Function at 0x1004c43a
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008bb91
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa64
push esi
and dword [ebp - 0x18], 0
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10050bf4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4e4], eax
mov dword [ebp - 0x1a0], 1
push 3
lea ecx, [ebp - 0x214]
call fcn.10018d3c
and dword [ebp - 4], 0
push 2
lea ecx, [ebp - 0x7e8]
call fcn.10018d3c
mov byte [ebp - 4], 1
mov dword [ebp - 0x54c], 0x9b4af7bd
mov dword [ebp - 0x554], 0x22803359
mov dword [ebp - 0x538], 0
mov dword [ebp - 0x8ec], 0xfffffffc
mov dword [ebp - 0xf0], 0
jmp 0x1004c4e5
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 3
jge 0x1004c507
push dword [ebp - 0xf0]
lea ecx, [ebp - 0x214]
call fcn.10018dda
mov dword [eax], 0x4a8b108f
jmp 0x1004c4d8
push 0x59cd
push 0x224f
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0x7e8]
push eax
push 0
call fcn.1004b71f
add esp, 0x14
mov esi, dword [ebp - 0x1a0]
push 0
lea ecx, [ebp - 0x214]
call fcn.10018dda
mov dword [eax], esi
push 0
lea ecx, [ebp - 0x214]
call fcn.10018dda
push 1
lea ecx, [ebp - 0x7e8]
call fcn.10018dda
mov dword [ebp - 0x368], eax
push 0
lea ecx, [ebp - 0x214]
call fcn.10018dda
mov ecx, dword [ebp - 0x368]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x368]
cmp dword [eax], 0
je 0x1004c595
mov eax, 0x360d
test eax, eax
je 0x1004c595
mov dword [ebp - 0x508], 1
jmp 0x1004c59c
and dword [ebp - 0x508], 0
push 0
lea ecx, [ebp - 0x214]
call fcn.10018dda
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [eax]
je 0x1004c5c8
cmp dword [ebp - 0x1a0], 0
je 0x1004c5c8
mov dword [ebp - 0x510], 1
jmp 0x1004c5cf
and dword [ebp - 0x510], 0
cmp dword [ebp - 0x510], 0x27d373ee
jg 0x1004c5e7
mov dword [ebp - 0x680], 1
jmp 0x1004c5ee
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x878], eax
mov esi, dword [ebp - 0x1a0]
push 0
lea ecx, [ebp - 0x214]
call fcn.10018dda
cmp esi, dword [eax]
jne 0x1004c61d
mov dword [ebp - 0x518], 1
jmp 0x1004c624
and dword [ebp - 0x518], 0
cmp dword [ebp - 0x518], 0xf39c
jle 0x1004c63c
mov dword [ebp - 0x520], 1
jmp 0x1004c643
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x54c], eax
mov esi, dword [ebp - 0x54c]
push 0
lea ecx, [ebp - 0x214]
call fcn.10018dda
add esi, dword [eax]
mov dword [ebp - 0x554], esi
mov esi, dword [ebp - 0x554]
push 0
lea ecx, [ebp - 0x214]
call fcn.10018dda
cmp esi, dword [eax]
jl 0x1004c68d
mov dword [ebp - 0x55c], 1
jmp 0x1004c694
and dword [ebp - 0x55c], 0
push 0
lea ecx, [ebp - 0x214]
call fcn.10018dda
mov ecx, dword [ebp - 0x55c]
cmp ecx, dword [eax]
jg 0x1004c6b7
mov dword [ebp - 0x56c], 1
jmp 0x1004c6be
and dword [ebp - 0x56c], 0
push 1
lea ecx, [ebp - 0x214]
call fcn.10018dda
mov ecx, dword [ebp - 0x56c]
sub ecx, dword [eax]
mov dword [ebp - 0x538], ecx
cmp dword [ebp - 0x538], 0xd94b
je 0x1004c6f1
mov dword [ebp - 0x43c], 1
jmp 0x1004c6f8
and dword [ebp - 0x43c], 0
push 0
lea ecx, [ebp - 0x214]
call fcn.10018dda
mov eax, dword [eax]
cmp eax, dword [ebp - 0x43c]
jge 0x1004c71b
mov dword [ebp - 0x500], 1
jmp 0x1004c722
and dword [ebp - 0x500], 0
cmp dword [ebp - 0x500], 0
je 0x1004c737
mov dword [ebp - 0x2f4], 1
jmp 0x1004c73e
and dword [ebp - 0x2f4], 0
push 0
lea ecx, [ebp - 0x214]
call fcn.10018dda
mov ecx, dword [ebp - 0x2f4]
mov dword [eax], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7e8]
call fcn.10018dbe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x214]
call fcn.10018dbe
mov eax, dword [ebp - 0x4e4]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1004c786
jmp 0x10050c23
mov dword [ebp - 0x854], 0x2ca3c0bf
mov dword [ebp - 0x148], 0
jmp 0x1004c7a9
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 2
jge 0x1004c7c5
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x870], 0x93b4
jmp 0x1004c79c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x870], 0
je 0x1004c7ee
mov dword [ebp - 0x5f0], 0x33ef
mov dword [ebp - 0x5f0], 0x643cdf98
jmp 0x1004c889
mov dword [ebp - 0x14c], 8
mov dword [ebp - 0x14c], 1
jmp 0x1004c811
mov eax, dword [ebp - 0x14c]
dec eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jl 0x1004c889
mov dword [ebp - 0x18c], 0xffffffff
mov byte [ebp - 0x7e], 0
movzx eax, byte [ebp - 0x7e]
test eax, eax
je 0x1004c844
push 0x1212
push 1
push 0x7475
call fcn.1004b0cd
add esp, 0xc
mov dword [ebp - 0x18c], 0
jmp 0x1004c85d
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 1
jg 0x1004c884
mov byte [ebp - 0x79], 0
push 0
push 0x6d8
push 0x4e26
lea eax, [ebp - 0x79]
push eax
call fcn.1004bd9e
add esp, 0x10
jmp 0x1004c850
jmp 0x1004c804
mov eax, dword [ebp - 0x4e4]
mov ecx, dword [ebp - 0x24]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xbc], ecx
mov dword [ebp - 0x2c], 0xa4a9bdba
push 2
lea ecx, [ebp - 0x5b8]
call fcn.10018d3c
mov dword [ebp - 4], 2
mov dword [ebp - 0x608], 9
push 0x2e37
push 0
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x5b8]
push eax
call fcn.1004b134
add esp, 0x10
mov dword [ebp - 0x100], 0
jmp 0x1004c8f6
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 2
jge 0x1004c912
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x294], 0xfffffff6
jmp 0x1004c8e9
cmp dword [ebp - 0x2c], 0
je 0x1004c95c
mov byte [ebp - 0xbd], 0
lea eax, [ebp - 0xbd]
push eax
push 1
push 0x2ddf
push 0x3bcf
call fcn.1004b134
add esp, 0x10
mov byte [ebp - 0x9d], 0
lea eax, [ebp - 0x9d]
push eax
push 1
push 0x5e95
call fcn.1004b1b1
add esp, 0xc
jmp 0x1004cec3
push 3
lea ecx, [ebp - 0x2d8]
call fcn.10018d3c
mov byte [ebp - 4], 3
mov dword [ebp - 0x154], 0
jmp 0x1004c986
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jge 0x1004c9a8
push dword [ebp - 0x154]
lea ecx, [ebp - 0x2d8]
call fcn.10018dda
mov dword [eax], 1
jmp 0x1004c979
mov dword [ebp - 0x2c], 0
jmp 0x1004c9b8
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jg 0x1004caff
mov dword [ebp - 0x1ac], 0
push 0x6e24
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x2b0c
push 0
lea eax, [ebp - 0x5b8]
push eax
call fcn.1004bc4a
add esp, 0x18
mov dword [ebp - 0x1ac], 0
jmp 0x1004ca0b
mov eax, dword [ebp - 0x1ac]
dec eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0xffffffeb
jl 0x1004cafa
mov dword [ebp - 0x5f8], 0x57a6
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x5b8]
call fcn.10018dda
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x5b8]
call fcn.10018dda
mov esi, eax
push 1
lea ecx, [ebp - 0x2d8]
call fcn.10018dda
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x1004ca5f
mov dword [ebp - 0x2fc], 1
jmp 0x1004ca66
and dword [ebp - 0x2fc], 0
push 0
lea ecx, [ebp - 0x5b8]
call fcn.10018dda
mov eax, dword [eax]
add eax, 0xd62e652
jne 0x1004ca88
mov dword [ebp - 0x444], 1
jmp 0x1004ca8f
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x2fc]
cmp eax, dword [ebp - 0x444]
jne 0x1004caa9
mov dword [ebp - 0x304], 1
jmp 0x1004cab0
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x304]
neg eax
cmp eax, 0xffffffff
jle 0x1004cacd
push 4
pop eax
test eax, eax
jne 0x1004cacd
and dword [ebp - 0x564], 0
jmp 0x1004cad7
mov dword [ebp - 0x564], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x564]
mov dword [ebp + eax - 0x294], ecx
cmp dword [ebp - 0x5f8], 0
je 0x1004caf5
jmp 0x1004cafa
jmp 0x1004c9fe
jmp 0x1004c9b1
mov dword [ebp - 0x2c], 0
jmp 0x1004cb0f
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xe
jle 0x1004ceb4
mov dword [ebp - 0x15c], 0x67bbda73
mov dword [ebp - 0x58], 0
jmp 0x1004cb33
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x1004cb49
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x2a0], 0x7e3bc4ae
jmp 0x1004cb2c
mov dword [ebp - 0x58], 0
jmp 0x1004cb59
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1004cb6f
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x2bc], 0xd413053b
jmp 0x1004cb52
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2a0], 0xfffffffa
jmp 0x1004cb9d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2a0]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2a0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2a0], 0xffffffe7
jg 0x1004ceaf
mov dword [ebp - 0x314], 0xc0b8072
mov dword [ebp - 0x84], 0xfffffffa
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x294]
mov dword [ebp - 0x87c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
jne 0x1004ccfa
push 2
lea ecx, [ebp - 0x2d8]
call fcn.10018dda
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x294]
cmp dword [ebp + eax - 0x294], ecx
jg 0x1004cc23
mov dword [ebp - 0x30c], 1
jmp 0x1004cc2a
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x30c], eax
jge 0x1004cc44
mov dword [ebp - 0x600], 1
jmp 0x1004cc4b
and dword [ebp - 0x600], 0
push 1
lea ecx, [ebp - 0x2d8]
call fcn.10018dda
mov eax, dword [ebp - 0x15c]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x2a0]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x294]
test eax, eax
jne 0x1004cc97
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x294], 0
jne 0x1004cc97
and dword [ebp - 0x44c], 0
jmp 0x1004cca1
mov dword [ebp - 0x44c], 1
push 1
lea ecx, [ebp - 0x2d8]
call fcn.10018dda
mov eax, dword [eax]
neg eax
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x44c]
lea eax, [ecx + eax - 1]
cmp dword [ebp - 0x314], eax
jle 0x1004ccdc
mov dword [ebp - 0x4ec], 1
jmp 0x1004cce3
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x4ec], eax
jg 0x1004ccfa
and dword [ebp - 0x454], 0
jmp 0x1004cd04
mov dword [ebp - 0x454], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2a0]
mov dword [ebp - 0x31c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x31c]
mov dword [ebp + eax - 0x2bc], ecx
mov eax, dword [ebp - 0x31c]
add eax, dword [ebp - 0x454]
cmp eax, dword [ebp - 0x84]
jl 0x1004cd4d
cmp dword [ebp - 0x2c], 0
jne 0x1004cd4d
and dword [ebp - 0x324], 0
jmp 0x1004cd57
mov dword [ebp - 0x324], 1
mov eax, dword [ebp - 0x84]
imul eax, dword [ebp - 0x324]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x294]
jl 0x1004cd7f
mov dword [ebp - 0x540], 1
jmp 0x1004cd86
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x608]
cmp dword [ebp - 0x540], eax
jne 0x1004cda7
push 3
pop eax
test eax, eax
je 0x1004cda7
mov dword [ebp - 0x32c], 1
jmp 0x1004cdae
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x84], eax
push 1
lea ecx, [ebp - 0x2d8]
call fcn.10018dda
mov esi, eax
push 1
lea ecx, [ebp - 0x2d8]
call fcn.10018dda
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x1004cde8
mov dword [ebp - 0x45c], 1
jmp 0x1004cdef
and dword [ebp - 0x45c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2a0]
sub eax, dword [ebp - 0x45c]
cmp eax, 1
jge 0x1004ce13
mov dword [ebp - 0x334], 1
jmp 0x1004ce1a
and dword [ebp - 0x334], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2bc]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xd9258c0f
je 0x1004ce45
mov dword [ebp - 0x4f4], 1
jmp 0x1004ce4c
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x334]
cmp eax, dword [ebp - 0x4f4]
je 0x1004ce66
mov dword [ebp - 0x33c], 1
jmp 0x1004ce6d
and dword [ebp - 0x33c], 0
push 1
lea ecx, [ebp - 0x2d8]
call fcn.10018dda
mov ecx, dword [ebp - 0x33c]
cmp ecx, dword [eax]
jle 0x1004ce90
mov dword [ebp - 0x464], 1
jmp 0x1004ce97
and dword [ebp - 0x464], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x464]
mov dword [ebp + eax - 0x2bc], ecx
jmp 0x1004cb82
jmp 0x1004cb08
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2d8]
call fcn.10018dbe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5b8]
call fcn.10018dbe
mov eax, dword [ebp - 0xbc]
cmp dword [eax], 0x4550
je 0x1004cee5
jmp 0x10050c23
mov dword [ebp - 0xc8], 0xfffffffc
push 1
lea ecx, [ebp - 0x2e4]
call fcn.10018d3c
mov dword [ebp - 4], 4
mov dword [ebp - 0x610], 0xffffffff
push 3
lea ecx, [ebp - 0x6ec]
call fcn.10018d3c
mov byte [ebp - 4], 5
mov dword [ebp - 0x664], 0xffffffff
mov dword [ebp - 0x4c], 0
jmp 0x1004cf38
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1004cf54
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x2e4]
call fcn.10018dda
mov dword [eax], 3
jmp 0x1004cf31
mov dword [ebp - 0x4c], 0
jmp 0x1004cf64
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1004cf7a
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x8c], 0xdb6084ed
jmp 0x1004cf5d
push 0x48e3
lea eax, [ebp - 0x4c]
push eax
push 0x5883
push 0x7242
lea eax, [ebp - 0x6ec]
push eax
push 0x5d32
push 0x479
push 0x3848
push 0x53c0
push 0x3d4a
push 0x3720
push 1
call fcn.1004b201
add esp, 0x30
mov esi, dword [ebp - 0xc8]
push 0
lea ecx, [ebp - 0x2e4]
call fcn.10018dda
mov dword [eax], esi
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x85c], eax
push 0
lea ecx, [ebp - 0x2e4]
call fcn.10018dda
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x8c]
cmp dword [eax], ecx
jg 0x1004d007
mov dword [ebp - 0x344], 1
jmp 0x1004d00e
and dword [ebp - 0x344], 0
push 0
lea ecx, [ebp - 0x2e4]
call fcn.10018dda
mov ecx, dword [ebp - 0x344]
cmp ecx, dword [eax]
jne 0x1004d031
mov dword [ebp - 0x560], 1
jmp 0x1004d038
and dword [ebp - 0x560], 0
cmp dword [ebp - 0x560], 0
je 0x1004d05d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8c], 0
je 0x1004d05d
mov dword [ebp - 0x34c], 1
jmp 0x1004d064
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0x610], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8c], 0x81c1d99e
jb 0x1004d08f
mov dword [ebp - 0x46c], 1
jmp 0x1004d096
and dword [ebp - 0x46c], 0
push 0
lea ecx, [ebp - 0x2e4]
call fcn.10018dda
mov ecx, dword [ebp - 0x46c]
sub ecx, dword [eax]
cmp ecx, 0x64854668
jne 0x1004d0bf
mov dword [ebp - 0x354], 1
jmp 0x1004d0c6
and dword [ebp - 0x354], 0
push 0
lea ecx, [ebp - 0x2e4]
call fcn.10018dda
mov ecx, dword [ebp - 0x354]
sub ecx, dword [eax]
cmp ecx, 0xffff
jne 0x1004d0ef
mov dword [ebp - 0x65c], 1
jmp 0x1004d0f6
and dword [ebp - 0x65c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c]
mov dword [ebp - 0x884], eax
push 0
lea ecx, [ebp - 0x2e4]
call fcn.10018dda
mov eax, dword [eax]
sub eax, dword [ebp - 0xc8]
cmp eax, 0x5520f303
jge 0x1004d131
mov dword [ebp - 0x4fc], 1
jmp 0x1004d138
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x4fc], eax
jl 0x1004d152
mov dword [ebp - 0x26c], 1
jmp 0x1004d159
and dword [ebp - 0x26c], 0
push 0
lea ecx, [ebp - 0x2e4]
call fcn.10018dda
mov ecx, dword [ebp - 0x26c]
mov dword [eax], ecx
cmp dword [ebp - 0x26c], 0
jne 0x1004d189
mov eax, 0xffff
test eax, eax
jne 0x1004d189
and dword [ebp - 0x35c], 0
jmp 0x1004d193
mov dword [ebp - 0x35c], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x35c]
sub ecx, dword [ebp + eax - 0x8c]
je 0x1004d1bd
cmp dword [ebp - 0xc8], 0
je 0x1004d1bd
mov dword [ebp - 0x474], 1
jmp 0x1004d1c4
and dword [ebp - 0x474], 0
push 1
lea ecx, [ebp - 0x6ec]
call fcn.10018dda
mov ecx, dword [ebp - 0x474]
cmp ecx, dword [eax]
je 0x1004d1e7
mov dword [ebp - 0x364], 1
jmp 0x1004d1ee
and dword [ebp - 0x364], 0
push 1
lea ecx, [ebp - 0x6ec]
call fcn.10018dda
mov ecx, dword [ebp - 0x364]
cmp ecx, dword [eax]
jne 0x1004d211
mov dword [ebp - 0x548], 1
jmp 0x1004d218
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x548]
neg eax
cmp dword [ebp - 0xc8], eax
je 0x1004d234
mov dword [ebp - 0x36c], 1
jmp 0x1004d23b
and dword [ebp - 0x36c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c]
imul eax, dword [ebp - 0x36c]
cmp eax, 0xdeb47635
jbe 0x1004d262
mov dword [ebp - 0x47c], 1
jmp 0x1004d269
and dword [ebp - 0x47c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c]
cmp dword [ebp - 0x47c], eax
jl 0x1004d28a
mov dword [ebp - 0x374], 1
jmp 0x1004d291
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x664], eax
push 0
lea ecx, [ebp - 0x2e4]
call fcn.10018dda
mov dword [eax], 0xbc35cf45
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x6ec]
call fcn.10018dbe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2e4]
call fcn.10018dbe
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbc]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x864], 0x845d811f
mov dword [ebp - 0x88c], 0x662a2b3b
push 3
lea ecx, [ebp - 0x57c]
call fcn.10018d3c
mov dword [ebp - 4], 6
push 4
lea ecx, [ebp - 0x728]
call fcn.10018d3c
mov byte [ebp - 4], 7
mov dword [ebp - 0x66c], 0x8637
push 2
lea ecx, [ebp - 0x710]
call fcn.10018d3c
mov byte [ebp - 4], 8
mov dword [ebp - 0x67c], 0x40dfe9f4
mov dword [ebp - 0x54], 0
jmp 0x1004d34f
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x1004d36b
push dword [ebp - 0x54]
lea ecx, [ebp - 0x57c]
call fcn.10018dda
mov dword [eax], 7
jmp 0x1004d348
mov dword [ebp - 0x54], 0
jmp 0x1004d37b
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x1004d397
push dword [ebp - 0x54]
lea ecx, [ebp - 0x728]
call fcn.10018dda
mov dword [eax], 0xa927213e
jmp 0x1004d374
push 0x1803
lea eax, [ebp - 0x54]
push eax
push 0
lea eax, [ebp - 0x710]
push eax
call fcn.1004c0ff
add esp, 0x10
push 3
lea ecx, [ebp - 0x728]
call fcn.10018dda
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x2a4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x2a4]
mov dword [ecx], eax
mov eax, dword [ebp - 0x2a4]
cmp dword [eax], 0
jne 0x1004d4e0
push 3
lea ecx, [ebp - 0x728]
call fcn.10018dda
push 1
lea ecx, [ebp - 0x710]
call fcn.10018dda
mov eax, dword [eax]
neg eax
cmp eax, 0x6721f7d
jne 0x1004d415
mov dword [ebp - 0x504], 1
jmp 0x1004d41c
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x66c]
cmp eax, dword [ebp - 0x504]
je 0x1004d445
push 0
lea ecx, [ebp - 0x57c]
call fcn.10018dda
cmp dword [eax], 0
jne 0x1004d445
and dword [ebp - 0x37c], 0
jmp 0x1004d44f
mov dword [ebp - 0x37c], 1
push 0
lea ecx, [ebp - 0x57c]
call fcn.10018dda
mov ecx, dword [ebp - 0x37c]
imul ecx, dword [eax]
test ecx, ecx
je 0x1004d47e
mov eax, 0xfffb
test eax, eax
je 0x1004d47e
mov dword [ebp - 0x484], 1
jmp 0x1004d485
and dword [ebp - 0x484], 0
push 0
lea ecx, [ebp - 0x57c]
call fcn.10018dda
mov ecx, dword [ebp - 0x484]
cmp ecx, dword [eax]
jge 0x1004d4a8
mov dword [ebp - 0x384], 1
jmp 0x1004d4af
and dword [ebp - 0x384], 0
cmp dword [ebp - 0x384], 0xa9d9e177
ja 0x1004d4c7
mov dword [ebp - 0x568], 1
jmp 0x1004d4ce
and dword [ebp - 0x568], 0
cmp dword [ebp - 0x568], 0xfffffffb
jne 0x1004d4e0
and dword [ebp - 0x38c], 0
jmp 0x1004d4ea
mov dword [ebp - 0x38c], 1
cmp dword [ebp - 0x38c], 1
je 0x1004d4ff
mov dword [ebp - 0x674], 1
jmp 0x1004d506
and dword [ebp - 0x674], 0
push 1
lea ecx, [ebp - 0x710]
call fcn.10018dda
mov esi, eax
push 2
lea ecx, [ebp - 0x57c]
call fcn.10018dda
mov esi, dword [esi]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x57c]
call fcn.10018dda
cmp esi, dword [eax]
jle 0x1004d544
mov dword [ebp - 0x48c], 1
jmp 0x1004d54b
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x67c], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x710]
call fcn.10018dbe
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x728]
call fcn.10018dbe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x57c]
call fcn.10018dbe
mov eax, dword [ebp - 0x40]
cmp dword [eax + 4], 0
jne 0x1004d592
jmp 0x10050c23
mov dword [ebp - 0xf8], 0x29c1464f
mov dword [ebp - 0x394], 1
mov dword [ebp - 0x494], 0xfffffffe
mov dword [ebp - 0x3ac], 0
mov dword [ebp - 0x394], 1
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x394], eax
jl 0x1004d5de
mov dword [ebp - 0x50c], 1
jmp 0x1004d5e5
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0xf8]
sub eax, dword [ebp - 0x50c]
cmp eax, 0xfffffff6
jbe 0x1004d602
mov dword [ebp - 0x39c], 1
jmp 0x1004d609
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x494], eax
jl 0x1004d62f
mov dword [ebp - 0x3a4], 1
jmp 0x1004d636
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x3a4], eax
jle 0x1004d650
mov dword [ebp - 0x550], 1
jmp 0x1004d657
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x550]
inc eax
inc eax
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x3ac], eax
jne 0x1004d6a4
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x1004d6a2
push 0
push 0x345
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
jmp 0x1004d6e2
mov byte [ebp - 0xa5], 0
lea eax, [ebp - 0xa5]
push eax
push 0x2de4
push 0x5654
push 1
call fcn.1004b380
add esp, 0x10
mov byte [ebp - 0x7a], 0
push 0x6f24
push 0x752b
push 1
lea eax, [ebp - 0x7a]
push eax
call fcn.1004b3eb
add esp, 0x10
and dword [ebp - 0x20], 0
mov dword [ebp - 0x6c], 0x9841b3c6
mov dword [ebp - 0x164], 2
mov dword [ebp - 0x570], 8
mov dword [ebp - 0x68c], 0x888c5540
mov dword [ebp - 0x694], 1
mov dword [ebp - 0x69c], 0xfffffffd
push 2
lea ecx, [ebp - 0x89c]
call fcn.10018d3c
mov dword [ebp - 4], 9
mov dword [ebp - 0x6cc], 0x1919b17c
mov dword [ebp - 0x5c], 0
jmp 0x1004d74d
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x1004d763
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x61c], 0xfffffff9
jmp 0x1004d746
mov dword [ebp - 0x5c], 0
jmp 0x1004d773
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x1004d78f
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x89c]
call fcn.10018dda
mov dword [eax], 7
jmp 0x1004d76c
mov dword [ebp - 0x6c], 0xffffffe4
jmp 0x1004d79f
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x19
jne 0x1004d9bc
mov dword [ebp - 0x49c], 0x649b
mov dword [ebp - 0x194], 0
jmp 0x1004d7cc
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 2
jge 0x1004d7e8
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x52c], 0xfffb
jmp 0x1004d7bf
mov dword [ebp - 0x164], 0x9febb674
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x52c], 0
jne 0x1004d84e
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x49c], eax
jg 0x1004d822
mov dword [ebp - 0x274], 1
jmp 0x1004d829
and dword [ebp - 0x274], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x274]
mov dword [ebp + eax - 0x61c], ecx
cmp dword [ebp - 0x274], 0
jne 0x1004d84e
and dword [ebp - 0x3b4], 0
jmp 0x1004d858
mov dword [ebp - 0x3b4], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x52c]
cmp dword [ebp - 0x3b4], eax
jle 0x1004d889
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x61c], 0
je 0x1004d889
mov dword [ebp - 0x684], 1
jmp 0x1004d890
and dword [ebp - 0x684], 0
cmp dword [ebp - 0x68c], 0xb357
jge 0x1004d8a8
mov dword [ebp - 0x514], 1
jmp 0x1004d8af
and dword [ebp - 0x514], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x52c]
imul eax, dword [ebp - 0x514]
cmp eax, dword [ebp - 0x164]
jl 0x1004d8d7
mov dword [ebp - 0x3bc], 1
jmp 0x1004d8de
and dword [ebp - 0x3bc], 0
cmp dword [ebp - 0x3bc], 0
je 0x1004d8f3
mov dword [ebp - 0x4a4], 1
jmp 0x1004d8fa
and dword [ebp - 0x4a4], 0
cmp dword [ebp - 0x4a4], 0x7473
jle 0x1004d912
mov dword [ebp - 0x3c4], 1
jmp 0x1004d919
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x694]
imul eax, dword [ebp - 0x3c4]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x52c]
cmp eax, dword [ebp - 0x6c]
jl 0x1004d944
mov dword [ebp - 0x3cc], 1
jmp 0x1004d94b
and dword [ebp - 0x3cc], 0
mov dword [ebp - 0x570], 0xfffffffb
mov eax, dword [ebp - 0x570]
cmp eax, dword [ebp - 0x3cc]
je 0x1004d967
cmp dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x880], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x164]
cmp dword [ebp + eax - 0x61c], ecx
jle 0x1004d9a4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x52c], 0
je 0x1004d9a4
mov dword [ebp - 0x4ac], 1
jmp 0x1004d9ab
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x69c], eax
jmp 0x1004d798
push 0x7358
push 0x3015
push 1
lea eax, [ebp - 0x6cc]
push eax
call fcn.1004b46d
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x89c]
call fcn.10018dbe
mov eax, dword [ebp - 0xbc]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0xbc]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x70], 0xce125d16
mov dword [ebp - 0x1bc], 0
jmp 0x1004da20
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 1
jge 0x1004da3c
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0xd4], 0
jmp 0x1004da13
mov dword [ebp - 0x70], 0
jmp 0x1004da4c
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jl 0x1004db44
mov dword [ebp - 0x94], 0x1891f782
mov byte [ebp - 0x7c], 0
lea eax, [ebp - 0x7c]
push eax
push 0
push 0x44d9
call fcn.1004c43a
add esp, 0xc
mov dword [ebp - 0x94], 0
jmp 0x1004da90
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x1004db3f
mov dword [ebp - 0x16c], 0
jmp 0x1004dab6
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 3
jge 0x1004dad2
mov eax, dword [ebp - 0x16c]
mov dword [ebp + eax*4 - 0x740], 0xdfe4b283
jmp 0x1004daa9
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x740], 0
jmp 0x1004dafd
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x740]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x740], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x740], 0
jl 0x1004db3a
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x94]
mov eax, dword [ebp + eax*4 - 0xd4]
mov dword [ebp + ecx*4 - 0xd4], eax
mov eax, dword [ebp - 0x94]
cmp dword [ebp + eax*4 - 0xd4], 0
je 0x1004db38
jmp 0x1004dae4
jmp 0x1004dae4
jmp 0x1004da83
jmp 0x1004da45
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd4], 0
je 0x1004dbc6
mov eax, dword [ebp - 0x70]
add eax, dword [ebp - 0x70]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xd4]
jl 0x1004dba1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd4], 0x3563
je 0x1004db88
mov dword [ebp - 0x3d4], 1
jmp 0x1004db8f
and dword [ebp - 0x3d4], 0
cmp dword [ebp - 0x3d4], 3
jb 0x1004dba1
and dword [ebp - 0x51c], 0
jmp 0x1004dbab
mov dword [ebp - 0x51c], 1
imul eax, dword [ebp - 0x51c], 0xe55a
cmp eax, dword [ebp - 0x70]
jg 0x1004dbc6
mov dword [ebp - 0x3dc], 1
jmp 0x1004dbcd
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x70], eax
and dword [ebp - 0x2c4], 0
jmp 0x1004dbfb
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0xd0]
add eax, 0x28
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xbc]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x2c4], eax
jge 0x1004dc7c
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x4b4]
jb 0x1004dc77
mov eax, dword [ebp - 0xbc]
push dword [eax + 0x38]
mov eax, dword [ebp - 0xd0]
push dword [eax + 8]
call fcn.1004ad57
pop ecx
pop ecx
add eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x6a8]
jae 0x1004dc77
push 1
lea eax, [ebp - 0xd0]
push eax
push 0x8fe
lea eax, [ebp - 0x20]
push eax
call fcn.1004b4e3
add esp, 0x10
jmp 0x1004dc7c
jmp 0x1004dbdf
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x558], 0x89e022a5
mov dword [ebp - 0x4bc], 0xd2cc9105
mov dword [ebp - 0x524], 1
mov dword [ebp - 0x5d4], 0
mov dword [ebp - 0x910], 3
mov dword [ebp - 0x888], 1
mov dword [ebp - 0x8f4], 0
mov dword [ebp - 0x890], 7
mov dword [ebp - 0x920], 0xb462a77b
mov dword [ebp - 0x8a0], 0x883e
mov dword [ebp - 0x7fc], 0x5cbf7935
mov dword [ebp - 0x800], 4
mov dword [ebp - 0x808], 6
mov dword [ebp - 0x810], 0xfffffff6
mov dword [ebp - 0x534], 8
mov dword [ebp - 0x60], 0
jmp 0x1004dd2c
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 4
jge 0x1004dd42
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x6e0], 0xa29
jmp 0x1004dd25
mov dword [ebp - 0x60], 0
jmp 0x1004dd52
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1004dd68
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x9a0], 0xc06e3268
jmp 0x1004dd4b
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x818], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x9c]
cmp dword [ebp + eax - 0x6e0], ecx
jne 0x1004dd95
mov dword [ebp - 0x3e4], 1
jmp 0x1004dd9c
and dword [ebp - 0x3e4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3e4]
sub ecx, dword [ebp + eax - 0x6e0]
mov dword [ebp - 0x558], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6e0]
cmp eax, dword [ebp - 0x558]
je 0x1004ddd6
mov dword [ebp - 0x3ec], 1
jmp 0x1004dddd
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x4bc], eax
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x4bc], eax
jl 0x1004de03
mov dword [ebp - 0x628], 1
jmp 0x1004de0a
and dword [ebp - 0x628], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6e0]
mov dword [ebp - 0x820], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x828], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x6e0]
cmp dword [ebp - 0x9c], eax
jge 0x1004de4a
mov dword [ebp - 0x3f4], 1
jmp 0x1004de51
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x524], eax
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x524], eax
jne 0x1004de77
mov dword [ebp - 0x3fc], 1
jmp 0x1004de7e
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x3fc]
jge 0x1004de98
mov dword [ebp - 0x4c4], 1
jmp 0x1004de9f
and dword [ebp - 0x4c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6e0]
imul eax, dword [ebp - 0x4c4]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x6e0]
jge 0x1004dece
mov dword [ebp - 0x404], 1
jmp 0x1004ded5
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x404]
sub eax, 0x4a71b966
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp - 0x534]
dec eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x20], 0
jne 0x1004defe
jmp 0x10050c23
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0xa4], 0xd6273d59
mov dword [ebp - 0x830], 0
mov dword [ebp - 0x838], 0x87b3
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0
jmp 0x1004df3a
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x39
jge 0x1004e0e4
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x19c], 0
jmp 0x1004df64
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 4
jge 0x1004df80
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x93c], 0xffffffff
jmp 0x1004df57
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x840], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x93c], 1
jge 0x1004dfa5
mov dword [ebp - 0x5e8], 1
jmp 0x1004dfac
and dword [ebp - 0x5e8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x93c]
mov dword [ebp - 0x848], eax
cmp dword [ebp - 0x3c], 0xa516
jl 0x1004dfd7
cmp dword [ebp - 0x3c], 0
jne 0x1004dfd7
and dword [ebp - 0x40c], 0
jmp 0x1004dfe1
mov dword [ebp - 0x40c], 1
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x40c], eax
jl 0x1004dff8
mov dword [ebp - 0x4cc], 1
jmp 0x1004dfff
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x4cc]
cmp eax, dword [ebp - 0x3c]
jg 0x1004e019
mov dword [ebp - 0x414], 1
jmp 0x1004e020
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x3c], eax
jg 0x1004e042
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x68], eax
jmp 0x1004e06e
mov dword [ebp - 0x68], 0
jmp 0x1004e052
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jg 0x1004e06e
mov byte [ebp - 0x7f], 0
movzx eax, byte [ebp - 0x7f]
test eax, eax
je 0x1004e06c
push 1
call fcn.1004b540
pop ecx
jmp 0x1004e04b
mov dword [ebp - 0x68], 0x15
jmp 0x1004e07e
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0xf
jg 0x1004e0df
mov dword [ebp - 0x530], 0x585fafe4
mov dword [ebp - 0xa4], 0xffffffe9
jmp 0x1004e0a7
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0xfffffff5
jge 0x1004e0dd
mov dword [ebp - 0x850], 0x18bc698d
mov byte [ebp - 0x7b], 0
movzx eax, byte [ebp - 0x7b]
test eax, eax
je 0x1004e0ce
push 0
call fcn.1004bf7c
pop ecx
mov eax, dword [ebp - 0x530]
inc eax
mov dword [ebp - 0x530], eax
jmp 0x1004e09a
jmp 0x1004e077
jmp 0x1004df33
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax]
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x27c], 0xd9e177c4
mov dword [ebp - 0x688], 0
mov dword [ebp - 0x30], 0xfffffffe
jmp 0x1004e11d
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x12
jg 0x1004e13a
mov dword [ebp - 0x5cc], 0xc70c
cmp dword [ebp - 0x5cc], 0
je 0x1004e138
jmp 0x1004e13a
jmp 0x1004e116
mov dword [ebp - 0x30], 0
jmp 0x1004e14a
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffff3
je 0x1004e3e8
mov dword [ebp - 0x770], 0x62a2
mov dword [ebp - 0x76c], 0x62a2
mov dword [ebp - 0x768], 0x62a2
mov dword [ebp - 0x764], 0x62a2
lea ecx, [ebp - 0x27d]
call fcn.100092b3
push eax
lea eax, [ebp - 0x760]
push eax
lea eax, [ebp - 0x770]
push eax
lea ecx, [ebp - 0x950]
call fcn.10018de9
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x594]
call fcn.10018d98
mov dword [ebp - 4], 0xa
push 3
lea ecx, [ebp - 0x7d0]
call fcn.10018d3c
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x174], 0
jmp 0x1004e1e2
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 3
jge 0x1004e204
push dword [ebp - 0x174]
lea ecx, [ebp - 0x7d0]
call fcn.10018dda
mov dword [eax], 3
jmp 0x1004e1d5
cmp dword [ebp - 0x30], 0
jne 0x1004e219
cmp dword [ebp - 0x30], 0
jne 0x1004e219
and dword [ebp - 0x5dc], 0
jmp 0x1004e223
mov dword [ebp - 0x5dc], 1
cmp dword [ebp - 0x30], 0xffff8d28
jg 0x1004e238
mov dword [ebp - 0x41c], 1
jmp 0x1004e23f
and dword [ebp - 0x41c], 0
push 2
lea ecx, [ebp - 0x594]
call fcn.10018dda
mov ecx, dword [ebp - 0x41c]
cmp ecx, dword [eax]
jne 0x1004e262
mov dword [ebp - 0x4d4], 1
jmp 0x1004e269
and dword [ebp - 0x4d4], 0
cmp dword [ebp - 0x4d4], 8
jge 0x1004e281
cmp dword [ebp - 0x30], 0
jne 0x1004e281
and dword [ebp - 0x6c8], 0
jmp 0x1004e28b
mov dword [ebp - 0x6c8], 1
cmp dword [ebp - 0x30], 1
jne 0x1004e29d
mov dword [ebp - 0x424], 1
jmp 0x1004e2a4
and dword [ebp - 0x424], 0
cmp dword [ebp - 0x424], 0x223d
jge 0x1004e2bc
mov dword [ebp - 0x53c], 1
jmp 0x1004e2c3
and dword [ebp - 0x53c], 0
push 2
lea ecx, [ebp - 0x594]
call fcn.10018dda
mov ecx, dword [ebp - 0x53c]
imul ecx, dword [eax]
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0
je 0x1004e2fd
mov eax, 0x5fba2522
test eax, eax
je 0x1004e2fd
mov dword [ebp - 0x42c], 1
jmp 0x1004e304
and dword [ebp - 0x42c], 0
imul esi, dword [ebp - 0x42c], 0xffff
push 2
lea ecx, [ebp - 0x594]
call fcn.10018dda
cmp esi, dword [eax]
jg 0x1004e32b
mov dword [ebp - 0x5e4], 1
jmp 0x1004e332
and dword [ebp - 0x5e4], 0
push 2
lea ecx, [ebp - 0x594]
call fcn.10018dda
push 2
lea ecx, [ebp - 0x594]
call fcn.10018dda
push 7
pop eax
test eax, eax
je 0x1004e39a
mov dword [ebp - 0x5ec], 0x867f5d1c
push 1
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x594]
push eax
lea eax, [ebp - 0x7d0]
push eax
push 0x7bf0
push 0xb7
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x688]
push eax
lea eax, [ebp - 0x5ec]
push eax
call fcn.1004b566
add esp, 0x24
jmp 0x1004e3c5
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x1004e3c5
push 0x459b
push 1
push 0x41ac
push 0x6235
call fcn.1004b6c0
add esp, 0x10
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x7d0]
call fcn.10018dbe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x594]
call fcn.10018dbe
jmp 0x1004e143
xor ecx, ecx
call fcn.10032591
push eax
call fcn.100719a8
pop ecx
mov dword [ebp - 0x2b0], 3
mov dword [ebp - 0xac], 0xdc0e3e76
mov dword [ebp - 0x284], 1
mov dword [ebp - 0x5f4], 0xc56d
mov dword [ebp - 0x624], 3
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x2b0]
push eax
push 0x5a6c
push 0x53a5
push 1
call fcn.1004b71f
add esp, 0x14
cmp dword [ebp - 0xac], 0
jne 0x1004e471
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x858], eax
cmp dword [ebp - 0xac], 0
jne 0x1004e471
and dword [ebp - 0x4dc], 0
jmp 0x1004e47b
mov dword [ebp - 0x4dc], 1
mov eax, dword [ebp - 0x2b0]
cmp eax, dword [ebp - 0x4dc]
jge 0x1004e495
mov dword [ebp - 0x434], 1
jmp 0x1004e49c
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0x434], eax
jl 0x1004e4b6
mov dword [ebp - 0x544], 1
jmp 0x1004e4bd
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x284]
cmp dword [ebp - 0x544], eax
jl 0x1004e4d7
mov dword [ebp - 0x6a4], 1
jmp 0x1004e4de
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x860], eax
xor eax, eax
inc eax
je 0x1004e528
mov byte [ebp - 0xc0], 0
movzx eax, byte [ebp - 0xc0]
test eax, eax
je 0x1004e50f
push 0x2fa
push 0
call fcn.1004beca
pop ecx
pop ecx
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x1004e523
push 0
call fcn.1004b8db
pop ecx
jmp 0x1004e5ea
mov dword [ebp - 0x5fc], 0xffffffff
mov dword [ebp - 0x1b4], 0
jmp 0x1004e54b
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jge 0x1004e567
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x748], 0
jmp 0x1004e53e
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x748]
mov dword [ebp - 0x868], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5f4]
cmp dword [ebp + eax - 0x748], ecx
jge 0x1004e5a1
cmp dword [ebp - 0x624], 0
jne 0x1004e5a1
and dword [ebp - 0x2ec], 0
jmp 0x1004e5ab
mov dword [ebp - 0x2ec], 1
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x2ec]
sub eax, dword [ebp - 0x284]
cmp dword [ebp - 0xac], eax
jle 0x1004e5d7
mov dword [ebp - 0x2f0], 1
jmp 0x1004e5de
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x5fc], eax
mov dword [ebp - 0x874], 0xd33a4a9b
mov byte [ebp - 0xad], 0
movzx eax, byte [ebp - 0xad]
test eax, eax
je 0x1004e60e
push 0
call fcn.1004c00d
pop ecx
mov byte [ebp - 0x80], 0
movzx eax, byte [ebp - 0x80]
test eax, eax
je 0x1004e622
push 1
call fcn.1004b803
pop ecx
mov byte [ebp - 0x130], 8
mov byte [ebp - 0x12f], 0x97
mov byte [ebp - 0x12e], 5
mov byte [ebp - 0x12d], 1
mov byte [ebp - 0x12c], 7
mov byte [ebp - 0x12b], 7
mov byte [ebp - 0x12a], 1
mov byte [ebp - 0x129], 3
mov byte [ebp - 0x128], 9
mov byte [ebp - 0x127], 5
mov byte [ebp - 0x126], 4
mov byte [ebp - 0x125], 8
mov byte [ebp - 0x124], 0
mov byte [ebp - 0x123], 9
mov byte [ebp - 0x122], 6
mov byte [ebp - 0x121], 0
mov byte [ebp - 0x120], 3
mov byte [ebp - 0x11f], 6
mov byte [ebp - 0x11e], 9
mov byte [ebp - 0x11d], 0xf7
mov byte [ebp - 0x11c], 0x5b
mov byte [ebp - 0x11b], 0xe9
mov byte [ebp - 0x11a], 0xb0
mov byte [ebp - 0x119], 3
mov byte [ebp - 0x118], 0xee
mov byte [ebp - 0x117], 0xb1
mov byte [ebp - 0x116], 0x7e
mov byte [ebp - 0x115], 0x24
mov byte [ebp - 0x114], 2
mov byte [ebp - 0x113], 0
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x130]
or eax, 0xa7
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x130]
and ecx, 0xa7
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x130]
mov byte [ebp + ecx - 0x5a0], al
mov dword [ebp - 0x34], 2
and dword [ebp - 0x17c], 0
jmp 0x1004e74a
mov eax, dword [ebp - 0x34]
inc eax
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x1e
jae 0x1004e800
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x130]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x34], eax
jne 0x1004e794
mov eax, dword [ebp - 0x34]
movzx eax, byte [ebp + eax - 0x130]
inc eax
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [ebp + eax - 0x130]
mov ecx, dword [ebp - 0x34]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x34], eax
jmp 0x1004e742
mov eax, dword [ebp - 0x34]
movzx eax, byte [ebp + eax - 0x12f]
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x17c]
movzx ecx, byte [ebp + ecx - 0x132]
movsx ecx, byte [ebp + ecx - 0x5a0]
or eax, ecx
mov ecx, dword [ebp - 0x34]
movzx ecx, byte [ebp + ecx - 0x12f]
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x17c]
movzx edx, byte [ebp + edx - 0x132]
movsx edx, byte [ebp + edx - 0x5a0]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x34]
movzx ecx, byte [ebp + ecx - 0x130]
mov byte [ebp + ecx - 0x5a0], al
and dword [ebp - 0x17c], 0
jmp 0x1004e742
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x5a0], 0
mov dword [ebp - 0x5c8], 0xa5d6c05b
mov dword [ebp - 0x5c4], 0xa5d6c05b
mov dword [ebp - 0x5c0], 0xa5d6c05b
mov dword [ebp - 0x5bc], 0xa5d6c05b
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x2b8], 0x966ef3b0
mov dword [ebp - 0x28c], 0xc98aac1e
mov dword [ebp - 0x634], 0xffffffff
mov dword [ebp - 0x8f0], 9
mov dword [ebp - 0x1a4], 0
jmp 0x1004e888
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 3
jge 0x1004e8a4
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0xa1c], 0xf903a798
jmp 0x1004e87b
mov dword [ebp - 0x44], 0
jmp 0x1004e8b4
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jg 0x1004eaf9
mov dword [ebp - 0x604], 4
mov dword [ebp - 0x184], 0
jmp 0x1004e8e1
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 2
jge 0x1004e8fd
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x2ac], 0
jmp 0x1004e8d4
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2ac], 3
jmp 0x1004e92b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ac]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2ac], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2ac], 0
jl 0x1004eaf4
mov dword [ebp - 0x144], 0
jmp 0x1004e958
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jge 0x1004e974
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x62c], 0xd49598aa
jmp 0x1004e94b
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x5c8]
mov dword [ebp - 0x8f8], eax
cmp dword [ebp - 0x44], 0
jne 0x1004e99a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x62c], 0
je 0x1004ea18
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ac]
mov dword [ebp - 0x90c], eax
mov eax, 0xf4039ee4
test eax, eax
jb 0x1004e9c2
mov dword [ebp - 0x2f8], 1
jmp 0x1004e9c9
and dword [ebp - 0x2f8], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x5c8]
cmp dword [ebp - 0x2f8], eax
jl 0x1004e9ea
mov dword [ebp - 0x300], 1
jmp 0x1004e9f1
and dword [ebp - 0x300], 0
imul eax, dword [ebp - 0x300], 3
test eax, eax
je 0x1004ea0c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2ac], 0
je 0x1004ea18
mov dword [ebp - 0x308], 1
jmp 0x1004ea1f
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jne 0x1004ea4a
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x5c8], 0
jne 0x1004ea4a
and dword [ebp - 0x310], 0
jmp 0x1004ea54
mov dword [ebp - 0x310], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5c8]
cmp dword [ebp - 0x310], eax
jl 0x1004ea75
mov dword [ebp - 0x318], 1
jmp 0x1004ea7c
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x2b8], eax
imul eax, dword [ebp - 0x2b8], 0xe6a4
cmp eax, 0x1dd2e91c
jge 0x1004eaa5
mov dword [ebp - 0x320], 1
jmp 0x1004eaac
and dword [ebp - 0x320], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5c8]
imul eax, dword [ebp - 0x320]
mov dword [ebp - 0x28c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2ac]
mov dword [ebp - 0x914], eax
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x91c], eax
mov dword [ebp - 0x604], 0x8fc5674f
jmp 0x1004e910
jmp 0x1004e8ad
mov dword [ebp - 0x44], 0
jmp 0x1004eb09
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jg 0x1004ed95
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x160], 6
mov dword [ebp - 0x140], 0
jmp 0x1004eb40
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 1
jge 0x1004eb5c
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x158], 0x123020f6
jmp 0x1004eb33
push 4
pop eax
imul eax, eax, 0
mov ecx, 0x1c8
sub ecx, dword [ebp + eax - 0x158]
jne 0x1004ebb4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x158], 0x9150040b
jne 0x1004eb8f
mov dword [ebp - 0x328], 1
jmp 0x1004eb96
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0
jne 0x1004ebb4
and dword [ebp - 0x330], 0
jmp 0x1004ebbe
mov dword [ebp - 0x330], 1
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0
je 0x1004ec4d
mov dword [ebp - 0x2c8], 0xfffffffd
push 4
lea ecx, [ebp - 0x7dc]
call fcn.10018d3c
mov dword [ebp - 4], 0xc
push 1
lea eax, [ebp - 0x7dc]
push eax
push 0x7419
push 0x6b8f
lea eax, [ebp - 0x924]
push eax
push 0x54f6
call fcn.1004b839
add esp, 0x18
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x2c8], eax
mov esi, dword [ebp - 0x2c8]
push 2
lea ecx, [ebp - 0x7dc]
call fcn.10018dda
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7dc]
call fcn.10018dbe
jmp 0x1004ed7d
mov dword [ebp - 0x348], 0xffffffff
mov dword [ebp - 0x60c], 0x20245597
mov dword [ebp - 0x350], 0x2f725dc8
mov dword [ebp - 0x264], 0x46fac5ad
push 1
call fcn.1004b8db
pop ecx
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0x92c], eax
mov eax, 0x266c0953
test eax, eax
je 0x1004ed29
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x158], 0
jne 0x1004ecbb
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
je 0x1004ece1
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x918], eax
mov eax, dword [ebp - 0x350]
cmp dword [ebp - 0x2b8], eax
je 0x1004ece1
mov dword [ebp - 0x338], 1
jmp 0x1004ece8
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x60c]
cmp dword [ebp - 0x338], eax
jne 0x1004ed02
mov dword [ebp - 0x340], 1
jmp 0x1004ed09
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x340]
sub eax, dword [ebp - 0x348]
cmp eax, dword [ebp - 0x350]
jg 0x1004ed29
mov dword [ebp - 0x358], 1
jmp 0x1004ed30
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x63c], 8
ja 0x1004ed6a
mov dword [ebp - 0x360], 1
jmp 0x1004ed71
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x160], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x158]
mov dword [ebp - 0x160], eax
jmp 0x1004eb02
lea eax, [ebp - 0x5a0]
push eax
lea ecx, [ebp - 0x9e0]
call fcn.10027959
mov dword [ebp - 0x614], eax
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x644], eax
mov dword [ebp - 4], 0xd
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x644]
call fcn.10032551
pop ecx
mov dword [ebp - 0x648], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e0]
call fcn.10018c9e
mov dword [ebp - 0x78], 0xffffffff
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x620], 0xfffffffd
push 3
lea ecx, [ebp - 0x704]
call fcn.10018d3c
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x168], 0
jmp 0x1004ee2d
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 3
jge 0x1004ee4c
push dword [ebp - 0x168]
lea ecx, [ebp - 0x704]
call fcn.10018dda
and dword [eax], 0
jmp 0x1004ee20
mov dword [ebp - 0x78], 0xfffffffa
jmp 0x1004ee5c
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x1c
jle 0x1004eefd
mov dword [ebp - 0x75c], 0x25b0e446
mov dword [ebp - 0x758], 0x25b0e446
mov dword [ebp - 0x754], 0x25b0e446
mov dword [ebp - 0x750], 0x25b0e446
lea ecx, [ebp - 0x285]
call fcn.100092b3
push eax
lea eax, [ebp - 0x74c]
push eax
lea eax, [ebp - 0x75c]
push eax
lea ecx, [ebp - 0x990]
call fcn.10018de9
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x8ac]
call fcn.10018d98
mov byte [ebp - 4], 0xf
push 0
push 0x402b
lea eax, [ebp - 0x8ac]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x78cf
call fcn.1004c038
add esp, 0x14
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x8ac]
call fcn.10018dbe
jmp 0x1004ee55
cmp dword [ebp - 0x10c], 0
jne 0x1004ef0a
xor eax, eax
je 0x1004ef1c
cmp dword [ebp - 0x78], 0
je 0x1004ef1c
mov dword [ebp - 0x2e8], 1
jmp 0x1004ef23
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x2e8], eax
jg 0x1004ef3a
mov dword [ebp - 0x370], 1
jmp 0x1004ef41
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x370], eax
je 0x1004ef58
mov dword [ebp - 0x378], 1
jmp 0x1004ef5f
and dword [ebp - 0x378], 0
cmp dword [ebp - 0x378], 7
jg 0x1004ef74
mov dword [ebp - 0x380], 1
jmp 0x1004ef7b
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x380]
cmp dword [ebp - 0x78], eax
je 0x1004ef98
mov dword [ebp - 0x388], 1
jmp 0x1004ef9f
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x388]
neg eax
cmp eax, 0xa5b7
jne 0x1004efba
mov dword [ebp - 0x390], 1
jmp 0x1004efc1
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x620]
cmp dword [ebp - 0x390], eax
jl 0x1004efdb
mov dword [ebp - 0x398], 1
jmp 0x1004efe2
and dword [ebp - 0x398], 0
push 2
lea ecx, [ebp - 0x704]
call fcn.10018dda
mov ecx, dword [ebp - 0x398]
cmp ecx, dword [eax]
jne 0x1004f005
mov dword [ebp - 0x3a0], 1
jmp 0x1004f00c
and dword [ebp - 0x3a0], 0
push 2
lea ecx, [ebp - 0x704]
call fcn.10018dda
mov ecx, dword [ebp - 0x3a0]
imul ecx, dword [eax]
sub ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x10c], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x704]
call fcn.10018dbe
and dword [ebp - 0x170], 0
jmp 0x1004f053
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0xb
jae 0x1004f06c
mov eax, dword [ebp - 0x170]
mov byte [ebp + eax - 0x5a0], 0
jmp 0x1004f046
mov byte [ebp - 0x260], 8
mov byte [ebp - 0x25f], 0xfb
mov byte [ebp - 0x25e], 4
mov byte [ebp - 0x25d], 4
mov byte [ebp - 0x25c], 2
mov byte [ebp - 0x25b], 3
mov byte [ebp - 0x25a], 9
mov byte [ebp - 0x259], 7
mov byte [ebp - 0x258], 1
mov byte [ebp - 0x257], 6
mov byte [ebp - 0x256], 7
mov byte [ebp - 0x255], 0
mov byte [ebp - 0x254], 5
mov byte [ebp - 0x253], 7
mov byte [ebp - 0x252], 6
mov byte [ebp - 0x251], 8
mov byte [ebp - 0x250], 0
mov byte [ebp - 0x24f], 8
mov byte [ebp - 0x24e], 0x36
mov byte [ebp - 0x24d], 0x13
mov byte [ebp - 0x24c], 0xb3
mov byte [ebp - 0x24b], 0xfa
mov byte [ebp - 0x24a], 0x41
mov byte [ebp - 0x249], 0x8c
mov byte [ebp - 0x248], 0x2d
mov byte [ebp - 0x247], 0xef
mov byte [ebp - 0x246], 0x77
mov byte [ebp - 0x245], 0x7a
mov byte [ebp - 0x244], 0x40
mov byte [ebp - 0x243], 0x7d
mov byte [ebp - 0x242], 0x61
mov byte [ebp - 0x241], 0x3d
mov byte [ebp - 0x240], 0xd7
mov byte [ebp - 0x23f], 0xf7
mov byte [ebp - 0x23e], 0x13
mov byte [ebp - 0x23d], 0x20
mov byte [ebp - 0x23c], 0xba
mov byte [ebp - 0x23b], 0xcc
mov byte [ebp - 0x23a], 0xb8
mov byte [ebp - 0x239], 0x84
mov byte [ebp - 0x238], 0xdb
mov byte [ebp - 0x237], 0xa9
mov byte [ebp - 0x236], 0x69
mov byte [ebp - 0x235], 0x71
mov byte [ebp - 0x234], 0x6d
mov byte [ebp - 0x233], 0x55
mov byte [ebp - 0x232], 0x81
mov byte [ebp - 0x231], 0xa6
mov byte [ebp - 0x230], 5
mov byte [ebp - 0x22f], 0xd7
mov byte [ebp - 0x22e], 0x55
mov byte [ebp - 0x22d], 0x7f
mov byte [ebp - 0x22c], 0x41
mov byte [ebp - 0x22b], 8
mov byte [ebp - 0x22a], 0xfb
mov byte [ebp - 0x229], 0x31
mov byte [ebp - 0x228], 0xd2
mov byte [ebp - 0x227], 0x91
mov byte [ebp - 0x226], 0x7b
mov byte [ebp - 0x225], 0xce
mov byte [ebp - 0x224], 0xd3
mov byte [ebp - 0x223], 0xfa
mov byte [ebp - 0x222], 0x8c
mov byte [ebp - 0x221], 0xe
mov byte [ebp - 0x220], 0xba
mov byte [ebp - 0x21f], 0xd3
mov byte [ebp - 0x21e], 0xd4
mov byte [ebp - 0x21d], 0x32
mov byte [ebp - 0x21c], 0x70
mov byte [ebp - 0x21b], 0x13
mov byte [ebp - 0x21a], 0xb2
mov byte [ebp - 0x219], 0x29
mov byte [ebp - 0x218], 0xc3
mov byte [ebp - 0x217], 3
mov byte [ebp - 0x216], 3
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x260]
or eax, 0xcb
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x260]
and ecx, 0xcb
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x260]
mov byte [ebp + ecx - 0x5ac], al
mov dword [ebp - 0x38], 2
and dword [ebp - 0x134], 0
jmp 0x1004f2cf
cmp dword [ebp - 0x38], 0x4b
jae 0x1004f385
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x260]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x38], eax
jne 0x1004f319
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x5ac], 0
mov dword [ebp - 0xb4], 0xfffffff7
mov dword [ebp - 0x50], 0xfffffffd
push 1
lea ecx, [ebp - 0x588]
call fcn.10018d3c
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x408], 7
mov dword [ebp - 0x438], 6
mov dword [ebp - 0x64], 0
jmp 0x1004f3dc
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x5d8], eax
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 0x5e0], eax
mov eax, dword [ebp - 0x5e0]
movzx eax, byte [eax]
test eax, eax
je 0x10050c23
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret