Function at 0x100470b6
Capabilities:
Contain obfuscated stackstrings
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b7df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc5c
push esi
and dword [ebp - 0x18], 0
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1004cc43
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x9c], 0xffffffff
mov dword [ebp - 0x700], 0xe34edf6b
push 3
lea ecx, [ebp - 0x950]
call fcn.1000a48a
and dword [ebp - 4], 0
mov dword [ebp - 0x7b4], 0xffffffff
mov dword [ebp - 0x7dc], 0x47d228d5
mov dword [ebp - 0xa74], 0xb2b058ef
lea eax, [ebp - 0xa54]
push eax
lea eax, [ebp - 0x950]
push eax
push 0
push 0x67a1
push 0x691e
call fcn.10045d2b
add esp, 0x14
mov byte [ebp - 0xc7], 0
lea eax, [ebp - 0xc7]
push eax
push 0x5c44
push 0x7049
push 0
push 0x681c
call fcn.10046f3f
add esp, 0x14
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa90], eax
cmp dword [ebp - 0x9c], 0xfffffff8
jne 0x10047198
mov dword [ebp - 0x774], 1
jmp 0x1004719f
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x774], eax
jl 0x100471b9
mov dword [ebp - 0x6c0], 1
jmp 0x100471c0
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x6c0], eax
jle 0x100471da
mov dword [ebp - 0x6c8], 1
jmp 0x100471e1
and dword [ebp - 0x6c8], 0
cmp dword [ebp - 0x6c8], 0x4b1b055c
jge 0x100471f9
mov dword [ebp - 0x6d0], 1
jmp 0x10047200
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x6d0], eax
jg 0x1004721a
mov dword [ebp - 0x6f0], 1
jmp 0x10047221
and dword [ebp - 0x6f0], 0
cmp dword [ebp - 0x6f0], 2
jge 0x10047236
mov dword [ebp - 0x6f8], 1
jmp 0x1004723d
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x6f8]
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x700]
mov dword [ebp - 0x778], eax
push 1
lea ecx, [ebp - 0x950]
call fcn.1000a502
mov ecx, dword [ebp - 0x778]
mov dword [eax], ecx
mov eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0x778]
imul eax, eax, 0x2124
add eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x7b4]
je 0x10047296
mov dword [ebp - 0x780], 1
jmp 0x1004729d
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x7dc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x950]
call fcn.1000a4e6
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x6dc], eax
mov dword [ebp - 0x7e4], 1
mov dword [ebp - 0x7f4], 0
mov dword [ebp - 0x7ec], 0x530de9bf
push 2
lea ecx, [ebp - 0x9c8]
call fcn.1000a48a
mov dword [ebp - 4], 1
mov dword [ebp - 0x7fc], 1
mov dword [ebp - 0x1dc], 0
jmp 0x10047316
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 2
jge 0x10047338
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0x9c8]
call fcn.1000a502
mov dword [eax], 0x74a52027
jmp 0x10047309
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x1004735e
push 0x236e
push 0
push 0x26e1
call fcn.1004501e
add esp, 0xc
push 0
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x7ec]
push eax
push 0x5711
lea eax, [ebp - 0x7f4]
push eax
lea eax, [ebp - 0x9c8]
push eax
lea eax, [ebp - 0x7fc]
push eax
push 0x4392
call fcn.1004521a
add esp, 0x20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c8]
call fcn.1000a4e6
mov eax, dword [ebp - 0x6dc]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x100473b9
jmp 0x1004cc64
mov eax, dword [ebp - 0x6dc]
mov ecx, dword [ebp - 0x30]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0x188], 0x57fd5464
mov dword [ebp - 0x670], 0x55eec80f
mov dword [ebp - 0x3a8], 0xf37911b9
mov dword [ebp - 0x188], 0x13
jmp 0x10047402
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0x11
jg 0x100476a0
mov dword [ebp - 0x910], 0x2a2c7c8a
mov dword [ebp - 0x90c], 0x2a2c7c8a
mov dword [ebp - 0x908], 0x2a2c7c8a
mov dword [ebp - 0x904], 0x2a2c7c8a
lea ecx, [ebp - 0x339]
call fcn.1000a5ed
push eax
lea eax, [ebp - 0x900]
push eax
lea eax, [ebp - 0x910]
push eax
lea ecx, [ebp - 0xb94]
call fcn.100136d2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9e0]
call fcn.100136ac
mov dword [ebp - 4], 2
mov dword [ebp - 0xa4], 1
mov dword [ebp - 0xa4], 0
jmp 0x10047496
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jg 0x1004768c
mov dword [ebp - 0x318], 0x368a9017
mov dword [ebp - 0x15c], 0x9a2f3817
mov dword [ebp - 0x678], 0x481f3403
mov dword [ebp - 0x398], 0x1e60e779
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xa5c], eax
cmp dword [ebp - 0xa4], 0
jb 0x100474ec
mov dword [ebp - 0x390], 1
jmp 0x100474f3
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x15c]
imul eax, dword [ebp - 0x678]
cmp eax, dword [ebp - 0x670]
jge 0x10047514
mov dword [ebp - 0x804], 1
jmp 0x1004751b
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0xb30], eax
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x9e0]
call fcn.1000a502
mov dword [ebp - 0x59c], eax
push 3
lea ecx, [ebp - 0x9e0]
call fcn.1000a502
mov ecx, dword [ebp - 0x59c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x59c]
mov ecx, dword [ebp - 0x390]
cmp ecx, dword [eax]
jg 0x10047571
mov dword [ebp - 0x668], 1
jmp 0x10047578
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x398]
imul eax, dword [ebp - 0x318]
cmp eax, dword [ebp - 0x670]
je 0x100475a5
mov dword [ebp - 0x3a0], 1
jmp 0x100475ac
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp - 0x678]
cmp dword [ebp - 0x3a8], eax
jg 0x10047606
mov dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x680]
dec eax
mov dword [ebp - 0x680], eax
lea eax, [ebp - 0x318]
push eax
push 0x5e
push 0x60e7
push 0
push 0x3941
push 0x65be
push 0x60c4
call fcn.10044e71
add esp, 0x1c
jmp 0x10047661
mov dword [ebp - 0x3b0], 0xffffffff
mov dword [ebp - 0x15c], 0xfffffff5
jmp 0x10047629
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0x1a
jg 0x10047661
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x10047652
push 1
push 0x3bac
call fcn.1000b20c
pop ecx
pop ecx
mov eax, dword [ebp - 0x3b0]
inc eax
mov dword [ebp - 0x3b0], eax
jmp 0x1004761c
mov byte [ebp - 0x93], 0
movzx eax, byte [ebp - 0x93]
test eax, eax
je 0x10047687
push 0x6a4c
push 0
push 0x16b4
call fcn.1004539c
add esp, 0xc
jmp 0x10047489
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e0]
call fcn.1000a4e6
jmp 0x100473f5
mov eax, dword [ebp - 0xe4]
cmp dword [eax], 0x4550
je 0x100476b3
jmp 0x1004cc64
push 1
lea ecx, [ebp - 0x9d4]
call fcn.1000a48a
mov dword [ebp - 4], 3
mov dword [ebp - 0x824], 0
mov dword [ebp - 0x814], 0x9827359b
mov dword [ebp - 0x80c], 0x5411aa84
mov dword [ebp - 0x81c], 0
mov dword [ebp - 0x938], 0x48ab
mov dword [ebp - 0x934], 0x48ab
mov dword [ebp - 0x930], 0x48ab
mov dword [ebp - 0x92c], 0x48ab
lea ecx, [ebp - 0x341]
call fcn.1000a5ed
push eax
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0x938]
push eax
lea ecx, [ebp - 0xb54]
call fcn.100136d2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb40]
call fcn.100136ac
mov byte [ebp - 4], 4
mov dword [ebp - 0x1f8], 0
jmp 0x10047769
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 1
jge 0x1004778b
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0x9d4]
call fcn.1000a502
mov dword [eax], 0xe1ab
jmp 0x1004775c
push 0x133a
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x814]
push eax
push 1
lea eax, [ebp - 0x9d4]
push eax
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.10044e71
add esp, 0x1c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xb40]
call fcn.1000a4e6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9d4]
call fcn.1000a4e6
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xe4]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
cmp dword [eax + 4], 0
jne 0x100477fc
jmp 0x1004cc64
and dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0xe4]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0xe4]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x10c], 7
mov dword [ebp - 0x13c], 0x63384304
mov dword [ebp - 0x114], 0x145c1747
mov dword [ebp - 0x82c], 0x9d70cad
mov dword [ebp - 0xac], 0xffffffff
mov dword [ebp - 0x6b8], 0
mov dword [ebp - 0x10c], 0
jmp 0x1004786f
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xe
jle 0x10047d1a
push 2
lea ecx, [ebp - 0x314]
call fcn.1000a48a
mov dword [ebp - 4], 5
push 0x6b94
push 0x1725
push 0x6072
push 0x14e6
push 0
lea eax, [ebp - 0x314]
push eax
push 0x3bf3
lea eax, [ebp - 0xa7c]
push eax
call fcn.10046693
add esp, 0x20
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x100478e1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0
lea ecx, [ebp - 0x314]
call fcn.1000a502
and dword [eax], 0
jmp 0x10047917
push 0
lea ecx, [ebp - 0x314]
call fcn.1000a502
mov dword [ebp - 0x688], eax
mov eax, dword [ebp - 0x688]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x688]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x314]
call fcn.1000a502
cmp dword [eax], 7
je 0x10047d06
mov dword [ebp - 0x78], 0x89a5a40f
push 3
lea ecx, [ebp - 0x968]
call fcn.1000a48a
mov byte [ebp - 4], 6
lea eax, [ebp - 0xae8]
push eax
push 1
lea eax, [ebp - 0x968]
push eax
call fcn.1004501e
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x13c]
push eax
push 0x6506
push 0
call fcn.10045dc3
add esp, 0x10
mov dword [ebp - 0x13c], 0
jmp 0x10047993
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0x10
jle 0x10047cf2
mov dword [ebp - 0x370], 0xea0c8d46
xor eax, eax
inc eax
je 0x10047aac
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0xa84], eax
push 1
lea ecx, [ebp - 0x314]
call fcn.1000a502
push 0
lea ecx, [ebp - 0x314]
call fcn.1000a502
mov esi, eax
push 0
lea ecx, [ebp - 0x314]
call fcn.1000a502
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x100479fa
mov dword [ebp - 0x3b8], 1
jmp 0x10047a01
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x82c], eax
cmp dword [ebp - 0x78], 1
jl 0x10047a1f
mov dword [ebp - 0x690], 1
jmp 0x10047a26
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x690]
jle 0x10047a40
mov dword [ebp - 0x3c0], 1
jmp 0x10047a47
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x3c0]
neg eax
cmp dword [ebp - 0x78], eax
jge 0x10047a60
mov dword [ebp - 0x698], 1
jmp 0x10047a67
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x9ec0021f
jb 0x10047a94
cmp dword [ebp - 0xac], 0
je 0x10047a94
mov dword [ebp - 0x3c8], 1
jmp 0x10047a9b
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x6b8], eax
jmp 0x10047ced
mov dword [ebp - 0x35c], 4
mov dword [ebp - 0x78], 0xffffffeb
jmp 0x10047ac6
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xfffffffb
jne 0x10047ced
mov dword [ebp - 0x190], 0x540fff06
mov dword [ebp - 0xac], 0x14
jmp 0x10047af3
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xffffffef
jl 0x10047b14
push 0
push 0x589a
lea eax, [ebp - 0x190]
push eax
call fcn.100470b6
add esp, 0xc
jmp 0x10047ae6
mov dword [ebp - 0x114], 0
jmp 0x10047b2d
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 4
jl 0x10047ce8
mov dword [ebp - 0x34c], 1
cmp dword [ebp - 0x78], 0
je 0x10047b68
push 0
lea ecx, [ebp - 0x314]
call fcn.1000a502
cmp dword [eax], 0
je 0x10047b68
mov dword [ebp - 0x3d8], 1
jmp 0x10047b6f
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0xb18], eax
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x35c], eax
je 0x10047b95
mov dword [ebp - 0x834], 1
jmp 0x10047b9c
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0xa8c], eax
cmp dword [ebp - 0x34c], 0
jne 0x10047bcc
push 0
lea ecx, [ebp - 0x314]
call fcn.1000a502
cmp dword [eax], 0
jne 0x10047bcc
and dword [ebp - 0x6a0], 0
jmp 0x10047bd6
mov dword [ebp - 0x6a0], 1
cmp dword [ebp - 0x6a0], 0xffffffff
jl 0x10047beb
mov dword [ebp - 0x83c], 1
jmp 0x10047bf2
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xaf8], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0xa94], eax
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0x34c]
cmp dword [ebp - 0x190], eax
jg 0x10047c33
mov eax, 0xb4bc71f8
test eax, eax
jne 0x10047c33
and dword [ebp - 0x354], 0
jmp 0x10047c3d
mov dword [ebp - 0x354], 1
push 0
lea ecx, [ebp - 0x968]
call fcn.1000a502
mov ecx, dword [ebp - 0x354]
mov dword [eax], ecx
cmp dword [ebp - 0x354], 0
je 0x10047c70
cmp dword [ebp - 0x35c], 0
je 0x10047c70
mov dword [ebp - 0x3d0], 1
jmp 0x10047c77
and dword [ebp - 0x3d0], 0
push 0
lea ecx, [ebp - 0x314]
call fcn.1000a502
mov esi, dword [ebp - 0x3d0]
add esi, dword [eax]
push 1
lea ecx, [ebp - 0x314]
call fcn.1000a502
cmp esi, dword [eax]
jge 0x10047ca9
mov dword [ebp - 0x6a8], 1
jmp 0x10047cb0
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x370]
add eax, dword [ebp - 0x6a8]
cmp dword [ebp - 0x3d8], eax
jne 0x10047cd0
mov dword [ebp - 0x6b0], 1
jmp 0x10047cd7
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x6b8], eax
jmp 0x10047b20
jmp 0x10047abf
jmp 0x10047986
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x968]
call fcn.1000a4e6
jmp 0x100478f3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x314]
call fcn.1000a4e6
jmp 0x10047862
lea eax, [ebp - 0x3c]
push eax
push 1
push 0x5033
lea eax, [ebp - 0x64]
push eax
push 0x7e29
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x460]
push eax
call fcn.10045091
add esp, 0x1c
push 3
lea ecx, [ebp - 0xac4]
call fcn.1000a48a
mov dword [ebp - 4], 7
mov dword [ebp - 0xaa0], 0x2fd4914d
mov dword [ebp - 0xb04], 0x5b7cefa9
mov dword [ebp - 0x9e8], 0x96a162c9
mov dword [ebp - 0x9f0], 1
mov dword [ebp - 0x9f8], 0xba75a592
mov dword [ebp - 0xa00], 1
mov dword [ebp - 0xa08], 1
mov dword [ebp - 0x8fc], 0xfff7
mov dword [ebp - 0x8f8], 0xfff7
mov dword [ebp - 0x8f4], 0xfff7
mov dword [ebp - 0x8f0], 0xfff7
lea eax, [ebp - 0x154]
push eax
push 0
lea eax, [ebp - 0xac4]
push eax
call fcn.100451a5
add esp, 0xc
mov dword [ebp - 0x154], 0
jmp 0x10047df7
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 3
jge 0x10047e13
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0xc30], 0xfffffffc
jmp 0x10047dea
mov byte [ebp - 0xc8], 0
movzx eax, byte [ebp - 0xc8]
test eax, eax
je 0x10047e39
push 0x185
push 1
push 0xd71
call fcn.100451a5
add esp, 0xc
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x8fc]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x8fc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac4]
call fcn.1000a4e6
cmp dword [ebp - 0x3c], 0
jne 0x10047e6e
jmp 0x1004cc64
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x3c]
add ecx, dword [eax]
add ecx, dword [ebp - 0x30]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x100], 0xfe0a8eac
push 3
lea ecx, [ebp - 0x710]
call fcn.1000a48a
mov dword [ebp - 4], 8
push 1
push 0x175a
push 0x668c
lea eax, [ebp - 0x710]
push eax
push 0x2bc0
push 0x77a5
push 0x17af
lea eax, [ebp - 0x11c]
push eax
call fcn.1004521a
add esp, 0x20
mov dword [ebp - 0x11c], 0
jmp 0x10047ee4
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 3
jge 0x10047f00
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0xb4c], 0
jmp 0x10047ed7
mov dword [ebp - 0x100], 0xffffffed
jmp 0x10047f19
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0xfffffff3
jg 0x100480f7
mov dword [ebp - 0x50], 0xfffffffc
mov dword [ebp - 0x378], 0
mov dword [ebp - 0x50], 0
jmp 0x10047f47
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jg 0x100480f2
mov dword [ebp - 0x84c], 5
push dword [ebp - 0x50]
lea ecx, [ebp - 0x710]
call fcn.1000a502
cmp dword [eax], 1
jb 0x10047f7a
mov dword [ebp - 0x6ec], 1
jmp 0x10047f81
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x100], eax
jne 0x10047f98
mov dword [ebp - 0x3e4], 1
jmp 0x10047f9f
and dword [ebp - 0x3e4], 0
push dword [ebp - 0x50]
lea ecx, [ebp - 0x710]
call fcn.1000a502
mov ecx, dword [ebp - 0x3e4]
cmp ecx, dword [eax]
jl 0x10047fc3
mov dword [ebp - 0x844], 1
jmp 0x10047fca
and dword [ebp - 0x844], 0
push dword [ebp - 0x50]
lea ecx, [ebp - 0x710]
call fcn.1000a502
push 1
lea ecx, [ebp - 0x710]
call fcn.1000a502
cmp dword [eax], 0
jne 0x10047ff9
cmp dword [ebp - 0x50], 0
jne 0x10047ff9
and dword [ebp - 0x67c], 0
jmp 0x10048003
mov dword [ebp - 0x67c], 1
mov eax, dword [ebp - 0x67c]
sub eax, 0xff63
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 0x96e6a373
jne 0x1004802c
mov dword [ebp - 0x3ec], 1
jmp 0x10048033
and dword [ebp - 0x3ec], 0
push dword [ebp - 0x50]
lea ecx, [ebp - 0x710]
call fcn.1000a502
mov ecx, dword [ebp - 0x3ec]
cmp ecx, dword [eax]
jl 0x10048057
mov dword [ebp - 0x5a4], 1
jmp 0x1004805e
and dword [ebp - 0x5a4], 0
push dword [ebp - 0x50]
lea ecx, [ebp - 0x710]
call fcn.1000a502
mov ecx, dword [ebp - 0x5a4]
cmp ecx, dword [eax]
jle 0x10048082
mov dword [ebp - 0x3f4], 1
jmp 0x10048089
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x84c], eax
mov eax, dword [ebp - 0x378]
cmp dword [ebp - 0x6ec], eax
jge 0x100480af
mov dword [ebp - 0x3fc], 1
jmp 0x100480b6
and dword [ebp - 0x3fc], 0
imul eax, dword [ebp - 0x3fc], 0xdfbc
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xb4c], eax
mov byte [ebp - 0x8c], 0
movzx eax, byte [ebp - 0x8c]
test eax, eax
je 0x100480ed
push 0
push 0x494
call fcn.100465c8
pop ecx
pop ecx
jmp 0x10047f40
jmp 0x10047f0c
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x1004811b
push 0x20ba
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x710]
call fcn.1000a4e6
xor ecx, ecx
call fcn.10030403
push eax
call fcn.10061111
pop ecx
mov dword [ebp - 0x854], 0xfffffff9
push 3
lea ecx, [ebp - 0x980]
call fcn.1000a48a
mov dword [ebp - 4], 9
push 0x22da
lea eax, [ebp - 0xa10]
push eax
push 0x7c74
lea eax, [ebp - 0x980]
push eax
push 0
call fcn.1004692b
add esp, 0x14
mov byte [ebp - 0xd6], 0
movzx eax, byte [ebp - 0xd6]
test eax, eax
je 0x10048198
push 0
push 0x4e20
call fcn.10046bd6
pop ecx
pop ecx
push 0x6d8e
lea eax, [ebp - 0x980]
push eax
push 0x2cc1
push 0
lea eax, [ebp - 0x854]
push eax
call fcn.1004540d
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x980]
call fcn.1000a4e6
mov dword [ebp - 0x85c], 8
mov dword [ebp - 0x144], 0xfffffffb
push 0x65bb
push 0x7d51
lea eax, [ebp - 0x144]
push eax
push 0
lea eax, [ebp - 0x85c]
push eax
call fcn.100460e3
add esp, 0x14
mov dword [ebp - 0x144], 0
jmp 0x10048218
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xfffffffe
je 0x10048266
mov byte [ebp - 0x94], 0
movzx eax, byte [ebp - 0x94]
test eax, eax
je 0x10048247
push 0
push 0x3916
push 0x1534
call fcn.10045ca0
add esp, 0xc
mov byte [ebp - 0x8e], 0
push 0
lea eax, [ebp - 0x8e]
push eax
push 0x7fae
call fcn.10045f00
add esp, 0xc
jmp 0x1004820b
mov byte [ebp - 0x308], 6
mov byte [ebp - 0x307], 0xe6
mov byte [ebp - 0x306], 0
mov byte [ebp - 0x305], 0
mov byte [ebp - 0x304], 7
mov byte [ebp - 0x303], 7
mov byte [ebp - 0x302], 8
mov byte [ebp - 0x301], 6
mov byte [ebp - 0x300], 3
mov byte [ebp - 0x2ff], 7
mov byte [ebp - 0x2fe], 5
mov byte [ebp - 0x2fd], 6
mov byte [ebp - 0x2fc], 1
mov byte [ebp - 0x2fb], 4
mov byte [ebp - 0x2fa], 0x5a
mov byte [ebp - 0x2f9], 0x1f
mov byte [ebp - 0x2f8], 0x2d
mov byte [ebp - 0x2f7], 0x1c
mov byte [ebp - 0x2f6], 0xf8
mov byte [ebp - 0x2f5], 0x44
mov byte [ebp - 0x2f4], 0x63
mov byte [ebp - 0x2f3], 0xc1
mov byte [ebp - 0x2f2], 0x6d
mov byte [ebp - 0x2f1], 0xee
mov byte [ebp - 0x2f0], 0xa2
mov byte [ebp - 0x2ef], 0x4c
mov byte [ebp - 0x2ee], 0x6c
mov byte [ebp - 0x2ed], 0xb5
mov byte [ebp - 0x2ec], 0xae
mov byte [ebp - 0x2eb], 0x91
mov byte [ebp - 0x2ea], 0xd0
mov byte [ebp - 0x2e9], 0xad
mov byte [ebp - 0x2e8], 0xb
mov byte [ebp - 0x2e7], 0xfa
mov byte [ebp - 0x2e6], 0xb8
mov byte [ebp - 0x2e5], 0xa8
mov byte [ebp - 0x2e4], 0x8f
mov byte [ebp - 0x2e3], 0xda
mov byte [ebp - 0x2e2], 0x62
mov byte [ebp - 0x2e1], 0x22
mov byte [ebp - 0x2e0], 0x70
mov byte [ebp - 0x2df], 0x68
mov byte [ebp - 0x2de], 0xf2
mov byte [ebp - 0x2dd], 0x72
mov byte [ebp - 0x2dc], 0x71
mov byte [ebp - 0x2db], 0x2a
mov byte [ebp - 0x2da], 0x16
mov byte [ebp - 0x2d9], 0x1a
mov byte [ebp - 0x2d8], 0xd6
mov byte [ebp - 0x2d7], 0xbc
mov byte [ebp - 0x2d6], 0x7d
mov byte [ebp - 0x2d5], 0xb8
mov byte [ebp - 0x2d4], 0xd3
mov byte [ebp - 0x2d3], 0x1c
mov byte [ebp - 0x2d2], 0xc6
mov byte [ebp - 0x2d1], 0x85
mov byte [ebp - 0x2d0], 0xea
mov byte [ebp - 0x2cf], 0xfb
mov byte [ebp - 0x2ce], 0x49
mov byte [ebp - 0x2cd], 0x59
mov byte [ebp - 0x2cc], 0x26
mov byte [ebp - 0x2cb], 0xce
mov byte [ebp - 0x2ca], 0x50
mov byte [ebp - 0x2c9], 0xa3
mov byte [ebp - 0x2c8], 0x80
mov byte [ebp - 0x2c7], 0x7b
mov byte [ebp - 0x2c6], 0x50
mov byte [ebp - 0x2c5], 0x5a
mov byte [ebp - 0x2c4], 0xee
mov byte [ebp - 0x2c3], 0xec
mov byte [ebp - 0x2c2], 0xfb
mov byte [ebp - 0x2c1], 0x3a
mov byte [ebp - 0x2c0], 0x65
mov byte [ebp - 0x2bf], 0x77
mov byte [ebp - 0x2be], 0x70
mov byte [ebp - 0x2bd], 0x6b
mov byte [ebp - 0x2bc], 0xc2
mov byte [ebp - 0x2bb], 0x44
mov byte [ebp - 0x2ba], 0x3c
mov byte [ebp - 0x2b9], 0xdf
mov byte [ebp - 0x2b8], 1
mov byte [ebp - 0x2b7], 0x32
mov byte [ebp - 0x2b6], 0xd
mov byte [ebp - 0x2b5], 0xfa
mov byte [ebp - 0x2b4], 0x8e
mov byte [ebp - 0x2b3], 0x6b
mov byte [ebp - 0x2b2], 0x3b
mov byte [ebp - 0x2b1], 0x5b
mov byte [ebp - 0x2b0], 0xc1
mov byte [ebp - 0x2af], 0x1b
mov byte [ebp - 0x2ae], 0x84
mov byte [ebp - 0x2ad], 0xd6
mov byte [ebp - 0x2ac], 0xae
mov byte [ebp - 0x2ab], 0x76
mov byte [ebp - 0x2aa], 0x34
mov byte [ebp - 0x2a9], 0x85
mov byte [ebp - 0x2a8], 0xe5
mov byte [ebp - 0x2a7], 0x14
mov byte [ebp - 0x2a6], 0x74
mov byte [ebp - 0x2a5], 0x5f
mov byte [ebp - 0x2a4], 0x5b
mov byte [ebp - 0x2a3], 0x3e
mov byte [ebp - 0x2a2], 0x23
mov byte [ebp - 0x2a1], 0x4e
mov byte [ebp - 0x2a0], 3
mov byte [ebp - 0x29f], 2
mov byte [ebp - 0x29e], 2
mov byte [ebp - 0x29d], 4
mov byte [ebp - 0x29c], 0xf
mov byte [ebp - 0x29b], 9
mov byte [ebp - 0x29a], 8
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x308]
or eax, 0xd7
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x308]
and ecx, 0xd7
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x308]
mov byte [ebp + ecx - 0x7b0], al
mov dword [ebp - 0x44], 2
and dword [ebp - 0x18c], 0
jmp 0x100485c5
mov eax, dword [ebp - 0x44]
inc eax
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x6f
jae 0x10048684
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x308]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x44], eax
jne 0x1004860f
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x308]
inc eax
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x308]
mov ecx, dword [ebp - 0x44]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x44], eax
jmp 0x100485bd
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x307]
mov ecx, dword [ebp - 0x44]
sub ecx, dword [ebp - 0x18c]
movzx ecx, byte [ebp + ecx - 0x30a]
movsx ecx, byte [ebp + ecx - 0x7b0]
or eax, ecx
mov ecx, dword [ebp - 0x44]
movzx ecx, byte [ebp + ecx - 0x307]
mov edx, dword [ebp - 0x44]
sub edx, dword [ebp - 0x18c]
movzx edx, byte [ebp + edx - 0x30a]
movsx edx, byte [ebp + edx - 0x7b0]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x44]
movzx ecx, byte [ebp + ecx - 0x308]
mov byte [ebp + ecx - 0x7b0], al
lea eax, [ebp - 0x18c]
push eax
push 0
call fcn.1004565e
pop ecx
pop ecx
jmp 0x100485bd
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x7b0], 0
push 2
lea ecx, [ebp - 0xad4]
call fcn.1000a48a
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x124], 0x13532fe2
push 0
push 0x4c28
lea eax, [ebp - 0xad4]
push eax
lea eax, [ebp - 0xa18]
push eax
call fcn.10046761
add esp, 0x10
mov dword [ebp - 0x124], 0
jmp 0x100486e6
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 1
jg 0x1004875e
mov dword [ebp - 0x1c4], 0xffffffff
mov dword [ebp - 0x1c4], 0
jmp 0x10048712
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 1
jg 0x10048759
mov dword [ebp - 0x8d8], 0x10f7a73
mov byte [ebp - 0x90], 0
movzx eax, byte [ebp - 0x90]
test eax, eax
je 0x1004873f
push 0
call fcn.100462c0
pop ecx
lea eax, [ebp - 0x124]
push eax
push 1
lea eax, [ebp - 0x8d8]
push eax
call fcn.1004539c
add esp, 0xc
jmp 0x10048705
jmp 0x100486d9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xad4]
call fcn.1000a4e6
lea eax, [ebp - 0x7b0]
push eax
lea ecx, [ebp - 0xc48]
call fcn.1001ef40
mov dword [ebp - 0x8e0], eax
mov eax, dword [ebp - 0x8e0]
mov dword [ebp - 0x8b4], eax
mov dword [ebp - 4], 0xb
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x8b4]
call fcn.100303c3
pop ecx
mov dword [ebp - 0x7f8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc48]
call fcn.1001ef6f
mov dword [ebp - 0x374], 0x810d21df
push 1
lea ecx, [ebp - 0x798]
call fcn.1000a48a
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x320], 0x1c5adf85
mov dword [ebp - 0x5bc], 0x33a9025b
mov dword [ebp - 0x8c0], 0
mov dword [ebp - 0x34], 0
jmp 0x10048809
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x10048825
push dword [ebp - 0x34]
lea ecx, [ebp - 0x798]
call fcn.1000a502
mov dword [eax], 0x17be9fb1
jmp 0x10048802
mov dword [ebp - 0x34], 0
jmp 0x10048835
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x1004884b
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x178], 1
jmp 0x1004882e
mov dword [ebp - 0x34], 0
jmp 0x1004885b
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x1004886e
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x7c], 0xfffffffa
jmp 0x10048854
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0x27439cb6
jg 0x10048893
mov dword [ebp - 0x5ac], 1
jmp 0x1004889a
and dword [ebp - 0x5ac], 0
push 0
lea ecx, [ebp - 0x798]
call fcn.1000a502
mov esi, dword [ebp - 0x5ac]
neg esi
push 0
lea ecx, [ebp - 0x798]
call fcn.1000a502
cmp esi, dword [eax]
jg 0x100488cc
mov dword [ebp - 0x684], 1
jmp 0x100488d3
and dword [ebp - 0x684], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x178]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x178]
cmp eax, 1
jbe 0x100488fe
mov dword [ebp - 0x404], 1
jmp 0x10048905
and dword [ebp - 0x404], 0
cmp dword [ebp - 0x404], 9
jl 0x1004891a
mov dword [ebp - 0x40c], 1
jmp 0x10048921
and dword [ebp - 0x40c], 0
mov esi, dword [ebp - 0x684]
add esi, dword [ebp - 0x40c]
push 0
lea ecx, [ebp - 0x798]
call fcn.1000a502
cmp esi, dword [eax]
jne 0x10048950
mov eax, 0x4419
test eax, eax
jne 0x10048950
and dword [ebp - 0x5b4], 0
jmp 0x1004895a
mov dword [ebp - 0x5b4], 1
push 0
lea ecx, [ebp - 0x798]
call fcn.1000a502
mov ecx, dword [ebp - 0x5b4]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x178], 0
je 0x10048998
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7c], 0
je 0x10048998
mov dword [ebp - 0x414], 1
jmp 0x1004899f
and dword [ebp - 0x414], 0
cmp dword [ebp - 0x414], 0xffffffff
jl 0x100489b4
mov dword [ebp - 0x734], 1
jmp 0x100489bb
and dword [ebp - 0x734], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x178]
add eax, dword [ebp - 0x734]
cmp eax, 0xc1c73b01
jne 0x100489e1
mov dword [ebp - 0x41c], 1
jmp 0x100489e8
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0xa20], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c]
mov dword [ebp - 0xa28], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c]
mov dword [ebp - 0xa30], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x178]
mov dword [ebp - 0xa38], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x178]
mov dword [ebp - 0xa40], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c]
mov dword [ebp - 0xa48], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c]
mov dword [ebp - 0xa50], eax
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0xa58], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c]
add eax, 0x1c25
jne 0x10048a8e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x178]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x7c]
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 0xfffffff6
je 0x10048ad4
xor eax, eax
je 0x10048ad4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x178], 0
je 0x10048ad4
mov dword [ebp - 0x68c], 1
jmp 0x10048adb
and dword [ebp - 0x68c], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0x178]
sub eax, dword [ebp + ecx - 0x178]
mov dword [ebp - 0x424], eax
push 0
lea ecx, [ebp - 0x798]
call fcn.1000a502
mov ecx, dword [ebp - 0x424]
mov dword [eax], ecx
mov eax, dword [ebp - 0x424]
cmp eax, dword [ebp - 0x68c]
jge 0x10048b2a
mov dword [ebp - 0x42c], 1
jmp 0x10048b31
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x8c0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x798]
call fcn.1000a4e6
and dword [ebp - 0x194], 0
jmp 0x10048b62
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0xb
jae 0x10048b7b
mov eax, dword [ebp - 0x194]
mov byte [ebp + eax - 0x7b0], 0
jmp 0x10048b55
mov dword [ebp - 0x694], 0xffffffff
mov dword [ebp - 0x160], 0x94964a53
mov dword [ebp - 0xb4], 0x70c3099c
mov dword [ebp - 0x328], 0
mov dword [ebp - 0xdc], 0xfffffff7
mov dword [ebp - 0x7c0], 0
mov dword [ebp - 0x5c4], 0x6721f7d9
mov dword [ebp - 0xa60], 0
mov dword [ebp - 0x1ec], 0
jmp 0x10048be4
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 3
jge 0x10048c00
mov eax, dword [ebp - 0x1ec]
mov dword [ebp + eax*4 - 0xae4], 0xfffffffd
jmp 0x10048bd7
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x328], eax
mov dword [ebp - 0xb4], 0
jmp 0x10048c3d
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0xffffffea
jge 0x10048e84
mov dword [ebp - 0xa6c], 0x515466b
mov dword [ebp - 0xaa4], 0x3b6f9b69
mov dword [ebp - 0xaac], 0
mov dword [ebp - 0x7d4], 0xbd5de1fc
mov dword [ebp - 0xab4], 3
mov dword [ebp - 0x43c], 0xcf5aa05
mov dword [ebp - 0x19c], 1
mov dword [ebp - 0x350], 0x4763523e
mov dword [ebp - 0x6c], 0
jmp 0x10048caa
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x10048cc0
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xc58], 0x77c422d5
jmp 0x10048ca3
mov dword [ebp - 0x6c], 0
jmp 0x10048cd0
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x10048ce6
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xa9c], 0xecb2ec6f
jmp 0x10048cc9
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xb0c], eax
cmp dword [ebp - 0x43c], 0
je 0x10048d0e
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x10048d0e
mov dword [ebp - 0x434], 1
jmp 0x10048d15
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x5c4], eax
mov eax, dword [ebp - 0x5c4]
cmp eax, dword [ebp - 0x434]
jge 0x10048d3b
mov dword [ebp - 0x6f4], 1
jmp 0x10048d42
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x160]
sub eax, dword [ebp - 0x350]
mov ecx, dword [ebp - 0x6f4]
mov edx, dword [ebp - 0x350]
inc edx
mov dword [ebp - 0x350], edx
cmp eax, ecx
jg 0x10048d7a
cmp dword [ebp - 0x43c], 0
je 0x10048d7a
mov dword [ebp - 0x5cc], 1
jmp 0x10048d81
and dword [ebp - 0x5cc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5cc]
mov dword [ebp + eax - 0xae4], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xae4]
imul eax, dword [ebp - 0x160]
test eax, eax
je 0x10048dc1
cmp dword [ebp - 0x328], 0
je 0x10048dc1
mov dword [ebp - 0x444], 1
jmp 0x10048dc8
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x7d4]
cmp dword [ebp - 0x444], eax
jg 0x10048deb
cmp dword [ebp - 0x694], 0
je 0x10048deb
mov dword [ebp - 0x44c], 1
jmp 0x10048df2
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x7c0]
add eax, dword [ebp - 0x44c]
cmp eax, dword [ebp - 0x328]
jne 0x10048e12
mov dword [ebp - 0x5d4], 1
jmp 0x10048e19
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x5d4]
inc eax
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x19c], 0x12
jmp 0x10048e3f
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0xfffffff3
jne 0x10048e7f
mov dword [ebp - 0xdc], 0
jmp 0x10048e61
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 1
jg 0x10048e7d
mov eax, dword [ebp - 0xdc]
mov dword [ebp + eax*4 - 0xa9c], 0
jmp 0x10048e54
jmp 0x10048e32
jmp 0x10048c30
push 3
lea ecx, [ebp - 0x730]
call fcn.1000a48a
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x2c], 0x394643cd
mov dword [ebp - 0x1ac], 1
mov dword [ebp - 0x1d4], 0x95621847
mov dword [ebp - 0x368], 1
push 1
lea ecx, [ebp - 0x720]
call fcn.1000a48a
mov byte [ebp - 4], 0xe
push 4
lea ecx, [ebp - 0x9b0]
call fcn.1000a48a
mov byte [ebp - 4], 0xf
mov dword [ebp - 0xb14], 7
mov dword [ebp - 0x60c], 0
mov dword [ebp - 0x1c], 0
jmp 0x10048f03
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10048f1f
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x730]
call fcn.1000a502
mov dword [eax], 0xc93b
jmp 0x10048efc
mov dword [ebp - 0x1c], 0
jmp 0x10048f2f
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x10048f4b
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x720]
call fcn.1000a502
mov dword [eax], 0xb82a
jmp 0x10048f28
mov dword [ebp - 0x1c], 0
jmp 0x10048f5b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10048f71
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x998], 0
jmp 0x10048f54
mov dword [ebp - 0x1c], 0
jmp 0x10048f81
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10048f9d
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9b0]
call fcn.1000a502
mov dword [eax], 0x8662
jmp 0x10048f7a
mov dword [ebp - 0x2c], 0
jmp 0x10048fad
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x10048feb
lea eax, [ebp - 0x730]
push eax
push 0x1eb1
lea eax, [ebp - 0x2c]
push eax
push 1
push 0x3c8d
call fcn.1004540d
add esp, 0x14
mov byte [ebp - 0xc5], 0
push 0
lea eax, [ebp - 0xc5]
push eax
call fcn.10045f5f
pop ecx
pop ecx
jmp 0x10048fa6
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xb1c], eax
push 0
lea ecx, [ebp - 0x730]
call fcn.1000a502
cmp dword [eax], 0
jne 0x10049018
mov eax, 0x3632
test eax, eax
jne 0x10049018
and dword [ebp - 0x454], 0
jmp 0x10049022
mov dword [ebp - 0x454], 1
push 0
lea ecx, [ebp - 0x730]
call fcn.1000a502
mov eax, dword [eax]
neg eax
add eax, dword [ebp - 0x454]
cmp eax, 0xfbce
jl 0x1004904c
mov dword [ebp - 0x764], 1
jmp 0x10049053
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x764]
cmp eax, 2
je 0x1004906e
mov dword [ebp - 0x45c], 1
jmp 0x10049075
and dword [ebp - 0x45c], 0
cmp dword [ebp - 0x45c], 2
ja 0x1004908a
mov dword [ebp - 0x5dc], 1
jmp 0x10049091
and dword [ebp - 0x5dc], 0
push 2
lea ecx, [ebp - 0x730]
call fcn.1000a502
mov ecx, dword [ebp - 0x5dc]
imul ecx, dword [eax]
test ecx, ecx
je 0x1004936e
mov dword [ebp - 0x1a4], 0x802d14a5
mov dword [ebp - 0x1e4], 0xb7f464f6
mov dword [ebp - 0x880], 0xfffffffa
mov dword [ebp - 0x1cc], 0
jmp 0x100490e6
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 1
jge 0x10049102
mov eax, dword [ebp - 0x1cc]
mov dword [ebp + eax*4 - 0x12c], 0x28405cef
jmp 0x100490d9
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x12c]
sub esi, dword [ebp - 0x2c]
push 2
lea ecx, [ebp - 0x730]
call fcn.1000a502
cmp esi, dword [eax]
jg 0x1004912f
mov dword [ebp - 0x464], 1
jmp 0x10049136
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x464]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1ac]
sub eax, 0x6f914a11
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x12c]
jl 0x10049170
mov dword [ebp - 0x69c], 1
jmp 0x10049177
and dword [ebp - 0x69c], 0
imul eax, dword [ebp - 0x69c], 0xfffc
cmp eax, dword [ebp - 0x1a4]
jg 0x10049195
mov dword [ebp - 0x46c], 1
jmp 0x1004919c
and dword [ebp - 0x46c], 0
imul eax, dword [ebp - 0x46c], 0x478d
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0
jne 0x100491c1
mov dword [ebp - 0x5e4], 1
jmp 0x100491c8
and dword [ebp - 0x5e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x12c]
cmp dword [ebp - 0x5e4], eax
je 0x100491ef
cmp dword [ebp - 0x1a4], 0
jne 0x100491ef
and dword [ebp - 0x474], 0
jmp 0x100491f9
mov dword [ebp - 0x474], 1
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1e4]
sub eax, dword [ebp - 0x2c]
cmp eax, 0x4f970398
jl 0x1004922d
mov dword [ebp - 0x6fc], 1
jmp 0x10049234
and dword [ebp - 0x6fc], 0
push 0
lea ecx, [ebp - 0x720]
call fcn.1000a502
mov ecx, dword [ebp - 0x6fc]
cmp ecx, dword [eax]
jne 0x10049254
cmp dword [ebp - 0x1e4], 0
je 0x10049266
cmp dword [ebp - 0x2c], 0
je 0x10049266
mov dword [ebp - 0x47c], 1
jmp 0x1004926d
and dword [ebp - 0x47c], 0
mov esi, dword [ebp - 0x2c]
push 0
lea ecx, [ebp - 0x720]
call fcn.1000a502
mov ecx, dword [ebp - 0x47c]
imul ecx, dword [eax]
sub esi, ecx
cmp esi, 0xe1e161e4
jae 0x1004929c
mov dword [ebp - 0x5ec], 1
jmp 0x100492a3
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x5ec], eax
jg 0x100492bd
mov dword [ebp - 0x484], 1
jmp 0x100492c4
and dword [ebp - 0x484], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x12c]
cmp dword [ebp - 0x484], eax
jg 0x100492e5
mov dword [ebp - 0x6a4], 1
jmp 0x100492ec
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x1a4]
imul eax, dword [ebp - 0x6a4]
test eax, eax
jne 0x1004930f
cmp dword [ebp - 0x1e4], 0
jne 0x1004930f
and dword [ebp - 0x48c], 0
jmp 0x10049319
mov dword [ebp - 0x48c], 1
cmp dword [ebp - 0x48c], 2
ja 0x1004932e
mov dword [ebp - 0x5f4], 1
jmp 0x10049335
and dword [ebp - 0x5f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x12c]
push 4
pop ecx
shl ecx, 1
mov edx, dword [ebp - 0x5f4]
sub edx, dword [ebp + ecx - 0x998]
push 4
pop ecx
shl ecx, 0
add edx, dword [ebp + ecx - 0x998]
add eax, edx
mov dword [ebp - 0x880], eax
jmp 0x100495c7
mov dword [ebp - 0xf0], 4
mov dword [ebp - 0x8c8], 1
cmp dword [ebp - 0xf0], 0x293e35f2
je 0x1004939a
mov dword [ebp - 0x494], 1
jmp 0x100493a1
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x494], 0
je 0x10049452
mov esi, dword [ebp - 0xf0]
push 0
lea ecx, [ebp - 0x720]
call fcn.1000a502
cmp esi, dword [eax]
jne 0x100493d1
mov dword [ebp - 0x744], 1
jmp 0x100493d8
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x2c], eax
jle 0x100493fe
push 1
lea ecx, [ebp - 0x730]
call fcn.1000a502
cmp dword [eax], 0
jne 0x100493fe
and dword [ebp - 0x49c], 0
jmp 0x10049408
mov dword [ebp - 0x49c], 1
mov eax, dword [ebp - 0x744]
cmp eax, dword [ebp - 0x49c]
jg 0x10049422
mov dword [ebp - 0x5fc], 1
jmp 0x10049429
and dword [ebp - 0x5fc], 0
push 0
lea ecx, [ebp - 0x720]
call fcn.1000a502
mov ecx, dword [ebp - 0x5fc]
sub ecx, dword [eax]
sub ecx, dword [ebp - 0x368]
je 0x10049452
mov dword [ebp - 0x4a4], 1
jmp 0x10049459
and dword [ebp - 0x4a4], 0
push 0
lea ecx, [ebp - 0x720]
call fcn.1000a502
mov ecx, dword [ebp - 0x4a4]
add ecx, dword [eax]
mov dword [ebp - 0x1ac], ecx
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0x1ac], eax
jge 0x100495b0
mov dword [ebp - 0x7c8], 0xd7cbc176
mov dword [ebp - 0x704], 0xd34b
mov dword [ebp - 0x7d0], 0x9d8ad31a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x998], 0
je 0x100494d7
mov esi, dword [ebp - 0xf0]
push 1
lea ecx, [ebp - 0x9b0]
call fcn.1000a502
cmp esi, dword [eax]
je 0x100494d7
mov dword [ebp - 0x6ac], 1
jmp 0x100494de
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x7c8]
mov dword [ebp - 0xb24], eax
or eax, 0xffffffff
je 0x10049501
push 0
lea ecx, [ebp - 0x720]
call fcn.1000a502
cmp dword [eax], 0
jne 0x10049513
mov eax, 0x56c84d1b
test eax, eax
jne 0x10049513
and dword [ebp - 0x4ac], 0
jmp 0x1004951d
mov dword [ebp - 0x4ac], 1
mov eax, dword [ebp - 0x6ac]
cmp eax, dword [ebp - 0x4ac]
jge 0x10049537
mov dword [ebp - 0x604], 1
jmp 0x1004953e
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x1d4]
imul eax, dword [ebp - 0x604]
test eax, eax
je 0x10049564
cmp dword [ebp - 0xf0], 0
je 0x10049564
mov dword [ebp - 0x4b4], 1
jmp 0x1004956b
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x704], eax
mov eax, dword [ebp - 0x704]
mov dword [ebp - 0x8c8], eax
cmp dword [ebp - 0xf0], 0xc91981f0
jne 0x1004959b
mov dword [ebp - 0x4bc], 1
jmp 0x100495a2
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x7d0], eax
jmp 0x100495c7
mov dword [ebp - 0xb2c], 5
mov eax, dword [ebp - 0x60c]
dec eax
mov dword [ebp - 0x60c], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x9b0]
call fcn.1000a4e6
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x720]
call fcn.1000a4e6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x730]
call fcn.1000a4e6
mov byte [ebp - 0x298], 2
mov byte [ebp - 0x297], 0x97
mov byte [ebp - 0x296], 8
mov byte [ebp - 0x295], 7
mov byte [ebp - 0x294], 9
mov byte [ebp - 0x293], 0
mov byte [ebp - 0x292], 0x47
mov byte [ebp - 0x291], 0x77
mov byte [ebp - 0x290], 0x83
mov byte [ebp - 0x28f], 0x1e
mov byte [ebp - 0x28e], 0x6f
mov byte [ebp - 0x28d], 0xc0
mov byte [ebp - 0x28c], 0xce
mov byte [ebp - 0x28b], 0xda
mov byte [ebp - 0x28a], 0x1e
mov byte [ebp - 0x289], 0x43
mov byte [ebp - 0x288], 0xe5
mov byte [ebp - 0x287], 0xf3
mov byte [ebp - 0x286], 0x8b
mov byte [ebp - 0x285], 0xd5
mov byte [ebp - 0x284], 0x10
mov byte [ebp - 0x283], 0x72
mov byte [ebp - 0x282], 0xc1
mov byte [ebp - 0x281], 0xa1
mov byte [ebp - 0x280], 0xcb
mov byte [ebp - 0x27f], 0x24
mov byte [ebp - 0x27e], 0xbf
mov byte [ebp - 0x27d], 0xbc
mov byte [ebp - 0x27c], 0xd4
mov byte [ebp - 0x27b], 0x99
mov byte [ebp - 0x27a], 0x3c
mov byte [ebp - 0x279], 0x81
mov byte [ebp - 0x278], 0xed
mov byte [ebp - 0x277], 0xe2
mov byte [ebp - 0x276], 0xcd
mov byte [ebp - 0x275], 0x18
mov byte [ebp - 0x274], 0xe
mov byte [ebp - 0x273], 6
mov byte [ebp - 0x272], 0xcf
mov byte [ebp - 0x271], 0x66
mov byte [ebp - 0x270], 0x64
mov byte [ebp - 0x26f], 0x14
mov byte [ebp - 0x26e], 0x75
mov byte [ebp - 0x26d], 0xd8
mov byte [ebp - 0x26c], 0xc7
mov byte [ebp - 0x26b], 0x69
mov byte [ebp - 0x26a], 0x5f
mov byte [ebp - 0x269], 0xc3
mov byte [ebp - 0x268], 0x77
mov byte [ebp - 0x267], 0xe8
mov byte [ebp - 0x266], 0x29
mov byte [ebp - 0x265], 0xb0
mov byte [ebp - 0x264], 0xdf
mov byte [ebp - 0x263], 0x53
mov byte [ebp - 0x262], 0xc2
mov byte [ebp - 0x261], 0x7e
mov byte [ebp - 0x260], 0xb3
mov byte [ebp - 0x25f], 0x83
mov byte [ebp - 0x25e], 0x89
mov byte [ebp - 0x25d], 0x90
mov byte [ebp - 0x25c], 0x8a
mov byte [ebp - 0x25b], 0xa3
mov byte [ebp - 0x25a], 0x71
mov byte [ebp - 0x259], 0x6f
mov byte [ebp - 0x258], 0xde
mov byte [ebp - 0x257], 0x39
mov byte [ebp - 0x256], 0x39
mov byte [ebp - 0x255], 0x33
mov byte [ebp - 0x254], 0xa2
mov byte [ebp - 0x253], 0x8d
mov byte [ebp - 0x252], 0x79
mov byte [ebp - 0x251], 0xf6
mov byte [ebp - 0x250], 0xae
mov byte [ebp - 0x24f], 0xd6
mov byte [ebp - 0x24e], 0xfc
mov byte [ebp - 0x24d], 0xc1
mov byte [ebp - 0x24c], 0xd3
mov byte [ebp - 0x24b], 0x28
mov byte [ebp - 0x24a], 5
mov byte [ebp - 0x249], 1
mov byte [ebp - 0x248], 1
mov byte [ebp - 0x247], 7
mov byte [ebp - 0x246], 0
mov byte [ebp - 0x245], 7
mov byte [ebp - 0x244], 6
mov byte [ebp - 0x243], 8
mov byte [ebp - 0x242], 3
mov byte [ebp - 0x241], 0xb
mov byte [ebp - 0x240], 4
mov byte [ebp - 0x23f], 6
mov byte [ebp - 0x23e], 7
mov byte [ebp - 0x23d], 2
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x298]
or eax, 0xa0
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x298]
and ecx, 0xa0
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x298]
mov byte [ebp + ecx - 0x78c], al
mov dword [ebp - 0x20], 2
and dword [ebp - 0x14c], 0
jmp 0x100498ce
mov eax, dword [ebp - 0x20]
inc eax
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x5c
jae 0x100499ac
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x298]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x20], eax
jne 0x10049918
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x298]
inc eax
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x298]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x20], eax
jmp 0x100498c6
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x297]
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x14c]
movzx ecx, byte [ebp + ecx - 0x29a]
movsx ecx, byte [ebp + ecx - 0x78c]
add eax, ecx
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0x297]
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x14c]
movzx edx, byte [ebp + edx - 0x29a]
movsx edx, byte [ebp + edx - 0x78c]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0x297]
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x14c]
movzx edx, byte [ebp + edx - 0x29a]
movsx edx, byte [ebp + edx - 0x78c]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0x298]
mov byte [ebp + ecx - 0x78c], al
and dword [ebp - 0x14c], 0
jmp 0x100498c6
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x78c], 0
lea eax, [ebp - 0x78c]
push eax
lea ecx, [ebp - 0xbc4]
call fcn.1001ef40
mov dword [ebp - 0x8d0], eax
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0x7d8], eax
mov dword [ebp - 4], 0x10
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x7d8]
call fcn.100303c3
pop ecx
mov dword [ebp - 0x8bc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc4]
call fcn.1001ef6f
mov dword [ebp - 0x5c], 0x799ac789
push 4
lea ecx, [ebp - 0x86c]
call fcn.1000a48a
mov dword [ebp - 4], 0x11
or dword [ebp - 0x924], 0xffffffff
or dword [ebp - 0x920], 0xffffffff
or dword [ebp - 0x91c], 0xffffffff
or dword [ebp - 0x918], 0xffffffff
lea ecx, [ebp - 0x331]
call fcn.1000a5ed
push eax
lea eax, [ebp - 0x914]
push eax
lea eax, [ebp - 0x924]
push eax
lea ecx, [ebp - 0xb74]
call fcn.100136d2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x95c]
call fcn.100136ac
mov byte [ebp - 4], 0x12
mov dword [ebp - 0xb34], 0
mov dword [ebp - 0x1b4], 0
jmp 0x10049a9d
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 4
jge 0x10049abf
push dword [ebp - 0x1b4]
lea ecx, [ebp - 0x86c]
call fcn.1000a502
mov dword [eax], 0x172d
jmp 0x10049a90
cmp dword [ebp - 0x5c], 0
je 0x10049ae4
mov byte [ebp - 0x92], 0
movzx eax, byte [ebp - 0x92]
test eax, eax
je 0x10049adf
push 1
call fcn.10045539
pop ecx
jmp 0x10049da7
mov dword [ebp - 0x1f4], 0
jmp 0x10049afd
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 3
jge 0x10049b19
mov eax, dword [ebp - 0x1f4]
mov dword [ebp + eax*4 - 0x740], 0x12b5
jmp 0x10049af0
mov dword [ebp - 0x5c], 0
jmp 0x10049b29
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jg 0x10049da7
mov dword [ebp - 0x74], 0xefa9d19a
mov dword [ebp - 0x358], 0x83bbb66e
mov dword [ebp - 0x7e8], 0xfffffffc
mov dword [ebp - 0x74], 2
jmp 0x10049b5e
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jl 0x10049da2
mov dword [ebp - 0x330], 0x33e34b64
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xb00], eax
push 2
lea ecx, [ebp - 0x86c]
call fcn.1000a502
mov eax, dword [eax]
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0
je 0x10049bb7
push 1
lea ecx, [ebp - 0x86c]
call fcn.1000a502
cmp dword [eax], 0
je 0x10049bb7
mov dword [ebp - 0x4c4], 1
jmp 0x10049bbe
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x4c4], eax
jle 0x10049bd5
mov dword [ebp - 0x6b4], 1
jmp 0x10049bdc
and dword [ebp - 0x6b4], 0
cmp dword [ebp - 0x6b4], 9
jb 0x10049bf1
mov dword [ebp - 0x4cc], 1
jmp 0x10049bf8
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0x740]
cmp dword [ebp - 0x4cc], eax
je 0x10049c16
mov dword [ebp - 0x614], 1
jmp 0x10049c1d
and dword [ebp - 0x614], 0
push 2
lea ecx, [ebp - 0x86c]
call fcn.1000a502
mov ecx, dword [ebp - 0x614]
cmp ecx, dword [eax]
jge 0x10049c40
mov dword [ebp - 0x4d4], 1
jmp 0x10049c47
and dword [ebp - 0x4d4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x740]
cmp dword [ebp - 0x4d4], eax
je 0x10049c68
mov dword [ebp - 0x77c], 1
jmp 0x10049c6f
and dword [ebp - 0x77c], 0
imul eax, dword [ebp - 0x77c], 0x3ae5
mov dword [ebp - 0x4dc], eax
push 3
lea ecx, [ebp - 0x95c]
call fcn.1000a502
mov ecx, dword [ebp - 0x4dc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x4dc], eax
jge 0x10049cab
mov dword [ebp - 0x61c], 1
jmp 0x10049cb2
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0x740]
add eax, dword [ebp - 0x61c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x740]
je 0x10049cdd
mov dword [ebp - 0x88c], 1
jmp 0x10049ce4
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0x740]
mov dword [ebp - 0x9e4], eax
push 2
lea ecx, [ebp - 0x95c]
call fcn.1000a502
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0x740]
mov dword [ebp - 0x9ec], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0x330]
dec eax
mov dword [ebp - 0x330], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x740]
cmp dword [ebp - 0x330], eax
jle 0x10049d48
mov dword [ebp - 0x7e0], 1
jmp 0x10049d4f
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp + eax*4 - 0x740], 1
jg 0x10049d68
mov dword [ebp - 0x8cc], 1
jmp 0x10049d6f
and dword [ebp - 0x8cc], 0
cmp dword [ebp - 0x358], 0
jne 0x10049d87
cmp dword [ebp - 0x74], 0
jne 0x10049d87
and dword [ebp - 0x4e4], 0
jmp 0x10049d91
mov dword [ebp - 0x4e4], 1
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x7e8], eax
jmp 0x10049b57
jmp 0x10049b22
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x95c]
call fcn.1000a4e6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x86c]
call fcn.1000a4e6
and dword [ebp - 0x1bc], 0
jmp 0x10049ddb
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0xb
jae 0x10049df4
mov eax, dword [ebp - 0x1bc]
mov byte [ebp + eax - 0x78c], 0
jmp 0x10049dce
push 3
lea ecx, [ebp - 0x9a4]
call fcn.1000a48a
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x7f0], 0xfffffff8
lea eax, [ebp - 0x9f4]
push eax
push 0x3d37
push 1
push 0x40d9
lea eax, [ebp - 0x9a4]
push eax
call fcn.1004555f
add esp, 0x14
mov byte [ebp - 0x96], 0
movzx eax, byte [ebp - 0x96]
test eax, eax
je 0x10049e5e
push 0x5f3f
push 1
call fcn.10045606
pop ecx
pop ecx
mov dword [ebp - 0x134], 2
jmp 0x10049e77
mov eax, dword [ebp - 0x134]
dec eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jl 0x10049f30
mov dword [ebp - 0x104], 0xf2887cf2
mov dword [ebp - 0x894], 0xb5d1cb6a
mov dword [ebp - 0x104], 2
jmp 0x10049eb1
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jl 0x10049f2b
mov dword [ebp - 0x108], 0x285faafe
mov dword [ebp - 0x108], 0
jmp 0x10049edd
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 2
jg 0x10049f26
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x894]
push eax
push 0x2453
lea eax, [ebp - 0x7f0]
push eax
push 0x6f97
push 0
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x9a4]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.100459df
add esp, 0x24
jmp 0x10049ed0
jmp 0x10049ea4
jmp 0x10049e6a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9a4]
call fcn.1000a4e6
push dword [ebp - 0x8bc]
push dword [ebp - 0x7f8]
call fcn.100430e4
pop ecx
pop ecx
mov dword [ebp - 0x534], eax
mov dword [ebp - 0x28], 0x7e2799ac
mov dword [ebp - 0x80], 0x592c6eed
mov dword [ebp - 0x28], 0
jmp 0x10049f76
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x16
je 0x1004a3c7
mov dword [ebp - 0x54], 0x8b72fd49
mov dword [ebp - 0x180], 6
mov dword [ebp - 0x54], 0
jmp 0x10049fa1
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xe
jl 0x1004a1ab
push 2
lea ecx, [ebp - 0x750]
call fcn.1000a48a
mov dword [ebp - 4], 0x14
push 0
lea eax, [ebp - 0x110]
push eax
push 0x1c5c
lea eax, [ebp - 0x750]
push eax
call fcn.10045e88
add esp, 0x10
mov dword [ebp - 0x110], 0
jmp 0x10049ff5
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 1
jge 0x1004a011
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0xb28], 0x2c5b641b
jmp 0x10049fe8
push 0
lea ecx, [ebp - 0x750]
call fcn.1000a502
cmp dword [eax], 0
jne 0x1004a0b4
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x9fc], eax
cmp dword [ebp - 0x28], 0
jne 0x1004a06b
mov esi, dword [ebp - 0x28]
push 0
lea ecx, [ebp - 0x750]
call fcn.1000a502
add esi, dword [eax]
mov dword [ebp - 0x80], esi
mov esi, dword [ebp - 0x80]
push 0
lea ecx, [ebp - 0x750]
call fcn.1000a502
cmp esi, dword [eax]
jle 0x1004a06b
and dword [ebp - 0x6bc], 0
jmp 0x1004a075
mov dword [ebp - 0x6bc], 1
push 0
lea ecx, [ebp - 0x750]
call fcn.1000a502
mov ecx, dword [ebp - 0x6bc]
cmp ecx, dword [eax]
jge 0x1004a098
mov dword [ebp - 0x4ec], 1
jmp 0x1004a09f
and dword [ebp - 0x4ec], 0
cmp dword [ebp - 0x4ec], 0x64ba
je 0x1004a0b4
and dword [ebp - 0x624], 0
jmp 0x1004a0be
mov dword [ebp - 0x624], 1
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x624]
je 0x1004a0eb
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1004a0e9
push 0x4913
push 1
call fcn.1004565e
pop ecx
pop ecx
jmp 0x1004a15e
mov dword [ebp - 0x184], 0
jmp 0x1004a104
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 1
jge 0x1004a120
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x4f4], 1
jmp 0x1004a0f7
push 0
lea ecx, [ebp - 0x750]
call fcn.1000a502
cmp dword [eax], 0
je 0x1004a143
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x750]
call fcn.1000a4e6
jmp 0x1004a1ab
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4f4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x4f4], eax
mov byte [ebp - 0xd8], 0
movzx eax, byte [ebp - 0xd8]
test eax, eax
je 0x1004a197
push 0x1eea
push 0
push 0x1b72
push 0x1348
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x750]
call fcn.1000a4e6
jmp 0x10049f9a
cmp dword [ebp - 0x28], 0
jne 0x1004a1f2
mov eax, dword [ebp - 0x54]
shl eax, 1
cmp eax, dword [ebp - 0x180]
jne 0x1004a1ca
mov dword [ebp - 0x714], 1
jmp 0x1004a1d1
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x714]
inc eax
imul eax, dword [ebp - 0x28]
neg eax
cmp eax, dword [ebp - 0x54]
jl 0x1004a1f2
cmp dword [ebp - 0x28], 0
jne 0x1004a1f2
and dword [ebp - 0x4fc], 0
jmp 0x1004a1fc
mov dword [ebp - 0x4fc], 1
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x4fc], eax
jne 0x1004a216
mov dword [ebp - 0x89c], 1
jmp 0x1004a21d
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xab0], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x28]
sub eax, ecx
cmp eax, dword [ebp - 0x28]
jg 0x1004a242
mov dword [ebp - 0x62c], 1
jmp 0x1004a249
and dword [ebp - 0x62c], 0
cmp dword [ebp - 0x62c], 5
jb 0x1004a25e
mov dword [ebp - 0x504], 1
jmp 0x1004a265
and dword [ebp - 0x504], 0
mov dword [ebp - 0x80], 0xfffffff9
mov eax, dword [ebp - 0x80]
imul eax, dword [ebp - 0x504]
test eax, eax
je 0x1004a2a0
lea eax, [ebp - 0x80]
push eax
push 1
lea eax, [ebp - 0x54]
push eax
push 0x636d
push 0x6ee5
push 0x6102
call fcn.10045690
add esp, 0x18
jmp 0x1004a3c2
mov dword [ebp - 0x524], 0x40c09c4f
mov dword [ebp - 0x800], 1
cmp dword [ebp - 0x28], 0
je 0x1004a2c6
mov dword [ebp - 0x6c4], 1
jmp 0x1004a2cd
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x6c4], eax
jle 0x1004a2e4
mov dword [ebp - 0x50c], 1
jmp 0x1004a2eb
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x50c]
cmp eax, 2
je 0x1004a305
mov dword [ebp - 0x634], 1
jmp 0x1004a30c
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x634]
sub eax, 0xd33f
jne 0x1004a325
mov dword [ebp - 0x514], 1
jmp 0x1004a32c
and dword [ebp - 0x514], 0
cmp dword [ebp - 0x514], 0xc19a
jg 0x1004a344
mov dword [ebp - 0x754], 1
jmp 0x1004a34b
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x754]
jge 0x1004a362
mov dword [ebp - 0x51c], 1
jmp 0x1004a369
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x524]
cmp dword [ebp - 0x51c], eax
jg 0x1004a383
mov dword [ebp - 0x63c], 1
jmp 0x1004a38a
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x63c]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x800], eax
lea eax, [ebp - 0x80]
push eax
push 0x2b6
lea eax, [ebp - 0x524]
push eax
push 1
lea eax, [ebp - 0x180]
push eax
push 0x7447
call fcn.10045740
add esp, 0x18
jmp 0x10049f6f
push 0x1f60
push 0x3a70
lea eax, [ebp - 0xe4]
push eax
push 0xc25
lea eax, [ebp - 0x534]
push eax
push 1
push 0x6a91
push 0x4839
push 0x709e
call fcn.100459df
add esp, 0x24
mov dword [ebp - 0x52c], 1
mov dword [ebp - 0x6cc], 0xb02971c1
mov dword [ebp - 0x8dc], 0xffffffff
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x6cc], eax
mov eax, dword [ebp - 0x6cc]
mov dword [ebp - 0x8dc], eax
cmp dword [ebp - 0x52c], 0
je 0x1004a45b
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x1004a456
push 1
call fcn.10045b04
pop ecx
jmp 0x1004a4dd
push 1
lea ecx, [ebp - 0x974]
call fcn.1000a48a
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x17c], 0
jmp 0x1004a488
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 1
jge 0x1004a4aa
push dword [ebp - 0x17c]
lea ecx, [ebp - 0x974]
call fcn.1000a502
mov dword [eax], 9
jmp 0x1004a47b
push 0
lea ecx, [ebp - 0x974]
call fcn.1000a502
mov dword [ebp - 0x644], eax
mov eax, dword [ebp - 0x644]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x644]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x974]
call fcn.1000a4e6
push 0xf
push 5
call fcn.100430e4
pop ecx
pop ecx
add eax, dword [ebp - 0x534]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], eax
mov dword [ebp - 0x170], 0xfffffff9
mov dword [ebp - 0x16c], 0xfffffff9
mov dword [ebp - 0x168], 0xfffffff9
mov dword [ebp - 0x164], 0xfffffff9
mov dword [ebp - 0x60], 0x85a1fa14
mov dword [ebp - 0x4c], 0xfffffffb
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x170]
mov dword [ebp - 0x60], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x170]
cmp dword [ebp - 0x60], eax
jg 0x1004a5b0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x170], 0
je 0x1004a568
mov dword [ebp - 0x6d8], 1
jmp 0x1004a56f
and dword [ebp - 0x6d8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x170]
add eax, dword [ebp - 0x6d8]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x170]
jne 0x1004a59f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x170], 0
xor eax, eax
inc eax
je 0x1004a5b0
mov dword [ebp - 0x53c], 1
jmp 0x1004a5b7
and dword [ebp - 0x53c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x170]
cmp dword [ebp - 0x53c], eax
jne 0x1004a5d8
mov dword [ebp - 0x64c], 1
jmp 0x1004a5df
and dword [ebp - 0x64c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x170]
cmp dword [ebp - 0x64c], eax
jg 0x1004a600
mov dword [ebp - 0x544], 1
jmp 0x1004a607
and dword [ebp - 0x544], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x170]
imul eax, dword [ebp - 0x544]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x4c], 3
jmp 0x1004a62e
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x1004a7e3
mov dword [ebp - 0x6e0], 7
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x170], 0
je 0x1004a67b
mov dword [ebp - 0x60], 0
jmp 0x1004a65f
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jg 0x1004a676
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x170], 0
je 0x1004a674
jmp 0x1004a676
jmp 0x1004a658
jmp 0x1004a7de
mov dword [ebp - 0x6e8], 0xfffffffd
mov dword [ebp - 0x60], 3
jmp 0x1004a695
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x1004a7de
mov dword [ebp - 0x554], 0xa9e1a0e1
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x170]
mov dword [ebp - 0xa04], eax
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0xb08], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x170]
add eax, 0x2955
cmp eax, 0xca
jg 0x1004a6f6
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x170], 0
jne 0x1004a6f6
and dword [ebp - 0x6d4], 0
jmp 0x1004a700
mov dword [ebp - 0x6d4], 1
cmp dword [ebp - 0x6d4], 0xa644184
jg 0x1004a718
mov dword [ebp - 0x54c], 1
jmp 0x1004a71f
and dword [ebp - 0x54c], 0
cmp dword [ebp - 0x54c], 7
jle 0x1004a734
mov dword [ebp - 0x654], 1
jmp 0x1004a73b
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x654]
mov dword [ebp - 0x554], eax
mov eax, dword [ebp - 0x554]
mov dword [ebp - 0x6e0], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x170]
cmp dword [ebp - 0x6e0], eax
je 0x1004a771
mov dword [ebp - 0x55c], 1
jmp 0x1004a778
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ebp + ecx*4 - 0x170]
imul ecx, dword [ebp - 0x55c]
cmp dword [ebp + eax*4 - 0x170], ecx
jne 0x1004a7a1
mov dword [ebp - 0x65c], 1
jmp 0x1004a7a8
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x170]
cmp dword [ebp - 0x65c], eax
jg 0x1004a7c6
mov dword [ebp - 0x564], 1
jmp 0x1004a7cd
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x6e8], eax
jmp 0x1004a68e
jmp 0x1004a627
and dword [ebp - 0x138], 0
mov dword [ebp - 0x88], 0x1824a8c6
mov dword [ebp - 0xec], 1
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x3f8], 0x248e
push 1
lea ecx, [ebp - 0x384]
call fcn.1000a48a
mov dword [ebp - 4], 0x16
push 0x67a9
push 0x79d5
push 0x58a3
lea eax, [ebp - 0xa0c]
push eax
push 0x4ed0
push 0
lea eax, [ebp - 0x384]
push eax
call fcn.10046fb2
add esp, 0x1c
mov dword [ebp - 0x88], 0
jmp 0x1004a868
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xffffffef
jl 0x1004ab70
mov dword [ebp - 0xf4], 0xffffffff
push 3
lea ecx, [ebp - 0x8ec]
call fcn.1000a48a
mov byte [ebp - 4], 0x17
push 1
lea ecx, [ebp - 0x944]
call fcn.1000a48a
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x70], 0
jmp 0x1004a8b1
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x1004a8cd
push dword [ebp - 0x70]
lea ecx, [ebp - 0x8ec]
call fcn.1000a502
mov dword [eax], 0xfffffffb
jmp 0x1004a8aa
mov dword [ebp - 0x70], 0
jmp 0x1004a8dd
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1004a8f9
push dword [ebp - 0x70]
lea ecx, [ebp - 0x944]
call fcn.1000a502
mov dword [eax], 4
jmp 0x1004a8d6
cmp dword [ebp - 0x88], 0
jne 0x1004a914
cmp dword [ebp - 0xec], 0
jne 0x1004a914
and dword [ebp - 0x56c], 0
jmp 0x1004a91e
mov dword [ebp - 0x56c], 1
cmp dword [ebp - 0x56c], 1
je 0x1004a933
mov dword [ebp - 0x808], 1
jmp 0x1004a93a
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0xf4], eax
je 0x1004a954
mov dword [ebp - 0x664], 1
jmp 0x1004a95b
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x48], eax
jge 0x1004a97b
mov dword [ebp - 0x574], 1
jmp 0x1004a982
and dword [ebp - 0x574], 0
cmp dword [ebp - 0x574], 5
jne 0x1004a997
mov dword [ebp - 0x724], 1
jmp 0x1004a99e
and dword [ebp - 0x724], 0
cmp dword [ebp - 0x724], 0x58099740
jle 0x1004a9b6
mov dword [ebp - 0x57c], 1
jmp 0x1004a9bd
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x57c], eax
jle 0x1004a9d7
mov dword [ebp - 0x66c], 1
jmp 0x1004a9de
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x66c], eax
jl 0x1004a9f8
mov dword [ebp - 0x584], 1
jmp 0x1004a9ff
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0x584]
jne 0x1004aa19
mov dword [ebp - 0x6e4], 1
jmp 0x1004aa20
and dword [ebp - 0x6e4], 0
cmp dword [ebp - 0x6e4], 0
jge 0x1004aa35
mov dword [ebp - 0x58c], 1
jmp 0x1004aa3c
and dword [ebp - 0x58c], 0
cmp dword [ebp - 0x58c], 0x15ee56e3
jne 0x1004aa54
mov dword [ebp - 0x674], 1
jmp 0x1004aa5b
and dword [ebp - 0x674], 0
cmp dword [ebp - 0x674], 0xe4ed383d
jae 0x1004aa73
mov dword [ebp - 0x594], 1
jmp 0x1004aa7a
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0xf4]
imul eax, dword [ebp - 0x594]
cmp eax, dword [ebp - 0xec]
jl 0x1004aa9b
mov dword [ebp - 0x388], 1
jmp 0x1004aaa2
and dword [ebp - 0x388], 0
push 2
lea ecx, [ebp - 0x8ec]
call fcn.1000a502
mov ecx, dword [ebp - 0x388]
mov dword [eax], ecx
mov eax, 0x4981c586
cmp eax, 0xfffffff8
jne 0x1004aacd
mov dword [ebp - 0x8a4], 1
jmp 0x1004aad4
and dword [ebp - 0x8a4], 0
cmp dword [ebp - 0xf4], 0
jne 0x1004aaef
cmp dword [ebp - 0xf4], 0
jne 0x1004aaef
and dword [ebp - 0x3dc], 0
jmp 0x1004aaf9
mov dword [ebp - 0x3dc], 1
mov eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x3dc]
je 0x1004ab25
push 2
lea ecx, [ebp - 0x8ec]
call fcn.1000a502
cmp dword [eax], 0
je 0x1004ab25
mov dword [ebp - 0x3e0], 1
jmp 0x1004ab2c
and dword [ebp - 0x3e0], 0
push 0
lea ecx, [ebp - 0x944]
call fcn.1000a502
mov ecx, dword [ebp - 0x3e0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x3f8], eax
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x944]
call fcn.1000a4e6
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x8ec]
call fcn.1000a4e6
jmp 0x1004a85b
mov dword [ebp - 0x48], 0
jmp 0x1004ab80
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x1004ac9d
mov dword [ebp - 0x338], 0
push 0
lea ecx, [ebp - 0x384]
call fcn.1000a502
mov esi, eax
push 0
lea ecx, [ebp - 0x384]
call fcn.1000a502
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x1004abc2
mov dword [ebp - 0x810], 1
jmp 0x1004abc9
and dword [ebp - 0x810], 0
push dword [ebp - 0x48]
lea ecx, [ebp - 0x384]
call fcn.1000a502
mov esi, eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0x384]
call fcn.1000a502
mov esi, dword [esi]
imul esi, dword [eax]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x384]
call fcn.1000a502
sub esi, dword [eax]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x384]
call fcn.1000a502
add esi, dword [eax]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x384]
call fcn.1000a502
cmp esi, dword [eax]
je 0x1004ac2a
mov dword [ebp - 0x3e8], 1
jmp 0x1004ac31
and dword [ebp - 0x3e8], 0
push dword [ebp - 0x48]
lea ecx, [ebp - 0x384]
call fcn.1000a502
mov ecx, dword [ebp - 0x3e8]
cmp ecx, dword [eax]
jl 0x1004ac55
mov dword [ebp - 0x3f0], 1
jmp 0x1004ac5c
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x88], eax
push 1
lea eax, [ebp - 0x338]
push eax
lea eax, [ebp - 0x3f8]
push eax
call fcn.10045ca0
add esp, 0xc
jmp 0x1004ab79
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x384]
call fcn.1000a4e6
push 0x6add
push 0x346b
push 1
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10045d2b
add esp, 0x14
mov dword [ebp - 0x38], 0x6dd8d130
push 2
lea ecx, [ebp - 0x7a4]
call fcn.1000a48a
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x36c], 0x74bd
mov dword [ebp - 0x8ac], 1
mov dword [ebp - 0x8d4], 2
lea eax, [ebp - 0x7a4]
push eax
push 0
push 0x2bf2
lea eax, [ebp - 0x118]
push eax
push 0x2093
call fcn.10046c18
add esp, 0x14
mov dword [ebp - 0x118], 0
jmp 0x1004ad3f
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 2
jge 0x1004ad5b
mov eax, dword [ebp - 0x118]
mov dword [ebp + eax*4 - 0xa68], 0xd76df3e2
jmp 0x1004ad32
cmp dword [ebp - 0x38], 0
jne 0x1004af32
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jl 0x1004ad79
mov dword [ebp - 0x400], 1
jmp 0x1004ad80
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x400], eax
je 0x1004ad97
mov dword [ebp - 0x408], 1
jmp 0x1004ad9e
and dword [ebp - 0x408], 0
imul eax, dword [ebp - 0x408], 0x233f
test eax, eax
jne 0x1004adbb
cmp dword [ebp - 0x38], 0
jne 0x1004adbb
and dword [ebp - 0x410], 0
jmp 0x1004adc5
mov dword [ebp - 0x410], 1
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x410]
test eax, eax
jb 0x1004addf
mov dword [ebp - 0x418], 1
jmp 0x1004ade6
and dword [ebp - 0x418], 0
cmp dword [ebp - 0x418], 0xa37b
jg 0x1004adfe
mov dword [ebp - 0x420], 1
jmp 0x1004ae05
and dword [ebp - 0x420], 0
mov esi, dword [ebp - 0x38]
imul esi, dword [ebp - 0x420]
push 1
lea ecx, [ebp - 0x7a4]
call fcn.1000a502
cmp esi, dword [eax]
jge 0x1004ae2c
mov dword [ebp - 0x428], 1
jmp 0x1004ae33
and dword [ebp - 0x428], 0
push 1
lea ecx, [ebp - 0x7a4]
call fcn.1000a502
mov ecx, dword [ebp - 0x428]
cmp ecx, dword [eax]
jg 0x1004ae56
mov dword [ebp - 0x8c4], 1
jmp 0x1004ae5d
and dword [ebp - 0x8c4], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xa14], eax
mov eax, dword [ebp - 0x36c]
cmp dword [ebp - 0x38], eax
jg 0x1004ae7d
mov dword [ebp - 0x430], 1
jmp 0x1004ae84
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x430]
jl 0x1004ae9b
mov dword [ebp - 0x438], 1
jmp 0x1004aea2
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x438], eax
jle 0x1004aebf
cmp dword [ebp - 0x38], 0
je 0x1004aebf
mov dword [ebp - 0x440], 1
jmp 0x1004aec6
and dword [ebp - 0x440], 0
push 1
lea ecx, [ebp - 0x7a4]
call fcn.1000a502
mov ecx, dword [ebp - 0x440]
cmp ecx, dword [eax]
jl 0x1004aee9
mov dword [ebp - 0x448], 1
jmp 0x1004aef0
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x448]
jg 0x1004af07
mov dword [ebp - 0x818], 1
jmp 0x1004af0e
and dword [ebp - 0x818], 0
push 1
lea ecx, [ebp - 0x7a4]
call fcn.1000a502
cmp dword [ebp - 0x36c], 0
jne 0x1004af32
or eax, 0xffffffff
jne 0x1004af32
and dword [ebp - 0x450], 0
jmp 0x1004af3c
mov dword [ebp - 0x450], 1
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x8ac], eax
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x820], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x820]
mov dword [ebp + eax - 0xa68], ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xb20], eax
push 0
lea ecx, [ebp - 0x7a4]
call fcn.1000a502
mov ecx, 0xfd8b
sub ecx, dword [eax]
jne 0x1004af92
mov dword [ebp - 0x458], 1
jmp 0x1004af99
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x8d4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7a4]
call fcn.1000a4e6
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xa1c], 0x3342eb90
mov byte [ebp - 0x9d], 0
push 0
lea eax, [ebp - 0x9d]
push eax
call fcn.10046657
pop ecx
pop ecx
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x1004b004
push 0x1c9a
push 0x491
push 0
call fcn.1004654c
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
sub eax, dword [ebp - 0x138]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x120], 0xfffffffe
push 0x1cbe
push 0x6358
lea eax, [ebp - 0x120]
push eax
push 1
call fcn.10045dc3
add esp, 0x10
mov dword [ebp - 0x120], 0xfffffffe
jmp 0x1004b054
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 2
jle 0x1004b07f
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x1004b07d
push 0xb16
push 0
call fcn.10046213
pop ecx
pop ecx
jmp 0x1004b047
and dword [ebp - 0x128], 0
jmp 0x1004b095
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0xe8]
jge 0x1004b137
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
sub eax, dword [ecx + 0x18]
cmp dword [ebp - 0x128], eax
jae 0x1004b0eb
push 0x7da1
push 0
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x3cfb
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x468]
push eax
call fcn.10046c9c
add esp, 0x20
jmp 0x1004b108
lea eax, [ebp - 0x468]
push eax
push 0x3aac
push 1
lea eax, [ebp - 0x460]
push eax
call fcn.10045e0e
add esp, 0x10
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x468]
mov dword [ecx + eax], edx
push 1
push 0x167b
lea eax, [ebp - 0x10]
push eax
push 0xd2a
call fcn.10045e88
add esp, 0x10
jmp 0x1004b088
mov dword [ebp - 0xac8], 0
mov byte [ebp - 0xd7], 0
push 1
push 0x17f0
lea eax, [ebp - 0xd7]
push eax
call fcn.10045f00
add esp, 0xc
mov byte [ebp - 0xad], 0
movzx eax, byte [ebp - 0xad]
test eax, eax
je 0x1004b17e
push 1
push 0x4d95
call fcn.10045f5f
pop ecx
pop ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
sub eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x14], eax
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.10045fd8
add esp, 0x10
push 3
lea ecx, [ebp - 0x770]
call fcn.1000a48a
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x40], 0x394643cd
mov dword [ebp - 0x1b0], 1
mov dword [ebp - 0x1b8], 0x95621847
mov dword [ebp - 0x340], 1
push 1
lea ecx, [ebp - 0x760]
call fcn.1000a48a
mov byte [ebp - 4], 0x1b
push 4
lea ecx, [ebp - 0x9bc]
call fcn.1000a48a
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0xa24], 7
mov dword [ebp - 0x838], 0
push 0x1fc2
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x770]
push eax
push 0x59e1
push 1
call fcn.10046039
add esp, 0x14
mov dword [ebp - 0x58], 0
jmp 0x1004b24a
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1004b266
push dword [ebp - 0x58]
lea ecx, [ebp - 0x760]
call fcn.1000a502
mov dword [eax], 0xb82a
jmp 0x1004b243
mov dword [ebp - 0x58], 0
jmp 0x1004b276
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x1004b28c
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x98c], 0
jmp 0x1004b26f
lea eax, [ebp - 0x9bc]
push eax
lea eax, [ebp - 0x58]
push eax
push 0x53f3
push 1
push 0x3414
call fcn.100460e3
add esp, 0x14
mov dword [ebp - 0x40], 0
jmp 0x1004b2bb
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jg 0x1004b304
push 0x3719
lea eax, [ebp - 0x770]
push eax
lea eax, [ebp - 0x40]
push eax
push 1
call fcn.100461a0
add esp, 0x10
mov byte [ebp - 0xc6], 0
push 0x79b6
push 0x1781
push 0
push 0x6db8
lea eax, [ebp - 0xc6]
push eax
call fcn.100469ac
add esp, 0x14
jmp 0x1004b2b4
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xb10], eax
push 0
lea ecx, [ebp - 0x770]
call fcn.1000a502
cmp dword [eax], 0
jne 0x1004b331
mov eax, 0x3632
test eax, eax
jne 0x1004b331
and dword [ebp - 0x470], 0
jmp 0x1004b33b
mov dword [ebp - 0x470], 1
push 0
lea ecx, [ebp - 0x770]
call fcn.1000a502
mov eax, dword [eax]
neg eax
add eax, dword [ebp - 0x470]
cmp eax, 0xfbce
jl 0x1004b365
mov dword [ebp - 0x478], 1
jmp 0x1004b36c
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x478]
cmp eax, 2
je 0x1004b387
mov dword [ebp - 0x480], 1
jmp 0x1004b38e
and dword [ebp - 0x480], 0
cmp dword [ebp - 0x480], 2
ja 0x1004b3a3
mov dword [ebp - 0x488], 1
jmp 0x1004b3aa
and dword [ebp - 0x488], 0
push 2
lea ecx, [ebp - 0x770]
call fcn.1000a502
mov ecx, dword [ebp - 0x488]
imul ecx, dword [eax]
test ecx, ecx
je 0x1004b687
mov dword [ebp - 0x1a0], 0x802d14a5
mov dword [ebp - 0x1a8], 0xb7f464f6
mov dword [ebp - 0x828], 0xfffffffa
mov dword [ebp - 0x198], 0
jmp 0x1004b3ff
cmp dword [ebp - 0x198], 1
jge 0x1004b41b
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x130], 0x28405cef
jmp 0x1004b3f2
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x130]
sub esi, dword [ebp - 0x40]
push 2
lea ecx, [ebp - 0x770]
call fcn.1000a502
cmp esi, dword [eax]
jg 0x1004b448
mov dword [ebp - 0xe0], 4
mov dword [ebp - 0x830], 1
cmp dword [ebp - 0xe0], 0x293e35f2
je 0x1004b6b3
mov dword [ebp - 0x4f0], 1
jmp 0x1004b6ba
and dword [ebp - 0x4f0], 0
cmp dword [ebp - 0x4f0], 0
je 0x1004b76b
mov esi, dword [ebp - 0xe0]
push 0
lea ecx, [ebp - 0x760]
call fcn.1000a502
cmp esi, dword [eax]
jne 0x1004b6ea
and dword [ebp - 0x510], 0
push 0
lea ecx, [ebp - 0x760]
call fcn.1000a502
mov ecx, dword [ebp - 0x510]
add ecx, dword [eax]
mov dword [ebp - 0x1b0], ecx
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x1b0], eax
jge 0x1004b8c9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x7c4], eax
mov eax, dword [ebp - 0x7c4]
mov dword [ebp - 0x7cc], eax
mov eax, dword [ebp - 0x7cc]
mov dword [eax], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret