Function at 0x45f443
Capabilities:
Contain obfuscated stackstrings
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b9519
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4ac
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 3
lea ecx, [ebp - 0x160]
call fcn.004091ed
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x84], 0xfffffffe
push 3
lea ecx, [ebp - 0x2cc]
call fcn.004091ed
mov dword [ebp - 0x1bc], 0xffffffff
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x328]
push eax
call fcn.00431ecb
pop ecx
pop ecx
lea eax, [ebp - 0x2cc]
push eax
lea eax, [ebp - 0x328]
push eax
call fcn.0045f003
pop ecx
pop ecx
mov byte [ebp - 0x3b], 0
lea eax, [ebp - 0x3b]
push eax
call fcn.00406dea
pop ecx
mov dword [ebp - 0x28], 0
jmp 0x45f4ec
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jg 0x45f8fd
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x68], 0xfffffff7
mov dword [ebp - 0x18c], 0xaf19195c
lea eax, [ebp - 0x2cc]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0045f04b
add esp, 0x18
mov dword [ebp - 0x20], 2
jmp 0x45f547
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x45f8f8
mov dword [ebp - 0x58], 1
push dword [ebp - 0x20]
lea ecx, [ebp - 0x160]
call fcn.004092db
push dword [ebp - 0x20]
lea ecx, [ebp - 0x2cc]
call fcn.004092db
mov esi, eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x160]
call fcn.004092db
mov ecx, dword [esi]
imul ecx, dword [eax]
mov dword [ebp - 0x68], ecx
mov esi, dword [ebp - 0x68]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x160]
call fcn.004092db
sub esi, dword [eax]
cmp esi, 0xb29d
jg 0x45f5b3
mov dword [ebp - 0x1b8], 1
jmp 0x45f5ba
and dword [ebp - 0x1b8], 0
cmp dword [ebp - 0x1b8], 0xa83fb18b
je 0x45f5d2
mov dword [ebp - 0x288], 1
jmp 0x45f5d9
and dword [ebp - 0x288], 0
cmp dword [ebp - 0x288], 0xffffffff
ja 0x45f5ee
mov dword [ebp - 0x27c], 1
jmp 0x45f5f5
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x27c], eax
je 0x45f60c
mov dword [ebp - 0x184], 1
jmp 0x45f613
and dword [ebp - 0x184], 0
mov esi, dword [ebp - 0x34]
add esi, dword [ebp - 0x184]
push 1
lea ecx, [ebp - 0x160]
call fcn.004092db
cmp esi, dword [eax]
jg 0x45f639
mov dword [ebp - 0x270], 1
jmp 0x45f640
and dword [ebp - 0x270], 0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x160]
call fcn.004092db
mov ecx, dword [ebp - 0x270]
add ecx, dword [eax]
cmp ecx, 0x524be18a
jg 0x45f66a
mov dword [ebp - 0x2d4], 1
jmp 0x45f671
and dword [ebp - 0x2d4], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x160]
call fcn.004092db
push dword [ebp - 0x28]
lea ecx, [ebp - 0x160]
call fcn.004092db
mov ecx, dword [ebp - 0x28]
cmp dword [eax], ecx
jle 0x45f6a0
mov dword [ebp - 0x284], 1
jmp 0x45f6a7
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0xcb5c7460
jne 0x45f6cb
mov dword [ebp - 0x21c], 1
jmp 0x45f6d2
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x21c]
inc ecx
imul eax, ecx
test eax, eax
je 0x45f718
mov dword [ebp - 0x34], 0
jmp 0x45f6fa
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jg 0x45f713
mov byte [ebp - 0x3c], 0
movzx eax, byte [ebp - 0x3c]
test eax, eax
je 0x45f711
call fcn.0045f0ea
jmp 0x45f6f3
jmp 0x45f8f3
mov dword [ebp - 0x4c], 0x961f9da9
push dword [ebp - 0x28]
lea ecx, [ebp - 0x160]
call fcn.004092db
mov dword [ebp - 0x194], eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0x160]
call fcn.004092db
mov ecx, dword [ebp - 0x194]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x194]
cmp dword [eax], 0
jne 0x45f765
cmp dword [ebp - 0x68], 0
jne 0x45f765
and dword [ebp - 0x308], 0
jmp 0x45f76f
mov dword [ebp - 0x308], 1
cmp dword [ebp - 0x4c], 0
je 0x45f787
cmp dword [ebp - 0x4c], 0
je 0x45f787
mov dword [ebp - 0x310], 1
jmp 0x45f78e
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x58], eax
je 0x45f7b4
mov dword [ebp - 0x264], 1
jmp 0x45f7bb
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x264]
cmp eax, dword [ebp - 0x68]
jle 0x45f7d6
mov dword [ebp - 0x19c], 1
jmp 0x45f7dd
and dword [ebp - 0x19c], 0
push 0
lea ecx, [ebp - 0x2cc]
call fcn.004092db
mov eax, dword [eax]
cmp eax, dword [ebp - 0x19c]
jle 0x45f800
mov dword [ebp - 0x224], 1
jmp 0x45f807
and dword [ebp - 0x224], 0
cmp dword [ebp - 0x224], 0xfffffffc
jne 0x45f81c
mov dword [ebp - 0x1a4], 1
jmp 0x45f823
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x1a4]
sub eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x84]
jl 0x45f840
mov dword [ebp - 0x29c], 1
jmp 0x45f847
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x29c], eax
jl 0x45f85e
mov dword [ebp - 0x1ac], 1
jmp 0x45f865
and dword [ebp - 0x1ac], 0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x2cc]
call fcn.004092db
mov ecx, dword [ebp - 0x1ac]
imul ecx, dword [eax]
test ecx, ecx
jne 0x45f88c
mov dword [ebp - 0x22c], 1
jmp 0x45f893
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xffff
jbe 0x45f8b7
mov dword [ebp - 0x1b4], 1
jmp 0x45f8be
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x1b4], eax
jg 0x45f8d5
mov dword [ebp - 0x26c], 1
jmp 0x45f8dc
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x26c]
neg eax
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x4c], eax
jmp 0x45f540
jmp 0x45f4e5
lea ecx, [ebp - 0x2cc]
call fcn.004092bf
lea ecx, [ebp - 0x160]
call fcn.004092bf
mov dword [ebp - 0x50], 0xd4e06482
push 1
lea ecx, [ebp - 0x3e0]
call fcn.004091ed
lea eax, [ebp - 0x3e0]
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.0045f0ff
pop ecx
pop ecx
lea eax, [ebp - 0x50]
push eax
call fcn.0045f147
pop ecx
mov dword [ebp - 0x50], 0
jmp 0x45f956
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x45f96c
mov byte [ebp - 0x39], 0
lea eax, [ebp - 0x39]
push eax
call fcn.0045f277
pop ecx
jmp 0x45f94f
lea ecx, [ebp - 0x3e0]
call fcn.004092bf
call fcn.00406fea
mov byte [ebp - 0x154], 0x14
mov byte [ebp - 0x153], 0x22
mov byte [ebp - 0x152], 0x11
mov byte [ebp - 0x151], 7
mov byte [ebp - 0x150], 2
mov byte [ebp - 0x14f], 0x11
mov byte [ebp - 0x14e], 0xc
mov byte [ebp - 0x14d], 0xe
mov byte [ebp - 0x14c], 0x12
mov byte [ebp - 0x14b], 0x1e
mov byte [ebp - 0x14a], 0x15
mov byte [ebp - 0x149], 5
mov byte [ebp - 0x148], 0x13
mov byte [ebp - 0x147], 2
mov byte [ebp - 0x146], 0xd
mov byte [ebp - 0x145], 0x1a
mov byte [ebp - 0x144], 7
mov byte [ebp - 0x143], 6
mov byte [ebp - 0x142], 4
mov byte [ebp - 0x141], 0xd
mov byte [ebp - 0x140], 6
mov byte [ebp - 0x13f], 2
mov byte [ebp - 0x13e], 5
mov byte [ebp - 0x13d], 1
mov byte [ebp - 0x13c], 0x17
mov byte [ebp - 0x13b], 0x1e
mov byte [ebp - 0x13a], 0xe
mov byte [ebp - 0x139], 0x17
mov byte [ebp - 0x138], 1
mov byte [ebp - 0x137], 0xd
mov byte [ebp - 0x136], 0xf
mov byte [ebp - 0x135], 0x12
mov byte [ebp - 0x134], 0x10
mov byte [ebp - 0x133], 1
mov byte [ebp - 0x132], 8
mov byte [ebp - 0x131], 0x18
mov byte [ebp - 0x130], 0xa
mov byte [ebp - 0x12f], 2
mov byte [ebp - 0x12e], 9
mov byte [ebp - 0x12d], 1
mov byte [ebp - 0x12c], 0xb
mov byte [ebp - 0x12b], 6
mov byte [ebp - 0x12a], 0x4f
mov byte [ebp - 0x129], 0x3e
mov byte [ebp - 0x128], 0xbf
mov byte [ebp - 0x127], 0xca
mov byte [ebp - 0x126], 0xae
mov byte [ebp - 0x125], 0x93
mov byte [ebp - 0x124], 0x21
mov byte [ebp - 0x123], 0xb5
mov byte [ebp - 0x122], 0x1e
mov byte [ebp - 0x121], 9
mov byte [ebp - 0x120], 0xcd
mov byte [ebp - 0x11f], 0x5b
mov byte [ebp - 0x11e], 0x1e
mov byte [ebp - 0x11d], 0x63
mov byte [ebp - 0x11c], 0xce
mov byte [ebp - 0x11b], 0x67
mov byte [ebp - 0x11a], 0x16
mov byte [ebp - 0x119], 0xca
mov byte [ebp - 0x118], 0x2d
mov byte [ebp - 0x117], 0xee
mov byte [ebp - 0x116], 0x74
mov byte [ebp - 0x115], 0xb9
mov byte [ebp - 0x114], 0x81
mov byte [ebp - 0x113], 0x57
mov byte [ebp - 0x112], 0xbd
mov byte [ebp - 0x111], 0xc3
mov byte [ebp - 0x110], 0x64
mov byte [ebp - 0x10f], 0xf
mov byte [ebp - 0x10e], 0xb5
mov byte [ebp - 0x10d], 0x35
mov byte [ebp - 0x10c], 0xee
mov byte [ebp - 0x10b], 0x28
mov byte [ebp - 0x10a], 0xd9
mov byte [ebp - 0x109], 0x2f
mov byte [ebp - 0x108], 0x9d
mov byte [ebp - 0x107], 0x2f
mov byte [ebp - 0x106], 0x34
mov byte [ebp - 0x105], 0x4d
mov byte [ebp - 0x104], 0x4f
mov byte [ebp - 0x103], 0x4d
mov byte [ebp - 0x102], 0xc1
mov byte [ebp - 0x101], 0x68
mov byte [ebp - 0x100], 0x31
mov byte [ebp - 0xff], 0x87
mov byte [ebp - 0xfe], 6
mov byte [ebp - 0xfd], 0x87
mov byte [ebp - 0xfc], 0xca
mov byte [ebp - 0xfb], 0x35
mov byte [ebp - 0xfa], 0xf2
mov byte [ebp - 0xf9], 0x21
mov byte [ebp - 0xf8], 2
mov byte [ebp - 0xf7], 0x7f
mov byte [ebp - 0xf6], 0x44
mov byte [ebp - 0xf5], 0xad
mov byte [ebp - 0xf4], 0x42
mov byte [ebp - 0xf3], 0xf8
mov byte [ebp - 0xf2], 0xfb
mov byte [ebp - 0xf1], 0x2b
mov byte [ebp - 0xf0], 0xaa
mov byte [ebp - 0xef], 0x29
mov byte [ebp - 0xee], 0x99
mov byte [ebp - 0xed], 0xa2
mov byte [ebp - 0xec], pe_nt_image_headers32
mov byte [ebp - 0xeb], 0x9b
mov byte [ebp - 0xea], 0x35
mov byte [ebp - 0xe9], 0xc8
mov byte [ebp - 0xe8], 0x78
mov byte [ebp - 0xe7], 0xc7
mov byte [ebp - 0xe6], 0x24
mov byte [ebp - 0xe5], 0x3d
mov byte [ebp - 0xe4], 3
mov byte [ebp - 0xe3], 0x61
mov byte [ebp - 0xe2], 0x48
mov byte [ebp - 0xe1], 0x98
mov byte [ebp - 0xe0], 0x3c
mov byte [ebp - 0xdf], 0xef
mov byte [ebp - 0xde], 0x28
mov byte [ebp - 0xdd], 0x39
mov byte [ebp - 0xdc], 0x6a
mov byte [ebp - 0xdb], 0x31
mov byte [ebp - 0xda], 3
mov byte [ebp - 0xd9], 8
mov byte [ebp - 0xd8], 0x18
mov byte [ebp - 0xd7], 0x1d
mov byte [ebp - 0xd6], 0
mov byte [ebp - 0xd5], 0x18
mov byte [ebp - 0xd4], 0x19
mov byte [ebp - 0xd3], 0x1b
mov byte [ebp - 0xd2], 0x16
mov byte [ebp - 0xd1], 0xd
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x154]
or eax, 0x57
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x154]
and ecx, 0x57
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x154]
mov byte [ebp + ecx - 0x39c], al
mov dword [ebp - 0x70], 0x48261f9c
mov dword [ebp - 0x70], 0
jmp 0x45fd68
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xffffffe6
jle 0x45fdaa
mov dword [ebp - 0x54], 0xfffffffa
mov dword [ebp - 0x54], 0
jmp 0x45fd85
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xfffffff6
jne 0x45fd9e
mov byte [ebp - 0x3a], 0
movzx eax, byte [ebp - 0x3a]
test eax, eax
je 0x45fd9c
call fcn.0045f299
jmp 0x45fd7e
lea eax, [ebp - 0x54]
push eax
call fcn.0045f2a6
pop ecx
jmp 0x45fd61
mov dword [ebp - 0x18], 2
and dword [ebp - 0x5c], 0
jmp 0x45fdbf
mov eax, dword [ebp - 0x18]
inc eax
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x84
jae 0x46059f
push 2
lea ecx, [ebp - 0x298]
call fcn.004091ed
mov dword [ebp - 0x30], 0xdf2f4a8b
mov dword [ebp - 0x3f4], 0
mov dword [ebp - 0x8c], 0
jmp 0x45fe03
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x45fe25
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x298]
call fcn.004092db
mov dword [eax], 0xf0ea75c9
jmp 0x45fdf6
mov dword [ebp - 0x30], 1
jmp 0x45fe35
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x460073
mov dword [ebp - 0x60], 0
jmp 0x45fe4f
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x45fe65
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x2ac], 0xffffffff
jmp 0x45fe48
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2ac], 1
jmp 0x45fe93
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ac]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2ac], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2ac], 0
jl 0x46006e
mov dword [ebp - 0x38], 8
mov dword [ebp - 0x320], 0xb2e809b4
mov dword [ebp - 0x38], 1
jmp 0x45fec8
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x460069
mov dword [ebp - 0x44], 0x7d373ee7
push dword [ebp - 0x30]
lea ecx, [ebp - 0x298]
call fcn.004092db
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov esi, dword [ebp - 0x44]
push dword [ebp - 0x38]
lea ecx, [ebp - 0x298]
call fcn.004092db
add esi, dword [eax]
je 0x45ff29
mov eax, 0xffffa8ec
test eax, eax
je 0x45ff29
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x2ac]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x298]
call fcn.004092db
cmp esi, dword [eax]
jge 0x45ff38
cmp dword [ebp - 0x30], 0
jne 0x45ff38
and dword [ebp - 0x318], 0
jmp 0x45ff42
mov dword [ebp - 0x318], 1
push dword [ebp - 0x30]
lea ecx, [ebp - 0x298]
call fcn.004092db
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0x30], 0
jne 0x45ff78
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2ac], 0
jne 0x45ff78
and dword [ebp - 0x234], 0
jmp 0x45ff82
mov dword [ebp - 0x234], 1
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x320], eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x2ac]
lea ecx, [ebp - 0x298]
call fcn.004092db
cmp dword [eax], 0xdd484073
jae 0x45ffba
mov dword [ebp - 0x1c4], 1
jmp 0x45ffc1
and dword [ebp - 0x1c4], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x298]
call fcn.004092db
mov ecx, dword [ebp - 0x1c4]
mov dword [eax], ecx
mov dword [ebp - 0x44], 0xffffffe6
jmp 0x45ffe7
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffe6
je 0x460064
push 3
lea ecx, [ebp - 0x36c]
call fcn.004091ed
mov dword [ebp - 0x94], 0
jmp 0x460013
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x460035
push dword [ebp - 0x94]
lea ecx, [ebp - 0x36c]
call fcn.004092db
mov dword [eax], 1
jmp 0x460006
push 1
lea ecx, [ebp - 0x36c]
call fcn.004092db
cmp dword [eax], 0
je 0x460054
lea ecx, [ebp - 0x36c]
call fcn.004092bf
jmp 0x460064
lea ecx, [ebp - 0x36c]
call fcn.004092bf
jmp 0x45ffe0
jmp 0x45fec1
jmp 0x45fe78
jmp 0x45fe2e
lea ecx, [ebp - 0x298]
call fcn.004092bf
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x154]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x18], eax
jne 0x46010d
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x154]
inc eax
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x154]
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x410], 0x265a
mov dword [ebp - 0x80], 0xffffffea
jmp 0x4600da
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 8
jge 0x460108
mov dword [ebp - 0x2d0], 0xfffffffb
mov byte [ebp - 0x3e], 0
movzx eax, byte [ebp - 0x3e]
test eax, eax
je 0x4600fb
call fcn.0045f2eb
cmp dword [ebp - 0x2d0], 0
je 0x460106
jmp 0x460108
jmp 0x4600d3
jmp 0x45fdb7
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x153]
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x5c]
movzx ecx, byte [ebp + ecx - 0x156]
movsx ecx, byte [ebp + ecx - 0x39c]
add eax, ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0x153]
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x5c]
movzx edx, byte [ebp + edx - 0x156]
movsx edx, byte [ebp + edx - 0x39c]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0x153]
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x5c]
movzx edx, byte [ebp + edx - 0x156]
movsx edx, byte [ebp + edx - 0x39c]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0x154]
mov byte [ebp + ecx - 0x39c], al
lea eax, [ebp - 0x5c]
push eax
push 0x69be
push 0x62e2
push 0
call fcn.0046177d
add esp, 0x10
push 1
lea ecx, [ebp - 0x2b8]
call fcn.004091ed
mov dword [ebp - 0x24], 0xb0b02971
mov dword [ebp - 0x24c], 0x732adaa2
push 4
lea ecx, [ebp - 0x338]
call fcn.004091ed
mov dword [ebp - 0x244], 0xfffffff8
mov dword [ebp - 0x31c], 0xffffffff
mov dword [ebp - 0x2e0], 0x97911697
mov dword [ebp - 0x324], 0xe785
mov dword [ebp - 0x1fc], 0xfffffffd
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0045f2fa
pop ecx
pop ecx
mov dword [ebp - 0x1c], 0
jmp 0x460223
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x460239
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2c0], 0xfffffff7
jmp 0x46021c
mov dword [ebp - 0x1c], 0
jmp 0x460249
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x460265
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x338]
call fcn.004092db
mov dword [eax], 0x524
jmp 0x460242
mov dword [ebp - 0x1c], 0
jmp 0x460275
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x46028b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4bc], 1
jmp 0x46026e
mov dword [ebp - 0x24], 0
jmp 0x46029b
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jg 0x460517
mov dword [ebp - 0xa0], 0x6411d7fe
mov dword [ebp - 0x2ec], 0x1a6f3221
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2b8]
call fcn.004092db
cmp dword [eax], 0
jne 0x4604cc
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3a4], eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2b8]
call fcn.004092db
cmp dword [eax], 0xfa97
jne 0x4602fb
mov dword [ebp - 0x360], 1
jmp 0x460302
and dword [ebp - 0x360], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2b8]
call fcn.004092db
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2b8]
call fcn.004092db
mov ecx, dword [ebp - 0xa0]
cmp dword [eax], ecx
jge 0x460334
mov dword [ebp - 0x28c], 1
jmp 0x46033b
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x24c]
cmp dword [ebp - 0x28c], eax
jg 0x460355
mov dword [ebp - 0x1cc], 1
jmp 0x46035c
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x1cc]
sub eax, 6
cmp eax, 0xd2ae857b
jne 0x460378
mov dword [ebp - 0x178], 1
jmp 0x46037f
and dword [ebp - 0x178], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x178]
mov dword [ebp + eax - 0x2c0], ecx
mov esi, dword [ebp - 0x178]
add esi, 6
push 3
lea ecx, [ebp - 0x338]
call fcn.004092db
cmp esi, dword [eax]
jl 0x4603b8
mov dword [ebp - 0x23c], 1
jmp 0x4603bf
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x244], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2c0], 9
jne 0x4603f0
cmp dword [ebp - 0xa0], 0
je 0x4603f0
mov dword [ebp - 0x1d4], 1
jmp 0x4603f7
and dword [ebp - 0x1d4], 0
push 0
lea ecx, [ebp - 0x2b8]
call fcn.004092db
mov ecx, dword [ebp - 0x1d4]
cmp ecx, dword [eax]
jge 0x46041a
mov dword [ebp - 0x274], 1
jmp 0x460421
and dword [ebp - 0x274], 0
push 3
lea ecx, [ebp - 0x338]
call fcn.004092db
mov ecx, dword [ebp - 0x274]
cmp ecx, dword [eax]
jg 0x460444
mov dword [ebp - 0x1dc], 1
jmp 0x46044b
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x1dc]
jl 0x460462
mov dword [ebp - 0x34c], 1
jmp 0x460469
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x2e0], 0
je 0x46049c
cmp dword [ebp - 0x324], 0
je 0x46049c
cmp dword [ebp - 0x244], 0
je 0x46049c
mov dword [ebp - 0x1e4], 1
jmp 0x4604a3
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x1e4], eax
jle 0x4604cc
push 3
lea ecx, [ebp - 0x338]
call fcn.004092db
cmp dword [eax], 0
jne 0x4604cc
and dword [ebp - 0x278], 0
jmp 0x4604d6
mov dword [ebp - 0x278], 1
cmp dword [ebp - 0x278], 0xf75d
jge 0x4604ee
mov dword [ebp - 0x1ec], 1
jmp 0x4604f5
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x1ec]
sub eax, dword [ebp - 0xa0]
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x2ec], 0
je 0x460512
jmp 0x460517
jmp 0x460294
cmp dword [ebp - 0x24c], 0xb6910c33
jne 0x46052f
mov dword [ebp - 0x1f4], 1
jmp 0x460536
and dword [ebp - 0x1f4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2c0]
cmp dword [ebp - 0x1f4], eax
jl 0x460557
mov dword [ebp - 0x280], 1
jmp 0x46055e
and dword [ebp - 0x280], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x280]
mov dword [ebp + eax - 0x2c0], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x1fc], 0x8af80453
lea ecx, [ebp - 0x338]
call fcn.004092bf
lea ecx, [ebp - 0x2b8]
call fcn.004092bf
jmp 0x45fdb7
mov dword [ebp - 0x88], 9
mov dword [ebp - 0x88], 0
jmp 0x4605c2
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xffffffe9
jg 0x460838
mov dword [ebp - 0x254], 0xe40
mov dword [ebp - 0x348], 0xaa90fc
cmp dword [ebp - 0x254], 0xfb0
jle 0x46068b
and dword [ebp - 0xb4], 0
jmp 0x460609
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x7346
jge 0x46068b
and dword [ebp - 0x90], 0
jmp 0x46062b
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x686a
jge 0x460686
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0x90]
sar eax, cl
cdq
mov dword [ebp - 0x2dc], eax
mov dword [ebp - 0x2d8], edx
push dword [ebp - 0x2d8]
push dword [ebp - 0x2dc]
lea ecx, [ebp - 0x48c]
call fcn.00401a21
pop ecx
pop ecx
mov ecx, eax
call fcn.00408e8d
push eax
call fcn.004a3217
pop ecx
lea ecx, [ebp - 0x48c]
call fcn.00408e83
jmp 0x46061e
jmp 0x4605fc
mov dword [ebp - 0x32c], 0xfffffffc
and dword [ebp - 4], 0
cmp dword [ebp - 0x254], 0xc4e
jge 0x4606b1
push dword [ebp - 0x348]
call fcn.004a3217
pop ecx
jmp 0x4606cd
or dword [ebp - 4], 0xffffffff
jmp 0x4606d7
mov dword [ebp - 0x204], 0x1c7c
mov dword [ebp - 0x2f8], 0xaa9120
cmp dword [ebp - 0x204], 0x1d74
jle 0x4607cf
and dword [ebp - 0xac], 0
jmp 0x460711
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x3cb3
jge 0x4607c3
and dword [ebp - 0x98], 0
jmp 0x460737
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x73d8
jge 0x4607be
and dword [ebp - 0xbc], 0
jmp 0x460759
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xa5c
jge 0x4607b9
and dword [ebp - 0x78], 0
jmp 0x460772
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x436a
jge 0x4607b7
mov eax, dword [ebp - 0xac]
sub eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0xbc]
add ecx, dword [ebp - 0x78]
xor eax, ecx
cdq
mov dword [ebp - 0x2e8], eax
mov dword [ebp - 0x2e4], edx
push dword [ebp - 0x2e4]
push dword [ebp - 0x2e8]
mov ecx, 0xac0918
call fcn.00408e98
jmp 0x46076b
jmp 0x46074c
jmp 0x46072a
jmp 0x460704
push 0
push 0
push 0
call dword [0xac3350]
mov byte [ebp - 0x3d], 0
mov dword [ebp - 4], 2
cmp dword [ebp - 0x204], 0x1906
jge 0x4607f6
mov edx, dword [ebp - 0x2f8]
mov ecx, 0xac0918
call fcn.0040bb10
jmp 0x460812
or dword [ebp - 4], 0xffffffff
jmp 0x46081c
lea eax, [ebp - 0x3d]
push eax
call fcn.0045f342
pop ecx
lea eax, [ebp - 0x32c]
push eax
call fcn.0045f36a
pop ecx
jmp 0x4605b5
xor eax, eax
inc eax
imul eax, eax, 0x1a
mov byte [ebp + eax - 0x39c], 0
call fcn.0045f3b4
lea eax, [ebp - 0x39c]
push eax
lea ecx, [ebp - 0x474]
call fcn.00467b48
and dword [ebp - 0x7c], 0
jmp 0x46086a
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0x1b
jae 0x460939
mov dword [ebp - 0x304], 0xfffffffc
mov dword [ebp - 0x48], 0xce9d05ba
and dword [ebp - 0x380], 0
and dword [ebp - 0x37c], 0
and dword [ebp - 0x378], 0
and dword [ebp - 0x374], 0
lea ecx, [ebp - 0x165]
call fcn.004092ea
push eax
lea eax, [ebp - 0x370]
push eax
lea eax, [ebp - 0x380]
push eax
lea ecx, [ebp - 0x45c]
call fcn.004092ed
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x43c]
call fcn.00409299
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00406e7b
pop ecx
pop ecx
mov dword [ebp - 0x48], 0
jmp 0x4608f8
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jg 0x46091e
mov dword [ebp - 0x2a0], 9
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
je 0x46091c
jmp 0x4608f1
jmp 0x4608f1
lea ecx, [ebp - 0x43c]
call fcn.004092bf
mov eax, dword [ebp - 0x7c]
mov byte [ebp + eax - 0x39c], 0
jmp 0x460863
mov dword [ebp - 0x3b8], 5
mov dword [ebp - 0x3c0], 3
mov dword [ebp - 0x3c8], 0xffffffff
mov dword [ebp - 0x3d0], 0xade2167
mov dword [ebp - 0x20c], 0x2aae
mov dword [ebp - 0x340], 0xaa9190
cmp dword [ebp - 0x20c], 0x2b50
jle 0x460a29
and dword [ebp - 0x64], 0
jmp 0x460992
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x5ac
jge 0x4609f9
and dword [ebp - 0x6c], 0
jmp 0x4609a8
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x3bc3
jge 0x4609f7
and dword [ebp - 0x74], 0
jmp 0x4609be
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x3eaf
jge 0x4609f5
mov eax, dword [ebp - 0x64]
sub eax, dword [ebp - 0x6c]
and eax, dword [ebp - 0x74]
cdq
mov dword [ebp - 0x2f4], eax
mov dword [ebp - 0x2f0], edx
push dword [ebp - 0x2f0]
push dword [ebp - 0x2f4]
mov ecx, 0xac0918
call fcn.00408e98
jmp 0x4609b7
jmp 0x4609a1
jmp 0x46098b
push 0
push 0x25eb
push 0x1b3f
push 0x12bb
push 0x1d1b
push 0x12cc
push 0xacb
push 0x1323
push 0x227c
call dword [0xac309c]
mov dword [ebp - 0x418], 0
mov dword [ebp - 4], 4
cmp dword [ebp - 0x20c], 0x2949
jge 0x460a56
mov edx, dword [ebp - 0x340]
mov ecx, 0xac0918
call fcn.0040bb10
jmp 0x460a72
or dword [ebp - 4], 0xffffffff
jmp 0x460a7c
mov dword [ebp - 0x420], 0x6a3367f5
mov dword [ebp - 0x25c], 0x65b1
mov dword [ebp - 0x30c], 0xaa9218
cmp dword [ebp - 0x25c], 0x6993
jle 0x460b72
and dword [ebp - 0x9c], 0
jmp 0x460ac0
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0x5349
jge 0x460b72
and dword [ebp - 0xa8], 0
jmp 0x460ae6
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x5dcf
jge 0x460b6d
and dword [ebp - 0xb0], 0
jmp 0x460b08
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x4027
jge 0x460b68
mov eax, dword [ebp - 0x9c]
imul eax, dword [ebp - 0xa8]
xor eax, dword [ebp - 0xb0]
cdq
mov dword [ebp - 0x300], eax
mov dword [ebp - 0x2fc], edx
push dword [ebp - 0x2fc]
push dword [ebp - 0x300]
lea ecx, [ebp - 0x4b0]
call fcn.00401a21
pop ecx
pop ecx
mov ecx, eax
call fcn.00408e8d
push eax
call fcn.004a3217
pop ecx
lea ecx, [ebp - 0x4b0]
call fcn.00408e83
jmp 0x460afb
jmp 0x460ad9
jmp 0x460ab3
mov dword [ebp - 0x33c], 1
mov dword [ebp - 4], 6
cmp dword [ebp - 0x25c], 0x63a8
jge 0x460b9b
push dword [ebp - 0x30c]
call fcn.004a3217
pop ecx
jmp 0x460bb7
or dword [ebp - 4], 0xffffffff
jmp 0x460bc1
mov dword [ebp - 0x214], 9
mov eax, dword [ebp - 0x214]
dec eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x33c], 1
push 0xa9d519
lea ecx, [ebp - 0x454]
call fcn.00467b48
mov dword [ebp - 0x428], 0xaabecba2
mov dword [ebp - 0x430], 0xd97a888a
mov dword [ebp - 0x3fc], 0xffffffff
push 3
lea ecx, [ebp - 0x3f0]
call fcn.004091ed
mov dword [ebp - 0x424], 0xeda58528
mov dword [ebp - 0x180], 0xd5fe
mov dword [ebp - 0x2c], 0
jmp 0x460c41
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x460c57
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x498], 0xffffffff
jmp 0x460c3a
mov dword [ebp - 0x2c], 0
jmp 0x460c67
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x460c80
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x3f0]
call fcn.004092db
and dword [eax], 0
jmp 0x460c60
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
lea ecx, [ebp - 0x3f0]
call fcn.004092bf
lea eax, [ebp - 0x474]
push eax
push 0x184a
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x3ac]
push eax
push 0
push 0x699e
push 0x4117
push 0x7a56
push 0x74b
call fcn.00461dfa
add esp, 0x28
mov dword [ebp - 0xd0], 0x2d5e48d3
mov dword [ebp - 0xcc], 0x2d5e48d3
mov dword [ebp - 0xc8], 0x2d5e48d3
mov dword [ebp - 0xc4], 0x2d5e48d3
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x35c], 0xfffffff9
mov dword [ebp - 0x358], 0xfffffff9
mov dword [ebp - 0x354], 0xfffffff9
mov dword [ebp - 0x350], 0xfffffff9
mov dword [ebp - 0x16c], 0xc9a7b2e0
mov dword [ebp - 0x208], 2
mov dword [ebp - 0x164], 1
mov dword [ebp - 0x314], 0xd30a9375
mov dword [ebp - 0x404], 0x971a050d
mov dword [ebp - 0xb8], 0
jmp 0x460d76
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jge 0x460d92
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x344], 1
jmp 0x460d69
mov dword [ebp - 0x14], 3
jmp 0x460da2
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x4611d9
mov dword [ebp - 0xc0], 1
mov dword [ebp - 0x170], 0x5b042041
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0xa4], 0x9db3fa3c
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xd0]
mov dword [ebp - 0x3b4], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xd0]
add eax, dword [ebp - 0x14]
je 0x460e0e
mov eax, 0x21342f3d
test eax, eax
je 0x460e0e
cmp dword [ebp - 0x14], 0
je 0x460e0e
mov dword [ebp - 0x188], 1
jmp 0x460e15
and dword [ebp - 0x188], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xd0]
cmp dword [ebp - 0x188], eax
je 0x460e36
mov dword [ebp - 0x190], 1
jmp 0x460e3d
and dword [ebp - 0x190], 0
cmp dword [ebp - 0x190], 0
jbe 0x460e52
mov dword [ebp - 0x198], 1
jmp 0x460e59
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xd0]
cmp dword [ebp - 0x198], eax
je 0x460e77
mov dword [ebp - 0x1a0], 1
jmp 0x460e7e
and dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xd0]
cmp eax, dword [ebp - 0x1a0]
jge 0x460e9c
mov dword [ebp - 0x1a8], 1
jmp 0x460ea3
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xd0]
imul eax, dword [ebp - 0x1a8]
sub eax, 0x268d3bf7
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xd0]
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd0], 0xd955a619
jbe 0x460f0f
mov dword [ebp - 0x1b0], 1
jmp 0x460f16
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xd0]
cmp eax, dword [ebp - 0x170]
jle 0x460f40
mov dword [ebp - 0x17c], 1
jmp 0x460f47
and dword [ebp - 0x17c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x17c]
sub ecx, dword [ebp + eax - 0xd0]
cmp ecx, dword [ebp - 0x1c8]
jle 0x460f6e
mov dword [ebp - 0x1c0], 1
jmp 0x460f75
and dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0x1c0]
add eax, 3
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xd0], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd0], 1
cmp dword [ebp - 0x14], 1
jge 0x460fab
mov dword [ebp - 0x1f8], 1
jmp 0x460fb2
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x14], 0
jg 0x460fcd
mov dword [ebp - 0x1d0], 1
jmp 0x460fd4
and dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c8]
add ecx, dword [ebp - 0x1d0]
imul eax, ecx
cmp eax, dword [ebp - 0x14]
jge 0x460ff7
mov dword [ebp - 0x1d8], 1
jmp 0x460ffe
and dword [ebp - 0x1d8], 0
mov eax, dword [ebp - 0x1d8]
add eax, 9
cmp eax, dword [ebp - 0xa4]
jl 0x46101b
mov dword [ebp - 0x1e0], 1
jmp 0x461022
and dword [ebp - 0x1e0], 0
cmp dword [ebp - 0x1e0], 0
je 0x461037
mov dword [ebp - 0x1e8], 1
jmp 0x46103e
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x1e8], eax
jge 0x461058
mov dword [ebp - 0x1f0], 1
jmp 0x46105f
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x1f0]
sub eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1f8], eax
jne 0x461085
cmp dword [ebp - 0xa4], 0
je 0x461085
mov dword [ebp - 0x200], 1
jmp 0x46108c
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x200]
cmp eax, 0xaee
je 0x4610a8
mov dword [ebp - 0x174], 1
jmp 0x4610af
and dword [ebp - 0x174], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x174]
mov dword [ebp + eax - 0x35c], ecx
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0xd0], 0
jne 0x461112
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0xd0], 0
jne 0x461112
and dword [ebp - 0x210], 0
jmp 0x46111c
mov dword [ebp - 0x210], 1
cmp dword [ebp - 0x210], 0
jl 0x461131
mov dword [ebp - 0x218], 1
jmp 0x461138
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x164], eax
xor eax, eax
cmp eax, 0x562e
je 0x461159
mov dword [ebp - 0x220], 1
jmp 0x461160
and dword [ebp - 0x220], 0
cmp dword [ebp - 0x220], 0x32af72da
jne 0x461178
mov dword [ebp - 0x228], 1
jmp 0x46117f
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x228], eax
je 0x461199
mov dword [ebp - 0x230], 1
jmp 0x4611a0
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x170]
add eax, dword [ebp - 0x230]
je 0x4611c1
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x4611c1
mov dword [ebp - 0x238], 1
jmp 0x4611c8
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0xa4], eax
jmp 0x460d9b
cmp dword [ebp - 0x314], 0
jne 0x4611fb
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd0], 0
jne 0x4611fb
and dword [ebp - 0x240], 0
jmp 0x461205
mov dword [ebp - 0x240], 1
cmp dword [ebp - 0x240], 0
jg 0x46121a
mov dword [ebp - 0x248], 1
jmp 0x461221
and dword [ebp - 0x248], 0
cmp dword [ebp - 0x248], 0xffffffff
jne 0x461236
mov dword [ebp - 0x250], 1
jmp 0x46123d
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x16c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x35c]
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x3f8], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x344], 0
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x35c], 0x90d92204
jl 0x461298
mov dword [ebp - 0x258], 1
jmp 0x46129f
and dword [ebp - 0x258], 0
cmp dword [ebp - 0x258], 1
jge 0x4612b4
mov dword [ebp - 0x260], 1
jmp 0x4612bb
and dword [ebp - 0x260], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x35c]
cmp eax, dword [ebp - 0x260]
jge 0x4612db
mov dword [ebp - 0x268], 1
jmp 0x4612e2
and dword [ebp - 0x268], 0
imul eax, dword [ebp - 0x268], 0x9c4b
mov dword [ebp - 0x164], eax
lea eax, [ebp - 0x454]
push eax
mov ecx, dword [ebp + 8]
call fcn.00409101
lea ecx, [ebp - 0x454]
call fcn.0040915a
lea ecx, [ebp - 0x474]
call fcn.0040915a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret