Function at 0x498faa
Capabilities:
Contain obfuscated stackstrings
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b884b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x480
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x49ae62
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x314], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x2cc]
movzx eax, byte [eax]
test eax, eax
je 0x499074
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x3c]
mov dword [eax], 0
jmp 0x49904f
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x3c]
cmp dword [eax], 2
jge 0x49906f
mov eax, dword [ebp - 0x3c]
push dword [eax]
mov ecx, dword [ebp - 0x278]
call fcn.0040af99
mov dword [eax], 1
jmp 0x499044
jmp 0x49ae60
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xcc]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x44], 0x7e2799ac
mov dword [ebp - 0x1f4], 2
mov dword [ebp - 0x284], 0xfffffff8
mov dword [ebp - 0x44], 0
jmp 0x4990c6
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xfffffff2
je 0x49913c
mov dword [ebp - 0x1c0], 0xfffffffa
mov dword [ebp - 0x2e4], 0x5b641b44
push 0x14af
push 0
push 0x3f50
push 1
push 0xe83
lea eax, [ebp - 0x1c0]
push eax
push 0x167f
push 0x5cea
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x44]
push eax
push 0x57a0
lea eax, [ebp - 0x1f4]
push eax
push 0x6180
lea eax, [ebp - 0x284]
push eax
call fcn.0047988f
add esp, 0x38
cmp dword [ebp - 0x1c0], 0
je 0x49913a
jmp 0x4990bf
jmp 0x4990bf
and dword [ebp - 0x100], 0
jmp 0x49915b
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x14]
add eax, 0x28
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x100], eax
jge 0x49ae60
mov dword [ebp - 0x204], 0xb642c70b
mov dword [ebp - 0x384], 0xbc75286e
mov dword [ebp - 0x37c], 1
mov dword [ebp - 0x3e4], 0xe1ca2961
mov dword [ebp - 0x2e0], 0xe307b5ca
mov dword [ebp - 0x36c], 0xfffffffc
mov dword [ebp - 0x3d0], 0
mov dword [ebp - 0x38c], 6
mov dword [ebp - 0x3e8], 0xcf95751c
mov dword [ebp - 0x394], 0xfffffff8
mov dword [ebp - 0x3bc], 0x6f1860ec
mov dword [ebp - 0x350], 8
mov dword [ebp - 0x34c], 8
mov dword [ebp - 0x348], 8
mov dword [ebp - 0x344], 8
lea ecx, [ebp - 0x10d]
call fcn.0040afa8
push eax
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x350]
push eax
lea ecx, [ebp - 0x410]
call fcn.0040afab
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x408]
call fcn.0040af57
mov dword [ebp - 0x39c], 0xfffffffa
mov dword [ebp - 0x1fc], 2
lea eax, [ebp - 0x1fc]
push eax
push 0x5f8d
push 1
push 0x7635
push 0x7d25
push 1
push 0x58ac
push 1
call fcn.00472966
add esp, 0x20
push 1
push 0x374e
lea eax, [ebp - 0x2e0]
push eax
push 0
push 0xd27
lea eax, [ebp - 0x204]
push eax
push 0x181e
push 0x150e
push 0x53c9
push 0x72f0
call fcn.004900e8
add esp, 0x28
lea ecx, [ebp - 0x408]
call fcn.0040af7d
mov dword [ebp - 0x1c8], 0x538f
mov dword [ebp - 0x290], 0xa92790
cmp dword [ebp - 0x1c8], 0x574a
jle 0x49936f
push 0
push 0
call dword [0xaa8198]
and dword [ebp - 0x58], 0
jmp 0x4992f9
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0x5d33
jge 0x49936f
and dword [ebp - 0xb8], 0
jmp 0x499318
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0x2bc4
jge 0x49936d
and dword [ebp - 0x60], 0
jmp 0x499331
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xce2
jge 0x49936b
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0xb8]
sub eax, dword [ebp - 0x60]
cdq
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], edx
push dword [ebp - 0x258]
push dword [ebp - 0x25c]
mov ecx, 0xaa4f58
call fcn.0040ac83
jmp 0x49932a
jmp 0x49930b
jmp 0x4992f2
mov dword [ebp - 0x28], 0xfffffffc
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c8], 0x4fcd
jge 0x499396
mov edx, dword [ebp - 0x290]
mov ecx, 0xaa4f58
call fcn.0040d509
jmp 0x4993b2
or dword [ebp - 4], 0xffffffff
jmp 0x4993bc
mov dword [ebp - 0xe8], 0
jmp 0x4993d5
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 3
jge 0x4993f1
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0x3a8], 0xfffffff9
jmp 0x4993c8
mov dword [ebp - 0x28], 0
jmp 0x499401
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jg 0x49941d
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x3a8]
mov dword [ebp + ecx*4 - 0x3a8], eax
jmp 0x4993fa
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
and eax, 0x20000000
je 0x499436
mov dword [ebp - 0x120], 1
jmp 0x49943d
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x1a4], 0x2540
mov dword [ebp - 0x29c], 0xa927e0
cmp dword [ebp - 0x1a4], 0x262e
jle 0x499516
and dword [ebp - 0x70], 0
jmp 0x49947a
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x3679
jge 0x499516
and dword [ebp - 0x68], 0
jmp 0x499494
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x593d
jge 0x499511
and dword [ebp - 0xc0], 0
jmp 0x4994b3
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x2fb5
jge 0x49950c
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0xc0]
xor eax, dword [ebp - 0x70]
cdq
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], edx
push dword [ebp - 0x264]
push dword [ebp - 0x268]
lea ecx, [ebp - 0x478]
call fcn.004019f8
pop ecx
pop ecx
mov ecx, eax
call fcn.0040ac78
push eax
call fcn.004a1e87
pop ecx
lea ecx, [ebp - 0x478]
call fcn.0040ac6e
jmp 0x4994a6
jmp 0x49948d
jmp 0x499473
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x134], 0x55059b8b
push 1
lea ecx, [ebp - 0x368]
call fcn.0040aeab
push 1
lea eax, [ebp - 0x3c4]
push eax
push 0xf9f
push 0x4d83
lea eax, [ebp - 0x368]
push eax
push 0x1d42
push 0x795
push 0x77cc
push 0x8d
push 0x613b
push 0x3f82
push 0x4d43
push 1
push 0x6400
call fcn.00472a8c
add esp, 0x38
cmp dword [ebp - 0x1c], 0
je 0x499701
cmp dword [ebp - 0x1c], 0
je 0x499701
mov dword [ebp - 0x17c], 0x602c
mov dword [ebp - 0x20c], 0xa92818
cmp dword [ebp - 0x17c], 0x6255
jle 0x499673
and dword [ebp - 0xfc], 0
jmp 0x4995ce
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0x14ba
jge 0x499673
and dword [ebp - 0x78], 0
jmp 0x4995eb
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x14f3
jge 0x49966e
and dword [ebp - 0xc8], 0
jmp 0x49960a
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0x63aa
jge 0x499669
and dword [ebp - 0x80], 0
jmp 0x499623
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x1912
jge 0x499667
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x78]
sar eax, cl
mov ecx, dword [ebp - 0xc8]
sub ecx, dword [ebp - 0x80]
and eax, ecx
cdq
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x270], edx
push dword [ebp - 0x270]
push dword [ebp - 0x274]
mov ecx, 0xaa4f58
call fcn.0040ac83
jmp 0x49961c
jmp 0x4995fd
jmp 0x4995e4
jmp 0x4995c1
push 0x2701
push 0x1a33
push 0xcad
push 0x1de
push 0
push 0x6187
push 0x3c72
push 0x28f2
push 0
push 0x1271
push 0x5a85
push 0xd7f
push 0xfb4
call fcn.0048768e
add esp, 0x34
mov dword [ebp - 4], 2
cmp dword [ebp - 0x17c], 0x5ea6
jge 0x4996d9
mov edx, dword [ebp - 0x20c]
mov ecx, 0xaa4f58
call fcn.0040d509
jmp 0x4996f5
or dword [ebp - 4], 0xffffffff
jmp 0x4996ff
jmp 0x499746
mov dword [ebp - 0x2f4], 0x2751c76d
mov dword [ebp - 0x214], 0xbab59342
mov byte [ebp - 0x1d], 0
push 1
push 1
lea eax, [ebp - 0x1d]
push eax
push 0x2a55
call fcn.00472e57
add esp, 0x10
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x1c], 0
jmp 0x499756
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x499775
push 1
lea eax, [ebp - 0x368]
push eax
push 1
lea eax, [ebp - 0x1c]
push eax
call fcn.00472f05
add esp, 0x10
jmp 0x49974f
lea ecx, [ebp - 0x368]
call fcn.0040af7d
mov dword [ebp - 4], 4
cmp dword [ebp - 0x1a4], 0x243b
jge 0x49979f
push dword [ebp - 0x29c]
call fcn.004a1e87
pop ecx
jmp 0x4997bb
or dword [ebp - 4], 0xffffffff
jmp 0x4997c5
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
and eax, 0x40000000
je 0x4997de
mov dword [ebp - 0x13c], 1
jmp 0x4997e5
and dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x224], 7
mov dword [ebp - 0x18c], 7
mov dword [ebp - 0x1ac], 9
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x184], 0x1962
mov dword [ebp - 0x21c], 0xa92870
cmp dword [ebp - 0x184], 0x1be8
jle 0x49994b
and dword [ebp - 0x90], 0
jmp 0x49985a
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x19ee
jge 0x499940
and dword [ebp - 0xf0], 0
jmp 0x499880
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0x474b
jge 0x49993b
and dword [ebp - 0x88], 0
jmp 0x4998a6
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x85
jge 0x499936
and dword [ebp - 0xd0], 0
jmp 0x4998cc
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0x3990
jge 0x499931
mov eax, dword [ebp - 0xf0]
add eax, dword [ebp - 0x88]
and eax, dword [ebp - 0xd0]
or eax, dword [ebp - 0x90]
cdq
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x27c], edx
push dword [ebp - 0x27c]
push dword [ebp - 0x280]
lea ecx, [ebp - 0x430]
call fcn.004019f8
pop ecx
pop ecx
mov ecx, eax
call fcn.0040ac78
push eax
call fcn.004a1e87
pop ecx
lea ecx, [ebp - 0x430]
call fcn.0040ac6e
jmp 0x4998bf
jmp 0x499899
jmp 0x499873
jmp 0x49984d
push 0x2662
call dword [0xaa8568]
mov dword [ebp - 0x3ac], 0x9a56718e
mov dword [ebp - 4], 6
cmp dword [ebp - 0x184], 0x17c5
jge 0x499974
push dword [ebp - 0x21c]
call fcn.004a1e87
pop ecx
jmp 0x499990
or dword [ebp - 4], 0xffffffff
jmp 0x49999a
mov dword [ebp - 0x3cc], 0xfffffffd
mov dword [ebp - 0x3e0], 1
mov dword [ebp - 0x23c], 0xffffffff
mov dword [ebp - 0x3fc], 0x53526c71
mov dword [ebp - 0x3f8], 0x53526c71
mov dword [ebp - 0x3f4], 0x53526c71
mov dword [ebp - 0x3f0], 0x53526c71
mov dword [ebp - 0x144], 0x3241
mov dword [ebp - 0x2e8], 0xa928a0
cmp dword [ebp - 0x144], 0x35b1
jle 0x499b14
push 0
push 0xad5
push 0x236
push 0x1b9f
call dword [0xaa8098]
and dword [ebp - 0x4c], 0
jmp 0x499a28
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x26cc
jge 0x499b0c
and dword [ebp - 0x98], 0
jmp 0x499a4b
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xdf7
jge 0x499b07
and dword [ebp - 0xd8], 0
jmp 0x499a71
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x558f
jge 0x499b02
and dword [ebp - 0xa0], 0
jmp 0x499a97
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0x6cb0
jge 0x499afd
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0xd8]
sar eax, cl
mov ecx, dword [ebp - 0xa0]
shl eax, cl
cdq
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x288], edx
push dword [ebp - 0x288]
push dword [ebp - 0x28c]
lea ecx, [ebp - 0x448]
call fcn.004019f8
pop ecx
pop ecx
mov ecx, eax
call fcn.0040ac78
push eax
call fcn.004a1e87
pop ecx
lea ecx, [ebp - 0x448]
call fcn.0040ac6e
jmp 0x499a8a
jmp 0x499a64
jmp 0x499a3e
jmp 0x499a21
push 0
call dword [0xaa837c]
mov dword [ebp - 4], 8
cmp dword [ebp - 0x144], 0x312c
jge 0x499b33
push dword [ebp - 0x2e8]
call fcn.004a1e87
pop ecx
jmp 0x499b4f
or dword [ebp - 4], 0xffffffff
jmp 0x499b59
mov dword [ebp - 0xf8], 0
jmp 0x499b72
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jge 0x499b8e
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x328], 0x67bc620
jmp 0x499b65
push 0x4827
push 1
push 0
push 0x6e7
lea eax, [ebp - 0x18c]
push eax
push 0x1290
lea eax, [ebp - 0x224]
push eax
push 0x5a68
push 0x1cb0
push 1
lea eax, [ebp - 0x38]
push eax
push 0x1a8e
push 0x5ffb
call fcn.0049bc75
add esp, 0x34
mov dword [ebp - 0x38], 0x19
jmp 0x499be1
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x1e
jle 0x499d48
mov dword [ebp - 0x2ec], 0xffffffff
mov dword [ebp - 0x22c], 1
mov dword [ebp - 0x2f0], 0xffffffff
mov dword [ebp - 0x2a8], 0
mov dword [ebp - 0x244], 0xcc19583e
mov dword [ebp - 0x370], 3
mov dword [ebp - 0x378], 0xdfcc86f8
mov dword [ebp - 0x2b4], 0
cmp dword [ebp - 0x2a8], 0
je 0x499c59
cmp dword [ebp - 0x22c], 0
je 0x499c59
mov dword [ebp - 0x1c4], 1
jmp 0x499c60
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x2ec]
sub eax, dword [ebp - 0x1c4]
cmp eax, dword [ebp - 0x104]
jge 0x499c80
mov dword [ebp - 0x14c], 1
jmp 0x499c87
and dword [ebp - 0x14c], 0
cmp dword [ebp - 0x14c], 4
ja 0x499caa
xor eax, eax
inc eax
je 0x499caa
cmp dword [ebp - 0x18c], 0
je 0x499caa
mov dword [ebp - 0x234], 1
jmp 0x499cb1
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x388], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x328]
dec eax
mov dword [ebp - 0x154], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x154]
mov dword [ebp + eax - 0x328], ecx
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x154], eax
jle 0x499d19
mov dword [ebp - 0x15c], 1
jmp 0x499d20
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x1ac]
imul ecx, dword [ebp - 0x15c], 0xfdaf
add eax, ecx
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x244], 0
je 0x499d43
jmp 0x499d48
jmp 0x499bda
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
and eax, 0x80000000
je 0x499d61
mov dword [ebp - 0x194], 1
jmp 0x499d68
and dword [ebp - 0x194], 0
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x200], eax
push 0
push 0x2b78
push 1
push 1
call fcn.00491a6b
add esp, 0x10
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
and eax, 0x2000000
je 0x49a3aa
push 0x4000
mov eax, dword [ebp - 0x14]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x14]
push dword [eax + 8]
push 0x93f3
push 0x8893
call fcn.00409ef3
pop ecx
pop ecx
call eax
mov dword [ebp - 0x30], 0x6847
push 3
lea ecx, [ebp - 0x12c]
call fcn.0040aeab
push 4
lea ecx, [ebp - 0x300]
call fcn.0040aeab
mov dword [ebp - 0x164], 0x1e31
mov dword [ebp - 0x2c0], 0xa928f8
cmp dword [ebp - 0x164], 0x1ea0
jle 0x499eeb
and dword [ebp - 0x50], 0
jmp 0x499e0e
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xc32
jge 0x499eeb
and dword [ebp - 0xa8], 0
jmp 0x499e31
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x381c
jge 0x499ee6
and dword [ebp - 0xe0], 0
jmp 0x499e57
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0x3f6d
jge 0x499ee1
and dword [ebp - 0xb0], 0
jmp 0x499e79
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x5037
jge 0x499edc
mov eax, dword [ebp - 0xa8]
imul eax, dword [ebp - 0xe0]
and eax, dword [ebp - 0xb0]
xor eax, dword [ebp - 0x50]
cdq
mov dword [ebp - 0x298], eax
mov dword [ebp - 0x294], edx
push dword [ebp - 0x294]
push dword [ebp - 0x298]
lea ecx, [ebp - 0x460]
call fcn.004019f8
pop ecx
pop ecx
mov ecx, eax
call fcn.0040ac78
push eax
call fcn.004a1e87
pop ecx
lea ecx, [ebp - 0x460]
call fcn.0040ac6e
jmp 0x499e6c
jmp 0x499e4a
jmp 0x499e24
jmp 0x499e07
push 1
lea ecx, [ebp - 0x320]
call fcn.0040aeab
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x164], 0x1be2
jge 0x499f17
push dword [ebp - 0x2c0]
call fcn.004a1e87
pop ecx
jmp 0x499f33
or dword [ebp - 4], 0xffffffff
jmp 0x499f3d
mov dword [ebp - 0x254], 0xd42a
mov dword [ebp - 0x1d8], 1
mov dword [ebp - 0x26c], 4
mov dword [ebp - 0x2d8], 0x2535b5b0
mov dword [ebp - 0x2dc], 0xc525ac89
push 0x70f9
push 0
lea eax, [ebp - 0x12c]
push eax
push 1
push 0x7b54
lea eax, [ebp - 0x34]
push eax
call fcn.00478e76
add esp, 0x18
push 0x2276
lea eax, [ebp - 0x34]
push eax
push 0x30e
push 0x5d58
push 0x38a1
push 1
push 0x4f12
lea eax, [ebp - 0x300]
push eax
push 0x5c48
push 0x71a3
push 0x2c2a
push 0
push 0x4a2d
call fcn.00485793
add esp, 0x34
mov dword [ebp - 0x34], 0
jmp 0x499fe4
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x49a000
push dword [ebp - 0x34]
lea ecx, [ebp - 0x320]
call fcn.0040af99
mov dword [eax], 0x12def906
jmp 0x499fdd
push 0x7cea
push 0x6c0c
lea eax, [ebp - 0x30]
push eax
push 0x2431
push 1
push 0x1ed9
push 0x4456
push 1
push 0x5a27
call fcn.00473116
add esp, 0x24
mov dword [ebp - 0x1bc], 0x2332
mov dword [ebp - 0x24c], 0xa92960
cmp dword [ebp - 0x1bc], 0x268c
jle 0x49a0c2
and dword [ebp - 0x54], 0
jmp 0x49a05b
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x7493
jge 0x49a0c2
and dword [ebp - 0x5c], 0
jmp 0x49a071
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x61a4
jge 0x49a0c0
and dword [ebp - 0x64], 0
jmp 0x49a087
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x3885
jge 0x49a0be
mov eax, dword [ebp - 0x54]
sub eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x64]
cdq
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x2a0], edx
push dword [ebp - 0x2a0]
push dword [ebp - 0x2a4]
mov ecx, 0xaa4f58
call fcn.0040ac83
jmp 0x49a080
jmp 0x49a06a
jmp 0x49a054
mov dword [ebp - 4], 0xc
cmp dword [ebp - 0x1bc], 0x207b
jge 0x49a0e5
mov edx, dword [ebp - 0x24c]
mov ecx, 0xaa4f58
call fcn.0040d509
jmp 0x49a101
or dword [ebp - 4], 0xffffffff
jmp 0x49a10b
cmp dword [ebp - 0x30], 1
jge 0x49a121
xor eax, eax
je 0x49a121
mov dword [ebp - 0x16c], 1
jmp 0x49a128
and dword [ebp - 0x16c], 0
cmp dword [ebp - 0x16c], 0x8586fd5d
ja 0x49a140
mov dword [ebp - 0x19c], 1
jmp 0x49a147
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x19c]
je 0x49a15e
mov dword [ebp - 0x174], 1
jmp 0x49a165
and dword [ebp - 0x174], 0
push 2
lea ecx, [ebp - 0x12c]
call fcn.0040af99
mov ecx, dword [ebp - 0x174]
cmp ecx, dword [eax]
jge 0x49a188
mov dword [ebp - 0x1b4], 1
jmp 0x49a18f
and dword [ebp - 0x1b4], 0
push 1
lea ecx, [ebp - 0x12c]
call fcn.0040af99
mov ecx, dword [ebp - 0x1b4]
cmp ecx, dword [eax]
jg 0x49a1b2
mov dword [ebp - 0x10c], 1
jmp 0x49a1b9
and dword [ebp - 0x10c], 0
push 2
lea ecx, [ebp - 0x300]
call fcn.0040af99
mov ecx, dword [ebp - 0x10c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x11c], eax
push 0
lea ecx, [ebp - 0x320]
call fcn.0040af99
mov ecx, dword [ebp - 0x11c]
mov dword [eax], ecx
mov esi, dword [ebp - 0x30]
sub esi, dword [ebp - 0x11c]
push 2
lea ecx, [ebp - 0x12c]
call fcn.0040af99
cmp esi, dword [eax]
jl 0x49a218
mov dword [ebp - 0x130], 1
jmp 0x49a21f
and dword [ebp - 0x130], 0
push 2
lea ecx, [ebp - 0x12c]
call fcn.0040af99
mov ecx, dword [ebp - 0x130]
cmp ecx, dword [eax]
jg 0x49a242
mov dword [ebp - 0x138], 1
jmp 0x49a249
and dword [ebp - 0x138], 0
push 2
lea ecx, [ebp - 0x12c]
call fcn.0040af99
mov ecx, dword [ebp - 0x138]
imul ecx, dword [eax]
test ecx, ecx
je 0x49a29e
push 1
push 0
push 0x188f
push 0x1afc
push 0x1dc6
push 1
call fcn.00497ca6
add esp, 0x18
mov byte [ebp - 0x16], 0
push 1
lea eax, [ebp - 0x16]
push eax
push 1
push 0xcdf
call fcn.0047330a
add esp, 0x10
jmp 0x49a384
push 2
lea ecx, [ebp - 0x35c]
call fcn.0040aeab
mov dword [ebp - 0x1dc], 0
mov dword [ebp - 0x260], 0xe18e6f96
mov dword [ebp - 0x6c], 0
jmp 0x49a2cf
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x49a2eb
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x35c]
call fcn.0040af99
mov dword [eax], 0xb1ad
jmp 0x49a2c8
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x254]
push eax
push 0x435
lea eax, [ebp - 0x1d8]
push eax
push 0x67da
push 1
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x300]
push eax
push 0x2188
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x2dc]
push eax
push 0
lea eax, [ebp - 0x26c]
push eax
push 0x624e
lea eax, [ebp - 0x1dc]
push eax
call fcn.00475c53
add esp, 0x48
push 0x2ae7
lea eax, [ebp - 0x300]
push eax
push 0x67eb
push 1
push 1
call fcn.004733ad
add esp, 0x14
lea ecx, [ebp - 0x35c]
call fcn.0040af7d
lea ecx, [ebp - 0x320]
call fcn.0040af7d
lea ecx, [ebp - 0x300]
call fcn.0040af7d
lea ecx, [ebp - 0x12c]
call fcn.0040af7d
jmp 0x499145
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x40], 0xb6eab3cf
push 3
lea ecx, [ebp - 0x3b8]
call fcn.0040aeab
push 0
push 1
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x3b8]
push eax
call fcn.0048c11b
add esp, 0x10
push 0x3f89
push 0x39df
push 0
push 1
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0047b0e3
add esp, 0x18
mov dword [ebp - 0x24], 0
jmp 0x49a40d
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff1
je 0x49a6d8
mov dword [ebp - 0x1f0], 0
mov dword [ebp - 0x1f8], 0x509e13c9
mov dword [ebp - 0x40], 0x1b
jmp 0x49a43b
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xfffffffd
jne 0x49a6d3
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x140], 0x3f7f
mov dword [ebp - 0x1e0], 0xa929f8
cmp dword [ebp - 0x140], 0x41e2
jle 0x49a531
and dword [ebp - 0x74], 0
jmp 0x49a480
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x1562
jge 0x49a531
and dword [ebp - 0x7c], 0
jmp 0x49a49a
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xbc1
jge 0x49a52c
and dword [ebp - 0x84], 0
jmp 0x49a4bd
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0x56bd
jge 0x49a527
and dword [ebp - 0x8c], 0
jmp 0x49a4df
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0x33f3
jge 0x49a525
mov eax, dword [ebp - 0x74]
imul eax, dword [ebp - 0x7c]
sub eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x8c]
sar eax, cl
cdq
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x2ac], edx
push dword [ebp - 0x2ac]
push dword [ebp - 0x2b0]
mov ecx, 0xaa4f58
call fcn.0040ac83
jmp 0x49a4d2
jmp 0x49a4b0
jmp 0x49a493
jmp 0x49a479
mov dword [ebp - 4], 0xe
cmp dword [ebp - 0x140], 0x3c2f
jge 0x49a554
mov edx, dword [ebp - 0x1e0]
mov ecx, 0xaa4f58
call fcn.0040d509
jmp 0x49a570
or dword [ebp - 4], 0xffffffff
jmp 0x49a57a
mov dword [ebp - 0x94], 0
jmp 0x49a593
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x49a5af
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x310], 0xffffffff
jmp 0x49a586
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x310], 0xffffffed
jmp 0x49a5dd
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x310]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x310], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x310], 0xffffffeb
jl 0x49a681
mov dword [ebp - 0x1e8], 0x5211521f
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x49a666
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x310]
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0x114]
inc eax
cmp eax, dword [ebp - 0x1f0]
jne 0x49a647
mov dword [ebp - 0x148], 1
jmp 0x49a64e
and dword [ebp - 0x148], 0
cmp dword [ebp - 0x148], 0x7f45
jl 0x49a666
mov dword [ebp - 0x150], 1
jmp 0x49a66d
and dword [ebp - 0x150], 0
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x150]
mov dword [ebp - 0x1f8], eax
jmp 0x49a5c2
mov byte [ebp - 0x17], 0
push 0x1e91
push 1
push 0x459b
push 0x3f58
push 0x2c4f
push 0x245f
push 0x77d9
push 0x46eb
push 0
push 0x203b
push 0x1ede
push 0x583c
lea eax, [ebp - 0x17]
push eax
push 1
push 0x3b79
call fcn.0047e329
add esp, 0x3c
jmp 0x49a434
jmp 0x49a406
lea ecx, [ebp - 0x3b8]
call fcn.0040af7d
lea eax, [ebp - 0x200]
push eax
push 1
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0047230f
add esp, 0x1c
mov dword [ebp - 0x1a0], 5
mov dword [ebp - 0x228], 0xffffffff
mov dword [ebp - 0x158], 0x72a3
mov dword [ebp - 0x218], 0xa92a40
cmp dword [ebp - 0x158], 0x73a5
jle 0x49a817
and dword [ebp - 0xac], 0
jmp 0x49a75d
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x4deb
jge 0x49a80f
and dword [ebp - 0x9c], 0
jmp 0x49a783
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0x7692
jge 0x49a80a
and dword [ebp - 0xa4], 0
jmp 0x49a7a5
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x6ed7
jge 0x49a805
mov eax, dword [ebp - 0x9c]
imul eax, dword [ebp - 0xa4]
and eax, dword [ebp - 0xac]
cdq
mov dword [ebp - 0x2bc], eax
mov dword [ebp - 0x2b8], edx
push dword [ebp - 0x2b8]
push dword [ebp - 0x2bc]
lea ecx, [ebp - 0x490]
call fcn.004019f8
pop ecx
pop ecx
mov ecx, eax
call fcn.0040ac78
push eax
call fcn.004a1e87
pop ecx
lea ecx, [ebp - 0x490]
call fcn.0040ac6e
jmp 0x49a798
jmp 0x49a776
jmp 0x49a750
push 0
call dword [0xaa8074]
mov dword [ebp - 4], 0x10
cmp dword [ebp - 0x158], 0x7116
jge 0x49a836
push dword [ebp - 0x218]
call fcn.004a1e87
pop ecx
jmp 0x49a852
or dword [ebp - 4], 0xffffffff
jmp 0x49a85c
mov dword [ebp - 0xb4], 0
jmp 0x49a875
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x49a891
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x1d4], 0xfffffffa
jmp 0x49a868
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1d4], 0
jmp 0x49a8bf
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d4]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1d4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1d4], 0xffffffe2
jne 0x49aba6
mov dword [ebp - 0x2c], 0x74aa0d72
mov dword [ebp - 0x160], 0x58e9
mov dword [ebp - 0x220], 0xa92a74
cmp dword [ebp - 0x160], 0x5b8d
jle 0x49a985
push 1
push 0
push 0
push 0
call dword [0xaa8300]
and dword [ebp - 0xbc], 0
jmp 0x49a922
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0x4246
jge 0x49a985
and dword [ebp - 0xc4], 0
jmp 0x49a944
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x5177
jge 0x49a983
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0xc4]
shl eax, cl
cdq
mov dword [ebp - 0x2c8], eax
mov dword [ebp - 0x2c4], edx
push dword [ebp - 0x2c4]
push dword [ebp - 0x2c8]
mov ecx, 0xaa4f58
call fcn.0040ac83
jmp 0x49a937
jmp 0x49a915
mov dword [ebp - 0x33c], 0xfffffffc
mov dword [ebp - 0x338], 0xfffffffc
mov dword [ebp - 0x334], 0xfffffffc
mov dword [ebp - 0x330], 0xfffffffc
lea ecx, [ebp - 0x105]
call fcn.0040afa8
push eax
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x33c]
push eax
lea ecx, [ebp - 0x418]
call fcn.0040afab
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3dc]
call fcn.0040af57
mov dword [ebp - 4], 0x12
cmp dword [ebp - 0x160], 0x58b0
jge 0x49aa05
mov edx, dword [ebp - 0x220]
mov ecx, 0xaa4f58
call fcn.0040d509
jmp 0x49aa21
or dword [ebp - 4], 0xffffffff
jmp 0x49aa2b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d4]
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jl 0x49aafc
cmp dword [ebp - 0x2c], 8
jne 0x49aa5c
mov dword [ebp - 0x168], 1
jmp 0x49aa63
and dword [ebp - 0x168], 0
cmp dword [ebp - 0x168], 8
jne 0x49aa78
mov dword [ebp - 0x170], 1
jmp 0x49aa7f
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x170], eax
jge 0x49aa96
mov dword [ebp - 0x178], 1
jmp 0x49aa9d
and dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x178], eax
jne 0x49aab4
mov dword [ebp - 0x180], 1
jmp 0x49aabb
and dword [ebp - 0x180], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d4]
cmp dword [ebp - 0x180], eax
jge 0x49aadc
mov dword [ebp - 0x188], 1
jmp 0x49aae3
and dword [ebp - 0x188], 0
cmp dword [ebp - 0x188], 0x2d3f
jg 0x49aafc
xor eax, eax
jne 0x49aafc
and dword [ebp - 0x190], 0
jmp 0x49ab06
mov dword [ebp - 0x190], 1
mov eax, dword [ebp - 0x190]
sub eax, 0xffff
jne 0x49ab22
cmp dword [ebp - 0x2c], 0
jne 0x49ab22
and dword [ebp - 0x198], 0
jmp 0x49ab2c
mov dword [ebp - 0x198], 1
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x1a0], eax
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x1d4]
push 1
lea ecx, [ebp - 0x3dc]
call fcn.0040af99
cmp esi, dword [eax]
jle 0x49ab62
mov dword [ebp - 0x1a8], 1
jmp 0x49ab69
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0x1a8], eax
jle 0x49ab83
mov dword [ebp - 0x1b0], 1
jmp 0x49ab8a
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x228], eax
lea ecx, [ebp - 0x3dc]
call fcn.0040af7d
jmp 0x49a8a4
mov byte [ebp - 0x15], 0
push 0x7de6
push 1
push 0
lea eax, [ebp - 0x15]
push eax
push 1
push 0x1676
push 0x3444
call fcn.004921f5
add esp, 0x1c
push dword [ebp - 0xcc]
push 1
push 0x4165
push 0x5505
push 0x7e25
push 0x7d48
push 1
lea eax, [ebp - 0x118]
push eax
push 0x4589
push dword [ebp - 0x14]
push 0x86e
push 0
push 0x2f43
call fcn.0049385d
add esp, 0x34
cmp dword [ebp - 0x118], 0
jbe 0x49ae5b
mov dword [ebp - 0xf4], 0x648261f
push 0x3a9b
push 0x7fb0
push 1
push 0x954
push 1
push 0x77d8
call fcn.004735be
add esp, 0x18
mov dword [ebp - 0x1b8], 0x7699
mov dword [ebp - 0x238], 0xa92aa8
cmp dword [ebp - 0x1b8], 0x7934
jle 0x49ad40
and dword [ebp - 0xd4], 0
jmp 0x49ac7d
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x490d
jge 0x49ad40
and dword [ebp - 0xdc], 0
jmp 0x49aca3
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0x6ce
jge 0x49ad3b
and dword [ebp - 0xe4], 0
jmp 0x49acc9
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0x43c2
jge 0x49ad36
and dword [ebp - 0xec], 0
jmp 0x49aceb
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x316d
jge 0x49ad34
mov eax, dword [ebp - 0xd4]
add eax, dword [ebp - 0xdc]
add eax, dword [ebp - 0xe4]
xor eax, dword [ebp - 0xec]
cdq
mov dword [ebp - 0x2d4], eax
mov dword [ebp - 0x2d0], edx
push dword [ebp - 0x2d0]
push dword [ebp - 0x2d4]
mov ecx, 0xaa4f58
call fcn.0040ac83
jmp 0x49acde
jmp 0x49acbc
jmp 0x49ac96
jmp 0x49ac70
mov dword [ebp - 0xf4], 0
jmp 0x49ad59
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xffffffe6
jge 0x49ade6
mov dword [ebp - 0x48], 0x925b0e44
mov dword [ebp - 0x374], 1
push 0x449a
push 0
push 1
push 0x244f
push 0x67d2
push 0x6990
lea eax, [ebp - 0x48]
push eax
call fcn.00493d71
add esp, 0x1c
mov dword [ebp - 0x48], 0
jmp 0x49adab
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xe
jl 0x49ade1
mov dword [ebp - 0x230], 8
push 0x2655
push 1
push 0x37a1
lea eax, [ebp - 0x230]
push eax
push 0x7a68
push 0
push 1
call fcn.0047757f
add esp, 0x1c
jmp 0x49ada4
jmp 0x49ad4c
mov dword [ebp - 4], 0x14
cmp dword [ebp - 0x1b8], 0x74eb
jge 0x49ae09
mov edx, dword [ebp - 0x238]
mov ecx, 0xaa4f58
call fcn.0040d509
jmp 0x49ae25
or dword [ebp - 4], 0xffffffff
jmp 0x49ae2f
lea eax, [ebp - 0x3c8]
push eax
push dword [ebp - 0x240]
push dword [ebp - 0x118]
mov eax, dword [ebp - 0x14]
push dword [eax + 8]
push 0x93f3
push 0x82e3
call fcn.00409ef3
pop ecx
pop ecx
call eax
jmp 0x499145
jmp 0x49ae99
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x248], eax
push 0x12b6
push 0x4702
push 0x6ec3
push 0x6e5
push dword [ebp - 0x248]
push 1
push 0x5c74
push 0x70d1
call fcn.00476fb3
add esp, 0x20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret