Function at 0x475430
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a64d2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x58c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x477a72
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2fc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x35c]
movzx eax, byte [eax]
test eax, eax
je 0x477a57
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x268], 0x4128
mov dword [ebp - 0x3b4], 0xaa5724
cmp dword [ebp - 0x268], 0x424d
jle 0x475536
push 0
call dword [0xab6120]
and dword [ebp - 0xf4], 0
jmp 0x4754d2
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0x5caa
jge 0x475536
and dword [ebp - 0x94], 0
jmp 0x4754f4
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0x35b0
jge 0x475534
mov eax, dword [ebp - 0xf4]
cdq
idiv dword [ebp - 0x94]
mov eax, edx
cdq
mov dword [ebp - 0x308], eax
mov dword [ebp - 0x304], edx
push dword [ebp - 0x304]
push dword [ebp - 0x308]
mov ecx, 0xab36e8
call fcn.0041b4f7
jmp 0x4754e7
jmp 0x4754c5
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x60], 0xbc40ed3c
mov dword [ebp - 0x110], 0
jmp 0x47555d
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 2
jge 0x475576
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x70], 0x43cdf98a
jmp 0x475550
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x70]
mov dword [ebp - 0x48c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x70]
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x2c], 0
je 0x4755ae
cmp dword [ebp - 0x60], 0
je 0x4755ae
mov dword [ebp - 0x18c], 1
jmp 0x4755b5
and dword [ebp - 0x18c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x70]
cmp eax, dword [ebp - 0x18c]
jl 0x4755d3
mov dword [ebp - 0x2b4], 1
jmp 0x4755da
and dword [ebp - 0x2b4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x70]
cmp dword [ebp - 0x2b4], eax
jl 0x4755f8
mov dword [ebp - 0x170], 1
jmp 0x4755ff
and dword [ebp - 0x170], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x70]
cmp eax, dword [ebp - 0x170]
jge 0x47561d
mov dword [ebp - 0x2ac], 1
jmp 0x475624
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x2ac]
inc eax
je 0x47563f
cmp dword [ebp - 0x60], 0
je 0x47563f
mov dword [ebp - 0x16c], 1
jmp 0x475646
and dword [ebp - 0x16c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x16c]
mov dword [ebp + eax - 0x70], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x70]
mov dword [ebp - 0x43c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x70]
mov dword [ebp - 0x480], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x70], 0xfffb
jae 0x475692
mov dword [ebp - 0x2a0], 1
jmp 0x475699
and dword [ebp - 0x2a0], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x70]
cmp dword [ebp + eax - 0x70], ecx
jl 0x4756bb
mov dword [ebp - 0x178], 1
jmp 0x4756c2
and dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x2a0]
add eax, dword [ebp - 0x178]
je 0x475922
mov dword [ebp - 0x60], 0
jmp 0x4756e4
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x13
jle 0x475920
mov dword [ebp - 0x2c], 0x10
jmp 0x4756fe
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x30
je 0x47591b
push 3
lea ecx, [ebp - 0x3c4]
call fcn.0041b63b
push 0
lea eax, [ebp - 0x444]
push eax
push 0x1ff5
lea eax, [ebp - 0x3c4]
push eax
push 0xc26
call fcn.00483f5a
add esp, 0x14
push 0
lea ecx, [ebp - 0x3c4]
call fcn.00401332
mov dword [eax], 0xffffffe6
jmp 0x475770
push 0
lea ecx, [ebp - 0x3c4]
call fcn.00401332
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x218]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x3c4]
call fcn.00401332
cmp dword [eax], 0xe
je 0x47590b
mov dword [ebp - 0x9c], 0x5d580090
mov byte [ebp - 0x56], 0
movzx eax, byte [ebp - 0x56]
test eax, eax
je 0x4757b1
push 0
push 0x2ec
push 0
push 0
push 0
push 0
call dword [0xab6200]
mov dword [ebp - 0x9c], 1
jmp 0x4757ca
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jl 0x475906
mov dword [ebp - 0x180], 0x22ba
mov dword [ebp - 0x3a0], 0xaa5758
cmp dword [ebp - 0x180], 0x23dd
jle 0x47589b
push 0
push 0
call dword [0xab612c]
and dword [ebp - 0xfc], 0
jmp 0x47581b
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0x37fa
jge 0x47589b
and dword [ebp - 0xa4], 0
jmp 0x47583d
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x7d53
jge 0x475896
mov eax, dword [ebp - 0xfc]
xor eax, dword [ebp - 0xa4]
cdq
mov dword [ebp - 0x314], eax
mov dword [ebp - 0x310], edx
push dword [ebp - 0x310]
push dword [ebp - 0x314]
lea ecx, [ebp - 0x584]
call fcn.00401e2f
pop ecx
pop ecx
mov ecx, eax
call fcn.0041b4cc
push eax
call fcn.0048ee0a
pop ecx
lea ecx, [ebp - 0x584]
call fcn.00401328
jmp 0x475830
jmp 0x47580e
mov byte [ebp - 0x55], 0
and dword [ebp - 4], 0
cmp dword [ebp - 0x180], 0x212c
jge 0x4758bb
push dword [ebp - 0x3a0]
call fcn.0048ee0a
pop ecx
jmp 0x4758d7
or dword [ebp - 4], 0xffffffff
jmp 0x4758e1
movzx eax, byte [ebp - 0x55]
test eax, eax
je 0x475901
push 1
push 0x6f0f
push 1
push 0x51f6
push 0
call fcn.004832f6
add esp, 0x14
jmp 0x4757bd
jmp 0x47574c
lea ecx, [ebp - 0x3c4]
call fcn.0041b70d
jmp 0x4756f7
jmp 0x4756dd
jmp 0x47599b
mov byte [ebp - 0x49], 0
movzx eax, byte [ebp - 0x49]
test eax, eax
je 0x47593f
push 0
push 0x15e3
push 0
push 0
call dword [0xab6300]
mov dword [ebp - 0x2c], 0
jmp 0x47594f
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jg 0x47599b
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x70]
mov dword [ebp + ecx*4 - 0x70], eax
mov byte [ebp - 0x57], 0
movzx eax, byte [ebp - 0x57]
test eax, eax
je 0x475999
push 0x70b4
push 0x4a20
push 0
push 0x76d8
push 0x2dad
push 0x7228
push 1
push 0x345f
call fcn.004745f3
add esp, 0x20
jmp 0x475948
mov dword [ebp - 4], 2
cmp dword [ebp - 0x268], 0x4064
jge 0x4759c0
push dword [ebp - 0x3b4]
push 0xab36e8
call fcn.0041cf47
pop ecx
pop ecx
jmp 0x4759dc
or dword [ebp - 4], 0xffffffff
jmp 0x4759e6
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xe8]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x488], 0xc8959310
mov dword [ebp - 0x220], 0x12f3ccd2
mov dword [ebp - 0x30], 0
jmp 0x475a25
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x475a3b
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x3b0], 8
jmp 0x475a1e
mov dword [ebp - 0x30], 0
jmp 0x475a4b
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x475a61
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x44c], 1
jmp 0x475a44
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3b0], 0xffffffff
jmp 0x475a8f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3b0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3b0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3b0], 0x19
je 0x475ad3
mov dword [ebp - 0x188], 0xffffffff
mov dword [ebp - 0x2f4], 0xfffffffb
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3b0]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x2f4], eax
jmp 0x475a74
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
and dword [ebp - 0x150], 0
jmp 0x475aff
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x24]
add eax, 0x28
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x150], eax
jge 0x477a55
mov dword [ebp - 0x190], 0x7809
mov dword [ebp - 0x2d0], 0xaa5774
cmp dword [ebp - 0x190], 0x7a1e
jle 0x475be3
push 0x20a9
push 0
push 0x197e
call dword [0xab619c]
and dword [ebp - 0x118], 0
jmp 0x475b63
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0x7ef
jge 0x475be3
and dword [ebp - 0xac], 0
jmp 0x475b85
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xa88
jge 0x475bde
mov eax, dword [ebp - 0x118]
or eax, dword [ebp - 0xac]
cdq
mov dword [ebp - 0x320], eax
mov dword [ebp - 0x31c], edx
push dword [ebp - 0x31c]
push dword [ebp - 0x320]
lea ecx, [ebp - 0x524]
call fcn.00401e2f
pop ecx
pop ecx
mov ecx, eax
call fcn.0041b4cc
push eax
call fcn.0048ee0a
pop ecx
lea ecx, [ebp - 0x524]
call fcn.00401328
jmp 0x475b78
jmp 0x475b56
mov dword [ebp - 4], 4
cmp dword [ebp - 0x190], 0x7528
jge 0x475c02
push dword [ebp - 0x2d0]
call fcn.0048ee0a
pop ecx
jmp 0x475c1e
or dword [ebp - 4], 0xffffffff
jmp 0x475c28
mov dword [ebp - 0x74], 0xfffffff9
mov dword [ebp - 0x14], 0xc04c
mov dword [ebp - 0x120], 0x3f126c7f
push 4
lea ecx, [ebp - 0x41c]
call fcn.0041b63b
mov dword [ebp - 0x290], 0x4b1c
mov dword [ebp - 0x368], 0xaa57a0
cmp dword [ebp - 0x290], 0x4e19
jle 0x475d38
and dword [ebp - 0x88], 0
jmp 0x475c87
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x29b9
jge 0x475d38
and dword [ebp - 0xb4], 0
jmp 0x475cad
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x7b44
jge 0x475d33
and dword [ebp - 0x104], 0
jmp 0x475ccf
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x542d
jge 0x475d2e
mov eax, dword [ebp - 0x88]
or eax, dword [ebp - 0xb4]
or eax, dword [ebp - 0x104]
cdq
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x328], edx
push dword [ebp - 0x328]
push dword [ebp - 0x32c]
lea ecx, [ebp - 0x4f4]
call fcn.00401e2f
pop ecx
pop ecx
mov ecx, eax
call fcn.0041b4cc
push eax
call fcn.0048ee0a
pop ecx
lea ecx, [ebp - 0x4f4]
call fcn.00401328
jmp 0x475cc2
jmp 0x475ca0
jmp 0x475c7a
mov dword [ebp - 4], 6
cmp dword [ebp - 0x290], 0x4a5e
jge 0x475d57
push dword [ebp - 0x368]
call fcn.0048ee0a
pop ecx
jmp 0x475d73
or dword [ebp - 4], 0xffffffff
jmp 0x475d7d
push 0x2018
push 0x43
lea eax, [ebp - 0x490]
push eax
push 0xff4
push 0x77b5
push 1
push 0x3c0a
push 0
lea eax, [ebp - 0x41c]
push eax
call fcn.0047cc1b
add esp, 0x24
mov dword [ebp - 0x74], 0
jmp 0x475dbd
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xfffffff0
jl 0x47617b
push 4
lea ecx, [ebp - 0x2c0]
call fcn.0041b63b
mov dword [ebp - 0x78], 0xffff
mov dword [ebp - 0xbc], 0
jmp 0x475df4
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 4
jge 0x475e16
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x2c0]
call fcn.00401332
mov dword [eax], 3
jmp 0x475de7
cmp dword [ebp - 0x14], 0
jne 0x475ece
push 1
lea ecx, [ebp - 0x2c0]
call fcn.00401332
cmp dword [eax], 0x49f4ffcf
jle 0x475e41
mov dword [ebp - 0x198], 1
jmp 0x475e48
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x198]
cmp eax, 0x60a22152
je 0x475e65
mov dword [ebp - 0x228], 1
jmp 0x475e6c
and dword [ebp - 0x228], 0
push 2
lea ecx, [ebp - 0x2c0]
call fcn.00401332
mov ecx, dword [ebp - 0x228]
cmp ecx, dword [eax]
jge 0x475e8f
mov dword [ebp - 0x1a0], 1
jmp 0x475e96
and dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1a0], eax
jne 0x475eb0
cmp dword [ebp - 0x14], 0
jne 0x475eb0
and dword [ebp - 0x270], 0
jmp 0x475eba
mov dword [ebp - 0x270], 1
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x270]
jg 0x475ece
and dword [ebp - 0x1a8], 0
jmp 0x475ed8
mov dword [ebp - 0x1a8], 1
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x1a8], eax
jle 0x475eef
mov dword [ebp - 0x230], 1
jmp 0x475ef6
and dword [ebp - 0x230], 0
push 2
lea ecx, [ebp - 0x2c0]
call fcn.00401332
mov eax, dword [eax]
cmp eax, dword [ebp - 0x230]
je 0x475f12
xor eax, eax
inc eax
je 0x475f44
push 0x63c
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x37ec
lea eax, [ebp - 0x120]
push eax
push 0
push 0x72c6
push 0x2bd7
call fcn.00477c36
add esp, 0x20
jmp 0x47616b
mov dword [ebp - 0x2c4], 0xffff
mov dword [ebp - 0x148], 0xf34d89bb
mov dword [ebp - 0x2d8], 0xcd5ccfde
mov dword [ebp - 0x42c], 0xc9f13a4b
mov dword [ebp - 0x428], 0xc9f13a4b
mov dword [ebp - 0x424], 0xc9f13a4b
mov dword [ebp - 0x420], 0xc9f13a4b
mov dword [ebp - 0x14], 0
jmp 0x475f9a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 9
jge 0x47616b
mov dword [ebp - 0x2b0], 0xffff
mov dword [ebp - 0x1c8], 1
mov dword [ebp - 0x78], 0xfffffffc
jmp 0x475fc8
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jne 0x476166
mov dword [ebp - 0x84], 0xd8c6
cmp dword [ebp - 0x2b0], 0
jne 0x476109
cmp dword [ebp - 0x84], 0
jne 0x475ffe
mov dword [ebp - 0x278], 1
jmp 0x476005
and dword [ebp - 0x278], 0
push 0
lea ecx, [ebp - 0x2c0]
call fcn.00401332
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x45c], eax
push 0xfffffffffffffffc
pop eax
imul eax, eax, 0xfffffff6
cmp eax, 0x883f
jg 0x476034
mov dword [ebp - 0x1b0], 1
jmp 0x47603b
and dword [ebp - 0x1b0], 0
cmp dword [ebp - 0x1b0], 0x58a13c4
je 0x476053
mov dword [ebp - 0x1b8], 1
jmp 0x47605a
and dword [ebp - 0x1b8], 0
mov eax, dword [ebp - 0x2b0]
add eax, dword [ebp - 0x1b8]
cmp eax, 0xffff
ja 0x476079
mov dword [ebp - 0x238], 1
jmp 0x476080
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
add eax, dword [ebp - 0x2d8]
cmp eax, 0xfffffff8
jae 0x4760a9
mov dword [ebp - 0x1c0], 1
jmp 0x4760b0
and dword [ebp - 0x1c0], 0
push 2
lea ecx, [ebp - 0x2c0]
call fcn.00401332
mov ecx, dword [ebp - 0x2c4]
sub ecx, dword [ebp - 0x1c0]
imul ecx, dword [eax]
imul ecx, dword [ebp - 0x278]
mov dword [ebp - 0x120], ecx
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x498], eax
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0x148], 0
jne 0x476109
and dword [ebp - 0x240], 0
jmp 0x476113
mov dword [ebp - 0x240], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x240]
mov dword [ebp + eax - 0x42c], ecx
mov dword [ebp - 0x84], 0
jmp 0x47613f
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0x18
jl 0x476161
mov byte [ebp - 0x54], 0
movzx eax, byte [ebp - 0x54]
test eax, eax
je 0x47615f
push 1
push 0
call fcn.0047516d
pop ecx
pop ecx
jmp 0x476132
jmp 0x475fc1
jmp 0x475f93
lea ecx, [ebp - 0x2c0]
call fcn.0041b70d
jmp 0x475db6
mov dword [ebp - 0x14], 3
jmp 0x47618b
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x4761b8
push dword [ebp - 0x14]
lea ecx, [ebp - 0x41c]
call fcn.00401332
cmp dword [eax], 0
je 0x4761a6
jmp 0x4761b8
push 0
lea eax, [ebp - 0x120]
push eax
call fcn.004867ba
pop ecx
pop ecx
jmp 0x476184
lea ecx, [ebp - 0x41c]
call fcn.0041b70d
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x24]
and eax, 0x20000000
je 0x4761dc
mov dword [ebp - 0x1d0], 1
jmp 0x4761e3
and dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x3b8], eax
push 3
lea ecx, [ebp - 0x404]
call fcn.0041b63b
mov dword [ebp - 0x7c], 1
push 2
lea ecx, [ebp - 0x410]
call fcn.0041b63b
push 0
push 0x1d7
lea eax, [ebp - 0x404]
push eax
push 0x2731
push 0x25c1
push 0
lea eax, [ebp - 0x80]
push eax
push 1
push 0x501e
call fcn.0047c9da
add esp, 0x24
mov dword [ebp - 0x80], 0
jmp 0x47624d
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x476269
push dword [ebp - 0x80]
lea ecx, [ebp - 0x410]
call fcn.00401332
mov dword [eax], 0x9c90e69c
jmp 0x476246
lea eax, [ebp - 0x404]
push eax
push 0x2e94
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x7c]
push eax
push 0x278b
push 1
push 1
call fcn.00474aea
add esp, 0x1c
mov dword [ebp - 0x7c], 0x15
jmp 0x4762a1
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
je 0x4762e5
mov dword [ebp - 0x4a0], 0x6243a5d8
mov dword [ebp - 0x47c], 9
mov dword [ebp - 0x2e0], 0xe094bf7d
mov dword [ebp - 0x2e0], 1
mov byte [ebp - 0x58], 0
movzx eax, byte [ebp - 0x58]
test eax, eax
je 0x4762e3
push 0
call fcn.004832d8
pop ecx
jmp 0x47629a
lea ecx, [ebp - 0x410]
call fcn.0041b70d
lea ecx, [ebp - 0x404]
call fcn.0041b70d
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x24]
and eax, 0x40000000
je 0x476314
mov dword [ebp - 0x298], 1
jmp 0x47631b
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x40], 0x1c76d7be
mov dword [ebp - 0x248], 0xfffffff9
mov dword [ebp - 0x34], 0
jmp 0x476348
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x47635e
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x2e8], 0xf21009d4
jmp 0x476341
mov dword [ebp - 0x1d8], 0x670a
mov dword [ebp - 0x390], 0xaa57e8
cmp dword [ebp - 0x1d8], 0x6a56
jle 0x476483
and dword [ebp - 0xc4], 0
jmp 0x476398
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x2df2
jge 0x476483
and dword [ebp - 0x124], 0
jmp 0x4763be
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0x4ae8
jge 0x47647e
and dword [ebp - 0xcc], 0
jmp 0x4763e4
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x1038
jge 0x476479
and dword [ebp - 0x114], 0
jmp 0x47640a
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x2e65
jge 0x476474
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x124]
sar eax, cl
mov ecx, dword [ebp - 0xcc]
imul ecx, dword [ebp - 0x114]
sar eax, cl
cdq
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x334], edx
push dword [ebp - 0x334]
push dword [ebp - 0x338]
lea ecx, [ebp - 0x554]
call fcn.00401e2f
pop ecx
pop ecx
mov ecx, eax
call fcn.0041b4cc
push eax
call fcn.0048ee0a
pop ecx
lea ecx, [ebp - 0x554]
call fcn.00401328
jmp 0x4763fd
jmp 0x4763d7
jmp 0x4763b1
jmp 0x47638b
mov dword [ebp - 0x34], 0
jmp 0x476493
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x4764a9
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x4bc], 0x13923cc
jmp 0x47648c
mov dword [ebp - 4], 8
cmp dword [ebp - 0x1d8], 0x6502
jge 0x4764c8
push dword [ebp - 0x390]
call fcn.0048ee0a
pop ecx
jmp 0x4764e4
or dword [ebp - 4], 0xffffffff
jmp 0x4764ee
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x40], eax
jl 0x476502
mov dword [ebp - 0x140], 1
jmp 0x476509
and dword [ebp - 0x140], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x140]
mov dword [ebp + eax - 0x2e8], ecx
mov eax, dword [ebp - 0x140]
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x248]
cmp dword [ebp - 0x40], eax
jg 0x476542
mov dword [ebp - 0x1e0], 1
jmp 0x476549
and dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1e0], eax
je 0x476560
mov dword [ebp - 0x280], 1
jmp 0x476567
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x280], eax
jne 0x476585
push 8
pop eax
test eax, eax
je 0x476585
mov dword [ebp - 0x1e8], 1
jmp 0x47658c
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1e8], eax
jl 0x4765a3
mov dword [ebp - 0x250], 1
jmp 0x4765aa
and dword [ebp - 0x250], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x250]
mov dword [ebp + eax - 0x4bc], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x24]
and eax, 0x80000000
je 0x4765d6
mov dword [ebp - 0x1f0], 1
jmp 0x4765dd
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x318], eax
mov dword [ebp - 0x3f8], 3
mov dword [ebp - 0x3f4], 3
mov dword [ebp - 0x3f0], 3
mov dword [ebp - 0x3ec], 3
lea ecx, [ebp - 0x139]
call fcn.0041b729
push eax
lea eax, [ebp - 0x3e8]
push eax
lea eax, [ebp - 0x3f8]
push eax
lea ecx, [ebp - 0x4dc]
call fcn.0041b72c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x160]
call fcn.0041b6e7
mov dword [ebp - 0x50], 0x18885c6f
mov dword [ebp - 0x258], 0xf2b8319b
mov dword [ebp - 0x50], 0
jmp 0x476667
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jg 0x476c54
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x51], 0
push 0x1ca6
push 0
push 0x4bce
lea eax, [ebp - 0x51]
push eax
call fcn.004791a7
add esp, 0x10
mov dword [ebp - 0x18], 0
jmp 0x4766a4
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jg 0x476c4f
mov dword [ebp - 0x48], 0xe9323d1b
mov dword [ebp - 0x134], 0xfff9
mov dword [ebp - 0x3a4], 0xfffffffd
mov dword [ebp - 0x48], 3
jmp 0x4766d9
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x476c4a
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0xd4], 0
jmp 0x476703
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 3
jge 0x47671f
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x458], 0x29ba
jmp 0x4766f6
push dword [ebp - 0x48]
lea ecx, [ebp - 0x160]
call fcn.00401332
mov ecx, dword [ebp - 0x50]
cmp dword [eax], ecx
jg 0x476740
mov dword [ebp - 0x2a8], 1
jmp 0x476747
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x2a8], eax
je 0x47675e
mov dword [ebp - 0x1f8], 1
jmp 0x476765
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0x5b3d
jl 0x476789
mov dword [ebp - 0x200], 1
jmp 0x476790
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x200], eax
jne 0x4767a7
mov dword [ebp - 0x288], 1
jmp 0x4767ae
and dword [ebp - 0x288], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x160]
call fcn.00401332
mov ecx, dword [ebp - 0x288]
cmp ecx, dword [eax]
jl 0x4767d2
mov dword [ebp - 0x208], 1
jmp 0x4767d9
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jne 0x4767fa
mov eax, 0xfff8
test eax, eax
jne 0x4767fa
and dword [ebp - 0x260], 0
jmp 0x476804
mov dword [ebp - 0x260], 1
cmp dword [ebp - 0x260], 1
jbe 0x476819
mov dword [ebp - 0x364], 1
jmp 0x476820
and dword [ebp - 0x364], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x160]
call fcn.00401332
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x49c], eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x160]
call fcn.00401332
mov esi, eax
push 2
lea ecx, [ebp - 0x160]
call fcn.00401332
mov ecx, dword [esi]
imul ecx, dword [eax]
cmp ecx, 6
jl 0x47686d
mov dword [ebp - 0x210], 1
jmp 0x476874
and dword [ebp - 0x210], 0
cmp dword [ebp - 0x210], 0x662b0a94
jl 0x47688c
mov dword [ebp - 0x168], 1
jmp 0x476893
and dword [ebp - 0x168], 0
mov esi, dword [ebp - 0x168]
shl esi, 1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x160]
call fcn.00401332
sub esi, dword [eax]
cmp esi, dword [ebp - 0x134]
jg 0x4768bf
mov dword [ebp - 0x174], 1
jmp 0x4768c6
and dword [ebp - 0x174], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x174], eax
jne 0x4768e0
mov dword [ebp - 0x17c], 1
jmp 0x4768e7
and dword [ebp - 0x17c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x458]
cmp dword [ebp - 0x17c], eax
jge 0x476908
mov dword [ebp - 0x184], 1
jmp 0x47690f
and dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x184], eax
je 0x476926
mov dword [ebp - 0x164], 1
jmp 0x47692d
and dword [ebp - 0x164], 0
push 2
lea ecx, [ebp - 0x160]
call fcn.00401332
mov ecx, dword [ebp - 0x164]
cmp ecx, dword [eax]
je 0x476959
mov eax, 0xa4d2c64
test eax, eax
je 0x476959
mov dword [ebp - 0x194], 1
jmp 0x476960
and dword [ebp - 0x194], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x194], eax
je 0x47697a
mov dword [ebp - 0x19c], 1
jmp 0x476981
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x19c]
sub eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
cmp eax, 0x69393dda
jl 0x4769a3
mov dword [ebp - 0x2f0], 1
jmp 0x4769aa
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1a4], eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x160]
call fcn.00401332
mov ecx, dword [ebp - 0x1a4]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x458]
add eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 0x64], 2
jmp 0x4769f2
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x476c45
mov byte [ebp - 0x59], 0
movzx eax, byte [ebp - 0x59]
test eax, eax
je 0x476b46
push 0
call fcn.00479438
pop ecx
mov dword [ebp - 0x1ac], 0xf7a
mov dword [ebp - 0x2f8], 0xaa5844
cmp dword [ebp - 0x1ac], 0x121b
jle 0x476b01
and dword [ebp - 0xdc], 0
jmp 0x476a4e
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0x1386
jge 0x476b01
and dword [ebp - 0x11c], 0
jmp 0x476a74
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0x76dc
jge 0x476afc
and dword [ebp - 0xe4], 0
jmp 0x476a96
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0x7a2c
jge 0x476af7
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0x11c]
shl eax, cl
or eax, dword [ebp - 0xe4]
cdq
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x340], edx
push dword [ebp - 0x340]
push dword [ebp - 0x344]
lea ecx, [ebp - 0x50c]
call fcn.00401e2f
pop ecx
pop ecx
mov ecx, eax
call fcn.0041b4cc
push eax
call fcn.0048ee0a
pop ecx
lea ecx, [ebp - 0x50c]
call fcn.00401328
jmp 0x476a89
jmp 0x476a67
jmp 0x476a41
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x1ac], 0xc27
jge 0x476b20
push dword [ebp - 0x2f8]
call fcn.0048ee0a
pop ecx
jmp 0x476b3c
or dword [ebp - 4], 0xffffffff
jmp 0x476b46
mov dword [ebp - 0x1b4], 0x11a2
mov dword [ebp - 0x36c], 0xaa5860
cmp dword [ebp - 0x1b4], 0x12e2
jle 0x476bdd
and dword [ebp - 0x12c], 0
jmp 0x476b7c
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x1b18
jge 0x476bdd
and dword [ebp - 0xec], 0
jmp 0x476b9e
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x3681
jge 0x476bdb
mov eax, dword [ebp - 0x12c]
add eax, dword [ebp - 0xec]
cdq
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x34c], edx
push dword [ebp - 0x34c]
push dword [ebp - 0x350]
mov ecx, 0xab36e8
call fcn.0041b4f7
jmp 0x476b91
jmp 0x476b6f
push dword [ebp - 0x50]
lea ecx, [ebp - 0x160]
call fcn.00401332
cmp dword [eax], 0
je 0x476bf5
jmp 0x4769eb
mov dword [ebp - 4], 0xc
cmp dword [ebp - 0x1b4], 0x10a3
jge 0x476c1a
push dword [ebp - 0x36c]
push 0xab36e8
call fcn.0041cf47
pop ecx
pop ecx
jmp 0x476c36
or dword [ebp - 4], 0xffffffff
jmp 0x476c40
jmp 0x4769eb
jmp 0x4766d2
jmp 0x47669d
jmp 0x476660
lea ecx, [ebp - 0x160]
call fcn.0041b70d
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x24]
and eax, 0x2000000
je 0x477093
push 0x4000
mov eax, dword [ebp - 0x24]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x24]
push dword [eax + 8]
push 0xb16
push 0x982
call fcn.004440d8
pop ecx
pop ecx
call eax
mov dword [ebp - 0x20], 0xe83c773
mov dword [ebp - 0x1f4], 3
mov dword [ebp - 0x378], 0xe0f61949
mov dword [ebp - 0x108], 0
jmp 0x476cc8
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 3
jge 0x476ce4
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x468], 2
jmp 0x476cbb
mov dword [ebp - 0x20], 2
jmp 0x476cf4
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x476d0b
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x468], 0
je 0x476d09
jmp 0x476d0b
jmp 0x476ced
mov dword [ebp - 0x20], 0
jmp 0x476d1b
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff0
jg 0x47708e
mov dword [ebp - 0x68], 0xffffffff
mov dword [ebp - 0x430], 0x2bdb979c
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0x68], 2
jmp 0x476d50
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x477089
mov dword [ebp - 0x1bc], 0x56b4
mov dword [ebp - 0x300], 0xaa58c4
cmp dword [ebp - 0x1bc], 0x5922
jle 0x476e7f
and dword [ebp - 0x8c], 0
jmp 0x476d94
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0x3b70
jge 0x476e7f
and dword [ebp - 0x90], 0
jmp 0x476dba
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x1884
jge 0x476e7a
and dword [ebp - 0x98], 0
jmp 0x476de0
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x1fc1
jge 0x476e75
and dword [ebp - 0xa0], 0
jmp 0x476e06
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0x6d1
jge 0x476e70
mov eax, dword [ebp - 0x8c]
cdq
idiv dword [ebp - 0x90]
add edx, dword [ebp - 0x98]
mov ecx, dword [ebp - 0xa0]
sar edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x374], eax
mov dword [ebp - 0x370], edx
push dword [ebp - 0x370]
push dword [ebp - 0x374]
lea ecx, [ebp - 0x53c]
call fcn.00401e2f
pop ecx
pop ecx
mov ecx, eax
call fcn.0041b4cc
push eax
call fcn.0048ee0a
pop ecx
lea ecx, [ebp - 0x53c]
call fcn.00401328
jmp 0x476df9
jmp 0x476dd3
jmp 0x476dad
jmp 0x476d87
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0xe
cmp dword [ebp - 0x1bc], 0x55a0
jge 0x476ea5
push dword [ebp - 0x300]
call fcn.0048ee0a
pop ecx
jmp 0x476ec1
or dword [ebp - 4], 0xffffffff
jmp 0x476ecb
mov dword [ebp - 0x1c], 2
jmp 0x476edb
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x476f22
mov dword [ebp - 0x39c], 0x9dbea522
mov byte [ebp - 0x52], 0
push 0x51ff
push 0x6fcc
push 0x9ba
push 1
push 1
lea eax, [ebp - 0x52]
push eax
push 0x2c93
push 1
call fcn.00474d33
add esp, 0x20
cmp dword [ebp - 0x39c], 0
je 0x476f20
jmp 0x476f22
jmp 0x476ed4
cmp dword [ebp - 0x68], 0
je 0x476f99
mov dword [ebp - 0x1c], 0
jmp 0x476f38
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x476f94
mov dword [ebp - 0xa8], 0xf6a715cc
mov dword [ebp - 0xa8], 0
jmp 0x476f61
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jg 0x476f92
push 1
push 0x4803
push 0x4c27
push 0
call fcn.00481c76
add esp, 0x10
push 0
lea eax, [ebp - 0x30c]
push eax
call fcn.00479c71
pop ecx
pop ecx
jmp 0x476f54
jmp 0x476f31
jmp 0x477084
mov dword [ebp - 0x1dc], 0x86f8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c4], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1c4]
mov dword [ebp + eax - 0x468], ecx
mov eax, dword [ebp - 0x1c]
add eax, 4
cmp eax, dword [ebp - 0x1c4]
jle 0x476fe1
mov dword [ebp - 0x1cc], 1
jmp 0x476fe8
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x1cc], eax
jge 0x476fff
mov dword [ebp - 0x1d4], 1
jmp 0x477006
and dword [ebp - 0x1d4], 0
mov eax, dword [ebp - 0x1dc]
sub eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x20]
jg 0x477020
mov dword [ebp - 0x1e4], 1
jmp 0x477027
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x1dc]
add eax, dword [ebp - 0x1e4]
jne 0x477041
mov dword [ebp - 0x1ec], 1
jmp 0x477048
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 8
jl 0x477069
mov dword [ebp - 0x1fc], 1
jmp 0x477070
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x1fc]
sub eax, dword [ebp - 0x1c]
sub eax, 0x33f665aa
mov dword [ebp - 0x378], eax
jmp 0x476d49
jmp 0x476d14
jmp 0x475ae9
lea eax, [ebp - 0x24]
push eax
push 0x37fd
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x3b8]
push eax
push 0
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x2dc]
push eax
push 0x78a9
call fcn.0048192e
add esp, 0x20
mov dword [ebp - 0x204], 0x4916
mov dword [ebp - 0x384], 0xaa58e8
cmp dword [ebp - 0x204], 0x4b6d
jle 0x4771b4
and dword [ebp - 0xb0], 0
jmp 0x477101
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x3c35
jge 0x4771b4
and dword [ebp - 0xb8], 0
jmp 0x477127
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0x69e5
jge 0x4771af
and dword [ebp - 0xc0], 0
jmp 0x477149
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x662a
jge 0x4771aa
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0xb8]
sar eax, cl
or eax, dword [ebp - 0xc0]
cdq
mov dword [ebp - 0x380], eax
mov dword [ebp - 0x37c], edx
push dword [ebp - 0x37c]
push dword [ebp - 0x380]
lea ecx, [ebp - 0x56c]
call fcn.00401e2f
pop ecx
pop ecx
mov ecx, eax
call fcn.0041b4cc
push eax
call fcn.0048ee0a
pop ecx
lea ecx, [ebp - 0x56c]
call fcn.00401328
jmp 0x47713c
jmp 0x47711a
jmp 0x4770f4
mov dword [ebp - 4], 0x10
cmp dword [ebp - 0x204], 0x45d1
jge 0x4771d3
push dword [ebp - 0x384]
call fcn.0048ee0a
pop ecx
jmp 0x4771ef
or dword [ebp - 4], 0xffffffff
jmp 0x4771f9
push 2
lea ecx, [ebp - 0x478]
call fcn.0041b63b
mov dword [ebp - 0xc8], 0xffffffff
mov dword [ebp - 0x494], 6
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x434]
push eax
push 1
push 0x28d1
push 0x7d85
push 1
call fcn.00474fbf
add esp, 0x18
mov dword [ebp - 0xc8], 1
jmp 0x477257
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jl 0x4773db
mov byte [ebp - 0x39], 0
movzx eax, byte [ebp - 0x39]
test eax, eax
je 0x4773d6
push 1
push 0x17d9
push 0x6697
push 0x3339
push 0x6b91
push 0
push 0xd93
push 1
push 0x4744
call fcn.0047c9da
add esp, 0x24
mov dword [ebp - 0x20c], 0xc97
mov dword [ebp - 0x330], 0xaa5928
cmp dword [ebp - 0x20c], 0xed7
jle 0x477391
call dword [0xab629c]
and dword [ebp - 0xd0], 0
jmp 0x4772e0
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0x35b4
jge 0x477391
and dword [ebp - 0xd8], 0
jmp 0x477306
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x3885
jge 0x47738c
and dword [ebp - 0xe0], 0
jmp 0x477328
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0x209
jge 0x477387
mov eax, dword [ebp - 0xd0]
add eax, dword [ebp - 0xd8]
or eax, dword [ebp - 0xe0]
cdq
mov dword [ebp - 0x38c], eax
mov dword [ebp - 0x388], edx
push dword [ebp - 0x388]
push dword [ebp - 0x38c]
lea ecx, [ebp - 0x59c]
call fcn.00401e2f
pop ecx
pop ecx
mov ecx, eax
call fcn.0041b4cc
push eax
call fcn.0048ee0a
pop ecx
lea ecx, [ebp - 0x59c]
call fcn.00401328
jmp 0x47731b
jmp 0x4772f9
jmp 0x4772d3
mov dword [ebp - 4], 0x12
cmp dword [ebp - 0x20c], 0x9ec
jge 0x4773b0
push dword [ebp - 0x330]
call fcn.0048ee0a
pop ecx
jmp 0x4773cc
or dword [ebp - 4], 0xffffffff
jmp 0x4773d6
jmp 0x47724a
lea ecx, [ebp - 0x478]
call fcn.0041b70d
lea eax, [ebp - 0x2a4]
push eax
push 0x5244
push 1
push 0
lea eax, [ebp - 0x24]
push eax
push 0x51cf
push 0x5e98
lea eax, [ebp - 0xe8]
push eax
push 0x4e2b
push 1
call fcn.004810a0
add esp, 0x28
mov dword [ebp - 0xf8], 0x862fd41e
mov dword [ebp - 0x3e4], 0x97963ba2
mov dword [ebp - 0x3e0], 0x97963ba2
mov dword [ebp - 0x3dc], 0x97963ba2
mov dword [ebp - 0x3d8], 0x97963ba2
lea ecx, [ebp - 0x151]
call fcn.0041b729
push eax
lea eax, [ebp - 0x3d4]
push eax
lea eax, [ebp - 0x3e4]
push eax
lea ecx, [ebp - 0x4c4]
call fcn.0041b72c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3d0]
call fcn.0041b6e7
mov dword [ebp - 0x264], 1
mov dword [ebp - 0x274], 0x5bfeb1ec
mov dword [ebp - 0x23c], 2
mov dword [ebp - 0xf0], 0
jmp 0x4774b8
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 1
jge 0x4774d4
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x2cc], 5
jmp 0x4774ab
mov dword [ebp - 0xf8], 0xfffffffb
jmp 0x4774ed
mov eax, dword [ebp - 0xf8]
dec eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0xffffffef
jle 0x477848
mov dword [ebp - 0x28], 0xde2167fa
mov dword [ebp - 0x360], 0xeca6696b
mov dword [ebp - 0x28], 0
jmp 0x47751b
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffee
jle 0x477843
mov dword [ebp - 0x38], 0x5ed9a924
mov dword [ebp - 0x214], 0x97867a7b
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0x100], 0
jmp 0x477559
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 4
jge 0x477575
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x4d4], 5
jmp 0x47754c
cmp dword [ebp - 0x38], 0
je 0x47758b
cmp dword [ebp - 0x28], 0
je 0x477586
jmp 0x477843
jmp 0x47783e
mov dword [ebp - 0x284], 0
mov dword [ebp - 0x144], 0x74f5
push 0
lea ecx, [ebp - 0x3d0]
call fcn.00401332
mov dword [eax], 7
mov dword [ebp - 0x214], 1
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x284], 0
jne 0x4775ee
or eax, 0xffffffff
jne 0x4775ee
mov dword [ebp - 0x21c], 1
jmp 0x4775f5
and dword [ebp - 0x21c], 0
cmp dword [ebp - 0x21c], 1
jbe 0x47760a
mov dword [ebp - 0x354], 1
jmp 0x477611
and dword [ebp - 0x354], 0
cmp dword [ebp - 0x28], 0
jne 0x477623
mov dword [ebp - 0x224], 1
jmp 0x47762a
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0x224]
add eax, 0x7ec5
cmp eax, 1
jge 0x477646
mov dword [ebp - 0x22c], 1
jmp 0x47764d
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x144]
imul eax, dword [ebp - 0x22c]
add eax, 0x413eae2f
imul eax, eax, 0xa9ef
test eax, eax
jne 0x47767b
cmp dword [ebp - 0x264], 0
jne 0x47767b
and dword [ebp - 0x33c], 0
jmp 0x477685
mov dword [ebp - 0x33c], 1
mov eax, dword [ebp - 0x274]
cmp dword [ebp - 0x28], eax
jge 0x47769c
mov dword [ebp - 0x234], 1
jmp 0x4776a3
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x23c], eax
jg 0x4776cb
xor eax, eax
inc eax
jne 0x4776cb
and dword [ebp - 0x244], 0
jmp 0x4776d5
mov dword [ebp - 0x244], 1
cmp dword [ebp - 0x244], 0xfffffff7
jne 0x4776ea
mov dword [ebp - 0x24c], 1
jmp 0x4776f1
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x24c]
cmp eax, dword [ebp - 0x38]
jg 0x477712
cmp dword [ebp - 0x38], 0
je 0x477712
mov dword [ebp - 0x254], 1
jmp 0x477719
and dword [ebp - 0x254], 0
push 1
lea ecx, [ebp - 0x3d0]
call fcn.00401332
mov ecx, dword [ebp - 0x254]
cmp ecx, dword [eax]
jl 0x477742
cmp dword [ebp - 0x38], 0
je 0x477742
mov dword [ebp - 0x25c], 1
jmp 0x477749
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x25c], eax
jle 0x477760
mov dword [ebp - 0x14c], 1
jmp 0x477767
and dword [ebp - 0x14c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x14c]
mov dword [ebp + eax - 0x4d4], ecx
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14c], eax
jl 0x477790
mov dword [ebp - 0x358], 1
jmp 0x477797
and dword [ebp - 0x358], 0
cmp dword [ebp - 0x28], 0
jne 0x4777a4
cmp dword [ebp - 0x264], 0
cmp dword [ebp - 0x38], 0xefd9132e
jae 0x4777b9
mov dword [ebp - 0x26c], 1
jmp 0x4777c0
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x26c], eax
jge 0x4777d7
mov dword [ebp - 0x27c], 1
jmp 0x4777de
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x274]
cmp dword [ebp - 0x27c], eax
je 0x4777f8
mov dword [ebp - 0x28c], 1
jmp 0x4777ff
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x284]
cmp eax, dword [ebp - 0x28c]
jge 0x477819
mov dword [ebp - 0x348], 1
jmp 0x477820
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x448], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x2c8], eax
jmp 0x477514
jmp 0x4774e0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x2cc]
push 0
lea ecx, [ebp - 0x3d0]
call fcn.00401332
mov dword [eax], esi
lea ecx, [ebp - 0x3d0]
call fcn.0041b70d
cmp dword [ebp - 0x2a4], 0
jbe 0x477a50
mov dword [ebp - 0x128], 0x3ae35568
mov dword [ebp - 0x4b0], 0xeb905d09
mov dword [ebp - 0x128], 0xa
jmp 0x4778a9
mov eax, dword [ebp - 0x128]
dec eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 3
jge 0x477a24
mov dword [ebp - 0x294], 0x37c6
mov dword [ebp - 0x2d4], 0xaa5998
cmp dword [ebp - 0x294], 0x3b07
jle 0x477984
and dword [ebp - 0x130], 0
jmp 0x4778f0
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0x1096
jge 0x477984
and dword [ebp - 0x138], 0
jmp 0x477916
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x3ff5
jge 0x47797f
and dword [ebp - 0x10c], 0
jmp 0x477938
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x73b5
jge 0x47797d
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x138]
shl eax, cl
xor eax, dword [ebp - 0x10c]
cdq
mov dword [ebp - 0x398], eax
mov dword [ebp - 0x394], edx
push dword [ebp - 0x394]
push dword [ebp - 0x398]
mov ecx, 0xab36e8
call fcn.0041b4f7
jmp 0x47792b
jmp 0x477909
jmp 0x4778e3
mov dword [ebp - 0x29c], 0xfffffff8
mov dword [ebp - 4], 0x14
cmp dword [ebp - 0x294], 0x3564
jge 0x4779b3
push dword [ebp - 0x2d4]
push 0xab36e8
call fcn.0041cf47
pop ecx
pop ecx
jmp 0x4779cf
or dword [ebp - 4], 0xffffffff
jmp 0x4779d9
mov eax, dword [ebp - 0x29c]
dec eax
mov dword [ebp - 0x29c], eax
mov byte [ebp - 0x53], 0
push 0x3ee5
lea eax, [ebp - 0x53]
push eax
push 1
push 0x1e46
push 0x2179
push 0x61c2
push 0x740e
push 0
push 0x59b5
push 0x4c87
push 1
call fcn.00483c05
add esp, 0x2c
jmp 0x47789c
lea eax, [ebp - 0x484]
push eax
push dword [ebp - 0x2dc]
push dword [ebp - 0x2a4]
mov eax, dword [ebp - 0x24]
push dword [eax + 8]
push 0xb16
push 0x8b8
call fcn.004440d8
pop ecx
pop ecx
call eax
jmp 0x475ae9
jmp 0x477a70
mov byte [ebp - 0x41], 0
movzx eax, byte [ebp - 0x41]
test eax, eax
je 0x477a70
push 0
push 0x178
call dword [0xab60d0]
jmp 0x477a9a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2ec], eax
push dword [ebp - 0x2e4]
push dword [ebp - 0x2ec]
push 1
call fcn.00474f9d
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret