Function at 0x406f80
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446289
mov eax, dword fs:[0]
push eax
mov eax, 0x1204
call fcn.0043a940
mov eax, dword [0x452364]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xd74], ecx
mov dword [ebp - 4], 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x5fc], esp
lea eax, [ebp + 0x18]
push eax
call fcn.00401b70
mov dword [ebp - 0xd78], eax
mov ecx, dword [ebp - 0xd74]
call fcn.004050e0
lea ecx, [ebp - 0xa0]
call fcn.0040fde0
mov byte [ebp - 4], 1
push 0x44c214
lea ecx, [ebp - 0xc8]
call fcn.00401ad0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xd74]
mov dword [ecx + 0x114], fcn.00405670
lea edx, [ebp - 0xc8]
push edx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov ecx, dword [ebp - 0xd74]
mov edx, dword [ecx + 0x114]
mov dword [eax], edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.0041f170
add esp, 4
add eax, 1
mov dword [ebp - 0xd0], eax
xor ecx, ecx
mov eax, dword [ebp - 0xd0]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041d48c
add esp, 4
mov dword [ebp - 0x600], eax
mov eax, dword [ebp - 0x600]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xf4], 0
mov byte [ebp - 0x7d], 0
cmp dword [ebp - 0xd0], 1
jle 0x40735b
push 0x1c
lea ecx, [ebp - 0x61c]
push ecx
lea edx, [ebp - 0xc8]
push edx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov eax, dword [eax]
call eax
add esp, 8
mov dword [ebp - 0xd7c], eax
mov ecx, dword [ebp - 0xd7c]
mov dword [ebp - 0xd80], ecx
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0xd80]
push edx
lea ecx, [ebp - 0x1a4]
call fcn.00401b70
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x61c]
call fcn.00401bb0
lea ecx, [ebp - 0x1a4]
call fcn.0040f520
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x1b0], 0
jmp 0x407124
mov eax, dword [ebp - 0x1b0]
add eax, 1
mov dword [ebp - 0x1b0], eax
mov ecx, dword [ebp - 0x1b0]
cmp ecx, dword [ebp - 0xd0]
jge 0x407151
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 0x1b0]
movsx ax, byte [edx]
mov ecx, dword [ebp - 0x1b0]
mov edx, dword [ebp - 0xa8]
mov word [edx + ecx*2], ax
jmp 0x407115
mov byte [ebp - 0x185], 0
mov dword [ebp - 0x180], 0
mov dword [ebp - 0x1b4], 0
jmp 0x40717d
mov eax, dword [ebp - 0x1b4]
add eax, 1
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 5
jge 0x4071bb
mov ecx, dword [ebp - 0x1b4]
mov edx, dword [ebp - 0xa8]
movzx eax, word [edx + ecx*2]
mov ecx, dword [ebp - 0x1b4]
mov edx, dword [ebp - 0x184]
movzx ecx, word [edx + ecx*2]
cmp eax, ecx
jne 0x4071b9
mov edx, dword [ebp - 0x180]
add edx, 1
mov dword [ebp - 0x180], edx
jmp 0x40716e
mov dword [ebp - 0xa8], 0x44c240
push 0x1d
lea eax, [ebp - 0x638]
push eax
lea ecx, [ebp - 0xc8]
push ecx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov edx, dword [eax]
call edx
add esp, 8
mov dword [ebp - 0xd84], eax
mov eax, dword [ebp - 0xd84]
mov dword [ebp - 0xd88], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0xd88]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.00401b70
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x638]
call fcn.00401bb0
push 0x44c244
lea ecx, [ebp + 0x18]
call fcn.0040f3e0
push 0x44c248
lea ecx, [ebp + 0x18]
call fcn.0040f3e0
push 0x44c250
lea ecx, [ebp + 0x18]
call fcn.0040f3e0
mov dword [ebp - 0x63c], 0x14
mov edx, dword [ebp - 0x63c]
push edx
call fcn.0041d48c
add esp, 4
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x640], 0
je 0x407293
mov eax, dword [ebp - 0x63c]
push eax
push 0
mov ecx, dword [ebp - 0x640]
push ecx
call fcn.0041f960
add esp, 0xc
mov edx, dword [ebp - 0x640]
mov dword [ebp - 0xd8c], edx
jmp 0x40729d
mov dword [ebp - 0xd8c], 0
mov eax, dword [ebp - 0xd8c]
mov dword [ebp - 0x1a8], eax
push 0xa
mov ecx, dword [ebp - 0x1a8]
push ecx
call fcn.0041fa75
cdq
mov ecx, 0x64
idiv ecx
push edx
call fcn.0041faeb
add esp, 0xc
mov dword [ebp - 0x1ac], eax
mov edx, dword [ebp - 0x1a8]
push edx
lea ecx, [ebp + 0x18]
call fcn.0040f3e0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x644], esp
lea eax, [ebp + 0x18]
push eax
call fcn.00401b70
mov dword [ebp - 0xd90], eax
mov ecx, dword [ebp - 0xd90]
mov dword [ebp - 0xd94], ecx
mov byte [ebp - 4], 9
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x648], esp
lea edx, [ebp - 0x17c]
push edx
call fcn.00401b70
mov dword [ebp - 0xd98], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0xd74]
call fcn.0040e230
mov eax, dword [ebp - 0xd74]
mov byte [eax + 0x78], 1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x17c]
call fcn.00401bb0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1a4]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x64c], esp
push 0x44c254
call fcn.00401ad0
mov dword [ebp - 0xd9c], eax
mov ecx, dword [ebp - 0xd74]
call fcn.004061b0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x650], esp
lea edx, [ebp + 0x18]
push edx
call fcn.00401b70
mov dword [ebp - 0xda0], eax
mov ecx, dword [ebp - 0xd74]
call fcn.0040b0f0
mov dword [ebp - 0xda4], eax
mov eax, dword [ebp - 0xda4]
mov dword [ebp - 0x34], eax
cmp dword [ebp + 0xc], 0
je 0x4073c5
cmp dword [ebp - 0x34], 0
jne 0x4076f5
push 0x2b
lea ecx, [ebp - 0x66c]
push ecx
lea edx, [ebp - 0xc8]
push edx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov eax, dword [eax]
call eax
add esp, 8
mov dword [ebp - 0xda8], eax
mov ecx, dword [ebp - 0xda8]
mov dword [ebp - 0xdac], ecx
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0xdac]
push edx
lea ecx, [ebp - 0x1d0]
call fcn.00401b70
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x66c]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x670], esp
push 0x44c258
call fcn.00401ad0
mov dword [ebp - 0xdb0], eax
mov eax, dword [ebp - 0xdb0]
mov dword [ebp - 0xdb4], eax
mov byte [ebp - 4], 0xd
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x674], esp
push 0x44c25c
call fcn.00401ad0
mov dword [ebp - 0xdb8], eax
mov ecx, dword [ebp - 0xdb8]
mov dword [ebp - 0xdbc], ecx
mov byte [ebp - 4], 0xe
sub esp, 0x1c
mov edx, esp
mov dword [ebp - 0x678], esp
push 0x44c260
lea eax, [ebp - 0x1d0]
push eax
push edx
call fcn.0041a360
add esp, 0xc
mov dword [ebp - 0xdc0], eax
mov ecx, dword [ebp + 8]
push ecx
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
push 0x2c
lea edx, [ebp - 0x694]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov ecx, dword [eax]
call ecx
add esp, 8
mov dword [ebp - 0xdc4], eax
mov edx, dword [ebp - 0xdc4]
mov dword [ebp - 0xdc8], edx
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0xdc8]
push eax
lea ecx, [ebp - 0x1ec]
call fcn.00401b70
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x694]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x698], esp
push 0x44c264
call fcn.00401ad0
mov dword [ebp - 0xdcc], eax
mov ecx, dword [ebp - 0xdcc]
mov dword [ebp - 0xdd0], ecx
mov byte [ebp - 4], 0x12
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x69c], esp
push 0x44c268
call fcn.00401ad0
mov dword [ebp - 0xdd4], eax
mov edx, dword [ebp - 0xdd4]
mov dword [ebp - 0xdd8], edx
mov byte [ebp - 4], 0x13
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6a0], esp
lea eax, [ebp - 0x1ec]
push eax
call fcn.00401b70
mov dword [ebp - 0xddc], eax
mov ecx, dword [ebp + 8]
push ecx
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
movzx edx, byte [0x454870]
push edx
mov eax, dword [0x454874]
push eax
mov ecx, dword [ebp - 0xac]
push ecx
mov ecx, dword [ebp - 0xd74]
call fcn.0040ad30
movzx edx, al
test edx, edx
je 0x4076a5
push 0x2d
lea eax, [ebp - 0x6bc]
push eax
lea ecx, [ebp - 0xc8]
push ecx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov edx, dword [eax]
call edx
add esp, 8
mov dword [ebp - 0xde0], eax
mov eax, dword [ebp - 0xde0]
mov dword [ebp - 0xde4], eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0xde4]
push ecx
lea ecx, [ebp - 0x208]
call fcn.00401b70
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x6bc]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6c0], esp
push 0x44c26c
call fcn.00401ad0
mov dword [ebp - 0xde8], eax
mov edx, dword [ebp - 0xde8]
mov dword [ebp - 0xdec], edx
mov byte [ebp - 4], 0x17
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6c4], esp
push 0x44c270
call fcn.00401ad0
mov dword [ebp - 0xdf0], eax
mov eax, dword [ebp - 0xdf0]
mov dword [ebp - 0xdf4], eax
mov byte [ebp - 4], 0x18
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6c8], esp
lea edx, [ebp - 0x208]
push edx
call fcn.00401b70
mov dword [ebp - 0xdf8], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x208]
call fcn.00401bb0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1ec]
call fcn.00401bb0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1d0]
call fcn.00401bb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.00401bb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa0]
call fcn.00405fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401bb0
jmp 0x40abd2
lea ecx, [ebp - 0x78]
call fcn.0040e3d0
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x154]
call fcn.0040e400
mov byte [ebp - 4], 0x1a
lea edx, [ebp - 0x154]
push edx
lea ecx, [ebp - 0x78]
call fcn.0040e4e0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x6cc], esp
lea eax, [ebp + 0x18]
push eax
call fcn.00401b70
mov dword [ebp - 0xdfc], eax
mov ecx, dword [ebp - 0xd74]
call fcn.00406d00
mov byte [ebp - 0xdfd], al
mov cl, byte [ebp - 0xdfd]
mov byte [0x454870], cl
mov byte [ebp - 0x160], 0x2c
mov byte [ebp - 0x15f], 0x2e
mov byte [ebp - 0x15e], 0x25
mov byte [ebp - 0x15d], 0x24
mov byte [ebp - 0x15c], 0x7c
mov byte [ebp - 0x15b], 0x25
mov byte [ebp - 0x15a], 0x2d
mov byte [ebp - 0x159], 0x32
mov byte [ebp - 0x158], 0x29
mov byte [ebp - 0x157], 0x28
mov byte [ebp - 0x156], 0x27
mov byte [ebp - 0x155], 0x35
push 0xc
lea edx, [ebp - 0x160]
push edx
lea eax, [ebp - 0x6e8]
push eax
mov ecx, dword [ebp - 0xd74]
call fcn.00406960
mov dword [ebp - 0xe04], eax
mov ecx, dword [ebp - 0xe04]
mov dword [ebp - 0xe08], ecx
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0xe08]
call fcn.0040f520
push eax
lea ecx, [ebp - 0x138]
call fcn.00401ad0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x6e8]
call fcn.00401bb0
push 0
lea edx, [ebp - 0x138]
push edx
lea ecx, [ebp + 0x18]
call fcn.0040f560
cmp eax, dword [0x44ca8c]
je 0x407822
mov byte [ebp - 0x7d], 1
movzx eax, byte [0x454870]
test eax, eax
je 0x40793d
push 0x454874
movzx ecx, byte [ebp - 0x7d]
push ecx
lea edx, [ebp - 0xf4]
push edx
lea eax, [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
mov ecx, dword [ebp - 0xd74]
call fcn.00406e00
xor edx, edx
cmp dword [ebp - 0xf4], 0
sete dl
test edx, edx
jne 0x40793b
mov eax, dword [0x454874]
add eax, 4
mov ecx, dword [0x454868]
sub ecx, eax
push ecx
mov edx, dword [ebp - 0xf4]
push edx
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0xd74]
call fcn.00406b30
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x244]
call fcn.00413050
push eax
lea ecx, [ebp - 0x240]
call fcn.00401ad0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x224]
call fcn.0040e3d0
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x6f0]
push ecx
lea ecx, [ebp - 0x240]
call fcn.0040f4c0
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x6f8]
push ecx
lea ecx, [ebp - 0x240]
call fcn.0040f490
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x224]
call fcn.0041a3f0
push 0x44c274
lea ecx, [ebp - 0x78]
call fcn.0040e510
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x224]
call fcn.0040e4c0
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x240]
call fcn.00401bb0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x244]
call fcn.0040f6a0
jmp 0x4079a5
mov ecx, dword [0x454868]
mov dword [0x454874], ecx
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0xac], edx
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x4079a5
mov dword [ebp - 0x248], 0
jmp 0x407975
mov ecx, dword [ebp - 0x248]
add ecx, 1
mov dword [ebp - 0x248], ecx
mov edx, dword [ebp - 0x248]
cmp edx, dword [0x454874]
jge 0x4079a5
mov eax, dword [ebp - 0xac]
add eax, dword [ebp - 0x248]
movzx ecx, byte [eax]
xor ecx, 0x41
mov edx, dword [ebp - 0xac]
add edx, dword [ebp - 0x248]
mov byte [edx], cl
jmp 0x407966
push 7
lea eax, [ebp - 0x714]
push eax
lea ecx, [ebp - 0xc8]
push ecx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov edx, dword [eax]
call edx
add esp, 8
mov dword [ebp - 0xe0c], eax
mov eax, dword [ebp - 0xe0c]
mov dword [ebp - 0xe10], eax
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0xe10]
push ecx
lea ecx, [ebp - 0x118]
call fcn.00401b70
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x714]
call fcn.00401bb0
lea ecx, [ebp - 0x118]
call fcn.0040f520
mov dword [ebp - 0xf0], eax
mov edx, dword [ebp - 0xf0]
push edx
mov eax, dword [ebp - 0xd74]
mov ecx, dword [eax + 0xec]
push ecx
mov ecx, dword [ebp - 0xd74]
call fcn.0040e1f0
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jne 0x407dab
push 0x2b
lea edx, [ebp - 0x730]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov ecx, dword [eax]
call ecx
add esp, 8
mov dword [ebp - 0xe14], eax
mov edx, dword [ebp - 0xe14]
mov dword [ebp - 0xe18], edx
mov byte [ebp - 4], 0x24
mov eax, dword [ebp - 0xe18]
push eax
lea ecx, [ebp - 0x264]
call fcn.00401b70
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x730]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x734], esp
push 0x44c27c
call fcn.00401ad0
mov dword [ebp - 0xe1c], eax
mov ecx, dword [ebp - 0xe1c]
mov dword [ebp - 0xe20], ecx
mov byte [ebp - 4], 0x27
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x738], esp
push 0x44c280
call fcn.00401ad0
mov dword [ebp - 0xe24], eax
mov edx, dword [ebp - 0xe24]
mov dword [ebp - 0xe28], edx
mov byte [ebp - 4], 0x28
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x73c], esp
push 0x44c284
lea ecx, [ebp - 0x264]
push ecx
push eax
call fcn.0041a360
add esp, 0xc
mov dword [ebp - 0xe2c], eax
mov edx, dword [ebp + 8]
push edx
mov byte [ebp - 4], 0x26
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
push 0x2c
lea eax, [ebp - 0x758]
push eax
lea ecx, [ebp - 0xc8]
push ecx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov edx, dword [eax]
call edx
add esp, 8
mov dword [ebp - 0xe30], eax
mov eax, dword [ebp - 0xe30]
mov dword [ebp - 0xe34], eax
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0xe34]
push ecx
lea ecx, [ebp - 0x280]
call fcn.00401b70
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x758]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x75c], esp
push 0x44c288
call fcn.00401ad0
mov dword [ebp - 0xe38], eax
mov edx, dword [ebp - 0xe38]
mov dword [ebp - 0xe3c], edx
mov byte [ebp - 4], 0x2c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x760], esp
push 0x44c28c
call fcn.00401ad0
mov dword [ebp - 0xe40], eax
mov eax, dword [ebp - 0xe40]
mov dword [ebp - 0xe44], eax
mov byte [ebp - 4], 0x2d
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x764], esp
lea edx, [ebp - 0x280]
push edx
call fcn.00401b70
mov dword [ebp - 0xe48], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0x2b
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
movzx ecx, byte [0x454870]
push ecx
mov edx, dword [0x454874]
push edx
mov eax, dword [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0xd74]
call fcn.0040ad30
movzx ecx, al
test ecx, ecx
je 0x407d22
push 0x2d
lea edx, [ebp - 0x780]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov ecx, dword [eax]
call ecx
add esp, 8
mov dword [ebp - 0xe4c], eax
mov edx, dword [ebp - 0xe4c]
mov dword [ebp - 0xe50], edx
mov byte [ebp - 4], 0x2e
mov eax, dword [ebp - 0xe50]
push eax
lea ecx, [ebp - 0x29c]
call fcn.00401b70
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x780]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x784], esp
push 0x44c290
call fcn.00401ad0
mov dword [ebp - 0xe54], eax
mov ecx, dword [ebp - 0xe54]
mov dword [ebp - 0xe58], ecx
mov byte [ebp - 4], 0x31
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x788], esp
push 0x44c294
call fcn.00401ad0
mov dword [ebp - 0xe5c], eax
mov edx, dword [ebp - 0xe5c]
mov dword [ebp - 0xe60], edx
mov byte [ebp - 4], 0x32
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x78c], esp
lea eax, [ebp - 0x29c]
push eax
call fcn.00401b70
mov dword [ebp - 0xe64], eax
mov ecx, dword [ebp + 8]
push ecx
mov byte [ebp - 4], 0x30
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x29c]
call fcn.00401bb0
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x280]
call fcn.00401bb0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x264]
call fcn.00401bb0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x118]
call fcn.00401bb0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x138]
call fcn.00401bb0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x154]
call fcn.0040e4c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x78]
call fcn.0040e4c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.00401bb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa0]
call fcn.00405fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401bb0
jmp 0x40abd2
mov edx, dword [ebp - 0xd74]
cmp dword [edx + 0xfc], 0
jne 0x408128
push 0x2b
lea eax, [ebp - 0x7a8]
push eax
lea ecx, [ebp - 0xc8]
push ecx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov edx, dword [eax]
call edx
add esp, 8
mov dword [ebp - 0xe68], eax
mov eax, dword [ebp - 0xe68]
mov dword [ebp - 0xe6c], eax
mov byte [ebp - 4], 0x33
mov ecx, dword [ebp - 0xe6c]
push ecx
lea ecx, [ebp - 0x2b8]
call fcn.00401b70
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x7a8]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x7ac], esp
push 0x44c298
call fcn.00401ad0
mov dword [ebp - 0xe70], eax
mov edx, dword [ebp - 0xe70]
mov dword [ebp - 0xe74], edx
mov byte [ebp - 4], 0x36
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x7b0], esp
push 0x44c29c
call fcn.00401ad0
mov dword [ebp - 0xe78], eax
mov eax, dword [ebp - 0xe78]
mov dword [ebp - 0xe7c], eax
mov byte [ebp - 4], 0x37
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x7b4], esp
push 0x44c2a0
lea edx, [ebp - 0x2b8]
push edx
push ecx
call fcn.0041a360
add esp, 0xc
mov dword [ebp - 0xe80], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0x35
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
push 0x2c
lea ecx, [ebp - 0x7d0]
push ecx
lea edx, [ebp - 0xc8]
push edx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov eax, dword [eax]
call eax
add esp, 8
mov dword [ebp - 0xe84], eax
mov ecx, dword [ebp - 0xe84]
mov dword [ebp - 0xe88], ecx
mov byte [ebp - 4], 0x38
mov edx, dword [ebp - 0xe88]
push edx
lea ecx, [ebp - 0x2d4]
call fcn.00401b70
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x7d0]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x7d4], esp
push 0x44c2a4
call fcn.00401ad0
mov dword [ebp - 0xe8c], eax
mov eax, dword [ebp - 0xe8c]
mov dword [ebp - 0xe90], eax
mov byte [ebp - 4], 0x3b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x7d8], esp
push 0x44c2a8
call fcn.00401ad0
mov dword [ebp - 0xe94], eax
mov ecx, dword [ebp - 0xe94]
mov dword [ebp - 0xe98], ecx
mov byte [ebp - 4], 0x3c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x7dc], esp
lea edx, [ebp - 0x2d4]
push edx
call fcn.00401b70
mov dword [ebp - 0xe9c], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0x3a
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
movzx ecx, byte [0x454870]
push ecx
mov edx, dword [0x454874]
push edx
mov eax, dword [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0xd74]
call fcn.0040ad30
movzx ecx, al
test ecx, ecx
je 0x40809f
push 0x2d
lea edx, [ebp - 0x7f8]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov ecx, dword [eax]
call ecx
add esp, 8
mov dword [ebp - 0xea0], eax
mov edx, dword [ebp - 0xea0]
mov dword [ebp - 0xea4], edx
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0xea4]
push eax
lea ecx, [ebp - 0x2f0]
call fcn.00401b70
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x7f8]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x7fc], esp
push 0x44c2ac
call fcn.00401ad0
mov dword [ebp - 0xea8], eax
mov ecx, dword [ebp - 0xea8]
mov dword [ebp - 0xeac], ecx
mov byte [ebp - 4], pe_nt_image_headers32
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x800], esp
push 0x44c2b0
call fcn.00401ad0
mov dword [ebp - 0xeb0], eax
mov edx, dword [ebp - 0xeb0]
mov dword [ebp - 0xeb4], edx
mov byte [ebp - 4], 0x41
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x804], esp
lea eax, [ebp - 0x2f0]
push eax
call fcn.00401b70
mov dword [ebp - 0xeb8], eax
mov ecx, dword [ebp + 8]
push ecx
mov byte [ebp - 4], 0x3f
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x2f0]
call fcn.00401bb0
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x2d4]
call fcn.00401bb0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x2b8]
call fcn.00401bb0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x118]
call fcn.00401bb0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x138]
call fcn.00401bb0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x154]
call fcn.0040e4c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x78]
call fcn.0040e4c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.00401bb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa0]
call fcn.00405fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401bb0
jmp 0x40abd2
mov byte [ebp - 0x5c], 0x15
mov byte [ebp - 0x5b], 0x29
mov byte [ebp - 0x5a], 0x28
mov byte [ebp - 0x59], 0x32
mov byte [ebp - 0x58], 0x61
mov byte [ebp - 0x57], 0x28
mov byte [ebp - 0x56], 0x32
mov byte [ebp - 0x55], 0x61
mov byte [ebp - 0x54], 0x70
push 9
lea edx, [ebp - 0x5c]
push edx
lea eax, [ebp - 0x820]
push eax
mov ecx, dword [ebp - 0xd74]
call fcn.00406960
mov dword [ebp - 0xebc], eax
mov ecx, dword [ebp - 0xebc]
mov dword [ebp - 0xec0], ecx
mov byte [ebp - 4], 0x42
mov ecx, dword [ebp - 0xec0]
call fcn.0040f520
push eax
lea ecx, [ebp - 0x118]
call fcn.0040f3c0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x820]
call fcn.00401bb0
lea ecx, [ebp - 0x118]
call fcn.00401c50
mov dword [ebp - 0xfc], eax
push 1
lea edx, [ebp - 0x83c]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov ecx, dword [eax]
call ecx
add esp, 8
mov dword [ebp - 0xec4], eax
mov edx, dword [ebp - 0xec4]
mov dword [ebp - 0xec8], edx
mov byte [ebp - 4], 0x43
mov eax, dword [ebp - 0xec8]
push eax
mov ecx, dword [ebp - 0xfc]
push ecx
push 0
lea ecx, [ebp - 0x118]
call fcn.0040f460
push eax
lea ecx, [ebp - 0x30]
call fcn.00401b70
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x83c]
call fcn.00401bb0
lea ecx, [ebp - 0x30]
call fcn.0040f520
mov dword [ebp - 0xf0], eax
mov edx, dword [ebp - 0xf0]
push edx
mov eax, dword [ebp - 0xd74]
mov ecx, dword [eax + 0xec]
push ecx
mov ecx, dword [ebp - 0xd74]
call fcn.0040e1f0
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jne 0x4085d2
push 0x2b
lea edx, [ebp - 0x858]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov ecx, dword [eax]
call ecx
add esp, 8
mov dword [ebp - 0xecc], eax
mov edx, dword [ebp - 0xecc]
mov dword [ebp - 0xed0], edx
mov byte [ebp - 4], 0x46
mov eax, dword [ebp - 0xed0]
push eax
lea ecx, [ebp - 0x30c]
call fcn.00401b70
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x858]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x85c], esp
push 0x44c2b4
call fcn.00401ad0
mov dword [ebp - 0xed4], eax
mov ecx, dword [ebp - 0xed4]
mov dword [ebp - 0xed8], ecx
mov byte [ebp - 4], 0x49
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x860], esp
push 0x44c2b8
call fcn.00401ad0
mov dword [ebp - 0xedc], eax
mov edx, dword [ebp - 0xedc]
mov dword [ebp - 0xee0], edx
mov byte [ebp - 4], 0x4a
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x864], esp
push 0x44c2bc
lea ecx, [ebp - 0x30c]
push ecx
push eax
call fcn.0041a360
add esp, 0xc
mov dword [ebp - 0xee4], eax
mov edx, dword [ebp + 8]
push edx
mov byte [ebp - 4], 0x48
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
push 0x2c
lea eax, [ebp - 0x880]
push eax
lea ecx, [ebp - 0xc8]
push ecx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov edx, dword [eax]
call edx
add esp, 8
mov dword [ebp - 0xee8], eax
mov eax, dword [ebp - 0xee8]
mov dword [ebp - 0xeec], eax
mov byte [ebp - 4], 0x4b
mov ecx, dword [ebp - 0xeec]
push ecx
lea ecx, [ebp - 0x328]
call fcn.00401b70
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x880]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x884], esp
push 0x44c2c0
call fcn.00401ad0
mov dword [ebp - 0xef0], eax
mov edx, dword [ebp - 0xef0]
mov dword [ebp - 0xef4], edx
mov byte [ebp - 4], 0x4e
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x888], esp
push 0x44c2c4
call fcn.00401ad0
mov dword [ebp - 0xef8], eax
mov eax, dword [ebp - 0xef8]
mov dword [ebp - 0xefc], eax
mov byte [ebp - 4], 0x4f
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x88c], esp
lea edx, [ebp - 0x328]
push edx
call fcn.00401b70
mov dword [ebp - 0xf00], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0x4d
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
movzx ecx, byte [0x454870]
push ecx
mov edx, dword [0x454874]
push edx
mov eax, dword [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0xd74]
call fcn.0040ad30
movzx ecx, al
test ecx, ecx
je 0x40853d
push 0x2d
lea edx, [ebp - 0x8a8]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov ecx, dword [eax]
call ecx
add esp, 8
mov dword [ebp - 0xf04], eax
mov edx, dword [ebp - 0xf04]
mov dword [ebp - 0xf08], edx
mov byte [ebp - 4], 0x50
mov eax, dword [ebp - 0xf08]
push eax
lea ecx, [ebp - 0x344]
call fcn.00401b70
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x8a8]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x8ac], esp
push 0x44c2c8
call fcn.00401ad0
mov dword [ebp - 0xf0c], eax
mov ecx, dword [ebp - 0xf0c]
mov dword [ebp - 0xf10], ecx
mov byte [ebp - 4], 0x53
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x8b0], esp
push 0x44c2cc
call fcn.00401ad0
mov dword [ebp - 0xf14], eax
mov edx, dword [ebp - 0xf14]
mov dword [ebp - 0xf18], edx
mov byte [ebp - 4], 0x54
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x8b4], esp
lea eax, [ebp - 0x344]
push eax
call fcn.00401b70
mov dword [ebp - 0xf1c], eax
mov ecx, dword [ebp + 8]
push ecx
mov byte [ebp - 4], 0x52
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x344]
call fcn.00401bb0
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x328]
call fcn.00401bb0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x30c]
call fcn.00401bb0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x30]
call fcn.00401bb0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x118]
call fcn.00401bb0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x138]
call fcn.00401bb0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x154]
call fcn.0040e4c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x78]
call fcn.0040e4c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.00401bb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa0]
call fcn.00405fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401bb0
jmp 0x40abd2
mov edx, dword [ebp - 0xd74]
cmp dword [edx + 0x104], 0
jne 0x40895b
push 0x2b
lea eax, [ebp - 0x8d0]
push eax
lea ecx, [ebp - 0xc8]
push ecx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov edx, dword [eax]
call edx
add esp, 8
mov dword [ebp - 0xf20], eax
mov eax, dword [ebp - 0xf20]
mov dword [ebp - 0xf24], eax
mov byte [ebp - 4], 0x55
mov ecx, dword [ebp - 0xf24]
push ecx
lea ecx, [ebp - 0x360]
call fcn.00401b70
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0x8d0]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x8d4], esp
push 0x44c2d0
call fcn.00401ad0
mov dword [ebp - 0xf28], eax
mov edx, dword [ebp - 0xf28]
mov dword [ebp - 0xf2c], edx
mov byte [ebp - 4], 0x58
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x8d8], esp
push 0x44c2d4
call fcn.00401ad0
mov dword [ebp - 0xf30], eax
mov eax, dword [ebp - 0xf30]
mov dword [ebp - 0xf34], eax
mov byte [ebp - 4], 0x59
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x8dc], esp
push 0x44c2d8
lea edx, [ebp - 0x360]
push edx
push ecx
call fcn.0041a360
add esp, 0xc
mov dword [ebp - 0xf38], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0x57
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
push 0x2c
lea ecx, [ebp - 0x8f8]
push ecx
lea edx, [ebp - 0xc8]
push edx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov eax, dword [eax]
call eax
add esp, 8
mov dword [ebp - 0xf3c], eax
mov ecx, dword [ebp - 0xf3c]
mov dword [ebp - 0xf40], ecx
mov byte [ebp - 4], 0x5a
mov edx, dword [ebp - 0xf40]
push edx
lea ecx, [ebp - 0x37c]
call fcn.00401b70
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x8f8]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x8fc], esp
push 0x44c2dc
call fcn.00401ad0
mov dword [ebp - 0xf44], eax
mov eax, dword [ebp - 0xf44]
mov dword [ebp - 0xf48], eax
mov byte [ebp - 4], 0x5d
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x900], esp
push 0x44c2e0
call fcn.00401ad0
mov dword [ebp - 0xf4c], eax
mov ecx, dword [ebp - 0xf4c]
mov dword [ebp - 0xf50], ecx
mov byte [ebp - 4], 0x5e
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x904], esp
lea edx, [ebp - 0x37c]
push edx
call fcn.00401b70
mov dword [ebp - 0xf54], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0x5c
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
movzx ecx, byte [0x454870]
push ecx
mov edx, dword [0x454874]
push edx
mov eax, dword [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0xd74]
call fcn.0040ad30
movzx ecx, al
test ecx, ecx
je 0x4088c6
push 0x2d
lea edx, [ebp - 0x920]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov ecx, dword [eax]
call ecx
add esp, 8
mov dword [ebp - 0xf58], eax
mov edx, dword [ebp - 0xf58]
mov dword [ebp - 0xf5c], edx
mov byte [ebp - 4], 0x5f
mov eax, dword [ebp - 0xf5c]
push eax
lea ecx, [ebp - 0x398]
call fcn.00401b70
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0x920]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x924], esp
push 0x44c2e4
call fcn.00401ad0
mov dword [ebp - 0xf60], eax
mov ecx, dword [ebp - 0xf60]
mov dword [ebp - 0xf64], ecx
mov byte [ebp - 4], 0x62
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x928], esp
push 0x44c2e8
call fcn.00401ad0
mov dword [ebp - 0xf68], eax
mov edx, dword [ebp - 0xf68]
mov dword [ebp - 0xf6c], edx
mov byte [ebp - 4], 0x63
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x92c], esp
lea eax, [ebp - 0x398]
push eax
call fcn.00401b70
mov dword [ebp - 0xf70], eax
mov ecx, dword [ebp + 8]
push ecx
mov byte [ebp - 4], 0x61
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x398]
call fcn.00401bb0
mov byte [ebp - 4], 0x57
lea ecx, [ebp - 0x37c]
call fcn.00401bb0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x360]
call fcn.00401bb0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x30]
call fcn.00401bb0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x118]
call fcn.00401bb0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x138]
call fcn.00401bb0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x154]
call fcn.0040e4c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x78]
call fcn.0040e4c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.00401bb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa0]
call fcn.00405fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401bb0
jmp 0x40abd2
mov edx, dword [ebp - 0xd74]
mov eax, dword [ebp - 0xac]
mov dword [edx + 0x7c], eax
mov ecx, dword [ebp - 0xd74]
cmp dword [ecx + 0x7c], 0
je 0x40898e
mov edx, dword [ebp - 0xd74]
mov eax, dword [edx + 0x7c]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x408d04
push 0x2b
lea edx, [ebp - 0x948]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov ecx, dword [eax]
call ecx
add esp, 8
mov dword [ebp - 0xf74], eax
mov edx, dword [ebp - 0xf74]
mov dword [ebp - 0xf78], edx
mov byte [ebp - 4], 0x64
mov eax, dword [ebp - 0xf78]
push eax
lea ecx, [ebp - 0x3b4]
call fcn.00401b70
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x948]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x94c], esp
push 0x44c2ec
call fcn.00401ad0
mov dword [ebp - 0xf7c], eax
mov ecx, dword [ebp - 0xf7c]
mov dword [ebp - 0xf80], ecx
mov byte [ebp - 4], 0x67
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x950], esp
push 0x44c2f0
call fcn.00401ad0
mov dword [ebp - 0xf84], eax
mov edx, dword [ebp - 0xf84]
mov dword [ebp - 0xf88], edx
mov byte [ebp - 4], 0x68
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x954], esp
push 0x44c2f4
lea ecx, [ebp - 0x3b4]
push ecx
push eax
call fcn.0041a360
add esp, 0xc
mov dword [ebp - 0xf8c], eax
mov edx, dword [ebp + 8]
push edx
mov byte [ebp - 4], 0x66
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
push 0x2c
lea eax, [ebp - 0x970]
push eax
lea ecx, [ebp - 0xc8]
push ecx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov edx, dword [eax]
call edx
add esp, 8
mov dword [ebp - 0xf90], eax
mov eax, dword [ebp - 0xf90]
mov dword [ebp - 0xf94], eax
mov byte [ebp - 4], 0x69
mov ecx, dword [ebp - 0xf94]
push ecx
lea ecx, [ebp - 0x3d0]
call fcn.00401b70
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x970]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x974], esp
push 0x44c2f8
call fcn.00401ad0
mov dword [ebp - 0xf98], eax
mov edx, dword [ebp - 0xf98]
mov dword [ebp - 0xf9c], edx
mov byte [ebp - 4], 0x6c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x978], esp
push 0x44c2fc
call fcn.00401ad0
mov dword [ebp - 0xfa0], eax
mov eax, dword [ebp - 0xfa0]
mov dword [ebp - 0xfa4], eax
mov byte [ebp - 4], 0x6d
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x97c], esp
lea edx, [ebp - 0x3d0]
push edx
call fcn.00401b70
mov dword [ebp - 0xfa8], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0x6b
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
movzx ecx, byte [0x454870]
push ecx
mov edx, dword [0x454874]
push edx
mov eax, dword [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0xd74]
call fcn.0040ad30
movzx ecx, al
test ecx, ecx
je 0x408c6f
push 0x2d
lea edx, [ebp - 0x998]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov ecx, dword [eax]
call ecx
add esp, 8
mov dword [ebp - 0xfac], eax
mov edx, dword [ebp - 0xfac]
mov dword [ebp - 0xfb0], edx
mov byte [ebp - 4], 0x6e
mov eax, dword [ebp - 0xfb0]
push eax
lea ecx, [ebp - 0x3ec]
call fcn.00401b70
mov byte [ebp - 4], 0x70
lea ecx, [ebp - 0x998]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x99c], esp
push 0x44c300
call fcn.00401ad0
mov dword [ebp - 0xfb4], eax
mov ecx, dword [ebp - 0xfb4]
mov dword [ebp - 0xfb8], ecx
mov byte [ebp - 4], 0x71
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x9a0], esp
push 0x44c304
call fcn.00401ad0
mov dword [ebp - 0xfbc], eax
mov edx, dword [ebp - 0xfbc]
mov dword [ebp - 0xfc0], edx
mov byte [ebp - 4], 0x72
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x9a4], esp
lea eax, [ebp - 0x3ec]
push eax
call fcn.00401b70
mov dword [ebp - 0xfc4], eax
mov ecx, dword [ebp + 8]
push ecx
mov byte [ebp - 4], 0x70
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x3ec]
call fcn.00401bb0
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x3d0]
call fcn.00401bb0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x3b4]
call fcn.00401bb0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x30]
call fcn.00401bb0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x118]
call fcn.00401bb0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x138]
call fcn.00401bb0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x154]
call fcn.0040e4c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x78]
call fcn.0040e4c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.00401bb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa0]
call fcn.00405fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401bb0
jmp 0x40abd2
mov edx, dword [ebp - 0xd74]
mov eax, dword [edx + 0x7c]
mov ecx, dword [ebp - 0xac]
add ecx, dword [eax + 0x3c]
mov edx, dword [ebp - 0xd74]
mov dword [edx + 0x80], ecx
mov eax, dword [ebp - 0xd74]
cmp dword [eax + 0x80], 0
je 0x408d49
mov ecx, dword [ebp - 0xd74]
mov edx, dword [ecx + 0x80]
cmp dword [edx], 0x4550
je 0x4090bf
push 0x2b
lea eax, [ebp - 0x9c0]
push eax
lea ecx, [ebp - 0xc8]
push ecx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov edx, dword [eax]
call edx
add esp, 8
mov dword [ebp - 0xfc8], eax
mov eax, dword [ebp - 0xfc8]
mov dword [ebp - 0xfcc], eax
mov byte [ebp - 4], 0x73
mov ecx, dword [ebp - 0xfcc]
push ecx
lea ecx, [ebp - 0x408]
call fcn.00401b70
mov byte [ebp - 4], 0x75
lea ecx, [ebp - 0x9c0]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x9c4], esp
push 0x44c308
call fcn.00401ad0
mov dword [ebp - 0xfd0], eax
mov edx, dword [ebp - 0xfd0]
mov dword [ebp - 0xfd4], edx
mov byte [ebp - 4], 0x76
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x9c8], esp
push 0x44c30c
call fcn.00401ad0
mov dword [ebp - 0xfd8], eax
mov eax, dword [ebp - 0xfd8]
mov dword [ebp - 0xfdc], eax
mov byte [ebp - 4], 0x77
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x9cc], esp
push 0x44c310
lea edx, [ebp - 0x408]
push edx
push ecx
call fcn.0041a360
add esp, 0xc
mov dword [ebp - 0xfe0], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0x75
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
push 0x2c
lea ecx, [ebp - 0x9e8]
push ecx
lea edx, [ebp - 0xc8]
push edx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov eax, dword [eax]
call eax
add esp, 8
mov dword [ebp - 0xfe4], eax
mov ecx, dword [ebp - 0xfe4]
mov dword [ebp - 0xfe8], ecx
mov byte [ebp - 4], 0x78
mov edx, dword [ebp - 0xfe8]
push edx
lea ecx, [ebp - 0x424]
call fcn.00401b70
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0x9e8]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x9ec], esp
push 0x44c314
call fcn.00401ad0
mov dword [ebp - 0xfec], eax
mov eax, dword [ebp - 0xfec]
mov dword [ebp - 0xff0], eax
mov byte [ebp - 4], 0x7b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x9f0], esp
push 0x44c318
call fcn.00401ad0
mov dword [ebp - 0xff4], eax
mov ecx, dword [ebp - 0xff4]
mov dword [ebp - 0xff8], ecx
mov byte [ebp - 4], 0x7c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x9f4], esp
lea edx, [ebp - 0x424]
push edx
call fcn.00401b70
mov dword [ebp - 0xffc], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0x7a
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
movzx ecx, byte [0x454870]
push ecx
mov edx, dword [0x454874]
push edx
mov eax, dword [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0xd74]
call fcn.0040ad30
movzx ecx, al
test ecx, ecx
je 0x40902a
push 0x2d
lea edx, [ebp - 0xa10]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov ecx, dword [eax]
call ecx
add esp, 8
mov dword [ebp - 0x1000], eax
mov edx, dword [ebp - 0x1000]
mov dword [ebp - 0x1004], edx
mov byte [ebp - 4], 0x7d
mov eax, dword [ebp - 0x1004]
push eax
lea ecx, [ebp - 0x440]
call fcn.00401b70
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0xa10]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xa14], esp
push 0x44c31c
call fcn.00401ad0
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1008]
mov dword [ebp - 0x100c], ecx
mov byte [ebp - 4], 0x80
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xa18], esp
push 0x44c320
call fcn.00401ad0
mov dword [ebp - 0x1010], eax
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x1014], edx
mov byte [ebp - 4], 0x81
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xa1c], esp
lea eax, [ebp - 0x440]
push eax
call fcn.00401b70
mov dword [ebp - 0x1018], eax
mov ecx, dword [ebp + 8]
push ecx
mov byte [ebp - 4], 0x7f
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0x440]
call fcn.00401bb0
mov byte [ebp - 4], 0x75
lea ecx, [ebp - 0x424]
call fcn.00401bb0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x408]
call fcn.00401bb0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x30]
call fcn.00401bb0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x118]
call fcn.00401bb0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x138]
call fcn.00401bb0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x154]
call fcn.0040e4c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x78]
call fcn.0040e4c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.00401bb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa0]
call fcn.00405fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401bb0
jmp 0x40abd2
push 0x44
push 0
mov edx, dword [ebp - 0xd74]
add edx, 0x98
push edx
call fcn.0041f960
add esp, 0xc
push 0x10
push 0
mov eax, dword [ebp - 0xd74]
add eax, 0x88
push eax
call fcn.0041f960
add esp, 0xc
push 8
lea ecx, [ebp - 0xa38]
push ecx
lea edx, [ebp - 0xc8]
push edx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov eax, dword [eax]
call eax
add esp, 8
mov dword [ebp - 0x101c], eax
mov ecx, dword [ebp - 0x101c]
mov dword [ebp - 0x1020], ecx
mov byte [ebp - 4], 0x82
mov edx, dword [ebp - 0x1020]
push edx
lea ecx, [ebp - 0x118]
call fcn.00401bd0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0xa38]
call fcn.00401bb0
lea ecx, [ebp - 0x118]
call fcn.0040f520
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
push eax
mov ecx, dword [ebp - 0xd74]
mov edx, dword [ecx + 0xec]
push edx
mov ecx, dword [ebp - 0xd74]
call fcn.0040e1f0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4094f3
push 0x30
lea eax, [ebp - 0xa54]
push eax
lea ecx, [ebp - 0xc8]
push ecx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov edx, dword [eax]
call edx
add esp, 8
mov dword [ebp - 0x1024], eax
mov eax, dword [ebp - 0x1024]
mov dword [ebp - 0x1028], eax
mov byte [ebp - 4], 0x83
mov ecx, dword [ebp - 0x1028]
push ecx
lea ecx, [ebp - 0x45c]
call fcn.00401b70
mov byte [ebp - 4], 0x85
lea ecx, [ebp - 0xa54]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xa58], esp
push 0x44c324
call fcn.00401ad0
mov dword [ebp - 0x102c], eax
mov edx, dword [ebp - 0x102c]
mov dword [ebp - 0x1030], edx
mov byte [ebp - 4], 0x86
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xa5c], esp
push 0x44c328
call fcn.00401ad0
mov dword [ebp - 0x1034], eax
mov eax, dword [ebp - 0x1034]
mov dword [ebp - 0x1038], eax
mov byte [ebp - 4], 0x87
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xa60], esp
lea edx, [ebp - 0x45c]
push edx
call fcn.00401b70
mov dword [ebp - 0x103c], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0x85
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
push 0x2c
lea ecx, [ebp - 0xa7c]
push ecx
lea edx, [ebp - 0xc8]
push edx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov eax, dword [eax]
call eax
add esp, 8
mov dword [ebp - 0x1040], eax
mov ecx, dword [ebp - 0x1040]
mov dword [ebp - 0x1044], ecx
mov byte [ebp - 4], 0x88
mov edx, dword [ebp - 0x1044]
push edx
lea ecx, [ebp - 0x478]
call fcn.00401b70
mov byte [ebp - 4], 0x8a
lea ecx, [ebp - 0xa7c]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xa80], esp
push 0x44c32c
call fcn.00401ad0
mov dword [ebp - 0x1048], eax
mov eax, dword [ebp - 0x1048]
mov dword [ebp - 0x104c], eax
mov byte [ebp - 4], 0x8b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xa84], esp
push 0x44c330
call fcn.00401ad0
mov dword [ebp - 0x1050], eax
mov ecx, dword [ebp - 0x1050]
mov dword [ebp - 0x1054], ecx
mov byte [ebp - 4], 0x8c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xa88], esp
lea edx, [ebp - 0x478]
push edx
call fcn.00401b70
mov dword [ebp - 0x1058], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0x8a
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
movzx ecx, byte [0x454870]
push ecx
mov edx, dword [0x454874]
push edx
mov eax, dword [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0xd74]
call fcn.0040ad30
movzx ecx, al
test ecx, ecx
je 0x40945e
push 0x2d
lea edx, [ebp - 0xaa4]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov ecx, dword [eax]
call ecx
add esp, 8
mov dword [ebp - 0x105c], eax
mov edx, dword [ebp - 0x105c]
mov dword [ebp - 0x1060], edx
mov byte [ebp - 4], 0x8d
mov eax, dword [ebp - 0x1060]
push eax
lea ecx, [ebp - 0x494]
call fcn.00401b70
mov byte [ebp - 4], 0x8f
lea ecx, [ebp - 0xaa4]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xaa8], esp
push 0x44c334
call fcn.00401ad0
mov dword [ebp - 0x1064], eax
mov ecx, dword [ebp - 0x1064]
mov dword [ebp - 0x1068], ecx
mov byte [ebp - 4], 0x90
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xaac], esp
push 0x44c338
call fcn.00401ad0
mov dword [ebp - 0x106c], eax
mov edx, dword [ebp - 0x106c]
mov dword [ebp - 0x1070], edx
mov byte [ebp - 4], 0x91
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xab0], esp
lea eax, [ebp - 0x494]
push eax
call fcn.00401b70
mov dword [ebp - 0x1074], eax
mov ecx, dword [ebp + 8]
push ecx
mov byte [ebp - 4], 0x8f
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
mov byte [ebp - 4], 0x8a
lea ecx, [ebp - 0x494]
call fcn.00401bb0
mov byte [ebp - 4], 0x85
lea ecx, [ebp - 0x478]
call fcn.00401bb0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x45c]
call fcn.00401bb0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x30]
call fcn.00401bb0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x118]
call fcn.00401bb0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x138]
call fcn.00401bb0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x154]
call fcn.0040e4c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x78]
call fcn.0040e4c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.00401bb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa0]
call fcn.00405fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401bb0
jmp 0x40abd2
lea ecx, [ebp - 0x50]
call fcn.00401aa0
mov byte [ebp - 4], 0x92
lea edx, [ebp - 0xab8]
push edx
lea ecx, [ebp - 0x78]
call fcn.0040e570
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0xac0]
push eax
lea ecx, [ebp - 0x78]
call fcn.0040e540
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x50]
call fcn.0041a430
mov eax, dword [ebp - 0xd74]
add eax, 0x88
push eax
mov ecx, dword [ebp - 0xd74]
add ecx, 0x98
push ecx
push 0
push 0
push 4
push 0
push 0
push 0
lea ecx, [ebp - 0x50]
call fcn.0040f520
push eax
mov edx, dword [ebp + 0xc]
push edx
call dword [ebp - 0x14]
test eax, eax
jne 0x4098f2
push 0x2b
lea eax, [ebp - 0xadc]
push eax
lea ecx, [ebp - 0xc8]
push ecx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov edx, dword [eax]
call edx
add esp, 8
mov dword [ebp - 0x1078], eax
mov eax, dword [ebp - 0x1078]
mov dword [ebp - 0x107c], eax
mov byte [ebp - 4], 0x93
mov ecx, dword [ebp - 0x107c]
push ecx
lea ecx, [ebp - 0x4b0]
call fcn.00401b70
mov byte [ebp - 4], 0x95
lea ecx, [ebp - 0xadc]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xae0], esp
push 0x44c33c
call fcn.00401ad0
mov dword [ebp - 0x1080], eax
mov edx, dword [ebp - 0x1080]
mov dword [ebp - 0x1084], edx
mov byte [ebp - 4], 0x96
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xae4], esp
push 0x44c340
call fcn.00401ad0
mov dword [ebp - 0x1088], eax
mov eax, dword [ebp - 0x1088]
mov dword [ebp - 0x108c], eax
mov byte [ebp - 4], 0x97
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xae8], esp
push 0x44c344
lea edx, [ebp - 0x4b0]
push edx
push ecx
call fcn.0041a360
add esp, 0xc
mov dword [ebp - 0x1090], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0x95
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
push 0x2c
lea ecx, [ebp - 0xb04]
push ecx
lea edx, [ebp - 0xc8]
push edx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov eax, dword [eax]
call eax
add esp, 8
mov dword [ebp - 0x1094], eax
mov ecx, dword [ebp - 0x1094]
mov dword [ebp - 0x1098], ecx
mov byte [ebp - 4], 0x98
mov edx, dword [ebp - 0x1098]
push edx
lea ecx, [ebp - 0x4cc]
call fcn.00401b70
mov byte [ebp - 4], 0x9a
lea ecx, [ebp - 0xb04]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xb08], esp
push 0x44c348
call fcn.00401ad0
mov dword [ebp - 0x109c], eax
mov eax, dword [ebp - 0x109c]
mov dword [ebp - 0x10a0], eax
mov byte [ebp - 4], 0x9b
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xb0c], esp
push 0x44c34c
call fcn.00401ad0
mov dword [ebp - 0x10a4], eax
mov ecx, dword [ebp - 0x10a4]
mov dword [ebp - 0x10a8], ecx
mov byte [ebp - 4], 0x9c
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xb10], esp
lea edx, [ebp - 0x4cc]
push edx
call fcn.00401b70
mov dword [ebp - 0x10ac], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0x9a
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
movzx ecx, byte [0x454870]
push ecx
mov edx, dword [0x454874]
push edx
mov eax, dword [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0xd74]
call fcn.0040ad30
movzx ecx, al
test ecx, ecx
je 0x409851
push 0x2d
lea edx, [ebp - 0xb2c]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov ecx, dword [eax]
call ecx
add esp, 8
mov dword [ebp - 0x10b0], eax
mov edx, dword [ebp - 0x10b0]
mov dword [ebp - 0x10b4], edx
mov byte [ebp - 4], 0x9d
mov eax, dword [ebp - 0x10b4]
push eax
lea ecx, [ebp - 0x4e8]
call fcn.00401b70
mov byte [ebp - 4], 0x9f
lea ecx, [ebp - 0xb2c]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xb30], esp
push 0x44c350
call fcn.00401ad0
mov dword [ebp - 0x10b8], eax
mov ecx, dword [ebp - 0x10b8]
mov dword [ebp - 0x10bc], ecx
mov byte [ebp - 4], 0xa0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xb34], esp
push 0x44c354
call fcn.00401ad0
mov dword [ebp - 0x10c0], eax
mov edx, dword [ebp - 0x10c0]
mov dword [ebp - 0x10c4], edx
mov byte [ebp - 4], 0xa1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xb38], esp
lea eax, [ebp - 0x4e8]
push eax
call fcn.00401b70
mov dword [ebp - 0x10c8], eax
mov ecx, dword [ebp + 8]
push ecx
mov byte [ebp - 4], 0x9f
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
mov byte [ebp - 4], 0x9a
lea ecx, [ebp - 0x4e8]
call fcn.00401bb0
mov byte [ebp - 4], 0x95
lea ecx, [ebp - 0x4cc]
call fcn.00401bb0
mov byte [ebp - 4], 0x92
lea ecx, [ebp - 0x4b0]
call fcn.00401bb0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x50]
call fcn.00401bb0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x30]
call fcn.00401bb0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x118]
call fcn.00401bb0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x138]
call fcn.00401bb0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x154]
call fcn.0040e4c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x78]
call fcn.0040e4c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.00401bb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa0]
call fcn.00405fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401bb0
jmp 0x40abd2
mov byte [ebp - 0xe0], 0x15
mov byte [ebp - 0xdf], 0x29
mov byte [ebp - 0xde], 0x28
mov byte [ebp - 0xdd], 0x32
mov byte [ebp - 0xdc], 0x61
mov byte [ebp - 0xdb], 0x28
mov byte [ebp - 0xda], 0x32
mov byte [ebp - 0xd9], 0x61
mov byte [ebp - 0xd8], 0x78
push 9
lea edx, [ebp - 0xe0]
push edx
lea eax, [ebp - 0xb54]
push eax
mov ecx, dword [ebp - 0xd74]
call fcn.00406960
mov dword [ebp - 0x10cc], eax
mov ecx, dword [ebp - 0x10cc]
mov dword [ebp - 0x10d0], ecx
mov byte [ebp - 4], 0xa2
mov ecx, dword [ebp - 0x10d0]
call fcn.0040f520
push eax
lea ecx, [ebp - 0x118]
call fcn.0040f3c0
mov byte [ebp - 4], 0x92
lea ecx, [ebp - 0xb54]
call fcn.00401bb0
lea ecx, [ebp - 0x118]
call fcn.00401c50
mov dword [ebp - 0xd4], eax
push 9
lea edx, [ebp - 0xb70]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov ecx, dword [eax]
call ecx
add esp, 8
mov dword [ebp - 0x10d4], eax
mov edx, dword [ebp - 0x10d4]
mov dword [ebp - 0x10d8], edx
mov byte [ebp - 4], 0xa3
mov eax, dword [ebp - 0x10d8]
push eax
mov ecx, dword [ebp - 0xd4]
push ecx
push 0
lea ecx, [ebp - 0x118]
call fcn.0040f460
push eax
lea ecx, [ebp - 0x30]
call fcn.00401bd0
mov byte [ebp - 4], 0x92
lea ecx, [ebp - 0xb70]
call fcn.00401bb0
lea ecx, [ebp - 0x30]
call fcn.0040f520
mov dword [ebp - 0xf0], eax
mov edx, dword [ebp - 0xf0]
push edx
mov eax, dword [ebp - 0xd74]
mov ecx, dword [eax + 0xec]
push ecx
mov ecx, dword [ebp - 0xd74]
call fcn.0040e1f0
mov dword [ebp - 0x7c], eax
push 4
push 0x1000
push 4
push 0
call dword [ebp - 0x7c]
mov edx, dword [ebp - 0xd74]
mov dword [edx + 0xdc], eax
mov eax, dword [ebp - 0xd74]
mov ecx, dword [eax + 0xdc]
mov dword [ecx], 0x10007
mov edx, dword [ebp - 0xd74]
mov eax, dword [edx + 0xdc]
push eax
mov ecx, dword [ebp - 0xd74]
mov edx, dword [ecx + 0x8c]
push edx
mov eax, dword [ebp - 0xd74]
mov ecx, dword [eax + 0x104]
call ecx
test eax, eax
jne 0x409e12
push 0x2b
lea edx, [ebp - 0xb8c]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov ecx, dword [eax]
call ecx
add esp, 8
mov dword [ebp - 0x10dc], eax
mov edx, dword [ebp - 0x10dc]
mov dword [ebp - 0x10e0], edx
mov byte [ebp - 4], 0xa4
mov eax, dword [ebp - 0x10e0]
push eax
lea ecx, [ebp - 0x504]
call fcn.00401b70
mov byte [ebp - 4], 0xa6
lea ecx, [ebp - 0xb8c]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xb90], esp
push 0x44c358
call fcn.00401ad0
mov dword [ebp - 0x10e4], eax
mov ecx, dword [ebp - 0x10e4]
mov dword [ebp - 0x10e8], ecx
mov byte [ebp - 4], 0xa7
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xb94], esp
push 0x44c35c
call fcn.00401ad0
mov dword [ebp - 0x10ec], eax
mov edx, dword [ebp - 0x10ec]
mov dword [ebp - 0x10f0], edx
mov byte [ebp - 4], 0xa8
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0xb98], esp
push 0x44c360
lea ecx, [ebp - 0x504]
push ecx
push eax
call fcn.0041a360
add esp, 0xc
mov dword [ebp - 0x10f4], eax
mov edx, dword [ebp + 8]
push edx
mov byte [ebp - 4], 0xa6
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
push 0x2c
lea eax, [ebp - 0xbb4]
push eax
lea ecx, [ebp - 0xc8]
push ecx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov edx, dword [eax]
call edx
add esp, 8
mov dword [ebp - 0x10f8], eax
mov eax, dword [ebp - 0x10f8]
mov dword [ebp - 0x10fc], eax
mov byte [ebp - 4], 0xa9
mov ecx, dword [ebp - 0x10fc]
push ecx
lea ecx, [ebp - 0x520]
call fcn.00401b70
mov byte [ebp - 4], 0xab
lea ecx, [ebp - 0xbb4]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xbb8], esp
push 0x44c364
call fcn.00401ad0
mov dword [ebp - 0x1100], eax
mov edx, dword [ebp - 0x1100]
mov dword [ebp - 0x1104], edx
mov byte [ebp - 4], 0xac
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xbbc], esp
push 0x44c368
call fcn.00401ad0
mov dword [ebp - 0x1108], eax
mov eax, dword [ebp - 0x1108]
mov dword [ebp - 0x110c], eax
mov byte [ebp - 4], 0xad
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xbc0], esp
lea edx, [ebp - 0x520]
push edx
call fcn.00401b70
mov dword [ebp - 0x1110], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0xab
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
movzx ecx, byte [0x454870]
push ecx
mov edx, dword [0x454874]
push edx
mov eax, dword [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0xd74]
call fcn.0040ad30
movzx ecx, al
test ecx, ecx
je 0x409d71
push 0x2d
lea edx, [ebp - 0xbdc]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov ecx, dword [eax]
call ecx
add esp, 8
mov dword [ebp - 0x1114], eax
mov edx, dword [ebp - 0x1114]
mov dword [ebp - 0x1118], edx
mov byte [ebp - 4], 0xae
mov eax, dword [ebp - 0x1118]
push eax
lea ecx, [ebp - 0x53c]
call fcn.00401b70
mov byte [ebp - 4], 0xb0
lea ecx, [ebp - 0xbdc]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xbe0], esp
push 0x44c36c
call fcn.00401ad0
mov dword [ebp - 0x111c], eax
mov ecx, dword [ebp - 0x111c]
mov dword [ebp - 0x1120], ecx
mov byte [ebp - 4], 0xb1
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xbe4], esp
push 0x44c370
call fcn.00401ad0
mov dword [ebp - 0x1124], eax
mov edx, dword [ebp - 0x1124]
mov dword [ebp - 0x1128], edx
mov byte [ebp - 4], 0xb2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xbe8], esp
lea eax, [ebp - 0x53c]
push eax
call fcn.00401b70
mov dword [ebp - 0x112c], eax
mov ecx, dword [ebp + 8]
push ecx
mov byte [ebp - 4], 0xb0
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
mov byte [ebp - 4], 0xab
lea ecx, [ebp - 0x53c]
call fcn.00401bb0
mov byte [ebp - 4], 0xa6
lea ecx, [ebp - 0x520]
call fcn.00401bb0
mov byte [ebp - 4], 0x92
lea ecx, [ebp - 0x504]
call fcn.00401bb0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x50]
call fcn.00401bb0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x30]
call fcn.00401bb0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x118]
call fcn.00401bb0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x138]
call fcn.00401bb0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x154]
call fcn.0040e4c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x78]
call fcn.0040e4c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.00401bb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa0]
call fcn.00405fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401bb0
jmp 0x40abd2
push 0
push 4
mov edx, dword [ebp - 0xd74]
add edx, 0xe0
push edx
mov eax, dword [ebp - 0xd74]
mov ecx, dword [eax + 0xdc]
mov edx, dword [ecx + 0xa4]
add edx, 8
push edx
mov eax, dword [ebp - 0xd74]
mov ecx, dword [eax + 0x88]
push ecx
mov edx, dword [ebp - 0xd74]
mov eax, dword [edx + 0xfc]
call eax
mov ecx, dword [ebp - 0xd74]
mov edx, dword [ecx + 0x80]
mov eax, dword [ebp - 0xd74]
mov ecx, dword [eax + 0xe0]
cmp ecx, dword [edx + 0x34]
jne 0x40a370
mov byte [ebp - 0x550], 0x15
mov byte [ebp - 0x54f], 0x29
mov byte [ebp - 0x54e], 0x28
mov byte [ebp - 0x54d], 0x32
mov byte [ebp - 0x54c], 0x61
mov byte [ebp - 0x54b], 0x28
mov byte [ebp - 0x54a], 0x32
mov byte [ebp - 0x549], 0x61
mov byte [ebp - 0x548], 0x70
mov byte [ebp - 0x547], 0x71
push 0xa
lea edx, [ebp - 0x550]
push edx
lea eax, [ebp - 0xc04]
push eax
mov ecx, dword [ebp - 0xd74]
call fcn.00406960
mov dword [ebp - 0x1130], eax
mov ecx, dword [ebp - 0x1130]
mov dword [ebp - 0x1134], ecx
mov byte [ebp - 4], 0xb3
mov ecx, dword [ebp - 0x1134]
call fcn.0040f520
push eax
lea ecx, [ebp - 0x118]
call fcn.0040f3c0
mov byte [ebp - 4], 0x92
lea ecx, [ebp - 0xc04]
call fcn.00401bb0
lea ecx, [ebp - 0x118]
call fcn.00401c50
mov dword [ebp - 0x540], eax
push 0xa
lea edx, [ebp - 0xc20]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov ecx, dword [eax]
call ecx
add esp, 8
mov dword [ebp - 0x1138], eax
mov edx, dword [ebp - 0x1138]
mov dword [ebp - 0x113c], edx
mov byte [ebp - 4], 0xb4
mov eax, dword [ebp - 0x113c]
push eax
mov ecx, dword [ebp - 0x540]
push ecx
push 0
lea ecx, [ebp - 0x118]
call fcn.0040f460
push eax
lea ecx, [ebp - 0x30]
call fcn.00401bd0
mov byte [ebp - 4], 0x92
lea ecx, [ebp - 0xc20]
call fcn.00401bb0
lea ecx, [ebp - 0x30]
call fcn.0040f520
mov dword [ebp - 0xf0], eax
mov edx, dword [ebp - 0xf0]
push edx
mov eax, dword [ebp - 0xd74]
mov ecx, dword [eax + 0xf0]
push ecx
mov ecx, dword [ebp - 0xd74]
call fcn.0040e1f0
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x544], 0
jne 0x40a350
push 0x2b
lea edx, [ebp - 0xc3c]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov ecx, dword [eax]
call ecx
add esp, 8
mov dword [ebp - 0x1140], eax
mov edx, dword [ebp - 0x1140]
mov dword [ebp - 0x1144], edx
mov byte [ebp - 4], 0xb5
mov eax, dword [ebp - 0x1144]
push eax
lea ecx, [ebp - 0x56c]
call fcn.00401b70
mov byte [ebp - 4], 0xb7
lea ecx, [ebp - 0xc3c]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc40], esp
push 0x44c374
call fcn.00401ad0
mov dword [ebp - 0x1148], eax
mov ecx, dword [ebp - 0x1148]
mov dword [ebp - 0x114c], ecx
mov byte [ebp - 4], 0xb8
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc44], esp
push 0x44c378
call fcn.00401ad0
mov dword [ebp - 0x1150], eax
mov edx, dword [ebp - 0x1150]
mov dword [ebp - 0x1154], edx
mov byte [ebp - 4], 0xb9
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0xc48], esp
push 0x44c37c
lea ecx, [ebp - 0x56c]
push ecx
push eax
call fcn.0041a360
add esp, 0xc
mov dword [ebp - 0x1158], eax
mov edx, dword [ebp + 8]
push edx
mov byte [ebp - 4], 0xb7
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
push 0x2c
lea eax, [ebp - 0xc64]
push eax
lea ecx, [ebp - 0xc8]
push ecx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov edx, dword [eax]
call edx
add esp, 8
mov dword [ebp - 0x115c], eax
mov eax, dword [ebp - 0x115c]
mov dword [ebp - 0x1160], eax
mov byte [ebp - 4], 0xba
mov ecx, dword [ebp - 0x1160]
push ecx
lea ecx, [ebp - 0x588]
call fcn.00401b70
mov byte [ebp - 4], 0xbc
lea ecx, [ebp - 0xc64]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc68], esp
push 0x44c380
call fcn.00401ad0
mov dword [ebp - 0x1164], eax
mov edx, dword [ebp - 0x1164]
mov dword [ebp - 0x1168], edx
mov byte [ebp - 4], 0xbd
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc6c], esp
push 0x44c384
call fcn.00401ad0
mov dword [ebp - 0x116c], eax
mov eax, dword [ebp - 0x116c]
mov dword [ebp - 0x1170], eax
mov byte [ebp - 4], 0xbe
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc70], esp
lea edx, [ebp - 0x588]
push edx
call fcn.00401b70
mov dword [ebp - 0x1174], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0xbc
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
movzx ecx, byte [0x454870]
push ecx
mov edx, dword [0x454874]
push edx
mov eax, dword [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0xd74]
call fcn.0040ad30
movzx ecx, al
test ecx, ecx
je 0x40a2af
push 0x2d
lea edx, [ebp - 0xc8c]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov ecx, dword [eax]
call ecx
add esp, 8
mov dword [ebp - 0x1178], eax
mov edx, dword [ebp - 0x1178]
mov dword [ebp - 0x117c], edx
mov byte [ebp - 4], 0xbf
mov eax, dword [ebp - 0x117c]
push eax
lea ecx, [ebp - 0x5a4]
call fcn.00401b70
mov byte [ebp - 4], 0xc1
lea ecx, [ebp - 0xc8c]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc90], esp
push 0x44c388
call fcn.00401ad0
mov dword [ebp - 0x1180], eax
mov ecx, dword [ebp - 0x1180]
mov dword [ebp - 0x1184], ecx
mov byte [ebp - 4], 0xc2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc94], esp
push 0x44c38c
call fcn.00401ad0
mov dword [ebp - 0x1188], eax
mov edx, dword [ebp - 0x1188]
mov dword [ebp - 0x118c], edx
mov byte [ebp - 4], 0xc3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xc98], esp
lea eax, [ebp - 0x5a4]
push eax
call fcn.00401b70
mov dword [ebp - 0x1190], eax
mov ecx, dword [ebp + 8]
push ecx
mov byte [ebp - 4], 0xc1
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
mov byte [ebp - 4], 0xbc
lea ecx, [ebp - 0x5a4]
call fcn.00401bb0
mov byte [ebp - 4], 0xb7
lea ecx, [ebp - 0x588]
call fcn.00401bb0
mov byte [ebp - 4], 0x92
lea ecx, [ebp - 0x56c]
call fcn.00401bb0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x50]
call fcn.00401bb0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x30]
call fcn.00401bb0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x118]
call fcn.00401bb0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x138]
call fcn.00401bb0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x154]
call fcn.0040e4c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x78]
call fcn.0040e4c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.00401bb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa0]
call fcn.00405fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401bb0
jmp 0x40abd2
mov edx, dword [ebp - 0xd74]
mov eax, dword [edx + 0xe0]
push eax
mov ecx, dword [ebp - 0xd74]
mov edx, dword [ecx + 0x88]
push edx
call dword [ebp - 0x544]
mov byte [ebp - 0xec], 0x15
mov byte [ebp - 0xeb], 0x29
mov byte [ebp - 0xea], 0x28
mov byte [ebp - 0xe9], 0x32
mov byte [ebp - 0xe8], 0x61
mov byte [ebp - 0xe7], 0x28
mov byte [ebp - 0xe6], 0x32
mov byte [ebp - 0xe5], 0x61
mov byte [ebp - 0xe4], 0x70
mov byte [ebp - 0xe3], 0x70
push 0xa
lea eax, [ebp - 0xec]
push eax
lea ecx, [ebp - 0xcb4]
push ecx
mov ecx, dword [ebp - 0xd74]
call fcn.00406960
mov dword [ebp - 0x1194], eax
mov edx, dword [ebp - 0x1194]
mov dword [ebp - 0x1198], edx
mov byte [ebp - 4], 0xc4
mov ecx, dword [ebp - 0x1198]
call fcn.0040f520
push eax
lea ecx, [ebp - 0x118]
call fcn.0040f3c0
mov byte [ebp - 4], 0x92
lea ecx, [ebp - 0xcb4]
call fcn.00401bb0
lea ecx, [ebp - 0x118]
call fcn.00401c50
mov dword [ebp - 0xa4], eax
push 0xb
lea eax, [ebp - 0xcd0]
push eax
lea ecx, [ebp - 0xc8]
push ecx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov edx, dword [eax]
call edx
add esp, 8
mov dword [ebp - 0x119c], eax
mov eax, dword [ebp - 0x119c]
mov dword [ebp - 0x11a0], eax
mov byte [ebp - 4], 0xc5
mov ecx, dword [ebp - 0x11a0]
push ecx
mov edx, dword [ebp - 0xa4]
push edx
push 0
lea ecx, [ebp - 0x118]
call fcn.0040f460
push eax
lea ecx, [ebp - 0x30]
call fcn.00401bd0
mov byte [ebp - 4], 0x92
lea ecx, [ebp - 0xcd0]
call fcn.00401bb0
lea ecx, [ebp - 0x30]
call fcn.0040f520
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
push eax
mov ecx, dword [ebp - 0xd74]
mov edx, dword [ecx + 0xec]
push edx
mov ecx, dword [ebp - 0xd74]
call fcn.0040e1f0
mov dword [ebp - 0xf8], eax
push pe_nt_image_headers32
push 0x3000
mov eax, dword [ebp - 0xd74]
mov ecx, dword [eax + 0x80]
mov edx, dword [ecx + 0x50]
push edx
mov eax, dword [ebp - 0xd74]
mov ecx, dword [eax + 0x80]
mov edx, dword [ecx + 0x34]
push edx
mov eax, dword [ebp - 0xd74]
mov ecx, dword [eax + 0x88]
push ecx
call dword [ebp - 0xf8]
mov edx, dword [ebp - 0xd74]
mov dword [edx + 0xe4], eax
mov eax, dword [ebp - 0xd74]
cmp dword [eax + 0xe4], 0
jne 0x40a896
push 0x2b
lea ecx, [ebp - 0xcec]
push ecx
lea edx, [ebp - 0xc8]
push edx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov eax, dword [eax]
call eax
add esp, 8
mov dword [ebp - 0x11a4], eax
mov ecx, dword [ebp - 0x11a4]
mov dword [ebp - 0x11a8], ecx
mov byte [ebp - 4], 0xc6
mov edx, dword [ebp - 0x11a8]
push edx
lea ecx, [ebp - 0x5c0]
call fcn.00401b70
mov byte [ebp - 4], 0xc8
lea ecx, [ebp - 0xcec]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xcf0], esp
push 0x44c390
call fcn.00401ad0
mov dword [ebp - 0x11ac], eax
mov eax, dword [ebp - 0x11ac]
mov dword [ebp - 0x11b0], eax
mov byte [ebp - 4], 0xc9
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xcf4], esp
push 0x44c394
call fcn.00401ad0
mov dword [ebp - 0x11b4], eax
mov ecx, dword [ebp - 0x11b4]
mov dword [ebp - 0x11b8], ecx
mov byte [ebp - 4], 0xca
sub esp, 0x1c
mov edx, esp
mov dword [ebp - 0xcf8], esp
push 0x44c398
lea eax, [ebp - 0x5c0]
push eax
push edx
call fcn.0041a360
add esp, 0xc
mov dword [ebp - 0x11bc], eax
mov ecx, dword [ebp + 8]
push ecx
mov byte [ebp - 4], 0xc8
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
push 0x2c
lea edx, [ebp - 0xd14]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov ecx, dword [eax]
call ecx
add esp, 8
mov dword [ebp - 0x11c0], eax
mov edx, dword [ebp - 0x11c0]
mov dword [ebp - 0x11c4], edx
mov byte [ebp - 4], 0xcb
mov eax, dword [ebp - 0x11c4]
push eax
lea ecx, [ebp - 0x5dc]
call fcn.00401b70
mov byte [ebp - 4], 0xcd
lea ecx, [ebp - 0xd14]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd18], esp
push 0x44c3a0
call fcn.00401ad0
mov dword [ebp - 0x11c8], eax
mov ecx, dword [ebp - 0x11c8]
mov dword [ebp - 0x11cc], ecx
mov byte [ebp - 4], 0xce
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd1c], esp
push 0x44c3a4
call fcn.00401ad0
mov dword [ebp - 0x11d0], eax
mov edx, dword [ebp - 0x11d0]
mov dword [ebp - 0x11d4], edx
mov byte [ebp - 4], 0xcf
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd20], esp
lea eax, [ebp - 0x5dc]
push eax
call fcn.00401b70
mov dword [ebp - 0x11d8], eax
mov ecx, dword [ebp + 8]
push ecx
mov byte [ebp - 4], 0xcd
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
movzx edx, byte [0x454870]
push edx
mov eax, dword [0x454874]
push eax
mov ecx, dword [ebp - 0xac]
push ecx
mov ecx, dword [ebp - 0xd74]
call fcn.0040ad30
movzx edx, al
test edx, edx
je 0x40a7f5
push 0x2d
lea eax, [ebp - 0xd3c]
push eax
lea ecx, [ebp - 0xc8]
push ecx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov edx, dword [eax]
call edx
add esp, 8
mov dword [ebp - 0x11dc], eax
mov eax, dword [ebp - 0x11dc]
mov dword [ebp - 0x11e0], eax
mov byte [ebp - 4], 0xd0
mov ecx, dword [ebp - 0x11e0]
push ecx
lea ecx, [ebp - 0x5f8]
call fcn.00401b70
mov byte [ebp - 4], 0xd2
lea ecx, [ebp - 0xd3c]
call fcn.00401bb0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd40], esp
push 0x44c3a8
call fcn.00401ad0
mov dword [ebp - 0x11e4], eax
mov edx, dword [ebp - 0x11e4]
mov dword [ebp - 0x11e8], edx
mov byte [ebp - 4], 0xd3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd44], esp
push 0x44c3ac
call fcn.00401ad0
mov dword [ebp - 0x11ec], eax
mov eax, dword [ebp - 0x11ec]
mov dword [ebp - 0x11f0], eax
mov byte [ebp - 4], 0xd4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd48], esp
lea edx, [ebp - 0x5f8]
push edx
call fcn.00401b70
mov dword [ebp - 0x11f4], eax
mov eax, dword [ebp + 8]
push eax
mov byte [ebp - 4], 0xd2
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
mov byte [ebp - 4], 0xcd
lea ecx, [ebp - 0x5f8]
call fcn.00401bb0
mov byte [ebp - 4], 0xc8
lea ecx, [ebp - 0x5dc]
call fcn.00401bb0
mov byte [ebp - 4], 0x92
lea ecx, [ebp - 0x5c0]
call fcn.00401bb0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x50]
call fcn.00401bb0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x30]
call fcn.00401bb0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x118]
call fcn.00401bb0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x138]
call fcn.00401bb0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x154]
call fcn.0040e4c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x78]
call fcn.0040e4c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.00401bb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa0]
call fcn.00405fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401bb0
jmp 0x40abd2
push 0
mov ecx, dword [ebp - 0xd74]
mov edx, dword [ecx + 0x80]
mov eax, dword [edx + 0x54]
push eax
mov ecx, dword [ebp - 0xac]
push ecx
mov edx, dword [ebp - 0xd74]
mov eax, dword [edx + 0xe4]
push eax
mov ecx, dword [ebp - 0xd74]
mov edx, dword [ecx + 0x88]
push edx
call dword [ebp - 0x11c]
mov eax, dword [ebp - 0xd74]
mov dword [eax + 0xe8], 0
jmp 0x40a8fc
mov ecx, dword [ebp - 0xd74]
mov edx, dword [ecx + 0xe8]
add edx, 1
mov eax, dword [ebp - 0xd74]
mov dword [eax + 0xe8], edx
mov ecx, dword [ebp - 0xd74]
mov edx, dword [ecx + 0x80]
movzx eax, word [edx + 6]
mov ecx, dword [ebp - 0xd74]
cmp dword [ecx + 0xe8], eax
jge 0x40a9ae
mov edx, dword [ebp - 0xd74]
mov eax, dword [edx + 0x7c]
mov ecx, dword [ebp - 0xac]
add ecx, dword [eax + 0x3c]
mov edx, dword [ebp - 0xd74]
mov eax, dword [edx + 0xe8]
imul eax, eax, 0x28
lea ecx, [ecx + eax + 0xf8]
mov edx, dword [ebp - 0xd74]
mov dword [edx + 0x84], ecx
push 0
mov eax, dword [ebp - 0xd74]
mov ecx, dword [eax + 0x84]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 0xd74]
mov ecx, dword [eax + 0x84]
mov edx, dword [ebp - 0xac]
add edx, dword [ecx + 0x14]
push edx
mov eax, dword [ebp - 0xd74]
mov ecx, dword [eax + 0x84]
mov edx, dword [ebp - 0xd74]
mov eax, dword [edx + 0xe4]
add eax, dword [ecx + 0xc]
push eax
mov ecx, dword [ebp - 0xd74]
mov edx, dword [ecx + 0x88]
push edx
call dword [ebp - 0x11c]
jmp 0x40a8e1
push 0
push 4
mov eax, dword [ebp - 0xd74]
mov ecx, dword [eax + 0x80]
add ecx, 0x34
push ecx
mov edx, dword [ebp - 0xd74]
mov eax, dword [edx + 0xdc]
mov ecx, dword [eax + 0xa4]
add ecx, 8
push ecx
mov edx, dword [ebp - 0xd74]
mov eax, dword [edx + 0x88]
push eax
call dword [ebp - 0x11c]
mov ecx, dword [ebp - 0xd74]
mov edx, dword [ecx + 0x80]
mov eax, dword [ebp - 0xd74]
mov ecx, dword [eax + 0xe4]
add ecx, dword [edx + 0x28]
mov edx, dword [ebp - 0xd74]
mov eax, dword [edx + 0xdc]
mov dword [eax + 0xb0], ecx
mov ecx, dword [ebp - 0xd74]
mov edx, dword [ecx + 0xdc]
push edx
mov eax, dword [ebp - 0xd74]
mov ecx, dword [eax + 0x8c]
push ecx
mov edx, dword [ebp - 0xd74]
mov eax, dword [edx + 0x108]
call eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd4c], esp
push 0x44c3b0
call fcn.00401ad0
mov dword [ebp - 0x11f8], eax
mov ecx, dword [ebp - 0x11f8]
mov dword [ebp - 0x11fc], ecx
mov byte [ebp - 4], 0xd5
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd50], esp
push 0x44c3b4
call fcn.00401ad0
mov dword [ebp - 0x1200], eax
mov edx, dword [ebp - 0x1200]
mov dword [ebp - 0x1204], edx
mov byte [ebp - 4], 0xd6
push 0x32
lea eax, [ebp - 0xd70]
push eax
lea ecx, [ebp - 0xc8]
push ecx
lea ecx, [ebp - 0xa0]
call fcn.0040fe10
mov edx, dword [eax]
call edx
add esp, 8
mov dword [ebp - 0x1208], eax
mov eax, dword [ebp - 0x1208]
mov dword [ebp - 0x120c], eax
mov byte [ebp - 4], 0xd7
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xd54], esp
mov edx, dword [ebp - 0x120c]
push edx
call fcn.00401b70
mov dword [ebp - 0x1210], eax
push 0
mov byte [ebp - 4], 0xd8
mov ecx, dword [ebp - 0xd74]
call fcn.0040ce90
mov byte [ebp - 4], 0x92
lea ecx, [ebp - 0xd70]
call fcn.00401bb0
mov eax, dword [ebp - 0xd74]
mov ecx, dword [eax + 0x8c]
push ecx
mov edx, dword [ebp - 0xd74]
mov eax, dword [edx + 0x100]
call eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0xd74]
mov edx, dword [ecx + 0x88]
push edx
mov eax, dword [ebp - 0xd74]
mov ecx, dword [eax + 0x10c]
call ecx
push 0x8000
push 0
mov edx, dword [ebp + 0x14]
push edx
call dword [ebp - 0xcc]
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x50]
call fcn.00401bb0
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x30]
call fcn.00401bb0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x118]
call fcn.00401bb0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x138]
call fcn.00401bb0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x154]
call fcn.0040e4c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x78]
call fcn.0040e4c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc8]
call fcn.00401bb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa0]
call fcn.00405fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.00401bb0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e20d
mov esp, ebp
pop ebp
ret 0x2c