Function at 0x441bb1
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf02d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x570
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x441bf7
push 0x5a7e
push 1
push 0x6266
call fcn.0044467f
add esp, 0xc
jmp 0x44466e
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x300], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x330], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0x324]
movzx eax, byte [eax]
test eax, eax
je 0x444495
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x11c], 0x17571177
mov dword [ebp - 0x11c], 0xffffffe2
jmp 0x441c5b
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 8
jl 0x441cd2
mov dword [ebp - 0x120], 0x3245f1db
mov dword [ebp - 0x120], 0
jmp 0x441c87
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x16
jge 0x441ccd
push 0x6f9b
push 0x58f4
push 0
call fcn.00440517
add esp, 0xc
push 0x7788
push 0
push 1
push 0x3690
push 0x1add
push 0x43b2
push 1
push 0x6bf3
call fcn.0044d9e6
add esp, 0x20
jmp 0x441c7a
jmp 0x441c4e
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xd0]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x4b4], 0xfffffff9
mov dword [ebp - 0x498], 0xc9995890
mov dword [ebp - 0x4a0], 0x68939f5f
push 3
lea ecx, [ebp - 0x4e0]
call fcn.004088bc
mov dword [ebp - 0x3f8], 0x84257392
push 0
push 1
lea eax, [ebp - 0x4e0]
push eax
push 0x3afd
push 0x7752
push 0x63f4
push 0x128e
lea eax, [ebp - 0x4a8]
push eax
call fcn.0042dd65
add esp, 0x20
mov dword [ebp - 0x298], 0x309b
mov dword [ebp - 0x3f0], 0xac0b08
cmp dword [ebp - 0x298], 0x314a
jle 0x441de1
and dword [ebp - 0x70], 0
jmp 0x441d84
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x79e
jge 0x441de1
and dword [ebp - 0xfc], 0
jmp 0x441da3
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0x1ea9
jge 0x441ddf
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0xfc]
shl eax, cl
cdq
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x340], edx
push dword [ebp - 0x340]
push dword [ebp - 0x344]
mov ecx, 0xadd238
call fcn.00408691
jmp 0x441d96
jmp 0x441d7d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x4b0], eax
cmp dword [ebp - 0x28], 0
je 0x441f8b
mov dword [ebp - 0x3e8], 0
mov dword [ebp - 0x28], 0x18
jmp 0x441e0e
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x12
je 0x441f89
push 2
lea ecx, [ebp - 0x2d4]
call fcn.004088bc
mov dword [ebp - 0x338], 0xa062b000
push 0
lea eax, [ebp - 0x4d0]
push eax
lea eax, [ebp - 0x2d4]
push eax
push 0x4172
push 0x769
call fcn.00419616
add esp, 0x14
push 1
lea ecx, [ebp - 0x2d4]
call fcn.004089aa
mov dword [eax], 0x1a
jmp 0x441e8a
push 1
lea ecx, [ebp - 0x2d4]
call fcn.004089aa
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x1b4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1b4]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x2d4]
call fcn.004089aa
cmp dword [eax], 0xffffffff
jg 0x441f79
push 1
lea ecx, [ebp - 0x2d4]
call fcn.004089aa
cmp dword [eax], 0
je 0x441f69
mov dword [ebp - 0x78], 0xfffffffa
mov dword [ebp - 0x78], 0
jmp 0x441ecd
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xfffffff2
je 0x441f3c
mov dword [ebp - 0x128], 1
mov byte [ebp - 0x2d], 0
movzx eax, byte [ebp - 0x2d]
test eax, eax
je 0x441efa
push 0x6ddd
push 0
push 1
call fcn.00416123
add esp, 0xc
mov dword [ebp - 0x128], 0
jmp 0x441f13
mov eax, dword [ebp - 0x128]
dec eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xfffffffb
jle 0x441f3a
mov byte [ebp - 0x2f], 0
push 0
push 0x21e
push 0x7b5
lea eax, [ebp - 0x2f]
push eax
call fcn.0042fd67
add esp, 0x10
jmp 0x441f06
jmp 0x441ec6
lea eax, [ebp - 0x338]
push eax
push 0xc4b
push 1
push 0x16a7
push 1
push 0x4b1a
push 0x67b2
lea eax, [ebp - 0x28]
push eax
call fcn.00411b4b
add esp, 0x20
jmp 0x441f74
cmp dword [ebp - 0x3e8], 0
je 0x441f74
jmp 0x441f79
jmp 0x441e66
lea ecx, [ebp - 0x2d4]
call fcn.0040898e
jmp 0x441e07
jmp 0x441fab
push 0
push 0xab0
push 0
push 0x19ec
push 0x5fa
push 0x5d46
call fcn.0041d9b8
add esp, 0x18
and dword [ebp - 4], 0
cmp dword [ebp - 0x298], 0x2f8d
jge 0x441fcb
mov edx, dword [ebp - 0x3f0]
mov ecx, 0xadd238
call fcn.0040af1a
jmp 0x441fe7
or dword [ebp - 4], 0xffffffff
jmp 0x441ff1
push 0x6ca0
push 1
lea eax, [ebp - 0x3f8]
push eax
push 0x6284
push 0x24aa
push 0x7668
push 1
call fcn.00411e5c
add esp, 0x1c
lea ecx, [ebp - 0x4e0]
call fcn.0040898e
and dword [ebp - 0x14c], 0
jmp 0x442042
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14]
add eax, 0x28
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x14c], eax
jge 0x444490
mov dword [ebp - 0x190], 0x847dfa86
mov dword [ebp - 0x18c], 0x847dfa86
mov dword [ebp - 0x188], 0x847dfa86
mov dword [ebp - 0x184], 0x847dfa86
mov dword [ebp - 0x464], 0xa2cb51db
mov dword [ebp - 0x460], 0xa2cb51db
mov dword [ebp - 0x45c], 0xa2cb51db
mov dword [ebp - 0x458], 0xa2cb51db
lea ecx, [ebp - 0x15d]
call fcn.004089b9
push eax
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x464]
push eax
lea ecx, [ebp - 0x508]
call fcn.004089bc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xcc]
call fcn.00408968
mov dword [ebp - 0x2a0], 0x2620
mov dword [ebp - 0x400], 0xac0b34
cmp dword [ebp - 0x2a0], 0x2856
jle 0x4421aa
and dword [ebp - 0x88], 0
jmp 0x442119
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x74e9
jge 0x442198
and dword [ebp - 0x80], 0
jmp 0x442132
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x1356
jge 0x442193
and dword [ebp - 0x104], 0
jmp 0x442151
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x7571
jge 0x442191
mov eax, dword [ebp - 0x80]
sub eax, dword [ebp - 0x104]
xor eax, dword [ebp - 0x88]
cdq
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x34c], edx
push dword [ebp - 0x34c]
push dword [ebp - 0x350]
mov ecx, 0xadd238
call fcn.00408691
jmp 0x442144
jmp 0x44212b
jmp 0x44210c
push 0x2368
push 0x219
push 0
call dword [0xae0490]
mov dword [ebp - 0x2c4], 0xfffffff9
mov dword [ebp - 4], 2
cmp dword [ebp - 0x2a0], 0x2424
jge 0x4421d7
mov edx, dword [ebp - 0x400]
mov ecx, 0xadd238
call fcn.0040af1a
jmp 0x4421f3
or dword [ebp - 4], 0xffffffff
jmp 0x4421fd
mov dword [ebp - 0x130], 0
jmp 0x442216
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jge 0x442232
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x16c], 0x63abefa0
jmp 0x442209
push 0
lea ecx, [ebp - 0xcc]
call fcn.004089aa
and dword [eax], 0
jmp 0x442268
push 0
lea ecx, [ebp - 0xcc]
call fcn.004089aa
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x2a8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2a8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xcc]
call fcn.004089aa
cmp dword [eax], 3
jg 0x44286a
mov dword [ebp - 0x24], 0xab274bf9
mov dword [ebp - 0x39c], 0
mov dword [ebp - 0x2b0], 0x3e01
mov dword [ebp - 0x408], 0xac0b70
cmp dword [ebp - 0x2b0], 0x3fbf
jle 0x4423b5
and dword [ebp - 0x90], 0
jmp 0x4422c9
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x3e81
jge 0x4423b5
and dword [ebp - 0x10c], 0
jmp 0x4422ef
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x4bfe
jge 0x4423b0
and dword [ebp - 0x98], 0
jmp 0x442315
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x338e
jge 0x4423ab
and dword [ebp - 0x138], 0
jmp 0x44233b
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x13f6
jge 0x4423a6
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x10c]
shl eax, cl
mov ecx, dword [ebp - 0x98]
shl eax, cl
mov ecx, dword [ebp - 0x138]
shl eax, cl
cdq
mov dword [ebp - 0x35c], eax
mov dword [ebp - 0x358], edx
push dword [ebp - 0x358]
push dword [ebp - 0x35c]
lea ecx, [ebp - 0x538]
call fcn.00401a68
pop ecx
pop ecx
mov ecx, eax
call fcn.00408686
push eax
call fcn.004a8e07
pop ecx
lea ecx, [ebp - 0x538]
call fcn.0040867c
jmp 0x44232e
jmp 0x442308
jmp 0x4422e2
jmp 0x4422bc
mov dword [ebp - 4], 4
cmp dword [ebp - 0x2b0], 0x3abb
jge 0x4423d4
push dword [ebp - 0x408]
call fcn.004a8e07
pop ecx
jmp 0x4423f0
or dword [ebp - 4], 0xffffffff
jmp 0x4423fa
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x304], 0x40e708be
mov dword [ebp - 0x3f4], 0xffffffff
mov dword [ebp - 0x284], 0x16c2
mov dword [ebp - 0x428], 0xac0bbc
cmp dword [ebp - 0x284], 0x17fd
jle 0x442503
and dword [ebp - 0xa8], 0
jmp 0x442452
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x5613
jge 0x442503
and dword [ebp - 0xa0], 0
jmp 0x442478
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0x215d
jge 0x4424fe
and dword [ebp - 0x114], 0
jmp 0x44249a
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x2a05
jge 0x4424f9
mov eax, dword [ebp - 0xa0]
sub eax, dword [ebp - 0x114]
xor eax, dword [ebp - 0xa8]
cdq
mov dword [ebp - 0x368], eax
mov dword [ebp - 0x364], edx
push dword [ebp - 0x364]
push dword [ebp - 0x368]
lea ecx, [ebp - 0x568]
call fcn.00401a68
pop ecx
pop ecx
mov ecx, eax
call fcn.00408686
push eax
call fcn.004a8e07
pop ecx
lea ecx, [ebp - 0x568]
call fcn.0040867c
jmp 0x44248d
jmp 0x44246b
jmp 0x442445
mov dword [ebp - 4], 6
cmp dword [ebp - 0x284], 0x1379
jge 0x442522
push dword [ebp - 0x428]
call fcn.004a8e07
pop ecx
jmp 0x44253e
or dword [ebp - 4], 0xffffffff
jmp 0x442548
mov dword [ebp - 0x140], 0
jmp 0x442561
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 2
jge 0x44257d
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x380], 0x3531
jmp 0x442554
mov dword [ebp - 0x2c8], 0x4fb1
mov dword [ebp - 0x3a8], 0xac0c10
cmp dword [ebp - 0x2c8], 0x5049
jle 0x442639
and dword [ebp - 0xb0], 0
jmp 0x4425b7
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x1122
jge 0x442639
and dword [ebp - 0x148], 0
jmp 0x4425d9
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0x75d1
jge 0x442634
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0x148]
shl eax, cl
cdq
mov dword [ebp - 0x374], eax
mov dword [ebp - 0x370], edx
push dword [ebp - 0x370]
push dword [ebp - 0x374]
lea ecx, [ebp - 0x520]
call fcn.00401a68
pop ecx
pop ecx
mov ecx, eax
call fcn.00408686
push eax
call fcn.004a8e07
pop ecx
lea ecx, [ebp - 0x520]
call fcn.0040867c
jmp 0x4425cc
jmp 0x4425aa
mov dword [ebp - 0x24], 0
jmp 0x442649
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x442820
mov dword [ebp - 0x4f4], 0x2703d9b9
mov dword [ebp - 0x30c], 0x62daab72
mov dword [ebp - 0x308], 0x452a26f3
mov dword [ebp - 0x4f0], 0x9d44c039
mov dword [ebp - 0x328], 0x1637c1d6
mov dword [ebp - 0x4d4], 0xfffffff8
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x380]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x380], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x190]
mov dword [ebp - 0x494], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x190]
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x290], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x290]
mov dword [ebp + eax - 0x16c], ecx
mov eax, dword [ebp - 0x290]
sub eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x308]
jge 0x442709
mov dword [ebp - 0x1a0], 1
jmp 0x442710
and dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0x24], eax
jge 0x442733
mov dword [ebp - 0x1a8], 1
jmp 0x44273a
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1a8], eax
je 0x442751
mov dword [ebp - 0x280], 1
jmp 0x442758
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x4e8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x16c], 0x506ed55c
jle 0x44278f
mov dword [ebp - 0x1b0], 1
jmp 0x442796
and dword [ebp - 0x1b0], 0
cmp dword [ebp - 0x1b0], 1
jae 0x4427ab
mov dword [ebp - 0x240], 1
jmp 0x4427b2
and dword [ebp - 0x240], 0
cmp dword [ebp - 0x240], 0x254f8d3
jle 0x4427ca
mov dword [ebp - 0x174], 1
jmp 0x4427d1
and dword [ebp - 0x174], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x174]
mov dword [ebp + eax - 0x190], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x380]
cmp dword [ebp - 0x174], eax
jg 0x442805
mov dword [ebp - 0x1b8], 1
jmp 0x44280c
and dword [ebp - 0x1b8], 0
push 0xfffffffffffffffd
pop eax
sub eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x30c], eax
jmp 0x442642
mov dword [ebp - 4], 8
cmp dword [ebp - 0x2c8], 0x4edd
jge 0x44283f
push dword [ebp - 0x3a8]
call fcn.004a8e07
pop ecx
jmp 0x44285b
or dword [ebp - 4], 0xffffffff
jmp 0x442865
jmp 0x442244
mov dword [ebp - 0x220], 0x7414
mov dword [ebp - 0x2f4], 0xac0c80
cmp dword [ebp - 0x220], 0x7449
jle 0x442931
push 0
call dword [0xae0478]
and dword [ebp - 0x64], 0
jmp 0x4428a3
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x5c44
jge 0x442931
and dword [ebp - 0xb8], 0
jmp 0x4428c6
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0x5d50
jge 0x44292c
and dword [ebp - 0x134], 0
jmp 0x4428e8
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x371
jge 0x44292a
mov ecx, dword [ebp - 0xb8]
add ecx, dword [ebp - 0x134]
mov eax, dword [ebp - 0x64]
shl eax, cl
cdq
mov dword [ebp - 0x38c], eax
mov dword [ebp - 0x388], edx
push dword [ebp - 0x388]
push dword [ebp - 0x38c]
mov ecx, 0xadd238
call fcn.00408691
jmp 0x4428db
jmp 0x4428b9
jmp 0x44289c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x16c], 0
je 0x442ad7
mov dword [ebp - 0x1c0], 0x49f7fae0
mov dword [ebp - 0x1c8], 0xffffffff
mov dword [ebp - 0x1d0], 1
push 0
lea ecx, [ebp - 0xcc]
call fcn.004089aa
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x190]
add ecx, dword [eax]
mov dword [ebp - 0x1c0], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x16c]
cmp dword [ebp - 0x1c0], eax
jle 0x4429a6
mov dword [ebp - 0x248], 1
jmp 0x4429ad
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1c8]
sub eax, 4
cmp eax, 0x28a2
jge 0x4429d5
mov dword [ebp - 0x28c], 1
jmp 0x4429dc
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x1d0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x16c]
cmp dword [ebp - 0x1d0], eax
jge 0x442a09
mov dword [ebp - 0x250], 1
jmp 0x442a10
and dword [ebp - 0x250], 0
cmp dword [ebp - 0x250], 0xf963
jl 0x442a31
mov eax, 0xfffe
test eax, eax
je 0x442a31
mov dword [ebp - 0x1d8], 1
jmp 0x442a38
and dword [ebp - 0x1d8], 0
push 0
lea ecx, [ebp - 0xcc]
call fcn.004089aa
mov ecx, dword [ebp - 0x1d8]
cmp ecx, dword [eax]
jne 0x442a5b
mov dword [ebp - 0x2ac], 1
jmp 0x442a62
and dword [ebp - 0x2ac], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x16c]
mov ecx, dword [ebp - 0x2ac]
lea esi, [eax + ecx - 0xb1d7]
push 1
lea ecx, [ebp - 0xcc]
call fcn.004089aa
cmp esi, dword [eax]
jne 0x442a99
mov dword [ebp - 0x1e0], 1
jmp 0x442aa0
and dword [ebp - 0x1e0], 0
cmp dword [ebp - 0x1e0], 0x459cadfd
jle 0x442ab8
mov dword [ebp - 0x258], 1
jmp 0x442abf
and dword [ebp - 0x258], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x258]
mov dword [ebp + eax - 0x190], ecx
jmp 0x442ea8
mov dword [ebp - 0x218], 0xf1b
push 3
lea ecx, [ebp - 0x2c0]
call fcn.004088bc
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0xc0], 0
jmp 0x442b0e
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jge 0x442b30
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x2c0]
call fcn.004089aa
mov dword [eax], 4
jmp 0x442b01
push 0
lea ecx, [ebp - 0x2c0]
call fcn.004089aa
cmp dword [eax], 0
je 0x442b57
mov eax, 0xfff7
test eax, eax
je 0x442b57
mov dword [ebp - 0x1e8], 1
jmp 0x442b5e
and dword [ebp - 0x1e8], 0
push 0
lea ecx, [ebp - 0x2c0]
call fcn.004089aa
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1e8]
lea eax, [ecx + eax + 1]
test eax, eax
je 0x442b90
mov eax, 0x15dc
test eax, eax
je 0x442b90
mov dword [ebp - 0x294], 1
jmp 0x442b97
and dword [ebp - 0x294], 0
push 4
pop eax
imul eax, eax, 3
mov esi, dword [ebp + eax - 0x190]
add esi, dword [ebp - 0x294]
push 0
lea ecx, [ebp - 0xcc]
call fcn.004089aa
cmp esi, dword [eax]
jle 0x442bc7
mov dword [ebp - 0x314], 1
jmp 0x442bce
and dword [ebp - 0x314], 0
push 2
lea ecx, [ebp - 0x2c0]
call fcn.004089aa
push 0
lea ecx, [ebp - 0xcc]
call fcn.004089aa
cmp dword [eax], 1
je 0x442bf9
mov dword [ebp - 0x154], 1
jmp 0x442c00
and dword [ebp - 0x154], 0
push 1
lea ecx, [ebp - 0x2c0]
call fcn.004089aa
mov ecx, dword [ebp - 0x154]
mov dword [eax], ecx
cmp dword [ebp - 0x154], 0xa958
jle 0x442c2d
mov dword [ebp - 0x1f0], 1
jmp 0x442c34
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x1f0], eax
jge 0x442c4b
mov dword [ebp - 0x260], 1
jmp 0x442c52
and dword [ebp - 0x260], 0
cmp dword [ebp - 0x260], 0
jb 0x442c67
mov dword [ebp - 0x1f8], 1
jmp 0x442c6e
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x2c4], eax
jg 0x442c91
mov dword [ebp - 0x41c], 1
jmp 0x442c98
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x49c], eax
push 8
pop eax
test eax, eax
jne 0x442cc3
push 0
lea ecx, [ebp - 0xcc]
call fcn.004089aa
cmp dword [eax], 0
jne 0x442cc3
and dword [ebp - 0x200], 0
jmp 0x442ccd
mov dword [ebp - 0x200], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x190]
cmp eax, dword [ebp - 0x200]
jg 0x442cee
mov dword [ebp - 0x268], 1
jmp 0x442cf5
and dword [ebp - 0x268], 0
push 3
lea ecx, [ebp - 0xcc]
call fcn.004089aa
mov eax, dword [eax]
add eax, dword [ebp - 0x268]
imul esi, eax, 0xe35e
push 1
lea ecx, [ebp - 0xcc]
call fcn.004089aa
cmp esi, dword [eax]
jne 0x442d2d
mov dword [ebp - 0x208], 1
jmp 0x442d34
and dword [ebp - 0x208], 0
mov esi, dword [ebp - 0x34]
add esi, dword [ebp - 0x208]
push 0
lea ecx, [ebp - 0xcc]
call fcn.004089aa
cmp esi, dword [eax]
je 0x442d5a
mov dword [ebp - 0x29c], 1
jmp 0x442d61
and dword [ebp - 0x29c], 0
cmp dword [ebp - 0x29c], 3
je 0x442d76
mov dword [ebp - 0x210], 1
jmp 0x442d7d
and dword [ebp - 0x210], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x16c], 0x99b5
imul eax, dword [ebp - 0x210], 0
sub eax, 0xc14f
cmp eax, 0x99b5
jle 0x442db3
mov eax, 0x9592
test eax, eax
jne 0x442db3
and dword [ebp - 0x31c], 0
jmp 0x442dbd
mov dword [ebp - 0x31c], 1
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x190], 0xffffffff
jle 0x442dd5
mov eax, 0xfff9
test eax, eax
je 0x442de7
push 0
lea ecx, [ebp - 0x2c0]
call fcn.004089aa
cmp dword [eax], 0
jne 0x442df7
xor eax, eax
jne 0x442df7
mov dword [ebp - 0x270], 1
jmp 0x442dfe
and dword [ebp - 0x270], 0
cmp dword [ebp - 0x270], 1
je 0x442e13
mov dword [ebp - 0x2b4], 1
jmp 0x442e1a
and dword [ebp - 0x2b4], 0
mov dword [ebp - 0x218], 1
mov eax, dword [ebp - 0x218]
cmp eax, dword [ebp - 0x2b4]
jle 0x442e3e
mov dword [ebp - 0x178], 1
jmp 0x442e45
and dword [ebp - 0x178], 0
push 3
lea ecx, [ebp - 0xcc]
call fcn.004089aa
mov ecx, dword [ebp - 0x178]
mov dword [eax], ecx
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x178], eax
jle 0x442e71
mov dword [ebp - 0x3b4], 1
jmp 0x442e78
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48c], eax
push 0
lea ecx, [ebp - 0x2c0]
call fcn.004089aa
push 4
pop ecx
shl ecx, 0
mov eax, dword [eax]
mov dword [ebp + ecx - 0x190], eax
lea ecx, [ebp - 0x2c0]
call fcn.0040898e
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x220], 0x71dd
jge 0x442ecb
mov edx, dword [ebp - 0x2f4]
mov ecx, 0xadd238
call fcn.0040af1a
jmp 0x442ee7
or dword [ebp - 4], 0xffffffff
jmp 0x442ef1
lea ecx, [ebp - 0xcc]
call fcn.0040898e
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
and eax, 0x20000000
je 0x442f15
mov dword [ebp - 0x278], 1
jmp 0x442f1c
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x42c], eax
push 1
lea ecx, [ebp - 0x438]
call fcn.004088bc
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x4a4]
push eax
push 0
call fcn.0041a3eb
add esp, 0xc
mov dword [ebp - 0x3c], 0
jmp 0x442f64
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jg 0x44302c
mov dword [ebp - 0x124], 0
jmp 0x442f87
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 3
jge 0x442fa3
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x500], 0xea6801fc
jmp 0x442f7a
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x500], 0xffffffff
or eax, 0xffffffff
je 0x442feb
push 1
lea eax, [ebp - 0x438]
push eax
push 0x6af5
push 0
lea eax, [ebp - 0x3c]
push eax
call fcn.0044c0dc
add esp, 0x14
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x438]
call fcn.004089aa
cmp dword [eax], 0
je 0x442fe9
jmp 0x44302c
jmp 0x443027
mov byte [ebp - 0x29], 0
push 0x45ee
push 1
push 0x5c36
push 1
lea eax, [ebp - 0x29]
push eax
call fcn.004130ff
add esp, 0x14
mov byte [ebp - 0x2e], 0
lea eax, [ebp - 0x2e]
push eax
push 0x6d28
push 1
push 0x12b7
push 1
call fcn.004133c3
add esp, 0x14
jmp 0x442f5d
lea ecx, [ebp - 0x438]
call fcn.0040898e
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
and eax, 0x40000000
je 0x443050
mov dword [ebp - 0x228], 1
jmp 0x443057
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x3d8], eax
mov dword [ebp - 0x4c], 0x638ecf54
mov dword [ebp - 0x1ac], 5
mov dword [ebp - 0x194], 0x8f62c4df
mov dword [ebp - 0x4b8], 0xffffffff
mov dword [ebp - 0xd4], 0
jmp 0x4430a1
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 2
jge 0x4430bd
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x398], 3
jmp 0x443094
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x398], 0xffffffff
mov dword [ebp - 0x4c], 5
jmp 0x4430de
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xfffffffe
jle 0x443267
mov dword [ebp - 0x32c], 0x118c84b7
mov dword [ebp - 0x144], 0
jmp 0x44310b
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 2
jge 0x443127
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x180], 0x576c5165
jmp 0x4430fe
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x398]
cmp dword [ebp + eax - 0x180], ecx
jge 0x44314f
mov dword [ebp - 0x1a4], 1
jmp 0x443156
and dword [ebp - 0x1a4], 0
cmp dword [ebp - 0x4c], 0
je 0x443224
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x180]
cmp dword [ebp + eax - 0x180], ecx
jle 0x443188
mov dword [ebp - 0x2a4], 1
jmp 0x44318f
and dword [ebp - 0x2a4], 0
cmp dword [ebp - 0x2a4], 0xa7b7e80d
ja 0x4431a7
mov dword [ebp - 0x230], 1
jmp 0x4431ae
and dword [ebp - 0x230], 0
cmp dword [ebp - 0x230], 2
jge 0x4431c3
mov dword [ebp - 0x198], 1
jmp 0x4431ca
and dword [ebp - 0x198], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x180], 0x1fc42ff1
jne 0x4431e9
mov dword [ebp - 0x19c], 1
jmp 0x4431f0
and dword [ebp - 0x19c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x398]
imul eax, dword [ebp - 0x19c]
test eax, eax
je 0x443224
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x180], 0
je 0x443224
mov dword [ebp - 0x3fc], 1
jmp 0x44322b
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x4ac], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x180]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x32c], eax
jmp 0x4430d7
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
and eax, 0x80000000
je 0x443280
mov dword [ebp - 0x1bc], 1
jmp 0x443287
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x360], eax
push 2
lea ecx, [ebp - 0x488]
call fcn.004088bc
mov dword [ebp - 0x44], 0x4cd4536
push 1
lea ecx, [ebp - 0x450]
call fcn.004088bc
push 2
lea ecx, [ebp - 0x470]
call fcn.004088bc
lea eax, [ebp - 0x1c4]
push eax
push 0x249c
push 0x2e75
push 0x4ecd
push 0x10e7
push 1
lea eax, [ebp - 0x488]
push eax
push 0x758f
push 0
push 1
call fcn.00414a15
add esp, 0x28
push 0x65aa
lea eax, [ebp - 0x1c4]
push eax
push 0
push 0x4a39
lea eax, [ebp - 0x450]
push eax
call fcn.0041ddfe
add esp, 0x14
lea eax, [ebp - 0x470]
push eax
push 0x3a91
push 1
push 1
lea eax, [ebp - 0x1c4]
push eax
push 0x19f9
call fcn.00413e4a
add esp, 0x18
mov dword [ebp - 0x44], 0
jmp 0x44334c
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jg 0x44357f
mov dword [ebp - 0xec], 0xa3062a4b
mov dword [ebp - 0x1cc], 0x21b5
mov dword [ebp - 0x3c0], 0xac0cd0
cmp dword [ebp - 0x1cc], 0x24af
jle 0x44346b
and dword [ebp - 0xe4], 0
jmp 0x44339a
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0x33a2
jge 0x443460
and dword [ebp - 0xdc], 0
jmp 0x4433c0
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0x3ea6
jge 0x44345b
and dword [ebp - 0x12c], 0
jmp 0x4433e6
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x6bb0
jge 0x443456
and dword [ebp - 0x13c], 0
jmp 0x443408
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0x2882
jge 0x443454
mov eax, dword [ebp - 0xdc]
cdq
idiv dword [ebp - 0x12c]
and edx, dword [ebp - 0xe4]
and edx, dword [ebp - 0x13c]
mov eax, edx
cdq
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 0x3a0], edx
push dword [ebp - 0x3a0]
push dword [ebp - 0x3a4]
mov ecx, 0xadd238
call fcn.00408691
jmp 0x4433fb
jmp 0x4433d9
jmp 0x4433b3
jmp 0x44338d
push 0x327
call dword [0xae0090]
lea eax, [ebp - 0x450]
push eax
push 0
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x44]
push eax
push 1
push 0x3075
push 0xa83
lea eax, [ebp - 0x488]
push eax
call fcn.0041878d
add esp, 0x20
mov dword [ebp - 4], 0xc
cmp dword [ebp - 0x1cc], 0x1f11
jge 0x4434bd
mov edx, dword [ebp - 0x3c0]
mov ecx, 0xadd238
call fcn.0040af1a
jmp 0x4434d9
or dword [ebp - 4], 0xffffffff
jmp 0x4434e3
mov dword [ebp - 0xec], 0
jmp 0x4434fc
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0xffffffff
jg 0x44357a
mov dword [ebp - 0x118], 0x722abac8
mov dword [ebp - 0x118], 0xffffffff
jmp 0x443528
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 1
je 0x443575
mov dword [ebp - 0x334], 1
mov byte [ebp - 0x2a], 0
push 0
lea eax, [ebp - 0x2a]
push eax
push 0x3bf9
call fcn.0043bee9
add esp, 0xc
push 0x775c
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x334]
push eax
push 1
push 0
push 1
call fcn.00417d92
add esp, 0x18
jmp 0x44351b
jmp 0x4434ef
jmp 0x443345
push 0x46bf
push 0x31d5
push 1
push 0x70ee
push 0x54e2
push 1
call fcn.00414037
add esp, 0x18
lea ecx, [ebp - 0x470]
call fcn.0040898e
lea ecx, [ebp - 0x450]
call fcn.0040898e
lea ecx, [ebp - 0x488]
call fcn.0040898e
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x24]
and eax, 0x2000000
je 0x44397f
push 0x4000
mov eax, dword [ebp - 0x14]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x14]
push dword [eax + 8]
push 0x139d
push 0x1639
call fcn.00407ec1
pop ecx
pop ecx
call eax
push 1
lea ecx, [ebp - 0x60]
call fcn.004088bc
mov dword [ebp - 0x18], 0x56f9b2cf
mov dword [ebp - 0x20], 0x2324015f
mov dword [ebp - 0x15c], 0xe291920b
push 2
lea ecx, [ebp - 0x47c]
call fcn.004088bc
mov dword [ebp - 0x4c0], 0xfffffff7
lea eax, [ebp - 0x60]
push eax
push 0x47f5
push 0x19cd
push 1
push 0x6332
push 0x4b05
push 0x71e2
lea eax, [ebp - 0x54]
push eax
push 1
push 0x4fcb
push 1
call fcn.00414135
add esp, 0x2c
mov dword [ebp - 0x54], 0
jmp 0x443672
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x44368e
push dword [ebp - 0x54]
lea ecx, [ebp - 0x47c]
call fcn.004089aa
mov dword [eax], 1
jmp 0x44366b
mov dword [ebp - 0x18], 0
jmp 0x44369e
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x4436e6
mov dword [ebp - 0x33c], 0x9fb023ed
mov dword [ebp - 0x4c8], 0xcc5d9b4e
mov dword [ebp - 0x424], 0x45ee28fd
push 0
lea eax, [ebp - 0x60]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x33c]
push eax
call fcn.0041d9b8
add esp, 0x18
jmp 0x443697
mov dword [ebp - 0x20], 2
mov esi, dword [ebp - 0x20]
push 0
lea ecx, [ebp - 0x60]
call fcn.004089aa
cmp esi, dword [eax]
jne 0x44370a
mov dword [ebp - 0x1d4], 1
jmp 0x443711
and dword [ebp - 0x1d4], 0
cmp dword [ebp - 0x1d4], 0x8cdf
jle 0x443729
mov dword [ebp - 0x1dc], 1
jmp 0x443730
and dword [ebp - 0x1dc], 0
push 0
lea ecx, [ebp - 0x60]
call fcn.004089aa
mov ecx, dword [ebp - 0x1dc]
cmp ecx, dword [eax]
je 0x443750
mov dword [ebp - 0x1e4], 1
jmp 0x443757
and dword [ebp - 0x1e4], 0
push 0
lea ecx, [ebp - 0x60]
call fcn.004089aa
mov ecx, dword [ebp - 0x1e4]
cmp ecx, dword [eax]
je 0x443777
mov dword [ebp - 0x1ec], 1
jmp 0x44377e
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x15c], eax
mov esi, dword [ebp - 0x20]
push 0
lea ecx, [ebp - 0x60]
call fcn.004089aa
cmp esi, dword [eax]
je 0x4437a7
mov dword [ebp - 0x1f4], 1
jmp 0x4437ae
and dword [ebp - 0x1f4], 0
cmp dword [ebp - 0x1f4], 0
je 0x4437c3
mov dword [ebp - 0x1fc], 1
jmp 0x4437ca
and dword [ebp - 0x1fc], 0
push 0
lea ecx, [ebp - 0x60]
call fcn.004089aa
mov esi, dword [ebp - 0x1fc]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x60]
call fcn.004089aa
cmp esi, dword [eax]
jge 0x4437f6
mov dword [ebp - 0x204], 1
jmp 0x4437fd
and dword [ebp - 0x204], 0
push 0
lea ecx, [ebp - 0x60]
call fcn.004089aa
mov esi, eax
mov edi, dword [ebp - 0x204]
sub edi, 4
push 0
lea ecx, [ebp - 0x60]
call fcn.004089aa
imul edi, dword [eax]
cmp dword [esi], edi
jg 0x44382f
mov dword [ebp - 0x20c], 1
jmp 0x443836
and dword [ebp - 0x20c], 0
push 0
lea ecx, [ebp - 0x60]
call fcn.004089aa
mov esi, eax
push 0
lea ecx, [ebp - 0x60]
call fcn.004089aa
mov ecx, dword [ebp - 0x20c]
sub ecx, dword [eax]
cmp dword [esi], ecx
jg 0x443870
push 0
lea ecx, [ebp - 0x60]
call fcn.004089aa
cmp dword [eax], 0
jne 0x443870
and dword [ebp - 0x214], 0
jmp 0x44387a
mov dword [ebp - 0x214], 1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x214]
jge 0x4438d1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x15c], eax
mov byte [ebp - 0x2c], 0
movzx eax, byte [ebp - 0x2c]
test eax, eax
je 0x4438cc
push 0x4031
push 1
push 0x196b
push 0
push 0x38ef
push 0x7390
push 1
push 0x22a7
push 0x5f35
call fcn.00416888
add esp, 0x24
jmp 0x443967
mov dword [ebp - 0x348], 1
mov dword [ebp - 0x4bc], 1
mov dword [ebp - 0x4ec], 0x160c6370
mov dword [ebp - 0x4c4], 0xffffffff
mov dword [ebp - 0x3cc], 0xc3cc8c9f
mov dword [ebp - 0x20], 0xfffffff4
jmp 0x443913
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff0
jl 0x443931
push 0x5d55
push 0
call fcn.0042f0e4
pop ecx
pop ecx
cmp dword [ebp - 0x20], 0
je 0x44392f
jmp 0x44390c
jmp 0x44390c
lea eax, [ebp - 0x20]
push eax
push 1
push 1
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x47c]
push eax
push 0
lea eax, [ebp - 0x3cc]
push eax
lea eax, [ebp - 0x348]
push eax
call fcn.00430069
add esp, 0x28
lea ecx, [ebp - 0x47c]
call fcn.0040898e
lea ecx, [ebp - 0x60]
call fcn.0040898e
jmp 0x44202c
mov dword [ebp - 0xf4], 0xfd3df75d
mov dword [ebp - 0x404], 0xfffffffd
mov dword [ebp - 0xf4], 0xffffffe8
jmp 0x4439ac
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xa
je 0x443b07
mov byte [ebp - 0x30], 0
push 0
push 0x166e
lea eax, [ebp - 0x30]
push eax
call fcn.00430ed0
add esp, 0xc
push 0x8a2
lea eax, [ebp - 0x404]
push eax
push 0x61c6
push 1
push 1
push 0
push 0x2cff
call fcn.0043ef18
add esp, 0x1c
mov dword [ebp - 0x21c], 0x17df
mov dword [ebp - 0x354], 0xac0d28
cmp dword [ebp - 0x21c], 0x1a43
jle 0x443abd
push 0
push 0
push 0
push 0
push 0
call dword [0xae0304]
and dword [ebp - 0x74], 0
jmp 0x443a35
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x2bb7
jge 0x443abd
and dword [ebp - 0x68], 0
jmp 0x443a4b
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x483e
jge 0x443ab8
and dword [ebp - 0x6c], 0
jmp 0x443a61
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x1572
jge 0x443ab6
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x6c]
shl eax, cl
xor eax, dword [ebp - 0x74]
cdq
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x3ac], edx
push dword [ebp - 0x3ac]
push dword [ebp - 0x3b0]
lea ecx, [ebp - 0x550]
call fcn.00401a68
pop ecx
pop ecx
mov ecx, eax
call fcn.00408686
push eax
call fcn.004a8e07
pop ecx
lea ecx, [ebp - 0x550]
call fcn.0040867c
jmp 0x443a5a
jmp 0x443a44
jmp 0x443a2e
mov dword [ebp - 4], 0xe
cmp dword [ebp - 0x21c], 0x16a7
jge 0x443adc
push dword [ebp - 0x354]
call fcn.004a8e07
pop ecx
jmp 0x443af8
or dword [ebp - 4], 0xffffffff
jmp 0x443b02
jmp 0x44399f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x6bf2
push 0
lea eax, [ebp - 0x3d8]
push eax
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.004148f5
add esp, 0x1c
mov dword [ebp - 0x224], 0x52d3
mov dword [ebp - 0x36c], 0xac0d50
cmp dword [ebp - 0x224], 0x54a9
jle 0x443c33
push 0
push 0
push 0
call dword [fcn.00ae0024]
and dword [ebp - 0x7c], 0
jmp 0x443b73
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xf35
jge 0x443c33
and dword [ebp - 0x84], 0
jmp 0x443b96
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0x3766
jge 0x443c2e
and dword [ebp - 0x8c], 0
jmp 0x443bbc
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0x2a26
jge 0x443c29
and dword [ebp - 0x94], 0
jmp 0x443bde
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0x1198
jge 0x443c27
mov eax, dword [ebp - 0x7c]
cdq
idiv dword [ebp - 0x84]
mov eax, dword [ebp - 0x8c]
sub eax, dword [ebp - 0x94]
or eax, edx
cdq
mov dword [ebp - 0x3bc], eax
mov dword [ebp - 0x3b8], edx
push dword [ebp - 0x3b8]
push dword [ebp - 0x3bc]
mov ecx, 0xadd238
call fcn.00408691
jmp 0x443bd1
jmp 0x443baf
jmp 0x443b89
jmp 0x443b6c
mov dword [ebp - 4], 0x10
cmp dword [ebp - 0x224], 0x5294
jge 0x443c56
mov edx, dword [ebp - 0x36c]
mov ecx, 0xadd238
call fcn.0040af1a
jmp 0x443c72
or dword [ebp - 4], 0xffffffff
jmp 0x443c7c
push 3
lea ecx, [ebp - 0x2e0]
call fcn.004088bc
mov dword [ebp - 0x1c], 0xfe7d8a87
mov dword [ebp - 0x150], 3
mov dword [ebp - 0x48], 0x9cea
push 4
lea ecx, [ebp - 0x444]
call fcn.004088bc
mov dword [ebp - 0x25c], 0x6dad8be7
mov dword [ebp - 0x40c], 1
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2e0]
push eax
push 0
call fcn.0043f5b0
add esp, 0xc
push 0
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x7d11
push 1
call fcn.00429b9f
add esp, 0x14
mov dword [ebp - 0x38], 0
jmp 0x443d03
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x443d19
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x378], 7
jmp 0x443cfc
mov dword [ebp - 0x1c], 0
jmp 0x443d29
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x443ed5
mov dword [ebp - 0x40], 1
lea eax, [ebp - 0x1c]
push eax
push 0x4b27
push 0x423c
push 0x2372
push 0x2fc3
push 0x6de2
push 0x2a01
push 1
push 0x6eda
lea eax, [ebp - 0x40]
push eax
push 0x6be1
push 0x5a22
push 0xaa7
push 0x7301
push 0x1390
push 0
lea eax, [ebp - 0x2e0]
push eax
call fcn.00413476
add esp, 0x44
mov dword [ebp - 0x40], 0
jmp 0x443da1
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jg 0x443ed0
mov dword [ebp - 0x22c], 0x6ca3
mov dword [ebp - 0x3e4], 0xac0dd4
cmp dword [ebp - 0x22c], 0x6fe4
jle 0x443e50
and dword [ebp - 0x9c], 0
jmp 0x443de5
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0x5b27
jge 0x443e46
and dword [ebp - 0xa4], 0
jmp 0x443e07
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x4f88
jge 0x443e44
mov eax, dword [ebp - 0x9c]
or eax, dword [ebp - 0xa4]
cdq
mov dword [ebp - 0x3c8], eax
mov dword [ebp - 0x3c4], edx
push dword [ebp - 0x3c4]
push dword [ebp - 0x3c8]
mov ecx, 0xadd238
call fcn.00408691
jmp 0x443dfa
jmp 0x443dd8
push 0
push 0
call dword [0xae03c0]
mov byte [ebp - 0x2b], 0
mov dword [ebp - 4], 0x12
cmp dword [ebp - 0x22c], 0x6b82
jge 0x443e77
mov edx, dword [ebp - 0x3e4]
mov ecx, 0xadd238
call fcn.0040af1a
jmp 0x443e93
or dword [ebp - 4], 0xffffffff
jmp 0x443e9d
movzx eax, byte [ebp - 0x2b]
test eax, eax
je 0x443ec0
push 0x6b8e
push 1
push 0x2920
push 0x658
push 1
call fcn.004144c2
add esp, 0x14
cmp dword [ebp - 0x40], 0
je 0x443ecb
jmp 0x443d9a
jmp 0x443d9a
jmp 0x443d22
mov dword [ebp - 0x26c], 0x533d
mov dword [ebp - 0x384], 0xac0e10
cmp dword [ebp - 0x26c], 0x55cc
jle 0x443fa4
and dword [ebp - 0xac], 0
jmp 0x443f0f
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x41b6
jge 0x443fa4
and dword [ebp - 0xb4], 0
jmp 0x443f35
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0xb99
jge 0x443f9f
and dword [ebp - 0xbc], 0
jmp 0x443f57
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0x66fc
jge 0x443f9d
mov eax, dword [ebp - 0xac]
cdq
idiv dword [ebp - 0xb4]
or edx, dword [ebp - 0xbc]
mov eax, edx
cdq
mov dword [ebp - 0x3d4], eax
mov dword [ebp - 0x3d0], edx
push dword [ebp - 0x3d0]
push dword [ebp - 0x3d4]
mov ecx, 0xadd238
call fcn.00408691
jmp 0x443f4a
jmp 0x443f28
jmp 0x443f02
push 0
lea ecx, [ebp - 0x2e0]
call fcn.004089aa
mov eax, dword [ebp - 0x150]
imul eax, dword [ebp - 0x48]
sub eax, 0xc437ffe
cmp eax, dword [ebp - 0x150]
jne 0x443fd4
mov dword [ebp - 0x234], 1
jmp 0x443fdb
and dword [ebp - 0x234], 0
push 1
lea ecx, [ebp - 0x2e0]
call fcn.004089aa
mov ecx, dword [ebp - 0x234]
cmp ecx, dword [eax]
je 0x444004
cmp dword [ebp - 0x48], 0
je 0x444004
mov dword [ebp - 0x170], 1
jmp 0x44400b
and dword [ebp - 0x170], 0
push 1
lea ecx, [ebp - 0x2e0]
call fcn.004089aa
mov ecx, dword [ebp - 0x170]
mov dword [eax], ecx
cmp dword [ebp - 0x170], 0xdda259c
jle 0x444038
mov dword [ebp - 0x23c], 1
jmp 0x44403f
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x23c], eax
jge 0x444059
cmp dword [ebp - 0x48], 0
jne 0x444059
and dword [ebp - 0x244], 0
jmp 0x444063
mov dword [ebp - 0x244], 1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x244]
je 0x444083
mov eax, 0x1d67
test eax, eax
je 0x444083
mov dword [ebp - 0x24c], 1
jmp 0x44408a
and dword [ebp - 0x24c], 0
push 2
lea ecx, [ebp - 0x444]
call fcn.004089aa
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x164]
mov dword [ecx], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x164]
add eax, dword [ecx]
cmp eax, dword [ebp - 0x24c]
jne 0x4440cd
mov dword [ebp - 0x254], 1
jmp 0x4440d4
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x25c]
add eax, dword [ebp - 0x48]
jne 0x44410c
push 0
lea ecx, [ebp - 0x444]
call fcn.004089aa
cmp dword [eax], 0
jne 0x44410c
and dword [ebp - 0x264], 0
jmp 0x444116
mov dword [ebp - 0x264], 1
mov eax, 0xfffc
sub eax, dword [ebp - 0x264]
cmp eax, dword [ebp - 0x150]
jg 0x444135
mov dword [ebp - 0x158], 1
jmp 0x44413c
and dword [ebp - 0x158], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x158]
mov dword [ebp + eax - 0x378], ecx
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x40c], eax
mov dword [ebp - 4], 0x14
cmp dword [ebp - 0x26c], 0x4f9b
jge 0x44417e
mov edx, dword [ebp - 0x384]
mov ecx, 0xadd238
call fcn.0040af1a
jmp 0x44419a
or dword [ebp - 4], 0xffffffff
jmp 0x4441a4
lea ecx, [ebp - 0x444]
call fcn.0040898e
lea ecx, [ebp - 0x2e0]
call fcn.0040898e
push 0x6b95
push 0x1954
push 1
push 0x1e1f
push 0x22a7
push 0x55d9
push 0x17a
push 0x4c30
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0xd0]
push eax
push 0x1ce9
push 0x5536
lea eax, [ebp - 0x14]
push eax
push 0x1204
push 0x1f31
push 0x36d1
push 1
call fcn.004125f9
add esp, 0x44
push 3
lea ecx, [ebp - 0x418]
call fcn.004088bc
mov dword [ebp - 0x4e4], 1
push 1
push 0x228a
push 1
lea eax, [ebp - 0x4cc]
push eax
lea eax, [ebp - 0x418]
push eax
push 0x160e
push 0x49a
push 0x6cd4
push 0x3392
push 1
push 0x6e41
call fcn.00412ba3
add esp, 0x2c
push 0
lea ecx, [ebp - 0x418]
call fcn.004089aa
and dword [eax], 0
jmp 0x44429b
push 0
lea ecx, [ebp - 0x418]
call fcn.004089aa
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x274]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x274]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x418]
call fcn.004089aa
cmp dword [eax], 0xffffffe4
je 0x4442f6
mov dword [ebp - 0xd8], 0
jmp 0x4442c6
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 1
jge 0x4442e2
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x3ec], 4
jmp 0x4442b9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3ec], 0
je 0x4442f4
jmp 0x4442f6
jmp 0x444277
lea ecx, [ebp - 0x418]
call fcn.0040898e
cmp dword [ebp - 0x27c], 0
jbe 0x44448b
mov dword [ebp - 0xe0], 0
jmp 0x444327
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jge 0x444343
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0xe8], 0xb9f9b31
jmp 0x44431a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xe8], 0
jmp 0x444371
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xe8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe8], 0xf
jg 0x44445f
mov dword [ebp - 0x2f0], 0xb0ceafd9
mov dword [ebp - 0x2ec], 0xb0ceafd9
mov dword [ebp - 0x2e8], 0xb0ceafd9
mov dword [ebp - 0x2e4], 0xb0ceafd9
mov dword [ebp - 0xf0], 0
jmp 0x4443c6
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 1
jge 0x4443e2
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x390], 0xf1bf
jmp 0x4443b9
push 0x256e
push 0x646e
push 0x209c
push 0x8db
push 1
push 1
call fcn.00412f37
add esp, 0x18
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x2f0], 0
jmp 0x444430
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2f0]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x2f0], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2f0], 1
jge 0x44445a
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2f0]
mov dword [ebp + eax*4 - 0x390], 0xd8d1
jmp 0x444415
jmp 0x444356
lea eax, [ebp - 0x490]
push eax
push dword [ebp - 0x420]
push dword [ebp - 0x27c]
mov eax, dword [ebp - 0x14]
push dword [eax + 8]
push 0x139d
push 0xe65
call fcn.00407ec1
pop ecx
pop ecx
call eax
jmp 0x44202c
jmp 0x44466e
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x310], eax
mov dword [ebp - 0x288], 0x243c
mov dword [ebp - 0x320], 0xac0e58
cmp dword [ebp - 0x288], 0x2610
jle 0x4445e1
push 0
call dword [0xae0260]
and dword [ebp - 0xf8], 0
jmp 0x4444ef
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0xfa1
jge 0x4445d9
and dword [ebp - 0x100], 0
jmp 0x444515
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0x5ce4
jge 0x4445d4
and dword [ebp - 0x108], 0
jmp 0x44453b
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0x7efa
jge 0x4445cf
and dword [ebp - 0x110], 0
jmp 0x444561
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x5688
jge 0x4445ca
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0x100]
shl eax, cl
mov ecx, dword [ebp - 0x108]
sar eax, cl
and eax, dword [ebp - 0x110]
cdq
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 0x3dc], edx
push dword [ebp - 0x3dc]
push dword [ebp - 0x3e0]
lea ecx, [ebp - 0x580]
call fcn.00401a68
pop ecx
pop ecx
mov ecx, eax
call fcn.00408686
push eax
call fcn.004a8e07
pop ecx
lea ecx, [ebp - 0x580]
call fcn.0040867c
jmp 0x444554
jmp 0x44452e
jmp 0x444508
jmp 0x4444e2
push 0
call dword [0xae0470]
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x50]
mov dword [eax], 0
jmp 0x44460c
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x50]
mov dword [ecx], eax
mov eax, dword [ebp - 0x50]
cmp dword [eax], 2
jge 0x444629
mov eax, dword [ebp - 0x50]
push dword [eax]
mov ecx, dword [ebp - 0x318]
call fcn.004089aa
and dword [eax], 0
jmp 0x444601
mov dword [ebp - 4], 0x16
cmp dword [ebp - 0x288], 0x2408
jge 0x444648
push dword [ebp - 0x320]
call fcn.004a8e07
pop ecx
jmp 0x444664
or dword [ebp - 4], 0xffffffff
jmp 0x44466e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret