Function at 0x41c706
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1450
call fcn.00491f50
push esi
push edi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x4259b9
mov eax, dword [ebp + 8]
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xacc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xb28], eax
mov eax, dword [ebp - 0xb28]
movzx eax, byte [eax]
test eax, eax
je 0x42596d
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x10c], 9
push 3
lea ecx, [ebp - 0xdb8]
call fcn.00410610
mov dword [ebp - 0x960], 0x74da8628
mov dword [ebp - 0x70], 0
jmp 0x41c782
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x41c798
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xd8c], 0x10c9
jmp 0x41c77b
mov dword [ebp - 0x70], 0
jmp 0x41c7a8
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x41c7c4
push dword [ebp - 0x70]
lea ecx, [ebp - 0xdb8]
call fcn.004106b1
mov dword [eax], 0x9275
jmp 0x41c7a1
mov dword [ebp - 0x10c], 3
jmp 0x41c7dd
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jl 0x41c96e
mov dword [ebp - 0x5c], 0xfffffffd
mov dword [ebp - 0xb3c], 0xa7a81a82
mov dword [ebp - 0x5c], 0
jmp 0x41c80b
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jg 0x41c954
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0xd8c]
mov dword [ebp - 0x710], eax
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x710]
mov dword [ebp + eax*4 - 0xd8c], ecx
cmp dword [ebp - 0x710], 0
jne 0x41c91a
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0xd8c]
mov dword [ebp - 0x1198], eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ebp + ecx*4 - 0xd8c]
cmp dword [ebp + eax*4 - 0xd8c], ecx
jne 0x41c877
mov dword [ebp - 0x948], 1
jmp 0x41c87e
and dword [ebp - 0x948], 0
imul eax, dword [ebp - 0x948], 0x87a7
test eax, eax
je 0x41c8aa
push 1
lea ecx, [ebp - 0xdb8]
call fcn.004106b1
cmp dword [eax], 0
je 0x41c8aa
mov dword [ebp - 0x950], 1
jmp 0x41c8b1
and dword [ebp - 0x950], 0
cmp dword [ebp - 0x950], 0x8ed4
je 0x41c8c9
mov dword [ebp - 0x958], 1
jmp 0x41c8d0
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0x960], eax
mov esi, dword [ebp - 0x960]
push 1
lea ecx, [ebp - 0xdb8]
call fcn.004106b1
cmp esi, dword [eax]
jne 0x41c8ff
mov dword [ebp - 0x968], 1
jmp 0x41c906
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x968], eax
jl 0x41c91a
and dword [ebp - 0x970], 0
jmp 0x41c924
mov dword [ebp - 0x970], 1
cmp dword [ebp - 0x970], 0x63e31551
jge 0x41c93c
mov dword [ebp - 0x984], 1
jmp 0x41c943
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x984]
mov dword [ebp - 0xb3c], eax
jmp 0x41c804
mov eax, dword [ebp - 0x10c]
cmp dword [ebp + eax*4 - 0xd8c], 0
je 0x41c969
jmp 0x41c7d0
jmp 0x41c7d0
lea ecx, [ebp - 0xdb8]
call fcn.004106ac
push 2
lea ecx, [ebp - 0xf08]
call fcn.00410610
mov dword [ebp - 0x16c], 0x79763266
push 0
lea eax, [ebp - 0xf08]
push eax
lea eax, [ebp - 0x1288]
push eax
push 1
call fcn.00416e04
add esp, 0x10
mov dword [ebp - 0x16c], 0
jmp 0x41c9c3
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 1
jg 0x41c9f2
push 0x588b
lea eax, [ebp - 0xf08]
push eax
push 0
push 0x6bfa
push 1
lea eax, [ebp - 0x16c]
push eax
call fcn.0041a1a8
add esp, 0x18
jmp 0x41c9b6
lea ecx, [ebp - 0xf08]
call fcn.004106ac
push 1
lea ecx, [ebp - 0x410]
call fcn.00410610
mov dword [ebp - 0x2b8], 0
jmp 0x41ca23
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 1
jge 0x41ca45
push dword [ebp - 0x2b8]
lea ecx, [ebp - 0x410]
call fcn.004106b1
mov dword [eax], 0xfb871c7b
jmp 0x41ca16
push 0
lea ecx, [ebp - 0x410]
call fcn.004106b1
mov esi, eax
push 0
lea ecx, [ebp - 0x410]
call fcn.004106b1
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x41ca73
mov dword [ebp - 0x98c], 1
jmp 0x41ca7a
and dword [ebp - 0x98c], 0
push 0
lea ecx, [ebp - 0x410]
call fcn.004106b1
mov ecx, dword [ebp - 0x98c]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x410]
call fcn.004106b1
push 0
lea ecx, [ebp - 0x410]
call fcn.004106b1
push 0
lea ecx, [ebp - 0x410]
call fcn.004106b1
cmp dword [eax], 0x85c9e53
je 0x41caca
mov dword [ebp - 0x994], 1
jmp 0x41cad1
and dword [ebp - 0x994], 0
imul eax, dword [ebp - 0x994], 0
cmp eax, 0xb21a35ca
jbe 0x41cb0d
push 0
lea ecx, [ebp - 0x410]
call fcn.004106b1
cmp dword [eax], 0
je 0x41cb0d
push 0x181f
push 0
push 0
push 1
lea eax, [ebp - 0x410]
push eax
call fcn.0041b873
add esp, 0x14
jmp 0x41cb55
mov dword [ebp - 0xb44], 9
push 0
lea ecx, [ebp - 0x410]
call fcn.004106b1
mov eax, dword [eax]
mov dword [ebp - 0xb44], eax
mov byte [ebp - 0xc2], 0
push 0x1ff9
push 0x2133
push 0
lea eax, [ebp - 0xc2]
push eax
push 0x2be8
push 1
call fcn.0041a0e4
add esp, 0x18
lea ecx, [ebp - 0x410]
call fcn.004106ac
mov dword [ebp - 0x118], 9
mov dword [ebp - 0xd0], 0x834504cd
mov dword [ebp - 0xfc0], 1
mov dword [ebp - 0xfbc], 1
mov dword [ebp - 0xfb8], 1
mov dword [ebp - 0xfb4], 1
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xd0], 3
jmp 0x41cbc1
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jl 0x41cbff
mov byte [ebp - 0xc4], 0
movzx eax, byte [ebp - 0xc4]
test eax, eax
je 0x41cbeb
push 0
push 0
push 0x11b5
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp - 0xd0]
cmp dword [ebp + eax*4 - 0xfc0], 0
je 0x41cbfd
jmp 0x41cbb4
jmp 0x41cbb4
push 3
lea ecx, [ebp - 0xdf4]
call fcn.00410610
mov dword [ebp - 0x1178], 4
mov byte [ebp - 0xc6], 0
movzx eax, byte [ebp - 0xc6]
test eax, eax
je 0x41cc30
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov byte [ebp - 0xc8], 0
movzx eax, byte [ebp - 0xc8]
test eax, eax
je 0x41cc5d
push 0
push 0x7178
push 0x727c
push 0x4a9
push 0
call fcn.004176ed
add esp, 0x14
mov dword [ebp - 0x51c], 0x74da8628
mov dword [ebp - 0x168], 0
jmp 0x41cc80
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 4
jge 0x41cc9c
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0xd9c], 0x10c9
jmp 0x41cc73
lea eax, [ebp - 0xdf4]
push eax
push 0
push 0
lea eax, [ebp - 0x168]
push eax
push 0x46e6
push 0x5ecc
call fcn.00417b83
add esp, 0x18
mov dword [ebp - 0x118], 3
jmp 0x41ccd9
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jl 0x41dae1
mov dword [ebp - 0x28], 0x3df603fa
mov dword [ebp - 0x9b4], 0x13cef339
mov dword [ebp - 0x1fc], 0
jmp 0x41cd10
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 2
jge 0x41cd2c
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0x154], 0x124f01c0
jmp 0x41cd03
mov dword [ebp - 0x28], 1
jmp 0x41cd3c
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x41d02e
mov dword [ebp - 0x9a4], 6
mov dword [ebp - 0xa2c], 0xa862
mov dword [ebp - 0x2a4], 0
jmp 0x41cd73
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 1
jge 0x41cd8f
mov eax, dword [ebp - 0x2a4]
mov dword [ebp + eax*4 - 0xb4c], 0xfffffffa
jmp 0x41cd66
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x154], 0
je 0x41cdb8
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x154], 0
je 0x41cdb8
mov dword [ebp - 0x99c], 1
jmp 0x41cdbf
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0x99c]
mov dword [ebp - 0x9a4], eax
cmp dword [ebp - 0x9a4], 0xfffffff9
jb 0x41cde0
mov dword [ebp - 0x9ac], 1
jmp 0x41cde7
and dword [ebp - 0x9ac], 0
mov eax, dword [ebp - 0x9ac]
mov dword [ebp - 0x9b4], eax
cmp dword [ebp - 0x9b4], 0
jne 0x41ce0e
mov eax, 0x279e56e6
test eax, eax
jne 0x41ce0e
and dword [ebp - 0x9bc], 0
jmp 0x41ce18
mov dword [ebp - 0x9bc], 1
imul eax, dword [ebp - 0x9bc], 0x6d5d
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x154]
neg eax
mov ecx, dword [ebp - 0x28]
cmp eax, dword [ebp + ecx*4 - 0x154]
jge 0x41ce54
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x154], 0
jne 0x41ce54
and dword [ebp - 0x9c4], 0
jmp 0x41ce5e
mov dword [ebp - 0x9c4], 1
cmp dword [ebp - 0x9c4], 0xfffffffe
je 0x41ce73
mov dword [ebp - 0x9cc], 1
jmp 0x41ce7a
and dword [ebp - 0x9cc], 0
cmp dword [ebp - 0x9cc], 0x29ec6ea3
jl 0x41ce92
mov dword [ebp - 0xa1c], 1
jmp 0x41ce99
and dword [ebp - 0xa1c], 0
mov eax, dword [ebp - 0xa1c]
sub eax, 0x7efe5121
je 0x41ceaf
cmp dword [ebp - 0xa2c], 0
jne 0x41cec5
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x154], 0
jne 0x41cec5
and dword [ebp - 0xa24], 0
jmp 0x41cecf
mov dword [ebp - 0xa24], 1
imul eax, dword [ebp - 0xa24], 0
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x154]
test eax, eax
jne 0x41cefa
cmp dword [ebp - 0xa2c], 0
jne 0x41cefa
and dword [ebp - 0xa10], 0
jmp 0x41cf04
mov dword [ebp - 0xa10], 1
cmp dword [ebp - 0xa10], 0x90ba5fc0
ja 0x41cf1c
mov dword [ebp - 0x76c], 1
jmp 0x41cf23
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x76c]
inc eax
mov ecx, dword [ebp - 0x28]
cmp eax, dword [ebp + ecx*4 - 0x154]
jge 0x41cf42
mov dword [ebp - 0x940], 1
jmp 0x41cf49
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x154]
cmp dword [ebp - 0x940], eax
jl 0x41cf67
mov dword [ebp - 0x48c], 1
jmp 0x41cf6e
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x154]
cmp dword [ebp - 0x48c], eax
je 0x41cf8c
mov dword [ebp - 0xa18], 1
jmp 0x41cf93
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0xa18]
sub eax, dword [ebp - 0x28]
cmp eax, 0xc73e
jge 0x41cfaf
mov dword [ebp - 0x494], 1
jmp 0x41cfb6
and dword [ebp - 0x494], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x154]
cmp dword [ebp - 0x494], eax
jge 0x41cfd7
mov dword [ebp - 0x380], 1
jmp 0x41cfde
and dword [ebp - 0x380], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x380]
mov dword [ebp + eax - 0x154], ecx
cmp dword [ebp - 0x380], 0
je 0x41d00f
mov eax, 0x8837
test eax, eax
je 0x41d00f
mov dword [ebp - 0x774], 1
jmp 0x41d016
and dword [ebp - 0x774], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x774]
mov dword [ebp + eax - 0xb4c], ecx
jmp 0x41cd35
mov dword [ebp - 0x9c], 0xfffffffd
mov dword [ebp - 0x64], 0xac204e2d
mov dword [ebp - 0x38], 0x6b71
mov dword [ebp - 0x60], 7
mov dword [ebp - 0x170], 0x8fefd6e5
mov dword [ebp - 0x4d4], 0x12bbf3af
mov dword [ebp - 0x8f4], 3
mov dword [ebp - 0x204], 0
jmp 0x41d084
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 4
jge 0x41d0a0
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0xdac], 0xf3adcfe
jmp 0x41d077
mov dword [ebp - 0x64], 0xfffffff3
jmp 0x41d0b0
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0xfffffff2
jge 0x41d3b1
mov dword [ebp - 0x138], 3
mov dword [ebp - 0xb54], 3
mov dword [ebp - 0xb64], 0x889e
push 2
lea ecx, [ebp - 0xcec]
call fcn.00410610
mov dword [ebp - 0x8ec], 0
mov dword [ebp - 0xc00], 3
mov dword [ebp - 0x2ac], 0
jmp 0x41d112
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 2
jge 0x41d134
push dword [ebp - 0x2ac]
lea ecx, [ebp - 0xcec]
call fcn.004106b1
mov dword [eax], 1
jmp 0x41d105
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x12a0], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x1180], eax
imul eax, dword [ebp - 0x138], 0xfff6
add eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0xb54]
jl 0x41d16a
mov dword [ebp - 0xb5c], 1
jmp 0x41d171
and dword [ebp - 0xb5c], 0
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x1298], eax
mov eax, dword [ebp - 0xb64]
sub eax, 7
imul eax, eax, 0x6dd2
test eax, eax
jne 0x41d1a2
cmp dword [ebp - 0x138], 0
jne 0x41d1a2
and dword [ebp - 0x49c], 0
jmp 0x41d1ac
mov dword [ebp - 0x49c], 1
mov eax, dword [ebp - 0x49c]
sub eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x64]
jne 0x41d1c6
mov dword [ebp - 0x8e4], 1
jmp 0x41d1cd
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x8e4], eax
jl 0x41d26a
mov dword [ebp - 0xb6c], 0x26cdee94
mov dword [ebp - 0x1188], 0xaec51ac
cmp dword [ebp - 0xb6c], 1
jge 0x41d205
mov dword [ebp - 0x4a4], 1
jmp 0x41d20c
and dword [ebp - 0x4a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdac]
cmp dword [ebp - 0x4a4], eax
jne 0x41d22d
mov dword [ebp - 0x77c], 1
jmp 0x41d234
and dword [ebp - 0x77c], 0
cmp dword [ebp - 0x77c], 0xffffffff
jge 0x41d249
mov dword [ebp - 0x4ac], 1
jmp 0x41d250
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x4ac]
sub eax, 6
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x60]
mov dword [ebp - 0x170], eax
jmp 0x41d2c1
mov dword [ebp - 0xbf8], 7
mov byte [ebp - 0xb7], 0
movzx eax, byte [ebp - 0xb7]
test eax, eax
je 0x41d29c
push 0
push 0x7244
push 0x75b6
push 1
call fcn.0041a978
add esp, 0x10
lea eax, [ebp - 0xcec]
push eax
push 0
push 1
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xbf8]
push eax
push 0x3d43
push 1
call fcn.004175f7
add esp, 0x1c
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0xfe8], eax
mov dword [ebp - 0x60], 0xca6f77a3
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x38], eax
jl 0x41d2e8
mov dword [ebp - 0x9a0], 1
jmp 0x41d2ef
and dword [ebp - 0x9a0], 0
push 1
lea ecx, [ebp - 0xcec]
call fcn.004106b1
mov eax, dword [eax]
cmp eax, dword [ebp - 0x9a0]
jge 0x41d312
mov dword [ebp - 0x4b4], 1
jmp 0x41d319
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0
jne 0x41d340
mov eax, 0x6f59
test eax, eax
jne 0x41d340
and dword [ebp - 0x784], 0
jmp 0x41d34a
mov dword [ebp - 0x784], 1
push 1
lea ecx, [ebp - 0xcec]
call fcn.004106b1
mov ecx, dword [ebp - 0x784]
imul ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp + eax - 0xdac]
cmp ecx, dword [ebp - 0x138]
jl 0x41d382
mov dword [ebp - 0x4bc], 1
jmp 0x41d389
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x8ec], eax
mov eax, dword [ebp - 0x8ec]
mov dword [ebp - 0xc00], eax
lea ecx, [ebp - 0xcec]
call fcn.004106ac
jmp 0x41d0a9
mov dword [ebp - 0x60], 3
jmp 0x41d3c1
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x41d58d
mov dword [ebp - 0x198], 1
mov dword [ebp - 0x38], 0
jmp 0x41d3e5
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jg 0x41d588
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0xdac], 0
jne 0x41d40c
cmp dword [ebp - 0x4d4], 0
jne 0x41d40c
cmp dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x198]
sub eax, 0x5994c1a6
imul eax, eax, 0x2ba
test eax, eax
jb 0x41d42d
mov dword [ebp - 0x4c4], 1
jmp 0x41d434
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0xdac]
cmp dword [ebp - 0x4c4], eax
jne 0x41d452
mov dword [ebp - 0x78c], 1
jmp 0x41d459
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x8f4]
cmp dword [ebp - 0x78c], eax
jne 0x41d473
mov dword [ebp - 0x4cc], 1
jmp 0x41d47a
and dword [ebp - 0x4cc], 0
cmp dword [ebp - 0x4cc], 0x474a
jle 0x41d492
mov dword [ebp - 0xa04], 1
jmp 0x41d499
and dword [ebp - 0xa04], 0
mov eax, dword [ebp - 0xa04]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xfec], eax
cmp dword [ebp - 0x4d4], 0x7dc1
jne 0x41d4c6
mov dword [ebp - 0x794], 1
jmp 0x41d4cd
and dword [ebp - 0x794], 0
cmp dword [ebp - 0x794], 1
jge 0x41d4eb
cmp dword [ebp - 0x198], 0
je 0x41d4eb
mov dword [ebp - 0x4dc], 1
jmp 0x41d4f2
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x4dc], eax
jg 0x41d50c
mov dword [ebp - 0xc08], 1
jmp 0x41d513
and dword [ebp - 0xc08], 0
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x102c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp + ecx*4 - 0xdac]
add ecx, 0xe300
cmp dword [ebp + eax - 0xdac], ecx
jge 0x41d54a
mov dword [ebp - 0x4e4], 1
jmp 0x41d551
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x8f4]
imul eax, dword [ebp - 0x4e4]
cmp eax, dword [ebp - 0x38]
jg 0x41d56f
mov dword [ebp - 0x79c], 1
jmp 0x41d576
and dword [ebp - 0x79c], 0
imul eax, dword [ebp - 0x79c], 0xfffffffd
mov dword [ebp - 0x170], eax
jmp 0x41d3de
jmp 0x41d3ba
mov dword [ebp - 0xc38], 0xa7a81a82
mov dword [ebp - 0x20c], 0xddc85f70
mov dword [ebp - 0x1034], 8
mov dword [ebp - 0x103c], 1
mov dword [ebp - 0x1044], 1
mov dword [ebp - 0x104c], 0x962ee6d0
mov dword [ebp - 0x1054], 0x3e86f8c7
mov dword [ebp - 0x105c], 0xf3de0369
mov dword [ebp - 0x1064], 0x80ca9f8d
mov dword [ebp - 0x106c], 0xa9bacde9
mov dword [ebp - 0x1074], 0x1e19e95d
mov dword [ebp - 0x107c], 0xfffffffc
mov dword [ebp - 0x132c], 0xfffffff6
mov dword [ebp - 0x1328], 0xfffffff6
mov dword [ebp - 0x1324], 0xfffffff6
mov dword [ebp - 0x1320], 0xfffffff6
mov dword [ebp - 0xc18], 0
mov dword [ebp - 0x20c], 0x13
jmp 0x41d650
mov eax, dword [ebp - 0x20c]
dec eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xfffffff8
jg 0x41d670
mov dword [ebp - 0xc10], 0xffffffff
cmp dword [ebp - 0xc10], 0
je 0x41d66e
jmp 0x41d670
jmp 0x41d643
lea eax, [ebp - 0xc18]
push eax
push 1
push 0
push 1
push 0xe35
call fcn.0041b873
add esp, 0x14
mov dword [ebp - 0x9c], 0
jmp 0x41d6a3
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jg 0x41d9f9
mov dword [ebp - 0x20], 0x824a8c6a
mov dword [ebp - 0xc30], 5
mov dword [ebp - 0x20], 9
jmp 0x41d6d1
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 7
jge 0x41d6ee
mov dword [ebp - 0xc20], 8
cmp dword [ebp - 0xc20], 0
je 0x41d6ec
jmp 0x41d6ee
jmp 0x41d6ca
mov dword [ebp - 0x20], 0
jmp 0x41d6fe
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 8
jl 0x41d8ab
push 2
lea ecx, [ebp - 0xa48]
call fcn.00410610
mov dword [ebp - 0x7a4], 0xa062b000
mov dword [ebp - 0x4fc], 0x5405732a
push 0x5185
lea eax, [ebp - 0xa48]
push eax
push 0xfa8
push 0
lea eax, [ebp - 0x1084]
push eax
push 1
push 0x1d3c
call fcn.00411fa0
add esp, 0x1c
push 1
lea ecx, [ebp - 0xa48]
call fcn.004106b1
push 1
lea ecx, [ebp - 0xa48]
call fcn.004106b1
cmp dword [eax], 0xf8b4
jle 0x41d780
mov dword [ebp - 0x4ec], 1
jmp 0x41d787
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x4ec], eax
jg 0x41d79e
mov dword [ebp - 0x9a8], 1
jmp 0x41d7a5
and dword [ebp - 0x9a8], 0
push 1
lea ecx, [ebp - 0xa48]
call fcn.004106b1
mov ecx, dword [ebp - 0x9a8]
cmp ecx, dword [eax]
jle 0x41d7c8
mov dword [ebp - 0xc28], 1
jmp 0x41d7cf
and dword [ebp - 0xc28], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x108c], eax
push 1
lea ecx, [ebp - 0xa48]
call fcn.004106b1
mov eax, dword [eax]
neg eax
cmp eax, 0xffffffff
jle 0x41d803
mov eax, 0xffff
test eax, eax
je 0x41d803
mov dword [ebp - 0x4f4], 1
jmp 0x41d80a
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x4f4], eax
je 0x41d821
mov dword [ebp - 0x8fc], 1
jmp 0x41d828
and dword [ebp - 0x8fc], 0
push 1
lea ecx, [ebp - 0xa48]
call fcn.004106b1
mov eax, dword [eax]
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebp - 0x7a4]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x4fc]
cmp eax, dword [ebp - 0x8fc]
jg 0x41d863
mov dword [ebp - 0x504], 1
jmp 0x41d86a
and dword [ebp - 0x504], 0
imul eax, dword [ebp - 0x504], 0x7392
sub eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jl 0x41d888
mov dword [ebp - 0x7ac], 1
jmp 0x41d88f
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x7ac]
mov dword [ebp - 0xc30], eax
lea ecx, [ebp - 0xa48]
call fcn.004106ac
jmp 0x41d6f7
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp + eax*4 - 0xd9c]
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x50c]
mov dword [ebp + eax*4 - 0xd9c], ecx
cmp dword [ebp - 0x50c], 0
jne 0x41d9bf
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp + eax*4 - 0xd9c]
mov dword [ebp - 0x1094], eax
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp + ecx*4 - 0xd9c]
cmp dword [ebp + eax*4 - 0xd9c], ecx
jne 0x41d919
mov dword [ebp - 0xa28], 1
jmp 0x41d920
and dword [ebp - 0xa28], 0
imul eax, dword [ebp - 0xa28], 0x87a7
test eax, eax
je 0x41d94c
push 1
lea ecx, [ebp - 0xdf4]
call fcn.004106b1
cmp dword [eax], 0
je 0x41d94c
mov dword [ebp - 0x514], 1
jmp 0x41d953
and dword [ebp - 0x514], 0
cmp dword [ebp - 0x514], 0x8ed4
je 0x41d96b
mov dword [ebp - 0x7b4], 1
jmp 0x41d972
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0x51c], eax
mov esi, dword [ebp - 0x51c]
push 1
lea ecx, [ebp - 0xdf4]
call fcn.004106b1
cmp esi, dword [eax]
jne 0x41d9a1
mov dword [ebp - 0x904], 1
jmp 0x41d9a8
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x904], eax
jl 0x41d9bf
and dword [ebp - 0x524], 0
jmp 0x41d9c9
mov dword [ebp - 0x524], 1
cmp dword [ebp - 0x524], 0x63e31551
jge 0x41d9e1
mov dword [ebp - 0x7bc], 1
jmp 0x41d9e8
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x7bc]
mov dword [ebp - 0xc38], eax
jmp 0x41d696
push 3
lea ecx, [ebp - 0xac0]
call fcn.00410610
mov dword [ebp - 0x78], 0
jmp 0x41da16
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x41da2c
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xff8], 0xffffffff
jmp 0x41da0f
mov dword [ebp - 0x78], 0
jmp 0x41da3c
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x41da58
push dword [ebp - 0x78]
lea ecx, [ebp - 0xac0]
call fcn.004106b1
mov dword [eax], 0xf5c184c5
jmp 0x41da35
push 2
lea ecx, [ebp - 0xac0]
call fcn.004106b1
and dword [eax], 0
jmp 0x41da8e
push 2
lea ecx, [ebp - 0xac0]
call fcn.004106b1
mov dword [ebp - 0x52c], eax
mov eax, dword [ebp - 0x52c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x52c]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xac0]
call fcn.004106b1
cmp dword [eax], 2
jge 0x41dabc
push 2
lea ecx, [ebp - 0xac0]
call fcn.004106b1
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0xff8], 0x82bd
jmp 0x41da6a
lea ecx, [ebp - 0xac0]
call fcn.004106ac
mov eax, dword [ebp - 0x118]
cmp dword [ebp + eax*4 - 0xd9c], 0
je 0x41dadc
jmp 0x41cccc
jmp 0x41cccc
lea ecx, [ebp - 0xdf4]
call fcn.004106ac
push 1
lea ecx, [ebp - 0x420]
call fcn.00410610
lea eax, [ebp - 0x420]
push eax
push 0x35ec
lea eax, [ebp - 0x109c]
push eax
push 0x1e5b
push 0x35cf
push 0
push 1
call fcn.0041a5ea
add esp, 0x1c
push 0x1e5b
push 0x5d1e
lea eax, [ebp - 0x420]
push eax
push 0
push 1
push 0x5782
push 0
call fcn.0041c4b0
add esp, 0x1c
push 0
lea ecx, [ebp - 0x420]
call fcn.004106b1
push 0
lea ecx, [ebp - 0x420]
call fcn.004106b1
push 0
lea ecx, [ebp - 0x420]
call fcn.004106b1
cmp dword [eax], 0x85c9e53
je 0x41db81
mov dword [ebp - 0x9b0], 1
jmp 0x41db88
and dword [ebp - 0x9b0], 0
imul eax, dword [ebp - 0x9b0], 0
cmp eax, 0xb21a35ca
jbe 0x41dbca
push 0
lea ecx, [ebp - 0x420]
call fcn.004106b1
cmp dword [eax], 0
je 0x41dbca
push 0
lea ecx, [ebp - 0x420]
call fcn.004106b1
mov esi, eax
push 0
lea ecx, [ebp - 0x420]
call fcn.004106b1
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x41dc05
mov dword [ebp - 0xc40], 9
push 0
lea ecx, [ebp - 0x420]
call fcn.004106b1
mov eax, dword [eax]
mov dword [ebp - 0xc40], eax
mov byte [ebp - 0x107], 0
movzx eax, byte [ebp - 0x107]
test eax, eax
je 0x41dc05
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
lea ecx, [ebp - 0x420]
call fcn.004106ac
mov dword [ebp - 0x1b0], 0xe1757117
push 2
lea ecx, [ebp - 0xf38]
call fcn.00410610
mov dword [ebp - 0x10a4], 0xbff1eb7e
mov dword [ebp - 0x2b4], 0
jmp 0x41dc4a
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 2
jge 0x41dc6c
push dword [ebp - 0x2b4]
lea ecx, [ebp - 0xf38]
call fcn.004106b1
mov dword [eax], 1
jmp 0x41dc3d
mov dword [ebp - 0x1b0], 0
jmp 0x41dc85
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0xfffffff8
jge 0x41de30
push 3
lea ecx, [ebp - 0xaa8]
call fcn.00410610
mov dword [ebp - 0x214], 1
lea eax, [ebp - 0x10ac]
push eax
push 0x41e2
push 1
push 0x7b0
lea eax, [ebp - 0xaa8]
push eax
push 0x76e8
push 0
call fcn.0041a885
add esp, 0x1c
push 0
lea ecx, [ebp - 0xaa8]
call fcn.004106b1
and dword [eax], 0
jmp 0x41dd08
push 0
lea ecx, [ebp - 0xaa8]
call fcn.004106b1
mov dword [ebp - 0x534], eax
mov eax, dword [ebp - 0x534]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x534]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xaa8]
call fcn.004106b1
cmp dword [eax], 1
jg 0x41dd58
mov dword [ebp - 0xc48], 0xfffffffa
push 0x43fa
push 0
lea eax, [ebp - 0x1b0]
push eax
push 0x22b2
push 1
lea eax, [ebp - 0xaa8]
push eax
lea eax, [ebp - 0xc48]
push eax
lea eax, [ebp - 0xf38]
push eax
call fcn.00416ade
add esp, 0x20
jmp 0x41dce4
mov dword [ebp - 0x214], 0x12
jmp 0x41dd71
mov eax, dword [ebp - 0x214]
dec eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffe9
jge 0x41de20
push 3
lea ecx, [ebp - 0xf20]
call fcn.00410610
push 0x2648
push 0x5432
push 0x284b
push 0
push 0x33c1
lea eax, [ebp - 0xf20]
push eax
push 1
lea eax, [ebp - 0x10b4]
push eax
push 0x4da7
push 0x1a63
push 0x396f
call fcn.004162c0
add esp, 0x2c
mov byte [ebp - 0xb9], 0
push 0x6c69
push 0x4a1d
lea eax, [ebp - 0xb9]
push eax
push 0
push 0
push 1
push 0x733a
push 0x4a9b
call fcn.00416991
add esp, 0x20
push 0x29af
lea eax, [ebp - 0xf20]
push eax
push 0
push 0
call fcn.0041623a
add esp, 0x10
lea ecx, [ebp - 0xf20]
call fcn.004106ac
jmp 0x41dd64
lea ecx, [ebp - 0xaa8]
call fcn.004106ac
jmp 0x41dc78
lea ecx, [ebp - 0xf38]
call fcn.004106ac
mov dword [ebp - 0x7c4], 0x1d925b0e
push 1
lea ecx, [ebp - 0xdc4]
call fcn.00410610
mov dword [ebp - 0x98], 0
jmp 0x41de6b
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x41de87
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x1004], 1
jmp 0x41de5e
mov dword [ebp - 0x98], 0
jmp 0x41dea0
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x41dec2
push dword [ebp - 0x98]
lea ecx, [ebp - 0xdc4]
call fcn.004106b1
mov dword [eax], 0xfffffff9
jmp 0x41de93
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1004]
mov dword [ebp - 0x7c4], eax
mov esi, dword [ebp - 0x7c4]
push 0
lea ecx, [ebp - 0xdc4]
call fcn.004106b1
mov dword [eax], esi
push 0
push 0
lea eax, [ebp - 0xdc4]
push eax
push 0x5f4a
call fcn.00417492
add esp, 0x10
lea ecx, [ebp - 0xdc4]
call fcn.004106ac
push 1
lea ecx, [ebp - 0x44c]
call fcn.00410610
push 0
push 0x323e
push 0x7110
push 1
lea eax, [ebp - 0x44c]
push eax
push 0x6025
push 0x529b
lea eax, [ebp - 0x10bc]
push eax
push 0
push 0x30c
call fcn.00417c7f
add esp, 0x28
mov dword [ebp - 0xd8], 0xfffffff8
mov dword [ebp - 0xc68], 0xa5d732ad
mov dword [ebp - 0xd8], 0xfffffff7
jmp 0x41df7c
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x1b
jle 0x41e0b0
mov dword [ebp - 0x130], 0x70cd
mov dword [ebp - 0x3f0], 0xffffffff
mov dword [ebp - 0x53c], 0x7e6aa165
mov eax, dword [ebp - 0x3f0]
cmp dword [ebp - 0x130], eax
jne 0x41e095
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 0
je 0x41e020
mov eax, dword [ebp - 0x130]
sub eax, 0x3e52
cmp eax, 0x5d56974e
je 0x41dfec
mov dword [ebp - 0x90c], 1
jmp 0x41dff3
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x90c], eax
jg 0x41e00d
mov dword [ebp - 0xc50], 1
jmp 0x41e014
and dword [ebp - 0xc50], 0
cmp dword [ebp - 0xd8], 0x6b5b
jg 0x41e032
cmp dword [ebp - 0x130], 0
jne 0x41e032
and dword [ebp - 0xc58], 0
jmp 0x41e03c
mov dword [ebp - 0xc58], 1
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x10c4], eax
cmp dword [ebp - 0x130], 0xf86f25db
jae 0x41e060
mov dword [ebp - 0xc60], 1
jmp 0x41e067
and dword [ebp - 0xc60], 0
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x10cc], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x10d4], eax
xor eax, eax
inc eax
neg eax
cmp eax, dword [ebp - 0xd8]
jl 0x41e095
and dword [ebp - 0x544], 0
jmp 0x41e09f
mov dword [ebp - 0x544], 1
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0xc68], eax
jmp 0x41df6f
mov byte [ebp - 0x104], 0
push 0x7c9c
push 0x4c1d
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 1
push 0x7351
call fcn.0041c706
add esp, 0x1c
push 0x1c85
push 0x78f
push 0x24af
push 1
push 0
lea eax, [ebp - 0x44c]
push eax
push 1
call fcn.0041c4b0
add esp, 0x1c
mov dword [ebp - 0x2bc], 9
push 1
lea ecx, [ebp - 0x434]
call fcn.00410610
mov dword [ebp - 0x178], 0
jmp 0x41e12f
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 3
jge 0x41e14b
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0xa54], 1
jmp 0x41e122
lea eax, [ebp - 0x178]
push eax
push 0
lea eax, [ebp - 0x434]
push eax
push 0
call fcn.0041af47
add esp, 0x10
mov dword [ebp - 0x2bc], 0
jmp 0x41e17e
mov eax, dword [ebp - 0x2bc]
dec eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0xffffffe8
jg 0x41e5b4
mov dword [ebp - 0x30], 0x914d2edc
mov dword [ebp - 0x57c], 0
mov dword [ebp - 0x30], 2
jmp 0x41e1ac
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x41e5af
mov dword [ebp - 0x1a0], 0x162c9cc1
mov dword [ebp - 0x180], 0xb5c6f8b8
mov dword [ebp - 0x1a0], 2
jmp 0x41e1e3
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
jl 0x41e51c
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xa54]
mov dword [ebp - 0x7cc], eax
mov eax, dword [ebp - 0x1a0]
mov ecx, dword [ebp - 0x7cc]
mov dword [ebp + eax*4 - 0xa54], ecx
cmp dword [ebp - 0x7cc], 1
jne 0x41e228
mov dword [ebp - 0x54c], 1
jmp 0x41e22f
and dword [ebp - 0x54c], 0
push 0
lea ecx, [ebp - 0x434]
call fcn.004106b1
mov ecx, dword [ebp - 0x54c]
mov dword [eax], ecx
mov dword [ebp - 0x180], 0
jmp 0x41e25d
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 2
jg 0x41e517
mov dword [ebp - 0x80], 0xfffffffb
mov dword [ebp - 0xcb4], 0x2a4e6309
mov dword [ebp - 0x80], 0
jmp 0x41e28b
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jg 0x41e2dd
mov dword [ebp - 0xc70], 0x5ab06c0e
push 0x6a0d
push 0
push 0x3eb1
push 0x778
push 0x40fa
lea eax, [ebp - 0xc70]
push eax
push 0x36f6
push 0x7a03
push 0x74a9
push 0xfd3
push 0
push 0x3758
call fcn.0041ac16
add esp, 0x30
jmp 0x41e284
mov dword [ebp - 0x80], 0
jmp 0x41e2ed
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jg 0x41e512
mov dword [ebp - 0x21c], 1
push 1
lea eax, [ebp - 0x434]
push eax
push 0x5a6c
push 1
push 0x1db
push 0xa42
push 0x3fc2
push 0x16c3
push 0
lea eax, [ebp - 0x21c]
push eax
call fcn.00417c7f
add esp, 0x28
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xa54]
mov dword [ebp - 0x10dc], eax
mov esi, dword [ebp - 0xcb4]
push 0
lea ecx, [ebp - 0x434]
call fcn.004106b1
cmp esi, dword [eax]
je 0x41e372
mov eax, 0x1832d748
test eax, eax
je 0x41e372
mov dword [ebp - 0x9e4], 1
jmp 0x41e379
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x9e4], eax
je 0x41e390
mov dword [ebp - 0x554], 1
jmp 0x41e397
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x554]
add eax, 0xeeb4
sub eax, dword [ebp - 0x30]
jne 0x41e3b9
cmp dword [ebp - 0x21c], 0
jne 0x41e3b9
and dword [ebp - 0x7d4], 0
jmp 0x41e3c3
mov dword [ebp - 0x7d4], 1
cmp dword [ebp - 0x7d4], 0x44fb66c1
jle 0x41e3db
mov dword [ebp - 0x55c], 1
jmp 0x41e3e2
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x55c], eax
jne 0x41e3f9
mov dword [ebp - 0x914], 1
jmp 0x41e400
and dword [ebp - 0x914], 0
cmp dword [ebp - 0x914], 0
jb 0x41e415
mov dword [ebp - 0x564], 1
jmp 0x41e41c
and dword [ebp - 0x564], 0
cmp dword [ebp - 0x564], 0x312b9482
jne 0x41e434
mov dword [ebp - 0x7dc], 1
jmp 0x41e43b
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x7dc]
sub eax, 4
cmp eax, dword [ebp - 0x21c]
je 0x41e458
mov dword [ebp - 0x56c], 1
jmp 0x41e45f
and dword [ebp - 0x56c], 0
push 0
lea ecx, [ebp - 0x434]
call fcn.004106b1
mov ecx, dword [ebp - 0x56c]
sub ecx, dword [eax]
je 0x41e494
push 0
lea ecx, [ebp - 0x434]
call fcn.004106b1
cmp dword [eax], 0
je 0x41e494
mov dword [ebp - 0x9b8], 1
jmp 0x41e49b
and dword [ebp - 0x9b8], 0
cmp dword [ebp - 0x9b8], 0xfffffffe
jne 0x41e4b6
cmp dword [ebp - 0x180], 0
jne 0x41e4b6
and dword [ebp - 0x574], 0
jmp 0x41e4c0
mov dword [ebp - 0x574], 1
cmp dword [ebp - 0x574], 7
ja 0x41e4d5
mov dword [ebp - 0xcbc], 1
jmp 0x41e4dc
and dword [ebp - 0xcbc], 0
push 0
lea ecx, [ebp - 0x434]
call fcn.004106b1
cmp dword [eax], 5
je 0x41e4fa
mov dword [ebp - 0x7e4], 1
jmp 0x41e501
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x7e4]
mov dword [ebp - 0x21c], eax
jmp 0x41e2e6
jmp 0x41e250
jmp 0x41e1d6
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0xa54], 0
jne 0x41e553
mov dword [ebp - 0x57c], 0xffff
mov eax, dword [ebp - 0x57c]
sub eax, 0xcfb9
mov ecx, dword [ebp - 0x30]
cmp eax, dword [ebp + ecx*4 - 0xa54]
jge 0x41e553
and dword [ebp - 0x91c], 0
jmp 0x41e55d
mov dword [ebp - 0x91c], 1
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xa54]
add eax, dword [ebp - 0x91c]
jne 0x41e57e
cmp dword [ebp - 0x30], 0
jne 0x41e57e
and dword [ebp - 0x584], 0
jmp 0x41e588
mov dword [ebp - 0x584], 1
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0xa54]
add esi, dword [ebp - 0x584]
push 0
lea ecx, [ebp - 0x434]
call fcn.004106b1
mov dword [eax], esi
jmp 0x41e1a5
jmp 0x41e171
lea ecx, [ebp - 0x434]
call fcn.004106ac
push 0
lea ecx, [ebp - 0x44c]
call fcn.004106b1
push 0
lea ecx, [ebp - 0x44c]
call fcn.004106b1
push 0
lea ecx, [ebp - 0x44c]
call fcn.004106b1
cmp dword [eax], 0x85c9e53
je 0x41e5fa
mov dword [ebp - 0x7ec], 1
jmp 0x41e601
and dword [ebp - 0x7ec], 0
imul eax, dword [ebp - 0x7ec], 0
cmp eax, 0xb21a35ca
jbe 0x41e6ed
push 0
lea ecx, [ebp - 0x44c]
call fcn.004106b1
cmp dword [eax], 0
je 0x41e6ed
push 2
lea ecx, [ebp - 0x1214]
call fcn.00410610
mov dword [ebp - 0x2c4], 0xc184c506
push 1
push 0x1973
push 0x72bc
push 0x2751
lea eax, [ebp - 0x10e4]
push eax
push 0x69f3
push 0
push 0x2e62
lea eax, [ebp - 0x1214]
push eax
push 0x42ed
call fcn.0041adc3
add esp, 0x28
mov dword [ebp - 0x2c4], 1
jmp 0x41e691
mov eax, dword [ebp - 0x2c4]
dec eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0
jl 0x41e6bb
mov byte [ebp - 0xbb], 0
lea eax, [ebp - 0xbb]
push eax
push 0x6b00
push 0
push 1
call fcn.0041623a
add esp, 0x10
jmp 0x41e684
lea ecx, [ebp - 0x1214]
call fcn.004106ac
push 0x75a3
push 0
push 1
push 0xb50
lea eax, [ebp - 0x44c]
push eax
push 0x38c0
call fcn.00417b83
add esp, 0x18
jmp 0x41ee27
mov dword [ebp - 0xcdc], 9
mov dword [ebp - 0x188], 0xec2e0cf5
mov dword [ebp - 0xccc], 0xffff
mov byte [ebp - 0xfc], 0
push 0x22a6
push 0x8f
push 0x7954
push 1
push 0x4e96
push 1
lea eax, [ebp - 0xfc]
push eax
call fcn.00411fa0
add esp, 0x1c
mov dword [ebp - 0x188], 0xffffffe4
jmp 0x41e752
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0x1a
jge 0x41e842
push 2
lea ecx, [ebp - 0xf74]
call fcn.00410610
mov dword [ebp - 0xcc4], 0xd86e52d8
mov dword [ebp - 0xcd4], 0xfffffffb
push 1
lea ecx, [ebp - 0xecc]
call fcn.00410610
lea eax, [ebp - 0xf74]
push eax
push 0x9c9
push 0x23be
lea eax, [ebp - 0x1c0]
push eax
push 0
push 1
call fcn.0041c64e
add esp, 0x18
mov dword [ebp - 0x1c0], 0
jmp 0x41e7ca
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 1
jge 0x41e7ec
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0xecc]
call fcn.004106b1
mov dword [eax], 0x236728ad
jmp 0x41e7bd
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0xcc4]
push eax
lea eax, [ebp - 0xf74]
push eax
lea eax, [ebp - 0xccc]
push eax
push 1
lea eax, [ebp - 0xcd4]
push eax
lea eax, [ebp - 0xecc]
push eax
push 0x31de
push 0
call fcn.00416551
add esp, 0x24
lea ecx, [ebp - 0xecc]
call fcn.004106ac
lea ecx, [ebp - 0xf74]
call fcn.004106ac
jmp 0x41e745
push 0
lea ecx, [ebp - 0x44c]
call fcn.004106b1
mov eax, dword [eax]
mov dword [ebp - 0xcdc], eax
mov dword [ebp - 0x45c], 0x5bb2c213
mov dword [ebp - 0x458], 0x5bb2c213
mov dword [ebp - 0x454], 0x5bb2c213
mov dword [ebp - 0x450], 0x5bb2c213
mov dword [ebp - 0xb0], 9
mov dword [ebp - 0xb0], 0
jmp 0x41e8a2
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jg 0x41eb0a
push 3
lea ecx, [ebp - 0xa60]
call fcn.00410610
mov dword [ebp - 0x224], 0
jmp 0x41e8d5
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 3
jge 0x41e8f4
push dword [ebp - 0x224]
lea ecx, [ebp - 0xa60]
call fcn.004106b1
or dword [eax], 0xffffffff
jmp 0x41e8c8
push 0
lea ecx, [ebp - 0xa60]
call fcn.004106b1
and dword [eax], 0
jmp 0x41e92a
push 0
lea ecx, [ebp - 0xa60]
call fcn.004106b1
mov dword [ebp - 0x58c], eax
mov eax, dword [ebp - 0x58c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x58c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa60]
call fcn.004106b1
cmp dword [eax], 3
jg 0x41eadd
mov dword [ebp - 0x2cc], 0
jmp 0x41e959
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 2
jge 0x41e975
mov eax, dword [ebp - 0x2cc]
mov dword [ebp + eax*4 - 0x3a8], 6
jmp 0x41e94c
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x3a8], 3
jmp 0x41e9a3
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3a8]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x3a8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3a8], 0
jl 0x41ead8
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp + eax*4 - 0x45c]
mov dword [ebp - 0x10ec], eax
push 4
pop eax
imul eax, eax, 3
imul eax, dword [ebp + eax - 0x45c], 0xf609
test eax, eax
je 0x41ea9f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a8], 0
je 0x41ea9f
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp + eax*4 - 0x45c]
mov dword [ebp - 0x10f4], eax
mov eax, dword [ebp - 0xb0]
cmp dword [ebp + eax*4 - 0x45c], 0x98d2
jg 0x41ea29
mov dword [ebp - 0xd54], 1
jmp 0x41ea30
and dword [ebp - 0xd54], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x45c]
mov dword [ebp - 0x10fc], eax
mov eax, dword [ebp - 0xb0]
cmp dword [ebp + eax*4 - 0x45c], 0
je 0x41ea6e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a8], 0
je 0x41ea6e
mov dword [ebp - 0x9e8], 1
jmp 0x41ea75
and dword [ebp - 0x9e8], 0
imul eax, dword [ebp - 0x9e8], 0xfbeb
test eax, eax
je 0x41ea9f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a8], 0
je 0x41ea9f
mov dword [ebp - 0xd5c], 1
jmp 0x41eaa6
and dword [ebp - 0xd5c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x45c]
mov dword [ebp - 0x1104], eax
push 0
lea ecx, [ebp - 0xa60]
call fcn.004106b1
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x45c], 0xbe3d0e72
jmp 0x41e988
jmp 0x41e906
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x45c], 0
je 0x41eafa
lea ecx, [ebp - 0xa60]
call fcn.004106ac
jmp 0x41eb0a
lea ecx, [ebp - 0xa60]
call fcn.004106ac
jmp 0x41e895
mov dword [ebp - 0x120], 0xfffffff8
mov dword [ebp - 0x594], 0xfffffff9
mov dword [ebp - 0x7f4], 0x466a
mov dword [ebp - 0x400], 0x813c27f3
mov dword [ebp - 0x3f8], 0x8bbd1883
mov dword [ebp - 0x22c], 0
jmp 0x41eb55
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 1
jge 0x41eb71
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0xac], 0xffffffff
jmp 0x41eb48
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xac], 0
jne 0x41ec93
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x110c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xac]
imul eax, dword [ebp - 0x120]
test eax, eax
jne 0x41ebc5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xac], 0
je 0x41ebc5
mov dword [ebp - 0xd64], 1
jmp 0x41ebcc
and dword [ebp - 0xd64], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xac]
mov dword [ebp - 0x1114], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xac]
mov dword [ebp - 0x111c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xac]
mov dword [ebp - 0x1124], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xac]
sub eax, 0x6335
mov dword [ebp - 0x594], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xac]
cmp dword [ebp - 0x594], eax
jg 0x41ec3e
mov dword [ebp - 0xd6c], 1
jmp 0x41ec45
and dword [ebp - 0xd6c], 0
mov dword [ebp - 0x7f4], 0xfffd
mov eax, dword [ebp - 0x7f4]
mov dword [ebp - 0x400], eax
mov eax, dword [ebp - 0x3f8]
cmp dword [ebp - 0x400], eax
jle 0x41ec75
mov dword [ebp - 0x59c], 1
jmp 0x41ec7c
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x59c], eax
jl 0x41ec93
and dword [ebp - 0x924], 0
jmp 0x41ec9d
mov dword [ebp - 0x924], 1
mov eax, dword [ebp - 0x3f8]
cmp dword [ebp - 0x924], eax
jge 0x41ecb7
mov dword [ebp - 0x5a4], 1
jmp 0x41ecbe
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x5a4]
jge 0x41ecd8
mov dword [ebp - 0x7fc], 1
jmp 0x41ecdf
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x3f8]
cmp dword [ebp - 0x7fc], eax
jne 0x41ecf6
cmp dword [ebp - 0x400], 0
jne 0x41ed08
cmp dword [ebp - 0x120], 0
jne 0x41ed08
and dword [ebp - 0x5ac], 0
jmp 0x41ed12
mov dword [ebp - 0x5ac], 1
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x120], eax
mov byte [ebp - 0xbd], 0
mov dword [ebp - 0x112c], 0
push 3
lea ecx, [ebp - 0x1224]
call fcn.00410610
mov dword [ebp - 0x1134], 0xffffffff
mov dword [ebp - 0x113c], 0x1a4e
mov dword [ebp - 0x1144], 2
mov dword [ebp - 0x114c], 0xfa55
mov dword [ebp - 0xc78], 0x9e56
mov dword [ebp - 0x1a8], 0
jmp 0x41ed87
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 1
jge 0x41eda3
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0x1154], 0x4f01
jmp 0x41ed7a
push 0x605
lea eax, [ebp - 0x1224]
push eax
push 0x4516
push 0
push 0x3375
push 0x6954
push 0
push 0x3fb2
push 0x1801
push 0x4fe1
lea eax, [ebp - 0x1a8]
push eax
call fcn.0041705d
add esp, 0x2c
push 1
push 0
push 0x324e
lea eax, [ebp - 0xc78]
push eax
call fcn.00417492
add esp, 0x10
lea ecx, [ebp - 0x1224]
call fcn.004106ac
push 0x2d08
lea eax, [ebp - 0xbd]
push eax
push 0xa64
push 1
push 0
push 1
push 0x1f8
call fcn.0041c706
add esp, 0x1c
lea ecx, [ebp - 0x44c]
call fcn.004106ac
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc5c], 0
mov dword [ebp - 0x2d4], 0
jmp 0x41ee5c
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 3
jge 0x41ee78
mov eax, dword [ebp - 0x2d4]
mov dword [ebp + eax*4 - 0x1dc], 0xfffffff7
jmp 0x41ee4f
mov dword [ebp - 8], 2
jmp 0x41ee88
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x41f19b
mov dword [ebp - 0x3fc], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1dc], 0
jne 0x41eeb7
mov dword [ebp - 0x804], 1
jmp 0x41eebe
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x1dc]
cmp dword [ebp - 8], eax
je 0x41eed9
mov dword [ebp - 0x9c0], 1
jmp 0x41eee0
and dword [ebp - 0x9c0], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x1dc]
cmp dword [ebp - 0x9c0], eax
je 0x41eefe
mov dword [ebp - 0x5b4], 1
jmp 0x41ef05
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x5b4]
sub eax, 9
cmp eax, dword [ebp - 8]
je 0x41ef1f
mov dword [ebp - 0x5bc], 1
jmp 0x41ef26
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x804]
imul eax, dword [ebp - 0x5bc]
add eax, 0xecaf
cmp eax, 0xfffffffc
jbe 0x41ef49
mov dword [ebp - 0x92c], 1
jmp 0x41ef50
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x1dc]
cmp dword [ebp - 0x92c], eax
je 0x41ef6e
mov dword [ebp - 0x5c4], 1
jmp 0x41ef75
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x1dc]
cmp dword [ebp - 0x5c4], eax
jl 0x41ef93
mov dword [ebp - 0x80c], 1
jmp 0x41ef9a
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x80c], eax
jle 0x41efba
mov eax, 0x8502
test eax, eax
je 0x41efba
mov dword [ebp - 0x5cc], 1
jmp 0x41efc1
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x1dc]
cmp dword [ebp - 0x5cc], eax
jg 0x41efdf
mov dword [ebp - 0x9f0], 1
jmp 0x41efe6
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x1dc]
cmp eax, dword [ebp - 0x9f0]
jl 0x41f00e
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x1dc], 0
jne 0x41f00e
and dword [ebp - 0x5d4], 0
jmp 0x41f018
mov dword [ebp - 0x5d4], 1
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0xc5c], eax
mov eax, dword [ebp - 8]
imul eax, dword [ebp + eax*4 - 0x1dc], 0x8123
cmp dword [ebp - 8], eax
jge 0x41f043
mov dword [ebp - 0x814], 1
jmp 0x41f04a
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 1
jl 0x41f06b
mov dword [ebp - 0x5dc], 1
jmp 0x41f072
and dword [ebp - 0x5dc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1dc]
cmp eax, dword [ebp - 0x5dc]
jg 0x41f092
mov dword [ebp - 0x934], 1
jmp 0x41f099
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x1dc]
cmp eax, dword [ebp - 0x934]
jg 0x41f0b7
mov dword [ebp - 0x5e4], 1
jmp 0x41f0be
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x1dc]
cmp dword [ebp - 0x5e4], eax
jle 0x41f0dc
mov dword [ebp - 0x81c], 1
jmp 0x41f0e3
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x1dc]
cmp dword [ebp - 0x81c], eax
jl 0x41f101
mov dword [ebp - 0x5ec], 1
jmp 0x41f108
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x1dc]
cmp dword [ebp - 0x5ec], eax
jle 0x41f130
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x1dc], 0
jne 0x41f130
and dword [ebp - 0x9c8], 0
jmp 0x41f13a
mov dword [ebp - 0x9c8], 1
mov eax, dword [ebp - 0x9c8]
sub eax, 0xf11c
je 0x41f154
cmp dword [ebp - 0x3fc], 0
je 0x41f152
jmp 0x41f19b
jmp 0x41f196
mov byte [ebp - 0xbf], 0
push 0x178a
push 0x2a34
lea eax, [ebp - 0xbf]
push eax
push 0
push 0x795b
push 0x743
push 1
push 0x224a
push 0x4ba1
push 0x7e1c
push 0x2f0c
call fcn.0041705d
add esp, 0x2c
jmp 0x41ee81
mov byte [ebp - 0x102], 0
push 0
push 0xcfb
push 1
lea eax, [ebp - 0x102]
push eax
call fcn.00417b07
add esp, 0x10
lea eax, [ebp - 0x898]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x8a0], eax
mov dword [ebp - 0xad8], 0xa35f394a
mov dword [ebp - 0x115c], 2
mov dword [ebp - 0xb34], 0x7a4bedcc
mov dword [ebp - 0x1164], 0xfffffff8
mov dword [ebp - 0x824], 0x660f7e73
mov dword [ebp - 0x116c], 1
mov dword [ebp - 0xe84], 0xfffffff7
mov dword [ebp - 0xe80], 0xfffffff7
mov dword [ebp - 0xe7c], 0xfffffff7
mov dword [ebp - 0xe78], 0xfffffff7
lea ecx, [ebp - 0x391]
call fcn.004017e5
push eax
lea eax, [ebp - 0xe74]
push eax
lea eax, [ebp - 0xe84]
push eax
lea ecx, [ebp - 0x13cc]
call fcn.004106c0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xcfc]
call fcn.00410686
mov dword [ebp - 0x60c], 8
mov dword [ebp - 0x1174], 0x6773
mov dword [ebp - 0x117c], 0xfffffffb
mov dword [ebp - 0x388], 0x6493
mov dword [ebp - 0xc64], 0xffffffff
mov dword [ebp - 0xae0], 0x1ba1
push 2
lea ecx, [ebp - 0x1234]
call fcn.00410610
push 0x5b4a
push 0x3c84
push 0x491e
push 0
push 1
push 1
lea eax, [ebp - 0x1234]
push eax
lea eax, [ebp - 0x1184]
push eax
call fcn.00416991
add esp, 0x20
cmp dword [ebp - 0xb34], 0
je 0x41f308
push 0
lea ecx, [ebp - 0xcfc]
call fcn.004106b1
cmp dword [eax], 0
je 0x41f308
mov dword [ebp - 0x5f4], 1
jmp 0x41f30f
and dword [ebp - 0x5f4], 0
push 0
lea ecx, [ebp - 0xcfc]
call fcn.004106b1
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5f4]
jl 0x41f332
mov dword [ebp - 0x5fc], 1
jmp 0x41f339
and dword [ebp - 0x5fc], 0
push 0
lea ecx, [ebp - 0xcfc]
call fcn.004106b1
mov eax, dword [eax]
mov dword [ebp - 0x824], eax
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0xad0], eax
mov eax, dword [ebp - 0x824]
sub eax, dword [ebp - 0x5fc]
mov dword [ebp - 0xc94], eax
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0xad0]
cmp eax, dword [ebp - 0xc94]
jl 0x41f393
mov dword [ebp - 0x404], 1
jmp 0x41f39a
and dword [ebp - 0x404], 0
push 3
lea ecx, [ebp - 0xcfc]
call fcn.004106b1
mov ecx, dword [ebp - 0x404]
mov dword [eax], ecx
cmp dword [ebp - 0x404], 0x1e6
jg 0x41f3c7
mov dword [ebp - 0x93c], 1
jmp 0x41f3ce
and dword [ebp - 0x93c], 0
cmp dword [ebp - 0x93c], 0x2095d7c
jne 0x41f3e6
mov dword [ebp - 0x604], 1
jmp 0x41f3ed
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0xad8]
cmp eax, dword [ebp - 0x604]
jne 0x41f407
mov dword [ebp - 0x82c], 1
jmp 0x41f40e
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x60c], eax
mov eax, dword [ebp - 0xc64]
cmp dword [ebp - 0x60c], eax
jne 0x41f434
mov dword [ebp - 0x9f8], 1
jmp 0x41f43b
and dword [ebp - 0x9f8], 0
mov eax, dword [ebp - 0x9f8]
mov dword [ebp - 0xae0], eax
lea ecx, [ebp - 0x1234]
call fcn.004106ac
lea ecx, [ebp - 0xcfc]
call fcn.004106ac
cmp dword [ebp - 0x8a0], 0
je 0x4252c2
cmp dword [ebp - 0x898], 1
jle 0x4252c2
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x944], 0x511ecbfc
push 2
lea ecx, [ebp - 0xdd0]
call fcn.00410610
mov dword [ebp - 0x90], 0
jmp 0x41f4ae
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x41f4ca
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0xd0c], 0xffffffff
jmp 0x41f4a1
mov dword [ebp - 0x90], 0
jmp 0x41f4e3
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x41f505
push dword [ebp - 0x90]
lea ecx, [ebp - 0xdd0]
call fcn.004106b1
mov dword [eax], 0x5adb
jmp 0x41f4d6
mov dword [ebp - 0x10], 3
jmp 0x41f515
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff3
jle 0x41f532
mov dword [ebp - 0xc9c], 0x83c8
cmp dword [ebp - 0xc9c], 0
je 0x41f530
jmp 0x41f532
jmp 0x41f50e
mov dword [ebp - 0x10], 0
jmp 0x41f542
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x41f7fe
mov dword [ebp - 0x54], 0x22e6e7f7
mov dword [ebp - 0x834], 0
mov dword [ebp - 0xc6c], 0
mov byte [ebp - 0x100], 0
movzx eax, byte [ebp - 0x100]
test eax, eax
je 0x41f591
push 0x30fa
push 1
push 1
push 0
push 0x5939
call fcn.0041b873
add esp, 0x14
mov dword [ebp - 0x54], 0
jmp 0x41f5a1
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jg 0x41f7f9
mov dword [ebp - 0x140], 0x86bdae89
mov dword [ebp - 0x9d0], 0xacdd1f66
mov dword [ebp - 0x644], 0xfffffff6
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xd0c], 0
jne 0x41f5e5
cmp dword [ebp - 0x10], 0xffffffff
jg 0x41f5e5
and dword [ebp - 0xae8], 0
jmp 0x41f5ef
mov dword [ebp - 0xae8], 1
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x118c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xd0c]
mov dword [ebp - 0x1194], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0c]
mov dword [ebp - 0x119c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x11a4], eax
cmp dword [ebp - 0x10], 2
jne 0x41f639
cmp dword [ebp - 0x54], 0
jne 0x41f639
and dword [ebp - 0x614], 0
jmp 0x41f643
mov dword [ebp - 0x614], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xd0c]
mov dword [ebp - 0x11ac], eax
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x11b4], eax
imul eax, dword [ebp - 0x834], 0x5e4d
cmp eax, dword [ebp - 0x54]
jge 0x41f67a
mov dword [ebp - 0x61c], 1
jmp 0x41f681
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x61c], eax
jg 0x41f690
cmp dword [ebp - 0x10], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd0c]
cmp dword [ebp - 0x944], eax
je 0x41f6b7
cmp dword [ebp - 0x944], 0
jne 0x41f6b7
and dword [ebp - 0x624], 0
jmp 0x41f6c1
mov dword [ebp - 0x624], 1
cmp dword [ebp - 0x624], 0x38d6
jge 0x41f6d9
mov dword [ebp - 0x83c], 1
jmp 0x41f6e0
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x83c]
mov dword [ebp - 0x140], eax
mov esi, dword [ebp - 0x140]
push 1
lea ecx, [ebp - 0xdd0]
call fcn.004106b1
mov dword [eax], esi
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x11bc], eax
push 1
lea ecx, [ebp - 0xdd0]
call fcn.004106b1
cmp dword [eax], 0
je 0x41f734
cmp dword [ebp - 0x140], 0
je 0x41f734
mov dword [ebp - 0x62c], 1
jmp 0x41f73b
and dword [ebp - 0x62c], 0
cmp dword [ebp - 0x62c], 0x737b
jg 0x41f753
mov dword [ebp - 0x63c], 1
jmp 0x41f75a
and dword [ebp - 0x63c], 0
mov dword [ebp - 0x9d0], 0xaca6
cmp dword [ebp - 0x9d0], 0xeef1
jle 0x41f77c
mov dword [ebp - 0x634], 1
jmp 0x41f783
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x634], eax
jge 0x41f79a
mov dword [ebp - 0x844], 1
jmp 0x41f7a1
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x844]
mov ecx, dword [ebp - 0x63c]
sub ecx, eax
mov dword [ebp - 0x140], ecx
cmp dword [ebp - 0x140], 4
ja 0x41f7cd
mov dword [ebp - 0x94c], 1
jmp 0x41f7d4
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x94c]
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 0
mov dword [ebp - 0xc6c], 0xfffffffe
jmp 0x41f59a
jmp 0x41f53b
lea ecx, [ebp - 0xdd0]
call fcn.004106ac
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x654], 0xfbb9cf7d
mov dword [ebp - 0x854], 0xeadd5d
mov dword [ebp - 0x66c], 1
mov dword [ebp - 0x9e0], 0xfffffffa
mov dword [ebp - 0x234], 0
jmp 0x41f851
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 2
jge 0x41f86d
mov eax, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0xe38], 0x609d70ca
jmp 0x41f844
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x11c4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x11cc], eax
cmp dword [ebp - 0xc], 0
je 0x41f8ee
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x11d4], eax
cmp dword [ebp - 0xc], 2
jne 0x41f8a0
mov dword [ebp - 0x84c], 1
jmp 0x41f8a7
and dword [ebp - 0x84c], 0
cmp dword [ebp - 0x84c], 0x2092
jle 0x41f8bf
mov dword [ebp - 0x390], 1
jmp 0x41f8c6
and dword [ebp - 0x390], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x390]
mov dword [ebp + eax - 0xe38], ecx
cmp dword [ebp - 0x390], 0
je 0x41f8ee
mov dword [ebp - 0x64c], 1
jmp 0x41f8f5
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x64c], eax
jne 0x41f915
mov eax, 0xd02e889e
test eax, eax
je 0x41f915
mov dword [ebp - 0xa00], 1
jmp 0x41f91c
and dword [ebp - 0xa00], 0
mov eax, dword [ebp - 0xa00]
mov dword [ebp - 0x654], eax
mov eax, dword [ebp - 0x654]
mov dword [ebp - 0x854], eax
cmp dword [ebp - 0x854], 0
jne 0x41f94d
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x41f94d
and dword [ebp - 0x65c], 0
jmp 0x41f957
mov dword [ebp - 0x65c], 1
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x65c], eax
jle 0x41f96e
mov dword [ebp - 0x954], 1
jmp 0x41f975
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0x954]
sub eax, 6
cmp eax, dword [ebp - 0xc]
jl 0x41f98f
mov dword [ebp - 0x664], 1
jmp 0x41f996
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x664]
sub eax, 0xe81d
cmp eax, 6
jne 0x41f9b2
mov dword [ebp - 0x85c], 1
jmp 0x41f9b9
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x85c]
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp - 0x66c]
mov dword [ebp - 0x9e0], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x9e0], eax
jne 0x41f9e8
mov dword [ebp - 0x674], 1
jmp 0x41f9ef
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x674]
add eax, dword [ebp - 0xc]
neg eax
imul eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0xc]
je 0x41fa15
mov dword [ebp - 0x864], 1
jmp 0x41fa1c
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x864], eax
jne 0x41fae3
mov dword [ebp - 0x128], 0xce404d4
mov dword [ebp - 0xaf0], 1
cmp dword [ebp - 0x128], 0
jne 0x41fa61
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe38], 0
jne 0x41fa61
and dword [ebp - 0x67c], 0
jmp 0x41fa6b
mov dword [ebp - 0x67c], 1
mov eax, dword [ebp - 0x67c]
sub eax, dword [ebp - 0x128]
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0x128], 0
jmp 0x41fa96
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0x17
jl 0x41fae1
mov dword [ebp - 0xc], 0
jmp 0x41faaf
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jg 0x41fadf
mov byte [ebp - 0xc0], 0
movzx eax, byte [ebp - 0xc0]
test eax, eax
je 0x41fadd
push 0x400d
push 1
push 0
push 0x2a52
call fcn.0041b7fe
add esp, 0x10
jmp 0x41faa8
jmp 0x41fa89
jmp 0x41fb06
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x41fb06
push 1
push 0
push 0x49a1
call fcn.00416ebb
add esp, 0xc
mov byte [ebp - 0xfe], 0
push 1
lea eax, [ebp - 0xfe]
push eax
push 0
call fcn.00416f83
add esp, 0xc
mov dword [ebp - 0xbc0], 0xa35f394a
mov dword [ebp - 0x11dc], 2
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x2dc], 0
jmp 0x41fb54
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 3
jge 0x41fb70
mov eax, dword [ebp - 0x2dc]
mov dword [ebp + eax*4 - 0xa9c], 0xffffffff
jmp 0x41fb47
mov dword [ebp - 0x2c], 0
jmp 0x41fb80
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x41ff72
mov dword [ebp - 0x88], 0xba339924
mov dword [ebp - 0x88], 2
jmp 0x41fbad
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jl 0x41ff6d
mov dword [ebp - 0x190], 0x274bf90e
push 2
lea ecx, [ebp - 0xfa4]
call fcn.00410610
mov dword [ebp - 0x964], 0
mov dword [ebp - 0xb00], 0x5b5b06a8
mov dword [ebp - 0x23c], 0
jmp 0x41fbfe
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 2
jge 0x41fc20
push dword [ebp - 0x23c]
lea ecx, [ebp - 0xfa4]
call fcn.004106b1
mov dword [eax], 5
jmp 0x41fbf1
mov dword [ebp - 0x190], 0
jmp 0x41fc39
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 2
jg 0x41ff5d
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x58], 2
jmp 0x41fc5d
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x41ff58
mov dword [ebp - 0x244], 0xdaab72b2
mov dword [ebp - 0xaf8], 0xfffffff6
push 1
lea ecx, [ebp - 0xf44]
call fcn.00410610
mov dword [ebp - 0x2e4], 0
jmp 0x41fca1
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 1
jge 0x41fcc0
push dword [ebp - 0x2e4]
lea ecx, [ebp - 0xf44]
call fcn.004106b1
or dword [eax], 0xffffffff
jmp 0x41fc94
mov dword [ebp - 0x244], 2
jmp 0x41fcd9
mov eax, dword [ebp - 0x244]
dec eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
jl 0x41fd59
mov dword [ebp - 0x2ec], 1
mov dword [ebp - 0xca4], 0xffffffff
mov dword [ebp - 0x2ec], 2
jmp 0x41fd0f
mov eax, dword [ebp - 0x2ec]
dec eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0
jl 0x41fd54
push 0xb6b
push 0x713d
push 0x3854
lea eax, [ebp - 0xca4]
push eax
push 0
push 0x249b
lea eax, [ebp - 0xaf8]
push eax
push 0
push 0x3ddd
push 0x2777
push 1
call fcn.0041aa91
add esp, 0x2c
jmp 0x41fd02
jmp 0x41fccc
mov eax, dword [ebp - 0x58]
cmp dword [ebp + eax*4 - 0xa9c], 0
jne 0x41fe72
cmp dword [ebp - 0x2c], 0
jne 0x41fe18
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0xa9c]
cmp dword [ebp - 0x190], eax
jle 0x41fd92
mov dword [ebp - 0x95c], 1
jmp 0x41fd99
and dword [ebp - 0x95c], 0
cmp dword [ebp - 0x95c], 0xdaba
jge 0x41fdb1
mov dword [ebp - 0x684], 1
jmp 0x41fdb8
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x684], eax
jl 0x41fdd2
mov dword [ebp - 0x86c], 1
jmp 0x41fdd9
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x86c]
sub ecx, dword [ebp + eax*4 - 0xa9c]
cmp ecx, dword [ebp - 0x88]
jne 0x41fdfd
mov dword [ebp - 0x68c], 1
jmp 0x41fe04
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x68c]
jle 0x41fe18
and dword [ebp - 0xa08], 0
jmp 0x41fe22
mov dword [ebp - 0xa08], 1
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0xa08]
add esi, eax
push 1
lea ecx, [ebp - 0xfa4]
call fcn.004106b1
cmp esi, dword [eax]
jl 0x41fe50
mov dword [ebp - 0x694], 1
jmp 0x41fe57
and dword [ebp - 0x694], 0
cmp dword [ebp - 0x694], 0xe155
jle 0x41fe72
cmp dword [ebp - 0x58], 0
jne 0x41fe72
and dword [ebp - 0x874], 0
jmp 0x41fe7c
mov dword [ebp - 0x874], 1
cmp dword [ebp - 0x874], 9
jne 0x41fe91
mov dword [ebp - 0x69c], 1
jmp 0x41fe98
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x69c]
mov dword [ebp - 0x964], eax
mov eax, dword [ebp - 0x964]
mov dword [ebp - 0x11e4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x11ec], eax
mov eax, dword [ebp - 0x58]
cmp dword [ebp + eax*4 - 0xa9c], 0
jb 0x41fed4
xor eax, eax
inc eax
jne 0x41fed4
and dword [ebp - 0x6a4], 0
jmp 0x41fede
mov dword [ebp - 0x6a4], 1
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x6a4], eax
jle 0x41fef8
mov dword [ebp - 0x87c], 1
jmp 0x41feff
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x87c], eax
jl 0x41ff19
mov dword [ebp - 0xb74], 1
jmp 0x41ff20
and dword [ebp - 0xb74], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa9c]
mov dword [ebp - 0x11f4], eax
push 0
lea ecx, [ebp - 0xf44]
call fcn.004106b1
mov eax, dword [eax]
mov dword [ebp - 0xb00], eax
lea ecx, [ebp - 0xf44]
call fcn.004106ac
jmp 0x41fc56
jmp 0x41fc2c
lea ecx, [ebp - 0xfa4]
call fcn.004106ac
jmp 0x41fba0
jmp 0x41fb79
mov dword [ebp - 0x2c], 0
jmp 0x41ff82
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x41ff98
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xa9c], 0
jmp 0x41ff7b
mov dword [ebp - 0xb40], 0x7a4bedcc
mov dword [ebp - 0xb08], 0xc7a00f47
mov dword [ebp - 0xb10], 2
mov dword [ebp - 0xb78], 0x7eed050b
mov dword [ebp - 0xb80], 0xe13c9534
mov dword [ebp - 0xe5c], 5
mov dword [ebp - 0xe58], 5
mov dword [ebp - 0xe54], 5
mov dword [ebp - 0xe50], 5
lea ecx, [ebp - 0x399]
call fcn.004017e5
push eax
lea eax, [ebp - 0xe4c]
push eax
lea eax, [ebp - 0xe5c]
push eax
lea ecx, [ebp - 0x13bc]
call fcn.004106c0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1374]
call fcn.00410686
mov dword [ebp - 0x11fc], 0x34fd39ef
mov byte [ebp - 0xc3], 0
push 0x5004
push 1
push 0
push 1
lea eax, [ebp - 0xc3]
push eax
call fcn.0041b155
add esp, 0x14
push 0x6b60
push 0x4a7c
lea eax, [ebp - 0xb78]
push eax
push 1
push 0x7739
push 0x35b0
push 1
push 0x44cd
lea eax, [ebp - 0xb08]
push eax
lea eax, [ebp - 0xb80]
push eax
lea eax, [ebp - 0xb10]
push eax
call fcn.004162c0
add esp, 0x2c
lea ecx, [ebp - 0x1374]
call fcn.004106ac
mov dword [ebp - 0x1204], 0xfffffff8
mov dword [ebp - 0x71c], 0x660f7e73
push 1
lea ecx, [ebp - 0xde8]
call fcn.00410610
mov dword [ebp - 0x6cc], 0x90a3cfce
mov dword [ebp - 0xb18], 2
mov dword [ebp - 0xb90], 0x3e93d0b5
mov dword [ebp - 0x12b8], 0xeb9e
mov dword [ebp - 0x6e4], 0x215256ee
mov dword [ebp - 0x12c0], 0x720348f4
mov dword [ebp - 0x12c8], 0
mov dword [ebp - 0xb98], 0x426a7609
mov dword [ebp - 0x96c], 0x88e10e5e
mov dword [ebp - 0x894], 0xabc24891
mov dword [ebp - 0x12d0], 0xf05f4326
mov dword [ebp - 0xa14], 1
mov dword [ebp - 0x12d8], 0xfffffff8
push 2
lea ecx, [ebp - 0xed8]
call fcn.00410610
mov dword [ebp - 0xb20], 0x5f992db7
mov dword [ebp - 0x6bc], 0
mov dword [ebp - 0x6dc], 0x8ce22955
mov dword [ebp - 0x12e0], 0xffffffff
mov dword [ebp - 0x12e8], 0x5de082ad
mov dword [ebp - 0x3e4], 0xfffffffe
push 0xcd
push 0x4841
push 0x61d
push 0
lea eax, [ebp - 0xb88]
push eax
push 0x151e
push 0x2d5b
lea eax, [ebp - 0xde8]
push eax
push 1
call fcn.0041b4e8
add esp, 0x24
push 1
lea eax, [ebp - 0xed8]
push eax
lea eax, [ebp - 0xb88]
push eax
push 0x7f3e
push 0
call fcn.004176ed
add esp, 0x14
cmp dword [ebp - 0x6cc], 1
jl 0x4201f1
mov dword [ebp - 0x6ac], 1
jmp 0x4201f8
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x6ac]
mov dword [ebp - 0xa14], eax
cmp dword [ebp - 0xa14], 0
jne 0x420216
cmp dword [ebp - 0xb18], 0
je 0x42022b
cmp dword [ebp - 0xb90], 0
je 0x42022b
mov dword [ebp - 0x6b4], 1
jmp 0x420232
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x3e4]
cmp eax, dword [ebp - 0x6b4]
jg 0x420259
mov dword [ebp - 0x884], 1
jmp 0x420260
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x6bc], eax
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x96c], eax
mov esi, dword [ebp - 0x96c]
push 0
lea ecx, [ebp - 0xde8]
call fcn.004106b1
cmp dword [eax], esi
jg 0x42029b
mov dword [ebp - 0x6c4], 1
jmp 0x4202a2
and dword [ebp - 0x6c4], 0
cmp dword [ebp - 0x6c4], 0x8e1b8814
jne 0x4202ba
mov dword [ebp - 0x88c], 1
jmp 0x4202c1
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x6dc]
cmp dword [ebp - 0x88c], eax
jne 0x4202db
mov dword [ebp - 0x9ec], 1
jmp 0x4202e2
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x6cc]
cmp dword [ebp - 0x9ec], eax
jne 0x420302
push 0
lea ecx, [ebp - 0xed8]
call fcn.004106b1
cmp dword [eax], 0
jne 0x420312
push 4
pop eax
test eax, eax
jne 0x420312
and dword [ebp - 0x6d4], 0
jmp 0x42031c
mov dword [ebp - 0x6d4], 1
mov eax, dword [ebp - 0x6d4]
inc eax
mov dword [ebp - 0x894], eax
mov eax, dword [ebp - 0xb20]
cmp dword [ebp - 0x894], eax
jl 0x420349
cmp dword [ebp - 0x6dc], 0
jne 0x420349
and dword [ebp - 0x974], 0
jmp 0x420353
mov dword [ebp - 0x974], 1
mov eax, dword [ebp - 0x974]
mov dword [ebp - 0x6e4], eax
mov esi, dword [ebp - 0x6e4]
push 0
lea ecx, [ebp - 0xde8]
call fcn.004106b1
imul esi, dword [eax]
mov dword [ebp - 0xb98], esi
lea ecx, [ebp - 0xed8]
call fcn.004106ac
lea ecx, [ebp - 0xde8]
call fcn.004106ac
mov dword [ebp - 0x12f0], 1
mov dword [ebp - 0xe70], 0xfffffff7
mov dword [ebp - 0xe6c], 0xfffffff7
mov dword [ebp - 0xe68], 0xfffffff7
mov dword [ebp - 0xe64], 0xfffffff7
lea ecx, [ebp - 0x3e5]
call fcn.004017e5
push eax
lea eax, [ebp - 0xe60]
push eax
lea eax, [ebp - 0xe70]
push eax
lea ecx, [ebp - 0x13ac]
call fcn.004106c0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd1c]
call fcn.00410686
mov dword [ebp - 0xa20], 8
mov dword [ebp - 0x12f8], 0x6773
mov dword [ebp - 0xe98], 1
mov dword [ebp - 0xe94], 1
mov dword [ebp - 0xe90], 1
mov dword [ebp - 0xe8c], 1
lea ecx, [ebp - 0x3dd]
call fcn.004017e5
push eax
lea eax, [ebp - 0xe88]
push eax
lea eax, [ebp - 0xe98]
push eax
lea ecx, [ebp - 0x1404]
call fcn.004106c0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1244]
call fcn.00410686
mov dword [ebp - 0x24c], 0
jmp 0x420482
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 1
jge 0x42049e
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0x2f4], 0xd4081c29
jmp 0x420475
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2f4], 0
jmp 0x4204cc
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2f4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2f4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2f4], 3
jg 0x42054f
mov dword [ebp - 0x160], 1
mov dword [ebp - 0x160], 0
jmp 0x4204ff
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 3
jg 0x42054a
mov byte [ebp - 0x106], 0
movzx eax, byte [ebp - 0x106]
test eax, eax
je 0x420530
push 0x5860
push 0
push 0x91c
push 1
call fcn.0041af47
add esp, 0x10
push dword [ebp - 0x160]
lea ecx, [ebp - 0x1244]
call fcn.004106b1
cmp dword [eax], 0
je 0x420548
jmp 0x4204f2
jmp 0x4204f2
jmp 0x4204b1
lea ecx, [ebp - 0x1244]
call fcn.004106ac
mov dword [ebp - 0x1300], 0xfffffffb
mov dword [ebp - 0x164], 0x79b69b2e
mov dword [ebp - 0xac4], 0x38b4b72b
mov dword [ebp - 0x254], 0
jmp 0x420591
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 3
jge 0x4205ad
mov eax, dword [ebp - 0x254]
mov dword [ebp + eax*4 - 0x1428], 0
jmp 0x420584
push 0
lea eax, [ebp - 0xac4]
push eax
push 0x1550
push 1
lea eax, [ebp - 0x164]
push eax
call fcn.00417a3c
add esp, 0x14
mov dword [ebp - 0x164], 0
jmp 0x4205e5
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 2
jg 0x42061e
mov byte [ebp - 0xc5], 0
lea eax, [ebp - 0xc5]
push eax
push 0xaa1
push 0x7069
push 0x6829
push 0
push 0x4f25
push 0
call fcn.0041a6bf
add esp, 0x1c
jmp 0x4205d8
mov dword [ebp - 0x3bc], 0x6493
push 1
lea ecx, [ebp - 0xab4]
call fcn.00410610
mov dword [ebp - 0x2fc], 0
jmp 0x42064e
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 1
jge 0x420670
push dword [ebp - 0x2fc]
lea ecx, [ebp - 0xab4]
call fcn.004106b1
mov dword [eax], 0x1928c176
jmp 0x420641
push 0
lea ecx, [ebp - 0xab4]
call fcn.004106b1
and dword [eax], 0
jmp 0x4206a6
push 0
lea ecx, [ebp - 0xab4]
call fcn.004106b1
mov dword [ebp - 0x89c], eax
mov eax, dword [ebp - 0x89c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x89c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xab4]
call fcn.004106b1
cmp dword [eax], 0xffffffea
jl 0x4206ff
mov dword [ebp - 0xba0], 0
mov dword [ebp - 0xb30], 0x849f845d
cmp dword [ebp - 0xba0], 0
je 0x4206d7
jmp 0x4206ff
lea eax, [ebp - 0xb30]
push eax
push 0x7c2b
push 0x8e6
push 1
push 1
push 0
lea eax, [ebp - 0xab4]
push eax
call fcn.0041c706
add esp, 0x1c
jmp 0x420682
lea ecx, [ebp - 0xab4]
call fcn.004106ac
mov dword [ebp - 0xb50], 0xffffffff
mov dword [ebp - 0xbc8], 0x1ba1
mov dword [ebp - 0x1c], 0x24ec2e0c
mov dword [ebp - 0x264], 0x4c7af5af
mov dword [ebp - 0x304], 0
jmp 0x420748
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 2
jge 0x420764
mov eax, dword [ebp - 0x304]
mov dword [ebp + eax*4 - 0x428], 1
jmp 0x42073b
mov dword [ebp - 0x1c], 0xb
jmp 0x420774
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff5
jle 0x4207b9
mov byte [ebp - 0xc9], 0
push 0x3207
lea eax, [ebp - 0xc9]
push eax
push 0
push 0x4b79
push 0x5fcc
push 0x3d2d
push 0
push 0x6f72
push 0x6d17
push 0x907
call fcn.0041b3b1
add esp, 0x28
jmp 0x42076d
mov dword [ebp - 0x1c], 0
jmp 0x4207c9
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jg 0x420b49
push 3
lea ecx, [ebp - 0xa78]
call fcn.00410610
mov dword [ebp - 0xba8], 0x4d14b718
mov dword [ebp - 0x25c], 0
jmp 0x420803
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 3
jge 0x420825
push dword [ebp - 0x25c]
lea ecx, [ebp - 0xa78]
call fcn.004106b1
mov dword [eax], 3
jmp 0x4207f6
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x428]
add eax, 0x16db
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x428]
imul eax, dword [ebp - 0x264]
test eax, eax
je 0x420b12
mov dword [ebp - 0x268], 0xffff
mov dword [ebp - 0x6ec], 1
push 3
lea ecx, [ebp - 0xee4]
call fcn.00410610
push 0
lea eax, [ebp - 0x15c]
push eax
push 0x68fa
push 0x74ef
push 0x6079
push 0x4974
lea eax, [ebp - 0xee4]
push eax
push 0
push 0x7859
push 0x31d9
push 0x1c71
push 0x5a8a
push 1
call fcn.004177e3
add esp, 0x34
mov dword [ebp - 0x15c], 0
jmp 0x4208d1
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 3
jge 0x4208ed
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x13a4], 0xc65a
jmp 0x4208c4
cmp dword [ebp - 0x268], 0
jne 0x4209ac
mov eax, dword [ebp - 0x1c]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x428]
cmp dword [ebp + eax*4 - 0x428], ecx
je 0x42091f
push 2
lea ecx, [ebp - 0xa78]
call fcn.004106b1
mov ecx, dword [ebp - 0x268]
cmp dword [eax], ecx
jl 0x4209cf
push 0x537d
push 0x5d0e
push 0x945
push 1
push 1
push 0
push 0x4bce
push 0x5b71
call fcn.00416991
add esp, 0x20
lea ecx, [ebp - 0xa78]
call fcn.004106ac
jmp 0x4207c2
push 2
lea ecx, [ebp - 0x1254]
call fcn.00410610
mov dword [ebp - 0x2f8], 0xdb3ae355
mov dword [ebp - 0x2f8], 0
jmp 0x420b79
mov eax, dword [ebp - 0x2f8]
dec eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0xfffffff6
je 0x420c09
mov dword [ebp - 0xb38], 0x9ea
mov dword [ebp - 0xbb0], 0xffffffff
push 0x37f2
push 0x898
lea eax, [ebp - 0xb38]
push eax
push 0x4761
push 0
lea eax, [ebp - 0xbb0]
push eax
push 1
call fcn.0041a6bf
add esp, 0x1c
mov byte [ebp - 0xc7], 0
movzx eax, byte [ebp - 0xc7]
test eax, eax
je 0x420c04
push 0x19b2
push 0x3451
push 0x26b3
push 0x1f35
push 1
push 0x1d96
push 0x6c25
push 0x3755
push 1
call fcn.00416551
add esp, 0x24
jmp 0x420b6c
lea eax, [ebp - 0x1308]
push eax
lea eax, [ebp - 0x1254]
push eax
push 0x7990
push 1
push 1
push 1
push 0x3fd2
push 0x5f96
call fcn.00416991
add esp, 0x20
push 1
lea ecx, [ebp - 0xf2c]
call fcn.00410610
mov dword [ebp - 0x270], 0
jmp 0x420c5a
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 1
jge 0x420c7c
push dword [ebp - 0x270]
lea ecx, [ebp - 0xf2c]
call fcn.004106b1
mov dword [eax], 0x1928c176
jmp 0x420c4d
push 0x74ed
push 1
push 0x6b40
lea eax, [ebp - 0xf2c]
push eax
push 1
push 0x6dc6
push 0x1fd4
push 0x5a0
call fcn.00416ade
add esp, 0x20
lea ecx, [ebp - 0xf2c]
call fcn.004106ac
cmp dword [ebp - 0xb40], 0
je 0x420cda
push 0
lea ecx, [ebp - 0xd1c]
call fcn.004106b1
cmp dword [eax], 0
je 0x420cda
mov dword [ebp - 0x8b4], 1
jmp 0x420ce1
and dword [ebp - 0x8b4], 0
push 0
lea ecx, [ebp - 0xd1c]
call fcn.004106b1
mov eax, dword [eax]
cmp eax, dword [ebp - 0x8b4]
jl 0x420d04
mov dword [ebp - 0x988], 1
jmp 0x420d0b
and dword [ebp - 0x988], 0
push 0
lea ecx, [ebp - 0xd1c]
call fcn.004106b1
mov eax, dword [eax]
mov dword [ebp - 0x71c], eax
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0xbb8], eax
mov eax, dword [ebp - 0x71c]
sub eax, dword [ebp - 0x988]
mov dword [ebp - 0xb48], eax
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp - 0xbb8]
cmp eax, dword [ebp - 0xb48]
jl 0x420d65
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xc54], 0
mov dword [ebp - 0x248], 0
jmp 0x4252ec
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 3
jge 0x425308
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0x1d0], 0xfffffff7
jmp 0x4252df
mov dword [ebp - 4], 2
jmp 0x425318
mov eax, dword [ebp - 4]
dec eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x425611
mov dword [ebp - 0x3dc], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1d0], 0
jne 0x425347
mov dword [ebp - 0x8b8], 1
jmp 0x42534e
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x1d0]
cmp dword [ebp - 4], eax
je 0x425369
mov dword [ebp - 0x8a8], 1
jmp 0x425370
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x1d0]
cmp dword [ebp - 0x8a8], eax
je 0x42538e
mov dword [ebp - 0x8b0], 1
jmp 0x425395
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x8b0]
sub eax, 9
cmp eax, dword [ebp - 4]
je 0x4253af
mov dword [ebp - 0x8c0], 1
jmp 0x4253b6
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x8b8]
imul eax, dword [ebp - 0x8c0]
add eax, 0xecaf
cmp eax, 0xfffffffc
jbe 0x4253d9
mov dword [ebp - 0x8c8], 1
jmp 0x4253e0
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x1d0]
cmp dword [ebp - 0x8c8], eax
je 0x4253fe
mov dword [ebp - 0x8d0], 1
jmp 0x425405
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x1d0]
cmp dword [ebp - 0x8d0], eax
jl 0x425423
mov dword [ebp - 0x8d8], 1
jmp 0x42542a
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x8d8], eax
jle 0x42544a
mov eax, 0x8502
test eax, eax
je 0x42544a
mov dword [ebp - 0x8e0], 1
jmp 0x425451
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x1d0]
cmp dword [ebp - 0x8e0], eax
jg 0x42546f
mov dword [ebp - 0x8e8], 1
jmp 0x425476
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x1d0]
cmp eax, dword [ebp - 0x8e8]
jl 0x42549e
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x1d0], 0
jne 0x42549e
and dword [ebp - 0x8f0], 0
jmp 0x4254a8
mov dword [ebp - 0x8f0], 1
mov eax, dword [ebp - 0x8f0]
mov dword [ebp - 0xc54], eax
mov eax, dword [ebp - 4]
imul eax, dword [ebp + eax*4 - 0x1d0], 0x8123
cmp dword [ebp - 4], eax
jge 0x4254d3
mov dword [ebp - 0x8f8], 1
jmp 0x4254da
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x8f8]
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 1
jl 0x4254fb
mov dword [ebp - 0x900], 1
jmp 0x425502
and dword [ebp - 0x900], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1d0]
cmp eax, dword [ebp - 0x900]
jg 0x425522
mov dword [ebp - 0x908], 1
jmp 0x425529
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x1d0]
cmp eax, dword [ebp - 0x908]
jg 0x425547
mov dword [ebp - 0x910], 1
jmp 0x42554e
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x1d0]
cmp dword [ebp - 0x910], eax
jle 0x42556c
mov dword [ebp - 0x918], 1
jmp 0x425573
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x1d0]
cmp dword [ebp - 0x918], eax
jl 0x425591
mov dword [ebp - 0x920], 1
jmp 0x425598
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x1d0]
cmp dword [ebp - 0x920], eax
jle 0x4255c0
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x1d0], 0
jne 0x4255c0
and dword [ebp - 0x928], 0
jmp 0x4255ca
mov dword [ebp - 0x928], 1
mov eax, dword [ebp - 0x928]
sub eax, 0xf11c
je 0x4255e4
cmp dword [ebp - 0x3dc], 0
je 0x4255e2
jmp 0x425611
jmp 0x42560c
mov byte [ebp - 0xbc], 0
movzx eax, byte [ebp - 0xbc]
test eax, eax
je 0x42560c
push 0xd5f
push 1
push 1
push 0x43a9
call fcn.0041b7fe
add esp, 0x10
jmp 0x425311
mov byte [ebp - 0xbe], 0
movzx eax, byte [ebp - 0xbe]
test eax, eax
je 0x42563b
push 0x261
push 1
push 1
push 1
push 0x3662
call fcn.0041b873
add esp, 0x14
movzx eax, byte [ebp - 0x11]
test eax, eax
jne 0x425843
mov dword [ebp - 0x1c4], 0xe1757117
push 2
lea ecx, [ebp - 0xf14]
call fcn.00410610
mov dword [ebp - 0x129c], 0xbff1eb7e
push 0xa42
push 0x4082
lea eax, [ebp - 0x1170]
push eax
push 0x7885
push 0x518a
lea eax, [ebp - 0xf14]
push eax
push 0x2930
push 1
push 0x52ad
push 1
push 0x27b0
push 0x42d1
push 1
push 0x17cc
call fcn.0041be0a
add esp, 0x38
mov dword [ebp - 0x1c4], 0
jmp 0x4256ca
mov eax, dword [ebp - 0x1c4]
dec eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0xfffffff8
jge 0x42582e
push 3
lea ecx, [ebp - 0xa84]
call fcn.00410610
mov dword [ebp - 0xac8], 1
mov dword [ebp - 0x250], 0
jmp 0x425707
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 3
jge 0x425729
push dword [ebp - 0x250]
lea ecx, [ebp - 0xa84]
call fcn.004106b1
mov dword [eax], 0xe1e2c0d3
jmp 0x4256fa
push 0
lea ecx, [ebp - 0xa84]
call fcn.004106b1
and dword [eax], 0
jmp 0x42575f
push 0
lea ecx, [ebp - 0xa84]
call fcn.004106b1
mov dword [ebp - 0x930], eax
mov eax, dword [ebp - 0x930]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x930]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa84]
call fcn.004106b1
cmp dword [eax], 1
jg 0x4257fa
mov dword [ebp - 0x1b8], 0xfffffffa
mov dword [ebp - 0x1b8], 1
jmp 0x425798
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0
jl 0x4257f5
mov dword [ebp - 0xc8c], 0
lea eax, [ebp - 0x1c4]
push eax
push 0x69bf
push 1
lea eax, [ebp - 0x1b8]
push eax
push 0x65a3
lea eax, [ebp - 0xa84]
push eax
push 0x36b4
push 0x219
lea eax, [ebp - 0xf14]
push eax
lea eax, [ebp - 0xc8c]
push eax
push 1
push 0x2d37
call fcn.0041c27a
add esp, 0x30
jmp 0x42578b
jmp 0x42573b
push 0x3910
lea eax, [ebp - 0xac8]
push eax
push 0x2e1c
push 1
push 1
push 0x52b0
push 1
call fcn.0041c4b0
add esp, 0x1c
lea ecx, [ebp - 0xa84]
call fcn.004106ac
jmp 0x4256bd
lea ecx, [ebp - 0xf14]
call fcn.004106ac
jmp 0x425a3f
mov dword [ebp - 0x938], 0x1d925b0e
push 1
lea ecx, [ebp - 0xe24]
call fcn.00410610
mov dword [ebp - 0xa0], 0
jmp 0x425873
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x42588f
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x101c], 1
jmp 0x425866
mov dword [ebp - 0xa0], 0
jmp 0x4258a8
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x4258ca
push dword [ebp - 0xa0]
lea ecx, [ebp - 0xe24]
call fcn.004106b1
mov dword [eax], 0xfffffff9
jmp 0x42589b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x101c]
mov dword [ebp - 0x938], eax
mov esi, dword [ebp - 0x938]
push 0
lea ecx, [ebp - 0xe24]
call fcn.004106b1
mov dword [eax], esi
push 0x695a
push 0x4257
lea eax, [ebp - 0xe24]
push eax
push 0x7fd0
push 1
push 1
call fcn.0041c64e
add esp, 0x18
lea ecx, [ebp - 0xe24]
call fcn.004106ac
push 1
lea eax, [ebp - 0x1440]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.0040e976
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x138c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x138c]
lea edi, [ebp - 0xddc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0xddc], 0
je 0x42596b
push 0
push dword [ebp - 0xdd4]
push dword [ebp - 0xdd8]
call dword [ebp - 0xddc]
jmp 0x4259b4
mov eax, dword [ebp - 0xacc]
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0xad4]
mov dword [ebp - 0xae4], eax
mov eax, dword [ebp - 0xadc]
mov dword [ebp - 0xaf4], eax
mov eax, dword [ebp - 0xae4]
mov dword [ebp - 0xaec], eax
push 0
mov ecx, dword [ebp - 0xaec]
call fcn.004106b1
mov ecx, dword [ebp - 0xaf4]
mov eax, dword [eax]
mov dword [ecx], eax
jmp 0x425a3f
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xb04], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xb1c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0xafc]
movzx eax, byte [eax]
test eax, eax
je 0x425a12
mov eax, dword [ebp - 0xb04]
mov dword [ebp - 0xb0c], eax
mov eax, dword [ebp - 0xb0c]
mov dword [ebp - 0xb14], eax
mov eax, dword [ebp - 0xb14]
movzx eax, byte [eax]
test eax, eax
je 0x425a10
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
jmp 0x425a3f
mov eax, dword [ebp - 0xb1c]
mov dword [ebp - 0xb24], eax
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0xb2c], eax
mov eax, dword [ebp - 0xb2c]
movzx eax, byte [eax]
test eax, eax
je 0x425a3f
push 0
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
pop esi
mov esp, ebp
pop ebp
ret