Function at 0x10049dc2
Capabilities:
Contain obfuscated stackstrings
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10072767
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5a8
push esi
and dword [ebp - 0x278], 0
mov dword [ebp - 0x50], 0xfffffffc
mov dword [ebp - 0x2f8], 0xf0415773
mov dword [ebp - 0x88], 0
jmp 0x10049e12
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x10049e2b
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x44], 0xfb6f65e7
jmp 0x10049e05
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
mov dword [ebp - 0x498], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x44]
cmp dword [ebp + eax - 0x44], ecx
jg 0x10049e5d
mov dword [ebp - 0x1b0], 1
jmp 0x10049e64
and dword [ebp - 0x1b0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
cmp eax, dword [ebp - 0x1b0]
jl 0x10049e82
mov dword [ebp - 0x2a0], 1
jmp 0x10049e89
and dword [ebp - 0x2a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
cmp dword [ebp - 0x2a0], eax
jl 0x10049ea7
mov dword [ebp - 0x12c], 1
jmp 0x10049eae
and dword [ebp - 0x12c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x12c]
mov dword [ebp + eax - 0x44], ecx
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x12c]
test eax, eax
jne 0x10049ee2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x44], 0
jne 0x10049ee2
and dword [ebp - 0x2f4], 0
jmp 0x10049eec
mov dword [ebp - 0x2f4], 1
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x468], eax
cmp dword [ebp - 0x50], 2
ja 0x10049f10
mov dword [ebp - 0x2bc], 1
jmp 0x10049f17
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x2bc], eax
jge 0x10049f2e
mov dword [ebp - 0x2b0], 1
jmp 0x10049f35
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x2f8], eax
mov byte [ebp - 0x3b], 0
movzx eax, byte [ebp - 0x3b]
test eax, eax
je 0x10049f5a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x24], 0x77e8edf1
mov dword [ebp - 0x3bc], 6
mov dword [ebp - 0x3b8], 6
mov dword [ebp - 0x3b4], 6
mov dword [ebp - 0x3b0], 6
lea ecx, [ebp - 0x15d]
call fcn.10009bd3
push eax
lea eax, [ebp - 0x3ac]
push eax
lea eax, [ebp - 0x3bc]
push eax
lea ecx, [ebp - 0x504]
call fcn.10009bd6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x394]
call fcn.10009b36
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0
je 0x1004a020
cmp dword [ebp - 0x24], 0
je 0x10049fe1
mov byte [ebp - 0x3d], 0
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x10049fdf
call fcn.10049c96
jmp 0x1004a00d
mov dword [ebp - 0x24], 0
jmp 0x10049ff1
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1004a00d
push dword [ebp - 0x24]
lea ecx, [ebp - 0x394]
call fcn.10009b6a
mov dword [eax], 0xe1e2
jmp 0x10049fea
mov byte [ebp - 0x3e], 0
movzx eax, byte [ebp - 0x3e]
test eax, eax
je 0x1004a01e
call fcn.10049cb4
jmp 0x1004a08b
mov dword [ebp - 0x300], 0x9989d221
mov dword [ebp - 0x24], 0x14
jmp 0x1004a03a
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xa
jne 0x1004a076
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x64], 0
jmp 0x1004a057
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jg 0x1004a074
push dword [ebp - 0x64]
lea ecx, [ebp - 0x394]
call fcn.10009b6a
cmp dword [eax], 0
je 0x1004a072
jmp 0x1004a074
jmp 0x1004a050
jmp 0x1004a033
push 2
lea ecx, [ebp - 0x394]
call fcn.10009b6a
mov eax, dword [eax]
mov dword [ebp - 0x300], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x394]
call fcn.10009b5c
mov byte [ebp - 0x10c], 4
mov byte [ebp - 0x10b], 0xe5
mov byte [ebp - 0x10a], 0xf
mov byte [ebp - 0x109], 0x15
mov byte [ebp - 0x108], 9
mov byte [ebp - 0x107], 0x1a
mov byte [ebp - 0x106], 0x19
mov byte [ebp - 0x105], 0x10
mov byte [ebp - 0x104], 0x14
mov byte [ebp - 0x103], 0xf
mov byte [ebp - 0x102], 0xe
mov byte [ebp - 0x101], 0x14
mov byte [ebp - 0x100], 0xf0
mov byte [ebp - 0xff], 0x81
mov byte [ebp - 0xfe], 0xdb
mov byte [ebp - 0xfd], 0x6d
mov byte [ebp - 0xfc], 0x49
mov byte [ebp - 0xfb], 0x71
mov byte [ebp - 0xfa], 0xc4
mov byte [ebp - 0xf9], 0xa7
mov byte [ebp - 0xf8], 0xf6
mov byte [ebp - 0xf7], 0xb6
mov byte [ebp - 0xf6], 0x62
mov byte [ebp - 0xf5], 0xfc
mov byte [ebp - 0xf4], 0xf1
mov byte [ebp - 0xf3], 5
mov byte [ebp - 0xf2], 0x13
mov byte [ebp - 0xf1], 0x15
mov byte [ebp - 0xf0], 0x10
mov byte [ebp - 0xef], 0x13
mov byte [ebp - 0xee], 2
mov byte [ebp - 0xed], 0x10
mov byte [ebp - 0xec], 5
mov byte [ebp - 0xeb], 0x18
mov byte [ebp - 0xea], 8
mov byte [ebp - 0xe9], 0x17
mov byte [ebp - 0xe8], 1
mov byte [ebp - 0xe7], 0
mov byte [ebp - 0xe6], 0x19
mov byte [ebp - 0xe5], 3
mov byte [ebp - 0xe4], 5
mov byte [ebp - 0xe3], 6
mov byte [ebp - 0xe2], 3
mov byte [ebp - 0xe1], 2
mov byte [ebp - 0xe0], 4
mov byte [ebp - 0xdf], 0x11
mov byte [ebp - 0xde], 0x11
mov byte [ebp - 0xdd], 0xe
mov byte [ebp - 0xdc], 0x1d
mov byte [ebp - 0xdb], 0x12
mov byte [ebp - 0xda], 0x1c
mov byte [ebp - 0xd9], 1
mov byte [ebp - 0xd8], 0x11
mov byte [ebp - 0xd7], 0xc
mov byte [ebp - 0xd6], 0xf
mov byte [ebp - 0xd5], 0xa
mov byte [ebp - 0xd4], 6
mov byte [ebp - 0xd3], 0xd
mov byte [ebp - 0xd2], 5
mov byte [ebp - 0xd1], 7
mov byte [ebp - 0xd0], 6
mov byte [ebp - 0xcf], 0x16
mov byte [ebp - 0xce], 0x1f
mov byte [ebp - 0xcd], 0xb
mov byte [ebp - 0xcc], 0x1b
mov byte [ebp - 0xcb], 8
mov byte [ebp - 0xca], 5
mov dword [ebp - 0x1c], 0x4768
mov dword [ebp - 0x34c], 0
mov dword [ebp - 0x9c], 0
jmp 0x1004a299
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x1004a2b5
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x118], 0
jmp 0x1004a28c
mov byte [ebp - 0x39], 0
movzx eax, byte [ebp - 0x39]
test eax, eax
je 0x1004a2c6
call fcn.1000fbfc
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x464], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x46c], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x118]
cmp dword [ebp + eax - 0x118], ecx
jl 0x1004a30f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x118], 0
je 0x1004a30f
mov dword [ebp - 0x224], 1
jmp 0x1004a316
and dword [ebp - 0x224], 0
cmp dword [ebp - 0x224], 0xebf9
jl 0x1004a32e
mov dword [ebp - 0x340], 1
jmp 0x1004a335
and dword [ebp - 0x340], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x118]
cmp dword [ebp + eax - 0x118], ecx
jg 0x1004a35d
mov dword [ebp - 0x348], 1
jmp 0x1004a364
and dword [ebp - 0x348], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x118]
mov dword [ebp - 0x470], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x118]
mov dword [ebp - 0x4b4], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x118]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jge 0x1004a3b0
mov dword [ebp - 0x350], 1
jmp 0x1004a3b7
and dword [ebp - 0x350], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x118]
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x484], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x118]
mov dword [ebp - 0x440], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x118]
sub eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
je 0x1004a4f9
push 3
lea ecx, [ebp - 0x3e8]
call fcn.10009afa
mov dword [ebp - 4], 1
mov dword [ebp - 0x7c], 0
jmp 0x1004a423
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1004a43f
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x3e8]
call fcn.10009b6a
mov dword [eax], 0xb0d5
jmp 0x1004a41c
mov dword [ebp - 0x1c], 8
jmp 0x1004a44f
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x17
jne 0x1004a4e5
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x34], 2
jmp 0x1004a47a
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1004a493
mov byte [ebp - 0x3a], 0
movzx eax, byte [ebp - 0x3a]
test eax, eax
je 0x1004a491
call fcn.1000fc1a
jmp 0x1004a473
mov dword [ebp - 0x34], 0
jmp 0x1004a4a3
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jg 0x1004a4e0
mov byte [ebp - 0x3c], 0
movzx eax, byte [ebp - 0x3c]
test eax, eax
je 0x1004a4ba
call fcn.10049cc3
push 1
lea ecx, [ebp - 0x3e8]
call fcn.10009b6a
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x280]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x280]
mov dword [ecx], eax
jmp 0x1004a49c
jmp 0x1004a448
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3e8]
call fcn.10009b5c
jmp 0x1004a6bb
mov dword [ebp - 0x168], 0xfffffff7
mov dword [ebp - 0x6c], 0x7f668cde
mov dword [ebp - 0x90], 0
jmp 0x1004a523
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x1004a53f
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x4c4], 7
jmp 0x1004a516
mov dword [ebp - 0x1c], 0
jmp 0x1004a54f
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x39
jl 0x1004a6bb
mov dword [ebp - 0x5c], 0x3e8af804
call fcn.10049cd7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x118], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x168], eax
jle 0x1004a58a
mov dword [ebp - 0x18c], 1
jmp 0x1004a591
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x18c], eax
jg 0x1004a5a8
mov dword [ebp - 0x274], 1
jmp 0x1004a5af
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x274], eax
je 0x1004a5c9
mov dword [ebp - 0x388], 1
jmp 0x1004a5d0
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x450], eax
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], eax
jle 0x1004a5f2
xor eax, eax
inc eax
je 0x1004a5f2
mov dword [ebp - 0x194], 1
jmp 0x1004a5f9
and dword [ebp - 0x194], 0
mov eax, dword [ebp - 0x194]
sub eax, dword [ebp - 0x6c]
cmp eax, 1
jne 0x1004a613
mov dword [ebp - 0x22c], 1
jmp 0x1004a61a
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x22c], eax
je 0x1004a634
mov dword [ebp - 0x37c], 1
jmp 0x1004a63b
and dword [ebp - 0x37c], 0
imul eax, dword [ebp - 0x6c], 0x91c6
cmp eax, dword [ebp - 0x6c]
jg 0x1004a653
mov dword [ebp - 0x19c], 1
jmp 0x1004a65a
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x2a4], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp + eax - 0x4c4], ecx
cmp dword [ebp - 0x2a4], 0
jne 0x1004a6a0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x118], 0
jne 0x1004a6a0
and dword [ebp - 0x1a4], 0
jmp 0x1004a6aa
mov dword [ebp - 0x1a4], 1
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x34c], eax
jmp 0x1004a548
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x10c]
or eax, 0x80
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x10c]
and ecx, 0x80
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x10c]
mov byte [ebp + ecx - 0x420], al
mov dword [ebp - 0x4c], 0xc184c506
mov dword [ebp - 0x94], 0
jmp 0x1004a719
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jge 0x1004a735
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x3a8], 0xb57f
jmp 0x1004a70c
mov dword [ebp - 0x4c], 0
jmp 0x1004a745
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jg 0x1004a863
mov dword [ebp - 0x314], 0x1626
cmp dword [ebp - 0x314], 0x1301
jge 0x1004a84a
lea ecx, [ebp - 0x438]
call fcn.100097ac
mov dword [ebp - 4], 2
lea edx, [ebp - 0x438]
mov ecx, 0x10663c70
call fcn.10041625
push 0x20
lea ecx, [ebp - 0x438]
call fcn.1000b1e8
and dword [ebp - 0x98], 0
and dword [ebp - 0x54], 0
jmp 0x1004a7ac
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
lea ecx, [ebp - 0x438]
call fcn.10009e39
cmp dword [ebp - 0x54], eax
jae 0x1004a820
push dword [ebp - 0x54]
lea ecx, [ebp - 0x438]
call fcn.1000b3cf
movsx esi, byte [eax]
mov eax, dword [ebp - 0x54]
inc eax
push eax
lea ecx, [ebp - 0x438]
call fcn.1000b3cf
movsx eax, byte [eax]
cmp esi, eax
jne 0x1004a7f3
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
jmp 0x1004a7fa
and dword [ebp - 0x98], 0
cmp dword [ebp - 0x98], 6
jl 0x1004a81e
push fcn.1000d301
mov edx, 0x10007824
mov ecx, 0x10663bb8
call fcn.1000d12a
mov ecx, eax
call fcn.100099cf
jmp 0x1004a7a5
push fcn.1000d301
mov edx, 0x10007828
mov ecx, 0x10663bb8
call fcn.1000d12a
mov ecx, eax
call fcn.100099cf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x438]
call fcn.100097ec
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x3a8]
mov dword [ebp + ecx*4 - 0x3a8], eax
jmp 0x1004a73e
mov dword [ebp - 0x20], 2
and dword [ebp - 0x60], 0
jmp 0x1004a878
mov eax, dword [ebp - 0x20]
inc eax
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x43
jae 0x1004b148
mov dword [ebp - 0x14], 0x6fe7d8a8
push 1
lea ecx, [ebp - 0x3a0]
call fcn.10009afa
mov dword [ebp - 4], 3
mov dword [ebp - 0x458], 0x596def04
mov dword [ebp - 0x30], 0
jmp 0x1004a8b7
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x1004a8cd
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x128], 0x540d
jmp 0x1004a8b0
mov dword [ebp - 0x30], 0
jmp 0x1004a8dd
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1004a8f9
push dword [ebp - 0x30]
lea ecx, [ebp - 0x3a0]
call fcn.10009b6a
mov dword [eax], 0xa58de38
jmp 0x1004a8d6
mov dword [ebp - 0x14], 0
jmp 0x1004a909
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x1004aeae
mov dword [ebp - 0x18], 0x5b3b9da4
mov dword [ebp - 0x48], 0x33c8a0c0
mov dword [ebp - 0x154], 0x61e9426
mov dword [ebp - 0x304], 0xbeba
mov dword [ebp - 0x18], 3
jmp 0x1004a945
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1004ae92
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x74], 0xe4c12f69
mov dword [ebp - 0x2c], 0
jmp 0x1004a96d
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1004a983
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x30c], 5
jmp 0x1004a966
mov dword [ebp - 0x2c], 0
jmp 0x1004a993
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1004a9a9
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x478], 0xdb4546b7
jmp 0x1004a98c
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x128]
mov dword [ebp + ecx*4 - 0x128], eax
mov dword [ebp - 0x38], 3
jmp 0x1004a9cd
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1004ae8d
mov dword [ebp - 0x2f0], 1
mov dword [ebp - 0x320], 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x128]
mov dword [ebp + ecx*4 - 0x128], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x128]
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x480], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x14]
cmp dword [ebp + eax - 0x128], ecx
jle 0x1004aa36
mov dword [ebp - 0x234], 1
jmp 0x1004aa3d
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x234]
sub ecx, dword [ebp + eax*4 - 0x128]
cmp ecx, dword [ebp - 0x18]
jl 0x1004aa5e
mov dword [ebp - 0x1ac], 1
jmp 0x1004aa65
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x128]
cmp dword [ebp - 0x1ac], eax
jle 0x1004aa96
cmp dword [ebp - 0x2f0], 0
jne 0x1004aa96
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x128], 0
jne 0x1004aa96
and dword [ebp - 0x2e8], 0
jmp 0x1004aaa0
mov dword [ebp - 0x2e8], 1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x488], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x38], eax
jl 0x1004aabd
mov dword [ebp - 0x27c], 1
jmp 0x1004aac4
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x128]
cmp eax, dword [ebp - 0x27c]
jg 0x1004aae2
mov dword [ebp - 0x318], 1
jmp 0x1004aae9
and dword [ebp - 0x318], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x128]
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x128]
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x14], eax
jl 0x1004ab29
mov dword [ebp - 0x134], 1
jmp 0x1004ab30
and dword [ebp - 0x134], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x134]
mov dword [ebp + eax - 0x30c], ecx
mov eax, dword [ebp - 0x134]
sub eax, dword [ebp - 0x14]
cmp eax, 0xfffffff9
jne 0x1004ab5d
mov dword [ebp - 0x1b4], 1
jmp 0x1004ab64
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
imul eax, dword [ebp - 0x38]
test eax, eax
jne 0x1004ab8e
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x128], 0
jne 0x1004ab8e
and dword [ebp - 0x23c], 0
jmp 0x1004ab98
mov dword [ebp - 0x23c], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x23c], eax
jg 0x1004abb9
cmp dword [ebp - 0x14], 0
je 0x1004abb9
xor eax, eax
je 0x1004abb9
mov dword [ebp - 0x2fc], 1
jmp 0x1004abc0
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4a8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30c], 0
je 0x1004acd8
mov dword [ebp - 0x48], 0x14
jmp 0x1004abed
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x13
jne 0x1004acd3
mov eax, 0xffff6d05
test eax, eax
je 0x1004ac1c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x30c], 0
je 0x1004ac1c
mov dword [ebp - 0x2a8], 1
jmp 0x1004ac23
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xb39
jg 0x1004ac44
mov dword [ebp - 0x1bc], 1
jmp 0x1004ac4b
and dword [ebp - 0x1bc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x128]
add eax, dword [ebp - 0x1bc]
cmp dword [ebp - 0x2a8], eax
jne 0x1004ac72
mov dword [ebp - 0x1c4], 1
jmp 0x1004ac79
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x74], eax
jle 0x1004ac9c
cmp dword [ebp - 0x14], 0
je 0x1004ac9c
mov dword [ebp - 0x244], 1
jmp 0x1004aca3
and dword [ebp - 0x244], 0
cmp dword [ebp - 0x244], 0x7d38
jg 0x1004acbb
mov dword [ebp - 0x1cc], 1
jmp 0x1004acc2
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x320], eax
jmp 0x1004abe6
jmp 0x1004ae88
mov dword [ebp - 0xb4], 0
jmp 0x1004acf1
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x1004ad0d
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x13c], 1
jmp 0x1004ace4
cmp dword [ebp - 0x14], 0
je 0x1004ad2f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x13c], 0xfffffff8
je 0x1004ad2f
mov dword [ebp - 0x284], 1
jmp 0x1004ad36
and dword [ebp - 0x284], 0
cmp dword [ebp - 0x284], 0x153d
je 0x1004ad4e
mov dword [ebp - 0x1d4], 1
jmp 0x1004ad55
and dword [ebp - 0x1d4], 0
cmp dword [ebp - 0x1d4], 0
je 0x1004ad6a
mov dword [ebp - 0x24c], 1
jmp 0x1004ad71
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x24c]
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp eax, dword [ebp + ecx*4 - 0x128]
jge 0x1004ad92
mov dword [ebp - 0x1dc], 1
jmp 0x1004ad99
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x154]
cmp eax, dword [ebp - 0x1dc]
jle 0x1004adb3
mov dword [ebp - 0x2b4], 1
jmp 0x1004adba
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x2b4]
sub eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x304]
je 0x1004add7
mov dword [ebp - 0x328], 1
jmp 0x1004adde
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4b0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x478]
mov ecx, dword [ebp - 0x18]
sub eax, dword [ebp + ecx*4 - 0x128]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x13c]
cmp eax, 0xffffffff
jne 0x1004ae1c
mov dword [ebp - 0x1e4], 1
jmp 0x1004ae23
and dword [ebp - 0x1e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x13c]
cmp dword [ebp - 0x1e4], eax
jl 0x1004ae44
mov dword [ebp - 0x254], 1
jmp 0x1004ae4b
and dword [ebp - 0x254], 0
cmp dword [ebp - 0x254], 0x451c
jne 0x1004ae63
mov dword [ebp - 0x164], 1
jmp 0x1004ae6a
and dword [ebp - 0x164], 0
push 0
lea ecx, [ebp - 0x3a0]
call fcn.10009b6a
mov ecx, dword [ebp - 0x164]
mov dword [eax], ecx
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x74], eax
jmp 0x1004a9c6
jmp 0x1004a93e
push 0
lea ecx, [ebp - 0x3a0]
call fcn.10009b6a
cmp dword [eax], 0
je 0x1004aea9
jmp 0x1004a902
jmp 0x1004a902
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3a0]
call fcn.10009b5c
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x10c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x20], eax
jne 0x1004aefd
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x10c]
inc eax
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x10c]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x20], eax
jmp 0x1004a870
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x10b]
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x60]
movzx ecx, byte [ebp + ecx - 0x10e]
movsx ecx, byte [ebp + ecx - 0x420]
add eax, ecx
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0x10b]
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x60]
movzx edx, byte [ebp + edx - 0x10e]
movsx edx, byte [ebp + edx - 0x420]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0x10b]
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x60]
movzx edx, byte [ebp + edx - 0x10e]
movsx edx, byte [ebp + edx - 0x420]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0x10c]
mov byte [ebp + ecx - 0x420], al
mov dword [ebp - 0x58], 0xfffffffb
mov dword [ebp - 0x2ac], 0
push 2
lea ecx, [ebp - 0x2d8]
call fcn.10009afa
mov dword [ebp - 4], 4
mov dword [ebp - 0x330], 0xffffffff
mov dword [ebp - 0x4b8], 0xfffffff9
mov dword [ebp - 0xa4], 0
jmp 0x1004afce
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x1004afed
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x2d8]
call fcn.10009b6a
or dword [eax], 0xffffffff
jmp 0x1004afc1
mov dword [ebp - 0x58], 0x16
jmp 0x1004affd
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xffffffff
jg 0x1004b109
mov dword [ebp - 0xc4], 0xffab8c3a
mov dword [ebp - 0x310], 9
mov dword [ebp - 0x1ec], 0xb78acc4b
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x2d8]
push eax
call fcn.1001b09c
add esp, 0xc
cmp dword [ebp - 0x310], 3
je 0x1004b06c
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0
je 0x1004b06c
mov dword [ebp - 0x290], 1
jmp 0x1004b073
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0xc4]
add eax, dword [ebp - 0x290]
imul ecx, dword [ebp - 0xc4], 0x314a
cmp eax, ecx
jge 0x1004b0a2
mov eax, 0xc6d21cd4
test eax, eax
je 0x1004b0a2
mov dword [ebp - 0x1f4], 1
jmp 0x1004b0a9
and dword [ebp - 0x1f4], 0
push 0
lea ecx, [ebp - 0x2d8]
call fcn.10009b6a
mov ecx, dword [ebp - 0x1f4]
sub ecx, dword [eax]
jne 0x1004b0cc
mov dword [ebp - 0x25c], 1
jmp 0x1004b0d3
and dword [ebp - 0x25c], 0
cmp dword [ebp - 0x25c], 0
jg 0x1004b0e8
mov dword [ebp - 0x1fc], 1
jmp 0x1004b0ef
and dword [ebp - 0x1fc], 0
push 0
lea ecx, [ebp - 0x2d8]
call fcn.10009b6a
mov ecx, dword [ebp - 0x1fc]
mov dword [eax], ecx
jmp 0x1004aff6
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x2ac]
push eax
call fcn.1000fdf6
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d8]
call fcn.10009b5c
lea eax, [ebp - 0x60]
push eax
call fcn.10049d09
pop ecx
jmp 0x1004a870
xor eax, eax
inc eax
imul eax, eax, 0x1a
mov byte [ebp + eax - 0x420], 0
mov dword [ebp - 0x17c], 0x3b26bdde
mov dword [ebp - 0x178], 0x3b26bdde
mov dword [ebp - 0x174], 0x3b26bdde
mov dword [ebp - 0x170], 0x3b26bdde
mov dword [ebp - 0x21c], 8
mov dword [ebp - 0x2b8], 0xfffffffa
mov dword [ebp - 0xac], 0
jmp 0x1004b1ab
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 4
jge 0x1004b1c7
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x514], 0xfffffff9
jmp 0x1004b19e
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x17c], 0
jmp 0x1004b1f2
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x17c]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x17c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x17c], 0xffffffec
jl 0x1004b417
mov dword [ebp - 0x26c], 2
mov dword [ebp - 0x404], 0x15fb26c4
mov dword [ebp - 0x400], 0x15fb26c4
mov dword [ebp - 0x3fc], 0x15fb26c4
mov dword [ebp - 0x3f8], 0x15fb26c4
mov dword [ebp - 0xbc], 0
jmp 0x1004b250
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x1004b26c
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x28c], 0
jmp 0x1004b243
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x17c]
cmp dword [ebp + eax - 0x17c], ecx
je 0x1004b293
mov dword [ebp - 0x204], 1
jmp 0x1004b29a
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x204]
add eax, 5
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x17c]
jge 0x1004b2bd
mov dword [ebp - 0x264], 1
jmp 0x1004b2c4
and dword [ebp - 0x264], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28c]
cmp dword [ebp - 0x264], eax
jl 0x1004b2e5
mov dword [ebp - 0x20c], 1
jmp 0x1004b2ec
and dword [ebp - 0x20c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x17c]
cmp dword [ebp - 0x20c], eax
jge 0x1004b30c
mov dword [ebp - 0x29c], 1
jmp 0x1004b313
and dword [ebp - 0x29c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28c]
sub eax, dword [ebp - 0x29c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x28c]
jge 0x1004b341
mov dword [ebp - 0x214], 1
jmp 0x1004b348
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x21c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x21c]
sub ecx, dword [ebp + eax - 0x17c]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28c]
imul eax, ecx
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0xfffffffa
je 0x1004b39d
mov dword [ebp - 0x338], 1
jmp 0x1004b3a4
and dword [ebp - 0x338], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x17c]
mov dword [ebp - 0x31c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x31c]
mov dword [ebp + eax - 0x514], ecx
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x28c]
cmp dword [ebp + eax - 0x17c], ecx
jg 0x1004b3fe
call fcn.10049d1d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x404], 0
jmp 0x1004b412
mov dword [ebp - 0x378], 0x9192
mov dword [ebp - 0x378], 0
jmp 0x1004b1d9
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x4f4]
call fcn.10014a48
mov dword [ebp - 4], 5
and dword [ebp - 0x8c], 0
jmp 0x1004b446
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0x1b
jae 0x1004b45f
mov eax, dword [ebp - 0x8c]
mov byte [ebp + eax - 0x420], 0
jmp 0x1004b439
push 0x10007781
lea ecx, [ebp - 0x4dc]
call fcn.10014a48
mov byte [ebp - 4], 6
mov dword [ebp - 0x28], 3
mov dword [ebp - 0xc8], 0x58b39d20
push 1
lea ecx, [ebp - 0x370]
call fcn.10009afa
mov byte [ebp - 4], 7
push 3
lea ecx, [ebp - 0x360]
call fcn.10009afa
mov byte [ebp - 4], 8
push 1
lea ecx, [ebp - 0x2e4]
call fcn.10009afa
mov byte [ebp - 4], 9
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x148], 0x31b54653
mov dword [ebp - 0x260], 0xffffffff
mov dword [ebp - 0x494], 0x6d0a
mov dword [ebp - 0x78], 0x7fb90efd
mov dword [ebp - 0x10], 0
jmp 0x1004b4f6
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1004b50c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2cc], 2
jmp 0x1004b4ef
lea eax, [ebp - 0x370]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1000fb09
pop ecx
pop ecx
mov dword [ebp - 0x10], 0
jmp 0x1004b52e
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1004b54a
push dword [ebp - 0x10]
lea ecx, [ebp - 0x360]
call fcn.10009b6a
mov dword [eax], 0xac8e4c12
jmp 0x1004b527
mov dword [ebp - 0x10], 0
jmp 0x1004b55a
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1004b576
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2e4]
call fcn.10009b6a
mov dword [eax], 0xfffffff9
jmp 0x1004b553
mov dword [ebp - 0x10], 0
jmp 0x1004b586
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1004b59c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x298], 1
jmp 0x1004b57f
mov dword [ebp - 0x10], 0
jmp 0x1004b5ac
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1004b5c2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x444], 0
jmp 0x1004b5a5
mov dword [ebp - 0x28], 0
jmp 0x1004b5d2
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jl 0x1004bd25
mov dword [ebp - 0x1b8], 9
mov dword [ebp - 0x1f8], 0x68be135e
mov dword [ebp - 0x80], 0xffffffff
mov dword [ebp - 0x198], 0x60cbeb96
mov dword [ebp - 0x3d0], 0xfffffff7
mov dword [ebp - 0x3cc], 0xfffffff7
mov dword [ebp - 0x3c8], 0xfffffff7
mov dword [ebp - 0x3c4], 0xfffffff7
lea ecx, [ebp - 0x155]
call fcn.10009bd3
push eax
lea eax, [ebp - 0x3c0]
push eax
lea eax, [ebp - 0x3d0]
push eax
lea ecx, [ebp - 0x4fc]
call fcn.10009bd6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3dc]
call fcn.10009b36
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x364], 4
mov dword [ebp - 0x324], 0x1f27
cmp dword [ebp - 0x324], 0x673
jge 0x1004b845
mov dword [ebp - 0x4ac], 0x9d
mov byte [ebp - 0x5b4], 0
push 0x9c
push 0
lea eax, [ebp - 0x5b3]
push eax
call fcn.10058120
add esp, 0xc
and dword [ebp - 0xa8], 0
lea eax, [ebp - 0xa8]
push eax
push 0x10007814
call fcn.10057e4b
pop ecx
pop ecx
and dword [ebp - 0x68], 0
and dword [ebp - 0x70], 0
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x68]
push eax
push 0x100079b8
call fcn.10057e4b
add esp, 0xc
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xa0], eax
jmp 0x1004b6fc
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x70]
jge 0x1004b717
mov eax, dword [ebp - 0xa0]
mov byte [ebp + eax - 0x5b4], 1
jmp 0x1004b6ef
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
je 0x1004b7ed
and dword [ebp - 0x144], 0
and dword [ebp - 0x15c], 0
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x144]
push eax
push 0x100079b8
call fcn.10057e4b
add esp, 0xc
mov eax, dword [ebp - 0x144]
cmp eax, dword [ebp - 0x68]
jge 0x1004b769
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x184], eax
jmp 0x1004b775
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x15c]
jge 0x1004b797
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x188], eax
jmp 0x1004b7a3
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0xb0], eax
jmp 0x1004b7ca
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0x32c]
jge 0x1004b7e8
mov eax, dword [ebp - 0xb0]
mov byte [ebp + eax - 0x5b4], 0
jmp 0x1004b7bd
jmp 0x1004b717
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xb8], eax
jmp 0x1004b80c
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x70]
jge 0x1004b833
mov eax, dword [ebp - 0xb8]
movzx eax, byte [ebp + eax - 0x5b4]
add eax, dword [ebp - 0x14c]
mov dword [ebp - 0x14c], eax
jmp 0x1004b7ff
push dword [ebp - 0x14c]
push 0x1000781c
call fcn.10058066
pop ecx
pop ecx
mov dword [ebp - 0x2ec], 0xffffffff
mov dword [ebp - 0x380], 0x1928
cmp dword [ebp - 0x380], 0x1145
jge 0x1004b8f4
lea eax, [ebp - 0x334]
push eax
push 0x100078ec
call fcn.10057e4b
pop ecx
pop ecx
and dword [ebp - 0xc0], 0
jmp 0x1004b892
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0x334]
jge 0x1004b8e9
mov eax, dword [ebp - 0xc0]
and eax, 0x80000003
jns 0x1004b8b2
dec eax
or eax, 0xfffffffc
inc eax
inc eax
and eax, 0x80000003
jns 0x1004b8bf
dec eax
or eax, 0xfffffffc
inc eax
cmp eax, 1
jle 0x1004b8d0
mov dword [ebp - 0x190], 1
jmp 0x1004b8d7
and dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x190]
add eax, 0x61
push eax
call fcn.1005b005
pop ecx
jmp 0x1004b885
push 0x10007781
call fcn.10058226
pop ecx
cmp dword [ebp - 0x1b8], 0
jne 0x1004ba9c
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x198], 0xfffffff6
cmp dword [ebp - 0x198], 0
je 0x1004b980
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc8]
mov dword [ebp + eax - 0x2cc], ecx
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x28], eax
jne 0x1004b94b
mov dword [ebp - 0x1a0], 1
jmp 0x1004b952
and dword [ebp - 0x1a0], 0
push 0
lea ecx, [ebp - 0x370]
call fcn.10009b6a
or dword [eax], 0xffffffff
mov eax, dword [ebp - 0x1a0]
dec eax
je 0x1004b980
mov eax, 0x57a55752
test eax, eax
je 0x1004b980
mov dword [ebp - 0x1a8], 1
jmp 0x1004b987
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x1a8]
sub eax, 0xffff
cmp eax, dword [ebp - 0x80]
jne 0x1004b9a3
mov dword [ebp - 0x180], 1
jmp 0x1004b9aa
and dword [ebp - 0x180], 0
push 0
lea ecx, [ebp - 0x360]
call fcn.10009b6a
mov ecx, dword [ebp - 0x180]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x28]
jg 0x1004b9d0
mov dword [ebp - 0x1c0], 1
jmp 0x1004b9d7
and dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x1c0], eax
jne 0x1004ba01
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2cc], 0
je 0x1004ba01
mov dword [ebp - 0x16c], 1
jmp 0x1004ba08
and dword [ebp - 0x16c], 0
push 0
lea ecx, [ebp - 0x2e4]
call fcn.10009b6a
mov ecx, dword [ebp - 0x16c]
mov dword [eax], ecx
cmp dword [ebp - 0x16c], 0xd67a
jle 0x1004ba35
mov dword [ebp - 0x1c8], 1
jmp 0x1004ba3c
and dword [ebp - 0x1c8], 0
push 0
lea ecx, [ebp - 0x360]
call fcn.10009b6a
mov ecx, dword [ebp - 0x1c8]
cmp ecx, dword [eax]
jge 0x1004ba5f
mov dword [ebp - 0x1d0], 1
jmp 0x1004ba66
and dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x1f8]
cmp dword [ebp - 0x1d0], eax
jge 0x1004ba80
mov dword [ebp - 0x1d8], 1
jmp 0x1004ba87
and dword [ebp - 0x1d8], 0
cmp dword [ebp - 0x1d8], 0x776e9f81
jle 0x1004ba9c
and dword [ebp - 0x1e0], 0
jmp 0x1004baa6
mov dword [ebp - 0x1e0], 1
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x80], eax
push 0
lea ecx, [ebp - 0x3dc]
call fcn.10009b6a
cmp dword [eax], 0
je 0x1004bb1b
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2cc]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x80]
neg eax
cmp eax, dword [ebp - 0x148]
jg 0x1004bafa
mov dword [ebp - 0x1f0], 1
jmp 0x1004bb01
and dword [ebp - 0x1f0], 0
push 2
lea ecx, [ebp - 0x3dc]
call fcn.10009b6a
mov ecx, dword [ebp - 0x1f0]
mov dword [eax], ecx
jmp 0x1004bd11
mov dword [ebp - 0x200], 0x13735ca7
mov dword [ebp - 0x130], 0x9ce07b88
push 1
lea ecx, [ebp - 0x3f4]
call fcn.10009afa
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x84], 0
jmp 0x1004bb59
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1004bb7b
push dword [ebp - 0x84]
lea ecx, [ebp - 0x3f4]
call fcn.10009b6a
mov dword [eax], 0xfffffffb
jmp 0x1004bb4c
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x364], eax
jg 0x1004bb92
mov dword [ebp - 0x208], 1
jmp 0x1004bb99
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xfffffff6
jne 0x1004bbba
mov dword [ebp - 0x33c], 1
jmp 0x1004bbc1
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x384], eax
push 0
lea ecx, [ebp - 0x370]
call fcn.10009b6a
mov ecx, dword [ebp - 0x384]
mov dword [eax], ecx
cmp dword [ebp - 0x1f8], 0
je 0x1004bc00
cmp dword [ebp - 0x130], 0
je 0x1004bc00
mov dword [ebp - 0x344], 1
jmp 0x1004bc07
and dword [ebp - 0x344], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2cc]
mov dword [ebp - 0x44c], eax
mov eax, 0x2937
cmp eax, 1
jne 0x1004bc30
mov dword [ebp - 0x138], 1
jmp 0x1004bc37
and dword [ebp - 0x138], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x138]
mov dword [ebp + eax - 0x2cc], ecx
cmp dword [ebp - 0x138], 1
je 0x1004bc5e
mov dword [ebp - 0x374], 1
jmp 0x1004bc65
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x2ec]
sub eax, dword [ebp - 0x200]
mov dword [ebp - 0x140], eax
push 0
lea ecx, [ebp - 0x2e4]
call fcn.10009b6a
mov ecx, dword [ebp - 0x140]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x140]
mov dword [ebp + eax - 0x298], ecx
cmp dword [ebp - 0x140], 0xba43
jle 0x1004bcc3
mov dword [ebp - 0x210], 1
jmp 0x1004bcca
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x208]
neg eax
cmp eax, dword [ebp - 0x210]
jle 0x1004bce6
mov dword [ebp - 0x218], 1
jmp 0x1004bced
and dword [ebp - 0x218], 0
push 0
lea ecx, [ebp - 0x3f4]
call fcn.10009b6a
mov ecx, dword [ebp - 0x218]
mov dword [eax], ecx
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x3f4]
call fcn.10009b5c
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x3dc]
call fcn.10009b5c
jmp 0x1004b5cb
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x78]
inc ecx
mov dword [ebp - 0x78], ecx
test eax, eax
jne 0x1004bf13
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x220], eax
push 0
lea ecx, [ebp - 0x2e4]
call fcn.10009b6a
mov ecx, dword [ebp - 0x220]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x220]
mov dword [ebp + eax - 0x2cc], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x454], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x148]
cmp dword [ebp + eax - 0x2cc], ecx
jl 0x1004bd9e
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2cc], 0
jne 0x1004bd9e
and dword [ebp - 0x228], 0
jmp 0x1004bda8
mov dword [ebp - 0x228], 1
push 0
lea ecx, [ebp - 0x360]
call fcn.10009b6a
mov ecx, dword [ebp - 0x228]
cmp ecx, dword [eax]
jg 0x1004bdcb
mov dword [ebp - 0x230], 1
jmp 0x1004bdd2
and dword [ebp - 0x230], 0
cmp dword [ebp - 0x230], 0x9c241240
jbe 0x1004bdea
mov dword [ebp - 0x238], 1
jmp 0x1004bdf1
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x238], eax
jg 0x1004be08
mov dword [ebp - 0x240], 1
jmp 0x1004be0f
and dword [ebp - 0x240], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x298]
cmp dword [ebp - 0x240], eax
jg 0x1004be30
mov dword [ebp - 0x248], 1
jmp 0x1004be37
and dword [ebp - 0x248], 0
push 4
pop eax
imul eax, eax, 3
mov esi, dword [ebp + eax - 0x2cc]
push 0
lea ecx, [ebp - 0x2e4]
call fcn.10009b6a
mov eax, dword [eax]
sub eax, dword [ebp - 0x248]
cmp esi, eax
jne 0x1004be6f
mov eax, 0x47bed265
test eax, eax
jne 0x1004be6f
and dword [ebp - 0x250], 0
jmp 0x1004be79
mov dword [ebp - 0x250], 1
cmp dword [ebp - 0x250], 0xc1af
jg 0x1004be91
mov dword [ebp - 0x258], 1
jmp 0x1004be98
and dword [ebp - 0x258], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x298]
cmp dword [ebp - 0x258], eax
jge 0x1004beb9
mov dword [ebp - 0x150], 1
jmp 0x1004bec0
and dword [ebp - 0x150], 0
push 0
lea ecx, [ebp - 0x370]
call fcn.10009b6a
mov ecx, dword [ebp - 0x150]
mov dword [eax], ecx
mov eax, dword [ebp - 0x260]
cmp dword [ebp - 0x150], eax
jl 0x1004beef
mov dword [ebp - 0x268], 1
jmp 0x1004bef6
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x268], eax
je 0x1004bf13
mov eax, 0xd161
test eax, eax
jne 0x1004bf13
and dword [ebp - 0x270], 0
jmp 0x1004bf1d
mov dword [ebp - 0x270], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x298]
imul eax, dword [ebp - 0x270]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x298], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x2e4]
call fcn.10009b5c
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x360]
call fcn.10009b5c
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x370]
call fcn.10009b5c
lea eax, [ebp - 0x4f4]
push eax
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x4dc]
push eax
call fcn.10049d45
add esp, 0x10
lea eax, [ebp - 0x4dc]
push eax
mov ecx, dword [ebp + 8]
call fcn.1001c079
mov eax, dword [ebp - 0x278]
or eax, 1
mov dword [ebp - 0x278], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x4dc]
call fcn.10014a77
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4f4]
call fcn.10014a77
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret