Function at 0x475300
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea ecx, [esp + 4]
and esp, 0xffffffe0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x718
call fcn.0040acc0
mov byte [ebp - 0x6db], 0x30
mov dword [esp], 0xd8405dd1
call fcn.00401740
call eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [0x498280]
mov al, byte [ebp - 0x6db]
sub eax, 0x31
sub esp, 0xc
cmp al, 1
jbe 0x4754a1
lea ebx, [ebp - 0x6db]
mov dword [esp + 8], 0x38
mov dword [esp + 4], str.________P_a_t_r_i_c_k___N_e_w_e_l_l_________n
mov dword [esp], 0x480740
call fcn.0046d410
mov dword [esp + 8], 0x38
mov dword [esp + 4], str.___________________pmn2_lehigh.edu____________________n
mov dword [esp], 0x480740
call fcn.0046d410
mov dword [esp + 8], 0x38
mov dword [esp + 4], str.______________________________________________________n
mov dword [esp], 0x480740
call fcn.0046d410
mov dword [esp + 8], 0x38
mov dword [esp + 4], str._____________Thursday__November_09__2000______________n
mov dword [esp], 0x480740
call fcn.0046d410
mov dword [esp + 8], 0x38
mov dword [esp + 4], str.______________________________________________________n
mov dword [esp], 0x480740
call fcn.0046d410
mov dword [esp + 8], 0x38
mov dword [esp + 4], str.______________________HANGMAN__v1.2___________________n
mov dword [esp], 0x480740
call fcn.0046d410
mov dword [esp + 8], 0x38
mov dword [esp + 4], str._______________College_NickName_Edition_______________n
mov dword [esp], 0x480740
call fcn.0046d410
mov dword [esp + 8], 0x39
mov dword [esp + 4], str.____________________________n_n
mov dword [esp], 0x480740
call fcn.0046d410
mov dword [esp + 8], 0x26
mov dword [esp + 4], str.Choose:_t1__Computer_Selected_Password_n
mov dword [esp], 0x480740
call fcn.0046d410
mov dword [esp + 8], 0x1e
mov dword [esp + 4], str._t2__User_Defined_Password_n___
mov dword [esp], 0x480740
call fcn.0046d410
mov dword [esp + 4], ebx
mov dword [esp], 0x4806a0
call fcn.004724e0
mov al, byte [ebp - 0x6db]
sub eax, 0x31
cmp al, 1
ja 0x475368
lea ebx, [ebp - 0x38]
lea eax, [ebp - 0x638]
mov dword [ebp - 0x6ec], ebx
vpxor xmm0, xmm0, xmm0
vmovdqa ymmword [eax], ymm0
add eax, 0x20
cmp eax, dword [ebp - 0x6ec]
jne 0x4754b4
mov byte [ebp - 0x38], 0
mov byte [ebp - 0x37], 0
mov byte [ebp - 0x36], 0
mov byte [ebp - 0x35], 0
mov byte [ebp - 0x34], 0
mov byte [ebp - 0x33], 0
mov byte [ebp - 0x32], 0
mov byte [ebp - 0x31], 0
mov al, 0x79
movsx eax, al
mov ebx, dword [0x498458]
mov dword [esp], eax
vzeroupper
call ebx
cmp eax, 0x6e
je 0x476873
lea eax, [ebp - 0x6b8]
mov esi, str.abcdefghijklmnopqrstuvwxyz
mov edi, eax
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x6f0], eax
mov dl, byte [0x48103e]
mov ax, word [esi]
mov byte [edi + 2], dl
mov word [edi], ax
cmp byte [ebp - 0x6db], 0x32
je 0x4767f5
mov dword [esp + 4], 0x481244
mov dword [esp], str.Hangman__College_Edition_.pmn
call 0x416b78
mov esi, eax
test eax, eax
je 0x4755ce
lea ebx, [ebp - 0x638]
mov edi, 1
mov dword [esp], esi
call 0x416b80
cmp al, 0xff
je 0x475580
cmp al, 0x2a
je 0x476500
mov byte [ebx], 0
xor edi, edi
inc ebx
mov dword [esp], esi
call 0x416b80
cmp al, 0xff
jne 0x475566
mov ebx, edi
test bl, bl
je 0x4755c3
lea eax, [ebp - 0x638]
lea esi, [esi]
vpxor xmm0, xmm0, xmm0
vmovdqa ymmword [eax], ymm0
add eax, 0x20
cmp dword [ebp - 0x6ec], eax
jne 0x475590
mov byte [ebp - 0x38], 0
mov byte [ebp - 0x37], 0
mov byte [ebp - 0x36], 0
mov byte [ebp - 0x35], 0
mov byte [ebp - 0x34], 0
mov byte [ebp - 0x33], 0
mov byte [ebp - 0x32], 0
mov byte [ebp - 0x31], 0
mov dword [esp], esi
vzeroupper
call 0x416b88
mov ebx, 0x608
call 0x416b90
mov edx, eax
sar edx, 0x1f
idiv ebx
cmp byte [ebp + edx - 0x638], 0
jne 0x4755d3
mov eax, dword [edx*4 + 0x4790e0]
mov dword [ebp - 0x710], edx
mov dword [esp], eax
call fcn.0040c6b0
mov edx, dword [ebp - 0x710]
mov dword [ebp - 0x700], eax
mov ebx, eax
mov ecx, dword [ebx]
add ebx, 4
lea eax, [ecx - 0x1010101]
xor ecx, 0xffffffff
and eax, ecx
and eax, 0x80808080
je 0x47560c
mov ecx, eax
mov byte [ebp + edx - 0x638], 1
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [ebx + 2]
mov dword [esp + 4], 0x481264
cmovne ecx, ebx
add al, al
mov eax, dword [ebp - 0x700]
sbb ecx, 3
mov dword [esp], str.Hangman__College_Edition_.pmn
sub ecx, eax
mov dword [ebp - 0x70c], ecx
mov dword [ebp - 0x6f4], ecx
call 0x416b78
lea esi, [ebp - 0x30]
mov ebx, eax
lea edi, [ebp - 0x638]
jmp 0x47568d
mov dword [esp + 4], 0x481020
mov dword [esp], ebx
inc edi
call fcn.00401550
cmp edi, esi
je 0x4756a7
cmp byte [edi], 0
jne 0x475678
mov dword [esp + 4], 0x481022
mov dword [esp], ebx
inc edi
call fcn.00401580
cmp edi, esi
jne 0x47568d
mov dword [esp], ebx
call 0x416b88
mov edx, dword [ebp - 0x70c]
mov dword [esp], edx
call fcn.00416b38
mov ecx, dword [ebp - 0x6f4]
mov dword [ebp - 0x6fc], eax
mov byte [ebp - 0x6d8], 0x20
mov byte [ebp - 0x6d4], 0x20
mov byte [ebp - 0x6d2], 0x20
mov byte [ebp - 0x6d1], 0x20
mov byte [ebp - 0x6d0], 0x20
mov byte [ebp - 0x6ce], 0x20
mov byte [ebp - 0x6cd], 0x20
mov byte [ebp - 0x6cc], 0x20
mov byte [ebp - 0x6ca], 0x20
mov byte [ebp - 0x6c9], 0x20
mov byte [ebp - 0x6d7], 0xda
mov byte [ebp - 0x6d6], 0xc4
mov byte [ebp - 0x6d5], 0xbf
mov byte [ebp - 0x6d3], 0xb3
mov byte [ebp - 0x6cf], 0xb3
mov byte [ebp - 0x6cb], 0xb3
mov byte [ebp - 0x6c8], 0xc4
mov byte [ebp - 0x6c7], 0xc1
mov byte [ebp - 0x6c6], 0xc4
mov byte [ebp - 0x6c5], 0xc4
test ecx, ecx
jle 0x4768b7
xor ebx, ebx
mov esi, dword [0x4983ec]
mov edi, 0x5f
lea esi, [esi]
mov eax, dword [ebp - 0x700]
mov cl, byte [eax + ebx]
movsx eax, cl
mov dword [esp], eax
mov byte [ebp - 0x710], cl
call esi
mov cl, byte [ebp - 0x710]
test eax, eax
mov eax, dword [ebp - 0x6fc]
cmovne ecx, edi
mov byte [eax + ebx], cl
inc ebx
cmp ebx, dword [ebp - 0x6f4]
jne 0x475770
mov edx, ebx
mov eax, dword [ebp - 0x6fc]
mov byte [eax + edx], 0
mov dword [esp], 0x48103f
call 0x416b70
lea ebx, [ebp - 0x6da]
mov dl, byte [ebp - 0x6d8]
mov dword [esp + 8], 1
mov byte [ebp - 0x6da], dl
mov dword [esp + 4], ebx
mov dword [esp], 0x480880
call fcn.0046d410
mov cl, byte [ebp - 0x6d7]
mov byte [ebp - 0x6da], cl
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x480880
call fcn.0046d410
mov al, byte [ebp - 0x6d6]
mov byte [ebp - 0x6da], al
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x480880
call fcn.0046d410
mov dl, byte [ebp - 0x6d5]
mov byte [ebp - 0x6da], dl
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x480880
call fcn.0046d410
mov eax, dword [0x480880]
mov eax, dword [eax - 0xc]
mov esi, dword [eax + 0x4808fc]
test esi, esi
je 0x4768f0
cmp byte [esi + 0x1c], 0
je 0x476779
mov al, byte [esi + 0x27]
movsx eax, al
mov ecx, 0x480880
mov dword [esp], eax
call fcn.00443a50
mov ecx, eax
push edi
call fcn.00443cc0
mov cl, byte [ebp - 0x6d4]
mov byte [ebp - 0x6da], cl
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x480880
call fcn.0046d410
mov al, byte [ebp - 0x6d3]
mov byte [ebp - 0x6da], al
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x480880
call fcn.0046d410
mov dl, byte [ebp - 0x6d2]
mov byte [ebp - 0x6da], dl
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x480880
call fcn.0046d410
mov cl, byte [ebp - 0x6d1]
mov byte [ebp - 0x6da], cl
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x480880
call fcn.0046d410
mov eax, dword [0x480880]
mov eax, dword [eax - 0xc]
mov esi, dword [eax + 0x4808fc]
test esi, esi
je 0x4768f0
cmp byte [esi + 0x1c], 0
je 0x47675e
mov al, byte [esi + 0x27]
movsx eax, al
mov ecx, 0x480880
mov dword [esp], eax
call fcn.00443a50
push ecx
mov ecx, eax
call fcn.00443cc0
mov al, byte [ebp - 0x6d0]
mov byte [ebp - 0x6da], al
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x480880
call fcn.0046d410
mov dl, byte [ebp - 0x6cf]
mov byte [ebp - 0x6da], dl
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x480880
call fcn.0046d410
mov cl, byte [ebp - 0x6ce]
mov byte [ebp - 0x6da], cl
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x480880
call fcn.0046d410
mov al, byte [ebp - 0x6cd]
mov byte [ebp - 0x6da], al
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x480880
call fcn.0046d410
mov eax, dword [0x480880]
mov eax, dword [eax - 0xc]
mov esi, dword [eax + 0x4808fc]
test esi, esi
je 0x4768f0
cmp byte [esi + 0x1c], 0
je 0x476743
mov al, byte [esi + 0x27]
movsx eax, al
mov ecx, 0x480880
mov dword [esp], eax
call fcn.00443a50
mov ecx, eax
push edi
call fcn.00443cc0
mov dl, byte [ebp - 0x6cc]
mov byte [ebp - 0x6da], dl
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x480880
call fcn.0046d410
mov cl, byte [ebp - 0x6cb]
mov byte [ebp - 0x6da], cl
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x480880
call fcn.0046d410
mov al, byte [ebp - 0x6ca]
mov byte [ebp - 0x6da], al
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x480880
call fcn.0046d410
mov dl, byte [ebp - 0x6c9]
mov byte [ebp - 0x6da], dl
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x480880
call fcn.0046d410
mov eax, dword [0x480880]
mov eax, dword [eax - 0xc]
mov esi, dword [eax + 0x4808fc]
test esi, esi
je 0x4768f0
cmp byte [esi + 0x1c], 0
je 0x476728
mov al, byte [esi + 0x27]
movsx eax, al
mov ecx, 0x480880
mov dword [esp], eax
call fcn.00443a50
push ecx
mov ecx, eax
call fcn.00443cc0
mov cl, byte [ebp - 0x6c8]
mov byte [ebp - 0x6da], cl
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x480880
call fcn.0046d410
mov al, byte [ebp - 0x6c7]
mov byte [ebp - 0x6da], al
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x480880
call fcn.0046d410
mov dl, byte [ebp - 0x6c6]
mov byte [ebp - 0x6da], dl
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x480880
call fcn.0046d410
mov cl, byte [ebp - 0x6c5]
mov byte [ebp - 0x6da], cl
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], 0x480880
call fcn.0046d410
mov eax, dword [0x480880]
mov eax, dword [eax - 0xc]
mov ebx, dword [eax + 0x4808fc]
test ebx, ebx
je 0x4768f0
cmp byte [ebx + 0x1c], 0
je 0x4767da
mov al, byte [ebx + 0x27]
movsx eax, al
mov ecx, 0x480880
mov dword [esp], eax
call fcn.00443a50
mov ecx, eax
push edi
call fcn.00443cc0
mov eax, dword [ebp - 0x6fc]
mov edx, dword [ebp - 0x6fc]
test eax, eax
je 0x476895
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
xor ecx, 0xffffffff
and eax, ecx
and eax, 0x80808080
je 0x475bcd
mov ecx, eax
mov ebx, dword [ebp - 0x6fc]
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
mov dword [esp], 0x480880
cmove edx, ecx
add al, al
mov eax, dword [ebp - 0x6fc]
sbb edx, 3
mov dword [esp + 4], eax
sub edx, ebx
mov dword [esp + 8], edx
call fcn.0046d410
mov eax, dword [0x480880]
mov eax, dword [eax - 0xc]
mov ebx, dword [eax + 0x4808fc]
test ebx, ebx
je 0x4768f0
cmp byte [ebx + 0x1c], 0
je 0x4767bf
mov al, byte [ebx + 0x27]
movsx eax, al
mov ecx, 0x480880
mov dword [esp], eax
call fcn.00443a50
mov ecx, eax
push edx
call fcn.00443cc0
lea edx, [ebp - 0x6b8]
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
xor ecx, 0xffffffff
and eax, ecx
and eax, 0x80808080
je 0x475c5f
mov ecx, eax
mov dword [esp], 0x480880
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
add al, al
mov eax, dword [ebp - 0x6f0]
sbb edx, 3
sub edx, eax
mov dword [esp + 8], edx
lea edx, [ebp - 0x6b8]
mov dword [esp + 4], edx
call fcn.0046d410
mov eax, dword [0x480880]
mov eax, dword [eax - 0xc]
mov ebx, dword [eax + 0x4808fc]
test ebx, ebx
je 0x4768f0
cmp byte [ebx + 0x1c], 0
je 0x4767a4
mov al, byte [ebx + 0x27]
movsx eax, al
mov ecx, 0x480880
mov dword [esp], eax
call fcn.00443a50
mov ecx, eax
push esi
call fcn.00443cc0
lea esi, [ebp - 0x6d9]
mov dword [ebp - 0x708], 0xffffffff
nop
lea esi, [esi]
mov dword [esp + 8], 0xd
mov dword [esp + 4], str.Enter_Guess:
mov dword [esp], 0x480740
call fcn.0046d410
call fcn.0040c6b8
mov ebx, dword [0x498458]
movsx eax, al
mov dword [ebp - 0x704], eax
mov dword [esp], eax
call ebx
lea edi, [ebp - 0x6b8]
mov dword [ebp - 0x6f4], eax
movsx ecx, al
mov edx, dword [edi]
add edi, 4
lea eax, [edx - 0x1010101]
xor edx, 0xffffffff
and eax, edx
and eax, 0x80808080
je 0x475d44
mov edx, eax
mov ebx, dword [ebp - 0x6f0]
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea edx, [edi + 2]
cmove edi, edx
add al, al
sbb edi, 3
sub edi, ebx
test edi, edi
jle 0x475eb2
mov ebx, dword [0x498458]
mov dword [esp], ecx
call ebx
lea ebx, [ebp - 0x6b8]
mov dword [ebp - 0x6f8], eax
add edi, ebx
jmp 0x475da9
inc ebx
cmp ebx, edi
je 0x475eb2
movsx eax, byte [ebx]
mov edx, dword [0x498458]
mov dword [esp], eax
call edx
cmp eax, dword [ebp - 0x6f8]
jne 0x475da0
mov eax, dword [ebp - 0x700]
mov ecx, eax
mov edx, dword [ecx]
add ecx, 4
lea eax, [edx - 0x1010101]
xor edx, 0xffffffff
and eax, edx
and eax, 0x80808080
je 0x475dc7
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea edx, [ecx + 2]
cmovne edx, ecx
add al, al
mov eax, dword [ebp - 0x700]
sbb edx, 3
mov edi, eax
sub edx, eax
xor ebx, ebx
mov dword [ebp - 0x6f8], edx
test edx, edx
jg 0x475e1e
jmp 0x4765f0
inc ebx
cmp dword [ebp - 0x6f8], ebx
je 0x4765f0
movsx eax, byte [edi + ebx]
mov ecx, dword [0x498458]
mov dword [esp], eax
call ecx
cmp dword [ebp - 0x6f4], eax
jne 0x475e11
xor edi, edi
mov edx, dword [0x498458]
jmp 0x475e62
inc edi
cmp dword [ebp - 0x6f8], edi
je 0x475ea4
mov edx, dword [ebp - 0x704]
mov ebx, dword [0x498458]
mov dword [esp], edx
call ebx
mov edx, ebx
mov dword [ebp - 0x6f4], eax
mov eax, dword [ebp - 0x700]
mov bl, byte [eax + edi]
movsx eax, bl
mov dword [esp], eax
call edx
cmp eax, dword [ebp - 0x6f4]
jne 0x475e40
mov eax, dword [ebp - 0x6fc]
mov edx, dword [ebp - 0x704]
mov byte [eax + edi], bl
mov ebx, dword [0x498458]
mov dword [esp], edx
call ebx
inc edi
mov dword [ebp - 0x6f4], eax
cmp dword [ebp - 0x6f8], edi
jne 0x475e49
mov eax, dword [ebp - 0x6f4]
mov byte [ebp + eax - 0x719], 0x5f
mov dword [esp], 0x48103f
call 0x416b70
mov dl, byte [ebp - 0x6d8]
mov byte [ebp - 0x6d9], dl
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], 0x480880
call fcn.0046d410
mov cl, byte [ebp - 0x6d7]
mov byte [ebp - 0x6d9], cl
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], 0x480880
call fcn.0046d410
mov bl, byte [ebp - 0x6d6]
mov byte [ebp - 0x6d9], bl
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], 0x480880
call fcn.0046d410
mov al, byte [ebp - 0x6d5]
mov byte [ebp - 0x6d9], al
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], 0x480880
call fcn.0046d410
mov eax, dword [0x480880]
mov eax, dword [eax - 0xc]
mov ebx, dword [eax + 0x4808fc]
test ebx, ebx
je 0x4768f0
cmp byte [ebx + 0x1c], 0
je 0x4765d0
mov al, byte [ebx + 0x27]
movsx eax, al
mov ecx, 0x480880
mov dword [esp], eax
call fcn.00443a50
mov ecx, eax
push edi
call fcn.00443cc0
mov dl, byte [ebp - 0x6d4]
mov byte [ebp - 0x6d9], dl
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], 0x480880
call fcn.0046d410
mov cl, byte [ebp - 0x6d3]
mov byte [ebp - 0x6d9], cl
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], 0x480880
call fcn.0046d410
mov bl, byte [ebp - 0x6d2]
mov byte [ebp - 0x6d9], bl
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], 0x480880
call fcn.0046d410
mov al, byte [ebp - 0x6d1]
mov byte [ebp - 0x6d9], al
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], 0x480880
call fcn.0046d410
mov eax, dword [0x480880]
mov eax, dword [eax - 0xc]
mov ebx, dword [eax + 0x4808fc]
test ebx, ebx
je 0x4768f0
cmp byte [ebx + 0x1c], 0
je 0x4765b0
mov al, byte [ebx + 0x27]
movsx eax, al
mov ecx, 0x480880
mov dword [esp], eax
call fcn.00443a50
push ecx
mov ecx, eax
call fcn.00443cc0
mov dl, byte [ebp - 0x6d0]
mov byte [ebp - 0x6d9], dl
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], 0x480880
call fcn.0046d410
mov cl, byte [ebp - 0x6cf]
mov byte [ebp - 0x6d9], cl
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], 0x480880
call fcn.0046d410
mov bl, byte [ebp - 0x6ce]
mov byte [ebp - 0x6d9], bl
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], 0x480880
call fcn.0046d410
mov al, byte [ebp - 0x6cd]
mov byte [ebp - 0x6d9], al
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], 0x480880
call fcn.0046d410
mov eax, dword [0x480880]
mov eax, dword [eax - 0xc]
mov ebx, dword [eax + 0x4808fc]
test ebx, ebx
je 0x4768f0
cmp byte [ebx + 0x1c], 0
je 0x476590
mov al, byte [ebx + 0x27]
movsx eax, al
mov ecx, 0x480880
mov dword [esp], eax
call fcn.00443a50
mov ecx, eax
push edi
call fcn.00443cc0
mov dl, byte [ebp - 0x6cc]
mov byte [ebp - 0x6d9], dl
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], 0x480880
call fcn.0046d410
mov cl, byte [ebp - 0x6cb]
mov byte [ebp - 0x6d9], cl
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], 0x480880
call fcn.0046d410
mov bl, byte [ebp - 0x6ca]
mov byte [ebp - 0x6d9], bl
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], 0x480880
call fcn.0046d410
mov al, byte [ebp - 0x6c9]
mov byte [ebp - 0x6d9], al
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], 0x480880
call fcn.0046d410
mov eax, dword [0x480880]
mov eax, dword [eax - 0xc]
mov ebx, dword [eax + 0x4808fc]
test ebx, ebx
je 0x4768f0
cmp byte [ebx + 0x1c], 0
je 0x476570
mov al, byte [ebx + 0x27]
movsx eax, al
mov ecx, 0x480880
mov dword [esp], eax
call fcn.00443a50
push ecx
mov ecx, eax
call fcn.00443cc0
mov dl, byte [ebp - 0x6c8]
mov byte [ebp - 0x6d9], dl
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], 0x480880
call fcn.0046d410
mov cl, byte [ebp - 0x6c7]
mov byte [ebp - 0x6d9], cl
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], 0x480880
call fcn.0046d410
mov bl, byte [ebp - 0x6c6]
mov byte [ebp - 0x6d9], bl
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], 0x480880
call fcn.0046d410
mov al, byte [ebp - 0x6c5]
mov byte [ebp - 0x6d9], al
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], 0x480880
call fcn.0046d410
mov eax, dword [0x480880]
mov eax, dword [eax - 0xc]
mov ebx, dword [eax + 0x4808fc]
test ebx, ebx
je 0x4768f0
cmp byte [ebx + 0x1c], 0
je 0x476550
mov al, byte [ebx + 0x27]
movsx eax, al
mov ecx, 0x480880
mov dword [esp], eax
call fcn.00443a50
mov ecx, eax
push edi
call fcn.00443cc0
mov edx, dword [ebp - 0x6fc]
test edx, edx
je 0x4766d0
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
xor ecx, 0xffffffff
and eax, ecx
and eax, 0x80808080
je 0x4762c3
mov ecx, eax
mov dword [esp], 0x480880
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
add al, al
mov ecx, dword [ebp - 0x6fc]
sbb edx, 3
mov eax, dword [ebp - 0x6fc]
sub edx, ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.0046d410
mov eax, dword [0x480880]
mov eax, dword [eax - 0xc]
mov ebx, dword [eax + 0x4808fc]
test ebx, ebx
je 0x4768f0
cmp byte [ebx + 0x1c], 0
je 0x476530
mov al, byte [ebx + 0x27]
movsx eax, al
mov ecx, 0x480880
mov dword [esp], eax
call fcn.00443a50
mov ecx, eax
push edi
call fcn.00443cc0
lea edx, [ebp - 0x6b8]
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
xor ecx, 0xffffffff
and eax, ecx
and eax, 0x80808080
je 0x476355
mov ecx, eax
mov ebx, dword [ebp - 0x6f0]
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
mov dword [esp], 0x480880
cmove edx, ecx
add al, al
sbb edx, 3
sub edx, ebx
mov dword [esp + 8], edx
lea edx, [ebp - 0x6b8]
mov dword [esp + 4], edx
call fcn.0046d410
mov eax, dword [0x480880]
mov eax, dword [eax - 0xc]
mov ebx, dword [eax + 0x4808fc]
test ebx, ebx
je 0x4768f0
cmp byte [ebx + 0x1c], 0
je 0x476510
mov al, byte [ebx + 0x27]
movsx eax, al
mov ecx, 0x480880
mov dword [esp], eax
call fcn.00443a50
mov ecx, eax
push edx
call fcn.00443cc0
mov eax, dword [ebp - 0x6fc]
mov ebx, dword [ebp - 0x70c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x700]
mov dword [esp + 8], ebx
mov dword [esp], eax
call 0x416b98
test eax, eax
je 0x476680
cmp dword [ebp - 0x708], 4
jle 0x475d00
lea ebx, [ebp - 0x6d8]
mov dword [esp + 8], 0x481274
mov dword [esp + 4], 0x481274
mov dword [esp], ebx
call fcn.00401ec0
mov dword [esp + 8], 0x18
mov dword [esp + 4], str._nYou_lose_nSolution_was__
mov dword [esp], 0x480880
call fcn.0046d410
mov edi, dword [ebp - 0x700]
mov edx, dword [ebp - 0x700]
test edi, edi
je 0x4768ce
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
xor ecx, 0xffffffff
and eax, ecx
and eax, 0x80808080
je 0x476466
mov ecx, eax
mov ebx, dword [ebp - 0x700]
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
mov dword [esp], 0x480880
cmove edx, ecx
add al, al
mov eax, dword [ebp - 0x700]
sbb edx, 3
mov dword [esp + 4], eax
sub edx, ebx
mov dword [esp + 8], edx
call fcn.0046d410
mov dword [esp + 8], 2
mov dword [esp + 4], 0x48129a
mov dword [esp], 0x480880
call fcn.0046d410
mov dword [esp + 8], 0x2f
mov dword [esp + 4], str.Enter__n__to_quit__anything_else_to_play_again
mov dword [esp], 0x480740
call fcn.0046d410
call fcn.0040c6b8
jmp 0x4754e5
mov byte [ebx], 1
inc ebx
jmp 0x475574
mov ecx, ebx
call 0x41d840
mov eax, dword [ebx]
mov ecx, ebx
mov dword [esp], 0xa
call dword [eax + 0x18]
push ecx
jmp 0x4763c9
mov ecx, ebx
call 0x41d840
mov eax, dword [ebx]
mov ecx, ebx
mov dword [esp], 0xa
call dword [eax + 0x18]
push edx
jmp 0x476337
mov ecx, ebx
call 0x41d840
mov eax, dword [ebx]
mov ecx, ebx
mov dword [esp], 0xa
call dword [eax + 0x18]
push edx
jmp 0x47629d
mov ecx, ebx
call 0x41d840
mov eax, dword [ebx]
mov ecx, ebx
mov dword [esp], 0xa
call dword [eax + 0x18]
push ebx
jmp 0x4761d2
mov ecx, ebx
call 0x41d840
mov eax, dword [ebx]
mov ecx, ebx
mov dword [esp], 0xa
call dword [eax + 0x18]
push edx
jmp 0x476107
mov ecx, ebx
call 0x41d840
mov eax, dword [ebx]
mov ecx, ebx
mov dword [esp], 0xa
call dword [eax + 0x18]
push ebx
jmp 0x47603c
mov ecx, ebx
call 0x41d840
mov eax, dword [ebx]
mov ecx, ebx
mov dword [esp], 0xa
call dword [eax + 0x18]
push edx
jmp 0x475f71
inc dword [ebp - 0x708]
je 0x4766f2
mov al, byte [0x4790a0]
cmp dword [ebp - 0x708], 1
je 0x476799
cmp dword [ebp - 0x708], 2
je 0x476794
mov al, byte [0x479060]
cmp dword [ebp - 0x708], 3
je 0x476799
cmp dword [ebp - 0x708], 4
je 0x4768be
mov al, byte [0x479020]
mov edx, dword [ebp - 0x704]
mov ebx, dword [0x498458]
mov byte [ebp - 0x6c9], al
mov dword [esp], edx
call ebx
mov dword [ebp - 0x708], 5
mov dword [ebp - 0x6f4], eax
mov eax, dword [ebp - 0x6f4]
mov byte [ebp + eax - 0x719], 0x5f
jmp 0x475eb2
mov eax, dword [ebp - 0x6fc]
lea ebx, [ebp - 0x6d8]
mov dword [esp + 8], 0x481274
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00401ec0
mov dword [esp + 8], 0xb
mov dword [esp + 4], str._n_nYou_Win__n
mov dword [esp], 0x480880
call fcn.0046d410
cmp dword [ebp - 0x708], 4
jle 0x4764d3
jmp 0x47641e
mov eax, dword [0x480880]
mov ecx, dword [eax - 0xc]
add ecx, 0x480880
mov eax, dword [ecx + 0x14]
or eax, 1
mov dword [esp], eax
call fcn.0046b510
push ebx
jmp 0x476314
mov bl, byte [0x4790c0]
mov byte [ebp - 0x6d1], bl
mov edx, dword [ebp - 0x704]
mov ebx, dword [0x498458]
mov dword [esp], edx
call ebx
mov dword [ebp - 0x6f4], eax
mov eax, dword [ebp - 0x6f4]
mov byte [ebp + eax - 0x719], 0x5f
jmp 0x475eb2
mov ecx, esi
call 0x41d840
mov eax, dword [esi]
mov ecx, esi
mov dword [esp], 0xa
call dword [eax + 0x18]
push esi
jmp 0x475ad6
mov ecx, esi
call 0x41d840
mov eax, dword [esi]
mov ecx, esi
mov dword [esp], 0xa
call dword [eax + 0x18]
push edx
jmp 0x475a0b
mov ecx, esi
call 0x41d840
mov eax, dword [esi]
mov ecx, esi
mov dword [esp], 0xa
call dword [eax + 0x18]
push esi
jmp 0x475940
mov ecx, esi
call 0x41d840
mov eax, dword [esi]
mov ecx, esi
mov dword [esp], 0xa
call dword [eax + 0x18]
push edx
jmp 0x475875
mov al, byte [0x479080]
mov byte [ebp - 0x6cd], al
jmp 0x4766fe
mov ecx, ebx
call 0x41d840
mov eax, dword [ebx]
mov ecx, ebx
mov dword [esp], 0xa
call dword [eax + 0x18]
push edi
jmp 0x475cd3
mov ecx, ebx
call 0x41d840
mov eax, dword [ebx]
mov ecx, ebx
mov dword [esp], 0xa
call dword [eax + 0x18]
push ecx
jmp 0x475c41
mov ecx, ebx
call 0x41d840
mov eax, dword [ebx]
mov ecx, ebx
mov dword [esp], 0xa
call dword [eax + 0x18]
push edx
jmp 0x475ba1
mov dword [esp + 8], 0x14
mov dword [esp + 4], str._nEnter_Secret_Word:
mov dword [esp], 0x480740
call fcn.0046d410
lea ebx, [ebp - 0x688]
xor esi, esi
lea esi, [esi]
call fcn.0040c6b8
mov byte [ebx + esi], al
cmp al, 0xd
je 0x476881
mov dword [esp], 0x481020
inc esi
call fcn.00401530
cmp esi, 0x50
jne 0x476820
mov dword [ebp - 0x6f4], esi
mov dword [ebp - 0x70c], 0x50
mov ecx, esi
mov byte [ebp + ecx - 0x688], 0
mov dword [esp], ebx
call fcn.0040c6b0
mov dword [esp], eax
call fcn.0040c6b0
mov dword [ebp - 0x700], eax
jmp 0x4756af
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov dword [ebp - 0x6f4], esi
mov dword [ebp - 0x70c], esi
mov ecx, dword [ebp - 0x6f4]
jmp 0x476850
mov eax, dword [0x480880]
mov ecx, dword [eax - 0xc]
add ecx, 0x480880
mov eax, dword [ecx + 0x14]
or eax, 1
mov dword [esp], eax
call fcn.0046b510
push esi
jmp 0x475c1e
xor edx, edx
jmp 0x4757a6
mov al, byte [0x479040]
mov byte [ebp - 0x6c9], al
jmp 0x4766fe
mov eax, dword [0x480880]
mov ecx, dword [eax - 0xc]
add ecx, 0x480880
mov eax, dword [ecx + 0x14]
or eax, 1
mov dword [esp], eax
call fcn.0046b510
push esi
jmp 0x4764b7
call fcn.0046dfb0
lea esi, [esi]
lea edi, [edi]
sub esp, 0x1c
mov ecx, 0x496020
call int.00469040
mov dword [esp], 0x401500
call fcn.0040a0f0
add esp, 0x1c
ret