Function at 0x485a3b
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bfa7b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x32c0
call fcn.004bb2f0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x49c641
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18f0], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1e68], eax
mov eax, dword [ebp - 0x1e68]
movzx eax, byte [eax]
test eax, eax
je 0x49c603
push 0x5ae5
push 0
push 1
call fcn.004792a5
add esp, 0xc
push 3
lea ecx, [ebp - 0x2310]
call fcn.0040a30e
mov dword [ebp - 0x1920], 4
mov dword [ebp - 0x30c], 0
jmp 0x485ad4
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 3
jge 0x485af3
push dword [ebp - 0x30c]
lea ecx, [ebp - 0x2310]
call fcn.0040a3fc
and dword [eax], 0
jmp 0x485ac7
lea eax, [ebp - 0x1920]
push eax
push 0x3dbf
push 0x44dc
push 0x489c
lea eax, [ebp - 0x2310]
push eax
push 0
push 0
call fcn.0046fd2d
add esp, 0x1c
lea ecx, [ebp - 0x2310]
call fcn.0040a3e0
mov dword [ebp - 0x20f0], 0x25260417
mov dword [ebp - 0x108c], 0x59a5
mov dword [ebp - 0x1928], 0xa92670
cmp dword [ebp - 0x108c], 0x5b28
jle 0x485c53
and dword [ebp - 0x644], 0
jmp 0x485b6b
mov eax, dword [ebp - 0x644]
inc eax
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 0x3a6e
jge 0x485c53
and dword [ebp - 0x324], 0
jmp 0x485b91
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0x3326
jge 0x485c4e
and dword [ebp - 0x320], 0
jmp 0x485bb7
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0x2fe6
jge 0x485c49
and dword [ebp - 0x8fc], 0
jmp 0x485bdd
mov eax, dword [ebp - 0x8fc]
inc eax
mov dword [ebp - 0x8fc], eax
cmp dword [ebp - 0x8fc], 0x41a0
jge 0x485c44
mov eax, dword [ebp - 0x320]
mov ecx, dword [ebp - 0x8fc]
shl eax, cl
xor eax, dword [ebp - 0x324]
or eax, dword [ebp - 0x644]
cdq
mov dword [ebp - 0x1944], eax
mov dword [ebp - 0x1940], edx
push dword [ebp - 0x1940]
push dword [ebp - 0x1944]
lea ecx, [ebp - 0x2e54]
call fcn.004019b1
pop ecx
pop ecx
mov ecx, eax
call fcn.00409fae
push eax
call fcn.004a91a7
pop ecx
lea ecx, [ebp - 0x2e54]
call fcn.00409fa4
jmp 0x485bd0
jmp 0x485baa
jmp 0x485b84
jmp 0x485b5e
mov dword [ebp - 0x1fe4], 0xda0bdbdf
and dword [ebp - 4], 0
cmp dword [ebp - 0x108c], 0x587f
jge 0x485c79
push dword [ebp - 0x1928]
call fcn.004a91a7
pop ecx
jmp 0x485c95
or dword [ebp - 4], 0xffffffff
jmp 0x485c9f
push 1
lea ecx, [ebp - 0x2388]
call fcn.0040a30e
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x64c], 1
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x7c], 0x8461e707
mov dword [ebp - 0x13b8], 0
mov dword [ebp - 0x10f0], 0x906a58e0
mov dword [ebp - 0x32c], 0
jmp 0x485cfb
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 3
jge 0x485d17
mov eax, dword [ebp - 0x32c]
mov dword [ebp + eax*4 - 0x2340], 0
jmp 0x485cee
mov eax, dword [ebp - 0x64c]
cmp dword [ebp - 0x28], eax
jge 0x485d2e
mov dword [ebp - 0x15ec], 1
jmp 0x485d35
and dword [ebp - 0x15ec], 0
cmp dword [ebp - 0x64c], 0xffffffff
jae 0x485d4a
mov dword [ebp - 0x15b4], 1
jmp 0x485d51
and dword [ebp - 0x15b4], 0
mov eax, dword [ebp - 0x15b4]
neg eax
jne 0x485d67
mov dword [ebp - 0x15bc], 1
jmp 0x485d6e
and dword [ebp - 0x15bc], 0
cmp dword [ebp - 0x15bc], 1
jae 0x485d83
mov dword [ebp - 0x15c4], 1
jmp 0x485d8a
and dword [ebp - 0x15c4], 0
mov eax, dword [ebp - 0x15c4]
sub eax, 0x3ea2f29b
cmp eax, dword [ebp - 0x28]
je 0x485da6
mov dword [ebp - 0x15cc], 1
jmp 0x485dad
and dword [ebp - 0x15cc], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x15cc], eax
jge 0x485dc4
mov dword [ebp - 0x15d4], 1
jmp 0x485dcb
and dword [ebp - 0x15d4], 0
mov eax, dword [ebp - 0x64c]
cmp dword [ebp - 0x15d4], eax
jle 0x485de8
cmp dword [ebp - 0x28], 0
jne 0x485de8
and dword [ebp - 0x15dc], 0
jmp 0x485df2
mov dword [ebp - 0x15dc], 1
cmp dword [ebp - 0x15dc], 0xffffffff
jne 0x485e07
mov dword [ebp - 0x15e4], 1
jmp 0x485e0e
and dword [ebp - 0x15e4], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x15e4], eax
je 0x485e25
mov dword [ebp - 0x15f4], 1
jmp 0x485e2c
and dword [ebp - 0x15f4], 0
mov eax, dword [ebp - 0x15ec]
imul eax, dword [ebp - 0x15f4]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x2674], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2658], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x2bc8], eax
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x486108
mov dword [ebp - 0x1930], 6
mov dword [ebp - 0xb30], 0x59e478df
mov dword [ebp - 0x28], 0xfffffff0
jmp 0x485e8c
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x13
jl 0x486103
mov dword [ebp - 0x334], 0x6565
push 3
lea ecx, [ebp - 0x2328]
call fcn.0040a30e
push 0
push 0x5154
lea eax, [ebp - 0x2660]
push eax
push 0
lea eax, [ebp - 0x2328]
push eax
push 0x7cfd
push 0x53ed
push 0x3b7d
push 1
push 0x3b37
call fcn.0047405c
add esp, 0x28
mov dword [ebp - 0x7c], 0
jmp 0x485ef2
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xfffffff8
jge 0x4860f3
mov dword [ebp - 0x1938], 0xfffffff6
mov dword [ebp - 0x7d4], 0
jmp 0x485f1f
mov eax, dword [ebp - 0x7d4]
inc eax
mov dword [ebp - 0x7d4], eax
cmp dword [ebp - 0x7d4], 1
jge 0x485f3b
mov eax, dword [ebp - 0x7d4]
mov dword [ebp + eax*4 - 0x15fc], 0x41b8
jmp 0x485f12
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x15fc]
dec eax
mov dword [ebp - 0x1604], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1604]
mov dword [ebp + eax - 0x15fc], ecx
cmp dword [ebp - 0x1604], 0
jne 0x4860bd
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x29b0], eax
imul eax, dword [ebp - 0x130], 0xf3e4
cmp eax, 0xafa0
je 0x485f95
mov dword [ebp - 0x160c], 1
jmp 0x485f9c
and dword [ebp - 0x160c], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x160c]
cmp dword [ebp - 0x28], eax
jge 0x485fbf
cmp dword [ebp - 0x334], 0
je 0x485fbf
mov dword [ebp - 0x1614], 1
jmp 0x485fc6
and dword [ebp - 0x1614], 0
cmp dword [ebp - 0x1614], 0xa1265296
jae 0x485fde
mov dword [ebp - 0xb20], 1
jmp 0x485fe5
and dword [ebp - 0xb20], 0
mov eax, dword [ebp - 0x334]
cmp dword [ebp - 0xb20], eax
jl 0x485fff
mov dword [ebp - 0x15ac], 1
jmp 0x486006
and dword [ebp - 0x15ac], 0
cmp dword [ebp - 0x15ac], 0xffffffff
jle 0x48601b
mov dword [ebp - 0x10d8], 1
jmp 0x486022
and dword [ebp - 0x10d8], 0
mov eax, dword [ebp - 0x334]
add eax, dword [ebp - 0x10d8]
cmp eax, 0xffffffff
jg 0x486048
mov eax, 0x3c66883c
test eax, eax
je 0x486048
mov dword [ebp - 0xb28], 1
jmp 0x48604f
and dword [ebp - 0xb28], 0
mov eax, dword [ebp - 0x1930]
cmp dword [ebp - 0xb28], eax
jl 0x486069
mov dword [ebp - 0x1520], 1
jmp 0x486070
and dword [ebp - 0x1520], 0
mov eax, dword [ebp - 0x1520]
mov dword [ebp - 0xb30], eax
mov eax, dword [ebp - 0x334]
sub eax, dword [ebp - 0xb30]
cmp eax, 0xffff
jne 0x48609b
mov dword [ebp - 0x10e0], 1
jmp 0x4860a2
and dword [ebp - 0x10e0], 0
mov eax, dword [ebp - 0x10e0]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
je 0x4860db
cmp dword [ebp - 0x7c], 0
je 0x4860db
push 2
lea ecx, [ebp - 0x2328]
call fcn.0040a3fc
cmp dword [eax], 0
je 0x4860db
mov dword [ebp - 0xb38], 1
jmp 0x4860e2
and dword [ebp - 0xb38], 0
mov eax, dword [ebp - 0xb38]
mov dword [ebp - 0x1938], eax
jmp 0x485eeb
lea ecx, [ebp - 0x2328]
call fcn.0040a3e0
jmp 0x485e85
jmp 0x486435
mov dword [ebp - 0x1f54], 0x8de6
mov dword [ebp - 0xf4], 0x1027339
push 1
lea ecx, [ebp - 0x1ff4]
call fcn.0040a30e
push 4
lea ecx, [ebp - 0x2104]
call fcn.0040a30e
mov dword [ebp - 0x1f5c], 0xfffffffd
mov dword [ebp - 0x1f64], 8
push 1
push 0xc68
lea eax, [ebp - 0x1ff4]
push eax
push 0
push 0x49c7
push 0
push 0x1803
lea eax, [ebp - 0x1f4c]
push eax
push 0x4cc8
call fcn.0046b48a
add esp, 0x24
push 0x4f85
push 0
push 0x20e7
lea eax, [ebp - 0x2104]
push eax
push 0x1acf
push 0
lea eax, [ebp - 0x1f4c]
push eax
push 0x3e8a
push 0x5b21
push 0x16c6
call fcn.0047f68f
add esp, 0x28
lea eax, [ebp - 0x64c]
push eax
push 0x5f69
lea eax, [ebp - 0x7c]
push eax
push 0x13ee
push 0x3c
push 0x59bd
push 0x5905
lea eax, [ebp - 0x130]
push eax
push 0x1603
lea eax, [ebp - 0x28]
push eax
push 0x58a3
push 0
push 0x66a8
push 0x63c5
lea eax, [ebp - 0xf4]
push eax
push 0x7f63
push 1
push 0x5bbc
lea eax, [ebp - 0x1f54]
push eax
push 1
lea eax, [ebp - 0x13b8]
push eax
push 0x1e1c
call fcn.004716cf
add esp, 0x58
mov dword [ebp - 0xf4], 0
jmp 0x48623d
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jg 0x48641f
mov dword [ebp - 0xafc], 0xc91981f0
mov eax, dword [ebp - 0xf4]
mov eax, dword [ebp + eax*4 - 0x2340]
mov dword [ebp - 0x2668], eax
mov eax, dword [ebp - 0x13b8]
neg eax
imul esi, eax, 0x4019
imul esi, dword [ebp - 0x7c]
push 0
lea ecx, [ebp - 0x1ff4]
call fcn.0040a3fc
cmp esi, dword [eax]
jle 0x486296
mov dword [ebp - 0xb40], 1
jmp 0x48629d
and dword [ebp - 0xb40], 0
push 0
lea ecx, [ebp - 0x1ff4]
call fcn.0040a3fc
mov ecx, dword [ebp - 0xb40]
add ecx, dword [eax]
mov dword [ebp - 0x10e8], ecx
push 0
lea ecx, [ebp - 0x2104]
call fcn.0040a3fc
mov ecx, dword [ebp - 0x10e8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x10e8], eax
jne 0x4862e4
mov dword [ebp - 0xb48], 1
jmp 0x4862eb
and dword [ebp - 0xb48], 0
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0xb48]
add ecx, 4
neg ecx
cmp dword [ebp + eax*4 - 0x2340], ecx
jle 0x486311
mov dword [ebp - 0x15d8], 1
jmp 0x486318
and dword [ebp - 0x15d8], 0
mov eax, dword [ebp - 0x15d8]
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0xafc]
mov dword [ebp - 0x1f5c], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x2b34], eax
push 0
lea ecx, [ebp - 0x1ff4]
call fcn.0040a3fc
cmp dword [eax], 0x706cd8fd
jle 0x48635d
mov dword [ebp - 0xb50], 1
jmp 0x486364
and dword [ebp - 0xb50], 0
cmp dword [ebp - 0x28], 9
ja 0x486376
mov dword [ebp - 0xb58], 1
jmp 0x48637d
and dword [ebp - 0xb58], 0
mov eax, dword [ebp - 0xb50]
mov dword [ebp - 0x10f0], eax
mov eax, dword [ebp - 0x10f0]
cmp eax, dword [ebp - 0xb58]
jl 0x4863a3
mov dword [ebp - 0x13c0], 1
jmp 0x4863aa
and dword [ebp - 0x13c0], 0
imul eax, dword [ebp - 0x13c0], 0
test eax, eax
jb 0x4863c1
mov dword [ebp - 0xb60], 1
jmp 0x4863c8
and dword [ebp - 0xb60], 0
push 3
lea ecx, [ebp - 0x2104]
call fcn.0040a3fc
mov ecx, dword [ebp - 0xb60]
mov dword [eax], ecx
mov eax, dword [ebp - 0xafc]
mov dword [ebp - 0x2670], eax
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x2340], ecx
je 0x486407
mov dword [ebp - 0x10f8], 1
jmp 0x48640e
and dword [ebp - 0x10f8], 0
mov eax, dword [ebp - 0x10f8]
mov dword [ebp - 0x1f64], eax
jmp 0x486230
lea ecx, [ebp - 0x2104]
call fcn.0040a3e0
lea ecx, [ebp - 0x1ff4]
call fcn.0040a3e0
push 4
lea ecx, [ebp - 0x2370]
call fcn.0040a30e
push 2
lea ecx, [ebp - 0x988]
call fcn.0040a30e
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x1108], 1
mov dword [ebp - 0x165c], 0xffffffff
mov dword [ebp - 0x1f8c], 0xffffffff
mov dword [ebp - 0x29bc], 0
mov dword [ebp - 0x2678], 4
mov dword [ebp - 0x2b8c], 0xfffffff9
mov dword [ebp - 0x2680], 0xffffffff
push 1
lea eax, [ebp - 0x260]
push eax
push 0x650a
push 1
push 0x287a
push 0x28e9
lea eax, [ebp - 0x988]
push eax
push 0xa4d
push 0
push 0x8e
call fcn.0047405c
add esp, 0x28
mov dword [ebp - 0xb68], 0x3a10
mov dword [ebp - 0x1f6c], 0xa926b8
cmp dword [ebp - 0xb68], 0x3be4
jle 0x486579
push 0
call dword [0xaab294]
and dword [ebp - 0x33c], 0
jmp 0x486516
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0x2e90
jge 0x486579
and dword [ebp - 0x89c], 0
jmp 0x486538
mov eax, dword [ebp - 0x89c]
inc eax
mov dword [ebp - 0x89c], eax
cmp dword [ebp - 0x89c], 0x329f
jge 0x486577
mov eax, dword [ebp - 0x33c]
mov ecx, dword [ebp - 0x89c]
sar eax, cl
cdq
mov dword [ebp - 0x1950], eax
mov dword [ebp - 0x194c], edx
push dword [ebp - 0x194c]
push dword [ebp - 0x1950]
mov ecx, 0xaa82b8
call fcn.00409fb9
jmp 0x48652b
jmp 0x486509
mov dword [ebp - 0x260], 0
jmp 0x486592
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 3
jge 0x4865ae
mov eax, dword [ebp - 0x260]
mov dword [ebp + eax*4 - 0x27b4], 0x2e8b5a47
jmp 0x486585
mov dword [ebp - 4], 2
cmp dword [ebp - 0xb68], 0x384e
jge 0x4865d1
mov edx, dword [ebp - 0x1f6c]
mov ecx, 0xaa82b8
call fcn.0040ca6e
jmp 0x4865ed
or dword [ebp - 4], 0xffffffff
jmp 0x4865f7
mov dword [ebp - 0xb0], 0
jmp 0x486610
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jg 0x4869cc
mov dword [ebp - 0x1f84], 0xcd3624b6
mov dword [ebp - 0x29cc], 9
mov dword [ebp - 0x2688], 0x4b38b4b7
mov dword [ebp - 0x2b3c], 1
mov dword [ebp - 0x1528], 0x1e97
mov dword [ebp - 0x1f74], 0xa92730
cmp dword [ebp - 0x1528], 0x2176
jle 0x48674e
push 0
push 0
push 0
call dword [0xaab3ac]
and dword [ebp - 0x344], 0
jmp 0x48668b
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0x999
jge 0x48674e
and dword [ebp - 0x654], 0
jmp 0x4866b1
mov eax, dword [ebp - 0x654]
inc eax
mov dword [ebp - 0x654], eax
cmp dword [ebp - 0x654], 0x3eed
jge 0x486749
and dword [ebp - 0x34c], 0
jmp 0x4866d7
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0x2414
jge 0x486744
and dword [ebp - 0x7dc], 0
jmp 0x4866f9
mov eax, dword [ebp - 0x7dc]
inc eax
mov dword [ebp - 0x7dc], eax
cmp dword [ebp - 0x7dc], 0x146a
jge 0x486742
mov eax, dword [ebp - 0x344]
add eax, dword [ebp - 0x654]
sub eax, dword [ebp - 0x34c]
sub eax, dword [ebp - 0x7dc]
cdq
mov dword [ebp - 0x195c], eax
mov dword [ebp - 0x1958], edx
push dword [ebp - 0x1958]
push dword [ebp - 0x195c]
mov ecx, 0xaa82b8
call fcn.00409fb9
jmp 0x4866ec
jmp 0x4866ca
jmp 0x4866a4
jmp 0x48667e
push 1
lea ecx, [ebp - 0x27c4]
call fcn.0040a30e
mov dword [ebp - 4], 4
cmp dword [ebp - 0x1528], 0x1c05
jge 0x48677e
mov edx, dword [ebp - 0x1f74]
mov ecx, 0xaa82b8
call fcn.0040ca6e
jmp 0x48679a
or dword [ebp - 4], 0xffffffff
jmp 0x4867a4
push 0
lea eax, [ebp - 0x27c4]
push eax
push 0
push 0x1934
push 0x3fe2
push 0x7c99
lea eax, [ebp - 0x2690]
push eax
push 0x21a4
push 0x31a2
push 0x5cc8
call fcn.0046b7af
add esp, 0x28
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x988]
call fcn.0040a3fc
cmp dword [eax], 0
je 0x48693c
push 0
lea ecx, [ebp - 0x988]
call fcn.0040a3fc
cmp dword [eax], 0
je 0x486815
push 1
lea ecx, [ebp - 0x988]
call fcn.0040a3fc
push 1
lea ecx, [ebp - 0x988]
call fcn.0040a3fc
mov esi, dword [eax]
add esi, 0x43925499
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x988]
call fcn.0040a3fc
cmp esi, dword [eax]
jge 0x48684b
mov dword [ebp - 0xb70], 1
jmp 0x486852
and dword [ebp - 0xb70], 0
cmp dword [ebp - 0xb70], 0x5290ce96
jge 0x48686a
mov dword [ebp - 0x1100], 1
jmp 0x486871
and dword [ebp - 0x1100], 0
mov eax, dword [ebp - 0x1100]
sub eax, 8
jne 0x486897
push 1
lea ecx, [ebp - 0x988]
call fcn.0040a3fc
cmp dword [eax], 0
jne 0x486897
and dword [ebp - 0xb78], 0
jmp 0x4868a1
mov dword [ebp - 0xb78], 1
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x988]
call fcn.0040a3fc
mov esi, eax
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x988]
call fcn.0040a3fc
mov ecx, dword [ebp - 0xb78]
add ecx, dword [eax]
mov esi, dword [esi]
sub esi, ecx
push 1
lea ecx, [ebp - 0x988]
call fcn.0040a3fc
cmp esi, dword [eax]
jg 0x4868ee
mov dword [ebp - 0x13c8], 1
jmp 0x4868f5
and dword [ebp - 0x13c8], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x13c8], eax
je 0x48690f
mov dword [ebp - 0xb80], 1
jmp 0x486916
and dword [ebp - 0xb80], 0
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0x1108], eax
cmp dword [ebp - 0x1108], 0
je 0x48693c
xor eax, eax
inc eax
je 0x48693c
mov dword [ebp - 0x1f7c], 1
jmp 0x486943
and dword [ebp - 0x1f7c], 0
mov esi, dword [ebp - 0xb0]
push 0
lea ecx, [ebp - 0x988]
call fcn.0040a3fc
cmp esi, dword [eax]
jge 0x48696f
mov eax, 0x88c5
test eax, eax
je 0x48696f
mov dword [ebp - 0xb88], 1
jmp 0x486976
and dword [ebp - 0xb88], 0
push 1
lea ecx, [ebp - 0x988]
call fcn.0040a3fc
mov ecx, dword [ebp - 0xb88]
add ecx, dword [eax]
sub ecx, dword [ebp - 0x1f84]
add ecx, dword [ebp - 0x165c]
sub ecx, dword [ebp - 0x165c]
mov dword [ebp - 0x1f8c], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x27b4]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x27b4], eax
lea ecx, [ebp - 0x27c4]
call fcn.0040a3e0
jmp 0x486603
lea ecx, [ebp - 0x988]
call fcn.0040a3e0
push 1
lea ecx, [ebp - 0x22f8]
call fcn.0040a30e
mov dword [ebp - 0x1f94], 0xffffffff
push 1
lea ecx, [ebp - 0x2364]
call fcn.0040a30e
mov dword [ebp - 0x1f9c], 0xfffffffc
mov dword [ebp - 0x2f4], 0
jmp 0x486a1e
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 1
jge 0x486a40
push dword [ebp - 0x2f4]
lea ecx, [ebp - 0x22f8]
call fcn.0040a3fc
mov dword [eax], 0xfffffffb
jmp 0x486a11
push 0
push 0
push 0x60c9
lea eax, [ebp - 0x2f4]
push eax
lea eax, [ebp - 0x2364]
push eax
push 1
call fcn.00476e51
add esp, 0x18
push 0x5c5c
push 1
push 0x1140
lea eax, [ebp - 0x1f94]
push eax
push 1
push 0x32aa
push 0x7f0b
lea eax, [ebp - 0x2364]
push eax
push 1
lea eax, [ebp - 0x22f8]
push eax
lea eax, [ebp - 0x1f9c]
push eax
push 0x400d
push 0x4971
call fcn.004708d7
add esp, 0x34
mov byte [ebp - 0x111], 0
push 0
push 0x47fe
push 0x2605
push 0x7ecd
push 0
push 0x62ba
push 0x5da8
push 0x6513
push 0x3883
push 0x2090
push 1
lea eax, [ebp - 0x111]
push eax
push 0x2035
call fcn.0047a4e9
add esp, 0x34
lea ecx, [ebp - 0x2364]
call fcn.0040a3e0
lea ecx, [ebp - 0x22f8]
call fcn.0040a3e0
push 1
push 0x5ab3
lea eax, [ebp - 0x1fb4]
push eax
push 0x7614
lea eax, [ebp - 0x2388]
push eax
push 0x4993
push 0x34fc
push 0
call fcn.00472278
add esp, 0x20
mov dword [ebp - 0x65c], 0x42c70bb7
mov dword [ebp - 0x354], 0
jmp 0x486b59
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 3
jge 0x486b75
mov eax, dword [ebp - 0x354]
mov dword [ebp + eax*4 - 0x3208], 0xfffffffc
jmp 0x486b4c
mov dword [ebp - 0x65c], 2
jmp 0x486b8e
mov eax, dword [ebp - 0x65c]
dec eax
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jl 0x486e7d
mov dword [ebp - 0xb90], 0x1590
mov dword [ebp - 0x1fa4], 0xa92764
cmp dword [ebp - 0xb90], 0x181a
jle 0x486c67
and dword [ebp - 0x364], 0
jmp 0x486bd5
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0x5119
jge 0x486c67
and dword [ebp - 0x35c], 0
jmp 0x486bfb
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0x4d4a
jge 0x486c62
and dword [ebp - 0x954], 0
jmp 0x486c1d
mov eax, dword [ebp - 0x954]
inc eax
mov dword [ebp - 0x954], eax
cmp dword [ebp - 0x954], 0x7695
jge 0x486c60
mov eax, dword [ebp - 0x35c]
sub eax, dword [ebp - 0x954]
and eax, dword [ebp - 0x364]
cdq
mov dword [ebp - 0x1968], eax
mov dword [ebp - 0x1964], edx
push dword [ebp - 0x1964]
push dword [ebp - 0x1968]
mov ecx, 0xaa82b8
call fcn.00409fb9
jmp 0x486c10
jmp 0x486bee
jmp 0x486bc8
mov dword [ebp - 0x664], 1
mov dword [ebp - 4], 6
cmp dword [ebp - 0xb90], 0x1489
jge 0x486c94
mov edx, dword [ebp - 0x1fa4]
mov ecx, 0xaa82b8
call fcn.0040ca6e
jmp 0x486cb0
or dword [ebp - 4], 0xffffffff
jmp 0x486cba
mov dword [ebp - 0x664], 2
jmp 0x486cd3
mov eax, dword [ebp - 0x664]
dec eax
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 0
jl 0x486e78
mov byte [ebp - 0x1a1], 0
mov dword [ebp - 0x1110], 0x41b2
mov dword [ebp - 0x1fac], 0xa92780
cmp dword [ebp - 0x1110], 0x4498
jle 0x486e1b
push 0x1540
push 0x149b
push 0
call dword [0xaab498]
and dword [ebp - 0x374], 0
jmp 0x486d33
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0x7467
jge 0x486e1b
and dword [ebp - 0x36c], 0
jmp 0x486d59
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0x1552
jge 0x486e16
and dword [ebp - 0x7e4], 0
jmp 0x486d7f
mov eax, dword [ebp - 0x7e4]
inc eax
mov dword [ebp - 0x7e4], eax
cmp dword [ebp - 0x7e4], 0x55d8
jge 0x486e11
and dword [ebp - 0x66c], 0
jmp 0x486da5
mov eax, dword [ebp - 0x66c]
inc eax
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x66c], 0x7422
jge 0x486e0c
mov ecx, dword [ebp - 0x36c]
sub ecx, dword [ebp - 0x7e4]
mov eax, dword [ebp - 0x374]
shl eax, cl
and eax, dword [ebp - 0x66c]
cdq
mov dword [ebp - 0x1974], eax
mov dword [ebp - 0x1970], edx
push dword [ebp - 0x1970]
push dword [ebp - 0x1974]
lea ecx, [ebp - 0x3268]
call fcn.004019b1
pop ecx
pop ecx
mov ecx, eax
call fcn.00409fae
push eax
call fcn.004a91a7
pop ecx
lea ecx, [ebp - 0x3268]
call fcn.00409fa4
jmp 0x486d98
jmp 0x486d72
jmp 0x486d4c
jmp 0x486d26
push 1
lea eax, [ebp - 0x1a1]
push eax
push 0
call fcn.00470d49
add esp, 0xc
mov dword [ebp - 4], 8
cmp dword [ebp - 0x1110], 0x403a
jge 0x486e4d
push dword [ebp - 0x1fac]
call fcn.004a91a7
pop ecx
jmp 0x486e69
or dword [ebp - 4], 0xffffffff
jmp 0x486e73
jmp 0x486cc6
jmp 0x486b81
push 1
push 0x4571
push 1
call fcn.00470d49
add esp, 0xc
push 0
push 0x677d
lea eax, [ebp - 0x1fb4]
push eax
push 0xbc1
push 0
lea eax, [ebp - 0x2370]
push eax
call fcn.00485514
add esp, 0x18
mov dword [ebp - 0xb98], 0x619d
mov dword [ebp - 0x1fdc], 0xa927c0
cmp dword [ebp - 0xb98], 0x656d
jle 0x486fa2
and dword [ebp - 0x37c], 0
jmp 0x486eec
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0x4d3e
jge 0x486fa2
and dword [ebp - 0x8a4], 0
jmp 0x486f12
mov eax, dword [ebp - 0x8a4]
inc eax
mov dword [ebp - 0x8a4], eax
cmp dword [ebp - 0x8a4], 0x4a74
jge 0x486f9d
and dword [ebp - 0x384], 0
jmp 0x486f34
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0x3be3
jge 0x486f98
mov eax, dword [ebp - 0x37c]
cdq
idiv dword [ebp - 0x8a4]
mov ecx, dword [ebp - 0x384]
shl edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x1980], eax
mov dword [ebp - 0x197c], edx
push dword [ebp - 0x197c]
push dword [ebp - 0x1980]
lea ecx, [ebp - 0x2e84]
call fcn.004019b1
pop ecx
pop ecx
mov ecx, eax
call fcn.00409fae
push eax
call fcn.004a91a7
pop ecx
lea ecx, [ebp - 0x2e84]
call fcn.00409fa4
jmp 0x486f27
jmp 0x486f05
jmp 0x486edf
push 2
lea ecx, [ebp - 0x2358]
call fcn.0040a30e
mov dword [ebp - 0x2fc], 0
mov dword [ebp - 0x1fcc], 1
mov dword [ebp - 0x1fc4], 0xffffffff
mov dword [ebp - 0x1fbc], 0xffffffff
mov dword [ebp - 0x29dc], 0
mov dword [ebp - 0x2698], 4
mov dword [ebp - 0x2bb8], 0xfffffff9
mov dword [ebp - 0x26a0], 0xffffffff
mov dword [ebp - 0xb4], 0
jmp 0x487018
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jge 0x48703a
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x2358]
call fcn.0040a3fc
mov dword [eax], 0xfffffff6
jmp 0x48700b
mov dword [ebp - 0xb4], 0
jmp 0x487053
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x48706f
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x27d4], 0x2e8b5a47
jmp 0x487046
mov dword [ebp - 0x2fc], 0
jmp 0x487088
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 1
jg 0x487161
mov dword [ebp - 0x1fd4], 0xcd3624b6
mov dword [ebp - 0x29ec], 9
mov dword [ebp - 0x26a8], 0x4b38b4b7
mov dword [ebp - 0x2b44], 1
push 1
lea ecx, [ebp - 0x27e4]
call fcn.0040a30e
lea eax, [ebp - 0x26b0]
push eax
push 0x5f9d
lea eax, [ebp - 0x27e4]
push eax
push 0x29df
push 0x33c1
push 0x2d1a
push 1
push 0
call fcn.0047e219
add esp, 0x20
lea eax, [ebp - 0x1fbc]
push eax
push 0
push 0
push 0x34c1
push 0x452a
lea eax, [ebp - 0x2358]
push eax
lea eax, [ebp - 0x1fc4]
push eax
lea eax, [ebp - 0x2fc]
push eax
lea eax, [ebp - 0x1fcc]
push eax
lea eax, [ebp - 0x1fd4]
push eax
call fcn.004857be
add esp, 0x28
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x27d4]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x27d4], eax
lea ecx, [ebp - 0x27e4]
call fcn.0040a3e0
jmp 0x48707b
lea ecx, [ebp - 0x2358]
call fcn.0040a3e0
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0xb98], 0x5fc7
jge 0x48718b
push dword [ebp - 0x1fdc]
call fcn.004a91a7
pop ecx
jmp 0x4871a7
or dword [ebp - 4], 0xffffffff
jmp 0x4871b1
push 1
push 0x4227
lea eax, [ebp - 0x2388]
push eax
push 0
push 0x54f0
push 0x65c7
lea eax, [ebp - 0x1fe4]
push eax
lea eax, [ebp - 0x20f0]
push eax
push 0x2243
lea eax, [ebp - 0x2370]
push eax
call fcn.004711c0
add esp, 0x28
lea ecx, [ebp - 0x2370]
call fcn.0040a3e0
lea ecx, [ebp - 0x2388]
call fcn.0040a3e0
mov dword [ebp - 0x13d0], 0x41e5
mov dword [ebp - 0xba0], 0xf57a7c20
mov dword [ebp - 0x674], 0
jmp 0x487230
mov eax, dword [ebp - 0x674]
inc eax
mov dword [ebp - 0x674], eax
cmp dword [ebp - 0x674], 3
jge 0x48724c
mov eax, dword [ebp - 0x674]
mov dword [ebp + eax*4 - 0x2db8], 3
jmp 0x487223
mov eax, dword [ebp - 0x13d0]
mov dword [ebp - 0xba0], eax
push 1
push 0x4987
push 0x54c3
push 0x7ef3
push 1
push 0x5680
lea eax, [ebp - 0x13d0]
push eax
push 0x7cb0
push 0x7b8c
push 0x55e3
push 0x1d3a
lea eax, [ebp - 0xba0]
push eax
push 0x1e6e
push 0x500c
push 0
call fcn.00484b8c
add esp, 0x3c
mov byte [ebp - 0x29], 0
push 1
lea ecx, [ebp - 0x1b8]
call fcn.0040a30e
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x138], 0xa0c0e075
mov dword [ebp - 0x21bc], 1
mov dword [ebp - 0x21b8], 1
mov dword [ebp - 0x21b4], 1
mov dword [ebp - 0x21b0], 1
mov dword [ebp - 0x29fc], 0x908cb2cc
mov dword [ebp - 0x26b8], 0xfea38a5b
mov dword [ebp - 0x1ccc], 0xfffffff8
mov dword [ebp - 0x2b94], 1
push 0
lea eax, [ebp - 0x26c0]
push eax
push 0
push 0x457a
push 1
lea eax, [ebp - 0x1b8]
push eax
call fcn.004739a0
add esp, 0x18
push 0
lea ecx, [ebp - 0x1b8]
call fcn.0040a3fc
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2a0c], eax
push 0
lea ecx, [ebp - 0x1b8]
call fcn.0040a3fc
mov esi, eax
push 0
lea ecx, [ebp - 0x1b8]
call fcn.0040a3fc
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x487382
mov dword [ebp - 0x1118], 1
jmp 0x487389
and dword [ebp - 0x1118], 0
cmp dword [ebp - 0x1118], 0xfffffff6
jbe 0x48739e
mov dword [ebp - 0xba8], 1
jmp 0x4873a5
and dword [ebp - 0xba8], 0
mov esi, dword [ebp - 0xba8]
sub esi, dword [ebp - 0x1c]
push 0
lea ecx, [ebp - 0x1b8]
call fcn.0040a3fc
cmp esi, dword [eax]
jge 0x4873d1
cmp dword [ebp - 0x1c], 0
je 0x4873d1
mov dword [ebp - 0x1530], 1
jmp 0x4873d8
and dword [ebp - 0x1530], 0
push 0
lea ecx, [ebp - 0x1b8]
call fcn.0040a3fc
mov ecx, dword [ebp - 0x1530]
cmp ecx, dword [eax]
jne 0x4873fb
mov dword [ebp - 0xbb0], 1
jmp 0x487402
and dword [ebp - 0xbb0], 0
push 0
lea ecx, [ebp - 0x1b8]
call fcn.0040a3fc
mov ecx, dword [ebp - 0xbb0]
cmp ecx, dword [eax]
je 0x487425
mov dword [ebp - 0x1120], 1
jmp 0x48742c
and dword [ebp - 0x1120], 0
push 0
lea ecx, [ebp - 0x1b8]
call fcn.0040a3fc
mov ecx, dword [ebp - 0x1120]
cmp ecx, dword [eax]
je 0x48744f
mov dword [ebp - 0xbb8], 1
jmp 0x487456
and dword [ebp - 0xbb8], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xbb8], eax
jge 0x48746d
mov dword [ebp - 0x13d8], 1
jmp 0x487474
and dword [ebp - 0x13d8], 0
mov eax, dword [ebp - 0x13d8]
sub eax, 0x53526c71
cmp eax, 1
ja 0x487490
mov dword [ebp - 0xbc0], 1
jmp 0x487497
and dword [ebp - 0xbc0], 0
push 0
lea ecx, [ebp - 0x1b8]
call fcn.0040a3fc
mov eax, dword [eax]
cmp eax, dword [ebp - 0xbc0]
jge 0x4874ba
mov dword [ebp - 0x1128], 1
jmp 0x4874c1
and dword [ebp - 0x1128], 0
push 0
lea ecx, [ebp - 0x1b8]
call fcn.0040a3fc
mov ecx, dword [ebp - 0x1128]
cmp ecx, dword [eax]
je 0x4874e4
mov dword [ebp - 0xbc8], 1
jmp 0x4874eb
and dword [ebp - 0xbc8], 0
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0x138], eax
mov esi, dword [ebp - 0x138]
push 0
lea ecx, [ebp - 0x1b8]
call fcn.0040a3fc
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x1b8]
call fcn.0040a3fc
cmp dword [eax], esi
jg 0x487703
mov dword [ebp - 0xbd8], 1
mov dword [ebp - 0x38c], 0
jmp 0x487544
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 3
jge 0x487560
mov eax, dword [ebp - 0x38c]
mov dword [ebp + eax*4 - 0x2bf8], 1
jmp 0x487537
mov dword [ebp - 0x138], 0xfffffffb
jmp 0x487579
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x12
jle 0x487701
mov dword [ebp - 0x26c8], 1
mov dword [ebp - 0x7ec], 0
jmp 0x4875a9
mov eax, dword [ebp - 0x7ec]
inc eax
mov dword [ebp - 0x7ec], eax
cmp dword [ebp - 0x7ec], 3
jge 0x4875c5
mov eax, dword [ebp - 0x7ec]
mov dword [ebp + eax*4 - 0x27f4], 0x674f9af3
jmp 0x48759c
mov dword [ebp - 0x1c], 0xffffffe7
jmp 0x4875d5
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xd
jle 0x4876db
mov dword [ebp - 0xb04], 0xfbcae26e
push 0
lea ecx, [ebp - 0x1b8]
call fcn.0040a3fc
mov dword [eax], 0xe511bd77
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jne 0x487610
mov dword [ebp - 0x15e0], 1
jmp 0x487617
and dword [ebp - 0x15e0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2bf8]
cmp dword [ebp - 0x15e0], eax
jne 0x487638
mov dword [ebp - 0xbd0], 1
jmp 0x48763f
and dword [ebp - 0xbd0], 0
push 0
lea ecx, [ebp - 0x1b8]
call fcn.0040a3fc
mov eax, dword [eax]
cmp eax, dword [ebp - 0xbd0]
jle 0x487662
mov dword [ebp - 0x1130], 1
jmp 0x487669
and dword [ebp - 0x1130], 0
mov eax, dword [ebp - 0xbd8]
imul eax, dword [ebp - 0xb04]
mov ecx, dword [ebp - 0x1130]
lea eax, [eax + ecx - 1]
mov ecx, dword [ebp - 0xb04]
dec ecx
mov dword [ebp - 0xb04], ecx
cmp eax, 1
je 0x4876a7
xor eax, eax
inc eax
jne 0x4876a7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x27f4], 0
je 0x4876bc
cmp dword [ebp - 0xbd8], 0
je 0x4876bc
mov dword [ebp - 0x13e0], 1
jmp 0x4876c3
and dword [ebp - 0x13e0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x13e0]
mov dword [ebp + eax - 0x27f4], ecx
jmp 0x4875ce
mov byte [ebp - 0x12b], 0
lea eax, [ebp - 0x12b]
push eax
push 1
push 0
push 0
push 0x5d5e
call fcn.00482b5c
add esp, 0x14
jmp 0x48756c
jmp 0x487717
mov dword [ebp - 0x20f8], 0xfffffffe
mov dword [ebp - 0x20f8], 0xfffffffc
mov dword [ebp - 0x1c], 0
jmp 0x487727
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1a
jl 0x487970
mov dword [ebp - 0x1538], 0x72c95c8f
mov dword [ebp - 0x228], 0xedd67940
mov dword [ebp - 0xbe0], 0xf5726b06
mov dword [ebp - 0x1140], 0x996bd0c
mov dword [ebp - 0x2b4c], 0xd331f862
push 3
lea ecx, [ebp - 0x2804]
call fcn.0040a30e
mov dword [ebp - 0x394], 0
jmp 0x487789
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 3
jge 0x4877ab
push dword [ebp - 0x394]
lea ecx, [ebp - 0x2804]
call fcn.0040a3fc
mov dword [eax], 0xdd0043bd
jmp 0x48777c
mov dword [ebp - 0xbe0], 0xffffffff
cmp dword [ebp - 0xbe0], 0
jne 0x4877d0
mov eax, 0x4f20
test eax, eax
jne 0x4877d0
and dword [ebp - 0x20e4], 0
jmp 0x4877da
mov dword [ebp - 0x20e4], 1
mov eax, dword [ebp - 0x1538]
neg eax
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x26d0], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x2a1c], eax
cmp dword [ebp - 0x228], 0xfffb
jae 0x487818
mov dword [ebp - 0x1138], 1
jmp 0x48781f
and dword [ebp - 0x1138], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1138], eax
jne 0x487836
mov dword [ebp - 0xbe8], 1
jmp 0x48783d
and dword [ebp - 0xbe8], 0
push 0
lea ecx, [ebp - 0x1b8]
call fcn.0040a3fc
mov ecx, dword [ebp - 0xbe8]
imul ecx, dword [eax]
test ecx, ecx
jne 0x487869
cmp dword [ebp - 0x228], 0
jne 0x487869
and dword [ebp - 0x1e30], 0
jmp 0x487873
mov dword [ebp - 0x1e30], 1
push 0
lea ecx, [ebp - 0x1b8]
call fcn.0040a3fc
push 0
lea ecx, [ebp - 0x1b8]
call fcn.0040a3fc
mov esi, eax
push 0
lea ecx, [ebp - 0x1b8]
call fcn.0040a3fc
mov ecx, dword [esi]
imul ecx, dword [eax]
test ecx, ecx
jne 0x4878b7
cmp dword [ebp - 0x1140], 0
jne 0x4878b7
and dword [ebp - 0xbf0], 0
jmp 0x4878c1
mov dword [ebp - 0xbf0], 1
mov eax, dword [ebp - 0x1538]
add eax, dword [ebp - 0xbf0]
cmp eax, dword [ebp - 0x1c]
jl 0x4878e0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x21bc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x21bc]
cmp dword [ebp - 0x138], eax
jg 0x487901
mov dword [ebp - 0xbf8], 1
jmp 0x487908
and dword [ebp - 0xbf8], 0
mov eax, dword [ebp - 0x1140]
imul eax, dword [ebp - 0xbf8]
cmp eax, 0xb45d
je 0x487928
mov dword [ebp - 0x13e8], 1
jmp 0x48792f
and dword [ebp - 0x13e8], 0
mov esi, dword [ebp - 0x13e8]
neg esi
push 0
lea ecx, [ebp - 0x1b8]
call fcn.0040a3fc
mov dword [eax], esi
push 1
push 1
lea eax, [ebp - 0x1ccc]
push eax
push 0
push 0x13f4
call fcn.00479c16
add esp, 0x14
lea ecx, [ebp - 0x2804]
call fcn.0040a3e0
jmp 0x487720
lea ecx, [ebp - 0x1b8]
call fcn.0040a3e0
mov dword [ebp - 0xc98], 0x19b2
mov dword [ebp - 0x1e94], 0xa92830
cmp dword [ebp - 0xc98], 0x1d6d
jle 0x487a45
and dword [ebp - 0x67c], 0
jmp 0x4879b5
mov eax, dword [ebp - 0x67c]
inc eax
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 0x3ce6
jge 0x487a36
and dword [ebp - 0x39c], 0
jmp 0x4879d7
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 0xc85
jge 0x487a31
mov eax, dword [ebp - 0x67c]
imul eax, dword [ebp - 0x39c]
cdq
mov dword [ebp - 0x198c], eax
mov dword [ebp - 0x1988], edx
push dword [ebp - 0x1988]
push dword [ebp - 0x198c]
lea ecx, [ebp - 0x30a0]
call fcn.004019b1
pop ecx
pop ecx
mov ecx, eax
call fcn.00409fae
push eax
call fcn.004a91a7
pop ecx
lea ecx, [ebp - 0x30a0]
call fcn.00409fa4
jmp 0x4879ca
jmp 0x4879a8
push 0
push 0x1a1b
push 0
call dword [0xaab3bc]
mov dword [ebp - 0xc00], 0x5992
mov dword [ebp - 0x1918], 0xa92884
cmp dword [ebp - 0xc00], 0x5ce7
jle 0x487b01
and dword [ebp - 0x904], 0
jmp 0x487a7f
mov eax, dword [ebp - 0x904]
inc eax
mov dword [ebp - 0x904], eax
cmp dword [ebp - 0x904], 0x287c
jge 0x487b01
and dword [ebp - 0x3a4], 0
jmp 0x487aa1
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0x4e25
jge 0x487afc
mov eax, dword [ebp - 0x904]
mov ecx, dword [ebp - 0x3a4]
shl eax, cl
cdq
mov dword [ebp - 0x1998], eax
mov dword [ebp - 0x1994], edx
push dword [ebp - 0x1994]
push dword [ebp - 0x1998]
lea ecx, [ebp - 0x2eb4]
call fcn.004019b1
pop ecx
pop ecx
mov ecx, eax
call fcn.00409fae
push eax
call fcn.004a91a7
pop ecx
lea ecx, [ebp - 0x2eb4]
call fcn.00409fa4
jmp 0x487a94
jmp 0x487a72
mov dword [ebp - 4], 0xc
cmp dword [ebp - 0xc00], 0x57c5
jge 0x487b20
push dword [ebp - 0x1918]
call fcn.004a91a7
pop ecx
jmp 0x487b3c
or dword [ebp - 4], 0xffffffff
jmp 0x487b46
mov dword [ebp - 0xa84], 5
push 2
lea ecx, [ebp - 0x2824]
call fcn.0040a30e
mov dword [ebp - 0x26d8], 1
mov dword [ebp - 0x2bd8], 3
push 3
lea ecx, [ebp - 0x2814]
call fcn.0040a30e
mov dword [ebp - 0x1148], 0x2b5f
mov dword [ebp - 0x1724], 0xa928e4
cmp dword [ebp - 0x1148], 0x2e39
jle 0x487c4f
and dword [ebp - 0x684], 0
jmp 0x487bb8
mov eax, dword [ebp - 0x684]
inc eax
mov dword [ebp - 0x684], eax
cmp dword [ebp - 0x684], 0x480a
jge 0x487c38
and dword [ebp - 0x3ac], 0
jmp 0x487bda
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 0x48d8
jge 0x487c33
mov eax, dword [ebp - 0x684]
add eax, dword [ebp - 0x3ac]
cdq
mov dword [ebp - 0x19a4], eax
mov dword [ebp - 0x19a0], edx
push dword [ebp - 0x19a0]
push dword [ebp - 0x19a4]
lea ecx, [ebp - 0x31b4]
call fcn.004019b1
pop ecx
pop ecx
mov ecx, eax
call fcn.00409fae
push eax
call fcn.004a91a7
pop ecx
lea ecx, [ebp - 0x31b4]
call fcn.00409fa4
jmp 0x487bcd
jmp 0x487bab
push 0x170
push 0x1951
push 0
push 0x10b7
call dword [0xaab470]
mov dword [ebp - 4], 0xe
cmp dword [ebp - 0x1148], 0x298c
jge 0x487c6e
push dword [ebp - 0x1724]
call fcn.004a91a7
pop ecx
jmp 0x487c8a
or dword [ebp - 4], 0xffffffff
jmp 0x487c94
mov dword [ebp - 0x9c], 0
jmp 0x487cad
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jge 0x487cc9
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x2d34], 0xffffffff
jmp 0x487ca0
push 0xdf4
lea eax, [ebp - 0x9c]
push eax
push 1
push 1
lea eax, [ebp - 0x2824]
push eax
call fcn.00470e25
add esp, 0x14
mov dword [ebp - 0x9c], 0
jmp 0x487d01
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x487d23
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x2814]
call fcn.0040a3fc
mov dword [eax], 0x7b30477a
jmp 0x487cf4
cmp dword [ebp - 0xa84], 0x38ec
jg 0x487d3b
mov dword [ebp - 0x1e54], 1
jmp 0x487d42
and dword [ebp - 0x1e54], 0
mov eax, dword [ebp - 0xa84]
mov dword [ebp - 0x26e0], eax
mov dword [ebp - 0xa84], 0xc511ec1f
push 0x7b2a
push 0
push 0x11d4
push 0x5e99
push 0x206d
push 0x42ff
push 1
call fcn.004795f9
add esp, 0x1c
lea ecx, [ebp - 0x2814]
call fcn.0040a3e0
lea ecx, [ebp - 0x2824]
call fcn.0040a3e0
mov dword [ebp - 0xc08], 0xe57ad95e
mov dword [ebp - 0x172c], 9
push 1
lea ecx, [ebp - 0x23a0]
call fcn.0040a30e
mov dword [ebp - 0x7f4], 0
jmp 0x487dcd
mov eax, dword [ebp - 0x7f4]
inc eax
mov dword [ebp - 0x7f4], eax
cmp dword [ebp - 0x7f4], 1
jge 0x487def
push dword [ebp - 0x7f4]
lea ecx, [ebp - 0x23a0]
call fcn.0040a3fc
mov dword [eax], 0xfffffffc
jmp 0x487dc0
lea eax, [ebp - 0x172c]
push eax
push 0
push 0
push 0x157f
lea eax, [ebp - 0xc08]
push eax
push 0x7e77
call fcn.0046b05e
add esp, 0x18
push 0x6eb9
push 0x7f60
push 0x397c
push 1
lea eax, [ebp - 0x23a0]
push eax
lea eax, [ebp - 0xc08]
push eax
push 1
call fcn.00470ee1
add esp, 0x1c
lea ecx, [ebp - 0x23a0]
call fcn.0040a3e0
mov dword [ebp - 0x1190], 0x41e5
mov dword [ebp - 0x230], 0xf57a7c20
or dword [ebp - 0x2244], 0xffffffff
or dword [ebp - 0x2240], 0xffffffff
or dword [ebp - 0x223c], 0xffffffff
or dword [ebp - 0x2238], 0xffffffff
lea ecx, [ebp - 0xae1]
call fcn.0040a40b
push eax
lea eax, [ebp - 0x2234]
push eax
lea eax, [ebp - 0x2244]
push eax
lea ecx, [ebp - 0x2c84]
call fcn.0040a40e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2834]
call fcn.0040a3ba
mov dword [ebp - 0x1cd8], 3
push 1
push 0x1843
push 1
lea eax, [ebp - 0x2834]
push eax
push 0x1ace
lea eax, [ebp - 0x1cd8]
push eax
push 0x3358
push 0x6f12
call fcn.004710ae
add esp, 0x20
lea ecx, [ebp - 0x2834]
call fcn.0040a3e0
push 1
lea ecx, [ebp - 0x23b8]
call fcn.0040a30e
mov dword [ebp - 0x2c8], 1
lea eax, [ebp - 0x23b8]
push eax
push 1
push 1
lea eax, [ebp - 0x2a2c]
push eax
call fcn.00471530
add esp, 0x10
mov dword [ebp - 0x2c8], 0
jmp 0x487f39
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0
jg 0x487ffe
mov dword [ebp - 0x1e5c], 0x81f3403c
mov dword [ebp - 0x1734], 0
push 0x7e38
push 0x4cd7
push 0x5e18
push 0x4915
lea eax, [ebp - 0x23b8]
push eax
push 0x49b9
lea eax, [ebp - 0x2c8]
push eax
push 0x42cd
push 0x680d
push 0x1744
push 0x7692
push 1
push 0xf8d
lea eax, [ebp - 0x1734]
push eax
push 0x6940
push 0x4d94
push 1
push 0x4b13
push 0x6e3
push 1
push 0x5f85
lea eax, [ebp - 0x1e5c]
push eax
call fcn.004716cf
add esp, 0x58
push 1
push 0x4264
push 0xf14
push 0xf9
push 0x12d7
push 0x1823
push 0x1101
push 1
call fcn.00472278
add esp, 0x20
jmp 0x487f2c
lea ecx, [ebp - 0x23b8]
call fcn.0040a3e0
mov dword [ebp - 0x1150], 1
mov dword [ebp - 0x173c], 0xa421e0be
mov dword [ebp - 0xc20], 0xffffffff
mov dword [ebp - 0x219c], 0
mov dword [ebp - 0x2198], 0
mov dword [ebp - 0x2194], 0
mov dword [ebp - 0x2190], 0
mov dword [ebp - 0xc10], 0xfffffffc
mov dword [ebp - 0x26e8], 0xffffffff
push 1
lea ecx, [ebp - 0x1708]
call fcn.0040a30e
mov dword [ebp - 0x1e64], 0xfeea3821
mov dword [ebp - 0xa0c], 0xb6ea1325
mov dword [ebp - 0x13f0], 1
mov dword [ebp - 0x1cf0], 0xde45
mov dword [ebp - 0x1754], 0xfffffff9
mov dword [ebp - 0x3b4], 0
jmp 0x4880bb
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 1
jge 0x4880dd
push dword [ebp - 0x3b4]
lea ecx, [ebp - 0x1708]
call fcn.0040a3fc
mov dword [eax], 0x7a30b913
jmp 0x4880ae
mov eax, dword [ebp - 0x1150]
mov dword [ebp - 0x2b54], eax
mov eax, dword [ebp - 0xa0c]
inc eax
mov dword [ebp - 0xa0c], eax
mov eax, dword [ebp - 0x173c]
cmp dword [ebp - 0xa0c], eax
jge 0x488110
mov dword [ebp - 0x1638], 1
jmp 0x488117
and dword [ebp - 0x1638], 0
push 0
lea ecx, [ebp - 0x1708]
call fcn.0040a3fc
mov eax, dword [ebp - 0xc10]
mov dword [ebp - 0x26f0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1638]
sub ecx, dword [ebp + eax - 0x219c]
je 0x488158
push 9
pop eax
test eax, eax
je 0x488158
mov dword [ebp - 0x1ce4], 1
jmp 0x48815f
and dword [ebp - 0x1ce4], 0
cmp dword [ebp - 0xc10], 0
je 0x48817d
mov eax, 0xbfede048
test eax, eax
je 0x48817d
mov dword [ebp - 0x1744], 1
jmp 0x488184
and dword [ebp - 0x1744], 0
mov eax, dword [ebp - 0x1e64]
mov dword [ebp - 0x2a3c], eax
cmp dword [ebp - 0x1150], 1
jl 0x4881a5
mov dword [ebp - 0xc18], 1
jmp 0x4881ac
and dword [ebp - 0xc18], 0
mov eax, dword [ebp - 0xc18]
mov dword [ebp - 0x13f0], eax
cmp dword [ebp - 0x13f0], 0xcb87
jg 0x4881d0
mov dword [ebp - 0x174c], 1
jmp 0x4881d7
and dword [ebp - 0x174c], 0
push 0
lea ecx, [ebp - 0x1708]
call fcn.0040a3fc
mov dword [ebp - 0xc20], 0xfce3badf
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x219c]
cmp dword [ebp - 0xc20], eax
je 0x48820e
mov dword [ebp - 0x1158], 1
jmp 0x488215
and dword [ebp - 0x1158], 0
push 0
lea ecx, [ebp - 0x1708]
call fcn.0040a3fc
mov ecx, dword [ebp - 0x1158]
cmp ecx, dword [eax]
je 0x488238
mov dword [ebp - 0xc28], 1
jmp 0x48823f
and dword [ebp - 0xc28], 0
push 0
lea ecx, [ebp - 0x1708]
call fcn.0040a3fc
mov ecx, dword [ebp - 0xc28]
cmp ecx, dword [eax]
je 0x488262
mov dword [ebp - 0x1540], 1
jmp 0x488269
and dword [ebp - 0x1540], 0
mov eax, dword [ebp - 0x1cf0]
cmp dword [ebp - 0x1540], eax
jne 0x488283
mov dword [ebp - 0xc30], 1
jmp 0x48828a
and dword [ebp - 0xc30], 0
mov eax, dword [ebp - 0xc30]
mov dword [ebp - 0x1754], eax
lea ecx, [ebp - 0x1708]
call fcn.0040a3e0
mov dword [ebp - 0x68c], 0
jmp 0x4882ba
mov eax, dword [ebp - 0x68c]
inc eax
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x68c], 3
jge 0x4882d6
mov eax, dword [ebp - 0x68c]
mov dword [ebp + eax*4 - 0x304c], 3
jmp 0x4882ad
mov dword [ebp - 0x21c], 0xfffffff8
mov dword [ebp - 0x1160], 0x785a
mov dword [ebp - 0x1e6c], 0xa9291c
cmp dword [ebp - 0x1160], 0x7901
jle 0x4883e3
and dword [ebp - 0x3bc], 0
jmp 0x48831a
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 0x7348
jge 0x4883e3
and dword [ebp - 0x8ac], 0
jmp 0x488340
mov eax, dword [ebp - 0x8ac]
inc eax
mov dword [ebp - 0x8ac], eax
cmp dword [ebp - 0x8ac], 0x212f
jge 0x4883de
and dword [ebp - 0x3c4], 0
jmp 0x488366
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 0x6c5f
jge 0x4883d9
and dword [ebp - 0x694], 0
jmp 0x488388
mov eax, dword [ebp - 0x694]
inc eax
mov dword [ebp - 0x694], eax
cmp dword [ebp - 0x694], 0x750
jge 0x4883d7
mov eax, dword [ebp - 0x3bc]
mov ecx, dword [ebp - 0x8ac]
shl eax, cl
mov edx, dword [ebp - 0x3c4]
mov ecx, dword [ebp - 0x694]
shl edx, cl
and eax, edx
cdq
mov dword [ebp - 0x19b0], eax
mov dword [ebp - 0x19ac], edx
push dword [ebp - 0x19ac]
push dword [ebp - 0x19b0]
mov ecx, 0xaa82b8
call fcn.00409fb9
jmp 0x48837b
jmp 0x488359
jmp 0x488333
jmp 0x48830d
mov dword [ebp - 0x58], 8
mov dword [ebp - 4], 0x10
cmp dword [ebp - 0x1160], 0x7797
jge 0x48840d
mov edx, dword [ebp - 0x1e6c]
mov ecx, 0xaa82b8
call fcn.0040ca6e
jmp 0x488429
or dword [ebp - 4], 0xffffffff
jmp 0x488433
mov dword [ebp - 0xc38], 0x635
mov dword [ebp - 0x175c], 0xa92958
cmp dword [ebp - 0xc38], 0x7f8
jle 0x48853c
push 0x1456
call dword [0xaab0f0]
and dword [ebp - 0x69c], 0
jmp 0x488478
mov eax, dword [ebp - 0x69c]
inc eax
mov dword [ebp - 0x69c], eax
cmp dword [ebp - 0x69c], 0x627c
jge 0x48853c
and dword [ebp - 0x3cc], 0
jmp 0x48849e
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0x22fb
jge 0x488537
and dword [ebp - 0x7fc], 0
jmp 0x4884c4
mov eax, dword [ebp - 0x7fc]
inc eax
mov dword [ebp - 0x7fc], eax
cmp dword [ebp - 0x7fc], 0x7949
jge 0x488532
and dword [ebp - 0x3d4], 0
jmp 0x4884e6
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 0x282a
jge 0x488530
mov eax, dword [ebp - 0x3cc]
imul eax, dword [ebp - 0x7fc]
add eax, dword [ebp - 0x3d4]
or eax, dword [ebp - 0x69c]
cdq
mov dword [ebp - 0x19bc], eax
mov dword [ebp - 0x19b8], edx
push dword [ebp - 0x19b8]
push dword [ebp - 0x19bc]
mov ecx, 0xaa82b8
call fcn.00409fb9
jmp 0x4884d9
jmp 0x4884b7
jmp 0x488491
jmp 0x48846b
mov dword [ebp - 0x24e8], 0xb0d69b45
mov dword [ebp - 0x24e4], 0xb0d69b45
mov dword [ebp - 0x24e0], 0xb0d69b45
mov dword [ebp - 0x24dc], 0xb0d69b45
mov dword [ebp - 4], 0x12
cmp dword [ebp - 0xc38], 0x3fa
jge 0x488587
mov edx, dword [ebp - 0x175c]
mov ecx, 0xaa82b8
call fcn.0040ca6e
jmp 0x4885a3
or dword [ebp - 4], 0xffffffff
jmp 0x4885ad
mov dword [ebp - 0x1170], 1
mov dword [ebp - 0x1d08], 0xfffffff8
mov dword [ebp - 0x3dc], 0
jmp 0x4885da
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 1
jge 0x4885f6
mov eax, dword [ebp - 0x3dc]
mov dword [ebp + eax*4 - 0x214], 0xffffffff
jmp 0x4885cd
mov dword [ebp - 0x21c], 0x13
jmp 0x48860f
mov eax, dword [ebp - 0x21c]
dec eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xffffffe3
jne 0x488a01
push 1
lea ecx, [ebp - 0x968]
call fcn.0040a30e
push 0
push 0x5a6a
lea eax, [ebp - 0x968]
push eax
lea eax, [ebp - 0x26f8]
push eax
push 0x3990
push 1
call fcn.00482a68
add esp, 0x18
mov dword [ebp - 0xc48], 0x39a7
mov dword [ebp - 0x1764], 0xa92998
cmp dword [ebp - 0xc48], 0x3bb7
jle 0x488726
push 0x2528
call dword [0xaab0bc]
and dword [ebp - 0x6a4], 0
jmp 0x488692
mov eax, dword [ebp - 0x6a4]
inc eax
mov dword [ebp - 0x6a4], eax
cmp dword [ebp - 0x6a4], 0x7c45
jge 0x488726
and dword [ebp - 0x934], 0
jmp 0x4886b8
mov eax, dword [ebp - 0x934]
inc eax
mov dword [ebp - 0x934], eax
cmp dword [ebp - 0x934], 0x2928
jge 0x488721
and dword [ebp - 0x3e4], 0
jmp 0x4886da
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 0x6ce7
jge 0x48871f
mov eax, dword [ebp - 0x934]
mov ecx, dword [ebp - 0x3e4]
shl eax, cl
and eax, dword [ebp - 0x6a4]
cdq
mov dword [ebp - 0x19c8], eax
mov dword [ebp - 0x19c4], edx
push dword [ebp - 0x19c4]
push dword [ebp - 0x19c8]
mov ecx, 0xaa82b8
call fcn.00409fb9
jmp 0x4886cd
jmp 0x4886ab
jmp 0x488685
push 0
lea ecx, [ebp - 0x968]
call fcn.0040a3fc
push 0
lea ecx, [ebp - 0x968]
call fcn.0040a3fc
push 0
lea ecx, [ebp - 0x968]
call fcn.0040a3fc
cmp dword [eax], 0x6b6f
jg 0x4887b4
push 0
lea ecx, [ebp - 0x968]
call fcn.0040a3fc
push 0
lea ecx, [ebp - 0x968]
call fcn.0040a3fc
cmp dword [eax], 0
jne 0x488786
cmp dword [ebp - 0x21c], 0
jne 0x488786
and dword [ebp - 0x13f8], 0
jmp 0x488790
mov dword [ebp - 0x13f8], 1
push 0
lea ecx, [ebp - 0x968]
call fcn.0040a3fc
mov ecx, dword [ebp - 0x13f8]
cmp ecx, dword [eax]
je 0x4887b4
push 0
lea ecx, [ebp - 0x968]
call fcn.0040a3fc
push 0
lea ecx, [ebp - 0x968]
call fcn.0040a3fc
cmp dword [eax], 0x53494abc
jne 0x4887de
cmp dword [ebp - 0x21c], 0
je 0x4887de
mov dword [ebp - 0xc40], 1
jmp 0x4887e5
and dword [ebp - 0xc40], 0
mov esi, dword [ebp - 0xc40]
inc esi
push 0
lea ecx, [ebp - 0x968]
call fcn.0040a3fc
cmp esi, dword [eax]
je 0x488809
mov dword [ebp - 0x1cfc], 1
jmp 0x488810
and dword [ebp - 0x1cfc], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x2b9c], eax
push 0
lea ecx, [ebp - 0x968]
call fcn.0040a3fc
mov eax, dword [ebp - 0x58]
sub eax, 0x26c4
cmp eax, dword [ebp - 0x58]
je 0x48883f
mov dword [ebp - 0x1168], 1
jmp 0x488846
and dword [ebp - 0x1168], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1168]
mov dword [ebp + eax - 0x214], ecx
mov dword [ebp - 4], 0x14
cmp dword [ebp - 0xc48], 0x37c6
jge 0x48887c
mov edx, dword [ebp - 0x1764]
mov ecx, 0xaa82b8
call fcn.0040ca6e
jmp 0x488898
or dword [ebp - 4], 0xffffffff
jmp 0x4888a2
mov dword [ebp - 0x58], 0
jmp 0x4888b2
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x4889f1
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x214]
mov dword [ebp - 0x2700], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x214]
mov dword [ebp - 0x2a4c], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x214]
mov dword [ebp - 0x15e8], eax
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x15e8]
mov dword [ebp + eax*4 - 0x214], ecx
push dword [ebp - 0x58]
lea ecx, [ebp - 0x968]
call fcn.0040a3fc
mov eax, dword [eax]
cmp eax, dword [ebp - 0x15e8]
jl 0x488920
mov dword [ebp - 0x1e74], 1
jmp 0x488927
and dword [ebp - 0x1e74], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x214], 0
jne 0x488943
mov dword [ebp - 0x176c], 1
jmp 0x48894a
and dword [ebp - 0x176c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x24e8]
mov dword [ebp - 0x2708], eax
push 0
lea ecx, [ebp - 0x968]
call fcn.0040a3fc
cmp dword [eax], 1
je 0x48897b
mov dword [ebp - 0xc50], 1
jmp 0x488982
and dword [ebp - 0xc50], 0
imul eax, dword [ebp - 0xc50], 0x9586
mov dword [ebp - 0x1170], eax
cmp dword [ebp - 0x1170], 0
je 0x4889b3
push 0x2c5c
push 0x2d42
push 0
push 0
call fcn.00483bdb
add esp, 0x10
jmp 0x4889ec
mov byte [ebp - 0x169], 0
lea eax, [ebp - 0x169]
push eax
push 0x198f
push 0x485c
push 1
push 1
push 0x1588
push 0x6988
call fcn.00472429
add esp, 0x1c
cmp dword [ebp - 0x1d08], 0
je 0x4889ec
jmp 0x4889f1
jmp 0x4888ab
lea ecx, [ebp - 0x968]
call fcn.0040a3e0
jmp 0x488602
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x1190]
push eax
push 0x32a5
push 0
push 0
call fcn.0046b8d7
add esp, 0x14
mov dword [ebp - 0x8c], 0xe57b
mov dword [ebp - 0x1e8], 9
mov dword [ebp - 0x3ec], 0xe885dc1b
mov dword [ebp - 0xac], 0xfffffffe
mov dword [ebp - 0x1408], 0
mov dword [ebp - 0x177c], 0x8c534832
mov dword [ebp - 0x1d20], 0xc2a7322e
mov dword [ebp - 0x1d14], 0xfff9
push 3
lea ecx, [ebp - 0x211c]
call fcn.0040a30e
push 0x5259
push 0
lea eax, [ebp - 0x2b5c]
push eax
push 1
push 0x1b94
push 0x116d
lea eax, [ebp - 0x211c]
push eax
call fcn.0046e7be
add esp, 0x1c
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x2710], eax
cmp dword [ebp - 0x8c], 0
jne 0x488c1e
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x8c], eax
jne 0x488ad9
mov dword [ebp - 0xc58], 1
jmp 0x488ae0
and dword [ebp - 0xc58], 0
mov eax, dword [ebp - 0xc58]
neg eax
je 0x488af6
mov dword [ebp - 0x1400], 1
jmp 0x488afd
and dword [ebp - 0x1400], 0
mov eax, dword [ebp - 0x8c]
sub eax, dword [ebp - 0x8c]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x1e8]
cmp eax, dword [ebp - 0x1400]
jge 0x488b29
mov dword [ebp - 0xc60], 1
jmp 0x488b30
and dword [ebp - 0xc60], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0xc60], eax
jge 0x488b4a
mov dword [ebp - 0x1178], 1
jmp 0x488b51
and dword [ebp - 0x1178], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x1178], eax
jg 0x488b6b
mov dword [ebp - 0xc68], 1
jmp 0x488b72
and dword [ebp - 0xc68], 0
mov eax, dword [ebp - 0xc68]
mov dword [ebp - 0x3ec], eax
cmp dword [ebp - 0x3ec], 0x3cf81320
jg 0x488b9a
push 7
pop eax
test eax, eax
jne 0x488b9a
and dword [ebp - 0x1548], 0
jmp 0x488ba4
mov dword [ebp - 0x1548], 1
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x1548], eax
jne 0x488bbe
mov dword [ebp - 0xc70], 1
jmp 0x488bc5
and dword [ebp - 0xc70], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0xc70], eax
je 0x488bdf
mov dword [ebp - 0x1180], 1
jmp 0x488be6
and dword [ebp - 0x1180], 0
cmp dword [ebp - 0x1180], 0
jl 0x488bfb
mov dword [ebp - 0x1774], 1
jmp 0x488c02
and dword [ebp - 0x1774], 0
cmp dword [ebp - 0x1e8], 0xfffffffd
jge 0x488c17
mov dword [ebp - 0xc78], 1
jmp 0x488c1e
and dword [ebp - 0xc78], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x1e8], eax
jg 0x488c85
mov dword [ebp - 0x1e7c], 0xa955
lea eax, [ebp - 0x3ec]
push eax
push 0x1420
push 0x56de
push 0x2deb
lea eax, [ebp - 0x1408]
push eax
push 0
lea eax, [ebp - 0x8c]
push eax
push 0x11ca
lea eax, [ebp - 0x1e7c]
push eax
push 0
lea eax, [ebp - 0x177c]
push eax
lea eax, [ebp - 0x1e8]
push eax
call fcn.0046dbde
add esp, 0x30
jmp 0x488d33
mov dword [ebp - 0x1e84], 0xd56b
mov dword [ebp - 0x1784], 0
mov dword [ebp - 0x178c], 0xad93
push 0x7ca4
push 0x5e86
lea eax, [ebp - 0x1d14]
push eax
push 0x4496
push 0x4bdf
lea eax, [ebp - 0x1784]
push eax
push 0x4b57
push 0x4b4c
push 1
push 0x3fb3
lea eax, [ebp - 0x1e84]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x1e8]
push eax
push 0x2597
push 0x29bc
push 0x61f2
push 0x1667
push 0x4d41
lea eax, [ebp - 0x178c]
push eax
push 0
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x1d20]
push eax
lea eax, [ebp - 0x1408]
push eax
push 0
call fcn.00474e02
add esp, 0x64
mov dword [ebp - 0xc80], 0x2546
mov dword [ebp - 0x1794], 0xa929e8
cmp dword [ebp - 0xc80], 0x25d0
jle 0x488e30
and dword [ebp - 0x804], 0
jmp 0x488d6d
mov eax, dword [ebp - 0x804]
inc eax
mov dword [ebp - 0x804], eax
cmp dword [ebp - 0x804], 0x2b23
jge 0x488e30
and dword [ebp - 0x3f4], 0
jmp 0x488d93
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0x69ce
jge 0x488e2b
and dword [ebp - 0x6ac], 0
jmp 0x488db9
mov eax, dword [ebp - 0x6ac]
inc eax
mov dword [ebp - 0x6ac], eax
cmp dword [ebp - 0x6ac], 0x3377
jge 0x488e26
and dword [ebp - 0x3fc], 0
jmp 0x488ddb
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 0x7aaa
jge 0x488e24
mov eax, dword [ebp - 0x804]
and eax, dword [ebp - 0x3f4]
xor eax, dword [ebp - 0x6ac]
or eax, dword [ebp - 0x3fc]
cdq
mov dword [ebp - 0x19d4], eax
mov dword [ebp - 0x19d0], edx
push dword [ebp - 0x19d0]
push dword [ebp - 0x19d4]
mov ecx, 0xaa82b8
call fcn.00409fb9
jmp 0x488dce
jmp 0x488dac
jmp 0x488d86
jmp 0x488d60
mov dword [ebp - 0xac], 2
jmp 0x488e49
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x488eae
push dword [ebp - 0xac]
lea ecx, [ebp - 0x211c]
call fcn.0040a3fc
cmp dword [eax], 0
je 0x488e6a
jmp 0x488eae
push 0x793e
push 0x77b1
push 0x6840
lea eax, [ebp - 0x211c]
push eax
push 0x62d8
push 0
push 0x5546
lea eax, [ebp - 0xac]
push eax
push 0xa23
push 1
push 0xb97
push 0x56f9
call fcn.0046dbde
add esp, 0x30
jmp 0x488e3c
mov dword [ebp - 4], 0x16
cmp dword [ebp - 0xc80], 0x2225
jge 0x488ed1
mov edx, dword [ebp - 0x1794]
mov ecx, 0xaa82b8
call fcn.0040ca6e
jmp 0x488eed
or dword [ebp - 4], 0xffffffff
jmp 0x488ef7
lea ecx, [ebp - 0x211c]
call fcn.0040a3e0
mov dword [ebp - 0x230], 0
jmp 0x488f1b
cmp dword [ebp - 0x230], 0x14
jg 0x489612
push 2
lea ecx, [ebp - 0x2004]
call fcn.0040a30e
mov dword [ebp - 0x1188], 0x4d6c
mov dword [ebp - 0x1e8c], 0xa92a24
cmp dword [ebp - 0x1188], 0x512a
jle 0x489042
push 0x8c2
call dword [0xaab4b8]
and dword [ebp - 0x8b4], 0
jmp 0x488f7a
mov eax, dword [ebp - 0x8b4]
inc eax
mov dword [ebp - 0x8b4], eax
cmp dword [ebp - 0x8b4], 0x567
jge 0x489042
and dword [ebp - 0x404], 0
jmp 0x488fa0
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 0x76b1
jge 0x48903d
and dword [ebp - 0x6b4], 0
jmp 0x488fc6
mov eax, dword [ebp - 0x6b4]
inc eax
mov dword [ebp - 0x6b4], eax
cmp dword [ebp - 0x6b4], 0x5a6d
jge 0x489038
and dword [ebp - 0x40c], 0
jmp 0x488fe8
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0x7adc
jge 0x489036
mov eax, dword [ebp - 0x8b4]
mov ecx, dword [ebp - 0x404]
sar eax, cl
mov ecx, dword [ebp - 0x6b4]
imul ecx, dword [ebp - 0x40c]
sar eax, cl
cdq
mov dword [ebp - 0x19e0], eax
mov dword [ebp - 0x19dc], edx
push dword [ebp - 0x19dc]
push dword [ebp - 0x19e0]
mov ecx, 0xaa82b8
call fcn.00409fb9
jmp 0x488fdb
jmp 0x488fb9
jmp 0x488f93
jmp 0x488f6d
mov dword [ebp - 4], 0x18
cmp dword [ebp - 0x1188], 0x4cde
jge 0x489065
mov edx, dword [ebp - 0x1e8c]
mov ecx, 0xaa82b8
call fcn.0040ca6e
jmp 0x489081
or dword [ebp - 4], 0xffffffff
jmp 0x48908b
push 0
push 1
lea eax, [ebp - 0x2a5c]
push eax
push 1
push 0x64d
push 0x5f32
lea eax, [ebp - 0x2004]
push eax
call fcn.004732f1
add esp, 0x1c
push 0
lea ecx, [ebp - 0x2004]
call fcn.0040a3fc
and dword [eax], 0
jmp 0x4890e7
push 0
lea ecx, [ebp - 0x2004]
call fcn.0040a3fc
cmp dword [eax], 0xe
jne 0x489389
mov dword [ebp - 0x298], 0x76d7be7e
mov dword [ebp - 0x1620], 0xcc
mov dword [ebp - 0x179c], 0xa92a48
cmp dword [ebp - 0x1620], 0x3ff
jle 0x489208
and dword [ebp - 0x6bc], 0
jmp 0x489141
mov eax, dword [ebp - 0x6bc]
inc eax
mov dword [ebp - 0x6bc], eax
cmp dword [ebp - 0x6bc], 0x80a
jge 0x489208
and dword [ebp - 0x80c], 0
jmp 0x489167
mov eax, dword [ebp - 0x80c]
inc eax
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0x5afa
jge 0x489203
and dword [ebp - 0x414], 0
jmp 0x48918d
cmp dword [ebp - 0x414], 0x2672
jge 0x4891fe
and dword [ebp - 0x41c], 0
jmp 0x4891af
cmp dword [ebp - 0x41c], 0x33e3
jge 0x4891fc
jmp 0x48915a
jmp 0x489134
mov dword [ebp - 4], 0x1a
cmp dword [ebp - 0x1620], 0xfffffeee
jge 0x48922b
mov edx, dword [ebp - 0x179c]
mov ecx, 0xaa82b8
call fcn.0040ca6e
jmp 0x489247
or dword [ebp - 4], 0xffffffff
jmp 0x489251
mov dword [ebp - 0x90c], 0
jmp 0x48926a
mov eax, dword [ebp - 0x90c]
inc eax
mov dword [ebp - 0x90c], eax
cmp dword [ebp - 0x90c], 4
jge 0x489286
mov eax, dword [ebp - 0x90c]
mov dword [ebp + eax*4 - 0x2bec], 0xffff
jmp 0x48925d
mov dword [ebp - 0x298], 3
jmp 0x48929f
cmp dword [ebp - 0x298], 0
jl 0x489367
mov dword [ebp - 0x424], 0
jmp 0x4892c5
push 0x56a8
push 0x72bf
push 0
push 0x45b4
push 0
push 1
call fcn.0047d7d1
add esp, 0x18
jmp 0x4890c3
lea ecx, [ebp - 0x2004]
call fcn.0040a3e0
mov dword [ebp - 0x17a4], 0x924c0001
mov dword [ebp - 0xc90], 0x5658
mov dword [ebp - 0x1d2c], 0xa92a74
cmp dword [ebp - 0xc90], 0x56aa
jle 0x4894a3
and dword [ebp - 0x6c4], 0
jmp 0x4893d8
mov eax, dword [ebp - 0x6c4]
inc eax
mov dword [ebp - 0x6c4], eax
cmp dword [ebp - 0x6c4], 0x3899
jge 0x48948d
and dword [ebp - 0x42c], 0
jmp 0x4893fe
mov eax, dword [ebp - 0x42c]
inc eax
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0x1ad2
jge 0x489488
and dword [ebp - 0x814], 0
jmp 0x489420
mov eax, dword [ebp - 0x814]
inc eax
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0x4e38
jge 0x489483
mov eax, dword [ebp - 0x6c4]
imul eax, dword [ebp - 0x42c]
cdq
idiv dword [ebp - 0x814]
mov eax, edx
cdq
mov dword [ebp - 0x19f8], eax
mov dword [ebp - 0x19f4], edx
push dword [ebp - 0x19f4]
push dword [ebp - 0x19f8]
lea ecx, [ebp - 0x2ee4]
call fcn.004019b1
pop ecx
pop ecx
mov ecx, eax
call fcn.00409fae
push eax
call fcn.004a91a7
pop ecx
lea ecx, [ebp - 0x2ee4]
call fcn.00409fa4
jmp 0x489413
jmp 0x4893f1
jmp 0x4893cb
push 0
push 0
push 0xeff
push 0x142e
push 0
call dword [0xaab4a0]
mov dword [ebp - 0x104], 0xffffffff
mov dword [ebp - 0x434], 0
jmp 0x4894c6
mov eax, dword [ebp - 0x434]
inc eax
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 3
jge 0x4894e2
mov eax, dword [ebp - 0x434]
mov dword [ebp + eax*4 - 0x2c7c], 0xfffffff9
jmp 0x4894b9
mov dword [ebp - 0x104], 2
jmp 0x4894fb
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jl 0x489559
mov byte [ebp - 0x131], 0
push 0
push 0x1c22
push 0x4cf8
push 0x7f5c
push 0x7bf0
push 0x5f53
push 0x7256
lea eax, [ebp - 0x131]
push eax
push 0
push 0x2fbf
push 0x11f1
push 0x5da9
push 0x28f
push 0x3fec
push 1
call fcn.00478339
add esp, 0x3c
jmp 0x4894ee
mov dword [ebp - 0x104], 0
jmp 0x489572
cmp dword [ebp - 0x104], 0x17
jle 0x4895bc
mov dword [ebp - 0x238], 0xfffffffc
mov dword [ebp - 0x238], 0
jmp 0x48959e
cmp dword [ebp - 0x238], 3
jge 0x4895ba
mov dword [ebp - 4], 0x1c
cmp dword [ebp - 0xc90], 0x5645
jge 0x4895db
push dword [ebp - 0x1d2c]
call fcn.004a91a7
pop ecx
jmp 0x4895f7
mov dword [ebp - 4], 0x1e
cmp dword [ebp - 0xc98], 0x1790
jge 0x489631
push dword [ebp - 0x1e94]
call fcn.004a91a7
pop ecx
jmp 0x48964d
or dword [ebp - 4], 0xffffffff
jmp 0x489657
mov dword [ebp - 0x43c], 0xfff8
mov dword [ebp - 0x8bc], 0x896e6a37
mov dword [ebp - 0xa14], 0x188047d2
mov dword [ebp - 0x218c], 1
mov dword [ebp - 0x2188], 1
mov dword [ebp - 0x2184], 1
mov dword [ebp - 0x2180], 1
mov dword [ebp - 0x1418], 0xcc90
mov dword [ebp - 0x6cc], 0
jmp 0x4896c0
mov eax, dword [ebp - 0x6cc]
inc eax
mov dword [ebp - 0x6cc], eax
cmp dword [ebp - 0x6cc], 2
jge 0x4896dc
mov eax, dword [ebp - 0x6cc]
mov dword [ebp + eax*4 - 0x1a04], 1
jmp 0x4896b3
push 1
lea eax, [ebp - 0x43c]
push eax
push 0x99e
push 1
push 0x3f58
call fcn.00472704
add esp, 0x14
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a04]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1a04]
inc ecx
push 4
pop edx
imul edx, edx, 0
mov dword [ebp + edx - 0x1a04], ecx
test eax, eax
je 0x4897bc
mov eax, dword [ebp - 0xa14]
neg eax
cmp eax, 0xffff
ja 0x48975d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x218c]
mov dword [ebp - 0x2718], eax
mov eax, 0x9403
test eax, eax
jne 0x48975d
and dword [ebp - 0x1410], 0
jmp 0x489767
mov dword [ebp - 0x1410], 1
mov eax, dword [ebp - 0x8bc]
cmp dword [ebp - 0x1410], eax
je 0x489781
mov dword [ebp - 0xca0], 1
jmp 0x489788
and dword [ebp - 0xca0], 0
cmp dword [ebp - 0xca0], 0xffffffff
jne 0x48979d
mov dword [ebp - 0x1198], 1
jmp 0x4897a4
and dword [ebp - 0x1198], 0
cmp dword [ebp - 0x1198], 0xd514
jg 0x4897bc
mov dword [ebp - 0xca8], 1
jmp 0x4897c3
and dword [ebp - 0xca8], 0
mov eax, dword [ebp - 0x8bc]
cmp dword [ebp - 0xca8], eax
jle 0x4897dd
mov dword [ebp - 0x1550], 1
jmp 0x4897e4
and dword [ebp - 0x1550], 0
cmp dword [ebp - 0x1550], 3
jne 0x4897f9
mov dword [ebp - 0xcb0], 1
jmp 0x489800
and dword [ebp - 0xcb0], 0
mov eax, dword [ebp - 0x43c]
cmp eax, dword [ebp - 0xcb0]
jle 0x48981a
mov dword [ebp - 0x11a0], 1
jmp 0x489821
and dword [ebp - 0x11a0], 0
mov eax, dword [ebp - 0xa14]
cmp dword [ebp - 0x11a0], eax
jle 0x489841
mov eax, 0x842b4cf2
test eax, eax
jne 0x489841
and dword [ebp - 0xcb8], 0
jmp 0x48984b
mov dword [ebp - 0xcb8], 1
mov eax, dword [ebp - 0x1418]
cmp dword [ebp - 0xcb8], eax
jl 0x489865
mov dword [ebp - 0xad0], 1
jmp 0x48986c
and dword [ebp - 0xad0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xad0]
mov dword [ebp + eax - 0x218c], ecx
mov eax, dword [ebp - 0xad0]
sub eax, dword [ebp - 0x43c]
mov ecx, dword [ebp - 0x43c]
imul ecx, eax
mov dword [ebp - 0x8bc], ecx
mov eax, dword [ebp - 0x1418]
cmp dword [ebp - 0x8bc], eax
jne 0x4898b3
mov dword [ebp - 0xcc0], 1
jmp 0x4898ba
and dword [ebp - 0xcc0], 0
mov eax, dword [ebp - 0xcc0]
mov dword [ebp - 0xa14], eax
push 3
lea ecx, [ebp - 0x994]
call fcn.0040a30e
mov dword [ebp - 0x30], 0xf230
push 0
lea eax, [ebp - 0x994]
push eax
push 0x2be3
push 0
lea eax, [ebp - 0x2ba0]
push eax
push 0x7d9d
push 0x588c
push 0x59f4
push 0x3a9f
push 0x7cf
call fcn.004711c0
add esp, 0x28
push 2
lea ecx, [ebp - 0x994]
call fcn.0040a3fc
push 1
lea ecx, [ebp - 0x994]
call fcn.0040a3fc
mov esi, eax
push 0
lea ecx, [ebp - 0x994]
call fcn.0040a3fc
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x48994d
mov dword [ebp - 0x11a8], 1
jmp 0x489954
and dword [ebp - 0x11a8], 0
push 2
lea ecx, [ebp - 0x994]
call fcn.0040a3fc
mov ecx, dword [ebp - 0x11a8]
imul ecx, dword [eax]
test ecx, ecx
jne 0x48997c
or eax, 0xffffffff
jne 0x48997c
mov dword [ebp - 0xcc8], 1
push 2
lea ecx, [ebp - 0x994]
call fcn.0040a3fc
mov ecx, dword [ebp - 0xcc8]
cmp ecx, dword [eax]
jle 0x4899a9
mov eax, dword [ebp - 0x18f0]
mov dword [ebp - 0x18f8], eax
mov eax, dword [ebp - 0x18f8]
mov dword [ebp - 0x1900], eax
push 0
mov ecx, dword [ebp - 0x1900]
call fcn.0040a3fc
mov dword [ebp - 0x15a4], eax
mov eax, dword [ebp - 0x15a4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x15a4]
mov dword [ecx], eax
jmp 0x49c66e
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1910], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1908], eax
push 1
push dword [ebp - 0x1908]
push dword [ebp - 0x1910]
push 0xdaa
call fcn.0046b46f
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret