Function at 0x1004c4fa
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006e4fd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x450
push esi
push edi
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x7c], 0x97ec53a2
mov dword [ebp - 0x84], 0x81b2706
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x11c], 1
mov dword [ebp - 0x20], 0xfffffff1
jmp 0x1004c556
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffffd
jge 0x1004ca7a
mov dword [ebp - 0x14], 1
push 3
lea ecx, [ebp - 0xc0]
call fcn.1002b6f7
and dword [ebp - 4], 0
mov dword [ebp - 0xa8], 0xbf748bbe
mov dword [ebp - 0x98], 0
jmp 0x1004c59b
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x1004c5bd
push dword [ebp - 0x98]
lea ecx, [ebp - 0xc0]
call fcn.1002b7f6
mov dword [eax], 0x8974b66
jmp 0x1004c58e
cmp dword [ebp - 0x14], 0
je 0x1004c7c5
mov dword [ebp - 0x26c], 0x1c59
cmp dword [ebp - 0x26c], 0x71d
jge 0x1004c76e
lea ecx, [ebp - 0x2f0]
call fcn.1002b6ea
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2fc]
call fcn.1002b6ea
mov byte [ebp - 4], 2
lea eax, [ebp - 0x6c]
push eax
push 0x10007740
call fcn.10055feb
pop ecx
pop ecx
cmp eax, 1
jne 0x1004c750
lea ecx, [ebp - 0x2f0]
call fcn.1004e789
lea ecx, [ebp - 0x2fc]
call fcn.1004e789
and dword [ebp - 0xcc], 0
jmp 0x1004c644
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0x6c]
jge 0x1004c690
lea eax, [ebp - 0x380]
push eax
lea eax, [ebp - 0x388]
push eax
push 0x1000789c
call fcn.10055feb
add esp, 0xc
lea eax, [ebp - 0x388]
push eax
lea ecx, [ebp - 0x2f0]
call fcn.1004e72c
lea eax, [ebp - 0x380]
push eax
lea ecx, [ebp - 0x2fc]
call fcn.1004e72c
jmp 0x1004c637
push dword [ebp - 0x6c]
push 0x10007740
call fcn.10056438
pop ecx
pop ecx
and dword [ebp - 0x44], 0
jmp 0x1004c6ac
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x6c]
jge 0x1004c740
push dword [ebp - 0x44]
lea ecx, [ebp - 0x2fc]
call fcn.1002b8a3
mov esi, eax
mov eax, dword [ebp - 0x44]
inc eax
cdq
idiv dword [ebp - 0x6c]
push edx
lea ecx, [ebp - 0x2fc]
call fcn.1002b8a3
movsd xmm0, qword [esi]
addsd xmm0, qword [eax]
divsd xmm0, qword [0x10007eb8]
push ecx
push ecx
movsd qword [esp], xmm0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x2f0]
call fcn.1002b8a3
mov esi, eax
mov eax, dword [ebp - 0x44]
inc eax
cdq
idiv dword [ebp - 0x6c]
push edx
lea ecx, [ebp - 0x2f0]
call fcn.1002b8a3
movsd xmm0, qword [esi]
addsd xmm0, qword [eax]
divsd xmm0, qword [0x10007eb8]
push ecx
push ecx
movsd qword [esp], xmm0
push 0x10007bd4
call fcn.10056438
add esp, 0x14
jmp 0x1004c6a5
push 0x1000775c
call fcn.10056438
pop ecx
jmp 0x1004c5ff
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2fc]
call fcn.1002b83e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2f0]
call fcn.1002b83e
mov dword [ebp - 0x2dc], 0xa97963ba
cmp dword [ebp - 0x20], 0
jne 0x1004c78a
mov dword [ebp - 0x158], 1
jmp 0x1004c791
and dword [ebp - 0x158], 0
push 2
lea ecx, [ebp - 0xc0]
call fcn.1002b7f6
mov ecx, dword [ebp - 0x158]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0xc0]
call fcn.1002b7f6
mov dword [eax], 0x9a924c00
mov dword [ebp - 0x2dc], 0x9a924c00
jmp 0x1004c7f3
cmp dword [ebp - 0x14], 0
jne 0x1004c7d7
mov dword [ebp - 0x210], 1
jmp 0x1004c7de
and dword [ebp - 0x210], 0
push 1
lea ecx, [ebp - 0xc0]
call fcn.1002b7f6
mov ecx, dword [ebp - 0x210]
mov dword [eax], ecx
cmp dword [ebp - 0x14], 0
jne 0x1004c8f8
cmp dword [ebp - 0x20], 0
jne 0x1004c8f8
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x14], eax
jl 0x1004c81b
mov dword [ebp - 0x244], 1
jmp 0x1004c822
and dword [ebp - 0x244], 0
cmp dword [ebp - 0x244], 9
je 0x1004c837
mov dword [ebp - 0x100], 1
jmp 0x1004c83e
and dword [ebp - 0x100], 0
push 2
lea ecx, [ebp - 0xc0]
call fcn.1002b7f6
mov esi, dword [ebp - 0xa8]
push 2
lea ecx, [ebp - 0xc0]
call fcn.1002b7f6
cmp esi, dword [eax]
jne 0x1004c86e
mov dword [ebp - 0x2e4], 1
jmp 0x1004c875
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x20], 0xef8169c1
jae 0x1004c893
mov dword [ebp - 0x2c8], 1
jmp 0x1004c89a
and dword [ebp - 0x2c8], 0
push 0
lea ecx, [ebp - 0xc0]
call fcn.1002b7f6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xa8], eax
jne 0x1004c8c7
mov dword [ebp - 0x24c], 1
jmp 0x1004c8ce
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x24c], eax
jne 0x1004c8e8
mov dword [ebp - 0x288], 1
jmp 0x1004c8ef
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xa8], eax
cmp dword [ebp - 0x20], 0
je 0x1004c942
mov dword [ebp - 0x27c], 0x49a5c1b0
mov dword [ebp - 0x14], 0
jmp 0x1004c918
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1004c934
push dword [ebp - 0x14]
lea ecx, [ebp - 0xc0]
call fcn.1002b7f6
mov dword [eax], 0xfffffff9
jmp 0x1004c911
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x7c], eax
jmp 0x1004ca66
push 2
lea ecx, [ebp - 0x368]
call fcn.1002b6f7
mov byte [ebp - 4], 3
mov dword [ebp - 0x2bc], 0xfffffffc
mov dword [ebp - 0xa0], 0
jmp 0x1004c976
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x1004c998
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x368]
call fcn.1002b7f6
mov dword [eax], 0xa932da3b
jmp 0x1004c969
push 0
lea ecx, [ebp - 0x368]
call fcn.1002b7f6
mov dword [ebp - 0x108], eax
push 1
lea ecx, [ebp - 0xc0]
call fcn.1002b7f6
mov ecx, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
mov esi, dword [ebp - 0x7c]
push 1
lea ecx, [ebp - 0xc0]
call fcn.1002b7f6
cmp esi, dword [eax]
jl 0x1004c9ed
mov dword [ebp - 0x114], 1
jmp 0x1004c9f4
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x84], eax
je 0x1004ca0b
mov dword [ebp - 0x254], 1
jmp 0x1004ca12
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x25c]
cmp dword [ebp - 0x114], eax
je 0x1004ca38
mov dword [ebp - 0x1bc], 1
jmp 0x1004ca3f
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x368]
call fcn.1002b77b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc0]
call fcn.1002b77b
jmp 0x1004c54f
mov dword [ebp - 0x84], 0xffffffe6
jmp 0x1004ca93
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0x2b
jge 0x1004cabd
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x7c], eax
mov byte [ebp - 0x3e], 0
movzx eax, byte [ebp - 0x3e]
test eax, eax
je 0x1004cabb
push 0x15f0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x1004ca86
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x18], 0xfd52
mov dword [ebp - 0x64], 0xa198
push 2
lea ecx, [ebp - 0x268]
call fcn.1002b6f7
mov dword [ebp - 4], 4
mov dword [ebp - 0x30], 0
jmp 0x1004caf6
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x1004cb12
push dword [ebp - 0x30]
lea ecx, [ebp - 0x268]
call fcn.1002b7f6
mov dword [eax], 0x3d925d3c
jmp 0x1004caef
mov dword [ebp - 0x30], 0
jmp 0x1004cb22
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1004cb38
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x2c4], 0x99d621dd
jmp 0x1004cb1b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x1c], 1
ja 0x1004cb5c
mov eax, 0x99ea
test eax, eax
je 0x1004cb5c
mov dword [ebp - 0x20c], 1
jmp 0x1004cb63
and dword [ebp - 0x20c], 0
cmp dword [ebp - 0x20c], 0x36dc9922
jne 0x1004cb7b
mov dword [ebp - 0x124], 1
jmp 0x1004cb82
and dword [ebp - 0x124], 0
cmp dword [ebp - 0x124], 0xffffffff
je 0x1004cb97
mov dword [ebp - 0x284], 1
jmp 0x1004cb9e
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x1c], 7
ja 0x1004cbc2
mov dword [ebp - 0x1c4], 1
jmp 0x1004cbc9
and dword [ebp - 0x1c4], 0
imul eax, dword [ebp - 0x1c4], 0
mov ecx, dword [ebp - 0x18]
lea eax, [eax + ecx - 9]
imul eax, eax, 0xffffffff
cmp eax, dword [ebp - 0x18]
jg 0x1004cbeb
mov dword [ebp - 0x12c], 1
jmp 0x1004cbf2
and dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x12c], eax
jne 0x1004cc09
mov dword [ebp - 0x238], 1
jmp 0x1004cc10
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x238]
cmp dword [ebp - 0x1c], eax
jne 0x1004cc2a
mov dword [ebp - 0x134], 1
jmp 0x1004cc31
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x134]
add eax, 5
mov dword [ebp - 0x1cc], 1
jmp 0x1004cc4d
cmp dword [ebp - 0x1cc], 0x1de2a907
jge 0x1004cc65
mov dword [ebp - 0x13c], 1
jmp 0x1004cc6c
and dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x13c]
jne 0x1004cc83
mov dword [ebp - 0x2d8], 1
jmp 0x1004cc8a
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x64], 0
je 0x1004ccd0
mov dword [ebp - 0x218], 0xffffffff
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
jmp 0x1004ce37
mov dword [ebp - 0x70], 0x177fd8b2
mov dword [ebp - 0xec], 0xfffffffa
cmp dword [ebp - 0xec], 0
je 0x1004ccfc
cmp dword [ebp - 0x64], 0
je 0x1004ccfc
mov dword [ebp - 0x144], 1
jmp 0x1004cd03
and dword [ebp - 0x144], 0
cmp dword [ebp - 0x144], 0x6953
jl 0x1004cd1b
mov dword [ebp - 0x1d4], 1
jmp 0x1004cd22
and dword [ebp - 0x1d4], 0
mov eax, dword [ebp - 0x1d4]
add eax, 0x7718da91
cmp eax, 0x7656
jge 0x1004cd40
mov dword [ebp - 0x14c], 1
jmp 0x1004cd47
and dword [ebp - 0x14c], 0
imul eax, dword [ebp - 0x14c], 0xffff
cmp dword [ebp - 0x1c], eax
je 0x1004cd62
mov dword [ebp - 0x258], 1
jmp 0x1004cd69
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x258], eax
je 0x1004cd89
cmp dword [ebp - 0x70], 0
je 0x1004cd89
mov dword [ebp - 0x154], 1
jmp 0x1004cd90
and dword [ebp - 0x154], 0
cmp dword [ebp - 0x154], 0xfffa
jb 0x1004cda8
mov dword [ebp - 0x1dc], 1
jmp 0x1004cdaf
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x1dc], eax
jge 0x1004cdc9
mov dword [ebp - 0x15c], 1
jmp 0x1004cdd0
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x15c], eax
jle 0x1004cde7
mov dword [ebp - 0x220], 1
jmp 0x1004cdee
and dword [ebp - 0x220], 0
imul eax, dword [ebp - 0x220], 0xe874
cmp eax, dword [ebp - 0x70]
jle 0x1004ce09
mov dword [ebp - 0x164], 1
jmp 0x1004ce10
and dword [ebp - 0x164], 0
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x164]
jne 0x1004ce27
mov dword [ebp - 0x1e4], 1
jmp 0x1004ce2e
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x18], 0
jmp 0x1004ce47
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x31
jg 0x1004d024
mov dword [ebp - 0x78], 0x5c8f
mov dword [ebp - 0x1ec], 0xfffffffc
mov dword [ebp - 0x1c], 0xffffffec
jmp 0x1004ce72
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe8
jg 0x1004ce8c
mov byte [ebp - 0x5e], 0
movzx eax, byte [ebp - 0x5e]
test eax, eax
je 0x1004ce8a
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x1004ce6b
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x78], 0
je 0x1004cf66
cmp dword [ebp - 0x78], 0x6f0e
jge 0x1004ceb4
mov dword [ebp - 0x16c], 1
jmp 0x1004cebb
and dword [ebp - 0x16c], 0
cmp dword [ebp - 0x16c], 1
je 0x1004ced0
mov dword [ebp - 0x240], 1
jmp 0x1004ced7
and dword [ebp - 0x240], 0
push 0
lea ecx, [ebp - 0x268]
call fcn.1002b7f6
mov ecx, dword [ebp - 0x240]
cmp ecx, dword [eax]
jg 0x1004cefa
mov dword [ebp - 0x174], 1
jmp 0x1004cf01
and dword [ebp - 0x174], 0
mov esi, dword [ebp - 0x78]
add esi, dword [ebp - 0x174]
push 0
lea ecx, [ebp - 0x268]
call fcn.1002b7f6
imul esi, dword [eax]
mov dword [ebp - 0x1ec], esi
cmp dword [ebp - 0x1ec], 0
je 0x1004cf47
push 1
lea ecx, [ebp - 0x268]
call fcn.1002b7f6
cmp dword [eax], 0
je 0x1004cf47
mov dword [ebp - 0x17c], 1
jmp 0x1004cf4e
and dword [ebp - 0x17c], 0
cmp dword [ebp - 0x17c], 0xaa2e
jle 0x1004cf66
mov dword [ebp - 0x28c], 1
jmp 0x1004cf6d
and dword [ebp - 0x28c], 0
push 1
lea ecx, [ebp - 0x268]
call fcn.1002b7f6
mov eax, 0xcd44
imul eax, eax, 0xffffffff
cmp eax, dword [ebp - 0x18]
jge 0x1004cf9c
mov eax, 0x1b10cd78
test eax, eax
je 0x1004cf9c
mov dword [ebp - 0x228], 1
jmp 0x1004cfa3
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x228], eax
jg 0x1004cfba
mov dword [ebp - 0x184], 1
jmp 0x1004cfc1
and dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x184]
dec eax
cmp eax, dword [ebp - 0x18]
jg 0x1004cfd9
mov dword [ebp - 0x1f4], 1
jmp 0x1004cfe0
and dword [ebp - 0x1f4], 0
cmp dword [ebp - 0x1f4], 9
jae 0x1004cff5
mov dword [ebp - 0x18c], 1
jmp 0x1004cffc
and dword [ebp - 0x18c], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x2c4]
imul esi, dword [ebp - 0x18c]
push 1
lea ecx, [ebp - 0x268]
call fcn.1002b7f6
mov dword [eax], esi
jmp 0x1004ce40
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.1002b77b
mov dword [ebp - 0x1ac], 0x2cb5
mov dword [ebp - 0x3e0], 0xd085c9e5
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x80], 0xfffffff6
mov dword [ebp - 0x294], 0x50315362
mov dword [ebp - 0x2e0], 0
mov dword [ebp - 0xd4], 0x2a26f3f1
push 1
lea ecx, [ebp - 0x314]
call fcn.1002b6f7
mov dword [ebp - 4], 5
mov dword [ebp - 0x29c], 0x1637c1d6
mov dword [ebp - 0x2cc], 0x127b
mov dword [ebp - 0x4c], 0xe0cd5c0f
mov dword [ebp - 0x10], 0
jmp 0x1004d0b5
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1004d0d1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x314]
call fcn.1002b7f6
mov dword [eax], 2
jmp 0x1004d0ae
mov dword [ebp - 0x10], 0
jmp 0x1004d0e1
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1004d0f7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x424], 0x12a3
jmp 0x1004d0da
mov dword [ebp - 0x10], 0
jmp 0x1004d107
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1004d11d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x450], 0x693ce85d
jmp 0x1004d100
imul eax, dword [ebp - 0x294], 0x4174
mov dword [ebp - 0x250], eax
push 0
lea ecx, [ebp - 0x314]
call fcn.1002b7f6
mov ecx, dword [ebp - 0x250]
mov dword [eax], ecx
cmp dword [ebp - 0x250], 0
jne 0x1004d157
mov dword [ebp - 0x1fc], 1
jmp 0x1004d15e
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x378], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2cc]
cmp dword [ebp + eax - 0x424], ecx
jge 0x1004d197
mov dword [ebp - 0x194], 1
jmp 0x1004d19e
and dword [ebp - 0x194], 0
mov eax, dword [ebp - 0xd4]
imul eax, dword [ebp - 0x194]
cmp eax, 0xfffffffd
je 0x1004d1bc
mov dword [ebp - 0x19c], 1
jmp 0x1004d1c3
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x1fc]
add eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x4c], eax
jle 0x1004d1e7
mov dword [ebp - 0x230], 1
jmp 0x1004d1ee
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x1ac]
cmp eax, dword [ebp - 0x230]
jge 0x1004d208
mov dword [ebp - 0x1a4], 1
jmp 0x1004d20f
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0xffff
je 0x1004d233
mov dword [ebp - 0x204], 1
jmp 0x1004d23a
and dword [ebp - 0x204], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x450]
add eax, dword [ebp - 0x204]
cmp dword [ebp - 0x1ac], eax
je 0x1004d261
mov dword [ebp - 0x248], 1
jmp 0x1004d268
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x248], eax
jg 0x1004d27f
mov dword [ebp - 0x1b4], 1
jmp 0x1004d286
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x4c], 0xffffffe2
jmp 0x1004d2a2
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x1f
jne 0x1004d3e1
mov dword [ebp - 0x3c], 0x140c5034
mov dword [ebp - 0x110], 0x63cd51dc
cmp dword [ebp - 0x3c], 0
je 0x1004d2d5
cmp dword [ebp - 0x3c], 0
je 0x1004d2d5
mov dword [ebp - 0x10c], 1
jmp 0x1004d2dc
and dword [ebp - 0x10c], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x10c]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
sub eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x3c]
je 0x1004d307
or eax, 0xffffffff
jne 0x1004d307
and dword [ebp - 0x118], 0
jmp 0x1004d311
mov dword [ebp - 0x118], 1
push 0
lea ecx, [ebp - 0x314]
call fcn.1002b7f6
mov ecx, dword [ebp - 0x118]
cmp ecx, dword [eax]
jge 0x1004d334
mov dword [ebp - 0x120], 1
jmp 0x1004d33b
and dword [ebp - 0x120], 0
cmp dword [ebp - 0x120], 0xfffd
jbe 0x1004d353
mov dword [ebp - 0x128], 1
jmp 0x1004d35a
and dword [ebp - 0x128], 0
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x128]
cmp dword [ebp - 0x3c], eax
jne 0x1004d37b
cmp dword [ebp - 0x3c], 0
je 0x1004d37b
mov dword [ebp - 0x130], 1
jmp 0x1004d382
and dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x130]
jl 0x1004d399
mov dword [ebp - 0x138], 1
jmp 0x1004d3a0
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x80], 0
jmp 0x1004d3bc
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0xfffffffa
jne 0x1004d3dc
mov byte [ebp - 0x3f], 0
movzx eax, byte [ebp - 0x3f]
test eax, eax
je 0x1004d3da
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
jmp 0x1004d3b5
jmp 0x1004d29b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x314]
call fcn.1002b77b
mov dword [ebp - 0x88], 0x24ec2e0c
mov dword [ebp - 0xc4], 0xccba
mov dword [ebp - 0xe4], 0xffffffff
mov dword [ebp - 0x160], 0xebf495e3
mov dword [ebp - 0x168], 0
mov dword [ebp - 0x178], 1
mov dword [ebp - 0x2d0], 0xffffffff
mov dword [ebp - 0xb0], 0
jmp 0x1004d44f
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x1004d46b
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x2a4], 0x329b3a00
jmp 0x1004d442
cmp dword [ebp - 0xc4], 0
je 0x1004d4a7
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jne 0x1004d492
cmp dword [ebp - 0x160], 0
je 0x1004d4a7
cmp dword [ebp - 0xe4], 0
je 0x1004d4a7
mov dword [ebp - 0x148], 1
jmp 0x1004d4ae
and dword [ebp - 0x148], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a4]
imul eax, dword [ebp - 0x148]
cmp eax, 0xd9a2b82c
ja 0x1004d4d5
mov dword [ebp - 0x150], 1
jmp 0x1004d4dc
and dword [ebp - 0x150], 0
cmp dword [ebp - 0x150], 0
jne 0x1004d4f1
mov dword [ebp - 0xf4], 1
jmp 0x1004d4f8
and dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x168], eax
jl 0x1004d51e
mov dword [ebp - 0x170], 1
jmp 0x1004d525
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x178], eax
mov eax, 0x2a43
sub eax, dword [ebp - 0xc4]
imul eax, dword [ebp - 0x178]
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x88], 0xffffffeb
jmp 0x1004d562
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xffffffe9
jge 0x1004d5e4
push 2
lea ecx, [ebp - 0x3f8]
call fcn.1002b6f7
mov dword [ebp - 4], 6
mov dword [ebp - 0x94], 0xd86e52d8
lea eax, [ebp - 0x3f8]
push eax
lea eax, [ebp - 0x38c]
push eax
call fcn.1004c367
pop ecx
pop ecx
mov dword [ebp - 0x94], 0
jmp 0x1004d5b7
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jg 0x1004d5d0
mov byte [ebp - 0x55], 0
lea eax, [ebp - 0x55]
push eax
call fcn.1004c470
pop ecx
jmp 0x1004d5aa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3f8]
call fcn.1002b77b
jmp 0x1004d555
mov dword [ebp - 0x2ac], 0x1da5
cmp dword [ebp - 0x2ac], 0xa1e
jge 0x1004d653
lea eax, [ebp - 0x2d4]
push eax
mov ecx, 0x1065eb30
call fcn.1002aea5
and dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x38]
inc eax
imul eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
inc ecx
inc ecx
imul eax, ecx
imul ecx, dword [ebp - 0x2d4], 6
cmp eax, ecx
jg 0x1004d633
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
jmp 0x1004d60f
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
push fcn.1002fce0
push dword [ebp - 0x38]
mov ecx, 0x1065ea78
call fcn.1002b4c3
mov ecx, eax
call fcn.1002b293
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x1b8], 0xb06c0e26
mov dword [ebp - 0x274], 0x641b44ad
mov dword [ebp - 0x24], 0
jmp 0x1004d67e
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffe5
jg 0x1004d8a6
mov dword [ebp - 0x8c], 0x34b64b5c
mov byte [ebp - 0x4d], 0
mov dword [ebp - 0x2b4], 0x260c
cmp dword [ebp - 0x2b4], 0x107d
jge 0x1004d793
push 0x108ad008
push 0x10007740
call fcn.10055feb
pop ecx
pop ecx
and dword [ebp - 0x9c], 0
jmp 0x1004d6d7
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
cmp eax, dword [0x108ad008]
jge 0x1004d701
mov eax, dword [ebp - 0x9c]
lea eax, [eax*4 + 0x108ad010]
push eax
push 0x10007740
call fcn.10055feb
pop ecx
pop ecx
jmp 0x1004d6ca
mov eax, dword [0x108ad008]
lea edx, [eax*4 + 0x108ad010]
mov ecx, 0x108ad010
call fcn.1002fcc2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [eax + 0x108ad010]
mov dword [ebp - 0x180], eax
and dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x54]
mov eax, dword [eax*4 + 0x108ad010]
cmp eax, dword [ebp - 0x180]
jne 0x1004d753
mov eax, dword [ebp - 0x54]
cmp eax, dword [0x108ad008]
jge 0x1004d753
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
jmp 0x1004d72d
mov eax, dword [ebp - 0x54]
cmp eax, dword [0x108ad008]
jne 0x1004d77d
mov eax, dword [ebp - 0x54]
mov eax, dword [eax*4 + 0x108ad00c]
cmp eax, dword [ebp - 0x180]
jne 0x1004d77d
push 0x100077c4
call fcn.100567a1
pop ecx
jmp 0x1004d793
mov eax, dword [ebp - 0x54]
push dword [eax*4 + 0x108ad010]
push 0x10007768
call fcn.10056438
pop ecx
pop ecx
movzx eax, byte [ebp - 0x4d]
test eax, eax
je 0x1004d7ac
push 0
push 0x1cfb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp dword [ebp - 0x8c], 0xb101
jl 0x1004d7c4
mov dword [ebp - 0x188], 1
jmp 0x1004d7cb
and dword [ebp - 0x188], 0
cmp dword [ebp - 0x188], 0xffffffff
ja 0x1004d7e0
mov dword [ebp - 0x190], 1
jmp 0x1004d7e7
and dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x190]
jle 0x1004d7fe
mov dword [ebp - 0x198], 1
jmp 0x1004d805
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x198], eax
jle 0x1004d83d
mov dword [ebp - 0x1a0], 1
jmp 0x1004d844
and dword [ebp - 0x1a0], 0
cmp dword [ebp - 0x1a0], 0
je 0x1004d859
mov dword [ebp - 0x1a8], 1
jmp 0x1004d860
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x8c]
imul eax, dword [ebp - 0x1a8]
cmp eax, dword [ebp - 0x24]
jl 0x1004d87e
mov dword [ebp - 0x1b0], 1
jmp 0x1004d885
and dword [ebp - 0x1b0], 0
imul eax, dword [ebp - 0x1b0], 0xfffffff6
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x274], eax
jmp 0x1004d677
lea eax, [ebp - 0x88]
push eax
call fcn.1004c493
pop ecx
mov dword [ebp - 0xd8], 7
mov dword [ebp - 0xe0], 0xfffffffb
mov dword [ebp - 0xac], 0xfffffff8
mov dword [ebp - 0x278], 1
mov dword [ebp - 0x5c], 0xb996a530
mov dword [ebp - 0x344], 0xfffffffd
mov dword [ebp - 0x340], 0xfffffffd
mov dword [ebp - 0x33c], 0xfffffffd
mov dword [ebp - 0x338], 0xfffffffd
lea ecx, [ebp - 0xed]
call fcn.1002b805
push eax
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x344]
push eax
lea ecx, [ebp - 0x438]
call fcn.1002b808
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x350]
call fcn.1002b755
mov dword [ebp - 4], 7
mov dword [ebp - 0x200], 0xfb49a5c1
mov dword [ebp - 0x330], 0xfffffff6
mov dword [ebp - 0x32c], 0xfffffff6
mov dword [ebp - 0x328], 0xfffffff6
mov dword [ebp - 0x324], 0xfffffff6
lea ecx, [ebp - 0xd9]
call fcn.1002b805
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0x440]
call fcn.1002b808
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x374]
call fcn.1002b755
mov byte [ebp - 4], 8
mov dword [ebp - 0x298], 0xffffffff
mov dword [ebp - 0xa4], 0
jmp 0x1004d9d4
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jge 0x1004d9f0
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x1e8], 0xf5ed9a92
jmp 0x1004d9c7
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x3d4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1e8], 0x9e96bb64
jb 0x1004da27
mov dword [ebp - 0x1c0], 1
jmp 0x1004da2e
and dword [ebp - 0x1c0], 0
cmp dword [ebp - 0x1c0], 0x652f
jne 0x1004da46
mov dword [ebp - 0x1c8], 1
jmp 0x1004da4d
and dword [ebp - 0x1c8], 0
mov esi, dword [ebp - 0x1c8]
add esi, 0x3d7f
push 3
lea ecx, [ebp - 0x350]
call fcn.1002b7f6
cmp esi, dword [eax]
jge 0x1004da76
mov dword [ebp - 0x280], 1
jmp 0x1004da7d
and dword [ebp - 0x280], 0
cmp dword [ebp - 0xd8], 0
ja 0x1004da92
mov dword [ebp - 0xc8], 1
jmp 0x1004da99
and dword [ebp - 0xc8], 0
push 3
lea ecx, [ebp - 0x350]
call fcn.1002b7f6
mov ecx, dword [ebp - 0xc8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0xc8], eax
je 0x1004dac8
mov dword [ebp - 0x1d0], 1
jmp 0x1004dacf
and dword [ebp - 0x1d0], 0
cmp dword [ebp - 0x1d0], 0xc821
je 0x1004dae7
mov dword [ebp - 0x1d8], 1
jmp 0x1004daee
and dword [ebp - 0x1d8], 0
push 1
lea ecx, [ebp - 0x374]
call fcn.1002b7f6
mov ecx, dword [ebp - 0x1d8]
cmp ecx, dword [eax]
jg 0x1004db11
mov dword [ebp - 0x1e0], 1
jmp 0x1004db18
and dword [ebp - 0x1e0], 0
cmp dword [ebp - 0x1e0], 0x932d
jge 0x1004db30
mov dword [ebp - 0xd0], 1
jmp 0x1004db37
and dword [ebp - 0xd0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd0]
mov dword [ebp + eax - 0x1e8], ecx
cmp dword [ebp - 0xd0], 0
jne 0x1004db65
cmp dword [ebp - 0xac], 0
jne 0x1004db65
and dword [ebp - 0x1f0], 0
jmp 0x1004db6f
mov dword [ebp - 0x1f0], 1
mov eax, dword [ebp - 0xac]
add eax, dword [ebp - 0x1f0]
cmp eax, dword [ebp - 0xac]
je 0x1004db8f
mov dword [ebp - 0x1f8], 1
jmp 0x1004db96
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x270]
cmp eax, dword [ebp - 0x290]
jne 0x1004dbd8
mov dword [ebp - 0x208], 1
jmp 0x1004dbdf
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x208], eax
jl 0x1004dbf9
mov dword [ebp - 0x214], 1
jmp 0x1004dc00
and dword [ebp - 0x214], 0
mov esi, dword [ebp - 0x214]
neg esi
push 1
lea ecx, [ebp - 0x374]
call fcn.1002b7f6
cmp esi, dword [eax]
jle 0x1004dc25
mov dword [ebp - 0x21c], 1
jmp 0x1004dc2c
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0xe0], eax
jne 0x1004dc52
mov dword [ebp - 0x224], 1
jmp 0x1004dc59
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x298], eax
mov dword [ebp - 0x5c], 0xffffffe4
jmp 0x1004dc75
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x28
jge 0x1004dc91
mov byte [ebp - 0x5d], 0
movzx eax, byte [ebp - 0x5d]
test eax, eax
je 0x1004dc8f
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
jmp 0x1004dc6e
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x374]
call fcn.1002b77b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x350]
call fcn.1002b77b
mov dword [ebp - 0x74], 0x9f9b3198
mov dword [ebp - 0x74], 0
jmp 0x1004dcc6
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xffffffe6
jl 0x1004dcec
cmp dword [ebp - 0x74], 0
je 0x1004dcd4
jmp 0x1004dcec
mov byte [ebp - 0x45], 0
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x1004dcea
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x1004dcbf
push 1
lea eax, [ebp - 0x45c]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.100498e0
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x430]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x430]
lea edi, [ebp - 0x308]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x34], 0xd453
push 4
lea ecx, [ebp - 0x35c]
call fcn.1002b6f7
mov dword [ebp - 4], 9
mov dword [ebp - 0x39c], 4
mov dword [ebp - 0x28], 0
jmp 0x1004dd50
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1004dd69
push dword [ebp - 0x28]
lea ecx, [ebp - 0x35c]
call fcn.1002b7f6
and dword [eax], 0
jmp 0x1004dd49
mov dword [ebp - 0x28], 0
jmp 0x1004dd79
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1004dd8f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x3fc], 0x5e2138b3
jmp 0x1004dd72
mov byte [ebp - 0x3d], 0
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x1004dda6
push 0x23d2
call dword [sym.imp.USER32.dll_IsIconic]
cmp dword [ebp - 0x34], 0
je 0x1004ddde
mov dword [ebp - 0x2a0], 4
mov dword [ebp - 0x34], 0
jmp 0x1004ddc6
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jg 0x1004ddd9
cmp dword [ebp - 0x2a0], 0
je 0x1004ddd7
jmp 0x1004ddd9
jmp 0x1004ddbf
jmp 0x1004e0cf
mov dword [ebp - 0xe8], 0xdbc1c234
mov dword [ebp - 0x2c0], 0xffffffff
mov dword [ebp - 0x3a4], 0x504ed09e
mov dword [ebp - 0x3dc], 0x6c56d20a
mov dword [ebp - 0x3ac], 0xcde30eca
mov dword [ebp - 0x418], 0xfffffffb
mov dword [ebp - 0x3b4], 0xfffffff8
mov dword [ebp - 0x3e4], 0
mov dword [ebp - 0x3bc], 0xfffffffc
mov dword [ebp - 0x40c], 0x8a57461d
push 2
lea ecx, [ebp - 0x408]
call fcn.1002b6f7
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x2a8], 0x180b
cmp dword [ebp - 0x2a8], 0x1179
jge 0x1004df08
push 0x107e9af4
push 0x107e9af8
push 0x10007798
call fcn.10055feb
add esp, 0xc
and dword [ebp - 0xb4], 0
jmp 0x1004dea5
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
push 0x100076ad
call fcn.100567a1
pop ecx
mov eax, dword [ebp - 0xb4]
cmp eax, dword [0x107e9af8]
jge 0x1004df08
and dword [ebp - 0x90], 0
jmp 0x1004dec9
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
cmp eax, dword [0x107e9af8]
jge 0x1004df06
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0x90]
jne 0x1004def9
push dword [0x107e9af4]
push 0x10007780
call fcn.10056438
pop ecx
pop ecx
jmp 0x1004df04
push 0x10007be4
call fcn.10056438
pop ecx
jmp 0x1004debc
jmp 0x1004de8d
mov dword [ebp - 0x2c], 0
jmp 0x1004df18
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1004df34
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x408]
call fcn.1002b7f6
mov dword [eax], 2
jmp 0x1004df11
mov dword [ebp - 0x2c], 0
jmp 0x1004df44
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1004df5a
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x31c], 0xb407cb0b
jmp 0x1004df3d
mov dword [ebp - 0x34], 0
jmp 0x1004df6a
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jg 0x1004e0a5
mov dword [ebp - 0x68], 0xffffffff
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0xe8], eax
jne 0x1004df9b
mov dword [ebp - 0x22c], 1
jmp 0x1004dfa2
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x22c], eax
je 0x1004dfb9
mov dword [ebp - 0x2b0], 1
jmp 0x1004dfc0
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x3ec], eax
push 2
lea ecx, [ebp - 0x35c]
call fcn.1002b7f6
cmp dword [eax], 0xe8b01213
jb 0x1004dfea
mov dword [ebp - 0x234], 1
jmp 0x1004dff1
and dword [ebp - 0x234], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x234]
cmp eax, dword [ebp - 0x68]
jl 0x1004e00b
mov dword [ebp - 0x23c], 1
jmp 0x1004e012
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x23c], eax
jl 0x1004e02c
mov dword [ebp - 0xf8], 1
jmp 0x1004e033
and dword [ebp - 0xf8], 0
cmp dword [ebp - 0xf8], 0x3e99
jne 0x1004e04b
mov dword [ebp - 0xfc], 1
jmp 0x1004e052
and dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0xfc], eax
jle 0x1004e069
mov dword [ebp - 0x104], 1
jmp 0x1004e070
and dword [ebp - 0x104], 0
mov eax, dword [ebp - 0x104]
add eax, 0xbac8
cmp eax, dword [ebp - 0xe8]
jne 0x1004e08f
mov dword [ebp - 0x2b8], 1
jmp 0x1004e096
and dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2c0], 0x9a2a67f6
jmp 0x1004df63
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x31c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x31c], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x408]
call fcn.1002b77b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x35c]
call fcn.1002b77b
cmp dword [ebp - 0x308], 0
je 0x1004e0fb
push 5
push dword [ebp - 0x300]
push dword [ebp - 0x304]
call dword [ebp - 0x308]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret