Function at 0x46f20b
Capabilities:
Contain obfuscated stackstrings
Validate payment card number using luhn algorithm

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9ac
push esi
push edi
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x46f41a
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x54c], 0x16e5
cmp dword [ebp - 0x54c], 0x8f5
jge 0x46f400
lea eax, [ebp - 0x224]
push eax
push 0xac224c
call fcn.004fad78
pop ecx
pop ecx
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x518], eax
mov eax, dword [ebp - 0x224]
dec eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x518], 0
je 0x46f400
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x90]
push eax
push 0xac230c
call fcn.004fad78
add esp, 0xc
mov eax, dword [ebp - 0x90]
dec eax
cdq
sub eax, edx
sar eax, 1
cmp dword [ebp - 0x144], eax
jle 0x46f2ba
push 0xac22a4
call fcn.004fb4f7
pop ecx
jmp 0x46f258
or dword [ebp - 0x520], 0xffffffff
lea eax, [ebp - 0x520]
push eax
mov eax, dword [ebp - 0x90]
inc eax
push eax
lea ecx, [ebp - 0x5f8]
call fcn.00428b88
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x198], 2
jmp 0x46f30b
mov eax, dword [ebp - 0x198]
inc eax
inc eax
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x198]
cmp eax, dword [ebp - 0x90]
jg 0x46f341
cmp dword [ebp - 0x144], 0
jle 0x46f341
push dword [ebp - 0x198]
lea ecx, [ebp - 0x5f8]
call fcn.00428ce3
mov ecx, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
jmp 0x46f2f0
mov dword [ebp - 0x110], 1
jmp 0x46f35a
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x90]
jg 0x46f39d
push dword [ebp - 0x110]
lea ecx, [ebp - 0x5f8]
call fcn.00428ce3
cmp dword [eax], 0
jge 0x46f39b
push dword [ebp - 0x110]
lea ecx, [ebp - 0x5f8]
call fcn.00428ce3
mov ecx, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
jmp 0x46f34d
mov dword [ebp - 0x1a0], 1
jmp 0x46f3b6
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
cmp eax, dword [ebp - 0x90]
jg 0x46f3e5
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0x5f8]
call fcn.00428ce3
push dword [eax]
push 0xac2284
call fcn.004fb3a8
pop ecx
pop ecx
jmp 0x46f3a9
push 0xac21b5
call fcn.004fb4f7
pop ecx
lea ecx, [ebp - 0x5f8]
call fcn.00428ae3
jmp 0x46f258
push dword [ebp - 0x528]
push 1
push 0x58e2
call fcn.00473846
add esp, 0xc
jmp 0x473840
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5b0], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x5b8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x4f0], eax
mov dword [ebp - 0x530], 0x2596
cmp dword [ebp - 0x530], 0x42c
jge 0x46f52c
lea eax, [ebp - 0x238]
push eax
push 0xac224c
call fcn.004fad78
pop ecx
pop ecx
cmp dword [ebp - 0x238], 6
jge 0x46f478
push 0xac22a4
call fcn.004fb4f7
pop ecx
jmp 0x46f4f1
push 0xac2bd4
call fcn.004fb3a8
pop ecx
mov dword [ebp - 0xe8], 7
jmp 0x46f49c
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0x238]
jg 0x46f4f1
mov eax, dword [ebp - 0xe8]
and eax, 0x80000001
jns 0x46f4bc
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x46f4cc
mov dword [ebp - 0x364], 1
jmp 0x46f4d6
mov dword [ebp - 0x364], 2
push dword [ebp - 0xe8]
push dword [ebp - 0x364]
push 0xac2bec
call fcn.004fb3a8
add esp, 0xc
jmp 0x46f48f
mov dword [ebp - 0x13c], 2
jmp 0x46f50a
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0x238]
jg 0x46f52c
push dword [ebp - 0x13c]
push 0xac2a9c
call fcn.004fb3a8
pop ecx
pop ecx
jmp 0x46f4fd
lea eax, [ebp + 0xc]
mov dword [ebp - 0x5a8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x5a8]
movzx eax, byte [eax]
test eax, eax
je 0x4737ce
mov eax, dword [ebp - 0x5b0]
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0x3d4], eax
mov eax, dword [0xcfed8c]
and eax, 1
jne 0x46f593
mov eax, dword [0xcfed8c]
or eax, 1
mov dword [0xcfed8c], eax
mov ecx, 0xcfecb4
call fcn.0042944b
push 0x51860e
call fcn.004fb37e
pop ecx
push dword [ebp - 0x3c4]
lea ecx, [ebp - 0x710]
call fcn.004288a3
lea eax, [ebp - 0x7c4]
push eax
lea ecx, [ebp - 0x710]
call fcn.0042a3e0
push dword [eax]
lea eax, [ebp - 0x90c]
push eax
lea ecx, [ebp - 0x710]
call fcn.0042a3f4
push dword [eax]
lea eax, [ebp - 0x798]
push eax
lea ecx, [ebp - 0x710]
call fcn.0042a3e0
push dword [eax]
mov edx, 0x4334cf
lea ecx, [ebp - 0x858]
call fcn.0047682d
add esp, 0xc
mov dword [ebp - 0x40], 0x8094a188
mov dword [ebp - 0x378], 0x8319b885
mov dword [ebp - 0x7a0], 3
push 2
lea ecx, [ebp - 0x888]
call fcn.00428b0d
mov dword [ebp - 0xa0], 0
jmp 0x46f634
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jge 0x46f650
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x448], 0xb319
jmp 0x46f627
lea eax, [ebp - 0x888]
push eax
push 0x74df
push 0x2956
push 0x2eaf
push 0x3216
lea eax, [ebp - 0xa0]
push eax
push 1
push 1
push 0
call fcn.004460fa
add esp, 0x24
mov dword [ebp - 0x40], 0
jmp 0x46f690
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jg 0x4700a0
mov dword [ebp - 0x74], 0xeafd94fe
mov dword [ebp - 0x84], 0xffffffff
push 4
lea ecx, [ebp - 0x874]
call fcn.00428b0d
push 1
push 0x2590
push 0x54ac
push 0x5e7e
lea eax, [ebp - 0x114]
push eax
push 0x2e35
push 1
push 0x594c
push 0x2f02
lea eax, [ebp - 0x874]
push eax
push 0x4b0c
push 1
push 0x7b63
push 0x4643
call fcn.00437807
add esp, 0x38
mov dword [ebp - 0x114], 0
jmp 0x46f71a
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 2
jge 0x46f736
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x6c8], 4
jmp 0x46f70d
mov dword [ebp - 0x5c0], 0x1b4e
cmp dword [ebp - 0x5c0], 0x1152
jge 0x46f860
lea eax, [ebp - 0x3e4]
push eax
lea eax, [ebp - 0x240]
push eax
push 0xac2278
call fcn.004fad78
add esp, 0xc
movsd xmm0, qword [0xac5378]
movsd qword [ebp - 0x53c], xmm0
mov dword [ebp - 0x8c], 1
jmp 0x46f794
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x240]
jg 0x46f844
cvtsi2sd xmm0, dword [ebp - 0x8c]
cvtsi2sd xmm1, dword [ebp - 0x8c]
mulsd xmm1, qword [0xac53d0]
cvtsi2sd xmm2, dword [ebp - 0x240]
divsd xmm1, xmm2
mov ecx, dword [ebp - 0x3e4]
movsd qword [ebp - 0x7cc], xmm0
movsd xmm0, xmm1
call fcn.00476a05
mov eax, dword [ebp - 0x8c]
dec eax
cvtsi2sd xmm1, eax
mulsd xmm1, qword [0xac53d0]
cvtsi2sd xmm2, dword [ebp - 0x240]
divsd xmm1, xmm2
mov ecx, dword [ebp - 0x3e4]
movsd qword [ebp - 0x8e4], xmm0
movsd xmm0, xmm1
call fcn.00476a05
movsd xmm1, qword [ebp - 0x8e4]
subsd xmm1, xmm0
movsd xmm0, qword [ebp - 0x7cc]
mulsd xmm0, xmm1
addsd xmm0, qword [ebp - 0x53c]
movsd qword [ebp - 0x53c], xmm0
jmp 0x46f787
push ecx
push ecx
movsd xmm0, qword [ebp - 0x53c]
movsd qword [esp], xmm0
push 0xac24a0
call fcn.004fb3a8
add esp, 0xc
mov dword [ebp - 0x74], 2
jmp 0x46f870
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jl 0x470090
mov dword [ebp - 0x288], 0xffffffff
mov dword [ebp - 0x5d0], 0x3fd5
push 2
lea ecx, [ebp - 0x608]
call fcn.00428b0d
mov dword [ebp - 0x8cc], 0x90a341a4
lea eax, [ebp - 0x608]
push eax
push 0
lea eax, [ebp - 0x7a8]
push eax
push 0
call fcn.00444e47
add esp, 0x10
mov dword [ebp - 0x5c8], 0x1db0
cmp dword [ebp - 0x5c8], 0x8a5
jge 0x46fa14
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x248]
push eax
push 0xac2268
call fcn.004fad78
add esp, 0x10
lea eax, [ebp - 0x1dc]
push eax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x25c]
push eax
push 0xac2268
call fcn.004fad78
add esp, 0x10
and dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x248]
cmp eax, dword [ebp - 0x25c]
jle 0x46f948
mov eax, dword [ebp - 0x248]
sub eax, dword [ebp - 0x25c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x3ec], eax
jmp 0x46f95a
mov eax, dword [ebp - 0x248]
sub eax, dword [ebp - 0x25c]
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x264]
cmp eax, dword [ebp - 0x260]
jle 0x46f98d
mov eax, dword [ebp - 0x264]
sub eax, dword [ebp - 0x260]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x3f4], eax
jmp 0x46f99f
mov eax, dword [ebp - 0x264]
sub eax, dword [ebp - 0x260]
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x244]
cmp eax, dword [ebp - 0x1dc]
jle 0x46f9d2
mov eax, dword [ebp - 0x244]
sub eax, dword [ebp - 0x1dc]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x41c], eax
jmp 0x46f9e4
mov eax, dword [ebp - 0x244]
sub eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x41c]
mov dword [ebp - 0x48], eax
js 0x46f9fe
mov dword [ebp - 0x424], 0xac24a8
jmp 0x46fa08
mov dword [ebp - 0x424], 0xac24ac
push dword [ebp - 0x424]
call fcn.004fb4f7
pop ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x448]
mov dword [ebp - 0x860], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x448], 1
jg 0x46fa40
mov dword [ebp - 0x400], 1
jmp 0x46fa47
and dword [ebp - 0x400], 0
cmp dword [ebp - 0x400], 0xfffffff7
jae 0x46fa5c
mov dword [ebp - 0x278], 1
jmp 0x46fa63
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x278], eax
jg 0x46fa7a
mov dword [ebp - 0x3dc], 1
jmp 0x46fa81
and dword [ebp - 0x3dc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x448]
cmp dword [ebp - 0x3dc], eax
jge 0x46faa2
mov dword [ebp - 0x368], 1
jmp 0x46faa9
and dword [ebp - 0x368], 0
cmp dword [ebp - 0x368], 0xa7eb8e13
jbe 0x46fac1
mov dword [ebp - 0x280], 1
jmp 0x46fac8
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x280]
neg eax
mov ecx, dword [ebp - 0x40]
cmp eax, dword [ebp + ecx*4 - 0x448]
jl 0x46fae8
mov dword [ebp - 0x3e0], 1
jmp 0x46faef
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x3e0]
inc eax
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x5d0]
cmp dword [ebp - 0x288], eax
je 0x46fb16
mov dword [ebp - 0x370], 1
jmp 0x46fb1d
and dword [ebp - 0x370], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x448]
cmp dword [ebp - 0x370], eax
jl 0x46fb3e
mov dword [ebp - 0x290], 1
jmp 0x46fb45
and dword [ebp - 0x290], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x448]
cmp dword [ebp - 0x290], eax
jl 0x46fb65
mov dword [ebp - 0x43c], 1
jmp 0x46fb6c
and dword [ebp - 0x43c], 0
push 0
lea ecx, [ebp - 0x608]
call fcn.00428ce3
mov ecx, dword [ebp - 0x43c]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x608]
call fcn.00428ce3
cmp dword [ebp - 0x40], 0
jne 0x46fbbf
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x448]
mov dword [ebp - 0x7b0], eax
cmp dword [ebp - 0x378], 0
je 0x46fbb6
cmp dword [ebp - 0x74], 0
jne 0x46fbbf
and dword [ebp - 0x298], 0
jmp 0x46fbc9
mov dword [ebp - 0x298], 1
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
sub eax, dword [ebp - 0x378]
je 0x46fbef
mov dword [ebp - 0x2a0], 1
jmp 0x46fbf6
and dword [ebp - 0x2a0], 0
cmp dword [ebp - 0x2a0], 7
jge 0x46fc0b
mov dword [ebp - 0x3e8], 1
jmp 0x46fc12
and dword [ebp - 0x3e8], 0
cmp dword [ebp - 0x3e8], 7
jne 0x46fc27
mov dword [ebp - 0x2a8], 1
jmp 0x46fc2e
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x2a8], eax
jl 0x46fc61
mov dword [ebp - 0x5d8], 0xffff
cmp dword [ebp - 0x5d8], 0
je 0x46fc5c
lea ecx, [ebp - 0x608]
call fcn.00428ae3
jmp 0x470090
jmp 0x470080
mov dword [ebp - 0x904], 0xbf085fff
mov dword [ebp - 0x7b8], 0xa4d2c643
mov dword [ebp - 0x868], 0xfffffff9
mov dword [ebp - 0x84], 0
jmp 0x46fc98
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jg 0x470080
mov dword [ebp - 0x7c0], 0x8afb1cad
mov dword [ebp - 0x838], 0x8a84d237
mov dword [ebp - 0x5e0], 0x21d4
cmp dword [ebp - 0x5e0], 0xf49
jge 0x46fd69
mov dword [ebp - 0x8b4], 5
and dword [ebp - 0xa8], 0
and dword [ebp - 0x1d0], 0
jmp 0x46fcfa
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 5
jge 0x46fd2a
lea eax, [ebp - 0x5e8]
push eax
push 0xac2248
call fcn.004fad78
pop ecx
pop ecx
mov eax, dword [ebp - 0xa8]
add eax, dword [ebp - 0x5e8]
mov dword [ebp - 0xa8], eax
jmp 0x46fced
cmp dword [ebp - 0xa8], 0
jle 0x46fd5e
mov eax, dword [ebp - 0xa8]
cdq
push 5
pop ecx
idiv ecx
test edx, edx
jne 0x46fd5e
mov eax, dword [ebp - 0xa8]
cdq
push 5
pop ecx
idiv ecx
push eax
push 0xac2328
call fcn.004fb3a8
pop ecx
pop ecx
jmp 0x46fd69
push 0xac22a4
call fcn.004fb4f7
pop ecx
mov byte [ebp - 0x41], 0
mov dword [ebp - 0x644], 0x15ef
cmp dword [ebp - 0x644], 0x432
jge 0x470043
lea eax, [ebp - 0x56c]
push eax
push 0xac2248
call fcn.004fad78
pop ecx
pop ecx
lea ecx, [ebp - 0x1c0]
call fcn.00428b00
lea ecx, [ebp - 0x480]
call fcn.00428b00
lea ecx, [ebp - 0x434]
call fcn.00428b00
and dword [ebp - 0x20], 0
and dword [ebp - 0x1e4], 0
jmp 0x46fdd5
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1e4]
cmp eax, dword [ebp - 0x56c]
jge 0x46fe38
lea eax, [ebp - 0x20]
push eax
push 0xac2248
call fcn.004fad78
pop ecx
pop ecx
cmp dword [ebp - 0x20], 0
jge 0x46fe0a
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c0]
call fcn.00428c5d
jmp 0x46fe36
cmp dword [ebp - 0x20], 0
jne 0x46fe21
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x480]
call fcn.00428c5d
jmp 0x46fe36
cmp dword [ebp - 0x20], 0
jle 0x46fe36
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x434]
call fcn.00428c5d
jmp 0x46fdc8
lea ecx, [ebp - 0x434]
call fcn.00428ccf
test eax, eax
jne 0x46fe9b
lea ecx, [ebp - 0x1c0]
call fcn.00428cf2
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x1c0]
call fcn.00428cf9
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x434]
call fcn.00428c5d
lea ecx, [ebp - 0x1c0]
call fcn.00428cf2
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x1c0]
call fcn.00428cf9
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x434]
call fcn.00428c5d
lea ecx, [ebp - 0x1c0]
call fcn.00428ccf
xor edx, edx
push 2
pop ecx
div ecx
test edx, edx
jne 0x46fedb
lea ecx, [ebp - 0x1c0]
call fcn.00428cf2
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x1c0]
call fcn.00428cf9
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x480]
call fcn.00428c5d
lea ecx, [ebp - 0x1c0]
call fcn.00428ccf
push eax
push 0xac2bf4
call fcn.004fb3a8
pop ecx
pop ecx
and dword [ebp - 0x190], 0
jmp 0x46ff09
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
lea ecx, [ebp - 0x1c0]
call fcn.00428ccf
cmp dword [ebp - 0x190], eax
jae 0x46ff3d
push dword [ebp - 0x190]
lea ecx, [ebp - 0x1c0]
call fcn.00428ce3
push dword [eax]
push 0xac232c
call fcn.004fb3a8
pop ecx
pop ecx
jmp 0x46fefc
push 0xac2348
call fcn.004fb3a8
pop ecx
lea ecx, [ebp - 0x434]
call fcn.00428ccf
push eax
push 0xac2bf4
call fcn.004fb3a8
pop ecx
pop ecx
and dword [ebp - 0x19c], 0
jmp 0x46ff76
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
lea ecx, [ebp - 0x434]
call fcn.00428ccf
cmp dword [ebp - 0x19c], eax
jae 0x46ffaa
push dword [ebp - 0x19c]
lea ecx, [ebp - 0x434]
call fcn.00428ce3
push dword [eax]
push 0xac232c
call fcn.004fb3a8
pop ecx
pop ecx
jmp 0x46ff69
push 0xac2348
call fcn.004fb3a8
pop ecx
lea ecx, [ebp - 0x480]
call fcn.00428ccf
push eax
push 0xac2bf4
call fcn.004fb3a8
pop ecx
pop ecx
and dword [ebp - 0x14c], 0
jmp 0x46ffe3
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
lea ecx, [ebp - 0x480]
call fcn.00428ccf
cmp dword [ebp - 0x14c], eax
jae 0x470017
push dword [ebp - 0x14c]
lea ecx, [ebp - 0x480]
call fcn.00428ce3
push dword [eax]
push 0xac232c
call fcn.004fb3a8
pop ecx
pop ecx
jmp 0x46ffd6
push 0xac2348
call fcn.004fb3a8
pop ecx
lea ecx, [ebp - 0x434]
call fcn.00428ae3
lea ecx, [ebp - 0x480]
call fcn.00428ae3
lea ecx, [ebp - 0x1c0]
call fcn.00428ae3
push 0x4b0f
push 0x7472
push 0x62fc
push 0
lea eax, [ebp - 0x41]
push eax
call fcn.0046f0fb
add esp, 0x14
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6c8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x6c8], eax
jmp 0x46fc8b
lea ecx, [ebp - 0x608]
call fcn.00428ae3
jmp 0x46f869
lea ecx, [ebp - 0x874]
call fcn.00428ae3
jmp 0x46f689
lea ecx, [ebp - 0x888]
call fcn.00428ae3
lea ecx, [ebp - 0x710]
call fcn.00433454
mov dword [ebp - 0x3cc], eax
mov dword [ebp - 0x840], 0xfffffffd
mov byte [ebp - 0x42], 0
push 0x78a1
lea eax, [ebp - 0x42]
push eax
push 1
push 0
call fcn.004426fa
add esp, 0x10
push 0x373
push 0x4947
push 0x75e4
push 0x79a7
push 0x386d
push 0x34d1
push 1
push 1
push 1
call fcn.004460fa
add esp, 0x24
movzx eax, byte [0xcfebfa]
test eax, eax
je 0x47042c
mov ecx, 0xcfecb4
call fcn.004760df
movzx eax, al
test eax, eax
jne 0x47042c
lea eax, [ebp - 0x3cc]
push eax
lea eax, [ebp - 0x2b8]
push eax
mov ecx, 0xcfecb4
call fcn.00429038
mov dword [ebp - 0x5a4], 1
mov dword [ebp - 0x510], 0xc40ed3c1
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0x8fc], 1
mov dword [ebp - 0x8dc], 0x6bde64f6
mov dword [ebp - 0x8d8], 0x6bde64f6
mov dword [ebp - 0x8d4], 0x6bde64f6
mov dword [ebp - 0x8d0], 0x6bde64f6
lea eax, [ebp - 0x5a4]
push eax
lea eax, [ebp - 0x510]
push eax
lea eax, [ebp - 0xf0]
push eax
push 0xe18
push 0
push 1
push 0x5b55
call fcn.00443309
add esp, 0x1c
mov dword [ebp - 0xf0], 0xc
jmp 0x4701db
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0x11
jg 0x47025a
push 1
lea ecx, [ebp - 0x734]
call fcn.00428b0d
push 0x5289
push 0x7382
lea eax, [ebp - 0x734]
push eax
push 1
push 0
lea eax, [ebp - 0x848]
push eax
call fcn.00437561
add esp, 0x18
lea eax, [ebp - 0x734]
push eax
push 1
push 1
call fcn.00438653
add esp, 0xc
push 0x3cd2
push 0x5db4
push 1
push 1
push 0x510c
push 0x750a
push 1
call fcn.0043c875
add esp, 0x1c
lea ecx, [ebp - 0x734]
call fcn.00428ae3
jmp 0x4701ce
mov dword [ebp - 0x4ac], 0x215f
cmp dword [ebp - 0x4ac], 0x12ff
jge 0x4703c7
lea eax, [ebp - 0x1ec]
push eax
push 0xac224c
call fcn.004fad78
pop ecx
pop ecx
and dword [ebp - 0x640], 0
lea eax, [ebp - 0x640]
push eax
mov eax, dword [ebp - 0x1ec]
inc eax
push eax
lea ecx, [ebp - 0x66c]
call fcn.00428b88
mov dword [ebp - 0x258], 1
jmp 0x4702c1
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x258]
cmp eax, dword [ebp - 0x1ec]
jge 0x47033f
lea eax, [ebp - 0x5ac]
push eax
lea eax, [ebp - 0x4b4]
push eax
push 0xac230c
call fcn.004fad78
add esp, 0xc
push dword [ebp - 0x4b4]
lea ecx, [ebp - 0x66c]
call fcn.00428ce3
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x380]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x380]
mov dword [ecx], eax
push dword [ebp - 0x5ac]
lea ecx, [ebp - 0x66c]
call fcn.00428ce3
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x2b0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2b0]
mov dword [ecx], eax
jmp 0x4702b4
and dword [ebp - 0x22c], 0
mov dword [ebp - 0x184], 1
jmp 0x47035f
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x184]
cmp eax, dword [ebp - 0x1ec]
jg 0x4703aa
push dword [ebp - 0x184]
lea ecx, [ebp - 0x66c]
call fcn.00428ce3
cmp dword [eax], 1
jne 0x47038f
mov dword [ebp - 0x3fc], 1
jmp 0x470396
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x22c]
add eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x22c], eax
jmp 0x470352
push dword [ebp - 0x22c]
push 0xac2258
call fcn.004fb3a8
pop ecx
pop ecx
lea ecx, [ebp - 0x66c]
call fcn.00428ae3
lea eax, [ebp - 0x8c4]
push eax
mov ecx, 0xcfecb4
call fcn.00428cb2
push eax
lea ecx, [ebp - 0x2b8]
call fcn.004294e0
movzx eax, al
test eax, eax
je 0x47042c
push 1
push 0x488f
push 0x7b3d
push 0
push 0x63ce
call fcn.0043bf62
add esp, 0x14
lea ecx, [ebp - 0x2b8]
call fcn.004760e8
mov ecx, dword [ebp - 0x3d4]
mov eax, dword [eax + 4]
mov dword [ecx], eax
lea ecx, [ebp - 0x710]
call fcn.00428903
jmp 0x473840
mov dword [ebp - 0x4bc], 0x2231
cmp dword [ebp - 0x4bc], 0x824
jge 0x47050e
lea eax, [ebp - 0x1f4]
push eax
push 0xac224c
call fcn.004fad78
pop ecx
pop ecx
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x61c], eax
mov eax, dword [ebp - 0x1f4]
dec eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x61c], 0
je 0x47050e
lea eax, [ebp - 0x24c]
push eax
push 0xac224c
call fcn.004fad78
pop ecx
pop ecx
cmp dword [ebp - 0x24c], 1
jl 0x4704a6
push 0xac22f0
call fcn.004fb3a8
pop ecx
cmp dword [ebp - 0x24c], 2
jl 0x4704ba
push 0xac22f4
call fcn.004fb3a8
pop ecx
and dword [ebp - 0x154], 0
jmp 0x4704d0
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
inc eax
inc eax
cmp eax, dword [ebp - 0x24c]
jge 0x4704fe
mov eax, dword [ebp - 0x154]
add eax, 9
cdq
push 0xa
pop ecx
idiv ecx
push edx
push 0xac224c
call fcn.004fb3a8
pop ecx
pop ecx
jmp 0x4704c3
push 0xac21b5
call fcn.004fb4f7
pop ecx
jmp 0x470459
and dword [ebp - 0xfc], 0
lea eax, [ebp - 0x710]
push eax
call fcn.004356ab
pop ecx
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jne 0x47372c
mov dword [ebp - 0x4c4], 0x26a1
cmp dword [ebp - 0x4c4], 0x78c
jge 0x470717
xor cl, cl
call fcn.00403fb2
lea eax, [ebp - 0x1fc]
push eax
lea eax, [ebp - 0x15c]
push eax
mov ecx, 0xad3d60
call fcn.00428021
mov ecx, eax
call fcn.00428021
and dword [ebp - 0x5b4], 0
lea eax, [ebp - 0x5b4]
push eax
mov eax, dword [ebp - 0x15c]
inc eax
push eax
lea ecx, [ebp - 0x74c]
call fcn.00428b88
mov dword [ebp - 0x1a8], 1
jmp 0x4705af
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
cmp eax, dword [ebp - 0x15c]
jg 0x4705db
push dword [ebp - 0x1a8]
lea ecx, [ebp - 0x74c]
call fcn.00428ce3
push eax
mov ecx, 0xad3d60
call fcn.00428021
jmp 0x4705a2
and dword [ebp - 0x4cc], 0
lea eax, [ebp - 0x4cc]
push eax
mov eax, dword [ebp - 0x15c]
inc eax
push eax
lea ecx, [ebp - 0x618]
call fcn.00428b88
mov dword [ebp - 0x7c], 1
jmp 0x47060c
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x15c]
jg 0x47064d
mov eax, dword [ebp - 0x7c]
dec eax
push eax
lea ecx, [ebp - 0x618]
call fcn.00428ce3
mov esi, eax
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x74c]
call fcn.00428ce3
mov esi, dword [esi]
add esi, dword [eax]
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x618]
call fcn.00428ce3
mov dword [eax], esi
jmp 0x470605
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x648], eax
mov eax, dword [ebp - 0x1fc]
dec eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x648], 0
je 0x4706e5
lea eax, [ebp - 0x4d4]
push eax
lea eax, [ebp - 0x5bc]
push eax
mov ecx, 0xad3d60
call fcn.00428021
mov ecx, eax
call fcn.00428021
push dword [ebp - 0x4d4]
lea ecx, [ebp - 0x618]
call fcn.00428ce3
mov esi, eax
mov eax, dword [ebp - 0x5bc]
dec eax
push eax
lea ecx, [ebp - 0x618]
call fcn.00428ce3
mov ecx, dword [esi]
sub ecx, dword [eax]
mov dword [ebp - 0x388], ecx
cmp dword [ebp - 0x388], 0
jle 0x4706e0
mov eax, dword [ebp - 0x234]
add eax, dword [ebp - 0x388]
mov dword [ebp - 0x234], eax
jmp 0x470654
push fcn.0042f9e1
push dword [ebp - 0x234]
mov ecx, 0xad3cb8
call fcn.0042844a
mov ecx, eax
call fcn.0042841d
lea ecx, [ebp - 0x618]
call fcn.00428ae3
lea ecx, [ebp - 0x74c]
call fcn.00428ae3
mov dword [ebp - 0x788], 0xfffffff6
push 0x211d
push 0x78d6
push 0
push 1
push 0x6117
push 0x511
push 0x202a
call fcn.00439853
add esp, 0x1c
push 1
push 0x6d1
push 1
push 0x44f3
push 0x8bd
call fcn.00446606
add esp, 0x14
cmp dword [0xcfec00], 0
jne 0x47370b
mov dword [ebp - 0x64], 0xfffffff6
push 3
lea ecx, [ebp - 0x474]
call fcn.00428b0d
mov dword [ebp - 0x5c4], 0xeb969161
mov dword [ebp - 0x18c], 0x3572
push 1
lea ecx, [ebp - 0x6b4]
call fcn.00428b0d
push 2
lea ecx, [ebp - 0x728]
call fcn.00428b0d
push 3
lea ecx, [ebp - 0x638]
call fcn.00428b0d
mov dword [ebp - 0xf8], 5
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x607a
push 0x55d6
push 0
push 0x3982
push 0x1e52
call fcn.004492ed
add esp, 0x1c
mov dword [ebp - 0xc], 0
jmp 0x470800
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x47081c
push dword [ebp - 0xc]
lea ecx, [ebp - 0x6b4]
call fcn.00428ce3
mov dword [eax], 0xdb77
jmp 0x4707f9
lea eax, [ebp - 0xc]
push eax
push 0x355e
push 0x79ee
push 1
lea eax, [ebp - 0x728]
push eax
push 1
push 0x42e0
call fcn.00439083
add esp, 0x1c
push 1
push 0x2d45
push 0x3eab
push 1
lea eax, [ebp - 0xc]
push eax
push 0x3cca
lea eax, [ebp - 0x638]
push eax
push 0x39e0
push 1
call fcn.004393f4
add esp, 0x24
mov dword [ebp - 0xc], 0
jmp 0x47087f
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jge 0x470895
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x78c], 1
jmp 0x470878
mov dword [ebp - 0xc], 0
jmp 0x4708a5
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x4708bb
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x984], 0x8b4fd089
jmp 0x47089e
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x794], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x4dc], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x62c], eax
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x4dc]
cmp eax, dword [ebp - 0x62c]
je 0x470900
mov dword [ebp - 0x2c0], 1
jmp 0x470907
and dword [ebp - 0x2c0], 0
cmp dword [ebp - 0x2c0], 1
jge 0x47091c
mov dword [ebp - 0x3f0], 1
jmp 0x470923
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x79c], eax
mov eax, dword [ebp - 0x3f0]
add eax, 6
cmp dword [ebp - 0x64], eax
jne 0x470946
mov dword [ebp - 0x2c8], 1
jmp 0x47094d
and dword [ebp - 0x2c8], 0
cmp dword [ebp - 0x2c8], 1
jl 0x470965
cmp dword [ebp - 0x64], 0
je 0x470965
cmp dword [ebp - 0x18c], 0
jne 0x470980
push 1
lea ecx, [ebp - 0x474]
call fcn.00428ce3
cmp dword [eax], 0
jne 0x470980
and dword [ebp - 0x4e4], 0
jmp 0x47098a
mov dword [ebp - 0x4e4], 1
mov eax, dword [ebp - 0x5c4]
mov dword [ebp - 0x7a4], eax
push 0
lea ecx, [ebp - 0x474]
call fcn.00428ce3
cmp dword [eax], 0
je 0x470b38
push 2
lea ecx, [ebp - 0x628]
call fcn.00428b0d
lea eax, [ebp - 0x628]
push eax
push 0
push 1
push 1
lea eax, [ebp - 0xb0]
push eax
push 0x40aa
call fcn.00445096
add esp, 0x18
mov dword [ebp - 0xb0], 0
jmp 0x4709f3
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x470a0f
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x390], 0
jmp 0x4709e6
push 0
lea ecx, [ebp - 0x6b4]
call fcn.00428ce3
mov dword [eax], 0xfffffffa
push 2
lea ecx, [ebp - 0x474]
call fcn.00428ce3
mov dword [eax], 0xfffffffa
push 0
lea ecx, [ebp - 0x728]
call fcn.00428ce3
mov dword [eax], 0xfffffffa
mov eax, 0x1e5c
cmp eax, 0xfffffffa
je 0x470a5e
mov dword [ebp - 0x2d0], 1
jmp 0x470a65
and dword [ebp - 0x2d0], 0
push 0
lea ecx, [ebp - 0x628]
call fcn.00428ce3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x390]
inc eax
mov dword [ebp - 0x4ec], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4ec]
mov dword [ebp + eax - 0x390], ecx
push 0
lea ecx, [ebp - 0x628]
call fcn.00428ce3
push 0
lea ecx, [ebp - 0x638]
call fcn.00428ce3
mov dword [ebp - 0x650], eax
push 0
lea ecx, [ebp - 0x638]
call fcn.00428ce3
mov ecx, dword [ebp - 0x650]
mov eax, dword [eax]
mov dword [ecx], eax
cmp dword [ebp - 0x64], 0xa557
jg 0x470ae5
mov dword [ebp - 0x404], 1
jmp 0x470aec
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x2d0]
cmp eax, dword [ebp - 0x404]
jle 0x470b06
mov dword [ebp - 0x2d8], 1
jmp 0x470b0d
and dword [ebp - 0x2d8], 0
push 1
lea ecx, [ebp - 0x628]
call fcn.00428ce3
mov ecx, dword [ebp - 0x2d8]
add ecx, dword [eax]
mov dword [ebp - 0xf8], ecx
lea ecx, [ebp - 0x628]
call fcn.00428ae3
jmp 0x4710d3
mov dword [ebp - 0x504], 0x6f4846e1
mov dword [ebp - 0x20c], 6
mov dword [ebp - 0x2f8], 0x5c8bb6af
mov dword [ebp - 0x4f4], 0x1f00
cmp dword [ebp - 0x4f4], 0x128c
jge 0x470c01
lea eax, [ebp - 0x87c]
push eax
lea eax, [ebp - 0x398]
push eax
push 0xac2bfc
call fcn.004fad78
add esp, 0xc
cvtsi2sd xmm0, dword [ebp - 0x398]
movsd xmm1, qword [0xac53f8]
divsd xmm1, xmm0
movsd xmm0, xmm1
call fcn.005159f0
mulsd xmm0, qword [ebp - 0x87c]
cvtsi2sd xmm1, dword [ebp - 0x398]
movsd xmm2, qword [0xac53f8]
divsd xmm2, xmm1
movsd qword [ebp - 0x7d8], xmm0
movsd xmm0, xmm2
call fcn.005159f0
movsd xmm1, qword [0xac53d0]
subsd xmm1, xmm0
movsd xmm0, qword [ebp - 0x7d8]
divsd xmm0, xmm1
push ecx
push ecx
movsd qword [esp], xmm0
push 0xac2494
call fcn.004fb3a8
add esp, 0xc
mov dword [ebp - 0x3a8], 0x8a83a56c
mov dword [ebp - 0x63c], 0xfffffffc
push 2
lea ecx, [ebp - 0x89c]
call fcn.00428b0d
mov dword [ebp - 0x5d4], 0xac39
mov dword [ebp - 0x5cc], 0x1b89
cmp dword [ebp - 0x5cc], 0x782
jge 0x470e8d
lea eax, [ebp - 0x204]
push eax
push 0xac224c
call fcn.004fad78
pop ecx
pop ecx
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x204]
dec eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x4fc], 0
je 0x470e8d
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push eax
push 0xac230c
call fcn.004fad78
add esp, 0xc
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x70]
lea eax, [ecx + eax - 1]
push eax
lea ecx, [ebp - 0x684]
call fcn.00428b0d
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x70]
lea eax, [ecx + eax - 1]
push eax
lea ecx, [ebp - 0x6c0]
call fcn.00428b0d
and dword [ebp - 0x108], 0
jmp 0x470cd6
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x70]
jge 0x470d92
and dword [ebp - 0x94], 0
jmp 0x470cfb
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x68]
jge 0x470d8d
lea eax, [ebp - 0x3f8]
push eax
push 0xac2248
call fcn.004fad78
pop ecx
pop ecx
mov eax, dword [ebp - 0x108]
add eax, dword [ebp - 0x94]
push eax
lea ecx, [ebp - 0x684]
call fcn.00428ce3
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x2e0]
mov eax, dword [eax]
add eax, dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x2e0]
mov dword [ecx], eax
mov eax, dword [ebp - 0x108]
add eax, dword [ebp - 0x94]
push eax
lea ecx, [ebp - 0x6c0]
call fcn.00428ce3
mov dword [ebp - 0x2e8], eax
xor eax, eax
inc eax
sub eax, dword [ebp - 0x3f8]
mov ecx, dword [ebp - 0x2e8]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x2e8]
mov dword [ecx], eax
jmp 0x470cee
jmp 0x470cc9
and dword [ebp - 0x250], 0
and dword [ebp - 0x50], 0
jmp 0x470da6
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
lea eax, [eax + eax + 2]
mov ecx, dword [ebp - 0x70]
add ecx, dword [ebp - 0x68]
cmp eax, ecx
jge 0x470e60
push dword [ebp - 0x50]
lea ecx, [ebp - 0x684]
call fcn.00428ce3
mov esi, eax
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x70]
lea eax, [ecx + eax - 2]
sub eax, dword [ebp - 0x50]
push eax
lea ecx, [ebp - 0x684]
call fcn.00428ce3
mov ecx, dword [esi]
add ecx, dword [eax]
mov dword [ebp - 0x3a0], ecx
push dword [ebp - 0x50]
lea ecx, [ebp - 0x6c0]
call fcn.00428ce3
mov esi, eax
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x70]
lea eax, [ecx + eax - 2]
sub eax, dword [ebp - 0x50]
push eax
lea ecx, [ebp - 0x6c0]
call fcn.00428ce3
mov ecx, dword [esi]
add ecx, dword [eax]
mov dword [ebp - 0x2f0], ecx
mov eax, dword [ebp - 0x3a0]
cmp eax, dword [ebp - 0x2f0]
jge 0x470e3d
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x40c], eax
jmp 0x470e49
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x250]
add eax, dword [ebp - 0x40c]
mov dword [ebp - 0x250], eax
jmp 0x470d9f
push dword [ebp - 0x250]
push 0xac2258
call fcn.004fb3a8
pop ecx
pop ecx
lea ecx, [ebp - 0x6c0]
call fcn.00428ae3
lea ecx, [ebp - 0x684]
call fcn.00428ae3
jmp 0x470c59
push 0
lea eax, [ebp - 0x89c]
push eax
push 0x3839
lea eax, [ebp - 0x7ac]
push eax
push 0x2983
push 0
push 0x51f3
call fcn.0046f20b
add esp, 0x1c
mov dword [ebp - 0xf8], 0xfffffffc
jmp 0x470ecf
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0x1a
jne 0x4710b0
mov dword [ebp - 0x30], 0
jmp 0x470eec
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x470f02
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x318], 1
jmp 0x470ee5
mov dword [ebp - 0x30], 0
jmp 0x470f12
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x470f28
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x8ec], 0
jmp 0x470f0b
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x2f8]
mov ecx, dword [ebp - 0x20c]
dec ecx
mov dword [ebp - 0x20c], ecx
test eax, eax
je 0x471033
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x7b4], eax
cmp dword [ebp - 0x3a8], 0
je 0x471033
cmp dword [ebp - 0x63c], 1
jne 0x470f7d
mov dword [ebp - 0x23c], 1
jmp 0x470f84
and dword [ebp - 0x23c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x23c]
mov dword [ebp + eax - 0x8ec], ecx
cmp dword [ebp - 0x23c], 0
jne 0x470fac
mov dword [ebp - 0x300], 1
jmp 0x470fb3
and dword [ebp - 0x300], 0
cmp dword [ebp - 0x300], 0xc987f9bd
ja 0x470fcb
mov dword [ebp - 0x414], 1
jmp 0x470fd2
and dword [ebp - 0x414], 0
push 1
lea ecx, [ebp - 0x474]
call fcn.00428ce3
mov ecx, dword [ebp - 0x414]
mov dword [eax], ecx
xor eax, eax
jne 0x471006
push 0
lea ecx, [ebp - 0x6b4]
call fcn.00428ce3
cmp dword [eax], 0
jne 0x471006
and dword [ebp - 0x308], 0
jmp 0x471010
mov dword [ebp - 0x308], 1
push 0
lea ecx, [ebp - 0x638]
call fcn.00428ce3
mov ecx, dword [ebp - 0x308]
cmp ecx, dword [eax]
jl 0x471033
mov dword [ebp - 0x3b0], 1
jmp 0x47103a
and dword [ebp - 0x3b0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x318]
imul ecx, dword [ebp - 0x3b0], 0xffff
lea eax, [eax + ecx + 3]
cmp dword [ebp - 0x504], eax
jl 0x471069
mov dword [ebp - 0x310], 1
jmp 0x471070
and dword [ebp - 0x310], 0
cmp dword [ebp - 0x310], 0xfff7
jbe 0x47108e
mov eax, 0xca71
test eax, eax
jne 0x47108e
and dword [ebp - 0x420], 0
jmp 0x471098
mov dword [ebp - 0x420], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x420]
mov dword [ebp + eax - 0x318], ecx
jmp 0x470ec2
push 0xe90
lea eax, [ebp - 0x5d4]
push eax
push 1
push 1
call fcn.004403e6
add esp, 0x10
lea ecx, [ebp - 0x89c]
call fcn.00428ae3
lea ecx, [ebp - 0x638]
call fcn.00428ae3
lea ecx, [ebp - 0x728]
call fcn.00428ae3
lea ecx, [ebp - 0x6b4]
call fcn.00428ae3
lea ecx, [ebp - 0x474]
call fcn.00428ae3
mov dword [ebp - 0x50c], 0x13aa
cmp dword [ebp - 0x50c], 0x958
jge 0x47129c
mov dword [ebp - 0x7bc], 0x94
lea eax, [ebp - 0x1a4]
push eax
push 0xac224c
call fcn.004fad78
pop ecx
pop ecx
push dword [ebp - 0x1a4]
lea ecx, [ebp - 0x48c]
call fcn.00475f5c
and dword [ebp - 0x164], 0
jmp 0x47115d
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
cmp eax, dword [ebp - 0x1a4]
jge 0x47118b
push dword [ebp - 0x164]
lea ecx, [ebp - 0x48c]
call fcn.00428af1
push eax
push 0xac224c
call fcn.004fad78
pop ecx
pop ecx
jmp 0x471150
lea eax, [ebp - 0x784]
push eax
lea ecx, [ebp - 0x48c]
call fcn.00428cc0
push dword [eax]
lea eax, [ebp - 0x7d0]
push eax
lea ecx, [ebp - 0x48c]
call fcn.00428cb2
push dword [eax]
call fcn.004767c5
pop ecx
pop ecx
xorpd xmm0, xmm0
movlpd qword [ebp - 0x138], xmm0
and dword [ebp - 0xd8], 0
jmp 0x4711dc
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x1a4]
jge 0x471278
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x48c]
call fcn.00428af1
mov esi, eax
mov eax, dword [ebp - 0x1a4]
dec eax
sub eax, dword [ebp - 0xd8]
push eax
lea ecx, [ebp - 0x48c]
call fcn.00428af1
push dword [eax + 4]
push dword [eax]
push dword [esi + 4]
push dword [esi]
call fcn.004ff5a0
push 0
push 0x94
push edx
push eax
call fcn.00514360
add eax, dword [ebp - 0x138]
adc edx, dword [ebp - 0x134]
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], edx
push 0
push 0x94
push dword [ebp - 0x134]
push dword [ebp - 0x138]
call fcn.00514360
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], edx
jmp 0x4711cf
push dword [ebp - 0x134]
push dword [ebp - 0x138]
push 0xac2250
call fcn.004fb3a8
add esp, 0xc
lea ecx, [ebp - 0x48c]
call fcn.00428ae3
mov dword [ebp - 0x7dc], 1
mov dword [ebp - 0x7e8], 0
push 4
lea ecx, [ebp - 0x8c0]
call fcn.00428b0d
push 1
lea ecx, [ebp - 0x8b0]
call fcn.00428b0d
mov dword [ebp - 0x7f4], 0xfffffff9
mov dword [ebp - 0x51c], 0x6123
mov dword [ebp - 0x658], 0x1bbc
cmp dword [ebp - 0x658], 0xab7
jge 0x47140c
lea eax, [ebp - 0x514]
push eax
push 0xac224c
call fcn.004fad78
pop ecx
pop ecx
and dword [ebp - 0x38], 0
or dword [ebp - 0x2c], 0xffffffff
or dword [ebp - 0x3b8], 0xffffffff
and dword [ebp - 0x214], 0
jmp 0x471330
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cmp eax, dword [ebp - 0x514]
jge 0x4713ea
lea eax, [ebp - 0x34]
push eax
push 0xac224c
call fcn.004fad78
pop ecx
pop ecx
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x2c]
je 0x471372
cmp dword [ebp - 0x34], 2
jne 0x471366
cmp dword [ebp - 0x2c], 3
je 0x471372
cmp dword [ebp - 0x34], 3
jne 0x471378
cmp dword [ebp - 0x2c], 2
jne 0x471378
or dword [ebp - 0x38], 0xffffffff
jmp 0x4713ea
cmp dword [ebp - 0x34], 1
jne 0x471384
cmp dword [ebp - 0x2c], 2
je 0x471390
cmp dword [ebp - 0x34], 2
jne 0x471399
cmp dword [ebp - 0x2c], 1
jne 0x471399
mov eax, dword [ebp - 0x38]
add eax, 3
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x34], 1
jne 0x4713a5
cmp dword [ebp - 0x2c], 3
je 0x4713b1
cmp dword [ebp - 0x34], 3
jne 0x4713ba
cmp dword [ebp - 0x2c], 1
jne 0x4713ba
mov eax, dword [ebp - 0x38]
add eax, 4
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x34], 2
jne 0x4713d6
cmp dword [ebp - 0x2c], 1
jne 0x4713d6
cmp dword [ebp - 0x3b8], 3
jne 0x4713d6
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
jmp 0x471323
cmp dword [ebp - 0x38], 0
jge 0x4713fd
push 0xac24c4
call fcn.004fb4f7
pop ecx
jmp 0x47140c
push dword [ebp - 0x38]
push 0xac2c04
call fcn.004fb3a8
pop ecx
pop ecx
lea eax, [ebp - 0x5dc]
push eax
push 0x322e
push 1
push 1
push 0x609e
push 0x7970
lea eax, [ebp - 0x8c0]
push eax
call fcn.00439853
add esp, 0x1c
lea eax, [ebp - 0x8b0]
push eax
push 0
push 0
push 0x5a86
push 0x51dc
lea eax, [ebp - 0x5dc]
push eax
push 0x5f9
push 1
call fcn.0043b727
add esp, 0x20
push 0xb80
push 0
push 1
lea eax, [ebp - 0x51c]
push eax
push 0x6f6f
call fcn.00448cf1
add esp, 0x14
mov byte [ebp - 0x44], 0
movzx eax, byte [ebp - 0x44]
test eax, eax
je 0x4714a6
push 0x7d7f
push 0x3a01
push 0x5bea
push 0
push 1
push 1
call fcn.004370e9
add esp, 0x18
lea ecx, [ebp - 0x8b0]
call fcn.00428ae3
lea ecx, [ebp - 0x8c0]
call fcn.00428ae3
push 1
push 1
push 0x261f
push 0x7dc9
push 0x3d56
call fcn.00440bc1
add esp, 0x14
mov byte [ebp - 0xd0], 4
mov byte [ebp - 0xcf], 0x44
mov byte [ebp - 0xce], 1
mov byte [ebp - 0xcd], 0
mov byte [ebp - 0xcc], 0
mov byte [ebp - 0xcb], 0x2e
mov byte [ebp - 0xca], 3
mov byte [ebp - 0xc9], 0x25
mov byte [ebp - 0xc8], 7
mov byte [ebp - 0xc7], 0x5c
mov byte [ebp - 0xc6], 1
mov byte [ebp - 0xc5], 0xad
mov byte [ebp - 0xc4], 0xb
mov byte [ebp - 0xc3], 0x5e
mov byte [ebp - 0xc2], 5
mov byte [ebp - 0xc1], 0
mov byte [ebp - 0xc0], 9
mov byte [ebp - 0xbf], 8
mov byte [ebp - 0xbe], 2
mov byte [ebp - 0xbd], 0x16
mov byte [ebp - 0xbc], 6
mov byte [ebp - 0xbb], 0x41
mov byte [ebp - 0xba], 8
mov byte [ebp - 0xb9], 0x1d
mov byte [ebp - 0xb8], 0xa
mov byte [ebp - 0xb7], 0x42
mov dword [ebp - 0x660], 0x18b8
cmp dword [ebp - 0x660], 0x11c6
jge 0x471726
lea eax, [ebp - 0x254]
push eax
push 0xac224c
call fcn.004fad78
pop ecx
pop ecx
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x524], eax
mov eax, dword [ebp - 0x254]
dec eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x524], 0
je 0x471726
lea eax, [ebp - 0x568]
push eax
push 0xac224c
call fcn.004fad78
pop ecx
pop ecx
lea ecx, [ebp - 0x26c]
call fcn.0042904d
lea ecx, [ebp - 0x548]
call fcn.004294f3
mov dword [ebp - 0x16c], 1
jmp 0x471622
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x16c]
cmp eax, dword [ebp - 0x568]
jg 0x4716bf
lea eax, [ebp - 0x10c]
push eax
push 0xac224c
call fcn.004fad78
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x26c]
call fcn.0042917d
test eax, eax
je 0x47168a
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x26c]
call fcn.004290e9
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x95c]
push eax
lea ecx, [ebp - 0x548]
call fcn.00429508
jmp 0x4716ba
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x548]
call fcn.0042917d
test eax, eax
jne 0x4716ba
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x26c]
call fcn.00429062
mov ecx, dword [ebp - 0x16c]
mov dword [eax], ecx
jmp 0x471615
lea ecx, [ebp - 0x26c]
call fcn.004290e5
test eax, eax
je 0x4716f2
lea eax, [ebp - 0x800]
push eax
lea ecx, [ebp - 0x26c]
call fcn.004290d5
mov ecx, eax
call fcn.0042964f
mov eax, dword [eax + 4]
mov dword [ebp - 0x320], eax
jmp 0x4716f9
or dword [ebp - 0x320], 0xffffffff
push dword [ebp - 0x320]
push 0xac2258
call fcn.004fb3a8
pop ecx
pop ecx
lea ecx, [ebp - 0x548]
call fcn.00429526
lea ecx, [ebp - 0x26c]
call fcn.004290b3
jmp 0x4715ba
push 1
lea ecx, [ebp - 0x740]
call fcn.00428b0d
mov dword [ebp - 0x78], 0x56f9b2cf
mov dword [ebp - 0x570], 0xfffe
mov dword [ebp - 0x194], 0
jmp 0x47175d
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 1
jge 0x47177f
push dword [ebp - 0x194]
lea ecx, [ebp - 0x740]
call fcn.00428ce3
mov dword [eax], 0xe0bcd8c4
jmp 0x471750
lea eax, [ebp - 0x78]
push eax
push 0x2cd3
push 0
push 1
push 0x3b13
push 0x850
push 0x4e3b
call fcn.00448753
add esp, 0x1c
mov dword [ebp - 0x78], 0x17
jmp 0x4717b3
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 9
je 0x4717f4
mov dword [ebp - 0x52c], 0xad9b
lea eax, [ebp - 0x52c]
push eax
push 0x5177
lea eax, [ebp - 0x740]
push eax
lea eax, [ebp - 0x570]
push eax
push 1
push 0x4fbb
lea eax, [ebp - 0x78]
push eax
push 1
call fcn.00446bda
add esp, 0x20
jmp 0x4717ac
lea ecx, [ebp - 0x740]
call fcn.00428ae3
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0xd0]
or eax, 0x21
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0xd0]
and ecx, 0x21
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0xd0]
mov word [ebp + ecx*2 - 0x780], ax
mov dword [ebp - 0x10], 2
and dword [ebp - 0xac], 0
jmp 0x471851
mov eax, dword [ebp - 0x10]
inc eax
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x1a
jae 0x4725a0
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xd0]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x10], eax
jne 0x47189b
mov eax, dword [ebp - 0x10]
movzx eax, byte [ebp + eax - 0xd0]
inc eax
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [ebp + eax - 0xd0]
mov ecx, dword [ebp - 0x10]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x10], eax
jmp 0x471849
push 1
lea ecx, [ebp - 0x1cc]
call fcn.00428b0d
mov dword [ebp - 0x1d4], 1
mov dword [ebp - 0x58], 0x5f432603
mov dword [ebp - 0x3c8], 0xfffffff8
mov dword [ebp - 0x534], 0x1d23
cmp dword [ebp - 0x534], 0x101e
jge 0x471955
lea eax, [ebp - 0x21c]
push eax
push 0xac224c
call fcn.004fad78
pop ecx
pop ecx
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x578], eax
mov eax, dword [ebp - 0x21c]
dec eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x578], 0
je 0x471955
lea eax, [ebp - 0x408]
push eax
push 0xac224c
call fcn.004fad78
pop ecx
pop ecx
cmp dword [ebp - 0x408], 2
jle 0x47193a
mov eax, dword [ebp - 0x408]
dec eax
dec eax
mov dword [ebp - 0x328], eax
jmp 0x471941
and dword [ebp - 0x328], 0
push dword [ebp - 0x328]
push 0xac2258
call fcn.004fb3a8
pop ecx
pop ecx
jmp 0x4718ec
push 1
push 0xf84
lea eax, [ebp - 0x1cc]
push eax
push 0x3462
push 0x7b06
push 1
push 0x3425
lea eax, [ebp - 0xe0]
push eax
call fcn.00441bad
add esp, 0x20
mov dword [ebp - 0xe0], 0
jmp 0x47199c
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jge 0x4719b8
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0x758], 0xffffffff
jmp 0x47198f
mov eax, 0x93d0b548
test eax, eax
je 0x4719fc
push 0
lea ecx, [ebp - 0x1cc]
call fcn.00428ce3
mov esi, eax
push 0
lea ecx, [ebp - 0x1cc]
call fcn.00428ce3
mov ecx, dword [esi]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x1d4]
jg 0x4719fc
push 0
lea ecx, [ebp - 0x1cc]
call fcn.00428ce3
cmp dword [eax], 0
jne 0x471a0e
cmp dword [ebp - 0x1d4], 0
jne 0x471a0e
and dword [ebp - 0x3c0], 0
jmp 0x471a18
mov dword [ebp - 0x3c0], 1
push 0
lea ecx, [ebp - 0x1cc]
call fcn.00428ce3
mov esi, dword [ebp - 0x3c0]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x1cc]
call fcn.00428ce3
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x1cc]
call fcn.00428ce3
cmp esi, dword [eax]
jl 0x471a5e
xor eax, eax
inc eax
je 0x471a5e
mov dword [ebp - 0x330], 1
jmp 0x471a65
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x540], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x540]
mov dword [ebp + eax - 0x758], ecx
push 0
lea ecx, [ebp - 0x1cc]
call fcn.00428ce3
mov ecx, dword [ebp - 0x3c8]
cmp dword [eax], ecx
jle 0x471aac
mov dword [ebp - 0x438], 1
jmp 0x471ab3
and dword [ebp - 0x438], 0
push 0
lea ecx, [ebp - 0x1cc]
call fcn.00428ce3
mov ecx, dword [ebp - 0x438]
sub ecx, dword [ebp - 0x1d4]
cmp dword [eax], ecx
jl 0x471adc
mov dword [ebp - 0x338], 1
jmp 0x471ae3
and dword [ebp - 0x338], 0
push 0
lea ecx, [ebp - 0x1cc]
call fcn.00428ce3
mov eax, dword [eax]
imul eax, dword [ebp - 0x338]
cmp eax, 1
je 0x471b0a
mov dword [ebp - 0x340], 1
jmp 0x471b11
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x3c8]
cmp dword [ebp - 0x340], eax
jne 0x471b56
mov dword [ebp - 0x580], 0x6fd8
mov dword [ebp - 0x58], 0
jmp 0x471b39
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jg 0x471b51
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x754]
mov dword [ebp - 0x580], eax
jmp 0x471b32
jmp 0x471c79
push 0x37fe
push 1
push 0x34aa
push 0x50aa
push 1
push 1
push 0x1840
push 0x2e99
push 0x3c2e
push 0x295e
push 0x5578
call fcn.0043651e
add esp, 0x2c
mov dword [ebp - 0x4a0], 0x16c0
cmp dword [ebp - 0x4a0], 0x66d
jge 0x471c5e
lea eax, [ebp - 0x6f8]
push eax
lea eax, [ebp - 0x6d0]
push eax
push 0xac248c
call fcn.004fad78
add esp, 0xc
movsd xmm0, qword [ebp - 0x6d0]
call fcn.00514bf0
mulsd xmm0, qword [ebp - 0x6f8]
movsd qword [ebp - 0x7e4], xmm0
movsd xmm0, qword [ebp - 0x6f8]
call fcn.00514bf0
mulsd xmm0, qword [ebp - 0x6d0]
movsd xmm1, qword [ebp - 0x7e4]
subsd xmm1, xmm0
movsd qword [ebp - 0x6d8], xmm1
movsd xmm0, qword [ebp - 0x6d8]
ucomisd xmm0, qword [0xac5378]
lahf
test ah, 0x44
jp 0x471c2a
push 0xac2a68
call fcn.004fb4f7
pop ecx
jmp 0x471c5e
movsd xmm0, qword [0xac5378]
comisd xmm0, xmmword [ebp - 0x6d8]
jbe 0x471c48
mov dword [ebp - 0x410], 0xac2c10
jmp 0x471c52
mov dword [ebp - 0x410], 0xac2c14
push dword [ebp - 0x410]
call fcn.004fb4f7
pop ecx
push 0
lea ecx, [ebp - 0x1cc]
call fcn.00428ce3
push 4
pop ecx
shl ecx, 1
mov eax, dword [eax]
mov dword [ebp + ecx - 0x758], eax
lea ecx, [ebp - 0x1cc]
call fcn.00428ae3
mov eax, dword [ebp - 0x10]
movzx eax, byte [ebp + eax - 0xcf]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0xac]
movzx ecx, byte [ebp + ecx - 0xd2]
movzx ecx, word [ebp + ecx*2 - 0x780]
add eax, ecx
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ebp + ecx - 0xcf]
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0xac]
movzx edx, byte [ebp + edx - 0xd2]
movzx edx, word [ebp + edx*2 - 0x780]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ebp + ecx - 0xcf]
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0xac]
movzx edx, byte [ebp + edx - 0xd2]
movzx edx, word [ebp + edx*2 - 0x780]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ebp + ecx - 0xd0]
mov word [ebp + ecx*2 - 0x780], ax
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x98], 1
mov dword [ebp - 0x100], 1
push 2
lea ecx, [ebp - 0x454]
call fcn.00428b0d
mov dword [ebp - 0x80c], 0xffffffff
mov dword [ebp - 0x588], 0x221f
cmp dword [ebp - 0x588], 0x12d5
jge 0x471dbd
and dword [ebp - 0x1d8], 0
lea eax, [ebp - 0x1d8]
push eax
push 0xac224c
call fcn.004fad78
pop ecx
pop ecx
cmp dword [ebp - 0x1d8], 0
jne 0x471d85
push 0xac22c4
call fcn.004fb4f7
pop ecx
jmp 0x471dbd
cvtsi2sd xmm0, dword [ebp - 0x1d8]
push 2
pop ecx
movsd qword [ebp - 0x890], xmm0
call fcn.0042f794
movsd xmm1, qword [ebp - 0x890]
mulsd xmm1, xmm0
cvttsd2si eax, xmm1
shl eax, 2
push eax
push 0xac2258
call fcn.004fb3a8
pop ecx
pop ecx
mov dword [ebp - 0x2ac], 0xfffffffc
push 0x6e7b
lea eax, [ebp - 0x454]
push eax
push 0x11b3
push 0
push 0x4760
push 0
lea eax, [ebp - 0x818]
push eax
call fcn.00448df4
add esp, 0x1c
push 1
push 0x8fd
push 0x5f68
push 1
call fcn.004420a5
add esp, 0x10
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x824], eax
cmp dword [ebp - 0x24], 0
jne 0x471e26
xor eax, eax
inc eax
je 0x471e26
mov dword [ebp - 0x348], 1
jmp 0x471e2d
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x348]
sub eax, dword [ebp - 0x24]
imul eax, eax, 0xfff9
cmp dword [ebp - 0x24], eax
jge 0x471e4d
mov dword [ebp - 0x3d0], 1
jmp 0x471e54
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jne 0x471e78
cmp dword [ebp - 0x24], 0
jne 0x471e78
and dword [ebp - 0x350], 0
jmp 0x471e82
mov dword [ebp - 0x350], 1
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x350], eax
jne 0x471e99
mov dword [ebp - 0x428], 1
jmp 0x471ea0
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x428], eax
jl 0x471eb7
mov dword [ebp - 0x558], 1
jmp 0x471ebe
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x83c], eax
push 0
lea ecx, [ebp - 0x454]
call fcn.00428ce3
cmp dword [eax], 0
jne 0x471eee
mov eax, 0xe5f58cdc
test eax, eax
jne 0x471eee
and dword [ebp - 0x358], 0
jmp 0x471ef8
mov dword [ebp - 0x358], 1
cmp dword [ebp - 0x358], 0xffff
jne 0x471f10
mov dword [ebp - 0x3d8], 1
jmp 0x471f17
and dword [ebp - 0x3d8], 0
push 1
lea ecx, [ebp - 0x454]
call fcn.00428ce3
mov ecx, dword [ebp - 0x3d8]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x24]
jne 0x471f3d
mov dword [ebp - 0x360], 1
jmp 0x471f44
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x360], eax
je 0x471f5e
mov dword [ebp - 0x590], 1
jmp 0x471f65
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x844], eax
push 7
pop eax
cmp eax, 0x23b1
jae 0x471f84
mov dword [ebp - 0x418], 1
jmp 0x471f8b
and dword [ebp - 0x418], 0
push 0
lea ecx, [ebp - 0x454]
call fcn.00428ce3
mov ecx, dword [ebp - 0x418]
cmp ecx, dword [eax]
je 0x471fae
mov dword [ebp - 0x274], 1
jmp 0x471fb5
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x274]
sub eax, dword [ebp - 0x100]
jne 0x471fd5
mov eax, 0x32f1efae
test eax, eax
jne 0x471fd5
and dword [ebp - 0x27c], 0
jmp 0x471fdf
mov dword [ebp - 0x27c], 1
push 1
lea ecx, [ebp - 0x454]
call fcn.00428ce3
mov ecx, dword [ebp - 0x27c]
cmp ecx, dword [eax]
jne 0x472002
mov dword [ebp - 0x1e0], 1
jmp 0x472009
and dword [ebp - 0x1e0], 0
push 0
lea ecx, [ebp - 0x454]
call fcn.00428ce3
mov ecx, dword [ebp - 0x1e0]
mov dword [eax], ecx
cmp dword [ebp - 0x1e0], 0
je 0x47203c
mov eax, 0x7665
test eax, eax
je 0x47203c
mov dword [ebp - 0x284], 1
jmp 0x472043
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x284], eax
jg 0x47205a
mov dword [ebp - 0x28c], 1
jmp 0x472061
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x28c]
jne 0x472078
mov dword [ebp - 0x564], 1
jmp 0x47207f
and dword [ebp - 0x564], 0
imul eax, dword [ebp - 0x98], 0x438e
test eax, eax
je 0x4720a2
cmp dword [ebp - 0x98], 0
je 0x4720a2
mov dword [ebp - 0x598], 1
jmp 0x4720a9
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x84c], eax
cmp dword [ebp - 0x100], 0
je 0x472100
push 1
push 1
lea eax, [ebp - 0x98]
push eax
push 0x5af4
push 0x3e91
call fcn.004470ad
add esp, 0x14
push 1
push 0x19e2
push 0x698d
push 1
push 0x26fb
push 0x4e4a
call fcn.004424a5
add esp, 0x18
jmp 0x47256c
mov dword [ebp - 0x5a0], 0x21de
cmp dword [ebp - 0x5a0], 0x135e
jge 0x472288
lea eax, [ebp - 0x1e8]
push eax
push 0xac224c
call fcn.004fad78
pop ecx
pop ecx
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x5e4], eax
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x5e4], 0
je 0x472288
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x574]
push eax
push 0xac230c
call fcn.004fad78
add esp, 0xc
lea ecx, [ebp - 0x45c]
call fcn.004294f3
and dword [ebp - 0x1f0], 0
jmp 0x47218f
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f0]
cmp eax, dword [ebp - 0x574]
jge 0x4721cb
lea eax, [ebp - 0x654]
push eax
push 0xac224c
call fcn.004fad78
pop ecx
pop ecx
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x964]
push eax
lea ecx, [ebp - 0x45c]
call fcn.00429508
jmp 0x472182
cmp dword [ebp - 0x1f8], 1
jne 0x472213
lea ecx, [ebp - 0x45c]
call fcn.004290e5
cmp eax, 1
jbe 0x4721f0
mov dword [ebp - 0x294], 1
jmp 0x4721f7
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x294]
shl eax, 1
xor ecx, ecx
inc ecx
sub ecx, eax
push ecx
push 0xac2258
call fcn.004fb3a8
pop ecx
pop ecx
jmp 0x472278
lea ecx, [ebp - 0x45c]
call fcn.004290e5
mov ecx, dword [ebp - 0x1f8]
lea eax, [eax + ecx - 3]
mov ecx, dword [ebp - 0x1f8]
dec ecx
xor edx, edx
div ecx
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
jle 0x472250
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x29c], eax
jmp 0x47225a
mov dword [ebp - 0x29c], 1
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x174], eax
push dword [ebp - 0x174]
push 0xac2258
call fcn.004fb3a8
pop ecx
pop ecx
lea ecx, [ebp - 0x45c]
call fcn.00429526
jmp 0x47212d
mov dword [ebp - 0x854], 0x312a7fad
mov dword [ebp - 0x85c], 0xff7828e9
mov dword [ebp - 0x57c], 0x225d
cmp dword [ebp - 0x57c], 0x86a
jge 0x47252a
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x200]
push eax
push 0xac230c
call fcn.004fad78
add esp, 0xc
push dword [ebp - 0x200]
lea ecx, [ebp - 0x69c]
call fcn.00428b0d
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x71c]
call fcn.00428b0d
xorpd xmm0, xmm0
movlpd qword [ebp - 0x1b4], xmm0
and dword [ebp - 0x9c], 0
jmp 0x472315
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x200]
jge 0x47236f
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x69c]
call fcn.00428ce3
push eax
push 0xac224c
call fcn.004fad78
pop ecx
pop ecx
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x69c]
call fcn.00428ce3
mov eax, dword [eax]
cdq
add eax, dword [ebp - 0x1b4]
adc edx, dword [ebp - 0x1b0]
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b0], edx
jmp 0x472308
mov eax, dword [ebp - 0xa4]
cdq
push edx
push eax
push dword [ebp - 0x1b0]
push dword [ebp - 0x1b4]
call fcn.00514360
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x550], edx
mov eax, dword [ebp - 0x554]
or eax, dword [ebp - 0x550]
je 0x4723ae
push 0xac24ac
call fcn.004fb4f7
pop ecx
mov eax, dword [ebp - 0xa4]
cdq
push edx
push eax
push dword [ebp - 0x1b0]
push dword [ebp - 0x1b4]
call fcn.005142b0
mov dword [ebp - 0x2a4], eax
and dword [ebp - 0x1ac], 0
mov byte [ebp - 0x25], 1
and dword [ebp - 0x140], 0
jmp 0x4723ef
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
cmp eax, dword [ebp - 0xa4]
jge 0x4724a4
and dword [ebp - 0x208], 0
and dword [ebp - 0x17c], 0
mov eax, dword [ebp - 0x1ac]
cmp eax, dword [ebp - 0x200]
jge 0x472472
mov eax, dword [ebp - 0x17c]
cmp eax, dword [ebp - 0x2a4]
jge 0x472472
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x5ec], eax
push dword [ebp - 0x5ec]
lea ecx, [ebp - 0x69c]
call fcn.00428ce3
mov ecx, dword [ebp - 0x17c]
add ecx, dword [eax]
mov dword [ebp - 0x17c], ecx
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
jmp 0x47240f
mov eax, dword [ebp - 0x17c]
cmp eax, dword [ebp - 0x2a4]
je 0x472486
mov byte [ebp - 0x25], 0
jmp 0x4724a4
push dword [ebp - 0x140]
lea ecx, [ebp - 0x71c]
call fcn.00428ce3
mov ecx, dword [ebp - 0x208]
mov dword [eax], ecx
jmp 0x4723e2
movzx eax, byte [ebp - 0x25]
test eax, eax
je 0x472509
push 0xac24a8
call fcn.004fb4f7
pop ecx
and dword [ebp - 0x148], 0
jmp 0x4724cd
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
cmp eax, dword [ebp - 0xa4]
jge 0x4724fc
push dword [ebp - 0x148]
lea ecx, [ebp - 0x71c]
call fcn.00428ce3
push dword [eax]
push 0xac2284
call fcn.004fb3a8
pop ecx
pop ecx
jmp 0x4724c0
push 0xac21b5
call fcn.004fb4f7
pop ecx
jmp 0x472514
push 0xac24ac
call fcn.004fb4f7
pop ecx
lea ecx, [ebp - 0x71c]
call fcn.00428ae3
lea ecx, [ebp - 0x69c]
call fcn.00428ae3
mov dword [ebp - 0x150], 0
jmp 0x472543
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 4
jge 0x47255f
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x9ac], 0x9718b2f1
jmp 0x472536
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
lea ecx, [ebp - 0x454]
call fcn.00428ae3
push 0
push 1
push 0x4ec
lea eax, [ebp - 0xac]
push eax
push 0x396a
push 0x7359
push 1
call fcn.00440ebe
add esp, 0x1c
jmp 0x471849
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0x780], cx
mov dword [ebp - 0x18], 1
mov dword [ebp - 4], 0
mov dword [ebp - 0xd4], 0x6fde
mov dword [ebp - 0x158], 0
jmp 0x4725e1
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 3
jge 0x4725fd
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x468], 0xf81320f2
jmp 0x4725d4
mov dword [ebp - 0x18], 0
jmp 0x47260d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 6
jne 0x47282d
mov dword [ebp - 0x80], 3
push 0x77c1
push 1
push 0x45d6
push 0x221d
push 0x881
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 4]
push eax
push 0xa57
lea eax, [ebp - 0x18]
push eax
push 1
push 0x5537
push 0
call fcn.00449322
add esp, 0x30
mov dword [ebp - 0x80], 0
jmp 0x472666
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x29
jle 0x472828
mov dword [ebp - 0xb4], 1
mov dword [ebp - 4], 0
jmp 0x47268a
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jg 0x4727e3
mov dword [ebp - 0x2c4], 0xffffffff
mov eax, dword [ebp - 0x2c4]
cmp dword [ebp - 0xb4], eax
jne 0x472769
cmp dword [ebp - 0x18], 0
jne 0x4726c5
cmp dword [ebp - 0x18], 0
jne 0x4726c5
and dword [ebp - 0x2b4], 0
jmp 0x4726cf
mov dword [ebp - 0x2b4], 1
cmp dword [ebp - 0x2b4], 0xffff
jbe 0x4726e7
mov dword [ebp - 0x2bc], 1
jmp 0x4726ee
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0xb4]
add eax, dword [ebp - 0x2bc]
je 0x472708
mov dword [ebp - 0x2cc], 1
jmp 0x47270f
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x2c4]
cmp dword [ebp - 0x2cc], eax
jne 0x472729
mov dword [ebp - 0x2d4], 1
jmp 0x472730
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0x2d4]
jg 0x47274a
mov dword [ebp - 0x2dc], 1
jmp 0x472751
and dword [ebp - 0x2dc], 0
cmp dword [ebp - 0x2dc], 0x8ff7
jl 0x472769
mov dword [ebp - 0x2e4], 1
jmp 0x472770
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x2e4], eax
jg 0x47278a
mov dword [ebp - 0x2ec], 1
jmp 0x472791
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x2ec]
sub eax, 0xe12f
je 0x4727a2
cmp dword [ebp - 0x80], 0
cmp dword [ebp - 0xb4], 0
jne 0x4727c4
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x468], 0
jne 0x4727c4
and dword [ebp - 0x2f4], 0
jmp 0x4727ce
mov dword [ebp - 0x2f4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x2f4]
mov dword [ebp + eax*4 - 0x468], ecx
jmp 0x472683
push 1
push 0x7f20
push 0x6f4b
push 0x2b31
push 0x9a
push 0x293e
push 0x48cf
push 0x660d
push 1
push 0x733c
push 1
push 0x3f94
push 0x747
call fcn.004472b4
add esp, 0x34
jmp 0x47265f
jmp 0x472606
mov dword [ebp - 4], 0
jmp 0x47283d
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jg 0x472bb1
mov dword [ebp - 0x60], 1
push 1
lea ecx, [ebp - 0x678]
call fcn.00428b0d
mov dword [ebp - 0x36c], 0xa74ab722
mov dword [ebp - 0x270], 0x71ce904
push 0x1f70
push 0x7f00
push 0x3cb5
lea eax, [ebp - 0x864]
push eax
push 1
push 1
lea eax, [ebp - 0x678]
push eax
call fcn.00443309
add esp, 0x1c
mov eax, dword [ebp - 4]
mov dword [ebp - 0x8c8], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x900], eax
imul eax, dword [ebp - 4], 0x98c5
cmp eax, dword [ebp - 0x60]
jge 0x4728c2
mov dword [ebp - 0x2fc], 1
jmp 0x4728c9
and dword [ebp - 0x2fc], 0
cmp dword [ebp - 0x2fc], 0xfbae54fd
jae 0x4728e1
mov dword [ebp - 0x584], 1
jmp 0x4728e8
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x908], eax
push 0
lea ecx, [ebp - 0x678]
call fcn.00428ce3
xor eax, eax
cmp eax, 0xfffffff7
jae 0x472911
mov dword [ebp - 0x304], 1
jmp 0x472918
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x304]
sub eax, 0x40931bc1
cmp eax, dword [ebp - 0x18]
jl 0x472934
mov dword [ebp - 0x30c], 1
jmp 0x47293b
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x30c], eax
je 0x472952
mov dword [ebp - 0x314], 1
jmp 0x472959
and dword [ebp - 0x314], 0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x468], 0x2c0e
cmp dword [ebp - 0x314], 0x2c0e
jl 0x472981
mov dword [ebp - 0x31c], 1
jmp 0x472988
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x31c], eax
jl 0x47299f
mov dword [ebp - 0x324], 1
jmp 0x4729a6
and dword [ebp - 0x324], 0
cmp dword [ebp - 0x324], 5
je 0x4729bb
mov dword [ebp - 0x32c], 1
jmp 0x4729c2
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x32c], eax
jne 0x4729d9
mov dword [ebp - 0x334], 1
jmp 0x4729e0
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xb150
jge 0x472a16
cmp dword [ebp - 0xd4], 0
jne 0x472a16
and dword [ebp - 0x33c], 0
jmp 0x472a20
mov dword [ebp - 0x33c], 1
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x33c], eax
jl 0x472a37
mov dword [ebp - 0x344], 1
jmp 0x472a3e
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 4], 0x4e46
jge 0x472a5f
mov dword [ebp - 0x34c], 1
jmp 0x472a66
and dword [ebp - 0x34c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x34c]
mov dword [ebp + eax - 0x468], ecx
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x60], eax
imul eax, dword [ebp - 0x60], 0xc301
inc eax
cmp eax, dword [ebp - 0xd4]
jne 0x472a9e
mov dword [ebp - 0x354], 1
jmp 0x472aa5
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x354]
add eax, 0xb85a
cmp eax, 1
je 0x472ac1
mov dword [ebp - 0x35c], 1
jmp 0x472ac8
and dword [ebp - 0x35c], 0
cmp dword [ebp - 0x35c], 0xfffffffe
jl 0x472add
mov dword [ebp - 0x64c], 1
jmp 0x472ae4
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x910], eax
push 0
lea ecx, [ebp - 0x678]
call fcn.00428ce3
cmp dword [eax], 0
jne 0x472b18
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x468], 0
jne 0x472b18
and dword [ebp - 0x58c], 0
jmp 0x472b22
mov dword [ebp - 0x58c], 1
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x8f0], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 4], eax
jle 0x472b42
mov dword [ebp - 0x374], 1
jmp 0x472b49
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x374], eax
je 0x472b60
mov dword [ebp - 0x37c], 1
jmp 0x472b67
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x37c]
jg 0x472b8b
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x468], 0
je 0x472b8b
mov dword [ebp - 0x384], 1
jmp 0x472b92
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0xd4]
add eax, dword [ebp - 0x384]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x678]
call fcn.00428ae3
jmp 0x472836
mov dword [ebp - 0x5fc], 0x19fe
cmp dword [ebp - 0x5fc], 0x441
jge 0x472c52
lea eax, [ebp - 0x210]
push eax
push 0xac224c
call fcn.004fad78
pop ecx
pop ecx
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x594], eax
mov eax, dword [ebp - 0x210]
dec eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x594], 0
je 0x472c52
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x59c]
push eax
push 0xac230c
call fcn.004fad78
add esp, 0xc
mov eax, dword [ebp - 0x65c]
inc eax
mov ecx, dword [ebp - 0x59c]
shl ecx, 1
cmp eax, ecx
jg 0x472c3a
mov dword [ebp - 0x38c], 0xac22b8
jmp 0x472c44
mov dword [ebp - 0x38c], 0xac22bc
push dword [ebp - 0x38c]
call fcn.004fb4f7
pop ecx
jmp 0x472bde
lea eax, [ebp - 0x780]
push eax
lea ecx, [ebp - 0x99c]
call fcn.00475d99
push eax
call fcn.004356ab
pop ecx
mov dword [ebp - 0x3bc], eax
lea ecx, [ebp - 0x99c]
call fcn.00428903
push 3
lea ecx, [ebp - 0x764]
call fcn.00428b0d
mov dword [ebp - 0x60c], 0x1ccf
cmp dword [ebp - 0x60c], 0x49a
jge 0x472fd1
mov dword [ebp - 0x914], 0xa9
xor cl, cl
call fcn.00403fb2
lea eax, [ebp - 0x394]
push eax
lea eax, [ebp - 0x4a4]
push eax
push 0x4333a9
mov ecx, 0xad3d60
call fcn.00428429
mov ecx, eax
call fcn.00428160
mov ecx, eax
call fcn.00428160
lea ecx, [ebp - 0x954]
call fcn.00476212
lea ecx, [ebp - 0x954]
call fcn.00476212
and dword [ebp - 0x220], 0
and dword [ebp - 0x218], 0
jmp 0x472d12
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
cmp eax, dword [ebp - 0x4a4]
jge 0x472fa9
lea ecx, [ebp - 0x92c]
call fcn.00427e81
lea edx, [ebp - 0x92c]
mov ecx, 0xad3d60
call fcn.00476825
lea ecx, [ebp - 0x6f0]
call fcn.00476212
lea ecx, [ebp - 0x6f0]
call fcn.00476212
and dword [ebp - 0x3c], 0
jmp 0x472d62
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x92c]
call fcn.00427fb4
cmp dword [ebp - 0x3c], eax
jae 0x472e4b
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x92c]
call fcn.00427f95
mov al, byte [eax]
mov byte [ebp - 6], al
and dword [ebp - 0x88], 0
movsx eax, byte [ebp - 6]
cmp eax, 0x30
jl 0x472db1
movsx eax, byte [ebp - 6]
cmp eax, 0x39
jg 0x472db1
movsx eax, byte [ebp - 6]
sub eax, 0x30
mov dword [ebp - 0x88], eax
jmp 0x472dbe
movsx eax, byte [ebp - 6]
sub eax, 0x37
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
and eax, 8
je 0x472ddd
push 1
mov eax, dword [ebp - 0x3c]
shl eax, 2
push eax
lea ecx, [ebp - 0x6f0]
call fcn.00476224
mov eax, dword [ebp - 0x88]
and eax, 4
je 0x472e00
push 1
mov eax, dword [ebp - 0x3c]
lea eax, [eax*4 + 1]
push eax
lea ecx, [ebp - 0x6f0]
call fcn.00476224
mov eax, dword [ebp - 0x88]
and eax, 2
je 0x472e23
push 1
mov eax, dword [ebp - 0x3c]
lea eax, [eax*4 + 2]
push eax
lea ecx, [ebp - 0x6f0]
call fcn.00476224
mov eax, dword [ebp - 0x88]
and eax, 1
je 0x472e46
push 1
mov eax, dword [ebp - 0x3c]
lea eax, [eax*4 + 3]
push eax
lea ecx, [ebp - 0x6f0]
call fcn.00476224
jmp 0x472d5b
and dword [ebp - 0x160], 0
jmp 0x472e61
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x394]
jg 0x472ea9
push dword [ebp - 0x160]
lea eax, [ebp - 0x7f0]
push eax
lea ecx, [ebp - 0x6f0]
call fcn.00476200
mov ecx, eax
call fcn.0047628e
movzx eax, al
push eax
mov ecx, 0xad3cb8
call fcn.00475b72
lea ecx, [ebp - 0x7f0]
call fcn.0047628d
jmp 0x472e54
push fcn.0042f9e1
mov ecx, 0xad3cb8
call fcn.0042841d
mov byte [ebp - 0x11], 0
mov byte [ebp - 5], 0
and dword [ebp - 0xdc], 0
jmp 0x472ed6
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0x394]
jg 0x472f88
push dword [ebp - 0xdc]
lea eax, [ebp - 0x8f8]
push eax
lea ecx, [ebp - 0x6f0]
call fcn.00476200
mov ecx, eax
call fcn.0047628e
mov byte [ebp - 0x51], al
lea ecx, [ebp - 0x8f8]
call fcn.0047628d
movzx eax, byte [ebp - 0x51]
test eax, eax
je 0x472f5c
mov byte [ebp - 0x11], 1
push dword [ebp - 0xdc]
lea eax, [ebp - 0x7fc]
push eax
lea ecx, [ebp - 0x954]
call fcn.00476200
mov ecx, eax
call fcn.0047628e
mov byte [ebp - 0x43], al
lea ecx, [ebp - 0x7fc]
call fcn.0047628d
movzx eax, byte [ebp - 0x43]
test eax, eax
je 0x472f5a
mov byte [ebp - 5], 1
jmp 0x472f83
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x472f79
movzx eax, byte [ebp - 5]
test eax, eax
jne 0x472f79
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
mov byte [ebp - 5], 0
mov al, byte [ebp - 5]
mov byte [ebp - 0x11], al
jmp 0x472ec9
push 6
pop ecx
lea esi, [ebp - 0x6f0]
lea edi, [ebp - 0x954]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x92c]
call fcn.00427f0a
jmp 0x472d05
push fcn.0042f9e1
push dword [ebp - 0x220]
push 0x4333a9
mov ecx, 0xad3cb8
call fcn.00428429
mov ecx, eax
call fcn.0042844a
mov ecx, eax
call fcn.0042841d
mov dword [ebp - 0x4a8], 0xfffffffb
push 1
lea eax, [ebp - 0x764]
push eax
lea eax, [ebp - 0x850]
push eax
push 0x589d
push 1
push 0x4910
call fcn.0043b9e9
add esp, 0x18
push 1
push 1
lea eax, [ebp - 0x4a8]
push eax
push 0x35b4
push 0x3819
push 0x6cff
lea eax, [ebp - 0x764]
push eax
call fcn.0044811b
add esp, 0x1c
lea ecx, [ebp - 0x764]
call fcn.00428ae3
mov dword [ebp - 0x4b0], 0x20c7
cmp dword [ebp - 0x4b0], 0xc9f
jge 0x473160
lea eax, [ebp - 0x230]
push eax
push 0xac224c
call fcn.004fad78
pop ecx
pop ecx
mov eax, dword [ebp - 0x230]
inc eax
push eax
lea ecx, [ebp - 0x690]
call fcn.00428e00
mov dword [ebp - 0x228], 1
jmp 0x47308c
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp - 0x230]
jge 0x4730f5
lea eax, [ebp - 0x3a4]
push eax
lea eax, [ebp - 0x39c]
push eax
push 0xac230c
call fcn.004fad78
add esp, 0xc
lea eax, [ebp - 0x3a4]
push eax
push dword [ebp - 0x39c]
lea ecx, [ebp - 0x690]
call fcn.00428e9a
mov ecx, eax
call fcn.00428c5d
lea eax, [ebp - 0x39c]
push eax
push dword [ebp - 0x3a4]
lea ecx, [ebp - 0x690]
call fcn.00428e9a
mov ecx, eax
call fcn.00428c5d
jmp 0x47307f
mov byte [ebp - 0x49], 0
lea eax, [ebp - 0x49]
push eax
mov eax, dword [ebp - 0x230]
inc eax
push eax
lea ecx, [ebp - 0x93c]
call fcn.00429225
lea eax, [ebp - 0x93c]
push eax
lea eax, [ebp - 0x690]
push eax
push 1
call fcn.00420d2c
add esp, 0xc
fstp qword [ebp - 0x8a4]
push ecx
push ecx
movsd xmm0, qword [ebp - 0x8a4]
movsd qword [esp], xmm0
push 0xac24a0
call fcn.004fb3a8
add esp, 0xc
lea ecx, [ebp - 0x93c]
call fcn.00429281
lea ecx, [ebp - 0x690]
call fcn.00428e95
and dword [ebp - 0x168], 0
jmp 0x473176
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xd
jae 0x473191
xor eax, eax
mov ecx, dword [ebp - 0x168]
mov word [ebp + ecx*2 - 0x780], ax
jmp 0x473169
mov dword [ebp - 0xe4], 4
mov dword [ebp - 0x4b8], 0x9ea9831
mov dword [ebp - 0xe4], 0
jmp 0x4731be
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0xffffffe5
je 0x473228
push 0x6978
push 0x5aab
lea eax, [ebp - 0x4b8]
push eax
push 0
push 0x75a
push 1
lea eax, [ebp - 0xe4]
push eax
call fcn.00439083
add esp, 0x1c
push 0x2056
push 0x7b3a
push 0x317d
push 0x13e3
push 0x2686
push 0x5450
push 1
push 0x61e3
push 0x7b76
push 1
push 1
call fcn.00443a2e
add esp, 0x2c
jmp 0x4731b1
cmp dword [ebp - 0x3bc], 0
je 0x47370b
mov byte [ebp - 0x130], 0
mov byte [ebp - 0x12f], 0xe5
mov byte [ebp - 0x12e], 3
mov byte [ebp - 0x12d], 0x70
mov byte [ebp - 0x12c], 0xb
mov byte [ebp - 0x12b], 0x8a
mov byte [ebp - 0x12a], 1
mov byte [ebp - 0x129], 0x23
mov byte [ebp - 0x128], 5
mov byte [ebp - 0x127], 6
mov byte [ebp - 0x126], 2
mov byte [ebp - 0x125], 8
mov byte [ebp - 0x124], 4
mov byte [ebp - 0x123], 0x2d
mov byte [ebp - 0x122], 8
mov byte [ebp - 0x121], 0x2d
mov byte [ebp - 0x120], 0xa
mov byte [ebp - 0x11f], 0x18
mov byte [ebp - 0x11e], 0xb
mov byte [ebp - 0x11d], 0x2e
mov byte [ebp - 0x11c], 9
mov byte [ebp - 0x11b], 0x25
mov byte [ebp - 0x11a], 3
mov byte [ebp - 0x119], 0x16
mov byte [ebp - 0x118], 6
mov byte [ebp - 0x117], 6
mov byte [ebp - 0x116], 7
mov byte [ebp - 0x115], 0x10
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x130]
or eax, 0xa9
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x130]
and ecx, 0xa9
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x130]
mov byte [ebp + ecx - 0x49c], al
mov dword [ebp - 0x1c], 2
and dword [ebp - 0x170], 0
jmp 0x47334f
mov eax, dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1c
jae 0x47343e
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x130]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x1c], eax
jne 0x473399
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x130]
inc eax
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x130]
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x1c], eax
jmp 0x473347
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x12f]
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x170]
movzx ecx, byte [ebp + ecx - 0x132]
movsx ecx, byte [ebp + ecx - 0x49c]
or eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x12f]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x170]
movzx edx, byte [ebp + edx - 0x132]
movsx edx, byte [ebp + edx - 0x49c]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x130]
mov byte [ebp + ecx - 0x49c], al
push 0x2b76
push 0x72a8
lea eax, [ebp - 0x170]
push eax
push 0x76e6
push 0x605b
push 0x1219
push 0x23ec
push 0x5ece
push 1
push 0x4447
push 1
push 0xdcf
call fcn.004446ea
add esp, 0x30
jmp 0x473347
mov dword [ebp - 0x4c0], 0x1d15
cmp dword [ebp - 0x4c0], 0x7bf
jge 0x473693
movsd xmm0, qword [0xac5438]
movsd qword [ebp - 0x814], xmm0
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0x180]
push eax
push 0xac230c
call fcn.004fad78
add esp, 0xc
movsd xmm0, qword [0xac5378]
movsd qword [ebp - 0x808], xmm0
lea eax, [ebp - 0x808]
push eax
push dword [ebp - 0x180]
lea ecx, [ebp - 0x6a8]
call fcn.00429953
and dword [ebp - 0x178], 0
jmp 0x4734c1
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
cmp eax, dword [ebp - 0x180]
jge 0x47358d
lea eax, [ebp - 0x3ac]
push eax
lea eax, [ebp - 0x3b4]
push eax
push 0xac230c
call fcn.004fad78
add esp, 0xc
mov eax, dword [ebp - 0x3b4]
dec eax
cdq
idiv dword [ebp - 0xec]
inc eax
imul eax, dword [ebp - 0xec]
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x3ac]
cdq
idiv dword [ebp - 0xec]
imul eax, dword [ebp - 0xec]
mov dword [ebp - 0x4c8], eax
mov eax, dword [ebp - 0x4c8]
sub eax, dword [ebp - 0x4d0]
cdq
idiv dword [ebp - 0xec]
inc eax
mov dword [ebp - 0x4d8], eax
cvtsi2sd xmm0, dword [ebp - 0x4d8]
mulsd xmm0, qword [0xac53d0]
mov eax, dword [ebp - 0x3ac]
sub eax, dword [ebp - 0x3b4]
inc eax
cvtsi2sd xmm1, eax
divsd xmm0, xmm1
push dword [ebp - 0x178]
lea ecx, [ebp - 0x6a8]
movsd qword [ebp - 0x82c], xmm0
call fcn.00428af1
movsd xmm0, qword [ebp - 0x82c]
movsd qword [eax], xmm0
jmp 0x4734b4
movsd xmm0, qword [0xac5378]
movsd qword [ebp - 0x560], xmm0
and dword [ebp - 0xf4], 0
jmp 0x4735b3
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0x180]
jge 0x47366c
mov eax, dword [ebp - 0xf4]
inc eax
cdq
idiv dword [ebp - 0x180]
mov dword [ebp - 0x4e0], edx
movsd xmm0, qword [0xac53e0]
mulsd xmm0, qword [ebp - 0x814]
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x6a8]
movsd qword [ebp - 0x820], xmm0
call fcn.00428af1
movsd xmm0, qword [0xac53d0]
subsd xmm0, qword [eax]
push dword [ebp - 0x4e0]
lea ecx, [ebp - 0x6a8]
movsd qword [ebp - 0x834], xmm0
call fcn.00428af1
movsd xmm0, qword [0xac53d0]
subsd xmm0, qword [eax]
movsd xmm1, qword [ebp - 0x834]
mulsd xmm1, xmm0
movsd xmm0, qword [0xac53d0]
subsd xmm0, xmm1
movsd xmm1, qword [ebp - 0x820]
mulsd xmm1, xmm0
addsd xmm1, qword [ebp - 0x560]
movsd qword [ebp - 0x560], xmm1
jmp 0x4735a6
push ecx
push ecx
movsd xmm0, qword [ebp - 0x560]
movsd qword [esp], xmm0
push 0xac2494
call fcn.004fb3a8
add esp, 0xc
lea ecx, [ebp - 0x6a8]
call fcn.00428ae3
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x49c], 0
lea eax, [ebp - 0x49c]
push eax
lea ecx, [ebp - 0x97c]
call fcn.00475dbe
and dword [ebp - 0x188], 0
jmp 0x4736c9
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xd
jae 0x4736e2
mov eax, dword [ebp - 0x188]
mov byte [ebp + eax - 0x49c], 0
jmp 0x4736bc
push 0
push 0
lea eax, [ebp - 0x97c]
push eax
push dword [ebp - 0x3bc]
call fcn.00455cb9
add esp, 0x10
mov dword [0xcfec00], eax
lea ecx, [ebp - 0x97c]
call fcn.004289cc
cmp dword [0xcfec00], 0
je 0x47372c
mov ecx, dword [ebp - 0x3c4]
call fcn.00428962
push eax
call dword [0xcfec00]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x790], 0
push 0x593c
push 1
push 1
push 1
push 0x4b0c
push 0x4576
call fcn.00445096
add esp, 0x18
mov byte [ebp - 0x59], 0
push 0x1bfe
push 1
push 1
push 0x4a30
lea eax, [ebp - 0x59]
push eax
call fcn.00448cf1
add esp, 0x14
push 0x7f70
lea eax, [ebp - 0xfc]
push eax
push 1
push 1
push 0x7167
push 1
push 0xcfecb4
push 0xcfebfa
push 0x6d99
lea eax, [ebp - 0x3cc]
push eax
call fcn.00445c86
add esp, 0x28
mov eax, dword [ebp - 0x3d4]
mov ecx, dword [ebp - 0xfc]
mov dword [eax], ecx
lea ecx, [ebp - 0x710]
call fcn.00428903
jmp 0x473840
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x4f8], eax
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x500], eax
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0x104]
mov dword [eax], 0
jmp 0x47381d
mov eax, dword [ebp - 0x104]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x104]
mov dword [ecx], eax
mov eax, dword [ebp - 0x104]
cmp dword [eax], 2
jge 0x473840
mov eax, dword [ebp - 0x104]
push dword [eax]
mov ecx, dword [ebp - 0x508]
call fcn.00428ce3
and dword [eax], 0
jmp 0x47380c
pop edi
pop esi
mov esp, ebp
pop ebp
ret