Function at 0x1003cea9
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a960
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x658
push ebx
push esi
push edi
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x1003d018
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2f8], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x398], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x390], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x408], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0x398]
movzx eax, byte [eax]
test eax, eax
je 0x1003cfd3
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x3d0], eax
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x3d8], eax
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x424]
push dword [eax]
push dword [ebp - 0x388]
push 1
push 0x4a65
push dword [ebp - 0x304]
mov eax, dword [ebp - 0x3ac]
push dword [eax]
push 1
push dword [ebp - 0x30c]
call fcn.1003a078
add esp, 0x20
jmp 0x1003d013
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x3b4], eax
mov eax, dword [ebp - 0x3b4]
movzx eax, byte [eax]
test eax, eax
je 0x1003d013
push 0
push 0x20bd
push 0xd68
push 0x48a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
jmp 0x1003fbf6
mov eax, dword [ebp + 8]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3e0], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x31c]
movzx eax, byte [eax]
test eax, eax
je 0x1003d07b
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp - 0x3bc]
mov dword [eax], 0
jmp 0x1003fbf6
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x3c4], 0xb0f7
mov dword [ebp - 0xdc], 0
jmp 0x1003d0c2
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 3
jge 0x1003d0de
mov eax, dword [ebp - 0xdc]
mov dword [ebp + eax*4 - 0x610], 0xfffffffa
jmp 0x1003d0b5
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3c4]
mov dword [ebp + eax - 0x610], ecx
mov byte [ebp - 0x5c], 0
movzx eax, byte [ebp - 0x5c]
test eax, eax
je 0x1003d105
push 0
call fcn.1003bbf8
pop ecx
mov dword [ebp - 0x10], 0xfff8
mov dword [ebp - 0xfc], 0x17571177
mov dword [ebp - 0xfc], 0xffffffe6
jmp 0x1003d12f
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0xfffffff0
jg 0x1003d181
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xec], 0
jmp 0x1003d15b
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x13
je 0x1003d17f
mov byte [ebp - 0x65], 0
push 1
push 0x47e6
lea eax, [ebp - 0x65]
push eax
push 0
call fcn.1003a387
add esp, 0x10
jmp 0x1003d14e
jmp 0x1003d122
mov dword [ebp - 0x74], 7
push 3
lea ecx, [ebp - 0x2e4]
call fcn.1000bb6e
and dword [ebp - 4], 0
mov dword [ebp - 0x560], 9
push 2
lea ecx, [ebp - 0x4a8]
call fcn.1000bb6e
mov byte [ebp - 4], 1
mov dword [ebp - 0x33c], 0x5c8094a
push 0xedd
push 0x4e91
push 1
push 0x2f8
lea eax, [ebp - 0x4dc]
push eax
push 0x324f
push 0x3314
push 0x137a
push 0x5a2a
push 0x7a8
lea eax, [ebp - 0x4a8]
push eax
push 1
call fcn.100258bd
add esp, 0x30
push 0
push 0x3042
push 0
push 0x2d03
push 0x7700
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x4a8]
push eax
call fcn.1002825f
add esp, 0x1c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x4a8]
call fcn.1000bbf0
push 0
push 0x6637
push 0x1b02
lea eax, [ebp - 0x4e0]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 0x67ce
push 1
call fcn.1002934c
add esp, 0x1c
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x344], 0x6f393842
mov dword [ebp - 0xf4], 0
jmp 0x1003d28b
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jge 0x1003d2a7
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x2c8], 3
jmp 0x1003d27e
mov byte [ebp - 0x80], 0
push 1
lea eax, [ebp - 0x80]
push eax
push 0x3f58
push 0
push 0x606
call fcn.100373f6
add esp, 0x14
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4e8], eax
xor eax, eax
inc eax
je 0x1003d2e5
cmp dword [ebp - 0x4c], 0
je 0x1003d2e5
mov dword [ebp - 0x294], 1
jmp 0x1003d2ec
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x4c]
add eax, 3
cmp dword [ebp - 0x4c], eax
jle 0x1003d303
mov dword [ebp - 0x29c], 1
jmp 0x1003d30a
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x29c]
test eax, eax
je 0x1003d32a
cmp dword [ebp - 0x4c], 0
je 0x1003d32a
mov dword [ebp - 0x2a4], 1
jmp 0x1003d331
and dword [ebp - 0x2a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c8]
cmp dword [ebp - 0x2a4], eax
jle 0x1003d352
mov dword [ebp - 0x3fc], 1
jmp 0x1003d359
and dword [ebp - 0x3fc], 0
cmp dword [ebp - 0x4c], 1
jae 0x1003d36b
mov dword [ebp - 0x2ac], 1
jmp 0x1003d372
and dword [ebp - 0x2ac], 0
cmp dword [ebp - 0x2ac], 0xfffffffe
jne 0x1003d387
mov dword [ebp - 0x2c0], 1
jmp 0x1003d38e
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x2c0], eax
jge 0x1003d3a5
mov dword [ebp - 0x2d0], 1
jmp 0x1003d3ac
and dword [ebp - 0x2d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c8]
cmp dword [ebp - 0x2d0], eax
je 0x1003d3cd
mov dword [ebp - 0x2d8], 1
jmp 0x1003d3d4
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x10], 0
jne 0x1003d4a5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x4f0], eax
cmp dword [ebp - 0x10], 0
jne 0x1003d408
cmp dword [ebp - 0x10], 0
jne 0x1003d408
and dword [ebp - 0x220], 0
jmp 0x1003d412
mov dword [ebp - 0x220], 1
cmp dword [ebp - 0x220], 0
je 0x1003d42d
cmp dword [ebp - 0x10], 0
je 0x1003d42d
mov dword [ebp - 0x3cc], 1
jmp 0x1003d434
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
je 0x1003d448
mov dword [ebp - 0x170], 1
jmp 0x1003d44f
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x170], eax
jg 0x1003d466
mov dword [ebp - 0x2c4], 1
jmp 0x1003d46d
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x2c4]
jne 0x1003d487
cmp dword [ebp - 0x10], 0
jne 0x1003d487
and dword [ebp - 0x178], 0
jmp 0x1003d491
mov dword [ebp - 0x178], 1
mov eax, dword [ebp - 0x178]
sub eax, dword [ebp - 0x10]
jne 0x1003d4a5
and dword [ebp - 0x164], 0
jmp 0x1003d4af
mov dword [ebp - 0x164], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x164], eax
jge 0x1003db9b
cmp dword [ebp - 0x10], 0
je 0x1003db9b
push 2
lea ecx, [ebp - 0x154]
call fcn.1000bb6e
mov byte [ebp - 4], 2
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x354], 1
mov dword [ebp - 0x2b0], 0xfffffffa
mov dword [ebp - 0x3d4], 0xd2ca8e1f
mov dword [ebp - 0x35c], 0xd81c9193
mov dword [ebp - 0x100], 0
jmp 0x1003d521
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 2
jge 0x1003d543
push dword [ebp - 0x100]
lea ecx, [ebp - 0x154]
call fcn.1000bc0c
mov dword [eax], 0x90ac204e
jmp 0x1003d514
push 0
lea ecx, [ebp - 0x154]
call fcn.1000bc0c
and dword [eax], 0
jmp 0x1003d579
push 0
lea ecx, [ebp - 0x154]
call fcn.1000bc0c
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x180]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x154]
call fcn.1000bc0c
cmp dword [eax], 0xffffffee
jle 0x1003d7e4
mov dword [ebp - 0x84], 0xb143e95a
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x4d4], 0x70d97802
mov dword [ebp - 0x4d0], 0x70d97802
mov dword [ebp - 0x4cc], 0x70d97802
mov dword [ebp - 0x4c8], 0x70d97802
push 1
lea ecx, [ebp - 0x154]
call fcn.1000bc0c
cmp dword [eax], 0x220985a9
jle 0x1003d5f3
mov dword [ebp - 0x228], 1
jmp 0x1003d5fa
and dword [ebp - 0x228], 0
cmp dword [ebp - 0x228], 0xb8ee
jge 0x1003d612
mov dword [ebp - 0x188], 1
jmp 0x1003d619
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x188], eax
jl 0x1003d639
mov dword [ebp - 0x22c], 1
jmp 0x1003d640
and dword [ebp - 0x22c], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x84]
dec eax
cmp dword [ebp - 0x22c], eax
jge 0x1003d65b
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
jmp 0x1003d6ae
mov byte [ebp - 0x6d], 0
lea eax, [ebp - 0x6d]
push eax
push 1
push 0x2b7e
push 0x5afe
push 0
call fcn.100276cb
add esp, 0x14
mov dword [ebp - 0x2c], 0xb
jmp 0x1003d689
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x11
jl 0x1003d6ae
lea eax, [ebp - 0x84]
push eax
push 0
push 0x6c3
push 0
push 0x8e5
call fcn.1003711d
add esp, 0x14
jmp 0x1003d682
mov eax, 0x8886
test eax, eax
je 0x1003d762
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
je 0x1003d6d6
mov dword [ebp - 0x190], 1
jmp 0x1003d6dd
and dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x84], eax
mov esi, dword [ebp - 0x84]
push 0
lea ecx, [ebp - 0x154]
call fcn.1000bc0c
cmp esi, dword [eax]
jle 0x1003d70c
mov dword [ebp - 0x34c], 1
jmp 0x1003d713
and dword [ebp - 0x34c], 0
cmp dword [ebp - 0x50], 0xdb5a
jge 0x1003d728
mov dword [ebp - 0x288], 1
jmp 0x1003d72f
and dword [ebp - 0x288], 0
cmp dword [ebp - 0x288], 1
je 0x1003d744
mov dword [ebp - 0x198], 1
jmp 0x1003d74b
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x198], eax
je 0x1003d762
mov dword [ebp - 0x404], 1
jmp 0x1003d769
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x4f8], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x500], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x510], eax
push 0
lea ecx, [ebp - 0x154]
call fcn.1000bc0c
cmp dword [eax], 0xffff
jbe 0x1003d7ae
mov dword [ebp - 0x240], 1
jmp 0x1003d7b5
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x2b0], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x354]
mov dword [ebp + eax - 0x4d4], ecx
jmp 0x1003d555
lea eax, [ebp - 0x3d4]
push eax
lea eax, [ebp - 0x2b0]
push eax
push 0x4d2f
push 0x747d
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x35c]
push eax
push 1
push 0
lea eax, [ebp - 0x154]
push eax
call fcn.1003c57d
add esp, 0x24
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x154]
call fcn.1000bbf0
mov dword [ebp - 0x10], 0
jmp 0x1003d839
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x1f
jge 0x1003db96
mov dword [ebp - 0x9c], 0xd297
mov dword [ebp - 0xc8], 0
jmp 0x1003d866
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 4
jge 0x1003d882
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x4c4], 0xa8eac8b
jmp 0x1003d859
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x4c4], 0xfffffff5
jmp 0x1003d8ad
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x4c4]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x4c4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x4c4], 0xa
jg 0x1003d932
mov dword [ebp - 0xe8], 0x1fe77dd6
mov dword [ebp - 0xe8], 0xfffffffa
jmp 0x1003d8df
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0xfffffff5
jle 0x1003d92d
mov dword [ebp - 0x9c], 0x4210e164
push 0x6475
push 0x4e73
push 0x1f96
push 0x4ef4
push 1
push 1
push 0x43a4
push 0x7daf
push 0x6675
push 0xa77
push 0x29a1
call fcn.10025b36
add esp, 0x2c
jmp 0x1003d8d2
jmp 0x1003d894
mov dword [ebp - 0x9c], 0xffffffe5
jmp 0x1003d94b
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0x28
jle 0x1003d9fb
mov dword [ebp - 0xd0], 0x735b263d
mov dword [ebp - 0x10c], 0xcc9c
cmp dword [ebp - 0xd0], 0
jne 0x1003d987
mov eax, 0x8047
test eax, eax
jne 0x1003d987
and dword [ebp - 0x1a8], 0
jmp 0x1003d991
mov dword [ebp - 0x1a8], 1
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0xd0]
cmp eax, dword [ebp - 0x10c]
jle 0x1003d9b7
mov dword [ebp - 0x248], 1
jmp 0x1003d9be
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x1a8]
cmp eax, dword [ebp - 0x248]
je 0x1003d9d8
mov dword [ebp - 0x1b0], 1
jmp 0x1003d9df
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0x10c], 0
je 0x1003d9f6
jmp 0x1003d9fb
jmp 0x1003d93e
mov dword [ebp - 0x2f4], 0x8ade19d2
mov dword [ebp - 0x2f0], 0x8ade19d2
mov dword [ebp - 0x2ec], 0x8ade19d2
mov dword [ebp - 0x2e8], 0x8ade19d2
mov dword [ebp - 0x3c], 0
jmp 0x1003da33
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1003da49
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x40c], 0xfffffff8
jmp 0x1003da2c
mov dword [ebp - 0x3c], 0
jmp 0x1003da59
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x1003da6f
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x590], 0xc345fe46
jmp 0x1003da52
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2f4], 0
jmp 0x1003da9a
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2f4]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2f4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2f4], 0
jl 0x1003dac3
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2f4]
cmp dword [ebp + eax*4 - 0x40c], 0
je 0x1003dac1
jmp 0x1003dac3
jmp 0x1003da81
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x590]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x590], eax
mov byte [ebp - 0x7f], 0
push 1
lea ecx, [ebp - 0x448]
call fcn.1000bb6e
mov byte [ebp - 4], 3
mov dword [ebp - 0x364], 0xffffffff
mov dword [ebp - 0x3dc], 0xe2bbef7d
push 0
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x518]
push eax
push 0x7736
call fcn.1003bad0
add esp, 0x10
push 0x4d4b
push 0x290e
push 1
push 0x7df7
push 0x7395
lea eax, [ebp - 0x448]
push eax
push 0x3423
push 1
push 0x7c4e
lea eax, [ebp - 0x364]
push eax
push 0
lea eax, [ebp - 0x3dc]
push eax
call fcn.1002996a
add esp, 0x30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x448]
call fcn.1000bbf0
push 0x1509
push 0x7112
push 0x7fce
lea eax, [ebp - 0x7f]
push eax
push 0
call fcn.10034ca9
add esp, 0x14
jmp 0x1003d832
jmp 0x1003e88e
mov dword [ebp - 0x64], 0x5969a22d
mov dword [ebp - 0x8c], 0xffffffff
mov dword [ebp - 0x44], 0xfa553fc2
mov dword [ebp - 0x1d8], 0xb26d5d64
mov dword [ebp - 0xf8], 0
jmp 0x1003dbd6
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jge 0x1003dbf2
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x98], 4
jmp 0x1003dbc9
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x98]
mov dword [ebp - 0x520], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x98]
cmp dword [ebp + eax - 0x98], ecx
jle 0x1003dc2d
mov dword [ebp - 0x290], 1
jmp 0x1003dc34
and dword [ebp - 0x290], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x98]
cmp dword [ebp - 0x290], eax
jge 0x1003dc55
mov dword [ebp - 0x1b8], 1
jmp 0x1003dc5c
and dword [ebp - 0x1b8], 0
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x64], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x98]
cmp dword [ebp - 0x64], eax
je 0x1003dc83
mov dword [ebp - 0x250], 1
jmp 0x1003dc8a
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x8c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x98]
mov dword [ebp - 0x528], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x98]
mov dword [ebp - 0x530], eax
cmp dword [ebp - 0x64], 0x9297
je 0x1003dce1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x98], 0
je 0x1003dce1
mov dword [ebp - 0x36c], 1
jmp 0x1003dce8
and dword [ebp - 0x36c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x98]
mov dword [ebp - 0x538], eax
push 0xfffffffffffffff9
pop eax
test eax, eax
je 0x1003dd17
cmp dword [ebp - 0x8c], 0
je 0x1003dd17
mov dword [ebp - 0x1c0], 1
jmp 0x1003dd1e
and dword [ebp - 0x1c0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x98]
cmp eax, dword [ebp - 0x1c0]
jge 0x1003dd3f
mov dword [ebp - 0x2d4], 1
jmp 0x1003dd46
and dword [ebp - 0x2d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x98]
cmp dword [ebp - 0x2d4], eax
jge 0x1003dd67
mov dword [ebp - 0x1c8], 1
jmp 0x1003dd6e
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x8c], 0
je 0x1003dfe2
cmp dword [ebp - 0x8c], 0
je 0x1003dfe2
push 1
lea ecx, [ebp - 0x490]
call fcn.1000bb6e
mov byte [ebp - 4], 4
mov dword [ebp - 0x48], 0
jmp 0x1003ddb2
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x1003ddc8
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x238], 0xfffffffb
jmp 0x1003ddab
mov dword [ebp - 0x48], 0
jmp 0x1003ddd8
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x1003ddf4
push dword [ebp - 0x48]
lea ecx, [ebp - 0x490]
call fcn.1000bc0c
mov dword [eax], 0xc0d357
jmp 0x1003ddd1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x238]
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x64], 0
jne 0x1003de42
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x238], 0xfffffff8
jge 0x1003de27
mov dword [ebp - 0x258], 1
jmp 0x1003de2e
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x258], eax
je 0x1003de42
and dword [ebp - 0x1d0], 0
jmp 0x1003de4c
mov dword [ebp - 0x1d0], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x238]
cmp dword [ebp - 0x1d0], eax
jg 0x1003de70
cmp dword [ebp - 0x64], 0
jne 0x1003de70
and dword [ebp - 0x298], 0
jmp 0x1003de7a
mov dword [ebp - 0x298], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x238]
cmp dword [ebp - 0x298], eax
jl 0x1003de9b
mov dword [ebp - 0x414], 1
jmp 0x1003dea2
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x548], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x238]
mov dword [ebp - 0x550], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x98], 0
jne 0x1003dee0
mov eax, 0x2cdfd7f7
test eax, eax
jne 0x1003dee0
and dword [ebp - 0x374], 0
jmp 0x1003deea
mov dword [ebp - 0x374], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x238]
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x1d8]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x238]
cmp dword [ebp - 0x8c], eax
jne 0x1003df31
mov dword [ebp - 0x260], 1
jmp 0x1003df38
and dword [ebp - 0x260], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x238]
cmp dword [ebp - 0x260], eax
jl 0x1003df58
mov dword [ebp - 0x1e0], 1
jmp 0x1003df5f
and dword [ebp - 0x1e0], 0
push 0
lea ecx, [ebp - 0x490]
call fcn.1000bc0c
mov ecx, dword [ebp - 0x1e0]
mov dword [eax], ecx
mov dword [ebp - 0x44], 0
jmp 0x1003df84
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x1003dfd1
push 0x1d1e
push 0x6878
push 0
push 0x5efa
push 0x2700
push 0x7bd8
push 0
push 0x120f
push 0x26ed
push 1
push 0x3a85
push 0x5fb
push 0x4d2b
push 0x3937
call fcn.1003aefc
add esp, 0x38
jmp 0x1003df7d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x490]
call fcn.1000bbf0
jmp 0x1003e031
mov dword [ebp - 0x44], 0
jmp 0x1003dff2
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jg 0x1003e008
push 0x4244
push 0
call fcn.1003bf6e
pop ecx
pop ecx
jmp 0x1003dfeb
mov byte [ebp - 0x75], 0
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x1003e031
push 0x6a7b
push 0x59e
push 1
push 1
push 0x471c
push 0
call fcn.10026e71
add esp, 0x18
mov dword [ebp - 0xf0], 0xfffffff9
mov dword [ebp - 0x4d8], 0xe7e55059
mov dword [ebp - 0x568], 0
mov dword [ebp - 0x570], 0x5934215e
mov dword [ebp - 0x578], 0x21009d43
mov dword [ebp - 0x580], 7
mov dword [ebp - 0x5f4], 4
mov dword [ebp - 0x5fc], 0x51554671
mov dword [ebp - 0xd8], 0
jmp 0x1003e09a
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 1
jge 0x1003e0b6
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x604], 1
jmp 0x1003e08d
mov dword [ebp - 0xf0], 0xffffffe9
jmp 0x1003e0cf
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0x15
jl 0x1003e386
push 3
lea ecx, [ebp - 0x5b0]
call fcn.1000bb6e
mov byte [ebp - 4], 5
mov dword [ebp - 0x5f0], 1
mov dword [ebp - 0x5d4], 0xffffffff
mov dword [ebp - 0x4e4], 0xfffffff8
push 1
lea ecx, [ebp - 0x460]
call fcn.1000bb6e
mov byte [ebp - 4], 6
mov dword [ebp - 0x14], 0
jmp 0x1003e12c
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1003e142
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe0], 0xfffffffb
jmp 0x1003e125
mov dword [ebp - 0x14], 0
jmp 0x1003e152
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1003e16b
push dword [ebp - 0x14]
lea ecx, [ebp - 0x5b0]
call fcn.1000bc0c
and dword [eax], 0
jmp 0x1003e14b
mov dword [ebp - 0x14], 0
jmp 0x1003e17b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1003e191
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x56c], 0xe6bc
jmp 0x1003e174
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x460]
push eax
push 0x6f04
push 0x2885
push 0x620f
push 0
push 0x4fe2
push 1
call fcn.10028362
add esp, 0x24
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xe0], 0x1c
jmp 0x1003e1ec
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xe0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe0], 0x19
je 0x1003e363
mov dword [ebp - 0x4ec], 0x38b6
mov dword [ebp - 0x5e4], 0xfffffff6
push 2
lea ecx, [ebp - 0x5a0]
call fcn.1000bb6e
mov byte [ebp - 4], 7
mov dword [ebp - 0x41c], 0x1a1f
cmp dword [ebp - 0x41c], 0xd88
jge 0x1003e2ec
and dword [0x10749cc8], 0
jmp 0x1003e253
mov eax, dword [0x10749cc8]
inc eax
mov dword [0x10749cc8], eax
push 0x1076a980
push 0x10749b10
push 0x10007a00
call fcn.10050dfb
add esp, 0xc
test eax, eax
je 0x1003e2ec
cmp dword [0x10749b10], 1
jl 0x1003e2ec
cmp dword [0x1076a980], 0
jl 0x1003e2ec
mov eax, dword [0x1076a980]
cmp eax, dword [0x10749b10]
jle 0x1003e29c
push 0x10007c04
call fcn.1005329d
pop ecx
jmp 0x1003e248
mov eax, dword [0x1076a980]
cmp eax, dword [0x10749b10]
jne 0x1003e2b6
push 0x10007be8
call fcn.1005329d
pop ecx
jmp 0x1003e248
push 0x19860
push 0xffffffffffffffff
push 0x10751120
call fcn.1004a674
add esp, 0xc
push 2
push 0
push 0
call fcn.1003ccb8
add esp, 0xc
push edx
push eax
push 0x10007a2c
call fcn.1005118c
add esp, 0xc
jmp 0x1003e248
lea eax, [ebp - 0x5a0]
push eax
push 0x1fb4
push 0
push 0x19d1
lea eax, [ebp - 0x4f4]
push eax
push 0x62d5
push 0x6499
push 0
push 0x5370
push 0x7dd
push 1
push 0x572f
call fcn.1002996a
add esp, 0x30
push 0
lea ecx, [ebp - 0x460]
call fcn.1000bc0c
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2bc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2bc]
mov dword [ecx], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x5a0]
call fcn.1000bbf0
jmp 0x1003e1d1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x460]
call fcn.1000bbf0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5b0]
call fcn.1000bbf0
jmp 0x1003e0c2
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x37c], 1
mov dword [ebp - 0xb8], 0
jmp 0x1003e3b0
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x1003e3cc
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x634], 0xffff
jmp 0x1003e3a3
mov byte [ebp - 0x5a], 0
push 0x75bb
push 0x6d42
push 0
push 0
lea eax, [ebp - 0x5a]
push eax
call fcn.1003b3d7
add esp, 0x14
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x634]
mov dword [ebp - 0x37c], eax
mov dword [ebp - 0x3f8], 0x4d024bfc
mov dword [ebp - 0xa8], 0x30f94f37
mov dword [ebp - 0x128], 0xfffffffe
mov dword [ebp - 0xc4], 0
jmp 0x1003e434
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jge 0x1003e450
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x430], 0xec2e0cf5
jmp 0x1003e427
mov dword [ebp - 0xa8], 0
jmp 0x1003e469
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jg 0x1003e615
mov dword [ebp - 0x30], 0xccbad86e
mov dword [ebp - 0x418], 0xffffffff
mov dword [ebp - 0x30], 0
jmp 0x1003e497
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jg 0x1003e5f7
mov dword [ebp - 0x6c], 0x5a80e358
mov dword [ebp - 0x6c], 0
jmp 0x1003e4b8
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jg 0x1003e5f2
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x574], eax
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
cmp eax, dword [ebp + ecx*4 - 0x430]
jle 0x1003e4ea
mov dword [ebp - 0x1e8], 1
jmp 0x1003e4f1
and dword [ebp - 0x1e8], 0
cmp dword [ebp - 0x1e8], 1
je 0x1003e506
mov dword [ebp - 0x268], 1
jmp 0x1003e50d
and dword [ebp - 0x268], 0
cmp dword [ebp - 0x268], 0x75d5
jge 0x1003e525
mov dword [ebp - 0x1f0], 1
jmp 0x1003e52c
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x1f0]
sub eax, 0x5248
sub eax, dword [ebp - 0x128]
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0x430]
cmp eax, dword [ebp - 0x418]
jle 0x1003e55d
mov dword [ebp - 0x2a0], 1
jmp 0x1003e564
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x2a0], eax
jl 0x1003e57e
mov dword [ebp - 0x1f8], 1
jmp 0x1003e585
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x128]
add eax, dword [ebp - 0x1f8]
cmp eax, dword [ebp - 0x6c]
jg 0x1003e5a2
mov dword [ebp - 0x270], 1
jmp 0x1003e5a9
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x430]
imul eax, dword [ebp - 0x270]
cmp eax, dword [ebp - 0x6c]
jl 0x1003e5cb
mov dword [ebp - 0x200], 1
jmp 0x1003e5d2
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0x430], ecx
cmp dword [ebp - 0xa8], 0
je 0x1003e5ed
jmp 0x1003e5f2
jmp 0x1003e4b1
jmp 0x1003e490
mov byte [ebp - 0x5d], 0
push 1
lea eax, [ebp - 0x5d]
push eax
push 1
push 0x478c
call fcn.10025d71
add esp, 0x10
jmp 0x1003e45c
mov byte [ebp - 0x59], 0
movzx eax, byte [ebp - 0x59]
test eax, eax
je 0x1003e634
push 0
push 0x1349
push 1
push 1
call fcn.100418c4
add esp, 0x10
mov dword [ebp - 0xcc], 0
jmp 0x1003e64d
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x1003e669
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x49c], 0x3cd3
jmp 0x1003e640
xor eax, eax
inc eax
je 0x1003e672
cmp dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x2cc], eax
push 1
lea ecx, [ebp - 0x2e4]
call fcn.1000bc0c
mov ecx, dword [ebp - 0x2cc]
mov dword [eax], ecx
cmp dword [ebp - 0x2cc], 0xfffffffb
jge 0x1003e6a5
mov dword [ebp - 0x208], 1
jmp 0x1003e6ac
and dword [ebp - 0x208], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x208]
sub ecx, dword [ebp + eax - 0x49c]
cmp ecx, 0xb46f9f11
jne 0x1003e6e3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x49c], 0
je 0x1003e6e3
mov dword [ebp - 0x278], 1
jmp 0x1003e6ea
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x1003e73f
mov dword [ebp - 0x28], 0x1b
jmp 0x1003e709
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xf
jle 0x1003e73a
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x1003e738
push 0x7adf
push 0x4654
push 0x45d0
push 1
push 0
push 0
call fcn.1003a2c6
add esp, 0x18
jmp 0x1003e702
jmp 0x1003e88e
mov dword [ebp - 0x114], 0xe9a03a1b
mov dword [ebp - 0x130], 0xe0ca
mov dword [ebp - 0x74], 0
jmp 0x1003e763
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x1003e779
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x49c], 9
jmp 0x1003e75c
cmp dword [ebp - 0x114], 0xe96c
jne 0x1003e791
mov dword [ebp - 0x210], 1
jmp 0x1003e798
and dword [ebp - 0x210], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x114]
cmp eax, 0x9fd40fd7
ja 0x1003e7b4
mov dword [ebp - 0x2a8], 1
jmp 0x1003e7bb
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x210]
cmp eax, dword [ebp - 0x2a8]
jg 0x1003e7d5
mov dword [ebp - 0x218], 1
jmp 0x1003e7dc
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x28], eax
mov esi, dword [ebp - 0x28]
push 0
lea ecx, [ebp - 0x2e4]
call fcn.1000bc0c
cmp esi, dword [eax]
jne 0x1003e805
mov dword [ebp - 0x280], 1
jmp 0x1003e80c
and dword [ebp - 0x280], 0
mov esi, dword [ebp - 0x130]
add esi, dword [ebp - 0x280]
add esi, dword [ebp - 0x130]
push 1
lea ecx, [ebp - 0x2e4]
call fcn.1000bc0c
mov dword [eax], esi
cmp dword [ebp - 0x28], 0
je 0x1003e848
cmp dword [ebp - 0x130], 0
je 0x1003e848
mov dword [ebp - 0x168], 1
jmp 0x1003e84f
and dword [ebp - 0x168], 0
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x168]
jge 0x1003e869
mov dword [ebp - 0x384], 1
jmp 0x1003e870
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x4fc], eax
push 1
lea ecx, [ebp - 0x2e4]
call fcn.1000bc0c
mov eax, dword [eax]
mov dword [ebp - 0x74], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2e4]
call fcn.1000bbf0
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x28c], eax
push 3
lea ecx, [ebp - 0x4b4]
call fcn.1000bb6e
mov dword [ebp - 4], 8
mov dword [ebp - 0xac], 0
mov dword [ebp - 0x3a4], 0xfffffffb
push 4
lea ecx, [ebp - 0x478]
call fcn.1000bb6e
mov byte [ebp - 4], 9
mov dword [ebp - 0x34], 0
jmp 0x1003e8f5
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x1003e911
push dword [ebp - 0x34]
lea ecx, [ebp - 0x4b4]
call fcn.1000bc0c
mov dword [eax], 0xb9b55bb2
jmp 0x1003e8ee
mov dword [ebp - 0x38c], 0x1f1d
cmp dword [ebp - 0x38c], 0xe14
jge 0x1003eadc
push 0x10007d84
lea ecx, [ebp - 0x628]
call fcn.1000b6bc
mov byte [ebp - 4], 0xa
push 0x10007d90
lea ecx, [ebp - 0x664]
call fcn.1000b6bc
mov byte [ebp - 4], 0xb
push 0x10007d98
lea ecx, [ebp - 0x64c]
call fcn.1000b6bc
mov byte [ebp - 4], 0xc
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x5ec], esp
lea eax, [ebp - 0x664]
push eax
call fcn.1000b685
mov dword [ebp - 0x504], eax
mov byte [ebp - 4], 0xd
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x57c], esp
lea eax, [ebp - 0x628]
push eax
call fcn.1000b685
mov byte [ebp - 4], 0xc
call fcn.1003cdc4
add esp, 0x30
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x16c], eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x50c], esp
lea eax, [ebp - 0x64c]
push eax
call fcn.1000b685
mov dword [ebp - 0x5e0], eax
mov byte [ebp - 4], 0xe
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x514], esp
lea eax, [ebp - 0x628]
push eax
call fcn.1000b685
mov byte [ebp - 4], 0xc
call fcn.1003cdc4
add esp, 0x30
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x16c], 0xffffffff
je 0x1003ea46
push fcn.1000f027
push dword [ebp - 0x16c]
mov edx, 0x10007da0
mov ecx, 0x1065bbb8
call fcn.1000f059
mov ecx, eax
call fcn.1000b947
mov ecx, eax
call fcn.1000b93b
jmp 0x1003ea61
push fcn.1000f027
mov edx, 0x10007db8
mov ecx, 0x1065bbb8
call fcn.1000f059
mov ecx, eax
call fcn.1000b93b
cmp dword [ebp - 0x174], 0xffffffff
je 0x1003ea94
push fcn.1000f027
push dword [ebp - 0x174]
mov edx, 0x10007dd0
mov ecx, 0x1065bbb8
call fcn.1000f059
mov ecx, eax
call fcn.1000b947
mov ecx, eax
call fcn.1000b93b
jmp 0x1003eaaf
push fcn.1000f027
mov edx, 0x10007de8
mov ecx, 0x1065bbb8
call fcn.1000f059
mov ecx, eax
call fcn.1000b93b
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x64c]
call fcn.1000b70e
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x664]
call fcn.1000b70e
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x628]
call fcn.1000b70e
mov dword [ebp - 0x34], 0
jmp 0x1003eaec
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x1003eb08
push dword [ebp - 0x34]
lea ecx, [ebp - 0x478]
call fcn.1000bc0c
mov dword [eax], 0xfffffffe
jmp 0x1003eae5
mov dword [ebp - 0xac], 0
jmp 0x1003eb21
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 2
jg 0x1003eb8a
mov dword [ebp - 0x39c], 0x2282d564
mov dword [ebp - 0x400], 0xae9a07b3
mov dword [ebp - 0x420], 1
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x39c]
push eax
lea eax, [ebp - 0x4b4]
push eax
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x420]
push eax
push 0
push 0xcd7
lea eax, [ebp - 0x3a4]
push eax
call fcn.1003c231
add esp, 0x24
jmp 0x1003eb14
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x478]
call fcn.1000bbf0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4b4]
call fcn.1000bbf0
mov dword [ebp - 0x58], 1
push 4
lea ecx, [ebp - 0x5d0]
call fcn.1000bb6e
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x584], 0x280643b8
mov dword [ebp - 0xd4], 0
jmp 0x1003ebe6
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 4
jge 0x1003ec08
push dword [ebp - 0xd4]
lea ecx, [ebp - 0x5d0]
call fcn.1000bc0c
mov dword [eax], 0xfffffffa
jmp 0x1003ebd9
mov dword [ebp - 0x58], 0
jmp 0x1003ec18
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0x12
jle 0x1003ec51
mov dword [ebp - 0x2fc], 0xfffffffe
push 1
push 0xc2b
push 0
lea eax, [ebp - 0x2fc]
push eax
push 0x5b59
push 0x7c8b
push 0x694e
call fcn.1002825f
add esp, 0x1c
jmp 0x1003ec11
mov dword [ebp - 0x58], 0
jmp 0x1003ec61
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jg 0x1003edb8
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0xb0], 3
jmp 0x1003ec8e
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jl 0x1003edb3
mov dword [ebp - 0x3f0], 0xfffffff8
mov dword [ebp - 0x3ec], 0xfffffff8
mov dword [ebp - 0x3e8], 0xfffffff8
mov dword [ebp - 0x3e4], 0xfffffff8
mov dword [ebp - 0x51c], 0x60d2f38d
mov dword [ebp - 0x600], 0xb9193c1d
mov byte [ebp - 0x5b], 0
movzx eax, byte [ebp - 0x5b]
test eax, eax
je 0x1003ecfe
push 0x7e8e
push 0x77e7
push 0
push 1
push 0x3c66
call fcn.1003b3d7
add esp, 0x14
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x3f0], 3
jmp 0x1003ed2c
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x3f0]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x3f0], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x3f0], 0
jl 0x1003edae
mov dword [ebp - 0x524], 1
mov dword [ebp - 0x594], 1
push 2
lea ecx, [ebp - 0x5c0]
call fcn.1000bb6e
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x300], 0xde9a
push 1
lea eax, [ebp - 0x52c]
push eax
push 1
push 0x4a97
lea eax, [ebp - 0x5c0]
push eax
call fcn.10025e78
add esp, 0x14
lea eax, [ebp - 0x300]
push eax
push 0
call fcn.1003c6de
pop ecx
pop ecx
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x5c0]
call fcn.1000bbf0
jmp 0x1003ed11
jmp 0x1003ec81
jmp 0x1003ec5a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5d0]
call fcn.1000bbf0
push 0
push 1
push 1
push 0x3de5
call fcn.100279a7
add esp, 0x10
mov dword [ebp - 0xe4], 0x4ec2e0cf
mov dword [ebp - 0x5e8], 0xfffffffd
mov dword [ebp - 0x534], 0xaf8b5131
mov dword [ebp - 0x5a4], 0xfffffff8
mov dword [ebp - 0x53c], 0x92bd42ca
mov dword [ebp - 0x5f8], 0
mov dword [ebp - 0x544], 6
mov dword [ebp - 0x5b4], 0xfffffff7
mov dword [ebp - 0x54c], 1
mov dword [ebp - 0x5d8], 0xffffffff
mov dword [ebp - 0x328], 1
mov dword [ebp - 0xe4], 1
jmp 0x1003ee61
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0xfffffffc
jne 0x1003f1be
push 2
lea ecx, [ebp - 0x43c]
call fcn.1000bb6e
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x320], 0xd86e52d8
push 0x12e2
lea eax, [ebp - 0x554]
push eax
push 0x77e2
lea eax, [ebp - 0x43c]
push eax
push 0
call fcn.1003fcfe
add esp, 0x14
mov dword [ebp - 0x308], 0x1f24
cmp dword [ebp - 0x308], 0x1131
jge 0x1003f18b
lea eax, [ebp - 0x1bc]
push eax
lea eax, [ebp - 0x120]
push eax
push 0x10007a00
call fcn.10050dfb
add esp, 0xc
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x194]
push eax
push 0x10007b80
call fcn.10050dfb
add esp, 0x10
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x1b4]
push eax
push 0x10007b80
call fcn.10050dfb
add esp, 0x10
mov eax, dword [ebp - 0x120]
cdq
push 8
pop ecx
shl ecx, 0
mov dword [ecx + 0x1072b998], eax
mov dword [ecx + 0x1072b99c], edx
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x124], 1
mov dword [ebp - 0x11c], 1
mov eax, dword [ebp - 0x194]
imul eax, dword [ebp - 0x120]
cdq
idiv dword [ebp - 0x18c]
add eax, dword [ebp - 0x184]
cdq
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], edx
mov eax, dword [ebp - 0x1b4]
imul eax, dword [ebp - 0x120]
cdq
idiv dword [ebp - 0x1ac]
add eax, dword [ebp - 0x1a4]
cdq
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], edx
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x1bc]
je 0x1003f16a
mov eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0xbc]
jg 0x1003f0a4
jl 0x1003efde
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0xc0]
jae 0x1003f0a4
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
mov ecx, dword [ebp - 0x108]
cmp ecx, dword [eax*8 + 0x1072b998]
jne 0x1003f011
mov eax, dword [ebp - 0x17c]
mov ecx, dword [ebp - 0x104]
cmp ecx, dword [eax*8 + 0x1072b99c]
je 0x1003f035
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x108]
mov dword [eax*8 + 0x1072b998], ecx
mov ecx, dword [ebp - 0x104]
mov dword [eax*8 + 0x1072b99c], ecx
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x184]
cdq
mov esi, eax
mov edi, edx
mov eax, dword [ebp - 0x18c]
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x194]
cdq
mov ecx, dword [ebp - 0x124]
push dword [ecx*8 + 0x1072b99c]
push dword [ecx*8 + 0x1072b998]
push edx
push eax
call fcn.10056cf0
mov ecx, dword [ebp - 0x310]
push ecx
push ebx
push edx
push eax
call fcn.100693e0
add eax, esi
adc edx, edi
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], edx
jmp 0x1003f165
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0xc0]
cmp ecx, dword [eax*8 + 0x1072b998]
jne 0x1003f0d7
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0xbc]
cmp ecx, dword [eax*8 + 0x1072b99c]
je 0x1003f0fb
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc0]
mov dword [eax*8 + 0x1072b998], ecx
mov ecx, dword [ebp - 0xbc]
mov dword [eax*8 + 0x1072b99c], ecx
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x1a4]
cdq
mov esi, eax
mov edi, edx
mov eax, dword [ebp - 0x1ac]
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x1b4]
cdq
mov ecx, dword [ebp - 0x11c]
push dword [ecx*8 + 0x1072b99c]
push dword [ecx*8 + 0x1072b998]
push edx
push eax
call fcn.10056cf0
mov ecx, dword [ebp - 0x318]
push ecx
push ebx
push edx
push eax
call fcn.100693e0
add eax, esi
adc edx, edi
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], edx
jmp 0x1003efa9
mov eax, dword [ebp - 0x1bc]
push dword [eax*8 + 0x1072b99c]
push dword [eax*8 + 0x1072b998]
push 0x10007a2c
call fcn.1005118c
add esp, 0xc
push 0x2c60
push 0
lea eax, [ebp - 0x320]
push eax
push 1
lea eax, [ebp - 0x43c]
push eax
call fcn.1003711d
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x43c]
call fcn.1000bbf0
jmp 0x1003ee54
push 1
push 0
lea eax, [ebp - 0x328]
push eax
push 0x2d0a
call fcn.100298cd
add esp, 0x10
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xb4]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x40], eax
push 4
lea ecx, [ebp - 0x160]
call fcn.1000bb6e
mov dword [ebp - 4], 0x12
push 2
lea ecx, [ebp - 0x484]
call fcn.1000bb6e
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x20c], 9
mov dword [ebp - 0x340], 0xffffffff
mov dword [ebp - 0x5c4], 8
mov dword [ebp - 0x18], 0
jmp 0x1003f244
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1003f25a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x454], 0x64a6847d
jmp 0x1003f23d
mov dword [ebp - 0x18], 0
jmp 0x1003f26a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1003f286
push dword [ebp - 0x18]
lea ecx, [ebp - 0x160]
call fcn.1000bc0c
mov dword [eax], 0xfffffff9
jmp 0x1003f263
mov dword [ebp - 0x18], 0
jmp 0x1003f296
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1003f2b2
push dword [ebp - 0x18]
lea ecx, [ebp - 0x484]
call fcn.1000bc0c
mov dword [eax], 0x7d2703d9
jmp 0x1003f28f
mov byte [ebp - 0x7e], 0
movzx eax, byte [ebp - 0x7e]
test eax, eax
je 0x1003f2f2
push 1
push 0x4cd0
push 0x2a2
push 0x3073
push 0x4218
push 0x71f3
push 0x7a3d
push 0x62ac
push 1
push 0x6ecb
call fcn.10026496
add esp, 0x28
push 3
lea ecx, [ebp - 0x160]
call fcn.1000bc0c
mov dword [eax], 2
jmp 0x1003f32b
push 3
lea ecx, [ebp - 0x160]
call fcn.1000bc0c
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1c4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1c4]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x160]
call fcn.1000bc0c
cmp dword [eax], 0
jl 0x1003f632
push 3
lea ecx, [ebp - 0x148]
call fcn.1000bb6e
mov byte [ebp - 4], 0x14
push 2
lea ecx, [ebp - 0x46c]
call fcn.1000bb6e
mov byte [ebp - 4], 0x15
push 0x5c11
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x148]
push eax
push 0
call fcn.1004102d
add esp, 0x10
mov dword [ebp - 0xa0], 0
jmp 0x1003f399
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x1003f3b8
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x46c]
call fcn.1000bc0c
or dword [eax], 0xffffffff
jmp 0x1003f38c
push 3
lea ecx, [ebp - 0x160]
call fcn.1000bc0c
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x454], 0
jle 0x1003f3dd
mov dword [ebp - 0x1cc], 1
jmp 0x1003f3e4
and dword [ebp - 0x1cc], 0
cmp dword [ebp - 0x1cc], 0x401dbdae
jge 0x1003f3fc
mov dword [ebp - 0x1d4], 1
jmp 0x1003f403
and dword [ebp - 0x1d4], 0
push 2
lea ecx, [ebp - 0x148]
call fcn.1000bc0c
mov ecx, dword [ebp - 0x1d4]
cmp ecx, dword [eax]
je 0x1003f43c
push 3
lea ecx, [ebp - 0x160]
call fcn.1000bc0c
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x454], 0
jne 0x1003f43c
and dword [ebp - 0x1dc], 0
jmp 0x1003f446
mov dword [ebp - 0x1dc], 1
push 2
lea ecx, [ebp - 0x148]
call fcn.1000bc0c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1dc]
jg 0x1003f469
mov dword [ebp - 0x1ec], 1
jmp 0x1003f470
and dword [ebp - 0x1ec], 0
push 1
lea ecx, [ebp - 0x46c]
call fcn.1000bc0c
mov dword [ebp - 0x1e4], eax
push 0
lea ecx, [ebp - 0x148]
call fcn.1000bc0c
mov ecx, dword [ebp - 0x1e4]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1e4]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1ec]
jle 0x1003f4b6
mov dword [ebp - 0x1f4], 1
jmp 0x1003f4bd
and dword [ebp - 0x1f4], 0
mov esi, dword [ebp - 0x1f4]
add esi, 0xdadf
push 3
lea ecx, [ebp - 0x160]
call fcn.1000bc0c
cmp esi, dword [eax]
jg 0x1003f4e6
mov dword [ebp - 0x1fc], 1
jmp 0x1003f4ed
and dword [ebp - 0x1fc], 0
cmp dword [ebp - 0x1fc], 5
jb 0x1003f502
mov dword [ebp - 0x204], 1
jmp 0x1003f509
and dword [ebp - 0x204], 0
push 0
lea ecx, [ebp - 0x148]
call fcn.1000bc0c
mov ecx, dword [ebp - 0x204]
add ecx, dword [eax]
mov dword [ebp - 0x20c], ecx
mov esi, dword [ebp - 0x20c]
inc esi
push 2
lea ecx, [ebp - 0x148]
call fcn.1000bc0c
cmp esi, dword [eax]
jge 0x1003f548
mov dword [ebp - 0x330], 1
jmp 0x1003f54f
and dword [ebp - 0x330], 0
push 1
lea ecx, [ebp - 0x484]
call fcn.1000bc0c
mov dword [ebp - 0x338], eax
push 2
lea ecx, [ebp - 0x148]
call fcn.1000bc0c
mov ecx, dword [ebp - 0x338]
mov eax, dword [eax]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x160]
call fcn.1000bc0c
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x454], 8
jb 0x1003f59e
mov dword [ebp - 0x214], 1
jmp 0x1003f5a5
and dword [ebp - 0x214], 0
push 2
lea ecx, [ebp - 0x148]
call fcn.1000bc0c
mov ecx, dword [ebp - 0x214]
cmp ecx, dword [eax]
jge 0x1003f5c8
mov dword [ebp - 0x21c], 1
jmp 0x1003f5cf
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x340], eax
mov byte [ebp - 0x5e], 0
push 0x5b5
push 0x1fa9
push 1
lea eax, [ebp - 0x5e]
push eax
push 0x5a39
push 0x2f05
push 1
push 0x3587
push 0
push 0x1993
call fcn.10034587
add esp, 0x28
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x46c]
call fcn.1000bbf0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x148]
call fcn.1000bbf0
jmp 0x1003f307
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x484]
call fcn.1000bbf0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.1000bbf0
and dword [ebp - 0x12c], 0
jmp 0x1003f66f
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x40]
add eax, 0x28
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x12c], eax
jge 0x1003fbf6
mov eax, dword [ebp - 0x40]
cmp dword [eax + 0x10], 0
jne 0x1003f6bc
push 0x4e79
lea eax, [ebp - 0x40]
push eax
push 1
push 0
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.10026f2d
add esp, 0x1c
jmp 0x1003f659
mov dword [ebp - 0x20], 0xca2c
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x90], 0xffffffff
mov dword [ebp - 0x24], 1
push 1
lea ecx, [ebp - 0x13c]
call fcn.1000bb6e
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x360], 0xad33dc28
mov dword [ebp - 0x370], 1
mov dword [ebp - 0x1c], 0
jmp 0x1003f727
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1003f73d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2b8], 0xfffffffd
jmp 0x1003f720
mov dword [ebp - 0x1c], 0
jmp 0x1003f74d
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1003f760
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x54], 2
jmp 0x1003f746
mov dword [ebp - 0x1c], 0
jmp 0x1003f770
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1003f789
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x13c]
call fcn.1000bc0c
and dword [eax], 0
jmp 0x1003f769
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2b8]
cmp dword [ebp - 0x20], eax
je 0x1003f7a7
mov dword [ebp - 0x254], 1
jmp 0x1003f7ae
and dword [ebp - 0x254], 0
cmp dword [ebp - 0x20], 0x3153
jg 0x1003f7c3
mov dword [ebp - 0x23c], 1
jmp 0x1003f7ca
and dword [ebp - 0x23c], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2b8], 0
je 0x1003f7eb
xor eax, eax
inc eax
je 0x1003f7eb
mov dword [ebp - 0x350], 1
jmp 0x1003f7f2
and dword [ebp - 0x350], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x54]
mov dword [ebp - 0x55c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x54]
cmp dword [ebp - 0xa4], eax
jge 0x1003f820
mov dword [ebp - 0x224], 1
jmp 0x1003f827
and dword [ebp - 0x224], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x54]
cmp dword [ebp - 0x224], eax
jne 0x1003f845
mov dword [ebp - 0x358], 1
jmp 0x1003f84c
and dword [ebp - 0x358], 0
mov eax, 0xfffb
cmp eax, 0x1dbd
je 0x1003f864
mov dword [ebp - 0x244], 1
jmp 0x1003f86b
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x244]
jne 0x1003f88b
mov dword [ebp - 0x24c], 1
jmp 0x1003f892
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x54]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x2b8]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x24], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2b8]
cmp dword [ebp - 0x254], eax
jge 0x1003f8ec
mov dword [ebp - 0x25c], 1
jmp 0x1003f8f3
and dword [ebp - 0x25c], 0
push 0
lea ecx, [ebp - 0x13c]
call fcn.1000bc0c
mov ecx, dword [ebp - 0x25c]
mov dword [eax], ecx
mov dword [ebp - 0x20], 0
jmp 0x1003f918
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x1003fb82
mov dword [ebp - 0x368], 0xffff
push 1
push 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x13c]
push eax
push 0x21e3
call fcn.10027084
add esp, 0x18
mov dword [ebp - 0x24], 0
jmp 0x1003f95c
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jg 0x1003fb7d
mov dword [ebp - 0x110], 0xffffffff
mov dword [ebp - 0x378], 0xf1a7dfae
mov dword [ebp - 0x7c], 0
jmp 0x1003f98a
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jg 0x1003fb63
mov dword [ebp - 0x274], 0x236bbbd2
mov dword [ebp - 0x88], 0
jmp 0x1003f9b7
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jg 0x1003fa5d
mov dword [ebp - 0xa4], 0
jmp 0x1003f9dd
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jg 0x1003fa58
push 0x4541
push 1
push 1
push 0x4638
push 0x7870
call fcn.10026968
add esp, 0x14
mov dword [ebp - 0x90], 0
jmp 0x1003fa1a
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jg 0x1003fa53
push dword [ebp - 0x24]
lea ecx, [ebp - 0x13c]
call fcn.1000bc0c
mov esi, eax
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x13c]
call fcn.1000bc0c
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x54], 0
je 0x1003fa51
jmp 0x1003fa53
jmp 0x1003fa0d
jmp 0x1003f9d0
jmp 0x1003f9aa
push dword [ebp - 0x24]
lea ecx, [ebp - 0x13c]
call fcn.1000bc0c
cmp dword [eax], 0
je 0x1003fa8d
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x54], 0xffffffff
jne 0x1003fa86
mov dword [ebp - 0x264], 1
jmp 0x1003fa8d
and dword [ebp - 0x264], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x13c]
call fcn.1000bc0c
mov dword [eax], 0xfffffffc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x5dc], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x54]
mov dword [ebp - 0x564], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp + eax - 0x54]
mov dword [ebp - 0x26c], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x26c]
mov dword [ebp + eax*4 - 0x2b8], ecx
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x274]
sub eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x110]
jne 0x1003fb07
mov dword [ebp - 0x27c], 1
jmp 0x1003fb0e
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x27c], eax
jg 0x1003fb31
cmp dword [ebp - 0x360], 0
je 0x1003fb31
mov dword [ebp - 0x284], 1
jmp 0x1003fb38
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x368]
cmp dword [ebp - 0x284], eax
jne 0x1003fb54
push 0xfffffffffffffff7
pop eax
test eax, eax
je 0x1003fb54
cmp dword [ebp - 0x370], 0
mov dword [ebp - 0x378], 0x25954a43
jmp 0x1003f983
push dword [ebp - 0x24]
lea ecx, [ebp - 0x13c]
call fcn.1000bc0c
cmp dword [eax], 0
je 0x1003fb78
jmp 0x1003fb7d
jmp 0x1003f955
jmp 0x1003f911
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.1000bbf0
push 4
push 0x1000
mov eax, dword [ebp - 0x40]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x28c]
add ecx, dword [eax + 0xc]
push ecx
push 0x47b2
push 0x35c9
call fcn.1004a412
pop ecx
pop ecx
call eax
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x40]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x380]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x118]
call fcn.1004a5c9
add esp, 0xc
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x118]
mov dword [eax + 8], ecx
jmp 0x1003f659
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret