Function at 0x1002bac4
Capabilities:
Get geographical location
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006650e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x258
push esi
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1002be30
mov dword [ebp - 0x1dc], 0x14cf
cmp dword [ebp - 0x1dc], 0xc88
jge 0x1002bc71
lea eax, [ebp - 0x9c]
push eax
mov ecx, 0x106576b0
call fcn.1001747d
push fcn.1001bb63
mov edx, 0x10009c34
mov ecx, 0x106575f8
call fcn.1001bb95
mov ecx, eax
call fcn.1001766c
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x1e0], 0
je 0x1002bc71
and dword [ebp - 0x98], 0
jmp 0x1002bb71
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xa
jge 0x1002bb94
mov eax, dword [ebp - 0x98]
lea eax, [ebp + eax*4 - 0x264]
push eax
mov ecx, 0x106576b0
call fcn.1001747d
jmp 0x1002bb64
mov byte [ebp - 0xd], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0x264]
cmp eax, dword [ebp + ecx - 0x264]
jge 0x1002bbb8
mov byte [ebp - 0xd], 1
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x1002bbf7
mov byte [ebp - 0xd], 1
and dword [ebp - 0x44], 0
jmp 0x1002bbd1
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 9
jge 0x1002bbf5
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x264]
cmp eax, dword [ebp + ecx*4 - 0x260]
jle 0x1002bbf3
mov byte [ebp - 0xd], 0
jmp 0x1002bbf5
jmp 0x1002bbca
jmp 0x1002bc2c
mov byte [ebp - 0xd], 1
and dword [ebp - 0x58], 0
jmp 0x1002bc08
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 9
jge 0x1002bc2c
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x264]
cmp eax, dword [ebp + ecx*4 - 0x260]
jge 0x1002bc2a
mov byte [ebp - 0xd], 0
jmp 0x1002bc2c
jmp 0x1002bc01
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x1002bc51
push fcn.1001bb63
mov edx, 0x10009c44
mov ecx, 0x106575f8
call fcn.1001bb95
mov ecx, eax
call fcn.1001766c
jmp 0x1002bc6c
push fcn.1001bb63
mov edx, 0x10009c4c
mov ecx, 0x106575f8
call fcn.1001bb95
mov ecx, eax
call fcn.1001766c
jmp 0x1002bb35
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1d8], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x1ec], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x1e8]
movzx eax, byte [eax]
test eax, eax
je 0x1002bcdc
push 0x132a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1002be2b
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x6c]
cmp dword [eax], 0
je 0x1002bda0
mov eax, dword [ebp - 0x11c]
cmp dword [eax], 0
je 0x1002bda0
mov dword [ebp - 0x94], 1
jmp 0x1002bda7
and dword [ebp - 0x94], 0
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c4]
mov ecx, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
imul eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x10c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x10c]
mov ecx, dword [ecx]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x124]
mov dword [eax], ecx
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x124]
mov ecx, dword [ecx]
add ecx, dword [eax]
mov eax, dword [ebp - 0x6c]
cmp dword [eax], ecx
je 0x1002be0f
mov dword [ebp - 0xf0], 1
jmp 0x1002be16
and dword [ebp - 0xf0], 0
push 3
mov ecx, dword [ebp - 0x16c]
call fcn.10017a5d
mov ecx, dword [ebp - 0xf0]
mov dword [eax], ecx
jmp 0x1002cb0e
lea eax, [ebp + 0xc]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x190], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x128]
movzx eax, byte [eax]
test eax, eax
je 0x1002cae3
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x34], eax
push 4
lea ecx, [ebp - 0xb0]
call fcn.100179d6
and dword [ebp - 4], 0
push 1
lea ecx, [ebp - 0x80]
call fcn.100179d6
mov byte [ebp - 4], 1
mov dword [ebp - 0x1b8], 8
push 0x14b5
lea eax, [ebp - 0xb0]
push eax
push 0
push 1
lea eax, [ebp - 0x40]
push eax
push 0x1329
call fcn.100292d5
add esp, 0x18
mov dword [ebp - 0x40], 0
jmp 0x1002bee9
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x1002bf02
push dword [ebp - 0x40]
lea ecx, [ebp - 0x80]
call fcn.10017a5d
mov dword [eax], 1
jmp 0x1002bee2
push 0
lea ecx, [ebp - 0x80]
call fcn.10017a5d
and dword [eax], 0
jmp 0x1002bf32
push 0
lea ecx, [ebp - 0x80]
call fcn.10017a5d
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x114]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x80]
call fcn.10017a5d
cmp dword [eax], 3
jg 0x1002c2f1
mov dword [ebp - 0x1ac], 0x1e5e
cmp dword [ebp - 0x1ac], 0x948
jge 0x1002c009
lea eax, [ebp - 0xa0]
push eax
push 0x100099f8
call fcn.1004d23b
pop ecx
pop ecx
mov eax, dword [ebp - 0xa0]
and eax, 1
mov byte [ebp - 0xe], al
and dword [ebp - 0x54], 0
jmp 0x1002bf8b
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0xa0]
jge 0x1002bfdf
lea eax, [ebp - 0xc0]
push eax
push 0x100099f8
call fcn.1004d23b
pop ecx
pop ecx
cmp dword [ebp - 0x54], 0
jne 0x1002bfc0
mov eax, dword [ebp - 0xc0]
and eax, 1
jne 0x1002bfc0
mov byte [ebp - 0xe], 0
jmp 0x1002bfdf
mov eax, dword [ebp - 0xa0]
dec eax
cmp dword [ebp - 0x54], eax
jne 0x1002bfdd
mov eax, dword [ebp - 0xc0]
and eax, 1
jne 0x1002bfdd
mov byte [ebp - 0xe], 0
jmp 0x1002bfdf
jmp 0x1002bf84
movzx eax, byte [ebp - 0xe]
test eax, eax
je 0x1002bff3
mov dword [ebp - 0x118], 0x10009c58
jmp 0x1002bffd
mov dword [ebp - 0x118], 0x10009c5c
push dword [ebp - 0x118]
call fcn.1004de06
pop ecx
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0xe0], 0xfffe
mov byte [ebp - 0x29], 0
movzx eax, byte [ebp - 0x29]
test eax, eax
je 0x1002c041
push 0x217c
push 0
push 0x21c7
push 0xc1e
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x4c], 3
jmp 0x1002c051
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x1002c2ec
mov dword [ebp - 0x38], 0x3d4752e4
push 0
lea ecx, [ebp - 0x80]
call fcn.10017a5d
push dword [eax]
lea ecx, [ebp - 0xb0]
call fcn.10017a5d
cmp dword [eax], 0
je 0x1002c298
mov dword [ebp - 0xd8], 0xffffffff
mov dword [ebp - 0xe8], 0xfffffff7
push 0
lea ecx, [ebp - 0x80]
call fcn.10017a5d
push dword [eax]
lea ecx, [ebp - 0xb0]
call fcn.10017a5d
cmp dword [eax], 0
je 0x1002c0c5
push 0xfffffffffffffff7
pop eax
test eax, eax
je 0x1002c0c5
mov dword [ebp - 0xc8], 1
jmp 0x1002c0cc
and dword [ebp - 0xc8], 0
push 0
lea ecx, [ebp - 0x80]
call fcn.10017a5d
push dword [eax]
lea ecx, [ebp - 0xb0]
call fcn.10017a5d
cmp dword [eax], 0xfffffff8
jg 0x1002c0f4
mov dword [ebp - 0x184], 1
jmp 0x1002c0fb
and dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0xc8], eax
jl 0x1002c11e
mov dword [ebp - 0xf8], 1
jmp 0x1002c125
and dword [ebp - 0xf8], 0
push 0
lea ecx, [ebp - 0x80]
call fcn.10017a5d
push dword [eax]
lea ecx, [ebp - 0xb0]
call fcn.10017a5d
mov ecx, dword [ebp - 0xf8]
cmp ecx, dword [eax]
jg 0x1002c152
mov dword [ebp - 0xd0], 1
jmp 0x1002c159
and dword [ebp - 0xd0], 0
push 0
lea ecx, [ebp - 0x80]
call fcn.10017a5d
push dword [eax]
lea ecx, [ebp - 0xb0]
call fcn.10017a5d
mov ecx, dword [ebp - 0xd0]
cmp ecx, dword [eax]
jge 0x1002c186
mov dword [ebp - 0x110], 1
jmp 0x1002c18d
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xd8], eax
imul eax, dword [ebp - 0xd8], 9
cmp eax, dword [ebp - 0xe8]
jge 0x1002c1b4
mov dword [ebp - 0x100], 1
jmp 0x1002c1bb
and dword [ebp - 0x100], 0
push 0
lea ecx, [ebp - 0x80]
call fcn.10017a5d
push dword [eax]
lea ecx, [ebp - 0xb0]
call fcn.10017a5d
mov esi, dword [ebp - 0x100]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x80]
call fcn.10017a5d
push dword [eax]
lea ecx, [ebp - 0xb0]
call fcn.10017a5d
cmp esi, dword [eax]
je 0x1002c201
mov dword [ebp - 0x120], 1
jmp 0x1002c208
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x120], eax
jge 0x1002c222
mov dword [ebp - 0x1a8], 1
jmp 0x1002c229
and dword [ebp - 0x1a8], 0
push 0
lea ecx, [ebp - 0x80]
call fcn.10017a5d
push dword [eax]
lea ecx, [ebp - 0xb0]
call fcn.10017a5d
mov eax, dword [eax]
dec eax
cmp eax, dword [ebp - 0xe8]
jg 0x1002c257
mov dword [ebp - 0x108], 1
jmp 0x1002c25e
and dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x2a], 0
push 0x76b5
push 0x5f98
push 1
push 0
push 0x614c
lea eax, [ebp - 0x2a]
push eax
push 1
push 0x4298
push 0x3dc8
call fcn.10032a77
add esp, 0x24
jmp 0x1002c2a9
mov byte [ebp - 0x1e], 0
push 0
lea eax, [ebp - 0x1e]
push eax
call fcn.10033332
pop ecx
pop ecx
mov dword [ebp - 0x38], 0
jmp 0x1002c2b9
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jg 0x1002c2e7
mov dword [ebp - 0x18c], 0x61e33ecd
push 0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.1003183f
add esp, 0x10
jmp 0x1002c2b2
jmp 0x1002c04a
jmp 0x1002bf11
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x80]
call fcn.10017a38
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.10017a38
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x194]
add ecx, dword [eax]
mov dword [ebp - 0x170], ecx
push 1
lea ecx, [ebp - 0x20c]
call fcn.100179d6
mov dword [ebp - 4], 2
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x1c0], 1
lea eax, [ebp - 0x20c]
push eax
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.1002ab5f
add esp, 0xc
push 0x3907
push 1
lea eax, [ebp - 0x1c0]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
lea eax, [ebp - 0x19c]
push eax
call fcn.10028c36
add esp, 0x18
mov byte [ebp - 0x20], 0
movzx eax, byte [ebp - 0x20]
test eax, eax
je 0x1002c3ae
push 0x4587
push 0xf75
push 1
push 1
push 0x22c5
push 0x2e
call fcn.100292d5
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.10017a38
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
add eax, 8
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x14], 0x36951ad3
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x1c], 0x8dc509ca
mov dword [ebp - 0x84], 0
jmp 0x1002c3f6
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x1002c40f
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x60], 0xae9714a0
jmp 0x1002c3e9
mov dword [ebp - 0x14], 0
jmp 0x1002c41f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jg 0x1002c6f2
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x30], 0x2f7c629c
mov dword [ebp - 0x138], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x60], 0
jne 0x1002c45d
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x60], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp + ecx*4 - 0x60]
cmp dword [ebp + eax - 0x60], ecx
jl 0x1002c47c
mov dword [ebp - 0xb8], 1
jmp 0x1002c483
and dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x1c8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
cmp dword [ebp - 0x30], eax
jge 0x1002c4aa
mov dword [ebp - 0xbc], 1
jmp 0x1002c4b1
and dword [ebp - 0xbc], 0
mov dword [ebp - 0x64], 0xbf0ddd9c
mov eax, dword [ebp - 0xbc]
sub eax, dword [ebp - 0x30]
cmp dword [ebp - 0x64], eax
je 0x1002c4d2
mov dword [ebp - 0xc4], 1
jmp 0x1002c4d9
and dword [ebp - 0xc4], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfff7
jne 0x1002c4f7
mov dword [ebp - 0xcc], 1
jmp 0x1002c4fe
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xcc]
jl 0x1002c515
mov dword [ebp - 0x1a4], 1
jmp 0x1002c51c
and dword [ebp - 0x1a4], 0
cmp dword [ebp - 0x14], 0
jg 0x1002c52e
mov dword [ebp - 0xd4], 1
jmp 0x1002c535
and dword [ebp - 0xd4], 0
mov eax, dword [ebp - 0xd4]
add eax, 0xfff9
cmp eax, dword [ebp - 0x30]
jge 0x1002c551
mov dword [ebp - 0x12c], 1
jmp 0x1002c558
and dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x60]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x1c]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x60]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x60]
mov ecx, dword [ebp - 0x30]
add ecx, dword [ebp - 0x30]
add eax, ecx
je 0x1002c615
mov dword [ebp - 0x130], 0xe5fef407
mov eax, 0x59af
sub eax, dword [ebp - 0x64]
sub eax, dword [ebp - 0x28]
add eax, 0xf5fd
cmp dword [ebp - 0x130], eax
je 0x1002c5b6
mov dword [ebp - 0xdc], 1
jmp 0x1002c5bd
and dword [ebp - 0xdc], 0
cmp dword [ebp - 0xdc], 1
jbe 0x1002c5df
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x60], 0
je 0x1002c5df
mov dword [ebp - 0xe4], 1
jmp 0x1002c5e6
and dword [ebp - 0xe4], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0xe4], eax
jg 0x1002c600
mov dword [ebp - 0xec], 1
jmp 0x1002c607
and dword [ebp - 0xec], 0
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x64], eax
jmp 0x1002c6ed
mov dword [ebp - 0x140], 0x469f41af
push 1
push 0x6e77
push 0x1aad
push 1
lea eax, [ebp - 0x140]
push eax
call fcn.100293b9
add esp, 0x14
mov dword [ebp - 0x28], 1
jmp 0x1002c64c
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x1002c6ed
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x60], 0
je 0x1002c665
jmp 0x1002c6ed
mov dword [ebp - 0x1c], 1
jmp 0x1002c675
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x1002c6e8
mov dword [ebp - 0xf4], 1
mov dword [ebp - 0x74], 0
jmp 0x1002c695
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x1002c6ab
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x224], 3
jmp 0x1002c68e
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xb92a1dd6
je 0x1002c6cc
mov dword [ebp - 0xfc], 1
jmp 0x1002c6d3
and dword [ebp - 0xfc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xfc]
mov dword [ebp + eax - 0x224], ecx
jmp 0x1002c66e
jmp 0x1002c645
jmp 0x1002c418
mov dword [ebp - 0x1c], 0xffffffe2
jmp 0x1002c702
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffffe
jl 0x1002c72a
mov byte [ebp - 0x1f], 0
movzx eax, byte [ebp - 0x1f]
test eax, eax
je 0x1002c728
push 0x3f12
push 0x19e3
push 0
call fcn.10031c0b
add esp, 0xc
jmp 0x1002c6fb
and dword [ebp - 0xa4], 0
jmp 0x1002c748
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x68]
inc eax
inc eax
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
mov eax, dword [eax + 4]
sub eax, 8
shr eax, 1
cmp dword [ebp - 0xa4], eax
jae 0x1002ca71
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x150], 0x185a1fa1
mov dword [ebp - 0x23c], 0xf95751cf
mov dword [ebp - 0x214], 1
mov dword [ebp - 0x21c], 0x6f1860ec
push 2
lea ecx, [ebp - 0x238]
call fcn.100179d6
mov dword [ebp - 4], 3
mov dword [ebp - 0x158], 0x158fb5c4
mov dword [ebp - 0x18], 0
jmp 0x1002c7c1
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002c7dd
push dword [ebp - 0x18]
lea ecx, [ebp - 0x238]
call fcn.10017a5d
mov dword [eax], 0xfffffff9
jmp 0x1002c7ba
mov dword [ebp - 0x18], 0
jmp 0x1002c7ed
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1002c803
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x228], 0xffffffff
jmp 0x1002c7e6
cmp dword [ebp - 0x148], 0
je 0x1002c81c
xor eax, eax
je 0x1002c81c
mov dword [ebp - 0x104], 1
jmp 0x1002c823
and dword [ebp - 0x104], 0
push 3
pop eax
sub eax, dword [ebp - 0x104]
xor ecx, ecx
inc ecx
sub ecx, eax
sub ecx, 0x10000
mov dword [ebp - 0x150], ecx
push 0x3d21
push 1
lea eax, [ebp - 0x158]
push eax
push 0x1b34
push 0x17e9
push 1
call fcn.1002a434
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.10017a38
push 0
push 1
lea eax, [ebp - 0x68]
push eax
push 1
push 0x7637
lea eax, [ebp - 0x160]
push eax
push 0x7b67
call fcn.10033358
add esp, 0x1c
push 4
lea ecx, [ebp - 0x200]
call fcn.100179d6
mov dword [ebp - 4], 4
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x88], 0
jmp 0x1002c8c8
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 4
jge 0x1002c8e7
push dword [ebp - 0x88]
lea ecx, [ebp - 0x200]
call fcn.10017a5d
or dword [eax], 0xffffffff
jmp 0x1002c8bb
mov dword [ebp - 0x90], 3
jmp 0x1002c900
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x1002ca09
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x3c], 0
jmp 0x1002c92b
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jg 0x1002ca04
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x200]
call fcn.10017a5d
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 0x15
jmp 0x1002c958
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x16
jg 0x1002c9ff
mov dword [ebp - 0x8c], 4
mov dword [ebp - 0x8c], 0
jmp 0x1002c985
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jg 0x1002c9de
mov dword [ebp - 0x50], 0
cmp dword [ebp - 0x50], 0
je 0x1002c99d
jmp 0x1002c9de
mov dword [ebp - 0x50], 0
jmp 0x1002c9ad
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jg 0x1002c9dc
mov byte [ebp - 0x1d], 0
movzx eax, byte [ebp - 0x1d]
test eax, eax
je 0x1002c9da
push 0x1211
push 0x3c31
push 1
push 0
push 0x7bb8
call fcn.1002a7c8
add esp, 0x14
jmp 0x1002c9a6
jmp 0x1002c978
mov byte [ebp - 0x21], 0
lea eax, [ebp - 0x21]
push eax
push 0xef7
push 0
push 0x344f
call fcn.1003273f
add esp, 0x10
jmp 0x1002c951
jmp 0x1002c924
jmp 0x1002c8f3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x200]
call fcn.10017a38
mov eax, dword [ebp - 0x68]
movzx eax, word [eax]
and eax, 0xfff
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 3
je 0x1002ca42
jmp 0x1002ca6c
mov eax, dword [ebp - 0x170]
add eax, dword [ebp - 0x178]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x180]
add eax, dword [ecx]
mov ecx, dword [ebp - 0xb4]
mov dword [ecx], eax
jmp 0x1002c733
mov dword [ebp - 0x188], 0xc5a654fd
mov dword [ebp - 0x70], 0
jmp 0x1002ca8b
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1002caa1
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x1f4], 0x1f2c
jmp 0x1002ca84
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f4]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x1f4]
mov dword [ebp - 0x188], eax
push 0x21ef
push 0
call fcn.100339cb
pop ecx
pop ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ecx]
add ecx, dword [eax + 4]
mov eax, dword [ebp - 0x34]
mov dword [eax], ecx
jmp 0x1002cb0e
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x1a0], eax
push 0
mov ecx, dword [ebp - 0x1a0]
call fcn.10017a5d
mov dword [eax], 0x69aed23b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret