Function at 0x1002b947
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10084719
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c4
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1002b9cf
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x40]
mov dword [eax], 0
jmp 0x1002b9aa
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x40]
mov dword [ecx], eax
mov eax, dword [ebp - 0x40]
cmp dword [eax], 2
jge 0x1002b9ca
mov eax, dword [ebp - 0x40]
push dword [eax]
mov ecx, dword [ebp - 0x1ac]
call fcn.100265d2
mov dword [eax], 0xfffffffc
jmp 0x1002b99f
jmp 0x1002caf9
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1b8], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 6
mov dword [ebp - 0x60], 0xd1454bcd
mov dword [ebp - 0x284], 0xba832a49
mov dword [ebp - 0x264], 0x1501494d
mov dword [ebp - 0x26c], 0xa1dd6b9e
mov dword [ebp - 0x20c], 1
mov dword [ebp - 0x1f4], 0xfffffff8
mov dword [ebp - 0x38], 0xffffffee
jmp 0x1002ba37
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x1a
jne 0x1002bc53
mov dword [ebp - 0xa0], 0xf81320f2
mov dword [ebp - 0x20], 0
jmp 0x1002ba5b
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1002ba6e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x48], 0x51ad
jmp 0x1002ba54
mov dword [ebp - 0x20], 0
jmp 0x1002ba7e
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002ba91
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x68], 5
jmp 0x1002ba77
mov byte [ebp - 0x24], 0
push 1
lea eax, [ebp - 0x24]
push eax
push 0x7066
call fcn.1002b597
add esp, 0xc
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x68], 0
jmp 0x1002bacd
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x68]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x68], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x68], 0
jl 0x1002bc4e
mov dword [ebp - 0x74], 0
jmp 0x1002baee
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x1002bb04
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x278], 0xe5ec3521
jmp 0x1002bae7
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x68]
mov eax, dword [ebp + eax*4 - 0x48]
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x60], 0xfffb
cmp dword [ebp - 0x60], 0
je 0x1002bbe6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x68]
mov eax, dword [ebp + eax*4 - 0x48]
mov dword [ebp - 0x298], eax
or eax, 0xffffffff
jne 0x1002bbb1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x68]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x68]
mov ecx, dword [ebp + ecx*4 - 0x48]
cmp dword [ebp + eax*4 - 0x48], ecx
jle 0x1002bb6c
mov dword [ebp - 0x10c], 1
jmp 0x1002bb73
and dword [ebp - 0x10c], 0
cmp dword [ebp - 0x10c], 0x445acee6
jle 0x1002bb8b
mov dword [ebp - 0x18c], 1
jmp 0x1002bb92
and dword [ebp - 0x18c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x68]
mov ecx, dword [ebp - 0x18c]
sub ecx, dword [ebp + eax*4 - 0x48]
jne 0x1002bbb1
and dword [ebp - 0x218], 0
jmp 0x1002bbbb
mov dword [ebp - 0x218], 1
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x60]
sub eax, 0xc4dd
jne 0x1002bbda
cmp dword [ebp - 0xa0], 0
je 0x1002bbe6
mov dword [ebp - 0x184], 1
jmp 0x1002bbed
and dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x184]
cmp eax, dword [ebp - 0x38]
jne 0x1002bc07
mov dword [ebp - 0x98], 1
jmp 0x1002bc0e
and dword [ebp - 0x98], 0
cmp dword [ebp - 0x98], 0x75ff4442
jne 0x1002bc2c
mov eax, 0xc7128abf
test eax, eax
jne 0x1002bc2c
and dword [ebp - 0x9c], 0
jmp 0x1002bc36
mov dword [ebp - 0x9c], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x9c]
mov dword [ebp + eax - 0x278], ecx
jmp 0x1002bab8
jmp 0x1002ba30
xor eax, eax
inc eax
je 0x1002bc6d
cmp dword [ebp - 0x20c], 0
je 0x1002bc6d
mov dword [ebp - 0x118], 1
jmp 0x1002bc74
and dword [ebp - 0x118], 0
cmp dword [ebp - 0x118], 0
jl 0x1002bc89
mov dword [ebp - 0xa8], 1
jmp 0x1002bc90
and dword [ebp - 0xa8], 0
cmp dword [ebp - 0xa8], 9
je 0x1002bcab
cmp dword [ebp - 0x60], 0
je 0x1002bcab
mov dword [ebp - 0x170], 1
jmp 0x1002bcb2
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1b8]
add ecx, dword [eax]
mov dword [ebp - 0x1b4], ecx
mov dword [ebp - 0x1f0], 0x387f
mov dword [ebp - 0x2a8], 1
push 3
lea ecx, [ebp - 0x2b8]
call fcn.10026565
and dword [ebp - 4], 0
mov dword [ebp - 0x23c], 0xef5d
mov dword [ebp - 0x1c0], 0xc54c9751
lea eax, [ebp - 0x280]
push eax
push 0
lea eax, [ebp - 0x2b8]
push eax
call fcn.1002d4af
add esp, 0xc
mov byte [ebp - 0x21], 0
push 0
push 0x4ff9
lea eax, [ebp - 0x21]
push eax
call fcn.100308eb
add esp, 0xc
cmp dword [ebp - 0x1f0], 0
je 0x1002bdab
mov dword [ebp - 0x248], 0xffffffff
mov dword [ebp - 0x288], 0xedf0ebf9
mov dword [ebp - 0xb0], 0x215169ff
mov dword [ebp - 0x5c], 0
jmp 0x1002bd70
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x1002bd86
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x2c0], 0x4768c0aa
jmp 0x1002bd69
push 0x17ba
push 1
lea eax, [ebp - 0x1c0]
push eax
call fcn.1002b5f4
add esp, 0xc
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
jmp 0x1002bdbc
mov byte [ebp - 0x31], 0
push 1
lea eax, [ebp - 0x31]
push eax
call fcn.1002b65d
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2b8]
call fcn.100265cd
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
add eax, 8
mov dword [ebp - 0x54], eax
push 4
lea ecx, [ebp - 0x84]
call fcn.10026565
mov dword [ebp - 4], 1
mov dword [ebp - 0x44], 3
mov dword [ebp - 0xe0], 0x19d87263
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x1f8], 0
lea eax, [ebp - 0x84]
push eax
push 1
push 0x411a
lea eax, [ebp - 0x250]
push eax
call fcn.1002b6dd
add esp, 0x10
mov byte [ebp - 0x29], 0
push 0x6872
push 1
lea eax, [ebp - 0x29]
push eax
call fcn.1002b75f
add esp, 0xc
push 2
lea ecx, [ebp - 0x84]
call fcn.100265d2
and dword [eax], 0
jmp 0x1002be79
push 2
lea ecx, [ebp - 0x84]
call fcn.100265d2
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x120]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x84]
call fcn.100265d2
cmp dword [eax], 4
jl 0x1002c0f0
mov dword [ebp - 0x28], 0x974a
mov dword [ebp - 0x138], 0x8394
mov eax, 0xffff
test eax, eax
je 0x1002becc
push 2
lea ecx, [ebp - 0x84]
call fcn.100265d2
imul eax, dword [eax], 0xfff7
test eax, eax
je 0x1002becc
mov dword [ebp - 0xc0], 1
jmp 0x1002bed3
and dword [ebp - 0xc0], 0
push 2
lea ecx, [ebp - 0x84]
call fcn.100265d2
push 0
lea ecx, [ebp - 0x84]
call fcn.100265d2
mov ecx, dword [ebp - 0x28]
cmp dword [eax], ecx
jge 0x1002bf00
mov dword [ebp - 0xb8], 1
jmp 0x1002bf07
and dword [ebp - 0xb8], 0
cmp dword [ebp - 0xb8], 2
jb 0x1002bf34
cmp dword [ebp - 0x28], 0
je 0x1002bf34
push 2
lea ecx, [ebp - 0x84]
call fcn.100265d2
cmp dword [eax], 0
je 0x1002bf34
mov dword [ebp - 0x158], 1
jmp 0x1002bf3b
and dword [ebp - 0x158], 0
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x28]
test eax, eax
je 0x1002bf61
cmp dword [ebp - 0x28], 0
je 0x1002bf61
mov dword [ebp - 0x128], 1
jmp 0x1002bf68
and dword [ebp - 0x128], 0
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0x128]
je 0x1002bfb4
push 0x4302
push 0
lea eax, [ebp - 0x44]
push eax
call fcn.1002d51b
add esp, 0xc
mov byte [ebp - 0x22], 0
movzx eax, byte [ebp - 0x22]
test eax, eax
je 0x1002bfb2
push 0
push 0
push 0
push 0
push 0x95e
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x1002bfc5
mov byte [ebp - 0x23], 0
lea eax, [ebp - 0x23]
push eax
push 0
call fcn.1002f8a1
pop ecx
pop ecx
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
je 0x1002bfd9
mov dword [ebp - 0xd8], 1
jmp 0x1002bfe0
and dword [ebp - 0xd8], 0
imul eax, dword [ebp - 0x28], 0xfffffffd
add eax, 3
mov dword [ebp - 0x44], eax
jne 0x1002bff8
mov dword [ebp - 0xc8], 1
jmp 0x1002bfff
and dword [ebp - 0xc8], 0
cmp dword [ebp - 0xc8], 0x94ccb090
je 0x1002c017
mov dword [ebp - 0x180], 1
jmp 0x1002c01e
and dword [ebp - 0x180], 0
cmp dword [ebp - 0x180], 0xffffffff
jge 0x1002c033
mov dword [ebp - 0xd0], 1
jmp 0x1002c03a
and dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0xe0]
imul eax, dword [ebp - 0xd0]
cmp eax, 0x30bc
jne 0x1002c05a
mov dword [ebp - 0x130], 1
jmp 0x1002c061
and dword [ebp - 0x130], 0
push 0
lea ecx, [ebp - 0x84]
call fcn.100265d2
mov ecx, dword [ebp - 0x130]
sub ecx, dword [eax]
cmp dword [ebp - 0xd8], ecx
jg 0x1002c08a
mov dword [ebp - 0x160], 1
jmp 0x1002c091
and dword [ebp - 0x160], 0
push 2
lea ecx, [ebp - 0x84]
call fcn.100265d2
mov ecx, dword [ebp - 0x160]
imul ecx, dword [eax]
test ecx, ecx
jne 0x1002c0bd
cmp dword [ebp - 0x21c], 0
jne 0x1002c0bd
and dword [ebp - 0x1c8], 0
jmp 0x1002c0c7
mov dword [ebp - 0x1c8], 1
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x1f8], eax
jmp 0x1002be55
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
call fcn.100265cd
and dword [ebp - 0x78], 0
jmp 0x1002c114
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x54]
inc eax
inc eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov eax, dword [eax + 4]
sub eax, 8
shr eax, 1
cmp dword [ebp - 0x78], eax
jae 0x1002c9e0
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x1a8], 0xf11b
mov dword [ebp - 0x1a4], 0xf11b
mov dword [ebp - 0x1a0], 0xf11b
mov dword [ebp - 0x19c], 0xf11b
mov dword [ebp - 0x88], 0
mov dword [ebp - 0xdc], 1
mov dword [ebp - 0x214], 0x51f4
mov dword [ebp - 0x1d8], 0xc2e3
mov dword [ebp - 0x10], 0
jmp 0x1002c198
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x1002c1ae
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x208], 1
jmp 0x1002c191
mov dword [ebp - 0x10], 0
jmp 0x1002c1be
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002c1d4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2d0], 0x7384c7b
jmp 0x1002c1b7
mov dword [ebp - 0x10], 0
jmp 0x1002c1e4
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1002c1fa
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1e0], 0xdd146f1
jmp 0x1002c1dd
mov dword [ebp - 0x18], 0xd
jmp 0x1002c20a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x11
jne 0x1002c46b
mov dword [ebp - 0x14], 0x4a0d
mov dword [ebp - 0x8c], 1
mov dword [ebp - 0x108], 0xfffffff7
mov dword [ebp - 0x188], 0xfffffff9
mov eax, 0xebfb2c41
sub eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1a8]
cmp dword [ebp - 0x1c], eax
jge 0x1002c265
mov dword [ebp - 0xe8], 1
jmp 0x1002c26c
and dword [ebp - 0xe8], 0
cmp dword [ebp - 0xe8], 0xc1dfe936
jbe 0x1002c284
mov dword [ebp - 0x1d0], 1
jmp 0x1002c28b
and dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x14], eax
jle 0x1002c2b1
mov dword [ebp - 0x178], 1
jmp 0x1002c2b8
and dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x178]
sub eax, dword [ebp - 0x14]
cmp eax, 0x51c3
jne 0x1002c2d4
mov dword [ebp - 0xf0], 1
jmp 0x1002c2db
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xf0], eax
jg 0x1002c2f2
mov dword [ebp - 0x140], 1
jmp 0x1002c2f9
and dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x140]
jle 0x1002c310
mov dword [ebp - 0xf8], 1
jmp 0x1002c317
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0xf8]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jg 0x1002c331
mov dword [ebp - 0x168], 1
jmp 0x1002c338
and dword [ebp - 0x168], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x168]
jg 0x1002c34f
mov dword [ebp - 0x100], 1
jmp 0x1002c356
and dword [ebp - 0x100], 0
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x14], 0xffffffff
jae 0x1002c37d
mov dword [ebp - 0x148], 1
jmp 0x1002c384
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x268], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x14], 0xd2c298c2
jb 0x1002c3c6
mov dword [ebp - 0x110], 1
jmp 0x1002c3cd
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x110], eax
jl 0x1002c3e7
mov dword [ebp - 0x150], 1
jmp 0x1002c3ee
and dword [ebp - 0x150], 0
cmp dword [ebp - 0x150], 0x5bb5fb49
jl 0x1002c406
mov dword [ebp - 0x94], 1
jmp 0x1002c40d
and dword [ebp - 0x94], 0
cmp dword [ebp - 0x94], 0xc1b09c82
jne 0x1002c425
mov dword [ebp - 0xa4], 1
jmp 0x1002c42c
and dword [ebp - 0xa4], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x1c], eax
imul eax, dword [ebp - 0x1c], 0x95
sub eax, dword [ebp - 0xa4]
cmp eax, 1
jne 0x1002c453
mov dword [ebp - 0xac], 1
jmp 0x1002c45a
and dword [ebp - 0xac], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x88], eax
jmp 0x1002c203
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1a8]
mov dword [ebp - 0x270], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a8], 0xfffffff7
jle 0x1002c494
cmp dword [ebp - 0x1c], 0
jne 0x1002c49d
mov eax, 0x10f
test eax, eax
je 0x1002c4b8
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1a8], 0
je 0x1002c4b8
mov dword [ebp - 0xb4], 1
jmp 0x1002c4bf
and dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0xb4], eax
jg 0x1002c4d9
mov dword [ebp - 0xbc], 1
jmp 0x1002c4e0
and dword [ebp - 0xbc], 0
cmp dword [ebp - 0xbc], 0xfffffffb
jne 0x1002c4f5
mov dword [ebp - 0xc4], 1
jmp 0x1002c4fc
and dword [ebp - 0xc4], 0
cmp dword [ebp - 0xc4], 0xffffffff
jle 0x1002c511
mov dword [ebp - 0xcc], 1
jmp 0x1002c518
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0xcc]
add eax, 0x13599695
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0x18], 0
jne 0x1002c541
cmp dword [ebp - 0x88], 0
jne 0x1002c541
and dword [ebp - 0xd4], 0
jmp 0x1002c54b
mov dword [ebp - 0xd4], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd4]
mov dword [ebp + eax - 0x208], ecx
mov eax, 0xbb1d
sub eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xdc]
add ecx, dword [ebp - 0x214]
cmp eax, ecx
jge 0x1002c582
mov dword [ebp - 0xe4], 1
jmp 0x1002c589
and dword [ebp - 0xe4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a8]
cmp dword [ebp - 0xe4], eax
jle 0x1002c698
mov dword [ebp - 0x6c], 0x7dfd
mov dword [ebp - 0x104], 0x9fb14be5
mov dword [ebp - 0x200], 0xfffffffd
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2a4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x208]
cmp dword [ebp - 0x18], eax
jg 0x1002c5e4
mov dword [ebp - 0xf4], 1
jmp 0x1002c5eb
and dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x6c], 0xffffffff
jg 0x1002c61b
mov dword [ebp - 0xec], 1
jmp 0x1002c622
and dword [ebp - 0xec], 0
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xf4]
sub eax, dword [ebp - 0x1c]
jne 0x1002c646
push 0xfffffffffffffff8
pop eax
test eax, eax
jne 0x1002c646
and dword [ebp - 0xfc], 0
jmp 0x1002c650
mov dword [ebp - 0xfc], 1
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jne 0x1002c67d
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2d0], 0
jne 0x1002c67d
and dword [ebp - 0x90], 0
jmp 0x1002c687
mov dword [ebp - 0x90], 1
mov eax, dword [ebp - 0x90]
sub eax, dword [ebp - 0x6c]
mov dword [ebp - 0x200], eax
jmp 0x1002c6c3
mov byte [ebp - 0x32], 0
push 0
lea eax, [ebp - 0x32]
push eax
call fcn.1002d5da
pop ecx
pop ecx
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0x208]
mov dword [ebp + ecx - 0x1e0], eax
push 1
lea ecx, [ebp - 0x228]
call fcn.10026565
mov dword [ebp - 4], 2
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x13c], 7
mov dword [ebp - 0x164], 0x74643a64
mov dword [ebp - 0x50], 0
jmp 0x1002c702
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x1002c71e
push dword [ebp - 0x50]
lea ecx, [ebp - 0x228]
call fcn.100265d2
mov dword [eax], 0x22124f84
jmp 0x1002c6fb
push 0x6bba
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x228]
push eax
push 1
push 0xe31
call fcn.1002b7a6
add esp, 0x14
mov dword [ebp - 0x30], 0x15
jmp 0x1002c74d
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffff8
je 0x1002c969
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x22c], 0x9ab
mov dword [ebp - 0x70], 0
jmp 0x1002c778
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1002c78e
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x14c], 0x17c0
jmp 0x1002c771
mov dword [ebp - 0x4c], 9
jmp 0x1002c79e
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 8
jle 0x1002c964
push 3
lea ecx, [ebp - 0x238]
call fcn.10026565
mov byte [ebp - 4], 3
mov dword [ebp - 0x114], 0xfffffff8
mov dword [ebp - 0x16c], 1
lea eax, [ebp - 0x238]
push eax
push 1
push 0x4d26
lea eax, [ebp - 0x24c]
push eax
push 0x41a1
call fcn.1002b89d
add esp, 0x14
push 0
lea ecx, [ebp - 0x238]
call fcn.100265d2
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x4c], 0
jae 0x1002c81a
mov dword [ebp - 0x134], 1
jmp 0x1002c821
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x11c], eax
push 0
lea ecx, [ebp - 0x228]
call fcn.100265d2
mov ecx, dword [ebp - 0x11c]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14c]
cmp dword [ebp - 0x11c], eax
je 0x1002c863
mov dword [ebp - 0x124], 1
jmp 0x1002c86a
and dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x22c]
cmp dword [ebp - 0x124], eax
jl 0x1002c884
mov dword [ebp - 0x12c], 1
jmp 0x1002c88b
and dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x134]
sub eax, dword [ebp - 0x13c]
je 0x1002c8ac
cmp dword [ebp - 0x16c], 0
push 0
lea ecx, [ebp - 0x228]
call fcn.100265d2
mov eax, dword [eax]
neg eax
sub eax, 0xffff
cmp eax, 2
jbe 0x1002c8d3
mov dword [ebp - 0x144], 1
jmp 0x1002c8da
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x144]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x14c]
jle 0x1002c8fe
mov dword [ebp - 0x154], 1
jmp 0x1002c905
and dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x154], eax
jl 0x1002c91c
mov dword [ebp - 0x15c], 1
jmp 0x1002c923
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x25c], eax
push 0
lea ecx, [ebp - 0x238]
call fcn.100265d2
mov eax, dword [eax]
mov dword [ebp - 0x16c], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x238]
call fcn.100265cd
jmp 0x1002c797
jmp 0x1002c746
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.100265cd
mov eax, dword [ebp - 0x54]
movzx eax, word [eax]
sar eax, 0xc
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x54]
movzx eax, word [eax]
and eax, 0xfff
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 3
je 0x1002c9b1
jmp 0x1002c9db
mov eax, dword [ebp - 0x1b4]
add eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c4]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x174]
mov dword [ecx], eax
jmp 0x1002c105
push 1
lea ecx, [ebp - 0x198]
call fcn.10026565
mov dword [ebp - 4], 4
mov dword [ebp - 0x1cc], 0x90f02349
mov dword [ebp - 0x58], 0
jmp 0x1002ca0e
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1002ca2a
push dword [ebp - 0x58]
lea ecx, [ebp - 0x198]
call fcn.100265d2
mov dword [eax], 0xd3df75dc
jmp 0x1002ca07
push 0
lea ecx, [ebp - 0x198]
call fcn.100265d2
and dword [eax], 0
jmp 0x1002ca60
push 0
lea ecx, [ebp - 0x198]
call fcn.100265d2
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x17c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x198]
call fcn.100265d2
cmp dword [eax], 0xffffffe3
jle 0x1002cad8
mov dword [ebp - 0x1ec], 0xedac
mov dword [ebp - 0x1d4], 0xffffffff
mov dword [ebp - 0x1e4], 1
mov dword [ebp - 0x1dc], 0x89ced66e
push 0x2174
lea eax, [ebp - 0x1cc]
push eax
lea eax, [ebp - 0x1d4]
push eax
lea eax, [ebp - 0x1dc]
push eax
push 0
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x1ec]
push eax
call fcn.1002f089
add esp, 0x20
jmp 0x1002ca3c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x198]
call fcn.100265cd
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ecx]
add ecx, dword [eax + 4]
mov eax, dword [ebp - 0x3c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret