Function at 0x10039023
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006c842
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1258
call fcn.10067050
push esi
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1004144f
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xbc8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xbd8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xa18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xb94], eax
mov eax, dword [ebp - 0xa18]
movzx eax, byte [eax]
test eax, eax
je 0x100390fe
mov eax, dword [ebp - 0xb84]
mov dword [ebp - 0xb9c], eax
mov eax, dword [ebp - 0xb8c]
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0xb94]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xb9c]
mov dword [ebp - 0x694], eax
mov eax, dword [ebp - 0xba4]
mov dword [ebp - 0x1190], eax
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xe90], eax
mov eax, dword [ebp - 0x694]
xor ecx, ecx
inc ecx
sub ecx, dword [eax]
mov eax, dword [ebp - 0x694]
mov dword [eax], ecx
jmp 0x1004144d
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0xb54], eax
mov eax, dword [ebp - 0xbd0]
mov dword [ebp - 0x9fc], eax
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x14], 0xffffffff
push 1
lea ecx, [ebp - 0x92c]
call fcn.1001803e
and dword [ebp - 4], 0
mov dword [ebp - 0xbf8], 2
mov dword [ebp - 0x680], 0xefbae54f
mov dword [ebp - 0x3d8], 0x834d56b8
push 2
lea ecx, [ebp - 0xc68]
call fcn.1001803e
mov byte [ebp - 4], 1
push 3
lea ecx, [ebp - 0x958]
call fcn.1001803e
mov byte [ebp - 4], 2
mov dword [ebp - 0xd54], 0xcde8
mov dword [ebp - 0xd50], 0xcde8
mov dword [ebp - 0xd4c], 0xcde8
mov dword [ebp - 0xd48], 0xcde8
lea ecx, [ebp - 0x37d]
call fcn.1001818e
push eax
lea eax, [ebp - 0xd44]
push eax
lea eax, [ebp - 0xd54]
push eax
lea ecx, [ebp - 0x11c8]
call fcn.10018191
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x119c]
call fcn.1001807a
mov byte [ebp - 4], 3
mov dword [ebp - 0xc28], 0xb85ae340
push 0x54da
push 0
push 0x378b
lea eax, [ebp - 0x92c]
push eax
push 0x1edf
push 0x7925
push 0x770
lea eax, [ebp - 0x13c]
push eax
push 0
call fcn.1004523e
add esp, 0x24
mov dword [ebp - 0x13c], 0
jmp 0x10039231
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 2
jge 0x10039253
push dword [ebp - 0x13c]
lea ecx, [ebp - 0xc68]
call fcn.10018124
mov dword [eax], 0xab72231b
jmp 0x10039224
push 0
lea eax, [ebp - 0x958]
push eax
push 0x2cee
push 0x692c
push 0x3117
push 1
lea eax, [ebp - 0x13c]
push eax
push 0x1930
push 0x2b58
push 0x76b8
push 0x7df0
push 0x75f1
push 0x5bdd
push 0x388d
push 0x6475
call fcn.10036af7
add esp, 0x3c
cmp dword [ebp - 0x14], 0xf2d
jl 0x100392b9
mov dword [ebp - 0x8bc], 1
jmp 0x100392c0
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x8bc], eax
jg 0x100392dd
mov eax, 0x2f7c629c
test eax, eax
jne 0x100392dd
and dword [ebp - 0x8c4], 0
jmp 0x100392e7
mov dword [ebp - 0x8c4], 1
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x8c4]
sub eax, dword [ebp - 0x14]
cmp eax, 0x29a2
je 0x10039307
mov dword [ebp - 0xbe0], 1
jmp 0x1003930e
and dword [ebp - 0xbe0], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xe98], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xea0], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xea8], eax
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jne 0x10039341
mov dword [ebp - 0x8e4], 1
jmp 0x10039348
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x8e4], eax
jle 0x1003935f
mov dword [ebp - 0x8ec], 1
jmp 0x10039366
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x8ec]
jne 0x1003937d
mov dword [ebp - 0x8f4], 1
jmp 0x10039384
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x8f4], eax
jl 0x1003939b
mov dword [ebp - 0x8fc], 1
jmp 0x100393a2
and dword [ebp - 0x8fc], 0
push 0
lea ecx, [ebp - 0x92c]
call fcn.10018124
mov ecx, dword [ebp - 0x8fc]
cmp ecx, dword [eax]
jle 0x100393c5
mov dword [ebp - 0x904], 1
jmp 0x100393cc
and dword [ebp - 0x904], 0
cmp dword [ebp - 0x904], 0
je 0x100393e1
mov dword [ebp - 0x90c], 1
jmp 0x100393e8
and dword [ebp - 0x90c], 0
cmp dword [ebp - 0x90c], 0xfffffffa
jl 0x10039406
mov eax, 0x7258
test eax, eax
je 0x10039406
mov dword [ebp - 0xbe8], 1
jmp 0x1003940d
and dword [ebp - 0xbe8], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xeb0], eax
push 0
lea ecx, [ebp - 0x92c]
call fcn.10018124
cmp dword [eax], 0xfffffffa
jae 0x10039434
mov dword [ebp - 0xbf0], 1
jmp 0x1003943b
and dword [ebp - 0xbf0], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xeb8], eax
push 0
lea ecx, [ebp - 0x92c]
call fcn.10018124
cmp dword [eax], 0
je 0x10039492
mov byte [ebp - 0x136], 0
movzx eax, byte [ebp - 0x136]
test eax, eax
je 0x1003948d
push 0
push 0x4fa7
push 0x2c5b
push 0x4e61
push 0x2465
push 1
push 0x37e3
call fcn.10036864
add esp, 0x1c
jmp 0x10039717
mov dword [ebp - 0xc08], 0xfffffff9
push 3
lea ecx, [ebp - 0xda4]
call fcn.1001803e
mov byte [ebp - 4], 4
mov dword [ebp - 0xc00], 0xde002748
mov dword [ebp - 0xd2c], 9
mov dword [ebp - 0xd28], 9
mov dword [ebp - 0xd24], 9
mov dword [ebp - 0xd20], 9
lea ecx, [ebp - 0x2f9]
call fcn.1001818e
push eax
lea eax, [ebp - 0xd1c]
push eax
lea eax, [ebp - 0xd2c]
push eax
lea ecx, [ebp - 0x1230]
call fcn.10018191
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xdbc]
call fcn.1001807a
mov byte [ebp - 4], 5
push 1
lea ecx, [ebp - 0xc50]
call fcn.1001803e
mov byte [ebp - 4], 6
push 1
push 0x1a5f
lea eax, [ebp - 0x188]
push eax
push 0x3628
push 0
push 0x6f67
lea eax, [ebp - 0xda4]
push eax
push 0x5dd8
push 0x1845
call fcn.100427da
add esp, 0x24
mov dword [ebp - 0x188], 0
jmp 0x10039575
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 1
jge 0x10039597
push dword [ebp - 0x188]
lea ecx, [ebp - 0xc50]
call fcn.10018124
mov dword [eax], 0x84a8a623
jmp 0x10039568
push 0x2b86
push 0x6e22
lea eax, [ebp - 0x92c]
push eax
lea eax, [ebp - 0x680]
push eax
lea eax, [ebp - 0xbf8]
push eax
lea eax, [ebp - 0x958]
push eax
push 0x38b4
lea eax, [ebp - 0xda4]
push eax
push 0x5550
lea eax, [ebp - 0x3d8]
push eax
push 1
push 0x1cfc
push 0x5330
push 0x7d1a
lea eax, [ebp - 0xc50]
push eax
push 0x5045
lea eax, [ebp - 0xc68]
push eax
lea eax, [ebp - 0xdbc]
push eax
push 0
push 0x7b8a
lea eax, [ebp - 0x14]
push eax
push 0x4d82
push 0
push 0x2115
lea eax, [ebp - 0xc00]
push eax
lea eax, [ebp - 0xc08]
push eax
call fcn.10035a65
add esp, 0x68
push 0
lea ecx, [ebp - 0xc50]
call fcn.10018124
mov eax, 0xad93
test eax, eax
jne 0x10039679
xor eax, eax
inc eax
je 0x1003965d
cmp dword [ebp - 0xc28], 0
je 0x1003965d
mov dword [ebp - 0x914], 1
jmp 0x10039664
and dword [ebp - 0x914], 0
cmp dword [ebp - 0x914], 0x7f7f
jg 0x10039679
and dword [ebp - 0x910], 0
jmp 0x10039683
mov dword [ebp - 0x910], 1
push 3
lea ecx, [ebp - 0xdbc]
call fcn.10018124
mov ecx, dword [ebp - 0x910]
add ecx, dword [eax]
cmp ecx, 0x405ea325
jl 0x100396ac
mov dword [ebp - 0x8b4], 1
jmp 0x100396b3
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0x8b4]
neg eax
cmp eax, 0x8337
jl 0x100396ce
mov dword [ebp - 0x3d0], 1
jmp 0x100396d5
and dword [ebp - 0x3d0], 0
push 0
lea ecx, [ebp - 0xc50]
call fcn.10018124
mov ecx, dword [ebp - 0x3d0]
mov dword [eax], ecx
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xc50]
call fcn.100180a0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xdbc]
call fcn.100180a0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xda4]
call fcn.100180a0
mov eax, dword [ebp - 0x680]
mov dword [ebp - 0xec0], eax
push 2
lea ecx, [ebp - 0x958]
call fcn.10018124
push 1
lea ecx, [ebp - 0x958]
call fcn.10018124
push 1
lea ecx, [ebp - 0x958]
call fcn.10018124
cmp dword [eax], 0
je 0x10039772
mov esi, dword [ebp - 0x3d8]
push 0
lea ecx, [ebp - 0xc68]
call fcn.10018124
add esi, dword [eax]
je 0x10039772
mov dword [ebp - 0x7d8], 1
jmp 0x10039779
and dword [ebp - 0x7d8], 0
push 0
lea ecx, [ebp - 0x92c]
call fcn.10018124
mov ecx, dword [ebp - 0x7d8]
cmp ecx, dword [eax]
jg 0x1003979c
mov dword [ebp - 0x3e0], 1
jmp 0x100397a3
and dword [ebp - 0x3e0], 0
push 0
lea ecx, [ebp - 0xc68]
call fcn.10018124
mov ecx, dword [ebp - 0x3e0]
mov dword [eax], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x119c]
call fcn.100180a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x958]
call fcn.100180a0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc68]
call fcn.100180a0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x92c]
call fcn.100180a0
mov eax, dword [ebp - 0x2a4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x874], eax
mov dword [ebp - 0xd0], 0xcd5
mov dword [ebp - 0x180], 0xfffffff7
mov dword [ebp - 0x8c], 0x80c6548a
mov dword [ebp - 0x98], 4
mov dword [ebp - 0x27c], 0x64e785c2
mov dword [ebp - 0xec8], 0x9a78915c
imul eax, dword [ebp - 0xd0], 0xffff
mov ecx, 0xffff
sub ecx, eax
cmp ecx, dword [ebp - 0xd0]
jl 0x10039864
mov dword [ebp - 0x688], 1
jmp 0x1003986b
and dword [ebp - 0x688], 0
cmp dword [ebp - 0x688], 6
jge 0x10039880
mov dword [ebp - 0x3e8], 1
jmp 0x10039887
and dword [ebp - 0x3e8], 0
mov dword [ebp - 0x180], 0xffffffff
imul eax, dword [ebp - 0x3e8], 0xfffd
cmp dword [ebp - 0x180], eax
jle 0x100398af
mov dword [ebp - 0x880], 1
jmp 0x100398b6
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x880], eax
jg 0x100398d0
mov dword [ebp - 0x3f0], 1
jmp 0x100398d7
and dword [ebp - 0x3f0], 0
cmp dword [ebp - 0x3f0], 0
je 0x100398f5
cmp dword [ebp - 0x8c], 0
je 0x100398f5
mov dword [ebp - 0xc30], 1
jmp 0x100398fc
and dword [ebp - 0xc30], 0
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xf48], eax
cmp dword [ebp - 0x8c], 0
jne 0x10039923
cmp dword [ebp - 0x8c], 0
jne 0x10039923
and dword [ebp - 0x690], 0
jmp 0x1003992d
mov dword [ebp - 0x690], 1
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x690]
cmp dword [ebp - 0xd0], eax
je 0x1003994d
mov dword [ebp - 0x3f8], 1
jmp 0x10039954
and dword [ebp - 0x3f8], 0
cmp dword [ebp - 0x3f8], 0xe857
jne 0x10039970
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x10039970
and dword [ebp - 0x7e0], 0
jmp 0x1003997a
mov dword [ebp - 0x7e0], 1
imul eax, dword [ebp - 0x7e0], 7
sub eax, 0xd50c
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0xd0]
add eax, dword [ebp - 0x180]
cmp dword [ebp - 0x27c], eax
jl 0x100399ac
mov dword [ebp - 0x400], 1
jmp 0x100399b3
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x27c]
cmp dword [ebp - 0x400], eax
jl 0x100399cd
mov dword [ebp - 0xc38], 1
jmp 0x100399d4
and dword [ebp - 0xc38], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xf50], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xf58], eax
mov dword [ebp - 0x98], 0x3734
cmp dword [ebp - 0x98], 0
je 0x10039a14
cmp dword [ebp - 0x8c], 0
je 0x10039a14
mov dword [ebp - 0x698], 1
jmp 0x10039a1b
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x27c]
cmp dword [ebp - 0x698], eax
jl 0x10039a35
mov dword [ebp - 0xc40], 1
jmp 0x10039a3c
and dword [ebp - 0xc40], 0
cmp dword [ebp - 0x98], 0xfffffffb
jne 0x10039a51
mov dword [ebp - 0x408], 1
jmp 0x10039a58
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x180]
cmp eax, dword [ebp - 0x408]
je 0x10039b5d
mov dword [ebp - 0xc20], 7
mov dword [ebp - 0xb7c], 0xfffffff6
mov dword [ebp - 0x210], 0
jmp 0x10039a97
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 3
jge 0x10039ab3
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0x11a8], 4
jmp 0x10039a8a
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xf60], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xf68], eax
cmp dword [ebp - 0x98], 1
jl 0x10039ae0
mov dword [ebp - 0x89c], 1
jmp 0x10039ae7
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x89c]
neg eax
jne 0x10039afd
mov dword [ebp - 0x410], 1
jmp 0x10039b04
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0xc20]
cmp dword [ebp - 0x410], eax
jge 0x10039b1e
mov dword [ebp - 0x6a0], 1
jmp 0x10039b25
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x6a0]
neg eax
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x11a8]
jg 0x10039b48
mov dword [ebp - 0x418], 1
jmp 0x10039b4f
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0xb7c], eax
jmp 0x10039b9b
mov dword [ebp - 0x9d4], 0x1bbcb567
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x9d4]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x98]
push eax
push 0
lea eax, [ebp - 0x27c]
push eax
call fcn.10043b4c
add esp, 0x1c
mov dword [ebp - 0x21c], 0x8373b2c
mov dword [ebp - 0x354], 0xfffffffe
push 2
lea ecx, [ebp - 0xd80]
call fcn.1001803e
mov dword [ebp - 4], 7
mov dword [ebp - 0x190], 0
jmp 0x10039bdc
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 3
jge 0x10039bf8
mov eax, dword [ebp - 0x190]
mov dword [ebp + eax*4 - 0x39c], 1
jmp 0x10039bcf
push 0x35b8
push 0
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0xd80]
push eax
push 0x5a39
push 1
push 0x731d
call fcn.1002ae74
add esp, 0x1c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x39c], 0
je 0x10039d25
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x39c], 0
je 0x10039c55
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x39c], 0
jne 0x10039c99
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x39c], 0x21e9
jge 0x10039c74
mov dword [ebp - 0x7e8], 1
jmp 0x10039c7b
and dword [ebp - 0x7e8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x39c]
cmp dword [ebp - 0x7e8], eax
jl 0x10039c99
and dword [ebp - 0x420], 0
jmp 0x10039ca3
mov dword [ebp - 0x420], 1
mov eax, dword [ebp - 0x21c]
cmp dword [ebp - 0x420], eax
jl 0x10039cbd
mov dword [ebp - 0x6a8], 1
jmp 0x10039cc4
and dword [ebp - 0x6a8], 0
cmp dword [ebp - 0x6a8], 0xdcb3
jge 0x10039cdc
mov dword [ebp - 0x428], 1
jmp 0x10039ce3
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x21c]
cmp dword [ebp - 0x428], eax
jg 0x10039cfd
mov dword [ebp - 0x894], 1
jmp 0x10039d04
and dword [ebp - 0x894], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x39c]
cmp dword [ebp - 0x894], eax
jl 0x10039d25
mov dword [ebp - 0x430], 1
jmp 0x10039d2c
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x21c], 0
jne 0x10039e67
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x39c]
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0x5616
jge 0x10039d70
mov dword [ebp - 0x6b0], 1
jmp 0x10039d77
and dword [ebp - 0x6b0], 0
cmp dword [ebp - 0x6b0], 0x7497f3c8
je 0x10039d8f
mov dword [ebp - 0x438], 1
jmp 0x10039d96
and dword [ebp - 0x438], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x39c]
cmp eax, dword [ebp - 0x438]
jge 0x10039db6
mov dword [ebp - 0x988], 1
jmp 0x10039dbd
and dword [ebp - 0x988], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x39c]
mov dword [ebp - 0xf70], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x39c], 0x6a4abff1
je 0x10039def
mov dword [ebp - 0x7f0], 1
jmp 0x10039df6
and dword [ebp - 0x7f0], 0
mov eax, dword [ebp - 0x7f0]
sub eax, 0x463a36cb
je 0x10039e14
xor eax, eax
inc eax
je 0x10039e14
mov dword [ebp - 0x440], 1
jmp 0x10039e1b
and dword [ebp - 0x440], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x39c]
sub eax, dword [ebp - 0x21c]
cmp eax, dword [ebp - 0x440]
je 0x10039e48
mov eax, 0x4b66
test eax, eax
jne 0x10039e48
and dword [ebp - 0x6b8], 0
jmp 0x10039e52
mov dword [ebp - 0x6b8], 1
cmp dword [ebp - 0x6b8], 0xb7d4
jle 0x10039e67
and dword [ebp - 0x448], 0
jmp 0x10039e71
mov dword [ebp - 0x448], 1
push 1
lea ecx, [ebp - 0xd80]
call fcn.10018124
mov ecx, dword [ebp - 0x448]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd80]
call fcn.100180a0
mov dword [ebp - 0x84], 0xfffffff6
mov dword [ebp - 0x10], 0xfffffff9
mov dword [ebp - 0x6c0], 0x28f4e1c2
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x10039ec4
mov dword [ebp - 0xb00], 1
jmp 0x10039ecb
and dword [ebp - 0xb00], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jl 0x10039edf
mov dword [ebp - 0x890], 1
jmp 0x10039ee6
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x890], eax
je 0x10039efd
mov dword [ebp - 0x450], 1
jmp 0x10039f04
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x450]
cmp eax, dword [ebp - 0x10]
jl 0x10039f1e
mov dword [ebp - 0x990], 1
jmp 0x10039f25
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xf78], eax
mov dword [ebp - 0x6c0], 0xffffffff
mov eax, dword [ebp - 0x6c0]
cmp dword [ebp - 0x10], eax
jne 0x10039f4f
mov dword [ebp - 0x458], 1
jmp 0x10039f56
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x458], eax
je 0x10039f6d
mov dword [ebp - 0x7f8], 1
jmp 0x10039f74
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x7f8], eax
je 0x10039f8b
mov dword [ebp - 0x460], 1
jmp 0x10039f92
and dword [ebp - 0x460], 0
cmp dword [ebp - 0x460], 0x395e
jl 0x10039fc0
mov dword [ebp - 0x10], 0
jmp 0x10039fae
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 8
je 0x10039fbe
cmp dword [ebp - 0x10], 0
je 0x10039fbc
jmp 0x10039fbe
jmp 0x10039fa7
jmp 0x1003a009
mov byte [ebp - 0xc6], 0
lea eax, [ebp - 0xc6]
push eax
push 0
push 0x6a0d
push 1
push 0x568
push 0x32af
push 0xf37
push 0x40d0
push 0x503f
push 0x7a90
push 0x1eba
push 0
push 0x9bb
call fcn.100364fb
add esp, 0x34
mov dword [ebp - 0x2d4], 0
jmp 0x1003a022
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 1
jge 0x1003a03e
mov eax, dword [ebp - 0x2d4]
mov dword [ebp + eax*4 - 0x998], 0
jmp 0x1003a015
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x194], 0x7adf
mov dword [ebp - 0xbbc], 0xf592758e
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x48], eax
jl 0x1003a06d
mov dword [ebp - 0x468], 1
jmp 0x1003a074
and dword [ebp - 0x468], 0
mov eax, 0x63e31551
test eax, eax
je 0x1003a0cd
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xf80], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xf88], eax
mov eax, dword [ebp - 0x194]
add eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x194]
jne 0x1003a0ac
mov dword [ebp - 0x6c8], 1
jmp 0x1003a0b3
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x194]
add eax, dword [ebp - 0x6c8]
je 0x1003a0cd
mov dword [ebp - 0x8d4], 1
jmp 0x1003a0d4
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x468]
add eax, dword [ebp - 0x8d4]
cmp eax, dword [ebp - 0x48]
jne 0x1003a0f7
cmp dword [ebp - 0x194], 0
jne 0x1003a0f7
and dword [ebp - 0x470], 0
jmp 0x1003a101
mov dword [ebp - 0x470], 1
mov eax, dword [ebp - 0x470]
sub eax, dword [ebp - 0x194]
mov dword [ebp - 0xbbc], eax
mov dword [ebp - 0x48], 0xffffffef
jmp 0x1003a123
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x3b
jge 0x1003a167
mov byte [ebp - 0xc8], 0
movzx eax, byte [ebp - 0xc8]
test eax, eax
je 0x1003a165
push 0x2cee
push 0x4893
push 0x918
push 1
push 0x74ba
push 0x7ecd
push 0x6845
push 0
call fcn.10031869
add esp, 0x20
jmp 0x1003a11c
mov dword [ebp - 0x84], 0
jmp 0x1003a180
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1003a19c
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x998], 0
jmp 0x1003a173
mov dword [ebp - 0x84], 0
jmp 0x1003a1b5
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xf
jg 0x1003befc
mov dword [ebp - 0x284], 0x74dd0324
or dword [ebp - 0xcf0], 0xffffffff
or dword [ebp - 0xcec], 0xffffffff
or dword [ebp - 0xce8], 0xffffffff
or dword [ebp - 0xce4], 0xffffffff
lea ecx, [ebp - 0x385]
call fcn.1001818e
push eax
lea eax, [ebp - 0xce0]
push eax
lea eax, [ebp - 0xcf0]
push eax
lea ecx, [ebp - 0x11d0]
call fcn.10018191
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc80]
call fcn.1001807a
mov dword [ebp - 4], 8
mov dword [ebp - 0x9b0], 0x136dc992
mov dword [ebp - 0x30c], 0xbbd4aa41
push 3
lea ecx, [ebp - 0xca4]
call fcn.1001803e
mov byte [ebp - 4], 9
mov dword [ebp - 0x20], 0
jmp 0x1003a259
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1003a26f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xd8], 0x5c8094a1
jmp 0x1003a252
mov dword [ebp - 0x20], 0
jmp 0x1003a27f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1003a295
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1248], 0xfffffffb
jmp 0x1003a278
mov dword [ebp - 0x20], 0
jmp 0x1003a2a5
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1003a2bb
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x9a8], 0x3e2e1665
jmp 0x1003a29e
lea eax, [ebp - 0xca4]
push eax
push 0x7e94
lea eax, [ebp - 0x20]
push eax
push 0x50c8
push 1
push 0x28ff
push 0x671
push 0
call fcn.10032886
add esp, 0x20
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd8], 0
jmp 0x1003a314
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xd8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd8], 3
jg 0x1003a6bd
mov dword [ebp - 0xf90], 0x510afbd1
mov dword [ebp - 0xf98], 0x8470ed99
push 4
lea ecx, [ebp - 0xc8c]
call fcn.1001803e
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xc14], 0xd925d3c0
push 0
lea eax, [ebp - 0xfa0]
push eax
push 0x640c
lea eax, [ebp - 0xc8c]
push eax
push 1
call fcn.1002d58e
add esp, 0x14
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0xd8]
lea ecx, [ebp - 0xc80]
call fcn.10018124
cmp dword [eax], 0
je 0x1003a639
mov dword [ebp - 0x304], 0x458a922a
mov dword [ebp - 0xbc4], 1
mov dword [ebp - 0x9b8], 0x457718da
mov eax, 0x69393dda
test eax, eax
je 0x1003a550
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0xd8]
lea ecx, [ebp - 0xc80]
call fcn.10018124
cmp dword [eax], 0xbd921b0a
ja 0x1003a3ee
mov dword [ebp - 0x6d0], 1
jmp 0x1003a3f5
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x6d0]
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x9a0], eax
mov eax, dword [ebp - 0x304]
dec eax
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0xb08]
cmp eax, dword [ebp - 0x9a0]
jge 0x1003a434
mov dword [ebp - 0x480], 1
jmp 0x1003a43b
and dword [ebp - 0x480], 0
cmp dword [ebp - 0x30c], 9
jae 0x1003a450
mov dword [ebp - 0x3a0], 1
jmp 0x1003a457
and dword [ebp - 0x3a0], 0
push 0
lea ecx, [ebp - 0xc8c]
call fcn.10018124
mov ecx, dword [ebp - 0x3a0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc14]
cmp dword [ebp - 0x3a0], eax
jge 0x1003a493
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9a8], 0
jne 0x1003a493
and dword [ebp - 0x478], 0
jmp 0x1003a49d
mov dword [ebp - 0x478], 1
cmp dword [ebp - 0x478], 0x9056
jg 0x1003a4b5
mov dword [ebp - 0x800], 1
jmp 0x1003a4bc
and dword [ebp - 0x800], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd8]
cmp eax, dword [ebp - 0x800]
jge 0x1003a4dd
mov dword [ebp - 0x6d8], 1
jmp 0x1003a4e4
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x480]
cmp eax, dword [ebp - 0x6d8]
jne 0x1003a4fe
mov dword [ebp - 0xb10], 1
jmp 0x1003a505
and dword [ebp - 0xb10], 0
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0xfa8], eax
push 3
lea ecx, [ebp - 0xc80]
call fcn.10018124
cmp dword [eax], 0xde0d
jge 0x1003a532
mov dword [ebp - 0x488], 1
jmp 0x1003a539
and dword [ebp - 0x488], 0
push 2
lea ecx, [ebp - 0xca4]
call fcn.10018124
mov ecx, dword [ebp - 0x488]
sub ecx, dword [eax]
jne 0x1003a56b
push 0
lea ecx, [ebp - 0xc8c]
call fcn.10018124
cmp dword [eax], 0
jne 0x1003a56b
and dword [ebp - 0x898], 0
jmp 0x1003a575
mov dword [ebp - 0x898], 1
mov eax, dword [ebp - 0x9b0]
cmp dword [ebp - 0x898], eax
jl 0x1003a59e
push 2
lea ecx, [ebp - 0xca4]
call fcn.10018124
cmp dword [eax], 0
jne 0x1003a59e
and dword [ebp - 0x490], 0
jmp 0x1003a5a8
mov dword [ebp - 0x490], 1
cmp dword [ebp - 0x490], 0x3e629bad
jne 0x1003a5c0
mov dword [ebp - 0x6e0], 1
jmp 0x1003a5c7
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x30c]
cmp dword [ebp - 0x6e0], eax
jl 0x1003a5e1
mov dword [ebp - 0x498], 1
jmp 0x1003a5e8
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0xbc4]
cmp dword [ebp - 0x498], eax
jne 0x1003a602
mov dword [ebp - 0x808], 1
jmp 0x1003a609
and dword [ebp - 0x808], 0
cmp dword [ebp - 0x808], 0xa4d
jle 0x1003a621
mov dword [ebp - 0x4a0], 1
jmp 0x1003a628
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a0]
shl eax, 3
mov dword [ebp - 0x9b8], eax
jmp 0x1003a6a9
mov byte [ebp - 0xca], 0
movzx eax, byte [ebp - 0xca]
test eax, eax
je 0x1003a689
push 0x3c0b
push 0x6766
push 0x61e3
push 0x6633
push 0xc33
push 0x398
push 0x9cc
push 0
push 1
push 0x210
push 0x7878
push 0xe3c
call fcn.1002f030
add esp, 0x30
mov byte [ebp - 0xbf], 0
movzx eax, byte [ebp - 0xbf]
test eax, eax
je 0x1003a6a9
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xc8c]
call fcn.100180a0
jmp 0x1003a2f9
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xca4]
call fcn.100180a0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc80]
call fcn.100180a0
mov dword [ebp - 0xfb0], 0x7d7c1188
mov dword [ebp - 0xfb8], 0xeaa32b1c
mov dword [ebp - 0xfc0], 7
mov dword [ebp - 0xfc8], 1
push 4
lea ecx, [ebp - 0x1070]
call fcn.1001803e
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xb18], 8
mov dword [ebp - 0x224], 0
jmp 0x1003a73a
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 4
jge 0x1003a75c
push dword [ebp - 0x224]
lea ecx, [ebp - 0x1070]
call fcn.10018124
mov dword [eax], 0xfd1e814b
jmp 0x1003a72d
push 0x106f
push 0
push 0x78c8
lea eax, [ebp - 0xb18]
push eax
call fcn.10045163
add esp, 0x10
mov byte [ebp - 0x137], 0
push 0x4f4e
push 0x375b
push 0x2f8e
push 0x3019
push 0x3bf8
push 1
push 0x7a63
push 0x713c
push 0
push 1
lea eax, [ebp - 0x137]
push eax
push 0x773b
push 0x506c
push 0x6dfe
push 0x77dd
call fcn.10036c8b
add esp, 0x3c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1070]
call fcn.100180a0
mov dword [ebp - 0x284], 0
jmp 0x1003a7f2
cmp dword [ebp - 0x284], 0xffffffe6
jne 0x1003bef7
mov dword [ebp - 0xb8], 0x8cff0ea7
mov dword [ebp - 0x17c], 0xfffffffe
mov dword [ebp - 0x810], 0xe809b4af
mov dword [ebp - 0x9d0], 0
mov dword [ebp - 0xfd0], 0xfffffffb
mov dword [ebp - 0xfd8], 0
mov dword [ebp - 0xfe0], 0x108f9809
mov dword [ebp - 0xfe8], 1
mov dword [ebp - 0x818], 0xfff7
mov byte [ebp - 0xc1], 0
push 1
push 0
push 0x571a
push 0x4417
push 0x5d21
lea eax, [ebp - 0xc1]
push eax
call fcn.10031d74
add esp, 0x18
mov dword [ebp - 0xb8], 0
jmp 0x1003a89b
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 6
je 0x1003ad29
mov dword [ebp - 0x384], 0
mov dword [ebp - 0x1d4], 0x41145714
mov dword [ebp - 0xd18], 0x3674
mov dword [ebp - 0xd14], 0x3674
mov dword [ebp - 0xd10], 0x3674
mov dword [ebp - 0xd0c], 0x3674
lea ecx, [ebp - 0x3a5]
call fcn.1001818e
push eax
lea eax, [ebp - 0xd08]
push eax
lea eax, [ebp - 0xd18]
push eax
lea ecx, [ebp - 0x11e0]
call fcn.10018191
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1080]
call fcn.1001807a
mov dword [ebp - 4], 0xc
push 1
lea ecx, [ebp - 0xc98]
call fcn.1001803e
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x4d0], 0xc0336ae3
mov dword [ebp - 0xff0], 0x64e48c0c
mov dword [ebp - 0xff8], 0xffffffff
mov dword [ebp - 0x9c0], 0x1bf8
cmp dword [ebp - 0x9c0], 0xd85
jge 0x1003aa1f
lea eax, [ebp - 0x9c8]
push eax
lea eax, [ebp - 0x35c]
push eax
push 0x100087c4
call fcn.10052cbb
add esp, 0xc
and dword [ebp - 0x8f8], 0
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0xc34], eax
mov eax, dword [ebp - 0x35c]
dec eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0xc34], 0
je 0x1003aa0d
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x6e8]
push eax
push 0x100087c4
call fcn.10052cbb
add esp, 0xc
mov ecx, dword [ebp - 0x4a8]
sub ecx, dword [ebp - 0x6e8]
mov eax, dword [ebp - 0x6e8]
sub eax, dword [ebp - 0x8f8]
dec eax
cdq
idiv dword [ebp - 0x9c8]
add edx, dword [ebp - 0x314]
lea eax, [edx + ecx + 1]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x8f8], eax
jmp 0x1003a992
push dword [ebp - 0x314]
push 0x10008718
call fcn.100535f4
pop ecx
pop ecx
lea eax, [ebp - 0xc98]
push eax
push 0
lea eax, [ebp - 0x1000]
push eax
push 1
call fcn.1002f29c
add esp, 0x10
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x384]
cmp dword [ebp - 0xb8], eax
jl 0x1003aa5f
mov dword [ebp - 0x4b0], 1
jmp 0x1003aa66
and dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x4b0], 2
ja 0x1003aa7b
mov dword [ebp - 0x4c8], 1
jmp 0x1003aa82
and dword [ebp - 0x4c8], 0
cmp dword [ebp - 0x1d4], 0
je 0x1003aab2
push 0
lea ecx, [ebp - 0x1080]
call fcn.10018124
cmp dword [eax], 0
je 0x1003aab2
mov eax, 0x24b5e495
test eax, eax
je 0x1003aab2
mov dword [ebp - 0x6f0], 1
jmp 0x1003aab9
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0x6f0], eax
jne 0x1003aad3
mov dword [ebp - 0x4b8], 1
jmp 0x1003aada
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x1d4], 0xfffffff7
mov esi, dword [ebp - 0x1d4]
push 0
lea ecx, [ebp - 0xc98]
call fcn.10018124
cmp esi, dword [eax]
je 0x1003ab13
mov dword [ebp - 0xb20], 1
jmp 0x1003ab1a
and dword [ebp - 0xb20], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x810], eax
cmp dword [ebp - 0x810], 0x80335900
jb 0x1003ab3e
mov dword [ebp - 0x4c0], 1
jmp 0x1003ab45
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0xb8]
imul eax, dword [ebp - 0x4c0]
neg eax
cmp eax, 0xda8db884
je 0x1003ab67
mov dword [ebp - 0x6f8], 1
jmp 0x1003ab6e
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x6f8], eax
jne 0x1003ab88
mov dword [ebp - 0x8a0], 1
jmp 0x1003ab8f
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x4c8]
add eax, dword [ebp - 0x8a0]
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x4d0]
imul eax, dword [ebp - 0x9d0]
test eax, eax
je 0x1003abdb
mov byte [ebp - 0x11c], 0
push 0
lea eax, [ebp - 0x11c]
push eax
push 1
push 0x199e
push 0x29c2
call fcn.1002d49d
add esp, 0x14
jmp 0x1003acf9
mov dword [ebp - 0xbcc], 1
mov dword [ebp - 0x22c], 0
jmp 0x1003abfe
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 3
jge 0x1003ac1a
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0x11c0], 1
jmp 0x1003abf1
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x11c0], 0
jne 0x1003ac5c
cmp dword [ebp - 0x17c], 0
jne 0x1003ac3e
mov dword [ebp - 0x700], 1
jmp 0x1003ac45
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0xbcc]
add eax, dword [ebp - 0x700]
jne 0x1003ac5c
and dword [ebp - 0x9d8], 0
jmp 0x1003ac66
mov dword [ebp - 0x9d8], 1
push 0
lea ecx, [ebp - 0xc98]
call fcn.10018124
mov eax, 0xadd3
test eax, eax
jne 0x1003ac88
mov dword [ebp - 0xb28], 1
jmp 0x1003ac8f
and dword [ebp - 0xb28], 0
mov dword [ebp - 0x1d4], 0xfffffff6
mov dword [ebp - 0x17c], 0
jmp 0x1003acb2
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0xffffffe3
je 0x1003acf9
mov dword [ebp - 0x4d8], 0x9d95921b
push 0x303a
push 1
push 0x5888
push 0x2bf0
push 0x5de
push 1
lea eax, [ebp - 0x4d8]
push eax
call fcn.1002ae74
add esp, 0x1c
cmp dword [ebp - 0x4d8], 0
je 0x1003acf7
jmp 0x1003aca5
jmp 0x1003aca5
mov eax, dword [ebp - 0x818]
dec eax
mov dword [ebp - 0x818], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xc98]
call fcn.100180a0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1080]
call fcn.100180a0
jmp 0x1003a88e
mov dword [ebp - 0x1008], 0x6f7fbf21
mov dword [ebp - 0x34], 0x835a23e8
mov dword [ebp - 0xe0], 0x8ab9c279
mov dword [ebp - 0x234], 0xffffffff
mov dword [ebp - 0x9e0], 0x1935
cmp dword [ebp - 0x9e0], 0x436
jge 0x1003b120
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x4e0]
push eax
mov ecx, 0x1065d430
call fcn.100177fe
mov ecx, eax
call fcn.100177fe
mov ecx, eax
call fcn.100177fe
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x148]
jle 0x1003adb4
lea edx, [ebp - 0x148]
lea ecx, [ebp - 0x160]
call fcn.1001c705
cmp dword [ebp - 0x4e0], 2
jne 0x1003add8
push fcn.1001c8e7
mov edx, 0x10008b20
mov ecx, 0x1065d378
call fcn.1001c710
mov ecx, eax
call fcn.10017c34
lea ecx, [ebp - 0x12c]
call fcn.10017f7c
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x2b4], 1
jmp 0x1003ae03
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
cmp eax, dword [ebp - 0x4e0]
jg 0x1003ae25
lea eax, [ebp - 0x2b4]
push eax
lea ecx, [ebp - 0x12c]
call fcn.10018133
jmp 0x1003adf6
mov dword [ebp - 0x31c], 1
lea ecx, [ebp - 0x12c]
call fcn.10049d75
movzx eax, al
test eax, eax
jne 0x1003b0f6
lea ecx, [ebp - 0x12c]
call fcn.1001811b
cmp eax, 2
jne 0x1003ae5a
jmp 0x1003b0f6
and dword [ebp - 0x1c], 0
jmp 0x1003ae67
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x12c]
call fcn.1001811b
cmp dword [ebp - 0x1c], eax
jae 0x1003b0e4
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x12c]
call fcn.10018124
mov eax, dword [eax]
cmp eax, dword [ebp - 0x160]
jne 0x1003aead
mov eax, dword [ebp - 0x1c]
inc eax
push eax
lea ecx, [ebp - 0x12c]
call fcn.10018124
mov eax, dword [eax]
cmp eax, dword [ebp - 0x148]
je 0x1003aedf
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x12c]
call fcn.10018124
mov eax, dword [eax]
cmp eax, dword [ebp - 0x148]
jne 0x1003aefb
mov eax, dword [ebp - 0x1c]
inc eax
push eax
lea ecx, [ebp - 0x12c]
call fcn.10018124
mov eax, dword [eax]
cmp eax, dword [ebp - 0x160]
jne 0x1003aefb
push fcn.1001c8e7
push dword [ebp - 0x31c]
mov ecx, 0x1065d378
call fcn.10017c40
mov ecx, eax
call fcn.10017c34
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x12c]
call fcn.10018124
mov eax, dword [eax]
cmp eax, dword [ebp - 0x160]
jne 0x1003af6b
push 1
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x1020]
push eax
lea ecx, [ebp - 0x12c]
call fcn.100180a5
mov ecx, eax
call fcn.1001d3dc
mov ecx, eax
call fcn.1001d3dc
mov eax, dword [eax]
mov dword [ebp - 0xc1c], eax
push dword [ebp - 0xc1c]
lea eax, [ebp - 0x1028]
push eax
lea ecx, [ebp - 0x12c]
call fcn.10049d80
jmp 0x1003b0df
mov eax, dword [ebp - 0x1c]
inc eax
push eax
lea ecx, [ebp - 0x12c]
call fcn.10018124
mov eax, dword [eax]
cmp eax, dword [ebp - 0x160]
jne 0x1003afcd
push dword [ebp - 0x1c]
lea eax, [ebp - 0x1030]
push eax
lea eax, [ebp - 0x1038]
push eax
lea ecx, [ebp - 0x12c]
call fcn.100180a5
mov ecx, eax
call fcn.1001d3dc
mov eax, dword [eax]
mov dword [ebp - 0x9e8], eax
push dword [ebp - 0x9e8]
lea eax, [ebp - 0x1040]
push eax
lea ecx, [ebp - 0x12c]
call fcn.10049d80
jmp 0x1003b0df
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x12c]
call fcn.10018124
mov eax, dword [eax]
cmp eax, dword [ebp - 0x148]
jne 0x1003b03d
push 1
lea eax, [ebp - 0x1048]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x1050]
push eax
lea eax, [ebp - 0x1058]
push eax
lea ecx, [ebp - 0x12c]
call fcn.100180a5
mov ecx, eax
call fcn.1001d3dc
mov ecx, eax
call fcn.1001d3dc
mov eax, dword [eax]
mov dword [ebp - 0xb30], eax
push dword [ebp - 0xb30]
lea eax, [ebp - 0x1060]
push eax
lea ecx, [ebp - 0x12c]
call fcn.10049d80
jmp 0x1003b0df
mov eax, dword [ebp - 0x1c]
inc eax
push eax
lea ecx, [ebp - 0x12c]
call fcn.10018124
mov eax, dword [eax]
cmp eax, dword [ebp - 0x148]
jne 0x1003b09c
push dword [ebp - 0x1c]
lea eax, [ebp - 0x1130]
push eax
lea eax, [ebp - 0x1138]
push eax
lea ecx, [ebp - 0x12c]
call fcn.100180a5
mov ecx, eax
call fcn.1001d3dc
mov eax, dword [eax]
mov dword [ebp - 0x9f0], eax
push dword [ebp - 0x9f0]
lea eax, [ebp - 0x1168]
push eax
lea ecx, [ebp - 0x12c]
call fcn.10049d80
jmp 0x1003b0df
push dword [ebp - 0x1c]
lea eax, [ebp - 0x1170]
push eax
lea eax, [ebp - 0x1178]
push eax
lea ecx, [ebp - 0x12c]
call fcn.100180a5
mov ecx, eax
call fcn.1001d3dc
mov eax, dword [eax]
mov dword [ebp - 0xbd4], eax
push dword [ebp - 0xbd4]
lea eax, [ebp - 0x1180]
push eax
lea ecx, [ebp - 0x12c]
call fcn.10049d80
jmp 0x1003ae60
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
jmp 0x1003ae2f
push fcn.1001c8e7
mov edx, 0x10008b20
mov ecx, 0x1065d378
call fcn.1001c710
mov ecx, eax
call fcn.10017c34
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.100180a0
mov dword [ebp - 0x1bc], 0
mov dword [ebp - 0x1a4], 0x8d232121
push 2
lea ecx, [ebp - 0xcb0]
call fcn.1001803e
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x1188], 0x4033e270
mov dword [ebp - 0x19c], 0
jmp 0x1003b16b
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 1
jge 0x1003b187
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x720], 0xb15a8df0
jmp 0x1003b15e
push 0x7089
lea eax, [ebp - 0x19c]
push eax
push 0x13e4
lea eax, [ebp - 0xcb0]
push eax
push 0
push 0
call fcn.10036367
add esp, 0x18
mov eax, 0xb770
test eax, eax
je 0x1003b295
imul eax, dword [ebp - 0x34], 0xfffffffc
cmp dword [ebp - 0x34], eax
je 0x1003b1cd
mov dword [ebp - 0x708], 1
jmp 0x1003b1d4
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x708]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xe0]
add eax, 0xb287
jne 0x1003b1ff
cmp dword [ebp - 0xe0], 0
jne 0x1003b1ff
and dword [ebp - 0x4e8], 0
jmp 0x1003b209
mov dword [ebp - 0x4e8], 1
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x4e8]
jge 0x1003b21b
cmp dword [ebp - 0xe0], 0
push 7
pop eax
test eax, eax
je 0x1003b237
cmp dword [ebp - 0xe0], 0
je 0x1003b237
mov dword [ebp - 0x8e0], 1
jmp 0x1003b23e
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x8e0]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x4f0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4f0]
mov dword [ebp + eax - 0x720], ecx
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x234]
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0
je 0x1003b295
mov dword [ebp - 0x710], 1
jmp 0x1003b29c
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x710], eax
jge 0x1003b2b3
mov dword [ebp - 0x4f8], 1
jmp 0x1003b2ba
and dword [ebp - 0x4f8], 0
cmp dword [ebp - 0x4f8], 0x12c51978
jne 0x1003b2d2
mov dword [ebp - 0x9f8], 1
jmp 0x1003b2d9
and dword [ebp - 0x9f8], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xe18], eax
cmp dword [ebp - 0x34], 6
ja 0x1003b2f4
mov dword [ebp - 0x820], 1
jmp 0x1003b2fb
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x820], eax
jg 0x1003b312
mov dword [ebp - 0x500], 1
jmp 0x1003b319
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x111c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x1bc]
cmp dword [ebp - 0x234], eax
jne 0x1003b354
mov dword [ebp - 0x718], 1
jmp 0x1003b35b
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x1bc]
cmp eax, dword [ebp - 0x718]
je 0x1003b375
mov dword [ebp - 0x508], 1
jmp 0x1003b37c
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x1a4]
imul eax, dword [ebp - 0x508]
test eax, eax
jne 0x1003b39c
cmp dword [ebp - 0x34], 0
jne 0x1003b39c
and dword [ebp - 0x8a8], 0
jmp 0x1003b3a6
mov dword [ebp - 0x8a8], 1
cmp dword [ebp - 0x8a8], 0xe525
jl 0x1003b3be
mov dword [ebp - 0x510], 1
jmp 0x1003b3c5
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x510], eax
jne 0x1003b3df
mov dword [ebp - 0x518], 1
jmp 0x1003b3e6
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x828], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x828]
mov dword [ebp + eax - 0x720], ecx
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x828], eax
jg 0x1003b42b
mov dword [ebp - 0x520], 1
jmp 0x1003b432
and dword [ebp - 0x520], 0
push 1
lea ecx, [ebp - 0xcb0]
call fcn.10018124
mov ecx, dword [ebp - 0x520]
cmp ecx, dword [eax]
jne 0x1003b455
mov dword [ebp - 0x728], 1
jmp 0x1003b45c
and dword [ebp - 0x728], 0
cmp dword [ebp - 0x728], 0x50e8
je 0x1003b47d
mov eax, 0x4ce9d061
test eax, eax
je 0x1003b47d
mov dword [ebp - 0x528], 1
jmp 0x1003b484
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x528], eax
jl 0x1003b49e
mov dword [ebp - 0x908], 1
jmp 0x1003b4a5
and dword [ebp - 0x908], 0
push 1
lea ecx, [ebp - 0xcb0]
call fcn.10018124
mov ecx, dword [ebp - 0x908]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcb0]
call fcn.100180a0
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0xf04], 0
mov dword [ebp - 0x28c], 0
jmp 0x1003b4f3
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 1
jge 0x1003b50f
mov eax, dword [ebp - 0x28c]
mov dword [ebp + eax*4 - 0xb38], 1
jmp 0x1003b4e6
mov dword [ebp - 0x6c], 0
jmp 0x1003b51f
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1003b535
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xb38], 0xce125d16
jmp 0x1003b518
mov dword [ebp - 0x6c], 0
jmp 0x1003b545
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jl 0x1003b56c
mov dword [ebp - 0xa00], 0xdfe4
push 0
push 1
lea eax, [ebp - 0xa00]
push eax
push 0
call fcn.10036936
add esp, 0x10
jmp 0x1003b53e
mov dword [ebp - 0xe8], 0xcd5
mov dword [ebp - 0x1cc], 0xfffffff7
mov dword [ebp - 0xa0], 0x80c6548a
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x2cc], 0x64e785c2
mov dword [ebp - 0x116c], 0x9a78915c
imul eax, dword [ebp - 0xe8], 0xffff
mov ecx, 0xffff
sub ecx, eax
cmp ecx, dword [ebp - 0xe8]
jl 0x1003b5ca
mov dword [ebp - 0x530], 1
jmp 0x1003b5d1
and dword [ebp - 0x530], 0
cmp dword [ebp - 0x530], 6
jge 0x1003b5e6
mov dword [ebp - 0x730], 1
jmp 0x1003b5ed
and dword [ebp - 0x730], 0
mov dword [ebp - 0x1cc], 0xffffffff
imul eax, dword [ebp - 0x730], 0xfffd
cmp dword [ebp - 0x1cc], eax
jle 0x1003b615
mov dword [ebp - 0x538], 1
jmp 0x1003b61c
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x538], eax
jg 0x1003b636
mov dword [ebp - 0x830], 1
jmp 0x1003b63d
and dword [ebp - 0x830], 0
cmp dword [ebp - 0x830], 0
je 0x1003b65b
cmp dword [ebp - 0xa0], 0
je 0x1003b65b
mov dword [ebp - 0xc44], 1
jmp 0x1003b662
and dword [ebp - 0xc44], 0
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xe24], eax
cmp dword [ebp - 0xa0], 0
jne 0x1003b689
cmp dword [ebp - 0xa0], 0
jne 0x1003b689
and dword [ebp - 0x540], 0
jmp 0x1003b693
mov dword [ebp - 0x540], 1
mov eax, dword [ebp - 0xa0]
add eax, dword [ebp - 0x540]
cmp dword [ebp - 0xe8], eax
je 0x1003b6b3
mov dword [ebp - 0x738], 1
jmp 0x1003b6ba
and dword [ebp - 0x738], 0
cmp dword [ebp - 0x738], 0xe857
jne 0x1003b6d6
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x1003b6d6
and dword [ebp - 0x548], 0
jmp 0x1003b6e0
mov dword [ebp - 0x548], 1
imul eax, dword [ebp - 0x548], 7
sub eax, 0xd50c
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0xe8]
add eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0x2cc], eax
jl 0x1003b70f
mov dword [ebp - 0x8b0], 1
jmp 0x1003b716
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x8b0], eax
jl 0x1003b730
mov dword [ebp - 0xa08], 1
jmp 0x1003b737
and dword [ebp - 0xa08], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xfd4], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xe2c], eax
mov dword [ebp - 0x40], 0x3734
cmp dword [ebp - 0x40], 0
je 0x1003b76e
cmp dword [ebp - 0xa0], 0
je 0x1003b76e
mov dword [ebp - 0x550], 1
jmp 0x1003b775
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x550], eax
jl 0x1003b78f
mov dword [ebp - 0xb40], 1
jmp 0x1003b796
and dword [ebp - 0xb40], 0
cmp dword [ebp - 0x40], 0xfffffffb
jne 0x1003b7a8
mov dword [ebp - 0x740], 1
jmp 0x1003b7af
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x1cc]
cmp eax, dword [ebp - 0x740]
je 0x1003b8b1
mov dword [ebp - 0xa10], 7
mov dword [ebp - 0xbdc], 0xfffffff6
mov dword [ebp - 0x23c], 0
jmp 0x1003b7ee
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 3
jge 0x1003b80a
mov eax, dword [ebp - 0x23c]
mov dword [ebp + eax*4 - 0x11b4], 4
jmp 0x1003b7e1
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x10a4], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xe34], eax
cmp dword [ebp - 0x40], 1
jl 0x1003b831
mov dword [ebp - 0x558], 1
jmp 0x1003b838
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x558]
neg eax
jne 0x1003b84e
mov dword [ebp - 0x838], 1
jmp 0x1003b855
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0xa10]
cmp dword [ebp - 0x838], eax
jge 0x1003b86f
mov dword [ebp - 0x560], 1
jmp 0x1003b876
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x560]
neg eax
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x11b4]
jg 0x1003b899
mov dword [ebp - 0x748], 1
jmp 0x1003b8a0
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0xbdc], eax
jmp 0x1003b936
mov dword [ebp - 0xb48], 0x1bbcb567
mov dword [ebp - 0x40], 0
jmp 0x1003b8cb
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffe5
jl 0x1003b936
mov dword [ebp - 0x978], 0xa2a42895
push 0x7bae
push 0x5f0c
push 1
push 0x6fcd
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x2cc]
push eax
push 0x11df
lea eax, [ebp - 0x978]
push eax
push 0
push 0xaa9
lea eax, [ebp - 0x1cc]
push eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0xb48]
push eax
push 0x7128
push 0x645e
call fcn.1002bfb3
add esp, 0x3c
jmp 0x1003b8c4
mov dword [ebp - 0x244], 0
jmp 0x1003b94f
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 3
jge 0x1003b96b
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0x10a0], 6
jmp 0x1003b942
mov dword [ebp - 0x580], 0xda50
push 2
lea ecx, [ebp - 0xd98]
call fcn.1001803e
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x1c4], 0x8112def9
mov dword [ebp - 0x18c], 5
mov dword [ebp - 0x1ac], 0
jmp 0x1003b9b6
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 3
jge 0x1003b9d2
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0x964], 0x9b950315
jmp 0x1003b9a9
push 0x493a
push 0x605
push 0x2e97
lea eax, [ebp - 0xd98]
push eax
push 0
push 0x7766
push 0x48a9
push 1
push 0x5392
push 0x4776
lea eax, [ebp - 0x1ac]
push eax
push 0x1012
call fcn.1002b6c0
add esp, 0x30
push 0
push 0x5c50
push 1
push 0
push 0x6415
push 0x6ae3
push 0x41ba
call fcn.10031b90
add esp, 0x1c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x964]
mov dword [ebp - 0x568], eax
push 1
lea ecx, [ebp - 0xd98]
call fcn.10018124
mov ecx, dword [ebp - 0x568]
mov dword [eax], ecx
cmp dword [ebp - 0x568], 0
je 0x1003ba7d
mov eax, dword [ebp - 0x1c4]
sub eax, 0x372253f1
je 0x1003ba7d
mov eax, 0x39e2
test eax, eax
jne 0x1003ba96
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x964], 0
jne 0x1003ba96
and dword [ebp - 0x8e8], 0
jmp 0x1003baa0
mov dword [ebp - 0x8e8], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x964]
sub eax, dword [ebp - 0x8e8]
cmp eax, dword [ebp - 0x1c4]
je 0x1003bac7
mov dword [ebp - 0x570], 1
jmp 0x1003bace
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x570], eax
jg 0x1003bae8
mov dword [ebp - 0x750], 1
jmp 0x1003baef
and dword [ebp - 0x750], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x964]
add ecx, dword [ebp - 0x750]
cmp dword [ebp + eax - 0x964], ecx
jle 0x1003bb1c
mov dword [ebp - 0x364], 1
jmp 0x1003bb23
and dword [ebp - 0x364], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x364]
mov dword [ebp + eax - 0x964], ecx
cmp dword [ebp - 0x364], 1
je 0x1003bb4b
mov dword [ebp - 0x578], 1
jmp 0x1003bb52
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x578]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x1c4], eax
jle 0x1003bb78
mov dword [ebp - 0x840], 1
jmp 0x1003bb7f
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x840], eax
je 0x1003bb99
mov dword [ebp - 0x758], 1
jmp 0x1003bba0
and dword [ebp - 0x758], 0
mov dword [ebp - 0x580], 0x3992
mov eax, dword [ebp - 0x580]
imul eax, dword [ebp - 0x758]
cmp eax, dword [ebp - 0x18c]
jge 0x1003bbd1
cmp dword [ebp - 0x18c], 0
jne 0x1003bbd1
and dword [ebp - 0x588], 0
jmp 0x1003bbdb
mov dword [ebp - 0x588], 1
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x18c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd98]
call fcn.100180a0
mov byte [ebp - 0xc3], 0
push 0x5552
push 0x4586
push 0x62b7
push 0x7638
push 1
push 0x456a
push 0x7e3b
push 1
push 0x2180
push 0x646b
push 0x20fc
push 0x5049
call fcn.1002b6c0
add esp, 0x30
movzx eax, byte [ebp - 0xc3]
test eax, eax
je 0x1003bd24
mov dword [ebp - 0xf0], 0xb4ffb871
mov dword [ebp - 0xa20], 0x1dbdae4
push 1
lea ecx, [ebp - 0xc74]
call fcn.1001803e
mov dword [ebp - 4], 0x11
push 0
lea eax, [ebp - 0xc74]
push eax
push 0x502
lea eax, [ebp - 0xfdc]
push eax
push 0
call fcn.100369b9
add esp, 0x14
push 0x1e0
lea eax, [ebp - 0xf0]
push eax
push 1
push 0
push 1
lea eax, [ebp - 0xa20]
push eax
push 0x8f
push 0x2f5c
push 0x4023
call fcn.10031f9a
add esp, 0x24
mov dword [ebp - 0xf0], 0
jmp 0x1003bcda
cmp dword [ebp - 0xf0], 0
jg 0x1003bd0d
mov dword [ebp - 0x294], 0x8cff0ea7
mov dword [ebp - 0x170], 0x121a
mov dword [ebp - 0x294], 0xfffffffa
jmp 0x1003bd51
cmp dword [ebp - 0x294], 0x1b
jne 0x1003bed7
jmp 0x1003a1a8
mov dword [ebp - 0x38], 0xfffffff9
mov dword [ebp - 0x760], 0x28f4e1c2
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jle 0x1003bf21
mov dword [ebp - 0xc24], 1
jmp 0x1003bf28
and dword [ebp - 0xc24], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jl 0x1003bf3c
mov dword [ebp - 0x8b8], 1
jmp 0x1003bf43
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x8b8], eax
je 0x1003bf5a
mov dword [ebp - 0x590], 1
jmp 0x1003bf61
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x590]
cmp eax, dword [ebp - 0x38]
jl 0x1003bf7b
mov dword [ebp - 0xa28], 1
jmp 0x1003bf82
and dword [ebp - 0xa28], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xe3c], eax
mov dword [ebp - 0x760], 0xffffffff
mov eax, dword [ebp - 0x760]
cmp dword [ebp - 0x38], eax
jne 0x1003bfac
mov dword [ebp - 0x598], 1
jmp 0x1003bfb3
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x598], eax
je 0x1003bfca
mov dword [ebp - 0x848], 1
jmp 0x1003bfd1
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x848], eax
je 0x1003bfe8
mov dword [ebp - 0x5a0], 1
jmp 0x1003bfef
and dword [ebp - 0x5a0], 0
cmp dword [ebp - 0x5a0], 0x395e
jl 0x1003c017
push 0
lea eax, [ebp - 0x38]
push eax
push 0x18e5
push 0x59f9
push 0
call fcn.10041c43
add esp, 0x14
jmp 0x1003c036
mov byte [ebp - 0xc5], 0
lea eax, [ebp - 0xc5]
push eax
push 0xc37
push 0
push 0
call fcn.1002f1f2
add esp, 0x10
mov dword [ebp - 0x768], 0
mov dword [ebp - 0x150], 9
mov dword [ebp - 0xbe4], 1
push 0x4206
lea eax, [ebp - 0x150]
push eax
push 0x2861
lea eax, [ebp - 0x768]
push eax
push 0
push 0
push 0x935
call fcn.10032984
add esp, 0x1c
mov dword [ebp - 0x150], 0xffffffef
jmp 0x1003c096
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0xffffffec
jl 0x1003c0e9
mov dword [ebp - 0xb50], 0x97412df3
mov dword [ebp - 0xa30], 0xffffffff
push 1
push 0x394c
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0xb50]
push eax
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x768]
push eax
push 0
lea eax, [ebp - 0xbe4]
push eax
call fcn.10032326
add esp, 0x20
jmp 0x1003c089
mov eax, dword [ebp - 0x2a4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x2a4]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x1134], 0x624039b6
mov dword [ebp - 0x29c], 0x743d837b
mov dword [ebp - 0xe44], 0
mov dword [ebp - 0xfe4], 0xffffffff
mov dword [ebp - 0xe4c], 1
mov dword [ebp - 0x10b4], 0xfffffff8
mov dword [ebp - 0xa38], 0x221d
cmp dword [ebp - 0xa38], 0xe7d
jge 0x1003c296
and dword [ebp - 0x24c], 0
lea eax, [ebp - 0x24c]
push eax
push 0x10008780
call fcn.10052cbb
pop ecx
pop ecx
and dword [ebp - 0x324], 0
and dword [ebp - 0x184], 0
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0xb58], eax
mov eax, dword [ebp - 0x24c]
dec eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0xb58], 0
je 0x1003c1ee
lea eax, [ebp - 0x324]
push eax
push 0x100086a0
call fcn.10052cbb
pop ecx
pop ecx
cmp dword [ebp - 0x324], 0
jne 0x1003c1d6
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
jmp 0x1003c1ec
cmp dword [ebp - 0x324], 5
jne 0x1003c1ec
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
jmp 0x1003c189
cmp dword [ebp - 0x2bc], 9
jl 0x1003c275
cmp dword [ebp - 0x184], 0
jle 0x1003c275
and dword [ebp - 0x3a4], 0
jmp 0x1003c216
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
mov eax, dword [ebp - 0x2bc]
cdq
push 9
pop ecx
idiv ecx
cmp dword [ebp - 0x3a4], eax
jge 0x1003c237
push 0x10008b28
call fcn.100535f4
pop ecx
jmp 0x1003c209
and dword [ebp - 0x32c], 0
jmp 0x1003c24d
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x32c]
cmp eax, dword [ebp - 0x184]
jge 0x1003c268
push 0x10008b2c
call fcn.100535f4
pop ecx
jmp 0x1003c240
push 0x10008758
call fcn.100535f4
pop ecx
jmp 0x1003c296
cmp dword [ebp - 0x184], 0
jle 0x1003c28b
push 0x10008b2c
call fcn.10053c57
pop ecx
jmp 0x1003c296
push 0x1000896c
call fcn.10053c57
pop ecx
mov dword [ebp - 0xe54], 0x869ec427
push 3
lea ecx, [ebp - 0x10b0]
call fcn.1001803e
mov dword [ebp - 4], 0x12
mov dword [ebp - 0xa40], 0xc29478c9
mov dword [ebp - 0x254], 0
jmp 0x1003c2d7
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 3
jge 0x1003c2f9
push dword [ebp - 0x254]
lea ecx, [ebp - 0x10b0]
call fcn.10018124
mov dword [eax], 0xfa147b80
jmp 0x1003c2ca
push 0x5bd1
push 0x5c5b
push 0x1019
push 0
push 0x511f
push 0x6c1d
push 0
push 0xb4
push 1
push 0x2b73
push 0x726b
lea eax, [ebp - 0xa40]
push eax
call fcn.1002f4cc
add esp, 0x30
mov dword [ebp - 0x29c], 0
jmp 0x1003c34f
mov eax, dword [ebp - 0x29c]
dec eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0xfffffff0
jle 0x1003c393
mov byte [ebp - 0x11e], 0
movzx eax, byte [ebp - 0x11e]
test eax, eax
je 0x1003c391
push 0x24f3
push 0
push 0x5199
push 0x67d6
push 0
push 0x6976
push 0x206d
push 1
call fcn.10037134
add esp, 0x20
jmp 0x1003c342
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10b0]
call fcn.100180a0
mov dword [ebp - 0xc3c], 0x462d5e48
push 1
push 0
push 0x2a5e
push 0x74a9
push 0
push 0x3f18
push 0x2d33
lea eax, [ebp - 0xc3c]
push eax
call fcn.10032fe6
add esp, 0x20
mov byte [ebp - 0xc7], 0
push 0
lea eax, [ebp - 0xc7]
push eax
push 1
push 0
push 0x7832
push 0x4243
push 0xc47
call fcn.10041d0f
add esp, 0x1c
push 0
push 1
push 0x3f72
push 0x66a2
push 1
push 0x28ae
push 0x9a1
push 0x46e
call fcn.10032fe6
add esp, 0x20
mov dword [ebp - 0xfec], 0x5d6c
mov dword [ebp - 0xe5c], 0x3556
mov byte [ebp - 0x134], 0
movzx eax, byte [ebp - 0x134]
test eax, eax
je 0x1003c47c
push 0x6751
push 0x539f
push 0x12bf
push 1
push 0x201b
push 0
push 0x72d
push 0x5c19
push 0x1493
call fcn.1002f6c1
add esp, 0x24
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x1003c4ae
push 0x3c84
push 1
push 0
push 0x3950
push 0x130a
push 0x38d4
call fcn.1002df2d
add esp, 0x18
mov byte [ebp - 0xc9], 0
mov dword [ebp - 0x118c], 0xffffffff
mov dword [ebp - 0xe64], 7
mov dword [ebp - 0xff4], 7
mov dword [ebp - 0xe6c], 0x46df37d4
mov dword [ebp - 0x10c4], 0x87cf2e56
push 1
lea ecx, [ebp - 0x10c0]
call fcn.1001803e
mov dword [ebp - 4], 0x13
mov dword [ebp - 0xe74], 0xb7d8
mov dword [ebp - 0xa48], 0x10c13fe6
mov dword [ebp - 0xffc], 0x289fff12
mov dword [ebp - 0xe7c], 0xfffffff6
mov dword [ebp - 0x113c], 0xffffffff
mov dword [ebp - 0xe84], 0x6658
mov dword [ebp - 0x1004], 0
mov dword [ebp - 0x58], 0
jmp 0x1003c551
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1003c56d
push dword [ebp - 0x58]
lea ecx, [ebp - 0x10c0]
call fcn.10018124
mov dword [eax], 1
jmp 0x1003c54a
mov dword [ebp - 0x58], 0
jmp 0x1003c57d
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1003c593
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x5a8], 0x256fae7a
jmp 0x1003c576
push 0x36c1
push 0x135
push 1
lea eax, [ebp - 0xa48]
push eax
push 0x522e
push 0x1b98
push 0xc5a
push 0x2050
push 1
push 0x64fe
push 0x1ac0
push 0x7b2a
push 0x61c5
push 0x2b44
push 0x4b77
call fcn.1002bfb3
add esp, 0x3c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5a8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x5a8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10c0]
call fcn.100180a0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x1003c88e
mov dword [ebp - 0x94], 0x1824a8c6
mov dword [ebp - 0x90], 0x8a137b18
mov dword [ebp - 0xe8c], 0xc1da7bc9
mov dword [ebp - 0x10d4], 0xb6968939
mov dword [ebp - 0xa58], 0xb6cd3335
mov dword [ebp - 0xe94], 0x98d72a67
mov dword [ebp - 0x370], 8
mov dword [ebp - 0x74], 0
jmp 0x1003c671
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 4
jge 0x1003c687
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x114c], 0xffff
jmp 0x1003c66a
mov dword [ebp - 0x74], 0
jmp 0x1003c697
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 4
jge 0x1003c6ad
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x1264], 0xf9150fae
jmp 0x1003c690
push 0
push 0x104f
push 1
push 1
lea eax, [ebp - 0x90]
push eax
push 0x16de
lea eax, [ebp - 0x94]
push eax
call fcn.10041d0f
add esp, 0x1c
mov dword [ebp - 0x90], 0
jmp 0x1003c6ec
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jg 0x1003c886
mov dword [ebp - 0xa60], 0xfffffff6
mov dword [ebp - 0xb68], 1
mov dword [ebp - 0x100c], 0xaa8e
mov dword [ebp - 0xe9c], 0
mov dword [ebp - 0x1174], 0xffffffff
push 2
lea ecx, [ebp - 0x10d0]
call fcn.1001803e
mov dword [ebp - 4], 0x14
mov dword [ebp - 0xea4], 0x96f37d43
push 0
lea eax, [ebp - 0x10d0]
push eax
lea eax, [ebp - 0x1014]
push eax
push 0
call fcn.10030195
add esp, 0x10
mov dword [ebp - 0x94], 0
jmp 0x1003c77c
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jg 0x1003c799
mov eax, dword [ebp - 0x94]
cmp dword [ebp + eax*4 - 0x114c], 0
je 0x1003c797
jmp 0x1003c799
jmp 0x1003c76f
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x90]
mov ecx, dword [ebp + ecx*4 - 0x114c]
cmp dword [ebp + eax*4 - 0x114c], ecx
jle 0x1003c7c1
mov dword [ebp - 0x5b0], 1
jmp 0x1003c7c8
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0xb60], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xa50], eax
mov eax, dword [ebp - 0x370]
dec eax
mov dword [ebp - 0x370], eax
mov eax, dword [ebp - 0xb60]
cmp eax, dword [ebp - 0xa50]
jg 0x1003c807
mov dword [ebp - 0x900], 1
jmp 0x1003c80e
and dword [ebp - 0x900], 0
cmp dword [ebp - 0x900], 0xcd9d75
jle 0x1003c826
mov dword [ebp - 0xbec], 1
jmp 0x1003c82d
and dword [ebp - 0xbec], 0
mov eax, dword [ebp - 0xa58]
mov dword [ebp - 0xeac], eax
mov eax, dword [ebp - 0xb68]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x5b0], eax
jne 0x1003c85f
mov dword [ebp - 0x770], 1
jmp 0x1003c866
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0xa60], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10d0]
call fcn.100180a0
jmp 0x1003c6df
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [ebp - 0x9c], 0xfffffffc
mov dword [ebp - 0x8f0], 3
mov dword [ebp - 0xbf4], 0xfd3265c9
mov dword [ebp - 0x25c], 0
jmp 0x1003c8c5
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 1
jge 0x1003c8de
mov eax, dword [ebp - 0x25c]
mov dword [ebp + eax*4 - 0x30], 0
jmp 0x1003c8b8
mov dword [ebp - 0x9c], 0
jmp 0x1003c8f7
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jg 0x1003cf94
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x5e0], 0xfffffff6
push 3
lea ecx, [ebp - 0xdb0]
call fcn.1001803e
mov dword [ebp - 4], 0x15
mov dword [ebp - 0xa78], 0xcb277ce2
mov dword [ebp - 0xa80], 0xfffffffc
mov dword [ebp - 0x2dc], 0
jmp 0x1003c956
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 3
jge 0x1003c975
push dword [ebp - 0x2dc]
lea ecx, [ebp - 0xdb0]
call fcn.10018124
and dword [eax], 0
jmp 0x1003c949
mov dword [ebp - 0x24], 0
jmp 0x1003c985
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1003cf80
push 4
lea ecx, [ebp - 0x1fc]
call fcn.1001803e
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x5e8], 0xffffffff
mov dword [ebp - 0x264], 0
jmp 0x1003c9c3
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 4
jge 0x1003c9e5
push dword [ebp - 0x264]
lea ecx, [ebp - 0x1fc]
call fcn.10018124
mov dword [eax], 0xfffffffc
jmp 0x1003c9b6
mov byte [ebp - 0xcb], 0
movzx eax, byte [ebp - 0xcb]
test eax, eax
je 0x1003ca32
push 0x680e
push 0x5f04
push 0x51ce
push 0x4fea
push 0x4878
push 0x6230
push 0
push 1
push 0x68f5
push 0x3878
push 1
push 0x38a5
call fcn.1002dbe7
add esp, 0x30
push 1
lea ecx, [ebp - 0x1fc]
call fcn.10018124
and dword [eax], 0
jmp 0x1003ca68
push 1
lea ecx, [ebp - 0x1fc]
call fcn.10018124
mov dword [ebp - 0x5b8], eax
mov eax, dword [ebp - 0x5b8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x5b8]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x1fc]
call fcn.10018124
cmp dword [eax], 0
jl 0x1003cf6c
mov dword [ebp - 0x64], 0x781ced8f
push 3
lea ecx, [ebp - 0x94c]
call fcn.1001803e
mov byte [ebp - 4], 0x17
push 0
lea eax, [ebp - 0x10e4]
push eax
push 0x359c
push 1
push 0x499c
lea eax, [ebp - 0x94c]
push eax
call fcn.1002c1dd
add esp, 0x18
mov dword [ebp - 0x64], 0
jmp 0x1003caca
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jg 0x1003cf58
mov dword [ebp - 0x858], 0x7606ab81
mov dword [ebp - 0xa70], 0xe572dbe4
push 1
lea ecx, [ebp - 0x1fc]
call fcn.10018124
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x30]
push 1
lea ecx, [ebp - 0x1fc]
call fcn.10018124
mov eax, dword [eax]
add esi, dword [ebp + eax*4 - 0x30]
push 1
lea ecx, [ebp - 0x94c]
call fcn.10018124
cmp esi, dword [eax]
jge 0x1003cb2b
mov dword [ebp - 0x850], 1
jmp 0x1003cb32
and dword [ebp - 0x850], 0
push 1
lea ecx, [ebp - 0x1fc]
call fcn.10018124
mov esi, dword [ebp - 0x850]
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0x94c]
call fcn.10018124
cmp esi, dword [eax]
jle 0x1003cb64
mov dword [ebp - 0x334], 1
jmp 0x1003cb6b
and dword [ebp - 0x334], 0
push 1
lea ecx, [ebp - 0x94c]
call fcn.10018124
mov ecx, dword [ebp - 0x334]
mov dword [eax], ecx
cmp dword [ebp - 0x334], 0
jne 0x1003cb95
mov dword [ebp - 0x5c0], 1
jmp 0x1003cb9c
and dword [ebp - 0x5c0], 0
push 1
lea ecx, [ebp - 0x1fc]
call fcn.10018124
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x30]
cmp dword [ebp - 0x5c0], eax
jg 0x1003cbc3
mov dword [ebp - 0x778], 1
jmp 0x1003cbca
and dword [ebp - 0x778], 0
cmp dword [ebp - 0x778], 0
jl 0x1003cbdf
mov dword [ebp - 0x5c8], 1
jmp 0x1003cbe6
and dword [ebp - 0x5c8], 0
cmp dword [ebp - 0x5c8], 0xfffffff9
jb 0x1003cbfb
mov dword [ebp - 0x8c0], 1
jmp 0x1003cc02
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x8c0], eax
jle 0x1003cc1c
mov dword [ebp - 0x5d0], 1
jmp 0x1003cc23
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x5d0], eax
jne 0x1003cc3a
mov dword [ebp - 0x780], 1
jmp 0x1003cc41
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x780], eax
jle 0x1003cc58
mov dword [ebp - 0x5d8], 1
jmp 0x1003cc5f
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 0x858], eax
cmp dword [ebp - 0x858], 0
jne 0x1003cc8f
push 2
lea ecx, [ebp - 0x94c]
call fcn.10018124
cmp dword [eax], 0
jne 0x1003cc8f
and dword [ebp - 0xc2c], 0
jmp 0x1003cc99
mov dword [ebp - 0xc2c], 1
push 1
lea ecx, [ebp - 0x1fc]
call fcn.10018124
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xeb4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x5e0], eax
cmp dword [ebp - 0x5e0], 0
je 0x1003ccd3
push 3
lea ecx, [ebp - 0x1fc]
call fcn.10018124
cmp dword [eax], 0
jne 0x1003cce3
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x1003cce3
and dword [ebp - 0x788], 0
jmp 0x1003cced
mov dword [ebp - 0x788], 1
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0x5e8], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x5e8], eax
jne 0x1003cd10
mov dword [ebp - 0xa68], 1
jmp 0x1003cd17
and dword [ebp - 0xa68], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x30]
mov dword [ebp - 0xf00], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xebc], eax
mov dword [ebp - 0x8f0], 1
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x8f0], eax
jl 0x1003cd4e
mov dword [ebp - 0x5f0], 1
jmp 0x1003cd55
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x5f0], eax
jge 0x1003cd6c
mov dword [ebp - 0x790], 1
jmp 0x1003cd73
and dword [ebp - 0x790], 0
cmp dword [ebp - 0x790], 0x4ffa2b87
jle 0x1003cd8b
mov dword [ebp - 0xb70], 1
jmp 0x1003cd92
and dword [ebp - 0xb70], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x30]
push 1
lea ecx, [ebp - 0x1fc]
call fcn.10018124
cmp esi, dword [eax]
jge 0x1003cdb9
mov dword [ebp - 0x5f8], 1
jmp 0x1003cdc0
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x5f8], eax
jle 0x1003cdd7
mov dword [ebp - 0x860], 1
jmp 0x1003cdde
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0xa70]
cmp dword [ebp - 0x860], eax
je 0x1003cdf8
mov dword [ebp - 0x600], 1
jmp 0x1003cdff
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0xbf4]
cmp dword [ebp - 0x600], eax
je 0x1003ce23
push 0
lea ecx, [ebp - 0xdb0]
call fcn.10018124
cmp dword [eax], 0
jne 0x1003ce23
cmp dword [ebp - 0x64], 0
push 1
lea ecx, [ebp - 0x1fc]
call fcn.10018124
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x30], 0xffff
jne 0x1003ce46
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x30], 0
je 0x1003ce5b
cmp dword [ebp - 0xa78], 0
je 0x1003ce5b
mov dword [ebp - 0x798], 1
jmp 0x1003ce62
and dword [ebp - 0x798], 0
push 1
lea ecx, [ebp - 0x1fc]
call fcn.10018124
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x30]
cmp dword [ebp - 0x798], eax
jle 0x1003ce89
mov dword [ebp - 0x608], 1
jmp 0x1003ce90
and dword [ebp - 0x608], 0
cmp dword [ebp - 0x608], 0xc694a61b
jb 0x1003cea8
mov dword [ebp - 0xb78], 1
jmp 0x1003ceaf
and dword [ebp - 0xb78], 0
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp + eax*4 - 0x30]
mov dword [ebp - 0xf08], eax
mov eax, dword [ebp - 0x9c]
mov esi, dword [ebp + eax*4 - 0x30]
push 1
lea ecx, [ebp - 0x1fc]
call fcn.10018124
sub esi, dword [eax]
imul eax, esi, 0x3045
cmp eax, dword [ebp - 0x64]
jge 0x1003ceef
mov dword [ebp - 0x8c8], 1
jmp 0x1003cef6
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x30]
cmp dword [ebp - 0x8c8], eax
je 0x1003cf18
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x30], 0
jne 0x1003cf18
and dword [ebp - 0x610], 0
jmp 0x1003cf22
mov dword [ebp - 0x610], 1
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp + eax*4 - 0x30]
cmp dword [ebp - 0x610], eax
jl 0x1003cf40
mov dword [ebp - 0x7a0], 1
jmp 0x1003cf47
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0xa80], eax
jmp 0x1003cac3
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x94c]
call fcn.100180a0
jmp 0x1003ca44
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x1fc]
call fcn.100180a0
jmp 0x1003c97e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdb0]
call fcn.100180a0
jmp 0x1003c8ea
mov byte [ebp - 0x132], 0
lea eax, [ebp - 0x132]
push eax
push 0
push 0x6f8c
push 0x6d52
push 0x2d19
call fcn.10049577
add esp, 0x14
mov dword [ebp - 0x44], 0x643cdf98
mov dword [ebp - 0xa88], 0x2cf3e4c9
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x1003cff0
push 0x52b
push 0x137f
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
cmp dword [ebp - 0x44], 0
jne 0x1003d023
imul eax, dword [ebp - 0x44], 0x15d1
test eax, eax
je 0x1003d013
cmp dword [ebp - 0x44], 0
je 0x1003d013
mov dword [ebp - 0x618], 1
jmp 0x1003d01a
and dword [ebp - 0x618], 0
cmp dword [ebp - 0x618], 0
jg 0x1003d035
cmp dword [ebp - 0x44], 0
je 0x1003d035
mov dword [ebp - 0x868], 1
jmp 0x1003d03c
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x868], eax
jle 0x1003d053
mov dword [ebp - 0x620], 1
jmp 0x1003d05a
and dword [ebp - 0x620], 0
cmp dword [ebp - 0x620], 0xc9cd49fc
jbe 0x1003d072
mov dword [ebp - 0x7a8], 1
jmp 0x1003d079
and dword [ebp - 0x7a8], 0
cmp dword [ebp - 0x7a8], 0x9c3
jg 0x1003d097
cmp dword [ebp - 0x44], 0
je 0x1003d097
mov dword [ebp - 0x628], 1
jmp 0x1003d09e
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x628]
jg 0x1003d0cf
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x1003d0ca
push 0
push 0xfc5
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
jmp 0x1003d2f4
mov dword [ebp - 0x168], 0x60016488
mov dword [ebp - 0x870], 0xfffffff8
or dword [ebp - 0xd40], 0xffffffff
or dword [ebp - 0xd3c], 0xffffffff
or dword [ebp - 0xd38], 0xffffffff
or dword [ebp - 0xd34], 0xffffffff
lea ecx, [ebp - 0x2ed]
call fcn.1001818e
push eax
lea eax, [ebp - 0xd30]
push eax
lea eax, [ebp - 0xd40]
push eax
lea ecx, [ebp - 0x11f0]
call fcn.10018191
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xdc8]
call fcn.1001807a
mov dword [ebp - 4], 0x18
cmp dword [ebp - 0x44], 0
jne 0x1003d14d
mov dword [ebp - 0x648], 1
jmp 0x1003d154
and dword [ebp - 0x648], 0
cmp dword [ebp - 0x168], 0
jne 0x1003d237
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xec4], eax
mov eax, 0x656540f2
test eax, eax
je 0x1003d18b
mov eax, 0xb8e00457
test eax, eax
je 0x1003d18b
mov dword [ebp - 0x888], 1
jmp 0x1003d192
and dword [ebp - 0x888], 0
cmp dword [ebp - 0x888], 0xfff8
jb 0x1003d1aa
mov dword [ebp - 0x630], 1
jmp 0x1003d1b1
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x630]
je 0x1003d1c8
mov dword [ebp - 0x7b0], 1
jmp 0x1003d1cf
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x7b0], eax
jne 0x1003d1e9
mov dword [ebp - 0x638], 1
jmp 0x1003d1f0
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x638]
inc eax
mov dword [ebp - 0x870], eax
mov eax, dword [ebp - 0x870]
sub eax, 0x435e
cmp eax, dword [ebp - 0x168]
jne 0x1003d21c
mov dword [ebp - 0x640], 1
jmp 0x1003d223
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x640]
sub eax, dword [ebp - 0x44]
jne 0x1003d237
and dword [ebp - 0x7b8], 0
jmp 0x1003d241
mov dword [ebp - 0x7b8], 1
imul eax, dword [ebp - 0x7b8], 0x5ab1
cmp eax, dword [ebp - 0x168]
jg 0x1003d25f
mov dword [ebp - 0x88c], 1
jmp 0x1003d266
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x648]
cmp eax, dword [ebp - 0x88c]
jl 0x1003d286
mov eax, 0xa325
test eax, eax
jne 0x1003d286
and dword [ebp - 0x38c], 0
jmp 0x1003d290
mov dword [ebp - 0x38c], 1
push 2
lea ecx, [ebp - 0xdc8]
call fcn.10018124
mov ecx, dword [ebp - 0x38c]
mov dword [eax], ecx
cmp dword [ebp - 0x38c], 0x6284
jle 0x1003d2bd
mov dword [ebp - 0xc0c], 1
jmp 0x1003d2c4
and dword [ebp - 0xc0c], 0
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xf10], eax
push 0
lea ecx, [ebp - 0xdc8]
call fcn.10018124
mov eax, dword [eax]
mov dword [ebp - 0xa88], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc8]
call fcn.100180a0
and dword [ebp - 0x33c], 0
jmp 0x1003d313
mov eax, dword [ebp - 0x2a4]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x33c], eax
jge 0x1004144d
mov dword [ebp - 0xa4], 0xb4ffb871
mov dword [ebp - 0xb80], 0x1dbdae4
push 1
lea ecx, [ebp - 0xde0]
call fcn.1001803e
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x26c], 0
jmp 0x1003d36c
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 1
jge 0x1003d38e
push dword [ebp - 0x26c]
lea ecx, [ebp - 0xde0]
call fcn.10018124
mov dword [eax], 1
jmp 0x1003d35f
cmp dword [ebp - 0xa4], 0
jne 0x1003d46e
cmp dword [ebp - 0xa4], 0xb0a
jl 0x1003d3b3
mov dword [ebp - 0x650], 1
jmp 0x1003d3ba
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x650], eax
jg 0x1003d3d4
mov dword [ebp - 0x7c0], 1
jmp 0x1003d3db
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x7c0], eax
jne 0x1003d3f5
mov dword [ebp - 0x658], 1
jmp 0x1003d3fc
and dword [ebp - 0x658], 0
cmp dword [ebp - 0x658], 0xccfd66c4
jb 0x1003d414
mov dword [ebp - 0x878], 1
jmp 0x1003d41b
and dword [ebp - 0x878], 0
mov eax, dword [ebp - 0xa4]
sub eax, dword [ebp - 0x878]
imul eax, dword [ebp - 0xa4]
sub eax, 5
imul eax, eax, 0x8bc0
add eax, 4
cmp eax, 1
jae 0x1003d44b
mov dword [ebp - 0x660], 1
jmp 0x1003d452
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0x660]
cmp eax, 0x2cb51dba
jne 0x1003d46e
and dword [ebp - 0x7c8], 0
jmp 0x1003d478
mov dword [ebp - 0x7c8], 1
mov eax, dword [ebp - 0x7c8]
mov dword [ebp - 0xb80], eax
push 1
push 1
push 0x6ea6
lea eax, [ebp - 0xa4]
push eax
push 0
push 0x3da0
lea eax, [ebp - 0xde0]
push eax
push 0x79fb
call fcn.10032fe6
add esp, 0x20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xde0]
call fcn.100180a0
mov eax, dword [ebp - 0x60]
cmp dword [eax + 0x10], 0
jne 0x10040774
mov dword [ebp - 0x158], 0x5e7a66fe
mov dword [ebp - 0xaa0], 0xfffffffa
mov dword [ebp - 0xb88], 0xfffffff8
mov dword [ebp - 0xbfc], 0
mov dword [ebp - 0xd68], 0xcced
mov dword [ebp - 0xd64], 0xcced
mov dword [ebp - 0xd60], 0xcced
mov dword [ebp - 0xd5c], 0xcced
lea ecx, [ebp - 0x37e]
call fcn.1001818e
push eax
lea eax, [ebp - 0xd58]
push eax
lea eax, [ebp - 0xd68]
push eax
lea ecx, [ebp - 0x1208]
call fcn.10018191
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x10e0]
call fcn.1001807a
mov dword [ebp - 4], 0x1a
push 0x403a
push 0x7f4c
lea eax, [ebp - 0x158]
push eax
push 0
push 0x4616
push 0x5912
push 1
push 0x6ae1
push 1
push 0x3263
push 0x739a
push 0x2883
call fcn.1002f4cc
add esp, 0x30
mov dword [ebp - 0x158], 0
jmp 0x1003d5ad
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 1
je 0x1003d6de
push 2
lea ecx, [ebp - 0xe04]
call fcn.1001803e
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0xa90], 0xc2132456
mov dword [ebp - 0xa98], 0xffffffff
mov dword [ebp - 0x2c4], 0
jmp 0x1003d5f8
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 2
jge 0x1003d61a
push dword [ebp - 0x2c4]
lea ecx, [ebp - 0xe04]
call fcn.10018124
mov dword [eax], 6
jmp 0x1003d5eb
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x1003d639
push 0x2452
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
lea eax, [ebp - 0xa90]
push eax
lea eax, [ebp - 0x158]
push eax
push 0x799a
push 0x2489
push 0x4cf2
push 0x220d
lea eax, [ebp - 0xbfc]
push eax
push 0x58ce
push 0x13d
push 0x7f66
push 1
lea eax, [ebp - 0xa98]
push eax
lea eax, [ebp - 0xb88]
push eax
push 0x21a2
push 0x4e36
lea eax, [ebp - 0xe04]
push eax
push 0x5b3f
push 0x67ef
push 1
lea eax, [ebp - 0x10e0]
push eax
push 0x7866
push 0x56b
push 0
lea eax, [ebp - 0xaa0]
push eax
push 0x3ee5
push 0x5399
call fcn.10035a65
add esp, 0x68
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xe04]
call fcn.100180a0
jmp 0x1003d5a0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10e0]
call fcn.100180a0
push 1
lea ecx, [ebp - 0x1e4]
call fcn.1001803e
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x274], 0xf34ea885
mov dword [ebp - 0x4c], 0
jmp 0x1003d71b
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x1003d731
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x1f0], 0x64a6847d
jmp 0x1003d714
lea eax, [ebp - 0x4c]
push eax
push 1
push 0x33bb
push 0x712
push 0
lea eax, [ebp - 0x1e4]
push eax
push 0x27d9
call fcn.10032a4a
add esp, 0x1c
mov dword [ebp - 0x4c], 0
jmp 0x1003d767
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1003d77d
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x100], 0xc525
jmp 0x1003d760
push 0
lea ecx, [ebp - 0x1e4]
call fcn.10018124
mov dword [eax], 2
jmp 0x1003d7b6
push 0
lea ecx, [ebp - 0x1e4]
call fcn.10018124
mov dword [ebp - 0x668], eax
mov eax, dword [ebp - 0x668]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x668]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1e4]
call fcn.10018124
cmp dword [eax], 0
jl 0x1003da84
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0x3cc], 0
mov dword [ebp - 0xab0], 0x8bee6da
mov dword [ebp - 0xf8], 0
jmp 0x1003d803
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jg 0x1003d85c
mov dword [ebp - 0xc10], 0xfc4f27d2
push 0
lea ecx, [ebp - 0x1e4]
call fcn.10018124
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf8]
mov ecx, dword [ebp + ecx*4 - 0x1f0]
cmp dword [ebp + eax*4 - 0x1f0], ecx
je 0x1003d847
mov dword [ebp - 0x884], 1
jmp 0x1003d84e
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0xc10], eax
jmp 0x1003d7f6
mov dword [ebp - 0xf8], 0xa
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f0]
cmp eax, dword [ebp - 0xf8]
jge 0x1003d887
mov dword [ebp - 0x7d0], 1
jmp 0x1003d88e
and dword [ebp - 0x7d0], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1f0], 0xf885
je 0x1003d8ad
mov dword [ebp - 0x670], 1
jmp 0x1003d8b4
and dword [ebp - 0x670], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x1f0]
imul esi, dword [ebp - 0x670]
push 0
lea ecx, [ebp - 0x1e4]
call fcn.10018124
cmp esi, dword [eax]
jge 0x1003d8e5
mov dword [ebp - 0x678], 1
jmp 0x1003d8ec
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x7d0]
cmp eax, dword [ebp - 0x678]
jge 0x1003d91f
push 0
lea ecx, [ebp - 0x1e4]
call fcn.10018124
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x1f0], 0
je 0x1003d91f
mov dword [ebp - 0x3c8], 1
jmp 0x1003d926
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x3cc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f0]
cmp dword [ebp - 0x3cc], eax
jg 0x1003d953
mov dword [ebp - 0xaa8], 1
jmp 0x1003d95a
and dword [ebp - 0xaa8], 0
push 0
lea ecx, [ebp - 0x1e4]
call fcn.10018124
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1f0]
mov dword [ebp - 0xecc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f0]
sub eax, 0x6af30202
je 0x1003d9af
push 0
lea ecx, [ebp - 0x1e4]
call fcn.10018124
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x1f0], 0
je 0x1003d9af
mov dword [ebp - 0xb90], 1
jmp 0x1003d9b6
and dword [ebp - 0xb90], 0
push 0
lea ecx, [ebp - 0x1e4]
call fcn.10018124
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1f0]
mov dword [ebp - 0xf18], eax
push 0
lea ecx, [ebp - 0x1e4]
call fcn.10018124
push 0
lea ecx, [ebp - 0x1e4]
call fcn.10018124
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x1f0], 1
jbe 0x1003da04
mov dword [ebp - 0x3d4], 1
jmp 0x1003da0b
and dword [ebp - 0x3d4], 0
push 0
lea ecx, [ebp - 0x1e4]
call fcn.10018124
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1f0]
cmp dword [ebp - 0x3d4], eax
jge 0x1003da35
mov dword [ebp - 0x3dc], 1
jmp 0x1003da3c
and dword [ebp - 0x3dc], 0
push 0
lea ecx, [ebp - 0x1e4]
call fcn.10018124
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1f0]
add eax, dword [ebp - 0x3dc]
cmp eax, dword [ebp - 0xab0]
jge 0x1003da6c
mov dword [ebp - 0x3e4], 1
jmp 0x1003da73
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x274], eax
jmp 0x1003d792
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x100], 0
jne 0x1003dace
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x100]
mov dword [ebp - 0x3ec], eax
push 0
lea ecx, [ebp - 0x1e4]
call fcn.10018124
mov ecx, dword [ebp - 0x3ec]
mov dword [eax], ecx
cmp dword [ebp - 0x3ec], 0
jne 0x1003dace
and dword [ebp - 0x3f4], 0
jmp 0x1003dad8
mov dword [ebp - 0x3f4], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1f0]
cmp eax, dword [ebp - 0x3f4]
je 0x1003daf8
mov dword [ebp - 0x3fc], 1
jmp 0x1003daff
and dword [ebp - 0x3fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x100]
cmp dword [ebp - 0x3fc], eax
jg 0x1003db20
mov dword [ebp - 0x404], 1
jmp 0x1003db27
and dword [ebp - 0x404], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f0]
cmp dword [ebp - 0x404], eax
jne 0x1003db48
mov dword [ebp - 0x40c], 1
jmp 0x1003db4f
and dword [ebp - 0x40c], 0
cmp dword [ebp - 0x40c], 0xa839
jl 0x1003db67
mov dword [ebp - 0x414], 1
jmp 0x1003db6e
and dword [ebp - 0x414], 0
cmp dword [ebp - 0x414], 0xfffb
jne 0x1003db86
mov dword [ebp - 0x41c], 1
jmp 0x1003db8d
and dword [ebp - 0x41c], 0
xor eax, eax
sub eax, dword [ebp - 0x41c]
cmp eax, 0xfffffff8
jge 0x1003dba6
mov dword [ebp - 0x424], 1
jmp 0x1003dbad
and dword [ebp - 0x424], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x424]
sub ecx, dword [ebp + eax - 0x100]
cmp ecx, dword [ebp - 0x274]
jl 0x1003dbe4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x100], 0
je 0x1003dbe4
mov dword [ebp - 0x42c], 1
jmp 0x1003dbeb
and dword [ebp - 0x42c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x100]
cmp dword [ebp - 0x42c], eax
jge 0x1003dc0c
mov dword [ebp - 0x434], 1
jmp 0x1003dc13
and dword [ebp - 0x434], 0
cmp dword [ebp - 0x434], 0xfffffffd
jle 0x1003dc2e
mov eax, 0x236bbbd2
test eax, eax
jne 0x1003dc2e
and dword [ebp - 0x43c], 0
jmp 0x1003dc38
mov dword [ebp - 0x43c], 1
cmp dword [ebp - 0x43c], 0x7887
jne 0x1003dc50
mov dword [ebp - 0x444], 1
jmp 0x1003dc57
and dword [ebp - 0x444], 0
cmp dword [ebp - 0x444], 0x2392
jle 0x1003dc6f
mov dword [ebp - 0x44c], 1
jmp 0x1003dc76
and dword [ebp - 0x44c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x100]
cmp dword [ebp - 0x44c], eax
je 0x1003dc97
mov dword [ebp - 0x454], 1
jmp 0x1003dc9e
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x274]
cmp dword [ebp - 0x454], eax
jle 0x1003dcb8
mov dword [ebp - 0x45c], 1
jmp 0x1003dcbf
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x274], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1e4]
call fcn.100180a0
mov dword [ebp - 0x1a0], 0x1836ccb0
mov dword [ebp - 0x464], 0xfffffff7
mov dword [ebp - 0x37c], 0xfb1c0380
push 3
lea ecx, [ebp - 0xdf8]
call fcn.1001803e
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x198], 0
jmp 0x1003dd25
cmp dword [ebp - 0x198], 1
jge 0x1003dd41
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0xc04], 0xcd9d7
jmp 0x1003dd18
push 0x7962
push 0x3979
push 0x503
push 0x2f17
push 0x6e97
push 0
lea eax, [ebp - 0xdf8]
push eax
lea eax, [ebp - 0x198]
push eax
push 0x32e1
push 1
push 0x6bbe
push 0x70a0
call fcn.10042aa3
add esp, 0x30
mov byte [ebp - 0x12e], 0
movzx eax, byte [ebp - 0x12e]
test eax, eax
je 0x1003dd9d
mov dword [ebp - 0xadc], 0xfff7
mov dword [ebp - 0x1d8], 0xfffffffc
push 0x6dba
push 1
push 1
push 0x12d5
push 0x780a
push 0x52fd
push 0x6946
push 0x3c59
lea eax, [ebp - 0x1d8]
push eax
lea eax, [ebp - 0xadc]
push eax
push 0x7d48
push 0
push 0x7963
push 0x1ea2
push 0x13f7
push 0x3d69
push 0x6b8f
call fcn.1002e013
add esp, 0x44
mov dword [ebp - 0x1d8], 0xfffffff6
jmp 0x100407f9
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0x11
jle 0x10040860
mov byte [ebp - 0x119], 0
movzx eax, byte [ebp - 0x119]
test eax, eax
je 0x1004085e
push 0x3a06
push 0x9be
push 0x5e42
push 1
push 0x3eef
push 0x4bb4
push 0x529f
push 0x3047
push 0x7550
push 0x1d77
push 0x592
push 1
push 0
push 0x555c
push 0x2dd2
call fcn.1004592c
add esp, 0x3c
jmp 0x100407ec
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x204], 0xfffffff8
jmp 0x10040883
mov eax, dword [ebp - 0x204]
dec eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0xfffffff3
jg 0x100408b9
mov dword [ebp - 0xae4], 0
push 0x62e0
push 0x56e6
push 1
push 0
call fcn.1003008e
add esp, 0x10
cmp dword [ebp - 0xae4], 0
je 0x100408b7
jmp 0x10040876
jmp 0x10040876
mov dword [ebp - 0x208], 0x831713b9
mov dword [ebp - 0xafc], 1
mov dword [ebp - 0xaec], 0x82a10aa4
mov dword [ebp - 0x208], 0
jmp 0x100408f0
mov eax, dword [ebp - 0x208]
dec eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0xfffffffe
jge 0x10040993
mov dword [ebp - 0xaf4], 0x4e7937d8
push 0x5765
push 0x56a2
push 0x6112
push 0x6fff
push 0x2166
push 0x2f4a
push 0x4777
push 0x6155
lea eax, [ebp - 0xaec]
push eax
push 0x3dcf
push 0
push 0x4422
push 0x52cc
lea eax, [ebp - 0xaf4]
push eax
push 0x5459
push 0x73b
push 0x7fb0
push 0x1106
push 1
push 0x55c2
push 0xda1
lea eax, [ebp - 0xafc]
push eax
push 1
push 0x165c
push 0x598a
push 0x355c
call fcn.10035a65
add esp, 0x68
jmp 0x100408e3
mov dword [ebp - 0xb0c], 1
mov dword [ebp - 0x1084], 9
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x100409cd
push 0
push 0xc2f
push 0
push 0x1f3b
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov byte [ebp - 0xbe], 0
movzx eax, byte [ebp - 0xbe]
test eax, eax
je 0x100409ea
push 0x449
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov dword [ebp - 0x2d8], 0xd49fcfbc
push 1
lea ecx, [ebp - 0x3b4]
call fcn.1001803e
mov dword [ebp - 4], 0x25
mov dword [ebp - 0x2b8], 0
jmp 0x10040a21
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 1
jge 0x10040a43
push dword [ebp - 0x2b8]
lea ecx, [ebp - 0x3b4]
call fcn.10018124
mov dword [eax], 3
jmp 0x10040a14
push 0
lea ecx, [ebp - 0x3b4]
call fcn.10018124
mov dword [eax], 0xa
jmp 0x10040a7c
push 0
lea ecx, [ebp - 0x3b4]
call fcn.10018124
mov dword [ebp - 0x7d4], eax
mov eax, dword [ebp - 0x7d4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x7d4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x3b4]
call fcn.10018124
cmp dword [eax], 0xc
jg 0x10040aaf
mov dword [ebp - 0xb04], 0
push 0
lea ecx, [ebp - 0x3b4]
call fcn.10018124
mov eax, dword [eax]
mov dword [ebp - 0xb04], eax
jmp 0x10040a58
push 0
lea ecx, [ebp - 0x3b4]
call fcn.10018124
mov esi, eax
push 0
lea ecx, [ebp - 0x3b4]
call fcn.10018124
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x10040add
mov dword [ebp - 0x7dc], 1
jmp 0x10040ae4
and dword [ebp - 0x7dc], 0
push 0
lea ecx, [ebp - 0x3b4]
call fcn.10018124
mov ecx, dword [ebp - 0x7dc]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3b4]
call fcn.100180a0
mov dword [ebp - 0x2d0], 0x8461e707
mov dword [ebp - 0x214], 6
mov dword [ebp - 0x164], 0xb870004d
mov dword [ebp - 0x350], 0
mov dword [ebp - 0x2c8], 0
mov dword [ebp - 0xfbc], 0x4d633c66
mov dword [ebp - 0x834], 0
mov dword [ebp - 0xb3c], 0xffffffff
mov dword [ebp - 0xb44], 0xc34f9703
mov dword [ebp - 0x340], 0x5175
mov dword [ebp - 0x2c0], 0
jmp 0x10040b85
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 2
jge 0x10040ba1
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0xcc0], 0xeda7da9f
jmp 0x10040b78
push 0
push 0x5eb8
lea eax, [ebp - 0x2d8]
push eax
push 1
lea eax, [ebp - 0x164]
push eax
push 0x329f
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x350]
push eax
push 1
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0xb0c]
push eax
push 0x6edd
call fcn.10042e8b
add esp, 0x30
mov dword [ebp - 0x164], 0xc
jmp 0x10040c01
mov eax, dword [ebp - 0x164]
dec eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0xfffffff5
jne 0x10040ffe
push 1
lea ecx, [ebp - 0x938]
call fcn.1001803e
mov dword [ebp - 4], 0x26
mov dword [ebp - 0xb14], 2
mov dword [ebp - 0x804], 0x4c996e15
mov dword [ebp - 0xb4c], 0
mov dword [ebp - 0x2e0], 0x2ad9236
mov dword [ebp - 0xb1c], 0x71799991
mov dword [ebp - 0x84c], 0x2d14a59
mov dword [ebp - 0x86c], 0xfffffff6
mov dword [ebp - 0xb2c], 0x21847726
mov dword [ebp - 0xb34], 0
mov dword [ebp - 0x112c], 0xfffffff9
push 0
push 0
push 0xe75
lea eax, [ebp - 0xfc4]
push eax
lea eax, [ebp - 0x938]
push eax
call fcn.10037479
add esp, 0x14
push 0
lea ecx, [ebp - 0x938]
call fcn.10018124
cmp dword [eax], 0
jne 0x10040ec8
mov dword [ebp - 0x2d8], 0xc80f3bba
mov eax, dword [ebp - 0x340]
dec eax
mov dword [ebp - 0x340], eax
je 0x10040da0
mov eax, dword [ebp - 0x214]
cmp dword [ebp - 0x86c], eax
jl 0x10040cf2
mov dword [ebp - 0x7e4], 1
jmp 0x10040cf9
and dword [ebp - 0x7e4], 0
mov esi, dword [ebp - 0x7e4]
sub esi, dword [ebp - 0xb14]
neg esi
push 0
lea ecx, [ebp - 0x938]
call fcn.10018124
cmp esi, dword [eax]
je 0x10040d24
mov dword [ebp - 0x7ec], 1
jmp 0x10040d2b
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0x7ec], eax
jne 0x10040d45
mov dword [ebp - 0x348], 1
jmp 0x10040d4c
and dword [ebp - 0x348], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x348]
mov dword [ebp + eax - 0xcc0], ecx
mov eax, dword [ebp - 0x804]
add eax, dword [ebp - 0x348]
cmp eax, dword [ebp - 0x2c8]
jge 0x10040d7f
mov dword [ebp - 0x7f4], 1
jmp 0x10040d86
and dword [ebp - 0x7f4], 0
mov eax, dword [ebp - 0x2c8]
cmp dword [ebp - 0x7f4], eax
jl 0x10040da0
mov dword [ebp - 0x7fc], 1
jmp 0x10040da7
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x7fc]
sub eax, 0xd90b
cmp eax, dword [ebp - 0x804]
jne 0x10040dc6
mov dword [ebp - 0x80c], 1
jmp 0x10040dcd
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x834]
cmp dword [ebp - 0x80c], eax
jne 0x10040de7
mov dword [ebp - 0x814], 1
jmp 0x10040dee
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0x814], eax
jl 0x10040e0e
cmp dword [ebp - 0xb1c], 0
jne 0x10040e0e
and dword [ebp - 0x81c], 0
jmp 0x10040e18
mov dword [ebp - 0x81c], 1
mov eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0x81c], eax
je 0x10040e32
mov dword [ebp - 0x824], 1
jmp 0x10040e39
and dword [ebp - 0x824], 0
cmp dword [ebp - 0x824], 0
jg 0x10040e4e
mov dword [ebp - 0x82c], 1
jmp 0x10040e55
and dword [ebp - 0x82c], 0
cmp dword [ebp - 0x82c], 0xd188
jle 0x10040e6d
mov dword [ebp - 0x844], 1
mov eax, dword [ebp - 0x844]
mov dword [ebp - 0x84c], eax
cmp dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0xb34]
cmp dword [ebp - 0x84c], eax
jne 0x10040eff
mov dword [ebp - 0x854], 1
jmp 0x10040f06
and dword [ebp - 0x854], 0
cmp dword [ebp - 0x854], 0xf523
jg 0x10040f1e
mov dword [ebp - 0x85c], 1
jmp 0x10040f25
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0x85c]
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0xb3c]
mov dword [ebp - 0xfcc], eax
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0xe1c], eax
mov eax, dword [ebp - 0xb44]
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0xb4c]
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0xe20], eax
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0xe28], eax
mov esi, dword [ebp - 0x214]
push 0
lea ecx, [ebp - 0x938]
call fcn.10018124
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x938]
call fcn.10018124
cmp esi, dword [eax]
jl 0x10040fac
mov dword [ebp - 0x864], 1
jmp 0x10040fb3
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0xe30], eax
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0xe38], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xcc0]
mov dword [ebp - 0x214], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x938]
call fcn.100180a0
jmp 0x10040bf4
push 4
push 0x1000
mov eax, dword [ebp - 0x60]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x874]
add ecx, dword [eax + 0xc]
push ecx
push 0x1881
push 0x19f1
call fcn.100298f2
pop ecx
pop ecx
call eax
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0x60]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0xb54]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x358]
call fcn.10029aa6
add esp, 0xc
mov dword [ebp - 0x1b4], 0x24a8c6a5
mov dword [ebp - 0xb74], 0x4feccdf
mov dword [ebp - 0xb6c], 0x283d3454
mov dword [ebp - 0x1b4], 0
jmp 0x10041089
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0x13
jne 0x100412e9
mov dword [ebp - 0xcdc], 0x69f4288a
mov dword [ebp - 0xcd8], 0x69f4288a
mov dword [ebp - 0xcd4], 0x69f4288a
mov dword [ebp - 0xcd0], 0x69f4288a
lea ecx, [ebp - 0x35d]
call fcn.1001818e
push eax
lea eax, [ebp - 0xccc]
push eax
lea eax, [ebp - 0xcdc]
push eax
lea ecx, [ebp - 0x1210]
call fcn.10018191
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xdec]
call fcn.1001807a
mov dword [ebp - 4], 0x27
mov dword [ebp - 0x16c], 0xcb03629a
mov dword [ebp - 0xb5c], 0xb017290b
mov dword [ebp - 0x8a4], 0
mov dword [ebp - 0x16c], 3
jmp 0x10041131
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
jl 0x100412d5
push 3
lea ecx, [ebp - 0x920]
call fcn.1001803e
mov byte [ebp - 4], 0x28
push 0
lea eax, [ebp - 0x920]
push eax
push 1
push 1
push 0x31f0
lea eax, [ebp - 0xe40]
push eax
push 0x4fb0
call fcn.10031b90
add esp, 0x1c
push 1
lea ecx, [ebp - 0x920]
call fcn.10018124
mov dword [eax], 3
jmp 0x100411ae
push 1
lea ecx, [ebp - 0x920]
call fcn.10018124
cmp dword [eax], 0
jl 0x100412c1
mov dword [ebp - 0x174], 7
mov dword [ebp - 0xb64], 0xc3e5f88
push 0
push 0x3603
push 0x402d
push 0
lea eax, [ebp - 0xdec]
push eax
push 0x4b64
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x920]
push eax
lea eax, [ebp - 0x1b4]
push eax
lea eax, [ebp - 0xb5c]
push eax
lea eax, [ebp - 0xb64]
push eax
lea eax, [ebp - 0x8a4]
push eax
call fcn.1002fc07
add esp, 0x34
mov dword [ebp - 0x174], 0
jmp 0x10041244
cmp dword [ebp - 0x174], 3
jg 0x100412bc
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x920]
call fcn.100180a0
jmp 0x10041124
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdec]
call fcn.100180a0
jmp 0x1004107c
mov byte [ebp - 0xc2], 0
lea eax, [ebp - 0xc2]
push eax
push 0x3452
push 1
push 0
call fcn.10043aab
add esp, 0x10
mov dword [ebp - 0xe48], 0x13638ecf
mov dword [ebp - 0xe50], 4
mov dword [ebp - 0xe58], 1
mov dword [ebp - 0xe60], 0xffffffff
mov dword [ebp - 0xe68], 0x26ff23b1
mov dword [ebp - 0xe70], 0
mov dword [ebp - 0xe78], 1
mov dword [ebp - 0x1160], 0x31c5
mov dword [ebp - 0x115c], 0x31c5
mov dword [ebp - 0x1158], 0x31c5
mov dword [ebp - 0x1154], 0x31c5
mov dword [ebp - 0xe80], 0xc4df8e3b
mov dword [ebp - 0x8ac], 0x7b83
mov dword [ebp - 0xe88], 0xfffffffb
mov dword [ebp - 0x88], 0
jmp 0x100413ad
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x100413c9
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x11e8], 0xfffffffb
jmp 0x100413a0
mov dword [ebp - 0x88], 0
jmp 0x100413e2
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x100413fe
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x123c], 0x5165352f
jmp 0x100413d5
mov byte [ebp - 0xc4], 0
movzx eax, byte [ebp - 0xc4]
test eax, eax
je 0x10041424
push 0x4cda
push 0
push 0x3a55
call fcn.10044e76
add esp, 0xc
mov eax, dword [ebp - 0x8ac]
inc eax
mov dword [ebp - 0x8ac], eax
lea eax, [ebp - 0x358]
push eax
push 0
lea eax, [ebp - 0x60]
push eax
push 1
call fcn.10038ee0
add esp, 0x10
jmp 0x1003d2fd
jmp 0x10041460
push 1
push 0x41ee
push 7
call fcn.10030167
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret