Function at 0x101a9760
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102317b2
mov eax, dword fs:[0]
push eax
mov eax, 0x12ac
call fcn.101fc990
mov eax, dword [0x102d944c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c8], ecx
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2bc], 0
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2c4], 0
mov eax, dword [0x103f6504]
mov dword [ebp - 0xf94], eax
mov dword [ebp - 0xd74], 0x100f2c40
mov ecx, dword [ebp - 0xd74]
mov dword [ebp - 0xe3c], ecx
mov edx, dword [0x1054e05c]
mov eax, dword [edx + 8]
mov dword [ebp - 0xed8], eax
mov ecx, dword [ebp - 0xe3c]
push ecx
push 0xfffffffffffffffc
mov edx, dword [ebp - 0xed8]
push edx
call dword [ebp - 0xf94]
mov ecx, dword [ebp - 0x2c8]
mov dword [ecx + 0xbf8], eax
mov edx, dword [ebp - 0x2c8]
add edx, 4
mov dword [ebp - 0x2fc], edx
mov eax, dword [0x1054dff4]
mov dword [ebp - 0xf9c], eax
lea ecx, [ebp - 0x334]
mov dword [ebp - 0x618], ecx
mov edx, dword [ebp - 0x618]
mov eax, dword [ebp - 0xf9c]
mov dword [edx], eax
mov ecx, dword [ebp - 0x618]
mov dword [ebp - 0x10c0], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x2fc]
mov eax, dword [ebp - 0x334]
mov dword [edx], eax
mov ecx, dword [ebp - 0x334]
mov edx, dword [ecx]
mov dword [ebp - 0xfac], edx
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [ebp - 0xfac]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x2fc]
cmp dword [edx + 4], 0
jne 0x101a9899
mov dword [ebp - 4], 0xffffffff
jmp 0x101a9ad4
mov dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x3e4]
mov eax, dword [ecx + edx*4]
mov dword [ebp - 0x698], eax
cmp dword [ebp - 0x698], 0
jne 0x101a98cd
mov byte [ebp - 0x2ce], 0
jmp 0x101a9925
mov ecx, dword [0x103f6500]
mov dword [ebp - 0xfb4], ecx
push 0x1c
lea edx, [ebp - 0xcc]
push edx
mov eax, dword [ebp - 0x698]
push eax
call dword [ebp - 0xfb4]
test eax, eax
jne 0x101a98fc
mov byte [ebp - 0x2ce], 0
jmp 0x101a9925
mov ecx, dword [ebp - 0xb8]
and ecx, 1
jne 0x101a9915
mov edx, dword [ebp - 0xb8]
and edx, 0x100
je 0x101a991e
mov byte [ebp - 0x2ce], 0
jmp 0x101a9925
mov byte [ebp - 0x2ce], 1
movzx eax, byte [ebp - 0x2ce]
test eax, eax
je 0x101a9944
mov ecx, dword [ebp - 0x3e4]
add ecx, 1
mov dword [ebp - 0x3e4], ecx
jmp 0x101a98a3
mov edx, dword [ebp - 0x2fc]
mov eax, dword [ebp - 0x3e4]
mov dword [edx + 0xc], eax
mov ecx, dword [ebp - 0x2fc]
cmp dword [ecx + 0xc], 0
jne 0x101a996b
mov dword [ebp - 4], 0xffffffff
jmp 0x101a9ad4
mov edx, 1
test edx, edx
je 0x101a9988
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [eax + 0xc]
add ecx, 1
mov dword [ebp - 0x6b0], ecx
jmp 0x101a9997
mov edx, dword [ebp - 0x2fc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x6b0], eax
mov edx, dword [ebp - 0x6b0]
lea ecx, [ebp - 0xfcc]
call fcn.100d4cd0
mov dword [ebp - 0xfc4], eax
mov ecx, dword [ebp - 0xfc4]
push ecx
mov ecx, dword [ebp - 0x2fc]
add ecx, 8
call fcn.100d4d70
lea ecx, [ebp - 0xfcc]
call fcn.100d47e0
mov ecx, dword [ebp - 0x2fc]
add ecx, 8
call fcn.100d47b0
movzx edx, al
test edx, edx
jne 0x101a99ef
mov dword [ebp - 4], 0xffffffff
jmp 0x101a9ad4
mov ecx, dword [ebp - 0x2fc]
add ecx, 8
call fcn.100d47c0
mov dword [ebp - 0xfdc], eax
mov eax, dword [ebp - 0xfdc]
mov dword [ebp - 0x34], eax
mov ecx, 1
test ecx, ecx
je 0x101a9a88
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0xfe4], edx
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [eax + 0xc]
lea edx, [ecx*4 + 4]
push edx
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [eax + 4]
sub ecx, 4
push ecx
mov edx, dword [ebp - 0xfe4]
push edx
call fcn.101febb0
add esp, 0xc
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xff4], eax
mov ecx, dword [ebp - 0xff4]
add ecx, 4
mov dword [ebp - 0xffc], ecx
cmp dword [ebp - 0x334], 0
jne 0x101a9a6e
jmp 0x101a9a7c
mov edx, dword [ebp - 0x334]
mov eax, dword [ebp - 0xffc]
mov dword [edx], eax
mov ecx, dword [ebp - 0x2fc]
mov byte [ecx + 0x10], 1
jmp 0x101a9acd
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x100c], edx
mov eax, dword [ebp - 0x2fc]
mov ecx, dword [eax + 0xc]
shl ecx, 2
push ecx
mov edx, dword [ebp - 0x2fc]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x100c]
push ecx
call fcn.101febb0
add esp, 0xc
cmp dword [ebp - 0x334], 0
jne 0x101a9ac2
jmp 0x101a9acd
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x334]
mov dword [eax], edx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2c8]
add ecx, 4
mov dword [ebp - 0x338], ecx
mov dword [ebp - 0x1010], 0x101d0950
mov edx, dword [ebp - 0x338]
movzx eax, byte [edx + 0x10]
test eax, eax
je 0x101a9b0b
mov ecx, 0x29
add ecx, 1
mov dword [ebp - 0x6bc], ecx
jmp 0x101a9b15
mov dword [ebp - 0x6bc], 0x29
mov edx, dword [ebp - 0x6bc]
mov dword [ebp - 0x6c8], edx
mov eax, dword [ebp - 0x338]
cmp dword [eax + 4], 0
je 0x101a9b53
mov ecx, dword [ebp - 0x338]
add ecx, 8
call fcn.100d47b0
movzx ecx, al
test ecx, ecx
je 0x101a9b53
mov edx, dword [ebp - 0x338]
mov eax, dword [ebp - 0x6c8]
cmp eax, dword [edx + 0xc]
jbe 0x101a9b7d
mov dword [ebp - 0x484], 0
mov ecx, dword [ebp - 0x2c0]
or ecx, 1
mov dword [ebp - 0x2c0], ecx
lea edx, [ebp - 0x484]
mov dword [ebp - 0x1038], edx
jmp 0x101a9cbc
mov eax, dword [ebp - 0x1010]
mov dword [ebp - 0x1014], eax
mov ecx, dword [ebp - 0x1014]
mov dword [ebp - 0x101c], ecx
mov edx, dword [ebp - 0x338]
add edx, 8
mov dword [ebp - 0x1018], edx
mov eax, dword [ebp - 0x6c8]
push eax
mov ecx, dword [ebp - 0x1018]
call fcn.100d47d0
mov ecx, dword [ebp - 0x101c]
mov dword [eax], ecx
mov edx, 0x29
shl edx, 2
mov eax, dword [ebp - 0x338]
add edx, dword [eax + 4]
mov dword [ebp - 0x708], edx
mov ecx, dword [ebp - 0x708]
cmp dword [ecx], 0
je 0x101a9c23
mov edx, dword [ebp - 0x708]
mov eax, dword [edx]
mov dword [ebp - 0x1020], eax
mov ecx, dword [ebp - 0x1020]
mov dword [ebp - 0x1024], ecx
lea edx, [ebp - 0x1024]
mov dword [ebp - 0x1028], edx
mov eax, dword [ebp - 0x2c0]
or eax, 2
mov dword [ebp - 0x2c0], eax
mov ecx, dword [ebp - 0x1028]
mov dword [ebp - 0x70c], ecx
jmp 0x101a9c54
mov dword [ebp - 0x102c], 0
lea edx, [ebp - 0x102c]
mov dword [ebp - 0x1030], edx
mov eax, dword [ebp - 0x2c0]
or eax, 4
mov dword [ebp - 0x2c0], eax
mov ecx, dword [ebp - 0x1030]
mov dword [ebp - 0x70c], ecx
mov edx, dword [ebp - 0x70c]
mov dword [ebp - 0x1034], edx
mov eax, dword [ebp - 0x1034]
mov ecx, dword [eax]
mov dword [ebp - 0x484], ecx
mov edx, dword [ebp - 0x2c0]
or edx, 8
mov dword [ebp - 0x2c0], edx
mov eax, dword [ebp - 0x2c0]
and eax, 4
je 0x101a9c8f
and dword [ebp - 0x2c0], 0xfffffffb
mov ecx, dword [ebp - 0x2c0]
and ecx, 2
je 0x101a9ca1
and dword [ebp - 0x2c0], 0xfffffffd
mov edx, dword [ebp - 0x2c0]
or edx, 1
mov dword [ebp - 0x2c0], edx
lea eax, [ebp - 0x484]
mov dword [ebp - 0x1038], eax
mov ecx, dword [ebp - 0x2c8]
add ecx, 0x2c
mov dword [ebp - 0x30c], ecx
mov edx, dword [0x1054dfdc]
mov dword [ebp - 0x103c], edx
lea eax, [ebp - 0x32c]
mov dword [ebp - 0x710], eax
mov ecx, dword [ebp - 0x710]
mov edx, dword [ebp - 0x103c]
mov dword [ecx], edx
mov eax, dword [ebp - 0x710]
mov dword [ebp - 0x10c4], eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x30c]
mov edx, dword [ebp - 0x32c]
mov dword [ecx], edx
mov eax, dword [ebp - 0x32c]
mov ecx, dword [eax]
mov dword [ebp - 0x1040], ecx
mov edx, dword [ebp - 0x30c]
mov eax, dword [ebp - 0x1040]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0x30c]
cmp dword [ecx + 4], 0
jne 0x101a9d47
mov dword [ebp - 4], 0xffffffff
jmp 0x101a9f81
mov dword [ebp - 0x3dc], 0
mov edx, dword [ebp - 0x30c]
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 0x3dc]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0x714], edx
cmp dword [ebp - 0x714], 0
jne 0x101a9d7b
mov byte [ebp - 0x2d0], 0
jmp 0x101a9dd2
mov eax, dword [0x103f6500]
mov dword [ebp - 0x1044], eax
push 0x1c
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp - 0x714]
push edx
call dword [ebp - 0x1044]
test eax, eax
jne 0x101a9da9
mov byte [ebp - 0x2d0], 0
jmp 0x101a9dd2
mov eax, dword [ebp - 0xf0]
and eax, 1
jne 0x101a9dc2
mov ecx, dword [ebp - 0xf0]
and ecx, 0x100
je 0x101a9dcb
mov byte [ebp - 0x2d0], 0
jmp 0x101a9dd2
mov byte [ebp - 0x2d0], 1
movzx edx, byte [ebp - 0x2d0]
test edx, edx
je 0x101a9df1
mov eax, dword [ebp - 0x3dc]
add eax, 1
mov dword [ebp - 0x3dc], eax
jmp 0x101a9d51
mov ecx, dword [ebp - 0x30c]
mov edx, dword [ebp - 0x3dc]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x30c]
cmp dword [eax + 0xc], 0
jne 0x101a9e18
mov dword [ebp - 4], 0xffffffff
jmp 0x101a9f81
mov ecx, 1
test ecx, ecx
je 0x101a9e35
mov edx, dword [ebp - 0x30c]
mov eax, dword [edx + 0xc]
add eax, 1
mov dword [ebp - 0x718], eax
jmp 0x101a9e44
mov ecx, dword [ebp - 0x30c]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x718], edx
mov edx, dword [ebp - 0x718]
lea ecx, [ebp - 0x104c]
call fcn.100d4cd0
mov dword [ebp - 0x1048], eax
mov eax, dword [ebp - 0x1048]
push eax
mov ecx, dword [ebp - 0x30c]
add ecx, 8
call fcn.100d4d70
lea ecx, [ebp - 0x104c]
call fcn.100d47e0
mov ecx, dword [ebp - 0x30c]
add ecx, 8
call fcn.100d47b0
movzx ecx, al
test ecx, ecx
jne 0x101a9e9c
mov dword [ebp - 4], 0xffffffff
jmp 0x101a9f81
mov ecx, dword [ebp - 0x30c]
add ecx, 8
call fcn.100d47c0
mov dword [ebp - 0x1050], eax
mov edx, dword [ebp - 0x1050]
mov dword [ebp - 0x18], edx
mov eax, 1
test eax, eax
je 0x101a9f35
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1054], ecx
mov edx, dword [ebp - 0x30c]
mov eax, dword [edx + 0xc]
lea ecx, [eax*4 + 4]
push ecx
mov edx, dword [ebp - 0x30c]
mov eax, dword [edx + 4]
sub eax, 4
push eax
mov ecx, dword [ebp - 0x1054]
push ecx
call fcn.101febb0
add esp, 0xc
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1058], edx
mov eax, dword [ebp - 0x1058]
add eax, 4
mov dword [ebp - 0x105c], eax
cmp dword [ebp - 0x32c], 0
jne 0x101a9f1b
jmp 0x101a9f29
mov ecx, dword [ebp - 0x32c]
mov edx, dword [ebp - 0x105c]
mov dword [ecx], edx
mov eax, dword [ebp - 0x30c]
mov byte [eax + 0x10], 1
jmp 0x101a9f7a
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1060], ecx
mov edx, dword [ebp - 0x30c]
mov eax, dword [edx + 0xc]
shl eax, 2
push eax
mov ecx, dword [ebp - 0x30c]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x1060]
push eax
call fcn.101febb0
add esp, 0xc
cmp dword [ebp - 0x32c], 0
jne 0x101a9f6f
jmp 0x101a9f7a
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x32c]
mov dword [edx], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c8]
add eax, 0x2c
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x1064], 0x101b6aa0
mov ecx, dword [ebp - 0x33c]
movzx edx, byte [ecx + 0x10]
test edx, edx
je 0x101a9fb8
mov eax, 5
add eax, 1
mov dword [ebp - 0x71c], eax
jmp 0x101a9fc2
mov dword [ebp - 0x71c], 5
mov ecx, dword [ebp - 0x71c]
mov dword [ebp - 0x720], ecx
mov edx, dword [ebp - 0x33c]
cmp dword [edx + 4], 0
je 0x101aa000
mov ecx, dword [ebp - 0x33c]
add ecx, 8
call fcn.100d47b0
movzx eax, al
test eax, eax
je 0x101aa000
mov ecx, dword [ebp - 0x33c]
mov edx, dword [ebp - 0x720]
cmp edx, dword [ecx + 0xc]
jbe 0x101aa02a
mov dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x2c0]
or eax, 0x10
mov dword [ebp - 0x2c0], eax
lea ecx, [ebp - 0x488]
mov dword [ebp - 0x7bc], ecx
jmp 0x101aa16c
mov edx, dword [ebp - 0x1064]
mov dword [ebp - 0x1068], edx
mov eax, dword [ebp - 0x1068]
mov dword [ebp - 0x7a0], eax
mov ecx, dword [ebp - 0x33c]
add ecx, 8
mov dword [ebp - 0x79c], ecx
mov edx, dword [ebp - 0x720]
push edx
mov ecx, dword [ebp - 0x79c]
call fcn.100d47d0
mov ecx, dword [ebp - 0x7a0]
mov dword [eax], ecx
mov edx, 5
shl edx, 2
mov eax, dword [ebp - 0x33c]
add edx, dword [eax + 4]
mov dword [ebp - 0x724], edx
mov ecx, dword [ebp - 0x724]
cmp dword [ecx], 0
je 0x101aa0d0
mov edx, dword [ebp - 0x724]
mov eax, dword [edx]
mov dword [ebp - 0x7a4], eax
mov ecx, dword [ebp - 0x7a4]
mov dword [ebp - 0x7a8], ecx
lea edx, [ebp - 0x7a8]
mov dword [ebp - 0x7ac], edx
mov eax, dword [ebp - 0x2c0]
or eax, 0x20
mov dword [ebp - 0x2c0], eax
mov ecx, dword [ebp - 0x7ac]
mov dword [ebp - 0x728], ecx
jmp 0x101aa101
mov dword [ebp - 0x7b0], 0
lea edx, [ebp - 0x7b0]
mov dword [ebp - 0x7b4], edx
mov eax, dword [ebp - 0x2c0]
or eax, 0x40
mov dword [ebp - 0x2c0], eax
mov ecx, dword [ebp - 0x7b4]
mov dword [ebp - 0x728], ecx
mov edx, dword [ebp - 0x728]
mov dword [ebp - 0x7b8], edx
mov eax, dword [ebp - 0x7b8]
mov ecx, dword [eax]
mov dword [ebp - 0x488], ecx
mov edx, dword [ebp - 0x2c0]
or edx, 0x80
mov dword [ebp - 0x2c0], edx
mov eax, dword [ebp - 0x2c0]
and eax, 0x40
je 0x101aa13f
and dword [ebp - 0x2c0], 0xffffffbf
mov ecx, dword [ebp - 0x2c0]
and ecx, 0x20
je 0x101aa151
and dword [ebp - 0x2c0], 0xffffffdf
mov edx, dword [ebp - 0x2c0]
or edx, 0x10
mov dword [ebp - 0x2c0], edx
lea eax, [ebp - 0x488]
mov dword [ebp - 0x7bc], eax
mov ecx, dword [ebp - 0x2c8]
add ecx, 0x2c
mov dword [ebp - 0x330], ecx
mov dword [ebp - 0x7c0], 0x101b6b80
mov edx, dword [ebp - 0x330]
movzx eax, byte [edx + 0x10]
test eax, eax
je 0x101aa1a3
mov ecx, 6
add ecx, 1
mov dword [ebp - 0x72c], ecx
jmp 0x101aa1ad
mov dword [ebp - 0x72c], 6
mov edx, dword [ebp - 0x72c]
mov dword [ebp - 0x730], edx
mov eax, dword [ebp - 0x330]
cmp dword [eax + 4], 0
je 0x101aa1eb
mov ecx, dword [ebp - 0x330]
add ecx, 8
call fcn.100d47b0
movzx ecx, al
test ecx, ecx
je 0x101aa1eb
mov edx, dword [ebp - 0x330]
mov eax, dword [ebp - 0x730]
cmp eax, dword [edx + 0xc]
jbe 0x101aa218
mov dword [ebp - 0x48c], 0
mov ecx, dword [ebp - 0x2c0]
or ecx, 0x100
mov dword [ebp - 0x2c0], ecx
lea edx, [ebp - 0x48c]
mov dword [ebp - 0x7e8], edx
jmp 0x101aa36c
mov eax, dword [ebp - 0x7c0]
mov dword [ebp - 0x7c4], eax
mov ecx, dword [ebp - 0x7c4]
mov dword [ebp - 0x7cc], ecx
mov edx, dword [ebp - 0x330]
add edx, 8
mov dword [ebp - 0x7c8], edx
mov eax, dword [ebp - 0x730]
push eax
mov ecx, dword [ebp - 0x7c8]
call fcn.100d47d0
mov ecx, dword [ebp - 0x7cc]
mov dword [eax], ecx
mov edx, 6
shl edx, 2
mov eax, dword [ebp - 0x330]
add edx, dword [eax + 4]
mov dword [ebp - 0x734], edx
mov ecx, dword [ebp - 0x734]
cmp dword [ecx], 0
je 0x101aa2c0
mov edx, dword [ebp - 0x734]
mov eax, dword [edx]
mov dword [ebp - 0x7d0], eax
mov ecx, dword [ebp - 0x7d0]
mov dword [ebp - 0x7d4], ecx
lea edx, [ebp - 0x7d4]
mov dword [ebp - 0x7d8], edx
mov eax, dword [ebp - 0x2c0]
or eax, 0x200
mov dword [ebp - 0x2c0], eax
mov ecx, dword [ebp - 0x7d8]
mov dword [ebp - 0x738], ecx
jmp 0x101aa2f3
mov dword [ebp - 0x7dc], 0
lea edx, [ebp - 0x7dc]
mov dword [ebp - 0x7e0], edx
mov eax, dword [ebp - 0x2c0]
or eax, 0x400
mov dword [ebp - 0x2c0], eax
mov ecx, dword [ebp - 0x7e0]
mov dword [ebp - 0x738], ecx
mov edx, dword [ebp - 0x738]
mov dword [ebp - 0x7e4], edx
mov eax, dword [ebp - 0x7e4]
mov ecx, dword [eax]
mov dword [ebp - 0x48c], ecx
mov edx, dword [ebp - 0x2c0]
or edx, 0x800
mov dword [ebp - 0x2c0], edx
mov eax, dword [ebp - 0x2c0]
and eax, 0x400
je 0x101aa336
and dword [ebp - 0x2c0], 0xfffffbff
mov ecx, dword [ebp - 0x2c0]
and ecx, 0x200
je 0x101aa34e
and dword [ebp - 0x2c0], 0xfffffdff
mov edx, dword [ebp - 0x2c0]
or edx, 0x100
mov dword [ebp - 0x2c0], edx
lea eax, [ebp - 0x48c]
mov dword [ebp - 0x7e8], eax
mov ecx, dword [ebp - 0x2c8]
add ecx, 0x2c
mov dword [ebp - 0x340], ecx
mov dword [ebp - 0x7ec], 0x101b6ba0
mov edx, dword [ebp - 0x340]
movzx eax, byte [edx + 0x10]
test eax, eax
je 0x101aa3a3
mov ecx, 7
add ecx, 1
mov dword [ebp - 0x73c], ecx
jmp 0x101aa3ad
mov dword [ebp - 0x73c], 7
mov edx, dword [ebp - 0x73c]
mov dword [ebp - 0x740], edx
mov eax, dword [ebp - 0x340]
cmp dword [eax + 4], 0
je 0x101aa3eb
mov ecx, dword [ebp - 0x340]
add ecx, 8
call fcn.100d47b0
movzx ecx, al
test ecx, ecx
je 0x101aa3eb
mov edx, dword [ebp - 0x340]
mov eax, dword [ebp - 0x740]
cmp eax, dword [edx + 0xc]
jbe 0x101aa418
mov dword [ebp - 0x490], 0
mov ecx, dword [ebp - 0x2c0]
or ecx, 0x1000
mov dword [ebp - 0x2c0], ecx
lea edx, [ebp - 0x490]
mov dword [ebp - 0x814], edx
jmp 0x101aa56c
mov eax, dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], eax
mov ecx, dword [ebp - 0x7f0]
mov dword [ebp - 0x7f8], ecx
mov edx, dword [ebp - 0x340]
add edx, 8
mov dword [ebp - 0x7f4], edx
mov eax, dword [ebp - 0x740]
push eax
mov ecx, dword [ebp - 0x7f4]
call fcn.100d47d0
mov ecx, dword [ebp - 0x7f8]
mov dword [eax], ecx
mov edx, 7
shl edx, 2
mov eax, dword [ebp - 0x340]
add edx, dword [eax + 4]
mov dword [ebp - 0x744], edx
mov ecx, dword [ebp - 0x744]
cmp dword [ecx], 0
je 0x101aa4c0
mov edx, dword [ebp - 0x744]
mov eax, dword [edx]
mov dword [ebp - 0x7fc], eax
mov ecx, dword [ebp - 0x7fc]
mov dword [ebp - 0x800], ecx
lea edx, [ebp - 0x800]
mov dword [ebp - 0x804], edx
mov eax, dword [ebp - 0x2c0]
or eax, 0x2000
mov dword [ebp - 0x2c0], eax
mov ecx, dword [ebp - 0x804]
mov dword [ebp - 0x748], ecx
jmp 0x101aa4f3
mov dword [ebp - 0x808], 0
lea edx, [ebp - 0x808]
mov dword [ebp - 0x80c], edx
mov eax, dword [ebp - 0x2c0]
or eax, 0x4000
mov dword [ebp - 0x2c0], eax
mov ecx, dword [ebp - 0x80c]
mov dword [ebp - 0x748], ecx
mov edx, dword [ebp - 0x748]
mov dword [ebp - 0x810], edx
mov eax, dword [ebp - 0x810]
mov ecx, dword [eax]
mov dword [ebp - 0x490], ecx
mov edx, dword [ebp - 0x2c0]
or edx, 0x8000
mov dword [ebp - 0x2c0], edx
mov eax, dword [ebp - 0x2c0]
and eax, 0x4000
je 0x101aa536
and dword [ebp - 0x2c0], 0xffffbfff
mov ecx, dword [ebp - 0x2c0]
and ecx, 0x2000
je 0x101aa54e
and dword [ebp - 0x2c0], 0xffffdfff
mov edx, dword [ebp - 0x2c0]
or edx, 0x1000
mov dword [ebp - 0x2c0], edx
lea eax, [ebp - 0x490]
mov dword [ebp - 0x814], eax
mov ecx, dword [ebp - 0x2c8]
add ecx, 0x2c
mov dword [ebp - 0x344], ecx
mov dword [ebp - 0x818], 0x101b83f0
mov edx, dword [ebp - 0x344]
movzx eax, byte [edx + 0x10]
test eax, eax
je 0x101aa5a3
mov ecx, 0x24
add ecx, 1
mov dword [ebp - 0x74c], ecx
jmp 0x101aa5ad
mov dword [ebp - 0x74c], 0x24
mov edx, dword [ebp - 0x74c]
mov dword [ebp - 0x750], edx
mov eax, dword [ebp - 0x344]
cmp dword [eax + 4], 0
je 0x101aa5eb
mov ecx, dword [ebp - 0x344]
add ecx, 8
call fcn.100d47b0
movzx ecx, al
test ecx, ecx
je 0x101aa5eb
mov edx, dword [ebp - 0x344]
mov eax, dword [ebp - 0x750]
cmp eax, dword [edx + 0xc]
jbe 0x101aa618
mov dword [ebp - 0x494], 0
mov ecx, dword [ebp - 0x2c0]
or ecx, 0x10000
mov dword [ebp - 0x2c0], ecx
lea edx, [ebp - 0x494]
mov dword [ebp - 0x840], edx
jmp 0x101aa76c
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x81c], eax
mov ecx, dword [ebp - 0x81c]
mov dword [ebp - 0x824], ecx
mov edx, dword [ebp - 0x344]
add edx, 8
mov dword [ebp - 0x820], edx
mov eax, dword [ebp - 0x750]
push eax
mov ecx, dword [ebp - 0x820]
call fcn.100d47d0
mov ecx, dword [ebp - 0x824]
mov dword [eax], ecx
mov edx, 0x24
shl edx, 2
mov eax, dword [ebp - 0x344]
add edx, dword [eax + 4]
mov dword [ebp - 0x754], edx
mov ecx, dword [ebp - 0x754]
cmp dword [ecx], 0
je 0x101aa6c0
mov edx, dword [ebp - 0x754]
mov eax, dword [edx]
mov dword [ebp - 0x828], eax
mov ecx, dword [ebp - 0x828]
mov dword [ebp - 0x82c], ecx
lea edx, [ebp - 0x82c]
mov dword [ebp - 0x830], edx
mov eax, dword [ebp - 0x2c0]
or eax, 0x20000
mov dword [ebp - 0x2c0], eax
mov ecx, dword [ebp - 0x830]
mov dword [ebp - 0x758], ecx
jmp 0x101aa6f3
mov dword [ebp - 0x834], 0
lea edx, [ebp - 0x834]
mov dword [ebp - 0x838], edx
mov eax, dword [ebp - 0x2c0]
or eax, 0x40000
mov dword [ebp - 0x2c0], eax
mov ecx, dword [ebp - 0x838]
mov dword [ebp - 0x758], ecx
mov edx, dword [ebp - 0x758]
mov dword [ebp - 0x83c], edx
mov eax, dword [ebp - 0x83c]
mov ecx, dword [eax]
mov dword [ebp - 0x494], ecx
mov edx, dword [ebp - 0x2c0]
or edx, 0x80000
mov dword [ebp - 0x2c0], edx
mov eax, dword [ebp - 0x2c0]
and eax, 0x40000
je 0x101aa736
and dword [ebp - 0x2c0], 0xfffbffff
mov ecx, dword [ebp - 0x2c0]
and ecx, 0x20000
je 0x101aa74e
and dword [ebp - 0x2c0], 0xfffdffff
mov edx, dword [ebp - 0x2c0]
or edx, 0x10000
mov dword [ebp - 0x2c0], edx
lea eax, [ebp - 0x494]
mov dword [ebp - 0x840], eax
mov ecx, dword [ebp - 0x2c8]
add ecx, 0x2c
mov dword [ebp - 0x348], ecx
mov dword [ebp - 0x844], 0x101b8a10
mov edx, dword [ebp - 0x348]
movzx eax, byte [edx + 0x10]
test eax, eax
je 0x101aa7a3
mov ecx, 0x17
add ecx, 1
mov dword [ebp - 0x75c], ecx
jmp 0x101aa7ad
mov dword [ebp - 0x75c], 0x17
mov edx, dword [ebp - 0x75c]
mov dword [ebp - 0x760], edx
mov eax, dword [ebp - 0x348]
cmp dword [eax + 4], 0
je 0x101aa7eb
mov ecx, dword [ebp - 0x348]
add ecx, 8
call fcn.100d47b0
movzx ecx, al
test ecx, ecx
je 0x101aa7eb
mov edx, dword [ebp - 0x348]
mov eax, dword [ebp - 0x760]
cmp eax, dword [edx + 0xc]
jbe 0x101aa818
mov dword [ebp - 0x498], 0
mov ecx, dword [ebp - 0x2c0]
or ecx, 0x100000
mov dword [ebp - 0x2c0], ecx
lea edx, [ebp - 0x498]
mov dword [ebp - 0x86c], edx
jmp 0x101aa96c
mov eax, dword [ebp - 0x844]
mov dword [ebp - 0x848], eax
mov ecx, dword [ebp - 0x848]
mov dword [ebp - 0x850], ecx
mov edx, dword [ebp - 0x348]
add edx, 8
mov dword [ebp - 0x84c], edx
mov eax, dword [ebp - 0x760]
push eax
mov ecx, dword [ebp - 0x84c]
call fcn.100d47d0
mov ecx, dword [ebp - 0x850]
mov dword [eax], ecx
mov edx, 0x17
shl edx, 2
mov eax, dword [ebp - 0x348]
add edx, dword [eax + 4]
mov dword [ebp - 0x764], edx
mov ecx, dword [ebp - 0x764]
cmp dword [ecx], 0
je 0x101aa8c0
mov edx, dword [ebp - 0x764]
mov eax, dword [edx]
mov dword [ebp - 0x854], eax
mov ecx, dword [ebp - 0x854]
mov dword [ebp - 0x858], ecx
lea edx, [ebp - 0x858]
mov dword [ebp - 0x85c], edx
mov eax, dword [ebp - 0x2c0]
or eax, 0x200000
mov dword [ebp - 0x2c0], eax
mov ecx, dword [ebp - 0x85c]
mov dword [ebp - 0x768], ecx
jmp 0x101aa8f3
mov dword [ebp - 0x860], 0
lea edx, [ebp - 0x860]
mov dword [ebp - 0x864], edx
mov eax, dword [ebp - 0x2c0]
or eax, 0x400000
mov dword [ebp - 0x2c0], eax
mov ecx, dword [ebp - 0x864]
mov dword [ebp - 0x768], ecx
mov edx, dword [ebp - 0x768]
mov dword [ebp - 0x868], edx
mov eax, dword [ebp - 0x868]
mov ecx, dword [eax]
mov dword [ebp - 0x498], ecx
mov edx, dword [ebp - 0x2c0]
or edx, 0x800000
mov dword [ebp - 0x2c0], edx
mov eax, dword [ebp - 0x2c0]
and eax, 0x400000
je 0x101aa936
and dword [ebp - 0x2c0], 0xffbfffff
mov ecx, dword [ebp - 0x2c0]
and ecx, 0x200000
je 0x101aa94e
and dword [ebp - 0x2c0], 0xffdfffff
mov edx, dword [ebp - 0x2c0]
or edx, 0x100000
mov dword [ebp - 0x2c0], edx
lea eax, [ebp - 0x498]
mov dword [ebp - 0x86c], eax
mov ecx, dword [ebp - 0x2c8]
add ecx, 0x54
mov dword [ebp - 0x2e8], ecx
mov edx, dword [0x1054dfe4]
mov dword [ebp - 0x870], edx
lea eax, [ebp - 0x34c]
mov dword [ebp - 0x76c], eax
mov ecx, dword [ebp - 0x76c]
mov edx, dword [ebp - 0x870]
mov dword [ecx], edx
mov eax, dword [ebp - 0x76c]
mov dword [ebp - 0x10c8], eax
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x2e8]
mov edx, dword [ebp - 0x34c]
mov dword [ecx], edx
mov eax, dword [ebp - 0x34c]
mov ecx, dword [eax]
mov dword [ebp - 0x874], ecx
mov edx, dword [ebp - 0x2e8]
mov eax, dword [ebp - 0x874]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0x2e8]
cmp dword [ecx + 4], 0
jne 0x101aa9f7
mov dword [ebp - 4], 0xffffffff
jmp 0x101aac31
mov dword [ebp - 0x3d4], 0
mov edx, dword [ebp - 0x2e8]
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 0x3d4]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0x770], edx
cmp dword [ebp - 0x770], 0
jne 0x101aaa2b
mov byte [ebp - 0x2d1], 0
jmp 0x101aaa82
mov eax, dword [0x103f6500]
mov dword [ebp - 0x878], eax
push 0x1c
lea ecx, [ebp - 0x120]
push ecx
mov edx, dword [ebp - 0x770]
push edx
call dword [ebp - 0x878]
test eax, eax
jne 0x101aaa59
mov byte [ebp - 0x2d1], 0
jmp 0x101aaa82
mov eax, dword [ebp - 0x10c]
and eax, 1
jne 0x101aaa72
mov ecx, dword [ebp - 0x10c]
and ecx, 0x100
je 0x101aaa7b
mov byte [ebp - 0x2d1], 0
jmp 0x101aaa82
mov byte [ebp - 0x2d1], 1
movzx edx, byte [ebp - 0x2d1]
test edx, edx
je 0x101aaaa1
mov eax, dword [ebp - 0x3d4]
add eax, 1
mov dword [ebp - 0x3d4], eax
jmp 0x101aaa01
mov ecx, dword [ebp - 0x2e8]
mov edx, dword [ebp - 0x3d4]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x2e8]
cmp dword [eax + 0xc], 0
jne 0x101aaac8
mov dword [ebp - 4], 0xffffffff
jmp 0x101aac31
mov ecx, 1
test ecx, ecx
je 0x101aaae5
mov edx, dword [ebp - 0x2e8]
mov eax, dword [edx + 0xc]
add eax, 1
mov dword [ebp - 0x774], eax
jmp 0x101aaaf4
mov ecx, dword [ebp - 0x2e8]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x774], edx
mov edx, dword [ebp - 0x774]
lea ecx, [ebp - 0x880]
call fcn.100d4cd0
mov dword [ebp - 0x87c], eax
mov eax, dword [ebp - 0x87c]
push eax
mov ecx, dword [ebp - 0x2e8]
add ecx, 8
call fcn.100d4d70
lea ecx, [ebp - 0x880]
call fcn.100d47e0
mov ecx, dword [ebp - 0x2e8]
add ecx, 8
call fcn.100d47b0
movzx ecx, al
test ecx, ecx
jne 0x101aab4c
mov dword [ebp - 4], 0xffffffff
jmp 0x101aac31
mov ecx, dword [ebp - 0x2e8]
add ecx, 8
call fcn.100d47c0
mov dword [ebp - 0x884], eax
mov edx, dword [ebp - 0x884]
mov dword [ebp - 0x20], edx
mov eax, 1
test eax, eax
je 0x101aabe5
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x888], ecx
mov edx, dword [ebp - 0x2e8]
mov eax, dword [edx + 0xc]
lea ecx, [eax*4 + 4]
push ecx
mov edx, dword [ebp - 0x2e8]
mov eax, dword [edx + 4]
sub eax, 4
push eax
mov ecx, dword [ebp - 0x888]
push ecx
call fcn.101febb0
add esp, 0xc
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x88c], edx
mov eax, dword [ebp - 0x88c]
add eax, 4
mov dword [ebp - 0x890], eax
cmp dword [ebp - 0x34c], 0
jne 0x101aabcb
jmp 0x101aabd9
mov ecx, dword [ebp - 0x34c]
mov edx, dword [ebp - 0x890]
mov dword [ecx], edx
mov eax, dword [ebp - 0x2e8]
mov byte [eax + 0x10], 1
jmp 0x101aac2a
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x894], ecx
mov edx, dword [ebp - 0x2e8]
mov eax, dword [edx + 0xc]
shl eax, 2
push eax
mov ecx, dword [ebp - 0x2e8]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x894]
push eax
call fcn.101febb0
add esp, 0xc
cmp dword [ebp - 0x34c], 0
jne 0x101aac1f
jmp 0x101aac2a
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x34c]
mov dword [edx], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c8]
add eax, 0x54
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x898], 0x101b51f0
mov ecx, dword [ebp - 0x350]
movzx edx, byte [ecx + 0x10]
test edx, edx
je 0x101aac68
mov eax, 0x1b
add eax, 1
mov dword [ebp - 0x778], eax
jmp 0x101aac72
mov dword [ebp - 0x778], 0x1b
mov ecx, dword [ebp - 0x778]
mov dword [ebp - 0x77c], ecx
mov edx, dword [ebp - 0x350]
cmp dword [edx + 4], 0
je 0x101aacb0
mov ecx, dword [ebp - 0x350]
add ecx, 8
call fcn.100d47b0
movzx eax, al
test eax, eax
je 0x101aacb0
mov ecx, dword [ebp - 0x350]
mov edx, dword [ebp - 0x77c]
cmp edx, dword [ecx + 0xc]
jbe 0x101aacdc
mov dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x2c0]
or eax, 0x1000000
mov dword [ebp - 0x2c0], eax
lea ecx, [ebp - 0x49c]
mov dword [ebp - 0x8c0], ecx
jmp 0x101aae30
mov edx, dword [ebp - 0x898]
mov dword [ebp - 0x89c], edx
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0x8a4], eax
mov ecx, dword [ebp - 0x350]
add ecx, 8
mov dword [ebp - 0x8a0], ecx
mov edx, dword [ebp - 0x77c]
push edx
mov ecx, dword [ebp - 0x8a0]
call fcn.100d47d0
mov ecx, dword [ebp - 0x8a4]
mov dword [eax], ecx
mov edx, 0x1b
shl edx, 2
mov eax, dword [ebp - 0x350]
add edx, dword [eax + 4]
mov dword [ebp - 0x780], edx
mov ecx, dword [ebp - 0x780]
cmp dword [ecx], 0
je 0x101aad84
mov edx, dword [ebp - 0x780]
mov eax, dword [edx]
mov dword [ebp - 0x8a8], eax
mov ecx, dword [ebp - 0x8a8]
mov dword [ebp - 0x8ac], ecx
lea edx, [ebp - 0x8ac]
mov dword [ebp - 0x8b0], edx
mov eax, dword [ebp - 0x2c0]
or eax, 0x2000000
mov dword [ebp - 0x2c0], eax
mov ecx, dword [ebp - 0x8b0]
mov dword [ebp - 0x784], ecx
jmp 0x101aadb7
mov dword [ebp - 0x8b4], 0
lea edx, [ebp - 0x8b4]
mov dword [ebp - 0x8b8], edx
mov eax, dword [ebp - 0x2c0]
or eax, 0x4000000
mov dword [ebp - 0x2c0], eax
mov ecx, dword [ebp - 0x8b8]
mov dword [ebp - 0x784], ecx
mov edx, dword [ebp - 0x784]
mov dword [ebp - 0x8bc], edx
mov eax, dword [ebp - 0x8bc]
mov ecx, dword [eax]
mov dword [ebp - 0x49c], ecx
mov edx, dword [ebp - 0x2c0]
or edx, 0x8000000
mov dword [ebp - 0x2c0], edx
mov eax, dword [ebp - 0x2c0]
and eax, 0x4000000
je 0x101aadfa
and dword [ebp - 0x2c0], 0xfbffffff
mov ecx, dword [ebp - 0x2c0]
and ecx, 0x2000000
je 0x101aae12
and dword [ebp - 0x2c0], 0xfdffffff
mov edx, dword [ebp - 0x2c0]
or edx, 0x1000000
mov dword [ebp - 0x2c0], edx
lea eax, [ebp - 0x49c]
mov dword [ebp - 0x8c0], eax
mov ecx, dword [ebp - 0x2c8]
add ecx, 0x54
mov dword [ebp - 0x354], ecx
mov dword [ebp - 0x8c4], 0x101b5430
mov edx, dword [ebp - 0x354]
movzx eax, byte [edx + 0x10]
test eax, eax
je 0x101aae67
mov ecx, 0x5d
add ecx, 1
mov dword [ebp - 0x788], ecx
jmp 0x101aae71
mov dword [ebp - 0x788], 0x5d
mov edx, dword [ebp - 0x788]
mov dword [ebp - 0x78c], edx
mov eax, dword [ebp - 0x354]
cmp dword [eax + 4], 0
je 0x101aaeaf
mov ecx, dword [ebp - 0x354]
add ecx, 8
call fcn.100d47b0
movzx ecx, al
test ecx, ecx
je 0x101aaeaf
mov edx, dword [ebp - 0x354]
mov eax, dword [ebp - 0x78c]
cmp eax, dword [edx + 0xc]
jbe 0x101aaedc
mov dword [ebp - 0x4a0], 0
mov ecx, dword [ebp - 0x2c0]
or ecx, 0x10000000
mov dword [ebp - 0x2c0], ecx
lea edx, [ebp - 0x4a0]
mov dword [ebp - 0x8ec], edx
jmp 0x101ab030
mov eax, dword [ebp - 0x8c4]
mov dword [ebp - 0x8c8], eax
mov ecx, dword [ebp - 0x8c8]
mov dword [ebp - 0x8d0], ecx
mov edx, dword [ebp - 0x354]
add edx, 8
mov dword [ebp - 0x8cc], edx
mov eax, dword [ebp - 0x78c]
push eax
mov ecx, dword [ebp - 0x8cc]
call fcn.100d47d0
mov ecx, dword [ebp - 0x8d0]
mov dword [eax], ecx
mov edx, 0x5d
shl edx, 2
mov eax, dword [ebp - 0x354]
add edx, dword [eax + 4]
mov dword [ebp - 0x790], edx
mov ecx, dword [ebp - 0x790]
cmp dword [ecx], 0
je 0x101aaf84
mov edx, dword [ebp - 0x790]
mov eax, dword [edx]
mov dword [ebp - 0x8d4], eax
mov ecx, dword [ebp - 0x8d4]
mov dword [ebp - 0x8d8], ecx
lea edx, [ebp - 0x8d8]
mov dword [ebp - 0x8dc], edx
mov eax, dword [ebp - 0x2c0]
or eax, 0x20000000
mov dword [ebp - 0x2c0], eax
mov ecx, dword [ebp - 0x8dc]
mov dword [ebp - 0x794], ecx
jmp 0x101aafb7
mov dword [ebp - 0x8e0], 0
lea edx, [ebp - 0x8e0]
mov dword [ebp - 0x8e4], edx
mov eax, dword [ebp - 0x2c0]
or eax, 0x40000000
mov dword [ebp - 0x2c0], eax
mov ecx, dword [ebp - 0x8e4]
mov dword [ebp - 0x794], ecx
mov edx, dword [ebp - 0x794]
mov dword [ebp - 0x8e8], edx
mov eax, dword [ebp - 0x8e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4a0], ecx
mov edx, dword [ebp - 0x2c0]
or edx, 0x80000000
mov dword [ebp - 0x2c0], edx
mov eax, dword [ebp - 0x2c0]
and eax, 0x40000000
je 0x101aaffa
and dword [ebp - 0x2c0], 0xbfffffff
mov ecx, dword [ebp - 0x2c0]
and ecx, 0x20000000
je 0x101ab012
and dword [ebp - 0x2c0], 0xdfffffff
mov edx, dword [ebp - 0x2c0]
or edx, 0x10000000
mov dword [ebp - 0x2c0], edx
lea eax, [ebp - 0x4a0]
mov dword [ebp - 0x8ec], eax
mov ecx, dword [ebp - 0x2c8]
add ecx, 0x54
mov dword [ebp - 0x358], ecx
mov dword [ebp - 0x8f0], 0x101b5680
mov edx, dword [ebp - 0x358]
movzx eax, byte [edx + 0x10]
test eax, eax
je 0x101ab067
mov ecx, 0x5a
add ecx, 1
mov dword [ebp - 0x4c0], ecx
jmp 0x101ab071
mov dword [ebp - 0x4c0], 0x5a
mov edx, dword [ebp - 0x4c0]
mov dword [ebp - 0x4c4], edx
mov eax, dword [ebp - 0x358]
cmp dword [eax + 4], 0
je 0x101ab0af
mov ecx, dword [ebp - 0x358]
add ecx, 8
call fcn.100d47b0
movzx ecx, al
test ecx, ecx
je 0x101ab0af
mov edx, dword [ebp - 0x358]
mov eax, dword [ebp - 0x4c4]
cmp eax, dword [edx + 0xc]
jbe 0x101ab0d9
mov dword [ebp - 0x4a4], 0
mov ecx, dword [ebp - 0x2bc]
or ecx, 1
mov dword [ebp - 0x2bc], ecx
lea edx, [ebp - 0x4a4]
mov dword [ebp - 0x918], edx
jmp 0x101ab218
mov eax, dword [ebp - 0x8f0]
mov dword [ebp - 0x8f4], eax
mov ecx, dword [ebp - 0x8f4]
mov dword [ebp - 0x8fc], ecx
mov edx, dword [ebp - 0x358]
add edx, 8
mov dword [ebp - 0x8f8], edx
mov eax, dword [ebp - 0x4c4]
push eax
mov ecx, dword [ebp - 0x8f8]
call fcn.100d47d0
mov ecx, dword [ebp - 0x8fc]
mov dword [eax], ecx
mov edx, 0x5a
shl edx, 2
mov eax, dword [ebp - 0x358]
add edx, dword [eax + 4]
mov dword [ebp - 0x4c8], edx
mov ecx, dword [ebp - 0x4c8]
cmp dword [ecx], 0
je 0x101ab17f
mov edx, dword [ebp - 0x4c8]
mov eax, dword [edx]
mov dword [ebp - 0x900], eax
mov ecx, dword [ebp - 0x900]
mov dword [ebp - 0x904], ecx
lea edx, [ebp - 0x904]
mov dword [ebp - 0x908], edx
mov eax, dword [ebp - 0x2bc]
or eax, 2
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0x908]
mov dword [ebp - 0x4cc], ecx
jmp 0x101ab1b0
mov dword [ebp - 0x90c], 0
lea edx, [ebp - 0x90c]
mov dword [ebp - 0x910], edx
mov eax, dword [ebp - 0x2bc]
or eax, 4
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0x910]
mov dword [ebp - 0x4cc], ecx
mov edx, dword [ebp - 0x4cc]
mov dword [ebp - 0x914], edx
mov eax, dword [ebp - 0x914]
mov ecx, dword [eax]
mov dword [ebp - 0x4a4], ecx
mov edx, dword [ebp - 0x2bc]
or edx, 8
mov dword [ebp - 0x2bc], edx
mov eax, dword [ebp - 0x2bc]
and eax, 4
je 0x101ab1eb
and dword [ebp - 0x2bc], 0xfffffffb
mov ecx, dword [ebp - 0x2bc]
and ecx, 2
je 0x101ab1fd
and dword [ebp - 0x2bc], 0xfffffffd
mov edx, dword [ebp - 0x2bc]
or edx, 1
mov dword [ebp - 0x2bc], edx
lea eax, [ebp - 0x4a4]
mov dword [ebp - 0x918], eax
mov ecx, dword [ebp - 0x2c8]
add ecx, 0x68
mov dword [ebp - 0x2dc], ecx
mov edx, dword [0x1054dffc]
mov dword [ebp - 0x91c], edx
lea eax, [ebp - 0x35c]
mov dword [ebp - 0x4d0], eax
mov ecx, dword [ebp - 0x4d0]
mov edx, dword [ebp - 0x91c]
mov dword [ecx], edx
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x10cc], eax
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x2dc]
mov edx, dword [ebp - 0x35c]
mov dword [ecx], edx
mov eax, dword [ebp - 0x35c]
mov ecx, dword [eax]
mov dword [ebp - 0x920], ecx
mov edx, dword [ebp - 0x2dc]
mov eax, dword [ebp - 0x920]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0x2dc]
cmp dword [ecx + 4], 0
jne 0x101ab2a3
mov dword [ebp - 4], 0xffffffff
jmp 0x101ab4dd
mov dword [ebp - 0x3f0], 0
mov edx, dword [ebp - 0x2dc]
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 0x3f0]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0x4d4], edx
cmp dword [ebp - 0x4d4], 0
jne 0x101ab2d7
mov byte [ebp - 0x2d2], 0
jmp 0x101ab32e
mov eax, dword [0x103f6500]
mov dword [ebp - 0x924], eax
push 0x1c
lea ecx, [ebp - 0x13c]
push ecx
mov edx, dword [ebp - 0x4d4]
push edx
call dword [ebp - 0x924]
test eax, eax
jne 0x101ab305
mov byte [ebp - 0x2d2], 0
jmp 0x101ab32e
mov eax, dword [ebp - 0x128]
and eax, 1
jne 0x101ab31e
mov ecx, dword [ebp - 0x128]
and ecx, 0x100
je 0x101ab327
mov byte [ebp - 0x2d2], 0
jmp 0x101ab32e
mov byte [ebp - 0x2d2], 1
movzx edx, byte [ebp - 0x2d2]
test edx, edx
je 0x101ab34d
mov eax, dword [ebp - 0x3f0]
add eax, 1
mov dword [ebp - 0x3f0], eax
jmp 0x101ab2ad
mov ecx, dword [ebp - 0x2dc]
mov edx, dword [ebp - 0x3f0]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x2dc]
cmp dword [eax + 0xc], 0
jne 0x101ab374
mov dword [ebp - 4], 0xffffffff
jmp 0x101ab4dd
mov ecx, 1
test ecx, ecx
je 0x101ab391
mov edx, dword [ebp - 0x2dc]
mov eax, dword [edx + 0xc]
add eax, 1
mov dword [ebp - 0x4d8], eax
jmp 0x101ab3a0
mov ecx, dword [ebp - 0x2dc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x4d8], edx
mov edx, dword [ebp - 0x4d8]
lea ecx, [ebp - 0x92c]
call fcn.100d4cd0
mov dword [ebp - 0x928], eax
mov eax, dword [ebp - 0x928]
push eax
mov ecx, dword [ebp - 0x2dc]
add ecx, 8
call fcn.100d4d70
lea ecx, [ebp - 0x92c]
call fcn.100d47e0
mov ecx, dword [ebp - 0x2dc]
add ecx, 8
call fcn.100d47b0
movzx ecx, al
test ecx, ecx
jne 0x101ab3f8
mov dword [ebp - 4], 0xffffffff
jmp 0x101ab4dd
mov ecx, dword [ebp - 0x2dc]
add ecx, 8
call fcn.100d47c0
mov dword [ebp - 0x930], eax
mov edx, dword [ebp - 0x930]
mov dword [ebp - 0x50], edx
mov eax, 1
test eax, eax
je 0x101ab491
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x934], ecx
mov edx, dword [ebp - 0x2dc]
mov eax, dword [edx + 0xc]
lea ecx, [eax*4 + 4]
push ecx
mov edx, dword [ebp - 0x2dc]
mov eax, dword [edx + 4]
sub eax, 4
push eax
mov ecx, dword [ebp - 0x934]
push ecx
call fcn.101febb0
add esp, 0xc
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x938], edx
mov eax, dword [ebp - 0x938]
add eax, 4
mov dword [ebp - 0x93c], eax
cmp dword [ebp - 0x35c], 0
jne 0x101ab477
jmp 0x101ab485
mov ecx, dword [ebp - 0x35c]
mov edx, dword [ebp - 0x93c]
mov dword [ecx], edx
mov eax, dword [ebp - 0x2dc]
mov byte [eax + 0x10], 1
jmp 0x101ab4d6
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x940], ecx
mov edx, dword [ebp - 0x2dc]
mov eax, dword [edx + 0xc]
shl eax, 2
push eax
mov ecx, dword [ebp - 0x2dc]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x940]
push eax
call fcn.101febb0
add esp, 0xc
cmp dword [ebp - 0x35c], 0
jne 0x101ab4cb
jmp 0x101ab4d6
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x35c]
mov dword [edx], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c8]
add eax, 0x68
mov dword [ebp - 0x360], eax
mov dword [ebp - 0x944], 0x101dc490
mov ecx, dword [ebp - 0x360]
movzx edx, byte [ecx + 0x10]
test edx, edx
je 0x101ab514
mov eax, 0xe
add eax, 1
mov dword [ebp - 0x4dc], eax
jmp 0x101ab51e
mov dword [ebp - 0x4dc], 0xe
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0x4e0], ecx
mov edx, dword [ebp - 0x360]
cmp dword [edx + 4], 0
je 0x101ab55c
mov ecx, dword [ebp - 0x360]
add ecx, 8
call fcn.100d47b0
movzx eax, al
test eax, eax
je 0x101ab55c
mov ecx, dword [ebp - 0x360]
mov edx, dword [ebp - 0x4e0]
cmp edx, dword [ecx + 0xc]
jbe 0x101ab586
mov dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x2bc]
or eax, 0x10
mov dword [ebp - 0x2bc], eax
lea ecx, [ebp - 0x4a8]
mov dword [ebp - 0x96c], ecx
jmp 0x101ab6c8
mov edx, dword [ebp - 0x944]
mov dword [ebp - 0x948], edx
mov eax, dword [ebp - 0x948]
mov dword [ebp - 0x950], eax
mov ecx, dword [ebp - 0x360]
add ecx, 8
mov dword [ebp - 0x94c], ecx
mov edx, dword [ebp - 0x4e0]
push edx
mov ecx, dword [ebp - 0x94c]
call fcn.100d47d0
mov ecx, dword [ebp - 0x950]
mov dword [eax], ecx
mov edx, 0xe
shl edx, 2
mov eax, dword [ebp - 0x360]
add edx, dword [eax + 4]
mov dword [ebp - 0x4e4], edx
mov ecx, dword [ebp - 0x4e4]
cmp dword [ecx], 0
je 0x101ab62c
mov edx, dword [ebp - 0x4e4]
mov eax, dword [edx]
mov dword [ebp - 0x954], eax
mov ecx, dword [ebp - 0x954]
mov dword [ebp - 0x958], ecx
lea edx, [ebp - 0x958]
mov dword [ebp - 0x95c], edx
mov eax, dword [ebp - 0x2bc]
or eax, 0x20
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0x95c]
mov dword [ebp - 0x4e8], ecx
jmp 0x101ab65d
mov dword [ebp - 0x960], 0
lea edx, [ebp - 0x960]
mov dword [ebp - 0x964], edx
mov eax, dword [ebp - 0x2bc]
or eax, 0x40
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0x964]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4e8]
mov dword [ebp - 0x968], edx
mov eax, dword [ebp - 0x968]
mov ecx, dword [eax]
mov dword [ebp - 0x4a8], ecx
mov edx, dword [ebp - 0x2bc]
or edx, 0x80
mov dword [ebp - 0x2bc], edx
mov eax, dword [ebp - 0x2bc]
and eax, 0x40
je 0x101ab69b
and dword [ebp - 0x2bc], 0xffffffbf
mov ecx, dword [ebp - 0x2bc]
and ecx, 0x20
je 0x101ab6ad
and dword [ebp - 0x2bc], 0xffffffdf
mov edx, dword [ebp - 0x2bc]
or edx, 0x10
mov dword [ebp - 0x2bc], edx
lea eax, [ebp - 0x4a8]
mov dword [ebp - 0x96c], eax
mov ecx, dword [ebp - 0x2c8]
add ecx, 0x68
mov dword [ebp - 0x364], ecx
mov dword [ebp - 0x970], 0x101dc8d0
mov edx, dword [ebp - 0x364]
movzx eax, byte [edx + 0x10]
test eax, eax
je 0x101ab6ff
mov ecx, 0x13
add ecx, 1
mov dword [ebp - 0x4ec], ecx
jmp 0x101ab709
mov dword [ebp - 0x4ec], 0x13
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x4f0], edx
mov eax, dword [ebp - 0x364]
cmp dword [eax + 4], 0
je 0x101ab747
mov ecx, dword [ebp - 0x364]
add ecx, 8
call fcn.100d47b0
movzx ecx, al
test ecx, ecx
je 0x101ab747
mov edx, dword [ebp - 0x364]
mov eax, dword [ebp - 0x4f0]
cmp eax, dword [edx + 0xc]
jbe 0x101ab774
mov dword [ebp - 0x4ac], 0
mov ecx, dword [ebp - 0x2bc]
or ecx, 0x100
mov dword [ebp - 0x2bc], ecx
lea edx, [ebp - 0x4ac]
mov dword [ebp - 0x998], edx
jmp 0x101ab8c8
mov eax, dword [ebp - 0x970]
mov dword [ebp - 0x974], eax
mov ecx, dword [ebp - 0x974]
mov dword [ebp - 0x97c], ecx
mov edx, dword [ebp - 0x364]
add edx, 8
mov dword [ebp - 0x978], edx
mov eax, dword [ebp - 0x4f0]
push eax
mov ecx, dword [ebp - 0x978]
call fcn.100d47d0
mov ecx, dword [ebp - 0x97c]
mov dword [eax], ecx
mov edx, 0x13
shl edx, 2
mov eax, dword [ebp - 0x364]
add edx, dword [eax + 4]
mov dword [ebp - 0x4f4], edx
mov ecx, dword [ebp - 0x4f4]
cmp dword [ecx], 0
je 0x101ab81c
mov edx, dword [ebp - 0x4f4]
mov eax, dword [edx]
mov dword [ebp - 0x980], eax
mov ecx, dword [ebp - 0x980]
mov dword [ebp - 0x984], ecx
lea edx, [ebp - 0x984]
mov dword [ebp - 0x988], edx
mov eax, dword [ebp - 0x2bc]
or eax, 0x200
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0x988]
mov dword [ebp - 0x4f8], ecx
jmp 0x101ab84f
mov dword [ebp - 0x98c], 0
lea edx, [ebp - 0x98c]
mov dword [ebp - 0x990], edx
mov eax, dword [ebp - 0x2bc]
or eax, 0x400
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0x990]
mov dword [ebp - 0x4f8], ecx
mov edx, dword [ebp - 0x4f8]
mov dword [ebp - 0x994], edx
mov eax, dword [ebp - 0x994]
mov ecx, dword [eax]
mov dword [ebp - 0x4ac], ecx
mov edx, dword [ebp - 0x2bc]
or edx, 0x800
mov dword [ebp - 0x2bc], edx
mov eax, dword [ebp - 0x2bc]
and eax, 0x400
je 0x101ab892
and dword [ebp - 0x2bc], 0xfffffbff
mov ecx, dword [ebp - 0x2bc]
and ecx, 0x200
je 0x101ab8aa
and dword [ebp - 0x2bc], 0xfffffdff
mov edx, dword [ebp - 0x2bc]
or edx, 0x100
mov dword [ebp - 0x2bc], edx
lea eax, [ebp - 0x4ac]
mov dword [ebp - 0x998], eax
mov ecx, dword [ebp - 0x2c8]
add ecx, 0x18
mov dword [ebp - 0x2e0], ecx
mov edx, dword [0x1054e03c]
mov dword [ebp - 0x99c], edx
lea eax, [ebp - 0x36c]
mov dword [ebp - 0x4fc], eax
mov ecx, dword [ebp - 0x4fc]
mov edx, dword [ebp - 0x99c]
mov dword [ecx], edx
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x10d0], eax
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x2e0]
mov edx, dword [ebp - 0x36c]
mov dword [ecx], edx
mov eax, dword [ebp - 0x36c]
mov ecx, dword [eax]
mov dword [ebp - 0x9a0], ecx
mov edx, dword [ebp - 0x2e0]
mov eax, dword [ebp - 0x9a0]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0x2e0]
cmp dword [ecx + 4], 0
jne 0x101ab953
mov dword [ebp - 4], 0xffffffff
jmp 0x101abb8d
mov dword [ebp - 0x3e8], 0
mov edx, dword [ebp - 0x2e0]
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 0x3e8]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0x500], edx
cmp dword [ebp - 0x500], 0
jne 0x101ab987
mov byte [ebp - 0x2d3], 0
jmp 0x101ab9de
mov eax, dword [0x103f6500]
mov dword [ebp - 0x9a4], eax
push 0x1c
lea ecx, [ebp - 0x158]
push ecx
mov edx, dword [ebp - 0x500]
push edx
call dword [ebp - 0x9a4]
test eax, eax
jne 0x101ab9b5
mov byte [ebp - 0x2d3], 0
jmp 0x101ab9de
mov eax, dword [ebp - 0x144]
and eax, 1
jne 0x101ab9ce
mov ecx, dword [ebp - 0x144]
and ecx, 0x100
je 0x101ab9d7
mov byte [ebp - 0x2d3], 0
jmp 0x101ab9de
mov byte [ebp - 0x2d3], 1
movzx edx, byte [ebp - 0x2d3]
test edx, edx
je 0x101ab9fd
mov eax, dword [ebp - 0x3e8]
add eax, 1
mov dword [ebp - 0x3e8], eax
jmp 0x101ab95d
mov ecx, dword [ebp - 0x2e0]
mov edx, dword [ebp - 0x3e8]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x2e0]
cmp dword [eax + 0xc], 0
jne 0x101aba24
mov dword [ebp - 4], 0xffffffff
jmp 0x101abb8d
mov ecx, 1
test ecx, ecx
je 0x101aba41
mov edx, dword [ebp - 0x2e0]
mov eax, dword [edx + 0xc]
add eax, 1
mov dword [ebp - 0x504], eax
jmp 0x101aba50
mov ecx, dword [ebp - 0x2e0]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x504], edx
mov edx, dword [ebp - 0x504]
lea ecx, [ebp - 0x9ac]
call fcn.100d4cd0
mov dword [ebp - 0x9a8], eax
mov eax, dword [ebp - 0x9a8]
push eax
mov ecx, dword [ebp - 0x2e0]
add ecx, 8
call fcn.100d4d70
lea ecx, [ebp - 0x9ac]
call fcn.100d47e0
mov ecx, dword [ebp - 0x2e0]
add ecx, 8
call fcn.100d47b0
movzx ecx, al
test ecx, ecx
jne 0x101abaa8
mov dword [ebp - 4], 0xffffffff
jmp 0x101abb8d
mov ecx, dword [ebp - 0x2e0]
add ecx, 8
call fcn.100d47c0
mov dword [ebp - 0x9b0], eax
mov edx, dword [ebp - 0x9b0]
mov dword [ebp - 0x28], edx
mov eax, 1
test eax, eax
je 0x101abb41
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x9b4], ecx
mov edx, dword [ebp - 0x2e0]
mov eax, dword [edx + 0xc]
lea ecx, [eax*4 + 4]
push ecx
mov edx, dword [ebp - 0x2e0]
mov eax, dword [edx + 4]
sub eax, 4
push eax
mov ecx, dword [ebp - 0x9b4]
push ecx
call fcn.101febb0
add esp, 0xc
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x9b8], edx
mov eax, dword [ebp - 0x9b8]
add eax, 4
mov dword [ebp - 0x9bc], eax
cmp dword [ebp - 0x36c], 0
jne 0x101abb27
jmp 0x101abb35
mov ecx, dword [ebp - 0x36c]
mov edx, dword [ebp - 0x9bc]
mov dword [ecx], edx
mov eax, dword [ebp - 0x2e0]
mov byte [eax + 0x10], 1
jmp 0x101abb86
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x9c0], ecx
mov edx, dword [ebp - 0x2e0]
mov eax, dword [edx + 0xc]
shl eax, 2
push eax
mov ecx, dword [ebp - 0x2e0]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x9c0]
push eax
call fcn.101febb0
add esp, 0xc
cmp dword [ebp - 0x36c], 0
jne 0x101abb7b
jmp 0x101abb86
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x36c]
mov dword [edx], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c8]
add eax, 0x18
mov dword [ebp - 0x370], eax
mov dword [ebp - 0x9c4], 0x101cfef0
mov ecx, dword [ebp - 0x370]
movzx edx, byte [ecx + 0x10]
test edx, edx
je 0x101abbc4
mov eax, 0x10
add eax, 1
mov dword [ebp - 0x508], eax
jmp 0x101abbce
mov dword [ebp - 0x508], 0x10
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x50c], ecx
mov edx, dword [ebp - 0x370]
cmp dword [edx + 4], 0
je 0x101abc0c
mov ecx, dword [ebp - 0x370]
add ecx, 8
call fcn.100d47b0
movzx eax, al
test eax, eax
je 0x101abc0c
mov ecx, dword [ebp - 0x370]
mov edx, dword [ebp - 0x50c]
cmp edx, dword [ecx + 0xc]
jbe 0x101abc38
mov dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x2bc]
or eax, 0x1000
mov dword [ebp - 0x2bc], eax
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 0x9ec], ecx
jmp 0x101abd8c
mov edx, dword [ebp - 0x9c4]
mov dword [ebp - 0x9c8], edx
mov eax, dword [ebp - 0x9c8]
mov dword [ebp - 0x9d0], eax
mov ecx, dword [ebp - 0x370]
add ecx, 8
mov dword [ebp - 0x9cc], ecx
mov edx, dword [ebp - 0x50c]
push edx
mov ecx, dword [ebp - 0x9cc]
call fcn.100d47d0
mov ecx, dword [ebp - 0x9d0]
mov dword [eax], ecx
mov edx, 0x10
shl edx, 2
mov eax, dword [ebp - 0x370]
add edx, dword [eax + 4]
mov dword [ebp - 0x510], edx
mov ecx, dword [ebp - 0x510]
cmp dword [ecx], 0
je 0x101abce0
mov edx, dword [ebp - 0x510]
mov eax, dword [edx]
mov dword [ebp - 0x9d4], eax
mov ecx, dword [ebp - 0x9d4]
mov dword [ebp - 0x9d8], ecx
lea edx, [ebp - 0x9d8]
mov dword [ebp - 0x9dc], edx
mov eax, dword [ebp - 0x2bc]
or eax, 0x2000
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0x9dc]
mov dword [ebp - 0x514], ecx
jmp 0x101abd13
mov dword [ebp - 0x9e0], 0
lea edx, [ebp - 0x9e0]
mov dword [ebp - 0x9e4], edx
mov eax, dword [ebp - 0x2bc]
or eax, 0x4000
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0x9e4]
mov dword [ebp - 0x514], ecx
mov edx, dword [ebp - 0x514]
mov dword [ebp - 0x9e8], edx
mov eax, dword [ebp - 0x9e8]
mov ecx, dword [eax]
mov dword [ebp - 0x4b0], ecx
mov edx, dword [ebp - 0x2bc]
or edx, 0x8000
mov dword [ebp - 0x2bc], edx
mov eax, dword [ebp - 0x2bc]
and eax, 0x4000
je 0x101abd56
and dword [ebp - 0x2bc], 0xffffbfff
mov ecx, dword [ebp - 0x2bc]
and ecx, 0x2000
je 0x101abd6e
and dword [ebp - 0x2bc], 0xffffdfff
mov edx, dword [ebp - 0x2bc]
or edx, 0x1000
mov dword [ebp - 0x2bc], edx
lea eax, [ebp - 0x4b0]
mov dword [ebp - 0x9ec], eax
mov ecx, dword [ebp - 0x2c8]
add ecx, 0x18
mov dword [ebp - 0x374], ecx
mov dword [ebp - 0x9f0], 0x101cff00
mov edx, dword [ebp - 0x374]
movzx eax, byte [edx + 0x10]
test eax, eax
je 0x101abdc3
mov ecx, 0x11
add ecx, 1
mov dword [ebp - 0x518], ecx
jmp 0x101abdcd
mov dword [ebp - 0x518], 0x11
mov edx, dword [ebp - 0x518]
mov dword [ebp - 0x51c], edx
mov eax, dword [ebp - 0x374]
cmp dword [eax + 4], 0
je 0x101abe0b
mov ecx, dword [ebp - 0x374]
add ecx, 8
call fcn.100d47b0
movzx ecx, al
test ecx, ecx
je 0x101abe0b
mov edx, dword [ebp - 0x374]
mov eax, dword [ebp - 0x51c]
cmp eax, dword [edx + 0xc]
jbe 0x101abe38
mov dword [ebp - 0x4b4], 0
mov ecx, dword [ebp - 0x2bc]
or ecx, 0x10000
mov dword [ebp - 0x2bc], ecx
lea edx, [ebp - 0x4b4]
mov dword [ebp - 0xa18], edx
jmp 0x101abf8c
mov eax, dword [ebp - 0x9f0]
mov dword [ebp - 0x9f4], eax
mov ecx, dword [ebp - 0x9f4]
mov dword [ebp - 0x9fc], ecx
mov edx, dword [ebp - 0x374]
add edx, 8
mov dword [ebp - 0x9f8], edx
mov eax, dword [ebp - 0x51c]
push eax
mov ecx, dword [ebp - 0x9f8]
call fcn.100d47d0
mov ecx, dword [ebp - 0x9fc]
mov dword [eax], ecx
mov edx, 0x11
shl edx, 2
mov eax, dword [ebp - 0x374]
add edx, dword [eax + 4]
mov dword [ebp - 0x520], edx
mov ecx, dword [ebp - 0x520]
cmp dword [ecx], 0
je 0x101abee0
mov edx, dword [ebp - 0x520]
mov eax, dword [edx]
mov dword [ebp - 0xa00], eax
mov ecx, dword [ebp - 0xa00]
mov dword [ebp - 0xa04], ecx
lea edx, [ebp - 0xa04]
mov dword [ebp - 0xa08], edx
mov eax, dword [ebp - 0x2bc]
or eax, 0x20000
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0xa08]
mov dword [ebp - 0x524], ecx
jmp 0x101abf13
mov dword [ebp - 0xa0c], 0
lea edx, [ebp - 0xa0c]
mov dword [ebp - 0xa10], edx
mov eax, dword [ebp - 0x2bc]
or eax, 0x40000
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0xa10]
mov dword [ebp - 0x524], ecx
mov edx, dword [ebp - 0x524]
mov dword [ebp - 0xa14], edx
mov eax, dword [ebp - 0xa14]
mov ecx, dword [eax]
mov dword [ebp - 0x4b4], ecx
mov edx, dword [ebp - 0x2bc]
or edx, 0x80000
mov dword [ebp - 0x2bc], edx
mov eax, dword [ebp - 0x2bc]
and eax, 0x40000
je 0x101abf56
and dword [ebp - 0x2bc], 0xfffbffff
mov ecx, dword [ebp - 0x2bc]
and ecx, 0x20000
je 0x101abf6e
and dword [ebp - 0x2bc], 0xfffdffff
mov edx, dword [ebp - 0x2bc]
or edx, 0x10000
mov dword [ebp - 0x2bc], edx
lea eax, [ebp - 0x4b4]
mov dword [ebp - 0xa18], eax
mov ecx, dword [ebp - 0x2c8]
add ecx, 0x18
mov dword [ebp - 0x378], ecx
mov dword [ebp - 0xa1c], 0x101cfff0
mov edx, dword [ebp - 0x378]
movzx eax, byte [edx + 0x10]
test eax, eax
je 0x101abfc3
mov ecx, 0x12
add ecx, 1
mov dword [ebp - 0x528], ecx
jmp 0x101abfcd
mov dword [ebp - 0x528], 0x12
mov edx, dword [ebp - 0x528]
mov dword [ebp - 0x52c], edx
mov eax, dword [ebp - 0x378]
cmp dword [eax + 4], 0
je 0x101ac00b
mov ecx, dword [ebp - 0x378]
add ecx, 8
call fcn.100d47b0
movzx ecx, al
test ecx, ecx
je 0x101ac00b
mov edx, dword [ebp - 0x378]
mov eax, dword [ebp - 0x52c]
cmp eax, dword [edx + 0xc]
jbe 0x101ac038
mov dword [ebp - 0x4b8], 0
mov ecx, dword [ebp - 0x2bc]
or ecx, 0x100000
mov dword [ebp - 0x2bc], ecx
lea edx, [ebp - 0x4b8]
mov dword [ebp - 0xa44], edx
jmp 0x101ac18c
mov eax, dword [ebp - 0xa1c]
mov dword [ebp - 0xa20], eax
mov ecx, dword [ebp - 0xa20]
mov dword [ebp - 0xa28], ecx
mov edx, dword [ebp - 0x378]
add edx, 8
mov dword [ebp - 0xa24], edx
mov eax, dword [ebp - 0x52c]
push eax
mov ecx, dword [ebp - 0xa24]
call fcn.100d47d0
mov ecx, dword [ebp - 0xa28]
mov dword [eax], ecx
mov edx, 0x12
shl edx, 2
mov eax, dword [ebp - 0x378]
add edx, dword [eax + 4]
mov dword [ebp - 0x530], edx
mov ecx, dword [ebp - 0x530]
cmp dword [ecx], 0
je 0x101ac0e0
mov edx, dword [ebp - 0x530]
mov eax, dword [edx]
mov dword [ebp - 0xa2c], eax
mov ecx, dword [ebp - 0xa2c]
mov dword [ebp - 0xa30], ecx
lea edx, [ebp - 0xa30]
mov dword [ebp - 0xa34], edx
mov eax, dword [ebp - 0x2bc]
or eax, 0x200000
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0xa34]
mov dword [ebp - 0x534], ecx
jmp 0x101ac113
mov dword [ebp - 0xa38], 0
lea edx, [ebp - 0xa38]
mov dword [ebp - 0xa3c], edx
mov eax, dword [ebp - 0x2bc]
or eax, 0x400000
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0xa3c]
mov dword [ebp - 0x534], ecx
mov edx, dword [ebp - 0x534]
mov dword [ebp - 0xa40], edx
mov eax, dword [ebp - 0xa40]
mov ecx, dword [eax]
mov dword [ebp - 0x4b8], ecx
mov edx, dword [ebp - 0x2bc]
or edx, 0x800000
mov dword [ebp - 0x2bc], edx
mov eax, dword [ebp - 0x2bc]
and eax, 0x400000
je 0x101ac156
and dword [ebp - 0x2bc], 0xffbfffff
mov ecx, dword [ebp - 0x2bc]
and ecx, 0x200000
je 0x101ac16e
and dword [ebp - 0x2bc], 0xffdfffff
mov edx, dword [ebp - 0x2bc]
or edx, 0x100000
mov dword [ebp - 0x2bc], edx
lea eax, [ebp - 0x4b8]
mov dword [ebp - 0xa44], eax
mov ecx, dword [ebp - 0x2c8]
add ecx, 0x18
mov dword [ebp - 0x37c], ecx
mov dword [ebp - 0xa48], 0x101d02b0
mov edx, dword [ebp - 0x37c]
movzx eax, byte [edx + 0x10]
test eax, eax
je 0x101ac1c3
mov ecx, 0x18
add ecx, 1
mov dword [ebp - 0x538], ecx
jmp 0x101ac1cd
mov dword [ebp - 0x538], 0x18
mov edx, dword [ebp - 0x538]
mov dword [ebp - 0x53c], edx
mov eax, dword [ebp - 0x37c]
cmp dword [eax + 4], 0
je 0x101ac20b
mov ecx, dword [ebp - 0x37c]
add ecx, 8
call fcn.100d47b0
movzx ecx, al
test ecx, ecx
je 0x101ac20b
mov edx, dword [ebp - 0x37c]
mov eax, dword [ebp - 0x53c]
cmp eax, dword [edx + 0xc]
jbe 0x101ac238
mov dword [ebp - 0x448], 0
mov ecx, dword [ebp - 0x2bc]
or ecx, 0x1000000
mov dword [ebp - 0x2bc], ecx
lea edx, [ebp - 0x448]
mov dword [ebp - 0xa70], edx
jmp 0x101ac38c
mov eax, dword [ebp - 0xa48]
mov dword [ebp - 0xa4c], eax
mov ecx, dword [ebp - 0xa4c]
mov dword [ebp - 0xa54], ecx
mov edx, dword [ebp - 0x37c]
add edx, 8
mov dword [ebp - 0xa50], edx
mov eax, dword [ebp - 0x53c]
push eax
mov ecx, dword [ebp - 0xa50]
call fcn.100d47d0
mov ecx, dword [ebp - 0xa54]
mov dword [eax], ecx
mov edx, 0x18
shl edx, 2
mov eax, dword [ebp - 0x37c]
add edx, dword [eax + 4]
mov dword [ebp - 0x540], edx
mov ecx, dword [ebp - 0x540]
cmp dword [ecx], 0
je 0x101ac2e0
mov edx, dword [ebp - 0x540]
mov eax, dword [edx]
mov dword [ebp - 0xa58], eax
mov ecx, dword [ebp - 0xa58]
mov dword [ebp - 0xa5c], ecx
lea edx, [ebp - 0xa5c]
mov dword [ebp - 0xa60], edx
mov eax, dword [ebp - 0x2bc]
or eax, 0x2000000
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0xa60]
mov dword [ebp - 0x544], ecx
jmp 0x101ac313
mov dword [ebp - 0xa64], 0
lea edx, [ebp - 0xa64]
mov dword [ebp - 0xa68], edx
mov eax, dword [ebp - 0x2bc]
or eax, 0x4000000
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0xa68]
mov dword [ebp - 0x544], ecx
mov edx, dword [ebp - 0x544]
mov dword [ebp - 0xa6c], edx
mov eax, dword [ebp - 0xa6c]
mov ecx, dword [eax]
mov dword [ebp - 0x448], ecx
mov edx, dword [ebp - 0x2bc]
or edx, 0x8000000
mov dword [ebp - 0x2bc], edx
mov eax, dword [ebp - 0x2bc]
and eax, 0x4000000
je 0x101ac356
and dword [ebp - 0x2bc], 0xfbffffff
mov ecx, dword [ebp - 0x2bc]
and ecx, 0x2000000
je 0x101ac36e
and dword [ebp - 0x2bc], 0xfdffffff
mov edx, dword [ebp - 0x2bc]
or edx, 0x1000000
mov dword [ebp - 0x2bc], edx
lea eax, [ebp - 0x448]
mov dword [ebp - 0xa70], eax
mov ecx, dword [ebp - 0x2c8]
add ecx, 0x18
mov dword [ebp - 0x380], ecx
mov dword [ebp - 0xa74], 0x101d03b0
mov edx, dword [ebp - 0x380]
movzx eax, byte [edx + 0x10]
test eax, eax
je 0x101ac3c3
mov ecx, 0x2c
add ecx, 1
mov dword [ebp - 0x548], ecx
jmp 0x101ac3cd
mov dword [ebp - 0x548], 0x2c
mov edx, dword [ebp - 0x548]
mov dword [ebp - 0x54c], edx
mov eax, dword [ebp - 0x380]
cmp dword [eax + 4], 0
je 0x101ac40b
mov ecx, dword [ebp - 0x380]
add ecx, 8
call fcn.100d47b0
movzx ecx, al
test ecx, ecx
je 0x101ac40b
mov edx, dword [ebp - 0x380]
mov eax, dword [ebp - 0x54c]
cmp eax, dword [edx + 0xc]
jbe 0x101ac438
mov dword [ebp - 0x44c], 0
mov ecx, dword [ebp - 0x2bc]
or ecx, 0x10000000
mov dword [ebp - 0x2bc], ecx
lea edx, [ebp - 0x44c]
mov dword [ebp - 0xa9c], edx
jmp 0x101ac58c
mov eax, dword [ebp - 0xa74]
mov dword [ebp - 0xa78], eax
mov ecx, dword [ebp - 0xa78]
mov dword [ebp - 0xa80], ecx
mov edx, dword [ebp - 0x380]
add edx, 8
mov dword [ebp - 0xa7c], edx
mov eax, dword [ebp - 0x54c]
push eax
mov ecx, dword [ebp - 0xa7c]
call fcn.100d47d0
mov ecx, dword [ebp - 0xa80]
mov dword [eax], ecx
mov edx, 0x2c
shl edx, 2
mov eax, dword [ebp - 0x380]
add edx, dword [eax + 4]
mov dword [ebp - 0x550], edx
mov ecx, dword [ebp - 0x550]
cmp dword [ecx], 0
je 0x101ac4e0
mov edx, dword [ebp - 0x550]
mov eax, dword [edx]
mov dword [ebp - 0xa84], eax
mov ecx, dword [ebp - 0xa84]
mov dword [ebp - 0xa88], ecx
lea edx, [ebp - 0xa88]
mov dword [ebp - 0xa8c], edx
mov eax, dword [ebp - 0x2bc]
or eax, 0x20000000
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0xa8c]
mov dword [ebp - 0x554], ecx
jmp 0x101ac513
mov dword [ebp - 0xa90], 0
lea edx, [ebp - 0xa90]
mov dword [ebp - 0xa94], edx
mov eax, dword [ebp - 0x2bc]
or eax, 0x40000000
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0xa94]
mov dword [ebp - 0x554], ecx
mov edx, dword [ebp - 0x554]
mov dword [ebp - 0xa98], edx
mov eax, dword [ebp - 0xa98]
mov ecx, dword [eax]
mov dword [ebp - 0x44c], ecx
mov edx, dword [ebp - 0x2bc]
or edx, 0x80000000
mov dword [ebp - 0x2bc], edx
mov eax, dword [ebp - 0x2bc]
and eax, 0x40000000
je 0x101ac556
and dword [ebp - 0x2bc], 0xbfffffff
mov ecx, dword [ebp - 0x2bc]
and ecx, 0x20000000
je 0x101ac56e
and dword [ebp - 0x2bc], 0xdfffffff
mov edx, dword [ebp - 0x2bc]
or edx, 0x10000000
mov dword [ebp - 0x2bc], edx
lea eax, [ebp - 0x44c]
mov dword [ebp - 0xa9c], eax
mov ecx, dword [ebp - 0x2c8]
add ecx, 0x7c
mov dword [ebp - 0x310], ecx
mov edx, dword [0x1054dff0]
mov dword [ebp - 0xaa0], edx
lea eax, [ebp - 0x384]
mov dword [ebp - 0x558], eax
mov ecx, dword [ebp - 0x558]
mov edx, dword [ebp - 0xaa0]
mov dword [ecx], edx
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0x10d4], eax
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x310]
mov edx, dword [ebp - 0x384]
mov dword [ecx], edx
mov eax, dword [ebp - 0x384]
mov ecx, dword [eax]
mov dword [ebp - 0xaa4], ecx
mov edx, dword [ebp - 0x310]
mov eax, dword [ebp - 0xaa4]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0x310]
cmp dword [ecx + 4], 0
jne 0x101ac617
mov dword [ebp - 4], 0xffffffff
jmp 0x101ac851
mov dword [ebp - 0x3d0], 0
mov edx, dword [ebp - 0x310]
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 0x3d0]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0x55c], edx
cmp dword [ebp - 0x55c], 0
jne 0x101ac64b
mov byte [ebp - 0x2d4], 0
jmp 0x101ac6a2
mov eax, dword [0x103f6500]
mov dword [ebp - 0xaa8], eax
push 0x1c
lea ecx, [ebp - 0x174]
push ecx
mov edx, dword [ebp - 0x55c]
push edx
call dword [ebp - 0xaa8]
test eax, eax
jne 0x101ac679
mov byte [ebp - 0x2d4], 0
jmp 0x101ac6a2
mov eax, dword [ebp - 0x160]
and eax, 1
jne 0x101ac692
mov ecx, dword [ebp - 0x160]
and ecx, 0x100
je 0x101ac69b
mov byte [ebp - 0x2d4], 0
jmp 0x101ac6a2
mov byte [ebp - 0x2d4], 1
movzx edx, byte [ebp - 0x2d4]
test edx, edx
je 0x101ac6c1
mov eax, dword [ebp - 0x3d0]
add eax, 1
mov dword [ebp - 0x3d0], eax
jmp 0x101ac621
mov ecx, dword [ebp - 0x310]
mov edx, dword [ebp - 0x3d0]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x310]
cmp dword [eax + 0xc], 0
jne 0x101ac6e8
mov dword [ebp - 4], 0xffffffff
jmp 0x101ac851
mov ecx, 1
test ecx, ecx
je 0x101ac705
mov edx, dword [ebp - 0x310]
mov eax, dword [edx + 0xc]
add eax, 1
mov dword [ebp - 0x560], eax
jmp 0x101ac714
mov ecx, dword [ebp - 0x310]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x560], edx
mov edx, dword [ebp - 0x560]
lea ecx, [ebp - 0xab0]
call fcn.100d4cd0
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0xaac]
push eax
mov ecx, dword [ebp - 0x310]
add ecx, 8
call fcn.100d4d70
lea ecx, [ebp - 0xab0]
call fcn.100d47e0
mov ecx, dword [ebp - 0x310]
add ecx, 8
call fcn.100d47b0
movzx ecx, al
test ecx, ecx
jne 0x101ac76c
mov dword [ebp - 4], 0xffffffff
jmp 0x101ac851
mov ecx, dword [ebp - 0x310]
add ecx, 8
call fcn.100d47c0
mov dword [ebp - 0xab4], eax
mov edx, dword [ebp - 0xab4]
mov dword [ebp - 0x24], edx
mov eax, 1
test eax, eax
je 0x101ac805
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0xab8], ecx
mov edx, dword [ebp - 0x310]
mov eax, dword [edx + 0xc]
lea ecx, [eax*4 + 4]
push ecx
mov edx, dword [ebp - 0x310]
mov eax, dword [edx + 4]
sub eax, 4
push eax
mov ecx, dword [ebp - 0xab8]
push ecx
call fcn.101febb0
add esp, 0xc
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0xabc], edx
mov eax, dword [ebp - 0xabc]
add eax, 4
mov dword [ebp - 0xac0], eax
cmp dword [ebp - 0x384], 0
jne 0x101ac7eb
jmp 0x101ac7f9
mov ecx, dword [ebp - 0x384]
mov edx, dword [ebp - 0xac0]
mov dword [ecx], edx
mov eax, dword [ebp - 0x310]
mov byte [eax + 0x10], 1
jmp 0x101ac84a
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0xac4], ecx
mov edx, dword [ebp - 0x310]
mov eax, dword [edx + 0xc]
shl eax, 2
push eax
mov ecx, dword [ebp - 0x310]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0xac4]
push eax
call fcn.101febb0
add esp, 0xc
cmp dword [ebp - 0x384], 0
jne 0x101ac83f
jmp 0x101ac84a
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x384]
mov dword [edx], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c8]
add eax, 0x7c
mov dword [ebp - 0x388], eax
mov dword [ebp - 0xac8], 0x101c99a0
mov ecx, dword [ebp - 0x388]
movzx edx, byte [ecx + 0x10]
test edx, edx
je 0x101ac888
mov eax, 0x43
add eax, 1
mov dword [ebp - 0x564], eax
jmp 0x101ac892
mov dword [ebp - 0x564], 0x43
mov ecx, dword [ebp - 0x564]
mov dword [ebp - 0x568], ecx
mov edx, dword [ebp - 0x388]
cmp dword [edx + 4], 0
je 0x101ac8d0
mov ecx, dword [ebp - 0x388]
add ecx, 8
call fcn.100d47b0
movzx eax, al
test eax, eax
je 0x101ac8d0
mov ecx, dword [ebp - 0x388]
mov edx, dword [ebp - 0x568]
cmp edx, dword [ecx + 0xc]
jbe 0x101ac8fa
mov dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x2b8]
or eax, 1
mov dword [ebp - 0x2b8], eax
lea ecx, [ebp - 0x454]
mov dword [ebp - 0xaf0], ecx
jmp 0x101aca39
mov edx, dword [ebp - 0xac8]
mov dword [ebp - 0xacc], edx
mov eax, dword [ebp - 0xacc]
mov dword [ebp - 0xad4], eax
mov ecx, dword [ebp - 0x388]
add ecx, 8
mov dword [ebp - 0xad0], ecx
mov edx, dword [ebp - 0x568]
push edx
mov ecx, dword [ebp - 0xad0]
call fcn.100d47d0
mov ecx, dword [ebp - 0xad4]
mov dword [eax], ecx
mov edx, 0x43
shl edx, 2
mov eax, dword [ebp - 0x388]
add edx, dword [eax + 4]
mov dword [ebp - 0x56c], edx
mov ecx, dword [ebp - 0x56c]
cmp dword [ecx], 0
je 0x101ac9a0
mov edx, dword [ebp - 0x56c]
mov eax, dword [edx]
mov dword [ebp - 0xad8], eax
mov ecx, dword [ebp - 0xad8]
mov dword [ebp - 0xadc], ecx
lea edx, [ebp - 0xadc]
mov dword [ebp - 0xae0], edx
mov eax, dword [ebp - 0x2b8]
or eax, 2
mov dword [ebp - 0x2b8], eax
mov ecx, dword [ebp - 0xae0]
mov dword [ebp - 0x570], ecx
jmp 0x101ac9d1
mov dword [ebp - 0xae4], 0
lea edx, [ebp - 0xae4]
mov dword [ebp - 0xae8], edx
mov eax, dword [ebp - 0x2b8]
or eax, 4
mov dword [ebp - 0x2b8], eax
mov ecx, dword [ebp - 0xae8]
mov dword [ebp - 0x570], ecx
mov edx, dword [ebp - 0x570]
mov dword [ebp - 0xaec], edx
mov eax, dword [ebp - 0xaec]
mov ecx, dword [eax]
mov dword [ebp - 0x454], ecx
mov edx, dword [ebp - 0x2b8]
or edx, 8
mov dword [ebp - 0x2b8], edx
mov eax, dword [ebp - 0x2b8]
and eax, 4
je 0x101aca0c
and dword [ebp - 0x2b8], 0xfffffffb
mov ecx, dword [ebp - 0x2b8]
and ecx, 2
je 0x101aca1e
and dword [ebp - 0x2b8], 0xfffffffd
mov edx, dword [ebp - 0x2b8]
or edx, 1
mov dword [ebp - 0x2b8], edx
lea eax, [ebp - 0x454]
mov dword [ebp - 0xaf0], eax
mov ecx, dword [ebp - 0x2c8]
add ecx, 0x7c
mov dword [ebp - 0x38c], ecx
mov dword [ebp - 0xaf4], 0x101c9a00
mov edx, dword [ebp - 0x38c]
movzx eax, byte [edx + 0x10]
test eax, eax
je 0x101aca70
mov ecx, 0x52
add ecx, 1
mov dword [ebp - 0x574], ecx
jmp 0x101aca7a
mov dword [ebp - 0x574], 0x52
mov edx, dword [ebp - 0x574]
mov dword [ebp - 0x578], edx
mov eax, dword [ebp - 0x38c]
cmp dword [eax + 4], 0
je 0x101acab8
mov ecx, dword [ebp - 0x38c]
add ecx, 8
call fcn.100d47b0
movzx ecx, al
test ecx, ecx
je 0x101acab8
mov edx, dword [ebp - 0x38c]
mov eax, dword [ebp - 0x578]
cmp eax, dword [edx + 0xc]
jbe 0x101acae2
mov dword [ebp - 0x45c], 0
mov ecx, dword [ebp - 0x2b8]
or ecx, 0x10
mov dword [ebp - 0x2b8], ecx
lea edx, [ebp - 0x45c]
mov dword [ebp - 0xb1c], edx
jmp 0x101acc24
mov eax, dword [ebp - 0xaf4]
mov dword [ebp - 0xaf8], eax
mov ecx, dword [ebp - 0xaf8]
mov dword [ebp - 0xb00], ecx
mov edx, dword [ebp - 0x38c]
add edx, 8
mov dword [ebp - 0xafc], edx
mov eax, dword [ebp - 0x578]
push eax
mov ecx, dword [ebp - 0xafc]
call fcn.100d47d0
mov ecx, dword [ebp - 0xb00]
mov dword [eax], ecx
mov edx, 0x52
shl edx, 2
mov eax, dword [ebp - 0x38c]
add edx, dword [eax + 4]
mov dword [ebp - 0x57c], edx
mov ecx, dword [ebp - 0x57c]
cmp dword [ecx], 0
je 0x101acb88
mov edx, dword [ebp - 0x57c]
mov eax, dword [edx]
mov dword [ebp - 0xb04], eax
mov ecx, dword [ebp - 0xb04]
mov dword [ebp - 0xb08], ecx
lea edx, [ebp - 0xb08]
mov dword [ebp - 0xb0c], edx
mov eax, dword [ebp - 0x2b8]
or eax, 0x20
mov dword [ebp - 0x2b8], eax
mov ecx, dword [ebp - 0xb0c]
mov dword [ebp - 0x580], ecx
jmp 0x101acbb9
mov dword [ebp - 0xb10], 0
lea edx, [ebp - 0xb10]
mov dword [ebp - 0xb14], edx
mov eax, dword [ebp - 0x2b8]
or eax, 0x40
mov dword [ebp - 0x2b8], eax
mov ecx, dword [ebp - 0xb14]
mov dword [ebp - 0x580], ecx
mov edx, dword [ebp - 0x580]
mov dword [ebp - 0xb18], edx
mov eax, dword [ebp - 0xb18]
mov ecx, dword [eax]
mov dword [ebp - 0x45c], ecx
mov edx, dword [ebp - 0x2b8]
or edx, 0x80
mov dword [ebp - 0x2b8], edx
mov eax, dword [ebp - 0x2b8]
and eax, 0x40
je 0x101acbf7
and dword [ebp - 0x2b8], 0xffffffbf
mov ecx, dword [ebp - 0x2b8]
and ecx, 0x20
je 0x101acc09
and dword [ebp - 0x2b8], 0xffffffdf
mov edx, dword [ebp - 0x2b8]
or edx, 0x10
mov dword [ebp - 0x2b8], edx
lea eax, [ebp - 0x45c]
mov dword [ebp - 0xb1c], eax
mov ecx, dword [ebp - 0x2c8]
add ecx, 0x7c
mov dword [ebp - 0x390], ecx
mov dword [ebp - 0xb20], 0x101c9a20
mov edx, dword [ebp - 0x390]
movzx eax, byte [edx + 0x10]
test eax, eax
je 0x101acc5b
mov ecx, 0x74
add ecx, 1
mov dword [ebp - 0x584], ecx
jmp 0x101acc65
mov dword [ebp - 0x584], 0x74
mov edx, dword [ebp - 0x584]
mov dword [ebp - 0x588], edx
mov eax, dword [ebp - 0x390]
cmp dword [eax + 4], 0
je 0x101acca3
mov ecx, dword [ebp - 0x390]
add ecx, 8
call fcn.100d47b0
movzx ecx, al
test ecx, ecx
je 0x101acca3
mov edx, dword [ebp - 0x390]
mov eax, dword [ebp - 0x588]
cmp eax, dword [edx + 0xc]
jbe 0x101accd0
mov dword [ebp - 0x464], 0
mov ecx, dword [ebp - 0x2b8]
or ecx, 0x100
mov dword [ebp - 0x2b8], ecx
lea edx, [ebp - 0x464]
mov dword [ebp - 0xb48], edx
jmp 0x101ace24
mov eax, dword [ebp - 0xb20]
mov dword [ebp - 0xb24], eax
mov ecx, dword [ebp - 0xb24]
mov dword [ebp - 0xb2c], ecx
mov edx, dword [ebp - 0x390]
add edx, 8
mov dword [ebp - 0xb28], edx
mov eax, dword [ebp - 0x588]
push eax
mov ecx, dword [ebp - 0xb28]
call fcn.100d47d0
mov ecx, dword [ebp - 0xb2c]
mov dword [eax], ecx
mov edx, 0x74
shl edx, 2
mov eax, dword [ebp - 0x390]
add edx, dword [eax + 4]
mov dword [ebp - 0x58c], edx
mov ecx, dword [ebp - 0x58c]
cmp dword [ecx], 0
je 0x101acd78
mov edx, dword [ebp - 0x58c]
mov eax, dword [edx]
mov dword [ebp - 0xb30], eax
mov ecx, dword [ebp - 0xb30]
mov dword [ebp - 0xb34], ecx
lea edx, [ebp - 0xb34]
mov dword [ebp - 0xb38], edx
mov eax, dword [ebp - 0x2b8]
or eax, 0x200
mov dword [ebp - 0x2b8], eax
mov ecx, dword [ebp - 0xb38]
mov dword [ebp - 0x590], ecx
jmp 0x101acdab
mov dword [ebp - 0xb3c], 0
lea edx, [ebp - 0xb3c]
mov dword [ebp - 0xb40], edx
mov eax, dword [ebp - 0x2b8]
or eax, 0x400
mov dword [ebp - 0x2b8], eax
mov ecx, dword [ebp - 0xb40]
mov dword [ebp - 0x590], ecx
mov edx, dword [ebp - 0x590]
mov dword [ebp - 0xb44], edx
mov eax, dword [ebp - 0xb44]
mov ecx, dword [eax]
mov dword [ebp - 0x464], ecx
mov edx, dword [ebp - 0x2b8]
or edx, 0x800
mov dword [ebp - 0x2b8], edx
mov eax, dword [ebp - 0x2b8]
and eax, 0x400
je 0x101acdee
and dword [ebp - 0x2b8], 0xfffffbff
mov ecx, dword [ebp - 0x2b8]
and ecx, 0x200
je 0x101ace06
and dword [ebp - 0x2b8], 0xfffffdff
mov edx, dword [ebp - 0x2b8]
or edx, 0x100
mov dword [ebp - 0x2b8], edx
lea eax, [ebp - 0x464]
mov dword [ebp - 0xb48], eax
mov ecx, dword [ebp - 0x2c8]
add ecx, 0xe0
mov dword [ebp - 0x2e4], ecx
mov edx, dword [0x1054e010]
mov dword [ebp - 0xb4c], edx
lea eax, [ebp - 0x394]
mov dword [ebp - 0x594], eax
mov ecx, dword [ebp - 0x594]
mov edx, dword [ebp - 0xb4c]
mov dword [ecx], edx
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x10d8], eax
mov dword [ebp - 4], 6
mov ecx, dword [ebp - 0x2e4]
mov edx, dword [ebp - 0x394]
mov dword [ecx], edx
mov eax, dword [ebp - 0x394]
mov ecx, dword [eax]
mov dword [ebp - 0xb50], ecx
mov edx, dword [ebp - 0x2e4]
mov eax, dword [ebp - 0xb50]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0x2e4]
cmp dword [ecx + 4], 0
jne 0x101aceb2
mov dword [ebp - 4], 0xffffffff
jmp 0x101ad0ec
mov dword [ebp - 0x3d8], 0
mov edx, dword [ebp - 0x2e4]
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 0x3d8]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0x598], edx
cmp dword [ebp - 0x598], 0
jne 0x101acee6
mov byte [ebp - 0x2d5], 0
jmp 0x101acf3d
mov eax, dword [0x103f6500]
mov dword [ebp - 0xb54], eax
push 0x1c
lea ecx, [ebp - 0x190]
push ecx
mov edx, dword [ebp - 0x598]
push edx
call dword [ebp - 0xb54]
test eax, eax
jne 0x101acf14
mov byte [ebp - 0x2d5], 0
jmp 0x101acf3d
mov eax, dword [ebp - 0x17c]
and eax, 1
jne 0x101acf2d
mov ecx, dword [ebp - 0x17c]
and ecx, 0x100
je 0x101acf36
mov byte [ebp - 0x2d5], 0
jmp 0x101acf3d
mov byte [ebp - 0x2d5], 1
movzx edx, byte [ebp - 0x2d5]
test edx, edx
je 0x101acf5c
mov eax, dword [ebp - 0x2c8]
add eax, 0xe0
mov dword [ebp - 0x398], eax
mov dword [ebp - 0xb74], 0x101a4840
mov ecx, dword [ebp - 0x398]
movzx edx, byte [ecx + 0x10]
test edx, edx
je 0x101ad125
mov eax, 0x15
add eax, 1
mov dword [ebp - 0x5a0], eax
jmp 0x101ad12f
mov dword [ebp - 0x5a0], 0x15
mov ecx, dword [ebp - 0x5a0]
mov dword [ebp - 0x5a4], ecx
mov edx, dword [ebp - 0x398]
cmp dword [edx + 4], 0
je 0x101ad16d
mov ecx, dword [ebp - 0x398]
add ecx, 8
call fcn.100d47b0
movzx eax, al
test eax, eax
je 0x101ad16d
mov ecx, dword [ebp - 0x398]
mov edx, dword [ebp - 0x5a4]
cmp edx, dword [ecx + 0xc]
jbe 0x101ad199
mov dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x2b8]
or eax, 0x1000
mov dword [ebp - 0x2b8], eax
lea ecx, [ebp - 0x46c]
mov dword [ebp - 0xb9c], ecx
jmp 0x101ad2ed
mov ecx, dword [ebp - 0x2c8]
add ecx, 0xcc
mov dword [ebp - 0x308], ecx
mov edx, dword [0x1054e008]
mov dword [ebp - 0xba0], edx
lea eax, [ebp - 0x39c]
mov dword [ebp - 0x5b0], eax
mov ecx, dword [ebp - 0x5b0]
mov edx, dword [ebp - 0xba0]
mov dword [ecx], edx
mov eax, dword [ebp - 0x5b0]
mov dword [ebp - 0x10dc], eax
mov dword [ebp - 4], 7
mov ecx, dword [ebp - 0x308]
mov edx, dword [ebp - 0x39c]
mov dword [ecx], edx
mov eax, dword [ebp - 0x39c]
mov ecx, dword [eax]
mov dword [ebp - 0xba4], ecx
mov edx, dword [ebp - 0x308]
mov eax, dword [ebp - 0xba4]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0x308]
cmp dword [ecx + 4], 0
jne 0x101ad37b