Function at 0x10027895
Capabilities:
Enumerate pe sections
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007e3ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4e0
push esi
push edi
mov dword [ebp - 0x78], 0xfffffff6
mov dword [ebp - 0x16c], 0x23b6182e
mov dword [ebp - 0x68], 0x516a205b
mov dword [ebp - 0x27c], 5
mov dword [ebp - 0x300], 0xfffffffc
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
jne 0x100278ff
mov dword [ebp - 0x130], 1
jmp 0x10027906
and dword [ebp - 0x130], 0
cmp dword [ebp - 0x78], 1
jne 0x10027918
mov dword [ebp - 0x284], 1
jmp 0x1002791f
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x68], 0x9884
jg 0x10027946
mov dword [ebp - 0x28c], 1
jmp 0x1002794d
and dword [ebp - 0x28c], 0
cmp dword [ebp - 0x28c], 0xfffffff9
jge 0x10027962
mov dword [ebp - 0x294], 1
jmp 0x10027969
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
sub eax, 0x6b17
jne 0x1002798b
cmp dword [ebp - 0x78], 0
jne 0x1002798b
and dword [ebp - 0x318], 0
jmp 0x10027995
mov dword [ebp - 0x318], 1
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x408], eax
mov dword [ebp - 0x27c], 0x8f98
mov eax, dword [ebp - 0x27c]
cmp dword [ebp - 0x130], eax
jge 0x100279c2
mov dword [ebp - 0x1f0], 1
jmp 0x100279c9
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x1f0], eax
jl 0x100279e0
mov dword [ebp - 0x138], 1
jmp 0x100279e7
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x300], eax
mov byte [ebp - 0x4a], 0
movzx eax, byte [ebp - 0x4a]
test eax, eax
je 0x10027a1b
push 0x231c
push 0xb53
push 0x18f1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100299c9
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x54], 0xe9934b0b
mov dword [ebp - 0x3a0], 0xb17b722b
mov dword [ebp - 0x39c], 0xb17b722b
mov dword [ebp - 0x398], 0xb17b722b
mov dword [ebp - 0x394], 0xb17b722b
lea ecx, [ebp - 0xfd]
call fcn.10008dc3
push eax
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x3a0]
push eax
lea ecx, [ebp - 0x4e4]
call fcn.10017e4b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x47c]
call fcn.10017dfa
and dword [ebp - 4], 0
mov dword [ebp - 0x308], 0xff18c9a0
cmp dword [ebp - 0x24], 0
je 0x10027c4a
push 4
lea ecx, [ebp - 0x120]
call fcn.10017d9e
mov byte [ebp - 4], 1
mov dword [ebp - 0xb0], 0
jmp 0x10027ad4
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 4
jge 0x10027af6
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x120]
call fcn.10017e3c
mov dword [eax], 0xfffffffc
jmp 0x10027ac7
push 0
lea ecx, [ebp - 0x120]
call fcn.10017e3c
and dword [eax], 0
mov dword [ebp - 0x24], 0
jmp 0x10027b16
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x10027c39
mov dword [ebp - 0x280], 0xfffffffb
push dword [ebp - 0x24]
lea ecx, [ebp - 0x120]
call fcn.10017e3c
cmp dword [eax], 0
jne 0x10027b7d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x54], 1
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x250], eax
push 1
lea ecx, [ebp - 0x47c]
call fcn.10017e3c
mov ecx, dword [ebp - 0x250]
mov dword [eax], ecx
cmp dword [ebp - 0x250], 0
jne 0x10027b7d
and dword [ebp - 0x140], 0
jmp 0x10027b87
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x140], eax
jle 0x10027bb0
push 0
lea ecx, [ebp - 0x120]
call fcn.10017e3c
cmp dword [eax], 0
je 0x10027bb0
mov dword [ebp - 0x1f8], 1
jmp 0x10027bb7
and dword [ebp - 0x1f8], 0
cmp dword [ebp - 0x1f8], 0xbdd7
je 0x10027bde
push 0
lea ecx, [ebp - 0x120]
call fcn.10017e3c
cmp dword [eax], 0
jne 0x10027bde
and dword [ebp - 0x148], 0
jmp 0x10027be8
mov dword [ebp - 0x148], 1
push dword [ebp - 0x24]
lea ecx, [ebp - 0x120]
call fcn.10017e3c
push 0
lea ecx, [ebp - 0x120]
call fcn.10017e3c
mov ecx, dword [ebp - 0x148]
add ecx, dword [eax]
mov dword [ebp - 0x280], ecx
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x418], eax
push 0
lea ecx, [ebp - 0x120]
call fcn.10017e3c
mov dword [ebp - 0x308], 0xffffffff
jmp 0x10027b0f
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.10017e20
jmp 0x10027cb2
mov dword [ebp - 0x310], 0xe3bf118c
mov byte [ebp - 0x44], 0
movzx eax, byte [ebp - 0x44]
test eax, eax
je 0x10027c70
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov dword [ebp - 0x54], 0
jmp 0x10027c80
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x17
jne 0x10027cb2
mov dword [ebp - 0x2d0], 0x1966
mov byte [ebp - 0x4e], 0
movzx eax, byte [ebp - 0x4e]
test eax, eax
je 0x10027ca4
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x2d0], eax
jmp 0x10027c79
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x47c]
call fcn.10017e20
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x31c], eax
push 1
lea ecx, [ebp - 0x3cc]
call fcn.10017d9e
mov dword [ebp - 4], 2
mov dword [ebp - 0x60], 0x3606de71
mov dword [ebp - 0x94], 0
jmp 0x10027d07
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x10027d26
push dword [ebp - 0x94]
lea ecx, [ebp - 0x3cc]
call fcn.10017e3c
and dword [eax], 0
jmp 0x10027cfa
mov byte [ebp - 0x46], 0
movzx eax, byte [ebp - 0x46]
test eax, eax
je 0x10027d3f
push 0
push 0x762
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
mov dword [ebp - 0x60], 0
jmp 0x10027d4f
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x10027d9a
mov dword [ebp - 0xb4], 0x1738ab65
mov dword [ebp - 0xb4], 0
jmp 0x10027d78
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
jl 0x10027d98
push dword [ebp - 0x60]
lea ecx, [ebp - 0x3cc]
call fcn.10017e3c
cmp dword [eax], 0
je 0x10027d96
jmp 0x10027d98
jmp 0x10027d6b
jmp 0x10027d48
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3cc]
call fcn.10017e20
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80], eax
push 2
lea ecx, [ebp - 0x368]
call fcn.10017d9e
mov dword [ebp - 4], 3
mov dword [ebp - 0x34], 0
jmp 0x10027dd3
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x10027de9
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x420], 1
jmp 0x10027dcc
mov dword [ebp - 0x34], 0
jmp 0x10027df9
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x10027e12
push dword [ebp - 0x34]
lea ecx, [ebp - 0x368]
call fcn.10017e3c
or dword [eax], 0xffffffff
jmp 0x10027df2
push 1
lea ecx, [ebp - 0x368]
call fcn.10017e3c
and dword [eax], 0
jmp 0x10027e48
push 1
lea ecx, [ebp - 0x368]
call fcn.10017e3c
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x150]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x368]
call fcn.10017e3c
cmp dword [eax], 0
jg 0x10027e77
mov byte [ebp - 0x4c], 0
movzx eax, byte [ebp - 0x4c]
test eax, eax
je 0x10027e75
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
jmp 0x10027e24
mov byte [ebp - 0x48], 0
movzx eax, byte [ebp - 0x48]
test eax, eax
je 0x10027e8d
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x368]
call fcn.10017e20
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1fc], eax
mov dword [ebp - 0x428], 0x5dce
mov dword [ebp - 0x430], 0x90c4d8e5
mov dword [ebp - 0x438], 0x35f394a2
mov dword [ebp - 0x440], 0xe31d8329
mov dword [ebp - 0x448], 0xffffffff
mov dword [ebp - 0x450], 0x144ad72d
mov dword [ebp - 0x45c], 0xffffffff
mov dword [ebp - 0x464], 0xcc590f02
push 3
lea ecx, [ebp - 0x48c]
call fcn.10017d9e
mov dword [ebp - 4], 4
mov dword [ebp - 0x46c], 0xf8ee1d11
mov dword [ebp - 0x4b0], 9
mov dword [ebp - 0x4b8], 0xffffffff
mov dword [ebp - 0x320], 0xffffffff
push 0x2522
lea eax, [ebp - 0x4c0]
push eax
lea eax, [ebp - 0x48c]
push eax
push 0
push 0x3d7c
push 0x52c6
call fcn.10027895
add esp, 0x18
push 0
lea eax, [ebp - 0x320]
push eax
call fcn.1002a3a3
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48c]
call fcn.10017e20
mov dword [ebp - 0x20], 0x13dd33a4
push 1
lea ecx, [ebp - 0x2a4]
call fcn.10017d9e
mov dword [ebp - 4], 5
mov dword [ebp - 0x180], 0x2674
mov dword [ebp - 0x1a0], 0x9ff40b36
push 2
lea ecx, [ebp - 0x3d8]
call fcn.10017d9e
mov byte [ebp - 4], 6
mov dword [ebp - 0x2c], 0
jmp 0x10027fca
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10027fe6
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x2a4]
call fcn.10017e3c
mov dword [eax], 0xfffffffe
jmp 0x10027fc3
mov dword [ebp - 0x2c], 0
jmp 0x10027ff6
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x10028012
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x3d8]
call fcn.10017e3c
mov dword [eax], 0xfffffff8
jmp 0x10027fef
mov dword [ebp - 0x20], 0
jmp 0x10028022
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffef
jl 0x10028074
mov dword [ebp - 0x200], 0x1d89
mov dword [ebp - 0x328], 0x5efa20bd
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x200]
test eax, eax
je 0x1002805f
cmp dword [ebp - 0x200], 0
je 0x1002805f
mov dword [ebp - 0x158], 1
jmp 0x10028066
and dword [ebp - 0x158], 0
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x328], eax
jmp 0x1002801b
mov dword [ebp - 0x20], 0xd
jmp 0x10028084
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff9
je 0x1002848e
mov dword [ebp - 0x14], 0x51d52aa0
mov dword [ebp - 0xc4], 0xffffffff
mov eax, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x14], 0xca7
add eax, ecx
cmp eax, 8
jbe 0x100280bc
mov dword [ebp - 0x258], 1
jmp 0x100280c3
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x258]
test eax, eax
jne 0x100280e0
cmp dword [ebp - 0x14], 0
jne 0x100280e0
and dword [ebp - 0x160], 0
jmp 0x100280ea
mov dword [ebp - 0x160], 1
mov eax, 0xfff7
sub eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x160]
test eax, eax
je 0x1002822d
mov dword [ebp - 0x208], 0xd29ed7d4
mov dword [ebp - 0x9c], 0
jmp 0x10028124
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x10028140
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x49c], 0x451d77f1
jmp 0x10028117
mov dword [ebp - 0x14], 0
jmp 0x10028150
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x1002817b
mov byte [ebp - 0x4f], 0
movzx eax, byte [ebp - 0x4f]
test eax, eax
je 0x10028179
push 0x1bb6
push 0
push 0x149a
push 0x26e9
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
jmp 0x10028149
mov dword [ebp - 0x14], 0
jmp 0x1002818b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x10028228
mov dword [ebp - 0x350], 1
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2a4]
call fcn.10017e3c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x49c]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x208]
cmp dword [ebp - 0x14], eax
jne 0x100281d7
mov dword [ebp - 0x168], 1
jmp 0x100281de
and dword [ebp - 0x168], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x49c]
cmp eax, dword [ebp - 0x168]
jl 0x100281ff
mov dword [ebp - 0x298], 1
jmp 0x10028206
and dword [ebp - 0x298], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2a4]
call fcn.10017e3c
mov eax, dword [eax]
imul eax, dword [ebp - 0x298]
mov dword [ebp - 0x350], eax
jmp 0x10028184
jmp 0x10028489
mov dword [ebp - 0xfc], 0xffffffff
mov dword [ebp - 0x220], 0x8636eebc
mov dword [ebp - 0x178], 0xefce06df
mov dword [ebp - 0x228], 0xbbb785aa
mov dword [ebp - 0x2dc], 0xfffffffe
mov esi, dword [ebp - 0xfc]
push 0
lea ecx, [ebp - 0x2a4]
call fcn.10017e3c
mov ecx, dword [ebp - 0xfc]
imul ecx, dword [eax]
cmp esi, ecx
jne 0x1002828b
mov dword [ebp - 0x170], 1
jmp 0x10028292
and dword [ebp - 0x170], 0
push 0
lea ecx, [ebp - 0x2a4]
call fcn.10017e3c
mov ecx, dword [ebp - 0x170]
cmp ecx, dword [eax]
je 0x100282b5
mov dword [ebp - 0x2f8], 1
jmp 0x100282bc
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x4b4], eax
mov eax, 0xffff
test eax, eax
je 0x100282e3
cmp dword [ebp - 0xfc], 0
je 0x100282e3
mov dword [ebp - 0x210], 1
jmp 0x100282ea
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x210]
sub eax, dword [ebp - 0x220]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
sub eax, 0xa
je 0x10028318
xor eax, eax
inc eax
je 0x10028318
mov dword [ebp - 0x260], 1
jmp 0x1002831f
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0x180], 0
jge 0x10028340
mov dword [ebp - 0x268], 1
jmp 0x10028347
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0xc4]
dec eax
cmp eax, dword [ebp - 0x180]
jge 0x1002836e
mov dword [ebp - 0x218], 1
jmp 0x10028375
and dword [ebp - 0x218], 0
push 0
lea ecx, [ebp - 0x2a4]
call fcn.10017e3c
mov ecx, dword [ebp - 0x218]
cmp ecx, dword [eax]
jg 0x10028398
mov dword [ebp - 0x188], 1
jmp 0x1002839f
and dword [ebp - 0x188], 0
cmp dword [ebp - 0x188], 0xfff6
je 0x100283b7
mov dword [ebp - 0x288], 1
jmp 0x100283be
and dword [ebp - 0x288], 0
push 0
lea ecx, [ebp - 0x2a4]
call fcn.10017e3c
mov ecx, dword [ebp - 0x288]
cmp ecx, dword [eax]
jge 0x100283e1
mov dword [ebp - 0x190], 1
jmp 0x100283e8
and dword [ebp - 0x190], 0
cmp dword [ebp - 0x190], 0
jne 0x10028403
cmp dword [ebp - 0xc4], 0
jne 0x10028403
and dword [ebp - 0x198], 0
jmp 0x1002840d
mov dword [ebp - 0x198], 1
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x198], eax
jge 0x10028427
mov dword [ebp - 0x1a8], 1
jmp 0x1002842e
and dword [ebp - 0x1a8], 0
imul eax, dword [ebp - 0x268], 0xfffffffd
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp - 0x1a8]
jne 0x10028461
mov dword [ebp - 0xec], 1
jmp 0x10028468
and dword [ebp - 0xec], 0
push 0
lea ecx, [ebp - 0x3d8]
call fcn.10017e3c
mov ecx, dword [ebp - 0xec]
mov dword [eax], ecx
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x2dc], eax
jmp 0x1002807d
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3d8]
call fcn.10017e20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a4]
call fcn.10017e20
mov dword [ebp - 0x1c], 6
push 3
lea ecx, [ebp - 0xd8]
call fcn.10017d9e
mov dword [ebp - 4], 7
mov dword [ebp - 0x3c], 0xecf04b06
mov dword [ebp - 0x1d0], 5
mov dword [ebp - 0x1d8], 0
mov dword [ebp - 0xa4], 0
jmp 0x100284fb
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x1002851d
push dword [ebp - 0xa4]
lea ecx, [ebp - 0xd8]
call fcn.10017e3c
mov dword [eax], 1
jmp 0x100284ee
mov byte [ebp - 0x42], 0
movzx eax, byte [ebp - 0x42]
test eax, eax
je 0x10028539
push 0x16cf
push 0x11b0
call dword [sym.imp.USER32.dll_SetCaretPos]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2a8], eax
push 2
lea ecx, [ebp - 0xd8]
call fcn.10017e3c
mov ecx, dword [ebp - 0x2a8]
mov dword [eax], ecx
cmp dword [ebp - 0x2a8], 0
je 0x100286a5
mov dword [ebp - 0x5c], 6
mov dword [ebp - 0x1b8], 6
mov dword [ebp - 0x334], 0xb0fe2cf4
mov dword [ebp - 0x1c], 9
jmp 0x1002858f
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1c
jne 0x100285c2
mov byte [ebp - 0x43], 0
movzx eax, byte [ebp - 0x43]
test eax, eax
je 0x100285a9
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [ebp - 0x45], 0
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x100285c0
push 0x1e70
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x10028588
cmp dword [ebp - 0x5c], 9
jb 0x100285d4
mov dword [ebp - 0x348], 1
jmp 0x100285db
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x3fc], eax
mov esi, dword [ebp - 0x5c]
push 2
lea ecx, [ebp - 0xd8]
call fcn.10017e3c
add esi, dword [eax]
cmp esi, dword [ebp - 0x5c]
jle 0x10028607
mov dword [ebp - 0x1b0], 1
jmp 0x1002860e
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x1b0], eax
jle 0x10028625
mov dword [ebp - 0x230], 1
jmp 0x1002862c
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x3c], eax
mov esi, dword [ebp - 0x3c]
push 2
lea ecx, [ebp - 0xd8]
call fcn.10017e3c
cmp dword [eax], esi
jle 0x10028650
cmp dword [ebp - 0x1b8], 0
push 0
lea ecx, [ebp - 0xd8]
call fcn.10017e3c
imul esi, dword [eax], 0xffff
push 0
lea ecx, [ebp - 0xd8]
call fcn.10017e3c
cmp esi, dword [eax]
je 0x10028680
mov dword [ebp - 0x2e4], 1
jmp 0x10028687
and dword [ebp - 0x2e4], 0
push 2
lea ecx, [ebp - 0xd8]
call fcn.10017e3c
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x334], eax
jmp 0x10028991
mov dword [ebp - 0xbc], 0xc3ae5071
mov dword [ebp - 0x64], 0xfffffff7
mov dword [ebp - 0x104], 0xfffffffe
mov dword [ebp - 0x2fc], 0
mov dword [ebp - 0x3c], 0xfffffffa
jmp 0x100286da
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jle 0x10028859
mov dword [ebp - 0x108], 2
mov dword [ebp - 0x1c], 0x17
jmp 0x100286fe
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2a
jl 0x10028854
mov dword [ebp - 0xf4], 0xffffffff
mov dword [ebp - 0x270], 0xffffffff
cmp dword [ebp - 0x108], 0x16de
jg 0x10028806
mov eax, dword [ebp - 0x270]
cmp dword [ebp - 0x108], eax
jl 0x10028746
mov dword [ebp - 0x2ec], 1
jmp 0x1002874d
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x4bc], eax
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0x34c]
cmp eax, dword [ebp - 0x2f4]
jg 0x100287a4
mov dword [ebp - 0x1c0], 1
jmp 0x100287ab
and dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0x1c0]
jl 0x100287c5
mov dword [ebp - 0x238], 1
jmp 0x100287cc
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x460], eax
push 2
lea ecx, [ebp - 0xd8]
call fcn.10017e3c
push 2
lea ecx, [ebp - 0xd8]
call fcn.10017e3c
cmp dword [eax], 0
jne 0x10028806
and dword [ebp - 0x1c8], 0
jmp 0x10028810
mov dword [ebp - 0x1c8], 1
push 2
lea ecx, [ebp - 0xd8]
call fcn.10017e3c
mov ecx, dword [ebp - 0x1c8]
cmp ecx, dword [eax]
jle 0x10028833
mov dword [ebp - 0x290], 1
jmp 0x1002883a
and dword [ebp - 0x290], 0
push 2
lea ecx, [ebp - 0xd8]
call fcn.10017e3c
mov ecx, dword [ebp - 0x290]
mov dword [eax], ecx
jmp 0x100286f7
jmp 0x100286d3
mov dword [ebp - 0x1d0], 0x7ee8c4b0
cmp dword [ebp - 0x1d0], 0
je 0x10028881
cmp dword [ebp - 0x104], 0
je 0x10028881
mov dword [ebp - 0x240], 1
jmp 0x10028888
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x1d8], eax
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1d8], eax
je 0x100288b5
mov eax, 0xb447
test eax, eax
jne 0x100288b5
and dword [ebp - 0x278], 0
jmp 0x100288bf
mov dword [ebp - 0x278], 1
mov eax, dword [ebp - 0x104]
imul eax, dword [ebp - 0x278]
cmp dword [ebp - 0xbc], eax
jge 0x100288e0
mov dword [ebp - 0x1e0], 1
jmp 0x100288e7
and dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1e0], eax
jne 0x10028904
mov eax, 0xfff6
test eax, eax
jne 0x10028904
and dword [ebp - 0x1e8], 0
jmp 0x1002890e
mov dword [ebp - 0x1e8], 1
mov dword [ebp - 0x64], 0xfffffff9
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x248], eax
push 2
lea ecx, [ebp - 0xd8]
call fcn.10017e3c
mov ecx, dword [ebp - 0x248]
mov dword [eax], ecx
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x1e8]
jne 0x10028953
mov dword [ebp - 0x128], 1
jmp 0x1002895a
and dword [ebp - 0x128], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x128], eax
jge 0x1002897a
cmp dword [ebp - 0x64], 0
je 0x1002897a
mov dword [ebp - 0x33c], 1
jmp 0x10028981
and dword [ebp - 0x33c], 0
imul eax, dword [ebp - 0xbc], 0x85aa
mov dword [ebp - 0x2fc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd8]
call fcn.10017e20
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x40], 0x141b6ba0
mov dword [ebp - 0x3b4], 0xf37d437f
mov dword [ebp - 0x3b0], 0xf37d437f
mov dword [ebp - 0x3ac], 0xf37d437f
mov dword [ebp - 0x3a8], 0xf37d437f
lea ecx, [ebp - 0xe1]
call fcn.10008dc3
push eax
lea eax, [ebp - 0x3a4]
push eax
lea eax, [ebp - 0x3b4]
push eax
lea ecx, [ebp - 0x4ec]
call fcn.10017e4b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x378]
call fcn.10017dfa
mov dword [ebp - 4], 8
mov dword [ebp - 0x10], 0
jmp 0x10028a22
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe6
jge 0x10028c97
push 3
lea ecx, [ebp - 0x2b4]
call fcn.10017d9e
mov byte [ebp - 4], 9
mov dword [ebp - 0x28], 0
jmp 0x10028a4d
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10028a69
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2b4]
call fcn.10017e3c
mov dword [eax], 0xd16df251
jmp 0x10028a46
mov dword [ebp - 0x28], 0
jmp 0x10028a79
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x10028a8f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x36c], 0xfffffff8
jmp 0x10028a72
push 2
lea ecx, [ebp - 0x2b4]
call fcn.10017e3c
mov dword [eax], 0xffffffea
jmp 0x10028ac8
push 2
lea ecx, [ebp - 0x2b4]
call fcn.10017e3c
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x12c]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x2b4]
call fcn.10017e3c
cmp dword [eax], 0xfffffffa
jne 0x10028c83
mov dword [ebp - 0xac], 0xfc1da7bc
push 2
lea ecx, [ebp - 0x2b4]
call fcn.10017e3c
cmp dword [ebp - 0x10], 1
jl 0x10028b07
mov dword [ebp - 0x134], 1
jmp 0x10028b0e
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x134]
sub eax, 0x1aa5bbe7
je 0x10028b30
cmp dword [ebp - 0xac], 0
je 0x10028b30
mov dword [ebp - 0x13c], 1
jmp 0x10028b37
and dword [ebp - 0x13c], 0
cmp dword [ebp - 0x13c], 0xfffffffb
jle 0x10028b4c
mov dword [ebp - 0x144], 1
jmp 0x10028b53
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x144]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x36c]
jg 0x10028b78
mov dword [ebp - 0x14c], 1
jmp 0x10028b7f
and dword [ebp - 0x14c], 0
cmp dword [ebp - 0x14c], 0xde46
jl 0x10028b97
mov dword [ebp - 0x154], 1
jmp 0x10028b9e
and dword [ebp - 0x154], 0
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0x154]
jl 0x10028bb8
mov dword [ebp - 0x15c], 1
jmp 0x10028bbf
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x15c], eax
jg 0x10028bd6
mov dword [ebp - 0x164], 1
jmp 0x10028bdd
and dword [ebp - 0x164], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x164], eax
jge 0x10028bf4
mov dword [ebp - 0x304], 1
jmp 0x10028bfb
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x414], eax
mov eax, dword [ebp - 0xac]
add eax, 0x2c2b87db
jne 0x10028c1e
xor eax, eax
jne 0x10028c1e
and dword [ebp - 0x124], 0
jmp 0x10028c28
mov dword [ebp - 0x124], 1
push 2
lea ecx, [ebp - 0x2b4]
call fcn.10017e3c
mov eax, dword [eax]
imul eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0xac]
je 0x10028c52
mov dword [ebp - 0x174], 1
jmp 0x10028c59
and dword [ebp - 0x174], 0
cmp dword [ebp - 0x174], 0
ja 0x10028c6e
mov dword [ebp - 0x17c], 1
jmp 0x10028c75
and dword [ebp - 0x17c], 0
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x40], eax
jmp 0x10028aa4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x2b4]
call fcn.10017e20
jmp 0x10028a1b
mov dword [ebp - 0x10], 3
jmp 0x10028ca7
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x10028d91
push dword [ebp - 0x10]
lea ecx, [ebp - 0x378]
call fcn.10017e3c
cmp dword [eax], 0
je 0x10028cd4
cmp dword [ebp - 0x40], 0
je 0x10028ccf
jmp 0x10028d91
jmp 0x10028d8c
mov dword [ebp - 0x344], 1
mov dword [ebp - 0x40], 3
jmp 0x10028cee
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x10028d8c
push dword [ebp - 0x40]
lea ecx, [ebp - 0x378]
call fcn.10017e3c
mov ecx, dword [ebp - 0x344]
cmp dword [eax], ecx
jl 0x10028d1c
mov dword [ebp - 0x184], 1
jmp 0x10028d23
and dword [ebp - 0x184], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x378]
call fcn.10017e3c
mov eax, dword [eax]
neg eax
cmp dword [ebp - 0x184], eax
jg 0x10028d49
mov dword [ebp - 0x18c], 1
jmp 0x10028d50
and dword [ebp - 0x18c], 0
push dword [ebp - 0x40]
lea ecx, [ebp - 0x378]
call fcn.10017e3c
mov ecx, dword [ebp - 0x18c]
mov dword [eax], ecx
mov byte [ebp - 0x47], 0
push 0x242f
push 0x175d
lea eax, [ebp - 0x47]
push eax
push 0x614b
push 0
call fcn.1002a698
add esp, 0x14
jmp 0x10028ce7
jmp 0x10028ca0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x378]
call fcn.10017e20
mov dword [ebp - 0x6c], 0x951ad386
mov dword [ebp - 0x3e8], 0xffffffff
mov dword [ebp - 0x3e4], 0xffffffff
mov dword [ebp - 0x3e0], 0xffffffff
mov dword [ebp - 0x3dc], 0xffffffff
mov dword [ebp - 0xe0], 0x8217
mov dword [ebp - 0x4a0], 0
mov dword [ebp - 0x8c], 0
jmp 0x10028dfc
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x10028e18
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x2cc], 0xffff
jmp 0x10028def
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2cc]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x6c], 0
jmp 0x10028e37
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jg 0x10029160
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x1f4], 0xfffffffe
mov dword [ebp - 0x18], 2
jmp 0x10028e62
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1002915b
push 2
lea ecx, [ebp - 0x114]
call fcn.10017d9e
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x90], 0
jmp 0x10028e99
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x10028ebb
push dword [ebp - 0x90]
lea ecx, [ebp - 0x114]
call fcn.10017e3c
mov dword [eax], 1
jmp 0x10028e8c
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x3e8], 1
push 1
lea ecx, [ebp - 0x114]
call fcn.10017e3c
and dword [eax], 0
jmp 0x10028f01
push 1
lea ecx, [ebp - 0x114]
call fcn.10017e3c
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x194]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x114]
call fcn.10017e3c
cmp dword [eax], 2
jg 0x10029147
mov dword [ebp - 0x1cc], 1
mov dword [ebp - 0x1e4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x2cc]
mov dword [ebp - 0x41c], eax
push 1
lea ecx, [ebp - 0x114]
call fcn.10017e3c
mov esi, eax
mov edi, dword [ebp - 0x18]
push 1
lea ecx, [ebp - 0x114]
call fcn.10017e3c
imul edi, dword [eax]
imul edi, dword [esi]
cmp edi, dword [ebp - 0xe0]
je 0x10028f74
mov dword [ebp - 0x19c], 1
jmp 0x10028f7b
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x2cc]
cmp dword [ebp - 0x19c], eax
jg 0x10028f99
mov dword [ebp - 0x1a4], 1
jmp 0x10028fa0
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x1a4]
add eax, 0x1780eec2
je 0x10028fc2
mov eax, 0x3e5ec352
test eax, eax
je 0x10028fc2
mov dword [ebp - 0x1ac], 1
jmp 0x10028fc9
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x1ac], eax
jg 0x10028fe0
mov dword [ebp - 0x1b4], 1
jmp 0x10028fe7
and dword [ebp - 0x1b4], 0
cmp dword [ebp - 0x1b4], 0xfafb
jle 0x10028fff
mov dword [ebp - 0x1bc], 1
jmp 0x10029006
and dword [ebp - 0x1bc], 0
cmp dword [ebp - 0x1bc], 0xfffffffb
je 0x1002901b
mov dword [ebp - 0x30c], 1
jmp 0x10029022
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x468], eax
imul eax, dword [ebp - 0x18], 0xbc69
imul eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0x1cc]
jle 0x1002904d
mov dword [ebp - 0x1c4], 1
jmp 0x10029054
and dword [ebp - 0x1c4], 0
mov esi, dword [ebp - 0x18]
add esi, dword [ebp - 0x1c4]
push 1
lea ecx, [ebp - 0x114]
call fcn.10017e3c
cmp esi, dword [eax]
je 0x100290da
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0xe0], eax
jne 0x10029088
mov dword [ebp - 0x1d4], 1
jmp 0x1002908f
and dword [ebp - 0x1d4], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x2cc]
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1dc]
mov dword [ebp + eax*4 - 0x2cc], ecx
mov eax, dword [ebp - 0x1d4]
sub eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x1f4], eax
mov byte [ebp - 0x49], 0
movzx eax, byte [ebp - 0x49]
test eax, eax
je 0x100290d8
push 0xd28
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x10029142
mov dword [ebp - 0x32c], 0xfffffff7
mov esi, dword [ebp - 0x32c]
push 4
pop eax
shl eax, 1
sub esi, dword [ebp + eax - 0x2cc]
push 1
lea ecx, [ebp - 0x114]
call fcn.10017e3c
imul esi, dword [eax]
mov dword [ebp - 0x1e4], esi
mov esi, dword [ebp - 0x1e4]
push 1
lea ecx, [ebp - 0x114]
call fcn.10017e3c
cmp esi, dword [eax]
jg 0x1002912f
mov dword [ebp - 0x1ec], 1
jmp 0x10029136
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x1f4], eax
jmp 0x10028edd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.10017e20
jmp 0x10028e5b
jmp 0x10028e30
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x80]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x30], eax
and dword [ebp - 0xe8], 0
jmp 0x10029194
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0x30]
add eax, 0x28
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0xe8], eax
jge 0x100299c7
mov dword [ebp - 0xa0], 0x2cb51dba
mov dword [ebp - 0x424], 0xffffffff
mov dword [ebp - 0x98], 0
jmp 0x100291d6
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 4
jge 0x100291f2
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x3f8], 0xfff9
jmp 0x100291c9
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3f8]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x3f8], eax
mov dword [ebp - 0xa0], 0
jmp 0x10029224
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jg 0x10029325
mov dword [ebp - 0xa8], 0
jmp 0x1002924a
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 1
jge 0x10029263
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x7c], 0xfffffff9
jmp 0x1002923d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x7c], 3
jmp 0x10029288
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x7c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7c], 0
jl 0x10029320
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x74], 3
jmp 0x100292b0
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jl 0x1002931b
mov dword [ebp - 0x84], 0x50315362
mov dword [ebp - 0x84], 3
jmp 0x100292d9
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jl 0x100292fe
mov byte [ebp - 0x4b], 0
movzx eax, byte [ebp - 0x4b]
test eax, eax
je 0x100292fc
push 0
push 0x3a4f
call fcn.1002a446
pop ecx
pop ecx
jmp 0x100292cc
mov eax, dword [ebp - 0x74]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x7c]
mov eax, dword [ebp + eax*4 - 0x3f8]
mov dword [ebp + ecx*4 - 0x3f8], eax
jmp 0x100292a9
jmp 0x10029273
jmp 0x10029217
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x10], 0
jne 0x10029501
mov dword [ebp - 0xb8], 0xffffffff
mov dword [ebp - 0x314], 0
mov dword [ebp - 0x330], 0
mov dword [ebp - 0x88], 0
jmp 0x10029369
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x10029385
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x4d4], 1
jmp 0x1002935c
mov byte [ebp - 0x4d], 0
push 0
push 0x30b9
lea eax, [ebp - 0x4d]
push eax
call fcn.1002d83d
add esp, 0xc
mov dword [ebp - 0xb8], 1
jmp 0x100293b5
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jl 0x10029403
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xc0], 0
jmp 0x100293e1
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jg 0x100293f7
cmp dword [ebp - 0x314], 0
je 0x100293f5
jmp 0x100293f7
jmp 0x100293d4
mov dword [ebp - 0x330], 0
jmp 0x100293a8
lea eax, [ebp - 0x31c]
push eax
push 0x2b2a
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x4953
lea eax, [ebp - 0x1fc]
push eax
push 0
call fcn.100316b7
add esp, 0x1c
mov dword [ebp - 0x324], 0xffffffff
mov dword [ebp - 0x338], 0xe60f951f
mov dword [ebp - 0x4a4], 0x2a1e9487
mov dword [ebp - 0x42c], 0x10e164ca
mov dword [ebp - 0x470], 0x96e6c8ca
mov dword [ebp - 0x340], 0
mov dword [ebp - 0x434], 1
mov dword [ebp - 0xc8], 0
jmp 0x1002948f
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jge 0x100294ab
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x4a8], 0xd29729cf
jmp 0x10029482
push 0x419c
push 0x473c
push 0x3fbe
lea eax, [ebp - 0x338]
push eax
push 0x4f19
lea eax, [ebp - 0x324]
push eax
push 0x14f7
push 0
push 0x2da5
call fcn.1002a720
add esp, 0x24
push 0x2429
lea eax, [ebp - 0x340]
push eax
push 0
push 0x4aa
call fcn.10026bca
add esp, 0x10
jmp 0x1002917e
push 4
push 0x1000
mov eax, dword [ebp - 0x30]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1fc]
add ecx, dword [eax + 0xc]
push ecx
push 0xc22
push 0xfda
call fcn.10026116
pop ecx
pop ecx
call eax
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0x30]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2d4]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0xf8]
call fcn.100261cd
add esp, 0xc
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x38c], 0x2a43d953
mov dword [ebp - 0x388], 0x2a43d953
mov dword [ebp - 0x384], 0x2a43d953
mov dword [ebp - 0x380], 0x2a43d953
lea ecx, [ebp - 0xd9]
call fcn.10008dc3
push eax
lea eax, [ebp - 0x37c]
push eax
lea eax, [ebp - 0x38c]
push eax
lea ecx, [ebp - 0x4dc]
call fcn.10017e4b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x4cc]
call fcn.10017dfa
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x274], 0
mov dword [ebp - 0xcc], 0
jmp 0x100295ea
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 2
jge 0x10029606
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x458], 0x19583e35
jmp 0x100295dd
mov dword [ebp - 0x58], 0xfffffff6
jmp 0x10029616
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xfffffff0
jle 0x100296e9
push 3
lea ecx, [ebp - 0x2c0]
call fcn.10017d9e
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x43c], 0x79cd329b
lea eax, [ebp - 0x480]
push eax
push 0x1691
push 1
lea eax, [ebp - 0x2c0]
push eax
call fcn.10026bca
add esp, 0x10
push 1
lea ecx, [ebp - 0x2c0]
call fcn.10017e3c
and dword [eax], 0
jmp 0x1002968e
push 1
lea ecx, [ebp - 0x2c0]
call fcn.10017e3c
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x204]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x2c0]
call fcn.10017e3c
cmp dword [eax], 3
jg 0x100296d5
push 1
lea ecx, [ebp - 0x2c0]
call fcn.10017e3c
xor ecx, ecx
inc ecx
sub ecx, dword [eax]
cmp ecx, 0xfffffffa
jne 0x100296c3
mov dword [ebp - 0x20c], 1
jmp 0x100296ca
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x38], eax
jmp 0x1002966a
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x2c0]
call fcn.10017e20
jmp 0x1002960f
mov dword [ebp - 0x38], 0
jmp 0x100296f9
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x12
jle 0x10029994
mov dword [ebp - 0x444], 0xfb07
mov dword [ebp - 0x234], 0xfffffffe
push 3
lea ecx, [ebp - 0x3c0]
call fcn.10017d9e
mov byte [ebp - 4], 0xd
mov dword [ebp - 0xf0], 1
push 2
lea ecx, [ebp - 0x35c]
call fcn.10017d9e
mov byte [ebp - 4], 0xe
push 0
lea eax, [ebp - 0x3c0]
push eax
lea eax, [ebp - 0x2d8]
push eax
call fcn.100309ce
add esp, 0xc
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x35c]
push eax
push 0
call fcn.1002a4c5
add esp, 0xc
mov byte [ebp - 0x41], 0
movzx eax, byte [ebp - 0x41]
test eax, eax
je 0x10029798
push 0x3f2d
push 0x5c9d
push 0x200e
push 0
call fcn.1002a141
add esp, 0x10
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
jne 0x100297d8
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x214], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x214]
mov dword [ebp + eax - 0x458], ecx
cmp dword [ebp - 0x214], 0
jne 0x100297d8
and dword [ebp - 0x254], 0
jmp 0x100297e2
mov dword [ebp - 0x254], 1
mov dword [ebp - 0x58], 1
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x490], eax
mov eax, 0x4015
cmp eax, 1
jbe 0x1002981a
mov dword [ebp - 0x21c], 1
jmp 0x10029821
and dword [ebp - 0x21c], 0
push 1
lea ecx, [ebp - 0x35c]
call fcn.10017e3c
mov ecx, dword [ebp - 0x21c]
cmp ecx, dword [eax]
je 0x10029844
mov dword [ebp - 0x224], 1
jmp 0x1002984b
and dword [ebp - 0x224], 0
cmp dword [ebp - 0x224], 0xe188
je 0x10029863
mov dword [ebp - 0x22c], 1
jmp 0x1002986a
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x274]
cmp dword [ebp - 0x22c], eax
jg 0x10029884
mov dword [ebp - 0x23c], 1
jmp 0x1002988b
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x234]
cmp eax, dword [ebp - 0x23c]
jg 0x100298a5
mov dword [ebp - 0x244], 1
jmp 0x100298ac
and dword [ebp - 0x244], 0
cmp dword [ebp - 0x244], 0x17f72684
jl 0x100298c4
mov dword [ebp - 0x24c], 1
jmp 0x100298cb
and dword [ebp - 0x24c], 0
push 1
lea ecx, [ebp - 0x3c0]
call fcn.10017e3c
mov dword [eax], 0x4325
imul eax, dword [ebp - 0x24c], 0x4325
cmp eax, 1
ja 0x100298f9
mov dword [ebp - 0x25c], 1
jmp 0x10029900
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x254]
imul eax, dword [ebp - 0x25c]
cmp eax, dword [ebp - 0x38]
je 0x1002992d
push 1
lea ecx, [ebp - 0x35c]
call fcn.10017e3c
cmp dword [eax], 0
jne 0x1002992d
and dword [ebp - 0x264], 0
jmp 0x10029937
mov dword [ebp - 0x264], 1
cmp dword [ebp - 0x264], 0xb16aac89
ja 0x1002994f
mov dword [ebp - 0x26c], 1
jmp 0x10029956
and dword [ebp - 0x26c], 0
push 1
lea ecx, [ebp - 0x35c]
call fcn.10017e3c
mov ecx, dword [ebp - 0x26c]
sub ecx, dword [eax]
mov dword [ebp - 0x274], ecx
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x35c]
call fcn.10017e20
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x3c0]
call fcn.10017e20
jmp 0x100296f2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4cc]
call fcn.10017e20
push 0x5ed2
push 0x1b23
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0xf8]
push eax
push 0
call fcn.10029a36
add esp, 0x14
jmp 0x1002917e
jmp 0x10029a26
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0x70]
mov dword [eax], 0
jmp 0x10029a06
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x70]
mov dword [ecx], eax
mov eax, dword [ebp - 0x70]
cmp dword [eax], 3
jge 0x10029a26
mov eax, dword [ebp - 0x70]
push dword [eax]
mov ecx, dword [ebp - 0x2f0]
call fcn.10017e3c
mov dword [eax], 0xe6dc660f
jmp 0x100299fb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret