Function at 0x1002c8ea
Capabilities:
Encrypt data using speck
Identify system language via api
Modify service
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064c71
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x65c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x568], 0x124f01c0
mov dword [ebp - 0x598], 0xa3df603f
mov dword [ebp - 0x510], 8
mov dword [ebp - 0x578], 1
mov dword [ebp - 0x518], 0x5912491e
push 2
lea ecx, [ebp - 0x544]
call fcn.1002ff7c
and dword [ebp - 4], 0
mov dword [ebp - 0x5a0], 0xffffffff
mov dword [ebp - 0x1e8], 1
lea eax, [ebp - 0x544]
push eax
lea eax, [ebp - 0x520]
push eax
call fcn.1002c17d
pop ecx
pop ecx
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x544]
call fcn.1002fffe
and dword [ebp - 0x1c], 0
push 3
lea ecx, [ebp - 0x554]
call fcn.1002ff7c
mov dword [ebp - 4], 1
mov dword [ebp - 0x7c], 0xdada439b
mov dword [ebp - 0x580], 0x624cdb8f
push 1
lea eax, [ebp - 0x554]
push eax
push 0x713b
push 0x300e
push 1
lea eax, [ebp - 0x528]
push eax
call fcn.1002577d
add esp, 0x18
mov byte [ebp - 0x37], 0
lea eax, [ebp - 0x37]
push eax
call fcn.1002c1c2
pop ecx
mov dword [ebp - 0x7c], 0
jmp 0x1002ca02
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jg 0x1002cba5
mov dword [ebp - 0x35c], 0x7ab3921d
call fcn.1002c1f0
mov dword [ebp - 0x320], 0xe33
mov dword [ebp - 0x3b8], 0x10009fec
cmp dword [ebp - 0x320], 0x1185
jle 0x1002cb0f
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1eab
push 0x1bd6
push 0x60b
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
and dword [ebp - 0x104], 0
jmp 0x1002ca7a
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x45b0
jge 0x1002cb0f
and dword [ebp - 0x140], 0
jmp 0x1002caa0
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0x1cd4
jge 0x1002cb0a
and dword [ebp - 0x84], 0
jmp 0x1002cac2
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0x5f22
jge 0x1002cb08
mov eax, dword [ebp - 0x140]
cdq
idiv dword [ebp - 0x84]
or edx, dword [ebp - 0x104]
mov eax, edx
cdq
mov dword [ebp - 0x3c4], eax
mov dword [ebp - 0x3c0], edx
push dword [ebp - 0x3c0]
push dword [ebp - 0x3c4]
mov ecx, 0x1060e278
call fcn.1002fe67
jmp 0x1002cab5
jmp 0x1002ca93
jmp 0x1002ca6d
push 0xea7
push 0x5d3b
push 1
push 0x6ecb
push 0x7419
push 0x33bc
push 0x4c05
push 1
push 0x5797
push 0x14eb
lea eax, [ebp - 0x35c]
push eax
push 0x2ddc
push 0x166d
call fcn.10025c4c
add esp, 0x34
mov byte [ebp - 4], 2
cmp dword [ebp - 0x320], 0xa7f
jge 0x1002cb74
mov edx, dword [ebp - 0x3b8]
mov ecx, 0x1060e278
call fcn.10031911
jmp 0x1002cb90
mov dword [ebp - 4], 1
jmp 0x1002cba0
jmp 0x1002c9fb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x554]
call fcn.1002fffe
push 0
push 0x498a
push 0x4545
push 0x5052
push 0x4b0a
push 0
push 0x2eef
call fcn.1002ba50
add esp, 0x1c
mov dword [ebp - 0x2c], 0x7cb3
mov dword [ebp - 0x264], 0x8b01197b
cmp dword [ebp - 0x2c], 0
je 0x1002cfb8
mov dword [ebp - 0x34], 0x61f6
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x164], 0xfffffff7
lea eax, [ebp - 0x34]
push eax
call fcn.1002c227
pop ecx
mov dword [ebp - 0x34], 0x12
jmp 0x1002cc29
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xd
je 0x1002cfb6
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x2c], 0
jmp 0x1002cc4d
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x2a
jle 0x1002cfb1
and dword [ebp - 0x4b8], 0
and dword [ebp - 0x4b4], 0
and dword [ebp - 0x4b0], 0
and dword [ebp - 0x4ac], 0
lea ecx, [ebp - 0x17d]
call fcn.10030029
push eax
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x4b8]
push eax
lea ecx, [ebp - 0x5c4]
call fcn.1003002c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x4e8]
call fcn.1002ffd8
mov dword [ebp - 4], 4
mov dword [ebp - 0x30], 0x4990069f
mov dword [ebp - 0x30], 3
jmp 0x1002ccc6
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1002cf37
mov dword [ebp - 0x8c], 0x5fac1226
mov dword [ebp - 0x8c], 3
jmp 0x1002ccf3
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jl 0x1002cf32
cmp dword [ebp - 0x1a4], 0
jne 0x1002cd15
mov dword [ebp - 0x25c], 1
jmp 0x1002cd1c
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0x25c], eax
jl 0x1002cd4e
mov dword [ebp - 0x318], 1
jmp 0x1002cd55
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x318]
jne 0x1002cd6c
mov dword [ebp - 0x19c], 1
jmp 0x1002cd73
and dword [ebp - 0x19c], 0
push dword [ebp - 0x30]
lea ecx, [ebp - 0x4e8]
call fcn.1003001a
mov eax, dword [eax]
cmp eax, dword [ebp - 0x19c]
jle 0x1002cd97
mov dword [ebp - 0x474], 1
jmp 0x1002cd9e
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x508], eax
push 0xfffffffffffffff8
pop eax
cmp eax, 0xa3691f6f
jae 0x1002cefd
mov dword [ebp - 0x314], 0x4dcc
mov dword [ebp - 0x350], 0x1000a048
cmp dword [ebp - 0x314], 0x503c
jle 0x1002ceae
and dword [ebp - 0x144], 0
jmp 0x1002cdef
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0x7b8
jge 0x1002ceae
and dword [ebp - 0x94], 0
jmp 0x1002ce15
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0x1745
jge 0x1002cea9
and dword [ebp - 0x10c], 0
jmp 0x1002ce3b
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x1a2e
jge 0x1002cea4
mov eax, dword [ebp - 0x144]
add eax, dword [ebp - 0x94]
xor eax, dword [ebp - 0x10c]
cdq
mov dword [ebp - 0x3d0], eax
mov dword [ebp - 0x3cc], edx
push dword [ebp - 0x3cc]
push dword [ebp - 0x3d0]
lea ecx, [ebp - 0x624]
call fcn.1000db90
pop ecx
pop ecx
mov dword [ebp - 0x3b0], eax
mov ecx, dword [ebp - 0x3b0]
call fcn.1002fe47
push eax
call fcn.1004eea6
pop ecx
lea ecx, [ebp - 0x624]
call fcn.1002fe3d
jmp 0x1002ce2e
jmp 0x1002ce08
jmp 0x1002cde2
call fcn.1002c240
mov byte [ebp - 4], 5
cmp dword [ebp - 0x314], 0x4a2b
jge 0x1002cecf
push dword [ebp - 0x350]
call fcn.1004eea6
pop ecx
jmp 0x1002ceeb
mov dword [ebp - 4], 4
jmp 0x1002cefb
jmp 0x1002cf13
mov byte [ebp - 0x3e], 0
lea eax, [ebp - 0x3e]
push eax
call fcn.1002c366
pop ecx
cmp dword [ebp - 0x30], 0
je 0x1002cf13
jmp 0x1002cf32
push 1
push 1
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.100268c1
add esp, 0x10
jmp 0x1002cce6
jmp 0x1002ccbf
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x4e8]
push eax
lea eax, [ebp - 0x164]
push eax
push 0x5614
push 0x652e
push 0x4353
push 0x54e4
push 0x652f
lea eax, [ebp - 0x2c]
push eax
push 0x2b56
push 1
push 0x2a1b
push 0x4fd3
lea eax, [ebp - 0x34]
push eax
push 0x350
push 0x9c3
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x264]
push eax
push 0
call fcn.1002b37d
add esp, 0x4c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4e8]
call fcn.1002fffe
jmp 0x1002cc46
jmp 0x1002cc22
jmp 0x1002d005
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x344], 0xffffffff
push 0
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x344]
push eax
push 0x3b8a
push 0x5e7d
lea eax, [ebp - 0x2c]
push eax
push 0x6e42
push 1
lea eax, [ebp - 0x264]
push eax
push 0x57a7
call fcn.1002aa90
add esp, 0x28
mov dword [ebp - 0x34c], 0x8f8256a
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x26c], 0xb51f0ef2
mov dword [ebp - 0x1ac], 0x709a
mov dword [ebp - 0x3d4], 0x1000a0bc
cmp dword [ebp - 0x1ac], 0x71de
jle 0x1002d0f3
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
and dword [ebp - 0x148], 0
jmp 0x1002d060
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0x89e
jge 0x1002d0f3
and dword [ebp - 0xa4], 0
jmp 0x1002d086
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x142f
jge 0x1002d0ee
and dword [ebp - 0x114], 0
jmp 0x1002d0a8
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x6566
jge 0x1002d0ec
mov eax, dword [ebp - 0x148]
imul eax, dword [ebp - 0xa4]
and eax, dword [ebp - 0x114]
cdq
mov dword [ebp - 0x3dc], eax
mov dword [ebp - 0x3d8], edx
push dword [ebp - 0x3d8]
push dword [ebp - 0x3dc]
mov ecx, 0x1060e278
call fcn.1002fe67
jmp 0x1002d09b
jmp 0x1002d079
jmp 0x1002d053
mov dword [ebp - 0x1b4], 0
mov dword [ebp - 4], 7
cmp dword [ebp - 0x1ac], 0x6e69
jge 0x1002d120
mov edx, dword [ebp - 0x3d4]
mov ecx, 0x1060e278
call fcn.10031911
jmp 0x1002d13c
or dword [ebp - 4], 0xffffffff
jmp 0x1002d146
mov dword [ebp - 0x2c4], 1
push 4
lea ecx, [ebp - 0x4f4]
call fcn.1002ff7c
mov dword [ebp - 4], 9
mov dword [ebp - 0x354], 0x791b1675
mov dword [ebp - 0x498], 0x18101bc
push 0x5d91
push 1
push 0x76af
lea eax, [ebp - 0x530]
push eax
push 0xf2a
push 0
lea eax, [ebp - 0x4f4]
push eax
call fcn.1002afaf
add esp, 0x1c
push 1
push 0x53e1
push 0x3032
push 0x1649
push 1
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x1b4]
push eax
push 0x41ff
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x26c]
push eax
push 0x5c8f
push 1
lea eax, [ebp - 0x48]
push eax
call fcn.10026a77
add esp, 0x34
mov dword [ebp - 0x48], 0
jmp 0x1002d1f8
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jg 0x1002d285
mov dword [ebp - 0x3e0], 1
push 1
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x1b4]
push eax
push 0x73b8
push 0x38db
lea eax, [ebp - 0x26c]
push eax
push 0x5bde
push 0x48c7
push 0xebc
lea eax, [ebp - 0x4f4]
push eax
lea eax, [ebp - 0x498]
push eax
push 0x676
push 1
lea eax, [ebp - 0x354]
push eax
push 0x3874
lea eax, [ebp - 0x3e0]
push eax
push 0x6a
lea eax, [ebp - 0x48]
push eax
call fcn.10027471
add esp, 0x48
mov byte [ebp - 0x38], 0
lea eax, [ebp - 0x38]
push eax
call fcn.1002c39e
pop ecx
jmp 0x1002d1f1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4f4]
call fcn.1002fffe
mov dword [ebp - 0x50], 0xed3c15d0
mov dword [ebp - 0x16c], 0x6e1580eb
mov dword [ebp - 0x440], 0xfffffffb
mov dword [ebp - 0x324], 0xfffffffb
mov dword [ebp - 0xac], 0
jmp 0x1002d2d2
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x1002d2eb
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x18], 8
jmp 0x1002d2c5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x18], 0
jne 0x1002d30e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x18], 0
jne 0x1002d30e
and dword [ebp - 0x1c4], 0
jmp 0x1002d318
mov dword [ebp - 0x1c4], 1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x18], 0xffffffff
jne 0x1002d331
mov dword [ebp - 0x2f4], 1
jmp 0x1002d338
and dword [ebp - 0x2f4], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x18], 0x2ca3c0bf
je 0x1002d354
mov dword [ebp - 0x1bc], 1
jmp 0x1002d35b
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x1bc]
add eax, 0x1247
cmp dword [ebp - 0x2f4], eax
je 0x1002d37a
mov dword [ebp - 0x274], 1
jmp 0x1002d381
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x1c4]
cmp eax, dword [ebp - 0x274]
jg 0x1002d39b
mov dword [ebp - 0x1cc], 1
jmp 0x1002d3a2
and dword [ebp - 0x1cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
cmp dword [ebp - 0x1cc], eax
jge 0x1002d3c0
mov dword [ebp - 0x2cc], 1
jmp 0x1002d3c7
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x50], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x18], 0xffffffff
jl 0x1002d3e9
mov dword [ebp - 0x1dc], 1
jmp 0x1002d3f0
and dword [ebp - 0x1dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
mov dword [ebp - 0x56c], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x50], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x18], 0x3bdf78b1
jne 0x1002d422
mov dword [ebp - 0x1d4], 1
jmp 0x1002d429
and dword [ebp - 0x1d4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1d4]
dec ecx
cmp ecx, dword [ebp + eax - 0x18]
jl 0x1002d442
cmp dword [ebp - 0x50], 0
je 0x1002d45d
mov eax, 0x3407
test eax, eax
je 0x1002d45d
cmp dword [ebp - 0x50], 0
je 0x1002d45d
mov dword [ebp - 0x27c], 1
jmp 0x1002d464
and dword [ebp - 0x27c], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x18]
add ecx, dword [ebp - 0x27c]
sub ecx, dword [ebp + eax - 0x18]
cmp dword [ebp - 0x1dc], ecx
jg 0x1002d492
mov dword [ebp - 0x30c], 1
jmp 0x1002d499
and dword [ebp - 0x30c], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
push 4
pop edx
imul edx, edx, 0
mov edx, dword [ebp + edx - 0x18]
add edx, dword [ebp - 0x30c]
sub edx, dword [ebp + ecx - 0x18]
cmp edx, dword [ebp + eax - 0x18]
jl 0x1002d4cb
mov dword [ebp - 0x1e4], 1
jmp 0x1002d4d2
and dword [ebp - 0x1e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
cmp dword [ebp - 0x1e4], eax
jg 0x1002d4f0
mov dword [ebp - 0x284], 1
jmp 0x1002d4f7
and dword [ebp - 0x284], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
cmp dword [ebp - 0x284], eax
jg 0x1002d514
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x18], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x18]
cmp ecx, dword [ebp + eax - 0x18]
jg 0x1002d536
mov dword [ebp - 0x1ec], 1
jmp 0x1002d53d
and dword [ebp - 0x1ec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
cmp dword [ebp - 0x1ec], eax
je 0x1002d55b
mov dword [ebp - 0x2d4], 1
jmp 0x1002d562
and dword [ebp - 0x2d4], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x18]
imul ecx, dword [ebp - 0x2d4]
imul ecx, ecx, 0x6cd2
sub ecx, dword [ebp + eax - 0x18]
cmp ecx, 0xfff9
ja 0x1002d597
mov dword [ebp - 0x1f4], 1
jmp 0x1002d59e
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
je 0x1002d6d2
mov dword [ebp - 0x138], 0x4ff51021
mov dword [ebp - 0x364], 8
cmp dword [ebp - 0x138], 0
jne 0x1002d5e6
cmp dword [ebp - 0x16c], 0
jne 0x1002d5e6
and dword [ebp - 0x28c], 0
jmp 0x1002d5f0
mov dword [ebp - 0x28c], 1
imul eax, dword [ebp - 0x28c], 0x7102
cmp eax, dword [ebp - 0x138]
jge 0x1002d60e
mov dword [ebp - 0x1fc], 1
jmp 0x1002d615
and dword [ebp - 0x1fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18]
cmp dword [ebp - 0x1fc], eax
jl 0x1002d633
mov dword [ebp - 0x2fc], 1
jmp 0x1002d63a
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x2fc], eax
jne 0x1002d654
mov dword [ebp - 0x204], 1
jmp 0x1002d65b
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x324]
cmp dword [ebp - 0x204], eax
jne 0x1002d675
mov dword [ebp - 0x294], 1
jmp 0x1002d67c
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x294]
sub eax, dword [ebp - 0x138]
cmp dword [ebp - 0x440], eax
jg 0x1002d69c
mov dword [ebp - 0x20c], 1
jmp 0x1002d6a3
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x20c]
jg 0x1002d6ba
mov dword [ebp - 0x2dc], 1
jmp 0x1002d6c1
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x364], eax
jmp 0x1002d843
mov dword [ebp - 0x36c], 0x1e4171b3
mov dword [ebp - 0x214], 0x4e43
mov dword [ebp - 0x470], 0x1000a110
cmp dword [ebp - 0x214], 0x5039
jle 0x1002d7f1
and dword [ebp - 0xb4], 0
jmp 0x1002d716
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x2912
jge 0x1002d7d8
and dword [ebp - 0x11c], 0
jmp 0x1002d73c
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0x611c
jge 0x1002d7d3
and dword [ebp - 0xbc], 0
jmp 0x1002d762
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0x3094
jge 0x1002d7ce
mov eax, dword [ebp - 0xb4]
cdq
idiv dword [ebp - 0x11c]
and edx, dword [ebp - 0xbc]
mov eax, edx
cdq
mov dword [ebp - 0x3e8], eax
mov dword [ebp - 0x3e4], edx
push dword [ebp - 0x3e4]
push dword [ebp - 0x3e8]
lea ecx, [ebp - 0x654]
call fcn.1000db90
pop ecx
pop ecx
mov dword [ebp - 0x3ec], eax
mov ecx, dword [ebp - 0x3ec]
call fcn.1002fe47
push eax
call fcn.1004eea6
pop ecx
lea ecx, [ebp - 0x654]
call fcn.1002fe3d
jmp 0x1002d755
jmp 0x1002d72f
jmp 0x1002d709
push 0x2534
push 0x1ef9
push 0
push 0x25b1
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [ebp - 0x36c]
push eax
call fcn.1002c227
pop ecx
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x214], 0x4dbd
jge 0x1002d81d
push dword [ebp - 0x470]
call fcn.1004eea6
pop ecx
jmp 0x1002d839
or dword [ebp - 4], 0xffffffff
jmp 0x1002d843
push 1
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x184]
push eax
push 0xc49
push 1
push 0x34fa
call fcn.10027a20
add esp, 0x18
mov dword [ebp - 0x29c], 0x36e0
mov dword [ebp - 0x3f8], 0x1000a17c
cmp dword [ebp - 0x29c], 0x3a3d
jle 0x1002d8ee
and dword [ebp - 0x74], 0
jmp 0x1002d891
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x1ecb
jge 0x1002d8ee
and dword [ebp - 0xc4], 0
jmp 0x1002d8b0
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x5eb6
jge 0x1002d8ec
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0xc4]
sar eax, cl
cdq
mov dword [ebp - 0x3f4], eax
mov dword [ebp - 0x3f0], edx
push dword [ebp - 0x3f0]
push dword [ebp - 0x3f4]
mov ecx, 0x1060e278
call fcn.1002fe67
jmp 0x1002d8a3
jmp 0x1002d88a
mov eax, dword [ebp - 0x184]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002d9e5
push 3
lea ecx, [ebp - 0x564]
call fcn.1002ff7c
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x124], 0xdada439b
mov dword [ebp - 0x538], 0x624cdb8f
lea eax, [ebp - 0x564]
push eax
push 0x13e6
push 0x4722
push 0x137d
lea eax, [ebp - 0x574]
push eax
push 0x2baf
push 1
push 1
call fcn.10027adb
add esp, 0x20
mov byte [ebp - 0x3c], 0
push 1
push 0x70c
push 0x1358
lea eax, [ebp - 0x3c]
push eax
push 1
call fcn.10027d15
add esp, 0x14
mov dword [ebp - 0x124], 0
jmp 0x1002d98f
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 2
jg 0x1002d9cf
mov dword [ebp - 0x374], 0x7ab3921d
mov byte [ebp - 0x3a], 0
lea eax, [ebp - 0x3a]
push eax
call fcn.1002c3f9
pop ecx
push 1
push 1
lea eax, [ebp - 0x374]
push eax
push 0x3500
push 0x2f5f
call fcn.100280ba
add esp, 0x14
jmp 0x1002d982
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x564]
call fcn.1002fffe
xor eax, eax
jmp 0x1002f9e1
mov dword [ebp - 4], 0xd
cmp dword [ebp - 0x29c], 0x350c
jge 0x1002da08
mov edx, dword [ebp - 0x3f8]
mov ecx, 0x1060e278
call fcn.10031911
jmp 0x1002da24
or dword [ebp - 4], 0xffffffff
jmp 0x1002da2e
mov dword [ebp - 0x21c], 0x4e61
mov dword [ebp - 0x44c], 0x1000a1c0
cmp dword [ebp - 0x21c], 0x4ff6
jle 0x1002db39
push 0xeb4
push 0x3f8
call dword [sym.imp.USER32.dll_ReleaseDC]
and dword [ebp - 0xd4], 0
jmp 0x1002da78
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x5b2c
jge 0x1002db39
and dword [ebp - 0xcc], 0
jmp 0x1002da9e
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x360b
jge 0x1002db34
and dword [ebp - 0x14c], 0
jmp 0x1002dac4
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0x6ac8
jge 0x1002db2f
mov ecx, dword [ebp - 0xcc]
sub ecx, dword [ebp - 0x14c]
mov eax, dword [ebp - 0xd4]
sar eax, cl
cdq
mov dword [ebp - 0x400], eax
mov dword [ebp - 0x3fc], edx
push dword [ebp - 0x3fc]
push dword [ebp - 0x400]
lea ecx, [ebp - 0x5dc]
call fcn.1000db90
pop ecx
pop ecx
mov dword [ebp - 0x37c], eax
mov ecx, dword [ebp - 0x37c]
call fcn.1002fe47
push eax
call fcn.1004eea6
pop ecx
lea ecx, [ebp - 0x5dc]
call fcn.1002fe3d
jmp 0x1002dab7
jmp 0x1002da91
jmp 0x1002da6b
mov dword [ebp - 0x548], 0xffffffff
push 0x542c
push 1
push 0x3ffe
push 0x4710
push 0x4103
push 0x7005
push 0x4019
push 0x47ae
push 0x6d72
push 0x392
push 0x2c01
push 1
call fcn.10028183
add esp, 0x30
mov byte [ebp - 0x36], 0
lea eax, [ebp - 0x36]
push eax
call fcn.1002c427
pop ecx
mov dword [ebp - 4], 0xf
cmp dword [ebp - 0x21c], 0x4c97
jge 0x1002dbae
push dword [ebp - 0x44c]
call fcn.1004eea6
pop ecx
jmp 0x1002dbca
or dword [ebp - 4], 0xffffffff
jmp 0x1002dbd4
lea eax, [ebp - 0x5c]
push eax
push 1
push 1
push 0x5c59
push 0x3b3e
push 1
push 0x4bba
push 0x6af6
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp + 8]
push eax
call fcn.1002842e
add esp, 0x28
mov eax, dword [ebp - 0x5c]
cmp dword [eax], 0x4550
je 0x1002dc1c
call fcn.1002c457
xor eax, eax
jmp 0x1002f9e1
mov dword [ebp - 0x384], 0
push 1
lea ecx, [ebp - 0x4dc]
call fcn.1002ff7c
mov dword [ebp - 4], 0x11
lea eax, [ebp - 0x4dc]
push eax
push 1
push 0x10e6
lea eax, [ebp - 0x57c]
push eax
push 1
push 0x3926
push 0x1fc6
push 0x1fe7
push 0x3cea
push 0x78cf
push 0x1c8f
push 1
call fcn.10028709
add esp, 0x30
push 1
lea eax, [ebp - 0x384]
push eax
push 0x1b6e
push 0x39bd
push 1
lea eax, [ebp - 0x4dc]
push eax
call fcn.10028bd4
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4dc]
call fcn.1002fffe
push 0
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x130]
push eax
push 1
call fcn.1002aa08
add esp, 0x10
cmp dword [ebp - 0x130], 0
jne 0x1002e16e
mov dword [ebp - 0x58], 0xb9f9b31
mov dword [ebp - 0x174], 0x9822cb3a
mov dword [ebp - 0xec], 0xffffffff
mov dword [ebp - 0x12c], 0
jmp 0x1002dd04
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 2
jge 0x1002dd20
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0x18c], 1
jmp 0x1002dcf7
mov dword [ebp - 0x58], 0xffffffea
jmp 0x1002dd30
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xfffffff0
jge 0x1002e167
push 3
lea ecx, [ebp - 0x484]
call fcn.1002ff7c
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x22c], 0xa4f2a6ca
push 0x176c
push 0x1745
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0x692a
push 0x7f68
push 1
push 0x5796
push 0x37d2
push 0x20b
push 0
call fcn.1002bc54
add esp, 0x2c
mov dword [ebp - 0x6c], 0
jmp 0x1002dda2
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x1002ddb8
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x5bc], 0xfffffffb
jmp 0x1002dd9b
mov byte [ebp - 0x35], 0
lea eax, [ebp - 0x35]
push eax
call fcn.1002c5ea
pop ecx
push 0
lea ecx, [ebp - 0x484]
call fcn.1003001a
and dword [eax], 0
jmp 0x1002ddfc
push 0
lea ecx, [ebp - 0x484]
call fcn.1003001a
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 0x31c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x31c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x484]
call fcn.1003001a
cmp dword [eax], 1
jg 0x1002e153
mov dword [ebp - 0x20], 0xe9323d1b
mov dword [ebp - 0x234], 0xfffffffd
mov dword [ebp - 0x20], 1
jmp 0x1002de33
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x1002e14e
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x18c]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x18c], 0
je 0x1002e033
mov dword [ebp - 0x488], 0xfffb
mov dword [ebp - 0x224], 0x781a
mov dword [ebp - 0x38c], 0x1000a258
cmp dword [ebp - 0x224], 0x7a81
jle 0x1002dfcd
push 0
push 0x1092
push 0x1f0a
push 0
push 0x3fa
push 0x258
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
and dword [ebp - 0xdc], 0
jmp 0x1002deda
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0x3745
jge 0x1002dfcd
and dword [ebp - 0x154], 0
jmp 0x1002df00
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0x53ec
jge 0x1002dfc8
and dword [ebp - 0xe4], 0
jmp 0x1002df26
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0x610
jge 0x1002dfc3
and dword [ebp - 0x134], 0
jmp 0x1002df4c
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x1a8d
jge 0x1002dfbe
mov eax, dword [ebp - 0xdc]
imul eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0xe4]
sar eax, cl
and eax, dword [ebp - 0x134]
cdq
mov dword [ebp - 0x40c], eax
mov dword [ebp - 0x408], edx
push dword [ebp - 0x408]
push dword [ebp - 0x40c]
lea ecx, [ebp - 0x5f4]
call fcn.1000db90
pop ecx
pop ecx
mov dword [ebp - 0x404], eax
mov ecx, dword [ebp - 0x404]
call fcn.1002fe47
push eax
call fcn.1004eea6
pop ecx
lea ecx, [ebp - 0x5f4]
call fcn.1002fe3d
jmp 0x1002df3f
jmp 0x1002df19
jmp 0x1002def3
jmp 0x1002decd
cmp dword [ebp - 0x58], 0
je 0x1002dfd8
jmp 0x1002e14e
mov byte [ebp - 4], 0x13
cmp dword [ebp - 0x224], 0x7783
jge 0x1002dff4
push dword [ebp - 0x38c]
call fcn.1004eea6
pop ecx
jmp 0x1002e010
mov dword [ebp - 4], 0x12
jmp 0x1002e020
cmp dword [ebp - 0x488], 0
je 0x1002e02e
jmp 0x1002e14e
jmp 0x1002e149
mov dword [ebp - 0x17c], 0xffffffff
xor eax, eax
inc eax
je 0x1002e05b
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x18c], 0
je 0x1002e05b
mov dword [ebp - 0x2e4], 1
jmp 0x1002e062
and dword [ebp - 0x2e4], 0
mov dword [ebp - 0xec], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xec]
add ecx, dword [ebp + eax - 0x18c]
jne 0x1002e091
push 4
pop eax
test eax, eax
jne 0x1002e091
and dword [ebp - 0x2a4], 0
jmp 0x1002e09b
mov dword [ebp - 0x2a4], 1
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x22c]
add eax, dword [ebp - 0x2e4]
mov ecx, dword [ebp - 0x20]
imul ecx, eax
add ecx, dword [ebp - 0x17c]
imul ecx, dword [ebp - 0x234]
test ecx, ecx
je 0x1002e0df
cmp dword [ebp - 0x17c], 0
je 0x1002e0df
mov dword [ebp - 0x2ac], 1
jmp 0x1002e0e6
and dword [ebp - 0x2ac], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp + ecx*4 - 0x18c]
imul ecx, dword [ebp - 0x2ac]
cmp ecx, dword [ebp + eax - 0x5bc]
jge 0x1002e111
mov dword [ebp - 0x23c], 1
jmp 0x1002e118
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x18c]
cmp dword [ebp - 0x23c], eax
jg 0x1002e136
mov dword [ebp - 0x394], 1
jmp 0x1002e13d
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x174], eax
jmp 0x1002de2c
jmp 0x1002ddd8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x484]
call fcn.1002fffe
jmp 0x1002dd29
xor eax, eax
jmp 0x1002f9e1
lea eax, [ebp - 0x130]
push eax
push 1
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x558]
push eax
push 0xcd0
lea eax, [ebp - 0x1c]
push eax
push 0x27a1
push 1
push 0x204e
push 0x6e65
call fcn.10028fbd
add esp, 0x2c
mov dword [ebp - 0x13c], 0xda439beb
mov dword [ebp - 0x584], 0xffffffff
mov dword [ebp - 0x570], 0x18e418a5
mov dword [ebp - 0x588], 0x58e17c10
mov dword [ebp - 0x304], 0x2416
mov dword [ebp - 0x39c], 0x1000a2d0
cmp dword [ebp - 0x304], 0x24ff
jle 0x1002e297
and dword [ebp - 0x150], 0
jmp 0x1002e20d
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0xf41
jge 0x1002e297
and dword [ebp - 0xf4], 0
jmp 0x1002e22f
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0x7376
jge 0x1002e292
mov eax, dword [ebp - 0x150]
and eax, dword [ebp - 0xf4]
cdq
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x414], edx
push dword [ebp - 0x414]
push dword [ebp - 0x418]
lea ecx, [ebp - 0x60c]
call fcn.1000db90
pop ecx
pop ecx
mov dword [ebp - 0x410], eax
mov ecx, dword [ebp - 0x410]
call fcn.1002fe47
push eax
call fcn.1004eea6
pop ecx
lea ecx, [ebp - 0x60c]
call fcn.1002fe3d
jmp 0x1002e222
jmp 0x1002e200
mov dword [ebp - 4], 0x15
cmp dword [ebp - 0x304], 0x20b1
jge 0x1002e2b6
push dword [ebp - 0x39c]
call fcn.1004eea6
pop ecx
jmp 0x1002e2d2
or dword [ebp - 4], 0xffffffff
jmp 0x1002e2dc
mov dword [ebp - 0x458], 0x85e0710
mov dword [ebp - 0x28], 0
jmp 0x1002e2f6
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1002e30c
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5ac], 1
jmp 0x1002e2ef
mov dword [ebp - 0x28], 0
jmp 0x1002e31c
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1002e332
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x50c], 0x100c4307
jmp 0x1002e315
mov dword [ebp - 0x13c], 1
jmp 0x1002e34b
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jl 0x1002e42a
mov dword [ebp - 0x33c], 1
mov dword [ebp - 0x338], 1
mov dword [ebp - 0x334], 1
mov dword [ebp - 0x330], 1
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x33c], 0
jmp 0x1002e3ae
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x33c]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x33c], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x33c], 1
jg 0x1002e3fe
mov byte [ebp - 0x3d], 0
push 0x133a
push 0x6820
push 0x56ed
push 1
push 0x35a6
push 0x1cdc
push 0x7cfe
push 1
push 1
push 0x22a7
push 0x2ee0
lea eax, [ebp - 0x3d]
push eax
call fcn.1002963b
add esp, 0x30
jmp 0x1002e393
push 1
push 0x94
push 0x2e46
push 0x1192
lea eax, [ebp - 0x458]
push eax
push 1
push 0x6e5a
call fcn.100298b0
add esp, 0x1c
jmp 0x1002e33e
push dword [ebp - 0x1c]
push dword [ebp + 8]
push 0x58f0
push dword [ebp - 0x5c]
push 0x565a
push 1
push 0
call fcn.100154ee
add esp, 0x1c
mov dword [ebp - 0x4c], 0xf5540d7f
mov dword [ebp - 0x168], 1
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x4c], 0xffffffe8
jmp 0x1002e474
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xfffffff3
jle 0x1002e8e2
mov dword [ebp - 0x244], 0x6ccb
mov dword [ebp - 0x3a4], 0x1000a344
cmp dword [ebp - 0x244], 0x6e85
jle 0x1002e527
and dword [ebp - 0x80], 0
jmp 0x1002e4af
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x4d18
jge 0x1002e527
and dword [ebp - 0xfc], 0
jmp 0x1002e4ce
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0x7f04
jge 0x1002e525
and dword [ebp - 0x78], 0
jmp 0x1002e4e7
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x6512
jge 0x1002e523
mov ecx, dword [ebp - 0xfc]
sub ecx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x80]
sar eax, cl
cdq
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x420], edx
push dword [ebp - 0x420]
push dword [ebp - 0x424]
mov ecx, 0x1060e278
call fcn.1002fe67
jmp 0x1002e4e0
jmp 0x1002e4c1
jmp 0x1002e4a8
mov dword [ebp - 4], 0x17
cmp dword [ebp - 0x244], 0x6987
jge 0x1002e54a
mov edx, dword [ebp - 0x3a4]
mov ecx, 0x1060e278
call fcn.10031911
jmp 0x1002e566
or dword [ebp - 4], 0xffffffff
jmp 0x1002e570
mov dword [ebp - 0x2b4], 0x152a
mov dword [ebp - 0x41c], 0x1000a398
cmp dword [ebp - 0x2b4], 0x1732
jle 0x1002e63f
and dword [ebp - 0x98], 0
jmp 0x1002e5aa
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x76b
jge 0x1002e63f
and dword [ebp - 0x88], 0
jmp 0x1002e5d0
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xcca
jge 0x1002e63a
and dword [ebp - 0x90], 0
jmp 0x1002e5f2
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x2f34
jge 0x1002e638
mov eax, dword [ebp - 0x88]
cdq
idiv dword [ebp - 0x90]
and edx, dword [ebp - 0x98]
mov eax, edx
cdq
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x42c], edx
push dword [ebp - 0x42c]
push dword [ebp - 0x430]
mov ecx, 0x1060e278
call fcn.1002fe67
jmp 0x1002e5e5
jmp 0x1002e5c3
jmp 0x1002e59d
mov dword [ebp - 0x1b0], 0
mov dword [ebp - 4], 0x19
cmp dword [ebp - 0x2b4], 0x135f
jge 0x1002e66c
mov edx, dword [ebp - 0x41c]
mov ecx, 0x1060e278
call fcn.10031911
jmp 0x1002e688
or dword [ebp - 4], 0xffffffff
jmp 0x1002e692
mov dword [ebp - 0x1b8], 0xfffffffa
mov dword [ebp - 0x1d0], 0x7f47073
mov dword [ebp - 0x478], 0xe4879289
mov dword [ebp - 0xa0], 0
jmp 0x1002e6c9
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x1002e6e2
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x44], 5
jmp 0x1002e6bc
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x44], 0
jmp 0x1002e707
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x44], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x44], 0xffffffe2
je 0x1002e8dd
mov dword [ebp - 0x64], 0xc3f4f880
mov dword [ebp - 0x1c0], 6
cmp dword [ebp - 0x4c], 0
je 0x1002e734
jmp 0x1002e8dd
mov eax, 0xec62bb2c
test eax, eax
je 0x1002e743
cmp dword [ebp - 0x4c], 0
jne 0x1002e752
cmp dword [ebp - 0x64], 0
jne 0x1002e752
and dword [ebp - 0x24c], 0
jmp 0x1002e75c
mov dword [ebp - 0x24c], 1
cmp dword [ebp - 0x24c], 0xccedb775
ja 0x1002e774
mov dword [ebp - 0x2ec], 1
jmp 0x1002e77b
and dword [ebp - 0x2ec], 0
cmp dword [ebp - 0x2ec], 0xa6c8
jle 0x1002e793
mov dword [ebp - 0x254], 1
jmp 0x1002e79a
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x254]
sub eax, dword [ebp - 0x64]
jne 0x1002e7b7
cmp dword [ebp - 0x168], 0
jne 0x1002e7b7
and dword [ebp - 0x2bc], 0
jmp 0x1002e7c1
mov dword [ebp - 0x2bc], 1
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x2bc]
jg 0x1002e7d8
mov dword [ebp - 0x194], 1
jmp 0x1002e7df
and dword [ebp - 0x194], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
add eax, dword [ebp - 0x194]
je 0x1002e7f5
cmp dword [ebp - 0x64], 0
cmp dword [ebp - 0x168], 0
je 0x1002e810
cmp dword [ebp - 0x64], 0
je 0x1002e810
mov dword [ebp - 0x198], 1
jmp 0x1002e817
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
jne 0x1002e83e
mov eax, 0x8110cbbb
test eax, eax
jne 0x1002e83e
and dword [ebp - 0x3ac], 0
jmp 0x1002e848
mov dword [ebp - 0x3ac], 1
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x514], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x44], 0x9843
jne 0x1002e870
mov dword [ebp - 0x1a8], 1
jmp 0x1002e877
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1b0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
add eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x1b8]
sub eax, dword [ebp - 0x1c0]
cmp eax, dword [ebp - 0x168]
jge 0x1002e8b9
mov dword [ebp - 0x1c8], 1
jmp 0x1002e8c0
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x478], eax
jmp 0x1002e6f2
jmp 0x1002e46d
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x290]
push eax
call fcn.1002c618
add esp, 0xc
mov dword [ebp - 0x54], 0xed3c15d0
mov dword [ebp - 0x170], 0x6e1580eb
mov dword [ebp - 0x1d8], 0x4543
mov dword [ebp - 0x3b4], 0x1000a410
cmp dword [ebp - 0x1d8], 0x4566
jle 0x1002ea0d
and dword [ebp - 0xa8], 0
jmp 0x1002e947
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x4286
jge 0x1002ea0d
and dword [ebp - 0xb0], 0
jmp 0x1002e96d
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x3e3a
jge 0x1002ea08
and dword [ebp - 0xb8], 0
jmp 0x1002e993
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0x6054
jge 0x1002ea03
and dword [ebp - 0xc0], 0
jmp 0x1002e9b5
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x810
jge 0x1002ea01
mov eax, dword [ebp - 0xa8]
cdq
idiv dword [ebp - 0xb0]
sub edx, dword [ebp - 0xb8]
and edx, dword [ebp - 0xc0]
mov eax, edx
cdq
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x438], edx
push dword [ebp - 0x438]
push dword [ebp - 0x43c]
mov ecx, 0x1060e278
call fcn.1002fe67
jmp 0x1002e9a8
jmp 0x1002e986
jmp 0x1002e960
jmp 0x1002e93a
mov dword [ebp - 0x3bc], 0xfffffffb
mov dword [ebp - 4], 0x1b
cmp dword [ebp - 0x1d8], 0x41b8
jge 0x1002ea3a
mov edx, dword [ebp - 0x3b4]
mov ecx, 0x1060e278
call fcn.10031911
jmp 0x1002ea56
or dword [ebp - 4], 0xffffffff
jmp 0x1002ea60
mov dword [ebp - 0x428], 0xfffffffb
mov dword [ebp - 0xc8], 0
jmp 0x1002ea83
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jge 0x1002ea9c
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x14], 8
jmp 0x1002ea76
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x14], 0
jne 0x1002eabf
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x14], 0
jne 0x1002eabf
and dword [ebp - 0x1f0], 0
jmp 0x1002eac9
mov dword [ebp - 0x1f0], 1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x14], 0xffffffff
jne 0x1002eae2
mov dword [ebp - 0x190], 1
jmp 0x1002eae9
and dword [ebp - 0x190], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x14], 0x2ca3c0bf
je 0x1002eb05
mov dword [ebp - 0x1e0], 1
jmp 0x1002eb0c
and dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x1e0]
add eax, 0x1247
cmp dword [ebp - 0x190], eax
je 0x1002eb2b
mov dword [ebp - 0x1f8], 1
jmp 0x1002eb32
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x1f0]
cmp eax, dword [ebp - 0x1f8]
jg 0x1002eb4c
mov dword [ebp - 0x200], 1
jmp 0x1002eb53
and dword [ebp - 0x200], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
cmp dword [ebp - 0x200], eax
jge 0x1002eb71
mov dword [ebp - 0x208], 1
jmp 0x1002eb78
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x54], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x14], 0xffffffff
jl 0x1002eb9a
mov dword [ebp - 0x220], 1
jmp 0x1002eba1
and dword [ebp - 0x220], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
mov dword [ebp - 0x51c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x54], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x14], 0x3bdf78b1
jne 0x1002ebd3
mov dword [ebp - 0x210], 1
jmp 0x1002ebda
and dword [ebp - 0x210], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x210]
dec ecx
cmp ecx, dword [ebp + eax - 0x14]
jl 0x1002ebf3
cmp dword [ebp - 0x54], 0
je 0x1002ec0e
mov eax, 0x3407
test eax, eax
je 0x1002ec0e
cmp dword [ebp - 0x54], 0
je 0x1002ec0e
mov dword [ebp - 0x218], 1
jmp 0x1002ec15
and dword [ebp - 0x218], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x14]
add ecx, dword [ebp - 0x218]
sub ecx, dword [ebp + eax - 0x14]
cmp dword [ebp - 0x220], ecx
jg 0x1002ec43
mov dword [ebp - 0x228], 1
jmp 0x1002ec4a
and dword [ebp - 0x228], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
push 4
pop edx
imul edx, edx, 0
mov edx, dword [ebp + edx - 0x14]
add edx, dword [ebp - 0x228]
sub edx, dword [ebp + ecx - 0x14]
cmp edx, dword [ebp + eax - 0x14]
jl 0x1002ec7c
mov dword [ebp - 0x230], 1
jmp 0x1002ec83
and dword [ebp - 0x230], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
cmp dword [ebp - 0x230], eax
jg 0x1002eca1
mov dword [ebp - 0x238], 1
jmp 0x1002eca8
and dword [ebp - 0x238], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
cmp dword [ebp - 0x238], eax
jg 0x1002ecc5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x14], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x14]
cmp ecx, dword [ebp + eax - 0x14]
jg 0x1002ece7
mov dword [ebp - 0x240], 1
jmp 0x1002ecee
and dword [ebp - 0x240], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
cmp dword [ebp - 0x240], eax
je 0x1002ed0c
mov dword [ebp - 0x248], 1
jmp 0x1002ed13
and dword [ebp - 0x248], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x14]
imul ecx, dword [ebp - 0x248]
imul ecx, ecx, 0x6cd2
sub ecx, dword [ebp + eax - 0x14]
cmp ecx, 0xfff9
ja 0x1002ed48
mov dword [ebp - 0x250], 1
jmp 0x1002ed4f
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0
je 0x1002ee80
mov dword [ebp - 0xd0], 0x4ff51021
mov dword [ebp - 0x464], 8
cmp dword [ebp - 0xd0], 0
jne 0x1002ed97
cmp dword [ebp - 0x170], 0
jne 0x1002ed97
and dword [ebp - 0x258], 0
jmp 0x1002eda1
mov dword [ebp - 0x258], 1
imul eax, dword [ebp - 0x258], 0x7102
cmp eax, dword [ebp - 0xd0]
jge 0x1002edbf
mov dword [ebp - 0x260], 1
jmp 0x1002edc6
and dword [ebp - 0x260], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
cmp dword [ebp - 0x260], eax
jl 0x1002ede4
mov dword [ebp - 0x268], 1
jmp 0x1002edeb
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x268], eax
jne 0x1002ee05
mov dword [ebp - 0x270], 1
jmp 0x1002ee0c
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x428]
cmp dword [ebp - 0x270], eax
jne 0x1002ee26
mov dword [ebp - 0x278], 1
jmp 0x1002ee2d
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x278]
sub eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x3bc], eax
jg 0x1002ee4d
mov dword [ebp - 0x280], 1
jmp 0x1002ee54
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x280]
jg 0x1002ee6b
mov dword [ebp - 0x288], 1
jmp 0x1002ee72
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x464], eax
jmp 0x1002eed4
mov dword [ebp - 0x3c8], 0x1e4171b3
push 0x25d8
push 0x928
push 1
push 0x8fe
push 0x4584
push 0x74cd
push 0x222d
push 0x78c6
push 0x1b29
push 1
lea eax, [ebp - 0x3c8]
push eax
push 0x1cc7
push 0x8b3
push 0x52ce
call fcn.10029c53
add esp, 0x38
cmp dword [ebp - 0x290], 0
je 0x1002ef03
push 0x5ab5
push 1
lea eax, [ebp - 0x290]
push eax
push 1
lea eax, [ebp - 0x1c]
push eax
push 0x4c15
push 0x5813
call fcn.10029ffc
add esp, 0x1c
mov dword [ebp - 0x298], 0x774d
mov dword [ebp - 0x32c], 0x1000a480
cmp dword [ebp - 0x298], 0x79c2
jle 0x1002f003
and dword [ebp - 0xe8], 0
jmp 0x1002ef3d
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0x3313
jge 0x1002f003
and dword [ebp - 0xd8], 0
jmp 0x1002ef63
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x5503
jge 0x1002effe
and dword [ebp - 0xe0], 0
jmp 0x1002ef89
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0x34df
jge 0x1002eff9
and dword [ebp - 0xf0], 0
jmp 0x1002efab
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0x935
jge 0x1002eff7
mov ecx, dword [ebp - 0xd8]
imul ecx, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe8]
shl eax, cl
and eax, dword [ebp - 0xf0]
cdq
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x444], edx
push dword [ebp - 0x444]
push dword [ebp - 0x448]
mov ecx, 0x1060e278
call fcn.1002fe67
jmp 0x1002ef9e
jmp 0x1002ef7c
jmp 0x1002ef56
jmp 0x1002ef30
mov dword [ebp - 4], 0x1d
cmp dword [ebp - 0x298], 0x76d6
jge 0x1002f026
mov edx, dword [ebp - 0x32c]
mov ecx, 0x1060e278
call fcn.10031911
jmp 0x1002f042
or dword [ebp - 4], 0xffffffff
jmp 0x1002f04c
push 3
lea ecx, [ebp - 0x160]
call fcn.1002ff7c
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x24], 0x2667a876
mov dword [ebp - 0x178], 0xe2de4bf7
mov dword [ebp - 0x524], 0x12ef314d
mov dword [ebp - 0x358], 0xeec73f5c
mov dword [ebp - 0x2f0], 3
push 1
lea ecx, [ebp - 0x594]
call fcn.1002ff7c
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x328], 1
mov dword [ebp - 0x370], 0x17773416
push 0x140b
lea eax, [ebp - 0x160]
push eax
push 0x4f07
push 1
lea eax, [ebp - 0x340]
push eax
push 0x2ee6
push 0x103f
push 1
call fcn.1002a0e6
add esp, 0x20
push 1
push 0x1262
push 0x7630
push 0x4e91
push 1
lea eax, [ebp - 0x594]
push eax
push 0x11e3
push 0x3b82
lea eax, [ebp - 0x340]
push eax
push 1
push 0x4452
call fcn.1002a326
add esp, 0x2c
mov dword [ebp - 0x24], 2
jmp 0x1002f12c
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1002f469
mov dword [ebp - 0xf8], 0xcc1d
push 3
lea ecx, [ebp - 0x494]
call fcn.1002ff7c
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x60]
push eax
push 1
push 0xde5
push 0x5ad1
push 0x2a00
push 0x59ee
push 1
call fcn.1002a8d7
add esp, 0x20
mov dword [ebp - 0x60], 0
jmp 0x1002f18c
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1002f1a2
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x454], 8
jmp 0x1002f185
push dword [ebp - 0x24]
lea ecx, [ebp - 0x160]
call fcn.1003001a
push dword [ebp - 0x24]
lea ecx, [ebp - 0x160]
call fcn.1003001a
mov esi, eax
push 1
lea ecx, [ebp - 0x160]
call fcn.1003001a
mov eax, dword [eax]
cmp eax, dword [esi]
jge 0x1002f1df
mov dword [ebp - 0x2a0], 1
jmp 0x1002f1e6
and dword [ebp - 0x2a0], 0
push 1
lea ecx, [ebp - 0x160]
call fcn.1003001a
mov ecx, dword [ebp - 0x2a0]
cmp ecx, dword [eax]
jle 0x1002f219
push dword [ebp - 0x24]
lea ecx, [ebp - 0x160]
call fcn.1003001a
cmp dword [eax], 0
je 0x1002f219
cmp dword [ebp - 0xf8], 0
jne 0x1002f22b
cmp dword [ebp - 0x178], 0
jne 0x1002f22b
and dword [ebp - 0x2a8], 0
jmp 0x1002f235
mov dword [ebp - 0x2a8], 1
push dword [ebp - 0x24]
lea ecx, [ebp - 0x160]
call fcn.1003001a
mov eax, dword [eax]
cmp eax, dword [ebp - 0x2a8]
je 0x1002f259
mov dword [ebp - 0x2b0], 1
jmp 0x1002f260
and dword [ebp - 0x2b0], 0
push 2
lea ecx, [ebp - 0x160]
call fcn.1003001a
mov ecx, dword [ebp - 0x2b0]
cmp ecx, dword [eax]
jl 0x1002f283
mov dword [ebp - 0x348], 1
jmp 0x1002f28a
and dword [ebp - 0x348], 0
mov esi, dword [ebp - 0xf8]
add esi, 0x6aa1c33
neg esi
push 1
lea ecx, [ebp - 0x160]
call fcn.1003001a
add esi, dword [eax]
mov dword [ebp - 0x178], esi
push dword [ebp - 0x24]
lea ecx, [ebp - 0x160]
call fcn.1003001a
push 1
lea ecx, [ebp - 0x160]
call fcn.1003001a
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x2f0], 0
je 0x1002f2f2
mov eax, 0x2c1
test eax, eax
je 0x1002f2f2
mov dword [ebp - 0x2b8], 1
jmp 0x1002f2f9
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x358]
cmp dword [ebp - 0x2b8], eax
jne 0x1002f313
mov dword [ebp - 0x2c0], 1
jmp 0x1002f31a
and dword [ebp - 0x2c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x454]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x2c0]
dec eax
mov dword [ebp - 0x368], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x454]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x454], eax
mov eax, dword [ebp - 0x360]
cmp eax, dword [ebp - 0x368]
jg 0x1002f36f
mov dword [ebp - 0x2c8], 1
jmp 0x1002f376
and dword [ebp - 0x2c8], 0
push 2
lea ecx, [ebp - 0x494]
call fcn.1003001a
mov ecx, dword [ebp - 0x2c8]
sub ecx, dword [eax]
cmp dword [ebp - 0x178], ecx
jge 0x1002f3a5
mov eax, 0x3095
test eax, eax
jne 0x1002f3a5
and dword [ebp - 0x2d0], 0
jmp 0x1002f3af
mov dword [ebp - 0x2d0], 1
mov esi, dword [ebp - 0x370]
push 2
lea ecx, [ebp - 0x494]
call fcn.1003001a
mov ecx, dword [ebp - 0x2d0]
add ecx, dword [eax]
cmp ecx, esi
jg 0x1002f3da
mov dword [ebp - 0x2d8], 1
jmp 0x1002f3e1
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x2d8], eax
jg 0x1002f3fb
mov dword [ebp - 0x2e0], 1
jmp 0x1002f402
and dword [ebp - 0x2e0], 0
mov esi, dword [ebp - 0x2e0]
sub esi, dword [ebp - 0xf8]
push 0
lea ecx, [ebp - 0x494]
call fcn.1003001a
cmp esi, dword [eax]
jne 0x1002f42b
mov dword [ebp - 0x2e8], 1
jmp 0x1002f432
and dword [ebp - 0x2e8], 0
mov esi, dword [ebp - 0x2e8]
sub esi, 0x990b
push dword [ebp - 0x24]
lea ecx, [ebp - 0x160]
call fcn.1003001a
imul esi, dword [eax]
mov dword [ebp - 0x2f0], esi
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x494]
call fcn.1002fffe
jmp 0x1002f125
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x594]
call fcn.1002fffe
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.1002fffe
push dword [ebp - 0x1c]
call fcn.10017a2d
pop ecx
test eax, eax
jne 0x1002f49b
xor eax, eax
jmp 0x1002f9e1
mov dword [ebp - 0x100], 0
jmp 0x1002f4b4
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 3
jge 0x1002f4d0
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x4a4], 5
jmp 0x1002f4a7
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x4a4], 0
jmp 0x1002f4fe
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4a4]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x4a4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4a4], 0
jle 0x1002f578
mov dword [ebp - 0x504], 0xdf60
mov dword [ebp - 0x500], 0xdf60
mov dword [ebp - 0x4fc], 0xdf60
mov dword [ebp - 0x4f8], 0xdf60
mov dword [ebp - 0x68], 0xfddd3f46
mov dword [ebp - 0x68], 0
jmp 0x1002f54d
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jg 0x1002f563
mov byte [ebp - 0x39], 0
lea eax, [ebp - 0x39]
push eax
call fcn.1002c646
pop ecx
jmp 0x1002f546
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x504]
mov dword [ebp - 0x68], eax
jmp 0x1002f4e3
lea eax, [ebp - 0x1c]
push eax
push 0x6166
push 0x681d
push 0x44b6
push 0x1e95
push 0x71a1
push 0xbe6
push 0x6731
push 1
push 0x42fa
push 1
call fcn.1002ac66
add esp, 0x2c
mov dword [ebp - 0x300], 0x2c2b
mov dword [ebp - 0x3a0], 0x1000a508
cmp dword [ebp - 0x300], 0x2dcd
jle 0x1002f6ae
and dword [ebp - 0x118], 0
jmp 0x1002f5ea
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0x781
jge 0x1002f6ae
and dword [ebp - 0x108], 0
jmp 0x1002f610
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0x4169
jge 0x1002f6a9
and dword [ebp - 0x110], 0
jmp 0x1002f636
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x4ea
jge 0x1002f6a4
mov eax, dword [ebp - 0x108]
cdq
idiv dword [ebp - 0x110]
mov eax, dword [ebp - 0x118]
mov ecx, edx
sar eax, cl
cdq
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x45c], edx
push dword [ebp - 0x45c]
push dword [ebp - 0x460]
lea ecx, [ebp - 0x63c]
call fcn.1000db90
pop ecx
pop ecx
mov dword [ebp - 0x378], eax
mov ecx, dword [ebp - 0x378]
call fcn.1002fe47
push eax
call fcn.1004eea6
pop ecx
lea ecx, [ebp - 0x63c]
call fcn.1002fe3d
jmp 0x1002f629
jmp 0x1002f603
jmp 0x1002f5dd
mov dword [ebp - 0x70], 0x5540d7f8
mov dword [ebp - 0x2f8], 0x2e4f
mov dword [ebp - 0x388], 0x1000a560
cmp dword [ebp - 0x2f8], 0x30cc
jle 0x1002f779
and dword [ebp - 0x120], 0
jmp 0x1002f6ef
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x3375
jge 0x1002f779
and dword [ebp - 0x128], 0
jmp 0x1002f711
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0x1985
jge 0x1002f774
mov eax, dword [ebp - 0x120]
xor eax, dword [ebp - 0x128]
cdq
mov dword [ebp - 0x46c], eax
mov dword [ebp - 0x468], edx
push dword [ebp - 0x468]
push dword [ebp - 0x46c]
lea ecx, [ebp - 0x66c]
call fcn.1000db90
pop ecx
pop ecx
mov dword [ebp - 0x380], eax
mov ecx, dword [ebp - 0x380]
call fcn.1002fe47
push eax
call fcn.1004eea6
pop ecx
lea ecx, [ebp - 0x66c]
call fcn.1002fe3d
jmp 0x1002f704
jmp 0x1002f6e2
mov dword [ebp - 0x398], 1
mov dword [ebp - 4], 0x22
cmp dword [ebp - 0x2f8], 0x2c4c
jge 0x1002f7a2
push dword [ebp - 0x388]
call fcn.1004eea6
pop ecx
jmp 0x1002f7be
or dword [ebp - 4], 0xffffffff
jmp 0x1002f7c8
push 1
lea ecx, [ebp - 0x4d0]
call fcn.1002ff7c
mov dword [ebp - 4], 0x24
lea eax, [ebp - 0x4d0]
push eax
lea eax, [ebp - 0x534]
push eax
call fcn.1002c79b
pop ecx
pop ecx
mov dword [ebp - 0x70], 0
jmp 0x1002f801
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x1b
jne 0x1002f8eb
mov dword [ebp - 0x390], 0x13dce9d0
mov dword [ebp - 0x59c], 0xffffffff
push 1
lea ecx, [ebp - 0x4c4]
call fcn.1002ff7c
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0x5a4]
push eax
push 0x7f6a
push 0x54b7
push 0x1517
push 0x11dd
push 1
push 0x6046
push 0x1ecc
push 1
push 1
push 0x4eac
lea eax, [ebp - 0x4c4]
push eax
call fcn.1002b0a5
add esp, 0x30
push 0x5cd0
push 0x6662
push 0x50e5
push 0x4356
push 0x5617
lea eax, [ebp - 0x4d0]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x4c4]
push eax
push 0x7bda
push 0x6844
push 1
push 0x6549
lea eax, [ebp - 0x390]
push eax
push 0x198f
push 0x390
lea eax, [ebp - 0x398]
push eax
push 0x59d5
push 0x2f04
push 1
call fcn.1002b37d
add esp, 0x4c
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x4c4]
call fcn.1002fffe
jmp 0x1002f7fa
mov byte [ebp - 0x3b], 0
movzx eax, byte [ebp - 0x3b]
test eax, eax
je 0x1002f8fc
call fcn.1002c7e3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4d0]
call fcn.1002fffe
mov dword [ebp - 4], 0x26
cmp dword [ebp - 0x300], 0x2a05
jge 0x1002f92a
push dword [ebp - 0x3a0]
call fcn.1004eea6
pop ecx
jmp 0x1002f946
or dword [ebp - 4], 0xffffffff
jmp 0x1002f950
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002f9bb
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x130]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x308], ecx
jne 0x1002f975
xor eax, eax
jmp 0x1002f9e1
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x308]
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0
jne 0x1002f997
xor eax, eax
jmp 0x1002f9e1
push 0
lea eax, [ebp - 0x1c]
push eax
push 0x49b2
push 0x116e
push 0x22bd
push 1
push 0x7c10
call fcn.1002ba50
add esp, 0x1c
call fcn.1002c7f2
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x10], 0
je 0x1002f9d4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x310], eax
jmp 0x1002f9db
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x310]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret