Function at 0x1002c16c
Capabilities:
Contain obfuscated stackstrings
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008aa03
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x624
push esi
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002eaef
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2f4], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x344], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x344]
movzx eax, byte [eax]
test eax, eax
je 0x1002eaa3
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x2b0], eax
push 0x6f1d
push 0
push 1
push 0x2158
push 0x1b3b
push 1
call fcn.10028440
add esp, 0x18
mov eax, dword [0x10090cb4]
and eax, 1
jne 0x1002c23e
mov eax, dword [0x10090cb4]
or eax, 1
mov dword [0x10090cb4], eax
and dword [ebp - 4], 0
mov ecx, 0x100950bc
call fcn.10022f6e
push 0x1008b69c
call fcn.10074e59
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x50], 0xfffffffe
mov dword [ebp - 0x17c], 0
jmp 0x1002c25e
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 2
jge 0x1002c27a
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x51c], 1
jmp 0x1002c251
push 0x7df6
push 0
lea eax, [ebp - 0x50]
push eax
call fcn.10044d3e
add esp, 0xc
mov dword [ebp - 0x50], 1
jmp 0x1002c29d
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x1002c310
mov dword [ebp - 0x44], 6
push 0x1389
push 0x71e3
push 0
push 1
call fcn.10029f47
add esp, 0x10
mov dword [ebp - 0x44], 0
jmp 0x1002c2d0
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jg 0x1002c30e
push 0x108e
push 0x43cf
push 0x4aaf
push 1
push 1
push 0x5e6c
push 0x649b
push 0
call fcn.10029aeb
add esp, 0x20
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x51c], 0
je 0x1002c30c
jmp 0x1002c30e
jmp 0x1002c2c9
jmp 0x1002c296
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0x45c]
call fcn.10022b14
mov dword [ebp - 4], 1
push 2
lea ecx, [ebp - 0x514]
call fcn.10022d19
mov byte [ebp - 4], 2
mov dword [ebp - 0x4c], 0x2ee76f50
mov dword [ebp - 0x210], 0x1f81
mov dword [ebp - 0x3b8], 0x1000a438
cmp dword [ebp - 0x210], 0x214b
jle 0x1002c3d7
and dword [ebp - 0xf8], 0
jmp 0x1002c376
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0xfbd
jge 0x1002c3d7
and dword [ebp - 0x130], 0
jmp 0x1002c398
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0x38fb
jge 0x1002c3d5
mov eax, dword [ebp - 0xf8]
sub eax, dword [ebp - 0x130]
cdq
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x33c], edx
push dword [ebp - 0x33c]
push dword [ebp - 0x340]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x1002c38b
jmp 0x1002c369
cmp dword [ebp - 0x210], 0x1eed
jge 0x1002c3f3
mov edx, dword [ebp - 0x3b8]
mov ecx, 0x1008fbf8
call fcn.1002574f
push 0x15f7
push 1
push 0x239a
lea eax, [ebp - 0x514]
push eax
push 0x4b25
lea eax, [ebp - 0x530]
push eax
push 0x35e6
push 1
push 1
call fcn.10029c8a
add esp, 0x24
mov dword [ebp - 0x4c], 1
jmp 0x1002c433
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x1002c51e
mov dword [ebp - 0x68], 0xffab8c3a
push 2
lea ecx, [ebp - 0x4ac]
call fcn.10022d19
mov byte [ebp - 4], 3
push 0x275b
push 1
lea eax, [ebp - 0x4ac]
push eax
push 0x651a
push 0x4664
push 1
push 0x443e
lea eax, [ebp - 0x55c]
push eax
push 0x4a44
push 0x24d3
push 0x268e
push 0x30c6
call fcn.10026deb
add esp, 0x30
mov dword [ebp - 0x68], 0
jmp 0x1002c4a7
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jg 0x1002c4d0
lea eax, [ebp - 0x4ac]
push eax
push 0x275c
push 0x13c5
push 0
push 1
lea eax, [ebp - 0x4c]
push eax
call fcn.1002c16c
add esp, 0x18
jmp 0x1002c4a0
push 0
push 0x462
push 0x599f
push 0x1e50
lea eax, [ebp - 0x68]
push eax
push 0x579e
push 0x620a
push 1
push 0x4052
push 0x4238
push 0x7a5a
push 1
call fcn.100288b3
add esp, 0x30
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4ac]
call fcn.10022d9b
jmp 0x1002c42c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x514]
call fcn.10022d9b
lea eax, [ebp - 0x564]
push eax
lea ecx, [ebp - 0x45c]
call fcn.100235bb
push dword [eax]
lea eax, [ebp - 0x56c]
push eax
lea ecx, [ebp - 0x45c]
call fcn.100235cf
push dword [eax]
lea eax, [ebp - 0x524]
push eax
lea ecx, [ebp - 0x45c]
call fcn.100235bb
push dword [eax]
mov edx, 0x1002673e
lea ecx, [ebp - 0x4f0]
call fcn.100486c8
add esp, 0xc
mov dword [ebp - 0x24], 0xfffffffe
push 1
lea ecx, [ebp - 0x47c]
call fcn.10022d19
mov byte [ebp - 4], 4
mov dword [ebp - 0x58], 0
jmp 0x1002c5a4
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x1002c5ba
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x43c], 0
jmp 0x1002c59d
lea eax, [ebp - 0x58]
push eax
push 0
push 0x1aaf
push 0x56fe
push 0x4ae3
lea eax, [ebp - 0x47c]
push eax
call fcn.1002ec56
add esp, 0x18
mov dword [ebp - 0x24], 0xfffffff2
jmp 0x1002c5ee
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1c
jne 0x1002c692
mov dword [ebp - 0xc4], 0xd16df251
mov dword [ebp - 0x548], 0
mov dword [ebp - 0x4f8], 0xffffffff
mov dword [ebp - 0xc4], 0xffffffec
jmp 0x1002c62f
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xfffffffb
jl 0x1002c68d
mov dword [ebp - 0x3c], 0x2250db85
lea eax, [ebp - 0x3c]
push eax
push 1
push 0x300e
push 1
push 0
push 0x7708
push 0x67b0
push 0x749e
call fcn.100294f9
add esp, 0x20
mov dword [ebp - 0x3c], 0
jmp 0x1002c675
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x1002c68b
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x43c], 0xe9fb1c03
jmp 0x1002c66e
jmp 0x1002c622
jmp 0x1002c5e7
mov dword [ebp - 0x24], 1
jmp 0x1002c6a2
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1002c8d5
mov dword [ebp - 0x2cc], 0x7e2f
mov dword [ebp - 0x2f8], 0x1000a474
cmp dword [ebp - 0x2cc], 0x7ff7
jle 0x1002c7af
and dword [ebp - 0x158], 0
jmp 0x1002c6e6
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0x505f
jge 0x1002c7a9
and dword [ebp - 0xcc], 0
jmp 0x1002c70c
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x46a0
jge 0x1002c7a4
and dword [ebp - 0x138], 0
jmp 0x1002c732
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x6ec3
jge 0x1002c79f
and dword [ebp - 0xd4], 0
jmp 0x1002c754
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x6d99
jge 0x1002c79d
mov eax, dword [ebp - 0x158]
sub eax, dword [ebp - 0xcc]
xor eax, dword [ebp - 0x138]
xor eax, dword [ebp - 0xd4]
cdq
mov dword [ebp - 0x34c], eax
mov dword [ebp - 0x348], edx
push dword [ebp - 0x348]
push dword [ebp - 0x34c]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x1002c747
jmp 0x1002c725
jmp 0x1002c6ff
jmp 0x1002c6d9
call dword [sym.imp.USER32.dll_CreateMenu]
cmp dword [ebp - 0x2cc], 0x7c80
jge 0x1002c7cb
mov edx, dword [ebp - 0x2f8]
mov ecx, 0x1008fbf8
call fcn.1002574f
mov dword [ebp - 0x1ac], 0x68aa2d34
mov dword [ebp - 0x2b4], 0xffffffff
mov dword [ebp - 0x334], 0
mov dword [ebp - 0xf4], 0
jmp 0x1002c802
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jge 0x1002c81e
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x198], 0xffffffff
jmp 0x1002c7f5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x198], 1
jl 0x1002c83a
mov dword [ebp - 0x244], 1
jmp 0x1002c841
and dword [ebp - 0x244], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x198]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x198]
mov dword [ebp - 0x1ac], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x43c], 7
imul eax, dword [ebp - 0x1ac], 7
mov dword [ebp - 0x2c0], eax
push 0
lea ecx, [ebp - 0x47c]
call fcn.10022db7
mov ecx, dword [ebp - 0x2c0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2c0]
cmp eax, dword [ebp - 0x244]
jne 0x1002c8ae
mov dword [ebp - 0x1b4], 1
jmp 0x1002c8b5
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x334], eax
jmp 0x1002c69b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x47c]
call fcn.10022d9b
lea ecx, [ebp - 0x45c]
call fcn.100266c9
mov dword [ebp - 0x2a8], eax
movzx eax, byte [0x10095014]
test eax, eax
je 0x1002d090
mov ecx, 0x100950bc
call fcn.100483a5
movzx eax, al
test eax, eax
jne 0x1002d090
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x1dc]
push eax
mov ecx, 0x100950bc
call fcn.10023033
mov dword [ebp - 0x20], 0xfffffffe
push 1
lea ecx, [ebp - 0x4b8]
call fcn.10022d19
mov byte [ebp - 4], 5
mov dword [ebp - 0x78], 0
jmp 0x1002c959
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x1002c96f
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x444], 0
jmp 0x1002c952
lea eax, [ebp - 0x78]
push eax
push 1
push 0x114a
push 0x471f
push 0x1025
push 0x53f3
lea eax, [ebp - 0x4b8]
push eax
push 1
push 0
call fcn.10029c8a
add esp, 0x24
mov dword [ebp - 0x20], 0xfffffff2
jmp 0x1002c9ac
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1c
jne 0x1002ca55
mov dword [ebp - 0xdc], 0xd16df251
mov dword [ebp - 0x520], 0
mov dword [ebp - 0x500], 0xffffffff
mov dword [ebp - 0xdc], 0xffffffec
jmp 0x1002c9ed
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xfffffffb
jl 0x1002ca50
mov dword [ebp - 0x34], 0x2250db85
push 0x2372
push 1
lea eax, [ebp - 0x34]
push eax
push 0x487d
push 0x899
push 0x3421
push 0x3791
push 0
push 0
call fcn.10029c8a
add esp, 0x24
mov dword [ebp - 0x34], 0
jmp 0x1002ca38
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x1002ca4e
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x444], 0xe9fb1c03
jmp 0x1002ca31
jmp 0x1002c9e0
jmp 0x1002c9a5
mov dword [ebp - 0x20], 1
jmp 0x1002ca65
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x1002cd88
mov dword [ebp - 0x1c4], 0x68aa2d34
mov dword [ebp - 0x1d4], 0xffffffff
mov dword [ebp - 0x1bc], 0x41b2
mov dword [ebp - 0x300], 0x1000a490
cmp dword [ebp - 0x1bc], 0x443d
jle 0x1002cb88
and dword [ebp - 0x104], 0
jmp 0x1002cabd
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x167b
jge 0x1002cb7e
and dword [ebp - 0xfc], 0
jmp 0x1002cae3
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0x6118
jge 0x1002cb79
and dword [ebp - 0xe4], 0
jmp 0x1002cb09
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0x3ab2
jge 0x1002cb74
mov ecx, dword [ebp - 0xfc]
sub ecx, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x104]
shl eax, cl
cdq
mov dword [ebp - 0x358], eax
mov dword [ebp - 0x354], edx
push dword [ebp - 0x354]
push dword [ebp - 0x358]
lea ecx, [ebp - 0x5e8]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x3dc], eax
mov ecx, dword [ebp - 0x3dc]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x5e8]
call fcn.100229d5
jmp 0x1002cafc
jmp 0x1002cad6
jmp 0x1002cab0
push 0
push 0
call dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 0x3e8], 0
cmp dword [ebp - 0x1bc], 0x3f49
jge 0x1002cbaa
push dword [ebp - 0x300]
call fcn.10074e83
pop ecx
mov dword [ebp - 0x24c], 0x334
mov dword [ebp - 0x308], 0x1000a4e0
cmp dword [ebp - 0x24c], 0x484
jle 0x1002cc87
push 0
call dword [sym.imp.GDI32.dll_UnrealizeObject]
and dword [ebp - 0xec], 0
jmp 0x1002cbec
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x260
jge 0x1002cc7d
and dword [ebp - 0x10c], 0
jmp 0x1002cc12
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x2285
jge 0x1002cc78
mov eax, dword [ebp - 0xec]
cdq
idiv dword [ebp - 0x10c]
mov eax, edx
cdq
mov dword [ebp - 0x364], eax
mov dword [ebp - 0x360], edx
push dword [ebp - 0x360]
push dword [ebp - 0x364]
lea ecx, [ebp - 0x5d0]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x3e4], eax
mov ecx, dword [ebp - 0x3e4]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x5d0]
call fcn.100229d5
jmp 0x1002cc05
jmp 0x1002cbdf
push 0
push 0
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
cmp dword [ebp - 0x24c], 0x7d
jge 0x1002cc9c
push dword [ebp - 0x308]
call fcn.10074e83
pop ecx
mov dword [ebp - 0xb8], 0
jmp 0x1002ccb5
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jge 0x1002ccd1
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x1a0], 0xffffffff
jmp 0x1002cca8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a0], 1
jl 0x1002cced
mov dword [ebp - 0x1cc], 1
jmp 0x1002ccf4
and dword [ebp - 0x1cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x1a0]
mov dword [ebp - 0x1c4], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x444], 7
imul eax, dword [ebp - 0x1c4], 7
mov dword [ebp - 0x294], eax
push 0
lea ecx, [ebp - 0x4b8]
call fcn.10022db7
mov ecx, dword [ebp - 0x294]
mov dword [eax], ecx
mov eax, dword [ebp - 0x294]
cmp eax, dword [ebp - 0x1cc]
jne 0x1002cd61
mov dword [ebp - 0x254], 1
jmp 0x1002cd68
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x1d4]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x3e8], eax
jmp 0x1002ca5e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4b8]
call fcn.10022d9b
mov dword [ebp - 0x25c], 0x3127
mov dword [ebp - 0x320], 0x1000a540
cmp dword [ebp - 0x25c], 0x34e1
jle 0x1002cecb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
and dword [ebp - 0x114], 0
jmp 0x1002cddb
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x1fc4
jge 0x1002cecb
and dword [ebp - 0x178], 0
jmp 0x1002ce01
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x3029
jge 0x1002cec6
and dword [ebp - 0x100], 0
jmp 0x1002ce27
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0x4c5c
jge 0x1002cec1
and dword [ebp - 0x140], 0
jmp 0x1002ce4d
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0x220d
jge 0x1002cebc
mov eax, dword [ebp - 0x114]
xor eax, dword [ebp - 0x178]
xor eax, dword [ebp - 0x100]
or eax, dword [ebp - 0x140]
cdq
mov dword [ebp - 0x370], eax
mov dword [ebp - 0x36c], edx
push dword [ebp - 0x36c]
push dword [ebp - 0x370]
lea ecx, [ebp - 0x600]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x310], eax
mov ecx, dword [ebp - 0x310]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x600]
call fcn.100229d5
jmp 0x1002ce40
jmp 0x1002ce1a
jmp 0x1002cdf4
jmp 0x1002cdce
lea eax, [ebp - 0x528]
push eax
mov ecx, 0x100950bc
call fcn.10023025
push eax
lea ecx, [ebp - 0x1dc]
call fcn.100231b6
movzx eax, al
test eax, eax
je 0x1002d078
mov dword [ebp - 0x70], 0x824a8c6a
mov dword [ebp - 0x2c8], 0x39cb61d2
mov dword [ebp - 0x70], 0xffffffe5
jmp 0x1002cf14
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xf
jle 0x1002cfb4
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x108], 0
jmp 0x1002cf3e
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jge 0x1002cf5a
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x3c0], 0
jmp 0x1002cf31
mov dword [ebp - 0x60], 0
jmp 0x1002cf6a
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jg 0x1002cfaf
mov dword [ebp - 0x160], 0x629aa810
mov dword [ebp - 0x160], 0
jmp 0x1002cf93
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0
jg 0x1002cfad
mov eax, dword [ebp - 0x60]
cmp dword [ebp + eax*4 - 0x3c0], 0
je 0x1002cfab
jmp 0x1002cfad
jmp 0x1002cf86
jmp 0x1002cf63
jmp 0x1002cf0d
cmp dword [ebp - 0x2c8], 0
je 0x1002cfda
push 0
push 0x5436
push 1
push 0x5b54
push 0x6f6c
call fcn.1002b792
add esp, 0x14
jmp 0x1002d04e
mov dword [ebp - 0x318], 0xaa61fc2d
mov dword [ebp - 0x410], 0xd53d
push 0x16fd
push 0x2ab8
push 0x2812
push 1
push 1
push 0x378c
call fcn.10028299
add esp, 0x18
push 1
push 0x58aa
lea eax, [ebp - 0x318]
push eax
push 0x7ec0
push 0x593d
push 0x454a
lea eax, [ebp - 0x410]
push eax
push 0
push 0x2569
lea eax, [ebp - 0x2c8]
push eax
lea eax, [ebp - 0x70]
push eax
push 0
call fcn.100288b3
add esp, 0x30
lea ecx, [ebp - 0x1dc]
call fcn.100483ae
mov ecx, dword [ebp - 0x2b0]
mov eax, dword [eax + 4]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x45c]
call fcn.10022bac
jmp 0x1002ec18
cmp dword [ebp - 0x25c], 0x2e1e
jge 0x1002d090
push dword [ebp - 0x320]
call fcn.10074e83
pop ecx
mov dword [ebp - 0x28], 1
push 4
lea ecx, [ebp - 0x2dc]
call fcn.10022d19
mov byte [ebp - 4], 6
mov dword [ebp - 0x1ec], 0xffffffff
mov dword [ebp - 0x3c8], 0x263b0a6d
mov dword [ebp - 0x1f4], 0xffffffff
mov dword [ebp - 0x3f0], 0xb56cef3c
mov dword [ebp - 0x1fc], 0x92079655
mov dword [ebp - 0x330], 0xc1094d0e
push 1
push 0x4d66
push 0
lea eax, [ebp - 0x2dc]
push eax
push 1
lea eax, [ebp - 0x48]
push eax
push 0x635d
push 0x2f5a
call fcn.1002b3a2
add esp, 0x20
mov dword [ebp - 0x48], 0
jmp 0x1002d11c
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x1002d132
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x578], 0
jmp 0x1002d115
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x508], eax
push 3
lea ecx, [ebp - 0x2dc]
call fcn.10022db7
mov dword [eax], 1
mov esi, dword [ebp - 0x28]
push 1
lea ecx, [ebp - 0x2dc]
call fcn.10022db7
cmp esi, dword [eax]
jge 0x1002d16e
mov dword [ebp - 0x1e4], 1
jmp 0x1002d175
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x1e4]
sub eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x28]
jge 0x1002d18f
mov dword [ebp - 0x29c], 1
jmp 0x1002d196
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0
je 0x1002d1c9
push 3
lea ecx, [ebp - 0x2dc]
call fcn.10022db7
cmp dword [eax], 0
je 0x1002d1c9
mov dword [ebp - 0x194], 1
jmp 0x1002d1d0
and dword [ebp - 0x194], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x194]
mov dword [ebp + eax - 0x578], ecx
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jne 0x1002d203
mov dword [ebp - 0x264], 1
jmp 0x1002d20a
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x264]
sub eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x28]
jl 0x1002d224
mov dword [ebp - 0x328], 1
jmp 0x1002d22b
and dword [ebp - 0x328], 0
push 2
lea ecx, [ebp - 0x2dc]
call fcn.10022db7
mov eax, dword [eax]
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x3f0]
cmp dword [ebp - 0x1f4], eax
je 0x1002d25a
mov dword [ebp - 0x2bc], 1
jmp 0x1002d261
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0xfffffffd
je 0x1002d282
mov dword [ebp - 0x26c], 1
jmp 0x1002d289
and dword [ebp - 0x26c], 0
imul eax, dword [ebp - 0x26c], 3
mov dword [ebp - 0x330], eax
mov byte [ebp - 0x2d], 0
movzx eax, byte [ebp - 0x2d]
test eax, eax
je 0x1002d2f6
push 0x7a4d
push 0x6ef9
push 0x36a2
push 0x63a9
push 0
push 0x5d61
push 0x6019
push 0x599b
push 0x6fb4
push 0x76cc
push 0xa49
push 0x67e5
push 0x55dd
push 0x1c13
push 0x70ac
push 1
push 1
call fcn.1002a23d
add esp, 0x44
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2dc]
call fcn.10022d9b
and dword [ebp - 0x74], 0
lea eax, [ebp - 0x45c]
push eax
call fcn.10026be0
pop ecx
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jne 0x1002ea40
cmp dword [0x1009500c], 0
jne 0x1002ea22
mov dword [ebp - 0x148], 0xc184c506
mov dword [ebp - 0x110], 0
jmp 0x1002d353
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 2
jge 0x1002d36f
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x5a0], 1
jmp 0x1002d346
mov dword [ebp - 0x148], 0
jmp 0x1002d388
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 1
jg 0x1002d3b0
push 0x5051
push 1
push 1
push 0xfef
push 0x4db7
push 1
call fcn.10028440
add esp, 0x18
jmp 0x1002d37b
push 0x3b78
push 0x4af0
push 0x6e48
push 0x4683
push 1
push 0x523e
push 0x4346
push 0x1e53
push 0x3ce1
push 0x25d0
push 0x32df
push 0xfd4
push 0x34c1
push 0x66a5
push 0x1561
push 1
push 1
call fcn.1002a23d
add esp, 0x44
mov byte [ebp - 0x98], 5
mov byte [ebp - 0x97], 0xf7
mov byte [ebp - 0x96], 3
mov byte [ebp - 0x95], 2
mov byte [ebp - 0x94], 0xa
mov byte [ebp - 0x93], 2
mov byte [ebp - 0x92], 8
mov byte [ebp - 0x91], 0x42
mov byte [ebp - 0x90], 4
mov byte [ebp - 0x8f], 0x4b
mov byte [ebp - 0x8e], 9
mov byte [ebp - 0x8d], 1
mov byte [ebp - 0x8c], 4
mov byte [ebp - 0x8b], 0x80
mov byte [ebp - 0x8a], 0xee
mov byte [ebp - 0x89], 0xe2
mov byte [ebp - 0x88], 0x4a
mov byte [ebp - 0x87], 1
mov byte [ebp - 0x86], 1
mov byte [ebp - 0x85], 0
mov byte [ebp - 0x84], 0x2e
mov byte [ebp - 0x83], 0xb
mov byte [ebp - 0x82], 0x27
mov byte [ebp - 0x81], 2
mov byte [ebp - 0x80], 0x1e
mov byte [ebp - 0x7f], 6
mov byte [ebp - 0x7e], 0x41
mov byte [ebp - 0x7d], 7
mov byte [ebp - 0x7c], 1
mov dword [ebp - 0x204], 0x4a25
mov dword [ebp - 0x3d0], 0x1000a59c
cmp dword [ebp - 0x204], 0x4b07
jle 0x1002d599
push 0
push 0
call dword [sym.imp.USER32.dll_MapDialogRect]
and dword [ebp - 0x118], 0
jmp 0x1002d504
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0x465f
jge 0x1002d599
and dword [ebp - 0x170], 0
jmp 0x1002d52a
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0x7f2
jge 0x1002d594
and dword [ebp - 0x120], 0
jmp 0x1002d54c
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x5752
jge 0x1002d592
mov eax, dword [ebp - 0x118]
cdq
idiv dword [ebp - 0x170]
sub edx, dword [ebp - 0x120]
mov eax, edx
cdq
mov dword [ebp - 0x37c], eax
mov dword [ebp - 0x378], edx
push dword [ebp - 0x378]
push dword [ebp - 0x37c]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x1002d53f
jmp 0x1002d51d
jmp 0x1002d4f7
cmp dword [ebp - 0x204], 0x49a4
jge 0x1002d5b5
mov edx, dword [ebp - 0x3d0]
mov ecx, 0x1008fbf8
call fcn.1002574f
mov dword [ebp - 0x38], 0xad313dd3
mov dword [ebp - 0x150], 0
jmp 0x1002d5d5
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 4
jge 0x1002d5f1
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x4c8], 0
jmp 0x1002d5c8
mov dword [ebp - 0x38], 0
jmp 0x1002d601
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xfffffff8
jle 0x1002d82c
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x128], 0
jmp 0x1002d62b
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 2
jge 0x1002d647
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x53c], 0xffffffff
jmp 0x1002d61e
cmp dword [ebp - 0x10], 0
je 0x1002d705
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x10]
jle 0x1002d668
mov dword [ebp - 0x338], 1
jmp 0x1002d66f
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x4e8], eax
imul eax, dword [ebp - 0x10], 0xc105
imul eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x10]
cmp eax, 0xe5077045
jne 0x1002d69c
cmp dword [ebp - 0x38], 0
jne 0x1002d69c
and dword [ebp - 0x2a4], 0
jmp 0x1002d6a6
mov dword [ebp - 0x2a4], 1
cmp dword [ebp - 0x2a4], 1
jbe 0x1002d6bb
mov dword [ebp - 0x20c], 1
jmp 0x1002d6c2
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x20c]
sub eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jge 0x1002d6dc
mov dword [ebp - 0x274], 1
jmp 0x1002d6e3
and dword [ebp - 0x274], 0
mov eax, 0x92f644a
sub eax, dword [ebp - 0x274]
cmp eax, dword [ebp - 0x38]
je 0x1002d705
cmp dword [ebp - 0x10], 0
je 0x1002d705
mov dword [ebp - 0x214], 1
jmp 0x1002d70c
and dword [ebp - 0x214], 0
cmp dword [ebp - 0x214], 0xfffffff6
jb 0x1002d721
mov dword [ebp - 0x2d0], 1
jmp 0x1002d728
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x2d0]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], 3
jmp 0x1002d748
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1002d827
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x4c8], 0
jne 0x1002d7f7
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x4c8]
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x4c8], 0
jle 0x1002d78c
mov dword [ebp - 0x21c], 1
jmp 0x1002d793
and dword [ebp - 0x21c], 0
cmp dword [ebp - 0x21c], 0x212908cd
jle 0x1002d7ab
mov dword [ebp - 0x27c], 1
jmp 0x1002d7b2
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x4c8]
cmp dword [ebp - 0x27c], eax
jg 0x1002d7d0
mov dword [ebp - 0x224], 1
jmp 0x1002d7d7
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x224]
sub eax, 0x9dbe
cmp eax, 0xfffffff6
je 0x1002d7f7
mov dword [ebp - 0x2ac], 1
jmp 0x1002d7fe
and dword [ebp - 0x2ac], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2ac]
mov dword [ebp + eax - 0x53c], ecx
push 0x5421
push 1
push 1
call fcn.1002abf4
add esp, 0xc
jmp 0x1002d741
jmp 0x1002d5fa
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x98]
or eax, 0x9b
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x98]
and ecx, 0x9b
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x98]
mov word [ebp + ecx*2 - 0x4e4], ax
mov dword [ebp - 0x14], 2
and dword [ebp - 0x64], 0
jmp 0x1002d880
mov eax, dword [ebp - 0x14]
inc eax
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1d
jae 0x1002dd48
mov dword [ebp - 0x5c], 0x71bc
mov dword [ebp - 0x22c], 0xaf072071
mov dword [ebp - 0x52c], 1
mov dword [ebp - 0x1b8], 0x722abac8
mov dword [ebp - 0x18c], 0xfffffffb
mov dword [ebp - 0x28c], 0x86ff5291
mov dword [ebp - 0x1c0], 0xfffffffc
mov dword [ebp - 0x1b0], 0
push 3
lea ecx, [ebp - 0x488]
call fcn.10022d19
mov byte [ebp - 4], 7
mov dword [ebp - 0x54], 0
jmp 0x1002d8f8
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x1002d90e
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x284], 0xa3f30045
jmp 0x1002d8f1
push 0x733e
push 0
push 0x5f2d
push 0x7f85
push 0x5b21
lea eax, [ebp - 0x488]
push eax
push 0x14d5
push 0x6fa0
push 1
lea eax, [ebp - 0x54]
push eax
call fcn.1002befd
add esp, 0x28
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x22c]
cmp dword [ebp - 0x5c], eax
je 0x1002d963
mov dword [ebp - 0x234], 1
jmp 0x1002d96a
and dword [ebp - 0x234], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x284], 0
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x550], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x284]
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x234], 0xc3d076c5
je 0x1002d9b2
mov dword [ebp - 0x414], 1
jmp 0x1002d9b9
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x560], eax
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x1b8], eax
jl 0x1002d9d9
mov dword [ebp - 0x2c4], 1
jmp 0x1002d9e0
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0x2c4]
cmp eax, dword [ebp - 0x18c]
jl 0x1002d9fe
mov dword [ebp - 0x23c], 1
jmp 0x1002da05
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x540], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x1c0], 0x2fc5
jne 0x1002da41
mov dword [ebp - 0x1a8], 1
jmp 0x1002da48
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]
add eax, dword [ebp - 0x1b8]
mov ecx, dword [ebp - 0x1c0]
lea esi, [eax + ecx - 1]
push 0
lea ecx, [ebp - 0x488]
call fcn.10022db7
mov dword [eax], esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x488]
call fcn.10022d9b
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x98]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x14], eax
jne 0x1002dcae
push 3
lea ecx, [ebp - 0x4a0]
call fcn.10022d19
mov byte [ebp - 4], 8
mov dword [ebp - 0x1c], 0xffffffff
push 1
push 0x24fa
lea eax, [ebp - 0x4a0]
push eax
push 1
lea eax, [ebp - 0x4ec]
push eax
push 0xe23
push 0x7162
call fcn.1002add8
add esp, 0x1c
mov dword [ebp - 0x1c], 2
jmp 0x1002daf4
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x1002db4d
mov dword [ebp - 0x2f0], 0xffffffff
push 1
push 0x3273
push 0
push 0x3bb0
call fcn.1002bd44
add esp, 0x10
push 0x1570
push 1
push 0x2a20
lea eax, [ebp - 0x1c]
push eax
push 0x52
push 1
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x2f0]
push eax
push 0x2add
push 1
call fcn.1002af63
add esp, 0x28
jmp 0x1002daed
mov dword [ebp - 0x1c], 0
jmp 0x1002db5d
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1002db70
push 1
push 1
call fcn.1002b16d
pop ecx
pop ecx
jmp 0x1002db56
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4a0]
call fcn.10022d9b
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x98]
inc eax
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x98]
mov ecx, dword [ebp - 0x14]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c8], 0x533c
mov dword [ebp - 0x3d8], 0x1000a5bc
cmp dword [ebp - 0x1c8], 0x55a8
jle 0x1002dc8d
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
and dword [ebp - 0x168], 0
jmp 0x1002dbeb
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0x4455
jge 0x1002dc7f
and dword [ebp - 0xbc], 0
jmp 0x1002dc11
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0x4efe
jge 0x1002dc7a
and dword [ebp - 0xc0], 0
jmp 0x1002dc33
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x3dc9
jge 0x1002dc78
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0xbc]
sar eax, cl
and eax, dword [ebp - 0xc0]
cdq
mov dword [ebp - 0x388], eax
mov dword [ebp - 0x384], edx
push dword [ebp - 0x384]
push dword [ebp - 0x388]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x1002dc26
jmp 0x1002dc04
jmp 0x1002dbde
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
jmp 0x1002d878
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x97]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x64]
movzx ecx, byte [ebp + ecx - 0x9a]
movzx ecx, word [ebp + ecx*2 - 0x4e4]
add eax, ecx
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ebp + ecx - 0x97]
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x64]
movzx edx, byte [ebp + edx - 0x9a]
movzx edx, word [ebp + edx*2 - 0x4e4]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ebp + ecx - 0x97]
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x64]
movzx edx, byte [ebp + edx - 0x9a]
movzx edx, word [ebp + edx*2 - 0x4e4]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ebp + ecx - 0x98]
mov word [ebp + ecx*2 - 0x4e4], ax
push 0x140
push 1
lea eax, [ebp - 0x64]
push eax
push 1
call fcn.100291a9
add esp, 0x10
jmp 0x1002d878
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0x4e4], cx
mov dword [ebp - 0x4f4], 1
mov dword [ebp - 0x1d0], 0xae5d5ec7
mov dword [ebp - 0x350], 1
mov dword [ebp - 0xc8], 0
jmp 0x1002dd8f
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jge 0x1002ddab
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x3fc], 0xfffffff9
jmp 0x1002dd82
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x3fc], 0
jmp 0x1002ddd9
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3fc]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x3fc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3fc], 0
jne 0x1002df62
push 4
lea ecx, [ebp - 0x428]
call fcn.10022d19
mov byte [ebp - 4], 9
mov dword [ebp - 0x19c], 0xbf38
push 0x2836
push 0x212c
push 0
push 1
push 0x4e84
push 1
lea eax, [ebp - 0x428]
push eax
push 0x7c73
push 0x71db
push 0x5df3
lea eax, [ebp - 0x4fc]
push eax
push 0x255e
call fcn.10045c24
add esp, 0x30
push 1
lea eax, [ebp - 0x19c]
push eax
push 1
push 0x6b7a
push 1
push 0x83c
lea eax, [ebp - 0x428]
push eax
push 0x1fd4
call fcn.1002b3a2
add esp, 0x20
cmp dword [ebp - 0x19c], 0
jne 0x1002df38
push 3
lea ecx, [ebp - 0x428]
call fcn.10022db7
cmp dword [eax], 0
je 0x1002df1c
mov dword [ebp - 0x1d0], 1
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x1d0], eax
jle 0x1002deb9
mov dword [ebp - 0x1d8], 1
jmp 0x1002dec0
and dword [ebp - 0x1d8], 0
cmp dword [ebp - 0x1d8], 0xffffffff
je 0x1002ded5
mov dword [ebp - 0x1e0], 1
jmp 0x1002dedc
and dword [ebp - 0x1e0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3fc]
imul eax, dword [ebp - 0x1e0]
test eax, eax
jne 0x1002deff
mov dword [ebp - 0x1e8], 1
jmp 0x1002df06
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x1e8]
neg eax
je 0x1002df1c
mov dword [ebp - 0x1f0], 1
jmp 0x1002df23
and dword [ebp - 0x1f0], 0
cmp dword [ebp - 0x1f0], 0x14ba
jle 0x1002df38
and dword [ebp - 0x1f8], 0
jmp 0x1002df42
mov dword [ebp - 0x1f8], 1
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x350], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x428]
call fcn.10022d9b
jmp 0x1002ddbe
lea eax, [ebp - 0x4e4]
push eax
lea ecx, [ebp - 0x630]
call fcn.100482f4
mov dword [ebp - 0x400], eax
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0x35c], eax
mov byte [ebp - 4], 0xa
push dword [ebp - 0x35c]
call fcn.10026be0
pop ecx
mov dword [ebp - 0x298], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x630]
call fcn.10022bac
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x258], 0xfffffff8
push 4
lea ecx, [ebp - 0x434]
call fcn.10022d19
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x188], 0x5830af36
mov dword [ebp - 0x3b4], 1
mov dword [ebp - 0x6c], 0
jmp 0x1002dff1
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1002e007
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x380], 0
jmp 0x1002dfea
push 1
lea eax, [ebp - 0x434]
push eax
push 1
lea eax, [ebp - 0x6c]
push eax
push 0x5c9b
call fcn.1002b792
add esp, 0x14
mov dword [ebp - 0x2c], 0xf
jmp 0x1002e033
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jg 0x1002e48a
mov dword [ebp - 0xf0], 0xf7a73d2d
mov dword [ebp - 0x374], 1
mov dword [ebp - 0x470], 0xbf0a0cd9
mov dword [ebp - 0x46c], 0xbf0a0cd9
mov dword [ebp - 0x468], 0xbf0a0cd9
mov dword [ebp - 0x464], 0xbf0a0cd9
lea ecx, [ebp - 0x17d]
call fcn.10022dc6
push eax
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x470]
push eax
lea ecx, [ebp - 0x580]
call fcn.10022dc9
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x40c]
call fcn.10022d75
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x200], 0x492
mov dword [ebp - 0x3e0], 0x1000a5f8
cmp dword [ebp - 0x200], 0x7ca
jle 0x1002e1b1
and dword [ebp - 0xd0], 0
jmp 0x1002e0ec
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0x6c73
jge 0x1002e1b1
and dword [ebp - 0xd8], 0
jmp 0x1002e112
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x2b54
jge 0x1002e1ac
and dword [ebp - 0xe0], 0
jmp 0x1002e138
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0x7d20
jge 0x1002e1a7
and dword [ebp - 0xe8], 0
jmp 0x1002e15a
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0x1720
jge 0x1002e1a5
mov eax, dword [ebp - 0xd0]
sub eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xe0]
shl eax, cl
or eax, dword [ebp - 0xe8]
cdq
mov dword [ebp - 0x394], eax
mov dword [ebp - 0x390], edx
push dword [ebp - 0x390]
push dword [ebp - 0x394]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x1002e14d
jmp 0x1002e12b
jmp 0x1002e105
jmp 0x1002e0df
mov dword [ebp - 0x11c], 1
cmp dword [ebp - 0x200], 0x42c
jge 0x1002e1d7
mov edx, dword [ebp - 0x3e0]
mov ecx, 0x1008fbf8
call fcn.1002574f
mov dword [ebp - 0x504], 5
mov dword [ebp - 0x184], 0x52b8909f
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x190], 0x2551ad04
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x54c], eax
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x11c]
inc ecx
mov dword [ebp - 0x11c], ecx
test eax, eax
jne 0x1002e2f4
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x554], eax
push 0
lea ecx, [ebp - 0x434]
call fcn.10022db7
mov ecx, dword [ebp - 0x2c]
cmp dword [eax], ecx
jg 0x1002e25b
mov dword [ebp - 0x208], 1
jmp 0x1002e262
and dword [ebp - 0x208], 0
push 1
lea ecx, [ebp - 0x40c]
call fcn.10022db7
mov ecx, dword [ebp - 0x208]
cmp ecx, dword [eax]
jne 0x1002e285
mov dword [ebp - 0x1a4], 1
jmp 0x1002e28c
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x368]
cmp eax, dword [ebp - 0x41c]
jl 0x1002e2cb
mov dword [ebp - 0x218], 1
jmp 0x1002e2d2
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x188]
imul eax, dword [ebp - 0x218]
cmp eax, dword [ebp - 0xf0]
jle 0x1002e2f4
push 0
lea ecx, [ebp - 0x40c]
call fcn.10022db7
mov eax, dword [ebp - 0x190]
sub eax, dword [ebp - 0xf0]
sub eax, dword [ebp - 0x374]
cmp eax, 0x753f
jle 0x1002e31e
xor eax, eax
inc eax
je 0x1002e31e
mov dword [ebp - 0x220], 1
jmp 0x1002e325
and dword [ebp - 0x220], 0
cmp dword [ebp - 0x220], 0x758c
jne 0x1002e33d
mov dword [ebp - 0x228], 1
jmp 0x1002e344
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x228], eax
jl 0x1002e35e
mov dword [ebp - 0x230], 1
jmp 0x1002e365
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x230], eax
jl 0x1002e37f
mov dword [ebp - 0x238], 1
jmp 0x1002e386
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x3b4]
cmp dword [ebp - 0x238], eax
jle 0x1002e3a0
mov dword [ebp - 0x240], 1
jmp 0x1002e3a7
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x240]
inc eax
cmp eax, dword [ebp - 0x248]
jne 0x1002e3d4
push 0
lea ecx, [ebp - 0x434]
call fcn.10022db7
cmp dword [eax], 0
je 0x1002e3d4
mov dword [ebp - 0x250], 1
jmp 0x1002e3db
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0x76a9
jl 0x1002e3ff
mov dword [ebp - 0x260], 1
jmp 0x1002e406
and dword [ebp - 0x260], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x260]
sub ecx, dword [ebp + eax - 0x380]
imul eax, ecx, 0x2fd9
imul eax, dword [ebp - 0x190]
cmp dword [ebp - 0xf0], eax
jge 0x1002e43a
mov dword [ebp - 0x3bc], 1
jmp 0x1002e441
and dword [ebp - 0x3bc], 0
mov esi, dword [ebp - 0x11c]
add esi, dword [ebp - 0x190]
push 0
lea ecx, [ebp - 0x40c]
call fcn.10022db7
mov dword [eax], esi
cmp dword [ebp - 0x2c], 0
je 0x1002e476
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x40c]
call fcn.10022d9b
jmp 0x1002e02c
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x40c]
call fcn.10022d9b
jmp 0x1002e02c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x434]
call fcn.10022d9b
and dword [ebp - 0x124], 0
jmp 0x1002e4af
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xd
jae 0x1002e4dd
push 1
push 0x30
push 1
push 0x6f6
call fcn.1002bd44
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 0x124]
mov word [ebp + ecx*2 - 0x4e4], ax
jmp 0x1002e4a2
mov dword [ebp - 0x40], 0xe1757117
mov dword [ebp - 0x290], 0x8877e06
mov dword [ebp - 0x280], 0x1b185749
mov dword [ebp - 0x3cc], 0x47f6
mov dword [ebp - 0x40], 0
jmp 0x1002e512
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffe4
jge 0x1002e7b1
mov dword [ebp - 0x278], 0x3f9beab1
mov dword [ebp - 0x288], 0x549ec71c
mov dword [ebp - 0x270], 0xffffffff
mov dword [ebp - 0x398], 0x4118
mov dword [ebp - 0x3b0], 0
mov dword [ebp - 0x268], 0x43bb
mov dword [ebp - 0x3c4], 0x1000a650
cmp dword [ebp - 0x268], 0x457b
jle 0x1002e67a
and dword [ebp - 0x144], 0
jmp 0x1002e588
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0x1d46
jge 0x1002e67a
and dword [ebp - 0x12c], 0
jmp 0x1002e5ae
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x34e2
jge 0x1002e675
and dword [ebp - 0x134], 0
jmp 0x1002e5d4
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x2456
jge 0x1002e670
and dword [ebp - 0x13c], 0
jmp 0x1002e5fa
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0x4e0d
jge 0x1002e66b
mov eax, dword [ebp - 0x12c]
sub eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 0x13c]
sar eax, cl
or eax, dword [ebp - 0x144]
cdq
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x39c], edx
push dword [ebp - 0x39c]
push dword [ebp - 0x3a0]
lea ecx, [ebp - 0x5b8]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x38c], eax
mov ecx, dword [ebp - 0x38c]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x5b8]
call fcn.100229d5
jmp 0x1002e5ed
jmp 0x1002e5c7
jmp 0x1002e5a1
jmp 0x1002e57b
mov dword [ebp - 0x3d4], 0x83eb3d01
cmp dword [ebp - 0x268], 0x4186
jge 0x1002e69c
push dword [ebp - 0x3c4]
call fcn.10074e83
pop ecx
mov dword [ebp - 0x3a4], 0x4635
push 2
lea ecx, [ebp - 0x494]
call fcn.10022d19
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x14c], 0
jmp 0x1002e6d0
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 2
jge 0x1002e6f2
push dword [ebp - 0x14c]
lea ecx, [ebp - 0x494]
call fcn.10022db7
mov dword [eax], 1
jmp 0x1002e6c3
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x280]
push eax
push 1
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x288]
push eax
push 0xaaa
push 0
push 0x53e4
push 0x2d9b
call fcn.1002ede8
add esp, 0x2c
lea eax, [ebp - 0x398]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x278]
push eax
push 1
lea eax, [ebp - 0x3cc]
push eax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x3a4]
push eax
lea eax, [ebp - 0x3d4]
push eax
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x3b0]
push eax
push 0x41b8
push 0x4ca6
lea eax, [ebp - 0x290]
push eax
push 1
push 0
call fcn.1002a23d
add esp, 0x44
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x494]
call fcn.10022d9b
jmp 0x1002e50b
cmp dword [ebp - 0x298], 0
je 0x1002ea22
mov byte [ebp - 0xb4], 8
mov byte [ebp - 0xb3], 0xcc
mov byte [ebp - 0xb2], 5
mov byte [ebp - 0xb1], 8
mov byte [ebp - 0xb0], 2
mov byte [ebp - 0xaf], 8
mov byte [ebp - 0xae], 3
mov byte [ebp - 0xad], 5
mov byte [ebp - 0xac], 6
mov byte [ebp - 0xab], 6
mov byte [ebp - 0xaa], 0
mov byte [ebp - 0xa9], 0x2e
mov byte [ebp - 0xa8], 7
mov byte [ebp - 0xa7], 0x3e
mov byte [ebp - 0xa6], 1
mov byte [ebp - 0xa5], 0x1d
mov byte [ebp - 0xa4], 0xa
mov byte [ebp - 0xa3], 0x16
mov byte [ebp - 0xa2], 1
mov byte [ebp - 0xa1], 0x8c
mov byte [ebp - 0xa0], 4
mov byte [ebp - 0x9f], 0x35
mov byte [ebp - 0x9e], 0xb
mov byte [ebp - 0x9d], 0x1b
mov byte [ebp - 0x9c], 9
mov byte [ebp - 0x9b], 0x25
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0xb4]
or eax, 0xad
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0xb4]
and ecx, 0xad
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0xb4]
mov byte [ebp + ecx - 0x2ec], al
mov dword [ebp - 0x18], 2
and dword [ebp - 0x154], 0
jmp 0x1002e8ca
mov eax, dword [ebp - 0x18]
inc eax
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1a
jae 0x1002e9a2
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xb4]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x18], eax
jne 0x1002e914
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0xb4]
inc eax
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0xb4]
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x18], eax
jmp 0x1002e8c2
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0xb3]
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x154]
movzx ecx, byte [ebp + ecx - 0xb6]
movsx ecx, byte [ebp + ecx - 0x2ec]
or eax, ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0xb3]
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x154]
movzx edx, byte [ebp + edx - 0xb6]
movsx edx, byte [ebp + edx - 0x2ec]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0xb4]
mov byte [ebp + ecx - 0x2ec], al
push 0
push 0x258e
push 1
push 0x3c7f
push 1
push 0x3f98
push 0xd66
lea eax, [ebp - 0x154]
push eax
call fcn.1002b3a2
add esp, 0x20
jmp 0x1002e8c2
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x2ec], 0
lea eax, [ebp - 0x2ec]
push eax
lea ecx, [ebp - 0x598]
call fcn.10048319
mov byte [ebp - 4], 0xe
and dword [ebp - 0x15c], 0
jmp 0x1002e9dc
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xd
jae 0x1002e9f5
mov eax, dword [ebp - 0x15c]
mov byte [ebp + eax - 0x2ec], 0
jmp 0x1002e9cf
push 0
push 0
lea eax, [ebp - 0x598]
push eax
push dword [ebp - 0x298]
call fcn.10035360
add esp, 0x10
mov dword [0x1009500c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x598]
call fcn.10022c86
cmp dword [0x1009500c], 0
je 0x1002ea40
mov ecx, dword [ebp - 0x2a0]
call fcn.10022c0b
push eax
call dword [0x1009500c]
mov dword [ebp - 0x74], eax
push 0
push 1
call fcn.1002b16d
pop ecx
pop ecx
push 0x10095014
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x74]
push eax
push 1
push 1
push 0x7dd8
push 0x100950bc
push 1
call fcn.10029aeb
add esp, 0x20
mov eax, dword [ebp - 0x2b0]
mov ecx, dword [ebp - 0x74]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x45c]
call fcn.10022bac
jmp 0x1002ec18
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x314]
mov esi, dword [eax]
push 0
mov ecx, dword [ebp - 0x31c]
call fcn.10022db7
mov dword [eax], esi
jmp 0x1002ec18
mov dword [ebp - 0x2b8], 0x2522
mov dword [ebp - 0x32c], 0x1000a688
cmp dword [ebp - 0x2b8], 0x25db
jle 0x1002ebf8
and dword [ebp - 0x164], 0
jmp 0x1002eb29
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0x1e16
jge 0x1002ebea
and dword [ebp - 0x16c], 0
jmp 0x1002eb4f
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0xc16
jge 0x1002ebe5
and dword [ebp - 0x174], 0
jmp 0x1002eb75
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0x72dd
jge 0x1002ebe0
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0x16c]
sar eax, cl
xor eax, dword [ebp - 0x174]
cdq
mov dword [ebp - 0x3ac], eax
mov dword [ebp - 0x3a8], edx
push dword [ebp - 0x3a8]
push dword [ebp - 0x3ac]
lea ecx, [ebp - 0x618]
call fcn.100128ee
pop ecx
pop ecx
mov dword [ebp - 0x324], eax
mov ecx, dword [ebp - 0x324]
call fcn.100229df
push eax
call fcn.10074e83
pop ecx
lea ecx, [ebp - 0x618]
call fcn.100229d5
jmp 0x1002eb68
jmp 0x1002eb42
jmp 0x1002eb1c
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call fcn.1002b15c
pop ecx
cmp dword [ebp - 0x2b8], 0x2318
jge 0x1002ec18
push dword [ebp - 0x32c]
call fcn.10074e83
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret