Function at 0x10031b67
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xb4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x10036d4e
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x764], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x748], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x704], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x640], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 0x648], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x710], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x708], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x650], eax
mov dword [ebp - 0x4e0], 0x4bf7
mov dword [ebp - 0x618], 0x1000a6a0
cmp dword [ebp - 0x4e0], 0x4ea5
jle 0x10031cd9
and dword [ebp - 0x110], 0
jmp 0x10031c1a
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x3b71
jge 0x10031cd9
and dword [ebp - 0x108], 0
jmp 0x10031c40
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0x7a9c
jge 0x10031cd4
and dword [ebp - 0x198], 0
jmp 0x10031c66
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0xef1
jge 0x10031ccf
mov eax, dword [ebp - 0x108]
and eax, dword [ebp - 0x198]
xor eax, dword [ebp - 0x110]
cdq
mov dword [ebp - 0x65c], eax
mov dword [ebp - 0x658], edx
push dword [ebp - 0x658]
push dword [ebp - 0x65c]
lea ecx, [ebp - 0xaac]
call fcn.1000de7e
pop ecx
pop ecx
mov dword [ebp - 0x734], eax
mov ecx, dword [ebp - 0x734]
call fcn.10013118
push eax
call fcn.100520df
pop ecx
lea ecx, [ebp - 0xaac]
call fcn.1001310e
jmp 0x10031c59
jmp 0x10031c33
jmp 0x10031c0d
mov eax, dword [ebp - 0x648]
movzx eax, byte [eax]
test eax, eax
je 0x10031d5c
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x718], eax
mov eax, dword [ebp - 0x708]
mov dword [ebp - 0x720], eax
mov eax, dword [ebp - 0x710]
mov dword [ebp - 0x728], eax
mov eax, dword [ebp - 0x718]
mov dword [ebp - 0x738], eax
mov eax, dword [ebp - 0x720]
mov dword [ebp - 0x740], eax
mov eax, dword [ebp - 0x728]
mov dword [ebp - 0x730], eax
push 0x7465
mov eax, dword [ebp - 0x730]
push dword [eax]
push 1
push 1
mov eax, dword [ebp - 0x738]
push dword [eax]
mov eax, dword [ebp - 0x740]
push dword [eax]
call fcn.1001ad33
add esp, 0x18
jmp 0x10036d07
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x5b8], eax
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0x644], eax
mov eax, dword [ebp - 0x704]
mov dword [ebp - 0x4d8], eax
mov eax, dword [ebp - 0x640]
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x5b8]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x800], 0x76820624
mov dword [ebp - 0x7fc], 0x76820624
mov dword [ebp - 0x7f8], 0x76820624
mov dword [ebp - 0x7f4], 0x76820624
lea ecx, [ebp - 0x22d]
call fcn.10013410
push eax
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x800]
push eax
lea ecx, [ebp - 0xa4c]
call fcn.10013413
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x544]
call fcn.100133bf
and dword [ebp - 4], 0
mov dword [ebp - 0xf4], 0x5a1fa147
push 0
lea ecx, [ebp - 0x544]
call fcn.10013401
and dword [eax], 0
jmp 0x10031e3c
push 0
lea ecx, [ebp - 0x544]
call fcn.10013401
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3b8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x544]
call fcn.10013401
cmp dword [eax], 0xb
jge 0x10031ee7
mov dword [ebp - 0xf0], 0xffffffff
mov dword [ebp - 0x1e0], 0
jmp 0x10031e75
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 1
jge 0x10031e91
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0x58c], 0x869e
jmp 0x10031e68
mov dword [ebp - 0xf0], 0
jmp 0x10031eaa
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0xfffffff4
jge 0x10031ec8
mov eax, dword [ebp - 0xf0]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x58c], eax
jmp 0x10031e9d
mov byte [ebp - 0x90], 0
push 0
push 1
lea eax, [ebp - 0x90]
push eax
call fcn.1002df85
add esp, 0xc
jmp 0x10031e18
mov dword [ebp - 0xf4], 0xfffffff2
jmp 0x10031f00
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 6
jl 0x1003220b
push 3
lea ecx, [ebp - 0x518]
call fcn.10013363
mov byte [ebp - 4], 1
push 0
push 0x34e0
lea eax, [ebp - 0x518]
push eax
push 0x70c
lea eax, [ebp - 0x914]
push eax
push 0x531e
push 1
push 0x4a35
push 0x1041
call fcn.1002dc58
add esp, 0x24
mov dword [ebp - 0x4fc], 0x3938
mov dword [ebp - 0x594], 0x1000a6cc
cmp dword [ebp - 0x4fc], 0x3aae
jle 0x10032083
and dword [ebp - 0x120], 0
jmp 0x10031f8b
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x6651
jge 0x10032083
and dword [ebp - 0x118], 0
jmp 0x10031fb1
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0x602b
jge 0x1003207e
and dword [ebp - 0x1a0], 0
jmp 0x10031fd7
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0x7dcd
jge 0x10032079
and dword [ebp - 0xf8], 0
jmp 0x10031ffd
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0x2407
jge 0x10032074
mov eax, dword [ebp - 0x118]
cdq
idiv dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x120]
mov ecx, edx
shl eax, cl
or eax, dword [ebp - 0xf8]
cdq
mov dword [ebp - 0x668], eax
mov dword [ebp - 0x664], edx
push dword [ebp - 0x664]
push dword [ebp - 0x668]
lea ecx, [ebp - 0xaf4]
call fcn.1000de7e
pop ecx
pop ecx
mov dword [ebp - 0x684], eax
mov ecx, dword [ebp - 0x684]
call fcn.10013118
push eax
call fcn.100520df
pop ecx
lea ecx, [ebp - 0xaf4]
call fcn.1001310e
jmp 0x10031ff0
jmp 0x10031fca
jmp 0x10031fa4
jmp 0x10031f7e
mov byte [ebp - 4], 2
cmp dword [ebp - 0x4fc], 0x35ec
jge 0x1003209f
push dword [ebp - 0x594]
call fcn.100520df
pop ecx
jmp 0x100320bb
mov dword [ebp - 4], 1
jmp 0x100320cb
cmp dword [ebp - 0xf4], 0
je 0x100321b8
push 2
lea ecx, [ebp - 0x518]
call fcn.10013401
cmp dword [eax], 0
jne 0x100320f8
xor eax, eax
inc eax
jne 0x100320f8
and dword [ebp - 0x27c], 0
jmp 0x10032102
mov dword [ebp - 0x27c], 1
push 2
lea ecx, [ebp - 0x518]
call fcn.10013401
mov ecx, dword [ebp - 0x27c]
cmp ecx, dword [eax]
jg 0x10032125
mov dword [ebp - 0x274], 1
jmp 0x1003212c
and dword [ebp - 0x274], 0
push 0
lea ecx, [ebp - 0x544]
call fcn.10013401
cmp dword [eax], 0xfc60
jne 0x1003214d
mov dword [ebp - 0x4e8], 1
jmp 0x10032154
and dword [ebp - 0x4e8], 0
cmp dword [ebp - 0x4e8], 0
je 0x1003217b
push 2
lea ecx, [ebp - 0x518]
call fcn.10013401
cmp dword [eax], 0
je 0x1003217b
mov dword [ebp - 0x298], 1
jmp 0x10032182
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x274]
cmp eax, dword [ebp - 0x298]
jne 0x1003219c
mov dword [ebp - 0x3bc], 1
jmp 0x100321a3
and dword [ebp - 0x3bc], 0
cmp dword [ebp - 0x3bc], 0
je 0x100321b8
mov dword [ebp - 0x284], 1
jmp 0x100321bf
and dword [ebp - 0x284], 0
push 2
lea ecx, [ebp - 0x518]
call fcn.10013401
mov ecx, dword [ebp - 0x284]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x544]
call fcn.10013401
cmp dword [eax], 0
je 0x100321f7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x518]
call fcn.100133e5
jmp 0x1003220b
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x518]
call fcn.100133e5
jmp 0x10031ef3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x544]
call fcn.100133e5
mov dword [ebp - 0xa00], 1
push 1
lea ecx, [ebp - 0x980]
call fcn.10013363
mov dword [ebp - 4], 4
mov dword [ebp - 0x918], 0x963a
mov dword [ebp - 0x71c], 0x3d7f1912
mov dword [ebp - 0x220], 0
jmp 0x10032265
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 1
jge 0x10032287
push dword [ebp - 0x220]
lea ecx, [ebp - 0x980]
call fcn.10013401
mov dword [eax], 0xb7c7ce53
jmp 0x10032258
push 0xeb5
push 0x5b9e
push 0xe9d
lea eax, [ebp - 0x71c]
push eax
push 0
push 0
push 0x28b5
call fcn.10022aba
add esp, 0x1c
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x100322cb
push 0
push 1
call fcn.10026f99
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x980]
call fcn.100133e5
mov dword [ebp - 0x9c4], 0x3b3152c5
mov dword [ebp - 0x920], 0x9e95d1c5
mov dword [ebp - 0x138], 0xf6285890
mov dword [ebp - 0xa24], 0x364d64ea
push 3
lea ecx, [ebp - 0x990]
call fcn.10013363
mov dword [ebp - 4], 5
mov dword [ebp - 0x24], 0
jmp 0x10032326
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 4
jge 0x1003233c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xb5c], 1
jmp 0x1003231f
mov dword [ebp - 0x24], 0
jmp 0x1003234c
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10032362
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x520], 0
jmp 0x10032345
mov dword [ebp - 0x24], 0
jmp 0x10032372
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1003238b
push dword [ebp - 0x24]
lea ecx, [ebp - 0x990]
call fcn.10013401
or dword [eax], 0xffffffff
jmp 0x1003236b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x520], 3
jmp 0x100323b9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x520]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x520], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x520], 0
jl 0x100325ec
mov dword [ebp - 0xe0], 0x48afa2fa
mov dword [ebp - 0x928], 0xc7b5c6ef
mov dword [ebp - 0x9d4], 0x69bd697e
mov dword [ebp - 0x930], 0xacde9e84
mov dword [ebp - 0xa08], 0xfffffffe
mov dword [ebp - 0x938], 0x8b15e31
mov dword [ebp - 0x958], 0x4a90c6d2
mov dword [ebp - 0x940], 1
mov dword [ebp - 0x960], 1
mov dword [ebp - 0x948], 0x44653ff
mov dword [ebp - 0x28c], 0xffffffff
mov dword [ebp - 0x128], 0
jmp 0x10032454
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 4
jge 0x10032470
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0xb4c], 1
jmp 0x10032447
mov dword [ebp - 0x45c], 0xb10
mov dword [ebp - 0x59c], 0x1000a718
cmp dword [ebp - 0x45c], 0xcbb
jle 0x10032509
and dword [ebp - 0x1a8], 0
jmp 0x100324a6
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0x3abe
jge 0x10032509
and dword [ebp - 0x130], 0
jmp 0x100324c8
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0x45fd
jge 0x10032507
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [ebp - 0x130]
sar eax, cl
cdq
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x670], edx
push dword [ebp - 0x670]
push dword [ebp - 0x674]
mov ecx, 0x10611478
call fcn.10013138
jmp 0x100324bb
jmp 0x10032499
push 0x3a85
push 0x78a2
push 0x3a33
lea eax, [ebp - 0xe0]
push eax
push 1
push 0
call fcn.10023257
add esp, 0x18
mov byte [ebp - 4], 6
cmp dword [ebp - 0x45c], 0xab7
jge 0x1003254b
mov edx, dword [ebp - 0x59c]
mov ecx, 0x10611478
call fcn.10015a5f
jmp 0x10032567
mov dword [ebp - 4], 5
jmp 0x10032577
mov dword [ebp - 0xe0], 0
jmp 0x10032590
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jg 0x100325e7
mov dword [ebp - 0x968], 0xffffffff
mov dword [ebp - 0x1e8], 0
jmp 0x100325bc
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jge 0x100325d8
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0x950], 0x9642e40c
jmp 0x100325af
mov eax, dword [ebp - 0x28c]
dec eax
mov dword [ebp - 0x28c], eax
jmp 0x10032583
jmp 0x1003239e
mov dword [ebp - 0x138], 2
jmp 0x10032605
mov eax, dword [ebp - 0x138]
dec eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jl 0x1003263d
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x1003263b
push 0
push 0x5741
push 0x47ac
push 0x695c
push 0
call fcn.10036db4
add esp, 0x14
jmp 0x100325f8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x990]
call fcn.100133e5
mov dword [ebp - 0x814], 0x76820624
mov dword [ebp - 0x810], 0x76820624
mov dword [ebp - 0x80c], 0x76820624
mov dword [ebp - 0x808], 0x76820624
lea ecx, [ebp - 0x25a]
call fcn.10013410
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0xa7c]
call fcn.10013413
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x550]
call fcn.100133bf
mov dword [ebp - 4], 8
mov dword [ebp - 0xc8], 0x5a1fa147
mov dword [ebp - 0x30], 0xcb3f
mov dword [ebp - 0xac], 0xee91b76
mov dword [ebp - 0x3d4], 0xe4d8d955
mov dword [ebp - 0x44], 0
jmp 0x100326e5
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x100326fb
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xa20], 7
jmp 0x100326de
mov dword [ebp - 0x44], 0
jmp 0x1003270b
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x10032721
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xa44], 0xc9ba5b0
jmp 0x10032704
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x970], eax
mov eax, dword [ebp - 0x30]
add eax, 0x59c3
je 0x10032746
cmp dword [ebp - 0x30], 0
je 0x10032746
mov dword [ebp - 0x3c4], 1
jmp 0x1003274d
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x3c4], eax
jl 0x10032764
mov dword [ebp - 0x294], 1
jmp 0x1003276b
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x294], eax
jg 0x10032782
mov dword [ebp - 0x690], 1
jmp 0x10032789
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x9e4], eax
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
imul ecx, ecx, 3
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp + ecx - 0xa20]
imul ecx, edx, 0x1932
sub ecx, dword [ebp + eax - 0xa20]
jne 0x100327c6
cmp dword [ebp - 0x30], 0
jne 0x100327c6
and dword [ebp - 0x4ac], 0
jmp 0x100327d0
mov dword [ebp - 0x4ac], 1
mov eax, 0x9900
sub eax, dword [ebp - 0x4ac]
cmp eax, dword [ebp - 0x30]
jg 0x100327ef
cmp dword [ebp - 0x30], 0
jne 0x100327ef
and dword [ebp - 0x29c], 0
jmp 0x100327f9
mov dword [ebp - 0x29c], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x29c], eax
jne 0x10032810
mov dword [ebp - 0x3cc], 1
jmp 0x10032817
and dword [ebp - 0x3cc], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa20]
add eax, dword [ebp - 0x3cc]
jne 0x1003283c
push 3
pop eax
test eax, eax
jne 0x1003283c
and dword [ebp - 0x2a4], 0
jmp 0x10032846
mov dword [ebp - 0x2a4], 1
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x7b38
jg 0x1003286a
mov dword [ebp - 0x464], 1
jmp 0x10032871
and dword [ebp - 0x464], 0
cmp dword [ebp - 0x464], 0xffffffff
jge 0x10032886
mov dword [ebp - 0x2ac], 1
jmp 0x1003288d
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x2b4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2b4]
mov dword [ebp + eax - 0xa44], ecx
cmp dword [ebp - 0x2b4], 0
je 0x10032a8f
mov dword [ebp - 0xac], 0
jmp 0x100328de
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xfffffffb
jne 0x10032a8a
push 0
push 0
push 0x1373
push 1
push 0x6f49
lea eax, [ebp - 0x30]
push eax
call fcn.100192ce
add esp, 0x18
mov byte [ebp - 0x75], 0
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x10032a85
mov dword [ebp - 0x4d4], 0x161e
mov dword [ebp - 0x75c], 0x1000a798
cmp dword [ebp - 0x4d4], 0x1957
jle 0x10032a33
push 0
push 0
push 0x591
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
and dword [ebp - 0x1b0], 0
jmp 0x10032962
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0x768
jge 0x10032a24
and dword [ebp - 0x140], 0
jmp 0x10032988
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0x59b8
jge 0x10032a1f
and dword [ebp - 0x208], 0
jmp 0x100329ae
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0x4a90
jge 0x10032a1a
mov eax, dword [ebp - 0x1b0]
cdq
idiv dword [ebp - 0x140]
or edx, dword [ebp - 0x208]
mov eax, edx
cdq
mov dword [ebp - 0x680], eax
mov dword [ebp - 0x67c], edx
push dword [ebp - 0x67c]
push dword [ebp - 0x680]
lea ecx, [ebp - 0xac4]
call fcn.1000de7e
pop ecx
pop ecx
mov dword [ebp - 0x5a4], eax
mov ecx, dword [ebp - 0x5a4]
call fcn.10013118
push eax
call fcn.100520df
pop ecx
lea ecx, [ebp - 0xac4]
call fcn.1001310e
jmp 0x100329a1
jmp 0x1003297b
jmp 0x10032955
push 0
push 0x1294
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov byte [ebp - 4], 9
cmp dword [ebp - 0x4d4], 0x1330
jge 0x10032a59
push dword [ebp - 0x75c]
call fcn.100520df
pop ecx
jmp 0x10032a75
mov dword [ebp - 4], 8
jmp 0x10032a85
jmp 0x100328d1
jmp 0x10032c64
mov dword [ebp - 0x964], 0xe5f58cdc
mov dword [ebp - 0x148], 0
jmp 0x10032ab2
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 3
jge 0x10032ace
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x9a0], 7
jmp 0x10032aa5
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x9a0]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x9a0], eax
mov dword [ebp - 0x2bc], 0x6cc
mov dword [ebp - 0x69c], 0x1000a7e8
cmp dword [ebp - 0x2bc], 0x94a
jle 0x10032bf4
push 1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
and dword [ebp - 0x1b8], 0
jmp 0x10032b2f
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0x310c
jge 0x10032bee
and dword [ebp - 0x150], 0
jmp 0x10032b55
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0x62b1
jge 0x10032be9
and dword [ebp - 0x1f0], 0
jmp 0x10032b7b
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0x7c72
jge 0x10032be4
mov eax, dword [ebp - 0x1b8]
sub eax, dword [ebp - 0x150]
and eax, dword [ebp - 0x1f0]
cdq
mov dword [ebp - 0x68c], eax
mov dword [ebp - 0x688], edx
push dword [ebp - 0x688]
push dword [ebp - 0x68c]
lea ecx, [ebp - 0xadc]
call fcn.1000de7e
pop ecx
pop ecx
mov dword [ebp - 0x5ac], eax
mov ecx, dword [ebp - 0x5ac]
call fcn.10013118
push eax
call fcn.100520df
pop ecx
lea ecx, [ebp - 0xadc]
call fcn.1001310e
jmp 0x10032b6e
jmp 0x10032b48
jmp 0x10032b22
call dword [sym.imp.KERNEL32.dll_GetACP]
mov byte [ebp - 0x97], 0
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x2bc], 0x6ad
jge 0x10032c17
push dword [ebp - 0x69c]
call fcn.100520df
pop ecx
jmp 0x10032c33
mov dword [ebp - 4], 8
jmp 0x10032c43
movzx eax, byte [ebp - 0x97]
test eax, eax
je 0x10032c64
push 0x4dd2
push 0
push 0x5fab
push 0
call fcn.10018cb2
add esp, 0x10
push 0
lea ecx, [ebp - 0x550]
call fcn.10013401
and dword [eax], 0
jmp 0x10032c9a
push 0
lea ecx, [ebp - 0x550]
call fcn.10013401
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0x3dc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3dc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x550]
call fcn.10013401
cmp dword [eax], 0xb
jge 0x10033e78
mov dword [ebp - 0x28], 0x15912491
mov dword [ebp - 0x5b4], 0x6a47cded
mov dword [ebp - 0x724], 0xfffffffc
mov dword [ebp - 0x158], 0
jmp 0x10032ce4
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 2
jge 0x10032d00
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x7c8], 0xfa32
jmp 0x10032cd7
push 2
pop eax
test eax, eax
je 0x10032d19
cmp dword [ebp - 0x28], 0
je 0x10032d19
mov dword [ebp - 0x2c4], 1
jmp 0x10032d20
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x9e8], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x8b4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x8bc], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x8c4], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x2c4], eax
jl 0x10032d5b
mov dword [ebp - 0x46c], 1
jmp 0x10032d62
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x46c]
add eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x28]
je 0x10032d94
mov byte [ebp - 0x7d], 0
push 0x6470
push 0x43
push 0
push 1
lea eax, [ebp - 0x7d]
push eax
call fcn.100190e0
add esp, 0x14
jmp 0x10032e38
mov dword [ebp - 0x28], 0
jmp 0x10032da4
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jg 0x10032e38
mov dword [ebp - 0x60], 0xb6478c38
mov dword [ebp - 0x60], 1
jmp 0x10032dc5
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x10032e0c
mov dword [ebp - 0xd0], 0x6aeba4d3
mov dword [ebp - 0xd0], 0
jmp 0x10032dee
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x10032e0a
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x7c8], 0
jmp 0x10032de1
jmp 0x10032dbe
mov dword [ebp - 0x60], 1
jmp 0x10032e1c
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x10032e33
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x7c8], 0
je 0x10032e31
jmp 0x10032e33
jmp 0x10032e15
jmp 0x10032d9d
push 1
lea eax, [ebp - 0x5b4]
push eax
push 0x607c
push 0x5784
lea eax, [ebp - 0x724]
push eax
push 0x602f
push 0x4eab
push 0
push 0x6100
push 0x4252
call fcn.10025a4a
add esp, 0x28
mov dword [ebp - 0xc4], 0xffffffff
push 3
lea ecx, [ebp - 0x854]
call fcn.10013363
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x6a8], 0x39beb064
mov dword [ebp - 0x2cc], 0x44d4
mov dword [ebp - 0x5bc], 0x1000a814
cmp dword [ebp - 0x2cc], 0x4866
jle 0x10032f62
and dword [ebp - 0x1c0], 0
jmp 0x10032ecf
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0x91e
jge 0x10032f62
and dword [ebp - 0x160], 0
jmp 0x10032ef5
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0x52b7
jge 0x10032f5d
and dword [ebp - 0x218], 0
jmp 0x10032f17
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0x6293
jge 0x10032f5b
mov eax, dword [ebp - 0x1c0]
imul eax, dword [ebp - 0x160]
sub eax, dword [ebp - 0x218]
cdq
mov dword [ebp - 0x698], eax
mov dword [ebp - 0x694], edx
push dword [ebp - 0x694]
push dword [ebp - 0x698]
mov ecx, 0x10611478
call fcn.10013138
jmp 0x10032f0a
jmp 0x10032ee8
jmp 0x10032ec2
mov dword [ebp - 0x168], 0
jmp 0x10032f7b
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 3
jge 0x10032f9d
push dword [ebp - 0x168]
lea ecx, [ebp - 0x854]
call fcn.10013401
mov dword [eax], 0xbbca6318
jmp 0x10032f6e
mov byte [ebp - 4], 0xe
cmp dword [ebp - 0x2cc], 0x43d6
jge 0x10032fbd
mov edx, dword [ebp - 0x5bc]
mov ecx, 0x10611478
call fcn.10015a5f
jmp 0x10032fd9
mov dword [ebp - 4], 0xd
jmp 0x10032fe9
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x10033008
push 0
push 0x22a
call dword [sym.imp.USER32.dll_RemovePropA]
push 0
lea eax, [ebp - 0x854]
push eax
push 0x6cf
push 0x65ce
push 0x60a9
push 0x7c4
push 0
lea eax, [ebp - 0x6a8]
push eax
call fcn.100300d5
add esp, 0x20
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x854]
call fcn.100133e5
mov dword [ebp - 0x1c8], 0
jmp 0x1003305e
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 1
jge 0x1003307a
mov eax, dword [ebp - 0x1c8]
mov dword [ebp + eax*4 - 0x5cc], 0x869e
jmp 0x10033051
mov dword [ebp - 0xc4], 0
jmp 0x10033093
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xfffffff4
jge 0x1003316c
mov dword [ebp - 0x770], 0
mov dword [ebp - 0x170], 0
jmp 0x100330c3
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x100330df
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x1f8], 5
jmp 0x100330b6
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1f8], 0
jmp 0x1003310d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1f8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1f8], 0xffffffe3
jne 0x10033154
mov dword [ebp - 0x5c4], 1
lea eax, [ebp - 0x5c4]
push eax
push 0x6e75
push 0
push 0x6087
lea eax, [ebp - 0x770]
push eax
push 0x56fd
push 1
push 0
call fcn.10023e1b
add esp, 0x20
jmp 0x100330f2
mov eax, dword [ebp - 0xc4]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x5cc], eax
jmp 0x10033086
mov dword [ebp - 0x64], 0x5c68ec0a
mov dword [ebp - 0x94], 1
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x258], 0xfffffffd
mov dword [ebp - 0x4f8], 0xffffffff
mov dword [ebp - 0x3e4], 0x1384
mov dword [ebp - 0x6b4], 0x1000a888
cmp dword [ebp - 0x3e4], 0x15db
jle 0x1003329a
and dword [ebp - 0x180], 0
jmp 0x100331d5
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0x4155
jge 0x1003329a
and dword [ebp - 0x178], 0
jmp 0x100331fb
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x4df9
jge 0x10033295
and dword [ebp - 0x1d0], 0
jmp 0x10033221
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0xaf4
jge 0x10033290
and dword [ebp - 0x210], 0
jmp 0x10033243
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0x7f7d
jge 0x1003328e
mov eax, dword [ebp - 0x178]
mov ecx, dword [ebp - 0x1d0]
shl eax, cl
or eax, dword [ebp - 0x180]
or eax, dword [ebp - 0x210]
cdq
mov dword [ebp - 0x6a4], eax
mov dword [ebp - 0x6a0], edx
push dword [ebp - 0x6a0]
push dword [ebp - 0x6a4]
mov ecx, 0x10611478
call fcn.10013138
jmp 0x10033236
jmp 0x10033214
jmp 0x100331ee
jmp 0x100331c8
push 1
lea ecx, [ebp - 0x9b0]
call fcn.10013363
mov byte [ebp - 4], 0x10
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x3e4], 0x10e0
jge 0x100332cb
mov edx, dword [ebp - 0x6b4]
mov ecx, 0x10611478
call fcn.10015a5f
jmp 0x100332e7
mov dword [ebp - 4], 0x10
jmp 0x100332f7
mov dword [ebp - 0x8cc], 0xd6b9ec49
mov dword [ebp - 0x250], 0x38d7
mov dword [ebp - 0x40], 0
jmp 0x1003331b
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x10033331
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x4f4], 0xffffffff
jmp 0x10033314
mov dword [ebp - 0x40], 0
jmp 0x10033341
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x10033357
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xa8c], 0x2499e68f
jmp 0x1003333a
push 0x2563
push 0
push 0x1f29
push 0
lea eax, [ebp - 0x9b0]
push eax
push 0x3fe5
push 0x407d
lea eax, [ebp - 0x40]
push eax
push 0x60e4
call fcn.1002db2a
add esp, 0x24
mov dword [ebp - 0x64], 0xffffffef
jmp 0x10033397
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0xffffffe5
jl 0x100335ac
mov dword [ebp - 0x3f4], 0xffffffff
push 2
lea ecx, [ebp - 0x784]
call fcn.10013363
mov byte [ebp - 4], 0x13
push 0x7d97
lea eax, [ebp - 0x8d4]
push eax
push 1
push 0
push 0x5d3c
lea eax, [ebp - 0x784]
push eax
push 0x1a39
push 0x7d4a
push 0
call fcn.10027a71
add esp, 0x24
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x8dc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4f4]
mov dword [ebp - 0x8e4], eax
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x2d4], eax
push 1
lea ecx, [ebp - 0x784]
call fcn.10013401
mov ecx, dword [ebp - 0x2d4]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4f4]
cmp dword [ebp - 0x2d4], eax
jne 0x1003344d
mov dword [ebp - 0x4b4], 1
jmp 0x10033454
and dword [ebp - 0x4b4], 0
cmp dword [ebp - 0x4b4], 0xffffffff
jne 0x10033469
mov dword [ebp - 0x2dc], 1
jmp 0x10033470
and dword [ebp - 0x2dc], 0
cmp dword [ebp - 0x2dc], 0xddd9cd4
je 0x10033488
mov dword [ebp - 0x3ec], 1
jmp 0x1003348f
and dword [ebp - 0x3ec], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4f4]
cmp dword [ebp - 0x3ec], eax
jg 0x100334b0
mov dword [ebp - 0x2e4], 1
jmp 0x100334b7
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x2e4]
add eax, 0x849b
mov ecx, dword [ebp - 0x94]
sub ecx, eax
mov dword [ebp - 0x474], ecx
mov eax, dword [ebp - 0x474]
add eax, 0x229a
je 0x100334f2
mov eax, 0xf444
test eax, eax
je 0x100334f2
mov dword [ebp - 0x5d4], 1
jmp 0x100334f9
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x8ec], eax
cmp dword [ebp - 0x64], 1
jg 0x10033517
mov dword [ebp - 0x2ec], 1
jmp 0x1003351e
and dword [ebp - 0x2ec], 0
cmp dword [ebp - 0x2ec], 0x43e5ec35
jge 0x10033536
mov dword [ebp - 0x2f4], 1
jmp 0x1003353d
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x3f4]
add eax, dword [ebp - 0x2f4]
je 0x10033560
mov eax, 0x8bc698dc
test eax, eax
je 0x10033560
mov dword [ebp - 0x72c], 1
jmp 0x10033567
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x8f4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4f4]
mov dword [ebp - 0x8fc], eax
push 1
lea ecx, [ebp - 0x784]
call fcn.10013401
mov eax, dword [eax]
mov dword [ebp - 0x258], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x784]
call fcn.100133e5
jmp 0x10033390
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x904], eax
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x5dc], eax
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x5dc]
cmp eax, dword [ebp - 0x6c0]
jne 0x10033630
mov dword [ebp - 0x5e4], 1
mov eax, dword [ebp - 0x5e4]
mov dword [ebp - 0x258], eax
mov byte [ebp - 0x85], 0
push 0x448a
push 0
push 1
push 0x6c29
lea eax, [ebp - 0x85]
push eax
call fcn.1002640a
add esp, 0x14
jmp 0x1003379b
mov dword [ebp - 0x3fc], 0xa623b0d7
mov dword [ebp - 0x5ec], 3
mov dword [ebp - 0x94], 0
jmp 0x1003365d
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jg 0x1003379b
mov dword [ebp - 0x240], 6
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x240], 0x2b33
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x90c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4f4]
mov dword [ebp - 0x8b0], eax
mov dword [ebp - 0x54], 0xdfa8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa8c]
cmp eax, dword [ebp - 0x54]
je 0x100336cc
cmp dword [ebp - 0x54], 0
jne 0x100336cc
and dword [ebp - 0x2fc], 0
jmp 0x100336d6
mov dword [ebp - 0x2fc], 1
mov eax, dword [ebp - 0x2fc]
sub eax, dword [ebp - 0x3fc]
je 0x100336f6
cmp dword [ebp - 0x240], 0
je 0x100336f6
and dword [ebp - 0x778], 0
jmp 0x10033700
mov dword [ebp - 0x778], 1
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x91c], eax
cmp dword [ebp - 0x54], 0x7345
jl 0x10033721
mov dword [ebp - 0x304], 1
jmp 0x10033728
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x3fc]
cmp dword [ebp - 0x304], eax
je 0x10033742
mov dword [ebp - 0x47c], 1
jmp 0x10033749
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0x5ec], eax
mov dword [ebp - 0x54], 0
jmp 0x10033765
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x10033796
push 0
push 0x7836
push 0x5868
push 1
push 0
push 0x19af
push 0x57
push 0xc25
push 0x2c64
call fcn.1001973c
add esp, 0x24
jmp 0x1003375e
jmp 0x10033650
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x9b0]
call fcn.100133e5
mov byte [ebp - 0x96], 0
mov dword [ebp - 0xb4], 0xffffffff
push 3
lea ecx, [ebp - 0x7c0]
call fcn.10013363
mov byte [ebp - 4], 0x14
push 0x424c
push 0x53ec
push 0x51ea
push 0x6ba2
push 0x4414
push 0x6aa
lea eax, [ebp - 0x7c0]
push eax
push 0x6261
push 0x6cec
push 0x76ef
push 0x6f57
push 0x3a6b
push 0x6d21
push 0x184
push 1
push 0x4396
push 0x7afb
push 0x22b6
push 0x31f0
push 0
push 0x4c94
push 0x1dcd
push 0x1eba
lea eax, [ebp - 0x924]
push eax
push 0x491
push 0x2c92
push 0x688a
push 0x5035
push 0
push 0x4fad
call fcn.10027bc3
add esp, 0x78
mov dword [ebp - 0xb4], 0
jmp 0x1003387e
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0xb
jl 0x10033c1e
mov dword [ebp - 0xbc], 0xfffffffb
mov dword [ebp - 0x334], 1
mov dword [ebp - 0xbc], 0xffffffe6
jmp 0x100338b8
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xffffffee
je 0x10033c19
push 4
lea ecx, [ebp - 0x52c]
call fcn.10013363
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x83c], 0x9b88
mov dword [ebp - 0x838], 0x9b88
mov dword [ebp - 0x834], 0x9b88
mov dword [ebp - 0x830], 0x9b88
lea ecx, [ebp - 0x259]
call fcn.10013410
push eax
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x83c]
push eax
lea ecx, [ebp - 0xa54]
call fcn.10013413
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9c0]
call fcn.100133bf
mov byte [ebp - 4], 0x16
push 0x411d
lea eax, [ebp - 0x52c]
push eax
push 0x7054
push 0x4af8
push 0x5f1f
push 0x1a99
push 0
push 0x6842
lea eax, [ebp - 0x92c]
push eax
push 0x5e5
call fcn.100378ef
add esp, 0x28
push 3
lea ecx, [ebp - 0x52c]
call fcn.10013401
mov dword [eax], 0x1b
jmp 0x100339ab
push 3
lea ecx, [ebp - 0x52c]
call fcn.10013401
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x30c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x30c]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x52c]
call fcn.10013401
cmp dword [eax], 0xffffffeb
jle 0x10033bf6
mov dword [ebp - 0xc0], 0x1bca9d69
mov dword [ebp - 0x6cc], 0xfffd
mov dword [ebp - 0xc0], 0xd
jmp 0x100339ee
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x10
jge 0x10033a95
mov dword [ebp - 0xd8], 5
mov byte [ebp - 0x9b], 0
movzx eax, byte [ebp - 0x9b]
test eax, eax
je 0x10033a2f
push 0
push 1
push 0
push 0x745b
push 0x1f35
call fcn.1002ee27
add esp, 0x14
mov dword [ebp - 0xd8], 0
jmp 0x10033a48
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x10033a90
push 0x6a48
push 0x5dba
push 0x779c
lea eax, [ebp - 0xd8]
push eax
push 0x1cb6
push 0x1fb6
push 0x60b5
lea eax, [ebp - 0x7c0]
push eax
push 0
push 0x1b48
push 0
call fcn.10028a0f
add esp, 0x2c
jmp 0x10033a3b
jmp 0x100339e1
cmp dword [ebp - 0xbc], 0
jne 0x10033aaa
mov dword [ebp - 0x314], 1
jmp 0x10033ab1
and dword [ebp - 0x314], 0
mov esi, dword [ebp - 0xb4]
push 2
lea ecx, [ebp - 0x52c]
call fcn.10013401
cmp esi, dword [eax]
jle 0x10033add
cmp dword [ebp - 0xc0], 0
je 0x10033add
mov dword [ebp - 0x404], 1
jmp 0x10033ae4
and dword [ebp - 0x404], 0
cmp dword [ebp - 0x404], 1
je 0x10033af9
mov dword [ebp - 0x4bc], 1
jmp 0x10033b00
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0xb4]
sub eax, dword [ebp - 0xc0]
cmp eax, 0xfffffffd
je 0x10033b1d
mov dword [ebp - 0x31c], 1
jmp 0x10033b24
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x31c]
sub eax, 0x7c9b7427
cmp eax, dword [ebp - 0xbc]
je 0x10033b43
mov dword [ebp - 0x40c], 1
jmp 0x10033b4a
and dword [ebp - 0x40c], 0
push 2
lea ecx, [ebp - 0x7c0]
call fcn.10013401
mov eax, dword [eax]
cmp eax, dword [ebp - 0x40c]
jg 0x10033b6d
mov dword [ebp - 0x324], 1
jmp 0x10033b74
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x6cc]
cmp dword [ebp - 0x324], eax
jg 0x10033b8e
mov dword [ebp - 0x484], 1
jmp 0x10033b95
and dword [ebp - 0x484], 0
cmp dword [ebp - 0x484], 0x4f2a
je 0x10033bad
mov dword [ebp - 0x32c], 1
jmp 0x10033bb4
and dword [ebp - 0x32c], 0
cmp dword [ebp - 0x32c], 0xffffffff
jne 0x10033bc9
mov dword [ebp - 0x414], 1
jmp 0x10033bd0
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x334], eax
mov esi, dword [ebp - 0x334]
push 1
lea ecx, [ebp - 0x9c0]
call fcn.10013401
mov dword [eax], esi
jmp 0x10033987
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x9c0]
call fcn.100133e5
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x52c]
call fcn.100133e5
jmp 0x100338ab
jmp 0x10033871
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x7c0]
call fcn.100133e5
movzx eax, byte [ebp - 0x96]
test eax, eax
je 0x10033e73
push 2
lea ecx, [ebp - 0x55c]
call fcn.10013363
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x6c], 0xf2f4a8b1
mov dword [ebp - 0x604], 0x79c63c40
mov dword [ebp - 0x934], 1
mov dword [ebp - 0x5fc], 0x8ed4a55f
push 0
push 0
push 0x5aa8
lea eax, [ebp - 0x55c]
push eax
push 0x1bba
push 0x2e8c
push 0x46ab
push 0x7dcf
push 0x1416
push 0x746a
push 0x2f2c
lea eax, [ebp - 0x93c]
push eax
push 0x37e7
call fcn.1001a01f
add esp, 0x34
mov dword [ebp - 0x6c], 0
jmp 0x10033cc9
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jg 0x10033e54
mov dword [ebp - 0x944], 0
mov dword [ebp - 0x94c], 1
mov dword [ebp - 0x6d8], 0
push 2
lea ecx, [ebp - 0x848]
call fcn.10013363
mov byte [ebp - 4], 0x18
push 0
push 0x1789
push 0x6ff6
push 1
push 0x3255
push 0x4146
push 0x2725
push 0x6a72
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x954]
push eax
call fcn.1002f2c1
add esp, 0x28
mov esi, dword [ebp - 0x6c]
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x55c]
call fcn.10013401
cmp dword [eax], esi
jg 0x10033d5b
mov dword [ebp - 0x41c], 1
jmp 0x10033d62
and dword [ebp - 0x41c], 0
push 1
lea ecx, [ebp - 0x848]
call fcn.10013401
mov dword [ebp - 0x248], eax
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x55c]
call fcn.10013401
mov eax, dword [eax]
mov dword [ebp - 0x5f4], eax
mov eax, dword [ebp - 0x248]
mov eax, dword [eax]
mov dword [ebp - 0x57c], eax
mov eax, dword [ebp - 0x248]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x248]
mov dword [ecx], eax
mov eax, dword [ebp - 0x5f4]
cmp eax, dword [ebp - 0x57c]
jne 0x10033dc4
mov dword [ebp - 0x4dc], 1
jmp 0x10033dcb
and dword [ebp - 0x4dc], 0
mov esi, dword [ebp - 0x5fc]
mov edi, dword [ebp - 0x4dc]
sub edi, dword [ebp - 0x6d8]
push 0
lea ecx, [ebp - 0x55c]
call fcn.10013401
add edi, dword [eax]
cmp edi, esi
je 0x10033dfc
mov dword [ebp - 0x33c], 1
jmp 0x10033e03
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x33c]
sub eax, dword [ebp - 0x604]
cmp dword [ebp - 0x41c], eax
jge 0x10033e23
mov dword [ebp - 0x344], 1
jmp 0x10033e2a
and dword [ebp - 0x344], 0
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x55c]
call fcn.10013401
mov ecx, dword [ebp - 0x344]
mov dword [eax], ecx
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x848]
call fcn.100133e5
jmp 0x10033cc2
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x55c]
call fcn.100133e5
push 0xf62
push 0x179c
call dword [sym.imp.KERNEL32.dll_Beep]
jmp 0x10032c76
mov dword [ebp - 0xc8], 0xfffffff2
jmp 0x10033e91
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 6
jl 0x10034a7b
mov dword [ebp - 0x48c], 0x2b44
mov dword [ebp - 0x60c], 0x1000a8f0
cmp dword [ebp - 0x48c], 0x2d90
jle 0x10033fd4
and dword [ebp - 0x190], 0
jmp 0x10033ed8
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0x6fb4
jge 0x10033fd4
and dword [ebp - 0x100], 0
jmp 0x10033efe
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0x25d
jge 0x10033fcf
and dword [ebp - 0x188], 0
jmp 0x10033f24
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0x595
jge 0x10033fca
and dword [ebp - 0x1d8], 0
jmp 0x10033f4a
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0x548
jge 0x10033fc5
mov eax, dword [ebp - 0x188]
imul eax, dword [ebp - 0x1d8]
mov edx, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x100]
shl edx, cl
mov ecx, eax
sar edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x6b0], eax
mov dword [ebp - 0x6ac], edx
push dword [ebp - 0x6ac]
push dword [ebp - 0x6b0]
lea ecx, [ebp - 0xb0c]
call fcn.1000de7e
pop ecx
pop ecx
mov dword [ebp - 0x774], eax
mov ecx, dword [ebp - 0x774]
call fcn.10013118
push eax
call fcn.100520df
pop ecx
lea ecx, [ebp - 0xb0c]
call fcn.1001310e
jmp 0x10033f3d
jmp 0x10033f17
jmp 0x10033ef1
jmp 0x10033ecb
mov dword [ebp - 0x828], 0xfffffffc
mov dword [ebp - 0x824], 0xfffffffc
mov dword [ebp - 0x820], 0xfffffffc
mov dword [ebp - 0x81c], 0xfffffffc
lea ecx, [ebp - 0x225]
call fcn.10013410
push eax
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x828]
push eax
lea ecx, [ebp - 0xa5c]
call fcn.10013413
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x79c]
call fcn.100133bf
mov byte [ebp - 4], 0x19
mov byte [ebp - 4], 0x1a
cmp dword [ebp - 0x48c], 0x27ef
jge 0x10034051
push dword [ebp - 0x60c]
call fcn.100520df
pop ecx
jmp 0x1003406d
mov dword [ebp - 4], 0x19
jmp 0x1003407d
push 0
lea ecx, [ebp - 0x79c]
call fcn.10013401
and dword [eax], 0
jmp 0x100340b3
push 0
lea ecx, [ebp - 0x79c]
call fcn.10013401
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x34c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x34c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x79c]
call fcn.10013401
cmp dword [eax], 0xffffffe9
jne 0x10034215
mov dword [ebp - 0x424], 0x38aa
mov dword [ebp - 0x6e4], 0x1000a938
cmp dword [ebp - 0x424], 0x3a01
jle 0x10034163
and dword [ebp - 0x104], 0
jmp 0x100340ff
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x652
jge 0x10034163
and dword [ebp - 0x10c], 0
jmp 0x10034121
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x234b
jge 0x10034161
mov eax, dword [ebp - 0x104]
cdq
idiv dword [ebp - 0x10c]
mov eax, edx
cdq
mov dword [ebp - 0x6bc], eax
mov dword [ebp - 0x6b8], edx
push dword [ebp - 0x6b8]
push dword [ebp - 0x6bc]
mov ecx, 0x10611478
call fcn.10013138
jmp 0x10034114
jmp 0x100340f2
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x424], 0x3650
jge 0x10034183
mov edx, dword [ebp - 0x6e4]
mov ecx, 0x10611478
call fcn.10015a5f
jmp 0x1003419f
mov dword [ebp - 4], 0x19
jmp 0x100341af
mov dword [ebp - 0x614], 1
mov dword [ebp - 0x114], 0
jmp 0x100341d2
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 2
jge 0x100341ee
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0xa74], 0
jmp 0x100341c5
push 1
push 0x54e4
push 0
push 0x2cd1
lea eax, [ebp - 0x614]
push eax
push 0x75e2
call fcn.1001a9fe
add esp, 0x18
jmp 0x1003408f
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x79c]
call fcn.100133e5
push 3
lea ecx, [ebp - 0x790]
call fcn.10013363
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x2c], 0xde19d29b
mov dword [ebp - 0x124], 0xfffffff6
mov dword [ebp - 0x22c], 0x6d64bda9
mov dword [ebp - 0x11c], 0
jmp 0x10034269
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 3
jge 0x10034285
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x268], 1
jmp 0x1003425c
mov dword [ebp - 0x2c], 2
jmp 0x10034295
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x100344ac
push 3
lea ecx, [ebp - 0x538]
call fcn.10013363
mov byte [ebp - 4], 0x1f
push 0x70db
push 0x1579
push 0x6e51
push 0x74de
push 0x487b
push 0x57e
lea eax, [ebp - 0x538]
push eax
push 0
lea eax, [ebp - 0x9f4]
push eax
push 0x6405
push 0x3551
push 1
push 0x1269
call fcn.1002299a
add esp, 0x34
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x268], 0
jne 0x1003444e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x268]
mov dword [ebp - 0x9fc], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xa04], eax
mov dword [ebp - 0x124], 0xd5
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x124]
cmp ecx, dword [ebp + eax*4 - 0x268]
jne 0x1003434c
mov dword [ebp - 0x73c], 1
jmp 0x10034353
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xa0c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x268]
mov dword [ebp - 0xa28], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x268]
mov dword [ebp - 0xa30], eax
push 1
lea ecx, [ebp - 0x538]
call fcn.10013401
push 2
lea ecx, [ebp - 0x538]
call fcn.10013401
cmp dword [eax], 0
jne 0x100343bc
push 1
lea ecx, [ebp - 0x538]
call fcn.10013401
cmp dword [eax], 0
jne 0x100343bc
and dword [ebp - 0x61c], 0
jmp 0x100343c6
mov dword [ebp - 0x61c], 1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xa38], eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x22c], eax
imul eax, dword [ebp - 0x22c], 0xffffffff
test eax, eax
jne 0x100343f8
cmp dword [ebp - 0x124], 0
jne 0x100343f8
and dword [ebp - 0x354], 0
jmp 0x10034402
mov dword [ebp - 0x354], 1
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x354]
jne 0x10034419
mov dword [ebp - 0x4c4], 1
jmp 0x10034420
and dword [ebp - 0x4c4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4c4]
sub ecx, dword [ebp + eax - 0x268]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x268]
imul eax, ecx
sub eax, dword [ebp - 0x2c]
je 0x1003444e
and dword [ebp - 0x35c], 0
jmp 0x10034458
mov dword [ebp - 0x35c], 1
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x268]
add eax, dword [ebp - 0x35c]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x268], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x268], 0
je 0x10034498
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x538]
call fcn.100133e5
jmp 0x1003428e
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x538]
call fcn.100133e5
jmp 0x1003428e
mov dword [ebp - 0x22c], 1
push 0
push 0x758a
push 0
push 0x32d3
push 0x2f27
push 1
lea eax, [ebp - 0x790]
push eax
lea eax, [ebp - 0xa34]
push eax
call fcn.10027435
add esp, 0x20
mov dword [ebp - 0x42c], 0x17b
mov dword [ebp - 0x6f0], 0x1000a994
cmp dword [ebp - 0x42c], 0x20e
jle 0x100345e1
and dword [ebp - 0x134], 0
jmp 0x1003451b
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x3df4
jge 0x100345e1
and dword [ebp - 0x13c], 0
jmp 0x10034541
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0x66c0
jge 0x100345dc
and dword [ebp - 0xfc], 0
jmp 0x10034567
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0x4e76
jge 0x100345d7
and dword [ebp - 0x12c], 0
jmp 0x10034589
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0x5e36
jge 0x100345d5
mov eax, dword [ebp - 0xfc]
cdq
idiv dword [ebp - 0x12c]
mov eax, dword [ebp - 0x134]
sub eax, dword [ebp - 0x13c]
sub eax, edx
cdq
mov dword [ebp - 0x6c8], eax
mov dword [ebp - 0x6c4], edx
push dword [ebp - 0x6c4]
push dword [ebp - 0x6c8]
mov ecx, 0x10611478
call fcn.10013138
jmp 0x1003457c
jmp 0x1003455a
jmp 0x10034534
jmp 0x1003450e
push 1
lea ecx, [ebp - 0x758]
call fcn.10013363
mov byte [ebp - 4], 0x20
mov byte [ebp - 4], 0x21
cmp dword [ebp - 0x42c], 0x45
jge 0x1003460f
mov edx, dword [ebp - 0x6f0]
mov ecx, 0x10611478
call fcn.10015a5f
jmp 0x1003462b
mov dword [ebp - 4], 0x20
jmp 0x1003463b
mov dword [ebp - 0x76c], 0xac12265e
mov dword [ebp - 0x624], 0xfffffffd
mov dword [ebp - 0x144], 0
jmp 0x10034668
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jge 0x10034687
push dword [ebp - 0x144]
lea ecx, [ebp - 0x758]
call fcn.10013401
and dword [eax], 0
jmp 0x1003465b
mov byte [ebp - 0x88], 0
movzx eax, byte [ebp - 0x88]
test eax, eax
je 0x100346be
push 0x1d50
push 0
push 0x3118
push 1
push 0x54ae
push 0x6fb0
push 0x5385
call fcn.10018d47
add esp, 0x1c
push 0
lea ecx, [ebp - 0x758]
call fcn.10013401
mov dword [eax], 0xffffffed
jmp 0x100346f7
push 0
lea ecx, [ebp - 0x758]
call fcn.10013401
mov dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x364]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x364]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x758]
call fcn.10013401
cmp dword [eax], 6
jg 0x1003477f
mov dword [ebp - 0xe8], 0x665683c8
mov dword [ebp - 0xe8], 0
jmp 0x1003472c
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0xfffffff6
jl 0x1003477a
mov dword [ebp - 0x62c], 0xf72b5725
push 0x5b92
lea eax, [ebp - 0x624]
push eax
push 0x5c9a
push 1
push 0x332f
push 0x75
lea eax, [ebp - 0x76c]
push eax
push 0
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.1002374c
add esp, 0x28
jmp 0x1003471f
jmp 0x100346d3
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x758]
call fcn.100133e5
push 0x4239
push 0x18dc
push 0x6955
push 0x1ef2
push 0xce6
push 0x3e2c
push 0x58ae
push 0x49e5
push 0x152d
push 0xb2e
push 0x5858
push 0x7131
push 0x2b20
push 0x3d5b
push 0
push 0xa23
push 0x972
push 0x2a0
push 0x708a
push 1
push 0x2128
lea eax, [ebp - 0x790]
push eax
push 0x5195
push 0x1198
push 0x5126
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x550]
push eax
push 0x11f6
push 1
push 0x1e2a
call fcn.10027bc3
add esp, 0x78
push 1
lea ecx, [ebp - 0x7b4]
call fcn.10013363
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x48], 0x5252cb13
mov dword [ebp - 0x95c], 2
mov dword [ebp - 0x14c], 0
jmp 0x10034864
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 1
jge 0x10034886
push dword [ebp - 0x14c]
lea ecx, [ebp - 0x7b4]
call fcn.10013401
mov dword [eax], 0xc03342eb
jmp 0x10034857
mov dword [ebp - 0x48], 0
jmp 0x10034896
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x10034a0a
mov dword [ebp - 0x494], 0x130d
mov dword [ebp - 0x634], 0x1000a9f0
cmp dword [ebp - 0x494], 0x1525
jle 0x1003499c
and dword [ebp - 0x164], 0
jmp 0x100348da
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0x4efa
jge 0x1003499c
and dword [ebp - 0x154], 0
jmp 0x10034900
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0x640
jge 0x10034997
and dword [ebp - 0x15c], 0
jmp 0x10034926
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0x7eee
jge 0x10034992
mov eax, dword [ebp - 0x154]
cdq
idiv dword [ebp - 0x15c]
xor edx, dword [ebp - 0x164]
mov eax, edx
cdq
mov dword [ebp - 0x6d4], eax
mov dword [ebp - 0x6d0], edx
push dword [ebp - 0x6d0]
push dword [ebp - 0x6d4]
lea ecx, [ebp - 0xb3c]
call fcn.1000de7e
pop ecx
pop ecx
mov dword [ebp - 0x6fc], eax
mov ecx, dword [ebp - 0x6fc]
call fcn.10013118
push eax
call fcn.100520df
pop ecx
lea ecx, [ebp - 0xb3c]
call fcn.1001310e
jmp 0x10034919
jmp 0x100348f3
jmp 0x100348cd
lea eax, [ebp - 0x7b4]
push eax
lea eax, [ebp - 0x48]
push eax
push 0xfcf
push 0
push 0x7d51
push 0
call fcn.10027020
add esp, 0x18
mov byte [ebp - 4], 0x24
cmp dword [ebp - 0x494], 0x1216
jge 0x100349d9
push dword [ebp - 0x634]
call fcn.100520df
pop ecx
jmp 0x100349f5
mov dword [ebp - 4], 0x23
jmp 0x10034a05
jmp 0x1003488f
mov dword [ebp - 0x48], 0
jmp 0x10034a1a
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xffffffe4
jl 0x10034a35
push 0
push 1
lea eax, [ebp - 0x7b4]
push eax
call fcn.10023470
add esp, 0xc
jmp 0x10034a13
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x7b4]
call fcn.100133e5
push 0
lea ecx, [ebp - 0x550]
call fcn.10013401
cmp dword [eax], 0
je 0x10034a67
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x790]
call fcn.100133e5
jmp 0x10034a7b
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x790]
call fcn.100133e5
jmp 0x10033e84
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x550]
call fcn.100133e5
cmp dword [ebp - 0x24c], 0
jle 0x10036d07
mov dword [ebp - 0x58], 0x2c70bb74
mov dword [ebp - 0x578], 0
mov dword [ebp - 0x574], 0
mov dword [ebp - 0x570], 0
mov dword [ebp - 0x56c], 0
mov dword [ebp - 0xb0], 0xfffffffa
mov dword [ebp - 0x16c], 0
jmp 0x10034ae9
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 1
jge 0x10034b05
mov eax, dword [ebp - 0x16c]
mov dword [ebp + eax*4 - 0x184], 0x8206
jmp 0x10034adc
mov dword [ebp - 0x58], 0
jmp 0x10034b15
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x10034b6b
mov dword [ebp - 0x744], 9
lea eax, [ebp - 0x744]
push eax
push 0
push 0x58
push 0x68e0
push 0x4ad0
push 1
push 0x7528
push 0x7161
push 1
push 0x15fb
push 0x77ef
push 0x6e67
push 0x3456
push 0x6f1a
call fcn.10023991
add esp, 0x38
jmp 0x10034b0e
mov dword [ebp - 0x58], 0
jmp 0x10034b7b
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xb
jl 0x10034f65
mov dword [ebp - 0x50], 0xf1860ec0
mov dword [ebp - 0x50], 0
jmp 0x10034b9c
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jg 0x10034f60
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x394], 0x3c5d
mov dword [ebp - 0x700], 0x1000aa70
cmp dword [ebp - 0x394], 0x3c83
jle 0x10034c71
and dword [ebp - 0x174], 0
jmp 0x10034be7
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0x35bf
jge 0x10034c71
and dword [ebp - 0x17c], 0
jmp 0x10034c09
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0x848
jge 0x10034c6c
mov eax, dword [ebp - 0x174]
and eax, dword [ebp - 0x17c]
cdq
mov dword [ebp - 0x6e0], eax
mov dword [ebp - 0x6dc], edx
push dword [ebp - 0x6dc]
push dword [ebp - 0x6e0]
lea ecx, [ebp - 0xb24]
call fcn.1000de7e
pop ecx
pop ecx
mov dword [ebp - 0x63c], eax
mov ecx, dword [ebp - 0x63c]
call fcn.10013118
push eax
call fcn.100520df
pop ecx
lea ecx, [ebp - 0xb24]
call fcn.1001310e
jmp 0x10034bfc
jmp 0x10034bda
mov dword [ebp - 0x1c], 0
jmp 0x10034c81
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jg 0x10034e89
mov dword [ebp - 0xcc], 0xc7c6f1fd
mov eax, dword [ebp - 0x50]
cmp dword [ebp + eax*4 - 0x574], 0
je 0x10034ca7
jmp 0x10034e89
mov dword [ebp - 0xcc], 0
jmp 0x10034cc0
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jg 0x10034e84
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x8b8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x96c], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp + eax*4 - 0x574], 0
jne 0x10034cfe
mov eax, 0xffff
test eax, eax
jne 0x10034cfe
and dword [ebp - 0x36c], 0
jmp 0x10034d08
mov dword [ebp - 0x36c], 1
cmp dword [ebp - 0x36c], 0
je 0x10034d24
push 8
pop eax
test eax, eax
je 0x10034d24
mov dword [ebp - 0x434], 1
jmp 0x10034d2b
and dword [ebp - 0x434], 0
cmp dword [ebp - 0x434], 0x7aa2
jne 0x10034d43
mov dword [ebp - 0x374], 1
jmp 0x10034d4a
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x374], eax
jle 0x10034d61
mov dword [ebp - 0x37c], 1
jmp 0x10034d68
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x184]
mov dword [ebp - 0x4ec], eax
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0x4ec]
mov dword [ebp + eax*4 - 0x184], ecx
mov eax, dword [ebp - 0x4ec]
add eax, dword [ebp - 0x37c]
je 0x10034d9d
cmp dword [ebp - 0x1c], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x184], 0
jne 0x10034dc3
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x184], 0
jne 0x10034dc3
and dword [ebp - 0x43c], 0
jmp 0x10034dcd
mov dword [ebp - 0x43c], 1
cmp dword [ebp - 0x43c], 0xb5c4
jge 0x10034de5
mov dword [ebp - 0x384], 1
jmp 0x10034dec
and dword [ebp - 0x384], 0
cmp dword [ebp - 0x384], 0x10b49f2b
jg 0x10034e04
mov dword [ebp - 0x49c], 1
jmp 0x10034e0b
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0xb0]
cmp ecx, dword [ebp + eax*4 - 0x574]
jg 0x10034e35
mov dword [ebp - 0x38c], 1
jmp 0x10034e3c
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0x574]
cmp eax, dword [ebp - 0x38c]
jne 0x10034e63
cmp dword [ebp - 0x1c], 0
jne 0x10034e63
cmp dword [ebp - 0x1c], 0
jne 0x10034e63
and dword [ebp - 0x444], 0
jmp 0x10034e6d
mov dword [ebp - 0x444], 1
mov eax, dword [ebp - 0x444]
neg eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp + ecx*4 - 0x574], eax
jmp 0x10034cb3
jmp 0x10034c7a
mov dword [ebp - 4], 0x26
cmp dword [ebp - 0x394], 0x3902
jge 0x10034ea8
push dword [ebp - 0x700]
call fcn.100520df
pop ecx
jmp 0x10034ec4
or dword [ebp - 4], 0xffffffff
jmp 0x10034ece
mov dword [ebp - 0x1c], 0
jmp 0x10034ede
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jg 0x10034f5b
mov dword [ebp - 0xb0], 3
jmp 0x10034efd
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jl 0x10034f56
mov dword [ebp - 0x18c], 0xffffffff
mov dword [ebp - 0x18c], 0
jmp 0x10034f29
mov eax, dword [ebp - 0x18c]
dec eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0
jl 0x10034f54
push 0x166f
push 0x7bd0
push 0
push 0x151f
push 0
push 0x37b7
call fcn.1002eff5
add esp, 0x18
jmp 0x10034f1c
jmp 0x10034ef0
jmp 0x10034ed7
jmp 0x10034b95
jmp 0x10034b74
push 4
push 0x1000
push dword [ebp - 0x24c]
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x644]
add ecx, dword [eax + 0xc]
push ecx
push 0x5301
push 0x6411
call fcn.10012c24
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x254]
mov dword [ecx], eax
mov dword [ebp - 0x74c], 0xa41449c9
mov dword [ebp - 0x64c], 0x93876a47
push 4
lea ecx, [ebp - 0x878]
call fcn.10013363
mov dword [ebp - 4], 0x28
mov dword [ebp - 0x654], 0xfffffff8
mov dword [ebp - 0x70c], 0x663c10b4
mov dword [ebp - 0x760], 1
push 0
push 0x87f
push 1
push 0x34ca
lea eax, [ebp - 0x878]
push eax
push 0xeb2
lea eax, [ebp - 0x8c0]
push eax
call fcn.1002f74d
add esp, 0x1c
mov byte [ebp - 0x98], 0
push 0x2039
push 0x5de9
push 1
lea eax, [ebp - 0x98]
push eax
push 0x787f
push 0
push 0x4275
call fcn.1001a701
add esp, 0x1c
lea eax, [ebp - 0x760]
push eax
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 0x70c]
push eax
push 0x7a1c
lea eax, [ebp - 0x654]
push eax
push 0x13ad
lea eax, [ebp - 0x878]
push eax
push 0x300b
push 1
lea eax, [ebp - 0x74c]
push eax
push 0
call fcn.10028a0f
add esp, 0x2c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.100133e5
push 2
lea ecx, [ebp - 0x890]
call fcn.10013363
mov dword [ebp - 4], 0x29
mov dword [ebp - 0x4cc], 0x68ce
mov dword [ebp - 0x660], 0x1000ab04
cmp dword [ebp - 0x4cc], 0x697c
jle 0x1003514e
and dword [ebp - 0x194], 0
jmp 0x100350dc
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0x7ccd
jge 0x1003513f
and dword [ebp - 0x19c], 0
jmp 0x100350fe
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0x32c4
jge 0x1003513d
mov eax, dword [ebp - 0x194]
mov ecx, dword [ebp - 0x19c]
sar eax, cl
cdq
mov dword [ebp - 0x6ec], eax
mov dword [ebp - 0x6e8], edx
push dword [ebp - 0x6e8]
push dword [ebp - 0x6ec]
mov ecx, 0x10611478
call fcn.10013138
jmp 0x100350f1
jmp 0x100350cf
push 0
push 0x1828
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
mov byte [ebp - 4], 0x2a
cmp dword [ebp - 0x4cc], 0x67e5
jge 0x1003516e
mov edx, dword [ebp - 0x660]
mov ecx, 0x10611478
call fcn.10015a5f
jmp 0x1003518a
mov dword [ebp - 4], 0x29
jmp 0x1003519a
push 0
push 0x5153
lea eax, [ebp - 0x9ec]
push eax
push 0x8fa
push 0x6dd9
push 0
push 0x3670
lea eax, [ebp - 0x890]
push eax
call fcn.10022fd0
add esp, 0x20
mov byte [ebp - 0x8a], 0
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x100351ff
push 0
push 0x48c9
push 0x73c
push 0x6b4
push 0xacd
push 0
push 0x1f05
call fcn.1002534e
add esp, 0x1c
push 1
lea ecx, [ebp - 0x890]
call fcn.10013401
mov dword [eax], 0xfffffff6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x890]
call fcn.100133e5
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xb8], 8
mov dword [ebp - 0x74], 8
mov dword [ebp - 0xdc], 0xfffffffd
mov dword [ebp - 0x1a4], 0x37f1
mov dword [ebp - 0x1ac], 2
mov dword [ebp - 0x584], 0x65522591
mov dword [ebp - 0x598], 0xffffffff
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x4c]
jne 0x10035286
mov dword [ebp - 0x44c], 1
jmp 0x1003528d
and dword [ebp - 0x44c], 0
cmp dword [ebp - 0x4c], 0
jl 0x1003529f
mov dword [ebp - 0x39c], 1
jmp 0x100352a6
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x39c]
add eax, 0x17be
jne 0x100352c2
cmp dword [ebp - 0x4c], 0
jne 0x100352c2
and dword [ebp - 0x3a4], 0
jmp 0x100352cc
mov dword [ebp - 0x3a4], 1
mov eax, dword [ebp - 0x44c]
add eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0x4c], eax
jne 0x100352e9
mov dword [ebp - 0x4a4], 1
jmp 0x100352f0
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x18]
je 0x10035316
mov dword [ebp - 0x290], 1
jmp 0x1003531d
and dword [ebp - 0x290], 0
cmp dword [ebp - 0x74], 0
jne 0x1003532f
mov dword [ebp - 0x3ac], 1
jmp 0x10035336
and dword [ebp - 0x3ac], 0
imul eax, dword [ebp - 0x3ac], 0x5498
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jne 0x10035367
cmp dword [ebp - 0xdc], 0
jne 0x10035367
cmp dword [ebp - 0x74], 0
jne 0x10035367
and dword [ebp - 0x454], 0
jmp 0x10035371
mov dword [ebp - 0x454], 1
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x454], eax
jl 0x10035388
mov dword [ebp - 0x3b4], 1
jmp 0x1003538f
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x3b4]
jge 0x100353a6
mov dword [ebp - 0x4e4], 1
jmp 0x100353ad
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x4e4], eax
jg 0x100353c7
mov dword [ebp - 0x714], 1
jmp 0x100353ce
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x8c8], eax
mov dword [ebp - 0x1ac], 1
cmp dword [ebp - 0x1ac], 0
je 0x100353f4
cmp dword [ebp - 0xb8], 0
cmp dword [ebp - 0xdc], 0x94592404
je 0x1003540c
mov dword [ebp - 0x278], 1
jmp 0x10035413
and dword [ebp - 0x278], 0
xor eax, eax
sub eax, dword [ebp - 0x278]
cmp eax, dword [ebp - 0xdc]
jne 0x1003542f
mov dword [ebp - 0x280], 1
jmp 0x10035436
and dword [ebp - 0x280], 0
cmp dword [ebp - 0x280], 0x172
jl 0x10035454
cmp dword [ebp - 0x74], 0
je 0x10035454
mov dword [ebp - 0x288], 1
jmp 0x1003545b
and dword [ebp - 0x288], 0
imul eax, dword [ebp - 0x288], 0xab0c
test eax, eax
jne 0x1003547b
cmp dword [ebp - 0x1a4], 0
jne 0x1003547b
and dword [ebp - 0x270], 0
jmp 0x10035485
mov dword [ebp - 0x270], 1
mov eax, dword [ebp - 0x290]
cmp eax, dword [ebp - 0x270]
jne 0x100354ea
mov dword [ebp - 0x4c], 0
jmp 0x100354a3
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x34
jl 0x100354e5
mov byte [ebp - 0x87], 0
movzx eax, byte [ebp - 0x87]
test eax, eax
je 0x100354d8
push 1
push 0
push 0x2654
push 1
push 0x2e36
push 0x7c4d
call fcn.100192ce
add esp, 0x18
push 1
push 0
call fcn.100196da
pop ecx
pop ecx
jmp 0x1003549c
jmp 0x1003591a
mov dword [ebp - 0x2a0], 0xd0c6
push 3
lea ecx, [ebp - 0x7a8]
call fcn.10013363
mov dword [ebp - 4], 0x2c
mov dword [ebp - 0x678], 6
or dword [ebp - 0x7ec], 0xffffffff
or dword [ebp - 0x7e8], 0xffffffff
or dword [ebp - 0x7e4], 0xffffffff
or dword [ebp - 0x7e0], 0xffffffff
lea ecx, [ebp - 0x235]
call fcn.10013410
push eax
lea eax, [ebp - 0x7dc]
push eax
lea eax, [ebp - 0x7ec]
push eax
lea ecx, [ebp - 0xa94]
call fcn.10013413
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x86c]
call fcn.100133bf
mov byte [ebp - 4], 0x2d
mov dword [ebp - 0xd4], 0
jmp 0x10035580
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 1
jge 0x10035599
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x34], 0xe33a
jmp 0x10035573
push 0x2c6f
lea eax, [ebp - 0xd4]
push eax
push 0x1e9
lea eax, [ebp - 0x7a8]
push eax
push 1
push 0
call fcn.1002d0be
add esp, 0x18
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x74]
add ecx, dword [ebp + eax - 0x34]
je 0x100355d8
mov dword [ebp - 0x66c], 1
jmp 0x100355df
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x974], eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x8d0], eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x18], 0
jmp 0x10035613
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x100358fc
mov dword [ebp - 0x588], 0x285618a3
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x34], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb8]
cmp ecx, dword [ebp + eax - 0x34]
jl 0x1003564d
mov dword [ebp - 0x2a8], 1
jmp 0x10035654
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x2a0]
cmp eax, dword [ebp - 0x2a8]
jne 0x1003566e
mov dword [ebp - 0x2b8], 1
jmp 0x10035675
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x34]
mov dword [ebp - 0x2b0], eax
push 0
lea ecx, [ebp - 0x7a8]
call fcn.10013401
mov ecx, dword [ebp - 0x2b0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x34]
sub eax, dword [ebp - 0x2b0]
cmp eax, dword [ebp - 0x2b8]
jg 0x100356b8
mov dword [ebp - 0x2c0], 1
jmp 0x100356bf
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x2c0], eax
jle 0x100356d9
mov dword [ebp - 0x2c8], 1
jmp 0x100356e0
and dword [ebp - 0x2c8], 0
cmp dword [ebp - 0x2c8], 9
jae 0x100356f5
mov dword [ebp - 0x2d0], 1
jmp 0x100356fc
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x34]
cmp dword [ebp - 0x2d0], eax
jge 0x10035717
mov dword [ebp - 0x768], 1
jmp 0x1003571e
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x34]
mov dword [ebp - 0x9f0], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x34]
neg eax
sub eax, dword [ebp - 0x678]
cmp eax, 0x2f0819d5
je 0x1003574d
mov dword [ebp - 0x2d8], 1
jmp 0x10035754
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x2d8]
sub eax, 0xb115
mov dword [ebp - 0x2e0], eax
push 1
lea ecx, [ebp - 0x86c]
call fcn.10013401
mov ecx, dword [ebp - 0x2e0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x34]
cmp eax, dword [ebp - 0x2e0]
jge 0x10035795
mov dword [ebp - 0x2e8], 1
jmp 0x1003579c
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x584]
cmp dword [ebp - 0x2e8], eax
jl 0x100357b6
mov dword [ebp - 0x2f0], 1
jmp 0x100357bd
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x34]
cmp dword [ebp - 0x2f0], eax
je 0x100357d8
mov dword [ebp - 0x2f8], 1
jmp 0x100357df
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x34], 0
je 0x100358cd
mov dword [ebp - 0x590], 5
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x588]
push eax
push 1
call fcn.10018cb2
add esp, 0x10
mov eax, dword [ebp - 0x590]
mov dword [ebp - 0x8d8], eax
cmp dword [ebp - 0x598], 0xb5db
jl 0x1003583e
mov dword [ebp - 0x308], 1
jmp 0x10035845
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp + eax*4 - 0x34]
mov edi, dword [ebp - 0xdc]
push 2
lea ecx, [ebp - 0x86c]
call fcn.10013401
imul edi, dword [eax]
cmp edi, esi
jge 0x10035872
mov dword [ebp - 0x300], 1
jmp 0x10035879
and dword [ebp - 0x300], 0
cmp dword [ebp - 0x300], 1
jg 0x1003588e
mov dword [ebp - 0x310], 1
jmp 0x10035895
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x308]
cmp eax, dword [ebp - 0x310]
jle 0x100358af
mov dword [ebp - 0x318], 1
jmp 0x100358b6
and dword [ebp - 0x318], 0
push 0
lea ecx, [ebp - 0x7a8]
call fcn.10013401
mov ecx, dword [ebp - 0x318]
mov dword [eax], ecx
jmp 0x100358f7
mov byte [ebp - 0x8c], 0
movzx eax, byte [ebp - 0x8c]
test eax, eax
je 0x100358f7
push 0
push 0
push 1
push 0x14eb
push 0x2cbb
call fcn.10037186
add esp, 0x14
jmp 0x1003560c
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x86c]
call fcn.100133e5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7a8]
call fcn.100133e5
mov dword [ebp - 0x984], 1
mov dword [ebp - 0x5c], 0x4801
mov dword [ebp - 0x360], 0x6e74a6e8
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x5c], 0xffffffea
jmp 0x1003594c
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x2f
jg 0x10035c12
mov dword [ebp - 0x7c], 0x2edc7555
mov dword [ebp - 0x3c], 0x283bc1b0
mov dword [ebp - 0x5a0], 0xffffffff
mov dword [ebp - 0x1b4], 0
jmp 0x10035987
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 4
jge 0x100359a3
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x7d8], 0xfffffffa
jmp 0x1003597a
mov dword [ebp - 0x7c], 0x19
jmp 0x100359b3
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xffffffe2
jle 0x10035c0d
mov dword [ebp - 0x1bc], 0xba75a592
mov dword [ebp - 0x398], 0xb5009892
cmp dword [ebp - 0x5c], 0
jne 0x100359e9
cmp dword [ebp - 0x1bc], 0
jne 0x100359e9
and dword [ebp - 0x328], 0
jmp 0x100359f3
mov dword [ebp - 0x328], 1
cmp dword [ebp - 0x1bc], 0xcf04
jg 0x10035a0b
mov dword [ebp - 0x320], 1
jmp 0x10035a12
and dword [ebp - 0x320], 0
cmp dword [ebp - 0x320], 0x6fe5
jl 0x10035a2a
mov dword [ebp - 0x330], 1
jmp 0x10035a31
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x7c]
imul eax, dword [ebp - 0x328]
add eax, dword [ebp - 0x330]
jne 0x10035a4f
mov dword [ebp - 0x338], 1
jmp 0x10035a56
and dword [ebp - 0x338], 0
cmp dword [ebp - 0x338], 2
jb 0x10035a6b
mov dword [ebp - 0x340], 1
jmp 0x10035a72
and dword [ebp - 0x340], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7d8]
cmp dword [ebp - 0x340], eax
jle 0x10035a92
mov dword [ebp - 0x348], 1
jmp 0x10035a99
and dword [ebp - 0x348], 0
cmp dword [ebp - 0x348], 0xffffffff
jbe 0x10035ab4
cmp dword [ebp - 0x1bc], 0
jne 0x10035ab4
and dword [ebp - 0x350], 0
jmp 0x10035abe
mov dword [ebp - 0x350], 1
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x7c]
je 0x10035adb
mov dword [ebp - 0x358], 1
jmp 0x10035ae2
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x5a0], eax
mov dword [ebp - 0x3c], 3
jmp 0x10035b0a
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x10035c08
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x7d8]
mov dword [ebp - 0x8e0], eax
mov eax, dword [ebp - 0x398]
cmp eax, dword [ebp - 0x1bc]
jle 0x10035b3e
mov dword [ebp - 0x368], 1
jmp 0x10035b45
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x368], eax
jge 0x10035b5c
mov dword [ebp - 0x370], 1
jmp 0x10035b63
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x370]
sub ecx, dword [ebp + eax*4 - 0x7d8]
cmp ecx, 0x12b9
jge 0x10035b87
mov dword [ebp - 0x378], 1
jmp 0x10035b8e
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x378], eax
jle 0x10035ba5
mov dword [ebp - 0x380], 1
jmp 0x10035bac
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x7d8]
add eax, dword [ebp - 0x380]
mov ecx, dword [ebp - 0x3c]
cmp dword [ebp + ecx*4 - 0x7d8], eax
jge 0x10035bd4
mov dword [ebp - 0x388], 1
jmp 0x10035bdb
and dword [ebp - 0x388], 0
cmp dword [ebp - 0x388], 1
jge 0x10035bf0
mov dword [ebp - 0x390], 1
jmp 0x10035bf7
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x398], eax
jmp 0x10035b03
jmp 0x100359ac
jmp 0x10035945
push 1
lea ecx, [ebp - 0x9d0]
call fcn.10013363
mov dword [ebp - 4], 0x2e
mov dword [ebp - 0x1c4], 0
jmp 0x10035c3f
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 4
jge 0x10035c5b
mov eax, dword [ebp - 0x1c4]
mov dword [ebp + eax*4 - 0x8ac], 0xc93b4e1
jmp 0x10035c32
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x8ac], 8
jmp 0x10035c86
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8ac]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x8ac], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x8ac], 1
jl 0x10035cbf
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x10035cbd
push 1
push 0x16c8
push 0
push 0x362a
call fcn.10019538
add esp, 0x10
jmp 0x10035c6d
mov dword [ebp - 0xa10], 0x963a
mov dword [ebp - 0xe4], 0x24a8c6a5
mov dword [ebp - 0x5b0], 0x198d72a6
mov dword [ebp - 0x5a8], 1
mov dword [ebp - 0x580], 8
mov dword [ebp - 0xe4], 0x17
jmp 0x10035d0a
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0xffffffea
jge 0x10035d9b
mov dword [ebp - 0x3a0], 0xa137
mov dword [ebp - 0x3a8], 0x2a1836cc
push 1
push 0x30b
push 0x6a53
push 1
push 0
lea eax, [ebp - 0x3a0]
push eax
push 0x479b
lea eax, [ebp - 0x3a8]
push eax
push 0x245a
call fcn.1001973c
add esp, 0x24
lea eax, [ebp - 0x5a8]
push eax
push 1
push 0
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x3a8]
push eax
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x5b0]
push eax
lea eax, [ebp - 0x580]
push eax
push 0x1bf6
call fcn.1002ebb7
add esp, 0x24
jmp 0x10035cfd
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x10035dca
push 1
push 1
push 0x4381
push 0
push 0x5d0f
push 0xb00
call fcn.100192ce
add esp, 0x18
mov dword [ebp - 0x3f0], 0x3d7f1912
mov dword [ebp - 0x3b0], 0x2877
mov dword [ebp - 0x5c0], 0x1000ab20
cmp dword [ebp - 0x3b0], 0x2b3c
jle 0x10035ed1
and dword [ebp - 0x1dc], 0
jmp 0x10035e0e
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0x11b3
jge 0x10035ed1
and dword [ebp - 0x1cc], 0
jmp 0x10035e34
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0xfcc
jge 0x10035ecc
and dword [ebp - 0x1d4], 0
jmp 0x10035e5a
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0x13b3
jge 0x10035ec7
and dword [ebp - 0x1e4], 0
jmp 0x10035e7c
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0x459c
jge 0x10035ec5
mov eax, dword [ebp - 0x1cc]
sub eax, dword [ebp - 0x1d4]
and eax, dword [ebp - 0x1dc]
or eax, dword [ebp - 0x1e4]
cdq
mov dword [ebp - 0x6f8], eax
mov dword [ebp - 0x6f4], edx
push dword [ebp - 0x6f4]
push dword [ebp - 0x6f8]
mov ecx, 0x10611478
call fcn.10013138
jmp 0x10035e6f
jmp 0x10035e4d
jmp 0x10035e27
jmp 0x10035e01
mov dword [ebp - 0x38], 1
mov byte [ebp - 4], 0x2f
cmp dword [ebp - 0x3b0], 0x27a0
jge 0x10035ef8
mov edx, dword [ebp - 0x5c0]
mov ecx, 0x10611478
call fcn.10015a5f
jmp 0x10035f14
mov dword [ebp - 4], 0x2e
jmp 0x10035f24
mov dword [ebp - 0x1ec], 0
jmp 0x10035f3d
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 4
jge 0x10035f59
mov eax, dword [ebp - 0x1ec]
mov dword [ebp + eax*4 - 0x50c], 0x4a53aa9a
jmp 0x10035f30
push 0x6f0e
push 0x5b9a
push 0x742
push 0x2f8
push 0x314b
push 0x62d4
push 0x7ed5
push 0x21ee
push 0x4d2f
push 0x1126
push 0
push 0x1e34
push 0x4d98
push 0x1d57
push 0x62da
push 0x1949
push 0x1520
push 1
push 0x108f
push 0x6541
push 0xf77
push 0x4bef
push 0x7a59
push 0x57c5
lea eax, [ebp - 0x38]
push eax
call fcn.10019906
add esp, 0x64
mov dword [ebp - 0x38], 0
jmp 0x10035fe7
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jg 0x10036262
mov dword [ebp - 0x23c], 0xa05d
push 3
lea ecx, [ebp - 0x884]
call fcn.10013363
mov byte [ebp - 4], 0x31
mov dword [ebp - 0xec], 0
jmp 0x10036025
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 1
jge 0x10036041
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x5d0], 0x6711db60
jmp 0x10036018
push 0x66a9
lea eax, [ebp - 0x884]
push eax
push 0
push 0x7aca
lea eax, [ebp - 0xec]
push eax
push 0x5123
push 0x5590
push 0x6532
push 0x3303
push 0
call fcn.10018dc3
add esp, 0x28
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp + ecx*4 - 0x50c]
cmp ecx, dword [ebp + eax*4 - 0x50c]
jl 0x1003609b
mov dword [ebp - 0x5c8], 1
jmp 0x100360a2
and dword [ebp - 0x5c8], 0
xor eax, eax
jne 0x100361a8
mov eax, dword [ebp - 0x38]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x50c]
add ecx, dword [ebp - 0x23c]
add ecx, dword [ebp + eax*4 - 0x50c]
je 0x100360de
mov eax, 0xd067
test eax, eax
je 0x100360de
mov dword [ebp - 0x26c], 1
jmp 0x100360e5
and dword [ebp - 0x26c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50c]
neg eax
cmp eax, dword [ebp - 0x26c]
jne 0x10036108
mov dword [ebp - 0x234], 1
jmp 0x1003610f
and dword [ebp - 0x234], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x234]
mov dword [ebp + eax - 0x5d0], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x50c]
cmp dword [ebp - 0x234], eax
jle 0x10036143
mov dword [ebp - 0x3c0], 1
jmp 0x1003614a
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x23c]
cmp dword [ebp - 0x3c0], eax
jne 0x10036164
mov dword [ebp - 0x3c8], 1
jmp 0x1003616b
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x3c8]
sub eax, 0xa9d8
cmp eax, 0xffffffff
ja 0x10036187
mov dword [ebp - 0x3d0], 1
jmp 0x1003618e
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x23c]
imul eax, dword [ebp - 0x3d0]
neg eax
jne 0x100361a8
and dword [ebp - 0x3d8], 0
jmp 0x100361b2
mov dword [ebp - 0x3d8], 1
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x3d8], eax
je 0x100361cc
cmp dword [ebp - 0x38], 0
jne 0x100361cc
and dword [ebp - 0x3e0], 0
jmp 0x100361d6
mov dword [ebp - 0x3e0], 1
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x50c]
imul eax, dword [ebp - 0x3e0]
test eax, eax
jne 0x10036203
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x50c], 0
jne 0x10036203
and dword [ebp - 0x3e8], 0
jmp 0x1003620d
mov dword [ebp - 0x3e8], 1
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x50c]
cmp dword [ebp - 0x3e8], eax
jne 0x1003622b
mov dword [ebp - 0x5d8], 1
jmp 0x10036232
and dword [ebp - 0x5d8], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x50c]
push 0
lea ecx, [ebp - 0x884]
call fcn.10013401
mov dword [eax], esi
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x884]
call fcn.100133e5
jmp 0x10035fe0
mov dword [ebp - 0x1f4], 0
jmp 0x1003627b
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 1
jge 0x1003629d
push dword [ebp - 0x1f4]
lea ecx, [ebp - 0x9d0]
call fcn.10013401
mov dword [eax], 0xb7c7ce53
jmp 0x1003626e
mov eax, dword [ebp - 0x3f0]
dec eax
mov dword [ebp - 0x3f0], eax
push 4
lea ecx, [ebp - 0x89c]
call fcn.10013363
mov byte [ebp - 4], 0x32
mov dword [ebp - 0x5e0], 1
lea eax, [ebp - 0x8e8]
push eax
push 0x10eb
lea eax, [ebp - 0x89c]
push eax
push 1
push 0x482e
push 0
push 0x6a29
call fcn.1001a7f2
add esp, 0x1c
push 0x2485
lea eax, [ebp - 0x89c]
push eax
push 0x380f
push 0x1234
push 0x6ccb
push 1
push 0x133e
push 0x980
push 0x2578
push 0
lea eax, [ebp - 0x5e0]
push eax
push 0x737d
push 0x2f22
push 0x4b12
push 0x1e87
call fcn.1002cc26
add esp, 0x3c
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x89c]
call fcn.100133e5
push 3
lea ecx, [ebp - 0xa8]
call fcn.10013363
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x68], 0xffffffff
mov dword [ebp - 0x84], 0xa6b2c4eb
mov dword [ebp - 0x994], 0x81c3
push 0
push 0x1e6d
lea eax, [ebp - 0x8f0]
push eax
push 0x4f3d
lea eax, [ebp - 0xa8]
push eax
push 0x7bc
push 0
push 1
call fcn.10037365
add esp, 0x20
mov dword [ebp - 0x14], 2
jmp 0x100363bc
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1003663e
mov dword [ebp - 0x5f0], 0xb5f7a0d7
mov dword [ebp - 0x5f8], 7
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa8]
call fcn.10013401
mov esi, eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa8]
call fcn.10013401
mov eax, dword [eax]
mov dword [esi], eax
mov eax, 0xfff7
test eax, eax
je 0x10036443
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa8]
call fcn.10013401
cmp dword [eax], 0xcd833989
ja 0x10036427
mov dword [ebp - 0x3f8], 1
jmp 0x1003642e
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x3f8]
dec eax
je 0x10036443
mov dword [ebp - 0x400], 1
jmp 0x1003644a
and dword [ebp - 0x400], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa8]
call fcn.10013401
mov ecx, dword [ebp - 0x400]
cmp ecx, dword [eax]
jne 0x1003646e
mov dword [ebp - 0x408], 1
jmp 0x10036475
and dword [ebp - 0x408], 0
mov esi, dword [ebp - 0x408]
neg esi
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa8]
call fcn.10013401
cmp esi, dword [eax]
jl 0x1003649b
mov dword [ebp - 0x410], 1
jmp 0x100364a2
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jne 0x100364bd
mov dword [ebp - 0x418], 1
jmp 0x100364c4
and dword [ebp - 0x418], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa8]
call fcn.10013401
mov esi, dword [ebp - 0x418]
sub esi, dword [eax]
push 2
lea ecx, [ebp - 0xa8]
call fcn.10013401
sub esi, dword [eax]
jne 0x100364f9
or eax, 0xffffffff
jne 0x100364f9
and dword [ebp - 0x420], 0
jmp 0x10036503
mov dword [ebp - 0x420], 1
cmp dword [ebp - 0x420], 0xd4a55f07
je 0x1003651b
mov dword [ebp - 0x428], 1
jmp 0x10036522
and dword [ebp - 0x428], 0
mov esi, dword [ebp - 0x428]
add esi, 0xa
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa8]
call fcn.10013401
cmp esi, dword [eax]
jge 0x10036549
mov dword [ebp - 0x430], 1
jmp 0x10036550
and dword [ebp - 0x430], 0
push 1
lea ecx, [ebp - 0xa8]
call fcn.10013401
mov ecx, dword [ebp - 0x430]
cmp ecx, dword [eax]
je 0x10036573
mov dword [ebp - 0x438], 1
jmp 0x1003657a
and dword [ebp - 0x438], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa8]
call fcn.10013401
mov ecx, dword [ebp - 0x438]
cmp ecx, dword [eax]
je 0x1003659e
mov dword [ebp - 0x440], 1
jmp 0x100365a5
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x100365c2
xor eax, eax
jne 0x100365c2
cmp dword [ebp - 0x14], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa8]
call fcn.10013401
cmp dword [eax], 0xffff
jne 0x100365e4
mov dword [ebp - 0x5e8], 1
jmp 0x100365eb
and dword [ebp - 0x5e8], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa8]
call fcn.10013401
mov esi, dword [ebp - 0x14]
push 2
lea ecx, [ebp - 0xa8]
call fcn.10013401
mov edi, dword [eax]
add edi, esi
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa8]
call fcn.10013401
add edi, dword [eax]
mov dword [ebp - 0x5f0], edi
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa8]
call fcn.10013401
mov eax, dword [eax]
mov dword [ebp - 0x5f8], eax
jmp 0x100363b5
mov dword [ebp - 0x84], 0
jmp 0x10036657
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jg 0x10036963
mov dword [ebp - 0x214], 0xde89c674
mov dword [ebp - 0x478], 0x2923
mov dword [ebp - 0x68], 2
jmp 0x10036688
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x100368ed
mov dword [ebp - 0x20c], 0xb108f980
mov dword [ebp - 0x1fc], 0
jmp 0x100366b5
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 4
jge 0x100366d1
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0xa6c], 0x5d3cc114
jmp 0x100366a8
mov dword [ebp - 0x14], 2
jmp 0x100366e1
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x100368b0
push 1
lea ecx, [ebp - 0x860]
call fcn.10013363
mov byte [ebp - 4], 0x34
mov dword [ebp - 0x600], 0x9ba600ac
mov dword [ebp - 0x204], 0
jmp 0x1003671f
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 1
jge 0x10036741
push dword [ebp - 0x204]
lea ecx, [ebp - 0x860]
call fcn.10013401
mov dword [eax], 2
jmp 0x10036712
mov byte [ebp - 0x8b], 0
movzx eax, byte [ebp - 0x8b]
test eax, eax
je 0x1003676e
push 0xb21
push 0x8d9
push 1
push 0x363c
push 0
call fcn.10027209
add esp, 0x14
mov dword [ebp - 0x20c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x20c]
cmp ecx, dword [ebp + eax - 0xa6c]
jg 0x100367ec
cmp dword [ebp - 0x20c], 0xdc1b
jge 0x100367a5
mov dword [ebp - 0x448], 1
jmp 0x100367ac
and dword [ebp - 0x448], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa8]
call fcn.10013401
mov ecx, dword [ebp - 0x448]
cmp ecx, dword [eax]
jge 0x100367d0
mov dword [ebp - 0x450], 1
jmp 0x100367d7
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x100367fe
cmp dword [ebp - 0x214], 0
jne 0x100367fe
and dword [ebp - 0x458], 0
jmp 0x10036808
mov dword [ebp - 0x458], 1
push 0
lea ecx, [ebp - 0x860]
call fcn.10013401
mov dword [eax], 0x95cc9e52
cmp dword [ebp - 0x458], 0x95cc9e52
jg 0x10036833
mov dword [ebp - 0x460], 1
jmp 0x1003683a
and dword [ebp - 0x460], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa8]
call fcn.10013401
mov eax, dword [eax]
cmp eax, dword [ebp - 0x460]
jle 0x1003685e
mov dword [ebp - 0x468], 1
jmp 0x10036865
and dword [ebp - 0x468], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa8]
call fcn.10013401
mov ecx, dword [ebp - 0x468]
cmp ecx, dword [eax]
jne 0x10036889
mov dword [ebp - 0x470], 1
jmp 0x10036890
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x600], eax
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x860]
call fcn.100133e5
jmp 0x100366da
push 0x749b
push 0x35ed
push 1
lea eax, [ebp - 0xa8]
push eax
push 0x751d
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
call fcn.10018dc3
add esp, 0x28
jmp 0x10036681
mov eax, dword [ebp - 0x478]
cmp eax, dword [ebp - 0x68]
jg 0x10036904
mov dword [ebp - 0x480], 1
jmp 0x1003690b
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x480]
add eax, 0xfffd
jmp 0x10036924
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x488]
sub eax, dword [ebp - 0x214]
jne 0x1003694b
cmp dword [ebp - 0x84], 0
jne 0x1003694b
and dword [ebp - 0x490], 0
jmp 0x10036955
mov dword [ebp - 0x490], 1
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x14], eax
jmp 0x1003664a
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0xa8]
call fcn.100133e5
mov byte [ebp - 0x6d], 0
movzx eax, byte [ebp - 0x6d]
test eax, eax
je 0x10036c13
mov dword [ebp - 0x20], 0xa41449c9
mov dword [ebp - 0x244], 0x93876a47
push 4
lea ecx, [ebp - 0x568]
call fcn.10013363
mov byte [ebp - 4], 0x35
mov dword [ebp - 0x224], 0xfffffff8
mov dword [ebp - 0x4d0], 0x663c10b4
mov dword [ebp - 0x610], 1
mov dword [ebp - 0x21c], 0
jmp 0x100369db
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 4
jge 0x100369fd
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x568]
call fcn.10013401
mov dword [eax], 0xfffffff8
jmp 0x100369ce
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x10036a2f
push 0x66bb
push 0
push 1
push 0x531
push 0xbb9
push 0x1d45
call fcn.1002406e
add esp, 0x18
cmp dword [ebp - 0x20], 0
je 0x10036bb4
xor esi, esi
inc esi
sub esi, dword [ebp - 0x20]
push 0
lea ecx, [ebp - 0x568]
call fcn.10013401
mov dword [eax], esi
push 3
lea ecx, [ebp - 0x568]
call fcn.10013401
cmp dword [eax], 0
jne 0x10036a7b
push 0
lea ecx, [ebp - 0x568]
call fcn.10013401
cmp dword [eax], 0
jne 0x10036a7b
and dword [ebp - 0x498], 0
jmp 0x10036a85
mov dword [ebp - 0x498], 1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x9f8], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x8f8], eax
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0x224]
imul eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jg 0x10036ad6
mov dword [ebp - 0x608], 1
jmp 0x10036add
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x900], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xa2c], eax
mov eax, dword [ebp - 0x224]
cmp eax, dword [ebp - 0x20]
je 0x10036b06
mov dword [ebp - 0x4a0], 1
jmp 0x10036b0d
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x4a0]
neg eax
cmp eax, 0xd88101ae
jne 0x10036b2c
mov dword [ebp - 0x4a8], 1
jmp 0x10036b33
and dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x4a8], 0xfffffffd
jae 0x10036b49
push 0
lea ecx, [ebp - 0x568]
call fcn.10013401
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x908], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x9b4], eax
mov eax, 0xa4a2
test eax, eax
je 0x10036b78
xor eax, eax
inc eax
je 0x10036b78
mov dword [ebp - 0x4b0], 1
jmp 0x10036b7f
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x4b0], eax
je 0x10036b96
mov dword [ebp - 0x4b8], 1
jmp 0x10036b9d
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x4b8]
sub eax, 6
je 0x10036bb4
mov dword [ebp - 0x4c0], 1
jmp 0x10036bbb
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x4c0], eax
jg 0x10036bd2
mov dword [ebp - 0x4c8], 1
jmp 0x10036bd9
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x4d0]
shl eax, 1
sub eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x610], eax
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x568]
call fcn.100133e5
push 0
push 0
call fcn.10019f6f
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9d0]
call fcn.100133e5
push 3
lea ecx, [ebp - 0x9e0]
call fcn.10013363
mov dword [ebp - 4], 0x36
mov dword [ebp - 0x200], 1
push 0
lea eax, [ebp - 0x910]
push eax
push 0
lea eax, [ebp - 0x9e0]
push eax
call fcn.1002e4ae
add esp, 0x10
mov dword [ebp - 0x200], 0
jmp 0x10036c73
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 2
jg 0x10036ccf
mov byte [ebp - 0x9a], 0
movzx eax, byte [ebp - 0x9a]
test eax, eax
je 0x10036c96
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov byte [ebp - 0x86], 0
movzx eax, byte [ebp - 0x86]
test eax, eax
je 0x10036ccd
push 0x75d9
push 1
push 0x5950
push 1
push 0x60e9
push 0x87c
push 0x28ac
call fcn.10018d47
add esp, 0x1c
jmp 0x10036c66
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e0]
call fcn.100133e5
mov eax, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x254]
mov ecx, dword [ecx]
mov dword [eax + 8], ecx
push dword [ebp - 0x24c]
push 0
mov eax, dword [ebp - 0x254]
push dword [eax]
call fcn.10012f2c
add esp, 0xc
mov dword [ebp - 4], 0x37
cmp dword [ebp - 0x4e0], 0x48b9
jge 0x10036d26
push dword [ebp - 0x618]
call fcn.100520df
pop ecx
jmp 0x10036d42
or dword [ebp - 4], 0xffffffff
jmp 0x10036d4c
jmp 0x10036da3
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x630], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x638], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x628], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x620], eax
push 0x11c3
push 0x2e44
push 0x1165
push 0
push dword [ebp - 0x620]
push dword [ebp - 0x628]
push dword [ebp - 0x630]
push dword [ebp - 0x638]
call fcn.10031b2c
add esp, 0x20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret