Function at 0x1001d5ae
Capabilities:
Contain obfuscated stackstrings
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008b53d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xfdc
push esi
push 1
lea ecx, [ebp - 0xcac]
call fcn.1001737a
and dword [ebp - 4], 0
mov dword [ebp - 0xaec], 1
mov dword [ebp - 0xa0c], 0xa1fa147b
mov dword [ebp - 0xadc], 8
mov dword [ebp - 0xef4], 0xffffffff
mov dword [ebp - 0xae4], 0xffffffff
mov dword [ebp - 0x274], 0
jmp 0x1001d629
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 1
jge 0x1001d64b
push dword [ebp - 0x274]
lea ecx, [ebp - 0xcac]
call fcn.10017408
mov dword [eax], 1
jmp 0x1001d61c
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x1001d66b
push 1
push 0x2a7e
call fcn.1001bb69
pop ecx
pop ecx
lea eax, [ebp - 0xcac]
push eax
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0xadc]
push eax
push 0x63df
push 0
lea eax, [ebp - 0xae4]
push eax
lea eax, [ebp - 0xaec]
push eax
call fcn.1001cf1f
add esp, 0x1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcac]
call fcn.10017403
mov dword [ebp - 0x84], 6
mov dword [ebp - 0xe44], 0x47a6deec
mov dword [ebp - 0xd70], 0xd72276b8
mov dword [ebp - 0xd78], 0xfffffffc
mov dword [ebp - 0xd80], 0x9a57b5bf
mov dword [ebp - 0xd88], 0xce4a6f44
mov dword [ebp - 0xd90], 0xffffffff
mov dword [ebp - 0xaf4], 0xa7b445ac
mov dword [ebp - 0x84], 0x18
jmp 0x1001d715
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xffffffef
je 0x1001d758
mov byte [ebp - 0xb7], 0
movzx eax, byte [ebp - 0xb7]
test eax, eax
je 0x1001d73e
push 0
push 0x512e
call fcn.1001c30a
pop ecx
pop ecx
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x1001d756
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp 0x1001d708
mov dword [ebp - 0x84], 0
jmp 0x1001d771
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 8
jg 0x1001d7f9
mov dword [ebp - 0xd98], 0xffffffff
mov dword [ebp - 0xda0], 1
mov dword [ebp - 0xda8], 0x47c4d145
mov dword [ebp - 0xdb0], 0xfffffffa
mov dword [ebp - 0xdb8], 0xa53061ec
mov dword [ebp - 0xdc0], 0xfffffffe
mov dword [ebp - 0xdc8], 6
mov dword [ebp - 0xdd0], 0xe75cb554
push 0
push 0x13fa
lea eax, [ebp - 0xaf4]
push eax
call fcn.1001c2c1
add esp, 0xc
push 0x3c2c
push 1
push 0x1bc
call fcn.1001bbcc
add esp, 0xc
jmp 0x1001d764
mov eax, dword [0x1067df20]
and eax, 1
jne 0x1001d830
mov eax, dword [0x1067df20]
or eax, 1
mov dword [0x1067df20], eax
mov dword [ebp - 4], 1
mov ecx, 0x1067ded8
call fcn.10017518
push 0x1008d5de
call fcn.100719c6
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x50], 0x1f665683
mov dword [ebp - 0x68], 0x64ba8b35
mov dword [ebp - 0x7d8], 0xfffffffe
mov dword [ebp - 0xb0c], 0xf7828e97
mov dword [ebp - 0x27c], 0
jmp 0x1001d86b
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 3
jge 0x1001d887
mov eax, dword [ebp - 0x27c]
mov dword [ebp + eax*4 - 0x9d0], 0x16e2c9bf
jmp 0x1001d85e
cmp dword [ebp - 0x50], 0
jne 0x1001d9e6
xor eax, eax
inc eax
sub eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x50]
jl 0x1001d8a8
mov dword [ebp - 0x4f8], 1
jmp 0x1001d8af
and dword [ebp - 0x4f8], 0
cmp dword [ebp - 0x4f8], 1
jne 0x1001d8c4
mov dword [ebp - 0x918], 1
jmp 0x1001d8cb
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x918], eax
jne 0x1001d8e2
mov dword [ebp - 0x920], 1
jmp 0x1001d8e9
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x920]
jle 0x1001d906
mov dword [ebp - 0x928], 1
jmp 0x1001d90d
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x928], eax
jle 0x1001d924
mov dword [ebp - 0x930], 1
jmp 0x1001d92b
and dword [ebp - 0x930], 0
cmp dword [ebp - 0x930], 0
jge 0x1001d940
mov dword [ebp - 0x938], 1
jmp 0x1001d947
and dword [ebp - 0x938], 0
cmp dword [ebp - 0x938], 8
jl 0x1001d95c
mov dword [ebp - 0x940], 1
jmp 0x1001d963
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x940]
sub eax, 0x6e090b64
jne 0x1001d97f
cmp dword [ebp - 0x68], 0
jne 0x1001d97f
and dword [ebp - 0xafc], 0
jmp 0x1001d989
mov dword [ebp - 0xafc], 1
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
jg 0x1001d99a
mov eax, 0x8551b32e
test eax, eax
jne 0x1001d9ac
mov eax, 0x595a
test eax, eax
jne 0x1001d9ac
and dword [ebp - 0x948], 0
jmp 0x1001d9b6
mov dword [ebp - 0x948], 1
cmp dword [ebp - 0x948], 1
jge 0x1001d9cb
mov dword [ebp - 0x9a4], 1
jmp 0x1001d9d2
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x9a4], eax
jl 0x1001d9e6
and dword [ebp - 0x9ac], 0
jmp 0x1001d9f0
mov dword [ebp - 0x9ac], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9ac]
sub ecx, dword [ebp + eax - 0x9d0]
je 0x1001dbb7
mov dword [ebp - 0x284], 0xd55a
mov dword [ebp - 0x68], 0
jmp 0x1001da23
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x1001da45
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x1001da43
push 1
call fcn.1001bc44
pop ecx
jmp 0x1001da1c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9d0], 5
jne 0x1001da61
mov dword [ebp - 0x3b0], 1
jmp 0x1001da68
and dword [ebp - 0x3b0], 0
cmp dword [ebp - 0x284], 0
jne 0x1001db20
cmp dword [ebp - 0x284], 0
jne 0x1001dacd
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x9d0]
cmp dword [ebp + eax - 0x9d0], ecx
jge 0x1001dab7
xor eax, eax
jne 0x1001dab7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9d0], 0
jne 0x1001dab7
and dword [ebp - 0x998], 0
jmp 0x1001dac1
mov dword [ebp - 0x998], 1
cmp dword [ebp - 0x998], 0xa274
jle 0x1001dae2
mov eax, 0x1363
test eax, eax
je 0x1001dae2
mov dword [ebp - 0x87c], 1
jmp 0x1001dae9
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x7d8], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x7d8], eax
jge 0x1001db0c
mov dword [ebp - 0xb04], 1
jmp 0x1001db13
and dword [ebp - 0xb04], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x9d0], 0
xor eax, eax
jne 0x1001db36
cmp dword [ebp - 0x284], 0
jne 0x1001db36
and dword [ebp - 0x7e0], 0
jmp 0x1001db40
mov dword [ebp - 0x7e0], 1
mov eax, dword [ebp - 0x3b0]
neg eax
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x7e0]
jl 0x1001db62
mov dword [ebp - 0x3b8], 1
jmp 0x1001db69
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x284]
cmp dword [ebp - 0x3b8], eax
jl 0x1001db83
mov dword [ebp - 0x7e8], 1
jmp 0x1001db8a
and dword [ebp - 0x7e8], 0
cmp dword [ebp - 0x7e8], 0x402a
jle 0x1001dba2
mov dword [ebp - 0x3c0], 1
jmp 0x1001dba9
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0xb0c], eax
jmp 0x1001dbd1
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x1001dbd1
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push 0x3a34
push 0
call fcn.1001cbbd
pop ecx
pop ecx
push dword [ebp + 8]
lea ecx, [ebp - 0xd18]
call fcn.1001712f
mov dword [ebp - 4], 2
lea eax, [ebp - 0xdd8]
push eax
lea ecx, [ebp - 0xd18]
call fcn.10017926
push dword [eax]
lea eax, [ebp - 0xde0]
push eax
lea ecx, [ebp - 0xd18]
call fcn.1001793a
push dword [eax]
lea eax, [ebp - 0xde8]
push eax
lea ecx, [ebp - 0xd18]
call fcn.10017926
push dword [eax]
mov edx, 0x100192d1
lea ecx, [ebp - 0xdf0]
call fcn.10026644
add esp, 0xc
mov dword [ebp - 0x30c], 0x4e6d4f28
mov dword [ebp - 0x308], 0x4e6d4f28
mov dword [ebp - 0x304], 0x4e6d4f28
mov dword [ebp - 0x300], 0x4e6d4f28
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x310], 5
mov dword [ebp - 0x810], 0xe2095e04
mov dword [ebp - 0x3d8], 0xddbc75b1
mov dword [ebp - 0x3f0], 0x3f0bde8a
mov dword [ebp - 0xb14], 0xe17c927d
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x30c], 0
jne 0x1001dd0e
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x30c], 0
jle 0x1001dcdb
mov dword [ebp - 0x7f0], 1
jmp 0x1001dce2
and dword [ebp - 0x7f0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x30c]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x30c]
imul ecx, dword [ebp - 0x7f0]
push 4
pop edx
shl edx, 1
imul ecx, dword [ebp + edx - 0x30c]
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x30c]
push 4
pop edx
shl edx, 1
sub ecx, dword [ebp + edx - 0x30c]
cmp dword [ebp + eax - 0x30c], ecx
jg 0x1001dd40
mov dword [ebp - 0x3c8], 1
jmp 0x1001dd47
and dword [ebp - 0x3c8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x30c]
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x1fc]
cmp eax, dword [ebp - 0x3c8]
je 0x1001dd73
mov dword [ebp - 0x7f8], 1
jmp 0x1001dd7a
and dword [ebp - 0x7f8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x30c]
cmp dword [ebp - 0x7f8], eax
jl 0x1001dd9a
mov dword [ebp - 0x3d0], 1
jmp 0x1001dda1
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
push 4
pop eax
shl eax, 1
imul eax, dword [ebp + eax - 0x30c], 0
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0xdf8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x30c], 0x705e8c87
jg 0x1001ddf1
mov dword [ebp - 0x800], 1
jmp 0x1001ddf8
and dword [ebp - 0x800], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x30c]
add eax, dword [ebp - 0x800]
jne 0x1001de15
cmp dword [ebp - 0x3d8], 0
je 0x1001de2a
cmp dword [ebp - 0x3d8], 0
je 0x1001de2a
mov dword [ebp - 0x808], 1
jmp 0x1001de31
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0x808]
dec eax
cmp eax, 0xfffffffd
jge 0x1001de49
mov dword [ebp - 0x3e0], 1
jmp 0x1001de50
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x3e0], eax
jg 0x1001de6a
mov dword [ebp - 0x3e8], 1
jmp 0x1001de71
and dword [ebp - 0x3e8], 0
mov dword [ebp - 0x1fc], 0xa012
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x810], eax
mov eax, dword [ebp - 0x810]
cmp eax, dword [ebp - 0x3e8]
jle 0x1001dea1
mov dword [ebp - 0x818], 1
jmp 0x1001dea8
and dword [ebp - 0x818], 0
mov dword [ebp - 0x310], 0xffffffff
mov eax, dword [ebp - 0x310]
mov ecx, dword [ebp - 0x178]
imul ecx, dword [ebp - 0x818]
imul eax, ecx
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0xb14], eax
lea ecx, [ebp - 0xd18]
call fcn.1001925c
mov dword [ebp - 0x4bc], eax
mov dword [ebp - 0x44], 0xd4e7937
mov dword [ebp - 0xbc], 0xbc588e1b
push 1
lea ecx, [ebp - 0x958]
call fcn.1001737a
mov byte [ebp - 4], 3
mov dword [ebp - 0xb3c], 0xa4ec
mov dword [ebp - 0xe00], 8
lea eax, [ebp - 0x958]
push eax
push 0x345
lea eax, [ebp - 0xe08]
push eax
push 1
push 0x43d1
call fcn.1001bc7c
add esp, 0x14
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xe10], eax
push 0
lea ecx, [ebp - 0x958]
call fcn.10017408
cmp dword [eax], 0x8dc2a82a
jb 0x1001df70
mov dword [ebp - 0xb1c], 1
jmp 0x1001df77
and dword [ebp - 0xb1c], 0
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xe18], eax
push 0
lea ecx, [ebp - 0x958]
call fcn.10017408
push 0
lea ecx, [ebp - 0x958]
call fcn.10017408
mov esi, eax
push 0
lea ecx, [ebp - 0x958]
call fcn.10017408
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x1001dfca
mov dword [ebp - 0x820], 1
jmp 0x1001dfd1
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x820]
cmp eax, 1
jl 0x1001e235
push 3
lea ecx, [ebp - 0x394]
call fcn.1001737a
mov byte [ebp - 4], 4
mov dword [ebp - 0x1c8], 0
jmp 0x1001e014
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
jge 0x1001e036
push dword [ebp - 0x1c8]
lea ecx, [ebp - 0x394]
call fcn.10017408
mov dword [eax], 1
jmp 0x1001e007
mov dword [ebp - 0x44], 0x14
jmp 0x1001e046
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x3b
jg 0x1001e20a
mov dword [ebp - 0x3f8], 1
mov dword [ebp - 0xb24], 0xf0ed6937
mov dword [ebp - 0xb2c], 0x1300d3b5
mov byte [ebp - 0xab], 0
movzx eax, byte [ebp - 0xab]
test eax, eax
je 0x1001e08e
push 0
push 0x5f3a
call fcn.1001c691
pop ecx
pop ecx
cmp dword [ebp - 0x44], 0
jne 0x1001e0fd
push 1
lea ecx, [ebp - 0x394]
call fcn.10017408
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0xe20], eax
push 1
lea ecx, [ebp - 0x394]
call fcn.10017408
cmp dword [eax], 0
jne 0x1001e0d3
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x3f8]
jne 0x1001e0d3
and dword [ebp - 0x828], 0
jmp 0x1001e0dd
mov dword [ebp - 0x828], 1
push 1
lea ecx, [ebp - 0x394]
call fcn.10017408
mov ecx, dword [ebp - 0x828]
cmp ecx, dword [eax]
jne 0x1001e0fd
and dword [ebp - 0x400], 0
jmp 0x1001e107
mov dword [ebp - 0x400], 1
push 0
lea ecx, [ebp - 0x958]
call fcn.10017408
mov ecx, dword [ebp - 0x400]
cmp ecx, dword [eax]
jle 0x1001e130
mov eax, 0xd47030fc
test eax, eax
jne 0x1001e130
and dword [ebp - 0x830], 0
jmp 0x1001e13a
mov dword [ebp - 0x830], 1
push 1
lea ecx, [ebp - 0x394]
call fcn.10017408
mov ecx, dword [ebp - 0x830]
cmp ecx, dword [eax]
jl 0x1001e15d
mov dword [ebp - 0x408], 1
jmp 0x1001e164
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0xb24], eax
push 1
lea ecx, [ebp - 0x394]
call fcn.10017408
mov esi, eax
push 2
lea ecx, [ebp - 0x394]
call fcn.10017408
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x1001e19e
mov dword [ebp - 0x838], 1
jmp 0x1001e1a5
and dword [ebp - 0x838], 0
push 0
lea ecx, [ebp - 0x394]
call fcn.10017408
mov ecx, dword [ebp - 0x838]
cmp ecx, dword [eax]
jle 0x1001e1c8
mov dword [ebp - 0x410], 1
jmp 0x1001e1cf
and dword [ebp - 0x410], 0
push 1
lea ecx, [ebp - 0x394]
call fcn.10017408
mov ecx, dword [ebp - 0x410]
cmp ecx, dword [eax]
je 0x1001e1f2
mov dword [ebp - 0x840], 1
jmp 0x1001e1f9
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x840]
mov dword [ebp - 0xb2c], eax
jmp 0x1001e03f
mov byte [ebp - 0xac], 0
push 0
lea eax, [ebp - 0xac]
push eax
call fcn.1001cd9c
pop ecx
pop ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x394]
call fcn.10017403
jmp 0x1001e2fd
mov dword [ebp - 0x244], 0
jmp 0x1001e24e
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 1
jge 0x1001e26a
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0x1d0], 0xfffffff6
jmp 0x1001e241
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d0]
mov dword [ebp - 0xe28], eax
push 0
lea ecx, [ebp - 0x958]
call fcn.10017408
cmp dword [eax], 0
jne 0x1001e2c3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d0]
add eax, dword [ebp - 0xbc]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xe30], eax
cmp dword [ebp - 0x44], 0
jne 0x1001e2c3
and dword [ebp - 0xb34], 0
jmp 0x1001e2cd
mov dword [ebp - 0xb34], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d0]
mov dword [ebp - 0xe38], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d0]
mov dword [ebp - 0xe40], eax
mov dword [ebp - 0xb3c], 0xfffffffe
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x958]
call fcn.10017403
movzx eax, byte [0x1067ddc9]
test eax, eax
je 0x1001ea02
mov ecx, 0x1067ded8
call fcn.10026325
movzx eax, al
test eax, eax
jne 0x1001ea02
push 2
lea ecx, [ebp - 0xcd0]
call fcn.1001737a
mov byte [ebp - 4], 5
push 2
lea ecx, [ebp - 0xcdc]
call fcn.1001737a
mov byte [ebp - 4], 6
mov dword [ebp - 0x24c], 0xb03629aa
mov dword [ebp - 0x80], 0
jmp 0x1001e36c
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x1001e388
push dword [ebp - 0x80]
lea ecx, [ebp - 0xcd0]
call fcn.10017408
mov dword [eax], 1
jmp 0x1001e365
mov dword [ebp - 0x80], 0
jmp 0x1001e398
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x1001e3b4
push dword [ebp - 0x80]
lea ecx, [ebp - 0xcdc]
call fcn.10017408
mov dword [eax], 0x8a137b18
jmp 0x1001e391
push 0
lea ecx, [ebp - 0xcd0]
call fcn.10017408
mov dword [eax], 0xc6a53d06
push 0
lea ecx, [ebp - 0xcdc]
call fcn.10017408
mov dword [eax], 0xc6a53d06
mov dword [ebp - 0x24c], 1
jmp 0x1001e3f3
mov eax, dword [ebp - 0x24c]
dec eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jl 0x1001e412
mov dword [ebp - 0xb44], 1
mov dword [ebp - 0xb44], 0x3ee32743
jmp 0x1001e3e6
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xcdc]
call fcn.10017403
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xcd0]
call fcn.10017403
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0x478]
push eax
mov ecx, 0x1067ded8
call fcn.100174f0
push 4
lea ecx, [ebp - 0x188]
call fcn.1001737a
mov byte [ebp - 4], 7
push 1
lea ecx, [ebp - 0xc04]
call fcn.1001737a
mov byte [ebp - 4], 8
mov dword [ebp - 0x33c], 0xffffffff
mov dword [ebp - 0x138], 9
push 0
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x188]
push eax
push 0x779e
push 0x3612
call fcn.1001c3b5
add esp, 0x14
mov dword [ebp - 0x4c], 0
jmp 0x1001e4ad
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1001e4c9
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xc04]
call fcn.10017408
mov dword [eax], 0xff93f8de
jmp 0x1001e4a6
mov dword [ebp - 0x4c], 0
jmp 0x1001e4d9
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1001e4ef
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x8a0], 0x84ca67b1
jmp 0x1001e4d2
push 1
lea ecx, [ebp - 0x188]
call fcn.10017408
push 1
lea ecx, [ebp - 0x188]
call fcn.10017408
mov esi, eax
push 1
lea ecx, [ebp - 0x188]
call fcn.10017408
mov eax, dword [eax]
add eax, 0xfff6
cmp dword [esi], eax
je 0x1001e52f
mov dword [ebp - 0x418], 1
jmp 0x1001e536
and dword [ebp - 0x418], 0
cmp dword [ebp - 0x418], 1
jbe 0x1001e554
mov eax, 0x77a1
test eax, eax
je 0x1001e554
mov dword [ebp - 0x848], 1
jmp 0x1001e55b
and dword [ebp - 0x848], 0
push 1
lea ecx, [ebp - 0x188]
call fcn.10017408
mov ecx, dword [ebp - 0x848]
cmp ecx, dword [eax]
jle 0x1001e58d
push 1
lea ecx, [ebp - 0x188]
call fcn.10017408
cmp dword [eax], 0
jne 0x1001e58d
and dword [ebp - 0x420], 0
jmp 0x1001e597
mov dword [ebp - 0x420], 1
push 1
lea ecx, [ebp - 0x188]
call fcn.10017408
mov eax, dword [eax]
cmp eax, dword [ebp - 0x420]
jge 0x1001e5ba
mov dword [ebp - 0x850], 1
jmp 0x1001e5c1
and dword [ebp - 0x850], 0
push 1
lea ecx, [ebp - 0x188]
call fcn.10017408
mov eax, dword [eax]
cmp eax, dword [ebp - 0x850]
jl 0x1001e5e4
mov dword [ebp - 0x428], 1
jmp 0x1001e5eb
and dword [ebp - 0x428], 0
push 1
lea ecx, [ebp - 0x188]
call fcn.10017408
mov ecx, dword [ebp - 0x428]
cmp ecx, dword [eax]
jl 0x1001e60e
mov dword [ebp - 0x858], 1
jmp 0x1001e615
and dword [ebp - 0x858], 0
push 1
lea ecx, [ebp - 0x188]
call fcn.10017408
mov ecx, dword [ebp - 0x858]
cmp ecx, dword [eax]
jge 0x1001e957
mov dword [ebp - 0xc4], 0xffff
mov dword [ebp - 0x1d8], 0
push 1
lea ecx, [ebp - 0x188]
call fcn.10017408
mov ecx, dword [ebp - 0xc4]
cmp dword [eax], ecx
jne 0x1001e667
mov dword [ebp - 0x430], 1
jmp 0x1001e66e
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x430], eax
jl 0x1001e688
mov dword [ebp - 0x334], 1
jmp 0x1001e68f
and dword [ebp - 0x334], 0
push 0
lea ecx, [ebp - 0xc04]
call fcn.10017408
mov ecx, dword [ebp - 0x334]
mov dword [eax], ecx
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0
jne 0x1001e6d4
push 0
lea ecx, [ebp - 0xc04]
call fcn.10017408
cmp dword [eax], 0
jne 0x1001e6d4
and dword [ebp - 0x860], 0
jmp 0x1001e6de
mov dword [ebp - 0x860], 1
cmp dword [ebp - 0x860], 0xc3f121f2
jbe 0x1001e6f6
mov dword [ebp - 0x438], 1
jmp 0x1001e6fd
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x438], eax
jne 0x1001e717
mov dword [ebp - 0x868], 1
jmp 0x1001e71e
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0x1d8]
add eax, dword [ebp - 0x868]
cmp eax, dword [ebp - 0x1d8]
jle 0x1001e73e
mov dword [ebp - 0x440], 1
jmp 0x1001e745
and dword [ebp - 0x440], 0
cmp dword [ebp - 0x440], 0xffffffff
je 0x1001e767
push 0xfffffffffffffffe
pop eax
test eax, eax
jne 0x1001e767
cmp dword [ebp - 0x33c], 0
jne 0x1001e767
and dword [ebp - 0x870], 0
jmp 0x1001e771
mov dword [ebp - 0x870], 1
push 0
lea ecx, [ebp - 0x188]
call fcn.10017408
mov ecx, dword [ebp - 0x870]
cmp ecx, dword [eax]
je 0x1001e794
mov dword [ebp - 0x448], 1
jmp 0x1001e79b
and dword [ebp - 0x448], 0
cmp dword [ebp - 0x448], 1
ja 0x1001e7b0
mov dword [ebp - 0x878], 1
jmp 0x1001e7b7
and dword [ebp - 0x878], 0
push 1
lea ecx, [ebp - 0x188]
call fcn.10017408
mov ecx, dword [ebp - 0x878]
cmp ecx, dword [eax]
jge 0x1001e7da
mov dword [ebp - 0x450], 1
jmp 0x1001e7e1
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x1d8]
sub eax, dword [ebp - 0x138]
cmp eax, 0x19f88dd0
jge 0x1001e80c
mov dword [ebp - 0x880], 1
jmp 0x1001e813
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x880]
lea eax, [ecx + eax - 0x65d6]
add eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0xc4]
jle 0x1001e840
mov dword [ebp - 0x458], 1
jmp 0x1001e847
and dword [ebp - 0x458], 0
push 2
lea ecx, [ebp - 0x188]
call fcn.10017408
imul ecx, dword [ebp - 0x458], 0x7dfe
cmp dword [eax], ecx
jl 0x1001e86e
mov dword [ebp - 0x888], 1
jmp 0x1001e875
and dword [ebp - 0x888], 0
push 3
lea ecx, [ebp - 0x188]
call fcn.10017408
mov ecx, dword [ebp - 0x888]
cmp ecx, dword [eax]
jg 0x1001e898
mov dword [ebp - 0x460], 1
jmp 0x1001e89f
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x460]
jle 0x1001e8b9
mov dword [ebp - 0x890], 1
jmp 0x1001e8c0
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x1d8]
add eax, dword [ebp - 0x890]
jmp 0x1001e8da
and dword [ebp - 0x468], 0
push 1
lea ecx, [ebp - 0x188]
call fcn.10017408
mov eax, dword [eax]
cmp eax, dword [ebp - 0x468]
jle 0x1001e904
mov dword [ebp - 0x898], 1
jmp 0x1001e90b
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0x898]
inc eax
cmp eax, 3
jne 0x1001e923
mov dword [ebp - 0x470], 1
jmp 0x1001e92a
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x470]
neg eax
add eax, 0xffff
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x8a0], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x8a0], 0
jmp 0x1001e992
mov dword [ebp - 0x138], 3
jmp 0x1001e970
mov eax, dword [ebp - 0x138]
dec eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jl 0x1001e992
mov byte [ebp - 0xae], 0
lea eax, [ebp - 0xae]
push eax
push 1
call fcn.1001bed0
pop ecx
pop ecx
jmp 0x1001e963
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xc04]
call fcn.10017403
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x188]
call fcn.10017403
lea eax, [ebp - 0xe48]
push eax
mov ecx, 0x1067ded8
call fcn.100174e2
push eax
lea ecx, [ebp - 0x478]
call fcn.10017505
movzx eax, al
test eax, eax
je 0x1001ea02
lea ecx, [ebp - 0x478]
call fcn.1002632e
mov eax, dword [eax + 4]
mov dword [ebp - 0xb4c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd18]
call fcn.100171b4
mov eax, dword [ebp - 0xb4c]
jmp 0x10024868
and dword [ebp - 0x130], 0
mov dword [ebp - 0x20], 0x94b2ab76
mov dword [ebp - 0x344], 0x6128f3b8
push 3
lea ecx, [ebp - 0x3a0]
call fcn.1001737a
mov byte [ebp - 4], 9
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0x74], 0xa928
push 3
lea ecx, [ebp - 0x9c4]
call fcn.1001737a
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xb30], 0xd571f7fc
mov dword [ebp - 0xad4], 0xffff
mov dword [ebp - 0x4c8], 0x6dea2805
mov dword [ebp - 0xa20], 0x48cb009
mov dword [ebp - 0x7c], 0
jmp 0x1001ea85
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1001ea9e
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x3a0]
call fcn.10017408
or dword [eax], 0xffffffff
jmp 0x1001ea7e
mov dword [ebp - 0x7c], 0
jmp 0x1001eaae
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1001eaca
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x9c4]
call fcn.10017408
mov dword [eax], 0x6902
jmp 0x1001eaa7
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2f64
jge 0x1001ec1f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0xbe8], eax
mov eax, dword [ebp - 0x344]
dec eax
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0xbe0]
cmp eax, dword [ebp - 0xbe8]
jl 0x1001eb1a
mov dword [ebp - 0x8a8], 1
jmp 0x1001eb21
and dword [ebp - 0x8a8], 0
push 2
lea ecx, [ebp - 0x3a0]
call fcn.10017408
mov ecx, dword [ebp - 0x8a8]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0x3a0]
call fcn.10017408
or dword [eax], 0xffffffff
or eax, 0xffffffff
sub eax, dword [ebp - 0xcc]
jne 0x1001eb61
push 2
pop eax
test eax, eax
jne 0x1001eb61
and dword [ebp - 0x480], 0
jmp 0x1001eb6b
mov dword [ebp - 0x480], 1
mov eax, dword [ebp - 0x480]
sub eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0x20]
je 0x1001eb88
mov dword [ebp - 0x8b0], 1
jmp 0x1001eb8f
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x8b0]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
add eax, dword [ebp - 0x20]
jne 0x1001ebc0
cmp dword [ebp - 0xcc], 0
jne 0x1001ebc0
and dword [ebp - 0x488], 0
jmp 0x1001ebca
mov dword [ebp - 0x488], 1
mov eax, dword [ebp - 0x488]
dec eax
jne 0x1001ebe5
mov eax, 0x33ac
test eax, eax
jne 0x1001ebe5
and dword [ebp - 0x8b8], 0
jmp 0x1001ebef
mov dword [ebp - 0x8b8], 1
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x8b8], eax
jle 0x1001ec06
mov dword [ebp - 0x490], 1
jmp 0x1001ec0d
and dword [ebp - 0x490], 0
cmp dword [ebp - 0x490], 3
jb 0x1001ec1f
and dword [ebp - 0x8c0], 0
jmp 0x1001ec29
mov dword [ebp - 0x8c0], 1
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x8c0], eax
je 0x1001ec40
mov dword [ebp - 0x498], 1
jmp 0x1001ec47
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x498], eax
jne 0x1001ec5e
mov dword [ebp - 0x8c8], 1
jmp 0x1001ec65
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x8c8], eax
jge 0x1001ec7c
mov dword [ebp - 0x4a0], 1
jmp 0x1001ec83
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x4a0], eax
je 0x1001ec9a
mov dword [ebp - 0x8d0], 1
jmp 0x1001eca1
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x8d0], eax
je 0x1001ecb8
mov dword [ebp - 0x4a8], 1
jmp 0x1001ecbf
and dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x4a8], 1
ja 0x1001ecd4
mov dword [ebp - 0x8d8], 1
jmp 0x1001ecdb
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x8d8], eax
jle 0x1001ecf2
mov dword [ebp - 0x4b0], 1
jmp 0x1001ecf9
and dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x4b0], 1
jl 0x1001ed0e
mov dword [ebp - 0x8e0], 1
jmp 0x1001ed15
and dword [ebp - 0x8e0], 0
cmp dword [ebp - 0x8e0], 0
je 0x1001ed74
mov dword [ebp - 0xbf0], 0xfffffff6
mov dword [ebp - 0x20], 0
jmp 0x1001ed38
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x31
jg 0x1001ed54
push 1
lea ecx, [ebp - 0x3a0]
call fcn.10017408
cmp dword [eax], 0
je 0x1001ed52
jmp 0x1001ed54
jmp 0x1001ed31
push 0x135a
push 0x56be
lea eax, [ebp - 0xbf0]
push eax
push 0
call fcn.1001cb47
add esp, 0x10
jmp 0x1001f0ac
push 1
lea ecx, [ebp - 0x9b8]
call fcn.1001737a
mov byte [ebp - 4], 0xb
mov dword [ebp - 0xc50], 0xa7dc4cae
mov dword [ebp - 0xc4c], 0xa7dc4cae
mov dword [ebp - 0xc48], 0xa7dc4cae
mov dword [ebp - 0xc44], 0xa7dc4cae
mov dword [ebp - 0x908], 0xfffffffb
push 0x5a77
push 1
lea eax, [ebp - 0xe50]
push eax
lea eax, [ebp - 0x9b8]
push eax
call fcn.1001bf76
add esp, 0x10
push 2
lea ecx, [ebp - 0x9c4]
call fcn.10017408
cmp dword [eax], 0
je 0x1001ee34
mov dword [ebp - 0xbf8], 0xffff
mov dword [ebp - 0xbf4], 0xffffffff
mov esi, dword [ebp - 0xbf8]
push 0
lea ecx, [ebp - 0x9b8]
call fcn.10017408
mov dword [eax], esi
lea eax, [ebp - 0x9b8]
push eax
push 0
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xbf4]
push eax
call fcn.1001c12f
add esp, 0x14
jmp 0x1001ee69
mov byte [ebp - 0xb0], 0
movzx eax, byte [ebp - 0xb0]
test eax, eax
je 0x1001ee69
push 0x3a57
push 0x56f0
push 0
push 0x208a
push 0x3703
push 0x6eec
call fcn.1001c9ae
add esp, 0x18
push 2
lea ecx, [ebp - 0x3a0]
call fcn.10017408
mov dword [eax], 0x6fe0855b
push 0
lea ecx, [ebp - 0x9b8]
call fcn.10017408
cmp dword [eax], 0x8f94bbb
jge 0x1001ee9d
mov dword [ebp - 0x4b8], 1
jmp 0x1001eea4
and dword [ebp - 0x4b8], 0
push 2
lea ecx, [ebp - 0x3a0]
call fcn.10017408
mov ecx, dword [ebp - 0x4b8]
cmp ecx, dword [eax]
jl 0x1001eec7
mov dword [ebp - 0x8e8], 1
jmp 0x1001eece
and dword [ebp - 0x8e8], 0
push 2
lea ecx, [ebp - 0x9c4]
call fcn.10017408
mov ecx, dword [ebp - 0x8e8]
imul ecx, dword [eax]
test ecx, ecx
jne 0x1001ef03
push 1
lea ecx, [ebp - 0x9c4]
call fcn.10017408
cmp dword [eax], 0
jne 0x1001ef03
and dword [ebp - 0x4c0], 0
jmp 0x1001ef0d
mov dword [ebp - 0x4c0], 1
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0xcc], eax
mov esi, dword [ebp - 0xcc]
add esi, dword [ebp - 0xb30]
push 2
lea ecx, [ebp - 0x3a0]
call fcn.10017408
mov dword [eax], esi
push 0
lea ecx, [ebp - 0x3a0]
call fcn.10017408
push 0
lea ecx, [ebp - 0x9b8]
call fcn.10017408
mov eax, dword [ebp - 0xad4]
mov dword [ebp - 0xe58], eax
mov eax, 0x6f5c
cmp eax, 1
jg 0x1001ef70
mov dword [ebp - 0x8f0], 1
jmp 0x1001ef77
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x8f0]
mov dword [ebp - 0x4c8], eax
cmp dword [ebp - 0x4c8], 0xe12f
jg 0x1001ef9b
mov dword [ebp - 0x8f8], 1
jmp 0x1001efa2
and dword [ebp - 0x8f8], 0
imul eax, dword [ebp - 0x8f8], 0x8e76
cmp dword [ebp - 0x20], eax
jne 0x1001efc3
cmp dword [ebp - 0x74], 0
je 0x1001efc3
mov dword [ebp - 0x4d0], 1
jmp 0x1001efca
and dword [ebp - 0x4d0], 0
cmp dword [ebp - 0x4d0], 0xa7f9cd94
jne 0x1001efe2
mov dword [ebp - 0x900], 1
jmp 0x1001efe9
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x900]
je 0x1001f000
mov dword [ebp - 0xa18], 1
jmp 0x1001f007
and dword [ebp - 0xa18], 0
push 2
lea ecx, [ebp - 0x9c4]
call fcn.10017408
push 1
lea ecx, [ebp - 0x9c4]
call fcn.10017408
push 0xfffffffffffffff9
pop eax
test eax, eax
je 0x1001f03a
cmp dword [ebp - 0x20], 0
je 0x1001f03a
mov dword [ebp - 0xba0], 1
jmp 0x1001f041
and dword [ebp - 0xba0], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xc50]
mov dword [ebp - 0xe60], eax
push 0
lea ecx, [ebp - 0x9b8]
call fcn.10017408
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0xc50]
cmp dword [eax], ecx
je 0x1001f07e
mov dword [ebp - 0x4d8], 1
jmp 0x1001f085
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x908], eax
mov eax, dword [ebp - 0x908]
mov dword [ebp - 0xa20], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x9b8]
call fcn.10017403
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x9c4]
call fcn.10017403
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3a0]
call fcn.10017403
lea eax, [ebp - 0xd18]
push eax
call fcn.1001ab94
pop ecx
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
jne 0x10023f07
mov dword [ebp - 0x134], 0xce53
push 3
lea ecx, [ebp - 0x968]
call fcn.1001737a
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x374], 1
mov dword [ebp - 0x170], 0xeb0badca
lea eax, [ebp - 0x968]
push eax
push 0
push 0x6324
lea eax, [ebp - 0xe68]
push eax
call fcn.1001d31e
add esp, 0x10
cmp dword [ebp - 0x134], 0
jne 0x1001f151
cmp dword [ebp - 0x134], 0
jne 0x1001f151
and dword [ebp - 0x910], 0
jmp 0x1001f15b
mov dword [ebp - 0x910], 1
mov eax, dword [ebp - 0x134]
cmp eax, dword [ebp - 0x910]
jl 0x1001f175
mov dword [ebp - 0x34c], 1
jmp 0x1001f17c
and dword [ebp - 0x34c], 0
push 0
lea ecx, [ebp - 0x968]
call fcn.10017408
mov ecx, dword [ebp - 0x34c]
mov dword [eax], ecx
cmp dword [ebp - 0x34c], 0
je 0x1001f451
mov dword [ebp - 0x114], 0x43c6
mov dword [ebp - 0x504], 0
mov dword [ebp - 0x1e0], 7
mov dword [ebp - 0x97c], 0xffff
push 3
lea ecx, [ebp - 0xc7c]
call fcn.1001737a
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x91c], 0x253d9751
mov dword [ebp - 0xa28], 1
mov dword [ebp - 0x254], 0
jmp 0x1001f204
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 3
jge 0x1001f226
push dword [ebp - 0x254]
lea ecx, [ebp - 0xc7c]
call fcn.10017408
mov dword [eax], 0x43747c91
jmp 0x1001f1f7
mov dword [ebp - 0x114], 0x949a8df5
cmp dword [ebp - 0x114], 0
jne 0x1001f3c8
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0xe70], eax
cmp dword [ebp - 0x114], 1
jb 0x1001f267
cmp dword [ebp - 0x1e0], 0
je 0x1001f267
mov dword [ebp - 0x4e4], 1
jmp 0x1001f26e
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x4e4], eax
jg 0x1001f288
mov dword [ebp - 0x74c], 1
jmp 0x1001f28f
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0x74c], eax
jne 0x1001f2a9
mov dword [ebp - 0x4ec], 1
jmp 0x1001f2b0
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x1e0]
add eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x97c], eax
cmp dword [ebp - 0x97c], 4
ja 0x1001f2d7
mov dword [ebp - 0x4f4], 1
jmp 0x1001f2de
and dword [ebp - 0x4f4], 0
cmp dword [ebp - 0x4f4], 0
jle 0x1001f2f3
mov dword [ebp - 0x754], 1
jmp 0x1001f2fa
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x754], eax
jle 0x1001f314
mov dword [ebp - 0x4fc], 1
jmp 0x1001f31b
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x134]
add eax, dword [ebp - 0x4fc]
cmp eax, dword [ebp - 0x114]
jne 0x1001f33b
mov dword [ebp - 0x75c], 1
jmp 0x1001f342
and dword [ebp - 0x75c], 0
push 0
lea ecx, [ebp - 0x968]
call fcn.10017408
mov dword [ebp - 0x884], eax
push 0
lea ecx, [ebp - 0x968]
call fcn.10017408
mov ecx, dword [ebp - 0x884]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x884]
mov eax, dword [eax]
mov dword [ebp - 0x504], eax
mov eax, dword [ebp - 0x504]
add eax, dword [ebp - 0x75c]
mov dword [ebp - 0xb38], eax
push 1
lea ecx, [ebp - 0xc7c]
call fcn.10017408
mov ecx, dword [ebp - 0xb38]
mov dword [eax], ecx
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xe78], eax
push 0
lea ecx, [ebp - 0x968]
call fcn.10017408
cmp dword [eax], 0
jne 0x1001f3c8
and dword [ebp - 0x50c], 0
jmp 0x1001f3d2
mov dword [ebp - 0x50c], 1
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x91c], eax
mov eax, dword [ebp - 0x91c]
add eax, 6
sub eax, dword [ebp - 0x170]
cmp eax, dword [ebp - 0x134]
jne 0x1001f41c
push 0
lea ecx, [ebp - 0x968]
call fcn.10017408
cmp dword [eax], 0
jne 0x1001f41c
and dword [ebp - 0x514], 0
jmp 0x1001f426
mov dword [ebp - 0x514], 1
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0xa28], eax
push 1
push 0x353b
call fcn.1001bfe9
pop ecx
pop ecx
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xc7c]
call fcn.10017403
jmp 0x1001f49b
mov dword [ebp - 0x170], 0
jmp 0x1001f46a
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 2
jg 0x1001f49b
mov byte [ebp - 0xa6], 0
movzx eax, byte [ebp - 0xa6]
test eax, eax
je 0x1001f499
push 0
push 0x237e
push 0x1f85
call fcn.1001c75b
add esp, 0xc
jmp 0x1001f45d
lea eax, [ebp - 0x968]
push eax
lea eax, [ebp - 0x374]
push eax
push 0x658f
push 0xd19
push 0x44a3
push 1
push 0x411b
call fcn.1001c044
add esp, 0x1c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x968]
call fcn.10017403
mov dword [ebp - 0x40], 0xde05dae5
mov dword [ebp - 0x368], 0xffffffff
mov dword [ebp - 0xba8], 2
mov dword [ebp - 0xa38], 0xfffffffc
push 0x620c
push 1
push 0x2643
push 0x377b
push 0x38dc
call fcn.1001c12f
add esp, 0x14
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xe80], eax
xor eax, eax
je 0x1001f538
cmp dword [ebp - 0x40], 0
je 0x1001f538
mov dword [ebp - 0x764], 1
jmp 0x1001f53f
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x368]
mov dword [ebp - 0xba8], eax
cmp dword [ebp - 0x40], 0x29ef4a04
jl 0x1001f570
mov dword [ebp - 0x51c], 1
jmp 0x1001f577
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x51c]
cmp dword [ebp - 0x40], eax
jle 0x1001f592
mov dword [ebp - 0x88c], 1
jmp 0x1001f599
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x88c]
cmp eax, 4
je 0x1001f5bd
cmp dword [ebp - 0x368], 0
je 0x1001f5bd
mov dword [ebp - 0xa30], 1
jmp 0x1001f5c4
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xd58], eax
cmp dword [ebp - 0x40], 0xbc248910
jae 0x1001f5e2
mov dword [ebp - 0xb40], 1
jmp 0x1001f5e9
and dword [ebp - 0xb40], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xefc], eax
mov eax, 0xa48a
cmp eax, 0x8ea2
jne 0x1001f60a
mov dword [ebp - 0x524], 1
jmp 0x1001f611
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0xa38], eax
cmp dword [0x1067ddd4], 0
jne 0x10023bef
mov dword [ebp - 0x25c], 1
mov dword [ebp - 0xd28], 0x286e871d
mov dword [ebp - 0xd24], 0x286e871d
mov dword [ebp - 0xd20], 0x286e871d
mov dword [ebp - 0xd1c], 0x286e871d
mov dword [ebp - 0x25c], 0
jmp 0x1001f675
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 8
jle 0x1001f6c0
mov dword [ebp - 0x148], 2
mov dword [ebp - 0x148], 0
jmp 0x1001f6a1
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 3
jg 0x1001f6be
mov eax, dword [ebp - 0x148]
cmp dword [ebp + eax*4 - 0xd28], 0
je 0x1001f6bc
jmp 0x1001f6be
jmp 0x1001f694
jmp 0x1001f668
push 3
lea ecx, [ebp - 0x1f8]
call fcn.1001737a
mov byte [ebp - 4], 0xe
mov dword [ebp - 0xd4], 0x34e6d4f2
mov dword [ebp - 0xdc], 0x40e13f5e
mov dword [ebp - 0x13c], 0xfffffff6
mov dword [ebp - 0x89c], 3
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x264], 0x69a75015
mov dword [ebp - 0x78c], 0xffffffff
mov dword [ebp - 0xb48], 1
push 2
lea ecx, [ebp - 0xc88]
call fcn.1001737a
mov byte [ebp - 4], 0xf
push 0
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x1f8]
push eax
call fcn.1001c34e
add esp, 0xc
mov dword [ebp - 0x11c], 0
jmp 0x1001f763
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 4
jge 0x1001f77f
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0xd38], 1
jmp 0x1001f756
lea eax, [ebp - 0xc88]
push eax
lea eax, [ebp - 0x11c]
push eax
push 0x4099
push 0
call fcn.1001c61b
add esp, 0x10
push 0
lea ecx, [ebp - 0x1f8]
call fcn.10017408
mov eax, dword [eax]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xf04], eax
push 0
lea ecx, [ebp - 0x1f8]
call fcn.10017408
mov esi, dword [eax]
neg esi
push 0
lea ecx, [ebp - 0x1f8]
call fcn.10017408
cmp esi, dword [eax]
jge 0x1001f7eb
mov dword [ebp - 0x76c], 1
jmp 0x1001f7f2
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x76c], eax
je 0x1001f80c
mov dword [ebp - 0x52c], 1
jmp 0x1001f813
and dword [ebp - 0x52c], 0
push 0
lea ecx, [ebp - 0x1f8]
call fcn.10017408
mov ecx, dword [ebp - 0x52c]
cmp ecx, dword [eax]
jne 0x1001f836
mov dword [ebp - 0x994], 1
jmp 0x1001f83d
and dword [ebp - 0x994], 0
mov eax, dword [ebp - 0x994]
mov dword [ebp - 0xdc], eax
mov esi, dword [ebp - 0xdc]
push 1
lea ecx, [ebp - 0x1f8]
call fcn.10017408
imul esi, dword [eax]
cmp esi, 0xa0a9
jl 0x1001f87c
mov eax, 0x2370
test eax, eax
je 0x1001f87c
mov dword [ebp - 0xbb0], 1
jmp 0x1001f883
and dword [ebp - 0xbb0], 0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xf0c], eax
cmp dword [ebp - 0xdc], 0xfffffff7
jne 0x1001f8aa
cmp dword [ebp - 0xdc], 0
jne 0x1001f8aa
and dword [ebp - 0xa40], 0
jmp 0x1001f8b4
mov dword [ebp - 0xa40], 1
push 0
lea ecx, [ebp - 0x1f8]
call fcn.10017408
cmp dword [eax], 1
je 0x1001f8d2
mov dword [ebp - 0x534], 1
jmp 0x1001f8d9
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x13c], eax
mov esi, dword [ebp - 0x13c]
push 2
lea ecx, [ebp - 0x1f8]
call fcn.10017408
sub esi, dword [eax]
cmp dword [ebp - 0xd4], esi
jge 0x1001f90e
mov dword [ebp - 0x774], 1
jmp 0x1001f915
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
je 0x1001f93d
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x1001f93d
mov dword [ebp - 0x53c], 1
jmp 0x1001f944
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0x89c], eax
push 2
lea ecx, [ebp - 0x1f8]
call fcn.10017408
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0xd38]
push 2
lea ecx, [ebp - 0x1f8]
call fcn.10017408
cmp esi, dword [eax]
jge 0x1001f987
mov dword [ebp - 0x894], 1
jmp 0x1001f98e
and dword [ebp - 0x894], 0
push 2
lea ecx, [ebp - 0x1f8]
call fcn.10017408
mov ecx, dword [ebp - 0x894]
cmp ecx, dword [eax]
jge 0x1001f9b1
mov dword [ebp - 0x544], 1
jmp 0x1001f9b8
and dword [ebp - 0x544], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd38]
cmp dword [ebp - 0x544], eax
jge 0x1001f9d9
mov dword [ebp - 0x77c], 1
jmp 0x1001f9e0
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x77c]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0xf14], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd38], 0xce17c927
je 0x1001fa23
mov dword [ebp - 0x924], 1
jmp 0x1001fa2a
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x264], eax
jl 0x1001fa50
mov dword [ebp - 0x54c], 1
jmp 0x1001fa57
and dword [ebp - 0x54c], 0
cmp dword [ebp - 0x54c], 1
jb 0x1001fa7e
push 2
lea ecx, [ebp - 0x1f8]
call fcn.10017408
cmp dword [eax], 0
je 0x1001fa7e
mov dword [ebp - 0x554], 1
jmp 0x1001fa85
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x924]
cmp eax, dword [ebp - 0x554]
jge 0x1001fa9a
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x1001faa3
cmp dword [ebp - 0x13c], 0
jne 0x1001faaa
cmp dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xf1c], eax
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0xf24], eax
mov eax, dword [ebp - 0x78c]
mov dword [ebp - 0xf4c], eax
push 0
lea ecx, [ebp - 0x1f8]
call fcn.10017408
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0xb48], eax
je 0x1001faf5
mov dword [ebp - 0x784], 1
jmp 0x1001fafc
and dword [ebp - 0x784], 0
cmp dword [ebp - 0x784], 1
jle 0x1001fb11
mov dword [ebp - 0x55c], 1
jmp 0x1001fb18
and dword [ebp - 0x55c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xd38]
cmp dword [ebp - 0x55c], eax
je 0x1001fb38
mov dword [ebp - 0x564], 1
jmp 0x1001fb3f
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x89c]
cmp dword [ebp - 0x564], eax
jge 0x1001fb59
mov dword [ebp - 0x56c], 1
jmp 0x1001fb60
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x78c]
imul eax, dword [ebp - 0x56c]
cmp eax, dword [ebp - 0xdc]
jne 0x1001fb81
mov dword [ebp - 0x99c], 1
jmp 0x1001fb88
and dword [ebp - 0x99c], 0
push 1
lea ecx, [ebp - 0xc88]
call fcn.10017408
mov ecx, dword [ebp - 0x99c]
mov dword [eax], ecx
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xc88]
call fcn.10017403
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1f8]
call fcn.10017403
mov byte [ebp - 0x1bc], 1
mov byte [ebp - 0x1bb], 0xa7
mov byte [ebp - 0x1ba], 8
mov byte [ebp - 0x1b9], 0x4b
mov byte [ebp - 0x1b8], 0x1a
mov byte [ebp - 0x1b7], 9
mov byte [ebp - 0x1b6], 0x38
mov byte [ebp - 0x1b5], 2
mov byte [ebp - 0x1b4], 0x40
mov byte [ebp - 0x1b3], 0x90
mov byte [ebp - 0x1b2], 0x2b
mov byte [ebp - 0x1b1], 0xe8
mov byte [ebp - 0x1b0], 0xb4
mov byte [ebp - 0x1af], 0x8c
mov byte [ebp - 0x1ae], 0xbf
mov byte [ebp - 0x1ad], 0xe9
mov byte [ebp - 0x1ac], 0x7a
mov byte [ebp - 0x1ab], 0x3f
mov byte [ebp - 0x1aa], 0x68
mov byte [ebp - 0x1a9], 0x31
mov byte [ebp - 0x1a8], 0xd2
mov byte [ebp - 0x1a7], 0xe9
mov byte [ebp - 0x1a6], 0xab
mov byte [ebp - 0x1a5], 0x19
mov byte [ebp - 0x1a4], 0x97
mov byte [ebp - 0x1a3], pe_nt_image_headers32
mov byte [ebp - 0x1a2], 0x34
mov byte [ebp - 0x1a1], 0x52
mov byte [ebp - 0x1a0], 0xe2
mov byte [ebp - 0x19f], 0x45
mov byte [ebp - 0x19e], 0xaf
mov byte [ebp - 0x19d], 0xb
mov byte [ebp - 0x19c], 0x42
mov byte [ebp - 0x19b], 7
mov byte [ebp - 0x19a], 0x5e
mov byte [ebp - 0x199], 6
mov byte [ebp - 0x198], 1
mov byte [ebp - 0x197], 5
mov byte [ebp - 0x196], 0x5f
mov byte [ebp - 0x195], 9
mov byte [ebp - 0x194], 8
mov byte [ebp - 0x193], 4
mov byte [ebp - 0x192], 1
mov byte [ebp - 0x191], 0
mov byte [ebp - 0x190], 0x2e
mov byte [ebp - 0x18f], 3
mov byte [ebp - 0x18e], 0x25
mov byte [ebp - 0x18d], 0xa
mov byte [ebp - 0x18c], 2
mov byte [ebp - 0x18b], 2
mov byte [ebp - 0x18a], 0x1e
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1bc]
or eax, 0xc2
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1bc]
and ecx, 0xc2
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x1bc]
mov word [ebp + ecx*2 - 0xd54], ax
mov dword [ebp - 0x26c], 9
mov dword [ebp - 0x26c], 0
jmp 0x1001fd82
mov eax, dword [ebp - 0x26c]
dec eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0xfffffff5
jl 0x1001fdcc
mov byte [ebp - 0xa8], 0
lea eax, [ebp - 0xa8]
push eax
push 0x4e5
push 0x66d0
push 0
call fcn.1001d3cb
add esp, 0x10
mov byte [ebp - 0xaa], 0
push 1
lea eax, [ebp - 0xaa]
push eax
push 0x160b
call fcn.1001c224
add esp, 0xc
jmp 0x1001fd75
mov dword [ebp - 0x24], 2
and dword [ebp - 0x150], 0
jmp 0x1001fde4
mov eax, dword [ebp - 0x24]
inc eax
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x33
jae 0x100213a1
mov dword [ebp - 0xa48], 0x4f01
mov dword [ebp - 0x200], 0xf2c29a3d
mov dword [ebp - 0xf54], 0xfffffffb
mov dword [ebp - 0x318], 0xffffffff
push 2
lea ecx, [ebp - 0xc40]
call fcn.1001737a
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x574], 0x37b0
mov dword [ebp - 0x240], 0
jmp 0x1001fe4a
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jge 0x1001fe69
push dword [ebp - 0x240]
lea ecx, [ebp - 0xc40]
call fcn.10017408
and dword [eax], 0
jmp 0x1001fe3d
mov eax, dword [ebp - 0x574]
inc eax
mov dword [ebp - 0x574], eax
mov dword [ebp - 0x200], 0xffffffec
jmp 0x1001fe8f
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0x17
je 0x1001fff8
mov dword [ebp - 0x9f8], 0xffffffff
mov dword [ebp - 0x9f4], 0xffffffff
mov dword [ebp - 0x9f0], 0xffffffff
mov dword [ebp - 0x9ec], 0xffffffff
mov byte [ebp - 0xa7], 0
movzx eax, byte [ebp - 0xa7]
test eax, eax
je 0x1001fee4
push 1
push 0x6822
call fcn.1001c269
pop ecx
pop ecx
xor eax, eax
inc eax
je 0x1001ff05
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9f8], 0
je 0x1001ff05
mov dword [ebp - 0x8a4], 1
jmp 0x1001ff0c
and dword [ebp - 0x8a4], 0
mov esi, dword [ebp - 0x318]
push 0
lea ecx, [ebp - 0xc40]
call fcn.10017408
cmp esi, dword [eax]
jg 0x1001ff2f
mov dword [ebp - 0x794], 1
jmp 0x1001ff36
and dword [ebp - 0x794], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9f8]
cmp dword [ebp - 0x794], eax
je 0x1001ff57
mov dword [ebp - 0x57c], 1
jmp 0x1001ff5e
and dword [ebp - 0x57c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x9f8]
imul eax, dword [ebp - 0x57c]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0xf50], eax
mov eax, dword [ebp - 0xa48]
mov dword [ebp - 0xedc], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x9f8]
cmp dword [ebp + eax - 0x9f8], ecx
je 0x1001ffb6
mov dword [ebp - 0x584], 1
jmp 0x1001ffbd
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x8a4]
cmp eax, dword [ebp - 0x584]
jl 0x1001ffd7
mov dword [ebp - 0x79c], 1
jmp 0x1001ffde
and dword [ebp - 0x79c], 0
push 1
lea ecx, [ebp - 0xc40]
call fcn.10017408
mov ecx, dword [ebp - 0x79c]
mov dword [eax], ecx
jmp 0x1001fe82
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xc40]
call fcn.10017403
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1bc]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x24], eax
jne 0x1002090a
mov dword [ebp - 0x3c], 0x76c3a0b8
mov dword [ebp - 0x160], 0xe1e01b17
mov dword [ebp - 0xa50], 0xfffffffc
mov dword [ebp - 0x988], 1
push 1
lea ecx, [ebp - 0xcf4]
call fcn.1001737a
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x370], 0xb218ad38
mov dword [ebp - 0x350], 0xffffffff
mov dword [ebp - 0x5c4], 1
mov dword [ebp - 0xa68], 0xfffffffd
mov dword [ebp - 0x378], 0x19c7819a
mov dword [ebp - 0x320], 0x93a78091
mov dword [ebp - 0xa70], 0x2e769e88
mov dword [ebp - 0x10], 0
jmp 0x100200ae
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x100200c4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf70], 0xe834ab4
jmp 0x100200a7
mov dword [ebp - 0x10], 0
jmp 0x100200d4
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x100200f0
push dword [ebp - 0x10]
lea ecx, [ebp - 0xcf4]
call fcn.10017408
mov dword [eax], 0xd1a0c844
jmp 0x100200cd
mov dword [ebp - 0x10], 0
jmp 0x10020100
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10020116
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xca0], 0xd9aeb8ef
jmp 0x100200f9
mov dword [ebp - 0x10], 0
jmp 0x10020126
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002013c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf94], 0
jmp 0x1002011f
cmp dword [ebp - 0x3c], 0
jne 0x10020151
cmp dword [ebp - 0x3c], 0
jne 0x10020151
and dword [ebp - 0x58c], 0
jmp 0x1002015b
mov dword [ebp - 0x58c], 1
mov dword [ebp - 0x160], 0x111d
cmp dword [ebp - 0x160], 8
jg 0x1002017a
mov dword [ebp - 0x92c], 1
jmp 0x10020181
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x58c]
cmp eax, dword [ebp - 0x92c]
je 0x1002019b
mov dword [ebp - 0xbb8], 1
jmp 0x100201a2
and dword [ebp - 0xbb8], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xd64], eax
mov eax, 0x22a
test eax, eax
jle 0x100201c0
mov dword [ebp - 0x594], 1
jmp 0x100201c7
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x594], eax
jle 0x100201e7
cmp dword [ebp - 0x160], 0
je 0x100201e7
mov dword [ebp - 0x7a4], 1
jmp 0x100201ee
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x7a4]
neg eax
cmp dword [ebp - 0x3c], eax
jne 0x10020207
mov dword [ebp - 0x59c], 1
jmp 0x1002020e
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x59c]
cmp eax, dword [ebp - 0x3c]
jle 0x10020229
mov dword [ebp - 0x8ac], 1
jmp 0x10020230
and dword [ebp - 0x8ac], 0
cmp dword [ebp - 0x8ac], 0x5764
jl 0x10020248
mov dword [ebp - 0x5a4], 1
jmp 0x1002024f
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x5a4]
sub eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x3c]
jle 0x10020269
mov dword [ebp - 0x7ac], 1
jmp 0x10020270
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x7ac], eax
jl 0x10020287
mov dword [ebp - 0x5ac], 1
jmp 0x1002028e
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0xa50], eax
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xf70], 0
cmp dword [ebp - 0x988], 0
jl 0x100202bf
mov dword [ebp - 0x5cc], 1
jmp 0x100202c6
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x988]
mov dword [ebp - 0xd68], eax
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xca0], 0xf82e
xor eax, eax
je 0x100202fb
cmp dword [ebp - 0x5c4], 0
je 0x100202fb
mov dword [ebp - 0x5b4], 1
jmp 0x10020302
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x5b4]
sub eax, dword [ebp - 0x378]
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 2
jne 0x10020329
mov dword [ebp - 0x7b4], 1
jmp 0x10020330
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0xb50], eax
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0xa58], eax
mov eax, dword [ebp - 0x320]
dec eax
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0xb50]
cmp eax, dword [ebp - 0xa58]
jne 0x1002036f
mov dword [ebp - 0x5bc], 1
jmp 0x10020376
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0xa60], eax
mov eax, dword [ebp - 0x350]
dec eax
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0xbc0]
cmp eax, dword [ebp - 0xa60]
jg 0x100203b5
mov dword [ebp - 0x328], 1
jmp 0x100203bc
and dword [ebp - 0x328], 0
push 0
lea ecx, [ebp - 0xcf4]
call fcn.10017408
mov ecx, dword [ebp - 0x328]
mov dword [eax], ecx
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x328], eax
jle 0x100203f4
cmp dword [ebp - 0x160], 0
jne 0x100203f4
mov dword [ebp - 0xb60], 1
jmp 0x100203fb
and dword [ebp - 0xb60], 0
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0xe4c], eax
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0xd6c], eax
mov eax, 0xe6299310
cmp eax, 0x502d4801
jne 0x10020431
cmp dword [ebp - 0xa68], 0
jne 0x10020431
mov dword [ebp - 0x8b4], 1
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x8b4], eax
je 0x10020452
mov dword [ebp - 0x1c], 0x462d5e48
mov dword [ebp - 0xa0], 0x959c45c1
push 2
lea ecx, [ebp - 0x35c]
call fcn.1001737a
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x338], 0x3b6d3e8d
mov dword [ebp - 0xbbc], 0xfffe
mov dword [ebp - 0xa98], 0
mov dword [ebp - 0xd94], 0xfffffff7
mov dword [ebp - 0x210], 0
jmp 0x1002096d
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 2
jge 0x1002098c
push dword [ebp - 0x210]
lea ecx, [ebp - 0x35c]
call fcn.10017408
and dword [eax], 0
jmp 0x10020960
mov dword [ebp - 0x1c], 0xd
jmp 0x1002099c
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10021100
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x268], 0xffffffff
mov dword [ebp - 0x12c], 0x342f
mov dword [ebp - 0x218], 0xffffffff
mov dword [ebp - 0x6c], 0
jmp 0x100209db
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x100209f1
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x388], 1
jmp 0x100209d4
mov dword [ebp - 0x6c], 0
jmp 0x10020a01
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x10020a17
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x10c], 0x8bac04ee
jmp 0x100209fa
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x10c], 3
jmp 0x10020a45
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x10c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10c], 0
jl 0x100210fb
mov dword [ebp - 0x124], 0x35edade0
mov dword [ebp - 0x360], 0xd2b5f791
mov dword [ebp - 0xa88], 0x5ff1fc5b
mov dword [ebp - 0xb7c], 0xffbebd5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10c]
mov eax, dword [ebp + eax*4 - 0x388]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0
jmp 0x10020aa8
cmp dword [ebp - 0x28], 3
jg 0x100210f6
mov dword [ebp - 0x90], 0xffffffff
mov dword [ebp - 0x674], 6
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
jne 0x10020dcd
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x388]
sub eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x90]
jg 0x10020b00
mov dword [ebp - 0x8c4], 1
jmp 0x10020b07
and dword [ebp - 0x8c4], 0
cmp dword [ebp - 0x8c4], 0x23988f15
jge 0x10020b1f
mov dword [ebp - 0x604], 1
jmp 0x10020b26
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x604]
add eax, 0x766593c3
cmp eax, dword [ebp - 0x90]
jle 0x10020b45
mov dword [ebp - 0x7dc], 1
jmp 0x10020b4c
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
jne 0x10020b73
mov eax, 0x1197
test eax, eax
jne 0x10020b73
and dword [ebp - 0x60c], 0
jmp 0x10020b7d
mov dword [ebp - 0x60c], 1
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
neg eax
cmp eax, 1
je 0x10020ba2
mov dword [ebp - 0x93c], 1
jmp 0x10020ba9
and dword [ebp - 0x93c], 0
cmp dword [ebp - 0x93c], 0xe7a3
jne 0x10020bc1
mov dword [ebp - 0x614], 1
jmp 0x10020bc8
and dword [ebp - 0x614], 0
push 1
lea ecx, [ebp - 0x35c]
call fcn.10017408
mov esi, dword [ebp - 0x614]
imul esi, dword [eax]
push 1
lea ecx, [ebp - 0x35c]
call fcn.10017408
cmp esi, dword [eax]
jl 0x10020bfb
mov dword [ebp - 0x7e4], 1
jmp 0x10020c02
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x90]
imul eax, dword [ebp - 0x7e4]
mov dword [ebp - 0x90], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10c]
mov eax, dword [ebp + eax*4 - 0x388]
cmp dword [ebp - 0x90], eax
jne 0x10020c3d
mov dword [ebp - 0x61c], 1
jmp 0x10020c44
and dword [ebp - 0x61c], 0
cmp dword [ebp - 0x61c], 0
ja 0x10020c5f
mov eax, 0xef10
test eax, eax
jne 0x10020c5f
and dword [ebp - 0x8cc], 0
jmp 0x10020c69
mov dword [ebp - 0x8cc], 1
cmp dword [ebp - 0x8cc], 0
jle 0x10020c7e
mov dword [ebp - 0x624], 1
jmp 0x10020c85
and dword [ebp - 0x624], 0
cmp dword [ebp - 0x624], 1
jbe 0x10020c9a
mov dword [ebp - 0x7ec], 1
jmp 0x10020ca1
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x388]
cmp dword [ebp - 0x7ec], eax
je 0x10020cbf
mov dword [ebp - 0x62c], 1
jmp 0x10020cc6
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x388]
add eax, dword [ebp - 0x62c]
je 0x10020cf1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xa0], eax
jl 0x10020de4
mov dword [ebp - 0x8d4], 1
jmp 0x10020deb
and dword [ebp - 0x8d4], 0
push 1
lea ecx, [ebp - 0x35c]
call fcn.10017408
mov ecx, dword [ebp - 0x8d4]
imul ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x10c]
jg 0x10020e1c
mov dword [ebp - 0x644], 1
jmp 0x10020e23
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x388]
cmp eax, dword [ebp - 0x644]
jl 0x10020e41
mov dword [ebp - 0x7fc], 1
jmp 0x10020e48
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x7fc]
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x124], 0
jne 0x10020e69
mov dword [ebp - 0x64c], 1
jmp 0x10020e70
and dword [ebp - 0x64c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10c]
mov dword [ebp + eax*4 - 0x388], 0x3b72cd76
mov dword [ebp - 0x268], 0x3b72cd76
mov eax, dword [ebp - 0x64c]
sub eax, dword [ebp - 0x268]
je 0x10020ed1
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0xd9c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x388]
mov dword [ebp - 0xef8], eax
mov eax, 0xffff
test eax, eax
je 0x10020ed1
mov dword [ebp - 0x944], 1
jmp 0x10020ed8
and dword [ebp - 0x944], 0
mov eax, dword [ebp - 0x944]
inc eax
jns 0x10020eed
mov dword [ebp - 0x654], 1
jmp 0x10020ef4
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x90]
add eax, dword [ebp - 0x654]
cmp eax, dword [ebp - 0x124]
jge 0x10020f14
mov dword [ebp - 0x804], 1
jmp 0x10020f1b
and dword [ebp - 0x804], 0
push 1
lea ecx, [ebp - 0x35c]
call fcn.10017408
mov ecx, dword [ebp - 0x804]
cmp ecx, dword [eax]
jl 0x10020f3e
mov dword [ebp - 0x65c], 1
jmp 0x10020f45
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0xb7c]
cmp dword [ebp - 0x65c], eax
je 0x10020f5f
mov dword [ebp - 0x8dc], 1
jmp 0x10020f66
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x8dc], eax
jle 0x10020f7d
mov dword [ebp - 0xa90], 1
jmp 0x10020f84
and dword [ebp - 0xa90], 0
push 1
lea ecx, [ebp - 0x35c]
call fcn.10017408
push 1
lea ecx, [ebp - 0x35c]
call fcn.10017408
imul eax, dword [ebp - 0x28], 0xffffffff
test eax, eax
jne 0x10020fb8
cmp dword [ebp - 0xa0], 0
jne 0x10020fb8
and dword [ebp - 0x664], 0
jmp 0x10020fc2
mov dword [ebp - 0x664], 1
mov eax, dword [ebp - 0x360]
cmp dword [ebp - 0x664], eax
jne 0x10020fdc
mov dword [ebp - 0x80c], 1
jmp 0x10020fe3
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x10c]
add eax, dword [ebp - 0x90]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x10c]
cmp eax, 1
jb 0x1002103d
jmp 0x10020a2a
jmp 0x10020995
cmp dword [ebp - 0x338], 0
je 0x1002123a
mov dword [ebp - 0x338], 0xcefc
cmp dword [ebp - 0x338], 0
jne 0x1002112c
mov dword [ebp - 0x694], 1
jmp 0x10021133
and dword [ebp - 0x694], 0
push 0
lea ecx, [ebp - 0x35c]
call fcn.10017408
mov ecx, dword [ebp - 0x1c]
cmp dword [eax], ecx
jne 0x10021153
mov dword [ebp - 0x684], 1
jmp 0x1002115a
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x684], eax
jl 0x10021174
mov dword [ebp - 0x81c], 1
jmp 0x1002117b
and dword [ebp - 0x81c], 0
push 1
lea ecx, [ebp - 0x35c]
call fcn.10017408
mov ecx, dword [ebp - 0x81c]
cmp ecx, dword [eax]
jl 0x1002119e
mov dword [ebp - 0x68c], 1
jmp 0x100211a5
and dword [ebp - 0x68c], 0
cmp dword [ebp - 0x68c], 0x2b0e
jg 0x100211bd
mov dword [ebp - 0x94c], 1
jmp 0x100211c4
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x94c]
sub eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x694], eax
je 0x100211e1
mov dword [ebp - 0x364], 1
jmp 0x100211e8
and dword [ebp - 0x364], 0
push 1
lea ecx, [ebp - 0x35c]
call fcn.10017408
mov ecx, dword [ebp - 0x364]
mov dword [eax], ecx
mov eax, dword [ebp - 0x364]
sub eax, dword [ebp - 0x1c]
cmp eax, 0xe83d
jne 0x10021219
mov dword [ebp - 0x824], 1
jmp 0x10021220
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x824], eax
jle 0x1002123a
mov dword [ebp - 0x69c], 1
jmp 0x10021241
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x69c], eax
jge 0x1002125b
mov dword [ebp - 0x8ec], 1
jmp 0x10021262
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x8ec]
add eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xbbc]
cmp eax, dword [ebp - 0x1c]
jne 0x10021285
mov dword [ebp - 0x6a4], 1
jmp 0x1002128c
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x6a4]
jl 0x100212a6
mov dword [ebp - 0x82c], 1
jmp 0x100212ad
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x82c], eax
jl 0x100212c9
or eax, 0xffffffff
je 0x100212c9
mov dword [ebp - 0x6ac], 1
jmp 0x100212d0
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x6ac]
sub eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jle 0x100212ea
mov dword [ebp - 0x980], 1
jmp 0x100212f1
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x980]
mov dword [ebp - 0xa98], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x35c]
call fcn.10017403
mov eax, dword [ebp - 0x24]
movzx eax, byte [ebp + eax - 0x1bb]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x150]
movzx ecx, byte [ebp + ecx - 0x1be]
movzx ecx, word [ebp + ecx*2 - 0xd54]
add eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x1bb]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x150]
movzx edx, byte [ebp + edx - 0x1be]
movzx edx, word [ebp + edx*2 - 0xd54]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x1bb]
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x150]
movzx edx, byte [ebp + edx - 0x1be]
movzx edx, word [ebp + edx*2 - 0xd54]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ebp + ecx - 0x1bc]
mov word [ebp + ecx*2 - 0xd54], ax
and dword [ebp - 0x150], 0
jmp 0x1001fddc
mov dword [ebp - 0x250], 0
jmp 0x100213ba
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 3
jge 0x100213d6
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0xc34], 0xffffffff
jmp 0x100213ad
mov byte [ebp - 0xb4], 0
movzx eax, byte [ebp - 0xb4]
test eax, eax
je 0x100213fc
push 1
push 0x5dac
push 0x2e6c
call fcn.1001c34e
add esp, 0xc
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xc34], 0xffffffff
jmp 0x10021427
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xc34]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xc34], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc34], 0xfffffff5
je 0x100214d1
push 2
lea ecx, [ebp - 0xce8]
call fcn.1001737a
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x17c], 0
jmp 0x10021464
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 3
jge 0x10021480
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0xfd0], 1
jmp 0x10021457
push 1
push 0x53e4
push 0x756f
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0xce8]
push eax
call fcn.1001c3b5
add esp, 0x14
push 1
push 0x2202
push 0xe48
lea eax, [ebp - 0xce8]
push eax
call fcn.1001c45f
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xce8]
call fcn.10017403
jmp 0x1002140e
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0xd54], cx
mov dword [ebp - 0xec], 0xffffffff
mov dword [ebp - 0xda4], 0xd5f8d9a2
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xec], 0
jmp 0x1002151a
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0xe
jg 0x10021573
mov dword [ebp - 0xb84], 0xfc371865
mov dword [ebp - 0xbdc], 0xdb6d
mov dword [ebp - 0xaa0], 5
lea eax, [ebp - 0xb84]
push eax
push 0x6a6b
lea eax, [ebp - 0xec]
push eax
push 0x5225
push 1
lea eax, [ebp - 0xaa0]
push eax
lea eax, [ebp - 0xbdc]
push eax
call fcn.1001c517
add esp, 0x1c
jmp 0x1002150d
lea eax, [ebp - 0xd54]
push eax
lea ecx, [ebp - 0xfe8]
call fcn.10026277
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0xb8c], eax
mov byte [ebp - 4], 0x15
push dword [ebp - 0xb8c]
call fcn.1001ab94
pop ecx
mov dword [ebp - 0x7c0], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xfe8]
call fcn.100171b4
mov dword [ebp - 0x54], 0xca63
mov dword [ebp - 0x6b4], 7
mov dword [ebp - 0x6bc], 0x414b58e1
mov dword [ebp - 0xbc4], 9
mov dword [ebp - 0xab8], 0x37ead942
mov dword [ebp - 0x220], 0
jmp 0x10021604
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 1
jge 0x10021620
mov eax, dword [ebp - 0x220]
mov dword [ebp + eax*4 - 0x95c], 0xffffffff
jmp 0x100215f7
push 0x47b5
push 0x1fc5
lea eax, [ebp - 0x54]
push eax
push 1
call fcn.1001c61b
add esp, 0x10
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xe6c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xdac], eax
mov dword [ebp - 0x6b4], 1
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x6b4], eax
jl 0x1002166b
mov dword [ebp - 0x834], 1
jmp 0x10021672
and dword [ebp - 0x834], 0
cmp dword [ebp - 0x834], 1
jae 0x10021687
mov dword [ebp - 0xab0], 1
jmp 0x1002168e
and dword [ebp - 0xab0], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xf44], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xdb4], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xe74], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x6bc], eax
cmp dword [ebp - 0x6bc], 0
je 0x1002182c
mov dword [ebp - 0xac0], 0
mov dword [ebp - 0xbec], 8
mov dword [ebp - 0x844], 2
mov dword [ebp - 0xac8], 0x2f47d66
mov byte [ebp - 0xb6], 0
movzx eax, byte [ebp - 0xb6]
test eax, eax
je 0x10021708
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
xor eax, eax
inc eax
jne 0x1002171f
cmp dword [ebp - 0xbc4], 0
jne 0x1002171f
and dword [ebp - 0x8f4], 0
jmp 0x10021729
mov dword [ebp - 0x8f4], 1
cmp dword [ebp - 0x8f4], 0x19c5
jg 0x10021741
mov dword [ebp - 0x6c4], 1
jmp 0x10021748
and dword [ebp - 0x6c4], 0
cmp dword [ebp - 0x6c4], 2
je 0x1002175d
mov dword [ebp - 0x83c], 1
jmp 0x10021764
and dword [ebp - 0x83c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x83c]
mov dword [ebp + eax - 0x95c], ecx
mov eax, dword [ebp - 0xab8]
mov dword [ebp - 0xdbc], eax
cmp dword [ebp - 0x54], 0
jne 0x10021795
mov dword [ebp - 0xb94], 1
jmp 0x1002179c
and dword [ebp - 0xb94], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xf00], eax
cmp dword [ebp - 0x844], 0
je 0x100217c3
cmp dword [ebp - 0xac0], 0
je 0x100217c3
mov dword [ebp - 0x6cc], 1
jmp 0x100217ca
and dword [ebp - 0x6cc], 0
cmp dword [ebp - 0x6cc], 0xffffffff
je 0x100217ef
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x95c], 0
je 0x100217ef
mov dword [ebp - 0x6d4], 1
jmp 0x100217f6
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0xbec]
add eax, dword [ebp - 0x6d4]
cmp eax, dword [ebp - 0x844]
je 0x10021816
mov dword [ebp - 0x6dc], 1
jmp 0x1002181d
and dword [ebp - 0x6dc], 0
imul eax, dword [ebp - 0x6dc], 0
mov dword [ebp - 0xac8], eax
jmp 0x10021852
mov byte [ebp - 0xad], 0
movzx eax, byte [ebp - 0xad]
test eax, eax
je 0x10021852
push 0x668b
push 0x63c0
push 0
call fcn.1001c6c6
add esp, 0xc
and dword [ebp - 0x278], 0
jmp 0x10021868
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xd
jae 0x10021883
xor eax, eax
mov ecx, dword [ebp - 0x278]
mov word [ebp + ecx*2 - 0xd54], ax
jmp 0x1002185b
cmp dword [ebp - 0x7c0], 0
je 0x10023bef
mov dword [ebp - 0x110], 0x25b9b55b
mov dword [ebp - 0x340], 0xfffffffb
mov dword [ebp - 0xaf8], 0
mov dword [ebp - 0x70], 0
jmp 0x100218be
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x100218d1
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x30], 0x7689351f
jmp 0x100218b7
mov dword [ebp - 0x70], 0
jmp 0x100218e1
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x100218f7
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xe90], 9
jmp 0x100218da
mov dword [ebp - 0x110], 0x18
jmp 0x10021910
mov eax, dword [ebp - 0x110]
dec eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x16
jle 0x10021eb2
mov dword [ebp - 0x18], 0x417be187
mov dword [ebp - 0x88], 1
mov dword [ebp - 0xbd4], 0x676492a4
mov dword [ebp - 0xdc4], 0x6ea41824
mov dword [ebp - 0xe7c], 0x6c64e719
mov dword [ebp - 0xae8], 0xc90eb1f0
mov dword [ebp - 0x18], 0
jmp 0x10021966
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x10021e77
mov dword [ebp - 0xdcc], 0x3199f2dc
mov dword [ebp - 0xbe4], 0xfffffff7
mov dword [ebp - 0xbcc], 0
mov dword [ebp - 0xb9c], 4
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x30], 0
je 0x10021aeb
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x30]
mov ecx, dword [ebp - 0x18]
cmp eax, dword [ebp + ecx*4 - 0x30]
jge 0x100219d0
mov dword [ebp - 0x8fc], 1
jmp 0x100219d7
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x8fc]
cmp eax, 0xef51
jne 0x100219f4
mov dword [ebp - 0x6e4], 1
jmp 0x100219fb
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x6e4]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xf28], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xdd4], eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jg 0x10021a33
mov dword [ebp - 0x84c], 1
jmp 0x10021a3a
and dword [ebp - 0x84c], 0
cmp dword [ebp - 0x84c], 0xd4a79744
jne 0x10021a52
mov dword [ebp - 0x6ec], 1
jmp 0x10021a59
and dword [ebp - 0x6ec], 0
cmp dword [ebp - 0x6ec], 0xe72ee72c
jae 0x10021a71
mov dword [ebp - 0x984], 1
jmp 0x10021a78
and dword [ebp - 0x984], 0
cmp dword [ebp - 0x984], 2
jl 0x10021a8d
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x30]
add eax, dword [ebp - 0x904]
mov ecx, dword [ebp - 0x18]
cmp eax, dword [ebp + ecx*4 - 0x30]
jg 0x10021b14
mov dword [ebp - 0x704], 1
jmp 0x10021b1b
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x30]
cmp dword [ebp - 0x704], eax
jl 0x10021b36
mov dword [ebp - 0x85c], 1
jmp 0x10021b3d
and dword [ebp - 0x85c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x85c]
sub ecx, dword [ebp + eax - 0x30]
cmp ecx, 0x9448
jge 0x10021b61
mov dword [ebp - 0x70c], 1
jmp 0x10021b68
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x70c]
inc eax
je 0x10021e5e
mov dword [ebp - 0xad0], 0xd79
mov dword [ebp - 0xba4], 0
mov dword [ebp - 0xbac], 0xfff8
mov dword [ebp - 0x228], 0
jmp 0x10021bac
cmp dword [ebp - 0x228], 2
jge 0x10021bc8
mov dword [ebp - 0xbb4], 0xffffffff
mov dword [ebp - 0xbb4], 0xfffffff7
jmp 0x1002195f
mov dword [ebp - 0x88], 2
jmp 0x10021e90
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jl 0x10021ead
mov eax, dword [ebp - 0x88]
cmp dword [ebp + eax*4 - 0xe90], 0
je 0x10021eab
jmp 0x10021ead
jmp 0x10021e83
jmp 0x10021903
push 1
lea ecx, [ebp - 0x978]
call fcn.1001737a
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x118], 1
mov dword [ebp - 0xf08], 0xffffffff
lea eax, [ebp - 0x978]
push eax
lea eax, [ebp - 0xde4]
push eax
push 1
call fcn.1001c6c6
add esp, 0xc
push 0
lea ecx, [ebp - 0x978]
call fcn.10017408
mov dword [eax], 0xa
jmp 0x10021f28
push 0
lea ecx, [ebp - 0x978]
call fcn.10017408
mov dword [ebp - 0x4dc], eax
mov eax, dword [ebp - 0x4dc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4dc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x978]
call fcn.10017408
cmp dword [eax], 0xf
jle 0x1002210a
push 2
lea ecx, [ebp - 0x9e8]
call fcn.1001737a
mov byte [ebp - 4], 0x17
push 1
lea eax, [ebp - 0x9e8]
push eax
lea eax, [ebp - 0xe94]
push eax
call fcn.1001c75b
add esp, 0xc
push 1
lea ecx, [ebp - 0x9e8]
call fcn.10017408
and dword [eax], 0
jmp 0x10021f9d
push 1
lea ecx, [ebp - 0x9e8]
call fcn.10017408
cmp dword [eax], 0
je 0x1002209b
mov dword [ebp - 0xb00], 0xb44adca1
push 0
lea ecx, [ebp - 0x978]
call fcn.10017408
xor eax, eax
cmp eax, 1
je 0x10021fdd
mov dword [ebp - 0x4e8], 1
jmp 0x10021fe4
and dword [ebp - 0x4e8], 0
cmp dword [ebp - 0x4e8], 0
jge 0x10021ff9
mov dword [ebp - 0x4f0], 1
jmp 0x10022000
and dword [ebp - 0x4f0], 0
push 0
lea ecx, [ebp - 0x978]
call fcn.10017408
mov eax, dword [eax]
mov dword [ebp - 0x118], eax
mov esi, dword [ebp - 0x118]
imul esi, dword [ebp - 0x4f0]
push 0
lea ecx, [ebp - 0x978]
call fcn.10017408
cmp dword [eax], esi
jg 0x1002203f
mov dword [ebp - 0x3a4], 1
jmp 0x10022046
and dword [ebp - 0x3a4], 0
push 0
lea ecx, [ebp - 0x9e8]
call fcn.10017408
mov ecx, dword [ebp - 0x3a4]
cmp ecx, dword [eax]
je 0x10022069
mov dword [ebp - 0x500], 1
jmp 0x10022070
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0xb00], eax
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x10022096
mov dword [ebp - 0x118], 6
jmp 0x100220b4
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xfffffff3
jne 0x100220f6
mov dword [ebp - 0xb74], 0xfffffff9
cmp dword [ebp - 0xb74], 0
je 0x100220d2
jmp 0x100220f6
mov byte [ebp - 0xb5], 0
push 0
push 0x7233
push 0x4871
lea eax, [ebp - 0xb5]
push eax
call fcn.1001d2a1
add esp, 0x10
jmp 0x100220a7
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x9e8]
call fcn.10017403
jmp 0x10021f04
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x978]
call fcn.10017403
mov dword [ebp - 0x120], 0x25b9b55b
mov dword [ebp - 0x36c], 0xfffffffb
mov dword [ebp - 0xa14], 0
mov dword [ebp - 0x5c], 0
jmp 0x10022147
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x1002215a
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x2c], 0x7689351f
jmp 0x10022140
mov dword [ebp - 0x5c], 0
jmp 0x1002216a
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x10022180
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xea0], 9
jmp 0x10022163
mov dword [ebp - 0x120], 0x18
jmp 0x10022199
cmp dword [ebp - 0x120], 0x16
jle 0x10022741
mov dword [ebp - 0x14], 0x417be187
mov dword [ebp - 0x8c], 1
mov dword [ebp - 0xa10], 0x676492a4
mov dword [ebp - 0xdec], 0x6ea41824
mov dword [ebp - 0xf48], 0x6c64e719
mov dword [ebp - 0xb90], 0xc90eb1f0
mov dword [ebp - 0x14], 0
jmp 0x100221ef
mov byte [ebp - 0x2fc], 8
mov byte [ebp - 0x2fb], 0xe2
mov byte [ebp - 0x2fa], 4
mov byte [ebp - 0x2f9], 0x2d
mov byte [ebp - 0x2f8], 6
mov byte [ebp - 0x2f7], 0x2e
mov byte [ebp - 0x2f6], 2
mov byte [ebp - 0x2f5], 3
mov byte [ebp - 0x2f4], 7
mov byte [ebp - 0x2f3], 0x13
mov byte [ebp - 0x2f2], 0
mov byte [ebp - 0x2f1], 0x3e
mov byte [ebp - 0x2f0], 5
mov byte [ebp - 0x2ef], 0x25
mov byte [ebp - 0x2ee], 3
mov byte [ebp - 0x2ed], 0xd
mov byte [ebp - 0x2ec], 1
mov byte [ebp - 0x2eb], 0xb
mov byte [ebp - 0x2ea], 0x5c
mov byte [ebp - 0x2e9], 0xac
mov byte [ebp - 0x2e8], 0x2a
mov byte [ebp - 0x2e7], 0xd8
mov byte [ebp - 0x2e6], 0x6b
mov byte [ebp - 0x2e5], 0xe4
mov byte [ebp - 0x2e4], 1
mov byte [ebp - 0x2e3], 0x79
mov byte [ebp - 0x2e2], 0x48
mov byte [ebp - 0x2e1], 0xa2
mov byte [ebp - 0x2e0], 0x1c
mov byte [ebp - 0x2df], 0x3c
mov byte [ebp - 0x2de], 0x81
mov byte [ebp - 0x2dd], 0x16
mov byte [ebp - 0x2dc], 0x7a
mov byte [ebp - 0x2db], 0x3f
mov byte [ebp - 0x2da], 0xce
mov byte [ebp - 0x2d9], 0xa3
mov byte [ebp - 0x2d8], 3
mov byte [ebp - 0x2d7], 0xc9
mov byte [ebp - 0x2d6], 0x97
mov byte [ebp - 0x2d5], 0xa2
mov byte [ebp - 0x2d4], 0x5d
mov byte [ebp - 0x2d3], 0x26
mov byte [ebp - 0x2d2], 0x74
mov byte [ebp - 0x2d1], 0x94
mov byte [ebp - 0x2d0], 0xd1
mov byte [ebp - 0x2cf], 0x51
mov byte [ebp - 0x2ce], 0x3a
mov byte [ebp - 0x2cd], 0xe1
mov byte [ebp - 0x2cc], 0x2a
mov byte [ebp - 0x2cb], 0x9b
mov byte [ebp - 0x2ca], 0x18
mov byte [ebp - 0x2c9], 0xd4
mov byte [ebp - 0x2c8], 0x4f
mov byte [ebp - 0x2c7], 0x35
mov byte [ebp - 0x2c6], 0x15
mov byte [ebp - 0x2c5], 0x61
mov byte [ebp - 0x2c4], 8
mov byte [ebp - 0x2c3], 0x2a
mov byte [ebp - 0x2c2], 0x16
mov byte [ebp - 0x2c1], 0x6f
mov byte [ebp - 0x2c0], 0x20
mov byte [ebp - 0x2bf], 0x54
mov byte [ebp - 0x2be], 0x2a
mov byte [ebp - 0x2bd], 0xba
mov byte [ebp - 0x2bc], 0xd5
mov byte [ebp - 0x2bb], 0xcb
mov byte [ebp - 0x2ba], 0x42
mov byte [ebp - 0x2b9], 0xa
mov byte [ebp - 0x2b8], 0x5a
mov byte [ebp - 0x2b7], 0x49
mov byte [ebp - 0x2b6], 0x1e
mov byte [ebp - 0x2b5], 0x2f
mov byte [ebp - 0x2b4], 0xc2
mov byte [ebp - 0x2b3], 0x15
mov byte [ebp - 0x2b2], 0
mov byte [ebp - 0x2b1], 0x33
mov byte [ebp - 0x2b0], 0x2c
mov byte [ebp - 0x2af], 0xf2
mov byte [ebp - 0x2ae], 0x11
mov byte [ebp - 0x2ad], 0x98
mov byte [ebp - 0x2ac], 1
mov byte [ebp - 0x2ab], 0xa1
mov byte [ebp - 0x2aa], 0xe0
mov byte [ebp - 0x2a9], 0xfd
mov byte [ebp - 0x2a8], 0x92
mov byte [ebp - 0x2a7], 0xd4
mov byte [ebp - 0x2a6], 0x8a
mov byte [ebp - 0x2a5], 0xae
mov byte [ebp - 0x2a4], 2
mov byte [ebp - 0x2a3], 0xdc
mov byte [ebp - 0x2a2], 0xd9
mov byte [ebp - 0x2a1], 0x5f
mov byte [ebp - 0x2a0], 0x21
mov byte [ebp - 0x29f], 0xc0
mov byte [ebp - 0x29e], 0xf6
mov byte [ebp - 0x29d], 0x12
mov byte [ebp - 0x29c], 0x47
mov byte [ebp - 0x29b], 0x16
mov byte [ebp - 0x29a], 0x84
mov byte [ebp - 0x299], 0x73
mov byte [ebp - 0x298], 0xd3
mov byte [ebp - 0x297], 0xd4
mov byte [ebp - 0x296], 0x29
mov byte [ebp - 0x295], 0xaf
mov byte [ebp - 0x294], 0x3f
mov byte [ebp - 0x293], 0xe6
mov byte [ebp - 0x292], 0xf1
mov byte [ebp - 0x291], 0xfd
mov byte [ebp - 0x290], 0xfe
mov byte [ebp - 0x28f], 0x48
mov byte [ebp - 0x28e], 0
mov byte [ebp - 0x28d], 9
mov byte [ebp - 0x28c], 0x1d
mov byte [ebp - 0x28b], 0xb
mov byte [ebp - 0x28a], 0x25
mov byte [ebp - 0x289], 0xa
mov byte [ebp - 0x288], 0x2e
mov dword [ebp - 0x94], 0xfffffffc
mov dword [ebp - 0x348], 0xffffffff
mov dword [ebp - 0x94], 6
jmp 0x10022aa1
mov dword [ebp - 0x98], 0x9be1d925
mov dword [ebp - 0xa84], 0x4d8142c7
mov dword [ebp - 0x3c4], 0x20077fef
mov dword [ebp - 0x224], 0
jmp 0x10023c26
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 3
jge 0x10023c42
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0xec0], 0x648261f9
jmp 0x10023c19
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x10023c62
push 1
push 0x2138
call fcn.1001cd9c
pop ecx
pop ecx
mov dword [ebp - 0x98], 0
jmp 0x10023c7b
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jg 0x10023ee9
mov dword [ebp - 0x22c], 0xe46c
mov dword [ebp - 0x3dc], 0
push 1
lea ecx, [ebp - 0xcb8]
call fcn.1001737a
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0xcb8]
push eax
push 1
lea eax, [ebp - 0xe34]
push eax
call fcn.1001ce50
add esp, 0xc
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec0]
cmp dword [ebp - 0x98], eax
jg 0x10023cfc
mov byte [ebp - 0xb3], 0
push 1
push 0x2cda
lea eax, [ebp - 0xb3]
push eax
call fcn.1001cebe
add esp, 0xc
jmp 0x10023ed5
mov dword [ebp - 0x154], 9
mov dword [ebp - 0x3ec], 5
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0xeec], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0xec0], 1
mov eax, dword [ebp - 0x22c]
dec eax
cmp eax, dword [ebp - 0x98]
jne 0x10023d48
mov dword [ebp - 0x7c8], 1
jmp 0x10023d4f
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x7c8], eax
je 0x10023d69
mov dword [ebp - 0x7d0], 1
jmp 0x10023d70
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0xa84]
imul eax, dword [ebp - 0x7d0]
test eax, eax
je 0x10023d96
cmp dword [ebp - 0x22c], 0
je 0x10023d96
mov dword [ebp - 0x3a8], 1
jmp 0x10023d9d
and dword [ebp - 0x3a8], 0
cmp dword [ebp - 0x3a8], 0xfad0
je 0x10023dbe
mov eax, 0x72b7
test eax, eax
je 0x10023dbe
mov dword [ebp - 0x3ac], 1
jmp 0x10023dc5
and dword [ebp - 0x3ac], 0
cmp dword [ebp - 0x3ac], 0x390f3bd7
je 0x10023ddd
mov dword [ebp - 0x3b4], 1
jmp 0x10023de4
and dword [ebp - 0x3b4], 0
push 0
lea ecx, [ebp - 0xcb8]
call fcn.10017408
mov ecx, dword [ebp - 0x3b4]
sub ecx, dword [eax]
imul ecx, dword [ebp - 0x154]
sub ecx, 0x4a2
cmp ecx, dword [ebp - 0x154]
jle 0x10023e1a
mov dword [ebp - 0x3bc], 1
jmp 0x10023e21
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3dc]
imul eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 3
jae 0x10023e49
mov dword [ebp - 0x3cc], 1
jmp 0x10023e50
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x3cc], eax
je 0x10023e6a
mov dword [ebp - 0x3d4], 1
jmp 0x10023e71
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x22c]
cmp eax, dword [ebp - 0x3d4]
jne 0x10023e8b
mov dword [ebp - 0x3e4], 1
jmp 0x10023e92
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3dc]
cmp dword [ebp - 0x3e4], eax
jge 0x10023ea7
cmp dword [ebp - 0x3ec], 0
imul eax, dword [ebp - 0x3ec], 0xfffffff7
cmp eax, dword [ebp - 0x98]
jg 0x10023ec2
mov dword [ebp - 0x3f4], 1
jmp 0x10023ec9
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x154], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xcb8]
call fcn.10017403
jmp 0x10023c6e
cmp dword [0x1067ddd4], 0
je 0x10023f07
mov ecx, dword [ebp + 8]
call fcn.1002629c
push eax
call dword [0x1067ddd4]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x234], 4
mov dword [ebp - 0x234], 0xfffffff1
jmp 0x10023f2a
mov eax, dword [ebp - 0x234]
dec eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffeb
jl 0x10024019
mov dword [ebp - 0xa8c], 3
mov dword [ebp - 0xa94], 0xf23e93d0
push 1
lea ecx, [ebp - 0xc70]
call fcn.1001737a
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x23c], 0
jmp 0x10023f75
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 1
jge 0x10023f97
push dword [ebp - 0x23c]
lea ecx, [ebp - 0xc70]
call fcn.10017408
mov dword [eax], 0xf4a8fe24
jmp 0x10023f68
mov byte [ebp - 0xd5], 0
push 0x1e71
push 0x628
push 0x52a6
lea eax, [ebp - 0xd5]
push eax
push 1
push 0x39ac
push 0x1b61
call fcn.1001cf1f
add esp, 0x1c
push 0x3c71
lea eax, [ebp - 0xa8c]
push eax
lea eax, [ebp - 0xc70]
push eax
push 0x4518
push 0x1386
lea eax, [ebp - 0xa94]
push eax
push 0x793d
push 1
push 0x47c3
push 0x4960
call fcn.1001d047
add esp, 0x28
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xc70]
call fcn.10017403
jmp 0x10023f1d
cmp dword [ebp - 0x130], 0
je 0x1002474e
movzx eax, byte [0x1067ddc9]
test eax, eax
je 0x10024046
mov ecx, 0x1067ded8
call fcn.10026325
movzx eax, al
test eax, eax
jne 0x1002474e
push 4
lea ecx, [ebp - 0x16c]
call fcn.1001737a
mov byte [ebp - 4], 0x22
push 1
lea ecx, [ebp - 0xc1c]
call fcn.1001737a
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x31c], 0xffffffff
mov dword [ebp - 0x324], 9
push 1
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x2a45
call fcn.1001d2a1
add esp, 0x10
mov dword [ebp - 0x48], 0
jmp 0x100240a6
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x100240c2
push dword [ebp - 0x48]
lea ecx, [ebp - 0xc1c]
call fcn.10017408
mov dword [eax], 0xff93f8de
jmp 0x1002409f
mov dword [ebp - 0x48], 0
jmp 0x100240d2
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x100240e8
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x4b4], 0x84ca67b1
jmp 0x100240cb
push 1
lea ecx, [ebp - 0x16c]
call fcn.10017408
push 1
lea ecx, [ebp - 0x16c]
call fcn.10017408
mov esi, eax
push 1
lea ecx, [ebp - 0x16c]
call fcn.10017408
mov eax, dword [eax]
add eax, 0xfff6
cmp dword [esi], eax
je 0x10024128
mov dword [ebp - 0x3fc], 1
jmp 0x1002412f
and dword [ebp - 0x3fc], 0
cmp dword [ebp - 0x3fc], 1
jbe 0x1002414d
mov eax, 0x77a1
test eax, eax
je 0x1002414d
mov dword [ebp - 0x404], 1
jmp 0x10024154
and dword [ebp - 0x404], 0
push 1
lea ecx, [ebp - 0x16c]
call fcn.10017408
mov ecx, dword [ebp - 0x404]
cmp ecx, dword [eax]
jle 0x10024186
push 1
lea ecx, [ebp - 0x16c]
call fcn.10017408
cmp dword [eax], 0
jne 0x10024186
and dword [ebp - 0x40c], 0
jmp 0x10024190
mov dword [ebp - 0x40c], 1
push 1
lea ecx, [ebp - 0x16c]
call fcn.10017408
mov eax, dword [eax]
cmp eax, dword [ebp - 0x40c]
jge 0x100241b3
mov dword [ebp - 0x414], 1
jmp 0x100241ba
and dword [ebp - 0x414], 0
push 1
lea ecx, [ebp - 0x16c]
call fcn.10017408
mov eax, dword [eax]
cmp eax, dword [ebp - 0x414]
jl 0x100241dd
mov dword [ebp - 0x41c], 1
jmp 0x100241e4
and dword [ebp - 0x41c], 0
push 1
lea ecx, [ebp - 0x16c]
call fcn.10017408
mov ecx, dword [ebp - 0x41c]
cmp ecx, dword [eax]
jl 0x10024207
mov dword [ebp - 0x424], 1
jmp 0x1002420e
and dword [ebp - 0x424], 0
push 1
lea ecx, [ebp - 0x16c]
call fcn.10017408
mov ecx, dword [ebp - 0x424]
cmp ecx, dword [eax]
jge 0x10024550
mov dword [ebp - 0xfc], 0xffff
mov dword [ebp - 0x1c4], 0
push 1
lea ecx, [ebp - 0x16c]
call fcn.10017408
mov ecx, dword [ebp - 0xfc]
cmp dword [eax], ecx
jne 0x10024260
mov dword [ebp - 0x42c], 1
jmp 0x10024267
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x42c], eax
jl 0x10024281
mov dword [ebp - 0x314], 1
jmp 0x10024288
and dword [ebp - 0x314], 0
push 0
lea ecx, [ebp - 0xc1c]
call fcn.10017408
mov ecx, dword [ebp - 0x314]
mov dword [eax], ecx
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0
jne 0x100242cd
push 0
lea ecx, [ebp - 0xc1c]
call fcn.10017408
cmp dword [eax], 0
jne 0x100242cd
and dword [ebp - 0x434], 0
jmp 0x100242d7
mov dword [ebp - 0x434], 1
cmp dword [ebp - 0x434], 0xc3f121f2
jbe 0x100242ef
mov dword [ebp - 0x43c], 1
jmp 0x100242f6
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x43c], eax
jne 0x10024310
mov dword [ebp - 0x444], 1
jmp 0x10024317
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x1c4]
add eax, dword [ebp - 0x444]
cmp eax, dword [ebp - 0x1c4]
jle 0x10024337
mov dword [ebp - 0x44c], 1
jmp 0x1002433e
and dword [ebp - 0x44c], 0
cmp dword [ebp - 0x44c], 0xffffffff
je 0x10024360
push 0xfffffffffffffffe
pop eax
test eax, eax
jne 0x10024360
cmp dword [ebp - 0x31c], 0
jne 0x10024360
and dword [ebp - 0x454], 0
jmp 0x1002436a
mov dword [ebp - 0x454], 1
push 0
lea ecx, [ebp - 0x16c]
call fcn.10017408
mov ecx, dword [ebp - 0x454]
cmp ecx, dword [eax]
je 0x1002438d
mov dword [ebp - 0x45c], 1
jmp 0x10024394
and dword [ebp - 0x45c], 0
cmp dword [ebp - 0x45c], 1
ja 0x100243a9
mov dword [ebp - 0x464], 1
jmp 0x100243b0
and dword [ebp - 0x464], 0
push 1
lea ecx, [ebp - 0x16c]
call fcn.10017408
mov ecx, dword [ebp - 0x464]
cmp ecx, dword [eax]
jge 0x100243d3
mov dword [ebp - 0x46c], 1
jmp 0x100243da
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0x1c4]
sub eax, dword [ebp - 0x324]
cmp eax, 0x19f88dd0
jge 0x10024405
mov dword [ebp - 0x474], 1
jmp 0x1002440c
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x474]
lea eax, [ecx + eax - 0x65d6]
add eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0xfc]
jle 0x10024439
mov dword [ebp - 0x47c], 1
jmp 0x10024440
and dword [ebp - 0x47c], 0
push 2
lea ecx, [ebp - 0x16c]
call fcn.10017408
imul ecx, dword [ebp - 0x47c], 0x7dfe
cmp dword [eax], ecx
jl 0x10024467
mov dword [ebp - 0x484], 1
jmp 0x1002446e
and dword [ebp - 0x484], 0
push 3
lea ecx, [ebp - 0x16c]
call fcn.10017408
mov ecx, dword [ebp - 0x484]
cmp ecx, dword [eax]
jg 0x10024491
mov dword [ebp - 0x48c], 1
jmp 0x10024498
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0x48c]
jle 0x100244b2
mov dword [ebp - 0x494], 1
jmp 0x100244b9
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x1c4]
add eax, dword [ebp - 0x494]
jmp 0x100244d3
and dword [ebp - 0x49c], 0
push 1
lea ecx, [ebp - 0x16c]
call fcn.10017408
mov eax, dword [eax]
cmp eax, dword [ebp - 0x49c]
jle 0x100244fd
mov dword [ebp - 0x4a4], 1
jmp 0x10024504
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x4a4]
inc eax
cmp eax, 3
jne 0x1002451c
mov dword [ebp - 0x4ac], 1
jmp 0x10024523
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x4ac]
neg eax
add eax, 0xffff
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x4b4], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x4b4], 0
jmp 0x1002456b
push 0x6643
push 1
lea eax, [ebp - 0x324]
push eax
push 0x1114
call fcn.1001d31e
add esp, 0x10
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0xc1c]
call fcn.10017403
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x16c]
call fcn.10017403
lea eax, [ebp - 0x4bc]
push eax
mov ecx, 0x1067ded8
call fcn.100262e7
mov ecx, dword [ebp - 0x130]
mov dword [eax], ecx
mov dword [ebp - 0x104], 0xfffffff7
mov dword [ebp - 0xa9c], 0xcd49fcfb
mov dword [ebp - 0x4d4], 0xfffffff8
mov dword [ebp - 0xaac], 0xffffffff
push 4
lea ecx, [ebp - 0xed0]
call fcn.1001737a
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x1cc], 0
jmp 0x100245f4
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 4
jge 0x10024616
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0xed0]
call fcn.10017408
mov dword [eax], 1
jmp 0x100245e7
mov dword [ebp - 0x104], 0
jmp 0x1002462f
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0xffffffea
jle 0x10024738
mov dword [ebp - 0x1dc], 0x17633efc
mov dword [ebp - 0xab4], 0x64f6cbcb
mov dword [ebp - 0x1d4], 0
jmp 0x10024669
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 2
jge 0x10024685
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0xd60], 0xa752
jmp 0x1002465c
mov dword [ebp - 0x1dc], 0xffffffff
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0xe3c], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xd60], 1
mov eax, dword [ebp - 0xa9c]
cmp dword [ebp - 0x104], eax
je 0x100246c6
mov dword [ebp - 0x4c4], 1
jmp 0x100246cd
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x4c4], eax
jle 0x100246e7
mov dword [ebp - 0x4cc], 1
jmp 0x100246ee
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x4d4], eax
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x4d4], eax
jl 0x10024720
mov dword [ebp - 0xaa4], 1
jmp 0x10024727
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0xaac]
mov dword [ebp - 0xab4], eax
jmp 0x10024622
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xed0]
call fcn.10017403
mov byte [0x1067ddc9], 1
mov dword [ebp - 0x1e4], 4
mov dword [ebp - 0x1e4], 0xfffffff1
jmp 0x10024771
mov eax, dword [ebp - 0x1e4]
dec eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0xffffffeb
jl 0x10024847
mov dword [ebp - 0x15c], 3
mov dword [ebp - 0xac4], 0xf23e93d0
push 1
lea ecx, [ebp - 0xcc4]
call fcn.1001737a
mov byte [ebp - 4], 0x25
push 0xd2b
lea eax, [ebp - 0xf18]
push eax
lea eax, [ebp - 0xcc4]
push eax
push 1
call fcn.1001d3cb
add esp, 0x10
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x100247da
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x15c], 0
jmp 0x100247f3
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xc
jge 0x10024833
mov dword [ebp - 0xabc], 0xd60a2215
push 1
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0xabc]
push eax
push 0x7478
lea eax, [ebp - 0xac4]
push eax
lea eax, [ebp - 0xcc4]
push eax
call fcn.1001d47c
add esp, 0x18
jmp 0x100247e6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xcc4]
call fcn.10017403
jmp 0x10024764
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xacc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd18]
call fcn.100171b4
mov eax, dword [ebp - 0xacc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret