Function at 0x17cf54
Capabilities:
Check for time delay via gettickcount
Check http status code
Delete registry value
Disable system features via registry on windows
Get session information
Get session user name
Parse pe header
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x228
push 0
push 0
dec ecx
jne 0x17cf5c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x188e3f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x174]
call fcn.00013c3c
cmp dword [0x2a8fe4], 0
je 0x18836b
xor edx, edx
push ebp
push 0x1882f4
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x250]
mov eax, 0x188e50
call fcn.00031d88
mov edx, dword [ebp - 0x250]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea edx, [ebp - 0xd4]
mov eax, 0x2a8fe4
mov ecx, 4
call fcn.00012840
mov eax, dword [ebp - 0xd4]
mov al, byte [eax]
mov byte [ebp - 0x71], al
xor eax, eax
mov dword [ebp - 0x150], eax
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8ee5]
jne 0x17d8d3
cmp byte [0x2a8e3c], 0
je 0x17d8d3
cmp byte [0x2a8d10], 0
je 0x17d8d3
lea edx, [ebp - 0x254]
mov eax, 5
call fcn.0002d13c
mov edx, dword [ebp - 0x254]
lea eax, [ebp - 0x174]
call fcn.00013ed4
inc dword [ebp - 0x150]
inc dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
xor ebx, ebx
mov bl, byte [eax]
inc dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
movzx eax, byte [eax]
mov dword [ebp - 0x40], eax
shl dword [ebp - 0x40], 8
inc dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
movzx eax, byte [eax]
add dword [ebp - 0x40], eax
shl dword [ebp - 0x40], 8
inc dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
movzx eax, byte [eax]
add dword [ebp - 0x40], eax
shl dword [ebp - 0x40], 8
inc dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
movzx eax, byte [eax]
add dword [ebp - 0x40], eax
inc dword [ebp - 0xd4]
inc dword [ebp - 0xd4]
inc dword [ebp - 0xd4]
inc dword [ebp - 0xd4]
cmp ebx, 1
jb 0x17d8d3
cmp ebx, 0xff
jae 0x17d8d3
lea eax, [ebp - 0x5c]
mov edx, ebx
call fcn.00014200
inc dword [ebp - 0xd4]
lea eax, [ebp - 0x5c]
call fcn.0001409c
mov edx, eax
mov eax, dword [ebp - 0xd4]
mov ecx, ebx
call fcn.00012840
lea edx, [ebp - 0x258]
mov eax, 0x188e54
call fcn.00031d88
mov eax, dword [ebp - 0x258]
mov edx, dword [ebp - 0x5c]
call fcn.000141b8
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jle 0x17d8d3
mov eax, dword [ebp - 0x2c]
cdq
push edx
push eax
mov eax, ebx
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x17d132
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x17d14a
jmp 0x17d136
pop edx
pop eax
jle 0x17d14a
lea eax, [ebp - 0x34]
push eax
mov edx, dword [ebp - 0x2c]
inc edx
mov ecx, ebx
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
jmp 0x17d152
lea eax, [ebp - 0x34]
call fcn.00013c3c
mov edx, dword [ebp - 0x2c]
dec edx
lea eax, [ebp - 0x5c]
call fcn.00014200
lea eax, [ebp - 0xdc]
call fcn.00013c3c
lea edx, [ebp - 0x25c]
mov eax, 0x188e58
call fcn.00031d88
mov eax, dword [ebp - 0x25c]
mov edx, dword [ebp - 0x5c]
call fcn.000141b8
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jle 0x17d1c2
lea eax, [ebp - 0xdc]
push eax
mov ecx, dword [ebp - 0x2c]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x5c]
call fcn.00013ecc
mov ecx, eax
mov edx, dword [ebp - 0x2c]
inc edx
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0xdc]
call fcn.00013ecc
test eax, eax
jne 0x17d1dc
lea eax, [ebp - 0xdc]
call fcn.0002c654
lea edx, [ebp - 0x260]
mov eax, 0x188e5c
call fcn.00031d88
mov ecx, dword [ebp - 0x260]
xor edx, edx
xor eax, eax
call fcn.000fa484
mov ebx, eax
mov eax, ebx
and eax, 0x42ff
cmp eax, 3
jbe 0x17d2b2
lea edx, [ebp - 0x268]
mov eax, 0x188e60
call fcn.00031d88
push dword [ebp - 0x268]
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x26c]
call fcn.00033468
push dword [ebp - 0x26c]
lea edx, [ebp - 0x270]
mov eax, 0x188e64
call fcn.00031d88
push dword [ebp - 0x270]
lea edx, [ebp - 0x274]
mov eax, 3
call fcn.00033438
push dword [ebp - 0x274]
lea edx, [ebp - 0x278]
mov eax, 0x188e64
call fcn.00031d88
push dword [ebp - 0x278]
lea edx, [ebp - 0x27c]
mov eax, 0x42ff
call fcn.00033438
push dword [ebp - 0x27c]
lea eax, [ebp - 0x264]
mov edx, 6
call fcn.00013f8c
mov edx, dword [ebp - 0x264]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
mov byte [ebp - 0x159], 0
xor eax, eax
mov dword [ebp - 0x17c], eax
xor eax, eax
push ebp
push 0x17d8cc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x17c]
push eax
push 1
push 0
push 0
call sub.wtsapi32.dll_WTSEnumerateSessionsA
test eax, eax
je 0x17d881
cmp dword [ebp - 0x158], 0
jbe 0x17d7da
lea edx, [ebp - 0x280]
mov eax, ebx
call fcn.0018a330
mov eax, dword [ebp - 0x280]
call fcn.00013ecc
cdq
push edx
push eax
mov eax, ebx
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x17d32f
cmp eax, dword [esp]
pop edx
pop eax
ja 0x17d7da
jmp 0x17d337
pop edx
pop eax
jg 0x17d7da
mov eax, dword [ebp - 0x158]
dec eax
test eax, eax
jl 0x17d8a1
inc eax
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x17c]
mov eax, dword [edx + eax*4]
cmp eax, dword [ebp - 0x40]
je 0x17d7c6
cmp byte [ebp - 0x159], 0
jne 0x17d7c6
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x17c]
mov al, byte [edx + eax*4 + 8]
test al, al
je 0x17d397
add al, 0xfd
sub al, 2
jae 0x17d7c6
mov dword [ebp - 0x144], 0xf7
mov dword [ebp - 0x14c], 0xf7
mov eax, dword [ebp - 0x2c]
and eax, 0x42ff
xor edx, edx
mov dword [ebp + eax*4 - 0x1e0], edx
mov eax, dword [ebp - 0x2c]
and eax, 0x94ff
xor edx, edx
mov dword [ebp + eax*4 - 0x204], edx
xor eax, eax
push ebp
push 0x17d7bf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x2c]
and eax, 0x94ff
lea eax, [ebp + eax*4 - 0x204]
push eax
push 7
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x17c]
mov eax, dword [edx + eax*4]
push eax
push 0
call sub.wtsapi32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x17d721
lea eax, [ebp - 0x144]
push eax
mov eax, dword [ebp - 0x2c]
and eax, 0x42ff
lea eax, [ebp + eax*4 - 0x1e0]
push eax
push 5
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x17c]
mov eax, dword [edx + eax*4]
push eax
push 0
call sub.wtsapi32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x17d721
cmp dword [ebp - 0x14c], 1
jbe 0x17d741
cmp dword [ebp - 0x14c], 0xf7
jae 0x17d741
cmp dword [ebp - 0x144], 1
jbe 0x17d741
cmp dword [ebp - 0x144], 0xf7
jae 0x17d741
lea eax, [ebp - 0x288]
mov edx, dword [ebp - 0x2c]
and edx, 0x1ff
mov edx, dword [ebp + edx*4 - 0x204]
call fcn.00013e04
mov eax, dword [ebp - 0x288]
lea edx, [ebp - 0x284]
call fcn.00033054
mov eax, dword [ebp - 0x284]
push eax
lea edx, [ebp - 0x28c]
mov eax, dword [ebp - 0xdc]
call fcn.00033054
mov edx, dword [ebp - 0x28c]
pop eax
call fcn.00013fdc
jne 0x17d741
lea eax, [ebp - 0x294]
mov edx, dword [ebp - 0x2c]
and edx, 0x1ff
mov edx, dword [ebp + edx*4 - 0x1e0]
call fcn.00013e04
mov eax, dword [ebp - 0x294]
lea edx, [ebp - 0x290]
call fcn.00033054
mov eax, dword [ebp - 0x290]
push eax
lea edx, [ebp - 0x298]
mov eax, dword [ebp - 0x5c]
call fcn.00033054
mov edx, dword [ebp - 0x298]
pop eax
call fcn.00013fdc
jne 0x17d741
mov byte [ebp - 0x159], 1
push 0
lea eax, [ebp - 0x29c]
mov edx, dword [ebp - 0x34]
call fcn.000144c4
mov eax, dword [ebp - 0x29c]
call fcn.00014538
push eax
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x17c]
mov eax, dword [edx + eax*4]
push eax
mov eax, dword [ebp - 0x40]
push eax
push 0
call sub.WINSTA.DLL_WinStationConnectW
test eax, eax
je 0x17d64c
lea edx, [ebp - 0x2a4]
mov eax, 0x188e68
call fcn.00031d88
push dword [ebp - 0x2a4]
lea edx, [ebp - 0x2a8]
mov eax, 0x188e78
call fcn.00031d88
push dword [ebp - 0x2a8]
push dword [ebp - 0xdc]
lea edx, [ebp - 0x2ac]
mov eax, 0x188e58
call fcn.00031d88
push dword [ebp - 0x2ac]
push dword [ebp - 0x5c]
lea edx, [ebp - 0x2b0]
mov eax, 0x188e7c
call fcn.00031d88
push dword [ebp - 0x2b0]
mov eax, dword [ebp - 0x40]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2b4]
call fcn.00033468
push dword [ebp - 0x2b4]
lea edx, [ebp - 0x2b8]
mov eax, 0x188e80
call fcn.00031d88
push dword [ebp - 0x2b8]
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x17c]
mov eax, dword [edx + eax*4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2bc]
call fcn.00033468
push dword [ebp - 0x2bc]
lea eax, [ebp - 0x2a0]
mov edx, 9
call fcn.00013f8c
mov edx, dword [ebp - 0x2a0]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
jmp 0x17d741
lea edx, [ebp - 0x2c4]
mov eax, 0x188e88
call fcn.00031d88
push dword [ebp - 0x2c4]
lea edx, [ebp - 0x2c8]
mov eax, 0x188e78
call fcn.00031d88
push dword [ebp - 0x2c8]
push dword [ebp - 0xdc]
lea edx, [ebp - 0x2cc]
mov eax, 0x188e58
call fcn.00031d88
push dword [ebp - 0x2cc]
push dword [ebp - 0x5c]
lea edx, [ebp - 0x2d0]
mov eax, 0x188e7c
call fcn.00031d88
push dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x40]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2d4]
call fcn.00033468
push dword [ebp - 0x2d4]
lea edx, [ebp - 0x2d8]
mov eax, 0x188e80
call fcn.00031d88
push dword [ebp - 0x2d8]
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x17c]
mov eax, dword [edx + eax*4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2dc]
call fcn.00033468
push dword [ebp - 0x2dc]
lea eax, [ebp - 0x2c0]
mov edx, 9
call fcn.00013f8c
mov edx, dword [ebp - 0x2c0]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
jmp 0x17d741
lea edx, [ebp - 0x2e0]
mov eax, 0x188ea0
call fcn.00031d88
mov edx, dword [ebp - 0x2e0]
mov eax, dword [0x2a8dd0]
call fcn.00138970
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x17d7c6
mov eax, dword [ebp - 0x2c]
and eax, 0x42ff
cmp dword [ebp + eax*4 - 0x1e0], 0
je 0x17d775
mov eax, dword [ebp - 0x2c]
and eax, 0x42ff
mov eax, dword [ebp + eax*4 - 0x1e0]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x2c]
and eax, 0x42ff
xor edx, edx
mov dword [ebp + eax*4 - 0x1e0], edx
mov eax, dword [ebp - 0x2c]
and eax, 0x42ff
cmp dword [ebp + eax*4 - 0x204], 0
je 0x17d7ad
mov eax, dword [ebp - 0x2c]
and eax, 0x42ff
mov eax, dword [ebp + eax*4 - 0x204]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
mov eax, dword [ebp - 0x2c]
and eax, 0x42ff
xor edx, edx
mov dword [ebp + eax*4 - 0x204], edx
ret
inc dword [ebp - 0x2c]
dec dword [ebp - 0x18c]
jne 0x17d354
jmp 0x17d8a1
lea edx, [ebp - 0x2e8]
mov eax, 0x188e60
call fcn.00031d88
push dword [ebp - 0x2e8]
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2ec]
call fcn.00033468
push dword [ebp - 0x2ec]
lea edx, [ebp - 0x2f0]
mov eax, 0x188e64
call fcn.00031d88
push dword [ebp - 0x2f0]
lea edx, [ebp - 0x2f4]
mov eax, 3
call fcn.00033438
push dword [ebp - 0x2f4]
lea edx, [ebp - 0x2f8]
mov eax, 0x188e64
call fcn.00031d88
push dword [ebp - 0x2f8]
lea edx, [ebp - 0x2fc]
mov eax, 0x42ff
call fcn.00033438
push dword [ebp - 0x2fc]
lea eax, [ebp - 0x2e4]
mov edx, 6
call fcn.00013f8c
mov edx, dword [ebp - 0x2e4]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
jmp 0x17d8a1
lea edx, [ebp - 0x300]
mov eax, 0x188ea8
call fcn.00031d88
mov edx, dword [ebp - 0x300]
mov eax, dword [0x2a8dd0]
call fcn.00138970
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x17d8d3
cmp dword [ebp - 0x17c], 0
je 0x17d8c3
mov eax, dword [ebp - 0x17c]
push eax
call sub.wtsapi32.dll_WTSFreeMemory
xor eax, eax
mov dword [ebp - 0x17c], eax
ret
cmp byte [ebp - 0x71], 0xfd
jne 0x17db15
cmp byte [0x2a8e3c], 0
je 0x17db15
lea edx, [ebp - 0x304]
mov eax, 4
call fcn.0002d13c
mov edx, dword [ebp - 0x304]
lea eax, [ebp - 0x174]
call fcn.00013ed4
inc dword [ebp - 0x150]
inc dword [ebp - 0xd4]
cmp byte [0x2a8d10], 0
je 0x17d930
mov eax, dword [ebp - 0xd4]
mov word [eax], 0x5b
jmp 0x17da95
cmp byte [0x2a8e2c], 0
je 0x17d949
mov eax, dword [ebp - 0xd4]
mov word [eax], 0x305b
jmp 0x17da95
lea ecx, [ebp - 0x308]
mov dx, 0x230
mov eax, dword [0x5ec530]
call fcn.000493a4
mov eax, dword [ebp - 0x308]
call fcn.00013ecc
cmp eax, 7
jne 0x17da8a
lea ecx, [ebp - 0x30c]
mov dx, 0x230
mov eax, dword [0x5ec530]
call fcn.000493a4
mov eax, dword [ebp - 0x30c]
push eax
lea edx, [ebp - 0x310]
mov eax, 0x188eb0
call fcn.00031d88
mov eax, dword [ebp - 0x310]
pop edx
call fcn.000141b8
test eax, eax
jg 0x17da95
lea ecx, [ebp - 0x314]
mov dx, 0x230
mov eax, dword [0x5ec530]
call fcn.000493a4
mov eax, dword [ebp - 0x314]
push eax
lea edx, [ebp - 0x318]
mov eax, 0x188eb8
call fcn.00031d88
mov eax, dword [ebp - 0x318]
pop edx
call fcn.000141b8
test eax, eax
jle 0x17d9fb
mov eax, dword [ebp - 0xd4]
mov word [eax], 0x505b
jmp 0x17da95
lea ecx, [ebp - 0x31c]
mov dx, 0x230
mov eax, dword [0x5ec530]
call fcn.000493a4
mov eax, dword [ebp - 0x31c]
push eax
lea edx, [ebp - 0x320]
mov eax, 0x188ec0
call fcn.00031d88
mov eax, dword [ebp - 0x320]
pop edx
call fcn.000141b8
test eax, eax
jne 0x17da7d
lea ecx, [ebp - 0x324]
mov dx, 0x230
mov eax, dword [0x5ec530]
call fcn.000493a4
mov eax, dword [ebp - 0x324]
push eax
lea edx, [ebp - 0x328]
mov eax, 0x188ec8
call fcn.00031d88
mov eax, dword [ebp - 0x328]
pop edx
call fcn.000141b8
dec eax
jne 0x17da7d
mov eax, dword [ebp - 0xd4]
mov word [eax], 0x515b
jmp 0x17da95
mov eax, dword [ebp - 0xd4]
mov word [eax], 0x205b
jmp 0x17da95
mov eax, dword [ebp - 0xd4]
mov word [eax], 0x205b
mov eax, dword [ebp - 0xd4]
movzx eax, word [eax]
call fcn.000eb248
xor eax, eax
push ebp
push 0x17dac5
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0017ca40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x17db15
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8ee2]
jne 0x17db96
cmp byte [0x2a8e3c], 0
je 0x17db96
cmp byte [0x2a8d10], 0
je 0x17db96
lea edx, [ebp - 0x330]
mov eax, 2
call fcn.0002d13c
mov edx, dword [ebp - 0x330]
lea eax, [ebp - 0x174]
call fcn.00013ed4
inc dword [ebp - 0x150]
inc dword [ebp - 0xd4]
cmp byte [0x2a8d10], 0
je 0x17db75
mov eax, dword [ebp - 0xd4]
mov word [eax], 0x405b
jmp 0x17db96
cmp byte [0x2a8e2c], 0
je 0x17db8b
mov eax, dword [ebp - 0xd4]
mov word [eax], 0x205b
jmp 0x17db96
mov eax, dword [ebp - 0xd4]
mov word [eax], 0x305b
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8ee3]
jne 0x17dcdb
cmp byte [0x2a8e3c], 0
je 0x17dcdb
cmp byte [0x2a8d10], 0
je 0x17dcdb
lea edx, [ebp - 0x334]
mov eax, 3
call fcn.0002d13c
mov edx, dword [ebp - 0x334]
lea eax, [ebp - 0x174]
call fcn.00013ed4
inc dword [ebp - 0x150]
inc dword [ebp - 0xd4]
mov dx, 0x15b
mov eax, dword [0x5ee050]
call fcn.0004935c
add al, 0x64
and al, 0xff
mov edx, dword [ebp - 0xd4]
mov byte [edx], al
mov dx, 0x15c
mov eax, dword [0x5ee050]
call fcn.0004935c
test al, al
je 0x17dc2e
mov dx, 0x15d
mov eax, dword [0x5ee050]
call fcn.0004935c
cmp al, 3
jne 0x17dcdb
xor ecx, ecx
mov dx, 0x15e
mov eax, dword [0x5ee050]
call fcn.00049380
lea edx, [ebp - 0x338]
mov eax, 0x188edc
call fcn.00031d88
mov edx, dword [ebp - 0x338]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
xor eax, eax
push ebp
push 0x17dcc8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x2a8e28], 0xffffffff
cmp dword [0x2a8d5c], 0
je 0x17dc89
mov eax, dword [0x2a8d5c]
mov edx, dword [eax]
call dword [edx + 0x44]
push 1
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x151a4c]
call fcn.0018b5ac
mov edx, dword [ebp - 4]
mov dword [edx + 0x104], eax
mov dx, 0x15f
mov eax, dword [0x5ee050]
call fcn.0004935c
add al, 0x64
and al, 0xff
mov edx, dword [ebp - 0xd4]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x17dcdb
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8ee7]
jne 0x17dd94
cmp byte [0x2a8e3c], 0
je 0x17dd94
cmp byte [0x2a8d10], 0
je 0x17dd94
lea edx, [ebp - 0x33c]
mov eax, 7
call fcn.0002d13c
mov edx, dword [ebp - 0x33c]
lea eax, [ebp - 0x174]
call fcn.00013ed4
inc dword [ebp - 0x150]
inc dword [ebp - 0xd4]
call fcn.00136e40
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x17dd8b
mov eax, dword [ebp - 0xd4]
mov byte [eax], 1
lea edx, [ebp - 0x340]
mov eax, 0x188ef0
call fcn.00031d88
lea eax, [ebp - 0x340]
push eax
lea edx, [ebp - 0x344]
mov eax, dword [ebp - 0x2c]
call fcn.00033438
mov edx, dword [ebp - 0x344]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x340]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
jmp 0x17dd94
mov eax, dword [ebp - 0xd4]
mov byte [eax], 2
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8ee6]
jne 0x17ded1
cmp byte [0x2a8e3c], 0
je 0x17ded1
cmp byte [0x2a8d10], 0
je 0x17ded1
lea edx, [ebp - 0x348]
mov eax, 6
call fcn.0002d13c
mov edx, dword [ebp - 0x348]
lea eax, [ebp - 0x174]
call fcn.00013ed4
inc dword [ebp - 0x150]
inc dword [ebp - 0xd4]
lea edx, [ebp - 0x34c]
mov eax, 0x188f00
call fcn.00031d88
mov eax, dword [ebp - 0x34c]
push eax
lea eax, [ebp - 0xf0]
push eax
xor ecx, ecx
mov edx, dword [0x2a8dd0]
or eax, 0xffffffff
call fcn.00136efc
lea edx, [ebp - 0x350]
mov eax, 0x188f08
call fcn.00031d88
mov edx, dword [ebp - 0x350]
mov eax, dword [ebp - 0xf0]
call fcn.00013fdc
je 0x17dea0
call fcn.00136e40
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x17de95
mov eax, dword [ebp - 0xd4]
mov byte [eax], 0xb
lea edx, [ebp - 0x354]
mov eax, 0x188ef0
call fcn.00031d88
lea eax, [ebp - 0x354]
push eax
lea edx, [ebp - 0x358]
mov eax, dword [ebp - 0x2c]
call fcn.00033438
mov edx, dword [ebp - 0x358]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x354]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
jmp 0x17ded1
mov eax, dword [ebp - 0xd4]
mov byte [eax], 0xc
jmp 0x17ded1
lea edx, [ebp - 0x35c]
mov eax, 0x188f0c
call fcn.00031d88
lea eax, [ebp - 0x35c]
mov edx, dword [ebp - 0xf0]
call fcn.00013ed4
mov edx, dword [ebp - 0x35c]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8ee8]
jne 0x17dffb
cmp byte [0x2a8e3c], 0
je 0x17dffb
cmp byte [0x2a8d10], 0
je 0x17dffb
lea edx, [ebp - 0x360]
mov eax, 8
call fcn.0002d13c
mov edx, dword [ebp - 0x360]
lea eax, [ebp - 0x174]
call fcn.00013ed4
inc dword [ebp - 0x150]
inc dword [ebp - 0xd4]
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0xd4]
mov ecx, 4
call fcn.00012840
cmp dword [ebp - 0x40], 0xffffffff
je 0x17df6e
lea edx, [ebp - 0x364]
mov eax, 0x188f34
call fcn.00031d88
mov eax, dword [ebp - 0x364]
push eax
lea eax, [ebp - 0xf0]
push eax
xor ecx, ecx
mov edx, dword [0x2a8dd0]
mov eax, dword [ebp - 0x40]
call fcn.00136efc
lea edx, [ebp - 0x368]
mov eax, 0x188f08
call fcn.00031d88
mov edx, dword [ebp - 0x368]
mov eax, dword [ebp - 0xf0]
call fcn.00013fdc
je 0x17dffb
lea edx, [ebp - 0x370]
mov eax, 0x188f3c
call fcn.00031d88
push dword [ebp - 0x370]
mov eax, dword [ebp - 0x40]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x374]
call fcn.00033468
push dword [ebp - 0x374]
lea edx, [ebp - 0x378]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0x378]
push dword [ebp - 0xf0]
lea eax, [ebp - 0x36c]
mov edx, 4
call fcn.00013f8c
mov edx, dword [ebp - 0x36c]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8ee1]
jne 0x17e167
cmp byte [0x2a8e3c], 0
je 0x17e167
cmp byte [0x2a8d10], 0
je 0x17e167
lea edx, [ebp - 0x37c]
mov eax, 1
call fcn.0002d13c
mov edx, dword [ebp - 0x37c]
lea eax, [ebp - 0x174]
call fcn.00013ed4
inc dword [ebp - 0x150]
inc dword [ebp - 0xd4]
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0xd4]
mov ecx, 4
call fcn.00012840
cmp dword [ebp - 0x40], 1
je 0x17e167
lea edx, [ebp - 0x384]
mov eax, 0x188f68
call fcn.00031d88
mov eax, dword [ebp - 0x384]
push eax
lea eax, [ebp - 0x380]
push eax
xor ecx, ecx
mov edx, dword [0x2a8dd0]
mov eax, dword [ebp - 0x40]
call fcn.00136efc
mov eax, dword [ebp - 0x380]
push eax
lea edx, [ebp - 0x388]
mov eax, 0x188f70
call fcn.00031d88
mov ecx, dword [ebp - 0x388]
lea eax, [ebp - 0xf0]
pop edx
call fcn.00013f18
lea eax, [ebp - 0x38c]
mov edx, dword [ebp - 0xf0]
mov dl, byte [edx]
call fcn.00013de4
mov eax, dword [ebp - 0x38c]
push eax
lea edx, [ebp - 0x390]
mov eax, 0x188f74
call fcn.00031d88
mov edx, dword [ebp - 0x390]
pop eax
call fcn.00013fdc
je 0x17e167
lea edx, [ebp - 0x398]
mov eax, 0x188f3c
call fcn.00031d88
push dword [ebp - 0x398]
mov eax, dword [ebp - 0x40]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x39c]
call fcn.00033468
push dword [ebp - 0x39c]
lea edx, [ebp - 0x3a0]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0x3a0]
push dword [ebp - 0xf0]
lea eax, [ebp - 0x394]
mov edx, 4
call fcn.00013f8c
mov edx, dword [ebp - 0x394]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8f06]
jne 0x17e538
cmp byte [0x2a8e3c], 0
je 0x17e538
cmp byte [0x2a8d10], 0
je 0x17e538
lea edx, [ebp - 0x3a4]
mov eax, 0x7d
call fcn.0002c224
mov edx, dword [ebp - 0x3a4]
lea eax, [ebp - 0x174]
call fcn.00013ed4
inc dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov dword [ebp - 0xac], eax
add dword [ebp - 0xd4], 4
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
add dword [ebp - 0xd4], 4
cmp eax, 8
jne 0x17e40f
cmp dword [ebp - 0xac], 0
jb 0x17e3c6
cmp dword [ebp - 0xac], 0xffffffff
je 0x17e3c6
lea edx, [ebp - 0x3a8]
mov eax, 0x7e
call fcn.0002c224
mov edx, dword [ebp - 0x3a8]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea edx, [ebp - 0x96]
mov eax, dword [ebp - 0xd4]
mov ecx, 0xa
call fcn.00012840
call fcn.00019270
mov dword [ebp - 0xa0], eax
xor eax, eax
push ebp
push 0x17e29f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0xa0]
lea edx, [ebp - 0x96]
mov eax, dword [ebp - 0xac]
call fcn.000b94e4
lea edx, [ebp - 0x3ac]
mov eax, dword [ebp - 0xa0]
call fcn.00018c10
mov edx, dword [ebp - 0x3ac]
mov eax, dword [0x2a8dd0]
call fcn.00138a38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x17e2a6
lea eax, [ebp - 0xa0]
call fcn.00019280
ret
lea edx, [ebp - 0x3dc]
mov eax, 0x188f78
call fcn.00031d88
lea eax, [ebp - 0x3dc]
push eax
lea edx, [ebp - 0x3e0]
mov eax, dword [ebp - 0xac]
call fcn.0002d1ec
mov edx, dword [ebp - 0x3e0]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x3dc]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x17e532
cmp eax, 9
jne 0x17e532
cmp dword [ebp - 0xac], 0
jb 0x17e4ee
cmp dword [ebp - 0xac], 0xffffffff
je 0x17e4ee
lea edx, [ebp - 0x3e4]
mov eax, 0x80
call fcn.0002c224
mov edx, dword [ebp - 0x3e4]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x96]
xor ecx, ecx
mov edx, 0xa
call fcn.00012b94
call fcn.00019270
mov dword [ebp - 0xa0], eax
xor eax, eax
push ebp
push 0x17e4cf
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x96]
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xac]
call fcn.000b9610
lea edx, [ebp - 0x3e8]
mov eax, dword [ebp - 0xa0]
call fcn.00018c10
mov edx, dword [ebp - 0x3e8]
mov eax, dword [0x2a8dd0]
call fcn.00138a38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x17e4d6
lea eax, [ebp - 0xa0]
call fcn.00019280
ret
lea edx, [ebp - 0x3ec]
mov eax, 0x188f78
call fcn.00031d88
lea eax, [ebp - 0x3ec]
push eax
lea edx, [ebp - 0x3f0]
mov eax, dword [ebp - 0xac]
call fcn.0002d1ec
mov edx, dword [ebp - 0x3f0]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x3ec]
mov eax, dword [0x2a8dd0]
call fcn.00138970
inc dword [ebp - 0x150]
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8f07]
jne 0x17e57c
cmp byte [0x2a8e3c], 0
je 0x17e57c
cmp byte [0x2a8d10], 0
je 0x17e57c
lea edx, [ebp - 0x3f4]
mov eax, 0x8a
call fcn.0002c224
mov edx, dword [ebp - 0x3f4]
lea eax, [ebp - 0x174]
call fcn.00013ed4
inc dword [ebp - 0x150]
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8efb]
jne 0x17e5ec
cmp byte [0x2a8e3c], 0
je 0x17e5ec
cmp byte [0x2a8d10], 0
je 0x17e5ec
lea edx, [ebp - 0x3f8]
mov eax, 0x2b
call fcn.0002d13c
mov edx, dword [ebp - 0x3f8]
lea eax, [ebp - 0x174]
call fcn.00013ed4
inc dword [ebp - 0x150]
inc dword [ebp - 0xd4]
mov eax, dword [0x2a8dd0]
call fcn.0005d7ec
test al, al
je 0x17e5e1
mov eax, dword [ebp - 0xd4]
mov word [eax], 1
jmp 0x17e5ec
mov eax, dword [ebp - 0xd4]
mov word [eax], 2
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8ef9]
jne 0x17e6b9
cmp byte [0x2a8e3c], 0
je 0x17e6b9
cmp byte [0x2a8d10], 0
je 0x17e6b9
lea edx, [ebp - 0x3fc]
mov eax, 0x29
call fcn.0002d13c
mov edx, dword [ebp - 0x3fc]
lea eax, [ebp - 0x174]
call fcn.00013ed4
inc dword [ebp - 0x150]
inc dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
mov bx, word [eax]
test bx, bx
jbe 0x17e699
cmp bx, 0xc8
jae 0x17e699
add dword [ebp - 0xd4], 2
movzx edx, bx
lea eax, [ebp - 0xe8]
call fcn.00014200
lea eax, [ebp - 0xe8]
call fcn.0001409c
mov edx, eax
movzx ecx, bx
mov eax, dword [ebp - 0xd4]
call fcn.00012840
mov edx, dword [ebp - 0xe8]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x17e6b9
lea edx, [ebp - 0x400]
mov eax, 0x188f84
call fcn.00031d88
mov edx, dword [ebp - 0x400]
mov eax, dword [0x2a8dd0]
call fcn.00138970
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8efa]
jne 0x17e786
cmp byte [0x2a8e3c], 0
je 0x17e786
cmp byte [0x2a8d10], 0
je 0x17e786
lea edx, [ebp - 0x404]
mov eax, 0x2a
call fcn.0002d13c
mov edx, dword [ebp - 0x404]
lea eax, [ebp - 0x174]
call fcn.00013ed4
inc dword [ebp - 0x150]
inc dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
mov bx, word [eax]
test bx, bx
jbe 0x17e766
cmp bx, 0xc8
jae 0x17e766
add dword [ebp - 0xd4], 2
movzx edx, bx
lea eax, [ebp - 0xe8]
call fcn.00014200
lea eax, [ebp - 0xe8]
call fcn.0001409c
mov edx, eax
movzx ecx, bx
mov eax, dword [ebp - 0xd4]
call fcn.00012840
mov edx, dword [ebp - 0xe8]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
jmp 0x17e786
lea edx, [ebp - 0x408]
mov eax, 0x188f84
call fcn.00031d88
mov edx, dword [ebp - 0x408]
mov eax, dword [0x2a8dd0]
call fcn.00138970
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8f01]
jne 0x17f231
cmp byte [0x2a8e3c], 0
je 0x17f231
cmp byte [0x2a8d10], 0
je 0x17f231
lea edx, [ebp - 0x40c]
mov eax, 0x37
call fcn.0002d13c
mov edx, dword [ebp - 0x40c]
lea eax, [ebp - 0x174]
call fcn.00013ed4
inc dword [ebp - 0x150]
inc dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
mov ebx, dword [eax]
add dword [ebp - 0xd4], 4
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
add dword [ebp - 0xd4], 4
add dword [ebp - 0xd4], 4
cmp ebx, 1
jb 0x17f231
cmp ebx, 0x258
jae 0x17f231
lea edx, [ebp - 0x410]
mov eax, 0x38
call fcn.0002d13c
mov edx, dword [ebp - 0x410]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x5c]
mov edx, ebx
call fcn.00014200
lea eax, [ebp - 0x5c]
call fcn.0001409c
mov edx, eax
mov eax, dword [ebp - 0xd4]
mov ecx, ebx
call fcn.00012840
lea eax, [ebp - 0x44]
call fcn.00013c3c
call fcn.0002da8c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xb0]
call fcn.0002dfe8
lea edx, [ebp - 0xd8]
mov eax, dword [ebp - 0xb0]
call fcn.00060b44
lea ecx, [ebp - 0x44]
lea edx, [ebp - 0xd8]
mov eax, dword [ebp - 0x5c]
call fcn.00060f78
mov eax, dword [ebp - 0x44]
call fcn.00013ecc
test eax, eax
je 0x17e8d3
lea eax, [ebp - 0x414]
push eax
mov ecx, 0x1b
mov edx, 1
mov eax, dword [ebp - 0x44]
call fcn.000140d4
mov eax, dword [ebp - 0x414]
mov edx, 0x188f94
call fcn.00013fdc
je 0x17e912
call fcn.0002da8c
fsub qword [0x2a8e8c]
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xb0]
call fcn.0002dfe8
lea edx, [ebp - 0xd8]
mov eax, dword [ebp - 0xb0]
call fcn.00060b44
lea ecx, [ebp - 0x44]
lea edx, [ebp - 0xd8]
mov eax, dword [ebp - 0x5c]
call fcn.00060f78
lea eax, [ebp - 0x5c]
mov edx, dword [ebp - 0x44]
call fcn.00013cd4
lea edx, [ebp - 0x418]
mov eax, 0x188e54
call fcn.00031d88
mov eax, dword [ebp - 0x418]
mov edx, dword [ebp - 0x5c]
call fcn.000141b8
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x5c]
call fcn.00013ecc
test eax, eax
je 0x17e97b
lea eax, [ebp - 0x41c]
push eax
mov ecx, 0x1b
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0x41c]
mov edx, 0x188f94
call fcn.00013fdc
jne 0x17e97b
cmp dword [ebp - 0x2c], 1
jg 0x17e9a0
lea edx, [ebp - 0x420]
mov eax, 0x188fb0
call fcn.00031d88
mov edx, dword [ebp - 0x420]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x17f231
lea edx, [ebp - 0x424]
mov eax, 0x39
call fcn.0002d13c
mov edx, dword [ebp - 0x424]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x5c]
mov ecx, 0x1b
mov edx, 1
call fcn.00014114
mov eax, dword [ebp - 0x5c]
call fcn.00013ecc
mov ebx, eax
lea edx, [ebp - 0x428]
mov eax, 0x188e54
call fcn.00031d88
mov eax, dword [ebp - 0x428]
mov edx, dword [ebp - 0x5c]
call fcn.000141b8
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jle 0x17ea18
lea eax, [ebp - 0x34]
push eax
mov edx, dword [ebp - 0x2c]
inc edx
mov ecx, ebx
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
jmp 0x17ea20
lea eax, [ebp - 0x34]
call fcn.00013c3c
mov edx, dword [ebp - 0x2c]
dec edx
lea eax, [ebp - 0x5c]
call fcn.00014200
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 0x34]
call fcn.0001e384
lea edx, [ebp - 0x42c]
mov eax, 0x188e58
call fcn.00031d88
mov eax, dword [ebp - 0x42c]
mov edx, dword [ebp - 0x5c]
call fcn.000141b8
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jle 0x17ea8d
lea eax, [ebp - 0xdc]
push eax
mov ecx, dword [ebp - 0x2c]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
lea eax, [ebp - 0x5c]
push eax
mov edx, dword [ebp - 0x2c]
inc edx
mov ecx, ebx
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
jmp 0x17ea98
lea eax, [ebp - 0xdc]
call fcn.00013c3c
lea edx, [ebp - 0xf8]
mov eax, dword [ebp - 0xdc]
call fcn.0001e384
lea edx, [ebp - 0x104]
mov eax, dword [ebp - 0x5c]
call fcn.0001e384
lea edx, [ebp - 0x430]
mov eax, 0x3a
call fcn.0002d13c
mov edx, dword [ebp - 0x430]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea edx, [ebp - 0x434]
mov eax, 0x188fbc
call fcn.00031d88
mov ecx, dword [ebp - 0x434]
xor edx, edx
xor eax, eax
call fcn.000fa484
mov ebx, eax
mov eax, ebx
and eax, 0x42ff
cmp eax, 3
jbe 0x17ebae
lea edx, [ebp - 0x43c]
mov eax, 0x188e60
call fcn.00031d88
push dword [ebp - 0x43c]
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x440]
call fcn.00033468
push dword [ebp - 0x440]
lea edx, [ebp - 0x444]
mov eax, 0x188e64
call fcn.00031d88
push dword [ebp - 0x444]
lea edx, [ebp - 0x448]
mov eax, 3
call fcn.00033438
push dword [ebp - 0x448]
lea edx, [ebp - 0x44c]
mov eax, 0x188e64
call fcn.00031d88
push dword [ebp - 0x44c]
lea edx, [ebp - 0x450]
mov eax, 0x42ff
call fcn.00033438
push dword [ebp - 0x450]
lea eax, [ebp - 0x438]
mov edx, 6
call fcn.00013f8c
mov edx, dword [ebp - 0x438]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
lea edx, [ebp - 0x454]
mov eax, 0x3b
call fcn.0002d13c
mov edx, dword [ebp - 0x454]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov byte [ebp - 0x159], 0
xor eax, eax
mov dword [ebp - 0x168], eax
lea eax, [ebp - 0x168]
mov edx, 0x2ee0
call fcn.0002aea4
call fcn.00019298
mov dword [ebp - 0xc0], eax
xor eax, eax
push ebp
push 0x17f22a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc0]
push eax
lea edx, [ebp - 0x458]
mov eax, 0x188fc0
call fcn.00031d88
mov eax, dword [ebp - 0x458]
push eax
lea ecx, [ebp - 0x158]
lea eax, [ebp - 0x168]
mov edx, 0x3e8
call fcn.000f8cbc
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jne 0x17f18d
lea edx, [ebp - 0x45c]
mov eax, 0x3c
call fcn.0002d13c
mov edx, dword [ebp - 0x45c]
lea eax, [ebp - 0x174]
call fcn.00013ed4
cmp dword [ebp - 0x158], 0
jbe 0x17f0b2
lea edx, [ebp - 0x460]
mov eax, ebx
call fcn.0018a330
mov eax, dword [ebp - 0x460]
call fcn.00013ecc
cdq
push edx
push eax
mov eax, ebx
xor edx, edx
cmp edx, dword [esp + 4]
jne 0x17ecae
cmp eax, dword [esp]
pop edx
pop eax
ja 0x17f0b2
jmp 0x17ecb6
pop edx
pop eax
jg 0x17f0b2
push dword [ebp - 0xf8]
push 0x188fc8
push dword [ebp - 0x104]
lea eax, [ebp - 0x464]
mov edx, 3
call fcn.00014618
mov eax, dword [ebp - 0x464]
lea edx, [ebp - 0x44]
call fcn.0001dfe4
mov eax, dword [ebp - 0x158]
dec eax
test eax, eax
jl 0x17f157
inc eax
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x2c], 0
cmp byte [ebp - 0x159], 0
jne 0x17f09e
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x168]
mov eax, dword [edx + eax*4]
cmp eax, dword [ebp - 0x40]
je 0x17f09e
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x168]
mov al, byte [edx + eax*4 + 8]
test al, al
je 0x17ed45
add al, 0xfd
sub al, 2
jae 0x17f09e
lea eax, [ebp - 0x16c]
call fcn.00014314
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x184]
push eax
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x168]
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0x17d]
lea edx, [ebp - 0x140]
call fcn.000adcb4
lea eax, [ebp - 0x16c]
call fcn.00014314
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x160]
push eax
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x168]
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0x175]
lea edx, [ebp - 0x140]
call fcn.000ae5f8
mov al, byte [ebp - 0x17d]
and al, byte [ebp - 0x175]
je 0x17f05d
mov eax, dword [ebp - 0x184]
call fcn.00014548
test eax, eax
jle 0x17f05d
mov eax, dword [ebp - 0x160]
call fcn.00014548
test eax, eax
jle 0x17f05d
mov eax, dword [ebp - 0x184]
call fcn.00014548
cmp eax, 0xf7
jg 0x17f05d
mov eax, dword [ebp - 0x160]
call fcn.00014548
cmp eax, 0xf7
jg 0x17f05d
push dword [ebp - 0x160]
push 0x188fc8
push dword [ebp - 0x184]
lea eax, [ebp - 0x468]
mov edx, 3
call fcn.00014618
mov eax, dword [ebp - 0x468]
lea edx, [ebp - 0x4c]
call fcn.0001dfe4
lea eax, [ebp - 0xf0]
call fcn.00013c3c
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 0x44]
call fcn.00013fdc
jne 0x17ee77
lea edx, [ebp - 0xf0]
mov eax, 0x188fcc
call fcn.00031d88
jmp 0x17efe3
lea edx, [ebp - 0x46c]
mov eax, dword [ebp - 0x184]
call fcn.0001e5f8
mov eax, dword [ebp - 0x46c]
push eax
lea edx, [ebp - 0x470]
mov eax, dword [ebp - 0x104]
call fcn.0001e5f8
mov edx, dword [ebp - 0x470]
pop eax
call fcn.00014660
jne 0x17efe3
lea edx, [ebp - 0x474]
mov eax, dword [ebp - 0x160]
call fcn.0001e5f8
mov eax, dword [ebp - 0x474]
push eax
lea edx, [ebp - 0x478]
mov eax, dword [ebp - 0xf8]
call fcn.0001e5f8
mov edx, dword [ebp - 0x478]
pop eax
call fcn.00014660
jne 0x17efe3
lea edx, [ebp - 0xf0]
mov eax, 0x188fd0
call fcn.00031d88
push dword [ebp - 0xf8]
push 0x188fc8
push dword [ebp - 0x104]
lea eax, [ebp - 0x47c]
mov edx, 3
call fcn.00014618
mov edx, dword [ebp - 0x47c]
mov eax, dword [0x2a8dd0]
call fcn.00138a38
push dword [ebp - 0x160]
push 0x188fc8
push dword [ebp - 0x184]
lea eax, [ebp - 0x480]
mov edx, 3
call fcn.00014618
mov edx, dword [ebp - 0x480]
mov eax, dword [0x2a8dd0]
call fcn.00138a38
push dword [ebp - 0xf8]
push 0x188fc8
push dword [ebp - 0x104]
lea eax, [ebp - 0x488]
mov edx, 3
call fcn.00014618
mov eax, dword [ebp - 0x488]
lea edx, [ebp - 0x484]
call fcn.0001e5f8
mov edx, dword [ebp - 0x484]
mov eax, dword [0x2a8dd0]
call fcn.00138a38
push dword [ebp - 0x160]
push 0x188fc8
push dword [ebp - 0x184]
lea eax, [ebp - 0x490]
mov edx, 3
call fcn.00014618
mov eax, dword [ebp - 0x490]
lea edx, [ebp - 0x48c]
call fcn.0001e5f8
mov edx, dword [ebp - 0x48c]
mov eax, dword [0x2a8dd0]
call fcn.00138a38
mov eax, dword [ebp - 0xf0]
call fcn.00013ecc
test eax, eax
jle 0x17f07d
mov byte [ebp - 0x159], 1
lea edx, [ebp - 0x494]
mov eax, 0x3d
call fcn.0002d13c
mov edx, dword [ebp - 0x494]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [ebp - 0x40]
push eax
mov eax, dword [ebp - 0xf8]
push eax
mov eax, dword [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x118]
push eax
mov eax, dword [ebp - 0x2c]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 0x168]
mov ecx, dword [edx + eax*4]
mov dl, 1
mov eax, dword [0x151b3c]
call fcn.0018b960
mov edx, dword [ebp - 4]
mov dword [edx + 0x108], eax
jmp 0x17f07d
lea edx, [ebp - 0x498]
mov eax, 0x188ea0
call fcn.00031d88
mov edx, dword [ebp - 0x498]
mov eax, dword [0x2a8dd0]
call fcn.00138970
lea edx, [ebp - 0x49c]
mov eax, 0x3e
call fcn.0002d13c
mov edx, dword [ebp - 0x49c]
lea eax, [ebp - 0x174]
call fcn.00013ed4
inc dword [ebp - 0x2c]
dec dword [ebp - 0x18c]
jne 0x17ed02
jmp 0x17f157
lea edx, [ebp - 0x4a4]
mov eax, 0x188e60
call fcn.00031d88
push dword [ebp - 0x4a4]
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x4a8]
call fcn.00033468
push dword [ebp - 0x4a8]
lea edx, [ebp - 0x4ac]
mov eax, 0x188e64
call fcn.00031d88
push dword [ebp - 0x4ac]
lea edx, [ebp - 0x4b0]
mov eax, 3
call fcn.00033438
push dword [ebp - 0x4b0]
lea edx, [ebp - 0x4b4]
mov eax, 0x188e64
call fcn.00031d88
push dword [ebp - 0x4b4]
lea edx, [ebp - 0x4b8]
mov eax, 0x42ff
call fcn.00033438
push dword [ebp - 0x4b8]
lea eax, [ebp - 0x4a0]
mov edx, 6
call fcn.00013f8c
mov edx, dword [ebp - 0x4a0]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
mov eax, dword [ebp - 0xc0]
call fcn.00018fe0
test eax, eax
jbe 0x17f201
lea edx, [ebp - 0x4bc]
mov eax, dword [ebp - 0xc0]
call fcn.00018fcc
mov edx, dword [ebp - 0x4bc]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
jmp 0x17f201
lea edx, [ebp - 0x4c0]
mov eax, 0x188fd4
call fcn.00031d88
lea eax, [ebp - 0x4c0]
push eax
lea edx, [ebp - 0x4c4]
mov eax, dword [ebp - 0x140]
call fcn.0002b100
mov edx, dword [ebp - 0x4c4]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x4c0]
mov eax, dword [0x2a8dd0]
call fcn.00138970
mov eax, dword [ebp - 0xc0]
call fcn.00018fe0
test eax, eax
jbe 0x17f201
lea edx, [ebp - 0x4c8]
mov eax, dword [ebp - 0xc0]
call fcn.00018fcc
mov edx, dword [ebp - 0x4c8]
mov eax, dword [0x2a8dd0]
call fcn.00138970
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x17f231
lea eax, [ebp - 0xc0]
call fcn.000192a8
lea eax, [ebp - 0x168]
mov edx, 0x2ee0
call fcn.0002aecc
ret
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8f05]
jne 0x18094a
cmp byte [0x2a8e3c], 0
je 0x18094a
cmp byte [0x2a8d10], 0
je 0x18094a
lea edx, [ebp - 0x4cc]
mov eax, 0x72
call fcn.0002c224
mov edx, dword [ebp - 0x4cc]
lea eax, [ebp - 0x174]
call fcn.00013ed4
xor eax, eax
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x150]
lea eax, [ebp - 0x44]
call fcn.00013c3c
call fcn.0002da8c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xb0]
call fcn.0002dfe8
lea edx, [ebp - 0xd8]
mov eax, dword [ebp - 0xb0]
call fcn.00060b44
cmp dword [ebp - 0xd8], 0
jne 0x1808e0
inc dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jbe 0x18089a
cmp dword [ebp - 0x1c], 0x2710
jae 0x18089a
lea eax, [ebp - 0x44]
call fcn.00013c3c
lea edx, [ebp - 0x4d0]
mov eax, 0x73
call fcn.0002c224
mov edx, dword [ebp - 0x4d0]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x1c]
call fcn.00014200
add dword [ebp - 0xd4], 4
lea eax, [ebp - 0x4c]
call fcn.0001409c
mov edx, eax
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0x1c]
call fcn.00012840
lea ecx, [ebp - 0x44]
lea edx, [ebp - 0xd8]
mov eax, dword [ebp - 0x4c]
call fcn.00060f78
lea eax, [ebp - 0x4d4]
push eax
mov ecx, 0x1b
mov edx, 1
mov eax, dword [ebp - 0x44]
call fcn.000140d4
mov eax, dword [ebp - 0x4d4]
mov edx, 0x188f94
call fcn.00013fdc
jne 0x180851
lea edx, [ebp - 0x4d8]
mov eax, 0x74
call fcn.0002c224
mov edx, dword [ebp - 0x4d8]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x44]
mov ecx, 0x1b
mov edx, 1
call fcn.00014114
mov dword [ebp - 0x40], 0xffffffff
xor eax, eax
push ebp
push 0x17f50b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x4dc]
mov eax, 0x188fe0
call fcn.00031d88
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0x4e0]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 0x44]
call fcn.000140d4
mov edx, dword [ebp - 0x4e0]
pop eax
call fcn.00013ed4
mov eax, dword [ebp - 0x4dc]
call fcn.00033518
mov dword [ebp - 0xac], eax
lea edx, [ebp - 0x4e4]
mov eax, 0x188fe0
call fcn.00031d88
lea eax, [ebp - 0x4e4]
push eax
lea eax, [ebp - 0x4e8]
push eax
mov ecx, 8
mov edx, 9
mov eax, dword [ebp - 0x44]
call fcn.000140d4
mov edx, dword [ebp - 0x4e8]
pop eax
call fcn.00013ed4
mov eax, dword [ebp - 0x4e4]
call fcn.00033518
mov dword [ebp - 0x40], eax
lea edx, [ebp - 0x4ec]
mov eax, 0x188fe0
call fcn.00031d88
lea eax, [ebp - 0x4ec]
push eax
lea eax, [ebp - 0x4f0]
push eax
mov ecx, 4
mov edx, 0x11
mov eax, dword [ebp - 0x44]
call fcn.000140d4
mov edx, dword [ebp - 0x4f0]
pop eax
call fcn.00013ed4
mov eax, dword [ebp - 0x4ec]
call fcn.00033518
mov ebx, eax
lea edx, [ebp - 0x4f4]
mov eax, 0x188fe0
call fcn.00031d88
lea eax, [ebp - 0x4f4]
push eax
lea eax, [ebp - 0x4f8]
push eax
mov ecx, 4
mov edx, 0x15
mov eax, dword [ebp - 0x44]
call fcn.000140d4
mov edx, dword [ebp - 0x4f8]
pop eax
call fcn.00013ed4
mov eax, dword [ebp - 0x4f4]
call fcn.00033518
mov esi, eax
lea eax, [ebp - 0x44]
mov ecx, 0x18
mov edx, 1
call fcn.00014114
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x17f576
cmp dword [ebp - 0xac], 0xffffffff
je 0x1807a4
cmp dword [ebp - 0x40], 0xffffffff
je 0x1807a4
test ebx, ebx
jbe 0x1807a4
cmp ebx, 0xff
jae 0x1807a4
test esi, esi
jbe 0x1807a4
cmp esi, 0xff
jae 0x1807a4
lea edx, [ebp - 0x504]
mov eax, 0x75
call fcn.0002c224
mov edx, dword [ebp - 0x504]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x5c]
push eax
mov ecx, ebx
mov edx, 1
mov eax, dword [ebp - 0x44]
call fcn.000140d4
lea eax, [ebp - 0x44]
mov ecx, ebx
mov edx, 1
call fcn.00014114
lea eax, [ebp - 0x50]
push eax
mov ecx, esi
mov edx, 1
mov eax, dword [ebp - 0x44]
call fcn.000140d4
mov eax, dword [ebp - 0x50]
mov edx, 0x188ffc
call fcn.00013fdc
jne 0x17ffed
lea edx, [ebp - 0x508]
mov eax, 0x96
call fcn.0002c224
mov edx, dword [ebp - 0x508]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x20]
call fcn.00014314
xor eax, eax
mov dword [ebp - 0x140], eax
lea edx, [ebp - 0x128]
mov eax, dword [ebp - 0x5c]
call fcn.0001c4b0
lea ecx, [ebp - 0xf8]
lea edx, [ebp - 0x104]
mov eax, dword [ebp - 0x128]
call fcn.0002fa68
mov eax, dword [ebp - 0x104]
call fcn.00014548
test eax, eax
jg 0x17f6cc
lea edx, [ebp - 0x50c]
mov eax, 0x18900c
call fcn.00031d88
lea eax, [ebp - 0x50c]
push eax
lea edx, [ebp - 0x510]
mov eax, dword [ebp - 0xac]
call fcn.0002d1ec
mov edx, dword [ebp - 0x510]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x50c]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x180924
call sub.kernel32.dll_WTSGetActiveConsoleSessionId
cmp eax, dword [ebp - 0xac]
je 0x180924
mov eax, dword [ebp - 0xf8]
call fcn.00014548
test eax, eax
jg 0x17f743
lea edx, [ebp - 0x514]
mov eax, 0x18901c
call fcn.00031d88
lea eax, [ebp - 0x514]
push eax
lea edx, [ebp - 0x518]
mov eax, dword [ebp - 0xac]
call fcn.0002d1ec
mov edx, dword [ebp - 0x518]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x514]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
lea eax, [ebp - 0x128]
mov edx, dword [ebp - 0x104]
call fcn.00014350
jmp 0x17f764
push dword [ebp - 0xf8]
push 0x188fc8
push dword [ebp - 0x104]
lea eax, [ebp - 0x128]
mov edx, 3
call fcn.00014618
call fcn.00019298
mov dword [ebp - 0xc0], eax
xor eax, eax
push ebp
push 0x17ffe6
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x114]
mov edx, dword [ebp - 0xc0]
mov eax, dword [ebp - 0x40]
call fcn.001466ec
mov eax, dword [ebp - 0xc0]
call fcn.000192cc
lea edx, [ebp - 0x1b9]
mov eax, dword [ebp - 0x114]
call fcn.000be57c
lea eax, [ebp - 0x1b9]
call fcn.0001ca50
sub al, 2
je 0x17f879
sub al, 0x15
je 0x17f879
lea edx, [ebp - 0x520]
mov eax, 0x18902c
call fcn.00031d88
push dword [ebp - 0x520]
lea edx, [ebp - 0x524]
mov eax, dword [ebp - 0xac]
call fcn.0002d1ec
push dword [ebp - 0x524]
lea edx, [ebp - 0x528]
mov eax, 0x189058
call fcn.00031d88
push dword [ebp - 0x528]
push dword [ebp - 0x114]
lea edx, [ebp - 0x52c]
mov eax, 0x18905c
call fcn.00031d88
push dword [ebp - 0x52c]
lea edx, [ebp - 0x530]
lea eax, [ebp - 0x1b9]
call fcn.0001cd50
push dword [ebp - 0x530]
lea edx, [ebp - 0x534]
mov eax, 0x189060
call fcn.00031d88
push dword [ebp - 0x534]
lea eax, [ebp - 0x51c]
mov edx, 7
call fcn.00013f8c
mov edx, dword [ebp - 0x51c]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
jmp 0x17ffcd
lea eax, [ebp - 0x1b9]
mov ecx, dword [ebp - 0xc0]
mov dl, 2
call fcn.000be144
test al, al
jne 0x17f945
lea edx, [ebp - 0x53c]
mov eax, 0x189064
call fcn.00031d88
push dword [ebp - 0x53c]
lea edx, [ebp - 0x540]
mov eax, dword [ebp - 0xac]
call fcn.0002d1ec
push dword [ebp - 0x540]
lea edx, [ebp - 0x544]
mov eax, 0x189058
call fcn.00031d88
push dword [ebp - 0x544]
push dword [ebp - 0x114]
lea edx, [ebp - 0x548]
mov eax, 0x18905c
call fcn.00031d88
push dword [ebp - 0x548]
lea edx, [ebp - 0x54c]
lea eax, [ebp - 0x1b9]
call fcn.0001cd50
push dword [ebp - 0x54c]
lea edx, [ebp - 0x550]
mov eax, 0x189060
call fcn.00031d88
push dword [ebp - 0x550]
lea eax, [ebp - 0x538]
mov edx, 7
call fcn.00013f8c
mov edx, dword [ebp - 0x538]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
jmp 0x17ffcd
lea edx, [ebp - 0x554]
mov eax, 0x97
call fcn.0002c224
mov edx, dword [ebp - 0x554]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [0x2a976c]
push eax
mov eax, dword [0x2a9198]
push eax
mov eax, dword [0x2a9634]
push eax
mov eax, dword [0x2a936c]
push eax
mov eax, dword [0x2a961c]
push eax
lea eax, [ebp - 0x131]
push eax
lea eax, [ebp - 0x146]
push eax
lea eax, [ebp - 0x16e]
push eax
lea eax, [ebp - 0x152]
push eax
lea eax, [ebp - 0x133]
push eax
lea eax, [ebp - 0x139]
push eax
lea eax, [ebp - 0x176]
push eax
mov eax, dword [0x2a91cc]
push eax
mov eax, dword [0x2a9834]
push eax
lea eax, [ebp - 0x151]
push eax
lea eax, [ebp - 0x161]
push eax
lea eax, [ebp - 0x16d]
push eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x145]
push eax
lea eax, [ebp - 0x162]
push eax
lea eax, [ebp - 0x132]
push eax
lea eax, [ebp - 0x147]
push eax
mov eax, dword [0x2a934c]
push eax
mov ecx, dword [0x2a9160]
mov edx, dword [0x2a9700]
mov eax, dword [0x2a9498]
call fcn.000b1f6c
mov eax, dword [0x2a92c0]
mov eax, dword [eax]
mov dword [ebp - 0x194], eax
mov al, byte [ebp - 0x134]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x194]
mov word [edx + 0x10], ax
mov al, byte [ebp - 0x147]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x194]
mov word [edx + 0x18], ax
mov al, byte [ebp - 0x132]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x194]
mov word [edx + 0x16], ax
mov eax, dword [ebp - 0x194]
mov dl, byte [ebp - 0x152]
mov byte [eax + 5], dl
mov al, byte [ebp - 0x145]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x194]
mov word [edx + 0x12], ax
mov al, byte [ebp - 0x176]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x194]
mov word [edx + 8], ax
mov al, byte [ebp - 0x151]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x194]
mov word [edx + 0xa], ax
mov eax, dword [ebp - 0x194]
mov dl, byte [ebp - 0x16e]
mov byte [eax + 4], dl
mov al, byte [ebp - 0x131]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x194]
mov word [edx], ax
mov al, byte [ebp - 0x146]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x194]
mov word [edx + 2], ax
mov al, byte [ebp - 0x161]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x194]
mov word [edx + 0xc], ax
mov eax, dword [ebp - 0x194]
mov dl, byte [ebp - 0x133]
mov byte [eax + 6], dl
mov al, byte [ebp - 0x16d]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x194]
mov word [edx + 0xe], ax
mov eax, dword [ebp - 0x194]
mov dl, byte [ebp - 0x139]
mov byte [eax + 7], dl
mov al, byte [ebp - 0x162]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x194]
mov word [edx + 0x14], ax
lea edx, [ebp - 0x558]
mov eax, 0x189094
call fcn.00031d88
mov edx, dword [ebp - 0x558]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
mov eax, dword [0x2a9498]
cmp byte [eax], 0
je 0x17ffcd
mov eax, dword [0x2a9160]
cmp byte [eax], 0
je 0x17ffcd
mov eax, dword [0x2a976c]
cmp byte [eax], 0
je 0x17ffcd
mov eax, dword [0x2a9634]
mov eax, dword [eax]
call fcn.00014548
test eax, eax
jle 0x17ffcd
lea edx, [ebp - 0x55c]
mov eax, 0x98
call fcn.0002c224
mov edx, dword [ebp - 0x55c]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0xe0]
call fcn.00014314
lea eax, [ebp - 0xa8]
call fcn.00014314
lea eax, [ebp - 0x108]
call fcn.00014314
lea eax, [ebp - 0x3c]
call fcn.00014314
lea edx, [ebp - 0x560]
mov eax, 0x99
call fcn.0002c224
mov edx, dword [ebp - 0x560]
lea eax, [ebp - 0x174]
call fcn.00013ed4
xor eax, eax
mov dword [ebp - 0x130], eax
call fcn.00019270
mov dword [ebp - 0xa0], eax
xor eax, eax
push ebp
push 0x17fcd2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xe0]
push eax
mov eax, dword [ebp - 0xa8]
push eax
mov eax, dword [ebp - 0x108]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0xa0]
push eax
lea eax, [ebp - 0x130]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x128]
call fcn.000ee218
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xa0]
call fcn.00018c24
test eax, eax
jbe 0x17fcb9
cmp dword [ebp - 0x2c], 0
jge 0x17fc98
lea edx, [ebp - 0x564]
mov eax, dword [ebp - 0xa0]
call fcn.00018c10
mov edx, dword [ebp - 0x564]
mov eax, dword [0x2a8dd0]
call fcn.00138bc8
jmp 0x17fcb9
lea edx, [ebp - 0x568]
mov eax, dword [ebp - 0xa0]
call fcn.00018c10
mov edx, dword [ebp - 0x568]
mov eax, dword [0x2a8dd0]
call fcn.00138a38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x17fcd9
lea eax, [ebp - 0xa0]
call fcn.00019280
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x180924
lea eax, [ebp - 0xc0]
call fcn.000192a8
ret
mov eax, dword [ebp - 0x50]
mov edx, 0x189210
call fcn.00013fdc
je 0x18002d
mov eax, dword [ebp - 0x50]
mov edx, 0x189228
call fcn.00013fdc
je 0x18002d
mov eax, dword [ebp - 0x50]
mov edx, 0x189240
call fcn.00013fdc
je 0x18002d
mov eax, dword [ebp - 0x50]
mov edx, 0x189258
call fcn.00013fdc
jne 0x180784
mov eax, dword [ebp - 0x50]
mov edx, 0x189210
call fcn.00013fdc
je 0x18004b
mov eax, dword [ebp - 0x50]
mov edx, 0x189228
call fcn.00013fdc
jne 0x180097
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0x40]
jne 0x180097
lea edx, [ebp - 0x5d4]
mov eax, 0x76
call fcn.0002c224
mov edx, dword [ebp - 0x5d4]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [0x2a8dd0]
push eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x5c]
call fcn.00112aa0
jmp 0x180924
lea edx, [ebp - 0x5d8]
mov eax, 0x77
call fcn.0002c224
mov edx, dword [ebp - 0x5d8]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x54]
call fcn.00014314
lea eax, [ebp - 0x64]
call fcn.00014314
lea eax, [ebp - 0x20]
call fcn.00014314
xor eax, eax
mov dword [ebp - 0x140], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x35]
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 0xac]
call fcn.000adcb4
cmp byte [ebp - 0x35], 0
je 0x180106
cmp dword [ebp - 0x140], 0
je 0x18017d
lea edx, [ebp - 0x5e0]
mov eax, 0x189268
call fcn.00031d88
push dword [ebp - 0x5e0]
lea edx, [ebp - 0x5e4]
mov al, byte [ebp - 0x35]
call fcn.0002d050
push dword [ebp - 0x5e4]
lea edx, [ebp - 0x5e8]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0x5e8]
lea edx, [ebp - 0x5ec]
mov eax, dword [ebp - 0x140]
call fcn.0002b100
push dword [ebp - 0x5ec]
lea eax, [ebp - 0x5dc]
mov edx, 4
call fcn.00013f8c
mov edx, dword [ebp - 0x5dc]
mov eax, dword [0x2a8dd0]
call fcn.00138970
lea eax, [ebp - 0x20]
call fcn.00014314
xor eax, eax
mov dword [ebp - 0x140], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0xb9]
lea edx, [ebp - 0x140]
mov eax, dword [ebp - 0xac]
call fcn.000ae5f8
cmp byte [ebp - 0xb9], 0
je 0x1801c1
cmp dword [ebp - 0x140], 0
je 0x18023b
lea edx, [ebp - 0x5f4]
mov eax, 0x189274
call fcn.00031d88
push dword [ebp - 0x5f4]
lea edx, [ebp - 0x5f8]
mov al, byte [ebp - 0xb9]
call fcn.0002d050
push dword [ebp - 0x5f8]
lea edx, [ebp - 0x5fc]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0x5fc]
lea edx, [ebp - 0x600]
mov eax, dword [ebp - 0x140]
call fcn.0002b100
push dword [ebp - 0x600]
lea eax, [ebp - 0x5f0]
mov edx, 4
call fcn.00013f8c
mov edx, dword [ebp - 0x5f0]
mov eax, dword [0x2a8dd0]
call fcn.00138970
mov eax, dword [ebp - 0x104]
call fcn.00014548
test eax, eax
jg 0x18026f
lea edx, [ebp - 0x604]
mov eax, 0x189280
call fcn.00031d88
mov edx, dword [ebp - 0x604]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x180777
mov eax, dword [ebp - 0xf8]
call fcn.00014548
test eax, eax
jg 0x1802b1
lea edx, [ebp - 0x608]
mov eax, 0x18928c
call fcn.00031d88
mov edx, dword [ebp - 0x608]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
lea eax, [ebp - 0x128]
mov edx, dword [ebp - 0x104]
call fcn.00014350
jmp 0x1802d2
push dword [ebp - 0xf8]
push 0x188fc8
push dword [ebp - 0x104]
lea eax, [ebp - 0x128]
mov edx, 3
call fcn.00014618
lea ecx, [ebp - 0xe8]
lea edx, [ebp - 0x11c]
lea eax, [ebp - 0xcd]
call fcn.000e17a4
mov edx, dword [ebp - 0xe8]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
lea edx, [ebp - 0x60c]
mov eax, 0x78
call fcn.0002c224
mov edx, dword [ebp - 0x60c]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0xe0]
call fcn.00014314
lea eax, [ebp - 0xa8]
call fcn.00014314
lea eax, [ebp - 0x108]
call fcn.00014314
lea eax, [ebp - 0x3c]
call fcn.00014314
lea edx, [ebp - 0x610]
mov eax, 0x79
call fcn.0002c224
mov edx, dword [ebp - 0x610]
lea eax, [ebp - 0x174]
call fcn.00013ed4
xor eax, eax
mov dword [ebp - 0x130], eax
call fcn.00019270
mov dword [ebp - 0xa0], eax
xor eax, eax
push ebp
push 0x180434
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xe0]
push eax
mov eax, dword [ebp - 0xa8]
push eax
mov eax, dword [ebp - 0x108]
push eax
mov eax, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 0xa0]
push eax
lea eax, [ebp - 0x130]
push eax
xor ecx, ecx
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x128]
call fcn.000ee218
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xa0]
call fcn.00018c24
test eax, eax
jbe 0x18041b
cmp dword [ebp - 0x2c], 0
jge 0x1803fa
lea edx, [ebp - 0x614]
mov eax, dword [ebp - 0xa0]
call fcn.00018c10
mov edx, dword [ebp - 0x614]
mov eax, dword [0x2a8dd0]
call fcn.00138bc8
jmp 0x18041b
lea edx, [ebp - 0x618]
mov eax, dword [ebp - 0xa0]
call fcn.00018c10
mov edx, dword [ebp - 0x618]
mov eax, dword [0x2a8dd0]
call fcn.00138a38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x18043b
lea eax, [ebp - 0xa0]
call fcn.00019280
ret
lea eax, [ebp - 0x3c]
call fcn.00014314
jmp 0x180924
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [0x2a8dd0]
push eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x5c]
call fcn.00112aa0
jmp 0x180924
lea edx, [ebp - 0x680]
mov eax, 0x189374
call fcn.00031d88
push dword [ebp - 0x680]
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x684]
call fcn.00033468
push dword [ebp - 0x684]
lea edx, [ebp - 0x688]
mov eax, 0x188e64
call fcn.00031d88
push dword [ebp - 0x688]
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x68c]
call fcn.00033468
push dword [ebp - 0x68c]
lea edx, [ebp - 0x690]
mov eax, 0x188e64
call fcn.00031d88
push dword [ebp - 0x690]
mov eax, dword [ebp - 0x40]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x694]
call fcn.00033468
push dword [ebp - 0x694]
lea eax, [ebp - 0x67c]
mov edx, 6
call fcn.00013f8c
mov edx, dword [ebp - 0x67c]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
jmp 0x180924
lea edx, [ebp - 0x698]
mov eax, 0x189380
call fcn.00031d88
lea eax, [ebp - 0x698]
push eax
lea edx, [ebp - 0x69c]
mov eax, dword [ebp - 0xd8]
call fcn.0002d44c
mov edx, dword [ebp - 0x69c]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x698]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x180924
lea edx, [ebp - 0x6a0]
mov eax, 0x189390
call fcn.00031d88
lea eax, [ebp - 0x6a0]
push eax
lea edx, [ebp - 0x6a4]
mov eax, dword [ebp - 0xd8]
call fcn.0002d44c
mov edx, dword [ebp - 0x6a4]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x6a0]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x180924
lea edx, [ebp - 0x6a8]
mov eax, 0x1893a0
call fcn.00031d88
lea eax, [ebp - 0x6a8]
push eax
lea edx, [ebp - 0x6ac]
mov eax, dword [ebp - 0xd8]
call fcn.0002d44c
mov edx, dword [ebp - 0x6ac]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x6a8]
mov eax, dword [0x2a8dd0]
call fcn.00138970
lea edx, [ebp - 0xd4]
mov eax, 0x2a8fe4
mov ecx, 4
call fcn.00012840
inc dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x30]
mov dword [eax], edx
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8ef8]
jne 0x180a17
cmp byte [0x2a8e3c], 0
je 0x180a17
cmp byte [0x2a8d10], 0
je 0x180a17
lea edx, [ebp - 0x6b0]
mov eax, 0x28
call fcn.0002d13c
mov edx, dword [ebp - 0x6b0]
lea eax, [ebp - 0x174]
call fcn.00013ed4
inc dword [ebp - 0x150]
inc dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
mov bx, word [eax]
test bx, bx
jbe 0x1809f7
cmp bx, 0xc8
jae 0x1809f7
add dword [ebp - 0xd4], 2
movzx edx, bx
lea eax, [ebp - 0xe8]
call fcn.00014200
lea eax, [ebp - 0xe8]
call fcn.0001409c
mov edx, eax
movzx ecx, bx
mov eax, dword [ebp - 0xd4]
call fcn.00012840
mov edx, dword [ebp - 0xe8]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
jmp 0x180a17
lea edx, [ebp - 0x6b4]
mov eax, 0x188f84
call fcn.00031d88
mov edx, dword [ebp - 0x6b4]
mov eax, dword [0x2a8dd0]
call fcn.00138970
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8efc]
jne 0x180a98
cmp byte [0x2a8e3c], 0
je 0x180a98
cmp byte [0x2a8d10], 0
je 0x180a98
lea edx, [ebp - 0x6b8]
mov eax, 0x2c
call fcn.0002d13c
mov edx, dword [ebp - 0x6b8]
lea eax, [ebp - 0x174]
call fcn.00013ed4
inc dword [ebp - 0x150]
inc dword [ebp - 0xd4]
lea eax, [ebp - 0x6bc]
call fcn.0005e2b0
mov edx, dword [ebp - 0x6bc]
lea eax, [ebp - 0x5c]
call fcn.00013e94
mov eax, dword [ebp - 0x5c]
call fcn.00013ecc
inc eax
push eax
lea eax, [ebp - 0x5c]
call fcn.0001409c
mov edx, dword [ebp - 0xd4]
pop ecx
call fcn.00012840
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8f02]
je 0x180ab2
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8f03]
jne 0x187294
cmp byte [0x2a8e3c], 0
je 0x187294
cmp byte [0x2a8d10], 0
je 0x187294
lea edx, [ebp - 0x6c0]
mov eax, 0x3f
call fcn.0002d13c
mov edx, dword [ebp - 0x6c0]
lea eax, [ebp - 0x174]
call fcn.00013ed4
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x14]
call fcn.00014314
inc dword [ebp - 0x150]
inc dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov dword [ebp - 0xac], eax
add dword [ebp - 0xd4], 4
mov eax, dword [ebp - 0xd4]
movzx ebx, word [eax]
cmp ebx, 1
jb 0x187223
cmp ebx, 0x3e8
jae 0x187223
lea edx, [ebp - 0x6c4]
mov eax, 0x40
call fcn.0002d13c
mov edx, dword [ebp - 0x6c4]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x5c]
mov edx, ebx
call fcn.00014200
add dword [ebp - 0xd4], 2
lea eax, [ebp - 0x5c]
call fcn.0001409c
mov edx, eax
mov eax, dword [ebp - 0xd4]
mov ecx, ebx
call fcn.00012840
lea eax, [ebp - 0x44]
call fcn.00013c3c
call fcn.0002da8c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xb0]
call fcn.0002dfe8
lea edx, [ebp - 0xd8]
mov eax, dword [ebp - 0xb0]
call fcn.00060b44
lea ecx, [ebp - 0x44]
lea edx, [ebp - 0xd8]
mov eax, dword [ebp - 0x5c]
call fcn.00060f78
mov eax, dword [ebp - 0x44]
call fcn.00013ecc
test eax, eax
je 0x180bfa
lea eax, [ebp - 0x6c8]
push eax
mov ecx, 0x1b
mov edx, 1
mov eax, dword [ebp - 0x44]
call fcn.000140d4
mov eax, dword [ebp - 0x6c8]
mov edx, 0x188f94
call fcn.00013fdc
je 0x180c5a
lea edx, [ebp - 0x6cc]
mov eax, 0x41
call fcn.0002d13c
mov edx, dword [ebp - 0x6cc]
lea eax, [ebp - 0x174]
call fcn.00013ed4
call fcn.0002da8c
fsub qword [0x2a8e8c]
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0xb0]
call fcn.0002dfe8
lea edx, [ebp - 0xd8]
mov eax, dword [ebp - 0xb0]
call fcn.00060b44
lea ecx, [ebp - 0x44]
lea edx, [ebp - 0xd8]
mov eax, dword [ebp - 0x5c]
call fcn.00060f78
lea eax, [ebp - 0x5c]
mov edx, dword [ebp - 0x44]
call fcn.00013cd4
mov eax, dword [ebp - 0x5c]
call fcn.00013ecc
test eax, eax
je 0x180c9c
lea eax, [ebp - 0x6d0]
push eax
mov ecx, 0x1b
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0x6d0]
mov edx, 0x188f94
call fcn.00013fdc
je 0x180cc1
lea edx, [ebp - 0x6d4]
mov eax, 0x1893b0
call fcn.00031d88
mov edx, dword [ebp - 0x6d4]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x18726e
lea edx, [ebp - 0x6d8]
mov eax, 0x42
call fcn.0002d13c
mov edx, dword [ebp - 0x6d8]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x5c]
mov ecx, 0x1b
mov edx, 1
call fcn.00014114
mov eax, dword [ebp - 0x5c]
mov edx, 0x1893c4
call fcn.00013fdc
jne 0x180f3c
lea edx, [ebp - 0x6dc]
mov eax, 0x43
call fcn.0002d13c
mov edx, dword [ebp - 0x6dc]
lea eax, [ebp - 0x174]
call fcn.00013ed4
cmp dword [0x2a8e38], 0
jne 0x180f04
xor eax, eax
push ebp
push 0x180ef3
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x2800
push 0
lea eax, [ebp - 0x6e4]
call fcn.000305b0
mov eax, dword [ebp - 0x6e4]
lea edx, [ebp - 0x6e0]
call fcn.0001d8bc
lea eax, [ebp - 0x6e0]
push eax
lea eax, [ebp - 0x6ec]
call fcn.00027f68
mov edx, dword [ebp - 0x6ec]
lea eax, [ebp - 0x6e8]
call fcn.000144c4
mov edx, dword [ebp - 0x6e8]
pop eax
call fcn.00014554
mov ecx, dword [ebp - 0x6e0]
mov dl, 1
mov eax, dword [0x499dc]
call fcn.0004b534
mov dword [0x2a8e38], eax
cmp dword [0x2a8e38], 0
je 0x180ee9
lea edx, [ebp - 0x6f4]
xor eax, eax
call fcn.0001e6d0
lea eax, [ebp - 0x6f4]
push eax
lea edx, [ebp - 0x700]
mov eax, 0x1893d4
call fcn.00031d88
lea eax, [ebp - 0x700]
push eax
lea edx, [ebp - 0x704]
mov eax, 0x1893d8
call fcn.00031d88
mov edx, dword [ebp - 0x704]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x700]
lea eax, [ebp - 0x6fc]
call fcn.000144c4
push dword [ebp - 0x6fc]
lea edx, [ebp - 0x70c]
xor eax, eax
call fcn.0001e6d0
mov eax, dword [ebp - 0x70c]
call fcn.00014538
lea edx, [ebp - 0x708]
call fcn.0002baa8
push dword [ebp - 0x708]
lea edx, [ebp - 0x714]
mov eax, 0x1893e0
call fcn.00031d88
mov edx, dword [ebp - 0x714]
lea eax, [ebp - 0x710]
call fcn.000144c4
push dword [ebp - 0x710]
lea edx, [ebp - 0x71c]
mov eax, 3
call fcn.00033438
mov edx, dword [ebp - 0x71c]
lea eax, [ebp - 0x718]
call fcn.000144c4
push dword [ebp - 0x718]
lea edx, [ebp - 0x724]
mov eax, 0x1893e4
call fcn.00031d88
mov edx, dword [ebp - 0x724]
lea eax, [ebp - 0x720]
call fcn.000144c4
push dword [ebp - 0x720]
lea eax, [ebp - 0x6f8]
mov edx, 5
call fcn.00014618
mov edx, dword [ebp - 0x6f8]
pop eax
call fcn.00014554
mov edx, dword [ebp - 0x6f4]
lea ecx, [ebp - 0x6f0]
mov eax, dword [0x2a8e38]
call fcn.0004c490
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x180f04
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8f02]
jne 0x180f1b
mov eax, dword [0x2a8e38]
call fcn.0012f434
jmp 0x180f30
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8f03]
jne 0x180f30
mov eax, dword [0x2a8e38]
call fcn.0012f75c
mov dword [ebp - 0x30], 0x20001015
jmp 0x18726e
lea eax, [ebp - 0x728]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0x728]
mov edx, 0x1893f0
call fcn.00013fdc
jne 0x181909
lea edx, [ebp - 0x72c]
mov eax, 0x44
call fcn.0002d13c
mov edx, dword [ebp - 0x72c]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [0x2a97c4]
mov eax, dword [eax]
mov ecx, 0x3e8
xor edx, edx
div ecx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x5c]
call fcn.00013cd4
lea eax, [ebp - 0x4c]
mov ecx, 0xc
mov edx, 1
call fcn.00014114
lea eax, [ebp - 0x4c]
push eax
mov ecx, 0xa
mov edx, 1
mov eax, dword [ebp - 0x4c]
call fcn.000140d4
mov eax, dword [ebp - 0x4c]
call fcn.00013ecc
cmp eax, 0xa
je 0x181012
lea edx, [ebp - 0x730]
mov eax, 0x189400
call fcn.00031d88
lea eax, [ebp - 0x730]
mov edx, dword [ebp - 0x4c]
call fcn.00013ed4
mov edx, dword [ebp - 0x730]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x18726e
lea eax, [ebp - 0x44]
mov edx, dword [ebp - 0x5c]
call fcn.00013cd4
lea eax, [ebp - 0x44]
mov ecx, 0x16
mov edx, 1
call fcn.00014114
mov eax, dword [ebp - 0x44]
call fcn.00013ecc
cmp eax, 2
jge 0x181061
lea edx, [ebp - 0x734]
mov eax, 0x189414
call fcn.00031d88
mov edx, dword [ebp - 0x734]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x18726e
lea edx, [ebp - 0x738]
mov eax, 0x45
call fcn.0002d13c
mov edx, dword [ebp - 0x738]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea edx, [ebp - 0xc4]
mov eax, dword [ebp - 0x4c]
call fcn.00015490
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0xc4], 0
je 0x1810cf
lea edx, [ebp - 0x73c]
mov eax, 0x189424
call fcn.00031d88
lea eax, [ebp - 0x73c]
mov edx, dword [ebp - 0x4c]
call fcn.00013ed4
mov edx, dword [ebp - 0x73c]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x18726e
cmp dword [ebp - 0x1c], 0
jne 0x1810ed
mov eax, dword [0x2a97c4]
mov eax, dword [eax]
mov ecx, 0x3e8
xor edx, edx
div ecx
mov dword [ebp - 0x30], eax
jmp 0x18726e
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x18141f
lea edx, [ebp - 0x740]
mov eax, 0x46
call fcn.0002d13c
mov edx, dword [ebp - 0x740]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [0x2a97c4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [0x2a97c4]
mov eax, dword [eax]
call fcn.000e1cfc
mov ebx, eax
test ebx, ebx
je 0x181192
push 0x189440
lea edx, [ebp - 0x74c]
mov eax, 0x189464
call fcn.00031d88
push dword [ebp - 0x74c]
lea edx, [ebp - 0x750]
mov eax, ebx
call fcn.0002b100
push dword [ebp - 0x750]
lea eax, [ebp - 0x748]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0x748]
lea eax, [ebp - 0x744]
call fcn.000144c4
mov edx, dword [ebp - 0x744]
mov eax, dword [0x2a8dd0]
call fcn.00138bc8
mov eax, dword [0x2a97c4]
mov eax, dword [eax]
mov ecx, 0x3e8
xor edx, edx
div ecx
mov dword [ebp - 0x30], eax
lea edx, [ebp - 0x754]
mov eax, dword [ebp - 0x44]
call fcn.0001c3d0
mov eax, dword [ebp - 0x754]
push eax
lea eax, [ebp - 0x760]
call fcn.000277dc
push dword [ebp - 0x760]
lea edx, [ebp - 0x764]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0x764]
lea eax, [ebp - 0x768]
call fcn.0002c5c8
push dword [ebp - 0x768]
lea edx, [ebp - 0x76c]
mov eax, 0x18946c
call fcn.00031d88
push dword [ebp - 0x76c]
lea eax, [ebp - 0x770]
call fcn.0002c5c8
push dword [ebp - 0x770]
lea edx, [ebp - 0x774]
mov eax, 0x1894a0
call fcn.00031d88
push dword [ebp - 0x774]
lea eax, [ebp - 0x75c]
mov edx, 6
call fcn.00013f8c
mov edx, dword [ebp - 0x75c]
lea eax, [ebp - 0x758]
call fcn.000144c4
mov edx, dword [ebp - 0x758]
lea eax, [ebp - 0x124]
pop ecx
call fcn.000145b4
mov edx, dword [ebp - 0x124]
mov eax, dword [0x2a8dd0]
call fcn.00138a38
xor eax, eax
call fcn.000e4504
test al, al
je 0x18726e
lea edx, [ebp - 0x77c]
mov eax, 0x1894bc
call fcn.00031d88
push dword [ebp - 0x77c]
lea edx, [ebp - 0x784]
mov eax, dword [ebp - 0x44]
call fcn.0001c3d0
mov edx, dword [ebp - 0x784]
lea eax, [ebp - 0x780]
call fcn.00013e94
push dword [ebp - 0x780]
push 0x1894d0
lea edx, [ebp - 0x788]
mov eax, 0x1894d4
call fcn.00031d88
push dword [ebp - 0x788]
lea edx, [ebp - 0x78c]
mov eax, dword [ebp - 0xac]
call fcn.0002d1ec
push dword [ebp - 0x78c]
push 0x1894d0
push 0x1894d0
lea edx, [ebp - 0x790]
mov eax, 0x1894e0
call fcn.00031d88
push dword [ebp - 0x790]
call fcn.00034c74
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x794]
call fcn.0002ea6c
push dword [ebp - 0x794]
push 0x1894d0
lea edx, [ebp - 0x798]
mov eax, 0x1894e0
call fcn.00031d88
push dword [ebp - 0x798]
call fcn.0002da8c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x79c]
call fcn.0002ea6c
push dword [ebp - 0x79c]
lea edx, [ebp - 0x7a0]
mov eax, 0x1894ec
call fcn.00031d88
push dword [ebp - 0x7a0]
lea eax, [ebp - 0x778]
mov edx, 0xd
call fcn.00013f8c
mov eax, dword [ebp - 0x778]
push eax
lea eax, [ebp - 0x7a4]
mov edx, dword [ebp - 0x124]
call fcn.00013e94
mov eax, dword [ebp - 0x7a4]
pop edx
call fcn.00152558
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jg 0x18726e
lea edx, [ebp - 0x7ac]
mov eax, 0x1894f4
call fcn.00031d88
push dword [ebp - 0x7ac]
lea edx, [ebp - 0x7b0]
mov eax, dword [ebp - 0x2c]
call fcn.00033438
push dword [ebp - 0x7b0]
lea edx, [ebp - 0x7b4]
mov eax, 0x189060
call fcn.00031d88
push dword [ebp - 0x7b4]
lea eax, [ebp - 0x7a8]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0x7a8]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
jmp 0x18726e
cmp dword [ebp - 0x1c], 0xe10
jb 0x1818bf
cmp dword [ebp - 0x1c], 0x2a300
ja 0x1818bf
lea edx, [ebp - 0x7b8]
mov eax, 0x47
call fcn.0002d13c
mov edx, dword [ebp - 0x7b8]
lea eax, [ebp - 0x174]
call fcn.00013ed4
imul eax, dword [ebp - 0x1c], 0x3e8
mov edx, dword [0x2a97c4]
mov dword [edx], eax
mov eax, dword [0x2a97c4]
mov eax, dword [eax]
call fcn.000e1cfc
mov ebx, eax
test ebx, ebx
je 0x1814da
push 0x189440
lea edx, [ebp - 0x7c4]
mov eax, 0x189528
call fcn.00031d88
push dword [ebp - 0x7c4]
lea edx, [ebp - 0x7c8]
mov eax, ebx
call fcn.0002b100
push dword [ebp - 0x7c8]
lea eax, [ebp - 0x7c0]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0x7c0]
lea eax, [ebp - 0x7bc]
call fcn.000144c4
mov edx, dword [ebp - 0x7bc]
mov eax, dword [0x2a8dd0]
call fcn.00138bc8
mov eax, dword [0x2a97c4]
mov eax, dword [eax]
mov ecx, 0x3e8
xor edx, edx
div ecx
mov dword [ebp - 0x30], eax
mov eax, dword [0x2a97c4]
mov eax, dword [eax]
mov dword [ebp - 0x7d0], eax
xor eax, eax
mov dword [ebp - 0x7cc], eax
fild qword [ebp - 0x7d0]
fistp qword [ebp - 0x110]
wait
call fcn.00034c74
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x7d0]
call fcn.00034724
lea eax, [ebp - 0x7d0]
call fcn.000347b0
fild qword [ebp - 0x110]
faddp st(1)
fistp qword [ebp - 0x110]
wait
push dword [ebp - 0x10c]
push dword [ebp - 0x110]
lea eax, [ebp - 0x7d0]
call fcn.00034794
lea eax, [ebp - 0x7d0]
call fcn.00034764
fstp qword [ebp - 0x80]
wait
lea eax, [ebp - 0x7dc]
call fcn.000277dc
push dword [ebp - 0x7dc]
lea edx, [ebp - 0x7e0]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0x7e0]
lea eax, [ebp - 0x7e4]
call fcn.0002c5c8
push dword [ebp - 0x7e4]
lea edx, [ebp - 0x7e8]
mov eax, 0x18946c
call fcn.00031d88
push dword [ebp - 0x7e8]
lea eax, [ebp - 0x7ec]
call fcn.0002c5c8
push dword [ebp - 0x7ec]
lea edx, [ebp - 0x7f0]
mov eax, 0x189530
call fcn.00031d88
push dword [ebp - 0x7f0]
lea eax, [ebp - 0x7d8]
mov edx, 6
call fcn.00013f8c
mov edx, dword [ebp - 0x7d8]
lea eax, [ebp - 0x7d4]
call fcn.000144c4
push dword [ebp - 0x7d4]
lea edx, [ebp - 0x7f4]
mov eax, dword [ebp - 0x44]
call fcn.0001c3d0
push dword [ebp - 0x7f4]
lea edx, [ebp - 0x7fc]
mov eax, 0x18954c
call fcn.00031d88
lea eax, [ebp - 0x7fc]
push eax
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
lea eax, [ebp - 0x800]
call fcn.0002ecdc
mov edx, dword [ebp - 0x800]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x7fc]
lea eax, [ebp - 0x7f8]
call fcn.000144c4
push dword [ebp - 0x7f8]
lea eax, [ebp - 0x124]
mov edx, 3
call fcn.00014618
mov edx, dword [ebp - 0x124]
mov eax, dword [0x2a8dd0]
call fcn.00138a38
xor eax, eax
call fcn.000e4504
test al, al
je 0x18726e
lea edx, [ebp - 0x804]
mov eax, 0x48
call fcn.0002d13c
mov edx, dword [ebp - 0x804]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea edx, [ebp - 0x80c]
mov eax, 0x189558
call fcn.00031d88
push dword [ebp - 0x80c]
lea edx, [ebp - 0x814]
mov eax, dword [ebp - 0x44]
call fcn.0001c3d0
mov edx, dword [ebp - 0x814]
lea eax, [ebp - 0x810]
call fcn.00013e94
push dword [ebp - 0x810]
push 0x1894d0
lea edx, [ebp - 0x818]
mov eax, 0x189568
call fcn.00031d88
push dword [ebp - 0x818]
lea edx, [ebp - 0x81c]
mov eax, dword [ebp - 0xac]
call fcn.0002d1ec
push dword [ebp - 0x81c]
push 0x1894d0
lea edx, [ebp - 0x820]
mov eax, 0x189578
call fcn.00031d88
push dword [ebp - 0x820]
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
lea eax, [ebp - 0x824]
call fcn.0002ecdc
push dword [ebp - 0x824]
push 0x1894d0
lea edx, [ebp - 0x828]
mov eax, 0x189588
call fcn.00031d88
push dword [ebp - 0x828]
call fcn.00034c74
add esp, 0xfffffff8
fstp qword [esp]
wait
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
lea eax, [ebp - 0x82c]
call fcn.000315d0
push dword [ebp - 0x82c]
push 0x1894d0
push 0x1894d0
lea edx, [ebp - 0x830]
mov eax, 0x189598
call fcn.00031d88
push dword [ebp - 0x830]
call fcn.00034c74
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x834]
call fcn.0002ea6c
push dword [ebp - 0x834]
push 0x1894d0
lea edx, [ebp - 0x838]
mov eax, 0x189598
call fcn.00031d88
push dword [ebp - 0x838]
call fcn.0002da8c
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x83c]
call fcn.0002ea6c
push dword [ebp - 0x83c]
lea edx, [ebp - 0x840]
mov eax, 0x1894ec
call fcn.00031d88
push dword [ebp - 0x840]
lea eax, [ebp - 0x808]
mov edx, 0x13
call fcn.00013f8c
mov eax, dword [ebp - 0x808]
push eax
lea eax, [ebp - 0x844]
mov edx, dword [ebp - 0x124]
call fcn.00013e94
mov eax, dword [ebp - 0x844]
pop edx
call fcn.00152558
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jg 0x18726e
lea edx, [ebp - 0x84c]
mov eax, 0x1894f4
call fcn.00031d88
push dword [ebp - 0x84c]
lea edx, [ebp - 0x850]
mov eax, dword [ebp - 0x2c]
call fcn.00033438
push dword [ebp - 0x850]
lea edx, [ebp - 0x854]
mov eax, 0x189060
call fcn.00031d88
push dword [ebp - 0x854]
lea eax, [ebp - 0x848]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0x848]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
jmp 0x18726e
lea edx, [ebp - 0x858]
mov eax, 0x189424
call fcn.00031d88
lea eax, [ebp - 0x858]
push eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x85c]
call fcn.00033468
mov edx, dword [ebp - 0x85c]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x858]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x18726e
lea eax, [ebp - 0x860]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0x860]
mov edx, 0x1895b0
call fcn.00013fdc
jne 0x181eeb
lea edx, [ebp - 0x864]
mov eax, 0x49
call fcn.0002d13c
mov edx, dword [ebp - 0x864]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x5c]
mov ecx, 0xd
mov edx, 1
call fcn.00014114
lea eax, [ebp - 0x868]
push eax
mov eax, dword [0x2a95ac]
mov eax, dword [eax]
call fcn.00013ecc
mov ecx, eax
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0x868]
mov edx, dword [0x2a95ac]
mov edx, dword [edx]
call fcn.00013fdc
jne 0x1819bd
mov eax, dword [0x2a95ac]
mov eax, dword [eax]
call fcn.00013ecc
mov ecx, eax
lea eax, [ebp - 0x5c]
mov edx, 1
call fcn.00014114
lea edx, [ebp - 0x86c]
mov eax, 0x1895c0
call fcn.00031d88
mov eax, dword [ebp - 0x86c]
mov edx, dword [ebp - 0x5c]
call fcn.000141b8
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jg 0x181a1e
lea edx, [ebp - 0x870]
mov eax, 0x1895c4
call fcn.00031d88
lea eax, [ebp - 0x870]
mov edx, dword [ebp - 0x5c]
call fcn.00013ed4
mov edx, dword [ebp - 0x870]
mov eax, dword [0x2a8dd0]
call fcn.00138970
mov dword [ebp - 0x30], 1
jmp 0x18726e
lea edx, [ebp - 0x874]
mov eax, 0x4a
call fcn.0002d13c
mov edx, dword [ebp - 0x874]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x2c]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
lea eax, [ebp - 0x44]
push eax
mov eax, dword [ebp - 0x5c]
call fcn.00013ecc
mov ecx, eax
mov edx, dword [ebp - 0x2c]
inc edx
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0x4c]
call fcn.00013ecc
test eax, eax
jne 0x181b08
mov dword [ebp - 0x30], 0x89a
lea edx, [ebp - 0x87c]
mov eax, 0x1895d8
call fcn.00031d88
push dword [ebp - 0x87c]
push dword [ebp - 0x4c]
lea edx, [ebp - 0x880]
mov eax, 0x1895e4
call fcn.00031d88
push dword [ebp - 0x880]
push dword [ebp - 0x44]
lea edx, [ebp - 0x884]
mov eax, 0x1895e8
call fcn.00031d88
push dword [ebp - 0x884]
lea edx, [ebp - 0x888]
mov eax, 0x89a
call fcn.0002b100
push dword [ebp - 0x888]
lea eax, [ebp - 0x878]
mov edx, 6
call fcn.00013f8c
mov edx, dword [ebp - 0x878]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x18726e
mov eax, dword [ebp - 0x44]
call fcn.0002c678
test al, al
jne 0x181ba0
mov dword [ebp - 0x30], 3
lea edx, [ebp - 0x890]
mov eax, 0x1895d8
call fcn.00031d88
push dword [ebp - 0x890]
push dword [ebp - 0x4c]
lea edx, [ebp - 0x894]
mov eax, 0x1895e4
call fcn.00031d88
push dword [ebp - 0x894]
push dword [ebp - 0x44]
lea edx, [ebp - 0x898]
mov eax, 0x1895e8
call fcn.00031d88
push dword [ebp - 0x898]
lea edx, [ebp - 0x89c]
mov eax, dword [ebp - 0x30]
call fcn.0002b100
push dword [ebp - 0x89c]
lea eax, [ebp - 0x88c]
mov edx, 6
call fcn.00013f8c
mov edx, dword [ebp - 0x88c]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x18726e
xor eax, eax
push ebp
push 0x181e61
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x8a0]
mov eax, 0x4b
call fcn.0002d13c
mov edx, dword [ebp - 0x8a0]
lea eax, [ebp - 0x174]
call fcn.00013ed4
push 0x10000000
push 2
push 3
lea eax, [ebp - 0x84]
push eax
lea edx, [ebp - 0x8a4]
mov eax, 0x1895ec
call fcn.00031d88
mov eax, dword [ebp - 0x8a4]
push eax
lea eax, [ebp - 0x8a8]
mov edx, dword [ebp - 0x44]
call fcn.000144c4
mov edx, dword [ebp - 0x8a8]
xor ecx, ecx
pop eax
call fcn.0004e600
mov ebx, eax
push 0x10000000
push 2
push 3
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x8ac]
mov eax, 0x1895fc
call fcn.00031d88
mov eax, dword [ebp - 0x8ac]
push eax
lea eax, [ebp - 0x8b0]
mov edx, dword [ebp - 0x44]
call fcn.000144c4
mov edx, dword [ebp - 0x8b0]
mov cl, 1
pop eax
call fcn.0004e600
mov esi, eax
push 0x10000000
push 2
push 3
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x8b4]
mov edx, dword [ebp - 0x44]
call fcn.000144c4
mov edx, dword [ebp - 0x8b4]
mov cl, 1
mov eax, dword [ebp - 0x4c]
call fcn.0004e600
mov edi, eax
lea edx, [ebp - 0x8bc]
mov eax, 0x1895d8
call fcn.00031d88
push dword [ebp - 0x8bc]
push dword [ebp - 0x4c]
lea edx, [ebp - 0x8c0]
mov eax, 0x1895e4
call fcn.00031d88
push dword [ebp - 0x8c0]
push dword [ebp - 0x44]
lea edx, [ebp - 0x8c4]
mov eax, 0x189060
call fcn.00031d88
push dword [ebp - 0x8c4]
lea eax, [ebp - 0x8b8]
mov edx, 5
call fcn.00013f8c
mov edx, dword [ebp - 0x8b8]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
lea edx, [ebp - 0x8cc]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0x8cc]
lea edx, [ebp - 0x8d0]
mov eax, ebx
call fcn.0002d44c
push dword [ebp - 0x8d0]
lea edx, [ebp - 0x8d4]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0x8d4]
lea edx, [ebp - 0x8d8]
mov eax, dword [ebp - 0x84]
call fcn.0002b100
push dword [ebp - 0x8d8]
lea eax, [ebp - 0x8c8]
mov edx, 4
call fcn.00013f8c
mov edx, dword [ebp - 0x8c8]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
lea edx, [ebp - 0x8e0]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0x8e0]
lea edx, [ebp - 0x8e4]
mov eax, esi
call fcn.0002d44c
push dword [ebp - 0x8e4]
lea edx, [ebp - 0x8e8]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0x8e8]
lea edx, [ebp - 0x8ec]
mov eax, dword [ebp - 0x18]
call fcn.0002b100
push dword [ebp - 0x8ec]
lea eax, [ebp - 0x8dc]
mov edx, 4
call fcn.00013f8c
mov edx, dword [ebp - 0x8dc]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
lea edx, [ebp - 0x8f4]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0x8f4]
lea edx, [ebp - 0x8f8]
mov eax, edi
call fcn.0002d44c
push dword [ebp - 0x8f8]
lea edx, [ebp - 0x8fc]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0x8fc]
lea edx, [ebp - 0x900]
mov eax, dword [ebp - 0xc8]
call fcn.0002b100
push dword [ebp - 0x900]
lea eax, [ebp - 0x8f0]
mov edx, 4
call fcn.00013f8c
mov edx, dword [ebp - 0x8f0]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
mov dword [ebp - 0x30], 0x20001015
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x18726e
lea eax, [ebp - 0x90c]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0x90c]
mov edx, 0x189618
call fcn.00013fdc
jne 0x18206e
lea edx, [ebp - 0x910]
mov eax, 0x4d
call fcn.0002d13c
mov edx, dword [ebp - 0x910]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x5c]
mov ecx, 0xc
mov edx, 1
call fcn.00014114
mov eax, dword [ebp - 0x5c]
call fcn.00013ecc
dec eax
jne 0x18203b
mov eax, dword [ebp - 0x5c]
cmp byte [eax], 0x31
jne 0x181faf
lea edx, [ebp - 0x914]
mov eax, 0x4e
call fcn.0002d13c
mov edx, dword [ebp - 0x914]
lea eax, [ebp - 0x174]
call fcn.00013ed4
inc dword [0x2a8edc]
cmp dword [0x2a8edc], 1
jne 0x181f99
call fcn.00156af4
call sub.kernel32.dll_GetTickCount
mov dword [0x2a8ed8], eax
mov dword [ebp - 0x30], 0x20001015
jmp 0x18726e
mov eax, dword [ebp - 0x5c]
cmp byte [eax], 0x30
jne 0x182008
cmp dword [0x2a8edc], 0
jbe 0x181ffc
dec dword [0x2a8edc]
cmp dword [0x2a8edc], 0
jne 0x181ffc
lea edx, [ebp - 0x918]
mov eax, 0x4f
call fcn.0002d13c
mov edx, dword [ebp - 0x918]
lea eax, [ebp - 0x174]
call fcn.00013ed4
call fcn.00156e80
xor eax, eax
mov dword [0x2a8ed8], eax
mov dword [ebp - 0x30], 0x20001015
jmp 0x18726e
lea edx, [ebp - 0x91c]
mov eax, 0x189628
call fcn.00031d88
lea eax, [ebp - 0x91c]
mov edx, dword [ebp - 0x5c]
call fcn.00013ed4
mov edx, dword [ebp - 0x91c]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x18726e
lea edx, [ebp - 0x920]
mov eax, 0x189638
call fcn.00031d88
lea eax, [ebp - 0x920]
mov edx, dword [ebp - 0x5c]
call fcn.00013ed4
mov edx, dword [ebp - 0x920]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x18726e
lea eax, [ebp - 0x924]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0x924]
mov edx, 0x189650
call fcn.00013fdc
jne 0x182202
lea edx, [ebp - 0x928]
mov eax, 0x50
call fcn.0002d13c
mov edx, dword [ebp - 0x928]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x5c]
mov ecx, 0xc
mov edx, 1
call fcn.00014114
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x5c]
call fcn.00015490
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jb 0x1821f6
cmp dword [ebp - 0xac], 0xffffffff
je 0x1821f6
lea edx, [ebp - 0x92c]
mov eax, 0x51
call fcn.0002d13c
mov edx, dword [ebp - 0x92c]
lea eax, [ebp - 0x174]
call fcn.00013ed4
call fcn.00019298
mov dword [ebp - 0xc0], eax
xor eax, eax
push ebp
push 0x1821ef
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x934]
mov eax, dword [ebp - 0xac]
call fcn.00033438
push dword [ebp - 0x934]
lea edx, [ebp - 0x938]
mov eax, 0x189660
call fcn.00031d88
push dword [ebp - 0x938]
mov eax, dword [ebp - 0xac]
call fcn.0010f840
lea edx, [ebp - 0x93c]
call fcn.00033438
push dword [ebp - 0x93c]
lea edx, [ebp - 0x940]
mov eax, 0x189060
call fcn.00031d88
push dword [ebp - 0x940]
lea eax, [ebp - 0x930]
mov edx, 4
call fcn.00013f8c
mov eax, dword [ebp - 0x930]
mov edx, dword [ebp - 0xc0]
call fcn.00019ef4
lea edx, [ebp - 0x944]
mov eax, dword [ebp - 0xc0]
call fcn.00018fcc
mov edx, dword [ebp - 0x944]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1821f6
lea eax, [ebp - 0xc0]
call fcn.000192a8
ret
mov dword [ebp - 0x30], 0x20001015
jmp 0x18726e
lea eax, [ebp - 0x948]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0x948]
mov edx, 0x189688
call fcn.00013fdc
jne 0x182390
lea edx, [ebp - 0x94c]
mov eax, 0x52
call fcn.0002d13c
mov edx, dword [ebp - 0x94c]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov edx, dword [0x2a8dd0]
mov al, 1
call fcn.00155fa4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, 5
ja case.0x18226e.0
jmp dword [eax*4 + 0x182275]
lea edx, [ebp - 0x950]
mov eax, 0x189698
call fcn.00031d88
mov edx, dword [ebp - 0x950]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
jmp 0x18726e
lea edx, [ebp - 0x954]
mov eax, 0x1896c8
call fcn.00031d88
mov edx, dword [ebp - 0x954]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
jmp 0x18726e
lea edx, [ebp - 0x958]
mov eax, 0x1896fc
call fcn.00031d88
mov edx, dword [ebp - 0x958]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x18726e
lea edx, [ebp - 0x95c]
mov eax, 0x189724
call fcn.00031d88
mov edx, dword [ebp - 0x95c]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
jmp 0x18726e
lea edx, [ebp - 0x960]
mov eax, 0x189750
call fcn.00031d88
mov edx, dword [ebp - 0x960]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
jmp 0x18726e
lea edx, [ebp - 0x964]
mov eax, 0x18977c
call fcn.00031d88
lea eax, [ebp - 0x964]
push eax
mov eax, dword [ebp - 0x30]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x968]
call fcn.00033468
mov edx, dword [ebp - 0x968]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x964]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x18726e
lea eax, [ebp - 0x96c]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0x96c]
mov edx, 0x1897a4
call fcn.00013fdc
jne 0x1824ed
lea edx, [ebp - 0x970]
mov eax, 0x53
call fcn.0002d13c
mov edx, dword [ebp - 0x970]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov dword [ebp - 0x30], 0x63
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x5c]
call fcn.00013cd4
lea eax, [ebp - 0x4c]
mov ecx, 0xc
mov edx, 1
call fcn.00014114
call fcn.00019270
mov dword [ebp - 0xa0], eax
xor eax, eax
push ebp
push 0x1824e6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x974]
mov eax, 0x188f08
call fcn.00031d88
mov edx, dword [ebp - 0x974]
mov eax, dword [ebp - 0x4c]
call fcn.00013fdc
jne 0x18245e
mov eax, dword [ebp - 0xa0]
call fcn.001587f4
test eax, eax
jle 0x182455
mov dword [ebp - 0x30], 1
jmp 0x18249d
mov dword [ebp - 0x30], 2
jmp 0x18249d
lea edx, [ebp - 0x978]
mov eax, 0x1897b4
call fcn.00031d88
mov edx, dword [ebp - 0x978]
mov eax, dword [ebp - 0x4c]
call fcn.00013fdc
jne 0x18249d
mov eax, dword [ebp - 0xa0]
call fcn.00158e64
test eax, eax
jle 0x182496
mov dword [ebp - 0x30], 3
jmp 0x18249d
mov dword [ebp - 0x30], 4
mov eax, dword [ebp - 0xa0]
call fcn.00018c24
test eax, eax
jbe 0x1824cd
lea edx, [ebp - 0x97c]
mov eax, dword [ebp - 0xa0]
call fcn.00018c10
mov edx, dword [ebp - 0x97c]
mov eax, dword [0x2a8dd0]
call fcn.00138bc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x18726e
lea eax, [ebp - 0xa0]
call fcn.00019280
ret
lea eax, [ebp - 0x980]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0x980]
mov edx, 0x1897c0
call fcn.00013fdc
jne 0x1828da
lea edx, [ebp - 0x984]
mov eax, 0x54
call fcn.0002d13c
mov edx, dword [ebp - 0x984]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov dword [ebp - 0x30], 0x63
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x5c]
call fcn.00013cd4
lea eax, [ebp - 0x4c]
mov ecx, 0xc
mov edx, 1
call fcn.00014114
lea eax, [ebp - 0x20]
call fcn.00014314
lea ecx, [ebp - 0x104]
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xac]
call fcn.000ae5d4
lea eax, [ebp - 0x20]
call fcn.00014314
lea ecx, [ebp - 0xf8]
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xac]
call fcn.000aef20
lea eax, [ebp - 0x20]
call fcn.00014314
push dword [ebp - 0xf8]
push 0x188fc8
push dword [ebp - 0x104]
lea eax, [ebp - 0x988]
mov edx, 3
call fcn.00014618
mov eax, dword [ebp - 0x988]
lea edx, [ebp - 0x78]
call fcn.0001de60
mov eax, dword [ebp - 0x78]
call fcn.00013ecc
test eax, eax
jle 0x1826dc
lea eax, [ebp - 0x98c]
call fcn.0002dec4
push dword [ebp - 0x98c]
push 0x1897d8
lea edx, [ebp - 0x998]
mov eax, 0x1897e8
call fcn.00031d88
push dword [ebp - 0x998]
lea edx, [ebp - 0x99c]
mov eax, dword [ebp - 0xac]
call fcn.0002d1ec
push dword [ebp - 0x99c]
lea edx, [ebp - 0x9a0]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0x9a0]
lea eax, [ebp - 0x994]
mov edx, 4
call fcn.00013f8c
mov edx, dword [ebp - 0x994]
lea eax, [ebp - 0x990]
call fcn.000144c4
push dword [ebp - 0x990]
push dword [ebp - 0xf8]
push 0x188fc8
push dword [ebp - 0x104]
lea edx, [ebp - 0x9ac]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0x9ac]
push dword [ebp - 0x78]
lea edx, [ebp - 0x9b0]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0x9b0]
push dword [ebp - 0x4c]
lea eax, [ebp - 0x9a8]
mov edx, 4
call fcn.00013f8c
mov edx, dword [ebp - 0x9a8]
lea eax, [ebp - 0x9a4]
call fcn.000144c4
push dword [ebp - 0x9a4]
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00014618
jmp 0x18277f
lea eax, [ebp - 0x9b4]
call fcn.0002df5c
push dword [ebp - 0x9b4]
push 0x1897d8
lea edx, [ebp - 0x9c0]
mov eax, 0x1897e8
call fcn.00031d88
push dword [ebp - 0x9c0]
lea edx, [ebp - 0x9c4]
mov eax, dword [ebp - 0xac]
call fcn.0002d1ec
push dword [ebp - 0x9c4]
lea edx, [ebp - 0x9c8]
mov eax, 0x189058
call fcn.00031d88
push dword [ebp - 0x9c8]
lea eax, [ebp - 0x9bc]
mov edx, 4
call fcn.00013f8c
mov edx, dword [ebp - 0x9bc]
lea eax, [ebp - 0x9b8]
call fcn.000144c4
push dword [ebp - 0x9b8]
push dword [ebp - 0xf8]
push 0x188fc8
push dword [ebp - 0x104]
push 0x1897f4
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00014618
mov eax, dword [ebp - 0x78]
call fcn.00013ecc
test eax, eax
jle 0x18285d
lea edx, [ebp - 0x9cc]
mov eax, 0x188f08
call fcn.00031d88
mov edx, dword [ebp - 0x9cc]
mov eax, dword [ebp - 0x4c]
call fcn.00013fdc
jne 0x1827f6
lea edx, [ebp - 0x9d0]
mov eax, 0x55
call fcn.0002d13c
mov edx, dword [ebp - 0x9d0]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [ebp - 0x78]
call fcn.001571e4
test al, al
je 0x1827ed
mov dword [ebp - 0x30], 1
mov eax, dword [ebp - 0x78]
call fcn.00157780
jmp 0x182864
mov dword [ebp - 0x30], 2
jmp 0x182864
lea edx, [ebp - 0x9d4]
mov eax, 0x1897b4
call fcn.00031d88
mov edx, dword [ebp - 0x9d4]
mov eax, dword [ebp - 0x4c]
call fcn.00013fdc
jne 0x182864
lea edx, [ebp - 0x9d8]
mov eax, 0x56
call fcn.0002d13c
mov edx, dword [ebp - 0x9d8]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [ebp - 0x78]
call fcn.001574b4
test al, al
je 0x18284c
mov dword [ebp - 0x30], 3
jmp 0x182853
mov dword [ebp - 0x30], 4
mov eax, dword [ebp - 0x78]
call fcn.0015780c
jmp 0x182864
mov dword [ebp - 0x30], 5
lea edx, [ebp - 0x9e0]
mov eax, 0x188f64
call fcn.00031d88
lea eax, [ebp - 0x9e0]
push eax
mov eax, dword [ebp - 0x30]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x9e4]
call fcn.00033468
mov edx, dword [ebp - 0x9e4]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x9e0]
lea eax, [ebp - 0x9dc]
call fcn.000144c4
mov edx, dword [ebp - 0x9dc]
lea eax, [ebp - 0x20]
call fcn.00014554
mov eax, dword [ebp - 0x20]
call fcn.00014548
test eax, eax
jle 0x18726e
mov edx, dword [ebp - 0x20]
mov eax, dword [0x2a8dd0]
call fcn.00138a38
jmp 0x18726e
lea eax, [ebp - 0x9e8]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0x9e8]
mov edx, 0x189800
call fcn.00013fdc
jne 0x182cc7
lea edx, [ebp - 0x9ec]
mov eax, 0x57
call fcn.0002d13c
mov edx, dword [ebp - 0x9ec]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov dword [ebp - 0x30], 0x63
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x5c]
call fcn.00013cd4
lea eax, [ebp - 0x4c]
mov ecx, 0xc
mov edx, 1
call fcn.00014114
lea eax, [ebp - 0x20]
call fcn.00014314
lea ecx, [ebp - 0x104]
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xac]
call fcn.000ae5d4
lea eax, [ebp - 0x20]
call fcn.00014314
lea ecx, [ebp - 0xf8]
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xac]
call fcn.000aef20
lea eax, [ebp - 0x20]
call fcn.00014314
push dword [ebp - 0xf8]
push 0x188fc8
push dword [ebp - 0x104]
lea eax, [ebp - 0x9f0]
mov edx, 3
call fcn.00014618
mov eax, dword [ebp - 0x9f0]
lea edx, [ebp - 0x78]
call fcn.0001de60
mov eax, dword [ebp - 0x78]
call fcn.00013ecc
test eax, eax
jle 0x182ac9
lea eax, [ebp - 0x9f4]
call fcn.0002dec4
push dword [ebp - 0x9f4]
push 0x1897d8
lea edx, [ebp - 0xa00]
mov eax, 0x189810
call fcn.00031d88
push dword [ebp - 0xa00]
lea edx, [ebp - 0xa04]
mov eax, dword [ebp - 0xac]
call fcn.0002d1ec
push dword [ebp - 0xa04]
lea edx, [ebp - 0xa08]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0xa08]
lea eax, [ebp - 0x9fc]
mov edx, 4
call fcn.00013f8c
mov edx, dword [ebp - 0x9fc]
lea eax, [ebp - 0x9f8]
call fcn.000144c4
push dword [ebp - 0x9f8]
push dword [ebp - 0xf8]
push 0x188fc8
push dword [ebp - 0x104]
lea edx, [ebp - 0xa14]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0xa14]
push dword [ebp - 0x78]
lea edx, [ebp - 0xa18]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0xa18]
push dword [ebp - 0x4c]
lea eax, [ebp - 0xa10]
mov edx, 4
call fcn.00013f8c
mov edx, dword [ebp - 0xa10]
lea eax, [ebp - 0xa0c]
call fcn.000144c4
push dword [ebp - 0xa0c]
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00014618
jmp 0x182b6c
lea eax, [ebp - 0xa1c]
call fcn.0002df5c
push dword [ebp - 0xa1c]
push 0x1897d8
lea edx, [ebp - 0xa28]
mov eax, 0x189810
call fcn.00031d88
push dword [ebp - 0xa28]
lea edx, [ebp - 0xa2c]
mov eax, dword [ebp - 0xac]
call fcn.0002d1ec
push dword [ebp - 0xa2c]
lea edx, [ebp - 0xa30]
mov eax, 0x189058
call fcn.00031d88
push dword [ebp - 0xa30]
lea eax, [ebp - 0xa24]
mov edx, 4
call fcn.00013f8c
mov edx, dword [ebp - 0xa24]
lea eax, [ebp - 0xa20]
call fcn.000144c4
push dword [ebp - 0xa20]
push dword [ebp - 0xf8]
push 0x188fc8
push dword [ebp - 0x104]
push 0x1897f4
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00014618
mov eax, dword [ebp - 0x78]
call fcn.00013ecc
test eax, eax
jle 0x182c4a
lea edx, [ebp - 0xa34]
mov eax, 0x188f08
call fcn.00031d88
mov edx, dword [ebp - 0xa34]
mov eax, dword [ebp - 0x4c]
call fcn.00013fdc
jne 0x182be3
lea edx, [ebp - 0xa38]
mov eax, 0x58
call fcn.0002d13c
mov edx, dword [ebp - 0xa38]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [ebp - 0x78]
call fcn.00157b6c
test al, al
je 0x182bda
mov dword [ebp - 0x30], 1
mov eax, dword [ebp - 0x78]
call fcn.00158108
jmp 0x182c51
mov dword [ebp - 0x30], 2
jmp 0x182c51
lea edx, [ebp - 0xa3c]
mov eax, 0x1897b4
call fcn.00031d88
mov edx, dword [ebp - 0xa3c]
mov eax, dword [ebp - 0x4c]
call fcn.00013fdc
jne 0x182c51
lea edx, [ebp - 0xa40]
mov eax, 0x59
call fcn.0002d13c
mov edx, dword [ebp - 0xa40]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [ebp - 0x78]
call fcn.00157e3c
test al, al
je 0x182c39
mov dword [ebp - 0x30], 3
jmp 0x182c40
mov dword [ebp - 0x30], 4
mov eax, dword [ebp - 0x78]
call fcn.00158194
jmp 0x182c51
mov dword [ebp - 0x30], 5
lea edx, [ebp - 0xa48]
mov eax, 0x188f64
call fcn.00031d88
lea eax, [ebp - 0xa48]
push eax
mov eax, dword [ebp - 0x30]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa4c]
call fcn.00033468
mov edx, dword [ebp - 0xa4c]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0xa48]
lea eax, [ebp - 0xa44]
call fcn.000144c4
mov edx, dword [ebp - 0xa44]
lea eax, [ebp - 0x20]
call fcn.00014554
mov eax, dword [ebp - 0x20]
call fcn.00014548
test eax, eax
jle 0x18726e
mov edx, dword [ebp - 0x20]
mov eax, dword [0x2a8dd0]
call fcn.00138a38
jmp 0x18726e
lea eax, [ebp - 0xa50]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0xa50]
mov edx, 0x189820
call fcn.00013fdc
jne 0x182e7f
lea edx, [ebp - 0xa54]
mov eax, 0x5a
call fcn.0002d13c
mov edx, dword [ebp - 0xa54]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x5c]
call fcn.00013cd4
lea eax, [ebp - 0x4c]
mov ecx, 0xc
mov edx, 1
call fcn.00014114
mov eax, dword [ebp - 0x4c]
call fcn.00013ecc
dec eax
jne 0x182e21
mov eax, dword [ebp - 0x4c]
cmp byte [eax], 0x30
je 0x182e70
mov eax, dword [ebp - 0x4c]
cmp byte [eax], 0x31
jne 0x182d87
mov eax, dword [0x2a924c]
mov dword [eax], 1
lea edx, [ebp - 0xa58]
mov eax, 0x189830
call fcn.00031d88
mov edx, dword [ebp - 0xa58]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
jmp 0x182e70
mov eax, dword [ebp - 0x4c]
cmp byte [eax], 0x32
jne 0x182dbf
mov eax, dword [0x2a924c]
mov dword [eax], 2
lea edx, [ebp - 0xa5c]
mov eax, 0x189854
call fcn.00031d88
mov edx, dword [ebp - 0xa5c]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
jmp 0x182e70
lea eax, [ebp - 0xa60]
mov edx, dword [ebp - 0x4c]
mov dl, byte [edx]
call fcn.00013de4
mov eax, dword [ebp - 0xa60]
push eax
lea edx, [ebp - 0xa64]
mov eax, 0x18986c
call fcn.00031d88
mov edx, dword [ebp - 0xa64]
pop eax
call fcn.00013fdc
jne 0x182e70
mov eax, dword [0x2a924c]
mov dword [eax], 3
lea edx, [ebp - 0xa68]
mov eax, 0x189870
call fcn.00031d88
mov edx, dword [ebp - 0xa68]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
jmp 0x182e70
lea edx, [ebp - 0xa70]
mov eax, 0x189894
call fcn.00031d88
push dword [ebp - 0xa70]
push dword [ebp - 0x4c]
lea edx, [ebp - 0xa74]
mov eax, 0x189060
call fcn.00031d88
push dword [ebp - 0xa74]
lea eax, [ebp - 0xa6c]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0xa6c]
mov eax, dword [0x2a8dd0]
call fcn.00138970
mov eax, dword [0x2a924c]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
jmp 0x18726e
lea eax, [ebp - 0xa78]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0xa78]
mov edx, 0x1898a4
call fcn.00013fdc
jne 0x183063
lea edx, [ebp - 0xa7c]
mov eax, 0x5c
call fcn.0002d13c
mov edx, dword [ebp - 0xa7c]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x5c]
call fcn.00013cd4
lea eax, [ebp - 0x4c]
mov ecx, 0xc
mov edx, 1
call fcn.00014114
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x4c]
call fcn.0001c4b0
mov eax, dword [ebp - 0x28]
call fcn.00014548
test eax, eax
jle 0x183011
mov eax, dword [ebp - 0x28]
call fcn.00014548
cmp eax, 0xf0
jg 0x183011
mov dx, 0x162
mov eax, dword [0x5ee048]
call fcn.0004935c
test al, al
jne 0x182fe5
xor edx, edx
push ebp
push 0x182f89
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0xa80]
mov eax, 0x5d
call fcn.0002d13c
mov edx, dword [ebp - 0xa80]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [ebp - 0xac]
push eax
mov ecx, dword [ebp - 0x28]
mov dl, 1
mov eax, dword [0x151f20]
call fcn.0018dc00
mov dword [ebp - 0x30], 2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x18726e
lea edx, [ebp - 0xa88]
mov eax, 0x1898c0
call fcn.00031d88
mov edx, dword [ebp - 0xa88]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
mov dword [ebp - 0x30], 4
jmp 0x18726e
lea edx, [ebp - 0xa8c]
mov eax, 0x189900
call fcn.00031d88
lea eax, [ebp - 0xa8c]
push eax
mov eax, dword [ebp - 0x28]
call fcn.00014548
lea edx, [ebp - 0xa90]
call fcn.00033438
mov edx, dword [ebp - 0xa90]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0xa8c]
mov eax, dword [0x2a8dd0]
call fcn.00138970
mov dword [ebp - 0x30], 5
jmp 0x18726e
lea eax, [ebp - 0xa94]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0xa94]
mov edx, 0x189930
call fcn.00013fdc
jne 0x1830b5
mov dword [ebp - 0x30], 1
cmp dword [0x2a8cd4], 0
je 0x18726e
mov eax, dword [0x2a8cd4]
mov eax, dword [eax + 0x30]
push eax
call sub.kernel32.dll_SetEvent
jmp 0x18726e
lea eax, [ebp - 0xa98]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0xa98]
mov edx, 0x189948
call fcn.00013fdc
jne 0x183236
lea edx, [ebp - 0xa9c]
mov eax, 0x5e
call fcn.0002d13c
mov edx, dword [ebp - 0xa9c]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x5c]
mov ecx, 0xc
mov edx, 1
call fcn.00014114
xor eax, eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x5c]
call fcn.00013ecc
dec eax
jne 0x183203
mov eax, dword [ebp - 0x5c]
cmp byte [eax], 0x34
jne 0x183173
call sub.kernel32.dll_GetTickCount
mov dword [0x2a8df8], eax
mov dword [0x2a8d54], 1
lea edx, [ebp - 0xaa0]
mov eax, 0x189958
call fcn.00031d88
mov edx, dword [ebp - 0xaa0]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
mov dword [ebp - 0x30], 4
jmp 0x18726e
mov eax, dword [ebp - 0x5c]
cmp byte [eax], 0x35
jne 0x1831bb
call sub.kernel32.dll_GetTickCount
mov dword [0x2a8d40], eax
mov dword [0x2a8df0], 1
lea edx, [ebp - 0xaa4]
mov eax, 0x189978
call fcn.00031d88
mov edx, dword [ebp - 0xaa4]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
mov dword [ebp - 0x30], 5
jmp 0x18726e
lea edx, [ebp - 0xaa8]
mov eax, 0x189994
call fcn.00031d88
lea eax, [ebp - 0xaa8]
push eax
lea eax, [ebp - 0xaac]
mov edx, dword [ebp - 0x5c]
mov dl, byte [edx]
call fcn.00013de4
mov edx, dword [ebp - 0xaac]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0xaa8]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
jmp 0x18726e
lea edx, [ebp - 0xab0]
mov eax, 0x1899a0
call fcn.00031d88
lea eax, [ebp - 0xab0]
mov edx, dword [ebp - 0x5c]
call fcn.00013ed4
mov edx, dword [ebp - 0xab0]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x18726e
lea eax, [ebp - 0xab4]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0xab4]
mov edx, 0x1899b8
call fcn.00013fdc
jne 0x1836cf
mov dword [ebp - 0x30], 0x20001015
lea edx, [ebp - 0xab8]
mov eax, 0x8c
call fcn.0002c224
mov edx, dword [ebp - 0xab8]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x5c]
call fcn.00013cd4
lea eax, [ebp - 0x4c]
mov ecx, 0xc
mov edx, 1
call fcn.00014114
lea eax, [ebp - 0x20]
call fcn.00014314
lea ecx, [ebp - 0x104]
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xac]
call fcn.000ae5d4
lea eax, [ebp - 0x20]
call fcn.00014314
lea ecx, [ebp - 0xf8]
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xac]
call fcn.000aef20
lea eax, [ebp - 0x20]
call fcn.00014314
push dword [ebp - 0xf8]
push 0x188fc8
push dword [ebp - 0x104]
lea eax, [ebp - 0xabc]
mov edx, 3
call fcn.00014618
mov eax, dword [ebp - 0xabc]
lea edx, [ebp - 0x78]
call fcn.0001de60
mov eax, dword [ebp - 0x78]
call fcn.00013ecc
test eax, eax
jle 0x183425
lea eax, [ebp - 0xac0]
call fcn.0002dec4
push dword [ebp - 0xac0]
push 0x1899d0
lea edx, [ebp - 0xacc]
mov eax, 0x1899e4
call fcn.00031d88
push dword [ebp - 0xacc]
lea edx, [ebp - 0xad0]
mov eax, dword [ebp - 0xac]
call fcn.0002d1ec
push dword [ebp - 0xad0]
lea edx, [ebp - 0xad4]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0xad4]
lea eax, [ebp - 0xac8]
mov edx, 4
call fcn.00013f8c
mov edx, dword [ebp - 0xac8]
lea eax, [ebp - 0xac4]
call fcn.000144c4
push dword [ebp - 0xac4]
push dword [ebp - 0xf8]
push 0x188fc8
push dword [ebp - 0x104]
lea edx, [ebp - 0xae0]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0xae0]
push dword [ebp - 0x78]
lea edx, [ebp - 0xae4]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0xae4]
push dword [ebp - 0x4c]
lea eax, [ebp - 0xadc]
mov edx, 4
call fcn.00013f8c
mov edx, dword [ebp - 0xadc]
lea eax, [ebp - 0xad8]
call fcn.000144c4
push dword [ebp - 0xad8]
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00014618
jmp 0x1834c8
lea eax, [ebp - 0xae8]
call fcn.0002df5c
push dword [ebp - 0xae8]
push 0x1899d0
lea edx, [ebp - 0xaf4]
mov eax, 0x1899e4
call fcn.00031d88
push dword [ebp - 0xaf4]
lea edx, [ebp - 0xaf8]
mov eax, dword [ebp - 0xac]
call fcn.0002d1ec
push dword [ebp - 0xaf8]
lea edx, [ebp - 0xafc]
mov eax, 0x189058
call fcn.00031d88
push dword [ebp - 0xafc]
lea eax, [ebp - 0xaf0]
mov edx, 4
call fcn.00013f8c
mov edx, dword [ebp - 0xaf0]
lea eax, [ebp - 0xaec]
call fcn.000144c4
push dword [ebp - 0xaec]
push dword [ebp - 0xf8]
push 0x188fc8
push dword [ebp - 0x104]
push 0x1897f4
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00014618
mov eax, dword [ebp - 0x78]
call fcn.00013ecc
test eax, eax
jle 0x1836ad
lea edx, [ebp - 0xb00]
mov eax, 0x188f08
call fcn.00031d88
mov edx, dword [ebp - 0xb00]
mov eax, dword [ebp - 0x4c]
call fcn.00013fdc
jne 0x1835f5
lea edx, [ebp - 0xb04]
mov eax, 0x8d
call fcn.0002c224
mov edx, dword [ebp - 0xb04]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [ebp - 0x78]
call fcn.000e9724
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
je 0x183587
lea edx, [ebp - 0xb0c]
mov eax, 0x1899e8
call fcn.00031d88
lea eax, [ebp - 0xb0c]
push eax
lea edx, [ebp - 0xb10]
mov eax, dword [ebp - 0x140]
call fcn.0002b100
mov edx, dword [ebp - 0xb10]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0xb0c]
lea eax, [ebp - 0xb08]
call fcn.000144c4
mov edx, dword [ebp - 0xb08]
lea eax, [ebp - 0x20]
call fcn.00014554
lea eax, [ebp - 0x188]
call fcn.00013c3c
lea ecx, [ebp - 0x188]
mov edx, dword [ebp - 0x78]
mov eax, 0x1899f8
call fcn.000e92a8
mov eax, dword [ebp - 0x188]
call fcn.00013ecc
test eax, eax
jle 0x1836ad
push dword [ebp - 0x20]
lea eax, [ebp - 0xb14]
call fcn.0004a6b0
push dword [ebp - 0xb14]
lea eax, [ebp - 0xb18]
mov edx, dword [ebp - 0x188]
call fcn.000144c4
push dword [ebp - 0xb18]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00014618
jmp 0x1836ad
lea edx, [ebp - 0xb1c]
mov eax, 0x1897b4
call fcn.00031d88
mov edx, dword [ebp - 0xb1c]
mov eax, dword [ebp - 0x4c]
call fcn.00013fdc
jne 0x1836ad
lea edx, [ebp - 0xb20]
mov eax, 0x8e
call fcn.0002c224
mov edx, dword [ebp - 0xb20]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [ebp - 0x78]
call fcn.000e9940
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
je 0x1836ad
cmp dword [ebp - 0x140], 2
je 0x1836ad
lea edx, [ebp - 0xb28]
mov eax, 0x189a04
call fcn.00031d88
lea eax, [ebp - 0xb28]
push eax
lea edx, [ebp - 0xb2c]
mov eax, dword [ebp - 0x140]
call fcn.0002b100
mov edx, dword [ebp - 0xb2c]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0xb28]
lea eax, [ebp - 0xb24]
call fcn.000144c4
mov edx, dword [ebp - 0xb24]
lea eax, [ebp - 0x20]
call fcn.00014554
mov eax, dword [ebp - 0x20]
call fcn.00014548
test eax, eax
jle 0x18726e
mov edx, dword [ebp - 0x20]
mov eax, dword [0x2a8dd0]
call fcn.00138a38
jmp 0x18726e
lea eax, [ebp - 0xb30]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0xb30]
mov edx, 0x189a18
call fcn.00013fdc
jne 0x183780
mov dword [ebp - 0x30], 0x20001015
lea edx, [ebp - 0xb34]
mov eax, 0xb4
call fcn.0002c224
mov edx, dword [ebp - 0xb34]
lea eax, [ebp - 0x174]
call fcn.00013ed4
cmp byte [0x2a8cbc], 0
jne 0x18375b
lea edx, [ebp - 0xb38]
mov eax, 0x189a28
call fcn.00031d88
mov edx, dword [ebp - 0xb38]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
mov byte [0x2a8cbc], 1
jmp 0x18726e
lea edx, [ebp - 0xb3c]
mov eax, 0x189a50
call fcn.00031d88
mov edx, dword [ebp - 0xb3c]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
jmp 0x18726e
lea eax, [ebp - 0xb40]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0xb40]
mov edx, 0x189a8c
call fcn.00013fdc
jne 0x183805
mov dword [ebp - 0x30], 0x20001015
lea edx, [ebp - 0xb44]
mov eax, 0xb5
call fcn.0002c224
mov edx, dword [ebp - 0xb44]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x188]
call fcn.00013c3c
lea edx, [ebp - 0x188]
mov eax, dword [0x2a93d0]
mov eax, dword [eax]
call fcn.00131140
mov edx, dword [ebp - 0x188]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
jmp 0x18726e
lea eax, [ebp - 0xb48]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0xb48]
mov edx, 0x189aa4
call fcn.00013fdc
jne 0x183b81
lea edx, [ebp - 0xb4c]
mov eax, 0xb6
call fcn.0002c224
mov edx, dword [ebp - 0xb4c]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x20]
call fcn.00014314
xor eax, eax
mov dword [ebp - 0x140], eax
lea ecx, [ebp - 0x184]
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xac]
call fcn.000ae5d4
lea eax, [ebp - 0x20]
call fcn.00014314
xor eax, eax
mov dword [ebp - 0x140], eax
lea ecx, [ebp - 0x160]
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xac]
call fcn.000aef20
push dword [ebp - 0x160]
push 0x188fc8
push dword [ebp - 0x184]
lea eax, [ebp - 0xb50]
mov edx, 3
call fcn.00014618
mov eax, dword [ebp - 0xb50]
lea edx, [ebp - 0x78]
call fcn.0001de60
mov eax, dword [ebp - 0x78]
call fcn.00013ecc
test eax, eax
jne 0x1838e6
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0x184]
call fcn.0001de60
push dword [ebp - 0x78]
lea edx, [ebp - 0xb54]
mov eax, 0x188e58
call fcn.00031d88
push dword [ebp - 0xb54]
push 0x189abc
lea eax, [ebp - 0x6c]
mov edx, 3
call fcn.00013f8c
lea eax, [ebp - 0x5c]
mov ecx, 0xc
mov edx, 1
call fcn.00014114
xor eax, eax
mov dword [ebp - 0x60], eax
xor eax, eax
push ebp
push 0x183b7a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x6c]
call fcn.00014090
push eax
push 0x80000003
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jne 0x183ac1
mov eax, dword [ebp - 0x5c]
mov edx, 0x189b00
call fcn.00013fdc
jne 0x183994
mov dword [ebp - 0x1c], 1
jmp 0x183999
xor eax, eax
mov dword [ebp - 0x1c], eax
push 4
lea eax, [ebp - 0x1c]
push eax
push 4
push 0
push 0x189b04
mov eax, dword [ebp - 0x60]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jne 0x183a2a
lea edx, [ebp - 0xb5c]
mov eax, dword [ebp - 0xac]
call fcn.00033438
push dword [ebp - 0xb5c]
lea edx, [ebp - 0xb60]
mov eax, 0x189b14
call fcn.00031d88
push dword [ebp - 0xb60]
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xb64]
call fcn.00033468
push dword [ebp - 0xb64]
lea eax, [ebp - 0xb58]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0xb58]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
jmp 0x183b58
lea edx, [ebp - 0xb6c]
mov eax, dword [ebp - 0xac]
call fcn.00033438
push dword [ebp - 0xb6c]
lea edx, [ebp - 0xb70]
mov eax, 0x189b14
call fcn.00031d88
push dword [ebp - 0xb70]
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xb74]
call fcn.00033468
push dword [ebp - 0xb74]
lea edx, [ebp - 0xb78]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0xb78]
lea edx, [ebp - 0xb7c]
mov eax, dword [ebp - 0x140]
call fcn.0002b100
push dword [ebp - 0xb7c]
lea eax, [ebp - 0xb68]
mov edx, 5
call fcn.00013f8c
mov edx, dword [ebp - 0xb68]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x183b58
lea edx, [ebp - 0xb84]
mov eax, dword [ebp - 0xac]
call fcn.00033438
push dword [ebp - 0xb84]
lea edx, [ebp - 0xb88]
mov eax, 0x189b2c
call fcn.00031d88
push dword [ebp - 0xb88]
mov eax, dword [ebp - 0x140]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xb8c]
call fcn.00033468
push dword [ebp - 0xb8c]
lea edx, [ebp - 0xb90]
mov eax, 0x189058
call fcn.00031d88
push dword [ebp - 0xb90]
push dword [ebp - 0x5c]
lea edx, [ebp - 0xb94]
mov eax, 0x189060
call fcn.00031d88
push dword [ebp - 0xb94]
lea eax, [ebp - 0xb80]
mov edx, 6
call fcn.00013f8c
mov edx, dword [ebp - 0xb80]
mov eax, dword [0x2a8dd0]
call fcn.00138970
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x18726e
cmp dword [ebp - 0x60], 0
je 0x183b74
mov eax, dword [ebp - 0x60]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x60], eax
ret
lea eax, [ebp - 0xb98]
push eax
mov ecx, 0xc
mov edx, 1
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
mov eax, dword [ebp - 0xb98]
mov edx, 0x189b48
call fcn.00013fdc
jne 0x183e0b
mov dword [ebp - 0x30], 0x20001015
lea edx, [ebp - 0xb9c]
mov eax, 0xa0
call fcn.0002c224
mov edx, dword [ebp - 0xb9c]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x5c]
mov ecx, 0xc
mov edx, 1
call fcn.00014114
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x5c]
call fcn.00015490
mov esi, eax
mov eax, dword [ebp - 0xac]
call fcn.00152be8
mov ebx, eax
cmp ebx, 1
jl 0x183dd0
cmp ebx, 0x400
jg 0x183dd0
lea eax, [ebx + ebx*2]
lea eax, [eax*4 + 0x5ee1d0]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
cmp dword [eax], 0xffffffff
je 0x183d01
mov eax, dword [ebp - 0x1a0]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xac]
je 0x183d01
push 0x189b60
lea edx, [ebp - 0xba4]
mov eax, 0x189b74
call fcn.00031d88
push dword [ebp - 0xba4]
mov eax, dword [ebp - 0x1a0]
mov eax, dword [eax + 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xba8]
call fcn.00033468
push dword [ebp - 0xba8]
lea edx, [ebp - 0xbac]
mov eax, 0x189b7c
call fcn.00031d88
push dword [ebp - 0xbac]
lea edx, [ebp - 0xbb0]
mov eax, dword [ebp - 0x1a0]
mov eax, dword [eax]
call fcn.0002d1ec
push dword [ebp - 0xbb0]
lea edx, [ebp - 0xbb4]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0xbb4]
lea edx, [ebp - 0xbb8]
mov eax, dword [ebp - 0xac]
call fcn.0002d1ec
push dword [ebp - 0xbb8]
lea eax, [ebp - 0xba0]
mov edx, 7
call fcn.00013f8c
mov edx, dword [ebp - 0xba0]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
mov eax, dword [ebp - 0x1a0]
cmp dword [eax + 8], 0
je 0x183da6
mov eax, dword [ebp - 0x1a0]
cmp esi, dword [eax + 8]
je 0x183da6
push 0x189b60
lea edx, [ebp - 0xbc0]
mov eax, 0x189b74
call fcn.00031d88
push dword [ebp - 0xbc0]
mov eax, dword [ebp - 0x1a0]
mov eax, dword [eax + 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xbc4]
call fcn.00033468
push dword [ebp - 0xbc4]
lea edx, [ebp - 0xbc8]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0xbc8]
mov eax, esi
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xbcc]
call fcn.00033468
push dword [ebp - 0xbcc]
lea eax, [ebp - 0xbbc]
mov edx, 5
call fcn.00013f8c
mov edx, dword [ebp - 0xbbc]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
call sub.kernel32.dll_GetTickCount
mov edx, dword [ebp - 0x1a0]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x1a0]
mov edx, dword [ebp - 0xac]
mov dword [eax], edx
mov eax, dword [ebp - 0x1a0]
mov dword [eax + 8], esi
jmp 0x18726e
lea edx, [ebp - 0xbd4]
mov eax, 0x189b8c
call fcn.00031d88
mov ecx, dword [ebp - 0xbd4]
mov edx, 0x189b60
lea eax, [ebp - 0xbd0]
call fcn.00013f18
mov edx, dword [ebp - 0xbd0]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x18726e
lea edx, [ebp - 0xbd8]
mov eax, 0x5f
call fcn.0002d13c
mov edx, dword [ebp - 0xbd8]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x78]
call fcn.00013c3c
mov eax, dword [0x2a95ac]
mov eax, dword [eax]
mov edx, dword [ebp - 0x5c]
call fcn.000141b8
dec eax
jne 0x183ff5
lea edx, [ebp - 0xbdc]
mov eax, 0x60
call fcn.0002d13c
mov edx, dword [ebp - 0xbdc]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [0x2a95ac]
mov eax, dword [eax]
call fcn.00013ecc
mov ecx, eax
lea eax, [ebp - 0x5c]
mov edx, 1
call fcn.00014114
lea eax, [ebp - 0x78]
mov edx, dword [ebp - 0x5c]
call fcn.00013cd4
lea ecx, [ebp - 0xf8]
lea edx, [ebp - 0x104]
mov eax, dword [ebp - 0x78]
call fcn.0001e044
lea edx, [ebp - 0xbe4]
mov eax, 0x189b94
call fcn.00031d88
push dword [ebp - 0xbe4]
push dword [ebp - 0x78]
lea edx, [ebp - 0xbe8]
mov eax, 0x1899e4
call fcn.00031d88
push dword [ebp - 0xbe8]
lea eax, [ebp - 0xbe0]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0xbe0]
lea eax, [ebp - 0x14]
call fcn.000144c4
push dword [ebp - 0x14]
push dword [ebp - 0xf8]
push 0x188fc8
push dword [ebp - 0x104]
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00014618
lea edx, [ebp - 0xbec]
mov eax, dword [ebp - 0x78]
call fcn.00033054
mov eax, dword [ebp - 0xbec]
push eax
lea eax, [ebp - 0xbf4]
call fcn.0005dea8
mov eax, dword [ebp - 0xbf4]
lea edx, [ebp - 0xbf0]
call fcn.00033054
mov edx, dword [ebp - 0xbf0]
pop eax
call fcn.00013fdc
sete byte [ebp - 0xa1]
cmp byte [ebp - 0xa1], 0
je 0x1842f3
lea edx, [ebp - 0xc04]
mov eax, 0x189ba4
call fcn.00031d88
push dword [ebp - 0xc04]
push dword [ebp - 0x78]
lea edx, [ebp - 0xc08]
mov eax, 0x189bcc
call fcn.00031d88
push dword [ebp - 0xc08]
lea eax, [ebp - 0xc00]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0xc00]
lea eax, [ebp - 0xbfc]
call fcn.000144c4
push dword [ebp - 0xbfc]
lea eax, [ebp - 0xc0c]
call fcn.0005e3f8
push dword [ebp - 0xc0c]
push 0x189bfc
lea eax, [ebp - 0xbf8]
mov edx, 3
call fcn.00014618
mov edx, dword [ebp - 0xbf8]
mov eax, dword [0x2a8dd0]
call fcn.00138a38
jmp 0x1842f3
lea edx, [ebp - 0xc10]
mov eax, 0x61
call fcn.0002d13c
mov edx, dword [ebp - 0xc10]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea edx, [ebp - 0xc18]
mov eax, 0x189c00
call fcn.00031d88
mov edx, dword [ebp - 0xc18]
lea eax, [ebp - 0xc14]
call fcn.000144c4
mov edx, dword [ebp - 0xc14]
mov eax, dword [0x2a8dd0]
call fcn.00138b00
lea eax, [ebp - 0xc1c]
mov edx, dword [ebp - 0x5c]
call fcn.000144c4
mov ecx, dword [ebp - 0xc1c]
lea eax, [ebp - 0x14]
mov edx, 0x189c10
call fcn.000145b4
lea eax, [ebp - 0x104]
mov edx, dword [ebp - 0x5c]
call fcn.000144c4
lea edx, [ebp - 0xc20]
mov eax, 0x188e58
call fcn.00031d88
mov eax, dword [ebp - 0xc20]
mov edx, dword [ebp - 0x5c]
call fcn.000141b8
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x1840aa
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x5c]
call fcn.00013cd4
jmp 0x1840bf
lea eax, [ebp - 0x4c]
push eax
mov edx, dword [ebp - 0x2c]
inc edx
mov ecx, 0xc8
mov eax, dword [ebp - 0x5c]
call fcn.000140d4
lea eax, [ebp - 0xc28]
mov edx, dword [ebp - 0x4c]
call fcn.000144c4
mov eax, dword [ebp - 0xc28]
lea edx, [ebp - 0xc24]
call fcn.0001e5f8
mov eax, dword [ebp - 0xc24]
push eax
lea eax, [ebp - 0xc30]
call fcn.0005e3f8
mov eax, dword [ebp - 0xc30]
lea edx, [ebp - 0xc2c]
call fcn.0001e5f8
mov edx, dword [ebp - 0xc2c]
pop eax
call fcn.00014660
sete byte [ebp - 0xa1]
cmp byte [ebp - 0xa1], 0
je 0x1841ad
lea edx, [ebp - 0xc40]
mov eax, 0x189ba4
call fcn.00031d88
push dword [ebp - 0xc40]
push dword [ebp - 0x5c]
lea edx, [ebp - 0xc44]
mov eax, 0x189bcc
call fcn.00031d88
push dword [ebp - 0xc44]
lea eax, [ebp - 0xc3c]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0xc3c]
lea eax, [ebp - 0xc38]
call fcn.000144c4
push dword [ebp - 0xc38]
lea eax, [ebp - 0xc48]
call fcn.0005e3f8
push dword [ebp - 0xc48]
push 0x189bfc
lea eax, [ebp - 0xc34]
mov edx, 3
call fcn.00014618
mov edx, dword [ebp - 0xc34]
mov eax, dword [0x2a8dd0]
call fcn.00138a38
mov dword [ebp - 0x1c], 0x400
mov dword [ebp - 0x48], 0x400
lea eax, [ebp - 0xcc]
mov edx, 0x400
call fcn.0002aea4
lea eax, [ebp - 0x58]
mov edx, 0x400
call fcn.0002aea4
xor eax, eax
push ebp
push 0x1842ec
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x78]
call fcn.00013c3c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xcc]
push eax
mov eax, dword [ebp - 0x5c]
call fcn.00014090
push eax
push 0
call sub.advapi32.dll_LookupAccountNameA
test eax, eax
je 0x1842c1
xor eax, eax
mov dword [ebp - 0x100], eax
xor eax, eax
push ebp
push 0x1842ba
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x100]
push eax
mov eax, dword [ebp - 0xcc]
push eax
call sub.advapi32.dll_ConvertSidToStringSidA_2
test al, al
je 0x18428f
xor eax, eax
push ebp
push 0x18427d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x100]
call fcn.00033f18
mov ecx, eax
lea eax, [ebp - 0x78]
mov edx, dword [ebp - 0x100]
call fcn.00013d24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x18428f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1842c1
cmp dword [ebp - 0x100], 0
je 0x1842b1
mov eax, dword [ebp - 0x100]
push eax
call sub.kernel32.dll_LocalFree_1
xor eax, eax
mov dword [ebp - 0x100], eax
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1842f3
lea eax, [ebp - 0x58]
mov edx, 0x400
call fcn.0002aecc
lea eax, [ebp - 0xcc]
mov edx, 0x400
call fcn.0002aecc
ret
mov eax, dword [ebp - 0x78]
call fcn.00013ecc
test eax, eax
jle 0x1871a7
mov eax, dword [ebp - 0x78]
call fcn.00013ecc
test eax, eax
jle 0x187152
lea edx, [ebp - 0xc4c]
mov eax, 0x62
call fcn.0002d13c
mov edx, dword [ebp - 0xc4c]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [ebp - 4]
mov byte [eax + 0x10d], 0
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x113]
mov edx, dword [ebp - 4]
mov byte [edx + 0x112], al
mov eax, dword [ebp - 4]
mov byte [eax + 0x111], 0
mov eax, dword [ebp - 4]
mov byte [eax + 0x10c], 0
call fcn.000e06f0
mov edx, dword [ebp - 4]
mov byte [edx + 0x10e], al
mov eax, dword [ebp - 4]
mov byte [eax + 0x10f], 0
call fcn.000e0400
mov edx, dword [ebp - 4]
mov byte [edx + 0x113], al
mov eax, dword [ebp - 4]
mov byte [eax + 0x110], 0
xor eax, eax
mov dword [ebp - 0x130], eax
xor eax, eax
mov dword [ebp - 0x138], eax
cmp byte [ebp - 0xa1], 0
jne 0x184974
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8f03]
je 0x184974
lea edx, [ebp - 0xc50]
mov eax, 0x63
call fcn.0002d13c
mov edx, dword [ebp - 0xc50]
lea eax, [ebp - 0x174]
call fcn.00013ed4
call fcn.00019270
mov dword [ebp - 0xa0], eax
xor eax, eax
push ebp
push 0x1844a5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xa0]
push eax
lea eax, [ebp - 0x130]
push eax
lea edx, [ebp - 0xc54]
mov eax, 0x1897b4
call fcn.00031d88
mov eax, dword [ebp - 0xc54]
push eax
push dword [ebp - 0xf8]
push 0x188fc8
push dword [ebp - 0x104]
lea eax, [ebp - 0xc58]
mov edx, 3
call fcn.00014618
mov edx, dword [ebp - 0xc58]
mov ecx, dword [ebp - 0xac]
pop eax
call fcn.000f0704
mov eax, dword [ebp - 0xa0]
call fcn.00018c24
test eax, eax
jbe 0x18448c
lea edx, [ebp - 0xc5c]
mov eax, dword [ebp - 0xa0]
call fcn.00018c10
mov edx, dword [ebp - 0xc5c]
mov eax, dword [0x2a8dd0]
call fcn.00138a38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1844ac
lea eax, [ebp - 0xa0]
call fcn.00019280
ret
lea edx, [ebp - 0xcc8]
mov eax, 0x67
call fcn.0002c224
mov edx, dword [ebp - 0xcc8]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x10]
mov edx, 0x400
call fcn.0002aea4
xor eax, eax
push ebp
push 0x18714b
push dword fs:[eax]
mov dword fs:[eax], esp
push dword [ebp - 0x78]
lea edx, [ebp - 0xccc]
mov eax, 0x188e58
call fcn.00031d88
push dword [ebp - 0xccc]
push 0x189abc
lea eax, [ebp - 0x6c]
mov edx, 3
call fcn.00013f8c
xor eax, eax
mov dword [ebp - 0x60], eax
xor eax, eax
push ebp
push 0x184b19
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x60]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
mov eax, dword [ebp - 0x6c]
call fcn.00014090
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jne 0x184aa7
push 0x189b04
mov eax, dword [ebp - 0x60]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
je 0x184af7
cmp dword [ebp - 0x140], 2
je 0x184af7
push dword [ebp - 0x6c]
lea edx, [ebp - 0xcd4]
mov eax, 0x189ca4
call fcn.00031d88
push dword [ebp - 0xcd4]
lea edx, [ebp - 0xcd8]
mov eax, dword [ebp - 0x140]
call fcn.0002b100
push dword [ebp - 0xcd8]
lea eax, [ebp - 0xcd0]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0xcd0]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x184af7
push dword [ebp - 0x6c]
lea edx, [ebp - 0xce0]
mov eax, 0x189cb0
call fcn.00031d88
push dword [ebp - 0xce0]
lea edx, [ebp - 0xce4]
mov eax, dword [ebp - 0x140]
call fcn.0002b100
push dword [ebp - 0xce4]
lea eax, [ebp - 0xcdc]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0xcdc]
mov eax, dword [0x2a8dd0]
call fcn.00138970
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x184b20
cmp dword [ebp - 0x60], 0
je 0x184b13
mov eax, dword [ebp - 0x60]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x60], eax
ret
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x140], eax
lea edx, [ebp - 0xfe0]
mov eax, 0x18a044
call fcn.00031d88
mov edx, dword [ebp - 0xfe0]
mov eax, dword [0x2a8dd0]
call fcn.00138970
lea edx, [ebp - 0xfe4]
mov eax, dword [ebp - 0x140]
call fcn.0002b100
mov edx, dword [ebp - 0xfe4]
mov eax, dword [0x2a8dd0]
call fcn.00138970
mov dword [ebp - 0x30], 0x20001021
jmp 0x187208
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x140], eax
lea edx, [ebp - 0xfe8]
mov eax, 0x18a05c
call fcn.00031d88
lea eax, [ebp - 0xfe8]
mov edx, dword [ebp - 0x5c]
call fcn.00013ed4
mov edx, dword [ebp - 0xfe8]
mov eax, dword [0x2a8dd0]
call fcn.00138970
lea edx, [ebp - 0xfec]
mov eax, dword [ebp - 0x140]
call fcn.0002b100
mov edx, dword [ebp - 0xfec]
mov eax, dword [0x2a8dd0]
call fcn.00138970
mov dword [ebp - 0x30], 0x20001018
mov eax, dword [ebp - 0x14]
call fcn.00014548
test eax, eax
jle 0x18726e
mov edx, dword [ebp - 0x14]
mov eax, dword [0x2a8dd0]
call fcn.00138a38
jmp 0x18726e
lea edx, [ebp - 0xff0]
mov eax, 0x18a07c
call fcn.00031d88
lea eax, [ebp - 0xff0]
push eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xff4]
call fcn.00033468
mov edx, dword [ebp - 0xff4]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0xff0]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
mov dword [ebp - 0x30], 0x20001017
lea edx, [ebp - 0xd4]
mov eax, 0x2a8fe4
mov ecx, 4
call fcn.00012840
inc dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x30]
mov dword [eax], edx
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8efd]
jne 0x1873eb
cmp byte [0x2a8e3c], 0
je 0x1873eb
cmp byte [0x2a8d10], 0
je 0x1873eb
lea edx, [ebp - 0xff8]
mov eax, 0x2d
call fcn.0002d13c
mov edx, dword [ebp - 0xff8]
lea eax, [ebp - 0x174]
call fcn.00013ed4
inc dword [ebp - 0x150]
inc dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
cmp byte [eax], 1
jne 0x187317
lea edx, [ebp - 0xffc]
mov eax, 0x18a088
call fcn.00031d88
mov eax, dword [ebp - 0xffc]
xor edx, edx
call fcn.0013059c
jmp 0x1873eb
mov eax, dword [ebp - 0xd4]
cmp byte [eax], 2
jne 0x187347
lea edx, [ebp - 0x1000]
mov eax, 0x18a088
call fcn.00031d88
mov eax, dword [ebp - 0x1000]
mov edx, 1
call fcn.0013059c
jmp 0x1873eb
mov eax, dword [ebp - 0xd4]
cmp byte [eax], 3
jne 0x187374
lea edx, [ebp - 0x1004]
mov eax, 0x18a088
call fcn.00031d88
mov eax, dword [ebp - 0x1004]
mov edx, 2
call fcn.0013059c
jmp 0x1873eb
mov eax, dword [ebp - 0xd4]
cmp byte [eax], 4
jne 0x1873a1
lea edx, [ebp - 0x1008]
mov eax, 0x18a088
call fcn.00031d88
mov eax, dword [ebp - 0x1008]
mov edx, 3
call fcn.0013059c
jmp 0x1873eb
mov eax, dword [ebp - 0xd4]
cmp byte [eax], 5
jne 0x1873ce
lea edx, [ebp - 0x100c]
mov eax, 0x18a088
call fcn.00031d88
mov eax, dword [ebp - 0x100c]
mov edx, 3
call fcn.0013059c
jmp 0x1873eb
lea edx, [ebp - 0x1010]
mov eax, 0x18a088
call fcn.00031d88
mov eax, dword [ebp - 0x1010]
xor edx, edx
call fcn.0013059c
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8efe]
je 0x187410
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8eff]
je 0x187410
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8f00]
jne 0x18815d
cmp byte [0x2a8e3c], 0
je 0x18815d
cmp byte [0x2a8d10], 0
je 0x18815d
lea edx, [ebp - 0x1014]
mov eax, 0x2e
call fcn.0002d13c
mov edx, dword [ebp - 0x1014]
lea eax, [ebp - 0x174]
call fcn.00013ed4
inc dword [ebp - 0x150]
inc dword [ebp - 0xd4]
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffff
je 0x1874d0
call fcn.00019270
mov dword [ebp - 0xa0], eax
xor eax, eax
push ebp
push 0x1874c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x40]
call fcn.000b93b8
lea edx, [ebp - 0x1018]
mov eax, dword [ebp - 0xa0]
call fcn.00018c10
mov edx, dword [ebp - 0x1018]
mov eax, dword [0x2a8dd0]
call fcn.00138a38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1874d0
lea eax, [ebp - 0xa0]
call fcn.00019280
ret
add dword [ebp - 0xd4], 4
mov eax, dword [ebp - 0xd4]
mov bx, word [eax]
test bx, bx
jbe 0x18811c
call fcn.000acc90
sub eax, 0xc8
movzx edx, bx
cmp eax, edx
jle 0x18811c
lea edx, [ebp - 0x101c]
mov eax, 0x2f
call fcn.0002d13c
mov edx, dword [ebp - 0x101c]
lea eax, [ebp - 0x174]
call fcn.00013ed4
add dword [ebp - 0xd4], 2
movzx edx, bx
lea eax, [ebp - 0xe8]
call fcn.00014200
lea eax, [ebp - 0xe8]
call fcn.0001409c
mov edx, eax
movzx ecx, bx
mov eax, dword [ebp - 0xd4]
call fcn.00012840
mov edx, dword [ebp - 0xe8]
mov eax, 0x18a09c
call fcn.000141b8
dec eax
jne 0x18758f
lea edx, [ebp - 0x1020]
mov eax, 0x8b
call fcn.0002c224
mov edx, dword [ebp - 0x1020]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov byte [0x2a8e74], 2
jmp 0x18815d
mov edx, dword [ebp - 0xe8]
mov eax, 0x18a0b4
call fcn.000141b8
dec eax
jne 0x187704
lea edx, [ebp - 0x1024]
mov eax, 0x30
call fcn.0002d13c
mov edx, dword [ebp - 0x1024]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0xe8]
mov ecx, 0xc
mov edx, 1
call fcn.00014114
lea eax, [ebp - 0x124]
call fcn.00014314
mov edx, 0x18a0b4
lea eax, [ebp - 0x102c]
mov ecx, dword [ebp - 0xe8]
call fcn.00013f18
mov edx, dword [ebp - 0x102c]
lea eax, [ebp - 0x1028]
call fcn.000144c4
mov eax, dword [ebp - 0x1028]
push eax
mov eax, dword [ebp - 0x40]
push eax
push 0
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x1038]
call fcn.0002b6e4
mov eax, dword [ebp - 0x1038]
lea edx, [ebp - 0x1034]
call fcn.00035eb0
lea eax, [ebp - 0x1034]
push eax
lea eax, [ebp - 0x103c]
call fcn.00027f5c
mov edx, dword [ebp - 0x103c]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x1034]
lea eax, [ebp - 0x1030]
call fcn.000144c4
mov eax, dword [ebp - 0x1030]
push eax
lea eax, [ebp - 0x1048]
call fcn.0002b6e4
mov eax, dword [ebp - 0x1048]
lea edx, [ebp - 0x1044]
call fcn.00035eb0
lea eax, [ebp - 0x1044]
push eax
lea eax, [ebp - 0x104c]
call fcn.00027f5c
mov edx, dword [ebp - 0x104c]
pop eax
call fcn.00013ed4
mov edx, dword [ebp - 0x1044]
lea eax, [ebp - 0x1040]
call fcn.000144c4
mov eax, dword [ebp - 0x1040]
push eax
lea eax, [ebp - 0x1054]
call fcn.000ad128
mov edx, dword [ebp - 0x1054]
lea eax, [ebp - 0x1050]
call fcn.000144c4
mov edx, dword [ebp - 0x1050]
pop eax
pop ecx
call fcn.0010fd30
mov edx, dword [ebp - 0x124]
mov eax, dword [0x2a8dd0]
call fcn.00138a38
jmp 0x18815d
mov edx, dword [ebp - 0xe8]
mov eax, 0x18a0cc
call fcn.000141b8
dec eax
jne 0x1877e0
lea edx, [ebp - 0x1058]
mov eax, 0x31
call fcn.0002d13c
mov edx, dword [ebp - 0x1058]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea eax, [ebp - 0x4c]
call fcn.0014d3f4
mov edx, dword [ebp - 0x4c]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
lea eax, [ebp - 0x4c]
call fcn.0014d498
mov edx, dword [ebp - 0x4c]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
lea eax, [ebp - 0x4c]
call fcn.0014e7a0
mov edx, dword [ebp - 0x4c]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
call fcn.00019270
mov dword [ebp - 0xa0], eax
xor eax, eax
push ebp
push 0x1877d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xa0]
call fcn.0014fd28
lea edx, [ebp - 0x105c]
mov eax, dword [ebp - 0xa0]
call fcn.00018c10
mov edx, dword [ebp - 0x105c]
mov eax, dword [0x2a8dd0]
call fcn.00138a38
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x18815d
lea eax, [ebp - 0xa0]
call fcn.00019280
ret
mov edx, dword [ebp - 0xe8]
mov eax, 0x18a0e4
call fcn.000141b8
dec eax
jne 0x187a98
lea edx, [ebp - 0x1060]
mov eax, 0x32
call fcn.0002d13c
mov edx, dword [ebp - 0x1060]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [0x2a976c]
push eax
mov eax, dword [0x2a9198]
push eax
mov eax, dword [0x2a9634]
push eax
mov eax, dword [0x2a936c]
push eax
mov eax, dword [0x2a961c]
push eax
lea eax, [ebp - 0x131]
push eax
lea eax, [ebp - 0x146]
push eax
lea eax, [ebp - 0x16e]
push eax
lea eax, [ebp - 0x152]
push eax
lea eax, [ebp - 0x133]
push eax
lea eax, [ebp - 0x139]
push eax
lea eax, [ebp - 0x176]
push eax
mov eax, dword [0x2a91cc]
push eax
mov eax, dword [0x2a9834]
push eax
lea eax, [ebp - 0x151]
push eax
lea eax, [ebp - 0x161]
push eax
lea eax, [ebp - 0x16d]
push eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x145]
push eax
lea eax, [ebp - 0x162]
push eax
lea eax, [ebp - 0x132]
push eax
lea eax, [ebp - 0x147]
push eax
mov eax, dword [0x2a934c]
push eax
mov ecx, dword [0x2a9160]
mov edx, dword [0x2a9700]
mov eax, dword [0x2a9498]
call fcn.000b1f6c
mov eax, dword [0x2a902c]
mov eax, dword [eax]
mov dx, 0xb6
call fcn.00049330
xor eax, eax
push ebp
push 0x187a27
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x2a92c0]
mov eax, dword [eax]
mov dword [ebp - 0x1a4], eax
mov al, byte [ebp - 0x16d]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x1a4]
mov word [edx + 0xe], ax
mov eax, dword [ebp - 0x1a4]
mov dl, byte [ebp - 0x139]
mov byte [eax + 7], dl
mov eax, dword [ebp - 0x1a4]
mov dl, byte [ebp - 0x16e]
mov byte [eax + 4], dl
mov al, byte [ebp - 0x151]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x1a4]
mov word [edx + 0xa], ax
mov al, byte [ebp - 0x176]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x1a4]
mov word [edx + 8], ax
mov al, byte [ebp - 0x162]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x1a4]
mov word [edx + 0x14], ax
mov al, byte [ebp - 0x134]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x1a4]
mov word [edx + 0x10], ax
mov al, byte [ebp - 0x145]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x1a4]
mov word [edx + 0x12], ax
mov al, byte [ebp - 0x146]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x1a4]
mov word [edx + 2], ax
mov eax, dword [ebp - 0x1a4]
mov dl, byte [ebp - 0x133]
mov byte [eax + 6], dl
mov al, byte [ebp - 0x131]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x1a4]
mov word [edx], ax
mov al, byte [ebp - 0x132]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x1a4]
mov word [edx + 0x16], ax
mov eax, dword [ebp - 0x1a4]
mov dl, byte [ebp - 0x152]
mov byte [eax + 5], dl
mov al, byte [ebp - 0x161]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x1a4]
mov word [edx + 0xc], ax
mov al, byte [ebp - 0x147]
neg al
sbb eax, eax
mov edx, dword [ebp - 0x1a4]
mov word [edx + 0x18], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x187a2e
mov eax, dword [0x2a902c]
mov eax, dword [eax]
mov dx, 0xb6
call fcn.0004933c
ret
mov edx, dword [ebp - 0xe8]
mov eax, 0x18a170
call fcn.000141b8
dec eax
jne 0x187d78
lea edx, [ebp - 0x106c]
mov eax, 0x33
call fcn.0002d13c
mov edx, dword [ebp - 0x106c]
lea eax, [ebp - 0x174]
call fcn.00013ed4
call fcn.000e2d3c
test al, al
je 0x187d53
lea edx, [ebp - 0x1070]
mov eax, 0x34
call fcn.0002d13c
mov edx, dword [ebp - 0x1070]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea edx, [ebp - 0x1078]
mov eax, 0x18a180
call fcn.00031d88
push dword [ebp - 0x1078]
push 0x1894d0
lea edx, [ebp - 0x107c]
mov eax, 0x18a198
call fcn.00031d88
push dword [ebp - 0x107c]
lea eax, [ebp - 0x1080]
call fcn.000277dc
push dword [ebp - 0x1080]
lea edx, [ebp - 0x1084]
mov eax, 0x1899e4
call fcn.00031d88
push dword [ebp - 0x1084]
lea eax, [ebp - 0x1088]
call fcn.0002c5c8
push dword [ebp - 0x1088]
lea eax, [ebp - 0x1074]
mov edx, 6
call fcn.00013f8c
mov eax, dword [ebp - 0x1074]
push eax
lea eax, [ebp - 0x1090]
call fcn.000277dc
push dword [ebp - 0x1090]
lea edx, [ebp - 0x1094]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0x1094]
lea eax, [ebp - 0x1098]
call fcn.0002c5c8
push dword [ebp - 0x1098]
lea edx, [ebp - 0x109c]
mov eax, 0x18a1a4
call fcn.00031d88
push dword [ebp - 0x109c]
mov eax, dword [0x2a8e94]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10a0]
call fcn.00033468
push dword [ebp - 0x10a0]
lea edx, [ebp - 0x10a4]
mov eax, 0x189060
call fcn.00031d88
push dword [ebp - 0x10a4]
lea eax, [ebp - 0x108c]
mov edx, 6
call fcn.00013f8c
mov eax, dword [ebp - 0x108c]
pop edx
call fcn.00152558
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jle 0x187cc0
lea edx, [ebp - 0x10ac]
mov eax, 0x18a1b4
call fcn.00031d88
push dword [ebp - 0x10ac]
mov eax, dword [0x2a8e94]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x10b0]
call fcn.00033468
push dword [ebp - 0x10b0]
lea edx, [ebp - 0x10b4]
mov eax, 0x18a1cc
call fcn.00031d88
push dword [ebp - 0x10b4]
lea edx, [ebp - 0x10b8]
mov eax, dword [ebp - 0x2c]
call fcn.00033438
push dword [ebp - 0x10b8]
lea edx, [ebp - 0x10bc]
mov eax, 0x18a1e0
call fcn.00031d88
push dword [ebp - 0x10bc]
lea eax, [ebp - 0x10a8]
mov edx, 5
call fcn.00013f8c
mov edx, dword [ebp - 0x10a8]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
inc dword [0x2a8e94]
jmp 0x18815d
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x187ceb
lea edx, [ebp - 0x10c0]
mov eax, 0x18a1e8
call fcn.00031d88
mov edx, dword [ebp - 0x10c0]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
jmp 0x18815d
lea edx, [ebp - 0x10c8]
mov eax, 0x18a220
call fcn.00031d88
push dword [ebp - 0x10c8]
lea edx, [ebp - 0x10cc]
mov eax, dword [ebp - 0xc4]
call fcn.00033438
push dword [ebp - 0x10cc]
lea edx, [ebp - 0x10d0]
mov eax, 0x189060
call fcn.00031d88
push dword [ebp - 0x10d0]
lea eax, [ebp - 0x10c4]
mov edx, 3
call fcn.00013f8c
mov edx, dword [ebp - 0x10c4]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
jmp 0x18815d
lea edx, [ebp - 0x10d4]
mov eax, 0x18a254
call fcn.00031d88
mov edx, dword [ebp - 0x10d4]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
jmp 0x18815d
mov eax, dword [0x2a95ac]
mov eax, dword [eax]
mov edx, dword [ebp - 0xe8]
call fcn.000141b8
dec eax
jne 0x187fe1
lea edx, [ebp - 0x10d8]
mov eax, 0x35
call fcn.0002d13c
mov edx, dword [ebp - 0x10d8]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [0x2a95ac]
mov eax, dword [eax]
call fcn.00013ecc
mov ecx, eax
lea eax, [ebp - 0xe8]
mov edx, 1
call fcn.00014114
lea edx, [ebp - 0x124]
mov eax, dword [ebp - 0xe8]
call fcn.0001e384
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8efe]
jne 0x187f35
lea edx, [ebp - 0x10dc]
mov eax, 0x188e50
call fcn.00031d88
mov edx, dword [ebp - 0x10dc]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov edx, dword [ebp - 0x124]
mov eax, 0x18a28c
call fcn.00014874
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jl 0x187ea1
lea edx, [ebp - 0x10e0]
mov eax, 0x18a2a8
call fcn.00031d88
mov edx, dword [ebp - 0x10e0]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea edx, [ebp - 0x10e4]
mov eax, 0x18a2ac
call fcn.00031d88
mov edx, dword [ebp - 0x10e4]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea edx, [ebp - 0x10e8]
mov eax, 0x18a2b0
call fcn.00031d88
lea eax, [ebp - 0x10e8]
mov edx, 0x18a2c8
call fcn.00013ed4
mov edx, dword [ebp - 0x10e8]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
jmp 0x18815d
lea edx, [ebp - 0x10ec]
mov eax, 0x18a2d8
call fcn.00031d88
mov edx, dword [ebp - 0x10ec]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [ebp - 0x124]
call fcn.00014548
test eax, eax
jle 0x18815d
mov eax, dword [0x2a9220]
cmp dword [eax], 0
je 0x187f20
call sub.kernel32.dll_GetTickCount
mov edx, dword [0x2a9220]
mov edx, dword [edx]
call fcn.0002cde4
cmp eax, 0x1d4c0
jb 0x187f03
mov eax, dword [0x2a9220]
xor edx, edx
mov dword [eax], edx
jmp 0x187f20
mov edx, dword [ebp - 0x124]
mov eax, 0x18a2e0
call fcn.00014874
test eax, eax
jle 0x187f20
mov eax, dword [0x2a9220]
xor edx, edx
mov dword [eax], edx
mov edx, dword [ebp - 0x124]
mov eax, dword [0x2a8dd0]
call fcn.00138a38
jmp 0x18815d
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8eff]
jne 0x187f89
lea edx, [ebp - 0x10f0]
mov eax, 0x18a2f0
call fcn.00031d88
mov edx, dword [ebp - 0x10f0]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [ebp - 0x124]
call fcn.00014548
test eax, eax
jle 0x18815d
mov edx, dword [ebp - 0x124]
mov eax, dword [0x2a8dd0]
call fcn.00138b00
jmp 0x18815d
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8f00]
jne 0x18815d
lea edx, [ebp - 0x10f4]
mov eax, 0x18a2f4
call fcn.00031d88
mov edx, dword [ebp - 0x10f4]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [ebp - 0x124]
call fcn.00014548
test eax, eax
jle 0x18815d
mov edx, dword [ebp - 0x124]
mov eax, dword [0x2a8dd0]
call fcn.00138bc8
jmp 0x18815d
lea edx, [ebp - 0x10f8]
mov eax, 0x36
call fcn.0002d13c
mov edx, dword [ebp - 0x10f8]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea edx, [ebp - 0x10fc]
mov eax, 0x18a2f8
call fcn.00031d88
mov edx, dword [ebp - 0x10fc]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8efe]
jne 0x188077
lea edx, [ebp - 0x1100]
mov eax, 0x18a2fc
call fcn.00031d88
mov edx, dword [ebp - 0x1100]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [ebp - 0xe8]
call fcn.00013ecc
test eax, eax
jle 0x18815d
mov edx, dword [ebp - 0xe8]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
jmp 0x18815d
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8eff]
jne 0x1880cb
lea edx, [ebp - 0x1104]
mov eax, 0x18a300
call fcn.00031d88
mov edx, dword [ebp - 0x1104]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [ebp - 0xe8]
call fcn.00013ecc
test eax, eax
jle 0x18815d
mov edx, dword [ebp - 0xe8]
mov eax, dword [0x2a8dd0]
call fcn.001388a8
jmp 0x18815d
mov al, byte [ebp - 0x71]
cmp al, byte [0x2a8f00]
jne 0x18815d
lea edx, [ebp - 0x1108]
mov eax, 0x18a304
call fcn.00031d88
mov edx, dword [ebp - 0x1108]
lea eax, [ebp - 0x174]
call fcn.00013ed4
mov eax, dword [ebp - 0xe8]
call fcn.00013ecc
test eax, eax
jle 0x18815d
mov edx, dword [ebp - 0xe8]
mov eax, dword [0x2a8dd0]
call fcn.00138970
jmp 0x18815d
lea edx, [ebp - 0x110c]
mov eax, 0x18a308
call fcn.00031d88
mov edx, dword [ebp - 0x110c]
lea eax, [ebp - 0x174]
call fcn.00013ed4
lea edx, [ebp - 0x1110]
mov eax, 0x188f84
call fcn.00031d88
mov edx, dword [ebp - 0x1110]
mov eax, dword [0x2a8dd0]
call fcn.00138970
lea edx, [ebp - 0x1114]
mov eax, 0x18a2a8
call fcn.00031d88
mov edx, dword [ebp - 0x1114]
lea eax, [ebp - 0x174]
call fcn.00013ed4
cmp dword [ebp - 0x150], 1
je 0x1882b0
cmp byte [0x2a8e3c], 0
je 0x1882b0
cmp byte [0x2a8d10], 0
je 0x1882b0
lea edx, [ebp - 0x111c]
mov eax, 0x18a30c
call fcn.00031d88
push dword [ebp - 0x111c]
lea edx, [ebp - 0x1120]
mov eax, dword [ebp - 0x150]
call fcn.00033438
push dword [ebp - 0x1120]
lea edx, [ebp - 0x1124]
mov eax, 0x18a31c
call fcn.00031d88
push dword [ebp - 0x1124]
lea edx, [ebp - 0x1128]
mov al, byte [ebp - 0x71]
call fcn.0002d37c
push dword [ebp - 0x1128]
lea edx, [ebp - 0x112c]
mov eax, 0x188f64
call fcn.00031d88
push dword [ebp - 0x112c]
lea edx, [ebp - 0x1130]
mov eax, dword [0x2a8e08]
call fcn.00033438
push dword [ebp - 0x1130]
lea eax, [ebp - 0x1118]
mov edx, 6
call fcn.00013f8c
mov edx, dword [ebp - 0x1118]
mov eax, dword [0x2a8dd0]
call fcn.001387e0
call fcn.000acc90
mov edx, eax
mov eax, dword [0x2a8fe4]
xor ecx, ecx
call fcn.00012b94
inc dword [0x2a8e08]
cmp dword [0x2a8e08], 0xa
jle 0x188271
mov byte [0x2a8d10], 0
cmp byte [0x2a8d10], 0
je 0x188281
mov byte [0x2a8d38], 0
cmp dword [0x2a8e08], 0xa
jle 0x1882c9
cmp byte [0x2a8d10], 0
jne 0x1882c9
call fcn.000eb13c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfff8
je 0x1882c9
mov eax, 0x505b
call fcn.000eb248
jmp 0x1882c9
cmp byte [ebp - 0x71], 0xfd
je 0x1882c9
cmp byte [ebp - 0x71], 0xfe
je 0x1882c9
cmp byte [ebp - 0x71], 0xfc
je 0x1882c9
xor eax, eax
mov dword [0x2a8e08], eax
lea edx, [ebp - 0x1134]
mov eax, 0x18a320
call fcn.00031d88
mov edx, dword [ebp - 0x1134]
lea eax, [ebp - 0x174]
call fcn.00013ed4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x18836b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x188e49
lea eax, [ebp - 0x1140]
mov edx, 0x39
call fcn.00013c60
lea eax, [ebp - 0x105c]
call fcn.00014314
lea eax, [ebp - 0x1058]
mov edx, 2
call fcn.00013c60
lea eax, [ebp - 0x1050]
call fcn.00014314
lea eax, [ebp - 0x104c]
mov edx, 3
call fcn.00013c60
lea eax, [ebp - 0x1040]
call fcn.00014314
lea eax, [ebp - 0x103c]
mov edx, 3
call fcn.00013c60
lea eax, [ebp - 0x1030]
call fcn.00014314
lea eax, [ebp - 0x102c]
call fcn.00013c3c
lea eax, [ebp - 0x1028]
call fcn.00014314
lea eax, [ebp - 0x1024]
mov edx, 3
call fcn.00013c60
lea eax, [ebp - 0x1018]
call fcn.00014314
lea eax, [ebp - 0x1014]
mov edx, 0x17
call fcn.00013c60
lea eax, [ebp - 0xfb8]
call fcn.00014314
lea eax, [ebp - 0xfb4]
call fcn.00013c3c
lea eax, [ebp - 0xfb0]
mov edx, 0xa
call fcn.00013c60
lea eax, [ebp - 0xf88]
call fcn.00014314
lea eax, [ebp - 0xf84]
mov edx, 0x1a
call fcn.00013c60
lea eax, [ebp - 0xf1c]
mov edx, 3
call fcn.0001432c
lea eax, [ebp - 0xf10]
mov edx, 9
call fcn.00013c60
lea eax, [ebp - 0xeec]
mov edx, 3
call fcn.0001432c
lea eax, [ebp - 0xee0]
mov edx, 3
call fcn.00013c60
lea eax, [ebp - 0xed4]
mov edx, 2
call fcn.0001432c
lea eax, [ebp - 0xecc]
mov edx, 2
call fcn.00013c60
lea eax, [ebp - 0xec4]
call fcn.00014314
lea eax, [ebp - 0xec0]
call fcn.00013c3c
lea eax, [ebp - 0xebc]
mov edx, 2
call fcn.0001432c
lea eax, [ebp - 0xeb4]
mov edx, 5
call fcn.00013c60
lea eax, [ebp - 0xea0]
mov edx, 4
call fcn.0001432c
lea eax, [ebp - 0xe90]
call fcn.00013c3c
lea eax, [ebp - 0xe8c]
mov edx, 4
call fcn.0001432c
lea eax, [ebp - 0xe7c]
call fcn.00013c3c
lea eax, [ebp - 0xe78]
mov edx, 2
call fcn.0001432c
lea eax, [ebp - 0xe70]
mov edx, 0x13
call fcn.00013c60
lea eax, [ebp - 0xe24]
call fcn.00014314
lea eax, [ebp - 0xe20]
mov edx, 5
call fcn.00013c60
lea eax, [ebp - 0xe0c]
call fcn.00014314
lea eax, [ebp - 0xe08]
mov edx, 6
call fcn.00013c60
lea eax, [ebp - 0xdf0]
call fcn.00014314
lea eax, [ebp - 0xdec]
mov edx, 0xd
call fcn.00013c60
lea eax, [ebp - 0xdb8]
call fcn.00014314
lea eax, [ebp - 0xdb4]
mov edx, 0x12
call fcn.00013c60
lea eax, [ebp - 0xd6c]
call fcn.00014314
lea eax, [ebp - 0xd68]
mov edx, 4
call fcn.00013c60
lea eax, [ebp - 0xd58]
call fcn.00014314
lea eax, [ebp - 0xd54]
mov edx, 8
call fcn.00013c60
lea eax, [ebp - 0xd34]
call fcn.00014314
lea eax, [ebp - 0xd30]
mov edx, 4
call fcn.00013c60
lea eax, [ebp - 0xd20]
call fcn.00014314
lea eax, [ebp - 0xd1c]
mov edx, 0x1a
call fcn.00013c60
lea eax, [ebp - 0xcb4]
mov edx, 6
call fcn.0001432c
lea eax, [ebp - 0xc90]
call fcn.00013c3c
lea eax, [ebp - 0xc8c]
mov edx, 2
call fcn.0001432c
lea eax, [ebp - 0xc9c]
mov edx, 3
call fcn.00013c60
lea eax, [ebp - 0xc84]
mov edx, 4
call fcn.0001432c
lea eax, [ebp - 0xc74]
mov edx, 6
call fcn.00013c60
lea eax, [ebp - 0xc5c]
mov edx, 2
call fcn.0001432c
lea eax, [ebp - 0xc54]
mov edx, 3
call fcn.00013c60
lea eax, [ebp - 0xc48]
call fcn.00014314
lea eax, [ebp - 0xc44]
mov edx, 3
call fcn.00013c60
lea eax, [ebp - 0xc38]
mov edx, 6
call fcn.0001432c
lea eax, [ebp - 0xc20]
call fcn.00013c3c
lea eax, [ebp - 0xc1c]
call fcn.00014314
lea eax, [ebp - 0xc18]
call fcn.00013c3c
lea eax, [ebp - 0xc14]
call fcn.00014314
lea eax, [ebp - 0xc10]
call fcn.00013c3c
lea eax, [ebp - 0xc0c]
call fcn.00014314
lea eax, [ebp - 0xc08]
mov edx, 3
call fcn.00013c60
lea eax, [ebp - 0xbfc]
mov edx, 2
call fcn.0001432c
lea eax, [ebp - 0xbf4]
mov edx, 0x29
call fcn.00013c60
lea eax, [ebp - 0xb50]
call fcn.00014314
lea eax, [ebp - 0xb4c]
mov edx, 0xa
call fcn.00013c60
lea eax, [ebp - 0xb24]
call fcn.00014314
lea eax, [ebp - 0xb20]
mov edx, 2
call fcn.00013c60
lea eax, [ebp - 0xb18]
mov edx, 2
call fcn.0001432c
lea eax, [ebp - 0xb10]
mov edx, 2
call fcn.00013c60
lea eax, [ebp - 0xb08]
call fcn.00014314
lea eax, [ebp - 0xb04]
call fcn.00013c3c
lea eax, [ebp - 0xb00]
mov edx, 5
call fcn.00013c60
lea eax, [ebp - 0xaec]
mov edx, 2
call fcn.0001432c
lea eax, [ebp - 0xae4]
mov edx, 3
call fcn.00013c60
lea eax, [ebp - 0xad8]
call fcn.00014314
lea eax, [ebp - 0xad4]
mov edx, 4
call fcn.00013c60
lea eax, [ebp - 0xac4]
mov edx, 3
call fcn.0001432c
lea eax, [ebp - 0xab8]
mov edx, 0x1d
call fcn.00013c60
lea eax, [ebp - 0xa44]
call fcn.00014314
lea eax, [ebp - 0xa40]
mov edx, 8
call fcn.00013c60
lea eax, [ebp - 0xa20]
mov edx, 2
call fcn.0001432c
lea eax, [ebp - 0xa18]
mov edx, 3
call fcn.00013c60
lea eax, [ebp - 0xa0c]
call fcn.00014314
lea eax, [ebp - 0xa08]
mov edx, 4
call fcn.00013c60
lea eax, [ebp - 0x9f8]
mov edx, 3
call fcn.0001432c
lea eax, [ebp - 0x9ec]
mov edx, 4
call fcn.00013c60
lea eax, [ebp - 0x9dc]
call fcn.00014314
lea eax, [ebp - 0x9d8]
mov edx, 8
call fcn.00013c60
lea eax, [ebp - 0x9b8]
mov edx, 2
call fcn.0001432c
lea eax, [ebp - 0x9b0]
mov edx, 3
call fcn.00013c60
lea eax, [ebp - 0x9a4]
call fcn.00014314
lea eax, [ebp - 0x9a0]
mov edx, 4
call fcn.00013c60
lea eax, [ebp - 0x990]
mov edx, 3
call fcn.0001432c
lea eax, [ebp - 0x984]
mov edx, 2
call fcn.00013c60
lea eax, [ebp - 0x97c]
call fcn.00014314
lea eax, [ebp - 0x978]
mov edx, 2
call fcn.00013c60
lea eax, [ebp - 0x970]
mov edx, 0x2f
call fcn.00013c60
lea eax, [ebp - 0x8b4]
mov edx, 2
call fcn.0001432c
lea eax, [ebp - 0x8ac]
call fcn.00013c3c
lea eax, [ebp - 0x8a8]
call fcn.00014314
lea eax, [ebp - 0x8a4]
mov edx, 0x24
call fcn.00013c60
lea eax, [ebp - 0x814]
call fcn.00014314
lea eax, [ebp - 0x810]
mov edx, 6
call fcn.00013c60
lea eax, [ebp - 0x7f8]
mov edx, 2
call fcn.0001432c
lea eax, [ebp - 0x7e0]
mov edx, 3
call fcn.00013c60
lea eax, [ebp - 0x7d4]
call fcn.00014314
lea eax, [ebp - 0x7f0]
mov edx, 4
call fcn.00013c60
lea eax, [ebp - 0x7c8]
mov edx, 3
call fcn.00013c60
lea eax, [ebp - 0x7bc]
call fcn.00014314
lea eax, [ebp - 0x7b8]
mov edx, 0xd
call fcn.00013c60
lea eax, [ebp - 0x784]
call fcn.00014314
lea eax, [ebp - 0x780]
mov edx, 0xa
call fcn.00013c60
lea eax, [ebp - 0x758]
mov edx, 2
call fcn.0001432c
lea eax, [ebp - 0x750]
mov edx, 3
call fcn.00013c60
lea eax, [ebp - 0x744]
call fcn.00014314
lea eax, [ebp - 0x740]
mov edx, 8
call fcn.00013c60
lea eax, [ebp - 0x720]
call fcn.00014314
lea eax, [ebp - 0x71c]
call fcn.00013c3c
lea eax, [ebp - 0x718]
call fcn.00014314
lea eax, [ebp - 0x714]
call fcn.00013c3c
lea eax, [ebp - 0x710]
mov edx, 3
call fcn.0001432c
lea eax, [ebp - 0x704]
mov edx, 2
call fcn.00013c60
lea eax, [ebp - 0x6fc]
mov edx, 4
call fcn.0001432c
lea eax, [ebp - 0x6ec]
call fcn.00013c3c
lea eax, [ebp - 0x6e8]
mov edx, 3
call fcn.0001432c
lea eax, [ebp - 0x6dc]
mov edx, 8
call fcn.00013c60
lea eax, [ebp - 0x6bc]
call fcn.00014314
lea eax, [ebp - 0x6b8]
mov edx, 0x12
call fcn.00013c60
lea eax, [ebp - 0x670]
mov edx, 2
call fcn.0001432c
lea eax, [ebp - 0x668]
mov edx, 2
call fcn.00013c60
lea eax, [ebp - 0x660]
mov edx, 2
call fcn.0001432c
lea eax, [ebp - 0x658]
call fcn.00013c3c
lea eax, [ebp - 0x654]
call fcn.00014314
lea eax, [ebp - 0x64c]
mov edx, 2
call fcn.0001432c
lea eax, [ebp - 0x650]
call fcn.00013c3c
lea eax, [ebp - 0x644]
call fcn.00014314
lea eax, [ebp - 0x640]
call fcn.00013c3c
lea eax, [ebp - 0x63c]
call fcn.00014314
lea eax, [ebp - 0x638]
mov edx, 6
call fcn.00013c60
lea eax, [ebp - 0x620]
mov edx, 4
call fcn.0001432c
lea eax, [ebp - 0x610]
mov edx, 0x14
call fcn.00013c60
lea eax, [ebp - 0x5c0]
mov edx, 2
call fcn.0001432c
lea eax, [ebp - 0x5b8]
mov edx, 4
call fcn.00013c60
lea eax, [ebp - 0x5a8]
mov edx, 2
call fcn.0001432c
lea eax, [ebp - 0x5a0]
call fcn.00013c3c
lea eax, [ebp - 0x59c]
call fcn.00014314
lea eax, [ebp - 0x598]
call fcn.00013c3c
lea eax, [ebp - 0x594]
mov edx, 3
call fcn.0001432c
lea eax, [ebp - 0x588]
mov edx, 6
call fcn.00013c60
lea eax, [ebp - 0x570]
mov edx, 4
call fcn.0001432c
lea eax, [ebp - 0x560]
mov edx, 0x2a
call fcn.00013c60
lea eax, [ebp - 0x4b8]
mov edx, 0xa
call fcn.00013c60
lea eax, [ebp - 0x490]
mov edx, 0xc
call fcn.0001432c
lea eax, [ebp - 0x460]
mov edx, 0x1e
call fcn.00013c60
lea eax, [ebp - 0x3e8]
call fcn.00014314
lea eax, [ebp - 0x3e4]
mov edx, 4
call fcn.00013c60
lea eax, [ebp - 0x3d4]
call fcn.00014314
lea eax, [ebp - 0x3d0]
mov edx, 3
call fcn.00013c60
lea eax, [ebp - 0x3c4]
call fcn.00014314
lea eax, [ebp - 0x3c0]
mov edx, 3
call fcn.00013c60
lea eax, [ebp - 0x3b4]
call fcn.00014314
lea eax, [ebp - 0x3b0]
call fcn.00013c3c
lea eax, [ebp - 0x3ac]
call fcn.00014314
lea eax, [ebp - 0x3a8]
mov edx, 0x20
call fcn.00013c60
lea eax, [ebp - 0x328]
mov edx, 0x23
call fcn.00013c60
lea eax, [ebp - 0x29c]
call fcn.00014314
lea eax, [ebp - 0x298]
mov edx, 0x13
call fcn.00013c60
lea eax, [ebp - 0x188]
call fcn.00013c3c
lea eax, [ebp - 0x184]
call fcn.00014314
lea eax, [ebp - 0x174]
call fcn.00013c3c
lea eax, [ebp - 0x16c]
call fcn.00014314
lea eax, [ebp - 0x160]
call fcn.00014314
lea eax, [ebp - 0x12c]
call fcn.00013c3c
lea eax, [ebp - 0x128]
mov edx, 2
call fcn.0001432c
lea eax, [ebp - 0x11c]
mov edx, 2
call fcn.0001432c
lea eax, [ebp - 0x114]
call fcn.00013c3c
lea eax, [ebp - 0x108]
mov edx, 2
call fcn.0001432c
lea eax, [ebp - 0xfc]
mov edx, 3
call fcn.0001432c
lea eax, [ebp - 0xf0]
call fcn.00013c3c
lea eax, [ebp - 0xe8]
call fcn.00013c3c
lea eax, [ebp - 0xe0]
call fcn.00014314
lea eax, [ebp - 0xdc]
call fcn.00013c3c
lea eax, [ebp - 0xb8]
call fcn.00014314
lea eax, [ebp - 0xb0]
call fcn.00013c3c
lea eax, [ebp - 0xa8]
call fcn.00014314
lea eax, [ebp - 0x78]
call fcn.00013c3c
lea eax, [ebp - 0x6c]
call fcn.00013c3c
lea eax, [ebp - 0x64]
call fcn.00014314
lea eax, [ebp - 0x5c]
call fcn.00013c3c
lea eax, [ebp - 0x54]
call fcn.00014314
lea eax, [ebp - 0x50]
mov edx, 2
call fcn.00013c60
lea eax, [ebp - 0x44]
call fcn.00013c3c
lea eax, [ebp - 0x3c]
call fcn.00014314
lea eax, [ebp - 0x34]
call fcn.00013c3c
lea eax, [ebp - 0x28]
call fcn.00014314
lea eax, [ebp - 0x20]
call fcn.00014314
lea eax, [ebp - 0x14]
call fcn.00014314
ret