Function at 0x10014754
Capabilities:
Compare security identifiers
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006c798
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xea4
push esi
movzx eax, byte [ebp + 0x3c]
test eax, eax
je 0x100147ad
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x988], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x854], eax
push dword [ebp - 0x988]
push 1
push 0x44a
push dword [ebp - 0x854]
call fcn.1001aef3
add esp, 0x10
jmp 0x1001aee4
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x86c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x7d4], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x880], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x7c4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x7e4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x864], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x7cc], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x7dc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x7f4], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x85c], eax
mov eax, dword [ebp - 0x85c]
movzx eax, byte [eax]
test eax, eax
je 0x1001ac07
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0x7bc], eax
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0x7ac], eax
mov eax, dword [ebp - 0x880]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0xc94], 0xfffffffc
mov dword [ebp - 0xd0c], 0xa76aabec
mov dword [ebp - 0xc74], 0x1bd97a88
mov dword [ebp - 0xd7c], 0xc9f3690f
mov dword [ebp - 0xc7c], 0xf2fb5a5e
mov dword [ebp - 0xd1c], 0xfffffffd
push 3
lea ecx, [ebp - 0xcf8]
call fcn.1002cb22
and dword [ebp - 4], 0
push 2
lea ecx, [ebp - 0xb08]
call fcn.1002cb22
mov byte [ebp - 4], 1
mov dword [ebp - 0x48], 0
jmp 0x100148b3
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x100148cf
push dword [ebp - 0x48]
lea ecx, [ebp - 0xcf8]
call fcn.1002cc7e
mov dword [eax], 0xe4b7834d
jmp 0x100148ac
mov dword [ebp - 0x48], 0
jmp 0x100148df
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x100148fb
push dword [ebp - 0x48]
lea ecx, [ebp - 0xb08]
call fcn.1002cc7e
mov dword [eax], 0x2e65
jmp 0x100148d8
push 0
lea ecx, [ebp - 0xb08]
call fcn.1002cc7e
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0x508]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x508]
mov dword [ecx], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb08]
call fcn.1002cbfb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcf8]
call fcn.1002cbfb
mov eax, dword [ebp - 0x218]
mov eax, dword [eax + 4]
mov dword [ebp - 0x620], eax
mov dword [ebp - 0x168], 0xe1757117
mov dword [ebp - 0x890], 0xfffffffb
mov dword [ebp - 0x6b8], 0
mov dword [ebp - 0xc98], 0
mov dword [ebp - 0xc9c], 0x689278a4
mov dword [ebp - 0xd3c], 0x9ab1b576
mov dword [ebp - 0xbbc], 6
mov dword [ebp - 0xbc0], 0x9e5e26c5
mov dword [ebp - 0xbc8], 0xa41183d9
mov dword [ebp - 0xbd0], 0xffffffff
mov dword [ebp - 0xbd8], 0x3d7e6de1
mov dword [ebp - 0xbe0], 0xfffffffe
mov dword [ebp - 0xbe8], 0xdb596534
mov dword [ebp - 0xbf0], 1
mov dword [ebp - 0xbf8], 6
mov dword [ebp - 0xc00], 0xfffffffc
mov dword [ebp - 0xc08], 0xfffffffa
mov dword [ebp - 0xc10], 0x48a66be8
mov dword [ebp - 0x8a8], 0
mov dword [ebp - 0x1ac], 0
jmp 0x10014a23
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 3
jge 0x10014a3f
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0xe48], 1
jmp 0x10014a16
mov dword [ebp - 0x168], 0
jmp 0x10014a58
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0xfffffff0
jne 0x10014cd4
mov dword [ebp - 0x898], 0xfffffff6
mov dword [ebp - 0x264], 7
mov dword [ebp - 0x2b4], 1
push 2
lea ecx, [ebp - 0x964]
call fcn.1002cb22
mov dword [ebp - 4], 2
mov dword [ebp - 0xc18], 0x4b4ea65d
mov dword [ebp - 0x6d8], 0xfffffffc
push 1
lea ecx, [ebp - 0xb98]
call fcn.1002cb22
mov byte [ebp - 4], 3
mov dword [ebp - 0x8b8], 6
push 0x654
lea eax, [ebp - 0x964]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call fcn.1000d3b2
add esp, 0x10
lea eax, [ebp - 0x888]
push eax
lea eax, [ebp - 0xb98]
push eax
push 0
call fcn.1000b9bf
add esp, 0xc
push 0x5a27
push 0
push 0x2777
push 0x2d06
lea eax, [ebp - 0x168]
push eax
push 0
lea eax, [ebp - 0x264]
push eax
push 0xfa5
lea eax, [ebp - 0x890]
push eax
lea eax, [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x898]
push eax
lea eax, [ebp - 0x6b8]
push eax
call fcn.10026813
add esp, 0x30
push 0
lea ecx, [ebp - 0xb98]
call fcn.1002cc7e
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x23c]
mov eax, dword [eax]
mov dword [ebp - 0x8a0], eax
mov eax, dword [ebp - 0x23c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x23c]
mov dword [ecx], eax
cmp dword [ebp - 0x8a0], 0x322662b2
jge 0x10014b8f
mov dword [ebp - 0x690], 1
jmp 0x10014b96
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x2b4]
cmp eax, dword [ebp - 0x690]
jge 0x10014bb0
mov dword [ebp - 0x6b0], 1
jmp 0x10014bb7
and dword [ebp - 0x6b0], 0
cmp dword [ebp - 0x6b0], 6
je 0x10014bcc
mov dword [ebp - 0x6c0], 1
jmp 0x10014bd3
and dword [ebp - 0x6c0], 0
cmp dword [ebp - 0x264], 0
jne 0x10014be3
cmp dword [ebp - 0x6b8], 0
cmp dword [ebp - 0x6c0], 0x3eb3
je 0x10014bfb
mov dword [ebp - 0x6c8], 1
jmp 0x10014c02
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x264]
cmp dword [ebp - 0x6c8], eax
jle 0x10014c1c
mov dword [ebp - 0x6d0], 1
jmp 0x10014c23
and dword [ebp - 0x6d0], 0
push 1
lea ecx, [ebp - 0x964]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x6d0]
sub ecx, dword [eax]
jne 0x10014c4c
cmp dword [ebp - 0x8a8], 0
jne 0x10014c4c
and dword [ebp - 0x8b0], 0
jmp 0x10014c56
mov dword [ebp - 0x8b0], 1
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0xc20], eax
push 1
lea ecx, [ebp - 0x964]
call fcn.1002cc7e
mov eax, dword [eax]
mov dword [ebp - 0x6d8], eax
cmp dword [ebp - 0x6d8], 0
jne 0x10014c92
cmp dword [ebp - 0x8b8], 0
jne 0x10014c92
and dword [ebp - 0x604], 0
jmp 0x10014c9c
mov dword [ebp - 0x604], 1
push 1
lea ecx, [ebp - 0x964]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x604]
mov dword [eax], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb98]
call fcn.1002cbfb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x964]
call fcn.1002cbfb
jmp 0x10014a4b
push 2
lea ecx, [ebp - 0x974]
call fcn.1002cb22
mov dword [ebp - 4], 4
mov dword [ebp - 0x8c0], 0xbd94543b
lea eax, [ebp - 0x974]
push eax
push 0x1e1b
push 0x221e
push 0x24af
push 0x3195
push 0
push 0x1a63
push 0x66ce
push 0x1623
push 0x3f16
lea eax, [ebp - 0xc28]
push eax
call fcn.1000b6a0
add esp, 0x2c
push 1
lea ecx, [ebp - 0x974]
call fcn.1002cc7e
mov dword [eax], 9
jmp 0x10014d6b
push 1
lea ecx, [ebp - 0x974]
call fcn.1002cc7e
mov dword [ebp - 0x688], eax
mov eax, dword [ebp - 0x688]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x688]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x974]
call fcn.1002cc7e
cmp dword [eax], 0
jle 0x10014dc4
mov dword [ebp - 0x370], 0x4696a485
push 0x5ab3
lea eax, [ebp - 0x370]
push eax
push 0
push 0x4c0f
lea eax, [ebp - 0x8c0]
push eax
push 0x4b42
push 1
push 0x590a
push 0
call fcn.10026172
add esp, 0x24
cmp dword [ebp - 0x370], 0
je 0x10014dc2
jmp 0x10014d47
jmp 0x10014d47
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x974]
call fcn.1002cbfb
push 1
lea ecx, [ebp - 0x30c]
call fcn.1002cb22
mov dword [ebp - 4], 5
mov dword [ebp - 0x93c], 0xa9ac70c3
mov dword [ebp - 0x8c8], 0x1aa6
cmp dword [ebp - 0x8c8], 0xeaa
jge 0x10014ec2
and dword [ebp - 0x2dc], 0
and dword [ebp - 0x26c], 0
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x2dc]
push eax
push 0x10007b84
call fcn.1005459b
add esp, 0xc
mov eax, dword [ebp - 0x26c]
cmp eax, dword [ebp - 0x2dc]
jge 0x10014e50
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x35c], eax
jmp 0x10014e5c
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x274]
inc eax
push eax
push 0x10007b8c
call fcn.100549f9
pop ecx
pop ecx
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x15c], eax
jmp 0x10014e97
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
jl 0x10014ec2
push dword [ebp - 0x15c]
mov eax, dword [ebp - 0x274]
sub eax, dword [ebp - 0x15c]
push eax
push 0x10007bb8
call fcn.100549f9
add esp, 0xc
jmp 0x10014e8a
mov dword [ebp - 0x944], 0xca8fecf7
mov dword [ebp - 0x8d0], 0xffffffff
mov dword [ebp - 0xc30], 0xffffffff
mov dword [ebp - 0xc38], 1
mov dword [ebp - 0xc40], 0x721f7d96
mov dword [ebp - 0xc48], 0x84edc02
mov dword [ebp - 0xc50], 0xfffffff7
mov dword [ebp - 0xc58], 0x9d9e177c
mov dword [ebp - 0xc60], 0x2522abf7
mov dword [ebp - 0xc68], 0xfffffffd
push 3
lea ecx, [ebp - 0xd08]
call fcn.1002cb22
mov byte [ebp - 4], 6
mov dword [ebp - 0xc70], 0
push 0
push 0xe7a
push 0xb46
lea eax, [ebp - 0xd08]
push eax
lea eax, [ebp - 0x190]
push eax
push 0
call fcn.10026093
add esp, 0x18
mov dword [ebp - 0x190], 0
jmp 0x10014f7e
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 1
jge 0x10014f9a
mov eax, dword [ebp - 0x190]
mov dword [ebp + eax*4 - 0x524], 0x9867f5d1
jmp 0x10014f71
lea eax, [ebp - 0x8d0]
push eax
lea eax, [ebp - 0x93c]
push eax
push 1
push 0x43f6
lea eax, [ebp - 0x944]
push eax
push 1
call fcn.10009fc9
add esp, 0x18
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x524]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x524], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xd08]
call fcn.1002cbfb
mov dword [ebp - 0x110], 0xffffffff
mov dword [ebp - 0x14], 0xcecb4571
mov dword [ebp - 0x68], 0
jmp 0x1001500b
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x10015021
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x31c], 0x841b3c69
jmp 0x10015004
mov dword [ebp - 0x68], 0
jmp 0x10015031
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x10015047
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x954], 0xffffffff
jmp 0x1001502a
mov dword [ebp - 0x14], 0
jmp 0x10015057
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x1001527c
mov dword [ebp - 0x53c], 1
mov dword [ebp - 0x9fc], 0x4a2c930f
mov eax, dword [ebp - 0x14]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x31c]
cmp dword [ebp + eax*4 - 0x31c], ecx
jl 0x1001509a
mov dword [ebp - 0x364], 1
jmp 0x100150a1
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x31c]
cmp eax, dword [ebp - 0x364]
jge 0x100150bf
mov dword [ebp - 0x6d4], 1
jmp 0x100150c6
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x31c]
cmp dword [ebp - 0x6d4], eax
jg 0x100150e4
mov dword [ebp - 0x36c], 1
jmp 0x100150eb
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x31c]
add eax, dword [ebp - 0x36c]
cmp eax, 0xeb6b9dd9
jne 0x1001510e
mov dword [ebp - 0x94c], 1
jmp 0x10015115
and dword [ebp - 0x94c], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x31c]
mov dword [ebp + ecx*4 - 0x31c], eax
mov eax, dword [ebp - 0x14]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x31c]
cmp dword [ebp + eax*4 - 0x31c], ecx
jg 0x1001514d
mov dword [ebp - 0x52c], 1
jmp 0x10015154
and dword [ebp - 0x52c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x954]
cmp dword [ebp - 0x52c], eax
jl 0x10015175
mov dword [ebp - 0x374], 1
jmp 0x1001517c
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x31c]
sub eax, dword [ebp - 0x374]
jne 0x1001519e
push 9
pop eax
test eax, eax
jne 0x1001519e
and dword [ebp - 0x60c], 0
jmp 0x100151a8
mov dword [ebp - 0x60c], 1
cmp dword [ebp - 0x60c], 0
je 0x100151bd
mov dword [ebp - 0x37c], 1
jmp 0x100151c4
and dword [ebp - 0x37c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp + ecx*4 - 0x31c]
add ecx, dword [ebp - 0x37c]
cmp dword [ebp + eax - 0x31c], ecx
jne 0x100151ef
mov dword [ebp - 0x534], 1
jmp 0x100151f6
and dword [ebp - 0x534], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x31c]
cmp dword [ebp - 0x534], eax
jle 0x10015217
mov dword [ebp - 0x384], 1
jmp 0x1001521e
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x31c]
cmp dword [ebp - 0x384], eax
jle 0x1001523c
mov dword [ebp - 0x67c], 1
jmp 0x10015243
and dword [ebp - 0x67c], 0
cmp dword [ebp - 0x67c], 1
jne 0x10015258
mov dword [ebp - 0x38c], 1
jmp 0x1001525f
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x53c], eax
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0x9fc], eax
jmp 0x10015050
mov dword [ebp - 0x1f4], 0
jmp 0x10015295
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 1
jge 0x100152b7
push dword [ebp - 0x1f4]
lea ecx, [ebp - 0x30c]
call fcn.1002cc7e
mov dword [eax], 0x51da622a
jmp 0x10015288
mov dword [ebp - 0x170], 0x8ec0ae97
mov dword [ebp - 0xae8], 0x5211521f
mov dword [ebp - 0xae4], 0x5211521f
mov dword [ebp - 0xae0], 0x5211521f
mov dword [ebp - 0xadc], 0x5211521f
lea ecx, [ebp - 0x245]
call fcn.1002cc93
push eax
lea eax, [ebp - 0xad8]
push eax
lea eax, [ebp - 0xae8]
push eax
lea ecx, [ebp - 0xdfc]
call fcn.1002cc96
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd18]
call fcn.1002cbd5
mov byte [ebp - 4], 7
mov dword [ebp - 0x170], 0xfffffff6
jmp 0x1001533b
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0xfffffffc
jge 0x100153d0
mov dword [ebp - 0x84c], 0xcd4431fa
mov dword [ebp - 0x9c8], 2
mov dword [ebp - 0x778], 1
mov byte [ebp - 0xc5], 0
lea eax, [ebp - 0xc5]
push eax
push 0
push 0x3fc9
push 0x3428
push 0x5c5a
push 0
push 0x7151
call fcn.1000cee5
add esp, 0x1c
lea eax, [ebp - 0xd18]
push eax
lea eax, [ebp - 0x170]
push eax
push 0x58b0
push 0x27ad
lea eax, [ebp - 0x9c8]
push eax
push 0
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x778]
push eax
call fcn.1000ec87
add esp, 0x20
jmp 0x1001532e
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xd18]
call fcn.1002cbfb
push 0
lea ecx, [ebp - 0x30c]
call fcn.1002cc7e
cmp dword [eax], 7
jle 0x100153fd
mov dword [ebp - 0x394], 1
jmp 0x10015404
and dword [ebp - 0x394], 0
push 0
lea ecx, [ebp - 0x30c]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x394]
cmp ecx, dword [eax]
jle 0x10015427
mov dword [ebp - 0x934], 1
jmp 0x1001542e
and dword [ebp - 0x934], 0
push 0
lea ecx, [ebp - 0x30c]
call fcn.1002cc7e
mov esi, eax
push 0
lea ecx, [ebp - 0x30c]
call fcn.1002cc7e
mov ecx, dword [esi]
sub ecx, dword [eax]
cmp ecx, 0xbc40
jg 0x10015462
mov dword [ebp - 0x614], 1
jmp 0x10015469
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x110], eax
mov esi, dword [ebp - 0x110]
neg esi
push 0
lea ecx, [ebp - 0x30c]
call fcn.1002cc7e
sub esi, dword [eax]
imul esi, esi, 7
push 0
lea ecx, [ebp - 0x30c]
call fcn.1002cc7e
add esi, dword [eax]
je 0x100159e8
mov dword [ebp - 0x50], 5
mov dword [ebp - 0x24], 0xc58f5537
mov dword [ebp - 0x50], 0
jmp 0x100154c2
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xc
jne 0x10015947
mov dword [ebp - 0x1c], 0xc285ce96
mov dword [ebp - 0xac0], 0x4579
mov dword [ebp - 0xabc], 0x4579
mov dword [ebp - 0xab8], 0x4579
mov dword [ebp - 0xab4], 0x4579
lea ecx, [ebp - 0x2ea]
call fcn.1002cc93
push eax
lea eax, [ebp - 0xab0]
push eax
lea eax, [ebp - 0xac0]
push eax
lea ecx, [ebp - 0xe0c]
call fcn.1002cc96
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2fc]
call fcn.1002cbd5
mov byte [ebp - 4], 8
mov dword [ebp - 0x1b4], 0
jmp 0x1001554d
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 3
jge 0x10015569
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x75c], 0xfffffff8
jmp 0x10015540
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x50], eax
je 0x10015584
mov dword [ebp - 0x544], 1
jmp 0x1001558b
and dword [ebp - 0x544], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x75c]
cmp dword [ebp + eax - 0x75c], ecx
jne 0x100155b2
mov dword [ebp - 0x780], 1
jmp 0x100155b9
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xc78], eax
mov esi, dword [ebp - 0x50]
push 2
lea ecx, [ebp - 0x2fc]
call fcn.1002cc7e
cmp esi, dword [eax]
jg 0x100155e2
mov dword [ebp - 0x39c], 1
jmp 0x100155e9
and dword [ebp - 0x39c], 0
push 2
lea ecx, [ebp - 0x2fc]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x39c]
cmp ecx, dword [eax]
jg 0x1001560c
mov dword [ebp - 0x3a4], 1
jmp 0x10015613
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x544]
cmp eax, dword [ebp - 0x3a4]
jg 0x1001562d
mov dword [ebp - 0x6bc], 1
jmp 0x10015634
and dword [ebp - 0x6bc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x75c]
cmp dword [ebp - 0x6bc], eax
jge 0x10015655
mov dword [ebp - 0x3ac], 1
jmp 0x1001565c
and dword [ebp - 0x3ac], 0
cmp dword [ebp - 0x3ac], 0xffffffff
je 0x10015671
mov dword [ebp - 0x54c], 1
jmp 0x10015678
and dword [ebp - 0x54c], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x75c]
push 2
lea ecx, [ebp - 0x2fc]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x54c]
add ecx, dword [eax]
imul esi, ecx
mov dword [ebp - 0x3b4], esi
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3b4]
mov dword [ebp + eax - 0x75c], ecx
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0x1d
jmp 0x100156cf
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffe5
jl 0x10015933
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x1c], 0
jmp 0x100156f0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10015737
lea eax, [ebp - 0x1c]
push eax
push 1
push 0x786
lea eax, [ebp - 0x2fc]
push eax
push 0x1ec9
push 0
push 0x4beb
push 0x8c3
push 0x243b
push 0x7d53
push 0x1ece
push 0x3c1d
call fcn.10026813
add esp, 0x30
jmp 0x100156e9
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc80], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc8c], eax
mov eax, dword [ebp - 0x28]
inc eax
cmp dword [ebp - 0x28], eax
jl 0x1001575e
mov dword [ebp - 0x61c], 1
jmp 0x10015765
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x61c], eax
jle 0x1001577c
mov dword [ebp - 0x3bc], 1
jmp 0x10015783
and dword [ebp - 0x3bc], 0
push 2
lea ecx, [ebp - 0x2fc]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x3bc]
cmp ecx, dword [eax]
jge 0x100157af
mov eax, 0xe48c0c84
test eax, eax
je 0x100157af
mov dword [ebp - 0x8dc], 1
jmp 0x100157b6
and dword [ebp - 0x8dc], 0
push 2
lea ecx, [ebp - 0x2fc]
call fcn.1002cc7e
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jne 0x100157d7
mov dword [ebp - 0x554], 1
jmp 0x100157de
and dword [ebp - 0x554], 0
push 3
lea ecx, [ebp - 0x2fc]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x554]
cmp ecx, dword [eax]
jl 0x10015801
mov dword [ebp - 0x788], 1
jmp 0x10015808
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x8e0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8e0]
mov dword [ebp + eax - 0x75c], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xd2c], eax
mov eax, 0xce85
inc eax
cmp eax, dword [ebp - 0x28]
jne 0x10015844
mov dword [ebp - 0x3c4], 1
jmp 0x1001584b
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x3c4], eax
jl 0x10015862
mov dword [ebp - 0x790], 1
jmp 0x10015869
and dword [ebp - 0x790], 0
push 2
lea ecx, [ebp - 0x2fc]
call fcn.1002cc7e
push 3
lea ecx, [ebp - 0x2fc]
call fcn.1002cc7e
push 2
lea ecx, [ebp - 0x2fc]
call fcn.1002cc7e
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x28], eax
jg 0x100158ad
mov eax, 0x11659018
test eax, eax
je 0x100158ad
mov dword [ebp - 0x684], 1
jmp 0x100158b4
and dword [ebp - 0x684], 0
cmp dword [ebp - 0x684], 0xee1e3c1d
jae 0x100158d2
cmp dword [ebp - 0x28], 0
je 0x100158d2
mov dword [ebp - 0x958], 1
jmp 0x100158d9
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xbb8], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jg 0x100158f6
mov dword [ebp - 0x798], 1
jmp 0x100158fd
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc90], eax
cmp dword [ebp - 0x24], 0
je 0x1001591e
cmp dword [ebp - 0x28], 0
je 0x1001591e
mov dword [ebp - 0x3cc], 1
jmp 0x10015925
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x1c], eax
jmp 0x100156c8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2fc]
call fcn.1002cbfb
jmp 0x100154bb
mov dword [ebp - 0x3dc], 1
cmp dword [ebp - 0x3dc], 0
je 0x10015978
push 0
lea ecx, [ebp - 0x30c]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x10015978
mov dword [ebp - 0x55c], 1
jmp 0x1001597f
and dword [ebp - 0x55c], 0
cmp dword [ebp - 0x55c], 0x4da8
jge 0x10015997
mov dword [ebp - 0x3d4], 1
jmp 0x1001599e
and dword [ebp - 0x3d4], 0
push 0
lea ecx, [ebp - 0x30c]
call fcn.1002cc7e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x3d4]
je 0x100159c1
mov dword [ebp - 0x624], 1
jmp 0x100159c8
and dword [ebp - 0x624], 0
push 0
lea ecx, [ebp - 0x30c]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x624]
add ecx, dword [eax]
mov dword [ebp - 0x3dc], ecx
jmp 0x10017f7c
push 0x6cde
push 0
push 0x4136
lea eax, [ebp - 0x110]
push eax
call fcn.10010f1a
add esp, 0x10
push 2
lea ecx, [ebp - 0x768]
call fcn.1002cb22
mov byte [ebp - 4], 9
mov dword [ebp - 0x64], 5
mov dword [ebp - 0x80], 0x10e6b6cd
mov dword [ebp - 0x7a8], 0xfffffffe
mov dword [ebp - 0x8f0], 0xeccdf493
lea eax, [ebp - 0x768]
push eax
push 0x3338
push 1
push 0x2302
push 0x102b
push 0x244e
lea eax, [ebp - 0xca0]
push eax
push 1
call fcn.1000a1bd
add esp, 0x20
xor eax, eax
jne 0x10015a7a
push 1
lea ecx, [ebp - 0x768]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x10015a98
push 1
lea ecx, [ebp - 0x768]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x10015a98
mov dword [ebp - 0x564], 1
jmp 0x10015a9f
and dword [ebp - 0x564], 0
push 1
lea ecx, [ebp - 0x768]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x564]
add ecx, dword [eax]
jne 0x10015ac2
mov dword [ebp - 0x3e4], 1
jmp 0x10015ac9
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x80], 0
jmp 0x10015ae2
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0xffffffef
jne 0x10015fe8
push 2
lea ecx, [ebp - 0x984]
call fcn.1002cb22
mov byte [ebp - 4], 0xa
push 3
lea ecx, [ebp - 0xb50]
call fcn.1002cb22
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x7b0], 0xfffffff9
mov dword [ebp - 0x68c], 0
mov dword [ebp - 0x70], 0
jmp 0x10015b32
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x10015b4e
push dword [ebp - 0x70]
lea ecx, [ebp - 0x984]
call fcn.1002cc7e
mov dword [eax], 1
jmp 0x10015b2b
mov dword [ebp - 0x70], 0
jmp 0x10015b5e
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x10015b7a
push dword [ebp - 0x70]
lea ecx, [ebp - 0xb50]
call fcn.1002cc7e
mov dword [eax], 0x5a42
jmp 0x10015b57
mov dword [ebp - 0x64], 0
jmp 0x10015b8a
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x17
jne 0x10015bb4
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x10015baa
push 0
call fcn.1000c64d
pop ecx
cmp dword [ebp - 0x80], 0
je 0x10015bb2
jmp 0x10015b83
jmp 0x10015b83
push 0
lea ecx, [ebp - 0x984]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x10015fae
mov dword [ebp - 0x27c], 0
mov dword [ebp - 0x234], 0
jmp 0x10015bed
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 2
jge 0x10015c09
mov eax, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0x69c], 0xfffffffb
jmp 0x10015be0
mov dword [ebp - 0x64], 0
jmp 0x10015c19
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jg 0x10015f1f
mov dword [ebp - 0x74], 0x7392715e
mov dword [ebp - 0x8e8], 0x188e
cmp dword [ebp - 0x8e8], 0xe00
jge 0x10015d87
and dword [ebp - 0x2bc], 0
lea eax, [ebp - 0x6ec]
push eax
mov ecx, 0x1065dcc0
call fcn.1002c299
cmp dword [ebp - 0x6ec], 0x1a
jle 0x10015c7d
push fcn.1003148b
push 0xffffffffffffffff
mov ecx, 0x1065dc18
call fcn.1002c6be
mov ecx, eax
call fcn.1002c6b2
lea ecx, [ebp - 0xde8]
call fcn.1002c13e
mov byte [ebp - 4], 0xc
lea edx, [ebp - 0xde8]
mov ecx, 0x1065dcc0
call fcn.100312ac
and dword [ebp - 0xeb0], 0
push 0x64
push 0
lea eax, [ebp - 0xeac]
push eax
call fcn.10054ab0
add esp, 0xc
and dword [ebp - 0x1bc], 0
jmp 0x10015ccc
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1bc]
cmp eax, dword [ebp - 0x6ec]
jge 0x10015d0e
push dword [ebp - 0x1bc]
lea ecx, [ebp - 0xde8]
call fcn.1002c231
movsx eax, byte [eax]
lea eax, [ebp + eax*4 - 0x1034]
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0x3ec]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3ec]
mov dword [ecx], eax
jmp 0x10015cbf
and dword [ebp - 0x188], 0
jmp 0x10015d24
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0x1a
jge 0x10015d5c
mov eax, dword [ebp - 0x188]
cmp dword [ebp + eax*4 - 0xeb0], 0
jle 0x10015d5a
mov eax, dword [ebp - 0x188]
mov eax, dword [ebp + eax*4 - 0xeb0]
mov ecx, dword [ebp - 0x2bc]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x2bc], eax
jmp 0x10015d17
push fcn.1003148b
push dword [ebp - 0x2bc]
mov ecx, 0x1065dc18
call fcn.1002c6be
mov ecx, eax
call fcn.1002c6b2
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xde8]
call fcn.1002c1c6
mov dword [ebp - 0x74], 1
jmp 0x10015d97
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jl 0x10015eec
mov dword [ebp - 0x9ec], 0xfffffff6
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xca8], eax
cmp dword [ebp - 0x74], 0xffffffff
jb 0x10015e57
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x80]
mov dword [ebp + eax - 0x69c], ecx
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x69c], 1
ja 0x10015dea
mov dword [ebp - 0x7a0], 1
jmp 0x10015df1
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xcb0], eax
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0xcb8], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xcc0], eax
push 0
lea ecx, [ebp - 0x984]
call fcn.1002cc7e
push 0
lea ecx, [ebp - 0x984]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x10015e43
mov eax, 0x64069a3e
test eax, eax
je 0x10015e43
mov dword [ebp - 0x56c], 1
jmp 0x10015e4a
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x56c]
sub eax, 0x830a
je 0x10015e6c
mov eax, 0xd6b1f848
test eax, eax
je 0x10015e6c
mov dword [ebp - 0x3f4], 1
jmp 0x10015e73
and dword [ebp - 0x3f4], 0
push 1
lea ecx, [ebp - 0xb50]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x3f4]
add ecx, dword [eax]
jne 0x10015e96
mov dword [ebp - 0x62c], 1
jmp 0x10015e9d
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x62c]
inc eax
cmp eax, dword [ebp - 0x80]
jg 0x10015eb5
mov dword [ebp - 0x3fc], 1
jmp 0x10015ebc
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x27c], eax
lea eax, [ebp - 0x64]
push eax
push 0
push 0x506e
lea eax, [ebp - 0x7a8]
push eax
push 0x7301
call fcn.1002801c
add esp, 0x14
jmp 0x10015d90
mov byte [ebp - 0x125], 0
push 0xe3c
push 0x23df
push 0
lea eax, [ebp - 0x125]
push eax
push 0x128f
push 0x562f
push 1
call fcn.1000d13f
add esp, 0x1c
jmp 0x10015c12
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x69c]
cmp dword [ebp - 0x27c], eax
jg 0x10015f40
mov dword [ebp - 0x574], 1
jmp 0x10015f47
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x8f0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x69c], 0
jne 0x10015f96
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x69c]
mov dword [ebp - 0xcc8], eax
mov esi, dword [ebp - 0x27c]
push 0
lea ecx, [ebp - 0x768]
call fcn.1002cc7e
sub esi, dword [eax]
jne 0x10015f96
and dword [ebp - 0x404], 0
jmp 0x10015fa0
mov dword [ebp - 0x404], 1
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x7b0], eax
jmp 0x10015fc5
mov dword [ebp - 0xcd0], 0x70b
mov eax, dword [ebp - 0x68c]
inc eax
mov dword [ebp - 0x68c], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xb50]
call fcn.1002cbfb
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x984]
call fcn.1002cbfb
jmp 0x10015adb
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x768]
call fcn.1002cbfb
mov dword [ebp - 0x110], 0
jmp 0x10016010
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jg 0x10017f7c
mov dword [ebp - 0x2c], 0xa32b1cec
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x1fc], 0
jmp 0x10016047
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 4
jge 0x10016063
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0xbb4], 0x9841
jmp 0x1001603a
mov dword [ebp - 0x2c], 0
jmp 0x10016073
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jg 0x1001619d
mov dword [ebp - 0x1c4], 0x5a40f2fd
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0xbb4]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x40c]
mov dword [ebp + eax*4 - 0xbb4], ecx
mov eax, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp + eax*4 - 0xbb4], 0x8807
test eax, eax
je 0x100160d4
mov eax, 0xc47d
test eax, eax
je 0x100160d4
mov dword [ebp - 0x57c], 1
jmp 0x100160db
and dword [ebp - 0x57c], 0
xor eax, eax
sub eax, dword [ebp - 0x57c]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x1c4], eax
jg 0x10016103
mov dword [ebp - 0x968], 1
jmp 0x1001610a
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xcd8], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0xbb4]
sub eax, dword [ebp - 0x2c]
je 0x1001613a
cmp dword [ebp - 0x1c4], 0
je 0x1001613a
mov dword [ebp - 0x414], 1
jmp 0x10016141
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x414]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa4], 0xd
jmp 0x10016169
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0xffffffe7
jne 0x10016198
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x10016196
push 0x7bc
push 0x11a0
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
jmp 0x1001615c
jmp 0x1001606c
mov dword [ebp - 0x1dc], 3
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x5c], 0
jmp 0x100161c1
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x100161d7
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xd28], 0xd7f825e7
jmp 0x100161ba
mov dword [ebp - 0x5c], 0
jmp 0x100161e7
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x100161fd
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xe04], 0xf0f5ebe
jmp 0x100161e0
mov dword [ebp - 0x154], 2
jmp 0x10016216
mov eax, dword [ebp - 0x154]
dec eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0
jl 0x10016673
mov dword [ebp - 0xa84], 0x3b9da4d0
mov dword [ebp - 0xa80], 0x3b9da4d0
mov dword [ebp - 0xa7c], 0x3b9da4d0
mov dword [ebp - 0xa78], 0x3b9da4d0
lea ecx, [ebp - 0x2a9]
call fcn.1002cc93
push eax
lea eax, [ebp - 0xa74]
push eax
lea eax, [ebp - 0xa84]
push eax
lea ecx, [ebp - 0xe1c]
call fcn.1002cc96
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x994]
call fcn.1002cbd5
mov byte [ebp - 4], 0xd
mov dword [ebp - 0xce0], 0x8421705
mov dword [ebp - 0xce8], 0xc2132456
mov dword [ebp - 0xd60], 0xb969161d
mov dword [ebp - 0xd68], 0x57257ea0
mov dword [ebp - 0x7b8], 0x1916
cmp dword [ebp - 0x7b8], 0xb24
jge 0x100164bc
mov dword [ebp - 0xd70], 0xa1
and dword [ebp - 0x8f8], 0
lea eax, [ebp - 0x8f8]
push eax
push 0xa3
lea ecx, [ebp - 0x33c]
call fcn.1002cb5e
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x7c0]
push eax
push 0x10007c34
call fcn.1005459b
add esp, 0xc
and dword [ebp - 0x300], 0
jmp 0x10016323
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x300]
cmp eax, dword [ebp - 0x7c0]
jge 0x1001644a
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x134]
push eax
push 0x10007c34
call fcn.1005459b
add esp, 0xc
push dword [ebp - 0x134]
lea ecx, [ebp - 0x33c]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x21c]
sub ecx, dword [eax]
mov dword [ebp - 0x41c], ecx
mov eax, dword [ebp - 0x12c]
cmp eax, dword [ebp - 0x41c]
jg 0x100163b3
push dword [ebp - 0x134]
lea ecx, [ebp - 0x33c]
call fcn.1002cc7e
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0x634]
mov eax, dword [eax]
add eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x634]
mov dword [ecx], eax
and dword [ebp - 0x12c], 0
jmp 0x100163de
push dword [ebp - 0x134]
lea ecx, [ebp - 0x33c]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x21c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x12c]
sub eax, dword [ebp - 0x41c]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x134]
inc eax
push eax
lea ecx, [ebp - 0x33c]
call fcn.1002cc7e
mov dword [ebp - 0x584], eax
mov eax, dword [ebp - 0x584]
mov eax, dword [eax]
add eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x584]
mov dword [ecx], eax
mov eax, dword [ebp - 0x134]
inc eax
push eax
lea ecx, [ebp - 0x33c]
call fcn.1002cc7e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x21c]
jle 0x10016445
mov eax, dword [ebp - 0x134]
inc eax
push eax
lea ecx, [ebp - 0x33c]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x21c]
mov dword [eax], ecx
jmp 0x10016316
and dword [ebp - 0x284], 0
and dword [ebp - 0x1cc], 0
jmp 0x10016467
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
lea ecx, [ebp - 0x33c]
call fcn.1002cc75
cmp dword [ebp - 0x1cc], eax
jae 0x1001649b
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0x33c]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x284]
add ecx, dword [eax]
mov dword [ebp - 0x284], ecx
jmp 0x1001645a
push dword [ebp - 0x284]
push 0x10007b90
call fcn.100549f9
pop ecx
pop ecx
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x33c]
call fcn.1002cbfb
mov dword [ebp - 0xd78], 0xfffffff9
mov dword [ebp - 0xd80], 0x4902314a
mov dword [ebp - 0xd94], 0xfffffff7
mov dword [ebp - 0xd9c], 0x69919c44
mov dword [ebp - 0xda8], 0x9dc86695
mov dword [ebp - 0x6c4], 0xf06e
push 2
lea ecx, [ebp - 0x994]
call fcn.1002cc7e
and dword [eax], 0
jmp 0x1001652e
push 2
lea ecx, [ebp - 0x994]
call fcn.1002cc7e
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x424]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x424]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x994]
call fcn.1002cc7e
cmp dword [eax], 2
jg 0x1001663b
mov dword [ebp - 0xdb0], 0xffffffff
mov dword [ebp - 0xdb8], 0x445a8cce
mov dword [ebp - 0x204], 0
jmp 0x10016571
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 1
jge 0x1001658d
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0xdc0], 0x244c3f4f
jmp 0x10016564
mov eax, dword [ebp - 0x154]
cmp dword [ebp + eax*4 - 0xd28], 0
je 0x100165d6
mov byte [ebp - 0x123], 0
movzx eax, byte [ebp - 0x123]
test eax, eax
je 0x100165d4
push 0xba0
push 0x6efb
push 0x3b90
push 0
push 0x60c1
push 0x7520
push 0
call fcn.1002627b
add esp, 0x1c
jmp 0x10016629
mov dword [ebp - 0x1d4], 0
mov dword [ebp - 0x1d4], 2
jmp 0x100165f9
mov eax, dword [ebp - 0x1d4]
dec eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0
jl 0x10016629
push 0xe0c
push 0x72f2
push 0x2b4b
push 0
push 0x7264
push 0x5b6c
push 1
call fcn.1002627b
add esp, 0x1c
jmp 0x100165ec
mov eax, dword [ebp - 0x6c4]
dec eax
mov dword [ebp - 0x6c4], eax
jmp 0x1001650a
mov eax, dword [ebp - 0x154]
cmp dword [ebp + eax*4 - 0xd28], 0
je 0x1001665f
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x994]
call fcn.1002cbfb
jmp 0x10016209
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x994]
call fcn.1002cbfb
jmp 0x10016209
mov byte [ebp - 0xfd], 0
mov dword [ebp - 0xac], 3
mov dword [ebp - 0x90], 0xfffffffc
push 3
lea ecx, [ebp - 0xb80]
call fcn.1002cb22
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x22c], 0
jmp 0x100166b8
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 3
jge 0x100166da
push dword [ebp - 0x22c]
lea ecx, [ebp - 0xb80]
call fcn.1002cc7e
mov dword [eax], 0xfffffff6
jmp 0x100166ab
mov dword [ebp - 0xac], 0xffffffe2
jmp 0x100166f3
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xfffffffe
je 0x100169ea
mov dword [ebp - 0x13c], 0x121f90ef
mov dword [ebp - 0x14c], 0x4a754320
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0xac], eax
jl 0x1001672e
mov dword [ebp - 0x42c], 1
jmp 0x10016735
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x42c], eax
jne 0x1001674f
mov dword [ebp - 0x58c], 1
jmp 0x10016756
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
add eax, dword [ebp - 0x58c]
jne 0x10016782
cmp dword [ebp - 0x90], 0
jne 0x10016782
and dword [ebp - 0x434], 0
jmp 0x1001678c
mov dword [ebp - 0x434], 1
cmp dword [ebp - 0x434], 0xfffffffc
jae 0x10016993
mov dword [ebp - 0x900], 0
mov dword [ebp - 0xa5c], 1
mov dword [ebp - 0xa58], 1
mov dword [ebp - 0xa54], 1
mov dword [ebp - 0xa50], 1
mov dword [ebp - 0x594], 0x6ef3
cmp dword [ebp - 0x90], 0
jne 0x100167f0
cmp dword [ebp - 0x594], 0
jne 0x100167f0
and dword [ebp - 0x63c], 0
jmp 0x100167fa
mov dword [ebp - 0x63c], 1
mov eax, dword [ebp - 0x63c]
neg eax
cmp eax, dword [ebp - 0x14c]
jg 0x10016816
mov dword [ebp - 0x43c], 1
jmp 0x1001681d
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x43c]
sub eax, dword [ebp - 0x594]
cmp eax, 0x6c50
jne 0x1001683c
mov dword [ebp - 0x694], 1
jmp 0x10016843
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x444], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x444]
mov dword [ebp + eax - 0xa5c], ecx
mov eax, dword [ebp - 0x444]
cmp eax, dword [ebp - 0x694]
jl 0x1001687b
mov dword [ebp - 0x44c], 1
jmp 0x10016882
and dword [ebp - 0x44c], 0
cmp dword [ebp - 0x44c], 0xfffffff7
je 0x10016897
mov dword [ebp - 0x59c], 1
jmp 0x1001689e
and dword [ebp - 0x59c], 0
cmp dword [ebp - 0x59c], 0
jb 0x100168b3
mov dword [ebp - 0x9d8], 1
jmp 0x100168ba
and dword [ebp - 0x9d8], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0xac], eax
jl 0x100168d4
mov dword [ebp - 0x454], 1
jmp 0x100168db
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0x454]
je 0x100168f5
mov dword [ebp - 0x644], 1
jmp 0x100168fc
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x644], eax
je 0x10016916
mov dword [ebp - 0x45c], 1
jmp 0x1001691d
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x45c], eax
jl 0x10016937
mov dword [ebp - 0x7c8], 1
jmp 0x1001693e
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0xdb4], eax
mov eax, dword [ebp - 0x13c]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xa5c]
test eax, eax
jne 0x10016974
mov eax, 0x99643747
test eax, eax
jne 0x10016974
and dword [ebp - 0x5a4], 0
jmp 0x1001697e
mov dword [ebp - 0x5a4], 1
mov eax, dword [ebp - 0x90]
imul eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x14c], eax
jmp 0x100169e5
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x100169bb
push 0
push 0x2988
push 0x50f8
push 1
call fcn.1000a5fe
add esp, 0x10
mov byte [ebp - 0x11e], 0
movzx eax, byte [ebp - 0x11e]
test eax, eax
je 0x100169e5
push 0x124
push 0
push 0
push 0
push 0xb57
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
jmp 0x100166e6
mov dword [ebp - 0x90], 0
jmp 0x10016a03
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x10016a26
lea eax, [ebp - 0xb80]
push eax
push 0
lea eax, [ebp - 0x90]
push eax
call fcn.100274df
add esp, 0xc
jmp 0x100169f6
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xb80]
call fcn.1002cbfb
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x10016bfa
mov dword [ebp - 0x178], 0x1f7e2799
mov dword [ebp - 0x7d8], 0xe2632c5
mov dword [ebp - 0x908], 0xa6e8f591
mov dword [ebp - 0x7d0], 0xffffffff
mov dword [ebp - 0x178], 0xffffffe6
jmp 0x10016a85
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0xfffffff1
jge 0x10016bda
push 3
lea ecx, [ebp - 0x9a4]
call fcn.1002cb22
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x978], 0xffff
push 4
lea ecx, [ebp - 0xa0c]
call fcn.1002cb22
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x6c], 0
jmp 0x10016ace
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x10016aea
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x9a4]
call fcn.1002cc7e
mov dword [eax], 0x2fd4914d
jmp 0x10016ac7
mov dword [ebp - 0x6c], 0
jmp 0x10016afa
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x10016b16
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xa0c]
call fcn.1002cc7e
mov dword [eax], 0x4489b467
jmp 0x10016af3
push 1
lea ecx, [ebp - 0x9a4]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x10016b4b
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xa0c]
call fcn.1002cbfb
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9a4]
call fcn.1002cbfb
jmp 0x10016bda
push 1
push 0x1210
lea eax, [ebp - 0x9a4]
push eax
lea eax, [ebp - 0x7d0]
push eax
push 0x44f2
lea eax, [ebp - 0x978]
push eax
lea eax, [ebp - 0x7d8]
push eax
push 0x2777
push 0x366f
push 0x3273
push 0
push 1
push 0x63f7
push 0x6b66
lea eax, [ebp - 0x908]
push eax
push 0x1f2d
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0x178]
push eax
push 0x7253
call fcn.1001afb4
add esp, 0x4c
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xa0c]
call fcn.1002cbfb
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9a4]
call fcn.1002cbfb
jmp 0x10016a78
push 0
push 0x1a13
push 0
push 0x7181
push 0x25f7
push 0x5399
call fcn.1000b496
add esp, 0x18
mov dword [ebp - 0xb4], 3
mov dword [ebp - 0x88], 0xfffffffc
push 3
lea ecx, [ebp - 0xb38]
call fcn.1002cb22
mov byte [ebp - 4], 0x12
push 0x4978
push 1
lea eax, [ebp - 0xd84]
push eax
lea eax, [ebp - 0xb38]
push eax
push 0x7ee9
push 0
push 0x3681
push 0x6d3b
call fcn.1000f2bf
add esp, 0x20
mov dword [ebp - 0xb4], 0xffffffe2
jmp 0x10016c66
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0xfffffffe
je 0x10016f63
mov dword [ebp - 0x144], 0x121f90ef
mov dword [ebp - 0x130], 0x4a754320
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0xb4], eax
jl 0x10016ca1
mov dword [ebp - 0x464], 1
jmp 0x10016ca8
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x464], eax
jne 0x10016cc2
mov dword [ebp - 0x6dc], 1
jmp 0x10016cc9
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
add eax, dword [ebp - 0x6dc]
jne 0x10016cf5
cmp dword [ebp - 0x88], 0
jne 0x10016cf5
and dword [ebp - 0x46c], 0
jmp 0x10016cff
mov dword [ebp - 0x46c], 1
cmp dword [ebp - 0x46c], 0xfffffffc
jae 0x10016f06
mov dword [ebp - 0x7e8], 0
mov dword [ebp - 0xa4c], 1
mov dword [ebp - 0xa48], 1
mov dword [ebp - 0xa44], 1
mov dword [ebp - 0xa40], 1
mov dword [ebp - 0x64c], 0x6ef3
cmp dword [ebp - 0x88], 0
jne 0x10016d63
cmp dword [ebp - 0x64c], 0
jne 0x10016d63
and dword [ebp - 0x5ac], 0
jmp 0x10016d6d
mov dword [ebp - 0x5ac], 1
mov eax, dword [ebp - 0x5ac]
neg eax
cmp eax, dword [ebp - 0x130]
jg 0x10016d89
mov dword [ebp - 0x474], 1
jmp 0x10016d90
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x474]
sub eax, dword [ebp - 0x64c]
cmp eax, 0x6c50
jne 0x10016daf
mov dword [ebp - 0x5b4], 1
jmp 0x10016db6
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x47c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x47c]
mov dword [ebp + eax - 0xa4c], ecx
mov eax, dword [ebp - 0x47c]
cmp eax, dword [ebp - 0x5b4]
jl 0x10016dee
mov dword [ebp - 0x484], 1
jmp 0x10016df5
and dword [ebp - 0x484], 0
cmp dword [ebp - 0x484], 0xfffffff7
je 0x10016e0a
mov dword [ebp - 0x6a0], 1
jmp 0x10016e11
and dword [ebp - 0x6a0], 0
cmp dword [ebp - 0x6a0], 0
jb 0x10016e26
mov dword [ebp - 0x7e0], 1
jmp 0x10016e2d
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0xb4], eax
jl 0x10016e47
mov dword [ebp - 0x48c], 1
jmp 0x10016e4e
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x144]
cmp eax, dword [ebp - 0x48c]
je 0x10016e68
mov dword [ebp - 0x5bc], 1
jmp 0x10016e6f
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x5bc], eax
je 0x10016e89
mov dword [ebp - 0x494], 1
jmp 0x10016e90
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x494], eax
jl 0x10016eaa
mov dword [ebp - 0x9f0], 1
jmp 0x10016eb1
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0x7e8]
mov dword [ebp - 0xca4], eax
mov eax, dword [ebp - 0x144]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xa4c]
test eax, eax
jne 0x10016ee7
mov eax, 0x99643747
test eax, eax
jne 0x10016ee7
and dword [ebp - 0x654], 0
jmp 0x10016ef1
mov dword [ebp - 0x654], 1
mov eax, dword [ebp - 0x88]
imul eax, dword [ebp - 0x654]
mov dword [ebp - 0x130], eax
jmp 0x10016f5e
mov byte [ebp - 0x120], 0
movzx eax, byte [ebp - 0x120]
test eax, eax
je 0x10016f33
push 0
push 0x5f39
push 0
push 0x41b6
push 0x480c
call fcn.1000ff5a
add esp, 0x14
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x10016f5e
push 0
push 0x4152
push 0x6b70
push 0x5972
call fcn.1000d58e
add esp, 0x10
jmp 0x10016c59
mov dword [ebp - 0x88], 0
jmp 0x10016f7c
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x10016fae
push 0x7398
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0xb38]
push eax
push 0xb0e
push 0
push 0xf56
call fcn.1001c88d
add esp, 0x18
jmp 0x10016f6f
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xb38]
call fcn.1002cbfb
mov dword [ebp - 0x1dc], 0
jmp 0x10016fd6
mov eax, dword [ebp - 0x1dc]
dec eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
jl 0x10017f77
mov dword [ebp - 0x910], 0x1669
cmp dword [ebp - 0x910], 0x8c8
jge 0x1001707e
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x28c]
push eax
push 0x10007c8c
call fcn.1005459b
add esp, 0x10
mov eax, dword [ebp - 0x2c4]
cmp eax, dword [ebp - 0x28c]
je 0x10017068
mov eax, dword [ebp - 0x2c4]
sub eax, dword [ebp - 0x28c]
cdq
idiv dword [ebp - 0x49c]
test eax, eax
jle 0x1001705c
mov eax, dword [ebp - 0x2c4]
sub eax, dword [ebp - 0x28c]
cdq
idiv dword [ebp - 0x49c]
cmp edx, 1
jle 0x10017068
mov dword [ebp - 0x5c4], 0x10007b9c
jmp 0x10017072
mov dword [ebp - 0x5c4], 0x10007b98
push dword [ebp - 0x5c4]
call fcn.10054d82
pop ecx
push 2
lea ecx, [ebp - 0x72c]
call fcn.1002cb22
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x54], 5
mov dword [ebp - 0x7c], 0x10e6b6cd
mov dword [ebp - 0x9e8], 0xfffffffe
mov dword [ebp - 0x810], 0xeccdf493
push 0x106f
lea eax, [ebp - 0xbc4]
push eax
push 1
push 0
push 0
push 0x7894
push 0x6ddd
push 0xa3c
lea eax, [ebp - 0x72c]
push eax
call fcn.100108f5
add esp, 0x24
xor eax, eax
jne 0x100170f7
push 1
lea ecx, [ebp - 0x72c]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x10017115
push 1
lea ecx, [ebp - 0x72c]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x10017115
mov dword [ebp - 0x4a4], 1
jmp 0x1001711c
and dword [ebp - 0x4a4], 0
push 1
lea ecx, [ebp - 0x72c]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x4a4]
add ecx, dword [eax]
jne 0x1001713f
mov dword [ebp - 0x6cc], 1
jmp 0x10017146
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x6cc]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x7c], 0
jmp 0x1001715f
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xffffffef
jne 0x10017a24
push 2
lea ecx, [ebp - 0x9b4]
call fcn.1002cb22
mov byte [ebp - 4], 0x14
push 3
lea ecx, [ebp - 0xb2c]
call fcn.1002cb22
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x998], 0xfffffff9
mov dword [ebp - 0x818], 0
lea eax, [ebp - 0x9b4]
push eax
push 0x2748
push 0x3365
push 1
push 0x4ba4
push 1
lea eax, [ebp - 0x7f8]
push eax
call fcn.1000a330
add esp, 0x1c
mov dword [ebp - 0x7f0], 0x1f5b
cmp dword [ebp - 0x7f0], 0x7eb
jge 0x1001732a
call fcn.100546d5
push 0x20
pop ecx
imul ecx, ecx, 0
add eax, ecx
push eax
push 0x10007be8
push 0x10007bec
call fcn.10054c3f
add esp, 0xc
call fcn.100546d5
push 0x20
pop ecx
shl ecx, 0
add eax, ecx
push eax
push 0x10007bf4
push 0x10007bf8
call fcn.10054c3f
add esp, 0xc
lea eax, [ebp - 0x76c]
push eax
push 0x10007b70
call fcn.1005459b
pop ecx
pop ecx
mov dword [ebp - 0x20c], 1
jmp 0x1001724e
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
cmp eax, dword [ebp - 0x76c]
jg 0x1001732a
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 0x10007b84
call fcn.1005459b
add esp, 0xc
push dword [ebp - 0x20c]
push 0x10007c9c
call fcn.100549f9
pop ecx
pop ecx
mov eax, dword [ebp - 0x2e4]
and eax, 0x80000001
jns 0x1001729f
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x100172b9
mov eax, dword [ebp - 0x294]
and eax, 0x80000001
jns 0x100172b5
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x100172e3
cvtsi2sd xmm0, dword [ebp - 0x2e4]
cvtsi2sd xmm1, dword [ebp - 0x294]
mulsd xmm0, xmm1
push ecx
push ecx
movsd qword [esp], xmm0
push 0x10007cac
call fcn.100549f9
add esp, 0xc
jmp 0x10017325
mov eax, dword [ebp - 0x2e4]
imul eax, dword [ebp - 0x294]
dec eax
cvtsi2sd xmm0, eax
push 2
pop ecx
movsd qword [ebp - 0xc88], xmm0
call fcn.100316c6
movsd xmm1, qword [ebp - 0xc88]
addsd xmm1, xmm0
push ecx
push ecx
movsd qword [esp], xmm1
push 0x10007cac
call fcn.100549f9
add esp, 0xc
jmp 0x10017241
lea eax, [ebp - 0x7f8]
push eax
lea eax, [ebp - 0xb2c]
push eax
push 0x5261
push 0
call fcn.100277a2
add esp, 0x10
mov dword [ebp - 0x54], 0
jmp 0x10017357
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x17
jne 0x10017394
mov byte [ebp - 0x122], 0
movzx eax, byte [ebp - 0x122]
test eax, eax
je 0x1001738a
push 0x519d
push 0x1ea6
push 0
push 0x51f7
push 1
call fcn.1000d0a0
add esp, 0x14
cmp dword [ebp - 0x7c], 0
je 0x10017392
jmp 0x10017350
jmp 0x10017350
push 0
lea ecx, [ebp - 0x9b4]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x10017864
mov dword [ebp - 0x2cc], 0
mov dword [ebp - 0x1e4], 0
jmp 0x100173cd
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 2
jge 0x100173e9
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0x6a8], 0xfffffffb
jmp 0x100173c0
mov dword [ebp - 0x54], 0
jmp 0x100173f9
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jg 0x100177d2
mov dword [ebp - 0x78], 0x7392715e
mov dword [ebp - 0x78], 1
jmp 0x1001741a
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jl 0x10017559
mov dword [ebp - 0x800], 0xfffffff6
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xd88], eax
cmp dword [ebp - 0x78], 0xffffffff
jb 0x100174da
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x7c]
mov dword [ebp + eax - 0x6a8], ecx
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x6a8], 1
ja 0x1001746d
mov dword [ebp - 0x918], 1
jmp 0x10017474
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xbcc], eax
mov eax, dword [ebp - 0x800]
mov dword [ebp - 0xcac], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xbd4], eax
push 0
lea ecx, [ebp - 0x9b4]
call fcn.1002cc7e
push 0
lea ecx, [ebp - 0x9b4]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x100174c6
mov eax, 0x64069a3e
test eax, eax
je 0x100174c6
mov dword [ebp - 0x4ac], 1
jmp 0x100174cd
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x4ac]
sub eax, 0x830a
je 0x100174ef
mov eax, 0xd6b1f848
test eax, eax
je 0x100174ef
mov dword [ebp - 0x5cc], 1
jmp 0x100174f6
and dword [ebp - 0x5cc], 0
push 1
lea ecx, [ebp - 0xb2c]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x5cc]
add ecx, dword [eax]
jne 0x10017519
mov dword [ebp - 0x4b4], 1
jmp 0x10017520
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x4b4]
inc eax
cmp eax, dword [ebp - 0x7c]
jg 0x10017538
mov dword [ebp - 0x65c], 1
jmp 0x1001753f
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x65c]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x9e8], eax
jmp 0x10017413
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x100177cd
mov dword [ebp - 0x808], 0x18b1
cmp dword [ebp - 0x808], 0xf41
jge 0x100177c5
lea eax, [ebp - 0x38]
push eax
push 0x10007b74
call fcn.1005459b
pop ecx
pop ecx
push dword [ebp - 0x38]
lea ecx, [ebp - 0xa3c]
call fcn.1002cb22
mov byte [ebp - 4], 0x16
and dword [ebp - 0x224], 0
jmp 0x100175c1
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x224]
cmp eax, dword [ebp - 0x38]
jge 0x100175ec
push dword [ebp - 0x224]
lea ecx, [ebp - 0xa3c]
call fcn.1002cc7e
push eax
push 0x10007b74
call fcn.1005459b
pop ecx
pop ecx
jmp 0x100175b4
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x920], eax
lea eax, [ebp - 0x920]
push eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x6e8]
call fcn.1002cb5e
mov byte [ebp - 4], 0x17
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
and dword [ebp - 0xbc], 0
jmp 0x1001762c
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0x38]
jge 0x100176b4
push dword [ebp - 0xbc]
lea ecx, [ebp - 0xa3c]
call fcn.1002cc7e
cmp dword [eax], 0
jne 0x10017653
and dword [ebp - 0x18], 0
jmp 0x1001765a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x6e8]
call fcn.1002cc7e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x18]
jge 0x1001768d
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x6e8]
call fcn.1002cc7e
mov eax, dword [eax]
mov dword [ebp - 0x4bc], eax
jmp 0x10017696
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4bc], eax
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x6e8]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x4bc]
mov dword [eax], ecx
jmp 0x1001761f
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0xc4], eax
jmp 0x100176d4
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jl 0x1001775a
push dword [ebp - 0xc4]
lea ecx, [ebp - 0xa3c]
call fcn.1002cc7e
cmp dword [eax], 0
jne 0x100176f9
and dword [ebp - 0x18], 0
jmp 0x10017700
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x6e8]
call fcn.1002cc7e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x18]
jge 0x10017733
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x6e8]
call fcn.1002cc7e
mov eax, dword [eax]
mov dword [ebp - 0x5d4], eax
jmp 0x1001773c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x5d4], eax
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x6e8]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x5d4]
mov dword [eax], ecx
jmp 0x100176c7
and dword [ebp - 0x1ec], 0
jmp 0x10017770
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x1ec]
cmp eax, dword [ebp - 0x38]
jge 0x1001779c
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0x6e8]
call fcn.1002cc7e
push dword [eax]
push 0x10007bb0
call fcn.100549f9
pop ecx
pop ecx
jmp 0x10017763
push 0x10007add
call fcn.10054d82
pop ecx
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x6e8]
call fcn.1002cbfb
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xa3c]
call fcn.1002cbfb
push 0
call fcn.1000b9a8
pop ecx
jmp 0x100173f2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6a8]
cmp dword [ebp - 0x2cc], eax
jg 0x100177f3
mov dword [ebp - 0x4c4], 1
jmp 0x100177fa
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x810], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6a8], 0
jne 0x10017849
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6a8]
mov dword [ebp - 0xd4c], eax
mov esi, dword [ebp - 0x2cc]
push 0
lea ecx, [ebp - 0x72c]
call fcn.1002cc7e
sub esi, dword [eax]
jne 0x10017849
and dword [ebp - 0x6ac], 0
jmp 0x10017853
mov dword [ebp - 0x6ac], 1
mov eax, dword [ebp - 0x6ac]
mov dword [ebp - 0x998], eax
jmp 0x10017a01
mov dword [ebp - 0xbdc], 0x70b
push 0
lea eax, [ebp - 0x818]
push eax
push 0x66fb
push 0x1c1a
push 0xe
push 1
call fcn.1000fffc
add esp, 0x18
mov dword [ebp - 0x928], 0x1ed5
cmp dword [ebp - 0x928], 0xd03
jge 0x10017a01
lea eax, [ebp - 0x4cc]
push eax
push 0x10007b74
call fcn.1005459b
pop ecx
pop ecx
push dword [ebp - 0x4cc]
lea ecx, [ebp - 0x744]
call fcn.1002cb22
mov byte [ebp - 4], 0x18
and dword [ebp - 0x1a4], 0
jmp 0x100178e5
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
cmp eax, dword [ebp - 0x4cc]
jge 0x10017913
push dword [ebp - 0x1a4]
lea ecx, [ebp - 0x744]
call fcn.1002cc7e
push eax
push 0x10007b74
call fcn.1005459b
pop ecx
pop ecx
jmp 0x100178d8
lea eax, [ebp - 0xcb4]
push eax
lea ecx, [ebp - 0x744]
call fcn.1002cc0e
push dword [eax]
lea eax, [ebp - 0xbe4]
push eax
lea ecx, [ebp - 0x744]
call fcn.1002cc00
push dword [eax]
call fcn.100316ed
pop ecx
pop ecx
lea eax, [ebp - 0x820]
push eax
push 0x10007b74
call fcn.1005459b
pop ecx
pop ecx
and dword [ebp - 0x29c], 0
jmp 0x1001796b
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x29c]
cmp eax, dword [ebp - 0x820]
jge 0x100179e7
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x9f8]
push eax
push 0x10007c34
call fcn.1005459b
add esp, 0xc
push dword [ebp - 0x9f8]
lea eax, [ebp - 0x744]
push eax
call fcn.1001446f
pop ecx
pop ecx
mov dword [ebp - 0x830], eax
push dword [ebp - 0x828]
lea eax, [ebp - 0x744]
push eax
call fcn.100144eb
pop ecx
pop ecx
mov dword [ebp - 0x930], eax
mov eax, dword [ebp - 0x930]
sub eax, dword [ebp - 0x830]
inc eax
push eax
push 0x10007bb0
call fcn.100549f9
pop ecx
pop ecx
jmp 0x1001795e
push 0x10007add
call fcn.10054d82
pop ecx
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x744]
call fcn.1002cbfb
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xb2c]
call fcn.1002cbfb
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x9b4]
call fcn.1002cbfb
jmp 0x10017158
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x72c]
call fcn.1002cbfb
mov byte [ebp - 0xdd], 0
push 1
lea ecx, [ebp - 0x348]
call fcn.1002cb22
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x4d4], 0xfffffffa
push 2
lea ecx, [ebp - 0x6f8]
call fcn.1002cb22
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x9a8], 0xffffffff
push 1
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x198]
push eax
push 1
push 0x272a
call fcn.1000a43f
add esp, 0x14
mov dword [ebp - 0x198], 0
jmp 0x10017aa8
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 2
jge 0x10017aca
push dword [ebp - 0x198]
lea ecx, [ebp - 0x6f8]
call fcn.1002cc7e
mov dword [eax], 4
jmp 0x10017a9b
push 0
lea ecx, [ebp - 0x348]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x10017c7d
mov eax, 0x106ec6e5
test eax, eax
je 0x10017bf9
push 0
lea ecx, [ebp - 0x348]
call fcn.1002cc7e
cmp dword [eax], 0
jne 0x10017b0d
xor eax, eax
inc eax
jne 0x10017b0d
and dword [ebp - 0x5dc], 0
jmp 0x10017b17
mov dword [ebp - 0x5dc], 1
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0x4d4], eax
mov esi, dword [ebp - 0x4d4]
push 0
lea ecx, [ebp - 0x348]
call fcn.1002cc7e
cmp esi, dword [eax]
je 0x10017b46
mov dword [ebp - 0x664], 1
jmp 0x10017b4d
and dword [ebp - 0x664], 0
push 0
lea ecx, [ebp - 0x348]
call fcn.1002cc7e
mov esi, dword [ebp - 0x664]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x348]
call fcn.1002cc7e
cmp esi, dword [eax]
jl 0x10017b80
mov dword [ebp - 0x4dc], 1
jmp 0x10017b87
and dword [ebp - 0x4dc], 0
cmp dword [ebp - 0x4dc], 0x6700
je 0x10017bae
push 1
lea ecx, [ebp - 0x6f8]
call fcn.1002cc7e
cmp dword [eax], 0
jne 0x10017bae
and dword [ebp - 0x5e4], 0
jmp 0x10017bb8
mov dword [ebp - 0x5e4], 1
push 0
lea ecx, [ebp - 0x6f8]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x5e4]
imul ecx, dword [eax]
test ecx, ecx
je 0x10017bf9
push 0
lea ecx, [ebp - 0x348]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x10017bf9
mov eax, 0x6f37911b
test eax, eax
je 0x10017bf9
mov dword [ebp - 0x4e4], 1
jmp 0x10017c00
and dword [ebp - 0x4e4], 0
mov esi, dword [ebp - 0x4e4]
sub esi, 0x13e4e915
push 1
lea ecx, [ebp - 0x6f8]
call fcn.1002cc7e
cmp esi, dword [eax]
jle 0x10017c29
mov dword [ebp - 0x6fc], 1
jmp 0x10017c30
and dword [ebp - 0x6fc], 0
push 0
lea ecx, [ebp - 0x6f8]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x6fc]
cmp ecx, dword [eax]
jle 0x10017c53
mov dword [ebp - 0x4ec], 1
jmp 0x10017c5a
and dword [ebp - 0x4ec], 0
push 1
lea ecx, [ebp - 0x6f8]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x4ec]
cmp ecx, dword [eax]
jg 0x10017c7d
mov dword [ebp - 0x5ec], 1
jmp 0x10017c84
and dword [ebp - 0x5ec], 0
push 0
lea ecx, [ebp - 0x348]
call fcn.1002cc7e
mov esi, eax
push 1
lea ecx, [ebp - 0x6f8]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x5ec]
add ecx, dword [eax]
mov eax, dword [esi]
sub eax, ecx
mov dword [ebp - 0x9a8], eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x6f8]
call fcn.1002cbfb
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x348]
call fcn.1002cbfb
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x10017f72
mov dword [ebp - 0x138], 0xfffb
mov dword [ebp - 0xaac], 0x70bb743d
mov dword [ebp - 0xaa8], 0x70bb743d
mov dword [ebp - 0xaa4], 0x70bb743d
mov dword [ebp - 0xaa0], 0x70bb743d
lea ecx, [ebp - 0x25d]
call fcn.1002cc93
push eax
lea eax, [ebp - 0xa9c]
push eax
lea eax, [ebp - 0xaac]
push eax
lea ecx, [ebp - 0xe2c]
call fcn.1002cc96
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb44]
call fcn.1002cbd5
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0xad4], 0xd2f38d92
mov dword [ebp - 0xad0], 0xd2f38d92
mov dword [ebp - 0xacc], 0xd2f38d92
mov dword [ebp - 0xac8], 0xd2f38d92
lea ecx, [ebp - 0x25f]
call fcn.1002cc93
push eax
lea eax, [ebp - 0xac4]
push eax
lea eax, [ebp - 0xad4]
push eax
lea ecx, [ebp - 0xe34]
call fcn.1002cc96
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd38]
call fcn.1002cbd5
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x838], 0x2515
cmp dword [ebp - 0x838], 0xf5e
jge 0x10017ecc
mov dword [ebp - 0x2f0], 1
push 0x106648d8
push 0x10007b70
call fcn.1005459b
pop ecx
pop ecx
mov eax, dword [0x106648d8]
mov dword [ebp - 0x938], eax
mov eax, dword [0x106648d8]
dec eax
mov dword [0x106648d8], eax
cmp dword [ebp - 0x938], 0
je 0x10017ecc
push 0x106cca14
push 0x106cca1c
push 0x106cc788
push 0x10007c28
call fcn.1005459b
add esp, 0x10
and dword [ebp - 0x1a8], 0
jmp 0x10017e35
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
cmp eax, dword [0x106cc788]
jge 0x10017e5f
mov eax, dword [ebp - 0x1a8]
lea eax, [eax*8 + 0x106642d0]
push eax
push 0x10007cb4
call fcn.1005459b
pop ecx
pop ecx
jmp 0x10017e28
push 0x608
push 0xffffffffffffffff
push 0x106cca20
call fcn.1003d774
add esp, 0xc
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x840], eax
push 0
call fcn.1001455f
pop ecx
fstp qword [ebp - 0xda4]
mov ecx, dword [0x106cca1c]
movsd xmm0, qword [ebp - 0xda4]
call fcn.10009250
push ecx
push ecx
movsd qword [esp], xmm0
push dword [ebp - 0x840]
push 0x10007cb8
call fcn.100549f9
add esp, 0x10
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
jmp 0x10017de0
mov esi, dword [ebp - 0x138]
push 2
lea ecx, [ebp - 0xb44]
call fcn.1002cc7e
mov dword [eax], esi
mov dword [ebp - 0x138], 0
jmp 0x10017efa
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 3
jg 0x10017f4c
mov dword [ebp - 0xa00], 0xb80be39e
lea eax, [ebp - 0xa00]
push eax
lea eax, [ebp - 0xd38]
push eax
lea eax, [ebp - 0xb44]
push eax
push 0
lea eax, [ebp - 0x138]
push eax
call fcn.1001cc1f
add esp, 0x14
mov byte [ebp - 0xa5], 0
push 0
lea eax, [ebp - 0xa5]
push eax
call fcn.1001f840
pop ecx
pop ecx
jmp 0x10017eed
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xd38]
call fcn.1002cbfb
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xb44]
call fcn.1002cbfb
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
jmp 0x10016fc9
jmp 0x10016003
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30c]
call fcn.1002cbfb
mov dword [ebp - 0x2d4], 0xd4f2
mov dword [ebp - 0x2a4], 0x959310c1
mov dword [ebp - 0xcc], 0x2db8e964
mov dword [ebp - 0x240], 1
mov dword [ebp - 0x848], 0x3ddc
mov dword [ebp - 0x1b0], 0x14c5
mov dword [ebp - 0x58], 0
jmp 0x10017fd7
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x10017fed
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x330], 0x145ccb97
jmp 0x10017fd0
mov dword [ebp - 0x58], 0
jmp 0x10017ffd
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 4
jge 0x10018013
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0xdd0], 0x40c88307
jmp 0x10017ff6
mov byte [ebp - 0x124], 0
movzx eax, byte [ebp - 0x124]
test eax, eax
je 0x1001802d
push 0
call fcn.10025f8d
pop ecx
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0xd8c], eax
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x240]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x330]
cmp eax, dword [ebp - 0x1b0]
jne 0x1001806d
mov dword [ebp - 0x4f4], 1
jmp 0x10018074
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0xcc]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x330]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x330]
cmp eax, 0xfffffff8
jle 0x100180b2
mov dword [ebp - 0x66c], 1
jmp 0x100180b9
and dword [ebp - 0x66c], 0
cmp dword [ebp - 0x66c], 0x4f0e4f20
jne 0x100180d1
mov dword [ebp - 0x4fc], 1
jmp 0x100180d8
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x2a4]
imul eax, dword [ebp - 0x4fc]
sub eax, 0xbaaa
cmp eax, dword [ebp - 0xcc]
jle 0x100180fe
mov dword [ebp - 0x5f4], 1
jmp 0x10018105
and dword [ebp - 0x5f4], 0
cmp dword [ebp - 0x5f4], 0xe0c0a103
jne 0x1001811d
mov dword [ebp - 0x504], 1
jmp 0x10018124
and dword [ebp - 0x504], 0
cmp dword [ebp - 0x504], 0
je 0x10018139
mov dword [ebp - 0x6b4], 1
jmp 0x10018140
and dword [ebp - 0x6b4], 0
cmp dword [ebp - 0x6b4], 0xffffffff
jle 0x10018155
mov dword [ebp - 0x50c], 1
jmp 0x1001815c
and dword [ebp - 0x50c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x50c]
sub ecx, dword [ebp + eax - 0x330]
mov dword [ebp - 0x2a4], ecx
cmp dword [ebp - 0x2a4], 0x8169b41d
je 0x1001818d
mov dword [ebp - 0x5fc], 1
jmp 0x10018194
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x2d4]
cmp eax, dword [ebp - 0x5fc]
je 0x100181b4
cmp dword [ebp - 0x1b0], 0
jne 0x100181b4
and dword [ebp - 0x514], 0
jmp 0x100181be
mov dword [ebp - 0x514], 1
mov eax, dword [ebp - 0x2d4]
cmp eax, dword [ebp - 0x514]
jle 0x100181d8
mov dword [ebp - 0x674], 1
jmp 0x100181df
and dword [ebp - 0x674], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xdd0]
cmp dword [ebp - 0x674], eax
jl 0x10018200
mov dword [ebp - 0x51c], 1
jmp 0x10018207
and dword [ebp - 0x51c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xdd0]
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x354], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x354]
mov dword [ebp + eax - 0x330], ecx
mov eax, dword [ebp - 0x848]
add eax, dword [ebp - 0x354]
je 0x100182d3
mov dword [ebp - 0x940], 4
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x940]
mov dword [ebp + eax - 0x330], ecx
mov dword [ebp - 0xcc], 0
jmp 0x1001827b
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x19
jge 0x100182ce
mov byte [ebp - 0xad], 0
movzx eax, byte [ebp - 0xad]
test eax, eax
je 0x100182cc
push 0x6cf5
push 1
push 0x5328
push 0x6a9e
push 0
push 0x6a77
push 0x365d
push 0
push 0x4846
push 0x1bf7
push 0xd47
call fcn.1000a893
add esp, 0x2c
jmp 0x1001826e
jmp 0x1001838d
and dword [ebp - 0xafc], 0
and dword [ebp - 0xaf8], 0
and dword [ebp - 0xaf4], 0
and dword [ebp - 0xaf0], 0
lea ecx, [ebp - 0x2e9]
call fcn.1002cc93
push eax
lea eax, [ebp - 0xaec]
push eax
lea eax, [ebp - 0xafc]
push eax
lea ecx, [ebp - 0xe3c]
call fcn.1002cc96
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd48]
call fcn.1002cbd5
mov dword [ebp - 4], 0x1d
push 2
lea ecx, [ebp - 0xd48]
call fcn.1002cc7e
mov eax, dword [eax]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1001837e
push 0x1d45
push 0x611f
push 1
push 0x1582
push 0x3b20
push 0x3ee1
push 1
push 0x1efc
push 0
call fcn.10026172
add esp, 0x24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd48]
call fcn.1002cbfb
push 4
lea ecx, [ebp - 0xb74]
call fcn.1002cb22
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x718], 0xaa32b1ce
mov dword [ebp - 0x714], 0xaa32b1ce
mov dword [ebp - 0x710], 0xaa32b1ce
mov dword [ebp - 0x70c], 0xaa32b1ce
mov dword [ebp - 0x9f4], 9
mov dword [ebp - 0x148], 0xfffffffe
mov dword [ebp - 0x350], 0x7f03
lea eax, [ebp - 0xbec]
push eax
lea eax, [ebp - 0xb74]
push eax
push 0x2dc9
push 1
push 1
push 0x5d0b
call fcn.1000a4e0
add esp, 0x18
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x718], 3
jmp 0x10018436
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x718]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x718], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x718], 0
jl 0x100186e4
mov dword [ebp - 0x140], 0x733c6338
mov dword [ebp - 0x160], 0x9ed890fc
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x10018477
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x140], 3
jmp 0x10018490
mov eax, dword [ebp - 0x140]
dec eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jl 0x100186df
mov dword [ebp - 0x160], 1
cmp dword [ebp - 0x160], 0
je 0x1001862c
mov dword [ebp - 0x358], 0
mov dword [ebp - 0x948], 0x2b416c28
mov dword [ebp - 0x1b8], 0
jmp 0x100184e1
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 1
jge 0x100184fd
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x860], 0x4087b332
jmp 0x100184d4
mov esi, dword [ebp - 0x160]
push dword [ebp - 0x140]
lea ecx, [ebp - 0xb74]
call fcn.1002cc7e
cmp esi, dword [eax]
je 0x10018524
mov dword [ebp - 0x850], 1
jmp 0x1001852b
and dword [ebp - 0x850], 0
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0xcbc], eax
push 4
pop eax
shl eax, 1
imul eax, dword [ebp + eax - 0x718], 0
cmp eax, dword [ebp - 0x350]
jle 0x10018558
mov dword [ebp - 0x9b8], 1
jmp 0x1001855f
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xbf4], eax
mov dword [ebp - 0x358], 0
cmp dword [ebp - 0x358], 0x87a9
jne 0x1001858d
mov dword [ebp - 0x360], 1
jmp 0x10018594
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x360], eax
jge 0x100185ae
mov dword [ebp - 0x368], 1
jmp 0x100185b5
and dword [ebp - 0x368], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x718]
cmp dword [ebp - 0x368], eax
jge 0x100185d5
mov dword [ebp - 0x858], 1
jmp 0x100185dc
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x948]
mov dword [ebp - 0xd5c], eax
cmp dword [ebp - 0x148], 0
jne 0x10018603
cmp dword [ebp - 0x350], 0
jne 0x10018603
and dword [ebp - 0x378], 0
jmp 0x1001860d
mov dword [ebp - 0x378], 1
mov eax, dword [ebp - 0x378]
mov dword [ebp - 0x160], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x860], 0x6bc712ba
jmp 0x10018688
push 4
lea ecx, [ebp - 0xb5c]
call fcn.1002cb22
mov byte [ebp - 4], 0x1f
push 1
push 0x137a
push 0
lea eax, [ebp - 0xbfc]
push eax
lea eax, [ebp - 0xb5c]
push eax
call fcn.1000ff5a
add esp, 0x14
lea eax, [ebp - 0xb5c]
push eax
lea eax, [ebp - 0x9f4]
push eax
push 0x5e73
push 0
call fcn.1000f7d0
add esp, 0x10
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xb5c]
call fcn.1002cbfb
mov dword [ebp - 0x148], 3
jmp 0x100186a1
mov eax, dword [ebp - 0x148]
dec eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
jl 0x100186da
mov byte [ebp - 0x126], 0
push 0
push 0x1861
push 0x398a
push 0x7e8c
push 0
lea eax, [ebp - 0x126]
push eax
push 0x1ea0
call fcn.10025cb5
add esp, 0x1c
jmp 0x10018694
jmp 0x10018483
jmp 0x1001841d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb74]
call fcn.1002cbfb
mov dword [ebp - 0x150], 0xbaf43b7c
mov dword [ebp - 0x1c0], 0xfffffffe
mov dword [ebp - 0x868], 0x25f0
cmp dword [ebp - 0x868], 0x8a2
jge 0x1001894b
and dword [ebp - 0xe4], 0
lea eax, [ebp - 0xe4]
push eax
push 0x10007b70
call fcn.1005459b
pop ecx
pop ecx
xor ecx, ecx
mov eax, dword [ebp - 0xe4]
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1004e448
pop ecx
mov dword [ebp - 0x950], eax
mov eax, dword [ebp - 0x950]
mov dword [ebp - 0x16c], eax
xor ecx, ecx
mov eax, dword [ebp - 0xe4]
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1004e448
pop ecx
mov dword [ebp - 0x870], eax
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0xec], eax
and dword [ebp - 0x164], 0
jmp 0x100187ab
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
cmp eax, dword [ebp - 0xe4]
jge 0x100187e7
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0x16c]
lea eax, [ecx + eax*4]
push eax
push 0x10007b70
call fcn.1005459b
pop ecx
pop ecx
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0xec]
and dword [ecx + eax*4], 0
jmp 0x1001879e
and dword [ebp - 0x60], 0
mov dword [ebp - 0xd4], 1
jmp 0x10018804
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0xe4]
jge 0x10018863
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0x16c]
mov edx, dword [ebp - 0xd4]
mov esi, dword [ebp - 0x16c]
mov eax, dword [ecx + eax*4 - 4]
cmp eax, dword [esi + edx*4]
jg 0x1001885d
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xec]
mov eax, dword [ecx + eax*4]
add eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0xd4]
mov edx, dword [ebp - 0xec]
mov dword [edx + ecx*4], eax
jmp 0x10018861
and dword [ebp - 0x60], 0
jmp 0x100187f7
and dword [ebp - 0x60], 0
mov eax, dword [ebp - 0xe4]
dec eax
dec eax
mov dword [ebp - 0xdc], eax
jmp 0x10018884
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jl 0x100188de
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0x16c]
mov edx, dword [ebp - 0xdc]
mov esi, dword [ebp - 0x16c]
mov eax, dword [ecx + eax*4]
cmp eax, dword [esi + edx*4 + 4]
jl 0x100188d8
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0xec]
mov eax, dword [ecx + eax*4]
add eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0xdc]
mov edx, dword [ebp - 0xec]
mov dword [edx + ecx*4], eax
jmp 0x100188dc
and dword [ebp - 0x60], 0
jmp 0x10018877
and dword [ebp - 0x244], 0
and dword [ebp - 0x174], 0
jmp 0x100188fb
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x174]
cmp eax, dword [ebp - 0xe4]
jge 0x10018937
mov eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0xec]
mov eax, dword [ecx + eax*4]
cmp eax, dword [ebp - 0x244]
jle 0x10018935
mov eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0xec]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x244], eax
jmp 0x100188ee
mov eax, dword [ebp - 0x244]
inc eax
push eax
push 0x10007b8c
call fcn.100549f9
pop ecx
pop ecx
push 1
lea ecx, [ebp - 0xa30]
call fcn.1002cb22
mov dword [ebp - 4], 0x20
push 0
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0xcc4]
push eax
push 1
call fcn.1001bb2b
add esp, 0x10
mov dword [ebp - 0x8d8], 0x1553
cmp dword [ebp - 0x8d8], 0x60a
jge 0x10018af7
call fcn.100546d5
push 0x20
pop ecx
imul ecx, ecx, 0
add eax, ecx
push eax
push 0x10007be8
push 0x10007bec
call fcn.10054c3f
add esp, 0xc
call fcn.100546d5
push 0x20
pop ecx
shl ecx, 0
add eax, ecx
push eax
push 0x10007bf4
push 0x10007bf8
call fcn.10054c3f
add esp, 0xc
lea eax, [ebp - 0x388]
push eax
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x17c]
push eax
mov ecx, 0x1065dcc0
call fcn.1002c299
mov ecx, eax
call fcn.1002c299
mov ecx, eax
call fcn.1002c299
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x380]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x380]
add ecx, dword [eax + 4]
call fcn.100099fb
movzx eax, al
test eax, eax
je 0x10018af7
mov eax, dword [ebp - 0x390]
shl eax, 1
mov ecx, dword [ebp - 0x388]
sub ecx, eax
add ecx, dword [ebp - 0x17c]
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x388]
neg eax
mov ecx, dword [ebp - 0x390]
lea eax, [eax + ecx*4]
imul ecx, dword [ebp - 0x17c], 3
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x268], eax
push fcn.1003148b
imul eax, dword [ebp - 0x24c], 0x19
imul ecx, dword [ebp - 0x268], 5
add eax, dword [ebp - 0x17c]
add ecx, eax
push ecx
mov eax, dword [ebp - 0x24c]
shl eax, 4
add eax, dword [ebp - 0x17c]
mov ecx, dword [ebp - 0x268]
lea eax, [eax + ecx*4]
push eax
imul eax, dword [ebp - 0x24c], 9
imul ecx, dword [ebp - 0x268], 3
add eax, dword [ebp - 0x17c]
add ecx, eax
push ecx
mov ecx, 0x1065dc18
call fcn.1002c6be
mov edx, 0x10007bc8
mov ecx, eax
call fcn.100312b4
mov ecx, eax
call fcn.1002c6be
mov edx, 0x10007bc8
mov ecx, eax
call fcn.100312b4
mov ecx, eax
call fcn.1002c6be
mov ecx, eax
call fcn.1002c6b2
jmp 0x100189d3
lea eax, [ebp - 0x150]
push eax
push 0x3ee7
lea eax, [ebp - 0x1c0]
push eax
push 0x789e
push 0x7712
push 0x6326
push 0x2cf7
push 0
call fcn.1001af5e
add esp, 0x20
cmp dword [ebp - 0x1c0], 0
je 0x10018b93
mov dword [ebp - 0x150], 0
jmp 0x10018b4a
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jg 0x10018b91
push 0
push 0x66f9
push 1
lea eax, [ebp - 0x1c0]
push eax
lea eax, [ebp - 0xa30]
push eax
push 0x7670
call fcn.1000b496
add esp, 0x18
push dword [ebp - 0x150]
lea ecx, [ebp - 0xa30]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x10018b8f
jmp 0x10018b91
jmp 0x10018b3d
jmp 0x10018bed
mov dword [ebp - 0x87c], 0xfffffffd
mov byte [ebp - 0xbd], 0
push 1
push 0x5797
lea eax, [ebp - 0xbd]
push eax
push 1
push 0x6e83
push 0x492a
push 0x109e
push 0x5c69
call fcn.1000a686
add esp, 0x20
lea eax, [ebp - 0x87c]
push eax
lea eax, [ebp - 0x1c0]
push eax
push 0x4815
push 0
call fcn.10010301
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa30]
call fcn.1002cbfb
mov dword [ebp - 0x84], 7
mov dword [ebp - 0xf4], 0xffffffff
mov dword [ebp - 0x270], 0x4c59
mov dword [ebp - 0x184], 0x9725245f
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xc04], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xd90], eax
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x10018c5d
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0xf4], eax
je 0x10018c5d
mov dword [ebp - 0x398], 1
jmp 0x10018c64
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x270]
cmp dword [ebp - 0x398], eax
jge 0x10018c7e
mov dword [ebp - 0x8d4], 1
jmp 0x10018c85
and dword [ebp - 0x8d4], 0
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0xc0c], eax
cmp dword [ebp - 0xf4], 0
je 0x10018ca1
cmp dword [ebp - 0x270], 0
xor eax, eax
je 0x10018cac
cmp dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x184], 0
jmp 0x10018cd1
mov eax, dword [ebp - 0x184]
dec eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0xfffffffd
jne 0x10018d10
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x10018d0e
push 0x4657
push 0x1bef
push 1
push 0x300f
push 0x1f5
push 0
push 1
call fcn.1000fb98
add esp, 0x1c
jmp 0x10018cc4
mov dword [ebp - 0x104], 0xffff
mov dword [ebp - 0x3a0], 0xbaf43b7c
mov dword [ebp - 0x1c8], 0xfffffffe
push 1
lea ecx, [ebp - 0xb8c]
call fcn.1002cb22
mov dword [ebp - 4], 0x21
push 1
push 0
lea eax, [ebp - 0xb8c]
push eax
lea eax, [ebp - 0xccc]
push eax
call fcn.1001cb73
add esp, 0x10
lea eax, [ebp - 0x1c8]
push eax
push 0x607c
push 1
push 1
push 0
lea eax, [ebp - 0x3a0]
push eax
push 0x59a2
push 0x88
push 0x382d
call fcn.100108f5
add esp, 0x24
cmp dword [ebp - 0x1c8], 0
je 0x10018dc5
push 0x6b78
lea eax, [ebp - 0x1c8]
push eax
lea eax, [ebp - 0xb8c]
push eax
push 0x2d4c
push 0x1c1e
push 0
lea eax, [ebp - 0x3a0]
push eax
call fcn.1000ba93
add esp, 0x1c
jmp 0x10018e18
mov dword [ebp - 0x884], 0xfffffffd
push 1
push 0x2600
push 0x5928
push 0x1caf
push 0x2554
push 0
call fcn.10026093
add esp, 0x18
push 0x20e8
push 0
push 0x6969
push 0x4045
lea eax, [ebp - 0x1c8]
push eax
push 1
lea eax, [ebp - 0x884]
push eax
call fcn.1000cee5
add esp, 0x1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb8c]
call fcn.1002cbfb
mov dword [ebp - 0x2a0], 0x3e5ec352
mov dword [ebp - 0x2a8], 0xdc509ca4
mov dword [ebp - 0xfc], 0xfab8
mov dword [ebp - 0x1e0], 0x1e19
mov dword [ebp - 0x278], 0x2858905b
mov dword [ebp - 0x3d0], 0
mov dword [ebp - 0x18c], 0xab9c279a
mov dword [ebp - 0xc14], 0xfffffff6
mov dword [ebp - 0x1f0], 0x97cbb402
mov dword [ebp - 0x894], 0xa88acc16
mov dword [ebp - 0x8e4], 0x1fe5
cmp dword [ebp - 0x8e4], 0x87d
jge 0x10018ed3
push 0x106c8788
push 0x106c87f0
push 0x106c8784
push 0x10007ccc
call fcn.1005459b
add esp, 0x10
push 0
push 0
call fcn.1001460f
pop ecx
pop ecx
push 0x10007b9c
call fcn.10054d82
pop ecx
mov dword [ebp - 0x428], 3
mov dword [ebp - 0x89c], 9
mov dword [ebp - 0x194], 0xfffffffa
mov dword [ebp - 0x8f4], 0xffffffff
mov dword [ebp - 0x1d0], 0
jmp 0x10018f14
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 2
jge 0x10018f30
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0x878], 0xfffffffa
jmp 0x10018f07
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0xfc], eax
je 0x10018f4a
mov dword [ebp - 0x3c0], 1
jmp 0x10018f51
and dword [ebp - 0x3c0], 0
cmp dword [ebp - 0xfc], 0
jne 0x10018f9d
mov eax, dword [ebp - 0xfc]
sub eax, dword [ebp - 0x1e0]
sub eax, dword [ebp - 0xfc]
cmp eax, 0xffff
ja 0x10018f7f
mov dword [ebp - 0x3a8], 1
jmp 0x10018f86
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x278]
add eax, dword [ebp - 0x3a8]
jne 0x10018f9d
and dword [ebp - 0x3b0], 0
jmp 0x10018fa7
mov dword [ebp - 0x3b0], 1
cmp dword [ebp - 0x3b0], 0x78ac
jne 0x10018fbf
mov dword [ebp - 0x3b8], 1
jmp 0x10018fc6
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x3c0], 0
jle 0x10018fe1
mov dword [ebp - 0x3c8], 1
jmp 0x10018fe8
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x3d0], eax
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0x3d0], eax
je 0x1001900e
mov dword [ebp - 0x3d8], 1
jmp 0x10019015
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x18c], 0xa
jmp 0x1001903a
mov eax, dword [ebp - 0x18c]
dec eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0xfffffff1
jne 0x10019522
mov dword [ebp - 0x410], 0x1540ee1d
mov dword [ebp - 0x280], 0xf85a06c0
mov dword [ebp - 0x8fc], 0xdfdaf0b5
mov dword [ebp - 0xd64], 0x6062cf9e
mov dword [ebp - 0xc1c], 0
mov dword [ebp - 0xcd4], 0x5d06de21
mov dword [ebp - 0x8ec], 7
mov dword [ebp - 0x1d8], 0
jmp 0x100190a6
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 3
jge 0x100190c2
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0xa18], 0
jmp 0x10019099
cmp dword [ebp - 0x1e0], 0
je 0x1001919d
mov eax, dword [ebp - 0x194]
dec eax
mov dword [ebp - 0x194], eax
jne 0x1001910d
cmp dword [ebp - 0x280], 0
jne 0x100190f4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x878]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa18], 0
jne 0x1001910d
and dword [ebp - 0x3e0], 0
jmp 0x10019117
mov dword [ebp - 0x3e0], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa18]
cmp dword [ebp - 0x3e0], eax
jg 0x10019137
mov dword [ebp - 0x3e8], 1
jmp 0x1001913e
and dword [ebp - 0x3e8], 0
cmp dword [ebp - 0x3e8], 0x59f7c1ae
jle 0x10019156
mov dword [ebp - 0x3f0], 1
jmp 0x1001915d
and dword [ebp - 0x3f0], 0
cmp dword [ebp - 0x3f0], 0xa0d3
jl 0x10019175
mov dword [ebp - 0x3f8], 1
jmp 0x1001917c
and dword [ebp - 0x3f8], 0
cmp dword [ebp - 0x3f8], 0xfba3
jg 0x10019191
mov eax, 0xd318
test eax, eax
je 0x1001919d
mov dword [ebp - 0x400], 1
jmp 0x100191a4
and dword [ebp - 0x400], 0
cmp dword [ebp - 0x400], 0x1bb57cf3
jl 0x100191bc
mov dword [ebp - 0x408], 1
jmp 0x100191c3
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x408]
inc eax
cmp dword [ebp - 0x410], eax
jle 0x100191de
mov dword [ebp - 0x418], 1
jmp 0x100191e5
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x410]
cmp dword [ebp - 0x418], eax
jge 0x1001920c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa18], 0
jne 0x1001920c
and dword [ebp - 0x420], 0
jmp 0x10019216
mov dword [ebp - 0x420], 1
push 4
pop eax
sub eax, dword [ebp - 0x420]
sub eax, 0x2309
sub eax, dword [ebp - 0x1e0]
je 0x100193b9
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x88c], 0x9b3460ee
push 3
lea ecx, [ebp - 0xba4]
call fcn.1002cb22
mov dword [ebp - 4], 0x22
push 0x23ff
lea eax, [ebp - 0xc24]
push eax
lea eax, [ebp - 0xba4]
push eax
push 0x698e
push 0
call fcn.100104d5
add esp, 0x14
cmp dword [ebp - 0x1e8], 0
jne 0x10019359
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa18]
mov dword [ebp - 0x88c], eax
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x8ec]
cmp dword [ebp - 0x428], eax
jl 0x100192c0
mov dword [ebp - 0x430], 1
jmp 0x100192c7
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0x430], eax
jle 0x100192e1
mov dword [ebp - 0x438], 1
jmp 0x100192e8
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x438]
sub eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0x1e8]
jle 0x10019308
mov dword [ebp - 0x440], 1
jmp 0x1001930f
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x1f0]
add eax, dword [ebp - 0x440]
add eax, dword [ebp - 0x894]
imul eax, eax, 0xe3ff
cmp eax, dword [ebp - 0x8f4]
jge 0x1001933b
mov dword [ebp - 0x448], 1
jmp 0x10019342
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x1e8]
cmp dword [ebp - 0x448], eax
jge 0x10019359
and dword [ebp - 0x450], 0
jmp 0x10019363
mov dword [ebp - 0x450], 1
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x878]
sub esi, dword [ebp - 0x450]
add esi, dword [ebp - 0x89c]
push 1
lea ecx, [ebp - 0xba4]
call fcn.1002cc7e
mov dword [eax], esi
mov byte [ebp - 0x128], 0
movzx eax, byte [ebp - 0x128]
test eax, eax
je 0x100193a5
push 0
call fcn.1001c9c2
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xba4]
call fcn.1002cbfb
jmp 0x1001951d
mov dword [ebp - 0x488], 0x33481ff7
mov dword [ebp - 0x480], 0
cmp dword [ebp - 0x8fc], 0
jne 0x100194ae
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x878], 0xffffffff
jge 0x100193f6
mov dword [ebp - 0x458], 1
jmp 0x100193fd
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x278]
cmp dword [ebp - 0x458], eax
jg 0x10019417
mov dword [ebp - 0x460], 1
jmp 0x1001941e
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x194]
add eax, dword [ebp - 0x460]
cmp dword [ebp - 0x280], eax
je 0x1001943e
mov dword [ebp - 0x468], 1
jmp 0x10019445
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x488]
cmp dword [ebp - 0x468], eax
jl 0x1001945f
mov dword [ebp - 0x470], 1
jmp 0x10019466
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x470]
inc eax
cmp eax, dword [ebp - 0x194]
jl 0x10019481
mov dword [ebp - 0x478], 1
jmp 0x10019488
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x480]
imul eax, dword [ebp - 0x278]
test eax, eax
jne 0x100194ae
cmp dword [ebp - 0x280], 0
je 0x100194c3
cmp dword [ebp - 0x488], 0
je 0x100194c3
mov dword [ebp - 0x490], 1
jmp 0x100194ca
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x1f0]
imul eax, dword [ebp - 0x490]
neg eax
je 0x100194ee
push 2
pop eax
test eax, eax
je 0x100194ee
mov dword [ebp - 0x498], 1
jmp 0x100194f5
and dword [ebp - 0x498], 0
cmp dword [ebp - 0x498], 0xfffffff6
jg 0x1001950a
mov dword [ebp - 0x4a0], 1
jmp 0x10019511
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x1f0], eax
jmp 0x1001902d
mov dword [ebp - 0x4f0], 0xa3fd
mov dword [ebp - 0x90c], 0xffffffff
push 2
lea ecx, [ebp - 0xb20]
call fcn.1002cb22
mov dword [ebp - 4], 0x23
push 0
lea eax, [ebp - 0xb20]
push eax
lea eax, [ebp - 0xdac]
push eax
push 0x360c
push 0x1422
call fcn.1000b473
add esp, 0x14
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x10019592
push 0x7466
push 0
push 0x73c0
call fcn.1001b57d
add esp, 0xc
mov dword [ebp - 0x8a4], 0x16b2
cmp dword [ebp - 0x8a4], 0x695
jge 0x100196b8
xor cl, cl
call fcn.10009ad6
lea eax, [ebp - 0x288]
push eax
mov ecx, 0x1065dcc0
call fcn.1002c3d9
push fcn.1003148b
mov edx, 0x10007b98
mov ecx, 0x1065dc18
call fcn.100312b4
mov ecx, eax
call fcn.1002c6b2
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x904], eax
mov eax, dword [ebp - 0x288]
dec eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x904], 0
je 0x100196b8
lea eax, [ebp - 0xc2c]
push eax
lea eax, [ebp - 0xcdc]
push eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x290]
push eax
mov ecx, 0x1065dcc0
call fcn.1002c3d9
mov ecx, eax
call fcn.1002c3d9
mov ecx, eax
call fcn.1002c3d9
mov ecx, eax
call fcn.1002c3d9
mov eax, dword [ebp - 0x290]
and eax, 0x80000001
jns 0x10019652
dec eax
or eax, 0xfffffffe
inc eax
inc eax
inc eax
and eax, 0x80000001
jns 0x10019660
dec eax
or eax, 0xfffffffe
inc eax
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x298]
and eax, 0x80000001
jns 0x10019678
dec eax
or eax, 0xfffffffe
inc eax
inc eax
inc eax
and eax, 0x80000001
jns 0x10019686
dec eax
or eax, 0xfffffffe
inc eax
mov dword [ebp - 0x298], eax
push fcn.1003148b
mov eax, dword [ebp - 0x290]
mov ecx, dword [ebp - 0x298]
lea eax, [ecx + eax*2 + 1]
push eax
mov ecx, 0x1065dc18
call fcn.1002c7d0
mov ecx, eax
call fcn.1002c6b2
jmp 0x100195df
cmp dword [ebp - 0x84], 0x1320f2d6
jg 0x100196d0
mov dword [ebp - 0x4a8], 1
jmp 0x100196d7
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x84]
imul eax, dword [ebp - 0x4a8]
test eax, eax
je 0x100196fd
cmp dword [ebp - 0x104], 0
je 0x100196fd
mov dword [ebp - 0x4b0], 1
jmp 0x10019704
and dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x4b0], 0xd6b5
jge 0x1001971c
mov dword [ebp - 0x4b8], 1
jmp 0x10019723
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x4b8], eax
jg 0x1001973d
mov dword [ebp - 0x4c0], 1
jmp 0x10019744
and dword [ebp - 0x4c0], 0
cmp dword [ebp - 0x4c0], 0xff44
je 0x1001975c
mov dword [ebp - 0x4c8], 1
jmp 0x10019763
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x4c8], eax
je 0x1001977d
mov dword [ebp - 0x4d0], 1
jmp 0x10019784
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x4d0], eax
jg 0x1001979e
mov dword [ebp - 0x4d8], 1
jmp 0x100197a5
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x2a0]
add eax, 8
cmp eax, 0xfffffff8
jge 0x100197cb
mov dword [ebp - 0x4e0], 1
jmp 0x100197d2
and dword [ebp - 0x4e0], 0
imul eax, dword [ebp - 0x4e0], 0x1718
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x2a8], eax
jne 0x100197fc
mov dword [ebp - 0x4e8], 1
jmp 0x10019803
and dword [ebp - 0x4e8], 0
imul eax, dword [ebp - 0x4e8], 0x3725
mov dword [ebp - 0x4f0], eax
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x4f0], eax
jle 0x1001982d
mov dword [ebp - 0x8ac], 1
jmp 0x10019834
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xc34], eax
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x2a0], eax
je 0x1001985a
mov dword [ebp - 0x4f8], 1
jmp 0x10019861
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x84]
imul eax, dword [ebp - 0x4f8]
sub eax, dword [ebp - 0x84]
jne 0x1001987d
cmp dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x84]
sub eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x104]
jl 0x1001989d
mov dword [ebp - 0x500], 1
jmp 0x100198a4
and dword [ebp - 0x500], 0
mov esi, dword [ebp - 0x500]
sub esi, dword [ebp - 0x90c]
push 0
lea ecx, [ebp - 0xb20]
call fcn.1002cc7e
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb20]
call fcn.1002cbfb
push 3
lea ecx, [ebp - 0x328]
call fcn.1002cb22
mov dword [ebp - 4], 0x24
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x2c0], 8
mov dword [ebp - 0xd6c], 0xfffffff8
push 0
lea eax, [ebp - 0xc3c]
push eax
lea eax, [ebp - 0x328]
push eax
call fcn.100264fe
add esp, 0xc
mov dword [ebp - 0x10], 0
jmp 0x10019925
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x10019be3
push 1
lea ecx, [ebp - 0xa24]
call fcn.1002cb22
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0xa24]
push eax
lea eax, [ebp - 0x19c]
push eax
push 0
call fcn.1001c221
add esp, 0xc
mov dword [ebp - 0x8b4], 0x20b6
cmp dword [ebp - 0x8b4], 0xac7
jge 0x10019a11
lea eax, [ebp - 0x2b0]
push eax
push 0x10007b8c
call fcn.1005459b
pop ecx
pop ecx
and dword [ebp - 0x1f8], 0
and dword [ebp - 0x2b8], 0
and dword [ebp - 0x510], 0
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x2b0]
dec eax
mov dword [ebp - 0x2b0], eax
js 0x100199ff
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x510]
push eax
push 0x10007bb8
call fcn.1005459b
add esp, 0xc
mov eax, dword [ebp - 0x34c]
sub eax, dword [ebp - 0x510]
add eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1f8]
cmp eax, dword [ebp - 0x2b8]
jle 0x100199fd
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x2b8], eax
jmp 0x100199a1
push dword [ebp - 0x2b8]
push 0x10007b8c
call fcn.100549f9
pop ecx
pop ecx
mov dword [ebp - 0x19c], 0
jmp 0x10019a2a
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 1
jge 0x10019a46
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x914], 0xfffffffd
jmp 0x10019a1d
push dword [ebp - 0x10]
lea ecx, [ebp - 0x328]
call fcn.1002cc7e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x328]
call fcn.1002cc7e
mov esi, eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x328]
call fcn.1002cc7e
mov eax, dword [eax]
mov ecx, dword [esi]
lea eax, [eax + ecx + 1]
mov dword [ebp - 0x2c0], eax
mov esi, dword [ebp - 0x2c0]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x328]
call fcn.1002cc7e
cmp esi, dword [eax]
jg 0x10019aa4
mov dword [ebp - 0x518], 1
jmp 0x10019aab
and dword [ebp - 0x518], 0
cmp dword [ebp - 0x518], 3
je 0x10019ac0
mov dword [ebp - 0x520], 1
jmp 0x10019ac7
and dword [ebp - 0x520], 0
cmp dword [ebp - 0x520], 2
jle 0x10019adc
mov dword [ebp - 0x528], 1
jmp 0x10019ae3
and dword [ebp - 0x528], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x328]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x528]
cmp ecx, dword [eax]
jg 0x10019b17
push dword [ebp - 0x10]
lea ecx, [ebp - 0x328]
call fcn.1002cc7e
cmp dword [eax], 0
jne 0x10019b17
and dword [ebp - 0x530], 0
jmp 0x10019b21
mov dword [ebp - 0x530], 1
mov esi, dword [ebp - 0x530]
neg esi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x328]
call fcn.1002cc7e
cmp esi, dword [eax]
je 0x10019b47
mov dword [ebp - 0x538], 1
jmp 0x10019b4e
and dword [ebp - 0x538], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x328]
call fcn.1002cc7e
mov eax, dword [eax]
sub eax, dword [ebp - 0x538]
mov dword [ebp - 0x540], eax
push 0
lea ecx, [ebp - 0xa24]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x540]
mov dword [eax], ecx
mov eax, dword [ebp - 0x540]
sub eax, dword [ebp - 0x10]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x914], eax
push 0xebd
push 1
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0xa24]
push eax
push 0
push 0xfc4
push 0x2c89
push 1
push 0x4d21
push 0x7f5e
push 0x6eaf
call fcn.1000a893
add esp, 0x2c
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xa24]
call fcn.1002cbfb
jmp 0x1001991e
lea eax, [ebp - 0x10]
push eax
push 0
call fcn.1001bbc5
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x328]
call fcn.1002cbfb
mov eax, dword [ebp - 0x218]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x218]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x94], 9
push 2
lea ecx, [ebp - 0x738]
call fcn.1002cb22
mov dword [ebp - 4], 0x26
mov dword [ebp - 0x180], 0
jmp 0x10019c51
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 3
jge 0x10019c6d
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x9d4], 1
jmp 0x10019c44
push 0
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x738]
push eax
call fcn.1001f571
add esp, 0xc
mov dword [ebp - 0x8bc], 0x195f
cmp dword [ebp - 0x8bc], 0xfed
jge 0x10019ee9
lea eax, [ebp - 0xce4]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x2c8]
push eax
push 0x10007c8c
call fcn.1005459b
add esp, 0x10
mov byte [ebp - 0x11f], 0x20
lea eax, [ebp - 0x11f]
push eax
push dword [ebp - 0x208]
lea ecx, [ebp - 0xdf4]
call fcn.1002d1ae
mov dword [ebp - 0x91c], eax
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x8c4], eax
mov byte [ebp - 4], 0x27
push dword [ebp - 0x8c4]
push dword [ebp - 0x2c8]
lea ecx, [ebp - 0x9c4]
call fcn.1002d1f8
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0xdf4]
call fcn.1002d1d0
and dword [ebp - 0x1a0], 0
jmp 0x10019d32
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
cmp eax, dword [ebp - 0x2c8]
jge 0x10019d9e
and dword [ebp - 0x200], 0
jmp 0x10019d56
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x200]
cmp eax, dword [ebp - 0x208]
jge 0x10019d91
push dword [ebp - 0x200]
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0x9c4]
call fcn.1002d094
mov ecx, eax
call fcn.1002d1ec
push eax
push 0x10007cd4
call fcn.1005459b
pop ecx
pop ecx
jmp 0x10019d49
push 0x10007bc4
call fcn.1005459b
pop ecx
jmp 0x10019d25
and dword [ebp - 0x8c], 0
jmp 0x10019db4
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x208]
jge 0x10019ecf
and dword [ebp - 0x10c], 0
mov dword [ebp - 0x20], 1
jmp 0x10019ddd
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x2c8]
jge 0x10019eb8
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x8c]
jg 0x10019e2b
mov eax, dword [ebp - 0x8c]
sub eax, dword [ebp - 0x20]
push eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x9c4]
call fcn.1002d094
mov ecx, eax
call fcn.1002d1ec
movsx eax, byte [eax]
cmp eax, 0x52
jne 0x10019e2b
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x208]
jge 0x10019e70
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x20]
push eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x9c4]
call fcn.1002d094
mov ecx, eax
call fcn.1002d1ec
movsx eax, byte [eax]
cmp eax, 0x4c
jne 0x10019e70
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x20]
and eax, 0x80000001
jns 0x10019e7f
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x10019eb3
push dword [ebp - 0x8c]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x9c4]
call fcn.1002d094
mov ecx, eax
call fcn.1002d1ec
movsx eax, byte [eax]
cmp eax, 0x55
jne 0x10019eb3
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
jmp 0x10019dd6
push dword [ebp - 0x10c]
push 0x10007bb0
call fcn.100549f9
pop ecx
pop ecx
jmp 0x10019da7
push 0x10007add
call fcn.10054d82
pop ecx
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x9c4]
call fcn.1002d21a
mov dword [ebp - 0x94], 2
jmp 0x10019f02
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x1001a005
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9d4]
mov dword [ebp - 0xc44], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9d4], 1
jbe 0x10019f3e
mov dword [ebp - 0x548], 1
jmp 0x10019f45
and dword [ebp - 0x548], 0
cmp dword [ebp - 0x548], 0x9900
jge 0x10019f5d
mov dword [ebp - 0x550], 1
jmp 0x10019f64
and dword [ebp - 0x550], 0
cmp dword [ebp - 0x550], 0xfffffff7
jne 0x10019f79
mov dword [ebp - 0x558], 1
jmp 0x10019f80
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp + eax*4 - 0x9d4]
cmp eax, dword [ebp - 0x558]
jl 0x10019fa1
mov dword [ebp - 0x560], 1
jmp 0x10019fa8
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp + eax*4 - 0x9d4]
mov ecx, dword [ebp - 0x560]
add ecx, 0x980
imul eax, ecx
test eax, eax
je 0x10019fe4
mov eax, dword [ebp - 0x94]
cmp dword [ebp + eax*4 - 0x9d4], 0
je 0x10019fe4
mov dword [ebp - 0x568], 1
jmp 0x10019feb
and dword [ebp - 0x568], 0
push 0
lea ecx, [ebp - 0x738]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x568]
mov dword [eax], ecx
jmp 0x10019ef5
cmp dword [ebp - 0x94], 0x3dd972c4
jg 0x1001a01d
mov dword [ebp - 0x570], 1
jmp 0x1001a024
and dword [ebp - 0x570], 0
push 0
lea ecx, [ebp - 0x738]
call fcn.1002cc7e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x570]
jl 0x1001a047
mov dword [ebp - 0x578], 1
jmp 0x1001a04e
and dword [ebp - 0x578], 0
push 0
lea ecx, [ebp - 0x738]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x578]
sub ecx, dword [eax]
jns 0x1001a07a
mov eax, 0xe265
test eax, eax
je 0x1001a07a
mov dword [ebp - 0x580], 1
jmp 0x1001a081
and dword [ebp - 0x580], 0
push 0
lea ecx, [ebp - 0x738]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x580]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x738]
call fcn.1002cbfb
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x34], 0xc58f5537
mov dword [ebp - 0x40], 0
jmp 0x1001a0c3
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xc
jne 0x1001a526
mov dword [ebp - 0x114], 0xc285ce96
mov dword [ebp - 0xa98], 0x4579
mov dword [ebp - 0xa94], 0x4579
mov dword [ebp - 0xa90], 0x4579
mov dword [ebp - 0xa8c], 0x4579
lea ecx, [ebp - 0x25e]
call fcn.1002cc93
push eax
lea eax, [ebp - 0xa88]
push eax
lea eax, [ebp - 0xa98]
push eax
lea ecx, [ebp - 0xe14]
call fcn.1002cc96
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x25c]
call fcn.1002cbd5
mov dword [ebp - 4], 0x2a
mov dword [ebp - 0x210], 0
jmp 0x1001a154
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 3
jge 0x1001a170
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0x750], 0xfffffff8
jmp 0x1001a147
mov dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x40], eax
je 0x1001a191
mov dword [ebp - 0x590], 1
jmp 0x1001a198
and dword [ebp - 0x590], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x750]
cmp dword [ebp + eax - 0x750], ecx
jne 0x1001a1bf
mov dword [ebp - 0x924], 1
jmp 0x1001a1c6
and dword [ebp - 0x924], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xd98], eax
mov esi, dword [ebp - 0x40]
push 2
lea ecx, [ebp - 0x25c]
call fcn.1002cc7e
cmp esi, dword [eax]
jg 0x1001a1ef
mov dword [ebp - 0x588], 1
jmp 0x1001a1f6
and dword [ebp - 0x588], 0
push 2
lea ecx, [ebp - 0x25c]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x588]
cmp ecx, dword [eax]
jg 0x1001a219
mov dword [ebp - 0x598], 1
jmp 0x1001a220
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x590]
cmp eax, dword [ebp - 0x598]
jg 0x1001a23a
mov dword [ebp - 0x5a0], 1
jmp 0x1001a241
and dword [ebp - 0x5a0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x750]
cmp dword [ebp - 0x5a0], eax
jge 0x1001a262
mov dword [ebp - 0x5a8], 1
jmp 0x1001a269
and dword [ebp - 0x5a8], 0
cmp dword [ebp - 0x5a8], 0xffffffff
je 0x1001a27e
mov dword [ebp - 0x5b0], 1
jmp 0x1001a285
and dword [ebp - 0x5b0], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x750]
push 2
lea ecx, [ebp - 0x25c]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x5b0]
add ecx, dword [eax]
imul esi, ecx
mov dword [ebp - 0x5b8], esi
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5b8]
mov dword [ebp + eax - 0x750], ecx
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0x1d
jmp 0x1001a2dc
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffe5
jl 0x1001a512
mov dword [ebp - 0x30], 0
push 0
push 0x3d62
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.1000f8d3
add esp, 0x10
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc4c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xcec], eax
mov eax, dword [ebp - 0x30]
inc eax
cmp dword [ebp - 0x30], eax
jl 0x1001a331
mov dword [ebp - 0x5c0], 1
jmp 0x1001a338
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x5c0], eax
jle 0x1001a34f
mov dword [ebp - 0x5c8], 1
jmp 0x1001a356
and dword [ebp - 0x5c8], 0
push 2
lea ecx, [ebp - 0x25c]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x5c8]
cmp ecx, dword [eax]
jge 0x1001a382
mov eax, 0xe48c0c84
test eax, eax
je 0x1001a382
mov dword [ebp - 0x8cc], 1
jmp 0x1001a389
and dword [ebp - 0x8cc], 0
push 2
lea ecx, [ebp - 0x25c]
call fcn.1002cc7e
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x114], eax
jne 0x1001a3b0
mov dword [ebp - 0x5d0], 1
jmp 0x1001a3b7
and dword [ebp - 0x5d0], 0
push 3
lea ecx, [ebp - 0x25c]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x5d0]
cmp ecx, dword [eax]
jl 0x1001a3da
mov dword [ebp - 0x92c], 1
jmp 0x1001a3e1
and dword [ebp - 0x92c], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x770], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x770]
mov dword [ebp + eax - 0x750], ecx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc54], eax
mov eax, 0xce85
inc eax
cmp eax, dword [ebp - 0x30]
jne 0x1001a41d
mov dword [ebp - 0x5d8], 1
jmp 0x1001a424
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x5d8], eax
jl 0x1001a43b
mov dword [ebp - 0x774], 1
jmp 0x1001a442
and dword [ebp - 0x774], 0
push 2
lea ecx, [ebp - 0x25c]
call fcn.1002cc7e
push 3
lea ecx, [ebp - 0x25c]
call fcn.1002cc7e
push 2
lea ecx, [ebp - 0x25c]
call fcn.1002cc7e
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x30], eax
jg 0x1001a486
mov eax, 0x11659018
test eax, eax
je 0x1001a486
mov dword [ebp - 0x5e0], 1
jmp 0x1001a48d
and dword [ebp - 0x5e0], 0
cmp dword [ebp - 0x5e0], 0xee1e3c1d
jae 0x1001a4ab
cmp dword [ebp - 0x30], 0
je 0x1001a4ab
mov dword [ebp - 0x77c], 1
jmp 0x1001a4b2
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xd74], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jg 0x1001a4cf
mov dword [ebp - 0x784], 1
jmp 0x1001a4d6
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xc5c], eax
cmp dword [ebp - 0x34], 0
je 0x1001a4fa
cmp dword [ebp - 0x30], 0
je 0x1001a4fa
mov dword [ebp - 0x5e8], 1
jmp 0x1001a501
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x114], eax
jmp 0x1001a2d5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x25c]
call fcn.1002cbfb
jmp 0x1001a0bc
and dword [ebp - 0x2d0], 0
jmp 0x1001a545
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x3c]
add eax, 0x28
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x218]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x2d0], eax
jge 0x1001ac02
mov dword [ebp - 0x79c], 8
mov dword [ebp - 0x794], 0
push 3
lea ecx, [ebp - 0xb14]
call fcn.1002cb22
mov dword [ebp - 4], 0x2b
mov dword [ebp - 0x78c], 0xfa8fad7
mov dword [ebp - 0x220], 0
jmp 0x1001a5a8
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 3
jge 0x1001a5ca
push dword [ebp - 0x220]
lea ecx, [ebp - 0xb14]
call fcn.1002cc7e
mov dword [eax], 0xe0f758fc
jmp 0x1001a59b
push 0
lea eax, [ebp - 0xb14]
push eax
lea eax, [ebp - 0x78c]
push eax
lea eax, [ebp - 0x794]
push eax
push 1
push 0x266b
lea eax, [ebp - 0x79c]
push eax
call fcn.10025cb5
add esp, 0x1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb14]
call fcn.1002cbfb
mov eax, dword [ebp - 0x3c]
cmp dword [eax + 0x10], 0
jne 0x1001a909
push 2
lea ecx, [ebp - 0x708]
call fcn.1002cb22
mov dword [ebp - 4], 0x2c
mov dword [ebp - 0x44], 0
jmp 0x1001a637
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x1001a64d
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x7a4], 0x648261f
jmp 0x1001a630
mov dword [ebp - 0x44], 0
jmp 0x1001a65d
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x1001a679
push dword [ebp - 0x44]
lea ecx, [ebp - 0x708]
call fcn.1002cc7e
mov dword [eax], 0xe19d29be
jmp 0x1001a656
push 1
lea ecx, [ebp - 0x708]
call fcn.1002cc7e
and dword [eax], 0
jmp 0x1001a6af
push 1
lea ecx, [ebp - 0x708]
call fcn.1002cc7e
mov dword [ebp - 0x5f0], eax
mov eax, dword [ebp - 0x5f0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x5f0]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x708]
call fcn.1002cc7e
cmp dword [eax], 1
jge 0x1001a6dd
push 1
lea ecx, [ebp - 0x708]
call fcn.1002cc7e
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x7a4], 0xe446df37
jmp 0x1001a68b
push 0x6747
lea eax, [ebp - 0x708]
push eax
push 0
push 0x73b5
push 0x62fc
call fcn.1000a842
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x708]
call fcn.1002cbfb
lea eax, [ebp - 0x2d8]
push eax
push 0x1c66
push 0
lea eax, [ebp - 0x620]
push eax
push 1
push 0x43aa
lea eax, [ebp - 0x3c]
push eax
push 1
push 0x2347
push 0x1e69
lea eax, [ebp - 0x7ac]
push eax
push 0x258f
call fcn.1001cc58
add esp, 0x30
mov dword [ebp - 0x9c], 0xfffffff6
mov dword [ebp - 0x610], 0xe75d5f8d
mov dword [ebp - 0x228], 0
jmp 0x1001a779
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 3
jge 0x1001a795
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0xb68], 0xec2e0cf5
jmp 0x1001a76c
mov dword [ebp - 0x9c], 0
jmp 0x1001a7ae
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jg 0x1001a85d
mov dword [ebp - 0x230], 0
jmp 0x1001a7d4
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 2
jge 0x1001a7f0
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0x720], 0xbb11accb
jmp 0x1001a7c7
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x720], 0
jmp 0x1001a81e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x720]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x720], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x720], 2
jg 0x1001a858
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1001a856
push 0
push 0x158c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x1001a803
jmp 0x1001a7a1
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xcfc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb68]
mov dword [ebp - 0xc64], eax
mov eax, dword [ebp - 0x9c]
add eax, 8
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x610]
cmp dword [ebp - 0x9c], eax
jl 0x1001a8a5
mov dword [ebp - 0x600], 1
jmp 0x1001a8ac
and dword [ebp - 0x600], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb68]
mov dword [ebp - 0x5f8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5f8]
mov dword [ebp + eax - 0xb68], ecx
mov eax, dword [ebp - 0x5f8]
sub eax, dword [ebp - 0x600]
cmp eax, 0xb82c4475
jae 0x1001a8f1
mov dword [ebp - 0x608], 1
jmp 0x1001a8f8
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x610], eax
jmp 0x1001a52f
mov dword [ebp - 0x158], 0x3f467215
mov dword [ebp - 0xa70], 1
mov dword [ebp - 0xa6c], 1
mov dword [ebp - 0xa68], 1
mov dword [ebp - 0xa64], 1
lea ecx, [ebp - 0x24d]
call fcn.1002cc93
push eax
lea eax, [ebp - 0xa60]
push eax
lea eax, [ebp - 0xa70]
push eax
lea ecx, [ebp - 0xe24]
call fcn.1002cc96
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd58]
call fcn.1002cbd5
mov dword [ebp - 4], 0x2d
mov eax, 0xfff8
test eax, eax
je 0x1001a9bc
mov eax, dword [ebp - 0x158]
imul ecx, dword [ebp - 0x158], 0x9c9f
lea eax, [eax + ecx + 0x7b04800f]
test eax, eax
je 0x1001a9bc
mov byte [ebp - 0x127], 0
movzx eax, byte [ebp - 0x127]
test eax, eax
je 0x1001a9b7
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1001ab8e
mov dword [ebp - 0x7b4], 0x876a
mov dword [ebp - 0x158], 0
jmp 0x1001a9df
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0x1b
jg 0x1001ab8e
mov dword [ebp - 0x4c], 0xb6bc3ec3
mov dword [ebp - 0x4c], 0
jmp 0x1001aa03
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jg 0x1001ab39
mov dword [ebp - 0x238], 0xffffffff
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xd58]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x1001aa2f
jmp 0x1001ab39
mov dword [ebp - 0x238], 3
jmp 0x1001aa48
mov eax, dword [ebp - 0x238]
dec eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jl 0x1001ab34
push 3
lea ecx, [ebp - 0x9e4]
call fcn.1002cb22
mov byte [ebp - 4], 0x2e
push 0x5d28
push 0x539f
lea eax, [ebp - 0x9e4]
push eax
push 0x1902
lea eax, [ebp - 0xdbc]
push eax
push 0x452e
push 0
push 0x34c6
call fcn.10026326
add esp, 0x20
push 2
lea ecx, [ebp - 0x9e4]
call fcn.1002cc7e
and dword [eax], 0
jmp 0x1001aacd
push 2
lea ecx, [ebp - 0x9e4]
call fcn.1002cc7e
mov dword [ebp - 0x618], eax
mov eax, dword [ebp - 0x618]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x618]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x9e4]
call fcn.1002cc7e
cmp dword [eax], 3
jg 0x1001ab20
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x1001ab1e
push 0x1364
push 0x4056
push 0xf50
push 0x5261
push 0
push 0x6373
push 0xa19
push 0x27ba
call fcn.1000c81a
add esp, 0x20
jmp 0x1001aaa9
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x9e4]
call fcn.1002cbfb
jmp 0x1001aa3b
jmp 0x1001a9fc
mov dword [ebp - 0x4c], 0
jmp 0x1001ab49
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jg 0x1001ab89
mov dword [ebp - 0x214], 1
mov dword [ebp - 0x214], 3
jmp 0x1001ab72
mov eax, dword [ebp - 0x214]
dec eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jl 0x1001ab87
mov dword [ebp - 0x7b4], 0xd5467356
jmp 0x1001ab65
jmp 0x1001ab42
jmp 0x1001a9d2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd58]
call fcn.1002cbfb
push 4
push 0x1000
mov eax, dword [ebp - 0x3c]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x620]
add ecx, dword [eax + 0xc]
push ecx
push 0xa6bf
push 0xc5fd
call fcn.1003d532
pop ecx
pop ecx
call eax
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x3c]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x7bc]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x2d8]
call fcn.1003d6c9
add esp, 0xc
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x2d8]
mov dword [eax + 8], ecx
jmp 0x1001a52f
jmp 0x1001aee4
mov eax, dword [ebp - 0x7c4]
mov dword [ebp - 0x7fc], eax
mov eax, dword [ebp - 0x7cc]
mov dword [ebp - 0x804], eax
mov eax, dword [ebp - 0x7d4]
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0x814], eax
mov eax, dword [ebp - 0x7e4]
mov dword [ebp - 0x81c], eax
mov eax, dword [ebp - 0x7ec]
mov dword [ebp - 0x824], eax
mov eax, dword [ebp - 0x7f4]
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp - 0x7fc]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp - 0x804]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x668], eax
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x81c]
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x824]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x82c]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp - 0x98]
cmp dword [eax], 0x1320f2d6
jg 0x1001acc9
mov dword [ebp - 0x628], 1
jmp 0x1001acd0
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
imul eax, dword [ebp - 0x628]
test eax, eax
je 0x1001acfa
mov eax, dword [ebp - 0x11c]
cmp dword [eax], 0
je 0x1001acfa
mov dword [ebp - 0x630], 1
jmp 0x1001ad01
and dword [ebp - 0x630], 0
cmp dword [ebp - 0x630], 0xd6b5
jge 0x1001ad19
mov dword [ebp - 0x638], 1
jmp 0x1001ad20
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
cmp dword [ebp - 0x638], eax
jg 0x1001ad3c
mov dword [ebp - 0x640], 1
jmp 0x1001ad43
and dword [ebp - 0x640], 0
cmp dword [ebp - 0x640], 0xff44
je 0x1001ad5b
mov dword [ebp - 0x648], 1
jmp 0x1001ad62
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
cmp dword [ebp - 0x648], eax
je 0x1001ad7e
mov dword [ebp - 0x650], 1
jmp 0x1001ad85
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
cmp dword [ebp - 0x650], eax
jg 0x1001ada1
mov dword [ebp - 0x2e0], 1
jmp 0x1001ada8
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x670]
mov ecx, dword [ebp - 0x2e0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2e0]
add eax, 8
cmp eax, 0xfffffff8
jge 0x1001add0
mov dword [ebp - 0x658], 1
jmp 0x1001add7
and dword [ebp - 0x658], 0
imul eax, dword [ebp - 0x658], 0x1718
mov ecx, dword [ebp - 0x2e8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x2e8]
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jne 0x1001ae07
mov dword [ebp - 0x660], 1
jmp 0x1001ae0e
and dword [ebp - 0x660], 0
imul eax, dword [ebp - 0x660], 0x3725
mov ecx, dword [ebp - 0x668]
mov dword [ecx], eax
mov eax, dword [ebp - 0x668]
mov ecx, dword [ebp - 0x11c]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jle 0x1001ae3e
mov dword [ebp - 0x834], 1
jmp 0x1001ae45
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x11c]
mov eax, dword [eax]
mov dword [ebp - 0xc6c], eax
mov eax, dword [ebp - 0x670]
mov ecx, dword [ebp - 0x11c]
mov ecx, dword [ecx]
cmp dword [eax], ecx
je 0x1001ae71
mov dword [ebp - 0x678], 1
jmp 0x1001ae78
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
imul eax, dword [ebp - 0x678]
mov ecx, dword [ebp - 0x98]
sub eax, dword [ecx]
jne 0x1001ae9a
mov eax, dword [ebp - 0x2e8]
cmp dword [eax], 0
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x98]
sub eax, dword [ecx]
mov ecx, dword [ebp - 0x11c]
cmp eax, dword [ecx]
jl 0x1001aec0
mov dword [ebp - 0x680], 1
jmp 0x1001aec7
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x83c]
mov esi, dword [ebp - 0x680]
sub esi, dword [eax]
push 0
mov ecx, dword [ebp - 0x844]
call fcn.1002cc7e
mov dword [eax], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret