Function at 0x1001b06f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10069e77
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x334
push esi
push edi
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001c5ac
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x250], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x1c4]
movzx eax, byte [eax]
test eax, eax
je 0x1001b0e1
mov byte [ebp - 0x2c], 0
push 1
push 1
push 0x5d84
lea eax, [ebp - 0x2c]
push eax
call fcn.10017b3d
add esp, 0x10
jmp 0x1001c5a7
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x10], 5
push 3
lea ecx, [ebp - 0x174]
call fcn.1000e524
and dword [ebp - 4], 0
mov dword [ebp - 0x74], 0x17017a68
mov dword [ebp - 0x1a4], 0xfffffffb
mov dword [ebp - 0x258], 0x25da
cmp dword [ebp - 0x258], 0x115d
jge 0x1001b2de
lea ecx, [ebp - 0x290]
call fcn.1000e3f6
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x314]
call fcn.1000e3f6
mov byte [ebp - 4], 2
xor eax, eax
inc eax
je 0x1001b2c0
lea edx, [ebp - 0x290]
mov ecx, 0x10612310
call fcn.1002b354
mov edx, 0x10008030
lea ecx, [ebp - 0x290]
call fcn.1002b379
movzx eax, al
test eax, eax
je 0x1001b19a
jmp 0x1001b2c0
lea ecx, [ebp - 0x290]
call fcn.1000e4ab
mov dword [ebp - 0x260], eax
lea ecx, [ebp - 0x314]
call fcn.100277cd
and dword [ebp - 0x28], 0
jmp 0x1001b1c3
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x260]
jge 0x1001b26f
push dword [ebp - 0x28]
lea ecx, [ebp - 0x290]
call fcn.100277dd
movsx eax, byte [eax]
push eax
call fcn.10054cfb
pop ecx
test eax, eax
jne 0x1001b20a
push dword [ebp - 0x28]
lea ecx, [ebp - 0x290]
call fcn.100277dd
movsx eax, byte [eax]
push eax
call fcn.10054ca5
pop ecx
test eax, eax
je 0x1001b26a
push dword [ebp - 0x28]
lea ecx, [ebp - 0x290]
call fcn.100277dd
movsx eax, byte [eax]
push eax
call fcn.10054cfb
pop ecx
test eax, eax
je 0x1001b242
push dword [ebp - 0x28]
lea ecx, [ebp - 0x290]
call fcn.100277dd
movsx eax, byte [eax]
add eax, 0x20
mov dword [ebp - 0x144], eax
jmp 0x1001b259
push dword [ebp - 0x28]
lea ecx, [ebp - 0x290]
call fcn.100277dd
movsx eax, byte [eax]
mov dword [ebp - 0x144], eax
push dword [ebp - 0x144]
lea ecx, [ebp - 0x314]
call fcn.100277bc
jmp 0x1001b1bc
lea eax, [ebp - 0x314]
push eax
call fcn.1001b012
pop ecx
movzx eax, al
test eax, eax
je 0x1001b2a0
push 0x1002b14b
mov edx, 0x1000803c
mov ecx, 0x10612258
call fcn.1002b17d
mov ecx, eax
call fcn.10027a3e
jmp 0x1001b2bb
push 0x1002b14b
mov edx, 0x10008040
mov ecx, 0x10612258
call fcn.1002b17d
mov ecx, eax
call fcn.10027a3e
jmp 0x1001b165
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x314]
call fcn.1000e3bb
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x290]
call fcn.1000e3bb
push 1
lea eax, [ebp - 0x2b4]
push eax
push 0xe4d
push 0
lea eax, [ebp - 0x174]
push eax
call fcn.1001a467
add esp, 0x14
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x1c], ecx
test eax, eax
jne 0x1001b4dc
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x1c], eax
jg 0x1001b323
mov dword [ebp - 0x150], 1
jmp 0x1001b32a
and dword [ebp - 0x150], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x150]
cmp eax, dword [ebp - 0x10]
jg 0x1001b47d
cmp dword [ebp - 0x10], 0xa3c3d214
je 0x1001b351
mov dword [ebp - 0xa4], 1
jmp 0x1001b358
and dword [ebp - 0xa4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xa4], eax
jg 0x1001b36f
mov dword [ebp - 0x9c], 1
jmp 0x1001b376
and dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x9c], eax
jg 0x1001b390
cmp dword [ebp - 0x1c], 0
jne 0x1001b390
and dword [ebp - 0xa0], 0
jmp 0x1001b39a
mov dword [ebp - 0xa0], 1
push 1
lea ecx, [ebp - 0x174]
call fcn.1000e5c2
mov ecx, dword [ebp - 0xa0]
cmp ecx, dword [eax]
jg 0x1001b3c3
cmp dword [ebp - 0x10], 0
je 0x1001b3c3
mov dword [ebp - 0x100], 1
jmp 0x1001b3ca
and dword [ebp - 0x100], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x100], eax
je 0x1001b3e1
mov dword [ebp - 0xa8], 1
jmp 0x1001b3e8
and dword [ebp - 0xa8], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xa8], eax
je 0x1001b3ff
mov dword [ebp - 0x268], 1
jmp 0x1001b406
and dword [ebp - 0x268], 0
push 1
lea ecx, [ebp - 0x174]
call fcn.1000e5c2
mov esi, eax
push 1
lea ecx, [ebp - 0x174]
call fcn.1000e5c2
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x1001b434
mov dword [ebp - 0x130], 1
jmp 0x1001b43b
and dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x130], eax
jl 0x1001b452
mov dword [ebp - 0xb0], 1
jmp 0x1001b459
and dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jge 0x1001b474
cmp dword [ebp - 0x74], 0
je 0x1001b474
cmp dword [ebp - 0x10], 0
jne 0x1001b47d
and dword [ebp - 0x108], 0
jmp 0x1001b487
mov dword [ebp - 0x108], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x108], eax
jg 0x1001b49e
mov dword [ebp - 0xb8], 1
jmp 0x1001b4a5
and dword [ebp - 0xb8], 0
cmp dword [ebp - 0xb8], 0xf6f0c3da
jb 0x1001b4bd
mov dword [ebp - 0x148], 1
jmp 0x1001b4c4
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x148]
dec eax
dec eax
cmp eax, 0xcf8f
jg 0x1001b4dc
and dword [ebp - 0xc0], 0
jmp 0x1001b4e6
mov dword [ebp - 0xc0], 1
push 2
lea ecx, [ebp - 0x174]
call fcn.1000e5c2
mov ecx, dword [ebp - 0xc0]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x10]
jne 0x1001b532
mov dword [ebp - 0x210], 0xffffffff
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 1
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10013726
add esp, 0x1c
jmp 0x1001b5a3
mov dword [ebp - 0x10], 0
jmp 0x1001b542
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1001b584
push 0x78ff
push 0x70b5
push 0x373b
push 0x63e8
lea eax, [ebp - 0x174]
push eax
push 0x8a6
push 0
lea eax, [ebp - 0x10]
push eax
push 1
push 0x6697
push 0x55a9
call fcn.10016215
add esp, 0x2c
jmp 0x1001b53b
lea eax, [ebp - 0x1c]
push eax
push 0xde1
push 0
push 0x793c
push 0x7b0
push 0
call fcn.100244aa
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x174]
call fcn.1000e5a6
mov eax, dword [ebp - 0x40]
mov eax, dword [eax + 4]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x2d8], 0x825e7a66
mov dword [ebp - 0x2dc], 0xfffffff8
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x5c], 0
jmp 0x1001b5e6
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x1001b5fc
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x2f4], 5
jmp 0x1001b5df
push 0x783a
push 0x2fc2
push 0
push 0x113e
lea eax, [ebp - 0x48]
push eax
push 1
call fcn.10015b00
add esp, 0x18
mov dword [ebp - 0x48], 0
jmp 0x1001b62b
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x17
jg 0x1001b65a
mov dword [ebp - 0x1ac], 1
push 0
push 0x6949
push 1
lea eax, [ebp - 0x1ac]
push eax
push 0x6682
call fcn.10017021
add esp, 0x14
jmp 0x1001b624
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
push 8
pop ecx
shl ecx, 0
lea eax, [eax + ecx + 0x78]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x278], 0x13dce9d0
mov dword [ebp - 0x274], 0x13dce9d0
mov dword [ebp - 0x270], 0x13dce9d0
mov dword [ebp - 0x26c], 0x13dce9d0
mov dword [ebp - 0x110], 0x160cbeb9
mov dword [ebp - 0x218], 0xffffffff
push 0x3538
push 0x30e2
push 0
call fcn.100219c6
add esp, 0xc
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x278], 0
jne 0x1001b6db
mov dword [ebp - 0x118], 1
jmp 0x1001b6e2
and dword [ebp - 0x118], 0
mov dword [ebp - 0x110], 0x141a9c21
cmp dword [ebp - 0x110], 1
je 0x1001b701
mov dword [ebp - 0xc8], 1
jmp 0x1001b708
and dword [ebp - 0xc8], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x278]
cmp dword [ebp - 0xc8], eax
jge 0x1001b729
mov dword [ebp - 0x138], 1
jmp 0x1001b730
and dword [ebp - 0x138], 0
cmp dword [ebp - 0x138], 6
jbe 0x1001b745
mov dword [ebp - 0xd0], 1
jmp 0x1001b74c
and dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0xd0]
shl eax, 2
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x278]
jge 0x1001b770
mov dword [ebp - 0xd8], 1
jmp 0x1001b777
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0xd8]
jle 0x1001b791
mov dword [ebp - 0x158], 1
jmp 0x1001b798
and dword [ebp - 0x158], 0
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x120]
cmp dword [eax + 4], 0
jbe 0x1001c597
mov dword [ebp - 0x220], 1
mov dword [ebp - 0x1bc], 0x22e974a5
mov dword [ebp - 0xe0], 0x5bc42206
mov dword [ebp - 0x1b4], 0xfffffffc
push 3
lea ecx, [ebp - 0x2b0]
call fcn.1000e524
mov dword [ebp - 4], 3
push 1
push 0x34b9
push 0xcd0
push 0x3481
push 0x7a64
push 1
lea eax, [ebp - 0x2b8]
push eax
push 0x3665
lea eax, [ebp - 0x2b0]
push eax
call fcn.100130f7
add esp, 0x24
lea eax, [ebp - 0x1b4]
push eax
lea eax, [ebp - 0xe0]
push eax
push 1
lea eax, [ebp - 0x220]
push eax
push 0x3fa7
push 0
lea eax, [ebp - 0x1bc]
push eax
call fcn.10018d67
add esp, 0x1c
push 0x172
push 0
push 0x2c2e
push 1
push 0x1e8a
push 0x2f63
lea eax, [ebp - 0xe0]
push eax
push 0x1b72
lea eax, [ebp - 0x2b0]
push eax
push 0x726a
push 0x24f9
push 0xb74
push 0
push 0x57f5
call fcn.10023b70
add esp, 0x38
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2b0]
call fcn.1000e5a6
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x68]
add ecx, dword [eax]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x98], 0x507e6732
mov dword [ebp - 0x140], 0xfffffffa
mov dword [ebp - 0x128], 0x1362395e
mov dword [ebp - 0x19c], 0xfffffffa
mov dword [ebp - 0x20], 0
jmp 0x1001b8ee
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1001b904
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x18c], 0xfffffffc
jmp 0x1001b8e7
mov dword [ebp - 0x20], 0
jmp 0x1001b914
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1001b92a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x228], 0x2006887e
jmp 0x1001b90d
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x18c], 0
je 0x1001ba6e
push 4
pop eax
shl eax, 0
xor ecx, ecx
inc ecx
sub ecx, dword [ebp + eax - 0x18c]
push 4
pop eax
shl eax, 1
imul ecx, dword [ebp + eax - 0x18c]
push 4
pop eax
shl eax, 1
cmp ecx, dword [ebp + eax - 0x18c]
je 0x1001b974
mov dword [ebp - 0xe8], 1
jmp 0x1001b97b
and dword [ebp - 0xe8], 0
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
je 0x1001b9a0
xor eax, eax
je 0x1001b9a0
mov dword [ebp - 0xf0], 1
jmp 0x1001b9a7
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0x48dc
jge 0x1001b9cb
mov dword [ebp - 0xf8], 1
jmp 0x1001b9d2
and dword [ebp - 0xf8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x18c]
cmp dword [ebp - 0xf8], eax
jle 0x1001b9f3
mov dword [ebp - 0x90], 1
jmp 0x1001b9fa
and dword [ebp - 0x90], 0
mov dword [ebp - 0x98], 0x1a07
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x94], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x94]
mov dword [ebp + eax - 0x228], ecx
mov eax, dword [ebp - 0x94]
imul eax, dword [ebp - 0x90]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x18c]
sub ecx, eax
cmp ecx, 0xffffffff
jae 0x1001ba4f
mov dword [ebp - 0xac], 1
jmp 0x1001ba56
and dword [ebp - 0xac], 0
cmp dword [ebp - 0xac], 0x7806
jne 0x1001ba6e
mov dword [ebp - 0xb4], 1
jmp 0x1001ba75
and dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x19c], eax
jmp 0x1001ba8c
mov eax, dword [ebp - 0x38]
add eax, 0x14
mov dword [ebp - 0x38], eax
push dword [ebp - 0x38]
call fcn.10011ffa
pop ecx
movzx eax, al
test eax, eax
jne 0x1001c597
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0xc], 0
je 0x1001c597
push 2
lea ecx, [ebp - 0x198]
call fcn.1000e524
mov dword [ebp - 4], 4
mov dword [ebp - 0x3c], 0xbf390197
mov dword [ebp - 0x1cc], 0x52f34111
mov dword [ebp - 0x230], 0x6c65b0b5
lea eax, [ebp - 0x198]
push eax
push 1
push 0x4eb6
lea eax, [ebp - 0x2c0]
push eax
push 1
call fcn.10013203
add esp, 0x14
push 0
lea ecx, [ebp - 0x198]
call fcn.1000e5c2
mov dword [eax], 0xfffffffa
jmp 0x1001bb34
push 0
lea ecx, [ebp - 0x198]
call fcn.1000e5c2
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xbc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x198]
call fcn.1000e5c2
cmp dword [eax], 0xfffffff8
jg 0x1001bb9b
push 0
call fcn.1002151b
pop ecx
mov byte [ebp - 0x2a], 0
push 0x7630
push 1
push 0x2c1b
lea eax, [ebp - 0x2a]
push eax
push 0x5bb1
push 0x95e
push 0x429a
push 0x3cc7
push 0
push 1
push 0x2efb
push 0x5c0d
push 0x1470
push 0x6713
call fcn.1002222b
add esp, 0x38
jmp 0x1001bb10
mov dword [ebp - 0x3c], 0
jmp 0x1001bbab
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jg 0x1001bc24
mov dword [ebp - 0x240], 0xffffffff
mov dword [ebp - 0x238], 0xffffffff
mov dword [ebp - 0x1e8], 0
lea eax, [ebp - 0x230]
push eax
push 0x476b
push 1
push 0x7f9a
push 0x14c7
push 0
lea eax, [ebp - 0x1cc]
push eax
lea eax, [ebp - 0x198]
push eax
push 0x5ba0
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x240]
push eax
push 0x5c13
lea eax, [ebp - 0x1e8]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.1001748d
add esp, 0x38
jmp 0x1001bba4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x198]
call fcn.1000e5a6
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x68]
add ecx, dword [eax + 0xc]
push ecx
push 0xe0e
push 0x9ef
call fcn.1003eeee
pop ecx
pop ecx
call eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x2c8], 0
mov byte [ebp - 0x29], 0
movzx eax, byte [ebp - 0x29]
test eax, eax
je 0x1001bc77
push 0x1f66
call dword [sym.imp.USER32.dll_GetKeyState]
push 1
push 0x25d0
push 1
push 0x1dc2
call fcn.100132d0
add esp, 0x10
cmp dword [ebp - 0x88], 0
jne 0x1001c1e2
mov dword [ebp - 0x1d8], 0x5b9b55bb
mov dword [ebp - 0x70], 0
jmp 0x1001bcb4
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x1001bcca
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x340], 0
jmp 0x1001bcad
push 0x76a0
push 0x1c08
push 0x6a28
lea eax, [ebp - 0x1d8]
push eax
push 1
push 1
push 0x3bc9
push 0x5f0
push 1
call fcn.10013a46
add esp, 0x24
push 0x39a5
push 0x1e5f
push 0x7e60
push 0x4d2a
push 0
push 1
lea eax, [ebp - 0x44]
push eax
push 0x13cd
push 0x480f
push 0x2c55
push 0x1a28
push 0x3156
push 0x712
call fcn.1001564b
add esp, 0x34
mov dword [ebp - 0x14], 0x81c2900
push 1
lea ecx, [ebp - 0x168]
call fcn.1000e524
mov dword [ebp - 4], 5
mov dword [ebp - 0x6c], 0xc7a2
mov dword [ebp - 0x2d0], 0x82c5a4ec
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x11c], 0xebeb
mov dword [ebp - 0x24], 0
jmp 0x1001bd87
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1001bd9d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x180], 0x3b91
jmp 0x1001bd80
mov dword [ebp - 0x24], 0
jmp 0x1001bdad
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1001bdc9
push dword [ebp - 0x24]
lea ecx, [ebp - 0x168]
call fcn.1000e5c2
mov dword [eax], 0x5dd7582b
jmp 0x1001bda6
mov dword [ebp - 0x14], 0
jmp 0x1001bdd9
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jg 0x1001c0a6
push 3
lea ecx, [ebp - 0x1e4]
call fcn.1000e524
mov byte [ebp - 4], 6
mov dword [ebp - 0x264], 0xfffffffb
mov dword [ebp - 0x34], 0
push 0x5237
push 0x2408
lea eax, [ebp - 0x2f0]
push eax
push 0
lea eax, [ebp - 0x1e4]
push eax
call fcn.1001d388
add esp, 0x14
cmp dword [ebp - 0x14], 0
jne 0x1001be3d
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x1001be3d
and dword [ebp - 0xc4], 0
jmp 0x1001be47
mov dword [ebp - 0xc4], 1
push 1
lea ecx, [ebp - 0x1e4]
call fcn.1000e5c2
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc4]
lea eax, [eax + ecx - 4]
test eax, eax
je 0x1001c035
mov dword [ebp - 0x50], 0x7030fc35
mov dword [ebp - 0x22c], 0x35fe57b6
mov dword [ebp - 0x64], 0
jmp 0x1001be89
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x1001be9f
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x334], 0x30b9
jmp 0x1001be82
mov byte [ebp - 0x2b], 0
movzx eax, byte [ebp - 0x2b]
test eax, eax
je 0x1001bec1
push 0x2f16
push 0
push 0x1e1f
push 0
call fcn.10023f55
add esp, 0x10
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x180]
imul eax, dword [ebp - 0x264]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x180]
jle 0x1001bef0
mov dword [ebp - 0xf4], 1
jmp 0x1001bef7
and dword [ebp - 0xf4], 0
mov dword [ebp - 0x34], 0x335c
mov esi, dword [ebp - 0x34]
push 0
lea ecx, [ebp - 0x168]
call fcn.1000e5c2
cmp esi, dword [eax]
je 0x1001bf1e
mov dword [ebp - 0xcc], 1
jmp 0x1001bf25
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x180]
imul eax, dword [ebp - 0xcc]
cmp eax, 0x4cd021a
jge 0x1001bf49
mov dword [ebp - 0xd4], 1
jmp 0x1001bf50
and dword [ebp - 0xd4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xd4], eax
jl 0x1001bf67
mov dword [ebp - 0xdc], 1
jmp 0x1001bf6e
and dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x1001bf8f
cmp dword [ebp - 0x50], 0
je 0x1001bf8f
mov dword [ebp - 0xe4], 1
jmp 0x1001bf96
and dword [ebp - 0xe4], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xe4]
jle 0x1001bfb6
mov eax, 0xffff
test eax, eax
je 0x1001bfb6
mov dword [ebp - 0xec], 1
jmp 0x1001bfbd
and dword [ebp - 0xec], 0
push 1
lea ecx, [ebp - 0x1e4]
call fcn.1000e5c2
mov ecx, dword [ebp - 0xec]
cmp ecx, dword [eax]
je 0x1001bfe0
mov dword [ebp - 0x1ec], 1
jmp 0x1001bfe7
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x2fc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x334]
inc eax
imul eax, dword [ebp - 0xf4]
test eax, eax
jne 0x1001c01e
mov dword [ebp - 0xfc], 1
jmp 0x1001c025
and dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0xfc]
neg eax
mov dword [ebp - 0x22c], eax
jmp 0x1001c092
mov dword [ebp - 0x34], 2
jmp 0x1001c045
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1001c092
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1e4]
call fcn.1000e5c2
cmp dword [eax], 0
je 0x1001c060
jmp 0x1001c092
push 0x69ca
push 0x2505
lea eax, [ebp - 0x6c]
push eax
push 0x4e38
push 0x7df7
push 1
push 0x3b17
push 0x22e3
push 1
push 1
call fcn.10013c2e
add esp, 0x28
jmp 0x1001c03e
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1e4]
call fcn.1000e5a6
jmp 0x1001bdd2
cmp dword [ebp - 0x14], 0
je 0x1001c11f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x180]
mov dword [ebp - 0x2bc], eax
push 0
lea ecx, [ebp - 0x168]
call fcn.1000e5c2
mov esi, eax
push 4
pop eax
imul eax, eax, 0
mov edi, dword [ebp + eax - 0x180]
push 0
lea ecx, [ebp - 0x168]
call fcn.1000e5c2
add edi, dword [eax]
push 0
lea ecx, [ebp - 0x168]
call fcn.1000e5c2
imul edi, dword [eax]
add edi, dword [ebp - 0x14]
cmp dword [esi], edi
jle 0x1001c113
push 0
lea ecx, [ebp - 0x168]
call fcn.1000e5c2
cmp dword [eax], 0
je 0x1001c11f
mov dword [ebp - 0x104], 1
jmp 0x1001c126
and dword [ebp - 0x104], 0
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x104]
sub edx, dword [ebp + ecx - 0x180]
imul eax, edx
cmp eax, dword [ebp - 0x6c]
jne 0x1001c157
mov dword [ebp - 0x10c], 1
jmp 0x1001c15e
and dword [ebp - 0x10c], 0
cmp dword [ebp - 0x10c], 0x3c82
jge 0x1001c176
mov dword [ebp - 0x114], 1
jmp 0x1001c17d
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x11c], eax
jne 0x1001c1a0
mov dword [ebp - 0x124], 1
jmp 0x1001c1a7
and dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x124]
jg 0x1001c1be
mov dword [ebp - 0x12c], 1
jmp 0x1001c1c5
and dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x14], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x168]
call fcn.1000e5a6
jmp 0x1001c597
mov dword [ebp - 0x58], 0x4cd45360
mov dword [ebp - 0x1f4], 1
mov dword [ebp - 0x24c], 0xfffffff6
mov dword [ebp - 0x1fc], 0x7563ffa
mov dword [ebp - 0x54], 0
jmp 0x1001c217
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x1001c22d
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x324], 0xffff
jmp 0x1001c210
mov dword [ebp - 0x58], 1
jmp 0x1001c23d
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x1001c2ad
mov dword [ebp - 0x134], 0xa9831117
push 0x24ca
push 1
push 0x1003
push 0
push 0x4e44
lea eax, [ebp - 0x134]
push eax
call fcn.10018372
add esp, 0x18
push 0x2b6b
push 0x1a82
push 1
push 0x2cad
lea eax, [ebp - 0x134]
push eax
push 0x3ea8
lea eax, [ebp - 0x1f4]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x1fc]
push eax
push 1
call fcn.1001348e
add esp, 0x28
jmp 0x1001c236
push 1
push 0x16f8
push 1
push 0x78e8
push 0
push 0x204f
lea eax, [ebp - 0x40]
push eax
push 0x2ad5
call fcn.10019375
add esp, 0x20
mov dword [ebp - 0x2ec], 0x648261f9
push 0x6d0b
push 0
push 0x62ee
push 0xe06
call fcn.1002514a
add esp, 0x10
mov byte [ebp - 0x2e], 0
push 0x1c9f
push 1
push 0x28b1
push 0x57c9
push 0x548d
lea eax, [ebp - 0x2e]
push eax
push 0x3f1d
push 0x6602
push 0
push 0x1a97
push 0x2752
call fcn.1001853a
add esp, 0x2c
mov eax, dword [ebp - 0x40]
cmp dword [eax + 8], 0
jne 0x1001c52f
push 0x4041
push 0x1fd2
lea eax, [ebp - 0x44]
push eax
push 1
push 1
call fcn.10013f10
add esp, 0x14
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x80], 8
mov byte [ebp - 0x2d], 0
lea eax, [ebp - 0x2d]
push eax
push 0x6c39
push 0x2352
push 1
push 1
call fcn.10013fa6
add esp, 0x14
mov dword [ebp - 0x18], 0xfffffff9
jmp 0x1001c395
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x16
jne 0x1001c52d
mov dword [ebp - 0x2a4], 0xfffffff7
mov dword [ebp - 0x2a0], 0xfffffff7
mov dword [ebp - 0x29c], 0xfffffff7
mov dword [ebp - 0x298], 0xfffffff7
lea ecx, [ebp - 0x81]
call fcn.1000e5d1
push eax
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0x31c]
call fcn.1000e5d4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2e8]
call fcn.1000e580
mov dword [ebp - 4], 7
mov dword [ebp - 0x60], 0
jmp 0x1001c413
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x1001c426
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x7c], 0xded6
jmp 0x1001c40c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7c], 0
jne 0x1001c443
mov eax, dword [ebp - 0x18]
neg eax
jne 0x1001c443
and dword [ebp - 0x13c], 0
jmp 0x1001c44d
mov dword [ebp - 0x13c], 1
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x80], eax
je 0x1001c46a
mov dword [ebp - 0x234], 1
jmp 0x1001c471
and dword [ebp - 0x234], 0
cmp dword [ebp - 0x18], 0xc430
je 0x1001c499
cmp dword [ebp - 0x18], 0
je 0x1001c499
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7c], 0
je 0x1001c499
mov dword [ebp - 0x204], 1
jmp 0x1001c4a0
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2d4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x18], eax
je 0x1001c4d6
mov dword [ebp - 0x8c], 1
jmp 0x1001c4dd
and dword [ebp - 0x8c], 0
push 2
lea ecx, [ebp - 0x2e8]
call fcn.1000e5c2
mov ecx, dword [ebp - 0x8c]
mov dword [eax], ecx
push 0x37aa
push 0x3063
push 0x41b9
push 0x6174
push 1
push 1
push 0x4c18
push 1
call fcn.10014248
add esp, 0x20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2e8]
call fcn.1000e5a6
jmp 0x1001c38e
jmp 0x1001c597
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x68]
push dword [ebp - 0x38]
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x40]
call fcn.100122b8
add esp, 0x18
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x68]
lea eax, [ebp - 0x88]
push eax
call fcn.10012a11
add esp, 0x14
cmp dword [ebp - 0x44], 0
jne 0x1001c592
push 0
push 0x1663
push 1
call fcn.10016c30
add esp, 0xc
jmp 0x1001c597
jmp 0x1001ba83
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 0x44]
mov dword [eax], ecx
jmp 0x1001c737
jmp 0x1001c737
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x254], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1b0], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x214]
movzx eax, byte [eax]
test eax, eax
je 0x1001c6d7
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x14c]
mov dword [ecx], eax
push 0
mov ecx, dword [ebp - 0x200]
call fcn.1000e5c2
mov eax, dword [eax]
add eax, 6
je 0x1001c696
mov eax, 0xfecf7921
test eax, eax
je 0x1001c696
mov dword [ebp - 0x154], 1
jmp 0x1001c69d
and dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x208]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x154]
jl 0x1001c6b9
mov dword [ebp - 0x15c], 1
jmp 0x1001c6c0
and dword [ebp - 0x15c], 0
push 0
mov ecx, dword [ebp - 0x1a0]
call fcn.1000e5c2
mov ecx, dword [ebp - 0x15c]
mov dword [eax], ecx
jmp 0x1001c737
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x4c]
mov dword [eax], 0
jmp 0x1001c71a
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x4c]
cmp dword [eax], 3
jge 0x1001c737
mov eax, dword [ebp - 0x4c]
push dword [eax]
mov ecx, dword [ebp - 0x1c8]
call fcn.1000e5c2
and dword [eax], 0
jmp 0x1001c70f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret