Function at 0x1003846e
Capabilities:
Check os version
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061f87
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x17dc
call fcn.1005d890
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x10038821
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xfd0], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xeec], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xd94], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xd8c], eax
mov eax, dword [ebp - 0xeec]
movzx eax, byte [eax]
test eax, eax
je 0x1003869a
mov eax, dword [ebp - 0xd8c]
mov dword [ebp - 0xd9c], eax
mov eax, dword [ebp - 0xd94]
mov dword [ebp - 0xda4], eax
mov eax, dword [ebp - 0xd9c]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0xda4]
mov dword [ebp - 0xfc0], eax
mov dword [ebp - 0x738], 0x2c87
mov dword [ebp - 0xfc8], 0x1000ae8c
cmp dword [ebp - 0x738], 0x2e56
jle 0x1003860d
and dword [ebp - 0x32c], 0
jmp 0x10038542
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0x1ccc
jge 0x10038607
and dword [ebp - 0x204], 0
jmp 0x10038568
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0x4256
jge 0x10038602
and dword [ebp - 0x424], 0
jmp 0x1003858e
mov eax, dword [ebp - 0x424]
inc eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0x2ea8
jge 0x100385fd
and dword [ebp - 0x20c], 0
jmp 0x100385b0
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0x12d3
jge 0x100385fb
mov ecx, dword [ebp - 0x204]
sub ecx, dword [ebp - 0x424]
sub ecx, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x32c]
sar eax, cl
cdq
mov dword [ebp - 0xdb0], eax
mov dword [ebp - 0xdac], edx
push dword [ebp - 0xdac]
push dword [ebp - 0xdb0]
mov ecx, 0x10609cb8
call fcn.1000fe1e
jmp 0x100385a3
jmp 0x10038581
jmp 0x1003855b
jmp 0x10038535
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov eax, dword [ebp - 0x1a4]
mov dword [eax], 0
jmp 0x1003862c
mov eax, dword [ebp - 0x1a4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1a4]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1a4]
cmp dword [eax], 3
jge 0x1003864f
mov eax, dword [ebp - 0x1a4]
push dword [eax]
mov ecx, dword [ebp - 0xfc0]
call fcn.1000ffd1
or dword [eax], 0xffffffff
jmp 0x1003861b
and dword [ebp - 4], 0
cmp dword [ebp - 0x738], 0x29e6
jge 0x1003866f
mov edx, dword [ebp - 0xfc8]
mov ecx, 0x10609cb8
call fcn.100118c8
jmp 0x1003868b
or dword [ebp - 4], 0xffffffff
jmp 0x10038695
jmp 0x1003881c
mov eax, dword [ebp - 0xfd0]
mov dword [ebp - 0xfd8], eax
mov eax, dword [ebp - 0xfd8]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
mov dword [eax], 0
jmp 0x100386d1
mov eax, dword [ebp - 0x214]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x214]
mov dword [ecx], eax
mov eax, dword [ebp - 0x214]
cmp dword [eax], 0
jg 0x1003881c
mov dword [ebp - 0xb64], 0x683c
mov dword [ebp - 0xfe8], 0x1000aec0
cmp dword [ebp - 0xb64], 0x6917
jle 0x100387b2
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
and dword [ebp - 0x3bc], 0
jmp 0x10038722
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 0x1762
jge 0x100387b2
and dword [ebp - 0x21c], 0
jmp 0x10038748
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0x4d8b
jge 0x100387ad
mov eax, dword [ebp - 0x3bc]
mov ecx, dword [ebp - 0x21c]
shl eax, cl
cdq
mov dword [ebp - 0xdbc], eax
mov dword [ebp - 0xdb8], edx
push dword [ebp - 0xdb8]
push dword [ebp - 0xdbc]
lea ecx, [ebp - 0x166c]
call fcn.1000d1e0
pop ecx
pop ecx
mov dword [ebp - 0xfe0], eax
mov ecx, dword [ebp - 0xfe0]
call fcn.1000fdfe
push eax
call fcn.1004bc16
pop ecx
lea ecx, [ebp - 0x166c]
call fcn.1000fdf4
jmp 0x1003873b
jmp 0x10038715
mov byte [ebp - 0x10b], 0
mov dword [ebp - 4], 2
cmp dword [ebp - 0xb64], 0x645e
jge 0x100387d8
push dword [ebp - 0xfe8]
call fcn.1004bc16
pop ecx
jmp 0x100387f4
or dword [ebp - 4], 0xffffffff
jmp 0x100387fe
movzx eax, byte [ebp - 0x10b]
test eax, eax
je 0x10038817
push 0
push 0x6d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
jmp 0x100386c0
jmp 0x10042c21
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1000], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1008], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xff8], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1010], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0xff0], eax
mov eax, dword [ebp - 0xff0]
movzx eax, byte [eax]
test eax, eax
je 0x10042c19
mov eax, dword [ebp - 0xff8]
mov dword [ebp - 0x106c], eax
mov eax, dword [ebp - 0x1000]
mov dword [ebp - 0xc3c], eax
mov eax, dword [ebp - 0x1008]
mov dword [ebp - 0xb54], eax
mov eax, dword [ebp - 0x1010]
mov dword [ebp - 0x4f8], eax
mov dword [ebp - 0x1c], 0x8748
mov dword [ebp - 0xc4], 5
push 2
lea ecx, [ebp - 0x548]
call fcn.1000ff33
mov dword [ebp - 4], 4
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0xa50], 0xb5e35254
mov dword [ebp - 0x334], 0
jmp 0x100388de
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 2
jge 0x10038900
push dword [ebp - 0x334]
lea ecx, [ebp - 0x548]
call fcn.1000ffd1
mov dword [eax], 0xfd03b15a
jmp 0x100388d1
cmp dword [ebp - 0x1c], 0
je 0x10038a06
xor eax, eax
jne 0x1003891d
cmp dword [ebp - 0x1c], 0
jne 0x1003891d
and dword [ebp - 0x4e4], 0
jmp 0x10038927
mov dword [ebp - 0x4e4], 1
mov dword [ebp - 0xc4], 0xc18ab9c2
push 0
lea ecx, [ebp - 0x548]
call fcn.1000ffd1
mov ecx, dword [ebp - 0x4e4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x4e4]
je 0x10038964
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x10038964
and dword [ebp - 0xba4], 0
jmp 0x1003896e
mov dword [ebp - 0xba4], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xba4], eax
jne 0x10038985
mov dword [ebp - 0xbac], 1
jmp 0x1003898c
and dword [ebp - 0xbac], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xbac], eax
jl 0x100389a3
mov dword [ebp - 0xbb4], 1
jmp 0x100389aa
and dword [ebp - 0xbb4], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xbb4]
je 0x100389c7
cmp dword [ebp - 0x1c], 0
je 0x100389c7
mov dword [ebp - 0xbbc], 1
jmp 0x100389ce
and dword [ebp - 0xbbc], 0
mov eax, dword [ebp - 0xbbc]
sub eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jne 0x100389e8
mov dword [ebp - 0xbc4], 1
jmp 0x100389ef
and dword [ebp - 0xbc4], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xbc4]
jne 0x10038a06
mov dword [ebp - 0x8a0], 1
jmp 0x10038a0d
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x8a0]
sub eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
test eax, eax
je 0x10038a2b
push 0
lea ecx, [ebp - 0x548]
call fcn.1000ffd1
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x54]
jl 0x10038a42
cmp dword [ebp - 0x54], 0
jne 0x10038a42
and dword [ebp - 0xb5c], 0
jmp 0x10038a4c
mov dword [ebp - 0xb5c], 1
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0xb5c]
imul eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x1c]
cmp eax, 1
ja 0x10038a6e
mov dword [ebp - 0x564], 1
jmp 0x10038a75
and dword [ebp - 0x564], 0
cmp dword [ebp - 0x564], 0xfb6f85a0
jae 0x10038a8e
push 0
lea ecx, [ebp - 0x548]
call fcn.1000ffd1
mov eax, 0x8acc167d
test eax, eax
je 0x10038f51
mov dword [ebp - 0x404], 0x8ae0512e
mov dword [ebp - 0x464], 5
mov dword [ebp - 0x4bc], 0xffffffff
mov dword [ebp - 0xd84], 4
mov dword [ebp - 0x1360], 0xdc67586e
mov dword [ebp - 0x5a4], 0xffffffff
mov dword [ebp - 0x22c], 0x8d320cd5
mov dword [ebp - 0x7c], 0
jmp 0x10038af1
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x10038b07
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x12b4], 0
jmp 0x10038aea
mov dword [ebp - 0x7c], 0
jmp 0x10038b17
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x10038b2d
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x15e0], 0xfffffffb
jmp 0x10038b10
mov dword [ebp - 0x54], 5
jmp 0x10038b3d
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xffffffe3
jge 0x10038cc8
mov dword [ebp - 0x89c], 0xffffffff
mov dword [ebp - 0x224], 0
jmp 0x10038b6a
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 3
jge 0x10038b86
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0x15bc], 0xfffffffa
jmp 0x10038b5d
mov dword [ebp - 0x89c], 0xffffffff
mov esi, dword [ebp - 0x89c]
neg esi
push 0
lea ecx, [ebp - 0x548]
call fcn.1000ffd1
cmp esi, dword [eax]
jg 0x10038bb5
mov dword [ebp - 0x56c], 1
jmp 0x10038bbc
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x56c]
jle 0x10038bd3
mov dword [ebp - 0x8a8], 1
jmp 0x10038bda
and dword [ebp - 0x8a8], 0
cmp dword [ebp - 0x404], 0
je 0x10038bf4
xor eax, eax
inc eax
je 0x10038bf4
mov dword [ebp - 0xb08], 1
jmp 0x10038bfb
and dword [ebp - 0xb08], 0
mov eax, dword [ebp - 0xb08]
sub eax, 0xcede
cmp eax, 0x6b93dced
jge 0x10038c19
mov dword [ebp - 0x574], 1
jmp 0x10038c20
and dword [ebp - 0x574], 0
imul eax, dword [ebp - 0x574], 0x2de4
cmp eax, 0xf8f0b53c
je 0x10038c3d
mov dword [ebp - 0x57c], 1
jmp 0x10038c44
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x8a8]
cmp eax, dword [ebp - 0x57c]
jl 0x10038c5e
mov dword [ebp - 0xa40], 1
jmp 0x10038c65
and dword [ebp - 0xa40], 0
push 0
lea ecx, [ebp - 0x548]
call fcn.1000ffd1
mov ecx, dword [ebp - 0xa40]
cmp ecx, dword [eax]
jg 0x10038c88
mov dword [ebp - 0x584], 1
jmp 0x10038c8f
and dword [ebp - 0x584], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x15bc]
cmp dword [ebp - 0x584], eax
jle 0x10038cb0
mov dword [ebp - 0x8b0], 1
jmp 0x10038cb7
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0x464], eax
jmp 0x10038b36
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x1474], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1078], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x105c], eax
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x1078]
cmp eax, dword [ebp - 0x105c]
jne 0x10038d10
mov dword [ebp - 0x58c], 1
jmp 0x10038d17
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x58c]
add eax, 0x503ecef3
je 0x10038d30
mov dword [ebp - 0xb74], 1
jmp 0x10038d37
and dword [ebp - 0xb74], 0
cmp dword [ebp - 0xb74], 0xffffffff
je 0x10038d4c
mov dword [ebp - 0x594], 1
jmp 0x10038d53
and dword [ebp - 0x594], 0
cmp dword [ebp - 0x594], 0xfffffff7
jge 0x10038d68
mov dword [ebp - 0x8b8], 1
jmp 0x10038d6f
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0xc4]
add eax, dword [ebp - 0x8b8]
je 0x10038d90
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x10038d90
mov dword [ebp - 0x59c], 1
jmp 0x10038d97
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x404]
cmp dword [ebp - 0x59c], eax
jne 0x10038db1
mov dword [ebp - 0xa48], 1
jmp 0x10038db8
and dword [ebp - 0xa48], 0
mov eax, dword [ebp - 0xd84]
cmp dword [ebp - 0xa48], eax
jne 0x10038dd2
mov dword [ebp - 0xc30], 1
jmp 0x10038dd9
and dword [ebp - 0xc30], 0
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x136c], eax
mov eax, dword [ebp - 0x5a4]
sub eax, 0x38e4a6a7
imul eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x464], eax
push 0
lea ecx, [ebp - 0x548]
call fcn.1000ffd1
cmp dword [eax], 0xffffffff
jne 0x10038e1b
mov dword [ebp - 0x8c0], 1
jmp 0x10038e22
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x404]
cmp dword [ebp - 0x8c0], eax
jl 0x10038e3c
mov dword [ebp - 0x5ac], 1
jmp 0x10038e43
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x5ac], eax
jne 0x10038e5a
mov dword [ebp - 0xb10], 1
jmp 0x10038e61
and dword [ebp - 0xb10], 0
mov eax, dword [ebp - 0xa50]
cmp dword [ebp - 0xb10], eax
jle 0x10038e7b
mov dword [ebp - 0x5b4], 1
jmp 0x10038e82
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x5b4]
sub eax, 0xe796
cmp eax, dword [ebp - 0x4bc]
jge 0x10038ea1
mov dword [ebp - 0xea4], 1
jmp 0x10038ea8
and dword [ebp - 0xea4], 0
push 0
lea ecx, [ebp - 0x548]
call fcn.1000ffd1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x15e0], 0
je 0x10038ed5
xor eax, eax
je 0x10038ed5
mov dword [ebp - 0x8c8], 1
jmp 0x10038edc
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x404]
cmp dword [ebp - 0x8c8], eax
jl 0x10038ef6
mov dword [ebp - 0x5bc], 1
jmp 0x10038efd
and dword [ebp - 0x5bc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x12b4]
cmp eax, dword [ebp - 0x5bc]
je 0x10038f27
cmp dword [ebp - 0x4bc], 0
je 0x10038f27
mov dword [ebp - 0xc38], 1
jmp 0x10038f2e
and dword [ebp - 0xc38], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x157c], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x1374], eax
mov eax, dword [ebp - 0xa50]
mov dword [ebp - 0x54], eax
jmp 0x10038f70
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x10038f70
push 0x21f0
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov dword [ebp - 0xc4], 1
jmp 0x10038f89
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jl 0x10038fae
mov byte [ebp - 0x132], 0
movzx eax, byte [ebp - 0x132]
test eax, eax
je 0x10038fac
push 0
call fcn.1002e266
pop ecx
jmp 0x10038f7c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x548]
call fcn.1000ffb5
mov dword [ebp - 0x38], 5
mov dword [ebp - 0xb84], 1
mov dword [ebp - 0xf58], 0x7f4a7d2a
mov dword [ebp - 0xeb0], 0xc0ec0dce
mov dword [ebp - 0x33c], 0
jmp 0x10038ffb
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 3
jge 0x10039017
mov eax, dword [ebp - 0x33c]
mov dword [ebp + eax*4 - 0x11e8], 1
jmp 0x10038fee
mov dword [ebp - 0x38], 2
jmp 0x10039027
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1003907b
mov byte [ebp - 0xd9], 0
push 0x4429
push 0x2690
lea eax, [ebp - 0xd9]
push eax
push 0x5d7
push 0x2ca2
push 1
push 0x707d
push 0x10be
push 0x45b
push 0x1317
push 0
push 0x214c
push 0x1507
call fcn.1002a7fc
add esp, 0x34
jmp 0x10039020
mov dword [ebp - 0x38], 2
jmp 0x1003908b
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x10039208
mov dword [ebp - 0x120], 0xc34eea2a
mov dword [ebp - 0x8d8], 0xfeae2151
mov dword [ebp - 0xa58], 0xfffffffc
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x1484], eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x120]
je 0x100390df
cmp dword [ebp - 0x120], 0
je 0x100390df
mov dword [ebp - 0x5c4], 1
jmp 0x100390e6
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x5c4]
jl 0x10039100
mov dword [ebp - 0x8d0], 1
jmp 0x10039107
and dword [ebp - 0x8d0], 0
cmp dword [ebp - 0x8d0], 0x3847
jge 0x1003911f
mov dword [ebp - 0x5cc], 1
jmp 0x10039126
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb84]
sub eax, 0x86f2
imul eax, dword [ebp - 0x120]
test eax, eax
jne 0x10039163
cmp dword [ebp - 0x120], 0
jne 0x10039163
mov eax, 0x6548aab5
test eax, eax
jne 0x10039163
and dword [ebp - 0x5d4], 0
jmp 0x1003916d
mov dword [ebp - 0x5d4], 1
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x8d8], eax
mov eax, dword [ebp - 0x8d8]
cmp eax, dword [ebp - 0x38]
je 0x10039199
cmp dword [ebp - 0xf58], 0
je 0x10039199
mov dword [ebp - 0x5dc], 1
jmp 0x100391a0
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x137c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x11e8]
mov dword [ebp - 0xc40], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc40]
mov dword [ebp + eax*4 - 0x11e8], ecx
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0xa58], eax
mov eax, dword [ebp - 0xa58]
mov dword [ebp - 0x1520], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1384], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11e8]
mov dword [ebp - 0xeb0], eax
jmp 0x10039084
mov dword [ebp - 0x18], 0x4c23afc3
mov dword [ebp - 0x46c], 1
mov dword [ebp - 0x1f0], 0xe5034859
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1494], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x138c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1564], eax
xor eax, eax
neg eax
cmp eax, 0x5e3b372b
je 0x10039255
mov dword [ebp - 0x5e4], 1
jmp 0x1003925c
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x5e4]
jle 0x10039273
mov dword [ebp - 0x8e0], 1
jmp 0x1003927a
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x8e0], eax
jge 0x10039291
mov dword [ebp - 0x5ec], 1
jmp 0x10039298
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x46c]
cmp eax, dword [ebp - 0x5ec]
jle 0x100392bb
mov dword [ebp - 0xb18], 1
jmp 0x100392c2
and dword [ebp - 0xb18], 0
mov eax, dword [ebp - 0xb18]
sub eax, dword [ebp - 0x18]
cmp eax, 6
jg 0x100392e2
mov eax, 0xe75
test eax, eax
jne 0x100392e2
and dword [ebp - 0x5f4], 0
jmp 0x100392ec
mov dword [ebp - 0x5f4], 1
imul eax, dword [ebp - 0x5f4], 0
test eax, eax
je 0x10039319
mov byte [ebp - 0x134], 0
lea eax, [ebp - 0x134]
push eax
push 0x5832
push 0
call fcn.100307ab
add esp, 0xc
jmp 0x1003948b
mov dword [ebp - 0xf60], 0x3b16aac8
mov dword [ebp - 0xc50], 1
mov dword [ebp - 0x8e8], 0x392b
mov dword [ebp - 0xc48], 0x1000af00
cmp dword [ebp - 0x8e8], 0x394c
jle 0x100393fb
and dword [ebp - 0x23c], 0
jmp 0x10039367
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0x2201
jge 0x100393fb
and dword [ebp - 0x234], 0
jmp 0x1003938d
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0x2b80
jge 0x100393f6
and dword [ebp - 0x3c4], 0
jmp 0x100393af
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 0x389c
jge 0x100393f4
mov eax, dword [ebp - 0x234]
mov ecx, dword [ebp - 0x3c4]
sar eax, cl
and eax, dword [ebp - 0x23c]
cdq
mov dword [ebp - 0xdc8], eax
mov dword [ebp - 0xdc4], edx
push dword [ebp - 0xdc4]
push dword [ebp - 0xdc8]
mov ecx, 0x10609cb8
call fcn.1000fe1e
jmp 0x100393a2
jmp 0x10039380
jmp 0x1003935a
mov dword [ebp - 0x18], 0
jmp 0x1003940b
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffffd
je 0x10039436
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x10039429
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
cmp dword [ebp - 0x1f0], 0
je 0x10039434
jmp 0x10039404
jmp 0x10039404
mov dword [ebp - 4], 5
cmp dword [ebp - 0x8e8], 0x355f
jge 0x10039459
mov edx, dword [ebp - 0xc48]
mov ecx, 0x10609cb8
call fcn.100118c8
jmp 0x10039475
or dword [ebp - 4], 0xffffffff
jmp 0x1003947f
mov eax, dword [ebp - 0xf60]
mov dword [ebp - 0xc50], eax
mov dword [ebp - 0x1f0], 0xfffffff1
jmp 0x100394a4
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0x2d
je 0x100395e3
mov dword [ebp - 0xf68], 0x5c5395f8
mov dword [ebp - 0xebc], 0xf3bc9f
mov dword [ebp - 0xc60], 0
mov dword [ebp - 0x18], 0
jmp 0x100394df
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffff1
jg 0x100395de
mov dword [ebp - 0xc68], 0x28ad
mov dword [ebp - 0x10ec], 1
mov dword [ebp - 0x10e8], 1
mov dword [ebp - 0x10e4], 1
mov dword [ebp - 0x10e0], 1
lea ecx, [ebp - 0x4fd]
call fcn.1000ffe0
push eax
lea eax, [ebp - 0x10dc]
push eax
lea eax, [ebp - 0x10ec]
push eax
lea ecx, [ebp - 0x163c]
call fcn.1000ffe3
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1440]
call fcn.1000ff8f
mov dword [ebp - 4], 7
mov dword [ebp - 0xc58], 0
mov dword [ebp - 0xec8], 0xc80d673
push 0
push 0x7044
lea eax, [ebp - 0x1440]
push eax
lea eax, [ebp - 0xebc]
push eax
lea eax, [ebp - 0xc58]
push eax
push 0x145f
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0xf68]
push eax
lea eax, [ebp - 0xc60]
push eax
lea eax, [ebp - 0xec8]
push eax
lea eax, [ebp - 0xc68]
push eax
push 0x3627
push 0x49d
push 0x16d6
lea eax, [ebp - 0x18]
push eax
call fcn.1002bda4
add esp, 0x3c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1440]
call fcn.1000ffb5
jmp 0x100394d8
jmp 0x10039497
mov dword [ebp - 0x20], 0x8748
mov dword [ebp - 0xc8], 5
mov dword [ebp - 0xf70], 0xffffffff
mov dword [ebp - 0xc70], 0xfffffff8
mov byte [ebp - 0x136], 0
movzx eax, byte [ebp - 0x136]
test eax, eax
je 0x1003962e
push 0
push 0x2571
push 0x2d49
call fcn.10033f08
add esp, 0xc
push 0
push 0x7d15
push 0x433f
lea eax, [ebp - 0xf70]
push eax
push 0x2232
push 0xdb2
push 0x3487
lea eax, [ebp - 0xc70]
push eax
push 0x1e56
call fcn.1002ba90
add esp, 0x24
push 2
lea ecx, [ebp - 0x554]
call fcn.1000ff33
mov dword [ebp - 4], 8
mov dword [ebp - 0x60], 0xffffffff
mov dword [ebp - 0x344], 0
jmp 0x10039698
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 2
jge 0x100396b4
mov eax, dword [ebp - 0x344]
mov dword [ebp + eax*4 - 0x10c8], 0x62fd
jmp 0x1003968b
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x100396e1
push 1
push 0
push 0x5b83
push 0x43d4
push 0xcf7
call fcn.1002adbb
add esp, 0x14
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x10c8]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x10c8], eax
mov dword [ebp - 0x86c], 0xb5e35254
mov dword [ebp - 0x5fc], 0x5b57
mov dword [ebp - 0xed4], 0x1000af38
cmp dword [ebp - 0x5fc], 0x5f2f
jle 0x100397ab
and dword [ebp - 0x244], 0
jmp 0x10039740
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0x10a0
jge 0x100397a3
and dword [ebp - 0x444], 0
jmp 0x10039762
mov eax, dword [ebp - 0x444]
inc eax
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 0x2774
jge 0x100397a1
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0x444]
sar eax, cl
cdq
mov dword [ebp - 0xdd4], eax
mov dword [ebp - 0xdd0], edx
push dword [ebp - 0xdd0]
push dword [ebp - 0xdd4]
mov ecx, 0x10609cb8
call fcn.1000fe1e
jmp 0x10039755
jmp 0x10039733
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov byte [ebp - 4], 9
cmp dword [ebp - 0x5fc], 0x5a1c
jge 0x100397cb
mov edx, dword [ebp - 0xed4]
mov ecx, 0x10609cb8
call fcn.100118c8
jmp 0x100397e7
mov dword [ebp - 4], 8
jmp 0x100397f7
mov dword [ebp - 0x474], 0xd06ce125
mov dword [ebp - 0x4fc], 0xfffffff7
mov dword [ebp - 0x60c], 9
mov dword [ebp - 0x1394], 0x2250db85
mov dword [ebp - 0xc78], 1
mov dword [ebp - 0xa4], 0
jmp 0x10039842
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 4
jge 0x1003985e
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x1538], 0x7be9fb1c
jmp 0x10039835
mov dword [ebp - 0xa4], 0
jmp 0x10039877
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jge 0x10039893
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x24c], 0x7be2d3d4
jmp 0x1003986a
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x4fc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x24c], eax
cmp dword [ebp - 0xc78], 0
je 0x10039911
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1538], 0x64d9
jge 0x100398ee
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24c], 0
jne 0x100398ee
and dword [ebp - 0xa60], 0
jmp 0x100398f8
mov dword [ebp - 0xa60], 1
mov eax, dword [ebp - 0xa60]
sub eax, 0xffff
je 0x10039911
mov dword [ebp - 0x604], 1
jmp 0x10039918
and dword [ebp - 0x604], 0
cmp dword [ebp - 0x604], 1
jle 0x1003993a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24c], 0
jne 0x1003993a
and dword [ebp - 0x8f0], 0
jmp 0x10039944
mov dword [ebp - 0x8f0], 1
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x60c], eax
mov eax, dword [ebp - 0x474]
imul eax, dword [ebp - 0x8f0]
cmp dword [ebp - 0x60c], eax
jge 0x1003997d
mov dword [ebp - 0xb80], 1
jmp 0x10039984
and dword [ebp - 0xb80], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb80]
neg ecx
cmp ecx, dword [ebp + eax - 0x1538]
jge 0x100399a7
mov dword [ebp - 0x614], 1
jmp 0x100399ae
and dword [ebp - 0x614], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x614]
mov dword [ebp + eax - 0x1538], ecx
push 0
push 0x21ff
lea eax, [ebp - 0x14a4]
push eax
push 1
push 0
lea eax, [ebp - 0x554]
push eax
push 0x4e18
push 0x3cce
call fcn.1003384b
add esp, 0x20
cmp dword [ebp - 0x20], 0
je 0x10039af2
xor eax, eax
jne 0x10039a09
cmp dword [ebp - 0x20], 0
jne 0x10039a09
and dword [ebp - 0x4c4], 0
jmp 0x10039a13
mov dword [ebp - 0x4c4], 1
mov dword [ebp - 0xc8], 0xc18ab9c2
push 0
lea ecx, [ebp - 0x554]
call fcn.1000ffd1
mov ecx, dword [ebp - 0x4c4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0x4c4]
je 0x10039a50
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x10039a50
and dword [ebp - 0x8f8], 0
jmp 0x10039a5a
mov dword [ebp - 0x8f8], 1
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x8f8], eax
jne 0x10039a71
mov dword [ebp - 0x61c], 1
jmp 0x10039a78
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x61c], eax
jl 0x10039a8f
mov dword [ebp - 0xa68], 1
jmp 0x10039a96
and dword [ebp - 0xa68], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xa68]
je 0x10039ab3
cmp dword [ebp - 0x20], 0
je 0x10039ab3
mov dword [ebp - 0x624], 1
jmp 0x10039aba
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x624]
sub eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jne 0x10039ad4
mov dword [ebp - 0x900], 1
jmp 0x10039adb
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x900]
jne 0x10039af2
mov dword [ebp - 0x62c], 1
jmp 0x10039af9
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x62c]
sub eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
test eax, eax
je 0x10039b17
push 0
lea ecx, [ebp - 0x554]
call fcn.1000ffd1
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x60]
jl 0x10039b2e
cmp dword [ebp - 0x60], 0
jne 0x10039b2e
and dword [ebp - 0xb20], 0
jmp 0x10039b38
mov dword [ebp - 0xb20], 1
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0xb20]
imul eax, dword [ebp - 0x60]
imul eax, dword [ebp - 0x20]
cmp eax, 1
ja 0x10039b5a
mov dword [ebp - 0x634], 1
jmp 0x10039b61
and dword [ebp - 0x634], 0
cmp dword [ebp - 0x634], 0xfb6f85a0
jae 0x10039b7a
push 0
lea ecx, [ebp - 0x554]
call fcn.1000ffd1
mov eax, 0x8acc167d
test eax, eax
je 0x1003d05a
mov dword [ebp - 0x1bc], 9
mov dword [ebp - 0xc88], 0x60edac7a
mov dword [ebp - 0x34c], 0
jmp 0x10039bb4
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 2
jge 0x10039bd0
mov eax, dword [ebp - 0x34c]
mov dword [ebp + eax*4 - 0xdec], 0x11c15747
jmp 0x10039ba7
mov dword [ebp - 0x1bc], 0xffffffe7
jmp 0x10039be9
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0xfffffff7
jge 0x1003a00b
mov dword [ebp - 0x1d4], 0
push 1
lea ecx, [ebp - 0x117c]
call fcn.1000ff33
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x254], 0
jmp 0x10039c2a
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 1
jge 0x10039c4c
push dword [ebp - 0x254]
lea ecx, [ebp - 0x117c]
call fcn.1000ffd1
mov dword [eax], 0xc1543f36
jmp 0x10039c1d
mov dword [ebp - 0x1d4], 0x17
jmp 0x10039c65
mov eax, dword [ebp - 0x1d4]
dec eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0xfffffff5
jl 0x10039ff7
mov dword [ebp - 0x184], 0xffffffff
mov dword [ebp - 0x18c], 0xc3cbaa6f
mov dword [ebp - 0x184], 0
jmp 0x10039c9f
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 1
jg 0x10039fd3
mov dword [ebp - 0x354], 0xfffffffd
mov dword [ebp - 0x908], 0x7796
mov dword [ebp - 0xc80], 0x1000afc0
cmp dword [ebp - 0x908], 0x780f
jle 0x10039db1
and dword [ebp - 0x3cc], 0
jmp 0x10039cf0
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0x7a57
jge 0x10039db1
and dword [ebp - 0x25c], 0
jmp 0x10039d16
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xee0
jge 0x10039dac
and dword [ebp - 0x1f4], 0
jmp 0x10039d3c
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0x5933
jge 0x10039da7
mov eax, dword [ebp - 0x3cc]
mov ecx, dword [ebp - 0x25c]
shl eax, cl
or eax, dword [ebp - 0x1f4]
cdq
mov dword [ebp - 0xde0], eax
mov dword [ebp - 0xddc], edx
push dword [ebp - 0xddc]
push dword [ebp - 0xde0]
lea ecx, [ebp - 0x1708]
call fcn.1000d1e0
pop ecx
pop ecx
mov dword [ebp - 0xf78], eax
mov ecx, dword [ebp - 0xf78]
call fcn.1000fdfe
push eax
call fcn.1004bc16
pop ecx
lea ecx, [ebp - 0x1708]
call fcn.1000fdf4
jmp 0x10039d2f
jmp 0x10039d09
jmp 0x10039ce3
mov dword [ebp - 0xb94], 0xd1532d49
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x908], 0x7665
jge 0x10039dd7
push dword [ebp - 0xc80]
call fcn.1004bc16
pop ecx
jmp 0x10039df3
mov dword [ebp - 4], 0xb
jmp 0x10039e03
mov dword [ebp - 0xc90], 9
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x139c], eax
cmp dword [ebp - 0x354], 4
jge 0x10039e2e
mov dword [ebp - 0x63c], 1
jmp 0x10039e35
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x354]
add eax, dword [ebp - 0x63c]
cmp eax, dword [ebp - 0x1d4]
jne 0x10039e62
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xdec], 0
jne 0x10039e62
and dword [ebp - 0xa70], 0
jmp 0x10039e6c
mov dword [ebp - 0xa70], 1
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0xa70], eax
jge 0x10039e86
mov dword [ebp - 0x644], 1
jmp 0x10039e8d
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x644]
sub eax, 6
jne 0x10039eaa
mov eax, 0x55126ed4
test eax, eax
jne 0x10039eaa
and dword [ebp - 0x910], 0
jmp 0x10039eb4
mov dword [ebp - 0x910], 1
cmp dword [ebp - 0x910], 0x25f3
jl 0x10039ecc
mov dword [ebp - 0x64c], 1
jmp 0x10039ed3
and dword [ebp - 0x64c], 0
cmp dword [ebp - 0x64c], 0xfffffffb
jbe 0x10039ee8
mov dword [ebp - 0xee0], 1
jmp 0x10039eef
and dword [ebp - 0xee0], 0
mov eax, dword [ebp - 0xc88]
mov dword [ebp - 0x14d8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xdec], 0
je 0x10039f20
cmp dword [ebp - 0x1bc], 0
je 0x10039f20
mov dword [ebp - 0x47c], 1
jmp 0x10039f27
and dword [ebp - 0x47c], 0
push 0
lea ecx, [ebp - 0x117c]
call fcn.1000ffd1
mov ecx, dword [ebp - 0x47c]
mov dword [eax], ecx
cmp dword [ebp - 0x47c], 0xfffffffd
jne 0x10039f51
mov dword [ebp - 0xf80], 1
jmp 0x10039f58
and dword [ebp - 0xf80], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdec]
add eax, dword [ebp - 0x354]
imul eax, dword [ebp - 0xb94]
add eax, 0x4ce3095f
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x18c], 0
jmp 0x10039f96
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 1
jg 0x10039fce
mov dword [ebp - 0xc24], 0xa6df
cmp dword [ebp - 0xc90], 0
je 0x10039fb4
jmp 0x10039fce
push 0
lea eax, [ebp - 0xb94]
push eax
lea eax, [ebp - 0xc24]
push eax
call fcn.10030dc5
add esp, 0xc
jmp 0x10039f89
jmp 0x10039c92
mov byte [ebp - 0x138], 0
lea eax, [ebp - 0x138]
push eax
push 0
push 0
push 0x57fc
call fcn.10033ff1
add esp, 0x10
jmp 0x10039c58
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x117c]
call fcn.1000ffb5
jmp 0x10039bdc
mov dword [ebp - 0x3ac], 0x8ae0512e
mov dword [ebp - 0x4ac], 5
mov dword [ebp - 0x654], 0x643f
mov dword [ebp - 0xf88], 0x1000afd8
cmp dword [ebp - 0x654], 0x6634
jle 0x1003a118
and dword [ebp - 0x264], 0
jmp 0x1003a059
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0x4665
jge 0x1003a118
and dword [ebp - 0x40c], 0
jmp 0x1003a07f
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0x53bb
jge 0x1003a113
and dword [ebp - 0x26c], 0
jmp 0x1003a0a5
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0x590a
jge 0x1003a10e
mov eax, dword [ebp - 0x264]
add eax, dword [ebp - 0x40c]
add eax, dword [ebp - 0x26c]
cdq
mov dword [ebp - 0xdf8], eax
mov dword [ebp - 0xdf4], edx
push dword [ebp - 0xdf4]
push dword [ebp - 0xdf8]
lea ecx, [ebp - 0x178c]
call fcn.1000d1e0
pop ecx
pop ecx
mov dword [ebp - 0xc98], eax
mov ecx, dword [ebp - 0xc98]
call fcn.1000fdfe
push eax
call fcn.1004bc16
pop ecx
lea ecx, [ebp - 0x178c]
call fcn.1000fdf4
jmp 0x1003a098
jmp 0x1003a072
jmp 0x1003a04c
mov dword [ebp - 0xcb8], 8
mov byte [ebp - 4], 0xe
cmp dword [ebp - 0x654], 0x6078
jge 0x1003a13e
push dword [ebp - 0xf88]
call fcn.1004bc16
pop ecx
jmp 0x1003a15a
mov dword [ebp - 4], 8
jmp 0x1003a16a
mov dword [ebp - 0xf90], 0x9ea7
push 1
lea ecx, [ebp - 0x11ac]
call fcn.1000ff33
mov byte [ebp - 4], 0x10
mov dword [ebp - 0xcb0], 0xffffffff
push 1
lea ecx, [ebp - 0x1194]
call fcn.1000ff33
mov byte [ebp - 4], 0x11
mov dword [ebp - 0xca8], 0x85b3d925
mov dword [ebp - 0xf04], 0xfffffff8
mov dword [ebp - 0xef8], 0x4a788afb
lea eax, [ebp - 0x11ac]
push eax
lea eax, [ebp - 0xca0]
push eax
push 0
call fcn.10034c63
add esp, 0xc
lea eax, [ebp - 0xca0]
push eax
push 0xd33
push 0
push 0x889
push 0x25e5
lea eax, [ebp - 0x1194]
push eax
push 0
call fcn.1002b3e3
add esp, 0x1c
push 0
lea eax, [ebp - 0xef8]
push eax
push 0xb5d
lea eax, [ebp - 0xca8]
push eax
lea eax, [ebp - 0xf90]
push eax
lea eax, [ebp - 0x11ac]
push eax
lea eax, [ebp - 0xcb0]
push eax
lea eax, [ebp - 0xf04]
push eax
lea eax, [ebp - 0x1194]
push eax
lea eax, [ebp - 0xcb8]
push eax
call fcn.1002b590
add esp, 0x28
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1194]
call fcn.1000ffb5
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x11ac]
call fcn.1000ffb5
mov dword [ebp - 0x1e4], 0x9f9b3198
mov dword [ebp - 0xcc8], 0x5cbcef05
mov dword [ebp - 0xf10], 0x3e38693
mov dword [ebp - 0x13a4], 5
mov dword [ebp - 0x14b4], 9
mov dword [ebp - 0xce8], 0x5b0e82ca
mov dword [ebp - 0x918], 0x7fdb
mov dword [ebp - 0xcc0], 0x1000b060
cmp dword [ebp - 0x918], 0x8349
jle 0x1003a3d4
and dword [ebp - 0x3d4], 0
jmp 0x1003a2da
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 0x149a
jge 0x1003a3d4
and dword [ebp - 0x27c], 0
jmp 0x1003a300
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0x4084
jge 0x1003a3cf
and dword [ebp - 0x35c], 0
jmp 0x1003a326
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0x1795
jge 0x1003a3ca
and dword [ebp - 0x274], 0
jmp 0x1003a34c
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0x70e6
jge 0x1003a3c5
mov esi, dword [ebp - 0x35c]
mov ecx, dword [ebp - 0x274]
shl esi, cl
mov eax, dword [ebp - 0x3d4]
cdq
idiv dword [ebp - 0x27c]
xor edx, esi
mov eax, edx
cdq
mov dword [ebp - 0xe04], eax
mov dword [ebp - 0xe00], edx
push dword [ebp - 0xe00]
push dword [ebp - 0xe04]
lea ecx, [ebp - 0x1738]
call fcn.1000d1e0
pop ecx
pop ecx
mov dword [ebp - 0xf98], eax
mov ecx, dword [ebp - 0xf98]
call fcn.1000fdfe
push eax
call fcn.1004bc16
pop ecx
lea ecx, [ebp - 0x1738]
call fcn.1000fdf4
jmp 0x1003a33f
jmp 0x1003a319
jmp 0x1003a2f3
jmp 0x1003a2cd
mov dword [ebp - 0x13ac], 0x48bd921b
mov byte [ebp - 4], 0x12
cmp dword [ebp - 0x918], 0x7f06
jge 0x1003a3fa
push dword [ebp - 0xcc0]
call fcn.1004bc16
pop ecx
jmp 0x1003a416
mov dword [ebp - 4], 8
jmp 0x1003a426
mov dword [ebp - 0x14dc], 0xffffffff
mov dword [ebp - 0x920], 0
push 4
lea ecx, [ebp - 0x1200]
call fcn.1000ff33
mov byte [ebp - 4], 0x14
mov dword [ebp - 0xfb0], 0x953c
push 1
lea eax, [ebp - 0x13b4]
push eax
push 0x682d
push 1
push 0
push 0x593d
lea eax, [ebp - 0x1200]
push eax
push 0x631b
call fcn.1003384b
add esp, 0x20
mov dword [ebp - 0x1e4], 0x1a
jmp 0x1003a499
mov eax, dword [ebp - 0x1e4]
dec eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0x19
jl 0x1003a76e
mov dword [ebp - 0xfa8], 0xfffffff8
mov dword [ebp - 0x14c4], 0xfffffffd
mov dword [ebp - 0x13bc], 0xdcef989b
mov dword [ebp - 0xce0], 0xfffffffc
mov dword [ebp - 0xf1c], 8
mov dword [ebp - 0x14e4], 0xd8c53784
mov dword [ebp - 0xfa0], 0xea7eb8e1
mov dword [ebp - 0xcd8], 0x20c4365d
mov dword [ebp - 0x194], 1
mov dword [ebp - 0xcd0], 0x6de0d615
lea eax, [ebp - 0xf10]
push eax
push 0x2f58
lea eax, [ebp - 0xcc8]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0xfa0]
push eax
lea eax, [ebp - 0xcd0]
push eax
push 0
lea eax, [ebp - 0xf1c]
push eax
lea eax, [ebp - 0xcd8]
push eax
push 0xe91
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0xfa8]
push eax
lea eax, [ebp - 0xce0]
push eax
lea eax, [ebp - 0x1200]
push eax
lea eax, [ebp - 0x920]
push eax
call fcn.1002b5c4
add esp, 0x3c
mov dword [ebp - 0x65c], 0x4259
mov dword [ebp - 0xf28], 0x1000b0a8
cmp dword [ebp - 0x65c], 0x4607
jle 0x1003a641
and dword [ebp - 0x364], 0
jmp 0x1003a5ac
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0x4f35
jge 0x1003a641
and dword [ebp - 0x284], 0
jmp 0x1003a5d2
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 0xb4b
jge 0x1003a63c
and dword [ebp - 0x42c], 0
jmp 0x1003a5f4
mov eax, dword [ebp - 0x42c]
inc eax
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0x731e
jge 0x1003a63a
mov eax, dword [ebp - 0x364]
cdq
idiv dword [ebp - 0x284]
xor edx, dword [ebp - 0x42c]
mov eax, edx
cdq
mov dword [ebp - 0xe10], eax
mov dword [ebp - 0xe0c], edx
push dword [ebp - 0xe0c]
push dword [ebp - 0xe10]
mov ecx, 0x10609cb8
call fcn.1000fe1e
jmp 0x1003a5e7
jmp 0x1003a5c5
jmp 0x1003a59f
mov byte [ebp - 4], 0x15
cmp dword [ebp - 0x65c], 0x4242
jge 0x1003a661
mov edx, dword [ebp - 0xf28]
mov ecx, 0x10609cb8
call fcn.100118c8
jmp 0x1003a67d
mov dword [ebp - 4], 0x14
jmp 0x1003a68d
mov dword [ebp - 0x194], 0
jmp 0x1003a6a6
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0x25
jge 0x1003a769
mov dword [ebp - 0xb28], 0x389e
mov dword [ebp - 0xcf0], 2
cmp dword [ebp - 0xce8], 0xffffffff
jne 0x1003a6dc
mov dword [ebp - 0xa78], 1
jmp 0x1003a6e3
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0xfb0]
cmp eax, dword [ebp - 0xa78]
jle 0x1003a6fd
mov dword [ebp - 0x664], 1
jmp 0x1003a704
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0x920], eax
cmp dword [ebp - 0xb28], 0
jne 0x1003a72b
mov eax, 0x1cd4
test eax, eax
jne 0x1003a72b
and dword [ebp - 0x66c], 0
jmp 0x1003a735
mov dword [ebp - 0x66c], 1
cmp dword [ebp - 0x66c], 0xffffffff
jg 0x1003a74a
mov dword [ebp - 0x674], 1
jmp 0x1003a751
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0xb28]
sub eax, dword [ebp - 0x674]
dec eax
mov dword [ebp - 0xcf0], eax
jmp 0x1003a699
jmp 0x1003a48c
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1200]
call fcn.1000ffb5
mov dword [ebp - 0x454], 0xffffffff
mov dword [ebp - 0xf84], 4
mov dword [ebp - 0x1c4], 0x7e2799ac
mov dword [ebp - 0x1c4], 0x1a
jmp 0x1003a7b4
mov eax, dword [ebp - 0x1c4]
dec eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0xfffffff3
jne 0x1003a7d2
push 0
call fcn.100345ae
pop ecx
cmp dword [ebp - 0x1c4], 0
je 0x1003a7d0
jmp 0x1003a7d2
jmp 0x1003a7a7
mov dword [ebp - 0x13c4], 0xdc67586e
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x28c], 0
jmp 0x1003a7fc
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 3
jge 0x1003a818
mov eax, dword [ebp - 0x28c]
mov dword [ebp + eax*4 - 0xc04], 1
jmp 0x1003a7ef
mov dword [ebp - 0x48], 2
jmp 0x1003a828
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x1003a90e
mov dword [ebp - 0x1034], 9
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0xc04]
mov dword [ebp - 0x14d4], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0xc04]
mov dword [ebp - 0x13cc], eax
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0xc04], 0x14ae
je 0x1003a878
mov dword [ebp - 0xfb8], 1
jmp 0x1003a87f
and dword [ebp - 0xfb8], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x14ec], eax
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0xc04], 0
je 0x1003a8ae
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0xc04], 0
je 0x1003a8ae
mov dword [ebp - 0xcf8], 1
jmp 0x1003a8b5
and dword [ebp - 0xcf8], 0
xor eax, eax
cmp eax, 0xc99cdf9c
jb 0x1003a8ca
mov dword [ebp - 0x928], 1
jmp 0x1003a8d1
and dword [ebp - 0x928], 0
cmp dword [ebp - 0x928], 0x8974b66
jle 0x1003a8f6
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0xc04], 0
je 0x1003a8f6
mov dword [ebp - 0x67c], 1
jmp 0x1003a8fd
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x67c]
mov dword [ebp - 0x1034], eax
jmp 0x1003a821
mov byte [ebp - 0xf1], 0
mov dword [ebp - 0x684], 0x6ab3
mov dword [ebp - 0xd08], 0x1000b118
cmp dword [ebp - 0x684], 0x6d47
jle 0x1003a9e1
and dword [ebp - 0x36c], 0
jmp 0x1003a94f
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0x7d19
jge 0x1003a9e1
and dword [ebp - 0x294], 0
jmp 0x1003a975
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0x18de
jge 0x1003a9dc
and dword [ebp - 0x3dc], 0
jmp 0x1003a997
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 0x5071
jge 0x1003a9da
mov eax, dword [ebp - 0x36c]
xor eax, dword [ebp - 0x294]
xor eax, dword [ebp - 0x3dc]
cdq
mov dword [ebp - 0xe1c], eax
mov dword [ebp - 0xe18], edx
push dword [ebp - 0xe18]
push dword [ebp - 0xe1c]
mov ecx, 0x10609cb8
call fcn.1000fe1e
jmp 0x1003a98a
jmp 0x1003a968
jmp 0x1003a942
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x1003ab72
push 0
call fcn.10035c58
pop ecx
mov dword [ebp - 0xa80], 0xff2
mov dword [ebp - 0xf44], 0x1000b134
cmp dword [ebp - 0xa80], 0x1249
jle 0x1003ab2a
and dword [ebp - 0x2a4], 0
jmp 0x1003aa32
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0x330
jge 0x1003ab2a
and dword [ebp - 0x414], 0
jmp 0x1003aa58
mov eax, dword [ebp - 0x414]
inc eax
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0x3444
jge 0x1003ab25
and dword [ebp - 0x29c], 0
jmp 0x1003aa7e
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0x6661
jge 0x1003ab20
and dword [ebp - 0x374], 0
jmp 0x1003aaa4
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0xca9
jge 0x1003ab1b
mov eax, dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x374]
shl eax, cl
mov ecx, dword [ebp - 0x2a4]
imul ecx, dword [ebp - 0x414]
and eax, ecx
cdq
mov dword [ebp - 0xe28], eax
mov dword [ebp - 0xe24], edx
push dword [ebp - 0xe24]
push dword [ebp - 0xe28]
lea ecx, [ebp - 0x1684]
call fcn.1000d1e0
pop ecx
pop ecx
mov dword [ebp - 0xd00], eax
mov ecx, dword [ebp - 0xd00]
call fcn.1000fdfe
push eax
call fcn.1004bc16
pop ecx
lea ecx, [ebp - 0x1684]
call fcn.1000fdf4
jmp 0x1003aa97
jmp 0x1003aa71
jmp 0x1003aa4b
jmp 0x1003aa25
mov byte [ebp - 4], 0x17
cmp dword [ebp - 0xa80], 0xf2b
jge 0x1003ab46
push dword [ebp - 0xf44]
call fcn.1004bc16
pop ecx
jmp 0x1003ab62
mov dword [ebp - 4], 8
jmp 0x1003ab72
mov byte [ebp - 4], 0x19
cmp dword [ebp - 0x684], 0x68a7
jge 0x1003ab92
mov edx, dword [ebp - 0xd08]
mov ecx, 0x10609cb8
call fcn.100118c8
jmp 0x1003abae
mov dword [ebp - 4], 8
jmp 0x1003abbe
push 1
lea ecx, [ebp - 0xbd4]
call fcn.1000ff33
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0x938], 0xfffffffd
mov dword [ebp - 0x930], 0x168f
mov dword [ebp - 0xd10], 0x1000b180
cmp dword [ebp - 0x930], 0x1a23
jle 0x1003aca7
and dword [ebp - 0x2ac], 0
jmp 0x1003ac1d
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0x1a54
jge 0x1003aca7
and dword [ebp - 0x37c], 0
jmp 0x1003ac3f
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0x8b
jge 0x1003aca2
mov eax, dword [ebp - 0x2ac]
and eax, dword [ebp - 0x37c]
cdq
mov dword [ebp - 0xe34], eax
mov dword [ebp - 0xe30], edx
push dword [ebp - 0xe30]
push dword [ebp - 0xe34]
lea ecx, [ebp - 0x16a8]
call fcn.1000d1e0
pop ecx
pop ecx
mov dword [ebp - 0xfdc], eax
mov ecx, dword [ebp - 0xfdc]
call fcn.1000fdfe
push eax
call fcn.1004bc16
pop ecx
lea ecx, [ebp - 0x16a8]
call fcn.1000fdf4
jmp 0x1003ac32
jmp 0x1003ac10
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x930], 0x1566
jge 0x1003acc3
push dword [ebp - 0xd10]
call fcn.1004bc16
pop ecx
jmp 0x1003acdf
mov dword [ebp - 4], 0x1b
jmp 0x1003acef
mov dword [ebp - 0x2b4], 0
jmp 0x1003ad08
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 1
jge 0x1003ad2a
push dword [ebp - 0x2b4]
lea ecx, [ebp - 0xbd4]
call fcn.1000ffd1
mov dword [eax], 0x473eb905
jmp 0x1003acfb
push 0
lea ecx, [ebp - 0xbd4]
call fcn.1000ffd1
cmp dword [eax], 0
je 0x1003adea
push 0
lea ecx, [ebp - 0xbd4]
call fcn.1000ffd1
mov esi, eax
push 0
lea ecx, [ebp - 0xbd4]
call fcn.1000ffd1
mov edi, dword [eax]
add edi, dword [esi]
push 0
lea ecx, [ebp - 0xbd4]
call fcn.1000ffd1
cmp dword [eax], edi
jl 0x1003ad7d
mov dword [ebp - 0x4ec], 1
jmp 0x1003ad84
and dword [ebp - 0x4ec], 0
push 0
lea ecx, [ebp - 0xbd4]
call fcn.1000ffd1
mov ecx, dword [ebp - 0x4ec]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc0]
imul eax, dword [ebp - 0x4ec]
mov dword [ebp - 0xf4c], eax
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xf4c], 0xfffffff8
jbe 0x1003adce
mov dword [ebp - 0x68c], 1
jmp 0x1003add5
and dword [ebp - 0x68c], 0
cmp dword [ebp - 0x68c], 0xfffffff7
jne 0x1003adea
mov dword [ebp - 0xb9c], 1
jmp 0x1003adf1
and dword [ebp - 0xb9c], 0
mov eax, dword [ebp - 0x938]
cmp dword [ebp - 0xb9c], eax
jl 0x1003ae0b
mov dword [ebp - 0x694], 1
jmp 0x1003ae12
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0x938], eax
mov dword [ebp - 0xc0], 0
jmp 0x1003ae37
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jg 0x1003aeb5
mov dword [ebp - 0xd18], 0xc234
mov dword [ebp - 0x1058], 0x63d62a04
push 0x50bd
push 1
push 0x27be
lea eax, [ebp - 0xc0]
push eax
push 0x15ed
lea eax, [ebp - 0xbd4]
push eax
push 0x385f
push 0x2ec3
lea eax, [ebp - 0xd18]
push eax
lea eax, [ebp - 0x1058]
push eax
push 0
push 0x74aa
push 0x18f3
push 0x118e
push 0
push 0x4c87
push 0x77e4
call fcn.1002e9ce
add esp, 0x44
jmp 0x1003ae2a
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xbd4]
call fcn.1000ffb5
mov dword [ebp - 0xbc0], 0xffffffff
mov dword [ebp - 0x19c], 3
mov dword [ebp - 0x3e4], 0
jmp 0x1003aef1
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
cmp dword [ebp - 0x3e4], 3
jge 0x1003af0d
mov eax, dword [ebp - 0x3e4]
mov dword [ebp + eax*4 - 0x15c8], 0xa8c6a53d
jmp 0x1003aee4
push 0
push 0x2485
call fcn.1002bb73
pop ecx
pop ecx
mov dword [ebp - 0x19c], 0
jmp 0x1003af34
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 3
jge 0x1003af50
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x15c8], 1
jmp 0x1003af27
mov dword [ebp - 0x314], 0x8d320cd5
mov dword [ebp - 0x40], 0xfffc
mov dword [ebp - 0x1dc], 0x758e92ed
mov dword [ebp - 0x148], 0xffffffff
mov dword [ebp - 0x48c], 0x128b
mov dword [ebp - 0x384], 0x57af
push 3
lea ecx, [ebp - 0x1248]
call fcn.1000ff33
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0xd28], 0xfffffffa
mov dword [ebp - 0xb98], 0x86010944
push 2
lea ecx, [ebp - 0x1230]
call fcn.1000ff33
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x64], 0
jmp 0x1003afcf
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x1003afe5
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xc20], 0x996e1580
jmp 0x1003afc8
lea eax, [ebp - 0x64]
push eax
push 0xca5
push 0
push 1
push 0x6f93
lea eax, [ebp - 0x1248]
push eax
call fcn.1002b0bf
add esp, 0x18
mov dword [ebp - 0x64], 0
jmp 0x1003b016
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x1003b032
push dword [ebp - 0x64]
lea ecx, [ebp - 0x1230]
call fcn.1000ffd1
mov dword [eax], 0xfffffff6
jmp 0x1003b00f
mov byte [ebp - 0x13a], 0
movzx eax, byte [ebp - 0x13a]
test eax, eax
je 0x1003b04e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
imul eax, dword [ebp - 0x40], 0
mov ecx, dword [ebp - 0x40]
imul ecx, dword [ebp - 0x40]
sub ecx, eax
sub ecx, dword [ebp - 0x40]
mov eax, 0x7adf
sub eax, ecx
imul eax, dword [ebp - 0x40]
cmp dword [ebp - 0x40], eax
jg 0x1003b07a
mov dword [ebp - 0x69c], 1
jmp 0x1003b081
and dword [ebp - 0x69c], 0
imul eax, dword [ebp - 0x69c], 0xffffffff
test eax, eax
jne 0x1003b098
mov dword [ebp - 0xa88], 1
jmp 0x1003b09f
and dword [ebp - 0xa88], 0
mov eax, dword [ebp - 0xa88]
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0xfff7
jbe 0x1003b0c3
mov dword [ebp - 0x6a4], 1
jmp 0x1003b0ca
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x6a4]
sub eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x40]
test eax, eax
jne 0x1003b0ea
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x1003b412
mov dword [ebp - 0xa98], 1
mov dword [ebp - 0x950], 0xffffffff
mov dword [ebp - 0x4cc], 1
mov dword [ebp - 0x6d4], 0x4a603d2c
mov dword [ebp - 0xd20], 1
mov dword [ebp - 0x484], 0xfffffffb
push 2
lea ecx, [ebp - 0x1218]
call fcn.1000ff33
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x6ec], 0xfffffffc
lea eax, [ebp - 0x1218]
push eax
push 0
lea eax, [ebp - 0x13d4]
push eax
call fcn.1003418e
add esp, 0xc
push 0x3cd8
push 0
push 0x31be
lea eax, [ebp - 0x1dc]
push eax
call fcn.10030904
add esp, 0x10
mov eax, dword [ebp - 0x1dc]
sub eax, 0x9842
jne 0x1003b370
mov eax, dword [ebp - 0x48c]
inc eax
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x40], 0
jne 0x1003b1a8
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xc20], 0
je 0x1003b1bd
mov eax, 0xc2da
test eax, eax
je 0x1003b1bd
mov dword [ebp - 0x940], 1
jmp 0x1003b1c4
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x940], eax
jne 0x1003b1db
mov dword [ebp - 0x6ac], 1
jmp 0x1003b1e2
and dword [ebp - 0x6ac], 0
cmp dword [ebp - 0x6ac], 0xfffffff6
ja 0x1003b1f4
cmp dword [ebp - 0x148], 0
je 0x1003b209
cmp dword [ebp - 0x484], 0
je 0x1003b209
mov dword [ebp - 0xb30], 1
jmp 0x1003b210
and dword [ebp - 0xb30], 0
mov eax, dword [ebp - 0xa98]
imul eax, dword [ebp - 0xb30]
cmp eax, dword [ebp - 0x6d4]
jge 0x1003b231
mov dword [ebp - 0x6b4], 1
jmp 0x1003b238
and dword [ebp - 0x6b4], 0
cmp dword [ebp - 0x6b4], 0x23ee1e16
jg 0x1003b250
mov dword [ebp - 0x948], 1
jmp 0x1003b257
and dword [ebp - 0x948], 0
cmp dword [ebp - 0x948], 9
jbe 0x1003b26c
mov dword [ebp - 0x6bc], 1
jmp 0x1003b273
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x6bc]
sub eax, dword [ebp - 0x950]
cmp eax, dword [ebp - 0x4cc]
jle 0x1003b2a3
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xc20], 0
je 0x1003b2a3
mov dword [ebp - 0xa90], 1
jmp 0x1003b2aa
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 0xa90]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x484], eax
cmp dword [ebp - 0x484], 0
je 0x1003b2e0
cmp dword [ebp - 0x4cc], 0
je 0x1003b2e0
mov dword [ebp - 0x6c4], 1
jmp 0x1003b2e7
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x384]
cmp dword [ebp - 0x6c4], eax
jg 0x1003b307
cmp dword [ebp - 0x950], 0
jne 0x1003b307
and dword [ebp - 0x6cc], 0
jmp 0x1003b311
mov dword [ebp - 0x6cc], 1
push 1
lea ecx, [ebp - 0x1218]
call fcn.1000ffd1
mov ecx, dword [ebp - 0x6cc]
cmp ecx, dword [eax]
jg 0x1003b334
mov dword [ebp - 0xbd8], 1
jmp 0x1003b33b
and dword [ebp - 0xbd8], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xbd8], eax
jl 0x1003b352
mov dword [ebp - 0x958], 1
jmp 0x1003b359
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x6d4]
cmp dword [ebp - 0x958], eax
jl 0x1003b370
and dword [ebp - 0x6dc], 0
jmp 0x1003b37a
mov dword [ebp - 0x6dc], 1
push 2
lea ecx, [ebp - 0x1248]
call fcn.1000ffd1
mov ecx, dword [ebp - 0x6dc]
cmp ecx, dword [eax]
jne 0x1003b39d
mov dword [ebp - 0x6e4], 1
jmp 0x1003b3a4
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0xa98]
cmp eax, dword [ebp - 0x6e4]
jle 0x1003b3be
mov dword [ebp - 0x960], 1
jmp 0x1003b3c5
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x960]
mov dword [ebp - 0x6ec], eax
mov eax, dword [ebp - 0x6ec]
cmp eax, dword [ebp - 0xd20]
jle 0x1003b3eb
mov dword [ebp - 0xb38], 1
jmp 0x1003b3f2
and dword [ebp - 0xb38], 0
mov eax, dword [ebp - 0xb38]
mov dword [ebp - 0x4cc], eax
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x1218]
call fcn.1000ffb5
jmp 0x1003b767
mov dword [ebp - 0x84], 0x86461d90
mov dword [ebp - 0x724], 0x37a9e214
mov dword [ebp - 0x2bc], 0
jmp 0x1003b43f
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 4
jge 0x1003b45b
mov eax, dword [ebp - 0x2bc]
mov dword [ebp + eax*4 - 0x1270], 5
jmp 0x1003b432
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x14f4], eax
mov dword [ebp - 0x1dc], 0xffffffff
cmp dword [ebp - 0x84], 0x8662
jne 0x1003b48f
cmp dword [ebp - 0x84], 0
jne 0x1003b48f
and dword [ebp - 0x6f4], 0
jmp 0x1003b499
mov dword [ebp - 0x6f4], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xc20]
cmp dword [ebp - 0x6f4], eax
jle 0x1003b4ba
mov dword [ebp - 0x968], 1
jmp 0x1003b4c1
and dword [ebp - 0x968], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
cmp eax, dword [ebp - 0x968]
jl 0x1003b4f4
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xc20], 0
jne 0x1003b4f4
and dword [ebp - 0xf54], 0
jmp 0x1003b4fe
mov dword [ebp - 0xf54], 1
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x13dc], eax
mov eax, dword [ebp - 0x148]
cmp eax, dword [ebp - 0x48c]
jge 0x1003b524
mov dword [ebp - 0x6fc], 1
jmp 0x1003b52b
and dword [ebp - 0x6fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc20]
cmp dword [ebp - 0x6fc], eax
jge 0x1003b54c
mov dword [ebp - 0xaa0], 1
jmp 0x1003b553
and dword [ebp - 0xaa0], 0
mov eax, dword [ebp - 0xd28]
cmp dword [ebp - 0xaa0], eax
jg 0x1003b56d
mov dword [ebp - 0x704], 1
jmp 0x1003b574
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x704], eax
jne 0x1003b58e
mov dword [ebp - 0x504], 1
jmp 0x1003b595
and dword [ebp - 0x504], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x504]
mov dword [ebp + eax - 0x1270], ecx
cmp dword [ebp - 0x504], 0xffffffff
jl 0x1003b5bd
mov dword [ebp - 0x970], 1
jmp 0x1003b5c4
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x970]
jl 0x1003b5de
mov dword [ebp - 0x70c], 1
jmp 0x1003b5e5
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x70c], eax
jne 0x1003b5ff
mov dword [ebp - 0x494], 1
jmp 0x1003b606
and dword [ebp - 0x494], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x494]
mov dword [ebp + eax - 0xc20], ecx
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0xb98], eax
cmp dword [ebp - 0xb98], 0
jae 0x1003b63a
mov dword [ebp - 0x714], 1
jmp 0x1003b641
and dword [ebp - 0x714], 0
push 1
lea ecx, [ebp - 0x1230]
call fcn.1000ffd1
mov ecx, dword [ebp - 0x714]
cmp ecx, dword [eax]
jl 0x1003b674
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1270], 0
je 0x1003b674
mov dword [ebp - 0x978], 1
jmp 0x1003b67b
and dword [ebp - 0x978], 0
cmp dword [ebp - 0x978], 0xfff9
jbe 0x1003b693
mov dword [ebp - 0x71c], 1
jmp 0x1003b69a
and dword [ebp - 0x71c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc20]
cmp eax, dword [ebp - 0x71c]
jne 0x1003b6bb
mov dword [ebp - 0xaa8], 1
jmp 0x1003b6c2
and dword [ebp - 0xaa8], 0
mov eax, dword [ebp - 0xaa8]
dec eax
mov dword [ebp - 0x724], eax
je 0x1003b6ed
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xc20], 0
je 0x1003b6ed
mov dword [ebp - 0x980], 1
jmp 0x1003b6f4
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x980]
sub eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x84]
je 0x1003b714
mov dword [ebp - 0x72c], 1
jmp 0x1003b71b
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x384]
cmp dword [ebp - 0x72c], eax
je 0x1003b739
xor eax, eax
je 0x1003b739
mov dword [ebp - 0xb40], 1
jmp 0x1003b740
and dword [ebp - 0xb40], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1270]
sub eax, dword [ebp - 0xb40]
imul eax, dword [ebp - 0x384]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1270], eax
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x1230]
call fcn.1000ffb5
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1248]
call fcn.1000ffb5
mov dword [ebp - 0x6c], 0
jmp 0x1003b795
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x1003b7ab
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x12c0], 0
jmp 0x1003b78e
mov dword [ebp - 0x6c], 0
jmp 0x1003b7bb
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x1003b7d1
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x1604], 0xfffffffb
jmp 0x1003b7b4
mov dword [ebp - 0x178], 0xfffffffd
mov dword [ebp - 0x2d4], 0xffffffff
mov dword [ebp - 0x49c], 0
mov dword [ebp - 0x990], 0x1355fff
mov dword [ebp - 0x4d4], 0
mov dword [ebp - 0x74c], 0x36c93846
mov dword [ebp - 0xd38], 0xe65f
mov dword [ebp - 0x734], 0x392c
mov dword [ebp - 0xfe4], 0x1000b1f8
cmp dword [ebp - 0x734], 0x3bd3
jle 0x1003b917
and dword [ebp - 0x38c], 0
jmp 0x1003b851
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0x4a20
jge 0x1003b917
and dword [ebp - 0x2cc], 0
jmp 0x1003b877
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 0x59b
jge 0x1003b912
and dword [ebp - 0x2c4], 0
jmp 0x1003b89d
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0x63d5
jge 0x1003b90d
and dword [ebp - 0x43c], 0
jmp 0x1003b8bf
mov eax, dword [ebp - 0x43c]
inc eax
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0x5417
jge 0x1003b90b
mov eax, dword [ebp - 0x2c4]
cdq
idiv dword [ebp - 0x43c]
and edx, dword [ebp - 0x2cc]
or edx, dword [ebp - 0x38c]
mov eax, edx
cdq
mov dword [ebp - 0xe40], eax
mov dword [ebp - 0xe3c], edx
push dword [ebp - 0xe3c]
push dword [ebp - 0xe40]
mov ecx, 0x10609cb8
call fcn.1000fe1e
jmp 0x1003b8b2
jmp 0x1003b890
jmp 0x1003b86a
jmp 0x1003b844
mov dword [ebp - 0xb4], 0
jmp 0x1003b930
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jge 0x1003b94c
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x10d8], 1
jmp 0x1003b923
mov byte [ebp - 4], 0x21
cmp dword [ebp - 0x734], 0x384e
jge 0x1003b96c
mov edx, dword [ebp - 0xfe4]
mov ecx, 0x10609cb8
call fcn.100118c8
jmp 0x1003b988
mov dword [ebp - 4], 8
jmp 0x1003b998
mov dword [ebp - 0xb4], 0
jmp 0x1003b9b1
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x1003b9cd
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x15d4], 0xffffffff
jmp 0x1003b9a4
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x1003b9f3
push 0
push 0x2800
push 0x36b8
call fcn.1002bc93
add esp, 0xc
cmp dword [ebp - 0x990], 0
jg 0x1003ba08
mov dword [ebp - 0xd30], 1
jmp 0x1003ba0f
and dword [ebp - 0xd30], 0
mov eax, dword [ebp - 0x4d4]
inc eax
mov dword [ebp - 0x4d4], eax
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x14e0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10d8], 3
jge 0x1003ba44
mov dword [ebp - 0x988], 1
jmp 0x1003ba4b
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x178]
neg eax
cmp eax, dword [ebp - 0x988]
jne 0x1003ba67
mov dword [ebp - 0x73c], 1
jmp 0x1003ba6e
and dword [ebp - 0x73c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10d8]
imul eax, dword [ebp - 0x73c]
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 0
je 0x1003baa6
cmp dword [ebp - 0x2d4], 0
je 0x1003baa6
mov dword [ebp - 0xab0], 1
jmp 0x1003baad
and dword [ebp - 0xab0], 0
mov eax, dword [ebp - 0x178]
imul eax, dword [ebp - 0xab0]
cmp eax, dword [ebp - 0x2d4]
jne 0x1003bad4
cmp dword [ebp - 0x74c], 0
jne 0x1003bad4
and dword [ebp - 0x744], 0
jmp 0x1003bade
mov dword [ebp - 0x744], 1
mov eax, dword [ebp - 0x744]
sub eax, dword [ebp - 0x2d4]
cmp eax, dword [ebp - 0x178]
jg 0x1003bafe
mov dword [ebp - 0xf5c], 1
jmp 0x1003bb05
and dword [ebp - 0xf5c], 0
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x13e4], eax
mov eax, dword [ebp - 0x990]
mov dword [ebp - 0x1574], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x15d4]
mov dword [ebp - 0x13ec], eax
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x14e8], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x13f4], eax
mov eax, dword [ebp - 0x49c]
cmp eax, dword [ebp - 0x74c]
jle 0x1003bb62
mov dword [ebp - 0xbb8], 1
jmp 0x1003bb69
and dword [ebp - 0xbb8], 0
mov eax, dword [ebp - 0xbb8]
mov dword [ebp - 0xd38], eax
mov dword [ebp - 0x60], 5
jmp 0x1003bb85
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x1100], 0xfffffff9
mov dword [ebp - 0x10fc], 0xfffffff9
mov dword [ebp - 0x10f8], 0xfffffff9
mov dword [ebp - 0x10f4], 0xfffffff9
lea ecx, [ebp - 0x511]
call fcn.1000ffe0
push eax
lea eax, [ebp - 0x10f0]
push eax
lea eax, [ebp - 0x1100]
push eax
lea ecx, [ebp - 0x1654]
call fcn.1000ffe3
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1460]
call fcn.1000ff8f
mov byte [ebp - 4], 0x2c
mov dword [ebp - 0x458], 0x7e2799ac
cmp dword [ebp - 0x458], 0
je 0x1003d226
mov dword [ebp - 0xf8c], 0xfffffff8
mov dword [ebp - 0xb68], 0x1632
mov dword [ebp - 0xd98], 0x1000b360
cmp dword [ebp - 0xb68], 0x16f0
jle 0x1003d1b6
and dword [ebp - 0x3fc], 0
jmp 0x1003d120
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 0x75ed
jge 0x1003d1b6
and dword [ebp - 0x31c], 0
jmp 0x1003d146
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0x680d
jge 0x1003d1b1
and dword [ebp - 0x3b4], 0
jmp 0x1003d168
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 0x7ac1
jge 0x1003d1af
mov eax, dword [ebp - 0x3fc]
mov ecx, dword [ebp - 0x31c]
shl eax, cl
mov ecx, dword [ebp - 0x3b4]
sar eax, cl
cdq
mov dword [ebp - 0xe70], eax
mov dword [ebp - 0xe6c], edx
push dword [ebp - 0xe6c]
push dword [ebp - 0xe70]
mov ecx, 0x10609cb8
call fcn.1000fe1e
jmp 0x1003d15b
jmp 0x1003d139
jmp 0x1003d113
push 0
lea eax, [ebp - 0xf8c]
push eax
lea eax, [ebp - 0x458]
push eax
push 0x1163
push 0x10b6
call fcn.10034a51
add esp, 0x14
mov byte [ebp - 4], 0x2d
cmp dword [ebp - 0xb68], 0x1576
jge 0x1003d1f8
mov edx, dword [ebp - 0xd98]
mov ecx, 0x10609cb8
call fcn.100118c8
jmp 0x1003d214
mov dword [ebp - 4], 0x2c
jmp 0x1003d224
jmp 0x1003d265
mov dword [ebp - 0x1068], 0xffffffff
mov esi, dword [ebp - 0x1068]
push 0
lea ecx, [ebp - 0x1460]
call fcn.1000ffd1
mov dword [eax], esi
mov byte [ebp - 0x142], 0
movzx eax, byte [ebp - 0x142]
test eax, eax
je 0x1003d265
push 0
push 0x5594
call fcn.10033820
pop ecx
pop ecx
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1460]
call fcn.1000ffb5
mov dword [ebp - 0x30], 5
mov dword [ebp - 0xb00], 1
mov dword [ebp - 0xda0], 0x7f4a7d2a
mov dword [ebp - 0xda8], 0xc0ec0dce
mov dword [ebp - 0x1fc], 0
jmp 0x1003d2b2
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 3
jge 0x1003d2ce
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0x1260], 1
jmp 0x1003d2a5
mov dword [ebp - 0x30], 2
jmp 0x1003d2de
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1003d313
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x1003d311
push 0x520e
push 0x5289
push 0
push 1
push 0x2f96
call fcn.1002ae2a
add esp, 0x14
jmp 0x1003d2d7
mov dword [ebp - 0x30], 2
jmp 0x1003d323
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1003d4a0
mov dword [ebp - 0x130], 0xc34eea2a
mov dword [ebp - 0xa30], 0xfeae2151
mov dword [ebp - 0xbb0], 0xfffffffc
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x1318], eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x130]
je 0x1003d377
cmp dword [ebp - 0x130], 0
je 0x1003d377
mov dword [ebp - 0x874], 1
jmp 0x1003d37e
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0x874]
jl 0x1003d398
mov dword [ebp - 0xa28], 1
jmp 0x1003d39f
and dword [ebp - 0xa28], 0
cmp dword [ebp - 0xa28], 0x3847
jge 0x1003d3b7
mov dword [ebp - 0x87c], 1
jmp 0x1003d3be
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0xb00], eax
mov eax, dword [ebp - 0xb00]
sub eax, 0x86f2
imul eax, dword [ebp - 0x130]
test eax, eax
jne 0x1003d3fb
cmp dword [ebp - 0x130], 0
jne 0x1003d3fb
mov eax, 0x6548aab5
test eax, eax
jne 0x1003d3fb
and dword [ebp - 0x884], 0
jmp 0x1003d405
mov dword [ebp - 0x884], 1
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0xa30], eax
mov eax, dword [ebp - 0xa30]
cmp eax, dword [ebp - 0x30]
je 0x1003d431
cmp dword [ebp - 0xda0], 0
je 0x1003d431
mov dword [ebp - 0x88c], 1
jmp 0x1003d438
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x1320], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1260]
mov dword [ebp - 0xf94], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xf94]
mov dword [ebp + eax*4 - 0x1260], ecx
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0x1328], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1330], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1260]
mov dword [ebp - 0xda8], eax
jmp 0x1003d31c
mov byte [ebp - 0x10d], 0
lea eax, [ebp - 0x10d]
push eax
push 0
push 0
call fcn.1002b34f
add esp, 0xc
push 2
lea ecx, [ebp - 0x1084]
call fcn.1000ff33
mov byte [ebp - 4], 0x2f
mov dword [ebp - 0x154], 0x6ff23b1a
mov dword [ebp - 0x450], 0x8cccddd
mov dword [ebp - 0x1338], 0x884cb8f6
mov dword [ebp - 0x200], 0x9b58331c
mov dword [ebp - 0x208], 1
mov dword [ebp - 0x1340], 1
mov dword [ebp - 0x1348], 0x4c3d
mov dword [ebp - 0xdb4], 0x61ca7276
push 0xe7d
lea eax, [ebp - 0x1084]
push eax
push 0x4f44
lea eax, [ebp - 0x1b4]
push eax
push 0
call fcn.1002c313
add esp, 0x14
mov dword [ebp - 0x1b4], 0
jmp 0x1003d556
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 3
jge 0x1003d572
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x1020], 1
jmp 0x1003d549
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
jne 0x1003d635
cmp dword [ebp - 0x450], 0
jne 0x1003d635
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1020]
mov dword [ebp - 0x1350], eax
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x1358], eax
cmp dword [ebp - 0x200], 0x7b83
jle 0x1003d5c9
mov dword [ebp - 0x894], 1
jmp 0x1003d5d0
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0x208]
cmp dword [ebp - 0x894], eax
jle 0x1003d5ea
mov dword [ebp - 0xa38], 1
jmp 0x1003d5f1
and dword [ebp - 0xa38], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1020]
mov dword [ebp - 0x450], eax
mov eax, dword [ebp - 0x450]
imul eax, dword [ebp - 0xa38]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jne 0x1003d635
and dword [ebp - 0x55c], 0
jmp 0x1003d63f
mov dword [ebp - 0x55c], 1
push 1
lea ecx, [ebp - 0x1084]
call fcn.1000ffd1
mov ecx, dword [ebp - 0x55c]
cmp ecx, dword [eax]
jge 0x1003d662
mov dword [ebp - 0x560], 1
jmp 0x1003d669
and dword [ebp - 0x560], 0
push 1
lea ecx, [ebp - 0x1084]
call fcn.1000ffd1
mov eax, dword [eax]
sub eax, dword [ebp - 0x560]
je 0x1003d7a9
mov dword [ebp - 0x1004], 0
mov dword [ebp - 0x1294], 0xbf7c295a
mov dword [ebp - 0x1368], 0xfffffffe
mov dword [ebp - 0x1370], 0xffffffff
mov dword [ebp - 0x1378], 0xb1bb30b1
mov dword [ebp - 0x1380], 0xe8e548e0
mov dword [ebp - 0x1388], 0
mov dword [ebp - 0x1390], 0x6eae1177
mov dword [ebp - 0x1398], 0x18d7c584
mov dword [ebp - 0x13a0], 0xa81f6ed7
mov dword [ebp - 0x13a8], 0xfffffffb
mov dword [ebp - 0x13b0], 0x5fe96f77
mov dword [ebp - 0x13b8], 0xcd890f6d
mov dword [ebp - 0x13c0], 0x2fd17ba7
mov dword [ebp - 0x13c8], 7
mov dword [ebp - 0x210], 0
jmp 0x1003d733
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 3
jge 0x1003d74f
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0x175c], 0xffffffff
jmp 0x1003d726
mov dword [ebp - 0x154], 0
jmp 0x1003d768
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 9
jl 0x1003d785
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1020]
mov dword [ebp - 0x1004], eax
jmp 0x1003d75b
push 0x7739
push 0
push 0x6343
push 0x3788
push 0
lea eax, [ebp - 0xdb4]
push eax
call fcn.1003337e
add esp, 0x18
jmp 0x1003d81d
mov dword [ebp - 0x17c], 0xd5f5ab95
mov dword [ebp - 0xf9c], 0xffffffff
mov dword [ebp - 0x17c], 0xd012cd0a
mov dword [ebp - 0x17c], 0
jmp 0x1003d7e0
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0x1c
jne 0x1003d81d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1020]
mov dword [ebp - 0x568], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x568]
mov dword [ebp + eax - 0x1020], ecx
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0xf9c], eax
jmp 0x1003d7d3
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1084]
call fcn.1000ffb5
mov dword [ebp - 0xc8], 1
jmp 0x1003d845
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jl 0x1003e21b
mov dword [ebp - 0xd0], 0x7ddc85f7
mov dword [ebp - 0xf3c], 0x46158d32
mov dword [ebp - 0xf38], 0x46158d32
mov dword [ebp - 0xf34], 0x46158d32
mov dword [ebp - 0xf30], 0x46158d32
mov dword [ebp - 0xfa4], 0x5a06c0f1
mov dword [ebp - 0x13d0], 0xe8bf
mov dword [ebp - 0xd0], 0xfffffffc
jmp 0x1003d8b1
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xb
jne 0x1003dd7c
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0x570], 0x24c0
mov dword [ebp - 0xdc0], 0x1000b3ac
cmp dword [ebp - 0x570], 0x256a
jle 0x1003d9d4
push 0
push 0x1247
call dword [sym.imp.USER32.dll_EndDialog]
and dword [ebp - 0x228], 0
jmp 0x1003d90f
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0x3f9d
jge 0x1003d9d4
and dword [ebp - 0x230], 0
jmp 0x1003d935
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0x1a3
jge 0x1003d9cf
and dword [ebp - 0x218], 0
jmp 0x1003d95b
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xe60
jge 0x1003d9ca
and dword [ebp - 0x220], 0
jmp 0x1003d97d
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0x5c28
jge 0x1003d9c8
mov eax, dword [ebp - 0x218]
add eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0x228]
xor ecx, dword [ebp - 0x230]
xor eax, ecx
cdq
mov dword [ebp - 0xe7c], eax
mov dword [ebp - 0xe78], edx
push dword [ebp - 0xe78]
push dword [ebp - 0xe7c]
mov ecx, 0x10609cb8
call fcn.1000fe1e
jmp 0x1003d970
jmp 0x1003d94e
jmp 0x1003d928
jmp 0x1003d902
mov byte [ebp - 4], 0x30
cmp dword [ebp - 0x570], 0x245b
jge 0x1003d9f4
mov edx, dword [ebp - 0xdc0]
mov ecx, 0x10609cb8
call fcn.100118c8
jmp 0x1003da10
mov dword [ebp - 4], 8
jmp 0x1003da20
mov dword [ebp - 0xdd8], 0xffffffff
mov dword [ebp - 0x238], 0
jmp 0x1003da43
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 1
jge 0x1003da5f
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0xdcc], 0xfffffff8
jmp 0x1003da36
mov dword [ebp - 0xd8], 0
jmp 0x1003da78
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jg 0x1003dd77
mov dword [ebp - 0x188], 0x962ee6d0
mov dword [ebp - 0x188], 0
jmp 0x1003daa8
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 3
jg 0x1003dd58
mov dword [ebp - 0x180], 0x5c6eff3d
mov dword [ebp - 0x588], 0xf79b347d
mov dword [ebp - 0x180], 3
jmp 0x1003dae2
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jl 0x1003dd53
mov dword [ebp - 0x164], 0x136ef6f0
mov dword [ebp - 0x240], 0
jmp 0x1003db12
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 2
jge 0x1003db2e
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0xb70], 0x9f8d19c9
jmp 0x1003db05
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xb70], 0
jmp 0x1003db5c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb70]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xb70], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb70], 3
jg 0x1003dd2b
mov dword [ebp - 0x598], 0xa3c3d214
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb70]
mov dword [ebp - 0x13d8], eax
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0x13e0], eax
cmp dword [ebp - 0x180], 0
jne 0x1003dbae
mov dword [ebp - 0x578], 1
jmp 0x1003dbb5
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x578], eax
jge 0x1003dbcf
mov dword [ebp - 0x1070], 1
jmp 0x1003dbd6
and dword [ebp - 0x1070], 0
mov eax, 0x8e60d743
cmp eax, 0x9984333
jne 0x1003dbee
mov dword [ebp - 0x580], 1
jmp 0x1003dbf5
and dword [ebp - 0x580], 0
xor eax, eax
sub eax, dword [ebp - 0x580]
mov dword [ebp - 0x588], eax
je 0x1003dc15
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xdcc], 0
jne 0x1003dc27
mov eax, 0xfa90ef87
test eax, eax
jne 0x1003dc27
and dword [ebp - 0x590], 0
jmp 0x1003dc31
mov dword [ebp - 0x590], 1
mov eax, dword [ebp - 0x590]
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
jae 0x1003dc52
mov dword [ebp - 0x5a0], 1
jmp 0x1003dc59
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp + eax*4 - 0xf3c]
mov dword [ebp - 0x5a8], eax
mov eax, dword [ebp - 0x188]
mov ecx, dword [ebp - 0x5a8]
mov dword [ebp + eax*4 - 0xf3c], ecx
mov eax, dword [ebp - 0x598]
add eax, dword [ebp - 0x5a0]
imul eax, dword [ebp - 0xfa4]
cmp dword [ebp - 0x5a8], eax
je 0x1003dca6
mov dword [ebp - 0x5b0], 1
jmp 0x1003dcad
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x5b0]
sub eax, dword [ebp - 0xd0]
add eax, dword [ebp - 0xd0]
cmp eax, 1
jle 0x1003dcd0
mov dword [ebp - 0x5b8], 1
jmp 0x1003dcd7
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0xdd8], eax
mov dword [ebp - 0x164], 0
jmp 0x1003dcfc
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 3
jg 0x1003dd26
mov byte [ebp - 0x139], 0
push 0x1abe
push 1
push 0
lea eax, [ebp - 0x139]
push eax
call fcn.10033ff1
add esp, 0x10
jmp 0x1003dcef
jmp 0x1003db41
mov byte [ebp - 0x10f], 0
movzx eax, byte [ebp - 0x10f]
test eax, eax
je 0x1003dd4e
push 0x2255
push 0
push 1
call fcn.1002b34f
add esp, 0xc
jmp 0x1003dad5
jmp 0x1003da9b
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp + eax*4 - 0xf3c]
mov ecx, dword [ebp - 0xd8]
mov dword [ebp + ecx*4 - 0xf3c], eax
jmp 0x1003da6b
jmp 0x1003d8a4
mov dword [ebp - 0x94], 0x2ba39464
mov dword [ebp - 0x14c], 0xfffd
mov dword [ebp - 0x628], 1
mov dword [ebp - 0xfac], 0x4171b3fe
mov dword [ebp - 0x248], 0
jmp 0x1003ddbd
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 1
jge 0x1003ddd6
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0x68], 5
jmp 0x1003ddb0
mov dword [ebp - 0x94], 0
jmp 0x1003ddef
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x1003e1ed
mov dword [ebp - 0x14], 0x17f75960
mov dword [ebp - 0x15c], 0x2ca3c0bf
mov dword [ebp - 0x460], 0xb15b
mov dword [ebp - 0x14], 0
jmp 0x1003de27
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x1003de47
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x68]
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x68], eax
mov dword [ebp - 0x15c], 2
jmp 0x1003de20
mov byte [ebp - 0x131], 0
movzx eax, byte [ebp - 0x131]
test eax, eax
je 0x1003de61
push 0
call fcn.1002e8be
pop ecx
mov dword [ebp - 0x14], 0
jmp 0x1003de71
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x1003e1e8
mov dword [ebp - 0x468], 0xfffffffa
mov dword [ebp - 0xdf0], 5
mov dword [ebp - 0x15c], 0
jmp 0x1003dea8
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
jl 0x1003e016
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp + eax*4 - 0x68]
cmp eax, dword [ebp - 0x94]
jge 0x1003ded3
mov dword [ebp - 0x5d0], 1
jmp 0x1003deda
and dword [ebp - 0x5d0], 0
imul eax, dword [ebp - 0x468], 0xe707
mov ecx, dword [ebp - 0x94]
cmp dword [ebp + ecx*4 - 0x68], eax
je 0x1003defc
mov dword [ebp - 0x100c], 1
jmp 0x1003df03
and dword [ebp - 0x100c], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x13e8], eax
cmp dword [ebp - 0x468], 0xf59ec134
jae 0x1003df24
mov dword [ebp - 0x5c0], 1
jmp 0x1003df2b
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x14c]
imul eax, dword [ebp - 0x5c0]
test eax, eax
je 0x1003df48
mov dword [ebp - 0x5c8], 1
jmp 0x1003df4f
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x5c8], eax
jle 0x1003df66
mov dword [ebp - 0x5d8], 1
jmp 0x1003df6d
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x5d0]
cmp eax, dword [ebp - 0x5d8]
jne 0x1003df87
mov dword [ebp - 0xde4], 1
jmp 0x1003df8e
and dword [ebp - 0xde4], 0
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp + eax*4 - 0x68]
mov dword [ebp - 0x13f0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x68], 1
je 0x1003dfb7
mov dword [ebp - 0x5e0], 1
jmp 0x1003dfbe
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x5e0], eax
jl 0x1003dfd8
mov dword [ebp - 0x5e8], 1
jmp 0x1003dfdf
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x460], eax
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x1003e011
push 0x2141
push 0
push 0x77b3
call fcn.1002ee88
add esp, 0xc
jmp 0x1003de9b
mov eax, 0x9fa4
test eax, eax
je 0x1003e0cd
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x13f8], eax
cmp dword [ebp - 0x14c], 0x2d14a59
jle 0x1003e044
mov dword [ebp - 0x5f0], 1
jmp 0x1003e04b
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x5f0]
add ecx, 0x24956218
cmp ecx, dword [ebp + eax*4 - 0x68]
jg 0x1003e06c
mov dword [ebp - 0x5f8], 1
jmp 0x1003e073
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x14]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x68]
imul ecx, dword [ebp - 0x5f8]
imul ecx, dword [ebp + eax*4 - 0x68]
test ecx, ecx
jne 0x1003e0a2
cmp dword [ebp - 0x15c], 0
jne 0x1003e0a2
and dword [ebp - 0x600], 0
jmp 0x1003e0ac
mov dword [ebp - 0x600], 1
mov eax, dword [ebp - 0x460]
imul eax, dword [ebp - 0x600]
cmp dword [ebp - 0x14c], eax
jle 0x1003e0cd
mov dword [ebp - 0x608], 1
jmp 0x1003e0d4
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x608], eax
jg 0x1003e0ee
mov dword [ebp - 0x610], 1
jmp 0x1003e0f5
and dword [ebp - 0x610], 0
cmp dword [ebp - 0x610], 0
ja 0x1003e10a
mov dword [ebp - 0x618], 1
jmp 0x1003e111
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0x460]
cmp dword [ebp - 0x618], eax
jle 0x1003e12b
mov dword [ebp - 0x620], 1
jmp 0x1003e132
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x68]
imul eax, dword [ebp - 0x620]
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x628], 0xc5cecce0
je 0x1003e164
cmp dword [ebp - 0x468], 0
jne 0x1003e164
and dword [ebp - 0x630], 0
jmp 0x1003e16e
mov dword [ebp - 0x630], 1
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x630], eax
jge 0x1003e188
mov dword [ebp - 0x638], 1
jmp 0x1003e18f
and dword [ebp - 0x638], 0
cmp dword [ebp - 0x638], 0xfffffffe
jle 0x1003e1a4
mov dword [ebp - 0x640], 1
jmp 0x1003e1ab
and dword [ebp - 0x640], 0
imul eax, dword [ebp - 0x640], 0x5e2
imul eax, dword [ebp - 0xfac]
cmp eax, dword [ebp - 0x14c]
je 0x1003e1d0
mov dword [ebp - 0x648], 1
jmp 0x1003e1d7
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0xdf0], eax
jmp 0x1003de6a
jmp 0x1003dde2
mov byte [ebp - 0x10a], 0
push 0x44f7
push 1
push 0x6e92
lea eax, [ebp - 0x10a]
push eax
push 0
push 0x10ad
call fcn.1003337e
add esp, 0x18
jmp 0x1003d838
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x554]
call fcn.1000ffb5
mov eax, dword [ebp - 0x106c]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x4f0], eax
mov dword [ebp - 0x258], 0x730f94f3
mov dword [ebp - 0x250], 0
jmp 0x1003e25c
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 3
jge 0x1003e278
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0x1690], 0xec2e0cf5
jmp 0x1003e24f
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x1003e2a5
push 1
push 1
push 0x5d8c
push 0x6442
push 0x2952
call fcn.1002adbb
add esp, 0x14
mov dword [ebp - 0x258], 0
jmp 0x1003e2be
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 2
jg 0x1003e414
mov byte [ebp - 0x141], 0
movzx eax, byte [ebp - 0x141]
test eax, eax
je 0x1003e309
push 0x74ba
push 0x62fa
push 0
push 0x26a3
push 0x5cd9
push 1
push 0x6116
push 0x7378
push 0
call fcn.100355e6
add esp, 0x24
mov byte [ebp - 0x113], 0
mov dword [ebp - 0x650], 0x1abb
mov dword [ebp - 0xdfc], 0x1000b3ec
cmp dword [ebp - 0x650], 0x1cc8
jle 0x1003e3a7
and dword [ebp - 0x260], 0
jmp 0x1003e346
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0x753f
jge 0x1003e3a7
and dword [ebp - 0x268], 0
jmp 0x1003e368
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0x5c5
jge 0x1003e3a5
mov eax, dword [ebp - 0x260]
add eax, dword [ebp - 0x268]
cdq
mov dword [ebp - 0xe88], eax
mov dword [ebp - 0xe84], edx
push dword [ebp - 0xe84]
push dword [ebp - 0xe88]
mov ecx, 0x10609cb8
call fcn.1000fe1e
jmp 0x1003e35b
jmp 0x1003e339
movzx eax, byte [ebp - 0x113]
test eax, eax
je 0x1003e3c6
push 0
push 0x2752
push 0x691b
call fcn.1002bac4
add esp, 0xc
mov dword [ebp - 4], 0x32
cmp dword [ebp - 0x650], 0x17d1
jge 0x1003e3e9
mov edx, dword [ebp - 0xdfc]
mov ecx, 0x10609cb8
call fcn.100118c8
jmp 0x1003e405
or dword [ebp - 4], 0xffffffff
jmp 0x1003e40f
jmp 0x1003e2b1
cmp dword [ebp - 0x4f0], 0
jle 0x10042c17
mov dword [ebp - 0x270], 0
jmp 0x1003e43a
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 3
jge 0x1003e456
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0x10a8], 0xad313dd3
jmp 0x1003e42d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x10a8], 0xffffffff
jmp 0x1003e484
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10a8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x10a8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10a8], 0x11
jge 0x1003e4c8
mov byte [ebp - 0x133], 0
movzx eax, byte [ebp - 0x133]
test eax, eax
je 0x1003e4c6
push 0x2d0
push 0
push 0x48ba
push 0
push 0x773b
push 0x1f99
call fcn.1002e080
add esp, 0x18
jmp 0x1003e469
mov dword [ebp - 0x278], 0
jmp 0x1003e4e1
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 1
jge 0x1003e4fd
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0x280], 0x831713b9
jmp 0x1003e4d4
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x280], 0xfffffffb
jmp 0x1003e52b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x280]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x280], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x280], 0xfffffff5
jg 0x1003e552
mov dword [ebp - 0xfb4], 0xe8384627
cmp dword [ebp - 0xfb4], 0
je 0x1003e550
jmp 0x1003e552
jmp 0x1003e510
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x50], 0x19ac196a
mov dword [ebp - 0x1400], 0x962600bf
mov dword [ebp - 0x6b8], 0xc9c6c2cf
mov dword [ebp - 0xb8], 0
jmp 0x1003e58d
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jge 0x1003e5a9
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x170], 9
jmp 0x1003e580
mov dword [ebp - 0xb8], 0
jmp 0x1003e5c2
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x1003e5de
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x1470], 1
jmp 0x1003e5b5
mov dword [ebp - 0x34], 0
jmp 0x1003e5ee
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jg 0x1003e915
mov dword [ebp - 0x1408], 0x2d748aee
mov dword [ebp - 0x1410], 0x983ca307
mov dword [ebp - 0x1418], 0x27f44fb6
mov dword [ebp - 0x1420], 0xffffffff
mov dword [ebp - 0x154c], 0xd89188b9
mov dword [ebp - 0x1548], 0xd89188b9
mov dword [ebp - 0x1544], 0xd89188b9
mov dword [ebp - 0x1540], 0xd89188b9
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x170], 0xdc75
je 0x1003e664
mov dword [ebp - 0x658], 1
jmp 0x1003e66b
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x50], 1
jmp 0x1003e684
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x1003e910
mov dword [ebp - 0xe08], 1
mov dword [ebp - 0x1014], 0x232c2a4e
mov dword [ebp - 0x1428], 0xffffffff
mov dword [ebp - 0x1430], 0x71fda660
push 3
lea ecx, [ebp - 0x1480]
call fcn.1000ff33
mov dword [ebp - 4], 0x34
lea eax, [ebp - 0x14fc]
push eax
lea eax, [ebp - 0x1480]
push eax
push 0
call fcn.1002c781
add esp, 0xc
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0x170]
cmp eax, dword [ebp - 0x34]
je 0x1003e894
mov eax, dword [ebp - 0x50]
cmp dword [ebp + eax*4 - 0x170], 0xfe0cd1b7
jb 0x1003e711
mov dword [ebp - 0x660], 1
jmp 0x1003e718
and dword [ebp - 0x660], 0
cmp dword [ebp - 0x660], 1
jne 0x1003e737
mov eax, dword [ebp - 0x50]
cmp dword [ebp + eax*4 - 0x170], 0
jne 0x1003e737
and dword [ebp - 0x668], 0
jmp 0x1003e741
mov dword [ebp - 0x668], 1
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0x170]
cmp dword [ebp - 0x668], eax
jge 0x1003e75f
mov dword [ebp - 0x470], 1
jmp 0x1003e766
and dword [ebp - 0x470], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x470]
mov dword [ebp + eax - 0x1470], ecx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x50]
mov ecx, dword [ebp + ecx*4 - 0x170]
add ecx, dword [ebp - 0x470]
cmp ecx, dword [ebp + eax*4 - 0x170]
jl 0x1003e7a0
mov dword [ebp - 0x670], 1
jmp 0x1003e7a7
and dword [ebp - 0x670], 0
cmp dword [ebp - 0x670], 0x5e97312b
jge 0x1003e7bf
mov dword [ebp - 0x678], 1
jmp 0x1003e7c6
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x170]
cmp dword [ebp - 0x678], eax
jle 0x1003e7e4
mov dword [ebp - 0x680], 1
jmp 0x1003e7eb
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x680]
mov dword [ebp - 0xe08], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp + eax*4 - 0x170], 4
jae 0x1003e810
mov dword [ebp - 0x688], 1
jmp 0x1003e817
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x170]
cmp dword [ebp - 0x688], eax
jg 0x1003e835
mov dword [ebp - 0x690], 1
jmp 0x1003e83c
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x170]
cmp dword [ebp - 0x690], eax
je 0x1003e85a
mov dword [ebp - 0x698], 1
jmp 0x1003e861
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x170]
cmp dword [ebp - 0x698], eax
jge 0x1003e882
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1470], 0
jne 0x1003e894
mov eax, 0x27420ea1
test eax, eax
jne 0x1003e894
and dword [ebp - 0x6a0], 0
jmp 0x1003e89e
mov dword [ebp - 0x6a0], 1
mov eax, dword [ebp - 0x6a0]
neg eax
cmp eax, 0xfffffff9
jl 0x1003e8b7
mov dword [ebp - 0x6a8], 1
jmp 0x1003e8be
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x170]
cmp dword [ebp - 0x6a8], eax
je 0x1003e8dc
mov dword [ebp - 0x6b0], 1
jmp 0x1003e8e3
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x6b8]
dec eax
mov dword [ebp - 0x6b8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1480]
call fcn.1000ffb5
jmp 0x1003e67d
jmp 0x1003e5e7
mov dword [ebp - 0x2c8], 0x730f94f3
mov dword [ebp - 0x150], 0x3c4ab274
push 1
lea ecx, [ebp - 0x1030]
call fcn.1000ff33
mov dword [ebp - 4], 0x35
mov dword [ebp - 0x478], 0xfffffffd
mov dword [ebp - 0x190], 0xbfa32a17
mov dword [ebp - 0x6e0], 0x7fce6bb2
mov dword [ebp - 0x1290], 9
mov dword [ebp - 0x128c], 9
mov dword [ebp - 0x1288], 9
mov dword [ebp - 0x1284], 9
mov dword [ebp - 0xe20], 0xfffe
mov dword [ebp - 0x1114], 1
mov dword [ebp - 0x1110], 1
mov dword [ebp - 0x110c], 1
mov dword [ebp - 0x1108], 1
lea ecx, [ebp - 0x449]
call fcn.1000ffe0
push eax
lea eax, [ebp - 0x1104]
push eax
lea eax, [ebp - 0x1114]
push eax
lea ecx, [ebp - 0x1624]
call fcn.1000ffe3
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1490]
call fcn.1000ff8f
mov byte [ebp - 4], 0x36
mov dword [ebp - 0x1064], 0xfffffffb
lea eax, [ebp - 0x1030]
push eax
push 0x94e
push 0x70c2
push 0x3b17
lea eax, [ebp - 0x1504]
push eax
push 0x3582
push 0x327b
push 0
call fcn.1002c2e0
add esp, 0x20
mov eax, dword [ebp - 0x150]
cmp eax, dword [ebp - 0x150]
jne 0x1003ea43
mov dword [ebp - 0xe14], 1
jmp 0x1003ea4a
and dword [ebp - 0xe14], 0
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x150c], eax
push 0
lea ecx, [ebp - 0x1030]
call fcn.1000ffd1
and dword [eax], 0
mov dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x150]
cmp eax, dword [ebp - 0x190]
je 0x1003ea9f
cmp dword [ebp - 0x150], 0
je 0x1003ea9f
mov dword [ebp - 0x6c0], 1
jmp 0x1003eaa6
and dword [ebp - 0x6c0], 0
cmp dword [ebp - 0x6c0], 0x8586fd5d
je 0x1003eabf
push 0
lea ecx, [ebp - 0x1030]
call fcn.1000ffd1
cmp dword [ebp - 0x150], 0xffff
jbe 0x1003ead7
mov dword [ebp - 0x6c8], 1
jmp 0x1003eade
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x6c8]
mov dword [ebp - 0x6e0], eax
mov eax, dword [ebp - 0x190]
cmp eax, dword [ebp - 0x478]
je 0x1003eb04
mov dword [ebp - 0x480], 1
jmp 0x1003eb0b
and dword [ebp - 0x480], 0
push 0
lea ecx, [ebp - 0x1030]
call fcn.1000ffd1
mov ecx, dword [ebp - 0x480]
mov dword [eax], ecx
cmp dword [ebp - 0x480], 0x254f8d36
jg 0x1003eb38
mov dword [ebp - 0x6d0], 1
jmp 0x1003eb3f
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x6d0], eax
jle 0x1003eb59
mov dword [ebp - 0x6d8], 1
jmp 0x1003eb60
and dword [ebp - 0x6d8], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1290]
cmp dword [ebp - 0x6d8], eax
jl 0x1003eb8a
cmp dword [ebp - 0x6e0], 0
je 0x1003eb8a
mov dword [ebp - 0x6e8], 1
jmp 0x1003eb91
and dword [ebp - 0x6e8], 0
xor eax, eax
sub eax, dword [ebp - 0x6e8]
cmp eax, 0xffffffff
je 0x1003ebaa
mov dword [ebp - 0xfbc], 1
jmp 0x1003ebb1
and dword [ebp - 0xfbc], 0
mov eax, 0x9a27
neg eax
cmp eax, 0x8f738f58
jbe 0x1003ebcb
mov dword [ebp - 0x6f0], 1
jmp 0x1003ebd2
and dword [ebp - 0x6f0], 0
cmp dword [ebp - 0x6f0], 0xdadf8609
jbe 0x1003ebea
mov dword [ebp - 0x6f8], 1
jmp 0x1003ebf1
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0xe20]
cmp dword [ebp - 0x6f8], eax
je 0x1003ec0b
mov dword [ebp - 0x700], 1
jmp 0x1003ec12
and dword [ebp - 0x700], 0
cmp dword [ebp - 0x700], 0xdae4
je 0x1003ec2a
mov dword [ebp - 0x708], 1
jmp 0x1003ec31
and dword [ebp - 0x708], 0
cmp dword [ebp - 0x708], 0
jne 0x1003ec55
push 1
lea ecx, [ebp - 0x1490]
call fcn.1000ffd1
cmp dword [eax], 0
jne 0x1003ec55
and dword [ebp - 0x710], 0
jmp 0x1003ec5f
mov dword [ebp - 0x710], 1
mov eax, dword [ebp - 0x1064]
cmp dword [ebp - 0x710], eax
jg 0x1003ec79
mov dword [ebp - 0x718], 1
jmp 0x1003ec80
and dword [ebp - 0x718], 0
cmp dword [ebp - 0x718], 6
jge 0x1003ec95
mov dword [ebp - 0x720], 1
jmp 0x1003ec9c
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x720]
mov dword [ebp - 0x190], eax
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x1490]
call fcn.1000ffb5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1030]
call fcn.1000ffb5
mov dword [ebp - 0x728], 0x227b
mov dword [ebp - 0xfc4], 0x1000b454
cmp dword [ebp - 0x728], 0x2555
jle 0x1003edc2
and dword [ebp - 0x288], 0
jmp 0x1003ed00
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0x5dd
jge 0x1003edc2
and dword [ebp - 0x290], 0
jmp 0x1003ed26
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0x3792
jge 0x1003edbd
and dword [ebp - 0x298], 0
jmp 0x1003ed4c
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0x7da4
jge 0x1003edb8
mov eax, dword [ebp - 0x288]
imul eax, dword [ebp - 0x290]
mov ecx, dword [ebp - 0x298]
shl eax, cl
cdq
mov dword [ebp - 0xe94], eax
mov dword [ebp - 0xe90], edx
push dword [ebp - 0xe90]
push dword [ebp - 0xe94]
lea ecx, [ebp - 0x1720]
call fcn.1000d1e0
pop ecx
pop ecx
mov dword [ebp - 0xe2c], eax
mov ecx, dword [ebp - 0xe2c]
call fcn.1000fdfe
push eax
call fcn.1004bc16
pop ecx
lea ecx, [ebp - 0x1720]
call fcn.1000fdf4
jmp 0x1003ed3f
jmp 0x1003ed19
jmp 0x1003ecf3
mov dword [ebp - 4], 0x37
cmp dword [ebp - 0x728], 0x1fb4
jge 0x1003ede1
push dword [ebp - 0xfc4]
call fcn.1004bc16
pop ecx
jmp 0x1003edfd
or dword [ebp - 4], 0xffffffff
jmp 0x1003ee07
mov dword [ebp - 0x2a0], 0
jmp 0x1003ee20
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 3
jge 0x1003ee3c
mov eax, dword [ebp - 0x2a0]
mov dword [ebp + eax*4 - 0x17d4], 0xec2e0cf5
jmp 0x1003ee13
mov dword [ebp - 0x113c], 0xfffffffc
mov dword [ebp - 0x1138], 0xfffffffc
mov dword [ebp - 0x1134], 0xfffffffc
mov dword [ebp - 0x1130], 0xfffffffc
lea ecx, [ebp - 0x459]
call fcn.1000ffe0
push eax
lea eax, [ebp - 0x112c]
push eax
lea eax, [ebp - 0x113c]
push eax
lea ecx, [ebp - 0x1634]
call fcn.1000ffe3
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x10c0]
call fcn.1000ff8f
mov dword [ebp - 4], 0x39
push 0
lea ecx, [ebp - 0x10c0]
call fcn.1000ffd1
mov dword [eax], 0xa
jmp 0x1003eed9
push 0
lea ecx, [ebp - 0x10c0]
call fcn.1000ffd1
mov dword [ebp - 0x730], eax
mov eax, dword [ebp - 0x730]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x730]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x10c0]
call fcn.1000ffd1
cmp dword [eax], 0xffffffee
jle 0x1003ef1b
mov dword [ebp - 0xe38], 0xdc7555b7
mov dword [ebp - 0x1024], 0xfffffff7
push 0x56db
push 0
call fcn.1002c762
pop ecx
pop ecx
mov eax, dword [ebp - 0xe38]
mov dword [ebp - 0x1024], eax
jmp 0x1003eeb5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10c0]
call fcn.1000ffb5
mov byte [ebp - 0x13b], 0
mov dword [ebp - 0x198], 0x11738ab6
mov dword [ebp - 0x1514], 0
mov dword [ebp - 0x558], 0x738e
mov dword [ebp - 0xfcc], 0x1000b490
cmp dword [ebp - 0x558], 0x74d7
jle 0x1003f084
and dword [ebp - 0x1f8], 0
jmp 0x1003ef7f
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0x43a8
jge 0x1003f043
and dword [ebp - 0x2a8], 0
jmp 0x1003efa5
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0x4942
jge 0x1003f03e
and dword [ebp - 0x2b0], 0
jmp 0x1003efcb
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0x6373
jge 0x1003f039
mov eax, dword [ebp - 0x2a8]
cdq
idiv dword [ebp - 0x2b0]
mov eax, dword [ebp - 0x1f8]
mov ecx, edx
shl eax, cl
cdq
mov dword [ebp - 0xea0], eax
mov dword [ebp - 0xe9c], edx
push dword [ebp - 0xe9c]
push dword [ebp - 0xea0]
lea ecx, [ebp - 0x1750]
call fcn.1000d1e0
pop ecx
pop ecx
mov dword [ebp - 0xe44], eax
mov ecx, dword [ebp - 0xe44]
call fcn.1000fdfe
push eax
call fcn.1004bc16
pop ecx
lea ecx, [ebp - 0x1750]
call fcn.1000fdf4
jmp 0x1003efbe
jmp 0x1003ef98
jmp 0x1003ef72
push 0x18ce
push 0x1dc3
push 0
push 0
push 0x72c
push 0x850
push 0x22d2
push 0x1d1b
push 0x1c8e
push 0xdbd
push 0x21aa
push 0x5c1
push 0x5e5
call dword [sym.imp.GDI32.dll_StretchDIBits]
mov dword [ebp - 0x2b8], 0
jmp 0x1003f09d
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 4
jge 0x1003f0b9
mov eax, dword [ebp - 0x2b8]
mov dword [ebp + eax*4 - 0x1590], 0x6de7
jmp 0x1003f090
mov dword [ebp - 4], 0x3a
cmp dword [ebp - 0x558], 0x70c0
jge 0x1003f0d8
push dword [ebp - 0xfcc]
call fcn.1004bc16
pop ecx
jmp 0x1003f0f4
or dword [ebp - 4], 0xffffffff
jmp 0x1003f0fe
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x1590]
imul ecx, dword [ebp + eax - 0x1590]
mov dword [ebp - 0x198], ecx
mov dword [ebp - 0x198], 0
jmp 0x1003f138
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0xffffffeb
jl 0x1003f19b
mov dword [ebp - 0x2c0], 0xd3f7bf48
mov dword [ebp - 0x2c0], 0
jmp 0x1003f164
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0x12
jle 0x1003f199
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1003f197
push 0x5126
push 0
push 0x627b
push 0
push 1
call fcn.1002eea2
add esp, 0x14
jmp 0x1003f157
jmp 0x1003f12b
movzx eax, byte [ebp - 0x13b]
test eax, eax
je 0x1003f1be
push 0x7deb
push 1
push 0x2fca
push 0
push 1
call fcn.1002eea2
add esp, 0x14
mov dword [ebp - 0x2c8], 0
jmp 0x1003f1d7
cmp dword [ebp - 0x2c8], 2
jg 0x10040329
or dword [ebp - 0x1164], 0xffffffff
or dword [ebp - 0x1160], 0xffffffff
or dword [ebp - 0x115c], 0xffffffff
or dword [ebp - 0x1158], 0xffffffff
lea ecx, [ebp - 0x4b1]
call fcn.1000ffe0
push eax
lea eax, [ebp - 0x1154]
push eax
lea eax, [ebp - 0x1164]
push eax
lea ecx, [ebp - 0x161c]
call fcn.1000ffe3
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x14a0]
call fcn.1000ff8f
mov dword [ebp - 4], 0x3c
mov dword [ebp - 0x158], 1
mov dword [ebp - 0x151c], 7
mov dword [ebp - 0x158], 0
jmp 0x1003f269
cmp dword [ebp - 0x158], 4
jge 0x1003f29b
push 4
push 0x1000
push dword [ebp - 0x4f0]
mov eax, dword [ebp - 0xb54]
mov ecx, dword [ebp - 0xc3c]
add ecx, dword [eax + 0xc]
push ecx
push 0xabf5
push 0xa269
call fcn.10029d52
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x4f8]
mov dword [ecx], eax
push 4
lea ecx, [ebp - 0xbf8]
call fcn.1000ff33
mov dword [ebp - 4], 0x4c
mov dword [ebp - 0x4b0], 0xa37d
mov dword [ebp - 0x870], 0xe44fa3fd
mov dword [ebp - 0x878], 0xb35f1971
mov dword [ebp - 0x848], 0x739
mov dword [ebp - 0xc4c], 0x1000b620
cmp dword [ebp - 0x848], 0x929
jle 0x1004045e
and dword [ebp - 0x340], 0
jmp 0x100403cd
mov dword [ebp - 0x80], 0
jmp 0x1004046e
jmp 0x10042c21
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret