Function at 0x100329cb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008492d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbcc
push esi
mov dword [ebp - 0x108], 0xb26bdde0
mov dword [ebp - 0x108], 0
jmp 0x10032a0d
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0xa
je 0x10032a43
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x10032a36
push 1
push 0x3774
call fcn.1003108c
pop ecx
pop ecx
cmp dword [ebp - 0x108], 0
je 0x10032a41
jmp 0x10032a43
jmp 0x10032a00
push 3
lea ecx, [ebp - 0x8c0]
call fcn.10025495
and dword [ebp - 4], 0
push 0
push 0x4fbe
lea eax, [ebp - 0x94c]
push eax
lea eax, [ebp - 0x8c0]
push eax
push 0x1f5a
call fcn.10031873
add esp, 0x14
mov byte [ebp - 0x7f], 0
movzx eax, byte [ebp - 0x7f]
test eax, eax
je 0x10032a90
push 0
push 0x32da
call fcn.10032144
pop ecx
pop ecx
push 0x55b8
push 0x7b66
push 0x12db
lea eax, [ebp - 0x8c0]
push eax
push 0x1c1a
push 1
call fcn.100310c8
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c0]
call fcn.10025501
mov eax, dword [0x14b216cc]
and eax, 1
jne 0x10032afb
mov eax, dword [0x14b216cc]
or eax, 1
mov dword [0x14b216cc], eax
mov dword [ebp - 4], 1
mov ecx, 0x14b216a8
call fcn.1003959e
push 0x100862db
call fcn.1006c5d6
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x34], 0x825e7a66
mov dword [ebp - 0x20], 0x13d
mov dword [ebp - 0xac4], 0x54efd0e6
push 1
lea eax, [ebp - 0x20]
push eax
call fcn.10031165
pop ecx
pop ecx
mov dword [ebp - 0x20], 0xffffffe8
jmp 0x10032b30
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x14
jl 0x10033093
mov dword [ebp - 0x98], 0xfffffff9
mov dword [ebp - 0x1c], 0x7d38c461
mov dword [ebp - 0x124], 0
jmp 0x10032b64
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 2
jge 0x10032b80
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x554], 1
jmp 0x10032b57
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xa14], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x554]
mov dword [ebp - 0xb1c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x20]
cmp dword [ebp + eax - 0x554], ecx
jg 0x10032bba
mov dword [ebp - 0x478], 1
jmp 0x10032bc1
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x478]
jg 0x10032bd8
mov dword [ebp - 0x548], 1
jmp 0x10032bdf
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x548], eax
jl 0x10032edf
mov dword [ebp - 0x4f4], 0
mov dword [ebp - 0x7c8], 7
mov dword [ebp - 0x7c4], 7
mov dword [ebp - 0x7c0], 7
mov dword [ebp - 0x7bc], 7
mov dword [ebp - 0x540], 0x12f69a01
mov dword [ebp - 0x34], 0
jmp 0x10032c3a
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xffffffef
jne 0x10032e9c
mov dword [ebp - 0x7dc], 0x1d67
mov dword [ebp - 0x7d8], 0x1d67
mov dword [ebp - 0x7d4], 0x1d67
mov dword [ebp - 0x7d0], 0x1d67
lea ecx, [ebp - 0x2d5]
call fcn.10008d2a
push eax
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x7dc]
push eax
lea ecx, [ebp - 0xb60]
call fcn.10025515
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x890]
call fcn.100254d7
mov dword [ebp - 4], 2
mov dword [ebp - 0x630], 0xfffffffc
push 3
pop eax
test eax, eax
je 0x10032e6e
cmp dword [ebp - 0x20], 0x129b45e8
jg 0x10032cd2
mov dword [ebp - 0x574], 1
jmp 0x10032cd9
and dword [ebp - 0x574], 0
cmp dword [ebp - 0x574], 0xfffa
jbe 0x10032cf7
cmp dword [ebp - 0x20], 0
je 0x10032cf7
mov dword [ebp - 0x57c], 1
jmp 0x10032cfe
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x57c]
sub eax, 0xe487
cmp eax, 1
jne 0x10032d23
mov eax, 0xc090
test eax, eax
je 0x10032d23
mov dword [ebp - 0x66c], 1
jmp 0x10032d2a
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x598], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x598]
mov dword [ebp + eax - 0x7c8], ecx
mov eax, dword [ebp - 0x4f4]
cmp dword [ebp - 0x598], eax
jg 0x10032d5f
mov dword [ebp - 0x2e4], 1
jmp 0x10032d66
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 1
je 0x10032d87
mov dword [ebp - 0x444], 1
jmp 0x10032d8e
and dword [ebp - 0x444], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x554]
add eax, dword [ebp - 0x444]
cmp eax, 0x578
jne 0x10032db4
mov dword [ebp - 0x2ec], 1
jmp 0x10032dbb
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xee6ee3e4
jne 0x10032ddf
mov dword [ebp - 0x620], 1
jmp 0x10032de6
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0xa1c], eax
push 1
lea ecx, [ebp - 0x890]
call fcn.10025506
push 1
lea ecx, [ebp - 0x890]
call fcn.10025506
imul eax, dword [eax], 0xfffffff9
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x554]
je 0x10032e2c
mov dword [ebp - 0x2f4], 1
jmp 0x10032e33
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1c], eax
jg 0x10032e50
mov dword [ebp - 0x44c], 1
jmp 0x10032e57
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x44c], eax
jg 0x10032e6e
mov dword [ebp - 0x628], 1
jmp 0x10032e75
and dword [ebp - 0x628], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x7c8]
mov dword [ebp - 0x630], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x890]
call fcn.10025501
jmp 0x10032c33
mov dword [ebp - 0x1c], 1
jmp 0x10032eac
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x10032eda
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x10032ed8
push 0x7147
push 0
push 0x78b3
call fcn.100326e8
add esp, 0xc
jmp 0x10032ea5
jmp 0x1003308e
mov dword [ebp - 0x638], 0xffffffff
mov dword [ebp - 0x128], 0
jmp 0x10032f02
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 2
jge 0x10032f1e
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x7b0], 0
jmp 0x10032ef5
mov dword [ebp - 0x1c], 0
jmp 0x10032f2e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x10
jg 0x10033027
mov dword [ebp - 0x160], 0xd727ab81
mov dword [ebp - 0x454], 1
mov dword [ebp - 0x30c], 0x8cafaca8
mov eax, dword [ebp - 0x160]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x554]
jl 0x10032f79
mov dword [ebp - 0x2fc], 1
jmp 0x10032f80
and dword [ebp - 0x2fc], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x7b0], 1
jne 0x10032f9c
mov dword [ebp - 0x54c], 1
jmp 0x10032fa3
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x2fc]
add eax, 0x3430537
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x54c]
sub ecx, dword [ebp - 0x160]
cmp eax, ecx
jg 0x10032fcd
mov dword [ebp - 0x304], 1
jmp 0x10032fd4
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x160]
add eax, dword [ebp - 0x304]
add eax, dword [ebp - 0x160]
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x30c], eax
jge 0x1003300f
mov dword [ebp - 0x4fc], 1
jmp 0x10033016
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x98], eax
jmp 0x10032f27
mov dword [ebp - 0x34], 0
jmp 0x10033037
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xfffffff4
jge 0x1003308e
mov dword [ebp - 0x1c], 0xffffffff
jmp 0x1003304d
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffee
jle 0x1003308c
mov dword [ebp - 0x98], 0xfffffff0
jmp 0x1003306c
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x16
jge 0x1003308a
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7b0]
mov dword [ebp - 0x638], eax
jmp 0x1003305f
jmp 0x10033046
jmp 0x10033030
jmp 0x10032b29
push dword [ebp + 8]
lea ecx, [ebp - 0x8d8]
call fcn.100394d9
mov dword [ebp - 4], 3
mov dword [ebp - 0x754], 1
mov dword [ebp - 0x750], 1
mov dword [ebp - 0x74c], 1
mov dword [ebp - 0x748], 1
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0xd0], 0xbda73a15
mov dword [ebp - 0x928], 8
mov dword [ebp - 0x14], 0
jmp 0x100330fb
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x1003333d
mov dword [ebp - 0x2a4], 0
mov dword [ebp - 0x78], 0xffffffff
push 1
call fcn.10031227
pop ecx
cmp dword [ebp - 0x14], 0
je 0x10033156
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x14], eax
jg 0x10033138
mov dword [ebp - 0x314], 1
jmp 0x1003313f
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x314], eax
jl 0x10033156
mov dword [ebp - 0x45c], 1
jmp 0x1003315d
and dword [ebp - 0x45c], 0
cmp dword [ebp - 0x45c], 0
jne 0x10033172
mov dword [ebp - 0x31c], 1
jmp 0x10033179
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x31c], eax
jne 0x10033190
mov dword [ebp - 0x594], 1
jmp 0x10033197
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x594], eax
jl 0x100331b5
push 0xfffffffffffffff9
pop eax
test eax, eax
je 0x100331b5
mov dword [ebp - 0x324], 1
jmp 0x100331bc
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x324], eax
jg 0x100331d3
mov dword [ebp - 0x464], 1
jmp 0x100331da
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x464]
cmp eax, dword [ebp - 0x14]
jg 0x100331f5
mov dword [ebp - 0x32c], 1
jmp 0x100331fc
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x32c]
jge 0x10033213
mov dword [ebp - 0x504], 1
jmp 0x1003321a
and dword [ebp - 0x504], 0
mov dword [ebp - 0x2a4], 1
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x334], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x334]
mov dword [ebp + eax - 0x754], ecx
mov eax, dword [ebp - 0x504]
sub eax, dword [ebp - 0x14]
cmp dword [ebp - 0x334], eax
je 0x10033260
mov dword [ebp - 0x46c], 1
jmp 0x10033267
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x46c]
test eax, eax
je 0x10033290
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x754], 0
je 0x10033290
mov dword [ebp - 0x33c], 1
jmp 0x10033297
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x33c], eax
jge 0x100332ae
mov dword [ebp - 0x558], 1
jmp 0x100332b5
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x558], eax
jge 0x100332cc
mov dword [ebp - 0x344], 1
jmp 0x100332d3
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x100332f7
cmp dword [ebp - 0x2a4], 0
jne 0x100332f7
mov dword [ebp - 0x6b0], 1
jmp 0x100332fe
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x930], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x754], 0xc0e4
jge 0x10033325
mov dword [ebp - 0x474], 1
jmp 0x1003332c
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0xd0], eax
jmp 0x100330f4
mov dword [ebp - 0x14], 0xffffffe4
jmp 0x1003334d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x100333fc
mov dword [ebp - 0xd0], 0
jmp 0x10033370
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xffffffed
jg 0x100333f7
mov dword [ebp - 0x130], 8
mov dword [ebp - 0x130], 3
jmp 0x1003339c
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
jl 0x100333f2
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x100333cf
push 1
push 0x5749
push 0x7ad
push 0x6ece
push 0xbc5
call fcn.1003125e
add esp, 0x14
mov byte [ebp - 0x83], 0
movzx eax, byte [ebp - 0x83]
test eax, eax
je 0x100333f0
push 0
push 0x15e
push 0
call dword [sym.imp.GDI32.dll_GetRegionData]
jmp 0x1003338f
jmp 0x10033363
jmp 0x10033346
lea eax, [ebp - 0x960]
push eax
lea ecx, [ebp - 0x8d8]
call fcn.10039530
push dword [eax]
lea eax, [ebp - 0x968]
push eax
lea ecx, [ebp - 0x8d8]
call fcn.10039544
push dword [eax]
lea eax, [ebp - 0x970]
push eax
lea ecx, [ebp - 0x8d8]
call fcn.10039530
push dword [eax]
mov edx, 0x1002f144
lea ecx, [ebp - 0x978]
call fcn.10039c9b
add esp, 0xc
mov dword [ebp - 0xc0], 0xe971
push 3
lea ecx, [ebp - 0x830]
call fcn.10025495
mov byte [ebp - 4], 4
mov dword [ebp - 0x980], 0x5bf2d3f5
lea eax, [ebp - 0x988]
push eax
lea eax, [ebp - 0x830]
push eax
push 0
call fcn.1003278e
add esp, 0xc
mov esi, dword [ebp - 0xc0]
push 0
lea ecx, [ebp - 0x830]
call fcn.10025506
mov dword [eax], esi
mov dword [ebp - 0xc0], 0
jmp 0x100334b6
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 2
jg 0x10033613
mov dword [ebp - 0x990], 0xffffffff
mov dword [ebp - 0x998], 0
mov dword [ebp - 0x9a0], 2
mov dword [ebp - 0x9a8], 0x6ce4a6f4
mov dword [ebp - 0x9b0], 0xa53061ec
mov dword [ebp - 0x9b8], 0xfffffffe
mov dword [ebp - 0x9c0], 0x4431fada
mov dword [ebp - 0x9c8], 1
mov dword [ebp - 0x9d0], 0x7779a7b4
mov dword [ebp - 0x9d8], 0x85dc1b6e
mov dword [ebp - 0x9e0], 2
mov dword [ebp - 0x9e8], 0xffffffff
push 1
lea ecx, [ebp - 0xa60]
call fcn.10025495
mov byte [ebp - 4], 5
mov dword [ebp - 0x9f0], 7
mov dword [ebp - 0x6b8], 0x67dbf129
push 1
lea eax, [ebp - 0xa60]
push eax
push 0x96f
lea eax, [ebp - 0x3c]
push eax
push 0x1e9
push 0x21e
push 0x21e0
push 0x1d30
call fcn.1003135c
add esp, 0x20
mov dword [ebp - 0x3c], 0
jmp 0x1003359e
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x100335b4
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xba0], 0x261718bc
jmp 0x10033597
mov dword [ebp - 0x3c], 0
jmp 0x100335c4
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x100335da
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x9f8], 0x93cc9d6c
jmp 0x100335bd
push 0x2112
lea eax, [ebp - 0x6b8]
push eax
push 0x53af
push 0x3682
push 1
push 0x2786
call fcn.100314e9
add esp, 0x18
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa60]
call fcn.10025501
jmp 0x100334a9
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x830]
call fcn.10025501
lea ecx, [ebp - 0x8d8]
call fcn.1002f0cf
mov dword [ebp - 0x538], eax
push 3
lea ecx, [ebp - 0x824]
call fcn.10025495
mov byte [ebp - 4], 6
mov dword [ebp - 0xd8], 0xffffffff
mov dword [ebp - 0xa00], 0
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa08]
push eax
push 0
push 0x27f9
push 0xad
call fcn.10031fbc
add esp, 0x14
mov dword [ebp - 0xd8], 0
jmp 0x10033693
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 2
jg 0x10033786
push 1
lea ecx, [ebp - 0x8f0]
call fcn.10025495
mov byte [ebp - 4], 7
mov dword [ebp - 0x6c0], 0xe008fb0b
push 3
lea ecx, [ebp - 0x83c]
call fcn.10025495
mov byte [ebp - 4], 8
mov dword [ebp - 0xf0], 0
jmp 0x100336e5
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 1
jge 0x10033707
push dword [ebp - 0xf0]
lea ecx, [ebp - 0x8f0]
call fcn.10025506
mov dword [eax], 0x13e13a6c
jmp 0x100336d8
push 0
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0xf0]
push eax
push 0x3cb9
call fcn.1003171e
add esp, 0x10
push 0x239b
push 0x2899
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x8f0]
push eax
push 1
lea eax, [ebp - 0x6c0]
push eax
lea eax, [ebp - 0x824]
push eax
call fcn.100315b7
add esp, 0x20
push 0
call fcn.10032959
pop ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x83c]
call fcn.10025501
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x8f0]
call fcn.10025501
jmp 0x10033686
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x824]
call fcn.10025501
movzx eax, byte [0x14b215fa]
test eax, eax
je 0x10033e33
mov ecx, 0x14b216a8
call fcn.10039655
movzx eax, al
test eax, eax
jne 0x10033e33
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x284], 9
mov dword [ebp - 0x168], 0xffffffff
mov dword [ebp - 0x178], 0
jmp 0x100337ed
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 3
jge 0x10033809
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x760], 8
jmp 0x100337e0
mov dword [ebp - 0x2c], 0
jmp 0x10033819
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1003382f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x760], 0xfffffffc
jmp 0x10033812
mov dword [ebp - 0x2c], 0
jmp 0x1003383f
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x10033a6a
mov dword [ebp - 0x138], 0xee327439
mov dword [ebp - 0xac], 0xfffffffc
mov dword [ebp - 0x100], 0x10e6b6cd
mov dword [ebp - 0x138], 0xaa81
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x760]
cmp eax, dword [ebp - 0x138]
je 0x10033891
mov dword [ebp - 0x354], 1
jmp 0x10033898
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xa10], eax
mov eax, dword [ebp - 0xac]
add eax, dword [ebp - 0xac]
cmp eax, 0xffffffff
jae 0x100338c1
mov dword [ebp - 0x34c], 1
jmp 0x100338c8
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x34c]
inc eax
inc eax
cmp eax, 5
jg 0x100338e1
mov dword [ebp - 0x50c], 1
jmp 0x100338e8
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xa18], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xa20], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x354], eax
jle 0x10033923
mov dword [ebp - 0x47c], 1
jmp 0x1003392a
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x2c], eax
je 0x1003394d
mov dword [ebp - 0x6c8], 1
jmp 0x10033954
and dword [ebp - 0x6c8], 0
cmp dword [ebp - 0x168], 0x981c5860
jb 0x1003396c
mov dword [ebp - 0x35c], 1
jmp 0x10033973
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x35c], eax
jl 0x1003398d
mov dword [ebp - 0x72c], 1
jmp 0x10033994
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0xa28], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x760]
mov dword [ebp - 0xa30], eax
cmp dword [ebp - 0xac], 0
je 0x100339cd
xor eax, eax
inc eax
je 0x100339cd
mov dword [ebp - 0x590], 1
jmp 0x100339d4
and dword [ebp - 0x590], 0
cmp dword [ebp - 0x590], 7
je 0x100339e9
mov dword [ebp - 0x734], 1
jmp 0x100339f0
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0xa38], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x760]
mov dword [ebp - 0xa40], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xa48], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x284], eax
je 0x10033a3d
mov dword [ebp - 0x364], 1
jmp 0x10033a44
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xa50], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x168], eax
jmp 0x10033838
lea eax, [ebp - 0x538]
push eax
lea eax, [ebp - 0x59c]
push eax
mov ecx, 0x14b216a8
call fcn.1003965e
lea eax, [ebp - 0xaf8]
push eax
mov ecx, 0x14b216a8
call fcn.10025976
push eax
lea ecx, [ebp - 0x59c]
call fcn.10039679
movzx eax, al
test eax, eax
je 0x10033e33
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0x28c], 8
mov dword [ebp - 0x37c], 0xffffffff
mov dword [ebp - 0xb00], 0
mov dword [ebp - 0x39c], 0xffffffff
mov dword [ebp - 0x650], 1
mov dword [ebp - 0xb08], 0
mov dword [ebp - 0x644], 1
mov dword [ebp - 0x5ec], 0x7d37
mov dword [ebp - 0x618], 0xe117
mov dword [ebp - 0x48], 0
jmp 0x10033b1b
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x10033b31
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x2d4], 0x13638ecf
jmp 0x10033b14
mov dword [ebp - 0x48], 0
jmp 0x10033b41
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x10033b57
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x878], 0xb722ba7b
jmp 0x10033b3a
mov dword [ebp - 0x74], 0x19
jmp 0x10033b67
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 5
jge 0x10033c15
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xb10], 0
mov dword [ebp - 0xb18], 0
mov dword [ebp - 0x484], 0xfffffff6
mov dword [ebp - 0x140], 0
jmp 0x10033bb2
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 4
jge 0x10033bce
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0xbd8], 0xfffffff8
jmp 0x10033ba5
mov dword [ebp - 0xe0], 0
jmp 0x10033be7
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jge 0x10033c03
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0x2d4], 0x23b6182e
jmp 0x10033bda
mov eax, dword [ebp - 0x484]
dec eax
mov dword [ebp - 0x484], eax
jmp 0x10033b60
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2d4], 0
je 0x10033c95
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0xb20], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x878], 0
jne 0x10033c4d
mov dword [ebp - 0x36c], 1
jmp 0x10033c54
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x36c]
jg 0x10033c6b
mov dword [ebp - 0x730], 1
jmp 0x10033c72
and dword [ebp - 0x730], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x878]
mov dword [ebp - 0xb28], eax
xor eax, eax
inc eax
je 0x10033c95
mov dword [ebp - 0x514], 1
jmp 0x10033c9c
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x644]
cmp dword [ebp - 0x514], eax
jg 0x10033cb6
mov dword [ebp - 0x374], 1
jmp 0x10033cbd
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x374]
sub eax, dword [ebp - 0x74]
cmp eax, 0xe41b
jge 0x10033cd9
mov dword [ebp - 0x48c], 1
jmp 0x10033ce0
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x5ec]
cmp dword [ebp - 0x37c], eax
je 0x10033d06
mov dword [ebp - 0x564], 1
jmp 0x10033d0d
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x564], eax
jle 0x10033d24
mov dword [ebp - 0x384], 1
jmp 0x10033d2b
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x74]
add eax, dword [ebp - 0x384]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x878]
cmp eax, dword [ebp - 0x28c]
je 0x10033d55
mov dword [ebp - 0x494], 1
jmp 0x10033d5c
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x494]
sub eax, dword [ebp - 0x618]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x2d4]
jge 0x10033d83
mov dword [ebp - 0x38c], 1
jmp 0x10033d8a
and dword [ebp - 0x38c], 0
cmp dword [ebp - 0x38c], 0xedb553a8
jne 0x10033da2
mov dword [ebp - 0x51c], 1
jmp 0x10033da9
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x650]
cmp dword [ebp - 0x51c], eax
jge 0x10033dc3
mov dword [ebp - 0x394], 1
jmp 0x10033dca
and dword [ebp - 0x394], 0
imul eax, dword [ebp - 0x394], 0x95c4
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0xf928
jne 0x10033df2
mov dword [ebp - 0x49c], 1
jmp 0x10033df9
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0x39c], eax
lea ecx, [ebp - 0x59c]
call fcn.10039673
mov eax, dword [eax + 4]
mov dword [ebp - 0x5f4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8d8]
call fcn.10039526
mov eax, dword [ebp - 0x5f4]
jmp 0x1003785b
and dword [ebp - 0xbc], 0
push 3
lea ecx, [ebp - 0x854]
call fcn.10025495
mov byte [ebp - 4], 9
mov dword [ebp - 0xb8], 0xfffffffb
push 1
lea eax, [ebp - 0x854]
push eax
lea eax, [ebp - 0xb30]
push eax
call fcn.10031662
add esp, 0xc
mov byte [ebp - 0x91], 0
push 0x2ae3
push 0
push 0x1844
lea eax, [ebp - 0x91]
push eax
call fcn.100324ae
add esp, 0x10
mov dword [ebp - 0xb8], 0
jmp 0x10033ea8
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jg 0x10033f02
mov dword [ebp - 0x658], 0xbbef7d65
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x854]
call fcn.10025506
mov ecx, dword [ebp - 0xb8]
add ecx, dword [eax]
mov dword [ebp - 0x658], ecx
mov byte [ebp - 0xa4], 0
movzx eax, byte [ebp - 0xa4]
test eax, eax
je 0x10033f00
push 0x7168
push 0x7401
push 0
call fcn.10031c92
add esp, 0xc
jmp 0x10033e9b
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x854]
call fcn.10025501
lea eax, [ebp - 0x8d8]
push eax
call fcn.1002f887
pop ecx
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jne 0x1003736e
mov dword [ebp - 0xb38], 0x2e0cf572
mov dword [ebp - 0xb40], 1
mov dword [ebp - 0xb48], 0x7831e42a
mov dword [ebp - 0x3a4], 0xcbad86e5
mov dword [ebp - 0xb50], 0
push 4
lea ecx, [ebp - 0xa70]
call fcn.10025495
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x5fc], 0
mov dword [ebp - 0x18c], 0
jmp 0x10033f97
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 4
jge 0x10033fb9
push dword [ebp - 0x18c]
lea ecx, [ebp - 0xa70]
call fcn.10025506
mov dword [eax], 0xfffffff7
jmp 0x10033f8a
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
lea eax, [ebp - 0x5fc]
push eax
push 0x4006
push 1
call fcn.100316d5
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xa70]
call fcn.10025501
mov dword [ebp - 0x660], 0xffffffff
mov dword [ebp - 0xb58], 0x60b0ceaf
mov dword [ebp - 0x148], 0
jmp 0x10034018
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 2
jge 0x10034034
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0xb88], 0xf9b3
jmp 0x1003400b
push 1
push 0xed1
push 0x371f
lea eax, [ebp - 0x660]
push eax
call fcn.1003171e
add esp, 0x10
cmp dword [0x14b215f4], 0
jne 0x10037001
mov dword [ebp - 0xf8], 1
push 3
lea ecx, [ebp - 0x884]
call fcn.10025495
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x170], 0
jmp 0x10034090
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 3
jge 0x100340b2
push dword [ebp - 0x170]
lea ecx, [ebp - 0x884]
call fcn.10025506
mov dword [eax], 0x57e71f09
jmp 0x10034083
mov dword [ebp - 0xf8], 0
jmp 0x100340cb
mov eax, dword [ebp - 0xf8]
dec eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0xfffffff3
jg 0x10034234
push 2
lea ecx, [ebp - 0x6d8]
call fcn.10025495
mov byte [ebp - 4], 0xc
push 1
lea ecx, [ebp - 0x86c]
call fcn.10025495
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x54], 0
jmp 0x1003410a
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x10034126
push dword [ebp - 0x54]
lea ecx, [ebp - 0x6d8]
call fcn.10025506
mov dword [eax], 0x20fe6e32
jmp 0x10034103
mov dword [ebp - 0x54], 0
jmp 0x10034136
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x10034152
push dword [ebp - 0x54]
lea ecx, [ebp - 0x86c]
call fcn.10025506
mov dword [eax], 0x989d221e
jmp 0x1003412f
push 1
lea ecx, [ebp - 0x6d8]
call fcn.10025506
and dword [eax], 0
jmp 0x10034188
push 1
lea ecx, [ebp - 0x6d8]
call fcn.10025506
mov dword [ebp - 0x4a4], eax
mov eax, dword [ebp - 0x4a4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4a4]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x6d8]
call fcn.10025506
cmp dword [eax], 0x1c
jne 0x100341f1
mov dword [ebp - 0x604], 0x7928fbc7
mov dword [ebp - 0x668], 0xee4e9120
lea eax, [ebp - 0x86c]
push eax
push 1
lea eax, [ebp - 0xf8]
push eax
push 0x7025
lea eax, [ebp - 0x604]
push eax
push 0x1657
call fcn.100317d2
add esp, 0x18
mov esi, dword [ebp - 0x668]
push 0
lea ecx, [ebp - 0x884]
call fcn.10025506
mov dword [eax], esi
jmp 0x10034164
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x10034211
push 0x5bd6
push 0
call fcn.1003274f
pop ecx
pop ecx
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x86c]
call fcn.10025501
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x6d8]
call fcn.10025501
jmp 0x100340be
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x884]
call fcn.10025501
push 1
lea ecx, [ebp - 0x784]
call fcn.10025495
mov byte [ebp - 4], 0xe
mov dword [ebp - 0xb0], 0xfffffff7
mov dword [ebp - 0x60c], 0x15912491
mov dword [ebp - 0x150], 0
jmp 0x10034281
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 1
jge 0x100342a3
push dword [ebp - 0x150]
lea ecx, [ebp - 0x784]
call fcn.10025506
mov dword [eax], 7
jmp 0x10034274
mov dword [ebp - 0xb0], 0
jmp 0x100342bc
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jl 0x10034300
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x784]
call fcn.10025506
mov dword [eax], 1
mov dword [ebp - 0x60c], 1
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x784]
call fcn.10025506
cmp dword [eax], 0
je 0x100342fe
jmp 0x100342af
jmp 0x100342af
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x784]
call fcn.10025501
mov byte [ebp - 0x274], 3
mov byte [ebp - 0x273], 0x27
mov byte [ebp - 0x272], 9
mov byte [ebp - 0x271], 0xa
mov byte [ebp - 0x270], 7
mov byte [ebp - 0x26f], 0x56
mov byte [ebp - 0x26e], 4
mov byte [ebp - 0x26d], 0x57
mov byte [ebp - 0x26c], 0x62
mov byte [ebp - 0x26b], 0x7f
mov byte [ebp - 0x26a], 0xe5
mov byte [ebp - 0x269], 0xfc
mov byte [ebp - 0x268], 0x63
mov byte [ebp - 0x267], 0x41
mov byte [ebp - 0x266], 0x8f
mov byte [ebp - 0x265], 0x6c
mov byte [ebp - 0x264], 0x32
mov byte [ebp - 0x263], 0xf4
mov byte [ebp - 0x262], 0xb9
mov byte [ebp - 0x261], 0x13
mov byte [ebp - 0x260], 0x5d
mov byte [ebp - 0x25f], 0x6b
mov byte [ebp - 0x25e], 0x6f
mov byte [ebp - 0x25d], 0xa8
mov byte [ebp - 0x25c], pe_nt_image_headers32
mov byte [ebp - 0x25b], 0x75
mov byte [ebp - 0x25a], 0x4b
mov byte [ebp - 0x259], 0x69
mov byte [ebp - 0x258], 0x71
mov byte [ebp - 0x257], 0x3e
mov byte [ebp - 0x256], 0x48
mov byte [ebp - 0x255], 0x36
mov byte [ebp - 0x254], 0x6d
mov byte [ebp - 0x253], 0xa6
mov byte [ebp - 0x252], 0x75
mov byte [ebp - 0x251], 0x84
mov byte [ebp - 0x250], 0xd9
mov byte [ebp - 0x24f], 0x40
mov byte [ebp - 0x24e], 0x5b
mov byte [ebp - 0x24d], 0x4a
mov byte [ebp - 0x24c], 0x73
mov byte [ebp - 0x24b], 0xb7
mov byte [ebp - 0x24a], 8
mov byte [ebp - 0x249], 0x5c
mov byte [ebp - 0x248], 0x7e
mov byte [ebp - 0x247], 0xc4
mov byte [ebp - 0x246], 0x95
mov byte [ebp - 0x245], 0x70
mov byte [ebp - 0x244], 0x85
mov byte [ebp - 0x243], 0x6e
mov byte [ebp - 0x242], 0xa3
mov byte [ebp - 0x241], 0x40
mov byte [ebp - 0x240], 0x55
mov byte [ebp - 0x23f], 0x40
mov byte [ebp - 0x23e], 0x91
mov byte [ebp - 0x23d], 0x6f
mov byte [ebp - 0x23c], 0xfd
mov byte [ebp - 0x23b], 0x3c
mov byte [ebp - 0x23a], 0x6f
mov byte [ebp - 0x239], 0xc1
mov byte [ebp - 0x238], 0x1b
mov byte [ebp - 0x237], 0x25
mov byte [ebp - 0x236], pe_nt_image_headers32
mov byte [ebp - 0x235], 0x3c
mov byte [ebp - 0x234], 0x32
mov byte [ebp - 0x233], 0x6d
mov byte [ebp - 0x232], 0x95
mov byte [ebp - 0x231], 0xb5
mov byte [ebp - 0x230], 0x54
mov byte [ebp - 0x22f], 0x5f
mov byte [ebp - 0x22e], 0xa4
mov byte [ebp - 0x22d], 5
mov byte [ebp - 0x22c], 0x63
mov byte [ebp - 0x22b], 0x61
mov byte [ebp - 0x22a], 0x95
mov byte [ebp - 0x229], 0xc0
mov byte [ebp - 0x228], 0xa3
mov byte [ebp - 0x227], 0x4f
mov byte [ebp - 0x226], 0x99
mov byte [ebp - 0x225], 0xc6
mov byte [ebp - 0x224], 0x77
mov byte [ebp - 0x223], 0xd5
mov byte [ebp - 0x222], 0x65
mov byte [ebp - 0x221], pe_nt_image_headers32
mov byte [ebp - 0x220], 0xee
mov byte [ebp - 0x21f], 0x5c
mov byte [ebp - 0x21e], 0xd2
mov byte [ebp - 0x21d], 0xf1
mov byte [ebp - 0x21c], 0x87
mov byte [ebp - 0x21b], 0x42
mov byte [ebp - 0x21a], 0xe0
mov byte [ebp - 0x219], 0x10
mov byte [ebp - 0x218], 0xcf
mov byte [ebp - 0x217], 0x1e
mov byte [ebp - 0x216], 0xd4
mov byte [ebp - 0x215], 0x21
mov byte [ebp - 0x214], 0xbb
mov byte [ebp - 0x213], 0xbe
mov byte [ebp - 0x212], 8
mov byte [ebp - 0x211], 0x93
mov byte [ebp - 0x210], 0x5f
mov byte [ebp - 0x20f], 8
mov byte [ebp - 0x20e], 0x99
mov byte [ebp - 0x20d], 0xe2
mov byte [ebp - 0x20c], 0x75
mov byte [ebp - 0x20b], 0x83
mov byte [ebp - 0x20a], 0x15
mov byte [ebp - 0x209], 0
mov byte [ebp - 0x208], 0x2e
mov byte [ebp - 0x207], 2
mov byte [ebp - 0x206], 0x39
mov byte [ebp - 0x205], 6
mov byte [ebp - 0x204], 0x41
mov byte [ebp - 0x203], 0xa
mov byte [ebp - 0x202], 0x5f
mov byte [ebp - 0x201], 5
mov byte [ebp - 0x200], 0
mov byte [ebp - 0x1ff], 8
mov byte [ebp - 0x1fe], 0x42
mov byte [ebp - 0x1fd], 1
mov byte [ebp - 0x1fc], 0x4b
mov byte [ebp - 0x1fb], 0xb
mov byte [ebp - 0x1fa], 9
push 4
lea ecx, [ebp - 0x2c0]
call fcn.10025495
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x24], 0x79c4185a
mov dword [ebp - 0x52c], 0xffffffff
mov dword [ebp - 0x40], 0
jmp 0x1003469e
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x100346b4
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xe8], 0
jmp 0x10034697
mov dword [ebp - 0x40], 0
jmp 0x100346c4
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x100346e0
push dword [ebp - 0x40]
lea ecx, [ebp - 0x2c0]
call fcn.10025506
mov dword [eax], 0x42c70bb7
jmp 0x100346bd
push 3
lea ecx, [ebp - 0x2c0]
call fcn.10025506
and dword [eax], 0
jmp 0x10034716
push 3
lea ecx, [ebp - 0x2c0]
call fcn.10025506
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x3ac]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x3ac]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x2c0]
call fcn.10025506
cmp dword [eax], 0
jl 0x100349b6
mov dword [ebp - 0xb4], 0xf55e00fe
mov dword [ebp - 0xb4], 0
jmp 0x1003474f
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
jg 0x10034829
push 4
lea ecx, [ebp - 0x89c]
call fcn.10025495
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x184], 0
jmp 0x10034786
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 4
jge 0x100347a5
push dword [ebp - 0x184]
lea ecx, [ebp - 0x89c]
call fcn.10025506
and dword [eax], 0
jmp 0x10034779
push 0x11c3
push 0x14d1
lea eax, [ebp - 0x24]
push eax
push 0x73df
push 0x6ca3
push 0x4045
push 0x3d44
push 0
call fcn.10032181
add esp, 0x20
push 3
lea ecx, [ebp - 0x2c0]
call fcn.10025506
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xe8], 0xe3cf9575
jb 0x100347f9
mov dword [ebp - 0x524], 1
jmp 0x10034800
and dword [ebp - 0x524], 0
push 3
lea ecx, [ebp - 0x89c]
call fcn.10025506
mov ecx, dword [ebp - 0x524]
mov dword [eax], ecx
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x89c]
call fcn.10025501
jmp 0x10034742
mov dword [ebp - 0x24], 0
jmp 0x10034839
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jg 0x100349b1
push 2
lea ecx, [ebp - 0x8b4]
call fcn.10025495
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x678], 0
mov dword [ebp - 0x158], 0
jmp 0x10034877
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 2
jge 0x10034899
push dword [ebp - 0x158]
lea ecx, [ebp - 0x8b4]
call fcn.10025506
mov dword [eax], 0x734cb441
jmp 0x1003486a
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0xe8], 0x5849
jne 0x100348b5
mov dword [ebp - 0x670], 1
jmp 0x100348bc
and dword [ebp - 0x670], 0
push 3
lea ecx, [ebp - 0x2c0]
call fcn.10025506
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xe8]
cmp dword [ebp - 0xb4], eax
jl 0x100348e6
mov dword [ebp - 0x2ac], 1
jmp 0x100348ed
and dword [ebp - 0x2ac], 0
push 0
lea ecx, [ebp - 0x8b4]
call fcn.10025506
mov ecx, dword [ebp - 0x2ac]
mov dword [eax], ecx
cmp dword [ebp - 0x2ac], 0xffffffff
jae 0x10034917
mov dword [ebp - 0x3b4], 1
jmp 0x1003491e
and dword [ebp - 0x3b4], 0
push 3
lea ecx, [ebp - 0x2c0]
call fcn.10025506
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xe8]
cmp eax, dword [ebp - 0x3b4]
je 0x10034948
mov dword [ebp - 0x4ac], 1
jmp 0x1003494f
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x4ac]
sub eax, dword [ebp - 0xb4]
imul eax, eax, 0x2c51
test eax, eax
jne 0x10034971
mov dword [ebp - 0x3bc], 1
jmp 0x10034978
and dword [ebp - 0x3bc], 0
cmp dword [ebp - 0x3bc], 0xffffffff
jg 0x1003498d
mov dword [ebp - 0x614], 1
jmp 0x10034994
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x678], eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x8b4]
call fcn.10025501
jmp 0x10034832
jmp 0x100346f2
mov dword [ebp - 0x24], 0x17
jmp 0x100349c6
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff5
jge 0x10034b3a
mov dword [ebp - 0x7c], 0x9118158f
mov dword [ebp - 0x680], 0x86de1f17
mov dword [ebp - 0x688], 0x6a6d983a
cmp dword [ebp - 0x7c], 0
jne 0x100349fd
mov dword [ebp - 0x3c4], 1
jmp 0x10034a04
and dword [ebp - 0x3c4], 0
push 3
lea ecx, [ebp - 0x2c0]
call fcn.10025506
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x92c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x61c], eax
push 3
lea ecx, [ebp - 0x2c0]
call fcn.10025506
mov ecx, dword [ebp - 0x61c]
mov dword [eax], ecx
mov esi, dword [ebp - 0x24]
push 3
lea ecx, [ebp - 0x2c0]
call fcn.10025506
cmp esi, dword [eax]
jle 0x10034a58
mov dword [ebp - 0x570], 1
jmp 0x10034a5f
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x570]
add eax, 0x5a955069
je 0x10034a7e
cmp dword [ebp - 0x7c], 0
je 0x10034a7e
mov dword [ebp - 0x4b4], 1
jmp 0x10034a85
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x3c4]
cmp eax, dword [ebp - 0x4b4]
je 0x10034a9f
mov dword [ebp - 0x3cc], 1
jmp 0x10034aa6
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x52c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe8]
cmp dword [ebp - 0x52c], eax
je 0x10034ad3
mov dword [ebp - 0x3d4], 1
jmp 0x10034ada
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x680]
cmp dword [ebp - 0x7c], eax
jl 0x10034b00
cmp dword [ebp - 0x7c], 0
je 0x10034b00
mov dword [ebp - 0x4bc], 1
jmp 0x10034b07
and dword [ebp - 0x4bc], 0
cmp dword [ebp - 0x4bc], 0
jne 0x10034b1c
mov dword [ebp - 0x624], 1
jmp 0x10034b23
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x950], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x688], eax
jmp 0x100349bf
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c0]
call fcn.10025501
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x274]
or eax, 0x49
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x274]
and ecx, 0x49
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x274]
mov word [ebp + ecx*2 - 0x918], ax
mov dword [ebp - 0x18], 2
and dword [ebp - 0xcc], 0
jmp 0x10034b9b
mov eax, dword [ebp - 0x18]
inc eax
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7b
jae 0x10035079
push 2
lea ecx, [ebp - 0x6e8]
call fcn.10025495
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x958], 0xfffffffa
push 1
lea eax, [ebp - 0xad4]
push eax
push 0x740f
push 0x12ce
lea eax, [ebp - 0x6e8]
push eax
call fcn.10031873
add esp, 0x14
push 1
lea ecx, [ebp - 0x6e8]
call fcn.10025506
and dword [eax], 0
jmp 0x10034c18
push 1
lea ecx, [ebp - 0x6e8]
call fcn.10025506
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0x3dc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x3dc]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x6e8]
call fcn.10025506
cmp dword [eax], 0xfffffffe
jne 0x10034c4c
mov dword [ebp - 0x62c], 0xf402
mov dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0x690], eax
jmp 0x10034bf4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x6e8]
call fcn.10025501
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x274]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x18], eax
jne 0x10034e95
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x274]
inc eax
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x274]
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc4], 0xffffffff
push 3
lea ecx, [ebp - 0x778]
call fcn.10025495
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x294], 0xd9ee
push 1
lea ecx, [ebp - 0x76c]
call fcn.10025495
mov byte [ebp - 4], 0x14
push 0x2a92
push 0
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x778]
push eax
call fcn.10031bab
add esp, 0x10
push 0x5ab
push 0x75c4
push 0x5f0e
push 1
lea eax, [ebp - 0x76c]
push eax
push 0x7748
push 0x3a73
lea eax, [ebp - 0x634]
push eax
push 0x20cb
push 0xde2
push 0x6180
push 0x7cd
call fcn.1003191d
add esp, 0x30
mov dword [ebp - 0xc4], 0xfffffffe
jmp 0x10034d4e
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xffffffe2
jne 0x10034da6
mov byte [ebp - 0x93], 0
movzx eax, byte [ebp - 0x93]
test eax, eax
je 0x10034d87
push 0x3f23
push 0x6d8d
push 0x6116
push 0x22ef
push 0
call fcn.100322e6
add esp, 0x14
mov byte [ebp - 0x87], 0
push 0
lea eax, [ebp - 0x87]
push eax
push 0x7774
call fcn.100323f5
add esp, 0xc
jmp 0x10034d41
mov eax, dword [ebp - 0x294]
dec eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0xfffffffa
jb 0x10034dc8
mov dword [ebp - 0x5a4], 1
jmp 0x10034dcf
and dword [ebp - 0x5a4], 0
cmp dword [ebp - 0x5a4], 1
je 0x10034de4
mov dword [ebp - 0x3e4], 1
jmp 0x10034deb
and dword [ebp - 0x3e4], 0
push 1
lea ecx, [ebp - 0x778]
call fcn.10025506
mov ecx, dword [ebp - 0x3e4]
cmp ecx, dword [eax]
jle 0x10034e0e
mov dword [ebp - 0x698], 1
jmp 0x10034e15
and dword [ebp - 0x698], 0
push 0
lea ecx, [ebp - 0x76c]
call fcn.10025506
mov dword [ebp - 0x4c4], eax
push 0
lea ecx, [ebp - 0x76c]
call fcn.10025506
mov ecx, dword [ebp - 0x4c4]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x4c4]
cmp eax, dword [ecx]
jne 0x10034e5b
mov dword [ebp - 0x63c], 1
jmp 0x10034e62
and dword [ebp - 0x63c], 0
push 0
lea ecx, [ebp - 0x778]
call fcn.10025506
or dword [eax], 0xffffffff
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x76c]
call fcn.10025501
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x778]
call fcn.10025501
jmp 0x10034b93
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x273]
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0xcc]
movzx ecx, byte [ebp + ecx - 0x276]
movzx ecx, word [ebp + ecx*2 - 0x918]
add eax, ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0x273]
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0xcc]
movzx edx, byte [ebp + edx - 0x276]
movzx edx, word [ebp + edx*2 - 0x918]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0x273]
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0xcc]
movzx edx, byte [ebp + edx - 0x276]
movzx edx, word [ebp + edx*2 - 0x918]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0x274]
mov word [ebp + ecx*2 - 0x918], ax
push 4
lea ecx, [ebp - 0xa90]
call fcn.10025495
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x120], 0x532fe223
mov dword [ebp - 0x110], 0
jmp 0x10034f52
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 4
jge 0x10034f74
push dword [ebp - 0x110]
lea ecx, [ebp - 0xa90]
call fcn.10025506
mov dword [eax], 0xb9b5
jmp 0x10034f45
mov dword [ebp - 0x120], 3
jmp 0x10034f8d
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jl 0x1003504a
mov dword [ebp - 0x7f0], 0x795010f7
mov dword [ebp - 0x7ec], 0x795010f7
mov dword [ebp - 0x7e8], 0x795010f7
mov dword [ebp - 0x7e4], 0x795010f7
lea ecx, [ebp - 0x275]
call fcn.10008d2a
push eax
lea eax, [ebp - 0x7e0]
push eax
lea eax, [ebp - 0x7f0]
push eax
lea ecx, [ebp - 0xb98]
call fcn.10025515
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa80]
call fcn.100254d7
mov byte [ebp - 4], 0x16
push 3
lea ecx, [ebp - 0xa80]
call fcn.10025506
and dword [eax], 0
mov byte [ebp - 0xa2], 0
movzx eax, byte [ebp - 0xa2]
test eax, eax
je 0x10035036
push 0x2f81
push 0x2378
push 0x5584
push 1
call fcn.10031b11
add esp, 0x10
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xa80]
call fcn.10025501
jmp 0x10034f80
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xa90]
call fcn.10025501
lea eax, [ebp - 0xcc]
push eax
push 1
push 0xced
push 0x23c0
call fcn.10031bab
add esp, 0x10
jmp 0x10034b93
push 3
lea ecx, [ebp - 0x8fc]
call fcn.10025495
mov byte [ebp - 4], 0x17
mov dword [ebp - 0xd4], 0xffffffff
lea eax, [ebp - 0x8fc]
push eax
lea eax, [ebp - 0x934]
push eax
push 1
push 0x2451
call fcn.10031c1c
add esp, 0x10
mov dword [ebp - 0xd4], 2
jmp 0x100350ca
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jl 0x100350fe
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x100350f4
push 0
push 0x4de
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
push 0
call fcn.1003299f
pop ecx
jmp 0x100350bd
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x8fc]
push eax
push 1
call fcn.10031c92
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x8fc]
call fcn.10025501
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0x918], cx
lea eax, [ebp - 0x918]
push eax
lea ecx, [ebp - 0xbb8]
call fcn.10039501
mov dword [ebp - 0x6a0], eax
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0x6a8], eax
mov byte [ebp - 4], 0x18
push dword [ebp - 0x6a8]
call fcn.1002f887
pop ecx
mov dword [ebp - 0x448], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xbb8]
call fcn.10039526
mov dword [ebp - 0x3f4], 0xb4e1265a
mov dword [ebp - 0x29c], 0x418a5273
mov dword [ebp - 0x64c], 0xfffffff6
mov dword [ebp - 0x2c4], 0xfffffffc
mov dword [ebp - 0x2b4], 1
mov dword [ebp - 0x11c], 0
jmp 0x100351c9
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 2
jge 0x100351e5
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x560], 0x14b58e17
jmp 0x100351bc
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x2c4]
cmp dword [ebp - 0x29c], eax
jle 0x1003520c
mov dword [ebp - 0x3ec], 1
jmp 0x10035213
and dword [ebp - 0x3ec], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x560]
cmp dword [ebp + eax - 0x560], ecx
jne 0x10035257
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x560]
mov dword [ebp - 0xa24], eax
cmp dword [ebp - 0x2b4], 0
je 0x10035257
mov dword [ebp - 0x6c4], 1
jmp 0x1003525e
and dword [ebp - 0x6c4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x560]
mov dword [ebp - 0x940], eax
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0xb3c], eax
cmp dword [ebp - 0x3ec], 1
jne 0x10035292
mov dword [ebp - 0x534], 1
jmp 0x10035299
and dword [ebp - 0x534], 0
cmp dword [ebp - 0x534], 0xf30b
jle 0x100352b1
mov dword [ebp - 0x720], 1
jmp 0x100352b8
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x91c], eax
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x100352d2
cmp dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x29c]
sub eax, dword [ebp - 0x2b4]
jmp 0x100352ec
and dword [ebp - 0x4cc], 0
mov dword [ebp - 0x3f4], 0xfffffff8
mov eax, dword [ebp - 0x3f4]
cmp eax, dword [ebp - 0x4cc]
jle 0x10035317
mov dword [ebp - 0x3fc], 1
jmp 0x1003531e
and dword [ebp - 0x3fc], 0
cmp dword [ebp - 0x3fc], 0
jae 0x10035333
mov dword [ebp - 0x578], 1
jmp 0x1003533a
and dword [ebp - 0x578], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x578]
mov dword [ebp + eax - 0x560], ecx
mov byte [ebp - 0x99], 0
lea eax, [ebp - 0x99]
push eax
push 1
push 0x4be2
push 0x676f
call fcn.10031da8
add esp, 0x10
and dword [ebp - 0x12c], 0
jmp 0x10035385
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0xd
jae 0x10035487
mov dword [ebp - 0x6cc], 0xfffffffa
push 3
lea ecx, [ebp - 0x8a8]
call fcn.10025495
mov byte [ebp - 4], 0x19
push 2
lea ecx, [ebp - 0x848]
call fcn.10025495
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x65c], 0x54981c58
mov dword [ebp - 0x654], 0xfffffff9
mov dword [ebp - 0x5c], 0
jmp 0x100353e2
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x100353fe
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x8a8]
call fcn.10025506
mov dword [eax], 0x3700168a
jmp 0x100353db
mov dword [ebp - 0x5c], 0
jmp 0x1003540e
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x10035427
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x848]
call fcn.10025506
and dword [eax], 0
jmp 0x10035407
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x8a8]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x6cc]
push eax
push 1
lea eax, [ebp - 0x65c]
push eax
call fcn.10031e2e
add esp, 0x18
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x848]
call fcn.10025501
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x8a8]
call fcn.10025501
xor eax, eax
mov ecx, dword [ebp - 0x12c]
mov word [ebp + ecx*2 - 0x918], ax
jmp 0x10035378
cmp dword [ebp - 0x448], 0
je 0x10037001
mov dword [ebp - 0x68], 0xffff
mov dword [ebp - 0x134], 0x462ccd20
mov dword [ebp - 0x40c], 0xffffffff
mov dword [ebp - 0x41c], 0x2e71
mov dword [ebp - 0x5a0], 0
mov dword [ebp - 0x58], 0
jmp 0x100354d3
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x100354e9
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x424], 0xa90ef874
jmp 0x100354cc
mov dword [ebp - 0x58], 0
jmp 0x100354f9
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1003550f
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x6dc], 0x1a0197cb
jmp 0x100354f2
cmp dword [ebp - 0x68], 0
jne 0x10035527
mov eax, 0xd32f
test eax, eax
jne 0x10035527
and dword [ebp - 0x42c], 0
jmp 0x10035531
mov dword [ebp - 0x42c], 1
cmp dword [ebp - 0x68], 0
je 0x10035627
cmp dword [ebp - 0x68], 0
je 0x10035553
cmp dword [ebp - 0x68], 0
je 0x10035553
mov dword [ebp - 0x404], 1
jmp 0x1003555a
and dword [ebp - 0x404], 0
imul eax, dword [ebp - 0x404], 0xffffffff
imul eax, eax, 0
add eax, dword [ebp - 0x134]
cmp eax, dword [ebp - 0x134]
jne 0x1003557e
mov dword [ebp - 0x4d4], 1
jmp 0x10035585
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0xfffffffd
jg 0x100355a6
mov dword [ebp - 0x53c], 1
jmp 0x100355ad
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x53c], eax
je 0x100355c7
mov dword [ebp - 0x414], 1
jmp 0x100355ce
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x414], eax
jne 0x100355e5
mov dword [ebp - 0x4dc], 1
jmp 0x100355ec
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x4dc]
sub eax, dword [ebp - 0x41c]
cmp dword [ebp - 0x68], eax
jne 0x10035609
mov dword [ebp - 0x700], 1
jmp 0x10035610
and dword [ebp - 0x700], 0
imul eax, dword [ebp - 0x68], 0x998
test eax, eax
je 0x10035627
mov dword [ebp - 0x664], 1
jmp 0x1003562e
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xa2c], eax
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x5a0], eax
cmp dword [ebp - 0x5a0], 0xffff
jne 0x1003565f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x424], 0
je 0x1003567b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x424], 0
je 0x1003567b
mov dword [ebp - 0x4e4], 1
jmp 0x10035682
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
add eax, 0x3da550e8
cmp eax, dword [ebp - 0x134]
jle 0x100356a7
cmp dword [ebp - 0x68], 0
je 0x100356a7
mov dword [ebp - 0x544], 1
jmp 0x100356ae
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x42c]
imul eax, dword [ebp - 0x544]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x6dc], eax
mov dword [ebp - 0xe4], 0xffffffff
push 3
lea ecx, [ebp - 0x7a8]
call fcn.10025495
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x27c], 0xd9ee
push 1
lea ecx, [ebp - 0x790]
call fcn.10025495
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0xdc], 0
jmp 0x10035717
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 3
jge 0x10035739
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x7a8]
call fcn.10025506
mov dword [eax], 0x4fc2285f
jmp 0x1003570a
push 0x25ed
push 0x967
push 1
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x790]
push eax
call fcn.10031fbc
add esp, 0x14
mov dword [ebp - 0xe4], 0xfffffffe
jmp 0x10035774
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0xffffffe2
jne 0x100357c1
mov byte [ebp - 0x8b], 0
movzx eax, byte [ebp - 0x8b]
test eax, eax
je 0x10035799
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov byte [ebp - 0xa3], 0
movzx eax, byte [ebp - 0xa3]
test eax, eax
je 0x100357bf
push 0x5cc6
push 0x1a13
push 1
call fcn.10032066
add esp, 0xc
jmp 0x10035767
mov eax, dword [ebp - 0x27c]
dec eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0xfffffffa
jb 0x100357e3
mov dword [ebp - 0x434], 1
jmp 0x100357ea
and dword [ebp - 0x434], 0
cmp dword [ebp - 0x434], 1
je 0x100357ff
mov dword [ebp - 0x4ec], 1
jmp 0x10035806
and dword [ebp - 0x4ec], 0
push 1
lea ecx, [ebp - 0x7a8]
call fcn.10025506
mov ecx, dword [ebp - 0x4ec]
cmp ecx, dword [eax]
jle 0x10035829
mov dword [ebp - 0x5e4], 1
jmp 0x10035830
and dword [ebp - 0x5e4], 0
push 0
lea ecx, [ebp - 0x790]
call fcn.10025506
mov dword [ebp - 0x43c], eax
push 0
lea ecx, [ebp - 0x790]
call fcn.10025506
mov ecx, dword [ebp - 0x43c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0x43c]
cmp eax, dword [ecx]
jne 0x10035876
mov dword [ebp - 0x704], 1
jmp 0x1003587d
and dword [ebp - 0x704], 0
push 0
lea ecx, [ebp - 0x7a8]
call fcn.10025506
or dword [eax], 0xffffffff
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x790]
call fcn.10025501
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x7a8]
call fcn.10025501
mov byte [ebp - 0x1f8], 1
mov byte [ebp - 0x1f7], 0xbe
mov byte [ebp - 0x1f6], 6
mov byte [ebp - 0x1f5], 0xd
mov byte [ebp - 0x1f4], 0x46
mov byte [ebp - 0x1f3], 0x9d
mov byte [ebp - 0x1f2], 0xed
mov byte [ebp - 0x1f1], 0x19
mov byte [ebp - 0x1f0], 0x6c
mov byte [ebp - 0x1ef], 0x3d
mov byte [ebp - 0x1ee], 0xc6
mov byte [ebp - 0x1ed], 0x65
mov byte [ebp - 0x1ec], 0x7d
mov byte [ebp - 0x1eb], 0x9d
mov byte [ebp - 0x1ea], 0xf7
mov byte [ebp - 0x1e9], 0x1b
mov byte [ebp - 0x1e8], 0x38
mov byte [ebp - 0x1e7], 0x37
mov byte [ebp - 0x1e6], 0x37
mov byte [ebp - 0x1e5], 0x87
mov byte [ebp - 0x1e4], 0xa0
mov byte [ebp - 0x1e3], 0x77
mov byte [ebp - 0x1e2], 8
mov byte [ebp - 0x1e1], 0xe3
mov byte [ebp - 0x1e0], pe_nt_image_headers32
mov byte [ebp - 0x1df], 0xb
mov byte [ebp - 0x1de], 0xc7
mov byte [ebp - 0x1dd], 0xc7
mov byte [ebp - 0x1dc], 0xbb
mov byte [ebp - 0x1db], 0x89
mov byte [ebp - 0x1da], 0x62
mov byte [ebp - 0x1d9], 0xe
mov byte [ebp - 0x1d8], 0x33
mov byte [ebp - 0x1d7], 0xaf
mov byte [ebp - 0x1d6], 0x7e
mov byte [ebp - 0x1d5], 0xe3
mov byte [ebp - 0x1d4], 0xaa
mov byte [ebp - 0x1d3], 0x6d
mov byte [ebp - 0x1d2], 0x24
mov byte [ebp - 0x1d1], 0xed
mov byte [ebp - 0x1d0], 0xc5
mov byte [ebp - 0x1cf], 0xe1
mov byte [ebp - 0x1ce], 0x97
mov byte [ebp - 0x1cd], 0xbe
mov byte [ebp - 0x1cc], 0xf3
mov byte [ebp - 0x1cb], 0x15
mov byte [ebp - 0x1ca], 0xf9
mov byte [ebp - 0x1c9], 9
mov byte [ebp - 0x1c8], 0x1b
mov byte [ebp - 0x1c7], 0xa
mov byte [ebp - 0x1c6], 0xe5
mov byte [ebp - 0x1c5], 0x52
mov byte [ebp - 0x1c4], 0xe0
mov byte [ebp - 0x1c3], 0x72
mov byte [ebp - 0x1c2], 0x9b
mov byte [ebp - 0x1c1], 0xa
mov byte [ebp - 0x1c0], 0x30
mov byte [ebp - 0x1bf], 0x2a
mov byte [ebp - 0x1be], 0xf2
mov byte [ebp - 0x1bd], 0x3a
mov byte [ebp - 0x1bc], 0xec
mov byte [ebp - 0x1bb], 0xb3
mov byte [ebp - 0x1ba], 0x1d
mov byte [ebp - 0x1b9], 0xd6
mov byte [ebp - 0x1b8], 0x66
mov byte [ebp - 0x1b7], 0x65
mov byte [ebp - 0x1b6], 0x7e
mov byte [ebp - 0x1b5], 0xc5
mov byte [ebp - 0x1b4], 1
mov byte [ebp - 0x1b3], 0xc
mov byte [ebp - 0x1b2], 0x13
mov byte [ebp - 0x1b1], 0x2c
mov byte [ebp - 0x1b0], 0xaa
mov byte [ebp - 0x1af], 0x91
mov byte [ebp - 0x1ae], 0x42
mov byte [ebp - 0x1ad], 0xa
mov byte [ebp - 0x1ac], 0x1b
mov byte [ebp - 0x1ab], 7
mov byte [ebp - 0x1aa], 0xb
mov byte [ebp - 0x1a9], 8
mov byte [ebp - 0x1a8], 0x13
mov byte [ebp - 0x1a7], 3
mov byte [ebp - 0x1a6], 5
mov byte [ebp - 0x1a5], 2
mov byte [ebp - 0x1a4], 5
mov byte [ebp - 0x1a3], 5
mov byte [ebp - 0x1a2], 8
mov byte [ebp - 0x1a1], 9
mov byte [ebp - 0x1a0], 0x1b
mov byte [ebp - 0x19f], 0xb
mov byte [ebp - 0x19e], 0x25
mov byte [ebp - 0x19d], 0
mov byte [ebp - 0x19c], 0x1b
mov byte [ebp - 0x19b], 4
mov byte [ebp - 0x19a], 0
mov dword [ebp - 0x38], 3
mov dword [ebp - 0x2e0], 0x1023f126
push 4
lea ecx, [ebp - 0x79c]
call fcn.10025495
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x50], 0
jmp 0x10035b76
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x10035b8c
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x5b0], 0xffffffff
jmp 0x10035b6f
mov dword [ebp - 0x50], 0
jmp 0x10035b9c
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jge 0x10035bb8
push dword [ebp - 0x50]
lea ecx, [ebp - 0x79c]
call fcn.10025506
mov dword [eax], 0x5ecc
jmp 0x10035b95
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x10035bd2
push 0
call fcn.10032872
pop ecx
mov dword [ebp - 0x38], 2
jmp 0x10035be2
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x10035e11
mov dword [ebp - 0x338], 0xd8c65816
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x10035c1c
push 0x1b45
push 1
push 0x4af
call fcn.100320d6
add esp, 0xc
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x5b0], 0x4e94
jle 0x10035c38
mov dword [ebp - 0x310], 1
jmp 0x10035c3f
and dword [ebp - 0x310], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5b0], 0xe5e53494
je 0x10035c5e
mov dword [ebp - 0x580], 1
jmp 0x10035c65
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x580]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x2e0]
mov ecx, dword [ebp - 0x38]
add eax, dword [ebp + ecx*4 - 0x5b0]
je 0x10035c98
mov eax, 0x389a9b8
test eax, eax
je 0x10035c98
mov dword [ebp - 0x2e8], 1
jmp 0x10035c9f
and dword [ebp - 0x2e8], 0
cmp dword [ebp - 0x2e8], 0
je 0x10035cba
mov eax, 0x8ea2
test eax, eax
jne 0x10035cba
and dword [ebp - 0x2f0], 0
jmp 0x10035cc4
mov dword [ebp - 0x2f0], 1
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x5b0]
add eax, dword [ebp - 0x2f0]
cmp eax, 1
je 0x10035ce5
mov dword [ebp - 0x2f8], 1
jmp 0x10035cec
and dword [ebp - 0x2f8], 0
cmp dword [ebp - 0x2f8], 0
je 0x10035d01
mov dword [ebp - 0x300], 1
jmp 0x10035d08
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x300]
lea eax, [ecx + eax + 7]
mov ecx, dword [ebp - 0x38]
cmp eax, dword [ebp + ecx*4 - 0x5b0]
jne 0x10035d2d
mov dword [ebp - 0x308], 1
jmp 0x10035d34
and dword [ebp - 0x308], 0
cmp dword [ebp - 0x308], 9
jne 0x10035d49
mov dword [ebp - 0x318], 1
jmp 0x10035d50
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x310]
cmp eax, dword [ebp - 0x318]
jge 0x10035d79
push 1
lea ecx, [ebp - 0x79c]
call fcn.10025506
cmp dword [eax], 0
jne 0x10035d79
and dword [ebp - 0x320], 0
jmp 0x10035d83
mov dword [ebp - 0x320], 1
mov esi, dword [ebp - 0x320]
sub esi, 0x2ef7e291
push 1
lea ecx, [ebp - 0x79c]
call fcn.10025506
cmp esi, dword [eax]
jg 0x10035dac
mov dword [ebp - 0x328], 1
jmp 0x10035db3
and dword [ebp - 0x328], 0
cmp dword [ebp - 0x328], 7
jae 0x10035dc8
mov dword [ebp - 0x280], 1
jmp 0x10035dcf
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x280]
mov dword [ebp + eax*4 - 0x5b0], ecx
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0x280], eax
jl 0x10035df9
mov dword [ebp - 0x330], 1
jmp 0x10035e00
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x338], eax
jmp 0x10035bdb
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x79c]
call fcn.10025501
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1f8]
or eax, 0xd1
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1f8]
and ecx, 0xd1
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x1f8]
mov byte [ebp + ecx - 0x5e0], al
mov dword [ebp - 0xec], 8
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x10035e8b
push 1
push 0x1034
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
mov dword [ebp - 0xec], 0xffffffe8
jmp 0x10035ea4
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0xfffffff0
jge 0x10035ef7
mov dword [ebp - 0x13c], 0
jmp 0x10035ec6
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 2
jge 0x10035ee2
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x93c], 0xbb11accb
jmp 0x10035eb9
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xec]
mov dword [ebp + eax - 0x93c], ecx
jmp 0x10035e97
mov dword [ebp - 0x28], 2
and dword [ebp - 0x114], 0
jmp 0x10035f0f
mov eax, dword [ebp - 0x28]
inc eax
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x5f
jae 0x10036466
mov dword [ebp - 0xf4], 0x13b91020
mov dword [ebp - 0x6ec], 0xffffffff
mov dword [ebp - 0x674], 1
mov dword [ebp - 0x144], 0
jmp 0x10035f50
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jge 0x10035f6c
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x954], 0x2e42
jmp 0x10035f43
mov dword [ebp - 0xf4], 0
jmp 0x10035f85
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xfffffff7
jl 0x10036065
mov dword [ebp - 0x70c], 0xffffffff
mov dword [ebp - 0x67c], 0x504dbf0c
mov dword [ebp - 0x818], 0xfd47030f
mov dword [ebp - 0x814], 0xfd47030f
mov dword [ebp - 0x810], 0xfd47030f
mov dword [ebp - 0x80c], 0xfd47030f
lea ecx, [ebp - 0x2ad]
call fcn.10008d2a
push eax
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x818]
push eax
lea ecx, [ebp - 0xb80]
call fcn.10025515
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xaa0]
call fcn.100254d7
mov byte [ebp - 4], 0x1e
mov byte [ebp - 0x7e], 0
push 1
lea eax, [ebp - 0x7e]
push eax
call fcn.10032144
pop ecx
pop ecx
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x6ec]
push eax
push 0x6689
lea eax, [ebp - 0x67c]
push eax
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x70c]
push eax
lea eax, [ebp - 0xaa0]
push eax
push 1
call fcn.10032181
add esp, 0x20
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xaa0]
call fcn.10025501
jmp 0x10035f78
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1f8]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x28], eax
jne 0x10036180
mov dword [ebp - 0x684], 0xce456251
mov dword [ebp - 0x68c], 1
mov dword [ebp - 0x804], 0x1c17c774
mov dword [ebp - 0x800], 0x1c17c774
mov dword [ebp - 0x7fc], 0x1c17c774
mov dword [ebp - 0x7f8], 0x1c17c774
lea ecx, [ebp - 0x2a5]
call fcn.10008d2a
push eax
lea eax, [ebp - 0x7f4]
push eax
lea eax, [ebp - 0x804]
push eax
lea ecx, [ebp - 0xb90]
call fcn.10025515
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xab0]
call fcn.100254d7
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x6fc], 0x8f2ba167
mov byte [ebp - 0x80], 0
movzx eax, byte [ebp - 0x80]
test eax, eax
je 0x1003611f
push 0x2955
push 0x17a2
push 0
call fcn.10032445
add esp, 0xc
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x6fc]
push eax
lea eax, [ebp - 0xab0]
push eax
lea eax, [ebp - 0x68c]
push eax
push 1
call fcn.100322e6
add esp, 0x14
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xab0]
call fcn.10025501
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x1f8]
inc eax
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x1f8]
mov ecx, dword [ebp - 0x28]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x28], eax
jmp 0x10035f07
mov dword [ebp - 0x44], 0
push 3
lea ecx, [ebp - 0x58c]
call fcn.10025495
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x14c], 0
jmp 0x100361b1
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 3
jge 0x100361d3
push dword [ebp - 0x14c]
lea ecx, [ebp - 0x58c]
call fcn.10025506
mov dword [eax], 1
jmp 0x100361a4
push 1
push 0x44e8
lea eax, [ebp - 0x44]
push eax
call fcn.100323f5
add esp, 0xc
mov dword [ebp - 0x44], 0
jmp 0x100361f6
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jg 0x10036352
mov dword [ebp - 0x154], 0
jmp 0x10036219
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 1
jge 0x10036235
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x714], 0xfffffff7
jmp 0x1003620c
mov byte [ebp - 0x82], 0
movzx eax, byte [ebp - 0x82]
test eax, eax
je 0x1003624f
push 0
call fcn.1003283b
pop ecx
xor eax, eax
jne 0x10036260
push 2
lea ecx, [ebp - 0x58c]
call fcn.10025506
mov eax, 0xffff
cmp eax, 9
je 0x10036276
mov dword [ebp - 0x340], 1
jmp 0x1003627d
and dword [ebp - 0x340], 0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x58c]
call fcn.10025506
mov ecx, dword [ebp - 0x340]
cmp ecx, dword [eax]
jl 0x100362a1
mov dword [ebp - 0x348], 1
jmp 0x100362a8
and dword [ebp - 0x348], 0
push 0
lea ecx, [ebp - 0x58c]
call fcn.10025506
mov esi, eax
push dword [ebp - 0x44]
lea ecx, [ebp - 0x58c]
call fcn.10025506
mov ecx, dword [ebp - 0x348]
add ecx, dword [eax]
cmp dword [esi], ecx
jle 0x100362dd
mov dword [ebp - 0x350], 1
jmp 0x100362e4
and dword [ebp - 0x350], 0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x58c]
call fcn.10025506
mov eax, dword [eax]
cmp eax, dword [ebp - 0x350]
jge 0x10036308
mov dword [ebp - 0x358], 1
jmp 0x1003630f
and dword [ebp - 0x358], 0
push dword [ebp - 0x44]
lea ecx, [ebp - 0x58c]
call fcn.10025506
mov ecx, dword [ebp - 0x358]
cmp ecx, dword [eax]
jne 0x10036333
mov dword [ebp - 0x360], 1
jmp 0x1003633a
and dword [ebp - 0x360], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x360]
mov dword [ebp + eax - 0x714], ecx
jmp 0x100361ef
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x58c]
call fcn.10025501
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x1f7]
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x114]
movzx ecx, byte [ebp + ecx - 0x1fa]
movsx ecx, byte [ebp + ecx - 0x5e0]
or eax, ecx
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [ebp + ecx - 0x1f7]
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x114]
movzx edx, byte [ebp + edx - 0x1fa]
movsx edx, byte [ebp + edx - 0x5e0]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [ebp + ecx - 0x1f8]
mov byte [ebp + ecx - 0x5e0], al
mov dword [ebp - 0xfc], 8
mov byte [ebp - 0x84], 0
movzx eax, byte [ebp - 0x84]
test eax, eax
je 0x100363ee
push 1
push 0x1034
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
mov dword [ebp - 0xfc], 0xffffffe8
jmp 0x10036407
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0xfffffff0
jge 0x1003645a
mov dword [ebp - 0x15c], 0
jmp 0x10036429
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 2
jge 0x10036445
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x948], 0xbb11accb
jmp 0x1003641c
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xfc]
mov dword [ebp + eax - 0x948], ecx
jmp 0x100363fa
and dword [ebp - 0x114], 0
jmp 0x10035f07
mov dword [ebp - 0xae4], 0xffffffff
mov dword [ebp - 0x3b0], 0xfffffff7
mov dword [ebp - 0x69c], 0xd1454bcd
mov dword [ebp - 0x694], 7
push 3
lea ecx, [ebp - 0x860]
call fcn.10025495
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x368], 0x50b7f45
mov dword [ebp - 0x380], 3
mov dword [ebp - 0x4c], 0
jmp 0x100364c3
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x100364d9
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x198], 0x68ec0ae9
jmp 0x100364bc
mov dword [ebp - 0x4c], 0
jmp 0x100364e9
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x10036505
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x860]
call fcn.10025506
mov dword [eax], 0xafa01777
jmp 0x100364e2
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x198], 0
jmp 0x10036533
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x198]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x198], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x198], 0xffffffeb
jge 0x100366f9
mov dword [ebp - 0x118], 0x6cce57bf
mov dword [ebp - 0x95c], 0xffffffff
mov dword [ebp - 0x71c], 0x1b9849b7
mov dword [ebp - 0xa34], 0xab3cf813
mov dword [ebp - 0x964], 0xec352115
mov dword [ebp - 0xb24], 0xffffffff
push 3
lea ecx, [ebp - 0xad0]
call fcn.10025495
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x96c], 9
lea eax, [ebp - 0xad0]
push eax
lea eax, [ebp - 0xa3c]
push eax
push 1
call fcn.10032445
add esp, 0xc
mov dword [ebp - 0x118], 0xfffffffe
jmp 0x100365cf
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 3
jl 0x100366b7
mov dword [ebp - 0x974], 9
mov dword [ebp - 0xaf4], 0x76b87d0f
mov dword [ebp - 0x97c], 0
mov dword [ebp - 0xa44], 0x61ece30
mov dword [ebp - 0x984], 0xffffffff
mov dword [ebp - 0xb4c], 0x7d393e75
mov dword [ebp - 0x98c], 0x80eec299
mov dword [ebp - 0xa4c], 0x3d5943e2
mov dword [ebp - 0x994], 0xfffffffe
mov dword [ebp - 0xafc], 0x7c869b7d
mov dword [ebp - 0x99c], 0x9a275ff4
push 1
lea ecx, [ebp - 0xac0]
call fcn.10025495
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x164], 0
jmp 0x10036674
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 1
jge 0x10036696
push dword [ebp - 0x164]
lea ecx, [ebp - 0xac0]
call fcn.10025506
mov dword [eax], 0xfffffff7
jmp 0x10036667
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0xac0]
call fcn.10025501
jmp 0x100365c2
push 0
push 0x22c5
lea eax, [ebp - 0x694]
push eax
push 0x3924
lea eax, [ebp - 0x380]
push eax
push 0x3aff
lea eax, [ebp - 0x71c]
push eax
call fcn.1003786a
add esp, 0x1c
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xad0]
call fcn.10025501
jmp 0x10036518
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x198], 7
jg 0x10036715
mov dword [ebp - 0x370], 1
jmp 0x1003671c
and dword [ebp - 0x370], 0
mov esi, dword [ebp - 0x69c]
push 2
lea ecx, [ebp - 0x860]
call fcn.10025506
cmp esi, dword [eax]
jg 0x1003673f
mov dword [ebp - 0x378], 1
jmp 0x10036746
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x370]
cmp eax, dword [ebp - 0x378]
jne 0x10036760
mov dword [ebp - 0x388], 1
jmp 0x10036767
and dword [ebp - 0x388], 0
cmp dword [ebp - 0x380], 0
jne 0x10036789
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x198], 0
jne 0x10036789
and dword [ebp - 0x390], 0
jmp 0x10036793
mov dword [ebp - 0x390], 1
mov eax, dword [ebp - 0x388]
cmp eax, dword [ebp - 0x390]
jge 0x100367ad
mov dword [ebp - 0x398], 1
jmp 0x100367b4
and dword [ebp - 0x398], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x198]
cmp dword [ebp - 0x398], eax
jge 0x100367d5
mov dword [ebp - 0x3a0], 1
jmp 0x100367dc
and dword [ebp - 0x3a0], 0
cmp dword [ebp - 0x3a0], 1
jne 0x100367f1
mov dword [ebp - 0x3a8], 1
jmp 0x100367f8
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0xffffffff
jne 0x10036819
mov dword [ebp - 0x3b8], 1
jmp 0x10036820
and dword [ebp - 0x3b8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3b8]
mov dword [ebp + eax - 0x198], ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x860]
call fcn.10025501
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x5e0], 0
push 2
lea ecx, [ebp - 0x6f8]
call fcn.10025495
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x104], 0x57976326
mov dword [ebp - 0x6ac], 0x15aa9614
mov dword [ebp - 0x724], 0xfffffffe
mov dword [ebp - 0x710], 0xffffffff
lea eax, [ebp - 0xa54]
push eax
push 1
lea eax, [ebp - 0x6f8]
push eax
push 0x602e
call fcn.100324ae
add esp, 0x10
mov dword [ebp - 0x104], 0
jmp 0x100368bf
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 1
jg 0x1003698e
mov dword [ebp - 0xa0], 1
mov dword [ebp - 0x6a4], 0xc2377963
mov dword [ebp - 0xa0], 0
jmp 0x100368f9
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jg 0x10036989
mov dword [ebp - 0x708], 0xe401d933
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x6f8]
call fcn.10025506
mov esi, eax
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x6f8]
call fcn.10025506
mov ecx, dword [esi]
mov dword [eax], ecx
lea eax, [ebp - 0x6f8]
push eax
push 1
lea eax, [ebp - 0x708]
push eax
lea eax, [ebp - 0x6a4]
push eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x724]
push eax
lea eax, [ebp - 0x6ac]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x68fa
lea eax, [ebp - 0x710]
push eax
push 0x6c02
call fcn.1003252b
add esp, 0x2c
jmp 0x100368ec
jmp 0x100368b2
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x6f8]
call fcn.10025501
lea eax, [ebp - 0x5e0]
push eax
lea ecx, [ebp - 0xb78]
call fcn.1002536e
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x30], 0xa439beb0
mov dword [ebp - 0x5d0], 0x265a
mov dword [ebp - 0x5cc], 0x265a
mov dword [ebp - 0x5c8], 0x265a
mov dword [ebp - 0x5c4], 0x265a
mov dword [ebp - 0x5c0], 0xffffffff
mov dword [ebp - 0x5bc], 0xffffffff
mov dword [ebp - 0x5b8], 0xffffffff
mov dword [ebp - 0x5b4], 0xffffffff
mov dword [ebp - 0x290], 0x49690b28
mov dword [ebp - 0x9a4], 0xfffffffa
mov dword [ebp - 0xb2c], 0xffffffff
mov dword [ebp - 0x728], 0
mov dword [ebp - 0x9ac], 0xad942a26
mov dword [ebp - 0x16c], 0
jmp 0x10036a55
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 2
jge 0x10036a71
mov eax, dword [ebp - 0x16c]
mov dword [ebp + eax*4 - 0x56c], 0xffffffff
jmp 0x10036a48
cmp dword [ebp - 0x30], 0
jne 0x10036cd1
mov dword [ebp - 0x400], 7
push 2
lea ecx, [ebp - 0x8e4]
call fcn.10025495
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x64], 0
jmp 0x10036aa6
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x10036abc
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x7b8], 0
jmp 0x10036a9f
mov dword [ebp - 0x64], 0
jmp 0x10036acc
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x10036ae8
push dword [ebp - 0x64]
lea ecx, [ebp - 0x8e4]
call fcn.10025506
mov dword [eax], 0xfffffff6
jmp 0x10036ac5
mov dword [ebp - 0x30], 0
jmp 0x10036af8
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jg 0x10036cbd
mov dword [ebp - 0x6b4], 0xbf3b8cff
cmp dword [ebp - 0x30], 0
je 0x10036b39
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x5c0]
cmp dword [ebp + eax - 0x5c0], ecx
jl 0x10036b39
mov dword [ebp - 0x3c0], 1
jmp 0x10036b40
and dword [ebp - 0x3c0], 0
cmp dword [ebp - 0x3c0], 0x32d7af2c
jl 0x10036b58
mov dword [ebp - 0x3c8], 1
jmp 0x10036b5f
and dword [ebp - 0x3c8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7b8]
cmp dword [ebp - 0x3c8], eax
jle 0x10036b80
mov dword [ebp - 0x3d0], 1
jmp 0x10036b87
and dword [ebp - 0x3d0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7b8]
cmp eax, dword [ebp - 0x3d0]
jne 0x10036ba8
mov dword [ebp - 0x3d8], 1
jmp 0x10036baf
and dword [ebp - 0x3d8], 0
cmp dword [ebp - 0x3d8], 0xfffffffd
jne 0x10036bc4
mov dword [ebp - 0x3e0], 1
jmp 0x10036bcb
and dword [ebp - 0x3e0], 0
cmp dword [ebp - 0x3e0], 0x3582f80c
jl 0x10036be3
mov dword [ebp - 0x3e8], 1
jmp 0x10036bea
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x5d0]
cmp dword [ebp - 0x3e8], eax
jg 0x10036c08
mov dword [ebp - 0x3f0], 1
jmp 0x10036c0f
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp + ecx*4 - 0x5d0]
imul ecx, dword [ebp - 0x3f0]
cmp dword [ebp + eax*4 - 0x5d0], ecx
jl 0x10036c38
mov dword [ebp - 0x288], 1
jmp 0x10036c3f
and dword [ebp - 0x288], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x288]
mov dword [ebp + eax - 0x56c], ecx
cmp dword [ebp - 0x288], 0xffff
je 0x10036c6a
mov dword [ebp - 0x3f8], 1
jmp 0x10036c71
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 0
jb 0x10036c92
mov dword [ebp - 0x408], 1
jmp 0x10036c99
and dword [ebp - 0x408], 0
push 0
lea ecx, [ebp - 0x8e4]
call fcn.10025506
mov ecx, dword [ebp - 0x408]
mov dword [eax], ecx
mov dword [ebp - 0x6b4], 1
jmp 0x10036af1
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x8e4]
call fcn.10025501
jmp 0x10036d59
mov dword [ebp - 0xa64], 0xe80a7c6d
mov dword [ebp - 0x9b4], 7
mov dword [ebp - 0xb04], 0x2f23d37f
mov dword [ebp - 0x9bc], 0xfffffffd
mov dword [ebp - 0xa74], 0xdb62b2fa
mov dword [ebp - 0x9c4], 1
mov dword [ebp - 0xb44], 0xfffffffe
mov dword [ebp - 0x174], 0
jmp 0x10036d30
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 1
jge 0x10036d4c
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x9cc], 0xfffffff7
jmp 0x10036d23
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x56c]
mov dword [ebp - 0xa84], eax
mov eax, 0xfffb
test eax, eax
jne 0x10036d81
mov dword [ebp - 0x410], 1
jmp 0x10036d88
and dword [ebp - 0x410], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x56c]
cmp eax, dword [ebp - 0x410]
jge 0x10036da9
mov dword [ebp - 0x418], 1
jmp 0x10036db0
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x418], eax
jle 0x10036dc7
mov dword [ebp - 0x420], 1
jmp 0x10036dce
and dword [ebp - 0x420], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x420]
sub ecx, dword [ebp + eax - 0x5d0]
push 4
pop eax
imul eax, eax, 3
cmp ecx, dword [ebp + eax - 0x5d0]
jle 0x10036e0b
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x5c0], 0
je 0x10036e0b
mov dword [ebp - 0x428], 1
jmp 0x10036e12
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0x428], eax
jne 0x10036e2c
mov dword [ebp - 0x430], 1
jmp 0x10036e33
and dword [ebp - 0x430], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5c0]
cmp dword [ebp - 0x430], eax
jle 0x10036e53
mov dword [ebp - 0x438], 1
jmp 0x10036e5a
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x728], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5c0]
add eax, dword [ebp - 0x30]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x56c]
jle 0x10036e90
mov dword [ebp - 0x440], 1
jmp 0x10036e97
and dword [ebp - 0x440], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x440]
mov dword [ebp + eax - 0x56c], ecx
and dword [ebp - 0x180], 0
jmp 0x10036ec0
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0xd
jae 0x10036ed9
mov eax, dword [ebp - 0x180]
mov byte [ebp + eax - 0x5e0], 0
jmp 0x10036eb3
push 3
lea ecx, [ebp - 0xaf0]
call fcn.10025495
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x9d4], 0xffffffff
mov dword [ebp - 0xb0c], 0
mov dword [ebp - 0x9dc], 0xfffffff6
mov dword [ebp - 0xa94], 1
push 4
lea ecx, [ebp - 0xae0]
call fcn.10025495
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x6bc], 1
lea eax, [ebp - 0x10c]
push eax
push 1
lea eax, [ebp - 0xaf0]
push eax
call fcn.100326e8
add esp, 0xc
mov dword [ebp - 0x10c], 0
jmp 0x10036f5e
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 4
jge 0x10036f80
push dword [ebp - 0x10c]
lea ecx, [ebp - 0xae0]
call fcn.10025506
mov dword [eax], 4
jmp 0x10036f51
lea eax, [ebp - 0x6bc]
push eax
push 1
call fcn.1003274f
pop ecx
pop ecx
mov byte [ebp - 0x86], 0
movzx eax, byte [ebp - 0x86]
test eax, eax
je 0x10036fb6
push 0x7e06
push 0x5e09
push 1
call fcn.1003278e
add esp, 0xc
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xae0]
call fcn.10025501
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xaf0]
call fcn.10025501
push 0
push 0
lea eax, [ebp - 0xb78]
push eax
push dword [ebp - 0x448]
call fcn.1003829b
add esp, 0x10
mov dword [0x14b215f4], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xb78]
call fcn.100253f6
mov dword [ebp - 0x744], 1
mov dword [ebp - 0x740], 1
mov dword [ebp - 0x73c], 1
mov dword [ebp - 0x738], 1
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc8], 0xbda73a15
mov dword [ebp - 0x9e4], 8
mov dword [ebp - 0x10], 0
jmp 0x10037054
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x100372ab
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x70], 0xffffffff
mov byte [ebp - 0x88], 0
push 1
push 0x45df
lea eax, [ebp - 0x88]
push eax
call fcn.100327f2
add esp, 0xc
cmp dword [ebp - 0x10], 0
je 0x100370c4
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x10], eax
jg 0x100370a6
mov dword [ebp - 0x450], 1
jmp 0x100370ad
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x450], eax
jl 0x100370c4
mov dword [ebp - 0x458], 1
jmp 0x100370cb
and dword [ebp - 0x458], 0
cmp dword [ebp - 0x458], 0
jne 0x100370e0
mov dword [ebp - 0x460], 1
jmp 0x100370e7
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x460], eax
jne 0x100370fe
mov dword [ebp - 0x468], 1
jmp 0x10037105
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x468], eax
jl 0x10037123
push 0xfffffffffffffff9
pop eax
test eax, eax
je 0x10037123
mov dword [ebp - 0x470], 1
jmp 0x1003712a
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x470], eax
jg 0x10037141
mov dword [ebp - 0x2dc], 1
jmp 0x10037148
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x2dc]
cmp eax, dword [ebp - 0x10]
jg 0x10037163
mov dword [ebp - 0x480], 1
jmp 0x1003716a
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x480]
jge 0x10037181
mov dword [ebp - 0x488], 1
jmp 0x10037188
and dword [ebp - 0x488], 0
mov dword [ebp - 0x298], 1
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x490], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x490]
mov dword [ebp + eax - 0x744], ecx
mov eax, dword [ebp - 0x488]
sub eax, dword [ebp - 0x10]
cmp dword [ebp - 0x490], eax
je 0x100371ce
mov dword [ebp - 0x498], 1
jmp 0x100371d5
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x498]
test eax, eax
je 0x100371fe
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x744], 0
je 0x100371fe
mov dword [ebp - 0x4a0], 1
jmp 0x10037205
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x4a0], eax
jge 0x1003721c
mov dword [ebp - 0x4a8], 1
jmp 0x10037223
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x4a8], eax
jge 0x1003723a
mov dword [ebp - 0x4b0], 1
jmp 0x10037241
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jne 0x10037265
cmp dword [ebp - 0x298], 0
jne 0x10037265
mov dword [ebp - 0x718], 1
jmp 0x1003726c
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xb34], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x744], 0xc0e4
jge 0x10037293
mov dword [ebp - 0x4b8], 1
jmp 0x1003729a
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0xc8], eax
jmp 0x1003704d
mov dword [ebp - 0x10], 0xffffffe4
jmp 0x100372bb
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x10037350
mov dword [ebp - 0xc8], 0
jmp 0x100372de
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0xffffffed
jg 0x1003734b
mov dword [ebp - 0x188], 8
mov dword [ebp - 0x188], 3
jmp 0x1003730a
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
jl 0x10037349
mov byte [ebp - 0x8a], 0
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x1003732d
push 1
call fcn.1003283b
pop ecx
mov byte [ebp - 0x8c], 0
movzx eax, byte [ebp - 0x8c]
test eax, eax
je 0x10037347
push 1
call fcn.10032872
pop ecx
jmp 0x100372fd
jmp 0x100372d1
jmp 0x100372b4
cmp dword [0x14b215f4], 0
je 0x1003736e
mov ecx, dword [ebp + 8]
call fcn.10039562
push eax
call dword [0x14b215f4]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x60], 0x42c7
mov dword [ebp - 0x5f8], 0
mov dword [ebp - 0x9ec], 0xf27779e4
mov dword [ebp - 0xaa4], 0xffffffff
mov dword [ebp - 0x9f4], 0xcbd72f54
mov dword [ebp - 0x2a0], 0xffffffff
mov dword [ebp - 0x6c], 0
jmp 0x100373b7
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x100373cd
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xbc8], 1
jmp 0x100373b0
mov dword [ebp - 0x6c], 0
jmp 0x100373dd
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x100373f3
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x924], 0xa2b52f10
jmp 0x100373d6
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xb14], eax
imul eax, dword [ebp - 0x60], 0
test eax, eax
je 0x10037712
mov dword [ebp - 0x190], 0x93c1
mov dword [ebp - 0x640], 0xffff
mov dword [ebp - 0x4e8], 0xb83de37d
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x10037440
push 1
call fcn.100328da
pop ecx
mov dword [ebp - 0x60], 0xffffffeb
jmp 0x10037450
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x32
jle 0x1003770d
push 3
lea ecx, [ebp - 0x2d0]
call fcn.10025495
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x9fc]
push eax
call fcn.10032911
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x2d0]
call fcn.10025506
and dword [eax], 0
jmp 0x100374b6
push 0
lea ecx, [ebp - 0x2d0]
call fcn.10025506
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x4c0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4c0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x2d0]
call fcn.10025506
cmp dword [eax], 8
jne 0x100376f9
mov dword [ebp - 0x5e8], 0xfffffff6
mov dword [ebp - 0x5f0], 0xffffffff
mov dword [ebp - 0x4e0], 0xad11e758
mov dword [ebp - 0x508], 0x41ce094b
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0xab4], eax
push 0
lea ecx, [ebp - 0x2d0]
call fcn.10025506
cmp dword [ebp - 0x640], 7
jbe 0x10037522
mov dword [ebp - 0x648], 1
jmp 0x10037529
and dword [ebp - 0x648], 0
push 0
lea ecx, [ebp - 0x2d0]
call fcn.10025506
cmp dword [ebp - 0x5e8], 0xa9e1a0e
jle 0x1003754e
mov dword [ebp - 0x4c8], 1
jmp 0x10037555
and dword [ebp - 0x4c8], 0
push 0
lea ecx, [ebp - 0x2d0]
call fcn.10025506
mov ecx, dword [ebp - 0x4c8]
cmp ecx, dword [eax]
jle 0x1003757b
cmp dword [ebp - 0x60], 0
jne 0x1003757b
and dword [ebp - 0x4d0], 0
jmp 0x10037585
mov dword [ebp - 0x4d0], 1
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x4d0], eax
jne 0x1003759f
mov dword [ebp - 0x4d8], 1
jmp 0x100375a6
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x5f0], eax
mov dword [ebp - 0x4e0], 0xd341
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x4e8], eax
mov esi, dword [ebp - 0x4e8]
push 0
lea ecx, [ebp - 0x2d0]
call fcn.10025506
sub esi, dword [eax]
cmp esi, 0xf0e26a25
jbe 0x100375f1
mov dword [ebp - 0x4f0], 1
jmp 0x100375f8
and dword [ebp - 0x4f0], 0
push 0
lea ecx, [ebp - 0x2d0]
call fcn.10025506
mov ecx, dword [ebp - 0x4f0]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x508]
jg 0x10037621
mov dword [ebp - 0x4f8], 1
jmp 0x10037628
and dword [ebp - 0x4f8], 0
cmp dword [ebp - 0x4f8], 0xffffffff
jge 0x1003763d
mov dword [ebp - 0x500], 1
jmp 0x10037644
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x60]
imul eax, dword [ebp - 0x500]
imul eax, dword [ebp - 0x190]
cmp eax, dword [ebp - 0x508]
jg 0x10037669
mov dword [ebp - 0x510], 1
jmp 0x10037670
and dword [ebp - 0x510], 0
push 0
lea ecx, [ebp - 0x2d0]
call fcn.10025506
mov ecx, dword [ebp - 0x510]
cmp ecx, dword [eax]
jl 0x10037693
mov dword [ebp - 0x518], 1
jmp 0x1003769a
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x518]
add eax, 5
je 0x100376ba
mov eax, 0xaea381e1
test eax, eax
je 0x100376ba
mov dword [ebp - 0x520], 1
jmp 0x100376c1
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x520], eax
jge 0x100376de
cmp dword [ebp - 0x60], 0
jne 0x100376de
and dword [ebp - 0x528], 0
jmp 0x100376e8
mov dword [ebp - 0x528], 1
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0x5f8], eax
jmp 0x10037492
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2d0]
call fcn.10025501
jmp 0x10037449
jmp 0x100377db
mov dword [ebp - 0xa04], 0xffffffff
mov dword [ebp - 0xb54], 0x455d89f
mov dword [ebp - 0xa0c], 0x32f8
mov dword [ebp - 0x17c], 0
jmp 0x10037749
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 1
jge 0x10037765
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x608], 0xcb0b9d62
jmp 0x1003773c
mov byte [ebp - 0x90], 0
movzx eax, byte [ebp - 0x90]
test eax, eax
je 0x1003777f
push 1
call fcn.10032959
pop ecx
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x924], 0xd177
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x600], eax
mov eax, dword [ebp - 0x2a0]
dec eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x600], 0xd177
jge 0x100377c1
mov dword [ebp - 0x530], 1
jmp 0x100377c8
and dword [ebp - 0x530], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x530]
mov dword [ebp + eax - 0x608], ecx
mov byte [ebp - 0x92], 0
movzx eax, byte [ebp - 0x92]
test eax, eax
je 0x100377f5
push 1
call fcn.1003299f
pop ecx
cmp dword [ebp - 0xbc], 0
je 0x1003783a
movzx eax, byte [0x14b215fa]
test eax, eax
je 0x1003781a
mov ecx, 0x14b216a8
call fcn.10039655
movzx eax, al
test eax, eax
jne 0x1003783a
lea eax, [ebp - 0x538]
push eax
mov ecx, 0x14b216a8
call fcn.100395f2
mov ecx, dword [ebp - 0xbc]
mov dword [eax], ecx
mov byte [0x14b215fa], 1
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x610], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8d8]
call fcn.10039526
mov eax, dword [ebp - 0x610]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret