Function at 0x1001fb13
Capabilities:
Check os version
Enumerate pe sections
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061192
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xf1c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x1002533f
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x98c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x994], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x9ac], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x9dc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x8e8], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x9cc], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x9d4], eax
mov eax, dword [ebp - 0x9ac]
movzx eax, byte [eax]
test eax, eax
je 0x1001fc14
mov eax, dword [ebp - 0x8e8]
mov dword [ebp - 0x99c], eax
mov eax, dword [ebp - 0x98c]
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0x994]
mov dword [ebp - 0x820], eax
mov eax, dword [ebp - 0x99c]
mov dword [ebp - 0x9c4], eax
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0x9bc], eax
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0x9b4], eax
mov eax, dword [ebp - 0x9b4]
mov ecx, dword [ebp - 0x9bc]
mov ecx, dword [ecx]
cmp ecx, dword [eax]
jle 0x1001fbfa
mov dword [ebp - 0x444], 1
jmp 0x1001fc01
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x9c4]
mov ecx, dword [ebp - 0x444]
mov dword [eax], ecx
jmp 0x1002533a
mov eax, dword [ebp - 0x9cc]
mov dword [ebp - 0xa44], eax
mov eax, dword [ebp - 0x9d4]
mov dword [ebp - 0xa3c], eax
mov eax, dword [ebp - 0x9dc]
mov dword [ebp - 0x1e0], eax
push 1
lea ecx, [ebp - 0x2d8]
call fcn.1000f6e4
and dword [ebp - 4], 0
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x218], 7
push 2
lea ecx, [ebp - 0xac0]
call fcn.1000f6e4
mov byte [ebp - 4], 1
mov dword [ebp - 0x3b0], 0xf3a6825d
mov dword [ebp - 0x82c], 0x988ed9e8
push 0
lea eax, [ebp - 0x2d8]
push eax
push 0x6da8
push 0x68b9
push 0
lea eax, [ebp - 0x9e4]
push eax
call fcn.1002ca05
add esp, 0x18
push 0
push 0x363f
lea eax, [ebp - 0xac0]
push eax
lea eax, [ebp - 0x9e4]
push eax
call fcn.10026b72
add esp, 0x10
mov dword [ebp - 0x28], 0
jmp 0x1001fcd0
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jg 0x1001ff79
mov dword [ebp - 0x7b8], 0
mov dword [ebp - 0xc0], 0xfffb
mov dword [ebp - 0x5c4], 0
mov dword [ebp - 0xa90], 0x23020f62
mov dword [ebp - 0x7b8], 0x3203bd65
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xd28], eax
push 0
lea ecx, [ebp - 0x2d8]
call fcn.1000f782
cmp dword [eax], 0
jbe 0x1001fd36
mov dword [ebp - 0x7a8], 1
jmp 0x1001fd3d
and dword [ebp - 0x7a8], 0
push 0
lea ecx, [ebp - 0x2d8]
call fcn.1000f782
mov ecx, dword [ebp - 0x7a8]
cmp ecx, dword [eax]
jne 0x1001fd60
mov dword [ebp - 0x7b0], 1
jmp 0x1001fd67
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x7b0]
sub eax, 0x6671
cmp dword [ebp - 0x7b8], eax
je 0x1001fd86
mov dword [ebp - 0x7c0], 1
jmp 0x1001fd8d
and dword [ebp - 0x7c0], 0
push 0
lea ecx, [ebp - 0x2d8]
call fcn.1000f782
mov eax, dword [eax]
mov ecx, dword [ebp - 0x7c0]
lea eax, [ecx + eax - 7]
cmp eax, 1
jne 0x1001fdb7
mov dword [ebp - 0x7c8], 1
jmp 0x1001fdbe
and dword [ebp - 0x7c8], 0
push 0
lea ecx, [ebp - 0x2d8]
call fcn.1000f782
mov ecx, dword [ebp - 0x7c8]
cmp ecx, dword [eax]
jle 0x1001fde1
mov dword [ebp - 0x7d0], 1
jmp 0x1001fde8
and dword [ebp - 0x7d0], 0
push 0
lea ecx, [ebp - 0x2d8]
call fcn.1000f782
mov ecx, dword [ebp - 0x7d0]
cmp ecx, dword [eax]
jle 0x1001fe0b
mov dword [ebp - 0x7d8], 1
jmp 0x1001fe12
and dword [ebp - 0x7d8], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2d8]
call fcn.1000f782
mov eax, dword [eax]
add eax, dword [ebp - 0x7d8]
jne 0x1001fe3c
cmp dword [ebp - 0xc0], 0
jne 0x1001fe3c
and dword [ebp - 0x7e0], 0
jmp 0x1001fe46
mov dword [ebp - 0x7e0], 1
push 0
lea ecx, [ebp - 0x2d8]
call fcn.1000f782
mov ecx, dword [ebp - 0x7e0]
cmp ecx, dword [eax]
jle 0x1001fe69
mov dword [ebp - 0x7a0], 1
jmp 0x1001fe70
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x7a0], eax
jl 0x1001fe8a
mov dword [ebp - 0x378], 1
jmp 0x1001fe91
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x378], eax
jge 0x1001fea8
mov dword [ebp - 0x5c8], 1
jmp 0x1001feaf
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x5c8]
sub eax, 0xfa8fad7
sub eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0x28]
jne 0x1001fed1
mov dword [ebp - 0x380], 1
jmp 0x1001fed8
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x380], eax
jg 0x1001fef2
mov dword [ebp - 0x79c], 1
jmp 0x1001fef9
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x79c], eax
jle 0x1001ff13
mov dword [ebp - 0x388], 1
jmp 0x1001ff1a
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x5c4], eax
mov eax, dword [ebp - 0x5c4]
cmp eax, dword [ebp - 0xc0]
jge 0x1001ff40
mov dword [ebp - 0x390], 1
jmp 0x1001ff47
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x390], eax
jge 0x1001ff61
mov dword [ebp - 0x6d4], 1
jmp 0x1001ff68
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0xa90], eax
jmp 0x1001fcc9
mov dword [ebp - 0x28], 0
jmp 0x1001ff89
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x10020118
mov dword [ebp - 0x16c], 0xfffffffc
mov dword [ebp - 0x5cc], 0xf6d77974
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x1001ffbf
call dword [sym.imp.USER32.dll_GetMessageTime]
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0xc8c], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0xd7c], eax
push 0
lea ecx, [ebp - 0x2d8]
call fcn.1000f782
cmp dword [ebp - 0x16c], 0xc01f
jne 0x1001fffc
mov dword [ebp - 0x8e0], 1
jmp 0x10020003
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0xc94], eax
mov esi, dword [ebp - 0x16c]
push 0
lea ecx, [ebp - 0x2d8]
call fcn.1000f782
cmp dword [eax], esi
je 0x10020032
mov dword [ebp - 0x398], 1
jmp 0x10020039
and dword [ebp - 0x398], 0
push 1
lea ecx, [ebp - 0xac0]
call fcn.1000f782
mov ecx, dword [ebp - 0x398]
sub ecx, dword [eax]
mov dword [ebp - 0x5cc], ecx
mov eax, dword [ebp - 0x5cc]
dec eax
imul eax, eax, 0xfffffff8
cmp eax, 1
jne 0x1002006f
mov dword [ebp - 0x3a0], 1
jmp 0x10020076
and dword [ebp - 0x3a0], 0
cmp dword [ebp - 0x3a0], 0xfffd
je 0x1002008e
mov dword [ebp - 0x75c], 1
jmp 0x10020095
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x75c]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xfef6
je 0x100200b9
mov dword [ebp - 0x3a8], 1
jmp 0x100200c0
and dword [ebp - 0x3a8], 0
push 0
lea ecx, [ebp - 0x2d8]
call fcn.1000f782
mov ecx, dword [ebp - 0x3a8]
cmp ecx, dword [eax]
jne 0x100200e3
mov dword [ebp - 0x5d4], 1
jmp 0x100200ea
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x3b0], eax
mov esi, dword [ebp - 0x3b0]
push 1
lea ecx, [ebp - 0xac0]
call fcn.1000f782
mov eax, dword [eax]
sub eax, esi
mov dword [ebp - 0x82c], eax
jmp 0x1001ff82
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xac0]
call fcn.1000f766
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d8]
call fcn.1000f766
mov dword [ebp - 0x134], 0
lea eax, [ebp - 0x134]
push eax
push 1
push 0
push 0x4162
push 0xec1
push 0x6f3
push 0x74c4
call fcn.1001ac9b
add esp, 0x1c
mov dword [ebp - 0x134], 0
jmp 0x10020180
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x14
je 0x100201aa
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x100201a8
push 0
push 0x2031
call dword [sym.imp.USER32.dll_SetMenu]
jmp 0x10020173
mov dword [ebp - 0x174], 1
mov dword [ebp - 0x174], 0xfffffffb
jmp 0x100201cd
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0x13
jle 0x10020206
mov dword [ebp - 0x9b8], 0xfffffff8
push 0x4baa
push 0x54
push 0
push 0x6f4d
push 0
push 0x1787
lea eax, [ebp - 0x9b8]
push eax
call fcn.1001b833
add esp, 0x1c
jmp 0x100201c0
mov byte [ebp - 0xce], 0
movzx eax, byte [ebp - 0xce]
test eax, eax
je 0x10020233
push 0x3b92
push 1
push 0x16be
push 0
push 0xeb7
call fcn.1001d77c
add esp, 0x14
mov dword [ebp - 0x714], 0xffffffff
mov dword [ebp - 0x344], 0x8ade
push 1
lea ecx, [ebp - 0x5bc]
call fcn.1000f6e4
mov dword [ebp - 4], 2
mov dword [ebp - 0x5e4], 1
mov dword [ebp - 0x834], 1
push 0
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x5bc]
push eax
call fcn.1002ad18
add esp, 0xc
mov dword [ebp - 0x104], 0
jmp 0x100202a0
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 1
jge 0x100202bc
mov eax, dword [ebp - 0x104]
mov dword [ebp + eax*4 - 0x7dc], 0xd43d
jmp 0x10020293
mov dword [ebp - 0x344], 1
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0xdd4], eax
push 0
lea ecx, [ebp - 0x5bc]
call fcn.1000f782
push 0
lea ecx, [ebp - 0x5bc]
call fcn.1000f782
mov esi, eax
push 0
lea ecx, [ebp - 0x5bc]
call fcn.1000f782
mov eax, dword [eax]
cmp eax, dword [esi]
jge 0x1002030d
mov dword [ebp - 0x6dc], 1
jmp 0x10020314
and dword [ebp - 0x6dc], 0
cmp dword [ebp - 0x6dc], 0x662d
jge 0x1002033e
push 0
lea ecx, [ebp - 0x5bc]
call fcn.1000f782
cmp dword [eax], 0
je 0x1002033e
mov dword [ebp - 0x3b8], 1
jmp 0x10020345
and dword [ebp - 0x3b8], 0
push 0
lea ecx, [ebp - 0x5bc]
call fcn.1000f782
mov eax, dword [eax]
cmp eax, dword [ebp - 0x3b8]
jg 0x10020368
mov dword [ebp - 0x5dc], 1
jmp 0x1002036f
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x5dc]
sub eax, dword [ebp - 0x5e4]
cmp dword [ebp - 0x344], eax
jg 0x1002038f
mov dword [ebp - 0x3c0], 1
jmp 0x10020396
and dword [ebp - 0x3c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7dc]
cmp dword [ebp - 0x3c0], eax
jg 0x100203b7
mov dword [ebp - 0x3c8], 1
jmp 0x100203be
and dword [ebp - 0x3c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7dc]
add eax, dword [ebp - 0x3c8]
cmp eax, dword [ebp - 0x5e4]
jge 0x100203e5
mov dword [ebp - 0x3d0], 1
jmp 0x100203ec
and dword [ebp - 0x3d0], 0
push 0
lea ecx, [ebp - 0x5bc]
call fcn.1000f782
mov ecx, dword [ebp - 0x3d0]
cmp ecx, dword [eax]
jle 0x1002040f
mov dword [ebp - 0x6e4], 1
jmp 0x10020416
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x6e4]
mov dword [ebp - 0x834], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5bc]
call fcn.1000f766
mov dword [ebp - 0xc9c], 0
mov dword [ebp - 0xb24], 1
mov dword [ebp - 0xb20], 1
mov dword [ebp - 0xb1c], 1
mov dword [ebp - 0xb18], 1
mov dword [ebp - 0x854], 0x87697ab8
mov dword [ebp - 0x644], 0xfffffffd
mov dword [ebp - 0x21c], 0xfffffff6
mov dword [ebp - 0x21c], 0
jmp 0x1002049a
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0xc
je 0x10020589
mov dword [ebp - 0xb7c], 0x5b0e446d
mov dword [ebp - 0xb78], 0x5b0e446d
mov dword [ebp - 0xb74], 0x5b0e446d
mov dword [ebp - 0xb70], 0x5b0e446d
lea ecx, [ebp - 0x2d9]
call fcn.1000f791
push eax
lea eax, [ebp - 0xb6c]
push eax
lea eax, [ebp - 0xb7c]
push eax
lea ecx, [ebp - 0xe8c]
call fcn.1000f794
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc1c]
call fcn.1000f740
mov dword [ebp - 4], 3
mov byte [ebp - 0xa5], 0
lea eax, [ebp - 0xa5]
push eax
push 0
push 1
push 0x569e
push 1
push 0x95c
push 0x1638
push 0x408e
push 0x6161
push 0x716
push 0x2088
push 0x623f
call fcn.1001b58d
add esp, 0x30
push 3
lea ecx, [ebp - 0xc1c]
call fcn.1000f782
cmp dword [eax], 0
je 0x10020575
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc1c]
call fcn.1000f766
jmp 0x1002048d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc1c]
call fcn.1000f766
jmp 0x1002048d
mov dword [ebp - 0xa48], 0x8a064f57
mov dword [ebp - 0xa38], 7
mov dword [ebp - 0x83c], 0xd59e57ad
mov dword [ebp - 0xd84], 0xffffffff
push 1
lea ecx, [ebp - 0xd34]
call fcn.1000f6e4
mov dword [ebp - 4], 4
push 3
lea ecx, [ebp - 0xd24]
call fcn.1000f6e4
mov byte [ebp - 4], 5
mov dword [ebp - 0xca4], 0xdd2cc910
push 1
lea ecx, [ebp - 0xbec]
call fcn.1000f6e4
mov byte [ebp - 4], 6
mov dword [ebp - 0x2c], 0
jmp 0x10020601
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x1002061d
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xd34]
call fcn.1000f782
mov dword [eax], 0xa290be44
jmp 0x100205fa
mov dword [ebp - 0x2c], 0
jmp 0x1002062d
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x10020649
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xd24]
call fcn.1000f782
mov dword [eax], 0x6bafcb14
jmp 0x10020626
push 0
push 0x46e1
lea eax, [ebp - 0xbec]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.10026a7c
add esp, 0x10
mov eax, dword [ebp - 0xa38]
mov dword [ebp - 0x83c], eax
push 0
lea eax, [ebp - 0xbec]
push eax
push 0x116b
push 0x44c
push 1
call fcn.1001b9c3
add esp, 0x14
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xbec]
call fcn.1000f766
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xd24]
call fcn.1000f766
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd34]
call fcn.1000f766
mov dword [ebp - 0x15c], 0xfffffffb
mov dword [ebp - 0x17c], 0
jmp 0x100206dc
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 2
jge 0x100206f8
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0xcc8], 1
jmp 0x100206cf
mov dword [ebp - 0x15c], 0xfffffffe
jmp 0x10020711
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xffffffef
jg 0x10020869
push 1
lea ecx, [ebp - 0x7fc]
call fcn.1000f6e4
mov dword [ebp - 4], 7
mov dword [ebp - 0x12c], 0x8a835a23
mov dword [ebp - 0x26c], 0
jmp 0x10020755
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 1
jge 0x10020777
push dword [ebp - 0x26c]
lea ecx, [ebp - 0x7fc]
call fcn.1000f782
mov dword [eax], 1
jmp 0x10020748
push 0
lea ecx, [ebp - 0x7fc]
call fcn.1000f782
and dword [eax], 0
jmp 0x100207ad
push 0
lea ecx, [ebp - 0x7fc]
call fcn.1000f782
mov dword [ebp - 0x3d8], eax
mov eax, dword [ebp - 0x3d8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3d8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x7fc]
call fcn.1000f782
cmp dword [eax], 1
jg 0x10020803
mov dword [ebp - 0x9c0], 1
push 0
lea ecx, [ebp - 0x7fc]
call fcn.1000f782
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xcc8], 0xfffffffd
je 0x100207ee
mov dword [ebp - 0x5ec], 1
jmp 0x100207f5
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0x9c0], eax
jmp 0x10020789
mov dword [ebp - 0x12c], 0
jmp 0x1002081c
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 1
jge 0x10020855
push 0x326e
push 1
push 0x6bf1
lea eax, [ebp - 0x7fc]
push eax
push 0
push 0x3b5a
lea eax, [ebp - 0x12c]
push eax
push 0x77b8
call fcn.1001f83d
add esp, 0x20
jmp 0x1002080f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7fc]
call fcn.1000f766
jmp 0x10020704
mov byte [ebp - 0xd0], 0
push 0
lea eax, [ebp - 0xd0]
push eax
push 0x4dd5
push 0x614e
push 0
call fcn.1001f2b9
add esp, 0x14
mov dword [ebp - 0x184], 0
jmp 0x100208a6
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 2
jge 0x100208c2
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0xcf8], 0xfff6
jmp 0x10020899
mov dword [ebp - 0xc8], 0
push 4
lea ecx, [ebp - 0x158]
call fcn.1000f6e4
mov dword [ebp - 4], 8
mov dword [ebp - 0x7c], 0x168f928d
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0x320], 1
mov dword [ebp - 0x410], 7
mov dword [ebp - 0xa40], 0x290900dd
push 0x2cd3
lea eax, [ebp - 0xdbc]
push eax
push 1
lea eax, [ebp - 0x158]
push eax
push 0
call fcn.1001e791
add esp, 0x14
push 3
lea ecx, [ebp - 0x158]
call fcn.1000f782
and dword [eax], 0
cmp dword [ebp - 0xc8], 0
jl 0x10020a68
push 3
lea ecx, [ebp - 0x158]
call fcn.1000f782
mov esi, eax
push 2
lea ecx, [ebp - 0x158]
call fcn.1000f782
mov eax, dword [eax]
cmp eax, dword [esi]
jl 0x10020979
mov dword [ebp - 0x3e0], 1
jmp 0x10020980
and dword [ebp - 0x3e0], 0
push 0
lea ecx, [ebp - 0x158]
call fcn.1000f782
mov ecx, dword [ebp - 0x3e0]
cmp ecx, dword [eax]
je 0x100209a3
mov dword [ebp - 0x764], 1
jmp 0x100209aa
and dword [ebp - 0x764], 0
push 3
lea ecx, [ebp - 0x158]
call fcn.1000f782
mov ecx, dword [ebp - 0x764]
sub ecx, dword [eax]
cmp ecx, 0x22ba
jne 0x100209d3
mov dword [ebp - 0x3e8], 1
jmp 0x100209da
and dword [ebp - 0x3e8], 0
push 3
lea ecx, [ebp - 0x158]
call fcn.1000f782
mov eax, dword [eax]
imul eax, dword [ebp - 0x3e8]
test eax, eax
jne 0x10020a06
mov eax, 0xe80d
test eax, eax
jne 0x10020a06
and dword [ebp - 0x5f4], 0
jmp 0x10020a10
mov dword [ebp - 0x5f4], 1
push 3
lea ecx, [ebp - 0x158]
call fcn.1000f782
mov ecx, dword [ebp - 0x5f4]
cmp ecx, dword [eax]
je 0x10020a33
mov dword [ebp - 0x2e4], 1
jmp 0x10020a3a
and dword [ebp - 0x2e4], 0
push 3
lea ecx, [ebp - 0x158]
call fcn.1000f782
mov ecx, dword [ebp - 0x2e4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2e4]
add eax, 0x89bd
je 0x10020a68
mov dword [ebp - 0x3f0], 1
jmp 0x10020a6f
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0xc8]
sub eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x7c], eax
push 3
lea ecx, [ebp - 0x158]
call fcn.1000f782
mov eax, dword [eax]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x7c]
jl 0x10020aaa
mov dword [ebp - 0x7a4], 1
jmp 0x10020ab1
and dword [ebp - 0x7a4], 0
mov esi, dword [ebp - 0x7c]
push 3
lea ecx, [ebp - 0x158]
call fcn.1000f782
sub esi, dword [eax]
je 0x10020ada
cmp dword [ebp - 0xc8], 0
je 0x10020ada
mov dword [ebp - 0x6ec], 1
jmp 0x10020ae1
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x6ec], eax
je 0x10020afb
mov dword [ebp - 0x3f8], 1
jmp 0x10020b02
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x3f8], eax
je 0x10020b19
mov dword [ebp - 0x5fc], 1
jmp 0x10020b20
and dword [ebp - 0x5fc], 0
cmp dword [ebp - 0x5fc], 0x6c47
jl 0x10020b38
mov dword [ebp - 0x400], 1
jmp 0x10020b3f
and dword [ebp - 0x400], 0
mov esi, dword [ebp - 0x400]
sub esi, dword [ebp - 0x7c]
push 3
lea ecx, [ebp - 0x158]
call fcn.1000f782
cmp esi, dword [eax]
je 0x10020b65
mov dword [ebp - 0x408], 1
jmp 0x10020b6c
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x7a4]
cmp eax, dword [ebp - 0x408]
jle 0x10020df9
cmp dword [ebp - 0x320], 0
je 0x10020df9
mov dword [ebp - 0x844], 0xbe4a9ff1
mov dword [ebp - 0x224], 0
jmp 0x10020bae
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 3
jge 0x10020bca
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0x810], 0x3a099773
jmp 0x10020ba1
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x810], 0
jne 0x10020bf1
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x810], 0
jne 0x10020bf1
and dword [ebp - 0x2ec], 0
jmp 0x10020bfb
mov dword [ebp - 0x2ec], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x810]
sub eax, dword [ebp - 0x7c]
jne 0x10020c26
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x810], 0
jne 0x10020c26
and dword [ebp - 0x604], 0
jmp 0x10020c30
mov dword [ebp - 0x604], 1
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x410], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x410]
imul ecx, dword [ebp - 0x320]
add ecx, dword [ebp + eax - 0x810]
cmp ecx, 0x95df
jne 0x10020c69
mov dword [ebp - 0x6f4], 1
jmp 0x10020c70
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x6f4]
sub eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0xd8]
jle 0x10020c90
mov dword [ebp - 0x418], 1
jmp 0x10020c97
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x418], eax
jge 0x10020cb1
mov dword [ebp - 0x60c], 1
jmp 0x10020cb8
and dword [ebp - 0x60c], 0
cmp dword [ebp - 0x60c], 0xfffffffe
jae 0x10020ccd
mov dword [ebp - 0x420], 1
jmp 0x10020cd4
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0xd8]
imul eax, dword [ebp - 0x420]
cmp eax, dword [ebp - 0x320]
jg 0x10020cf5
mov dword [ebp - 0x76c], 1
jmp 0x10020cfc
and dword [ebp - 0x76c], 0
cmp dword [ebp - 0x76c], 0xe0bb
jl 0x10020d14
mov dword [ebp - 0x428], 1
jmp 0x10020d1b
and dword [ebp - 0x428], 0
cmp dword [ebp - 0x428], 0x6407
jg 0x10020d33
mov dword [ebp - 0x614], 1
jmp 0x10020d3a
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x614], eax
jl 0x10020d54
mov dword [ebp - 0x430], 1
jmp 0x10020d5b
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x430], eax
jg 0x10020d75
mov dword [ebp - 0x6fc], 1
jmp 0x10020d7c
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x6fc], eax
jg 0x10020d93
mov dword [ebp - 0x438], 1
jmp 0x10020d9a
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x438]
jg 0x10020db2
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x810], 0
push 3
lea ecx, [ebp - 0x158]
call fcn.1000f782
mov ecx, dword [ebp - 0x2ec]
mov dword [eax], ecx
mov eax, dword [ebp - 0x844]
imul eax, dword [ebp - 0x2ec]
test eax, eax
jle 0x10020de4
mov dword [ebp - 0x61c], 1
jmp 0x10020deb
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0xa40], eax
jmp 0x10020e1f
push 0x5079
push 0
push 1
push 0x61dd
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0xc8]
push eax
push 1
call fcn.1001852d
add esp, 0x1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x158]
call fcn.1000f766
mov dword [ebp - 0x68], 0x1220985a
mov dword [ebp - 0x31c], 0xd8530de9
mov dword [ebp - 0xcac], 5
mov dword [ebp - 0xd8c], 0xcf687292
mov dword [ebp - 0xcb4], 1
mov dword [ebp - 0xce8], 0x77b69c93
mov dword [ebp - 0xcbc], 0xfffffffd
mov dword [ebp - 0xcec], 0x5cbf7935
mov dword [ebp - 0xcf0], 0xfffffffc
mov dword [ebp - 0xd94], 0xab721576
mov dword [ebp - 0x84c], 0xab0b
push 3
lea ecx, [ebp - 0xd44]
call fcn.1000f6e4
mov dword [ebp - 4], 9
mov dword [ebp - 0x44], 0
jmp 0x10020ebd
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x10020ed3
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xaa4], 0x9bf39019
jmp 0x10020eb6
mov dword [ebp - 0x44], 0
jmp 0x10020ee3
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x10020ef9
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xcfc], 0x631cd1ac
jmp 0x10020edc
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xd44]
push eax
push 0x6b3f
push 1
push 1
call fcn.10018246
add esp, 0x14
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xdc4], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xaa4]
cmp ecx, dword [ebp + eax - 0xaa4]
jne 0x10020f44
mov dword [ebp - 0x440], 1
jmp 0x10020f4b
and dword [ebp - 0x440], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xaa4]
cmp ecx, dword [ebp + eax - 0xaa4]
jg 0x10020f71
mov dword [ebp - 0x7c4], 1
jmp 0x10020f78
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x440]
add eax, dword [ebp - 0x7c4]
js 0x10020f92
mov dword [ebp - 0x448], 1
jmp 0x10020f99
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x68], 0
je 0x1002116c
mov dword [ebp - 0x468], 0x9d87263b
mov dword [ebp - 0xd08], 4
mov dword [ebp - 0xd9c], 0x94ccb090
mov dword [ebp - 0x54], 0
jmp 0x10020fdd
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x10020ff3
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xe14], 0xfffffff8
jmp 0x10020fd6
mov dword [ebp - 0x54], 0
jmp 0x10021003
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x10021019
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xf2c], 0
jmp 0x10020ffc
mov dword [ebp - 0x68], 0
jmp 0x10021029
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jg 0x1002115a
mov dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x624], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x624]
mov dword [ebp + eax - 0xe14], ecx
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp + eax*4 - 0xaa4]
add eax, 0x5fa
cmp dword [ebp - 0x624], eax
jl 0x10021082
xor eax, eax
je 0x10021082
mov dword [ebp - 0x450], 1
jmp 0x10021089
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x468]
cmp dword [ebp - 0x450], eax
jne 0x100210a3
mov dword [ebp - 0x704], 1
jmp 0x100210aa
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x704]
mov dword [ebp - 0x458], eax
cmp dword [ebp - 0x458], 0
jae 0x100210cb
mov dword [ebp - 0x62c], 1
jmp 0x100210d2
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ebp + ecx*4 - 0xaa4]
sub ecx, dword [ebp + eax*4 - 0xaa4]
cmp ecx, dword [ebp - 0x62c]
jg 0x100210fa
mov dword [ebp - 0x460], 1
jmp 0x10021101
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x460]
sub eax, 0xb1af
cmp eax, dword [ebp - 0x31c]
jg 0x10021120
mov dword [ebp - 0x774], 1
jmp 0x10021127
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0x468], eax
push 0x4618
push 1
push 1
push 0x1a4f
push 0x32d2
push 0x16b0
push 1
call fcn.1001852d
add esp, 0x1c
jmp 0x10021022
push 0
lea eax, [ebp - 0x84c]
push eax
call fcn.1002ccb3
pop ecx
pop ecx
jmp 0x1002118b
mov byte [ebp - 0xad], 0
movzx eax, byte [ebp - 0xad]
test eax, eax
je 0x1002118b
push 0xd5a
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd44]
call fcn.1000f766
mov byte [ebp - 0xd2], 0
push 1
push 0x22dc
push 0x43fd
push 0x7c3
push 1
push 1
push 0x3cc0
call fcn.100188f4
add esp, 0x1c
movzx eax, byte [ebp - 0xd2]
test eax, eax
je 0x10021402
push 4
lea ecx, [ebp - 0xc34]
call fcn.1000f6e4
mov dword [ebp - 4], 0xa
mov dword [ebp - 0xec], 0xffffffff
mov dword [ebp - 0x84], 0xffff
mov dword [ebp - 0x7ac], 3
mov dword [ebp - 0xd10], 0x1c443818
lea eax, [ebp - 0xc34]
push eax
push 0x4b88
push 1
lea eax, [ebp - 0xde0]
push eax
push 0
call fcn.1001d078
add esp, 0x14
push 0x6fc5
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0xc34]
push eax
push 1
push 1
call fcn.10018d58
add esp, 0x14
mov eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0x84]
jge 0x10021266
mov dword [ebp - 0x634], 1
jmp 0x1002126d
and dword [ebp - 0x634], 0
imul eax, dword [ebp - 0x634], 0x92e3
test eax, eax
jne 0x1002128d
cmp dword [ebp - 0x84], 0
jne 0x1002128d
and dword [ebp - 0x470], 0
jmp 0x10021297
mov dword [ebp - 0x470], 1
mov eax, dword [ebp - 0x84]
add eax, dword [ebp - 0x470]
cmp eax, 0xfffe
jbe 0x100212b6
mov dword [ebp - 0x70c], 1
jmp 0x100212bd
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0xec]
add eax, dword [ebp - 0x70c]
je 0x100212e0
cmp dword [ebp - 0x84], 0
je 0x100212e0
mov dword [ebp - 0x478], 1
jmp 0x100212e7
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x478], eax
jle 0x10021301
mov dword [ebp - 0x63c], 1
jmp 0x10021308
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x63c], eax
je 0x10021322
mov dword [ebp - 0x480], 1
jmp 0x10021329
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x7ac], eax
mov eax, dword [ebp - 0xec]
add eax, dword [ebp - 0x7ac]
add eax, dword [ebp - 0xec]
cmp dword [ebp - 0x84], eax
jge 0x1002135b
mov dword [ebp - 0x488], 1
jmp 0x10021362
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x488]
neg eax
jne 0x10021373
cmp dword [ebp - 0x84], 0
imul eax, dword [ebp - 0xec], 0xbe2d
test eax, eax
je 0x100213a0
mov byte [ebp - 0xd4], 0
movzx eax, byte [ebp - 0xd4]
test eax, eax
je 0x1002139e
push 0
push 0
call fcn.1001ac1f
pop ecx
pop ecx
jmp 0x100213dd
mov dword [ebp - 0x9c8], 0x1bd53d2a
push 0x3773
push 0x439e
push 0x7407
push 0x3f40
lea eax, [ebp - 0x9c8]
push eax
push 1
push 1
push 0x1a4b
push 0x224b
push 0
call fcn.1001ba47
add esp, 0x28
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc34]
call fcn.1000f766
push 0x81d
push 0x7c78
push 0
push 1
call fcn.1001d6ee
add esp, 0x10
mov eax, dword [ebp - 0x714]
mov dword [ebp - 0xd18], eax
cmp dword [ebp - 0x644], 1
jge 0x10021429
cmp dword [ebp - 0x644], 0
jne 0x10021429
and dword [ebp - 0x490], 0
jmp 0x10021433
mov dword [ebp - 0x490], 1
cmp dword [ebp - 0x490], 0x94628aea
jb 0x10021446
cmp dword [ebp - 0x854], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcf8]
mov dword [ebp - 0xda4], eax
mov eax, dword [ebp - 0xa48]
mov dword [ebp - 0xc7c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb24], 0xd2ad05b3
jae 0x10021484
mov dword [ebp - 0x498], 1
jmp 0x1002148b
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x714]
cmp dword [ebp - 0x498], eax
je 0x100214ae
mov eax, 0xa3ebef27
test eax, eax
je 0x100214ae
mov dword [ebp - 0x64c], 1
jmp 0x100214b5
and dword [ebp - 0x64c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x64c]
mov dword [ebp + eax - 0xb24], ecx
mov eax, dword [ebp - 0x1e0]
mov eax, dword [eax + 4]
mov dword [ebp - 0x58c], eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x294], 0xffffffff
mov dword [ebp - 0x324], 0x97b09b37
mov dword [ebp - 0x18c], 0xf118c84b
push 4
lea ecx, [ebp - 0xc04]
call fcn.1000f6e4
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xdcc], 1
push 0
lea eax, [ebp - 0xc04]
push eax
push 1
push 0x6dd5
push 0x7b8
lea eax, [ebp - 0x10c]
push eax
call fcn.1001ad79
add esp, 0x18
mov dword [ebp - 0x10c], 0
jmp 0x10021557
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jge 0x10021573
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x2fc], 1
jmp 0x1002154a
mov dword [ebp - 0x3c], 0
jmp 0x10021583
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 5
jl 0x10021831
mov dword [ebp - 0x8c], 9
push 1
lea ecx, [ebp - 0xd54]
call fcn.1000f6e4
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x14c], 0
jmp 0x100215c1
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 4
jge 0x100215dd
mov eax, dword [ebp - 0x14c]
mov dword [ebp + eax*4 - 0xe64], 0xb8575526
jmp 0x100215b4
push 0x2b58
lea eax, [ebp - 0x14c]
push eax
push 0
lea eax, [ebp - 0xd54]
push eax
push 0x455b
push 0x23be
push 0
push 1
push 0x23af
call fcn.1001c43a
add esp, 0x24
cmp dword [ebp - 0x8c], 0
je 0x1002162b
cmp dword [ebp - 0x8c], 0
je 0x1002162b
mov dword [ebp - 0x2f4], 1
jmp 0x10021632
and dword [ebp - 0x2f4], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2f4]
mov dword [ebp + eax - 0xe64], ecx
cmp dword [ebp - 0x2f4], 0xfffffffd
jne 0x10021659
mov dword [ebp - 0x4a0], 1
jmp 0x10021660
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x4a0], eax
jl 0x1002167a
mov dword [ebp - 0x77c], 1
jmp 0x10021681
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x77c]
cmp eax, dword [ebp - 0x3c]
jle 0x1002169b
mov dword [ebp - 0x4a8], 1
jmp 0x100216a2
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0xd38], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0xdac], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xd48], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0xd6c], eax
imul eax, dword [ebp - 0x324], 0x7b30
cmp eax, dword [ebp - 0x8c]
jle 0x10021705
mov dword [ebp - 0x654], 1
jmp 0x1002170c
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x654]
jge 0x10021726
mov dword [ebp - 0x4b0], 1
jmp 0x1002172d
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x4b0]
jl 0x10021744
mov dword [ebp - 0x71c], 1
jmp 0x1002174b
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x71c]
sub eax, dword [ebp - 0x3c]
cmp eax, 0x2f4e
jle 0x10021767
mov dword [ebp - 0x4b8], 1
jmp 0x1002176e
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x4b8], eax
jl 0x10021785
mov dword [ebp - 0x65c], 1
jmp 0x1002178c
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x65c], eax
jle 0x100217af
cmp dword [ebp - 0x18c], 0
je 0x100217af
mov dword [ebp - 0x4c0], 1
jmp 0x100217b6
and dword [ebp - 0x4c0], 0
mov dword [ebp - 0x294], 0xb618
mov eax, dword [ebp - 0x294]
imul eax, dword [ebp - 0x4c0]
test eax, eax
je 0x100217e6
cmp dword [ebp - 0x294], 0
je 0x100217e6
mov dword [ebp - 0x7d4], 1
jmp 0x100217ed
and dword [ebp - 0x7d4], 0
push 2
lea ecx, [ebp - 0xc04]
call fcn.1000f782
mov ecx, dword [ebp - 0x7d4]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2fc]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2fc], eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xd54]
call fcn.1000f766
jmp 0x1002157c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2fc]
mov dword [ebp - 0x294], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc04]
call fcn.1000f766
mov dword [ebp - 0x194], 0xad313dd3
mov dword [ebp - 0x4e0], 0x8c105a83
mov dword [ebp - 0x85c], 0x7828451d
push 1
lea ecx, [ebp - 0xc10]
call fcn.1000f6e4
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x78], 0
jmp 0x10021895
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x100218ab
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xe4], 0xe01bd97a
jmp 0x1002188e
mov dword [ebp - 0x78], 0
jmp 0x100218bb
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x100218d7
push dword [ebp - 0x78]
lea ecx, [ebp - 0xc10]
call fcn.1000f782
mov dword [eax], 1
jmp 0x100218b4
mov dword [ebp - 0x194], 0
jmp 0x100218f0
mov eax, dword [ebp - 0x194]
dec eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0xfffffffa
jle 0x10021ab6
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x1c], 0
jmp 0x10021914
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x10021a9c
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xe4]
mov dword [ebp - 0xd58], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xe4], 0x6c382506
jge 0x1002194a
mov dword [ebp - 0x4c8], 1
jmp 0x10021951
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x4c8], eax
jg 0x10021968
mov dword [ebp - 0x664], 1
jmp 0x1002196f
and dword [ebp - 0x664], 0
cmp dword [ebp - 0x664], 0xfffffffe
jl 0x10021984
mov dword [ebp - 0x4d0], 1
jmp 0x1002198b
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xe4]
cmp dword [ebp - 0x4d0], eax
jl 0x100219a9
mov dword [ebp - 0x724], 1
jmp 0x100219b0
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x724]
add eax, 3
cmp eax, 0x7d92
jge 0x100219cc
mov dword [ebp - 0x4d8], 1
jmp 0x100219d3
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xe4]
cmp eax, dword [ebp - 0x4d8]
jge 0x100219f1
mov dword [ebp - 0x66c], 1
jmp 0x100219f8
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x66c]
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x4e0]
cmp ecx, dword [ebp + eax*4 - 0xe4]
jne 0x10021a28
mov eax, 0xe5077045
test eax, eax
jne 0x10021a28
and dword [ebp - 0x784], 0
jmp 0x10021a32
mov dword [ebp - 0x784], 1
cmp dword [ebp - 0x784], 0
jne 0x10021a47
mov dword [ebp - 0x4e8], 1
jmp 0x10021a4e
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xe4]
cmp dword [ebp - 0x4e8], eax
je 0x10021a6c
mov dword [ebp - 0x674], 1
jmp 0x10021a73
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x674]
mov dword [ebp - 0x85c], eax
push 0
lea ecx, [ebp - 0xc10]
call fcn.1000f782
cmp dword [eax], 0
je 0x10021a97
jmp 0x10021a9c
jmp 0x1002190d
push 1
push 0x30c2
lea eax, [ebp - 0x1c]
push eax
push 0
call fcn.1001b8fb
add esp, 0x10
jmp 0x100218e3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc10]
call fcn.1000f766
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0x114], 0x4f3d4e6
mov dword [ebp - 0x22c], 0
jmp 0x10021af6
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 3
jge 0x10021b12
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0xad8], 0x4b25b3b9
jmp 0x10021ae9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xad8], 0
je 0x10021b30
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xad8], 0
mov dword [ebp - 0x4c], 0xea66e58d
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xad8]
sub ecx, dword [ebp + eax - 0xad8]
cmp ecx, dword [ebp - 0x4c]
jg 0x10021b62
mov dword [ebp - 0x4f0], 1
jmp 0x10021b69
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x114], 0xb
jmp 0x10021b8e
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xfffffff8
jne 0x10021d96
mov dword [ebp - 0x4c], 0
jmp 0x10021bab
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xfffffffa
jge 0x10021cec
mov dword [ebp - 0x864], 1
mov dword [ebp - 0x72c], 0x46d
mov dword [ebp - 0xa50], 0x10009518
cmp dword [ebp - 0x72c], 0x5ae
jle 0x10021c8a
and dword [ebp - 0x19c], 0
jmp 0x10021bf9
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0x10ae
jge 0x10021c8a
and dword [ebp - 0x274], 0
jmp 0x10021c1f
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xbd8
jge 0x10021c85
mov eax, dword [ebp - 0x19c]
cdq
idiv dword [ebp - 0x274]
mov eax, edx
cdq
mov dword [ebp - 0x8f4], eax
mov dword [ebp - 0x8f0], edx
push dword [ebp - 0x8f0]
push dword [ebp - 0x8f4]
lea ecx, [ebp - 0xea4]
call fcn.1000d000
pop ecx
pop ecx
mov dword [ebp - 0x9d0], eax
mov ecx, dword [ebp - 0x9d0]
call fcn.1000f5af
push eax
call fcn.1004b356
pop ecx
lea ecx, [ebp - 0xea4]
call fcn.1000f5a5
jmp 0x10021c12
jmp 0x10021bec
lea eax, [ebp - 0x864]
push eax
push 1
push 0x43f8
push 1
call fcn.100192f4
add esp, 0x10
mov dword [ebp - 4], 0xe
cmp dword [ebp - 0x72c], 0x1ce
jge 0x10021cc1
push dword [ebp - 0xa50]
call fcn.1004b356
pop ecx
jmp 0x10021cdd
or dword [ebp - 4], 0xffffffff
jmp 0x10021ce7
jmp 0x10021ba4
mov dword [ebp - 0x4c], 0xa
jmp 0x10021cfc
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xfffffffd
jle 0x10021d91
push 1
lea ecx, [ebp - 0xacc]
call fcn.1000f6e4
mov dword [ebp - 4], 0x10
lea eax, [ebp - 0xd70]
push eax
push 0xcb7
push 0
push 1
push 0x1390
lea eax, [ebp - 0xacc]
push eax
push 0xc33
call fcn.100193a2
add esp, 0x1c
mov byte [ebp - 0xb0], 0
lea eax, [ebp - 0xb0]
push eax
push 0
call fcn.1003245f
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0xacc]
call fcn.1000f782
cmp dword [eax], 0
je 0x10021d7d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xacc]
call fcn.1000f766
jmp 0x10021d91
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xacc]
call fcn.1000f766
jmp 0x10021cf5
jmp 0x10021b81
mov dword [ebp - 0xfc], 0x4f3d4e6
and dword [ebp - 0xba4], 0
and dword [ebp - 0xba0], 0
and dword [ebp - 0xb9c], 0
and dword [ebp - 0xb98], 0
lea ecx, [ebp - 0x339]
call fcn.1000f791
push eax
lea eax, [ebp - 0xb94]
push eax
lea eax, [ebp - 0xba4]
push eax
lea ecx, [ebp - 0xe4c]
call fcn.1000f794
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2ac]
call fcn.1000f740
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x4f8], 0x7b5
mov dword [ebp - 0x86c], 0x10009598
cmp dword [ebp - 0x4f8], 0x7d8
jle 0x10021ef5
and dword [ebp - 0x1a4], 0
jmp 0x10021e32
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0x8044
jge 0x10021ef5
and dword [ebp - 0x234], 0
jmp 0x10021e58
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0x793e
jge 0x10021ef0
and dword [ebp - 0x1ac], 0
jmp 0x10021e7e
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0x526e
jge 0x10021eeb
and dword [ebp - 0x2bc], 0
jmp 0x10021ea0
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0x48b5
jge 0x10021ee9
mov eax, dword [ebp - 0x1a4]
sub eax, dword [ebp - 0x234]
add eax, dword [ebp - 0x1ac]
sub eax, dword [ebp - 0x2bc]
cdq
mov dword [ebp - 0x900], eax
mov dword [ebp - 0x8fc], edx
push dword [ebp - 0x8fc]
push dword [ebp - 0x900]
mov ecx, 0x10609ad8
call fcn.1000f5cf
jmp 0x10021e93
jmp 0x10021e71
jmp 0x10021e4b
jmp 0x10021e25
mov dword [ebp - 0x80], 0x6088b922
mov byte [ebp - 4], 0x12
cmp dword [ebp - 0x4f8], 0x79f
jge 0x10021f1c
mov edx, dword [ebp - 0x86c]
mov ecx, 0x10609ad8
call fcn.10011079
jmp 0x10021f38
mov dword [ebp - 4], 0x11
jmp 0x10021f48
mov dword [ebp - 0x304], 0x49968cb6
mov dword [ebp - 0x87c], 0x1a0e1c2a
mov dword [ebp - 0xa60], 0x60f181e2
mov dword [ebp - 0x1b4], 0
jmp 0x10021f7f
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 1
jge 0x10021f98
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x70], 4
jmp 0x10021f72
push 0
lea ecx, [ebp - 0x2ac]
call fcn.1000f782
and dword [eax], 0
jmp 0x10021fce
push 0
lea ecx, [ebp - 0x2ac]
call fcn.1000f782
mov dword [ebp - 0x67c], eax
mov eax, dword [ebp - 0x67c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x67c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x2ac]
call fcn.1000f782
cmp dword [eax], 0
jl 0x100221e6
mov dword [ebp - 0x9d8], 0
push 2
lea ecx, [ebp - 0xafc]
call fcn.1000f6e4
mov byte [ebp - 4], 0x14
mov dword [ebp - 0xa58], 0xee0cd979
mov dword [ebp - 0x23c], 0
jmp 0x10022022
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 2
jge 0x10022044
push dword [ebp - 0x23c]
lea ecx, [ebp - 0xafc]
call fcn.1000f782
mov dword [eax], 0xfdbd
jmp 0x10022015
push 0
lea ecx, [ebp - 0x2ac]
call fcn.1000f782
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x70], 0
jne 0x10022075
push 0
lea ecx, [ebp - 0x2ac]
call fcn.1000f782
cmp dword [eax], 0
jne 0x10022075
and dword [ebp - 0x508], 0
jmp 0x1002207f
mov dword [ebp - 0x508], 1
push 0
lea ecx, [ebp - 0x2ac]
call fcn.1000f782
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x70], 0
je 0x100220ee
mov esi, dword [ebp - 0x9d8]
push 1
lea ecx, [ebp - 0xafc]
call fcn.1000f782
cmp esi, dword [eax]
jge 0x100220b8
mov dword [ebp - 0x874], 1
jmp 0x100220bf
and dword [ebp - 0x874], 0
mov dword [ebp - 0x80], 0x93c1
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xd68], eax
push 0
lea ecx, [ebp - 0x2ac]
call fcn.1000f782
cmp dword [ebp - 0x80], 0
je 0x100220ee
mov dword [ebp - 0x500], 1
jmp 0x100220f5
and dword [ebp - 0x500], 0
push 0
lea ecx, [ebp - 0x2ac]
call fcn.1000f782
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x70]
cmp dword [ebp - 0x500], eax
jl 0x1002211c
mov dword [ebp - 0x7b4], 1
jmp 0x10022123
and dword [ebp - 0x7b4], 0
push 1
lea ecx, [ebp - 0xafc]
call fcn.1000f782
mov ecx, dword [ebp - 0x7b4]
cmp ecx, dword [eax]
jg 0x10022159
push 0
lea ecx, [ebp - 0x2ac]
call fcn.1000f782
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x70], 0
jne 0x10022159
and dword [ebp - 0x684], 0
jmp 0x10022163
mov dword [ebp - 0x684], 1
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp - 0x508]
sub esi, dword [ebp - 0x684]
add esi, dword [ebp + eax - 0x70]
push 0
lea ecx, [ebp - 0x2ac]
call fcn.1000f782
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x70], esi
jne 0x1002219a
mov dword [ebp - 0x32c], 1
jmp 0x100221a1
and dword [ebp - 0x32c], 0
push 0
lea ecx, [ebp - 0x2ac]
call fcn.1000f782
mov eax, dword [eax]
mov ecx, dword [ebp - 0x32c]
mov dword [ebp + eax*4 - 0x70], ecx
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0xa58], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xafc]
call fcn.1000f766
jmp 0x10021faa
cmp dword [ebp - 0x304], 0x2967684a
jne 0x10022204
cmp dword [ebp - 0x80], 0
je 0x10022204
mov dword [ebp - 0x510], 1
jmp 0x1002220b
and dword [ebp - 0x510], 0
mov esi, dword [ebp - 0x87c]
push 0
lea ecx, [ebp - 0x2ac]
call fcn.1000f782
mov eax, dword [eax]
imul eax, dword [ebp - 0x510]
cmp eax, esi
jle 0x10022237
mov dword [ebp - 0x9e0], 1
jmp 0x1002223e
and dword [ebp - 0x9e0], 0
push 1
lea ecx, [ebp - 0x2ac]
call fcn.1000f782
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x80]
jge 0x1002225f
mov dword [ebp - 0x518], 1
jmp 0x10022266
and dword [ebp - 0x518], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x70]
mov dword [ebp - 0x734], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x734]
mov dword [ebp + eax - 0x70], ecx
mov eax, dword [ebp - 0x734]
cmp eax, dword [ebp - 0x518]
jge 0x100222a0
mov dword [ebp - 0x884], 1
jmp 0x100222a7
and dword [ebp - 0x884], 0
mov dword [ebp - 0x80], 1
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xa60], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2ac]
call fcn.1000f766
push 0x1b3
push 1
push 0x776a
push 0x62e4
push 0x2b3c
push 0
push 0x5733
call fcn.1001ccc0
add esp, 0x1c
mov dword [ebp - 0x1bc], 0
jmp 0x10022304
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 3
jge 0x10022320
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0xb08], 0x4b25b3b9
jmp 0x100222f7
mov dword [ebp - 0x27c], 1
mov dword [ebp - 0x27c], 0xfffffffb
jmp 0x10022343
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0x13
jle 0x1002236e
mov dword [ebp - 0x88c], 0xfffffff8
lea eax, [ebp - 0x88c]
push eax
push 0
push 0x7e8a
call fcn.1002b8db
add esp, 0xc
jmp 0x10022336
mov byte [ebp - 0xc1], 0
push 0x4ff1
push 0x39b9
push 0x790e
push 0
push 0
push 0x7a30
lea eax, [ebp - 0xc1]
push eax
call fcn.1001a726
add esp, 0x1c
mov dword [ebp - 0x520], 0x5ca9
mov dword [ebp - 0x9e8], 0x100095e8
cmp dword [ebp - 0x520], 0x5e8a
jle 0x100224ad
and dword [ebp - 0x1cc], 0
jmp 0x100223d6
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0x5d4
jge 0x1002249c
and dword [ebp - 0x29c], 0
jmp 0x100223fc
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0x3f61
jge 0x10022497
and dword [ebp - 0x1c4], 0
jmp 0x10022422
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0x65a9
jge 0x10022492
and dword [ebp - 0x244], 0
jmp 0x10022444
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0x1fb9
jge 0x10022490
mov eax, dword [ebp - 0x1c4]
cdq
idiv dword [ebp - 0x244]
mov eax, dword [ebp - 0x1cc]
add eax, dword [ebp - 0x29c]
and eax, edx
cdq
mov dword [ebp - 0x90c], eax
mov dword [ebp - 0x908], edx
push dword [ebp - 0x908]
push dword [ebp - 0x90c]
mov ecx, 0x10609ad8
call fcn.1000f5cf
jmp 0x10022437
jmp 0x10022415
jmp 0x100223ef
jmp 0x100223c9
push 0
push 0x38c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb08], 0
je 0x100224cb
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb08], 0
mov dword [ebp - 0x30], 0xea66e58d
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xb08]
sub ecx, dword [ebp + eax - 0xb08]
cmp ecx, dword [ebp - 0x30]
jg 0x100224fd
mov dword [ebp - 0x68c], 1
jmp 0x10022504
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x68c]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 4], 0x15
cmp dword [ebp - 0x520], 0x5c09
jge 0x10022533
mov edx, dword [ebp - 0x9e8]
mov ecx, 0x10609ad8
call fcn.10011079
jmp 0x1002254f
or dword [ebp - 4], 0xffffffff
jmp 0x10022559
mov dword [ebp - 0xab4], 0xe91a049f
mov dword [ebp - 0xab0], 0xe91a049f
mov dword [ebp - 0xaac], 0xe91a049f
mov dword [ebp - 0xaa8], 0xe91a049f
mov dword [ebp - 0x94], 0xc1ec2db2
mov dword [ebp - 0x1dc], 0xab56411d
mov dword [ebp - 0x73c], 1
push 3
lea ecx, [ebp - 0x81c]
call fcn.1000f6e4
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x9c], 0xc3e1b8d8
mov dword [ebp - 0x1d4], 0
jmp 0x100225d6
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 3
jge 0x100225f8
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x81c]
call fcn.1000f782
mov dword [eax], 0x5d732ada
jmp 0x100225c9
mov dword [ebp - 0x94], 3
jmp 0x10022611
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x100228c1
mov dword [ebp - 0xb68], 0xefa97f51
mov dword [ebp - 0xb64], 0xefa97f51
mov dword [ebp - 0xb60], 0xefa97f51
mov dword [ebp - 0xb5c], 0xefa97f51
lea ecx, [ebp - 0x30d]
call fcn.1000f791
push eax
lea eax, [ebp - 0xb58]
push eax
lea eax, [ebp - 0xb68]
push eax
lea ecx, [ebp - 0xe54]
call fcn.1000f794
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xbbc]
call fcn.1000f740
mov byte [ebp - 4], 0x18
push 4
pop eax
shl eax, 0
mov ecx, 0x2a3b3f36
sub ecx, dword [ebp + eax - 0xab4]
cmp ecx, dword [ebp - 0x94]
jle 0x100226cf
mov dword [ebp - 0xd78], 5
push 0x4a71
push 0x597c
push 0
push 0x74fc
lea eax, [ebp - 0x9c]
push eax
push 0x3db4
push 1
call fcn.1001d54a
add esp, 0x1c
jmp 0x100228ad
mov dword [ebp - 0xa68], 0
mov dword [ebp - 0x24c], 0
jmp 0x100226f2
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 2
jge 0x1002270e
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0x804], 0x116971db
jmp 0x100226e5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x804]
mov dword [ebp - 0xd80], eax
push 1
lea ecx, [ebp - 0x81c]
call fcn.1000f782
cmp dword [eax], 0
jne 0x1002273f
mov dword [ebp - 0x78c], 1
jmp 0x10022746
and dword [ebp - 0x78c], 0
cmp dword [ebp - 0x78c], 0xfffffff9
jne 0x1002276d
push 1
lea ecx, [ebp - 0x81c]
call fcn.1000f782
cmp dword [eax], 0
je 0x1002276d
mov dword [ebp - 0x528], 1
jmp 0x10022774
and dword [ebp - 0x528], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x528]
add ecx, 0x144af
cmp ecx, dword [ebp + eax - 0x804]
jg 0x1002279b
mov dword [ebp - 0x694], 1
jmp 0x100227a2
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp + eax*4 - 0xab4]
cmp dword [ebp - 0x694], eax
jne 0x100227c3
mov dword [ebp - 0x530], 1
jmp 0x100227ca
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x73c], eax
mov eax, dword [ebp - 0x73c]
sub eax, 0x213a
cmp eax, 0xfffffff7
jg 0x100227f2
mov dword [ebp - 0x538], 1
jmp 0x100227f9
and dword [ebp - 0x538], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x804]
cmp dword [ebp - 0x538], eax
jg 0x1002281a
mov dword [ebp - 0x69c], 1
jmp 0x10022821
and dword [ebp - 0x69c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x804]
cmp eax, dword [ebp - 0x69c]
jne 0x10022842
mov dword [ebp - 0x894], 1
jmp 0x10022849
and dword [ebp - 0x894], 0
push 2
lea ecx, [ebp - 0xbbc]
call fcn.1000f782
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp + eax*4 - 0xab4]
cmp eax, dword [ebp - 0x9c]
jg 0x10022877
mov dword [ebp - 0x540], 1
jmp 0x1002287e
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0xa68], eax
push 1
lea ecx, [ebp - 0x81c]
call fcn.1000f782
cmp dword [eax], 0
je 0x100228ad
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xbbc]
call fcn.1000f766
jmp 0x100228c1
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xbbc]
call fcn.1000f766
jmp 0x10022604
mov dword [ebp - 0x9c], 0
jmp 0x100228da
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jg 0x1002293b
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x81c]
call fcn.1000f782
cmp dword [eax], 0
je 0x100228fb
jmp 0x1002293b
mov dword [ebp - 0x1dc], 2
jmp 0x10022914
mov eax, dword [ebp - 0x1dc]
dec eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
jl 0x10022939
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x10022937
push 0
call fcn.10033961
pop ecx
jmp 0x10022907
jmp 0x100228cd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x81c]
call fcn.1000f766
mov dword [ebp - 0xfc], 0xb
jmp 0x10022963
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0xfffffff8
jne 0x100243a3
mov dword [ebp - 0x30], 0
jmp 0x10022980
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffffa
jge 0x10022d91
mov dword [ebp - 0x6a4], 0xffffffff
mov dword [ebp - 0xd74], 0
mov dword [ebp - 0xb34], 1
mov dword [ebp - 0xb30], 1
mov dword [ebp - 0xb2c], 1
mov dword [ebp - 0xb28], 1
mov dword [ebp - 0x89c], 0x87697ab8
mov dword [ebp - 0x7cc], 0xfffffffd
mov dword [ebp - 0x9f8], 0x8a064f57
mov dword [ebp - 0x284], 0
jmp 0x100229fd
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 2
jge 0x10022a19
mov eax, dword [ebp - 0x284]
mov dword [ebp + eax*4 - 0xcd4], 0xfff6
jmp 0x100229f0
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x10022a4e
push 0x2bb8
push 0x1d99
push 0x75a
push 0x78c0
push 0
push 0x79f4
call fcn.10028c33
add esp, 0x18
mov eax, dword [ebp - 0x6a4]
mov dword [ebp - 0xc80], eax
cmp dword [ebp - 0x7cc], 1
jge 0x10022a75
cmp dword [ebp - 0x7cc], 0
jne 0x10022a75
and dword [ebp - 0x548], 0
jmp 0x10022a7f
mov dword [ebp - 0x548], 1
cmp dword [ebp - 0x548], 0x94628aea
jb 0x10022a92
cmp dword [ebp - 0x89c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcd4]
mov dword [ebp - 0xc88], eax
mov eax, dword [ebp - 0x9f8]
mov dword [ebp - 0xc90], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb34], 0xd2ad05b3
jae 0x10022ad0
mov dword [ebp - 0x550], 1
jmp 0x10022ad7
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x6a4]
cmp dword [ebp - 0x550], eax
je 0x10022afa
mov eax, 0xa3ebef27
test eax, eax
je 0x10022afa
mov dword [ebp - 0x744], 1
jmp 0x10022b01
and dword [ebp - 0x744], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x744]
mov dword [ebp + eax - 0xb34], ecx
mov dword [ebp - 0x1e4], 1
mov dword [ebp - 0x1e4], 0
jmp 0x10022b37
mov eax, dword [ebp - 0x1e4]
dec eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0xfffffffb
jge 0x10022d8c
mov dword [ebp - 0x11c], 0x48261f9c
mov dword [ebp - 0xf4], 1
mov dword [ebp - 0x1ec], 0x5b0e446d
mov eax, dword [ebp - 0x1ec]
dec eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0xf4], 1
jl 0x10022b84
mov dword [ebp - 0x558], 1
jmp 0x10022b8b
and dword [ebp - 0x558], 0
cmp dword [ebp - 0x558], 1
jb 0x10022cc5
mov dword [ebp - 0xa88], 0xfffffffe
mov dword [ebp - 0x8b4], 0xffffffff
mov dword [ebp - 0xf4], 0x1d
jmp 0x10022bc5
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0x15
je 0x10022cc0
push 3
lea ecx, [ebp - 0xbe0]
call fcn.1000f6e4
mov dword [ebp - 4], 0x19
push 1
lea ecx, [ebp - 0xbc8]
call fcn.1000f6e4
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x8ac], 0xd4e2095e
mov dword [ebp - 0xa80], 0xf0e4f200
lea eax, [ebp - 0x8a4]
push eax
push 0x77ba
push 0
lea eax, [ebp - 0xbe0]
push eax
push 0x152
call fcn.10028423
add esp, 0x14
push 0
lea eax, [ebp - 0xbc8]
push eax
lea eax, [ebp - 0x8a4]
push eax
push 0xb78
call fcn.1002c385
add esp, 0x10
lea eax, [ebp - 0xa80]
push eax
push 1
push 0x3d9c
push 0x7479
lea eax, [ebp - 0xbe0]
push eax
push 0x30c1
push 1
lea eax, [ebp - 0xbc8]
push eax
lea eax, [ebp - 0x1ec]
push eax
lea eax, [ebp - 0x8ac]
push eax
push 0
lea eax, [ebp - 0xa88]
push eax
lea eax, [ebp - 0x8b4]
push eax
push 0x3ba0
call fcn.1001c5f5
add esp, 0x38
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xbc8]
call fcn.1000f766
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbe0]
call fcn.1000f766
jmp 0x10022bb8
jmp 0x10022d73
push 1
lea ecx, [ebp - 0xbf8]
call fcn.1000f6e4
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x254], 0
jmp 0x10022cf2
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 1
jge 0x10022d14
push dword [ebp - 0x254]
lea ecx, [ebp - 0xbf8]
call fcn.1000f782
mov dword [eax], 0xfffffffc
jmp 0x10022ce5
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0xc98], eax
mov esi, dword [ebp - 0xf4]
push 0
lea ecx, [ebp - 0xbf8]
call fcn.1000f782
mov dword [eax], esi
mov dword [ebp - 0x11c], 0
jmp 0x10022d4e
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jg 0x10022d64
cmp dword [ebp - 0x11c], 0
je 0x10022d62
jmp 0x10022d64
jmp 0x10022d41
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbf8]
call fcn.1000f766
mov dword [ebp - 0xa04], 1
mov dword [ebp - 0xa04], 0
jmp 0x10022b2a
jmp 0x10022979
mov dword [ebp - 0x6b4], 1
mov dword [ebp - 0x74c], 1
mov dword [ebp - 0x6ac], 0x6191
mov dword [ebp - 0xa4c], 0x10009670
cmp dword [ebp - 0x6ac], 0x61bb
jle 0x10022ed3
and dword [ebp - 0x25c], 0
jmp 0x10022ddf
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0x2f38
jge 0x10022ed3
and dword [ebp - 0x2b4], 0
jmp 0x10022e05
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0x50e9
jge 0x10022ece
and dword [ebp - 0x1f4], 0
jmp 0x10022e2b
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0x74b4
jge 0x10022ec9
and dword [ebp - 0x1fc], 0
jmp 0x10022e51
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0x616e
jge 0x10022ec4
mov ecx, dword [ebp - 0x2b4]
add ecx, dword [ebp - 0x1f4]
mov eax, dword [ebp - 0x25c]
sar eax, cl
mov ecx, dword [ebp - 0x1fc]
shl eax, cl
cdq
mov dword [ebp - 0x918], eax
mov dword [ebp - 0x914], edx
push dword [ebp - 0x914]
push dword [ebp - 0x918]
lea ecx, [ebp - 0xeec]
call fcn.1000d000
pop ecx
pop ecx
mov dword [ebp - 0x8bc], eax
mov ecx, dword [ebp - 0x8bc]
call fcn.1000f5af
push eax
call fcn.1004b356
pop ecx
lea ecx, [ebp - 0xeec]
call fcn.1000f5a5
jmp 0x10022e44
jmp 0x10022e1e
jmp 0x10022df8
jmp 0x10022dd2
mov dword [ebp - 0x30c], 0x69f30c
mov dword [ebp - 4], 0x1c
cmp dword [ebp - 0x6ac], 0x6011
jge 0x10022efc
push dword [ebp - 0xa4c]
call fcn.1004b356
pop ecx
jmp 0x10022f18
or dword [ebp - 4], 0xffffffff
jmp 0x10022f22
push 3
lea ecx, [ebp - 0xae4]
call fcn.1000f6e4
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0xca0], 0xffffffff
mov dword [ebp - 0x328], 0x40a98cee
mov dword [ebp - 0x560], 0x91b76e1e
mov dword [ebp - 0x8cc], 0x8d955a61
mov dword [ebp - 0x124], 0x249687fd
mov dword [ebp - 0x8d4], 0xffffffff
mov dword [ebp - 0xa14], 0xfffffffc
mov dword [ebp - 0x144], 0
jmp 0x10022f95
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jge 0x10022fb1
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0xa6c], 0xd214c405
jmp 0x10022f88
lea eax, [ebp - 0x144]
push eax
push 0
push 0x1d68
push 0x9d0
push 1
lea eax, [ebp - 0xae4]
push eax
push 0x24f8
push 0
push 0x1e82
push 0xd60
call fcn.1002cf53
add esp, 0x28
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0xca8], eax
push 2
lea ecx, [ebp - 0xae4]
call fcn.1000f782
mov dword [eax], 0x2e26
mov dword [ebp - 0x560], 0x2e26
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x8c4], eax
mov eax, dword [ebp - 0x560]
mov dword [ebp - 0xa0c], eax
mov eax, dword [ebp - 0x328]
dec eax
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x8c4]
cmp eax, dword [ebp - 0xa0c]
jl 0x1002304e
mov dword [ebp - 0x794], 1
jmp 0x10023055
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0xcb0], eax
mov eax, dword [ebp - 0x30c]
cmp dword [ebp - 0x794], eax
jg 0x1002307b
mov dword [ebp - 0x568], 1
jmp 0x10023082
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x30c]
sub eax, dword [ebp - 0x568]
mov dword [ebp - 0x8cc], eax
mov esi, dword [ebp - 0x124]
push 2
lea ecx, [ebp - 0xae4]
call fcn.1000f782
cmp dword [eax], esi
jg 0x100230b7
mov dword [ebp - 0x578], 1
jmp 0x100230be
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x570], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x570]
mov dword [ebp + eax - 0xa6c], ecx
mov eax, dword [ebp - 0x570]
mov dword [ebp - 0x74c], eax
mov eax, dword [ebp - 0x74c]
imul eax, dword [ebp - 0x578]
test eax, eax
je 0x1002310f
cmp dword [ebp - 0x8d4], 0
je 0x1002310f
mov dword [ebp - 0x6bc], 1
jmp 0x10023116
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0xa14], eax
mov dword [ebp - 0x124], 0xfffffff3
jmp 0x1002313b
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xfffffff2
je 0x1002318a
mov dword [ebp - 0x8dc], 0x38d6
mov byte [ebp - 0xb4], 0
push 0x2cc1
push 0
lea eax, [ebp - 0xb4]
push eax
call fcn.10033381
add esp, 0xc
push 0x62b0
lea eax, [ebp - 0x8dc]
push eax
push 0
push 1
push 0x2f91
call fcn.1001a902
add esp, 0x14
jmp 0x1002312e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xae4]
call fcn.1000f766
mov dword [ebp - 0x30], 0xa
jmp 0x100231a9
cmp dword [ebp - 0x30], 0xfffffffd
jle 0x1002439e
mov dword [ebp - 0x28c], 0
jmp 0x100231cc
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 1
jge 0x100231e8
mov eax, dword [ebp - 0x28c]
mov dword [ebp + eax*4 - 0x204], 0xfffffffd
jmp 0x100231bf
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x204], 0
jmp 0x10023216
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x204]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x204], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x204], 0xffffffe3
jle 0x10023249
mov byte [ebp - 0xc9], 0
push 0
push 1
push 0x50b4
push 1
lea eax, [ebp - 0xc9]
push eax
call fcn.1002ce64
add esp, 0x14
jmp 0x100231fb
push 1
lea ecx, [ebp - 0xaf0]
call fcn.1000f6e4
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x38], 0x26ff23b1
mov dword [ebp - 0xdc], 0xfffffffa
mov dword [ebp - 0x13c], 0x84cb8f6c
mov dword [ebp - 0xa8c], 5
mov dword [ebp - 0xb90], 0x1e183a09
mov dword [ebp - 0xb8c], 0x1e183a09
mov dword [ebp - 0xb88], 0x1e183a09
mov dword [ebp - 0xb84], 0x1e183a09
lea ecx, [ebp - 0x315]
call fcn.1000f791
push eax
lea eax, [ebp - 0xb80]
push eax
lea eax, [ebp - 0xb90]
push eax
lea ecx, [ebp - 0xe6c]
call fcn.1000f794
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc40]
call fcn.1000f740
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x3b4], 0x8cf49cf9
mov dword [ebp - 0x264], 0
jmp 0x10023306
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 1
jge 0x10023322
mov eax, dword [ebp - 0x264]
mov dword [ebp + eax*4 - 0x38c], 1
jmp 0x100232f9
cmp dword [ebp - 0x38], 0
jne 0x10023337
cmp dword [ebp - 0x38], 0
jne 0x10023337
and dword [ebp - 0x7bc], 0
jmp 0x10023341
mov dword [ebp - 0x7bc], 1
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xcb8], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xcc0], eax
mov eax, 0xffff
cmp eax, 0xffffffff
ja 0x1002336c
mov dword [ebp - 0x580], 1
jmp 0x10023373
and dword [ebp - 0x580], 0
imul eax, dword [ebp - 0x580], 0x69f4
cmp dword [ebp - 0x7bc], eax
jne 0x10023391
mov dword [ebp - 0x588], 1
jmp 0x10023398
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x13c]
imul eax, dword [ebp - 0x588]
test eax, eax
je 0x100233c7
cmp dword [ebp - 0x13c], 0
je 0x100233c7
mov eax, 0xfff6
test eax, eax
je 0x100233c7
mov dword [ebp - 0xa54], 1
jmp 0x100233ce
and dword [ebp - 0xa54], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xccc], eax
cmp dword [ebp - 0xdc], 0
je 0x1002346d
mov dword [ebp - 0x8ec], 0x28eaf608
mov dword [ebp - 0xa1c], 0xab4d258d
mov dword [ebp - 0x8e4], 0x3a81f6ed
push 0x554e
lea eax, [ebp - 0xc40]
push eax
push 1
push 0x1810
push 0
lea eax, [ebp - 0x8e4]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xa1c]
push eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0xa8c]
push eax
call fcn.1001ed3f
add esp, 0x30
mov byte [ebp - 0xb6], 0
movzx eax, byte [ebp - 0xb6]
test eax, eax
je 0x10023468
call dword [sym.imp.KERNEL32.dll_GetVersion]
jmp 0x10023a8b
mov dword [ebp - 0xa7c], 1
mov dword [ebp - 0xa78], 1
mov dword [ebp - 0xa74], 1
mov dword [ebp - 0xa70], 1
mov dword [ebp - 0x188], 0x5e429b05
mov dword [ebp - 0x20c], 0
jmp 0x100234b8
cmp dword [ebp - 0x20c], 1
jge 0x100234d4
jmp 0x10022956
mov dword [ebp - 0xf0], 0xfffffffb
mov dword [ebp - 0x1c8], 0
jmp 0x100243c6
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
jge 0x100243e2
mov eax, dword [ebp - 0x1c8]
mov dword [ebp + eax*4 - 0xe44], 1
jmp 0x100243b9
mov byte [ebp - 0xba], 0
movzx eax, byte [ebp - 0xba]
test eax, eax
je 0x10024414
push 1
push 0x6dbf
push 0x340a
push 0x75bb
push 0
push 0x3a6a
call fcn.1002ca05
add esp, 0x18
mov dword [ebp - 0xf0], 0
jmp 0x1002442d
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 2
jg 0x100244f4
mov eax, dword [ebp - 0xf0]
cmp dword [ebp + eax*4 - 0xe44], 0
je 0x1002449e
mov byte [ebp - 0xd3], 0
movzx eax, byte [ebp - 0xd3]
test eax, eax
je 0x1002448b
push 0x307c
push 0x914
push 0x2c86
push 0x5ee8
push 1
push 0x6ede
push 0x16b9
push 1
push 0x4726
call fcn.10019ba3
add esp, 0x24
push 1
push 0
push 0x4ec5
call fcn.10019c67
add esp, 0xc
jmp 0x100244ef
mov byte [ebp - 0xbc], 0
movzx eax, byte [ebp - 0xbc]
test eax, eax
je 0x100244e4
push 0x2ba1
push 0x5eed
push 0x23b0
push 0
push 0xe9c
push 0x1f75
push 0x199c
push 0x6044
push 0x4768
push 0
call fcn.10028681
add esp, 0x28
cmp dword [ebp - 0xf0], 0
je 0x100244ef
jmp 0x100244f4
jmp 0x10024420
mov eax, dword [ebp - 0x1e0]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0x1e0]
mov ecx, dword [ecx]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xd88], 0x41b3c692
mov byte [ebp - 0xae], 0
push 1
push 1
lea eax, [ebp - 0xae]
push eax
call fcn.10019c67
add esp, 0xc
mov byte [ebp - 0xaf], 0
movzx eax, byte [ebp - 0xaf]
test eax, eax
je 0x1002455b
push 1
push 0
push 0x5ddd
push 0xded
call fcn.1001a44e
add esp, 0x10
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0xa4], 0xe04a276a
mov dword [ebp - 0x1d8], 0xfffffffd
mov dword [ebp - 0x934], 0xffffffff
mov dword [ebp - 0x20], 0xffffffe4
jmp 0x10024597
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff2
jle 0x1002482a
mov dword [ebp - 0x1d0], 0xd37a5b7d
mov dword [ebp - 0x314], 0xfff8
mov dword [ebp - 0x4b4], 0xcccaea0a
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x10024616
push 0x5265
push 0x4077
push 0x6779
push 1
push 0x7ba0
push 0x42f6
push 0x3177
push 0x3fd9
push 0x4505
push 1
push 0x4740
push 0x4e8f
push 0x3239
push 1
call fcn.10019e08
add esp, 0x38
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0xd90], eax
mov eax, dword [ebp - 0x1d0]
cmp eax, dword [ebp - 0x1d0]
jge 0x1002463c
mov dword [ebp - 0x494], 1
jmp 0x10024643
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x1d0], 0
jne 0x1002465e
cmp dword [ebp - 0x314], 0
jne 0x1002465e
and dword [ebp - 0x484], 0
jmp 0x10024668
mov dword [ebp - 0x484], 1
cmp dword [ebp - 0x484], 0x9fff
jg 0x10024680
mov dword [ebp - 0x48c], 1
jmp 0x10024687
and dword [ebp - 0x48c], 0
imul eax, dword [ebp - 0x48c], 0
dec eax
dec eax
cmp eax, dword [ebp - 0x314]
je 0x100246a4
mov dword [ebp - 0x49c], 1
jmp 0x100246ab
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x494]
cmp eax, dword [ebp - 0x49c]
jge 0x100246c5
mov dword [ebp - 0xa84], 1
jmp 0x100246cc
and dword [ebp - 0xa84], 0
mov eax, 0x1cb6
imul eax, eax, 0xba87
cmp eax, 0x14c5530c
jne 0x100246ea
mov dword [ebp - 0x4a4], 1
jmp 0x100246f1
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x314]
add eax, dword [ebp - 0x4a4]
add eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
jle 0x10024711
mov dword [ebp - 0x4ac], 1
jmp 0x10024718
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebp - 0x4b4]
cmp eax, dword [ebp - 0x20]
jg 0x1002473b
mov dword [ebp - 0x4bc], 1
jmp 0x10024742
and dword [ebp - 0x4bc], 0
imul eax, dword [ebp - 0x4bc], 9
test eax, eax
je 0x1002476f
mov byte [ebp - 0xb7], 0
movzx eax, byte [ebp - 0xb7]
test eax, eax
je 0x1002476a
push 0
push 1
call fcn.1001a857
pop ecx
pop ecx
jmp 0x10024825
push 2
lea ecx, [ebp - 0xc58]
call fcn.1000f6e4
mov dword [ebp - 4], 0x2a
push 0x7682
lea eax, [ebp - 0x110]
push eax
push 0
push 1
lea eax, [ebp - 0xc58]
push eax
push 0x5c4e
push 0xe14
call fcn.1002bebc
add esp, 0x1c
mov dword [ebp - 0x110], 0
jmp 0x100247c5
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 4
jge 0x100247e1
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0xe84], 0
jmp 0x100247b8
mov dword [ebp - 0x24], 0
jmp 0x100247f1
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jg 0x10024816
push 4
pop eax
imul esi, eax, 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0xc58]
call fcn.1000f782
mov eax, dword [eax]
mov dword [ebp + esi - 0xe84], eax
jmp 0x100247ea
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc58]
call fcn.1000f766
jmp 0x10024590
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jne 0x100249a6
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0xa4]
je 0x10024857
mov dword [ebp - 0x4c4], 1
jmp 0x1002485e
and dword [ebp - 0x4c4], 0
cmp dword [ebp - 0x20], 0xffffffff
jae 0x10024870
mov dword [ebp - 0x4cc], 1
jmp 0x10024877
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x4c4]
sub eax, dword [ebp - 0x4cc]
cmp eax, 1
jge 0x10024894
mov dword [ebp - 0x4d4], 1
jmp 0x1002489b
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x4d4]
test eax, eax
jne 0x100248b8
cmp dword [ebp - 0x24], 0
jne 0x100248b8
and dword [ebp - 0x4dc], 0
jmp 0x100248c2
mov dword [ebp - 0x4dc], 1
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x4dc], eax
jle 0x100248d9
mov dword [ebp - 0x4e4], 1
jmp 0x100248e0
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
sub eax, 3
cmp eax, dword [ebp - 0x20]
jge 0x100248fa
mov dword [ebp - 0x928], 1
jmp 0x10024901
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xd98], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0xa4]
jge 0x10024924
mov dword [ebp - 0x4ec], 1
jmp 0x1002492b
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0xa4]
je 0x10024954
cmp dword [ebp - 0x1d8], 0
je 0x10024954
mov dword [ebp - 0x4f4], 1
jmp 0x1002495b
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x4f4], eax
jne 0x10024975
mov dword [ebp - 0xa34], 1
jmp 0x1002497c
and dword [ebp - 0xa34], 0
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0xda0], eax
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x24]
jl 0x1002499f
mov dword [ebp - 0x4fc], 1
jmp 0x100249a6
and dword [ebp - 0x4fc], 0
cmp dword [ebp - 0x1d8], 0x19c8
jne 0x100249be
mov dword [ebp - 0x504], 1
jmp 0x100249c5
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x934], eax
mov dword [ebp - 0x118], 0xe0648261
mov dword [ebp - 0xc68], 8
mov dword [ebp - 0xc64], 8
mov dword [ebp - 0xc60], 8
mov dword [ebp - 0xc5c], 8
mov dword [ebp - 0x118], 3
jmp 0x10024a1c
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0x1a
jge 0x10024aa3
mov dword [ebp - 0x50], 0x925b0e44
mov dword [ebp - 0x50], 0
jmp 0x10024a3c
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x13
je 0x10024a78
mov dword [ebp - 0xa64], 0x7e4f
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x50]
jle 0x10024a63
mov dword [ebp - 0x50c], 1
jmp 0x10024a6a
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0xa64], eax
jmp 0x10024a35
mov dword [ebp - 0x50], 0
jmp 0x10024a88
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jge 0x10024a9e
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0xc68], 0x2d9ee1c9
jmp 0x10024a81
jmp 0x10024a0f
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x10024ac0
push 1
push 0
call fcn.1001ac1f
pop ecx
pop ecx
and dword [ebp - 0x2e0], 0
jmp 0x10024adf
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x6c]
add eax, 0x28
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x1e0]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x2e0], eax
jge 0x1002533a
mov dword [ebp - 0x1f0], 0xffffffff
push 2
lea ecx, [ebp - 0xd64]
call fcn.1000f6e4
mov dword [ebp - 4], 0x2b
mov dword [ebp - 0x940], 0xfffffffd
mov dword [ebp - 0x1e8], 0
jmp 0x10024b38
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 2
jge 0x10024b5a
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0xd64]
call fcn.1000f782
mov dword [eax], 0xecba2afe
jmp 0x10024b2b
mov dword [ebp - 0x1f0], 0
jmp 0x10024b73
mov eax, dword [ebp - 0x1f0]
dec eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0xffffffe7
je 0x10024c2c
mov dword [ebp - 0x1f8], 0
jmp 0x10024b99
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 3
jge 0x10024bb5
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0xb14], 1
jmp 0x10024b8c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb14], 0
jmp 0x10024be3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb14]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xb14], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb14], 1
jg 0x10024c1d
mov byte [ebp - 0xbb], 0
movzx eax, byte [ebp - 0xbb]
test eax, eax
je 0x10024c1b
push 1
push 1
push 0x7bf7
push 0x2c56
call fcn.1001a44e
add esp, 0x10
jmp 0x10024bc8
mov dword [ebp - 0x940], 0x5efa20bd
jmp 0x10024b66
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd64]
call fcn.1000f766
mov eax, dword [ebp - 0x6c]
cmp dword [eax + 0x10], 0
jne 0x10024d33
push 0
push 0x578b
push 0x1636
call fcn.10032584
add esp, 0xc
lea eax, [ebp - 0x2e8]
push eax
push 0x3aa7
push 1
push 1
push 0x1a1e
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x58c]
push eax
push 0x51bf
lea eax, [ebp - 0xa3c]
push eax
call fcn.1001a4e2
add esp, 0x24
mov dword [ebp - 0x120], 7
mov dword [ebp - 0x120], 0xf
jmp 0x10024cb3
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xffffffed
je 0x10024d2e
mov dword [ebp - 0x200], 0xfffffff7
mov dword [ebp - 0xa94], 0xdcc590f0
mov dword [ebp - 0x200], 0
jmp 0x10024ce9
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 6
jne 0x10024d29
mov dword [ebp - 0x94c], 0xf0ed
lea eax, [ebp - 0x94c]
push eax
lea eax, [ebp - 0xa94]
push eax
lea eax, [ebp - 0x120]
push eax
push 1
push 0
push 0x32e5
push 0x71b7
call fcn.1001a726
add esp, 0x1c
jmp 0x10024cdc
jmp 0x10024ca6
jmp 0x10024ac9
mov dword [ebp - 0x584], 0
mov dword [ebp - 0x55c], 0x73838a1f
mov dword [ebp - 0x210], 0xffffffff
mov dword [ebp - 0x554], 0xfffffff7
mov dword [ebp - 0x208], 0
jmp 0x10024d74
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 4
jge 0x10024d90
mov eax, dword [ebp - 0x208]
mov dword [ebp + eax*4 - 0x7f0], 0xaa9a
jmp 0x10024d67
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x7f0]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x7f0], eax
cmp dword [ebp - 0x210], 0
je 0x10024f79
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7f0]
mov dword [ebp - 0xda8], eax
cmp dword [ebp - 0x584], 1
jbe 0x10024def
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x7f0], 0
je 0x10024def
mov dword [ebp - 0x514], 1
jmp 0x10024df6
and dword [ebp - 0x514], 0
cmp dword [ebp - 0x514], 1
jb 0x10024e0b
mov dword [ebp - 0x51c], 1
jmp 0x10024e12
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x210]
imul eax, dword [ebp - 0x51c]
test eax, eax
jae 0x10024e38
cmp dword [ebp - 0x554], 0
je 0x10024e38
mov dword [ebp - 0x524], 1
jmp 0x10024e3f
and dword [ebp - 0x524], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x7f0]
add eax, dword [ebp - 0x524]
jne 0x10024e62
or eax, 0xffffffff
jne 0x10024e62
and dword [ebp - 0x52c], 0
jmp 0x10024e6c
mov dword [ebp - 0x52c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7f0]
cmp dword [ebp - 0x52c], eax
je 0x10024e8d
mov dword [ebp - 0x534], 1
jmp 0x10024e94
and dword [ebp - 0x534], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7f0]
cmp dword [ebp - 0x534], eax
jne 0x10024eb5
and dword [ebp - 0x56c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x7f0]
cmp eax, dword [ebp - 0x56c]
jne 0x10024fa1
mov dword [ebp - 0x574], 1
jmp 0x10024fa8
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x210]
imul eax, dword [ebp - 0x574]
cmp eax, 0x1f199e1f
jg 0x10024fc8
mov dword [ebp - 0x57c], 1
jmp 0x10024fcf
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0x584], eax
push 4
push 0x1000
mov eax, dword [ebp - 0x6c]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x58c]
add ecx, dword [eax + 0xc]
push ecx
push 0x2d22
push 0x5037
call fcn.10016449
pop ecx
pop ecx
call eax
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x6c]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0xa44]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x2e8]
call fcn.100167ed
add esp, 0xc
mov dword [ebp - 0x220], 9
push 1
lea ecx, [ebp - 0xbb0]
call fcn.1000f6e4
mov dword [ebp - 4], 0x2c
push 1
lea ecx, [ebp - 0x35c]
call fcn.1000f6e4
mov byte [ebp - 4], 0x2d
mov dword [ebp - 0xb54], 0xfffa
mov dword [ebp - 0xb50], 0xfffa
mov dword [ebp - 0xb4c], 0xfffa
mov dword [ebp - 0xb48], 0xfffa
mov dword [ebp - 0x5e8], 0
mov dword [ebp - 0x9fc], 0xfffffffb
mov dword [ebp - 0x64], 0
jmp 0x100250aa
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x100250c3
push dword [ebp - 0x64]
lea ecx, [ebp - 0xbb0]
call fcn.1000f782
or dword [eax], 0xffffffff
jmp 0x100250a3
mov dword [ebp - 0x64], 0
jmp 0x100250d3
cmp dword [ebp - 0x64], 1
jge 0x100250ef
jmp 0x10026a4b
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x8b0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa00], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x8b8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xa08], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x97c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x970], eax
mov eax, dword [ebp - 0x970]
movzx eax, byte [eax]
test eax, eax
je 0x100268c1
mov eax, dword [ebp - 0xa00]
mov dword [ebp - 0x988], eax
mov eax, dword [ebp - 0x97c]
mov dword [ebp - 0x898], eax
mov eax, dword [ebp - 0xa08]
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x988]
add ecx, dword [eax]
mov dword [ebp - 0x880], ecx
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
add eax, 8
mov dword [ebp - 0x298], eax
push 3
lea ecx, [ebp - 0xc28]
call fcn.1000f6e4
mov dword [ebp - 4], 0x2e
mov dword [ebp - 0xa18], 0xe4f1f13b
mov dword [ebp - 0x990], 0x2ea21e1d
mov dword [ebp - 0xa10], 0x314d41bd
mov dword [ebp - 0x998], 5
lea eax, [ebp - 0xdc0]
push eax
push 1
lea eax, [ebp - 0xc28]
push eax
push 0
call fcn.1001bbae
add esp, 0x10
lea eax, [ebp - 0xa10]
push eax
lea eax, [ebp - 0x990]
push eax
push 0x2d52
push 1
push 0
lea eax, [ebp - 0xc28]
push eax
lea eax, [ebp - 0xa18]
push eax
lea eax, [ebp - 0x998]
push eax
call fcn.1002ade0
add esp, 0x20
push 0x497e
push 0x70f5
push 0x4d83
push 0x21a1
push 0x6e0d
push 0x7c84
push 0x4ba9
push 0x245
push 0x3ee8
push 1
push 1
push 0x7cde
push 0x73d6
push 0
push 0x78b
call fcn.1001bc90
add esp, 0x3c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc28]
call fcn.1000f766
and dword [ebp - 0x2f0], 0
jmp 0x100254d8
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0x298]
inc eax
inc eax
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
sub eax, 8
shr eax, 1
cmp dword [ebp - 0x2f0], eax
jae 0x1002666d
mov dword [ebp - 0x608], 0xe1d
mov dword [ebp - 0x9a0], 0x100097f0
cmp dword [ebp - 0x608], 0x1010
jle 0x100255ef
and dword [ebp - 0x228], 0
jmp 0x1002552e
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0x7060
jge 0x100255ef
and dword [ebp - 0x230], 0
jmp 0x10025554
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0x64d1
jge 0x100255ea
and dword [ebp - 0x238], 0
jmp 0x1002557a
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0x5c77
jge 0x100255e5
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x230]
sar eax, cl
and eax, dword [ebp - 0x238]
cdq
mov dword [ebp - 0x954], eax
mov dword [ebp - 0x950], edx
push dword [ebp - 0x950]
push dword [ebp - 0x954]
lea ecx, [ebp - 0xed4]
call fcn.1000d000
pop ecx
pop ecx
mov dword [ebp - 0xa20], eax
mov ecx, dword [ebp - 0xa20]
call fcn.1000f5af
push eax
call fcn.1004b356
pop ecx
lea ecx, [ebp - 0xed4]
call fcn.1000f5a5
jmp 0x1002556d
jmp 0x10025547
jmp 0x10025521
mov dword [ebp - 4], 0x2f
cmp dword [ebp - 0x608], 0xbde
jge 0x1002560e
push dword [ebp - 0x9a0]
call fcn.1004b356
pop ecx
jmp 0x1002562a
or dword [ebp - 4], 0xffffffff
jmp 0x10025634
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0x34], 0xf47a6de
mov dword [ebp - 0x2f8], 0x2e63372
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x10025664
mov dword [ebp - 0x610], 1
jmp 0x1002566b
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x74]
imul eax, dword [ebp - 0x610]
test eax, eax
je 0x100256ab
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x100256a6
push 1
push 0x2369
push 0x1df
push 0x6a82
push 1
call fcn.1001b9c3
add esp, 0x14
jmp 0x10025a8e
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x630], 1
mov dword [ebp - 0x240], 0
jmp 0x100256d8
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 4
jge 0x100256f4
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0xdf8], 0x28f6
jmp 0x100256cb
mov dword [ebp - 0x34], 0
jmp 0x10025704
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jg 0x1002590d
mov dword [ebp - 0xac], 0x7b5b
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0x74], 0
jmp 0x10025735
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jg 0x10025908
mov dword [ebp - 0x248], 0
jmp 0x10025758
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 3
jge 0x10025774
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0xbd4], 0x69b7d6b5
jmp 0x1002574b
cmp dword [ebp - 0x34], 0
jne 0x1002578c
cmp dword [ebp - 0x128], 0
jne 0x1002578c
and dword [ebp - 0x640], 0
jmp 0x10025796
mov dword [ebp - 0x640], 1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbd4], 0
jne 0x100257b8
cmp dword [ebp - 0xac], 0
jne 0x100257b8
and dword [ebp - 0x618], 0
jmp 0x100257c2
mov dword [ebp - 0x618], 1
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x618], eax
je 0x100257dc
mov dword [ebp - 0x620], 1
jmp 0x100257e3
and dword [ebp - 0x620], 0
imul eax, dword [ebp - 0x620], 0xfffffffc
cmp eax, dword [ebp - 0x128]
jge 0x100257fe
mov dword [ebp - 0x628], 1
jmp 0x10025805
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x630], eax
cmp dword [ebp - 0x630], 0
je 0x1002582f
cmp dword [ebp - 0xac], 0
je 0x1002582f
mov dword [ebp - 0x638], 1
jmp 0x10025836
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x638]
jne 0x10025848
cmp dword [ebp - 0x34], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x2f8]
cmp dword [ebp - 0x640], eax
jg 0x1002586e
mov dword [ebp - 0x650], 1
jmp 0x10025875
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp + eax*4 - 0xdf8]
mov dword [ebp - 0x648], eax
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x648]
mov dword [ebp + eax*4 - 0xdf8], ecx
mov eax, dword [ebp - 0x648]
imul eax, dword [ebp - 0x650]
cmp eax, dword [ebp - 0xac]
jle 0x100258b6
mov dword [ebp - 0x658], 1
jmp 0x100258bd
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x658], eax
jge 0x100258d7
mov dword [ebp - 0x660], 1
jmp 0x100258de
and dword [ebp - 0x660], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x660]
mov dword [ebp + eax - 0xbd4], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbd4], 0
je 0x10025903
jmp 0x10025908
jmp 0x1002572e
jmp 0x100256fd
push 0
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x128]
push eax
push 0xf98
lea eax, [ebp - 0x34]
push eax
push 0x5561
call fcn.1002b63a
add esp, 0x18
mov dword [ebp - 0x668], 0x5beb
mov dword [ebp - 0x9a8], 0x10009870
cmp dword [ebp - 0x668], 0x5d70
jle 0x10025a49
and dword [ebp - 0x260], 0
jmp 0x1002596a
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0x40b6
jge 0x10025a29
and dword [ebp - 0x250], 0
jmp 0x10025990
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0xe39
jge 0x10025a24
and dword [ebp - 0x258], 0
jmp 0x100259b6
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0x62f8
jge 0x10025a1f
mov eax, dword [ebp - 0x250]
sub eax, dword [ebp - 0x258]
and eax, dword [ebp - 0x260]
cdq
mov dword [ebp - 0x960], eax
mov dword [ebp - 0x95c], edx
push dword [ebp - 0x95c]
push dword [ebp - 0x960]
lea ecx, [ebp - 0xf04]
call fcn.1000d000
pop ecx
pop ecx
mov dword [ebp - 0xa28], eax
mov ecx, dword [ebp - 0xa28]
call fcn.1000f5af
push eax
call fcn.1004b356
pop ecx
lea ecx, [ebp - 0xf04]
call fcn.1000f5a5
jmp 0x100259a9
jmp 0x10025983
jmp 0x1002595d
push 0
push 0x6e7
push 0x23b6
push 0
push 0x10c0
push 0x1d7e
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], 0x31
cmp dword [ebp - 0x668], 0x5b42
jge 0x10025a68
push dword [ebp - 0x9a8]
call fcn.1004b356
pop ecx
jmp 0x10025a84
or dword [ebp - 4], 0xffffffff
jmp 0x10025a8e
push 0x5e12
lea eax, [ebp - 0x34]
push eax
push 0x38b0
push 0x2a7
push 0x148f
push 1
push 1
push 0x27a6
lea eax, [ebp - 0x2f8]
push eax
push 1
call fcn.1001ba47
add esp, 0x28
push 4
lea ecx, [ebp - 0x368]
call fcn.1000f6e4
mov dword [ebp - 4], 0x33
push 3
lea ecx, [ebp - 0x2cc]
call fcn.1000f6e4
mov byte [ebp - 4], 0x34
mov dword [ebp - 0x14], 0xd6b3
mov dword [ebp - 0x130], 0xfffffff9
mov dword [ebp - 0x670], 0x187e
mov dword [ebp - 0xa30], 0x100098bc
cmp dword [ebp - 0x670], 0x1915
jle 0x10025b8f
and dword [ebp - 0x268], 0
jmp 0x10025b2c
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0xa85
jge 0x10025b8f
and dword [ebp - 0x270], 0
jmp 0x10025b4e
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0x4373
jge 0x10025b8d
mov eax, dword [ebp - 0x268]
mov ecx, dword [ebp - 0x270]
sar eax, cl
cdq
mov dword [ebp - 0x96c], eax
mov dword [ebp - 0x968], edx
push dword [ebp - 0x968]
push dword [ebp - 0x96c]
mov ecx, 0x10609ad8
call fcn.1000f5cf
jmp 0x10025b41
jmp 0x10025b1f
mov dword [ebp - 0x278], 0xffffffff
mov byte [ebp - 4], 0x35
cmp dword [ebp - 0x670], 0x182b
jge 0x10025bb9
mov edx, dword [ebp - 0xa30]
mov ecx, 0x10609ad8
call fcn.10011079
jmp 0x10025bd5
mov dword [ebp - 4], 0x34
jmp 0x10025be5
mov dword [ebp - 0x6e0], 0xffff
mov dword [ebp - 0xc78], 0x6ce2
mov dword [ebp - 0xc74], 0x6ce2
mov dword [ebp - 0xc70], 0x6ce2
mov dword [ebp - 0xc6c], 0x6ce2
mov dword [ebp - 0x58], 0
jmp 0x10025c27
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 4
jge 0x10025c43
push dword [ebp - 0x58]
lea ecx, [ebp - 0x368]
call fcn.1000f782
mov dword [eax], 0xb871c7bf
jmp 0x10025c20
mov dword [ebp - 0x58], 0
jmp 0x10025c53
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x10025c6f
push dword [ebp - 0x58]
lea ecx, [ebp - 0x2cc]
call fcn.1000f782
mov dword [eax], 5
jmp 0x10025c4c
push 0
lea ecx, [ebp - 0x368]
call fcn.1000f782
cmp dword [eax], 0
jne 0x10025c8d
mov dword [ebp - 0x9b0], 1
jmp 0x10025c94
and dword [ebp - 0x9b0], 0
push 1
lea ecx, [ebp - 0x2cc]
call fcn.1000f782
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x300]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x300]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x368]
call fcn.1000f782
mov ecx, dword [ebp - 0x300]
mov ecx, dword [ecx]
cmp ecx, dword [eax]
je 0x10025cdd
mov dword [ebp - 0x678], 1
jmp 0x10025ce4
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
push 0
lea ecx, [ebp - 0x368]
call fcn.1000f782
cmp esi, dword [eax]
jle 0x10025d0d
mov dword [ebp - 0x680], 1
jmp 0x10025d14
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x680]
mov dword [ebp - 0x130], eax
push 2
lea ecx, [ebp - 0x2cc]
call fcn.1000f782
mov esi, dword [ebp - 0x130]
push 2
lea ecx, [ebp - 0x368]
call fcn.1000f782
add esi, dword [eax]
push 3
lea ecx, [ebp - 0x368]
call fcn.1000f782
cmp dword [eax], esi
jne 0x10025d65
cmp dword [ebp - 0x130], 0
jne 0x10025d65
and dword [ebp - 0x824], 0
jmp 0x10025d6f
mov dword [ebp - 0x824], 1
mov eax, 0xd66c4a87
test eax, eax
je 0x10025d8b
push 9
pop eax
test eax, eax
je 0x10025d8b
mov dword [ebp - 0x688], 1
jmp 0x10025d92
and dword [ebp - 0x688], 0
push 0
lea ecx, [ebp - 0x368]
call fcn.1000f782
mov eax, dword [eax]
imul eax, dword [ebp - 0x688]
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x14], 0
jmp 0x10025dbe
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jg 0x1002604f
mov dword [ebp - 0x308], 0xffffffff
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2cc]
call fcn.1000f782
mov dword [ebp - 0x690], eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2cc]
call fcn.1000f782
mov ecx, dword [ebp - 0x690]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x690]
cmp dword [eax], 0
je 0x10025fe7
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2cc]
call fcn.1000f782
cmp dword [eax], 0xc6a687e9
jbe 0x10025e2f
mov dword [ebp - 0x698], 1
jmp 0x10025e36
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0x698]
jge 0x10025e50
mov dword [ebp - 0x6a0], 1
jmp 0x10025e57
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
jg 0x10025e78
mov dword [ebp - 0x6a8], 1
jmp 0x10025e7f
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x278], eax
mov esi, dword [ebp - 0x278]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2cc]
call fcn.1000f782
cmp esi, dword [eax]
je 0x10025eb3
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x10025eb3
and dword [ebp - 0x6b0], 0
jmp 0x10025ebd
mov dword [ebp - 0x6b0], 1
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2cc]
call fcn.1000f782
mov ecx, dword [ebp - 0x6b0]
cmp ecx, dword [eax]
jne 0x10025ee1
mov dword [ebp - 0x6b8], 1
jmp 0x10025ee8
and dword [ebp - 0x6b8], 0
push 2
lea ecx, [ebp - 0x368]
call fcn.1000f782
mov ecx, dword [ebp - 0x6b8]
cmp ecx, dword [eax]
je 0x10025f11
or eax, 0xffffffff
jne 0x10025f11
xor eax, eax
jne 0x10025f11
and dword [ebp - 0x6c0], 0
jmp 0x10025f1b
mov dword [ebp - 0x6c0], 1
mov eax, dword [ebp - 0x6e0]
cmp dword [ebp - 0x6c0], eax
jl 0x10025f35
mov dword [ebp - 0x6c8], 1
jmp 0x10025f3c
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x6c8], eax
je 0x10025f56
mov dword [ebp - 0x6d0], 1
jmp 0x10025f5d
and dword [ebp - 0x6d0], 0
cmp dword [ebp - 0x6d0], 0xfffffff6
jae 0x10025f72
mov dword [ebp - 0x6d8], 1
jmp 0x10025f79
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x6d8], eax
jle 0x10025f90
mov dword [ebp - 0x828], 1
jmp 0x10025f97
and dword [ebp - 0x828], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2cc]
call fcn.1000f782
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc78]
mov dword [ebp - 0xdc8], eax
push 0
lea ecx, [ebp - 0x368]
call fcn.1000f782
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2cc]
call fcn.1000f782
mov esi, dword [ebp - 0x6e0]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2cc]
call fcn.1000f782
mov eax, dword [ebp - 0x308]
add eax, 4
je 0x10026018
mov byte [ebp - 0xca], 0
push 0
push 1
lea eax, [ebp - 0xca]
push eax
push 0x7836
push 0x6f0c
call fcn.1002a8e2
add esp, 0x14
jmp 0x10026022
mov dword [ebp - 0x278], 0xfffffff8
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x1002604a
push 0x3cd2
push 1
push 0x6473
push 1
call fcn.1001bbae
add esp, 0x10
jmp 0x10025db7
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x2cc]
call fcn.1000f766
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x368]
call fcn.1000f766
push 0x7845
push 0x57b7
push 0x3fe
push 0x5f2c
push 0x2755
push 0x8e1
push 0x58a
push 0x7ca1
push 0x7725
push 1
push 1
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x870]
push eax
push 1
push 0x25e8
call fcn.1001bc90
add esp, 0x3c
mov dword [ebp - 0x140], 0xd3f46721
mov dword [ebp - 0x138], 0xfd2d1a4e
push 4
lea ecx, [ebp - 0x350]
call fcn.1000f6e4
mov dword [ebp - 4], 0x37
mov dword [ebp - 0x290], 1
mov dword [ebp - 0x848], 0x1cdffa87
mov dword [ebp - 0x718], 0xb7203fca
mov dword [ebp - 0x838], 0xffffffff
lea eax, [ebp - 0x350]
push eax
push 0x5117
push 1
push 0x71dc
push 0x22e5
push 0x2765
push 1
push 1
lea eax, [ebp - 0xdd0]
push eax
call fcn.1001c43a
add esp, 0x24
lea eax, [ebp - 0x350]
push eax
push 0
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.1001e95f
add esp, 0x10
mov eax, 0xc3e8ce6f
test eax, eax
je 0x100262f1
cmp dword [ebp - 0x140], 0
jne 0x10026180
push 0xfffffffffffffffd
pop eax
test eax, eax
jne 0x10026180
and dword [ebp - 0x700], 0
jmp 0x1002618a
mov dword [ebp - 0x700], 1
mov esi, dword [ebp - 0x290]
push 1
lea ecx, [ebp - 0x350]
call fcn.1000f782
cmp esi, dword [eax]
jg 0x100261ad
mov dword [ebp - 0x6e8], 1
jmp 0x100261b4
and dword [ebp - 0x6e8], 0
push 1
lea ecx, [ebp - 0x350]
call fcn.1000f782
mov esi, dword [ebp - 0x6e8]
add esi, dword [eax]
neg esi
push 2
lea ecx, [ebp - 0x350]
call fcn.1000f782
cmp esi, dword [eax]
jl 0x100261e8
mov dword [ebp - 0x6f0], 1
jmp 0x100261ef
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x6f0]
add eax, 0x51545b5e
jne 0x10026217
push 3
lea ecx, [ebp - 0x350]
call fcn.1000f782
cmp dword [eax], 0
jne 0x10026217
and dword [ebp - 0x6f8], 0
jmp 0x10026221
mov dword [ebp - 0x6f8], 1
push 2
lea ecx, [ebp - 0x350]
call fcn.1000f782
mov ecx, dword [ebp - 0x6f8]
cmp ecx, dword [eax]
jg 0x10026244
mov dword [ebp - 0x708], 1
jmp 0x1002624b
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x700]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x140]
sub eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x708]
jl 0x10026277
mov dword [ebp - 0x710], 1
jmp 0x1002627e
and dword [ebp - 0x710], 0
push 1
lea ecx, [ebp - 0x350]
call fcn.1000f782
mov ecx, dword [ebp - 0x710]
sub ecx, dword [eax]
mov dword [ebp - 0x290], ecx
je 0x100262f1
mov dword [ebp - 0x840], 0
mov dword [ebp - 0x830], 1
push 1
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x840]
push eax
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x140]
push eax
push 0
lea eax, [ebp - 0x718]
push eax
call fcn.1001f54e
add esp, 0x24
jmp 0x1002644e
mov dword [ebp - 0x720], 0x49a1
mov dword [ebp - 0x858], 0x100098d8
cmp dword [ebp - 0x720], 0x4bb9
jle 0x100263bb
and dword [ebp - 0x280], 0
jmp 0x1002632b
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0x61fb
jge 0x100263bb
and dword [ebp - 0x288], 0
jmp 0x10026351
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0x3fba
jge 0x100263b6
mov eax, dword [ebp - 0x280]
mov ecx, dword [ebp - 0x288]
sar eax, cl
cdq
mov dword [ebp - 0x978], eax
mov dword [ebp - 0x974], edx
push dword [ebp - 0x974]
push dword [ebp - 0x978]
lea ecx, [ebp - 0xf1c]
call fcn.1000d000
pop ecx
pop ecx
mov dword [ebp - 0x850], eax
mov ecx, dword [ebp - 0x850]
call fcn.1000f5af
push eax
call fcn.1004b356
pop ecx
lea ecx, [ebp - 0xf1c]
call fcn.1000f5a5
jmp 0x10026344
jmp 0x1002631e
push 0x6a10
lea eax, [ebp - 0x718]
push eax
push 0
lea eax, [ebp - 0x290]
push eax
call fcn.10026a5c
add esp, 0x10
mov byte [ebp - 4], 0x38
cmp dword [ebp - 0x720], 0x4903
jge 0x100263f4
push dword [ebp - 0x858]
call fcn.1004b356
pop ecx
jmp 0x10026410
mov dword [ebp - 4], 0x37
jmp 0x10026420
lea eax, [ebp - 0x138]
push eax
push 0x5374
lea eax, [ebp - 0x140]
push eax
push 0x36b8
lea eax, [ebp - 0x350]
push eax
push 0
push 0x3f22
call fcn.1002aa20
add esp, 0x1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x350]
call fcn.1000f766
push 0x4357
push 1
lea eax, [ebp - 0x298]
push eax
push 0x68ec
push 0x1161
push 0x1d55
push 1
push 0x4eb9
push 0x5206
push 0x42
push 1
push 0x1252
push 0x343e
lea eax, [ebp - 0x888]
push eax
call fcn.1001c5f5
add esp, 0x38
mov dword [ebp - 0x738], 0xffffffff
mov dword [ebp - 0xde8], 0
mov dword [ebp - 0xb44], 1
mov dword [ebp - 0xb40], 1
mov dword [ebp - 0xb3c], 1
mov dword [ebp - 0xb38], 1
mov dword [ebp - 0x860], 0x87697ab8
mov dword [ebp - 0x728], 0xfffffffd
mov dword [ebp - 0x868], 0x8a064f57
mov dword [ebp - 0x2a0], 0
jmp 0x10026516
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 2
jge 0x10026532
mov eax, dword [ebp - 0x2a0]
mov dword [ebp + eax*4 - 0xce0], 0xfff6
jmp 0x10026509
mov byte [ebp - 0xcc], 0
push 0x2943
push 1
push 1
lea eax, [ebp - 0xcc]
push eax
push 0x605
push 0x5acb
call fcn.1001ca68
add esp, 0x18
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0xddc], eax
cmp dword [ebp - 0x728], 1
jge 0x10026582
cmp dword [ebp - 0x728], 0
jne 0x10026582
and dword [ebp - 0x730], 0
jmp 0x1002658c
mov dword [ebp - 0x730], 1
cmp dword [ebp - 0x730], 0x94628aea
jb 0x1002659f
cmp dword [ebp - 0x860], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xce0]
mov dword [ebp - 0xde4], eax
mov eax, dword [ebp - 0x868]
mov dword [ebp - 0xdd8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb44], 0xd2ad05b3
jae 0x100265dd
mov dword [ebp - 0x740], 1
jmp 0x100265e4
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x738]
cmp dword [ebp - 0x740], eax
je 0x10026607
mov eax, 0xa3ebef27
test eax, eax
je 0x10026607
mov dword [ebp - 0x748], 1
jmp 0x1002660e
and dword [ebp - 0x748], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x748]
mov dword [ebp + eax - 0xb44], ecx
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x878], eax
cmp dword [ebp - 0x878], 3
je 0x1002663a
jmp 0x10026668
mov eax, dword [ebp - 0x880]
add eax, dword [ebp - 0x888]
mov dword [ebp - 0x890], eax
push 0xd47
push 0
lea eax, [ebp - 0x890]
push eax
push dword [ebp - 0x898]
call fcn.1001f192
add esp, 0x10
jmp 0x100254bd
mov dword [ebp - 0x5c], 0xfffffffe
mov dword [ebp - 0x770], 0x311e2db8
push 2
lea ecx, [ebp - 0xc4c]
call fcn.1000f6e4
mov dword [ebp - 4], 0x3a
mov dword [ebp - 0x18], 0
jmp 0x100266a2
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x100266b8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe08], 1
jmp 0x1002669b
mov dword [ebp - 0x18], 0
jmp 0x100266c8
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x100266de
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe38], 9
jmp 0x100266c1
mov dword [ebp - 0x18], 0
jmp 0x100266ee
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002670a
push dword [ebp - 0x18]
lea ecx, [ebp - 0xc4c]
call fcn.1000f782
mov dword [eax], 0x48407374
jmp 0x100266e7
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xc84], eax
mov eax, 0x21f1
test eax, eax
jne 0x100267ce
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x750], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x750]
mov dword [ebp + eax - 0xe08], ecx
cmp dword [ebp - 0x750], 0x3ee7
jl 0x10026761
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xe08], 0
jne 0x10026761
and dword [ebp - 0x758], 0
jmp 0x1002676b
mov dword [ebp - 0x758], 1
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x758]
je 0x10026782
mov dword [ebp - 0x760], 1
jmp 0x10026789
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x760], eax
jl 0x100267a0
mov dword [ebp - 0x8a0], 1
jmp 0x100267a7
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xdb4], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xe38], 9
xor eax, eax
jne 0x100267ce
and dword [ebp - 0x768], 0
jmp 0x100267d8
mov dword [ebp - 0x768], 1
mov eax, dword [ebp - 0x768]
mov dword [ebp - 0x770], eax
cmp dword [ebp - 0x770], 0
je 0x10026800
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x10026800
mov dword [ebp - 0x778], 1
jmp 0x10026807
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x778], eax
jle 0x1002681e
mov dword [ebp - 0x780], 1
jmp 0x10026825
and dword [ebp - 0x780], 0
cmp dword [ebp - 0x780], 0xea6801fc
jbe 0x1002683d
mov dword [ebp - 0x8a8], 1
jmp 0x10026844
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x5c]
je 0x10026858
mov dword [ebp - 0x788], 1
jmp 0x1002685f
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x788], eax
jl 0x10026876
mov dword [ebp - 0x790], 1
jmp 0x1002687d
and dword [ebp - 0x790], 0
push 0
lea ecx, [ebp - 0xc4c]
call fcn.1000f782
mov ecx, dword [ebp - 0x790]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4c]
call fcn.1000f766
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf8]
mov ecx, dword [ecx]
add ecx, dword [eax + 4]
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
jmp 0x10026a4b
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0x8c0], eax
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0x8c8], eax
mov dword [ebp - 0x798], 0x54e1
mov dword [ebp - 0x8d8], 0x10009948
cmp dword [ebp - 0x798], 0x556d
jle 0x100269a5
and dword [ebp - 0x2b0], 0
jmp 0x10026913
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0x216d
jge 0x100269a5
and dword [ebp - 0x2b8], 0
jmp 0x10026939
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0x199e
jge 0x100269a0
and dword [ebp - 0x2c0], 0
jmp 0x1002695b
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0x241a
jge 0x1002699e
mov eax, dword [ebp - 0x2b0]
add eax, dword [ebp - 0x2b8]
add eax, dword [ebp - 0x2c0]
cdq
mov dword [ebp - 0x984], eax
mov dword [ebp - 0x980], edx
push dword [ebp - 0x980]
push dword [ebp - 0x984]
mov ecx, 0x10609ad8
call fcn.1000f5cf
jmp 0x1002694e
jmp 0x1002692c
jmp 0x10026906
mov eax, dword [ebp - 0x8c0]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x8c8]
mov dword [ebp - 0x8d0], eax
mov eax, dword [ebp - 0x148]
mov dword [eax], 0
jmp 0x100269dc
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x148]
mov dword [ecx], eax
mov eax, dword [ebp - 0x148]
cmp dword [eax], 3
jge 0x10026a02
mov eax, dword [ebp - 0x148]
push dword [eax]
mov ecx, dword [ebp - 0x8d0]
call fcn.1000f782
mov dword [eax], 0x2bb11acc
jmp 0x100269cb
mov dword [ebp - 4], 0x3b
cmp dword [ebp - 0x798], 0x5225
jge 0x10026a25
mov edx, dword [ebp - 0x8d8]
mov ecx, 0x10609ad8
call fcn.10011079
jmp 0x10026a41
or dword [ebp - 4], 0xffffffff
jmp 0x10026a4b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret