Function at 0x1003fd8e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100645f2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x88c
push esi
mov dword [ebp - 0x470], 0xffffffff
push 1
lea ecx, [ebp - 0x5e4]
call fcn.1000e0be
and dword [ebp - 4], 0
mov dword [ebp - 0x728], 0x3992
push 0x1f32
push 0x2d3
push 0x324
push 0x870
push 1
push 0x2ad5
lea eax, [ebp - 0x710]
push eax
push 0x666a
push 0x7b4e
lea eax, [ebp - 0x5e4]
push eax
push 1
call fcn.1003b0d4
add esp, 0x2c
push 0xd08
push 0x2446
push 1
push 0xc2c
push 0x7241
push 0x7be0
push 0x1c99
push 0x5d03
push 1
call fcn.1003b2af
add esp, 0x24
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x5e4]
push eax
push 1
push 0x1de3
push 0x3709
push 1
call fcn.1003b46b
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5e4]
call fcn.1000e0fa
and dword [ebp - 0x34], 0
push 4
lea ecx, [ebp - 0x6b4]
call fcn.1000e0be
mov dword [ebp - 4], 1
mov dword [ebp - 0xa8], 0xada439be
lea eax, [ebp - 0x668]
push eax
push 0xcb4
lea eax, [ebp - 0x6b4]
push eax
push 1
push 0x6c60
push 1
call fcn.1003b553
add esp, 0x18
mov dword [ebp - 0xa8], 3
jmp 0x1003fed0
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x1004000c
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0xc8], 0x44455595
mov dword [ebp - 0x4a8], 0xb94d0f4f
mov dword [ebp - 0x3c], 0
jmp 0x1003ff08
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jg 0x1003ff1d
lea eax, [ebp - 0xc8]
push eax
call fcn.1003f49d
pop ecx
jmp 0x1003ff01
mov dword [ebp - 0xc8], 0
jmp 0x1003ff36
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jg 0x10040007
mov dword [ebp - 0x594], 1
mov dword [ebp - 0x590], 1
mov dword [ebp - 0x58c], 1
mov dword [ebp - 0x588], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x594]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0
jmp 0x1003ff8b
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jg 0x10040002
mov dword [ebp - 0x144], 0xfffffffb
mov dword [ebp - 0x144], 0
jmp 0x1003ffb4
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 3
jg 0x10040000
mov dword [ebp - 0xe4], 0xc67ee39f
mov dword [ebp - 0xe4], 0
jmp 0x1003ffe0
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 3
jg 0x1003fffe
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x594]
mov dword [ebp - 0x4a8], eax
jmp 0x1003ffd3
jmp 0x1003ffa7
jmp 0x1003ff84
jmp 0x1003ff29
jmp 0x1003fec3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6b4]
call fcn.1000e0fa
mov dword [ebp - 0xc0], 1
mov dword [ebp - 0x41c], 0x7161ab6e
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x164], 0xbfb3a4df
mov dword [ebp - 0x40], 0
jmp 0x10040053
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x10040069
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x4b0], 0xfffffffa
jmp 0x1004004c
mov dword [ebp - 0x40], 0
jmp 0x10040079
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x1004008f
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x768], 0x2b96ce02
jmp 0x10040072
cmp dword [ebp - 0xc0], 0xfffffffa
jle 0x100400a4
mov dword [ebp - 0x20c], 1
jmp 0x100400ab
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x41c], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x4b0], 0
mov dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x428]
cmp dword [ebp - 0x41c], eax
jge 0x100400ec
mov dword [ebp - 0x1a0], 1
jmp 0x100400f3
and dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x1a0], eax
jne 0x1004010d
mov dword [ebp - 0x1a8], 1
jmp 0x10040114
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
imul eax, dword [ebp - 0xc0]
test eax, eax
jne 0x1004013a
cmp dword [ebp - 0x164], 0
je 0x1004014a
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x1004014a
and dword [ebp - 0x398], 0
jmp 0x10040154
mov dword [ebp - 0x398], 1
mov eax, dword [ebp - 0xc0]
add eax, dword [ebp - 0x398]
cmp dword [ebp - 0x1a8], eax
jne 0x10040174
mov dword [ebp - 0x3a0], 1
jmp 0x1004017b
and dword [ebp - 0x3a0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3a0]
mov dword [ebp + eax - 0x768], ecx
push 3
lea ecx, [ebp - 0x6e4]
call fcn.1000e0be
mov dword [ebp - 4], 2
mov dword [ebp - 0x6e8], 1
mov dword [ebp - 0x670], 0x51ad386c
mov dword [ebp - 0x69c], 0xcd53bc6e
push 2
lea ecx, [ebp - 0x6d4]
call fcn.1000e0be
mov byte [ebp - 4], 3
mov dword [ebp - 0x724], 0x7d0f
mov dword [ebp - 0x3a8], 0xffffffff
push 2
lea ecx, [ebp - 0x6c4]
call fcn.1000e0be
mov byte [ebp - 4], 4
mov dword [ebp - 0x4d0], 0x9a7b445a
lea eax, [ebp - 0x6e4]
push eax
lea eax, [ebp - 0x1b0]
push eax
call fcn.1003f4b4
pop ecx
pop ecx
push 1
push 0x532f
push 1
push 1
push 0x7379
lea eax, [ebp - 0x1b0]
push eax
push 0x7f59
lea eax, [ebp - 0x6d4]
push eax
call fcn.1003b723
add esp, 0x20
push 0x7190
push 0x2745
push 0x758c
lea eax, [ebp - 0x6c4]
push eax
push 1
push 0x213d
lea eax, [ebp - 0x1b0]
push eax
push 0
call fcn.1003edda
add esp, 0x20
mov eax, dword [ebp - 0x3a8]
dec eax
mov dword [ebp - 0x3a8], eax
push 1
lea eax, [ebp - 0x4d0]
push eax
push 1
call fcn.1003ba1f
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x6c4]
call fcn.1000e0fa
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6d4]
call fcn.1000e0fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6e4]
call fcn.1000e0fa
mov eax, dword [ebp + 8]
mov dword [ebp - 0x168], eax
push 1
lea ecx, [ebp - 0x530]
call fcn.1000e0be
mov dword [ebp - 4], 5
push 0x7a3e
push 0x24b7
lea eax, [ebp - 0x530]
push eax
push 1
lea eax, [ebp - 0x698]
push eax
push 0x7617
push 0x2a6f
push 0x22af
push 0x2d36
push 1
push 0x1645
call fcn.1003bece
add esp, 0x2c
push 0
lea ecx, [ebp - 0x530]
call fcn.1000e0ff
and dword [eax], 0
jmp 0x1004034b
push 0
lea ecx, [ebp - 0x530]
call fcn.1000e0ff
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x1b8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1b8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x530]
call fcn.1000e0ff
cmp dword [eax], 0x11
jge 0x10040392
mov dword [ebp - 0x138], 0xaa9ac70c
mov dword [ebp - 0x138], 0xffffffea
jmp 0x10040380
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0xffffffff
jg 0x10040390
call fcn.1003f4fc
jmp 0x10040373
jmp 0x10040327
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x530]
call fcn.1000e0fa
mov eax, dword [ebp - 0x168]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10040aa4
push 1
lea ecx, [ebp - 0x160]
call fcn.1000e0be
mov dword [ebp - 4], 6
push 2
lea ecx, [ebp - 0x614]
call fcn.1000e0be
mov byte [ebp - 4], 7
mov dword [ebp - 0x178], 0
push 1
push 0x6ec9
push 1
push 0x6a27
push 0x78a3
lea eax, [ebp - 0x4d8]
push eax
lea eax, [ebp - 0x160]
push eax
push 0x5803
push 0x3db8
push 0x5ff1
push 0xc96
call fcn.1003c0e1
add esp, 0x2c
push 0x4be
push 1
lea eax, [ebp - 0x4d8]
push eax
push 0xb3
push 0x1566
push 0x2b9
push 1
push 0
lea eax, [ebp - 0x614]
push eax
call fcn.1003cb78
add esp, 0x24
mov dword [ebp - 0x4e0], 0x1723
cmp dword [ebp - 0x4e0], 0xf6d
jge 0x1004056f
and dword [ebp - 0x1c0], 0
lea eax, [ebp - 0x1c0]
push eax
push 0x1000774c
call fcn.1004a93b
pop ecx
pop ecx
and dword [ebp - 0x120], 0
lea eax, [ebp - 0x120]
push eax
push 0x10007748
call fcn.1004a93b
pop ecx
pop ecx
xor ecx, ecx
mov eax, dword [ebp - 0x120]
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10045feb
pop ecx
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x3b0], eax
and dword [ebp - 0xec], 0
jmp 0x100404e2
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0x120]
jge 0x1004050e
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x3b0]
lea eax, [ecx + eax*4]
push eax
push 0x1000774c
call fcn.1004a93b
pop ecx
pop ecx
jmp 0x100404d5
and dword [ebp - 0x194], 0
and dword [ebp - 0xf4], 0
jmp 0x1004052b
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0x120]
dec eax
cmp dword [ebp - 0xf4], eax
jge 0x1004055d
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0x3b0]
mov edx, dword [ebp - 0x1c0]
sub edx, dword [ecx + eax*4]
add edx, dword [ebp - 0x194]
mov dword [ebp - 0x194], edx
jmp 0x1004051e
push dword [ebp - 0x194]
push 0x10007be8
call fcn.1004ace5
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x160]
call fcn.1000e0ff
mov dword [eax], 0xffffffea
jmp 0x100405a8
push 0
lea ecx, [ebp - 0x160]
call fcn.1000e0ff
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3c8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3c8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x160]
call fcn.1000e0ff
cmp dword [eax], 0xffffffed
jge 0x10040a7f
mov dword [ebp - 0x48], 0xe0b4074d
mov dword [ebp - 0x190], 1
mov dword [ebp - 0x4a0], 0
mov dword [ebp - 0x124], 0
jmp 0x100405f2
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 2
jge 0x1004060e
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x43c], 0xd6b65720
jmp 0x100405e5
mov dword [ebp - 0x48], 0
jmp 0x1004061e
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x1a
jl 0x10040a58
mov dword [ebp - 0x7c], 0x8531d14c
mov dword [ebp - 0x170], 0x967268f5
mov dword [ebp - 0x6f8], 0x119b
mov dword [ebp - 0xfc], 0
jmp 0x1004065c
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 3
jge 0x10040678
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x774], 0x66d210ec
jmp 0x1004064f
push 0
lea ecx, [ebp - 0x160]
call fcn.1000e0ff
mov esi, dword [ebp - 0x7c]
shl esi, 2
push 0
lea ecx, [ebp - 0x160]
call fcn.1000e0ff
cmp esi, dword [eax]
jge 0x100406a8
mov dword [ebp - 0x1c8], 1
jmp 0x100406af
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x1c8], eax
jl 0x100406c6
mov dword [ebp - 0x180], 1
jmp 0x100406cd
and dword [ebp - 0x180], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x180]
mov dword [ebp + eax - 0x43c], ecx
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
imul eax, dword [ebp - 0x48]
neg eax
cmp eax, dword [ebp - 0x48]
jg 0x10040709
mov dword [ebp - 0x3d0], 1
jmp 0x10040710
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x3d0], eax
je 0x10040727
mov dword [ebp - 0x1d0], 1
jmp 0x1004072e
and dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x1d0], eax
jge 0x10040745
mov dword [ebp - 0x4f0], 1
jmp 0x1004074c
and dword [ebp - 0x4f0], 0
push 0
lea ecx, [ebp - 0x160]
call fcn.1000e0ff
cmp dword [eax], 2
jne 0x1004076a
mov dword [ebp - 0x3d8], 1
jmp 0x10040771
and dword [ebp - 0x3d8], 0
cmp dword [ebp - 0x3d8], 5
jle 0x10040786
mov dword [ebp - 0x1d8], 1
jmp 0x1004078d
and dword [ebp - 0x1d8], 0
push 1
lea ecx, [ebp - 0x614]
call fcn.1000e0ff
mov ecx, dword [ebp - 0x1d8]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x160]
call fcn.1000e0ff
push 0
lea ecx, [ebp - 0x160]
call fcn.1000e0ff
cmp dword [eax], 0
je 0x100407d3
cmp dword [ebp - 0x48], 0
je 0x100407d3
mov dword [ebp - 0x3e0], 1
jmp 0x100407da
and dword [ebp - 0x3e0], 0
cmp dword [ebp - 0x3e0], 0xeb0badca
jne 0x100407f2
mov dword [ebp - 0x1e0], 1
jmp 0x100407f9
and dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x1e0]
sub eax, dword [ebp - 0x48]
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 3
jbe 0x1004081d
mov dword [ebp - 0x3e8], 1
jmp 0x10040824
and dword [ebp - 0x3e8], 0
cmp dword [ebp - 0x3e8], 1
je 0x10040839
mov dword [ebp - 0x1e8], 1
jmp 0x10040840
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
je 0x10040871
mov eax, 0x38991f3
test eax, eax
je 0x10040871
push 9
pop eax
test eax, eax
je 0x10040871
mov dword [ebp - 0x3f0], 1
jmp 0x10040878
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x3f0], eax
jne 0x1004088f
mov dword [ebp - 0x1f0], 1
jmp 0x10040896
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x1f0]
neg eax
je 0x10040a3b
push 3
lea ecx, [ebp - 0x5fc]
call fcn.1000e0be
mov byte [ebp - 4], 8
mov dword [ebp - 0x6a0], 0xe2dc6606
mov dword [ebp - 0x61c], 0xd7787123
mov dword [ebp - 0x4f8], 0
push 1
lea eax, [ebp - 0x5fc]
push eax
lea eax, [ebp - 0x624]
push eax
push 1
call fcn.1003c21e
add esp, 0x10
cmp dword [ebp - 0x7c], 0
jne 0x100408ff
mov dword [ebp - 0x400], 1
jmp 0x10040906
and dword [ebp - 0x400], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x400]
mov dword [ebp + eax - 0x43c], ecx
mov esi, dword [ebp - 0x4f8]
push 0
lea ecx, [ebp - 0x160]
call fcn.1000e0ff
sub esi, dword [eax]
je 0x10040949
mov eax, 0xf6dc
test eax, eax
je 0x10040949
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x43c], 0
jbe 0x10040959
push 0xfffffffffffffff8
pop eax
test eax, eax
jne 0x10040959
and dword [ebp - 0x1f8], 0
jmp 0x10040963
mov dword [ebp - 0x1f8], 1
mov eax, dword [ebp - 0x170]
cmp eax, dword [ebp - 0x1f8]
jg 0x1004097d
mov dword [ebp - 0x408], 1
jmp 0x10040984
and dword [ebp - 0x408], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x43c]
cmp dword [ebp - 0x408], eax
jne 0x100409a5
mov dword [ebp - 0x200], 1
jmp 0x100409ac
and dword [ebp - 0x200], 0
push 0
lea ecx, [ebp - 0x160]
call fcn.1000e0ff
mov ecx, dword [ebp - 0x200]
cmp ecx, dword [eax]
je 0x100409cf
mov dword [ebp - 0x410], 1
jmp 0x100409d6
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x410], eax
jg 0x100409ed
mov dword [ebp - 0x208], 1
jmp 0x100409f4
and dword [ebp - 0x208], 0
push 2
lea ecx, [ebp - 0x5fc]
call fcn.1000e0ff
mov ecx, dword [ebp - 0x208]
cmp ecx, dword [eax]
jge 0x10040a17
mov dword [ebp - 0x418], 1
jmp 0x10040a1e
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x190], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x5fc]
call fcn.1000e0fa
jmp 0x10040a53
lea eax, [ebp - 0x4a0]
push eax
call fcn.1000acd0
pop ecx
cmp dword [ebp - 0x178], 0
je 0x10040a53
jmp 0x10040a58
jmp 0x10040617
push 0x4227
push 1
push 0x2c93
push 1
push 0x134b
push 1
push 0x27fa
call fcn.1003c2e7
add esp, 0x1c
jmp 0x10040584
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x614]
call fcn.1000e0fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.1000e0fa
xor eax, eax
jmp 0x100436ac
mov dword [ebp - 0x104], 0x75b57fd5
mov dword [ebp - 0x12c], 0
jmp 0x10040ac7
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 3
jge 0x10040ae3
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0x744], 0xffff
jmp 0x10040aba
mov dword [ebp - 0x104], 0
jmp 0x10040afc
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0xc
jne 0x10040bc2
push 2
lea ecx, [ebp - 0x568]
call fcn.1000e0be
mov dword [ebp - 4], 9
mov dword [ebp - 0x47c], 0xffffffff
push 0x68f6
push 1
push 0x245b
lea eax, [ebp - 0x62c]
push eax
push 0x5431
push 0x53aa
push 0x3b1c
push 0x417f
push 0x7546
lea eax, [ebp - 0x568]
push eax
push 0x51bf
push 1
push 0x5f7f
push 0x44f5
push 0x485d
call fcn.1003c44a
add esp, 0x3c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x744], 0
je 0x10040b99
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x568]
call fcn.1000e0fa
jmp 0x10040bc2
push 1
lea ecx, [ebp - 0x568]
call fcn.1000e0ff
mov eax, dword [eax]
mov dword [ebp - 0x47c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x568]
call fcn.1000e0fa
jmp 0x10040aef
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.1003f518
add esp, 0xc
mov dword [ebp - 0x634], 0xffff
mov dword [ebp - 0x38], 0
jmp 0x10040bf6
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x10040c0c
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x154], 0xa75c
jmp 0x10040bef
mov dword [ebp - 0x38], 0
jmp 0x10040c1c
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x10040c32
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x688], 0x93876a47
jmp 0x10040c15
call fcn.1003f546
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x154], 0
jne 0x10040c60
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x154], 0
jne 0x10040c60
and dword [ebp - 0x21c], 0
jmp 0x10040c6a
mov dword [ebp - 0x21c], 1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x154], 0xffffffff
jg 0x10040c86
mov dword [ebp - 0x420], 1
jmp 0x10040c8d
and dword [ebp - 0x420], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x154]
cmp dword [ebp - 0x420], eax
jne 0x10040cae
mov dword [ebp - 0x214], 1
jmp 0x10040cb5
and dword [ebp - 0x214], 0
cmp dword [ebp - 0x214], 0xdb78
jg 0x10040ccd
mov dword [ebp - 0x32c], 1
jmp 0x10040cd4
and dword [ebp - 0x32c], 0
cmp dword [ebp - 0x32c], 0x3ec3d4e7
jl 0x10040cec
mov dword [ebp - 0x520], 1
jmp 0x10040cf3
and dword [ebp - 0x520], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
mov dword [ebp - 0x63c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x154], 0xc326
jle 0x10040d25
mov dword [ebp - 0x484], 1
jmp 0x10040d2c
and dword [ebp - 0x484], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
mov dword [ebp - 0x644], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x21c]
sub ecx, dword [ebp + eax - 0x154]
cmp ecx, 1
jle 0x10040d63
mov dword [ebp - 0x3c0], 1
jmp 0x10040d6a
and dword [ebp - 0x3c0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp + eax - 0x688], ecx
mov eax, dword [ebp - 0xac]
cmp dword [eax], 0x4550
je 0x10040f34
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x188], 5
mov dword [ebp - 0x10c], 0xfffffffa
mov dword [ebp - 0x234], 4
mov dword [ebp - 0x74], 0x1a
jmp 0x10040dc4
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xa
jne 0x10040f0c
mov dword [ebp - 0x224], 0x9ee1
mov dword [ebp - 0x134], 0
jmp 0x10040df1
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jge 0x10040e0d
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0xb0], 1
jmp 0x10040de4
mov dword [ebp - 0x10c], 0xdc34
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb0]
cmp eax, dword [ebp - 0x10c]
je 0x10040e38
mov dword [ebp - 0x334], 1
jmp 0x10040e3f
and dword [ebp - 0x334], 0
mov dword [ebp - 0x224], 0x85faafe3
mov eax, dword [ebp - 0x224]
cmp eax, dword [ebp - 0x334]
jne 0x10040e63
mov dword [ebp - 0x22c], 1
jmp 0x10040e6a
and dword [ebp - 0x22c], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb0], 0
jne 0x10040e88
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb0], 0
mov eax, 0xb1b6
sub eax, 0xdca2
cmp dword [ebp - 0x22c], eax
jg 0x10040ea6
mov dword [ebp - 0x3bc], 1
jmp 0x10040ead
and dword [ebp - 0x3bc], 0
mov dword [ebp - 0x188], 0xffffffff
mov eax, dword [ebp - 0x188]
cmp eax, dword [ebp - 0x3bc]
jle 0x10040ed1
mov dword [ebp - 0x504], 1
jmp 0x10040ed8
and dword [ebp - 0x504], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb0]
mov dword [ebp - 0x64c], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x234], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x10c]
mov dword [ebp + eax - 0xb0], ecx
jmp 0x10040dbd
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.1003f578
add esp, 0x10
xor eax, eax
jmp 0x100436ac
push 1
push 0x6570
push 0x186b
push 0x2a7a
push 0x3209
push 0x2eae
lea eax, [ebp - 0x100]
push eax
push 0x5e2f
push 0x71c8
push 0x4e1c
push 0x149e
push 0x16fa
push 0x67f8
push 0x705
push 1
push dword [ebp - 0xac]
call fcn.1003a496
add esp, 0x40
push 1
lea ecx, [ebp - 0x460]
call fcn.1000e0be
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x494], 0xffffffff
mov dword [ebp - 0x28], 0
jmp 0x10040fb7
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x10040fcd
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xd8], 0xffffffff
jmp 0x10040fb0
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1003f68c
pop ecx
pop ecx
mov dword [ebp - 0x28], 0
jmp 0x10040fef
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10041005
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x67c], 0x4dde9a
jmp 0x10040fe8
mov byte [ebp - 0x65], 0
lea eax, [ebp - 0x65]
push eax
call fcn.1003f6d4
pop ecx
push 0
lea ecx, [ebp - 0x460]
call fcn.1000e0ff
and dword [eax], 0
jmp 0x10041049
push 0
lea ecx, [ebp - 0x460]
call fcn.1000e0ff
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x33c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x33c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x460]
call fcn.1000e0ff
cmp dword [eax], 0
jg 0x1004122b
mov dword [ebp - 0x30], 0xfe1ca2
mov dword [ebp - 0x30], 0
jmp 0x10041076
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jg 0x1004108d
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0xd8], 0
je 0x1004108b
jmp 0x1004108d
jmp 0x1004106f
mov dword [ebp - 0x30], 0
jmp 0x1004109d
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x10041226
mov dword [ebp - 0x13c], 0xffffffff
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x100410d8
push 0xef
push 1
push 1
push 0x47b3
push 0x75cb
call fcn.1003d47c
add esp, 0x14
mov dword [ebp - 0x13c], 0
jmp 0x100410f1
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jl 0x10041221
mov dword [ebp - 0x114], 0x3e7ed6f1
push 0
lea ecx, [ebp - 0x460]
call fcn.1000e0ff
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xd8], 0
je 0x10041126
jmp 0x10041221
mov dword [ebp - 0x114], 0
jmp 0x1004113f
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jg 0x1004121c
mov dword [ebp - 0xd0], 8
mov dword [ebp - 0xd0], 0
jmp 0x1004116f
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jl 0x10041217
mov dword [ebp - 0x48c], 0x80643b8a
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0xd8]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0x23c]
mov dword [ebp + eax*4 - 0xd8], ecx
cmp dword [ebp - 0x23c], 0xe6fc
jge 0x100411c1
mov dword [ebp - 0x3f8], 1
jmp 0x100411c8
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x244], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x244]
mov dword [ebp + eax - 0x67c], ecx
mov eax, dword [ebp - 0x3f8]
cmp eax, dword [ebp - 0x244]
jg 0x10041201
mov dword [ebp - 0x534], 1
jmp 0x10041208
and dword [ebp - 0x534], 0
mov dword [ebp - 0x494], 1
jmp 0x10041162
jmp 0x10041132
jmp 0x100410e4
jmp 0x10041096
jmp 0x10041025
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x460]
call fcn.1000e0fa
cmp dword [ebp - 0x100], 0
jne 0x10041454
push 1
lea ecx, [ebp - 0x454]
call fcn.1000e0be
mov dword [ebp - 4], 0xb
push 1
push 0x57f5
push 1
push 0x4ebc
push 1
push 0x754c
push 0x3bd5
push 0x4458
push 0x1846
push 0x5789
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x454]
push eax
push 0x6bf6
push 0x1921
call fcn.1003d52d
add esp, 0x38
push 0
lea ecx, [ebp - 0x454]
call fcn.1000e0ff
mov dword [eax], 0xfffffff6
jmp 0x100412dd
push 0
lea ecx, [ebp - 0x454]
call fcn.1000e0ff
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x344]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x344]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x454]
call fcn.1000e0ff
cmp dword [eax], 0x13
jne 0x100413af
mov dword [ebp - 0x24c], 0xd5816210
push 2
lea ecx, [ebp - 0x5c0]
call fcn.1000e0be
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x50c], 0xa3cfce2
mov dword [ebp - 0x49c], 8
mov dword [ebp - 0x11c], 0
jmp 0x1004133b
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 2
jge 0x1004135d
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x5c0]
call fcn.1000e0ff
mov dword [eax], 0x23ed15de
jmp 0x1004132e
cmp dword [ebp - 0x24c], 0
je 0x10041377
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x5c0]
call fcn.1000e0fa
jmp 0x100413af
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.1003f6ff
add esp, 0x10
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x5c0]
call fcn.1000e0fa
jmp 0x100412b9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x454]
call fcn.1000e0fa
push 3
lea ecx, [ebp - 0x574]
call fcn.1000e0be
mov dword [ebp - 4], 0xd
mov dword [ebp - 0xb8], 0x5252cb13
lea eax, [ebp - 0x574]
push eax
lea eax, [ebp - 0x65c]
push eax
call fcn.1003f77b
pop ecx
pop ecx
mov dword [ebp - 0xb8], 0
jmp 0x1004140a
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jg 0x1004143e
push 2
lea ecx, [ebp - 0x574]
call fcn.1000e0ff
mov esi, eax
push dword [ebp - 0xb8]
lea ecx, [ebp - 0x574]
call fcn.1000e0ff
mov ecx, dword [esi]
mov dword [eax], ecx
call fcn.1003f7c0
jmp 0x100413fd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x574]
call fcn.1000e0fa
xor eax, eax
jmp 0x100436ac
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x4a4], 1
mov dword [ebp - 0x148], 0
jmp 0x1004147e
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 1
jge 0x1004149a
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x374], 0xe1d925b0
jmp 0x10041471
mov dword [ebp - 0x548], 0x1717
cmp dword [ebp - 0x548], 0xeea
jge 0x100415bb
push 0x8f
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.1000d8a3
add esp, 0xc
mov dword [ebp - 0x18], 1
jmp 0x100414da
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x8f
jg 0x1004156c
cmp dword [ebp - 0x18], 1
jl 0x10041507
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x805]
test eax, eax
jne 0x10041507
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x804], 1
cmp dword [ebp - 0x18], 2
jl 0x10041527
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x806]
test eax, eax
jne 0x10041527
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x804], 1
cmp dword [ebp - 0x18], 4
jl 0x10041547
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x808]
test eax, eax
jne 0x10041547
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x804], 1
cmp dword [ebp - 0x18], 5
jl 0x10041567
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x809]
test eax, eax
jne 0x10041567
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax - 0x804], 1
jmp 0x100414d3
xor eax, eax
inc eax
je 0x100415bb
lea eax, [ebp - 0x3c4]
push eax
push 0x10007748
call fcn.1004a93b
pop ecx
pop ecx
cmp dword [ebp - 0x3c4], 0
jne 0x1004158f
jmp 0x100415bb
mov eax, dword [ebp - 0x3c4]
movzx eax, byte [ebp + eax - 0x804]
test eax, eax
je 0x100415ae
push 0x10007bf0
call fcn.1004ace5
pop ecx
jmp 0x100415b9
push 0x10007bf8
call fcn.1004ace5
pop ecx
jmp 0x1004156c
mov byte [ebp - 0x68], 0
movzx eax, byte [ebp - 0x68]
test eax, eax
je 0x100415cc
call fcn.1003f80d
mov dword [ebp - 0x5c], 0
jmp 0x100415dc
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xfffffff6
jge 0x10041c70
mov dword [ebp - 0x10], 0x7d45db34
mov dword [ebp - 0x37c], 0xfffffffc
mov dword [ebp - 0x10], 0
jmp 0x10041607
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jg 0x1004161d
mov byte [ebp - 0x67], 0
lea eax, [ebp - 0x67]
push eax
call fcn.1003f81f
pop ecx
jmp 0x10041600
mov dword [ebp - 0x10], 0
jmp 0x1004162d
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe2
jg 0x10041c6b
mov dword [ebp - 0x3cc], 0
push 3
lea ecx, [ebp - 0x540]
call fcn.1000e0be
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x8c], 3
mov dword [ebp - 0x44], 0
jmp 0x1004166f
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x10041685
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xa4], 1
jmp 0x10041668
mov dword [ebp - 0x44], 0
jmp 0x10041695
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x100416b1
push dword [ebp - 0x44]
lea ecx, [ebp - 0x540]
call fcn.1000e0ff
mov dword [eax], 0xd7276cc
jmp 0x1004168e
mov eax, 0x7d8cf4c5
test eax, eax
je 0x10041837
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa4]
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x10], 0
je 0x100416e9
cmp dword [ebp - 0x10], 0
je 0x100416e9
mov dword [ebp - 0x254], 1
jmp 0x100416f0
and dword [ebp - 0x254], 0
cmp dword [ebp - 0x254], 0xe13f5e3
jne 0x10041711
mov eax, 0xfffc
test eax, eax
je 0x10041711
mov dword [ebp - 0x34c], 1
jmp 0x10041718
and dword [ebp - 0x34c], 0
cmp dword [ebp - 0x34c], 0xccaea0a9
ja 0x10041730
mov dword [ebp - 0x25c], 1
jmp 0x10041737
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x25c], eax
je 0x1004174e
mov dword [ebp - 0x3fc], 1
jmp 0x10041755
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x3fc]
sub eax, dword [ebp - 0x10]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xa4]
jne 0x10041779
mov dword [ebp - 0x264], 1
jmp 0x10041780
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x264]
sub eax, 7
cmp eax, dword [ebp - 0x5c]
jne 0x1004179a
mov dword [ebp - 0x354], 1
jmp 0x100417a1
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x354]
jne 0x100417b8
mov dword [ebp - 0x26c], 1
jmp 0x100417bf
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x274], eax
push 1
lea ecx, [ebp - 0x540]
call fcn.1000e0ff
mov ecx, dword [ebp - 0x274]
mov dword [eax], ecx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x274]
jne 0x10041803
mov dword [ebp - 0x35c], 1
jmp 0x1004180a
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x8c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa4]
cmp dword [ebp - 0x8c], eax
je 0x10041837
mov dword [ebp - 0x27c], 1
jmp 0x1004183e
and dword [ebp - 0x27c], 0
cmp dword [ebp - 0x27c], 9
jne 0x10041853
mov dword [ebp - 0x414], 1
jmp 0x1004185a
and dword [ebp - 0x414], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x414]
sub ecx, dword [ebp + eax - 0xa4]
cmp ecx, dword [ebp - 0x10]
je 0x100419cb
mov dword [ebp - 0x28c], 0x3e5c7d81
mov dword [ebp - 0x584], 4
mov dword [ebp - 0x580], 4
mov dword [ebp - 0x57c], 4
mov dword [ebp - 0x578], 4
mov esi, dword [ebp - 0x10]
push 0
lea ecx, [ebp - 0x540]
call fcn.1000e0ff
add esi, dword [eax]
jne 0x100418d7
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x8c], 0
jne 0x100418d7
and dword [ebp - 0x284], 0
jmp 0x100418e1
mov dword [ebp - 0x284], 1
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x284], eax
jne 0x100418f8
mov dword [ebp - 0x364], 1
jmp 0x100418ff
and dword [ebp - 0x364], 0
push 1
lea ecx, [ebp - 0x540]
call fcn.1000e0ff
mov eax, dword [eax]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x364]
sub eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x28c], eax
jge 0x10041934
mov dword [ebp - 0x3d4], 1
jmp 0x1004193b
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x8c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x374]
cmp dword [ebp - 0x8c], eax
je 0x10041968
mov dword [ebp - 0x294], 1
jmp 0x1004196f
and dword [ebp - 0x294], 0
cmp dword [ebp - 0x294], 1
je 0x10041984
mov dword [ebp - 0x36c], 1
jmp 0x1004198b
and dword [ebp - 0x36c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x584]
cmp dword [ebp - 0x36c], eax
je 0x100419ac
mov dword [ebp - 0x29c], 1
jmp 0x100419b3
and dword [ebp - 0x29c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x29c]
mov dword [ebp + eax - 0x584], ecx
jmp 0x10041c57
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x14c], 0x1fbcda4f
mov dword [ebp - 0x514], 5
cmp dword [ebp - 0x10], 0
je 0x10041bd1
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0xa0]
lea eax, [eax + ecx - 0x6030033]
test eax, eax
je 0x10041a1f
cmp dword [ebp - 0xa0], 0
je 0x10041a1f
mov dword [ebp - 0x404], 1
jmp 0x10041a26
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x404], eax
jle 0x10041a3d
mov dword [ebp - 0x2a4], 1
jmp 0x10041a44
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0xa0]
add eax, dword [ebp - 0x2a4]
cmp eax, dword [ebp - 0x14c]
je 0x10041a6d
mov eax, 0x8d5b
test eax, eax
je 0x10041a6d
mov dword [ebp - 0x2ac], 1
jmp 0x10041a74
and dword [ebp - 0x2ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x374]
cmp dword [ebp - 0x2ac], eax
jne 0x10041a95
mov dword [ebp - 0x3dc], 1
jmp 0x10041a9c
and dword [ebp - 0x3dc], 0
cmp dword [ebp - 0x3dc], 0
jbe 0x10041ab1
mov dword [ebp - 0x2b4], 1
jmp 0x10041ab8
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x37c]
sub eax, dword [ebp - 0x14c]
imul eax, dword [ebp - 0x14c]
test eax, eax
jne 0x10041aed
mov eax, 0xb39d90dc
test eax, eax
jne 0x10041aed
and dword [ebp - 0x2bc], 0
jmp 0x10041af7
mov dword [ebp - 0x2bc], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x2bc], eax
jge 0x10041b0e
mov dword [ebp - 0x424], 1
jmp 0x10041b15
and dword [ebp - 0x424], 0
cmp dword [ebp - 0x424], 0x2d46fede
jg 0x10041b2d
mov dword [ebp - 0x2c4], 1
jmp 0x10041b34
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x2c4], eax
jl 0x10041b4e
mov dword [ebp - 0x384], 1
jmp 0x10041b55
and dword [ebp - 0x384], 0
cmp dword [ebp - 0x384], 0x5b12
je 0x10041b73
cmp dword [ebp - 0xa0], 0
je 0x10041b73
and dword [ebp - 0x2cc], 0
jmp 0x10041b7d
mov dword [ebp - 0x2cc], 1
cmp dword [ebp - 0x2cc], 0xd754
jl 0x10041b95
mov dword [ebp - 0x3e4], 1
jmp 0x10041b9c
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x3e4], eax
je 0x10041bb3
mov dword [ebp - 0x2d4], 1
jmp 0x10041bba
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2d4]
sub eax, dword [ebp - 0x10]
je 0x10041bd1
mov dword [ebp - 0x38c], 1
jmp 0x10041bd8
and dword [ebp - 0x38c], 0
cmp dword [ebp - 0x38c], 0x3fbd5ced
jne 0x10041bf0
mov dword [ebp - 0x2dc], 1
jmp 0x10041bf7
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x2dc], eax
jge 0x10041c0e
mov dword [ebp - 0x40c], 1
jmp 0x10041c15
and dword [ebp - 0x40c], 0
cmp dword [ebp - 0x40c], 0xdce6
jl 0x10041c2d
mov dword [ebp - 0x2e4], 1
jmp 0x10041c34
and dword [ebp - 0x2e4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2e4]
sub ecx, dword [ebp + eax - 0xa4]
mov dword [ebp - 0x4a4], ecx
mov dword [ebp - 0x514], 0xffffffff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x540]
call fcn.1000e0fa
jmp 0x10041626
jmp 0x100415d5
push 0x54d6
push 0x626e
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x34]
push eax
push 1
push 0x63c9
push 1
push 0x675a
push 0x57c7
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.1003e00f
add esp, 0x30
push 0x3f99
push dword [ebp + 8]
push dword [ebp - 0x34]
push 1
push 0
push dword [ebp - 0xac]
call fcn.100304d5
add esp, 0x18
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x268]
push eax
call fcn.1003f857
add esp, 0xc
mov dword [ebp - 0x58], 7
mov dword [ebp - 0x64], 0x3191b495
mov dword [ebp - 0x3b8], 0xde2e510b
mov dword [ebp - 0x4b4], 8
mov dword [ebp - 0x4ac], 0x167f
cmp dword [ebp - 0x4ac], 0xfa0
jge 0x10041e08
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x544]
push eax
push 0x10007780
call fcn.1004a93b
add esp, 0xc
and dword [ebp - 0x39c], 0
and dword [ebp - 0x2fc], 0
mov dword [ebp - 0x128], 1
jmp 0x10041d6d
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x544]
jg 0x10041df6
lea eax, [ebp - 0x394]
push eax
push 0x10007748
call fcn.1004a93b
pop ecx
pop ecx
mov eax, dword [ebp - 0x394]
cdq
idiv dword [ebp - 0x2ec]
test edx, edx
jle 0x10041dab
mov dword [ebp - 0x3ec], 1
jmp 0x10041db2
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x394]
cdq
idiv dword [ebp - 0x2ec]
add eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x2f4]
cmp eax, dword [ebp - 0x39c]
jl 0x10041df1
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x2fc], eax
jmp 0x10041d60
push dword [ebp - 0x2fc]
push 0x100077a4
call fcn.1004ace5
pop ecx
pop ecx
mov dword [ebp - 0x140], 0
jmp 0x10041e21
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 1
jge 0x10041e3a
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x50], 1
jmp 0x10041e14
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 1
jg 0x10041e53
mov dword [ebp - 0x3a4], 1
jmp 0x10041e5a
and dword [ebp - 0x3a4], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 8
jge 0x10041e73
mov dword [ebp - 0x3f4], 1
jmp 0x10041e7a
and dword [ebp - 0x3f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
add eax, dword [ebp - 0x3f4]
je 0x10041ea5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 0
je 0x10041ea5
mov dword [ebp - 0x304], 1
jmp 0x10041eac
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x58], eax
imul eax, dword [ebp - 0x58], 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x50]
add ecx, dword [ebp - 0x3a4]
sub ecx, eax
jne 0x10041edc
cmp dword [ebp - 0x58], 0
jne 0x10041edc
and dword [ebp - 0x30c], 0
jmp 0x10041ee6
mov dword [ebp - 0x30c], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x30c]
sub ecx, dword [ebp + eax - 0x50]
jne 0x10041f17
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 0
jne 0x10041f17
mov eax, 0x89fe57f6
test eax, eax
jne 0x10041f17
and dword [ebp - 0x3b4], 0
jmp 0x10041f21
mov dword [ebp - 0x3b4], 1
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x64], 0
jmp 0x10041f3a
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jne 0x10042270
mov dword [ebp - 0x60], 0xffffffff
mov dword [ebp - 0x240], 0x9d0e131a
mov dword [ebp - 0x58], 0
jmp 0x10041f65
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xc
jg 0x1004226b
mov dword [ebp - 0x84], 0x181f51b4
mov dword [ebp - 0x210], 0x315eac84
mov dword [ebp - 0x130], 0x5c87e177
mov dword [ebp - 0x248], 0xfad6770d
push 2
lea ecx, [ebp - 0x5f0]
call fcn.1000e0be
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x9c], 0
jmp 0x10041fc4
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x10041fe0
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x51c], 5
jmp 0x10041fb7
lea eax, [ebp - 0x5f0]
push eax
lea eax, [ebp - 0x9c]
push eax
call fcn.1003f885
pop ecx
pop ecx
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x680], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x6a4], eax
cmp dword [ebp - 0x84], 0
je 0x10042028
cmp dword [ebp - 0x60], 0
je 0x10042028
cmp dword [ebp - 0x60], 0
je 0x10042028
mov dword [ebp - 0x314], 1
jmp 0x1004202f
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x314], eax
jne 0x10042053
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 0
je 0x10042053
mov dword [ebp - 0x3ac], 1
jmp 0x1004205a
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x3ac], eax
jne 0x10042074
mov dword [ebp - 0x31c], 1
jmp 0x1004207b
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
imul eax, dword [ebp - 0x58]
test eax, eax
jne 0x100420a3
or eax, 0xffffffff
jne 0x100420a3
and dword [ebp - 0x324], 0
jmp 0x100420ad
mov dword [ebp - 0x324], 1
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x324], eax
jg 0x100420c4
mov dword [ebp - 0x198], 1
jmp 0x100420cb
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x210]
imul eax, dword [ebp - 0x4b4]
test eax, eax
je 0x100420fd
mov eax, 0x5c5bccbf
test eax, eax
je 0x100420fd
mov dword [ebp - 0x218], 1
jmp 0x10042104
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x218], eax
jl 0x1004211e
mov dword [ebp - 0x220], 1
jmp 0x10042125
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x220], eax
jl 0x1004213f
mov dword [ebp - 0x228], 1
jmp 0x10042146
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x228], eax
je 0x10042160
mov dword [ebp - 0x230], 1
jmp 0x10042167
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x230], eax
jg 0x10042184
cmp dword [ebp - 0x130], 0
jne 0x10042184
and dword [ebp - 0x238], 0
jmp 0x1004218e
mov dword [ebp - 0x238], 1
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x240]
sub eax, dword [ebp - 0x60]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
sub eax, dword [ebp - 0x64]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x51c], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x720], eax
mov dword [ebp - 0x248], 0xfa7dc071
mov eax, dword [ebp - 0x248]
sub eax, 7
imul eax, dword [ebp - 0x84]
cmp eax, 0xffffffff
jg 0x100421f3
mov dword [ebp - 0x250], 1
jmp 0x100421fa
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x250]
sub eax, 0xdbdc
cmp eax, dword [ebp - 0x84]
jne 0x10042219
mov dword [ebp - 0x258], 1
jmp 0x10042220
and dword [ebp - 0x258], 0
cmp dword [ebp - 0x258], 1
jb 0x10042235
mov dword [ebp - 0x260], 1
jmp 0x1004223c
and dword [ebp - 0x260], 0
mov esi, dword [ebp - 0x260]
sub esi, 0x58409478
push 1
lea ecx, [ebp - 0x5f0]
call fcn.1000e0ff
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5f0]
call fcn.1000e0fa
jmp 0x10041f5e
jmp 0x10041f33
cmp dword [ebp - 0x268], 0
je 0x100423f6
mov dword [ebp - 0xb4], 0x324ec2e0
mov dword [ebp - 0x5a8], 4
mov dword [ebp - 0x5a4], 4
mov dword [ebp - 0x5a0], 4
mov dword [ebp - 0x59c], 4
lea ecx, [ebp - 0x189]
call fcn.1000ed23
push eax
lea eax, [ebp - 0x598]
push eax
lea eax, [ebp - 0x5a8]
push eax
lea ecx, [ebp - 0x758]
call fcn.10021c6c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x5d8]
call fcn.10021c46
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x55c], 0x9b3a00d0
mov dword [ebp - 0xb4], 0
jmp 0x1004230e
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0xfffffff5
jl 0x10042366
mov dword [ebp - 0xdc], 0xb4c23afc
mov dword [ebp - 0xdc], 0
jmp 0x1004233a
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 3
jg 0x10042364
mov dword [ebp - 0x4c0], 0x416db6d0
lea eax, [ebp - 0x5d8]
push eax
lea eax, [ebp - 0x4c0]
push eax
call fcn.1003f8cd
pop ecx
pop ecx
jmp 0x1004232d
jmp 0x10042301
push 1
push 0xc4c
lea eax, [ebp - 0xb4]
push eax
push 0x3a67
lea eax, [ebp - 0x5d8]
push eax
push 0x2e6b
lea eax, [ebp - 0x55c]
push eax
push 0x4a38
push 0x7336
push 0x1746
push 1
push 0x4785
call fcn.1003e3e4
add esp, 0x30
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5d8]
call fcn.1000e0fa
push 1
push 0x5e00
push 0x6212
push 0x4192
push 0x6ff2
push dword [ebp - 0x34]
push 0x5a00
push 0x59f
push 0x2067
push dword [ebp - 0x268]
push 0
push 0x8a4
call fcn.1003e3e4
add esp, 0x30
mov dword [ebp - 0x270], 0xffffffff
lea eax, [ebp - 0x270]
push eax
push 1
push 0x5884
push 0x259b
push 0x406
push 1
push 0x6a31
call fcn.1003e6b7
add esp, 0x1c
lea eax, [ebp - 0x270]
push eax
call fcn.1003f964
pop ecx
push dword [ebp - 0x34]
call fcn.10038031
pop ecx
test eax, eax
jne 0x100424ba
push 2
lea ecx, [ebp - 0x6f4]
call fcn.1000e0be
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x4cc], 0xf1febaee
mov dword [ebp - 0xe0], 0
jmp 0x10042478
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 2
jge 0x10042497
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x6f4]
call fcn.1000e0ff
and dword [eax], 0
jmp 0x1004246b
lea eax, [ebp - 0x4cc]
push eax
call fcn.1003fa83
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6f4]
call fcn.1000e0fa
xor eax, eax
jmp 0x100436ac
mov dword [ebp - 0xe8], 1
push 3
lea ecx, [ebp - 0x5cc]
call fcn.1000e0be
mov dword [ebp - 4], 0x12
push 1
lea ecx, [ebp - 0x5b4]
call fcn.1000e0be
mov byte [ebp - 4], 0x13
push 2
lea ecx, [ebp - 0x608]
call fcn.1000e0be
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x524], 0xffffffff
mov dword [ebp - 0x4d4], 0xfffffffe
mov dword [ebp - 0x2c], 0
jmp 0x1004251e
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x10042537
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x5cc]
call fcn.1000e0ff
or dword [eax], 0xffffffff
jmp 0x10042517
mov dword [ebp - 0x2c], 0
jmp 0x10042547
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10042563
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x5b4]
call fcn.1000e0ff
mov dword [eax], 0x1b6eab3c
jmp 0x10042540
lea eax, [ebp - 0x608]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1003faeb
pop ecx
pop ecx
mov eax, dword [ebp - 0xe8]
add eax, dword [ebp - 0xe8]
mov dword [ebp - 0xe8], eax
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x608]
push eax
lea eax, [ebp - 0x5cc]
push eax
lea eax, [ebp - 0x5b4]
push eax
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x4d4]
push eax
call fcn.1003fb33
add esp, 0x18
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x608]
call fcn.1000e0fa
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x5b4]
call fcn.1000e0fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5cc]
call fcn.1000e0fa
push 0x7e5
push 0
push 0x6765
push dword [ebp - 0x34]
push 1
push 0x3005
push 0x68ca
call fcn.1002ea2d
add esp, 0x1c
mov dword [ebp - 0x14], 8
push 4
lea ecx, [ebp - 0x448]
call fcn.1000e0be
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x4ec], 0xffffffff
mov dword [ebp - 0x508], 0x52259155
mov dword [ebp - 0x4e4], 0
mov dword [ebp - 0x4fc], 0x1b83
cmp dword [ebp - 0x4fc], 0xfa3
jge 0x10042818
call fcn.1004aa75
push 0x20
pop ecx
imul ecx, ecx, 0
add eax, ecx
push eax
push 0x10007750
push 0x10007754
call fcn.1004af2f
add esp, 0xc
call fcn.1004aa75
push 0x20
pop ecx
shl ecx, 0
add eax, ecx
push eax
push 0x1000775c
push 0x10007760
call fcn.1004af2f
add esp, 0xc
lea eax, [ebp - 0x174]
push eax
mov ecx, 0x10656a70
call fcn.1000da5c
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x278]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x278]
add ecx, dword [eax + 4]
call fcn.10022b9a
movzx eax, al
test eax, eax
je 0x10042818
mov byte [ebp - 0x21], 1
and dword [ebp - 0xf0], 0
jmp 0x100426ee
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
cmp eax, dword [ebp - 0x174]
jge 0x1004270c
mov eax, dword [ebp - 0xf0]
mov byte [ebp + eax - 0x898], 0
jmp 0x100426e1
lea eax, [ebp - 0xc4]
push eax
mov ecx, 0x10656a70
call fcn.1000da5c
mov dword [ebp - 0x16c], 1
jmp 0x10042736
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x16c]
cmp eax, dword [ebp - 0x174]
jge 0x100427d3
lea eax, [ebp - 0xbc]
push eax
mov ecx, 0x10656a70
call fcn.1000da5c
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0xbc]
je 0x100427a1
mov eax, dword [ebp - 0xbc]
sub eax, dword [ebp - 0xc4]
push eax
call fcn.1004ceec
pop ecx
movzx eax, byte [ebp + eax - 0x898]
test eax, eax
jne 0x100427a1
mov eax, dword [ebp - 0xbc]
sub eax, dword [ebp - 0xc4]
push eax
call fcn.1004ceec
pop ecx
cmp eax, dword [ebp - 0x174]
jl 0x100427a7
mov byte [ebp - 0x21], 0
jmp 0x100427c2
mov eax, dword [ebp - 0xbc]
sub eax, dword [ebp - 0xc4]
push eax
call fcn.1004ceec
pop ecx
mov byte [ebp + eax - 0x898], 1
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xc4], eax
jmp 0x10042729
movzx eax, byte [ebp - 0x21]
test eax, eax
je 0x100427f8
push fcn.10012b0d
mov edx, 0x10007c04
mov ecx, 0x106569b8
call fcn.10012936
mov ecx, eax
call fcn.1000dd60
jmp 0x10042813
push fcn.10012b0d
mov edx, 0x10007c0c
mov ecx, 0x106569b8
call fcn.10012936
mov ecx, eax
call fcn.1000dd60
jmp 0x1004269c
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x618]
push eax
call fcn.1003fca5
pop ecx
pop ecx
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], 0
je 0x100429b3
mov dword [ebp - 0xcc], 0xffffffff
mov dword [ebp - 0x280], 0xfffffffc
mov dword [ebp - 0x280], 0xb000cd9d
cmp dword [ebp - 0x280], 1
je 0x10042871
mov dword [ebp - 0x298], 1
jmp 0x10042878
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
je 0x1004288c
mov dword [ebp - 0x288], 1
jmp 0x10042893
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0xcc]
add eax, dword [ebp - 0x288]
cmp eax, dword [ebp - 0x14]
jge 0x100428b0
mov dword [ebp - 0x290], 1
jmp 0x100428b7
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x290], eax
jge 0x100428ce
mov dword [ebp - 0x2a0], 1
jmp 0x100428d5
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x298]
imul eax, dword [ebp - 0x2a0]
cmp eax, 0xe55a
jl 0x100428f5
mov dword [ebp - 0x2a8], 1
jmp 0x100428fc
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x2a8], eax
je 0x10042916
mov dword [ebp - 0x2b0], 1
jmp 0x1004291d
and dword [ebp - 0x2b0], 0
cmp dword [ebp - 0x2b0], 1
jb 0x10042932
mov dword [ebp - 0x2b8], 1
jmp 0x10042939
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0x2b8]
jg 0x10042953
mov dword [ebp - 0x2c0], 1
jmp 0x1004295a
and dword [ebp - 0x2c0], 0
cmp dword [ebp - 0x2c0], 0xaa810d21
ja 0x10042972
mov dword [ebp - 0x2c8], 1
jmp 0x10042979
and dword [ebp - 0x2c8], 0
cmp dword [ebp - 0x2c8], 0x8b4dfecb
jae 0x10042991
mov dword [ebp - 0x2d0], 1
jmp 0x10042998
and dword [ebp - 0x2d0], 0
imul eax, dword [ebp - 0x2d0], 0x9150
sub eax, dword [ebp - 0xcc]
mov dword [ebp - 0xcc], eax
jmp 0x10042d41
mov dword [ebp - 0x1c], 0
jmp 0x100429c3
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x100429d9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x94], 0x6f39
jmp 0x100429bc
mov dword [ebp - 0x1c], 0
jmp 0x100429e9
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x100429ff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x750], 0
jmp 0x100429e2
mov dword [ebp - 0x1c], 0
jmp 0x10042a0f
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10042a25
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4bc], 5
jmp 0x10042a08
mov dword [ebp - 0x14], 0
jmp 0x10042a35
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x10042d41
mov dword [ebp - 0x78], 0x88592840
mov dword [ebp - 0xf8], 0
jmp 0x10042a5f
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 3
jge 0x10042a7b
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x46c], 0xfffffff6
jmp 0x10042a52
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x46c], 0
jmp 0x10042aa9
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x46c]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x46c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x46c], 0
jg 0x10042d3c
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x318], 0xeccdf493
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x94], 1
je 0x10042aea
mov dword [ebp - 0x2d8], 1
jmp 0x10042af1
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x94]
cmp eax, dword [ebp - 0x2d8]
jg 0x10042b0f
mov dword [ebp - 0x4dc], 1
jmp 0x10042b16
and dword [ebp - 0x4dc], 0
push 3
pop eax
test eax, eax
jg 0x10042b29
mov dword [ebp - 0x500], 1
jmp 0x10042b30
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x94]
mov dword [ebp - 0x714], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x94], 0
je 0x10042b69
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x94], 0
je 0x10042b69
mov dword [ebp - 0x2e0], 1
jmp 0x10042b70
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jne 0x10042b8f
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x10042b8f
and dword [ebp - 0x2e8], 0
jmp 0x10042b99
mov dword [ebp - 0x2e8], 1
cmp dword [ebp - 0x2e8], 2
jl 0x10042bae
mov dword [ebp - 0x2f0], 1
jmp 0x10042bb5
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x94]
cmp dword [ebp - 0x2f0], eax
jl 0x10042bd3
mov dword [ebp - 0x2f8], 1
jmp 0x10042bda
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], 0
jmp 0x10042bf3
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jg 0x10042d37
mov dword [ebp - 0x80], 0x1d8d4885
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x68c], eax
push 1
lea ecx, [ebp - 0x448]
call fcn.1000e0ff
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [eax]
sub eax, dword [ebp + ecx - 0x750]
sub eax, dword [ebp - 0x70]
sub eax, 5
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x46c]
jne 0x10042c4a
mov dword [ebp - 0x300], 1
jmp 0x10042c51
and dword [ebp - 0x300], 0
push 1
lea ecx, [ebp - 0x448]
call fcn.1000e0ff
mov ecx, dword [ebp - 0x300]
cmp ecx, dword [eax]
jne 0x10042c74
mov dword [ebp - 0x308], 1
jmp 0x10042c7b
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x308]
jge 0x10042c92
mov dword [ebp - 0x310], 1
jmp 0x10042c99
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x620], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x71c], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x4bc], 0xfffffffb
mov dword [ebp - 0x78], 0
jmp 0x10042cdb
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jl 0x10042d32
mov dword [ebp - 0x80], 0
jmp 0x10042cf1
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jg 0x10042d30
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x4bc], 0xffffffff
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x46c]
inc eax
push eax
lea ecx, [ebp - 0x448]
call fcn.1000e0ff
push 4
pop ecx
shl ecx, 0
mov eax, dword [eax]
mov dword [ebp + ecx - 0x4bc], eax
jmp 0x10042cea
jmp 0x10042cd4
jmp 0x10042bec
jmp 0x10042a8e
jmp 0x10042a2e
push 0x41cc
push 0
lea eax, [ebp - 0x448]
push eax
push 0x3c86
lea eax, [ebp - 0x4e4]
push eax
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x4ec]
push eax
push 0x1858
call fcn.100436bb
add esp, 0x20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x448]
call fcn.1000e0fa
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1004368b
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x100]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x368], ecx
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x510], 0x258c
cmp dword [ebp - 0x510], 0x5ac
jge 0x10042e87
call fcn.1004aa75
push 0x20
pop ecx
imul ecx, ecx, 0
add eax, ecx
push eax
push 0x10007750
push 0x10007c18
call fcn.1004af2f
add esp, 0xc
call fcn.1004aa75
push 0x20
pop ecx
shl ecx, 0
add eax, ecx
push eax
push 0x1000775c
push 0x10007760
call fcn.1004af2f
add esp, 0xc
movsd xmm0, qword [0x10007c28]
movsd qword [ebp - 0x4c8], xmm0
and dword [ebp - 0x17c], 0
jmp 0x10042e2f
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0xc
jge 0x10042e63
lea eax, [ebp - 0x694]
push eax
mov ecx, 0x10656a70
call fcn.10043d79
movsd xmm0, qword [ebp - 0x4c8]
addsd xmm0, qword [ebp - 0x694]
movsd qword [ebp - 0x4c8], xmm0
jmp 0x10042e22
movsd xmm0, qword [ebp - 0x4c8]
divsd xmm0, qword [0x10007c60]
push ecx
push ecx
movsd qword [esp], xmm0
push 0x10007c20
call fcn.1004ace5
add esp, 0xc
mov dword [ebp - 0x320], 0xdb6d0374
mov dword [ebp - 0x518], 0x746e33a7
mov dword [ebp - 0x20], 6
jmp 0x10042eab
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe8
jge 0x10042efd
push 0x70d3
push 0x6f4e
push 0x7204
push 0x1e35
push 0x37d5
push 0x1299
push 0x60dd
push 0x4aa
push 1
push 0x4be
push 1
push 0x539b
push 0x6238
push 0x150a
push 1
call fcn.1003e8ec
add esp, 0x3c
jmp 0x10042ea4
mov dword [ebp - 0x20], 0
jmp 0x10042f0d
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffffb
jge 0x1004303c
mov dword [ebp - 0x338], 0xffffffff
mov dword [ebp - 0x4f4], 0xfff9
call fcn.1003fced
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x320], eax
jle 0x10042f50
mov dword [ebp - 0x348], 1
jmp 0x10042f57
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x628], eax
cmp dword [ebp - 0x20], 0
jne 0x10042f78
cmp dword [ebp - 0x338], 0
jne 0x10042f78
and dword [ebp - 0x328], 0
jmp 0x10042f82
mov dword [ebp - 0x328], 1
mov eax, dword [ebp - 0x4f4]
cmp dword [ebp - 0x328], eax
jge 0x10042f9c
mov dword [ebp - 0x330], 1
jmp 0x10042fa3
and dword [ebp - 0x330], 0
imul eax, dword [ebp - 0x330], 0xae7b
test eax, eax
jne 0x10042fc1
push 7
pop eax
test eax, eax
jne 0x10042fc1
and dword [ebp - 0x340], 0
jmp 0x10042fcb
mov dword [ebp - 0x340], 1
mov eax, dword [ebp - 0x338]
cmp dword [ebp - 0x340], eax
jg 0x10042fe5
mov dword [ebp - 0x350], 1
jmp 0x10042fec
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x348]
cmp eax, dword [ebp - 0x350]
jne 0x10043006
mov dword [ebp - 0x358], 1
jmp 0x1004300d
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x358], eax
jg 0x10043024
mov dword [ebp - 0x360], 1
jmp 0x1004302b
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x518], eax
jmp 0x10042f06
cmp dword [ebp - 0x368], 0
jne 0x1004304c
xor eax, eax
jmp 0x100436ac
mov dword [ebp - 0xd4], 0x462d5e48
mov dword [ebp - 0xd4], 0
jmp 0x1004306f
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x19
jne 0x10043088
mov byte [ebp - 0x66], 0
lea eax, [ebp - 0x66]
push eax
call fcn.1003fd18
pop ecx
jmp 0x10043062
lea eax, [ebp - 0xd4]
push eax
call fcn.1003fd50
pop ecx
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x368]
mov dword [ebp - 0x474], eax
cmp dword [ebp - 0x474], 0
jne 0x100430ba
xor eax, eax
jmp 0x100436ac
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x98], 0x3d37a5b7
mov dword [ebp - 0x90], 0xc2e7ccc8
mov dword [ebp - 0x184], 0x600d5493
mov dword [ebp - 0x6a8], 1
mov dword [ebp - 0x88], 1
mov dword [ebp - 0x1d4], 0x8f7f
mov dword [ebp - 0x1f4], 0xdcbc
mov dword [ebp - 0x108], 0
jmp 0x10043120
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 4
jge 0x1004313c
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x738], 2
jmp 0x10043113
mov dword [ebp - 0x54], 0
jmp 0x1004314c
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xffffffe6
jne 0x100435fe
mov dword [ebp - 0x4c], 0xd4f2887c
push 3
lea ecx, [ebp - 0x434]
call fcn.1000e0be
mov dword [ebp - 4], 0x16
push 0x1952
lea eax, [ebp - 0x630]
push eax
push 1
push 1
push 0x1bd
lea eax, [ebp - 0x434]
push eax
push 0x1176
call fcn.1003f00c
add esp, 0x1c
cmp dword [ebp - 0x4c], 0xfffffff9
jg 0x100431ac
mov dword [ebp - 0x370], 1
jmp 0x100431b3
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x4c]
neg eax
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x370], eax
je 0x100431d8
mov dword [ebp - 0x378], 1
jmp 0x100431df
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x54]
add ecx, dword [ebp - 0x378]
cmp eax, ecx
jle 0x100431ff
mov dword [ebp - 0x380], 1
jmp 0x10043206
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x90], 0
jmp 0x1004322b
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xfffffff1
je 0x100435ea
mov dword [ebp - 0x558], 0xa023703a
mov dword [ebp - 0x554], 0xa023703a
mov dword [ebp - 0x550], 0xa023703a
mov dword [ebp - 0x54c], 0xa023703a
mov dword [ebp - 0x490], 0x781be2fc
mov dword [ebp - 0x4c], 0
jmp 0x1004327a
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x2f
jle 0x100435e5
mov dword [ebp - 0x118], 3
mov dword [ebp - 0x390], 0xd77cccae
cmp dword [ebp - 0x98], 0xca27
jle 0x100432b0
mov dword [ebp - 0x388], 1
jmp 0x100432b7
and dword [ebp - 0x388], 0
cmp dword [ebp - 0x388], 0xffff3cce
jl 0x10043331
push 3
lea ecx, [ebp - 0x704]
call fcn.1000e0be
mov byte [ebp - 4], 0x17
push 0x7090
push 0x658e
push 1
push 0x296
lea eax, [ebp - 0x708]
push eax
push 1
push 0x4f6
lea eax, [ebp - 0x704]
push eax
call fcn.1003f120
add esp, 0x20
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x558]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x558], eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x704]
call fcn.1000e0fa
jmp 0x100434ea
mov dword [ebp - 0x478], 0xc0a1
mov dword [ebp - 0x480], 0
mov dword [ebp - 0x110], 0
jmp 0x1004335e
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 1
jge 0x1004337a
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x1c4], 0xfffffffb
jmp 0x10043351
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x638], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x558]
mov dword [ebp - 0x6b8], eax
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x640], eax
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x70c], eax
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x648], eax
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x6c8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x390]
mov dword [ebp + eax - 0x1c4], ecx
mov eax, 0x64fef537
test eax, eax
je 0x10043418
mov eax, 0x1ddbc75b
test eax, eax
je 0x10043418
push 1
lea ecx, [ebp - 0x434]
call fcn.1000e0ff
cmp dword [eax], 0
je 0x10043418
mov dword [ebp - 0x19c], 1
jmp 0x1004341f
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x19c], eax
jg 0x10043439
mov dword [ebp - 0x1a4], 1
jmp 0x10043440
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x1a4], eax
jle 0x10043457
mov dword [ebp - 0x1ac], 1
jmp 0x1004345e
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x1ac], eax
je 0x10043478
mov dword [ebp - 0x1b4], 1
jmp 0x1004347f
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x1b4], eax
je 0x10043499
mov dword [ebp - 0x1bc], 1
jmp 0x100434a0
and dword [ebp - 0x1bc], 0
push 1
lea ecx, [ebp - 0x434]
call fcn.1000e0ff
mov ecx, dword [ebp - 0x1bc]
mov dword [eax], ecx
mov dword [ebp - 0x88], 0
jmp 0x100434ce
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x100434ea
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x1c4], 6
jmp 0x100434c1
cmp dword [ebp - 0x54], 0xffffffff
jg 0x100434fc
mov dword [ebp - 0x1cc], 1
jmp 0x10043503
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x1d4], eax
mov esi, dword [ebp - 0x1d4]
push 1
lea ecx, [ebp - 0x434]
call fcn.1000e0ff
cmp esi, dword [eax]
jle 0x10043532
mov dword [ebp - 0x1dc], 1
jmp 0x10043539
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x1dc], eax
jg 0x10043553
mov dword [ebp - 0x488], 1
jmp 0x1004355a
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x650], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x558], 0
jne 0x10043588
cmp dword [ebp - 0x490], 0
jne 0x10043588
and dword [ebp - 0x1e4], 0
jmp 0x10043592
mov dword [ebp - 0x1e4], 1
mov esi, dword [ebp - 0x1e4]
sub esi, 0x737e
push 1
lea ecx, [ebp - 0x434]
call fcn.1000e0ff
cmp esi, dword [eax]
jge 0x100435c4
cmp dword [ebp - 0x118], 0
je 0x100435c4
mov dword [ebp - 0x1ec], 1
jmp 0x100435cb
and dword [ebp - 0x1ec], 0
push 1
lea ecx, [ebp - 0x434]
call fcn.1000e0ff
mov ecx, dword [ebp - 0x1ec]
mov dword [eax], ecx
jmp 0x10043273
jmp 0x1004321e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x434]
call fcn.1000e0fa
jmp 0x10043145
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x718], eax
cmp dword [ebp - 0x184], 0x93a39d8e
jbe 0x10043622
mov dword [ebp - 0x498], 1
jmp 0x10043629
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x658], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x6d8], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x738]
mov dword [ebp - 0x660], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x738], 0xfffffff6
je 0x1004366b
mov dword [ebp - 0x1fc], 1
jmp 0x10043672
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x1fc]
sub eax, 4
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x34]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x10], 0
je 0x1004369f
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x204], eax
jmp 0x100436a6
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x204]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret