Function at 0x1002b822
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008ae53
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x234
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002c814
push 3
lea ecx, [ebp - 0x1d4]
call fcn.10018b61
and dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x158], 0xfffffff6
mov dword [ebp - 0x19c], 0xfffffffa
mov dword [ebp - 0x64], 0
jmp 0x1002b889
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1002b8a5
push dword [ebp - 0x64]
lea ecx, [ebp - 0x1d4]
call fcn.10018bff
mov dword [eax], 0x10c93b4e
jmp 0x1002b882
mov dword [ebp - 0x14], 2
jmp 0x1002b8b5
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1002bb65
mov dword [ebp - 0x7c], 0x3a6c9cd4
push 1
lea ecx, [ebp - 0x1f8]
call fcn.10018b61
mov byte [ebp - 4], 1
mov dword [ebp - 0x20], 0
jmp 0x1002b8e7
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1002b900
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1f8]
call fcn.10018bff
and dword [eax], 0
jmp 0x1002b8e0
mov dword [ebp - 0x20], 0
jmp 0x1002b910
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002b926
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x234], 0xfffffff9
jmp 0x1002b909
mov byte [ebp - 0x2f], 0
movzx eax, byte [ebp - 0x2f]
test eax, eax
je 0x1002b943
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x16c], eax
push 0
lea ecx, [ebp - 0x1f8]
call fcn.10018bff
mov ecx, dword [ebp - 0x16c]
mov dword [eax], ecx
cmp dword [ebp - 0x16c], 0
jne 0x1002b984
xor eax, eax
inc eax
jne 0x1002b984
and dword [ebp - 0x184], 0
jmp 0x1002b98e
mov dword [ebp - 0x184], 1
mov eax, dword [ebp - 0x184]
add eax, 0xfff8
cmp eax, dword [ebp - 0x14]
jle 0x1002b9aa
mov dword [ebp - 0xa0], 1
jmp 0x1002b9b1
and dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xa0], eax
jg 0x1002b9c8
mov dword [ebp - 0x14c], 1
jmp 0x1002b9cf
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x14c]
jg 0x1002b9ec
mov dword [ebp - 0xa8], 1
jmp 0x1002b9f3
and dword [ebp - 0xa8], 0
cmp dword [ebp - 0xa8], 0x4255ebda
je 0x1002ba0b
mov dword [ebp - 0x174], 1
jmp 0x1002ba12
and dword [ebp - 0x174], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1d4]
call fcn.10018bff
mov dword [ebp - 0xb0], eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1d4]
call fcn.10018bff
mov ecx, dword [ebp - 0xb0]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x174]
mov ecx, dword [ebp - 0xb0]
cmp dword [ecx], eax
jne 0x1002ba5d
mov dword [ebp - 0x154], 1
jmp 0x1002ba64
and dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x154], eax
jle 0x1002ba7b
mov dword [ebp - 0xb8], 1
jmp 0x1002ba82
and dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xb8], eax
jne 0x1002ba99
mov dword [ebp - 0x194], 1
jmp 0x1002baa0
and dword [ebp - 0x194], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x194]
cmp eax, dword [ebp - 0x14]
jle 0x1002baba
mov dword [ebp - 0xc0], 1
jmp 0x1002bac1
and dword [ebp - 0xc0], 0
cmp dword [ebp - 0xc0], 0x4886
jg 0x1002bad9
mov dword [ebp - 0x15c], 1
jmp 0x1002bae0
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x15c], eax
jne 0x1002baf7
mov dword [ebp - 0xc8], 1
jmp 0x1002bafe
and dword [ebp - 0xc8], 0
cmp dword [ebp - 0xc8], 1
jle 0x1002bb13
mov dword [ebp - 0x17c], 1
jmp 0x1002bb1a
and dword [ebp - 0x17c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x234]
cmp dword [ebp - 0x17c], eax
jg 0x1002bb3a
mov dword [ebp - 0xd0], 1
jmp 0x1002bb41
and dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0xd0]
mov dword [ebp - 0x19c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1f8]
call fcn.10018be3
jmp 0x1002b8ae
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d4]
call fcn.10018be3
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x90], 0
push 3
lea ecx, [ebp - 0x1ec]
call fcn.10018b61
mov dword [ebp - 4], 2
mov dword [ebp - 0x70], 0
jmp 0x1002bbc1
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x1002bbdd
push dword [ebp - 0x70]
lea ecx, [ebp - 0x1ec]
call fcn.10018bff
mov dword [eax], 0x1f6f49c2
jmp 0x1002bbba
push 0
call fcn.10032ae1
pop ecx
mov dword [ebp - 0x1c], 0xffffffe2
jmp 0x1002bbf5
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffea
je 0x1002be66
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x2c], 0x694d2b5f
mov dword [ebp - 0x100], 0xfffffff9
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jg 0x1002bc2e
mov dword [ebp - 0x164], 1
jmp 0x1002bc35
and dword [ebp - 0x164], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x164], eax
jne 0x1002bc4c
mov dword [ebp - 0xd8], 1
jmp 0x1002bc53
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0xd8], eax
jl 0x1002bc6a
mov dword [ebp - 0x18c], 1
jmp 0x1002bc71
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x18c], eax
jg 0x1002bc88
mov dword [ebp - 0xe0], 1
jmp 0x1002bc8f
and dword [ebp - 0xe0], 0
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffff8
je 0x1002bcaa
mov dword [ebp - 0x13c], 1
jmp 0x1002bcb1
and dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x13c]
jg 0x1002bcc8
mov dword [ebp - 0xe8], 1
jmp 0x1002bccf
and dword [ebp - 0xe8], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xe8], eax
je 0x1002bce6
mov dword [ebp - 0x140], 1
jmp 0x1002bced
and dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x140]
jge 0x1002bd04
mov dword [ebp - 0xf0], 1
jmp 0x1002bd0b
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0xf0]
cmp eax, 0x194
jg 0x1002bd27
mov dword [ebp - 0x148], 1
jmp 0x1002bd2e
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x148], eax
jge 0x1002bd45
mov dword [ebp - 0xf8], 1
jmp 0x1002bd4c
and dword [ebp - 0xf8], 0
cmp dword [ebp - 0xf8], 0xc8b1
jle 0x1002bd64
mov dword [ebp - 0x150], 1
jmp 0x1002bd6b
and dword [ebp - 0x150], 0
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x1002be4b
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x2c], 0
jmp 0x1002bd9b
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x1002be49
mov dword [ebp - 0x1a4], 0x38e21363
lea eax, [ebp - 0x34]
push eax
push 0
push 0xf17
lea eax, [ebp - 0x2c]
push eax
call fcn.10034ba2
add esp, 0x10
mov dword [ebp - 0x34], 2
jmp 0x1002bdd6
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1002be44
mov dword [ebp - 0x1c8], 0xd8720725
mov dword [ebp - 0x1c4], 0x93c394a7
push 0x6c6a
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c8]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x1c4]
push eax
push 0
lea eax, [ebp - 0x1ec]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0x416e
call fcn.1002c899
add esp, 0x30
cmp dword [ebp - 0x34], 0
je 0x1002be42
jmp 0x1002bdcf
jmp 0x1002bdcf
jmp 0x1002bd94
jmp 0x1002be61
push 0
push 0x4df6
lea eax, [ebp - 0x100]
push eax
call fcn.1002d617
add esp, 0xc
jmp 0x1002bbee
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1ec]
call fcn.10018be3
mov eax, dword [ebp - 0x68]
mov eax, dword [eax + 4]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x78], 0
jmp 0x1002be98
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x1002beae
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x240], 0x64a6847d
jmp 0x1002be91
mov dword [ebp - 0x74], 0
jmp 0x1002bebe
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jg 0x1002bf41
mov dword [ebp - 0x6c], 0x39924432
mov dword [ebp - 0x6c], 0
jmp 0x1002bedb
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jg 0x1002bf3c
mov dword [ebp - 0x4c], 0xad2086bd
mov byte [ebp - 0x35], 0
movzx eax, byte [ebp - 0x35]
test eax, eax
je 0x1002befc
push 0
call fcn.1002ebd7
pop ecx
mov dword [ebp - 0x4c], 2
jmp 0x1002bf0c
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x1002bf3a
mov dword [ebp - 0x94], 0x315362d
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x240], 0
je 0x1002bf38
jmp 0x1002bf3a
jmp 0x1002bf05
jmp 0x1002bed4
jmp 0x1002beb7
mov byte [ebp - 0x2d], 0
push 0
push 0x3856
lea eax, [ebp - 0x2d]
push eax
call fcn.1002d3e5
add esp, 0xc
mov dword [ebp - 0x24], 0x9ad59e57
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x218], 0xfffffffe
mov dword [ebp - 0x50], 0
jmp 0x1002bf80
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x1002bf96
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x204], 1
jmp 0x1002bf79
mov dword [ebp - 0x24], 0
jmp 0x1002bfa6
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jg 0x1002c0e6
mov dword [ebp - 0x160], 6
mov dword [ebp - 0x1b0], 1
lea eax, [ebp - 0x160]
push eax
push 0x7b0f
push 0x37ae
push 0
push 0x374e
call fcn.10035835
add esp, 0x14
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x204]
cmp dword [ebp - 0x24], eax
jg 0x1002bfff
mov dword [ebp - 0x108], 1
jmp 0x1002c006
and dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x108], eax
jl 0x1002c01d
mov dword [ebp - 0x1b4], 1
jmp 0x1002c024
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x160]
dec ecx
cmp dword [ebp + eax*4 - 0x204], ecx
jl 0x1002c043
mov dword [ebp - 0x110], 1
jmp 0x1002c04a
and dword [ebp - 0x110], 0
cmp dword [ebp - 0x110], 0xffff
jb 0x1002c062
mov dword [ebp - 0x168], 1
jmp 0x1002c069
and dword [ebp - 0x168], 0
mov eax, dword [ebp - 0x168]
add eax, 0x44421408
cmp eax, 4
jl 0x1002c085
mov dword [ebp - 0x118], 1
jmp 0x1002c08c
and dword [ebp - 0x118], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x1002c0b0
mov eax, 0x5fa2ef70
test eax, eax
je 0x1002c0b0
mov dword [ebp - 0x170], 1
jmp 0x1002c0b7
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x170], eax
jne 0x1002c0ce
mov dword [ebp - 0x120], 1
jmp 0x1002c0d5
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x1b0], eax
jmp 0x1002bf9f
mov dword [ebp - 0x3c], 0
jmp 0x1002c0f6
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x1002c10c
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x204], 0x6d0811fc
jmp 0x1002c0ef
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x28], eax
push 3
lea ecx, [ebp - 0x60]
call fcn.10018b61
mov dword [ebp - 4], 3
mov dword [ebp - 0x178], 0xfc520ea
mov dword [ebp - 0x84], 1
mov dword [ebp - 0x9c], 0xeadd5d
mov dword [ebp - 0x1c0], 0xfffffffe
push 0
push 0x702f
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0x24d2
push 0x356e
call fcn.1002d56e
add esp, 0x18
push 0x4adf
push 0x56b0
push 0
lea eax, [ebp - 0x60]
push eax
push 0x4012
call fcn.1002b822
add esp, 0x14
push 2
lea ecx, [ebp - 0x60]
call fcn.10018bff
mov esi, eax
push 0
lea ecx, [ebp - 0x60]
call fcn.10018bff
mov ecx, dword [esi]
add ecx, dword [eax]
mov dword [ebp - 0x178], ecx
mov esi, dword [ebp - 0x178]
push 2
lea ecx, [ebp - 0x60]
call fcn.10018bff
cmp dword [eax], esi
jge 0x1002c1ea
push 2
lea ecx, [ebp - 0x60]
call fcn.10018bff
cmp dword [eax], 0
je 0x1002c1ea
mov dword [ebp - 0x128], 1
jmp 0x1002c1f1
and dword [ebp - 0x128], 0
push 0
lea ecx, [ebp - 0x60]
call fcn.10018bff
mov ecx, dword [ebp - 0x128]
cmp ecx, dword [eax]
jne 0x1002c211
mov dword [ebp - 0x180], 1
jmp 0x1002c218
and dword [ebp - 0x180], 0
push 2
lea ecx, [ebp - 0x60]
call fcn.10018bff
mov ecx, dword [ebp - 0x180]
cmp ecx, dword [eax]
je 0x1002c238
mov dword [ebp - 0x130], 1
jmp 0x1002c23f
and dword [ebp - 0x130], 0
push 0
lea ecx, [ebp - 0x60]
call fcn.10018bff
mov ecx, dword [ebp - 0x130]
cmp ecx, dword [eax]
je 0x1002c25f
mov dword [ebp - 0x188], 1
jmp 0x1002c266
and dword [ebp - 0x188], 0
cmp dword [ebp - 0x188], 0
jne 0x1002c27b
mov dword [ebp - 0x138], 1
jmp 0x1002c282
and dword [ebp - 0x138], 0
push 2
lea ecx, [ebp - 0x60]
call fcn.10018bff
mov eax, dword [eax]
imul eax, dword [ebp - 0x138]
cmp eax, 7
jne 0x1002c2a6
mov dword [ebp - 0x190], 1
jmp 0x1002c2ad
and dword [ebp - 0x190], 0
cmp dword [ebp - 0x190], 0
jge 0x1002c2c2
mov dword [ebp - 0x198], 1
jmp 0x1002c2c9
and dword [ebp - 0x198], 0
push 2
lea ecx, [ebp - 0x60]
call fcn.10018bff
mov esi, dword [ebp - 0x198]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x60]
call fcn.10018bff
cmp esi, dword [eax]
je 0x1002c2fa
push 0xfffffffffffffffe
pop eax
test eax, eax
jne 0x1002c2fa
and dword [ebp - 0x144], 0
jmp 0x1002c304
mov dword [ebp - 0x144], 1
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x84], eax
mov esi, dword [ebp - 0x84]
push 2
lea ecx, [ebp - 0x60]
call fcn.10018bff
cmp esi, dword [eax]
jle 0x1002c330
mov dword [ebp - 0x98], 1
jmp 0x1002c337
and dword [ebp - 0x98], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
je 0x1002c36a
mov eax, 0xfbd10caa
test eax, eax
je 0x1002c36a
cmp dword [ebp - 0x84], 0
je 0x1002c36a
mov dword [ebp - 0xa4], 1
jmp 0x1002c371
and dword [ebp - 0xa4], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x1c0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.10018be3
and dword [ebp - 0x8c], 0
jmp 0x1002c3a8
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x28]
add eax, 0x28
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x8c], eax
jge 0x1002c812
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x10], 0
jne 0x1002c704
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x18], 0
jmp 0x1002c3e8
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002c3fe
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x214], 0
jmp 0x1002c3e1
mov dword [ebp - 0x18], 0
jmp 0x1002c40e
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1002c424
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x228], 0x9da97273
jmp 0x1002c407
mov dword [ebp - 0x18], 0
jmp 0x1002c434
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1002c44a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1b8], 0x9e6a0122
jmp 0x1002c42d
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x214]
cmp dword [ebp + eax - 0x214], ecx
je 0x1002c472
mov dword [ebp - 0xac], 1
jmp 0x1002c479
and dword [ebp - 0xac], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x214]
cmp eax, dword [ebp - 0xac]
jge 0x1002c497
mov dword [ebp - 0x80], 1
jmp 0x1002c49b
and dword [ebp - 0x80], 0
cmp dword [ebp - 0x10], 0
jne 0x1002c57d
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jge 0x1002c4b9
mov dword [ebp - 0xb4], 1
jmp 0x1002c4c0
and dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xb4], eax
jge 0x1002c4d7
mov dword [ebp - 0xbc], 1
jmp 0x1002c4de
and dword [ebp - 0xbc], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xbc]
je 0x1002c4fb
cmp dword [ebp - 0x10], 0
je 0x1002c4fb
mov dword [ebp - 0xc4], 1
jmp 0x1002c502
and dword [ebp - 0xc4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc4], eax
jl 0x1002c519
mov dword [ebp - 0xcc], 1
jmp 0x1002c520
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xcc], eax
jg 0x1002c537
mov dword [ebp - 0xd4], 1
jmp 0x1002c53e
and dword [ebp - 0xd4], 0
cmp dword [ebp - 0xd4], 0x2bf5
jle 0x1002c556
mov dword [ebp - 0xdc], 1
jmp 0x1002c55d
and dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xdc], eax
jl 0x1002c56e
cmp dword [ebp - 0x10], 0
je 0x1002c574
cmp dword [ebp - 0x10], 0
jne 0x1002c57d
and dword [ebp - 0xe4], 0
jmp 0x1002c587
mov dword [ebp - 0xe4], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x228]
cmp dword [ebp - 0xe4], eax
jg 0x1002c5a8
mov dword [ebp - 0xec], 1
jmp 0x1002c5af
and dword [ebp - 0xec], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xec]
sub ecx, dword [ebp + eax - 0x228]
cmp ecx, 0x4d8142c7
jl 0x1002c5d6
mov dword [ebp - 0xf4], 1
jmp 0x1002c5dd
and dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xf4], eax
jl 0x1002c5f4
mov dword [ebp - 0xfc], 1
jmp 0x1002c5fb
and dword [ebp - 0xfc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x80]
mov dword [ebp + eax - 0x214], ecx
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0xfc]
jne 0x1002c622
mov dword [ebp - 0x104], 1
jmp 0x1002c629
and dword [ebp - 0x104], 0
cmp dword [ebp - 0x104], 0xffffffff
jbe 0x1002c63e
mov dword [ebp - 0x10c], 1
jmp 0x1002c645
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10c], eax
jl 0x1002c65c
mov dword [ebp - 0x114], 1
jmp 0x1002c663
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
inc eax
cmp eax, 1
jg 0x1002c681
mov dword [ebp - 0x11c], 1
jmp 0x1002c688
and dword [ebp - 0x11c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x11c]
mov dword [ebp + eax - 0x1b8], ecx
mov dword [ebp - 0x10], 0
jmp 0x1002c6ab
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x1002c6dc
mov dword [ebp - 0x40], 0
jmp 0x1002c6c1
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jg 0x1002c6da
mov byte [ebp - 0x2e], 0
push 0
lea eax, [ebp - 0x2e]
push eax
call fcn.1002f070
pop ecx
pop ecx
jmp 0x1002c6ba
jmp 0x1002c6a4
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x1a8]
push eax
push 0
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1002cd9d
add esp, 0x14
jmp 0x1002c392
push 2
lea ecx, [ebp - 0x1e0]
call fcn.10018b61
mov dword [ebp - 4], 4
mov dword [ebp - 0x44], 0x13638ecf
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x54], 0
jmp 0x1002c739
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x1002c755
push dword [ebp - 0x54]
lea ecx, [ebp - 0x1e0]
call fcn.10018bff
mov dword [eax], 0x42eb90da
jmp 0x1002c732
mov dword [ebp - 0x44], 1
jmp 0x1002c765
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x1002c78e
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x1e0]
push eax
push 0
push 0x41c1
call fcn.1002d450
add esp, 0x14
jmp 0x1002c75e
lea eax, [ebp - 0x124]
push eax
push 0
call fcn.1002c85c
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1e0]
call fcn.10018be3
push 4
push 0x1000
mov eax, dword [ebp - 0x28]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x12c]
add ecx, dword [eax + 0xc]
push ecx
push 0x850c
push 0x91b6
call fcn.10028215
pop ecx
pop ecx
call eax
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x28]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1ac]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x88]
call fcn.10028264
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x88]
mov dword [eax + 8], ecx
jmp 0x1002c392
jmp 0x1002c84d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x1bc], eax
push 2
mov ecx, dword [ebp - 0x1bc]
call fcn.10018bff
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x134]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret