Function at 0x1002b85a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006af23
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6d0
push esi
push 1
lea ecx, [ebp - 0x3a8]
call fcn.1000e440
and dword [ebp - 4], 0
mov dword [ebp - 0x44], 0xc29000d4
mov dword [ebp - 0xe0], 0
jmp 0x1002b8aa
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jge 0x1002b8cc
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x3a8]
call fcn.1000e49e
mov dword [eax], 0x9102071b
jmp 0x1002b89d
mov dword [ebp - 0x44], 0
jmp 0x1002b8dc
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x1002bc7d
mov dword [ebp - 0x8c], 0xffffffff
mov dword [ebp - 0x13c], 0x2846
mov dword [ebp - 0x124], 0
jmp 0x1002b913
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 1
jge 0x1002b92f
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0xec], 6
jmp 0x1002b906
mov dword [ebp - 0x8c], 0
jmp 0x1002b948
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jl 0x1002bc78
mov dword [ebp - 0xa0], 0xb61bab59
mov dword [ebp - 0x178], 0xe9d070fe
mov dword [ebp - 0x98], 1
mov dword [ebp - 0xa0], 0
jmp 0x1002b98c
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jg 0x1002bc31
mov dword [ebp - 0x38c], 0xa69eed08
mov dword [ebp - 0x404], 0x9020c5ab
push dword [ebp - 0x44]
lea ecx, [ebp - 0x3a8]
call fcn.1000e49e
push dword [ebp - 0x44]
lea ecx, [ebp - 0x3a8]
call fcn.1000e49e
push dword [ebp - 0x44]
lea ecx, [ebp - 0x3a8]
call fcn.1000e49e
cmp dword [ebp - 0x13c], 0
jne 0x1002b9ec
mov dword [ebp - 0x21c], 1
jmp 0x1002b9f3
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x21c]
sub eax, 0x598737a8
je 0x1002ba15
cmp dword [ebp - 0x13c], 0
je 0x1002ba15
mov dword [ebp - 0x1b0], 1
jmp 0x1002ba1c
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x13c]
add eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x38c], eax
je 0x1002ba4c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xec], 0
je 0x1002ba4c
mov dword [ebp - 0x2b0], 1
jmp 0x1002ba53
and dword [ebp - 0x2b0], 0
cmp dword [ebp - 0x2b0], 0xfffffff9
jae 0x1002ba68
mov dword [ebp - 0x1b8], 1
jmp 0x1002ba6f
and dword [ebp - 0x1b8], 0
mov eax, dword [ebp - 0x1b8]
sub eax, dword [ebp - 0x44]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x2f002739
jge 0x1002ba96
mov dword [ebp - 0x330], 1
jmp 0x1002ba9d
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x330], eax
jne 0x1002bab7
mov dword [ebp - 0x1c0], 1
jmp 0x1002babe
and dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0x1c0]
inc eax
neg eax
mov dword [ebp - 0x2b8], eax
push dword [ebp - 0x44]
lea ecx, [ebp - 0x3a8]
call fcn.1000e49e
mov ecx, dword [ebp - 0x2b8]
mov dword [eax], ecx
cmp dword [ebp - 0x2b8], 0
jne 0x1002baf8
mov dword [ebp - 0x1c8], 1
jmp 0x1002baff
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x1c8]
jg 0x1002bb19
mov dword [ebp - 0x370], 1
jmp 0x1002bb20
and dword [ebp - 0x370], 0
cmp dword [ebp - 0x370], 0x325a
jl 0x1002bb38
mov dword [ebp - 0x1d0], 1
jmp 0x1002bb3f
and dword [ebp - 0x1d0], 0
cmp dword [ebp - 0x1d0], 0xd982
jge 0x1002bb64
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xec], 0
jne 0x1002bb64
cmp dword [ebp - 0x98], 0
je 0x1002bb6b
cmp dword [ebp - 0x8c], 0
mov eax, 0xbeba424a
cmp eax, 1
jbe 0x1002bb81
mov dword [ebp - 0x2c0], 1
jmp 0x1002bb88
and dword [ebp - 0x2c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
cmp dword [ebp - 0x2c0], eax
jle 0x1002bba9
mov dword [ebp - 0x1d8], 1
jmp 0x1002bbb0
and dword [ebp - 0x1d8], 0
cmp dword [ebp - 0x1d8], 0
jg 0x1002bbcb
cmp dword [ebp - 0xa0], 0
jne 0x1002bbcb
and dword [ebp - 0x338], 0
jmp 0x1002bbd5
mov dword [ebp - 0x338], 1
mov eax, dword [ebp - 0x338]
dec eax
dec eax
jne 0x1002bbeb
mov dword [ebp - 0x1e0], 1
jmp 0x1002bbf2
and dword [ebp - 0x1e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
imul eax, dword [ebp - 0x1e0]
cmp eax, 0xe1db
jg 0x1002bc19
mov dword [ebp - 0x2c8], 1
jmp 0x1002bc20
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x404], eax
jmp 0x1002b97f
mov dword [ebp - 0x98], 0
jmp 0x1002bc4a
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jl 0x1002bc73
call fcn.1002b324
push dword [ebp - 0x98]
lea ecx, [ebp - 0x3a8]
call fcn.1000e49e
mov eax, dword [eax]
mov dword [ebp - 0x178], eax
jmp 0x1002bc3d
jmp 0x1002b93b
jmp 0x1002b8d5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3a8]
call fcn.1000e47c
and dword [ebp - 0x34], 0
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x150], 0xd757520c
mov dword [ebp - 0x2f8], 0xffffffff
mov dword [ebp - 0xf4], 3
mov dword [ebp - 0x3c], 0
jmp 0x1002bcc5
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1002bcd8
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1c], 0xfffffffe
jmp 0x1002bcbe
mov dword [ebp - 0x3c], 0
jmp 0x1002bce8
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1002bcfe
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x588], 0x46a2b7f3
jmp 0x1002bce1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1c], 0
jmp 0x1002bd23
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c], 0xffffffef
jl 0x1002c199
mov dword [ebp - 0x138], 0xcf4c59cd
mov dword [ebp - 0x134], 0xcf4c59cd
mov dword [ebp - 0x130], 0xcf4c59cd
mov dword [ebp - 0x12c], 0xcf4c59cd
mov dword [ebp - 0x2f0], 0x3497140d
xor eax, eax
je 0x1002c036
mov dword [ebp - 0x10c], 0xa27289ff
mov dword [ebp - 0x40c], 0x390f3bd7
mov dword [ebp - 0x90], 0xac11
cmp dword [ebp - 0x10c], 0x2f3c
jg 0x1002bda4
mov dword [ebp - 0x200], 1
jmp 0x1002bdab
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x10c]
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0x138]
cmp eax, 0x9034e105
ja 0x1002bdd0
mov dword [ebp - 0x1e8], 1
jmp 0x1002bdd7
and dword [ebp - 0x1e8], 0
cmp dword [ebp - 0x1e8], 0xa9f4f9a
jne 0x1002bdef
mov dword [ebp - 0x390], 1
jmp 0x1002bdf6
and dword [ebp - 0x390], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
add eax, dword [ebp - 0x390]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x138]
cmp eax, dword [ebp - 0x40c]
jge 0x1002be26
mov dword [ebp - 0x438], 1
jmp 0x1002be2d
and dword [ebp - 0x438], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x138]
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x10c], eax
jge 0x1002be59
mov dword [ebp - 0x1f0], 1
jmp 0x1002be60
and dword [ebp - 0x1f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
cmp dword [ebp - 0x1f0], eax
jg 0x1002be7e
mov dword [ebp - 0x2d0], 1
jmp 0x1002be85
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x14], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x138]
cmp dword [ebp - 0x14], eax
je 0x1002beab
mov dword [ebp - 0x1f8], 1
jmp 0x1002beb2
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x1f8], eax
je 0x1002becc
mov dword [ebp - 0x340], 1
jmp 0x1002bed3
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x340], eax
jg 0x1002beed
mov dword [ebp - 0x2d8], 1
jmp 0x1002bef4
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x200]
cmp eax, dword [ebp - 0x2d8]
je 0x1002bf0e
mov dword [ebp - 0x208], 1
jmp 0x1002bf15
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x208]
sub eax, 0x8d83
jne 0x1002bf34
mov eax, 0xbc46
test eax, eax
jne 0x1002bf34
and dword [ebp - 0x378], 0
jmp 0x1002bf3e
mov dword [ebp - 0x378], 1
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x378], eax
jg 0x1002bf58
mov dword [ebp - 0x210], 1
jmp 0x1002bf5f
and dword [ebp - 0x210], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
cmp dword [ebp - 0x210], eax
je 0x1002bf7d
mov dword [ebp - 0x2e0], 1
jmp 0x1002bf84
and dword [ebp - 0x2e0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x138]
cmp eax, dword [ebp - 0x2e0]
jg 0x1002bfa4
mov dword [ebp - 0x440], 1
jmp 0x1002bfab
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x560], eax
cmp dword [ebp - 0x90], 0
jne 0x1002bfcf
cmp dword [ebp - 0x14], 0
jne 0x1002bfcf
and dword [ebp - 0x218], 0
jmp 0x1002bfd9
mov dword [ebp - 0x218], 1
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x218], eax
je 0x1002bff3
mov dword [ebp - 0x348], 1
jmp 0x1002bffa
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x348]
sub eax, 9
jne 0x1002c01e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x138], 0
jne 0x1002c01e
and dword [ebp - 0x220], 0
jmp 0x1002c028
mov dword [ebp - 0x220], 1
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x150], eax
jmp 0x1002c094
mov dword [ebp - 0x448], 0xe10320ba
mov dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x448]
inc eax
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x138]
jl 0x1002c07a
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x138], 0
je 0x1002c07a
mov dword [ebp - 0x2e8], 1
jmp 0x1002c081
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x2f0]
imul eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x470], eax
mov dword [ebp - 0x14], 3
jmp 0x1002c0a4
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1002c194
mov byte [ebp - 0x7a], 0
lea eax, [ebp - 0x7a]
push eax
call fcn.1002b35a
pop ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2f8]
cmp dword [ebp + eax*4 - 0x138], ecx
jl 0x1002c0da
mov dword [ebp - 0x228], 1
jmp 0x1002c0e1
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x138]
cmp eax, dword [ebp - 0x228]
jg 0x1002c0ff
mov dword [ebp - 0x238], 1
jmp 0x1002c106
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x138], 0
je 0x1002c128
mov eax, 0x4f1d
test eax, eax
je 0x1002c128
mov dword [ebp - 0x398], 1
jmp 0x1002c12f
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x398], eax
je 0x1002c145
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x14]
cmp dword [ebp + eax - 0x138], ecx
je 0x1002c163
mov dword [ebp - 0x230], 1
jmp 0x1002c16a
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x230]
sub eax, dword [ebp - 0x2f0]
mov ecx, dword [ebp - 0x238]
sub ecx, eax
mov eax, dword [ebp - 0x14]
imul ecx, dword [ebp + eax*4 - 0x138]
mov dword [ebp - 0x150], ecx
jmp 0x1002c09d
jmp 0x1002bd0e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c], 0x6feb
jge 0x1002c1b5
mov dword [ebp - 0x350], 1
jmp 0x1002c1bc
and dword [ebp - 0x350], 0
cmp dword [ebp - 0x350], 0xb4d81485
jne 0x1002c1da
cmp dword [ebp - 0xf4], 0
jne 0x1002c1da
and dword [ebp - 0x240], 0
jmp 0x1002c1e4
mov dword [ebp - 0x240], 1
mov eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0x150]
sub ecx, dword [ebp - 0x240]
sub ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x2f8]
imul ecx, ecx, 0xfff6
imul eax, ecx
cmp eax, 0xa475
je 0x1002c21c
mov dword [ebp - 0x248], 1
jmp 0x1002c223
and dword [ebp - 0x248], 0
imul eax, dword [ebp - 0x248], 0xfffffff9
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xe87ca61
je 0x1002c248
mov dword [ebp - 0x380], 1
jmp 0x1002c24f
and dword [ebp - 0x380], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
cmp dword [ebp - 0x380], eax
jl 0x1002c26d
mov dword [ebp - 0x250], 1
jmp 0x1002c274
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x250]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1c], eax
push 1
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp + 8]
push eax
push 0x4afa
push 0x1778
push 1
call fcn.100275bd
add esp, 0x18
mov dword [ebp - 0x568], 0x47dfa860
call fcn.1002b38a
push 0x3dfb
push 0x3162
push 0x304c
push 0x4631
push 1
push 1
push 0x49aa
push 0x774e
push 0x395d
push 0x347c
push 0x1384
push 0x3743
push 0x7562
call fcn.10027a0d
add esp, 0x34
mov eax, dword [ebp - 0x188]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002c4e6
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x94], 0x90edcad2
push 2
lea ecx, [ebp - 0x484]
call fcn.1000e440
mov dword [ebp - 4], 1
mov dword [ebp - 0xb4], 0
jmp 0x1002c34d
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x1002c369
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x608], 0xfffffffb
jmp 0x1002c340
push 0x30e2
push 0x35db
push 0x4546
push 0x68c4
push 1
push 1
lea eax, [ebp - 0x484]
push eax
push 0x620b
lea eax, [ebp - 0xb4]
push eax
call fcn.10027d15
add esp, 0x24
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x2c]
test eax, eax
jne 0x1002c3b3
mov dword [ebp - 0x190], 1
jmp 0x1002c3ba
and dword [ebp - 0x190], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x190]
mov dword [ebp + eax - 0x608], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x190], eax
jge 0x1002c3f0
mov dword [ebp - 0x300], 1
jmp 0x1002c3f7
and dword [ebp - 0x300], 0
push 1
lea ecx, [ebp - 0x484]
call fcn.1000e49e
mov ecx, dword [ebp - 0x300]
mov dword [eax], ecx
mov dword [ebp - 0x2c], 0
jmp 0x1002c41c
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jg 0x1002c4d0
mov dword [ebp - 0x94], 1
jmp 0x1002c43f
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x1002c482
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x1002c480
push 0x23d0
push 0x889
push 0x143
push 0xa86
push 0x2690
push 0
push 0
push 0
push 0
push 0xee0
call dword [sym.imp.USER32.dll_DrawStateW]
jmp 0x1002c432
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x608], 0
jne 0x1002c4ab
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x484]
call fcn.1000e49e
cmp dword [eax], 0
jne 0x1002c4ab
and dword [ebp - 0x258], 0
jmp 0x1002c4b5
mov dword [ebp - 0x258], 1
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x484]
call fcn.1000e49e
mov ecx, dword [ebp - 0x258]
mov dword [eax], ecx
jmp 0x1002c415
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x484]
call fcn.1000e47c
xor eax, eax
jmp 0x1002e87c
push 2
lea ecx, [ebp - 0x504]
call fcn.1000e440
mov dword [ebp - 4], 2
mov dword [ebp - 0x3cc], 0xd490c4d8
mov dword [ebp - 0x570], 0xe31d
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x598]
push eax
call fcn.1002b3b6
pop ecx
pop ecx
push 0x76c9
push 1
lea eax, [ebp - 0x504]
push eax
push 1
lea eax, [ebp - 0x3cc]
push eax
call fcn.100282dc
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x504]
call fcn.1000e47c
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.1002b3fe
add esp, 0xc
mov dword [ebp - 0x4e0], 0x96dd1e1e
mov dword [ebp - 0x4dc], 0x96dd1e1e
mov dword [ebp - 0x4d8], 0x96dd1e1e
mov dword [ebp - 0x4d4], 0x96dd1e1e
lea ecx, [ebp - 0x1a1]
call fcn.1000efe6
push eax
lea eax, [ebp - 0x4d0]
push eax
lea eax, [ebp - 0x4e0]
push eax
lea ecx, [ebp - 0x6b0]
call fcn.1002f69f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3c8]
call fcn.1002f5e8
mov dword [ebp - 4], 3
mov dword [ebp - 0x9c], 0xbd4856cd
mov dword [ebp - 0x360], 0
mov dword [ebp - 0x3e0], 0x7fc0336a
mov dword [ebp - 0x11c], 0
jmp 0x1002c606
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 1
jge 0x1002c61f
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x60], 1
jmp 0x1002c5f9
push 2
lea ecx, [ebp - 0x3c8]
call fcn.1000e49e
and dword [eax], 0
jmp 0x1002c655
push 2
lea ecx, [ebp - 0x3c8]
call fcn.1000e49e
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0x358]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x358]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x3c8]
call fcn.1000e49e
cmp dword [eax], 0
jl 0x1002c909
mov dword [ebp - 0xfc], 0
jmp 0x1002c684
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 3
jge 0x1002c6a0
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x498], 0xea6801fc
jmp 0x1002c677
call fcn.1002b42c
mov dword [ebp - 0x3d8], 0x229d
cmp dword [ebp - 0x3d8], 0xa8b
jge 0x1002c8c3
lea eax, [ebp - 0x158]
push eax
push 0x100077f8
call fcn.100513ab
pop ecx
pop ecx
and dword [ebp - 0x160], 0
mov dword [ebp - 0xd8], 0x72
push dword [ebp - 0x158]
lea ecx, [ebp - 0x3bc]
call fcn.1000e440
mov byte [ebp - 4], 4
and dword [ebp - 0x88], 0
jmp 0x1002c70e
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x158]
jge 0x1002c7b0
push dword [ebp - 0x88]
lea ecx, [ebp - 0x3bc]
call fcn.1000e49e
push eax
push 0x100077f8
call fcn.100513ab
pop ecx
pop ecx
push dword [ebp - 0x88]
lea ecx, [ebp - 0x3bc]
call fcn.1000e49e
mov ecx, dword [ebp - 0xd8]
cmp ecx, dword [eax]
jge 0x1002c767
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x260], eax
jmp 0x1002c780
push dword [ebp - 0x88]
lea ecx, [ebp - 0x3bc]
call fcn.1000e49e
mov eax, dword [eax]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0xd8], eax
push dword [ebp - 0x88]
lea ecx, [ebp - 0x3bc]
call fcn.1000e49e
mov ecx, dword [ebp - 0x160]
add ecx, dword [eax]
mov dword [ebp - 0x160], ecx
jmp 0x1002c701
and dword [ebp - 0xdc], 0
and dword [ebp - 0x114], 0
jmp 0x1002c7cd
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x158]
jge 0x1002c89b
push dword [ebp - 0x114]
lea ecx, [ebp - 0x3bc]
call fcn.1000e49e
mov eax, dword [eax]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x84], 1
jmp 0x1002c811
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x180]
jg 0x1002c896
mov eax, dword [ebp - 0x180]
cdq
idiv dword [ebp - 0x84]
test edx, edx
je 0x1002c832
jmp 0x1002c804
mov ecx, dword [ebp - 0x84]
dec ecx
imul ecx, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x84]
dec eax
imul eax, dword [ebp - 0x180]
cdq
idiv dword [ebp - 0x84]
sub ecx, eax
mov dword [ebp - 0x308], ecx
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0x308]
jge 0x1002c879
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x268], eax
jmp 0x1002c885
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x268], eax
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0xdc], eax
jmp 0x1002c804
jmp 0x1002c7c0
mov eax, dword [ebp - 0x160]
add eax, dword [ebp - 0xdc]
push eax
push 0x10007804
call fcn.100515a0
pop ecx
pop ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x3bc]
call fcn.1000e47c
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x498], 0
jmp 0x1002c8ee
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x498]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x498], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x498], 0
jg 0x1002c904
call fcn.1002b5e2
jmp 0x1002c8d5
jmp 0x1002c631
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x60], 0xffffffff
je 0x1002c922
mov dword [ebp - 0x39c], 1
jmp 0x1002c929
and dword [ebp - 0x39c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
cmp eax, dword [ebp - 0x39c]
je 0x1002c946
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x60], 0
cmp dword [ebp - 0x9c], 0
je 0x1002c968
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x60], 0
je 0x1002c968
mov dword [ebp - 0x270], 1
jmp 0x1002c96f
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x9c]
imul eax, dword [ebp - 0x270]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x60]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x60]
cmp eax, dword [ebp - 0x9c]
jge 0x1002c9a4
mov dword [ebp - 0x44c], 1
jmp 0x1002c9ab
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x5a0], eax
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], eax
jge 0x1002c9d1
mov dword [ebp - 0x310], 1
jmp 0x1002c9d8
and dword [ebp - 0x310], 0
cmp dword [ebp - 0x310], 0
je 0x1002c9ed
mov dword [ebp - 0x278], 1
jmp 0x1002c9f4
and dword [ebp - 0x278], 0
push 2
lea ecx, [ebp - 0x3c8]
call fcn.1000e49e
mov dword [ebp - 0x280], eax
push 2
lea ecx, [ebp - 0x3c8]
call fcn.1000e49e
mov ecx, dword [ebp - 0x280]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x360]
mov ecx, dword [ebp - 0x280]
cmp dword [ecx], eax
je 0x1002ca46
mov dword [ebp - 0x318], 1
jmp 0x1002ca4d
and dword [ebp - 0x318], 0
cmp dword [ebp - 0x318], 0
je 0x1002ca6f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x60], 0
je 0x1002ca6f
mov dword [ebp - 0x288], 1
jmp 0x1002ca76
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x3e0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c8]
call fcn.1000e47c
mov eax, dword [ebp - 0xb0]
cmp dword [eax], 0x4550
je 0x1002ce1f
mov dword [ebp - 0x4cc], 9
mov dword [ebp - 0x4c8], 9
mov dword [ebp - 0x4c4], 9
mov dword [ebp - 0x4c0], 9
lea ecx, [ebp - 0x195]
call fcn.1000efe6
push eax
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0x4cc]
push eax
lea ecx, [ebp - 0x6b8]
call fcn.1002f69f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x510]
call fcn.1002f5e8
mov dword [ebp - 4], 5
mov dword [ebp - 0x5a8], 0x6dc660f7
mov dword [ebp - 0x5b0], 0xff8ee1d1
mov dword [ebp - 0x3e8], 0xfffffffb
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x5b8], 0xffffffff
mov dword [ebp - 0x5c0], 0xfffffffd
mov dword [ebp - 0x5c8], 0xedac7a8c
mov dword [ebp - 0x5d0], 0xc12a7b09
mov dword [ebp - 0x5d8], 0xf1571c09
mov dword [ebp - 0x5e0], 0x21dd2eb2
mov dword [ebp - 0x5e8], 0xffffffff
mov dword [ebp - 0x5f0], 0xffffffff
mov dword [ebp - 0x5f8], 1
mov dword [ebp - 0x680], 0
mov dword [ebp - 0x688], 0x89ced66
mov dword [ebp - 0x474], 0xfffffffe
mov dword [ebp - 0x690], 0x88ce324e
mov dword [ebp - 0x40], 0
jmp 0x1002cbc1
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x1002cbd4
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x64], 0x90c4d8e5
jmp 0x1002cbba
mov dword [ebp - 0x40], 0
jmp 0x1002cbe4
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x1002cbfa
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x6dc], 0xf199314e
jmp 0x1002cbdd
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x64], 0
jmp 0x1002cc1f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x64], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x64], 3
jg 0x1002ce09
mov dword [ebp - 0x674], 0xfffffff6
mov dword [ebp - 0x4b8], 9
mov dword [ebp - 0x4b4], 9
mov dword [ebp - 0x4b0], 9
mov dword [ebp - 0x4ac], 9
lea ecx, [ebp - 0x145]
call fcn.1000efe6
push eax
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x4b8]
push eax
lea ecx, [ebp - 0x6c8]
call fcn.1002f69f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x69c]
call fcn.1002f5e8
mov byte [ebp - 4], 6
mov dword [ebp - 0x1a0], 0x4d9fabaf
mov dword [ebp - 0x3f0], 0xfffffff8
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x64]
lea ecx, [ebp - 0x510]
call fcn.1000e49e
mov dword [eax], 0xa11c1574
mov eax, 0xa11c1574
test eax, eax
je 0x1002cde2
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x64]
lea ecx, [ebp - 0x510]
call fcn.1000e49e
cmp dword [eax], 0
jne 0x1002cd6d
mov eax, dword [ebp - 0x474]
cmp dword [ebp - 0x3e8], eax
jne 0x1002cd0b
mov dword [ebp - 0x388], 1
jmp 0x1002cd12
and dword [ebp - 0x388], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x64]
cmp eax, dword [ebp - 0x388]
je 0x1002cd30
mov dword [ebp - 0x290], 1
jmp 0x1002cd37
and dword [ebp - 0x290], 0
cmp dword [ebp - 0x290], 0xe16
je 0x1002cd4f
mov dword [ebp - 0x320], 1
jmp 0x1002cd56
and dword [ebp - 0x320], 0
imul eax, dword [ebp - 0x320], 0xfffc
test eax, eax
jne 0x1002cd6d
and dword [ebp - 0x298], 0
jmp 0x1002cd77
mov dword [ebp - 0x298], 1
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
cmp eax, dword [ebp - 0x298]
jl 0x1002cda5
push 7
pop eax
test eax, eax
je 0x1002cda5
mov dword [ebp - 0x368], 1
jmp 0x1002cdac
and dword [ebp - 0x368], 0
cmp dword [ebp - 0x368], 0
je 0x1002cdc1
mov dword [ebp - 0x2a0], 1
jmp 0x1002cdc8
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x458]
add eax, dword [ebp - 0x2a0]
je 0x1002cde2
mov dword [ebp - 0x328], 1
jmp 0x1002cde9
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x3f0], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x69c]
call fcn.1000e47c
jmp 0x1002cc0a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x510]
call fcn.1000e47c
xor eax, eax
jmp 0x1002e87c
lea eax, [ebp - 0x100]
push eax
push 0xa3
push 0x19d8
push 0x3df4
push 0x43f1
push 0x360
push 1
push 0x7cd7
push dword [ebp - 0xb0]
push 0xe1
push 1
push 0x4b79
call fcn.10026bc2
add esp, 0x30
cmp dword [ebp - 0x100], 0
jne 0x1002cf5f
mov dword [ebp - 0x488], 0x19ff
cmp dword [ebp - 0x488], 0xe06
jge 0x1002cf58
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x3f8]
push eax
lea eax, [ebp - 0xa4]
push eax
push 0x100078f0
call fcn.100513ab
add esp, 0x10
mov byte [ebp - 0x25], 0
imul eax, dword [ebp - 0xa4], 0xa
mov dword [ebp - 0xa4], eax
and dword [ebp - 0xc4], 0
jmp 0x1002ced0
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xa
jge 0x1002cf0a
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0xc4]
cdq
idiv dword [ebp - 0x3f8]
test edx, edx
jne 0x1002cf08
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0xc4]
mov dword [ebp - 0xa4], eax
mov byte [ebp - 0x25], 1
jmp 0x1002cf0a
jmp 0x1002cec3
movzx eax, byte [ebp - 0x25]
test eax, eax
je 0x1002cf4d
push dword [ebp - 0xa4]
push 0x100077f8
call fcn.100515a0
pop ecx
pop ecx
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
je 0x1002cf40
push 0x100078e4
call fcn.100515a0
pop ecx
jmp 0x1002cf24
push 0x100078e8
call fcn.100515a0
pop ecx
jmp 0x1002cf58
push 0x100078ec
call fcn.1005170c
pop ecx
xor eax, eax
jmp 0x1002e87c
push 0x2b2a
push 0x6650
push 0x2ab2
lea eax, [ebp - 0x100]
push eax
push 0x5ddd
push 0x3ac8
push 0x470e
push 1
push dword [ebp - 0xb0]
lea eax, [ebp - 0x57c]
push eax
push 1
push 0
push 0x3260
lea eax, [ebp - 0x34]
push eax
push 0x3748
push dword [ebp - 0x188]
call fcn.1002a85d
add esp, 0x40
mov dword [ebp - 0x5c], 0xdfe4d9ed
mov dword [ebp - 0xe8], 1
mov dword [ebp - 0x2a8], 0xffffffff
mov dword [ebp - 0x140], 0xaf9031ea
mov dword [ebp - 0xac], 4
mov dword [ebp - 0x170], 1
push 2
lea ecx, [ebp - 0x51c]
call fcn.1000e440
mov dword [ebp - 4], 7
mov dword [ebp - 0x1bc], 0x8d98c683
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x408], 9
mov dword [ebp - 0xbc], 0
jmp 0x1002d037
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x1002d053
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x418], 0x4122e7df
jmp 0x1002d02a
lea eax, [ebp - 0x51c]
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.1002b60e
pop ecx
pop ecx
push 1
push 0xab
push 0x3c8
push 0x6890
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x563c
push 0x5fde
push 0
push 1
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0xe8]
push eax
push 0xa1
call fcn.1002b082
add esp, 0x34
cmp dword [ebp - 0x5c], 0
je 0x1002d209
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x64c], eax
cmp dword [ebp - 0xac], 0xfffffff6
jg 0x1002d0d8
mov dword [ebp - 0x460], 1
jmp 0x1002d0df
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x55c], eax
cmp dword [ebp - 0xe8], 0xfffffff9
je 0x1002d100
mov dword [ebp - 0x394], 1
jmp 0x1002d107
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x394]
imul eax, ecx
mov dword [ebp - 0x170], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x418]
cmp dword [ebp - 0x170], eax
je 0x1002d140
mov dword [ebp - 0x1ac], 1
jmp 0x1002d147
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x1ac], eax
jl 0x1002d15e
mov dword [ebp - 0x400], 1
jmp 0x1002d165
and dword [ebp - 0x400], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x418]
mov dword [ebp - 0x5ec], eax
cmp dword [ebp - 0x170], 0x35d7
jl 0x1002d190
mov dword [ebp - 0x478], 1
jmp 0x1002d197
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x564], eax
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0xac], eax
jl 0x1002d1ba
mov dword [ebp - 0x1b4], 1
jmp 0x1002d1c1
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x140], eax
mov esi, dword [ebp - 0x140]
push 1
lea ecx, [ebp - 0x51c]
call fcn.1000e49e
mov dword [eax], esi
mov dword [ebp - 0x1bc], 0x820e
mov eax, dword [ebp - 0x1bc]
add eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0xe8]
jge 0x1002d209
mov dword [ebp - 0x1c4], 1
jmp 0x1002d210
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 6
jne 0x1002d231
mov dword [ebp - 0x1d4], 1
jmp 0x1002d238
and dword [ebp - 0x1d4], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x1d4], eax
je 0x1002d24f
mov dword [ebp - 0x1dc], 1
jmp 0x1002d256
and dword [ebp - 0x1dc], 0
cmp dword [ebp - 0x1dc], 0xffffffff
jne 0x1002d26b
mov dword [ebp - 0x1e4], 1
jmp 0x1002d272
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x1e4], eax
jl 0x1002d289
mov dword [ebp - 0x1ec], 1
jmp 0x1002d290
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x1ec], eax
jl 0x1002d2aa
mov dword [ebp - 0x1f4], 1
jmp 0x1002d2b1
and dword [ebp - 0x1f4], 0
cmp dword [ebp - 0x1f4], 0x1885
jg 0x1002d2c9
mov dword [ebp - 0x1fc], 1
jmp 0x1002d2d0
and dword [ebp - 0x1fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x418]
cmp dword [ebp - 0x1fc], eax
jge 0x1002d2f1
mov dword [ebp - 0x204], 1
jmp 0x1002d2f8
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x408], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x51c]
call fcn.1000e47c
lea eax, [ebp - 0xb0]
push eax
push 1
push 1
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp + 8]
push eax
call fcn.1002888c
add esp, 0x14
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.1002b656
add esp, 0xc
cmp dword [ebp - 0x20c], 0
je 0x1002d402
push 2
lea ecx, [ebp - 0x534]
call fcn.1000e440
mov dword [ebp - 4], 8
mov dword [ebp - 0x468], 0xfffffffe
mov dword [ebp - 0x578], 0xfffffff6
mov dword [ebp - 0xf0], 0
jmp 0x1002d399
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 2
jge 0x1002d3b8
push dword [ebp - 0xf0]
lea ecx, [ebp - 0x534]
call fcn.1000e49e
and dword [eax], 0
jmp 0x1002d38c
lea eax, [ebp - 0x534]
push eax
lea eax, [ebp - 0x468]
push eax
call fcn.1002b684
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x534]
call fcn.1000e47c
push 1
push 1
push 0x273a
push 0x6c54
lea eax, [ebp - 0x20c]
push eax
push 0x39d4
lea eax, [ebp - 0x34]
push eax
call fcn.10028962
add esp, 0x1c
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x38], 0
jmp 0x1002d419
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1002d42f
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x4a4], 0
jmp 0x1002d412
mov dword [ebp - 0x38], 0
jmp 0x1002d43f
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1002d455
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x214], 0xffffffff
jmp 0x1002d438
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x4a4], 0xfffffff2
jmp 0x1002d480
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x4a4]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x4a4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x4a4], 5
jg 0x1002d4d3
mov dword [ebp - 0xf8], 0x71d976ff
mov dword [ebp - 0x56c], 2
mov dword [ebp - 0xf8], 0
jmp 0x1002d4bc
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0x1b
jne 0x1002d4d1
lea eax, [ebp - 0x68]
push eax
call fcn.10024272
pop ecx
jmp 0x1002d4af
jmp 0x1002d467
mov dword [ebp - 0x68], 0
jmp 0x1002d4e3
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jg 0x1002d4ff
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp + eax*4 - 0x214]
mov dword [ebp + ecx*4 - 0x214], eax
jmp 0x1002d4dc
push dword [ebp - 0x34]
call fcn.1002440f
pop ecx
test eax, eax
jne 0x1002d852
mov dword [ebp - 0x580], 0x2fd4
mov dword [ebp - 0x574], 0xfffffff6
mov dword [ebp - 0x550], 0x20398070
push 1
lea ecx, [ebp - 0x638]
call fcn.1000e440
mov dword [ebp - 4], 9
push 1
lea ecx, [ebp - 0x628]
call fcn.1000e440
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x590], 0xffffffff
push 1
lea ecx, [ebp - 0x618]
call fcn.1000e440
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x410], 5
push 0x668c
lea eax, [ebp - 0x1a8]
push eax
push 1
push 0x638
lea eax, [ebp - 0x638]
push eax
push 1
push 0x5b3b
call fcn.10028a78
add esp, 0x1c
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x1a8]
push eax
push 0x7d0
push 1
push 1
push 0x2344
push 0x21c5
call fcn.10028cfe
add esp, 0x1c
lea eax, [ebp - 0x618]
push eax
push 0x3db4
push 1
push 0x3ad2
lea eax, [ebp - 0x1a8]
push eax
push 1
call fcn.10028dd5
add esp, 0x18
push 0x3c6e
push 1
lea eax, [ebp - 0x410]
push eax
push 1
push 0x1639
call fcn.10028ee5
add esp, 0x14
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x1002d61c
call fcn.1002b6cc
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x618]
call fcn.1000e47c
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x628]
call fcn.1000e47c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x638]
call fcn.1000e47c
mov dword [ebp - 0x48c], 0x15eb
cmp dword [ebp - 0x48c], 0x1102
jge 0x1002d84b
mov dword [ebp - 0x67c], 0x1a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x70]
push eax
push 0x10007944
call fcn.100513ab
add esp, 0xc
lea ecx, [ebp - 0x54c]
call fcn.1000e09c
mov dword [ebp - 4], 0xc
lea edx, [ebp - 0x54c]
mov ecx, 0x1065b170
call fcn.100331ca
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x70]
cdq
sub eax, edx
sar eax, 1
cmp dword [ebp - 0x10], eax
jle 0x1002d6c8
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
or dword [ebp - 0x18], 0xffffffff
and dword [ebp - 0x30], 0
and dword [ebp - 0x24], 0
and dword [ebp - 0x48], 0
jmp 0x1002d6e1
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x70]
cdq
sub eax, edx
sar eax, 1
cmp dword [ebp - 0x48], eax
jg 0x1002d781
push dword [ebp - 0x48]
lea ecx, [ebp - 0x54c]
call fcn.1000e11d
movsx esi, byte [eax]
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x48]
push eax
lea ecx, [ebp - 0x54c]
call fcn.1000e11d
movsx eax, byte [eax]
cmp esi, eax
je 0x1002d77c
push dword [ebp - 0x48]
lea ecx, [ebp - 0x54c]
call fcn.1000e11d
movsx esi, byte [eax]
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x48]
push eax
lea ecx, [ebp - 0x54c]
call fcn.1000e11d
movsx eax, byte [eax]
sub esi, eax
mov dword [ebp - 0x78], esi
jns 0x1002d752
mov eax, dword [ebp - 0x78]
add eax, 0x1a
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xd
jle 0x1002d761
push 0x1a
pop eax
sub eax, dword [ebp - 0x78]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x78]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x18], 0
jge 0x1002d776
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x30], eax
jmp 0x1002d6da
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jg 0x1002d79a
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
jmp 0x1002d81a
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x10]
jg 0x1002d7d0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x30]
jg 0x1002d7d0
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x10]
cmp eax, ecx
jg 0x1002d7d0
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x24]
add ecx, eax
mov dword [ebp - 0x24], ecx
jmp 0x1002d81a
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x10]
jg 0x1002d806
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x30]
jg 0x1002d806
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
cmp eax, ecx
jge 0x1002d806
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x24]
add ecx, eax
mov dword [ebp - 0x24], ecx
jmp 0x1002d81a
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x10]
jg 0x1002d81a
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x18], 0
jge 0x1002d82d
push 0x100078e4
call fcn.1005170c
pop ecx
jmp 0x1002d83c
push dword [ebp - 0x24]
push 0x10007804
call fcn.100515a0
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54c]
call fcn.1000e0ff
xor eax, eax
jmp 0x1002e87c
push 1
push 0x11d4
push dword [ebp - 0x34]
push 0x4243
push 0
call fcn.10021792
add esp, 0x14
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002e662
mov dword [ebp - 0x41c], 0x13a2
cmp dword [ebp - 0x41c], 0x563
jge 0x1002d93b
lea eax, [ebp - 0x450]
push eax
push 0x100077f8
call fcn.100513ab
pop ecx
pop ecx
lea ecx, [ebp - 0x424]
call fcn.1002f6c7
mov dword [ebp - 4], 0xd
and dword [ebp - 0x144], 0
jmp 0x1002d8cf
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
cmp eax, dword [ebp - 0x450]
jge 0x1002d914
lea eax, [ebp - 0x224]
push eax
push 0x100077f8
call fcn.100513ab
pop ecx
pop ecx
cmp dword [ebp - 0x224], 0
je 0x1002d912
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x6c0]
push eax
lea ecx, [ebp - 0x424]
call fcn.1002f6dc
jmp 0x1002d8c2
lea ecx, [ebp - 0x424]
call fcn.1002f71c
push eax
push 0x10007804
call fcn.100515a0
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x424]
call fcn.1002f6fa
mov dword [ebp - 0x584], 0xc6a53d06
call fcn.1002b6ed
mov byte [ebp - 0x7d], 0
lea eax, [ebp - 0x7d]
push eax
call fcn.1002b72c
pop ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x100]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x2f4], ecx
mov dword [ebp - 0xb8], 0x48bbca63
mov dword [ebp - 0x14c], 0xffffffff
mov dword [ebp - 0x110], 0xee39f3fa
call fcn.1002b764
mov dword [ebp - 0xb8], 0xffffffe6
jmp 0x1002d9a8
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0x13
jge 0x1002dad4
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x108], 0
jmp 0x1002d9d5
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 3
jge 0x1002d9f1
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x6a8], 0xffffffff
jmp 0x1002d9c8
mov dword [ebp - 0x14c], 0xdc4b4e12
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5f4], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x110], eax
jg 0x1002da30
mov dword [ebp - 0x22c], 1
jmp 0x1002da37
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x22c]
jg 0x1002da51
mov dword [ebp - 0x428], 1
jmp 0x1002da58
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x65c], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x594], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5fc], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x110], eax
je 0x1002da93
cmp dword [ebp - 0x110], 0
jne 0x1002da93
and dword [ebp - 0x454], 0
jmp 0x1002da9d
mov dword [ebp - 0x454], 1
cmp dword [ebp - 0x54], 0
jne 0x1002dab2
cmp dword [ebp - 0x54], 0
jne 0x1002dab2
and dword [ebp - 0x234], 0
jmp 0x1002dabc
mov dword [ebp - 0x234], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x234]
mov dword [ebp + eax - 0x6a8], ecx
jmp 0x1002d99b
cmp dword [ebp - 0x2f4], 0
jne 0x1002e1b2
mov dword [ebp - 0x20], 0xb7c7ce53
mov dword [ebp - 0x24c], 0x7f191253
mov dword [ebp - 0x254], 0xb5cf
mov dword [ebp - 0x50], 0
jmp 0x1002db0c
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x1002db22
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x528], 0xffffffff
jmp 0x1002db05
mov dword [ebp - 0x50], 0
jmp 0x1002db32
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x1002db48
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x434], 0xb43d2717
jmp 0x1002db2b
mov dword [ebp - 0x20], 0
jmp 0x1002db58
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x1002dbd6
mov dword [ebp - 0xd4], 3
mov byte [ebp - 0x7b], 0
push 0x48d8
lea eax, [ebp - 0x7b]
push eax
push 0x2d20
push 1
push 1
call fcn.10029604
add esp, 0x14
call fcn.1002b7c2
mov dword [ebp - 0xd4], 2
jmp 0x1002dba4
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jl 0x1002dbd1
mov byte [ebp - 0x7c], 0
movzx eax, byte [ebp - 0x7c]
test eax, eax
je 0x1002dbcf
push 0x6986
push 0x2f4b
push 1
push 1
call fcn.1002999f
add esp, 0x10
jmp 0x1002db97
jmp 0x1002db51
cmp dword [ebp - 0x20], 0
jne 0x1002dc7c
cmp dword [ebp - 0x20], 0
je 0x1002dc10
mov eax, dword [ebp - 0x20]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x528]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x528]
jg 0x1002dc10
mov dword [ebp - 0x23c], 1
jmp 0x1002dc17
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x23c]
jl 0x1002dc2e
mov dword [ebp - 0x244], 1
jmp 0x1002dc35
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0
jne 0x1002dc62
mov dword [ebp - 0x154], 1
jmp 0x1002dc69
and dword [ebp - 0x154], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x154]
mov dword [ebp + eax - 0x434], ecx
mov eax, 0xe491ba6b
cmp eax, 0x7e7c14ab
ja 0x1002dc94
mov dword [ebp - 0x25c], 1
jmp 0x1002dc9b
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x25c], eax
je 0x1002dcb2
mov dword [ebp - 0x264], 1
jmp 0x1002dcb9
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x264]
jg 0x1002dcd0
mov dword [ebp - 0x26c], 1
jmp 0x1002dcd7
and dword [ebp - 0x26c], 0
cmp dword [ebp - 0x26c], 1
jle 0x1002dcf0
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x1002dcf0
and dword [ebp - 0x274], 0
jmp 0x1002dcfa
mov dword [ebp - 0x274], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x274]
sub ecx, dword [ebp + eax - 0x528]
cmp ecx, 0x20dd
jne 0x1002dd21
mov dword [ebp - 0x27c], 1
jmp 0x1002dd28
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x58], 0xdfe4d9ed
mov dword [ebp - 0x45c], 0x1514
cmp dword [ebp - 0x45c], 0x99c
jge 0x1002de68
lea eax, [ebp - 0x15c]
push eax
push 0x100077f8
call fcn.100513ab
pop ecx
pop ecx
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x43c], 0
je 0x1002de68
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x464]
push eax
push 0x1000781c
call fcn.100513ab
add esp, 0xc
and dword [ebp - 0x17c], 0
and dword [ebp - 0x164], 0
jmp 0x1002ddc3
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
cmp eax, dword [ebp - 0x464]
jge 0x1002de58
lea eax, [ebp - 0x16c]
push eax
push 0x100077f8
call fcn.100513ab
pop ecx
pop ecx
mov eax, dword [ebp - 0x16c]
shl eax, 1
cmp eax, dword [ebp - 0x174]
jge 0x1002de05
push 0x10007800
call fcn.100515a0
pop ecx
jmp 0x1002de53
mov eax, dword [ebp - 0x16c]
shl eax, 1
cmp eax, dword [ebp - 0x174]
jle 0x1002de22
push 0x100077fc
call fcn.100515a0
pop ecx
jmp 0x1002de53
mov eax, dword [ebp - 0x16c]
shl eax, 1
cmp eax, dword [ebp - 0x174]
jne 0x1002de53
push dword [ebp - 0x17c]
push 0x100078c0
call fcn.100515a0
pop ecx
pop ecx
xor eax, eax
inc eax
sub eax, dword [ebp - 0x17c]
mov dword [ebp - 0x17c], eax
jmp 0x1002ddb6
push 0x10007760
call fcn.1005170c
pop ecx
jmp 0x1002dd65
mov dword [ebp - 0x118], 1
mov dword [ebp - 0x284], 0xffffffff
mov dword [ebp - 0x18c], 0xaf9031ea
mov dword [ebp - 0xc0], 4
mov dword [ebp - 0x184], 1
push 2
lea ecx, [ebp - 0x4ec]
call fcn.1000e440
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x2a4], 0x8d98c683
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x3d4], 9
mov dword [ebp - 0xa8], 0
jmp 0x1002dee5
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x1002df01
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x430], 0x4122e7df
jmp 0x1002ded8
lea eax, [ebp - 0x4ec]
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.1002b60e
pop ecx
pop ecx
push 1
push 0
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x284]
push eax
push 0x3b23
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x118]
push eax
push 0x7061
call fcn.10029a09
add esp, 0x20
cmp dword [ebp - 0x58], 0
je 0x1002e0a1
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x59c], eax
cmp dword [ebp - 0xc0], 0xfffffff6
jg 0x1002df70
mov dword [ebp - 0x444], 1
jmp 0x1002df77
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x68c], eax
cmp dword [ebp - 0x118], 0xfffffff9
je 0x1002df98
mov dword [ebp - 0x28c], 1
jmp 0x1002df9f
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x58]
add ecx, dword [ebp - 0x28c]
imul eax, ecx
mov dword [ebp - 0x184], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x430]
cmp dword [ebp - 0x184], eax
je 0x1002dfd8
mov dword [ebp - 0x294], 1
jmp 0x1002dfdf
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x294], eax
jl 0x1002dff6
mov dword [ebp - 0x46c], 1
jmp 0x1002dffd
and dword [ebp - 0x46c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x430]
mov dword [ebp - 0x5a4], eax
cmp dword [ebp - 0x184], 0x35d7
jl 0x1002e028
mov dword [ebp - 0x3d0], 1
jmp 0x1002e02f
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60c], eax
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0xc0], eax
jl 0x1002e052
mov dword [ebp - 0x29c], 1
jmp 0x1002e059
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x18c], eax
mov esi, dword [ebp - 0x18c]
push 1
lea ecx, [ebp - 0x4ec]
call fcn.1000e49e
mov dword [eax], esi
mov dword [ebp - 0x2a4], 0x820e
mov eax, dword [ebp - 0x2a4]
add eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x118]
jge 0x1002e0a1
mov dword [ebp - 0x2ac], 1
jmp 0x1002e0a8
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 6
jne 0x1002e0c9
mov dword [ebp - 0x2bc], 1
jmp 0x1002e0d0
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x2bc], eax
je 0x1002e0e7
mov dword [ebp - 0x2c4], 1
jmp 0x1002e0ee
and dword [ebp - 0x2c4], 0
cmp dword [ebp - 0x2c4], 0xffffffff
jne 0x1002e103
mov dword [ebp - 0x2cc], 1
jmp 0x1002e10a
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x2cc], eax
jl 0x1002e121
mov dword [ebp - 0x2d4], 1
jmp 0x1002e128
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x2d4], eax
jl 0x1002e142
mov dword [ebp - 0x2dc], 1
jmp 0x1002e149
and dword [ebp - 0x2dc], 0
cmp dword [ebp - 0x2dc], 0x1885
jg 0x1002e161
mov dword [ebp - 0x2e4], 1
jmp 0x1002e168
and dword [ebp - 0x2e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x430]
cmp dword [ebp - 0x2e4], eax
jge 0x1002e189
mov dword [ebp - 0x2ec], 1
jmp 0x1002e190
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x3d4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4ec]
call fcn.1000e47c
xor eax, eax
jmp 0x1002e87c
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x2f4]
mov dword [ebp - 0x3e4], eax
mov dword [ebp - 0x3dc], 0
mov dword [ebp - 0x5ac], 0
mov dword [ebp - 0x66c], 0x29bf390
mov dword [ebp - 0x5b4], 0x90be4438
push 3
lea ecx, [ebp - 0x648]
call fcn.1000e440
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x61c], 0xffffffff
mov dword [ebp - 0x2fc], 0xfff6
mov dword [ebp - 0xc8], 0
jmp 0x1002e230
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jge 0x1002e24c
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x6d0], 3
jmp 0x1002e223
push 1
push 1
push 0x14af
push 0x4e2f
lea eax, [ebp - 0xc8]
push eax
push 0x50eb
push 0x51e1
lea eax, [ebp - 0x648]
push eax
call fcn.10029a09
add esp, 0x20
push 1
lea eax, [ebp - 0x3dc]
push eax
push 0x5ad
push 1
push 0x7935
call fcn.10029df4
add esp, 0x14
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x648]
call fcn.1000e47c
cmp dword [ebp - 0x3e4], 0
jne 0x1002e658
mov dword [ebp - 0x4c], 0x67a876e6
mov dword [ebp - 0x324], 0xea21e1d8
mov dword [ebp - 0x128], 8
mov dword [ebp - 0x19c], 0x7f21
mov dword [ebp - 0x3ec], 0xc74c3eec
cmp dword [ebp - 0x4c], 0
je 0x1002e353
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], eax
jl 0x1002e309
mov dword [ebp - 0x304], 1
jmp 0x1002e310
and dword [ebp - 0x304], 0
cmp dword [ebp - 0x304], 0
jg 0x1002e325
mov dword [ebp - 0x30c], 1
jmp 0x1002e32c
and dword [ebp - 0x30c], 0
cmp dword [ebp - 0x30c], 9
jg 0x1002e341
mov dword [ebp - 0x314], 1
jmp 0x1002e348
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x314], eax
jl 0x1002e365
mov eax, 0x812a
test eax, eax
jne 0x1002e365
and dword [ebp - 0x31c], 0
jmp 0x1002e36f
mov dword [ebp - 0x31c], 1
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x128], eax
jge 0x1002e39e
mov dword [ebp - 0x32c], 1
jmp 0x1002e3a5
and dword [ebp - 0x32c], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x32c]
sub eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], eax
je 0x1002e3c0
cmp dword [ebp - 0x4c], 0
je 0x1002e598
mov dword [ebp - 0x34c], 0xfffffffa
mov dword [ebp - 0x344], 0x963f6d1d
mov dword [ebp - 0x364], 0x3ede5c48
mov dword [ebp - 0x3f4], 1
mov dword [ebp - 0x120], 0
jmp 0x1002e401
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 2
jge 0x1002e41d
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x3b0], 0x783312ef
jmp 0x1002e3f4
cmp dword [ebp - 0x19c], 0
je 0x1002e542
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x34c], eax
jle 0x1002e444
mov dword [ebp - 0x334], 1
jmp 0x1002e44b
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x128], eax
jl 0x1002e46e
mov dword [ebp - 0x33c], 1
jmp 0x1002e475
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0
jne 0x1002e49a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3b0], 0
je 0x1002e4af
cmp dword [ebp - 0x3ec], 0
je 0x1002e4af
mov dword [ebp - 0x354], 1
jmp 0x1002e4b6
and dword [ebp - 0x354], 0
mov eax, 0x18e
sub eax, dword [ebp - 0x34c]
add eax, dword [ebp - 0x354]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x3b0]
je 0x1002e4e2
mov dword [ebp - 0x35c], 1
jmp 0x1002e4e9
and dword [ebp - 0x35c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3b0]
cmp dword [ebp - 0x35c], eax
jge 0x1002e50a
mov dword [ebp - 0x194], 1
jmp 0x1002e511
and dword [ebp - 0x194], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x194]
mov dword [ebp + eax - 0x3b0], ecx
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 0
je 0x1002e542
and dword [ebp - 0x36c], 0
jmp 0x1002e54c
mov dword [ebp - 0x36c], 1
cmp dword [ebp - 0x36c], 0
je 0x1002e561
mov dword [ebp - 0x374], 1
jmp 0x1002e568
and dword [ebp - 0x374], 0
cmp dword [ebp - 0x374], 0xa8d6
jl 0x1002e580
mov dword [ebp - 0x37c], 1
jmp 0x1002e587
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x3f4], eax
jmp 0x1002e651
mov dword [ebp - 0x5bc], 0x1f1c18a0
mov dword [ebp - 0x670], 0x2f53403e
mov dword [ebp - 0x5c4], 0
push 3
lea ecx, [ebp - 0x4f8]
call fcn.1000e440
mov dword [ebp - 4], 0x10
mov dword [ebp - 0xd0], 0
jmp 0x1002e5e3
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 1
jge 0x1002e5ff
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x62c], 0x35d5d909
jmp 0x1002e5d6
push 1
lea eax, [ebp - 0x4f8]
push eax
push 0x1ace
push 1
push 0xfbe
push 0x5b25
lea eax, [ebp - 0xd0]
push eax
push 0x248e
call fcn.10029fd7
add esp, 0x20
lea eax, [ebp - 0x4f8]
push eax
lea eax, [ebp - 0x19c]
push eax
call fcn.1002b7ec
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4f8]
call fcn.1000e47c
xor eax, eax
jmp 0x1002e87c
mov eax, dword [ebp - 0x34]
mov dword [eax + 0x10], 1
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0x5cc], 0xfffffffb
push 1
lea ecx, [ebp - 0x668]
call fcn.1000e440
mov dword [ebp - 4], 0x11
mov dword [ebp - 0xe4], 0
jmp 0x1002e6a3
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 1
jge 0x1002e6c5
push dword [ebp - 0xe4]
lea ecx, [ebp - 0x668]
call fcn.1000e49e
mov dword [eax], 0x3ee32743
jmp 0x1002e696
push 0x6948
push 0x5a2d
push 0x17af
push 0x5582
push 0x263
push 0x73c9
push 0x450d
push 1
push 0x5aac
push 0x6ee2
push 1
push 1
lea eax, [ebp - 0xcc]
push eax
push 0xe56
push 0x1208
push 0x838
call fcn.1002a85d
add esp, 0x40
mov dword [ebp - 0xcc], 0xf
jmp 0x1002e72f
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x2b
jl 0x1002e84c
mov dword [ebp - 0x678], 0xa183
mov dword [ebp - 0x5d4], 0x29aa810d
mov dword [ebp - 0x63c], 0xffffffff
mov dword [ebp - 0x5dc], 0xffffffff
mov dword [ebp - 0x684], 0xfffffffc
mov dword [ebp - 0x5e4], 0x809d0107
mov dword [ebp - 0x554], 0x5732aa61
push 2
lea ecx, [ebp - 0x658]
call fcn.1000e440
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x3fc], 0xfffffff8
mov dword [ebp - 0x104], 0
jmp 0x1002e7b6
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 2
jge 0x1002e7d8
push dword [ebp - 0x104]
lea ecx, [ebp - 0x658]
call fcn.1000e49e
mov dword [eax], 2
jmp 0x1002e7a9
mov byte [ebp - 0x71], 0
push 1
push 0x4e8a
push 0x2325
push 1
lea eax, [ebp - 0x71]
push eax
call fcn.1002af0c
add esp, 0x14
push 1
push 0x18d5
push 0x6d67
push 0x10cb
push 0x6a1c
push 0x4ada
push 0x8c2
push 0x79e0
push 1
push 1
push 0x1336
push 0x4ccf
lea eax, [ebp - 0x3fc]
push eax
call fcn.1002b082
add esp, 0x34
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x658]
call fcn.1000e47c
jmp 0x1002e722
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x668]
call fcn.1000e47c
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x10], 0
je 0x1002e86f
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x384], eax
jmp 0x1002e876
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x384]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret