Function at 0x1002f8d0
Capabilities:
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a583
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x520
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x10031fa7
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x2c8]
movzx eax, byte [eax]
test eax, eax
je 0x10031f81
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x254], eax
push 1
lea ecx, [ebp - 0x3c4]
call fcn.1000e524
and dword [ebp - 4], 0
mov dword [ebp - 0x33c], 0xfffffffa
push 0x4782
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x3c4]
push eax
push 1
push 0x192d
push 0
call fcn.1002dcee
add esp, 0x18
mov dword [ebp - 0x88], 0
jmp 0x1002f9a6
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x1002f9c2
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x270], 0xfffffffe
jmp 0x1002f999
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x270], 0
jmp 0x1002f9f0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x270]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x270], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x270], 0
jl 0x1002fa52
push 0x52d5
push 0x668
push 0
push 0x6a0c
push 0x7626
push 0x70c8
push 0x7019
push 0
push 0x57
push 0x4729
call fcn.1002d4f0
add esp, 0x28
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x270]
lea ecx, [ebp - 0x3c4]
call fcn.1000e5c2
cmp dword [eax], 0
je 0x1002fa50
jmp 0x1002f9d5
jmp 0x1002f9d5
push 0x6ba5
lea eax, [ebp - 0x33c]
push eax
push 1
push 0x466e
push 1
call fcn.1002df99
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c4]
call fcn.1000e5a6
mov eax, dword [0x109e4cfc]
and eax, 1
jne 0x1002fab5
mov eax, dword [0x109e4cfc]
or eax, 1
mov dword [0x109e4cfc], eax
mov dword [ebp - 4], 1
mov ecx, 0x109e4cac
call fcn.100405a3
push 0x1006b045
call fcn.10052a03
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x264], 0
mov dword [ebp - 0xc8], 0
push 3
lea ecx, [ebp - 0x368]
call fcn.1000e524
mov dword [ebp - 4], 2
mov dword [ebp - 0x344], 1
mov dword [ebp - 0x178], 0xf40e13f5
mov dword [ebp - 0x308], 0x75015e0c
mov dword [ebp - 0x200], 8
push 2
lea ecx, [ebp - 0x460]
call fcn.1000e524
mov byte [ebp - 4], 3
mov dword [ebp - 0x20], 0
jmp 0x1002fb26
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1002fb39
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x24], 0xd9ba07e4
jmp 0x1002fb1f
mov dword [ebp - 0x20], 0
jmp 0x1002fb49
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002fb5f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x40c], 0xffffffff
jmp 0x1002fb42
push 0x449b
push 0x7acf
push 1
push 1
lea eax, [ebp - 0x20]
push eax
push 0x1e3
lea eax, [ebp - 0x368]
push eax
push 0x75f5
push 0x53e3
call fcn.1002d0bc
add esp, 0x24
push 1
push 0xce5
lea eax, [ebp - 0x460]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x503e
push 1
call fcn.1002e058
add esp, 0x18
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24], 0
jne 0x1002fca7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24], 0
je 0x1002fbe7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24], 0
je 0x1002fbe7
mov dword [ebp - 0x1a4], 1
jmp 0x1002fbee
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x264], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
cmp dword [ebp - 0x264], eax
jg 0x1002fc18
mov dword [ebp - 0x27c], 1
jmp 0x1002fc1f
and dword [ebp - 0x27c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
sub eax, dword [ebp - 0x27c]
jne 0x1002fc3e
xor eax, eax
jne 0x1002fc3e
and dword [ebp - 0x150], 0
jmp 0x1002fc48
mov dword [ebp - 0x150], 1
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0xc8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
cmp dword [ebp - 0xc8], eax
jne 0x1002fc72
mov dword [ebp - 0x124], 1
jmp 0x1002fc79
and dword [ebp - 0x124], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x124]
mov dword [ebp + eax - 0x40c], ecx
cmp dword [ebp - 0x124], 0
jne 0x1002fca7
cmp dword [ebp - 0xc8], 0
jne 0x1002fca7
and dword [ebp - 0x25c], 0
jmp 0x1002fcb1
mov dword [ebp - 0x25c], 1
push 0
lea ecx, [ebp - 0x368]
call fcn.1000e5c2
mov ecx, dword [ebp - 0x25c]
cmp ecx, dword [eax]
jle 0x1002fcd4
mov dword [ebp - 0x1f0], 1
jmp 0x1002fcdb
and dword [ebp - 0x1f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
cmp dword [ebp - 0x1f0], eax
je 0x1002fcf9
mov dword [ebp - 0x158], 1
jmp 0x1002fd00
and dword [ebp - 0x158], 0
push 0
lea ecx, [ebp - 0x368]
call fcn.1000e5c2
mov ecx, dword [ebp - 0x158]
sub ecx, dword [eax]
cmp ecx, 0x4709
jne 0x1002fd29
mov dword [ebp - 0x240], 1
jmp 0x1002fd30
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x344]
cmp dword [ebp - 0x240], eax
jl 0x1002fd4a
mov dword [ebp - 0x160], 1
jmp 0x1002fd51
and dword [ebp - 0x160], 0
mov eax, dword [ebp - 0x160]
add eax, 0x4c5530c4
mov dword [ebp - 0x178], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
mov dword [ebp - 0x494], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24], 0
je 0x1002fd94
mov eax, 0xfff6
test eax, eax
je 0x1002fd94
mov dword [ebp - 0x350], 1
jmp 0x1002fd9b
and dword [ebp - 0x350], 0
cmp dword [ebp - 0x308], 0xffffffff
jl 0x1002fdb0
mov dword [ebp - 0x1f8], 1
jmp 0x1002fdb7
and dword [ebp - 0x1f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40c]
add eax, dword [ebp - 0x1f8]
cmp eax, 1
jae 0x1002fddb
mov dword [ebp - 0x168], 1
jmp 0x1002fde2
and dword [ebp - 0x168], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x168]
sub ecx, 7
cmp dword [ebp + eax - 0x24], ecx
jle 0x1002fe03
mov dword [ebp - 0x268], 1
jmp 0x1002fe0a
and dword [ebp - 0x268], 0
cmp dword [ebp - 0x268], 0xd816
jg 0x1002fe22
mov dword [ebp - 0x170], 1
jmp 0x1002fe29
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x248], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x248]
mov dword [ebp + eax - 0x40c], ecx
mov eax, dword [ebp - 0x178]
imul eax, dword [ebp - 0x248]
mov dword [ebp - 0xc8], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x460]
call fcn.1000e5a6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x368]
call fcn.1000e5a6
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x3ac]
call fcn.100404ee
mov dword [ebp - 4], 4
mov dword [ebp - 0x118], 0xae355683
mov dword [ebp - 0x118], 0xfffffff3
jmp 0x1002fec0
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 6
jge 0x1002ffcb
mov dword [ebp - 0x70], 0x3111738a
mov dword [ebp - 0x8c], 0x568d526d
mov dword [ebp - 0x120], 0
jmp 0x1002fef7
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jge 0x1002ff13
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x2b8], 0x13244d51
jmp 0x1002feea
push 0x204
lea eax, [ebp - 0x8c]
push eax
push 0x323c
push 1
push 0
push 0x11f5
push 0x5fe8
lea eax, [ebp - 0x70]
push eax
push 0x13cc
push 0xa7c
push 1
call fcn.1003205e
add esp, 0x2c
mov dword [ebp - 0x8c], 0
jmp 0x1002ff63
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xfffffffa
jl 0x1002ffc6
mov dword [ebp - 0x70], 0
jmp 0x1002ff7c
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jg 0x1002ffc4
mov dword [ebp - 0x84], 0xffffffff
mov dword [ebp - 0x84], 0
jmp 0x1002ffa5
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jg 0x1002ffc2
mov eax, dword [ebp - 0x84]
cmp dword [ebp + eax*4 - 0x2b8], 0
je 0x1002ffc0
jmp 0x1002ffc2
jmp 0x1002ff98
jmp 0x1002ff75
jmp 0x1002ff56
jmp 0x1002feb3
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x3ac]
call fcn.10040545
push dword [eax]
lea eax, [ebp - 0x4a4]
push eax
lea ecx, [ebp - 0x3ac]
call fcn.10040559
push dword [eax]
lea eax, [ebp - 0x44c]
push eax
lea ecx, [ebp - 0x3ac]
call fcn.10040545
push dword [eax]
mov edx, 0x1002c5c5
lea ecx, [ebp - 0x4c4]
call fcn.10040c70
add esp, 0xc
push 0x75e3
push 1
push 1
push 0x625e
push 0x2c17
push 0x87e
push 0x23b5
call fcn.1002e6f0
add esp, 0x1c
lea ecx, [ebp - 0x3ac]
call fcn.1002c550
mov dword [ebp - 0x24c], eax
movzx eax, byte [0x109e4bb0]
test eax, eax
je 0x10030626
mov ecx, 0x109e4cac
call fcn.1004065a
movzx eax, al
test eax, eax
jne 0x10030626
mov dword [ebp - 0x1c], 0x9be1d925
push 2
lea ecx, [ebp - 0x400]
call fcn.1000e524
mov byte [ebp - 4], 5
mov dword [ebp - 0x78], 0
jmp 0x1003009c
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x100300b2
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x470], 0x648261f9
jmp 0x10030095
push 0x5f11
push 0x4e32
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push 0x27ae
call fcn.1003e7ea
add esp, 0x18
mov dword [ebp - 0x1c], 2
jmp 0x100300e6
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x1003012d
mov byte [ebp - 0x58], 0
movzx eax, byte [ebp - 0x58]
test eax, eax
je 0x10030106
push 0x5077
push 0
call fcn.1003fd5a
pop ecx
pop ecx
push 1
push 0x3ebb
push 0x19b1
push 1
push 0x1be3
push 0x1129
push 0x61fc
call fcn.1002d33f
add esp, 0x1c
jmp 0x100300df
mov dword [ebp - 0x1c], 0xfffffffc
jmp 0x1003013d
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffea
jge 0x10030256
mov dword [ebp - 0x134], 0x9637
mov dword [ebp - 0x188], 0
mov dword [ebp - 0x330], 0x9ba87a5
cmp dword [ebp - 0x1c], 0
jne 0x10030226
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x1c], eax
jg 0x10030186
mov dword [ebp - 0x180], 1
jmp 0x1003018d
and dword [ebp - 0x180], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x180]
inc ecx
cmp dword [ebp + eax - 0x470], ecx
jge 0x100301af
mov dword [ebp - 0x208], 1
jmp 0x100301b6
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x188], eax
jle 0x100301dc
mov dword [ebp - 0x284], 1
jmp 0x100301e3
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x284], eax
jle 0x100301fd
mov dword [ebp - 0x2d4], 1
jmp 0x10030204
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x454], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x470], 0
jne 0x10030226
and dword [ebp - 0x13c], 0
jmp 0x10030230
mov dword [ebp - 0x13c], 1
push 0
lea ecx, [ebp - 0x400]
call fcn.1000e5c2
mov ecx, dword [ebp - 0x13c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x330], eax
jmp 0x10030136
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x400]
call fcn.1000e5a6
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x1a8]
push eax
mov ecx, 0x109e4cac
call fcn.10040663
push 1
lea ecx, [ebp - 0x380]
call fcn.1000e524
mov byte [ebp - 4], 6
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x2c0], 0xf17e2f9d
mov dword [ebp - 0x2b0], 0xfffffff8
push 4
lea ecx, [ebp - 0x38c]
call fcn.1000e524
mov byte [ebp - 4], 7
mov dword [ebp - 0x3c], 0
jmp 0x100302ca
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x100302e6
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x380]
call fcn.1000e5c2
mov dword [eax], 0xfffffff8
jmp 0x100302c3
mov dword [ebp - 0x3c], 0
jmp 0x100302f6
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 4
jge 0x10030312
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x38c]
call fcn.1000e5c2
mov dword [eax], 0x637c1d6b
jmp 0x100302ef
mov dword [ebp - 0x28], 0
jmp 0x10030322
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jg 0x10030573
push 1
lea ecx, [ebp - 0x3e8]
call fcn.1000e524
mov byte [ebp - 4], 8
mov dword [ebp - 0x41c], 0x362daab7
mov dword [ebp - 0x418], 0x362daab7
mov dword [ebp - 0x414], 0x362daab7
mov dword [ebp - 0x410], 0x362daab7
mov dword [ebp - 0x4ac], 0x84868fda
mov dword [ebp - 0x464], 0x2ad015b0
mov dword [ebp - 0x4b8], 0xc3f90802
mov dword [ebp - 0x35c], 5
push 0x4773
lea eax, [ebp - 0x3e8]
push eax
push 0xad2
push 0
lea eax, [ebp - 0x68]
push eax
push 0x94
call fcn.1003edf2
add esp, 0x18
mov dword [ebp - 0x68], 0
jmp 0x100303c1
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x100303d7
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x394], 0x6a83cd0
jmp 0x100303ba
push 0
lea ecx, [ebp - 0x3e8]
call fcn.1000e5c2
cmp dword [eax], 0
jne 0x10030410
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x394]
dec eax
mov dword [ebp - 0x190], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x190]
mov dword [ebp + eax - 0x394], ecx
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x41c]
cmp dword [ebp - 0x2c0], eax
jne 0x10030431
mov dword [ebp - 0x210], 1
jmp 0x10030438
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x35c]
cmp dword [ebp - 0x210], eax
jl 0x10030452
mov dword [ebp - 0x198], 1
jmp 0x10030459
and dword [ebp - 0x198], 0
push 3
lea ecx, [ebp - 0x38c]
call fcn.1000e5c2
mov ecx, dword [ebp - 0x198]
cmp ecx, dword [eax]
jl 0x1003047c
mov dword [ebp - 0x250], 1
jmp 0x10030483
and dword [ebp - 0x250], 0
push 0
lea ecx, [ebp - 0x38c]
call fcn.1000e5c2
mov eax, dword [eax]
cmp eax, dword [ebp - 0x250]
je 0x100304a6
mov dword [ebp - 0x1a0], 1
jmp 0x100304ad
and dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x1a0], eax
jne 0x100304c4
mov dword [ebp - 0x218], 1
jmp 0x100304cb
and dword [ebp - 0x218], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x380]
call fcn.1000e5c2
mov esi, eax
push 0
lea ecx, [ebp - 0x380]
call fcn.1000e5c2
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x218]
jg 0x10030522
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x10030522
mov byte [ebp - 0x57], 0
movzx eax, byte [ebp - 0x57]
test eax, eax
je 0x10030520
push 0x4e00
push 0x6f36
push 0
push 0x33d2
call fcn.10032028
add esp, 0x10
jmp 0x1003055f
push 1
push 0x7120
push 0xfff
push 1
call fcn.1002ea61
add esp, 0x10
push 1
lea eax, [ebp - 0x2b0]
push eax
push 0x6ee1
push 0
push 0x10fb
push 0x326a
push 0x5d3b
call fcn.1002f8d0
add esp, 0x1c
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x3e8]
call fcn.1000e5a6
jmp 0x1003031b
mov dword [ebp - 0x28], 0
jmp 0x10030583
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffed
je 0x100305ba
push 1
push 0x470
push 0xc82
push 0x1f49
push 0x1906
push 1
push 0x2018
push 0x726c
push 0x714c
call fcn.1002ec54
add esp, 0x24
jmp 0x1003057c
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x38c]
call fcn.1000e5a6
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x380]
call fcn.1000e5a6
lea eax, [ebp - 0x474]
push eax
mov ecx, 0x109e4cac
call fcn.1000eb51
push eax
lea ecx, [ebp - 0x1a8]
call fcn.10040590
movzx eax, al
test eax, eax
je 0x10030626
lea ecx, [ebp - 0x1a8]
call fcn.10040678
mov ecx, dword [ebp - 0x254]
mov eax, dword [eax + 4]
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3ac]
call fcn.1004053b
jmp 0x10031fe3
mov dword [ebp - 0x64], 3
push 1
lea ecx, [ebp - 0x2a0]
call fcn.1000e524
mov byte [ebp - 4], 9
mov dword [ebp - 0x1b0], 0x11d0
mov dword [ebp - 0x338], 0xcd1ac8c6
push 0x2e25
lea eax, [ebp - 0x4b4]
push eax
push 0
lea eax, [ebp - 0x2a0]
push eax
push 0x3319
push 0x4ffa
push 0x7495
push 1
push 0x3b32
push 0x5f5f
call fcn.1002d4f0
add esp, 0x28
lea eax, [ebp - 0x1b0]
push eax
push 1
push 1
push 0x314c
push 0x4a68
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x2a0]
push eax
call fcn.1002ee06
add esp, 0x1c
mov dword [ebp - 0x64], 0x19
jmp 0x100306c2
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x1a
jg 0x10030745
mov dword [ebp - 0x274], 0xbdebf889
mov dword [ebp - 0x2d0], 0x90aec51
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x484], eax
push 0
lea ecx, [ebp - 0x2a0]
call fcn.1000e5c2
push 0
lea ecx, [ebp - 0x2a0]
call fcn.1000e5c2
mov dword [eax], 1
push 0
lea eax, [ebp - 0x64]
push eax
push 0x519d
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x338]
push eax
lea eax, [ebp - 0x2a0]
push eax
push 1
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x1b0]
push eax
call fcn.1002ddfa
add esp, 0x24
jmp 0x100306bb
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2a0]
call fcn.1000e5a6
and dword [ebp - 0x5c], 0
mov dword [ebp - 0x114], 0xa61928c1
push 0x7b16
push 0x69ab
push 0
push 0x7ade
push 0x2838
push 0
call fcn.1003ea24
add esp, 0x18
mov dword [ebp - 0x114], 0
jmp 0x1003079b
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x10
jg 0x100307fd
mov dword [ebp - 0xd0], 0xfffffffc
mov dword [ebp - 0xd0], 0x14
jmp 0x100307c7
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0x16
jg 0x100307fb
mov byte [ebp - 0x4d], 0
movzx eax, byte [ebp - 0x4d]
test eax, eax
je 0x100307f9
push 1
push 0x2e47
push 0x7085
push 1
push 0x1547
push 1
call fcn.1002d5eb
add esp, 0x18
jmp 0x100307ba
jmp 0x1003078e
lea eax, [ebp - 0x3ac]
push eax
call fcn.1002ce24
pop ecx
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jne 0x10031ca1
push 2
lea ecx, [ebp - 0x480]
call fcn.1000e524
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xf0], 0x57976326
push 0x6850
lea eax, [ebp - 0x4c0]
push eax
push 0
lea eax, [ebp - 0x480]
push eax
call fcn.10032235
add esp, 0x10
mov dword [ebp - 0xf0], 1
jmp 0x10030868
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jl 0x1003088c
mov byte [ebp - 0x55], 0
push 1
push 0x1c5
push 1
lea eax, [ebp - 0x55]
push eax
call fcn.1002efce
add esp, 0x10
jmp 0x1003085b
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x480]
call fcn.1000e5a6
cmp dword [0x109e4ba8], 0
jne 0x10031b2a
mov dword [ebp - 0x1b8], 0
mov dword [ebp - 0xd8], 0
push 3
lea ecx, [ebp - 0x374]
call fcn.1000e524
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x304], 1
mov dword [ebp - 0x280], 0xf40e13f5
mov dword [ebp - 0x30c], 0x75015e0c
mov dword [ebp - 0x1e8], 8
push 2
lea ecx, [ebp - 0x490]
call fcn.1000e524
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x14], 0
jmp 0x10030916
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x10030929
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2c], 0xd9ba07e4
jmp 0x1003090f
mov dword [ebp - 0x14], 0
jmp 0x10030939
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1003094f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3d0], 0xffffffff
jmp 0x10030932
mov dword [ebp - 0x14], 0
jmp 0x1003095f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1003097b
push dword [ebp - 0x14]
lea ecx, [ebp - 0x374]
call fcn.1000e5c2
mov dword [eax], 1
jmp 0x10030958
lea eax, [ebp - 0x14]
push eax
push 1
push 0xa02
push 0xe55
push 0xa57
push 0x7689
push 0x5f0f
push 0x3a65
push 0
push 0x17ef
lea eax, [ebp - 0x490]
push eax
call fcn.1003fe09
add esp, 0x2c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c], 0
jne 0x10030aac
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c], 0
je 0x100309ec
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c], 0
je 0x100309ec
mov dword [ebp - 0x220], 1
jmp 0x100309f3
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x1b8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x1b8], eax
jg 0x10030a1d
mov dword [ebp - 0x258], 1
jmp 0x10030a24
and dword [ebp - 0x258], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
sub eax, dword [ebp - 0x258]
jne 0x10030a43
xor eax, eax
jne 0x10030a43
and dword [ebp - 0x1c0], 0
jmp 0x10030a4d
mov dword [ebp - 0x1c0], 1
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0xd8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0xd8], eax
jne 0x10030a77
mov dword [ebp - 0x144], 1
jmp 0x10030a7e
and dword [ebp - 0x144], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x144]
mov dword [ebp + eax - 0x3d0], ecx
cmp dword [ebp - 0x144], 0
jne 0x10030aac
cmp dword [ebp - 0xd8], 0
jne 0x10030aac
and dword [ebp - 0x228], 0
jmp 0x10030ab6
mov dword [ebp - 0x228], 1
push 0
lea ecx, [ebp - 0x374]
call fcn.1000e5c2
mov ecx, dword [ebp - 0x228]
cmp ecx, dword [eax]
jle 0x10030ad9
mov dword [ebp - 0x1c8], 1
jmp 0x10030ae0
and dword [ebp - 0x1c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x1c8], eax
je 0x10030afe
mov dword [ebp - 0x278], 1
jmp 0x10030b05
and dword [ebp - 0x278], 0
push 0
lea ecx, [ebp - 0x374]
call fcn.1000e5c2
mov ecx, dword [ebp - 0x278]
sub ecx, dword [eax]
cmp ecx, 0x4709
jne 0x10030b2e
mov dword [ebp - 0x1d0], 1
jmp 0x10030b35
and dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x304]
cmp dword [ebp - 0x1d0], eax
jl 0x10030b4f
mov dword [ebp - 0x230], 1
jmp 0x10030b56
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x230]
add eax, 0x4c5530c4
mov dword [ebp - 0x280], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
mov dword [ebp - 0x43c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c], 0
je 0x10030b99
mov eax, 0xfff6
test eax, eax
je 0x10030b99
mov dword [ebp - 0x2d8], 1
jmp 0x10030ba0
and dword [ebp - 0x2d8], 0
cmp dword [ebp - 0x30c], 0xffffffff
jl 0x10030bb5
mov dword [ebp - 0x1d8], 1
jmp 0x10030bbc
and dword [ebp - 0x1d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3d0]
add eax, dword [ebp - 0x1d8]
cmp eax, 1
jae 0x10030be0
mov dword [ebp - 0x260], 1
jmp 0x10030be7
and dword [ebp - 0x260], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x260]
sub ecx, 7
cmp dword [ebp + eax - 0x2c], ecx
jle 0x10030c08
mov dword [ebp - 0x1e0], 1
jmp 0x10030c0f
and dword [ebp - 0x1e0], 0
cmp dword [ebp - 0x1e0], 0xd816
jg 0x10030c27
mov dword [ebp - 0x238], 1
jmp 0x10030c2e
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x14c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x14c]
mov dword [ebp + eax - 0x3d0], ecx
mov eax, dword [ebp - 0x280]
imul eax, dword [ebp - 0x14c]
mov dword [ebp - 0xd8], eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x490]
call fcn.1000e5a6
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x374]
call fcn.1000e5a6
mov dword [ebp - 0x1bc], 0x5a77
mov dword [ebp - 0x334], 0x10008970
cmp dword [ebp - 0x1bc], 0x5d99
jle 0x10030dd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [ebp - 0xf8], 0
jmp 0x10030cca
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0x5beb
jge 0x10030dbe
and dword [ebp - 0xe0], 0
jmp 0x10030cf0
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0x2856
jge 0x10030db9
and dword [ebp - 0x100], 0
jmp 0x10030d16
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0x5393
jge 0x10030db4
and dword [ebp - 0xe8], 0
jmp 0x10030d3c
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0x5c52
jge 0x10030daf
mov eax, dword [ebp - 0xf8]
cdq
idiv dword [ebp - 0xe0]
imul edx, dword [ebp - 0x100]
sub edx, dword [ebp - 0xe8]
mov eax, edx
cdq
mov dword [ebp - 0x2f0], eax
mov dword [ebp - 0x2ec], edx
push dword [ebp - 0x2ec]
push dword [ebp - 0x2f0]
lea ecx, [ebp - 0x500]
call fcn.10009eda
pop ecx
pop ecx
mov dword [ebp - 0x2e0], eax
mov ecx, dword [ebp - 0x2e0]
call fcn.1000e3c5
push eax
call fcn.10052a2d
pop ecx
lea ecx, [ebp - 0x500]
call fcn.1000e3bb
jmp 0x10030d2f
jmp 0x10030d09
jmp 0x10030ce3
jmp 0x10030cbd
push 0
push 0x160c
push 0
push 0x1bfc
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
mov dword [ebp - 0x154], 0x5c8b
mov dword [ebp - 0x2e8], 0x100089c8
cmp dword [ebp - 0x154], 0x600d
jle 0x10030f1b
and dword [ebp - 0x108], 0
jmp 0x10030e0c
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0x6dcc
jge 0x10030eff
and dword [ebp - 0x110], 0
jmp 0x10030e32
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x160c
jge 0x10030efa
and dword [ebp - 0xf4], 0
jmp 0x10030e58
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0x78b3
jge 0x10030ef5
and dword [ebp - 0x10c], 0
jmp 0x10030e7e
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x5939
jge 0x10030ef0
mov eax, dword [ebp - 0x108]
xor eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0xf4]
imul ecx, dword [ebp - 0x10c]
xor eax, ecx
cdq
mov dword [ebp - 0x2fc], eax
mov dword [ebp - 0x2f8], edx
push dword [ebp - 0x2f8]
push dword [ebp - 0x2fc]
lea ecx, [ebp - 0x530]
call fcn.10009eda
pop ecx
pop ecx
mov dword [ebp - 0x314], eax
mov ecx, dword [ebp - 0x314]
call fcn.1000e3c5
push eax
call fcn.10052a2d
pop ecx
lea ecx, [ebp - 0x530]
call fcn.1000e3bb
jmp 0x10030e71
jmp 0x10030e4b
jmp 0x10030e25
jmp 0x10030dff
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x154], 0x5b08
jge 0x10030f37
push dword [ebp - 0x2e8]
call fcn.10052a2d
pop ecx
jmp 0x10030f53
mov dword [ebp - 4], 4
jmp 0x10030f63
mov dword [ebp - 0x17c], 4
mov dword [ebp - 0x138], 0x2585fafe
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x324], 0xce5f
mov dword [ebp - 0x300], 0x6c84
push 4
lea ecx, [ebp - 0x3f4]
call fcn.1000e524
mov byte [ebp - 4], 0xf
push 3
lea ecx, [ebp - 0x3dc]
call fcn.1000e524
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x34], 0
jmp 0x10030fc4
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x10030fd7
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x48], 1
jmp 0x10030fbd
push 0x2597
push 1
push 1
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x3f4]
push eax
call fcn.1002f0a8
add esp, 0x14
mov dword [ebp - 0x34], 0
jmp 0x10031003
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x1003101f
push dword [ebp - 0x34]
lea ecx, [ebp - 0x3dc]
call fcn.1000e5c2
mov dword [eax], 0x95534fd3
jmp 0x10030ffc
push 4
pop eax
imul eax, eax, 0
push 9
pop ecx
sub ecx, dword [ebp + eax - 0x48]
cmp ecx, 0x4ddb
jg 0x10031040
mov dword [ebp - 0x15c], 1
jmp 0x10031047
and dword [ebp - 0x15c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x15c], eax
jge 0x10031065
mov dword [ebp - 0x31c], 1
jmp 0x1003106c
and dword [ebp - 0x31c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48]
mov dword [ebp - 0x4c8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48]
mov dword [ebp - 0x49c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
add eax, 0x628217c7
cmp eax, 1
jg 0x100310ac
mov dword [ebp - 0x164], 1
jmp 0x100310b3
and dword [ebp - 0x164], 0
cmp dword [ebp - 0x164], 0xabf8b243
je 0x100310cb
mov dword [ebp - 0x16c], 1
jmp 0x100310d2
and dword [ebp - 0x16c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48]
add eax, dword [ebp - 0x16c]
cmp eax, 0xfafb
jne 0x100310f5
mov dword [ebp - 0x174], 1
jmp 0x100310fc
and dword [ebp - 0x174], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x174]
sub ecx, dword [ebp + eax - 0x48]
sub ecx, dword [ebp - 0x17c]
mov dword [ebp - 0x138], ecx
imul eax, dword [ebp - 0x138], 0xda37
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x48]
jge 0x1003113a
mov dword [ebp - 0x2f4], 1
jmp 0x10031141
and dword [ebp - 0x2f4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48]
mov dword [ebp - 0x4cc], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x440], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x48], 0xc5c6a81d
jb 0x10031179
mov dword [ebp - 0x184], 1
jmp 0x10031180
and dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x184]
add eax, 0x61970388
je 0x100311a2
cmp dword [ebp - 0x138], 0
je 0x100311a2
mov dword [ebp - 0x18c], 1
jmp 0x100311a9
and dword [ebp - 0x18c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48]
add eax, dword [ebp - 0x18c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x48]
je 0x100311d1
mov dword [ebp - 0x194], 1
jmp 0x100311d8
and dword [ebp - 0x194], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x194], eax
jne 0x100311ef
mov dword [ebp - 0x19c], 1
jmp 0x100311f6
and dword [ebp - 0x19c], 0
cmp dword [ebp - 0x19c], 0xffff
ja 0x10031224
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x48], 0
je 0x10031224
cmp dword [ebp - 0x324], 0
je 0x10031224
mov dword [ebp - 0x148], 1
jmp 0x1003122b
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x148]
sub eax, dword [ebp - 0x300]
mov dword [ebp - 0x1ac], eax
push 1
lea ecx, [ebp - 0x3f4]
call fcn.1000e5c2
mov ecx, dword [ebp - 0x1ac]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x3dc]
call fcn.1000e5c2
mov ecx, dword [ebp - 0x1ac]
mov dword [eax], ecx
mov dword [ebp - 0x4c], 0
jmp 0x10031277
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jg 0x100312ca
mov dword [ebp - 0x32c], 0x277ed469
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x48], 0
je 0x100312a2
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x48], 0
je 0x100312a0
jmp 0x100312ca
jmp 0x100312c8
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0x48]
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x48], ecx
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x32c], eax
jmp 0x10031270
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x3dc]
call fcn.1000e5a6
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x3f4]
call fcn.1000e5a6
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x1bc], 0x599d
jge 0x10031304
push dword [ebp - 0x334]
call fcn.10052a2d
pop ecx
jmp 0x10031320
mov dword [ebp - 4], 4
jmp 0x10031330
mov byte [ebp - 0xc4], 0
mov byte [ebp - 0xc3], 0x6f
mov byte [ebp - 0xc2], 4
mov byte [ebp - 0xc1], 0x4b
mov byte [ebp - 0xc0], 0xe4
mov byte [ebp - 0xbf], 0x8d
mov byte [ebp - 0xbe], 0xfd
mov byte [ebp - 0xbd], 4
mov byte [ebp - 0xbc], 0x2e
mov byte [ebp - 0xbb], 8
mov byte [ebp - 0xba], 0x4b
mov byte [ebp - 0xb9], 0xa
mov byte [ebp - 0xb8], 0x42
mov byte [ebp - 0xb7], 0xb
mov byte [ebp - 0xb6], 0
mov byte [ebp - 0xb5], 5
mov byte [ebp - 0xb4], 0
mov byte [ebp - 0xb3], 9
mov byte [ebp - 0xb2], 8
mov byte [ebp - 0xb1], 2
mov byte [ebp - 0xb0], 0x16
mov byte [ebp - 0xaf], 7
mov byte [ebp - 0xae], 0x40
mov byte [ebp - 0xad], 3
mov byte [ebp - 0xac], 0x5c
mov byte [ebp - 0xab], 6
mov byte [ebp - 0xaa], 0x5d
mov byte [ebp - 0xa9], 1
mov byte [ebp - 0xa8], 0x56
push 2
lea ecx, [ebp - 0x3b8]
call fcn.1000e524
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x80], 0xd4f2887c
mov dword [ebp - 0x358], 0x2285faaf
mov dword [ebp - 0x340], 0xd9ee1c97
mov dword [ebp - 0x310], 0x3d37a5b7
push 0x16cd
push 0x6e79
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x3b8]
push eax
push 0
push 0x189e
call fcn.1003ead2
add esp, 0x18
push 0x5b9b
lea eax, [ebp - 0x358]
push eax
push 0x60c7
lea eax, [ebp - 0x310]
push eax
push 1
push 0x3ff9
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x3b8]
push eax
push 0x62b2
push 0x8b0
push 0x6ae0
push 0x5369
push 1
lea eax, [ebp - 0x80]
push eax
push 1
call fcn.1002d765
add esp, 0x3c
mov dword [ebp - 0x80], 0
jmp 0x100314b9
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x1d
jle 0x100314e4
mov byte [ebp - 0x4e], 0
lea eax, [ebp - 0x4e]
push eax
push 0x4de1
push 1
push 0x7a37
push 0x718c
push 0
call fcn.1003ea24
add esp, 0x18
jmp 0x100314b2
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x3b8]
call fcn.1000e5a6
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0xc4]
or eax, 0x24
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0xc4]
and ecx, 0x24
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0xc4]
mov word [ebp + ecx*2 - 0x438], ax
mov dword [ebp - 0x18], 2
and dword [ebp - 0xfc], 0
jmp 0x10031545
mov eax, dword [ebp - 0x18]
inc eax
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1d
jae 0x10031617
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0xc4]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x18], eax
jne 0x1003158f
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0xc4]
inc eax
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0xc4]
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x18], eax
jmp 0x1003153d
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0xc3]
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0xfc]
movzx ecx, byte [ebp + ecx - 0xc6]
movzx ecx, word [ebp + ecx*2 - 0x438]
or eax, ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0xc3]
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0xfc]
movzx edx, byte [ebp + edx - 0xc6]
movzx edx, word [ebp + edx*2 - 0x438]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0xc4]
mov word [ebp + ecx*2 - 0x438], ax
push 0xa4f
push 1
push 0x261c
push 0x7c8d
push 1
lea eax, [ebp - 0xfc]
push eax
call fcn.1002f182
add esp, 0x18
jmp 0x1003153d
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0x438], cx
mov dword [ebp - 0x40], 0xffff
mov dword [ebp - 0x140], 0xd53a38d0
mov dword [ebp - 0x318], 0xb63e91c
push 0x2ea2
lea eax, [ebp - 0x40]
push eax
push 1
push 1
call fcn.1002f2f8
add esp, 0x10
mov dword [ebp - 0x40], 0xffffffe5
jmp 0x10031667
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 5
jg 0x1003188e
mov dword [ebp - 0x11c], 0
jmp 0x1003168a
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 1
jge 0x100316a3
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x60], 0xffffffff
jmp 0x1003167d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x60], 0
jmp 0x100316c8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x60], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x60], 0xffffffe7
jg 0x10031862
mov dword [ebp - 0x104], 0x566a9272
mov dword [ebp - 0x130], 0
cmp dword [ebp - 0x104], 0x82ba
jl 0x10031705
mov dword [ebp - 0x1c4], 1
jmp 0x1003170c
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x104]
add eax, 0xfecafe8
cmp eax, dword [ebp - 0x1c4]
jle 0x1003172b
mov dword [ebp - 0x1ec], 1
jmp 0x10031732
and dword [ebp - 0x1ec], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x60], 0
je 0x10031754
cmp dword [ebp - 0x104], 0
je 0x10031754
mov dword [ebp - 0x1cc], 1
jmp 0x1003175b
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x1cc]
sub eax, dword [ebp - 0x140]
cmp eax, dword [ebp - 0x104]
jle 0x1003177b
mov dword [ebp - 0x1d4], 1
jmp 0x10031782
and dword [ebp - 0x1d4], 0
mov eax, dword [ebp - 0x1d4]
sub eax, dword [ebp - 0x40]
cmp eax, 0x223
jle 0x1003179e
mov dword [ebp - 0x1dc], 1
jmp 0x100317a5
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0x77c422d5
jle 0x100317cc
cmp dword [ebp - 0x40], 0
jne 0x100317cc
and dword [ebp - 0x1e4], 0
jmp 0x100317d6
mov dword [ebp - 0x1e4], 1
imul eax, dword [ebp - 0x1e4], 5
cmp eax, dword [ebp - 0x40]
jg 0x100317e9
cmp dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x1ec]
sub eax, dword [ebp - 0x130]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x60]
jl 0x1003180d
mov dword [ebp - 0x1f4], 1
jmp 0x10031814
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x1f4], eax
je 0x1003182b
mov dword [ebp - 0x1fc], 1
jmp 0x10031832
and dword [ebp - 0x1fc], 0
cmp dword [ebp - 0x1fc], 0xcb31
jl 0x1003184a
mov dword [ebp - 0x204], 1
jmp 0x10031851
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x318], eax
jmp 0x100316b3
push 0x5d19
push 0x2f7d
push 0x5896
lea eax, [ebp - 0x140]
push eax
push 1
push 0x57df
push 1
call fcn.1002f384
add esp, 0x1c
jmp 0x10031660
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x518]
call fcn.10040516
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0x320], eax
mov byte [ebp - 4], 0x14
push dword [ebp - 0x320]
call fcn.1002ce24
pop ecx
mov dword [ebp - 0x20c], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x518]
call fcn.1004053b
and dword [ebp - 0xec], 0
jmp 0x100318ed
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0xd
jae 0x10031908
xor eax, eax
mov ecx, dword [ebp - 0xec]
mov word [ebp + ecx*2 - 0x438], ax
jmp 0x100318e0
cmp dword [ebp - 0x20c], 0
je 0x10031b2a
mov byte [ebp - 0xa4], 7
mov byte [ebp - 0xa3], 0xef
mov byte [ebp - 0xa2], 6
mov byte [ebp - 0xa1], 0x10
mov byte [ebp - 0xa0], 0
mov byte [ebp - 0x9f], 0x2e
mov byte [ebp - 0x9e], 9
mov byte [ebp - 0x9d], 0x3e
mov byte [ebp - 0x9c], 1
mov byte [ebp - 0x9b], 0x1d
mov byte [ebp - 0x9a], 4
mov byte [ebp - 0x99], 0x23
mov byte [ebp - 0x98], 2
mov byte [ebp - 0x97], 0x2d
mov byte [ebp - 0x96], 5
mov byte [ebp - 0x95], 8
mov byte [ebp - 0x94], 8
mov byte [ebp - 0x93], 8
mov byte [ebp - 0x92], 3
mov byte [ebp - 0x91], 5
mov byte [ebp - 0x90], 0xa
mov byte [ebp - 0x8f], 0x1d
mov byte [ebp - 0x8e], 0xb
mov byte [ebp - 0x8d], 0x2e
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0xa4]
or eax, 0x9d
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0xa4]
and ecx, 0x9d
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0xa4]
mov byte [ebp + ecx - 0x294], al
mov dword [ebp - 0x30], 2
and dword [ebp - 0x128], 0
jmp 0x10031a13
mov eax, dword [ebp - 0x30]
inc eax
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x18
jae 0x10031aaa
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0xa3]
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x128]
movzx ecx, byte [ebp + ecx - 0xa6]
movsx ecx, byte [ebp + ecx - 0x294]
add eax, ecx
mov ecx, dword [ebp - 0x30]
movzx ecx, byte [ebp + ecx - 0xa3]
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x128]
movzx edx, byte [ebp + edx - 0xa6]
movsx edx, byte [ebp + edx - 0x294]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x30]
movzx ecx, byte [ebp + ecx - 0xa3]
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x128]
movzx edx, byte [ebp + edx - 0xa6]
movsx edx, byte [ebp + edx - 0x294]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x30]
movzx ecx, byte [ebp + ecx - 0xa4]
mov byte [ebp + ecx - 0x294], al
jmp 0x10031a0b
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x294], 0
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x4e8]
call fcn.1000e407
mov byte [ebp - 4], 0x15
and dword [ebp - 0xcc], 0
jmp 0x10031ae4
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xd
jae 0x10031afd
mov eax, dword [ebp - 0xcc]
mov byte [ebp + eax - 0x294], 0
jmp 0x10031ad7
push 0
push 0
lea eax, [ebp - 0x4e8]
push eax
push dword [ebp - 0x20c]
call fcn.1003681a
add esp, 0x10
mov dword [0x109e4ba8], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x4e8]
call fcn.1000e472
push 3
lea ecx, [ebp - 0x2ac]
call fcn.1000e524
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x2ac]
push eax
push 0
lea eax, [ebp - 0x450]
push eax
push 0x179
call fcn.1003e8f7
add esp, 0x10
push 1
push 0x5c53
push 0x6796
push 1
push 0x6ea4
call fcn.1002f48e
add esp, 0x14
push 2
lea ecx, [ebp - 0x2ac]
call fcn.1000e5c2
and dword [eax], 0
jmp 0x10031ba9
push 2
lea ecx, [ebp - 0x2ac]
call fcn.1000e5c2
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x214]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x2ac]
call fcn.1000e5c2
cmp dword [eax], 0xc
jge 0x10031c74
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0xd4], 0
jmp 0x10031bdf
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 1
jge 0x10031bfb
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x498], 2
jmp 0x10031bd2
lea eax, [ebp - 0x2ac]
push eax
push 1
push 1
push 0x33cd
push 0x22f0
lea eax, [ebp - 0x6c]
push eax
call fcn.1002f5c7
add esp, 0x18
mov dword [ebp - 0x6c], 0xffffffe3
jmp 0x10031c2c
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xfffffff0
jge 0x10031c6f
mov byte [ebp - 0x56], 0
movzx eax, byte [ebp - 0x56]
test eax, eax
je 0x10031c6d
push 1
push 0x7e75
push 0x74ae
push 0x3394
push 0x12e4
push 0x2b9e
push 1
push 0x25a0
push 0x29fa
call fcn.1002ddfa
add esp, 0x24
jmp 0x10031c25
jmp 0x10031b85
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2ac]
call fcn.1000e5a6
cmp dword [0x109e4ba8], 0
je 0x10031ca1
mov ecx, dword [ebp - 0x21c]
call fcn.10040577
push eax
call dword [0x109e4ba8]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x74], 0xfffffff9
mov dword [ebp - 0x348], 1
mov dword [ebp - 0x244], 0xfffffff8
mov dword [ebp - 0x74], 0
jmp 0x10031ccc
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xfffffff3
je 0x10031edc
mov dword [ebp - 0x38], 0
jmp 0x10031ce6
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x10031cf9
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x7c], 0xc90a35f3
jmp 0x10031cdf
mov dword [ebp - 0x38], 0
jmp 0x10031d09
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x10031d1f
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xe4], 0
jmp 0x10031d02
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x7c], 0
jmp 0x10031d44
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x7c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7c], 0xffffffee
jl 0x10031ed7
mov dword [ebp - 0x54], 0xfffffffb
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0x234], 9
mov dword [ebp - 0x54], 0
jmp 0x10031d80
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xffffffea
je 0x10031e2d
mov dword [ebp - 0x12c], 0xc590
lea eax, [ebp - 0x74]
push eax
push 0x46e8
push 0x7b
push 1
push 0
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0xdc]
push eax
call fcn.1002f205
add esp, 0x1c
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x4a8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x54]
cmp dword [ebp + eax - 0x7c], ecx
jge 0x10031dec
mov dword [ebp - 0x224], 1
jmp 0x10031df3
and dword [ebp - 0x224], 0
cmp dword [ebp - 0x12c], 0xffffffff
je 0x10031e08
mov dword [ebp - 0x22c], 1
jmp 0x10031e0f
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x224]
sub eax, dword [ebp - 0x22c]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xe4], eax
jmp 0x10031d79
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
cmp dword [ebp - 0x54], eax
jl 0x10031e4b
mov dword [ebp - 0x328], 1
jmp 0x10031e52
and dword [ebp - 0x328], 0
cmp dword [ebp - 0xdc], 0
je 0x10031e70
cmp dword [ebp - 0xdc], 0
je 0x10031e70
mov dword [ebp - 0x23c], 1
jmp 0x10031e77
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x4b0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x4bc], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xe4], 0xfffffffd
mov dword [ebp - 0x54], 0xfffffffd
jmp 0x10031d2f
jmp 0x10031cc5
cmp dword [ebp - 0x5c], 0
je 0x10031f2f
movzx eax, byte [0x109e4bb0]
test eax, eax
je 0x10031efe
mov ecx, 0x109e4cac
call fcn.1004065a
movzx eax, al
test eax, eax
jne 0x10031f2f
lea eax, [ebp - 0x24c]
push eax
mov ecx, 0x109e4cac
call fcn.100405f7
mov ecx, dword [ebp - 0x5c]
mov dword [eax], ecx
push 0
push 0x109e4bb0
push 0x6d6a
push 1
push 0x7572
call fcn.1002f48e
add esp, 0x14
push 1
push 0x43c6
push 0x5a5f
push 0x14a2
push 1
push 0x4fbf
push 0x4f42
call fcn.1002f6e8
add esp, 0x1c
mov eax, dword [ebp - 0x254]
mov ecx, dword [ebp - 0x5c]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3ac]
call fcn.1004053b
jmp 0x10031fe3
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2bc]
mov dword [eax], 0x236bbbd2
jmp 0x10031fe3
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2cc], eax
push dword [ebp - 0x2c4]
push 0x4736
push 0x3de3
push 0x6b36
push dword [ebp - 0x2cc]
push 0
push 0x4fc0
call fcn.10040004
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret