Function at 0x10019698
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005fab7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xe58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x1001ff67
lea eax, [ebp + 0x14]
mov dword [ebp - 0x980], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x8ac], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x89c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp - 0x980]
movzx eax, byte [eax]
test eax, eax
je 0x1001970a
push 0x1ec3
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x1001ff65
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0x874], eax
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp - 0x8ac]
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x11c], 0x5c68ec0a
mov dword [ebp - 0x430], 0x1780eec2
mov dword [ebp - 0x978], 0xaa50887c
mov dword [ebp - 0x1bc], 0
jmp 0x10019765
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 2
jge 0x10019781
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0x7b0], 0x76b8
jmp 0x10019758
mov dword [ebp - 0x11c], 0x13
jmp 0x1001979a
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0x1d
jg 0x1001994f
mov dword [ebp - 0x48], 0xce3051eb
mov dword [ebp - 0x758], 0x59229a27
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0
je 0x100197ea
cmp dword [ebp - 0x11c], 0
je 0x100197ea
imul eax, dword [ebp - 0x48], 0xf2d
test eax, eax
je 0x100197ea
mov dword [ebp - 0x730], 1
jmp 0x100197f1
and dword [ebp - 0x730], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7b0]
cmp dword [ebp - 0x730], eax
jne 0x10019812
mov dword [ebp - 0x738], 1
jmp 0x10019819
and dword [ebp - 0x738], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7b0]
cmp dword [ebp - 0x738], eax
jl 0x1001983a
mov dword [ebp - 0x740], 1
jmp 0x10019841
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x740], eax
jl 0x10019858
mov dword [ebp - 0x748], 1
jmp 0x1001985f
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x748]
jle 0x1001987c
mov eax, 0xc869
test eax, eax
jne 0x1001987c
and dword [ebp - 0x750], 0
jmp 0x10019886
mov dword [ebp - 0x750], 1
mov eax, dword [ebp - 0x750]
mov dword [ebp - 0x758], eax
cmp dword [ebp - 0x758], 0
jne 0x100198b4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7b0], 0
jne 0x100198b4
and dword [ebp - 0x8b4], 0
jmp 0x100198be
mov dword [ebp - 0x8b4], 1
mov eax, dword [ebp - 0x11c]
imul eax, dword [ebp - 0x48]
test eax, eax
jne 0x100198db
cmp dword [ebp - 0x48], 0
jne 0x100198db
and dword [ebp - 0x664], 0
jmp 0x100198e5
mov dword [ebp - 0x664], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7b0]
cmp eax, dword [ebp - 0x664]
jle 0x10019906
mov dword [ebp - 0x728], 1
jmp 0x1001990d
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xc70], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xc0c], eax
cmp dword [ebp - 0x48], 0xfafe44fa
jne 0x10019937
mov dword [ebp - 0x314], 1
jmp 0x1001993e
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x978], eax
jmp 0x1001978d
mov byte [ebp - 0xe6], 0
push 0
push 0x4296
push 0
push 1
push 0x3da7
lea eax, [ebp - 0xe6]
push eax
call fcn.10014aeb
add esp, 0x18
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x160], 7
mov dword [ebp - 0x1e8], 0xfffffffa
mov dword [ebp - 0x168], 0x91b05987
mov dword [ebp - 0x988], 0xc213db23
mov dword [ebp - 0x14c], 0
jmp 0x100199bd
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 2
jge 0x100199d9
mov eax, dword [ebp - 0x14c]
mov dword [ebp + eax*4 - 0x9c], 0x713b
jmp 0x100199b0
mov dword [ebp - 0x28], 1
jmp 0x100199e9
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x10019e7c
mov dword [ebp - 0x60], 8
mov dword [ebp - 0x32c], 0x30fc353
push 2
lea ecx, [ebp - 0xa40]
call fcn.1002c4d4
and dword [ebp - 4], 0
mov dword [ebp - 0xd34], 0x4b46114a
mov dword [ebp - 0x50], 0
jmp 0x10019a2f
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x10019a45
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x28c], 0x5da2ca33
jmp 0x10019a28
mov dword [ebp - 0x50], 0
jmp 0x10019a55
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x10019a71
push dword [ebp - 0x50]
lea ecx, [ebp - 0xa40]
call fcn.1002c572
mov dword [eax], 0x6378
jmp 0x10019a4e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1e8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp + ecx*4 - 0x9c]
add ecx, dword [ebp - 0x1e8]
cmp ecx, dword [ebp + eax - 0x9c]
je 0x10019aa5
mov dword [ebp - 0x324], 1
jmp 0x10019aac
and dword [ebp - 0x324], 0
cmp dword [ebp - 0x160], 0
je 0x10019aea
imul eax, dword [ebp - 0x160], 0
mov dword [ebp - 0x558], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x558]
mov dword [ebp + eax - 0x28c], ecx
cmp dword [ebp - 0x558], 0
je 0x10019aea
mov dword [ebp - 0x31c], 1
jmp 0x10019af1
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x160]
neg edx
imul edx, dword [ebp + ecx*4 - 0x9c]
cmp edx, dword [ebp + eax*4 - 0x9c]
jge 0x10019b28
mov dword [ebp - 0x7c8], 1
jmp 0x10019b2f
and dword [ebp - 0x7c8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9c]
mov dword [ebp - 0xc14], eax
push 0xfffffffffffffff8
pop eax
test eax, eax
jne 0x10019b59
push 6
pop eax
test eax, eax
jne 0x10019b59
and dword [ebp - 0x554], 0
jmp 0x10019b63
mov dword [ebp - 0x554], 1
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x9c]
cmp dword [ebp - 0x554], eax
jl 0x10019b81
mov dword [ebp - 0x734], 1
jmp 0x10019b88
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x324]
imul eax, dword [ebp - 0x734]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x32c]
sub ecx, dword [ebp + eax*4 - 0x9c]
cmp ecx, 0x6522452a
jne 0x10019bbf
mov dword [ebp - 0x55c], 1
jmp 0x10019bc6
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x55c]
jne 0x10019be4
mov dword [ebp - 0x334], 1
jmp 0x10019beb
and dword [ebp - 0x334], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c]
cmp dword [ebp - 0x334], eax
jle 0x10019c0c
mov dword [ebp - 0x66c], 1
jmp 0x10019c13
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x66c]
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x60], 0
jmp 0x10019c2f
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jg 0x10019e68
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x9c], 0x7618
jl 0x10019c55
mov dword [ebp - 0x354], 1
jmp 0x10019c5c
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x9c], 0
je 0x10019c82
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x9c], 0
je 0x10019c82
mov dword [ebp - 0x33c], 1
jmp 0x10019c89
and dword [ebp - 0x33c], 0
cmp dword [ebp - 0x33c], 0xebb3
jne 0x10019ca1
mov dword [ebp - 0x564], 1
jmp 0x10019ca8
and dword [ebp - 0x564], 0
cmp dword [ebp - 0x564], 0
jae 0x10019cbf
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x28c], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9c], 0
jne 0x10019cd3
cmp dword [ebp - 0x60], 0
mov eax, dword [ebp - 0x1e8]
cmp eax, dword [ebp - 0x60]
jl 0x10019cea
mov dword [ebp - 0x344], 1
jmp 0x10019cf1
and dword [ebp - 0x344], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x344]
mov dword [ebp + eax - 0x28c], ecx
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x9c], 0
jne 0x10019d1d
mov dword [ebp - 0x6f4], 1
jmp 0x10019d24
and dword [ebp - 0x6f4], 0
mov esi, dword [ebp - 0x1e8]
push 1
lea ecx, [ebp - 0xa40]
call fcn.1002c572
mov eax, dword [eax]
add eax, dword [ebp - 0x6f4]
imul eax, eax, 0xe3ba
cmp eax, esi
je 0x10019d55
mov dword [ebp - 0x34c], 1
jmp 0x10019d5c
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x9c]
cmp eax, dword [ebp - 0x34c]
jge 0x10019d7a
mov dword [ebp - 0x56c], 1
jmp 0x10019d81
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x9c]
cmp dword [ebp - 0x56c], eax
jne 0x10019d9f
mov dword [ebp - 0x674], 1
jmp 0x10019da6
and dword [ebp - 0x674], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x354]
sub ecx, dword [ebp - 0x674]
cmp ecx, dword [ebp + eax - 0x9c]
jle 0x10019dcd
mov dword [ebp - 0x35c], 1
jmp 0x10019dd4
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x9c], 1
jne 0x10019df9
mov dword [ebp - 0x574], 1
jmp 0x10019e00
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x168], eax
mov esi, dword [ebp - 0x168]
neg esi
push 0
lea ecx, [ebp - 0xa40]
call fcn.1002c572
cmp esi, dword [eax]
jle 0x10019e31
mov dword [ebp - 0x364], 1
jmp 0x10019e38
and dword [ebp - 0x364], 0
cmp dword [ebp - 0x364], 0xcc19ab5a
ja 0x10019e50
mov dword [ebp - 0x760], 1
jmp 0x10019e57
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x988], eax
jmp 0x10019c28
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa40]
call fcn.1002c556
jmp 0x100199e2
mov dword [ebp - 0xacc], 0xfffb
mov dword [ebp - 0xac8], 0xfffb
mov dword [ebp - 0xac4], 0xfffb
mov dword [ebp - 0xac0], 0xfffb
lea ecx, [ebp - 0x2c1]
call fcn.1002c581
push eax
lea eax, [ebp - 0xabc]
push eax
lea eax, [ebp - 0xacc]
push eax
lea ecx, [ebp - 0xd98]
call fcn.1002c584
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7c4]
call fcn.1002c530
mov dword [ebp - 4], 1
mov dword [ebp - 0x54], 1
mov dword [ebp - 0xcac], 0xffff
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x10019f14
push 1
push 0
push 0x5082
call fcn.1000fe46
add esp, 0xc
mov byte [ebp - 0xcf], 0
push 0x378a
push 0
lea eax, [ebp - 0xcf]
push eax
push 0x399e
call fcn.100263f8
add esp, 0x10
mov dword [ebp - 0xc1c], 0x1bfedaac
push 0x29f6
push 0x5212
push 0x4df
push 0
push 1
call fcn.10011cf1
add esp, 0x14
mov dword [ebp - 0xd04], 0xfffffffa
mov dword [ebp - 0xc24], 0xc05baf43
mov byte [ebp - 0xd1], 0
push 1
lea eax, [ebp - 0xd1]
push eax
push 0
call fcn.100126f8
add esp, 0xc
mov byte [ebp - 0xa2], 0
movzx eax, byte [ebp - 0xa2]
test eax, eax
je 0x10019fce
push 0xc32
push 0x118a
push 0x9cd
push 0x231d
push 0x2318
push 0x288
push 0x1d9e
push 0x2f1
push 0x1d32
call dword [sym.imp.GDI32.dll_Arc]
mov dword [ebp - 0x2c], 0x42c70bb7
mov dword [ebp - 0x90], 1
mov dword [ebp - 0x9a8], 3
push 2
lea ecx, [ebp - 0xc88]
call fcn.1002c4d4
mov byte [ebp - 4], 2
mov dword [ebp - 0x80], 0
jmp 0x1001a00a
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x1001a020
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x2ec], 0xffffffff
jmp 0x1001a003
mov dword [ebp - 0x80], 0
jmp 0x1001a030
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x1001a04c
push dword [ebp - 0x80]
lea ecx, [ebp - 0xc88]
call fcn.1002c572
mov dword [eax], 0x5eeffbb8
jmp 0x1001a029
mov dword [ebp - 0x2c], 0
jmp 0x1001a05c
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x1001a09d
mov eax, 0xa2961c0f
test eax, eax
je 0x1001a084
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x2ec], 0
je 0x1001a084
mov dword [ebp - 0x36c], 1
jmp 0x1001a08b
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x36c]
mov dword [ebp + eax*4 - 0x2ec], ecx
jmp 0x1001a055
mov dword [ebp - 0x2c], 0
jmp 0x1001a0ad
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffe2
jne 0x1001a50e
mov dword [ebp - 0x68], 0
push 1
lea ecx, [ebp - 0x774]
call fcn.1002c4d4
mov byte [ebp - 4], 3
mov dword [ebp - 0x58c], 0
mov dword [ebp - 0x3a4], 0x3e235bd6
mov dword [ebp - 0x268], 0
jmp 0x1001a0fc
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 1
jge 0x1001a11e
push dword [ebp - 0x268]
lea ecx, [ebp - 0x774]
call fcn.1002c572
mov dword [eax], 0x1de6fc60
jmp 0x1001a0ef
cmp dword [ebp - 0x68], 0
je 0x1001a15a
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x57c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x57c]
mov dword [ebp + eax - 0x2ec], ecx
mov eax, dword [ebp - 0x68]
imul eax, dword [ebp - 0x57c]
test eax, eax
je 0x1001a15a
mov dword [ebp - 0x374], 1
jmp 0x1001a161
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x68]
jl 0x1001a175
mov dword [ebp - 0x67c], 1
jmp 0x1001a17c
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x90], eax
mov esi, dword [ebp - 0x90]
sub esi, dword [ebp - 0x67c]
add esi, dword [ebp - 0x68]
push 0
lea ecx, [ebp - 0x774]
call fcn.1002c572
imul esi, dword [eax]
test esi, esi
je 0x1001a453
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xcbc], 0xffffffff
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2ec], 0
je 0x1001a1e8
cmp dword [ebp - 0xa8], 0
je 0x1001a1e8
mov dword [ebp - 0x990], 1
jmp 0x1001a1ef
and dword [ebp - 0x990], 0
cmp dword [ebp - 0x2c], 0
jne 0x1001a201
mov dword [ebp - 0x37c], 1
jmp 0x1001a208
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x37c]
sub eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0xa8]
jge 0x1001a22a
xor eax, eax
inc eax
je 0x1001a22a
mov dword [ebp - 0x584], 1
jmp 0x1001a231
and dword [ebp - 0x584], 0
cmp dword [ebp - 0x584], 0
jbe 0x1001a246
mov dword [ebp - 0x998], 1
jmp 0x1001a24d
and dword [ebp - 0x998], 0
mov esi, dword [ebp - 0x90]
mov edi, dword [ebp - 0xa8]
push 0
lea ecx, [ebp - 0x774]
call fcn.1002c572
mov eax, dword [eax]
sub eax, edi
cmp eax, esi
je 0x1001a28c
push 0
lea ecx, [ebp - 0x774]
call fcn.1002c572
cmp dword [eax], 0
je 0x1001a28c
mov dword [ebp - 0x384], 1
jmp 0x1001a293
and dword [ebp - 0x384], 0
push 0
lea ecx, [ebp - 0x774]
call fcn.1002c572
mov ecx, dword [ebp - 0x384]
imul ecx, dword [eax]
test ecx, ecx
je 0x1001a3aa
xor eax, eax
inc eax
je 0x1001a2f1
mov eax, dword [ebp - 0x58c]
mov dword [ebp - 0xc2c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2ec]
mov dword [ebp - 0xd44], eax
mov eax, dword [ebp - 0xa8]
imul eax, dword [ebp - 0xa8]
test eax, eax
je 0x1001a2f1
mov dword [ebp - 0x6fc], 1
jmp 0x1001a2f8
and dword [ebp - 0x6fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ec]
cmp dword [ebp - 0x6fc], eax
jg 0x1001a319
mov dword [ebp - 0x38c], 1
jmp 0x1001a320
and dword [ebp - 0x38c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x38c]
mov dword [ebp + eax - 0x2ec], ecx
push 3
pop eax
sub eax, dword [ebp - 0x58c]
cmp eax, dword [ebp - 0x90]
jne 0x1001a34f
mov dword [ebp - 0x394], 1
jmp 0x1001a356
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x394], eax
jl 0x1001a36d
mov dword [ebp - 0x684], 1
jmp 0x1001a374
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x684]
mov dword [ebp - 0xa8], eax
mov esi, dword [ebp - 0xa8]
push 0
lea ecx, [ebp - 0x774]
call fcn.1002c572
imul esi, dword [eax]
mov eax, dword [ebp - 0x90]
imul eax, esi
mov dword [ebp - 0x90], eax
jmp 0x1001a44e
mov dword [ebp - 0x9a0], 1
mov dword [ebp - 0x90], 0
mov eax, dword [ebp - 0x90]
neg eax
cmp eax, dword [ebp - 0x2c]
jle 0x1001a3d7
mov dword [ebp - 0x39c], 1
jmp 0x1001a3de
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0x39c], eax
jne 0x1001a407
mov eax, 0xaf4a9b83
test eax, eax
je 0x1001a407
cmp dword [ebp - 0x2c], 0
je 0x1001a407
mov dword [ebp - 0x2dc], 1
jmp 0x1001a40e
and dword [ebp - 0x2dc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2dc]
mov dword [ebp + eax - 0x2ec], ecx
cmp dword [ebp - 0x2dc], 0
jne 0x1001a43b
cmp dword [ebp - 0x9a0], 0
jne 0x1001a43b
and dword [ebp - 0x594], 0
jmp 0x1001a445
mov dword [ebp - 0x594], 1
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x68], eax
jmp 0x1001a4fa
push 3
lea ecx, [ebp - 0xb04]
call fcn.1002c4d4
mov byte [ebp - 4], 4
mov dword [ebp - 0x170], 0
jmp 0x1001a47d
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 3
jge 0x1001a49f
push dword [ebp - 0x170]
lea ecx, [ebp - 0xb04]
call fcn.1002c572
mov dword [eax], 0xd5357554
jmp 0x1001a470
cmp dword [ebp - 0x9a8], 0
je 0x1001a4cb
mov esi, dword [ebp - 0x3a4]
push 1
lea ecx, [ebp - 0xb04]
call fcn.1002c572
cmp esi, dword [eax]
jg 0x1001a4cb
mov dword [ebp - 0x73c], 1
jmp 0x1001a4d2
and dword [ebp - 0x73c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x73c]
mov dword [ebp + eax - 0x2ec], ecx
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x68], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xb04]
call fcn.1002c556
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x774]
call fcn.1002c556
jmp 0x1001a0a6
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc88]
call fcn.1002c556
mov dword [ebp - 0x54], 0
jmp 0x1001a52d
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jg 0x1001d7e9
mov dword [ebp - 0x3ac], 0x5e36
mov dword [ebp - 0x9b8], 0x100088b8
cmp dword [ebp - 0x3ac], 0x5eef
jle 0x1001a630
and dword [ebp - 0x1f0], 0
jmp 0x1001a571
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0x3a38
jge 0x1001a630
and dword [ebp - 0x178], 0
jmp 0x1001a597
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x122a
jge 0x1001a62b
and dword [ebp - 0x230], 0
jmp 0x1001a5bd
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0x4102
jge 0x1001a626
mov eax, dword [ebp - 0x1f0]
sub eax, dword [ebp - 0x178]
or eax, dword [ebp - 0x230]
cdq
mov dword [ebp - 0x8c0], eax
mov dword [ebp - 0x8bc], edx
push dword [ebp - 0x8bc]
push dword [ebp - 0x8c0]
lea ecx, [ebp - 0xdc8]
call fcn.1000d0f0
pop ecx
pop ecx
mov dword [ebp - 0x9b0], eax
mov ecx, dword [ebp - 0x9b0]
call fcn.1002c39f
push eax
call fcn.10049f86
pop ecx
lea ecx, [ebp - 0xdc8]
call fcn.1002c395
jmp 0x1001a5b0
jmp 0x1001a58a
jmp 0x1001a564
mov byte [ebp - 4], 5
cmp dword [ebp - 0x3ac], 0x5ba7
jge 0x1001a64c
push dword [ebp - 0x9b8]
call fcn.10049f86
pop ecx
jmp 0x1001a668
mov dword [ebp - 4], 1
jmp 0x1001a678
push 4
lea ecx, [ebp - 0x130]
call fcn.1002c4d4
mov byte [ebp - 4], 7
mov dword [ebp - 0x24], 0x132d683a
mov dword [ebp - 0x138], 0
jmp 0x1001a6a9
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 4
jge 0x1001a6c5
mov eax, dword [ebp - 0x138]
mov dword [ebp + eax*4 - 0x284], 0xa8eac8b
jmp 0x1001a69c
push 1
push 0x3407
push 0
push 0x71b8
push 0x11a6
lea eax, [ebp - 0x130]
push eax
push 0x70ab
push 0x44d1
push 0x6433
push 0x24
push 0x1af6
push 0x7379
lea eax, [ebp - 0x138]
push eax
push 0x68ba
push 0x3495
call fcn.1000f470
add esp, 0x3c
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x284], 0
jmp 0x1001a73e
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x284]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x284], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x284], 0x15
jne 0x1001a90a
mov dword [ebp - 0x124], 0x14c9
mov dword [ebp - 0x5ac], 0x30836b16
mov dword [ebp - 0x59c], 0x3e76e5b1
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x59c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x59c]
cmp ecx, dword [ebp + eax - 0x284]
je 0x1001a79b
mov dword [ebp - 0x3b4], 1
jmp 0x1001a7a2
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x3b4]
shl eax, 1
js 0x1001a7b8
mov dword [ebp - 0x68c], 1
jmp 0x1001a7bf
and dword [ebp - 0x68c], 0
cmp dword [ebp - 0x68c], 0x88c5
jg 0x1001a7d7
mov dword [ebp - 0x3bc], 1
jmp 0x1001a7de
and dword [ebp - 0x3bc], 0
cmp dword [ebp - 0x3bc], 0x23d4
je 0x1001a7f6
mov dword [ebp - 0x5a4], 1
jmp 0x1001a7fd
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x5a4]
sub eax, dword [ebp - 0x124]
jne 0x1001a81d
mov eax, 0x1f1e283d
test eax, eax
jne 0x1001a81d
and dword [ebp - 0x3c4], 0
jmp 0x1001a827
mov dword [ebp - 0x3c4], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x284]
cmp dword [ebp - 0x3c4], eax
jne 0x1001a848
mov dword [ebp - 0x704], 1
jmp 0x1001a84f
and dword [ebp - 0x704], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x284]
cmp dword [ebp - 0x704], eax
jl 0x1001a870
mov dword [ebp - 0x3cc], 1
jmp 0x1001a877
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x5ac], eax
mov eax, dword [ebp - 0x3cc]
sub eax, dword [ebp - 0x124]
sub eax, dword [ebp - 0x124]
cmp dword [ebp - 0x5ac], eax
jge 0x1001a8a9
mov dword [ebp - 0x3d4], 1
jmp 0x1001a8b0
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x3d4], eax
je 0x1001a8ca
mov dword [ebp - 0x694], 1
jmp 0x1001a8d1
and dword [ebp - 0x694], 0
cmp dword [ebp - 0x694], 0x8769
jne 0x1001a8e9
mov dword [ebp - 0x3dc], 1
jmp 0x1001a8f0
and dword [ebp - 0x3dc], 0
push 3
lea ecx, [ebp - 0x130]
call fcn.1002c572
mov ecx, dword [ebp - 0x3dc]
mov dword [eax], ecx
jmp 0x1001a725
mov dword [ebp - 0x24], 3
jmp 0x1001a91a
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1001acd0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x284], 0
jne 0x1001aa20
push dword [ebp - 0x24]
lea ecx, [ebp - 0x130]
call fcn.1002c572
cmp dword [eax], 0
je 0x1001a99e
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp + ecx - 0x284]
cmp edx, dword [ebp + eax - 0x284]
je 0x1001a974
mov dword [ebp - 0x5b4], 1
jmp 0x1001a97b
and dword [ebp - 0x5b4], 0
push 3
lea ecx, [ebp - 0x130]
call fcn.1002c572
mov ecx, dword [ebp - 0x5b4]
cmp ecx, dword [eax]
jle 0x1001a99e
mov dword [ebp - 0xa00], 1
jmp 0x1001a9a5
and dword [ebp - 0xa00], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x130]
call fcn.1002c572
push dword [ebp - 0x24]
lea ecx, [ebp - 0x130]
call fcn.1002c572
push dword [ebp - 0x24]
lea ecx, [ebp - 0x130]
call fcn.1002c572
cmp dword [eax], 0
je 0x1001a9f2
push 2
lea ecx, [ebp - 0x130]
call fcn.1002c572
cmp dword [eax], 0
je 0x1001a9f2
mov dword [ebp - 0x3e4], 1
jmp 0x1001a9f9
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x3e4]
neg eax
jne 0x1001aa20
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x284], 0
jne 0x1001aa20
and dword [ebp - 0x75c], 0
jmp 0x1001aa2a
mov dword [ebp - 0x75c], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x284]
cmp dword [ebp - 0x75c], eax
jne 0x1001aa4b
mov dword [ebp - 0x3ec], 1
jmp 0x1001aa52
and dword [ebp - 0x3ec], 0
push 3
lea ecx, [ebp - 0x130]
call fcn.1002c572
mov ecx, dword [ebp - 0x3ec]
add ecx, dword [eax]
jne 0x1001aa85
push dword [ebp - 0x24]
lea ecx, [ebp - 0x130]
call fcn.1002c572
cmp dword [eax], 0
jne 0x1001aa85
and dword [ebp - 0x5bc], 0
jmp 0x1001aa8f
mov dword [ebp - 0x5bc], 1
push 0
lea ecx, [ebp - 0x130]
call fcn.1002c572
mov ecx, dword [ebp - 0x5bc]
cmp ecx, dword [eax]
jl 0x1001aab2
mov dword [ebp - 0x8e4], 1
jmp 0x1001aab9
and dword [ebp - 0x8e4], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x130]
call fcn.1002c572
mov eax, 0xc5a258d3
test eax, eax
je 0x1001ac95
mov dword [ebp - 0x140], 0x38315eac
mov dword [ebp - 0x80c], 0xffffffff
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x284], 0
je 0x1001aafc
jmp 0x1001acd0
mov dword [ebp - 0x140], 0
jmp 0x1001ab15
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 3
jg 0x1001ac93
mov dword [ebp - 0xf8], 2
mov dword [ebp - 0x294], 0xfffffffd
mov dword [ebp - 0xf8], 0
jmp 0x1001ab4f
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 3
jg 0x1001ac6d
mov eax, 0x1656
test eax, eax
je 0x1001ab9a
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x284]
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x3f4]
mov dword [ebp + eax*4 - 0x284], ecx
cmp dword [ebp - 0x3f4], 0
je 0x1001ab9a
mov dword [ebp - 0x69c], 1
jmp 0x1001aba1
and dword [ebp - 0x69c], 0
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x130]
call fcn.1002c572
mov eax, dword [eax]
mov dword [ebp - 0x294], eax
mov esi, dword [ebp - 0x294]
add esi, dword [ebp - 0x69c]
push dword [ebp - 0x140]
lea ecx, [ebp - 0x130]
call fcn.1002c572
cmp dword [eax], esi
je 0x1001abfa
push dword [ebp - 0x24]
lea ecx, [ebp - 0x130]
call fcn.1002c572
cmp dword [eax], 0
je 0x1001abfa
mov dword [ebp - 0x3fc], 1
jmp 0x1001ac01
and dword [ebp - 0x3fc], 0
cmp dword [ebp - 0x3fc], 0xffad
jge 0x1001ac19
mov dword [ebp - 0x5c4], 1
jmp 0x1001ac20
and dword [ebp - 0x5c4], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x130]
call fcn.1002c572
mov ecx, dword [ebp - 0x5c4]
cmp ecx, dword [eax]
jge 0x1001ac44
mov dword [ebp - 0x894], 1
jmp 0x1001ac4b
and dword [ebp - 0x894], 0
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x130]
call fcn.1002c572
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x80c], eax
jmp 0x1001ab42
push 0x2031
lea eax, [ebp - 0x130]
push eax
push 0
lea eax, [ebp - 0x24]
push eax
push 0x527f
push 1
call fcn.10012784
add esp, 0x18
jmp 0x1001ab08
jmp 0x1001accb
push 1
push 0xaf7
push 0x7fa6
push 0x2567
push 0x5c
push 0
push 0x5396
push 0x20e0
push 0x1d0d
push 0x4c09
push 0x77f1
call fcn.1000d5f8
add esp, 0x2c
jmp 0x1001a913
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x130]
call fcn.1002c556
mov dword [ebp - 0xc8], 0xb0ceafd
mov dword [ebp - 0x40c], 0x2e0cf572
mov dword [ebp - 0xc34], 0x94f37831
mov dword [ebp - 0x404], 0xfffffff7
mov dword [ebp - 0x180], 0xccbad86e
mov dword [ebp - 0xccc], 6
mov dword [ebp - 0xb60], 0x71865425
mov dword [ebp - 0x2c0], 1
mov dword [ebp - 0xb64], 0x74c7af5a
and dword [ebp - 0xa90], 0
and dword [ebp - 0xa8c], 0
and dword [ebp - 0xa88], 0
and dword [ebp - 0xa84], 0
lea ecx, [ebp - 0x2c9]
call fcn.1002c581
push eax
lea eax, [ebp - 0xa80]
push eax
lea eax, [ebp - 0xa90]
push eax
lea ecx, [ebp - 0xd78]
call fcn.1002c584
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9c8]
call fcn.1002c530
mov byte [ebp - 4], 8
mov dword [ebp - 0xb6c], 6
mov dword [ebp - 0x29c], 0x236728ad
mov dword [ebp - 0x414], 0
mov dword [ebp - 0x8f8], 0
push 4
lea ecx, [ebp - 0xaec]
call fcn.1002c4d4
mov byte [ebp - 4], 9
mov dword [ebp - 0x8c], 0
jmp 0x1001ade0
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 4
jge 0x1001adfc
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xd1c], 0xffff
jmp 0x1001add3
mov dword [ebp - 0x8c], 0
jmp 0x1001ae15
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 4
jge 0x1001ae34
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xaec]
call fcn.1002c572
or dword [eax], 0xffffffff
jmp 0x1001ae08
push 0
push 0x309e
lea eax, [ebp - 0x414]
push eax
push 1
push 0x746c
push 1
push 0x24bd
call fcn.10019698
add esp, 0x1c
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xd1c]
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x7d8], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xd1c]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xd1c], eax
cmp dword [ebp - 0x7d8], 0xfffffff8
jl 0x1001aea7
mov dword [ebp - 0x41c], 1
jmp 0x1001aeae
and dword [ebp - 0x41c], 0
mov dword [ebp - 0x180], 0
cmp dword [ebp - 0x180], 0
jne 0x1001af59
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0xb74], eax
mov esi, dword [ebp - 0x2c0]
push 3
lea ecx, [ebp - 0x9c8]
call fcn.1002c572
cmp dword [eax], esi
jg 0x1001aef4
mov dword [ebp - 0x70c], 1
jmp 0x1001aefb
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x40c]
cmp eax, dword [ebp - 0x180]
jg 0x1001af21
mov dword [ebp - 0x8dc], 1
jmp 0x1001af28
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0xb7c], eax
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0xb98], eax
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0xba0], eax
xor eax, eax
jne 0x1001af59
and dword [ebp - 0x5cc], 0
jmp 0x1001af63
mov dword [ebp - 0x5cc], 1
push 3
lea ecx, [ebp - 0x9c8]
call fcn.1002c572
mov ecx, dword [ebp - 0x5cc]
cmp ecx, dword [eax]
jle 0x1001af8c
cmp dword [ebp - 0x414], 0
jne 0x1001af8c
and dword [ebp - 0x7e0], 0
jmp 0x1001af96
mov dword [ebp - 0x7e0], 1
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0xba8], eax
mov esi, dword [ebp - 0x8f8]
push 0
lea ecx, [ebp - 0x9c8]
call fcn.1002c572
cmp dword [eax], esi
jle 0x1001afc5
mov dword [ebp - 0x6a4], 1
jmp 0x1001afcc
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x29c]
cmp dword [ebp - 0x6a4], eax
jne 0x1001afe6
mov dword [ebp - 0x5d4], 1
jmp 0x1001afed
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x41c]
cmp eax, dword [ebp - 0x5d4]
jg 0x1001b007
mov dword [ebp - 0x2d8], 1
jmp 0x1001b00e
and dword [ebp - 0x2d8], 0
push 3
lea ecx, [ebp - 0x9c8]
call fcn.1002c572
mov ecx, dword [ebp - 0x2d8]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0xaec]
call fcn.1002c572
mov ecx, dword [ebp - 0x2d8]
mov dword [eax], ecx
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xaec]
call fcn.1002c556
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x9c8]
call fcn.1002c556
mov dword [ebp - 0xbb0], 7
mov dword [ebp - 0x188], 0xa9c4
mov dword [ebp - 0x148], 0x7fbf2121
mov dword [ebp - 0x1f8], 0
jmp 0x1001b08d
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 1
jge 0x1001b0a9
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0x7e8], 0xfffffffd
jmp 0x1001b080
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x7e8], 0
mov dword [ebp - 0x148], 0xfffffffa
jmp 0x1001b0d3
mov eax, dword [ebp - 0x148]
dec eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xfffffff9
jne 0x1001b1cd
mov byte [ebp - 0xd6], 0
movzx eax, byte [ebp - 0xd6]
test eax, eax
je 0x1001b108
push 0
push 0x4468
push 1
push 0x550b
call fcn.10010d27
add esp, 0x10
mov dword [ebp - 0x188], 0
jmp 0x1001b121
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0x3b
jge 0x1001b1c8
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x250], 0xfffffff7
jmp 0x1001b151
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0xa
jg 0x1001b1c3
mov dword [ebp - 0x190], 0x203bd652
mov dword [ebp - 0x190], 0
jmp 0x1001b17d
mov eax, dword [ebp - 0x190]
dec eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jl 0x1001b1c1
mov byte [ebp - 0xa3], 0
lea eax, [ebp - 0xa3]
push eax
push 0x5e3e
push 0x2660
push 1
push 0x72e2
push 0x1357
push 0
call fcn.10018909
add esp, 0x1c
cmp dword [ebp - 0x148], 0
je 0x1001b1bf
jmp 0x1001b170
jmp 0x1001b170
jmp 0x1001b144
jmp 0x1001b114
jmp 0x1001b0c6
mov dword [ebp - 0xc8], 0
jmp 0x1001b1e6
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jg 0x1001d093
mov dword [ebp - 0x118], 0xd00693e9
mov dword [ebp - 0x200], 0xfffffffb
mov dword [ebp - 0x70], 0
jmp 0x1001b217
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x1001b22d
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x7a8], 1
jmp 0x1001b210
mov dword [ebp - 0x70], 0
jmp 0x1001b23d
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1001b253
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xf0], 4
jmp 0x1001b236
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xf0], 0
jmp 0x1001b281
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xf0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf0], 3
jg 0x1001b41f
mov dword [ebp - 0x744], 0xfffffffc
mov dword [ebp - 0x2a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf0]
cmp dword [ebp + eax*4 - 0x7a8], 0
je 0x1001b2e3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf0]
cmp dword [ebp + eax*4 - 0x7a8], 0
je 0x1001b2e3
mov dword [ebp - 0x424], 1
jmp 0x1001b2ea
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x744], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf0]
mov eax, dword [ebp + eax*4 - 0x7a8]
cmp eax, dword [ebp - 0x744]
je 0x1001b31e
mov dword [ebp - 0x434], 1
jmp 0x1001b325
and dword [ebp - 0x434], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf0]
cmp dword [ebp + eax*4 - 0x7a8], 3
jle 0x1001b348
mov dword [ebp - 0x42c], 1
jmp 0x1001b34f
and dword [ebp - 0x42c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf0]
mov eax, dword [ebp + eax*4 - 0x7a8]
add eax, dword [ebp - 0x42c]
mov dword [ebp - 0x2a4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf0]
push 4
pop ecx
shl ecx, 0
mov edx, dword [ebp - 0x2a4]
imul edx, dword [ebp + ecx - 0xf0]
cmp edx, dword [ebp + eax*4 - 0x7a8]
jle 0x1001b3a5
mov dword [ebp - 0x5dc], 1
jmp 0x1001b3ac
and dword [ebp - 0x5dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf0]
add eax, dword [ebp - 0x5dc]
cmp dword [ebp - 0x434], eax
jne 0x1001b3dc
cmp dword [ebp - 0x2a4], 0
je 0x1001b3dc
mov dword [ebp - 0x6ac], 1
jmp 0x1001b3e3
and dword [ebp - 0x6ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf0]
mov ecx, dword [ebp - 0x6ac]
mov dword [ebp + eax*4 - 0x7a8], ecx
push 0
push 1
push 1
push 0x1c6
push 0x4f3f
push 0x4747
call fcn.10011951
add esp, 0x18
jmp 0x1001b266
mov dword [ebp - 0x200], 0x18
jmp 0x1001b438
mov eax, dword [ebp - 0x200]
dec eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0xffffffff
jge 0x1001b4db
mov dword [ebp - 0x110], 0x18ab9c27
mov byte [ebp - 0xd3], 0
movzx eax, byte [ebp - 0xd3]
test eax, eax
je 0x1001b470
push 0
push 0xbd0
push 0
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
mov dword [ebp - 0x110], 3
jmp 0x1001b489
mov eax, dword [ebp - 0x110]
dec eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jl 0x1001b4d6
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x110]
mov ecx, dword [ebp + ecx*4 - 0x7a8]
cmp ecx, dword [ebp + eax - 0xf0]
jge 0x1001b4ba
mov dword [ebp - 0x43c], 1
jmp 0x1001b4c1
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x43c]
mov dword [ebp + eax*4 - 0x7a8], ecx
jmp 0x1001b47c
jmp 0x1001b42b
mov dword [ebp - 0xbb8], 0xb11de2a9
push 0x4ebb
push 0
push 0x4d9c
push 1
call fcn.1000df1d
add esp, 0x10
mov dword [ebp - 0x390], 0x62b0a94f
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x88], 6
mov dword [ebp - 0xab8], 1
mov dword [ebp - 0xab4], 1
mov dword [ebp - 0xab0], 1
mov dword [ebp - 0xaac], 1
lea ecx, [ebp - 0x2d1]
call fcn.1002c581
push eax
lea eax, [ebp - 0xaa8]
push eax
lea eax, [ebp - 0xab8]
push eax
lea ecx, [ebp - 0xd70]
call fcn.1002c584
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x78c]
call fcn.1002c530
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x78], 0xa32f
mov dword [ebp - 0xb0], 0x55ff
mov dword [ebp - 0x198], 0
jmp 0x1001b5a4
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 2
jge 0x1001b5c0
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x8cc], 0x5d632600
jmp 0x1001b597
mov eax, 0xeb9ae77a
test eax, eax
je 0x1001b688
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
jne 0x1001b636
cmp dword [ebp - 0x88], 0
je 0x1001b5fa
cmp dword [ebp - 0x88], 0
je 0x1001b5fa
mov dword [ebp - 0x5e4], 1
jmp 0x1001b601
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x5e4], eax
jne 0x1001b618
mov dword [ebp - 0x444], 1
jmp 0x1001b61f
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x444], eax
jl 0x1001b636
and dword [ebp - 0x714], 0
jmp 0x1001b640
mov dword [ebp - 0x714], 1
mov eax, dword [ebp - 0x714]
sub eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x88]
jne 0x1001b660
mov dword [ebp - 0x9ac], 1
jmp 0x1001b667
and dword [ebp - 0x9ac], 0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xbc0], eax
cmp dword [ebp - 0x238], 0
je 0x1001b688
mov dword [ebp - 0x44c], 1
jmp 0x1001b68f
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x238]
cmp eax, dword [ebp - 0x44c]
jge 0x1001b6a9
mov dword [ebp - 0x5ec], 1
jmp 0x1001b6b0
and dword [ebp - 0x5ec], 0
cmp dword [ebp - 0x5ec], 0xb064
je 0x1001b6c8
mov dword [ebp - 0x454], 1
jmp 0x1001b6cf
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x454], eax
jle 0x1001b6e6
mov dword [ebp - 0x6b4], 1
jmp 0x1001b6ed
and dword [ebp - 0x6b4], 0
mov esi, dword [ebp - 0x6b4]
sub esi, dword [ebp - 0x78]
push 0
lea ecx, [ebp - 0x78c]
call fcn.1002c572
mov dword [eax], esi
push 0
lea ecx, [ebp - 0x78c]
call fcn.1002c572
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xbc8], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xbd0], eax
cmp dword [ebp - 0xb0], 1
jne 0x1001b73f
mov dword [ebp - 0x45c], 1
jmp 0x1001b746
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x45c], eax
je 0x1001b75d
mov dword [ebp - 0x5f4], 1
jmp 0x1001b764
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x5f4], eax
jle 0x1001b77b
mov dword [ebp - 0x464], 1
jmp 0x1001b782
and dword [ebp - 0x464], 0
push 0
lea ecx, [ebp - 0x78c]
call fcn.1002c572
mov ecx, dword [ebp - 0x464]
cmp ecx, dword [eax]
jl 0x1001b7a5
mov dword [ebp - 0x768], 1
jmp 0x1001b7ac
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x768]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0x78]
imul eax, dword [ebp - 0x78]
imul eax, eax, 0xfffffffc
cmp eax, dword [ebp - 0x78]
jne 0x1001b7eb
mov dword [ebp - 0x46c], 1
jmp 0x1001b7f2
and dword [ebp - 0x46c], 0
cmp dword [ebp - 0x46c], 0xc5f6
jle 0x1001b80a
mov dword [ebp - 0x5fc], 1
jmp 0x1001b811
and dword [ebp - 0x5fc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8cc]
cmp dword [ebp - 0x5fc], eax
je 0x1001b832
mov dword [ebp - 0x474], 1
jmp 0x1001b839
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0x474], eax
jl 0x1001b853
mov dword [ebp - 0x6bc], 1
jmp 0x1001b85a
and dword [ebp - 0x6bc], 0
mov esi, dword [ebp - 0x6bc]
sub esi, dword [ebp - 0x78]
push 0
lea ecx, [ebp - 0x78c]
call fcn.1002c572
cmp dword [eax], esi
jl 0x1001b890
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8cc], 0
je 0x1001b890
mov dword [ebp - 0x7f0], 1
jmp 0x1001b897
and dword [ebp - 0x7f0], 0
push 0
lea ecx, [ebp - 0x78c]
call fcn.1002c572
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x238]
cmp ecx, dword [ebp + eax - 0x8cc]
je 0x1001b8c5
mov dword [ebp - 0x47c], 1
jmp 0x1001b8cc
and dword [ebp - 0x47c], 0
mov esi, dword [ebp - 0xb0]
imul esi, dword [ebp - 0x47c]
push 3
lea ecx, [ebp - 0x78c]
call fcn.1002c572
mov dword [eax], esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x78c]
call fcn.1002c556
mov dword [ebp - 0x100], 0xbe44
mov dword [ebp - 0x208], 1
mov dword [ebp - 0x604], 0x17d7
mov dword [ebp - 0x1a0], 0
jmp 0x1001b92e
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 3
jge 0x1001b94a
mov eax, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0xc98], 0x15fdc8df
jmp 0x1001b921
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x1001b981
push 0x2a9b
push 0
push 0x91c
push 1
push 0x52f2
push 0x45b3
push 0x4c83
call fcn.1000f6a2
add esp, 0x1c
cmp dword [ebp - 0x100], 0
jne 0x1001b996
mov dword [ebp - 0x71c], 1
jmp 0x1001b99d
and dword [ebp - 0x71c], 0
cmp dword [ebp - 0x100], 0
jne 0x1001b9b8
cmp dword [ebp - 0x100], 0
jne 0x1001b9b8
and dword [ebp - 0x8ec], 0
jmp 0x1001b9c2
mov dword [ebp - 0x8ec], 1
mov eax, dword [ebp - 0x604]
dec eax
mov dword [ebp - 0x604], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xbe8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xc98], 0x6dd2cc9
jge 0x1001b9f9
mov dword [ebp - 0x484], 1
jmp 0x1001ba00
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x100]
imul eax, dword [ebp - 0x208]
cmp dword [ebp - 0x71c], eax
je 0x1001ba2d
mov dword [ebp - 0x7f8], 1
jmp 0x1001ba34
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0xbf0], eax
mov eax, dword [ebp - 0x208]
cmp eax, dword [ebp - 0x100]
je 0x1001ba5a
mov dword [ebp - 0x48c], 1
jmp 0x1001ba61
and dword [ebp - 0x48c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x48c]
mov dword [ebp + eax - 0xc98], ecx
mov dword [ebp - 0x1a8], 0
jmp 0x1001ba8d
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 1
jge 0x1001baa9
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0xbf8], 0xfffffff8
jmp 0x1001ba80
mov dword [ebp - 0x118], 3
jmp 0x1001bac2
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jl 0x1001cbeb
mov dword [ebp - 0x920], 1
mov dword [ebp - 0x644], 0x220f
mov dword [ebp - 0x984], 0x10008938
cmp dword [ebp - 0x644], 0x2298
jle 0x1001bbd4
and dword [ebp - 0x210], 0
jmp 0x1001bb13
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0x49f9
jge 0x1001bbd4
and dword [ebp - 0x260], 0
jmp 0x1001bb39
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0x23dc
jge 0x1001bbcf
and dword [ebp - 0x1b0], 0
jmp 0x1001bb5f
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0x5d01
jge 0x1001bbca
mov eax, dword [ebp - 0x260]
mov ecx, dword [ebp - 0x1b0]
sar eax, cl
and eax, dword [ebp - 0x210]
cdq
mov dword [ebp - 0x8d8], eax
mov dword [ebp - 0x8d4], edx
push dword [ebp - 0x8d4]
push dword [ebp - 0x8d8]
lea ecx, [ebp - 0xdf8]
call fcn.1000d0f0
pop ecx
pop ecx
mov dword [ebp - 0x97c], eax
mov ecx, dword [ebp - 0x97c]
call fcn.1002c39f
push eax
call fcn.10049f86
pop ecx
lea ecx, [ebp - 0xdf8]
call fcn.1002c395
jmp 0x1001bb52
jmp 0x1001bb2c
jmp 0x1001bb06
mov dword [ebp - 0x1c], 0x48261f9c
mov dword [ebp - 0xb8], 0xbfad0d72
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x120], 0xce17c927
cmp dword [ebp - 0x1c], 0
je 0x1001bc42
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1001bc3d
push 0x2459
push 1
push 0x33b2
push 0x32a4
push 1
push 0x2766
push 0x2fc
push 0x2f35
push 0x405d
call fcn.1000d26c
add esp, 0x24
jmp 0x1001c1f5
mov dword [ebp - 0x4f4], 0
mov dword [ebp - 0x810], 0xd8e7dfbf
mov dword [ebp - 0x818], 0x1b4c5108
mov dword [ebp - 0x1b8], 0
jmp 0x1001bc79
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 1
jge 0x1001bc92
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x14], 0x9be1d925
jmp 0x1001bc6c
mov dword [ebp - 0x1c], 0
jmp 0x1001bca2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jg 0x1001c1f5
mov dword [ebp - 0x2c8], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp + ecx*4 - 0x14]
neg ecx
cmp ecx, dword [ebp + eax - 0x14]
jne 0x1001bcd7
mov dword [ebp - 0x60c], 1
jmp 0x1001bcde
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x14]
cmp dword [ebp - 0x60c], eax
jle 0x1001bcf9
mov dword [ebp - 0x61c], 1
jmp 0x1001bd00
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x14], 0x87a5
je 0x1001bd19
mov dword [ebp - 0x494], 1
jmp 0x1001bd20
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x494], eax
jl 0x1001bd37
mov dword [ebp - 0x6c4], 1
jmp 0x1001bd3e
and dword [ebp - 0x6c4], 0
cmp dword [ebp - 0x6c4], 0
ja 0x1001bd53
mov dword [ebp - 0x49c], 1
jmp 0x1001bd5a
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x14]
add eax, dword [ebp - 0x49c]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x14], 0
jne 0x1001bd7a
and dword [ebp - 0x614], 0
jmp 0x1001bd84
mov dword [ebp - 0x614], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
cmp dword [ebp - 0x614], eax
jge 0x1001bda2
mov dword [ebp - 0x4a4], 1
jmp 0x1001bda9
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x4a4], eax
jge 0x1001bdc0
mov dword [ebp - 0x74c], 1
jmp 0x1001bdc7
and dword [ebp - 0x74c], 0
cmp dword [ebp - 0x74c], 0x3acb
jl 0x1001bddf
mov dword [ebp - 0x4ac], 1
jmp 0x1001bde6
and dword [ebp - 0x4ac], 0
cmp dword [ebp - 0x4ac], 0x2db8e964
jle 0x1001bdfe
mov dword [ebp - 0x800], 1
jmp 0x1001be05
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x14]
mov dword [ebp - 0xc00], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
mov dword [ebp - 0xc08], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
cmp dword [ebp - 0x61c], eax
jne 0x1001be43
cmp dword [ebp - 0x1c], 0
jne 0x1001be43
and dword [ebp - 0x8f4], 0
jmp 0x1001be4d
mov dword [ebp - 0x8f4], 1
mov eax, dword [ebp - 0x1c]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x14]
add ecx, dword [ebp + eax*4 - 0x14]
cmp ecx, dword [ebp - 0xb8]
jl 0x1001be72
mov dword [ebp - 0x4b4], 1
jmp 0x1001be79
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp + ecx*4 - 0x14]
cmp ecx, dword [ebp + eax*4 - 0x14]
jle 0x1001be9e
mov dword [ebp - 0x6cc], 1
jmp 0x1001bea5
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x6cc]
neg eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0
jmp 0x1001bec0
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jg 0x1001c1f0
mov dword [ebp - 0x9ec], 0x8db2edfd
mov dword [ebp - 0xb8], 0
jmp 0x1001beed
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jg 0x1001bff0
mov dword [ebp - 0x624], 6
mov dword [ebp - 0x2c8], 0
xor eax, eax
jne 0x1001bf91
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x14], 0
jle 0x1001bf28
mov dword [ebp - 0x4bc], 1
jmp 0x1001bf2f
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x624], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x624]
cmp ecx, dword [ebp + eax - 0x14]
jg 0x1001bf59
mov dword [ebp - 0x4c4], 1
jmp 0x1001bf60
and dword [ebp - 0x4c4], 0
cmp dword [ebp - 0x4c4], 1
je 0x1001bf75
mov dword [ebp - 0x808], 1
jmp 0x1001bf7c
and dword [ebp - 0x808], 0
mov eax, 0x6a3f
cmp eax, 0xffff
jne 0x1001bf91
and dword [ebp - 0x724], 0
jmp 0x1001bf9b
mov dword [ebp - 0x724], 1
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp + eax*4 - 0x14]
cmp eax, dword [ebp - 0x724]
je 0x1001bfb9
mov dword [ebp - 0x4cc], 1
jmp 0x1001bfc0
and dword [ebp - 0x4cc], 0
cmp dword [ebp - 0x4cc], 0xf7cd
jl 0x1001bfd8
mov dword [ebp - 0x62c], 1
jmp 0x1001bfdf
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0x120], eax
jmp 0x1001bee0
mov dword [ebp - 0x120], 0
jmp 0x1001c009
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jg 0x1001c1eb
push 3
lea ecx, [ebp - 0x9d8]
call fcn.1002c4d4
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x6d4], 0x7ece519c
lea eax, [ebp - 0x9d8]
push eax
push 0
lea eax, [ebp - 0xc10]
push eax
push 1
call fcn.1000e5b2
add esp, 0x10
mov esi, dword [ebp - 0x2c8]
push 0
lea ecx, [ebp - 0x9d8]
call fcn.1002c572
cmp dword [eax], esi
jle 0x1001c06e
mov dword [ebp - 0x4d4], 1
jmp 0x1001c075
and dword [ebp - 0x4d4], 0
mov esi, dword [ebp - 0x9ec]
push 0
lea ecx, [ebp - 0x9d8]
call fcn.1002c572
cmp dword [eax], esi
jl 0x1001c098
mov dword [ebp - 0x4dc], 1
jmp 0x1001c09f
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x6d4], eax
mov eax, dword [ebp - 0x6d4]
cmp eax, dword [ebp - 0x4dc]
jl 0x1001c0c5
mov dword [ebp - 0x634], 1
jmp 0x1001c0cc
and dword [ebp - 0x634], 0
push 2
lea ecx, [ebp - 0x9d8]
call fcn.1002c572
mov ecx, dword [ebp - 0x634]
cmp ecx, dword [eax]
jg 0x1001c0ef
mov dword [ebp - 0x4e4], 1
jmp 0x1001c0f6
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x4e4], eax
jge 0x1001c10d
mov dword [ebp - 0x764], 1
jmp 0x1001c114
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x4f4]
cmp dword [ebp - 0x764], eax
jle 0x1001c12e
mov dword [ebp - 0x4ec], 1
jmp 0x1001c135
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x810]
cmp dword [ebp - 0x4ec], eax
jl 0x1001c14f
mov dword [ebp - 0x63c], 1
jmp 0x1001c156
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x63c], eax
je 0x1001c16d
mov dword [ebp - 0x6dc], 1
jmp 0x1001c174
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x4f4]
cmp dword [ebp - 0x6dc], eax
jne 0x1001c18e
mov dword [ebp - 0x8fc], 1
jmp 0x1001c195
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0xc18], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xc20], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x14], 0xffffffff
jle 0x1001c1c1
xor eax, eax
jne 0x1001c1c1
and dword [ebp - 0x4fc], 0
jmp 0x1001c1cb
mov dword [ebp - 0x4fc], 1
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x818], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x9d8]
call fcn.1002c556
jmp 0x1001bffc
jmp 0x1001beb9
jmp 0x1001bc9b
push 0x2040
push 0x24f8
lea eax, [ebp - 0x120]
push eax
push 0
push 1
lea eax, [ebp - 0xb8]
push eax
push 0x20da
call fcn.10018add
add esp, 0x1c
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x644], 0x206b
jge 0x1001c23a
push dword [ebp - 0x984]
call fcn.10049f86
pop ecx
jmp 0x1001c256
mov dword [ebp - 4], 1
jmp 0x1001c266
mov dword [ebp - 0xc28], 0xb8319b88
push 1
push 0x15f7
push 0
push 0x34ca
call fcn.10010912
add esp, 0x10
mov dword [ebp - 0xd30], 0x5d3c095b
mov dword [ebp - 0xd2c], 0x5d3c095b
mov dword [ebp - 0xd28], 0x5d3c095b
mov dword [ebp - 0xd24], 0x5d3c095b
mov dword [ebp - 0x18], 0x48261f9c
mov dword [ebp - 0xc0], 0xbfad0d72
mov dword [ebp - 0x44], 9
mov dword [ebp - 0x108], 0xce17c927
cmp dword [ebp - 0x18], 0
je 0x1001c2f8
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x1001c2f3
push 0
push 1
call fcn.10014f0c
pop ecx
pop ecx
jmp 0x1001ca84
mov dword [ebp - 0x504], 0x4fbf
mov dword [ebp - 0x908], 0x100089a0
cmp dword [ebp - 0x504], 0x51b5
jle 0x1001c426
and dword [ebp - 0x1c8], 0
jmp 0x1001c332
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0x3fbb
jge 0x1001c426
and dword [ebp - 0x240], 0
jmp 0x1001c358
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0x75f9
jge 0x1001c421
and dword [ebp - 0x1c0], 0
jmp 0x1001c37e
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0x135d
jge 0x1001c41c
and dword [ebp - 0x218], 0
jmp 0x1001c3a4
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0x270a
jge 0x1001c417
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0x1c0]
shl eax, cl
mov ecx, dword [ebp - 0x218]
sar eax, cl
or eax, dword [ebp - 0x1c8]
cdq
mov dword [ebp - 0x904], eax
mov dword [ebp - 0x900], edx
push dword [ebp - 0x900]
push dword [ebp - 0x904]
lea ecx, [ebp - 0xe40]
call fcn.1000d0f0
pop ecx
pop ecx
mov dword [ebp - 0x820], eax
mov ecx, dword [ebp - 0x820]
call fcn.1002c39f
push eax
call fcn.10049f86
pop ecx
lea ecx, [ebp - 0xe40]
call fcn.1002c395
jmp 0x1001c397
jmp 0x1001c371
jmp 0x1001c34b
jmp 0x1001c325
mov dword [ebp - 0x348], 0
mov byte [ebp - 4], 0xe
cmp dword [ebp - 0x504], 0x4d06
jge 0x1001c44c
push dword [ebp - 0x908]
call fcn.10049f86
pop ecx
jmp 0x1001c468
mov dword [ebp - 4], 1
jmp 0x1001c478
mov dword [ebp - 0x838], 0xd8e7dfbf
mov dword [ebp - 0x840], 0x1b4c5108
mov dword [ebp - 0x258], 0
jmp 0x1001c4a5
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 1
jge 0x1001c4be
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0x20], 0x9be1d925
jmp 0x1001c498
mov dword [ebp - 0x18], 0
jmp 0x1001c4ce
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x1001ca84
mov dword [ebp - 0x2ac], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0x20]
neg ecx
cmp ecx, dword [ebp + eax - 0x20]
jne 0x1001c503
mov dword [ebp - 0x72c], 1
jmp 0x1001c50a
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x20]
cmp dword [ebp - 0x72c], eax
jle 0x1001c525
mov dword [ebp - 0x754], 1
jmp 0x1001c52c
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x20], 0x87a5
je 0x1001c545
mov dword [ebp - 0x50c], 1
jmp 0x1001c54c
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x50c], eax
jl 0x1001c563
mov dword [ebp - 0x64c], 1
jmp 0x1001c56a
and dword [ebp - 0x64c], 0
cmp dword [ebp - 0x64c], 0
ja 0x1001c57f
mov dword [ebp - 0x514], 1
jmp 0x1001c586
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x20]
add eax, dword [ebp - 0x514]
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x20], 0
jne 0x1001c5a6
and dword [ebp - 0x6e4], 0
jmp 0x1001c5b0
mov dword [ebp - 0x6e4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
cmp dword [ebp - 0x6e4], eax
jge 0x1001c5ce
mov dword [ebp - 0x51c], 1
jmp 0x1001c5d5
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x51c], eax
jge 0x1001c5ec
mov dword [ebp - 0x654], 1
jmp 0x1001c5f3
and dword [ebp - 0x654], 0
cmp dword [ebp - 0x654], 0x3acb
jl 0x1001c60b
mov dword [ebp - 0x524], 1
jmp 0x1001c612
and dword [ebp - 0x524], 0
cmp dword [ebp - 0x524], 0x2db8e964
jle 0x1001c62a
mov dword [ebp - 0x828], 1
jmp 0x1001c631
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x20]
mov dword [ebp - 0xc30], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
mov dword [ebp - 0xc38], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
cmp dword [ebp - 0x754], eax
jne 0x1001c66f
cmp dword [ebp - 0x18], 0
jne 0x1001c66f
and dword [ebp - 0x9b4], 0
jmp 0x1001c679
mov dword [ebp - 0x9b4], 1
mov eax, dword [ebp - 0x18]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x20]
add ecx, dword [ebp + eax*4 - 0x20]
cmp ecx, dword [ebp - 0xc0]
jl 0x1001c69e
mov dword [ebp - 0x52c], 1
jmp 0x1001c6a5
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0x20]
cmp ecx, dword [ebp + eax*4 - 0x20]
jle 0x1001c6ca
mov dword [ebp - 0x65c], 1
jmp 0x1001c6d1
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x65c]
neg eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0
jmp 0x1001c6ec
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jg 0x1001ca7f
mov dword [ebp - 0x914], 0x8db2edfd
mov dword [ebp - 0xc0], 0
jmp 0x1001c719
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jg 0x1001c85c
mov dword [ebp - 0x6ec], 6
push 0x621f
push 0x179b
push 0x2907
push 0x37b9
lea eax, [ebp - 0x2ac]
push eax
push 0
push 0x143e
push 0
push 0x593f
push 0x23ad
push 0x5c99
push 0x6a39
push 0x79f3
push 0xba0
call fcn.10027ef7
add esp, 0x38
xor eax, eax
jne 0x1001c7fd
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x20], 0
jle 0x1001c794
mov dword [ebp - 0x534], 1
jmp 0x1001c79b
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x6ec], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6ec]
cmp ecx, dword [ebp + eax - 0x20]
jg 0x1001c7c5
mov dword [ebp - 0x53c], 1
jmp 0x1001c7cc
and dword [ebp - 0x53c], 0
cmp dword [ebp - 0x53c], 1
je 0x1001c7e1
mov dword [ebp - 0x830], 1
jmp 0x1001c7e8
and dword [ebp - 0x830], 0
mov eax, 0x6a3f
cmp eax, 0xffff
jne 0x1001c7fd
and dword [ebp - 0x54c], 0
jmp 0x1001c807
mov dword [ebp - 0x54c], 1
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0x20]
cmp eax, dword [ebp - 0x54c]
je 0x1001c825
mov dword [ebp - 0x544], 1
jmp 0x1001c82c
and dword [ebp - 0x544], 0
cmp dword [ebp - 0x544], 0xf7cd
jl 0x1001c844
mov dword [ebp - 0x550], 1
jmp 0x1001c84b
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x108], eax
jmp 0x1001c70c
mov dword [ebp - 0x108], 0
jmp 0x1001c875
cmp dword [ebp - 0x108], 0
jg 0x1001ca7a
push 3
lea ecx, [ebp - 0x9e8]
call fcn.1002c4d4
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x310], 0x7ece519c
push 1
lea eax, [ebp - 0x9e8]
push eax
push 0x4b38
push 0x38d8
push 0x26bd
push 1
lea eax, [ebp - 0xc40]
push eax
push 0x68b0
push 0xabf
push 0x3c5d
push 0x42dd
call fcn.1000d5f8
add esp, 0x2c
mov esi, dword [ebp - 0x2ac]
push 0
lea ecx, [ebp - 0x9e8]
call fcn.1002c572
cmp dword [eax], esi
jle 0x1001c8fd
mov dword [ebp - 0x30c], 1
jmp 0x1001c904
and dword [ebp - 0x30c], 0
mov esi, dword [ebp - 0x914]
push 0
lea ecx, [ebp - 0x9e8]
call fcn.1002c572
cmp dword [eax], esi
jl 0x1001c927
mov dword [ebp - 0x318], 1
jmp 0x1001c92e
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x310]
cmp eax, dword [ebp - 0x318]
jl 0x1001c954
mov dword [ebp - 0x320], 1
jmp 0x1001c95b
and dword [ebp - 0x320], 0
push 2
lea ecx, [ebp - 0x9e8]
call fcn.1002c572
mov ecx, dword [ebp - 0x320]
cmp ecx, dword [eax]
jg 0x1001c97e
mov dword [ebp - 0x328], 1
jmp 0x1001c985
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x328], eax
jge 0x1001c99c
mov dword [ebp - 0x330], 1
jmp 0x1001c9a3
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x348]
cmp dword [ebp - 0x330], eax
jle 0x1001c9bd
mov dword [ebp - 0x338], 1
jmp 0x1001c9c4
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x838]
cmp dword [ebp - 0x338], eax
jl 0x1001c9de
mov dword [ebp - 0x340], 1
jmp 0x1001c9e5
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x340], eax
je 0x1001c9fc
jmp 0x1001c6e5
jmp 0x1001c4c7
push 0
push 0x5e53
lea eax, [ebp - 0xc0]
push eax
push 1
lea eax, [ebp - 0x108]
push eax
push 1
call fcn.1001064a
add esp, 0x18
push dword [ebp - 0x54]
lea ecx, [ebp - 0x7c4]
call fcn.1002c572
cmp dword [ebp - 0xc8], 0
jne 0x1001cafe
mov eax, dword [ebp - 0x118]
sub eax, 0x1ec92367
cmp eax, dword [ebp - 0xc8]
jl 0x1001cae2
push dword [ebp - 0x54]
lea ecx, [ebp - 0x7c4]
call fcn.1002c572
cmp dword [eax], 0
je 0x1001caef
push 3
lea ecx, [ebp - 0x7c4]
call fcn.1002c572
cmp dword [ebp - 0x54], 0
jne 0x1001cafe
and dword [ebp - 0x360], 0
jmp 0x1001cb08
mov dword [ebp - 0x360], 1
push 2
lea ecx, [ebp - 0x7c4]
call fcn.1002c572
mov ecx, dword [ebp - 0x360]
cmp ecx, dword [eax]
jg 0x1001cb2b
mov dword [ebp - 0x368], 1
jmp 0x1001cb32
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x54]
sub eax, 0xced4
cmp eax, dword [ebp - 0x368]
jne 0x1001cb4e
mov dword [ebp - 0x370], 1
jmp 0x1001cb55
and dword [ebp - 0x370], 0
push dword [ebp - 0x54]
lea ecx, [ebp - 0x7c4]
call fcn.1002c572
mov ecx, dword [ebp - 0x370]
cmp ecx, dword [eax]
jle 0x1001cb82
cmp dword [ebp - 0x118], 0
je 0x1001cb82
mov dword [ebp - 0x378], 1
jmp 0x1001cb89
and dword [ebp - 0x378], 0
cmp dword [ebp - 0x378], 9
jb 0x1001cba4
cmp dword [ebp - 0xc8], 0
jne 0x1001cba4
and dword [ebp - 0x380], 0
jmp 0x1001cbae
mov dword [ebp - 0x380], 1
cmp dword [ebp - 0x380], 0x9820
jl 0x1001cbc6
mov dword [ebp - 0x388], 1
jmp 0x1001cbcd
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x920], eax
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
jmp 0x1001bab5
push 2
lea ecx, [ebp - 0xa58]
call fcn.1002c4d4
mov byte [ebp - 4], 0x11
mov dword [ebp - 0xc58], 0xbac04ee7
push 0x45ac
push 0x49e5
push 0
push 0x1c8d
push 0x72a
push 1
lea eax, [ebp - 0xa58]
push eax
lea eax, [ebp - 0xc60]
push eax
push 0x52ca
call fcn.100107f0
add esp, 0x24
lea eax, [ebp - 0xa58]
push eax
push 0x3459
push 1
push 0x3913
push 1
push 0
push 0x2a11
call fcn.10019339
add esp, 0x1c
push 0
lea ecx, [ebp - 0xa58]
call fcn.1002c572
cmp dword [eax], 0
je 0x1001cd1f
push 1
lea ecx, [ebp - 0xb1c]
call fcn.1002c4d4
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x1d0], 0
jmp 0x1001cc9d
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 1
jge 0x1001ccbf
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0xb1c]
call fcn.1002c572
mov dword [eax], 0xb401
jmp 0x1001cc90
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x1001cce7
push 1
push 0x6e7c
push 0x438d
push 1
call fcn.1000d90b
add esp, 0x10
push 0
lea ecx, [ebp - 0xb1c]
call fcn.1002c572
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x398]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x398]
mov dword [ecx], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xb1c]
call fcn.1002c556
jmp 0x1001ce90
mov dword [ebp - 0x3a0], 0x72ac
mov dword [ebp - 0x848], 0x10008a20
cmp dword [ebp - 0x3a0], 0x75a9
jle 0x1001cdb6
and dword [ebp - 0x220], 0
jmp 0x1001cd55
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0x215c
jge 0x1001cdb6
and dword [ebp - 0x1d8], 0
jmp 0x1001cd77
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0x5f70
jge 0x1001cdb4
mov eax, dword [ebp - 0x220]
xor eax, dword [ebp - 0x1d8]
cdq
mov dword [ebp - 0x910], eax
mov dword [ebp - 0x90c], edx
push dword [ebp - 0x90c]
push dword [ebp - 0x910]
mov ecx, 0x10607df8
call fcn.1002c3bf
jmp 0x1001cd6a
jmp 0x1001cd48
push 3
lea ecx, [ebp - 0xb4c]
call fcn.1002c4d4
mov byte [ebp - 4], 0x13
mov byte [ebp - 4], 0x14
cmp dword [ebp - 0x3a0], 0x6fa5
jge 0x1001cde7
mov edx, dword [ebp - 0x848]
mov ecx, 0x10607df8
call fcn.1002de69
jmp 0x1001ce03
mov dword [ebp - 4], 0x13
jmp 0x1001ce13
mov dword [ebp - 0x58], 0
jmp 0x1001ce23
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x1001ce3f
push dword [ebp - 0x58]
lea ecx, [ebp - 0xb4c]
call fcn.1002c572
mov dword [eax], 0xfffffffb
jmp 0x1001ce1c
mov dword [ebp - 0x58], 0
jmp 0x1001ce4f
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 4
jge 0x1001ce65
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0xd88], 1
jmp 0x1001ce48
push 4
pop eax
imul esi, eax, 0
push 2
lea ecx, [ebp - 0xb4c]
call fcn.1002c572
mov eax, dword [eax]
mov dword [ebp + esi - 0xd88], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xb4c]
call fcn.1002c556
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa58]
call fcn.1002c556
mov dword [ebp - 0x3a8], 0x46
mov dword [ebp - 0x9dc], 0x10008a94
cmp dword [ebp - 0x3a8], 0x2ec
jle 0x1001cf75
and dword [ebp - 0x158], 0
jmp 0x1001ced9
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0x78cd
jge 0x1001cf6d
and dword [ebp - 0x248], 0
jmp 0x1001ceff
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0x2dd0
jge 0x1001cf68
and dword [ebp - 0x1e0], 0
jmp 0x1001cf21
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0x48f1
jge 0x1001cf66
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0x1e0]
shl eax, cl
or eax, dword [ebp - 0x158]
cdq
mov dword [ebp - 0x91c], eax
mov dword [ebp - 0x918], edx
push dword [ebp - 0x918]
push dword [ebp - 0x91c]
mov ecx, 0x10607df8
call fcn.1002c3bf
jmp 0x1001cf14
jmp 0x1001cef2
jmp 0x1001cecc
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov byte [ebp - 0xb9], 0
mov byte [ebp - 4], 0x16
cmp dword [ebp - 0x3a8], 0x39
jge 0x1001cf99
mov edx, dword [ebp - 0x9dc]
mov ecx, 0x10607df8
call fcn.1002de69
jmp 0x1001cfb5
mov dword [ebp - 4], 1
jmp 0x1001cfc5
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x1001d08e
mov dword [ebp - 0xae0], 1
mov dword [ebp - 0xadc], 1
mov dword [ebp - 0xad8], 1
mov dword [ebp - 0xad4], 1
lea ecx, [ebp - 0x2b9]
call fcn.1002c581
push eax
lea eax, [ebp - 0xad0]
push eax
lea eax, [ebp - 0xae0]
push eax
lea ecx, [ebp - 0xda8]
call fcn.1002c584
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xca8]
call fcn.1002c530
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x850], 0xc4d8e5cc
push 0
push 0x5650
push 0
lea eax, [ebp - 0x850]
push eax
push 0x190e
push 0x7e6f
push 1
lea eax, [ebp - 0xca8]
push eax
push 0x8e4
push 0x1dc9
call fcn.10010ab9
add esp, 0x28
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xca8]
call fcn.1002c556
push 0x1213
call dword [sym.imp.USER32.dll_GetQueueStatus]
jmp 0x1001b1d9
push 3
lea ecx, [ebp - 0xa4c]
call fcn.1002c4d4
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x3b8], 0x90be
mov dword [ebp - 0x2b4], 0x85a9576c
push 3
lea ecx, [ebp - 0xb34]
call fcn.1002c4d4
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x3c0], 5
mov dword [ebp - 0xc68], 0x5bbbdebf
mov dword [ebp - 0x5c], 0
jmp 0x1001d0ed
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x1001d106
push dword [ebp - 0x5c]
lea ecx, [ebp - 0xa4c]
call fcn.1002c572
or dword [eax], 0xffffffff
jmp 0x1001d0e6
mov dword [ebp - 0x5c], 0
jmp 0x1001d116
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x1001d132
push dword [ebp - 0x5c]
lea ecx, [ebp - 0xb34]
call fcn.1002c572
mov dword [eax], 1
jmp 0x1001d10f
push 0
lea ecx, [ebp - 0xa4c]
call fcn.1002c572
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x3b8]
mov ecx, dword [ebp - 0x2e0]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x2e0]
mov edx, dword [edx]
dec edx
mov esi, dword [ebp - 0x2e0]
mov dword [esi], edx
cmp ecx, eax
jle 0x1001d189
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0
je 0x1001d189
mov dword [ebp - 0x3b0], 1
jmp 0x1001d190
and dword [ebp - 0x3b0], 0
push 1
lea ecx, [ebp - 0xb34]
call fcn.1002c572
mov dword [eax], 0x1b66bafc
mov eax, dword [ebp - 0x3b0]
add eax, 0x1b66bafc
mov dword [ebp - 0x3c0], eax
push 0x7263
push 1
push 1
push 0x78f0
push 0x2f75
lea eax, [ebp - 0x3b8]
push eax
push 0x4650
push 0x4858
lea eax, [ebp - 0xa4c]
push eax
push 0x1891
lea eax, [ebp - 0x3c0]
push eax
push 0x6697
call fcn.1000d9b0
add esp, 0x30
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xb34]
call fcn.1002c556
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa4c]
call fcn.1002c556
mov byte [ebp - 0xdb], 0
mov dword [ebp - 0xaa4], 0x713b9102
mov dword [ebp - 0xaa0], 0x713b9102
mov dword [ebp - 0xa9c], 0x713b9102
mov dword [ebp - 0xa98], 0x713b9102
lea ecx, [ebp - 0x26d]
call fcn.1002c581
push eax
lea eax, [ebp - 0xa94]
push eax
lea eax, [ebp - 0xaa4]
push eax
lea ecx, [ebp - 0xd90]
call fcn.1002c584
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2f8]
call fcn.1002c530
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x2d0], 0xd04cd021
mov dword [ebp - 0x40], 3
jmp 0x1001d29f
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x1001d7a9
mov dword [ebp - 0x94], 1
mov dword [ebp - 0x3d8], 1
mov dword [ebp - 0x450], 0x69eed08e
mov dword [ebp - 0x94], 3
jmp 0x1001d2e0
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x1001d7a4
mov dword [ebp - 0xf4], 0xffffffff
mov dword [ebp - 0x3f8], 0xfffffff8
mov dword [ebp - 0xfc], 0xfffffff8
mov dword [ebp - 0x15c], 0
jmp 0x1001d324
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 1
jge 0x1001d340
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x144], 0x21c760fc
jmp 0x1001d317
mov dword [ebp - 0xf4], 3
jmp 0x1001d359
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
jl 0x1001d72b
mov dword [ebp - 0x4c], 0xabe8f210
mov dword [ebp - 0x92c], 1
mov dword [ebp - 0x4c], 3
jmp 0x1001d387
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x1001d6b9
mov dword [ebp - 0x164], 0
jmp 0x1001d3aa
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 3
jge 0x1001d3c6
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0xd5c], 0xff7503ae
jmp 0x1001d39d
push dword [ebp - 0x40]
lea ecx, [ebp - 0x2f8]
call fcn.1002c572
mov dword [ebp - 0x3c8], eax
push dword [ebp - 0x40]
lea ecx, [ebp - 0x2f8]
call fcn.1002c572
mov ecx, dword [ebp - 0x3c8]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x3c8]
cmp dword [eax], 0
je 0x1001d60a
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 1
jne 0x1001d41f
mov dword [ebp - 0x3d0], 1
jmp 0x1001d426
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x3d8], eax
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0xb5c], eax
cmp dword [ebp - 0x94], 0
je 0x1001d45c
mov eax, 0x956a218f
test eax, eax
je 0x1001d45c
mov dword [ebp - 0x3e0], 1
jmp 0x1001d463
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x3e0], eax
jge 0x1001d47d
mov dword [ebp - 0x3e8], 1
jmp 0x1001d484
and dword [ebp - 0x3e8], 0
push 1
lea ecx, [ebp - 0x2f8]
call fcn.1002c572
mov ecx, dword [ebp - 0x3e8]
cmp ecx, dword [eax]
jle 0x1001d4a7
mov dword [ebp - 0x3f0], 1
jmp 0x1001d4ae
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x3f0]
neg eax
mov dword [ebp - 0x3f8], eax
mov esi, dword [ebp - 0x3f8]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x2f8]
call fcn.1002c572
add esi, dword [eax]
mov dword [ebp - 0xfc], esi
mov esi, dword [ebp - 0x4c]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x2f8]
call fcn.1002c572
mov eax, dword [eax]
sub eax, 0x46ecff2d
cmp eax, esi
jge 0x1001d500
mov dword [ebp - 0x400], 1
jmp 0x1001d507
and dword [ebp - 0x400], 0
push dword [ebp - 0x40]
lea ecx, [ebp - 0x2f8]
call fcn.1002c572
mov ecx, dword [ebp - 0x400]
cmp ecx, dword [eax]
jle 0x1001d52b
mov dword [ebp - 0x408], 1
jmp 0x1001d532
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x408], eax
jle 0x1001d54c
mov dword [ebp - 0x410], 1
jmp 0x1001d553
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0x410]
jl 0x1001d56d
mov dword [ebp - 0x418], 1
jmp 0x1001d574
and dword [ebp - 0x418], 0
cmp dword [ebp - 0x418], 0xfffffffb
jg 0x1001d589
mov dword [ebp - 0x420], 1
jmp 0x1001d590
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x450], eax
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0xd5c]
mov dword [ebp - 0x428], eax
push 2
lea ecx, [ebp - 0x2f8]
call fcn.1002c572
mov ecx, dword [ebp - 0x428]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x428]
cmp dword [ecx], eax
je 0x1001d5e2
mov dword [ebp - 0x308], 1
jmp 0x1001d5e9
and dword [ebp - 0x308], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x144]
cmp dword [ebp - 0x308], eax
jge 0x1001d60a
mov dword [ebp - 0x438], 1
jmp 0x1001d611
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x438], eax
je 0x1001d62b
mov dword [ebp - 0x440], 1
jmp 0x1001d632
and dword [ebp - 0x440], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x144]
add ecx, dword [ebp - 0x440]
cmp ecx, dword [ebp + eax - 0x144]
jle 0x1001d660
mov dword [ebp - 0x448], 1
jmp 0x1001d667
and dword [ebp - 0x448], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x92c]
imul ecx, dword [ebp - 0x448]
add ecx, dword [ebp + eax - 0x144]
je 0x1001d6a9
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x1001d6a7
push 0x1dbc
push 0x1fee
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
jmp 0x1001d6b4
cmp dword [ebp - 0xfc], 0
je 0x1001d6b4
jmp 0x1001d6b9
jmp 0x1001d380
mov dword [ebp - 0x4c], 0
jmp 0x1001d6c9
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jg 0x1001d726
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x1001d724
push 1
push 0x6e98
push 0x44af
push 0
push 0x12f6
push 0x90b
push 0x1848
push 0x5375
push 0x3b9c
push 0x46b8
push 0x482
push 0x3526
push 0x151c
call fcn.10012c43
add esp, 0x34
jmp 0x1001d6c2
jmp 0x1001d34c
mov dword [ebp - 0xfc], 0
jmp 0x1001d744
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 3
jg 0x1001d79f
mov dword [ebp - 0x450], 0xfffffffc
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x144], 0x276c
push dword [ebp - 0x40]
lea ecx, [ebp - 0x2f8]
call fcn.1002c572
cmp dword [eax], 0xffff
jb 0x1001d78a
mov dword [ebp - 0x458], 1
jmp 0x1001d791
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x2d0], eax
jmp 0x1001d737
jmp 0x1001d2d3
jmp 0x1001d298
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2f8]
call fcn.1002c556
push 0xdf
push 0
push 0x3dd4
push 0x4971
push 0x1902
push 1
lea eax, [ebp - 0xdb]
push eax
push 0x29f9
call fcn.10025cbb
add esp, 0x20
jmp 0x1001a526
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c4]
call fcn.1002c556
mov dword [ebp - 0x104], 0xa0b8ee41
mov dword [ebp - 0x994], 0x5aad8530
mov dword [ebp - 0x4a8], 0xfffffffb
mov dword [ebp - 0x10c], 8
mov dword [ebp - 0x858], 0xb5a26cde
mov dword [ebp - 0x480], 0
mov dword [ebp - 0x4b8], 0xab72
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x4a0], 0xcdab0b82
mov dword [ebp - 0x868], 0xfffffff9
mov dword [ebp - 0x870], 0
lea eax, [ebp - 0x4a0]
push eax
push 0x306a
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0x994]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x4af6
lea eax, [ebp - 0x4a8]
push eax
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0x274]
push eax
push 0
push 0
push 0x2184
lea eax, [ebp - 0x480]
push eax
call fcn.10012180
add esp, 0x38
mov dword [ebp - 0x10c], 0
jmp 0x1001d8d9
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xa
jl 0x1001dc55
mov dword [ebp - 0x460], 0x6431
mov dword [ebp - 0x938], 0x10008af8
cmp dword [ebp - 0x460], 0x67dd
jle 0x1001d9aa
and dword [ebp - 0x16c], 0
jmp 0x1001d920
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0x1f2a
jge 0x1001d9aa
and dword [ebp - 0x174], 0
jmp 0x1001d942
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0x6d30
jge 0x1001d9a5
mov eax, dword [ebp - 0x16c]
sub eax, dword [ebp - 0x174]
cdq
mov dword [ebp - 0x928], eax
mov dword [ebp - 0x924], edx
push dword [ebp - 0x924]
push dword [ebp - 0x928]
lea ecx, [ebp - 0xde0]
call fcn.1000d0f0
pop ecx
pop ecx
mov dword [ebp - 0x860], eax
mov ecx, dword [ebp - 0x860]
call fcn.1002c39f
push eax
call fcn.10049f86
pop ecx
lea ecx, [ebp - 0xde0]
call fcn.1002c395
jmp 0x1001d935
jmp 0x1001d913
mov dword [ebp - 4], 0x1c
cmp dword [ebp - 0x460], 0x6401
jge 0x1001d9c9
push dword [ebp - 0x938]
call fcn.10049f86
pop ecx
jmp 0x1001d9e5
or dword [ebp - 4], 0xffffffff
jmp 0x1001d9ef
mov dword [ebp - 0x9bc], 0xffffffff
mov dword [ebp - 0x4c0], 1
mov dword [ebp - 0x878], 0x50551b70
mov dword [ebp - 0x17c], 0
jmp 0x1001da26
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 4
jge 0x1001da42
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0xa10], 1
jmp 0x1001da19
mov dword [ebp - 0x104], 0xc
jmp 0x1001da5b
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x3c
jl 0x1001db4f
mov dword [ebp - 0x468], 0xfffffff6
cmp dword [ebp - 0x468], 0
jne 0x1001da87
mov dword [ebp - 0x470], 1
jmp 0x1001da8e
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x468]
cmp dword [ebp - 0x470], eax
jne 0x1001daa8
mov dword [ebp - 0x478], 1
jmp 0x1001daaf
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x868]
add eax, dword [ebp - 0x478]
cmp eax, dword [ebp - 0x480]
jle 0x1001dacf
mov dword [ebp - 0x488], 1
jmp 0x1001dad6
and dword [ebp - 0x488], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa10]
add eax, dword [ebp - 0x488]
je 0x1001dafc
or eax, 0xffffffff
je 0x1001dafc
mov dword [ebp - 0x490], 1
jmp 0x1001db03
and dword [ebp - 0x490], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x490]
sub ecx, dword [ebp + eax - 0xa10]
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa10]
sub eax, ecx
cmp eax, dword [ebp - 0x9bc]
jle 0x1001db37
mov dword [ebp - 0x498], 1
jmp 0x1001db3e
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x4a0], eax
jmp 0x1001da4e
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x4a8]
cmp eax, dword [ebp - 0x274]
jge 0x1001db75
mov dword [ebp - 0x4b0], 1
jmp 0x1001db7c
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x4b0], eax
je 0x1001db96
mov dword [ebp - 0x944], 1
jmp 0x1001db9d
and dword [ebp - 0x944], 0
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0xc78], eax
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0xcf0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa10]
mov dword [ebp - 0xcf8], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xd00], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xa10], 0
jne 0x1001dbfa
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xa10], 0
jne 0x1001dbfa
and dword [ebp - 0x4c8], 0
jmp 0x1001dc04
mov dword [ebp - 0x4c8], 1
mov eax, dword [ebp - 0x4c0]
cmp dword [ebp - 0x4c8], eax
jl 0x1001dc1e
mov dword [ebp - 0x4d0], 1
jmp 0x1001dc25
and dword [ebp - 0x4d0], 0
cmp dword [ebp - 0x4d0], 0xbd9b76f
jl 0x1001dc3d
mov dword [ebp - 0x4d8], 1
jmp 0x1001dc44
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x878], eax
jmp 0x1001d8cc
mov eax, dword [ebp - 0x224]
mov eax, dword [eax + 4]
mov dword [ebp - 0x718], eax
mov dword [ebp - 0xd08], 0xffffffff
mov dword [ebp - 0xd38], 0xffffffff
mov dword [ebp - 0xd40], 0xffffffff
mov dword [ebp - 0xd48], 1
mov dword [ebp - 0xd50], 0xb25b3b9d
mov dword [ebp - 0xce4], 0xff82ff40
mov dword [ebp - 0xc3c], 0xa7275995
mov dword [ebp - 0xb90], 0xbd2ab60e
mov dword [ebp - 0xb68], 4
mov dword [ebp - 0xd0c], 0x5e1f6f08
mov dword [ebp - 0xb70], 0x1a9c2132
mov dword [ebp - 0xc44], 0
mov dword [ebp - 0xb78], 0x257ea0d0
mov dword [ebp - 0xcdc], 1
mov dword [ebp - 0xb80], 0xf88039d6
mov dword [ebp - 0xc4c], 0x21ec2184
mov dword [ebp - 0x99c], 0
mov dword [ebp - 0x64], 0
jmp 0x1001dd1e
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x1001dd34
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xda0], 0x81eca6c8
jmp 0x1001dd17
mov dword [ebp - 0x64], 0
jmp 0x1001dd44
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x1001dd5a
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xe68], 0x83a0f0f5
jmp 0x1001dd3d
lea eax, [ebp - 0x99c]
push eax
push 0x55f
push 0
push 1
push 0x1855
call fcn.1000ef7d
add esp, 0x14
mov dword [ebp - 0x518], 0xffffffff
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x13c], 1
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xb8c], eax
cmp dword [ebp - 0x34], 0x1ec2
jne 0x1001ddb0
mov dword [ebp - 0x4e0], 1
jmp 0x1001ddb7
and dword [ebp - 0x4e0], 0
cmp dword [ebp - 0x4e0], 2
jne 0x1001ddcc
mov dword [ebp - 0x4e8], 1
jmp 0x1001ddd3
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x4e8], eax
jle 0x1001ddea
mov dword [ebp - 0x4f0], 1
jmp 0x1001ddf1
and dword [ebp - 0x4f0], 0
mov eax, 0x4d03
sub eax, dword [ebp - 0x4f0]
cmp eax, 0xf0f5ebe
jge 0x1001de0f
mov dword [ebp - 0x4f8], 1
jmp 0x1001de16
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x4f8], eax
jne 0x1001de2d
mov dword [ebp - 0x500], 1
jmp 0x1001de34
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x500]
sub eax, dword [ebp - 0x34]
sub eax, 7
imul eax, dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jge 0x1001de55
mov dword [ebp - 0x880], 1
jmp 0x1001de5c
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xce0], eax
cmp dword [ebp - 0x34], 0xcea445a8
jb 0x1001de7f
xor eax, eax
inc eax
je 0x1001de7f
mov dword [ebp - 0x508], 1
jmp 0x1001de86
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x508], eax
jl 0x1001de9d
mov dword [ebp - 0x510], 1
jmp 0x1001dea4
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x518], 8
cmp dword [ebp - 0x518], 0x2b79dc86
jne 0x1001decf
mov dword [ebp - 0x520], 1
jmp 0x1001ded6
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x13c], 0
jmp 0x1001defb
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0x26
jl 0x1001e00c
mov dword [ebp - 0x528], 0x5aba9a98
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x1001df50
push 0xa7e
push 0x5260
push 1
push 0x2bc0
push 0x7ee8
push 0
push 0x1361
push 0x21aa
push 1
call fcn.10025087
add esp, 0x24
mov dword [ebp - 0x34], 1
jmp 0x1001df60
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x12
jle 0x1001e007
mov dword [ebp - 0xa68], 0x7073
mov dword [ebp - 0xa64], 0x7073
mov dword [ebp - 0xa60], 0x7073
mov dword [ebp - 0xa5c], 0x7073
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x1001dfaf
push 0x1ec3
call dword [sym.imp.USER32.dll_MessageBeep]
cmp dword [ebp - 0x528], 0
je 0x1001dfcf
mov dword [ebp - 0x950], 0x4489
cmp dword [ebp - 0x950], 0
je 0x1001dfcd
jmp 0x1001e007
jmp 0x1001e002
mov dword [ebp - 0xb94], 0xffffffff
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa68]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xa68], eax
cmp dword [ebp - 0x528], 0
je 0x1001e002
jmp 0x1001df59
jmp 0x1001df59
jmp 0x1001deee
push 4
lea ecx, [ebp - 0xa28]
call fcn.1002c4d4
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x8d0], 0x33f2
mov dword [ebp - 0xc54], 0xa049fe38
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x1001e095
push 0x4560
push 0x6ea2
push 0x3425
push 0x332f
push 0x60aa
push 0x6faa
push 0x6a67
push 0x6344
push 0x64df
push 1
push 0x6f5
push 1
push 0
push 0x19f
push 0x60f
push 0x59f1
call fcn.10011174
add esp, 0x40
mov byte [ebp - 0xd7], 0
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x1001e0d3
push 0x7ba2
push 0x1a81
push 0x5209
push 1
push 0
push 0
push 0x2a1c
push 0x6866
push 0x249
call fcn.10011a5c
add esp, 0x24
mov dword [ebp - 0x9cc], 0
mov dword [ebp - 0x588], 3
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x548], 0xc25bfc88
mov dword [ebp - 0x134], 0xffffffff
push 3
lea ecx, [ebp - 0xa1c]
call fcn.1002c4d4
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x888], 0xb564
push 1
lea ecx, [ebp - 0x9f8]
call fcn.1002c4d4
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x9fc], 0
mov dword [ebp - 0x890], 8
mov dword [ebp - 0x38], 0
jmp 0x1001e155
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1001e16b
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xa34], 0xfffffffc
jmp 0x1001e14e
mov dword [ebp - 0x38], 0
jmp 0x1001e17b
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1001e197
push dword [ebp - 0x38]
lea ecx, [ebp - 0xa1c]
call fcn.1002c572
mov dword [eax], 0xfffffff6
jmp 0x1001e174
mov dword [ebp - 0x38], 0
jmp 0x1001e1a7
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1001e1c3
push dword [ebp - 0x38]
lea ecx, [ebp - 0x9f8]
call fcn.1002c572
mov dword [eax], 0xfffe
jmp 0x1001e1a0
push 1
lea eax, [ebp - 0x588]
push eax
lea eax, [ebp - 0xa1c]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x548]
push eax
push 0x41fb
lea eax, [ebp - 0x888]
push eax
push 0x1190
lea eax, [ebp - 0x9f8]
push eax
lea eax, [ebp - 0x134]
push eax
push 0
call fcn.1000f816
add esp, 0x2c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa34]
imul eax, dword [ebp - 0x134]
test eax, eax
je 0x1001e456
mov dword [ebp - 0x184], 0xf156
mov dword [ebp - 0x288], 8
mov dword [ebp - 0x290], 1
mov dword [ebp - 0x580], 1
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0
je 0x1001e27f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa34], 0
je 0x1001e27f
mov dword [ebp - 0x530], 1
jmp 0x1001e286
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x530], eax
jge 0x1001e2a0
mov dword [ebp - 0x568], 1
jmp 0x1001e2a7
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x184]
cmp eax, dword [ebp - 0x184]
jg 0x1001e2c1
mov dword [ebp - 0x538], 1
jmp 0x1001e2c8
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x290], eax
mov esi, dword [ebp - 0x290]
push 0
lea ecx, [ebp - 0x9f8]
call fcn.1002c572
cmp esi, dword [eax]
jle 0x1001e2f7
mov dword [ebp - 0x540], 1
jmp 0x1001e2fe
and dword [ebp - 0x540], 0
imul eax, dword [ebp - 0x540], 0
test eax, eax
je 0x1001e327
push 0
lea ecx, [ebp - 0x9f8]
call fcn.1002c572
cmp dword [eax], 0
je 0x1001e327
mov dword [ebp - 0x560], 1
jmp 0x1001e32e
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x548]
cmp dword [ebp - 0x560], eax
jle 0x1001e348
mov dword [ebp - 0x570], 1
jmp 0x1001e34f
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x568]
cmp eax, dword [ebp - 0x570]
jne 0x1001e369
mov dword [ebp - 0x578], 1
jmp 0x1001e370
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x578]
mov dword [ebp - 0x580], eax
mov dword [ebp - 0x134], 1
mov eax, dword [ebp - 0x134]
sub eax, dword [ebp - 0x288]
cmp dword [ebp - 0x9fc], eax
jg 0x1001e3a6
mov dword [ebp - 0x590], 1
jmp 0x1001e3ad
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x890]
mov dword [ebp - 0xb9c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xa34], 0x6a6c3430
je 0x1001e3d2
cmp dword [ebp - 0x580], 0
cmp dword [ebp - 0x588], 0x181ca8fd
je 0x1001e3ea
mov dword [ebp - 0x598], 1
jmp 0x1001e3f1
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x590]
cmp eax, dword [ebp - 0x598]
jl 0x1001e40b
mov dword [ebp - 0x5a0], 1
jmp 0x1001e412
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x290]
imul eax, dword [ebp - 0x5a0]
cmp eax, dword [ebp - 0x114]
jl 0x1001e433
mov dword [ebp - 0x5a8], 1
jmp 0x1001e43a
and dword [ebp - 0x5a8], 0
imul eax, dword [ebp - 0x5a8], 0xfffc
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xa34], eax
jmp 0x1001e5a3
mov dword [ebp - 0x5c8], 1
mov dword [ebp - 0x114], 0
jmp 0x1001e479
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xffffffe8
jl 0x1001e5a3
mov dword [ebp - 0x5b0], 0x934b
mov dword [ebp - 0x95c], 0xd66052db
cmp dword [ebp - 0x5b0], 0xc0db1b79
jne 0x1001e4b2
mov dword [ebp - 0x5b8], 1
jmp 0x1001e4b9
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x5b0]
cmp eax, dword [ebp - 0x5b8]
jne 0x1001e4d3
mov dword [ebp - 0x5c0], 1
jmp 0x1001e4da
and dword [ebp - 0x5c0], 0
cmp dword [ebp - 0x5c0], 0
jbe 0x1001e4ef
mov dword [ebp - 0x5d0], 1
jmp 0x1001e4f6
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x5c8]
mov dword [ebp - 0xce8], eax
cmp dword [ebp - 0x5c8], 0
je 0x1001e51b
xor eax, eax
je 0x1001e51b
mov dword [ebp - 0x5d8], 1
jmp 0x1001e522
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x5d0]
cmp eax, dword [ebp - 0x5d8]
jl 0x1001e53c
mov dword [ebp - 0x5e0], 1
jmp 0x1001e543
and dword [ebp - 0x5e0], 0
push 2
lea ecx, [ebp - 0xa1c]
call fcn.1002c572
mov ecx, dword [ebp - 0x5e0]
cmp ecx, dword [eax]
jg 0x1001e566
mov dword [ebp - 0x5e8], 1
jmp 0x1001e56d
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x134]
add eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x95c], eax
mov byte [ebp - 0xcc], 0
lea eax, [ebp - 0xcc]
push eax
push 1
push 0x7e39
push 1
call fcn.1000df1d
add esp, 0x10
jmp 0x1001e46c
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x9f8]
call fcn.1002c556
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xa1c]
call fcn.1002c556
mov dword [ebp - 0x8e0], 0x738f5859
mov dword [ebp - 0x194], 2
mov dword [ebp - 0xba4], 0x3d4210e1
mov dword [ebp - 0xc5c], 6
mov dword [ebp - 0xbac], 0x6b47
mov dword [ebp - 0xd3c], 0x6f65e790
mov dword [ebp - 0xbb4], 0x6e6a3735
mov dword [ebp - 0xc64], 0xffffffff
push 4
lea ecx, [ebp - 0xcc8]
call fcn.1002c4d4
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x898], 0xffffffff
mov dword [ebp - 0x5f0], 0x1dd79339
mov dword [ebp - 0x18c], 0
jmp 0x1001e64f
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 4
jge 0x1001e671
push dword [ebp - 0x18c]
lea ecx, [ebp - 0xcc8]
call fcn.1002c572
mov dword [eax], 0xa7b051af
jmp 0x1001e642
mov dword [ebp - 0x194], 0xfffffff6
jmp 0x1001e68a
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0xfffffff8
jge 0x1001e70d
push 2
lea ecx, [ebp - 0xcb8]
call fcn.1002c4d4
mov byte [ebp - 4], 0x22
mov dword [ebp - 0xbbc], 0x6942a1e9
push 0x5026
push 0x73a3
push 0
lea eax, [ebp - 0xcb8]
push eax
push 0x3529
push 1
lea eax, [ebp - 0xcec]
push eax
call fcn.10015055
add esp, 0x1c
push 0
push 0x25f3
lea eax, [ebp - 0x898]
push eax
push 0xfa
push 0x17a4
push 0
call fcn.1002831c
add esp, 0x18
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xcb8]
call fcn.1002c556
jmp 0x1001e67d
mov eax, dword [ebp - 0x5f0]
dec eax
mov dword [ebp - 0x5f0], eax
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xcc8]
call fcn.1002c556
mov dword [ebp - 0x974], 0xe924f63a
push 4
lea ecx, [ebp - 0xb10]
call fcn.1002c4d4
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x19c], 0xaa32b1ce
lea eax, [ebp - 0xb10]
push eax
push 0x781c
lea eax, [ebp - 0xbc4]
push eax
push 0x75e0
push 0x630f
push 0xe40
push 0x4e17
push 0
call fcn.10028487
add esp, 0x20
mov dword [ebp - 0x19c], 0
jmp 0x1001e798
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 3
jg 0x1001e834
push 1
lea ecx, [ebp - 0xaf8]
call fcn.1002c4d4
mov byte [ebp - 4], 0x24
lea eax, [ebp - 0xc6c]
push eax
push 1
lea eax, [ebp - 0xaf8]
push eax
push 0x5b31
push 0
push 1
call fcn.10025eae
add esp, 0x18
mov byte [ebp - 0xdc], 0
movzx eax, byte [ebp - 0xdc]
test eax, eax
je 0x1001e7ff
push 0x35e7
push 1
push 0xe6d
push 1
call fcn.1000e5b2
add esp, 0x10
push 1
lea eax, [ebp - 0xb10]
push eax
push 0
push 1
lea eax, [ebp - 0xaf8]
push eax
push 0xb7d
call fcn.10014aeb
add esp, 0x18
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0xaf8]
call fcn.1002c556
jmp 0x1001e78b
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xb10]
call fcn.1002c556
mov dword [ebp - 0x8a8], 0x6dabac8e
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0xbcc], 0x443250e6
mov dword [ebp - 0x1a4], 0
jmp 0x1001e87a
mov eax, dword [ebp - 0x1a4]
dec eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0xfffffff8
jne 0x1001e9e4
mov dword [ebp - 0x5f8], 0x7087
mov dword [ebp - 0x8a0], 0x10008b70
cmp dword [ebp - 0x5f8], 0x73ec
jle 0x1001e982
and dword [ebp - 0x1ac], 0
jmp 0x1001e8c1
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0x25f5
jge 0x1001e982
and dword [ebp - 0x1b4], 0
jmp 0x1001e8e7
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0x3896
jge 0x1001e97d
and dword [ebp - 0x150], 0
jmp 0x1001e90d
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0x20c6
jge 0x1001e978
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [ebp - 0x1b4]
shl eax, cl
xor eax, dword [ebp - 0x150]
cdq
mov dword [ebp - 0x934], eax
mov dword [ebp - 0x930], edx
push dword [ebp - 0x930]
push dword [ebp - 0x934]
lea ecx, [ebp - 0xe28]
call fcn.1000d0f0
pop ecx
pop ecx
mov dword [ebp - 0x9a4], eax
mov ecx, dword [ebp - 0x9a4]
call fcn.1002c39f
push eax
call fcn.10049f86
pop ecx
lea ecx, [ebp - 0xe28]
call fcn.1002c395
jmp 0x1001e900
jmp 0x1001e8da
jmp 0x1001e8b4
mov dword [ebp - 0x968], 0xa2cb51db
mov byte [ebp - 4], 0x25
cmp dword [ebp - 0x5f8], 0x7036
jge 0x1001e9a8
push dword [ebp - 0x8a0]
call fcn.10049f86
pop ecx
jmp 0x1001e9c4
mov dword [ebp - 4], 0x1e
jmp 0x1001e9d4
cmp dword [ebp - 0x968], 0
je 0x1001e9df
jmp 0x1001e9e4
jmp 0x1001e86d
mov byte [ebp - 0xce], 0
movzx eax, byte [ebp - 0xce]
test eax, eax
je 0x1001ea0c
push 1
push 0x946
push 0x660
push 1
call fcn.1000e87b
add esp, 0x10
mov dword [ebp - 0x8b0], 3
mov dword [ebp - 0x8b8], 0
mov dword [ebp - 0x8c4], 0xffff
mov dword [ebp - 0x8e8], 0xffffffff
lea eax, [ebp - 0xa28]
push eax
push 0x345a
push 0
push 0x929
lea eax, [ebp - 0xd20]
push eax
call fcn.10026652
add esp, 0x14
push 3
lea ecx, [ebp - 0xa28]
call fcn.1002c572
mov dword [eax], 0xc64a6847
lea eax, [ebp - 0xa28]
push eax
lea eax, [ebp - 0x8a8]
push eax
lea eax, [ebp - 0x9cc]
push eax
lea eax, [ebp - 0x8b0]
push eax
push 0x45b7
lea eax, [ebp - 0x974]
push eax
lea eax, [ebp - 0x8b8]
push eax
lea eax, [ebp - 0x8e0]
push eax
lea eax, [ebp - 0x8c4]
push eax
push 0
lea eax, [ebp - 0x8e8]
push eax
push 1
lea eax, [ebp - 0x8d0]
push eax
push 0x7e03
call fcn.10012d0a
add esp, 0x38
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa28]
call fcn.1002c556
push 1
lea ecx, [ebp - 0xb28]
call fcn.1002c4d4
mov dword [ebp - 4], 0x27
mov dword [ebp - 0x1cc], 3
push 1
push 0x606e
push 1
push 0x7230
lea eax, [ebp - 0xbd4]
push eax
push 0x6d5
push 0
push 0x55d4
push 0x5833
lea eax, [ebp - 0xb28]
push eax
call fcn.10010ab9
add esp, 0x28
mov dword [ebp - 0x600], 0x3441
mov dword [ebp - 0x8f0], 0x10008bf0
cmp dword [ebp - 0x600], 0x37dd
jle 0x1001ebc1
and dword [ebp - 0x154], 0
jmp 0x1001eb5d
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0x1dea
jge 0x1001ebc1
and dword [ebp - 0x1c4], 0
jmp 0x1001eb7f
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0x22f8
jge 0x1001ebbf
mov eax, dword [ebp - 0x154]
cdq
idiv dword [ebp - 0x1c4]
mov eax, edx
cdq
mov dword [ebp - 0x940], eax
mov dword [ebp - 0x93c], edx
push dword [ebp - 0x93c]
push dword [ebp - 0x940]
mov ecx, 0x10607df8
call fcn.1002c3bf
jmp 0x1001eb72
jmp 0x1001eb50
mov byte [ebp - 4], 0x28
cmp dword [ebp - 0x600], 0x3276
jge 0x1001ebe1
mov edx, dword [ebp - 0x8f0]
mov ecx, 0x10607df8
call fcn.1002de69
jmp 0x1001ebfd
mov dword [ebp - 4], 0x27
jmp 0x1001ec0d
push 1
push 0x7d6f
push 0
push 1
lea eax, [ebp - 0xb28]
push eax
call fcn.1000eb38
add esp, 0x14
mov dword [ebp - 0x1cc], 0x18
jmp 0x1001ec40
mov eax, dword [ebp - 0x1cc]
dec eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0xfffffff3
jne 0x1001ec63
push 1
push 0x37ca
push 1
push 1
push 0x4cbd
call fcn.1000eb38
add esp, 0x14
jmp 0x1001ec33
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb28]
call fcn.1002c556
mov dword [ebp - 0x1dc], 0x3ae35568
mov dword [ebp - 0xc74], 1
mov dword [ebp - 0x7d4], 0x59d568d5
mov dword [ebp - 0x1d4], 0
jmp 0x1001eca9
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 2
jge 0x1001ecc5
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0x7b8], 0xeb606930
jmp 0x1001ec9c
mov dword [ebp - 0x1dc], 2
jmp 0x1001ecde
mov eax, dword [ebp - 0x1dc]
dec eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0xffffffff
jne 0x1001ee8e
mov dword [ebp - 0xbdc], 0xfffffff7
mov dword [ebp - 0xcf4], 0
mov dword [ebp - 0x610], 0
push 3
lea ecx, [ebp - 0x780]
call fcn.1002c4d4
mov dword [ebp - 4], 0x2a
mov dword [ebp - 0x298], 0xb7ab
mov dword [ebp - 0x1e4], 0
jmp 0x1001ed40
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 3
jge 0x1001ed62
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x780]
call fcn.1002c572
mov dword [eax], 0xdcd66a07
jmp 0x1001ed33
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x7b8]
push 2
lea ecx, [ebp - 0x780]
call fcn.1002c572
cmp dword [eax], esi
je 0x1001edaf
push 1
lea ecx, [ebp - 0x780]
call fcn.1002c572
push 1
lea ecx, [ebp - 0x780]
call fcn.1002c572
mov eax, 0xa04f
test eax, eax
je 0x1001edaf
mov dword [ebp - 0x608], 1
jmp 0x1001edb6
and dword [ebp - 0x608], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x610]
imul ecx, dword [ebp - 0x608]
cmp ecx, dword [ebp + eax - 0x7b8]
jne 0x1001eddf
xor eax, eax
jne 0x1001eddf
and dword [ebp - 0x7d0], 0
jmp 0x1001ede9
mov dword [ebp - 0x7d0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7b8]
mov dword [ebp - 0xbe4], eax
push 1
lea ecx, [ebp - 0x780]
call fcn.1002c572
push 1
lea ecx, [ebp - 0x780]
call fcn.1002c572
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0xc7c], eax
mov eax, dword [ebp - 0x298]
add eax, dword [ebp - 0x7d4]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x7b8], eax
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
mov byte [ebp - 0xd8], 0
movzx eax, byte [ebp - 0xd8]
test eax, eax
je 0x1001ee7a
push 0x7e0
push 1
push 0x3438
push 0x104a
push 0
push 0x40b3
call fcn.10011091
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x780]
call fcn.1002c556
jmp 0x1001ecd1
mov dword [ebp - 0x6c], 0xb871
push 4
lea ecx, [ebp - 0xb40]
call fcn.1002c4d4
mov dword [ebp - 4], 0x2b
mov dword [ebp - 0x1ec], 0
jmp 0x1001eec2
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 4
jge 0x1001eee4
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0xb40]
call fcn.1002c572
mov dword [eax], 0x31f145ba
jmp 0x1001eeb5
imul eax, dword [ebp - 0x6c], 0x2daa
cmp eax, dword [ebp - 0x6c]
je 0x1001eefc
mov dword [ebp - 0x618], 1
jmp 0x1001ef03
and dword [ebp - 0x618], 0
cmp dword [ebp - 0x618], 0xffffffff
jne 0x1001ef18
mov dword [ebp - 0x620], 1
jmp 0x1001ef1f
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x620]
je 0x1001ef36
mov dword [ebp - 0x628], 1
jmp 0x1001ef3d
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x6c]
imul eax, dword [ebp - 0x628]
cmp eax, dword [ebp - 0x6c]
jg 0x1001ef58
mov dword [ebp - 0x630], 1
jmp 0x1001ef5f
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x630]
sub eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x6c]
imul ecx, eax
test ecx, ecx
je 0x1001ef84
cmp dword [ebp - 0x6c], 0
je 0x1001ef84
mov dword [ebp - 0x638], 1
jmp 0x1001ef8b
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x638]
jge 0x1001efdc
mov dword [ebp - 0x7e4], 0xffffffff
mov dword [ebp - 0x7dc], 0xa32a17d0
push 0x3ba2
push 0
lea eax, [ebp - 0x7dc]
push eax
lea eax, [ebp - 0xb40]
push eax
push 0
push 0xe0e
lea eax, [ebp - 0x7e4]
push eax
push 0x3d00
call fcn.10012845
add esp, 0x20
jmp 0x1001f02d
mov byte [ebp - 0xd0], 0
push 0x24a2
lea eax, [ebp - 0xd0]
push eax
push 0x1e2f
push 0x12a1
push 0x4ba7
push 0x5003
push 0x358
push 0x33ef
push 0x6c13
push 0x2708
push 0
push 1
push 0x592
push 0x157f
call fcn.10012180
add esp, 0x38
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb40]
call fcn.1002c556
mov eax, dword [ebp - 0x224]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0x224]
mov ecx, dword [ecx]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x30], 0x42c70bb7
mov dword [ebp - 0xa0], 1
mov dword [ebp - 0x804], 3
push 2
lea ecx, [ebp - 0xcd8]
call fcn.1002c4d4
mov dword [ebp - 4], 0x2c
mov dword [ebp - 0x74], 0
jmp 0x1001f099
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x1001f0af
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x304], 0xffffffff
jmp 0x1001f092
mov dword [ebp - 0x74], 0
jmp 0x1001f0bf
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x1001f0db
push dword [ebp - 0x74]
lea ecx, [ebp - 0xcd8]
call fcn.1002c572
mov dword [eax], 0x5eeffbb8
jmp 0x1001f0b8
mov dword [ebp - 0x30], 0
jmp 0x1001f0eb
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jg 0x1001f12c
mov eax, 0xa2961c0f
test eax, eax
je 0x1001f113
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x304], 0
je 0x1001f113
mov dword [ebp - 0x640], 1
jmp 0x1001f11a
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x640]
mov dword [ebp + eax*4 - 0x304], ecx
jmp 0x1001f0e4
mov dword [ebp - 0x30], 0
jmp 0x1001f13c
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffe2
jne 0x1001f592
mov dword [ebp - 0x7c], 0
push 1
lea ecx, [ebp - 0x798]
call fcn.1002c4d4
mov byte [ebp - 4], 0x2d
mov dword [ebp - 0x688], 0
mov dword [ebp - 0x6b0], 0x3e235bd6
mov dword [ebp - 0x1f4], 0
jmp 0x1001f18b
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 1
jge 0x1001f1ad
push dword [ebp - 0x1f4]
lea ecx, [ebp - 0x798]
call fcn.1002c572
mov dword [eax], 0x1de6fc60
jmp 0x1001f17e
cmp dword [ebp - 0x7c], 0
je 0x1001f1e9
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x648], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x648]
mov dword [ebp + eax - 0x304], ecx
mov eax, dword [ebp - 0x7c]
imul eax, dword [ebp - 0x648]
test eax, eax
je 0x1001f1e9
mov dword [ebp - 0x650], 1
jmp 0x1001f1f0
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x7c]
jl 0x1001f204
mov dword [ebp - 0x658], 1
jmp 0x1001f20b
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0xa0], eax
mov esi, dword [ebp - 0xa0]
sub esi, dword [ebp - 0x658]
add esi, dword [ebp - 0x7c]
push 0
lea ecx, [ebp - 0x798]
call fcn.1002c572
imul esi, dword [eax]
test esi, esi
je 0x1001f4e2
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0xbec], 0xffffffff
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x304], 0
je 0x1001f277
cmp dword [ebp - 0xe4], 0
je 0x1001f277
mov dword [ebp - 0x7ec], 1
jmp 0x1001f27e
and dword [ebp - 0x7ec], 0
cmp dword [ebp - 0x30], 0
jne 0x1001f290
mov dword [ebp - 0x660], 1
jmp 0x1001f297
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x660]
sub eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0xe4]
jge 0x1001f2b9
xor eax, eax
inc eax
je 0x1001f2b9
mov dword [ebp - 0x668], 1
jmp 0x1001f2c0
and dword [ebp - 0x668], 0
cmp dword [ebp - 0x668], 0
jbe 0x1001f2d5
mov dword [ebp - 0x7f4], 1
jmp 0x1001f2dc
and dword [ebp - 0x7f4], 0
mov esi, dword [ebp - 0xa0]
mov edi, dword [ebp - 0xe4]
push 0
lea ecx, [ebp - 0x798]
call fcn.1002c572
mov eax, dword [eax]
sub eax, edi
cmp eax, esi
je 0x1001f31b
push 0
lea ecx, [ebp - 0x798]
call fcn.1002c572
cmp dword [eax], 0
je 0x1001f31b
mov dword [ebp - 0x670], 1
jmp 0x1001f322
and dword [ebp - 0x670], 0
push 0
lea ecx, [ebp - 0x798]
call fcn.1002c572
mov ecx, dword [ebp - 0x670]
imul ecx, dword [eax]
test ecx, ecx
je 0x1001f439
xor eax, eax
inc eax
je 0x1001f380
mov eax, dword [ebp - 0x688]
mov dword [ebp - 0xd4c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x304]
mov dword [ebp - 0xbf4], eax
mov eax, dword [ebp - 0xe4]
imul eax, dword [ebp - 0xe4]
test eax, eax
je 0x1001f380
mov dword [ebp - 0x678], 1
jmp 0x1001f387
and dword [ebp - 0x678], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x304]
cmp dword [ebp - 0x678], eax
jg 0x1001f3a8
mov dword [ebp - 0x680], 1
jmp 0x1001f3af
and dword [ebp - 0x680], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x680]
mov dword [ebp + eax - 0x304], ecx
push 3
pop eax
sub eax, dword [ebp - 0x688]
cmp eax, dword [ebp - 0xa0]
jne 0x1001f3de
mov dword [ebp - 0x690], 1
jmp 0x1001f3e5
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x690], eax
jl 0x1001f3fc
mov dword [ebp - 0x698], 1
jmp 0x1001f403
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0xe4], eax
mov esi, dword [ebp - 0xe4]
push 0
lea ecx, [ebp - 0x798]
call fcn.1002c572
imul esi, dword [eax]
mov eax, dword [ebp - 0xa0]
imul eax, esi
mov dword [ebp - 0xa0], eax
jmp 0x1001f4dd
mov dword [ebp - 0x7fc], 1
mov dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0xa0]
neg eax
cmp eax, dword [ebp - 0x30]
jle 0x1001f466
mov dword [ebp - 0x6a0], 1
jmp 0x1001f46d
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x6b0]
cmp dword [ebp - 0x6a0], eax
jne 0x1001f496
mov eax, 0xaf4a9b83
test eax, eax
je 0x1001f496
cmp dword [ebp - 0x30], 0
je 0x1001f496
mov dword [ebp - 0x2a0], 1
jmp 0x1001f49d
and dword [ebp - 0x2a0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2a0]
mov dword [ebp + eax - 0x304], ecx
cmp dword [ebp - 0x2a0], 0
jne 0x1001f4ca
cmp dword [ebp - 0x7fc], 0
jne 0x1001f4ca
and dword [ebp - 0x6a8], 0
jmp 0x1001f4d4
mov dword [ebp - 0x6a8], 1
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x7c], eax
jmp 0x1001f57e
push 3
lea ecx, [ebp - 0xb58]
call fcn.1002c4d4
mov byte [ebp - 4], 0x2e
lea eax, [ebp - 0xc8c]
push eax
push 0x5af
push 0x33b4
push 1
push 1
push 0
push 0x6abc
push 0x38b3
lea eax, [ebp - 0xb58]
push eax
call fcn.10011a5c
add esp, 0x24
cmp dword [ebp - 0x804], 0
je 0x1001f54f
mov esi, dword [ebp - 0x6b0]
push 1
lea ecx, [ebp - 0xb58]
call fcn.1002c572
cmp esi, dword [eax]
jg 0x1001f54f
mov dword [ebp - 0x6b8], 1
jmp 0x1001f556
and dword [ebp - 0x6b8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6b8]
mov dword [ebp + eax - 0x304], ecx
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x7c], eax
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0xb58]
call fcn.1002c556
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x798]
call fcn.1002c556
jmp 0x1001f135
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcd8]
call fcn.1002c556
mov dword [ebp - 0x6c0], 0x4f2e
mov dword [ebp - 0x7cc], 0x10008c80
cmp dword [ebp - 0x6c0], 0x4f7e
jle 0x1001f65b
push 0
push 0xa83
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
and dword [ebp - 0x1fc], 0
jmp 0x1001f5e8
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0x31ba
jge 0x1001f649
and dword [ebp - 0x204], 0
jmp 0x1001f60a
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0x502c
jge 0x1001f647
mov eax, dword [ebp - 0x1fc]
and eax, dword [ebp - 0x204]
cdq
mov dword [ebp - 0x94c], eax
mov dword [ebp - 0x948], edx
push dword [ebp - 0x948]
push dword [ebp - 0x94c]
mov ecx, 0x10607df8
call fcn.1002c3bf
jmp 0x1001f5fd
jmp 0x1001f5db
push 0x15ef
push 0x1775
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
mov dword [ebp - 0x6d0], 0
mov dword [ebp - 4], 0x2f
cmp dword [ebp - 0x6c0], 0x4dfd
jge 0x1001f688
mov edx, dword [ebp - 0x7cc]
mov ecx, 0x10607df8
call fcn.1002de69
jmp 0x1001f6a4
or dword [ebp - 4], 0xffffffff
jmp 0x1001f6ae
mov dword [ebp - 0x814], 0xfffffffd
mov dword [ebp - 0xbfc], 0xa56718e5
mov dword [ebp - 0x824], 0xa1405524
mov dword [ebp - 0xcfc], 0xffffffff
mov dword [ebp - 0x2a8], 0xf3922cbd
mov dword [ebp - 0x82c], 0xffffffff
mov dword [ebp - 0x834], 0xffffffff
mov dword [ebp - 0x20c], 0
jmp 0x1001f70d
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 2
jge 0x1001f729
mov eax, dword [ebp - 0x20c]
mov dword [ebp + eax*4 - 0xb88], 3
jmp 0x1001f700
mov dword [ebp - 0x6c8], 0x7191
mov dword [ebp - 0x81c], 0x10008ce8
cmp dword [ebp - 0x6c8], 0x7534
jle 0x1001f7c1
and dword [ebp - 0x214], 0
jmp 0x1001f75f
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0x6b26
jge 0x1001f7c1
and dword [ebp - 0x21c], 0
jmp 0x1001f781
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0x1c63
jge 0x1001f7bf
mov eax, dword [ebp - 0x214]
imul eax, dword [ebp - 0x21c]
cdq
mov dword [ebp - 0x958], eax
mov dword [ebp - 0x954], edx
push dword [ebp - 0x954]
push dword [ebp - 0x958]
mov ecx, 0x10607df8
call fcn.1002c3bf
jmp 0x1001f774
jmp 0x1001f752
lea eax, [ebp - 0x6d0]
push eax
lea eax, [ebp - 0x814]
push eax
push 0x476e
push 1
push 0x7951
push 0
push 0x7239
push 0x1bc6
push 0
call fcn.1002667c
add esp, 0x24
mov dword [ebp - 4], 0x31
cmp dword [ebp - 0x6c8], 0x6fc3
jge 0x1001f814
mov edx, dword [ebp - 0x81c]
mov ecx, 0x10607df8
call fcn.1002de69
jmp 0x1001f830
or dword [ebp - 4], 0xffffffff
jmp 0x1001f83a
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0xc04], eax
mov eax, dword [ebp - 0x2a8]
dec eax
mov dword [ebp - 0x2a8], eax
mov eax, 0xc7a4
test eax, eax
je 0x1001f87a
cmp dword [ebp - 0x824], 0
je 0x1001f87a
cmp dword [ebp - 0x6d0], 0
je 0x1001f87a
mov dword [ebp - 0x6d8], 1
jmp 0x1001f881
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x6d8]
sub eax, dword [ebp - 0x82c]
jne 0x1001f89c
xor eax, eax
jne 0x1001f89c
and dword [ebp - 0x6e0], 0
jmp 0x1001f8a6
mov dword [ebp - 0x6e0], 1
cmp dword [ebp - 0x6e0], 0x4fda
jge 0x1001f8be
mov dword [ebp - 0x6e8], 1
jmp 0x1001f8c5
and dword [ebp - 0x6e8], 0
cmp dword [ebp - 0x6e8], 8
jg 0x1001f8da
mov dword [ebp - 0x6f0], 1
jmp 0x1001f8e1
and dword [ebp - 0x6f0], 0
mov eax, 0x9b3a
sub eax, dword [ebp - 0x6f0]
cmp eax, 1
jne 0x1001f8fd
mov dword [ebp - 0x6f8], 1
jmp 0x1001f904
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x834]
cmp dword [ebp - 0x6f8], eax
jl 0x1001f91e
mov dword [ebp - 0x700], 1
jmp 0x1001f925
and dword [ebp - 0x700], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x700]
mov dword [ebp + eax - 0xb88], ecx
and dword [ebp - 0x2b0], 0
jmp 0x1001f95d
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x84]
add eax, 0x28
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x224]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x2b0], eax
jge 0x1001ff65
mov eax, dword [ebp - 0x84]
cmp dword [eax + 0x10], 0
jne 0x1001fcaa
mov dword [ebp - 0xa7c], 0xffff
mov dword [ebp - 0xa78], 0xffff
mov dword [ebp - 0xa74], 0xffff
mov dword [ebp - 0xa70], 0xffff
lea ecx, [ebp - 0x2ba]
call fcn.1002c581
push eax
lea eax, [ebp - 0xa6c]
push eax
lea eax, [ebp - 0xa7c]
push eax
lea ecx, [ebp - 0xdb0]
call fcn.1002c584
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd68]
call fcn.1002c530
mov dword [ebp - 4], 0x33
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x22c], 0
jmp 0x1001fa0c
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 3
jg 0x1001fa6f
mov byte [ebp - 0xd2], 0
push 0x5100
push 0x187c
push 0x607b
push 0x4072
push 0x7810
push 0x2074
push 0x67e4
push 0x1916
push 0x2c3e
push 0
push 0x7814
push 1
push 1
push 0x30c3
push 0x5201
lea eax, [ebp - 0xd2]
push eax
call fcn.10011174
add esp, 0x40
jmp 0x1001f9ff
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd68]
call fcn.1002c556
mov dword [ebp - 0x708], 0x4743
mov dword [ebp - 0x84c], 0x10008d50
cmp dword [ebp - 0x708], 0x47ae
jle 0x1001fbbf
and dword [ebp - 0x244], 0
jmp 0x1001fab8
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0x9c7
jge 0x1001fbaa
and dword [ebp - 0x24c], 0
jmp 0x1001fade
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0x466e
jge 0x1001fba5
and dword [ebp - 0x234], 0
jmp 0x1001fb04
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0x63e6
jge 0x1001fba0
and dword [ebp - 0x23c], 0
jmp 0x1001fb2a
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0x46a2
jge 0x1001fb9b
mov eax, dword [ebp - 0x234]
add eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 0x244]
sub ecx, dword [ebp - 0x24c]
or eax, ecx
cdq
mov dword [ebp - 0x964], eax
mov dword [ebp - 0x960], edx
push dword [ebp - 0x960]
push dword [ebp - 0x964]
lea ecx, [ebp - 0xe58]
call fcn.1000d0f0
pop ecx
pop ecx
mov dword [ebp - 0x83c], eax
mov ecx, dword [ebp - 0x83c]
call fcn.1002c39f
push eax
call fcn.10049f86
pop ecx
lea ecx, [ebp - 0xe58]
call fcn.1002c395
jmp 0x1001fb1d
jmp 0x1001faf7
jmp 0x1001fad1
jmp 0x1001faab
push 0x4fd
push 0xda
push 0xad
call dword [sym.imp.GDI32.dll_GetPixel]
lea eax, [ebp - 0x84]
push eax
push 0
push 0
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x844]
push eax
push 0x7899
lea eax, [ebp - 0x718]
push eax
call fcn.1001560f
add esp, 0x1c
mov dword [ebp - 4], 0x34
cmp dword [ebp - 0x708], 0x449b
jge 0x1001fc0b
push dword [ebp - 0x84c]
call fcn.10049f86
pop ecx
jmp 0x1001fc27
or dword [ebp - 4], 0xffffffff
jmp 0x1001fc31
mov dword [ebp - 0x854], 0xfffffffb
cmp dword [ebp - 0x854], 0
je 0x1001fc82
mov byte [ebp - 0xda], 0
movzx eax, byte [ebp - 0xda]
test eax, eax
je 0x1001fc61
push 0x2375
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [ebp - 0xd4], 0
push 1
push 0x4bba
push 0
lea eax, [ebp - 0xd4]
push eax
call fcn.10010a32
add esp, 0x10
jmp 0x1001fca5
mov byte [ebp - 0xde], 0
movzx eax, byte [ebp - 0xde]
test eax, eax
je 0x1001fca5
push 0xdf8
push 1
push 0
call fcn.10014a72
add esp, 0xc
jmp 0x1001f941
mov dword [ebp - 0xc9c], 0xb457
mov dword [ebp - 0x254], 0
jmp 0x1001fccd
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 1
jge 0x1001fce9
mov eax, dword [ebp - 0x254]
mov dword [ebp + eax*4 - 0x85c], 9
jmp 0x1001fcc0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x85c], 0
je 0x1001febf
mov byte [ebp - 0xca], 0
mov dword [ebp - 0x710], 0x4828
mov dword [ebp - 0x86c], 0x10008dd0
cmp dword [ebp - 0x710], 0x4a9e
jle 0x1001fe39
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
and dword [ebp - 0x26c], 0
jmp 0x1001fd46
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0x32ef
jge 0x1001fe39
and dword [ebp - 0x228], 0
jmp 0x1001fd6c
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0x598c
jge 0x1001fe34
and dword [ebp - 0x25c], 0
jmp 0x1001fd92
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0x56e5
jge 0x1001fe2f
and dword [ebp - 0x264], 0
jmp 0x1001fdb8
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0x6039
jge 0x1001fe2a
mov ecx, dword [ebp - 0x25c]
add ecx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x26c]
imul eax, dword [ebp - 0x228]
shl eax, cl
cdq
mov dword [ebp - 0x970], eax
mov dword [ebp - 0x96c], edx
push dword [ebp - 0x96c]
push dword [ebp - 0x970]
lea ecx, [ebp - 0xe10]
call fcn.1000d0f0
pop ecx
pop ecx
mov dword [ebp - 0x864], eax
mov ecx, dword [ebp - 0x864]
call fcn.1002c39f
push eax
call fcn.10049f86
pop ecx
lea ecx, [ebp - 0xe10]
call fcn.1002c395
jmp 0x1001fdab
jmp 0x1001fd85
jmp 0x1001fd5f
jmp 0x1001fd39
movzx eax, byte [ebp - 0xca]
test eax, eax
je 0x1001fe78
push 0x625c
push 0x7da8
push 0x2191
push 0x32b8
push 0x6850
push 0x983
push 0x5e17
push 0
push 1
push 0x4c76
call fcn.10012a4e
add esp, 0x28
mov dword [ebp - 4], 0x36
cmp dword [ebp - 0x710], 0x46c1
jge 0x1001fe97
push dword [ebp - 0x86c]
call fcn.10049f86
pop ecx
jmp 0x1001feb3
or dword [ebp - 4], 0xffffffff
jmp 0x1001febd
jmp 0x1001fede
mov byte [ebp - 0xcb], 0
push 1
push 0x47fb
lea eax, [ebp - 0xcb]
push eax
push 0
call fcn.1000fa13
add esp, 0x10
push 4
push 0x1000
mov eax, dword [ebp - 0x84]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x718]
add ecx, dword [eax + 0xc]
push ecx
push 0x6837
push 0x61b4
call fcn.1003a34b
pop ecx
pop ecx
call eax
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 0x84]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x874]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x2b8]
call fcn.1003a809
add esp, 0xc
push 0
push 0x4471
lea eax, [ebp - 0x2b8]
push eax
push 0x411f
lea eax, [ebp - 0x84]
push eax
call fcn.100283a9
add esp, 0x14
jmp 0x1001f941
jmp 0x1001ffb9
lea eax, [ebp + 0xc]
mov dword [ebp - 0x87c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x884], eax
mov eax, dword [ebp - 0x87c]
movzx eax, byte [eax]
test eax, eax
je 0x1001ffb1
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x88c], eax
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0x720], eax
mov eax, dword [ebp - 0x720]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x720]
mov dword [ecx], eax
jmp 0x1001ffb9
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret