Function at 0x100276ba
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100732ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
push esi
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10027743
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x58]
mov dword [eax], 0
jmp 0x1002771e
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x58]
mov dword [ecx], eax
mov eax, dword [ebp - 0x58]
cmp dword [eax], 4
jge 0x1002773e
mov eax, dword [ebp - 0x58]
push dword [eax]
mov ecx, dword [ebp - 0x15c]
call fcn.10016e40
mov dword [eax], 9
jmp 0x10027713
jmp 0x100285a6
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], 0xffffffff
mov dword [ebp - 0x204], 0xfffffffa
mov dword [ebp - 0x194], 0x822c
mov dword [ebp - 0x190], 0x822c
mov dword [ebp - 0x18c], 0x822c
mov dword [ebp - 0x188], 0x822c
mov dword [ebp - 0x80], 0xb
jmp 0x100277a7
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0xffffffff
jge 0x10027819
mov dword [ebp - 0x78], 0xffffffff
mov dword [ebp - 0x1e0], 0x693e932
mov dword [ebp - 0x1c0], 0xfffffff8
mov dword [ebp - 0x1c4], 0xa98815cb
mov dword [ebp - 0x78], 0
jmp 0x100277e2
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jl 0x10027817
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x194]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x194], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x194], 0
je 0x10027815
jmp 0x10027817
jmp 0x100277db
jmp 0x100277a0
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 4]
mov dword [ebp - 0xdc], eax
push 2
lea ecx, [ebp - 0x1fc]
call fcn.10016dd3
and dword [ebp - 4], 0
mov dword [ebp - 0x6c], 0
lea eax, [ebp - 0x1fc]
push eax
lea eax, [ebp - 0x1cc]
push eax
push 0xca6
push 0x49db
push 0
call fcn.1002a0d1
add esp, 0x14
mov dword [ebp - 0x6c], 0
jmp 0x10027872
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jg 0x10027920
mov dword [ebp - 0x4c], 0x5260417b
mov dword [ebp - 0x4c], 1
jmp 0x10027893
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x10027910
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x20], 0
jmp 0x100278b0
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jg 0x100278d9
mov byte [ebp - 0x2d], 0
push 0
push 0x4fd5
push 0x1402
push 0x7cc6
lea eax, [ebp - 0x2d]
push eax
call fcn.1002b4eb
add esp, 0x14
jmp 0x100278a9
mov dword [ebp - 0x20], 0
jmp 0x100278e9
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jg 0x1002790b
mov byte [ebp - 0x26], 0
movzx eax, byte [ebp - 0x26]
test eax, eax
je 0x10027909
push 0x7d3f
push 0
call fcn.100269c7
pop ecx
pop ecx
jmp 0x100278e2
jmp 0x1002788c
cmp dword [ebp - 0x4c], 0
je 0x1002791b
jmp 0x1002786b
jmp 0x1002786b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1fc]
call fcn.10016e3b
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x164], 0xfffffffc
mov dword [ebp - 0x7c], 0
jmp 0x10027950
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x10027966
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x17c], 0xffffffff
jmp 0x10027949
push 0
push 0x6ecb
push 0x3f44
push 0xa0f
call fcn.1002f337
add esp, 0x10
mov dword [ebp - 0x34], 2
jmp 0x1002798f
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x10027cd8
mov dword [ebp - 0x2c], 7
push 2
lea ecx, [ebp - 0x140]
call fcn.10016dd3
mov dword [ebp - 4], 1
mov dword [ebp - 0x74], 0
jmp 0x100279c4
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x100279e0
push dword [ebp - 0x74]
lea ecx, [ebp - 0x140]
call fcn.10016e40
mov dword [eax], 3
jmp 0x100279bd
mov dword [ebp - 0x2c], 0
jmp 0x100279f0
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x10027cc4
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x88], 4
mov dword [ebp - 0x18], 0x34cb4417
mov dword [ebp - 0x24], 2
jmp 0x10027a22
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x10027b4b
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x17c]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x2c]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x17c]
cmp dword [ebp + eax*4 - 0x17c], ecx
jg 0x10027a6e
mov dword [ebp - 0xa8], 1
jmp 0x10027a75
and dword [ebp - 0xa8], 0
imul eax, dword [ebp - 0x34], 0x38d9
mov dword [ebp - 0x11c], eax
push 1
lea ecx, [ebp - 0x140]
call fcn.10016e40
mov ecx, dword [ebp - 0x11c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x11c], eax
jl 0x10027aae
mov dword [ebp - 0x114], 1
jmp 0x10027ab5
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x114]
jge 0x10027acc
mov dword [ebp - 0xb0], 1
jmp 0x10027ad3
and dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0xb0], eax
jl 0x10027aea
mov dword [ebp - 0xf0], 1
jmp 0x10027af1
and dword [ebp - 0xf0], 0
cmp dword [ebp - 0xf0], 0x2c512dc6
jg 0x10027b09
mov dword [ebp - 0xb8], 1
jmp 0x10027b10
and dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0xb8]
je 0x10027b2d
cmp dword [ebp - 0x2c], 0
je 0x10027b2d
mov dword [ebp - 0x110], 1
jmp 0x10027b34
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x110]
neg eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp + ecx*4 - 0x17c], eax
jmp 0x10027a1b
mov dword [ebp - 0x18], 0
jmp 0x10027b5b
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jg 0x10027cbf
cmp dword [ebp - 0x34], 1
jne 0x10027b77
mov dword [ebp - 0xc0], 1
jmp 0x10027b7e
and dword [ebp - 0xc0], 0
cmp dword [ebp - 0xc0], 0
jne 0x10027ba3
push dword [ebp - 0x18]
lea ecx, [ebp - 0x140]
call fcn.10016e40
cmp dword [eax], 0
jne 0x10027ba3
and dword [ebp - 0xf8], 0
jmp 0x10027bad
mov dword [ebp - 0xf8], 1
cmp dword [ebp - 0xf8], 0xfff8102e
jne 0x10027bc5
mov dword [ebp - 0xc8], 1
jmp 0x10027bcc
and dword [ebp - 0xc8], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x140]
call fcn.10016e40
mov esi, eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x140]
call fcn.10016e40
mov ecx, dword [ebp - 0xc8]
add ecx, dword [eax]
cmp dword [esi], ecx
jne 0x10027c02
mov dword [ebp - 0x120], 1
jmp 0x10027c09
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x120], eax
jle 0x10027c20
mov dword [ebp - 0xd0], 1
jmp 0x10027c27
and dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xd0], eax
jg 0x10027c3e
mov dword [ebp - 0x100], 1
jmp 0x10027c45
and dword [ebp - 0x100], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x100], eax
jl 0x10027c5f
mov dword [ebp - 0xd8], 1
jmp 0x10027c66
and dword [ebp - 0xd8], 0
cmp dword [ebp - 0xd8], 0
jae 0x10027c7b
mov dword [ebp - 0x118], 1
jmp 0x10027c82
and dword [ebp - 0x118], 0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x17c], 0xffffffff
cmp dword [ebp - 0x118], 0xffffffff
jg 0x10027ca7
mov dword [ebp - 0xe0], 1
jmp 0x10027cae
and dword [ebp - 0xe0], 0
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x164], eax
jmp 0x10027b54
jmp 0x100279e9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x140]
call fcn.10016e3b
jmp 0x10027988
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x84]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x60], 0x4ec2e0cf
mov byte [ebp - 0x3e], 0
movzx eax, byte [ebp - 0x3e]
test eax, eax
je 0x10027d2d
push 0x23d0
push 0
push 0x21f8
push 0x6ae
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
mov dword [ebp - 0x60], 0
jmp 0x10027d3d
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x19
jle 0x10027d61
mov byte [ebp - 0x3d], 0
push 0x1f44
push 0
lea eax, [ebp - 0x3d]
push eax
push 0x6dcb
call fcn.1002a158
add esp, 0x10
jmp 0x10027d36
and dword [ebp - 0x94], 0
jmp 0x10027d80
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x1c]
add eax, 0x28
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x94], eax
jge 0x100285a6
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x10], 0
jne 0x100280fc
mov dword [ebp - 0x50], 0x4bf8f0aa
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x44], 0x7e7c14ab
push 2
lea ecx, [ebp - 0x1b8]
call fcn.10016dd3
mov dword [ebp - 4], 2
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x1dc]
push eax
push 0x716a
push 0x4a9
push 0
push 0x6da3
push 0x1afc
push 0x751f
call fcn.1002d1d8
add esp, 0x20
push 0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x16c]
push eax
call fcn.1002c369
add esp, 0x10
mov dword [ebp - 0x50], 0
jmp 0x10027e2b
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jg 0x10027ed7
mov dword [ebp - 0x108], 0xd38c
mov dword [ebp - 0x44], 1
jmp 0x10027e4f
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x10027ed2
mov dword [ebp - 0x150], 0xc8d535dd
push dword [ebp - 0x44]
lea ecx, [ebp - 0x1b8]
call fcn.10016e40
mov ecx, dword [ebp - 0x108]
cmp dword [eax], ecx
jle 0x10027ea0
mov dword [ebp - 0x144], 0xffff
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x108]
push eax
push 0
push 0x7ec1
call fcn.1002f51d
add esp, 0x10
jmp 0x10027eaa
mov dword [ebp - 0x150], 5
push 0x2874
push 0x9f
push 0xbeb
push 0x504d
push 0
push 0x60d2
call fcn.1002d53f
add esp, 0x18
jmp 0x10027e48
jmp 0x10027e24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b8]
call fcn.10016e3b
push 0
push 0x5acd
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xdc]
push eax
push 0x3380
lea eax, [ebp - 0x90]
push eax
call fcn.1002693e
add esp, 0x1c
push 2
lea ecx, [ebp - 0x134]
call fcn.10016dd3
mov dword [ebp - 4], 3
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x1e4], 0
push 0
lea eax, [ebp - 0x1ec]
push eax
lea eax, [ebp - 0x134]
push eax
push 0x5f36
call fcn.1002a3e3
add esp, 0x10
cmp dword [ebp - 0x10], 0
jne 0x10027f64
mov eax, 0xffff
test eax, eax
je 0x10027f79
mov eax, 0xe80031aa
test eax, eax
je 0x10027f79
mov dword [ebp - 0xe8], 1
jmp 0x10027f80
and dword [ebp - 0xe8], 0
cmp dword [ebp - 0x10], 1
jbe 0x10027f92
mov dword [ebp - 0x158], 1
jmp 0x10027f99
and dword [ebp - 0x158], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x208], eax
push 1
lea ecx, [ebp - 0x134]
call fcn.10016e40
cmp dword [ebp - 0x10], 0
jne 0x10027fd9
push 0
lea ecx, [ebp - 0x134]
call fcn.10016e40
cmp dword [eax], 0
jne 0x10027fd9
and dword [ebp - 0xa4], 0
jmp 0x10027fe3
mov dword [ebp - 0xa4], 1
cmp dword [ebp - 0xa4], 0
je 0x10027fff
mov byte [ebp - 0x25], 0
lea eax, [ebp - 0x25]
push eax
push 1
call fcn.1002534b
pop ecx
pop ecx
jmp 0x1002801f
mov dword [ebp - 0x10], 0
jmp 0x1002800f
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jg 0x1002801f
cmp dword [ebp - 0x10], 0
je 0x1002801d
jmp 0x1002801f
jmp 0x10028008
mov dword [ebp - 0x10], 0
jmp 0x1002802f
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jg 0x100280e8
mov dword [ebp - 0x48], 0xfffffffb
mov dword [ebp - 0x184], 0x75309757
push 0x4f9f
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x68de
push 0
call fcn.1002c233
add esp, 0x14
mov dword [ebp - 0x48], 0
jmp 0x10028079
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jg 0x100280e3
mov dword [ebp - 0x54], 0x4faf1418
mov dword [ebp - 0x54], 1
jmp 0x10028096
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x100280e1
mov byte [ebp - 0x35], 0
movzx eax, byte [ebp - 0x35]
test eax, eax
je 0x100280b6
push 1
push 0x4547
call fcn.100265d0
pop ecx
pop ecx
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x7d8c
lea eax, [ebp - 0x48]
push eax
push 0
call fcn.100267be
add esp, 0x1c
jmp 0x1002808f
jmp 0x10028072
jmp 0x10028028
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x134]
call fcn.10016e3b
jmp 0x10027d6a
push 2
lea ecx, [ebp - 0xa0]
call fcn.10016dd3
mov dword [ebp - 4], 4
mov dword [ebp - 0x14], 0
jmp 0x10028120
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10028136
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1a0], 1
jmp 0x10028119
mov dword [ebp - 0x14], 0
jmp 0x10028146
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10028162
push dword [ebp - 0x14]
lea ecx, [ebp - 0xa0]
call fcn.10016e40
mov dword [eax], 0xde19d29b
jmp 0x1002813f
mov dword [ebp - 0x14], 0
jmp 0x10028172
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10028188
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x218], 0xb5d1cb6a
jmp 0x1002816b
push 0
lea ecx, [ebp - 0xa0]
call fcn.10016e40
and dword [eax], 0
jmp 0x100281be
push 0
lea ecx, [ebp - 0xa0]
call fcn.10016e40
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xac]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa0]
call fcn.10016e40
cmp dword [eax], 2
jg 0x1002822e
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x64], 0
jmp 0x100281e7
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jg 0x10028229
mov dword [ebp - 0x68], 0xa07e4fc2
mov dword [ebp - 0x68], 0
jmp 0x10028204
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jg 0x10028227
push 0
lea ecx, [ebp - 0xa0]
call fcn.10016e40
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x1a0], 0
je 0x10028225
jmp 0x10028227
jmp 0x100281fd
jmp 0x100281e0
jmp 0x1002819a
push 0
lea ecx, [ebp - 0xa0]
call fcn.10016e40
cmp dword [eax], 0xfd43
jge 0x1002824f
mov dword [ebp - 0xb4], 1
jmp 0x10028256
and dword [ebp - 0xb4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
cmp eax, dword [ebp - 0xb4]
jge 0x10028277
mov dword [ebp - 0x160], 1
jmp 0x1002827e
and dword [ebp - 0x160], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
mov dword [ebp - 0x1c8], eax
mov eax, 0xff12
test eax, eax
jge 0x100282a6
mov dword [ebp - 0xbc], 1
jmp 0x100282ad
and dword [ebp - 0xbc], 0
push 1
lea ecx, [ebp - 0xa0]
call fcn.10016e40
mov ecx, dword [ebp - 0xbc]
cmp ecx, dword [eax]
jg 0x100282d0
mov dword [ebp - 0xc4], 1
jmp 0x100282d7
and dword [ebp - 0xc4], 0
cmp dword [ebp - 0xc4], 1
je 0x100282ec
mov dword [ebp - 0xcc], 1
jmp 0x100282f3
and dword [ebp - 0xcc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xcc]
sub ecx, dword [ebp + eax - 0x1a0]
mov dword [ebp - 0xd4], ecx
push 1
lea ecx, [ebp - 0xa0]
call fcn.10016e40
mov ecx, dword [ebp - 0xd4]
mov dword [eax], ecx
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xd4]
mov dword [ebp + eax - 0x218], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
call fcn.10016e3b
push 4
push 0x1000
mov eax, dword [ebp - 0x1c]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xdc]
add ecx, dword [eax + 0xc]
push ecx
push 0x356e
push 0x501e
call fcn.100248bb
pop ecx
pop ecx
call eax
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x1c]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x180]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x90]
call fcn.1002494e
add esp, 0xc
mov dword [ebp - 0x3c], 0xffffffff
push 2
lea ecx, [ebp - 0x1ac]
call fcn.10016dd3
mov dword [ebp - 4], 5
mov dword [ebp - 0xe4], 5
mov dword [ebp - 0x70], 0xbbd4856c
mov dword [ebp - 0x148], 0xb51f0ef2
push 0
lea eax, [ebp - 0x1ac]
push eax
push 0x5094
push 0x76e0
lea eax, [ebp - 0x5c]
push eax
call fcn.1002a1d3
add esp, 0x14
mov dword [ebp - 0x5c], 0
jmp 0x100283fb
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x10028411
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x128], 0xaf7b
jmp 0x100283f4
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x3c], 0xb5411457
je 0x1002842f
mov dword [ebp - 0x8c], 1
jmp 0x10028436
and dword [ebp - 0x8c], 0
push 1
lea ecx, [ebp - 0x1ac]
call fcn.10016e40
mov ecx, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 1
jb 0x1002846c
mov dword [ebp - 0xec], 1
jmp 0x10028473
and dword [ebp - 0xec], 0
cmp dword [ebp - 0xec], 1
jge 0x10028488
mov dword [ebp - 0xf4], 1
jmp 0x1002848f
and dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0xf4], eax
je 0x100284b8
push 1
lea ecx, [ebp - 0x1ac]
call fcn.10016e40
cmp dword [eax], 0
je 0x100284b8
mov dword [ebp - 0xfc], 1
jmp 0x100284bf
and dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0xfc]
jl 0x100284d6
mov dword [ebp - 0x104], 1
jmp 0x100284dd
and dword [ebp - 0x104], 0
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jne 0x100284fa
xor eax, eax
inc eax
jne 0x100284fa
and dword [ebp - 0x10c], 0
jmp 0x10028504
mov dword [ebp - 0x10c], 1
mov eax, dword [ebp - 0x10c]
add eax, 7
je 0x10028521
cmp dword [ebp - 0x70], 0
je 0x10028521
mov dword [ebp - 0x168], 1
jmp 0x10028528
and dword [ebp - 0x168], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1d0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x128]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1d8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x128]
mov dword [ebp - 0x1f0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x128]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x128]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x148], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1ac]
call fcn.10016e3b
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x90]
mov dword [eax + 8], ecx
jmp 0x10027d6a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret