Function at 0x1001da0b
Capabilities:
Create process on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10067537
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1388
call fcn.100623f0
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10026126
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xae4], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0xa20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xacc], eax
mov eax, dword [ebp - 0xa20]
movzx eax, byte [eax]
test eax, eax
je 0x1001da87
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
jmp 0x10026121
mov eax, dword [ebp - 0xacc]
mov dword [ebp - 0xaec], eax
mov eax, dword [ebp - 0xad4]
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0xadc]
mov dword [ebp - 0x92c], eax
mov eax, dword [ebp - 0xae4]
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebp - 0xaec]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x3b8], eax
push 1
lea ecx, [ebp - 0xca4]
call fcn.100165ef
and dword [ebp - 4], 0
mov dword [ebp - 0xb0c], 0xfffffffe
mov dword [ebp - 0x15c], 0
jmp 0x1001dafa
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 2
jge 0x1001db16
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x118], 1
jmp 0x1001daed
push 0
push 0x2833
lea eax, [ebp - 0x15c]
push eax
push 0
lea eax, [ebp - 0xca4]
push eax
push 0x1f0f
call fcn.1002dca3
add esp, 0x18
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x118]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x118]
je 0x1001db67
or eax, 0xffffffff
je 0x1001db67
mov dword [ebp - 0xaf4], 1
jmp 0x1001db6e
and dword [ebp - 0xaf4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x118]
mov dword [ebp - 0x1240], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x118]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x118]
cmp eax, 0x2d8cb4c2
jl 0x1001dbb1
mov dword [ebp - 0x5ac], 1
jmp 0x1001dbb8
and dword [ebp - 0x5ac], 0
cmp dword [ebp - 0x5ac], 0xffffffff
jne 0x1001dbcd
mov dword [ebp - 0x944], 1
jmp 0x1001dbd4
and dword [ebp - 0x944], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x118]
add eax, dword [ebp - 0x944]
cmp eax, 0x9f58
jg 0x1001dbfa
mov dword [ebp - 0x94c], 1
jmp 0x1001dc01
and dword [ebp - 0x94c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x118]
cmp dword [ebp - 0x94c], eax
jge 0x1001dc29
push 0x74b7
push 0
call fcn.1002d62c
pop ecx
pop ecx
jmp 0x1001de51
mov dword [ebp - 0x60], 0xfffffffb
mov dword [ebp - 0xafc], 2
mov dword [ebp - 0x9bc], 0xffffffff
mov dword [ebp - 0x60], 0
jmp 0x1001dc54
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jg 0x1001de51
mov dword [ebp - 0xb04], 0x74db9bec
mov eax, dword [ebp - 0x60]
cmp dword [ebp + eax*4 - 0x118], 0
jne 0x1001de01
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp + eax*4 - 0x118]
mov dword [ebp - 0xfb4], eax
push 8
pop eax
test eax, eax
je 0x1001dca5
cmp dword [ebp - 0xafc], 0
je 0x1001dca5
mov dword [ebp - 0x954], 1
jmp 0x1001dcac
and dword [ebp - 0x954], 0
cmp dword [ebp - 0x954], 2
jbe 0x1001dcc1
mov dword [ebp - 0x95c], 1
jmp 0x1001dcc8
and dword [ebp - 0x95c], 0
cmp dword [ebp - 0x95c], 0xe65dd4d1
jae 0x1001dcf8
mov eax, 0x8adc
test eax, eax
jne 0x1001dcf8
push 0
lea ecx, [ebp - 0xca4]
call fcn.100166d5
cmp dword [eax], 0
jne 0x1001dcf8
and dword [ebp - 0x964], 0
jmp 0x1001dd02
mov dword [ebp - 0x964], 1
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp + eax*4 - 0x118]
cmp dword [ebp - 0x964], eax
jg 0x1001dd2a
mov eax, dword [ebp - 0x60]
cmp dword [ebp + eax*4 - 0x118], 0
jne 0x1001dd2a
and dword [ebp - 0x96c], 0
jmp 0x1001dd34
mov dword [ebp - 0x96c], 1
cmp dword [ebp - 0x96c], 0x7fb07d0
je 0x1001dd4c
mov dword [ebp - 0x974], 1
jmp 0x1001dd53
and dword [ebp - 0x974], 0
cmp dword [ebp - 0x974], 0xf392
je 0x1001dd6b
mov dword [ebp - 0x97c], 1
jmp 0x1001dd72
and dword [ebp - 0x97c], 0
cmp dword [ebp - 0x97c], 0xfffffff7
jg 0x1001dd87
mov dword [ebp - 0x984], 1
jmp 0x1001dd8e
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x984]
jle 0x1001dda5
mov dword [ebp - 0x98c], 1
jmp 0x1001ddac
and dword [ebp - 0x98c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x118]
mov ecx, dword [ebp - 0x98c]
add ecx, 0x12af
sub eax, ecx
jne 0x1001dde2
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x118], 0
jne 0x1001dde2
and dword [ebp - 0x9ac], 0
jmp 0x1001ddec
mov dword [ebp - 0x9ac], 1
cmp dword [ebp - 0x9ac], 0xf87b
je 0x1001de01
and dword [ebp - 0x9b4], 0
jmp 0x1001de0b
mov dword [ebp - 0x9b4], 1
mov eax, dword [ebp - 0x9b4]
mov dword [ebp - 0x9bc], eax
cmp dword [ebp - 0x9bc], 0
jne 0x1001de36
mov eax, dword [ebp - 0x60]
cmp dword [ebp + eax*4 - 0x118], 0
jne 0x1001de36
and dword [ebp - 0x93c], 0
jmp 0x1001de40
mov dword [ebp - 0x93c], 1
mov eax, dword [ebp - 0x93c]
mov dword [ebp - 0xb04], eax
jmp 0x1001dc4d
push 0
lea eax, [ebp - 0xb0c]
push eax
lea eax, [ebp - 0xca4]
push eax
call fcn.1002e2de
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xca4]
call fcn.10016651
mov dword [ebp - 0xb24], 0xfffffffc
mov dword [ebp - 0x478], 0xfffffff7
mov dword [ebp - 0xbb4], 0x2b5725d3
mov dword [ebp - 0xba4], 0xfffffffa
mov dword [ebp - 0x2a4], 0x166c1932
mov dword [ebp - 0x11bc], 0xffffffff
mov dword [ebp - 0x11b8], 0xffffffff
mov dword [ebp - 0x11b4], 0xffffffff
mov dword [ebp - 0x11b0], 0xffffffff
mov dword [ebp - 0x24], 0
jmp 0x1001dee2
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1001def8
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x13c], 7
jmp 0x1001dedb
mov dword [ebp - 0x24], 0
jmp 0x1001df08
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1001df1e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1010], 0x5f58
jmp 0x1001df01
mov dword [ebp - 0x24], 0
jmp 0x1001df2e
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1001df44
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x720], 0x3b19
jmp 0x1001df27
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x13c], 0x18
jmp 0x1001df72
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x13c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x13c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x13c], 0xffffffed
jne 0x1001e25e
mov dword [ebp - 0x458], 8
mov dword [ebp - 0x1a8], 0xd1022782
mov dword [ebp - 0x1124], 0x7919adb8
mov dword [ebp - 0xfbc], 1
mov dword [ebp - 0x910], 0x1ce3cb5a
mov dword [ebp - 0x454], 0xffffffff
mov dword [ebp - 0x468], 0xfffffff8
mov dword [ebp - 0x20c], 1
mov dword [ebp - 0xb1c], 1
mov dword [ebp - 0xbac], 0xc837e05a
cmp dword [ebp - 0x2a4], 0
jne 0x1001e005
cmp dword [ebp - 0x458], 0
jne 0x1001e005
and dword [ebp - 0x358], 0
jmp 0x1001e00f
mov dword [ebp - 0x358], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x358]
mov dword [ebp + eax - 0x1010], ecx
mov eax, dword [ebp - 0x1a8]
add eax, dword [ebp - 0x358]
mov dword [ebp - 0x454], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x13c]
mov dword [ebp - 0x1244], eax
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0xfc4], eax
mov eax, dword [ebp - 0x1a8]
add eax, 0x5db
cmp eax, dword [ebp - 0x468]
jle 0x1001e072
mov dword [ebp - 0x450], 1
jmp 0x1001e079
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x910], eax
cmp dword [ebp - 0x910], 0
jne 0x1001e0a0
cmp dword [ebp - 0x1a8], 0
jne 0x1001e0a0
and dword [ebp - 0x710], 0
jmp 0x1001e0aa
mov dword [ebp - 0x710], 1
mov eax, dword [ebp - 0x458]
cmp dword [ebp - 0x710], eax
jl 0x1001e0c4
mov dword [ebp - 0xb14], 1
jmp 0x1001e0cb
and dword [ebp - 0xb14], 0
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x1134], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb1c]
cmp dword [ebp + eax - 0x720], ecx
jl 0x1001e105
mov dword [ebp - 0x460], 1
jmp 0x1001e10c
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0xb24]
cmp dword [ebp - 0x2a4], eax
je 0x1001e132
mov dword [ebp - 0x868], 1
jmp 0x1001e139
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0x868]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0xba4]
cmp dword [ebp - 0x1a8], eax
jg 0x1001e15a
cmp dword [ebp - 0x20c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x468]
cmp dword [ebp + eax - 0x13c], ecx
jge 0x1001e17b
mov dword [ebp - 0x718], 1
jmp 0x1001e182
and dword [ebp - 0x718], 0
cmp dword [ebp - 0x718], 0x1363
jle 0x1001e19a
mov dword [ebp - 0x470], 1
jmp 0x1001e1a1
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0xbac]
imul eax, dword [ebp - 0x470]
cmp eax, dword [ebp - 0x478]
jg 0x1001e1c2
mov dword [ebp - 0x968], 1
jmp 0x1001e1c9
and dword [ebp - 0x968], 0
imul eax, dword [ebp - 0x968], 0xfffa
cmp eax, dword [ebp - 0xbb4]
jg 0x1001e206
mov byte [ebp - 0xba], 0
movzx eax, byte [ebp - 0xba]
test eax, eax
je 0x1001e204
push 0x366
push 0x8c3
push 0
push 0x1291
call dword [sym.imp.USER32.dll_DrawFrameControl]
jmp 0x1001e259
cmp dword [ebp - 0x478], 0x12a7
jl 0x1001e21e
mov dword [ebp - 0x480], 1
jmp 0x1001e225
and dword [ebp - 0x480], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x720]
cmp dword [ebp - 0x480], eax
jg 0x1001e246
mov dword [ebp - 0x870], 1
jmp 0x1001e24d
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x2a4], eax
jmp 0x1001df57
mov dword [ebp - 0x214], 0x885c6f1b
push 3
lea ecx, [ebp - 0x103c]
call fcn.100165ef
mov dword [ebp - 4], 1
mov dword [ebp - 0x488], 0x868bb4a
mov dword [ebp - 0xfcc], 0x56e348cc
mov dword [ebp - 0x70], 0
jmp 0x1001e2a0
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1001e2b6
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x12e0], 0x98a8f939
jmp 0x1001e299
mov dword [ebp - 0x70], 0
jmp 0x1001e2c6
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x1001e2e2
push dword [ebp - 0x70]
lea ecx, [ebp - 0x103c]
call fcn.100166d5
mov dword [eax], 0x3a3fc4b0
jmp 0x1001e2bf
mov dword [ebp - 0x214], 1
jmp 0x1001e2fb
mov eax, dword [ebp - 0x214]
dec eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jl 0x1001e3bb
mov dword [ebp - 0x11d4], 0x34d0069
mov dword [ebp - 0xfd4], 0
push 2
lea ecx, [ebp - 0x1028]
call fcn.100165ef
mov byte [ebp - 4], 2
mov dword [ebp - 0x31c], 0
jmp 0x1001e346
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 2
jge 0x1001e368
push dword [ebp - 0x31c]
lea ecx, [ebp - 0x1028]
call fcn.100166d5
mov dword [eax], 0x23607a98
jmp 0x1001e339
mov eax, dword [ebp - 0x488]
dec eax
mov dword [ebp - 0x488], eax
mov byte [ebp - 0xae], 0
movzx eax, byte [ebp - 0xae]
test eax, eax
je 0x1001e3a7
push 1
push 0x5670
push 0x487f
push 0x4be3
push 0x5eb3
push 0
call fcn.1001c6d5
add esp, 0x18
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1028]
call fcn.10016651
jmp 0x1001e2ee
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x103c]
call fcn.10016651
mov dword [ebp - 0x144], 0x43cdf98a
mov dword [ebp - 0x21c], 0
jmp 0x1001e3ed
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 3
jge 0x1001e409
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0x1068], 0xc93b4e1a
jmp 0x1001e3e0
mov dword [ebp - 0x144], 0
jmp 0x1001e422
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 2
jg 0x1001e4fa
mov dword [ebp - 0x2b4], 0
jmp 0x1001e448
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 2
jge 0x1001e464
mov eax, dword [ebp - 0x2b4]
mov dword [ebp + eax*4 - 0x9c4], 1
jmp 0x1001e43b
mov eax, dword [ebp - 0x144]
cmp dword [ebp + eax*4 - 0x1068], 0
je 0x1001e479
jmp 0x1001e4fa
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x9c4], 2
jmp 0x1001e4a7
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9c4]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x9c4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9c4], 0
jl 0x1001e4f5
mov dword [ebp - 0xbbc], 0
lea eax, [ebp - 0xbbc]
push eax
push 0
call fcn.1002d836
pop ecx
pop ecx
mov byte [ebp - 0xbc], 0
push 0
push 0x3479
lea eax, [ebp - 0xbc]
push eax
push 0x4d72
call fcn.100334b9
add esp, 0x10
jmp 0x1001e48c
jmp 0x1001e415
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1068]
mov dword [ebp - 0x144], eax
push 1
lea ecx, [ebp - 0xcbc]
call fcn.100165ef
mov dword [ebp - 4], 3
push 2
lea ecx, [ebp - 0xe48]
call fcn.100165ef
mov byte [ebp - 4], 4
mov dword [ebp - 0x164], 0x2f4a8b10
push 0x66fb
push 0
lea eax, [ebp - 0x1144]
push eax
lea eax, [ebp - 0xe48]
push eax
push 0x1192
call fcn.10029347
add esp, 0x14
push 0
push 0x18b7
lea eax, [ebp - 0xe48]
push eax
lea eax, [ebp - 0x164]
push eax
push 0x1cc1
call fcn.100290c9
add esp, 0x14
mov dword [ebp - 0x164], 0
jmp 0x1001e598
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0x13
jge 0x1001e9e0
mov dword [ebp - 0x224], 0x3eee2fde
mov dword [ebp - 0x224], 0
jmp 0x1001e5c8
mov eax, dword [ebp - 0x224]
dec eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0xfffffff9
jg 0x1001e9db
mov dword [ebp - 0x2fc], 0x99d94b4b
mov dword [ebp - 0x2fc], 0x11
jmp 0x1001e5f8
mov eax, dword [ebp - 0x2fc]
dec eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0xfffffff8
jle 0x1001e9d6
push 2
lea ecx, [ebp - 0x1078]
call fcn.100165ef
mov byte [ebp - 4], 5
mov dword [ebp - 0x1ac], 0
jmp 0x1001e62f
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 1
jge 0x1001e64b
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0x22c], 0xc17e5c28
jmp 0x1001e622
push 0
push 0
push 0x5839
lea eax, [ebp - 0x1078]
push eax
lea eax, [ebp - 0x1ac]
push eax
push 1
call fcn.1001cc50
add esp, 0x18
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x22c], 0
jmp 0x1001e69a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x22c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x22c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x22c], 1
jg 0x1001e9c2
mov dword [ebp - 0x2bc], 0xffffffff
mov dword [ebp - 0xfdc], 0xffffffff
mov dword [ebp - 0x2bc], 0
jmp 0x1001e6db
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 1
jg 0x1001e9bd
mov dword [ebp - 0x1224], 7
mov dword [ebp - 0x234], 0
jmp 0x1001e70b
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 1
jge 0x1001e727
mov eax, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0x33c], 0x874b28e
jmp 0x1001e6fe
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x33c], 0
jmp 0x1001e755
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x33c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x33c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x33c], 1
jg 0x1001e9b8
mov dword [ebp - 0xbc4], 0x16d0
cmp dword [ebp - 0xbc4], 0xbba
jge 0x1001e859
lea eax, [ebp - 0xbe4]
push eax
lea eax, [ebp - 0xbd4]
push eax
lea eax, [ebp - 0xbdc]
push eax
lea eax, [ebp - 0xbcc]
push eax
push 0x10007a20
call fcn.1004ed2b
add esp, 0x14
mov eax, dword [ebp - 0xbcc]
sub eax, dword [ebp - 0xbd4]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0xbdc]
sub eax, dword [ebp - 0xbe4]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0x8c], 0
jge 0x1001e7e7
mov eax, dword [ebp - 0x8c]
neg eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0xa0], 0
jge 0x1001e7fe
mov eax, dword [ebp - 0xa0]
neg eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0x8c], 1
jge 0x1001e811
mov dword [ebp - 0x8c], 1
cmp dword [ebp - 0xa0], 1
jge 0x1001e824
mov dword [ebp - 0xa0], 1
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0xa0]
shl eax, 1
push eax
push 0x100078ec
call fcn.1004f5a5
pop ecx
pop ecx
mov dword [ebp - 0x728], 0x4957
mov eax, dword [ebp - 0x728]
dec eax
mov dword [ebp - 0x728], eax
mov byte [ebp - 0xb0], 0
mov dword [ebp - 0xac4], 0x1f0a
cmp dword [ebp - 0xac4], 0x539
jge 0x1001e9a0
lea ecx, [ebp - 0xeb4]
call fcn.10015ed2
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x12c8]
call fcn.10015ed2
mov byte [ebp - 4], 7
and dword [ebp - 0x490], 0
lea edx, [ebp - 0xeb4]
mov ecx, 0x10657dd0
call fcn.10038fb1
lea edx, [ebp - 0x12c8]
mov ecx, eax
call fcn.10038fb1
and dword [ebp - 0xcc], 0
jmp 0x1001e8e9
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
lea ecx, [ebp - 0xeb4]
call fcn.10015f53
cmp dword [ebp - 0xcc], eax
jae 0x1001e966
push dword [ebp - 0xcc]
lea ecx, [ebp - 0xeb4]
call fcn.10015f3f
movsx esi, byte [eax]
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x12c8]
call fcn.10015f3f
movsx eax, byte [eax]
lea eax, [esi + eax - 0x60]
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 1
jne 0x1001e94d
push dword [ebp - 0xcc]
lea ecx, [ebp - 0xeb4]
call fcn.10015f3f
mov byte [eax], 0x31
jmp 0x1001e961
push dword [ebp - 0xcc]
lea ecx, [ebp - 0xeb4]
call fcn.10015f3f
mov byte [eax], 0x30
jmp 0x1001e8dc
push fcn.1001aff1
lea edx, [ebp - 0xeb4]
mov ecx, 0x10657d18
call fcn.10038e14
mov ecx, eax
call fcn.1001617d
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x12c8]
call fcn.10015f35
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xeb4]
call fcn.10015f35
movzx eax, byte [ebp - 0xb0]
test eax, eax
je 0x1001e9b3
push 0
call fcn.1002ce44
pop ecx
jmp 0x1001e73a
jmp 0x1001e6ce
jmp 0x1001e67f
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1078]
call fcn.10016651
jmp 0x1001e5eb
jmp 0x1001e5bb
jmp 0x1001e58b
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe48]
call fcn.10016651
mov dword [ebp - 0x158], 0xfffffffe
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x30], 0xfffe
mov dword [ebp - 0x38], 0x11589a45
mov dword [ebp - 0x304], 0x88558b04
mov dword [ebp - 0x140], 0
mov dword [ebp - 0xdc4], 1
mov dword [ebp - 0xdc0], 1
mov dword [ebp - 0xdbc], 1
mov dword [ebp - 0xdb8], 1
lea ecx, [ebp - 0x3b1]
call fcn.10016739
push eax
lea eax, [ebp - 0xdb4]
push eax
lea eax, [ebp - 0xdc4]
push eax
lea ecx, [ebp - 0x12d0]
call fcn.1001673c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xcc8]
call fcn.1001662b
mov byte [ebp - 4], 8
mov dword [ebp - 0x778], 0xffffffff
mov dword [ebp - 0x528], 0
cmp dword [ebp - 0x14], 0
je 0x1001eeb1
cmp dword [ebp - 0x14], 0
jne 0x1001eaba
mov dword [ebp - 0x738], 1
jmp 0x1001eac1
and dword [ebp - 0x738], 0
cmp dword [ebp - 0x14], 1
jne 0x1001ead3
mov dword [ebp - 0x918], 1
jmp 0x1001eada
and dword [ebp - 0x918], 0
cmp dword [ebp - 0x918], 0xd4c3f121
ja 0x1001eaf2
mov dword [ebp - 0x498], 1
jmp 0x1001eaf9
and dword [ebp - 0x498], 0
cmp dword [ebp - 0x498], 0
jle 0x1001eb0e
mov dword [ebp - 0x730], 1
jmp 0x1001eb15
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x730], eax
jge 0x1001eb2c
mov dword [ebp - 0xa4c], 1
jmp 0x1001eb33
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xfe4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1154], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xfec], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jge 0x1001eb65
cmp dword [ebp - 0x14], 0
jne 0x1001eb65
and dword [ebp - 0x4a0], 0
jmp 0x1001eb6f
mov dword [ebp - 0x4a0], 1
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x40], eax
jle 0x1001eb8c
mov dword [ebp - 0x878], 1
jmp 0x1001eb93
and dword [ebp - 0x878], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x878], eax
jne 0x1001ebaa
mov dword [ebp - 0x4a8], 1
jmp 0x1001ebb1
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x4a8], eax
jl 0x1001ebc8
mov dword [ebp - 0x4b0], 1
jmp 0x1001ebcf
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x738]
cmp eax, dword [ebp - 0x4b0]
jne 0x1001ebe9
mov dword [ebp - 0x994], 1
jmp 0x1001ebf0
and dword [ebp - 0x994], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x994], eax
jne 0x1001ec07
mov dword [ebp - 0xa10], 1
jmp 0x1001ec0e
and dword [ebp - 0xa10], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x11e8], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x40], eax
jne 0x1001ec2b
mov dword [ebp - 0xb70], 1
jmp 0x1001ec32
and dword [ebp - 0xb70], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xff4], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1164], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x40], eax
jl 0x1001ec58
mov dword [ebp - 0x4b8], 1
jmp 0x1001ec5f
and dword [ebp - 0x4b8], 0
cmp dword [ebp - 0x4b8], 0
jl 0x1001ec6e
cmp dword [ebp - 0x30], 0
je 0x1001ec75
push 2
pop eax
test eax, eax
jne 0x1001ec8a
cmp dword [ebp - 0x40], 0
jne 0x1001ec8a
cmp dword [ebp - 0x14], 0
jne 0x1001ec8a
and dword [ebp - 0x740], 0
jmp 0x1001ec94
mov dword [ebp - 0x740], 1
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x740], eax
jg 0x1001ecab
mov dword [ebp - 0x4c0], 1
jmp 0x1001ecb2
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x4c0], eax
jle 0x1001eccf
mov eax, 0xfce9
test eax, eax
jne 0x1001eccf
and dword [ebp - 0x880], 0
jmp 0x1001ecd9
mov dword [ebp - 0x880], 1
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x880]
mov dword [ebp - 0x4c8], 1
jmp 0x1001ecf5
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x4c8]
cmp eax, dword [ebp - 0x30]
jne 0x1001ed0f
mov dword [ebp - 0x748], 1
jmp 0x1001ed16
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x748]
sub eax, dword [ebp - 0x30]
add eax, 0xa
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x304], eax
jge 0x1001ed3f
mov dword [ebp - 0x4d0], 1
jmp 0x1001ed46
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x4d0]
add eax, 0x3d55f422
jne 0x1001ed62
cmp dword [ebp - 0x38], 0
jne 0x1001ed62
and dword [ebp - 0x920], 0
jmp 0x1001ed6c
mov dword [ebp - 0x920], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x920], eax
je 0x1001ed83
mov dword [ebp - 0x4d8], 1
jmp 0x1001ed8a
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x4d8], eax
jne 0x1001eda1
mov dword [ebp - 0x750], 1
jmp 0x1001eda8
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x750], eax
jge 0x1001edbf
mov dword [ebp - 0x4e0], 1
jmp 0x1001edc6
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x4e0]
cmp eax, dword [ebp - 0x14]
jl 0x1001ede1
mov dword [ebp - 0x888], 1
jmp 0x1001ede8
and dword [ebp - 0x888], 0
cmp dword [ebp - 0x888], 2
jae 0x1001edfd
mov dword [ebp - 0x4e8], 1
jmp 0x1001ee04
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
je 0x1001ee2c
push 8
pop eax
test eax, eax
je 0x1001ee2c
mov dword [ebp - 0x758], 1
jmp 0x1001ee33
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x758], eax
jle 0x1001ee4a
mov dword [ebp - 0xa18], 1
jmp 0x1001ee51
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xffc], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x123c], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x1001ee75
mov dword [ebp - 0x4f0], 1
jmp 0x1001ee7c
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x4f0], eax
jle 0x1001ee93
mov dword [ebp - 0x970], 1
jmp 0x1001ee9a
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x970]
sub eax, dword [ebp - 0x30]
je 0x1001eeb1
mov dword [ebp - 0x4f8], 1
jmp 0x1001eeb8
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x4f8]
cmp eax, dword [ebp - 0x38]
jl 0x1001eed3
mov dword [ebp - 0x368], 1
jmp 0x1001eeda
and dword [ebp - 0x368], 0
push 2
lea ecx, [ebp - 0xcc8]
call fcn.100166d5
mov ecx, dword [ebp - 0x368]
mov dword [eax], ecx
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x368]
cmp eax, dword [ebp - 0x30]
jge 0x1001ef65
mov dword [ebp - 0xc54], 0
mov dword [ebp - 0x38], 0
jmp 0x1001ef17
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x15
jle 0x1001ef3a
lea eax, [ebp - 0xc54]
push eax
push 0
push 0x2abc
push 0x3754
call fcn.10031ec7
add esp, 0x10
jmp 0x1001ef10
mov byte [ebp - 0xbe], 0
movzx eax, byte [ebp - 0xbe]
test eax, eax
je 0x1001ef60
push 0
push 0x7843
push 0x2f4
call fcn.1002c1d7
add esp, 0xc
jmp 0x1001f259
mov dword [ebp - 0x23c], 0xe89e
mov dword [ebp - 0xa00], 0xe340cfce
mov dword [ebp - 0x364], 0xb14a51e2
mov dword [ebp - 0x2c4], 0
mov dword [ebp - 0x928], 8
push 2
lea ecx, [ebp - 0xecc]
call fcn.100165ef
mov byte [ebp - 4], 9
push 0x2a8e
push 0
lea eax, [ebp - 0xecc]
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.10031049
add esp, 0x10
cmp dword [ebp - 0x23c], 0
jne 0x1001efe0
mov eax, 0xf7cc8272
test eax, eax
jne 0x1001efe0
and dword [ebp - 0x760], 0
jmp 0x1001efea
mov dword [ebp - 0x760], 1
mov eax, dword [ebp - 0x760]
sub eax, dword [ebp - 0x23c]
mov dword [ebp - 0xa00], eax
cmp dword [ebp - 0x364], 0xec4
je 0x1001f014
mov dword [ebp - 0x500], 1
jmp 0x1001f01b
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x364]
cmp dword [ebp - 0x500], eax
je 0x1001f035
mov dword [ebp - 0x890], 1
jmp 0x1001f03c
and dword [ebp - 0x890], 0
mov dword [ebp - 0x40], 0x93cdb7cf
mov eax, dword [ebp - 0x890]
add eax, 8
cmp dword [ebp - 0x40], eax
jle 0x1001f05d
mov dword [ebp - 0x508], 1
jmp 0x1001f064
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x508]
jg 0x1001f07b
mov dword [ebp - 0x768], 1
jmp 0x1001f082
and dword [ebp - 0x768], 0
push 2
lea ecx, [ebp - 0xcc8]
call fcn.100166d5
mov eax, dword [eax]
sub eax, dword [ebp - 0x768]
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0x31225765
jg 0x1001f0b5
mov dword [ebp - 0x510], 1
jmp 0x1001f0bc
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x23c]
add eax, dword [ebp - 0x510]
je 0x1001f0f6
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x364]
push eax
push 0
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10032758
add esp, 0x18
jmp 0x1001f24a
mov dword [ebp - 0xd2c], 0x626c4802
mov dword [ebp - 0xd28], 0x626c4802
mov dword [ebp - 0xd24], 0x626c4802
mov dword [ebp - 0xd20], 0x626c4802
mov esi, dword [ebp - 0x23c]
push 0
lea ecx, [ebp - 0xecc]
call fcn.100166d5
mov dword [eax], esi
mov dword [ebp - 0x140], 0
jmp 0x1001f14c
mov eax, dword [ebp - 0x140]
dec eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xfffffffd
jl 0x1001f24a
mov dword [ebp - 0x244], 0xfc02
cmp dword [ebp - 0x244], 0
je 0x1001f197
mov eax, dword [ebp - 0x304]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xd2c]
add ecx, dword [ebp - 0x778]
imul eax, ecx
test eax, eax
je 0x1001f197
mov dword [ebp - 0x518], 1
jmp 0x1001f19e
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x928]
cmp dword [ebp - 0x518], eax
je 0x1001f1b8
mov dword [ebp - 0x770], 1
jmp 0x1001f1bf
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x244]
cmp dword [ebp - 0x770], eax
je 0x1001f1d9
mov dword [ebp - 0xb7c], 1
jmp 0x1001f1e0
and dword [ebp - 0xb7c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2c4]
cmp dword [ebp + eax - 0xd2c], ecx
jg 0x1001f206
cmp dword [ebp - 0x244], 0
jne 0x1001f206
and dword [ebp - 0x520], 0
jmp 0x1001f210
mov dword [ebp - 0x520], 1
cmp dword [ebp - 0x520], 0x871cfee8
jb 0x1001f228
mov dword [ebp - 0x898], 1
jmp 0x1001f22f
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0x244]
imul eax, dword [ebp - 0x898]
imul eax, eax, 0
mov dword [ebp - 0x528], eax
jmp 0x1001f13f
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xecc]
call fcn.10016651
push 0
lea eax, [ebp - 0xcc8]
push eax
push 0xeac
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x620c
lea eax, [ebp - 0x528]
push eax
push 0xab5
lea eax, [ebp - 0x38]
push eax
push 0
lea eax, [ebp - 0x778]
push eax
call fcn.1001c7ec
add esp, 0x30
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xcc8]
call fcn.10016651
mov dword [ebp - 0x1cc], 0
jmp 0x1001f2c4
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 2
jge 0x1001f2e0
mov eax, dword [ebp - 0x1cc]
mov dword [ebp + eax*4 - 0x110], 1
jmp 0x1001f2b7
mov dword [ebp - 0x788], 0x64fd9e2a
mov dword [ebp - 0x16c], 1
mov dword [ebp - 0x254], 1
mov dword [ebp - 0x8a0], 0xfffffffc
mov dword [ebp - 0x2cc], 0x7ea4c57
mov dword [ebp - 0x790], 0xf30b91ee
mov dword [ebp - 0x36c], 0xfff8
mov dword [ebp - 0x3f4], 1
mov dword [ebp - 0xa28], 1
mov dword [ebp - 0x24c], 0
jmp 0x1001f353
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 2
jge 0x1001f36f
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0x40c], 1
jmp 0x1001f346
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0x530], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x530]
mov dword [ebp + eax - 0x40c], ecx
cmp dword [ebp - 0x530], 0
jne 0x1001f42d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40c]
add eax, 0x6b2f0b0d
mov dword [ebp - 0x9a4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x9a4]
mov dword [ebp + eax - 0x40c], ecx
cmp dword [ebp - 0x9a4], 0x839e071a
jne 0x1001f3de
mov dword [ebp - 0x538], 1
jmp 0x1001f3e5
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x254], eax
jge 0x1001f40b
mov dword [ebp - 0x780], 1
jmp 0x1001f412
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x16c]
imul eax, dword [ebp - 0x780]
cmp eax, 2
je 0x1001f42d
and dword [ebp - 0x540], 0
jmp 0x1001f437
mov dword [ebp - 0x540], 1
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0x8a0], eax
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x8a0], eax
jg 0x1001f45d
mov dword [ebp - 0x548], 1
jmp 0x1001f464
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x548]
sub eax, dword [ebp - 0x788]
cmp eax, 5
jne 0x1001f481
mov dword [ebp - 0x550], 1
jmp 0x1001f488
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x550], eax
jle 0x1001f4a2
mov dword [ebp - 0x930], 1
jmp 0x1001f4a9
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x16c]
add eax, dword [ebp - 0x930]
mov dword [ebp - 0x2cc], eax
jne 0x1001f4cf
mov eax, 0x3799
test eax, eax
jne 0x1001f4cf
and dword [ebp - 0x558], 0
jmp 0x1001f4d9
mov dword [ebp - 0x558], 1
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0x790], eax
mov eax, dword [ebp - 0x790]
mov dword [ebp - 0x1174], eax
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x1080], eax
mov dword [ebp - 0x3f4], 0xbcabebf3
cmp dword [ebp - 0x36c], 0
jne 0x1001f529
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x40c], 0
jne 0x1001f529
and dword [ebp - 0x560], 0
jmp 0x1001f533
mov dword [ebp - 0x560], 1
mov eax, dword [ebp - 0x3f4]
cmp dword [ebp - 0x560], eax
jg 0x1001f54d
mov dword [ebp - 0x798], 1
jmp 0x1001f554
and dword [ebp - 0x798], 0
mov dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x105c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40c]
mov dword [ebp - 0x1184], eax
xor eax, eax
inc eax
je 0x1001f597
mov eax, 0xb209
test eax, eax
je 0x1001f597
mov dword [ebp - 0x8a8], 1
jmp 0x1001f59e
and dword [ebp - 0x8a8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x40c]
cmp dword [ebp - 0x8a8], eax
jl 0x1001f5d1
cmp dword [ebp - 0x3f4], 0
je 0x1001f5d1
mov eax, 0xf205
test eax, eax
je 0x1001f5d1
mov dword [ebp - 0x568], 1
jmp 0x1001f5d8
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0x568], eax
jne 0x1001f5f2
mov dword [ebp - 0x570], 1
jmp 0x1001f5f9
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x798]
add eax, dword [ebp - 0x570]
je 0x1001f615
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x40c], 0
cmp dword [ebp - 0x36c], 8
jb 0x1001f62a
mov dword [ebp - 0x978], 1
jmp 0x1001f631
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x254]
add eax, dword [ebp - 0x978]
mov dword [ebp - 0xa28], eax
push 0
lea eax, [ebp - 0xcbc]
push eax
lea eax, [ebp - 0x1cc]
push eax
call fcn.1002d722
add esp, 0xc
mov dword [ebp - 0x20], 0xe56f9b2c
mov dword [ebp - 0x37c], 0
mov dword [ebp - 0x2d4], 0xffffffff
push 1
lea ecx, [ebp - 0xce0]
call fcn.100165ef
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x5a0], 0xffffffff
mov dword [ebp - 0x106c], 0xffffffff
mov dword [ebp - 0xc94], 0x1c9a
cmp dword [ebp - 0xc94], 0x135f
jge 0x1001f949
lea eax, [ebp - 0x578]
push eax
mov ecx, 0x10657dd0
call fcn.10015f8e
lea ecx, [ebp - 0xe18]
call fcn.10015ed2
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1204]
call fcn.10015ed2
mov byte [ebp - 4], 0xc
lea edx, [ebp - 0xe18]
mov ecx, 0x10657dd0
call fcn.10038fb1
lea edx, [ebp - 0x1204]
mov ecx, eax
call fcn.10038fb1
lea edx, [ebp - 0x1204]
lea ecx, [ebp - 0xe18]
call fcn.10038fb6
movzx eax, al
test eax, eax
je 0x1001f731
push fcn.1001aff1
push 0
mov ecx, 0x10657d18
call fcn.10016189
mov ecx, eax
call fcn.1001617d
lea ecx, [ebp - 0xbf4]
call fcn.100165e2
mov byte [ebp - 4], 0xd
and dword [ebp - 0x94], 0
jmp 0x1001f756
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x578]
jge 0x1001f897
push dword [ebp - 0x94]
lea ecx, [ebp - 0xe18]
call fcn.10015f3f
movsx esi, byte [eax]
push dword [ebp - 0x94]
lea ecx, [ebp - 0x1204]
call fcn.10015f3f
movsx eax, byte [eax]
cmp esi, eax
je 0x1001f892
or dword [ebp - 0x3bc], 0xffffffff
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x174], eax
jmp 0x1001f7bb
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x174]
cmp eax, dword [ebp - 0x578]
jge 0x1001f805
push dword [ebp - 0x174]
lea ecx, [ebp - 0xe18]
call fcn.10015f3f
movsx esi, byte [eax]
push dword [ebp - 0x94]
lea ecx, [ebp - 0x1204]
call fcn.10015f3f
movsx eax, byte [eax]
cmp esi, eax
jne 0x1001f803
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x3bc], eax
jmp 0x1001f805
jmp 0x1001f7ae
cmp dword [ebp - 0x3bc], 0xffffffff
jne 0x1001f826
push fcn.1001aff1
push 0xffffffffffffffff
mov ecx, 0x10657d18
call fcn.10016189
mov ecx, eax
call fcn.1001617d
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x14c], eax
jmp 0x1001f841
mov eax, dword [ebp - 0x14c]
dec eax
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x94]
jle 0x1001f892
mov eax, dword [ebp - 0x14c]
dec eax
push eax
lea ecx, [ebp - 0xe18]
call fcn.10015f3f
mov esi, eax
push dword [ebp - 0x14c]
lea ecx, [ebp - 0xe18]
call fcn.10015f3f
mov edx, esi
mov ecx, eax
call fcn.1001b646
lea eax, [ebp - 0x14c]
push eax
lea ecx, [ebp - 0xbf4]
call fcn.100166e4
jmp 0x1001f834
jmp 0x1001f749
push fcn.1001aff1
lea ecx, [ebp - 0xbf4]
call fcn.100166cc
push eax
mov ecx, 0x10657d18
call fcn.1001629b
mov ecx, eax
call fcn.1001617d
and dword [ebp - 0x324], 0
jmp 0x1001f8cf
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
lea ecx, [ebp - 0xbf4]
call fcn.100166cc
cmp dword [ebp - 0x324], eax
jae 0x1001f90d
push dword [ebp - 0x324]
lea ecx, [ebp - 0xbf4]
call fcn.100166d5
push dword [eax]
mov ecx, 0x10657d18
call fcn.10016189
mov edx, 0x100078ac
mov ecx, eax
call fcn.1001ac64
jmp 0x1001f8c2
push fcn.1001aff1
mov ecx, 0x10657d18
call fcn.1001617d
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xbf4]
call fcn.10016651
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1204]
call fcn.10015f35
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xe18]
call fcn.10015f35
lea eax, [ebp - 0xce0]
push eax
push 0x793
push 0x2f70
push 1
push 0x3067
push 0
lea eax, [ebp - 0x1b4]
push eax
push 0
push 0x54d0
push 0x53ec
call fcn.100334ea
add esp, 0x28
mov dword [ebp - 0x1b4], 0
jmp 0x1001f997
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jge 0x1001f9b3
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x1318], 4
jmp 0x1001f98a
cmp dword [ebp - 0x20], 0
je 0x1001f9f9
cmp dword [ebp - 0x20], 0x8e1b8814
jne 0x1001f9ce
mov dword [ebp - 0xa30], 1
jmp 0x1001f9d5
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x122c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xf00], eax
cmp dword [ebp - 0x20], 0
je 0x1001f9f9
mov dword [ebp - 0x7a0], 1
jmp 0x1001fa00
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0
je 0x1001fff6
mov dword [ebp - 0x580], 0xabc24891
mov dword [ebp - 0x588], 0xfffffff6
mov dword [ebp - 0x598], 1
mov dword [ebp - 0x20], 0
jmp 0x1001fa53
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x1001ff0f
mov byte [ebp - 0xa1], 0
mov dword [ebp - 0xb88], 0x2377
cmp dword [ebp - 0xb88], 0x73e
jge 0x1001fd25
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x10007828
call fcn.1004ed2b
add esp, 0xc
and dword [ebp - 0xd4], 0
lea ecx, [ebp - 0x43c]
call fcn.100165e2
mov byte [ebp - 4], 0xe
and dword [ebp - 0x374], 0
jmp 0x1001fac2
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x374]
cmp eax, dword [ebp - 0xa38]
jge 0x1001fb97
lea eax, [ebp - 0xc5c]
push eax
push 0x100077e4
call fcn.1004ed2b
pop ecx
pop ecx
cmp dword [ebp - 0xc5c], 1
jne 0x1001fb2a
lea eax, [ebp - 0xa40]
push eax
push 0x100077e8
call fcn.1004ed2b
pop ecx
pop ecx
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0xa40]
add eax, dword [ebp - 0xd4]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
cdq
idiv dword [ebp - 0x3c]
mov dword [ebp - 0xd4], edx
jmp 0x1001fb92
lea ecx, [ebp - 0x43c]
call fcn.100166cc
test eax, eax
je 0x1001fb68
lea ecx, [ebp - 0x43c]
call fcn.1001678f
mov ecx, dword [ebp - 0xd4]
and ecx, 0x80000001
jns 0x1001fb57
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp dword [eax], ecx
jne 0x1001fb68
lea ecx, [ebp - 0x43c]
call fcn.100167e9
jmp 0x1001fb92
mov eax, dword [ebp - 0xd4]
and eax, 0x80000001
jns 0x1001fb7a
dec eax
or eax, 0xfffffffe
inc eax
mov dword [ebp - 0xb94], eax
lea eax, [ebp - 0xb94]
push eax
lea ecx, [ebp - 0x43c]
call fcn.10016796
jmp 0x1001fab5
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xc04]
call fcn.100165ef
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x43c]
call fcn.100166cc
test eax, eax
jne 0x1001fbfa
and dword [ebp - 0x17c], 0
jmp 0x1001fbce
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
cmp eax, dword [ebp - 0x3c]
jge 0x1001fbf5
mov esi, dword [ebp - 0x17c]
inc esi
push dword [ebp - 0x17c]
lea ecx, [ebp - 0xc04]
call fcn.100166d5
mov dword [eax], esi
jmp 0x1001fbc1
jmp 0x1001fcac
and dword [ebp - 0x9c], 0
jmp 0x1001fc10
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x3c]
jge 0x1001fcac
push 0
lea ecx, [ebp - 0x43c]
call fcn.100166d5
mov ecx, dword [ebp - 0x9c]
add ecx, dword [eax]
and ecx, 0x80000001
jns 0x1001fc41
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
jne 0x1001fc72
mov esi, dword [ebp - 0x9c]
inc esi
lea ecx, [ebp - 0x43c]
call fcn.100166cc
add eax, dword [ebp - 0x9c]
xor edx, edx
div dword [ebp - 0x3c]
push edx
lea ecx, [ebp - 0xc04]
call fcn.100166d5
mov dword [eax], esi
jmp 0x1001fca7
mov esi, dword [ebp - 0x9c]
inc esi
lea ecx, [ebp - 0x43c]
call fcn.100166cc
xor edx, edx
div dword [ebp - 0x3c]
mov eax, dword [ebp - 0x9c]
sub eax, edx
add eax, dword [ebp - 0x3c]
xor edx, edx
div dword [ebp - 0x3c]
push edx
lea ecx, [ebp - 0xc04]
call fcn.100166d5
mov dword [eax], esi
jmp 0x1001fc03
and dword [ebp - 0x25c], 0
jmp 0x1001fcc2
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x25c]
cmp eax, dword [ebp - 0x3c]
jge 0x1001fcfc
mov eax, dword [ebp - 0x25c]
add eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0xd4]
cdq
idiv dword [ebp - 0x3c]
push edx
lea ecx, [ebp - 0xc04]
call fcn.100166d5
push dword [eax]
push 0x1000784c
call fcn.1004f5a5
pop ecx
pop ecx
jmp 0x1001fcb5
push 0x10007751
call fcn.1004f8f6
pop ecx
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xc04]
call fcn.10016651
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x43c]
call fcn.10016651
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x1001fd38
push 0
call fcn.1002d675
pop ecx
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x1001ff0a
mov dword [ebp - 0xa48], 0x25cc
cmp dword [ebp - 0xa48], 0x625
jge 0x1001fef4
lea eax, [ebp - 0x3e4]
push eax
mov ecx, 0x10657dd0
call fcn.10015f8e
push dword [ebp - 0x3e4]
lea ecx, [ebp - 0xcf8]
call fcn.100165ef
mov byte [ebp - 4], 0x10
xorpd xmm0, xmm0
movlpd qword [ebp - 0x428], xmm0
and dword [ebp - 0x1dc], 0
jmp 0x1001fdb0
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x1dc]
cmp eax, dword [ebp - 0x3e4]
jge 0x1001fe08
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0xcf8]
call fcn.100166d5
push eax
mov ecx, 0x10657dd0
call fcn.10015f8e
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0xcf8]
call fcn.100166d5
mov eax, dword [eax]
cdq
add eax, dword [ebp - 0x428]
adc edx, dword [ebp - 0x424]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], edx
jmp 0x1001fda3
xorpd xmm0, xmm0
movlpd qword [ebp - 0x430], xmm0
and dword [ebp - 0x184], 0
jmp 0x1001fe2a
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x184]
cmp eax, dword [ebp - 0x3e4]
jge 0x1001fee5
push dword [ebp - 0x184]
lea ecx, [ebp - 0xcf8]
call fcn.100166d5
mov eax, dword [eax]
cdq
add eax, dword [ebp - 0x430]
adc edx, dword [ebp - 0x42c]
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp - 0x42c]
mov ecx, dword [ebp - 0x430]
call fcn.10066a4f
mov edx, dword [ebp - 0x424]
mov ecx, dword [ebp - 0x428]
movsd qword [ebp - 0x1050], xmm0
call fcn.10066a4f
divsd xmm0, qword [0x10007de0]
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.1004fd20
pop ecx
pop ecx
fstp qword [ebp - 0x101c]
movsd xmm0, qword [ebp - 0x1050]
comisd xmm0, xmmword [ebp - 0x101c]
jb 0x1001fee0
push fcn.1001aff1
mov eax, dword [ebp - 0x184]
inc eax
push eax
mov ecx, 0x10657d18
call fcn.10016189
mov ecx, eax
call fcn.1001617d
jmp 0x1001fee5
jmp 0x1001fe1d
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xcf8]
call fcn.10016651
push 0x53e6
push 0
push 1
push 0x5626
call fcn.1001d4d1
add esp, 0x10
jmp 0x1001fa4c
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x580], eax
mov eax, dword [ebp - 0x588]
cmp dword [ebp - 0x580], eax
jg 0x1001ff35
mov dword [ebp - 0x8b0], 1
jmp 0x1001ff3c
and dword [ebp - 0x8b0], 0
cmp dword [ebp - 0x8b0], 0x43260389
je 0x1001ff54
mov dword [ebp - 0x7a8], 1
jmp 0x1001ff5b
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x588]
cmp dword [ebp - 0x7a8], eax
jg 0x1001ff75
mov dword [ebp - 0x590], 1
jmp 0x1001ff7c
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x590], eax
jg 0x1001ff99
cmp dword [ebp - 0x2d4], 0
jne 0x1001ff99
and dword [ebp - 0x938], 0
jmp 0x1001ffa3
mov dword [ebp - 0x938], 1
mov eax, dword [ebp - 0x938]
mov dword [ebp - 0x598], eax
mov esi, dword [ebp - 0x598]
push 0
lea ecx, [ebp - 0xce0]
call fcn.100166d5
cmp esi, dword [eax]
jle 0x1001ffd2
mov dword [ebp - 0x7b0], 1
jmp 0x1001ffd9
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x7b0]
mov dword [ebp - 0x5a0], eax
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0x2d4], eax
jmp 0x10020152
push 3
lea ecx, [ebp - 0x1048]
call fcn.100165ef
mov byte [ebp - 4], 0x11
mov dword [ebp - 0xd9c], 0x2455f992
mov dword [ebp - 0xd98], 0x2455f992
mov dword [ebp - 0xd94], 0x2455f992
mov dword [ebp - 0xd90], 0x2455f992
lea ecx, [ebp - 0x3cd]
call fcn.10016739
push eax
lea eax, [ebp - 0xd8c]
push eax
lea eax, [ebp - 0xd9c]
push eax
lea ecx, [ebp - 0x12e8]
call fcn.1001673c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x128c]
call fcn.1001662b
mov byte [ebp - 4], 0x12
mov dword [ebp - 0xc7c], 0xa67606e8
mov dword [ebp - 0x8b8], 0xb0d6
lea eax, [ebp - 0x1048]
push eax
push 0
push 0x709f
lea eax, [ebp - 0x1bc]
push eax
call fcn.1002e1fe
add esp, 0x10
mov dword [ebp - 0x1bc], 0
jmp 0x100200b2
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 1
jge 0x100200ce
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0xf08], 7
jmp 0x100200a5
mov eax, dword [ebp - 0x8b8]
inc eax
mov dword [ebp - 0x8b8], eax
mov dword [ebp - 0x20], 0
jmp 0x100200eb
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x10020134
push 1
push 0x7c89
lea eax, [ebp - 0xce0]
push eax
push 0x4ea1
push 0x843
push 0x4f1e
lea eax, [ebp - 0x20]
push eax
push 0x64a0
lea eax, [ebp - 0xc7c]
push eax
push 0x65cd
push 0
push 0x1513
call fcn.1001c7ec
add esp, 0x30
jmp 0x100200e4
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x128c]
call fcn.10016651
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1048]
call fcn.10016651
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xce0]
call fcn.10016651
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x110]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x110]
je 0x1002018e
or eax, 0xffffffff
je 0x1002018e
mov dword [ebp - 0xa50], 1
jmp 0x10020195
and dword [ebp - 0xa50], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x110]
mov dword [ebp - 0xf10], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x110]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x110]
cmp eax, 0x2d8cb4c2
jl 0x100201d8
mov dword [ebp - 0x5a8], 1
jmp 0x100201df
and dword [ebp - 0x5a8], 0
cmp dword [ebp - 0x5a8], 0xffffffff
jne 0x100201f4
mov dword [ebp - 0x7b8], 1
jmp 0x100201fb
and dword [ebp - 0x7b8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x110]
add eax, dword [ebp - 0x7b8]
cmp eax, 0x9f58
jg 0x10020221
mov dword [ebp - 0x5b0], 1
jmp 0x10020228
and dword [ebp - 0x5b0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x110]
cmp dword [ebp - 0x5b0], eax
jge 0x1002085c
mov dword [ebp - 0xf18], 0xe9323d1b
mov dword [ebp - 0xf20], 0
mov dword [ebp - 0x7c], 0
jmp 0x10020265
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x1002027b
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x264], 0xb9f9b31
jmp 0x1002025e
mov dword [ebp - 0x7c], 0
jmp 0x1002028b
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 4
jge 0x100202a1
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x1384], 9
jmp 0x10020284
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x264], 0xffffffe7
jmp 0x100202cf
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x264]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x264], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x264], 0xffffffed
je 0x1002048b
mov dword [ebp - 0x30c], 0xfd94fe5f
mov dword [ebp - 0xba0], 0x815cbcef
mov dword [ebp - 0xf28], 0xa29822cb
mov dword [ebp - 0x9b0], 0xffffffff
mov dword [ebp - 0xa58], 0x62b0a94f
mov dword [ebp - 0x2c], 0
jmp 0x10020325
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1002033b
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1344], 0
jmp 0x1002031e
mov dword [ebp - 0x2c], 0
jmp 0x1002034b
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x10020361
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1374], 0x89b1ab44
jmp 0x10020344
mov dword [ebp - 0x2c], 0
jmp 0x10020371
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10020387
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xf30], 0
jmp 0x1002036a
mov dword [ebp - 0x30c], 0
jmp 0x100203a0
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 2
jg 0x10020486
mov dword [ebp - 0xf38], 1
mov dword [ebp - 0xf40], 0
mov dword [ebp - 0xf48], 1
mov dword [ebp - 0xf50], 0x78470ed9
mov dword [ebp - 0xf58], 0xa311c3fc
push 3
lea ecx, [ebp - 0x1090]
call fcn.100165ef
mov byte [ebp - 4], 0x13
mov dword [ebp - 0xf60], 0xffffffff
mov dword [ebp - 0x26c], 0
jmp 0x10020413
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 3
jge 0x10020435
push dword [ebp - 0x26c]
lea ecx, [ebp - 0x1090]
call fcn.100166d5
mov dword [eax], 0x3e458c45
jmp 0x10020406
mov eax, dword [ebp - 0x9b0]
dec eax
mov dword [ebp - 0x9b0], eax
push 0x6e97
push 1
push 0x50af
push 0x54ee
push 0x163e
lea eax, [ebp - 0xba0]
push eax
lea eax, [ebp - 0xa58]
push eax
push 0
push 0
call fcn.1001da0b
add esp, 0x24
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1090]
call fcn.10016651
jmp 0x10020393
jmp 0x100202b4
mov byte [ebp - 0x105], 0
mov dword [ebp - 0x274], 0x871c7bf0
mov dword [ebp - 0x2dc], 0
jmp 0x100204b5
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 3
jge 0x100204d1
mov eax, dword [ebp - 0x2dc]
mov dword [ebp + eax*4 - 0x1368], 0xa6847dfa
jmp 0x100204a8
push 0
push 0x7fdf
call fcn.1002e0c5
pop ecx
pop ecx
mov dword [ebp - 0x274], 0
jmp 0x100204f8
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 2
jg 0x10020723
mov dword [ebp - 0x334], 0
jmp 0x1002051e
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 3
jge 0x1002053a
mov eax, dword [ebp - 0x334]
mov dword [ebp + eax*4 - 0xd10], 7
jmp 0x10020511
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xd10], 2
jmp 0x10020568
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd10]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xd10], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd10], 0
jl 0x100205a0
mov byte [ebp - 0xc0], 0
movzx eax, byte [ebp - 0xc0]
test eax, eax
je 0x1002059e
push 0x4c7c
push 0x764c
push 0
call fcn.10030d39
add esp, 0xc
jmp 0x1002054d
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x1002071e
mov dword [ebp - 0xc64], 0x1bcb
cmp dword [ebp - 0xc64], 0x135a
jge 0x10020701
lea eax, [ebp - 0x1d4]
push eax
push 0x100077e4
call fcn.1004ed2b
pop ecx
pop ecx
and dword [ebp - 0x5b8], 0
and dword [ebp - 0x7c0], 0
and dword [ebp - 0x18c], 0
and dword [ebp - 0x194], 0
and dword [ebp - 0x3c4], 0
jmp 0x10020615
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x3c4]
cmp eax, dword [ebp - 0x1d4]
jge 0x10020664
lea eax, [ebp - 0x7c0]
push eax
lea eax, [ebp - 0x5b8]
push eax
push 0x100078e4
call fcn.1004ed2b
add esp, 0xc
mov eax, dword [ebp - 0x18c]
add eax, dword [ebp - 0x5b8]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x194]
add eax, dword [ebp - 0x7c0]
mov dword [ebp - 0x194], eax
jmp 0x10020608
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x1d4]
cdq
sub eax, edx
sar eax, 1
cmp dword [ebp - 0x18c], eax
jg 0x1002068c
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x5c0], eax
jmp 0x1002069e
mov eax, dword [ebp - 0x1d4]
sub eax, dword [ebp - 0x18c]
mov dword [ebp - 0x5c0], eax
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x1d4]
cdq
sub eax, edx
sar eax, 1
cmp dword [ebp - 0x194], eax
jg 0x100206cb
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x8c0], eax
jmp 0x100206dd
mov eax, dword [ebp - 0x1d4]
sub eax, dword [ebp - 0x194]
mov dword [ebp - 0x8c0], eax
mov eax, dword [ebp - 0x27c]
add eax, dword [ebp - 0x8c0]
mov dword [ebp - 0x27c], eax
push dword [ebp - 0x27c]
push 0x100078ec
call fcn.1004f5a5
pop ecx
pop ecx
push 0
push 1
push 0x10f2
push 0x2f74
push 0x32d7
push 1
call fcn.1001cc50
add esp, 0x18
jmp 0x100204eb
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x10020857
push 2
lea ecx, [ebp - 0x9f0]
call fcn.100165ef
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x74], 0
jmp 0x10020753
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x10020769
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x10a0], 0xfffffff9
jmp 0x1002074c
mov dword [ebp - 0x74], 0
jmp 0x10020779
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x10020795
push dword [ebp - 0x74]
lea ecx, [ebp - 0x9f0]
call fcn.100166d5
mov dword [eax], 0xecb45710
jmp 0x10020772
mov byte [ebp - 0xb7], 0
movzx eax, byte [ebp - 0xb7]
test eax, eax
je 0x100207af
push 0
call fcn.1003375b
pop ecx
push 1
lea ecx, [ebp - 0x9f0]
call fcn.100166d5
and dword [eax], 0
jmp 0x100207e5
push 1
lea ecx, [ebp - 0x9f0]
call fcn.100166d5
mov dword [ebp - 0x5c8], eax
mov eax, dword [ebp - 0x5c8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x5c8]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x9f0]
call fcn.100166d5
cmp dword [eax], 2
jg 0x10020836
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x10020811
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
push 4
pop eax
imul esi, eax, 0
push 1
lea ecx, [ebp - 0x9f0]
call fcn.100166d5
mov eax, dword [eax]
mov ecx, dword [ebp + esi - 0x10a0]
mov dword [ebp + eax*4 - 0x10a0], ecx
jmp 0x100207c1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x9f0]
call fcn.10016651
push 0x6a0
push 0x1b32
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x100212fe
mov dword [ebp - 0x64], 0xfffffffb
push 4
lea ecx, [ebp - 0xe60]
call fcn.100165ef
mov byte [ebp - 4], 0x15
mov dword [ebp - 0xa60], 0x6dfc9b99
mov dword [ebp - 0xf68], 0xffffffff
mov dword [ebp - 0xf70], 0
mov dword [ebp - 0x7c8], 0x9c1477a1
lea eax, [ebp - 0xe60]
push eax
push 0
push 0x7635
lea eax, [ebp - 0xf78]
push eax
call fcn.1002669a
add esp, 0x10
push 1
lea eax, [ebp - 0xa60]
push eax
lea eax, [ebp - 0xe60]
push eax
push 0x7778
push 0x53ab
push 1
call fcn.1001c6d5
add esp, 0x18
mov eax, dword [ebp - 0x7c8]
inc eax
mov dword [ebp - 0x7c8], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe60]
call fcn.10016651
mov dword [ebp - 0xa88], 2
push 3
lea ecx, [ebp - 0x9e4]
call fcn.100165ef
mov byte [ebp - 4], 0x16
push 2
lea ecx, [ebp - 0x418]
call fcn.100165ef
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x2e4], 0xffffffff
mov dword [ebp - 0x7d8], 0x6a7f4ea1
mov dword [ebp - 0x314], 0xf5e3d1aa
mov dword [ebp - 0x6c], 6
mov dword [ebp - 0x284], 0x800f4d4e
push 0
push 0
lea eax, [ebp - 0x1c4]
push eax
push 0x1226
push 0x263d
lea eax, [ebp - 0x9e4]
push eax
push 1
push 0x5c0b
call fcn.10028f82
add esp, 0x20
mov dword [ebp - 0x1c4], 0
jmp 0x10020998
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 2
jge 0x100209ba
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x418]
call fcn.100166d5
mov dword [eax], 1
jmp 0x1002098b
push 0x2fa7
lea eax, [ebp - 0x418]
push eax
push 0
push 0x2ede
lea eax, [ebp - 0x9e4]
push eax
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x2e4]
push eax
push 0
lea eax, [ebp - 0x6c]
push eax
call fcn.1002d014
add esp, 0x24
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0xf80], eax
mov esi, dword [ebp - 0x284]
push 0
lea ecx, [ebp - 0x9e4]
call fcn.100166d5
cmp esi, dword [eax]
jge 0x10020a1f
mov dword [ebp - 0x940], 1
jmp 0x10020a26
and dword [ebp - 0x940], 0
push 2
lea ecx, [ebp - 0x9e4]
call fcn.100166d5
mov eax, dword [eax]
mov dword [ebp - 0x6c], eax
mov esi, dword [ebp - 0x6c]
push 0
lea ecx, [ebp - 0x418]
call fcn.100166d5
cmp esi, dword [eax]
jg 0x10020a58
mov dword [ebp - 0x5d0], 1
jmp 0x10020a5f
and dword [ebp - 0x5d0], 0
push 0
lea ecx, [ebp - 0x418]
call fcn.100166d5
mov ecx, dword [ebp - 0x5d0]
cmp ecx, dword [eax]
jle 0x10020a88
cmp dword [ebp - 0x314], 0
jne 0x10020a88
and dword [ebp - 0x5d8], 0
jmp 0x10020a92
mov dword [ebp - 0x5d8], 1
mov esi, dword [ebp - 0x940]
sub esi, 0x832c1a4
imul esi, dword [ebp - 0x5d8]
push 1
lea ecx, [ebp - 0x9e4]
call fcn.100166d5
imul esi, dword [eax]
cmp esi, 0x43c7d757
jl 0x10020ac9
mov dword [ebp - 0x7d0], 1
jmp 0x10020ad0
and dword [ebp - 0x7d0], 0
push 0
lea ecx, [ebp - 0x418]
call fcn.100166d5
mov ecx, dword [ebp - 0x7d0]
add ecx, dword [eax]
jne 0x10020aed
cmp dword [ebp - 0x6c], 0
je 0x10020b25
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x10020b25
mov dword [ebp - 0xba8], 1
push 0x5992
lea eax, [ebp - 0x2e4]
push eax
push 0
push 0xe88
lea eax, [ebp - 0xba8]
push eax
call fcn.100295c8
add esp, 0x14
jmp 0x10020d50
mov dword [ebp - 0x68], 0xfffffffc
mov dword [ebp - 0x7e0], 0x7dd1a1fb
mov dword [ebp - 0x8d0], 0
mov dword [ebp - 0xa70], 0xfffffffb
mov dword [ebp - 0x6c], 2
jmp 0x10020b5a
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jl 0x10020b88
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x10020b86
push 0x1507
push 0x5df
push 0
call fcn.1002bf55
add esp, 0xc
jmp 0x10020b53
push 0
lea ecx, [ebp - 0x418]
call fcn.100166d5
mov ecx, dword [ebp - 0x68]
cmp dword [eax], ecx
je 0x10020ba8
mov dword [ebp - 0x5e0], 1
jmp 0x10020baf
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x5e0], eax
jge 0x10020bc6
mov dword [ebp - 0x8c8], 1
jmp 0x10020bcd
and dword [ebp - 0x8c8], 0
push 0
lea ecx, [ebp - 0x418]
call fcn.100166d5
mov ecx, dword [ebp - 0x8c8]
imul ecx, dword [eax]
imul ecx, dword [ebp - 0x68]
inc ecx
cmp ecx, dword [ebp - 0x68]
jl 0x10020bf9
mov dword [ebp - 0xa68], 1
jmp 0x10020c00
and dword [ebp - 0xa68], 0
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xf88], eax
mov eax, dword [ebp - 0x2e4]
cmp dword [ebp - 0x284], eax
jne 0x10020c23
mov dword [ebp - 0xc8c], 1
jmp 0x10020c2a
and dword [ebp - 0xc8c], 0
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0xf90], eax
mov eax, dword [ebp - 0x284]
sub eax, 5
mov dword [ebp - 0x6c], eax
mov esi, dword [ebp - 0x7d8]
push 0
lea ecx, [ebp - 0x418]
call fcn.100166d5
imul esi, dword [eax]
cmp esi, 1
jle 0x10020c69
mov dword [ebp - 0x5e8], 1
jmp 0x10020c70
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x68]
imul eax, dword [ebp - 0x5e8]
cmp eax, dword [ebp - 0x68]
jle 0x10020c8b
mov dword [ebp - 0x5f0], 1
jmp 0x10020c92
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x7d8]
cmp dword [ebp - 0x5f0], eax
jge 0x10020cac
mov dword [ebp - 0x980], 1
jmp 0x10020cb3
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x980], eax
jl 0x10020cd3
cmp dword [ebp - 0x7e0], 0
je 0x10020cd3
mov dword [ebp - 0x5f8], 1
jmp 0x10020cda
and dword [ebp - 0x5f8], 0
push 0
lea ecx, [ebp - 0x418]
call fcn.100166d5
mov ecx, dword [ebp - 0x5f8]
cmp ecx, dword [eax]
jge 0x10020cfd
mov dword [ebp - 0x600], 1
jmp 0x10020d04
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x7e0]
add eax, dword [ebp - 0x600]
mov dword [ebp - 0x8d0], eax
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 0
je 0x10020d3d
cmp dword [ebp - 0x68], 0
je 0x10020d3d
mov dword [ebp - 0x608], 1
jmp 0x10020d44
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0xa70], eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x418]
call fcn.10016651
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x9e4]
call fcn.10016651
mov dword [ebp - 0x808], 0xffffffff
push 2
lea ecx, [ebp - 0xe78]
call fcn.100165ef
mov byte [ebp - 4], 0x18
push 2
lea ecx, [ebp - 0x9fc]
call fcn.100165ef
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x19c], 0
jmp 0x10020db3
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 2
jge 0x10020dd5
push dword [ebp - 0x19c]
lea ecx, [ebp - 0xe78]
call fcn.100166d5
mov dword [eax], 7
jmp 0x10020da6
push 0x692e
lea eax, [ebp - 0x19c]
push eax
push 0x1006
push 0
lea eax, [ebp - 0x9fc]
push eax
call fcn.1002e1db
add esp, 0x14
push 0
lea ecx, [ebp - 0x9fc]
call fcn.100166d5
and dword [eax], 0
jmp 0x10020e2d
push 0
lea ecx, [ebp - 0x9fc]
call fcn.100166d5
mov dword [ebp - 0x7e8], eax
mov eax, dword [ebp - 0x7e8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x7e8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x9fc]
call fcn.100166d5
cmp dword [eax], 2
jge 0x10020e63
lea eax, [ebp - 0x9fc]
push eax
push 0x1adc
push 0
lea eax, [ebp - 0xe78]
push eax
push 0x69a1
call fcn.10026702
add esp, 0x14
jmp 0x10020e09
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x9fc]
call fcn.10016651
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe78]
call fcn.10016651
mov dword [ebp - 0x64], 0
jmp 0x10020e91
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jg 0x100212fe
mov dword [ebp - 0xbb8], 0xd15de05d
mov dword [ebp - 0xa78], 0x7f37c04c
mov dword [ebp - 0xa80], 0xffffffff
mov dword [ebp - 0xbb0], 0xffffffff
push 1
lea ecx, [ebp - 0xe24]
call fcn.100165ef
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0xc6c], 0x82a6f944
mov dword [ebp - 0x28c], 0
jmp 0x10020ef7
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 1
jge 0x10020f19
push dword [ebp - 0x28c]
lea ecx, [ebp - 0xe24]
call fcn.100166d5
mov dword [eax], 6
jmp 0x10020eea
lea eax, [ebp - 0xbb0]
push eax
lea eax, [ebp - 0xe24]
push eax
lea eax, [ebp - 0xa78]
push eax
push 0
lea eax, [ebp - 0xc6c]
push eax
lea eax, [ebp - 0xa80]
push eax
lea eax, [ebp - 0xbb8]
push eax
push 0x41e1
push 0x1ead
push 0x7d7f
push 0x36d9
push 0x6903
push 0
call fcn.1002d857
add esp, 0x34
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe24]
call fcn.10016651
mov dword [ebp - 0xc84], 0x74db9bec
mov dword [ebp - 0x610], 0xfffffffc
mov dword [ebp - 0x154], 0xdfe012d2
push 2
lea ecx, [ebp - 0xe3c]
call fcn.100165ef
mov byte [ebp - 4], 0x1b
push 0
lea eax, [ebp - 0xe3c]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0
push 0x7af3
push 0x3934
call fcn.10031674
add esp, 0x18
mov dword [ebp - 0x1a4], 0
jmp 0x10020fe3
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 2
jge 0x10020fff
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0x1058], 0xed40a165
jmp 0x10020fd6
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x10021027
push 0
push 0
push 0xc60
push 0x53e2
call fcn.10032dd3
add esp, 0x10
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0xf98], eax
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x154], eax
jl 0x1002104d
mov dword [ebp - 0x948], 1
jmp 0x10021054
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x610]
sub eax, dword [ebp - 0x948]
jne 0x1002106e
mov dword [ebp - 0x618], 1
jmp 0x10021075
and dword [ebp - 0x618], 0
cmp dword [ebp - 0x618], 0
ja 0x10021099
cmp dword [ebp - 0x154], 0
jne 0x10021099
cmp dword [ebp - 0x154], 0
jne 0x10021099
and dword [ebp - 0x7f0], 0
jmp 0x100210a3
mov dword [ebp - 0x7f0], 1
push 1
lea ecx, [ebp - 0xe3c]
call fcn.100166d5
mov ecx, dword [ebp - 0x7f0]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x154]
mov dword [ebp + eax - 0x1058], ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe3c]
call fcn.10016651
mov dword [ebp - 0x620], 0
push 0x1941
lea eax, [ebp - 0x620]
push eax
push 0
call fcn.10034fe6
add esp, 0xc
lea eax, [ebp - 0x620]
push eax
push 0
push 0x24e3
push 0x561d
call fcn.100290ae
add esp, 0x10
mov eax, dword [ebp - 0x64]
cmp dword [ebp + eax*4 - 0x110], 0
jne 0x100212ae
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x110]
mov dword [ebp - 0xfa0], eax
push 8
pop eax
test eax, eax
je 0x10021152
cmp dword [ebp - 0xa88], 0
je 0x10021152
mov dword [ebp - 0x8d8], 1
jmp 0x10021159
and dword [ebp - 0x8d8], 0
cmp dword [ebp - 0x8d8], 2
jbe 0x1002116e
mov dword [ebp - 0x628], 1
jmp 0x10021175
and dword [ebp - 0x628], 0
cmp dword [ebp - 0x628], 0xe65dd4d1
jae 0x100211a5
mov eax, 0x8adc
test eax, eax
jne 0x100211a5
push 0
lea ecx, [ebp - 0xcbc]
call fcn.100166d5
cmp dword [eax], 0
jne 0x100211a5
and dword [ebp - 0x7f8], 0
jmp 0x100211af
mov dword [ebp - 0x7f8], 1
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x110]
cmp dword [ebp - 0x7f8], eax
jg 0x100211d7
mov eax, dword [ebp - 0x64]
cmp dword [ebp + eax*4 - 0x110], 0
jne 0x100211d7
and dword [ebp - 0x630], 0
jmp 0x100211e1
mov dword [ebp - 0x630], 1
cmp dword [ebp - 0x630], 0x7fb07d0
je 0x100211f9
mov dword [ebp - 0x9a8], 1
jmp 0x10021200
and dword [ebp - 0x9a8], 0
cmp dword [ebp - 0x9a8], 0xf392
je 0x10021218
mov dword [ebp - 0x638], 1
jmp 0x1002121f
and dword [ebp - 0x638], 0
cmp dword [ebp - 0x638], 0xfffffff7
jg 0x10021234
mov dword [ebp - 0x800], 1
jmp 0x1002123b
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x800]
jle 0x10021252
mov dword [ebp - 0x640], 1
jmp 0x10021259
and dword [ebp - 0x640], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x110]
mov ecx, dword [ebp - 0x640]
add ecx, 0x12af
sub eax, ecx
jne 0x1002128f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x110], 0
jne 0x1002128f
and dword [ebp - 0x8e0], 0
jmp 0x10021299
mov dword [ebp - 0x8e0], 1
cmp dword [ebp - 0x8e0], 0xf87b
je 0x100212ae
and dword [ebp - 0x648], 0
jmp 0x100212b8
mov dword [ebp - 0x648], 1
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x808], eax
cmp dword [ebp - 0x808], 0
jne 0x100212e3
mov eax, dword [ebp - 0x64]
cmp dword [ebp + eax*4 - 0x110], 0
jne 0x100212e3
and dword [ebp - 0x650], 0
jmp 0x100212ed
mov dword [ebp - 0x650], 1
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0xc84], eax
jmp 0x10020e8a
mov dword [ebp - 0xfa8], 0xce12
mov dword [ebp - 0xfb0], 0xd69f
push 2
lea ecx, [ebp - 0x10b0]
call fcn.100165ef
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0xfb8], 7
mov dword [ebp - 0xfc0], 0xbe9f
mov dword [ebp - 0xfc8], 3
mov dword [ebp - 0x950], 0x732aa61f
push 0x5af4
push 0x6322
push 0
push 0x253
push 0x2937
push 0x5840
lea eax, [ebp - 0xfd0]
push eax
push 1
push 0
push 0x1fc9
push 0x4dee
lea eax, [ebp - 0x10b0]
push eax
call fcn.1002650a
add esp, 0x30
mov byte [ebp - 0xbb], 0
movzx eax, byte [ebp - 0xbb]
test eax, eax
je 0x100213c9
push 0
push 0x5ed1
push 0x485d
push 0x4cd4
push 0x4c0c
push 0x35e9
push 0x453
push 0x6176
call fcn.10026447
add esp, 0x20
mov eax, dword [ebp - 0x950]
inc eax
mov dword [ebp - 0x950], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10b0]
call fcn.10016651
mov dword [ebp - 0x158], 0
jmp 0x100213fe
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jl 0x10021447
mov dword [ebp - 0xfd8], 0x6240
push 0x4bf9
push 0
push 0x5291
call fcn.10032629
add esp, 0xc
push 0
call fcn.1002bdbc
pop ecx
push dword [ebp - 0x158]
lea ecx, [ebp - 0xcbc]
call fcn.100166d5
cmp dword [eax], 0
je 0x10021445
jmp 0x10021447
jmp 0x100213f1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcbc]
call fcn.10016651
mov dword [ebp - 0x294], 0x399841b3
mov dword [ebp - 0xa90], 0xbb6748f6
mov dword [ebp - 0x2ec], 0
jmp 0x10021483
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 3
jge 0x1002149f
mov eax, dword [ebp - 0x2ec]
mov dword [ebp + eax*4 - 0x12a4], 0xeb6b9dd9
jmp 0x10021476
mov dword [ebp - 0x294], 0
jmp 0x100214b8
mov eax, dword [ebp - 0x294]
dec eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0xfffffffc
jg 0x1002152a
mov dword [ebp - 0x32c], 0
jmp 0x100214da
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 1
jge 0x100214f6
mov eax, dword [ebp - 0x32c]
mov dword [ebp + eax*4 - 0xbc0], 0x4b733c63
jmp 0x100214cd
mov eax, dword [ebp - 0xa90]
mov dword [ebp - 0x658], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x658]
mov dword [ebp + eax - 0xbc0], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x658]
mov dword [ebp + eax - 0x12a4], ecx
jmp 0x100214ab
cmp dword [ebp - 0x3b8], 0
jle 0x10026121
mov dword [ebp - 0xef8], 0xfffffffd
mov dword [ebp - 0xef4], 0xfffffffd
mov dword [ebp - 0xef0], 0xfffffffd
mov dword [ebp - 0xeec], 0xfffffffd
push 3
lea ecx, [ebp - 0x9d8]
call fcn.100165ef
mov dword [ebp - 4], 0x1d
push 0x23a9
push 0
push 0x5afc
push 0x25fb
lea eax, [ebp - 0xfe0]
push eax
push 0x7702
lea eax, [ebp - 0x9d8]
push eax
push 0
push 1
push 0x3d71
call fcn.10034eb4
add esp, 0x28
push 2
lea ecx, [ebp - 0x9d8]
call fcn.100166d5
and dword [eax], 0
jmp 0x100215de
push 2
lea ecx, [ebp - 0x9d8]
call fcn.100166d5
mov dword [ebp - 0x810], eax
mov eax, dword [ebp - 0x810]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x810]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x9d8]
call fcn.100166d5
cmp dword [eax], 3
jg 0x1002160d
push 2
lea ecx, [ebp - 0x9d8]
call fcn.100166d5
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xef8], 0
je 0x1002160b
jmp 0x1002160d
jmp 0x100215ba
mov byte [ebp - 0xd5], 0
push 0x278c
push 0x40e0
push 0xf7e
lea eax, [ebp - 0xd5]
push eax
push 0
call fcn.100266da
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9d8]
call fcn.10016651
mov dword [ebp - 0x29c], 8
mov dword [ebp - 0x29c], 0
jmp 0x10021666
mov eax, dword [ebp - 0x29c]
dec eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0xfffffff8
jle 0x100216c3
mov dword [ebp - 0x160], 0xffffffff
mov dword [ebp - 0x160], 0
jmp 0x10021692
mov eax, dword [ebp - 0x160]
dec eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xffffffe7
jl 0x100216c1
mov dword [ebp - 0xa98], 0xe4b28306
lea eax, [ebp - 0x160]
push eax
push 0
lea eax, [ebp - 0xa98]
push eax
push 1
call fcn.1001cfc7
add esp, 0x10
jmp 0x10021685
jmp 0x10021659
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x100216ed
push 0x196c
push 0
push 0
push 0
push 0
push 0x1b00
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x238], 0x399841b3
push 2
lea ecx, [ebp - 0xe54]
call fcn.100165ef
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x168], 0x2f4a8b10
mov dword [ebp - 0x2f4], 0
jmp 0x1002172e
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 2
jge 0x10021750
push dword [ebp - 0x2f4]
lea ecx, [ebp - 0xe54]
call fcn.100166d5
mov dword [eax], 0x5c96
jmp 0x10021721
push 1
lea ecx, [ebp - 0xe54]
call fcn.100166d5
mov eax, dword [eax]
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x168], 0
jmp 0x1002177e
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0x13
jge 0x10021ab6
mov dword [ebp - 0x204], 0x3eee2fde
mov dword [ebp - 0x204], 0
jmp 0x100217ae
mov eax, dword [ebp - 0x204]
dec eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0xfffffff9
jg 0x10021ab1
mov dword [ebp - 0x208], 0x99d94b4b
mov dword [ebp - 0x208], 0x11
jmp 0x100217de
mov eax, dword [ebp - 0x208]
dec eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0xfffffff8
jle 0x10021aac
push 2
lea ecx, [ebp - 0x10c0]
call fcn.100165ef
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x170], 0
jmp 0x10021815
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x10021831
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x210], 0xc17e5c28
jmp 0x10021808
push 0x24be
push 0x163
lea eax, [ebp - 0x170]
push eax
push 1
lea eax, [ebp - 0x10c0]
push eax
push 0
push 0x6ea0
push 1
push 0x749b
push 0x5c1b
call fcn.100334ea
add esp, 0x28
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x210], 0
jmp 0x10021894
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x210]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x210], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x210], 1
jg 0x10021a98
mov dword [ebp - 0x218], 0xffffffff
mov dword [ebp - 0xfe8], 0xffffffff
mov dword [ebp - 0x218], 0
jmp 0x100218d5
cmp dword [ebp - 0x218], 1
jg 0x10021a93
mov dword [ebp - 0xff0], 7
mov dword [ebp - 0xc4c], 0x1aaf
cmp dword [ebp - 0xc4c], 0xabf
jge 0x100219f4
lea eax, [ebp - 0x178]
push eax
push 0x100078ec
call fcn.1004ed2b
pop ecx
pop ecx
lea eax, [ebp - 0xdc]
push eax
push 0x100077e4
call fcn.1004ed2b
pop ecx
pop ecx
mov eax, dword [ebp - 0x178]
dec eax
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x660], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x8e8], eax
and dword [ebp - 0x180], 0
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0x178]
dec eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0xaa0], 0
je 0x100219e2
lea eax, [ebp - 0xdc]
push eax
push 0x100077e4
call fcn.1004ed2b
pop ecx
pop ecx
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0x660]
jge 0x100219b6
push dword [ebp - 0x180]
push 0x100078ec
call fcn.1004f5a5
pop ecx
pop ecx
mov dword [ebp - 0x1fc], 0
jmp 0x10021a0d
cmp dword [ebp - 0x1fc], 1
jge 0x10021a29
jmp 0x10021879
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x10c0]
call fcn.10016651
jmp 0x100217d1
jmp 0x100217a1
jmp 0x10021771
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe54]
call fcn.10016651
mov dword [ebp - 0xac0], 0xbb6748f6
push 1
lea ecx, [ebp - 0xe6c]
call fcn.100165ef
mov dword [ebp - 4], 0x20
mov dword [ebp - 0xbc8], 0x96960f57
push 0x1333
lea eax, [ebp - 0xe6c]
push eax
push 0
lea eax, [ebp - 0xff8]
push eax
push 0x5033
call fcn.100264d1
add esp, 0x14
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x10021b37
push 0x79e5
push 0x2802
push 0
push 1
call fcn.1001cbb2
add esp, 0x10
push 0x77f1
push 0x73ae
push 0x59d5
lea eax, [ebp - 0xe6c]
push eax
push 0
push 0x3694
push 0x31ef
lea eax, [ebp - 0xbc8]
push eax
push 1
call fcn.1001d03f
add esp, 0x24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe6c]
call fcn.10016651
mov dword [ebp - 0x818], 0xffffffff
push 1
lea ecx, [ebp - 0xcd4]
call fcn.100165ef
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x670], 0xfffffffe
mov dword [ebp - 0xd60], 3
mov dword [ebp - 0xd5c], 3
mov dword [ebp - 0xd58], 3
mov dword [ebp - 0xd54], 3
lea ecx, [ebp - 0x3d5]
call fcn.10016739
push eax
lea eax, [ebp - 0xd50]
push eax
lea eax, [ebp - 0xd60]
push eax
lea ecx, [ebp - 0x12f8]
call fcn.1001673c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x10d0]
call fcn.1001662b
mov byte [ebp - 4], 0x22
mov dword [ebp - 0xc50], 0xe07e
mov dword [ebp - 0xaa8], 6
mov dword [ebp - 0x228], 0
jmp 0x10021c2f
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 1
jge 0x10021c51
push dword [ebp - 0x228]
lea ecx, [ebp - 0xcd4]
call fcn.100166d5
mov dword [eax], 0x4445559
jmp 0x10021c22
push 0x7943
push 0x5f37
push 0x1253
push 0
push 0x1141
push 0x649
push 0x58ec
push 0x9a2
push 0x36da
lea eax, [ebp - 0x670]
push eax
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0xcd4]
push eax
push 1
call fcn.1002d857
add esp, 0x34
lea eax, [ebp - 0xaa8]
push eax
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x10d0]
push eax
push 0
lea eax, [ebp - 0xc50]
push eax
lea eax, [ebp - 0x670]
push eax
lea eax, [ebp - 0xcd4]
push eax
call fcn.1002eba8
add esp, 0x1c
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x10d0]
call fcn.10016651
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcd4]
call fcn.10016651
mov dword [ebp - 0x230], 0
jmp 0x10021d05
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 3
jge 0x10021d21
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0x1280], 0xeb6b9dd9
jmp 0x10021cf8
mov dword [ebp - 0x188], 1
push 2
lea ecx, [ebp - 0xc14]
call fcn.100165ef
mov dword [ebp - 4], 0x23
push 0
push 0x218b
push 0x3415
lea eax, [ebp - 0xc14]
push eax
push 0x5070
lea eax, [ebp - 0x1000]
push eax
call fcn.1002647a
add esp, 0x18
mov dword [ebp - 0x188], 0
jmp 0x10021d7f
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xfffffffd
jl 0x10021f3f
mov dword [ebp - 0x138], 0xc4d8e5cc
mov dword [ebp - 0xc58], 0
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x138]
push eax
push 0
lea eax, [ebp - 0xc14]
push eax
push 0x2a8c
call fcn.1002672a
add esp, 0x14
mov dword [ebp - 0x138], 0
jmp 0x10021ddd
cmp dword [ebp - 0x138], 0x1c
jl 0x10021f3a
mov dword [ebp - 0x190], 0x7a4bedcc
mov dword [ebp - 0x1008], 0xffffffff
mov dword [ebp - 0x1014], 0xfffffff7
mov dword [ebp - 0x1188], 1
mov dword [ebp - 0x1190], 0xfffffffc
mov dword [ebp - 0x820], 0xfffffff6
mov dword [ebp - 0x190], 0xffffffe3
jmp 0x10021e3f
cmp dword [ebp - 0x190], 0xffffffe6
je 0x10021f2a
mov dword [ebp - 0x1198], 0x54e3
mov dword [ebp - 0xab8], 1
mov dword [ebp - 0x384], 0
push 0
lea ecx, [ebp - 0xc14]
call fcn.100166d5
mov esi, eax
push 1
lea ecx, [ebp - 0xc14]
call fcn.100166d5
mov ecx, dword [ebp - 0x138]
imul ecx, dword [eax]
cmp dword [esi], ecx
jge 0x10021e9f
mov dword [ebp - 0x988], 1
jmp 0x10021ea6
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0xab0], eax
mov eax, dword [ebp - 0x988]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0x384]
dec eax
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0xab0]
cmp eax, dword [ebp - 0xbd0]
jle 0x10021ee5
cmp dword [ebp - 0xc58], 0
je 0x10021f35
jmp 0x10021f3a
jmp 0x10021dd0
jmp 0x10021d72
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc14]
call fcn.10016651
mov dword [ebp - 0x238], 0
jmp 0x10021f67
cmp dword [ebp - 0x238], 0xfffffffc
jg 0x10022190
push 2
lea ecx, [ebp - 0x10f0]
call fcn.100165ef
mov dword [ebp - 4], 0x24
push 0
lea eax, [ebp - 0x10f0]
push eax
push 1
push 0x5d28
lea eax, [ebp - 0x198]
push eax
call fcn.1001d1bb
add esp, 0x14
mov dword [ebp - 0x198], 0
jmp 0x10021fc0
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 4
jge 0x10021fdc
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0xee8], 0xdf1febae
jmp 0x10021fb3
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xee8], 0
jmp 0x1002200a
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xee8], 1
jg 0x10022115
push 4
push 0x1000
push dword [ebp - 0x3b8]
mov eax, dword [ebp - 0x92c]
mov ecx, dword [ebp - 0xac8]
add ecx, dword [eax + 0xc]
push ecx
push 0x79e8
push 0x6b94
call fcn.1004065c
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x3c0]
mov dword [ecx], eax
mov dword [ebp - 0x90], 0xfffffff8
and dword [ebp - 0xd88], 0
and dword [ebp - 0xd84], 0
and dword [ebp - 0xd80], 0
and dword [ebp - 0xd7c], 0
lea ecx, [ebp - 0x3e5]
call fcn.10016739
push eax
lea eax, [ebp - 0xd78]
push eax
lea eax, [ebp - 0xd88]
push eax
lea ecx, [ebp - 0x1300]
call fcn.1001673c
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc24]
call fcn.1001662b
mov dword [ebp - 4], 0x26
mov dword [ebp - 0xc60], 0xffffffff
push 3
lea ecx, [ebp - 0xe84]
call fcn.100165ef
mov byte [ebp - 4], 0x27
push 2
lea ecx, [ebp - 0x1100]
call fcn.100165ef
mov byte [ebp - 4], 0x28
mov dword [ebp - 0xae0], 1
mov dword [ebp - 0x78], 0
jmp 0x10022270
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x1002228c
push dword [ebp - 0x78]
lea ecx, [ebp - 0xe84]
call fcn.100166d5
mov dword [eax], 0x2885
jmp 0x10022269
mov dword [ebp - 0x78], 0
jmp 0x1002229c
cmp dword [ebp - 0x78], 2
jge 0x100222b8
jmp 0x1002625f
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xaac], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xa9c], eax
mov dword [ebp - 0xa8c], 0x1e4e
cmp dword [ebp - 0xa8c], 0x8ee
jge 0x100261cf
lea ecx, [ebp - 0x1268]
call fcn.10015ed2
mov dword [ebp - 4], 0x3e
lea eax, [ebp - 0xa94]
push eax
mov ecx, 0x10657dd0
call fcn.10015f8e
mov dword [ebp - 0x3c8], 1
jmp 0x10026193
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3c8]
cmp eax, dword [ebp - 0xa94]
jg 0x100261c0
lea edx, [ebp - 0x1268]
mov ecx, 0x10657dd0
call fcn.10038fb1
lea eax, [ebp - 0x1268]
push eax
call fcn.1001d553
pop ecx
jmp 0x10026186
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1268]
call fcn.10015f35
mov eax, dword [ebp - 0xa9c]
movzx eax, byte [eax]
test eax, eax
je 0x100261f2
push 0
push 0x12f3
push 0
push 0x22c3
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
jmp 0x1002625f
mov eax, dword [ebp - 0xaa4]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0xaac]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0xab4]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0x934], eax
mov eax, dword [ebp - 0x340]
mov dword [eax], 0
jmp 0x10026241
mov eax, dword [ebp - 0x340]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x340]
mov dword [ecx], eax
mov eax, dword [ebp - 0x340]
cmp dword [eax], 2
jg 0x1002625f
mov eax, dword [ebp - 0x934]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x934]
mov dword [ecx], eax
jmp 0x10026230
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret