Function at 0x10026fe2
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006b69f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0xa57c
call fcn.10066650
push ebx
push esi
push edi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002b929
lea eax, [ebp + 0x14]
mov dword [ebp - 0x53c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x5b8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x5b0], eax
mov eax, dword [ebp - 0x53c]
movzx eax, byte [eax]
test eax, eax
je 0x10027068
mov byte [ebp - 0xbb], 0
movzx eax, byte [ebp - 0xbb]
test eax, eax
je 0x10027063
push 0x65f
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
jmp 0x1002b927
mov eax, dword [ebp - 0x5b0]
mov dword [ebp - 0x598], eax
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0x578], eax
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x408], eax
push 3
lea ecx, [ebp - 0x64c]
call fcn.1000dfce
and dword [ebp - 4], 0
mov dword [ebp - 0xc8], 0x96960f57
mov dword [ebp - 0x70], 0
lea eax, [ebp - 0x64c]
push eax
push 0x1312
push 0x70a7
push 0
lea eax, [ebp - 0x88c]
push eax
call fcn.1002bf60
add esp, 0x14
mov dword [ebp - 0xc8], 0
jmp 0x100270f8
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jg 0x10027299
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x4bc], 0x56df
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x64c]
call fcn.1000e00f
mov esi, eax
push 0
lea ecx, [ebp - 0x64c]
call fcn.1000e00f
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x10027148
mov dword [ebp - 0x2d8], 1
jmp 0x1002714f
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x2d8]
neg eax
imul eax, eax, 0xb666
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x64], 0
jmp 0x10027176
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jg 0x10027294
mov dword [ebp - 0x1cc], 0x4c8f0d07
mov dword [ebp - 0x5dc], 0xfffffff8
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x7c8], eax
cmp dword [ebp - 0x64], 0
je 0x100271c1
cmp dword [ebp - 0x1cc], 0
je 0x100271c1
cmp dword [ebp - 0x64], 0
je 0x100271c1
mov dword [ebp - 0x4a0], 1
jmp 0x100271c8
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x4a0], eax
jne 0x100271e8
cmp dword [ebp - 0x4bc], 0
jne 0x100271e8
and dword [ebp - 0x4a8], 0
jmp 0x100271f2
mov dword [ebp - 0x4a8], 1
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x5dc]
add ecx, dword [ebp - 0x4a8]
add ecx, dword [ebp - 0x64]
imul eax, ecx
cmp eax, 0xb64d
jge 0x1002726f
mov dword [ebp - 0x70], 2
jmp 0x10027227
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jl 0x1002726d
push 1
push 0x77ca
lea eax, [ebp - 0x64]
push eax
push 0xd09
push 0x3ca2
push 0x4842
push 0
lea eax, [ebp - 0x64c]
push eax
push 1
push 0x1b59
lea eax, [ebp - 0x4bc]
push eax
push 0x6a6a
call fcn.10025843
add esp, 0x30
jmp 0x10027220
jmp 0x1002728f
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x1002728f
push 0
push 0x5492
call fcn.1002da57
pop ecx
pop ecx
jmp 0x1002716f
jmp 0x100270eb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64c]
call fcn.1000e00a
mov dword [ebp - 0x4c4], 4
mov dword [ebp - 0x5fc], 0x1c2f
cmp dword [ebp - 0x5fc], 0x1222
jge 0x10027357
lea eax, [ebp - 0x23c]
push eax
push 0x100089d8
call fcn.10050e4b
pop ecx
pop ecx
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x604], eax
mov eax, dword [ebp - 0x23c]
dec eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x604], 0
je 0x10027357
lea eax, [ebp - 0x60c]
push eax
lea eax, [ebp - 0x230]
push eax
push 0x10008a14
call fcn.10050e4b
add esp, 0xc
mov eax, dword [ebp - 0x230]
shl eax, 1
cmp eax, dword [ebp - 0x60c]
jle 0x10027339
push 0x10008f74
call fcn.100511a7
pop ecx
jmp 0x10027355
mov eax, dword [ebp - 0x230]
shl eax, 1
push eax
push dword [ebp - 0x230]
push 0x10008e18
call fcn.10051040
add esp, 0xc
jmp 0x100272df
mov dword [ebp - 0x264], 0xffffffff
mov dword [ebp - 0x6c], 0
jmp 0x10027371
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x10027387
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x254], 0xa8eac8b1
jmp 0x1002736a
mov dword [ebp - 0x6c], 0
jmp 0x10027397
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x100273ad
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x804], 6
jmp 0x10027390
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x254], 0xfffffff2
jmp 0x100273d8
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x254]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x254], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x254], 0xfffffff1
jl 0x1002758f
mov dword [ebp - 0x100], 0x9753
mov dword [ebp - 0x43c], 0x196e6c8c
mov dword [ebp - 0x61c], 0xfffffffa
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x804], 0
jge 0x10027425
mov dword [ebp - 0x498], 1
jmp 0x1002742c
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 9
jl 0x1002744d
mov dword [ebp - 0x4cc], 1
jmp 0x10027454
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x100]
add eax, dword [ebp - 0x498]
cmp eax, dword [ebp - 0x264]
jl 0x10027480
mov dword [ebp - 0x39c], 1
jmp 0x10027487
and dword [ebp - 0x39c], 0
cmp dword [ebp - 0x39c], 0
jne 0x100274a8
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x254], 0
jne 0x100274a8
and dword [ebp - 0x614], 0
jmp 0x100274b2
mov dword [ebp - 0x614], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x254]
mov dword [ebp - 0x868], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x7d0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x254]
mov dword [ebp - 0x87c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x254]
cmp dword [ebp - 0x100], eax
jl 0x10027503
mov dword [ebp - 0x26c], 1
jmp 0x1002750a
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x26c], eax
jg 0x10027524
mov dword [ebp - 0x3b8], 1
jmp 0x1002752b
and dword [ebp - 0x3b8], 0
cmp dword [ebp - 0x3b8], 0
jge 0x10027540
mov dword [ebp - 0x274], 1
jmp 0x10027547
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x43c], eax
imul eax, dword [ebp - 0x43c], 0xffff
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x254]
jne 0x10027577
mov dword [ebp - 0x27c], 1
jmp 0x1002757e
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x61c], eax
jmp 0x100273bf
mov dword [ebp - 0x10], 0x1f78
mov dword [ebp - 0x24], 0xb61d2250
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x634], 0x5481f04f
mov dword [ebp - 0x1b4], 0
jmp 0x100275c7
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jge 0x100275e3
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x5e8], 0xfffffff6
jmp 0x100275ba
cmp dword [ebp - 0x10], 0x1836ccb0
jne 0x10027683
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x10], eax
jg 0x1002760a
mov dword [ebp - 0x624], 1
jmp 0x10027611
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jg 0x10027625
mov dword [ebp - 0x3b4], 1
jmp 0x1002762c
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x3b4], eax
jne 0x10027643
mov dword [ebp - 0x284], 1
jmp 0x1002764a
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x284], eax
jle 0x10027661
mov dword [ebp - 0x484], 1
jmp 0x10027668
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x7d8], eax
mov eax, 0x61fc
test eax, eax
jne 0x10027692
cmp dword [ebp - 0x14], 0
jne 0x10027692
and dword [ebp - 0x28c], 0
jmp 0x1002769c
mov dword [ebp - 0x28c], 1
imul eax, dword [ebp - 0x28c], 0x9995
test eax, eax
je 0x100277af
mov dword [ebp - 0x88], 0x34ca
mov dword [ebp - 0x19c], 0
jmp 0x100276d1
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 2
jge 0x100276ed
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x7ec], 0xfffe
jmp 0x100276c4
mov dword [ebp - 0x24], 0
jmp 0x100276fd
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff9
jge 0x100277aa
mov dword [ebp - 0x10], 0
jmp 0x10027717
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff3
je 0x1002772a
cmp dword [ebp - 0x88], 0
je 0x10027728
jmp 0x1002772a
jmp 0x10027710
mov dword [ebp - 0x14], 0
jmp 0x1002773a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jg 0x100277a5
push 0x1e74
push 0x4b5d
lea eax, [ebp - 0x88]
push eax
push 0x5289
push 0x4064
push 0
push 0x2657
push 1
push 1
call fcn.1001f17c
add esp, 0x24
mov dword [ebp - 0x88], 0
jmp 0x10027787
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x100277a3
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x7ec], 6
jmp 0x1002777a
jmp 0x10027733
jmp 0x100276f6
jmp 0x10027aa0
push 4
lea ecx, [ebp - 0x3ac]
call fcn.1000dfce
mov dword [ebp - 4], 1
mov dword [ebp - 0x228], 0x87b2
mov dword [ebp - 0x5a8], 0x7baed967
mov dword [ebp - 0x134], 0
jmp 0x100277f0
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 4
jge 0x1002780f
push dword [ebp - 0x134]
lea ecx, [ebp - 0x3ac]
call fcn.1000e00f
or dword [eax], 0xffffffff
jmp 0x100277e3
push 1
lea eax, [ebp - 0x3ac]
push eax
push 0
push 0x2c22
push 0x2209
push 0x18e1
push 0x5d2b
lea eax, [ebp - 0x24]
push eax
push 0x53de
push 0x6dbb
push 0x33d6
push 1
call fcn.1002bc26
add esp, 0x30
mov esi, dword [ebp - 0x24]
push 2
lea ecx, [ebp - 0x3ac]
call fcn.1000e00f
cmp esi, dword [eax]
jge 0x100279f1
cmp dword [ebp - 0x10], 0
jne 0x10027964
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x878], eax
push 3
lea ecx, [ebp - 0x3ac]
call fcn.1000e00f
cmp dword [eax], 0
je 0x1002789a
cmp dword [ebp - 0x24], 0
je 0x1002789a
mov dword [ebp - 0x3bc], 1
jmp 0x100278a1
and dword [ebp - 0x3bc], 0
push 0
lea ecx, [ebp - 0x3ac]
call fcn.1000e00f
mov ecx, dword [ebp - 0x3bc]
cmp ecx, dword [eax]
je 0x100278ca
cmp dword [ebp - 0x10], 0
je 0x100278ca
mov dword [ebp - 0x62c], 1
jmp 0x100278d1
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x7e0], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x24], eax
imul eax, dword [ebp - 0x24], 0xfffa
cmp eax, dword [ebp - 0x10]
jg 0x100278fb
mov dword [ebp - 0x294], 1
jmp 0x10027902
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x228]
cmp dword [ebp - 0x294], eax
jle 0x1002791c
mov dword [ebp - 0x444], 1
jmp 0x10027923
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0x32e5
jne 0x10027941
mov dword [ebp - 0x29c], 1
jmp 0x10027948
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x29c]
sub eax, dword [ebp - 0x10]
cmp eax, 0xd0509419
jb 0x10027964
mov dword [ebp - 0x3c4], 1
jmp 0x1002796b
and dword [ebp - 0x3c4], 0
mov esi, dword [ebp - 0x10]
imul esi, dword [ebp - 0x3c4]
push 2
lea ecx, [ebp - 0x3ac]
call fcn.1000e00f
cmp esi, dword [eax]
jg 0x10027992
mov dword [ebp - 0x2a4], 1
jmp 0x10027999
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x634]
cmp dword [ebp - 0x2a4], eax
jl 0x100279b3
mov dword [ebp - 0x63c], 1
jmp 0x100279ba
and dword [ebp - 0x63c], 0
cmp dword [ebp - 0x14], 0
jne 0x100279cf
cmp dword [ebp - 0x10], 0
jne 0x100279cf
and dword [ebp - 0x4c8], 0
jmp 0x100279d9
mov dword [ebp - 0x4c8], 1
cmp dword [ebp - 0x4c8], 0x52b7
jne 0x100279f1
mov dword [ebp - 0x2ac], 1
jmp 0x100279f8
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x5a8]
cmp dword [ebp - 0x2ac], eax
je 0x10027a12
mov dword [ebp - 0x3cc], 1
jmp 0x10027a19
and dword [ebp - 0x3cc], 0
cmp dword [ebp - 0x3cc], 0x5f26
jle 0x10027a31
mov dword [ebp - 0x550], 1
jmp 0x10027a38
and dword [ebp - 0x550], 0
mov esi, dword [ebp - 0x228]
push 3
lea ecx, [ebp - 0x3ac]
call fcn.1000e00f
cmp esi, dword [eax]
jle 0x10027a5b
mov dword [ebp - 0x2b4], 1
jmp 0x10027a62
and dword [ebp - 0x2b4], 0
cmp dword [ebp - 0x2b4], 9
jg 0x10027a77
mov dword [ebp - 0x44c], 1
jmp 0x10027a7e
and dword [ebp - 0x44c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x44c]
mov dword [ebp + eax - 0x5e8], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3ac]
call fcn.1000e00a
mov dword [ebp - 0x14], 1
jmp 0x10027ab0
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x10027b88
mov dword [ebp - 0x6c0], 0xe304
mov dword [ebp - 0x6bc], 0xe304
mov dword [ebp - 0x6b8], 0xe304
mov dword [ebp - 0x6b4], 0xe304
lea ecx, [ebp - 0x221]
call fcn.1000e7d2
push eax
lea eax, [ebp - 0x6b0]
push eax
lea eax, [ebp - 0x6c0]
push eax
lea ecx, [ebp - 0x93c]
call fcn.10032a42
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x708]
call fcn.100329ab
mov dword [ebp - 4], 2
push 0
lea ecx, [ebp - 0x708]
call fcn.1000e00f
cmp dword [eax], 0x742e
je 0x10027b3f
mov dword [ebp - 0x2bc], 1
jmp 0x10027b46
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2bc]
mov dword [ebp + eax*4 - 0x5e8], ecx
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x5e8], 0
je 0x10027b74
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x708]
call fcn.1000e00a
jmp 0x10027b88
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x708]
call fcn.1000e00a
jmp 0x10027aa9
mov dword [ebp - 0xec], 5
mov dword [ebp - 0x90], 0x245f1dbe
push 3
lea ecx, [ebp - 0x720]
call fcn.1000dfce
mov dword [ebp - 4], 3
mov dword [ebp - 0x1a4], 0
jmp 0x10027bc9
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 3
jge 0x10027beb
push dword [ebp - 0x1a4]
lea ecx, [ebp - 0x720]
call fcn.1000e00f
mov dword [eax], 1
jmp 0x10027bbc
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0xec], eax
jne 0x10027cf1
push 3
lea ecx, [ebp - 0x834]
call fcn.1000dfce
mov byte [ebp - 4], 4
mov dword [ebp - 0x1ac], 0
jmp 0x10027c33
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 3
jge 0x10027c55
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x834]
call fcn.1000e00f
mov dword [eax], 0xc0d3
jmp 0x10027c26
mov dword [ebp - 0x90], 0
jmp 0x10027c6e
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jg 0x10027ce0
mov dword [ebp - 0xec], 0
jmp 0x10027c90
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 2
jg 0x10027cde
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x10027cdc
push 0
push 0x4681
push 0xb0a
push 0x68df
push 1
push 1
push 0x4b15
push 0x5371
push 0x1950
push 0x85d
call fcn.10025f5c
add esp, 0x28
jmp 0x10027c83
jmp 0x10027c61
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x834]
call fcn.1000e00a
jmp 0x10027d1c
lea eax, [ebp - 0x720]
push eax
push 0
push 1
push 0
lea eax, [ebp - 0x90]
push eax
push 0x6109
push 0x18d3
push 0x236d
call fcn.1001455d
add esp, 0x20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x720]
call fcn.1000e00a
mov dword [ebp - 0xd8], 0x9e57ad95
push 3
lea ecx, [ebp - 0x714]
call fcn.1000dfce
mov dword [ebp - 4], 5
push 1
lea ecx, [ebp - 0x248]
call fcn.1000dfce
mov byte [ebp - 4], 6
mov dword [ebp - 0x520], 0x658a6001
mov dword [ebp - 0xfc], 0
jmp 0x10027d7d
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 3
jge 0x10027d99
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x738], 0x93b4e1a3
jmp 0x10027d70
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0xfc]
push eax
push 0x3ae1
push 0
push 1
call fcn.10024afc
add esp, 0x14
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x10027ddb
push 0x4db0
push 0
push 1
call fcn.100204b2
add esp, 0xc
push 0
lea ecx, [ebp - 0x248]
call fcn.1000e00f
mov dword [eax], 2
jmp 0x10027e14
push 0
lea ecx, [ebp - 0x248]
call fcn.1000e00f
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0x3d4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x3d4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x248]
call fcn.1000e00f
cmp dword [eax], 0
jl 0x10027fa9
mov dword [ebp - 0x1d8], 6
mov dword [ebp - 0x6a4], 0xdb2bc40e
mov dword [ebp - 0x6a0], 0xdb2bc40e
mov dword [ebp - 0x69c], 0xdb2bc40e
mov dword [ebp - 0x698], 0xdb2bc40e
mov dword [ebp - 0x3dc], 0x44cf5927
mov dword [ebp - 0x528], 0
mov dword [ebp - 0x52c], 0x90ae7359
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x6a4], 0
push 0
lea ecx, [ebp - 0x248]
call fcn.1000e00f
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x738]
mov dword [ebp - 0x810], eax
push 0
lea ecx, [ebp - 0x248]
call fcn.1000e00f
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x738]
mov dword [ebp - 0x75c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6a4]
mov dword [ebp - 0x764], eax
mov dword [ebp - 0x1d8], 0x1551da62
cmp dword [ebp - 0x1d8], 2
jg 0x10027ef5
mov dword [ebp - 0x2c4], 1
jmp 0x10027efc
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x3dc], eax
mov esi, dword [ebp - 0x1d8]
push 0
lea ecx, [ebp - 0x248]
call fcn.1000e00f
cmp esi, dword [eax]
jge 0x10027f2b
mov dword [ebp - 0x48c], 1
jmp 0x10027f32
and dword [ebp - 0x48c], 0
cmp dword [ebp - 0x48c], 0xa82e77e8
jne 0x10027f4a
mov dword [ebp - 0x2cc], 1
jmp 0x10027f51
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x520], eax
push 0
lea ecx, [ebp - 0x248]
call fcn.1000e00f
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x738]
imul eax, dword [ebp - 0x3dc]
cmp eax, 0xfffffff7
jle 0x10027f8b
mov dword [ebp - 0x2d4], 1
jmp 0x10027f92
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x528]
add eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x52c], eax
jmp 0x10027df0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x248]
call fcn.1000e00a
mov dword [ebp - 0x76c], 0xfff9
push 2
lea ecx, [ebp - 0x844]
call fcn.1000dfce
mov byte [ebp - 4], 7
mov dword [ebp - 0x774], 0xf4a8b108
mov dword [ebp - 0x454], 7
mov dword [ebp - 0x77c], 1
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x784]
push eax
push 0x1d50
push 1
push 0x27fa
push 0
push 0x6d8e
call fcn.10020dc2
add esp, 0x1c
mov eax, dword [ebp - 0x454]
inc eax
mov dword [ebp - 0x454], eax
push 0x5ca2
push 0
push 0x257d
push 1
push 1
call fcn.10021883
add esp, 0x14
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x844]
call fcn.1000e00a
mov dword [ebp - 0x78c], 0xfffffff6
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x10028075
push 0
push 0
call fcn.1001c139
pop ecx
pop ecx
mov byte [ebp - 0xc3], 0
movzx eax, byte [ebp - 0xc3]
test eax, eax
je 0x10028097
push 0x5ed
push 0x53d
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x68], 0
jmp 0x100280a7
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x100280bd
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x178], 0xc204e2db
jmp 0x100280a0
mov dword [ebp - 0x5cc], 0x1f57
cmp dword [ebp - 0x5cc], 0xb35
jge 0x10028358
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x10008e68
call fcn.10050e4b
add esp, 0x10
push dword [ebp - 0x40]
lea ecx, [ebp - 0x1c8]
call fcn.1000dfce
mov byte [ebp - 4], 8
and dword [ebp - 0x140], 0
jmp 0x1002811e
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
cmp eax, dword [ebp - 0x40]
jge 0x10028149
push dword [ebp - 0x140]
lea ecx, [ebp - 0x1c8]
call fcn.1000e00f
push eax
push 0x100089d8
call fcn.10050e4b
pop ecx
pop ecx
jmp 0x10028111
and dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x40]
and eax, 0x80000001
jns 0x1002815c
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x100281ad
mov eax, dword [ebp - 0x40]
cdq
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x1c8]
call fcn.1000e00f
cmp dword [eax], 2
jne 0x100281ad
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0xe4]
jge 0x10028195
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x2dc], eax
jmp 0x100281a1
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x44], eax
and dword [ebp - 0x20], 0
jmp 0x100281ba
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x40]
cdq
sub eax, edx
sar eax, 1
cmp dword [ebp - 0x20], eax
jge 0x1002833a
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1c8]
call fcn.1000e00f
cmp dword [eax], 2
jne 0x10028232
mov eax, dword [ebp - 0x40]
dec eax
sub eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c8]
call fcn.1000e00f
cmp dword [eax], 2
jne 0x10028232
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0xd4]
jge 0x10028212
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x3e4], eax
jmp 0x1002821e
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x3e4]
mov ecx, dword [ebp - 0x44]
lea eax, [ecx + eax*2]
mov dword [ebp - 0x44], eax
jmp 0x10028335
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1c8]
call fcn.1000e00f
cmp dword [eax], 2
jne 0x10028288
mov eax, dword [ebp - 0x40]
dec eax
sub eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c8]
call fcn.1000e00f
cmp dword [eax], 0
je 0x1002826b
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x2e4], eax
jmp 0x10028277
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x44], eax
jmp 0x10028335
mov eax, dword [ebp - 0x40]
dec eax
sub eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c8]
call fcn.1000e00f
cmp dword [eax], 2
jne 0x100282db
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1c8]
call fcn.1000e00f
cmp dword [eax], 0
je 0x100282c1
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x4ac], eax
jmp 0x100282cd
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x44], eax
jmp 0x10028335
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1c8]
call fcn.1000e00f
cmp dword [eax], 1
jg 0x10028335
mov eax, dword [ebp - 0x40]
dec eax
sub eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c8]
call fcn.1000e00f
cmp dword [eax], 1
jg 0x10028335
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1c8]
call fcn.1000e00f
mov esi, eax
mov eax, dword [ebp - 0x40]
dec eax
sub eax, dword [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c8]
call fcn.1000e00f
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x10028335
or dword [ebp - 0x44], 0xffffffff
jmp 0x1002833a
jmp 0x100281b3
push dword [ebp - 0x44]
push 0x100089dc
call fcn.10051040
pop ecx
pop ecx
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1c8]
call fcn.1000e040
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x110], 0
jmp 0x1002837b
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x13
jl 0x10028460
push 1
lea ecx, [ebp - 0x65c]
call fcn.1000dfce
mov byte [ebp - 4], 9
mov dword [ebp - 0x180], 0
jmp 0x100283b2
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 1
jge 0x100283d4
push dword [ebp - 0x180]
lea ecx, [ebp - 0x65c]
call fcn.1000e00f
mov dword [eax], 0x1f665683
jmp 0x100283a5
push 0
lea ecx, [ebp - 0x65c]
call fcn.1000e00f
mov dword [eax], 0xfffffff7
jmp 0x1002840d
push 0
lea ecx, [ebp - 0x65c]
call fcn.1000e00f
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp - 0x2ec]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x2ec]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x65c]
call fcn.1000e00f
cmp dword [eax], 0x12
je 0x1002844c
mov byte [ebp - 0xc2], 0
push 1
push 0x1dc2
push 0x3508
push 1
lea eax, [ebp - 0xc2]
push eax
push 0x44c7
push 0
call fcn.1001c30f
add esp, 0x1c
jmp 0x100283e9
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x65c]
call fcn.1000e00a
jmp 0x1002836e
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x68], 0
jmp 0x1002847a
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x10028493
push dword [ebp - 0x68]
lea ecx, [ebp - 0x714]
call fcn.1000e00f
or dword [eax], 0xffffffff
jmp 0x10028473
push 2
lea ecx, [ebp - 0x854]
call fcn.1000dfce
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x148], 0xfffffffa
push 0x5a1c
push 1
push 0
push 1
push 0x5fea
lea eax, [ebp - 0x794]
push eax
lea eax, [ebp - 0x854]
push eax
push 0x6b4a
call fcn.1001455d
add esp, 0x20
mov dword [ebp - 0x148], 0
jmp 0x100284f2
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 1
jg 0x10028559
push 0x72d5
push 0x22ec
push 0x2524
push 0
push 0x5ba5
push 0
call fcn.10024668
add esp, 0x18
mov byte [ebp - 0xbc], 0
movzx eax, byte [ebp - 0xbc]
test eax, eax
je 0x10028557
push 0x7b0d
push 0x354d
push 0x7bf5
push 1
push 0x4844
push 0x3965
push 0
push 0x6f29
call fcn.10025545
add esp, 0x20
jmp 0x100284e5
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x854]
call fcn.1000e00a
mov dword [ebp - 0xd8], 0
jmp 0x10028581
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jl 0x10029ae3
mov dword [ebp - 0x384], 0x6b719d87
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x618], 0xa519d814
mov dword [ebp - 0x2f4], 0xfffffffa
mov dword [ebp - 0x2fc], 6
mov dword [ebp - 0x638], 2
mov dword [ebp - 0x1a0], 0
jmp 0x100285e0
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 4
jge 0x100285fc
mov eax, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0x67c], 0x9841
jmp 0x100285d3
mov dword [ebp - 0x28], 0
jmp 0x1002860c
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jg 0x10028bb5
mov dword [ebp - 0x188], 0xebb6748f
mov dword [ebp - 0x210], 7
mov dword [ebp - 0x554], 0xffffffff
push 4
lea ecx, [ebp - 0x744]
call fcn.1000dfce
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x534], 0x2348
cmp dword [ebp - 0x534], 0xbdf
jge 0x10028914
call fcn.100519dc
push 0x20
pop ecx
imul ecx, ecx, 0
add eax, ecx
push eax
push 0x10008e38
push 0x10008e3c
call fcn.1005200b
add esp, 0xc
call fcn.100519dc
push 0x20
pop ecx
shl ecx, 0
add eax, ecx
push eax
push 0x10008e44
push 0x10008e48
call fcn.1005200b
add esp, 0xc
xor eax, eax
inc eax
je 0x10028914
lea eax, [ebp - 0x150]
push eax
mov ecx, 0x1065de18
call fcn.100322c2
cmp dword [ebp - 0x150], 0
jne 0x100286c7
jmp 0x10028914
push 0x18c
push 0
lea eax, [ebp - 0xc64]
push eax
call fcn.1003c587
add esp, 0xc
and dword [ebp - 0x50], 0
jmp 0x100286ea
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x150]
jge 0x10028795
mov eax, dword [ebp - 0x50]
and dword [ebp + eax*4 - 0xad8], 0
and dword [ebp - 0x74], 0
jmp 0x10028711
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x150]
jge 0x10028790
imul eax, dword [ebp - 0x50], 0x18c
lea eax, [ebp + eax - 0xa588]
mov ecx, dword [ebp - 0x74]
lea eax, [eax + ecx*4]
push eax
mov ecx, 0x1065de18
call fcn.100322c2
imul eax, dword [ebp - 0x50], 0x18c
lea eax, [ebp + eax - 0xa588]
mov ecx, dword [ebp - 0x50]
mov ecx, dword [ebp + ecx*4 - 0xad8]
mov edx, dword [ebp - 0x74]
add ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0xad8], ecx
imul eax, dword [ebp - 0x50], 0x18c
lea eax, [ebp + eax - 0xa588]
mov ecx, dword [ebp - 0x74]
mov ecx, dword [ebp + ecx*4 - 0xc64]
mov edx, dword [ebp - 0x74]
add ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xc64], ecx
jmp 0x1002870a
jmp 0x100286e3
and dword [ebp - 0xdc], 0
and dword [ebp - 0xcc], 0
and dword [ebp - 0x98], 0
jmp 0x100287b9
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x150]
jge 0x10028851
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp + eax*4 - 0xad8]
and eax, 0x80000001
jns 0x100287e4
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x10028802
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x514], eax
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp + eax*4 - 0xc64]
and eax, 0x80000001
jns 0x1002881b
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x10028839
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x660], eax
mov eax, dword [ebp - 0xdc]
add eax, dword [ebp - 0xcc]
cmp eax, 2
jle 0x1002884c
jmp 0x10028851
jmp 0x100287ac
mov eax, dword [ebp - 0xdc]
add eax, dword [ebp - 0xcc]
jne 0x1002887f
push fcn.10035be1
mov edx, 0x10008f7c
mov ecx, 0x1065dcf8
call fcn.10013070
mov ecx, eax
call fcn.100326db
jmp 0x1002890f
cmp dword [ebp - 0xdc], 1
jne 0x100288e4
cmp dword [ebp - 0xcc], 1
jne 0x100288e4
push fcn.10035be1
mov eax, dword [ebp - 0x660]
inc eax
push eax
mov eax, dword [ebp - 0x514]
inc eax
push eax
mov edx, 0x10008f84
mov ecx, 0x1065dcf8
call fcn.10013070
mov ecx, eax
call fcn.100326e7
mov edx, 0x10008f80
mov ecx, eax
call fcn.10013070
mov ecx, eax
call fcn.100326e7
mov edx, 0x10008e9c
mov ecx, eax
call fcn.10013070
mov ecx, eax
call fcn.100326db
jmp 0x1002890f
mov eax, dword [ebp - 0xdc]
add eax, dword [ebp - 0xcc]
test eax, eax
jle 0x1002890f
push fcn.10035be1
mov edx, 0x10008f94
mov ecx, 0x1065dcf8
call fcn.10013070
mov ecx, eax
call fcn.100326db
jmp 0x1002869f
mov dword [ebp - 0x5c], 0
jmp 0x10028924
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x1002893a
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x908], 1
jmp 0x1002891d
mov dword [ebp - 0x5c], 0
jmp 0x1002894a
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 4
jge 0x10028963
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x744]
call fcn.1000e00f
or dword [eax], 0xffffffff
jmp 0x10028943
mov dword [ebp - 0x188], 3
jmp 0x1002897c
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
jl 0x10028a0e
mov dword [ebp - 0x108], 0x6b6eb6b9
push 0x2ff2
push 1
push 1
push 0
push 0x67b2
push 0x39e4
push 0x203
lea eax, [ebp - 0x108]
push eax
call fcn.1001455d
add esp, 0x20
mov dword [ebp - 0x108], 0
jmp 0x100289d5
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 3
jg 0x10028a09
mov byte [ebp - 0x82], 0
push 0
push 0x3da5
push 0
push 0x2f62
push 0x7b6c
lea eax, [ebp - 0x82]
push eax
call fcn.1001bd77
add esp, 0x18
jmp 0x100289c8
jmp 0x1002896f
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x67c]
mov dword [ebp - 0x5d0], eax
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x5d0]
cmp eax, dword [ebp - 0x544]
jg 0x10028a51
mov dword [ebp - 0x3f4], 1
jmp 0x10028a58
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x67c]
cmp dword [ebp - 0x618], eax
jge 0x10028a76
mov dword [ebp - 0x3ec], 1
jmp 0x10028a7d
and dword [ebp - 0x3ec], 0
cmp dword [ebp - 0x3ec], 0xffffffff
je 0x10028a92
mov dword [ebp - 0x54c], 1
jmp 0x10028a99
and dword [ebp - 0x54c], 0
cmp dword [ebp - 0x2fc], 0
jne 0x10028abe
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x67c], 0
jne 0x10028abe
cmp dword [ebp - 0x28], 0
jne 0x10028abe
and dword [ebp - 0x45c], 0
jmp 0x10028ac8
mov dword [ebp - 0x45c], 1
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x67c]
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x2f4]
imul eax, dword [ebp - 0x45c]
mov dword [ebp - 0x5d8], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5d8]
mov dword [ebp + eax - 0x908], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x67c]
mov dword [ebp - 0x79c], eax
mov eax, dword [ebp - 0x554]
add eax, 0x7f03
imul eax, eax, 0x3cd3
test eax, eax
jne 0x10028b2a
cmp dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x638]
cmp dword [ebp - 0x3f4], eax
jle 0x10028b44
mov dword [ebp - 0x304], 1
jmp 0x10028b4b
and dword [ebp - 0x304], 0
cmp dword [ebp - 0x304], 2
je 0x10028b60
mov dword [ebp - 0x494], 1
jmp 0x10028b67
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x67c]
cmp dword [ebp - 0x494], eax
jl 0x10028b85
mov dword [ebp - 0x30c], 1
jmp 0x10028b8c
and dword [ebp - 0x30c], 0
push 3
lea ecx, [ebp - 0x744]
call fcn.1000e00f
mov ecx, dword [ebp - 0x30c]
mov dword [eax], ecx
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x744]
call fcn.1000e00a
jmp 0x10028605
mov dword [ebp - 0x600], 1
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x31c], 0x8cf5a8b0
push 3
lea ecx, [ebp - 0x688]
call fcn.1000dfce
mov byte [ebp - 4], 0xc
push 1
lea ecx, [ebp - 0x864]
call fcn.1000dfce
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x55c], 0x23a0
cmp dword [ebp - 0x55c], 0x10ec
jge 0x10028cdb
lea eax, [ebp - 0x1e0]
push eax
push 0x100089d8
call fcn.10050e4b
pop ecx
pop ecx
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x5e0], eax
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x5e0], 0
je 0x10028cdb
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x564]
push eax
lea eax, [ebp - 0x314]
push eax
push 0x10008e68
call fcn.10050e4b
add esp, 0x10
mov eax, dword [ebp - 0x22c]
cdq
idiv dword [ebp - 0x314]
mov eax, dword [ebp - 0x22c]
sub eax, edx
add eax, dword [ebp - 0x564]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
cmp eax, dword [ebp - 0x22c]
jle 0x10028ca2
mov dword [ebp - 0x3fc], 1
jmp 0x10028ca9
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x3fc]
imul eax, dword [ebp - 0x314]
mov ecx, dword [ebp - 0x158]
sub ecx, eax
mov dword [ebp - 0x158], ecx
push dword [ebp - 0x158]
push 0x100089dc
call fcn.10051040
pop ecx
pop ecx
jmp 0x10028c1f
mov dword [ebp - 0x620], 0x2507
cmp dword [ebp - 0x620], 0x6a8
jge 0x10029090
lea ecx, [ebp - 0x6d8]
call fcn.1000dec6
mov byte [ebp - 4], 0xe
lea edx, [ebp - 0x6d8]
mov ecx, 0x1065de18
call fcn.1003603a
push 0x10008f9c
lea ecx, [ebp - 0x934]
call fcn.1000dd4a
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x4f0]
call fcn.10032949
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x4e4]
call fcn.10032949
mov byte [ebp - 4], 0x11
and dword [ebp - 0xa0], 0
and dword [ebp - 0x1b0], 0
push dword [ebp - 0xa0]
lea eax, [ebp - 0x934]
push eax
lea ecx, [ebp - 0x6d8]
call fcn.100320c7
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]
cmp eax, dword [0x10008e10]
je 0x10028e24
mov eax, dword [ebp - 0x1b0]
sub eax, dword [ebp - 0xa0]
push eax
push dword [ebp - 0xa0]
lea eax, [ebp - 0x8fc]
push eax
lea ecx, [ebp - 0x6d8]
call fcn.1003214f
mov byte [ebp - 4], 0x12
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x7a4], esp
lea eax, [ebp - 0x8fc]
push eax
call fcn.100119f0
call fcn.10026f0c
add esp, 0x18
mov byte [ebp - 0x83], al
movzx eax, byte [ebp - 0x83]
test eax, eax
je 0x10028df1
lea eax, [ebp - 0x8fc]
push eax
lea ecx, [ebp - 0x4f0]
call fcn.1003306d
jmp 0x10028e03
lea eax, [ebp - 0x8fc]
push eax
lea ecx, [ebp - 0x4e4]
call fcn.1003306d
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x8fc]
call fcn.1000dd79
jmp 0x10028d54
lea ecx, [ebp - 0x6d8]
call fcn.1000e3c4
cmp dword [ebp - 0xa0], eax
ja 0x10028ece
lea ecx, [ebp - 0x6d8]
call fcn.1000e3c4
sub eax, dword [ebp - 0xa0]
push eax
push dword [ebp - 0xa0]
lea eax, [ebp - 0x8e4]
push eax
lea ecx, [ebp - 0x6d8]
call fcn.1003214f
mov byte [ebp - 4], 0x13
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x7ac], esp
lea eax, [ebp - 0x8e4]
push eax
call fcn.100119f0
call fcn.10026f0c
add esp, 0x18
mov byte [ebp - 0xbe], al
movzx eax, byte [ebp - 0xbe]
test eax, eax
je 0x10028ead
lea eax, [ebp - 0x8e4]
push eax
lea ecx, [ebp - 0x4f0]
call fcn.1003306d
jmp 0x10028ebf
lea eax, [ebp - 0x8e4]
push eax
lea ecx, [ebp - 0x4e4]
call fcn.1003306d
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x8e4]
call fcn.1000dd79
lea ecx, [ebp - 0x4f0]
call fcn.1003304d
test eax, eax
jbe 0x10028f76
mov edx, 0x10008fa0
mov ecx, 0x1065dcf8
call fcn.10013070
and dword [ebp - 0x160], 0
jmp 0x10028f06
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
lea ecx, [ebp - 0x4f0]
call fcn.1003304d
dec eax
cmp dword [ebp - 0x160], eax
jae 0x10028f45
push dword [ebp - 0x160]
lea ecx, [ebp - 0x4f0]
call fcn.10033059
mov edx, eax
mov ecx, 0x1065dcf8
call fcn.10035c1b
mov edx, 0x10008f80
mov ecx, eax
call fcn.10013070
jmp 0x10028ef9
push fcn.10035be1
lea ecx, [ebp - 0x4f0]
call fcn.10033066
mov edx, eax
mov ecx, 0x1065dcf8
call fcn.10035c1b
mov edx, 0x10008fa0
mov ecx, eax
call fcn.10013070
mov ecx, eax
call fcn.100326db
jmp 0x10028f91
push fcn.10035be1
mov edx, 0x10008fa4
mov ecx, 0x1065dcf8
call fcn.10013070
mov ecx, eax
call fcn.100326db
lea ecx, [ebp - 0x4e4]
call fcn.1003304d
test eax, eax
jbe 0x10029039
mov edx, 0x10008fa0
mov ecx, 0x1065dcf8
call fcn.10013070
and dword [ebp - 0x190], 0
jmp 0x10028fc9
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
lea ecx, [ebp - 0x4e4]
call fcn.1003304d
dec eax
cmp dword [ebp - 0x190], eax
jae 0x10029008
push dword [ebp - 0x190]
lea ecx, [ebp - 0x4e4]
call fcn.10033059
mov edx, eax
mov ecx, 0x1065dcf8
call fcn.10035c1b
mov edx, 0x10008f80
mov ecx, eax
call fcn.10013070
jmp 0x10028fbc
push fcn.10035be1
lea ecx, [ebp - 0x4e4]
call fcn.10033066
mov edx, eax
mov ecx, 0x1065dcf8
call fcn.10035c1b
mov edx, 0x10008fa0
mov ecx, eax
call fcn.10013070
mov ecx, eax
call fcn.100326db
jmp 0x10029054
push fcn.10035be1
mov edx, 0x10008fa4
mov ecx, 0x1065dcf8
call fcn.10013070
mov ecx, eax
call fcn.100326db
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x4e4]
call fcn.10033015
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x4f0]
call fcn.10033015
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x934]
call fcn.1000dd79
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x6d8]
call fcn.1000dd79
mov dword [ebp - 0x54], 0
jmp 0x100290a0
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x100290bc
push dword [ebp - 0x54]
lea ecx, [ebp - 0x688]
call fcn.1000e00f
mov dword [eax], 0x38d927f7
jmp 0x10029099
mov dword [ebp - 0x54], 0
jmp 0x100290cc
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x100290e8
push dword [ebp - 0x54]
lea ecx, [ebp - 0x864]
call fcn.1000e00f
mov dword [eax], 0xde9ab5c2
jmp 0x100290c5
lea eax, [ebp - 0x3c]
push eax
push 0x33bb
push 0
push 0x14aa
push 1
push 0x10bc
push 0
push 0x5154
push 0x7593
call fcn.1001dfd5
add esp, 0x24
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
je 0x10029127
mov dword [ebp - 0x464], 1
jmp 0x1002912e
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0xe7ed6f18
jbe 0x10029152
mov dword [ebp - 0x404], 1
jmp 0x10029159
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x404]
jle 0x10029170
mov dword [ebp - 0x1e8], 1
jmp 0x10029177
and dword [ebp - 0x1e8], 0
push 0
lea ecx, [ebp - 0x688]
call fcn.1000e00f
mov ecx, dword [ebp - 0x1e8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x1e8], eax
jle 0x100291a3
mov dword [ebp - 0x324], 1
jmp 0x100291aa
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x324]
je 0x100291c7
mov eax, 0xf7e44142
test eax, eax
jne 0x100291c7
and dword [ebp - 0x4c0], 0
jmp 0x100291d1
mov dword [ebp - 0x4c0], 1
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x4c0]
cmp eax, dword [ebp - 0x3c]
jl 0x100291ec
mov dword [ebp - 0x32c], 1
jmp 0x100291f3
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x32c], eax
jl 0x10029219
push 0
lea ecx, [ebp - 0x688]
call fcn.1000e00f
cmp dword [eax], 0
jne 0x10029219
and dword [ebp - 0x40c], 0
jmp 0x10029223
mov dword [ebp - 0x40c], 1
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x864]
call fcn.1000e00a
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x688]
call fcn.1000e00a
mov dword [ebp - 0x78], 0x48b08158
mov dword [ebp - 0x374], 0xcec4
mov dword [ebp - 0x1f0], 3
mov dword [ebp - 0x5f8], 0xffffffff
mov dword [ebp - 0x7b4], 2
mov dword [ebp - 0x58], 0
jmp 0x10029289
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1002929c
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x1c], 6
jmp 0x10029282
mov dword [ebp - 0x58], 0
jmp 0x100292ac
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x100292c2
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x4fc], 0xf3cf6872
jmp 0x100292a5
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1c], 0x1c
jmp 0x100292e7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c], 0xffffffec
jl 0x100295a8
mov dword [ebp - 0xd0], 0xca0029bf
mov dword [ebp - 0x168], 0xffffffff
lea eax, [ebp - 0xd0]
push eax
push 0x1467
push 0
push 0x4b69
push 0x6765
push 0x3f2a
push 1
push 0
call fcn.1002d962
add esp, 0x20
cmp dword [ebp - 0xd0], 0
je 0x100294eb
mov dword [ebp - 0x33c], 0x5fa2ef70
mov dword [ebp - 0x56c], 1
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x168], 0
jne 0x1002940f
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd0]
cmp dword [ebp + eax - 0x1c], ecx
jge 0x10029396
mov dword [ebp - 0x334], 1
jmp 0x1002939d
and dword [ebp - 0x334], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
cmp dword [ebp - 0x334], eax
jne 0x100293bb
mov dword [ebp - 0x46c], 1
jmp 0x100293c2
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x33c]
cmp dword [ebp - 0x168], eax
jle 0x100293e8
mov dword [ebp - 0x414], 1
jmp 0x100293ef
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x78]
add eax, dword [ebp - 0x414]
jne 0x1002940f
mov eax, 0x61a6
test eax, eax
jne 0x1002940f
mov dword [ebp - 0x344], 1
jmp 0x10029416
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x344]
sub eax, dword [ebp - 0xd0]
jne 0x1002943a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c], 0
jne 0x1002943a
and dword [ebp - 0x49c], 0
jmp 0x10029444
mov dword [ebp - 0x49c], 1
cmp dword [ebp - 0x49c], 1
jne 0x10029459
mov dword [ebp - 0x34c], 1
jmp 0x10029460
and dword [ebp - 0x34c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
add eax, dword [ebp - 0x34c]
je 0x10029485
push 9
pop eax
test eax, eax
je 0x10029485
mov dword [ebp - 0x41c], 1
jmp 0x1002948c
and dword [ebp - 0x41c], 0
cmp dword [ebp - 0x41c], 0xe6b93388
jae 0x100294a4
mov dword [ebp - 0x354], 1
jmp 0x100294ab
and dword [ebp - 0x354], 0
cmp dword [ebp - 0x354], 0xffffffff
jge 0x100294c0
mov dword [ebp - 0x218], 1
jmp 0x100294c7
and dword [ebp - 0x218], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x218]
mov dword [ebp + eax - 0x4fc], ecx
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x56c], eax
jmp 0x100295a3
mov dword [ebp - 0x474], 0xbca0
mov dword [ebp - 0x650], 0x94fb389f
mov dword [ebp - 0x78], 4
jmp 0x1002950f
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x14
jl 0x100295a3
mov dword [ebp - 0x574], 4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4fc]
mov dword [ebp - 0x7bc], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x7c4], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x7cc], eax
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x5ec], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5ec]
mov dword [ebp + eax - 0x4fc], ecx
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x7d4], eax
cmp dword [ebp - 0x474], 0
jne 0x1002958b
mov dword [ebp - 0x35c], 1
jmp 0x10029592
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x650], eax
jmp 0x10029508
jmp 0x100292d2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c], 0
je 0x100295c7
cmp dword [ebp - 0x78], 0
je 0x100295c7
mov dword [ebp - 0x424], 1
jmp 0x100295ce
and dword [ebp - 0x424], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
cmp dword [ebp - 0x424], eax
je 0x100295f6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c], 0
jne 0x100295f6
and dword [ebp - 0x364], 0
jmp 0x10029600
mov dword [ebp - 0x364], 1
cmp dword [ebp - 0x364], 0
ja 0x10029615
mov dword [ebp - 0x4b8], 1
jmp 0x1002961c
and dword [ebp - 0x4b8], 0
cmp dword [ebp - 0x4b8], 0xd4b3beb
jg 0x10029634
mov dword [ebp - 0x36c], 1
jmp 0x1002963b
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x374]
cmp dword [ebp - 0x36c], eax
jle 0x10029655
mov dword [ebp - 0x42c], 1
jmp 0x1002965c
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x1f0], eax
imul eax, dword [ebp - 0x1f0], 0x7aeb
test eax, eax
je 0x1002967d
cmp dword [ebp - 0x1f0], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4fc], 0x75f053d0
jle 0x1002969c
mov dword [ebp - 0x57c], 1
jmp 0x100296a3
and dword [ebp - 0x57c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4fc]
mov dword [ebp - 0x7dc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x4fc]
cmp eax, dword [ebp - 0x374]
jle 0x100296e2
mov dword [ebp - 0x47c], 1
jmp 0x100296e9
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x5f8]
cmp dword [ebp - 0x47c], eax
jl 0x10029703
mov dword [ebp - 0x37c], 1
jmp 0x1002970a
and dword [ebp - 0x37c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
dec eax
mov ecx, dword [ebp - 0x37c]
dec ecx
cmp eax, ecx
jne 0x1002972c
mov dword [ebp - 0x234], 1
jmp 0x10029733
and dword [ebp - 0x234], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x234]
mov dword [ebp + eax - 0x4fc], ecx
imul eax, dword [ebp - 0x234], 0xc39b
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1c], eax
mov dword [ebp - 0x1a8], 0
jmp 0x10029773
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 2
jge 0x1002978f
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0x1bc], 0
jmp 0x10029766
push 0x6638
push 1
push 0x2e96
push 0
push 0x393
call fcn.1001ec5a
add esp, 0x14
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1bc], 0
jmp 0x100297d8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1bc]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1bc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1bc], 0
jl 0x10029ade
mov dword [ebp - 0x1f8], 7
mov dword [ebp - 0x38c], 0xaf9d66de
mov dword [ebp - 0x198], 0x2c03342e
mov dword [ebp - 0x7e4], 0xffffffff
mov dword [ebp - 0x7f0], 0x3b6182ea
mov dword [ebp - 0x628], 0xfffffff9
mov dword [ebp - 0x7fc], 0x6a205b29
mov dword [ebp - 0x170], 0
jmp 0x1002984b
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x10029867
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x58c], 0
jmp 0x1002983e
mov dword [ebp - 0x198], 0xffffffeb
jmp 0x10029880
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0xffffffea
je 0x10029952
mov dword [ebp - 0x814], 0x26ff23b1
push 3
lea ecx, [ebp - 0x874]
call fcn.1000dfce
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x584], 2
mov dword [ebp - 0x118], 0
jmp 0x100298cb
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 1
jge 0x100298e7
mov eax, dword [ebp - 0x118]
mov dword [ebp + eax*4 - 0x81c], 0xfffffffa
jmp 0x100298be
push 1
lea eax, [ebp - 0x874]
push eax
lea eax, [ebp - 0x118]
push eax
push 0x1903
push 0x42ce
push 0x5cfc
push 0
call fcn.100209cd
add esp, 0x1c
push 0x44c2
lea eax, [ebp - 0x584]
push eax
push 0
push 0
push 0x69fd
call fcn.10024214
add esp, 0x14
push 0x7c1d
push 1
push 1
call fcn.10013da2
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x874]
call fcn.1000e00a
jmp 0x10029873
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x628]
mov dword [ebp + eax - 0x58c], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1bc]
cmp dword [ebp + eax*4 - 0x178], 0
jne 0x10029aba
or eax, 0xffffffff
je 0x100299a8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1bc]
cmp dword [ebp + eax*4 - 0x178], 0
je 0x100299a8
mov dword [ebp - 0x434], 1
jmp 0x100299af
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x1f8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1bc]
mov eax, dword [ebp + eax*4 - 0x178]
cmp dword [ebp - 0x1f8], eax
jl 0x100299f5
cmp dword [ebp - 0xd8], 0
jne 0x100299f5
and dword [ebp - 0x4a4], 0
jmp 0x100299ff
mov dword [ebp - 0x4a4], 1
mov eax, dword [ebp - 0x4a4]
neg eax
mov dword [ebp - 0x38c], eax
jne 0x10029a21
cmp dword [ebp - 0x600], 0
jne 0x10029a21
and dword [ebp - 0x3a0], 0
jmp 0x10029a2b
mov dword [ebp - 0x3a0], 1
cmp dword [ebp - 0x3a0], 0xffffffff
jle 0x10029a40
mov dword [ebp - 0x394], 1
jmp 0x10029a47
and dword [ebp - 0x394], 0
imul eax, dword [ebp - 0x394], 6
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1bc]
jne 0x10029a6f
cmp dword [ebp - 0x1f8], 0
jne 0x10029a6f
and dword [ebp - 0x3b0], 0
jmp 0x10029a79
mov dword [ebp - 0x3b0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1bc]
mov eax, dword [ebp + eax*4 - 0x178]
cmp dword [ebp - 0x3b0], eax
jle 0x10029aa1
mov dword [ebp - 0x594], 1
jmp 0x10029aa8
and dword [ebp - 0x594], 0
cmp dword [ebp - 0xd8], 0
jne 0x10029aba
and dword [ebp - 0x25c], 0
jmp 0x10029ac4
mov dword [ebp - 0x25c], 1
push 0
lea ecx, [ebp - 0x714]
call fcn.1000e00f
mov ecx, dword [ebp - 0x25c]
mov dword [eax], ecx
jmp 0x100297bd
jmp 0x10028574
mov dword [ebp - 0x80], 0x35568345
mov dword [ebp - 0x2a8], 1
mov dword [ebp - 0x1d4], 0xa2560131
mov dword [ebp - 0x2a0], 0xf941
mov dword [ebp - 0x80], 0
jmp 0x10029b18
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x16
jge 0x1002a6a9
mov dword [ebp - 0x238], 0x3063
push 2
lea ecx, [ebp - 0x510]
call fcn.1000dfce
mov byte [ebp - 4], 0x15
push 0xfac
push 0x2e3d
push 0x5550
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x510]
push eax
push 1
push 0
call fcn.1002bb1d
add esp, 0x1c
cmp dword [ebp - 0x80], 0
je 0x10029d36
mov dword [ebp - 0x220], 0xab61
mov dword [ebp - 0xe0], 1
mov dword [ebp - 0x200], 0x4ed09eb8
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x10029bb1
push 0x732e
push 0
push 1
call fcn.1001c060
add esp, 0xc
cmp dword [ebp - 0x220], 0xffffffff
jl 0x10029bc6
mov dword [ebp - 0x640], 1
jmp 0x10029bcd
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x220]
inc eax
imul eax, eax, 0xc28c
mov dword [ebp - 0xe0], eax
imul eax, dword [ebp - 0xe0], 0x7cba
cmp eax, dword [ebp - 0x220]
je 0x10029bfe
mov dword [ebp - 0x260], 1
jmp 0x10029c05
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x260]
sub eax, 0x3062
cmp eax, dword [ebp - 0x238]
jg 0x10029c24
mov dword [ebp - 0x59c], 1
jmp 0x10029c2b
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x758], eax
push 6
pop eax
test eax, eax
jne 0x10029c47
mov eax, 0xe4c7
test eax, eax
je 0x10029c5c
mov eax, 0x3f30
test eax, eax
je 0x10029c5c
mov dword [ebp - 0x608], 1
jmp 0x10029c63
and dword [ebp - 0x608], 0
cmp dword [ebp - 0xe0], 0
je 0x10029c7c
xor eax, eax
je 0x10029c7c
mov dword [ebp - 0x268], 1
jmp 0x10029c83
and dword [ebp - 0x268], 0
imul eax, dword [ebp - 0x268], 0x446b
test eax, eax
jne 0x10029c96
or eax, 0xffffffff
je 0x10029cab
cmp dword [ebp - 0xe0], 0
je 0x10029cab
mov dword [ebp - 0x270], 1
jmp 0x10029cb2
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0
je 0x10029cec
cmp dword [ebp - 0x80], 0
je 0x10029cec
cmp dword [ebp - 0xe0], 0
je 0x10029cea
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x510]
call fcn.1000e00a
jmp 0x1002a6a9
jmp 0x10029d31
mov dword [ebp - 0x5a4], 0
lea eax, [ebp - 0x2a8]
push eax
push 0x501a
lea eax, [ebp - 0x5a4]
push eax
lea eax, [ebp - 0x200]
push eax
push 1
lea eax, [ebp - 0x1d4]
push eax
lea eax, [ebp - 0xe0]
push eax
push 1
lea eax, [ebp - 0x238]
push eax
call fcn.100140c7
add esp, 0x24
jmp 0x1002a61d
mov dword [ebp - 0x278], 0
push 2
lea ecx, [ebp - 0x72c]
call fcn.1000dfce
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x630], 0x1427
cmp dword [ebp - 0x630], 0x444
jge 0x1002a232
push 8
pop eax
imul eax, eax, 0
mov dword [eax + 0x1153fef8], 1
and dword [eax + 0x1153fefc], 0
mov dword [ebp - 0xf4], 1
jmp 0x10029d9b
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xb
jge 0x10029dd7
mov eax, dword [ebp - 0xf4]
push 0
push 0xa
push dword [eax*8 + 0x1153fef4]
push dword [eax*8 + 0x1153fef0]
call fcn.10056fb0
mov ecx, dword [ebp - 0xf4]
mov dword [ecx*8 + 0x1153fef8], eax
mov dword [ecx*8 + 0x1153fefc], edx
jmp 0x10029d8e
push 0x10d9ec9c
push 0x11603f50
push 0x100089f8
call fcn.10050e4b
add esp, 0xc
and dword [ebp - 0x138], 0
jmp 0x10029e04
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
cmp eax, dword [0x11603f50]
jge 0x10029e2e
mov eax, dword [ebp - 0x138]
lea eax, [eax*4 + 0x10c18060]
push eax
push 0x100089d4
call fcn.10050e4b
pop ecx
pop ecx
jmp 0x10029df7
and dword [ebp - 0xf8], 0
jmp 0x10029e44
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xf8]
cmp eax, dword [0x11603f50]
jge 0x10029ec9
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax*4 + 0x10c18060]
cdq
idiv dword [0x10d9ec9c]
mov eax, edx
cdq
mov dword [ebp - 0x6ac], eax
mov dword [ebp - 0x6a8], edx
lea eax, [ebp - 0x6ac]
push eax
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax*4 + 0x10c18060]
call fcn.10036061
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.10051ca0
pop ecx
pop ecx
fstp qword [ebp - 0x80c]
movsd xmm0, qword [ebp - 0x80c]
addsd xmm0, qword [0x100091c0]
cvttsd2si eax, xmm0
imul ecx, eax, 0xc
add ecx, 0x1266e578
call fcn.10032c84
jmp 0x10029e37
mov dword [ebp - 0x104], 1
jmp 0x10029ee2
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0xa
jg 0x10029f2a
lea eax, [ebp - 0x894]
push eax
imul ecx, dword [ebp - 0x104], 0xc
add ecx, 0x1266e578
call fcn.100329d1
push dword [eax]
lea eax, [ebp - 0x89c]
push eax
imul ecx, dword [ebp - 0x104], 0xc
add ecx, 0x1266e578
call fcn.1000e113
push dword [eax]
call fcn.10036088
pop ecx
pop ecx
jmp 0x10029ed5
xorpd xmm0, xmm0
movlpd qword [ebp - 0x124], xmm0
and dword [ebp - 0xa8], 0
jmp 0x10029f4c
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
cmp eax, dword [0x11603f50]
jge 0x1002a219
mov dword [ebp - 0x2c], 1
jmp 0x10029f6e
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xa
jg 0x1002a12b
imul ecx, dword [ebp - 0x2c], 0xc
add ecx, 0x1266e578
call fcn.10032ce6
movzx eax, al
test eax, eax
je 0x10029f90
jmp 0x10029f67
mov eax, dword [0x10d9ec9c]
cdq
mov esi, eax
mov edi, edx
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax*4 + 0x10c18060]
cdq
idiv dword [0x10d9ec9c]
mov eax, edx
cdq
mov ebx, eax
mov eax, edx
mov dword [ebp - 0x5ac], eax
mov eax, dword [0x10d9ec9c]
cdq
mov ecx, dword [ebp - 0x2c]
push edx
push eax
push dword [ecx*8 + 0x1153fefc]
push dword [ecx*8 + 0x1153fef8]
call fcn.1006a850
push edx
push eax
mov eax, dword [ebp - 0x5ac]
push eax
push ebx
call fcn.10056fb0
mov ecx, eax
mov ebx, edx
mov eax, dword [0x10d9ec9c]
cdq
push edx
push eax
push ebx
push ecx
call fcn.1006a850
sub esi, eax
sbb edi, edx
mov eax, dword [0x10d9ec9c]
cdq
push edx
push eax
push edi
push esi
call fcn.1006a850
mov dword [ebp - 0x4b4], eax
mov dword [ebp - 0x4b0], edx
cmp dword [ebp - 0x4b0], 0
jg 0x1002a033
jl 0x1002a02e
cmp dword [ebp - 0x4b4], 0
jae 0x1002a033
jmp 0x10029f67
lea eax, [ebp - 0x8cc]
push eax
imul ecx, dword [ebp - 0x2c], 0xc
add ecx, 0x1266e578
call fcn.1000e113
push eax
lea eax, [ebp - 0x880]
push eax
imul ecx, dword [ebp - 0x2c], 0xc
add ecx, 0x1266e578
call fcn.100329d1
push dword [eax]
lea eax, [ebp - 0x760]
push eax
imul ecx, dword [ebp - 0x2c], 0xc
add ecx, 0x1266e578
call fcn.1000e113
push dword [eax]
lea edx, [ebp - 0x4b4]
lea ecx, [ebp - 0x884]
call fcn.100360ac
pop ecx
pop ecx
mov ecx, eax
call fcn.10033103
mov dword [ebp - 0x5b4], eax
lea eax, [ebp - 0x768]
push eax
imul ecx, dword [ebp - 0x2c], 0xc
add ecx, 0x1266e578
call fcn.1000e113
push eax
lea eax, [ebp - 0x818]
push eax
imul ecx, dword [ebp - 0x2c], 0xc
add ecx, 0x1266e578
call fcn.100329d1
push dword [eax]
lea eax, [ebp - 0x770]
push eax
imul ecx, dword [ebp - 0x2c], 0xc
add ecx, 0x1266e578
call fcn.1000e113
push dword [eax]
lea edx, [ebp - 0x4b4]
lea ecx, [ebp - 0x8b4]
call fcn.1003610b
pop ecx
pop ecx
mov ecx, eax
call fcn.10033103
mov dword [ebp - 0x610], eax
mov eax, dword [ebp - 0x610]
sub eax, dword [ebp - 0x5b4]
cdq
add eax, dword [ebp - 0x124]
adc edx, dword [ebp - 0x120]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], edx
jmp 0x10029f67
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax*4 + 0x10c18060]
cdq
idiv dword [0x10d9ec9c]
mov eax, edx
cdq
mov esi, eax
mov edi, edx
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax*4 + 0x10c18060]
call fcn.10036061
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.10051ca0
pop ecx
pop ecx
fstp qword [ebp - 0x7f8]
movsd xmm0, qword [ebp - 0x7f8]
addsd xmm0, qword [0x100091c0]
cvttsd2si ecx, xmm0
mov eax, dword [0x10d9ec9c]
cdq
push edx
push eax
push dword [ecx*8 + 0x1153fefc]
push dword [ecx*8 + 0x1153fef8]
call fcn.1006a850
push edx
push eax
push edi
push esi
call fcn.10056fb0
mov ecx, eax
mov esi, edx
mov eax, dword [0x10d9ec9c]
cdq
push edx
push eax
push esi
push ecx
call fcn.1006a850
mov ecx, eax
mov esi, edx
mov eax, dword [ebp - 0xa8]
mov eax, dword [eax*4 + 0x10c18060]
cdq
add ecx, eax
adc esi, edx
mov eax, dword [0x10d9ec9c]
cdq
push edx
push eax
push esi
push ecx
call fcn.1006a850
mov dword [ebp - 0x5f4], eax
mov dword [ebp - 0x5f0], edx
mov eax, dword [ebp - 0x5f4]
or eax, dword [ebp - 0x5f0]
jne 0x1002a214
mov eax, dword [ebp - 0x124]
sub eax, 1
mov ecx, dword [ebp - 0x120]
sbb ecx, 0
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], ecx
jmp 0x10029f3f
push dword [ebp - 0x120]
push dword [ebp - 0x124]
push 0x10008e8c
call fcn.10051040
add esp, 0xc
push 0
lea eax, [ebp - 0x778]
push eax
lea eax, [ebp - 0x72c]
push eax
call fcn.1002bd74
add esp, 0xc
mov dword [ebp - 0x5bc], 0x1955
cmp dword [ebp - 0x5bc], 0x9d3
jge 0x1002a586
lea eax, [ebp - 0x208]
push eax
push 0x100089d8
call fcn.10050e4b
pop ecx
pop ecx
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x524], eax
mov eax, dword [ebp - 0x208]
dec eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x524], 0
je 0x1002a586
lea eax, [ebp - 0xb0]
push eax
push 0x100089d8
call fcn.10050e4b
pop ecx
pop ecx
mov eax, dword [ebp - 0xb0]
inc eax
push eax
lea ecx, [ebp - 0x4d8]
call fcn.1000dfce
mov byte [ebp - 4], 0x17
and dword [ebp - 0x51c], 0
lea eax, [ebp - 0x51c]
push eax
mov eax, dword [ebp - 0xb0]
inc eax
push eax
lea ecx, [ebp - 0x66c]
call fcn.1000e01e
mov byte [ebp - 4], 0x18
mov byte [ebp - 0xc0], 1
lea eax, [ebp - 0xc0]
push eax
mov eax, dword [ebp - 0xb0]
inc eax
push eax
lea ecx, [ebp - 0x8b0]
call fcn.10032ad3
mov byte [ebp - 4], 0x19
mov byte [ebp - 0x31], 1
mov dword [ebp - 0x30], 1
jmp 0x1002a325
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0xb0]
jg 0x1002a3e0
push dword [ebp - 0x30]
lea ecx, [ebp - 0x4d8]
call fcn.1000e00f
push eax
push 0x100089d8
call fcn.10050e4b
pop ecx
pop ecx
push dword [ebp - 0x30]
lea ecx, [ebp - 0x4d8]
call fcn.1000e00f
mov eax, dword [eax]
cmp eax, dword [ebp - 0x30]
jge 0x1002a368
mov byte [ebp - 0x31], 0
push dword [ebp - 0x30]
lea ecx, [ebp - 0x4d8]
call fcn.1000e00f
mov esi, eax
mov eax, dword [ebp - 0x30]
dec eax
push eax
lea ecx, [ebp - 0x4d8]
call fcn.1000e00f
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x1002a3db
push dword [ebp - 0x30]
lea ecx, [ebp - 0x4d8]
call fcn.1000e00f
mov esi, eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x66c]
call fcn.1000e00f
mov ecx, dword [esi]
mov dword [eax], ecx
push 0
push dword [ebp - 0x30]
lea ecx, [ebp - 0x4d8]
call fcn.1000e00f
push dword [eax]
lea eax, [ebp - 0x91c]
push eax
lea ecx, [ebp - 0x8b0]
call fcn.10032bbd
mov ecx, eax
call fcn.10032bdc
jmp 0x1002a31e
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x1002a549
lea ecx, [ebp - 0x6fc]
call fcn.10032949
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x10c], 1
jmp 0x1002a414
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0xb0]
jg 0x1002a45c
push dword [ebp - 0x10c]
lea eax, [ebp - 0x94c]
push eax
lea ecx, [ebp - 0x8b0]
call fcn.10032bbd
mov ecx, eax
call fcn.10032c01
movzx eax, al
test eax, eax
je 0x1002a45a
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x6fc]
call fcn.10032a56
jmp 0x1002a407
and dword [ebp - 0x1d0], 0
mov dword [ebp - 0x114], 1
jmp 0x1002a47c
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0xb0]
jg 0x1002a4e5
push dword [ebp - 0x114]
lea ecx, [ebp - 0x66c]
call fcn.1000e00f
cmp dword [eax], 0
jle 0x1002a4a2
jmp 0x1002a46f
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x530], eax
push dword [ebp - 0x530]
lea ecx, [ebp - 0x6fc]
call fcn.1000e00f
mov esi, eax
push dword [ebp - 0x114]
lea ecx, [ebp - 0x66c]
call fcn.1000e00f
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
jmp 0x1002a46f
mov dword [ebp - 0x13c], 1
jmp 0x1002a4fe
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0xb0]
jg 0x1002a52d
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x66c]
call fcn.1000e00f
push dword [eax]
push 0x10008fa8
call fcn.10051040
pop ecx
pop ecx
jmp 0x1002a4f1
push 0x10008aed
call fcn.100511a7
pop ecx
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x6fc]
call fcn.1000e040
jmp 0x1002a554
push 0x10008a10
call fcn.100511a7
pop ecx
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x8b0]
call fcn.10032b11
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x66c]
call fcn.1000e040
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x4d8]
call fcn.1000e040
jmp 0x1002a277
mov eax, dword [ebp - 0x278]
add eax, dword [ebp - 0x278]
mov dword [ebp - 0x280], eax
push 0
lea ecx, [ebp - 0x510]
call fcn.1000e00f
mov ecx, dword [ebp - 0x280]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x72c]
call fcn.1000e00f
mov ecx, dword [ebp - 0x280]
mov dword [eax], ecx
push 0x927
push 0x7a0e
push 0x109d
push 0x536a
push 0x15c7
push 0x515a
lea eax, [ebp - 0x510]
push eax
push 1
push 0x2635
push 1
push 0x144f
push 0x7fae
push 0x6249
push 0x7f06
push 0
call fcn.1001fa17
add esp, 0x3c
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x72c]
call fcn.1000e00a
push 0
lea ecx, [ebp - 0x510]
call fcn.1000e00f
cmp dword [eax], 0xfffffff7
jge 0x1002a63b
mov dword [ebp - 0x288], 1
jmp 0x1002a642
and dword [ebp - 0x288], 0
cmp dword [ebp - 0x288], 1
jne 0x1002a657
mov dword [ebp - 0x290], 1
jmp 0x1002a65e
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x1d4]
mov ecx, dword [ebp - 0x290]
lea eax, [ecx + eax + 0xfffd]
cmp dword [ebp - 0x80], eax
je 0x1002a682
mov dword [ebp - 0x298], 1
jmp 0x1002a689
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x2a0], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x510]
call fcn.1000e00a
jmp 0x10029b11
lea eax, [ebp - 0x1d4]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x2a0]
push eax
push 0
lea eax, [ebp - 0x2a8]
push eax
push 1
call fcn.10024668
add esp, 0x18
mov dword [ebp - 0x538], 1
mov dword [ebp - 0x11c], 0x6915a136
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x11c], 0
jmp 0x1002a707
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0x1c
je 0x1002a750
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x1002a74e
push 0x5b3c
push 0x348c
push 1
push 0x4356
push 0
push 0x4b53
push 1
push 0x30ed
push 0x5b26
call fcn.1001dfd5
add esp, 0x24
jmp 0x1002a6fa
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x1002a784
push 1
push 0x27cc
push 0x6fae
push 0
push 0x442
push 0x68e6
push 1
call fcn.1001c30f
add esp, 0x1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x714]
call fcn.1000e00a
mov dword [ebp - 0x144], 0x1928c176
mov dword [ebp - 0x144], 0
jmp 0x1002a7b6
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xfffffff6
je 0x1002a916
mov dword [ebp - 0x14c], 0xaa9ac70c
mov dword [ebp - 0x8c4], 0xbfc3
mov dword [ebp - 0x8c0], 0xbfc3
mov dword [ebp - 0x8bc], 0xbfc3
mov dword [ebp - 0x8b8], 0xbfc3
mov dword [ebp - 0x14c], 0x12
jmp 0x1002a80e
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0x1b
jl 0x1002a911
mov dword [ebp - 0x154], 0x49f845d8
mov dword [ebp - 0x540], 5
mov dword [ebp - 0x154], 0xf
jmp 0x1002a848
mov eax, dword [ebp - 0x154]
dec eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xfffffff1
jne 0x1002a90c
mov dword [ebp - 0x15c], 0
jmp 0x1002a86e
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 2
jge 0x1002a88a
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x504], 1
jmp 0x1002a861
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x504], 3
jmp 0x1002a8b8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x504]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x504], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x504], 0
jl 0x1002a8fc
mov byte [ebp - 0xba], 0
movzx eax, byte [ebp - 0xba]
test eax, eax
je 0x1002a8fa
push 0x6333
push 0
push 0x6d5a
push 0x4c89
push 0x63eb
push 1
call fcn.1001bf3e
add esp, 0x18
jmp 0x1002a89d
cmp dword [ebp - 0x540], 0
je 0x1002a907
jmp 0x1002a90c
jmp 0x1002a83b
jmp 0x1002a801
jmp 0x1002a7a9
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x17c]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0xb8], 1
mov dword [ebp - 0x1dc], 0x3bed
mov dword [ebp - 0x1e4], 0xacd4a797
mov dword [ebp - 0x2e8], 0xfffffff6
mov dword [ebp - 0x310], 0xffffffff
mov dword [ebp - 0x164], 0
jmp 0x1002a97c
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 3
jge 0x1002a998
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x914], 0xfddf34ff
jmp 0x1002a96f
cmp dword [ebp - 0xb8], 0xef51
je 0x1002a9b0
mov dword [ebp - 0x2b0], 1
jmp 0x1002a9b7
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x1dc]
cmp dword [ebp - 0x2b0], eax
jle 0x1002a9d1
mov dword [ebp - 0x2b8], 1
jmp 0x1002a9d8
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x1dc]
cmp dword [ebp - 0x2b8], eax
jle 0x1002a9f2
mov dword [ebp - 0x548], 1
jmp 0x1002a9f9
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x820], eax
mov eax, dword [ebp - 0xb8]
add eax, 0x4ce34aaf
sub eax, dword [ebp - 0x1e4]
jne 0x1002aa2a
cmp dword [ebp - 0x1e4], 0
jne 0x1002aa2a
and dword [ebp - 0x2c0], 0
jmp 0x1002aa34
mov dword [ebp - 0x2c0], 1
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x2c0]
jge 0x1002aa4e
mov dword [ebp - 0x2c8], 1
jmp 0x1002aa55
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x2e8]
mov ecx, dword [ebp - 0x2c8]
lea eax, [ecx + eax + 3]
cmp dword [ebp - 0xb8], eax
jge 0x1002aa79
mov dword [ebp - 0x2d0], 1
jmp 0x1002aa80
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x2d0], eax
jg 0x1002aa9a
mov dword [ebp - 0x258], 1
jmp 0x1002aaa1
and dword [ebp - 0x258], 0
imul eax, dword [ebp - 0x258], 0
cmp eax, 0xa165f5c9
jne 0x1002aabb
mov dword [ebp - 0x2e0], 1
jmp 0x1002aac2
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0xb8]
add eax, dword [ebp - 0x2e0]
cmp eax, dword [ebp - 0x2e8]
je 0x1002aae2
mov dword [ebp - 0x2f0], 1
jmp 0x1002aae9
and dword [ebp - 0x2f0], 0
cmp dword [ebp - 0x2f0], 0xffff
jae 0x1002ab01
mov dword [ebp - 0x2f8], 1
jmp 0x1002ab08
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x2f8], eax
jl 0x1002ab22
mov dword [ebp - 0x300], 1
jmp 0x1002ab29
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0xb8]
imul eax, dword [ebp - 0x300]
cmp eax, 0xfffffff6
jne 0x1002ab47
mov dword [ebp - 0x308], 1
jmp 0x1002ab4e
and dword [ebp - 0x308], 0
imul eax, dword [ebp - 0x308], 0xae8e
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 1
jne 0x1002ab73
mov dword [ebp - 0x318], 1
jmp 0x1002ab7a
and dword [ebp - 0x318], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x318]
mov dword [ebp + eax - 0x914], ecx
mov dword [ebp - 0x38], 0x6960f57a
mov dword [ebp - 0x358], 1
mov dword [ebp - 0x7c], 0xa924c000
mov dword [ebp - 0x348], 0xfffffffb
mov dword [ebp - 0x174], 0
push 4
lea ecx, [ebp - 0x6f0]
call fcn.1000dfce
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x780], 0x4548
push 0
lea eax, [ebp - 0x888]
push eax
lea eax, [ebp - 0x6f0]
push eax
call fcn.1002090b
add esp, 0xc
mov eax, 0x6de0
test eax, eax
je 0x1002ac40
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x788], eax
mov eax, dword [ebp - 0x38]
sub eax, 0x7509cb0b
cmp eax, dword [ebp - 0x38]
jge 0x1002ac19
mov dword [ebp - 0x320], 1
jmp 0x1002ac20
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x320]
jne 0x1002ac34
mov eax, 0x3d6c1dfe
test eax, eax
je 0x1002ac40
mov dword [ebp - 0x328], 1
jmp 0x1002ac47
and dword [ebp - 0x328], 0
cmp dword [ebp - 0x328], 0xc8f0d071
jae 0x1002ac5f
mov dword [ebp - 0x330], 1
jmp 0x1002ac66
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x330], eax
je 0x1002ac7d
mov dword [ebp - 0x338], 1
jmp 0x1002ac84
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x338], eax
jg 0x1002ac9b
mov dword [ebp - 0x340], 1
jmp 0x1002aca2
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x348], eax
jge 0x1002acc5
mov dword [ebp - 0x350], 1
jmp 0x1002accc
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x828], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x790], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x7c], eax
jg 0x1002ad10
mov dword [ebp - 0x518], 1
jmp 0x1002ad17
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x8a0], eax
cmp dword [ebp - 0x174], 0
je 0x1002ad55
push 0x5d47
push 1
push 1
push 1
push 0x632e
push 0x4cb3
push 0x5a50
push 0x492
call fcn.1001455d
add esp, 0x20
jmp 0x1002af5c
push 3
lea ecx, [ebp - 0x6e4]
call fcn.1000dfce
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x16c], 0
jmp 0x1002ad7f
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 3
jge 0x1002ada1
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x6e4]
call fcn.1000e00f
mov dword [eax], 1
jmp 0x1002ad72
mov byte [ebp - 0xbf], 0
movzx eax, byte [ebp - 0xbf]
test eax, eax
je 0x1002af38
mov dword [ebp - 0x558], 0x1c81
cmp dword [ebp - 0x558], 0x800
jge 0x1002af2d
lea eax, [ebp - 0x1fc]
push eax
lea eax, [ebp - 0x560]
push eax
push 0x100089f8
call fcn.10050e4b
add esp, 0xc
cmp eax, 2
jne 0x1002af2d
push 0x60
push 0
push 0x11603ee8
call fcn.1003c587
add esp, 0xc
xor eax, eax
inc eax
imul eax, eax, 0
mov byte [eax + 0x11603ee8], 1
and dword [ebp - 0x1ec], 0
jmp 0x1002ae29
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x1ec]
cmp eax, dword [ebp - 0x560]
jge 0x1002aeaf
lea eax, [ebp - 0x1f4]
push eax
push 0x100089d4
call fcn.10050e4b
pop ecx
pop ecx
and dword [ebp - 0xe8], 0
jmp 0x1002ae60
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
add eax, dword [ebp - 0x1f4]
cmp eax, dword [ebp - 0x1fc]
jg 0x1002aeaa
mov eax, dword [ebp - 0xe8]
add eax, dword [ebp - 0x1f4]
movzx eax, byte [eax + 0x11603ee8]
mov ecx, dword [ebp - 0xe8]
movzx ecx, byte [ecx + 0x11603ee8]
or eax, ecx
mov ecx, dword [ebp - 0xe8]
add ecx, dword [ebp - 0x1f4]
mov byte [ecx + 0x11603ee8], al
jmp 0x1002ae53
jmp 0x1002ae1c
mov eax, dword [ebp - 0x1fc]
movzx eax, byte [eax + 0x11603ee8]
test eax, eax
jne 0x1002aecd
push 0x10008fb0
call fcn.100511a7
pop ecx
jmp 0x1002af28
and dword [ebp - 0x204], 0
mov dword [ebp - 0x128], 1
jmp 0x1002aeed
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x1fc]
jg 0x1002af16
mov eax, dword [ebp - 0x128]
movzx eax, byte [eax + 0x11603ee8]
add eax, dword [ebp - 0x204]
mov dword [ebp - 0x204], eax
jmp 0x1002aee0
push dword [ebp - 0x204]
push 0x10008a0c
call fcn.10051040
pop ecx
pop ecx
jmp 0x1002add1
push 0
push 1
call fcn.1001c139
pop ecx
pop ecx
push 2
lea ecx, [ebp - 0x6e4]
call fcn.1000e00f
mov eax, dword [eax]
mov dword [ebp - 0x174], eax
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x6e4]
call fcn.1000e00a
mov dword [ebp - 0x7c], 0
jmp 0x1002af6c
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jg 0x1002afb9
mov byte [ebp - 0x81], 0
push 0x93b
lea eax, [ebp - 0x81]
push eax
push 0
call fcn.1002d939
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x174]
push eax
push 0xb57
push 1
push 0x6256
lea eax, [ebp - 0x6f0]
push eax
push 0
call fcn.10021a9c
add esp, 0x1c
jmp 0x1002af65
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6f0]
call fcn.1000e00a
and dword [ebp - 0x20c], 0
jmp 0x1002afe7
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x60]
add eax, 0x28
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x20c], eax
jge 0x1002b927
mov dword [ebp - 0x798], 0xea75c96
mov dword [ebp - 0x570], 0x7df2f4a8
mov dword [ebp - 0x838], 3
mov dword [ebp - 0x568], 0xffff
mov dword [ebp - 0x184], 0
jmp 0x1002b040
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 2
jge 0x1002b05c
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x944], 0x256a9ef7
jmp 0x1002b033
push 0xcfd
lea eax, [ebp - 0x568]
push eax
push 0x4b33
push 0x11ef
push 0x5abc
push 0
push 0
push 0x3b9
push 0x6089
call fcn.100216bb
add esp, 0x24
push 0
push 0x3610
push 1
lea eax, [ebp - 0x570]
push eax
push 0x2f7f
push 0x4ff9
call fcn.1001bd77
add esp, 0x18
mov eax, dword [ebp - 0x60]
cmp dword [eax + 0x10], 0
jne 0x1002b0ee
push 0
push 0x37ca
push 1
push 1
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x578]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x60]
push eax
push 0x526b
call fcn.1002dc89
add esp, 0x24
jmp 0x1002afd1
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x754], 0xb319bd1
mov dword [ebp - 0x750], 0xb319bd1
mov dword [ebp - 0x74c], 0xb319bd1
mov dword [ebp - 0x748], 0xb319bd1
mov byte [ebp - 0xb1], 0
lea eax, [ebp - 0xb1]
push eax
push 0x2d58
push 0
push 0x4a21
call fcn.1002b94e
add esp, 0x10
mov dword [ebp - 0x4c], 0
jmp 0x1002b14f
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xfffffffe
jge 0x1002b4ca
mov dword [ebp - 0xf0], 0xffffffff
mov dword [ebp - 0x18c], 0x21046671
mov dword [ebp - 0x390], 1
mov dword [ebp - 0x3e8], 0xfffffff7
mov dword [ebp - 0x3f8], 0xffffffff
mov dword [ebp - 0x590], 0xffffffff
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x7a0], eax
mov eax, 0x27fa
cmp eax, 0xad5b
jg 0x1002b1b9
mov dword [ebp - 0x360], 1
jmp 0x1002b1c0
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x360]
add eax, dword [ebp - 0x4c]
jne 0x1002b1e0
cmp dword [ebp - 0xf0], 0
jne 0x1002b1e0
and dword [ebp - 0x368], 0
jmp 0x1002b1ea
mov dword [ebp - 0x368], 1
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x368], eax
jle 0x1002b204
mov dword [ebp - 0x370], 1
jmp 0x1002b20b
and dword [ebp - 0x370], 0
cmp dword [ebp - 0x370], 0x30a9
je 0x1002b223
mov dword [ebp - 0x378], 1
jmp 0x1002b22a
and dword [ebp - 0x378], 0
cmp dword [ebp - 0x378], 1
jle 0x1002b23f
mov dword [ebp - 0x380], 1
jmp 0x1002b246
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x380]
neg eax
je 0x1002b259
cmp dword [ebp - 0xf0], 0
jne 0x1002b268
cmp dword [ebp - 0x4c], 0
jne 0x1002b268
and dword [ebp - 0x580], 0
jmp 0x1002b272
mov dword [ebp - 0x580], 1
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x890], eax
imul eax, dword [ebp - 0xf0], 0
cmp eax, dword [ebp - 0x18c]
jle 0x1002b2c3
push 0x7d0e
push 0x4458
push 0
push 0x5982
push 1
push 0x772a
push 0x6101
push 0x35a7
push 0x7a18
push 0x55f9
call fcn.10026c31
add esp, 0x28
jmp 0x1002b4c5
mov dword [ebp - 0x3d0], 0x6a4137d6
mov dword [ebp - 0x3e0], 7
mov dword [ebp - 0x3c8], 0xfffffff8
push 2
lea ecx, [ebp - 0x694]
call fcn.1000dfce
mov dword [ebp - 4], 0x1d
push 0x49be
push 0x43ee
push 0xa94
lea eax, [ebp - 0x694]
push eax
push 0x4e07
push 1
push 0x1e59
push 0x2fd
lea eax, [ebp - 0x7a8]
push eax
push 0x7862
push 1
push 0x714a
call fcn.100146fb
add esp, 0x30
cmp dword [ebp - 0x3d0], 0
jne 0x1002b446
cmp dword [ebp - 0x18c], 0xffff
jb 0x1002b35c
mov dword [ebp - 0x388], 1
jmp 0x1002b363
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x388]
neg eax
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x398], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x398]
mov dword [ebp + eax - 0x754], ecx
cmp dword [ebp - 0x398], 0x549c
jle 0x1002b3a8
mov dword [ebp - 0x3c0], 1
jmp 0x1002b3af
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x3c0]
add eax, 8
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x7b0], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x8c8], eax
cmp dword [ebp - 0x18c], 5
jle 0x1002b3f7
mov dword [ebp - 0x3d8], 1
jmp 0x1002b3fe
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x3d0]
cmp dword [ebp - 0x3d8], eax
jg 0x1002b418
mov dword [ebp - 0x588], 1
jmp 0x1002b41f
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x7b8], eax
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x3e8], eax
cmp dword [ebp - 0x3e8], 0
jne 0x1002b446
and dword [ebp - 0x3f0], 0
jmp 0x1002b450
mov dword [ebp - 0x3f0], 1
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x3f8], eax
jne 0x1002b473
mov dword [ebp - 0x400], 1
jmp 0x1002b47a
and dword [ebp - 0x400], 0
push 0
lea ecx, [ebp - 0x694]
call fcn.1000e00f
mov ecx, dword [ebp - 0x400]
mov dword [eax], ecx
mov dword [ebp - 0x590], 4
cmp dword [ebp - 0x18c], 0
je 0x1002b4b6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x694]
call fcn.1000e00a
jmp 0x1002b148
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x694]
call fcn.1000e00a
jmp 0x1002b148
push 4
push 0x1000
mov eax, dword [ebp - 0x60]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x408]
add ecx, dword [eax + 0xc]
push ecx
push 0x4419
push 0x4018
call fcn.1003c06f
pop ecx
pop ecx
call eax
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x60]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x598]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x21c]
call fcn.1003c4dc
add esp, 0xc
mov dword [ebp - 0x48], 0x85f70ad6
mov dword [ebp - 0x18], 1
push 3
lea ecx, [ebp - 0x5c8]
call fcn.1000dfce
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x480], 0xfffffffd
mov dword [ebp - 0x5a0], 0xb53c
mov dword [ebp - 0x194], 0
jmp 0x1002b56d
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 3
jge 0x1002b58f
push dword [ebp - 0x194]
lea ecx, [ebp - 0x5c8]
call fcn.1000e00f
mov dword [eax], 2
jmp 0x1002b560
mov dword [ebp - 0x48], 0
jmp 0x1002b59f
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xfffffffc
jle 0x1002b7d6
mov dword [ebp - 0x214], 0xfffd
mov dword [ebp - 0x12c], 0x7d6364d6
push 0x772c
lea eax, [ebp - 0x18]
push eax
push 0
push 0x5c70
push 1
push 0x26c7
push 1
push 0x156
lea eax, [ebp - 0x214]
push eax
call fcn.1001dfd5
add esp, 0x24
mov eax, 0xcde9
test eax, eax
je 0x1002b678
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x858], eax
cmp dword [ebp - 0x18], 0x9646
jge 0x1002b615
mov dword [ebp - 0x410], 1
jmp 0x1002b61c
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x410], eax
jle 0x1002b636
mov dword [ebp - 0x418], 1
jmp 0x1002b63d
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x214]
cmp eax, dword [ebp - 0x418]
je 0x1002b657
mov dword [ebp - 0x420], 1
jmp 0x1002b65e
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x420], eax
jne 0x1002b678
mov dword [ebp - 0x428], 1
jmp 0x1002b67f
and dword [ebp - 0x428], 0
cmp dword [ebp - 0x428], 0x1b40
jg 0x1002b697
mov dword [ebp - 0x430], 1
jmp 0x1002b69e
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x214]
cmp eax, dword [ebp - 0x430]
jl 0x1002b6b8
mov dword [ebp - 0x438], 1
jmp 0x1002b6bf
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x438], eax
jle 0x1002b6d6
mov dword [ebp - 0x440], 1
jmp 0x1002b6dd
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x440]
jne 0x1002b6fa
cmp dword [ebp - 0x12c], 0
jne 0x1002b6fa
and dword [ebp - 0x448], 0
jmp 0x1002b704
mov dword [ebp - 0x448], 1
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x448], eax
jge 0x1002b71e
mov dword [ebp - 0x450], 1
jmp 0x1002b725
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x450]
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jne 0x1002b775
mov dword [ebp - 0x18], 2
jmp 0x1002b743
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1002b773
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x1002b771
push 0x3a0e
push 0x399b
push 1
push 1
call fcn.10014c52
add esp, 0x10
jmp 0x1002b73c
jmp 0x1002b7d1
mov dword [ebp - 0x130], 0
jmp 0x1002b78e
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 1
jge 0x1002b7aa
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x458], 0x9843334a
jmp 0x1002b781
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x458], 0
je 0x1002b7bc
jmp 0x1002b7d6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x458], 0
je 0x1002b7d1
jmp 0x1002b598
jmp 0x1002b598
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x7c0], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x898], eax
cmp dword [ebp - 0x18], 0
je 0x1002b7f7
cmp dword [ebp - 0x48], 0
jne 0x1002b812
push 2
lea ecx, [ebp - 0x5c8]
call fcn.1000e00f
cmp dword [eax], 0
jne 0x1002b812
and dword [ebp - 0x460], 0
jmp 0x1002b81c
mov dword [ebp - 0x460], 1
mov eax, dword [ebp - 0x18]
neg eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x460]
imul ecx, ecx, 0x9b8a
add ecx, 0x12ed4033
cmp eax, ecx
jl 0x1002b846
mov dword [ebp - 0x468], 1
jmp 0x1002b84d
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x1002b86e
mov eax, 0x1dce
test eax, eax
jne 0x1002b86e
and dword [ebp - 0x470], 0
jmp 0x1002b878
mov dword [ebp - 0x470], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x470], eax
je 0x1002b88f
mov dword [ebp - 0x478], 1
jmp 0x1002b896
and dword [ebp - 0x478], 0
push 0
lea ecx, [ebp - 0x5c8]
call fcn.1000e00f
mov ecx, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x478]
mov eax, dword [eax]
sub eax, ecx
test eax, eax
jle 0x1002b8c7
cmp dword [ebp - 0x480], 0
jne 0x1002b8c7
and dword [ebp - 0x488], 0
jmp 0x1002b8d1
mov dword [ebp - 0x488], 1
push 0
lea ecx, [ebp - 0x5c8]
call fcn.1000e00f
mov ecx, dword [ebp - 0x488]
cmp ecx, dword [eax]
jge 0x1002b8f4
mov dword [ebp - 0x490], 1
jmp 0x1002b8fb
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x5a0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c8]
call fcn.1000e00a
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x21c]
mov dword [eax + 8], ecx
jmp 0x1002afd1
jmp 0x1002b93d
push 1
push 0x7b17
push 0x30ad
call fcn.1001481b
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret