Function at 0x10038ab3
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a62a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe40
push esi
push edi
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x1003f7a4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x868], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x870], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x878], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x880], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x7ac], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x860], eax
mov eax, dword [ebp - 0x7ac]
movzx eax, byte [eax]
test eax, eax
je 0x10038baf
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x868]
mov dword [ebp - 0x32c], eax
push 4
push 0x2000
mov eax, dword [ebp - 0x2a4]
push dword [eax + 0x50]
mov eax, dword [ebp - 0x2a4]
push dword [eax + 0x34]
push 0xe89
push 0xccd
call fcn.100114c1
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x32c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x32c]
cmp dword [eax], 0
jne 0x10038baa
push 4
push 0x2000
mov eax, dword [ebp - 0x2a4]
push dword [eax + 0x50]
push 0
push 0xe89
push 0xccd
call fcn.100114c1
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x32c]
mov dword [ecx], eax
jmp 0x1003f79f
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0x7d8], eax
mov eax, dword [ebp - 0x880]
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x10], 0xfffffffa
mov dword [ebp - 0x298], 0xab4456e3
mov dword [ebp - 0x6e0], 0xd45b0e82
mov dword [ebp - 0x334], 0xfbd13d8c
mov dword [ebp - 0x738], 0xfffffffa
mov dword [ebp - 0x7c], 0
jmp 0x10038c12
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x10038c28
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x290], 0xd52a42bb
jmp 0x10038c0b
mov dword [ebp - 0x7c], 0
jmp 0x10038c38
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x10038c4e
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xda4], 0xbaf9eb11
jmp 0x10038c31
cmp dword [ebp - 0x298], 0xcc38
jne 0x10038c66
mov dword [ebp - 0x440], 1
jmp 0x10038c6d
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x6e0], eax
cmp dword [ebp - 0x6e0], 0x7c5b
je 0x10038c91
mov dword [ebp - 0x6e8], 1
jmp 0x10038c98
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0
je 0x10038cbb
cmp dword [ebp - 0x334], 0
je 0x10038cbb
xor eax, eax
inc eax
jne 0x10038cc2
cmp dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x298]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x290]
cmp eax, dword [ebp - 0x298]
jle 0x10038cea
mov dword [ebp - 0x6f0], 1
jmp 0x10038cf1
and dword [ebp - 0x6f0], 0
cmp dword [ebp - 0x6f0], 0x37bd55fd
jge 0x10038d09
mov dword [ebp - 0x888], 1
jmp 0x10038d10
and dword [ebp - 0x888], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x290], 0xffffffff
jae 0x10038d2c
mov dword [ebp - 0x6f8], 1
jmp 0x10038d33
and dword [ebp - 0x6f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x290]
cmp dword [ebp - 0x6f8], eax
jg 0x10038d54
mov dword [ebp - 0x700], 1
jmp 0x10038d5b
and dword [ebp - 0x700], 0
cmp dword [ebp - 0x700], 0x458a
jl 0x10038d73
mov dword [ebp - 0x728], 1
jmp 0x10038d7a
and dword [ebp - 0x728], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x290]
cmp dword [ebp - 0x728], eax
jge 0x10038d9b
mov dword [ebp - 0x730], 1
jmp 0x10038da2
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0x738], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x738]
mov dword [ebp + eax - 0xda4], ecx
mov dword [ebp - 0x40], 1
push 2
lea ecx, [ebp - 0x768]
call fcn.10011c5f
and dword [ebp - 4], 0
mov dword [ebp - 0x1e4], 0xffffffff
mov dword [ebp - 0x93c], 0xe6f885ea
mov dword [ebp - 0x94c], 0xfff9
mov dword [ebp - 0x890], 0x1c8b
cmp dword [ebp - 0x890], 0xd12
jge 0x10039365
push 4
pop eax
shl eax, 1
and dword [ebp + eax - 0xbec], 0
push 4
pop eax
shl eax, 0
and dword [ebp + eax - 0xbec], 0
push 4
pop eax
imul eax, eax, 0
and dword [ebp + eax - 0xbec], 0
push 4
pop eax
imul eax, eax, 5
mov dword [ebp + eax - 0xbec], 1
push 4
pop eax
shl eax, 2
mov dword [ebp + eax - 0xbec], 1
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xbec], 1
push 4
pop eax
shl eax, 3
mov dword [ebp + eax - 0xbec], 2
push 4
pop eax
imul eax, eax, 7
mov dword [ebp + eax - 0xbec], 2
push 4
pop eax
imul eax, eax, 6
mov dword [ebp + eax - 0xbec], 2
push 4
pop eax
imul eax, eax, 0xb
mov dword [ebp + eax - 0xbec], 3
push 4
pop eax
imul eax, eax, 0xa
mov dword [ebp + eax - 0xbec], 3
push 4
pop eax
imul eax, eax, 9
mov dword [ebp + eax - 0xbec], 3
push 4
pop eax
imul eax, eax, 0xe
mov dword [ebp + eax - 0xbec], 4
push 4
pop eax
imul eax, eax, 0xd
mov dword [ebp + eax - 0xbec], 4
push 4
pop eax
imul eax, eax, 0xc
mov dword [ebp + eax - 0xbec], 4
push 4
pop eax
imul eax, eax, 0x12
mov dword [ebp + eax - 0xbec], 5
push 4
pop eax
imul eax, eax, 0x11
mov dword [ebp + eax - 0xbec], 5
push 4
pop eax
shl eax, 4
mov dword [ebp + eax - 0xbec], 5
push 4
pop eax
imul eax, eax, 0xf
mov dword [ebp + eax - 0xbec], 5
push 4
pop eax
imul eax, eax, 0x15
mov dword [ebp + eax - 0xbec], 6
push 4
pop eax
imul eax, eax, 0x14
mov dword [ebp + eax - 0xbec], 6
push 4
pop eax
imul eax, eax, 0x13
mov dword [ebp + eax - 0xbec], 6
push 4
pop eax
imul eax, eax, 0x19
mov dword [ebp + eax - 0xbec], 7
push 4
pop eax
imul eax, eax, 0x18
mov dword [ebp + eax - 0xbec], 7
push 4
pop eax
imul eax, eax, 0x17
mov dword [ebp + eax - 0xbec], 7
push 4
pop eax
imul eax, eax, 0x16
mov dword [ebp + eax - 0xbec], 7
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb84], 1
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xb84], 2
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xb84], 3
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xb84], 1
push 4
pop eax
shl eax, 2
mov dword [ebp + eax - 0xb84], 2
push 4
pop eax
imul eax, eax, 5
mov dword [ebp + eax - 0xb84], 3
push 4
pop eax
imul eax, eax, 6
mov dword [ebp + eax - 0xb84], 1
push 4
pop eax
imul eax, eax, 7
mov dword [ebp + eax - 0xb84], 2
push 4
pop eax
shl eax, 3
mov dword [ebp + eax - 0xb84], 3
push 4
pop eax
imul eax, eax, 9
mov dword [ebp + eax - 0xb84], 1
push 4
pop eax
imul eax, eax, 0xa
mov dword [ebp + eax - 0xb84], 2
push 4
pop eax
imul eax, eax, 0xb
mov dword [ebp + eax - 0xb84], 3
push 4
pop eax
imul eax, eax, 0xc
mov dword [ebp + eax - 0xb84], 1
push 4
pop eax
imul eax, eax, 0xd
mov dword [ebp + eax - 0xb84], 2
push 4
pop eax
imul eax, eax, 0xe
mov dword [ebp + eax - 0xb84], 3
push 4
pop eax
imul eax, eax, 0xf
mov dword [ebp + eax - 0xb84], 1
push 4
pop eax
shl eax, 4
mov dword [ebp + eax - 0xb84], 2
push 4
pop eax
imul eax, eax, 0x11
mov dword [ebp + eax - 0xb84], 3
push 4
pop eax
imul eax, eax, 0x12
mov dword [ebp + eax - 0xb84], 4
push 4
pop eax
imul eax, eax, 0x13
mov dword [ebp + eax - 0xb84], 1
push 4
pop eax
imul eax, eax, 0x14
mov dword [ebp + eax - 0xb84], 2
push 4
pop eax
imul eax, eax, 0x15
mov dword [ebp + eax - 0xb84], 3
push 4
pop eax
imul eax, eax, 0x16
mov dword [ebp + eax - 0xb84], 1
push 4
pop eax
imul eax, eax, 0x17
mov dword [ebp + eax - 0xb84], 2
push 4
pop eax
imul eax, eax, 0x18
mov dword [ebp + eax - 0xb84], 3
push 4
pop eax
imul eax, eax, 0x19
mov dword [ebp + eax - 0xb84], 4
lea ecx, [ebp - 0x9a4]
call fcn.100117af
mov byte [ebp - 4], 1
lea eax, [ebp - 0x300]
push eax
mov ecx, 0x1065b310
call fcn.10011831
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp - 0x300]
dec eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x8a4], 0
je 0x10039356
lea eax, [ebp - 0x8b4]
push eax
lea eax, [ebp - 0x2b0]
push eax
mov ecx, 0x1065b310
call fcn.10011831
mov ecx, eax
call fcn.10011831
lea edx, [ebp - 0x9a4]
mov ecx, 0x1065b310
call fcn.10048b33
lea edx, [ebp - 0x9a4]
mov ecx, 0x1065b310
call fcn.10048b33
and dword [ebp - 0xd8], 0
lea ecx, [ebp - 0x9a4]
call fcn.10011c58
mov dword [ebp - 0x8ac], eax
and dword [ebp - 0x5c], 0
or dword [ebp - 0x18c], 0xffffffff
jmp 0x1003922b
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x8ac]
jge 0x10039335
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x9a4]
call fcn.10013a22
movsx eax, byte [eax]
cmp eax, 0x20
jne 0x1003926e
mov eax, dword [ebp - 0xd8]
add eax, dword [ebp - 0x2b0]
mov dword [ebp - 0xd8], eax
or dword [ebp - 0x18c], 0xffffffff
jmp 0x10039330
cmp dword [ebp - 0x18c], 0xffffffff
je 0x1003929e
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x9a4]
call fcn.10013a22
movsx eax, byte [eax]
mov ecx, dword [ebp - 0x18c]
mov ecx, dword [ebp + ecx*4 - 0xbec]
cmp ecx, dword [ebp + eax*4 - 0xcf0]
je 0x100392e5
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x9a4]
call fcn.10013a22
movsx eax, byte [eax]
mov ecx, dword [ebp - 0x2b0]
imul ecx, dword [ebp + eax*4 - 0xc88]
add ecx, dword [ebp - 0xd8]
mov dword [ebp - 0xd8], ecx
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x9a4]
call fcn.10013a22
movsx eax, byte [eax]
sub eax, 0x41
mov dword [ebp - 0x18c], eax
jmp 0x10039330
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x9a4]
call fcn.10013a22
movsx eax, byte [eax]
mov ecx, dword [ebp - 0x2b0]
imul ecx, dword [ebp + eax*4 - 0xc88]
add ecx, dword [ebp - 0x8b4]
add ecx, dword [ebp - 0xd8]
mov dword [ebp - 0xd8], ecx
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x9a4]
call fcn.10013a22
movsx eax, byte [eax]
sub eax, 0x41
mov dword [ebp - 0x18c], eax
jmp 0x10039224
push fcn.10016103
push dword [ebp - 0xd8]
mov ecx, 0x1065b258
call fcn.10011a2c
mov ecx, eax
call fcn.10011a20
jmp 0x1003919a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x9a4]
call fcn.10011812
push 0x63b6
push 0x7dbd
push 0x66b9
push 0x2c1
lea eax, [ebp - 0x768]
push eax
push 1
push 0x47ff
lea eax, [ebp - 0xc84]
push eax
push 1
call fcn.100296dd
add esp, 0x24
mov dword [ebp - 0x1e4], 1
jmp 0x100393b1
mov eax, dword [ebp - 0x1e4]
dec eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0
jl 0x1003951c
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x244], 0
jmp 0x100393de
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 3
jge 0x100393fa
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0xcf8], 0xa7ecc244
jmp 0x100393d1
mov dword [ebp - 0x74], 0
jmp 0x1003940a
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jg 0x10039517
mov dword [ebp - 0x740], 0xbdbdf7c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xcf8], 0xa23f
mov eax, 0xa23f
test eax, eax
je 0x10039462
push 1
lea ecx, [ebp - 0x768]
call fcn.10011cc6
mov eax, dword [eax]
mov dword [ebp - 0x740], eax
cmp dword [ebp - 0x740], 0
je 0x10039462
mov dword [ebp - 0x748], 1
jmp 0x10039469
and dword [ebp - 0x748], 0
push dword [ebp - 0x74]
lea ecx, [ebp - 0x768]
call fcn.10011cc6
mov eax, dword [eax]
cmp eax, dword [ebp - 0x748]
jg 0x1003948d
mov dword [ebp - 0x8bc], 1
jmp 0x10039494
and dword [ebp - 0x8bc], 0
push dword [ebp - 0x74]
lea ecx, [ebp - 0x768]
call fcn.10011cc6
cmp dword [eax], 0x753f
je 0x100394b6
mov dword [ebp - 0x934], 1
jmp 0x100394bd
and dword [ebp - 0x934], 0
push dword [ebp - 0x74]
lea ecx, [ebp - 0x768]
call fcn.10011cc6
mov esi, dword [ebp - 0x93c]
push dword [ebp - 0x74]
lea ecx, [ebp - 0x768]
call fcn.10011cc6
mov eax, dword [eax]
inc eax
cmp esi, eax
jl 0x100394f5
cmp dword [ebp - 0x74], 0
jne 0x100394f5
and dword [ebp - 0x944], 0
jmp 0x100394ff
mov dword [ebp - 0x944], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xcf8]
mov dword [ebp - 0x94c], eax
jmp 0x10039403
jmp 0x100393a4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x768]
call fcn.10011cc1
mov dword [ebp - 0x158], 0xfffffff6
mov dword [ebp - 0xf0], 0x5610a143
push 3
lea ecx, [ebp - 0x9f0]
call fcn.10011c5f
mov dword [ebp - 4], 2
mov dword [ebp - 0x188], 0x13b91020
mov dword [ebp - 0x858], 0
mov dword [ebp - 0x920], 0x7682c5a4
mov dword [ebp - 0x188], 3
jmp 0x1003958a
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 9
je 0x100395f3
mov dword [ebp - 0x798], 0xc588e1b6
mov dword [ebp - 0x954], 0xefe3
mov dword [ebp - 0x95c], 5
lea eax, [ebp - 0x954]
push eax
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x95c]
push eax
push 0x45f0
lea eax, [ebp - 0x920]
push eax
push 0
push 0x177c
push 0
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0x798]
push eax
call fcn.100422f6
add esp, 0x28
jmp 0x1003957d
mov dword [ebp - 0x44], 0xb674
mov dword [ebp - 0x1f4], 0
jmp 0x10039613
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 2
jge 0x1003962f
mov eax, dword [ebp - 0x1f4]
mov dword [ebp + eax*4 - 0x2a0], 0xfdad5a51
jmp 0x10039606
cmp dword [ebp - 0x44], 0xfffffff9
je 0x100396fe
cmp dword [ebp - 0x44], 0
je 0x10039688
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a0]
cmp dword [ebp - 0x44], eax
jl 0x1003965d
mov dword [ebp - 0x750], 1
jmp 0x10039664
and dword [ebp - 0x750], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a0]
imul eax, dword [ebp - 0x750]
test eax, eax
je 0x10039688
mov dword [ebp - 0x39c], 1
jmp 0x1003968f
and dword [ebp - 0x39c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2a0]
imul eax, dword [ebp - 0x39c]
test eax, eax
jne 0x100396c0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2a0], 0
jne 0x100396c0
and dword [ebp - 0x6d8], 0
jmp 0x100396ca
mov dword [ebp - 0x6d8], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a0]
imul eax, dword [ebp - 0x6d8]
test eax, eax
je 0x100396fe
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2a0], 0
je 0x100396fe
mov dword [ebp - 0x74c], 1
jmp 0x10039705
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x74c]
jne 0x1003971c
mov dword [ebp - 0x3a4], 1
jmp 0x10039723
and dword [ebp - 0x3a4], 0
imul eax, dword [ebp - 0x3a4], 0x829e
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x2a0]
je 0x1003976a
mov byte [ebp - 0xfc], 0
push 0x2f10
push 0x510b
push 1
push 0
push 0x6d57
lea eax, [ebp - 0xfc]
push eax
call fcn.1002f080
add esp, 0x18
jmp 0x1003988b
mov dword [ebp - 0x284], 0
mov dword [ebp - 0x79c], 0xb2bc8f96
mov dword [ebp - 0x44], 0
jmp 0x1003978e
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x11
je 0x1003988b
mov dword [ebp - 0x31c], 0xce96
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x284], eax
jle 0x100397b9
mov dword [ebp - 0x584], 1
jmp 0x100397c0
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x31c]
cmp eax, dword [ebp - 0x584]
jne 0x100397da
mov dword [ebp - 0x3ac], 1
jmp 0x100397e1
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x31c]
mov ecx, dword [ebp - 0x284]
push 4
pop edx
imul edx, edx, 0
add ecx, dword [ebp + edx - 0x2a0]
add eax, ecx
jne 0x10039810
cmp dword [ebp - 0x284], 0
jne 0x10039810
and dword [ebp - 0x674], 0
jmp 0x1003981a
mov dword [ebp - 0x674], 1
mov eax, dword [ebp - 0x284]
cmp dword [ebp - 0x674], eax
jge 0x10039834
mov dword [ebp - 0x3b4], 1
jmp 0x1003983b
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x31c]
cmp eax, dword [ebp - 0x3b4]
jg 0x10039855
mov dword [ebp - 0x58c], 1
jmp 0x1003985c
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x58c], eax
jg 0x10039873
mov dword [ebp - 0x3bc], 1
jmp 0x1003987a
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x79c], eax
jmp 0x10039787
mov byte [ebp - 0xda], 0
movzx eax, byte [ebp - 0xda]
test eax, eax
je 0x100398c4
push 1
push 0
push 0x1c46
push 0x4d4a
push 0x428e
push 1
push 0xd85
push 0x6281
call fcn.10030808
add esp, 0x20
push 1
push 0
push 1
lea eax, [ebp - 0xc88]
push eax
lea eax, [ebp - 0x9f0]
push eax
call fcn.1002f18e
add esp, 0x14
push 2
lea ecx, [ebp - 0x378]
call fcn.10011c5f
mov byte [ebp - 4], 3
mov dword [ebp - 0xa4], 0xa885c82f
mov dword [ebp - 0x17c], 0xfffffff7
mov dword [ebp - 0x2b8], 0x6bbbd28a
mov dword [ebp - 0xac], 0x5f459ca
push 0x7f3a
push 0x1b19
push 1
push 0x79d9
push 0
push 0x419b
push 0xc72
push 0xd45
push 0x2510
lea eax, [ebp - 0x378]
push eax
push 0x1cbb
push 0x5da4
lea eax, [ebp - 0xd2c]
push eax
push 0x3910
push 1
call fcn.1002f2a4
add esp, 0x3c
push 0x200e
push 0x43d1
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x17c]
push eax
push 1
push 1
call fcn.1002e757
add esp, 0x1c
push 0
lea ecx, [ebp - 0x378]
call fcn.10011cc6
cmp dword [eax], 0
jne 0x100399b0
mov dword [ebp - 0x6ec], 1
jmp 0x100399b7
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x6ec]
mov dword [ebp - 0xa4], eax
push 0
lea ecx, [ebp - 0x378]
call fcn.10011cc6
cmp dword [eax], 0
je 0x100399f3
push 0
lea ecx, [ebp - 0x378]
call fcn.10011cc6
cmp dword [eax], 0
je 0x100399f3
mov dword [ebp - 0x3c4], 1
jmp 0x100399fa
and dword [ebp - 0x3c4], 0
cmp dword [ebp - 0x3c4], 0xfffffff9
jbe 0x10039a0f
mov dword [ebp - 0x594], 1
jmp 0x10039a16
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x594]
sub eax, dword [ebp - 0x17c]
cmp eax, 5
jl 0x10039a33
mov dword [ebp - 0x3cc], 1
jmp 0x10039a3a
and dword [ebp - 0x3cc], 0
imul eax, dword [ebp - 0x3cc], 0x31fc
test eax, eax
jbe 0x10039a54
mov dword [ebp - 0x67c], 1
jmp 0x10039a5b
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x67c]
sub eax, dword [ebp - 0x17c]
cmp eax, dword [ebp - 0x17c]
jg 0x10039a7b
mov dword [ebp - 0x3d4], 1
jmp 0x10039a82
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0x3d4], eax
je 0x10039a9c
mov dword [ebp - 0x59c], 1
jmp 0x10039aa3
and dword [ebp - 0x59c], 0
push 0
lea ecx, [ebp - 0x378]
call fcn.10011cc6
mov ecx, dword [ebp - 0x59c]
cmp ecx, dword [eax]
jg 0x10039ac6
mov dword [ebp - 0x3dc], 1
jmp 0x10039acd
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0x3dc], eax
jg 0x10039ae7
mov dword [ebp - 0x72c], 1
jmp 0x10039aee
and dword [ebp - 0x72c], 0
imul eax, dword [ebp - 0x72c], 0x2e18
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 1
jbe 0x10039b13
mov dword [ebp - 0x8c0], 1
jmp 0x10039b1a
and dword [ebp - 0x8c0], 0
push 1
lea ecx, [ebp - 0x378]
call fcn.10011cc6
xor eax, eax
cmp eax, 1
jb 0x10039b3a
mov dword [ebp - 0x3e4], 1
jmp 0x10039b41
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
sub eax, dword [ebp - 0x2b8]
cmp eax, 0x7b09
jge 0x10039d17
mov dword [ebp - 0x92c], 0x91cd
mov dword [ebp - 0x7a4], 0x20a9
cmp dword [ebp - 0x7a4], 0x831
jge 0x10039c68
lea ecx, [ebp - 0xb1c]
call fcn.100117af
mov byte [ebp - 4], 4
lea edx, [ebp - 0xb1c]
mov ecx, 0x1065b310
call fcn.10016235
mov dword [ebp - 0x5a4], eax
mov eax, dword [ebp - 0x5a4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x5a4]
add ecx, dword [eax + 4]
call fcn.1001783a
movzx eax, al
test eax, eax
je 0x10039c59
mov edx, 0x1000b4c0
lea ecx, [ebp - 0xb1c]
call fcn.10048d66
movzx eax, al
test eax, eax
je 0x10039c59
lea eax, [ebp - 0xc90]
push eax
lea ecx, [ebp - 0xb1c]
call fcn.10011c30
push dword [eax]
lea eax, [ebp - 0xd34]
push eax
lea ecx, [ebp - 0xb1c]
call fcn.10011c1c
push dword [eax]
call fcn.10048d75
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10039c39
push fcn.10016103
lea edx, [ebp - 0xb1c]
mov ecx, 0x1065b258
call fcn.10048b58
mov ecx, eax
call fcn.10011a20
jmp 0x10039c54
push fcn.10016103
mov edx, 0x1000b4c4
mov ecx, 0x1065b258
call fcn.1002366b
mov ecx, eax
call fcn.10011a20
jmp 0x10039b97
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xb1c]
call fcn.10011812
mov dword [ebp - 0xac], 1
jmp 0x10039c81
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x10039d15
mov dword [ebp - 0xa4], 1
jmp 0x10039ca7
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jl 0x10039d10
push 0x2944
push 1
push 0x3a23
push 0x8a5
push 1
push 0x1777
call fcn.1002ed76
add esp, 0x18
lea eax, [ebp - 0xac]
push eax
push 0x389e
lea eax, [ebp - 0xa4]
push eax
push 1
lea eax, [ebp - 0x378]
push eax
push 0x6871
push 1
push 1
push 0x23f0
push 0x276c
lea eax, [ebp - 0x92c]
push eax
call fcn.1002ee25
add esp, 0x2c
jmp 0x10039c9a
jmp 0x10039c74
jmp 0x10039d91
push 2
lea ecx, [ebp - 0xaa8]
call fcn.10011c5f
mov byte [ebp - 4], 5
mov dword [ebp - 0x1fc], 0
jmp 0x10039d41
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 2
jge 0x10039d60
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0xaa8]
call fcn.10011cc6
and dword [eax], 0
jmp 0x10039d34
lea eax, [ebp - 0xaa8]
push eax
lea eax, [ebp - 0xa4]
push eax
push 0x48fc
push 0
push 0x71e
call fcn.1003fa92
add esp, 0x14
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xaa8]
call fcn.10011cc1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x378]
call fcn.10011cc1
mov dword [ebp - 0x40], 0xc1d6
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x10], eax
jge 0x10039e33
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x40]
jge 0x10039dca
mov dword [ebp - 0x3ec], 1
jmp 0x10039dd1
and dword [ebp - 0x3ec], 0
cmp dword [ebp - 0x3ec], 0xbc0d133f
ja 0x10039de9
mov dword [ebp - 0x684], 1
jmp 0x10039df0
and dword [ebp - 0x684], 0
cmp dword [ebp - 0x684], 0xb288586f
jb 0x10039e08
mov dword [ebp - 0x3f4], 1
jmp 0x10039e0f
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jne 0x10039e33
cmp dword [ebp - 0x40], 0
jne 0x10039e33
and dword [ebp - 0x5ac], 0
jmp 0x10039e3d
mov dword [ebp - 0x5ac], 1
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x5ac]
cmp eax, dword [ebp - 0x10]
jge 0x10039e58
mov dword [ebp - 0x3fc], 1
jmp 0x10039e5f
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x3fc], eax
jl 0x10039e76
mov dword [ebp - 0x6f4], 1
jmp 0x10039e7d
and dword [ebp - 0x6f4], 0
cmp dword [ebp - 0x6f4], 9
jb 0x10039e92
mov dword [ebp - 0x404], 1
jmp 0x10039e99
and dword [ebp - 0x404], 0
cmp dword [ebp - 0x404], 0xfffd
je 0x10039eb1
mov dword [ebp - 0x5b4], 1
jmp 0x10039eb8
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x5b4], eax
jl 0x10039ecf
mov dword [ebp - 0x40c], 1
jmp 0x10039ed6
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x40c], eax
je 0x10039eed
mov dword [ebp - 0x68c], 1
jmp 0x10039ef4
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x68c]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xf0], eax
jl 0x10039f1e
push 6
pop eax
test eax, eax
je 0x10039f1e
mov dword [ebp - 0x414], 1
jmp 0x10039f25
and dword [ebp - 0x414], 0
cmp dword [ebp - 0x414], 0xbefa
jge 0x10039f3d
mov dword [ebp - 0x5bc], 1
jmp 0x10039f44
and dword [ebp - 0x5bc], 0
cmp dword [ebp - 0x5bc], 0xec56
jge 0x10039f5c
mov dword [ebp - 0x41c], 1
jmp 0x10039f63
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x41c], eax
jge 0x10039f7a
mov dword [ebp - 0x744], 1
jmp 0x10039f81
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x744]
sub eax, 0xffff
cmp eax, dword [ebp - 0x10]
jne 0x10039f9d
mov dword [ebp - 0x424], 1
jmp 0x10039fa4
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x424]
je 0x1003b7f8
mov dword [ebp - 0x64], 9
mov dword [ebp - 0x24c], 0
jmp 0x10039fd3
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 4
jge 0x10039fef
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0xaf4], 3
jmp 0x10039fc6
mov dword [ebp - 0x64], 3
jmp 0x10039fff
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x1003a338
mov dword [ebp - 0x20c], 0xd3b3152c
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0xaf4]
mov dword [ebp + ecx*4 - 0xaf4], eax
mov dword [ebp - 0x78c], 0x1ac7
cmp dword [ebp - 0x78c], 0x4c0
jge 0x1003a2c5
lea eax, [ebp - 0x178]
push eax
push 0x1000b210
call fcn.10050d0b
pop ecx
pop ecx
push dword [ebp - 0x178]
lea ecx, [ebp - 0x34c]
call fcn.10011c5f
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x36c]
call fcn.10022886
mov byte [ebp - 4], 7
mov dword [ebp - 0x204], 1
jmp 0x1003a091
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
cmp eax, dword [ebp - 0x178]
jg 0x1003a0c6
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x8cc], eax
lea eax, [ebp - 0x8cc]
push eax
lea eax, [ebp - 0xde4]
push eax
lea ecx, [ebp - 0x36c]
call fcn.1002289b
jmp 0x1003a084
and dword [ebp - 0x138], 0
jmp 0x1003a0dc
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x178]
jge 0x1003a148
push dword [ebp - 0x138]
lea ecx, [ebp - 0x34c]
call fcn.10011cc6
push eax
push 0x1000b1cc
call fcn.10050d0b
pop ecx
pop ecx
push dword [ebp - 0x138]
lea ecx, [ebp - 0x34c]
call fcn.10011cc6
push eax
lea ecx, [ebp - 0x36c]
call fcn.100228b9
test eax, eax
jbe 0x1003a146
push dword [ebp - 0x138]
lea ecx, [ebp - 0x34c]
call fcn.10011cc6
push eax
lea ecx, [ebp - 0x36c]
call fcn.1004879a
jmp 0x1003a0cf
lea ecx, [ebp - 0x89c]
call fcn.10022886
mov byte [ebp - 4], 8
and dword [ebp - 0x8c], 0
jmp 0x1003a16d
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x178]
jge 0x1003a248
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x34c]
call fcn.10011cc6
push eax
lea ecx, [ebp - 0x89c]
call fcn.100228b9
test eax, eax
ja 0x1003a1d1
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x34c]
call fcn.10011cc6
cmp dword [eax], 0
jle 0x1003a1d1
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x34c]
call fcn.10011cc6
mov eax, dword [eax]
cmp eax, dword [ebp - 0x178]
jle 0x1003a21f
lea eax, [ebp - 0xc98]
push eax
lea ecx, [ebp - 0x36c]
call fcn.100230d7
mov ecx, eax
call fcn.1004882e
mov eax, dword [eax]
mov dword [ebp - 0x5c4], eax
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x34c]
call fcn.10011cc6
mov ecx, dword [ebp - 0x5c4]
mov dword [eax], ecx
lea eax, [ebp - 0x5c4]
push eax
lea ecx, [ebp - 0x36c]
call fcn.1004879a
jmp 0x1003a243
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x34c]
call fcn.10011cc6
push eax
lea eax, [ebp - 0xdc4]
push eax
lea ecx, [ebp - 0x89c]
call fcn.1002289b
jmp 0x1003a160
and dword [ebp - 0x274], 0
jmp 0x1003a25e
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x274]
cmp eax, dword [ebp - 0x178]
jge 0x1003a28d
push dword [ebp - 0x274]
lea ecx, [ebp - 0x34c]
call fcn.10011cc6
push dword [eax]
push 0x1000b334
call fcn.10050f3f
pop ecx
pop ecx
jmp 0x1003a251
push 0x1000b135
call fcn.100510f6
pop ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x89c]
call fcn.1001ddd9
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x36c]
call fcn.1001ddd9
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x34c]
call fcn.10011cc1
mov dword [ebp - 0x20c], 0xffffffea
jmp 0x1003a2de
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xfffffff1
je 0x1003a333
mov dword [ebp - 0x254], 0x2ee6d058
mov dword [ebp - 0x254], 0
jmp 0x1003a30a
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 3
jg 0x1003a331
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0xaf4]
mov dword [ebp + ecx*4 - 0xaf4], eax
cmp dword [ebp - 0x64], 0
je 0x1003a32f
jmp 0x1003a331
jmp 0x1003a2fd
jmp 0x1003a2d1
jmp 0x10039ff8
mov dword [ebp - 0x6bc], 0x9080254f
mov dword [ebp - 0x90], 0x571177e8
mov dword [ebp - 0x5ec], 0xffff
mov dword [ebp - 0x214], 0x4b664fb7
mov dword [ebp - 0x69c], 0xcfb6
mov dword [ebp - 0x2c0], 6
mov dword [ebp - 0x45c], 0xfffffffe
mov dword [ebp - 0xb04], 0xffffffff
mov dword [ebp - 0xb00], 0xffffffff
mov dword [ebp - 0xafc], 0xffffffff
mov dword [ebp - 0xaf8], 0xffffffff
mov dword [ebp - 0x324], 0x65d3
mov dword [ebp - 0x30c], 0xfffffffb
mov dword [ebp - 0x5fc], 0x12c2192b
mov dword [ebp - 0x960], 0xffffffff
mov dword [ebp - 0x90], 0
jmp 0x1003a3e7
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xfffffff3
jg 0x1003a843
mov dword [ebp - 0xe0], 7
mov dword [ebp - 0x9c], 1
mov dword [ebp - 0x44c], 1
mov dword [ebp - 0x48c], 0x344ffa2b
mov dword [ebp - 0x6ac], 0x85a0ff81
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0xd3c], eax
cmp dword [ebp - 0x90], 0
jne 0x1003a44d
cmp dword [ebp - 0xe0], 0
jne 0x1003a44d
and dword [ebp - 0x42c], 0
jmp 0x1003a457
mov dword [ebp - 0x42c], 1
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x42c], eax
jle 0x1003a471
mov dword [ebp - 0x694], 1
jmp 0x1003a478
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x694], eax
jle 0x1003a492
mov dword [ebp - 0x434], 1
jmp 0x1003a499
and dword [ebp - 0x434], 0
cmp dword [ebp - 0x434], 0xc5c9
jl 0x1003a4b1
mov dword [ebp - 0x5cc], 1
jmp 0x1003a4b8
and dword [ebp - 0x5cc], 0
cmp dword [ebp - 0x5cc], 0xfffffffb
jge 0x1003a4cd
mov dword [ebp - 0x43c], 1
jmp 0x1003a4d4
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x1003a4fb
cmp dword [ebp - 0x214], 0
jne 0x1003a4fb
and dword [ebp - 0x6fc], 0
jmp 0x1003a505
mov dword [ebp - 0x6fc], 1
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x6fc], eax
jg 0x1003a51f
mov dword [ebp - 0x444], 1
jmp 0x1003a526
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x69c]
cmp dword [ebp - 0x444], eax
jl 0x1003a540
mov dword [ebp - 0x5d4], 1
jmp 0x1003a547
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x44c]
imul eax, dword [ebp - 0xe0]
cmp eax, 0xf283019c
jae 0x1003a573
mov dword [ebp - 0x7b4], 1
jmp 0x1003a57a
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0xca0], eax
cmp dword [ebp - 0x9c], 0x718302cc
je 0x1003a59e
mov dword [ebp - 0x454], 1
jmp 0x1003a5a5
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x69c]
cmp dword [ebp - 0x454], eax
jg 0x1003a5bf
mov dword [ebp - 0x5dc], 1
jmp 0x1003a5c6
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 0
je 0x1003a5f0
cmp dword [ebp - 0xe0], 0
je 0x1003a5f0
mov dword [ebp - 0x734], 1
jmp 0x1003a5f7
and dword [ebp - 0x734], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x734]
mov dword [ebp + eax - 0xb04], ecx
xor eax, eax
inc eax
cmp eax, 0x85c
jne 0x1003a620
mov dword [ebp - 0x464], 1
jmp 0x1003a627
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x464], eax
jle 0x1003a641
mov dword [ebp - 0x5e4], 1
jmp 0x1003a648
and dword [ebp - 0x5e4], 0
cmp dword [ebp - 0x5e4], 0xb6976892
jb 0x1003a660
mov dword [ebp - 0x46c], 1
jmp 0x1003a667
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x46c], eax
jg 0x1003a681
mov dword [ebp - 0x6a4], 1
jmp 0x1003a688
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x2c0]
cmp dword [ebp - 0x6a4], eax
jne 0x1003a6a2
mov dword [ebp - 0x474], 1
jmp 0x1003a6a9
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x474], eax
jne 0x1003a6c9
cmp dword [ebp - 0x9c], 0
jne 0x1003a6c9
and dword [ebp - 0x8d0], 0
jmp 0x1003a6d3
mov dword [ebp - 0x8d0], 1
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0xcb4], eax
mov eax, dword [ebp - 0xe0]
add eax, dword [ebp - 0x324]
jne 0x1003a6ff
cmp dword [ebp - 0x9c], 0
jne 0x1003a6ff
and dword [ebp - 0x47c], 0
jmp 0x1003a709
mov dword [ebp - 0x47c], 1
mov eax, dword [ebp - 0x5ec]
cmp dword [ebp - 0x47c], eax
jg 0x1003a723
mov dword [ebp - 0x704], 1
jmp 0x1003a72a
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xcbc], eax
mov eax, dword [ebp - 0x704]
dec eax
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0xd84], eax
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x214], eax
jge 0x1003a769
mov dword [ebp - 0x484], 1
jmp 0x1003a770
and dword [ebp - 0x484], 0
cmp dword [ebp - 0x484], 0x3d7e6de1
jge 0x1003a788
mov dword [ebp - 0x7bc], 1
jmp 0x1003a78f
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0xbf4], eax
mov eax, dword [ebp - 0x2c0]
cmp dword [ebp - 0xe0], eax
jl 0x1003a7b5
mov dword [ebp - 0x5f4], 1
jmp 0x1003a7bc
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x6ac], eax
mov eax, dword [ebp - 0x6ac]
imul eax, dword [ebp - 0x90]
test eax, eax
je 0x1003a7fa
cmp dword [ebp - 0x30c], 0
je 0x1003a7fa
mov dword [ebp - 0x494], 1
jmp 0x1003a801
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x5fc], eax
mov eax, dword [ebp - 0x5fc]
imul eax, dword [ebp - 0xe0]
cmp eax, 1
jne 0x1003a82b
mov dword [ebp - 0x49c], 1
jmp 0x1003a832
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0x960], eax
jmp 0x1003a3da
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x1003a86d
push 0
push 1
push 1
push 0x791c
push 0xf58
call fcn.1002f18e
add esp, 0x14
mov dword [ebp - 0xf0], 0
jmp 0x1003a886
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 2
jg 0x1003b065
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0x7d4], 0xffffffff
mov dword [ebp - 0x20], 0
jmp 0x1003a8be
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1003ab0b
push 2
lea ecx, [ebp - 0x77c]
call fcn.10011c5f
mov byte [ebp - 4], 9
mov dword [ebp - 0x7c4], 0xf2e96673
mov dword [ebp - 0x84], 0
jmp 0x1003a8fc
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x1003a91e
push dword [ebp - 0x84]
lea ecx, [ebp - 0x77c]
call fcn.10011cc6
mov dword [eax], 0x75286e87
jmp 0x1003a8ef
mov dword [ebp - 0x84], 0
jmp 0x1003a937
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1003a953
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x7cc], 0x9785734c
jmp 0x1003a92a
push 0
lea ecx, [ebp - 0x77c]
call fcn.10011cc6
mov dword [eax], 0xfffffff9
jmp 0x1003a98c
push 0
lea ecx, [ebp - 0x77c]
call fcn.10011cc6
mov dword [ebp - 0x714], eax
mov eax, dword [ebp - 0x714]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x714]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x77c]
call fcn.10011cc6
cmp dword [eax], 0xfffffff3
je 0x1003aaf7
mov dword [ebp - 0x2c8], 0xb919
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x7c4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xbfc], eax
cmp dword [ebp - 0x20], 0
je 0x1003aa03
mov eax, dword [ebp - 0x2c8]
cmp dword [ebp - 0x20], eax
jle 0x1003a9db
mov dword [ebp - 0x4a4], 1
jmp 0x1003a9e2
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
je 0x1003aa03
mov dword [ebp - 0x604], 1
jmp 0x1003aa0a
and dword [ebp - 0x604], 0
cmp dword [ebp - 0x604], 0x88b92280
jbe 0x1003aa28
cmp dword [ebp - 0x2c8], 0
jne 0x1003aa28
and dword [ebp - 0x4ac], 0
jmp 0x1003aa32
mov dword [ebp - 0x4ac], 1
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x4ac], eax
jg 0x1003aa49
mov dword [ebp - 0x8d8], 1
jmp 0x1003aa50
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc04], eax
cmp dword [ebp - 0x20], 0x78c9dffb
jge 0x1003aa6e
mov dword [ebp - 0x6b4], 1
jmp 0x1003aa75
and dword [ebp - 0x6b4], 0
push 1
lea ecx, [ebp - 0x77c]
call fcn.10011cc6
mov ecx, dword [ebp - 0x6b4]
cmp ecx, dword [eax]
je 0x1003aa98
mov dword [ebp - 0x4b4], 1
jmp 0x1003aa9f
and dword [ebp - 0x4b4], 0
cmp dword [ebp - 0x4b4], 0xe0cd
je 0x1003aab7
mov dword [ebp - 0x60c], 1
jmp 0x1003aabe
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x2c8]
cmp dword [ebp - 0x60c], eax
jne 0x1003aad8
mov dword [ebp - 0x4bc], 1
jmp 0x1003aadf
and dword [ebp - 0x4bc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4bc]
mov dword [ebp + eax - 0x7cc], ecx
jmp 0x1003a968
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x77c]
call fcn.10011cc1
jmp 0x1003a8b7
xor eax, eax
jne 0x1003ab81
cmp dword [ebp - 0x20], 0
je 0x1003ab35
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x20], eax
je 0x1003ab35
mov dword [ebp - 0x928], 1
jmp 0x1003ab3c
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xc0c], eax
cmp dword [ebp - 0x7d4], 0
je 0x1003ab63
cmp dword [ebp - 0x20], 0
je 0x1003ab63
mov dword [ebp - 0x710], 1
jmp 0x1003ab6a
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x710], eax
je 0x1003ab81
and dword [ebp - 0x4c4], 0
jmp 0x1003ab8b
mov dword [ebp - 0x4c4], 1
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x10], 0
jmp 0x1003aba7
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x1003aef7
push 2
lea ecx, [ebp - 0xa08]
call fcn.10011c5f
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x140], 0xfffffff7
lea eax, [ebp - 0xc14]
push eax
push 0x7c28
push 0
push 0
push 0x24e1
push 0x36a8
push 0x48b4
lea eax, [ebp - 0xa08]
push eax
push 0x633d
push 0x3ea6
push 0x77e8
push 0x4a6b
push 0x2b4c
push 0x144f
call fcn.100324c6
add esp, 0x38
mov dword [ebp - 0x140], 1
jmp 0x1003ac31
mov eax, dword [ebp - 0x140]
dec eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jl 0x1003aecc
mov dword [ebp - 0x1cc], 0x5c62e089
push 0x6d9a
lea eax, [ebp - 0xa08]
push eax
push 0
push 1
push 0x589e
push 0x13ed
push 0x1de1
push 0x328
push 0x6046
push 0x6efc
push 0x7ab2
push 0x7dcc
lea eax, [ebp - 0x1cc]
push eax
push 0x29c4
call fcn.100324c6
add esp, 0x38
mov dword [ebp - 0x1cc], 0
jmp 0x1003acad
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 1
jg 0x1003aec7
push 1
lea ecx, [ebp - 0x97c]
call fcn.10011c5f
mov byte [ebp - 4], 0xb
push 1
lea ecx, [ebp - 0x96c]
call fcn.10011c5f
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x6c], 0
jmp 0x1003acec
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1003ad05
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x97c]
call fcn.10011cc6
or dword [eax], 0xffffffff
jmp 0x1003ace5
mov dword [ebp - 0x6c], 0
jmp 0x1003ad15
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1003ad31
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x96c]
call fcn.10011cc6
mov dword [eax], 1
jmp 0x1003ad0e
push 0
lea ecx, [ebp - 0x97c]
call fcn.10011cc6
and dword [eax], 0
jmp 0x1003ad67
push 0
lea ecx, [ebp - 0x97c]
call fcn.10011cc6
mov dword [ebp - 0x614], eax
mov eax, dword [ebp - 0x614]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x614]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x97c]
call fcn.10011cc6
cmp dword [eax], 1
jg 0x1003ae06
mov dword [ebp - 0x294], 1
mov byte [ebp - 0xe1], 0
push 0
lea eax, [ebp - 0xe1]
push eax
push 0x7b3e
call fcn.10041fce
add esp, 0xc
mov dword [ebp - 0x294], 0
jmp 0x1003adbd
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 1
jg 0x1003ae01
push 0x6fa3
push 0x4fcb
push 0xcd
push 0xd53
push 0x3fe7
push 1
push 0x37da
push 0x19eb
push 0
push 0x5fcc
push 0x3408
call fcn.100318ad
add esp, 0x2c
jmp 0x1003adb0
jmp 0x1003ad43
push 0
lea ecx, [ebp - 0x96c]
call fcn.10011cc6
mov dword [eax], 1
jmp 0x1003ae3f
push 0
lea ecx, [ebp - 0x96c]
call fcn.10011cc6
mov dword [ebp - 0x4cc], eax
mov eax, dword [ebp - 0x4cc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x4cc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x96c]
call fcn.10011cc6
cmp dword [eax], 0
jl 0x1003aea4
mov byte [ebp - 0x115], 0
push 0
lea eax, [ebp - 0x115]
push eax
push 0x516f
push 0x6820
push 0x66ee
push 0x35d9
push 0x301f
push 0
call fcn.1003622a
add esp, 0x20
push dword [ebp - 0x140]
lea ecx, [ebp - 0xa08]
call fcn.10011cc6
cmp dword [eax], 0
je 0x1003ae9f
jmp 0x1003ae1b
jmp 0x1003ae1b
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x96c]
call fcn.10011cc1
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x97c]
call fcn.10011cc1
jmp 0x1003aca0
jmp 0x1003ac24
mov dword [ebp - 0x140], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa08]
call fcn.10011cc1
mov eax, dword [ebp - 0x6bc]
inc eax
mov dword [ebp - 0x6bc], eax
jmp 0x1003aba0
mov dword [ebp - 0x98], 0x1f7e2799
mov dword [ebp - 0x98], 0
jmp 0x1003af1a
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x16
jg 0x1003b048
mov dword [ebp - 0x61c], 0x33e34b64
mov dword [ebp - 0x8e0], 0xfffffff8
mov dword [ebp - 0x21c], 0
jmp 0x1003af54
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 2
jge 0x1003af70
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0x70c], 0x6a162c9c
jmp 0x1003af47
cmp dword [ebp - 0x98], 0
je 0x1003af7e
jmp 0x1003b048
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x98]
cmp dword [ebp + eax - 0x70c], ecx
jge 0x1003af9f
mov dword [ebp - 0x4d4], 1
jmp 0x1003afa6
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x61c], eax
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0xc1c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x70c]
mov dword [ebp - 0xc24], eax
mov eax, dword [ebp - 0x98]
sub eax, dword [ebp - 0x98]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x70c]
jge 0x1003aff8
mov dword [ebp - 0x4dc], 1
jmp 0x1003afff
and dword [ebp - 0x4dc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x70c]
cmp eax, dword [ebp - 0x4dc]
jge 0x1003b02d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x70c], 0
jne 0x1003b02d
and dword [ebp - 0x718], 0
jmp 0x1003b037
mov dword [ebp - 0x718], 1
mov eax, dword [ebp - 0x718]
mov dword [ebp - 0x8e0], eax
jmp 0x1003af0d
push dword [ebp - 0xf0]
lea ecx, [ebp - 0x9f0]
call fcn.10011cc6
cmp dword [eax], 0
je 0x1003b060
jmp 0x1003b065
jmp 0x1003a879
push 2
lea ecx, [ebp - 0x130]
call fcn.10011c5f
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x50], 0xa885c82f
mov dword [ebp - 0x160], 0xfffffff7
mov dword [ebp - 0x310], 0x6bbbd28a
mov dword [ebp - 0xb0], 0x5f459ca
push 0x74bc
push 0
push 0x2cd9
push 0x7b3
push 0x7ef3
push 0x4dd0
push 1
lea eax, [ebp - 0xc2c]
push eax
push 0x1804
lea eax, [ebp - 0x130]
push eax
push 0
push 0x173a
push 0x3be5
push 0x2fa6
call fcn.10035422
add esp, 0x38
push 0
lea ecx, [ebp - 0x130]
call fcn.10011cc6
cmp dword [eax], 0
je 0x1003b218
mov eax, 0x637c1d6b
test eax, eax
je 0x1003b1f7
push 0
lea ecx, [ebp - 0x130]
call fcn.10011cc6
push 1
lea ecx, [ebp - 0x130]
call fcn.10011cc6
cmp dword [eax], 0xc0d1
jg 0x1003b135
mov dword [ebp - 0x7dc], 1
jmp 0x1003b13c
and dword [ebp - 0x7dc], 0
push 0
lea ecx, [ebp - 0x130]
call fcn.10011cc6
push 0
lea ecx, [ebp - 0x130]
call fcn.10011cc6
cmp dword [eax], 0
je 0x1003b179
push 0
lea ecx, [ebp - 0x130]
call fcn.10011cc6
cmp dword [eax], 0
je 0x1003b179
mov dword [ebp - 0x4e4], 1
jmp 0x1003b180
and dword [ebp - 0x4e4], 0
push 1
lea ecx, [ebp - 0x130]
call fcn.10011cc6
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [eax]
jle 0x1003b1a3
mov dword [ebp - 0x624], 1
jmp 0x1003b1aa
and dword [ebp - 0x624], 0
push 0
lea ecx, [ebp - 0x130]
call fcn.10011cc6
mov ecx, dword [ebp - 0x624]
cmp ecx, dword [eax]
jl 0x1003b1cd
mov dword [ebp - 0x4ec], 1
jmp 0x1003b1d4
and dword [ebp - 0x4ec], 0
push 0
lea ecx, [ebp - 0x130]
call fcn.10011cc6
mov ecx, dword [ebp - 0x4ec]
cmp ecx, dword [eax]
jle 0x1003b1f7
mov dword [ebp - 0x950], 1
jmp 0x1003b1fe
and dword [ebp - 0x950], 0
push 0
lea ecx, [ebp - 0x130]
call fcn.10011cc6
push 1
lea ecx, [ebp - 0x130]
call fcn.10011cc6
push 0
lea ecx, [ebp - 0x130]
call fcn.10011cc6
mov esi, 0x50cfdfe9
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x130]
call fcn.10011cc6
cmp esi, dword [eax]
jl 0x1003b249
mov dword [ebp - 0x6c4], 1
jmp 0x1003b250
and dword [ebp - 0x6c4], 0
cmp dword [ebp - 0x6c4], 0xfffffffd
jne 0x1003b265
mov dword [ebp - 0x7e4], 1
jmp 0x1003b26c
and dword [ebp - 0x7e4], 0
push 1
lea ecx, [ebp - 0x130]
call fcn.10011cc6
xor eax, eax
inc eax
imul eax, eax, 0xbee6
test eax, eax
jne 0x1003b292
mov dword [ebp - 0x4f4], 1
jmp 0x1003b299
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x160], eax
push 0
lea ecx, [ebp - 0x130]
call fcn.10011cc6
cmp dword [eax], 0
jne 0x1003b2c9
mov dword [ebp - 0x62c], 1
jmp 0x1003b2d0
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0x50], eax
push 0
lea ecx, [ebp - 0x130]
call fcn.10011cc6
cmp dword [eax], 0
je 0x1003b309
push 0
lea ecx, [ebp - 0x130]
call fcn.10011cc6
cmp dword [eax], 0
je 0x1003b309
mov dword [ebp - 0x4fc], 1
jmp 0x1003b310
and dword [ebp - 0x4fc], 0
cmp dword [ebp - 0x4fc], 0xfffffff9
jbe 0x1003b325
mov dword [ebp - 0x720], 1
jmp 0x1003b32c
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x720]
sub eax, dword [ebp - 0x160]
cmp eax, 5
jl 0x1003b349
mov dword [ebp - 0x504], 1
jmp 0x1003b350
and dword [ebp - 0x504], 0
imul eax, dword [ebp - 0x504], 0x31fc
test eax, eax
jbe 0x1003b36a
mov dword [ebp - 0x634], 1
jmp 0x1003b371
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x634]
sub eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x160]
jg 0x1003b391
mov dword [ebp - 0x50c], 1
jmp 0x1003b398
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x310]
cmp dword [ebp - 0x50c], eax
je 0x1003b3b2
mov dword [ebp - 0x6cc], 1
jmp 0x1003b3b9
and dword [ebp - 0x6cc], 0
push 0
lea ecx, [ebp - 0x130]
call fcn.10011cc6
mov ecx, dword [ebp - 0x6cc]
cmp ecx, dword [eax]
jg 0x1003b3dc
mov dword [ebp - 0x514], 1
jmp 0x1003b3e3
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x310]
cmp dword [ebp - 0x514], eax
jg 0x1003b3fd
mov dword [ebp - 0x63c], 1
jmp 0x1003b404
and dword [ebp - 0x63c], 0
imul eax, dword [ebp - 0x63c], 0x2e18
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 1
jbe 0x1003b429
mov dword [ebp - 0x8e8], 1
jmp 0x1003b430
and dword [ebp - 0x8e8], 0
push 1
lea ecx, [ebp - 0x130]
call fcn.10011cc6
xor eax, eax
cmp eax, 1
jb 0x1003b450
mov dword [ebp - 0x51c], 1
jmp 0x1003b457
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
sub eax, dword [ebp - 0x310]
cmp eax, 0x7b09
jge 0x1003b524
mov dword [ebp - 0x7ec], 0x91cd
mov dword [ebp - 0xb0], 1
jmp 0x1003b49d
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jl 0x1003b522
mov dword [ebp - 0x50], 1
jmp 0x1003b4b6
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x1003b51d
mov byte [ebp - 0xe9], 0
lea eax, [ebp - 0xe9]
push eax
push 0
push 0x1e6c
push 0x1100
push 1
push 0x4a54
call fcn.10031008
add esp, 0x18
lea eax, [ebp - 0x50]
push eax
push 0x492a
push 0x7cfc
push 1
push 0x4479
lea eax, [ebp - 0x7ec]
push eax
push 0
lea eax, [ebp - 0x130]
push eax
push 1
lea eax, [ebp - 0xb0]
push eax
call fcn.100359ba
add esp, 0x28
jmp 0x1003b4af
jmp 0x1003b490
jmp 0x1003b570
push 2
lea ecx, [ebp - 0xa78]
call fcn.10011c5f
mov byte [ebp - 4], 0xe
push 0
push 1
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0xa78]
push eax
call fcn.10031cd9
add esp, 0x10
push 1
lea ecx, [ebp - 0xa78]
call fcn.10011cc6
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xa78]
call fcn.10011cc1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x130]
call fcn.10011cc1
mov dword [ebp - 0x58], 0xb0f73838
mov dword [ebp - 0x25c], 0
jmp 0x1003b59f
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 1
jge 0x1003b5bb
mov eax, dword [ebp - 0x25c]
mov dword [ebp + eax*4 - 0x930], 0xffffffff
jmp 0x1003b592
mov dword [ebp - 0x58], 0
jmp 0x1003b5cb
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1003b5e1
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x930], 0xf94964a5
jmp 0x1003b5c4
mov dword [ebp - 0x58], 0
jmp 0x1003b5f1
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x1003b607
push 0
push 0x7837
call fcn.100400fe
pop ecx
pop ecx
jmp 0x1003b5ea
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x1003b7f3
mov dword [ebp - 0x224], 0
jmp 0x1003b636
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 3
jge 0x1003b652
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0xe4c], 0xa8c6a53d
jmp 0x1003b629
mov byte [ebp - 0xfb], 0
mov dword [ebp - 0x7f4], 0x1de9
cmp dword [ebp - 0x7f4], 0xf0f
jge 0x1003b78f
mov dword [ebp - 0xc3c], 0xd2
and dword [ebp - 0x27c], 0
lea eax, [ebp - 0x27c]
push eax
push 0x1000b1cc
call fcn.10050d0b
pop ecx
pop ecx
cmp dword [ebp - 0x27c], 3
jge 0x1003b6b0
push 0x1000b320
call fcn.100510f6
pop ecx
jmp 0x1003b78f
cmp dword [ebp - 0x27c], 3
jne 0x1003b6cf
push 0xd2
push 0x1000b324
call fcn.10050f3f
pop ecx
pop ecx
jmp 0x1003b78f
push 0x1000b4ac
call fcn.10050f3f
pop ecx
mov eax, dword [ebp - 0x27c]
dec eax
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x194], 0x94
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x8f0], eax
mov eax, dword [ebp - 0x2d0]
dec eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x8f0], 3
jle 0x1003b741
imul eax, dword [ebp - 0x194], 0xa
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
cdq
mov ecx, 0xd2
idiv ecx
mov dword [ebp - 0x194], edx
push 0x1000b4bc
call fcn.10050f3f
pop ecx
jmp 0x1003b6f1
mov eax, 0xd2
sub eax, dword [ebp - 0x194]
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0x94
jge 0x1003b769
push 0x1000b4bc
call fcn.10050f3f
pop ecx
cmp dword [ebp - 0x330], 0xa
jge 0x1003b77d
push 0x1000b4bc
call fcn.10050f3f
pop ecx
push dword [ebp - 0x330]
push 0x1000b324
call fcn.10050f3f
pop ecx
pop ecx
push 0
push 0x3560
lea eax, [ebp - 0xfb]
push eax
push 0x771
push 0
push 0x6d1
push 0x9c
push 0x7bf8
push 0x4727
call fcn.1003574b
add esp, 0x24
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x1003b7ed
push 1
push 0x17fd
push 0
push 0x2854
push 0x5fcf
call fcn.1002fb34
add esp, 0x14
call dword [sym.imp.USER32.dll_EndMenu]
jmp 0x1003c3e7
push 3
lea ecx, [ebp - 0xa84]
call fcn.10011c5f
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x2d8], 0xffffffff
mov dword [ebp - 0x53c], 0x80095520
mov dword [ebp - 0x318], 0xfffffff9
push 0x5d0a
push 0x2d21
push 0x221f
lea eax, [ebp - 0x1b4]
push eax
lea eax, [ebp - 0xa84]
push eax
push 0x108f
push 0
push 0x16aa
push 0x5d6
push 1
push 0x70b4
push 1
call fcn.10035012
add esp, 0x30
mov dword [ebp - 0x1b4], 0
jmp 0x1003b87f
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jge 0x1003b89b
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x1d8], 0xffffffff
jmp 0x1003b872
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1d8], 0
jmp 0x1003b8c9
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d8]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1d8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1d8], 2
jg 0x1003bb39
mov dword [ebp - 0xa0], 0x7fa5c62e
mov dword [ebp - 0xa0], 0
jmp 0x1003b900
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jg 0x1003bb26
mov dword [ebp - 0x19c], 1
mov dword [ebp - 0x980], 0x6d9e96b
mov dword [ebp - 0x19c], 2
jmp 0x1003b93a
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jl 0x1003baf9
mov dword [ebp - 0x6d4], 1
mov dword [ebp - 0x7fc], 0x169c1477
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1d8], 0
je 0x1003b970
jmp 0x1003baf9
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d8]
mov dword [ebp - 0xc44], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d8]
mov dword [ebp - 0xc4c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d8]
mov dword [ebp - 0xc54], eax
mov eax, dword [ebp - 0xa0]
sub eax, dword [ebp - 0x19c]
jne 0x1003b9c9
mov eax, 0x8633
test eax, eax
jne 0x1003b9c9
and dword [ebp - 0x71c], 0
jmp 0x1003b9d3
mov dword [ebp - 0x71c], 1
mov eax, dword [ebp - 0x71c]
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 1
jne 0x1003b9f4
mov dword [ebp - 0x524], 1
jmp 0x1003b9fb
and dword [ebp - 0x524], 0
imul eax, dword [ebp - 0x524], 0x64d0
test eax, eax
je 0x1003ba1e
cmp dword [ebp - 0x6d4], 0
je 0x1003ba1e
mov dword [ebp - 0x644], 1
jmp 0x1003ba25
and dword [ebp - 0x644], 0
cmp dword [ebp - 0x644], 0xa60813c2
jb 0x1003ba3d
mov dword [ebp - 0x52c], 1
jmp 0x1003ba44
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x52c]
sub eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x6d4]
jge 0x1003ba64
mov dword [ebp - 0x534], 1
jmp 0x1003ba6b
and dword [ebp - 0x534], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1d8]
cmp eax, dword [ebp - 0x534]
jne 0x1003ba8c
mov dword [ebp - 0x64c], 1
jmp 0x1003ba93
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 0xfffffffc
jne 0x1003baaf
cmp dword [ebp - 0xa0], 0
push dword [ebp - 0xa0]
lea ecx, [ebp - 0xa84]
call fcn.10011cc6
mov dword [eax], 5
cmp dword [ebp - 0x7fc], 5
je 0x1003badb
mov dword [ebp - 0x73c], 1
jmp 0x1003bae2
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x73c]
sub eax, dword [ebp - 0x980]
mov dword [ebp - 0x318], eax
jmp 0x1003b92d
mov byte [ebp - 0xf3], 0
movzx eax, byte [ebp - 0xf3]
test eax, eax
je 0x1003bb21
push 0xf0e
push 0x5f74
push 0
push 0
call fcn.10043010
add esp, 0x10
jmp 0x1003b8f3
cmp dword [ebp - 0x2d8], 0
je 0x1003bb34
jmp 0x1003b8ae
jmp 0x1003b8ae
cmp dword [ebp - 0x318], 0
je 0x1003bb76
cmp dword [ebp - 0x318], 0xff74f57b
jbe 0x1003bb5a
mov dword [ebp - 0x544], 1
jmp 0x1003bb61
and dword [ebp - 0x544], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x544]
mov dword [ebp + eax - 0x1d8], ecx
jmp 0x1003bbc5
mov byte [ebp - 0xfd], 0
push 0
push 0x2c7
push 1
push 1
push 0x1e96
lea eax, [ebp - 0xfd]
push eax
push 0x54d8
push 0x3aab
push 0x65f8
call fcn.10038ab3
add esp, 0x24
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1003bbc5
push 0
call fcn.100414a2
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa84]
call fcn.10011cc1
mov dword [ebp - 0x180], 0xb9f9b31
mov dword [ebp - 0x180], 0
jmp 0x1003bbf7
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0xffffffea
jge 0x1003bc30
mov dword [ebp - 0x804], 0xc6f1bf50
lea eax, [ebp - 0x804]
push eax
push 0x5e27
push 1
push 1
lea eax, [ebp - 0x180]
push eax
push 0x6e47
call fcn.1002f080
add esp, 0x18
jmp 0x1003bbea
mov byte [ebp - 0x11d], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x264], 0xffffffff
mov dword [ebp - 0x938], 0xe9069002
mov dword [ebp - 0x60], 0
jmp 0x1003bc69
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x1003bc7f
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x148], 1
jmp 0x1003bc62
mov dword [ebp - 0x60], 0
jmp 0x1003bc8f
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1003bca5
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0xcac], 6
jmp 0x1003bc88
cmp dword [ebp - 0x3c], 0
jne 0x1003bcdc
cmp dword [ebp - 0x3c], 0
jne 0x1003bcc0
cmp dword [ebp - 0x34], 0
jne 0x1003bcc0
and dword [ebp - 0x654], 0
jmp 0x1003bcca
mov dword [ebp - 0x654], 1
mov eax, dword [ebp - 0x654]
dec eax
jne 0x1003bcdc
and dword [ebp - 0x54c], 0
jmp 0x1003bce6
mov dword [ebp - 0x54c], 1
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x3c], eax
jl 0x1003bd03
mov dword [ebp - 0x6dc], 1
jmp 0x1003bd0a
and dword [ebp - 0x6dc], 0
cmp dword [ebp - 0x6dc], 3
jne 0x1003bd1f
mov dword [ebp - 0x2e0], 1
jmp 0x1003bd26
and dword [ebp - 0x2e0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2e0]
mov dword [ebp + eax - 0x148], ecx
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x2e0], eax
jle 0x1003bd50
mov dword [ebp - 0x8f8], 1
jmp 0x1003bd57
and dword [ebp - 0x8f8], 0
mov eax, 0xf144
cmp eax, 4
je 0x1003bd6d
mov dword [ebp - 0x554], 1
jmp 0x1003bd74
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x554]
neg eax
jne 0x1003bd90
mov eax, 0xd133
test eax, eax
jne 0x1003bd90
and dword [ebp - 0x65c], 0
jmp 0x1003bd9a
mov dword [ebp - 0x65c], 1
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x65c], eax
jg 0x1003bdb1
mov dword [ebp - 0x55c], 1
jmp 0x1003bdb8
and dword [ebp - 0x55c], 0
cmp dword [ebp - 0x55c], 1
jg 0x1003bddd
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x148], 0
je 0x1003bddd
mov dword [ebp - 0x724], 1
jmp 0x1003bde4
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x724], eax
jl 0x1003bdfb
mov dword [ebp - 0x564], 1
jmp 0x1003be02
and dword [ebp - 0x564], 0
cmp dword [ebp - 0x564], 0xffffffff
je 0x1003be17
mov dword [ebp - 0x664], 1
jmp 0x1003be1e
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0x264], eax
mov dword [ebp - 0x3c], 0xb
jmp 0x1003be3a
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x15
jne 0x1003c0ab
mov dword [ebp - 0x1c4], 0x976d9935
mov dword [ebp - 0x2e8], 1
mov dword [ebp - 0x22c], 0
jmp 0x1003be71
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 1
jge 0x1003be8d
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0x398], 0xf236bbbd
jmp 0x1003be64
mov dword [ebp - 0x34], 0
jmp 0x1003be9d
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1003beb4
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x148], 0
je 0x1003beb2
jmp 0x1003beb4
jmp 0x1003be96
cmp dword [ebp - 0x1c4], 0
jne 0x1003bec4
cmp dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0xc5c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x148]
cmp dword [ebp - 0x34], eax
jge 0x1003beee
mov dword [ebp - 0x56c], 1
jmp 0x1003bef5
and dword [ebp - 0x56c], 0
imul eax, dword [ebp - 0x56c], 0xffff
cmp eax, 0xffffffff
jle 0x1003bf10
mov dword [ebp - 0x6e4], 1
jmp 0x1003bf17
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x264]
cmp eax, dword [ebp - 0x6e4]
jle 0x1003bf31
mov dword [ebp - 0x80c], 1
jmp 0x1003bf38
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x938]
mov dword [ebp - 0xc64], eax
cmp dword [ebp - 0x1c4], 0
jne 0x1003bf66
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x148], 0
jne 0x1003bf66
and dword [ebp - 0x574], 0
jmp 0x1003bf70
mov dword [ebp - 0x574], 1
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x574], eax
jg 0x1003bf91
push 3
pop eax
test eax, eax
je 0x1003bf91
mov dword [ebp - 0x66c], 1
jmp 0x1003bf98
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x264]
cmp dword [ebp - 0x66c], eax
jne 0x1003bfb2
mov dword [ebp - 0x328], 1
jmp 0x1003bfb9
and dword [ebp - 0x328], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x328]
mov dword [ebp + eax - 0x398], ecx
mov eax, dword [ebp - 0x264]
cmp dword [ebp - 0x328], eax
jge 0x1003bfe6
mov dword [ebp - 0x57c], 1
jmp 0x1003bfed
and dword [ebp - 0x57c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x57c]
sub ecx, dword [ebp + eax - 0x148]
je 0x1003c01e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x398], 0
je 0x1003c01e
mov dword [ebp - 0x3a0], 1
jmp 0x1003c025
and dword [ebp - 0x3a0], 0
cmp dword [ebp - 0x3a0], 0xe6f9
jge 0x1003c03d
mov dword [ebp - 0x3a8], 1
jmp 0x1003c044
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 1
jg 0x1003c065
mov dword [ebp - 0x3b0], 1
jmp 0x1003c06c
and dword [ebp - 0x3b0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3b0]
sub ecx, dword [ebp + eax - 0xcac]
imul ecx, dword [ebp - 0x1c4]
test ecx, ecx
je 0x1003c096
mov dword [ebp - 0x3b8], 1
jmp 0x1003c09d
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x34], eax
jmp 0x1003be33
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x1003c3e7
push 1
lea ecx, [ebp - 0xacc]
call fcn.10011c5f
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x1bc], 0x53d8da8e
push 1
push 0
push 0x7d4c
push 0
push 0x3f79
push 0x6f7
lea eax, [ebp - 0xc6c]
push eax
lea eax, [ebp - 0xacc]
push eax
call fcn.1002fe48
add esp, 0x20
mov dword [ebp - 0x814], 0x16c5
cmp dword [ebp - 0x814], 0x9ee
jge 0x1003c2f3
mov edx, 0x11e51e30
mov ecx, 0x1065b310
call fcn.10016235
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebp - 0x3c0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3c0]
add ecx, dword [eax + 4]
call fcn.1001783a
movzx eax, al
test eax, eax
je 0x1003c2f3
mov edx, 0x1000b4c0
mov ecx, 0x11e51e30
call fcn.10048d66
movzx eax, al
test eax, eax
je 0x1003c2f3
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x28c], eax
and dword [ebp - 0xb4], 0
jmp 0x1003c1ab
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
mov ecx, 0x11e51e30
call fcn.10011c58
cmp dword [ebp - 0xb4], eax
jge 0x1003c25a
push dword [ebp - 0xb4]
mov ecx, 0x11e51e30
call fcn.10013a22
movsx eax, byte [eax]
cmp eax, 0x59
jne 0x1003c1e6
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
push dword [ebp - 0xb4]
mov ecx, 0x11e51e30
call fcn.10013a22
movsx eax, byte [eax]
cmp eax, 0x4e
jne 0x1003c20b
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
push dword [ebp - 0xb4]
mov ecx, 0x11e51e30
call fcn.10013a22
movsx eax, byte [eax]
cmp eax, 0x50
jne 0x1003c230
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
push dword [ebp - 0xb4]
mov ecx, 0x11e51e30
call fcn.10013a22
movsx eax, byte [eax]
cmp eax, 0x41
jne 0x1003c255
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
jmp 0x1003c19e
mov ecx, 0x11e51e30
call fcn.10011c58
xor edx, edx
push 2
pop ecx
div ecx
cmp edx, 1
jne 0x1003c27c
mov dword [ebp - 0x3c8], 1
jmp 0x1003c283
and dword [ebp - 0x3c8], 0
mov ecx, 0x11e51e30
call fcn.10011c58
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x3c8]
cmp dword [ebp - 0x234], eax
jl 0x1003c2ad
push 0x1000b4d4
call fcn.100510f6
pop ecx
jmp 0x1003c2ee
mov eax, dword [ebp - 0x28c]
cmp eax, dword [ebp - 0x1a4]
jle 0x1003c2c8
push 0x1000b33c
call fcn.100510f6
pop ecx
jmp 0x1003c2ee
mov eax, dword [ebp - 0x1a4]
cmp eax, dword [ebp - 0x28c]
jle 0x1003c2e3
push 0x1000b340
call fcn.100510f6
pop ecx
jmp 0x1003c2ee
push 0x1000b4e0
call fcn.100510f6
pop ecx
jmp 0x1003c11a
mov dword [ebp - 0x1bc], 0
jmp 0x1003c30c
mov eax, dword [ebp - 0x1bc]
dec eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0
jl 0x1003c360
mov dword [ebp - 0x900], 0x21f90ef3
mov dword [ebp - 0x81c], 0xffffffff
push 0x229a
lea eax, [ebp - 0x900]
push eax
push 0xbf
lea eax, [ebp - 0xacc]
push eax
push 0x4c44
lea eax, [ebp - 0x81c]
push eax
push 0
lea eax, [ebp - 0x1bc]
push eax
call fcn.100412fe
add esp, 0x20
jmp 0x1003c2ff
mov byte [ebp - 0xf7], 0
movzx eax, byte [ebp - 0xf7]
test eax, eax
je 0x1003c3d0
push 0x1512
push 0x4d82
push 0x5f70
push 0
push 0x5d98
push 0x4187
push 0x75c6
push 0x4d39
push 0x218a
push 0x3247
push 0x1aa0
push 0x3a79
push 1
push 0x7355
push 0x607a
push 0x4b80
push 0x421d
push 0x4c2
push 0
call fcn.10035e43
add esp, 0x4c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xacc]
call fcn.10011cc1
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
mov dword [ebp - 0x14], 0xbea12209
mov dword [ebp - 0x2f0], 0x8393131e
mov dword [ebp - 0x958], 0xe1f91674
mov dword [ebp - 0x824], 7
push 2
lea ecx, [ebp - 0xae4]
call fcn.10011c5f
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x4c], 0
jmp 0x1003c42d
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1003c440
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x2c], 0xf889
jmp 0x1003c426
mov dword [ebp - 0x4c], 0
jmp 0x1003c450
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x1003c46c
push dword [ebp - 0x4c]
lea ecx, [ebp - 0xae4]
call fcn.10011cc6
mov dword [eax], 4
jmp 0x1003c449
push 1
push 1
lea eax, [ebp - 0x14]
push eax
push 0
push 0x873
push 0x4e05
push 0x6b8b
push 0x7327
call fcn.1002fe48
add esp, 0x20
mov dword [ebp - 0x14], 0
jmp 0x1003c4a2
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x1003c714
mov dword [ebp - 0x304], 0xadcf
mov dword [ebp - 0x82c], 0xfe298319
cmp dword [ebp - 0x14], 0
je 0x1003c52b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x2c], 0
jne 0x1003c4f3
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x2c], 0
jne 0x1003c4f3
and dword [ebp - 0x3d0], 0
jmp 0x1003c4fd
mov dword [ebp - 0x3d0], 1
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x2c]
add eax, dword [ebp - 0x3d0]
je 0x1003c52b
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x2c], 0
je 0x1003c52b
mov eax, 0x9de360ab
test eax, eax
je 0x1003c52b
mov dword [ebp - 0x3d8], 1
jmp 0x1003c532
and dword [ebp - 0x3d8], 0
imul eax, dword [ebp - 0x3d8], 0xfffffff6
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x2c]
imul eax, dword [ebp - 0x14]
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 0x42c8
jle 0x1003c56b
cmp dword [ebp - 0x14], 0
je 0x1003c56b
mov dword [ebp - 0x3e0], 1
jmp 0x1003c572
and dword [ebp - 0x3e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x3e0], eax
jge 0x1003c590
mov dword [ebp - 0x3e8], 1
jmp 0x1003c597
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x3e8]
test eax, eax
jle 0x1003c5b0
mov dword [ebp - 0x3f0], 1
jmp 0x1003c5b7
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x2c]
cmp dword [ebp - 0x3f0], eax
jne 0x1003c5d8
cmp dword [ebp - 0x304], 0
jne 0x1003c5d8
and dword [ebp - 0x3f8], 0
jmp 0x1003c5e2
mov dword [ebp - 0x3f8], 1
mov eax, dword [ebp - 0x958]
cmp dword [ebp - 0x3f8], eax
jge 0x1003c602
cmp dword [ebp - 0x2f0], 0
jne 0x1003c602
and dword [ebp - 0x400], 0
jmp 0x1003c60c
mov dword [ebp - 0x400], 1
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x2c]
cmp eax, dword [ebp - 0x400]
jne 0x1003c627
mov dword [ebp - 0x408], 1
jmp 0x1003c62e
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x304]
cmp dword [ebp - 0x408], eax
jne 0x1003c648
mov dword [ebp - 0x410], 1
jmp 0x1003c64f
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x824]
cmp dword [ebp - 0x410], eax
jle 0x1003c669
mov dword [ebp - 0x908], 1
jmp 0x1003c670
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x2c], 0
jbe 0x1003c686
mov dword [ebp - 0x2f8], 1
jmp 0x1003c68d
and dword [ebp - 0x2f8], 0
push 1
lea ecx, [ebp - 0xae4]
call fcn.10011cc6
mov ecx, dword [ebp - 0x2f8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x304]
cmp dword [ebp - 0x2f8], eax
jl 0x1003c6bc
mov dword [ebp - 0x418], 1
jmp 0x1003c6c3
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x418], eax
je 0x1003c6da
mov dword [ebp - 0x420], 1
jmp 0x1003c6e1
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x2c]
cmp dword [ebp - 0x420], eax
jg 0x1003c6fc
mov dword [ebp - 0x428], 1
jmp 0x1003c703
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x82c], eax
jmp 0x1003c49b
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xae4]
call fcn.10011cc1
mov dword [ebp - 0x10], 0
jmp 0x1003c733
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x1003d369
mov dword [ebp - 0xbc], 0x831713b9
mov dword [ebp - 0x168], 0xec0351a9
mov dword [ebp - 0x4a8], 0x47030fc3
mov dword [ebp - 0x4a0], 0x93765224
mov dword [ebp - 0x970], 0x1fd29cc0
mov dword [ebp - 0xbc], 0x1a
jmp 0x1003c788
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xfffffff4
jne 0x1003cdbd
mov dword [ebp - 0x394], 7
mov dword [ebp - 0x940], 0x1722
cmp dword [ebp - 0x940], 0x10e9
jge 0x1003cacb
lea eax, [ebp - 0x834]
push eax
push 0x1000b1c8
call fcn.10050d0b
pop ecx
pop ecx
mov dword [ebp - 0x314], 1
jmp 0x1003c7e5
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x314]
cmp eax, dword [ebp - 0x834]
jg 0x1003cacb
lea eax, [ebp - 0xe40]
push eax
push 0x1000b35c
call fcn.10050d0b
pop ecx
pop ecx
lea eax, [ebp - 0xe40]
push eax
call fcn.10050c80
pop ecx
mov dword [ebp - 0x1e0], eax
and dword [ebp - 0x23c], 0
jmp 0x1003c833
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0x1a
jge 0x1003c853
imul eax, dword [ebp - 0x1e0], 0x68
mov ecx, dword [ebp - 0x23c]
or dword [eax + ecx*4 + 0x11771720], 0xffffffff
jmp 0x1003c826
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x28], eax
jmp 0x1003c866
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x1003c934
and dword [ebp - 0x1ac], 0
jmp 0x1003c886
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0xe40]
sub eax, 0x41
cmp dword [ebp - 0x1ac], eax
jge 0x1003c8c3
mov eax, dword [ebp - 0x28]
inc eax
imul eax, eax, 0x68
imul ecx, dword [ebp - 0x28], 0x68
mov edx, dword [ebp - 0x1ac]
mov esi, dword [ebp - 0x1ac]
mov eax, dword [eax + esi*4 + 0x11771720]
mov dword [ecx + edx*4 + 0x11771720], eax
jmp 0x1003c879
imul eax, dword [ebp - 0x28], 0x68
mov ecx, dword [ebp - 0x28]
movsx ecx, byte [ebp + ecx - 0xe40]
mov edx, dword [ebp - 0x28]
mov dword [eax + ecx*4 + 0x1177161c], edx
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0xe40]
sub eax, 0x40
mov dword [ebp - 0x184], eax
jmp 0x1003c8ff
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0x1a
jge 0x1003c92f
mov eax, dword [ebp - 0x28]
inc eax
imul eax, eax, 0x68
imul ecx, dword [ebp - 0x28], 0x68
mov edx, dword [ebp - 0x184]
mov esi, dword [ebp - 0x184]
mov eax, dword [eax + esi*4 + 0x11771720]
mov dword [ecx + edx*4 + 0x11771720], eax
jmp 0x1003c8f2
jmp 0x1003c85f
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x30], eax
jmp 0x1003c947
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1003c9f4
mov eax, dword [ebp - 0x30]
mov dword [eax*4 + 0x11836a60], 1
and dword [ebp - 0x190], 0
jmp 0x1003c975
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0x1a
jge 0x1003c9ef
mov eax, dword [ebp - 0x30]
inc eax
imul eax, eax, 0x68
mov ecx, dword [ebp - 0x190]
cmp dword [eax + ecx*4 + 0x11771720], 0xffffffff
jne 0x1003c997
jmp 0x1003c968
mov eax, dword [ebp - 0x30]
inc eax
imul eax, eax, 0x68
mov ecx, dword [ebp - 0x190]
mov eax, dword [eax + ecx*4 + 0x11771720]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ecx*4 + 0x11836a60]
add ecx, dword [eax*4 + 0x11836a60]
mov eax, dword [ebp - 0x30]
mov dword [eax*4 + 0x11836a60], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax*4 + 0x11836a60], 0x40
jle 0x1003c9ea
mov eax, dword [ebp - 0x30]
mov eax, dword [eax*4 + 0x11836a60]
sub eax, 0x40
mov ecx, dword [ebp - 0x30]
mov dword [ecx*4 + 0x11836a60], eax
jmp 0x1003c968
jmp 0x1003c940
mov dword [ebp - 0x150], 1
and dword [ebp - 0x26c], 0
jmp 0x1003ca14
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0x1a
jge 0x1003ca2d
mov eax, dword [ebp - 0x26c]
mov byte [ebp + eax - 0xe00], 0
jmp 0x1003ca07
and dword [ebp - 0x170], 0
jmp 0x1003ca43
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x170]
cmp eax, dword [ebp - 0x1e0]
jge 0x1003cab4
mov eax, dword [ebp - 0x170]
movsx eax, byte [ebp + eax - 0xe40]
movzx eax, byte [ebp + eax - 0xe41]
test eax, eax
jne 0x1003cab2
mov eax, dword [ebp - 0x170]
movsx eax, byte [ebp + eax - 0xe40]
mov byte [ebp + eax - 0xe41], 1
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x150]
add ecx, dword [eax*4 + 0x11836a60]
mov dword [ebp - 0x150], ecx
cmp dword [ebp - 0x150], 0x40
jle 0x1003cab2
mov eax, dword [ebp - 0x150]
sub eax, 0x40
mov dword [ebp - 0x150], eax
jmp 0x1003ca36
push dword [ebp - 0x150]
push 0x1000b324
call fcn.10050f3f
pop ecx
pop ecx
jmp 0x1003c7d8
mov dword [ebp - 0x68], 0
jmp 0x1003cadb
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1003caf1
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x770], 0x3069be54
jmp 0x1003cad4
mov dword [ebp - 0x68], 0
jmp 0x1003cb01
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x1003cb17
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x490], 0xd3b51ad5
jmp 0x1003cafa
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x770], 0xfffd
jne 0x1003cb36
mov dword [ebp - 0x450], 1
jmp 0x1003cb3d
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xc7c], eax
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0xbc], eax
jne 0x1003cb63
mov dword [ebp - 0x430], 1
jmp 0x1003cb6a
and dword [ebp - 0x430], 0
cmp dword [ebp - 0x430], 0
je 0x1003cb88
cmp dword [ebp - 0x394], 0
je 0x1003cb88
mov dword [ebp - 0x438], 1
jmp 0x1003cb8f
and dword [ebp - 0x438], 0
imul eax, dword [ebp - 0x438], 0x1aa2
sub eax, dword [ebp - 0x4a8]
cmp eax, dword [ebp - 0x394]
je 0x1003cbb3
mov dword [ebp - 0x448], 1
jmp 0x1003cbba
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x448]
mov ecx, dword [ebp - 0x450]
lea eax, [ecx + eax + 9]
test eax, eax
jne 0x1003cbe0
cmp dword [ebp - 0x4a0], 0
jne 0x1003cbe0
and dword [ebp - 0x458], 0
jmp 0x1003cbea
mov dword [ebp - 0x458], 1
mov eax, dword [ebp - 0x168]
cmp eax, dword [ebp - 0x458]
jl 0x1003cc04
mov dword [ebp - 0x910], 1
jmp 0x1003cc0b
and dword [ebp - 0x910], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x770], 0xffff
ja 0x1003cc2a
mov dword [ebp - 0x460], 1
jmp 0x1003cc31
and dword [ebp - 0x460], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x490]
cmp dword [ebp - 0x460], eax
jge 0x1003cc52
mov dword [ebp - 0x468], 1
jmp 0x1003cc59
and dword [ebp - 0x468], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x770]
cmp dword [ebp - 0x468], eax
je 0x1003cc83
mov eax, 0x9eed08e1
test eax, eax
je 0x1003cc83
mov dword [ebp - 0x470], 1
jmp 0x1003cc8a
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x470], eax
jl 0x1003cca4
mov dword [ebp - 0x478], 1
jmp 0x1003ccab
and dword [ebp - 0x478], 0
cmp dword [ebp - 0x478], 0x7503ae56
je 0x1003ccc3
mov dword [ebp - 0x480], 1
jmp 0x1003ccca
and dword [ebp - 0x480], 0
cmp dword [ebp - 0x480], 0xfffffffc
jg 0x1003ccdf
mov dword [ebp - 0x488], 1
jmp 0x1003cce6
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0xbc]
imul eax, dword [ebp - 0x488]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x770]
jle 0x1003cd1b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x490], 0
jne 0x1003cd1b
and dword [ebp - 0x498], 0
jmp 0x1003cd25
mov dword [ebp - 0x498], 1
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x498], eax
jle 0x1003cd3f
mov dword [ebp - 0x83c], 1
jmp 0x1003cd46
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0xbf0], eax
or eax, 0xffffffff
je 0x1003cd60
cmp dword [ebp - 0x970], 0
jne 0x1003cd72
cmp dword [ebp - 0x4a8], 0
jne 0x1003cd72
and dword [ebp - 0x4b0], 0
jmp 0x1003cd7c
mov dword [ebp - 0x4b0], 1
mov eax, dword [ebp - 0x4b0]
sub eax, dword [ebp - 0x168]
mov dword [ebp - 0x168], eax
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x1003cdb8
push 1
push 1
push 1
push 0x6400
push 0x6b57
call fcn.1002f18e
add esp, 0x14
jmp 0x1003c77b
mov dword [ebp - 0x158], 2
jmp 0x1003cdd6
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jl 0x1003d1af
mov dword [ebp - 0x2a8], 0xfffffffc
mov dword [ebp - 0x198], 0xe5c285ce
mov dword [ebp - 0x2ac], 6
mov dword [ebp - 0xc8c], 1
mov dword [ebp - 0x84c], 0xffffffff
mov dword [ebp - 0x4d8], 1
mov dword [ebp - 0x918], 0x741311e2
push 1
lea ecx, [ebp - 0xac0]
call fcn.10011c5f
mov byte [ebp - 4], 0x12
push 4
lea ecx, [ebp - 0xa6c]
call fcn.10011c5f
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x38], 0
jmp 0x1003ce5b
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1003ce71
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x1a0], 5
jmp 0x1003ce54
push 0x24cf
push 0x3d42
push 0x105f
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xac0]
push eax
push 0
push 1
call fcn.10036581
add esp, 0x1c
mov dword [ebp - 0x38], 0
jmp 0x1003cea7
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x1003cec3
push dword [ebp - 0x38]
lea ecx, [ebp - 0xa6c]
call fcn.10011cc6
mov dword [eax], 0x2a6add33
jmp 0x1003cea0
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0xc94], eax
push 0
lea ecx, [ebp - 0xac0]
call fcn.10011cc6
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x4b8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x4b8]
mov dword [ecx], eax
xor eax, eax
cmp eax, 0xae3d
je 0x1003cf08
mov dword [ebp - 0x4c0], 1
jmp 0x1003cf0f
and dword [ebp - 0x4c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
cmp dword [ebp - 0x4c0], eax
jg 0x1003cf30
mov dword [ebp - 0x4c8], 1
jmp 0x1003cf37
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x198]
sub eax, dword [ebp - 0x4c8]
cmp eax, dword [ebp - 0x2ac]
jne 0x1003cf57
mov dword [ebp - 0x4d0], 1
jmp 0x1003cf5e
and dword [ebp - 0x4d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
cmp dword [ebp - 0x4d0], eax
jle 0x1003cf7f
mov dword [ebp - 0x844], 1
jmp 0x1003cf86
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0xc9c], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0xca4], eax
mov eax, dword [ebp - 0x918]
neg eax
mov dword [ebp - 0x4d8], eax
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0xcb0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a0]
mov dword [ebp - 0xcb8], eax
imul eax, dword [ebp - 0x2ac], 0x5f7a
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x84c]
cmp dword [ebp - 0x198], eax
jg 0x1003d00f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a0], 0
jne 0x1003d00f
and dword [ebp - 0x4e0], 0
jmp 0x1003d019
mov dword [ebp - 0x4e0], 1
mov eax, dword [ebp - 0x2ac]
add eax, dword [ebp - 0x4e0]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1a0]
lea esi, [eax + ecx + 0x57252b0a]
push 1
lea ecx, [ebp - 0xa6c]
call fcn.10011cc6
mov dword [eax], esi
mov byte [ebp - 0xf1], 0
push 0x38ca
push 0x2e6f
push 0
lea eax, [ebp - 0xf1]
push eax
call fcn.10041971
add esp, 0x10
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xa6c]
call fcn.10011cc1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xac0]
call fcn.10011cc1
mov dword [ebp - 0x4e8], 3
mov dword [ebp - 0x40], 0
jmp 0x1003d0a2
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jg 0x1003d1aa
mov dword [ebp - 0x70], 0
jmp 0x1003d0bc
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x1003d0d2
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xa20], 0xe1757117
jmp 0x1003d0b5
mov dword [ebp - 0x70], 0
jmp 0x1003d0e2
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1003d0f8
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xcc0], 0
jmp 0x1003d0db
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xa20], 7
jmp 0x1003d126
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa20]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xa20], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa20], 0x11
jle 0x1003d198
mov dword [ebp - 0x1f0], 0xd37ad43
mov dword [ebp - 0x1f0], 0
jmp 0x1003d159
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0
jg 0x1003d193
mov byte [ebp - 0xf2], 0
movzx eax, byte [ebp - 0xf2]
test eax, eax
je 0x1003d191
push 0x11c8
push 0x70fa
push 1
push 0
push 1
push 0x16a2
call fcn.1003237f
add esp, 0x18
jmp 0x1003d14c
jmp 0x1003d10b
mov eax, dword [ebp - 0x4e8]
dec eax
mov dword [ebp - 0x4e8], eax
jmp 0x1003d09b
jmp 0x1003cdc9
mov dword [ebp - 0x4f8], 0xddd3f467
push 3
lea ecx, [ebp - 0xa90]
call fcn.10011c5f
mov byte [ebp - 4], 0x14
push 3
lea ecx, [ebp - 0x9e4]
call fcn.10011c5f
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x948], 0xffffffff
mov dword [ebp - 0x1a8], 0
jmp 0x1003d1fe
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 3
jge 0x1003d220
push dword [ebp - 0x1a8]
lea ecx, [ebp - 0xa90]
call fcn.10011cc6
mov dword [eax], 1
jmp 0x1003d1f1
lea eax, [ebp - 0x1a8]
push eax
push 0
push 1
push 0x491b
push 0x3195
push 0x7dd5
lea eax, [ebp - 0x9e4]
push eax
push 0x7109
call fcn.10030038
add esp, 0x20
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x4f0], eax
push 0
lea ecx, [ebp - 0xa90]
call fcn.10011cc6
mov ecx, dword [ebp - 0x4f0]
mov dword [eax], ecx
cmp dword [ebp - 0x4f0], 0x3df603fa
jg 0x1003d287
mov dword [ebp - 0x510], 1
jmp 0x1003d28e
and dword [ebp - 0x510], 0
cmp dword [ebp - 0x4f8], 0
jne 0x1003d2fa
push 0
lea ecx, [ebp - 0x9e4]
call fcn.10011cc6
push 0
lea ecx, [ebp - 0x9e4]
call fcn.10011cc6
cmp dword [eax], 0xbb6b
je 0x1003d2c5
mov dword [ebp - 0x500], 1
jmp 0x1003d2cc
and dword [ebp - 0x500], 0
cmp dword [ebp - 0x500], 0xffffffff
jb 0x1003d2e1
mov dword [ebp - 0x508], 1
jmp 0x1003d2e8
and dword [ebp - 0x508], 0
cmp dword [ebp - 0x508], 0
jne 0x1003d2fa
and dword [ebp - 0x518], 0
jmp 0x1003d304
mov dword [ebp - 0x518], 1
mov eax, dword [ebp - 0x510]
cmp eax, dword [ebp - 0x518]
jne 0x1003d31e
mov dword [ebp - 0x520], 1
jmp 0x1003d325
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x948], eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x9e4]
call fcn.10011cc1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa90]
call fcn.10011cc1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x9f0]
call fcn.10011cc6
cmp dword [eax], 0
je 0x1003d364
jmp 0x1003d369
jmp 0x1003c72c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9f0]
call fcn.10011cc1
mov dword [ebp - 0x864], 0xf89b546
mov dword [ebp - 0x8c4], 0xffffffff
mov dword [ebp - 0xcc8], 5
mov dword [ebp - 0xcd0], 0
mov dword [ebp - 0xcd8], 0xffffffff
mov dword [ebp - 0xce0], 4
mov dword [ebp - 0x8d4], 0xacde9e84
mov dword [ebp - 0xce8], 0x19e95d1c
mov dword [ebp - 0x854], 0
mov dword [ebp - 0xd44], 0xffffffff
mov dword [ebp - 0xd4c], 0x7008b15e
push 3
lea ecx, [ebp - 0xa9c]
call fcn.10011c5f
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x85c], 0
mov dword [ebp - 0x8c8], 0x3f1540ee
push 0x3048
push 0x6830
push 1
lea eax, [ebp - 0xd54]
push eax
push 1
push 0x600
push 0x3395
push 0x421
push 0x728a
push 0x3119
push 0x2810
push 0x6cda
push 0x67f6
lea eax, [ebp - 0xa9c]
push eax
push 1
call fcn.1002f2a4
add esp, 0x3c
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x1003d490
push 0x6b4b
push 0x3d4a
push 1
push 0
push 0x53a
push 0x5d1c
push 1
call fcn.100368be
add esp, 0x1c
lea eax, [ebp - 0x854]
push eax
push 0x4664
push 1
push 0x474b
push 0
lea eax, [ebp - 0x8c8]
push eax
lea eax, [ebp - 0x85c]
push eax
lea eax, [ebp - 0x8c4]
push eax
lea eax, [ebp - 0x864]
push eax
push 0x44e8
lea eax, [ebp - 0xa9c]
push eax
lea eax, [ebp - 0x8d4]
push eax
push 0x547f
call fcn.10030b3e
add esp, 0x34
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa9c]
call fcn.10011cc1
mov eax, dword [ebp - 0x248]
mov eax, dword [eax + 4]
mov dword [ebp - 0x6d0], eax
mov dword [ebp - 0x8dc], 0x1eefb6f6
mov dword [ebp - 0x528], 0xffffffff
mov dword [ebp - 0x86c], 0xffffffff
mov dword [ebp - 0x1b0], 0xf196e6c8
lea eax, [ebp - 0x1b0]
push eax
push 0x5655
push 1
push 0x52b1
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x8dc]
push eax
call fcn.1002f9d8
add esp, 0x1c
mov dword [ebp - 0x1b0], 8
jmp 0x1003d570
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 3
jg 0x1003d5ba
mov dword [ebp - 0x874], 0x32d683a7
push 1
lea eax, [ebp - 0x874]
push eax
push 1
push 0xeb3
push 0x46a8
call fcn.1002fb34
add esp, 0x14
push 1
lea eax, [ebp - 0x528]
push eax
push 0
push 0x5fe7
call fcn.10032270
add esp, 0x10
jmp 0x1003d563
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x35c], 0x7249aaed
mov dword [ebp - 0x358], 0x7249aaed
mov dword [ebp - 0x354], 0x7249aaed
mov dword [ebp - 0x350], 0x7249aaed
mov dword [ebp - 0x538], 0x667120dd
push 2
lea ecx, [ebp - 0xad8]
call fcn.10011c5f
mov dword [ebp - 4], 0x17
push 2
lea ecx, [ebp - 0xab4]
call fcn.10011c5f
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x134], 0
jmp 0x1003d631
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 3
jge 0x1003d64d
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0xa38], 0xfffffff7
jmp 0x1003d624
push 1
push 1
push 0x53c5
push 1
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0xad8]
push eax
push 0x7329
push 0x2535
call fcn.1002fe48
add esp, 0x20
push 0xea3
push 1
push 1
lea eax, [ebp - 0xab4]
push eax
push 0xa4d
push 0x3bfa
push 0x79cd
lea eax, [ebp - 0x134]
push eax
call fcn.10030038
add esp, 0x20
mov dword [ebp - 0x78], 0
jmp 0x1003d6b6
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jg 0x1003d6d2
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0xa38]
mov dword [ebp + ecx*4 - 0xa38], eax
jmp 0x1003d6af
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa38]
mov dword [ebp - 0xd5c], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x35c]
mov dword [ebp - 0xd78], eax
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x35c]
cmp dword [ebp + eax - 0x35c], ecx
jge 0x1003d720
mov dword [ebp - 0x8e4], 1
jmp 0x1003d727
and dword [ebp - 0x8e4], 0
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x35c], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xd80], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa38]
mov dword [ebp - 0xd88], eax
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x35c]
cmp dword [ebp + eax - 0x35c], ecx
jge 0x1003d789
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x35c], 0
je 0x1003d789
mov dword [ebp - 0x530], 1
jmp 0x1003d790
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x538], eax
mov eax, dword [ebp - 0x538]
add eax, 9
mov dword [ebp - 0x540], eax
push 1
lea ecx, [ebp - 0xad8]
call fcn.10011cc6
mov ecx, dword [ebp - 0x540]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x35c]
cmp dword [ebp - 0x540], eax
jl 0x1003d7e7
mov dword [ebp - 0x548], 1
jmp 0x1003d7ee
and dword [ebp - 0x548], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x35c]
cmp dword [ebp - 0x548], eax
jle 0x1003d80f
mov dword [ebp - 0x87c], 1
jmp 0x1003d816
and dword [ebp - 0x87c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x35c]
mov dword [ebp - 0xd90], eax
push 0
lea ecx, [ebp - 0xab4]
call fcn.10011cc6
mov dword [eax], 0x6a4137d6
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xab4]
call fcn.10011cc1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xad8]
call fcn.10011cc1
mov dword [ebp - 0xa4c], 4
mov dword [ebp - 0xa48], 4
mov dword [ebp - 0xa44], 4
mov dword [ebp - 0xa40], 4
lea ecx, [ebp - 0x31d]
call fcn.10011cd5
push eax
lea eax, [ebp - 0xa3c]
push eax
lea eax, [ebp - 0xa4c]
push eax
lea ecx, [ebp - 0xddc]
call fcn.10011cd8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9fc]
call fcn.10011c9b
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x1b8], 0
mov dword [ebp - 0x8ec], 0x9d29be1d
push 2
lea ecx, [ebp - 0xd08]
call fcn.10011c5f
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x1f8], 0
jmp 0x1003d8fc
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 2
jge 0x1003d91e
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0xd08]
call fcn.10011cc6
mov dword [eax], 0x46df37d4
jmp 0x1003d8ef
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x8ec], eax
mov dword [ebp - 0x1b8], 0
jmp 0x1003d943
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 1
jg 0x1003d963
mov dword [ebp - 0x884], 0
cmp dword [ebp - 0x884], 0
je 0x1003d961
jmp 0x1003d963
jmp 0x1003d936
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xd08]
call fcn.10011cc1
push 1
lea ecx, [ebp - 0x75c]
call fcn.10011c5f
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x80], 0
jmp 0x1003d993
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
jge 0x1003d9a9
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x9b4], 0xffffffff
jmp 0x1003d98c
mov dword [ebp - 0x80], 0
jmp 0x1003d9b9
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x1003d9cf
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x1ec], 1
jmp 0x1003d9b2
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1ec], 0
jmp 0x1003d9fd
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ec]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1ec], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1ec], 3
jg 0x1003da96
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ec]
cmp dword [ebp + eax*4 - 0x9b4], 0
je 0x1003da2a
jmp 0x1003da96
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9b4]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1ec]
sub eax, dword [ebp + ecx*4 - 0x9b4]
je 0x1003da70
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ec]
cmp dword [ebp + eax*4 - 0x9b4], 0
je 0x1003da70
mov dword [ebp - 0x550], 1
jmp 0x1003da77
and dword [ebp - 0x550], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ec]
mov ecx, dword [ebp - 0x550]
mov dword [ebp + eax*4 - 0x9b4], ecx
jmp 0x1003d9e2
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0x9b4]
mov dword [ebp + ecx - 0x1ec], eax
mov dword [ebp - 0xd98], 4
mov dword [ebp - 0xd60], 0x3072c02a
mov dword [ebp - 0xd38], 1
mov dword [ebp - 0xbf8], 0xffffffff
mov dword [ebp - 0xcc4], 1
mov dword [ebp - 0xc00], 1
mov dword [ebp - 0xd40], 0xa191a83a
mov dword [ebp - 0xc08], 0xc545e213
mov dword [ebp - 0xccc], 0x6d786ff5
mov dword [ebp - 0xc10], 0x2efe8e60
mov dword [ebp - 0xd74], 0xfe93
mov dword [ebp - 0xc18], 0xffffffff
mov dword [ebp - 0xcd4], 0x7054f86f
mov dword [ebp - 0x8a0], 0xffffffff
mov dword [ebp - 0x200], 0
jmp 0x1003db54
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 1
jge 0x1003db76
push dword [ebp - 0x200]
lea ecx, [ebp - 0x75c]
call fcn.10011cc6
mov dword [eax], 0xfffffff9
jmp 0x1003db47
push 0
lea ecx, [ebp - 0x9fc]
call fcn.10011cc6
mov dword [eax], 0xfffffff2
jmp 0x1003dbaf
push 0
lea ecx, [ebp - 0x9fc]
call fcn.10011cc6
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0x558]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x558]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x9fc]
call fcn.10011cc6
cmp dword [eax], 0xffffffee
jge 0x1003ded9
mov dword [ebp - 0x210], 0x98311173
mov dword [ebp - 0xc20], 0xfffffff7
mov dword [ebp - 0x8f4], 0x268b
cmp dword [ebp - 0x8f4], 0x107b
jge 0x1003dc9e
lea eax, [ebp - 0x8fc]
push eax
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x88c]
push eax
push 0x1000b4e4
call fcn.10050d0b
add esp, 0x14
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x88c]
lea eax, [ecx + eax*8]
mov ecx, dword [ebp - 0x208]
sub ecx, eax
mov dword [ebp - 0x208], ecx
mov eax, dword [ebp - 0x13c]
sub eax, dword [ebp - 0x8fc]
imul eax, eax, 0xc
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x208], 0
jg 0x1003dc64
push 0x1000b4bc
call fcn.100510f6
pop ecx
jmp 0x1003dc9e
cmp dword [ebp - 0x13c], 0
jg 0x1003dc7a
push 0x1000b320
call fcn.100510f6
pop ecx
jmp 0x1003dc9e
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x208]
lea eax, [ecx + eax - 1]
cdq
idiv dword [ebp - 0x13c]
push eax
push 0x1000b324
call fcn.10050f3f
pop ecx
pop ecx
mov dword [ebp - 0xd48], 0x446bd29a
mov dword [ebp - 0xc28], 1
mov dword [ebp - 0xd70], 0xed09eb81
mov dword [ebp - 0xd6c], 0xed09eb81
mov dword [ebp - 0xd68], 0xed09eb81
mov dword [ebp - 0xd64], 0xed09eb81
mov dword [ebp - 0x210], 0
jmp 0x1003dcf3
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0
jg 0x1003debc
mov dword [ebp - 0xc4], 0xffffffff
mov dword [ebp - 0xc4], 0
jmp 0x1003dd23
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jl 0x1003deb7
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xcc], 0
jmp 0x1003dd53
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jg 0x1003dea4
mov dword [ebp - 0x904], 0x86d6dbc1
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x75c]
call fcn.10011cc6
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xcdc], eax
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x75c]
call fcn.10011cc6
mov dword [ebp - 0x560], eax
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x75c]
call fcn.10011cc6
mov ecx, dword [ebp - 0x560]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x560]
cmp dword [eax], 0
je 0x1003ddd0
mov dword [ebp - 0x894], 1
jmp 0x1003ddd7
and dword [ebp - 0x894], 0
mov eax, 0xf2ba
cmp eax, 0x28ca
je 0x1003ddef
mov dword [ebp - 0x568], 1
jmp 0x1003ddf6
and dword [ebp - 0x568], 0
cmp dword [ebp - 0x568], 7
ja 0x1003de27
lea eax, [ebp - 0xc4]
push eax
push 0x6e73
push 0
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0x75c]
push eax
push 1
call fcn.10030a07
add esp, 0x18
jmp 0x1003de88
mov byte [ebp - 0xf4], 0
movzx eax, byte [ebp - 0xf4]
test eax, eax
je 0x1003de88
push 1
push 0x284f
push 0x2998
push 0x6646
push 0x1bb3
push 0x6b66
push 0x473c
push 0x50be
push 0x25ee
push 0xbd
push 0
push 0x427c
push 0
push 0x4af3
push 0x6d1c
push 0x3ada
call fcn.1003fadf
add esp, 0x40
push 0
lea ecx, [ebp - 0x75c]
call fcn.10011cc6
cmp dword [eax], 0
je 0x1003de9f
jmp 0x1003dd46
jmp 0x1003dd46
cmp dword [ebp - 0xcc], 0
je 0x1003deb2
jmp 0x1003dd16
jmp 0x1003dd16
jmp 0x1003dce6
lea eax, [ebp - 0x8a0]
push eax
push 0x5e2a
push 0
push 1
call fcn.10043010
add esp, 0x10
jmp 0x1003db8b
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x75c]
call fcn.10011cc1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9fc]
call fcn.10011cc1
push 0xc4
push 1
push 0x5d38
push 1
call fcn.10030165
add esp, 0x10
mov dword [ebp - 0x15c], 6
mov dword [ebp - 0x230], 0xed9ba07e
mov dword [ebp - 0x90c], 0x23de
cmp dword [ebp - 0x90c], 0x913
jge 0x1003e1fb
lea eax, [ebp - 0x144]
push eax
push 0x1000b1cc
call fcn.10050d0b
pop ecx
pop ecx
and dword [ebp - 0x8a8], 0
lea eax, [ebp - 0x8a8]
push eax
mov eax, dword [ebp - 0x144]
inc eax
push eax
lea ecx, [ebp - 0xdbc]
call fcn.10011cec
mov dword [ebp - 0x914], eax
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0x8b0], eax
mov dword [ebp - 4], 0x1c
push dword [ebp - 0x8b0]
mov eax, dword [ebp - 0x144]
inc eax
push eax
lea ecx, [ebp - 0x340]
call fcn.10048766
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xdbc]
call fcn.10011cc1
mov dword [ebp - 0x220], 1
jmp 0x1003dfc9
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
cmp eax, dword [ebp - 0x144]
jg 0x1003e02d
mov dword [ebp - 0x218], 1
jmp 0x1003dff0
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
cmp eax, dword [ebp - 0x144]
jg 0x1003e02b
push dword [ebp - 0x218]
push dword [ebp - 0x220]
lea ecx, [ebp - 0x340]
call fcn.1004878d
mov ecx, eax
call fcn.10011cc6
push eax
push 0x1000b1cc
call fcn.10050d0b
pop ecx
pop ecx
jmp 0x1003dfe3
jmp 0x1003dfbc
mov dword [ebp - 0x228], 1
jmp 0x1003e046
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp - 0x144]
jg 0x1003e07d
push dword [ebp - 0x228]
push 0
lea ecx, [ebp - 0x340]
call fcn.1004878d
mov ecx, eax
call fcn.10011cc6
push eax
push 0x1000b1cc
call fcn.10050d0b
pop ecx
pop ecx
jmp 0x1003e039
mov dword [ebp - 0x88], 1
jmp 0x1003e096
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x144]
jg 0x1003e1e1
and dword [ebp - 0x154], 0
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
push dword [ebp - 0x154]
push dword [ebp - 0x88]
lea ecx, [ebp - 0x340]
call fcn.1004878d
mov ecx, eax
call fcn.10011cc6
mov eax, dword [eax]
cmp eax, dword [ebp - 0x88]
jne 0x1003e0ed
jmp 0x1003e16c
mov dword [ebp - 0x14c], 1
jmp 0x1003e106
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
push dword [ebp - 0x14c]
push 0
lea ecx, [ebp - 0x340]
call fcn.1004878d
mov ecx, eax
call fcn.10011cc6
mov esi, eax
push dword [ebp - 0x154]
push dword [ebp - 0x88]
lea ecx, [ebp - 0x340]
call fcn.1004878d
mov ecx, eax
call fcn.10011cc6
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x1003e16a
push dword [ebp - 0x14c]
push 0
lea ecx, [ebp - 0x340]
call fcn.1004878d
mov ecx, eax
call fcn.10011cc6
mov eax, dword [eax]
cmp eax, dword [ebp - 0x88]
jne 0x1003e16c
jmp 0x1003e0f9
push dword [ebp - 0x14c]
push 0
lea ecx, [ebp - 0x340]
call fcn.1004878d
mov ecx, eax
call fcn.10011cc6
mov esi, eax
push dword [ebp - 0x154]
push dword [ebp - 0x88]
lea ecx, [ebp - 0x340]
call fcn.1004878d
mov ecx, eax
call fcn.10011cc6
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x1003e0b6
push dword [ebp - 0x154]
push dword [ebp - 0x88]
lea ecx, [ebp - 0x340]
call fcn.1004878d
mov ecx, eax
call fcn.10011cc6
push dword [eax]
push 0x1000b334
call fcn.10050f3f
pop ecx
pop ecx
jmp 0x1003e089
push 0x1000b135
call fcn.100510f6
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x340]
call fcn.10048788
mov dword [ebp - 0x91c], 0xa116
mov dword [ebp - 0x15c], 0
jmp 0x1003e21e
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xffffffec
je 0x1003e405
push 1
lea ecx, [ebp - 0x98c]
call fcn.10011c5f
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x580], 0xfffffff7
mov dword [ebp - 0x578], 9
mov dword [ebp - 0x2bc], 6
mov dword [ebp - 0x8b8], 0x6a7f4ea1
push 1
push 1
push 0x2a17
lea eax, [ebp - 0xc30]
push eax
push 0x55b2
push 1
push 0x1136
lea eax, [ebp - 0x98c]
push eax
call fcn.10030808
add esp, 0x20
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0xd94], eax
push 0
lea ecx, [ebp - 0x98c]
call fcn.10011cc6
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x2b4]
mov dword [ecx], eax
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 0x2b4]
add eax, dword [ecx]
je 0x1003e3b1
cmp dword [ebp - 0x15c], 9
jae 0x1003e2eb
mov dword [ebp - 0x570], 1
jmp 0x1003e2f2
and dword [ebp - 0x570], 0
mov dword [ebp - 0x580], 0xffffffff
mov eax, dword [ebp - 0x230]
imul eax, dword [ebp - 0x570]
imul eax, dword [ebp - 0x91c]
mov dword [ebp - 0x578], eax
mov eax, dword [ebp - 0x578]
cmp dword [ebp - 0x580], eax
jl 0x1003e330
mov dword [ebp - 0x588], 1
jmp 0x1003e337
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x2bc], eax
mov esi, dword [ebp - 0x2bc]
push 0
lea ecx, [ebp - 0x98c]
call fcn.10011cc6
cmp esi, dword [eax]
jge 0x1003e366
mov dword [ebp - 0x590], 1
jmp 0x1003e36d
and dword [ebp - 0x590], 0
push 0
lea ecx, [ebp - 0x98c]
call fcn.10011cc6
mov eax, dword [eax]
cmp eax, dword [ebp - 0x590]
jl 0x1003e390
mov dword [ebp - 0x598], 1
jmp 0x1003e397
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x8b8]
cmp dword [ebp - 0x598], eax
jle 0x1003e3b1
mov dword [ebp - 0x5a0], 1
jmp 0x1003e3b8
and dword [ebp - 0x5a0], 0
cmp dword [ebp - 0x5a0], 0xc4e2bf5f
ja 0x1003e3d0
mov dword [ebp - 0x5a8], 1
jmp 0x1003e3d7
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x5a8]
neg eax
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x230], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98c]
call fcn.10011cc1
jmp 0x1003e211
mov dword [ebp - 0xc38], 0
mov dword [ebp - 0xce4], 0x9aed23b6
mov dword [ebp - 0xc40], 0xffffffff
mov dword [ebp - 0x924], 0xfffffffc
mov dword [ebp - 0xd50], 0xff23b1a9
mov dword [ebp - 0xc48], 0x8cccddd1
mov dword [ebp - 0xcec], 0x576c5165
mov dword [ebp - 0x790], 1
mov dword [ebp - 0xc50], 0xffffffff
mov dword [ebp - 0xd7c], 0x9acd
mov dword [ebp - 0x2c4], 0x1c58
mov dword [ebp - 0x238], 0
jmp 0x1003e48c
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 1
jge 0x1003e4a8
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0x794], 0xfffffffe
jmp 0x1003e47f
mov eax, dword [ebp - 0x924]
mov ecx, dword [ebp - 0x2c4]
mov edx, dword [ebp - 0x2c4]
dec edx
mov dword [ebp - 0x2c4], edx
cmp ecx, eax
jge 0x1003e4de
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x794], 0
jne 0x1003e4de
and dword [ebp - 0x5b0], 0
jmp 0x1003e4e8
mov dword [ebp - 0x5b0], 1
mov eax, dword [ebp - 0x5b0]
mov dword [ebp - 0x790], eax
mov eax, dword [ebp - 0x248]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x248]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x164], 0xfffffff6
mov dword [ebp - 0xd4], 0x5610a143
push 3
lea ecx, [ebp - 0xa2c]
call fcn.10011c5f
mov dword [ebp - 4], 0x20
push 1
lea eax, [ebp - 0xc58]
push eax
push 0x599c
push 0x22a5
push 1
lea eax, [ebp - 0xa2c]
push eax
push 0
push 0x77a6
call fcn.10034df8
add esp, 0x20
mov dword [ebp - 0x48], 0xc1d6
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x18], eax
jge 0x1003e603
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x48]
jge 0x1003e59a
mov dword [ebp - 0x5b8], 1
jmp 0x1003e5a1
and dword [ebp - 0x5b8], 0
cmp dword [ebp - 0x5b8], 0xbc0d133f
ja 0x1003e5b9
mov dword [ebp - 0x5c0], 1
jmp 0x1003e5c0
and dword [ebp - 0x5c0], 0
cmp dword [ebp - 0x5c0], 0xb288586f
jb 0x1003e5d8
mov dword [ebp - 0x5c8], 1
jmp 0x1003e5df
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x5c8]
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
jne 0x1003e603
cmp dword [ebp - 0x48], 0
jne 0x1003e603
and dword [ebp - 0x5d0], 0
jmp 0x1003e60d
mov dword [ebp - 0x5d0], 1
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x5d0]
cmp eax, dword [ebp - 0x18]
jge 0x1003e628
mov dword [ebp - 0x5d8], 1
jmp 0x1003e62f
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x5d8], eax
jl 0x1003e646
mov dword [ebp - 0x5e0], 1
jmp 0x1003e64d
and dword [ebp - 0x5e0], 0
cmp dword [ebp - 0x5e0], 9
jb 0x1003e662
mov dword [ebp - 0x5e8], 1
jmp 0x1003e669
and dword [ebp - 0x5e8], 0
cmp dword [ebp - 0x5e8], 0xfffd
je 0x1003e681
mov dword [ebp - 0x5f0], 1
jmp 0x1003e688
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x5f0], eax
jl 0x1003e69f
mov dword [ebp - 0x5f8], 1
jmp 0x1003e6a6
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x5f8], eax
je 0x1003e6bd
mov dword [ebp - 0x600], 1
jmp 0x1003e6c4
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x600]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xd4], eax
jl 0x1003e6ee
push 6
pop eax
test eax, eax
je 0x1003e6ee
mov dword [ebp - 0x608], 1
jmp 0x1003e6f5
and dword [ebp - 0x608], 0
cmp dword [ebp - 0x608], 0xbefa
jge 0x1003e70d
mov dword [ebp - 0x610], 1
jmp 0x1003e714
and dword [ebp - 0x610], 0
cmp dword [ebp - 0x610], 0xec56
jge 0x1003e72c
jmp 0x1003fa82
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x828], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov dword [ebp - 0x810], 0x2642
cmp dword [ebp - 0x810], 0xc09
jge 0x1003f8d4
call fcn.10051444
push 0x20
pop ecx
imul ecx, ecx, 0
add eax, ecx
push eax
push 0x1000b39c
push 0x1000b3a0
call fcn.10051984
add esp, 0xc
call fcn.10051444
push 0x20
pop ecx
shl ecx, 0
add eax, ecx
push eax
push 0x1000b3a8
push 0x1000b3ac
call fcn.10051984
add esp, 0xc
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x820]
push eax
push 0x1000b354
call fcn.10050d0b
add esp, 0xc
mov dword [ebp - 0x288], 1
and dword [ebp - 0x2ec], 0
jmp 0x1003f84b
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x280], eax
mov byte [ebp - 0x21], 1
cmp dword [ebp - 0x280], 0
je 0x1003f898
movzx eax, byte [ebp - 0x21]
test eax, eax
je 0x1003f898
mov eax, dword [ebp - 0x280]
cdq
push 0xa
pop ecx
idiv ecx
cmp edx, dword [ebp - 0x818]
jne 0x1003f884
mov byte [ebp - 0x21], 0
mov eax, dword [ebp - 0x280]
cdq
push 0xa
pop ecx
idiv ecx
mov dword [ebp - 0x280], eax
jmp 0x1003f85b
movzx eax, byte [ebp - 0x21]
test eax, eax
je 0x1003f8ad
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp - 0x2ec]
cmp eax, dword [ebp - 0x820]
jne 0x1003f8cf
push dword [ebp - 0x288]
push 0x1000b324
call fcn.10050f3f
pop ecx
pop ecx
jmp 0x1003f8d4
jmp 0x1003f83e
mov eax, dword [ebp - 0x828]
movzx eax, byte [eax]
test eax, eax
je 0x1003fa7c
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x848], eax
mov dword [ebp - 0x838], 0x24b9
cmp dword [ebp - 0x838], 0x123a
jge 0x1003fa56
lea eax, [ebp - 0x2f4]
push eax
mov ecx, 0x1065b310
call fcn.10011831
lea ecx, [ebp - 0x9cc]
call fcn.100117af
mov dword [ebp - 4], 0x29
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp - 0x2f4]
dec eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x840], 0
je 0x1003fa47
lea edx, [ebp - 0x9cc]
mov ecx, 0x1065b310
call fcn.10016235
lea ecx, [ebp - 0x9cc]
call fcn.10011c58
cmp eax, 3
jne 0x1003fa2a
push 0
lea ecx, [ebp - 0x9cc]
call fcn.10013a22
movsx eax, byte [eax]
cmp eax, 0x6f
jne 0x1003f9a2
push 1
lea ecx, [ebp - 0x9cc]
call fcn.10013a22
movsx eax, byte [eax]
cmp eax, 0x6e
je 0x1003f9f6
push 0
lea ecx, [ebp - 0x9cc]
call fcn.10013a22
movsx eax, byte [eax]
cmp eax, 0x6f
jne 0x1003f9cc
push 2
lea ecx, [ebp - 0x9cc]
call fcn.10013a22
movsx eax, byte [eax]
cmp eax, 0x65
je 0x1003f9f6
push 1
lea ecx, [ebp - 0x9cc]
call fcn.10013a22
movsx eax, byte [eax]
cmp eax, 0x6e
jne 0x1003fa10
push 2
lea ecx, [ebp - 0x9cc]
call fcn.10013a22
movsx eax, byte [eax]
cmp eax, 0x65
jne 0x1003fa10
push fcn.10016103
push 1
mov ecx, 0x1065b258
call fcn.10011a2c
mov ecx, eax
call fcn.10011a20
jmp 0x1003fa28
push fcn.10016103
push 2
mov ecx, 0x1065b258
call fcn.10011a2c
mov ecx, eax
call fcn.10011a20
jmp 0x1003fa42
push fcn.10016103
push 3
mov ecx, 0x1065b258
call fcn.10011a2c
mov ecx, eax
call fcn.10011a20
jmp 0x1003f92e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9cc]
call fcn.10011812
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0x850], eax
mov eax, dword [ebp - 0x850]
movzx eax, byte [eax]
test eax, eax
je 0x1003fa7a
push 0xbb9
call dword [sym.imp.USER32.dll_IsZoomed]
jmp 0x1003fa82
call dword [sym.imp.USER32.dll_EndMenu]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret