Function at 0x10012040
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ab44
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1afc
call fcn.10065df0
push esi
push edi
movzx eax, byte [ebp + 0x34]
test eax, eax
je 0x100130de
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0xfdc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x106c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1074], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xe70], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xfe4], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xfd4], eax
mov eax, dword [ebp - 0xe70]
movzx eax, byte [eax]
test eax, eax
je 0x10013064
mov eax, dword [ebp - 0xfd4]
mov dword [ebp - 0x105c], eax
mov eax, dword [ebp - 0xfdc]
mov dword [ebp - 0x1044], eax
mov eax, dword [ebp - 0xfe4]
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 0x102c], 0x1e66
cmp dword [ebp - 0x102c], 0xd57
jge 0x1001220f
and dword [ebp - 0x2d4], 0
lea eax, [ebp - 0x2d4]
push eax
push 0x10007804
call fcn.100513ab
pop ecx
pop ecx
xor ecx, ecx
mov eax, dword [ebp - 0x2d4]
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1004ca40
pop ecx
mov dword [ebp - 0x1034], eax
mov eax, dword [ebp - 0x1034]
mov dword [ebp - 0x2dc], eax
mov dword [ebp - 0x238], 0x3b9aca00
and dword [ebp - 0x1a8], 0
jmp 0x1001215c
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
cmp eax, dword [ebp - 0x2d4]
jge 0x100121b4
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [ebp - 0x2dc]
lea eax, [ecx + eax*4]
push eax
push 0x100077f8
call fcn.100513ab
pop ecx
pop ecx
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [ebp - 0x2dc]
mov eax, dword [ecx + eax*4]
cmp eax, dword [ebp - 0x238]
jge 0x100121b2
mov eax, dword [ebp - 0x1a8]
mov ecx, dword [ebp - 0x2dc]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x238], eax
jmp 0x1001214f
and dword [ebp - 0x38c], 0
jmp 0x100121ca
mov eax, dword [ebp - 0x38c]
inc eax
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x38c]
cmp eax, dword [ebp - 0x2d4]
jge 0x100121fd
mov eax, dword [ebp - 0x38c]
mov ecx, dword [ebp - 0x2dc]
mov eax, dword [ecx + eax*4]
cdq
idiv dword [ebp - 0x238]
test edx, edx
je 0x100121fb
or dword [ebp - 0x238], 0xffffffff
jmp 0x100121fd
jmp 0x100121bd
push dword [ebp - 0x238]
push 0x10007804
call fcn.100515a0
pop ecx
pop ecx
mov eax, dword [ebp - 0x2e4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x5f8], eax
mov dword [ebp - 0x2b8], 0xfffffff9
mov dword [ebp - 0x394], 0
jmp 0x10012241
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 4
jge 0x1001225d
mov eax, dword [ebp - 0x394]
mov dword [ebp + eax*4 - 0x1874], 9
jmp 0x10012234
mov dword [ebp - 0x2b8], 0x14
jmp 0x10012276
mov eax, dword [ebp - 0x2b8]
dec eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0xffffffec
jl 0x100122dc
mov dword [ebp - 0x11c], 0xffffffff
mov dword [ebp - 0x11c], 3
jmp 0x100122a2
mov eax, dword [ebp - 0x11c]
dec eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jl 0x100122da
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x11c]
mov eax, dword [ebp + eax*4 - 0x1874]
mov dword [ebp + ecx*4 - 0x1874], eax
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x2b8]
mov dword [ebp + eax*4 - 0x1874], ecx
jmp 0x10012295
jmp 0x10012269
mov eax, dword [ebp - 0x2e4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x2e4]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x74], eax
and dword [ebp - 0x57c], 0
jmp 0x10012316
mov eax, dword [ebp - 0x57c]
inc eax
mov dword [ebp - 0x57c], eax
mov eax, dword [ebp - 0x74]
add eax, 0x28
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x2e4]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x57c], eax
jge 0x10013062
push 3
lea ecx, [ebp - 0x228]
call fcn.1000e440
and dword [ebp - 4], 0
mov dword [ebp - 0x484], 0xb275cf8b
mov dword [ebp - 0x514], 0x907865e1
mov dword [ebp - 0x48c], 0x1fe90568
push 3
lea ecx, [ebp - 0x12c4]
call fcn.1000e440
mov byte [ebp - 4], 1
mov dword [ebp - 0xcc4], 0x3e629bad
push 1
lea ecx, [ebp - 0x1354]
call fcn.1000e440
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1e4]
push eax
push 1
push 0
push 0x7b4c
push 0x2145
push 0x62f5
push 0x718
lea eax, [ebp - 0x228]
push eax
call fcn.1002378b
add esp, 0x20
lea eax, [ebp - 0x12c4]
push eax
push 0
lea eax, [ebp - 0x1e4]
push eax
push 0
push 0x601a
push 0x25ab
call fcn.10020fdf
add esp, 0x18
mov dword [ebp - 0x1e4], 0
jmp 0x100123f4
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 1
jge 0x10012416
push dword [ebp - 0x1e4]
lea ecx, [ebp - 0x1354]
call fcn.1000e49e
mov dword [eax], 0x1448afe0
jmp 0x100123e7
push 1
lea ecx, [ebp - 0x228]
call fcn.1000e49e
mov ecx, 0xd4aa41a8
sub ecx, dword [eax]
cmp ecx, 0x7bd55fd0
jge 0x1001243e
mov dword [ebp - 0x824], 1
jmp 0x10012445
and dword [ebp - 0x824], 0
push 2
lea ecx, [ebp - 0x228]
call fcn.1000e49e
mov ecx, dword [ebp - 0x824]
cmp ecx, dword [eax]
jl 0x10012468
mov dword [ebp - 0xccc], 1
jmp 0x1001246f
and dword [ebp - 0xccc], 0
push 2
lea ecx, [ebp - 0x228]
call fcn.1000e49e
mov eax, dword [eax]
cmp eax, dword [ebp - 0xccc]
jge 0x10012492
mov dword [ebp - 0xd08], 1
jmp 0x10012499
and dword [ebp - 0xd08], 0
push 2
lea ecx, [ebp - 0x228]
call fcn.1000e49e
mov ecx, dword [ebp - 0xd08]
cmp ecx, dword [eax]
jle 0x100124bc
mov dword [ebp - 0xd10], 1
jmp 0x100124c3
and dword [ebp - 0xd10], 0
push 2
lea ecx, [ebp - 0x228]
call fcn.1000e49e
mov ecx, dword [ebp - 0xd10]
cmp ecx, dword [eax]
jle 0x100124e6
mov dword [ebp - 0xd18], 1
jmp 0x100124ed
and dword [ebp - 0xd18], 0
push 2
lea ecx, [ebp - 0x228]
call fcn.1000e49e
mov eax, dword [eax]
cmp eax, dword [ebp - 0xd18]
jl 0x10012510
mov dword [ebp - 0xd20], 1
jmp 0x10012517
and dword [ebp - 0xd20], 0
mov eax, dword [ebp - 0xd20]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x1468], eax
push 1
lea ecx, [ebp - 0x228]
call fcn.1000e49e
mov eax, dword [eax]
mov dword [ebp - 0x514], eax
cmp dword [ebp - 0x514], 0
je 0x10012562
cmp dword [ebp - 0x484], 0
je 0x10012562
mov dword [ebp - 0xd28], 1
jmp 0x10012569
and dword [ebp - 0xd28], 0
cmp dword [ebp - 0xd28], 0xca0cec51
je 0x10012581
mov dword [ebp - 0xd30], 1
jmp 0x10012588
and dword [ebp - 0xd30], 0
cmp dword [ebp - 0xd30], 0xf2b8
jge 0x100125a0
mov dword [ebp - 0xd38], 1
jmp 0x100125a7
and dword [ebp - 0xd38], 0
cmp dword [ebp - 0xd38], 1
je 0x100125bc
mov dword [ebp - 0xd40], 1
jmp 0x100125c3
and dword [ebp - 0xd40], 0
push 2
lea ecx, [ebp - 0x228]
call fcn.1000e49e
mov ecx, dword [ebp - 0xd40]
cmp ecx, dword [eax]
jne 0x100125ef
mov eax, 0xd3c0
test eax, eax
je 0x100125ef
mov dword [ebp - 0xd48], 1
jmp 0x100125f6
and dword [ebp - 0xd48], 0
push 1
lea ecx, [ebp - 0x228]
call fcn.1000e49e
mov esi, dword [ebp - 0xd48]
sub esi, dword [eax]
push 2
lea ecx, [ebp - 0x228]
call fcn.1000e49e
cmp esi, dword [eax]
jge 0x10012628
mov dword [ebp - 0xdbc], 1
jmp 0x1001262f
and dword [ebp - 0xdbc], 0
mov eax, dword [ebp - 0xdbc]
mov dword [ebp - 0x48c], eax
mov esi, dword [ebp - 0x48c]
push 2
lea ecx, [ebp - 0x228]
call fcn.1000e49e
add esi, dword [eax]
push 2
lea ecx, [ebp - 0x228]
call fcn.1000e49e
add esi, dword [eax]
push 2
lea ecx, [ebp - 0x228]
call fcn.1000e49e
cmp esi, dword [eax]
jle 0x1001267c
mov dword [ebp - 0x103c], 1
jmp 0x10012683
and dword [ebp - 0x103c], 0
push 2
lea ecx, [ebp - 0x228]
call fcn.1000e49e
push 0
lea ecx, [ebp - 0x228]
call fcn.1000e49e
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x1444], eax
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0xdc4], eax
push 0
lea ecx, [ebp - 0x12c4]
call fcn.1000e49e
mov ecx, dword [ebp - 0xdc4]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x228]
call fcn.1000e49e
mov ecx, dword [ebp - 0xdc4]
sub ecx, dword [eax]
mov dword [ebp - 0xcc4], ecx
cmp dword [ebp - 0xcc4], 0xfffe
jbe 0x100126fd
mov dword [ebp - 0x5d8], 1
jmp 0x10012704
and dword [ebp - 0x5d8], 0
push 0
lea ecx, [ebp - 0x1354]
call fcn.1000e49e
mov ecx, dword [ebp - 0x5d8]
mov dword [eax], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1354]
call fcn.1000e47c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x12c4]
call fcn.1000e47c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.1000e47c
mov eax, dword [ebp - 0x74]
cmp dword [eax + 0x10], 0
jne 0x10012854
lea eax, [ebp - 0x5f8]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x54f6
lea eax, [ebp - 0x55c]
push eax
lea eax, [ebp - 0x1044]
push eax
push 0
call fcn.1002b046
add esp, 0x18
push 1
lea ecx, [ebp - 0x10e4]
call fcn.1000e440
mov dword [ebp - 4], 3
mov dword [ebp - 0x398], 0
jmp 0x100127a8
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 1
jge 0x100127ca
push dword [ebp - 0x398]
lea ecx, [ebp - 0x10e4]
call fcn.1000e49e
mov dword [eax], 0xfffffff8
jmp 0x1001279b
push 0
lea ecx, [ebp - 0x10e4]
call fcn.1000e49e
mov dword [eax], 1
jmp 0x10012803
push 0
lea ecx, [ebp - 0x10e4]
call fcn.1000e49e
mov dword [ebp - 0xd3c], eax
mov eax, dword [ebp - 0xd3c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xd3c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x10e4]
call fcn.1000e49e
cmp dword [eax], 0xfffffff6
je 0x10012840
mov byte [ebp - 0x10e], 0
movzx eax, byte [ebp - 0x10e]
test eax, eax
je 0x1001283e
push 0
push 0x411
push 0x1ab0
push 0xe02
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
jmp 0x100127df
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10e4]
call fcn.1000e47c
jmp 0x10012300
push 2
lea ecx, [ebp - 0x12d0]
call fcn.1000e440
mov dword [ebp - 4], 4
mov dword [ebp - 0x240], 0x7d8c
mov dword [ebp - 0x20c], 0xfffffff7
mov dword [ebp - 0x144c], 0xd5493e62
mov dword [ebp - 0x2ec], 0
jmp 0x1001289f
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 2
jge 0x100128c1
push dword [ebp - 0x2ec]
lea ecx, [ebp - 0x12d0]
call fcn.1000e49e
mov dword [eax], 0x446df37d
jmp 0x10012892
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x1bf3
lea eax, [ebp - 0x240]
push eax
push 0x638b
push 1
lea eax, [ebp - 0x12d0]
push eax
push 0x98e
push 0x92a
call fcn.10011cfa
add esp, 0x24
mov dword [ebp - 0x240], 0
jmp 0x1001290f
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0x1d
jle 0x10012b57
mov dword [ebp - 0x104c], 0xfffe
mov dword [ebp - 0x20c], 0xd
jmp 0x1001293f
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0x13
jg 0x10012983
mov byte [ebp - 0x110], 0
push 0x36a1
push 0
push 0x3bc5
push 1
lea eax, [ebp - 0x110]
push eax
push 0x35f3
call fcn.10020fdf
add esp, 0x18
lea eax, [ebp - 0x104c]
push eax
push 0
call fcn.1001dcca
pop ecx
pop ecx
jmp 0x10012932
mov dword [ebp - 0x1054], 0x2185
cmp dword [ebp - 0x1054], 0xb95
jge 0x10012b3a
lea eax, [ebp - 0x5f0]
push eax
mov ecx, 0x1065b170
call fcn.1002f04e
push dword [ebp - 0x5f0]
lea ecx, [ebp - 0xd58]
call fcn.1002f89e
mov byte [ebp - 4], 5
and dword [ebp - 0x430], 0
jmp 0x100129d9
mov eax, dword [ebp - 0x430]
inc eax
mov dword [ebp - 0x430], eax
mov eax, dword [ebp - 0x430]
cmp eax, dword [ebp - 0x5f0]
jge 0x10012a05
push dword [ebp - 0x430]
lea ecx, [ebp - 0xd58]
call fcn.1002f921
push eax
mov ecx, 0x1065b170
call fcn.1002f2a3
jmp 0x100129cc
lea eax, [ebp - 0x1454]
push eax
lea ecx, [ebp - 0xd58]
call fcn.1000e48f
push dword [eax]
lea eax, [ebp - 0x145c]
push eax
lea ecx, [ebp - 0xd58]
call fcn.1000e481
push dword [eax]
call fcn.10033038
pop ecx
pop ecx
mov byte [ebp - 0x31], 0
and dword [ebp - 0x1b4], 0
jmp 0x10012a4e
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
lea ecx, [ebp - 0xd58]
call fcn.1002f918
dec eax
dec eax
cmp dword [ebp - 0x1b4], eax
jae 0x10012aeb
push dword [ebp - 0x1b4]
lea ecx, [ebp - 0xd58]
call fcn.1002f921
mov esi, eax
mov eax, dword [ebp - 0x1b4]
inc eax
push eax
lea ecx, [ebp - 0xd58]
call fcn.1002f921
mov edi, dword [esi]
add edi, dword [eax]
mov esi, dword [esi + 4]
adc esi, dword [eax + 4]
mov eax, dword [ebp - 0x1b4]
inc eax
inc eax
push eax
lea ecx, [ebp - 0xd58]
call fcn.1002f921
mov dword [ebp - 0xff0], edi
mov dword [ebp - 0xfec], esi
mov dword [ebp - 0x9d0], eax
mov eax, dword [ebp - 0x9d0]
mov ecx, dword [ebp - 0xfec]
cmp ecx, dword [eax + 4]
jl 0x10012ae6
jg 0x10012ae0
mov eax, dword [ebp - 0x9d0]
mov ecx, dword [ebp - 0xff0]
cmp ecx, dword [eax]
jbe 0x10012ae6
mov byte [ebp - 0x31], 1
jmp 0x10012aeb
jmp 0x10012a41
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x10012b10
push fcn.10032e2f
mov edx, 0x10007824
mov ecx, 0x1065b2a8
call fcn.10032e61
mov ecx, eax
call fcn.1002f3b8
jmp 0x10012b2b
push fcn.10032e2f
mov edx, 0x10007828
mov ecx, 0x1065b2a8
call fcn.10032e61
mov ecx, eax
call fcn.1002f3b8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xd58]
call fcn.1000efca
push 1
push 1
push 0xd70
lea eax, [ebp - 0x20c]
push eax
call fcn.10011b78
add esp, 0x10
jmp 0x10012902
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12d0]
call fcn.1000e47c
push 4
push 0x1000
mov eax, dword [ebp - 0x74]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x5f8]
add ecx, dword [eax + 0xc]
push ecx
push 0x2fef
push 0x2bb7
call fcn.1004a19e
pop ecx
pop ecx
call eax
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp - 0x74]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x105c]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x55c]
call fcn.1004acaa
add esp, 0xc
push 2
lea ecx, [ebp - 0xe04]
call fcn.1000e440
mov dword [ebp - 4], 6
push 1
lea ecx, [ebp - 0x5cc]
call fcn.1000e440
mov byte [ebp - 4], 7
mov dword [ebp - 0x620], 1
mov dword [ebp - 0x9f0], 0xb6f2ba10
mov dword [ebp - 0x1064], 1
mov dword [ebp - 0x4c], 0
jmp 0x10012c0d
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 4
jge 0x10012c23
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xdb0], 0x5baf43b7
jmp 0x10012c06
push 1
lea eax, [ebp - 0x4c]
push eax
push 0
push 0x6f64
lea eax, [ebp - 0xe04]
push eax
call fcn.10023d89
add esp, 0x14
mov dword [ebp - 0x4c], 0
jmp 0x10012c4f
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x10012c68
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x5cc]
call fcn.1000e49e
and dword [eax], 0
jmp 0x10012c48
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xdb0]
mov dword [ebp - 0xbc0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xbc0]
mov dword [ebp + eax - 0xdb0], ecx
cmp dword [ebp - 0xbc0], 0
je 0x10012cd8
mov byte [ebp - 0x112], 0
movzx eax, byte [ebp - 0x112]
test eax, eax
je 0x10012cd3
push 0xe8e
push 0x4573
push 0xb52
push 0
push 0x5ad5
push 0x301a
push 1
push 0x2667
call fcn.1002875d
add esp, 0x20
jmp 0x10012e1e
mov dword [ebp - 0x2f4], 0xf0aa6e6f
mov dword [ebp - 0x608], 0x912530a9
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x1464], eax
cmp dword [ebp - 0x2f4], 0x68108531
jl 0x10012d22
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xdb0], 0
jne 0x10012d22
xor eax, eax
inc eax
jne 0x10012d22
and dword [ebp - 0x600], 0
jmp 0x10012d2c
mov dword [ebp - 0x600], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xdb0]
cmp dword [ebp - 0x600], eax
je 0x10012d4d
mov dword [ebp - 0x9d8], 1
jmp 0x10012d54
and dword [ebp - 0x9d8], 0
mov eax, dword [ebp - 0x9d8]
mov dword [ebp - 0x608], eax
cmp dword [ebp - 0x608], 0
jne 0x10012d82
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xdb0], 0
jne 0x10012d82
and dword [ebp - 0xcb8], 0
jmp 0x10012d8c
mov dword [ebp - 0xcb8], 1
cmp dword [ebp - 0xcb8], 0xffffffff
jg 0x10012da1
mov dword [ebp - 0x610], 1
jmp 0x10012da8
and dword [ebp - 0x610], 0
cmp dword [ebp - 0x610], 0x4039ee49
jl 0x10012dc0
mov dword [ebp - 0x9e0], 1
jmp 0x10012dc7
and dword [ebp - 0x9e0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xdb0]
add eax, dword [ebp - 0x9e0]
cmp dword [ebp - 0x2f4], eax
jle 0x10012df0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xdb0], 0
push 1
lea ecx, [ebp - 0xe04]
call fcn.1000e49e
mov eax, dword [ebp - 0x2f4]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0xdb0]
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xdb0], eax
push 0
lea ecx, [ebp - 0x5cc]
call fcn.1000e49e
cmp dword [eax], 0
jne 0x10012e4b
push 0
lea ecx, [ebp - 0x5cc]
call fcn.1000e49e
cmp dword [eax], 0
jne 0x10012e4b
and dword [ebp - 0x618], 0
jmp 0x10012e55
mov dword [ebp - 0x618], 1
push 1
lea ecx, [ebp - 0xe04]
call fcn.1000e49e
cmp dword [eax], 0xab391500
jne 0x10012e76
mov dword [ebp - 0xbc8], 1
jmp 0x10012e7d
and dword [ebp - 0xbc8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x618]
mov dword [ebp + eax - 0xdb0], ecx
push 0
lea ecx, [ebp - 0x5cc]
call fcn.1000e49e
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0x620], eax
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0x146c], eax
push 1
lea ecx, [ebp - 0xe04]
call fcn.1000e49e
cmp dword [eax], 0
je 0x10012ee2
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xdb0], 0
je 0x10012ee2
mov dword [ebp - 0x9e8], 1
jmp 0x10012ee9
and dword [ebp - 0x9e8], 0
push 0
lea ecx, [ebp - 0xe04]
call fcn.1000e49e
mov ecx, dword [ebp - 0x9e8]
cmp ecx, dword [eax]
je 0x10012f0c
mov dword [ebp - 0x628], 1
jmp 0x10012f13
and dword [ebp - 0x628], 0
push 0
lea ecx, [ebp - 0x5cc]
call fcn.1000e49e
mov ecx, dword [ebp - 0x628]
cmp ecx, dword [eax]
jne 0x10012f36
mov dword [ebp - 0xcd4], 1
jmp 0x10012f3d
and dword [ebp - 0xcd4], 0
cmp dword [ebp - 0xcd4], 0xfffffff9
jge 0x10012f52
mov dword [ebp - 0x630], 1
jmp 0x10012f59
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x9f0], eax
mov esi, dword [ebp - 0x9f0]
push 0
lea ecx, [ebp - 0x5cc]
call fcn.1000e49e
add esi, dword [eax]
jne 0x10012f8e
mov eax, 0x731d497c
test eax, eax
jne 0x10012f8e
and dword [ebp - 0x638], 0
jmp 0x10012f98
mov dword [ebp - 0x638], 1
push 0
lea ecx, [ebp - 0x5cc]
call fcn.1000e49e
mov ecx, dword [ebp - 0x638]
cmp ecx, dword [eax]
jl 0x10012fbb
mov dword [ebp - 0xbd0], 1
jmp 0x10012fc2
and dword [ebp - 0xbd0], 0
cmp dword [ebp - 0xbd0], 1
jl 0x10012fd7
mov dword [ebp - 0x640], 1
jmp 0x10012fde
and dword [ebp - 0x640], 0
push 0
lea ecx, [ebp - 0x5cc]
call fcn.1000e49e
mov ecx, dword [ebp - 0x640]
cmp ecx, dword [eax]
jge 0x10013001
mov dword [ebp - 0x9f8], 1
jmp 0x10013008
and dword [ebp - 0x9f8], 0
mov eax, dword [ebp - 0x9f8]
mov dword [ebp - 0x1064], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x5cc]
call fcn.1000e47c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe04]
call fcn.1000e47c
push 1
push 0x57a
lea eax, [ebp - 0x55c]
push eax
push 0x207
push 1
lea eax, [ebp - 0x74]
push eax
push 0x6291
push 0x4305
call fcn.10011e73
add esp, 0x20
jmp 0x10012300
jmp 0x100130d9
mov eax, dword [ebp - 0x106c]
mov dword [ebp - 0x107c], eax
mov eax, dword [ebp - 0x1074]
mov dword [ebp - 0x1084], eax
mov eax, dword [ebp - 0x107c]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x1084]
mov dword [ebp - 0x108c], eax
mov eax, dword [ebp - 0x280]
mov dword [eax], 0
jmp 0x100130b3
mov eax, dword [ebp - 0x280]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x280]
mov dword [ecx], eax
mov eax, dword [ebp - 0x280]
cmp dword [eax], 2
jge 0x100130d9
mov eax, dword [ebp - 0x280]
push dword [eax]
mov ecx, dword [ebp - 0x108c]
call fcn.1000e49e
mov dword [eax], 0x49e3c8d3
jmp 0x100130a2
jmp 0x1001dc0f
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x109c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x10a4], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x10ac], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10b4], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1094], eax
mov eax, dword [ebp - 0x1094]
movzx eax, byte [eax]
test eax, eax
je 0x1001db63
mov eax, dword [ebp - 0x109c]
mov dword [ebp - 0xef0], eax
mov eax, dword [ebp - 0x10a4]
mov dword [ebp - 0xee4], eax
mov eax, dword [ebp - 0x10ac]
mov dword [ebp - 0xcbc], eax
mov eax, dword [ebp - 0x10b4]
mov dword [ebp - 0x538], eax
mov dword [ebp - 0x3c], 0xb7c7ce53
mov dword [ebp - 0x650], 0x7f191253
mov dword [ebp - 0xa00], 0xb5cf
mov dword [ebp - 0xbc], 0
jmp 0x10013180
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jge 0x1001319c
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x12e8], 0xffffffff
jmp 0x10013173
mov dword [ebp - 0xbc], 0
jmp 0x100131b5
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x100131d1
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x10bc], 0xb43d2717
jmp 0x100131a8
mov dword [ebp - 0x3c], 0
jmp 0x100131e1
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jg 0x10013281
mov dword [ebp - 0x3a0], 3
mov byte [ebp - 0x114], 0
push 0xde9
push 0x251c
push 0x7b8a
lea eax, [ebp - 0x114]
push eax
push 0
push 0x6566
push 0
call fcn.1001176d
add esp, 0x1c
mov byte [ebp - 0x116], 0
movzx eax, byte [ebp - 0x116]
test eax, eax
je 0x10013242
push 0
push 0x224e
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x3a0], 2
jmp 0x1001325b
mov eax, dword [ebp - 0x3a0]
dec eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 0
jl 0x1001327c
push 0x16e5
push 0
push 0
push 0x78e
call fcn.1001ed4b
add esp, 0x10
jmp 0x1001324e
jmp 0x100131da
cmp dword [ebp - 0x3c], 0
jne 0x10013327
cmp dword [ebp - 0x3c], 0
je 0x100132bb
mov eax, dword [ebp - 0x3c]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x12e8]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x12e8]
jg 0x100132bb
mov dword [ebp - 0x648], 1
jmp 0x100132c2
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x648]
jl 0x100132d9
mov dword [ebp - 0xcc0], 1
jmp 0x100132e0
and dword [ebp - 0xcc0], 0
mov eax, dword [ebp - 0xcc0]
mov dword [ebp - 0x650], eax
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0xa00], eax
cmp dword [ebp - 0xa00], 0
jne 0x1001330d
mov dword [ebp - 0x494], 1
jmp 0x10013314
and dword [ebp - 0x494], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x494]
mov dword [ebp + eax - 0x10bc], ecx
mov eax, 0xe491ba6b
cmp eax, 0x7e7c14ab
ja 0x1001333f
mov dword [ebp - 0x658], 1
jmp 0x10013346
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x658], eax
je 0x1001335d
mov dword [ebp - 0xbd8], 1
jmp 0x10013364
and dword [ebp - 0xbd8], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0xbd8]
jg 0x1001337b
mov dword [ebp - 0x660], 1
jmp 0x10013382
and dword [ebp - 0x660], 0
cmp dword [ebp - 0x660], 1
jle 0x1001339b
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x1001339b
and dword [ebp - 0xa08], 0
jmp 0x100133a5
mov dword [ebp - 0xa08], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa08]
sub ecx, dword [ebp + eax - 0x12e8]
cmp ecx, 0x20dd
jne 0x100133cc
mov dword [ebp - 0x668], 1
jmp 0x100133d3
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x2a0], 0xffffffff
mov dword [ebp - 0x6a0], 0xe005ab13
mov dword [ebp - 0x11a4], 0x9999
mov dword [ebp - 0x250], 2
mov dword [ebp - 0xe50], 0x9aed
mov dword [ebp - 0x7c], 0
jmp 0x10013425
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 4
jge 0x1001343b
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xce4], 0xfffb
jmp 0x1001341e
mov dword [ebp - 0x7c], 0
jmp 0x1001344b
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x10013461
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x1730], 0xcd219fa4
jmp 0x10013444
mov dword [ebp - 0x28], 3
jmp 0x10013471
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x10013b1f
mov dword [ebp - 0x690], 1
mov dword [ebp - 0x1474], 9
mov dword [ebp - 0x147c], 0x25cf162c
mov dword [ebp - 0x1484], 0xba684a08
mov dword [ebp - 0x10c4], 0x15de
cmp dword [ebp - 0x10c4], 0xb14
jge 0x100136ba
push 0x10a83390
push 0x100077f4
call fcn.100513ab
pop ecx
pop ecx
and dword [ebp - 0x2fc], 0
jmp 0x100134e4
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0x2fc]
cmp eax, dword [0x10a83390]
jge 0x1001353e
and dword [ebp - 0x3f8], 0
jmp 0x10013508
mov eax, dword [ebp - 0x3f8]
inc eax
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0x3f8]
cmp eax, dword [0x10a83390]
jge 0x1001353c
imul eax, dword [ebp - 0x2fc], 0x228
mov ecx, dword [ebp - 0x3f8]
lea eax, [eax + ecx*4 + 0x10a70a00]
push eax
push 0x100077f4
call fcn.100513ab
pop ecx
pop ecx
jmp 0x100134fb
jmp 0x100134d7
and dword [ebp - 0x44], 0
jmp 0x1001354b
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp eax, dword [0x10a83390]
jge 0x10013614
and dword [ebp - 0x5c], 0
jmp 0x10013567
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
cmp eax, dword [0x10a83390]
jge 0x1001360f
imul eax, dword [ebp - 0x44], 0x228
mov ecx, dword [ebp - 0x5c]
cmp dword [eax + ecx*4 + 0x10a70a00], 1
jne 0x100135a1
mov eax, dword [ebp - 0x44]
mov eax, dword [eax*4 + 0x10ab4130]
inc eax
mov ecx, dword [ebp - 0x44]
mov dword [ecx*4 + 0x10ab4130], eax
jmp 0x1001360a
imul eax, dword [ebp - 0x44], 0x228
mov ecx, dword [ebp - 0x5c]
cmp dword [eax + ecx*4 + 0x10a70a00], 2
jne 0x100135cc
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax*4 + 0x10ab4130]
inc eax
mov ecx, dword [ebp - 0x5c]
mov dword [ecx*4 + 0x10ab4130], eax
jmp 0x1001360a
imul eax, dword [ebp - 0x44], 0x228
mov ecx, dword [ebp - 0x5c]
cmp dword [eax + ecx*4 + 0x10a70a00], 3
jne 0x1001360a
mov eax, dword [ebp - 0x44]
mov eax, dword [eax*4 + 0x10ab4130]
inc eax
mov ecx, dword [ebp - 0x44]
mov dword [ecx*4 + 0x10ab4130], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax*4 + 0x10ab4130]
inc eax
mov ecx, dword [ebp - 0x5c]
mov dword [ecx*4 + 0x10ab4130], eax
jmp 0x10013560
jmp 0x10013544
and dword [ebp - 0x51c], 0
and dword [ebp - 0x304], 0
jmp 0x10013631
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x304]
cmp eax, dword [0x10a83390]
jge 0x1001365e
mov eax, dword [ebp - 0x304]
cmp dword [eax*4 + 0x10ab4130], 0
jne 0x1001365c
mov eax, dword [ebp - 0x51c]
inc eax
mov dword [ebp - 0x51c], eax
jmp 0x10013624
push dword [ebp - 0x51c]
push 0x1000782c
call fcn.100515a0
pop ecx
pop ecx
and dword [ebp - 0x248], 0
jmp 0x10013686
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x248]
cmp eax, dword [0x10a83390]
jge 0x100136ba
mov eax, dword [ebp - 0x248]
cmp dword [eax*4 + 0x10ab4130], 0
jne 0x100136b8
mov eax, dword [ebp - 0x248]
inc eax
push eax
push 0x10007830
call fcn.100515a0
pop ecx
pop ecx
jmp 0x10013679
mov dword [ebp - 0x148c], 0x4c996e15
mov dword [ebp - 0x1494], 0xffffffff
mov dword [ebp - 0x1538], 8
mov dword [ebp - 0x1540], 0xffffffff
mov dword [ebp - 0x11b4], 0
mov dword [ebp - 0x1548], 1
mov dword [ebp - 0x13e8], 0xf464f612
mov dword [ebp - 0x13e4], 0xf464f612
mov dword [ebp - 0x13e0], 0xf464f612
mov dword [ebp - 0x13dc], 0xf464f612
mov dword [ebp - 0x11ac], 3
mov dword [ebp - 0x6a8], 0
mov dword [ebp - 0x3a8], 0
jmp 0x1001374b
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 3
jge 0x10013767
mov eax, dword [ebp - 0x3a8]
mov dword [ebp + eax*4 - 0x1300], 6
jmp 0x1001373e
mov eax, dword [ebp - 0x28]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xce4]
cmp dword [ebp + eax*4 - 0xce4], ecx
jl 0x1001378b
mov dword [ebp - 0x10cc], 1
jmp 0x10013792
and dword [ebp - 0x10cc], 0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xce4]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0xce4]
cmp dword [ebp - 0x2a0], eax
je 0x100137c0
mov dword [ebp - 0x10d4], 1
jmp 0x100137c7
and dword [ebp - 0x10d4], 0
xor eax, eax
inc eax
cmp eax, 0xfffffffc
jne 0x100137db
mov dword [ebp - 0xce8], 1
jmp 0x100137e2
and dword [ebp - 0xce8], 0
mov eax, dword [ebp - 0xce8]
sub eax, dword [ebp - 0x28]
cmp eax, 0x8461
jne 0x100137fe
mov dword [ebp - 0x670], 1
jmp 0x10013805
and dword [ebp - 0x670], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x670]
je 0x1001382c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xce4], 0
je 0x1001382c
mov dword [ebp - 0xa10], 1
jmp 0x10013833
and dword [ebp - 0xa10], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xce4]
add eax, dword [ebp - 0xa10]
mov ecx, dword [ebp - 0x28]
cmp eax, dword [ebp + ecx*4 - 0xce4]
jne 0x1001385e
mov dword [ebp - 0x678], 1
jmp 0x10013865
and dword [ebp - 0x678], 0
cmp dword [ebp - 0x678], 0x2337
jl 0x1001387d
mov dword [ebp - 0xbe0], 1
jmp 0x10013884
and dword [ebp - 0xbe0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xce4]
imul eax, dword [ebp - 0xbe0]
test eax, eax
jne 0x100138ae
cmp dword [ebp - 0x2a0], 0
jne 0x100138ae
and dword [ebp - 0x680], 0
jmp 0x100138b8
mov dword [ebp - 0x680], 1
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x680]
sub ecx, dword [ebp + eax*4 - 0xce4]
mov eax, dword [ebp - 0x28]
cmp ecx, dword [ebp + eax*4 - 0xce4]
jg 0x100138e0
mov dword [ebp - 0xa18], 1
jmp 0x100138e7
and dword [ebp - 0xa18], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xce4]
cmp dword [ebp - 0xa18], eax
jne 0x10013907
mov dword [ebp - 0x688], 1
jmp 0x1001390e
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x688]
neg eax
jne 0x1001392a
cmp dword [ebp - 0x2a0], 0
jne 0x1001392a
and dword [ebp - 0xcc8], 0
jmp 0x10013934
mov dword [ebp - 0xcc8], 1
mov eax, dword [ebp - 0xcc8]
mov dword [ebp - 0x690], eax
mov eax, dword [ebp - 0x2a0]
cmp dword [ebp - 0x690], eax
jle 0x1001395a
mov dword [ebp - 0x6b0], 1
jmp 0x10013961
and dword [ebp - 0x6b0], 0
cmp dword [ebp - 0x11a4], 0
jne 0x10013999
mov eax, dword [ebp - 0x11ac]
mov dword [ebp - 0x1550], eax
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x1558], eax
imul eax, dword [ebp - 0x11b4], 0xe651
test eax, eax
jne 0x10013999
and dword [ebp - 0xa20], 0
jmp 0x100139a3
mov dword [ebp - 0xa20], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xa20]
sub ecx, dword [ebp + eax - 0x1730]
mov dword [ebp - 0x698], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x698]
mov dword [ebp + eax - 0x1730], ecx
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x1190], eax
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0x10c0], eax
mov eax, dword [ebp - 0x250]
dec eax
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x1190]
cmp eax, dword [ebp - 0x10c0]
jle 0x10013a0d
mov dword [ebp - 0xbe8], 1
jmp 0x10013a14
and dword [ebp - 0xbe8], 0
mov eax, dword [ebp - 0xbe8]
mov dword [ebp - 0x6a0], eax
cmp dword [ebp - 0x6a0], 0
jne 0x10013a42
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1300], 0
jne 0x10013a42
and dword [ebp - 0xa28], 0
jmp 0x10013a4c
mov dword [ebp - 0xa28], 1
mov eax, dword [ebp - 0xa28]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0xe58], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xe58]
mov dword [ebp + eax - 0x1300], ecx
cmp dword [ebp - 0x250], 0
je 0x10013a8c
cmp dword [ebp - 0x6a8], 0
je 0x10013a8c
mov dword [ebp - 0xfcc], 1
jmp 0x10013a93
and dword [ebp - 0xfcc], 0
mov eax, dword [ebp - 0xe50]
mov dword [ebp - 0x1560], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1300], 0
jne 0x10013ac0
cmp dword [ebp - 0x250], 0
jne 0x10013ac0
and dword [ebp - 0xcf0], 0
jmp 0x10013aca
mov dword [ebp - 0xcf0], 1
cmp dword [ebp - 0xcf0], 0xffffffff
je 0x10013adf
mov dword [ebp - 0xa30], 1
jmp 0x10013ae6
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0x6b0]
cmp eax, dword [ebp - 0xa30]
jge 0x10013b00
mov dword [ebp - 0x6b8], 1
jmp 0x10013b07
and dword [ebp - 0x6b8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6b8]
mov dword [ebp + eax - 0x13e8], ecx
jmp 0x1001346a
mov dword [ebp - 0x30], 0xb7c7ce53
mov dword [ebp - 0x288], 0xfffffff9
mov dword [ebp - 0x30c], 0
jmp 0x10013b49
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 4
jge 0x10013b65
mov eax, dword [ebp - 0x30c]
mov dword [ebp + eax*4 - 0x1888], 9
jmp 0x10013b3c
mov dword [ebp - 0x288], 0x14
jmp 0x10013b7e
mov eax, dword [ebp - 0x288]
dec eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0xffffffec
jl 0x10013be4
mov dword [ebp - 0x124], 0xffffffff
mov dword [ebp - 0x124], 3
jmp 0x10013baa
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jl 0x10013be2
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x124]
mov eax, dword [ebp + eax*4 - 0x1888]
mov dword [ebp + ecx*4 - 0x1888], eax
mov eax, dword [ebp - 0x124]
mov ecx, dword [ebp - 0x288]
mov dword [ebp + eax*4 - 0x1888], ecx
jmp 0x10013b9d
jmp 0x10013b71
mov dword [ebp - 0xc50], 0x7f191253
mov dword [ebp - 0x840], 0xb5cf
push 3
lea ecx, [ebp - 0x21c]
call fcn.1000e440
mov dword [ebp - 4], 8
mov dword [ebp - 0x49c], 0xb275cf8b
mov dword [ebp - 0x568], 0x907865e1
mov dword [ebp - 0x4a4], 0x1fe90568
push 3
lea ecx, [ebp - 0x1330]
call fcn.1000e440
mov byte [ebp - 4], 9
mov dword [ebp - 0x6f0], 0x3e629bad
push 1
lea ecx, [ebp - 0x1318]
call fcn.1000e440
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x54], 0
jmp 0x10013c66
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x10013c82
push dword [ebp - 0x54]
lea ecx, [ebp - 0x21c]
call fcn.1000e49e
mov dword [eax], 0x34d0069
jmp 0x10013c5f
lea eax, [ebp - 0x1330]
push eax
push 0
lea eax, [ebp - 0x54]
push eax
push 0
push 0x4675
push 0x458f
call fcn.1001df5c
add esp, 0x18
mov dword [ebp - 0x54], 0
jmp 0x10013cb3
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x10013ccf
push dword [ebp - 0x54]
lea ecx, [ebp - 0x1318]
call fcn.1000e49e
mov dword [eax], 0x1448afe0
jmp 0x10013cac
push 1
lea ecx, [ebp - 0x21c]
call fcn.1000e49e
mov ecx, 0xd4aa41a8
sub ecx, dword [eax]
cmp ecx, 0x7bd55fd0
jge 0x10013cf7
mov dword [ebp - 0xbf0], 1
jmp 0x10013cfe
and dword [ebp - 0xbf0], 0
push 2
lea ecx, [ebp - 0x21c]
call fcn.1000e49e
mov ecx, dword [ebp - 0xbf0]
cmp ecx, dword [eax]
jl 0x10013d21
mov dword [ebp - 0x6c0], 1
jmp 0x10013d28
and dword [ebp - 0x6c0], 0
push 2
lea ecx, [ebp - 0x21c]
call fcn.1000e49e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x6c0]
jge 0x10013d4b
mov dword [ebp - 0xa38], 1
jmp 0x10013d52
and dword [ebp - 0xa38], 0
push 2
lea ecx, [ebp - 0x21c]
call fcn.1000e49e
mov ecx, dword [ebp - 0xa38]
cmp ecx, dword [eax]
jle 0x10013d75
mov dword [ebp - 0x6c8], 1
jmp 0x10013d7c
and dword [ebp - 0x6c8], 0
push 2
lea ecx, [ebp - 0x21c]
call fcn.1000e49e
mov ecx, dword [ebp - 0x6c8]
cmp ecx, dword [eax]
jle 0x10013d9f
mov dword [ebp - 0xcd0], 1
jmp 0x10013da6
and dword [ebp - 0xcd0], 0
push 2
lea ecx, [ebp - 0x21c]
call fcn.1000e49e
mov eax, dword [eax]
cmp eax, dword [ebp - 0xcd0]
jl 0x10013dc9
mov dword [ebp - 0x6d0], 1
jmp 0x10013dd0
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x6d0]
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0x1568], eax
push 1
lea ecx, [ebp - 0x21c]
call fcn.1000e49e
mov eax, dword [eax]
mov dword [ebp - 0x568], eax
cmp dword [ebp - 0x568], 0
je 0x10013e1b
cmp dword [ebp - 0x49c], 0
je 0x10013e1b
mov dword [ebp - 0xa40], 1
jmp 0x10013e22
and dword [ebp - 0xa40], 0
cmp dword [ebp - 0xa40], 0xca0cec51
je 0x10013e3a
mov dword [ebp - 0x6d8], 1
jmp 0x10013e41
and dword [ebp - 0x6d8], 0
cmp dword [ebp - 0x6d8], 0xf2b8
jge 0x10013e59
mov dword [ebp - 0xbf8], 1
jmp 0x10013e60
and dword [ebp - 0xbf8], 0
cmp dword [ebp - 0xbf8], 1
je 0x10013e75
mov dword [ebp - 0x6e0], 1
jmp 0x10013e7c
and dword [ebp - 0x6e0], 0
push 2
lea ecx, [ebp - 0x21c]
call fcn.1000e49e
mov ecx, dword [ebp - 0x6e0]
cmp ecx, dword [eax]
jne 0x10013ea8
mov eax, 0xd3c0
test eax, eax
je 0x10013ea8
mov dword [ebp - 0xa48], 1
jmp 0x10013eaf
and dword [ebp - 0xa48], 0
push 1
lea ecx, [ebp - 0x21c]
call fcn.1000e49e
mov esi, dword [ebp - 0xa48]
sub esi, dword [eax]
push 2
lea ecx, [ebp - 0x21c]
call fcn.1000e49e
cmp esi, dword [eax]
jge 0x10013ee1
mov dword [ebp - 0x6e8], 1
jmp 0x10013ee8
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x4a4], eax
mov esi, dword [ebp - 0x4a4]
push 2
lea ecx, [ebp - 0x21c]
call fcn.1000e49e
add esi, dword [eax]
push 2
lea ecx, [ebp - 0x21c]
call fcn.1000e49e
add esi, dword [eax]
push 2
lea ecx, [ebp - 0x21c]
call fcn.1000e49e
cmp esi, dword [eax]
jle 0x10013f35
mov dword [ebp - 0xedc], 1
jmp 0x10013f3c
and dword [ebp - 0xedc], 0
push 2
lea ecx, [ebp - 0x21c]
call fcn.1000e49e
push 0
lea ecx, [ebp - 0x21c]
call fcn.1000e49e
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x1570], eax
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0xcf8], eax
push 0
lea ecx, [ebp - 0x1330]
call fcn.1000e49e
mov ecx, dword [ebp - 0xcf8]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x21c]
call fcn.1000e49e
mov ecx, dword [ebp - 0xcf8]
sub ecx, dword [eax]
mov dword [ebp - 0x6f0], ecx
cmp dword [ebp - 0x6f0], 0xfffe
jbe 0x10013fb6
mov dword [ebp - 0xa50], 1
jmp 0x10013fbd
and dword [ebp - 0xa50], 0
push 0
lea ecx, [ebp - 0x1318]
call fcn.1000e49e
mov ecx, dword [ebp - 0xa50]
mov dword [eax], ecx
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1318]
call fcn.1000e47c
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1330]
call fcn.1000e47c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.1000e47c
push 2
lea ecx, [ebp - 0xe1c]
call fcn.1000e440
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xd4], 0x7d8c
mov dword [ebp - 0x64], 0xfffffff7
mov dword [ebp - 0x1578], 0xd5493e62
mov dword [ebp - 0xfe8], 0x1f87
cmp dword [ebp - 0xfe8], 0xf9c
jge 0x1001431b
call fcn.10051d83
push 0x20
pop ecx
imul ecx, ecx, 0
add eax, ecx
push eax
push 0x100078d0
push 0x100078d4
call fcn.10052087
add esp, 0xc
lea eax, [ebp - 0xe60]
push eax
mov ecx, 0x1065b170
call fcn.1002f04e
mov dword [ebp - 0x6f8], eax
mov eax, dword [ebp - 0x6f8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x6f8]
add ecx, dword [eax + 4]
call fcn.100107ed
movzx eax, al
test eax, eax
je 0x1001431b
and dword [ebp - 0x524], 0
jmp 0x100140b6
mov eax, dword [ebp - 0x524]
inc eax
mov dword [ebp - 0x524], eax
mov eax, dword [ebp - 0x524]
cmp eax, dword [ebp - 0xe60]
jge 0x10014114
lea eax, [ebp - 0xc00]
push eax
mov ecx, 0x1065b170
call fcn.1002f04e
lea edx, [ebp - 0x10b]
mov ecx, eax
call fcn.1003305c
movsx eax, byte [ebp - 0x10b]
cmp eax, 0x44
jne 0x10014101
lea eax, [ebp - 0xc00]
push eax
mov ecx, 0x10af8b1c
call fcn.1000e4ad
jmp 0x10014112
lea eax, [ebp - 0xc00]
push eax
mov ecx, 0x10af8b04
call fcn.1000e4ad
jmp 0x100140a9
and dword [ebp - 0x4b4], 0
lea eax, [ebp - 0x1580]
push eax
mov ecx, 0x10af8b1c
call fcn.1000e48f
push dword [eax]
lea eax, [ebp - 0x1588]
push eax
mov ecx, 0x10af8b1c
call fcn.1000e481
push dword [eax]
call fcn.10032e0b
pop ecx
pop ecx
lea eax, [ebp - 0x1590]
push eax
mov ecx, 0x10af8b04
call fcn.1000e48f
push dword [eax]
lea eax, [ebp - 0x1598]
push eax
mov ecx, 0x10af8b04
call fcn.1000e481
push dword [eax]
call fcn.10032e0b
pop ecx
pop ecx
and dword [ebp - 0x12c], 0
mov ecx, 0x10af8b1c
call fcn.1000f7d8
mov dword [ebp - 0x4ac], eax
jmp 0x1001419b
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
cmp eax, dword [ebp - 0x4ac]
jge 0x100142e6
and dword [ebp - 0x134], 0
mov ecx, 0x10af8b04
call fcn.1000f7d8
mov dword [ebp - 0x564], eax
jmp 0x100141d3
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
cmp eax, dword [ebp - 0x564]
jge 0x100142e1
push dword [ebp - 0x12c]
mov ecx, 0x10af8b1c
call fcn.1000e49e
mov esi, eax
push dword [ebp - 0x134]
mov ecx, 0x10af8b04
call fcn.1000e49e
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x100142dc
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
push dword [ebp - 0x12c]
lea eax, [ebp - 0x15a0]
push eax
lea eax, [ebp - 0x15a8]
push eax
mov ecx, 0x10af8b1c
call fcn.1000e481
mov ecx, eax
call fcn.1002f6b3
mov eax, dword [eax]
mov dword [ebp - 0x1198], eax
push dword [ebp - 0x1198]
lea eax, [ebp - 0x15b0]
push eax
mov ecx, 0x10af8b1c
call fcn.1002f667
push dword [ebp - 0x134]
lea eax, [ebp - 0x15b8]
push eax
lea eax, [ebp - 0x15c0]
push eax
mov ecx, 0x10af8b04
call fcn.1000e481
mov ecx, eax
call fcn.1002f6b3
mov eax, dword [eax]
mov dword [ebp - 0xe68], eax
push dword [ebp - 0xe68]
lea eax, [ebp - 0x15c8]
push eax
mov ecx, 0x10af8b04
call fcn.1002f667
mov eax, dword [ebp - 0x4ac]
dec eax
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x564]
dec eax
mov dword [ebp - 0x564], eax
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x134]
dec eax
mov dword [ebp - 0x134], eax
jmp 0x100142e1
jmp 0x100141c6
jmp 0x1001418e
mov ecx, 0x10af8b1c
call fcn.1002f699
mov ecx, 0x10af8b04
call fcn.1002f699
push fcn.10032e2f
push dword [ebp - 0x4b4]
mov ecx, 0x1065b2a8
call fcn.1002f3c4
mov ecx, eax
call fcn.1002f3b8
jmp 0x10014068
push 0x31fc
push 0x7933
push 0x7e5a
push 0xd66
push 0x2873
lea eax, [ebp - 0x15d0]
push eax
push 0x5456
push 0x85e
push 0
lea eax, [ebp - 0xe1c]
push eax
push 0x159c
push 0
push 0x391b
call fcn.10010dad
add esp, 0x34
push 0
lea ecx, [ebp - 0xe1c]
call fcn.1000e49e
mov esi, eax
push 1
lea ecx, [ebp - 0xe1c]
call fcn.1000e49e
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x100143a4
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0xd4], eax
je 0x100143a4
cmp dword [ebp - 0xd4], 0
jne 0x100143a4
and dword [ebp - 0x700], 0
jmp 0x100143ae
mov dword [ebp - 0x700], 1
push 1
lea ecx, [ebp - 0xe1c]
call fcn.1000e49e
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xd4]
add ecx, dword [ebp - 0x700]
imul eax, ecx
mov dword [ebp - 0xa58], eax
push 0
lea ecx, [ebp - 0xe1c]
call fcn.1000e49e
mov ecx, dword [ebp - 0xa58]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa58]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0xd4], 0
jmp 0x1001440a
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x1d
jle 0x10014656
mov dword [ebp - 0x708], 0xfffe
mov dword [ebp - 0x64], 0xd
jmp 0x10014431
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x13
jg 0x1001461f
mov byte [ebp - 0x18e], 0
movzx eax, byte [ebp - 0x18e]
test eax, eax
je 0x1001460d
mov dword [ebp - 0xff4], 0x1c8d
cmp dword [ebp - 0xff4], 0xd0b
jge 0x100145fc
lea eax, [ebp - 0xe48]
push eax
lea eax, [ebp - 0x3b0]
push eax
mov ecx, 0x1065b170
call fcn.1002f04e
mov ecx, eax
call fcn.1002f04e
push dword [ebp - 0x3b0]
mov ecx, 0x10af8b10
call fcn.1002f60e
and dword [ebp - 0x420], 0
jmp 0x100144b0
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x420]
cmp eax, dword [ebp - 0x3b0]
jge 0x100144db
push dword [ebp - 0x420]
mov ecx, 0x10af8b10
call fcn.1000e49e
push eax
mov ecx, 0x1065b170
call fcn.1002f04e
jmp 0x100144a3
lea eax, [ebp - 0x15d8]
push eax
mov ecx, 0x10af8b10
call fcn.1000e48f
push dword [eax]
lea eax, [ebp - 0x15e0]
push eax
mov ecx, 0x10af8b10
call fcn.1000e481
push dword [eax]
call fcn.10032e0b
pop ecx
pop ecx
lea eax, [ebp - 0x258]
push eax
mov ecx, 0x1065b170
call fcn.1002f04e
and dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x258]
cmp eax, dword [ebp - 0x3b0]
jg 0x10014574
and dword [ebp - 0x314], 0
jmp 0x10014544
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x314]
cmp eax, dword [ebp - 0x258]
jge 0x10014572
push dword [ebp - 0x314]
mov ecx, 0x10af8b10
call fcn.1000e49e
mov ecx, dword [ebp - 0x13c]
add ecx, dword [eax]
mov dword [ebp - 0x13c], ecx
jmp 0x10014537
jmp 0x100145e0
and dword [ebp - 0x31c], 0
jmp 0x10014597
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 0x258]
dec eax
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x31c]
cmp eax, dword [ebp - 0x3b0]
jge 0x100145c5
push dword [ebp - 0x31c]
mov ecx, 0x10af8b10
call fcn.1000e49e
mov ecx, dword [ebp - 0x13c]
add ecx, dword [eax]
mov dword [ebp - 0x13c], ecx
jmp 0x1001457d
mov eax, dword [ebp - 0xe48]
imul eax, dword [ebp - 0x258]
mov ecx, dword [ebp - 0x13c]
sub ecx, eax
mov dword [ebp - 0x13c], ecx
push fcn.10032e2f
push dword [ebp - 0x13c]
mov ecx, 0x1065b2a8
call fcn.1002f3c4
mov ecx, eax
call fcn.1002f3b8
push 0x6574
push 0
push 0
call fcn.100113d3
add esp, 0xc
mov eax, dword [ebp - 0x708]
dec eax
mov dword [ebp - 0x708], eax
jmp 0x1001442a
mov dword [ebp - 0x64], 0
jmp 0x1001462f
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x1a
jge 0x10014651
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x1001464f
push 0
call fcn.1001dc63
pop ecx
jmp 0x10014628
jmp 0x100143fd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe1c]
call fcn.1000e47c
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x324], 0x41fd9d08
mov dword [ebp - 0x1000], 5
mov dword [ebp - 0x15e8], 1
mov dword [ebp - 0x15f0], 1
mov dword [ebp - 0x15f8], 0
mov dword [ebp - 0x1600], 0xba2522ab
mov dword [ebp - 0x1608], 0xa260df39
push 2
lea ecx, [ebp - 0x1740]
call fcn.1000e440
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x720], 0x5dbf
mov dword [ebp - 0x400], 0
jmp 0x100146ec
mov eax, dword [ebp - 0x400]
inc eax
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 2
jge 0x1001470e
push dword [ebp - 0x400]
lea ecx, [ebp - 0x1740]
call fcn.1000e49e
mov dword [eax], 0xa5d840df
jmp 0x100146df
cmp dword [ebp - 0x2b0], 0
jne 0x1001472c
cmp dword [ebp - 0x324], 0
je 0x1001472c
mov dword [ebp - 0xd00], 1
jmp 0x10014733
and dword [ebp - 0xd00], 0
cmp dword [ebp - 0xd00], 0x5154
jl 0x1001474b
mov dword [ebp - 0x710], 1
jmp 0x10014752
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x2b0]
imul eax, dword [ebp - 0x710]
cmp eax, 0xf9b6
jg 0x10014772
mov dword [ebp - 0xa60], 1
jmp 0x10014779
and dword [ebp - 0xa60], 0
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0xa60], eax
je 0x10014793
mov dword [ebp - 0x718], 1
jmp 0x1001479a
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x718]
sub eax, dword [ebp - 0x324]
cmp eax, 1
jae 0x100147b7
mov dword [ebp - 0x1010], 1
jmp 0x100147be
and dword [ebp - 0x1010], 0
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x1610], eax
cmp dword [ebp - 0x324], 0xfff7
jb 0x100147e2
mov dword [ebp - 0xe78], 1
jmp 0x100147e9
and dword [ebp - 0xe78], 0
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x1618], eax
cmp dword [ebp - 0x2b0], 0xfffffffb
jle 0x1001480a
mov dword [ebp - 0xc08], 1
jmp 0x10014811
and dword [ebp - 0xc08], 0
mov eax, dword [ebp - 0xc08]
mov dword [ebp - 0x1000], eax
mov eax, dword [ebp - 0x720]
dec eax
mov dword [ebp - 0x720], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1740]
call fcn.1000e47c
mov dword [ebp - 0xa8], 0
jmp 0x10014852
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x1001486e
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x13a8], 0xffffffff
jmp 0x10014845
push 2
lea ecx, [ebp - 0xe34]
call fcn.1000e440
mov dword [ebp - 4], 0xd
push 1
lea ecx, [ebp - 0x5c0]
call fcn.1000e440
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x748], 1
mov dword [ebp - 0xc18], 0xb6f2ba10
mov dword [ebp - 0xe80], 1
mov dword [ebp - 0x48], 0
jmp 0x100148c1
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x100148d7
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x5e8], 0x5baf43b7
jmp 0x100148ba
lea eax, [ebp - 0xe34]
push eax
push 0
lea eax, [ebp - 0x48]
push eax
push 0x452e
push 0x7bc9
call fcn.10028a55
add esp, 0x14
mov dword [ebp - 0x48], 0
jmp 0x10014906
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x1001491f
push dword [ebp - 0x48]
lea ecx, [ebp - 0x5c0]
call fcn.1000e49e
and dword [eax], 0
jmp 0x100148ff
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5e8]
mov dword [ebp - 0xa68], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa68]
mov dword [ebp + eax - 0x5e8], ecx
cmp dword [ebp - 0xa68], 0
je 0x10014972
mov byte [ebp - 0x198], 0
push 0x5422
lea eax, [ebp - 0x198]
push eax
push 0
push 0
call fcn.1001187e
add esp, 0x10
jmp 0x10014ab8
mov dword [ebp - 0x3b8], 0xf0aa6e6f
mov dword [ebp - 0x730], 0x912530a9
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x1620], eax
cmp dword [ebp - 0x3b8], 0x68108531
jl 0x100149bc
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5e8], 0
jne 0x100149bc
xor eax, eax
inc eax
jne 0x100149bc
and dword [ebp - 0x728], 0
jmp 0x100149c6
mov dword [ebp - 0x728], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5e8]
cmp dword [ebp - 0x728], eax
je 0x100149e7
mov dword [ebp - 0xd8c], 1
jmp 0x100149ee
and dword [ebp - 0xd8c], 0
mov eax, dword [ebp - 0xd8c]
mov dword [ebp - 0x730], eax
cmp dword [ebp - 0x730], 0
jne 0x10014a1c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5e8], 0
jne 0x10014a1c
and dword [ebp - 0xa70], 0
jmp 0x10014a26
mov dword [ebp - 0xa70], 1
cmp dword [ebp - 0xa70], 0xffffffff
jg 0x10014a3b
mov dword [ebp - 0x738], 1
jmp 0x10014a42
and dword [ebp - 0x738], 0
cmp dword [ebp - 0x738], 0x4039ee49
jl 0x10014a5a
mov dword [ebp - 0xc10], 1
jmp 0x10014a61
and dword [ebp - 0xc10], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5e8]
add eax, dword [ebp - 0xc10]
cmp dword [ebp - 0x3b8], eax
jle 0x10014a8a
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5e8], 0
push 1
lea ecx, [ebp - 0xe34]
call fcn.1000e49e
mov eax, dword [ebp - 0x3b8]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x5e8]
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x5e8], eax
push 0
lea ecx, [ebp - 0x5c0]
call fcn.1000e49e
cmp dword [eax], 0
jne 0x10014ae5
push 0
lea ecx, [ebp - 0x5c0]
call fcn.1000e49e
cmp dword [eax], 0
jne 0x10014ae5
and dword [ebp - 0x740], 0
jmp 0x10014aef
mov dword [ebp - 0x740], 1
push 1
lea ecx, [ebp - 0xe34]
call fcn.1000e49e
cmp dword [eax], 0xab391500
jne 0x10014b10
mov dword [ebp - 0xa78], 1
jmp 0x10014b17
and dword [ebp - 0xa78], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x740]
mov dword [ebp + eax - 0x5e8], ecx
push 0
lea ecx, [ebp - 0x5c0]
call fcn.1000e49e
mov eax, dword [ebp - 0xa78]
mov dword [ebp - 0x748], eax
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x1628], eax
push 1
lea ecx, [ebp - 0xe34]
call fcn.1000e49e
cmp dword [eax], 0
je 0x10014b7c
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x5e8], 0
je 0x10014b7c
mov dword [ebp - 0xcec], 1
jmp 0x10014b83
and dword [ebp - 0xcec], 0
push 0
lea ecx, [ebp - 0xe34]
call fcn.1000e49e
mov ecx, dword [ebp - 0xcec]
cmp ecx, dword [eax]
je 0x10014ba6
mov dword [ebp - 0x750], 1
jmp 0x10014bad
and dword [ebp - 0x750], 0
push 0
lea ecx, [ebp - 0x5c0]
call fcn.1000e49e
mov ecx, dword [ebp - 0x750]
cmp ecx, dword [eax]
jne 0x10014bd0
mov dword [ebp - 0xa80], 1
jmp 0x10014bd7
and dword [ebp - 0xa80], 0
cmp dword [ebp - 0xa80], 0xfffffff9
jge 0x10014bec
mov dword [ebp - 0x758], 1
jmp 0x10014bf3
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0xc18], eax
mov esi, dword [ebp - 0xc18]
push 0
lea ecx, [ebp - 0x5c0]
call fcn.1000e49e
add esi, dword [eax]
jne 0x10014c28
mov eax, 0x731d497c
test eax, eax
jne 0x10014c28
and dword [ebp - 0x760], 0
jmp 0x10014c32
mov dword [ebp - 0x760], 1
push 0
lea ecx, [ebp - 0x5c0]
call fcn.1000e49e
mov ecx, dword [ebp - 0x760]
cmp ecx, dword [eax]
jl 0x10014c55
mov dword [ebp - 0xa88], 1
jmp 0x10014c5c
and dword [ebp - 0xa88], 0
cmp dword [ebp - 0xa88], 1
jl 0x10014c71
mov dword [ebp - 0x768], 1
jmp 0x10014c78
and dword [ebp - 0x768], 0
push 0
lea ecx, [ebp - 0x5c0]
call fcn.1000e49e
mov ecx, dword [ebp - 0x768]
cmp ecx, dword [eax]
jge 0x10014c9b
mov dword [ebp - 0xd44], 1
jmp 0x10014ca2
and dword [ebp - 0xd44], 0
mov eax, dword [ebp - 0xd44]
mov dword [ebp - 0xe80], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x5c0]
call fcn.1000e47c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe34]
call fcn.1000e47c
mov dword [ebp - 0xa8], 0
jmp 0x10014ce5
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 1
jge 0x10014d01
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x1038], 0xb43d2717
jmp 0x10014cd8
mov dword [ebp - 0x30], 0
jmp 0x10014d11
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jg 0x100163cd
push 1
lea ecx, [ebp - 0x1360]
call fcn.1000e440
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x1014], 8
mov dword [ebp - 0x32c], 0
jmp 0x10014d52
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 1
jge 0x10014d74
push dword [ebp - 0x32c]
lea ecx, [ebp - 0x1360]
call fcn.1000e49e
mov dword [eax], 0x1124f01c
jmp 0x10014d45
lea eax, [ebp - 0x1360]
push eax
push 0
lea eax, [ebp - 0x1014]
push eax
call fcn.1001dc86
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1360]
call fcn.1000e47c
mov dword [ebp - 0x35c], 3
mov dword [ebp - 0x440], 0xffffffff
mov dword [ebp - 0x440], 0
jmp 0x10014dc8
mov eax, dword [ebp - 0x440]
dec eax
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 0xffffffe9
jl 0x10014e60
mov dword [ebp - 0x334], 0x6d444182
mov dword [ebp - 0x334], 0xffffffeb
jmp 0x10014df8
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0xffffffed
jl 0x10014e5b
mov byte [ebp - 0x10f], 0
movzx eax, byte [ebp - 0x10f]
test eax, eax
je 0x10014e2c
push 0
push 0xa63
push 0x2c87
push 0x4698
call fcn.10028871
add esp, 0x10
mov byte [ebp - 0x190], 0
movzx eax, byte [ebp - 0x190]
test eax, eax
je 0x10014e59
push 0x434f
push 0x453a
push 0
push 0x961
push 0
call fcn.10029bfc
add esp, 0x14
jmp 0x10014deb
jmp 0x10014dbb
mov byte [ebp - 0x1a0], 0
push 2
lea ecx, [ebp - 0x10f4]
call fcn.1000e440
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x3c0], 0
jmp 0x10014e94
mov eax, dword [ebp - 0x3c0]
inc eax
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 2
jge 0x10014eb6
push dword [ebp - 0x3c0]
lea ecx, [ebp - 0x10f4]
call fcn.1000e49e
mov dword [eax], 1
jmp 0x10014e87
push 0
lea ecx, [ebp - 0x10f4]
call fcn.1000e49e
or dword [eax], 0xffffffff
jmp 0x10014eec
push 0
lea ecx, [ebp - 0x10f4]
call fcn.1000e49e
mov dword [ebp - 0x770], eax
mov eax, dword [ebp - 0x770]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x770]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x10f4]
call fcn.1000e49e
cmp dword [eax], 0x19
jge 0x10014f14
push 0x4495
push 0x7d82
push 0
call fcn.100232d3
add esp, 0xc
jmp 0x10014ec8
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x10014f3c
push 0
push 0
push 0x13d4
push 0x2f15
call fcn.10010d02
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10f4]
call fcn.1000e47c
movzx eax, byte [ebp - 0x1a0]
test eax, eax
je 0x10015043
mov dword [ebp - 0xe88], 0x32bb
push 4
lea ecx, [ebp - 0x1378]
call fcn.1000e440
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x100c], 1
mov dword [ebp - 0x1630], 8
mov dword [ebp - 0x1638], 0xe65dd4d1
mov dword [ebp - 0x1640], 0
mov dword [ebp - 0xe90], 0xffffffff
mov dword [ebp - 0x33c], 0
jmp 0x10014fc3
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 4
jge 0x10014fe5
push dword [ebp - 0x33c]
lea ecx, [ebp - 0x1378]
call fcn.1000e49e
mov dword [eax], 0x475ee4c2
jmp 0x10014fb6
push 0
lea eax, [ebp - 0xe88]
push eax
push 0x82a
lea eax, [ebp - 0x100c]
push eax
push 0x20e2
lea eax, [ebp - 0x1378]
push eax
call fcn.10027cea
add esp, 0x18
push 0
lea eax, [ebp - 0xe90]
push eax
push 0x919
push 0
push 1
call fcn.100286a3
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1378]
call fcn.1000e47c
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
mov dword [ebp - 0x1bc], 0xb6182eac
mov dword [ebp - 0x101c], 0xdd1d8f8f
mov dword [ebp - 0x1648], 0xab89bdd7
mov dword [ebp - 0x1650], 0x8d9ba5f2
mov dword [ebp - 0xe98], 1
mov dword [ebp - 0x84], 0
jmp 0x1001508e
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x100150aa
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x18cc], 1
jmp 0x10015081
mov dword [ebp - 0x84], 0
jmp 0x100150c3
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x100150df
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x1990], 1
jmp 0x100150b6
mov eax, dword [ebp - 0x1bc]
sub eax, dword [ebp - 0x1bc]
cmp eax, dword [ebp - 0x101c]
jg 0x100150ff
mov dword [ebp - 0xa90], 1
jmp 0x10015106
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 0x1bc]
add eax, dword [ebp - 0xa90]
cmp eax, dword [ebp - 0x1bc]
je 0x10015126
mov dword [ebp - 0x52c], 1
jmp 0x1001512d
and dword [ebp - 0x52c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x52c]
mov dword [ebp + eax - 0x18cc], ecx
mov eax, dword [ebp - 0x1bc]
cmp dword [ebp - 0x52c], eax
jge 0x1001515a
mov dword [ebp - 0x778], 1
jmp 0x10015161
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x778]
mov dword [ebp - 0x1bc], eax
lea eax, [ebp - 0xe98]
push eax
push 0
call fcn.1001e366
pop ecx
pop ecx
mov byte [ebp - 0x192], 0
mov dword [ebp - 0x268], 0xe6c8cac3
mov dword [ebp - 0xf4], 0xffffffff
mov dword [ebp - 0x290], 0xf23e4692
mov dword [ebp - 0x4d4], 0xfffffff7
mov dword [ebp - 0x34c], 0xffffffff
mov dword [ebp - 0x428], 7
mov dword [ebp - 0x578], 0xfffffffa
mov dword [ebp - 0xea8], 4
mov dword [ebp - 0x7b0], 0xfffffffc
mov dword [ebp - 0xc30], 0xaa775beb
mov dword [ebp - 0x10c8], 0xe702d15f
mov dword [ebp - 0x1658], 0xfffc
mov dword [ebp - 0x1024], 0x22e0
cmp dword [ebp - 0x1024], 0x4c3
jge 0x10015352
and dword [ebp - 0x408], 0
lea eax, [ebp - 0x408]
push eax
push 0x1000782c
call fcn.100513ab
pop ecx
pop ecx
and dword [ebp - 0x4bc], 0
and dword [ebp - 0x260], 0
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0xea0], eax
mov eax, dword [ebp - 0x408]
dec eax
mov dword [ebp - 0x408], eax
cmp dword [ebp - 0xea0], 0
je 0x100152aa
lea eax, [ebp - 0x4bc]
push eax
push 0x100077f4
call fcn.100513ab
pop ecx
pop ecx
cmp dword [ebp - 0x4bc], 0
jne 0x10015292
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
jmp 0x100152a8
cmp dword [ebp - 0x4bc], 5
jne 0x100152a8
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
jmp 0x10015245
cmp dword [ebp - 0x344], 9
jl 0x10015331
cmp dword [ebp - 0x260], 0
jle 0x10015331
and dword [ebp - 0x570], 0
jmp 0x100152d2
mov eax, dword [ebp - 0x570]
inc eax
mov dword [ebp - 0x570], eax
mov eax, dword [ebp - 0x344]
cdq
push 9
pop ecx
idiv ecx
cmp dword [ebp - 0x570], eax
jge 0x100152f3
push 0x100078e0
call fcn.100515a0
pop ecx
jmp 0x100152c5
and dword [ebp - 0x4c4], 0
jmp 0x10015309
mov eax, dword [ebp - 0x4c4]
inc eax
mov dword [ebp - 0x4c4], eax
mov eax, dword [ebp - 0x4c4]
cmp eax, dword [ebp - 0x260]
jge 0x10015324
push 0x100078e4
call fcn.100515a0
pop ecx
jmp 0x100152fc
push 0x100078e8
call fcn.100515a0
pop ecx
jmp 0x10015352
cmp dword [ebp - 0x260], 0
jle 0x10015347
push 0x100078e4
call fcn.1005170c
pop ecx
jmp 0x10015352
push 0x100078ec
call fcn.1005170c
pop ecx
mov dword [ebp - 0x3c8], 0
jmp 0x1001536b
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 4
jge 0x10015387
mov eax, dword [ebp - 0x3c8]
mov dword [ebp + eax*4 - 0x5a8], 0xffffffff
jmp 0x1001535e
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5a8]
push 4
pop ecx
imul ecx, ecx, 3
imul eax, dword [ebp + ecx - 0x5a8]
test eax, eax
jne 0x100153b1
mov dword [ebp - 0xc20], 1
jmp 0x100153b8
and dword [ebp - 0xc20], 0
push 4
pop eax
imul eax, eax, 3
push 0xfffffffffffffffd
pop ecx
sub ecx, dword [ebp + eax - 0x5a8]
je 0x100153da
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x5a8], 0
jne 0x100153f3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5a8], 0
jne 0x100153f3
and dword [ebp - 0x780], 0
jmp 0x100153fd
mov dword [ebp - 0x780], 1
mov eax, dword [ebp - 0xc20]
cmp eax, dword [ebp - 0x780]
jl 0x100155c0
mov dword [ebp - 0x1ec], 0x3735b263
mov dword [ebp - 0x1660], 0xfffffff6
mov dword [ebp - 0x1668], 7
mov dword [ebp - 0x1018], 0xc9d94031
mov dword [ebp - 0x1670], 0xf14186e1
mov dword [ebp - 0x1ec], 0
jmp 0x1001545a
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 3
jg 0x100155be
mov dword [ebp - 0x4cc], 0x6d0c11e0
push 1
lea ecx, [ebp - 0x1104]
call fcn.1000e440
mov dword [ebp - 4], 0x12
lea eax, [ebp - 0x1104]
push eax
lea eax, [ebp - 0x1678]
push eax
push 0
call fcn.10022b5c
add esp, 0xc
mov eax, dword [ebp - 0x34c]
dec eax
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x4cc]
cmp eax, dword [ebp - 0x34c]
jle 0x100154c4
mov dword [ebp - 0xa98], 1
jmp 0x100154cb
and dword [ebp - 0xa98], 0
push 0
lea ecx, [ebp - 0x1104]
call fcn.1000e49e
mov ecx, dword [ebp - 0xa98]
cmp ecx, dword [eax]
jge 0x100154ee
mov dword [ebp - 0x534], 1
jmp 0x100154f5
and dword [ebp - 0x534], 0
push 0
lea ecx, [ebp - 0x1104]
call fcn.1000e49e
mov ecx, dword [ebp - 0x534]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1ec]
cmp eax, dword [ebp - 0x534]
jne 0x10015524
mov dword [ebp - 0x788], 1
jmp 0x1001552b
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0
je 0x10015546
mov eax, dword [ebp - 0x268]
mov eax, dword [ebp - 0x4cc]
cmp dword [ebp - 0x4cc], eax
je 0x10015560
mov dword [ebp - 0xcf4], 1
jmp 0x10015567
and dword [ebp - 0xcf4], 0
mov eax, dword [ebp - 0x1ec]
imul eax, dword [ebp - 0xcf4]
cmp eax, 1
jbe 0x10015597
push 0
lea ecx, [ebp - 0x1104]
call fcn.1000e49e
cmp dword [eax], 0
je 0x10015597
mov dword [ebp - 0x790], 1
jmp 0x1001559e
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x790]
mov dword [ebp - 0x1018], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1104]
call fcn.1000e47c
jmp 0x1001544d
jmp 0x10015618
mov dword [ebp - 0xf4], 0
jmp 0x100155d9
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 4
jge 0x100155f5
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x5a8], 0xffffffff
jmp 0x100155cc
mov byte [ebp - 0x113], 0
movzx eax, byte [ebp - 0x113]
test eax, eax
je 0x10015618
push 1
push 0x5fed
push 0
call fcn.10010851
add esp, 0xc
cmp dword [ebp - 0x268], 0
je 0x10015887
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5a8]
cmp dword [ebp - 0x268], eax
jge 0x10015646
mov dword [ebp - 0xaa0], 1
jmp 0x1001564d
and dword [ebp - 0xaa0], 0
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0xaa0], eax
jne 0x1001566d
mov eax, 0xabd3
test eax, eax
jne 0x1001566d
and dword [ebp - 0x798], 0
jmp 0x10015677
mov dword [ebp - 0x798], 1
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x578]
cmp dword [ebp - 0x428], eax
je 0x1001569d
mov dword [ebp - 0xc28], 1
jmp 0x100156a4
and dword [ebp - 0xc28], 0
mov eax, dword [ebp - 0xea8]
add eax, dword [ebp - 0xc28]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x5a8]
jge 0x100156ca
mov dword [ebp - 0x7a0], 1
jmp 0x100156d1
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x34c]
cmp dword [ebp - 0x7a0], eax
je 0x100156eb
mov dword [ebp - 0xaa8], 1
jmp 0x100156f2
and dword [ebp - 0xaa8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5a8]
cmp dword [ebp - 0xaa8], eax
je 0x10015712
mov dword [ebp - 0x1158], 1
jmp 0x10015719
and dword [ebp - 0x1158], 0
cmp dword [ebp - 0x4d4], 1
jg 0x1001572e
mov dword [ebp - 0x7a8], 1
jmp 0x10015735
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x7b0]
cmp dword [ebp - 0x7a8], eax
jg 0x1001574f
mov dword [ebp - 0xdb8], 1
jmp 0x10015756
and dword [ebp - 0xdb8], 0
mov eax, dword [ebp - 0xdb8]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x578]
cmp dword [ebp - 0x290], eax
jle 0x1001577c
mov dword [ebp - 0xeb0], 1
jmp 0x10015783
and dword [ebp - 0xeb0], 0
cmp dword [ebp - 0x578], 0xa5db
jg 0x1001579b
mov dword [ebp - 0xab0], 1
jmp 0x100157a2
and dword [ebp - 0xab0], 0
mov eax, dword [ebp - 0x7b0]
cmp dword [ebp - 0xab0], eax
jg 0x100157bc
mov dword [ebp - 0x7b8], 1
jmp 0x100157c3
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x4d4]
imul eax, dword [ebp - 0x7b8]
mov dword [ebp - 0x4d4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5a8]
cmp dword [ebp - 0xc30], eax
jge 0x100157f7
mov dword [ebp - 0x1020], 1
jmp 0x100157fe
and dword [ebp - 0x1020], 0
cmp dword [ebp - 0x428], 0x338
jl 0x10015816
mov dword [ebp - 0x7c0], 1
jmp 0x1001581d
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0xc30]
cmp dword [ebp - 0x7c0], eax
jge 0x10015837
mov dword [ebp - 0xab8], 1
jmp 0x1001583e
and dword [ebp - 0xab8], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x5a8]
cmp dword [ebp - 0xab8], eax
jg 0x1001585f
mov dword [ebp - 0x7c8], 1
jmp 0x10015866
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0x7c8]
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
je 0x10015887
mov dword [ebp - 0xcfc], 1
jmp 0x1001588e
and dword [ebp - 0xcfc], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0xcfc]
jl 0x100158b4
mov dword [ebp - 0xeb8], 1
jmp 0x100158bb
and dword [ebp - 0xeb8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5a8]
mov dword [ebp - 0x1680], eax
cmp dword [ebp - 0x428], 0x42e27698
jne 0x100158e5
mov dword [ebp - 0x7d0], 1
jmp 0x100158ec
and dword [ebp - 0x7d0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x7d0]
sub ecx, dword [ebp + eax - 0x5a8]
mov dword [ebp - 0x10c8], ecx
movzx eax, byte [ebp - 0x192]
test eax, eax
je 0x10015935
push 0x51dc
push 0x52a7
push 0x72bc
push 0x3176
push 0
push 0x1938
push 1
call fcn.1001176d
add esp, 0x1c
push 2
lea ecx, [ebp - 0x1114]
call fcn.1000e440
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x144], 0x490c4d8e
mov dword [ebp - 0x1688], 4
push 0
lea eax, [ebp - 0x1114]
push eax
lea eax, [ebp - 0x1690]
push eax
push 0x46ed
call fcn.1001e8a3
add esp, 0x10
mov dword [ebp - 0x144], 0
jmp 0x10015993
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jg 0x10015b9b
mov dword [ebp - 0x1698], 0xfffffffa
mov dword [ebp - 0x16a0], 0xfffffff6
mov dword [ebp - 0x16a8], 0x89a278c0
mov dword [ebp - 0x1298], 0xb09f5954
mov dword [ebp - 0x1294], 0xb09f5954
mov dword [ebp - 0x1290], 0xb09f5954
mov dword [ebp - 0x128c], 0xb09f5954
lea ecx, [ebp - 0x585]
call fcn.1000efe6
push eax
lea eax, [ebp - 0x1288]
push eax
lea eax, [ebp - 0x1298]
push eax
lea ecx, [ebp - 0x1910]
call fcn.1002f69f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1750]
call fcn.1002f5e8
mov byte [ebp - 4], 0x14
mov dword [ebp - 0xec0], 1
push dword [ebp - 0x144]
lea ecx, [ebp - 0x1114]
call fcn.1000e49e
cmp dword [eax], 0
je 0x10015b3d
mov dword [ebp - 0x3d0], 1
mov dword [ebp - 0x16b0], 0xd76715f0
mov dword [ebp - 0x16b8], 2
mov dword [ebp - 0x16c0], 0x8e64e6dc
mov dword [ebp - 0x16c8], 0x7304
mov dword [ebp - 0x354], 0
jmp 0x10015a8e
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 3
jge 0x10015aaa
mov eax, dword [ebp - 0x354]
mov dword [ebp + eax*4 - 0x1980], 0xc257a10d
jmp 0x10015a81
mov dword [ebp - 0x3d0], 1
jmp 0x10015ac3
mov eax, dword [ebp - 0x3d0]
dec eax
mov dword [ebp - 0x3d0], eax
cmp dword [ebp - 0x3d0], 0
jl 0x10015b3b
mov dword [ebp - 0x16d0], 6
mov dword [ebp - 0x16d8], 0x7d711e7b
mov dword [ebp - 0x16e0], 0xffffffff
mov dword [ebp - 0x16e8], 0xfffffff6
mov dword [ebp - 0x16f0], 1
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x10015b1e
push 0x3472
push 0
call fcn.10011b5e
pop ecx
pop ecx
lea eax, [ebp - 0xec0]
push eax
push 1
push 0x4fa4
push 0
call fcn.10010a55
add esp, 0x10
jmp 0x10015ab6
jmp 0x10015b87
mov dword [ebp - 0x1028], 0xffffffff
mov esi, dword [ebp - 0x1028]
push dword [ebp - 0x144]
lea ecx, [ebp - 0x1114]
call fcn.1000e49e
mov dword [eax], esi
push dword [ebp - 0x144]
lea ecx, [ebp - 0x1114]
call fcn.1000e49e
cmp dword [eax], 0
je 0x10015b87
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1750]
call fcn.1000e47c
jmp 0x10015b9b
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x1750]
call fcn.1000e47c
jmp 0x10015986
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1114]
call fcn.1000e47c
mov dword [ebp - 0x35c], 2
jmp 0x10015bc3
cmp dword [ebp - 0x35c], 0
jl 0x100163c8
push 2
lea ecx, [ebp - 0x3f0]
call fcn.1000e440
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x2a8], 0x10b49f2b
mov dword [ebp - 0xb0], 0
jmp 0x10015c07
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x10015c29
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x3f0]
call fcn.1000e49e
mov dword [eax], 6
jmp 0x10015bfa
mov dword [ebp - 0xb0], 0
jmp 0x10015c42
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x10015c5e
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x364], 0
jmp 0x10015c35
push 0
lea ecx, [ebp - 0x3f0]
call fcn.1000e49e
cmp dword [eax], 0
je 0x10015e02
mov dword [ebp - 0x50], 0x43d837bc
mov dword [ebp - 0xed0], 6
mov dword [ebp - 0x50], 0
jmp 0x10015c95
cmp dword [ebp - 0x50], 0xffffffe7
jne 0x10015dfd
mov dword [ebp - 0xec8], 0xca29
mov dword [ebp - 0x11a8], 1
mov dword [ebp - 0x410], 0
jmp 0x10015ccc
mov eax, dword [ebp - 0x410]
inc eax
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 2
jge 0x10015ce8
mov eax, dword [ebp - 0x410]
mov dword [ebp + eax*4 - 0x14a0], 1
jmp 0x10015cbf
cmp dword [ebp - 0xec8], 0
je 0x10015cf6
jmp 0x10015dfd
push 0
lea ecx, [ebp - 0x3f0]
call fcn.1000e49e
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x16f8], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1700], eax
cmp dword [ebp - 0x50], 1
jb 0x10015d27
mov dword [ebp - 0xac0], 1
jmp 0x10015d2e
and dword [ebp - 0xac0], 0
cmp dword [ebp - 0xac0], 0x6fe6
jl 0x10015d46
jmp 0x10016062
mov dword [ebp - 0x7f8], 4
push 1
lea ecx, [ebp - 0x11c0]
call fcn.1000e440
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x800], 0xe26a25a9
push 0
push 0x6b50
lea eax, [ebp - 0x11c0]
push eax
lea eax, [ebp - 0x1708]
push eax
call fcn.1001de7e
add esp, 0x10
push 0
lea ecx, [ebp - 0x3f0]
call fcn.1000e49e
mov ecx, dword [ebp - 0x7f8]
cmp dword [eax], ecx
je 0x10015e67
mov dword [ebp - 0xd4c], 1
jmp 0x10015e6e
and dword [ebp - 0xd4c], 0
push 0
lea ecx, [ebp - 0x3f0]
call fcn.1000e49e
mov ecx, dword [ebp - 0xd4c]
cmp ecx, dword [eax]
jne 0x10015e91
mov dword [ebp - 0x7f0], 1
jmp 0x10015e98
and dword [ebp - 0x7f0], 0
mov eax, dword [ebp - 0x7f0]
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0
je 0x10015ec2
cmp dword [ebp - 0x2a8], 0
je 0x10015ec2
mov dword [ebp - 0xad0], 1
jmp 0x10015ec9
and dword [ebp - 0xad0], 0
push 0
lea ecx, [ebp - 0x3f0]
call fcn.1000e49e
mov ecx, dword [ebp - 0xad0]
add ecx, 3
cmp dword [eax], ecx
jg 0x10015eef
mov dword [ebp - 0x1030], 1
jmp 0x10015ef6
and dword [ebp - 0x1030], 0
push 0
lea ecx, [ebp - 0x3f0]
call fcn.1000e49e
mov eax, dword [ebp - 0x7f8]
mov dword [ebp - 0xc40], eax
push 0
lea ecx, [ebp - 0x11c0]
call fcn.1000e49e
mov ecx, dword [ebp - 0xc40]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc40]
mov dword [ebp - 0x800], eax
cmp dword [ebp - 0x800], 0xffff
jne 0x10015f48
mov dword [ebp - 0xad8], 1
jmp 0x10015f4f
and dword [ebp - 0xad8], 0
push 0
lea ecx, [ebp - 0x3f0]
call fcn.1000e49e
mov ecx, dword [ebp - 0xad8]
cmp ecx, dword [eax]
jle 0x10015f72
mov dword [ebp - 0x808], 1
jmp 0x10015f79
and dword [ebp - 0x808], 0
cmp dword [ebp - 0x808], 0x12dc6d0f
je 0x10015f91
mov esi, dword [ebp - 0x2a8]
push 0
lea ecx, [ebp - 0x3f0]
call fcn.1000e49e
cmp esi, dword [eax]
jg 0x10016085
mov dword [ebp - 0xc48], 1
jmp 0x1001608c
and dword [ebp - 0xc48], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x364]
add eax, dword [ebp - 0xc48]
cmp eax, 9
je 0x100160b0
mov dword [ebp - 0x820], 1
jmp 0x100160b7
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x2a8]
cmp eax, dword [ebp - 0x820]
jg 0x100160d1
mov dword [ebp - 0xae8], 1
jmp 0x100160d8
and dword [ebp - 0xae8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x364]
cmp dword [ebp - 0xae8], eax
jg 0x100160f9
jmp 0x10014d0a
push 1
lea ecx, [ebp - 0x1124]
call fcn.1000e440
mov dword [ebp - 4], 0x1a
push 0x1993
lea eax, [ebp - 0x1860]
push eax
lea eax, [ebp - 0x1124]
push eax
push 0x46a8
push 0
push 0
call fcn.10011c0b
add esp, 0x18
push 0
lea ecx, [ebp - 0x1124]
call fcn.1000e49e
mov dword [eax], 1
jmp 0x1001643e
push 0
lea ecx, [ebp - 0x1124]
call fcn.1000e49e
mov dword [ebp - 0x830], eax
mov eax, dword [ebp - 0x830]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x830]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1124]
call fcn.1000e49e
cmp dword [eax], 0xfffffff6
je 0x10016471
mov byte [ebp - 0x186], 0
push 0
push 0x6fd2
lea eax, [ebp - 0x186]
push eax
push 0
call fcn.10011ae6
add esp, 0x10
jmp 0x1001641a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1124]
call fcn.1000e47c
cmp dword [ebp - 0x30], 0
jne 0x10016526
cmp dword [ebp - 0x30], 0
je 0x100164ba
mov eax, dword [ebp - 0x30]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x13a8]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x13a8]
jg 0x100164ba
mov dword [ebp - 0xaf0], 1
jmp 0x100164c1
and dword [ebp - 0xaf0], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0xaf0]
jl 0x100164d8
mov dword [ebp - 0x838], 1
jmp 0x100164df
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x838]
mov dword [ebp - 0xc50], eax
mov eax, dword [ebp - 0xc50]
mov dword [ebp - 0x840], eax
cmp dword [ebp - 0x840], 0
jne 0x1001650c
mov dword [ebp - 0x53c], 1
jmp 0x10016513
and dword [ebp - 0x53c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x53c]
mov dword [ebp + eax - 0x1038], ecx
mov eax, 0xe491ba6b
cmp eax, 0x7e7c14ab
ja 0x1001653e
mov dword [ebp - 0xaf8], 1
jmp 0x10016545
and dword [ebp - 0xaf8], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0xaf8], eax
je 0x1001655c
mov dword [ebp - 0x848], 1
jmp 0x10016563
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x848]
jg 0x1001657a
mov dword [ebp - 0xd0c], 1
jmp 0x10016581
and dword [ebp - 0xd0c], 0
cmp dword [ebp - 0xd0c], 1
jle 0x1001659a
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x1001659a
and dword [ebp - 0x850], 0
jmp 0x100165a4
mov dword [ebp - 0x850], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x850]
sub ecx, dword [ebp + eax - 0x13a8]
cmp ecx, 0x20dd
jne 0x100165cb
mov dword [ebp - 0xb00], 1
jmp 0x100165d2
and dword [ebp - 0xb00], 0
mov eax, dword [ebp - 0xb00]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x3e0], 0x4f833fcb
mov dword [ebp - 0x374], 0
jmp 0x100165fe
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 1
jge 0x1001661a
mov eax, dword [ebp - 0x374]
mov dword [ebp + eax*4 - 0xee8], 0
jmp 0x100165f1
push 0x5430
push 0
push 0x3ac8
push 0x6e9c
push 0x51e4
push 0
call fcn.1001e3b7
add esp, 0x18
mov dword [ebp - 0x3e0], 0
jmp 0x10016653
mov eax, dword [ebp - 0x3e0]
dec eax
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0x3e0], 0
jl 0x100167f3
mov dword [ebp - 0x8c], 1
mov dword [ebp - 0x1890], 0xfffffffe
mov dword [ebp - 0x1898], 1
mov dword [ebp - 0x18a0], 0
mov dword [ebp - 0x18a8], 0x735b263d
mov dword [ebp - 0x18b0], 5
push 1
lea ecx, [ebp - 0x1770]
call fcn.1000e440
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x1168], 4
mov dword [ebp - 0x37c], 0
jmp 0x100166d3
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 1
jge 0x100166f5
push dword [ebp - 0x37c]
lea ecx, [ebp - 0x1770]
call fcn.1000e49e
mov dword [eax], 0x956e74e8
jmp 0x100166c6
mov dword [ebp - 0x8c], 0
jmp 0x1001670e
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jg 0x10016780
mov byte [ebp - 0x194], 0
movzx eax, byte [ebp - 0x194]
test eax, eax
je 0x1001676c
push 0x6c2d
push 0x1818
push 0x21ba
push 0x16fc
push 0x567b
push 0x56aa
push 0x31ab
push 0x4c2b
push 1
push 0x460f
push 0x6f2a
push 0
push 0x1174
call fcn.10010dad
add esp, 0x34
mov eax, dword [ebp - 0x8c]
cmp dword [ebp + eax*4 - 0xee8], 0
je 0x1001677e
jmp 0x10016701
jmp 0x10016701
mov dword [ebp - 0x8c], 0
jmp 0x10016799
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jl 0x100167df
mov dword [ebp - 0x18b8], 0xdfd9
mov dword [ebp - 0x18c0], 0x9753589f
mov dword [ebp - 0x180c], 0
mov dword [ebp - 0x14f4], 0x302aff63
push 1
lea eax, [ebp - 0x1168]
push eax
push 1
call fcn.10010851
add esp, 0xc
jmp 0x1001678c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1770]
call fcn.1000e47c
jmp 0x10016646
mov eax, dword [ebp - 0xef0]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x530], eax
mov dword [ebp - 0x1040], 0x1446
cmp dword [ebp - 0x1040], 0x41f
jge 0x100169a8
and dword [ebp - 0x4dc], 0
and dword [ebp - 0xc58], 0
and dword [ebp - 0x58c], 0
lea eax, [ebp - 0x58c]
push eax
lea eax, [ebp - 0xc58]
push eax
lea eax, [ebp - 0x4dc]
push eax
push 0x100078f0
call fcn.100513ab
add esp, 0x10
lea ecx, [ebp - 0xdd0]
call fcn.1000e433
mov dword [ebp - 4], 0x1c
or dword [ebp - 0xef8], 0xffffffff
lea eax, [ebp - 0xef8]
push eax
lea ecx, [ebp - 0xdd0]
call fcn.1002f76a
and dword [ebp - 0x418], 0
jmp 0x10016894
mov eax, dword [ebp - 0x418]
inc eax
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x418]
cmp eax, dword [ebp - 0x4dc]
jge 0x100168ea
and dword [ebp - 0x858], 0
lea eax, [ebp - 0x858]
push eax
push 0x100077f8
call fcn.100513ab
pop ecx
pop ecx
mov eax, dword [ebp - 0x858]
cmp eax, dword [ebp - 0xc58]
jle 0x100168e8
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x10d8], eax
lea eax, [ebp - 0x10d8]
push eax
lea ecx, [ebp - 0xdd0]
call fcn.1002f76a
jmp 0x10016887
lea eax, [ebp - 0x4dc]
push eax
lea ecx, [ebp - 0xdd0]
call fcn.1002f76a
and dword [ebp - 0x4e4], 0
and dword [ebp - 0x270], 0
jmp 0x10016919
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
mov esi, dword [ebp - 0x270]
inc esi
lea ecx, [ebp - 0xdd0]
call fcn.1000f7d8
cmp esi, eax
jae 0x10016987
mov eax, dword [ebp - 0x270]
inc eax
push eax
lea ecx, [ebp - 0xdd0]
call fcn.1000e49e
mov esi, eax
push dword [ebp - 0x270]
lea ecx, [ebp - 0xdd0]
call fcn.1000e49e
mov ecx, dword [esi]
sub ecx, dword [eax]
mov dword [ebp - 0x860], ecx
mov eax, dword [ebp - 0x860]
cmp eax, dword [ebp - 0x58c]
jle 0x10016985
mov eax, dword [ebp - 0x860]
sub eax, dword [ebp - 0x58c]
add eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x4e4], eax
jmp 0x1001690c
push dword [ebp - 0x4e4]
push 0x10007804
call fcn.100515a0
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdd0]
call fcn.1000e47c
mov dword [ebp - 0x298], 0x2c03342e
mov dword [ebp - 0x298], 0
jmp 0x100169cb
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0x1b
jne 0x100169f6
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x100169f4
push 0
push 0x209c
call fcn.10026e12
pop ecx
pop ecx
jmp 0x100169be
push 0
lea eax, [ebp - 0x298]
push eax
call fcn.10028687
pop ecx
pop ecx
push 1
lea ecx, [ebp - 0x13c0]
call fcn.1000e440
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0xf00], 8
mov dword [ebp - 0x384], 0
jmp 0x10016a3d
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 1
jge 0x10016a5f
push dword [ebp - 0x384]
lea ecx, [ebp - 0x13c0]
call fcn.1000e49e
mov dword [eax], 0x1124f01c
jmp 0x10016a30
push 1
lea eax, [ebp - 0x13c0]
push eax
lea eax, [ebp - 0xf00]
push eax
push 0
call fcn.100111ef
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c0]
call fcn.1000e47c
push 4
lea ecx, [ebp - 0x11e4]
call fcn.1000e440
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x868], 0xfffffffa
mov dword [ebp - 0xf08], 0x62939c01
mov dword [ebp - 0x11a0], 0xffffffff
push 2
lea ecx, [ebp - 0x13d8]
call fcn.1000e440
mov byte [ebp - 4], 0x1f
lea eax, [ebp - 0x11e4]
push eax
push 0
push 1
lea eax, [ebp - 0x1048]
push eax
call fcn.10010ef1
add esp, 0x10
push 0x7dd1
push 0x2ee0
push 0
lea eax, [ebp - 0x13d8]
push eax
lea eax, [ebp - 0x1048]
push eax
push 0x4656
call fcn.10012009
add esp, 0x18
push 1
lea ecx, [ebp - 0x11e4]
call fcn.1000e49e
cmp dword [eax], 0xa53a
jge 0x10016b2d
mov dword [ebp - 0xb08], 1
jmp 0x10016b34
and dword [ebp - 0xb08], 0
mov eax, dword [ebp - 0xb08]
mov dword [ebp - 0x868], eax
lea eax, [ebp - 0x11e4]
push eax
push 0x4fe6
push 0xbdb
lea eax, [ebp - 0x13d8]
push eax
lea eax, [ebp - 0x868]
push eax
lea eax, [ebp - 0xf08]
push eax
lea eax, [ebp - 0x11a0]
push eax
push 0x2473
push 0
call fcn.10026ea7
add esp, 0x24
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x13d8]
call fcn.1000e47c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11e4]
call fcn.1000e47c
mov dword [ebp - 0x308], 0x4f833fcb
push 2
lea ecx, [ebp - 0x1134]
call fcn.1000e440
mov dword [ebp - 4], 0x20
mov dword [ebp - 0x390], 0
jmp 0x10016bd1
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 2
jge 0x10016bf3
push dword [ebp - 0x390]
lea ecx, [ebp - 0x1134]
call fcn.1000e49e
mov dword [eax], 1
jmp 0x10016bc4
push 0
lea ecx, [ebp - 0x1134]
call fcn.1000e49e
or dword [eax], 0xffffffff
jmp 0x10016c29
push 0
lea ecx, [ebp - 0x1134]
call fcn.1000e49e
mov dword [ebp - 0xd5c], eax
mov eax, dword [ebp - 0xd5c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xd5c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1134]
call fcn.1000e49e
cmp dword [eax], 0x19
jge 0x10016c5a
mov byte [ebp - 0x155], 0
push 0x2645
lea eax, [ebp - 0x155]
push eax
push 0
call fcn.100210a0
add esp, 0xc
jmp 0x10016c05
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x10016c7b
push 1
push 0
push 0x1b90
call dword [sym.imp.USER32.dll_SetWindowRgn]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1134]
call fcn.1000e47c
mov dword [ebp - 0x2cc], 0
jmp 0x10016ca3
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 1
jge 0x10016cbf
mov eax, dword [ebp - 0x2cc]
mov dword [ebp + eax*4 - 0xfc8], 0
jmp 0x10016c96
mov dword [ebp - 0x204], 0xfffffff7
mov dword [ebp - 0xd14], 0x285faafe
mov dword [ebp - 0x2d8], 0x245f5b1b
mov dword [ebp - 0x22c], 0xdca27289
mov dword [ebp - 0xc60], 1
mov dword [ebp - 0x1cc], 9
mov dword [ebp - 0x4ec], 0x72b752bf
mov dword [ebp - 0x544], 4
mov dword [ebp - 0xf18], 0x889b
mov dword [ebp - 0xc78], 0x2089ce3
mov dword [ebp - 0x1664], 1
push 4
lea ecx, [ebp - 0x133c]
call fcn.1000e440
mov dword [ebp - 4], 0x21
mov dword [ebp - 0xb40], 0
mov dword [ebp - 0x230], 0
jmp 0x10016d64
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 1
jge 0x10016d80
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0x574], 0x66e9f086
jmp 0x10016d57
push 0
push 0x5266
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x133c]
push eax
push 0x56e1
call fcn.10023075
add esp, 0x14
mov byte [ebp - 0x187], 0
push 0
lea eax, [ebp - 0x187]
push eax
push 0x601e
push 0x66ea
push 0x893
push 0x5b5f
call fcn.10028835
add esp, 0x18
mov eax, dword [ebp - 0xd14]
mov dword [ebp - 0x1420], eax
mov eax, dword [ebp - 0x544]
mov ecx, dword [ebp - 0x544]
inc ecx
mov dword [ebp - 0x544], ecx
test eax, eax
je 0x10016e25
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x870], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x870]
mov dword [ebp + eax - 0x574], ecx
cmp dword [ebp - 0x870], 0
je 0x10016e25
mov dword [ebp - 0xb10], 1
jmp 0x10016e2c
and dword [ebp - 0xb10], 0
mov eax, dword [ebp - 0xc60]
cmp dword [ebp - 0xb10], eax
jl 0x10016e46
mov dword [ebp - 0x878], 1
jmp 0x10016e4d
and dword [ebp - 0x878], 0
mov eax, dword [ebp - 0x4ec]
add eax, dword [ebp - 0x878]
cmp eax, dword [ebp - 0xc60]
jle 0x10016e6d
mov dword [ebp - 0x880], 1
jmp 0x10016e74
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0x22c]
cmp dword [ebp - 0x880], eax
jg 0x10016e8e
mov dword [ebp - 0xb18], 1
jmp 0x10016e95
and dword [ebp - 0xb18], 0
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0xb18], eax
jl 0x10016eaa
cmp dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x1794], eax
mov eax, 0xf3d3
cmp eax, 0x64fe
jne 0x10016ece
mov dword [ebp - 0x888], 1
jmp 0x10016ed5
and dword [ebp - 0x888], 0
cmp dword [ebp - 0x888], 0xffffffff
jg 0x10016eea
mov dword [ebp - 0xf10], 1
jmp 0x10016ef1
and dword [ebp - 0xf10], 0
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x1428], eax
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x166c], eax
mov eax, dword [ebp - 0xd14]
cmp dword [ebp - 0x1cc], eax
jle 0x10016f23
mov dword [ebp - 0x1050], 1
jmp 0x10016f2a
and dword [ebp - 0x1050], 0
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x1430], eax
mov dword [ebp - 0x204], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x574]
cmp dword [ebp - 0x204], eax
jg 0x10016f83
mov byte [ebp - 0x125], 0
push 0
lea eax, [ebp - 0x125]
push eax
push 0
push 0x595d
push 0x6677
push 0xbd7
call fcn.100108a8
add esp, 0x18
jmp 0x10017429
mov dword [ebp - 0x1c4], 0xaf09d89c
mov dword [ebp - 0xb20], 1
mov dword [ebp - 0x8c0], 0xc23faab9
mov dword [ebp - 0xf28], 3
mov dword [ebp - 0x1058], 0x11c0d400
mov dword [ebp - 0x2d0], 0
jmp 0x10016fce
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 2
jge 0x10016fea
mov eax, dword [ebp - 0x2d0]
mov dword [ebp + eax*4 - 0x11ec], 0
jmp 0x10016fc1
mov eax, dword [ebp - 0xc78]
mov dword [ebp - 0x18b4], eax
mov eax, dword [ebp - 0x1c4]
add eax, 9
cmp eax, 0x4971
jne 0x10017017
xor eax, eax
inc eax
je 0x10017017
mov dword [ebp - 0x890], 1
jmp 0x1001701e
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0xf18]
mov dword [ebp - 0xb20], eax
mov eax, dword [ebp - 0x890]
sub eax, 0x358db2ed
cmp dword [ebp - 0xb20], eax
je 0x10017049
mov dword [ebp - 0x898], 1
jmp 0x10017050
and dword [ebp - 0x898], 0
cmp dword [ebp - 0x898], 0x825d
je 0x10017068
mov dword [ebp - 0xc68], 1
jmp 0x1001706f
and dword [ebp - 0xc68], 0
mov eax, dword [ebp - 0xc68]
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x2d8], eax
jne 0x10017095
mov dword [ebp - 0x8a0], 1
jmp 0x1001709c
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x1c4]
cmp eax, dword [ebp - 0x8a0]
je 0x100170b6
mov dword [ebp - 0xb28], 1
jmp 0x100170bd
and dword [ebp - 0xb28], 0
mov eax, dword [ebp - 0x4ec]
cmp eax, dword [ebp - 0xb28]
jle 0x100170dd
cmp dword [ebp - 0x22c], 0
jne 0x100170dd
and dword [ebp - 0x8a8], 0
jmp 0x100170e7
mov dword [ebp - 0x8a8], 1
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x8a8], eax
jg 0x10017101
mov dword [ebp - 0xda0], 1
jmp 0x10017108
and dword [ebp - 0xda0], 0
mov eax, dword [ebp - 0x1cc]
cmp dword [ebp - 0xda0], eax
je 0x10017122
mov dword [ebp - 0x8b0], 1
jmp 0x10017129
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x8b0], eax
jne 0x10017143
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x133c]
call fcn.1000e47c
mov dword [ebp - 0xf38], 0x62d5e48d
mov dword [ebp - 0xf30], 0xfffffffb
mov dword [ebp - 0x1060], 1
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x10017485
push 1
push 0x315e
push 0
push 0x36cf
push 0x54
push 0x707a
call fcn.100108a8
add esp, 0x18
lea eax, [ebp - 0xf30]
push eax
push 0
lea eax, [ebp - 0x1060]
push eax
push 0x2eb4
lea eax, [ebp - 0xf38]
push eax
push 1
call fcn.1001e3b7
add esp, 0x18
mov byte [ebp - 0x189], 0
movzx eax, byte [ebp - 0x189]
test eax, eax
je 0x100176a9
mov dword [ebp - 0x1068], 0xfcb1
mov dword [ebp - 0x10f8], 0x815898f0
mov dword [ebp - 0xf40], 0x5fdc8dfb
mov dword [ebp - 0x8e8], 0xf889e022
mov dword [ebp - 0x8f0], 0xffffffff
mov dword [ebp - 0x14c], 0x63b0a6d0
mov dword [ebp - 0xf48], 0x90aec51
lea eax, [ebp - 0x10f8]
push eax
lea eax, [ebp - 0x8e8]
push eax
lea eax, [ebp - 0xf40]
push eax
push 0
lea eax, [ebp - 0x1068]
push eax
lea eax, [ebp - 0x8f0]
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.100291b9
add esp, 0x1c
mov dword [ebp - 0x14c], 9
jmp 0x10017554
mov eax, dword [ebp - 0x14c]
dec eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 2
jne 0x10017689
mov dword [ebp - 0x234], 8
mov dword [ebp - 0xb50], 0xfffffffa
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x1450], eax
mov eax, dword [ebp - 0x234]
imul eax, dword [ebp - 0x8e8]
test eax, eax
je 0x1001759b
cmp dword [ebp - 0x14c], 0
jne 0x100175a2
cmp dword [ebp - 0x234], 0
cmp dword [ebp - 0x234], 9
ja 0x100175b7
mov dword [ebp - 0xd6c], 1
jmp 0x100175be
and dword [ebp - 0xd6c], 0
mov eax, dword [ebp - 0xd6c]
mov dword [ebp - 0x8f0], eax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0xb50], eax
mov eax, dword [ebp - 0xb50]
sub eax, dword [ebp - 0xf48]
je 0x1001762e
mov dword [ebp - 0x2f0], 0
jmp 0x100175fd
cmp dword [ebp - 0x2f0], 3
jge 0x10017619
mov eax, dword [ebp - 0x2f0]
mov dword [ebp + eax*4 - 0x18f0], 0xfffffffe
jmp 0x100175f0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x14c]
mov dword [ebp + eax - 0x18f0], ecx
jmp 0x1001766d
mov dword [ebp - 0x118c], 0x1cd1ac8c
lea eax, [ebp - 0x118c]
push eax
push 0
push 1
push 0x152d
call fcn.1001ed4b
add esp, 0x10
mov byte [ebp - 0x135], 0
push 0
lea eax, [ebp - 0x135]
push eax
push 0x36ba
call fcn.1002a385
add esp, 0xc
mov byte [ebp - 0x18b], 0
lea eax, [ebp - 0x18b]
push eax
push 0
call fcn.100238d2
pop ecx
pop ecx
jmp 0x10017547
push 0x2446
push 0x6771
push 1
push 0
push 0x1a6e
push 0x5c28
call fcn.10027ed8
add esp, 0x18
mov dword [ebp - 0x58], 0x824a8c6a
mov dword [ebp - 0xf50], 0x264d
cmp dword [ebp - 0xf50], 0xdf1
jge 0x10017805
lea eax, [ebp - 0x4fc]
push eax
push 0x100077f8
call fcn.100513ab
pop ecx
pop ecx
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x1070], eax
mov eax, dword [ebp - 0x4fc]
dec eax
mov dword [ebp - 0x4fc], eax
cmp dword [ebp - 0x1070], 0
je 0x10017805
lea eax, [ebp - 0x584]
push eax
push 0x100077f8
call fcn.100513ab
pop ecx
pop ecx
push dword [ebp - 0x584]
lea ecx, [ebp - 0x1144]
call fcn.1000e440
mov dword [ebp - 4], 0x22
and dword [ebp - 0x2f8], 0
jmp 0x10017744
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x2f8]
cmp eax, dword [ebp - 0x584]
jge 0x10017772
push dword [ebp - 0x2f8]
lea ecx, [ebp - 0x1144]
call fcn.1000e49e
push eax
push 0x100077f8
call fcn.100513ab
pop ecx
pop ecx
jmp 0x10017737
lea eax, [ebp - 0x184c]
push eax
lea ecx, [ebp - 0x1144]
call fcn.1000e481
push dword [eax]
lea eax, [ebp - 0x1458]
push eax
lea ecx, [ebp - 0x1144]
call fcn.1000e48f
push dword [eax]
call fcn.10033135
pop ecx
pop ecx
and dword [ebp - 0x300], 0
jmp 0x100177b7
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x300]
cmp eax, dword [ebp - 0x584]
jge 0x100177e6
push dword [ebp - 0x300]
lea ecx, [ebp - 0x1144]
call fcn.1000e49e
push dword [eax]
push 0x100078c0
call fcn.100515a0
pop ecx
pop ecx
jmp 0x100177aa
push 0x10007760
call fcn.1005170c
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1144]
call fcn.1000e47c
jmp 0x100176dd
mov dword [ebp - 0x504], 0xfffffff8
mov dword [ebp - 0x1078], 0
mov dword [ebp - 0xb58], 0xfffffffb
mov dword [ebp - 0x58], 0
jmp 0x10017833
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xfffffff1
jg 0x10017876
mov dword [ebp - 0xf58], 0x137b1891
mov dword [ebp - 0x1108], 0x6ccb0362
lea eax, [ebp - 0xf58]
push eax
lea eax, [ebp - 0x1108]
push eax
push 0x37e8
push 0
push 0x78f6
push 0x2262
call fcn.1002025c
add esp, 0x18
jmp 0x1001782c
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x58], eax
jne 0x1001788a
mov dword [ebp - 0x900], 1
jmp 0x10017891
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x504]
cmp dword [ebp - 0x504], eax
jl 0x100178ab
mov dword [ebp - 0xf60], 1
jmp 0x100178b2
and dword [ebp - 0xf60], 0
mov eax, dword [ebp - 0x504]
imul eax, dword [ebp - 0x58]
cmp eax, 1
jl 0x100178d3
cmp dword [ebp - 0x1078], 0
jne 0x100178d3
and dword [ebp - 0x8f8], 0
jmp 0x100178dd
mov dword [ebp - 0x8f8], 1
cmp dword [ebp - 0x8f8], 0x8e55
jge 0x100178f5
mov dword [ebp - 0xc80], 1
jmp 0x100178fc
and dword [ebp - 0xc80], 0
mov eax, dword [ebp - 0xc80]
mov dword [ebp - 0xb58], eax
mov eax, dword [ebp - 0x900]
sub eax, dword [ebp - 0xb58]
cmp eax, dword [ebp - 0x58]
jg 0x10017925
mov dword [ebp - 0xfc4], 0x1d52
cmp dword [ebp - 0xfc4], 0x1379
jge 0x1001dbe1
and dword [ebp - 0x540], 0
lea eax, [ebp - 0x540]
push eax
push 0x100077f8
call fcn.100513ab
pop ecx
pop ecx
cmp dword [ebp - 0x540], 0
jne 0x1001dba9
push 0x100078fc
call fcn.1005170c
pop ecx
jmp 0x1001dbe1
cvtsi2sd xmm0, dword [ebp - 0x540]
push 2
pop ecx
movsd qword [ebp - 0x14e8], xmm0
call fcn.1003317c
movsd xmm1, qword [ebp - 0x14e8]
mulsd xmm1, xmm0
cvttsd2si eax, xmm1
shl eax, 2
push eax
push 0x10007804
call fcn.100515a0
pop ecx
pop ecx
mov byte [ebp - 0x10c], 0
movzx eax, byte [ebp - 0x10c]
test eax, eax
je 0x1001dc0f
push 0
push 0x31c
push 0x2533
push 0x170a
push 0x19b4
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret