Function at 0x10230060
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10334c63
mov eax, dword fs:[0]
push eax
mov eax, 0x12c8
call fcn.102e1330
mov eax, dword [0x1040e140]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x284], ecx
mov dword [ebp - 0x27c], 0
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x280], 0
mov dword [ebp - 0x2d4], 0
mov eax, dword [0x105ae650]
mov dword [ebp - 0x109c], eax
mov dword [ebp - 0xe3c], 0x1009b890
mov ecx, dword [ebp - 0xe3c]
mov dword [ebp - 0x1074], ecx
mov edx, dword [ebp - 0x1074]
mov dword [ebp - 0x107c], edx
mov eax, dword [0x105b27a4]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x1094], ecx
mov edx, dword [ebp - 0x107c]
push edx
push 0xfffffffffffffffc
mov eax, dword [ebp - 0x1094]
push eax
call dword [ebp - 0x109c]
mov ecx, dword [ebp - 0x284]
mov dword [ecx + 0xba4], eax
mov edx, dword [ebp - 0x284]
mov dword [ebp - 0x2c8], edx
mov eax, dword [0x105b2740]
mov dword [ebp - 0x10b4], eax
lea ecx, [ebp - 0x34c]
mov dword [ebp - 0x5b0], ecx
mov edx, dword [ebp - 0x5b0]
mov eax, dword [ebp - 0x10b4]
mov dword [edx], eax
mov ecx, dword [ebp - 0x5b0]
mov dword [ebp - 0x10bc], ecx
mov edx, dword [ebp - 0x10bc]
mov dword [ebp - 0x1224], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x2c8]
mov ecx, dword [ebp - 0x34c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x34c]
mov eax, dword [edx]
mov dword [ebp - 0x10d4], eax
mov ecx, dword [ebp - 0x10d4]
mov edx, dword [ebp - 0x2c8]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x2c8]
cmp dword [eax + 4], 0
jne 0x102301b7
mov dword [ebp - 4], 0xffffffff
jmp 0x10230409
mov dword [ebp - 0x394], 0
mov ecx, dword [ebp - 0x2c8]
mov edx, dword [ecx + 4]
mov eax, dword [ebp - 0x394]
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x10dc], ecx
mov edx, dword [ebp - 0x10dc]
mov dword [ebp - 0x6a0], edx
cmp dword [ebp - 0x6a0], 0
jne 0x102301f7
mov byte [ebp - 0x293], 0
jmp 0x1023024e
mov eax, dword [0x105ae64c]
mov dword [ebp - 0x10f4], eax
push 0x1c
lea ecx, [ebp - 0x180]
push ecx
mov edx, dword [ebp - 0x6a0]
push edx
call dword [ebp - 0x10f4]
test eax, eax
jne 0x10230225
mov byte [ebp - 0x293], 0
jmp 0x1023024e
mov eax, dword [ebp - 0x16c]
and eax, 1
jne 0x1023023e
mov ecx, dword [ebp - 0x16c]
and ecx, 0x100
je 0x10230247
mov byte [ebp - 0x293], 0
jmp 0x1023024e
mov byte [ebp - 0x293], 1
movzx edx, byte [ebp - 0x293]
test edx, edx
je 0x1023026d
mov eax, dword [ebp - 0x394]
add eax, 1
mov dword [ebp - 0x394], eax
jmp 0x102301c1
mov ecx, dword [ebp - 0x394]
mov dword [ebp - 0x10fc], ecx
mov edx, dword [ebp - 0x10fc]
mov eax, dword [ebp - 0x2c8]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp - 0x2c8]
cmp dword [ecx + 0xc], 0
jne 0x102302a0
mov dword [ebp - 4], 0xffffffff
jmp 0x10230409
mov edx, 1
test edx, edx
je 0x102302bd
mov eax, dword [ebp - 0x2c8]
mov ecx, dword [eax + 0xc]
add ecx, 1
mov dword [ebp - 0x6a4], ecx
jmp 0x102302cc
mov edx, dword [ebp - 0x2c8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x6a4], eax
mov edx, dword [ebp - 0x6a4]
lea ecx, [ebp - 0x111c]
call fcn.1003ebb0
mov dword [ebp - 0x1114], eax
mov ecx, dword [ebp - 0x1114]
push ecx
mov ecx, dword [ebp - 0x2c8]
add ecx, 8
call fcn.1003ec40
lea ecx, [ebp - 0x111c]
call fcn.1003e2c0
mov ecx, dword [ebp - 0x2c8]
add ecx, 8
call fcn.1003e2a0
movzx edx, al
test edx, edx
jne 0x10230324
mov dword [ebp - 4], 0xffffffff
jmp 0x10230409
mov ecx, dword [ebp - 0x2c8]
add ecx, 8
call fcn.1003e250
mov dword [ebp - 0x112c], eax
mov eax, dword [ebp - 0x112c]
mov dword [ebp - 0x28], eax
mov ecx, 1
test ecx, ecx
je 0x102303bd
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x1130], edx
mov eax, dword [ebp - 0x2c8]
mov ecx, dword [eax + 0xc]
lea edx, [ecx*4 + 4]
push edx
mov eax, dword [ebp - 0x2c8]
mov ecx, dword [eax + 4]
sub ecx, 4
push ecx
mov edx, dword [ebp - 0x1130]
push edx
call fcn.102e4250
add esp, 0xc
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1134], eax
mov ecx, dword [ebp - 0x1134]
add ecx, 4
mov dword [ebp - 0x1138], ecx
cmp dword [ebp - 0x34c], 0
jne 0x102303a3
jmp 0x102303b1
mov edx, dword [ebp - 0x34c]
mov eax, dword [ebp - 0x1138]
mov dword [edx], eax
mov ecx, dword [ebp - 0x2c8]
mov byte [ecx + 0x10], 1
jmp 0x10230402
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x113c], edx
mov eax, dword [ebp - 0x2c8]
mov ecx, dword [eax + 0xc]
shl ecx, 2
push ecx
mov edx, dword [ebp - 0x2c8]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x113c]
push ecx
call fcn.102e4250
add esp, 0xc
cmp dword [ebp - 0x34c], 0
jne 0x102303f7
jmp 0x10230402
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34c]
mov dword [eax], edx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x284]
mov dword [ebp - 0x344], ecx
mov dword [ebp - 0x1140], 0x1024fa30
mov edx, dword [ebp - 0x1140]
mov dword [ebp - 0x1144], edx
mov eax, dword [ebp - 0x344]
movzx ecx, byte [eax + 0x10]
test ecx, ecx
je 0x10230449
mov edx, 0x29
add edx, 1
mov dword [ebp - 0x6a8], edx
jmp 0x10230453
mov dword [ebp - 0x6a8], 0x29
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x6ac], eax
mov ecx, dword [ebp - 0x344]
cmp dword [ecx + 4], 0
je 0x10230491
mov ecx, dword [ebp - 0x344]
add ecx, 8
call fcn.1003e2a0
movzx edx, al
test edx, edx
je 0x10230491
mov eax, dword [ebp - 0x344]
mov ecx, dword [ebp - 0x6ac]
cmp ecx, dword [eax + 0xc]
jbe 0x102304bb
mov dword [ebp - 0x6b8], 0
mov edx, dword [ebp - 0x27c]
or edx, 1
mov dword [ebp - 0x27c], edx
lea eax, [ebp - 0x6b8]
mov dword [ebp - 0x1228], eax
jmp 0x10230606
mov ecx, dword [ebp - 0x1144]
mov dword [ebp - 0x1148], ecx
mov edx, dword [ebp - 0x1148]
mov dword [ebp - 0x1150], edx
mov eax, dword [ebp - 0x344]
add eax, 8
mov dword [ebp - 0x114c], eax
mov ecx, dword [ebp - 0x6ac]
push ecx
mov ecx, dword [ebp - 0x114c]
call fcn.1003e2b0
mov edx, dword [ebp - 0x1150]
mov dword [eax], edx
mov eax, 0x29
shl eax, 2
mov ecx, dword [ebp - 0x344]
add eax, dword [ecx + 4]
mov dword [ebp - 0x6b0], eax
mov edx, dword [ebp - 0x6b0]
cmp dword [edx], 0
je 0x1023056d
mov eax, dword [ebp - 0x6b0]
mov ecx, dword [eax]
mov dword [ebp - 0x1154], ecx
mov edx, dword [ebp - 0x1154]
mov dword [ebp - 0x1158], edx
lea eax, [ebp - 0x1158]
mov dword [ebp - 0x115c], eax
mov ecx, dword [ebp - 0x115c]
mov dword [ebp - 0x1160], ecx
mov edx, dword [ebp - 0x27c]
or edx, 2
mov dword [ebp - 0x27c], edx
mov eax, dword [ebp - 0x1160]
mov dword [ebp - 0x6b4], eax
jmp 0x102305aa
mov dword [ebp - 0x1164], 0
lea ecx, [ebp - 0x1164]
mov dword [ebp - 0x1168], ecx
mov edx, dword [ebp - 0x1168]
mov dword [ebp - 0x116c], edx
mov eax, dword [ebp - 0x27c]
or eax, 4
mov dword [ebp - 0x27c], eax
mov ecx, dword [ebp - 0x116c]
mov dword [ebp - 0x6b4], ecx
mov edx, dword [ebp - 0x6b4]
mov dword [ebp - 0x1170], edx
mov eax, dword [ebp - 0x1170]
mov ecx, dword [eax]
mov dword [ebp - 0x6b8], ecx
mov edx, dword [ebp - 0x27c]
or edx, 8
mov dword [ebp - 0x27c], edx
mov eax, dword [ebp - 0x27c]
and eax, 4
je 0x102305e5
and dword [ebp - 0x27c], 0xfffffffb
mov ecx, dword [ebp - 0x27c]
and ecx, 2
je 0x102305f7
and dword [ebp - 0x27c], 0xfffffffd
mov edx, dword [ebp - 0x27c]
or edx, 1
mov dword [ebp - 0x27c], edx
mov eax, dword [ebp - 0x284]
add eax, 0x28
mov dword [ebp - 0x2cc], eax
mov ecx, dword [0x105b2728]
mov dword [ebp - 0x1174], ecx
lea edx, [ebp - 0x33c]
mov dword [ebp - 0x6bc], edx
mov eax, dword [ebp - 0x6bc]
mov ecx, dword [ebp - 0x1174]
mov dword [eax], ecx
mov edx, dword [ebp - 0x6bc]
mov dword [ebp - 0x1178], edx
mov eax, dword [ebp - 0x1178]
mov dword [ebp - 0x122c], eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x2cc]
mov edx, dword [ebp - 0x33c]
mov dword [ecx], edx
mov eax, dword [ebp - 0x33c]
mov ecx, dword [eax]
mov dword [ebp - 0x724], ecx
mov edx, dword [ebp - 0x724]
mov eax, dword [ebp - 0x2cc]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x2cc]
cmp dword [ecx + 4], 0
jne 0x1023069d
mov dword [ebp - 4], 0xffffffff
jmp 0x102308f0
mov dword [ebp - 0x398], 0
mov edx, dword [ebp - 0x2cc]
mov eax, dword [edx + 4]
mov ecx, dword [ebp - 0x398]
mov edx, dword [eax + ecx*4]
mov dword [ebp - 0x728], edx
mov eax, dword [ebp - 0x728]
mov dword [ebp - 0x6c0], eax
cmp dword [ebp - 0x6c0], 0
jne 0x102306dd
mov byte [ebp - 0x285], 0
jmp 0x10230735
mov ecx, dword [0x105ae64c]
mov dword [ebp - 0x72c], ecx
push 0x1c
lea edx, [ebp - 0x19c]
push edx
mov eax, dword [ebp - 0x6c0]
push eax
call dword [ebp - 0x72c]
test eax, eax
jne 0x1023070c
mov byte [ebp - 0x285], 0
jmp 0x10230735
mov ecx, dword [ebp - 0x188]
and ecx, 1
jne 0x10230725
mov edx, dword [ebp - 0x188]
and edx, 0x100
je 0x1023072e
mov byte [ebp - 0x285], 0
jmp 0x10230735
mov byte [ebp - 0x285], 1
movzx eax, byte [ebp - 0x285]
test eax, eax
je 0x10230754
mov ecx, dword [ebp - 0x398]
add ecx, 1
mov dword [ebp - 0x398], ecx
jmp 0x102306a7
mov edx, dword [ebp - 0x398]
mov dword [ebp - 0x730], edx
mov eax, dword [ebp - 0x730]
mov ecx, dword [ebp - 0x2cc]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0x2cc]
cmp dword [edx + 0xc], 0
jne 0x10230787
mov dword [ebp - 4], 0xffffffff
jmp 0x102308f0
mov eax, 1
test eax, eax
je 0x102307a4
mov ecx, dword [ebp - 0x2cc]
mov edx, dword [ecx + 0xc]
add edx, 1
mov dword [ebp - 0x6c4], edx
jmp 0x102307b3
mov eax, dword [ebp - 0x2cc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x6c4], ecx
mov edx, dword [ebp - 0x6c4]
lea ecx, [ebp - 0x738]
call fcn.1003ebb0
mov dword [ebp - 0x734], eax
mov edx, dword [ebp - 0x734]
push edx
mov ecx, dword [ebp - 0x2cc]
add ecx, 8
call fcn.1003ec40
lea ecx, [ebp - 0x738]
call fcn.1003e2c0
mov ecx, dword [ebp - 0x2cc]
add ecx, 8
call fcn.1003e2a0
movzx eax, al
test eax, eax
jne 0x1023080b
mov dword [ebp - 4], 0xffffffff
jmp 0x102308f0
mov ecx, dword [ebp - 0x2cc]
add ecx, 8
call fcn.1003e250
mov dword [ebp - 0x73c], eax
mov ecx, dword [ebp - 0x73c]
mov dword [ebp - 0x2c], ecx
mov edx, 1
test edx, edx
je 0x102308a4
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x740], eax
mov ecx, dword [ebp - 0x2cc]
mov edx, dword [ecx + 0xc]
lea eax, [edx*4 + 4]
push eax
mov ecx, dword [ebp - 0x2cc]
mov edx, dword [ecx + 4]
sub edx, 4
push edx
mov eax, dword [ebp - 0x740]
push eax
call fcn.102e4250
add esp, 0xc
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x744], ecx
mov edx, dword [ebp - 0x744]
add edx, 4
mov dword [ebp - 0x748], edx
cmp dword [ebp - 0x33c], 0
jne 0x1023088a
jmp 0x10230898
mov eax, dword [ebp - 0x33c]
mov ecx, dword [ebp - 0x748]
mov dword [eax], ecx
mov edx, dword [ebp - 0x2cc]
mov byte [edx + 0x10], 1
jmp 0x102308e9
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x74c], eax
mov ecx, dword [ebp - 0x2cc]
mov edx, dword [ecx + 0xc]
shl edx, 2
push edx
mov eax, dword [ebp - 0x2cc]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x74c]
push edx
call fcn.102e4250
add esp, 0xc
cmp dword [ebp - 0x33c], 0
jne 0x102308de
jmp 0x102308e9
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x33c]
mov dword [ecx], eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x284]
add edx, 0x28
mov dword [ebp - 0x32c], edx
mov dword [ebp - 0x750], 0x1023e1d0
mov eax, dword [ebp - 0x750]
mov dword [ebp - 0x754], eax
mov ecx, dword [ebp - 0x32c]
movzx edx, byte [ecx + 0x10]
test edx, edx
je 0x10230933
mov eax, 5
add eax, 1
mov dword [ebp - 0x6c8], eax
jmp 0x1023093d
mov dword [ebp - 0x6c8], 5
mov ecx, dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], ecx
mov edx, dword [ebp - 0x32c]
cmp dword [edx + 4], 0
je 0x1023097b
mov ecx, dword [ebp - 0x32c]
add ecx, 8
call fcn.1003e2a0
movzx eax, al
test eax, eax
je 0x1023097b
mov ecx, dword [ebp - 0x32c]
mov edx, dword [ebp - 0x6cc]
cmp edx, dword [ecx + 0xc]
jbe 0x102309a5
mov dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x27c]
or eax, 0x10
mov dword [ebp - 0x27c], eax
lea ecx, [ebp - 0x6d8]
mov dword [ebp - 0x1230], ecx
jmp 0x10230af3
mov edx, dword [ebp - 0x754]
mov dword [ebp - 0x758], edx
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0x760], eax
mov ecx, dword [ebp - 0x32c]
add ecx, 8
mov dword [ebp - 0x75c], ecx
mov edx, dword [ebp - 0x6cc]
push edx
mov ecx, dword [ebp - 0x75c]
call fcn.1003e2b0
mov ecx, dword [ebp - 0x760]
mov dword [eax], ecx
mov edx, 5
shl edx, 2
mov eax, dword [ebp - 0x32c]
add edx, dword [eax + 4]
mov dword [ebp - 0x6d0], edx
mov ecx, dword [ebp - 0x6d0]
cmp dword [ecx], 0
je 0x10230a57
mov edx, dword [ebp - 0x6d0]
mov eax, dword [edx]
mov dword [ebp - 0x764], eax
mov ecx, dword [ebp - 0x764]
mov dword [ebp - 0x768], ecx
lea edx, [ebp - 0x768]
mov dword [ebp - 0x76c], edx
mov eax, dword [ebp - 0x76c]
mov dword [ebp - 0x770], eax
mov ecx, dword [ebp - 0x27c]
or ecx, 0x20
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x770]
mov dword [ebp - 0x6d4], edx
jmp 0x10230a94
mov dword [ebp - 0x774], 0
lea eax, [ebp - 0x774]
mov dword [ebp - 0x778], eax
mov ecx, dword [ebp - 0x778]
mov dword [ebp - 0x77c], ecx
mov edx, dword [ebp - 0x27c]
or edx, 0x40
mov dword [ebp - 0x27c], edx
mov eax, dword [ebp - 0x77c]
mov dword [ebp - 0x6d4], eax
mov ecx, dword [ebp - 0x6d4]
mov dword [ebp - 0x780], ecx
mov edx, dword [ebp - 0x780]
mov eax, dword [edx]
mov dword [ebp - 0x6d8], eax
mov ecx, dword [ebp - 0x27c]
or ecx, 0x80
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x27c]
and edx, 0x40
je 0x10230ad2
and dword [ebp - 0x27c], 0xffffffbf
mov eax, dword [ebp - 0x27c]
and eax, 0x20
je 0x10230ae4
and dword [ebp - 0x27c], 0xffffffdf
mov ecx, dword [ebp - 0x27c]
or ecx, 0x10
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x284]
add edx, 0x28
mov dword [ebp - 0x324], edx
mov dword [ebp - 0x784], 0x1023e2a0
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x788], eax
mov ecx, dword [ebp - 0x324]
movzx edx, byte [ecx + 0x10]
test edx, edx
je 0x10230b36
mov eax, 6
add eax, 1
mov dword [ebp - 0x6dc], eax
jmp 0x10230b40
mov dword [ebp - 0x6dc], 6
mov ecx, dword [ebp - 0x6dc]
mov dword [ebp - 0x6e0], ecx
mov edx, dword [ebp - 0x324]
cmp dword [edx + 4], 0
je 0x10230b7e
mov ecx, dword [ebp - 0x324]
add ecx, 8
call fcn.1003e2a0
movzx eax, al
test eax, eax
je 0x10230b7e
mov ecx, dword [ebp - 0x324]
mov edx, dword [ebp - 0x6e0]
cmp edx, dword [ecx + 0xc]
jbe 0x10230baa
mov dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x27c]
or eax, 0x100
mov dword [ebp - 0x27c], eax
lea ecx, [ebp - 0x6ec]
mov dword [ebp - 0x1234], ecx
jmp 0x10230d0c
mov edx, dword [ebp - 0x788]
mov dword [ebp - 0x78c], edx
mov eax, dword [ebp - 0x78c]
mov dword [ebp - 0x794], eax
mov ecx, dword [ebp - 0x324]
add ecx, 8
mov dword [ebp - 0x790], ecx
mov edx, dword [ebp - 0x6e0]
push edx
mov ecx, dword [ebp - 0x790]
call fcn.1003e2b0
mov ecx, dword [ebp - 0x794]
mov dword [eax], ecx
mov edx, 6
shl edx, 2
mov eax, dword [ebp - 0x324]
add edx, dword [eax + 4]
mov dword [ebp - 0x6e4], edx
mov ecx, dword [ebp - 0x6e4]
cmp dword [ecx], 0
je 0x10230c5f
mov edx, dword [ebp - 0x6e4]
mov eax, dword [edx]
mov dword [ebp - 0x798], eax
mov ecx, dword [ebp - 0x798]
mov dword [ebp - 0x79c], ecx
lea edx, [ebp - 0x79c]
mov dword [ebp - 0x7a0], edx
mov eax, dword [ebp - 0x7a0]
mov dword [ebp - 0x7a4], eax
mov ecx, dword [ebp - 0x27c]
or ecx, 0x200
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x7a4]
mov dword [ebp - 0x6e8], edx
jmp 0x10230c9f
mov dword [ebp - 0x7a8], 0
lea eax, [ebp - 0x7a8]
mov dword [ebp - 0x7ac], eax
mov ecx, dword [ebp - 0x7ac]
mov dword [ebp - 0x7b0], ecx
mov edx, dword [ebp - 0x27c]
or edx, 0x400
mov dword [ebp - 0x27c], edx
mov eax, dword [ebp - 0x7b0]
mov dword [ebp - 0x6e8], eax
mov ecx, dword [ebp - 0x6e8]
mov dword [ebp - 0x7b4], ecx
mov edx, dword [ebp - 0x7b4]
mov eax, dword [edx]
mov dword [ebp - 0x6ec], eax
mov ecx, dword [ebp - 0x27c]
or ecx, 0x800
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x27c]
and edx, 0x400
je 0x10230ce3
and dword [ebp - 0x27c], 0xfffffbff
mov eax, dword [ebp - 0x27c]
and eax, 0x200
je 0x10230cfa
and dword [ebp - 0x27c], 0xfffffdff
mov ecx, dword [ebp - 0x27c]
or ecx, 0x100
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x284]
add edx, 0x28
mov dword [ebp - 0x31c], edx
mov dword [ebp - 0x7b8], 0x1023e2c0
mov eax, dword [ebp - 0x7b8]
mov dword [ebp - 0x7bc], eax
mov ecx, dword [ebp - 0x31c]
movzx edx, byte [ecx + 0x10]
test edx, edx
je 0x10230d4f
mov eax, 7
add eax, 1
mov dword [ebp - 0x6f0], eax
jmp 0x10230d59
mov dword [ebp - 0x6f0], 7
mov ecx, dword [ebp - 0x6f0]
mov dword [ebp - 0x6f4], ecx
mov edx, dword [ebp - 0x31c]
cmp dword [edx + 4], 0
je 0x10230d97
mov ecx, dword [ebp - 0x31c]
add ecx, 8
call fcn.1003e2a0
movzx eax, al
test eax, eax
je 0x10230d97
mov ecx, dword [ebp - 0x31c]
mov edx, dword [ebp - 0x6f4]
cmp edx, dword [ecx + 0xc]
jbe 0x10230dc3
mov dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x27c]
or eax, 0x1000
mov dword [ebp - 0x27c], eax
lea ecx, [ebp - 0x700]
mov dword [ebp - 0x1238], ecx
jmp 0x10230f25
mov edx, dword [ebp - 0x7bc]
mov dword [ebp - 0x7c0], edx
mov eax, dword [ebp - 0x7c0]
mov dword [ebp - 0x7c8], eax
mov ecx, dword [ebp - 0x31c]
add ecx, 8
mov dword [ebp - 0x7c4], ecx
mov edx, dword [ebp - 0x6f4]
push edx
mov ecx, dword [ebp - 0x7c4]
call fcn.1003e2b0
mov ecx, dword [ebp - 0x7c8]
mov dword [eax], ecx
mov edx, 7
shl edx, 2
mov eax, dword [ebp - 0x31c]
add edx, dword [eax + 4]
mov dword [ebp - 0x6f8], edx
mov ecx, dword [ebp - 0x6f8]
cmp dword [ecx], 0
je 0x10230e78
mov edx, dword [ebp - 0x6f8]
mov eax, dword [edx]
mov dword [ebp - 0x7cc], eax
mov ecx, dword [ebp - 0x7cc]
mov dword [ebp - 0x7d0], ecx
lea edx, [ebp - 0x7d0]
mov dword [ebp - 0x7d4], edx
mov eax, dword [ebp - 0x7d4]
mov dword [ebp - 0x7d8], eax
mov ecx, dword [ebp - 0x27c]
or ecx, 0x2000
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x7d8]
mov dword [ebp - 0x6fc], edx
jmp 0x10230eb8
mov dword [ebp - 0x7dc], 0
lea eax, [ebp - 0x7dc]
mov dword [ebp - 0x7e0], eax
mov ecx, dword [ebp - 0x7e0]
mov dword [ebp - 0x7e4], ecx
mov edx, dword [ebp - 0x27c]
or edx, 0x4000
mov dword [ebp - 0x27c], edx
mov eax, dword [ebp - 0x7e4]
mov dword [ebp - 0x6fc], eax
mov ecx, dword [ebp - 0x6fc]
mov dword [ebp - 0x7e8], ecx
mov edx, dword [ebp - 0x7e8]
mov eax, dword [edx]
mov dword [ebp - 0x700], eax
mov ecx, dword [ebp - 0x27c]
or ecx, 0x8000
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x27c]
and edx, 0x4000
je 0x10230efc
and dword [ebp - 0x27c], 0xffffbfff
mov eax, dword [ebp - 0x27c]
and eax, 0x2000
je 0x10230f13
and dword [ebp - 0x27c], 0xffffdfff
mov ecx, dword [ebp - 0x27c]
or ecx, 0x1000
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x284]
add edx, 0x28
mov dword [ebp - 0x314], edx
mov dword [ebp - 0x7ec], 0x1023e330
mov eax, dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], eax
mov ecx, dword [ebp - 0x314]
movzx edx, byte [ecx + 0x10]
test edx, edx
je 0x10230f68
mov eax, 0x24
add eax, 1
mov dword [ebp - 0x704], eax
jmp 0x10230f72
mov dword [ebp - 0x704], 0x24
mov ecx, dword [ebp - 0x704]
mov dword [ebp - 0x708], ecx
mov edx, dword [ebp - 0x314]
cmp dword [edx + 4], 0
je 0x10230fb0
mov ecx, dword [ebp - 0x314]
add ecx, 8
call fcn.1003e2a0
movzx eax, al
test eax, eax
je 0x10230fb0
mov ecx, dword [ebp - 0x314]
mov edx, dword [ebp - 0x708]
cmp edx, dword [ecx + 0xc]
jbe 0x10230fdc
mov dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x27c]
or eax, 0x10000
mov dword [ebp - 0x27c], eax
lea ecx, [ebp - 0x714]
mov dword [ebp - 0x1240], ecx
jmp 0x1023113e
mov edx, dword [ebp - 0x7f0]
mov dword [ebp - 0x7f4], edx
mov eax, dword [ebp - 0x7f4]
mov dword [ebp - 0x7fc], eax
mov ecx, dword [ebp - 0x314]
add ecx, 8
mov dword [ebp - 0x7f8], ecx
mov edx, dword [ebp - 0x708]
push edx
mov ecx, dword [ebp - 0x7f8]
call fcn.1003e2b0
mov ecx, dword [ebp - 0x7fc]
mov dword [eax], ecx
mov edx, 0x24
shl edx, 2
mov eax, dword [ebp - 0x314]
add edx, dword [eax + 4]
mov dword [ebp - 0x70c], edx
mov ecx, dword [ebp - 0x70c]
cmp dword [ecx], 0
je 0x10231091
mov edx, dword [ebp - 0x70c]
mov eax, dword [edx]
mov dword [ebp - 0x800], eax
mov ecx, dword [ebp - 0x800]
mov dword [ebp - 0x804], ecx
lea edx, [ebp - 0x804]
mov dword [ebp - 0x808], edx
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x80c], eax
mov ecx, dword [ebp - 0x27c]
or ecx, 0x20000
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x80c]
mov dword [ebp - 0x710], edx
jmp 0x102310d1
mov dword [ebp - 0x810], 0
lea eax, [ebp - 0x810]
mov dword [ebp - 0x814], eax
mov ecx, dword [ebp - 0x814]
mov dword [ebp - 0x818], ecx
mov edx, dword [ebp - 0x27c]
or edx, 0x40000
mov dword [ebp - 0x27c], edx
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x710], eax
mov ecx, dword [ebp - 0x710]
mov dword [ebp - 0x81c], ecx
mov edx, dword [ebp - 0x81c]
mov eax, dword [edx]
mov dword [ebp - 0x714], eax
mov ecx, dword [ebp - 0x27c]
or ecx, 0x80000
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x27c]
and edx, 0x40000
je 0x10231115
and dword [ebp - 0x27c], 0xfffbffff
mov eax, dword [ebp - 0x27c]
and eax, 0x20000
je 0x1023112c
and dword [ebp - 0x27c], 0xfffdffff
mov ecx, dword [ebp - 0x27c]
or ecx, 0x10000
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x284]
add edx, 0x28
mov dword [ebp - 0x30c], edx
mov dword [ebp - 0x820], 0x10240020
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0x824], eax
mov ecx, dword [ebp - 0x30c]
movzx edx, byte [ecx + 0x10]
test edx, edx
je 0x10231181
mov eax, 0x17
add eax, 1
mov dword [ebp - 0x718], eax
jmp 0x1023118b
mov dword [ebp - 0x718], 0x17
mov ecx, dword [ebp - 0x718]
mov dword [ebp - 0x71c], ecx
mov edx, dword [ebp - 0x30c]
cmp dword [edx + 4], 0
je 0x102311c9
mov ecx, dword [ebp - 0x30c]
add ecx, 8
call fcn.1003e2a0
movzx eax, al
test eax, eax
je 0x102311c9
mov ecx, dword [ebp - 0x30c]
mov edx, dword [ebp - 0x71c]
cmp edx, dword [ecx + 0xc]
jbe 0x102311f5
mov dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x27c]
or eax, 0x100000
mov dword [ebp - 0x27c], eax
lea ecx, [ebp - 0x3f4]
mov dword [ebp - 0x1244], ecx
jmp 0x10231357
mov edx, dword [ebp - 0x824]
mov dword [ebp - 0x828], edx
mov eax, dword [ebp - 0x828]
mov dword [ebp - 0x830], eax
mov ecx, dword [ebp - 0x30c]
add ecx, 8
mov dword [ebp - 0x82c], ecx
mov edx, dword [ebp - 0x71c]
push edx
mov ecx, dword [ebp - 0x82c]
call fcn.1003e2b0
mov ecx, dword [ebp - 0x830]
mov dword [eax], ecx
mov edx, 0x17
shl edx, 2
mov eax, dword [ebp - 0x30c]
add edx, dword [eax + 4]
mov dword [ebp - 0x3ec], edx
mov ecx, dword [ebp - 0x3ec]
cmp dword [ecx], 0
je 0x102312aa
mov edx, dword [ebp - 0x3ec]
mov eax, dword [edx]
mov dword [ebp - 0x834], eax
mov ecx, dword [ebp - 0x834]
mov dword [ebp - 0x838], ecx
lea edx, [ebp - 0x838]
mov dword [ebp - 0x83c], edx
mov eax, dword [ebp - 0x83c]
mov dword [ebp - 0x840], eax
mov ecx, dword [ebp - 0x27c]
or ecx, 0x200000
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x840]
mov dword [ebp - 0x3f0], edx
jmp 0x102312ea
mov dword [ebp - 0x844], 0
lea eax, [ebp - 0x844]
mov dword [ebp - 0x848], eax
mov ecx, dword [ebp - 0x848]
mov dword [ebp - 0x84c], ecx
mov edx, dword [ebp - 0x27c]
or edx, 0x400000
mov dword [ebp - 0x27c], edx
mov eax, dword [ebp - 0x84c]
mov dword [ebp - 0x3f0], eax
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp - 0x850], ecx
mov edx, dword [ebp - 0x850]
mov eax, dword [edx]
mov dword [ebp - 0x3f4], eax
mov ecx, dword [ebp - 0x27c]
or ecx, 0x800000
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x27c]
and edx, 0x400000
je 0x1023132e
and dword [ebp - 0x27c], 0xffbfffff
mov eax, dword [ebp - 0x27c]
and eax, 0x200000
je 0x10231345
and dword [ebp - 0x27c], 0xffdfffff
mov ecx, dword [ebp - 0x27c]
or ecx, 0x100000
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x284]
add edx, 0x50
mov dword [ebp - 0x2d0], edx
mov eax, dword [0x105b2730]
mov dword [ebp - 0x854], eax
lea ecx, [ebp - 0x304]
mov dword [ebp - 0x3f8], ecx
mov edx, dword [ebp - 0x3f8]
mov eax, dword [ebp - 0x854]
mov dword [edx], eax
mov ecx, dword [ebp - 0x3f8]
mov dword [ebp - 0x858], ecx
mov edx, dword [ebp - 0x858]
mov dword [ebp - 0x1248], edx
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x2d0]
mov ecx, dword [ebp - 0x304]
mov dword [eax], ecx
mov edx, dword [ebp - 0x304]
mov eax, dword [edx]
mov dword [ebp - 0x85c], eax
mov ecx, dword [ebp - 0x85c]
mov edx, dword [ebp - 0x2d0]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x2d0]
cmp dword [eax + 4], 0
jne 0x102313ed
mov dword [ebp - 4], 0xffffffff
jmp 0x1023163f
mov dword [ebp - 0x39c], 0
mov ecx, dword [ebp - 0x2d0]
mov edx, dword [ecx + 4]
mov eax, dword [ebp - 0x39c]
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x860], ecx
mov edx, dword [ebp - 0x860]
mov dword [ebp - 0x3fc], edx
cmp dword [ebp - 0x3fc], 0
jne 0x1023142d
mov byte [ebp - 0x286], 0
jmp 0x10231484
mov eax, dword [0x105ae64c]
mov dword [ebp - 0x864], eax
push 0x1c
lea ecx, [ebp - 0xf4]
push ecx
mov edx, dword [ebp - 0x3fc]
push edx
call dword [ebp - 0x864]
test eax, eax
jne 0x1023145b
mov byte [ebp - 0x286], 0
jmp 0x10231484
mov eax, dword [ebp - 0xe0]
and eax, 1
jne 0x10231474
mov ecx, dword [ebp - 0xe0]
and ecx, 0x100
je 0x1023147d
mov byte [ebp - 0x286], 0
jmp 0x10231484
mov byte [ebp - 0x286], 1
movzx edx, byte [ebp - 0x286]
test edx, edx
je 0x102314a3
mov eax, dword [ebp - 0x39c]
add eax, 1
mov dword [ebp - 0x39c], eax
jmp 0x102313f7
mov ecx, dword [ebp - 0x39c]
mov dword [ebp - 0x868], ecx
mov edx, dword [ebp - 0x868]
mov eax, dword [ebp - 0x2d0]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp - 0x2d0]
cmp dword [ecx + 0xc], 0
jne 0x102314d6
mov dword [ebp - 4], 0xffffffff
jmp 0x1023163f
mov edx, 1
test edx, edx
je 0x102314f3
mov eax, dword [ebp - 0x2d0]
mov ecx, dword [eax + 0xc]
add ecx, 1
mov dword [ebp - 0x400], ecx
jmp 0x10231502
mov edx, dword [ebp - 0x2d0]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x400], eax
mov edx, dword [ebp - 0x400]
lea ecx, [ebp - 0x870]
call fcn.1003ebb0
mov dword [ebp - 0x86c], eax
mov ecx, dword [ebp - 0x86c]
push ecx
mov ecx, dword [ebp - 0x2d0]
add ecx, 8
call fcn.1003ec40
lea ecx, [ebp - 0x870]
call fcn.1003e2c0
mov ecx, dword [ebp - 0x2d0]
add ecx, 8
call fcn.1003e2a0
movzx edx, al
test edx, edx
jne 0x1023155a
mov dword [ebp - 4], 0xffffffff
jmp 0x1023163f
mov ecx, dword [ebp - 0x2d0]
add ecx, 8
call fcn.1003e250
mov dword [ebp - 0x874], eax
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0x24], eax
mov ecx, 1
test ecx, ecx
je 0x102315f3
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x878], edx
mov eax, dword [ebp - 0x2d0]
mov ecx, dword [eax + 0xc]
lea edx, [ecx*4 + 4]
push edx
mov eax, dword [ebp - 0x2d0]
mov ecx, dword [eax + 4]
sub ecx, 4
push ecx
mov edx, dword [ebp - 0x878]
push edx
call fcn.102e4250
add esp, 0xc
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x87c], eax
mov ecx, dword [ebp - 0x87c]
add ecx, 4
mov dword [ebp - 0x880], ecx
cmp dword [ebp - 0x304], 0
jne 0x102315d9
jmp 0x102315e7
mov edx, dword [ebp - 0x304]
mov eax, dword [ebp - 0x880]
mov dword [edx], eax
mov ecx, dword [ebp - 0x2d0]
mov byte [ecx + 0x10], 1
jmp 0x10231638
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x884], edx
mov eax, dword [ebp - 0x2d0]
mov ecx, dword [eax + 0xc]
shl ecx, 2
push ecx
mov edx, dword [ebp - 0x2d0]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x884]
push ecx
call fcn.102e4250
add esp, 0xc
cmp dword [ebp - 0x304], 0
jne 0x1023162d
jmp 0x10231638
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x304]
mov dword [eax], edx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x284]
add ecx, 0x50
mov dword [ebp - 0x300], ecx
mov dword [ebp - 0x888], 0x1023cc80
mov edx, dword [ebp - 0x888]
mov dword [ebp - 0x88c], edx
mov eax, dword [ebp - 0x300]
movzx ecx, byte [eax + 0x10]
test ecx, ecx
je 0x10231682
mov edx, 0x1b
add edx, 1
mov dword [ebp - 0x404], edx
jmp 0x1023168c
mov dword [ebp - 0x404], 0x1b
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x408], eax
mov ecx, dword [ebp - 0x300]
cmp dword [ecx + 4], 0
je 0x102316ca
mov ecx, dword [ebp - 0x300]
add ecx, 8
call fcn.1003e2a0
movzx edx, al
test edx, edx
je 0x102316ca
mov eax, dword [ebp - 0x300]
mov ecx, dword [ebp - 0x408]
cmp ecx, dword [eax + 0xc]
jbe 0x102316f7
mov dword [ebp - 0x414], 0
mov edx, dword [ebp - 0x27c]
or edx, 0x1000000
mov dword [ebp - 0x27c], edx
lea eax, [ebp - 0x414]
mov dword [ebp - 0x124c], eax
jmp 0x10231858
mov ecx, dword [ebp - 0x88c]
mov dword [ebp - 0x890], ecx
mov edx, dword [ebp - 0x890]
mov dword [ebp - 0x898], edx
mov eax, dword [ebp - 0x300]
add eax, 8
mov dword [ebp - 0x894], eax
mov ecx, dword [ebp - 0x408]
push ecx
mov ecx, dword [ebp - 0x894]
call fcn.1003e2b0
mov edx, dword [ebp - 0x898]
mov dword [eax], edx
mov eax, 0x1b
shl eax, 2
mov ecx, dword [ebp - 0x300]
add eax, dword [ecx + 4]
mov dword [ebp - 0x40c], eax
mov edx, dword [ebp - 0x40c]
cmp dword [edx], 0
je 0x102317ac
mov eax, dword [ebp - 0x40c]
mov ecx, dword [eax]
mov dword [ebp - 0x89c], ecx
mov edx, dword [ebp - 0x89c]
mov dword [ebp - 0x8a0], edx
lea eax, [ebp - 0x8a0]
mov dword [ebp - 0x8a4], eax
mov ecx, dword [ebp - 0x8a4]
mov dword [ebp - 0x8a8], ecx
mov edx, dword [ebp - 0x27c]
or edx, 0x2000000
mov dword [ebp - 0x27c], edx
mov eax, dword [ebp - 0x8a8]
mov dword [ebp - 0x410], eax
jmp 0x102317eb
mov dword [ebp - 0x8ac], 0
lea ecx, [ebp - 0x8ac]
mov dword [ebp - 0x8b0], ecx
mov edx, dword [ebp - 0x8b0]
mov dword [ebp - 0x8b4], edx
mov eax, dword [ebp - 0x27c]
or eax, 0x4000000
mov dword [ebp - 0x27c], eax
mov ecx, dword [ebp - 0x8b4]
mov dword [ebp - 0x410], ecx
mov edx, dword [ebp - 0x410]
mov dword [ebp - 0x8b8], edx
mov eax, dword [ebp - 0x8b8]
mov ecx, dword [eax]
mov dword [ebp - 0x414], ecx
mov edx, dword [ebp - 0x27c]
or edx, 0x8000000
mov dword [ebp - 0x27c], edx
mov eax, dword [ebp - 0x27c]
and eax, 0x4000000
je 0x1023182e
and dword [ebp - 0x27c], 0xfbffffff
mov ecx, dword [ebp - 0x27c]
and ecx, 0x2000000
je 0x10231846
and dword [ebp - 0x27c], 0xfdffffff
mov edx, dword [ebp - 0x27c]
or edx, 0x1000000
mov dword [ebp - 0x27c], edx
mov eax, dword [ebp - 0x284]
add eax, 0x50
mov dword [ebp - 0x38c], eax
mov dword [ebp - 0x8bc], 0x1023ce50
mov ecx, dword [ebp - 0x8bc]
mov dword [ebp - 0x8c0], ecx
mov edx, dword [ebp - 0x38c]
movzx eax, byte [edx + 0x10]
test eax, eax
je 0x1023189b
mov ecx, 0x5d
add ecx, 1
mov dword [ebp - 0x418], ecx
jmp 0x102318a5
mov dword [ebp - 0x418], 0x5d
mov edx, dword [ebp - 0x418]
mov dword [ebp - 0x41c], edx
mov eax, dword [ebp - 0x38c]
cmp dword [eax + 4], 0
je 0x102318e3
mov ecx, dword [ebp - 0x38c]
add ecx, 8
call fcn.1003e2a0
movzx ecx, al
test ecx, ecx
je 0x102318e3
mov edx, dword [ebp - 0x38c]
mov eax, dword [ebp - 0x41c]
cmp eax, dword [edx + 0xc]
jbe 0x10231910
mov dword [ebp - 0x428], 0
mov ecx, dword [ebp - 0x27c]
or ecx, 0x10000000
mov dword [ebp - 0x27c], ecx
lea edx, [ebp - 0x428]
mov dword [ebp - 0x1250], edx
jmp 0x10231a72
mov eax, dword [ebp - 0x8c0]
mov dword [ebp - 0x8c4], eax
mov ecx, dword [ebp - 0x8c4]
mov dword [ebp - 0x8cc], ecx
mov edx, dword [ebp - 0x38c]
add edx, 8
mov dword [ebp - 0x8c8], edx
mov eax, dword [ebp - 0x41c]
push eax
mov ecx, dword [ebp - 0x8c8]
call fcn.1003e2b0
mov ecx, dword [ebp - 0x8cc]
mov dword [eax], ecx
mov edx, 0x5d
shl edx, 2
mov eax, dword [ebp - 0x38c]
add edx, dword [eax + 4]
mov dword [ebp - 0x420], edx
mov ecx, dword [ebp - 0x420]
cmp dword [ecx], 0
je 0x102319c5
mov edx, dword [ebp - 0x420]
mov eax, dword [edx]
mov dword [ebp - 0x8d0], eax
mov ecx, dword [ebp - 0x8d0]
mov dword [ebp - 0x8d4], ecx
lea edx, [ebp - 0x8d4]
mov dword [ebp - 0x8d8], edx
mov eax, dword [ebp - 0x8d8]
mov dword [ebp - 0x8dc], eax
mov ecx, dword [ebp - 0x27c]
or ecx, 0x20000000
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x8dc]
mov dword [ebp - 0x424], edx
jmp 0x10231a05
mov dword [ebp - 0x8e0], 0
lea eax, [ebp - 0x8e0]
mov dword [ebp - 0x8e4], eax
mov ecx, dword [ebp - 0x8e4]
mov dword [ebp - 0x8e8], ecx
mov edx, dword [ebp - 0x27c]
or edx, 0x40000000
mov dword [ebp - 0x27c], edx
mov eax, dword [ebp - 0x8e8]
mov dword [ebp - 0x424], eax
mov ecx, dword [ebp - 0x424]
mov dword [ebp - 0x8ec], ecx
mov edx, dword [ebp - 0x8ec]
mov eax, dword [edx]
mov dword [ebp - 0x428], eax
mov ecx, dword [ebp - 0x27c]
or ecx, 0x80000000
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x27c]
and edx, 0x40000000
je 0x10231a49
and dword [ebp - 0x27c], 0xbfffffff
mov eax, dword [ebp - 0x27c]
and eax, 0x20000000
je 0x10231a60
and dword [ebp - 0x27c], 0xdfffffff
mov ecx, dword [ebp - 0x27c]
or ecx, 0x10000000
mov dword [ebp - 0x27c], ecx
mov edx, dword [ebp - 0x284]
add edx, 0x50
mov dword [ebp - 0x388], edx
mov dword [ebp - 0x8f0], 0x1023d030
mov eax, dword [ebp - 0x8f0]
mov dword [ebp - 0x8f4], eax
mov ecx, dword [ebp - 0x388]
movzx edx, byte [ecx + 0x10]
test edx, edx
je 0x10231ab5
mov eax, 0x5a
add eax, 1
mov dword [ebp - 0x42c], eax
jmp 0x10231abf
mov dword [ebp - 0x42c], 0x5a
mov ecx, dword [ebp - 0x42c]
mov dword [ebp - 0x430], ecx
mov edx, dword [ebp - 0x388]
cmp dword [edx + 4], 0
je 0x10231afd
mov ecx, dword [ebp - 0x388]
add ecx, 8
call fcn.1003e2a0
movzx eax, al
test eax, eax
je 0x10231afd
mov ecx, dword [ebp - 0x388]
mov edx, dword [ebp - 0x430]
cmp edx, dword [ecx + 0xc]
jbe 0x10231b27
mov dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x278]
or eax, 1
mov dword [ebp - 0x278], eax
lea ecx, [ebp - 0x43c]
mov dword [ebp - 0x1254], ecx
jmp 0x10231c72
mov edx, dword [ebp - 0x8f4]
mov dword [ebp - 0x8f8], edx
mov eax, dword [ebp - 0x8f8]
mov dword [ebp - 0x900], eax
mov ecx, dword [ebp - 0x388]
add ecx, 8
mov dword [ebp - 0x8fc], ecx
mov edx, dword [ebp - 0x430]
push edx
mov ecx, dword [ebp - 0x8fc]
call fcn.1003e2b0
mov ecx, dword [ebp - 0x900]
mov dword [eax], ecx
mov edx, 0x5a
shl edx, 2
mov eax, dword [ebp - 0x388]
add edx, dword [eax + 4]
mov dword [ebp - 0x434], edx
mov ecx, dword [ebp - 0x434]
cmp dword [ecx], 0
je 0x10231bd9
mov edx, dword [ebp - 0x434]
mov eax, dword [edx]
mov dword [ebp - 0x904], eax
mov ecx, dword [ebp - 0x904]
mov dword [ebp - 0x908], ecx
lea edx, [ebp - 0x908]
mov dword [ebp - 0x90c], edx
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0x910], eax
mov ecx, dword [ebp - 0x278]
or ecx, 2
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0x910]
mov dword [ebp - 0x438], edx
jmp 0x10231c16
mov dword [ebp - 0x914], 0
lea eax, [ebp - 0x914]
mov dword [ebp - 0x918], eax
mov ecx, dword [ebp - 0x918]
mov dword [ebp - 0x91c], ecx
mov edx, dword [ebp - 0x278]
or edx, 4
mov dword [ebp - 0x278], edx
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x438], eax
mov ecx, dword [ebp - 0x438]
mov dword [ebp - 0x920], ecx
mov edx, dword [ebp - 0x920]
mov eax, dword [edx]
mov dword [ebp - 0x43c], eax
mov ecx, dword [ebp - 0x278]
or ecx, 8
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0x278]
and edx, 4
je 0x10231c51
and dword [ebp - 0x278], 0xfffffffb
mov eax, dword [ebp - 0x278]
and eax, 2
je 0x10231c63
and dword [ebp - 0x278], 0xfffffffd
mov ecx, dword [ebp - 0x278]
or ecx, 1
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0x284]
add edx, 0x64
mov dword [ebp - 0x298], edx
mov eax, dword [0x105b2748]
mov dword [ebp - 0x924], eax
lea ecx, [ebp - 0x384]
mov dword [ebp - 0x440], ecx
mov edx, dword [ebp - 0x440]
mov eax, dword [ebp - 0x924]
mov dword [edx], eax
mov ecx, dword [ebp - 0x440]
mov dword [ebp - 0x928], ecx
mov edx, dword [ebp - 0x928]
mov dword [ebp - 0x123c], edx
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x298]
mov ecx, dword [ebp - 0x384]
mov dword [eax], ecx
mov edx, dword [ebp - 0x384]
mov eax, dword [edx]
mov dword [ebp - 0x92c], eax
mov ecx, dword [ebp - 0x92c]
mov edx, dword [ebp - 0x298]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x298]
cmp dword [eax + 4], 0
jne 0x10231d08
mov dword [ebp - 4], 0xffffffff
jmp 0x10231f5a
mov dword [ebp - 0x3a0], 0
mov ecx, dword [ebp - 0x298]
mov edx, dword [ecx + 4]
mov eax, dword [ebp - 0x3a0]
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x930], ecx
mov edx, dword [ebp - 0x930]
mov dword [ebp - 0x444], edx
cmp dword [ebp - 0x444], 0
jne 0x10231d48
mov byte [ebp - 0x287], 0
jmp 0x10231d9f
mov eax, dword [0x105ae64c]
mov dword [ebp - 0x934], eax
push 0x1c
lea ecx, [ebp - 0x164]
push ecx
mov edx, dword [ebp - 0x444]
push edx
call dword [ebp - 0x934]
test eax, eax
jne 0x10231d76
mov byte [ebp - 0x287], 0
jmp 0x10231d9f
mov eax, dword [ebp - 0x150]
and eax, 1
jne 0x10231d8f
mov ecx, dword [ebp - 0x150]
and ecx, 0x100
je 0x10231d98
mov byte [ebp - 0x287], 0
jmp 0x10231d9f
mov byte [ebp - 0x287], 1
movzx edx, byte [ebp - 0x287]
test edx, edx
je 0x10231dbe
mov eax, dword [ebp - 0x3a0]
add eax, 1
mov dword [ebp - 0x3a0], eax
jmp 0x10231d12
mov ecx, dword [ebp - 0x3a0]
mov dword [ebp - 0x938], ecx
mov edx, dword [ebp - 0x938]
mov eax, dword [ebp - 0x298]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp - 0x298]
cmp dword [ecx + 0xc], 0
jne 0x10231df1
mov dword [ebp - 4], 0xffffffff
jmp 0x10231f5a
mov edx, 1
test edx, edx
je 0x10231e0e
mov eax, dword [ebp - 0x298]
mov ecx, dword [eax + 0xc]
add ecx, 1
mov dword [ebp - 0x448], ecx
jmp 0x10231e1d
mov edx, dword [ebp - 0x298]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x448], eax
mov edx, dword [ebp - 0x448]
lea ecx, [ebp - 0x940]
call fcn.1003ebb0
mov dword [ebp - 0x93c], eax
mov ecx, dword [ebp - 0x93c]
push ecx
mov ecx, dword [ebp - 0x298]
add ecx, 8
call fcn.1003ec40
lea ecx, [ebp - 0x940]
call fcn.1003e2c0
mov ecx, dword [ebp - 0x298]
add ecx, 8
call fcn.1003e2a0
movzx edx, al
test edx, edx
jne 0x10231e75
mov dword [ebp - 4], 0xffffffff
jmp 0x10231f5a
mov ecx, dword [ebp - 0x298]
add ecx, 8
call fcn.1003e250
mov dword [ebp - 0x944], eax
mov eax, dword [ebp - 0x944]
mov dword [ebp - 0x30], eax
mov ecx, 1
test ecx, ecx
je 0x10231f0e
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x948], edx
mov eax, dword [ebp - 0x298]
mov ecx, dword [eax + 0xc]
lea edx, [ecx*4 + 4]
push edx
mov eax, dword [ebp - 0x298]
mov ecx, dword [eax + 4]
sub ecx, 4
push ecx
mov edx, dword [ebp - 0x948]
push edx
call fcn.102e4250
add esp, 0xc
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x94c], eax
mov ecx, dword [ebp - 0x94c]
add ecx, 4
mov dword [ebp - 0x950], ecx
cmp dword [ebp - 0x384], 0
jne 0x10231ef4
jmp 0x10231f02
mov edx, dword [ebp - 0x384]
mov eax, dword [ebp - 0x950]
mov dword [edx], eax
mov ecx, dword [ebp - 0x298]
mov byte [ecx + 0x10], 1
jmp 0x10231f53
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x954], edx
mov eax, dword [ebp - 0x298]
mov ecx, dword [eax + 0xc]
shl ecx, 2
push ecx
mov edx, dword [ebp - 0x298]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x954]
push ecx
call fcn.102e4250
add esp, 0xc
cmp dword [ebp - 0x384], 0
jne 0x10231f48
jmp 0x10231f53
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x384]
mov dword [eax], edx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x284]
add ecx, 0x64
mov dword [ebp - 0x334], ecx
mov dword [ebp - 0x958], 0x102563e0
mov edx, dword [ebp - 0x958]
mov dword [ebp - 0x95c], edx
mov eax, dword [ebp - 0x334]
movzx ecx, byte [eax + 0x10]
test ecx, ecx
je 0x10231f9d
mov edx, 0xe
add edx, 1
mov dword [ebp - 0x44c], edx
jmp 0x10231fa7
mov dword [ebp - 0x44c], 0xe
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x450], eax
mov ecx, dword [ebp - 0x334]
cmp dword [ecx + 4], 0
je 0x10231fe5
mov ecx, dword [ebp - 0x334]
add ecx, 8
call fcn.1003e2a0
movzx edx, al
test edx, edx
je 0x10231fe5
mov eax, dword [ebp - 0x334]
mov ecx, dword [ebp - 0x450]
cmp ecx, dword [eax + 0xc]
jbe 0x1023200f
mov dword [ebp - 0x45c], 0
mov edx, dword [ebp - 0x278]
or edx, 0x10
mov dword [ebp - 0x278], edx
lea eax, [ebp - 0x45c]
mov dword [ebp - 0x125c], eax
jmp 0x1023215d
mov ecx, dword [ebp - 0x95c]
mov dword [ebp - 0x960], ecx
mov edx, dword [ebp - 0x960]
mov dword [ebp - 0x968], edx
mov eax, dword [ebp - 0x334]
add eax, 8
mov dword [ebp - 0x964], eax
mov ecx, dword [ebp - 0x450]
push ecx
mov ecx, dword [ebp - 0x964]
call fcn.1003e2b0
mov edx, dword [ebp - 0x968]
mov dword [eax], edx
mov eax, 0xe
shl eax, 2
mov ecx, dword [ebp - 0x334]
add eax, dword [ecx + 4]
mov dword [ebp - 0x454], eax
mov edx, dword [ebp - 0x454]
cmp dword [edx], 0
je 0x102320c1
mov eax, dword [ebp - 0x454]
mov ecx, dword [eax]
mov dword [ebp - 0x96c], ecx
mov edx, dword [ebp - 0x96c]
mov dword [ebp - 0x970], edx
lea eax, [ebp - 0x970]
mov dword [ebp - 0x974], eax
mov ecx, dword [ebp - 0x974]
mov dword [ebp - 0x978], ecx
mov edx, dword [ebp - 0x278]
or edx, 0x20
mov dword [ebp - 0x278], edx
mov eax, dword [ebp - 0x978]
mov dword [ebp - 0x458], eax
jmp 0x102320fe
mov dword [ebp - 0x97c], 0
lea ecx, [ebp - 0x97c]
mov dword [ebp - 0x980], ecx
mov edx, dword [ebp - 0x980]
mov dword [ebp - 0x984], edx
mov eax, dword [ebp - 0x278]
or eax, 0x40
mov dword [ebp - 0x278], eax
mov ecx, dword [ebp - 0x984]
mov dword [ebp - 0x458], ecx
mov edx, dword [ebp - 0x458]
mov dword [ebp - 0x988], edx
mov eax, dword [ebp - 0x988]
mov ecx, dword [eax]
mov dword [ebp - 0x45c], ecx
mov edx, dword [ebp - 0x278]
or edx, 0x80
mov dword [ebp - 0x278], edx
mov eax, dword [ebp - 0x278]
and eax, 0x40
je 0x1023213c
and dword [ebp - 0x278], 0xffffffbf
mov ecx, dword [ebp - 0x278]
and ecx, 0x20
je 0x1023214e
and dword [ebp - 0x278], 0xffffffdf
mov edx, dword [ebp - 0x278]
or edx, 0x10
mov dword [ebp - 0x278], edx
mov eax, dword [ebp - 0x284]
add eax, 0x64
mov dword [ebp - 0x380], eax
mov dword [ebp - 0x98c], 0x10256770
mov ecx, dword [ebp - 0x98c]
mov dword [ebp - 0x990], ecx
mov edx, dword [ebp - 0x380]
movzx eax, byte [edx + 0x10]
test eax, eax
je 0x102321a0
mov ecx, 0x13
add ecx, 1
mov dword [ebp - 0x460], ecx
jmp 0x102321aa
mov dword [ebp - 0x460], 0x13
mov edx, dword [ebp - 0x460]
mov dword [ebp - 0x464], edx
mov eax, dword [ebp - 0x380]
cmp dword [eax + 4], 0
je 0x102321e8
mov ecx, dword [ebp - 0x380]
add ecx, 8
call fcn.1003e2a0
movzx ecx, al
test ecx, ecx
je 0x102321e8
mov edx, dword [ebp - 0x380]
mov eax, dword [ebp - 0x464]
cmp eax, dword [edx + 0xc]
jbe 0x10232215
mov dword [ebp - 0x470], 0
mov ecx, dword [ebp - 0x278]
or ecx, 0x100
mov dword [ebp - 0x278], ecx
lea edx, [ebp - 0x470]
mov dword [ebp - 0x1260], edx
jmp 0x10232377
mov eax, dword [ebp - 0x990]
mov dword [ebp - 0x994], eax
mov ecx, dword [ebp - 0x994]
mov dword [ebp - 0x99c], ecx
mov edx, dword [ebp - 0x380]
add edx, 8
mov dword [ebp - 0x998], edx
mov eax, dword [ebp - 0x464]
push eax
mov ecx, dword [ebp - 0x998]
call fcn.1003e2b0
mov ecx, dword [ebp - 0x99c]
mov dword [eax], ecx
mov edx, 0x13
shl edx, 2
mov eax, dword [ebp - 0x380]
add edx, dword [eax + 4]
mov dword [ebp - 0x468], edx
mov ecx, dword [ebp - 0x468]
cmp dword [ecx], 0
je 0x102322ca
mov edx, dword [ebp - 0x468]
mov eax, dword [edx]
mov dword [ebp - 0x9a0], eax
mov ecx, dword [ebp - 0x9a0]
mov dword [ebp - 0x9a4], ecx
lea edx, [ebp - 0x9a4]
mov dword [ebp - 0x9a8], edx
mov eax, dword [ebp - 0x9a8]
mov dword [ebp - 0x9ac], eax
mov ecx, dword [ebp - 0x278]
or ecx, 0x200
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0x9ac]
mov dword [ebp - 0x46c], edx
jmp 0x1023230a
mov dword [ebp - 0x9b0], 0
lea eax, [ebp - 0x9b0]
mov dword [ebp - 0x9b4], eax
mov ecx, dword [ebp - 0x9b4]
mov dword [ebp - 0x9b8], ecx
mov edx, dword [ebp - 0x278]
or edx, 0x400
mov dword [ebp - 0x278], edx
mov eax, dword [ebp - 0x9b8]
mov dword [ebp - 0x46c], eax
mov ecx, dword [ebp - 0x46c]
mov dword [ebp - 0x9bc], ecx
mov edx, dword [ebp - 0x9bc]
mov eax, dword [edx]
mov dword [ebp - 0x470], eax
mov ecx, dword [ebp - 0x278]
or ecx, 0x800
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0x278]
and edx, 0x400
je 0x1023234e
and dword [ebp - 0x278], 0xfffffbff
mov eax, dword [ebp - 0x278]
and eax, 0x200
je 0x10232365
and dword [ebp - 0x278], 0xfffffdff
mov ecx, dword [ebp - 0x278]
or ecx, 0x100
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0x284]
add edx, 0x14
mov dword [ebp - 0x29c], edx
mov eax, dword [0x105b2788]
mov dword [ebp - 0x9c0], eax
lea ecx, [ebp - 0x37c]
mov dword [ebp - 0x474], ecx
mov edx, dword [ebp - 0x474]
mov eax, dword [ebp - 0x9c0]
mov dword [edx], eax
mov ecx, dword [ebp - 0x474]
mov dword [ebp - 0x9c4], ecx
mov edx, dword [ebp - 0x9c4]
mov dword [ebp - 0x1264], edx
mov dword [ebp - 4], 4
mov eax, dword [ebp - 0x29c]
mov ecx, dword [ebp - 0x37c]
mov dword [eax], ecx
mov edx, dword [ebp - 0x37c]
mov eax, dword [edx]
mov dword [ebp - 0x9c8], eax
mov ecx, dword [ebp - 0x9c8]
mov edx, dword [ebp - 0x29c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x29c]
cmp dword [eax + 4], 0
jne 0x1023240d
mov dword [ebp - 4], 0xffffffff
jmp 0x1023265f
mov dword [ebp - 0x3a4], 0
mov ecx, dword [ebp - 0x29c]
mov edx, dword [ecx + 4]
mov eax, dword [ebp - 0x3a4]
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x9cc], ecx
mov edx, dword [ebp - 0x9cc]
mov dword [ebp - 0x478], edx
cmp dword [ebp - 0x478], 0
jne 0x1023244d
mov byte [ebp - 0x288], 0
jmp 0x102324a4
mov eax, dword [0x105ae64c]
mov dword [ebp - 0x9d0], eax
push 0x1c
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp - 0x478]
push edx
call dword [ebp - 0x9d0]
test eax, eax
jne 0x1023247b
mov byte [ebp - 0x288], 0
jmp 0x102324a4
mov eax, dword [ebp - 0x1f8]
and eax, 1
jne 0x10232494
mov ecx, dword [ebp - 0x1f8]
and ecx, 0x100
je 0x1023249d
mov byte [ebp - 0x288], 0
jmp 0x102324a4
mov byte [ebp - 0x288], 1
movzx edx, byte [ebp - 0x288]
test edx, edx
je 0x102324c3
mov eax, dword [ebp - 0x3a4]
add eax, 1
mov dword [ebp - 0x3a4], eax
jmp 0x10232417
mov ecx, dword [ebp - 0x3a4]
mov dword [ebp - 0x9d4], ecx
mov edx, dword [ebp - 0x9d4]
mov eax, dword [ebp - 0x29c]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp - 0x29c]
cmp dword [ecx + 0xc], 0
jne 0x102324f6
mov dword [ebp - 4], 0xffffffff
jmp 0x1023265f
mov edx, 1
test edx, edx
je 0x10232513
mov eax, dword [ebp - 0x29c]
mov ecx, dword [eax + 0xc]
add ecx, 1
mov dword [ebp - 0x47c], ecx
jmp 0x10232522
mov edx, dword [ebp - 0x29c]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x47c], eax
mov edx, dword [ebp - 0x47c]
lea ecx, [ebp - 0x9dc]
call fcn.1003ebb0
mov dword [ebp - 0x9d8], eax
mov ecx, dword [ebp - 0x9d8]
push ecx
mov ecx, dword [ebp - 0x29c]
add ecx, 8
call fcn.1003ec40
lea ecx, [ebp - 0x9dc]
call fcn.1003e2c0
mov ecx, dword [ebp - 0x29c]
add ecx, 8
call fcn.1003e2a0
movzx edx, al
test edx, edx
jne 0x1023257a
mov dword [ebp - 4], 0xffffffff
jmp 0x1023265f
mov ecx, dword [ebp - 0x29c]
add ecx, 8
call fcn.1003e250
mov dword [ebp - 0x9e0], eax
mov eax, dword [ebp - 0x9e0]
mov dword [ebp - 0x34], eax
mov ecx, 1
test ecx, ecx
je 0x10232613
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x9e4], edx
mov eax, dword [ebp - 0x29c]
mov ecx, dword [eax + 0xc]
lea edx, [ecx*4 + 4]
push edx
mov eax, dword [ebp - 0x29c]
mov ecx, dword [eax + 4]
sub ecx, 4
push ecx
mov edx, dword [ebp - 0x9e4]
push edx
call fcn.102e4250
add esp, 0xc
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x9e8], eax
mov ecx, dword [ebp - 0x9e8]
add ecx, 4
mov dword [ebp - 0x9ec], ecx
cmp dword [ebp - 0x37c], 0
jne 0x102325f9
jmp 0x10232607
mov edx, dword [ebp - 0x37c]
mov eax, dword [ebp - 0x9ec]
mov dword [edx], eax
mov ecx, dword [ebp - 0x29c]
mov byte [ecx + 0x10], 1
jmp 0x10232658
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x9f0], edx
mov eax, dword [ebp - 0x29c]
mov ecx, dword [eax + 0xc]
shl ecx, 2
push ecx
mov edx, dword [ebp - 0x29c]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x9f0]
push ecx
call fcn.102e4250
add esp, 0xc
cmp dword [ebp - 0x37c], 0
jne 0x1023264d
jmp 0x10232658
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x37c]
mov dword [eax], edx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x284]
add ecx, 0x14
mov dword [ebp - 0x378], ecx
mov dword [ebp - 0x9f4], 0x1024ecc0
mov edx, dword [ebp - 0x9f4]
mov dword [ebp - 0x9f8], edx
mov eax, dword [ebp - 0x378]
movzx ecx, byte [eax + 0x10]
test ecx, ecx
je 0x102326a2
mov edx, 0x10
add edx, 1
mov dword [ebp - 0x480], edx
jmp 0x102326ac
mov dword [ebp - 0x480], 0x10
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x484], eax
mov ecx, dword [ebp - 0x378]
cmp dword [ecx + 4], 0
je 0x102326ea
mov ecx, dword [ebp - 0x378]
add ecx, 8
call fcn.1003e2a0
movzx edx, al
test edx, edx
je 0x102326ea
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 0x484]
cmp ecx, dword [eax + 0xc]
jbe 0x10232717
mov dword [ebp - 0x490], 0
mov edx, dword [ebp - 0x278]
or edx, 0x1000
mov dword [ebp - 0x278], edx
lea eax, [ebp - 0x490]
mov dword [ebp - 0x1268], eax
jmp 0x10232878
mov ecx, dword [ebp - 0x9f8]
mov dword [ebp - 0x9fc], ecx
mov edx, dword [ebp - 0x9fc]
mov dword [ebp - 0xa04], edx
mov eax, dword [ebp - 0x378]
add eax, 8
mov dword [ebp - 0xa00], eax
mov ecx, dword [ebp - 0x484]
push ecx
mov ecx, dword [ebp - 0xa00]
call fcn.1003e2b0
mov edx, dword [ebp - 0xa04]
mov dword [eax], edx
mov eax, 0x10
shl eax, 2
mov ecx, dword [ebp - 0x378]
add eax, dword [ecx + 4]
mov dword [ebp - 0x488], eax
mov edx, dword [ebp - 0x488]
cmp dword [edx], 0
je 0x102327cc
mov eax, dword [ebp - 0x488]
mov ecx, dword [eax]
mov dword [ebp - 0xa08], ecx
mov edx, dword [ebp - 0xa08]
mov dword [ebp - 0xa0c], edx
lea eax, [ebp - 0xa0c]
mov dword [ebp - 0xa10], eax
mov ecx, dword [ebp - 0xa10]
mov dword [ebp - 0xa14], ecx
mov edx, dword [ebp - 0x278]
or edx, 0x2000
mov dword [ebp - 0x278], edx
mov eax, dword [ebp - 0xa14]
mov dword [ebp - 0x48c], eax
jmp 0x1023280b
mov dword [ebp - 0xa18], 0
lea ecx, [ebp - 0xa18]
mov dword [ebp - 0xa1c], ecx
mov edx, dword [ebp - 0xa1c]
mov dword [ebp - 0xa20], edx
mov eax, dword [ebp - 0x278]
or eax, 0x4000
mov dword [ebp - 0x278], eax
mov ecx, dword [ebp - 0xa20]
mov dword [ebp - 0x48c], ecx
mov edx, dword [ebp - 0x48c]
mov dword [ebp - 0xa24], edx
mov eax, dword [ebp - 0xa24]
mov ecx, dword [eax]
mov dword [ebp - 0x490], ecx
mov edx, dword [ebp - 0x278]
or edx, 0x8000
mov dword [ebp - 0x278], edx
mov eax, dword [ebp - 0x278]
and eax, 0x4000
je 0x1023284e
and dword [ebp - 0x278], 0xffffbfff
mov ecx, dword [ebp - 0x278]
and ecx, 0x2000
je 0x10232866
and dword [ebp - 0x278], 0xffffdfff
mov edx, dword [ebp - 0x278]
or edx, 0x1000
mov dword [ebp - 0x278], edx
mov eax, dword [ebp - 0x284]
add eax, 0x14
mov dword [ebp - 0x374], eax
mov dword [ebp - 0xa28], 0x1024ecd0
mov ecx, dword [ebp - 0xa28]
mov dword [ebp - 0xa2c], ecx
mov edx, dword [ebp - 0x374]
movzx eax, byte [edx + 0x10]
test eax, eax
je 0x102328bb
mov ecx, 0x11
add ecx, 1
mov dword [ebp - 0x494], ecx
jmp 0x102328c5
mov dword [ebp - 0x494], 0x11
mov edx, dword [ebp - 0x494]
mov dword [ebp - 0x498], edx
mov eax, dword [ebp - 0x374]
cmp dword [eax + 4], 0
je 0x10232903
mov ecx, dword [ebp - 0x374]
add ecx, 8
call fcn.1003e2a0
movzx ecx, al
test ecx, ecx
je 0x10232903
mov edx, dword [ebp - 0x374]
mov eax, dword [ebp - 0x498]
cmp eax, dword [edx + 0xc]
jbe 0x10232930
mov dword [ebp - 0x4a4], 0
mov ecx, dword [ebp - 0x278]
or ecx, 0x10000
mov dword [ebp - 0x278], ecx
lea edx, [ebp - 0x4a4]
mov dword [ebp - 0x126c], edx
jmp 0x10232a92
mov eax, dword [ebp - 0xa2c]
mov dword [ebp - 0xa30], eax
mov ecx, dword [ebp - 0xa30]
mov dword [ebp - 0xa38], ecx
mov edx, dword [ebp - 0x374]
add edx, 8
mov dword [ebp - 0xa34], edx
mov eax, dword [ebp - 0x498]
push eax
mov ecx, dword [ebp - 0xa34]
call fcn.1003e2b0
mov ecx, dword [ebp - 0xa38]
mov dword [eax], ecx
mov edx, 0x11
shl edx, 2
mov eax, dword [ebp - 0x374]
add edx, dword [eax + 4]
mov dword [ebp - 0x49c], edx
mov ecx, dword [ebp - 0x49c]
cmp dword [ecx], 0
je 0x102329e5
mov edx, dword [ebp - 0x49c]
mov eax, dword [edx]
mov dword [ebp - 0xa3c], eax
mov ecx, dword [ebp - 0xa3c]
mov dword [ebp - 0xa40], ecx
lea edx, [ebp - 0xa40]
mov dword [ebp - 0xa44], edx
mov eax, dword [ebp - 0xa44]
mov dword [ebp - 0xa48], eax
mov ecx, dword [ebp - 0x278]
or ecx, 0x20000
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0xa48]
mov dword [ebp - 0x4a0], edx
jmp 0x10232a25
mov dword [ebp - 0xa4c], 0
lea eax, [ebp - 0xa4c]
mov dword [ebp - 0xa50], eax
mov ecx, dword [ebp - 0xa50]
mov dword [ebp - 0xa54], ecx
mov edx, dword [ebp - 0x278]
or edx, 0x40000
mov dword [ebp - 0x278], edx
mov eax, dword [ebp - 0xa54]
mov dword [ebp - 0x4a0], eax
mov ecx, dword [ebp - 0x4a0]
mov dword [ebp - 0xa58], ecx
mov edx, dword [ebp - 0xa58]
mov eax, dword [edx]
mov dword [ebp - 0x4a4], eax
mov ecx, dword [ebp - 0x278]
or ecx, 0x80000
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0x278]
and edx, 0x40000
je 0x10232a69
and dword [ebp - 0x278], 0xfffbffff
mov eax, dword [ebp - 0x278]
and eax, 0x20000
je 0x10232a80
and dword [ebp - 0x278], 0xfffdffff
mov ecx, dword [ebp - 0x278]
or ecx, 0x10000
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0x284]
add edx, 0x14
mov dword [ebp - 0x370], edx
mov dword [ebp - 0xa5c], 0x1024ed80
mov eax, dword [ebp - 0xa5c]
mov dword [ebp - 0xa60], eax
mov ecx, dword [ebp - 0x370]
movzx edx, byte [ecx + 0x10]
test edx, edx
je 0x10232ad5
mov eax, 0x12
add eax, 1
mov dword [ebp - 0x4a8], eax
jmp 0x10232adf
mov dword [ebp - 0x4a8], 0x12
mov ecx, dword [ebp - 0x4a8]
mov dword [ebp - 0x4ac], ecx
mov edx, dword [ebp - 0x370]
cmp dword [edx + 4], 0
je 0x10232b1d
mov ecx, dword [ebp - 0x370]
add ecx, 8
call fcn.1003e2a0
movzx eax, al
test eax, eax
je 0x10232b1d
mov ecx, dword [ebp - 0x370]
mov edx, dword [ebp - 0x4ac]
cmp edx, dword [ecx + 0xc]
jbe 0x10232b49
mov dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x278]
or eax, 0x100000
mov dword [ebp - 0x278], eax
lea ecx, [ebp - 0x4b8]
mov dword [ebp - 0x1270], ecx
jmp 0x10232cab
mov edx, dword [ebp - 0xa60]
mov dword [ebp - 0xa64], edx
mov eax, dword [ebp - 0xa64]
mov dword [ebp - 0xa6c], eax
mov ecx, dword [ebp - 0x370]
add ecx, 8
mov dword [ebp - 0xa68], ecx
mov edx, dword [ebp - 0x4ac]
push edx
mov ecx, dword [ebp - 0xa68]
call fcn.1003e2b0
mov ecx, dword [ebp - 0xa6c]
mov dword [eax], ecx
mov edx, 0x12
shl edx, 2
mov eax, dword [ebp - 0x370]
add edx, dword [eax + 4]
mov dword [ebp - 0x4b0], edx
mov ecx, dword [ebp - 0x4b0]
cmp dword [ecx], 0
je 0x10232bfe
mov edx, dword [ebp - 0x4b0]
mov eax, dword [edx]
mov dword [ebp - 0xa70], eax
mov ecx, dword [ebp - 0xa70]
mov dword [ebp - 0xa74], ecx
lea edx, [ebp - 0xa74]
mov dword [ebp - 0xa78], edx
mov eax, dword [ebp - 0xa78]
mov dword [ebp - 0xa7c], eax
mov ecx, dword [ebp - 0x278]
or ecx, 0x200000
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0xa7c]
mov dword [ebp - 0x4b4], edx
jmp 0x10232c3e
mov dword [ebp - 0xa80], 0
lea eax, [ebp - 0xa80]
mov dword [ebp - 0xa84], eax
mov ecx, dword [ebp - 0xa84]
mov dword [ebp - 0xa88], ecx
mov edx, dword [ebp - 0x278]
or edx, 0x400000
mov dword [ebp - 0x278], edx
mov eax, dword [ebp - 0xa88]
mov dword [ebp - 0x4b4], eax
mov ecx, dword [ebp - 0x4b4]
mov dword [ebp - 0xa8c], ecx
mov edx, dword [ebp - 0xa8c]
mov eax, dword [edx]
mov dword [ebp - 0x4b8], eax
mov ecx, dword [ebp - 0x278]
or ecx, 0x800000
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0x278]
and edx, 0x400000
je 0x10232c82
and dword [ebp - 0x278], 0xffbfffff
mov eax, dword [ebp - 0x278]
and eax, 0x200000
je 0x10232c99
and dword [ebp - 0x278], 0xffdfffff
mov ecx, dword [ebp - 0x278]
or ecx, 0x100000
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0x284]
add edx, 0x14
mov dword [ebp - 0x36c], edx
mov dword [ebp - 0xa90], 0x1024f180
mov eax, dword [ebp - 0xa90]
mov dword [ebp - 0xa94], eax
mov ecx, dword [ebp - 0x36c]
movzx edx, byte [ecx + 0x10]
test edx, edx
je 0x10232cee
mov eax, 0x18
add eax, 1
mov dword [ebp - 0x4bc], eax
jmp 0x10232cf8
mov dword [ebp - 0x4bc], 0x18
mov ecx, dword [ebp - 0x4bc]
mov dword [ebp - 0x4c0], ecx
mov edx, dword [ebp - 0x36c]
cmp dword [edx + 4], 0
je 0x10232d36
mov ecx, dword [ebp - 0x36c]
add ecx, 8
call fcn.1003e2a0
movzx eax, al
test eax, eax
je 0x10232d36
mov ecx, dword [ebp - 0x36c]
mov edx, dword [ebp - 0x4c0]
cmp edx, dword [ecx + 0xc]
jbe 0x10232d62
mov dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x278]
or eax, 0x1000000
mov dword [ebp - 0x278], eax
lea ecx, [ebp - 0x4cc]
mov dword [ebp - 0x1274], ecx
jmp 0x10232ec4
mov edx, dword [ebp - 0xa94]
mov dword [ebp - 0xa98], edx
mov eax, dword [ebp - 0xa98]
mov dword [ebp - 0xaa0], eax
mov ecx, dword [ebp - 0x36c]
add ecx, 8
mov dword [ebp - 0xa9c], ecx
mov edx, dword [ebp - 0x4c0]
push edx
mov ecx, dword [ebp - 0xa9c]
call fcn.1003e2b0
mov ecx, dword [ebp - 0xaa0]
mov dword [eax], ecx
mov edx, 0x18
shl edx, 2
mov eax, dword [ebp - 0x36c]
add edx, dword [eax + 4]
mov dword [ebp - 0x4c4], edx
mov ecx, dword [ebp - 0x4c4]
cmp dword [ecx], 0
je 0x10232e17
mov edx, dword [ebp - 0x4c4]
mov eax, dword [edx]
mov dword [ebp - 0xaa4], eax
mov ecx, dword [ebp - 0xaa4]
mov dword [ebp - 0xaa8], ecx
lea edx, [ebp - 0xaa8]
mov dword [ebp - 0xaac], edx
mov eax, dword [ebp - 0xaac]
mov dword [ebp - 0xab0], eax
mov ecx, dword [ebp - 0x278]
or ecx, 0x2000000
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0xab0]
mov dword [ebp - 0x4c8], edx
jmp 0x10232e57
mov dword [ebp - 0xab4], 0
lea eax, [ebp - 0xab4]
mov dword [ebp - 0xab8], eax
mov ecx, dword [ebp - 0xab8]
mov dword [ebp - 0xabc], ecx
mov edx, dword [ebp - 0x278]
or edx, 0x4000000
mov dword [ebp - 0x278], edx
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0x4c8], eax
mov ecx, dword [ebp - 0x4c8]
mov dword [ebp - 0xac0], ecx
mov edx, dword [ebp - 0xac0]
mov eax, dword [edx]
mov dword [ebp - 0x4cc], eax
mov ecx, dword [ebp - 0x278]
or ecx, 0x8000000
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0x278]
and edx, 0x4000000
je 0x10232e9b
and dword [ebp - 0x278], 0xfbffffff
mov eax, dword [ebp - 0x278]
and eax, 0x2000000
je 0x10232eb2
and dword [ebp - 0x278], 0xfdffffff
mov ecx, dword [ebp - 0x278]
or ecx, 0x1000000
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0x284]
add edx, 0x14
mov dword [ebp - 0x368], edx
mov dword [ebp - 0xac4], 0x1024f230
mov eax, dword [ebp - 0xac4]
mov dword [ebp - 0xac8], eax
mov ecx, dword [ebp - 0x368]
movzx edx, byte [ecx + 0x10]
test edx, edx
je 0x10232f07
mov eax, 0x2c
add eax, 1
mov dword [ebp - 0x4d0], eax
jmp 0x10232f11
mov dword [ebp - 0x4d0], 0x2c
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0x4d4], ecx
mov edx, dword [ebp - 0x368]
cmp dword [edx + 4], 0
je 0x10232f4f
mov ecx, dword [ebp - 0x368]
add ecx, 8
call fcn.1003e2a0
movzx eax, al
test eax, eax
je 0x10232f4f
mov ecx, dword [ebp - 0x368]
mov edx, dword [ebp - 0x4d4]
cmp edx, dword [ecx + 0xc]
jbe 0x10232f7b
mov dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x278]
or eax, 0x10000000
mov dword [ebp - 0x278], eax
lea ecx, [ebp - 0x4e0]
mov dword [ebp - 0x1258], ecx
jmp 0x102330dd
mov edx, dword [ebp - 0xac8]
mov dword [ebp - 0xacc], edx
mov eax, dword [ebp - 0xacc]
mov dword [ebp - 0xad4], eax
mov ecx, dword [ebp - 0x368]
add ecx, 8
mov dword [ebp - 0xad0], ecx
mov edx, dword [ebp - 0x4d4]
push edx
mov ecx, dword [ebp - 0xad0]
call fcn.1003e2b0
mov ecx, dword [ebp - 0xad4]
mov dword [eax], ecx
mov edx, 0x2c
shl edx, 2
mov eax, dword [ebp - 0x368]
add edx, dword [eax + 4]
mov dword [ebp - 0x4d8], edx
mov ecx, dword [ebp - 0x4d8]
cmp dword [ecx], 0
je 0x10233030
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0xad8], eax
mov ecx, dword [ebp - 0xad8]
mov dword [ebp - 0xadc], ecx
lea edx, [ebp - 0xadc]
mov dword [ebp - 0xae0], edx
mov eax, dword [ebp - 0xae0]
mov dword [ebp - 0xae4], eax
mov ecx, dword [ebp - 0x278]
or ecx, 0x20000000
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0xae4]
mov dword [ebp - 0x4dc], edx
jmp 0x10233070
mov dword [ebp - 0xae8], 0
lea eax, [ebp - 0xae8]
mov dword [ebp - 0xaec], eax
mov ecx, dword [ebp - 0xaec]
mov dword [ebp - 0xaf0], ecx
mov edx, dword [ebp - 0x278]
or edx, 0x40000000
mov dword [ebp - 0x278], edx
mov eax, dword [ebp - 0xaf0]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp - 0xaf4], ecx
mov edx, dword [ebp - 0xaf4]
mov eax, dword [edx]
mov dword [ebp - 0x4e0], eax
mov ecx, dword [ebp - 0x278]
or ecx, 0x80000000
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0x278]
and edx, 0x40000000
je 0x102330b4
and dword [ebp - 0x278], 0xbfffffff
mov eax, dword [ebp - 0x278]
and eax, 0x20000000
je 0x102330cb
and dword [ebp - 0x278], 0xdfffffff
mov ecx, dword [ebp - 0x278]
or ecx, 0x10000000
mov dword [ebp - 0x278], ecx
mov edx, dword [ebp - 0x284]
add edx, 0x78
mov dword [ebp - 0x2a0], edx
mov eax, dword [0x105b273c]
mov dword [ebp - 0xaf8], eax
lea ecx, [ebp - 0x360]
mov dword [ebp - 0x4e4], ecx
mov edx, dword [ebp - 0x4e4]
mov eax, dword [ebp - 0xaf8]
mov dword [edx], eax
mov ecx, dword [ebp - 0x4e4]
mov dword [ebp - 0xafc], ecx
mov edx, dword [ebp - 0xafc]
mov dword [ebp - 0x1180], edx
mov dword [ebp - 4], 5
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [ebp - 0x360]
mov dword [eax], ecx
mov edx, dword [ebp - 0x360]
mov eax, dword [edx]
mov dword [ebp - 0xb00], eax
mov ecx, dword [ebp - 0xb00]
mov edx, dword [ebp - 0x2a0]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x2a0]
cmp dword [eax + 4], 0
jne 0x10233173
mov dword [ebp - 4], 0xffffffff
jmp 0x102333c5
mov dword [ebp - 0x3a8], 0
mov ecx, dword [ebp - 0x2a0]
mov edx, dword [ecx + 4]
mov eax, dword [ebp - 0x3a8]
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0xb04], ecx
mov edx, dword [ebp - 0xb04]
mov dword [ebp - 0x4e8], edx
cmp dword [ebp - 0x4e8], 0
jne 0x102331b3
mov byte [ebp - 0x289], 0
jmp 0x1023320a
mov eax, dword [0x105ae64c]
mov dword [ebp - 0xb08], eax
push 0x1c
lea ecx, [ebp - 0xbc]
push ecx
mov edx, dword [ebp - 0x4e8]
push edx
call dword [ebp - 0xb08]
test eax, eax
jne 0x102331e1
mov byte [ebp - 0x289], 0
jmp 0x1023320a
mov eax, dword [ebp - 0xa8]
and eax, 1
jne 0x102331fa
mov ecx, dword [ebp - 0xa8]
and ecx, 0x100
je 0x10233203
mov byte [ebp - 0x289], 0
jmp 0x1023320a
mov byte [ebp - 0x289], 1
movzx edx, byte [ebp - 0x289]
test edx, edx
je 0x10233229
mov eax, dword [ebp - 0x3a8]
add eax, 1
mov dword [ebp - 0x3a8], eax
jmp 0x1023317d
mov ecx, dword [ebp - 0x3a8]
mov dword [ebp - 0xb0c], ecx
mov edx, dword [ebp - 0xb0c]
mov eax, dword [ebp - 0x2a0]
mov dword [eax + 0xc], edx
mov ecx, dword [ebp - 0x2a0]
cmp dword [ecx + 0xc], 0
jne 0x1023325c
mov dword [ebp - 4], 0xffffffff
jmp 0x102333c5
mov edx, 1
test edx, edx
je 0x10233279
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [eax + 0xc]
add ecx, 1
mov dword [ebp - 0x4ec], ecx
jmp 0x10233288
mov edx, dword [ebp - 0x2a0]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x4ec], eax
mov edx, dword [ebp - 0x4ec]
lea ecx, [ebp - 0xb14]
call fcn.1003ebb0
mov dword [ebp - 0xb10], eax
mov ecx, dword [ebp - 0xb10]
push ecx
mov ecx, dword [ebp - 0x2a0]
add ecx, 8
call fcn.1003ec40
lea ecx, [ebp - 0xb14]
call fcn.1003e2c0
mov ecx, dword [ebp - 0x2a0]
add ecx, 8
call fcn.1003e2a0
movzx edx, al
test edx, edx
jne 0x102332e0
mov dword [ebp - 4], 0xffffffff
jmp 0x102333c5
mov ecx, dword [ebp - 0x2a0]
add ecx, 8
call fcn.1003e250
mov dword [ebp - 0xb18], eax
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0x38], eax
mov ecx, 1
test ecx, ecx
je 0x10233379
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0xb1c], edx
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [eax + 0xc]
lea edx, [ecx*4 + 4]
push edx
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [eax + 4]
sub ecx, 4
push ecx
mov edx, dword [ebp - 0xb1c]
push edx
call fcn.102e4250
add esp, 0xc
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xb20], eax
mov ecx, dword [ebp - 0xb20]
add ecx, 4
mov dword [ebp - 0xb24], ecx
cmp dword [ebp - 0x360], 0
jne 0x1023335f
jmp 0x1023336d
mov edx, dword [ebp - 0x360]
mov eax, dword [ebp - 0xb24]
mov dword [edx], eax
mov ecx, dword [ebp - 0x2a0]
mov byte [ecx + 0x10], 1
jmp 0x102333be
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0xb28], edx
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [eax + 0xc]
shl ecx, 2
push ecx
mov edx, dword [ebp - 0x2a0]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0xb28]
push ecx
call fcn.102e4250
add esp, 0xc
cmp dword [ebp - 0x360], 0
jne 0x102333b3
jmp 0x102333be
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x360]
mov dword [eax], edx
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x284]
add ecx, 0x78
mov dword [ebp - 0x358], ecx
mov dword [ebp - 0xb2c], 0x10249860
mov edx, dword [ebp - 0xb2c]
mov dword [ebp - 0xb30], edx
mov eax, dword [ebp - 0x358]
movzx ecx, byte [eax + 0x10]
test ecx, ecx
je 0x10233408
mov edx, 0x43
add edx, 1
mov dword [ebp - 0x4f0], edx
jmp 0x10233412
mov dword [ebp - 0x4f0], 0x43
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x4f4], eax
mov ecx, dword [ebp - 0x358]
cmp dword [ecx + 4], 0
je 0x10233450
mov ecx, dword [ebp - 0x358]
add ecx, 8
call fcn.1003e2a0
movzx edx, al
test edx, edx
je 0x10233450
mov eax, dword [ebp - 0x358]
mov ecx, dword [ebp - 0x4f4]
cmp ecx, dword [eax + 0xc]
jbe 0x1023347a
mov dword [ebp - 0x500], 0
mov edx, dword [ebp - 0x274]
or edx, 1
mov dword [ebp - 0x274], edx
lea eax, [ebp - 0x500]
mov dword [ebp - 0x1184], eax
jmp 0x102335c5
mov ecx, dword [ebp - 0xb30]
mov dword [ebp - 0xb34], ecx
mov edx, dword [ebp - 0xb34]
mov dword [ebp - 0xb3c], edx
mov eax, dword [ebp - 0x358]
add eax, 8
mov dword [ebp - 0xb38], eax
mov ecx, dword [ebp - 0x4f4]
push ecx
mov ecx, dword [ebp - 0xb38]
call fcn.1003e2b0
mov edx, dword [ebp - 0xb3c]
mov dword [eax], edx
mov eax, 0x43
shl eax, 2
mov ecx, dword [ebp - 0x358]
add eax, dword [ecx + 4]
mov dword [ebp - 0x4f8], eax
mov edx, dword [ebp - 0x4f8]
cmp dword [edx], 0
je 0x1023352c
mov eax, dword [ebp - 0x4f8]
mov ecx, dword [eax]
mov dword [ebp - 0xb40], ecx
mov edx, dword [ebp - 0xb40]
mov dword [ebp - 0xb44], edx
lea eax, [ebp - 0xb44]
mov dword [ebp - 0xb48], eax
mov ecx, dword [ebp - 0xb48]
mov dword [ebp - 0xb4c], ecx
mov edx, dword [ebp - 0x274]
or edx, 2
mov dword [ebp - 0x274], edx
mov eax, dword [ebp - 0xb4c]
mov dword [ebp - 0x4fc], eax
jmp 0x10233569
mov dword [ebp - 0xb50], 0
lea ecx, [ebp - 0xb50]
mov dword [ebp - 0xb54], ecx
mov edx, dword [ebp - 0xb54]
mov dword [ebp - 0xb58], edx
mov eax, dword [ebp - 0x274]
or eax, 4
mov dword [ebp - 0x274], eax
mov ecx, dword [ebp - 0xb58]
mov dword [ebp - 0x4fc], ecx
mov edx, dword [ebp - 0x4fc]
mov dword [ebp - 0xb5c], edx
mov eax, dword [ebp - 0xb5c]
mov ecx, dword [eax]
mov dword [ebp - 0x500], ecx
mov edx, dword [ebp - 0x274]
or edx, 8
mov dword [ebp - 0x274], edx
mov eax, dword [ebp - 0x274]
and eax, 4
je 0x102335a4
and dword [ebp - 0x274], 0xfffffffb
mov ecx, dword [ebp - 0x274]
and ecx, 2
je 0x102335b6
and dword [ebp - 0x274], 0xfffffffd
mov edx, dword [ebp - 0x274]
or edx, 1
mov dword [ebp - 0x274], edx
mov eax, dword [ebp - 0x284]
add eax, 0x78
mov dword [ebp - 0x350], eax
mov dword [ebp - 0xb60], 0x102498c0
mov ecx, dword [ebp - 0xb60]
mov dword [ebp - 0xb64], ecx
mov edx, dword [ebp - 0x350]
movzx eax, byte [edx + 0x10]
test eax, eax
je 0x10233608
mov ecx, 0x52
add ecx, 1
mov dword [ebp - 0x504], ecx
jmp 0x10233612
mov dword [ebp - 0x504], 0x52
mov edx, dword [ebp - 0x504]
mov dword [ebp - 0x508], edx
mov eax, dword [ebp - 0x350]
cmp dword [eax + 4], 0
je 0x10233650
mov ecx, dword [ebp - 0x350]
add ecx, 8
call fcn.1003e2a0
movzx ecx, al
test ecx, ecx
je 0x10233650
mov edx, dword [ebp - 0x350]
mov eax, dword [ebp - 0x508]
cmp eax, dword [edx + 0xc]
jbe 0x1023367a
mov dword [ebp - 0x514], 0
mov ecx, dword [ebp - 0x274]
or ecx, 0x10
mov dword [ebp - 0x274], ecx
lea edx, [ebp - 0x514]
mov dword [ebp - 0x1188], edx
jmp 0x102337c8
mov eax, dword [ebp - 0xb64]
mov dword [ebp - 0xb68], eax
mov ecx, dword [ebp - 0xb68]
mov dword [ebp - 0xb70], ecx
mov edx, dword [ebp - 0x350]
add edx, 8
mov dword [ebp - 0xb6c], edx
mov eax, dword [ebp - 0x508]
push eax
mov ecx, dword [ebp - 0xb6c]
call fcn.1003e2b0
mov ecx, dword [ebp - 0xb70]
mov dword [eax], ecx
mov edx, 0x52
shl edx, 2
mov eax, dword [ebp - 0x350]
add edx, dword [eax + 4]
mov dword [ebp - 0x50c], edx
mov ecx, dword [ebp - 0x50c]
cmp dword [ecx], 0
je 0x1023372c
mov edx, dword [ebp - 0x50c]
mov eax, dword [edx]
mov dword [ebp - 0xb74], eax
mov ecx, dword [ebp - 0xb74]
mov dword [ebp - 0xb78], ecx
lea edx, [ebp - 0xb78]
mov dword [ebp - 0xb7c], edx
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xb80], eax
mov ecx, dword [ebp - 0x274]
or ecx, 0x20
mov dword [ebp - 0x274], ecx
mov edx, dword [ebp - 0xb80]
mov dword [ebp - 0x510], edx
jmp 0x10233769
mov dword [ebp - 0xb84], 0
lea eax, [ebp - 0xb84]
mov dword [ebp - 0xb88], eax
mov ecx, dword [ebp - 0xb88]
mov dword [ebp - 0xb8c], ecx
mov edx, dword [ebp - 0x274]
or edx, 0x40
mov dword [ebp - 0x274], edx
mov eax, dword [ebp - 0xb8c]
mov dword [ebp - 0x510], eax
mov ecx, dword [ebp - 0x510]
mov dword [ebp - 0xb90], ecx
mov edx, dword [ebp - 0xb90]
mov eax, dword [edx]
mov dword [ebp - 0x514], eax
mov ecx, dword [ebp - 0x274]
or ecx, 0x80
mov dword [ebp - 0x274], ecx
mov edx, dword [ebp - 0x274]
and edx, 0x40
je 0x102337a7
and dword [ebp - 0x274], 0xffffffbf
mov eax, dword [ebp - 0x274]
and eax, 0x20
je 0x102337b9
and dword [ebp - 0x274], 0xffffffdf
mov ecx, dword [ebp - 0x274]
or ecx, 0x10
mov dword [ebp - 0x274], ecx
mov edx, dword [ebp - 0x284]
add edx, 0x78
mov dword [ebp - 0x348], edx
mov dword [ebp - 0xb94], 0x102498e0
mov eax, dword [ebp - 0xb94]
mov dword [ebp - 0xb98], eax
mov ecx, dword [ebp - 0x348]
movzx edx, byte [ecx + 0x10]
test edx, edx
je 0x1023380b
mov eax, 0x74
add eax, 1
mov dword [ebp - 0x518], eax
jmp 0x10233815
mov dword [ebp - 0x518], 0x74
mov ecx, dword [ebp - 0x518]
mov dword [ebp - 0x51c], ecx
mov edx, dword [ebp - 0x348]
cmp dword [edx + 4], 0
je 0x10233853
mov ecx, dword [ebp - 0x348]
add ecx, 8
call fcn.1003e2a0
movzx eax, al
test eax, eax
je 0x10233853
mov ecx, dword [ebp - 0x348]
mov edx, dword [ebp - 0x51c]
cmp edx, dword [ecx + 0xc]
jbe 0x1023387f
mov dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x274]
or eax, 0x100
mov dword [ebp - 0x274], eax
lea ecx, [ebp - 0x528]
mov dword [ebp - 0x118c], ecx
jmp 0x102339e1
mov edx, dword [ebp - 0xb98]
mov dword [ebp - 0xb9c], edx
mov eax, dword [ebp - 0xb9c]
mov dword [ebp - 0xba4], eax
mov ecx, dword [ebp - 0x348]
add ecx, 8
mov dword [ebp - 0xba0], ecx
mov edx, dword [ebp - 0x51c]
push edx
mov ecx, dword [ebp - 0xba0]
call fcn.1003e2b0
mov ecx, dword [ebp - 0xba4]
mov dword [eax], ecx
mov edx, 0x74
shl edx, 2
mov eax, dword [ebp - 0x348]
add edx, dword [eax + 4]
mov dword [ebp - 0x520], edx
mov ecx, dword [ebp - 0x520]
cmp dword [ecx], 0
je 0x10233934
mov edx, dword [ebp - 0x520]
mov eax, dword [edx]
mov dword [ebp - 0xba8], eax
mov ecx, dword [ebp - 0xba8]
mov dword [ebp - 0xbac], ecx
lea edx, [ebp - 0xbac]
mov dword [ebp - 0xbb0], edx
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xbb4], eax
mov ecx, dword [ebp - 0x274]
or ecx, 0x200
mov dword [ebp - 0x274], ecx
mov edx, dword [ebp - 0xbb4]
mov dword [ebp - 0x524], edx
jmp 0x10233974
mov dword [ebp - 0xbb8], 0
lea eax, [ebp - 0xbb8]
mov dword [ebp - 0xbbc], eax
mov ecx, dword [ebp - 0xbbc]
mov dword [ebp - 0xbc0], ecx
mov edx, dword [ebp - 0x274]
or edx, 0x400
mov dword [ebp - 0x274], edx
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0x524], eax
mov ecx, dword [ebp - 0x524]
mov dword [ebp - 0xbc4], ecx
mov edx, dword [ebp - 0xbc4]
mov eax, dword [edx]
mov dword [ebp - 0x528], eax
mov ecx, dword [ebp - 0x274]
or ecx, 0x800
mov dword [ebp - 0x274], ecx
mov edx, dword [ebp - 0x274]
and edx, 0x400
je 0x102339b8
and dword [ebp - 0x274], 0xfffffbff
mov eax, dword [ebp - 0x274]
and eax, 0x200
je 0x102339cf
and dword [ebp - 0x274], 0xfffffdff
mov ecx, dword [ebp - 0x274]
or ecx, 0x100
mov dword [ebp - 0x274], ecx
mov edx, dword [ebp - 0x284]
add edx, 0xc8
mov dword [ebp - 0x2a4], edx
mov eax, dword [0x105b275c]
mov dword [ebp - 0xbc8], eax
lea ecx, [ebp - 0x340]
mov dword [ebp - 0x52c], ecx
mov edx, dword [ebp - 0x52c]
mov eax, dword [ebp - 0xbc8]
mov dword [edx], eax
mov ecx, dword [ebp - 0x52c]
mov dword [ebp - 0xbcc], ecx
mov edx, dword [ebp - 0xbcc]
mov dword [ebp - 0x1190], edx
mov dword [ebp - 4], 6
mov eax, dword [ebp - 0x2a4]
mov ecx, dword [ebp - 0x340]
mov dword [eax], ecx
mov edx, dword [ebp - 0x340]
mov eax, dword [edx]
mov dword [ebp - 0xbd0], eax
mov ecx, dword [ebp - 0xbd0]
mov edx, dword [ebp - 0x2a4]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x2a4]
cmp dword [eax + 4], 0
jne 0x10233a7a
mov dword [ebp - 4], 0xffffffff
jmp 0x10233ccc
mov dword [ebp - 0x3ac], 0
mov ecx, dword [ebp - 0x2a4]
mov edx, dword [ecx + 4]
mov eax, dword [ebp - 0x3ac]
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0xbd4], ecx
mov edx, dword [ebp - 0xbd4]
mov dword [ebp - 0x530], edx
cmp dword [ebp - 0x530], 0
jne 0x10233aba
mov byte [ebp - 0x28a], 0
jmp 0x10233b11
mov eax, dword [0x105ae64c]
mov dword [ebp - 0xbd8], eax
push 0x1c
lea ecx, [ebp - 0xd8]
push ecx
mov edx, dword [ebp - 0x530]
push edx
call dword [ebp - 0xbd8]
test eax, eax
jne 0x10233ae8
mov byte [ebp - 0x28a], 0
jmp 0x10233b11
mov eax, dword [ebp - 0xc4]
and eax, 1
jne 0x10233b01
mov ecx, dword [ebp - 0xc4]
and ecx, 0x100
je 0x10233b0a
mov byte [ebp - 0x28a], 0
jmp 0x10233b11
mov byte [ebp - 0x28a], 1
movzx edx, byte [ebp - 0x28a]
test edx, edx
je 0x10233b30
mov ecx, dword [ebp - 0x284]
add ecx, 0xc8
mov dword [ebp - 0x338], ecx
mov dword [ebp - 0xbfc], 0x1022cdd0
mov edx, dword [ebp - 0xbfc]
mov dword [ebp - 0xc00], edx
mov eax, dword [ebp - 0x338]
movzx ecx, byte [eax + 0x10]
test ecx, ecx
je 0x10233d12
mov edx, 0x15
add edx, 1
mov dword [ebp - 0x538], edx
jmp 0x10233d1c
mov dword [ebp - 0x538], 0x15
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x53c], eax
mov ecx, dword [ebp - 0x338]
cmp dword [ecx + 4], 0
je 0x10233d5a
mov ecx, dword [ebp - 0x338]
add ecx, 8
call fcn.1003e2a0
movzx edx, al
test edx, edx
je 0x10233d5a
mov eax, dword [ebp - 0x338]
mov ecx, dword [ebp - 0x53c]
cmp ecx, dword [eax + 0xc]
jbe 0x10233d87
mov dword [ebp - 0x548], 0
mov edx, dword [ebp - 0x274]
or edx, 0x1000
mov dword [ebp - 0x274], edx
lea eax, [ebp - 0x548]
mov dword [ebp - 0x1194], eax
jmp 0x10233ee8
mov eax, dword [ebp - 0x284]
add eax, 0xb4
mov dword [ebp - 0x2a8], eax
mov ecx, dword [0x105b2754]
mov dword [ebp - 0xc30], ecx
lea edx, [ebp - 0x330]
mov dword [ebp - 0x54c], edx
mov eax, dword [ebp - 0x54c]
mov ecx, dword [ebp - 0xc30]
mov dword [eax], ecx
mov edx, dword [ebp - 0x54c]
mov dword [ebp - 0xc34], edx
mov eax, dword [ebp - 0xc34]
mov dword [ebp - 0x1198], eax
mov dword [ebp - 4], 7
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [ebp - 0x330]
mov dword [ecx], edx
mov eax, dword [ebp - 0x330]
mov ecx, dword [eax]
mov dword [ebp - 0xc38], ecx
mov edx, dword [ebp - 0xc38]
mov eax, dword [ebp - 0x2a8]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x2a8]
cmp dword [ecx + 4], 0
jne 0x10233f81