Function at 0x10028ec1
Capabilities:
Compare security identifiers
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10071920
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1160
call fcn.1006c380
push esi
push edi
mov dword [ebp - 0x9b0], 0x1cc9
cmp dword [ebp - 0x9b0], 0xfa2
jge 0x10029320
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x168]
push eax
push 0x10007920
call fcn.10058e8b
add esp, 0xc
mov byte [ebp - 0x10d], 0x30
lea eax, [ebp - 0x10d]
push eax
push dword [ebp - 0x19c]
lea ecx, [ebp - 0xfac]
call fcn.1004a420
mov dword [ebp - 0x908], eax
mov eax, dword [ebp - 0x908]
mov dword [ebp - 0x910], eax
and dword [ebp - 4], 0
push dword [ebp - 0x910]
push dword [ebp - 0x168]
lea ecx, [ebp - 0xc38]
call fcn.1004a44e
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xfac]
call fcn.1001ad14
and dword [ebp - 0x284], 0
jmp 0x10028f8b
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x284]
cmp eax, dword [ebp - 0x168]
jge 0x10028ff7
and dword [ebp - 0x1e8], 0
jmp 0x10028faf
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x1e8]
cmp eax, dword [ebp - 0x19c]
jge 0x10028fea
push dword [ebp - 0x1e8]
push dword [ebp - 0x284]
lea ecx, [ebp - 0xc38]
call fcn.1001a266
mov ecx, eax
call fcn.1004a442
push eax
push 0x10007938
call fcn.10058e8b
pop ecx
pop ecx
jmp 0x10028fa2
push 0x1000793c
call fcn.10058e8b
pop ecx
jmp 0x10028f7e
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x170]
push eax
push 0x10007920
call fcn.10058e8b
add esp, 0xc
mov byte [ebp - 0xad], 0x30
lea eax, [ebp - 0xad]
push eax
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0xfc4]
call fcn.1004a420
mov dword [ebp - 0x918], eax
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x920], eax
mov byte [ebp - 4], 3
push dword [ebp - 0x920]
push dword [ebp - 0x170]
lea ecx, [ebp - 0xbd8]
call fcn.1004a44e
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xfc4]
call fcn.1001ad14
and dword [ebp - 0x28c], 0
jmp 0x10029083
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x28c]
cmp eax, dword [ebp - 0x170]
jge 0x100290ef
and dword [ebp - 0x1f0], 0
jmp 0x100290a7
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f0]
cmp eax, dword [ebp - 0x1a0]
jge 0x100290e2
push dword [ebp - 0x1f0]
push dword [ebp - 0x28c]
lea ecx, [ebp - 0xbd8]
call fcn.1001a266
mov ecx, eax
call fcn.1004a442
push eax
push 0x10007938
call fcn.10058e8b
pop ecx
pop ecx
jmp 0x1002909a
push 0x1000793c
call fcn.10058e8b
pop ecx
jmp 0x10029076
and dword [ebp - 0x374], 0
and dword [ebp - 0x748], 0
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x168]
cmp eax, dword [ebp - 0x170]
jge 0x1002912a
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x19c]
cmp eax, dword [ebp - 0x1a0]
jge 0x10029150
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x2e0]
neg eax
mov dword [ebp - 0x70], eax
jmp 0x10029164
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x2e0]
jg 0x100292e9
mov eax, dword [ebp - 0x364]
neg eax
mov dword [ebp - 0x7c], eax
jmp 0x10029187
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x364]
jg 0x100292e4
and dword [ebp - 0x178], 0
and dword [ebp - 0xb4], 0
jmp 0x100291b3
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0x168]
jge 0x10029294
and dword [ebp - 0xac], 0
jmp 0x100291db
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0x19c]
jge 0x1002928f
mov eax, dword [ebp - 0xb4]
add eax, dword [ebp - 0x70]
js 0x1002928a
mov eax, dword [ebp - 0xb4]
add eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x170]
jge 0x1002928a
mov eax, dword [ebp - 0xac]
add eax, dword [ebp - 0x7c]
js 0x1002928a
mov eax, dword [ebp - 0xac]
add eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x1a0]
jge 0x1002928a
push dword [ebp - 0xac]
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xc38]
call fcn.1001a266
mov ecx, eax
call fcn.1004a442
movsx eax, byte [eax]
cmp eax, 0x31
jne 0x1002928a
mov eax, dword [ebp - 0xac]
add eax, dword [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0xb4]
add eax, dword [ebp - 0x70]
push eax
lea ecx, [ebp - 0xbd8]
call fcn.1001a266
mov ecx, eax
call fcn.1004a442
movsx eax, byte [eax]
cmp eax, 0x31
jne 0x1002928a
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
jmp 0x100291ce
jmp 0x100291a6
mov eax, dword [ebp - 0x178]
cmp eax, dword [ebp - 0x374]
jle 0x100292c0
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x5c0], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x748], eax
push dword [ebp - 0x374]
push dword [ebp - 0x178]
push dword [ebp - 0x7c]
push dword [ebp - 0x70]
push 0x10007e18
call fcn.100597a7
add esp, 0x14
jmp 0x10029180
jmp 0x1002915d
push dword [ebp - 0x5c0]
push dword [ebp - 0x748]
push 0x10007920
call fcn.100597a7
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xbd8]
call fcn.1004a470
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc38]
call fcn.1004a470
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x10029335
push 0
call fcn.10036dff
pop ecx
jmp 0x100304f8
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x9d8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x8d0], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x9e0], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x8d8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x9f0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x9e8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x928], eax
mov eax, dword [ebp - 0x928]
movzx eax, byte [eax]
test eax, eax
je 0x1003032e
mov eax, dword [ebp - 0x9d8]
mov dword [ebp - 0x884], eax
mov eax, dword [ebp - 0x9e0]
mov dword [ebp - 0x890], eax
mov eax, dword [ebp - 0x9e8]
mov dword [ebp - 0x710], eax
mov eax, dword [ebp - 0x9f0]
mov dword [ebp - 0x308], eax
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x768], 0xcae7bf19
push 2
lea ecx, [ebp - 0xaec]
call fcn.1001a0d2
mov dword [ebp - 4], 6
mov dword [ebp - 0x778], 0xfe3d2f55
mov dword [ebp - 0x798], 0xffffffff
mov dword [ebp - 0x334], 0xfffffff7
mov dword [ebp - 0x1f8], 0
jmp 0x10029411
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 2
jge 0x10029433
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0xaec]
call fcn.1001a1d1
mov dword [eax], 0x64939e63
jmp 0x10029404
cmp dword [ebp - 0x28], 0
jne 0x10029451
cmp dword [ebp - 0x28], 0
jne 0x10029451
mov eax, 0xfffb
test eax, eax
jne 0x10029451
and dword [ebp - 0x750], 0
jmp 0x1002945b
mov dword [ebp - 0x750], 1
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x750], eax
jne 0x10029472
mov dword [ebp - 0x758], 1
jmp 0x10029479
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x758]
sub eax, 0x6917900f
je 0x1002948c
cmp dword [ebp - 0x28], 0
jne 0x1002949b
cmp dword [ebp - 0x28], 0
jne 0x1002949b
and dword [ebp - 0x760], 0
jmp 0x100294a5
mov dword [ebp - 0x760], 1
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x768], eax
mov eax, dword [ebp - 0x768]
mov dword [ebp - 0x770], eax
push 1
lea ecx, [ebp - 0xaec]
call fcn.1001a1d1
mov ecx, dword [ebp - 0x770]
mov dword [eax], ecx
mov eax, dword [ebp - 0x770]
add eax, 0x289c089c
cmp eax, dword [ebp - 0x28]
jg 0x100294ee
mov dword [ebp - 0x9f8], 1
jmp 0x100294f5
and dword [ebp - 0x9f8], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xf04], eax
mov dword [ebp - 0x778], 0xf6b903cf
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x778], eax
jne 0x1002951f
mov dword [ebp - 0x780], 1
jmp 0x10029526
and dword [ebp - 0x780], 0
cmp dword [ebp - 0x780], 0xfffffffb
jne 0x1002953b
mov dword [ebp - 0x788], 1
jmp 0x10029542
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x788]
sub eax, dword [ebp - 0x28]
jne 0x10029562
mov eax, 0x1e6e836
test eax, eax
jne 0x10029562
and dword [ebp - 0xa00], 0
jmp 0x1002956c
mov dword [ebp - 0xa00], 1
mov eax, 0xfc75dfcc
test eax, eax
je 0x10029593
push 1
lea ecx, [ebp - 0xaec]
call fcn.1001a1d1
cmp dword [eax], 0
je 0x10029593
mov dword [ebp - 0x790], 1
jmp 0x1002959a
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x790]
mov dword [ebp - 0x798], eax
mov eax, dword [ebp - 0x334]
cmp dword [ebp - 0x798], eax
je 0x100295c0
mov dword [ebp - 0x7a0], 1
jmp 0x100295c7
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x334]
imul eax, dword [ebp - 0x7a0]
cmp eax, dword [ebp - 0x28]
jge 0x100295e5
mov dword [ebp - 0x7a8], 1
jmp 0x100295ec
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x7a8], eax
jl 0x10029603
mov dword [ebp - 0x810], 1
jmp 0x1002960a
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x810]
neg eax
cmp dword [ebp - 0x28], eax
jne 0x10029623
mov dword [ebp - 0x740], 1
jmp 0x1002962a
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x740]
mov dword [ebp - 0x334], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaec]
call fcn.1001a156
mov dword [ebp - 0x15c], 3
mov dword [ebp - 0x15c], 0xa
jmp 0x10029668
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xffffffe6
jl 0x1002969a
mov dword [ebp - 0xa08], 0xaa9ac70c
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0xa08]
push eax
push 0
push 0x6dca
call fcn.10036f50
add esp, 0x10
jmp 0x1002965b
mov byte [ebp - 0x105], 0
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x100296b7
push 0x2405
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 4
lea ecx, [ebp - 0xe40]
call fcn.1001a0d2
mov dword [ebp - 4], 7
mov dword [ebp - 0x294], 0xfffffff7
push 0
push 0x1b39
lea eax, [ebp - 0xe40]
push eax
lea eax, [ebp - 0xf2c]
push eax
push 0x5e38
call fcn.10033e86
add esp, 0x14
mov dword [ebp - 0x294], 3
jmp 0x10029710
mov eax, dword [ebp - 0x294]
dec eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0
jl 0x100297dd
mov dword [ebp - 0x200], 0
jmp 0x10029736
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 3
jge 0x10029752
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0xad4], 0x65ab3e90
jmp 0x10029729
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x1002977c
push 0x6ca4
push 0
push 0
push 1
push 0x3bfa
call fcn.1003647d
add esp, 0x14
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xad4], 0
jmp 0x100297a7
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xad4]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xad4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xad4], 3
jg 0x100297d8
mov byte [ebp - 0x110], 0
movzx eax, byte [ebp - 0x110]
test eax, eax
je 0x100297d6
push 0x15ed
push 0
call fcn.10043039
pop ecx
pop ecx
jmp 0x1002978e
jmp 0x10029703
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe40]
call fcn.1001a156
mov dword [ebp - 0xaac], 1
mov dword [ebp - 0x1c0], 0x87013dce
push 1
lea ecx, [ebp - 0xc8c]
call fcn.1001a0d2
mov dword [ebp - 4], 8
mov dword [ebp - 0xa10], 0x39d6b9c2
mov dword [ebp - 0x29c], 0
jmp 0x10029837
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 1
jge 0x10029859
push dword [ebp - 0x29c]
lea ecx, [ebp - 0xc8c]
call fcn.1001a1d1
mov dword [eax], 1
jmp 0x1002982a
lea eax, [ebp - 0x1c0]
push eax
push 0x403c
push 0
lea eax, [ebp - 0xc8c]
push eax
lea eax, [ebp - 0xa10]
push eax
call fcn.10036d4e
add esp, 0x14
mov dword [ebp - 0x1c0], 0
jmp 0x10029896
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jg 0x100298ca
mov byte [ebp - 0xc5], 0
push 0
push 0x22da
push 0x1886
push 0
lea eax, [ebp - 0xc5]
push eax
push 0x35eb
call fcn.1003633d
add esp, 0x18
jmp 0x10029889
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc8c]
call fcn.1001a156
mov dword [ebp - 0x864], 0xcae7bf19
mov dword [ebp - 0x114], 0xbdde0bcd
mov dword [ebp - 0xa18], 0xe8e1b881
cmp dword [ebp - 0x114], 0
je 0x10029937
mov dword [ebp - 0xa20], 0x318d5816
lea eax, [ebp - 0xa18]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0xa20]
push eax
push 0x5cbb
push 0
push 0
push 0x2c53
call fcn.10032117
add esp, 0x1c
jmp 0x10029980
mov dword [ebp - 0x114], 0xfffffff6
jmp 0x10029950
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x2e
jge 0x10029980
mov byte [ebp - 0x10b], 0
movzx eax, byte [ebp - 0x10b]
test eax, eax
je 0x1002997e
push 1
push 0
push 0
push 0x1cd3
call fcn.10043652
add esp, 0x10
jmp 0x10029943
push 2
lea ecx, [ebp - 0xcbc]
call fcn.1001a0d2
mov dword [ebp - 4], 9
mov dword [ebp - 0x86c], 0xfe3d2f55
mov dword [ebp - 0x180], 0xfffffff6
mov dword [ebp - 0x78], 2
mov dword [ebp - 0xde0], 0xffffffff
mov dword [ebp - 0x180], 0
jmp 0x100299d2
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0xfffffff5
jle 0x10029d75
push 1
lea ecx, [ebp - 0x3a0]
call fcn.1001a0d2
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x208], 0
jmp 0x10029a09
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 1
jge 0x10029a2b
push dword [ebp - 0x208]
lea ecx, [ebp - 0x3a0]
call fcn.1001a1d1
mov dword [eax], 1
jmp 0x100299fc
cmp dword [ebp - 0x180], 0
je 0x10029cdb
mov dword [ebp - 0x830], 0xfffffff8
mov dword [ebp - 0x82c], 0xfffffff8
mov dword [ebp - 0x828], 0xfffffff8
mov dword [ebp - 0x824], 0xfffffff8
push 1
lea ecx, [ebp - 0xc50]
call fcn.1001a0d2
mov byte [ebp - 4], 0xb
push 0
push 0x49ea
push 0xc5
push 0x1fec
lea eax, [ebp - 0xee0]
push eax
lea eax, [ebp - 0xc50]
push eax
call fcn.10028745
add esp, 0x18
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x830], 0
jmp 0x10029ac3
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x830]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x830], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x830], 0
jg 0x10029ca3
mov dword [ebp - 0xbc], 0xd65121ac
mov dword [ebp - 0xbc], 0
jmp 0x10029af9
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x10029c74
mov dword [ebp - 0x774], 0xe96b779c
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x830]
lea ecx, [ebp - 0x3a0]
call fcn.1001a1d1
cmp dword [eax], 0x31d26ec1
jle 0x10029b3b
mov dword [ebp - 0x3bc], 1
jmp 0x10029b42
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x774], eax
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x3a0]
call fcn.1001a1d1
push 0
lea ecx, [ebp - 0x3a0]
call fcn.1001a1d1
cmp dword [eax], 0
je 0x10029bd2
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x830], 0
jne 0x10029b92
mov eax, 0x60de
test eax, eax
jne 0x10029b92
and dword [ebp - 0x5dc], 0
jmp 0x10029b9c
mov dword [ebp - 0x5dc], 1
cmp dword [ebp - 0x5dc], 1
jl 0x10029bb1
mov dword [ebp - 0x3c4], 1
jmp 0x10029bb8
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x78]
imul eax, dword [ebp - 0x3c4]
test eax, eax
je 0x10029bd2
mov dword [ebp - 0x6ec], 1
jmp 0x10029bd9
and dword [ebp - 0x6ec], 0
cmp dword [ebp - 0x6ec], 0xffffffff
je 0x10029bee
mov dword [ebp - 0x3cc], 1
jmp 0x10029bf5
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0xbc]
sub eax, dword [ebp - 0x3cc]
je 0x10029c15
cmp dword [ebp - 0x78], 0
je 0x10029c15
mov dword [ebp - 0x5e4], 1
jmp 0x10029c1c
and dword [ebp - 0x5e4], 0
cmp dword [ebp - 0x5e4], 1
jne 0x10029c31
mov dword [ebp - 0x3d4], 1
jmp 0x10029c38
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0x3d4]
jl 0x10029c52
mov dword [ebp - 0xa28], 1
jmp 0x10029c59
and dword [ebp - 0xa28], 0
push 0
lea ecx, [ebp - 0x3a0]
call fcn.1001a1d1
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x774], eax
jmp 0x10029aec
mov byte [ebp - 0xfe], 0
movzx eax, byte [ebp - 0xfe]
test eax, eax
je 0x10029c9e
push 0x29c3
push 0
push 1
push 1
push 0x1d06
call fcn.1003647d
add esp, 0x14
jmp 0x10029aaa
push 0x1051
push 0x7e64
push 0x15ec
push 0x2c75
push 0
push 1
lea eax, [ebp - 0xc50]
push eax
call fcn.10032117
add esp, 0x1c
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xc50]
call fcn.1001a156
jmp 0x10029d34
mov byte [ebp - 0xbd], 0
push 0
push 0x579
push 0x22ad
push 0
push 0x4886
push 0x4c11
push 0x7588
lea eax, [ebp - 0xbd]
push eax
call fcn.1003981b
add esp, 0x20
push 0
lea ecx, [ebp - 0x3a0]
call fcn.1001a1d1
cmp dword [eax], 0
je 0x10029d34
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x3a0]
call fcn.1001a156
jmp 0x100299c5
mov dword [ebp - 0x78], 0
jmp 0x10029d44
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jg 0x10029d61
push dword [ebp - 0x78]
lea ecx, [ebp - 0x3a0]
call fcn.1001a1d1
cmp dword [eax], 0
je 0x10029d5f
jmp 0x10029d61
jmp 0x10029d3d
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x3a0]
call fcn.1001a156
jmp 0x100299c5
mov dword [ebp - 0x874], 0xffffffff
mov dword [ebp - 0x8c], 0xc03342eb
mov dword [ebp - 0x84], 0x884cb8f6
mov dword [ebp - 0xde8], 0xa01c77dc
mov byte [ebp - 0x107], 0
movzx eax, byte [ebp - 0x107]
test eax, eax
je 0x10029dbc
push 1
push 0x19ad
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
mov dword [ebp - 0x8c], 0xffffffea
jmp 0x10029dd5
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xf
jge 0x1002a19d
mov dword [ebp - 0x148], 0x5589b583
mov dword [ebp - 0xb40], 0xffffffff
mov dword [ebp - 0xb3c], 0xffffffff
mov dword [ebp - 0xb38], 0xffffffff
mov dword [ebp - 0xb34], 0xffffffff
cmp dword [ebp - 0x8c], 0
jne 0x10029e29
mov dword [ebp - 0x3e4], 1
jmp 0x10029e30
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xf8c], eax
mov eax, dword [ebp - 0x84]
sub eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x148]
jne 0x10029e5c
mov dword [ebp - 0x3dc], 1
jmp 0x10029e63
and dword [ebp - 0x3dc], 0
cmp dword [ebp - 0x3dc], 0x587c7ab8
jne 0x10029e7b
mov dword [ebp - 0x5ec], 1
jmp 0x10029e82
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x5ec]
sub eax, dword [ebp - 0x148]
cmp dword [ebp - 0x3e4], eax
jl 0x10029ea2
mov dword [ebp - 0x6f4], 1
jmp 0x10029ea9
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x6f4]
jle 0x10029ec3
mov dword [ebp - 0x3ec], 1
jmp 0x10029eca
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x84]
imul eax, dword [ebp - 0x3ec]
cmp eax, 1
je 0x10029ee8
mov dword [ebp - 0x5f4], 1
jmp 0x10029eef
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xdf0], eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xee8], eax
mov eax, dword [ebp - 0x148]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0xb40]
test eax, eax
je 0x10029f55
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x10029f50
push 0x6c75
push 0xa14
push 0
call fcn.10033dc5
add esp, 0xc
jmp 0x1002a10c
push 2
lea ecx, [ebp - 0x7b8]
call fcn.1001a0d2
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xa38], 0x5618d7c
mov dword [ebp - 0x2a4], 0
jmp 0x10029f89
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 2
jge 0x10029fab
push dword [ebp - 0x2a4]
lea ecx, [ebp - 0x7b8]
call fcn.1001a1d1
mov dword [eax], 0x997b
jmp 0x10029f7c
lea eax, [ebp - 0x7b8]
push eax
push 0xa9b
push 0
call fcn.10031049
add esp, 0xc
push 1
lea ecx, [ebp - 0x7b8]
call fcn.1001a1d1
mov esi, eax
push 0
lea ecx, [ebp - 0x7b8]
call fcn.1001a1d1
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x10029fef
mov dword [ebp - 0x3f4], 1
jmp 0x10029ff6
and dword [ebp - 0x3f4], 0
push 1
lea ecx, [ebp - 0x7b8]
call fcn.1001a1d1
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [eax]
sub eax, dword [ebp + ecx - 0xb40]
cmp eax, dword [ebp - 0x3f4]
jle 0x1002a026
mov dword [ebp - 0x7c8], 1
jmp 0x1002a02d
and dword [ebp - 0x7c8], 0
push 1
lea ecx, [ebp - 0x7b8]
call fcn.1001a1d1
mov ecx, dword [ebp - 0x7c8]
cmp ecx, dword [eax]
jle 0x1002a050
mov dword [ebp - 0x3fc], 1
jmp 0x1002a057
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x3fc]
dec eax
dec eax
neg eax
cmp eax, 1
jne 0x1002a072
mov dword [ebp - 0xa30], 1
jmp 0x1002a079
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xe1c], eax
push 0
lea ecx, [ebp - 0x7b8]
call fcn.1001a1d1
cmp dword [eax], 0xec1f
jge 0x1002a0a6
mov dword [ebp - 0x5fc], 1
jmp 0x1002a0ad
and dword [ebp - 0x5fc], 0
cmp dword [ebp - 0x5fc], 8
je 0x1002a0c2
mov dword [ebp - 0x404], 1
jmp 0x1002a0c9
and dword [ebp - 0x404], 0
cmp dword [ebp - 0x404], 0x83a0
jg 0x1002a0e7
cmp dword [ebp - 0x8c], 0
jne 0x1002a0e7
and dword [ebp - 0x6fc], 0
jmp 0x1002a0f1
mov dword [ebp - 0x6fc], 1
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0xa38], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x7b8]
call fcn.1001a156
mov dword [ebp - 0x84], 0
jmp 0x1002a125
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xfffffffc
jl 0x1002a198
push 1
lea ecx, [ebp - 0xca4]
call fcn.1001a0d2
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x210], 0
jmp 0x1002a158
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 1
jge 0x1002a177
push dword [ebp - 0x210]
lea ecx, [ebp - 0xca4]
call fcn.1001a1d1
or dword [eax], 0xffffffff
jmp 0x1002a14b
push 0
lea eax, [ebp - 0xca4]
push eax
call fcn.10039c19
pop ecx
pop ecx
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xca4]
call fcn.1001a156
jmp 0x1002a118
jmp 0x10029dc8
mov dword [ebp - 0x9cc], 0xfffffff7
mov dword [ebp - 0x24], 0x324ec2e0
mov dword [ebp - 0x74], 0xcda2ae7b
push 2
lea ecx, [ebp - 0xe50]
call fcn.1001a0d2
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x2ac], 0
jmp 0x1002a1df
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 2
jge 0x1002a201
push dword [ebp - 0x2ac]
lea ecx, [ebp - 0xe50]
call fcn.1001a1d1
mov dword [eax], 0x6e71ebd
jmp 0x1002a1d2
mov dword [ebp - 0x24], 0
jmp 0x1002a211
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x15
jg 0x1002a420
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0x2b4], 0x8b9dbea5
mov dword [ebp - 0xab0], 0xc4b6369d
mov dword [ebp - 0x2b4], 0x4c7af5af
cmp dword [ebp - 0x2b4], 0x80d416db
jae 0x1002a25b
mov dword [ebp - 0xa40], 1
jmp 0x1002a262
and dword [ebp - 0xa40], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xefc], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xe24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
je 0x1002a317
mov dword [ebp - 0xaa0], 7
mov byte [ebp - 0x100], 0
movzx eax, byte [ebp - 0x100]
test eax, eax
je 0x1002a2b1
push 0x4e8e
push 0
call fcn.100442bc
pop ecx
pop ecx
mov dword [ebp - 0xc4], 0
jmp 0x1002a2ca
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x1a
jg 0x1002a312
mov dword [ebp - 0xa48], 0x2589d389
lea eax, [ebp - 0x2b4]
push eax
push 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xa48]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0xc4]
push eax
push 0x466e
lea eax, [ebp - 0xaa0]
push eax
call fcn.10032fef
add esp, 0x20
jmp 0x1002a2bd
jmp 0x1002a41b
mov dword [ebp - 0x2ec], 1
mov dword [ebp - 0x40c], 1
push 0xfffffffffffffffb
pop eax
sub eax, dword [ebp - 0x24]
cmp eax, 0xffffffff
jae 0x1002a342
mov dword [ebp - 0xaa8], 1
jmp 0x1002a349
and dword [ebp - 0xaa8], 0
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0xcf0], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xcf4], eax
cmp dword [ebp - 0x40c], 0xffff
jbe 0x1002a376
mov dword [ebp - 0x604], 1
jmp 0x1002a37d
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x2ec]
dec eax
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp - 0x604]
inc eax
cmp dword [ebp - 0x2ec], eax
jl 0x1002a3a5
mov dword [ebp - 0x414], 1
jmp 0x1002a3ac
and dword [ebp - 0x414], 0
cmp dword [ebp - 0x414], 1
je 0x1002a3c1
mov dword [ebp - 0x77c], 1
jmp 0x1002a3c8
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0xab0]
cmp eax, dword [ebp - 0x77c]
jg 0x1002a3e2
mov dword [ebp - 0x41c], 1
jmp 0x1002a3e9
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x41c]
sub eax, 0x5d48
cmp dword [ebp - 0xc4], eax
jne 0x1002a408
mov dword [ebp - 0x60c], 1
jmp 0x1002a40f
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0x2b4], eax
jmp 0x1002a20a
mov dword [ebp - 0x24], 0xffffffee
jmp 0x1002a430
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffe6
jge 0x1002a4f8
push 1
lea ecx, [ebp - 0xc20]
call fcn.1001a0d2
mov byte [ebp - 4], 0xf
mov dword [ebp - 0xcfc], 0x62afeddd
mov dword [ebp - 0x21c], 0
jmp 0x1002a46e
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 1
jge 0x1002a490
push dword [ebp - 0x21c]
lea ecx, [ebp - 0xc20]
call fcn.1001a1d1
mov dword [eax], 0xc22f
jmp 0x1002a461
mov dword [ebp - 0x74], 0
jmp 0x1002a4a0
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x14
jl 0x1002a4cd
mov dword [ebp - 0xab8], 0xfffffffa
push 0
push 0x24e
push 0x39d5
lea eax, [ebp - 0xab8]
push eax
call fcn.100453ee
add esp, 0x10
jmp 0x1002a499
cmp dword [ebp - 0x74], 0
je 0x1002a4e4
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xc20]
call fcn.1001a156
jmp 0x1002a4f8
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xc20]
call fcn.1001a156
jmp 0x1002a429
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xe50]
call fcn.1001a156
lea eax, [ebp - 0xcbc]
push eax
push 0
lea eax, [ebp - 0xd04]
push eax
call fcn.100281c2
add esp, 0xc
mov dword [ebp - 0xb54], 0xfffffff8
mov dword [ebp - 0xb50], 0xfffffff8
mov dword [ebp - 0xb4c], 0xfffffff8
mov dword [ebp - 0xb48], 0xfffffff8
lea ecx, [ebp - 0x335]
call fcn.1001a1e0
push eax
lea eax, [ebp - 0xb44]
push eax
lea eax, [ebp - 0xb54]
push eax
lea ecx, [ebp - 0x1044]
call fcn.1001a377
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xae0]
call fcn.1001a130
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x900], 1
push 0
lea ecx, [ebp - 0xae0]
call fcn.1001a1d1
mov dword [eax], 0x16
jmp 0x1002a5c3
push 0
lea ecx, [ebp - 0xae0]
call fcn.1001a1d1
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x424]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x424]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xae0]
call fcn.1001a1d1
cmp dword [eax], 0xffffffee
jle 0x1002a671
mov dword [ebp - 0x26c], 0xfffffff7
mov dword [ebp - 0x26c], 0
jmp 0x1002a5fc
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0x13
jg 0x1002a64a
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x1002a63e
push 0
push 0x1808
push 0x2cf5
push 0xe36
push 0
push 0x65f8
push 1
push 0x9bd
call fcn.10031a55
add esp, 0x20
mov dword [ebp - 0x900], 0x19ac196a
jmp 0x1002a5ef
mov byte [ebp - 0xd5], 0
push 0x7e38
push 0x1b22
push 0
lea eax, [ebp - 0xd5]
push eax
call fcn.10027eba
add esp, 0x10
jmp 0x1002a59f
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xae0]
call fcn.1001a156
push 0x5f67
lea eax, [ebp - 0xcbc]
push eax
push 0x2789
lea eax, [ebp - 0x864]
push eax
push 0x15a1
lea eax, [ebp - 0x9cc]
push eax
push 0x543d
lea eax, [ebp - 0x86c]
push eax
push 0
lea eax, [ebp - 0xaac]
push eax
lea eax, [ebp - 0x874]
push eax
push 0x7f77
push 0x37ad
call fcn.100282c1
add esp, 0x34
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcbc]
call fcn.1001a156
mov dword [ebp - 0x2a0], 5
mov byte [ebp - 0x102], 0
movzx eax, byte [ebp - 0x102]
test eax, eax
je 0x1002a70b
push 0
push 0x988
call fcn.1003102f
pop ecx
pop ecx
mov dword [ebp - 0x9d4], 0x1b9f
cmp dword [ebp - 0x9d4], 0xe75
jge 0x1002a8e1
lea ecx, [ebp - 0xc74]
call fcn.1001951f
mov dword [ebp - 4], 0x11
lea edx, [ebp - 0xc74]
mov ecx, 0x10663d30
call fcn.1001e8bf
lea ecx, [ebp - 0xc08]
call fcn.1001951f
mov byte [ebp - 4], 0x12
and dword [ebp - 0x224], 0
lea ecx, [ebp - 0xc74]
call fcn.10019635
dec eax
mov dword [ebp - 0xcc], eax
lea ecx, [ebp - 0xc74]
call fcn.10019635
xor edx, edx
push 2
pop ecx
div ecx
test edx, edx
jne 0x1002a7b4
push dword [ebp - 0xcc]
lea ecx, [ebp - 0xc74]
call fcn.10019621
mov al, byte [eax]
movzx eax, al
push eax
lea ecx, [ebp - 0xc08]
call fcn.100195cf
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0x19], 1
mov eax, dword [ebp - 0x224]
cmp eax, dword [ebp - 0xcc]
jg 0x1002a8a7
movzx eax, byte [ebp - 0x19]
test eax, eax
je 0x1002a829
lea eax, [ebp - 0xc08]
push eax
push dword [ebp - 0x224]
lea ecx, [ebp - 0xc74]
call fcn.10019621
mov dl, byte [eax]
lea ecx, [ebp - 0x115c]
call fcn.1004ac10
pop ecx
mov dword [ebp - 0x87c], eax
push dword [ebp - 0x87c]
lea ecx, [ebp - 0xc08]
call fcn.10019582
lea ecx, [ebp - 0x115c]
call fcn.100195a7
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
jmp 0x1002a87e
lea eax, [ebp - 0xc08]
push eax
push dword [ebp - 0xcc]
lea ecx, [ebp - 0xc74]
call fcn.10019621
mov dl, byte [eax]
lea ecx, [ebp - 0x1144]
call fcn.1004ac10
pop ecx
mov dword [ebp - 0xa34], eax
push dword [ebp - 0xa34]
lea ecx, [ebp - 0xc08]
call fcn.10019582
lea ecx, [ebp - 0x1144]
call fcn.100195a7
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
movzx eax, byte [ebp - 0x19]
test eax, eax
jne 0x1002a892
mov dword [ebp - 0x704], 1
jmp 0x1002a899
and dword [ebp - 0x704], 0
mov al, byte [ebp - 0x704]
mov byte [ebp - 0x19], al
jmp 0x1002a7b8
push fcn.1001ea64
lea edx, [ebp - 0xc08]
mov ecx, 0x10663c78
call fcn.1001e8c7
mov ecx, eax
call fcn.10019c5d
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xc08]
call fcn.100195a7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc74]
call fcn.100195a7
mov dword [ebp - 0x2a0], 1
jmp 0x1002a8fa
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0x18
jge 0x1002a93e
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x1002a93c
push 1
push 0x1c8c
push 0x25a3
push 0x5252
push 0
push 0x2c06
push 1
push 0x10b
call fcn.10031a55
add esp, 0x20
jmp 0x1002a8ed
mov eax, dword [ebp - 0x884]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x300], eax
push 4
lea ecx, [ebp - 0x7d8]
call fcn.1001a0d2
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x188], 0xb79f6a71
mov dword [ebp - 0x1a8], 0
jmp 0x1002a984
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 4
jge 0x1002a9a0
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0xf3c], 0x4ec2e0cf
jmp 0x1002a977
lea eax, [ebp - 0x7d8]
push eax
push 0
lea eax, [ebp - 0x1a8]
push eax
push 0x18fa
call fcn.10028290
add esp, 0x10
push 3
lea ecx, [ebp - 0x7d8]
call fcn.1001a1d1
mov dword [eax], 3
jmp 0x1002a9f6
push 3
lea ecx, [ebp - 0x7d8]
call fcn.1001a1d1
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x42c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x42c]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x7d8]
call fcn.1001a1d1
cmp dword [eax], 0
jl 0x1002aaf7
mov dword [ebp - 0x614], 0xfffffffb
mov dword [ebp - 0x22c], 0
jmp 0x1002aa2f
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 3
jge 0x1002aa4b
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0xfdc], 0x3a92bd42
jmp 0x1002aa22
mov byte [ebp - 0x104], 0
movzx eax, byte [ebp - 0x104]
test eax, eax
je 0x1002aa6b
push 0x6d6f
push 0
call fcn.10037a36
pop ecx
pop ecx
push 3
lea ecx, [ebp - 0x7d8]
call fcn.1001a1d1
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xf3c], 0xffffffff
je 0x1002aad6
push 3
lea ecx, [ebp - 0x7d8]
call fcn.1001a1d1
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xf3c]
mov dword [ebp - 0xd0c], eax
mov dword [ebp - 0x614], 1
mov esi, 0x6d0374c7
sub esi, dword [ebp - 0x614]
push 3
lea ecx, [ebp - 0x7d8]
call fcn.1001a1d1
mov eax, dword [eax]
cmp esi, dword [ebp + eax*4 - 0xf3c]
je 0x1002aad6
and dword [ebp - 0x434], 0
jmp 0x1002aae0
mov dword [ebp - 0x434], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x434]
mov dword [ebp + eax - 0xfdc], ecx
jmp 0x1002a9d2
mov dword [ebp - 0x188], 0xfffffffa
jmp 0x1002ab10
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xffffffe6
jne 0x1002ab8b
mov dword [ebp - 0x9dc], 0xffffffff
push 1
lea ecx, [ebp - 0xbe4]
call fcn.1001a0d2
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0xd14]
push eax
push 0x346a
lea eax, [ebp - 0xbe4]
push eax
push 0
call fcn.10028e34
add esp, 0x10
push 1
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0xbe4]
push eax
push 0
push 0x1a5f
lea eax, [ebp - 0x9dc]
push eax
call fcn.1003633d
add esp, 0x18
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xbe4]
call fcn.1001a156
jmp 0x1002ab03
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7d8]
call fcn.1001a156
push 3
lea ecx, [ebp - 0xe60]
call fcn.1001a0d2
mov dword [ebp - 4], 0x15
lea eax, [ebp - 0xe60]
push eax
lea eax, [ebp - 0x1b8]
push eax
push 0
push 0x3c49
call fcn.1004487d
add esp, 0x10
mov dword [ebp - 0x1b8], 0
jmp 0x1002abe4
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 4
jge 0x1002ac00
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0xcd8], 0x1e1e87df
jmp 0x1002abd7
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xcd8], 2
jmp 0x1002ac2e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcd8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xcd8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xcd8], 0
jl 0x1002ac73
mov byte [ebp - 0xe5], 0
push 0x4171
push 0xc7b
lea eax, [ebp - 0xe5]
push eax
push 0x488e
push 0
push 0x6163
push 0x36c6
push 0
call fcn.100305dc
add esp, 0x20
jmp 0x1002ac13
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe60]
call fcn.1001a156
mov dword [ebp - 0x244], 5
mov dword [ebp - 0xa7c], 0xe1757117
mov dword [ebp - 0x88c], 0x5231fbf6
push 0x60e5
push 0
lea eax, [ebp - 0x88c]
push eax
lea eax, [ebp - 0xa7c]
push eax
push 0
push 0x4ab0
push 0x6402
push 0xbbc
call fcn.10028ec1
add esp, 0x20
mov dword [ebp - 0x394], 0xbe4
mov dword [ebp - 0x390], 0xbe4
mov dword [ebp - 0x38c], 0xbe4
mov dword [ebp - 0x388], 0xbe4
mov dword [ebp - 0x33c], 0x15898f01
mov dword [ebp - 0x340], 0xfffffff9
mov dword [ebp - 0x23c], 1
mov dword [ebp - 0x190], 0x74952f34
push 3
lea ecx, [ebp - 0xaf8]
call fcn.1001a0d2
mov dword [ebp - 4], 0x16
push 0x3e36
push 0x11ba
lea eax, [ebp - 0xd1c]
push eax
push 0
lea eax, [ebp - 0xaf8]
push eax
call fcn.1002871d
add esp, 0x14
xor eax, eax
inc eax
je 0x1002ad75
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x394], 0
je 0x1002ad75
mov dword [ebp - 0x444], 1
jmp 0x1002ad7c
and dword [ebp - 0x444], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x394]
cmp dword [ebp + eax - 0x394], ecx
jl 0x1002ada4
mov dword [ebp - 0x7c4], 1
jmp 0x1002adab
and dword [ebp - 0x7c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x394]
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x340], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x394]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x7c4]
neg eax
mov ecx, dword [ebp - 0x340]
imul ecx, dword [ebp - 0x190]
cmp ecx, eax
jne 0x1002ae0e
mov dword [ebp - 0x43c], 1
jmp 0x1002ae15
and dword [ebp - 0x43c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x394]
cmp dword [ebp - 0x43c], eax
jne 0x1002ae36
mov dword [ebp - 0x61c], 1
jmp 0x1002ae3d
and dword [ebp - 0x61c], 0
imul eax, dword [ebp - 0x61c], 0xffffffff
cmp dword [ebp - 0x444], eax
jle 0x1002ae58
mov dword [ebp - 0x70c], 1
jmp 0x1002ae5f
and dword [ebp - 0x70c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x394]
add eax, dword [ebp - 0x70c]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x394]
test eax, eax
je 0x1002b06a
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x2f4], 0x1cd1ac8c
mov dword [ebp - 0x89c], 0xc844fc3
mov dword [ebp - 0x280], 0
jmp 0x1002aebc
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 1
jge 0x1002aed8
mov eax, dword [ebp - 0x280]
mov dword [ebp + eax*4 - 0x894], 5
jmp 0x1002aeaf
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x340]
cmp dword [ebp - 0x38], eax
jge 0x1002afc5
cmp dword [ebp - 0x38], 0
je 0x1002afb3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x394]
mov dword [ebp - 0xd24], eax
cmp dword [ebp - 0x38], 0xfffc
je 0x1002af1c
mov dword [ebp - 0x44c], 1
jmp 0x1002af23
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
add eax, 0x6e3268d
mov dword [ebp - 0x624], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x624]
mov dword [ebp + eax - 0x894], ecx
imul eax, dword [ebp - 0x624], 0xfffffffb
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x394]
jne 0x1002af69
mov dword [ebp - 0x454], 1
jmp 0x1002af70
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0
je 0x1002af98
push 9
pop eax
test eax, eax
je 0x1002af98
mov dword [ebp - 0x784], 1
jmp 0x1002af9f
and dword [ebp - 0x784], 0
imul eax, dword [ebp - 0x784], 0xd6b2
imul eax, eax, 0x94fb
test eax, eax
jne 0x1002afb9
cmp dword [ebp - 0x38], 0
je 0x1002afc5
mov dword [ebp - 0x9e4], 1
jmp 0x1002afcc
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x2f4], eax
jl 0x1002afe3
mov dword [ebp - 0x45c], 1
jmp 0x1002afea
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x89c], eax
mov dword [ebp - 0x38], 0
jmp 0x1002b006
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xfffffff2
jg 0x1002b065
mov dword [ebp - 0x234], 0
jmp 0x1002b025
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 2
jge 0x1002b041
mov eax, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0xdfc], 0xfffffff6
jmp 0x1002b018
push 0
lea eax, [ebp - 0x33c]
push eax
call fcn.100281e4
pop ecx
pop ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xdfc], 0
je 0x1002b063
jmp 0x1002afff
jmp 0x1002afff
jmp 0x1002b1a0
mov dword [ebp - 0xa3c], 0x44fa
mov dword [ebp - 0x2c4], 0
jmp 0x1002b08d
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 1
jge 0x1002b0a9
mov eax, dword [ebp - 0x2c4]
mov dword [ebp + eax*4 - 0x634], 1
jmp 0x1002b080
mov byte [ebp - 0x106], 0
lea eax, [ebp - 0x106]
push eax
push 0
call fcn.10037f79
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0xaf8]
call fcn.1001a1d1
mov esi, dword [eax]
add esi, 4
push 0
lea ecx, [ebp - 0xaf8]
call fcn.1001a1d1
cmp esi, dword [eax]
jl 0x1002b0ef
mov dword [ebp - 0x62c], 1
jmp 0x1002b0f6
and dword [ebp - 0x62c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x634]
cmp eax, dword [ebp - 0x62c]
jne 0x1002b117
mov dword [ebp - 0x464], 1
jmp 0x1002b11e
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0xa3c]
cmp eax, dword [ebp - 0x464]
jg 0x1002b138
mov dword [ebp - 0x714], 1
jmp 0x1002b13f
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x23c]
cmp eax, dword [ebp - 0x714]
jle 0x1002b159
mov dword [ebp - 0x46c], 1
jmp 0x1002b160
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x190], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x634]
cmp dword [ebp - 0x190], eax
je 0x1002b18d
mov dword [ebp - 0x474], 1
jmp 0x1002b194
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x23c], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x394]
dec eax
cmp eax, 0xfffffffa
je 0x1002b1bf
mov dword [ebp - 0x7ec], 1
jmp 0x1002b1c6
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x7ec]
mov dword [ebp - 0x190], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaf8]
call fcn.1001a156
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x1002b901
mov dword [ebp - 0x150], 0xfffffff7
push 3
lea ecx, [ebp - 0x1d0]
call fcn.1001a0d2
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x34], 0x9b4e
mov dword [ebp - 0x794], 0x415dbe4b
mov dword [ebp - 0x734], 0xb11f
mov dword [ebp - 0x288], 0
jmp 0x1002b249
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 3
jge 0x1002b26b
push dword [ebp - 0x288]
lea ecx, [ebp - 0x1d0]
call fcn.1001a1d1
mov dword [eax], 1
jmp 0x1002b23c
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x934], eax
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x8a4]
cmp eax, dword [ebp - 0x934]
je 0x1002b2a1
mov dword [ebp - 0x47c], 1
jmp 0x1002b2a8
and dword [ebp - 0x47c], 0
cmp dword [ebp - 0x47c], 0xffffffff
jg 0x1002b39b
push 2
lea ecx, [ebp - 0x1d0]
call fcn.1001a1d1
cmp dword [eax], 0x48f4a8fe
jg 0x1002b2d6
mov dword [ebp - 0x63c], 1
jmp 0x1002b2dd
and dword [ebp - 0x63c], 0
cmp dword [ebp - 0x63c], 0
jbe 0x1002b2f2
mov dword [ebp - 0x484], 1
jmp 0x1002b2f9
and dword [ebp - 0x484], 0
push 0
lea ecx, [ebp - 0x1d0]
call fcn.1001a1d1
mov ecx, dword [ebp - 0x484]
cmp ecx, dword [eax]
jl 0x1002b31c
mov dword [ebp - 0x8ac], 1
jmp 0x1002b323
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0xd2c], eax
push 0
lea ecx, [ebp - 0x1d0]
call fcn.1001a1d1
mov esi, eax
push 0
lea ecx, [ebp - 0x1d0]
call fcn.1001a1d1
mov esi, dword [esi]
sub esi, dword [eax]
inc esi
push 1
lea ecx, [ebp - 0x1d0]
call fcn.1001a1d1
cmp esi, dword [eax]
jg 0x1002b36d
mov dword [ebp - 0x948], 1
jmp 0x1002b374
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xd34], eax
push 0
lea ecx, [ebp - 0x1d0]
call fcn.1001a1d1
cmp dword [eax], 0
je 0x1002b39b
mov dword [ebp - 0x2fc], 1
jmp 0x1002b3a2
and dword [ebp - 0x2fc], 0
push 0
lea ecx, [ebp - 0x1d0]
call fcn.1001a1d1
mov ecx, dword [ebp - 0x2fc]
mov dword [eax], ecx
cmp dword [ebp - 0x2fc], 0xb8fa48a2
jb 0x1002b3cf
mov dword [ebp - 0x71c], 1
jmp 0x1002b3d6
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x71c], eax
jl 0x1002b3f0
mov dword [ebp - 0x48c], 1
jmp 0x1002b3f7
and dword [ebp - 0x48c], 0
cmp dword [ebp - 0x48c], 0xde0bcd8c
jae 0x1002b428
mov dword [ebp - 0x34], 0
jmp 0x1002b413
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jg 0x1002b423
push 0
call fcn.100454be
pop ecx
jmp 0x1002b40c
jmp 0x1002b8d0
mov dword [ebp - 0x49c], 0x25a1b582
mov dword [ebp - 0x4dc], 0xa0d0a060
mov dword [ebp - 0x8bc], 0xfffffff8
mov dword [ebp - 0x58], 0
jmp 0x1002b456
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x1002b46c
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x384], 0x45c761b8
jmp 0x1002b44f
mov dword [ebp - 0x58], 0
jmp 0x1002b47c
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1002b492
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x4ec], 0xf88197c5
jmp 0x1002b475
cmp dword [ebp - 0x34], 0
je 0x1002b852
push 0
lea ecx, [ebp - 0x1d0]
call fcn.1001a1d1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x384]
mov dword [ebp - 0xd3c], eax
mov eax, dword [ebp - 0x34]
sub eax, 0xa784
cmp eax, 0x386b
jg 0x1002b4e7
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x384], 0
je 0x1002b4e7
mov dword [ebp - 0x644], 1
jmp 0x1002b4ee
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x644]
sub eax, dword [ebp - 0x34]
jne 0x1002b50b
mov eax, 0x76a1
test eax, eax
jne 0x1002b50b
and dword [ebp - 0x8b4], 0
jmp 0x1002b515
mov dword [ebp - 0x8b4], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x384]
mov dword [ebp - 0xd44], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x384], 0xdf936bb3
jne 0x1002b545
mov dword [ebp - 0x494], 1
jmp 0x1002b54c
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x494], 1
jae 0x1002b561
mov dword [ebp - 0x78c], 1
jmp 0x1002b568
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x78c]
mov dword [ebp - 0x49c], eax
mov esi, dword [ebp - 0x49c]
push 0
lea ecx, [ebp - 0x1d0]
call fcn.1001a1d1
sub esi, dword [eax]
jne 0x1002b59d
mov eax, 0xb3bd
test eax, eax
jne 0x1002b59d
and dword [ebp - 0x64c], 0
jmp 0x1002b5a7
mov dword [ebp - 0x64c], 1
cmp dword [ebp - 0x64c], 0x4b2b3a3
jne 0x1002b5bf
mov dword [ebp - 0x4a4], 1
jmp 0x1002b5c6
and dword [ebp - 0x4a4], 0
cmp dword [ebp - 0x4a4], 0xffffffff
jg 0x1002b5db
mov dword [ebp - 0x724], 1
jmp 0x1002b5e2
and dword [ebp - 0x724], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x384]
cmp dword [ebp - 0x724], eax
jle 0x1002b603
mov dword [ebp - 0x4ac], 1
jmp 0x1002b60a
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x4ac]
add eax, 0x12619d9c
jne 0x1002b632
push 0
lea ecx, [ebp - 0x1d0]
call fcn.1001a1d1
cmp dword [eax], 0
jne 0x1002b632
and dword [ebp - 0x654], 0
jmp 0x1002b63c
mov dword [ebp - 0x654], 1
cmp dword [ebp - 0x654], 0x43585f1c
jge 0x1002b654
mov dword [ebp - 0x4b4], 1
jmp 0x1002b65b
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x150]
cmp eax, dword [ebp - 0x4b4]
jle 0x1002b675
mov dword [ebp - 0x7cc], 1
jmp 0x1002b67c
and dword [ebp - 0x7cc], 0
cmp dword [ebp - 0x7cc], 0xffffffff
jle 0x1002b693
or eax, 0xffffffff
jne 0x1002b693
and dword [ebp - 0x4bc], 0
jmp 0x1002b69d
mov dword [ebp - 0x4bc], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x384]
cmp dword [ebp - 0x4bc], eax
jge 0x1002b6be
mov dword [ebp - 0x65c], 1
jmp 0x1002b6c5
and dword [ebp - 0x65c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x384]
cmp eax, dword [ebp - 0x65c]
jne 0x1002b6e6
mov dword [ebp - 0x4c4], 1
jmp 0x1002b6ed
and dword [ebp - 0x4c4], 0
push 1
lea ecx, [ebp - 0x1d0]
call fcn.1001a1d1
mov ecx, dword [ebp - 0x4c4]
cmp ecx, dword [eax]
jl 0x1002b71f
push 0
lea ecx, [ebp - 0x1d0]
call fcn.1001a1d1
cmp dword [eax], 0
jne 0x1002b71f
and dword [ebp - 0x72c], 0
jmp 0x1002b729
mov dword [ebp - 0x72c], 1
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x4dc], eax
imul eax, dword [ebp - 0x150], 0x6e3f
cmp eax, 0xffffffff
jl 0x1002b750
mov dword [ebp - 0x4cc], 1
jmp 0x1002b757
and dword [ebp - 0x4cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x384]
cmp dword [ebp - 0x4cc], eax
jne 0x1002b77e
mov eax, 0x94a7
test eax, eax
jne 0x1002b77e
and dword [ebp - 0x664], 0
jmp 0x1002b788
mov dword [ebp - 0x664], 1
push 1
lea ecx, [ebp - 0x1d0]
call fcn.1001a1d1
mov ecx, dword [ebp - 0x664]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x384], 0xfffffffd
jl 0x1002b7b9
mov dword [ebp - 0x4d4], 1
jmp 0x1002b7c0
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x794], eax
cmp dword [ebp - 0x794], 0xffffffff
jg 0x1002b7e4
mov dword [ebp - 0x950], 1
jmp 0x1002b7eb
and dword [ebp - 0x950], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x384]
mov dword [ebp - 0xd4c], eax
mov eax, dword [ebp - 0x8bc]
cmp dword [ebp - 0x4dc], eax
jge 0x1002b818
mov dword [ebp - 0x66c], 1
jmp 0x1002b81f
and dword [ebp - 0x66c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x384]
cmp dword [ebp - 0x66c], eax
jg 0x1002b852
push 0
lea ecx, [ebp - 0x1d0]
call fcn.1001a1d1
cmp dword [eax], 0
je 0x1002b852
mov dword [ebp - 0x4e4], 1
jmp 0x1002b859
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
sub eax, 6
cmp eax, dword [ebp - 0x150]
je 0x1002b879
mov eax, dword [ebp - 0x734]
dec eax
mov dword [ebp - 0x734], eax
jmp 0x1002b8d0
mov dword [ebp - 0xd54], 0x6aefbdd5
mov byte [ebp - 0x108], 0
movzx eax, byte [ebp - 0x108]
test eax, eax
je 0x1002b8b5
push 0x7a70
push 0x35bf
push 0x50fd
push 0x1e64
push 1
push 0
call fcn.10027de3
add esp, 0x18
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4ec]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x4ec], eax
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1002b8ea
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d0]
call fcn.1001a156
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 0x11c], 0xfff6
mov dword [ebp - 0x674], 1
mov dword [ebp - 0x7fc], 0x5ca42045
mov dword [ebp - 0x930], 0xc8dd
mov dword [ebp - 0x8c4], 0xae4f
mov dword [ebp - 0x960], 0xfffffffa
mov dword [ebp - 0x344], 0xfffffff6
mov dword [ebp - 0x8cc], 0x8f738f58
mov dword [ebp - 0x968], 8
mov dword [ebp - 0x54], 0
jmp 0x1002b96b
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x1002b981
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xe70], 0xfffffffb
jmp 0x1002b964
mov dword [ebp - 0x54], 0
jmp 0x1002b991
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x1002b9a7
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xb18], 0xfffffff8
jmp 0x1002b98a
mov byte [ebp - 0x10a], 0
movzx eax, byte [ebp - 0x10a]
test eax, eax
je 0x1002b9e1
push 0xfd1
push 0
push 0x4161
push 0x1931
push 0x2699
push 0x7aa9
push 0x1a3
call fcn.10042d81
add esp, 0x1c
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x11c], eax
jle 0x1002b9f6
cmp dword [ebp - 0x11c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x11c]
mov dword [ebp + eax - 0xb18], ecx
mov eax, dword [ebp - 0x930]
mov dword [ebp - 0xd5c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb18]
mov dword [ebp - 0xd64], eax
mov dword [ebp - 0x674], 1
mov eax, dword [ebp - 0x674]
add eax, 0x3d9
mov dword [ebp - 0x4f4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4f4]
mov dword [ebp + eax - 0xe70], ecx
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x7fc], eax
mov eax, dword [ebp - 0x7fc]
mov dword [ebp - 0xd6c], eax
mov eax, dword [ebp - 0x8c4]
mov dword [ebp - 0xd74], eax
mov eax, dword [ebp - 0x344]
cmp dword [ebp - 0x960], eax
jle 0x1002ba94
mov dword [ebp - 0x4fc], 1
jmp 0x1002ba9b
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x4fc]
jl 0x1002bab5
mov dword [ebp - 0x67c], 1
jmp 0x1002babc
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x67c]
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0
jne 0x1002badf
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe70], 0
mov eax, dword [ebp - 0x8cc]
cmp dword [ebp - 0x11c], eax
jg 0x1002baf9
mov dword [ebp - 0x504], 1
jmp 0x1002bb00
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x968], eax
mov dword [ebp - 0x244], 1
jmp 0x1002bb25
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0x18
jge 0x1002bd79
mov dword [ebp - 0x80], 0xffffffff
mov dword [ebp - 0xd4], 1
push 1
lea ecx, [ebp - 0xc2c]
call fcn.1001a0d2
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x60], 0
jmp 0x1002bb67
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x1002bb80
push dword [ebp - 0x60]
lea ecx, [ebp - 0xc2c]
call fcn.1001a1d1
or dword [eax], 0xffffffff
jmp 0x1002bb60
mov dword [ebp - 0x60], 0
jmp 0x1002bb90
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 4
jge 0x1002bba6
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x1054], 6
jmp 0x1002bb89
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xd7c], eax
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x80], eax
jne 0x1002bbc3
mov dword [ebp - 0x73c], 1
jmp 0x1002bbca
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x73c], eax
jge 0x1002bbe4
mov dword [ebp - 0x50c], 1
jmp 0x1002bbeb
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x50c], eax
jg 0x1002bc05
mov dword [ebp - 0x684], 1
jmp 0x1002bc0c
and dword [ebp - 0x684], 0
cmp dword [ebp - 0x684], 0x71a0513
jge 0x1002bc24
mov dword [ebp - 0x514], 1
jmp 0x1002bc2b
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x514]
jge 0x1002bc42
mov dword [ebp - 0x79c], 1
jmp 0x1002bc49
and dword [ebp - 0x79c], 0
cmp dword [ebp - 0x79c], 4
jbe 0x1002bc64
cmp dword [ebp - 0xd4], 0
jne 0x1002bc64
and dword [ebp - 0x8d4], 0
jmp 0x1002bc6e
mov dword [ebp - 0x8d4], 1
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0xd84], eax
cmp dword [ebp - 0xd4], 5
je 0x1002bc8f
mov dword [ebp - 0x970], 1
jmp 0x1002bc96
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xd8c], eax
mov eax, dword [ebp - 0x80]
imul eax, dword [ebp - 0x80]
cmp dword [ebp - 0x80], eax
je 0x1002bcb7
mov dword [ebp - 0x51c], 1
jmp 0x1002bcbe
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
sub eax, 3
cmp eax, dword [ebp - 0xd4]
jge 0x1002bcdb
mov dword [ebp - 0x68c], 1
jmp 0x1002bce2
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x68c], eax
jg 0x1002bcfc
mov dword [ebp - 0x304], 1
jmp 0x1002bd03
and dword [ebp - 0x304], 0
push 0
lea ecx, [ebp - 0xc2c]
call fcn.1001a1d1
mov ecx, dword [ebp - 0x304]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x304]
mov dword [ebp + eax - 0x1054], ecx
mov byte [ebp - 0x9a], 0
movzx eax, byte [ebp - 0x9a]
test eax, eax
je 0x1002bd45
push 0
call fcn.10028237
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc2c]
call fcn.1001a156
mov byte [ebp - 0x9b], 0
movzx eax, byte [ebp - 0x9b]
test eax, eax
je 0x1002bd74
push 0x6dfa
push 0
call fcn.10037ac2
pop ecx
pop ecx
jmp 0x1002bb18
cmp dword [ebp - 0x300], 0
jle 0x10030329
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x88], 0xef874ac
mov dword [ebp - 0x904], 9
mov dword [ebp - 0x594], 0xbd04657e
mov dword [ebp - 0x9b8], 3
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xd94], eax
cmp dword [ebp - 0x18], 3
jne 0x1002bdd7
mov dword [ebp - 0x524], 1
jmp 0x1002bdde
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x524]
cmp eax, 6
jae 0x1002bdf8
mov dword [ebp - 0x8dc], 1
jmp 0x1002bdff
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xd9c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xda4], eax
mov eax, 0x4333
cmp eax, 6
je 0x1002be27
mov dword [ebp - 0x744], 1
jmp 0x1002be2e
and dword [ebp - 0x744], 0
imul eax, dword [ebp - 0x744], 0xfffffffa
cmp eax, dword [ebp - 0x30]
jl 0x1002be46
mov dword [ebp - 0x52c], 1
jmp 0x1002be4d
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x52c], eax
jl 0x1002be64
mov dword [ebp - 0x694], 1
jmp 0x1002be6b
and dword [ebp - 0x694], 0
cmp dword [ebp - 0x694], 0
jle 0x1002be80
mov dword [ebp - 0x534], 1
jmp 0x1002be87
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
add eax, 0x36ef
cmp eax, 9
jg 0x1002beaf
mov dword [ebp - 0x978], 1
jmp 0x1002beb6
and dword [ebp - 0x978], 0
cmp dword [ebp - 0x88], 0
jne 0x1002bece
cmp dword [ebp - 0x18], 0
jne 0x1002bece
and dword [ebp - 0x7dc], 0
jmp 0x1002bed8
mov dword [ebp - 0x7dc], 1
cmp dword [ebp - 0x7dc], 0xfffa
je 0x1002bef0
mov dword [ebp - 0x8e4], 1
jmp 0x1002bef7
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xdac], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x30], eax
jl 0x1002bf14
mov dword [ebp - 0x53c], 1
jmp 0x1002bf1b
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x53c], eax
jle 0x1002bf32
mov dword [ebp - 0x69c], 1
jmp 0x1002bf39
and dword [ebp - 0x69c], 0
cmp dword [ebp - 0x69c], 1
jg 0x1002bf4e
mov dword [ebp - 0x544], 1
jmp 0x1002bf55
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x544]
neg eax
shl eax, 3
cmp eax, dword [ebp - 0x30]
jl 0x1002bf71
mov dword [ebp - 0x74c], 1
jmp 0x1002bf78
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x74c]
je 0x1002bf8f
mov dword [ebp - 0x54c], 1
jmp 0x1002bf96
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x54c]
neg eax
cmp eax, dword [ebp - 0x30]
jge 0x1002bfaf
mov dword [ebp - 0x6a4], 1
jmp 0x1002bfb6
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x6a4], eax
jl 0x1002bfcd
mov dword [ebp - 0x554], 1
jmp 0x1002bfd4
and dword [ebp - 0x554], 0
cmp dword [ebp - 0x554], 0xffab
jge 0x1002bfec
mov dword [ebp - 0x980], 1
jmp 0x1002bff3
and dword [ebp - 0x980], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xdb4], eax
cmp dword [ebp - 0x18], 0
jne 0x1002c700
mov dword [ebp - 0x198], 1
mov dword [ebp - 0x30c], 1
mov dword [ebp - 0x764], 0xc63b
mov dword [ebp - 0x30], 0xfffffffc
jmp 0x1002c034
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x2b
jge 0x1002c6fe
mov dword [ebp - 0xdc], 7
mov dword [ebp - 0x9a8], 0
mov dword [ebp - 0x858], 0xffffffff
mov dword [ebp - 0x88], 0
jmp 0x1002c075
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xffffffe5
jne 0x1002c6f9
push 2
lea ecx, [ebp - 0x2d0]
call fcn.1001a0d2
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x2a8], 0
jmp 0x1002c0af
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 2
jge 0x1002c0d1
push dword [ebp - 0x2a8]
lea ecx, [ebp - 0x2d0]
call fcn.1001a1d1
mov dword [eax], 0xfffffff7
jmp 0x1002c0a2
mov dword [ebp - 0x8ec], 0x145e
cmp dword [ebp - 0x8ec], 0x553
jge 0x1002c15d
lea eax, [ebp - 0x8f4]
push eax
lea eax, [ebp - 0x7a4]
push eax
lea eax, [ebp - 0x988]
push eax
push 0x10007908
call fcn.10058e8b
add esp, 0x10
cvtsi2sd xmm0, dword [ebp - 0x7a4]
mulsd xmm0, qword [0x10008180]
cvtsi2sd xmm1, dword [ebp - 0x988]
mulsd xmm0, xmm1
mov eax, dword [ebp - 0x7a4]
add eax, dword [ebp - 0x8f4]
cvtsi2sd xmm1, eax
divsd xmm0, xmm1
movsd qword [ebp - 0xf44], xmm0
push ecx
push ecx
movsd xmm0, qword [ebp - 0xf44]
movsd qword [esp], xmm0
push 0x10007918
call fcn.100597a7
add esp, 0xc
mov dword [ebp - 0x18], 0
jmp 0x1002c16d
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffe7
jge 0x1002c6d8
mov dword [ebp - 0x990], 0x1a28
cmp dword [ebp - 0x990], 0x10a1
jge 0x1002c232
push 4
pop eax
imul eax, eax, 0
mov dword [eax + 0x11681900], 1
mov dword [ebp - 0x24c], 1
jmp 0x1002c1ba
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0x3d
jg 0x1002c1d7
call fcn.10028e4f
mov ecx, dword [ebp - 0x24c]
mov dword [ecx*4 + 0x11245440], eax
jmp 0x1002c1ad
push 0x108b97cc
push 0x1000780c
call fcn.10058e8b
pop ecx
pop ecx
mov eax, dword [0x108b97cc]
mov dword [ebp - 0x8fc], eax
mov eax, dword [0x108b97cc]
dec eax
mov dword [0x108b97cc], eax
cmp dword [ebp - 0x8fc], 0
je 0x1002c232
push 0x108b97c8
push 0x1000780c
call fcn.10058e8b
pop ecx
pop ecx
mov eax, dword [0x108b97c8]
push dword [eax*4 + 0x11245440]
push 0x10007894
call fcn.100597a7
pop ecx
pop ecx
jmp 0x1002c1e8
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x7bc], 0xfffffffc
mov dword [ebp - 0x20], 1
jmp 0x1002c253
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x1002c6d3
mov dword [ebp - 0x144], 0xfffffffd
mov dword [ebp - 0x754], 0
mov dword [ebp - 0x91c], 0x21c653c2
mov dword [ebp - 0x144], 1
jmp 0x1002c294
cmp dword [ebp - 0x144], 0
jl 0x1002c6ce
mov dword [ebp - 0x290], 0
jmp 0x1002c2ba
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 4
jge 0x1002c2d6
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0x106c], 0xc12abb1e
jmp 0x1002c2ad
push dword [ebp - 0x20]
lea ecx, [ebp - 0x2d0]
call fcn.1001a1d1
mov esi, dword [ebp - 0xdc]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x2d0]
call fcn.1001a1d1
imul esi, dword [eax]
test esi, esi
je 0x1002c310
or eax, 0xffffffff
je 0x1002c310
mov dword [ebp - 0x55c], 1
jmp 0x1002c317
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x198]
imul eax, dword [ebp - 0x55c]
cmp eax, dword [ebp - 0x198]
jle 0x1002c338
mov dword [ebp - 0x998], 1
jmp 0x1002c33f
and dword [ebp - 0x998], 0
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0xdbc], eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x2d0]
call fcn.1001a1d1
mov ecx, dword [ebp - 0xdc]
cmp dword [eax], ecx
jle 0x1002c36f
mov dword [ebp - 0x6ac], 1
jmp 0x1002c376
and dword [ebp - 0x6ac], 0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x2d0]
call fcn.1001a1d1
mov ecx, dword [ebp - 0x6ac]
cmp ecx, dword [eax]
jle 0x1002c39a
mov dword [ebp - 0x564], 1
jmp 0x1002c3a1
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x754], eax
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x754], eax
je 0x1002c3c7
mov dword [ebp - 0x56c], 1
jmp 0x1002c3ce
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x904]
imul eax, dword [ebp - 0x56c]
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0xfffffff7
jge 0x1002c3f6
mov dword [ebp - 0x9a0], 1
jmp 0x1002c3fd
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xdc4], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xdc], eax
jge 0x1002c41f
or eax, 0xffffffff
jne 0x1002c41f
and dword [ebp - 0x90c], 0
jmp 0x1002c429
mov dword [ebp - 0x90c], 1
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0xdcc], eax
cmp dword [ebp - 0xdc], 0
jne 0x1002c450
mov eax, 0xe51
test eax, eax
jne 0x1002c450
and dword [ebp - 0x6b4], 0
jmp 0x1002c45a
mov dword [ebp - 0x6b4], 1
push dword [ebp - 0x20]
lea ecx, [ebp - 0x2d0]
call fcn.1001a1d1
mov ecx, dword [ebp - 0x6b4]
cmp ecx, dword [eax]
jle 0x1002c47e
mov dword [ebp - 0x574], 1
jmp 0x1002c485
and dword [ebp - 0x574], 0
mov esi, dword [ebp - 0x198]
imul esi, dword [ebp - 0x574]
push 1
lea ecx, [ebp - 0x2d0]
call fcn.1001a1d1
cmp esi, dword [eax]
jg 0x1002c4b3
jmp 0x1002c24c
jmp 0x1002c166
mov eax, dword [ebp - 0x764]
dec eax
mov dword [ebp - 0x764], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d0]
call fcn.1001a156
jmp 0x1002c068
jmp 0x1002c02d
jmp 0x1002c738
mov dword [ebp - 0x924], 0xfffffff6
lea eax, [ebp - 0x9b8]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x64fb
lea eax, [ebp - 0x924]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x88]
push eax
push 0
call fcn.100305dc
add esp, 0x20
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x1002c754
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
call fcn.1004445c
pop ecx
mov dword [ebp - 0x160], 0xb110c93b
push 2
lea ecx, [ebp - 0xc44]
call fcn.1001a0d2
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x9c0], 0xfffffff7
push 0x5481
push 0x3c62
lea eax, [ebp - 0xc44]
push eax
push 0
lea eax, [ebp - 0xde4]
push eax
call fcn.10036866
add esp, 0x14
mov dword [ebp - 0x160], 0
jmp 0x1002c7bf
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 4
jg 0x1002c817
mov dword [ebp - 0x92c], 0xfffffffc
mov dword [ebp - 0x9c8], 0xfe012d2c
push 0
push 0x5232
lea eax, [ebp - 0x9c0]
push eax
lea eax, [ebp - 0x92c]
push eax
lea eax, [ebp - 0x160]
push eax
push 0x36b0
lea eax, [ebp - 0xc44]
push eax
push 0
lea eax, [ebp - 0x9c8]
push eax
call fcn.100331bc
add esp, 0x24
jmp 0x1002c7b2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc44]
call fcn.1001a156
push 4
lea ecx, [ebp - 0x7e8]
call fcn.1001a0d2
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x254], 0
jmp 0x1002c85d
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 4
jge 0x1002c879
mov eax, dword [ebp - 0x254]
mov dword [ebp + eax*4 - 0x116c], 0xc85f70ad
jmp 0x1002c850
mov dword [ebp - 0x2b8], 3
jmp 0x1002c892
mov eax, dword [ebp - 0x2b8]
dec eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
jl 0x1002c8d4
mov byte [ebp - 0x9f], 0
movzx eax, byte [ebp - 0x9f]
test eax, eax
je 0x1002c8b5
push 0
call fcn.1004500a
pop ecx
mov byte [ebp - 0xa1], 0
push 0x35b3
push 0
lea eax, [ebp - 0xa1]
push eax
call fcn.100332da
add esp, 0xc
jmp 0x1002c885
mov dword [ebp - 0x140], 0xb79f6a71
mov dword [ebp - 0xdec], 0xea75c96d
mov dword [ebp - 0xdf4], 0xffffffff
mov dword [ebp - 0xe00], 0xb108f825
mov dword [ebp - 0xe0c], 0x2d4ea680
mov dword [ebp - 0xe18], 0
mov dword [ebp - 0xe20], 0x61be360d
mov dword [ebp - 0x9d0], 0x4a6b2c4e
mov dword [ebp - 0x25c], 0
jmp 0x1002c93d
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 2
jge 0x1002c959
mov eax, dword [ebp - 0x25c]
mov dword [ebp + eax*4 - 0x10a4], 1
jmp 0x1002c930
lea eax, [ebp - 0x9d0]
push eax
push 0
call fcn.10030a6f
pop ecx
pop ecx
mov byte [ebp - 0xa3], 0
movzx eax, byte [ebp - 0xa3]
test eax, eax
je 0x1002c989
push 0
push 0x1dc3
call fcn.10037686
pop ecx
pop ecx
mov dword [ebp - 0x16c], 0
jmp 0x1002c9a2
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 4
jge 0x1002c9be
mov eax, dword [ebp - 0x16c]
mov dword [ebp + eax*4 - 0xf54], 0x4ec2e0cf
jmp 0x1002c995
mov dword [ebp - 0xe28], 9
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x1002c9ee
push 0x7c79
push 0x1a25
push 0
call fcn.10037d08
add esp, 0xc
mov byte [ebp - 0xa7], 0
movzx eax, byte [ebp - 0xa7]
test eax, eax
je 0x1002ce52
mov dword [ebp - 0x958], 0x1775
cmp dword [ebp - 0x958], 0x6ef
jge 0x1002ce23
lea eax, [ebp - 0xaa4]
push eax
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x348]
push eax
push 0x10007908
call fcn.10058e8b
add esp, 0x10
mov byte [ebp - 0xff], 0
lea eax, [ebp - 0xff]
push eax
push dword [ebp - 0x314]
lea ecx, [ebp - 0x1084]
call fcn.1001a2d7
mov dword [ebp - 0x9ec], eax
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0x94c], eax
mov byte [ebp - 4], 0x1c
push dword [ebp - 0x94c]
push dword [ebp - 0x348]
lea ecx, [ebp - 0x278]
call fcn.1004a475
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x1084]
call fcn.1001a315
and dword [ebp - 0x164], 0
mov dword [ebp - 0xe4], 1
jmp 0x1002cabb
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0xaa4]
jg 0x1002ce02
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x100078b0
call fcn.10058e8b
add esp, 0xc
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
push 1
push dword [ebp - 0x14]
lea eax, [ebp - 0x10f4]
push eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x278]
call fcn.1004a49c
mov ecx, eax
call fcn.1001a31e
mov ecx, eax
call fcn.1001a33d
cmp dword [ebp - 0x10], 0
jle 0x1002cbcc
cmp dword [ebp - 0x14], 0
jle 0x1002cbcc
push dword [ebp - 0x14]
lea eax, [ebp - 0x1004]
push eax
mov eax, dword [ebp - 0x10]
dec eax
push eax
lea ecx, [ebp - 0x278]
call fcn.1004a49c
mov ecx, eax
call fcn.1001a31e
mov ecx, eax
call fcn.1001a362
movzx eax, al
test eax, eax
je 0x1002cbcc
mov eax, dword [ebp - 0x14]
dec eax
push eax
lea eax, [ebp - 0x100c]
push eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x278]
call fcn.1004a49c
mov ecx, eax
call fcn.1001a31e
mov ecx, eax
call fcn.1001a362
movzx eax, al
test eax, eax
je 0x1002cbcc
mov eax, dword [ebp - 0x14]
dec eax
push eax
lea eax, [ebp - 0x101c]
push eax
mov eax, dword [ebp - 0x10]
dec eax
push eax
lea ecx, [ebp - 0x278]
call fcn.1004a49c
mov ecx, eax
call fcn.1001a31e
mov ecx, eax
call fcn.1001a362
movzx eax, al
test eax, eax
je 0x1002cbcc
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x164], eax
jmp 0x1002ce02
cmp dword [ebp - 0x10], 0
jle 0x1002cc86
mov eax, dword [ebp - 0x314]
dec eax
cmp dword [ebp - 0x14], eax
jge 0x1002cc86
push dword [ebp - 0x14]
lea eax, [ebp - 0x102c]
push eax
mov eax, dword [ebp - 0x10]
dec eax
push eax
lea ecx, [ebp - 0x278]
call fcn.1004a49c
mov ecx, eax
call fcn.1001a31e
mov ecx, eax
call fcn.1001a362
movzx eax, al
test eax, eax
je 0x1002cc86
mov eax, dword [ebp - 0x14]
inc eax
push eax
lea eax, [ebp - 0x103c]
push eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x278]
call fcn.1004a49c
mov ecx, eax
call fcn.1001a31e
mov ecx, eax
call fcn.1001a362
movzx eax, al
test eax, eax
je 0x1002cc86
mov eax, dword [ebp - 0x14]
inc eax
push eax
lea eax, [ebp - 0x10ac]
push eax
mov eax, dword [ebp - 0x10]
dec eax
push eax
lea ecx, [ebp - 0x278]
call fcn.1004a49c
mov ecx, eax
call fcn.1001a31e
mov ecx, eax
call fcn.1001a362
movzx eax, al
test eax, eax
je 0x1002cc86
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x164], eax
jmp 0x1002ce02
mov eax, dword [ebp - 0x348]
dec eax
cmp dword [ebp - 0x10], eax
jge 0x1002cd40
cmp dword [ebp - 0x14], 0
jle 0x1002cd40
push dword [ebp - 0x14]
lea eax, [ebp - 0x10bc]
push eax
mov eax, dword [ebp - 0x10]
inc eax
push eax
lea ecx, [ebp - 0x278]
call fcn.1004a49c
mov ecx, eax
call fcn.1001a31e
mov ecx, eax
call fcn.1001a362
movzx eax, al
test eax, eax
je 0x1002cd40
mov eax, dword [ebp - 0x14]
dec eax
push eax
lea eax, [ebp - 0x10cc]
push eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x278]
call fcn.1004a49c
mov ecx, eax
call fcn.1001a31e
mov ecx, eax
call fcn.1001a362
movzx eax, al
test eax, eax
je 0x1002cd40
mov eax, dword [ebp - 0x14]
dec eax
push eax
lea eax, [ebp - 0x10dc]
push eax
mov eax, dword [ebp - 0x10]
inc eax
push eax
lea ecx, [ebp - 0x278]
call fcn.1004a49c
mov ecx, eax
call fcn.1001a31e
mov ecx, eax
call fcn.1001a362
movzx eax, al
test eax, eax
je 0x1002cd40
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x164], eax
jmp 0x1002ce02
mov eax, dword [ebp - 0x348]
dec eax
cmp dword [ebp - 0x10], eax
jge 0x1002cdfd
mov eax, dword [ebp - 0x314]
dec eax
cmp dword [ebp - 0x14], eax
jge 0x1002cdfd
push dword [ebp - 0x14]
lea eax, [ebp - 0x10ec]
push eax
mov eax, dword [ebp - 0x10]
inc eax
push eax
lea ecx, [ebp - 0x278]
call fcn.1004a49c
mov ecx, eax
call fcn.1001a31e
mov ecx, eax
call fcn.1001a362
movzx eax, al
test eax, eax
je 0x1002cdfd
mov eax, dword [ebp - 0x14]
inc eax
push eax
lea eax, [ebp - 0x10fc]
push eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x278]
call fcn.1004a49c
mov ecx, eax
call fcn.1001a31e
mov ecx, eax
call fcn.1001a362
movzx eax, al
test eax, eax
je 0x1002cdfd
mov eax, dword [ebp - 0x14]
inc eax
push eax
lea eax, [ebp - 0x110c]
push eax
mov eax, dword [ebp - 0x10]
inc eax
push eax
lea ecx, [ebp - 0x278]
call fcn.1004a49c
mov ecx, eax
call fcn.1001a31e
mov ecx, eax
call fcn.1001a362
movzx eax, al
test eax, eax
je 0x1002cdfd
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x164], eax
jmp 0x1002ce02
jmp 0x1002caae
push dword [ebp - 0x164]
push 0x10007898
call fcn.100597a7
pop ecx
pop ecx
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x278]
call fcn.1004a497
push 1
push 0x426f
push 0x6fbb
push 0x6200
push 0x289d
push 0x6238
push 0xbf7
push 0
push 0x5fcf
call fcn.100331bc
add esp, 0x24
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x7e8]
push eax
push 0
push 0x73e2
call fcn.100332f2
add esp, 0x10
push 3
lea ecx, [ebp - 0x2dc]
call fcn.1001a0d2
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x350], 0xd8d13034
mov dword [ebp - 0x218], 7
mov dword [ebp - 0x5bc], 0x69d1fe9
mov dword [ebp - 0x174], 1
mov dword [ebp - 0xb90], 0x74d4a788
mov dword [ebp - 0xb8c], 0x74d4a788
mov dword [ebp - 0xb88], 0x74d4a788
mov dword [ebp - 0xb84], 0x74d4a788
lea ecx, [ebp - 0x315]
call fcn.1001a1e0
push eax
lea eax, [ebp - 0xb80]
push eax
lea eax, [ebp - 0xb90]
push eax
lea ecx, [ebp - 0x112c]
call fcn.1001a377
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x848]
call fcn.1001a130
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x124], 0x975a1448
mov dword [ebp - 0x3b4], 0x8b257695
mov dword [ebp - 0xb68], 0x15aca64a
mov dword [ebp - 0xb64], 0x15aca64a
mov dword [ebp - 0xb60], 0x15aca64a
mov dword [ebp - 0xb5c], 0x15aca64a
lea ecx, [ebp - 0x31d]
call fcn.1001a1e0
push eax
lea eax, [ebp - 0xb58]
push eax
lea eax, [ebp - 0xb68]
push eax
lea ecx, [ebp - 0x1124]
call fcn.1001a377
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa58]
call fcn.1001a130
mov byte [ebp - 4], 0x21
push 0x766b
push 0x1872
push 0
lea eax, [ebp - 0x2dc]
push eax
push 0x4e51
lea eax, [ebp - 0x40]
push eax
push 1
push 0
call fcn.10033319
add esp, 0x20
mov dword [ebp - 0x40], 0
jmp 0x1002cfb6
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1002cfcc
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xe08], 0x60b0ceaf
jmp 0x1002cfaf
mov dword [ebp - 0x40], 0
jmp 0x1002cfdc
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x1002cff2
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xff4], 0
jmp 0x1002cfd5
push 1
lea ecx, [ebp - 0x2dc]
call fcn.1001a1d1
cmp dword [eax], 0
jne 0x1002d1bd
push 1
lea ecx, [ebp - 0x2dc]
call fcn.1001a1d1
cmp dword [eax], 0
jne 0x1002d02f
mov eax, 0x2b83
test eax, eax
je 0x1002d02f
mov dword [ebp - 0x5ac], 1
jmp 0x1002d036
and dword [ebp - 0x5ac], 0
push 1
lea ecx, [ebp - 0x2dc]
call fcn.1001a1d1
mov ecx, dword [ebp - 0x5ac]
cmp ecx, dword [eax]
je 0x1002d059
mov dword [ebp - 0x6d4], 1
jmp 0x1002d060
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x218], eax
mov esi, dword [ebp - 0x218]
push 1
lea ecx, [ebp - 0x2dc]
call fcn.1001a1d1
cmp esi, dword [eax]
jg 0x1002d095
cmp dword [ebp - 0x5bc], 0
jne 0x1002d095
and dword [ebp - 0x5b4], 0
jmp 0x1002d09f
mov dword [ebp - 0x5b4], 1
mov eax, dword [ebp - 0x174]
add eax, dword [ebp - 0x5b4]
cmp eax, 3
jl 0x1002d0c5
mov eax, 0x87662b0a
test eax, eax
je 0x1002d0c5
mov dword [ebp - 0x360], 1
jmp 0x1002d0cc
and dword [ebp - 0x360], 0
push 2
lea ecx, [ebp - 0x848]
call fcn.1001a1d1
mov ecx, dword [ebp - 0x360]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x2dc]
call fcn.1001a1d1
mov ecx, dword [ebp - 0x360]
cmp ecx, dword [eax]
jle 0x1002d104
mov dword [ebp - 0x7c0], 1
jmp 0x1002d10b
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x7c0], eax
jge 0x1002d125
mov dword [ebp - 0x6dc], 1
jmp 0x1002d12c
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x5bc]
add eax, dword [ebp - 0x6dc]
jne 0x1002d14c
mov dword [ebp - 0x6e4], 1
imul esi, dword [ebp - 0x6e4], 6
push 1
lea ecx, [ebp - 0x2dc]
call fcn.1001a1d1
imul esi, dword [eax]
test esi, esi
jne 0x1002d1f4
cmp dword [ebp - 0x174], 0
jne 0x1002d1f4
and dword [ebp - 0x5d4], 0
jmp 0x1002d1fe
mov dword [ebp - 0x5d4], 1
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x3b4], eax
mov esi, dword [ebp - 0x3b4]
push 1
lea ecx, [ebp - 0x2dc]
call fcn.1001a1d1
cmp esi, dword [eax]
jl 0x1002d22d
mov dword [ebp - 0x954], 1
jmp 0x1002d234
and dword [ebp - 0x954], 0
push 2
lea ecx, [ebp - 0x848]
call fcn.1001a1d1
mov ecx, dword [ebp - 0x174]
imul ecx, dword [eax]
cmp ecx, 0xfffffff7
jne 0x1002d25b
mov dword [ebp - 0x3b8], 1
jmp 0x1002d262
and dword [ebp - 0x3b8], 0
cmp dword [ebp - 0x3b8], 0x69393dda
jne 0x1002d27a
mov dword [ebp - 0x3c0], 1
jmp 0x1002d281
and dword [ebp - 0x3c0], 0
cmp dword [ebp - 0x3c0], 1
jae 0x1002d296
mov dword [ebp - 0x3d0], 1
jmp 0x1002d29d
and dword [ebp - 0x3d0], 0
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0xe08]
mov dword [ebp - 0x3c8], eax
push 1
lea ecx, [ebp - 0x2dc]
call fcn.1001a1d1
mov ecx, dword [ebp - 0x3c8]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x3c8]
mov eax, dword [eax]
mov dword [ebp - 0x350], eax
mov esi, dword [ebp - 0x350]
push 1
lea ecx, [ebp - 0x2dc]
call fcn.1001a1d1
imul esi, dword [eax]
mov edi, dword [ebp - 0x3d0]
add edi, 0xffff
push 0
lea ecx, [ebp - 0x2dc]
call fcn.1001a1d1
sub edi, dword [eax]
add edi, 0x69e0
cmp esi, edi
jne 0x1002d9d4
mov dword [ebp - 0x214], 0xc2df100f
mov dword [ebp - 0x3d8], 1
mov dword [ebp - 0x124], 0xffffffec
jmp 0x1002d341
mov dword [ebp - 0xa44], 0xad05
mov dword [ebp - 0x218], 0x2c4e
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0xa44], eax
je 0x1002da00
jmp 0x100304f8
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0x8e0], eax
mov eax, dword [ebp - 0x8d8]
mov dword [ebp - 0x8e8], eax
mov eax, dword [ebp - 0x8e0]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0x8e8]
mov dword [ebp - 0x8f8], eax
mov eax, dword [ebp - 0xfc]
mov dword [eax], 0
jmp 0x1003037d
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xfc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xfc]
cmp dword [eax], 0
jle 0x100304f8
mov dword [ebp - 0xbb8], 0xfff9
mov dword [ebp - 0xbb4], 0xfff9
mov dword [ebp - 0xbb0], 0xfff9
mov dword [ebp - 0xbac], 0xfff9
lea ecx, [ebp - 0x351]
call fcn.1001a1e0
push eax
lea eax, [ebp - 0xba8]
push eax
lea eax, [ebp - 0xbb8]
push eax
lea ecx, [ebp - 0x109c]
call fcn.1001a377
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xeb0]
call fcn.1001a130
mov dword [ebp - 4], 0x37
mov dword [ebp - 0x728], 1
mov dword [ebp - 0x720], 0xfffffff7
mov dword [ebp - 0x310], 0x96ee4e91
mov dword [ebp - 0x738], 1
mov eax, dword [ebp - 0xfc]
cmp dword [eax], 0x2a96
jge 0x10030432
mov dword [ebp - 0x718], 1
jmp 0x10030439
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x310]
cmp eax, dword [ebp - 0x718]
jle 0x10030453
mov dword [ebp - 0x8f0], 1
jmp 0x1003045a
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [ebp - 0x720], eax
mov eax, dword [ebp - 0x720]
mov dword [ebp - 0xdd0], eax
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0xed8], eax
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0xdd8], eax
push 2
lea ecx, [ebp - 0xeb0]
call fcn.1001a1d1
and dword [eax], 0
mov dword [ebp - 0x728], 0
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
cmp dword [ebp - 0x728], eax
jne 0x100304c2
mov dword [ebp - 0x730], 1
jmp 0x100304c9
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0x8f8]
mov ecx, dword [ebp - 0x730]
mov dword [eax], ecx
mov eax, dword [ebp - 0x738]
inc eax
mov dword [ebp - 0x738], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xeb0]
call fcn.1001a156
jmp 0x1003036c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret