Function at 0x1002927e
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x101448a2
call fcn.1014399c
sub esp, 0x52c
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xf0], edx
mov dword [ebp - 4], ebx
push edi
mov dword [ebp - 0x38], ebx
push 8
pop edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0xd8], ecx
xor ecx, ecx
mov dword [ebp - 0x40], edx
inc ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
jmp 0x100292cd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x34], 0x4a8c6a53
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100292bf
mov dword [ebp - 0x48], ebx
cmp dword [ebp - 0x48], ebx
jl 0x10029329
mov dword [ebp - 0x1c], 0xbe92e3f9
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0x34], ebx
je 0x100292f1
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x34]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x34]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x34]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x34]
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x48], ecx
jne 0x1002931f
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0x34], ebx
mov eax, ecx
jne 0x10029321
mov eax, ebx
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0x48]
jns 0x100292da
mov dword [ebp - 0x10], 0xfffffff1
cmp dword [ebp - 0x10], edx
jle 0x1002935f
mov dword [ebp - 0x30], 0xbb000e2e
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x40], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jg 0x10029335
push dword [ebp + 8]
lea ecx, [ebp - 0x1ac]
call fcn.10014099
xor edi, edi
lea ecx, [ebp - 0x108]
inc edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], 0x42eb90da
push 4
call fcn.100141a5
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1e8]
push dword [ebp - 0xf0]
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0xa7221ebc
push eax
lea eax, [ebp - 0x1f8]
mov dword [ebp - 0xe4], ebx
push eax
push ebx
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe0], ebx
movdqu xmmword [ebp - 0x1f8], xmm0
mov dword [ebp - 0xdc], ebx
call fcn.10015178
push 3
pop eax
mov byte [ebp - 4], al
mov dword [ebp - 0x24], 0x7736
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 4
mov dword [ebp - 0x30], eax
jge 0x10029400
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x108]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x100293e8
push 3
pop eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 0xfffffffb
jg 0x10029606
mov ecx, dword [ebp - 0xe4]
mov dword [ebp - 0x148], ecx
jmp 0x1002941e
push 3
pop eax
push eax
lea ecx, [ebp - 0xfc]
call fcn.100141a5
push 4
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 4
call fcn.100141a5
push 3
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x10029459
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xfc]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10029446
mov dword [ebp - 0x14], ebx
jmp 0x10029476
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x114]
mov dword [eax + ecx*4], 0x5261fc42
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10029463
mov esi, dword [ebp - 0xfc]
mov dword [ebp - 0x150], esi
mov dword [esi + 4], 0x18
mov dword [ebp - 0x14], 0x8cccddd1
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], edx
jg 0x1002953f
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x3c], 0xd68f985
mov dword [ebp - 0x14c], 5
mov dword [ebp - 0x1c], 0x79d44f4c
mov ecx, dword [eax]
mov eax, dword [ebp - 0x114]
push 1
mov dword [eax], ecx
xor ecx, ecx
mov dword [ebp - 0x3c], edi
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14c]
cmp eax, 0x97b0
mov esi, dword [ebp - 0x108]
mov eax, dword [ebp - 0x3c]
setg cl
xor edx, edx
cmp dword [esi + edi*4], ecx
pop edi
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x10]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, 0x84b7
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x100294a2
mov esi, dword [ebp - 0x150]
xor ebx, ebx
push 3
pop edx
dec dword [esi + 4]
cmp dword [esi + 4], 9
jge 0x1002948f
mov eax, dword [ebp - 0x10]
xor ecx, ecx
imul eax, dword [ebp - 0x28], 0xfffffff6
mov edx, dword [ebp - 0x148]
cmp eax, dword [edx + 0xc]
mov eax, dword [ebp - 0x114]
setge cl
xor edx, edx
cmp ecx, dword [eax]
setge dl
sub edx, 0xe82b
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 5
setl al
cmp eax, 0xe3c2
jge 0x10029593
mov eax, dword [ebp - 0xe4]
cmp dword [eax + 4], ebx
je 0x1002959a
mov ecx, edi
cmp dword [esi + 4], ebx
jne 0x1002959c
mov ecx, ebx
dec dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x24]
cmp eax, ecx
jge 0x100295ac
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x114]
push eax
mov dword [eax], 0x6f576105
call fcn.10123626
pop ecx
mov byte [ebp - 4], 3
push dword [ebp - 0xfc]
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x10c], ebx
call fcn.10123626
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0xf4], ebx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffb
pop ecx
jle 0x1002941b
cmp dword [ebp - 0xe4], 0
je 0x1002962d
push dword [ebp - 0xe4]
call fcn.10123626
pop ecx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], ebx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x108], 0
je 0x10029658
push dword [ebp - 0x108]
call fcn.10123626
pop ecx
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0x60], 0x5f002b01
mov dword [ebp - 0x5c], 0x4d85ce10
mov dword [ebp - 0x58], 0x266461de
mov dword [ebp - 0x54], 0x1d8c152f
mov dword [ebp - 0x50], 0x8dcf553d
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x10], 0xfffffff0
jmp 0x100296c1
mov dword [ebp - 0x20], 0x8b10
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100296b9
push 1
push 0x1191
push 0x1e5
push 0x157e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
cmp dword [ebp - 0x20], ebx
jne 0x100296c7
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe8
jne 0x1002968b
mov ecx, ebx
mov edi, ebx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 0xff18ee85
mov dword [ebp - 0x10], ebx
jmp 0x100296e8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2c], 0x4fd3df75
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x100296da
mov dword [ebp - 0x2c], 0xffffffe3
cmp dword [ebp - 0x2c], 0xffffffed
je 0x10029776
mov dword [ebp - 0x10], 0xfffffff6
cmp dword [ebp - 0x10], ebx
je 0x10029720
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
sub eax, ecx
je 0x10029720
xor ecx, ecx
inc ecx
jmp 0x10029722
mov ecx, ebx
mov eax, dword [ebp - 0x10]
imul eax, ecx
neg eax
sbb eax, eax
neg eax
add eax, 0xffff
je 0x1002973f
cmp dword [ebp - 0x2c], ebx
je 0x1002973f
xor eax, eax
inc eax
jmp 0x10029741
mov eax, ebx
push 0xfffffffffffffffe
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x2c]
cmp eax, 0xfffffffb
jg 0x1002975b
cmp dword [ebp - 0x10], ebx
je 0x1002975b
xor edx, edx
inc edx
jmp 0x1002975d
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x20], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xffffffed
jne 0x100296fb
mov ecx, dword [ebp - 0x28]
cmp edi, 4
jne 0x10029789
push 0x10
pop ecx
push 0x12
mov dword [ebp - 0x28], ecx
pop edi
jmp 0x10029887
movzx eax, byte [ebp + edi - 0x5f]
lea esi, [ecx - 1]
sub eax, edi
mov dword [ebp - 0x10], 0x8e5c
push 4
lea ecx, [ebp - 0x144]
add esi, eax
call fcn.100141a5
mov dword [ebp - 0x1c], 0xd711e7bf
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x14], ebx
jmp 0x100297d6
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x144]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100297c3
mov dword [ebp - 0x14], ebx
jmp 0x100297f2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x154], 0xc60edac7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x100297e1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x144]
mov dword [ecx + 8], eax
test eax, eax
je 0x1002983e
mov dword [ebp - 0x1c], 0x7308f472
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ecx + 8], edx
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x154], ecx
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x24], ebx
je 0x1002983e
xor eax, eax
inc eax
jmp 0x10029840
mov eax, ebx
push dword [ebp - 0x144]
mov dword [ebp - 0x20], eax
call fcn.10123626
mov dword [ebp - 0x144], ebx
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x13c], ebx
pop ecx
test esi, esi
jns 0x10029877
or eax, 0xffffffff
sub eax, esi
add esi, 0x100
and eax, 0xffffff00
add esi, eax
movzx eax, byte [ebp + edi - 0x60]
mov ecx, dword [ebp - 0x28]
mov word [ebp + eax*2 - 0xec], si
add edi, 2
cmp edi, 0x14
jb 0x100296ce
xor eax, eax
lea ecx, [ebp - 0x278]
mov word [ebp - 0xe8], ax
lea eax, [ebp - 0xec]
push eax
call fcn.100140d4
push eax
lea edx, [ebp - 0x1ac]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1c4]
call fcn.10028a72
pop ecx
xor edi, edi
mov byte [ebp - 4], 7
push ebx
inc edi
lea ecx, [ebp - 0x278]
push edi
call fcn.10014706
cmp dword [ebp - 0x1b0], 8
lea ecx, [ebp - 0x538]
push ecx
lea eax, [ebp - 0x1c4]
mov dword [ebp - 0xec], ebx
cmovae eax, dword [ebp - 0x1c4]
push eax
push 0x5c4a9
push 0x32d38
mov word [ebp - 0xe8], bx
call fcn.10027b51
pop ecx
pop ecx
call eax
mov dword [ebp - 0x14], 0x3248c66
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x1c], 0xba6b42be
mov dword [ebp - 0x1c], 0x551fa4c8
push 4
mov dword [ebp - 0x3c], eax
call fcn.100141a5
mov dword [ebp - 0x1c], 0x91c84132
mov dword [ebp - 0x1c], 0x72d50fa8
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0x914a
mov dword [ebp - 0x10], ebx
jmp 0x1002996e
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x12c]
mov dword [eax + ecx*4], 0x5bb08661
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002995b
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
inc ecx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], edx
xor edx, edx
cmp dword [ebp - 0x20], 0x2717
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
mov edx, 0x1215
setge cl
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, edx
mov esi, dword [ebp - 0x12c]
setl cl
add ecx, dword [ebp - 0x14]
mov dword [esi + 8], edx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 3
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 0xffffffff
setg cl
cmp ecx, edx
je 0x100299fe
mov eax, ebx
cmp dword [esi + 8], ebx
je 0x10029a00
mov eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10029a18
call dword [sym.imp.USER32.dll_WaitMessage]
push dword [ebp - 0x12c]
call fcn.10123626
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], ebx
mov dword [esp], 0xe09a
call fcn.10018e4c
pop ecx
movzx eax, ax
lea ecx, [ebp - 0x1ac]
push eax
push edi
call fcn.10015dc2
mov dword [ebp - 0x14], 0x68ec0ae9
mov dword [ebp - 0x20], 0xbf2d3f50
mov dword [ebp - 0x14], 0x1b
cmp dword [ebp - 0x14], 0xfffffffa
jle 0x10029ac3
push 3
pop ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], ebx
jmp 0x10029a85
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2e4], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10029a78
mov dword [ebp - 0x10], ebx
jmp 0x10029a97
cmp dword [ebp - 0x10], ebx
jne 0x10029a9d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x10029a8f
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10029aba
push 0x1769
push 0xe14
push ebx
call dword [sym.imp.USER32.dll_RemoveMenu]
push 3
pop ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffa
jg 0x10029a70
mov dword [ebp - 0x20], 1
mov ecx, ebx
mov dword [ebp - 0x80], 0x33062f01
mov esi, ebx
mov dword [ebp - 0x7c], 0xb2860612
mov dword [ebp - 0x78], 0x196f495b
mov dword [ebp - 0x74], 0x87bc2dfa
mov dword [ebp - 0x70], 0x2dccc2f2
mov dword [ebp - 0x6c], 0x350463be
mov dword [ebp - 0x68], 0x37033505
mov dword [ebp - 0x64], 0x3d003b02
cmp ecx, 4
jne 0x10029b13
push 0x12
pop esi
push 0x14
pop ecx
jmp 0x10029b40
movzx eax, byte [ebp + ecx - 0x7f]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10029b33
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0x80]
mov word [ebp + eax*2 - 0x17c], dx
add ecx, 2
cmp ecx, 0x20
jb 0x10029b06
xor eax, eax
lea ecx, [ebp - 0x2a8]
mov word [ebp - 0x16e], ax
lea eax, [ebp - 0x17c]
push eax
call fcn.100140d4
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0xd8]
push eax
call fcn.10029011
xor eax, eax
mov byte [ebp - 4], 7
inc eax
lea ecx, [ebp - 0x2a8]
push ebx
push eax
mov dword [ebp - 0x38], eax
call fcn.10014706
push 2
lea ecx, [ebp - 0x120]
call fcn.100141a5
mov byte [ebp - 4], 9
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x10], ebx
jmp 0x10029bba
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x120]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10029ba7
mov dword [ebp - 0x24], 1
cmp dword [ebp - 0x24], ebx
jl 0x10029d03
push 1
lea ecx, [ebp - 0x138]
call fcn.100141a5
xor edx, edx
mov dword [ebp - 0x10], ebx
inc edx
jmp 0x10029bf4
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x138]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10029be5
mov eax, dword [ebp - 0x138]
mov dword [eax], ebx
mov dword [ebp - 0x28], 0xffffffff
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10029c22
push ebx
push ebx
push 0x1cd2
push ebx
call dword [sym.imp.USER32.dll_AppendMenuA]
xor edx, edx
inc edx
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], ebx
jl 0x10029cd1
mov dword [ebp - 0x10], 0x5f0ed1ad
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], ebx
jl 0x10029ca2
mov dword [ebp - 0x14], 0x498e64e6
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10029c69
push 0x1ef3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor edx, edx
inc edx
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x10029c9d
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10029c87
push ebx
push 0x7fa
push ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x120]
cmp dword [eax + ecx*4], ebx
jne 0x10029c9a
dec dword [ebp - 0x14]
jns 0x10029c71
xor edx, edx
inc edx
dec dword [ebp - 0x10]
jns 0x10029c3d
mov dword [ebp - 0x10], ebx
jmp 0x10029cc3
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10029cc0
push 0x1aad
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor edx, edx
inc edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x10029ca7
dec dword [ebp - 0x28]
jns 0x10029c2e
mov eax, dword [ebp - 0x138]
inc dword [eax]
cmp dword [eax], edx
jle 0x10029c01
push eax
call fcn.10123626
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], ebx
dec dword [ebp - 0x24]
pop ecx
jns 0x10029bd0
mov byte [ebp - 4], 7
cmp dword [ebp - 0x120], 0
je 0x10029d2e
push dword [ebp - 0x120]
call fcn.10123626
pop ecx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x118], ebx
xor eax, eax
lea edi, [ebp - 0x17c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x16c]
push 3
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.100141a5
push 3
pop edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], ebx
jmp 0x10029d63
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x160], 0xae35
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10029d52
mov dword [ebp - 0x14], ebx
jmp 0x10029d80
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x16c]
mov dword [eax + ecx*4], 0xcd453606
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10029d6d
mov edi, dword [ebp - 0x16c]
mov dword [edi + 8], 2
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x1c], 0x2aa9dade
cmp dword [edi + 8], ebx
je 0x10029daf
cmp dword [ebp - 0x1c], ebx
je 0x10029daf
xor ecx, ecx
inc ecx
jmp 0x10029db1
mov ecx, ebx
mov eax, dword [ebp - 0x160]
sub ecx, eax
cmp ecx, dword [ebp - 0x15c]
jge 0x10029dcb
cmp dword [edi + 8], ebx
je 0x10029dcb
xor ecx, ecx
inc ecx
jmp 0x10029dcd
mov ecx, ebx
mov eax, dword [edi + 8]
mov esi, 0x693009c
sub eax, ecx
mov ecx, dword [ebp - 0x20]
dec ecx
add ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
sub esi, ecx
mov ecx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x160]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, esi
setl al
dec dword [edi + 8]
mov dword [ebp - 0x1c], eax
jns 0x10029d92
mov edx, dword [ebp - 0x16c]
xor ecx, ecx
push edx
mov eax, dword [edx + 4]
add eax, 0xab79
cmp eax, 0x2c02
setle cl
mov dword [ebp - 0x20], ecx
call fcn.10123626
cmp dword [ebp - 0x3c], 0xffffffff
pop ecx
je 0x1002a1c2
push 3
pop ecx
mov dword [ebp - 0xa8], 0x64057001
mov edx, ebx
mov dword [ebp - 0xa4], 0x172e9312
mov edi, ebx
mov dword [ebp - 0xa0], 0xb301fc1c
mov dword [ebp - 0x9c], 0x1c6cb04a
mov dword [ebp - 0x98], 0x130a1751
mov word [ebp - 0x94], 0x173e
mov byte [ebp - 0x92], cl
mov dword [ebp - 0x91], 0x777026a
mov dword [ebp - 0x8d], 0x760979
mov dword [ebp - 0x89], 0x4700869
mov word [ebp - 0x85], 0x683
mov byte [ebp - 0x83], 0x41
cmp edx, 4
jne 0x10029eb6
push 0x12
pop edi
push 0x14
pop edx
jmp 0x10029ee9
movzx eax, byte [ebp + edx - 0xa7]
lea esi, [edi - 1]
sub eax, edx
add esi, eax
jns 0x10029ed9
or eax, 0xffffffff
sub eax, esi
add esi, 0x100
and eax, 0xffffff00
add esi, eax
movzx eax, byte [ebp + edx - 0xa8]
mov word [ebp + eax*2 - 0x210], si
add edx, 2
cmp edx, 0x26
jb 0x10029ea9
xor eax, eax
mov byte [ebp - 0xb1], cl
mov word [ebp - 0x1fc], ax
mov ecx, ebx
mov dword [ebp - 0xd4], 0x730b7605
mov esi, ebx
mov dword [ebp - 0xd0], 0x680c6100
mov dword [ebp - 0xcc], 0x390a7b01
mov dword [ebp - 0xc8], 0x565f830d
mov dword [ebp - 0xc4], 0x2ca1d47c
mov dword [ebp - 0xc0], 0x381a1865
mov dword [ebp - 0xbc], 0x97f0624
mov dword [ebp - 0xb8], 0x2760882
mov word [ebp - 0xb4], 0x778
mov byte [ebp - 0xb2], 0x78
mov dword [ebp - 0xb0], 0xd88048a
mov byte [ebp - 0xac], 0x86
cmp ecx, 0xc
jne 0x10029f82
push 0xd
pop esi
push 0x17
pop ecx
jmp 0x10029fb5
movzx eax, byte [ebp + ecx - 0xd3]
lea edx, [esi - 1]
sub eax, ecx
add edx, eax
jns 0x10029fa5
or eax, 0xffffffff
sub eax, edx
add edx, 0x100
and eax, 0xffffff00
add edx, eax
movzx eax, byte [ebp + ecx - 0xd4]
mov word [ebp + eax*2 - 0x230], dx
add ecx, 2
cmp ecx, 0x29
jb 0x10029f75
xor eax, eax
mov word [ebp - 0x214], ax
mov eax, dword [ebp - 0xf0]
cmp dword [eax], 2
jne 0x10029fee
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x2c0]
call fcn.100140d4
mov ecx, eax
mov dword [ebp - 0x38], 3
jmp 0x1002a00b
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x2d8]
call fcn.100140d4
push 5
mov ecx, eax
pop eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], eax
push ecx
lea ecx, [ebp - 0x260]
call fcn.1001410c
mov dword [ebp - 4], 0xb
mov eax, dword [ebp - 0x30]
test al, 4
je 0x1002a03f
and eax, 0xfffffffb
lea ecx, [ebp - 0x2d8]
push ebx
push 1
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x38], eax
call fcn.10014706
mov eax, dword [ebp - 0x30]
mov byte [ebp - 4], 0xc
test al, 2
je 0x1002a05b
push ebx
and eax, 0xfffffffd
lea ecx, [ebp - 0x2c0]
push 1
mov dword [ebp - 0x38], eax
call fcn.10014706
xor eax, eax
mov esi, dword [ebp - 0x3c]
lea edi, [ebp - 0x210]
stosd dword es:[edi], eax
push 7
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
lea edi, [ebp - 0x230]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x50c]
push eax
lea ecx, [ebp - 0x194]
call fcn.100140d4
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x184], 7
jb 0x1002a16b
lea eax, [ebp - 0x194]
push eax
lea edx, [ebp - 0x1ac]
lea ecx, [ebp - 0x290]
call fcn.10036a62
pop ecx
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0xe
push ecx
mov edx, eax
lea ecx, [ebp - 0x248]
call fcn.10028a4a
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0x10
call fcn.10014706
lea ecx, [ebp - 0x248]
call fcn.10038760
test al, al
je 0x1002a15d
lea eax, [ebp - 0x194]
push eax
lea ecx, [ebp - 0x1e8]
call fcn.10029011
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x1e8]
mov edi, dword [ebp - 0xd8]
mov ecx, edi
push eax
call fcn.1002919e
test al, al
je 0x1002a144
lea eax, [ebp - 0x1e8]
mov ecx, edi
push eax
call fcn.10034aa8
lea ecx, [edi + 0xc]
lea eax, [ebp - 0x1dc]
cmp ecx, eax
je 0x1002a144
push 0xffffffffffffffff
push ebx
push eax
call fcn.10014522
push ebx
push 1
lea ecx, [ebp - 0x1dc]
call fcn.10014706
lea ecx, [ebp - 0x1e8]
call fcn.100147a9
push ebx
push 1
lea ecx, [ebp - 0x248]
call fcn.10014706
push ebx
push 1
lea ecx, [ebp - 0x194]
mov byte [ebp - 4], 0xc
call fcn.10014706
lea eax, [ebp - 0x538]
push eax
push esi
push 0x5c4a9
push 0x12173
call fcn.10027b51
pop ecx
pop ecx
call eax
test eax, eax
jne 0x1002a07c
push esi
push 0x5c4a9
push 0x1f7f2
call fcn.10027b51
pop ecx
pop ecx
call eax
push ebx
push 1
lea ecx, [ebp - 0x260]
call fcn.10014706
push ebx
push 1
lea ecx, [ebp - 0x1c4]
call fcn.10014706
push ebx
push 1
lea ecx, [ebp - 0x1ac]
call fcn.10014706
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret