Function at 0x1002009f
Capabilities:
Compare security identifiers
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ca57
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc4c
push esi
push edi
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10025c73
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x678], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x708], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x6a0], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x680], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x6b0], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x758], eax
mov eax, dword [ebp - 0x708]
movzx eax, byte [eax]
test eax, eax
je 0x10020191
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0x688], eax
mov eax, dword [ebp - 0x680]
mov dword [ebp - 0x690], eax
mov eax, dword [ebp - 0x688]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x690]
mov dword [ebp - 0x698], eax
mov eax, dword [ebp - 0x118]
mov dword [eax], 0
jmp 0x10020166
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x118]
mov dword [ecx], eax
mov eax, dword [ebp - 0x118]
cmp dword [eax], 3
jge 0x1002018c
mov eax, dword [ebp - 0x118]
push dword [eax]
mov ecx, dword [ebp - 0x698]
call fcn.1002cc7e
mov dword [eax], 0xfffffff6
jmp 0x10020155
jmp 0x10025c71
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0x760], eax
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x518], eax
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x760]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0xb8], 0x76820624
and dword [ebp - 0x900], 0
and dword [ebp - 0x8fc], 0
and dword [ebp - 0x8f8], 0
and dword [ebp - 0x8f4], 0
lea ecx, [ebp - 0x269]
call fcn.1002cc93
push eax
lea eax, [ebp - 0x8f0]
push eax
lea eax, [ebp - 0x900]
push eax
lea ecx, [ebp - 0xbd0]
call fcn.1002cc96
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb9c]
call fcn.1002cbd5
and dword [ebp - 4], 0
mov dword [ebp - 0x12c], 0
jmp 0x10020248
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 2
jge 0x10020264
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0xa1c], 0xfffffff6
jmp 0x1002023b
push 1
lea eax, [ebp - 0xb8]
push eax
push 0x22a6
push 0x26e3
push 0x189d
push 0x30d
push 0x13a1
push 0x143f
push 0x3983
push 0
call fcn.1001f674
add esp, 0x28
mov dword [ebp - 0xb8], 0
jmp 0x100202b3
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jge 0x100202cf
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0xa1c], 2
jmp 0x100202a6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb9c]
call fcn.1002cbfb
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x3fc], 1
mov dword [ebp - 0x1c], 0xfffffff2
jmp 0x100202ff
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe6
jle 0x10020405
mov dword [ebp - 0x144], 0xffffffff
mov dword [ebp - 0x140], 0
jmp 0x1002032c
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 3
jge 0x10020348
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x84c], 0xbe1d925b
jmp 0x1002031f
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x84c], 0xfffffff1
jmp 0x10020376
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x84c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x84c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x84c], 0x11
jl 0x100203b8
mov dword [ebp - 0x768], 0
lea eax, [ebp - 0x768]
push eax
push 0x7fc3
push 0
push 0x2bd8
push 0x6aca
lea eax, [ebp - 0x1c]
push eax
push 0
call fcn.1000d13f
add esp, 0x1c
jmp 0x1002035b
mov dword [ebp - 0x144], 0
jmp 0x100203d1
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffe5
jne 0x10020400
mov byte [ebp - 0x89], 0
push 0xfc1
push 0x178
push 0
lea eax, [ebp - 0x89]
push eax
push 0
call fcn.1000d0a0
add esp, 0x14
jmp 0x100203c4
jmp 0x100202f8
mov dword [ebp - 0x770], 0x1461
cmp dword [ebp - 0x770], 0x429
jge 0x100205ce
push 0x106c897c
push 0x106c87f8
mov ecx, 0x1065dcc0
call fcn.1002c299
mov ecx, eax
call fcn.1002c299
mov edx, 0x10a22484
mov ecx, eax
call fcn.100312ac
and dword [ebp - 0x290], 0
mov dword [ebp - 0x108], 1
jmp 0x10020466
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x290]
cmp eax, dword [0x106c897c]
jge 0x100205b3
mov byte [ebp - 0x21], 1
and dword [ebp - 0xdc], 0
jmp 0x10020492
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
mov ecx, 0x10a224bc
call fcn.1002c250
cmp dword [ebp - 0x108], eax
jae 0x10020540
mov byte [ebp - 0x21], 1
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x1fc], eax
and dword [ebp - 0xdc], 0
jmp 0x100204db
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
mov ecx, 0x10a224bc
call fcn.1002c250
cmp dword [ebp - 0x1fc], eax
jae 0x10020531
mov ecx, 0x10a22484
call fcn.1002c250
cmp dword [ebp - 0xdc], eax
jae 0x10020531
push dword [ebp - 0x1fc]
mov ecx, 0x10a224bc
call fcn.1002c231
movsx esi, byte [eax]
push dword [ebp - 0xdc]
mov ecx, 0x10a22484
call fcn.1002c231
movsx eax, byte [eax]
cmp esi, eax
je 0x1002052f
mov byte [ebp - 0x21], 0
jmp 0x10020531
jmp 0x100204c1
movzx eax, byte [ebp - 0x21]
test eax, eax
je 0x1002053b
jmp 0x10020540
jmp 0x10020485
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x14c], eax
jmp 0x1002055b
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
mov ecx, 0x10a22484
call fcn.1002c250
cmp dword [ebp - 0x14c], eax
jae 0x1002058f
push dword [ebp - 0x14c]
mov ecx, 0x10a22484
call fcn.1002c231
mov al, byte [eax]
movzx eax, al
push eax
mov ecx, 0x10a224bc
call fcn.1002c1ef
jmp 0x1002054e
mov ecx, 0x10a224bc
call fcn.1002c250
mov esi, eax
mov ecx, 0x10a22484
call fcn.1002c250
sub esi, eax
inc esi
mov dword [ebp - 0x108], esi
jmp 0x10020459
push fcn.1003148b
mov edx, 0x10a224bc
mov ecx, 0x1065dc18
call fcn.100314bd
mov ecx, eax
call fcn.1002c6b2
cmp dword [ebp - 0x1c], 0
je 0x10020766
mov dword [ebp - 0x790], 0xafd77ccc
mov dword [ebp - 0x1ac], 0
jmp 0x100205fb
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 4
jge 0x10020617
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0x8b8], 0x37a5b7d8
jmp 0x100205ee
mov dword [ebp - 0x1c], 3
jmp 0x10020627
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x10020764
mov dword [ebp - 0x154], 0
jmp 0x1002064a
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 1
jge 0x10020666
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x780], 0xffffffff
jmp 0x1002063d
mov eax, dword [ebp - 0x1c]
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x8b8]
cmp dword [ebp + eax*4 - 0x8b8], ecx
jle 0x1002068b
mov dword [ebp - 0x778], 1
jmp 0x10020692
and dword [ebp - 0x778], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8b8]
mov dword [ebp - 0x9f4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3fc], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x8b8]
cmp dword [ebp - 0x3fc], eax
jge 0x100206cc
mov dword [ebp - 0x230], 1
jmp 0x100206d3
and dword [ebp - 0x230], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x230]
mov dword [ebp + eax - 0x780], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x230], eax
jle 0x100206fd
mov dword [ebp - 0x788], 1
jmp 0x10020704
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xb64], eax
xor eax, eax
inc eax
je 0x1002072e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8b8], 0
je 0x1002072e
mov dword [ebp - 0x528], 1
jmp 0x10020735
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x528], eax
jle 0x1002074c
mov dword [ebp - 0x530], 1
jmp 0x10020753
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x790], eax
jmp 0x10020620
jmp 0x100207ad
mov byte [ebp - 0xa2], 0
push 0x39b5
push 0x5860
push 0
push 0x46c6
push 0x359e
lea eax, [ebp - 0xa2]
push eax
push 0x315e
push 0
push 0x62ac
push 0x4db7
push 0x366b
push 0xefa
call fcn.10026b88
add esp, 0x30
mov dword [ebp - 0x68], 0x76820624
and dword [ebp - 0x928], 0
and dword [ebp - 0x924], 0
and dword [ebp - 0x920], 0
and dword [ebp - 0x91c], 0
lea ecx, [ebp - 0x271]
call fcn.1002cc93
push eax
lea eax, [ebp - 0x918]
push eax
lea eax, [ebp - 0x928]
push eax
lea ecx, [ebp - 0xbb0]
call fcn.1002cc96
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xba8]
call fcn.1002cbd5
mov dword [ebp - 4], 1
push 1
lea ecx, [ebp - 0x2d0]
call fcn.1002cb22
mov byte [ebp - 4], 2
mov dword [ebp - 0x98], 0xffffffff
mov dword [ebp - 0x1dc], 0
jmp 0x10020840
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 1
jge 0x10020862
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0x2d0]
call fcn.1002cc7e
mov dword [eax], 0x51da622a
jmp 0x10020833
push 0
lea ecx, [ebp - 0x2d0]
call fcn.1002cc7e
cmp dword [eax], 7
jle 0x10020880
mov dword [ebp - 0x538], 1
jmp 0x10020887
and dword [ebp - 0x538], 0
push 0
lea ecx, [ebp - 0x2d0]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x538]
cmp ecx, dword [eax]
jle 0x100208aa
mov dword [ebp - 0x798], 1
jmp 0x100208b1
and dword [ebp - 0x798], 0
push 0
lea ecx, [ebp - 0x2d0]
call fcn.1002cc7e
mov esi, eax
push 0
lea ecx, [ebp - 0x2d0]
call fcn.1002cc7e
mov ecx, dword [esi]
sub ecx, dword [eax]
cmp ecx, 0xbc40
jg 0x100208e5
mov dword [ebp - 0x540], 1
jmp 0x100208ec
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0x98], eax
mov esi, dword [ebp - 0x98]
neg esi
push 0
lea ecx, [ebp - 0x2d0]
call fcn.1002cc7e
sub esi, dword [eax]
imul esi, esi, 7
push 0
lea ecx, [ebp - 0x2d0]
call fcn.1002cc7e
add esi, dword [eax]
je 0x10020994
mov dword [ebp - 0x7a0], 1
push 1
push 0x22d5
push 0x3769
push 0x7ecd
push 0x325e
push 0x39f1
push 0x2a9e
lea eax, [ebp - 0x2d0]
push eax
push 0x4742
push 0x450f
push 0
push 0
push 0x50aa
lea eax, [ebp - 0x7a0]
push eax
push 0x61f4
push 0x1a74
push 0x7677
push 0x48f7
push 0x52d0
call fcn.1001afb4
add esp, 0x4c
jmp 0x10020a51
mov dword [ebp - 0x98], 0x4f6cbcb1
mov dword [ebp - 0x98], 0
jmp 0x100209b7
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jg 0x10020a51
mov dword [ebp - 0x15c], 3
mov byte [ebp - 0x8b], 0
movzx eax, byte [ebp - 0x8b]
test eax, eax
je 0x100209fb
push 0xeee
push 0x584e
push 0x8dc
push 0
push 0
call fcn.1000ae62
add esp, 0x14
mov dword [ebp - 0x15c], 0
jmp 0x10020a14
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
jl 0x10020a4c
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x10020a4a
push 0x1ba3
push 0
push 1
push 0x15f5
push 0x272b
call fcn.1001b86b
add esp, 0x14
jmp 0x10020a07
jmp 0x100209aa
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2d0]
call fcn.1002cbfb
mov dword [ebp - 0x61c], 7
mov dword [ebp - 0x670], 0xffff
mov dword [ebp - 0x75c], 0x3e5ec352
mov dword [ebp - 0x7c8], 0xdc509ca4
mov dword [ebp - 0x7d0], 0xa3fd
mov dword [ebp - 0x7c0], 0xffffffff
push 2
lea ecx, [ebp - 0x94c]
call fcn.1002cb22
mov byte [ebp - 4], 3
mov dword [ebp - 0x7a8], 0x1d15
cmp dword [ebp - 0x7a8], 0x1211
jge 0x10020bdd
lea eax, [ebp - 0x270]
push eax
push 0x10007b74
call fcn.1005459b
pop ecx
pop ecx
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x7b0], eax
mov eax, dword [ebp - 0x270]
dec eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x7b0], 0
je 0x10020bdd
lea eax, [ebp - 0x7b8]
push eax
push 0x10007b74
call fcn.1005459b
pop ecx
pop ecx
and dword [ebp - 0xf0], 0
and dword [ebp - 0x1b4], 0
and dword [ebp - 0x57c], 0
and dword [ebp - 0x238], 0
jmp 0x10020b3e
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x238]
cmp eax, dword [ebp - 0x7b8]
jge 0x10020bc6
lea eax, [ebp - 0x574]
push eax
push 0x10007b74
call fcn.1005459b
pop ecx
pop ecx
mov eax, dword [ebp - 0x574]
cmp eax, dword [ebp - 0x57c]
je 0x10020b74
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x1b4]
cmp eax, dword [ebp - 0xf0]
jle 0x10020b9d
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x56c], eax
jmp 0x10020ba9
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x56c], eax
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x57c], eax
jmp 0x10020b31
push dword [ebp - 0x1b4]
push 0x10007b90
call fcn.100549f9
pop ecx
pop ecx
jmp 0x10020ada
push 0
push 0x28d8
push 0x27fa
lea eax, [ebp - 0xb70]
push eax
lea eax, [ebp - 0x94c]
push eax
call fcn.10026a59
add esp, 0x14
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x10020c36
push 0x3eb
push 0x5d00
push 0x78b9
push 1
push 0x21ba
push 0
push 0x3e8f
call fcn.1000e74a
add esp, 0x1c
push 0
push 0x6204
lea eax, [ebp - 0x7c0]
push eax
lea eax, [ebp - 0x7c8]
push eax
push 0x257c
lea eax, [ebp - 0x7d0]
push eax
lea eax, [ebp - 0x94c]
push eax
push 0xb35
lea eax, [ebp - 0x670]
push eax
push 0
push 0x1290
lea eax, [ebp - 0x61c]
push eax
push 0x6e2e
lea eax, [ebp - 0x75c]
push eax
call fcn.10014754
add esp, 0x38
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x94c]
call fcn.1002cbfb
mov dword [ebp - 0x60], 5
mov dword [ebp - 0x3c], 0xc58f5537
mov dword [ebp - 0x60], 0
jmp 0x10020cb9
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xc
jne 0x10021125
mov dword [ebp - 0x38], 0xc285ce96
mov dword [ebp - 0x914], 0x4579
mov dword [ebp - 0x910], 0x4579
mov dword [ebp - 0x90c], 0x4579
mov dword [ebp - 0x908], 0x4579
lea ecx, [ebp - 0x2a5]
call fcn.1002cc93
push eax
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0x914]
push eax
lea ecx, [ebp - 0xbe0]
call fcn.1002cc96
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2a4]
call fcn.1002cbd5
mov byte [ebp - 4], 4
mov dword [ebp - 0x164], 0
jmp 0x10020d44
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 3
jge 0x10020d60
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x5e8], 0xfffffff8
jmp 0x10020d37
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x60], eax
je 0x10020d7b
mov dword [ebp - 0x58c], 1
jmp 0x10020d82
and dword [ebp - 0x58c], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x5e8]
cmp dword [ebp + eax - 0x5e8], ecx
jne 0x10020da9
mov dword [ebp - 0x624], 1
jmp 0x10020db0
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xb58], eax
mov esi, dword [ebp - 0x60]
push 2
lea ecx, [ebp - 0x2a4]
call fcn.1002cc7e
cmp esi, dword [eax]
jg 0x10020dd9
mov dword [ebp - 0x584], 1
jmp 0x10020de0
and dword [ebp - 0x584], 0
push 2
lea ecx, [ebp - 0x2a4]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x584]
cmp ecx, dword [eax]
jg 0x10020e03
mov dword [ebp - 0x520], 1
jmp 0x10020e0a
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x58c]
cmp eax, dword [ebp - 0x520]
jg 0x10020e24
mov dword [ebp - 0x2e0], 1
jmp 0x10020e2b
and dword [ebp - 0x2e0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5e8]
cmp dword [ebp - 0x2e0], eax
jge 0x10020e4c
mov dword [ebp - 0x454], 1
jmp 0x10020e53
and dword [ebp - 0x454], 0
cmp dword [ebp - 0x454], 0xffffffff
je 0x10020e68
mov dword [ebp - 0x2e8], 1
jmp 0x10020e6f
and dword [ebp - 0x2e8], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x5e8]
push 2
lea ecx, [ebp - 0x2a4]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x2e8]
add ecx, dword [eax]
imul esi, ecx
mov dword [ebp - 0x448], esi
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x448]
mov dword [ebp + eax - 0x5e8], ecx
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x3c], 0x1d
jmp 0x10020ec6
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffe5
jl 0x10021111
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x38], 0
jmp 0x10020ee7
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x10020f15
push 0x55f7
push 0x10c2
lea eax, [ebp - 0x2a4]
push eax
push 1
lea eax, [ebp - 0x38]
push eax
push 0
push 0xbd2
call fcn.1000a330
add esp, 0x1c
jmp 0x10020ee0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xb1c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xb2c], eax
mov eax, dword [ebp - 0x40]
inc eax
cmp dword [ebp - 0x40], eax
jl 0x10020f3c
mov dword [ebp - 0x2f0], 1
jmp 0x10020f43
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x2f0], eax
jle 0x10020f5a
mov dword [ebp - 0x500], 1
jmp 0x10020f61
and dword [ebp - 0x500], 0
push 2
lea ecx, [ebp - 0x2a4]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x500]
cmp ecx, dword [eax]
jge 0x10020f8d
mov eax, 0xe48c0c84
test eax, eax
je 0x10020f8d
mov dword [ebp - 0x7c4], 1
jmp 0x10020f94
and dword [ebp - 0x7c4], 0
push 2
lea ecx, [ebp - 0x2a4]
call fcn.1002cc7e
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jne 0x10020fb5
mov dword [ebp - 0x2f8], 1
jmp 0x10020fbc
and dword [ebp - 0x2f8], 0
push 3
lea ecx, [ebp - 0x2a4]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x2f8]
cmp ecx, dword [eax]
jl 0x10020fdf
mov dword [ebp - 0x62c], 1
jmp 0x10020fe6
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x764], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x764]
mov dword [ebp + eax - 0x5e8], ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x9e8], eax
mov eax, 0xce85
inc eax
cmp eax, dword [ebp - 0x40]
jne 0x10021022
mov dword [ebp - 0x450], 1
jmp 0x10021029
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x450], eax
jl 0x10021040
mov dword [ebp - 0x634], 1
jmp 0x10021047
and dword [ebp - 0x634], 0
push 2
lea ecx, [ebp - 0x2a4]
call fcn.1002cc7e
push 3
lea ecx, [ebp - 0x2a4]
call fcn.1002cc7e
push 2
lea ecx, [ebp - 0x2a4]
call fcn.1002cc7e
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x40], eax
jg 0x1002108b
mov eax, 0x11659018
test eax, eax
je 0x1002108b
mov dword [ebp - 0x300], 1
jmp 0x10021092
and dword [ebp - 0x300], 0
cmp dword [ebp - 0x300], 0xee1e3c1d
jae 0x100210b0
cmp dword [ebp - 0x40], 0
je 0x100210b0
mov dword [ebp - 0x7e8], 1
jmp 0x100210b7
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
jg 0x100210d4
mov dword [ebp - 0x63c], 1
jmp 0x100210db
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x9f0], eax
cmp dword [ebp - 0x3c], 0
je 0x100210fc
cmp dword [ebp - 0x40], 0
je 0x100210fc
mov dword [ebp - 0x53c], 1
jmp 0x10021103
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0x38], eax
jmp 0x10020ebf
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2a4]
call fcn.1002cbfb
jmp 0x10020cb2
mov dword [ebp - 0x1f4], 0
jmp 0x1002113e
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 2
jge 0x1002115a
mov eax, dword [ebp - 0x1f4]
mov dword [ebp + eax*4 - 0xa4c], 0xfffffff6
jmp 0x10021131
mov dword [ebp - 0xe4], 8
mov dword [ebp - 0x7cc], 0
push 3
lea ecx, [ebp - 0x940]
call fcn.1002cb22
mov byte [ebp - 4], 5
mov dword [ebp - 0x76c], 0xfa8fad7
mov dword [ebp - 0x16c], 0
jmp 0x100211a2
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 3
jge 0x100211c4
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x940]
call fcn.1002cc7e
mov dword [eax], 0xe0f758fc
jmp 0x10021195
mov dword [ebp - 0xe4], 0
jmp 0x100211dd
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0xfffffff3
jne 0x1002128b
push 3
lea ecx, [ebp - 0x9ac]
call fcn.1002cb22
mov byte [ebp - 4], 6
mov dword [ebp - 0x64c], 0xe197e7c1
mov dword [ebp - 0x644], 6
push 0x1976
push 0x1ef3
push 0
push 1
lea eax, [ebp - 0xb54]
push eax
push 0x73
lea eax, [ebp - 0x9ac]
push eax
call fcn.1000cfab
add esp, 0x1c
push 0
lea eax, [ebp - 0x940]
push eax
push 0x78b1
lea eax, [ebp - 0x76c]
push eax
lea eax, [ebp - 0x9ac]
push eax
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 0xe4]
push eax
push 0
call fcn.1000fd12
add esp, 0x28
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9ac]
call fcn.1002cbfb
jmp 0x100211d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x940]
call fcn.1002cbfb
mov dword [ebp - 0x68], 0xffffffe9
jmp 0x100212aa
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0xf
je 0x100215b5
mov dword [ebp - 0x774], 1
mov dword [ebp - 0x9f8], 0x16db6d03
mov dword [ebp - 0xabc], 0xaf8b5131
mov byte [ebp - 0x93], 0
movzx eax, byte [ebp - 0x93]
test eax, eax
je 0x100212fa
push 0
push 0
push 0x5791
push 0x55d9
call fcn.1001cb73
add esp, 0x10
lea eax, [ebp - 0x774]
push eax
push 0
push 0x360e
push 0x63b7
push 0x68ba
push 0
push 0x2d17
push 0x311f
call fcn.1000f2bf
add esp, 0x20
mov dword [ebp - 0x1bc], 1
mov dword [ebp - 0x1bc], 0
jmp 0x10021349
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 3
jg 0x100215b0
push 2
lea ecx, [ebp - 0x5a4]
call fcn.1002cb22
mov byte [ebp - 4], 7
mov dword [ebp - 0xf8], 0
jmp 0x10021380
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 1
jge 0x1002139c
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x654], 0x648261f
jmp 0x10021373
push 0x60b1
push 0x5a44
push 0x65fe
lea eax, [ebp - 0x5a4]
push eax
lea eax, [ebp - 0xf8]
push eax
push 0
push 0x496d
push 0x55ee
push 1
call fcn.10009ba0
add esp, 0x24
push 1
lea ecx, [ebp - 0x5a4]
call fcn.1002cc7e
and dword [eax], 0
jmp 0x10021405
push 1
lea ecx, [ebp - 0x5a4]
call fcn.1002cc7e
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x308]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x5a4]
call fcn.1002cc7e
cmp dword [eax], 1
jge 0x10021433
push 1
lea ecx, [ebp - 0x5a4]
call fcn.1002cc7e
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x654], 0xe446df37
jmp 0x100213e1
push 1
lea eax, [ebp - 0x5a4]
push eax
push 0
push 0
call fcn.10009edd
add esp, 0x10
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5a4]
call fcn.1002cbfb
mov dword [ebp - 0x7f0], 0xd1f2e966
mov dword [ebp - 0x110], 0xfffffff6
mov dword [ebp - 0x318], 0xe75d5f8d
mov dword [ebp - 0x174], 0
jmp 0x1002148e
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 3
jge 0x100214aa
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x958], 0xec2e0cf5
jmp 0x10021481
push 0x49f7
lea eax, [ebp - 0x110]
push eax
push 0x1f56
push 0
push 1
call fcn.1000ae62
add esp, 0x14
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xa00], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x958]
mov dword [ebp - 0xb34], eax
mov eax, dword [ebp - 0x110]
add eax, 8
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x318]
cmp dword [ebp - 0x110], eax
jl 0x1002150f
mov dword [ebp - 0x310], 1
jmp 0x10021516
and dword [ebp - 0x310], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x958]
mov dword [ebp - 0x458], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x458]
mov dword [ebp + eax - 0x958], ecx
mov eax, dword [ebp - 0x458]
sub eax, dword [ebp - 0x310]
cmp eax, 0xb82c4475
jae 0x1002155b
mov dword [ebp - 0x4fc], 1
jmp 0x10021562
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x318], eax
push 0x4cc5
push 0x3299
push 0
push 0x1be7
push 0
push 0x245b
push 0x46b1
push 1
lea eax, [ebp - 0x7f0]
push eax
push 0x5c9d
push 0x400
push 0x117b
call fcn.1001cc58
add esp, 0x30
jmp 0x1002133c
jmp 0x100212a3
mov dword [ebp - 0xc4], 0x3f467215
mov dword [ebp - 0x8ec], 1
mov dword [ebp - 0x8e8], 1
mov dword [ebp - 0x8e4], 1
mov dword [ebp - 0x8e0], 1
lea ecx, [ebp - 0x221]
call fcn.1002cc93
push eax
lea eax, [ebp - 0x8dc]
push eax
lea eax, [ebp - 0x8ec]
push eax
lea ecx, [ebp - 0xbd8]
call fcn.1002cc96
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xac8]
call fcn.1002cbd5
mov byte [ebp - 4], 8
mov eax, 0xfff8
test eax, eax
je 0x10021665
mov eax, dword [ebp - 0xc4]
imul ecx, dword [ebp - 0xc4], 0x9c9f
lea eax, [eax + ecx + 0x7b04800f]
test eax, eax
je 0x10021665
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x10021660
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x10021bf8
mov dword [ebp - 0x664], 0x876a
mov dword [ebp - 0xc4], 0
jmp 0x10021688
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x1b
jg 0x10021bf8
mov dword [ebp - 0x58], 0xb6bc3ec3
mov dword [ebp - 0x58], 0
jmp 0x100216ac
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jg 0x10021b8b
mov dword [ebp - 0x1e4], 0xffffffff
push dword [ebp - 0x58]
lea ecx, [ebp - 0xac8]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x100216d8
jmp 0x10021b8b
mov dword [ebp - 0x1e4], 3
jmp 0x100216f1
mov eax, dword [ebp - 0x1e4]
dec eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0
jl 0x10021b86
push 3
lea ecx, [ebp - 0x7e0]
call fcn.1002cb22
mov byte [ebp - 4], 9
mov dword [ebp - 0x65c], 0x1a24
cmp dword [ebp - 0x65c], 0x74b
jge 0x10021ab1
lea eax, [ebp - 0xaf4]
push eax
lea eax, [ebp - 0xa40]
push eax
lea eax, [ebp - 0xb40]
push eax
lea eax, [ebp - 0xa34]
push eax
lea eax, [ebp - 0xae0]
push eax
lea eax, [ebp - 0xa28]
push eax
push 0x10007d84
call fcn.1005459b
add esp, 0x1c
lea eax, [ebp - 0x77c]
push eax
push 0x10007b74
call fcn.1005459b
pop ecx
pop ecx
movsd xmm0, qword [0x10008328]
movsd qword [ebp - 0x6e0], xmm0
movsd xmm0, qword [0x10008328]
movsd qword [ebp - 0x54c], xmm0
movsd xmm0, qword [0x10008328]
movsd qword [ebp - 0x558], xmm0
movsd xmm0, qword [0x10008370]
movsd qword [ebp - 0x280], xmm0
and dword [ebp - 0x298], 0
jmp 0x100217c9
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x298]
cmp eax, dword [ebp - 0x77c]
jge 0x10021a5f
lea eax, [ebp - 0x6bc]
push eax
lea eax, [ebp - 0x6c8]
push eax
push 0x10007d9c
call fcn.1005459b
add esp, 4
movsd xmm0, qword [ebp - 0x6bc]
movsd qword [esp], xmm0
push ecx
push ecx
movsd xmm0, qword [ebp - 0x6c8]
movsd qword [esp], xmm0
push ecx
push ecx
movsd xmm0, qword [ebp - 0xae0]
movsd qword [esp], xmm0
push ecx
push ecx
movsd xmm0, qword [ebp - 0xa28]
movsd qword [esp], xmm0
call fcn.1001fdf1
add esp, 0x20
fstp qword [ebp - 0x2bc]
push ecx
push ecx
movsd xmm0, qword [ebp - 0x6bc]
movsd qword [esp], xmm0
push ecx
push ecx
movsd xmm0, qword [ebp - 0x6c8]
movsd qword [esp], xmm0
push ecx
push ecx
movsd xmm0, qword [ebp - 0xb40]
movsd qword [esp], xmm0
push ecx
push ecx
movsd xmm0, qword [ebp - 0xa34]
movsd qword [esp], xmm0
call fcn.1001fdf1
add esp, 0x20
fstp qword [ebp - 0x2c4]
push ecx
push ecx
movsd xmm0, qword [ebp - 0x6bc]
movsd qword [esp], xmm0
push ecx
push ecx
movsd xmm0, qword [ebp - 0x6c8]
movsd qword [esp], xmm0
push ecx
push ecx
movsd xmm0, qword [ebp - 0xaf4]
movsd qword [esp], xmm0
push ecx
push ecx
movsd xmm0, qword [ebp - 0xa40]
movsd qword [esp], xmm0
call fcn.1001fdf1
add esp, 0x20
fstp qword [ebp - 0x6d4]
movsd xmm0, qword [0x10008350]
mulsd xmm0, qword [ebp - 0x6d4]
addsd xmm0, qword [ebp - 0x6e0]
movsd qword [ebp - 0x6e0], xmm0
movsd xmm0, qword [ebp - 0x2bc]
subsd xmm0, qword [ebp - 0x6d4]
movsd qword [ebp - 0x2bc], xmm0
movsd xmm0, qword [ebp - 0x2c4]
subsd xmm0, qword [ebp - 0x6d4]
movsd qword [ebp - 0x2c4], xmm0
movsd xmm0, qword [ebp - 0x2bc]
addsd xmm0, qword [ebp - 0x558]
movsd xmm1, qword [ebp - 0x280]
comisd xmm1, xmm0
jbe 0x1002195a
movsd xmm0, qword [ebp - 0x2bc]
addsd xmm0, qword [ebp - 0x558]
movsd qword [ebp - 0x890], xmm0
jmp 0x1002196a
movsd xmm0, qword [ebp - 0x280]
movsd qword [ebp - 0x890], xmm0
movsd xmm0, qword [ebp - 0x890]
movsd qword [ebp - 0x280], xmm0
movsd xmm0, qword [ebp - 0x2c4]
addsd xmm0, qword [ebp - 0x54c]
movsd xmm1, qword [ebp - 0x280]
comisd xmm1, xmm0
jbe 0x100219b2
movsd xmm0, qword [ebp - 0x2c4]
addsd xmm0, qword [ebp - 0x54c]
movsd qword [ebp - 0x8a8], xmm0
jmp 0x100219c2
movsd xmm0, qword [ebp - 0x280]
movsd qword [ebp - 0x8a8], xmm0
movsd xmm0, qword [ebp - 0x8a8]
movsd qword [ebp - 0x280], xmm0
movsd xmm0, qword [ebp - 0x54c]
comisd xmm0, xmmword [ebp - 0x2bc]
jbe 0x100219f6
movsd xmm0, qword [ebp - 0x2bc]
movsd qword [ebp - 0x898], xmm0
jmp 0x10021a06
movsd xmm0, qword [ebp - 0x54c]
movsd qword [ebp - 0x898], xmm0
movsd xmm0, qword [ebp - 0x898]
movsd qword [ebp - 0x54c], xmm0
movsd xmm0, qword [ebp - 0x558]
comisd xmm0, xmmword [ebp - 0x2c4]
jbe 0x10021a3a
movsd xmm0, qword [ebp - 0x2c4]
movsd qword [ebp - 0x8a0], xmm0
jmp 0x10021a4a
movsd xmm0, qword [ebp - 0x558]
movsd qword [ebp - 0x8a0], xmm0
movsd xmm0, qword [ebp - 0x8a0]
movsd qword [ebp - 0x558], xmm0
jmp 0x100217bc
movsd xmm0, qword [ebp - 0x280]
addsd xmm0, qword [ebp - 0x6e0]
movsd qword [ebp - 0xb6c], xmm0
push fcn.1003148b
push 0
push 0xf
lea eax, [ebp - 0xc58]
push eax
call fcn.1004e368
add esp, 0xc
mov edx, eax
mov ecx, 0x1065dc18
call fcn.100318d9
movsd xmm1, qword [ebp - 0xb6c]
mov ecx, eax
call fcn.1002c9f7
mov ecx, eax
call fcn.1002c6b2
mov dword [ebp - 0x17c], 0
jmp 0x10021aca
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 3
jge 0x10021aec
push dword [ebp - 0x17c]
lea ecx, [ebp - 0x7e0]
call fcn.1002cc7e
mov dword [eax], 0xe665969a
jmp 0x10021abd
push 2
lea ecx, [ebp - 0x7e0]
call fcn.1002cc7e
and dword [eax], 0
jmp 0x10021b22
push 2
lea ecx, [ebp - 0x7e0]
call fcn.1002cc7e
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0x460]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x460]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x7e0]
call fcn.1002cc7e
cmp dword [eax], 3
jg 0x10021b72
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x10021b70
push 1
push 0x3ee
push 0x3b84
push 0
push 0x165f
push 0x1bf7
push 0x58b5
push 0x2ae0
call fcn.1000a686
add esp, 0x20
jmp 0x10021afe
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x7e0]
call fcn.1002cbfb
jmp 0x100216e4
jmp 0x100216a5
mov dword [ebp - 0x58], 0
jmp 0x10021b9b
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jg 0x10021bf3
mov dword [ebp - 0x1c4], 1
mov dword [ebp - 0x1c4], 3
jmp 0x10021bc4
mov eax, dword [ebp - 0x1c4]
dec eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
jl 0x10021bf1
push 0x170
lea eax, [ebp - 0x664]
push eax
push 0
push 0x41be
push 1
push 0x6454
call fcn.1000ac8b
add esp, 0x18
jmp 0x10021bb7
jmp 0x10021b94
jmp 0x1002167b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xac8]
call fcn.1002cbfb
mov dword [ebp - 0x68], 0
jmp 0x10021c17
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x10021c48
push 0x266f
push 0
push 0x7c46
push 0
push 0x736d
call fcn.100104fd
add esp, 0x14
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0xa4c], 2
jmp 0x10021c10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xba8]
call fcn.1002cbfb
cmp dword [ebp - 0x25c], 0
jle 0x10025c71
mov dword [ebp - 0x7d4], 0x1870
cmp dword [ebp - 0x7d4], 0xfa2
jge 0x10021d0e
lea eax, [ebp - 0x100]
push eax
mov ecx, 0x1065dcc0
call fcn.1002c3d9
cmp dword [ebp - 0x100], 1
jg 0x10021cb5
push fcn.1003148b
mov edx, 0x10007bac
mov ecx, 0x1065dc18
call fcn.100312b4
mov ecx, eax
call fcn.1002c6b2
jmp 0x10021d0e
push fcn.1003148b
mov eax, dword [ebp - 0x100]
inc eax
imul eax, dword [ebp - 0x100]
push eax
mov eax, dword [ebp - 0x100]
inc eax
push eax
push dword [ebp - 0x100]
mov ecx, 0x1065dc18
call fcn.1002c7d0
mov edx, 0x10007bc8
mov ecx, eax
call fcn.100312b4
mov ecx, eax
call fcn.1002c7d0
mov edx, 0x10007bc8
mov ecx, eax
call fcn.100312b4
mov ecx, eax
call fcn.1002c7d0
mov ecx, eax
call fcn.1002c6b2
mov dword [ebp - 0x66c], 0xffffffff
mov dword [ebp - 0x184], 0
jmp 0x10021d31
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 2
jge 0x10021d4d
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x6ec], 0x8b0d193e
jmp 0x10021d24
mov eax, 0xbad32bd0
test eax, eax
je 0x10021e18
mov dword [ebp - 0x204], 0
jmp 0x10021d73
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 3
jge 0x10021d8f
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0x87c], 0xffffffff
jmp 0x10021d66
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x87c], 0xffffffe8
jmp 0x10021dba
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x87c]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x87c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x87c], 0xffffffec
jg 0x10021df5
push 0x2f9c
push 0x4988
push 0
push 0x2d6f
push 0x1231
push 0x573f
push 0
push 0x368a
call fcn.10009d31
add esp, 0x20
jmp 0x10021da1
push 0
push 0x79cc
push 0x546d
push 0x33aa
push 0xb8
call fcn.100280fd
add esp, 0x14
jmp 0x10021ef8
mov dword [ebp - 0x240], 0xd3740063
mov dword [ebp - 0x784], 0x57863718
mov dword [ebp - 0x240], 0xc393
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x320], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x320]
mov dword [ebp + eax - 0x6ec], ecx
cmp dword [ebp - 0x320], 0
je 0x10021ea8
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x6ec], 0
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x6ec]
je 0x10021e87
mov dword [ebp - 0x588], 1
jmp 0x10021e8e
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x240]
add eax, dword [ebp - 0x588]
jne 0x10021ea8
mov dword [ebp - 0x328], 1
jmp 0x10021eaf
and dword [ebp - 0x328], 0
cmp dword [ebp - 0x328], 8
jne 0x10021ec4
mov dword [ebp - 0x468], 1
jmp 0x10021ecb
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x66c]
cmp dword [ebp - 0x468], eax
je 0x10021ee5
mov dword [ebp - 0x330], 1
jmp 0x10021eec
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x784], eax
push 4
push 0x1000
push dword [ebp - 0x25c]
mov eax, dword [ebp - 0x518]
mov ecx, dword [ebp - 0x674]
add ecx, dword [eax + 0xc]
push ecx
push 0xa6bf
push 0xc5fd
call fcn.1003d532
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x264]
mov dword [ecx], eax
mov dword [ebp - 0x20], 0x5299dada
push 1
lea ecx, [ebp - 0x818]
call fcn.1002cb22
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x278], 0xdbca
push 2
lea ecx, [ebp - 0x840]
call fcn.1002cb22
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x78c], 0xfffe
mov dword [ebp - 0x2c], 0
jmp 0x10021f80
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10021f93
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x34], 0
jmp 0x10021f79
lea eax, [ebp - 0x2c]
push eax
push 1
lea eax, [ebp - 0x818]
push eax
push 0xf2b
push 0x5e0c
push 1
push 0x6b8e
push 0x2a25
push 0
push 0x1d31
push 0x1faf
push 0x26d6
call fcn.1000bb70
add esp, 0x30
mov dword [ebp - 0x2c], 0
jmp 0x10021fdf
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x10021ffb
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x840]
call fcn.1002cc7e
mov dword [eax], 0x27e80a7c
jmp 0x10021fd8
mov dword [ebp - 0x2c], 0
jmp 0x1002200b
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x10022021
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x864], 0xff51885a
jmp 0x10022004
mov dword [ebp - 0x20], 0
jmp 0x10022031
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jg 0x100221da
mov dword [ebp - 0x67c], 6
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x34], 0
je 0x1002214a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
mov dword [ebp - 0xa08], eax
mov eax, 0x2d7a
cmp eax, 9
jb 0x10022079
mov dword [ebp - 0x504], 1
jmp 0x10022080
and dword [ebp - 0x504], 0
cmp dword [ebp - 0x504], 0xffffffff
jge 0x100220a6
push 0xfffffffffffffff7
pop eax
test eax, eax
je 0x100220a6
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x34], 0
je 0x100220a6
mov dword [ebp - 0x338], 1
jmp 0x100220ad
and dword [ebp - 0x338], 0
cmp dword [ebp - 0x338], 0x52fa
jge 0x100220c5
mov dword [ebp - 0x470], 1
jmp 0x100220cc
and dword [ebp - 0x470], 0
mov eax, 0xfaa3
sub eax, dword [ebp - 0x470]
mov dword [ebp - 0x340], eax
push 0
lea ecx, [ebp - 0x818]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x340]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
cmp dword [ebp - 0x340], eax
jg 0x10022110
mov dword [ebp - 0x7f8], 1
jmp 0x10022117
and dword [ebp - 0x7f8], 0
xor eax, eax
inc eax
je 0x10022120
xor eax, eax
jne 0x1002212a
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x34], 0
je 0x1002214a
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x34], 0
je 0x1002214a
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x34], 0
je 0x1002214a
mov dword [ebp - 0x544], 1
jmp 0x10022151
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x34]
cmp dword [ebp - 0x544], eax
jl 0x1002216c
mov dword [ebp - 0x348], 1
jmp 0x10022173
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x348]
sub eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x278]
jne 0x10022190
mov dword [ebp - 0x478], 1
jmp 0x10022197
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x67c], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x34], 1
jne 0x100221b9
mov dword [ebp - 0x350], 1
jmp 0x100221c0
and dword [ebp - 0x350], 0
push 0
lea ecx, [ebp - 0x840]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x350]
mov dword [eax], ecx
jmp 0x1002202a
cmp dword [ebp - 0x20], 0
je 0x100222dc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xacc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34], 0
je 0x10022295
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x34]
push 0
lea ecx, [ebp - 0x818]
call fcn.1002cc7e
imul esi, dword [eax]
mov dword [ebp - 0x50c], esi
push 0
lea ecx, [ebp - 0x818]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x50c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x278]
cmp dword [ebp - 0x50c], eax
je 0x1002224d
mov dword [ebp - 0x358], 1
jmp 0x10022254
and dword [ebp - 0x358], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x864]
sub eax, dword [ebp - 0x358]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x864]
dec ecx
push 4
pop edx
imul edx, edx, 0
mov dword [ebp + edx - 0x864], ecx
cmp eax, 0xb54c
je 0x10022295
mov dword [ebp - 0x480], 1
jmp 0x1002229c
and dword [ebp - 0x480], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
cmp dword [ebp - 0x480], eax
jne 0x100222c7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34], 0
je 0x100222c7
mov dword [ebp - 0x360], 1
jmp 0x100222ce
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x278]
cmp dword [ebp - 0x360], eax
jl 0x100222e9
xor eax, eax
jne 0x100222e9
and dword [ebp - 0x570], 0
jmp 0x100222f3
mov dword [ebp - 0x570], 1
push 0
lea ecx, [ebp - 0x840]
call fcn.1002cc7e
mov dword [eax], 7
cmp dword [ebp - 0x570], 7
jl 0x1002231b
mov dword [ebp - 0x368], 1
jmp 0x10022322
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x78c]
mov eax, 0xe7df
test eax, eax
je 0x1002234a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x864], 0
jne 0x1002234a
and dword [ebp - 0x488], 0
jmp 0x10022354
mov dword [ebp - 0x488], 1
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x840]
call fcn.1002cbfb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x818]
call fcn.1002cbfb
mov dword [ebp - 0x18], 0xffffffff
push 3
lea ecx, [ebp - 0x4f4]
call fcn.1002cb22
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x10], 0x74dd0324
push 1
lea ecx, [ebp - 0x2b4]
call fcn.1002cb22
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x380], 0x3b0639e6
push 0x637a
lea eax, [ebp - 0x4f4]
push eax
push 1
push 0x59d9
lea eax, [ebp - 0x120]
push eax
push 0
push 0
call fcn.1000fb98
add esp, 0x1c
mov dword [ebp - 0x120], 0
jmp 0x100223f7
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jge 0x10022419
push dword [ebp - 0x120]
lea ecx, [ebp - 0x2b4]
call fcn.1002cc7e
mov dword [eax], 0x4c8d3c89
jmp 0x100223ea
push 0
lea ecx, [ebp - 0x4f4]
call fcn.1002cc7e
and dword [eax], 0
cmp dword [ebp - 0x10], 0
jl 0x1002243b
mov dword [ebp - 0x370], 1
jmp 0x10022442
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x10], eax
mov esi, dword [ebp - 0x10]
push 0
lea ecx, [ebp - 0x2b4]
call fcn.1002cc7e
mov dword [eax], esi
mov dword [ebp - 0x10], 0
jmp 0x1002246d
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x10022784
mov dword [ebp - 0x250], 8
push 3
lea ecx, [ebp - 0x870]
call fcn.1002cb22
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x18c], 0
jmp 0x100224ab
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 3
jge 0x100224cd
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x870]
call fcn.1002cc7e
mov dword [eax], 0x4ab653b1
jmp 0x1002249e
mov byte [ebp - 0x88], 0
movzx eax, byte [ebp - 0x88]
test eax, eax
je 0x100224e7
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2b4]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x1002270c
push 4
lea ecx, [ebp - 0x858]
call fcn.1002cb22
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x6f4], 0x51dd2e91
mov dword [ebp - 0x1cc], 0
jmp 0x10022532
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 4
jge 0x10022554
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0x858]
call fcn.1002cc7e
mov dword [eax], 0x5bb08661
jmp 0x10022525
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4f4]
call fcn.1002cc7e
imul esi, dword [eax], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2b4]
call fcn.1002cc7e
cmp esi, dword [eax]
je 0x10022583
mov dword [ebp - 0x514], 1
jmp 0x1002258a
and dword [ebp - 0x514], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2b4]
call fcn.1002cc7e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x514]
je 0x100225ae
mov dword [ebp - 0x378], 1
jmp 0x100225b5
and dword [ebp - 0x378], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4f4]
call fcn.1002cc7e
mov esi, dword [ebp - 0x378]
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0x4f4]
call fcn.1002cc7e
cmp esi, dword [eax]
jle 0x100225e8
mov dword [ebp - 0x248], 1
jmp 0x100225ef
and dword [ebp - 0x248], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2b4]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x248]
mov dword [eax], ecx
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x250], eax
mov esi, dword [ebp - 0x250]
push 2
lea ecx, [ebp - 0x870]
call fcn.1002cc7e
cmp esi, dword [eax]
jne 0x10022634
mov dword [ebp - 0x684], 1
jmp 0x1002263b
and dword [ebp - 0x684], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2b4]
call fcn.1002cc7e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2b4]
call fcn.1002cc7e
mov esi, eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x4f4]
call fcn.1002cc7e
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x10022679
mov dword [ebp - 0x490], 1
jmp 0x10022680
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x490]
neg eax
cmp eax, 0xffffffff
ja 0x10022699
mov dword [ebp - 0x288], 1
jmp 0x100226a0
and dword [ebp - 0x288], 0
push 2
lea ecx, [ebp - 0x858]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x288]
mov dword [eax], ecx
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 5
jl 0x100226e5
push 2
lea ecx, [ebp - 0x858]
call fcn.1002cc7e
cmp dword [eax], 0
jne 0x100226e5
and dword [ebp - 0x550], 0
jmp 0x100226ef
mov dword [ebp - 0x550], 1
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x6f4], eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x858]
call fcn.1002cbfb
jmp 0x10022770
mov dword [ebp - 0x68c], 0xfd996437
mov dword [ebp - 0x6f8], 0xba796726
lea eax, [ebp - 0x870]
push eax
push 0x613b
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x2b4]
push eax
push 1
push 0x387
push 0
push 1
lea eax, [ebp - 0x4f4]
push eax
push 0x59cb
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x465b
lea eax, [ebp - 0x6f8]
push eax
call fcn.1001e458
add esp, 0x38
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x870]
call fcn.1002cbfb
jmp 0x10022466
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2b4]
call fcn.1002cbfb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4f4]
call fcn.1002cbfb
mov dword [ebp - 0x47c], 1
push 1
lea ecx, [ebp - 0xad8]
call fcn.1002cb22
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x1ec], 0x2c70bb74
mov dword [ebp - 0x194], 0
jmp 0x100227e3
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 1
jge 0x10022805
push dword [ebp - 0x194]
lea ecx, [ebp - 0xad8]
call fcn.1002cc7e
mov dword [eax], 0x2062
jmp 0x100227d6
push 1
push 0x45eb
push 0xf49
push 0
call fcn.1000cdc2
add esp, 0x10
mov dword [ebp - 0x1ec], 0
jmp 0x10022834
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0
jg 0x100228d6
mov dword [ebp - 0x74], 9
mov dword [ebp - 0x74], 0
jmp 0x10022858
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jl 0x10022888
mov byte [ebp - 0x94], 0
movzx eax, byte [ebp - 0x94]
test eax, eax
je 0x10022886
push 0
push 0x6ae4
push 0x2d43
push 0
call fcn.1001bb2b
add esp, 0x10
jmp 0x10022851
mov dword [ebp - 0x74], 0
jmp 0x10022898
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jg 0x100228d1
push 0x4301
push 1
push 0
push 0x2ac2
push 0x6315
push 0x2f88
push 0x6529
push 0
push 0x3b1
push 0x7457
call fcn.1000f42f
add esp, 0x28
jmp 0x10022891
jmp 0x10022827
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xad8]
call fcn.1002cbfb
mov dword [ebp - 0x18], 0xfffffff2
jmp 0x100228f5
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffe6
jle 0x1002423b
mov dword [ebp - 0xa10], 0xfffffffc
mov dword [ebp - 0xb5c], 0xa76aabec
mov dword [ebp - 0xb04], 0x1bd97a88
mov dword [ebp - 0xa74], 0xc9f3690f
mov dword [ebp - 0xb48], 0xf2fb5a5e
mov dword [ebp - 0xa7c], 0xfffffffd
push 3
lea ecx, [ebp - 0xaec]
call fcn.1002cb22
mov dword [ebp - 4], 0x11
push 2
lea ecx, [ebp - 0x9a0]
call fcn.1002cb22
mov byte [ebp - 4], 0x12
mov dword [ebp - 0xe8], 0
jmp 0x10022979
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 3
jge 0x1002299b
push dword [ebp - 0xe8]
lea ecx, [ebp - 0xaec]
call fcn.1002cc7e
mov dword [eax], 0xe4b7834d
jmp 0x1002296c
push 0
push 0x5b43
lea eax, [ebp - 0xe8]
push eax
push 1
lea eax, [ebp - 0x9a0]
push eax
push 0x185
push 0x4d78
push 0x1cad
call fcn.1001ef15
add esp, 0x20
push 0
lea ecx, [ebp - 0x9a0]
call fcn.1002cc7e
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x388]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x388]
mov dword [ecx], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x9a0]
call fcn.1002cbfb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaec]
call fcn.1002cbfb
mov dword [ebp - 0x1d4], 0xd1e1e87d
mov dword [ebp - 0x19c], 0
jmp 0x10022a2e
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 3
jge 0x10022a4a
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0xbfc], 0xfffffffd
jmp 0x10022a21
mov dword [ebp - 0x1d4], 0
jmp 0x10022a63
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 2
jg 0x10022ac3
mov byte [ebp - 0x8a], 0
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x10022a9b
push 0x4d5e
push 1
push 0
push 0x6e6c
push 1
push 0x3c1f
call fcn.1001fbdd
add esp, 0x18
mov byte [ebp - 0xa3], 0
push 0
push 0x2db3
lea eax, [ebp - 0xa3]
push eax
push 1
push 0
push 0x3a2
call fcn.10025fb0
add esp, 0x18
jmp 0x10022a56
mov dword [ebp - 0x178], 0xffffffff
mov dword [ebp - 0x13c], 0
jmp 0x10022ae6
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 3
jge 0x10022b02
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x888], 0xbe1d925b
jmp 0x10022ad9
mov dword [ebp - 0x694], 0x25fd
cmp dword [ebp - 0x694], 0xf35
jge 0x10022cab
push 0x106cd02c
push 0x106cd028
push 0x1065ee4c
push 0x10007da4
call fcn.1005459b
add esp, 0x10
push dword [0x1065ee4c]
mov ecx, 0x10a22460
call fcn.1002cc1d
and dword [ebp - 0xd4], 0
jmp 0x10022b5e
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
cmp eax, dword [0x1065ee4c]
jge 0x10022bae
push dword [ebp - 0xd4]
mov ecx, 0x10a22460
call fcn.1002cc7e
push eax
push 0x10007b70
call fcn.1005459b
pop ecx
pop ecx
push dword [ebp - 0xd4]
mov ecx, 0x10a22460
call fcn.1002cc7e
push eax
mov ecx, 0x10a2249c
call fcn.1002d245
mov ecx, dword [ebp - 0xd4]
mov dword [eax], ecx
jmp 0x10022b51
push 0x61a84
push 0xffffffffffffffff
push 0x10666d00
call fcn.1003d774
add esp, 0xc
and dword [ebp - 0x138], 0
jmp 0x10022bd8
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
cmp eax, dword [0x1065ee4c]
jge 0x10022c1a
push 0x186a1
push 0
push 0x106cd030
call fcn.1003d774
add esp, 0xc
push dword [ebp - 0x138]
call fcn.1001fe38
pop ecx
movzx eax, al
test eax, eax
jne 0x10022c18
push 0x10007b9c
call fcn.10054d82
pop ecx
jmp 0x10022bcb
push 0x10007b98
call fcn.10054d82
pop ecx
and dword [ebp - 0xcc], 0
jmp 0x10022c3b
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
cmp eax, dword [0x1065ee4c]
jge 0x10022ca3
cmp dword [ebp - 0xcc], 0
je 0x10022c5a
push 0x20
call fcn.10054d79
pop ecx
push dword [ebp - 0xcc]
mov ecx, 0x10a22460
call fcn.1002cc7e
mov esi, eax
mov eax, dword [ebp - 0xcc]
push dword [eax*4 + 0x10666d00]
mov ecx, 0x10a22460
call fcn.1002cc7e
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, dword [0x106cd028]
jne 0x10022c99
push 0x30
call fcn.10054d79
pop ecx
jmp 0x10022ca1
push 0x31
call fcn.10054d79
pop ecx
jmp 0x10022c2e
push 0xa
call fcn.10054d79
pop ecx
mov dword [ebp - 0x78], 7
mov dword [ebp - 0xa0], 0xffff
mov dword [ebp - 0x284], 0x3e5ec352
mov dword [ebp - 0x258], 0xdc509ca4
mov dword [ebp - 0x3b0], 0xa3fd
mov dword [ebp - 0x69c], 0xffffffff
push 2
lea ecx, [ebp - 0x9b8]
call fcn.1002cb22
mov dword [ebp - 4], 0x13
push 0x96f
push 0
lea eax, [ebp - 0x9b8]
push eax
push 1
lea eax, [ebp - 0xb14]
push eax
call fcn.100104fd
add esp, 0x14
mov byte [ebp - 0x8c], 0
movzx eax, byte [ebp - 0x8c]
test eax, eax
je 0x10022d36
push 0xefd
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x78], 0x1320f2d6
jg 0x10022d4b
mov dword [ebp - 0x498], 1
jmp 0x10022d52
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x78]
imul eax, dword [ebp - 0x498]
test eax, eax
je 0x10022d75
cmp dword [ebp - 0xa0], 0
je 0x10022d75
mov dword [ebp - 0x390], 1
jmp 0x10022d7c
and dword [ebp - 0x390], 0
cmp dword [ebp - 0x390], 0xd6b5
jge 0x10022d94
mov dword [ebp - 0x51c], 1
jmp 0x10022d9b
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x51c], eax
jg 0x10022db2
mov dword [ebp - 0x398], 1
jmp 0x10022db9
and dword [ebp - 0x398], 0
cmp dword [ebp - 0x398], 0xff44
je 0x10022dd1
mov dword [ebp - 0x4a0], 1
jmp 0x10022dd8
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x4a0], eax
je 0x10022df2
mov dword [ebp - 0x3a0], 1
jmp 0x10022df9
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x3a0], eax
jg 0x10022e13
mov dword [ebp - 0x580], 1
jmp 0x10022e1a
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x580]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x284]
add eax, 8
cmp eax, 0xfffffff8
jge 0x10022e40
mov dword [ebp - 0x3a8], 1
jmp 0x10022e47
and dword [ebp - 0x3a8], 0
imul eax, dword [ebp - 0x3a8], 0x1718
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x258], eax
jne 0x10022e6e
mov dword [ebp - 0x4a8], 1
jmp 0x10022e75
and dword [ebp - 0x4a8], 0
imul eax, dword [ebp - 0x4a8], 0x3725
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x3b0], eax
jle 0x10022e9f
mov dword [ebp - 0x700], 1
jmp 0x10022ea6
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xa84], eax
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x284], eax
je 0x10022ecc
mov dword [ebp - 0x524], 1
jmp 0x10022ed3
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x78]
imul eax, dword [ebp - 0x524]
sub eax, dword [ebp - 0x78]
jne 0x10022ee9
cmp dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x78]
sub eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0xa0]
jl 0x10022f03
mov dword [ebp - 0x3b8], 1
jmp 0x10022f0a
and dword [ebp - 0x3b8], 0
mov esi, dword [ebp - 0x3b8]
sub esi, dword [ebp - 0x69c]
push 0
lea ecx, [ebp - 0x9b8]
call fcn.1002cc7e
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9b8]
call fcn.1002cbfb
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x888], 0xfffffff1
jmp 0x10022f62
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x888]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x888], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x888], 0x11
jl 0x10023777
mov dword [ebp - 0x150], 0
push 2
lea ecx, [ebp - 0x600]
call fcn.1002cb22
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x4c], 5
mov dword [ebp - 0x80], 0x10e6b6cd
mov dword [ebp - 0x6ac], 0xfffffffe
mov dword [ebp - 0x718], 0xeccdf493
push 0x766d
push 0x1818
lea eax, [ebp - 0x600]
push eax
push 1
push 0
lea eax, [ebp - 0xb18]
push eax
call fcn.1000a4e0
add esp, 0x18
xor eax, eax
jne 0x10022ff0
push 1
lea ecx, [ebp - 0x600]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x1002300e
push 1
lea ecx, [ebp - 0x600]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x1002300e
mov dword [ebp - 0x4b0], 1
jmp 0x10023015
and dword [ebp - 0x4b0], 0
push 1
lea ecx, [ebp - 0x600]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x4b0]
add ecx, dword [eax]
jne 0x10023038
mov dword [ebp - 0x3c0], 1
jmp 0x1002303f
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x80], 0
jmp 0x10023058
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0xffffffef
jne 0x100233f3
push 2
lea ecx, [ebp - 0x828]
call fcn.1002cb22
mov byte [ebp - 4], 0x15
push 3
lea ecx, [ebp - 0x97c]
call fcn.1002cb22
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x6b4], 0xfffffff9
mov dword [ebp - 0x4c0], 0
push 0x6d19
lea eax, [ebp - 0x610]
push eax
push 0
push 0x45e9
push 0x4f6a
lea eax, [ebp - 0x828]
push eax
call fcn.1002bf8e
add esp, 0x18
lea eax, [ebp - 0x97c]
push eax
lea eax, [ebp - 0x610]
push eax
push 0x77d2
push 0
push 0xdb9
push 0
push 0x118
call fcn.100100d3
add esp, 0x1c
mov dword [ebp - 0x4c], 0
jmp 0x100230f8
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x17
jne 0x1002313a
mov byte [ebp - 0x86], 0
movzx eax, byte [ebp - 0x86]
test eax, eax
je 0x10023130
push 0xeef
push 0x3420
push 0
push 0x135e
push 0x7d5e
push 1
call fcn.10009fc9
add esp, 0x18
cmp dword [ebp - 0x80], 0
je 0x10023138
jmp 0x100230f1
jmp 0x100230f1
push 0
lea ecx, [ebp - 0x828]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x100233b9
mov dword [ebp - 0x28c], 0
mov dword [ebp - 0x148], 0
jmp 0x10023173
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 2
jge 0x1002318f
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x564], 0xfffffffb
jmp 0x10023166
mov dword [ebp - 0x4c], 0
jmp 0x1002319f
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jg 0x1002332a
mov dword [ebp - 0x70], 0x7392715e
mov dword [ebp - 0x70], 1
jmp 0x100231c0
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jl 0x100232ff
mov dword [ebp - 0x710], 0xfffffff6
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xa8c], eax
cmp dword [ebp - 0x70], 0xffffffff
jb 0x10023280
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x80]
mov dword [ebp + eax - 0x564], ecx
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x564], 1
ja 0x10023213
mov dword [ebp - 0x6a4], 1
jmp 0x1002321a
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xb20], eax
mov eax, dword [ebp - 0x710]
mov dword [ebp - 0xa94], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0xb60], eax
push 0
lea ecx, [ebp - 0x828]
call fcn.1002cc7e
push 0
lea ecx, [ebp - 0x828]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x1002326c
mov eax, 0x64069a3e
test eax, eax
je 0x1002326c
mov dword [ebp - 0x55c], 1
jmp 0x10023273
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x55c]
sub eax, 0x830a
je 0x10023295
mov eax, 0xd6b1f848
test eax, eax
je 0x10023295
mov dword [ebp - 0x3c8], 1
jmp 0x1002329c
and dword [ebp - 0x3c8], 0
push 1
lea ecx, [ebp - 0x97c]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x3c8]
add ecx, dword [eax]
jne 0x100232bf
mov dword [ebp - 0x4b8], 1
jmp 0x100232c6
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x4b8]
inc eax
cmp eax, dword [ebp - 0x80]
jg 0x100232de
mov dword [ebp - 0x3d0], 1
jmp 0x100232e5
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x6ac], eax
jmp 0x100231b9
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x10023325
push 0xfa6
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x10023198
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x564]
cmp dword [ebp - 0x28c], eax
jg 0x1002334b
mov dword [ebp - 0x52c], 1
jmp 0x10023352
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x718], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x564], 0
jne 0x100233a1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x564]
mov dword [ebp - 0xa9c], eax
mov esi, dword [ebp - 0x28c]
push 0
lea ecx, [ebp - 0x600]
call fcn.1002cc7e
sub esi, dword [eax]
jne 0x100233a1
and dword [ebp - 0x3d8], 0
jmp 0x100233ab
mov dword [ebp - 0x3d8], 1
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x6b4], eax
jmp 0x100233d0
mov dword [ebp - 0xb24], 0x70b
mov eax, dword [ebp - 0x4c0]
inc eax
mov dword [ebp - 0x4c0], eax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x97c]
call fcn.1002cbfb
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x828]
call fcn.1002cbfb
jmp 0x10023051
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x600]
call fcn.1002cbfb
mov dword [ebp - 0x150], 0x13
jmp 0x1002341b
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0xfffffff0
jle 0x10023772
push 2
lea ecx, [ebp - 0x220]
call fcn.1002cb22
mov dword [ebp - 4], 0x17
push 4
lea ecx, [ebp - 0x5dc]
call fcn.1002cb22
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x3f0], 0xa08b
mov dword [ebp - 0x30], 0
jmp 0x10023467
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1002347d
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x3f8], 1
jmp 0x10023460
mov dword [ebp - 0x30], 0
jmp 0x1002348d
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x100234a9
push dword [ebp - 0x30]
lea ecx, [ebp - 0x220]
call fcn.1002cc7e
mov dword [eax], 0xfffffffc
jmp 0x10023486
mov dword [ebp - 0x30], 0
jmp 0x100234b9
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x100234d5
push dword [ebp - 0x30]
lea ecx, [ebp - 0x5dc]
call fcn.1002cc7e
mov dword [eax], 0xdf11
jmp 0x100234b2
push 1
lea ecx, [ebp - 0x220]
call fcn.1002cc7e
and dword [eax], 0
jmp 0x1002350b
push 1
lea ecx, [ebp - 0x220]
call fcn.1002cc7e
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x3e0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x3e0]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x220]
call fcn.1002cc7e
cmp dword [eax], 0
jl 0x10023544
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x10023542
push 0
push 0x7aac
push 1
push 1
call fcn.10009edd
add esp, 0x10
jmp 0x100234e7
push 3
lea ecx, [ebp - 0x5dc]
call fcn.1002cc7e
push 3
lea ecx, [ebp - 0x5dc]
call fcn.1002cc7e
cmp dword [eax], 0xe856
jg 0x10023572
mov dword [ebp - 0x720], 1
jmp 0x10023579
and dword [ebp - 0x720], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f8]
mov dword [ebp - 0xaa4], eax
push 1
lea ecx, [ebp - 0x220]
call fcn.1002cc7e
cmp dword [eax], 0xf4df7b14
jne 0x100235ad
mov dword [ebp - 0x578], 1
jmp 0x100235b4
and dword [ebp - 0x578], 0
push 0
lea ecx, [ebp - 0x220]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x578]
cmp ecx, dword [eax]
jle 0x100235d7
mov dword [ebp - 0x3e8], 1
jmp 0x100235de
and dword [ebp - 0x3e8], 0
push 2
lea ecx, [ebp - 0x5dc]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x3e8]
cmp ecx, dword [eax]
je 0x10023601
mov dword [ebp - 0x4c8], 1
jmp 0x10023608
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x3f0]
cmp dword [ebp - 0x4c8], eax
jl 0x10023622
mov dword [ebp - 0x6c0], 1
jmp 0x10023629
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0xb50], eax
push 1
lea ecx, [ebp - 0x220]
call fcn.1002cc7e
mov esi, eax
push 1
lea ecx, [ebp - 0x5dc]
call fcn.1002cc7e
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x10023663
mov dword [ebp - 0x534], 1
jmp 0x1002366a
and dword [ebp - 0x534], 0
cmp dword [ebp - 0x534], 0xd46
jge 0x10023682
mov dword [ebp - 0x4d0], 1
jmp 0x10023689
and dword [ebp - 0x4d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f8]
cmp dword [ebp - 0x4d0], eax
jne 0x100236aa
mov dword [ebp - 0x728], 1
jmp 0x100236b1
and dword [ebp - 0x728], 0
push 1
lea ecx, [ebp - 0x220]
call fcn.1002cc7e
push 1
lea ecx, [ebp - 0x220]
call fcn.1002cc7e
cmp dword [eax], 0
jne 0x100236dc
mov dword [ebp - 0x400], 1
jmp 0x100236e3
and dword [ebp - 0x400], 0
push 1
lea ecx, [ebp - 0x220]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x400]
cmp ecx, dword [eax]
jg 0x1002370c
mov eax, 0x638299fa
test eax, eax
jne 0x1002370c
and dword [ebp - 0x568], 0
jmp 0x10023716
mov dword [ebp - 0x568], 1
cmp dword [ebp - 0x568], 0
jl 0x1002372b
mov dword [ebp - 0x408], 1
jmp 0x10023732
and dword [ebp - 0x408], 0
push 0
lea ecx, [ebp - 0x220]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x408]
mov dword [eax], ecx
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x5dc]
call fcn.1002cbfb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.1002cbfb
cmp dword [ebp - 0x18], 0
je 0x1002376d
jmp 0x10023772
jmp 0x1002340e
jmp 0x10022f47
mov dword [ebp - 0x418], 0xfffffff7
mov dword [ebp - 0xec], 5
mov dword [ebp - 0x4f8], 5
mov dword [ebp - 0x6e4], 0xffffffff
cmp dword [ebp - 0x418], 0
je 0x100237bf
imul eax, dword [ebp - 0xec], 0xffffffff
test eax, eax
je 0x100237bf
mov dword [ebp - 0x4d8], 1
jmp 0x100237c6
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x4d8], eax
jne 0x1002382b
mov dword [ebp - 0x6cc], 0xe8588d0d
mov dword [ebp - 0x158], 0
jmp 0x100237f7
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 1
jge 0x10023813
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x730], 0xffffffff
jmp 0x100237ea
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6cc]
mov dword [ebp + eax - 0x730], ecx
jmp 0x100239e9
mov dword [ebp - 0x410], 1
mov dword [ebp - 0x168], 0x9973063d
mov dword [ebp - 0x170], 1
mov dword [ebp - 0x260], 0xfffffff7
mov dword [ebp - 0x160], 0
jmp 0x1002386c
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 4
jge 0x10023888
mov eax, dword [ebp - 0x160]
mov dword [ebp + eax*4 - 0xb80], 0xe8b01213
jmp 0x1002385f
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x410], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb80]
cmp dword [ebp - 0x410], eax
jg 0x100238b5
mov dword [ebp - 0x4e8], 1
jmp 0x100238bc
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0xec]
imul eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x6d8], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x6d8]
mov dword [ebp + eax - 0xb80], ecx
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xaac], eax
cmp dword [ebp - 0x418], 0
jne 0x10023902
mov dword [ebp - 0x4e0], 1
jmp 0x10023909
and dword [ebp - 0x4e0], 0
cmp dword [ebp - 0x4e0], 0xfffffffa
je 0x1002391e
mov dword [ebp - 0x420], 1
jmp 0x10023925
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x168]
add eax, dword [ebp - 0x420]
mov dword [ebp - 0x4f8], eax
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x168], eax
je 0x1002395d
mov dword [ebp - 0x428], 1
jmp 0x10023964
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x428], eax
jg 0x1002397e
mov dword [ebp - 0x440], 1
jmp 0x10023985
and dword [ebp - 0x440], 0
cmp dword [ebp - 0x440], 0x67f6
je 0x1002399d
mov dword [ebp - 0x430], 1
jmp 0x100239a4
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x260]
cmp dword [ebp - 0x170], eax
jne 0x100239ca
mov dword [ebp - 0x738], 1
jmp 0x100239d1
and dword [ebp - 0x738], 0
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x6e4], eax
mov dword [ebp - 0x178], 0
jmp 0x10023a02
cmp dword [ebp - 0x178], 0xffffffe5
jne 0x10024236
push 2
lea ecx, [ebp - 0x214]
call fcn.1002cb22
mov dword [ebp - 4], 0x19
push 4
lea ecx, [ebp - 0x5f4]
call fcn.1002cb22
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x2dc], 0xa08b
mov dword [ebp - 0x44], 0
jmp 0x10023a4e
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x10023a64
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x2ec], 1
jmp 0x10023a47
mov dword [ebp - 0x44], 0
jmp 0x10023a74
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x10023a90
push dword [ebp - 0x44]
lea ecx, [ebp - 0x214]
call fcn.1002cc7e
mov dword [eax], 0xfffffffc
jmp 0x10023a6d
push 0x3078
push 0x6ad1
push 0x4210
push 0x72b6
push 0
lea eax, [ebp - 0x5f4]
push eax
push 1
push 0
push 0x3ecd
push 0x615f
push 0x69af
push 0x683a
lea eax, [ebp - 0x44]
push eax
push 0x7b52
call fcn.1001e458
add esp, 0x38
push 1
lea ecx, [ebp - 0x214]
call fcn.1002cc7e
and dword [eax], 0
jmp 0x10023b0c
push 1
lea ecx, [ebp - 0x214]
call fcn.1002cc7e
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x444]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x444]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x214]
call fcn.1002cc7e
cmp dword [eax], 0
jl 0x10023b48
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x10023b46
push 0
push 0x31f6
push 0x3940
push 0
call fcn.1000a5fe
add esp, 0x10
jmp 0x10023ae8
push 3
lea ecx, [ebp - 0x5f4]
call fcn.1002cc7e
push 3
lea ecx, [ebp - 0x5f4]
call fcn.1002cc7e
cmp dword [eax], 0xe856
jg 0x10023b76
mov dword [ebp - 0x740], 1
jmp 0x10023b7d
and dword [ebp - 0x740], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ec]
mov dword [ebp - 0x9e0], eax
push 1
lea ecx, [ebp - 0x214]
call fcn.1002cc7e
cmp dword [eax], 0xf4df7b14
jne 0x10023bb1
mov dword [ebp - 0x438], 1
jmp 0x10023bb8
and dword [ebp - 0x438], 0
push 0
lea ecx, [ebp - 0x214]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x438]
cmp ecx, dword [eax]
jle 0x10023bdb
mov dword [ebp - 0x44c], 1
jmp 0x10023be2
and dword [ebp - 0x44c], 0
push 2
lea ecx, [ebp - 0x5f4]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x44c]
cmp ecx, dword [eax]
je 0x10023c05
mov dword [ebp - 0x2d8], 1
jmp 0x10023c0c
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x2dc]
cmp dword [ebp - 0x2d8], eax
jl 0x10023c26
mov dword [ebp - 0x6f0], 1
jmp 0x10023c2d
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x9e4], eax
push 1
lea ecx, [ebp - 0x214]
call fcn.1002cc7e
mov esi, eax
push 1
lea ecx, [ebp - 0x5f4]
call fcn.1002cc7e
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x10023c67
mov dword [ebp - 0x2e4], 1
jmp 0x10023c6e
and dword [ebp - 0x2e4], 0
cmp dword [ebp - 0x2e4], 0xd46
jge 0x10023c86
mov dword [ebp - 0x2f4], 1
jmp 0x10023c8d
and dword [ebp - 0x2f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ec]
cmp dword [ebp - 0x2f4], eax
jne 0x10023cae
mov dword [ebp - 0x748], 1
jmp 0x10023cb5
and dword [ebp - 0x748], 0
push 1
lea ecx, [ebp - 0x214]
call fcn.1002cc7e
push 1
lea ecx, [ebp - 0x214]
call fcn.1002cc7e
cmp dword [eax], 0
jne 0x10023ce0
mov dword [ebp - 0x2fc], 1
jmp 0x10023ce7
and dword [ebp - 0x2fc], 0
push 1
lea ecx, [ebp - 0x214]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x2fc]
cmp ecx, dword [eax]
jg 0x10023d10
mov eax, 0x638299fa
test eax, eax
jne 0x10023d10
and dword [ebp - 0x304], 0
jmp 0x10023d1a
mov dword [ebp - 0x304], 1
cmp dword [ebp - 0x304], 0
jl 0x10023d2f
mov dword [ebp - 0x30c], 1
jmp 0x10023d36
and dword [ebp - 0x30c], 0
push 0
lea ecx, [ebp - 0x214]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x30c]
mov dword [eax], ecx
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x5f4]
call fcn.1002cbfb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x214]
call fcn.1002cbfb
push 2
lea ecx, [ebp - 0x5b0]
call fcn.1002cb22
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x314], 0x2a82
mov dword [ebp - 0x750], 3
mov dword [ebp - 0x54], 0
jmp 0x10023da1
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x10023dba
push dword [ebp - 0x54]
lea ecx, [ebp - 0x5b0]
call fcn.1002cc7e
and dword [eax], 0
jmp 0x10023d9a
mov dword [ebp - 0x54], 0
jmp 0x10023dca
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x10023de0
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x128], 0x18d4081c
jmp 0x10023dc3
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x128], 1
jmp 0x10023e0e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x128], 0
jl 0x10023f8f
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x128]
lea ecx, [ebp - 0x5b0]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x10023e5e
mov dword [ebp - 0x314], 0xfffffffa
cmp dword [ebp - 0x314], 0
je 0x10023e5e
and dword [ebp - 0x32c], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x128]
lea ecx, [ebp - 0x5b0]
call fcn.1002cc7e
mov esi, eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x128]
lea ecx, [ebp - 0x5b0]
call fcn.1002cc7e
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x10023ea9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5b0]
call fcn.1002cbfb
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x10024231
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x84], 0xb4f5ac3d
mov dword [ebp - 0x9ec], 0xcd90
push 0
push 0x758f
lea eax, [ebp - 0x28]
push eax
push 0x5e51
push 0
push 1
call fcn.1001b604
add esp, 0x18
cmp dword [ebp - 0x28], 0
je 0x1002402f
jmp 0x100239f5
jmp 0x100228ee
mov dword [ebp - 0x6fc], 0x23c4
cmp dword [ebp - 0x6fc], 0x450
jge 0x100244f1
lea eax, [ebp - 0x294]
push eax
push 0x10007b74
call fcn.1005459b
pop ecx
pop ecx
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x794], eax
mov eax, dword [ebp - 0x294]
dec eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x794], 0
je 0x100244f1
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x228]
push eax
push 0x10007c34
call fcn.1005459b
add esp, 0xc
and dword [ebp - 0x704], 0
lea eax, [ebp - 0x704]
push eax
mov eax, dword [ebp - 0x228]
inc eax
push eax
lea ecx, [ebp - 0x5bc]
call fcn.1002cb5e
mov dword [ebp - 4], 0x1d
mov byte [ebp - 0x90], 0
lea eax, [ebp - 0x90]
push eax
push dword [ebp - 0x228]
lea ecx, [ebp - 0x8d8]
call fcn.1002ce58
mov byte [ebp - 4], 0x1e
push 1
push 0
lea eax, [ebp - 0xbb8]
push eax
lea ecx, [ebp - 0x8d8]
call fcn.1002ceba
mov ecx, eax
call fcn.1002cf23
and dword [ebp - 0x268], 0
jmp 0x10024327
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
mov eax, dword [ebp - 0x268]
cmp eax, dword [ebp - 0x808]
jge 0x1002436b
lea eax, [ebp - 0x79c]
push eax
lea eax, [ebp - 0x70c]
push eax
push 0x10007c34
call fcn.1005459b
add esp, 0xc
push dword [ebp - 0x70c]
lea ecx, [ebp - 0x5bc]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x79c]
mov dword [eax], ecx
jmp 0x1002431a
and dword [ebp - 0x234], 0
mov dword [ebp - 0x7c], 1
jmp 0x10024382
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x228]
jg 0x100244bc
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x5bc]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x100243dc
push dword [ebp - 0x7c]
lea eax, [ebp - 0xbc8]
push eax
lea ecx, [ebp - 0x8d8]
call fcn.1002ceba
mov ecx, eax
call fcn.1002cf48
movzx eax, al
test eax, eax
jne 0x100243dc
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x5bc]
call fcn.1002cc7e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x7c]
jne 0x100243de
jmp 0x1002437b
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xbc], eax
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x5bc]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x10024476
push dword [ebp - 0xbc]
lea eax, [ebp - 0xbe8]
push eax
lea ecx, [ebp - 0x8d8]
call fcn.1002ceba
mov ecx, eax
call fcn.1002cf48
movzx eax, al
test eax, eax
jne 0x10024476
push 1
push dword [ebp - 0xbc]
lea eax, [ebp - 0xbc0]
push eax
lea ecx, [ebp - 0x8d8]
call fcn.1002ceba
mov ecx, eax
call fcn.1002cf23
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x5bc]
call fcn.1002cc7e
mov eax, dword [eax]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
jmp 0x100243ee
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x5bc]
call fcn.1002cc7e
cmp dword [eax], 0
jle 0x10024498
mov dword [ebp - 0x374], 1
jmp 0x1002449f
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x22c]
add eax, dword [ebp - 0x374]
add eax, dword [ebp - 0x234]
mov dword [ebp - 0x234], eax
jmp 0x1002437b
push dword [ebp - 0x234]
push 0x10007b90
call fcn.100549f9
pop ecx
pop ecx
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x8d8]
call fcn.1002ce96
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5bc]
call fcn.1002cbfb
jmp 0x10024268
mov dword [ebp - 0x48], 0x5c68ec0a
mov dword [ebp - 0x81c], 0xffffffff
mov dword [ebp - 0xa04], 6
mov dword [ebp - 0x48], 0xffffffef
jmp 0x1002451c
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x1d
je 0x100247ec
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x100247e7
mov dword [ebp - 0x714], 0x1c50
cmp dword [ebp - 0x714], 0x854
jge 0x100247c0
lea eax, [ebp - 0xc0]
push eax
mov ecx, 0x1065dcc0
call fcn.1002c299
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x60c]
call fcn.1002d296
mov dword [ebp - 4], 0x1f
and dword [ebp - 0x198], 0
jmp 0x10024595
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x198]
cmp eax, dword [ebp - 0xc0]
jge 0x100245c2
push dword [ebp - 0x198]
lea ecx, [ebp - 0x60c]
call fcn.1002d302
mov edx, eax
mov ecx, 0x1065dcc0
call fcn.100312ac
jmp 0x10024588
push 0
lea ecx, [ebp - 0x60c]
call fcn.1002d302
mov ecx, eax
call fcn.1002c250
imul eax, dword [ebp - 0xc0]
mov dword [ebp - 0xfc], eax
and dword [ebp - 0x1a8], 0
jmp 0x100245f9
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
cmp eax, dword [ebp - 0xc0]
jge 0x10024795
and dword [ebp - 0xf4], 0
and dword [ebp - 0x1a0], 0
jmp 0x10024628
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
cmp eax, dword [ebp - 0xc0]
jge 0x1002475c
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0x60c]
call fcn.1002d302
push eax
lea ecx, [ebp - 0xa6c]
call fcn.1002c118
mov byte [ebp - 4], 0x20
push dword [ebp - 0x1a8]
lea ecx, [ebp - 0x60c]
call fcn.1002d302
mov edx, eax
lea ecx, [ebp - 0xa6c]
call fcn.100318fb
movzx eax, al
test eax, eax
je 0x10024748
push dword [0x10007eec]
push 1
lea eax, [ebp - 0xc20]
push eax
lea ecx, [ebp - 0xa6c]
call fcn.1002c254
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x7ec]
mov dword [ebp - 0x71c], eax
mov byte [ebp - 4], 0x21
push 0
lea ecx, [ebp - 0xa6c]
call fcn.1002c231
mov al, byte [eax]
movzx eax, al
push eax
mov edx, dword [ebp - 0x71c]
lea ecx, [ebp - 0xc38]
call fcn.1003190a
pop ecx
mov dword [ebp - 0x7a4], eax
push dword [ebp - 0x7a4]
lea ecx, [ebp - 0xa6c]
call fcn.1002c1a1
lea ecx, [ebp - 0xc38]
call fcn.1002c1c6
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xc20]
call fcn.1002c1c6
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
push 0
lea ecx, [ebp - 0x60c]
call fcn.1002d302
mov ecx, eax
call fcn.1002c250
imul eax, dword [ebp - 0xc0]
cmp dword [ebp - 0xf4], eax
jbe 0x10024743
or dword [ebp - 0xfc], 0xffffffff
jmp 0x10024748
jmp 0x1002465b
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xa6c]
call fcn.1002c1c6
jmp 0x1002461b
mov eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0xf4]
jge 0x10024778
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x37c], eax
jmp 0x10024784
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0xfc], eax
jmp 0x100245ec
push fcn.1003148b
push dword [ebp - 0xfc]
mov ecx, 0x1065dc18
call fcn.1002c6be
mov ecx, eax
call fcn.1002c6b2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60c]
call fcn.1002d2fd
push 0x6fcd
push 0x5057
push 1
push 0x3f26
push 0xac4
push 0
push 1
push 0x662f
call fcn.100101e7
add esp, 0x20
jmp 0x10024515
mov dword [ebp - 0x48], 0xffffffe7
jmp 0x100247fc
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xffffffff
je 0x10024836
mov dword [ebp - 0x724], 0xb87d0fa5
lea eax, [ebp - 0x724]
push eax
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x48]
push eax
push 1
push 0
push 0x6569
push 0x736e
call fcn.10010663
add esp, 0x1c
jmp 0x100247f5
cmp dword [ebp - 0x18], 0
je 0x10025653
push 1
lea ecx, [ebp - 0x994]
call fcn.1002cb22
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x7ac], 0
mov dword [ebp - 0x72c], 0xfffffff7
mov dword [ebp - 0x7f4], 0xfff7
mov dword [ebp - 0x734], 9
mov dword [ebp - 0x5c], 0
jmp 0x1002488c
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x100248a8
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x994]
call fcn.1002cc7e
mov dword [eax], 0xe1e2
jmp 0x10024885
mov dword [ebp - 0x5c], 0
jmp 0x100248b8
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x100248ce
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xbf0], 0xa07c
jmp 0x100248b1
push 0x7143
lea eax, [ebp - 0x72c]
push eax
push 1
lea eax, [ebp - 0x994]
push eax
lea eax, [ebp - 0x7ac]
push eax
lea eax, [ebp - 0x734]
push eax
push 0
lea eax, [ebp - 0x7f4]
push eax
call fcn.10009d31
add esp, 0x20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x994]
call fcn.1002cbfb
mov dword [ebp - 0xa0c], 0x4039b642
push 0x4304
push 0x69f
push 1
push 0
push 0x5401
call fcn.1000d224
add esp, 0x14
push 1
push 0x783
push 0
push 1
call fcn.10009edd
add esp, 0x10
mov dword [ebp - 0x620], 0xafd77ccc
mov dword [ebp - 0x384], 0xad95e17c
push 1
lea ecx, [ebp - 0x598]
call fcn.1002cb22
mov dword [ebp - 4], 0x23
mov dword [ebp - 0x38c], 0xfffffff7
mov dword [ebp - 0x394], 0xfffffffd
mov dword [ebp - 0x3a4], 1
push 1
lea ecx, [ebp - 0x964]
call fcn.1002cb22
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x7b4], 0xfffffffa
push 0xcaf
lea eax, [ebp - 0x598]
push eax
push 0x671d
push 0x5988
push 0
push 0x6d8e
push 1
push 1
push 0x478
lea eax, [ebp - 0xc8]
push eax
push 0x2399
push 0x441f
push 0x78ef
push 0x6ec5
call fcn.1001e458
add esp, 0x38
mov dword [ebp - 0xc8], 0
jmp 0x10024a0c
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jge 0x10024a28
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x73c], 1
jmp 0x100249ff
push 0
push 0x7b36
lea eax, [ebp - 0x964]
push eax
push 0x6924
lea eax, [ebp - 0xc8]
push eax
push 0
call fcn.1000fffc
add esp, 0x18
push 1
push 0x1136
push 0x75a1
push 0
lea eax, [ebp - 0x384]
push eax
call fcn.1000a43f
add esp, 0x14
cmp dword [ebp - 0x384], 0
je 0x10024a9e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x73c], 0
je 0x10024a9e
push 0
lea ecx, [ebp - 0x598]
call fcn.1002cc7e
mov eax, dword [eax]
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x38c], 0
push 0
lea ecx, [ebp - 0x598]
call fcn.1002cc7e
mov eax, dword [eax]
mov dword [ebp - 0x394], eax
mov esi, dword [ebp - 0x394]
push 0
lea ecx, [ebp - 0x598]
call fcn.1002cc7e
mov edi, eax
push 0
lea ecx, [ebp - 0x598]
call fcn.1002cc7e
mov eax, dword [eax]
add eax, dword [edi]
cmp eax, esi
jle 0x10024ae9
mov dword [ebp - 0x39c], 1
jmp 0x10024af0
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x3a4], eax
mov esi, dword [ebp - 0x3a4]
push 0
lea ecx, [ebp - 0x598]
call fcn.1002cc7e
cmp esi, dword [eax]
jne 0x10024b1f
mov dword [ebp - 0x23c], 1
jmp 0x10024b26
and dword [ebp - 0x23c], 0
push 0
lea ecx, [ebp - 0x964]
call fcn.1002cc7e
mov ecx, dword [ebp - 0x23c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x7b4], eax
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x964]
call fcn.1002cbfb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x598]
call fcn.1002cbfb
mov dword [ebp - 0x1b0], 0
jmp 0x10024b7e
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 4
jge 0x10024b9a
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0x8c8], 0x37a5b7d8
jmp 0x10024b71
mov dword [ebp - 0x18], 3
jmp 0x10024baa
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1002564e
mov dword [ebp - 0x130], 0xb110c93b
mov dword [ebp - 0xa14], 0
mov dword [ebp - 0xa20], 0xffffffff
mov dword [ebp - 0xa2c], 0xffffffff
mov dword [ebp - 0xa38], 6
mov dword [ebp - 0xa44], 7
mov dword [ebp - 0xa50], 0xe13a6c9c
mov dword [ebp - 0xa54], 0xb44cf59
mov dword [ebp - 0xa70], 0xffffffff
mov dword [ebp - 0x3ac], 0x7000
mov dword [ebp - 0x1b8], 0
jmp 0x10024c31
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 1
jge 0x10024c4d
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0xa78], 0x874da862
jmp 0x10024c24
mov dword [ebp - 0x130], 8
jmp 0x10024c66
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0x13
jge 0x10024d0e
mov dword [ebp - 0xa80], 0x17633efc
mov dword [ebp - 0xa88], 0xffffffff
push 3
lea ecx, [ebp - 0xb00]
call fcn.1002cb22
mov dword [ebp - 4], 0x25
mov dword [ebp - 0x64], 0
jmp 0x10024cab
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x10024cc1
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xc08], 0xbb0cb8ce
jmp 0x10024ca4
mov dword [ebp - 0x64], 0
jmp 0x10024cd1
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x10024ced
push dword [ebp - 0x64]
lea ecx, [ebp - 0xb00]
call fcn.1002cc7e
mov dword [eax], 0x9ec13488
jmp 0x10024cca
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb00]
call fcn.1002cbfb
jmp 0x10024c59
mov dword [ebp - 0x10c], 1
mov dword [ebp - 0x10c], 0xf
jmp 0x10024d31
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffef
jne 0x10024f8d
mov dword [ebp - 0x9c8], 0x57e8
mov dword [ebp - 0x9c4], 0x57e8
mov dword [ebp - 0x9c0], 0x57e8
mov dword [ebp - 0x9bc], 0x57e8
mov dword [ebp - 0x104], 0xffffffff
push 4
lea ecx, [ebp - 0x5d0]
call fcn.1002cb22
mov dword [ebp - 4], 0x26
mov dword [ebp - 0x134], 0
jmp 0x10024d9d
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 4
jge 0x10024dbf
push dword [ebp - 0x134]
lea ecx, [ebp - 0x5d0]
call fcn.1002cc7e
mov dword [eax], 0xb101aae
jmp 0x10024d90
mov dword [ebp - 0x104], 0
jmp 0x10024dd8
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 3
jg 0x10024f11
mov dword [ebp - 0x3b4], 0
mov dword [ebp - 0x1c0], 0
jmp 0x10024e08
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 2
jge 0x10024e24
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x5c4], 0
jmp 0x10024dfb
mov eax, dword [ebp - 0x104]
cmp dword [ebp + eax*4 - 0x9c8], 0
je 0x10024e39
jmp 0x10024f11
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x5c4], 3
jmp 0x10024e67
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5c4]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x5c4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5c4], 0
jl 0x10024f0c
mov dword [ebp - 0x1c8], 1
mov dword [ebp - 0x1c8], 0
jmp 0x10024e9e
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
jg 0x10024ef3
mov dword [ebp - 0xa90], 0xb5c6f8b8
mov byte [ebp - 0x92], 0
push 0x6f6b
push 0x2445
lea eax, [ebp - 0x92]
push eax
push 0x2d7
push 0x452b
push 0
push 0
push 0x7a04
call fcn.1000d4c6
add esp, 0x20
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
jmp 0x10024e91
push 3
lea ecx, [ebp - 0x5d0]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x10024f07
jmp 0x10024f0c
jmp 0x10024e4c
jmp 0x10024dcb
push 3
lea ecx, [ebp - 0x5d0]
call fcn.1002cc7e
cmp dword [eax], 0
je 0x10024f3f
cmp dword [ebp - 0x10c], 0
je 0x10024f3d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5d0]
call fcn.1002cbfb
jmp 0x10024f8d
jmp 0x10024f79
mov dword [ebp - 0x744], 0xaa53f0d3
push 1
push 0x5a3c
push 1
push 1
call fcn.10009edd
add esp, 0x10
cmp dword [ebp - 0x744], 0
je 0x10024f79
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5d0]
call fcn.1002cbfb
jmp 0x10024d24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5d0]
call fcn.1002cbfb
jmp 0x10024d24
mov dword [ebp - 0xd0], 0x15a13695
mov dword [ebp - 0x1d0], 0
jmp 0x10024fb0
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 1
jge 0x10024fcc
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0x80c], 0xc0ae9714
jmp 0x10024fa3
mov dword [ebp - 0xd0], 0
jmp 0x10024fe5
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 1
jge 0x10025001
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x80c], 0xd386cce5
jmp 0x10024fd8
lea eax, [ebp - 0xd0]
push eax
push 1
push 0x1656
push 0x1efd
push 0
call fcn.1001fb18
add esp, 0x14
mov dword [ebp - 0x1d8], 0
jmp 0x10025037
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 1
jge 0x10025053
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0x614], 0xffffffff
jmp 0x1002502a
mov dword [ebp - 0x14], 0xfff8
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0x2d4], 0x8a0f8393
mov dword [ebp - 0x404], 0x8e12b6a3
push 2
lea ecx, [ebp - 0x970]
call fcn.1002cb22
mov dword [ebp - 4], 0x27
mov dword [ebp - 0x1e0], 0
jmp 0x100250a5
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 2
jge 0x100250c7
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0x970]
call fcn.1002cc7e
mov dword [eax], 1
jmp 0x10025098
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa98], eax
xor eax, eax
je 0x100250ff
cmp dword [ebp - 0x14], 0x2e97
je 0x100250e9
mov dword [ebp - 0x3bc], 1
jmp 0x100250f0
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
add eax, 0x20274952
imul eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jg 0x10025113
mov dword [ebp - 0x3c4], 1
jmp 0x1002511a
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x3c4], eax
jne 0x10025131
mov dword [ebp - 0x3cc], 1
jmp 0x10025138
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x3cc]
je 0x10025155
cmp dword [ebp - 0x14], 0
je 0x10025155
mov dword [ebp - 0x3d4], 1
jmp 0x1002515c
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x3d4]
jg 0x10025173
mov dword [ebp - 0x3dc], 1
jmp 0x1002517a
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x3dc]
cmp eax, 6
jl 0x10025195
mov dword [ebp - 0x3e4], 1
jmp 0x1002519c
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x3e4], eax
jl 0x100251b3
mov dword [ebp - 0x3ec], 1
jmp 0x100251ba
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x3ec]
neg eax
jne 0x100251d6
mov eax, 0x2206dd2c
test eax, eax
jne 0x100251d6
and dword [ebp - 0x3f4], 0
jmp 0x100251e0
mov dword [ebp - 0x3f4], 1
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x14], 0
jmp 0x100251fc
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x24
jge 0x10025541
mov dword [ebp - 0x1e8], 0x9d66de6b
push 3
lea ecx, [ebp - 0x804]
call fcn.1002cb22
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x46c], 0xcf687292
mov dword [ebp - 0x74c], 0x653e3f36
mov dword [ebp - 0xaa0], 1
mov dword [ebp - 0xd8], 6
mov dword [ebp - 0x6c], 0
jmp 0x10025259
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1002526f
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x7bc], 0x7263
jmp 0x10025252
mov dword [ebp - 0x6c], 0
jmp 0x1002527f
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x10025298
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x804]
call fcn.1002cc7e
or dword [eax], 0xffffffff
jmp 0x10025278
mov dword [ebp - 0xa8], 0
jmp 0x100252b1
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x1002552d
mov dword [ebp - 0xe0], 0xfff9
mov dword [ebp - 0x474], 0xfffffffd
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x1e8], 0
jmp 0x100252f8
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0
jl 0x10025528
mov dword [ebp - 0x9d8], 0xdab0b826
mov dword [ebp - 0x9d4], 0xdab0b826
mov dword [ebp - 0x9d0], 0xdab0b826
mov dword [ebp - 0x9cc], 0xdab0b826
mov dword [ebp - 0xd8], 0
jmp 0x10025346
cmp dword [ebp - 0xd8], 0
jg 0x10025523
mov eax, dword [ebp - 0xd8]
inc eax
push eax
lea ecx, [ebp - 0x804]
call fcn.1002cc7e
mov eax, dword [eax]
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x40c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x40c]
mov dword [ebp + eax - 0x9d8], ecx
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x804]
call fcn.1002cc7e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x40c]
jg 0x100253bf
mov dword [ebp - 0x41c], 1
jmp 0x100253c6
and dword [ebp - 0x41c], 0
cmp dword [ebp - 0x14], 0
je 0x100253d8
mov dword [ebp - 0x414], 1
jmp 0x100253df
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x414]
sub eax, dword [ebp - 0xe0]
imul eax, dword [ebp - 0x41c]
test eax, eax
jne 0x10025408
cmp dword [ebp - 0x74c], 0
jne 0x10025408
and dword [ebp - 0x424], 0
jmp 0x10025412
mov dword [ebp - 0x424], 1
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x424], eax
jle 0x1002542c
mov dword [ebp - 0x42c], 1
jmp 0x10025433
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x42c], eax
jge 0x1002544d
mov dword [ebp - 0x434], 1
jmp 0x10025454
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x7bc]
cmp eax, dword [ebp - 0x434]
jg 0x10025475
mov dword [ebp - 0x754], 1
jmp 0x1002547c
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xaa8], eax
cmp dword [ebp - 0xe0], 0xfffffffb
jne 0x1002549d
mov dword [ebp - 0x43c], 1
jmp 0x100254a4
and dword [ebp - 0x43c], 0
cmp dword [ebp - 0x43c], 0x3bebda3f
jl 0x100254bc
mov dword [ebp - 0x45c], 1
jmp 0x100254c3
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x45c], eax
je 0x100254da
mov dword [ebp - 0x464], 1
jmp 0x100254e1
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x474], eax
mov esi, dword [ebp - 0x474]
push 2
lea ecx, [ebp - 0x804]
call fcn.1002cc7e
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x970]
call fcn.1002cc7e
mov dword [eax], esi
jmp 0x10025339
jmp 0x100252eb
jmp 0x100252a4
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x804]
call fcn.1002cbfb
jmp 0x100251f5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x970]
call fcn.1002cbfb
mov eax, dword [ebp - 0x18]
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x8c8]
cmp dword [ebp + eax*4 - 0x8c8], ecx
jle 0x10025575
mov dword [ebp - 0x7e4], 1
jmp 0x1002557c
and dword [ebp - 0x7e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c8]
mov dword [ebp - 0xab0], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x8c8]
cmp dword [ebp - 0x47c], eax
jge 0x100255b6
mov dword [ebp - 0x244], 1
jmp 0x100255bd
and dword [ebp - 0x244], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x244]
mov dword [ebp + eax - 0x614], ecx
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x244], eax
jle 0x100255e7
mov dword [ebp - 0x618], 1
jmp 0x100255ee
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xab8], eax
xor eax, eax
inc eax
je 0x10025618
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8c8], 0
je 0x10025618
mov dword [ebp - 0x484], 1
jmp 0x1002561f
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x484], eax
jle 0x10025636
mov dword [ebp - 0x48c], 1
jmp 0x1002563d
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x620], eax
jmp 0x10024ba3
jmp 0x10025c1c
mov dword [ebp - 0xb0], 0xe125d16d
mov dword [ebp - 0x1f0], 0
jmp 0x10025676
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 1
jge 0x10025692
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0x4a4], 4
jmp 0x10025669
mov dword [ebp - 0xb0], 0xffffffff
mov dword [ebp - 0xb0], 0
jmp 0x100256b5
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jg 0x100257d7
mov dword [ebp - 0x24c], 0x7439
push 2
lea ecx, [ebp - 0x988]
call fcn.1002cb22
mov dword [ebp - 4], 0x29
mov dword [ebp - 0x1f8], 0
jmp 0x100256f9
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 2
jge 0x1002571b
push dword [ebp - 0x1f8]
lea ecx, [ebp - 0x988]
call fcn.1002cc7e
mov dword [eax], 0xfdb69689
jmp 0x100256ec
cmp dword [ebp - 0x24c], 3
jae 0x10025730
mov dword [ebp - 0x494], 1
jmp 0x10025737
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x494]
sub eax, 0x250d
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x4a4], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xb28], eax
cmp dword [ebp - 0x24c], 0xa8af
jle 0x10025773
mov dword [ebp - 0x49c], 1
jmp 0x1002577a
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0x49c]
jg 0x10025794
mov dword [ebp - 0x628], 1
jmp 0x1002579b
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0xb30], eax
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x4a4]
push 1
lea ecx, [ebp - 0x988]
call fcn.1002cc7e
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x988]
call fcn.1002cbfb
jmp 0x100256a8
mov byte [ebp - 0x87], 0
mov dword [ebp - 0x11c], 0x5a136951
mov dword [ebp - 0x638], 0xd72276b8
push 4
lea ecx, [ebp - 0xb10]
call fcn.1002cb22
mov dword [ebp - 4], 0x2a
mov dword [ebp - 0x114], 0
jmp 0x1002581f
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 1
jge 0x1002583b
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x630], 0x8ec0ae97
jmp 0x10025812
push 0x613b
lea eax, [ebp - 0x114]
push eax
push 0
lea eax, [ebp - 0xb10]
push eax
push 0x1d10
push 0x57fe
push 0x7de2
push 1
call fcn.1000a1bd
add esp, 0x20
mov dword [ebp - 0x11c], 0
jmp 0x10025882
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jg 0x100258d9
mov byte [ebp - 0x85], 0
push 0x7bb3
push 0x3c33
push 0x15f6
push 0x5506
push 0x5cf
push 0x2e44
push 0x678b
push 0
lea eax, [ebp - 0x85]
push eax
push 0
push 0x5cfc
push 0x4e5
push 0x64eb
call fcn.1000b580
add esp, 0x34
jmp 0x10025875
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x630], 0
je 0x10025910
lea eax, [ebp - 0x638]
push eax
push 0x13e6
push 1
push 0x5a1b
push 0
push 0x2cac
call fcn.1000f6fe
add esp, 0x18
jmp 0x100259a8
mov dword [ebp - 0x640], 0xfffffff7
mov dword [ebp - 0xb38], 0x4a6f4440
mov dword [ebp - 0xb44], 0
mov dword [ebp - 0x4ac], 0xb84c
mov dword [ebp - 0x200], 0
jmp 0x10025951
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 4
jge 0x1002596d
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0xc48], 0xfffffff7
jmp 0x10025944
lea eax, [ebp - 0x11c]
push eax
push 0x57c4
push 0x71ad
push 0x782d
push 0x1f8a
push 1
push 0
lea eax, [ebp - 0x640]
push eax
call fcn.1000d4c6
add esp, 0x20
mov eax, dword [ebp - 0x4ac]
dec eax
mov dword [ebp - 0x4ac], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb10]
call fcn.1002cbfb
movzx eax, byte [ebp - 0x87]
test eax, eax
je 0x10025c1c
mov dword [ebp - 0x50], 0x6cc9
mov dword [ebp - 0x254], 0xffff
mov dword [ebp - 0x1a4], 0xfffffffb
push 3
lea ecx, [ebp - 0x834]
call fcn.1002cb22
mov dword [ebp - 4], 0x2b
mov dword [ebp - 0x658], 0x86ae2ad2
mov dword [ebp - 0x208], 0
jmp 0x10025a18
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 3
jge 0x10025a3a
push dword [ebp - 0x208]
lea ecx, [ebp - 0x834]
call fcn.1002cc7e
mov dword [eax], 0x2b4cf22a
jmp 0x10025a0b
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0x38e8
je 0x10025a5e
mov dword [ebp - 0x4b4], 1
jmp 0x10025a65
and dword [ebp - 0x4b4], 0
cmp dword [ebp - 0x4b4], 0x415
jg 0x10025a7d
mov dword [ebp - 0x4bc], 1
jmp 0x10025a84
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x4bc], eax
jge 0x10025a9b
mov dword [ebp - 0x4c4], 1
jmp 0x10025aa2
and dword [ebp - 0x4c4], 0
cmp dword [ebp - 0x4c4], 0xc11e043
jge 0x10025aba
mov dword [ebp - 0x4cc], 1
jmp 0x10025ac1
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x4cc], eax
jne 0x10025adb
mov dword [ebp - 0x648], 1
jmp 0x10025ae2
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xb4c], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
je 0x10025aff
mov dword [ebp - 0x4d4], 1
jmp 0x10025b06
and dword [ebp - 0x4d4], 0
cmp dword [ebp - 0x4d4], 1
jb 0x10025b1b
mov dword [ebp - 0x4dc], 1
jmp 0x10025b22
and dword [ebp - 0x4dc], 0
mov eax, 0x2972
sub eax, dword [ebp - 0x4dc]
cmp eax, 0xfffffffb
jb 0x10025b41
cmp dword [ebp - 0x50], 0
jne 0x10025b41
and dword [ebp - 0x4e4], 0
jmp 0x10025b4b
mov dword [ebp - 0x4e4], 1
cmp dword [ebp - 0x4e4], 0xd9403132
jb 0x10025b63
mov dword [ebp - 0x508], 1
jmp 0x10025b6a
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x508], eax
jle 0x10025b81
mov dword [ebp - 0x650], 1
jmp 0x10025b88
and dword [ebp - 0x650], 0
cmp dword [ebp - 0x1a4], 0xaf14
jne 0x10025ba0
mov dword [ebp - 0x510], 1
jmp 0x10025ba7
and dword [ebp - 0x510], 0
imul esi, dword [ebp - 0x510], 0xba1d
add esi, dword [ebp - 0x1a4]
push 1
lea ecx, [ebp - 0x834]
call fcn.1002cc7e
mov dword [eax], esi
push 1
push 0
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x658]
push eax
push 0x46ea
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.1001c2e0
add esp, 0x20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x834]
call fcn.1002cbfb
push 0x1eaf
push 0
push 0x337c
push 1
call fcn.1000a7bd
add esp, 0x10
push 0x28ff
push 1
push 0x6605
push 0x35c2
push 0x7132
push 0x1d82
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x264]
push eax
push 0x580f
push 0x1e14
push 0
call fcn.1000b707
add esp, 0x2c
push dword [ebp - 0x25c]
push 0
mov eax, dword [ebp - 0x264]
push dword [eax]
call fcn.1003d774
add esp, 0xc
jmp 0x10025ca5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x660], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x668], eax
push dword [ebp - 0x660]
push 0x6697
push dword [ebp - 0x668]
push 0x3504
push 0
call fcn.1001eeed
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret