Function at 0x1003ca2e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100723d1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x850
push esi
push edi
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x68], 0x40ed3c15
mov dword [ebp - 0xc4], 0xd06bde64
xor eax, eax
inc eax
je 0x1003ca84
cmp dword [ebp - 0x60], 0
je 0x1003ca84
mov dword [ebp - 0x278], 1
jmp 0x1003ca8b
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x278]
jle 0x1003caa2
mov dword [ebp - 0x450], 1
jmp 0x1003caa9
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x1003caef
cmp dword [ebp - 0x34], 0x2337
jle 0x1003cacd
mov dword [ebp - 0x458], 1
jmp 0x1003cad4
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x1003caef
mov dword [ebp - 0x460], 1
jmp 0x1003caf6
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x68], eax
jne 0x1003cb13
mov dword [ebp - 0x43c], 1
jmp 0x1003cb1a
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x43c]
sub eax, dword [ebp - 0x60]
cmp eax, 0xa7525d2d
jae 0x1003cb36
mov dword [ebp - 0x208], 1
jmp 0x1003cb3d
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x208], eax
je 0x1003cb54
mov dword [ebp - 0x590], 1
jmp 0x1003cb5b
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x77c], eax
cmp dword [ebp - 0x60], 0
je 0x1003cbaa
mov dword [ebp - 0x68], 0
jmp 0x1003cb7a
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x12
jl 0x1003cba8
call fcn.1003bf78
mov dword [ebp - 0x34], 0
jmp 0x1003cb95
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xe
jne 0x1003cba6
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xc4], eax
jmp 0x1003cb8e
jmp 0x1003cb73
jmp 0x1003cc12
mov byte [ebp - 0x92], 0
push 0x1d64
push 1
push 1
push 0x177e
lea eax, [ebp - 0x92]
push eax
push 0x642a
push 0x27a6
push 1
call fcn.10033343
add esp, 0x20
mov dword [ebp - 0xc4], 0xfffffff9
jmp 0x1003cbf3
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x17
jne 0x1003cc12
mov byte [ebp - 0x93], 0
lea eax, [ebp - 0x93]
push eax
call fcn.1003bfac
pop ecx
jmp 0x1003cbe6
and dword [ebp - 0x30], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x9c], 0xfffffffc
mov dword [ebp - 0x78], 0x40ed3c15
mov dword [ebp - 0xe4], 0xd06bde64
xor eax, eax
inc eax
je 0x1003cc4f
cmp dword [ebp - 0x70], 0
je 0x1003cc4f
mov dword [ebp - 0x204], 1
jmp 0x1003cc56
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x204]
jle 0x1003cc6d
mov dword [ebp - 0x3d0], 1
jmp 0x1003cc74
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
je 0x1003ccc9
cmp dword [ebp - 0x9c], 0x2337
jle 0x1003cca1
mov dword [ebp - 0x20c], 1
jmp 0x1003cca8
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
je 0x1003ccc9
mov dword [ebp - 0x340], 1
jmp 0x1003ccd0
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x78], eax
jne 0x1003cced
mov dword [ebp - 0x214], 1
jmp 0x1003ccf4
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x214]
sub eax, dword [ebp - 0x70]
cmp eax, 0xa7525d2d
jae 0x1003cd10
mov dword [ebp - 0x440], 1
jmp 0x1003cd17
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x440], eax
je 0x1003cd2e
mov dword [ebp - 0x518], 1
jmp 0x1003cd35
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x6f0], eax
cmp dword [ebp - 0x70], 0
je 0x1003cdb3
mov dword [ebp - 0x78], 0
jmp 0x1003cd54
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x12
jl 0x1003cdb1
mov byte [ebp - 0x89], 0
lea eax, [ebp - 0x89]
push eax
call fcn.1003bfda
pop ecx
push 0x7a07
push 1
push 0x6a06
push 1
lea eax, [ebp - 0xe4]
push eax
push 0x2f6b
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x9c]
push eax
push 0x2e7c
push 0x5acb
push 0x733d
push 0x21fb
call fcn.100336f5
add esp, 0x30
jmp 0x1003cd4d
jmp 0x1003cdf0
call fcn.1003c019
mov dword [ebp - 0xe4], 0xfffffff9
jmp 0x1003cdd1
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0x17
jne 0x1003cdf0
mov byte [ebp - 0x95], 0
lea eax, [ebp - 0x95]
push eax
call fcn.1003c057
pop ecx
jmp 0x1003cdc4
mov dword [ebp - 0x4a0], 0xdb3ae355
push 1
lea ecx, [ebp - 0x70c]
call fcn.10009afa
and dword [ebp - 4], 0
lea eax, [ebp - 0x70c]
push eax
lea eax, [ebp - 0x7ec]
push eax
call fcn.1003c0a0
pop ecx
pop ecx
mov dword [ebp - 0x520], 0x13e7
cmp dword [ebp - 0x520], 0x10ba
jge 0x1003cf1f
lea eax, [ebp - 0x588]
push eax
lea eax, [ebp - 0x1f0]
push eax
push 0x100078f0
call fcn.10057e4b
add esp, 0xc
movsd xmm0, qword [0x10007fc8]
movsd qword [ebp - 0x490], xmm0
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x528], eax
mov eax, dword [ebp - 0x1f0]
dec eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x528], 0
je 0x1003cefb
lea eax, [ebp - 0x5e8]
push eax
lea eax, [ebp - 0x5c8]
push eax
push 0x10007a78
call fcn.10057e4b
add esp, 0xc
movsd xmm0, qword [ebp - 0x5c8]
divsd xmm0, qword [ebp - 0x5e8]
comisd xmm0, xmmword [ebp - 0x490]
jbe 0x1003cece
movsd xmm0, qword [ebp - 0x490]
movsd qword [ebp - 0x5e0], xmm0
jmp 0x1003cee6
movsd xmm0, qword [ebp - 0x5c8]
divsd xmm0, qword [ebp - 0x5e8]
movsd qword [ebp - 0x5e0], xmm0
movsd xmm0, qword [ebp - 0x5e0]
movsd qword [ebp - 0x490], xmm0
jmp 0x1003ce65
cvtsi2sd xmm0, dword [ebp - 0x588]
mulsd xmm0, qword [ebp - 0x490]
push ecx
push ecx
movsd qword [esp], xmm0
push 0x10007a54
call fcn.10058066
add esp, 0xc
lea eax, [ebp - 0x4a0]
push eax
call fcn.1003c0e5
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70c]
call fcn.10009b5c
push 3
lea ecx, [ebp - 0x180]
call fcn.10009afa
mov dword [ebp - 4], 1
mov dword [ebp - 0x624], 0xce695ef
mov dword [ebp - 0x620], 0xce695ef
mov dword [ebp - 0x61c], 0xce695ef
mov dword [ebp - 0x618], 0xce695ef
lea ecx, [ebp - 0x1e5]
call fcn.10009bd3
push eax
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x624]
push eax
lea ecx, [ebp - 0x83c]
call fcn.10009bd6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x71c]
call fcn.10009b36
mov byte [ebp - 4], 2
mov dword [ebp - 0x5b4], 0x5036ffe6
mov dword [ebp - 0x44], 0
jmp 0x1003cfca
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x1003cfe6
push dword [ebp - 0x44]
lea ecx, [ebp - 0x180]
call fcn.10009b6a
mov dword [eax], 0x7ddc85f7
jmp 0x1003cfc3
mov dword [ebp - 0x44], 0
jmp 0x1003cff6
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x1003d00c
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x448], 0xbdfadf62
jmp 0x1003cfef
push 1
lea ecx, [ebp - 0x180]
call fcn.10009b6a
and dword [eax], 0
jmp 0x1003d042
push 1
lea ecx, [ebp - 0x180]
call fcn.10009b6a
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x21c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x21c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x180]
call fcn.10009b6a
cmp dword [eax], 0xffffffe4
jne 0x1003d347
push 1
lea ecx, [ebp - 0x5c0]
call fcn.10009afa
mov byte [ebp - 4], 3
mov dword [ebp - 0x598], 0xfffffffe
mov dword [ebp - 0x6f8], 1
mov dword [ebp - 0x1e4], 0xfffffffe
mov dword [ebp - 0x23c], 0xc6d21cd
mov dword [ebp - 0x4c], 0
jmp 0x1003d0a1
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1003d0bd
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x5c0]
call fcn.10009b6a
mov dword [eax], 0xf8d1
jmp 0x1003d09a
mov dword [ebp - 0x4c], 0
jmp 0x1003d0cd
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1003d0e3
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x194], 3
jmp 0x1003d0c6
push 0
lea ecx, [ebp - 0x5c0]
call fcn.10009b6a
cmp dword [ebp - 0x598], 1
jne 0x1003d105
mov dword [ebp - 0x348], 1
jmp 0x1003d10c
and dword [ebp - 0x348], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x448]
cmp dword [ebp - 0x348], eax
jl 0x1003d12d
mov dword [ebp - 0x224], 1
jmp 0x1003d134
and dword [ebp - 0x224], 0
cmp dword [ebp - 0x224], 0x210c
je 0x1003d14c
mov dword [ebp - 0x3d8], 1
jmp 0x1003d153
and dword [ebp - 0x3d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x448]
cmp dword [ebp - 0x3d8], eax
je 0x1003d17a
push 2
lea ecx, [ebp - 0x180]
call fcn.10009b6a
cmp dword [eax], 0
je 0x1003d196
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x194], 0
je 0x1003d196
mov dword [ebp - 0x22c], 1
jmp 0x1003d19d
and dword [ebp - 0x22c], 0
push 1
lea ecx, [ebp - 0x180]
call fcn.10009b6a
mov ecx, dword [ebp - 0x22c]
cmp ecx, dword [eax]
jle 0x1003d1c0
mov dword [ebp - 0x350], 1
jmp 0x1003d1c7
and dword [ebp - 0x350], 0
cmp dword [ebp - 0x350], 9
jne 0x1003d1dc
mov dword [ebp - 0x234], 1
jmp 0x1003d1e3
and dword [ebp - 0x234], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x448]
push 0
lea ecx, [ebp - 0x180]
call fcn.10009b6a
mov edi, dword [ebp - 0x234]
imul edi, dword [eax]
push 4
pop eax
imul eax, eax, 0
imul edi, dword [ebp + eax - 0x194]
push 1
lea ecx, [ebp - 0x180]
call fcn.10009b6a
imul edi, dword [eax]
cmp esi, edi
je 0x1003d238
push 4
pop eax
test eax, eax
jne 0x1003d238
and dword [ebp - 0x420], 0
jmp 0x1003d242
mov dword [ebp - 0x420], 1
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp - 0x420], 0x4cbf
cmp dword [ebp + eax - 0x448], ecx
jne 0x1003d267
mov dword [ebp - 0x18c], 1
jmp 0x1003d26e
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x23c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x18c]
mov dword [ebp + eax - 0x448], ecx
mov eax, dword [ebp - 0x23c]
add eax, dword [ebp - 0x18c]
mov ecx, dword [ebp - 0x1e4]
dec ecx
mov dword [ebp - 0x1e4], ecx
test eax, eax
jne 0x1003d2c3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x194], 0
jne 0x1003d2c3
and dword [ebp - 0x358], 0
jmp 0x1003d2cd
mov dword [ebp - 0x358], 1
push 0
lea ecx, [ebp - 0x5c0]
call fcn.10009b6a
mov eax, dword [eax]
cmp eax, dword [ebp - 0x358]
jle 0x1003d2f0
mov dword [ebp - 0x5a0], 1
jmp 0x1003d2f7
and dword [ebp - 0x5a0], 0
push 1
lea ecx, [ebp - 0x180]
call fcn.10009b6a
push 1
lea ecx, [ebp - 0x180]
call fcn.10009b6a
push 0
lea ecx, [ebp - 0x180]
call fcn.10009b6a
push 2
lea ecx, [ebp - 0x71c]
call fcn.10009b6a
mov eax, dword [eax]
mov dword [ebp - 0x5b4], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c0]
call fcn.10009b5c
jmp 0x1003d01e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x71c]
call fcn.10009b5c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x180]
call fcn.10009b5c
mov dword [ebp - 0x244], 9
mov dword [ebp - 0x610], 0xa485bf25
mov dword [ebp - 0x60c], 0xa485bf25
mov dword [ebp - 0x608], 0xa485bf25
mov dword [ebp - 0x604], 0xa485bf25
lea ecx, [ebp - 0x181]
call fcn.10009bd3
push eax
lea eax, [ebp - 0x600]
push eax
lea eax, [ebp - 0x610]
push eax
lea ecx, [ebp - 0x81c]
call fcn.10009bd6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x730]
call fcn.10009b36
mov dword [ebp - 4], 4
mov dword [ebp - 0x5b0], 0x1579
cmp dword [ebp - 0x5b0], 0xd05
jge 0x1003d50b
and dword [ebp - 0x19c], 0
lea eax, [ebp - 0x19c]
push eax
push 0x10007814
call fcn.10057e4b
pop ecx
pop ecx
mov byte [ebp - 0x11], 1
cmp dword [ebp - 0x19c], 5
jne 0x1003d4eb
mov byte [ebp - 0x11], 0
and dword [ebp - 0x638], 0
xor eax, eax
lea edi, [ebp - 0x634]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebp - 0x1c4], 0
jmp 0x1003d445
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1c4]
cmp eax, dword [ebp - 0x19c]
jge 0x1003d4b4
and dword [ebp - 0x1dc], 0
and dword [ebp - 0x1a4], 0
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x1dc]
push eax
push 0x100079b8
call fcn.10057e4b
add esp, 0xc
mov eax, dword [ebp - 0x1dc]
mov eax, dword [ebp + eax*4 - 0x63c]
inc eax
mov ecx, dword [ebp - 0x1dc]
mov dword [ebp + ecx*4 - 0x63c], eax
mov eax, dword [ebp - 0x1a4]
mov eax, dword [ebp + eax*4 - 0x63c]
inc eax
mov ecx, dword [ebp - 0x1a4]
mov dword [ebp + ecx*4 - 0x63c], eax
jmp 0x1003d438
and dword [ebp - 0x148], 0
jmp 0x1003d4ca
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 5
jge 0x1003d4eb
mov eax, dword [ebp - 0x148]
cmp dword [ebp + eax*4 - 0x638], 2
je 0x1003d4e9
mov byte [ebp - 0x11], 1
jmp 0x1003d4eb
jmp 0x1003d4bd
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1003d500
push 0x10007b50
call fcn.10058226
pop ecx
jmp 0x1003d50b
push 0x10007b54
call fcn.10058226
pop ecx
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x7a8], eax
cmp dword [ebp - 0x244], 0
je 0x1003d536
mov byte [ebp - 0x91], 0
lea eax, [ebp - 0x91]
push eax
call fcn.1003c186
pop ecx
jmp 0x1003d55f
mov dword [ebp - 0x534], 0
push 1
push 0x32a4
lea eax, [ebp - 0x730]
push eax
lea eax, [ebp - 0x534]
push eax
push 1
call fcn.1003444b
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x730]
call fcn.10009b5c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x188], eax
push 0x894
push 0x3193
push 0x45f7
push 0x778d
push 0x3c17
push 1
push 1
call fcn.100344f6
add esp, 0x1c
mov eax, dword [ebp - 0x188]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1003dcf6
mov dword [ebp - 0x20], 1
mov dword [ebp - 0xcc], 0x85bf25cb
mov dword [ebp - 0x1ac], 0xfffffffa
mov dword [ebp - 0x20], 0xfffffff3
jmp 0x1003d5db
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff5
jg 0x1003d8b8
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x3e0], 1
call fcn.1003c1bb
mov dword [ebp - 0xcc], 0xd7953644
cmp dword [ebp - 0xcc], 0x4543beb7
jg 0x1003d858
mov dword [ebp - 0x3c], 0xfff6
mov dword [ebp - 0x55c], 0x380a3888
mov dword [ebp - 0x4b4], 0x4d41bd43
mov dword [ebp - 0x100], 0
jmp 0x1003d64c
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 2
jge 0x1003d668
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x5d8], 0xfffffffd
jmp 0x1003d63f
cmp dword [ebp - 0x3c], 0
je 0x1003d680
cmp dword [ebp - 0x20], 0
je 0x1003d680
mov dword [ebp - 0x464], 1
jmp 0x1003d687
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
sub eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jge 0x1003d6bf
mov dword [ebp - 0x24c], 1
jmp 0x1003d6c6
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x24c]
neg ecx
sub eax, ecx
cmp eax, dword [ebp - 0x20]
jle 0x1003d6e4
mov dword [ebp - 0x360], 1
jmp 0x1003d6eb
and dword [ebp - 0x360], 0
cmp dword [ebp - 0x360], 0x28f4e1c
jle 0x1003d70c
mov eax, 0xebdb
test eax, eax
je 0x1003d70c
mov dword [ebp - 0x254], 1
jmp 0x1003d713
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x254], eax
jg 0x1003d733
cmp dword [ebp - 0x1ac], 0
je 0x1003d733
mov dword [ebp - 0x25c], 1
jmp 0x1003d73a
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x464]
cmp eax, dword [ebp - 0x25c]
jne 0x1003d754
mov dword [ebp - 0x368], 1
jmp 0x1003d75b
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x368], eax
jle 0x1003d772
mov dword [ebp - 0x264], 1
jmp 0x1003d779
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x264], eax
jg 0x1003d790
mov dword [ebp - 0x3e8], 1
jmp 0x1003d797
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x134]
dec eax
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x510]
cmp eax, dword [ebp - 0x4ac]
jge 0x1003d7d6
mov dword [ebp - 0x26c], 1
jmp 0x1003d7dd
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x26c], eax
jl 0x1003d7f4
mov dword [ebp - 0x1cc], 1
jmp 0x1003d7fb
and dword [ebp - 0x1cc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1cc]
mov dword [ebp + eax - 0x5d8], ecx
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x55c], eax
mov dword [ebp - 0x3c], 0
jmp 0x1003d82a
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x27
jge 0x1003d856
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5d8]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x4b4], eax
call fcn.1003c1da
jmp 0x1003d823
jmp 0x1003d8b3
mov dword [ebp - 0x58c], 7
mov dword [ebp - 0x564], 5
mov dword [ebp - 0x4bc], 0x996fcd4d
call fcn.1003c21f
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x58c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x4bc]
push eax
push 0x460
lea eax, [ebp - 0x564]
push eax
push 1
push 1
call fcn.10035228
add esp, 0x24
jmp 0x1003d5d4
push 2
lea ecx, [ebp - 0x650]
call fcn.10009afa
mov dword [ebp - 4], 5
push 1
lea ecx, [ebp - 0x6b0]
call fcn.10009afa
mov byte [ebp - 4], 6
mov dword [ebp - 0x56c], 0
mov dword [ebp - 0x18], 0
jmp 0x1003d8f7
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1003d913
push dword [ebp - 0x18]
lea ecx, [ebp - 0x650]
call fcn.10009b6a
mov dword [eax], 0xdf99ff60
jmp 0x1003d8f0
mov dword [ebp - 0x4c4], 0x199f
cmp dword [ebp - 0x4c4], 0x855
jge 0x1003daee
push 0x1098a8f0
mov ecx, 0x10663c70
call fcn.1001bc37
call fcn.10008ec9
push eax
push 0
push 1
mov ecx, 0x10663c70
call fcn.1004090b
mov edx, 0x16017878
mov ecx, 0x10663c70
call fcn.10041a9d
push 0x10007781
lea ecx, [ebp - 0x74c]
call fcn.100097bd
mov byte [ebp - 4], 7
and dword [ebp - 0xb0], 0
jmp 0x1003d989
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
mov ecx, 0x16017878
call fcn.10009e39
cmp dword [ebp - 0xb0], eax
jae 0x1003da27
push dword [ebp - 0xb0]
mov ecx, 0x16017878
call fcn.1000b3cf
mov al, byte [eax]
movzx eax, al
push eax
lea ecx, [ebp - 0x74c]
call fcn.1000b1e8
push dword [ebp - 0xb0]
mov ecx, 0x16017878
call fcn.1000b3cf
movsx eax, byte [eax]
cmp eax, 0x2d
je 0x1003d9f0
push dword [ebp - 0xb0]
mov ecx, 0x16017878
call fcn.1000b3cf
movsx eax, byte [eax]
cmp eax, 0x20
jne 0x1003da22
lea ecx, [ebp - 0x74c]
call fcn.10009e39
mov dword [ebp - 0x5a4], eax
lea eax, [ebp - 0x5a4]
push eax
mov ecx, 0x16017868
call fcn.10009b79
push 0x10007781
lea ecx, [ebp - 0x74c]
call fcn.10040711
jmp 0x1003d97c
lea ecx, [ebp - 0x74c]
call fcn.10009e39
mov dword [ebp - 0x4cc], eax
lea eax, [ebp - 0x4cc]
push eax
mov ecx, 0x16017868
call fcn.10009b79
and dword [ebp - 0x1b4], 0
mov dword [ebp - 0x1ec], 0x3b9aca00
or dword [ebp - 0x370], 0xffffffff
mov eax, dword [ebp - 0x1b4]
cmp eax, dword [ebp - 0x1ec]
jg 0x1003dac3
mov eax, dword [ebp - 0x1b4]
add eax, dword [ebp - 0x1ec]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x108], eax
push dword [ebp - 0x108]
call fcn.1003c99b
pop ecx
movzx eax, al
test eax, eax
je 0x1003dab4
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x370], eax
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x1ec], eax
jmp 0x1003dac1
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x1b4], eax
jmp 0x1003da61
push fcn.1000d301
push dword [ebp - 0x370]
mov ecx, 0x10663bb8
call fcn.10040b71
mov ecx, eax
call fcn.100099cf
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x74c]
call fcn.100097ec
mov dword [ebp - 0x18], 0
jmp 0x1003dafe
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1003db14
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6cc], 0x667a876e
jmp 0x1003daf7
mov dword [ebp - 0x18], 0
jmp 0x1003db24
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1003db40
push dword [ebp - 0x18]
lea ecx, [ebp - 0x6b0]
call fcn.10009b6a
mov dword [eax], 0xfffffff7
jmp 0x1003db1d
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x6cc], 1
jmp 0x1003db6e
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6cc]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x6cc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x6cc], 0
jl 0x1003dcd1
push 4
lea ecx, [ebp - 0x49c]
call fcn.10009afa
mov byte [ebp - 4], 8
push 3
lea ecx, [ebp - 0x668]
call fcn.10009afa
mov byte [ebp - 4], 9
mov dword [ebp - 0x4d4], 6
mov dword [ebp - 0x594], 0xcc0f90b8
lea eax, [ebp - 0x49c]
push eax
push 1
push 0x5672
push 1
lea eax, [ebp - 0xdc]
push eax
push 0x675f
call fcn.1003776e
add esp, 0x18
mov dword [ebp - 0xdc], 0
jmp 0x1003dbf5
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 3
jge 0x1003dc17
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x668]
call fcn.10009b6a
mov dword [eax], 0xc863cc1
jmp 0x1003dbe8
push 3
lea ecx, [ebp - 0x49c]
call fcn.10009b6a
and dword [eax], 0
jmp 0x1003dc4d
push 3
lea ecx, [ebp - 0x49c]
call fcn.10009b6a
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x274]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x274]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x49c]
call fcn.10009b6a
cmp dword [eax], 1
jg 0x1003dcae
mov dword [ebp - 0x4dc], 0x96ce028f
lea eax, [ebp - 0x56c]
push eax
lea eax, [ebp - 0x4d4]
push eax
lea eax, [ebp - 0x594]
push eax
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 0x6b0]
push eax
call fcn.1003c25b
add esp, 0x20
jmp 0x1003dc29
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x668]
call fcn.10009b5c
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x49c]
call fcn.10009b5c
jmp 0x1003db53
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x6b0]
call fcn.10009b5c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x650]
call fcn.10009b5c
xor eax, eax
jmp 0x100404cb
push 1
push 0x6a2
push 0x570
push 0x4f27
push 0x2dc9
lea eax, [ebp + 8]
push eax
push 1
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0xe0]
push eax
push 0x4bb8
push 0x294b
call fcn.10037b82
add esp, 0x2c
mov dword [ebp - 0x1bc], 0xfffffffe
mov dword [ebp - 0x4e4], 0xb6ec79cf
mov dword [ebp - 0x3f0], 0xfffffff9
mov dword [ebp - 0x28c], 0xeb200688
mov dword [ebp - 0x380], 0x11015aa9
mov dword [ebp - 0x110], 0x28f4e1c
mov dword [ebp - 0x1d4], 0xab97
mov dword [ebp - 0x138], 0
jmp 0x1003dd91
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 1
jge 0x1003ddad
mov eax, dword [ebp - 0x138]
mov dword [ebp + eax*4 - 0x574], 3
jmp 0x1003dd84
or eax, 0xffffffff
je 0x1003defe
mov eax, dword [ebp - 0x1d4]
neg eax
mov dword [ebp - 0x428], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x428]
mov dword [ebp + eax - 0x574], ecx
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0x1d4]
inc ecx
mov dword [ebp - 0x1d4], ecx
test eax, eax
jne 0x1003de00
mov eax, 0x2395e2de
test eax, eax
jne 0x1003de00
and dword [ebp - 0x27c], 0
jmp 0x1003de0a
mov dword [ebp - 0x27c], 1
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x27c], eax
jle 0x1003de24
mov dword [ebp - 0x378], 1
jmp 0x1003de2b
and dword [ebp - 0x378], 0
cmp dword [ebp - 0x378], 0xfffffff6
je 0x1003de40
mov dword [ebp - 0x284], 1
jmp 0x1003de47
and dword [ebp - 0x284], 0
mov eax, 0xe66c
sub eax, dword [ebp - 0x284]
cmp eax, dword [ebp - 0x110]
jle 0x1003de66
mov dword [ebp - 0x294], 1
jmp 0x1003de6d
and dword [ebp - 0x294], 0
mov dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x4e4]
sub eax, dword [ebp - 0x380]
cmp eax, dword [ebp - 0x294]
je 0x1003deaf
mov dword [ebp - 0x44c], 1
jmp 0x1003deb6
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x1bc]
dec eax
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1bc]
cmp eax, dword [ebp - 0x44c]
je 0x1003dedd
mov dword [ebp - 0x29c], 1
jmp 0x1003dee4
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x29c], eax
jle 0x1003defe
mov dword [ebp - 0x388], 1
jmp 0x1003df05
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0xe0]
cmp dword [eax], 0x4550
je 0x1003e0e0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0x158], 0xfcf09cc2
mov dword [ebp - 0x158], 0xba1bf2b2
cmp dword [ebp - 0x158], 0xffffffff
jle 0x1003df56
mov dword [ebp - 0x2a4], 1
jmp 0x1003df5d
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x2a4], eax
jge 0x1003df89
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x7c8], eax
cmp dword [ebp - 0x158], 0
jne 0x1003df89
and dword [ebp - 0x3f8], 0
jmp 0x1003df93
mov dword [ebp - 0x3f8], 1
mov eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0x3f8]
jg 0x1003dfae
push 1
push 1
call fcn.10037d8d
pop ecx
pop ecx
jmp 0x1003e000
mov dword [ebp - 0x530], 0xffffffff
mov dword [ebp - 0xa8], 0xf
jmp 0x1003dfd1
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 9
jle 0x1003e000
mov dword [ebp - 0x4ec], 0xffffffff
call fcn.1003c475
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x4ec]
push eax
call fcn.10029ec5
pop ecx
pop ecx
jmp 0x1003dfc4
mov dword [ebp - 0xbc], 0xffffffff
mov dword [ebp - 0x40], 0
jmp 0x1003e01a
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x1003e030
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x7fc], 0xf75d
jmp 0x1003e013
mov dword [ebp - 0x40], 0
jmp 0x1003e040
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x1003e056
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x118], 0
jmp 0x1003e039
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x118], 0
jmp 0x1003e084
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x118]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x118], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x118], 2
jg 0x1003e0a4
mov byte [ebp - 0x61], 0
lea eax, [ebp - 0x61]
push eax
call fcn.1003c5a6
pop ecx
jmp 0x1003e069
mov dword [ebp - 0xbc], 0
jmp 0x1003e0bd
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jge 0x1003e0d9
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x7fc], 0xfff8
jmp 0x1003e0b0
xor eax, eax
jmp 0x100404cb
push 0x3ff9
lea eax, [ebp - 0xe0]
push eax
push 0x6370
push 1
push 1
push 1
lea eax, [ebp - 0x13c]
push eax
call fcn.10038061
add esp, 0x1c
push 1
lea ecx, [ebp - 0x65c]
call fcn.10009afa
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x140], 0
jmp 0x1003e133
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 1
jge 0x1003e155
push dword [ebp - 0x140]
lea ecx, [ebp - 0x65c]
call fcn.10009b6a
mov dword [eax], 0xdde0bcd8
jmp 0x1003e126
push 0x786b
push 1
lea eax, [ebp - 0x65c]
push eax
push 0x3b8b
push 1
push 0x1938
call fcn.10038196
add esp, 0x18
mov byte [ebp - 0x97], 0
push 0x747a
push 0x67f0
push 0
push 0x21bb
lea eax, [ebp - 0x97]
push eax
push 1
push 0x8ba
push 0x67f1
push 0x1095
call fcn.1003b443
add esp, 0x24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x65c]
call fcn.10009b5c
cmp dword [ebp - 0x13c], 0
jne 0x1003e2e2
push 2
lea ecx, [ebp - 0x6a4]
call fcn.10009afa
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xc0], 0x19d29be1
mov dword [ebp - 0x538], 0x5493e623
lea eax, [ebp - 0x6a4]
push eax
lea eax, [ebp - 0x710]
push eax
call fcn.1003c5d4
pop ecx
pop ecx
mov byte [ebp - 0x69], 0
lea eax, [ebp - 0x69]
push eax
call fcn.1003c61c
pop ecx
mov dword [ebp - 0xc0], 0
jmp 0x1003e22f
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jg 0x1003e2cc
mov dword [ebp - 0x540], 0x4e6d4f28
mov dword [ebp - 0x4f4], 9
mov dword [ebp - 0xc8], 0xfffffff8
lea eax, [ebp - 0x538]
push eax
lea eax, [ebp - 0x4f4]
push eax
lea eax, [ebp - 0x6a4]
push eax
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x540]
push eax
call fcn.1003c645
add esp, 0x18
mov dword [ebp - 0xc8], 1
jmp 0x1003e2a5
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jl 0x1003e2c7
mov dword [ebp - 0x4fc], 0x13f5
lea eax, [ebp - 0x4fc]
push eax
call fcn.1003c6b3
pop ecx
jmp 0x1003e298
jmp 0x1003e222
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6a4]
call fcn.10009b5c
xor eax, eax
jmp 0x100404cb
push 1
lea ecx, [ebp - 0x6bc]
call fcn.10009afa
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xd0], 0x471dfd94
mov dword [ebp - 0x28], 0
jmp 0x1003e310
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1003e326
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x850], 0xa8eac8b1
jmp 0x1003e309
push 0x3bf2
push 1
lea eax, [ebp - 0x6bc]
push eax
push 1
push 0xcb
push 1
lea eax, [ebp - 0x28]
push eax
push 0x2d01
call fcn.10038612
add esp, 0x20
mov dword [ebp - 0x28], 0
jmp 0x1003e35e
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1003e374
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x844], 0x4c90d297
jmp 0x1003e357
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x6bc]
push eax
call fcn.1003c6ca
pop ecx
pop ecx
mov dword [ebp - 0xd0], 0
jmp 0x1003e3a2
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jg 0x1003e3e0
mov dword [ebp - 0x120], 0x3735b263
mov dword [ebp - 0x120], 2
jmp 0x1003e3ce
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jl 0x1003e3de
call fcn.1003c754
jmp 0x1003e3c1
jmp 0x1003e395
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6bc]
call fcn.10009b5c
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x734]
push eax
lea eax, [ebp - 0x188]
push eax
push 1
lea eax, [ebp - 0x30]
push eax
push 1
push 0x81a
lea eax, [ebp - 0xe0]
push eax
call fcn.10038c78
add esp, 0x20
mov dword [ebp - 0xa0], 0xffffffff
mov dword [ebp - 0x2c4], 0xffffffff
mov dword [ebp - 0x190], 0xae28de6
mov dword [ebp - 0x548], 0xd52a42bb
mov dword [ebp - 0x504], 0
mov dword [ebp - 0x38], 0
jmp 0x1003e462
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1003e478
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x3a0], 0x82ca9683
jmp 0x1003e45b
mov dword [ebp - 0x38], 0
jmp 0x1003e488
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x1003e49e
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x680], 0xed9
jmp 0x1003e481
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xa0], eax
jl 0x1003e4b8
mov dword [ebp - 0x430], 1
jmp 0x1003e4bf
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x7b0], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x2ac], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2ac]
mov dword [ebp + eax - 0x3a0], ecx
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0xffffffff
jl 0x1003e50b
mov dword [ebp - 0x390], 1
jmp 0x1003e512
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x390]
add eax, 5
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x680]
jg 0x1003e536
mov dword [ebp - 0x2b4], 1
jmp 0x1003e53d
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x2b4]
jge 0x1003e557
mov dword [ebp - 0x2bc], 1
jmp 0x1003e55e
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x430]
cmp eax, dword [ebp - 0x2bc]
jne 0x1003e581
mov eax, 0xe136dc99
test eax, eax
je 0x1003e581
mov dword [ebp - 0x398], 1
jmp 0x1003e588
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0xa0]
sub eax, dword [ebp - 0x398]
cmp eax, dword [ebp - 0xa0]
jg 0x1003e5a8
mov dword [ebp - 0x400], 1
jmp 0x1003e5af
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x2c4]
imul eax, dword [ebp - 0x400]
test eax, eax
je 0x1003e5c9
cmp dword [ebp - 0x190], 0
jne 0x1003e5db
cmp dword [ebp - 0x548], 0
jne 0x1003e5db
and dword [ebp - 0x2cc], 0
jmp 0x1003e5e5
mov dword [ebp - 0x2cc], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2cc]
sub ecx, dword [ebp + eax - 0x680]
jne 0x1003e607
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x680]
mov dword [ebp - 0x504], eax
push dword [ebp - 0xe0]
push dword [ebp - 0x30]
push dword [ebp + 8]
push 1
push 0
push 0x143
call fcn.1002c70c
add esp, 0x18
mov dword [ebp - 0x24], 0xc755
mov dword [ebp - 0xb8], 0xffffffff
mov dword [ebp - 0x50c], 0xffff
mov dword [ebp - 0x570], 1
mov dword [ebp - 0x75c], 0
push 1
lea ecx, [ebp - 0x768]
call fcn.10009afa
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x2c], 0
jmp 0x1003e68a
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1003e6a0
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x488], 0
jmp 0x1003e683
mov dword [ebp - 0x2c], 0
jmp 0x1003e6b0
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1003e6c6
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x814], 1
jmp 0x1003e6a9
lea eax, [ebp - 0x768]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1003c78e
pop ecx
pop ecx
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
je 0x1003e6ec
mov dword [ebp - 0x2d4], 1
jmp 0x1003e6f3
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x2d4]
je 0x1003e746
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x24], eax
jle 0x1003e718
cmp dword [ebp - 0x24], 0
jne 0x1003e718
and dword [ebp - 0x45c], 0
jmp 0x1003e722
mov dword [ebp - 0x45c], 1
imul eax, dword [ebp - 0x45c], 0x505b
cmp dword [ebp - 0x24], eax
jne 0x1003e746
mov eax, 0xbffb
test eax, eax
je 0x1003e746
mov dword [ebp - 0x2dc], 1
jmp 0x1003e74d
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x2dc], eax
jne 0x1003e767
mov dword [ebp - 0x198], 1
jmp 0x1003e76e
and dword [ebp - 0x198], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x198]
mov dword [ebp + eax - 0x488], ecx
cmp dword [ebp - 0x198], 0
je 0x1003e8ca
mov dword [ebp - 0x550], 0xe263
mov dword [ebp - 0x1a0], 0xffffffff
mov dword [ebp - 0x2e4], 0x4489
mov dword [ebp - 0x558], 0xc5c3c3ae
mov eax, dword [ebp - 0x1a0]
sub eax, 0x456574b6
jne 0x1003e80c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x488], 0x3bbb66ef
jge 0x1003e7e2
mov dword [ebp - 0x3a8], 1
jmp 0x1003e7e9
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0xb8]
imul eax, dword [ebp - 0x2e4]
test eax, eax
jne 0x1003e80c
cmp dword [ebp - 0x24], 0
je 0x1003e821
cmp dword [ebp - 0xb8], 0
je 0x1003e821
mov dword [ebp - 0x408], 1
jmp 0x1003e828
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0x408], eax
jle 0x1003e842
mov dword [ebp - 0x2ec], 1
jmp 0x1003e849
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x550]
sub eax, dword [ebp - 0x2ec]
cmp eax, dword [ebp - 0x1a0]
je 0x1003e869
mov dword [ebp - 0x3b0], 1
jmp 0x1003e870
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x50c]
cmp dword [ebp - 0x3b0], eax
jg 0x1003e88a
mov dword [ebp - 0x2f4], 1
jmp 0x1003e891
and dword [ebp - 0x2f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x488]
cmp dword [ebp - 0x2f4], eax
jle 0x1003e8b2
mov dword [ebp - 0x438], 1
jmp 0x1003e8b9
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x558], eax
jmp 0x1003ec05
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x7e4], 0xb742d63d
mov dword [ebp - 0x2fc], 0xfffffffe
push 2
lea ecx, [ebp - 0x758]
call fcn.10009afa
mov byte [ebp - 4], 0xe
push 1
lea ecx, [ebp - 0x698]
call fcn.10009afa
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x1a8], 1
mov dword [ebp - 0x560], 0x20822c3
lea eax, [ebp - 0x758]
push eax
lea eax, [ebp - 0xd8]
push eax
call fcn.1003c7d6
pop ecx
pop ecx
mov dword [ebp - 0xd8], 0
jmp 0x1003e94c
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 1
jge 0x1003e96e
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x698]
call fcn.10009b6a
mov dword [eax], 0x277f
jmp 0x1003e93f
mov dword [ebp - 0x24], 0
jmp 0x1003e97e
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x21
je 0x1003ebd4
mov dword [ebp - 0x514], 0xffffffff
mov dword [ebp - 0x524], 6
mov dword [ebp - 0x76c], 0
mov dword [ebp - 0x3c0], 9
mov dword [ebp - 0x6dc], 1
mov dword [ebp - 0x6d8], 1
mov dword [ebp - 0x6d4], 1
mov dword [ebp - 0x6d0], 1
mov dword [ebp - 0x150], 0
jmp 0x1003e9f1
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jge 0x1003ea0d
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x808], 0xffffffff
jmp 0x1003e9e4
cmp dword [ebp - 0x128], 0xeeb
jg 0x1003ea25
mov dword [ebp - 0x314], 1
jmp 0x1003ea2c
and dword [ebp - 0x314], 0
mov dword [ebp - 0x514], 0xffffffff
mov eax, dword [ebp - 0x560]
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x51c], eax
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x51c]
cmp eax, dword [ebp - 0x568]
jl 0x1003ea81
mov dword [ebp - 0x304], 1
jmp 0x1003ea88
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x3b8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3b8]
mov dword [ebp + eax - 0x488], ecx
mov eax, dword [ebp - 0x3b8]
cmp eax, dword [ebp - 0x304]
jle 0x1003eac1
mov dword [ebp - 0x410], 1
jmp 0x1003eac8
and dword [ebp - 0x410], 0
cmp dword [ebp - 0x410], 0x5052
je 0x1003eae0
mov dword [ebp - 0x30c], 1
jmp 0x1003eae7
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebp - 0x524]
cmp dword [ebp - 0x3c0], eax
jl 0x1003eb0e
mov dword [ebp - 0x454], 1
jmp 0x1003eb15
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x314]
sub eax, dword [ebp - 0x454]
jne 0x1003eb2f
mov dword [ebp - 0x31c], 1
jmp 0x1003eb36
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x128], eax
mov esi, dword [ebp - 0x128]
push 0
lea ecx, [ebp - 0x698]
call fcn.10009b6a
cmp esi, dword [eax]
jg 0x1003eb65
mov dword [ebp - 0x3c8], 1
jmp 0x1003eb6c
and dword [ebp - 0x3c8], 0
cmp dword [ebp - 0x3c8], 0
jne 0x1003eb81
mov dword [ebp - 0x324], 1
jmp 0x1003eb88
and dword [ebp - 0x324], 0
cmp dword [ebp - 0x324], 0x4807
jne 0x1003ebac
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x6dc], 0
jne 0x1003ebac
and dword [ebp - 0x418], 0
jmp 0x1003ebb6
mov dword [ebp - 0x418], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x808]
add eax, dword [ebp - 0x418]
mov dword [ebp - 0x570], eax
jmp 0x1003e977
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb8]
mov dword [ebp + eax - 0x814], ecx
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x698]
call fcn.10009b5c
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x758]
call fcn.10009b5c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x768]
call fcn.10009b5c
lea eax, [ebp - 0xe0]
push eax
push 1
push 0x89e
push 0x1c3b
push 1
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.10039182
add esp, 0x1c
mov dword [ebp - 0x10], 5
mov dword [ebp - 0xf8], 2
mov dword [ebp - 0x1c0], 0xe8bfa085
mov dword [ebp - 0x1b0], 3
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x5fc], 0xddcdedc2
mov dword [ebp - 0x5f8], 0xddcdedc2
mov dword [ebp - 0x5f4], 0xddcdedc2
mov dword [ebp - 0x5f0], 0xddcdedc2
lea ecx, [ebp - 0x1dd]
call fcn.10009bd3
push eax
lea eax, [ebp - 0x5ec]
push eax
lea eax, [ebp - 0x5fc]
push eax
lea ecx, [ebp - 0x824]
call fcn.10009bd6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x644]
call fcn.10009b36
mov dword [ebp - 4], 0x10
mov dword [ebp - 0xa4], 1
mov dword [ebp - 0x580], 0xaeff8ee8
mov dword [ebp - 0x130], 0
jmp 0x1003ecff
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 4
jge 0x1003ed1b
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x168], 0xdc85
jmp 0x1003ecf2
mov dword [ebp - 0x10], 0
jmp 0x1003ed2b
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x1003f3e9
mov dword [ebp - 0x80], 0xc0ce695e
mov dword [ebp - 0x104], 0x6de21e5
mov dword [ebp - 0xfc], 0xffffffff
mov dword [ebp - 0x1b8], 0xcbeb03c7
mov byte [ebp - 0x96], 0
movzx eax, byte [ebp - 0x96]
test eax, eax
je 0x1003ed82
push 1
push 0
push 0x13f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x168]
mov dword [ebp - 0x7b8], eax
mov eax, dword [ebp - 0x10]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x168]
cmp dword [ebp + eax*4 - 0x168], ecx
jg 0x1003edb7
mov dword [ebp - 0x1fc], 1
jmp 0x1003edbe
and dword [ebp - 0x1fc], 0
cmp dword [ebp - 0x1fc], 0xb56
jl 0x1003edd6
mov dword [ebp - 0x200], 1
jmp 0x1003eddd
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0xf8]
add eax, dword [ebp - 0x200]
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x168]
cmp dword [ebp - 0x1c0], eax
jg 0x1003ee0d
mov dword [ebp - 0x1f8], 1
jmp 0x1003ee14
and dword [ebp - 0x1f8], 0
cmp dword [ebp - 0x1f8], 0xffffffff
jle 0x1003ee2f
cmp dword [ebp - 0xf8], 0
jne 0x1003ee2f
and dword [ebp - 0x210], 0
jmp 0x1003ee39
mov dword [ebp - 0x210], 1
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x6e0], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x168]
mov dword [ebp - 0x790], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x168], 0x617092ff
jl 0x1003ee83
mov dword [ebp - 0x218], 1
jmp 0x1003ee8a
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x168]
add eax, dword [ebp - 0x218]
cmp eax, 0xfffffff7
je 0x1003eeb2
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x1003eeb2
mov dword [ebp - 0x220], 1
jmp 0x1003eeb9
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x168]
cmp dword [ebp - 0x220], eax
jne 0x1003eee0
mov eax, 0xae0512ed
test eax, eax
je 0x1003eee0
mov dword [ebp - 0x52c], 1
jmp 0x1003eee7
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x168]
mov dword [ebp - 0x78c], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x168]
cmp dword [ebp - 0x80], eax
jl 0x1003ef15
mov dword [ebp - 0x228], 1
jmp 0x1003ef1c
and dword [ebp - 0x228], 0
cmp dword [ebp - 0x228], 0xb2de
jl 0x1003ef40
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x168], 0
jne 0x1003ef40
and dword [ebp - 0x230], 0
jmp 0x1003ef4a
mov dword [ebp - 0x230], 1
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0xfc], eax
jge 0x1003ef70
mov dword [ebp - 0x238], 1
jmp 0x1003ef77
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x238]
lea eax, [ecx + eax - 0x83b1]
cmp eax, 0xea59f7c1
ja 0x1003ef9a
mov dword [ebp - 0x240], 1
jmp 0x1003efa1
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x10]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x168]
add ecx, dword [ebp - 0x240]
sub eax, ecx
cmp eax, 7
jne 0x1003efc9
mov dword [ebp - 0x248], 1
jmp 0x1003efd0
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0x10]
add eax, dword [ebp + ecx*4 - 0x168]
cmp eax, 1
jl 0x1003f003
cmp dword [ebp - 0xfc], 0
jne 0x1003f003
and dword [ebp - 0x250], 0
jmp 0x1003f00d
mov dword [ebp - 0x250], 1
cmp dword [ebp - 0x250], 0
je 0x1003f022
mov dword [ebp - 0x258], 1
jmp 0x1003f029
and dword [ebp - 0x258], 0
cmp dword [ebp - 0x258], 0xfffffffe
jge 0x1003f03e
mov dword [ebp - 0x260], 1
jmp 0x1003f045
and dword [ebp - 0x260], 0
cmp dword [ebp - 0x260], 0
jne 0x1003f05a
mov dword [ebp - 0x268], 1
jmp 0x1003f061
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x1003f08b
cmp dword [ebp - 0x1b0], 0
je 0x1003f08b
mov dword [ebp - 0x270], 1
jmp 0x1003f092
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x270], eax
jl 0x1003f0a9
mov dword [ebp - 0x1f4], 1
jmp 0x1003f0b0
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x1f4], eax
jl 0x1003f0ca
mov dword [ebp - 0x280], 1
jmp 0x1003f0d1
and dword [ebp - 0x280], 0
push 0
lea ecx, [ebp - 0x644]
call fcn.10009b6a
mov ecx, dword [ebp - 0x280]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x168]
mov dword [ebp - 0x794], eax
mov dword [ebp - 0xa4], 0x42fc
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x168]
mov dword [ebp - 0x79c], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x798], eax
mov eax, 0xbecd
test eax, eax
je 0x1003f13d
cmp dword [ebp - 0xfc], 0
je 0x1003f13d
mov dword [ebp - 0x288], 1
jmp 0x1003f144
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x288]
sub eax, 0x8b32
push 4
pop ecx
imul ecx, ecx, 3
imul eax, dword [ebp + ecx - 0x168]
test eax, eax
jne 0x1003f170
cmp dword [ebp - 0x80], 0
jne 0x1003f170
and dword [ebp - 0x290], 0
jmp 0x1003f17a
mov dword [ebp - 0x290], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x168]
cmp dword [ebp - 0x290], eax
je 0x1003f198
mov dword [ebp - 0x578], 1
jmp 0x1003f19f
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x168]
mov dword [ebp - 0x7c0], eax
mov eax, dword [ebp - 0x80]
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x1b8]
jle 0x1003f1c9
mov dword [ebp - 0x298], 1
jmp 0x1003f1d0
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x1b8]
add eax, dword [ebp - 0x298]
je 0x1003f1f8
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.10029ec5
pop ecx
pop ecx
jmp 0x1003f3e4
mov dword [ebp - 0x1c8], 0xffffffff
mov dword [ebp - 0x2c8], 0xffffffff
mov dword [ebp - 0xa4], 3
jmp 0x1003f225
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
jl 0x1003f3e4
mov dword [ebp - 0x2a8], 0x2336
push 2
lea ecx, [ebp - 0x644]
call fcn.10009b6a
mov dword [eax], 0x56b0c4f5
cmp dword [ebp - 0x2a8], 0
jne 0x1003f2c9
cmp dword [ebp - 0x80], 0
jne 0x1003f274
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x168], 0
jne 0x1003f274
and dword [ebp - 0x2a0], 0
jmp 0x1003f27e
mov dword [ebp - 0x2a0], 1
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0x2a0], eax
jge 0x1003f298
mov dword [ebp - 0x2b0], 1
jmp 0x1003f29f
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x2b0], eax
jg 0x1003f2b9
mov dword [ebp - 0x2b8], 1
jmp 0x1003f2c0
and dword [ebp - 0x2b8], 0
cmp dword [ebp - 0x2b8], 0
je 0x1003f2d9
xor eax, eax
je 0x1003f2d9
mov dword [ebp - 0x2c0], 1
jmp 0x1003f2e0
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x1c8]
imul eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x2c8], eax
mov eax, 0x4dbc
test eax, eax
je 0x1003f3b0
mov eax, dword [ebp - 0x580]
mov dword [ebp - 0x6e4], eax
cmp dword [ebp - 0x10c], 0x52544ee7
je 0x1003f324
mov dword [ebp - 0x2d0], 1
jmp 0x1003f32b
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x2c8]
add eax, dword [ebp - 0x2d0]
cmp eax, dword [ebp - 0x80]
jle 0x1003f348
mov dword [ebp - 0x2d8], 1
jmp 0x1003f34f
and dword [ebp - 0x2d8], 0
cmp dword [ebp - 0x2d8], 0x8beb
jne 0x1003f367
mov dword [ebp - 0x2e0], 1
jmp 0x1003f36e
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x1c0]
cmp eax, dword [ebp - 0x2e0]
jne 0x1003f388
mov dword [ebp - 0x2e8], 1
jmp 0x1003f38f
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x104]
imul eax, dword [ebp - 0x2e8]
cmp eax, dword [ebp - 0x1c8]
jne 0x1003f3b0
mov dword [ebp - 0x2f0], 1
jmp 0x1003f3b7
and dword [ebp - 0x2f0], 0
cmp dword [ebp - 0x2f0], 0xffffffff
je 0x1003f3cc
mov dword [ebp - 0x2f8], 1
jmp 0x1003f3d3
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x10c], eax
jmp 0x1003f218
jmp 0x1003ed24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x644]
call fcn.10009b5c
cmp dword [ebp - 0x34c], 0
je 0x1003f80e
mov dword [ebp - 0x338], 0xffffffff
mov dword [ebp - 0x334], 0xffffffff
mov dword [ebp - 0x330], 0xffffffff
mov dword [ebp - 0x32c], 0xffffffff
mov dword [ebp - 0x54], 0xd4e7
mov dword [ebp - 0x344], 0x7e8f5349
mov dword [ebp - 0x59c], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x338]
mov dword [ebp - 0x300], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x300]
mov dword [ebp + eax - 0x338], ecx
cmp dword [ebp - 0x300], 0
je 0x1003f5c7
mov dword [ebp - 0x53c], 0xddd3f467
mov dword [ebp - 0x6ec], 1
mov dword [ebp - 0x6f4], 0x7b04800f
mov dword [ebp - 0x6fc], 0xffffffff
mov dword [ebp - 0x114], 1
push 3
lea ecx, [ebp - 0x778]
call fcn.10009afa
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x7a4], 0x8e486aeb
mov dword [ebp - 0x5a8], 0xfc3e
lea eax, [ebp - 0x7ac]
push eax
push 1
lea eax, [ebp - 0x778]
push eax
push 1
push 0x7ab1
push 1
call fcn.10039249
add esp, 0x18
push 0x1f78
push 1
push 0x14bb
push 0x3f51
push 0x38a
push 0x1a3f
push 0x69aa
push 0x7c69
push 0x319
push 0x7108
push 1
push 0x6b66
push 0x1a3d
lea eax, [ebp - 0x5a8]
push eax
push 0x1362
push 0x6a9
call fcn.10039360
add esp, 0x40
mov dword [ebp - 0x114], 0
jmp 0x1003f562
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 8
jne 0x1003f5b3
mov byte [ebp - 0x59], 0
push 1
push 0x74f8
push 0x4328
lea eax, [ebp - 0x59]
push eax
push 1
push 0xc54
push 0x7055
push 1
push 0x52b4
push 0x7891
push 0x3ff1
call fcn.1003984b
add esp, 0x2c
lea eax, [ebp - 0x53c]
push eax
call fcn.1003c81e
pop ecx
jmp 0x1003f555
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x778]
call fcn.10009b5c
jmp 0x1003f7f4
mov dword [ebp - 0x124], 0xee49
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x1003f5fd
push 0x2569
push 0x25df
push 0xac
push 0x20e0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov dword [ebp - 0x54], 3
jmp 0x1003f60d
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x1003f7f4
mov dword [ebp - 0x318], 0xff9752ee
mov dword [ebp - 0x11c], 0
jmp 0x1003f63a
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 1
jge 0x1003f656
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x1d0], 0
jmp 0x1003f62d
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x338]
mov dword [ebp - 0x7b4], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x1d0]
add ecx, dword [ebp - 0x124]
cmp dword [ebp + eax - 0x338], ecx
jne 0x1003f694
mov dword [ebp - 0x308], 1
jmp 0x1003f69b
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x338]
cmp eax, dword [ebp - 0x308]
jge 0x1003f6b9
mov dword [ebp - 0x57c], 1
jmp 0x1003f6c0
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp + eax*4 - 0x338], 0
je 0x1003f6e9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1d0], 0
je 0x1003f6e9
mov dword [ebp - 0x310], 1
jmp 0x1003f6f0
and dword [ebp - 0x310], 0
cmp dword [ebp - 0x310], 0x81cdffa8
jae 0x1003f708
mov dword [ebp - 0x1d8], 1
jmp 0x1003f70f
and dword [ebp - 0x1d8], 0
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0x338], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d0]
cmp dword [ebp - 0x1d8], eax
je 0x1003f740
mov dword [ebp - 0x544], 1
jmp 0x1003f747
and dword [ebp - 0x544], 0
mov dword [ebp - 0x318], 0x6e12cdfd
mov eax, dword [ebp - 0x318]
sub eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x124]
jg 0x1003f771
mov dword [ebp - 0x320], 1
jmp 0x1003f778
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x320], eax
jl 0x1003f792
mov dword [ebp - 0x328], 1
jmp 0x1003f799
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x328]
neg eax
je 0x1003f7bf
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x338], 0
je 0x1003f7bf
mov dword [ebp - 0x33c], 1
jmp 0x1003f7c6
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x59c], eax
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x1003f7ef
call fcn.1003c85c
jmp 0x1003f606
push dword [ebp - 0x34c]
push dword [ebp - 0x30]
push 1
push 0x29bd
push 1
call fcn.10027689
add esp, 0x14
push dword [ebp - 0x30]
call fcn.1002a0eb
pop ecx
test eax, eax
jne 0x1003f827
call fcn.1003c88c
xor eax, eax
jmp 0x100404cb
push 2
lea ecx, [ebp - 0x788]
call fcn.10009afa
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x12c], 0x56915a13
mov dword [ebp - 0x54c], 0xf47a6de
mov dword [ebp - 0xec], 0
jmp 0x1003f868
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 2
jge 0x1003f887
push dword [ebp - 0xec]
lea ecx, [ebp - 0x788]
call fcn.10009b6a
and dword [eax], 0
jmp 0x1003f85b
mov dword [ebp - 0x12c], 0
jmp 0x1003f8a0
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 1
jg 0x1003f8ca
push 1
push 1
lea eax, [ebp - 0x54c]
push eax
push 0x5c30
push 0x1946
push 1
call fcn.10039d88
add esp, 0x18
jmp 0x1003f893
push 0x612d
push 0x16c2
push 1
push 0x3f7b
push 0x5b1e
push 1
push 1
push 0x6fa5
push 0x4c8b
push 0x2d5c
call fcn.1003a1fd
add esp, 0x28
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x788]
call fcn.10009b5c
push 1
lea eax, [ebp - 0x30]
push eax
push 1
call fcn.1003a522
add esp, 0xc
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1004018a
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x13c]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x3d4], ecx
mov dword [ebp - 0xe8], 3
mov dword [ebp - 0x5ac], 0xfffffffb
mov dword [ebp - 0x4a4], 0x5cf1c946
mov dword [ebp - 0x7bc], 0xffffffff
mov dword [ebp - 0xe8], 0
jmp 0x1003f97e
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0xffffffe6
jne 0x1003fa27
mov dword [ebp - 0x584], 1
mov dword [ebp - 0x554], 0xaaf0a9b2
push 2
lea ecx, [ebp - 0x674]
call fcn.10009afa
mov dword [ebp - 4], 0x13
lea eax, [ebp - 0x674]
push eax
push 0xe6a
push 1
lea eax, [ebp - 0x7c4]
push eax
push 1
push 0x911
push 0x261
push 0x3a62
call fcn.1003a6ae
add esp, 0x20
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x584]
push eax
lea eax, [ebp - 0x554]
push eax
lea eax, [ebp - 0x5ac]
push eax
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.10029b31
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x674]
call fcn.10009b5c
jmp 0x1003f971
cmp dword [ebp - 0x3d4], 0
jne 0x1003fa37
xor eax, eax
jmp 0x100404cb
push 4
lea ecx, [ebp - 0x174]
call fcn.10009afa
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x38c], 0xfffffff6
mov dword [ebp - 0x1c], 0
jmp 0x1003fa65
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1003fa7e
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x174]
call fcn.10009b6a
or dword [eax], 0xffffffff
jmp 0x1003fa5e
mov dword [ebp - 0x1c], 0
jmp 0x1003fa8e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1003faa4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x480], 0
jmp 0x1003fa87
mov dword [ebp - 0x1c], 0
jmp 0x1003fab4
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1003faca
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7d8], 0
jmp 0x1003faad
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x480], 3
jmp 0x1003faf5
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x480]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x480], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x480], 0
jl 0x1003fed7
mov dword [ebp - 0x88], 0x25260
mov dword [ebp - 0x4a8], 0
mov dword [ebp - 0x48], 0
jmp 0x1003fb2c
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x1003fb42
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x3cc], 0x694486ca
jmp 0x1003fb25
mov dword [ebp - 0x48], 0
jmp 0x1003fb52
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x1003fb68
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x834], 1
jmp 0x1003fb4b
mov dword [ebp - 0x88], 3
jmp 0x1003fb81
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jl 0x1003fd36
mov dword [ebp - 0x58], 0xffffffff
mov dword [ebp - 0x36c], 0xfbebf0a0
mov dword [ebp - 0x58], 3
jmp 0x1003fbaf
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x1003fd31
mov dword [ebp - 0x4b0], 9
push dword [ebp - 0x58]
lea ecx, [ebp - 0x174]
call fcn.10009b6a
push 2
lea ecx, [ebp - 0x174]
call fcn.10009b6a
cmp dword [eax], 0
jne 0x1003fc3f
cmp dword [ebp - 0x88], 0x2d564c7b
jne 0x1003fbfb
mov dword [ebp - 0x354], 1
jmp 0x1003fc02
and dword [ebp - 0x354], 0
push dword [ebp - 0x58]
lea ecx, [ebp - 0x174]
call fcn.10009b6a
mov ecx, dword [ebp - 0x354]
cmp ecx, dword [eax]
jg 0x1003fc26
mov dword [ebp - 0x35c], 1
jmp 0x1003fc2d
and dword [ebp - 0x35c], 0
cmp dword [ebp - 0x35c], 4
jl 0x1003fc3f
and dword [ebp - 0x364], 0
jmp 0x1003fc49
mov dword [ebp - 0x364], 1
cmp dword [ebp - 0x364], 0x5ea6
jl 0x1003fd0f
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0
jne 0x1003fc9c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7d8]
mov dword [ebp - 0x7e0], eax
push 3
lea ecx, [ebp - 0x174]
call fcn.10009b6a
cmp dword [eax], 0
jne 0x1003fc9c
and dword [ebp - 0x374], 0
jmp 0x1003fca6
mov dword [ebp - 0x374], 1
imul eax, dword [ebp - 0x374], 0xcbb2
cmp eax, dword [ebp - 0x58]
jl 0x1003fcc1
mov dword [ebp - 0x37c], 1
jmp 0x1003fcc8
and dword [ebp - 0x37c], 0
push dword [ebp - 0x58]
lea ecx, [ebp - 0x174]
call fcn.10009b6a
mov ecx, dword [ebp - 0x38c]
imul ecx, dword [eax]
mov eax, dword [ebp - 0x37c]
sub eax, 0x28c20d18
cmp ecx, eax
jne 0x1003fcfa
mov dword [ebp - 0x384], 1
jmp 0x1003fd01
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x4b0], eax
jmp 0x1003fd2c
mov dword [ebp - 0x4b8], 0x783518f4
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4b8]
mov dword [ebp + eax - 0x3cc], ecx
jmp 0x1003fba8
jmp 0x1003fb74
mov dword [ebp - 0x38c], 0xfffffff7
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x480]
lea ecx, [ebp - 0x174]
call fcn.10009b6a
cmp dword [eax], 0
je 0x1003fe90
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x480]
lea ecx, [ebp - 0x174]
call fcn.10009b6a
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
push 3
lea ecx, [ebp - 0x174]
call fcn.10009b6a
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x480]
cmp dword [eax], ecx
jne 0x1003fdb0
mov dword [ebp - 0x394], 1
jmp 0x1003fdb7
and dword [ebp - 0x394], 0
cmp dword [ebp - 0x394], 0xcb6e
je 0x1003fdcf
mov dword [ebp - 0x39c], 1
jmp 0x1003fdd6
and dword [ebp - 0x39c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7d8]
cmp dword [ebp - 0x39c], eax
je 0x1003fdf6
mov dword [ebp - 0x3a4], 1
jmp 0x1003fdfd
and dword [ebp - 0x3a4], 0
cmp dword [ebp - 0x3a4], 2
jb 0x1003fe12
mov dword [ebp - 0x3ac], 1
jmp 0x1003fe19
and dword [ebp - 0x3ac], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3ac]
sub ecx, dword [ebp + eax - 0x7d8]
cmp ecx, 0x46c64e71
jg 0x1003fe40
mov dword [ebp - 0x3b4], 1
jmp 0x1003fe47
and dword [ebp - 0x3b4], 0
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x480]
lea ecx, [ebp - 0x174]
call fcn.10009b6a
mov eax, dword [eax]
cmp eax, dword [ebp - 0x3b4]
jge 0x1003fe90
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x480]
lea ecx, [ebp - 0x174]
call fcn.10009b6a
cmp dword [eax], 0
je 0x1003fe90
mov dword [ebp - 0x3bc], 1
jmp 0x1003fe97
and dword [ebp - 0x3bc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x834]
cmp dword [ebp - 0x3bc], eax
jle 0x1003feb8
mov dword [ebp - 0x3c4], 1
jmp 0x1003febf
and dword [ebp - 0x3c4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3c4]
mov dword [ebp + eax - 0x3cc], ecx
jmp 0x1003fadc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x174]
call fcn.10009b5c
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x3d4]
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x14c], 0x7e2799ac
mov dword [ebp - 0x7e8], 0xe0cd1b7e
mov dword [ebp - 0x7f0], 0x374489b4
mov dword [ebp - 0x7dc], 0xffffffff
mov dword [ebp - 0x144], 0
jmp 0x1003ff3c
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 2
jge 0x1003ff58
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x5d0], 0xa162
jmp 0x1003ff2f
mov dword [ebp - 0x14c], 0
jmp 0x1003ff71
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0x1a
je 0x10040170
mov dword [ebp - 0xac], 0x8b72fd49
mov dword [ebp - 0x6e8], 0xfffffffc
mov byte [ebp - 0x94], 0
lea eax, [ebp - 0x94]
push eax
call fcn.1003c8cb
pop ecx
mov dword [ebp - 0xac], 6
jmp 0x1003ffbf
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xf
jge 0x1004016b
mov dword [ebp - 0x90], 9
mov dword [ebp - 0x154], 0
jmp 0x1003ffef
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 2
jge 0x1004000b
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x724], 0x92c6eed1
jmp 0x1003ffe2
mov byte [ebp - 0x79], 0
lea eax, [ebp - 0x79]
push eax
call fcn.1003c90f
pop ecx
mov dword [ebp - 0x90], 0
jmp 0x10040032
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jg 0x10040166
mov dword [ebp - 0xb4], 1
mov dword [ebp - 0x3e4], 0x678e045
call fcn.1003c938
mov eax, dword [ebp - 0x90]
cmp dword [ebp + eax*4 - 0x5d0], 0
jne 0x10040107
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x724], 0
je 0x1004008d
xor eax, eax
inc eax
je 0x1004008d
mov dword [ebp - 0x3dc], 1
jmp 0x10040094
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x3e4]
cmp dword [ebp - 0xb4], eax
jg 0x100400c6
mov dword [ebp - 0x3ec], 1
jmp 0x100400cd
and dword [ebp - 0x3ec], 0
cmp dword [ebp - 0x3ec], 0xfffffff8
jle 0x100400e2
mov dword [ebp - 0x3f4], 1
jmp 0x100400e9
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x3f4], eax
jge 0x100400fe
cmp dword [ebp - 0x90], 0
mov eax, 0x56574b60
test eax, eax
je 0x1004014a
mov dword [ebp - 0xb4], 0xfffffffa
jmp 0x10040120
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x18
jge 0x10040148
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5d0], 0
je 0x1004013b
jmp 0x10040148
cmp dword [ebp - 0x90], 0
je 0x10040146
jmp 0x10040148
jmp 0x10040113
jmp 0x10040161
mov dword [ebp - 0x4c0], 0x97312b94
lea eax, [ebp - 0x4c0]
push eax
call fcn.1003c968
pop ecx
jmp 0x10040025
jmp 0x1003ffb2
jmp 0x1003ff64
cmp dword [ebp - 0x4c8], 0
jne 0x10040180
xor eax, eax
jmp 0x100404cb
lea eax, [ebp - 0x30]
push eax
call fcn.1003c981
pop ecx
push 3
lea ecx, [ebp - 0x470]
call fcn.10009afa
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x50], 0x9c213245
push 3
lea ecx, [ebp - 0x68c]
call fcn.10009afa
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x508], 0x2a
push 0x5fa6
lea eax, [ebp - 0x4d0]
push eax
push 0x6ca3
lea eax, [ebp - 0x470]
push eax
push 1
push 0x562b
push 1
push 0x16b6
call fcn.1003b643
add esp, 0x20
lea eax, [ebp - 0x4d0]
push eax
lea eax, [ebp - 0x68c]
push eax
push 0x56cd
push 1
push 1
push 0x4734
push 1
push 0x65c1
call fcn.1003b765
add esp, 0x20
push 0
lea ecx, [ebp - 0x470]
call fcn.10009b6a
cmp dword [eax], 0xffffffff
jle 0x10040237
mov dword [ebp - 0x414], 1
jmp 0x1004023e
and dword [ebp - 0x414], 0
mov dword [ebp - 0x50], 0
cmp dword [ebp - 0x50], 0
jne 0x10040257
mov dword [ebp - 0x3fc], 1
jmp 0x1004025e
and dword [ebp - 0x3fc], 0
push 2
lea ecx, [ebp - 0x470]
call fcn.10009b6a
mov eax, dword [eax]
cmp eax, dword [ebp - 0x3fc]
jle 0x10040281
mov dword [ebp - 0x404], 1
jmp 0x10040288
and dword [ebp - 0x404], 0
cmp dword [ebp - 0x404], 0xcbeb9691
jb 0x100402a0
mov dword [ebp - 0x40c], 1
jmp 0x100402a7
and dword [ebp - 0x40c], 0
imul esi, dword [ebp - 0x40c], 0xffff
push 0
lea ecx, [ebp - 0x470]
call fcn.10009b6a
cmp esi, dword [eax]
jl 0x100402ce
mov dword [ebp - 0x41c], 1
jmp 0x100402d5
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x414]
cmp eax, dword [ebp - 0x41c]
jge 0x100402ef
mov dword [ebp - 0x424], 1
jmp 0x100402f6
and dword [ebp - 0x424], 0
push 1
lea ecx, [ebp - 0x470]
call fcn.10009b6a
mov ecx, dword [ebp - 0x424]
cmp ecx, dword [eax]
jg 0x10040319
mov dword [ebp - 0x42c], 1
jmp 0x10040320
and dword [ebp - 0x42c], 0
cmp dword [ebp - 0x42c], 0xfffffffa
jl 0x1004034a
mov dword [ebp - 0x4d8], 0x2d62
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x4d8]
push eax
call fcn.10029ec5
pop ecx
pop ecx
jmp 0x1004048c
mov dword [ebp - 0x4f0], 0x783de769
mov dword [ebp - 0xf4], 0x8a83a56c
mov dword [ebp - 0x50], 0
jmp 0x1004036e
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jg 0x10040474
mov dword [ebp - 0xd4], 5
mov dword [ebp - 0x4e8], 0xffffffff
mov dword [ebp - 0x4f8], 0x784b52dd
mov dword [ebp - 0x500], 0x1f433c8a
mov dword [ebp - 0xd4], 2
jmp 0x100403b9
mov eax, dword [ebp - 0xd4]
dec eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jl 0x1004046f
mov dword [ebp - 0x7a0], 0xfffffffc
mov dword [ebp - 0x4e0], 0x5aba9a9
mov dword [ebp - 0xf0], 0
jmp 0x100403f3
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 3
jge 0x1004040f
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x85c], 0
jmp 0x100403e6
push 1
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x4e0]
push eax
lea eax, [ebp - 0x4e8]
push eax
push 0x4053
lea eax, [ebp - 0x4f0]
push eax
lea eax, [ebp - 0x4f8]
push eax
lea eax, [ebp - 0xd4]
push eax
push 1
lea eax, [ebp - 0x500]
push eax
lea eax, [ebp - 0xf4]
push eax
push 1
push 0x1105
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.1003b9f6
add esp, 0x3c
jmp 0x100403ac
jmp 0x10040367
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x508], eax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x68c]
call fcn.10009b5c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x470]
call fcn.10009b5c
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x10], 0
je 0x100404be
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x434], eax
jmp 0x100404c5
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x434]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret