Function at 0x100270d8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005ddc3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x710
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 2
lea ecx, [ebp - 0x59c]
call fcn.1002a6d6
and dword [ebp - 4], 0
mov dword [ebp - 0x42c], 0xdf1febae
mov dword [ebp - 0x424], 0x4f147909
mov dword [ebp - 0x3e0], 0x7e06985b
push 0xf47
push 0x7608
push 0x7b13
lea eax, [ebp - 0x690]
push eax
push 0x72c9
push 0x5048
push 0xc11
push 0
push 0x6232
push 1
lea eax, [ebp - 0x59c]
push eax
push 0x47ea
call fcn.100175db
add esp, 0x30
push 0x7523
push 0x75cb
lea eax, [ebp - 0x59c]
push eax
lea eax, [ebp - 0x3e0]
push eax
push 0x57e3
push 0x46f0
push 0x65b0
push 1
lea eax, [ebp - 0x424]
push eax
push 0x7b09
push 0x322b
push 0
lea eax, [ebp - 0x42c]
push eax
push 0x743e
call fcn.1001c1e6
add esp, 0x38
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x59c]
call fcn.1002a758
and dword [ebp - 0x20], 0
mov dword [ebp - 0x434], 1
mov dword [ebp - 0x43c], 0xfffffffc
mov dword [ebp - 0x678], 0xfffffffb
mov dword [ebp - 0x63c], 0xec79e672
mov dword [ebp - 0x4c8], 1
mov dword [ebp - 0x198], 0xffff
mov dword [ebp - 0xec], 0
jmp 0x10027226
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jge 0x10027242
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x5b4], 5
jmp 0x10027219
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x684], eax
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x64c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5b4], 0
je 0x1002727f
mov eax, 0x509c
test eax, eax
je 0x1002727f
mov dword [ebp - 0x230], 1
jmp 0x10027286
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x444]
cmp eax, dword [ebp - 0x4b8]
je 0x100272c5
mov dword [ebp - 0x4c0], 1
jmp 0x100272cc
and dword [ebp - 0x4c0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5b4]
mov dword [ebp - 0x5f4], eax
cmp dword [ebp - 0x4c8], 0xffff
jne 0x100272f6
mov dword [ebp - 0x334], 1
jmp 0x100272fd
and dword [ebp - 0x334], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x334]
mov dword [ebp + eax - 0x5b4], ecx
mov byte [ebp - 0x4a], 0
push 0x3a00
push 0x6f39
push 0x68d9
push 0x5dbe
lea eax, [ebp - 0x4a]
push eax
push 1
push 1
push 0x120a
push 0x1525
push 0x7afc
call fcn.10015c86
add esp, 0x28
mov dword [ebp - 0x28], 0
jmp 0x10027357
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1002736d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x548], 5
jmp 0x10027350
mov dword [ebp - 0x28], 0
jmp 0x1002737d
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10027393
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1a0], 0x4cd45360
jmp 0x10027376
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1a0], 1
jmp 0x100273c1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1a0]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1a0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1a0], 0
jl 0x100273fb
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1a0]
mov eax, dword [ebp + eax*4 - 0x548]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x1a0]
mov dword [ebp + ecx*4 - 0x548], eax
jmp 0x100273a6
mov byte [ebp - 0x3d], 0
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x1002741d
push 0x3ea4
push 1
push 0x1fe0
push 1
call fcn.10015e8c
add esp, 0x10
mov dword [ebp - 0x4e0], 0xdbda
mov dword [ebp - 0xe8], 0
jmp 0x10027440
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 2
jge 0x1002745c
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0x3a4], 0xa48bbca6
jmp 0x10027433
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3a4], 0xffffffeb
jmp 0x1002748a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3a4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a4], 7
jne 0x10027662
mov dword [ebp - 0x98], 0xffffffff
mov dword [ebp - 0x98], 0
jmp 0x100274c1
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xffffffe9
je 0x1002765d
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x128], 1
jmp 0x100274f1
mov eax, dword [ebp - 0x128]
dec eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xffffffe8
je 0x10027658
mov byte [ebp - 0x49], 0
movzx eax, byte [ebp - 0x49]
test eax, eax
je 0x10027653
call fcn.10026aee
mov dword [ebp - 0x33c], 0x294c
mov dword [ebp - 0x4d8], 0x1000995c
cmp dword [ebp - 0x33c], 0x29ed
jle 0x1002760e
and dword [ebp - 0xa0], 0
jmp 0x1002754d
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0x21da
jge 0x1002760e
and dword [ebp - 0xf0], 0
jmp 0x10027573
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0x4111
jge 0x10027609
and dword [ebp - 0xa8], 0
jmp 0x10027599
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x157
jge 0x10027604
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0xf0]
sar eax, cl
or eax, dword [ebp - 0xa8]
cdq
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x44c], edx
push dword [ebp - 0x44c]
push dword [ebp - 0x450]
lea ecx, [ebp - 0x6d8]
call fcn.1000cd20
pop ecx
pop ecx
mov dword [ebp - 0x4d0], eax
mov ecx, dword [ebp - 0x4d0]
call fcn.1002a5a1
push eax
call fcn.100480d6
pop ecx
lea ecx, [ebp - 0x6d8]
call fcn.1002a597
jmp 0x1002758c
jmp 0x10027566
jmp 0x10027540
mov dword [ebp - 4], 1
cmp dword [ebp - 0x33c], 0x288b
jge 0x1002762d
push dword [ebp - 0x4d8]
call fcn.100480d6
pop ecx
jmp 0x10027649
or dword [ebp - 4], 0xffffffff
jmp 0x10027653
jmp 0x100274e4
jmp 0x100274b4
jmp 0x1002746f
push 0x59d
push 0x69ba
push 0x398f
push 0x7635
push 1
push 0x6eac
lea eax, [ebp - 0x4e0]
push eax
push 0x5a1b
push 0x5154
push 0x36e6
push 0x254f
push 1
push 0x324e
push 1
push 0x1529
call fcn.1001601d
add esp, 0x3c
lea eax, [ebp + 8]
push eax
push 1
push 0x5b93
lea eax, [ebp - 0x184]
push eax
push 0x6415
push 0x4dff
push 0
push 0x5e0e
push 0x6345
call fcn.1001892d
add esp, 0x24
mov eax, dword [ebp - 0x184]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002789b
mov dword [ebp - 0x118], 0xffffffff
mov dword [ebp - 0x118], 0
jmp 0x10027715
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xfffffff1
jl 0x10027894
mov dword [ebp - 0x374], 0x467f
mov dword [ebp - 0x4e8], 0x100099b4
cmp dword [ebp - 0x374], 0x47f9
jle 0x1002782a
push 0x26
call dword [sym.imp.USER32.dll_MessageBeep]
and dword [ebp - 0xb8], 0
jmp 0x10027764
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0x651e
jge 0x1002782a
and dword [ebp - 0x138], 0
jmp 0x1002778a
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x778d
jge 0x10027825
and dword [ebp - 0xb0], 0
jmp 0x100277b0
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x172c
jge 0x10027820
and dword [ebp - 0xf8], 0
jmp 0x100277d2
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0x68bc
jge 0x1002781e
mov eax, dword [ebp - 0xb0]
imul eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0xb8]
add ecx, dword [ebp - 0x138]
xor eax, ecx
cdq
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x458], edx
push dword [ebp - 0x458]
push dword [ebp - 0x45c]
mov ecx, 0x10606538
call fcn.1002a5c1
jmp 0x100277c5
jmp 0x100277a3
jmp 0x1002777d
jmp 0x10027757
mov byte [ebp - 0x45], 0
mov dword [ebp - 4], 3
cmp dword [ebp - 0x374], 0x466e
jge 0x10027851
mov edx, dword [ebp - 0x4e8]
mov ecx, 0x10606538
call fcn.1002c06b
jmp 0x1002786d
or dword [ebp - 4], 0xffffffff
jmp 0x10027877
lea eax, [ebp - 0x45]
push eax
call fcn.10026afe
pop ecx
mov byte [ebp - 0x4b], 0
lea eax, [ebp - 0x4b]
push eax
call fcn.10026b47
pop ecx
jmp 0x10027708
xor eax, eax
jmp 0x1002a4bb
call fcn.10026b75
push 0x7b10
push 0x745c
lea eax, [ebp + 8]
push eax
push 1
lea eax, [ebp - 0x60]
push eax
push 0x3b35
push 0x7229
push 1
push 1
lea eax, [ebp - 0x184]
push eax
call fcn.10016ae8
add esp, 0x28
mov eax, dword [ebp - 0x60]
cmp dword [eax], 0x4550
je 0x10027eb1
push 2
lea ecx, [ebp - 0x628]
call fcn.1002a6d6
mov dword [ebp - 4], 5
mov dword [ebp - 0xc0], 1
lea eax, [ebp - 0x600]
push eax
push 1
push 1
lea eax, [ebp - 0x628]
push eax
push 0x6f9f
push 0x158c
call fcn.10016c29
add esp, 0x18
mov dword [ebp - 0xc0], 0
jmp 0x1002793b
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jg 0x100279a4
mov dword [ebp - 0x100], 0xbd97a888
mov dword [ebp - 0x3c0], 6
mov dword [ebp - 0x100], 1
jmp 0x10027971
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jl 0x100279a2
mov byte [ebp - 0x4d], 0
lea eax, [ebp - 0x4d]
push eax
call fcn.10026bbe
pop ecx
push 0x1e2
push 1
lea eax, [ebp - 0x3c0]
push eax
push 0
call fcn.1001b587
add esp, 0x10
jmp 0x10027964
jmp 0x1002792e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x628]
call fcn.1002a758
push 2
lea ecx, [ebp - 0x90]
call fcn.1002a6d6
mov dword [ebp - 4], 6
mov dword [ebp - 0x68], 0x3d47
mov dword [ebp - 0x194], 0x1c5860bc
mov dword [ebp - 0x4ec], 0xcdf493ab
mov dword [ebp - 0x3c8], 0xffffffff
mov dword [ebp - 0x18], 0
jmp 0x100279fc
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10027a12
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x638], 1
jmp 0x100279f5
mov dword [ebp - 0x18], 0
jmp 0x10027a22
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10027a35
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x78], 0xffffffff
jmp 0x10027a1b
push 0x3054
push 0
push 0x3717
push 0xc12
push 0x3180
push 1
push 1
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.1001b475
add esp, 0x24
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x78], 0
jmp 0x10027a87
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x78]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x78], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x78], 3
jge 0x10027aab
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x78]
mov dword [ebp + eax*4 - 0x638], 0xdf251d69
jmp 0x10027a72
push 0
lea ecx, [ebp - 0x90]
call fcn.1002a774
mov dword [eax], 0xfffffff0
jmp 0x10027ae4
push 0
lea ecx, [ebp - 0x90]
call fcn.1002a774
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x37c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x37c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x90]
call fcn.1002a774
cmp dword [eax], 0xf
jne 0x10027e9b
mov dword [ebp - 0x154], 0x2aa61fc2
mov dword [ebp - 0x14c], 0xaeb382e5
mov dword [ebp - 0x380], 0xa8f1edd1
mov dword [ebp - 0x3d0], 0xc5f2
push 0
lea ecx, [ebp - 0x90]
call fcn.1002a774
mov esi, eax
push 1
lea ecx, [ebp - 0x90]
call fcn.1002a774
mov eax, dword [eax]
cmp eax, dword [esi]
jle 0x10027b50
mov dword [ebp - 0x384], 1
jmp 0x10027b57
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0
je 0x10027b7e
cmp dword [ebp - 0x68], 0
je 0x10027b7e
mov dword [ebp - 0x32c], 1
jmp 0x10027b85
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x194], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x194]
sub ecx, dword [ebp + eax - 0x78]
cmp ecx, 0x3e141b6b
jl 0x10027bb5
mov dword [ebp - 0x1d4], 1
jmp 0x10027bbc
and dword [ebp - 0x1d4], 0
mov eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x1d4]
jle 0x10027bd6
mov dword [ebp - 0x2ac], 1
jmp 0x10027bdd
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x2ac], eax
jle 0x10027bf7
mov dword [ebp - 0x1dc], 1
jmp 0x10027bfe
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x1dc]
neg eax
cmp eax, dword [ebp - 0x14c]
jl 0x10027c1a
mov dword [ebp - 0x36c], 1
jmp 0x10027c21
and dword [ebp - 0x36c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
cmp dword [ebp - 0x36c], eax
je 0x10027c3f
mov dword [ebp - 0x1e4], 1
jmp 0x10027c46
and dword [ebp - 0x1e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x638]
cmp dword [ebp - 0x1e4], eax
jle 0x10027c67
mov dword [ebp - 0x2b4], 1
jmp 0x10027c6e
and dword [ebp - 0x2b4], 0
push 0
lea ecx, [ebp - 0x90]
call fcn.1002a774
mov eax, dword [eax]
sub eax, dword [ebp - 0x2b4]
push 4
pop ecx
shl ecx, 0
cmp dword [ebp + ecx - 0x78], eax
jge 0x10027c9b
mov dword [ebp - 0x1ec], 1
jmp 0x10027ca2
and dword [ebp - 0x1ec], 0
cmp dword [ebp - 0x1ec], 2
je 0x10027cb7
mov dword [ebp - 0x328], 1
jmp 0x10027cbe
and dword [ebp - 0x328], 0
push 4
pop eax
shl eax, 0
mov esi, dword [ebp - 0x328]
sub esi, dword [ebp + eax - 0x78]
push 0
lea ecx, [ebp - 0x90]
call fcn.1002a774
cmp esi, dword [eax]
jge 0x10027ceb
mov dword [ebp - 0x1f4], 1
jmp 0x10027cf2
and dword [ebp - 0x1f4], 0
mov esi, dword [ebp - 0x154]
add esi, dword [ebp - 0x1f4]
push 1
lea ecx, [ebp - 0x90]
call fcn.1002a774
cmp esi, dword [eax]
jne 0x10027d1b
mov dword [ebp - 0x17c], 1
jmp 0x10027d22
and dword [ebp - 0x17c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x17c]
mov dword [ebp + eax - 0x78], ecx
mov esi, dword [ebp - 0x154]
imul esi, dword [ebp - 0x17c]
push 0
lea ecx, [ebp - 0x90]
call fcn.1002a774
add esi, dword [eax]
jne 0x10027d62
mov eax, 0xb017290b
test eax, eax
jne 0x10027d62
and dword [ebp - 0x41c], 0
jmp 0x10027d6c
mov dword [ebp - 0x41c], 1
push 1
lea ecx, [ebp - 0x90]
call fcn.1002a774
mov esi, dword [ebp - 0x154]
push 0
lea ecx, [ebp - 0x90]
call fcn.1002a774
cmp dword [eax], esi
jle 0x10027dcb
mov dword [ebp - 0x3e4], 0xbf7a
push 0x2357
push 0x1a9a
push 0x166e
push 1
push 1
push 0x48fa
lea eax, [ebp - 0x3e4]
push eax
push 0xc72
call fcn.100171d2
add esp, 0x20
jmp 0x10027e96
mov dword [ebp - 0x68], 0xb
jmp 0x10027ddb
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x11
jl 0x10027e96
mov dword [ebp - 0x46c], 0xca404523
push 1
lea ecx, [ebp - 0x5d8]
call fcn.1002a6d6
mov byte [ebp - 4], 7
mov dword [ebp - 0xc8], 0
jmp 0x10027e19
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jge 0x10027e3b
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x5d8]
call fcn.1002a774
mov dword [eax], 0x6d99275a
jmp 0x10027e0c
push 1
lea eax, [ebp - 0x5d8]
push eax
lea eax, [ebp - 0x4ec]
push eax
lea eax, [ebp - 0x3c8]
push eax
push 0x78af
push 1
push 0x21c
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x3d0]
push eax
call fcn.100173d7
add esp, 0x2c
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x5d8]
call fcn.1002a758
jmp 0x10027dd4
jmp 0x10027ac0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90]
call fcn.1002a758
xor eax, eax
jmp 0x1002a4bb
mov dword [ebp - 0x4cc], 0xfe0a8eac
push 0x66ac
push 0x835
push 1
push 0x6ad3
push 0x59d
push 0
lea eax, [ebp - 0x4cc]
push eax
call fcn.10019915
add esp, 0x1c
mov byte [ebp - 0x46], 0
movzx eax, byte [ebp - 0x46]
test eax, eax
je 0x10027f04
push 1
push 0x5174
push 1
push 0x27e9
call fcn.1001795c
add esp, 0x10
push 0x3b11
push 1
push 0xda0
lea eax, [ebp - 0xa4]
push eax
push 1
push 0x631d
lea eax, [ebp - 0x60]
push eax
push 0xe5c
call fcn.100179f1
add esp, 0x20
cmp dword [ebp - 0xa4], 0
jne 0x10027f3f
xor eax, eax
jmp 0x1002a4bb
mov dword [ebp - 0x478], 0xfffffffd
mov dword [ebp - 0x54], 0x9ad59e57
mov dword [ebp - 0x3b4], 0xfffffffe
mov dword [ebp - 0x1fc], 0xffffffff
mov dword [ebp - 0x15c], 0xcef3cf68
mov dword [ebp - 0x510], 0xadc1094
mov dword [ebp - 0x484], 0x2883e731
mov dword [ebp - 0x5f0], 0xfffffffe
mov dword [ebp - 0x608], 0xfffffff8
push 4
lea ecx, [ebp - 0x658]
call fcn.1002a6d6
mov dword [ebp - 4], 8
mov dword [ebp - 0x224], 3
push 2
lea ecx, [ebp - 0x5cc]
call fcn.1002a6d6
mov byte [ebp - 4], 9
push 0x51e6
push 1
push 1
push 0x27aa
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x3d8]
push eax
call fcn.10017c9a
add esp, 0x18
lea eax, [ebp - 0x5cc]
push eax
lea eax, [ebp - 0x3d8]
push eax
call fcn.10026c02
pop ecx
pop ecx
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x1002806d
push 0xf
push 0x7c20
push 0x5750
push 0x41b6
push 0x2d59
push 0x3fb2
push 0x8fa
push 0x7563
push 0x41e2
push 0x51b
push 0
push 0x2bad
push 0x766d
push 0x18ef
push 1
push 0x2125
push 0x258c
push 0x7c39
push 1
call fcn.1001b75e
add esp, 0x4c
jmp 0x100283c1
mov dword [ebp - 0x20c], 7
mov dword [ebp - 0x214], 0x19d87263
mov dword [ebp - 0x610], 1
mov dword [ebp - 0x618], 0xfffffffa
mov dword [ebp - 0x680], 0xbab1f35
mov dword [ebp - 0x688], 0xabed9978
push 3
lea ecx, [ebp - 0x648]
call fcn.1002a6d6
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x5ec], 0xd385e397
push 0x4f47
push 1
push 0x3268
push 0x5926
lea eax, [ebp - 0x674]
push eax
push 0x7bf8
push 1
lea eax, [ebp - 0x648]
push eax
push 0x29cf
call fcn.1001892d
add esp, 0x24
mov dword [ebp - 0x54], 0xe
jmp 0x10028107
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 8
jne 0x100283a5
push 3
lea ecx, [ebp - 0x1ac]
call fcn.1002a6d6
mov byte [ebp - 4], 0xb
push 0x3ce6
push 0x4e0c
lea eax, [ebp - 0x1c]
push eax
push 1
push 0x6a7
push 1
lea eax, [ebp - 0x1ac]
push eax
push 0x1902
call fcn.10018a35
add esp, 0x20
mov dword [ebp - 0x1c], 0
jmp 0x1002815d
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10028173
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5fc], 0xb1b0cadf
jmp 0x10028156
mov dword [ebp - 0x1c], 0
jmp 0x10028183
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10028199
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x69c], 3
jmp 0x1002817c
mov eax, 0xdfba
test eax, eax
je 0x100282b5
mov eax, dword [ebp - 0x3b4]
cmp eax, dword [ebp - 0x214]
jl 0x100281c0
mov dword [ebp - 0x2bc], 1
jmp 0x100281c7
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x364], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x364]
mov dword [ebp + eax - 0x5fc], ecx
cmp dword [ebp - 0x364], 0xde6b9338
ja 0x1002820a
mov dword [ebp - 0x204], 1
jmp 0x10028211
and dword [ebp - 0x204], 0
push 0
lea ecx, [ebp - 0x1ac]
call fcn.1002a774
mov ecx, dword [ebp - 0x204]
cmp ecx, dword [eax]
je 0x10028234
mov dword [ebp - 0x2c4], 1
jmp 0x1002823b
and dword [ebp - 0x2c4], 0
mov dword [ebp - 0x20c], 0x2b90
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x20c]
cmp eax, dword [ebp - 0x15c]
jne 0x1002826b
mov dword [ebp - 0x330], 1
jmp 0x10028272
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x510]
cmp dword [ebp - 0x330], eax
jl 0x1002828c
mov dword [ebp - 0x3e8], 1
jmp 0x10028293
and dword [ebp - 0x3e8], 0
push 0
lea ecx, [ebp - 0x1ac]
call fcn.1002a774
cmp dword [ebp - 0x214], 0
je 0x100282b5
mov dword [ebp - 0x2cc], 1
jmp 0x100282bc
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x484], eax
push 0
lea ecx, [ebp - 0x1ac]
call fcn.1002a774
mov esi, eax
push 0
lea ecx, [ebp - 0x1ac]
call fcn.1002a774
mov eax, dword [eax]
sub eax, dword [esi]
cmp eax, 0xa26c
jg 0x1002830d
push 2
lea ecx, [ebp - 0x1ac]
call fcn.1002a774
cmp dword [eax], 0
je 0x1002830d
mov dword [ebp - 0x21c], 1
jmp 0x10028314
and dword [ebp - 0x21c], 0
cmp dword [ebp - 0x21c], 0xc51ac06e
jb 0x1002832c
mov dword [ebp - 0x368], 1
jmp 0x10028333
and dword [ebp - 0x368], 0
mov esi, dword [ebp - 0x368]
sub esi, 0x3cf435f5
push 0
lea ecx, [ebp - 0x1ac]
call fcn.1002a774
cmp dword [eax], esi
je 0x1002835c
mov dword [ebp - 0x3f0], 1
jmp 0x10028363
and dword [ebp - 0x3f0], 0
push 1
lea ecx, [ebp - 0x1ac]
call fcn.1002a774
mov eax, dword [ebp - 0x15c]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x69c], eax
mov byte [ebp - 0x48], 0
lea eax, [ebp - 0x48]
push eax
call fcn.10026c4a
pop ecx
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x1ac]
call fcn.1002a758
jmp 0x10028100
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x648]
call fcn.1002a758
lea eax, [ebp - 0x5cc]
push eax
call fcn.10013d1c
pop ecx
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x5cc]
call fcn.1002a758
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x658]
call fcn.1002a758
lea eax, [ebp - 0x67c]
push eax
push 0x5104
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x2db1
push 0
push 1
push 0x5b05
push dword [ebp - 0x60]
push dword [ebp - 0x184]
call fcn.10015c86
add esp, 0x28
push 0x1671
push 0x2b9
push 0x3392
push 0x1369
push 0x64b2
push 1
lea eax, [ebp + 8]
push eax
push 0xf07
lea eax, [ebp - 0x20]
push eax
push 0
push 0x59a
push 1
push 0x6aba
lea eax, [ebp - 0x60]
push eax
push 0x241
push 0x2240
push 0x6b79
call fcn.1001aa69
add esp, 0x44
mov dword [ebp - 0x34], 0x5d6c05ba
mov dword [ebp - 0x34], 0
jmp 0x1002848a
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xfffffff2
jg 0x10028631
mov dword [ebp - 0x4d4], 2
mov dword [ebp - 0x22c], 0x10466712
mov dword [ebp - 0x2dc], 1
mov dword [ebp - 0x490], 0xfffffff8
mov dword [ebp - 0x30], 0
jmp 0x100284cc
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x100284e2
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x668], 1
jmp 0x100284c5
mov dword [ebp - 0x30], 0
jmp 0x100284f2
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x10028508
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x6a8], 0xffffffff
jmp 0x100284eb
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x604], eax
mov eax, 0xdfad5bef
test eax, eax
jne 0x10028527
xor eax, eax
jne 0x10028527
and dword [ebp - 0x2d4], 0
jmp 0x10028531
mov dword [ebp - 0x2d4], 1
mov eax, dword [ebp - 0x2d4]
add eax, 7
sub eax, dword [ebp - 0x4d4]
cmp eax, 0x946b43d2
je 0x10028553
mov dword [ebp - 0x164], 1
jmp 0x1002855a
and dword [ebp - 0x164], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x164]
mov dword [ebp + eax - 0x668], ecx
cmp dword [ebp - 0x164], 0
jne 0x10028588
mov eax, 0x6b42be19
test eax, eax
jne 0x10028588
and dword [ebp - 0x3f8], 0
jmp 0x10028592
mov dword [ebp - 0x3f8], 1
cmp dword [ebp - 0x22c], 0
jne 0x100285a8
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x668], 0
mov dword [ebp - 0x22c], 0x6aed
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x34]
jle 0x100285c6
mov dword [ebp - 0x338], 1
jmp 0x100285cd
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x338]
neg eax
mov ecx, dword [ebp - 0x34]
add ecx, eax
mov dword [ebp - 0x234], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x234]
mov dword [ebp + eax - 0x6a8], ecx
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 0
jne 0x10028616
xor eax, eax
inc eax
jne 0x10028616
and dword [ebp - 0x23c], 0
jmp 0x10028620
mov dword [ebp - 0x23c], 1
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x490], eax
jmp 0x10028483
push 0x936
push 0x47e8
lea eax, [ebp - 0x60]
push eax
push 0x6d21
push 0x107a
push 0x39e0
push 1
push 0x60ac
lea eax, [ebp - 0x400]
push eax
push 0x6117
push 1
push 0x5f47
lea eax, [ebp - 0xa4]
push eax
call fcn.10019b24
add esp, 0x34
push 0x35c0
lea eax, [ebp - 0x400]
push eax
push 1
push 0x35ca
push 1
lea eax, [ebp - 0x20]
push eax
call fcn.10019c02
add esp, 0x18
push dword [ebp - 0x20]
call fcn.10013d43
pop ecx
test eax, eax
jne 0x100288ad
push 2
lea ecx, [ebp - 0x51c]
call fcn.1002a6d6
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x408], 0xd0714ad3
mov dword [ebp - 0x49c], 1
mov dword [ebp - 0x378], 0x239d
mov dword [ebp - 0x4fc], 0x100099f8
cmp dword [ebp - 0x378], 0x2538
jle 0x100287df
push 0x2535
call dword [sym.imp.USER32.dll_ShowCaret]
and dword [ebp - 0x108], 0
jmp 0x10028716
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0x5ab7
jge 0x100287df
and dword [ebp - 0xd8], 0
jmp 0x1002873c
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x11b8
jge 0x100287da
and dword [ebp - 0x120], 0
jmp 0x10028762
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x44b6
jge 0x100287d5
and dword [ebp - 0xd0], 0
jmp 0x10028784
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0x6529
jge 0x100287d3
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0xd0]
shl eax, cl
mov edx, dword [ebp - 0x108]
mov ecx, dword [ebp - 0xd8]
shl edx, cl
xor eax, edx
cdq
mov dword [ebp - 0x468], eax
mov dword [ebp - 0x464], edx
push dword [ebp - 0x464]
push dword [ebp - 0x468]
mov ecx, 0x10606538
call fcn.1002a5c1
jmp 0x10028777
jmp 0x10028755
jmp 0x1002872f
jmp 0x10028709
mov dword [ebp - 0x244], 4
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x378], 0x212b
jge 0x10028809
mov edx, dword [ebp - 0x4fc]
mov ecx, 0x10606538
call fcn.1002c06b
jmp 0x10028825
mov dword [ebp - 4], 0xc
jmp 0x10028835
mov dword [ebp - 0x7c], 0
jmp 0x10028845
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 2
jge 0x1002885e
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x51c]
call fcn.1002a774
and dword [eax], 0
jmp 0x1002883e
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x51c]
push eax
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x244]
push eax
call fcn.10026c73
add esp, 0x10
lea eax, [ebp - 0x51c]
push eax
lea eax, [ebp - 0x244]
push eax
call fcn.10026cc9
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x51c]
call fcn.1002a758
xor eax, eax
jmp 0x1002a4bb
mov dword [ebp - 0x410], 0xb0f73838
mov dword [ebp - 0x2e4], 0x4a53
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x16c], 0xd44ad374
push 2
lea ecx, [ebp - 0x4f8]
call fcn.1002a6d6
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x70], 0xb6f9b691
mov dword [ebp - 0x2f4], 0
mov dword [ebp - 0x4dc], 1
push 1
push 1
lea eax, [ebp - 0x4f8]
push eax
push 1
push 0x566d
lea eax, [ebp - 0x65c]
push eax
call fcn.10019dac
add esp, 0x18
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.10026d24
pop ecx
pop ecx
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
jne 0x10028a43
cmp dword [ebp - 0x2e4], 0
jae 0x1002895c
mov dword [ebp - 0x190], 1
jmp 0x10028963
and dword [ebp - 0x190], 0
push 1
lea ecx, [ebp - 0x4f8]
call fcn.1002a774
mov ecx, dword [ebp - 0x190]
mov dword [eax], ecx
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x190], eax
jne 0x10028992
mov dword [ebp - 0x24c], 1
jmp 0x10028999
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
jle 0x10028a27
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x340], eax
push 1
lea ecx, [ebp - 0x4f8]
call fcn.1002a774
mov ecx, dword [ebp - 0x340]
mov dword [eax], ecx
cmp dword [ebp - 0x340], 0
je 0x100289f6
push 0
lea ecx, [ebp - 0x4f8]
call fcn.1002a774
cmp dword [eax], 0
je 0x100289f6
mov dword [ebp - 0x254], 1
jmp 0x100289fd
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x70]
imul eax, dword [ebp - 0x254]
test eax, eax
jne 0x10028a1d
cmp dword [ebp - 0x130], 0
jne 0x10028a1d
and dword [ebp - 0x2ec], 0
jmp 0x10028a27
mov dword [ebp - 0x2ec], 1
mov dword [ebp - 0x16c], 1
cmp dword [ebp - 0x16c], 0
jne 0x10028a43
and dword [ebp - 0x25c], 0
jmp 0x10028a4d
mov dword [ebp - 0x25c], 1
cmp dword [ebp - 0x25c], 3
ja 0x10028a65
cmp dword [ebp - 0x70], 0
jne 0x10028a65
and dword [ebp - 0x370], 0
jmp 0x10028a6f
mov dword [ebp - 0x370], 1
cmp dword [ebp - 0x370], 0xffffffff
jge 0x10028a84
mov dword [ebp - 0x264], 1
jmp 0x10028a8b
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x4dc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4f8]
call fcn.1002a758
push dword [ebp - 0x20]
push 0x7e6e
push 0x21bd
push 1
push 0x1661
push 0
push 0x72a3
push 0x74f9
call fcn.10018a35
add esp, 0x20
mov dword [ebp - 0xe0], 2
mov dword [ebp - 0x584], 0x1dba
mov dword [ebp - 0x580], 0x1dba
mov dword [ebp - 0x57c], 0x1dba
mov dword [ebp - 0x578], 0x1dba
lea ecx, [ebp - 0x185]
call fcn.1002a783
push eax
lea eax, [ebp - 0x574]
push eax
lea eax, [ebp - 0x584]
push eax
lea ecx, [ebp - 0x6b0]
call fcn.1002a786
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x5a8]
call fcn.1002a732
mov dword [ebp - 4], 0x10
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x4c]
push eax
call fcn.10026d43
pop ecx
mov dword [ebp - 0xe0], 0xffffffe4
jmp 0x10028b6f
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0xfffffffa
jne 0x10028d08
mov dword [ebp - 0x110], 0
jmp 0x10028b95
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 2
jge 0x10028bb1
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x348], 0xffffffff
jmp 0x10028b88
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x348], 3
jmp 0x10028bdf
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x348]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x348], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x348], 0
jl 0x10028d03
mov dword [ebp - 0x84], 0x86bd085c
mov dword [ebp - 0x84], 0
jmp 0x10028c16
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jg 0x10028cfe
mov dword [ebp - 0x58], 0x95031536
mov dword [ebp - 0x58], 3
jmp 0x10028c3a
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x10028cdc
mov dword [ebp - 0x94], 0
jmp 0x10028c5d
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x10028c79
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x508], 0
jmp 0x10028c50
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x508], 0
jmp 0x10028ca7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x508]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x508], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x508], 4
jge 0x10028cd7
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x508]
lea ecx, [ebp - 0x5a8]
call fcn.1002a774
mov dword [eax], 0x7e2f
jmp 0x10028c8c
jmp 0x10028c33
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x348]
lea ecx, [ebp - 0x5a8]
call fcn.1002a774
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
jmp 0x10028c09
jmp 0x10028bc4
jmp 0x10028b62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5a8]
call fcn.1002a758
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002a1d1
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x360], 0xfffffffc
mov dword [ebp - 0x9c], 0
jmp 0x10028d50
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x10028d6c
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x39c], 1
jmp 0x10028d43
mov dword [ebp - 0x14], 2
jmp 0x10028d7c
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x10028e90
mov dword [ebp - 0x418], 5
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x39c]
mov dword [ebp - 0x60c], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x39c], 0
jne 0x10028df1
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x39c], 0x58e1
jl 0x10028dc9
mov dword [ebp - 0x26c], 1
jmp 0x10028dd0
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x39c]
sub eax, dword [ebp - 0x26c]
je 0x10028de8
cmp dword [ebp - 0x14], 0
jne 0x10028df1
and dword [ebp - 0x34c], 0
jmp 0x10028dfb
mov dword [ebp - 0x34c], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x34c], eax
je 0x10028e12
mov dword [ebp - 0x274], 1
jmp 0x10028e19
and dword [ebp - 0x274], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x39c]
cmp dword [ebp - 0x274], eax
jg 0x10028e47
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x39c], 0
je 0x10028e47
mov dword [ebp - 0x2fc], 1
jmp 0x10028e4e
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x39c]
cmp eax, dword [ebp - 0x2fc]
jne 0x10028e6c
mov dword [ebp - 0x27c], 1
jmp 0x10028e73
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x418], eax
jmp 0x10028d75
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xa4]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x208], ecx
push 2
lea ecx, [ebp - 0x3b0]
call fcn.1002a6d6
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0x358], 0xbcd76ce4
push 1
lea ecx, [ebp - 0x540]
call fcn.1002a6d6
mov byte [ebp - 4], 0x12
push 2
lea ecx, [ebp - 0x528]
call fcn.1002a6d6
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x174], 7
mov dword [ebp - 0x28c], 0xfffffff7
push 1
lea eax, [ebp - 0x284]
push eax
push 1
lea eax, [ebp - 0x3b0]
push eax
call fcn.1001a987
add esp, 0x10
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x284]
push eax
call fcn.10026d7d
pop ecx
pop ecx
push 0x2dc4
push 0x61b
push 0x24da
push 0x74cf
push 0x263d
push 1
push 0x7fbf
lea eax, [ebp - 0x284]
push eax
push 0xbdb
push 1
push 0x4c87
push 1
push 0x5b18
push 0x199c
push 0x44ad
push 0x6ae4
lea eax, [ebp - 0x528]
push eax
call fcn.1001aa69
add esp, 0x44
push 1
lea ecx, [ebp - 0x3b0]
call fcn.1002a774
cmp dword [eax], 0
jne 0x10028ff7
push 1
lea ecx, [ebp - 0x3b0]
call fcn.1002a774
cmp dword [eax], 0
jne 0x10028fd7
mov dword [ebp - 0x18c], 0x41fc9a57
mov esi, dword [ebp - 0x358]
push 1
lea ecx, [ebp - 0x3b0]
call fcn.1002a774
push 0
lea ecx, [ebp - 0x540]
call fcn.1002a774
mov esi, dword [ebp - 0x18c]
push 1
lea ecx, [ebp - 0x528]
call fcn.1002a774
sub esi, dword [eax]
jne 0x10028ff7
and dword [ebp - 0x304], 0
jmp 0x10029001
mov dword [ebp - 0x304], 1
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x28c], eax
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x3b0]
push eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x174]
push eax
call fcn.10026dc5
add esp, 0x1c
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x528]
call fcn.1002a758
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x540]
call fcn.1002a758
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3b0]
call fcn.1002a758
cmp dword [ebp - 0x208], 0
jne 0x100292c9
mov dword [ebp - 0x294], 0xd8b
mov dword [ebp - 0x420], 0x10009a58
cmp dword [ebp - 0x294], 0xf5e
jle 0x10029185
and dword [ebp - 0xac], 0
jmp 0x100290c6
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x2359
jge 0x10029185
and dword [ebp - 0xb4], 0
jmp 0x100290ec
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x250f
jge 0x10029180
and dword [ebp - 0xbc], 0
jmp 0x10029112
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xbdb
jge 0x1002917b
mov eax, dword [ebp - 0xac]
add eax, dword [ebp - 0xb4]
add eax, dword [ebp - 0xbc]
cdq
mov dword [ebp - 0x474], eax
mov dword [ebp - 0x470], edx
push dword [ebp - 0x470]
push dword [ebp - 0x474]
lea ecx, [ebp - 0x708]
call fcn.1000cd20
pop ecx
pop ecx
mov dword [ebp - 0x4a8], eax
mov ecx, dword [ebp - 0x4a8]
call fcn.1002a5a1
push eax
call fcn.100480d6
pop ecx
lea ecx, [ebp - 0x708]
call fcn.1002a597
jmp 0x10029105
jmp 0x100290df
jmp 0x100290b9
mov dword [ebp - 4], 0x14
cmp dword [ebp - 0x294], 0xb38
jge 0x100291a4
push dword [ebp - 0x420]
call fcn.100480d6
pop ecx
jmp 0x100291c0
or dword [ebp - 4], 0xffffffff
jmp 0x100291ca
mov dword [ebp - 0x148], 8
mov dword [ebp - 0x4ac], 0x141a9c21
mov dword [ebp - 0x428], 0xffffffff
mov dword [ebp - 0x144], 3
mov dword [ebp - 0x29c], 0x4e5a945c
mov dword [ebp - 0x30c], 0x593c8699
push 0x7532
lea eax, [ebp - 0x29c]
push eax
push 1
lea eax, [ebp - 0x148]
push eax
push 0x1c79
push 0x2520
push 0x296d
lea eax, [ebp - 0x4ac]
push eax
push 0x6b1f
push 0x4194
push 1
push 1
push 0x5cfe
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x144]
push eax
push 0x49a4
call fcn.1001b0d2
add esp, 0x40
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x148], 0
jne 0x1002928a
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
je 0x100292a3
mov dword [ebp - 0x4b0], 0xfffc
lea eax, [ebp - 0x4b0]
push eax
call fcn.10026ef3
pop ecx
jmp 0x100292c2
mov dword [ebp - 0x430], 0xfffffffb
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x148]
push eax
call fcn.10026f0a
pop ecx
pop ecx
xor eax, eax
jmp 0x1002a4bb
mov dword [ebp - 0x35c], 0x5381
mov dword [ebp - 0x4b4], 0x10009a98
cmp dword [ebp - 0x35c], 0x539d
jle 0x10029395
and dword [ebp - 0xc4], 0
jmp 0x10029303
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x1c9a
jge 0x10029395
and dword [ebp - 0xcc], 0
jmp 0x10029329
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x37d4
jge 0x10029390
and dword [ebp - 0xd4], 0
jmp 0x1002934b
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x797
jge 0x1002938e
mov eax, dword [ebp - 0xc4]
xor eax, dword [ebp - 0xcc]
xor eax, dword [ebp - 0xd4]
cdq
mov dword [ebp - 0x480], eax
mov dword [ebp - 0x47c], edx
push dword [ebp - 0x47c]
push dword [ebp - 0x480]
mov ecx, 0x10606538
call fcn.1002a5c1
jmp 0x1002933e
jmp 0x1002931c
jmp 0x100292f6
mov dword [ebp - 4], 0x16
cmp dword [ebp - 0x35c], 0x5045
jge 0x100293b8
mov edx, dword [ebp - 0x4b4]
mov ecx, 0x10606538
call fcn.1002c06b
jmp 0x100293d4
or dword [ebp - 4], 0xffffffff
jmp 0x100293de
mov dword [ebp - 0xdc], 0
jmp 0x100293f7
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 2
jge 0x10029413
mov eax, dword [ebp - 0xdc]
mov dword [ebp + eax*4 - 0x354], 0xffffffff
jmp 0x100293ea
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x354], 0
jmp 0x10029441
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x354]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x354], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x354], 0x13
jl 0x1002969f
mov dword [ebp - 0x150], 0xffffffff
mov dword [ebp - 0x1d8], 0xfffffffb
mov dword [ebp - 0x1f8], 0x3bf118c8
mov dword [ebp - 0xe4], 0
jmp 0x1002948c
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 4
jge 0x100294a8
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0x320], 0xffffffff
jmp 0x1002947f
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x320], 0xfffffff8
jmp 0x100294d6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x320]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x320], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x320], 7
jge 0x10029540
mov dword [ebp - 0x5e8], 0x22263126
mov dword [ebp - 0x5e4], 0x22263126
mov dword [ebp - 0x5e0], 0x22263126
mov dword [ebp - 0x5dc], 0x22263126
mov dword [ebp - 0x5c], 0xfffffffb
mov dword [ebp - 0x5c], 0
jmp 0x10029525
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 4
jge 0x1002953b
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x5e8], 0x1d8f8f57
jmp 0x1002951e
jmp 0x100294bb
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x320], 0xba5f
jl 0x1002955f
mov dword [ebp - 0x2a4], 1
jmp 0x10029566
and dword [ebp - 0x2a4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x320]
cmp dword [ebp - 0x2a4], eax
jl 0x10029587
mov dword [ebp - 0x1cc], 1
jmp 0x1002958e
and dword [ebp - 0x1cc], 0
cmp dword [ebp - 0x1cc], 0x5755
jle 0x100295a6
mov dword [ebp - 0x1d0], 1
jmp 0x100295ad
and dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x1d8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x320]
add eax, dword [ebp - 0x1d8]
jne 0x100295dc
xor eax, eax
inc eax
jne 0x100295dc
and dword [ebp - 0x1e0], 0
jmp 0x100295e6
mov dword [ebp - 0x1e0], 1
push 4
pop eax
shl eax, 0
imul ecx, dword [ebp - 0x1e0], 0xfffa
cmp ecx, dword [ebp + eax - 0x320]
je 0x1002960b
mov dword [ebp - 0x1e8], 1
jmp 0x10029612
and dword [ebp - 0x1e8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x320]
cmp dword [ebp - 0x1e8], eax
jg 0x10029633
mov dword [ebp - 0x1f0], 1
jmp 0x1002963a
and dword [ebp - 0x1f0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x354]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x1f8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x320]
cmp eax, dword [ebp - 0x1f8]
jle 0x10029680
mov dword [ebp - 0x200], 1
jmp 0x10029687
and dword [ebp - 0x200], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x200]
mov dword [ebp + eax - 0x320], ecx
jmp 0x10029426
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x208]
mov dword [ebp - 0x454], eax
push 3
lea ecx, [ebp - 0x1b8]
call fcn.1002a6d6
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x80], 0x94643cdf
mov dword [ebp - 0x438], 0xffffffff
mov dword [ebp - 0x160], 1
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x238], 0x9fc5c2da
lea eax, [ebp - 0x68c]
push eax
push 1
lea eax, [ebp - 0x1b8]
push eax
push 0xa4c
push 0xafd
push 0x271e
push 0
push 0x468
push 0x40a4
push 1
call fcn.1001c5a7
add esp, 0x28
mov dword [ebp - 0x80], 2
jmp 0x1002973c
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jl 0x10029a89
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x38], 0xfffffff6
call fcn.10026f70
mov dword [ebp - 0x2c], 2
jmp 0x10029769
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x10029a84
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x440], 0x3b03c3fa
mov dword [ebp - 0x158], 0xfffb
mov dword [ebp - 0x50c], 0xfffffff8
mov dword [ebp - 0x3c], 2
jmp 0x100297a8
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x10029a53
mov dword [ebp - 0x570], 0xe672ca3c
mov dword [ebp - 0x56c], 0xe672ca3c
mov dword [ebp - 0x568], 0xe672ca3c
mov dword [ebp - 0x564], 0xe672ca3c
lea ecx, [ebp - 0x13d]
call fcn.1002a783
push eax
lea eax, [ebp - 0x560]
push eax
lea eax, [ebp - 0x570]
push eax
lea ecx, [ebp - 0x6b8]
call fcn.1002a786
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1c4]
call fcn.1002a732
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x4e4], 0xb2b0402a
push 3
lea ecx, [ebp - 0x1c4]
call fcn.1002a774
mov dword [eax], 2
jmp 0x10029856
push 3
lea ecx, [ebp - 0x1c4]
call fcn.1002a774
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x210]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x210]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x1c4]
call fcn.1002a774
cmp dword [eax], 0
jl 0x10029a3f
mov dword [ebp - 0x4bc], 1
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1b8]
call fcn.1002a774
cmp dword [eax], 8
jae 0x10029895
mov dword [ebp - 0x220], 1
jmp 0x1002989c
and dword [ebp - 0x220], 0
push 3
lea ecx, [ebp - 0x1c4]
call fcn.1002a774
push dword [eax]
lea ecx, [ebp - 0x1b8]
call fcn.1002a774
push 3
lea ecx, [ebp - 0x1c4]
call fcn.1002a774
mov esi, eax
push 0
lea ecx, [ebp - 0x1c4]
call fcn.1002a774
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x100298e4
mov dword [ebp - 0x218], 1
jmp 0x100298eb
and dword [ebp - 0x218], 0
mov esi, dword [ebp - 0x3c]
imul esi, dword [ebp - 0x218]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1b8]
call fcn.1002a774
cmp dword [eax], esi
jne 0x10029913
mov dword [ebp - 0x228], 1
jmp 0x1002991a
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x220]
sub eax, dword [ebp - 0x228]
sub eax, 0x4da8
je 0x1002999a
push 0x23d9
push 0x7862
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x1c8]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x1c4]
push eax
push 0x1d74
lea eax, [ebp - 0x4e4]
push eax
push 0x150d
push 1
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x592b
push 1
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x2c]
push eax
push 1
call fcn.1001b75e
add esp, 0x4c
jmp 0x10029a00
mov dword [ebp - 0x448], 0xffffffff
push 1
push 0x6284
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x1c4]
push eax
push 0x2d28
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x160]
push eax
push 1
push 0xa18
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.1001bc63
add esp, 0x38
cmp dword [ebp - 0x38], 0
je 0x10029a00
jmp 0x10029a3f
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x1c8]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.10026f91
add esp, 0x20
jmp 0x10029832
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x1c4]
call fcn.1002a758
jmp 0x100297a1
mov dword [ebp - 0x38], 0
jmp 0x10029a63
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x10029a7f
push dword [ebp - 0x38]
lea ecx, [ebp - 0x1b8]
call fcn.1002a774
mov dword [eax], 0x863074c8
jmp 0x10029a5c
jmp 0x10029762
jmp 0x10029735
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b8]
call fcn.1002a758
cmp dword [ebp - 0x454], 0
jne 0x1002a1c7
mov dword [ebp - 0x240], 0x4f19
mov dword [ebp - 0x460], 0x10009b20
cmp dword [ebp - 0x240], 0x50bb
jle 0x10029bd1
and dword [ebp - 0x10c], 0
jmp 0x10029adf
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x321b
jge 0x10029bd1
and dword [ebp - 0x104], 0
jmp 0x10029b05
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0xc34
jge 0x10029bcc
and dword [ebp - 0xf4], 0
jmp 0x10029b2b
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xaaf
jge 0x10029bc7
and dword [ebp - 0xfc], 0
jmp 0x10029b51
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0x4cd5
jge 0x10029bc2
mov ecx, dword [ebp - 0xf4]
sub ecx, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x104]
sar eax, cl
or eax, dword [ebp - 0x10c]
cdq
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x488], edx
push dword [ebp - 0x488]
push dword [ebp - 0x48c]
lea ecx, [ebp - 0x6f0]
call fcn.1000cd20
pop ecx
pop ecx
mov dword [ebp - 0x4c4], eax
mov ecx, dword [ebp - 0x4c4]
call fcn.1002a5a1
push eax
call fcn.100480d6
pop ecx
lea ecx, [ebp - 0x6f0]
call fcn.1002a597
jmp 0x10029b44
jmp 0x10029b1e
jmp 0x10029af8
jmp 0x10029ad2
mov dword [ebp - 4], 0x1a
cmp dword [ebp - 0x240], 0x4dc0
jge 0x10029bf0
push dword [ebp - 0x460]
call fcn.100480d6
pop ecx
jmp 0x10029c0c
or dword [ebp - 4], 0xffffffff
jmp 0x10029c16
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x55c], 0xab1d6a56
mov dword [ebp - 0x558], 0xab1d6a56
mov dword [ebp - 0x554], 0xab1d6a56
mov dword [ebp - 0x550], 0xab1d6a56
lea ecx, [ebp - 0x17d]
call fcn.1002a783
push eax
lea eax, [ebp - 0x54c]
push eax
lea eax, [ebp - 0x55c]
push eax
lea ecx, [ebp - 0x6c0]
call fcn.1002a786
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x390]
call fcn.1002a732
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x2d8], 1
mov dword [ebp - 0x2c0], 1
mov dword [ebp - 0x114], 0
jmp 0x10029cb5
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 1
jge 0x10029cd1
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x3ec], 0
jmp 0x10029ca8
cmp dword [ebp - 0x44], 0
je 0x10029ef8
mov dword [ebp - 0x250], 0xffffffff
mov dword [ebp - 0x168], 4
push 1
lea ecx, [ebp - 0x5c0]
call fcn.1002a6d6
mov byte [ebp - 4], 0x1d
push 3
lea ecx, [ebp - 0x590]
call fcn.1002a6d6
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x3dc], 0xffffffff
push 0x4326
push 1
push 0x5c8a
push 0x2b60
push 0x58a3
lea eax, [ebp - 0x5c0]
push eax
push 1
lea eax, [ebp - 0x3bc]
push eax
push 0x7ad7
push 1
call fcn.1001c5a7
add esp, 0x28
push 1
push 1
push 0x4cc1
lea eax, [ebp - 0x3bc]
push eax
lea eax, [ebp - 0x590]
push eax
push 0x11fa
push 0x4cbc
push 0x5c8e
call fcn.1001c73d
add esp, 0x20
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x168]
je 0x10029da8
mov dword [ebp - 0x260], 1
jmp 0x10029daf
and dword [ebp - 0x260], 0
push 0
lea ecx, [ebp - 0x390]
call fcn.1002a774
cmp dword [eax], 0x495231fb
jg 0x10029dd0
mov dword [ebp - 0x3c4], 1
jmp 0x10029dd7
and dword [ebp - 0x3c4], 0
push 0
lea ecx, [ebp - 0x390]
call fcn.1002a774
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x250]
jge 0x10029dfb
mov dword [ebp - 0x248], 1
jmp 0x10029e02
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x248]
sub eax, dword [ebp - 0x250]
imul eax, eax, 0xe819
cmp eax, 1
jl 0x10029e25
mov dword [ebp - 0x258], 1
jmp 0x10029e2c
and dword [ebp - 0x258], 0
push 0
lea ecx, [ebp - 0x390]
call fcn.1002a774
mov ecx, dword [ebp - 0x258]
imul ecx, dword [eax]
test ecx, ecx
jne 0x10029e58
mov eax, 0xfff8
test eax, eax
jne 0x10029e58
and dword [ebp - 0x3cc], 0
jmp 0x10029e62
mov dword [ebp - 0x3cc], 1
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x614], eax
mov esi, dword [ebp - 0x44]
push 0
lea ecx, [ebp - 0x5c0]
call fcn.1002a774
cmp esi, dword [eax]
je 0x10029e8b
mov dword [ebp - 0x3d4], 1
jmp 0x10029e92
and dword [ebp - 0x3d4], 0
push 0
lea ecx, [ebp - 0x590]
call fcn.1002a774
push 0
lea ecx, [ebp - 0x390]
call fcn.1002a774
mov ecx, dword [ebp - 0x260]
cmp ecx, dword [eax]
jg 0x10029ec2
mov dword [ebp - 0x268], 1
jmp 0x10029ec9
and dword [ebp - 0x268], 0
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x3dc], eax
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x590]
call fcn.1002a758
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x5c0]
call fcn.1002a758
jmp 0x1002a1b1
mov dword [ebp - 0x2b0], 0xfffffff9
mov dword [ebp - 0x270], 0x5892
mov dword [ebp - 0x3b8], 0x10009b78
cmp dword [ebp - 0x270], 0x5acc
jle 0x10029f99
and dword [ebp - 0x11c], 0
jmp 0x10029f38
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0x6fb0
jge 0x10029f99
and dword [ebp - 0x124], 0
jmp 0x10029f5a
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0x3d6c
jge 0x10029f97
mov eax, dword [ebp - 0x11c]
xor eax, dword [ebp - 0x124]
cdq
mov dword [ebp - 0x498], eax
mov dword [ebp - 0x494], edx
push dword [ebp - 0x494]
push dword [ebp - 0x498]
mov ecx, 0x10606538
call fcn.1002a5c1
jmp 0x10029f4d
jmp 0x10029f2b
mov dword [ebp - 0x3f4], 0xfffffffa
mov byte [ebp - 4], 0x1f
cmp dword [ebp - 0x270], 0x56b2
jge 0x10029fc3
mov edx, dword [ebp - 0x3b8]
mov ecx, 0x10606538
call fcn.1002c06b
jmp 0x10029fdf
mov dword [ebp - 4], 0x1c
jmp 0x10029fef
mov dword [ebp - 0x170], 0xf39ab1b5
push 0x8f2
push 0x5e82
push 0x6fd
push 1
push 1
push 0x13d4
lea eax, [ebp - 0x2d8]
push eax
call fcn.1001c8c2
add esp, 0x1c
cmp dword [ebp - 0x44], 0
je 0x1002a09f
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x278], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x278]
mov dword [ebp + eax - 0x3ec], ecx
cmp dword [ebp - 0x278], 1
jne 0x1002a05a
mov dword [ebp - 0x280], 1
jmp 0x1002a061
and dword [ebp - 0x280], 0
push 0
lea ecx, [ebp - 0x390]
call fcn.1002a774
mov ecx, dword [ebp - 0x280]
cmp ecx, dword [eax]
jne 0x1002a084
mov dword [ebp - 0x288], 1
jmp 0x1002a08b
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x288]
je 0x1002a09f
and dword [ebp - 0x290], 0
jmp 0x1002a0a9
mov dword [ebp - 0x290], 1
push 0
lea ecx, [ebp - 0x390]
call fcn.1002a774
mov ecx, dword [ebp - 0x290]
cmp ecx, dword [eax]
jle 0x1002a0cc
mov dword [ebp - 0x298], 1
jmp 0x1002a0d3
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0x298], eax
jge 0x1002a0ed
mov dword [ebp - 0x2a0], 1
jmp 0x1002a0f4
and dword [ebp - 0x2a0], 0
cmp dword [ebp - 0x2a0], 3
jl 0x1002a109
mov dword [ebp - 0x2a8], 1
jmp 0x1002a110
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x2b0], 9
jne 0x1002a131
mov dword [ebp - 0x2b8], 1
jmp 0x1002a138
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x2b8], eax
jle 0x1002a152
mov dword [ebp - 0x2c8], 1
jmp 0x1002a159
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x2c0]
cmp eax, dword [ebp - 0x2c8]
jle 0x1002a173
mov dword [ebp - 0x2d0], 1
jmp 0x1002a17a
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
imul eax, dword [ebp - 0x2d8]
imul eax, dword [ebp - 0x170]
test eax, eax
jne 0x1002a1a3
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x64], eax
jmp 0x1002a1b1
mov byte [ebp - 0x47], 0
lea eax, [ebp - 0x47]
push eax
call fcn.10027047
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x390]
call fcn.1002a758
xor eax, eax
jmp 0x1002a4bb
lea eax, [ebp - 0x20]
push eax
call fcn.10027075
pop ecx
mov dword [ebp - 0x6c], 0x214c405b
mov dword [ebp - 0x24], 0xfffffffb
push 3
lea ecx, [ebp - 0x534]
call fcn.1002a6d6
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x178], 2
mov dword [ebp - 0x308], 0x72c40a98
mov dword [ebp - 0x404], 6
mov dword [ebp - 0x12c], 0
jmp 0x1002a22a
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 3
jge 0x1002a24c
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x534]
call fcn.1002a774
mov dword [eax], 0xfffffffa
jmp 0x1002a21d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2e0], eax
push 0
lea ecx, [ebp - 0x534]
call fcn.1002a774
mov ecx, dword [ebp - 0x2e0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x2e0]
jge 0x1002a281
mov dword [ebp - 0x2e8], 1
jmp 0x1002a288
and dword [ebp - 0x2e8], 0
imul eax, dword [ebp - 0x2e8], 9
sub eax, dword [ebp - 0x6c]
imul eax, dword [ebp - 0x24]
cmp dword [ebp - 0x6c], eax
jg 0x1002a2a7
mov dword [ebp - 0x2f0], 1
jmp 0x1002a2ae
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x61c], eax
cmp dword [ebp - 0x24], 0x41ce3cb5
jne 0x1002a2e4
mov dword [ebp - 0x3fc], 1
jmp 0x1002a2eb
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x62c], eax
cmp dword [ebp - 0x6c], 0x91f6
jle 0x1002a312
mov dword [ebp - 0x2f8], 1
jmp 0x1002a319
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x2f8]
test eax, eax
jne 0x1002a333
mov dword [ebp - 0x300], 1
jmp 0x1002a33a
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x404], eax
mov dword [ebp - 0x310], 0x4c51
mov dword [ebp - 0x414], 0x10009be4
cmp dword [ebp - 0x310], 0x4fd1
jle 0x1002a416
and dword [ebp - 0x134], 0
jmp 0x1002a38c
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x4921
jge 0x1002a416
and dword [ebp - 0x13c], 0
jmp 0x1002a3ae
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0x507d
jge 0x1002a411
mov eax, dword [ebp - 0x134]
add eax, dword [ebp - 0x13c]
cdq
mov dword [ebp - 0x4a4], eax
mov dword [ebp - 0x4a0], edx
push dword [ebp - 0x4a0]
push dword [ebp - 0x4a4]
lea ecx, [ebp - 0x720]
call fcn.1000cd20
pop ecx
pop ecx
mov dword [ebp - 0x40c], eax
mov ecx, dword [ebp - 0x40c]
call fcn.1002a5a1
push eax
call fcn.100480d6
pop ecx
lea ecx, [ebp - 0x720]
call fcn.1002a597
jmp 0x1002a3a1
jmp 0x1002a37f
mov dword [ebp - 0x24], 0
jmp 0x1002a426
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffe4
jge 0x1002a443
lea eax, [ebp - 0x534]
push eax
lea eax, [ebp - 0x178]
push eax
call fcn.1002708f
pop ecx
pop ecx
jmp 0x1002a41f
mov byte [ebp - 4], 0x22
cmp dword [ebp - 0x310], 0x4970
jge 0x1002a45f
push dword [ebp - 0x414]
call fcn.100480d6
pop ecx
jmp 0x1002a47b
mov dword [ebp - 4], 0x21
jmp 0x1002a48b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x534]
call fcn.1002a758
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x10], 0
je 0x1002a4ae
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x324], eax
jmp 0x1002a4b5
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x324]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret