Function at 0x10037119
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10072f1e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x888
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1003b217
lea eax, [ebp + 0x20]
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x490], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x498], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x534], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x53c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x4ac]
movzx eax, byte [eax]
test eax, eax
je 0x1003af41
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0x88], eax
push 2
lea ecx, [ebp - 0x688]
call fcn.10021783
and dword [ebp - 4], 0
mov dword [ebp - 0xdc], 0x57976326
mov dword [ebp - 0x544], 0xffffffff
push 1
push 0x752
lea eax, [ebp - 0x6d8]
push eax
push 0x8ab
lea eax, [ebp - 0x688]
push eax
push 1
call fcn.10032996
add esp, 0x18
mov dword [ebp - 0xdc], 1
jmp 0x1003721d
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jl 0x10037286
mov dword [ebp - 0x554], 0x6f97
mov dword [ebp - 0x5b0], 0x15bb0028
mov dword [ebp - 0x54c], 9
lea eax, [ebp - 0x544]
push eax
lea eax, [ebp - 0x54c]
push eax
push 0x7b70
push 1
lea eax, [ebp - 0x554]
push eax
lea eax, [ebp - 0xdc]
push eax
push 1
lea eax, [ebp - 0x688]
push eax
lea eax, [ebp - 0x5b0]
push eax
push 0x2695
call fcn.1002cd7a
add esp, 0x28
jmp 0x10037210
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x688]
call fcn.10021805
and dword [ebp - 0x30], 0
push 1
lea ecx, [ebp - 0x770]
call fcn.10021783
mov dword [ebp - 4], 1
mov dword [ebp - 0x124], 0xa4f833fc
push 0x3094
push 0x375f
lea eax, [ebp - 0x724]
push eax
push 0xda0
lea eax, [ebp - 0x770]
push eax
push 0
push 0
push 0x40e2
push 1
call fcn.10033630
add esp, 0x24
mov byte [ebp - 0x61], 0
movzx eax, byte [ebp - 0x61]
test eax, eax
je 0x100372fe
push 0
push 1
call fcn.10031783
pop ecx
pop ecx
mov dword [ebp - 0x124], 0
jmp 0x10037317
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jg 0x1003733b
mov byte [ebp - 0x56], 0
lea eax, [ebp - 0x56]
push eax
push 1
push 0x28bb
push 0
call fcn.1002fbd9
add esp, 0x10
jmp 0x1003730a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x770]
call fcn.10021805
mov dword [ebp - 0x94], 0xffffffff
mov dword [ebp - 0x1f8], 0xffffffff
mov dword [ebp - 0x468], 0x53a0
mov dword [ebp - 0x94], 0
jmp 0x10037381
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xfffffff6
jle 0x1003786f
push 2
lea ecx, [ebp - 0x208]
call fcn.10021783
mov dword [ebp - 4], 2
mov dword [ebp - 0x9c], 0xffff
mov dword [ebp - 0x52c], 0x8a59
mov dword [ebp - 0x30c], 0x3331
mov dword [ebp - 0x5b8], 0x100082c8
cmp dword [ebp - 0x30c], 0x3416
jle 0x10037497
and dword [ebp - 0x100], 0
jmp 0x100373f0
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0x383c
jge 0x10037485
and dword [ebp - 0x158], 0
jmp 0x10037416
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0x2b03
jge 0x10037480
and dword [ebp - 0x108], 0
jmp 0x10037438
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0x2964
jge 0x1003747e
mov eax, dword [ebp - 0x100]
cdq
idiv dword [ebp - 0x158]
sub edx, dword [ebp - 0x108]
mov eax, edx
cdq
mov dword [ebp - 0x560], eax
mov dword [ebp - 0x55c], edx
push dword [ebp - 0x55c]
push dword [ebp - 0x560]
mov ecx, 0x1061af58
call fcn.10021543
jmp 0x1003742b
jmp 0x10037409
jmp 0x100373e3
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 1
push 0xf1c
push 0x76c2
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x7c4]
push eax
call fcn.1003b2a2
add esp, 0x18
mov byte [ebp - 4], 3
cmp dword [ebp - 0x30c], 0x31f5
jge 0x100374db
mov edx, dword [ebp - 0x5b8]
mov ecx, 0x1061af58
call fcn.10025cea
jmp 0x100374f7
mov dword [ebp - 4], 2
jmp 0x10037507
push 0
lea ecx, [ebp - 0x208]
call fcn.10021821
mov dword [eax], 0xffffffe3
jmp 0x10037540
push 0
lea ecx, [ebp - 0x208]
call fcn.10021821
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x3e0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3e0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x208]
call fcn.10021821
cmp dword [eax], 0xffffffe3
jge 0x10037839
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x5d0], 0xffffffff
mov dword [ebp - 0x48], 0
jmp 0x10037577
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xffffffe3
jge 0x100377fa
mov dword [ebp - 0x60], 0xdd952eaa
mov dword [ebp - 0x60], 0
jmp 0x10037598
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xfffffffb
jge 0x100377f5
push 2
lea ecx, [ebp - 0x608]
call fcn.10021783
mov byte [ebp - 4], 5
mov dword [ebp - 0xbc], 0xd46758e3
lea eax, [ebp - 0x608]
push eax
push 0x479
push 0x27cc
push 1
push 1
push 0x6b9a
push 0x6c3a
push 0x296e
push 0x2104
push 0x5df5
push 0x7d41
lea eax, [ebp - 0x72c]
push eax
call fcn.1002cf45
add esp, 0x30
mov byte [ebp - 0x58], 0
movzx eax, byte [ebp - 0x58]
test eax, eax
je 0x10037635
push 1
push 0x594b
push 0
push 0x66f6
push 0x74c8
push 0x2acb
push 0x3f8f
push 0x37a2
call fcn.1003d981
add esp, 0x20
push 0
lea ecx, [ebp - 0x208]
call fcn.10021821
cmp dword [eax], 0
je 0x1003769e
cmp dword [ebp - 0xbc], 0
jne 0x10037692
mov esi, dword [ebp - 0x48]
mov edi, dword [ebp - 0xbc]
push 0
lea ecx, [ebp - 0x208]
call fcn.10021821
sub edi, dword [eax]
imul edi, esi
mov dword [ebp - 0x1f8], edi
mov esi, dword [ebp - 0x1f8]
imul esi, dword [ebp - 0x94]
push 0
lea ecx, [ebp - 0x208]
call fcn.10021821
imul esi, dword [eax]
test esi, esi
je 0x1003769e
mov dword [ebp - 0x5c0], 1
jmp 0x100376a5
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x5c8], eax
push 1
lea ecx, [ebp - 0x608]
call fcn.10021821
mov ecx, dword [ebp - 0x5c8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x60]
sub eax, dword [ebp - 0x48]
jne 0x100376d7
mov dword [ebp - 0x400], 1
jmp 0x100376de
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0x400]
cmp eax, dword [ebp - 0x48]
jle 0x100376fb
mov dword [ebp - 0x408], 1
jmp 0x10037702
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x408], eax
je 0x10037719
mov dword [ebp - 0x410], 1
jmp 0x10037720
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x410]
jle 0x1003773a
mov dword [ebp - 0x3d8], 1
jmp 0x10037741
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x3d8], eax
jle 0x1003776b
cmp dword [ebp - 0x60], 0
je 0x10037769
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x608]
call fcn.10021805
jmp 0x100377f5
jmp 0x100377e1
mov dword [ebp - 0x9c], 0xffffffeb
jmp 0x10037784
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xe
jg 0x100377d7
mov dword [ebp - 0x180], 0
jmp 0x100377a6
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 3
jge 0x100377c2
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x808], 2
jmp 0x10037799
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x808]
inc eax
mov dword [ebp - 0xbc], eax
jmp 0x10037777
mov dword [ebp - 0xbc], 0x70ce404d
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x608]
call fcn.10021805
jmp 0x10037591
jmp 0x10037570
push 0x589a
push 1
lea eax, [ebp - 0x5d0]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x52c]
push eax
push 1
push 1
lea eax, [ebp - 0x468]
push eax
call fcn.10032a79
add esp, 0x28
jmp 0x1003751c
lea eax, [ebp - 0x208]
push eax
push 0x1b44
push 0x5f35
push 0x4c85
push 1
push 0
call fcn.10031cf9
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x208]
call fcn.10021805
jmp 0x10037374
mov dword [ebp - 0xa4], 0xffffffff
mov dword [ebp - 0x320], 0x7cad7d71
mov dword [ebp - 0x3f0], 0xf889a278
mov dword [ebp - 0x18], 0
jmp 0x1003789d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x100378b3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x228], 1
jmp 0x10037896
mov dword [ebp - 0x18], 0
jmp 0x100378c3
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x100378d9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x440], 0xffffffff
jmp 0x100378bc
mov dword [ebp - 0x18], 0
jmp 0x100378e9
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x100378ff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x444], 0
jmp 0x100378e2
cmp dword [ebp - 0xa4], 0
je 0x10037971
cmp dword [ebp - 0xa4], 0xffffffff
je 0x1003791d
mov dword [ebp - 0x218], 1
jmp 0x10037924
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0xa4]
imul eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0x218]
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x220], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x220]
mov dword [ebp + eax - 0x228], ecx
cmp dword [ebp - 0x220], 0
je 0x10037971
mov dword [ebp - 0x394], 1
jmp 0x10037978
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x394]
jg 0x1003799f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x228], 0
jne 0x1003799f
and dword [ebp - 0x324], 0
jmp 0x100379a9
mov dword [ebp - 0x324], 1
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x324], eax
jl 0x100379c3
mov dword [ebp - 0x230], 1
jmp 0x100379ca
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x3f0], eax
cmp dword [ebp - 0x3f0], 0
je 0x100379fb
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x440], 0
je 0x100379fb
mov dword [ebp - 0x238], 1
jmp 0x10037a02
and dword [ebp - 0x238], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x238]
mov dword [ebp + eax - 0x444], ecx
push 1
push 0x2904
push 0x6fbc
push 0x654
push 0x1298
push 0x267
push 0x4d99
lea eax, [ebp - 0x1c8]
push eax
push 0x5faf
push 1
push 0x6b88
lea eax, [ebp - 0x1d0]
push eax
push 0x8a9
call fcn.1002ec9b
add esp, 0x34
mov eax, dword [ebp - 0x1c8]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1003802f
mov dword [ebp - 0x110], 0xffffffff
mov dword [ebp - 0x514], 4
mov dword [ebp - 0x110], 7
jmp 0x10037a9d
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x19
jl 0x10037b8d
push 1
lea ecx, [ebp - 0x5e0]
call fcn.10021783
mov dword [ebp - 4], 6
push 1
push 0x33f4
lea eax, [ebp - 0x7dc]
push eax
push 0x4167
lea eax, [ebp - 0x5e0]
push eax
push 1
call fcn.1002f097
add esp, 0x18
push 0x78b6
push 1
push 0
push 0x6bc8
call fcn.100364c6
add esp, 0x10
push 0
lea ecx, [ebp - 0x5e0]
call fcn.10021821
and dword [eax], 0
jmp 0x10037b2e
push 0
lea ecx, [ebp - 0x5e0]
call fcn.10021821
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x32c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x32c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x5e0]
call fcn.10021821
cmp dword [eax], 0xb
je 0x10037b79
mov dword [ebp - 0x514], 1
mov byte [ebp - 0x57], 0
push 0x11a2
push 0x52f9
push 0x652a
push 0x26d7
push 0x3c91
push 1
lea eax, [ebp - 0x57]
push eax
push 1
call fcn.10032e24
add esp, 0x20
jmp 0x10037b0a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5e0]
call fcn.10021805
jmp 0x10037a90
mov dword [ebp - 0x44c], 0xffffffff
mov dword [ebp - 0x1cc], 0x4dbbe568
mov dword [ebp - 0x734], 0x7993
push 2
lea ecx, [ebp - 0x6a0]
call fcn.10021783
mov dword [ebp - 4], 7
mov dword [ebp - 0x474], 1
mov dword [ebp - 0x7e4], 0xfffffff7
mov dword [ebp - 0x73c], 0x603f559c
mov dword [ebp - 0x7d0], 0
mov dword [ebp - 0x47c], 0x97c2
mov dword [ebp - 0x240], 0xf15f1d34
mov dword [ebp - 0x454], 0x9a3a768f
mov dword [ebp - 0x744], 0x3ba0
lea eax, [ebp - 0x7e8]
push eax
lea eax, [ebp - 0x6a0]
push eax
push 0x2606
push 1
push 0x6527
push 0x66e0
push 1
call fcn.1002f3d8
add esp, 0x1c
push 0xa88
push 0
lea eax, [ebp - 0x44c]
push eax
push 1
lea eax, [ebp - 0x1cc]
push eax
push 0xf73
call fcn.1003bd2f
add esp, 0x18
mov eax, 0x2b5aa0f9
test eax, eax
je 0x10037f4a
mov dword [ebp - 0x520], 1
mov dword [ebp - 0x1f4], 0xdb80ebbd
mov dword [ebp - 0x74c], 0xfffffffe
mov dword [ebp - 0x760], 1
mov dword [ebp - 0x518], 0x9cee24b2
mov dword [ebp - 0x7d8], 0xfffffff9
mov dword [ebp - 0x1ec], 0xfffe
mov dword [ebp - 0x1d4], 1
mov dword [ebp - 0x774], 0xfffffff6
mov dword [ebp - 0x14], 0
jmp 0x10037cd3
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10037ce9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x758], 0x8407374f
jmp 0x10037ccc
mov dword [ebp - 0x14], 0
jmp 0x10037cf9
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10037d0f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x56c], 0xee4f120b
jmp 0x10037cf2
mov dword [ebp - 0x14], 0
jmp 0x10037d1f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x10037d35
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x464], 0xe7732c35
jmp 0x10037d18
push 6
pop eax
test eax, eax
je 0x10037e38
mov dword [ebp - 0x240], 0x36787572
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x5b4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5b4]
mov dword [ebp + eax - 0x758], ecx
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x6d4], eax
cmp dword [ebp - 0x454], 0xfffb
jne 0x10037d8d
mov dword [ebp - 0x39c], 1
jmp 0x10037d94
and dword [ebp - 0x39c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x56c]
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp - 0x39c]
sub eax, dword [ebp - 0x518]
mov dword [ebp - 0x57c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x56c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x56c], eax
mov eax, dword [ebp - 0x45c]
cmp eax, dword [ebp - 0x57c]
jne 0x10037dee
mov dword [ebp - 0x248], 1
jmp 0x10037df5
and dword [ebp - 0x248], 0
cmp dword [ebp - 0x248], 0
jg 0x10037e0a
mov dword [ebp - 0x334], 1
jmp 0x10037e11
and dword [ebp - 0x334], 0
imul eax, dword [ebp - 0x334], 0x879c
add eax, dword [ebp - 0x1d4]
je 0x10037e38
cmp dword [ebp - 0x1d4], 0
je 0x10037e38
mov dword [ebp - 0x250], 1
jmp 0x10037e3f
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0x823388
jg 0x10037e6f
mov dword [ebp - 0x3d4], 1
jmp 0x10037e76
and dword [ebp - 0x3d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x464]
cmp dword [ebp - 0x3d4], eax
jle 0x10037e97
mov dword [ebp - 0x258], 1
jmp 0x10037e9e
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x520]
add eax, dword [ebp - 0x258]
cmp dword [ebp - 0x1d4], eax
jne 0x10037ebe
mov dword [ebp - 0x33c], 1
jmp 0x10037ec5
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x46c], eax
push 1
lea ecx, [ebp - 0x6a0]
call fcn.10021821
mov ecx, dword [ebp - 0x33c]
sub ecx, dword [eax]
mov dword [ebp - 0x5cc], ecx
mov eax, dword [ebp - 0x1ec]
dec eax
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x46c]
cmp eax, dword [ebp - 0x5cc]
jne 0x10037f13
mov dword [ebp - 0x260], 1
jmp 0x10037f1a
and dword [ebp - 0x260], 0
cmp dword [ebp - 0x260], 0x3a4c924b
jl 0x10037f32
mov dword [ebp - 0x3a4], 1
jmp 0x10037f39
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x474], eax
jmp 0x10038012
mov dword [ebp - 0x528], 0xe7af825
mov dword [ebp - 0x588], 0xd2a19d8d
push 3
lea ecx, [ebp - 0x780]
call fcn.10021783
mov byte [ebp - 4], 8
mov dword [ebp - 0x484], 0x9107
mov dword [ebp - 0x160], 0
jmp 0x10037f92
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 3
jge 0x10037fb4
push dword [ebp - 0x160]
lea ecx, [ebp - 0x780]
call fcn.10021821
mov dword [eax], 0x73b00c6b
jmp 0x10037f85
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x47c]
push eax
push 0x2bd0
lea eax, [ebp - 0x588]
push eax
push 0x3893
push 1
push 1
push 0x27d4
push 0
call fcn.10033630
add esp, 0x24
push 1
push 0
push 0x53cf
lea eax, [ebp - 0x484]
push eax
push 0x29de
call fcn.1003e184
add esp, 0x14
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x780]
call fcn.10021805
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6a0]
call fcn.10021805
mov eax, dword [ebp - 0x88]
and dword [eax], 0
jmp 0x1003b249
mov dword [ebp - 0x670], 0xa57b5bf2
mov dword [ebp - 0x66c], 0xa57b5bf2
mov dword [ebp - 0x668], 0xa57b5bf2
mov dword [ebp - 0x664], 0xa57b5bf2
lea ecx, [ebp - 0x1ed]
call fcn.10021830
push eax
lea eax, [ebp - 0x660]
push eax
lea eax, [ebp - 0x670]
push eax
lea ecx, [ebp - 0x868]
call fcn.10021833
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x41c]
call fcn.100217df
mov dword [ebp - 4], 9
mov dword [ebp - 0xd4], 0x6ce4
mov dword [ebp - 0xc4], 0xfffffff8
mov dword [ebp - 0x530], 0xb3cf8132
mov dword [ebp - 0x48c], 0xafe4
mov dword [ebp - 0x49c], 0x5737
push 0
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.1003d75f
add esp, 0x14
mov dword [ebp - 0xd4], 0
jmp 0x10038104
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 6
jge 0x100384c9
mov dword [ebp - 0x2c], 0xf261718b
push 3
lea ecx, [ebp - 0x6c4]
call fcn.10021783
mov byte [ebp - 4], 0xa
push 0x5bbf
push 0x29b7
push 0
push 1
lea eax, [ebp - 0x6e0]
push eax
push 1
push 0xdfb
lea eax, [ebp - 0x6c4]
push eax
push 0x449c
call fcn.10033cde
add esp, 0x24
mov dword [ebp - 0xc4], 0xffffffff
jmp 0x10038172
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x16
je 0x100384b5
mov dword [ebp - 0xe4], 0xbf8b243e
mov dword [ebp - 0x6e8], 0xffffffff
mov dword [ebp - 0x6f0], 1
mov dword [ebp - 0x538], 0x27815014
mov dword [ebp - 0x6f8], 0x4bab92a1
mov dword [ebp - 0x700], 0xcc907f7a
mov dword [ebp - 0x708], 0xfffffffa
push 0x28c7
push 1
push 1
push 0x6eba
push 0x5adb
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.1002f6bc
add esp, 0x20
mov dword [ebp - 0x2c], 3
jmp 0x10038202
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x100384b0
mov dword [ebp - 0x710], 0x7c74e2b7
mov dword [ebp - 0x494], 0
mov dword [ebp - 0x718], 0xcbf6
mov dword [ebp - 0x5bc], 0x311140ae
mov dword [ebp - 0x1fc], 0xffffffff
mov dword [ebp - 0x720], 0x200138d7
mov dword [ebp - 0x1dc], 1
mov dword [ebp - 0xe4], 0
jmp 0x1003826b
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 3
jg 0x10038478
mov dword [ebp - 0x118], 0
jmp 0x10038291
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 3
jge 0x100382ad
mov eax, dword [ebp - 0x118]
mov dword [ebp + eax*4 - 0x814], 3
jmp 0x10038284
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
je 0x10038316
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x41c]
call fcn.10021821
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x728], eax
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x268], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x268]
mov dword [ebp + eax - 0x814], ecx
cmp dword [ebp - 0x268], 0
je 0x10038316
mov dword [ebp - 0x344], 1
jmp 0x1003831d
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x494], eax
push 1
lea ecx, [ebp - 0x6c4]
call fcn.10021821
mov eax, dword [eax]
neg eax
imul esi, eax, 0x7169
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x41c]
call fcn.10021821
cmp dword [eax], esi
jle 0x1003835e
mov dword [ebp - 0x270], 1
jmp 0x10038365
and dword [ebp - 0x270], 0
cmp dword [ebp - 0x270], 0
jl 0x1003837a
mov dword [ebp - 0x404], 1
jmp 0x10038381
and dword [ebp - 0x404], 0
cmp dword [ebp - 0x404], 0xffff
ja 0x10038399
mov dword [ebp - 0x278], 1
jmp 0x100383a0
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x538]
cmp dword [ebp - 0x278], eax
jne 0x100383ba
mov dword [ebp - 0x34c], 1
jmp 0x100383c1
and dword [ebp - 0x34c], 0
mov esi, dword [ebp - 0x2c]
push 0
lea ecx, [ebp - 0x41c]
call fcn.10021821
mov edi, dword [ebp - 0x34c]
sub edi, dword [eax]
imul edi, esi
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x41c]
call fcn.10021821
cmp edi, dword [eax]
je 0x100383fa
mov dword [ebp - 0x280], 1
jmp 0x10038401
and dword [ebp - 0x280], 0
cmp dword [ebp - 0x280], 0xfffffff7
jne 0x10038416
mov dword [ebp - 0x3ac], 1
jmp 0x1003841d
and dword [ebp - 0x3ac], 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x41c]
call fcn.10021821
mov eax, dword [eax]
cmp eax, dword [ebp - 0x3ac]
je 0x10038441
mov dword [ebp - 0x288], 1
jmp 0x10038448
and dword [ebp - 0x288], 0
cmp dword [ebp - 0x288], 0x4bb1
jg 0x10038460
mov dword [ebp - 0x354], 1
jmp 0x10038467
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0x49c], eax
jmp 0x1003825e
mov byte [ebp - 0x8c], 0
lea eax, [ebp - 0x8c]
push eax
push 1
push 0x7ba3
push 0x5c56
push 0x3101
push 1
push 0x544e
push 0x12b
call fcn.10032f71
add esp, 0x20
jmp 0x100381fb
jmp 0x10038165
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x6c4]
call fcn.10021805
jmp 0x100380f7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x41c]
call fcn.10021805
push 0x3e4d
lea eax, [ebp - 0xc8]
push eax
push 0x7a5c
push 0x47ad
lea eax, [ebp - 0x1d0]
push eax
push 1
push 1
push 0x7713
push 0x246f
lea eax, [ebp - 0x1c8]
push eax
push 1
push 0x1381
call fcn.100331ed
add esp, 0x30
mov dword [ebp - 0x548], 0xf7e7308
mov dword [ebp - 0x730], 0xad7d711e
mov dword [ebp - 0x540], 1
mov dword [ebp - 0x738], 0x9f42c60e
mov dword [ebp - 0x5e4], 0x8cf1d65f
push 2
lea ecx, [ebp - 0x7a0]
call fcn.10021783
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x740], 0xfffffffd
mov dword [ebp - 0x1e4], 0x9e63
mov dword [ebp - 0x34], 0
jmp 0x10038583
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x10038599
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1ac], 0x4fd3df75
jmp 0x1003857c
mov dword [ebp - 0x34], 0
jmp 0x100385a9
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x100385c2
push dword [ebp - 0x34]
lea ecx, [ebp - 0x7a0]
call fcn.10021821
and dword [eax], 0
jmp 0x100385a2
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1ac], 0
jmp 0x100385f0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1ac]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1ac], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1ac], 0xfffffff7
jl 0x1003895a
push 3
lea ecx, [ebp - 0x790]
call fcn.10021783
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x748], 0
mov dword [ebp - 0x750], 0xd76715f0
mov dword [ebp - 0x75c], 0xa4bedcc5
mov dword [ebp - 0x7ec], 0x3498e64e
mov dword [ebp - 0x2a8], 0xfffffff6
mov dword [ebp - 0x7f4], 0xffffffff
mov dword [ebp - 0x7fc], 0xfffffffb
mov dword [ebp - 0x290], 0x4576
mov dword [ebp - 0x4a4], 0x10008348
cmp dword [ebp - 0x290], 0x4713
jle 0x10038756
and dword [ebp - 0x120], 0
jmp 0x10038695
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x1d6e
jge 0x10038756
and dword [ebp - 0x168], 0
jmp 0x100386bb
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0x3e57
jge 0x10038751
and dword [ebp - 0x128], 0
jmp 0x100386e1
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0x709a
jge 0x1003874c
mov eax, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x168]
sar eax, cl
xor eax, dword [ebp - 0x128]
cdq
mov dword [ebp - 0x578], eax
mov dword [ebp - 0x574], edx
push dword [ebp - 0x574]
push dword [ebp - 0x578]
lea ecx, [ebp - 0x880]
call fcn.1000a4b3
pop ecx
pop ecx
mov dword [ebp - 0x594], eax
mov ecx, dword [ebp - 0x594]
call fcn.10021246
push eax
call fcn.10059c65
pop ecx
lea ecx, [ebp - 0x880]
call fcn.1002123c
jmp 0x100386d4
jmp 0x100386ae
jmp 0x10038688
mov dword [ebp - 0x3dc], 0xf889a278
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x290], 0x44bc
jge 0x1003877c
push dword [ebp - 0x4a4]
call fcn.10059c65
pop ecx
jmp 0x10038798
mov dword [ebp - 4], 0xc
jmp 0x100387a8
mov dword [ebp - 0x7f0], 9
mov dword [ebp - 0x4b4], 0x3f1571c0
mov dword [ebp - 0x430], 0x7a10dd66
push 1
lea eax, [ebp - 0xcc]
push eax
push 0x4318
push 0x6832
push 0x90a
push 0x4a59
push 1
push 0x7642
push 0x5185
lea eax, [ebp - 0x790]
push eax
call fcn.100334f9
add esp, 0x28
mov dword [ebp - 0xcc], 0
jmp 0x10038817
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x10038833
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x820], 1
jmp 0x1003880a
mov eax, dword [ebp - 0x540]
cmp eax, dword [ebp - 0x430]
jne 0x1003884d
mov dword [ebp - 0x298], 1
jmp 0x10038854
and dword [ebp - 0x298], 0
imul eax, dword [ebp - 0x5e4], 0x8fb26055
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0x3dc]
imul eax, dword [ebp - 0x2a8]
add eax, dword [ebp - 0x298]
cmp eax, dword [ebp - 0x4b4]
jl 0x1003888b
mov dword [ebp - 0x35c], 1
jmp 0x10038892
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x548]
imul eax, dword [ebp - 0x35c]
test eax, eax
jne 0x100388bb
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x820], 0
jne 0x100388bb
and dword [ebp - 0x2a0], 0
jmp 0x100388c5
mov dword [ebp - 0x2a0], 1
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x4bc], eax
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x5a0], eax
mov eax, dword [ebp - 0x1e4]
dec eax
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x4bc]
cmp eax, dword [ebp - 0x5a0]
jl 0x10038904
mov dword [ebp - 0x3b4], 1
jmp 0x1003890b
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x2a8], eax
mov byte [ebp - 0x59], 0
push 0x46fd
push 0x44df
push 0x5fe9
push 0x78b2
push 0x73f9
push 1
push 1
lea eax, [ebp - 0x59]
push eax
push 1
call fcn.10033630
add esp, 0x24
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x790]
call fcn.10021805
jmp 0x100385d5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7a0]
call fcn.10021805
mov eax, dword [ebp - 0xc8]
cmp dword [eax], 0x4550
je 0x10038f44
mov dword [ebp - 0x38], 1
mov dword [ebp - 0xb8], 0xfffffff6
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x634], 0xfffffff7
mov dword [ebp - 0x630], 0xfffffff7
mov dword [ebp - 0x62c], 0xfffffff7
mov dword [ebp - 0x628], 0xfffffff7
mov dword [ebp - 0x98], 0xa8d3a18e
push 4
lea ecx, [ebp - 0x614]
call fcn.10021783
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x194], 0
jmp 0x100389f5
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 4
jge 0x10038a17
push dword [ebp - 0x194]
lea ecx, [ebp - 0x614]
call fcn.10021821
mov dword [eax], 0x1d2d
jmp 0x100389e8
push 1
lea eax, [ebp - 0x98]
push eax
push 0x4a89
push 1
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.100337a7
add esp, 0x18
mov dword [ebp - 0x38], 0x3582f80c
cmp dword [ebp - 0x38], 0
je 0x10038b9d
mov dword [ebp - 0x364], 0xc9a130df
mov dword [ebp - 0x4cc], 0x62cc684c
mov dword [ebp - 0x38], 3
jmp 0x10038a6f
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x10038b4f
mov dword [ebp - 0x550], 0xfffffffe
mov dword [ebp - 0x98], 0
jmp 0x10038a9c
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jg 0x10038b4a
mov dword [ebp - 0xb8], 3
jmp 0x10038ac2
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jl 0x10038b15
mov dword [ebp - 0x4c4], 0xd0f4f230
mov dword [ebp - 0xb0], 0
jmp 0x10038aee
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jg 0x10038b08
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x634], 0
je 0x10038b06
jmp 0x10038b08
jmp 0x10038ae1
cmp dword [ebp - 0x4c4], 0
je 0x10038b13
jmp 0x10038ab5
jmp 0x10038ab5
lea eax, [ebp - 0x550]
push eax
lea eax, [ebp - 0x364]
push eax
push 1
push 1
push 0x3c5e
push 1
push 0x4e6f
push 0x24ed
push 0x3862
call fcn.10033cde
add esp, 0x24
jmp 0x10038a8f
jmp 0x10038a68
push 0x5256
push 1
lea eax, [ebp - 0x98]
push eax
push 1
lea eax, [ebp - 0x38]
push eax
push 0x3e22
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0xb8]
push eax
push 1
lea eax, [ebp - 0x614]
push eax
push 0x74d9
push 0x5742
lea eax, [ebp - 0x4cc]
push eax
call fcn.1002fede
add esp, 0x34
jmp 0x10038c3f
mov dword [ebp - 0x130], 0
jmp 0x10038bb6
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 3
jge 0x10038bd2
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x838], 5
jmp 0x10038ba9
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x838], 0x820e
mov eax, 0x820e
cmp eax, 0x7e64
jg 0x10038bfb
mov dword [ebp - 0x2b0], 1
jmp 0x10038c02
and dword [ebp - 0x2b0], 0
push 1
lea ecx, [ebp - 0x614]
call fcn.10021821
mov ecx, dword [ebp - 0x2b0]
cmp ecx, dword [eax]
jg 0x10038c25
mov dword [ebp - 0x3fc], 1
jmp 0x10038c2c
and dword [ebp - 0x3fc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3fc]
mov dword [ebp + eax - 0x634], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x614]
call fcn.10021805
mov dword [ebp - 0x2b8], 0x3c68
mov dword [ebp - 0x558], 0x10008388
cmp dword [ebp - 0x2b8], 0x3ccf
jle 0x10038d1e
and dword [ebp - 0x170], 0
jmp 0x10038c88
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0x742f
jge 0x10038d12
and dword [ebp - 0x138], 0
jmp 0x10038caa
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x1d22
jge 0x10038d0d
mov eax, dword [ebp - 0x170]
or eax, dword [ebp - 0x138]
cdq
mov dword [ebp - 0x584], eax
mov dword [ebp - 0x580], edx
push dword [ebp - 0x580]
push dword [ebp - 0x584]
lea ecx, [ebp - 0x898]
call fcn.1000a4b3
pop ecx
pop ecx
mov dword [ebp - 0x5c4], eax
mov ecx, dword [ebp - 0x5c4]
call fcn.10021246
push eax
call fcn.10059c65
pop ecx
lea ecx, [ebp - 0x898]
call fcn.1002123c
jmp 0x10038c9d
jmp 0x10038c7b
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
mov dword [ebp - 0x65c], 0xfffffff8
mov dword [ebp - 0x658], 0xfffffff8
mov dword [ebp - 0x654], 0xfffffff8
mov dword [ebp - 0x650], 0xfffffff8
lea ecx, [ebp - 0x1c1]
call fcn.10021830
push eax
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 0x65c]
push eax
lea ecx, [ebp - 0x858]
call fcn.10021833
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x6b8]
call fcn.100217df
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x3c], 0
jmp 0x10038d92
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x10038da8
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x424], 0x24a8c6a5
jmp 0x10038d8b
mov dword [ebp - 0x3c], 0
jmp 0x10038db8
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x10038dce
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x3ec], 0xfb1c0380
jmp 0x10038db1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x424], 0
jmp 0x10038dfc
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x424]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x424], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x424], 0xf
jne 0x10038e84
mov dword [ebp - 0x1a4], 0x1836ccb0
mov dword [ebp - 0x4d4], 0x61d2250d
mov dword [ebp - 0x1a4], 0
jmp 0x10038e39
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 3
jg 0x10038e68
mov byte [ebp - 0x89], 0
push 1
push 1
lea eax, [ebp - 0x89]
push eax
call fcn.10033f6f
add esp, 0xc
mov dword [ebp - 0x4d4], 0x3066c93e
jmp 0x10038e2c
push 3
lea ecx, [ebp - 0x6b8]
call fcn.10021821
cmp dword [eax], 0
je 0x10038e7f
jmp 0x10038de1
jmp 0x10038de1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x3ec], 0
jmp 0x10038eb2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3ec]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3ec], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3ec], 4
jge 0x10038ee2
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x3ec]
lea ecx, [ebp - 0x6b8]
call fcn.10021821
mov dword [eax], 1
jmp 0x10038e97
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6b8]
call fcn.10021805
mov dword [ebp - 4], 0x11
cmp dword [ebp - 0x2b8], 0x3a29
jge 0x10038f10
push dword [ebp - 0x558]
call fcn.10059c65
pop ecx
jmp 0x10038f2c
or dword [ebp - 4], 0xffffffff
jmp 0x10038f36
mov eax, dword [ebp - 0x88]
and dword [eax], 0
jmp 0x1003b249
mov dword [ebp - 0x20], 0xa61928c1
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x20], 0
jmp 0x10038f65
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe4
je 0x100391a1
push 3
lea ecx, [ebp - 0x1c0]
call fcn.10021783
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x4e4], 0
push 0x1c28
push 0x12a5
push 0
lea eax, [ebp - 0x764]
push eax
lea eax, [ebp - 0x1c0]
push eax
push 0xea6
push 1
call fcn.10030e8c
add esp, 0x1c
push 0
lea ecx, [ebp - 0x1c0]
call fcn.10021821
cmp dword [ebp - 0x20], 0
jne 0x10039089
push 0
lea ecx, [ebp - 0x1c0]
call fcn.10021821
mov esi, eax
push 2
lea ecx, [ebp - 0x1c0]
call fcn.10021821
mov eax, dword [eax]
cmp eax, dword [esi]
jle 0x10038ffb
mov dword [ebp - 0x4dc], 1
jmp 0x10039002
and dword [ebp - 0x4dc], 0
push 0
lea ecx, [ebp - 0x1c0]
call fcn.10021821
cmp dword [ebp - 0x20], 0
jne 0x10039019
cmp dword [ebp - 0x20], 0
push 0
lea ecx, [ebp - 0x1c0]
call fcn.10021821
cmp dword [eax], 0
je 0x10039052
push 1
lea ecx, [ebp - 0x1c0]
call fcn.10021821
cmp dword [eax], 0
je 0x10039052
mov eax, 0xa2522abf
test eax, eax
je 0x10039052
mov dword [ebp - 0x36c], 1
jmp 0x10039059
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x36c], eax
jge 0x10039089
push 6
pop eax
test eax, eax
jne 0x10039089
push 0
lea ecx, [ebp - 0x1c0]
call fcn.10021821
cmp dword [eax], 0
jne 0x10039089
mov dword [ebp - 0x2c0], 1
jmp 0x10039090
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x2c0], eax
je 0x100390a7
mov dword [ebp - 0x3bc], 1
jmp 0x100390ae
and dword [ebp - 0x3bc], 0
push 0
lea ecx, [ebp - 0x1c0]
call fcn.10021821
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x6dc], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x7f8], eax
cmp dword [ebp - 0x20], 0xb63e91cb
jae 0x100390f1
mov dword [ebp - 0x2c8], 1
jmp 0x100390f8
and dword [ebp - 0x2c8], 0
cmp dword [ebp - 0x2c8], 7
jle 0x1003910d
mov dword [ebp - 0x374], 1
jmp 0x10039114
and dword [ebp - 0x374], 0
push 0
lea ecx, [ebp - 0x1c0]
call fcn.10021821
mov ecx, dword [ebp - 0x374]
sub ecx, dword [eax]
je 0x10039140
cmp dword [ebp - 0x140], 0
je 0x10039140
mov dword [ebp - 0x5ac], 1
jmp 0x10039147
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x6e4], eax
xor eax, eax
inc eax
jne 0x10039167
cmp dword [ebp - 0x140], 0
jne 0x10039167
and dword [ebp - 0x2d0], 0
jmp 0x10039171
mov dword [ebp - 0x2d0], 1
push 2
lea ecx, [ebp - 0x1c0]
call fcn.10021821
mov ecx, dword [ebp - 0x2d0]
imul ecx, dword [eax]
mov dword [ebp - 0x4e4], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c0]
call fcn.10021805
jmp 0x10038f5e
push 0x109b
lea eax, [ebp - 0x11c]
push eax
push 1
push 1
push 0x6952
push 0x3054
push 0x5c34
push 1
push 0x1e68
lea eax, [ebp - 0xc8]
push eax
push 0x4c0e
push 0x46fd
call fcn.10030237
add esp, 0x30
push 1
lea ecx, [ebp - 0x6d0]
call fcn.10021783
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x148], 0xc70bb743
mov dword [ebp - 0x178], 0
jmp 0x10039217
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 1
jge 0x10039236
push dword [ebp - 0x178]
lea ecx, [ebp - 0x6d0]
call fcn.10021821
and dword [eax], 0
jmp 0x1003920a
mov dword [ebp - 0x148], 0
jmp 0x1003924f
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
jg 0x10039309
mov dword [ebp - 0x19c], 0
jmp 0x10039275
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 2
jge 0x10039291
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x42c], 0xff55e00f
jmp 0x10039268
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x42c], 0
jmp 0x100392bf
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x42c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x42c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x42c], 0
jg 0x10039304
mov dword [ebp - 0x564], 0xfffffffe
lea eax, [ebp - 0x564]
push eax
push 0x67de
push 1
push 0x21ff
push 0x6f92
lea eax, [ebp - 0x6d0]
push eax
push 1
call fcn.10030e8c
add esp, 0x1c
jmp 0x100392a4
jmp 0x10039242
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6d0]
call fcn.10021805
cmp dword [ebp - 0x11c], 0
jne 0x100395b1
push 1
lea ecx, [ebp - 0x18c]
call fcn.10021783
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x2d8], 0xfffffff8
mov dword [ebp - 0x4ec], 0x3b8a277e
mov dword [ebp - 0xc0], 0
jmp 0x10039366
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jge 0x10039382
mov eax, dword [ebp - 0xc0]
mov dword [ebp + eax*4 - 0x5fc], 0
jmp 0x10039359
push 0x6011
push 0
push 1
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0xc0]
push eax
push 0xa6a
push 0x3a90
call fcn.10036e68
add esp, 0x1c
push 0
lea ecx, [ebp - 0x18c]
call fcn.10021821
mov dword [eax], 2
jmp 0x100393e4
push 0
lea ecx, [ebp - 0x18c]
call fcn.10021821
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x3e4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x3e4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x18c]
call fcn.10021821
cmp dword [eax], 0
jl 0x10039424
push 0
lea ecx, [ebp - 0x18c]
call fcn.10021821
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x5fc]
push 0
lea ecx, [ebp - 0x18c]
call fcn.10021821
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x5fc], esi
jmp 0x100393c0
mov eax, dword [ebp - 0x2d8]
cmp eax, dword [ebp - 0x2d8]
jge 0x1003943e
mov dword [ebp - 0x2e0], 1
jmp 0x10039445
and dword [ebp - 0x2e0], 0
push 0
lea ecx, [ebp - 0x18c]
call fcn.10021821
mov esi, eax
push 0
lea ecx, [ebp - 0x18c]
call fcn.10021821
mov eax, dword [eax]
cmp eax, dword [esi]
jge 0x10039473
mov dword [ebp - 0x37c], 1
jmp 0x1003947a
and dword [ebp - 0x37c], 0
push 0
lea ecx, [ebp - 0x18c]
call fcn.10021821
mov ecx, dword [ebp - 0x37c]
cmp ecx, dword [eax]
jl 0x100394ac
push 0
lea ecx, [ebp - 0x18c]
call fcn.10021821
cmp dword [eax], 0
jne 0x100394ac
and dword [ebp - 0x3c4], 0
jmp 0x100394b6
mov dword [ebp - 0x3c4], 1
mov eax, dword [ebp - 0x2e0]
cmp eax, dword [ebp - 0x3c4]
je 0x100394d0
mov dword [ebp - 0x2e8], 1
jmp 0x100394d7
and dword [ebp - 0x2e8], 0
push 0
lea ecx, [ebp - 0x18c]
call fcn.10021821
mov eax, dword [eax]
cmp eax, dword [ebp - 0x2e8]
je 0x100394fa
mov dword [ebp - 0x384], 1
jmp 0x10039501
and dword [ebp - 0x384], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5fc]
cmp eax, dword [ebp - 0x384]
jg 0x10039522
mov dword [ebp - 0x2f0], 1
jmp 0x10039529
and dword [ebp - 0x2f0], 0
push 0
lea ecx, [ebp - 0x18c]
call fcn.10021821
mov ecx, dword [ebp - 0x2f0]
add ecx, dword [eax]
mov dword [ebp - 0x40c], ecx
push 0
lea ecx, [ebp - 0x18c]
call fcn.10021821
mov ecx, dword [ebp - 0x40c]
mov dword [eax], ecx
cmp dword [ebp - 0x40c], 0x193c
jg 0x10039581
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5fc], 0
je 0x10039581
mov dword [ebp - 0x2f8], 1
jmp 0x10039588
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x4ec], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18c]
call fcn.10021805
mov eax, dword [ebp - 0x88]
and dword [eax], 0
jmp 0x1003b249
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0xc8]
push eax
push 0x3ce1
lea eax, [ebp - 0x784]
push eax
lea eax, [ebp - 0x1c8]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x6564
push 0
call fcn.1003e22f
add esp, 0x20
push 0x93d
push 0x77
push 0x6858
push 0
push 0x78a0
push dword [ebp - 0x1d0]
push 0
push 0x27e8
push dword [ebp - 0x30]
push 1
push dword [ebp - 0xc8]
call fcn.10029131
add esp, 0x2c
mov dword [ebp - 0x28], 0x149febb6
mov dword [ebp - 0xec], 0
jmp 0x10039638
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 2
jge 0x10039654
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x3f8], 0xfffffff8
jmp 0x1003962b
cmp dword [ebp - 0x28], 0
je 0x1003969a
cmp dword [ebp - 0x28], 0x3a34c865
jl 0x1003966f
mov dword [ebp - 0x38c], 1
jmp 0x10039676
and dword [ebp - 0x38c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f8]
imul eax, dword [ebp - 0x38c]
test eax, eax
je 0x1003969a
mov dword [ebp - 0x300], 1
jmp 0x100396a1
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x300]
jl 0x100396b8
mov dword [ebp - 0x3cc], 1
jmp 0x100396bf
and dword [ebp - 0x3cc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x3cc]
cmp ecx, dword [ebp + eax - 0x3f8]
jg 0x100396e3
mov dword [ebp - 0x308], 1
jmp 0x100396ea
and dword [ebp - 0x308], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3f8]
cmp dword [ebp - 0x308], eax
jne 0x1003970b
mov dword [ebp - 0x310], 1
jmp 0x10039712
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x310]
jne 0x1003972c
cmp dword [ebp - 0x28], 0
jne 0x1003972c
and dword [ebp - 0x210], 0
jmp 0x10039736
mov dword [ebp - 0x210], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3f8]
cmp dword [ebp - 0x210], eax
jne 0x10039768
push 1
push 0x4db2
push 0x1a23
push 1
push 0x24d6
call fcn.10031021
add esp, 0x14
jmp 0x100397a5
mov byte [ebp - 0x8b], 0
push 0
lea eax, [ebp - 0x8b]
push eax
call fcn.1003d8f3
pop ecx
pop ecx
mov dword [ebp - 0x28], 0
jmp 0x1003978f
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x100397a5
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x3f8], 0x8807383c
jmp 0x10039788
push 0x36d
lea eax, [ebp - 0x11c]
push eax
push 1
push 1
push 0x1de6
lea eax, [ebp - 0xc8]
push eax
push 0x64ee
lea eax, [ebp - 0x214]
push eax
call fcn.10034302
add esp, 0x20
cmp dword [ebp - 0x214], 0
je 0x10039838
push 0x386a
push 0xd55
push 0x63ba
push 0x3dcb
push 0x618f
push 1
push 0x4076
push 0x41b9
push 0x49a3
push 0x31d1
push 0
call fcn.10031183
add esp, 0x2c
push 0x5ea
push 0x306b
push 1
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x30]
push eax
push 1
call fcn.100343f3
add esp, 0x18
mov dword [ebp - 0x70], 0xffffffff
mov dword [ebp - 0x224], 0xffffffff
mov dword [ebp - 0x234], 1
mov dword [ebp - 0x23c], 0x5746ac1d
mov dword [ebp - 0x6ec], 9
mov dword [ebp - 0x70], 6
jmp 0x10039877
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xfffffff2
jl 0x10039ad4
mov dword [ebp - 0xa0], 0xecb45710
mov dword [ebp - 0x21c], 1
mov dword [ebp - 0x150], 0
jmp 0x100398ae
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jge 0x100398ca
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x850], 0x96f8f9ed
jmp 0x100398a1
mov dword [ebp - 0xa0], 0
jmp 0x100398e3
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0x1b
je 0x10039a98
mov dword [ebp - 0x68], 0xf257
mov dword [ebp - 0x22c], 0x2f20920a
mov dword [ebp - 0x5d4], 0xfffffffe
mov dword [ebp - 0x4f4], 0x6969e96c
lea eax, [ebp - 0x70]
push eax
push 1
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
lea eax, [ebp - 0xa0]
push eax
push 0x5314
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.1003c0a8
add esp, 0x28
mov dword [ebp - 0x68], 2
jmp 0x10039961
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x10039a93
mov dword [ebp - 0x24c], 9
push 1
push 1
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x70]
push eax
push 0x5fb
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x24c]
push eax
push 0x7570
call fcn.10031314
add esp, 0x30
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x70]
jg 0x100399d1
mov dword [ebp - 0x25c], 1
jmp 0x100399d8
and dword [ebp - 0x25c], 0
cmp dword [ebp - 0x23c], 0
je 0x10039a27
cmp dword [ebp - 0x23c], 0xf7ce
jne 0x100399f2
xor eax, eax
inc eax
je 0x10039a07
cmp dword [ebp - 0x5d4], 0
je 0x10039a07
mov dword [ebp - 0x244], 1
jmp 0x10039a0e
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x244]
sub eax, 0x5fdcf5da
je 0x10039a27
mov dword [ebp - 0x254], 1
jmp 0x10039a2e
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x24c]
imul eax, dword [ebp - 0x254]
cmp dword [ebp - 0x25c], eax
je 0x10039a4f
mov dword [ebp - 0x264], 1
jmp 0x10039a56
and dword [ebp - 0x264], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x850]
sub eax, dword [ebp - 0x264]
cmp eax, 0x615b38d6
je 0x10039a7b
mov dword [ebp - 0x26c], 1
jmp 0x10039a82
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x4f4], eax
jmp 0x1003995a
jmp 0x100398d6
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x10039acf
push 1
push 0x2b3d
push 0x1d06
push 0x7d92
push 0x4dba
push 1
push 0x700c
call fcn.10031808
add esp, 0x1c
jmp 0x10039870
push dword [ebp - 0x30]
call fcn.1002cb60
pop ecx
test eax, eax
jne 0x10039d0b
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0xf8], 0
jmp 0x10039b08
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jge 0x10039b24
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x1b4], 9
jmp 0x10039afb
mov dword [ebp - 0x274], 0x10e2
mov dword [ebp - 0x570], 0x10008418
cmp dword [ebp - 0x274], 0x1164
jle 0x10039bbd
and dword [ebp - 0xfc], 0
jmp 0x10039b5a
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0x6221
jge 0x10039bbd
and dword [ebp - 0x104], 0
jmp 0x10039b7c
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x57da
jge 0x10039bbb
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x104]
shl eax, cl
cdq
mov dword [ebp - 0x590], eax
mov dword [ebp - 0x58c], edx
push dword [ebp - 0x58c]
push dword [ebp - 0x590]
mov ecx, 0x1061af58
call fcn.10021543
jmp 0x10039b6f
jmp 0x10039b4d
mov byte [ebp - 0x71], 0
mov dword [ebp - 4], 0x16
cmp dword [ebp - 0x274], 0xf10
jge 0x10039be4
mov edx, dword [ebp - 0x570]
mov ecx, 0x1061af58
call fcn.10025cea
jmp 0x10039c00
or dword [ebp - 4], 0xffffffff
jmp 0x10039c0a
push 0x4665
push 0x4faa
lea eax, [ebp - 0x71]
push eax
push 0
call fcn.1003dfa2
add esp, 0x10
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b4]
mov dword [ebp - 0x7e0], eax
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x10039c55
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1b4], 0
jne 0x10039c55
and dword [ebp - 0x4fc], 0
jmp 0x10039c5f
mov dword [ebp - 0x4fc], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b4]
mov dword [ebp - 0x6f4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b4]
mov dword [ebp - 0x794], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
push 4
pop edx
shl edx, 0
mov edx, dword [ebp + edx - 0x1b4]
add edx, dword [ebp + ecx - 0x1b4]
sub edx, dword [ebp + eax - 0x1b4]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1b4], edx
je 0x10039cc7
mov dword [ebp - 0x504], 1
jmp 0x10039cce
and dword [ebp - 0x504], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1b4], 1
je 0x10039cea
mov dword [ebp - 0x27c], 1
jmp 0x10039cf1
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp - 0x88]
and dword [eax], 0
jmp 0x1003b249
push 1
push 0x5265
push 0x1c3b
push 1
push 0x2142
push 0x4f46
push 0x3daf
lea eax, [ebp - 0x30]
push eax
push 0x5fde
push 1
call fcn.1003194b
add esp, 0x28
mov dword [ebp - 0x438], 0x57fd5464
push 0x237d
push 0x1f4f
push 1
push 0x6627
push 1
push 0x7acb
lea eax, [ebp - 0x438]
push eax
call fcn.100344ea
add esp, 0x1c
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1003acde
push 3
lea ecx, [ebp - 0x7b0]
call fcn.10021783
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x114], 0xfffffffb
mov dword [ebp - 0x10c], 0
jmp 0x10039db2
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 3
jge 0x10039dd4
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x7b0]
call fcn.10021821
mov dword [eax], 0xbbca6318
jmp 0x10039da5
push 0x50dd
push 0x1b21
push 1
push 0x7983
push 1
call fcn.100346b8
add esp, 0x14
mov dword [ebp - 0x114], 0
jmp 0x10039e08
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 2
jg 0x10039e65
mov dword [ebp - 0x284], 0x24cdb8fa
push 1
push 0x6741
push 1
push 0x2f43
push 0x71c
push 0x2b37
push 0x43c4
push 0x4445
push 0x7a04
push 1
push 0x7202
push 0x595d
call fcn.100347a7
add esp, 0x30
mov eax, dword [ebp - 0x284]
dec eax
mov dword [ebp - 0x284], eax
jmp 0x10039dfb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7b0]
call fcn.10021805
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x11c]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x28c], ecx
jne 0x1003a0e2
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0x448], 0xc36b586f
mov dword [ebp - 0xd8], 0xb
jmp 0x10039ebb
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x1d
jg 0x1003a0be
mov dword [ebp - 0x40], 0xabecba2a
push 3
lea ecx, [ebp - 0x694]
call fcn.10021783
mov dword [ebp - 4], 0x19
mov dword [ebp - 0xf0], 0
jmp 0x10039efc
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 3
jge 0x10039f1b
push dword [ebp - 0xf0]
lea ecx, [ebp - 0x694]
call fcn.10021821
or dword [eax], 0xffffffff
jmp 0x10039eef
mov dword [ebp - 0x40], 0
jmp 0x10039f2b
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x10
jge 0x1003a027
mov dword [ebp - 0x12c], 0xffffffff
mov dword [ebp - 0xf4], 0
jmp 0x10039f58
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 3
jge 0x10039f74
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x844], 0xd035c573
jmp 0x10039f4b
mov dword [ebp - 0x12c], 0xe
jmp 0x10039f8d
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0xd
je 0x10039fd8
mov dword [ebp - 0xd0], 0xa94b2ab7
mov dword [ebp - 0xd0], 2
jmp 0x10039fb9
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jl 0x10039fd6
mov eax, dword [ebp - 0xd0]
cmp dword [ebp + eax*4 - 0x844], 0
je 0x10039fd4
jmp 0x10039fd6
jmp 0x10039fac
jmp 0x10039f80
mov byte [ebp - 0x55], 0
lea eax, [ebp - 0x55]
push eax
push 0x222b
push 0x7a65
push 1
push 0x1b
push 1
push 0x6a9e
push 0x34a7
push 0x6ebd
push 0x60d1
push 0x5423
push 0xdbc
push 1
push 0x150b
push 0x21d6
call fcn.100365c1
add esp, 0x3c
jmp 0x10039f24
mov dword [ebp - 0x40], 0
jmp 0x1003a037
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jg 0x1003a0aa
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x1003a079
push 0
push 0x47d1
push 0x6687
push 0x7d79
push 0x1b6
push 1
push 0x543d
push 0x3080
call fcn.1003c6fb
add esp, 0x20
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0xd8]
push eax
push 1
push 0x6fa5
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x40]
push eax
push 0
push 0x1a04
call fcn.1003dc56
add esp, 0x20
jmp 0x1003a030
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x694]
call fcn.10021805
jmp 0x10039eae
push 0
push 0x71e3
push 0x27df
push 1
call fcn.1003cf3c
add esp, 0x10
mov eax, dword [ebp - 0x88]
and dword [eax], 0
jmp 0x1003b249
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x28c]
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x4c], 0x8901f2c2
mov dword [ebp - 0x648], 1
mov dword [ebp - 0x644], 1
mov dword [ebp - 0x640], 1
mov dword [ebp - 0x63c], 1
lea ecx, [ebp - 0x1e5]
call fcn.10021830
push eax
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x648]
push eax
lea ecx, [ebp - 0x860]
call fcn.10021833
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x5f0]
call fcn.100217df
mov dword [ebp - 4], 0x1a
push 0
lea ecx, [ebp - 0x5f0]
call fcn.10021821
mov dword [eax], 0x603f
imul eax, dword [ebp - 0x4c], 0x603f
test eax, eax
je 0x1003a1b7
mov dword [ebp - 0x450], 0x4800fa72
lea eax, [ebp - 0x5f0]
push eax
push 0
lea eax, [ebp - 0x450]
push eax
push 1
push 0x4dd2
push 0x65dd
lea eax, [ebp - 0x4c]
push eax
call fcn.1003d631
add esp, 0x1c
jmp 0x1003a287
push 0x643d
push 1
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x5f0]
push eax
push 1
call fcn.10036a9d
add esp, 0x14
mov dword [ebp - 0x4c], 0
jmp 0x1003a1e3
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jg 0x1003a287
mov dword [ebp - 0x134], 0x9a22db78
mov dword [ebp - 0x134], 3
jmp 0x1003a210
mov eax, dword [ebp - 0x134]
dec eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jl 0x1003a282
push 1
lea ecx, [ebp - 0x67c]
call fcn.10021783
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x67c]
push eax
push 0
lea eax, [ebp - 0x6fc]
push eax
push 1
call fcn.10032d54
add esp, 0x10
push 0x6436
push 0x48f5
push 1
lea eax, [ebp - 0x67c]
push eax
push 0x376a
push 1
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x5f0]
push eax
call fcn.10032253
add esp, 0x20
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x67c]
call fcn.10021805
jmp 0x1003a203
jmp 0x1003a1dc
push 0x3ce9
push 0x2fe1
push 0x10e6
push 1
push 0xddc
push 1
push 0x578
push 0xd95
push 0x5b38
call fcn.10036b66
add esp, 0x24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5f0]
call fcn.10021805
cmp dword [ebp - 0x458], 0
jne 0x1003acd4
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x7c8], 0xffffffff
mov dword [ebp - 0xe8], 0x8f59172d
mov dword [ebp - 0x1e0], 0xfffffff8
mov dword [ebp - 0x44], 0
jmp 0x1003a307
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x1003a31d
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x624], 0x78948018
jmp 0x1003a300
mov dword [ebp - 0x44], 0
jmp 0x1003a32d
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x1003a343
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x6ac], 0x45dcefbd
jmp 0x1003a326
mov dword [ebp - 0x24], 3
jmp 0x1003a353
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1003a825
mov dword [ebp - 0xe0], 0x289a6957
mov dword [ebp - 0x704], 0x3744
mov dword [ebp - 0x54], 0x12b94821
mov dword [ebp - 0x50], 7
mov dword [ebp - 0xa8], 0x5119
mov dword [ebp - 0x13c], 0
jmp 0x1003a3a2
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 1
jge 0x1003a3be
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x338], 0xfffffff8
jmp 0x1003a395
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x624]
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x460]
mov dword [ebp + eax*4 - 0x624], ecx
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
je 0x1003a452
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x50]
jne 0x1003a410
cmp dword [ebp - 0xe0], 0
je 0x1003a410
mov dword [ebp - 0x294], 1
jmp 0x1003a417
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x294], eax
jne 0x1003a431
mov dword [ebp - 0x29c], 1
jmp 0x1003a438
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x1e0]
cmp eax, dword [ebp - 0x29c]
jge 0x1003a452
mov dword [ebp - 0x2a4], 1
jmp 0x1003a459
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x2a4], eax
jne 0x1003a473
mov dword [ebp - 0x2ac], 1
jmp 0x1003a47a
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x2ac], eax
jge 0x1003a49a
cmp dword [ebp - 0xa8], 0
je 0x1003a49a
mov dword [ebp - 0x2b4], 1
jmp 0x1003a4a1
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x2b4], eax
jg 0x1003a4bb
mov dword [ebp - 0x2bc], 1
jmp 0x1003a4c2
and dword [ebp - 0x2bc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6ac]
imul eax, dword [ebp - 0x2bc]
cmp eax, 0x33e3
jl 0x1003a4e9
mov dword [ebp - 0x2c4], 1
jmp 0x1003a4f0
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xe0]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x6ac], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6ac]
cmp eax, dword [ebp - 0xe8]
jl 0x1003a530
mov dword [ebp - 0x2cc], 1
jmp 0x1003a537
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0x2cc], eax
jle 0x1003a551
mov dword [ebp - 0x2d4], 1
jmp 0x1003a558
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2d4]
sub eax, dword [ebp - 0xa8]
je 0x1003a5cb
cmp dword [ebp - 0x54], 0
jne 0x1003a578
mov dword [ebp - 0x2dc], 1
jmp 0x1003a57f
and dword [ebp - 0x2dc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x624]
cmp eax, dword [ebp - 0x2dc]
jl 0x1003a5a0
mov dword [ebp - 0x1d8], 1
jmp 0x1003a5a7
and dword [ebp - 0x1d8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1d8]
mov dword [ebp + eax - 0x338], ecx
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0xe0], eax
jmp 0x1003a820
mov dword [ebp - 0xa8], 0
jmp 0x1003a5e4
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x14
jne 0x1003a80e
mov dword [ebp - 0x2fc], 1
mov dword [ebp - 0x144], 0
jmp 0x1003a614
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jge 0x1003a62d
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x78], 1
jmp 0x1003a607
mov dword [ebp - 0x50], 0
jmp 0x1003a63d
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xe
jl 0x1003a801
mov dword [ebp - 0x470], 0xfffffff7
mov dword [ebp - 0x54], 0
jmp 0x1003a661
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jg 0x1003a69a
push 0x2c07
push 1
push 0x484
push 0x7b4a
push 0x2791
push 0x336d
push 0x4324
push 0
push 1
push 0x3084
call fcn.10032a79
add esp, 0x28
jmp 0x1003a65a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x78], 0
je 0x1003a6c7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x78], 0
jne 0x1003a6bb
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x1003a6c7
mov dword [ebp - 0x2e4], 1
jmp 0x1003a6ce
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x2e4]
inc eax
je 0x1003a6ec
mov eax, 0x60a95a2e
test eax, eax
je 0x1003a6ec
mov dword [ebp - 0x2ec], 1
jmp 0x1003a6f3
and dword [ebp - 0x2ec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
cmp dword [ebp - 0x2ec], eax
jge 0x1003a711
mov dword [ebp - 0x2f4], 1
jmp 0x1003a718
and dword [ebp - 0x2f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
cmp dword [ebp - 0x2f4], eax
jne 0x1003a736
mov dword [ebp - 0x304], 1
jmp 0x1003a73d
and dword [ebp - 0x304], 0
mov dword [ebp - 0x2fc], 0x2398
mov eax, dword [ebp - 0x2fc]
cmp eax, dword [ebp - 0x304]
jl 0x1003a761
mov dword [ebp - 0x434], 1
jmp 0x1003a768
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x70c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
cmp eax, dword [ebp - 0x470]
jg 0x1003a78f
mov dword [ebp - 0x20c], 1
jmp 0x1003a796
and dword [ebp - 0x20c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
cmp eax, dword [ebp - 0x20c]
je 0x1003a7b4
mov dword [ebp - 0x328], 1
jmp 0x1003a7bb
and dword [ebp - 0x328], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
cmp dword [ebp - 0x328], eax
jg 0x1003a7df
cmp dword [ebp - 0x1e0], 0
jne 0x1003a7df
and dword [ebp - 0x330], 0
jmp 0x1003a7e9
mov dword [ebp - 0x330], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x330]
mov dword [ebp + eax - 0x338], ecx
jmp 0x1003a636
cmp dword [ebp - 0x50], 0
je 0x1003a809
jmp 0x1003a80e
jmp 0x1003a5d7
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x624], 0
je 0x1003a820
jmp 0x1003a34c
jmp 0x1003a34c
mov dword [ebp - 0x24], 0xe
jmp 0x1003a835
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xa
jle 0x1003a906
mov dword [ebp - 0x14c], 0xfffffffb
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp - 0x14c], 0xfd26
cmp ecx, dword [ebp + eax - 0x624]
je 0x1003a86e
mov dword [ebp - 0x340], 1
jmp 0x1003a875
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x14c]
sub eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x340]
jg 0x1003a895
mov dword [ebp - 0x348], 1
jmp 0x1003a89c
and dword [ebp - 0x348], 0
cmp dword [ebp - 0x348], 0
jne 0x1003a8b1
mov dword [ebp - 0x350], 1
jmp 0x1003a8b8
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x350], eax
jne 0x1003a8d2
mov dword [ebp - 0x358], 1
jmp 0x1003a8d9
and dword [ebp - 0x358], 0
cmp dword [ebp - 0x358], 0xffffffff
jge 0x1003a8ee
mov dword [ebp - 0x360], 1
jmp 0x1003a8f5
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x14c], eax
jmp 0x1003a82e
mov dword [ebp - 0x368], 0x3fda
mov dword [ebp - 0x478], 0x10008458
cmp dword [ebp - 0x368], 0x41db
jle 0x1003a9c3
push 0x2043
push 0x25d0
push 0x6a9
push 0x1d75
push 0x1d63
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
and dword [ebp - 0x154], 0
jmp 0x1003a95f
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0x7ba0
jge 0x1003a9c3
and dword [ebp - 0x15c], 0
jmp 0x1003a981
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0x5ed1
jge 0x1003a9c1
mov eax, dword [ebp - 0x154]
cdq
idiv dword [ebp - 0x15c]
mov eax, edx
cdq
mov dword [ebp - 0x59c], eax
mov dword [ebp - 0x598], edx
push dword [ebp - 0x598]
push dword [ebp - 0x59c]
mov ecx, 0x1061af58
call fcn.10021543
jmp 0x1003a974
jmp 0x1003a952
mov dword [ebp - 0x80], 0
mov dword [ebp - 4], 0x1c
cmp dword [ebp - 0x368], 0x3f96
jge 0x1003a9ed
mov edx, dword [ebp - 0x478]
mov ecx, 0x1061af58
call fcn.10025cea
jmp 0x1003aa09
or dword [ebp - 4], 0xffffffff
jmp 0x1003aa13
mov dword [ebp - 0x388], 0xc36b586f
mov dword [ebp - 0x80], 0xb
jmp 0x1003aa2d
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x1d
jg 0x1003acc6
mov dword [ebp - 0x1c], 0xabecba2a
push 3
lea ecx, [ebp - 0x31c]
call fcn.10021783
mov dword [ebp - 4], 0x1e
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x7cc]
push eax
push 1
push 0x1ae5
push 1
push 0x68f4
push 0x41a
push 0
push 0x7981
push 0x7d78
call fcn.10032652
add esp, 0x28
mov dword [ebp - 0x1c], 0
jmp 0x1003aa97
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x10
jge 0x1003ab5c
mov dword [ebp - 0x16c], 0xffffffff
mov dword [ebp - 0x164], 0
jmp 0x1003aac4
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 3
jge 0x1003aae0
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x82c], 0xd035c573
jmp 0x1003aab7
mov dword [ebp - 0x16c], 0xe
jmp 0x1003aaf9
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0xd
je 0x1003ab44
mov dword [ebp - 0xac], 0xa94b2ab7
mov dword [ebp - 0xac], 2
jmp 0x1003ab25
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x1003ab42
mov eax, dword [ebp - 0xac]
cmp dword [ebp + eax*4 - 0x82c], 0
je 0x1003ab40
jmp 0x1003ab42
jmp 0x1003ab18
jmp 0x1003aaec
push 1
push 1
push 0x65e6
push 1
call fcn.10036da1
add esp, 0x10
jmp 0x1003aa90
mov dword [ebp - 0x1c], 0
jmp 0x1003ab6c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1003acb2
mov byte [ebp - 0x69], 0
push 0x1f87
push 0x6436
push 1
push 0
lea eax, [ebp - 0x69]
push eax
push 0x3d6e
push 0x55e7
push 0x7b19
call fcn.10034302
add esp, 0x20
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x31c]
call fcn.10021821
cmp dword [eax], 0
jne 0x1003ac84
cmp dword [ebp - 0x80], 0xc4aee507
jbe 0x1003abcf
mov dword [ebp - 0x370], 1
jmp 0x1003abd6
and dword [ebp - 0x370], 0
cmp dword [ebp - 0x370], 0x6cd5
jl 0x1003abee
mov dword [ebp - 0x378], 1
jmp 0x1003abf5
and dword [ebp - 0x378], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x31c]
call fcn.10021821
mov ecx, dword [ebp - 0x378]
cmp ecx, dword [eax]
jg 0x1003ac19
mov dword [ebp - 0x480], 1
jmp 0x1003ac20
and dword [ebp - 0x480], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x31c]
call fcn.10021821
mov eax, dword [eax]
sub eax, 7
cmp eax, 2
jle 0x1003ac44
mov dword [ebp - 0x380], 1
jmp 0x1003ac4b
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x388], eax
mov esi, dword [ebp - 0x80]
push 1
lea ecx, [ebp - 0x31c]
call fcn.10021821
sub esi, dword [eax]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x31c]
call fcn.10021821
cmp esi, dword [eax]
jne 0x1003ac84
and dword [ebp - 0x488], 0
jmp 0x1003ac8e
mov dword [ebp - 0x488], 1
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x714], eax
mov esi, dword [ebp - 0x80]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x31c]
call fcn.10021821
mov dword [eax], esi
jmp 0x1003ab65
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x31c]
call fcn.10021805
jmp 0x1003aa26
mov eax, dword [ebp - 0x88]
and dword [eax], 0
jmp 0x1003b249
mov eax, dword [ebp - 0x30]
mov dword [eax + 0x10], 1
push 3
lea ecx, [ebp - 0x7c0]
call fcn.10021783
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x174], 1
mov dword [ebp - 0x398], 0
push 0x281a
push 0x6e54
push 1
lea eax, [ebp - 0x7c0]
push eax
push 1
push 0x5919
push 0xb04
push 1
push 0x7681
lea eax, [ebp - 0x7b4]
push eax
call fcn.10032652
add esp, 0x28
mov dword [ebp - 0x174], 2
jmp 0x1003ad54
mov eax, dword [ebp - 0x174]
dec eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
jl 0x1003aef2
mov dword [ebp - 0x17c], 0xa624cdb8
mov byte [ebp - 0x79], 0
lea eax, [ebp - 0x79]
push eax
push 0x717
push 0xcb0
push 0x5b9
push 0x439a
push 1
push 1
call fcn.1003280c
add esp, 0x1c
mov dword [ebp - 0x17c], 2
jmp 0x1003adac
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jl 0x1003aeed
push 2
lea ecx, [ebp - 0x510]
call fcn.10021783
mov byte [ebp - 4], 0x20
push 0x5019
push 0x1e1d
push 0xe57
lea eax, [ebp - 0x71c]
push eax
push 0x1c18
push 1
push 0
lea eax, [ebp - 0x510]
push eax
push 0x4bb3
push 0x6cbf
push 1
push 0x8ee
call fcn.100331ed
add esp, 0x30
mov byte [ebp - 0x8a], 0
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x1003ae40
push 0
push 0xb71
push 1
push 0x13a2
push 0x466a
push 0x34be
push 0x72bb
call fcn.100330fc
add esp, 0x1c
push 1
lea ecx, [ebp - 0x510]
call fcn.10021821
and dword [eax], 0
jmp 0x1003ae76
push 1
lea ecx, [ebp - 0x510]
call fcn.10021821
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0x390]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x390]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x510]
call fcn.10021821
cmp dword [eax], 2
jg 0x1003aed9
mov byte [ebp - 0x81], 0
push 0xbed
push 0x4018
push 0x427
push 0x7f97
push 0x31a8
push 1
push 0x6082
push 0x5680
push 1
push 0x592e
push 0x2e8c
lea eax, [ebp - 0x81]
push eax
push 0xbfc
call fcn.10036f82
add esp, 0x34
jmp 0x1003ae52
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x510]
call fcn.10021805
jmp 0x1003ad9f
jmp 0x1003ad47
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c0]
call fcn.10021805
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x10], 0
je 0x1003af22
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3a0], eax
jmp 0x1003af29
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x3a0]
mov dword [eax], ecx
jmp 0x1003b249
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x4c8], eax
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x500], eax
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x3a8], 0x16f2
mov dword [ebp - 0x4d8], 0x100084d8
cmp dword [ebp - 0x3a8], 0x199a
jle 0x1003b0ca
push 0
push 0x124
push 0x141f
push 0xb9a
push 0x1ad4
call dword [sym.imp.GDI32.dll_CreateBitmap]
and dword [ebp - 0x190], 0
jmp 0x1003aff7
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0x741e
jge 0x1003b0be
and dword [ebp - 0x198], 0
jmp 0x1003b01d
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0xb5c
jge 0x1003b0b9
and dword [ebp - 0x1a0], 0
jmp 0x1003b043
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0x7891
jge 0x1003b0b4
and dword [ebp - 0x1a8], 0
jmp 0x1003b065
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0x5052
jge 0x1003b0b2
mov eax, dword [ebp - 0x190]
cdq
idiv dword [ebp - 0x198]
imul edx, dword [ebp - 0x1a0]
sub edx, dword [ebp - 0x1a8]
mov eax, edx
cdq
mov dword [ebp - 0x5a8], eax
mov dword [ebp - 0x5a4], edx
push dword [ebp - 0x5a4]
push dword [ebp - 0x5a8]
mov ecx, 0x1061af58
call fcn.10021543
jmp 0x1003b058
jmp 0x1003b036
jmp 0x1003b010
jmp 0x1003afea
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 4], 0x21
cmp dword [ebp - 0x3a8], 0x1369
jge 0x1003b0f9
mov edx, dword [ebp - 0x4d8]
mov ecx, 0x1061af58
call fcn.10025cea
jmp 0x1003b115
or dword [ebp - 4], 0xffffffff
jmp 0x1003b11f
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x4e8]
cmp dword [eax], 0
jne 0x1003b142
mov dword [ebp - 0x3b8], 1
jmp 0x1003b149
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0xb4]
mov eax, dword [eax]
mov dword [ebp - 0x7d4], eax
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xb4]
mov ecx, dword [ecx]
sub ecx, dword [eax]
jne 0x1003b175
mov dword [ebp - 0x4f0], 1
jmp 0x1003b17c
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0xb4]
cmp dword [eax], 0
jne 0x1003b19b
mov eax, dword [ebp - 0x3b0]
cmp dword [eax], 0
jne 0x1003b19b
and dword [ebp - 0x4f8], 0
jmp 0x1003b1a5
mov dword [ebp - 0x4f8], 1
mov eax, dword [ebp - 0x3b0]
mov eax, dword [eax]
imul eax, dword [ebp - 0x3b8]
cmp eax, 0xedb0
jg 0x1003b1cf
mov eax, dword [ebp - 0xb4]
cmp dword [eax], 0
jne 0x1003b1cf
and dword [ebp - 0x3c0], 0
jmp 0x1003b1d9
mov dword [ebp - 0x3c0], 1
mov eax, dword [ebp - 0x3c8]
mov eax, dword [eax]
cmp dword [ebp - 0x3c0], eax
je 0x1003b200
mov eax, dword [ebp - 0x3c8]
cmp dword [eax], 0
je 0x1003b200
mov dword [ebp - 0x3d0], 1
jmp 0x1003b207
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x500]
mov ecx, dword [ebp - 0x3d0]
mov dword [eax], ecx
jmp 0x1003b249
mov eax, dword [ebp + 8]
mov dword [ebp - 0x524], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x51c], eax
push 1
push dword [ebp - 0x51c]
push 0x5579
push dword [ebp - 0x524]
push 0x1f83
call fcn.100301fe
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret