Function at 0x1003640a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006b64e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x12b48
call fcn.10065ea0
push esi
push edi
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10036536
mov eax, dword [ebp + 8]
mov dword [ebp - 0xd90], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0xc7c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xd88], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0xd80], eax
mov eax, dword [ebp - 0xc7c]
movzx eax, byte [eax]
test eax, eax
je 0x100364f5
mov eax, dword [ebp - 0xd80]
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0xd88]
mov dword [ebp - 0x3c8], eax
push 4
push 0x2000
mov eax, dword [ebp - 0x470]
push dword [eax + 0x50]
mov eax, dword [ebp - 0x470]
push dword [eax + 0x34]
push 0x5736
push 0x6a92
call fcn.10028cf3
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x3c8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x3c8]
cmp dword [eax], 0
jne 0x100364f3
push 4
push 0x2000
mov eax, dword [ebp - 0x470]
push dword [eax + 0x50]
push 0
push 0x5736
push 0x6a92
call fcn.10028cf3
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x3c8]
mov dword [ecx], eax
jmp 0x10036531
mov eax, dword [ebp - 0xd90]
mov dword [ebp - 0xd98], eax
mov eax, dword [ebp - 0xd98]
mov dword [ebp - 0xda0], eax
mov eax, dword [ebp - 0xda0]
movzx eax, byte [eax]
test eax, eax
je 0x10036531
push 0
push 0xd77
push 0x14a2
push 0x1e24
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
jmp 0x10040d00
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xdb8], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xda8], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xdc0], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0xdc8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xd50], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0xdb0], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xd58], eax
mov eax, dword [ebp - 0xda8]
movzx eax, byte [eax]
test eax, eax
je 0x10040c8b
mov eax, dword [ebp - 0xdb0]
mov dword [ebp - 0xfb0], eax
mov eax, dword [ebp - 0xdb8]
mov dword [ebp - 0xdb4], eax
mov eax, dword [ebp - 0xdc0]
mov dword [ebp - 0xa74], eax
mov eax, dword [ebp - 0xdc8]
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x35c], 0x88a137b1
mov dword [ebp - 0x1c8], 1
mov dword [ebp - 0xde0], 0x3187110e
mov dword [ebp - 0xde8], 6
mov dword [ebp - 0x368], 0
jmp 0x100365f7
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 3
jge 0x10036613
mov eax, dword [ebp - 0x368]
mov dword [ebp + eax*4 - 0xb78], 0xccb03629
jmp 0x100365ea
mov eax, dword [ebp - 0x35c]
neg eax
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x1368], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb78]
mov dword [ebp - 0x139c], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xb78]
cmp dword [ebp + eax - 0xb78], ecx
jl 0x10036665
mov dword [ebp - 0xdd0], 1
jmp 0x1003666c
and dword [ebp - 0xdd0], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb78], 0
je 0x10036688
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb78], 0
cmp dword [ebp - 0x35c], 1
ja 0x100366a3
cmp dword [ebp - 0x1c8], 0
jne 0x100366a3
and dword [ebp - 0xdd8], 0
jmp 0x100366ad
mov dword [ebp - 0xdd8], 1
mov eax, dword [ebp - 0xde0]
mov dword [ebp - 0x1534], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov eax, dword [ebp + eax - 0xb78]
mov dword [ebp + ecx - 0xb78], eax
mov dword [ebp - 0x1c8], 0
jmp 0x100366eb
mov eax, dword [ebp - 0x1c8]
dec eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0xffffffef
jne 0x10036756
mov dword [ebp - 0xdf0], 0xffffffff
mov dword [ebp - 0xde8], 0xfffffffb
push 0x2085
push 0x4030
push 0x2a6
push 0x7860
push 0x6b72
push 0x4c9a
lea eax, [ebp - 0xdf0]
push eax
push 0
push 0x17f4
push 0x6667
push 0
push 1
push 0xf1b
push 0x5e68
push 0x18db
call fcn.1002ce3c
add esp, 0x3c
jmp 0x100366de
mov dword [ebp - 0x40], 0x1824a8c6
mov dword [ebp - 0xa94], 0x9150faeb
mov dword [ebp - 0xec0], 0xffffffff
mov dword [ebp - 0x40], 0xfffffffb
jmp 0x10036781
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xfffffffd
jl 0x100367fa
mov dword [ebp - 0x30c], 0x7b1891f7
mov dword [ebp - 0x264], 0
jmp 0x100367aa
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 1
jge 0x100367c6
mov eax, dword [ebp - 0x264]
mov dword [ebp + eax*4 - 0x13a4], 0xffffffff
jmp 0x1003679d
mov dword [ebp - 0x30c], 0
jmp 0x100367df
mov eax, dword [ebp - 0x30c]
dec eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0
jl 0x100367f8
push 0x3577
push 0
call fcn.1002d410
pop ecx
pop ecx
jmp 0x100367d2
jmp 0x1003677a
mov dword [ebp - 0x40], 0
jmp 0x1003680a
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x12
jl 0x10036969
mov dword [ebp - 0x26c], 3
mov dword [ebp - 0xabc], 0x89328a06
mov dword [ebp - 0xab4], 0x56e31bb0
cmp dword [ebp - 0x40], 0
jg 0x10036844
mov dword [ebp - 0x7bc], 1
jmp 0x1003684b
and dword [ebp - 0x7bc], 0
cmp dword [ebp - 0x7bc], 0x67f8
jne 0x10036863
mov dword [ebp - 0xa84], 1
jmp 0x1003686a
and dword [ebp - 0xa84], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xa84], eax
je 0x10036881
mov dword [ebp - 0xa8c], 1
jmp 0x10036888
and dword [ebp - 0xa8c], 0
mov eax, dword [ebp - 0xa8c]
mov dword [ebp - 0xa94], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0xa94], eax
jle 0x100368ab
mov dword [ebp - 0xa9c], 1
jmp 0x100368b2
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0x26c]
cmp dword [ebp - 0xa9c], eax
jge 0x100368cc
mov dword [ebp - 0xaa4], 1
jmp 0x100368d3
and dword [ebp - 0xaa4], 0
mov eax, dword [ebp - 0x26c]
add eax, dword [ebp - 0xaa4]
cmp dword [ebp - 0x26c], eax
jle 0x100368f3
mov dword [ebp - 0xaac], 1
jmp 0x100368fa
and dword [ebp - 0xaac], 0
mov eax, dword [ebp - 0xaac]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0xab4]
cmp dword [ebp - 0x40], eax
jge 0x10036920
cmp dword [ebp - 0x40], 0
jne 0x10036920
and dword [ebp - 0xac4], 0
jmp 0x1003692a
mov dword [ebp - 0xac4], 1
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0xabc], eax
imul eax, dword [ebp - 0xabc], 9
cmp eax, dword [ebp - 0xac4]
jg 0x10036951
mov dword [ebp - 0xb0c], 1
jmp 0x10036958
and dword [ebp - 0xb0c], 0
mov eax, dword [ebp - 0xb0c]
mov dword [ebp - 0xec0], eax
jmp 0x10036803
mov dword [ebp - 0x8c], 0xa276
mov dword [ebp - 0xb1c], 0x50f6b34c
mov dword [ebp - 0x4ac], 0x45d764ce
mov dword [ebp - 0xb54], 0xcd95ff7
mov dword [ebp - 0xa7c], 0xee72c34c
push 3
lea ecx, [ebp - 0x11f4]
call fcn.1000b98b
and dword [ebp - 4], 0
mov dword [ebp - 0xed0], 0xf4c6f444
push 0
lea eax, [ebp - 0x14b8]
push eax
lea eax, [ebp - 0x11f4]
push eax
call fcn.10032768
add esp, 0xc
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x8c], eax
jg 0x100369e8
mov dword [ebp - 0xec8], 1
jmp 0x100369ef
and dword [ebp - 0xec8], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x13ac], eax
imul eax, dword [ebp - 0x8c], 0xae9a
test eax, eax
jne 0x10036a1b
cmp dword [ebp - 0x8c], 0
jne 0x10036a1b
and dword [ebp - 0xb14], 0
jmp 0x10036a25
mov dword [ebp - 0xb14], 1
mov eax, dword [ebp - 0xb14]
mov dword [ebp - 0xb1c], eax
cmp dword [ebp - 0xb1c], 0
jne 0x10036a4c
mov eax, 0xbed162c5
test eax, eax
jne 0x10036a4c
and dword [ebp - 0xb24], 0
jmp 0x10036a56
mov dword [ebp - 0xb24], 1
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x4ac]
je 0x10036a85
cmp dword [ebp - 0x4ac], 0
je 0x10036a85
mov dword [ebp - 0xb3c], 1
jmp 0x10036a8c
and dword [ebp - 0xb3c], 0
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0xb3c]
jg 0x10036aa6
mov dword [ebp - 0xb44], 1
jmp 0x10036aad
and dword [ebp - 0xb44], 0
mov eax, dword [ebp - 0xb44]
mov dword [ebp - 0xb54], eax
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0xb54], eax
jl 0x10036ad3
mov dword [ebp - 0x528], 1
jmp 0x10036ada
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x528]
sub eax, dword [ebp - 0xa7c]
cmp eax, dword [ebp - 0xa7c]
jne 0x10036afa
mov dword [ebp - 0x848], 1
jmp 0x10036b01
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x848]
je 0x10036b1b
mov dword [ebp - 0x530], 1
jmp 0x10036b22
and dword [ebp - 0x530], 0
push 1
lea ecx, [ebp - 0x11f4]
call fcn.1000ba29
mov ecx, dword [ebp - 0x530]
cmp ecx, dword [eax]
jl 0x10036b45
mov dword [ebp - 0x9d8], 1
jmp 0x10036b4c
and dword [ebp - 0x9d8], 0
mov eax, dword [ebp - 0x9d8]
mov dword [ebp - 0xed0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11f4]
call fcn.1000ba0d
mov dword [ebp - 0x294], 0x88a137b1
push 3
lea ecx, [ebp - 0x1164]
call fcn.1000b98b
mov dword [ebp - 4], 1
mov dword [ebp - 0xee8], 0xd3672969
mov dword [ebp - 0xef0], 0xf7919adb
push 1
lea ecx, [ebp - 0x11c4]
call fcn.1000b98b
mov byte [ebp - 4], 2
mov dword [ebp - 0xf08], 0xb16e
mov dword [ebp - 0xf00], 0x38d679bd
mov dword [ebp - 0xee0], 0xffffffff
mov dword [ebp - 0xf10], 2
mov dword [ebp - 0xef8], 0xa7fad540
push 1
push 0x75d2
lea eax, [ebp - 0x1164]
push eax
push 0x546b
push 0
lea eax, [ebp - 0xed8]
push eax
call fcn.1002af7a
add esp, 0x18
lea eax, [ebp - 0x11c4]
push eax
lea eax, [ebp - 0xed8]
push eax
push 0x7c22
push 0
push 0x5356
push 1
push 0x88a
call fcn.1002a72e
add esp, 0x1c
mov byte [ebp - 0x14e], 0
movzx eax, byte [ebp - 0x14e]
test eax, eax
je 0x10036c54
push 0x2a6
push 0x42eb
push 0x2ee2
push 0
call fcn.1002c754
add esp, 0x10
lea eax, [ebp - 0xee0]
push eax
push 0x3fd5
push 0
push 0x2fad
push 0x59d4
lea eax, [ebp - 0xee8]
push eax
lea eax, [ebp - 0xef0]
push eax
push 0
lea eax, [ebp - 0xef8]
push eax
lea eax, [ebp - 0xf00]
push eax
push 0x31c5
push 0x4475
push 0x3c50
lea eax, [ebp - 0x11c4]
push eax
push 0x5d0d
push 0x263d
lea eax, [ebp - 0xf08]
push eax
push 0x6488
lea eax, [ebp - 0x1164]
push eax
lea eax, [ebp - 0xf10]
push eax
call fcn.10045c17
add esp, 0x50
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x11c4]
call fcn.1000ba0d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1164]
call fcn.1000ba0d
mov dword [ebp - 0x230], 1
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x850], 0xfffffff9
mov dword [ebp - 0x39c], 0
jmp 0x10036d1e
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
cmp dword [ebp - 0x39c], 3
jge 0x10036d3a
mov eax, dword [ebp - 0x39c]
mov dword [ebp + eax*4 - 0x15cc], 1
jmp 0x10036d11
mov eax, 0xd058a835
test eax, eax
je 0x10036dd9
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x850], eax
cmp dword [ebp - 0x28], 0xffff
jbe 0x10036d65
mov dword [ebp - 0x538], 1
jmp 0x10036d6c
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
sub eax, dword [ebp - 0x28]
cmp eax, 0xb15e
jle 0x10036d91
mov eax, 0xfff6
test eax, eax
je 0x10036d91
mov dword [ebp - 0xf18], 1
jmp 0x10036d98
and dword [ebp - 0xf18], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x154c], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x850], eax
jg 0x10036db8
mov dword [ebp - 0x540], 1
jmp 0x10036dbf
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x540]
sub eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x28]
jg 0x10036dd9
mov dword [ebp - 0xaa0], 1
jmp 0x10036de0
and dword [ebp - 0xaa0], 0
mov eax, dword [ebp - 0xaa0]
sub eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x28]
je 0x10036dfa
mov dword [ebp - 0x548], 1
jmp 0x10036e01
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x548]
jg 0x10036e18
mov dword [ebp - 0xf20], 1
jmp 0x10036e1f
and dword [ebp - 0xf20], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x13b4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14c0], eax
xor eax, eax
cmp eax, 0xffffffff
ja 0x10036e44
mov dword [ebp - 0x858], 1
jmp 0x10036e4b
and dword [ebp - 0x858], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x858]
mov dword [ebp + eax - 0x15cc], ecx
mov dword [ebp - 0x28], 7
jmp 0x10036e6e
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x34
jl 0x10036edc
push 0x75e7
push 0x3c66
push 1
push 0x4ca2
push 0x6faa
push 0x62a
push 0x131e
push 0
push 0xde0
push 0x617
push 0x40ec
push 0x29c2
push 0x597c
push 0x3c0f
push 0x6ba2
push 0xa2c
push 0x692e
push 0x5f9
push 0x4eef
push 0x765f
call fcn.10045c17
add esp, 0x50
jmp 0x10036e67
mov dword [ebp - 0xe08], 0x3187110e
mov dword [ebp - 0xbdc], 6
mov dword [ebp - 0xf28], 0x18f5
cmp dword [ebp - 0xf28], 0x1350
jge 0x10036fa5
lea eax, [ebp - 0x314]
push eax
push 0x100077f0
call fcn.1005162b
pop ecx
pop ecx
and dword [ebp - 0x274], 0
jmp 0x10036f33
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x274]
cmp eax, dword [ebp - 0x314]
jge 0x10036fa5
and dword [ebp - 0x200], 0
jmp 0x10036f57
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x200]
cmp eax, dword [ebp - 0x314]
jge 0x10036f98
mov ecx, dword [ebp - 0x314]
imul ecx, dword [ebp - 0x200]
mov eax, dword [ebp - 0x200]
add eax, dword [ebp - 0x274]
cdq
idiv dword [ebp - 0x314]
lea eax, [ecx + edx + 1]
push eax
push 0x10007c64
call fcn.10051846
pop ecx
pop ecx
jmp 0x10036f4a
push 0x10007bfc
call fcn.10051846
pop ecx
jmp 0x10036f26
push 2
lea ecx, [ebp - 0xf38]
call fcn.1000b98b
mov dword [ebp - 4], 3
mov dword [ebp - 0xa0], 2
mov dword [ebp - 0xfc], 0xc71bc7dc
mov dword [ebp - 0x13bc], 0xe3e76316
mov dword [ebp - 0x27c], 0
jmp 0x10036ff0
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 2
jge 0x10037012
push dword [ebp - 0x27c]
lea ecx, [ebp - 0xf38]
call fcn.1000ba29
mov dword [eax], 1
jmp 0x10036fe3
mov dword [ebp - 0xa0], 1
jmp 0x1003702b
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jl 0x100371ad
mov dword [ebp - 0x168], 0x3111738a
mov dword [ebp - 0x1548], 1
mov byte [ebp - 0xeb], 0
movzx eax, byte [ebp - 0xeb]
test eax, eax
je 0x100370a8
push 0x3203
push 0x3bc4
push 0x315c
push 0x7568
push 0x76c8
push 0x737e
push 0x57bf
push 0x56eb
push 0
push 0x26d0
push 0x7c83
push 0x1636
push 0x177c
push 0x71
push 0
call fcn.1002a8af
add esp, 0x3c
push 0x6f20
push 0x63eb
push 0x5781
push 0x2b1e
push 0x6592
push 0
lea eax, [ebp - 0x168]
push eax
push 0x39cc
push 0x1156
push 0
push 0x67ce
push 0x2ee0
push 0x4354
call fcn.1002df41
add esp, 0x34
mov dword [ebp - 0x168], 0
jmp 0x10037106
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 1
jg 0x100371a8
mov dword [ebp - 0x364], 0
jmp 0x1003712c
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 4
jge 0x10037148
mov eax, dword [ebp - 0x364]
mov dword [ebp + eax*4 - 0x15a0], 0x443eb606
jmp 0x1003711f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x15a0]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x15a0], eax
push dword [ebp - 0x168]
lea ecx, [ebp - 0xf38]
call fcn.1000ba29
mov dword [ebp - 0x550], eax
push dword [ebp - 0xa0]
lea ecx, [ebp - 0xf38]
call fcn.1000ba29
mov ecx, dword [ebp - 0x550]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x550]
mov eax, dword [eax]
mov dword [ebp - 0xfc], eax
jmp 0x100370f9
jmp 0x1003701e
mov dword [ebp - 0xfc], 1
jmp 0x100371c6
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jl 0x10037218
mov dword [ebp - 0xa0], 0
jmp 0x100371e8
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jg 0x10037216
lea eax, [ebp - 0xf38]
push eax
push 0
lea eax, [ebp - 0xfc]
push eax
call fcn.1002b284
add esp, 0xc
cmp dword [ebp - 0xfc], 0
je 0x10037214
jmp 0x100371db
jmp 0x100371db
jmp 0x100371b9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf38]
call fcn.1000ba0d
mov dword [ebp - 0x13c4], 1
mov dword [ebp - 0x14c8], 0x60f57a7c
mov dword [ebp - 0x1508], 0x70ade216
mov dword [ebp - 0x1504], 0x70ade216
mov dword [ebp - 0x1500], 0x70ade216
mov dword [ebp - 0x14fc], 0x70ade216
mov dword [ebp - 0xfe8], 0x49f6d4a0
push 0x6e0e
push 0
push 0x772
lea eax, [ebp - 0xfe8]
push eax
call fcn.1002f49a
add esp, 0x10
mov byte [ebp - 0x158], 0
push 0x3fe6
push 0x41f1
push 0
lea eax, [ebp - 0x158]
push eax
call fcn.1003634f
add esp, 0x10
mov dword [ebp - 0x284], 0
jmp 0x100372c3
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 3
jge 0x100372df
mov eax, dword [ebp - 0x284]
mov dword [ebp + eax*4 - 0xb6c], 0xccb03629
jmp 0x100372b6
mov dword [ebp - 0x1a0], 0xfffffff6
mov dword [ebp - 0x28c], 0x8d3a18e4
mov dword [ebp - 0x31c], 0
jmp 0x1003730c
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 1
jge 0x10037328
mov eax, dword [ebp - 0x31c]
mov dword [ebp + eax*4 - 0x13cc], 0
jmp 0x100372ff
mov dword [ebp - 0x1a0], 0xfffffffd
jmp 0x10037341
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xfffffff9
jle 0x1003745f
mov dword [ebp - 0x1d0], 0x82f80c34
mov dword [ebp - 0x38c], 0x894ff545
mov dword [ebp - 0xbc4], 0x3799040c
mov eax, 0xdbda
test eax, eax
je 0x100373cb
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x1550], eax
imul eax, dword [ebp - 0x28c], 0xb94d
cmp eax, dword [ebp - 0x28c]
je 0x100373ac
mov dword [ebp - 0xd78], 1
jmp 0x100373b3
and dword [ebp - 0xd78], 0
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x13d4], eax
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x14d0], eax
mov eax, dword [ebp - 0x1a0]
add eax, 0xa130
cmp eax, 2
jne 0x100373e7
mov dword [ebp - 0x9e0], 1
jmp 0x100373ee
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0x9e0]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x28c]
imul eax, dword [ebp - 0x38c]
dec eax
mov dword [ebp - 0x38c], eax
jne 0x10037422
cmp dword [ebp - 0x1a0], 0
jne 0x10037422
and dword [ebp - 0x558], 0
jmp 0x1003742c
mov dword [ebp - 0x558], 1
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0xbc4], eax
push 0
push 0
push 0x5adc
lea eax, [ebp - 0x38c]
push eax
push 0x2b18
push 0x744a
call fcn.10044d4c
add esp, 0x18
jmp 0x10037334
mov byte [ebp - 0xed], 0
movzx eax, byte [ebp - 0xed]
test eax, eax
je 0x1003747c
push 1
push 0
call fcn.10029e78
pop ecx
pop ecx
mov eax, dword [ebp - 0x294]
neg eax
mov dword [ebp - 0x294], eax
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x13dc], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb6c]
mov dword [ebp - 0x1558], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xb6c]
cmp dword [ebp + eax - 0xb6c], ecx
jl 0x100374ce
mov dword [ebp - 0xe54], 1
jmp 0x100374d5
and dword [ebp - 0xe54], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb6c], 0
je 0x100374f1
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb6c], 0
cmp dword [ebp - 0x294], 1
ja 0x1003750c
cmp dword [ebp - 0x230], 0
jne 0x1003750c
and dword [ebp - 0xbcc], 0
jmp 0x10037516
mov dword [ebp - 0xbcc], 1
mov eax, dword [ebp - 0xe08]
mov dword [ebp - 0x1268], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov eax, dword [ebp + eax - 0xb6c]
mov dword [ebp + ecx - 0xb6c], eax
mov dword [ebp - 0x230], 0
jmp 0x10037554
mov eax, dword [ebp - 0x230]
dec eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0xffffffef
jne 0x100379d8
mov dword [ebp - 0x90], 7
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x10c], 0x5fe46c2e
push 2
lea ecx, [ebp - 0x4ec]
call fcn.1000b98b
mov dword [ebp - 4], 4
mov dword [ebp - 0x324], 0xfffffff9
mov dword [ebp - 0x5a0], 0xf8a6
mov dword [ebp - 0x45c], 0xffffffff
mov dword [ebp - 0x588], 0x67d3d8e1
mov dword [ebp - 0xbd4], 0xfffffffe
mov dword [ebp - 0xfdc], 0
lea eax, [ebp - 0x126c]
push eax
push 0x4f01
push 0
push 0x35
push 0xc96
push 0x297f
lea eax, [ebp - 0x4ec]
push eax
push 0x6896
push 0xd0c
push 0xf14
push 1
push 0x4523
push 0x3177
push 0x75e
call fcn.1002a04f
add esp, 0x38
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x10037650
mov eax, dword [ebp - 0x10c]
imul eax, dword [ebp - 0x104]
neg eax
mov dword [ebp - 0x10c], eax
je 0x10037650
mov dword [ebp - 0x860], 1
jmp 0x10037657
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0x860]
sub eax, dword [ebp - 0x104]
sub eax, dword [ebp - 0x90]
imul eax, dword [ebp - 0x104]
cmp dword [ebp - 0x90], eax
jge 0x10037684
mov dword [ebp - 0x560], 1
jmp 0x1003768b
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x560], eax
jl 0x100376a5
mov dword [ebp - 0xb10], 1
jmp 0x100376ac
and dword [ebp - 0xb10], 0
mov eax, dword [ebp - 0xb10]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x90], eax
jne 0x100376d2
mov dword [ebp - 0x568], 1
jmp 0x100376d9
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x568], eax
jle 0x100376f3
mov dword [ebp - 0x3d0], 1
jmp 0x100376fa
and dword [ebp - 0x3d0], 0
push 0
lea ecx, [ebp - 0x4ec]
call fcn.1000ba29
mov ecx, dword [ebp - 0x3d0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x10c], 0
jne 0x100378b6
push 1
lea ecx, [ebp - 0x4ec]
call fcn.1000ba29
mov eax, dword [eax]
sub eax, 0x1e8cb7da
imul eax, dword [ebp - 0x90]
test eax, eax
jne 0x10037762
push 0
lea ecx, [ebp - 0x4ec]
call fcn.1000ba29
cmp dword [eax], 0
jne 0x10037762
and dword [ebp - 0x868], 0
jmp 0x1003776c
mov dword [ebp - 0x868], 1
mov eax, dword [ebp - 0x868]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jne 0x1003778d
mov dword [ebp - 0x570], 1
jmp 0x10037794
and dword [ebp - 0x570], 0
push 1
lea ecx, [ebp - 0x4ec]
call fcn.1000ba29
mov ecx, dword [ebp - 0x570]
cmp ecx, dword [eax]
jne 0x100377b7
mov dword [ebp - 0x9e8], 1
jmp 0x100377be
and dword [ebp - 0x9e8], 0
mov eax, dword [ebp - 0x5a0]
cmp dword [ebp - 0x9e8], eax
jg 0x100377d8
mov dword [ebp - 0x578], 1
jmp 0x100377df
and dword [ebp - 0x578], 0
push 0
lea ecx, [ebp - 0x4ec]
call fcn.1000ba29
mov ecx, dword [ebp - 0x578]
cmp ecx, dword [eax]
jle 0x10037802
mov dword [ebp - 0x870], 1
jmp 0x10037809
and dword [ebp - 0x870], 0
cmp dword [ebp - 0x870], 2
jb 0x1003781e
mov dword [ebp - 0x580], 1
jmp 0x10037825
and dword [ebp - 0x580], 0
cmp dword [ebp - 0x580], 0
jge 0x10037843
cmp dword [ebp - 0xbd4], 0
je 0x10037843
mov dword [ebp - 0xaa8], 1
jmp 0x1003784a
and dword [ebp - 0xaa8], 0
mov eax, dword [ebp - 0x324]
cmp dword [ebp - 0xaa8], eax
jne 0x10037864
mov dword [ebp - 0x878], 1
jmp 0x1003786b
and dword [ebp - 0x878], 0
mov dword [ebp - 0x588], 3
mov eax, dword [ebp - 0x588]
cmp eax, dword [ebp - 0x878]
jl 0x1003788f
mov dword [ebp - 0x590], 1
jmp 0x10037896
and dword [ebp - 0x590], 0
push 0
lea ecx, [ebp - 0x4ec]
call fcn.1000ba29
mov eax, dword [eax]
cmp eax, dword [ebp - 0x590]
jl 0x100378b6
and dword [ebp - 0x9f0], 0
jmp 0x100378c0
mov dword [ebp - 0x9f0], 1
mov eax, dword [ebp - 0x45c]
inc eax
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x1274], eax
push 1
lea ecx, [ebp - 0x4ec]
call fcn.1000ba29
mov ecx, dword [ebp - 0x9f0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x90], eax
jg 0x10037908
mov dword [ebp - 0x598], 1
jmp 0x1003790f
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x324]
sub eax, dword [ebp - 0x598]
cmp eax, dword [ebp - 0x324]
jg 0x1003792f
mov dword [ebp - 0x880], 1
jmp 0x10037936
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x880]
cmp eax, dword [ebp - 0x5a0]
jne 0x10037956
mov dword [ebp - 0xb38], 1
jmp 0x1003795d
and dword [ebp - 0xb38], 0
mov eax, dword [ebp - 0xb38]
mov dword [ebp - 0xfdc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4ec]
call fcn.1000ba0d
mov dword [ebp - 0xe10], 0xffffffff
mov dword [ebp - 0xbdc], 0xfffffffb
push 0
push 0x32c5
push 0x6933
push 0x7d75
push 0x6f1a
push 0x6c78
push 0x3c8
lea eax, [ebp - 0xe10]
push eax
push 1
push 0x45e9
push 0x5e62
push 0x3092
push 0x5511
push 0
call fcn.1002dac2
add esp, 0x38
jmp 0x10037547
push 4
lea ecx, [ebp - 0x510]
call fcn.1000b98b
mov dword [ebp - 4], 5
mov dword [ebp - 0x54], 0x29000d4e
mov dword [ebp - 0x29c], 0
jmp 0x10037a0c
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 4
jge 0x10037a2e
push dword [ebp - 0x29c]
lea ecx, [ebp - 0x510]
call fcn.1000ba29
mov dword [eax], 0x207
jmp 0x100379ff
mov dword [ebp - 0x54], 0
jmp 0x10037a3e
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jg 0x10037d93
mov dword [ebp - 0xbe4], 0x1afe
cmp dword [ebp - 0xbe4], 0xc22
jge 0x10037af4
call fcn.10051e77
push 0x20
pop ecx
imul ecx, ecx, 0
add eax, ecx
push eax
push 0x10007b10
push 0x10007b14
call fcn.100523b7
add esp, 0xc
call fcn.10051e77
push 0x20
pop ecx
shl ecx, 0
add eax, ecx
push eax
push 0x10007b1c
push 0x10007b20
call fcn.100523b7
add esp, 0xc
lea eax, [ebp - 0x4a0]
push eax
mov ecx, 0x1065b470
call fcn.1004a823
mov dword [ebp - 0x5a8], eax
mov eax, dword [ebp - 0x5a8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x5a8]
add ecx, dword [eax + 4]
call fcn.10015f80
movzx eax, al
test eax, eax
je 0x10037af4
mov al, byte [ebp - 0x4a0]
mov byte [ebp - 0x150], al
mov dl, byte [ebp - 0x150]
mov ecx, 0x1065b3b8
call fcn.1004ad55
jmp 0x10037aa2
mov dword [ebp - 0x94], 0
jmp 0x10037b0d
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jge 0x10037b29
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x1620], 0xed69376
jmp 0x10037b00
mov dword [ebp - 0x94], 0
jmp 0x10037b42
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jge 0x10037b5e
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0xb8c], 0
jmp 0x10037b35
push dword [ebp - 0x54]
lea ecx, [ebp - 0x510]
call fcn.1000ba29
mov esi, eax
push dword [ebp - 0x54]
lea ecx, [ebp - 0x510]
call fcn.1000ba29
mov ecx, dword [esi]
imul ecx, dword [eax]
test ecx, ecx
jne 0x10037b93
xor eax, eax
inc eax
jne 0x10037b93
and dword [ebp - 0xf14], 0
jmp 0x10037b9d
mov dword [ebp - 0xf14], 1
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1290], eax
push dword [ebp - 0x54]
lea ecx, [ebp - 0x510]
call fcn.1000ba29
cmp dword [eax], 2
jge 0x10037bc5
mov dword [ebp - 0x888], 1
jmp 0x10037bcc
and dword [ebp - 0x888], 0
cmp dword [ebp - 0x888], 0x23cc
jl 0x10037be4
mov dword [ebp - 0x5b0], 1
jmp 0x10037beb
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x5b0]
sub eax, 0x47027eb9
cmp eax, 0x71639956
jle 0x10037c09
mov dword [ebp - 0x3d8], 1
jmp 0x10037c10
and dword [ebp - 0x3d8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3d8]
mov dword [ebp + eax - 0x1620], ecx
cmp dword [ebp - 0x3d8], 1
je 0x10037c38
mov dword [ebp - 0x9f8], 1
jmp 0x10037c3f
and dword [ebp - 0x9f8], 0
cmp dword [ebp - 0x9f8], 0
jne 0x10037c55
xor eax, eax
jne 0x10037c55
and dword [ebp - 0x5b8], 0
jmp 0x10037c5f
mov dword [ebp - 0x5b8], 1
push dword [ebp - 0x54]
lea ecx, [ebp - 0x510]
call fcn.1000ba29
mov ecx, dword [ebp - 0x5b8]
cmp ecx, dword [eax]
jne 0x10037c83
mov dword [ebp - 0xbec], 1
jmp 0x10037c8a
and dword [ebp - 0xbec], 0
push dword [ebp - 0x54]
lea ecx, [ebp - 0x510]
call fcn.1000ba29
push dword [ebp - 0x54]
lea ecx, [ebp - 0x510]
call fcn.1000ba29
mov ecx, dword [ebp - 0x54]
add ecx, 0xfffb
cmp dword [eax], ecx
jne 0x10037cbf
mov dword [ebp - 0x890], 1
jmp 0x10037cc6
and dword [ebp - 0x890], 0
push dword [ebp - 0x54]
lea ecx, [ebp - 0x510]
call fcn.1000ba29
mov ecx, dword [ebp - 0x890]
sub ecx, dword [eax]
je 0x10037d06
mov byte [ebp - 0xef], 0
push 0x70e7
lea eax, [ebp - 0xef]
push eax
push 0
push 1
push 0x38fd
push 1
call fcn.1002aeb0
add esp, 0x18
jmp 0x10037d26
mov dword [ebp - 0xe18], 0xfffffffb
mov dword [ebp - 0xbf4], 0x9ff7503a
mov eax, dword [ebp - 0xe18]
mov dword [ebp - 0xbf4], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb8c], 3
jmp 0x10037d54
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xb8c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb8c], 0
jl 0x10037d8e
mov byte [ebp - 0x160], 0
movzx eax, byte [ebp - 0x160]
test eax, eax
je 0x10037d8c
push 0x4b8d
push 0
push 0x445f
push 0
call fcn.1002a19b
add esp, 0x10
jmp 0x10037d39
jmp 0x10037a37
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x510]
call fcn.1000ba0d
mov eax, dword [ebp - 0xfb0]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x444], eax
mov dword [ebp - 0x1d8], 0xd4e06482
mov dword [ebp - 0x1d8], 0
jmp 0x10037dd4
mov eax, dword [ebp - 0x1d8]
dec eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0xffffffef
jg 0x10037ea0
mov dword [ebp - 0x1104], 0x5b0e446d
mov dword [ebp - 0x1100], 0x5b0e446d
mov dword [ebp - 0x10fc], 0x5b0e446d
mov dword [ebp - 0x10f8], 0x5b0e446d
lea ecx, [ebp - 0x4a5]
call fcn.1000ba38
push eax
lea eax, [ebp - 0x10f4]
push eax
lea eax, [ebp - 0x1104]
push eax
lea ecx, [ebp - 0x1674]
call fcn.1000ba3b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xff4]
call fcn.1000b9e7
mov dword [ebp - 4], 6
push 0
lea ecx, [ebp - 0xff4]
call fcn.1000ba29
cmp dword [eax], 0
je 0x10037e68
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xff4]
call fcn.1000ba0d
jmp 0x10037ea0
push 0x258a
push 0x1c4e
lea eax, [ebp - 0x1d8]
push eax
push 0
push 1
lea eax, [ebp - 0xff4]
push eax
call fcn.1002b05a
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xff4]
call fcn.1000ba0d
jmp 0x10037dc7
mov byte [ebp - 0xf1], 0
push 0
push 0x47b0
lea eax, [ebp - 0xf1]
push eax
call fcn.10046d80
add esp, 0xc
mov dword [ebp - 0x4c8], 0xd33a4a9b
mov dword [ebp - 0x4c4], 0xd33a4a9b
mov dword [ebp - 0x4c0], 0xd33a4a9b
mov dword [ebp - 0x4bc], 0xd33a4a9b
mov dword [ebp - 0x10], 0x2afe01bd
mov dword [ebp - 0x36c], 0
jmp 0x10037f05
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 3
jge 0x10037f21
mov eax, dword [ebp - 0x36c]
mov dword [ebp + eax*4 - 0xf48], 0xfffffff9
jmp 0x10037ef8
mov dword [ebp - 0x10], 3
jmp 0x10037f31
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x100382a0
mov dword [ebp - 0x48c], 0x29ed7d41
mov dword [ebp - 0x2a4], 0x8185f187
mov dword [ebp - 0xbfc], 0xffffffff
xor eax, eax
inc eax
je 0x10037f77
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x4c8], 0
je 0x10037f77
mov dword [ebp - 0x5c0], 1
jmp 0x10037f7e
and dword [ebp - 0x5c0], 0
cmp dword [ebp - 0x5c0], 1
jb 0x10037f9c
mov eax, 0x67bbda7
test eax, eax
je 0x10037f9c
mov dword [ebp - 0xab0], 1
jmp 0x10037fa3
and dword [ebp - 0xab0], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x4c8]
cmp dword [ebp - 0xab0], eax
jne 0x10037fc1
mov dword [ebp - 0x5c8], 1
jmp 0x10037fc8
and dword [ebp - 0x5c8], 0
cmp dword [ebp - 0x5c8], 9
jge 0x10037fdd
mov dword [ebp - 0x898], 1
jmp 0x10037fe4
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x898]
mov ecx, dword [ebp - 0x10]
cmp eax, dword [ebp + ecx*4 - 0x4c8]
je 0x10038005
mov dword [ebp - 0x5d0], 1
jmp 0x1003800c
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x5d0]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x2a4]
cmp ecx, dword [ebp + eax*4 - 0x4c8]
jne 0x10038039
mov dword [ebp - 0xa00], 1
jmp 0x10038040
and dword [ebp - 0xa00], 0
mov eax, dword [ebp - 0xa00]
inc eax
mov ecx, dword [ebp - 0x10]
cmp eax, dword [ebp + ecx*4 - 0x4c8]
jle 0x1003805f
mov dword [ebp - 0x5d8], 1
jmp 0x10038066
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x5d8]
sub eax, 0x2966b911
cmp eax, dword [ebp - 0x10]
jge 0x10038082
mov dword [ebp - 0x8a0], 1
jmp 0x10038089
and dword [ebp - 0x8a0], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x4c8]
imul eax, dword [ebp - 0x8a0]
test eax, eax
jne 0x100380b0
mov eax, 0x908c
test eax, eax
jne 0x100380b0
and dword [ebp - 0x5e0], 0
jmp 0x100380ba
mov dword [ebp - 0x5e0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4c8]
cmp eax, dword [ebp - 0x5e0]
jl 0x100380db
mov dword [ebp - 0xb18], 1
jmp 0x100380e2
and dword [ebp - 0xb18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x4c8]
neg eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0xb18]
imul eax, ecx
mov dword [ebp - 0xbfc], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x10038112
mov dword [ebp - 0x5e8], 1
jmp 0x10038119
and dword [ebp - 0x5e8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5e8]
mov dword [ebp + eax - 0xf48], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x48c]
cmp dword [ebp + eax - 0xf48], ecx
jne 0x1003814d
mov dword [ebp - 0x600], 1
jmp 0x10038154
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x4c8]
mov dword [ebp - 0x1298], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x4c8], 0
je 0x1003817d
mov dword [ebp - 0x8a8], 1
jmp 0x10038184
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0x8a8], eax
jne 0x1003819e
mov dword [ebp - 0x5f0], 1
jmp 0x100381a5
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x48c]
cmp dword [ebp - 0x5f0], eax
jne 0x100381d2
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x4c8], 0
jne 0x100381d2
mov eax, 0x128b80b
test eax, eax
jne 0x100381d2
and dword [ebp - 0xa08], 0
jmp 0x100381dc
mov dword [ebp - 0xa08], 1
cmp dword [ebp - 0xa08], 0
jl 0x100381f1
mov dword [ebp - 0x5f8], 1
jmp 0x100381f8
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x48c]
sub eax, dword [ebp - 0x5f8]
mov dword [ebp - 0x2a4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf48], 0xadd9258c
jae 0x1003822f
mov eax, 0xe971521f
test eax, eax
jne 0x1003822f
and dword [ebp - 0x8b0], 0
jmp 0x10038239
mov dword [ebp - 0x8b0], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x8b0]
sub ecx, dword [ebp + eax - 0xf48]
cmp ecx, 0xfffffff6
jge 0x1003825c
mov dword [ebp - 0xab8], 1
jmp 0x10038263
and dword [ebp - 0xab8], 0
mov eax, dword [ebp - 0x600]
imul eax, dword [ebp - 0xab8]
cmp eax, dword [ebp - 0x10]
jl 0x10038281
mov dword [ebp - 0x608], 1
jmp 0x10038288
and dword [ebp - 0x608], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x608]
mov dword [ebp + eax - 0xf48], ecx
jmp 0x10037f2a
push 4
lea ecx, [ebp - 0x504]
call fcn.1000b98b
mov dword [ebp - 4], 7
mov dword [ebp - 0x2ac], 0xa48bbca6
mov dword [ebp - 0x12a0], 0xdc4b4e12
mov dword [ebp - 0x12a8], 8
mov dword [ebp - 0x12b0], 8
mov dword [ebp - 0x12b8], 0
mov dword [ebp - 0x8b8], 0xfff9
mov dword [ebp - 0x32c], 0
jmp 0x10038309
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 3
jge 0x10038325
mov eax, dword [ebp - 0x32c]
mov dword [ebp + eax*4 - 0x16bc], 0xffffffff
jmp 0x100382fc
mov dword [ebp - 0x2ac], 0
jmp 0x1003833e
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0xf
jge 0x1003837d
mov dword [ebp - 0xe20], 0xfff8
push 0x790d
push 0
push 0x36d
lea eax, [ebp - 0xe20]
push eax
push 0x1374
push 0x1beb
push 0x1bd7
call fcn.100410fb
add esp, 0x1c
jmp 0x10038331
mov eax, dword [ebp - 0x8b8]
dec eax
mov dword [ebp - 0x8b8], eax
mov dword [ebp - 0x48], 0x29000d4e
mov dword [ebp - 0x3ac], 0
jmp 0x100383aa
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 4
jge 0x100383cc
push dword [ebp - 0x3ac]
lea ecx, [ebp - 0x504]
call fcn.1000ba29
mov dword [eax], 0x207
jmp 0x1003839d
mov dword [ebp - 0x24], 0xc184c506
push 2
lea ecx, [ebp - 0x4f8]
call fcn.1000b98b
mov byte [ebp - 4], 8
mov dword [ebp - 0x12c0], 0xfffffffa
mov dword [ebp - 0x210], 0
jmp 0x10038407
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 2
jge 0x10038423
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0x208], 0xb57f
jmp 0x100383fa
lea eax, [ebp - 0x210]
push eax
push 0xc5f
lea eax, [ebp - 0x4f8]
push eax
push 0x44de
push 0
call fcn.1002f2cb
add esp, 0x14
mov dword [ebp - 0x24], 1
jmp 0x10038455
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x10038690
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x208], 0
jne 0x10038482
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x208], 0
jne 0x10038482
and dword [ebp - 0x610], 0
jmp 0x1003848c
mov dword [ebp - 0x610], 1
push 0
lea ecx, [ebp - 0x4f8]
call fcn.1000ba29
mov eax, dword [eax]
cmp eax, dword [ebp - 0x610]
jl 0x100384af
mov dword [ebp - 0xa10], 1
jmp 0x100384b6
and dword [ebp - 0xa10], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xa10]
sub ecx, dword [ebp + eax*4 - 0x208]
jne 0x100384e1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x208], 0
jne 0x100384e1
and dword [ebp - 0x618], 0
jmp 0x100384eb
mov dword [ebp - 0x618], 1
mov eax, dword [ebp - 0x618]
neg eax
jne 0x10038502
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x208], 0
je 0x1003851b
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x208], 0
je 0x1003851b
mov dword [ebp - 0x8c0], 1
jmp 0x10038522
and dword [ebp - 0x8c0], 0
cmp dword [ebp - 0x8c0], 0
jbe 0x10038537
mov dword [ebp - 0x620], 1
jmp 0x1003853e
and dword [ebp - 0x620], 0
push 1
lea ecx, [ebp - 0x4f8]
call fcn.1000ba29
mov ecx, dword [ebp - 0x620]
cmp ecx, dword [eax]
je 0x10038561
mov dword [ebp - 0xb28], 1
jmp 0x10038568
and dword [ebp - 0xb28], 0
push 0
lea ecx, [ebp - 0x4f8]
call fcn.1000ba29
mov ecx, dword [ebp - 0xb28]
cmp ecx, dword [eax]
jg 0x1003858b
mov dword [ebp - 0xc04], 1
jmp 0x10038592
and dword [ebp - 0xc04], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x208]
mov dword [ebp - 0x12c8], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x208]
mov dword [ebp - 0x12d0], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x208]
mov dword [ebp - 0x12d8], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x208]
mov dword [ebp - 0x12e0], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x208], ecx
je 0x100385ed
mov dword [ebp - 0x628], 1
jmp 0x100385f4
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x628], eax
jle 0x1003860b
mov dword [ebp - 0x8c8], 1
jmp 0x10038612
and dword [ebp - 0x8c8], 0
mov esi, dword [ebp - 0x8c8]
inc esi
push 0
lea ecx, [ebp - 0x4f8]
call fcn.1000ba29
cmp esi, dword [eax]
jl 0x10038636
mov dword [ebp - 0x630], 1
jmp 0x1003863d
and dword [ebp - 0x630], 0
push 0
lea ecx, [ebp - 0x4f8]
call fcn.1000ba29
mov esi, dword [ebp - 0x630]
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0x4f8]
call fcn.1000ba29
cmp esi, dword [eax]
jge 0x1003866f
mov dword [ebp - 0xa18], 1
jmp 0x10038676
and dword [ebp - 0xa18], 0
push 1
lea ecx, [ebp - 0x4f8]
call fcn.1000ba29
mov ecx, dword [ebp - 0xa18]
mov dword [eax], ecx
jmp 0x1003844e
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x4f8]
call fcn.1000ba0d
mov dword [ebp - 0x48], 0
jmp 0x100386af
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jg 0x1003b012
push 3
lea ecx, [ebp - 0x11a0]
call fcn.1000b98b
mov byte [ebp - 4], 9
mov dword [ebp - 0x1e0], 0xffffffff
mov dword [ebp - 0xc0c], 0x2f3ccd24
mov dword [ebp - 0x12e8], 0x3f5e3d1a
push 0x318
push 0x2061
push 0x6655
push 0x22f5
push 1
lea eax, [ebp - 0x11a0]
push eax
push 0x3069
push 0
lea eax, [ebp - 0x12f0]
push eax
push 0x2572
push 0
push 0x2907
call fcn.1003640a
add esp, 0x30
mov byte [ebp - 0x152], 0
movzx eax, byte [ebp - 0x152]
test eax, eax
je 0x10038747
push 0
push 0x513f
call fcn.100413ec
pop ecx
pop ecx
mov dword [ebp - 0x1e0], 2
jmp 0x10038760
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
jl 0x10038859
mov dword [ebp - 0x228], 0
push 4
lea ecx, [ebp - 0x1188]
call fcn.1000b98b
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x2b4], 0
jmp 0x100387a1
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 4
jge 0x100387c3
push dword [ebp - 0x2b4]
lea ecx, [ebp - 0x1188]
call fcn.1000ba29
mov dword [eax], 0xd5493e6
jmp 0x10038794
mov byte [ebp - 0xf3], 0
movzx eax, byte [ebp - 0xf3]
test eax, eax
je 0x100387e3
push 0x4576
push 0
call fcn.1002d7d1
pop ecx
pop ecx
mov dword [ebp - 0x228], 2
jmp 0x100387fc
mov eax, dword [ebp - 0x228]
dec eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
jl 0x10038845
mov dword [ebp - 0xf1c], 0x30c4e2bf
push 0
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0xf1c]
push eax
lea eax, [ebp - 0xc0c]
push eax
lea eax, [ebp - 0x11a0]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x1188]
push eax
call fcn.1002f6df
add esp, 0x1c
jmp 0x100387ef
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1188]
call fcn.1000ba0d
jmp 0x10038753
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x11a0]
call fcn.1000ba0d
mov dword [ebp - 0x638], 0xfff7
mov dword [ebp - 0xe28], 0x1d1b984
cmp dword [ebp - 0x638], 0
je 0x10038895
push 0
push 0x1062
call fcn.100416b8
pop ecx
pop ecx
jmp 0x100388f4
mov byte [ebp - 0x15a], 0
movzx eax, byte [ebp - 0x15a]
test eax, eax
je 0x100388f4
push 0x4f56
push 0x3bca
push 0x62a7
push 0x5686
push 0x32f9
push 0x2844
push 0x6ee6
push 0x794f
push 1
push 0x3688
push 0x53df
push 0x10c5
push 0x1dad
push 0x4f4e
push 0
call fcn.1002a8af
add esp, 0x3c
push 1
lea eax, [ebp - 0xe28]
push eax
push 0x2c5f
push 0x6316
push 0
lea eax, [ebp - 0x638]
push eax
push 0
call fcn.10031b65
add esp, 0x1c
mov dword [ebp - 0xc14], 0x1813
cmp dword [ebp - 0xc14], 0xf62
jge 0x10038a02
lea eax, [ebp - 0x3e0]
push eax
push 0x10007a0c
call fcn.1005162b
pop ecx
pop ecx
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0xfd4], eax
mov eax, dword [ebp - 0x3e0]
dec eax
mov dword [ebp - 0x3e0], eax
cmp dword [ebp - 0xfd4], 0
je 0x10038a02
lea eax, [ebp - 0x8d0]
push eax
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0xc1c]
push eax
push 0x10007b94
call fcn.1005162b
add esp, 0x10
mov eax, dword [ebp - 0x8d0]
cdq
sub eax, edx
sar eax, 1
push eax
push dword [ebp - 0x464]
call fcn.1003638a
pop ecx
pop ecx
mov esi, eax
mov eax, dword [ebp - 0x8d0]
cdq
sub eax, edx
sar eax, 1
push eax
push dword [ebp - 0x464]
call fcn.1003638a
pop ecx
pop ecx
mov ecx, dword [ebp - 0x464]
sub ecx, eax
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
push eax
push dword [ebp - 0xc1c]
call fcn.1003638a
pop ecx
pop ecx
add esi, eax
imul eax, esi, 3
mov dword [ebp - 0xe30], eax
push dword [ebp - 0xe30]
push 0x10007818
call fcn.10051846
pop ecx
pop ecx
jmp 0x10038947
mov dword [ebp - 0xc8], 0
jmp 0x10038a1b
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jge 0x10038a37
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x15d8], 0xed69376
jmp 0x10038a0e
mov dword [ebp - 0xc8], 0
jmp 0x10038a50
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jge 0x10038a6c
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0xb9c], 0
jmp 0x10038a43
mov dword [ebp - 0x60], 0xffffffff
mov dword [ebp - 0xc24], 0
mov dword [ebp - 0xa8], 0
jmp 0x10038a96
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x10038ab2
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x4d0], 0x3198a8f9
jmp 0x10038a89
mov dword [ebp - 0xa8], 0
jmp 0x10038acb
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x10038ae7
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x16c8], 0xffffffff
jmp 0x10038abe
mov dword [ebp - 0x60], 0
jmp 0x10038af7
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jg 0x10038bd3
mov dword [ebp - 0xf24], 1
mov dword [ebp - 0xc2c], 0xd99ea7eb
mov eax, dword [ebp - 0x60]
cmp dword [ebp + eax*4 - 0x4d0], 0
jne 0x10038b2d
mov eax, dword [ebp - 0x60]
cmp dword [ebp + eax*4 - 0x4d0], 0
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x60]
mov ecx, dword [ebp + ecx*4 - 0x4d0]
imul edx, dword [ebp - 0x60], 9
add ecx, edx
imul ecx, ecx, 0xaced
sub ecx, dword [ebp - 0x60]
cmp dword [ebp + eax*4 - 0x4d0], ecx
jle 0x10038b6b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4d0], 0
je 0x10038b6b
and dword [ebp - 0x640], 0
jmp 0x10038b75
mov dword [ebp - 0x640], 1
mov eax, dword [ebp - 0xc24]
cmp dword [ebp - 0x640], eax
jge 0x10038b8f
mov dword [ebp - 0xac0], 1
jmp 0x10038b96
and dword [ebp - 0xac0], 0
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp + eax*4 - 0x4d0]
imul eax, dword [ebp - 0xac0]
cmp eax, dword [ebp - 0xf24]
jg 0x10038bbb
mov dword [ebp - 0x648], 1
jmp 0x10038bc2
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0xc2c], eax
jmp 0x10038af0
push dword [ebp - 0x48]
lea ecx, [ebp - 0x504]
call fcn.1000ba29
mov esi, eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0x504]
call fcn.1000ba29
mov ecx, dword [esi]
imul ecx, dword [eax]
test ecx, ecx
jne 0x10038c08
xor eax, eax
inc eax
jne 0x10038c08
and dword [ebp - 0xe38], 0
jmp 0x10038c12
mov dword [ebp - 0xe38], 1
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x12f8], eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0x504]
call fcn.1000ba29
cmp dword [eax], 2
jge 0x10038c3a
mov dword [ebp - 0x8d8], 1
jmp 0x10038c41
and dword [ebp - 0x8d8], 0
cmp dword [ebp - 0x8d8], 0x23cc
jl 0x10038c59
mov dword [ebp - 0x650], 1
jmp 0x10038c60
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x650]
sub eax, 0x47027eb9
cmp eax, 0x71639956
jle 0x10038c7e
mov dword [ebp - 0x3e8], 1
jmp 0x10038c85
and dword [ebp - 0x3e8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3e8]
mov dword [ebp + eax - 0x15d8], ecx
cmp dword [ebp - 0x3e8], 1
je 0x10038cad
mov dword [ebp - 0xa20], 1
jmp 0x10038cb4
and dword [ebp - 0xa20], 0
cmp dword [ebp - 0xa20], 0
jne 0x10038cca
xor eax, eax
jne 0x10038cca
and dword [ebp - 0x658], 0
jmp 0x10038cd4
mov dword [ebp - 0x658], 1
push dword [ebp - 0x48]
lea ecx, [ebp - 0x504]
call fcn.1000ba29
mov ecx, dword [ebp - 0x658]
cmp ecx, dword [eax]
jne 0x10038cf8
mov dword [ebp - 0xc34], 1
jmp 0x10038cff
and dword [ebp - 0xc34], 0
push dword [ebp - 0x48]
lea ecx, [ebp - 0x504]
call fcn.1000ba29
push dword [ebp - 0x48]
lea ecx, [ebp - 0x504]
call fcn.1000ba29
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffb
cmp dword [eax], ecx
jne 0x10038d34
mov dword [ebp - 0x8e0], 1
jmp 0x10038d3b
and dword [ebp - 0x8e0], 0
push dword [ebp - 0x48]
lea ecx, [ebp - 0x504]
call fcn.1000ba29
mov ecx, dword [ebp - 0x8e0]
sub ecx, dword [eax]
je 0x100396e9
push 1
lea ecx, [ebp - 0x106c]
call fcn.1000b98b
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x334], 0x813a3dbc
mov dword [ebp - 0x4a4], 0x7005
mov dword [ebp - 0x660], 0xa4bc
mov dword [ebp - 0x3f0], 6
mov dword [ebp - 0xc3c], 0xffffffff
mov dword [ebp - 0xe40], 0xdda30181
lea eax, [ebp - 0x2c]
push eax
push 0
lea eax, [ebp - 0x106c]
push eax
call fcn.10045819
add esp, 0xc
mov dword [ebp - 0x2c], 0
jmp 0x10038dc9
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x10038ddf
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xdfc], 0xd62e652
jmp 0x10038dc2
mov dword [ebp - 0x2c], 0
jmp 0x10038def
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x10038e05
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x108c], 0xfffffffa
jmp 0x10038de8
mov dword [ebp - 0x2c], 0
jmp 0x10038e15
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10038e2b
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xa30], 0x2c90
jmp 0x10038e0e
push 0
lea ecx, [ebp - 0x106c]
call fcn.1000ba29
cmp dword [eax], 0
je 0x1003909e
cmp dword [ebp - 0x660], 0
je 0x10038ea2
cmp dword [ebp - 0x660], 0x8f0b
jl 0x10038e62
mov dword [ebp - 0xb20], 1
jmp 0x10038e69
and dword [ebp - 0xb20], 0
mov eax, dword [ebp - 0x334]
cmp dword [ebp - 0xb20], eax
je 0x10038e83
mov dword [ebp - 0x668], 1
jmp 0x10038e8a
and dword [ebp - 0x668], 0
cmp dword [ebp - 0x668], 0x1cc0e426
jl 0x10038ea2
mov dword [ebp - 0x8e8], 1
jmp 0x10038ea9
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x8e8]
dec eax
je 0x10038ebe
mov dword [ebp - 0x670], 1
jmp 0x10038ec5
and dword [ebp - 0x670], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdfc]
cmp dword [ebp - 0x670], eax
jne 0x10038ee6
mov dword [ebp - 0xa28], 1
jmp 0x10038eed
and dword [ebp - 0xa28], 0
mov eax, dword [ebp - 0xa28]
sub eax, dword [ebp - 0x334]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xdfc]
mov dword [ebp - 0x678], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x678]
mov dword [ebp + eax - 0xdfc], ecx
cmp dword [ebp - 0x678], 0
jne 0x10038f38
push 4
pop eax
test eax, eax
jne 0x10038f38
and dword [ebp - 0x8f0], 0
jmp 0x10038f42
mov dword [ebp - 0x8f0], 1
mov eax, dword [ebp - 0x8f0]
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x334]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x108c]
test eax, eax
jl 0x10038f73
mov dword [ebp - 0x680], 1
jmp 0x10038f7a
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x4a4]
dec eax
mov dword [ebp - 0x4a4], eax
mov eax, dword [ebp - 0x4a4]
cmp eax, dword [ebp - 0x680]
je 0x10038faa
mov eax, 0x4fcd
test eax, eax
je 0x10038faa
mov dword [ebp - 0xac8], 1
jmp 0x10038fb1
and dword [ebp - 0xac8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x108c]
cmp dword [ebp - 0xac8], eax
je 0x10038fd2
mov dword [ebp - 0x688], 1
jmp 0x10038fd9
and dword [ebp - 0x688], 0
push 0
lea ecx, [ebp - 0x106c]
call fcn.1000ba29
mov eax, dword [eax]
cmp eax, dword [ebp - 0x688]
jge 0x10038ffc
mov dword [ebp - 0x8f8], 1
jmp 0x10039003
and dword [ebp - 0x8f8], 0
cmp dword [ebp - 0x8f8], 0x92f644a
je 0x1003901b
mov dword [ebp - 0xfb8], 1
jmp 0x10039022
and dword [ebp - 0xfb8], 0
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x1300], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3f0]
cmp dword [ebp + eax - 0xa30], ecx
jne 0x1003904f
mov dword [ebp - 0x690], 1
jmp 0x10039056
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x3f0]
cmp dword [ebp - 0x690], eax
jl 0x10039070
mov dword [ebp - 0x698], 1
jmp 0x10039077
and dword [ebp - 0x698], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa30]
add eax, dword [ebp - 0x698]
cmp eax, dword [ebp - 0xc3c]
je 0x1003909e
mov dword [ebp - 0x900], 1
jmp 0x100390a5
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0xe40], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x106c]
call fcn.1000ba0d
mov byte [ebp - 0xf5], 0
mov dword [ebp - 0x374], 0x571177e8
mov dword [ebp - 0xf2c], 0xfffffffb
mov dword [ebp - 0x2bc], 0
jmp 0x100390f4
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 4
jge 0x10039110
mov eax, dword [ebp - 0x2bc]
mov dword [ebp + eax*4 - 0x16f0], 0x45f1
jmp 0x100390e7
mov dword [ebp - 0x374], 0
jmp 0x10039129
mov eax, dword [ebp - 0x374]
dec eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0xffffffe7
je 0x10039224
mov dword [ebp - 0x10dc], 0x2c0d37ad
mov dword [ebp - 0x10d8], 0x2c0d37ad
mov dword [ebp - 0x10d4], 0x2c0d37ad
mov dword [ebp - 0x10d0], 0x2c0d37ad
lea ecx, [ebp - 0x3bd]
call fcn.1000ba38
push eax
lea eax, [ebp - 0x10cc]
push eax
lea eax, [ebp - 0x10dc]
push eax
lea ecx, [ebp - 0x1654]
call fcn.1000ba3b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1084]
call fcn.1000b9e7
mov byte [ebp - 4], 0xc
push 2
lea ecx, [ebp - 0x1084]
call fcn.1000ba29
mov dword [eax], 3
jmp 0x100391d0
push 2
lea ecx, [ebp - 0x1084]
call fcn.1000ba29
mov dword [ebp - 0x6a0], eax
mov eax, dword [ebp - 0x6a0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x6a0]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x1084]
call fcn.1000ba29
cmp dword [eax], 0
jl 0x10039210
mov dword [ebp - 0xc44], 0x781ced8f
lea eax, [ebp - 0xc44]
push eax
push 0
push 0x5b88
lea eax, [ebp - 0xf2c]
push eax
push 0x571b
call fcn.100312a6
add esp, 0x14
jmp 0x100391ac
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1084]
call fcn.1000ba0d
jmp 0x1003911c
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x100396e4
mov dword [ebp - 0xfcc], 0x177e8edf
mov dword [ebp - 0xfc8], 0x177e8edf
mov dword [ebp - 0xfc4], 0x177e8edf
mov dword [ebp - 0xfc0], 0x177e8edf
mov dword [ebp - 0x1e8], 0x1ced
mov dword [ebp - 0x114], 0xfffffff8
mov dword [ebp - 0x1308], 0x3d57638f
mov dword [ebp - 0x1310], 0
mov dword [ebp - 0x1318], 0xbc8b6976
mov dword [ebp - 0x1320], 0x83d4f39a
mov dword [ebp - 0x1328], 2
mov dword [ebp - 0x2c4], 0
jmp 0x100392ba
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 3
jge 0x100392d6
mov eax, dword [ebp - 0x2c4]
mov dword [ebp + eax*4 - 0x16d4], 0xd3384f7a
jmp 0x100392ad
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xfcc], 0
je 0x10039327
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x10039308
push 0x73e3
push 0
push 0
call fcn.1002ad9f
add esp, 0xc
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x10039322
push 0
call fcn.1002b261
pop ecx
jmp 0x100396d9
mov dword [ebp - 0x2cc], 0
mov dword [ebp - 0x3f8], 0x169ff9e6
mov dword [ebp - 0x1330], 0x1562
mov dword [ebp - 0xc5c], 0xd69c043c
mov dword [ebp - 0x33c], 0
jmp 0x10039368
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 4
jge 0x10039384
mov eax, dword [ebp - 0x33c]
mov dword [ebp + eax*4 - 0x1260], 0xa31e468a
jmp 0x1003935b
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x1338], eax
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x1340], eax
cmp dword [ebp - 0x1e8], 0
jne 0x100393b7
cmp dword [ebp - 0x114], 0
jne 0x100393b7
and dword [ebp - 0xb2c], 0
jmp 0x100393c1
mov dword [ebp - 0xb2c], 1
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0xb2c], eax
jle 0x100393db
mov dword [ebp - 0x6a8], 1
jmp 0x100393e2
and dword [ebp - 0x6a8], 0
cmp dword [ebp - 0x6a8], 0
je 0x100393f7
mov dword [ebp - 0x908], 1
jmp 0x100393fe
and dword [ebp - 0x908], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xfcc]
add ecx, dword [ebp - 0x908]
cmp dword [ebp + eax - 0xfcc], ecx
jl 0x10039434
mov eax, 0xb441a62a
test eax, eax
je 0x10039434
mov dword [ebp - 0x46c], 1
jmp 0x1003943b
and dword [ebp - 0x46c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x46c]
mov dword [ebp + eax - 0x1260], ecx
cmp dword [ebp - 0x46c], 0
je 0x10039467
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1260], 0
jne 0x1003946e
cmp dword [ebp - 0x1e8], 0
mov dword [ebp - 0x2cc], 0x231fbf68
cmp dword [ebp - 0x2cc], 0
je 0x10039528
mov dword [ebp - 0xe48], 0x5300
mov dword [ebp - 0x114], 0x10
jmp 0x100394a8
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xfffffffb
jne 0x100394e9
mov dword [ebp - 0xc4c], 1
push 0x49e4
push 0
lea eax, [ebp - 0xc4c]
push eax
push 0
push 0x66ce
push 0x364f
push 0x3827
push 0x121a
call fcn.10040fa9
add esp, 0x20
jmp 0x1003949b
mov eax, 0x93208af0
test eax, eax
je 0x10039510
cmp dword [ebp - 0x114], 0
je 0x10039510
cmp dword [ebp - 0xe48], 0
je 0x10039510
mov dword [ebp - 0x6b0], 1
jmp 0x10039517
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x2cc], eax
jmp 0x100396b0
mov dword [ebp - 0x6b8], 0x9a67
push 2
lea ecx, [ebp - 0xf58]
call fcn.1000b98b
mov byte [ebp - 4], 0xd
push 0x32c4
push 0x597d
lea eax, [ebp - 0x1348]
push eax
push 0x5034
push 0x987
push 0
lea eax, [ebp - 0xf58]
push eax
call fcn.1002b2a3
add esp, 0x1c
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x1260]
push 0
lea ecx, [ebp - 0xf58]
call fcn.1000ba29
cmp esi, dword [eax]
jg 0x10039599
mov dword [ebp - 0xa38], 1
jmp 0x100395a0
and dword [ebp - 0xa38], 0
mov eax, dword [ebp - 0x1e8]
mov ecx, dword [ebp - 0xa38]
sub ecx, 0x19c36c1d
imul eax, ecx
test eax, eax
je 0x100395d7
push 1
lea ecx, [ebp - 0xf58]
call fcn.1000ba29
cmp dword [eax], 0
je 0x100395d7
mov dword [ebp - 0x910], 1
jmp 0x100395de
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x6b8], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xfcc]
add eax, dword [ebp - 0x6b8]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x1260]
sub ecx, eax
xor eax, eax
sub eax, ecx
mov dword [ebp - 0xc54], eax
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0xfe4], eax
mov eax, dword [ebp - 0x3f8]
dec eax
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0xc54]
cmp eax, dword [ebp - 0xfe4]
jg 0x10039648
mov dword [ebp - 0x6c0], 1
jmp 0x1003964f
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x6c0], eax
jge 0x10039669
mov dword [ebp - 0xad4], 1
jmp 0x10039670
and dword [ebp - 0xad4], 0
cmp dword [ebp - 0xad4], 0
jge 0x10039685
mov dword [ebp - 0x6c8], 1
jmp 0x1003968c
and dword [ebp - 0x6c8], 0
push 1
lea ecx, [ebp - 0xf58]
call fcn.1000ba29
mov ecx, dword [ebp - 0x6c8]
mov dword [eax], ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xf58]
call fcn.1000ba0d
push 0
push 1
lea eax, [ebp - 0xc5c]
push eax
push 0x2155
push 0x7754
push 0x1751
push 1
push 0x22f5
call fcn.1002b143
add esp, 0x20
push 0x17b6
call dword [sym.imp.USER32.dll_IsWindow]
jmp 0x10039cc2
mov dword [ebp - 0x1a8], 0xfffffffe
mov dword [ebp - 0x6d0], 0x8bea1220
mov dword [ebp - 0x918], 1
push 1
lea ecx, [ebp - 0x11b8]
call fcn.1000b98b
mov byte [ebp - 4], 0xe
mov dword [ebp - 0xc74], 0xb90f9986
mov dword [ebp - 0xf3c], 0
mov dword [ebp - 0xc6c], 8
mov dword [ebp - 0xe58], 0xfffffff9
lea eax, [ebp - 0x11b8]
push eax
lea eax, [ebp - 0x1350]
push eax
push 0
push 0x5fdd
call fcn.1004350b
add esp, 0x10
mov dword [ebp - 0x1a8], 0xfffffff2
jmp 0x10039776
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0x1a
jne 0x100397e9
mov dword [ebp - 0xc64], 0
mov dword [ebp - 0xe50], 0x28ea3888
mov byte [ebp - 0xf7], 0
movzx eax, byte [ebp - 0xf7]
test eax, eax
je 0x100397b0
push 1
push 1
call fcn.10029e78
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x1a8]
push eax
push 0x3246
lea eax, [ebp - 0x6d0]
push eax
lea eax, [ebp - 0xe50]
push eax
lea eax, [ebp - 0xc64]
push eax
push 0x5ec7
lea eax, [ebp - 0x918]
push eax
call fcn.1002cace
add esp, 0x20
jmp 0x10039769
push 0
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0xf3c]
push eax
lea eax, [ebp - 0xc6c]
push eax
push 0x1596
lea eax, [ebp - 0xe58]
push eax
lea eax, [ebp - 0x11b8]
push eax
lea eax, [ebp - 0x918]
push eax
lea eax, [ebp - 0xc74]
push eax
push 0x1ef
lea eax, [ebp - 0x6d0]
push eax
call fcn.1002b387
add esp, 0x2c
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x11b8]
call fcn.1000ba0d
mov dword [ebp - 0xc84], 0xfffffffb
mov dword [ebp - 0xe8c], 0x9ff7503a
mov dword [ebp - 0x218], 9
mov dword [ebp - 0xfa0], 0xcecb4571
lea eax, [ebp - 0x218]
push eax
push 0
push 1
lea eax, [ebp - 0xfa0]
push eax
call fcn.1002a516
add esp, 0x10
mov dword [ebp - 0x218], 0
jmp 0x1003989f
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0x17
jle 0x10039cb6
mov dword [ebp - 0xbb8], 0x1d54
cmp dword [ebp - 0xbb8], 0x65c
jge 0x10039c6e
lea eax, [ebp - 0xe64]
push eax
push 0x100077f0
call fcn.1005162b
pop ecx
pop ecx
mov dword [ebp - 0x394], 1
jmp 0x100398f2
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x394]
cmp eax, dword [ebp - 0xe64]
jg 0x10039c6e
push dword [ebp - 0x394]
push 0x10007c68
call fcn.10051846
pop ecx
pop ecx
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x494]
push eax
push 0x10007a10
call fcn.1005162b
add esp, 0xc
and dword [ebp - 0x1b0], 0
jmp 0x10039947
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]
cmp eax, dword [ebp - 0x494]
jge 0x100399da
and dword [ebp - 0x1a4], 0
jmp 0x1003996f
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
cmp eax, dword [ebp - 0x344]
jge 0x100399d5
imul eax, dword [ebp - 0x1b0], 0x214
lea eax, [ebp + eax - 0x12b54]
mov ecx, dword [ebp - 0x1a4]
lea eax, [eax + ecx*4]
push eax
push 0x100077f0
call fcn.1005162b
pop ecx
pop ecx
imul eax, dword [ebp - 0x1b0], 0x214
lea eax, [ebp + eax - 0x12b54]
mov ecx, dword [ebp - 0x1a4]
cmp dword [eax + ecx*4], 0
jne 0x100399d3
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x14], eax
jmp 0x10039962
jmp 0x1003993a
xor eax, eax
inc eax
je 0x10039bc4
lea eax, [ebp - 0x7c]
push eax
push 0x100077f0
call fcn.1005162b
pop ecx
pop ecx
cmp dword [ebp - 0x7c], 0
jne 0x100399fe
jmp 0x10039bc4
cmp dword [ebp - 0x18], 0
jle 0x10039a6b
mov eax, dword [ebp - 0x18]
dec eax
imul eax, eax, 0x214
lea eax, [ebp + eax - 0x12b54]
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + ecx*4]
cmp eax, dword [ebp - 0x7c]
jne 0x10039a6b
push dword [ebp - 0x7c]
push 0x10007c80
call fcn.10051846
pop ecx
pop ecx
mov eax, dword [ebp - 0x18]
dec eax
imul eax, eax, 0x214
lea eax, [ebp + eax - 0x12b54]
mov ecx, dword [ebp - 0x14]
lea edx, [eax + ecx*4]
imul eax, dword [ebp - 0x18], 0x214
lea eax, [ebp + eax - 0x12b54]
mov ecx, dword [ebp - 0x14]
lea ecx, [eax + ecx*4]
call fcn.1000f0c7
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
jmp 0x10039bbf
mov eax, dword [ebp - 0x494]
dec eax
cmp dword [ebp - 0x18], eax
jge 0x10039ade
mov eax, dword [ebp - 0x18]
inc eax
imul eax, eax, 0x214
lea eax, [ebp + eax - 0x12b54]
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + ecx*4]
cmp eax, dword [ebp - 0x7c]
jne 0x10039ade
push dword [ebp - 0x7c]
push 0x10007c9c
call fcn.10051846
pop ecx
pop ecx
mov eax, dword [ebp - 0x18]
inc eax
imul eax, eax, 0x214
lea eax, [ebp + eax - 0x12b54]
mov ecx, dword [ebp - 0x14]
lea edx, [eax + ecx*4]
imul eax, dword [ebp - 0x18], 0x214
lea eax, [ebp + eax - 0x12b54]
mov ecx, dword [ebp - 0x14]
lea ecx, [eax + ecx*4]
call fcn.1000f0c7
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
jmp 0x10039bbf
cmp dword [ebp - 0x14], 0
jle 0x10039b44
imul eax, dword [ebp - 0x18], 0x214
lea eax, [ebp + eax - 0x12b54]
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + ecx*4 - 4]
cmp eax, dword [ebp - 0x7c]
jne 0x10039b44
push dword [ebp - 0x7c]
push 0x10007cb8
call fcn.10051846
pop ecx
pop ecx
imul eax, dword [ebp - 0x18], 0x214
lea eax, [ebp + eax - 0x12b54]
mov ecx, dword [ebp - 0x14]
lea edx, [eax + ecx*4 - 4]
imul eax, dword [ebp - 0x18], 0x214
lea eax, [ebp + eax - 0x12b54]
mov ecx, dword [ebp - 0x14]
lea ecx, [eax + ecx*4]
call fcn.1000f0c7
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
jmp 0x10039bbf
mov eax, dword [ebp - 0x344]
dec eax
cmp dword [ebp - 0x14], eax
jge 0x10039bb0
imul eax, dword [ebp - 0x18], 0x214
lea eax, [ebp + eax - 0x12b54]
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + ecx*4 + 4]
cmp eax, dword [ebp - 0x7c]
jne 0x10039bb0
push dword [ebp - 0x7c]
push 0x10007cd4
call fcn.10051846
pop ecx
pop ecx
imul eax, dword [ebp - 0x18], 0x214
lea eax, [ebp + eax - 0x12b54]
mov ecx, dword [ebp - 0x14]
lea edx, [eax + ecx*4 + 4]
imul eax, dword [ebp - 0x18], 0x214
lea eax, [ebp + eax - 0x12b54]
mov ecx, dword [ebp - 0x14]
lea ecx, [eax + ecx*4]
call fcn.1000f0c7
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
jmp 0x10039bbf
push dword [ebp - 0x7c]
push 0x10007cf0
call fcn.10051846
pop ecx
pop ecx
jmp 0x100399da
and dword [ebp - 0x2d4], 0
jmp 0x10039bda
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x2d4]
cmp eax, dword [ebp - 0x494]
jge 0x10039c5e
and dword [ebp - 0x1f0], 0
jmp 0x10039bfe
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f0]
cmp eax, dword [ebp - 0x344]
jge 0x10039c4e
imul eax, dword [ebp - 0x2d4], 0x214
lea eax, [ebp + eax - 0x12b54]
mov ecx, dword [ebp - 0x1f0]
push dword [eax + ecx*4]
push 0x100077f0
call fcn.10051846
pop ecx
pop ecx
mov eax, dword [ebp - 0x344]
dec eax
cmp dword [ebp - 0x1f0], eax
je 0x10039c4c
push 0x10007ae4
call fcn.10051846
pop ecx
jmp 0x10039bf1
push 0x10007bfc
call fcn.10051846
pop ecx
jmp 0x10039bcd
push 0x10007bfc
call fcn.10051846
pop ecx
jmp 0x100398e5
mov byte [ebp - 0x154], 0
movzx eax, byte [ebp - 0x154]
test eax, eax
je 0x10039c97
push 0
push 0x180a
push 0x20e4
push 0x1ce1
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x10039cb1
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
jmp 0x10039892
mov eax, dword [ebp - 0xc84]
mov dword [ebp - 0xe8c], eax
mov dword [ebp - 0xcac], 0x693e
mov dword [ebp - 0xe7c], 0x3205f5a2
mov dword [ebp - 0xe88], 0x413e458c
mov dword [ebp - 0xea0], 0xfffffffc
mov dword [ebp - 0xca4], 0xb275cf8
push 4
lea ecx, [ebp - 0x11d0]
call fcn.1000b98b
mov byte [ebp - 4], 0xf
mov dword [ebp - 0xe70], 2
mov dword [ebp - 0xc94], 0x6e19
mov dword [ebp - 0xc8c], 0x265f
cmp dword [ebp - 0xc8c], 0x551
jge 0x10039ec0
lea ecx, [ebp - 0x1158]
call fcn.1000b5c2
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x170]
push eax
mov ecx, 0x1065b470
call fcn.1000b67e
lea edx, [ebp - 0x1158]
mov ecx, eax
call fcn.100239fa
mov eax, dword [ebp - 0x170]
and eax, 0x80000001
jns 0x10039d72
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x10039dd4
and dword [ebp - 0x34], 0
jmp 0x10039d83
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x170]
jge 0x10039dcf
cmp dword [ebp - 0x34], 0
je 0x10039db3
mov eax, dword [ebp - 0x34]
and eax, 0x80000001
jns 0x10039da3
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x10039db3
mov dl, 0x2d
mov ecx, 0x1065b3b8
call fcn.1004ad55
push dword [ebp - 0x34]
lea ecx, [ebp - 0x1158]
call fcn.1000b655
mov dl, byte [eax]
mov ecx, 0x1065b3b8
call fcn.1004ad55
jmp 0x10039d7c
jmp 0x10039ea2
and dword [ebp - 0x34], 0
jmp 0x10039de1
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x170]
sub eax, 3
cmp dword [ebp - 0x34], eax
jge 0x10039e30
cmp dword [ebp - 0x34], 0
je 0x10039e14
mov eax, dword [ebp - 0x34]
and eax, 0x80000001
jns 0x10039e04
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x10039e14
mov dl, 0x2d
mov ecx, 0x1065b3b8
call fcn.1004ad55
push dword [ebp - 0x34]
lea ecx, [ebp - 0x1158]
call fcn.1000b655
mov dl, byte [eax]
mov ecx, 0x1065b3b8
call fcn.1004ad55
jmp 0x10039dda
cmp dword [ebp - 0x34], 0
je 0x10039e42
mov dl, 0x2d
mov ecx, 0x1065b3b8
call fcn.1004ad55
mov eax, dword [ebp - 0x170]
sub eax, 3
push eax
lea ecx, [ebp - 0x1158]
call fcn.1000b655
mov dl, byte [eax]
mov ecx, 0x1065b3b8
call fcn.1004ad55
mov eax, dword [ebp - 0x170]
dec eax
dec eax
push eax
lea ecx, [ebp - 0x1158]
call fcn.1000b655
mov dl, byte [eax]
mov ecx, 0x1065b3b8
call fcn.1004ad55
mov eax, dword [ebp - 0x170]
dec eax
push eax
lea ecx, [ebp - 0x1158]
call fcn.1000b655
mov dl, byte [eax]
mov ecx, 0x1065b3b8
call fcn.1004ad55
push fcn.1000f2a9
mov ecx, 0x1065b3b8
call fcn.1000b86d
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1158]
call fcn.1000b64b
mov dword [ebp - 0xea8], 0xfffffff9
mov dword [ebp - 0xc9c], 0x7d86c3ce
push 0
push 0x4f78
lea eax, [ebp - 0x11d0]
push eax
lea eax, [ebp - 0x1358]
push eax
call fcn.100309ac
add esp, 0x10
lea eax, [ebp - 0xe70]
push eax
lea eax, [ebp - 0xc94]
push eax
push 0
lea eax, [ebp - 0xea0]
push eax
push 0x78e9
lea eax, [ebp - 0xc9c]
push eax
push 0x98b
lea eax, [ebp - 0xe7c]
push eax
lea eax, [ebp - 0xca4]
push eax
lea eax, [ebp - 0x11d0]
push eax
lea eax, [ebp - 0xea8]
push eax
lea eax, [ebp - 0xcac]
push eax
lea eax, [ebp - 0xe88]
push eax
call fcn.10042ec5
add esp, 0x34
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x11d0]
call fcn.1000ba0d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb9c], 3
jmp 0x10039f88
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb9c], 0
jl 0x1003b00d
mov dword [ebp - 0x50], 0xce125d16
mov dword [ebp - 0xd4], 0x2aa61fc2
mov dword [ebp - 0x400], 8
mov dword [ebp - 0xd4], 0x9d75
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0xd4], eax
jg 0x10039fdc
cmp dword [ebp - 0xd4], 0
jne 0x10039fdc
cmp dword [ebp - 0xd4], 0
mov dword [ebp - 0x400], 0xf5fa
cmp dword [ebp - 0x400], 0
jne 0x10039ffe
cmp dword [ebp - 0x50], 0
jne 0x10039ffe
and dword [ebp - 0xa40], 0
jmp 0x1003a008
mov dword [ebp - 0xa40], 1
cmp dword [ebp - 0xa40], 0x68aa
jl 0x1003a020
mov dword [ebp - 0x6d8], 1
jmp 0x1003a027
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x6d8], eax
jg 0x1003a03e
mov dword [ebp - 0x920], 1
jmp 0x1003a045
and dword [ebp - 0x920], 0
cmp dword [ebp - 0x920], 0
jbe 0x1003a05a
mov dword [ebp - 0x6e0], 1
jmp 0x1003a061
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x6e0]
jne 0x1003a078
mov dword [ebp - 0xaf0], 1
jmp 0x1003a07f
and dword [ebp - 0xaf0], 0
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0xaf0]
jg 0x1003a099
mov dword [ebp - 0x6e8], 1
jmp 0x1003a0a0
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x6e8]
jge 0x1003a0d6
mov byte [ebp - 0x13e], 0
movzx eax, byte [ebp - 0x13e]
test eax, eax
je 0x1003a0d1
push 0x5dc9
push 0
push 0x45e3
call fcn.1002d8eb
add esp, 0xc
jmp 0x1003a2b4
push 1
lea ecx, [ebp - 0x1048]
call fcn.1000b98b
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x2dc], 0
jmp 0x1003a100
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 1
jge 0x1003a122
push dword [ebp - 0x2dc]
lea ecx, [ebp - 0x1048]
call fcn.1000ba29
mov dword [eax], 0xe92e3f91
jmp 0x1003a0f3
mov byte [ebp - 0x105], 0
lea eax, [ebp - 0x105]
push eax
push 0x734e
push 0
push 0x6f5e
push 0x36c0
call fcn.1004215c
add esp, 0x14
mov dword [ebp - 0x50], 0
jmp 0x1003a159
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jg 0x1003a2a5
mov dword [ebp - 0x11c], 0xffff
lea eax, [ebp - 0x50]
push eax
push 0x5446
push 0x3920
push 0x5f46
push 1
push 0x10c1
push 0
push 0x3155
push 0x5bd5
push 0x234e
push 0x740f
lea eax, [ebp - 0x11c]
push eax
push 0x4340
push 0x3b13
push 0x27b6
push 0
call fcn.1002c7a3
add esp, 0x40
mov dword [ebp - 0xd4], 0
jmp 0x1003a1d6
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jg 0x1003a2a0
mov dword [ebp - 0xcb4], 0x41b6
cmp dword [ebp - 0x11c], 0
je 0x1003a1fb
jmp 0x1003a2a0
mov dword [ebp - 0x11c], 0
jmp 0x1003a214
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jg 0x1003a29b
push 0x2d89
push 0x64c0
lea eax, [ebp - 0xcb4]
push eax
lea eax, [ebp - 0x1048]
push eax
push 0
push 0x98a
lea eax, [ebp - 0xd4]
push eax
push 0x2aa2
push 0x38f0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x11c]
push eax
push 0x2e5f
push 0x62d5
push 0x625c
push 0x4e32
call fcn.1004255f
add esp, 0x3c
push 0x5b80
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x1048]
push eax
push 0
push 0x204e
call fcn.10041c15
add esp, 0x14
jmp 0x1003a207
jmp 0x1003a1c9
jmp 0x1003a152
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1048]
call fcn.1000ba0d
mov byte [ebp - 0x14d], 0
movzx eax, byte [ebp - 0x14d]
test eax, eax
je 0x1003a2d4
push 0x4ce5
push 0
call fcn.10032b4d
pop ecx
pop ecx
mov dword [ebp - 0x4b4], 0xb8c3
mov dword [ebp - 0x37c], 0x152c58fb
mov dword [ebp - 0xccc], 0x7c8748af
mov dword [ebp - 0x1360], 3
mov dword [ebp - 0x34c], 0xe6d058a8
mov dword [ebp - 0x408], 0xffffffff
mov dword [ebp - 0x718], 0
mov dword [ebp - 0x728], 0
mov dword [ebp - 0x708], 1
push 1
lea ecx, [ebp - 0x1200]
call fcn.1000b98b
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x710], 4
mov dword [ebp - 0x2ec], 0x2e40c18a
mov dword [ebp - 0x238], 0xfffc
mov dword [ebp - 0x2e4], 0xf1a0197c
mov dword [ebp - 0x938], 0xb566e66b
push 0x484c
push 0x539a
push 1
push 0x1f1c
push 0x3e04
push 0x5a91
push 0x7c4
lea eax, [ebp - 0x1264]
push eax
push 0x4480
push 0x62e3
push 1
push 0x59f0
push 0x7442
lea eax, [ebp - 0x1200]
push eax
call fcn.1002a04f
add esp, 0x38
cmp dword [ebp - 0x408], 0
je 0x1003a42a
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0x238], eax
imul eax, dword [ebp - 0x728], 0x88ac
cmp dword [ebp - 0x2e4], eax
jg 0x1003a3f0
mov dword [ebp - 0xeb0], 1
jmp 0x1003a3f7
and dword [ebp - 0xeb0], 0
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x1370], eax
cmp dword [ebp - 0x718], 0
jne 0x1003a415
cmp dword [ebp - 0x4b4], 0
je 0x1003a42a
cmp dword [ebp - 0x37c], 0
je 0x1003a42a
mov dword [ebp - 0x928], 1
jmp 0x1003a431
and dword [ebp - 0x928], 0
cmp dword [ebp - 0x928], 0xfffffffa
jge 0x1003a446
mov dword [ebp - 0x6f0], 1
jmp 0x1003a44d
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x708]
imul eax, dword [ebp - 0x6f0]
cmp eax, dword [ebp - 0x938]
jne 0x1003a46e
mov dword [ebp - 0xa48], 1
jmp 0x1003a475
and dword [ebp - 0xa48], 0
cmp dword [ebp - 0xa48], 0xe695
je 0x1003a48d
mov dword [ebp - 0x6f8], 1
jmp 0x1003a494
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x4b4]
cmp dword [ebp - 0x6f8], eax
jl 0x1003a4ae
mov dword [ebp - 0x930], 1
jmp 0x1003a4b5
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x37c]
cmp dword [ebp - 0x930], eax
jne 0x1003a4cf
mov dword [ebp - 0x700], 1
jmp 0x1003a4d6
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x2e4]
cmp dword [ebp - 0x700], eax
jle 0x1003a4f0
mov dword [ebp - 0xae0], 1
jmp 0x1003a4f7
and dword [ebp - 0xae0], 0
mov eax, dword [ebp - 0xae0]
neg eax
cmp eax, dword [ebp - 0x34c]
jge 0x1003a513
mov dword [ebp - 0xcbc], 1
jmp 0x1003a51a
and dword [ebp - 0xcbc], 0
mov eax, dword [ebp - 0x708]
mov dword [ebp - 0x1378], eax
mov eax, dword [ebp - 0x938]
mov dword [ebp - 0x1380], eax
mov eax, dword [ebp - 0x710]
cmp dword [ebp - 0x37c], eax
jge 0x1003a552
cmp dword [ebp - 0x710], 0
jne 0x1003a552
and dword [ebp - 0xa50], 0
jmp 0x1003a55c
mov dword [ebp - 0xa50], 1
mov eax, dword [ebp - 0x37c]
cmp dword [ebp - 0xa50], eax
jl 0x1003a576
mov dword [ebp - 0x940], 1
jmp 0x1003a57d
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x718]
cmp dword [ebp - 0x940], eax
jl 0x1003a597
mov dword [ebp - 0x720], 1
jmp 0x1003a59e
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x2ec]
sub eax, dword [ebp - 0x720]
mov dword [ebp - 0xeb8], eax
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0xcc4], eax
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp - 0xeb8]
cmp eax, dword [ebp - 0xcc4]
je 0x1003a5e3
jmp 0x100386a8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x504]
call fcn.1000ba0d
mov dword [ebp - 0xa68], 0xb8c3
mov dword [ebp - 0xebc], 0x152c58fb
mov dword [ebp - 0xd0c], 0x7c8748af
mov dword [ebp - 0x13d8], 3
mov dword [ebp - 0x790], 0xe6d058a8
mov dword [ebp - 0xb04], 0xffffffff
mov dword [ebp - 0xcf4], 0
mov dword [ebp - 0x980], 0
mov dword [ebp - 0xfac], 1
push 1
lea ecx, [ebp - 0x1230]
call fcn.1000b98b
mov dword [ebp - 4], 0x16
mov dword [ebp - 0xd04], 4
mov dword [ebp - 0x970], 0x2e40c18a
mov dword [ebp - 0x1c0], 0xfffc
mov dword [ebp - 0x7a8], 0xf1a0197c
mov dword [ebp - 0xcfc], 0xb566e66b
lea eax, [ebp - 0x1230]
push eax
push 0x1768
push 0
lea eax, [ebp - 0x13e0]
push eax
call fcn.1002e844
add esp, 0x10
lea eax, [ebp - 0x790]
push eax
lea eax, [ebp - 0xcf4]
push eax
push 0xe12
lea eax, [ebp - 0x7a8]
push eax
lea eax, [ebp - 0x970]
push eax
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0xfac]
push eax
lea eax, [ebp - 0xcfc]
push eax
lea eax, [ebp - 0xebc]
push eax
lea eax, [ebp - 0x1230]
push eax
push 0
lea eax, [ebp - 0xd04]
push eax
push 1
lea eax, [ebp - 0xb04]
push eax
lea eax, [ebp - 0x1c0]
push eax
lea eax, [ebp - 0x980]
push eax
call fcn.1002e4a8
add esp, 0x40
mov dword [ebp - 0x1c0], 0
jmp 0x1003b163
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0x32
jne 0x1003b383
mov dword [ebp - 0x260], 0xdcdedc29
push 1
lea ecx, [ebp - 0x1018]
call fcn.1000b98b
mov byte [ebp - 4], 0x17
mov dword [ebp - 0xec4], 1
lea eax, [ebp - 0x13e8]
push eax
push 0x1902
push 0x42c6
push 1
lea eax, [ebp - 0x1018]
push eax
push 0
push 0
call fcn.10046da4
add esp, 0x1c
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x770], eax
push 0
lea ecx, [ebp - 0x1018]
call fcn.1000ba29
mov ecx, dword [ebp - 0x770]
mov dword [eax], ecx
cmp dword [ebp - 0x770], 0
je 0x1003b1fa
cmp dword [ebp - 0x260], 0
je 0x1003b1fa
mov dword [ebp - 0x778], 1
jmp 0x1003b201
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0xa68]
cmp dword [ebp - 0x778], eax
jne 0x1003b21b
mov dword [ebp - 0x780], 1
jmp 0x1003b222
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x970]
cmp eax, dword [ebp - 0x780]
jl 0x1003b23c
mov dword [ebp - 0x788], 1
jmp 0x1003b243
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x13f0], eax
mov eax, dword [ebp - 0xb04]
cmp dword [ebp - 0x788], eax
je 0x1003b269
mov dword [ebp - 0x978], 1
jmp 0x1003b270
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0x260]
add eax, dword [ebp - 0x978]
je 0x1003b29c
push 0
lea ecx, [ebp - 0x1018]
call fcn.1000ba29
cmp dword [eax], 0
je 0x1003b29c
mov dword [ebp - 0xf6c], 1
jmp 0x1003b2a3
and dword [ebp - 0xf6c], 0
xor eax, eax
inc eax
je 0x1003b2b8
xor eax, eax
je 0x1003b2b8
mov dword [ebp - 0xa70], 1
jmp 0x1003b2bf
and dword [ebp - 0xa70], 0
mov eax, dword [ebp - 0x790]
cmp dword [ebp - 0xa70], eax
jne 0x1003b2d9
mov dword [ebp - 0x798], 1
jmp 0x1003b2e0
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0xd0c]
cmp dword [ebp - 0x798], eax
jl 0x1003b2fa
mov dword [ebp - 0x7a0], 1
jmp 0x1003b301
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x980]
cmp dword [ebp - 0x7a0], eax
jne 0x1003b31b
mov dword [ebp - 0xaf8], 1
jmp 0x1003b322
and dword [ebp - 0xaf8], 0
cmp dword [ebp - 0xaf8], 3
jb 0x1003b33d
cmp dword [ebp - 0x7a8], 0
jne 0x1003b33d
and dword [ebp - 0x988], 0
jmp 0x1003b347
mov dword [ebp - 0x988], 1
cmp dword [ebp - 0x988], 0xfffffff7
jne 0x1003b35c
mov dword [ebp - 0x7b0], 1
jmp 0x1003b363
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x7b0]
mov dword [ebp - 0xec4], eax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x1018]
call fcn.1000ba0d
jmp 0x1003b156
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1230]
call fcn.1000ba0d
cmp dword [ebp - 0x444], 0
jle 0x10040c89
mov dword [ebp - 0x268], 0x417be187
mov dword [ebp - 0x428], 0x652d0da0
mov dword [ebp - 0x7b8], 0x4de6f885
mov dword [ebp - 0xd24], 0xad8ea5f3
mov dword [ebp - 0x13f8], 0xffffffff
mov dword [ebp - 0xd2c], 0
mov dword [ebp - 0x1400], 7
mov dword [ebp - 0x1408], 0xfffffffd
mov dword [ebp - 0x1410], 2
mov dword [ebp - 0x1418], 1
mov dword [ebp - 0x1420], 0xf6b34c2
mov dword [ebp - 0xd14], 0x8cd3bed1
push 3
lea ecx, [ebp - 0xf78]
call fcn.1000b98b
mov dword [ebp - 4], 0x18
mov dword [ebp - 0xecc], 1
mov dword [ebp - 0x1c4], 0
jmp 0x1003b44e
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 1
jge 0x1003b46a
mov eax, dword [ebp - 0x1c4]
mov dword [ebp + eax*4 - 0xfb4], 0xfffffff9
jmp 0x1003b441
lea eax, [ebp - 0xf78]
push eax
push 0x2a8d
push 0x177
lea eax, [ebp - 0x1c4]
push eax
push 0
call fcn.1002f057
add esp, 0x14
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x1428], eax
push 2
lea ecx, [ebp - 0xf78]
call fcn.1000ba29
mov dword [ebp - 0xa78], eax
mov eax, dword [ebp - 0xa78]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xa78]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xf78]
call fcn.1000ba29
mov ecx, dword [ebp - 0xd14]
cmp dword [eax], ecx
jne 0x1003b4df
mov dword [ebp - 0x484], 1
jmp 0x1003b4e6
and dword [ebp - 0x484], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x484]
mov dword [ebp + eax - 0xfb4], ecx
cmp dword [ebp - 0x484], 0xe8ef
jge 0x1003b511
mov dword [ebp - 0xd1c], 1
jmp 0x1003b518
and dword [ebp - 0xd1c], 0
mov eax, dword [ebp - 0x428]
inc eax
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x7b8], eax
mov eax, dword [ebp - 0x7b8]
imul eax, dword [ebp - 0x268]
sub eax, dword [ebp - 0xecc]
cmp dword [ebp - 0x428], eax
je 0x1003b558
mov dword [ebp - 0x990], 1
jmp 0x1003b55f
and dword [ebp - 0x990], 0
cmp dword [ebp - 0x990], 8
jne 0x1003b574
mov dword [ebp - 0x7c0], 1
jmp 0x1003b57b
and dword [ebp - 0x7c0], 0
mov eax, dword [ebp - 0xd24]
cmp dword [ebp - 0x7c0], eax
jge 0x1003b595
mov dword [ebp - 0xf7c], 1
jmp 0x1003b59c
and dword [ebp - 0xf7c], 0
push 1
lea ecx, [ebp - 0xf78]
call fcn.1000ba29
cmp dword [eax], 0x199f2dc8
jne 0x1003b5bd
mov dword [ebp - 0xb34], 1
jmp 0x1003b5c4
and dword [ebp - 0xb34], 0
mov eax, dword [ebp - 0x268]
imul eax, dword [ebp - 0xb34]
cmp eax, 0x8045
jg 0x1003b5e4
mov dword [ebp - 0x7c8], 1
jmp 0x1003b5eb
and dword [ebp - 0x7c8], 0
cmp dword [ebp - 0x7c8], 0xffff
jbe 0x1003b603
mov dword [ebp - 0x998], 1
jmp 0x1003b60a
and dword [ebp - 0x998], 0
mov eax, dword [ebp - 0x998]
mov dword [ebp - 0xd2c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf78]
call fcn.1000ba0d
push 0x855
push 1
push 0x4a79
push 0
push 0x3a35
push 0x62b2
push 0x33dd
push 0x11de
call fcn.10040fa9
add esp, 0x20
mov dword [ebp - 0x1e4], 0xd4e06482
mov dword [ebp - 0x1cc], 0xffffffff
push 3
lea ecx, [ebp - 0x1448]
call fcn.1000b98b
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x7d8], 0x8fe7528a
mov dword [ebp - 0xd3c], 0xd8ea5f34
mov dword [ebp - 0x12c], 0xff79facd
mov dword [ebp - 0xd44], 0
mov dword [ebp - 0x14cc], 0xee72c34c
mov dword [ebp - 0x9a8], 0x694486ca
mov dword [ebp - 0x430], 0x7a0
push 1
push 0
push 0x7867
lea eax, [ebp - 0x1448]
push eax
push 0x1187
lea eax, [ebp - 0x14d4]
push eax
push 1
push 0x2089
call fcn.1002b143
add esp, 0x20
mov dword [ebp - 0x1cc], 0xffffffe5
jmp 0x1003b701
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0xffffffff
jg 0x1003bab9
mov dword [ebp - 0x14dc], 0
mov dword [ebp - 0xfd0], 0
mov dword [ebp - 0xd4c], 5
mov dword [ebp - 0xd5c], 0xd3be
push 3
lea ecx, [ebp - 0x1438]
call fcn.1000b98b
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x448], 0x9d945ad3
mov dword [ebp - 0xed4], 0x1a20
cmp dword [ebp - 0xed4], 0x857
jge 0x1003b7a9
lea eax, [ebp - 0xfbc]
push eax
lea eax, [ebp - 0xd34]
push eax
mov ecx, 0x1065b470
call fcn.1000b67e
mov ecx, eax
call fcn.1000b67e
push fcn.1000f2a9
mov eax, dword [ebp - 0xd34]
add eax, dword [ebp - 0xfbc]
push eax
mov ecx, 0x1065b3b8
call fcn.1000b879
mov ecx, eax
call fcn.1000b86d
mov dword [ebp - 0xa88], 0x67e99e85
mov dword [ebp - 0x3c], 0
jmp 0x1003b7c3
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1003b7d9
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x178], 0xffffffff
jmp 0x1003b7bc
mov dword [ebp - 0x3c], 0
jmp 0x1003b7e9
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 4
jge 0x1003b7ff
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x15c0], 0xd20b50f6
jmp 0x1003b7e2
mov dword [ebp - 0x3c], 0
jmp 0x1003b80f
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x1003b828
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1438]
call fcn.1000ba29
and dword [eax], 0
jmp 0x1003b808
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x178], 0
jmp 0x1003b856
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x178]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x178], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x178], 2
jg 0x1003ba74
mov dword [ebp - 0x14e4], 1
mov dword [ebp - 0xd54], 9
mov dword [ebp - 0xee4], 0xffffffff
mov dword [ebp - 0x14ec], 0xe9a5a165
mov dword [ebp - 0xedc], 0
mov dword [ebp - 0xeec], 0
cmp dword [ebp - 0xd3c], 0
je 0x1003b8dc
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x14f4], eax
mov eax, dword [ebp - 0xedc]
mov dword [ebp - 0x1560], eax
cmp dword [ebp - 0x430], 0
je 0x1003b8dc
mov dword [ebp - 0x7d0], 1
jmp 0x1003b8e3
and dword [ebp - 0x7d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x178]
cmp dword [ebp - 0x7d0], eax
jg 0x1003b904
mov dword [ebp - 0xa80], 1
jmp 0x1003b90b
and dword [ebp - 0xa80], 0
mov eax, dword [ebp - 0x12c]
imul eax, dword [ebp - 0xa80]
cmp eax, dword [ebp - 0xd44]
jle 0x1003b92c
mov dword [ebp - 0xf8c], 1
jmp 0x1003b933
and dword [ebp - 0xf8c], 0
mov eax, dword [ebp - 0xd4c]
mov dword [ebp - 0x7d8], eax
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0x1568], eax
mov eax, dword [ebp - 0xee4]
cmp dword [ebp - 0xd54], eax
jne 0x1003b965
mov dword [ebp - 0x9a0], 1
jmp 0x1003b96c
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x448]
mov ecx, dword [ebp - 0x9a0]
mov edx, dword [ebp - 0x448]
dec edx
mov dword [ebp - 0x448], edx
cmp eax, ecx
jle 0x1003b99b
mov eax, 0x6c64
test eax, eax
jne 0x1003b99b
and dword [ebp - 0x7e0], 0
jmp 0x1003b9a5
mov dword [ebp - 0x7e0], 1
cmp dword [ebp - 0x7e0], 0xfffffffd
je 0x1003b9c0
cmp dword [ebp - 0xfd0], 0
jne 0x1003b9c0
and dword [ebp - 0xb00], 0
jmp 0x1003b9ca
mov dword [ebp - 0xb00], 1
xor eax, eax
inc eax
sub eax, dword [ebp - 0xb00]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
sub eax, 0x76f600b4
je 0x1003ba01
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x15c0], 0
je 0x1003ba01
mov dword [ebp - 0x7e8], 1
jmp 0x1003ba08
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0x7e8]
mov dword [ebp - 0x9a8], eax
mov eax, dword [ebp - 0x9a8]
neg eax
sub eax, dword [ebp - 0xd5c]
imul eax, dword [ebp - 0x430]
imul eax, dword [ebp - 0xeec]
cmp eax, dword [ebp - 0x1cc]
jle 0x1003ba44
mov dword [ebp - 0x7f0], 1
jmp 0x1003ba4b
and dword [ebp - 0x7f0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x7f0]
mov dword [ebp + eax - 0x15c0], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x178], 0
je 0x1003ba6f
jmp 0x1003ba74
jmp 0x1003b83b
mov dword [ebp - 0x12c], 3
jmp 0x1003ba8d
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jl 0x1003baa5
mov eax, dword [ebp - 0xa88]
inc eax
mov dword [ebp - 0xa88], eax
jmp 0x1003ba80
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1438]
call fcn.1000ba0d
jmp 0x1003b6f4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1448]
call fcn.1000ba0d
mov dword [ebp - 0x1e4], 0
jmp 0x1003bae1
mov eax, dword [ebp - 0x1e4]
dec eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0xffffffef
jg 0x1003c0b0
mov dword [ebp - 0x1570], 1
mov dword [ebp - 0x1578], 0x60f57a7c
mov dword [ebp - 0x151c], 0x70ade216
mov dword [ebp - 0x1518], 0x70ade216
mov dword [ebp - 0x1514], 0x70ade216
mov dword [ebp - 0x1510], 0x70ade216
mov dword [ebp - 0xd64], 0x49f6d4a0
push 0x6d05
lea eax, [ebp - 0xd64]
push eax
push 0
push 0x5cde
push 0x6a32
push 1
call fcn.1002ab55
add esp, 0x18
mov byte [ebp - 0x115], 0
push 0x412e
push 0x1728
lea eax, [ebp - 0x115]
push eax
push 0x361
push 0
push 0
call fcn.1002b2d8
add esp, 0x18
mov dword [ebp - 0x10a0], 0x5b0e446d
mov dword [ebp - 0x109c], 0x5b0e446d
mov dword [ebp - 0x1098], 0x5b0e446d
mov dword [ebp - 0x1094], 0x5b0e446d
lea ecx, [ebp - 0x3b1]
call fcn.1000ba38
push eax
lea eax, [ebp - 0x1090]
push eax
lea eax, [ebp - 0x10a0]
push eax
lea ecx, [ebp - 0x167c]
call fcn.1000ba3b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1078]
call fcn.1000b9e7
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x9b0], 0x60f951fe
mov dword [ebp - 0x7f8], 0
mov dword [ebp - 0x1d4], 0xb302aff6
lea eax, [ebp - 0x7f8]
push eax
push 0x937
lea eax, [ebp - 0x1d4]
push eax
push 0x1867
lea eax, [ebp - 0x9b0]
push eax
push 0
call fcn.100309dd
add esp, 0x18
mov dword [ebp - 0x1d4], 0xfffffff2
jmp 0x1003bc43
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0xe
jl 0x1003bd50
mov dword [ebp - 0x10c8], 0xfffffff6
mov dword [ebp - 0x10c4], 0xfffffff6
mov dword [ebp - 0x10c0], 0xfffffff6
mov dword [ebp - 0x10bc], 0xfffffff6
lea ecx, [ebp - 0x4ad]
call fcn.1000ba38
push eax
lea eax, [ebp - 0x10b8]
push eax
lea eax, [ebp - 0x10c8]
push eax
lea ecx, [ebp - 0x168c]
call fcn.1000ba3b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1458]
call fcn.1000b9e7
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0xf9c], 7
mov dword [ebp - 0x270], 0
jmp 0x1003bcd4
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 3
jge 0x1003bcf0
mov eax, dword [ebp - 0x270]
mov dword [ebp + eax*4 - 0x15e4], 0x2668451f
jmp 0x1003bcc7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x15e4]
mov dword [ebp - 0x1580], eax
push 0
lea ecx, [ebp - 0x1458]
call fcn.1000ba29
mov dword [ebp - 0x7f8], 0x31e13ca4
lea eax, [ebp - 0x9b0]
push eax
push 0x615e
lea eax, [ebp - 0xf9c]
push eax
push 0x3e85
push 0
call fcn.10047001
add esp, 0x14
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1458]
call fcn.1000ba0d
jmp 0x1003bc36
mov dword [ebp - 0x1dc], 0xc75b57fd
mov dword [ebp - 0x1588], 0x76b5a7dd
mov dword [ebp - 0xd7c], 0xd33b947e
mov dword [ebp - 0x278], 0
jmp 0x1003bd87
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 1
jge 0x1003bda3
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0xfd8], 0xfffffffd
jmp 0x1003bd7a
mov dword [ebp - 0x1dc], 0
jmp 0x1003bdbc
mov eax, dword [ebp - 0x1dc]
dec eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0xfffffffe
jne 0x1003c038
mov dword [ebp - 0xd6c], 0x7f6fb807
mov dword [ebp - 0x1590], 0xf5f996f3
mov dword [ebp - 0x158c], 0x70012af0
mov dword [ebp - 0x1520], 0xdc6b
mov dword [ebp - 0xefc], 0xf29855ee
push 1
lea ecx, [ebp - 0x1224]
call fcn.1000b98b
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x280], 0
jmp 0x1003be25
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 1
jge 0x1003be47
push dword [ebp - 0x280]
lea ecx, [ebp - 0x1224]
call fcn.1000ba29
mov dword [eax], 3
jmp 0x1003be18
cmp dword [ebp - 0x1dc], 0
je 0x1003c002
mov dword [ebp - 0x800], 1
mov dword [ebp - 0x13e4], 0xbc106ec6
mov dword [ebp - 0x1288], 0x24770669
mov dword [ebp - 0x1270], 3
mov dword [ebp - 0x14d8], 1
mov dword [ebp - 0x1278], 2
mov dword [ebp - 0x13ec], 0xffffffff
mov dword [ebp - 0x1284], 0
or dword [ebp - 0x10f0], 0xffffffff
or dword [ebp - 0x10ec], 0xffffffff
or dword [ebp - 0x10e8], 0xffffffff
or dword [ebp - 0x10e4], 0xffffffff
lea ecx, [ebp - 0x47d]
call fcn.1000ba38
push eax
lea eax, [ebp - 0x10e0]
push eax
lea eax, [ebp - 0x10f0]
push eax
lea ecx, [ebp - 0x16a4]
call fcn.1000ba3b
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1468]
call fcn.1000b9e7
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x288], 0
jmp 0x1003bf12
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 2
jge 0x1003bf2e
mov eax, dword [ebp - 0x288]
mov dword [ebp + eax*4 - 0x1634], 3
jmp 0x1003bf05
cmp dword [ebp - 0x800], 0x5fa5fef9
jg 0x1003bf46
mov dword [ebp - 0xb30], 1
jmp 0x1003bf4d
and dword [ebp - 0xb30], 0
push 0
lea ecx, [ebp - 0x1224]
call fcn.1000ba29
push 2
lea ecx, [ebp - 0x1468]
call fcn.1000ba29
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x458]
mov ecx, dword [ebp - 0x800]
imul ecx, dword [eax]
mov dword [ebp - 0xef4], ecx
mov eax, dword [ebp - 0xd6c]
mov dword [ebp - 0xd74], eax
mov eax, dword [ebp - 0x458]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x458]
mov dword [ecx], eax
mov eax, dword [ebp - 0xef4]
cmp eax, dword [ebp - 0xd74]
je 0x1003bfb9
mov dword [ebp - 0x808], 1
jmp 0x1003bfc0
and dword [ebp - 0x808], 0
mov eax, dword [ebp - 0xb30]
add eax, dword [ebp - 0x808]
mov dword [ebp - 0x9b8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9b8]
mov dword [ebp + eax - 0xfd8], ecx
mov eax, dword [ebp - 0x9b8]
mov dword [ebp - 0xd7c], eax
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x1468]
call fcn.1000ba0d
jmp 0x1003c024
lea eax, [ebp - 0xefc]
push eax
push 0x7c70
push 1
push 0x1930
push 0x7361
push 1
call fcn.1002ab55
add esp, 0x18
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1224]
call fcn.1000ba0d
jmp 0x1003bdaf
push 0
lea ecx, [ebp - 0x1078]
call fcn.1000ba29
cmp dword [eax], 0
je 0x1003c05b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1078]
call fcn.1000ba0d
jmp 0x1003c0b0
push 1
push 0x7a3a
push 0x6064
push 0x21d3
push 1
push 0x2358
push 0
call fcn.10031b65
add esp, 0x1c
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x1554], eax
push 1
lea ecx, [ebp - 0x1078]
call fcn.1000ba29
mov dword [eax], 0xfffffff6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1078]
call fcn.1000ba0d
jmp 0x1003bad4
mov dword [ebp - 0x128c], 0xffffffff
mov byte [ebp - 0x11d], 0
push 0x597f
push 0x5571
lea eax, [ebp - 0x11d]
push eax
push 0x326b
push 0x5470
push 0x4281
push 0
call fcn.100420a1
add esp, 0x1c
mov dword [ebp - 0xd84], 0x2366
cmp dword [ebp - 0xd84], 0x9a0
jge 0x1003c39b
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x198]
push eax
push 0x10007d0c
call fcn.1005162b
add esp, 0x14
mov eax, dword [ebp - 0x198]
cmp eax, dword [ebp - 0x19c]
jne 0x1003c155
mov eax, dword [ebp - 0x180]
cmp eax, dword [ebp - 0x188]
jne 0x1003c155
push 0x10007d18
call fcn.10051a06
pop ecx
mov eax, dword [ebp - 0x198]
sub eax, dword [ebp - 0x19c]
push eax
call fcn.100523fe
pop ecx
mov esi, eax
mov eax, dword [ebp - 0x180]
sub eax, dword [ebp - 0x188]
push eax
call fcn.100523fe
pop ecx
cmp esi, eax
jne 0x1003c18c
push 0x10007a40
call fcn.10051a06
pop ecx
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x298], eax
jmp 0x1003c1c2
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x290], 8
jg 0x1003c20d
cmp dword [ebp - 0x298], 8
jg 0x1003c20d
mov eax, dword [ebp - 0x290]
sub eax, dword [ebp - 0x19c]
push eax
call fcn.100523fe
pop ecx
mov esi, eax
mov eax, dword [ebp - 0x298]
sub eax, dword [ebp - 0x188]
push eax
call fcn.100523fe
pop ecx
cmp esi, eax
jne 0x1003c20b
push 0x10007adc
call fcn.10051a06
pop ecx
jmp 0x1003c1a8
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x2a8], eax
jmp 0x1003c243
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x2a8]
dec eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a0], 8
jg 0x1003c28e
cmp dword [ebp - 0x2a8], 0
jl 0x1003c28e
mov eax, dword [ebp - 0x2a0]
sub eax, dword [ebp - 0x19c]
push eax
call fcn.100523fe
pop ecx
mov esi, eax
mov eax, dword [ebp - 0x2a8]
sub eax, dword [ebp - 0x188]
push eax
call fcn.100523fe
pop ecx
cmp esi, eax
jne 0x1003c28c
push 0x10007adc
call fcn.10051a06
pop ecx
jmp 0x1003c229
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x2b8], eax
jmp 0x1003c2c4
mov eax, dword [ebp - 0x2b0]
dec eax
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b0], 0
jl 0x1003c30f
cmp dword [ebp - 0x2b8], 8
jg 0x1003c30f
mov eax, dword [ebp - 0x2b0]
sub eax, dword [ebp - 0x19c]
push eax
call fcn.100523fe
pop ecx
mov esi, eax
mov eax, dword [ebp - 0x2b8]
sub eax, dword [ebp - 0x188]
push eax
call fcn.100523fe
pop ecx
cmp esi, eax
jne 0x1003c30d
push 0x10007adc
call fcn.10051a06
pop ecx
jmp 0x1003c2aa
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x2c8], eax
jmp 0x1003c345
mov eax, dword [ebp - 0x2c0]
dec eax
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x2c8]
dec eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c0], 0
jl 0x1003c390
cmp dword [ebp - 0x2c8], 0
jl 0x1003c390
mov eax, dword [ebp - 0x2c0]
sub eax, dword [ebp - 0x19c]
push eax
call fcn.100523fe
pop ecx
mov esi, eax
mov eax, dword [ebp - 0x2c8]
sub eax, dword [ebp - 0x188]
push eax
call fcn.100523fe
pop ecx
cmp esi, eax
jne 0x1003c38e
push 0x10007adc
call fcn.10051a06
pop ecx
jmp 0x1003c32b
push 0x10007a44
call fcn.10051a06
pop ecx
mov byte [ebp - 0x161], 0
lea eax, [ebp - 0x161]
push eax
push 0
call fcn.10032934
pop ecx
pop ecx
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x440], 0xfffffff7
mov dword [ebp - 0xa98], 0x848967c7
mov dword [ebp - 0x13f4], 0x69f41af5
push 1
lea ecx, [ebp - 0x117c]
call fcn.1000b98b
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0xf04], 0xa1bd053a
mov dword [ebp - 0xb0], 0
jmp 0x1003c415
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x1003c42e
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x58], 0
jmp 0x1003c408
mov dword [ebp - 0xb0], 0
jmp 0x1003c447
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x1003c469
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x117c]
call fcn.1000ba29
mov dword [eax], 0x698ba832
jmp 0x1003c43a
mov byte [ebp - 0x151], 0
movzx eax, byte [ebp - 0x151]
test eax, eax
je 0x1003c49d
push 0x291c
push 0x2a17
push 0x4815
push 1
push 0x292
push 1
push 0
call fcn.10046da4
add esp, 0x1c
mov dword [ebp - 0x20], 0
jmp 0x1003c4ad
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x1003c9da
mov dword [ebp - 0x3bc], 0xfff6
mov dword [ebp - 0x54c], 0x59af2c67
mov dword [ebp - 0x828], 9
mov dword [ebp - 0x1250], 0x5b506946
mov dword [ebp - 0x124c], 0x5b506946
mov dword [ebp - 0x1248], 0x5b506946
mov dword [ebp - 0x1244], 0x5b506946
push 1
lea ecx, [ebp - 0x1170]
call fcn.1000b98b
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x3b8], 0
mov dword [ebp - 0xcc], 0
jmp 0x1003c531
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 2
jge 0x1003c54d
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x1280], 0xb631
jmp 0x1003c524
mov dword [ebp - 0xcc], 0
jmp 0x1003c566
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 1
jge 0x1003c588
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x1170]
call fcn.1000ba29
mov dword [eax], 0x96fb6c71
jmp 0x1003c559
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x38], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58]
cmp dword [ebp - 0x38], eax
jge 0x1003c5ac
mov dword [ebp - 0x810], 1
jmp 0x1003c5b3
and dword [ebp - 0x810], 0
cmp dword [ebp - 0x810], 0x9a57
jl 0x1003c5cb
mov dword [ebp - 0xa90], 1
jmp 0x1003c5d2
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x58]
mov ecx, dword [ebp - 0xa90]
sub ecx, dword [ebp - 0x3bc]
imul eax, ecx
cmp eax, dword [ebp - 0x20]
jle 0x1003c5f5
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x58], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp + ecx*4 - 0x58]
cmp dword [ebp + eax*4 - 0x58], ecx
jl 0x1003c611
mov dword [ebp - 0x818], 1
jmp 0x1003c618
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x818]
add eax, 0x31fa
mov dword [ebp - 0x440], eax
je 0x1003c672
push 1
push 0
push 0x203a
push 0x6bb9
lea eax, [ebp - 0x38]
push eax
push 0x7de5
call fcn.10044d4c
add esp, 0x18
mov dword [ebp - 0x38], 0
jmp 0x1003c65a
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jg 0x1003c670
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x58]
mov dword [ebp + ecx*4 - 0x58], eax
jmp 0x1003c653
jmp 0x1003c6d3
mov dword [ebp - 0x38], 0
jmp 0x1003c682
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jg 0x1003c6d3
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x1003c6ae
push 0
push 0x2bb5
push 0x15a6
call fcn.1004564b
add esp, 0xc
push 0x115
push 0x67ce
push 0x1907
push 0
push 0x180f
push 0x3f17
call fcn.1002e45b
add esp, 0x18
jmp 0x1003c67b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x58], 0
je 0x1003c86b
cmp dword [ebp - 0x20], 0
je 0x1003c7b2
cmp dword [ebp - 0x3b8], 1
jge 0x1003c703
mov dword [ebp - 0x9c0], 1
jmp 0x1003c70a
and dword [ebp - 0x9c0], 0
push 0
lea ecx, [ebp - 0x1170]
call fcn.1000ba29
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x438]
mov eax, dword [eax]
mov dword [ebp - 0xfe0], eax
mov eax, dword [ebp - 0x9c0]
mov dword [ebp - 0xd8c], eax
mov eax, dword [ebp - 0x438]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x438]
mov dword [ecx], eax
mov eax, dword [ebp - 0xfe0]
cmp eax, dword [ebp - 0xd8c]
jge 0x1003c762
mov dword [ebp - 0x460], 1
jmp 0x1003c769
and dword [ebp - 0x460], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x460]
mov dword [ebp + eax - 0x1250], ecx
cmp dword [ebp - 0x460], 0xffffffff
ja 0x1003c791
mov dword [ebp - 0x820], 1
jmp 0x1003c798
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x820]
sub eax, dword [ebp - 0x54c]
je 0x1003c7b2
mov dword [ebp - 0xb08], 1
jmp 0x1003c7b9
and dword [ebp - 0xb08], 0
mov eax, dword [ebp - 0xb08]
sub eax, dword [ebp - 0xf04]
imul eax, eax, 0xfffffffd
mov dword [ebp - 0x828], eax
mov eax, dword [ebp - 0x3b8]
cmp dword [ebp - 0x828], eax
jne 0x1003c7eb
cmp dword [ebp - 0x38], 0
jne 0x1003c7eb
and dword [ebp - 0x468], 0
jmp 0x1003c7f5
mov dword [ebp - 0x468], 1
push 0
lea ecx, [ebp - 0x117c]
call fcn.1000ba29
mov ecx, dword [ebp - 0x468]
mov dword [eax], ecx
mov eax, dword [ebp - 0x440]
cmp dword [ebp - 0x468], eax
jg 0x1003c824
mov dword [ebp - 0x9c8], 1
jmp 0x1003c82b
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x3b8]
add eax, dword [ebp - 0x9c8]
cmp eax, 0x43e267a5
jle 0x1003c84a
mov dword [ebp - 0x830], 1
jmp 0x1003c851
and dword [ebp - 0x830], 0
mov eax, dword [ebp - 0x3bc]
cmp dword [ebp - 0x830], eax
jg 0x1003c86b
mov dword [ebp - 0xd94], 1
jmp 0x1003c872
and dword [ebp - 0xd94], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x58]
mov dword [ebp - 0x1294], eax
mov eax, dword [ebp - 0xa98]
cmp dword [ebp - 0xa98], eax
jl 0x1003c899
mov dword [ebp - 0x838], 1
jmp 0x1003c8a0
and dword [ebp - 0x838], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x58]
cmp dword [ebp - 0x838], eax
jne 0x1003c8bb
mov dword [ebp - 0x9d0], 1
jmp 0x1003c8c2
and dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x9d0]
mov ecx, dword [ebp - 0x20]
cmp eax, dword [ebp + ecx*4 - 0x58]
jle 0x1003c8e1
mov dword [ebp - 0x840], 1
jmp 0x1003c8e8
and dword [ebp - 0x840], 0
cmp dword [ebp - 0x840], 0x9805f634
jae 0x1003c900
mov dword [ebp - 0xb40], 1
jmp 0x1003c907
and dword [ebp - 0xb40], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x58]
cmp eax, dword [ebp - 0xb40]
jl 0x1003c922
mov dword [ebp - 0x524], 1
jmp 0x1003c929
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x524]
sub ecx, dword [ebp + eax*4 - 0x58]
push 4
pop eax
shl eax, 0
sub ecx, dword [ebp + eax - 0x1280]
cmp ecx, 0x73452c79
je 0x1003c957
mov dword [ebp - 0x52c], 1
jmp 0x1003c95e
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x52c], eax
jl 0x1003c975
mov dword [ebp - 0x534], 1
jmp 0x1003c97c
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
neg eax
cmp eax, 0x69d59961
jg 0x1003c997
mov dword [ebp - 0x53c], 1
jmp 0x1003c99e
and dword [ebp - 0x53c], 0
cmp dword [ebp - 0x53c], 5
jne 0x1003c9b3
mov dword [ebp - 0x544], 1
jmp 0x1003c9ba
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0x54c], eax
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x1170]
call fcn.1000ba0d
jmp 0x1003c4a6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x117c]
call fcn.1000ba0d
mov byte [ebp - 0x125], 0
push 1
lea ecx, [ebp - 0xb50]
call fcn.1000b98b
mov dword [ebp - 4], 0x21
mov dword [ebp - 0xd9c], 0xe012d2c8
mov dword [ebp - 0x2d0], 0
jmp 0x1003ca27
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 1
jge 0x1003ca46
push dword [ebp - 0x2d0]
lea ecx, [ebp - 0xb50]
call fcn.1000ba29
or dword [eax], 0xffffffff
jmp 0x1003ca1a
mov byte [ebp - 0x12d], 0
push 0x5b20
push 0
push 0x4530
push 0
lea eax, [ebp - 0x12d]
push eax
call fcn.1002b5cc
add esp, 0x14
push 0
lea ecx, [ebp - 0xb50]
call fcn.1000ba29
mov esi, eax
push 0
lea ecx, [ebp - 0xb50]
call fcn.1000ba29
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x1003ca98
mov dword [ebp - 0x554], 1
jmp 0x1003ca9f
and dword [ebp - 0x554], 0
push 0
lea ecx, [ebp - 0xb50]
call fcn.1000ba29
mov eax, dword [eax]
dec eax
cmp dword [ebp - 0x554], eax
jl 0x1003cac3
mov dword [ebp - 0x55c], 1
jmp 0x1003caca
and dword [ebp - 0x55c], 0
cmp dword [ebp - 0x55c], 2
jae 0x1003cadf
mov dword [ebp - 0xfa8], 1
jmp 0x1003cae6
and dword [ebp - 0xfa8], 0
push 0
lea ecx, [ebp - 0xb50]
call fcn.1000ba29
push 0
lea ecx, [ebp - 0xb50]
call fcn.1000ba29
mov esi, eax
push 0
lea ecx, [ebp - 0xb50]
call fcn.1000ba29
mov ecx, dword [esi]
sub ecx, dword [eax]
mov dword [ebp - 0xd9c], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb50]
call fcn.1000ba0d
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1003cc98
mov dword [ebp - 0x1ac], 0xfff7
mov dword [ebp - 0x190], 0x1d1b984
cmp dword [ebp - 0x1ac], 0
je 0x1003cb76
mov byte [ebp - 0x153], 0
movzx eax, byte [ebp - 0x153]
test eax, eax
je 0x1003cb74
push 0
push 0x1f0c
call fcn.10040d10
pop ecx
pop ecx
jmp 0x1003cb9e
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x1003cb9e
push 0x1fce
push 0
push 0x56a8
push 0
call fcn.1003278c
add esp, 0x10
cmp dword [ebp - 0x1ac], 0
jne 0x1003cc3e
cmp dword [ebp - 0x1ac], 0
jne 0x1003cc08
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x190], eax
jg 0x1003cbce
mov dword [ebp - 0x564], 1
jmp 0x1003cbd5
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x564], eax
jne 0x1003cbef
mov dword [ebp - 0xf0c], 1
jmp 0x1003cbf6
and dword [ebp - 0xf0c], 0
mov eax, 0x431f
test eax, eax
jne 0x1003cc08
and dword [ebp - 0xda4], 0
jmp 0x1003cc12
mov dword [ebp - 0xda4], 1
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x14e0], eax
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x190], eax
jl 0x1003cc3e
cmp dword [ebp - 0x190], 0
jne 0x1003cc3e
and dword [ebp - 0x56c], 0
jmp 0x1003cc48
mov dword [ebp - 0x56c], 1
mov eax, dword [ebp - 0x190]
imul eax, dword [ebp - 0x56c]
mov dword [ebp - 0x190], eax
push 0x1560
push 0x222e
push 0x1724
push 0x806
push 0x1c11
push 0x24d5
push 0xdb5
push 0x134a
push 0x1682
push 0x5b1
push 0x23b6
call dword [sym.imp.GDI32.dll_StretchBlt]
mov dword [ebp - 0x9c], 4
mov dword [ebp - 0x3ec], 5
push 1
lea ecx, [ebp - 0x11dc]
call fcn.1000b98b
mov dword [ebp - 4], 0x22
mov dword [ebp - 0xe04], 1
push 0
lea eax, [ebp - 0x11dc]
push eax
push 0x43dc
lea eax, [ebp - 0x129c]
push eax
call fcn.10041b01
add esp, 0x10
mov dword [ebp - 0x9c], 0
jmp 0x1003cd00
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 8
jle 0x1003d167
mov dword [ebp - 0x584], 0xa290be4
mov dword [ebp - 0x3e4], 0x34111d01
mov dword [ebp - 0x98], 0
jmp 0x1003cd3a
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 4
jge 0x1003cd56
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x169c], 0xb90f9986
jmp 0x1003cd2d
mov dword [ebp - 0xe00], 0x2622
cmp dword [ebp - 0xe00], 0xf4a
jge 0x1003d036
lea eax, [ebp - 0x16c]
push eax
push 0x100077f0
call fcn.1005162b
pop ecx
pop ecx
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
and dword [ebp - 0x2d8], 0
jmp 0x1003cda6
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x2d8]
cmp eax, dword [ebp - 0x16c]
jge 0x1003cdd0
mov eax, dword [ebp - 0x2d8]
lea eax, [eax*4 + 0x108ae0d0]
push eax
push 0x100077f0
call fcn.1005162b
pop ecx
pop ecx
jmp 0x1003cd99
mov byte [ebp - 0x61], 1
mov dword [ebp - 0x1ec], 1
jmp 0x1003cded
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x1ec]
cmp eax, dword [ebp - 0x16c]
jge 0x1003ce23
mov eax, dword [ebp - 0x1ec]
cmp dword [eax*4 + 0x108ae0d0], 1
jle 0x1003ce21
mov eax, dword [ebp - 0x1ec]
cmp dword [eax*4 + 0x108ae0cc], 1
jle 0x1003ce21
mov byte [ebp - 0x61], 0
jmp 0x1003ce23
jmp 0x1003cde0
movzx eax, byte [ebp - 0x61]
test eax, eax
je 0x1003ce36
push 0x10007d1c
call fcn.10051a06
pop ecx
push 0x10007d24
call fcn.10051a06
pop ecx
mov dword [ebp - 0xc0], 1
push 0x10007d18
call fcn.10051846
pop ecx
mov dword [ebp - 0x1f4], 1
jmp 0x1003ce88
mov eax, dword [ebp - 0x1f4]
mov ecx, dword [ebp - 0xc0]
add ecx, dword [eax*4 + 0x108ae0d0]
mov dword [ebp - 0xc0], ecx
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x1f4]
cmp eax, dword [ebp - 0x16c]
jge 0x1003ced7
and dword [ebp - 0x3c4], 0
jmp 0x1003ceac
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x1f4]
mov ecx, dword [ebp - 0x3c4]
cmp ecx, dword [eax*4 + 0x108ae0d0]
jge 0x1003ced5
push dword [ebp - 0xc0]
push 0x10007c54
call fcn.10051846
pop ecx
pop ecx
jmp 0x1003ce9f
jmp 0x1003ce62
push 0x1000775d
call fcn.10051a06
pop ecx
mov dword [ebp - 0xc0], 1
push 0x10007d18
call fcn.10051846
pop ecx
mov dword [ebp - 0xb8], 1
jmp 0x1003cf10
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x16c]
jge 0x1003d02b
mov eax, dword [ebp - 0xb8]
cmp dword [eax*4 + 0x108ae0cc], 1
jle 0x1003cfce
and dword [ebp - 0x3cc], 0
jmp 0x1003cf4c
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax*4 + 0x108ae0d0]
cdq
sub eax, edx
sar eax, 1
cmp dword [ebp - 0x3cc], eax
jge 0x1003cf7c
mov eax, dword [ebp - 0xc0]
dec eax
push eax
push 0x10007c54
call fcn.10051846
pop ecx
pop ecx
jmp 0x1003cf3f
mov eax, dword [ebp - 0xb8]
mov eax, dword [eax*4 + 0x108ae0d0]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x3d4], eax
jmp 0x1003cfa3
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x3d4]
cmp ecx, dword [eax*4 + 0x108ae0d0]
jge 0x1003cfcc
push dword [ebp - 0xc0]
push 0x10007c54
call fcn.10051846
pop ecx
pop ecx
jmp 0x1003cf96
jmp 0x1003d00d
and dword [ebp - 0x3dc], 0
jmp 0x1003cfe4
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x3dc]
cmp ecx, dword [eax*4 + 0x108ae0d0]
jge 0x1003d00d
push dword [ebp - 0xc0]
push 0x10007c54
call fcn.10051846
pop ecx
pop ecx
jmp 0x1003cfd7
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xc0]
add ecx, dword [eax*4 + 0x108ae0d0]
mov dword [ebp - 0xc0], ecx
jmp 0x1003cf03
push 0x1000775d
call fcn.10051a06
pop ecx
mov dword [ebp - 0x98], 0
jmp 0x1003d04f
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x1003d06b
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x15fc], 0xfffffff6
jmp 0x1003d042
cmp dword [ebp - 0x584], 0
je 0x1003d149
mov dword [ebp - 0x3ec], 0xfffffff6
mov eax, dword [ebp - 0x9c]
cmp dword [ebp - 0x3ec], eax
jne 0x1003d09c
mov dword [ebp - 0x574], 1
jmp 0x1003d0a3
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x574]
inc eax
cmp eax, dword [ebp - 0x9c]
je 0x1003d0be
mov dword [ebp - 0x57c], 1
jmp 0x1003d0c5
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x584]
cmp dword [ebp - 0x3e4], eax
jl 0x1003d0eb
mov dword [ebp - 0xdac], 1
jmp 0x1003d0f2
and dword [ebp - 0xdac], 0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x13fc], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3e4]
mov dword [ebp + eax - 0x169c], ecx
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x12a4], eax
mov esi, dword [ebp - 0x9c]
push 0
lea ecx, [ebp - 0x11dc]
call fcn.1000ba29
sub esi, dword [eax]
je 0x1003d149
cmp dword [ebp - 0xe04], 0
je 0x1003d149
mov dword [ebp - 0x58c], 1
jmp 0x1003d150
and dword [ebp - 0x58c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x58c]
mov dword [ebp + eax - 0x15fc], ecx
jmp 0x1003ccf3
lea eax, [ebp - 0x9c]
push eax
push 0x4039
push 1
push 0
push 0x1a7a
push 0
call fcn.1002aeb0
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11dc]
call fcn.1000ba0d
push 4
push 0x1000
push dword [ebp - 0x444]
mov eax, dword [ebp - 0xa74]
mov ecx, dword [ebp - 0xdb4]
add ecx, dword [eax + 0xc]
push ecx
push 0x5736
push 0x6a92
call fcn.10028cf3
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x478]
mov dword [ecx], eax
mov dword [ebp - 0xa4], 0x5425a80e
mov dword [ebp - 0x5d4], 0xffffffff
push 4
lea ecx, [ebp - 0x248]
call fcn.1000b98b
mov dword [ebp - 4], 0x23
mov dword [ebp - 0x2e0], 0x9dda3143
mov dword [ebp - 0x60c], 0x36fa7abe
lea eax, [ebp - 0x1fc]
push eax
push 0x5f62
lea eax, [ebp - 0x248]
push eax
push 0
call fcn.1003100e
add esp, 0x10
mov dword [ebp - 0x1fc], 0
jmp 0x1003d23f
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 1
jge 0x1003d25b
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0x3fc], 0x24067bc6
jmp 0x1003d232
or eax, 0xffffffff
je 0x1003d691
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x1574], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x12ac], eax
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0xa4], eax
jge 0x1003d296
mov dword [ebp - 0x594], 1
jmp 0x1003d29d
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x594], eax
jne 0x1003d2b7
mov dword [ebp - 0x59c], 1
jmp 0x1003d2be
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x59c], eax
jne 0x1003d2d8
mov dword [ebp - 0x5a4], 1
jmp 0x1003d2df
and dword [ebp - 0x5a4], 0
push 3
lea ecx, [ebp - 0x248]
call fcn.1000ba29
mov ecx, dword [ebp - 0x5a4]
imul ecx, dword [eax]
test ecx, ecx
jne 0x1003d30b
mov eax, 0x475761ac
test eax, eax
jne 0x1003d30b
and dword [ebp - 0x5ac], 0
jmp 0x1003d315
mov dword [ebp - 0x5ac], 1
push 3
lea ecx, [ebp - 0x248]
call fcn.1000ba29
mov ecx, dword [ebp - 0x5ac]
cmp ecx, dword [eax]
jl 0x1003d338
mov dword [ebp - 0x5b4], 1
jmp 0x1003d33f
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x5b4]
je 0x1003d36b
push 0
lea ecx, [ebp - 0x248]
call fcn.1000ba29
cmp dword [eax], 0
je 0x1003d36b
mov dword [ebp - 0xe0c], 1
jmp 0x1003d372
and dword [ebp - 0xe0c], 0
push 1
lea ecx, [ebp - 0x248]
call fcn.1000ba29
push 3
lea ecx, [ebp - 0x248]
call fcn.1000ba29
cmp dword [eax], 0x9d38951f
jae 0x1003d3a1
push 3
lea ecx, [ebp - 0x248]
call fcn.1000ba29
mov eax, 0xfcc8
test eax, eax
jne 0x1003d3b8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3fc], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x5bc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5bc]
mov dword [ebp + eax - 0x3fc], ecx
push 3
lea ecx, [ebp - 0x248]
call fcn.1000ba29
mov ecx, dword [ebp - 0x5bc]
cmp ecx, dword [eax]
jge 0x1003d3fa
mov dword [ebp - 0x5c4], 1
jmp 0x1003d401
and dword [ebp - 0x5c4], 0
cmp dword [ebp - 0x5c4], 0xfffffffd
ja 0x1003d416
mov dword [ebp - 0x5cc], 1
jmp 0x1003d41d
and dword [ebp - 0x5cc], 0
push 0
lea ecx, [ebp - 0x248]
call fcn.1000ba29
mov ecx, dword [ebp - 0x5cc]
imul ecx, dword [eax]
cmp ecx, 0xaf8b5131
jb 0x1003d447
mov dword [ebp - 0x5dc], 1
jmp 0x1003d44e
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x5d4], eax
mov esi, dword [ebp - 0x5d4]
sub esi, dword [ebp - 0x5dc]
push 0
lea ecx, [ebp - 0x248]
call fcn.1000ba29
cmp esi, dword [eax]
jl 0x1003d492
push 3
lea ecx, [ebp - 0x248]
call fcn.1000ba29
cmp dword [eax], 0
jne 0x1003d492
and dword [ebp - 0x5e4], 0
jmp 0x1003d49c
mov dword [ebp - 0x5e4], 1
mov eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0x5e4], eax
jge 0x1003d4b6
mov dword [ebp - 0x5ec], 1
jmp 0x1003d4bd
and dword [ebp - 0x5ec], 0
push 2
lea ecx, [ebp - 0x248]
call fcn.1000ba29
mov ecx, dword [ebp - 0x5ec]
cmp ecx, dword [eax]
jl 0x1003d4e0
mov dword [ebp - 0x5f4], 1
jmp 0x1003d4e7
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0x5f4], eax
je 0x1003d691
mov dword [ebp - 0x2e8], 0xa6f4
mov dword [ebp - 0x3f4], 0x7c7592e0
mov dword [ebp - 0xdbc], 0x2575e7e8
mov byte [ebp - 0x155], 0
movzx eax, byte [ebp - 0x155]
test eax, eax
je 0x1003d541
push 0x4624
push 1
push 0x2695
push 0
push 1
call fcn.1002d905
add esp, 0x14
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x1404], eax
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x12b4], eax
cmp dword [ebp - 0x2e0], 0
jne 0x1003d5cb
mov esi, dword [ebp - 0x2e8]
push 3
lea ecx, [ebp - 0x248]
call fcn.1000ba29
cmp esi, dword [eax]
jl 0x1003d585
mov dword [ebp - 0x5fc], 1
jmp 0x1003d58c
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x2e0]
cmp eax, dword [ebp - 0x5fc]
jg 0x1003d5a6
mov dword [ebp - 0x604], 1
jmp 0x1003d5ad
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x3f4], eax
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x60c], eax
mov eax, dword [ebp - 0x60c]
cmp dword [ebp - 0x3f4], 0x1a69
jl 0x1003d5f0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3fc], 0
jne 0x1003d5f0
and dword [ebp - 0x614], 0
jmp 0x1003d5fa
mov dword [ebp - 0x614], 1
push 3
lea ecx, [ebp - 0x248]
call fcn.1000ba29
mov ecx, dword [ebp - 0x614]
cmp ecx, dword [eax]
jle 0x1003d61d
mov dword [ebp - 0x61c], 1
jmp 0x1003d624
and dword [ebp - 0x61c], 0
cmp dword [ebp - 0x61c], 0xffff
jae 0x1003d63c
mov dword [ebp - 0x624], 1
jmp 0x1003d643
and dword [ebp - 0x624], 0
cmp dword [ebp - 0x624], 0x7a76
jl 0x1003d65b
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x1003d6c3
push 0x4bfb
push 0x233a
push 0
push 0x71c7
push 0x7ec
push 1
call fcn.1002acf2
add esp, 0x18
mov byte [ebp - 0x157], 0
movzx eax, byte [ebp - 0x157]
test eax, eax
je 0x1003d6e3
push 0
push 0x5a6f
call fcn.10045a98
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.1000ba0d
mov dword [ebp - 0xac], 0xd1b7e280
mov dword [ebp - 0xe0], 1
mov dword [ebp - 0x24c], 0
jmp 0x1003d71f
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 2
jge 0x1003d73b
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0x148], 0xfd4914d2
jmp 0x1003d712
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x148], 0
jne 0x1003d757
mov dword [ebp - 0x67c], 1
jmp 0x1003d75e
and dword [ebp - 0x67c], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x148]
cmp dword [ebp + eax - 0x148], ecx
jne 0x1003d786
mov dword [ebp - 0x63c], 1
jmp 0x1003d78d
and dword [ebp - 0x63c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x148]
imul eax, dword [ebp - 0x63c]
cmp eax, 0xf591
jne 0x1003d7b4
mov dword [ebp - 0x644], 1
jmp 0x1003d7bb
and dword [ebp - 0x644], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x148]
cmp dword [ebp - 0x644], eax
je 0x1003d7dc
mov dword [ebp - 0xe14], 1
jmp 0x1003d7e3
and dword [ebp - 0xe14], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x14e8], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x12bc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x148], 0xbb1a88af
jae 0x1003d81a
mov dword [ebp - 0x64c], 1
jmp 0x1003d821
and dword [ebp - 0x64c], 0
cmp dword [ebp - 0x64c], 5
jae 0x1003d836
mov dword [ebp - 0x654], 1
jmp 0x1003d83d
and dword [ebp - 0x654], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x148]
cmp eax, dword [ebp - 0x654]
jne 0x1003d867
cmp dword [ebp - 0xac], 0
je 0x1003d867
mov dword [ebp - 0x65c], 1
jmp 0x1003d86e
and dword [ebp - 0x65c], 0
cmp dword [ebp - 0x65c], 0
jle 0x1003d883
mov dword [ebp - 0x664], 1
jmp 0x1003d88a
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0xe0]
add eax, dword [ebp - 0x664]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x148]
jle 0x1003d8b1
mov dword [ebp - 0x66c], 1
jmp 0x1003d8b8
and dword [ebp - 0x66c], 0
cmp dword [ebp - 0x66c], 0x9731
jge 0x1003d8d0
mov dword [ebp - 0xdc4], 1
jmp 0x1003d8d7
and dword [ebp - 0xdc4], 0
mov eax, 0xae50
test eax, eax
jae 0x1003d8ec
mov dword [ebp - 0xe1c], 1
jmp 0x1003d8f3
and dword [ebp - 0xe1c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x148]
mov dword [ebp - 0x140c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x148]
sub eax, 0x20ea1bca
cmp eax, 0x56a4
je 0x1003d92b
mov dword [ebp - 0x674], 1
jmp 0x1003d932
and dword [ebp - 0x674], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x148]
add eax, dword [ebp - 0x674]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x148]
jne 0x1003d960
mov dword [ebp - 0x684], 1
jmp 0x1003d967
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x67c]
add eax, dword [ebp - 0x684]
jne 0x1003d9d1
mov dword [ebp - 0xe0], 0
jmp 0x1003d98e
cmp dword [ebp - 0xe0], 2
jge 0x1003d9aa
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0x148], 6
jmp 0x1003d981
push 0x6ebe
lea eax, [ebp - 0xe0]
push eax
push 0
push 0x536e
lea eax, [ebp - 0xac]
push eax
call fcn.1002df14
add esp, 0x14
jmp 0x1003dcfa
mov dword [ebp - 0xdcc], 0xeeb4
lea eax, [ebp - 0xdcc]
push eax
push 0
push 1
call fcn.1002ad9f
add esp, 0xc
mov dword [ebp - 0xe24], 0x170d
cmp dword [ebp - 0xe24], 0x5ef
jge 0x1003dcfa
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0x10007d30
call fcn.1005162b
add esp, 0x10
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x70]
jl 0x1003da66
jg 0x1003da36
xorpd xmm0, xmm0
movlpd qword [ebp - 0x1b8], xmm0
mov eax, dword [ebp - 0x88]
add eax, 2
mov ecx, dword [ebp - 0x84]
adc ecx, 0
mov edx, dword [ebp - 0x74]
add edx, dword [ebp - 0x6c]
mov esi, dword [ebp - 0x70]
adc esi, dword [ebp - 0x68]
mov dword [ebp - 0xe6c], eax
mov dword [ebp - 0xe68], ecx
mov dword [ebp - 0xe78], edx
mov dword [ebp - 0xe74], esi
mov eax, dword [ebp - 0xe68]
cmp eax, dword [ebp - 0xe74]
jl 0x1003dad9
mov dword [ebp - 0xac], 1
jmp 0x1003dd13
cmp dword [ebp - 0xac], 0
jl 0x1003dd38
jmp 0x10040d00
mov eax, dword [ebp - 0xd50]
mov dword [ebp - 0xd60], eax
mov eax, dword [ebp - 0xd58]
mov dword [ebp - 0xd68], eax
mov eax, dword [ebp - 0xd60]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0xd68]
mov dword [ebp - 0xd70], eax
mov eax, dword [ebp - 0x23c]
mov dword [eax], 0
jmp 0x10040cda
mov eax, dword [ebp - 0x23c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x23c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x23c]
cmp dword [eax], 3
jge 0x10040d00
mov eax, dword [ebp - 0x23c]
push dword [eax]
mov ecx, dword [ebp - 0xd70]
call fcn.1000ba29
mov dword [eax], 0x8261f9c2
jmp 0x10040cc9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret