Function at 0x1001b4cf
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10083c37
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xdac
mov dword [ebp - 0x280], 5
mov dword [ebp - 0x7a4], 1
xor eax, eax
inc eax
je 0x1001b570
cmp dword [ebp - 0x280], 0
jne 0x1001b521
cmp dword [ebp - 0x280], 0
jne 0x1001b521
and dword [ebp - 0x42c], 0
jmp 0x1001b52b
mov dword [ebp - 0x42c], 1
mov eax, dword [ebp - 0x280]
cmp eax, dword [ebp - 0x42c]
jg 0x1001b545
mov dword [ebp - 0x79c], 1
jmp 0x1001b54c
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x79c]
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebp - 0x280]
add eax, dword [ebp - 0x7a4]
je 0x1001b570
push 0
call fcn.1001aead
pop ecx
jmp 0x1001b590
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1001b590
push 0
push 0x4674
call fcn.1001b3f6
pop ecx
pop ecx
mov dword [ebp - 0xaf4], 0xffffffff
mov dword [ebp - 0x1c8], 0xb733c633
mov dword [ebp - 0x300], 8
mov dword [ebp - 0x928], 0xfffffffa
mov dword [ebp - 0x334], 0x9d70cadd
mov dword [ebp - 0x7e0], 0xbc00eadd
mov dword [ebp - 0x930], 0x901516ea
mov dword [ebp - 0x220], 0
jmp 0x1001b5ef
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 2
jge 0x1001b60b
mov eax, dword [ebp - 0x220]
mov dword [ebp + eax*4 - 0xb74], 0xb6eb6b9d
jmp 0x1001b5e2
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x828], eax
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x828], 3
jae 0x1001b639
mov dword [ebp - 0x7cc], 1
jmp 0x1001b640
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0x928], eax
jl 0x1001b65a
mov dword [ebp - 0x7ac], 1
jmp 0x1001b661
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x1c8]
add eax, dword [ebp - 0x7ac]
je 0x1001b6ee
mov eax, dword [ebp - 0x334]
mov ecx, dword [ebp - 0x334]
inc ecx
mov dword [ebp - 0x334], ecx
test eax, eax
jne 0x1001b698
mov eax, 0xce9
test eax, eax
jne 0x1001b698
and dword [ebp - 0x7b4], 0
jmp 0x1001b6a2
mov dword [ebp - 0x7b4], 1
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0xe889
jge 0x1001b6c6
mov dword [ebp - 0x7d8], 1
jmp 0x1001b6cd
and dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0x7e0]
cmp dword [ebp - 0x7d8], eax
jl 0x1001b6ee
push 2
pop eax
test eax, eax
je 0x1001b6ee
mov dword [ebp - 0x7f0], 1
jmp 0x1001b6f5
and dword [ebp - 0x7f0], 0
mov eax, dword [ebp - 0x7e0]
cmp dword [ebp - 0x7f0], eax
jge 0x1001b70f
mov dword [ebp - 0x5d0], 1
jmp 0x1001b716
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x7cc]
imul eax, dword [ebp - 0x5d0]
cmp eax, dword [ebp - 0x930]
jne 0x1001b737
mov dword [ebp - 0x39c], 1
jmp 0x1001b73e
and dword [ebp - 0x39c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x39c]
mov dword [ebp + eax - 0xb74], ecx
mov eax, dword [0x10675e84]
and eax, 1
jne 0x1001b785
mov eax, dword [0x10675e84]
or eax, 1
mov dword [0x10675e84], eax
and dword [ebp - 4], 0
mov ecx, 0x10675e44
call fcn.10015ddc
push 0x1008523e
call fcn.1006a666
pop ecx
or dword [ebp - 4], 0xffffffff
push dword [ebp + 8]
lea ecx, [ebp - 0xa9c]
call fcn.10015aa4
mov dword [ebp - 4], 1
lea eax, [ebp - 0xb30]
push eax
lea ecx, [ebp - 0xa9c]
call fcn.100161ac
push dword [eax]
lea eax, [ebp - 0xb38]
push eax
lea ecx, [ebp - 0xa9c]
call fcn.100161c0
push dword [eax]
lea eax, [ebp - 0xb40]
push eax
lea ecx, [ebp - 0xa9c]
call fcn.100161ac
push dword [eax]
mov edx, 0x10018b3a
lea ecx, [ebp - 0xb48]
call fcn.100239d8
add esp, 0xc
mov dword [ebp - 0x794], 0x16f93bd5
mov dword [ebp - 0x5d8], 0
mov dword [ebp - 0x940], 0x9f486485
mov dword [ebp - 0x54], 0
jmp 0x1001b817
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x1001b82d
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xaac], 0xffffffff
jmp 0x1001b810
mov dword [ebp - 0x54], 0
jmp 0x1001b83d
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x1001b853
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x378], 0
jmp 0x1001b836
mov byte [ebp - 0xcf], 0
lea eax, [ebp - 0xcf]
push eax
push 0
call fcn.1001b1f6
pop ecx
pop ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xaac]
mov dword [ebp - 0xb50], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xaac]
mov dword [ebp - 0xb58], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x378], 0xe7ad53a
jg 0x1001b8af
mov dword [ebp - 0x938], 1
jmp 0x1001b8b6
and dword [ebp - 0x938], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x378]
mov dword [ebp - 0xb60], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x378]
mov dword [ebp - 0xb68], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xaac]
cmp dword [ebp - 0x5d8], eax
jl 0x1001b8fd
mov dword [ebp - 0x78c], 1
jmp 0x1001b904
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x78c]
mov dword [ebp - 0x794], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x378]
cmp dword [ebp - 0x794], eax
jg 0x1001b931
mov dword [ebp - 0x3a8], 1
jmp 0x1001b938
and dword [ebp - 0x3a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x378]
cmp dword [ebp - 0x3a8], eax
jge 0x1001b959
mov dword [ebp - 0x6e8], 1
jmp 0x1001b960
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x6e8]
sub eax, 0xf5a2
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x378]
jge 0x1001b986
mov dword [ebp - 0x3b0], 1
jmp 0x1001b98d
and dword [ebp - 0x3b0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xaac]
cmp eax, dword [ebp - 0x3b0]
jge 0x1001b9ae
mov dword [ebp - 0x3b8], 1
jmp 0x1001b9b5
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x5d8]
add eax, dword [ebp - 0x3b8]
cmp eax, 6
je 0x1001b9d2
mov dword [ebp - 0x7b8], 1
jmp 0x1001b9d9
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x7b8]
mov dword [ebp - 0x940], eax
lea ecx, [ebp - 0xa9c]
call fcn.10018ac5
mov dword [ebp - 0x764], eax
mov dword [ebp - 0x1c], 0xed9ba07e
mov dword [ebp - 0x23c], 0xd9ee1c97
mov dword [ebp - 0xe0], 0xfd77ccca
mov dword [ebp - 0x948], 0
mov dword [ebp - 0x950], 0xfffffffe
mov byte [ebp - 0xd1], 0
push 0
lea eax, [ebp - 0xd1]
push eax
call fcn.1001b2c6
pop ecx
pop ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xbe0], eax
mov dword [ebp - 0x23c], 0x85faafe3
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0xbe8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xbf0], eax
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0xe0], eax
je 0x1001ba7e
mov dword [ebp - 0x3c0], 1
jmp 0x1001ba85
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x3c0], eax
jl 0x1001baa2
cmp dword [ebp - 0xe0], 0
jne 0x1001baa2
and dword [ebp - 0x5e0], 0
jmp 0x1001baac
mov dword [ebp - 0x5e0], 1
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x1c], eax
jge 0x1001bac6
mov dword [ebp - 0x3c8], 1
jmp 0x1001bacd
and dword [ebp - 0x3c8], 0
imul eax, dword [ebp - 0x3c8], 0x78ef
sub eax, 0xffff
cmp eax, 2
je 0x1001baed
mov dword [ebp - 0x6f0], 1
jmp 0x1001baf4
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x6f0], eax
jle 0x1001bb0b
mov dword [ebp - 0x3d0], 1
jmp 0x1001bb12
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x23c]
cmp dword [ebp - 0x3d0], eax
je 0x1001bb2c
mov dword [ebp - 0x5e8], 1
jmp 0x1001bb33
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x5e8], eax
jne 0x1001bb4a
mov dword [ebp - 0x3d8], 1
jmp 0x1001bb51
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x3d8]
je 0x1001bb68
mov dword [ebp - 0x778], 1
jmp 0x1001bb6f
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x23c]
add eax, dword [ebp - 0x778]
cmp eax, dword [ebp - 0xe0]
jge 0x1001bb8f
mov dword [ebp - 0x3e0], 1
jmp 0x1001bb96
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x3e0]
imul eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x948]
jl 0x1001bbb7
mov dword [ebp - 0x5f0], 1
jmp 0x1001bbbe
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x5f0], eax
jg 0x1001bbd7
or eax, 0xffffffff
jne 0x1001bbd7
and dword [ebp - 0x3e8], 0
jmp 0x1001bbe1
mov dword [ebp - 0x3e8], 1
mov eax, dword [ebp - 0x3e8]
neg eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0x1af6658d
jne 0x1001bc0c
or eax, 0xffffffff
je 0x1001bc0c
mov dword [ebp - 0x6f8], 1
jmp 0x1001bc13
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x6f8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xbf8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x950], eax
movzx eax, byte [0x10675d86]
test eax, eax
je 0x1001c25e
mov ecx, 0x10675e44
call fcn.100236b9
movzx eax, al
test eax, eax
jne 0x1001c25e
mov dword [ebp - 0xa8], 0x32b1cecb
mov dword [ebp - 0x24c], 0xfffffffa
mov dword [ebp - 0x84], 0
jmp 0x1001bc7f
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x1001bc9b
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x168], 0
jmp 0x1001bc72
mov dword [ebp - 0x84], 0
jmp 0x1001bcb4
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 4
jge 0x1001bcd0
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xd54], 0x8d239be9
jmp 0x1001bca7
mov dword [ebp - 0xa8], 0
jmp 0x1001bce9
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x1001bfb1
mov dword [ebp - 0x130], 0x9f7fd1e8
mov dword [ebp - 0x1d8], 1
mov dword [ebp - 0xc00], 0x145c
mov dword [ebp - 0x970], 0xa4087b33
mov dword [ebp - 0x1d0], 0
jmp 0x1001bd37
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 3
jge 0x1001bd53
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0xd04], 4
jmp 0x1001bd2a
mov dword [ebp - 0x130], 0
jmp 0x1001bd6c
mov eax, dword [ebp - 0x130]
dec eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0
jl 0x1001be3f
mov dword [ebp - 0x15c], 0xb9dd952e
mov dword [ebp - 0x244], 0xfffffffd
mov dword [ebp - 0xc08], 0xffffffff
mov dword [ebp - 0xc44], 0x253a34c8
lea eax, [ebp - 0x15c]
push eax
push 0
call fcn.1001af22
pop ecx
pop ecx
mov dword [ebp - 0x244], 0
jmp 0x1001bdca
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0
jg 0x1001be3a
mov dword [ebp - 0x15c], 0
jmp 0x1001bdec
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
jl 0x1001be38
mov dword [ebp - 0x1d8], 0
jmp 0x1001be0e
mov eax, dword [ebp - 0x1d8]
dec eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0
jl 0x1001be36
mov byte [ebp - 0xd3], 0
lea eax, [ebp - 0xd3]
push eax
push 0
push 0x5f5
call fcn.1001ac89
add esp, 0xc
jmp 0x1001be01
jmp 0x1001bddf
jmp 0x1001bdbd
jmp 0x1001bd5f
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x168]
mov dword [ebp - 0xc4c], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x3f0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3f0]
mov dword [ebp + eax - 0xd04], ecx
cmp dword [ebp - 0x3f0], 0
je 0x1001bea0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x168]
cmp dword [ebp - 0x24c], eax
jl 0x1001bea0
or eax, 0xffffffff
je 0x1001bea0
mov dword [ebp - 0x5f8], 1
jmp 0x1001bea7
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0x5f8]
jge 0x1001bec1
mov dword [ebp - 0x3f8], 1
jmp 0x1001bec8
and dword [ebp - 0x3f8], 0
cmp dword [ebp - 0x3f8], 0xb2bc
jge 0x1001bee0
mov dword [ebp - 0x7ec], 1
jmp 0x1001bee7
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x24c]
cmp dword [ebp - 0x7ec], eax
je 0x1001bf01
mov dword [ebp - 0x400], 1
jmp 0x1001bf08
and dword [ebp - 0x400], 0
cmp dword [ebp - 0x400], 7
jae 0x1001bf1d
mov dword [ebp - 0x600], 1
jmp 0x1001bf24
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x600]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0xc54], eax
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x168]
mov dword [ebp - 0xc5c], eax
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x168], 0xc28c
test eax, eax
jne 0x1001bf76
cmp dword [ebp - 0x130], 0
jne 0x1001bf76
and dword [ebp - 0x33c], 0
jmp 0x1001bf80
mov dword [ebp - 0x33c], 1
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x33c]
mov dword [ebp + eax - 0xd54], ecx
mov eax, dword [ebp - 0x970]
add eax, dword [ebp - 0x33c]
mov ecx, dword [ebp - 0xa8]
mov dword [ebp + ecx*4 - 0x168], eax
jmp 0x1001bcdc
lea eax, [ebp - 0x764]
push eax
lea eax, [ebp - 0x780]
push eax
mov ecx, 0x10675e44
call fcn.10015db4
mov dword [ebp - 0x980], 0x8acc4b7c
mov dword [ebp - 0x1e0], 0
jmp 0x1001bfec
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 3
jge 0x1001c008
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0x384], 0x7ddc85f7
jmp 0x1001bfdf
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x384], 0
jmp 0x1001c033
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x384]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x384], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x384], 0xfffffff4
jge 0x1001c11c
mov dword [ebp - 0x978], 1
mov dword [ebp - 0x700], 0xc58bdfad
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x384], 0xfffffffd
jl 0x1001c075
mov dword [ebp - 0x408], 1
jmp 0x1001c07c
and dword [ebp - 0x408], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x384]
cmp eax, dword [ebp - 0x408]
jne 0x1001c0b9
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x384]
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0x384]
mov dword [ebp - 0x700], eax
jne 0x1001c0b9
and dword [ebp - 0x410], 0
jmp 0x1001c0c3
mov dword [ebp - 0x410], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x384]
cmp dword [ebp - 0x410], eax
jl 0x1001c0e3
mov dword [ebp - 0x608], 1
jmp 0x1001c0ea
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x978]
cmp eax, dword [ebp - 0x608]
jle 0x1001c104
mov dword [ebp - 0x418], 1
jmp 0x1001c10b
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x980], eax
jmp 0x1001c01a
lea eax, [ebp - 0xc64]
push eax
mov ecx, 0x10675e44
call fcn.10015da6
push eax
lea ecx, [ebp - 0x780]
call fcn.10015dc9
movzx eax, al
test eax, eax
je 0x1001c25e
mov dword [ebp - 0xb8], 1
mov dword [ebp - 0x9ec], 3
mov dword [ebp - 0xb8], 0xfffffffa
jmp 0x1001c171
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xe
jne 0x1001c201
mov dword [ebp - 0x9cc], 0
mov dword [ebp - 0x9c4], 1
mov dword [ebp - 0x9d4], 0x5b7d
mov dword [ebp - 0x254], 0
jmp 0x1001c1b5
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 4
jge 0x1001c1d1
mov eax, dword [ebp - 0x254]
mov dword [ebp + eax*4 - 0xd34], 8
jmp 0x1001c1a8
lea eax, [ebp - 0x9c4]
push eax
lea eax, [ebp - 0x9cc]
push eax
push 0
call fcn.1001ac08
add esp, 0xc
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd34]
mov dword [ebp - 0x9d4], eax
jmp 0x1001c164
mov dword [ebp - 0xb8], 0xfffffffd
jmp 0x1001c21a
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xffffffe6
jge 0x1001c230
cmp dword [ebp - 0x9ec], 0
je 0x1001c22e
jmp 0x1001c230
jmp 0x1001c20d
lea ecx, [ebp - 0x780]
call fcn.100236c2
mov eax, dword [eax + 4]
mov dword [ebp - 0x924], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa9c]
call fcn.10015b29
mov eax, dword [ebp - 0x924]
jmp 0x1002182b
mov dword [ebp - 0x1e8], 0x22e9
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x438], 0xfffe
mov dword [ebp - 0x68], 0
jmp 0x1001c28c
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x1001c2a2
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x154], 0xfffffff7
jmp 0x1001c285
mov dword [ebp - 0x68], 0
jmp 0x1001c2b2
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x1001c2c8
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0xd10], 0xfffffff6
jmp 0x1001c2ab
push 4
pop eax
test eax, eax
je 0x1001c3ad
mov eax, dword [ebp - 0x1e8]
mov ecx, dword [ebp - 0x1e8]
sub ecx, 0x4111d018
imul eax, ecx
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x154]
jge 0x1001c303
mov dword [ebp - 0x420], 1
jmp 0x1001c30a
and dword [ebp - 0x420], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
cmp eax, dword [ebp - 0x420]
jl 0x1001c32b
mov dword [ebp - 0x610], 1
jmp 0x1001c332
and dword [ebp - 0x610], 0
cmp dword [ebp - 0x610], 0xffffffff
jg 0x1001c347
mov dword [ebp - 0x920], 1
jmp 0x1001c34e
and dword [ebp - 0x920], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
mov dword [ebp - 0xc6c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
mov dword [ebp - 0x428], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x428]
mov dword [ebp + eax - 0xd10], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x154]
imul eax, dword [ebp - 0x428]
sub eax, 0x36efa05e
je 0x1001c3ad
mov dword [ebp - 0x708], 1
jmp 0x1001c3b4
and dword [ebp - 0x708], 0
cmp dword [ebp - 0x708], 0xc576
jne 0x1001c3cc
mov dword [ebp - 0x430], 1
jmp 0x1001c3d3
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
sub eax, 0x61a6b719
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x154]
sub eax, dword [ebp - 0x1e8]
cmp eax, dword [ebp - 0x1e8]
je 0x1001c406
mov dword [ebp - 0x618], 1
jmp 0x1001c40d
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0x834], eax
mov eax, dword [ebp - 0x438]
dec eax
mov dword [ebp - 0x438], eax
and dword [ebp - 0x158], 0
lea eax, [ebp - 0xa9c]
push eax
call fcn.10019b15
pop ecx
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jne 0x10020eba
mov dword [ebp - 0x1f0], 1
mov dword [ebp - 0x25c], 0
jmp 0x1001c470
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 2
jge 0x1001c48c
mov eax, dword [ebp - 0x25c]
mov dword [ebp + eax*4 - 0xd24], 0x1713
jmp 0x1001c463
mov dword [ebp - 0x1f0], 0
jmp 0x1001c4a5
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 1
jg 0x1001c4d0
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1001c4ce
push 0
push 0x4ac4
call fcn.1001b12a
pop ecx
pop ecx
jmp 0x1001c498
mov dword [ebp - 0xc74], 0x54fddd3f
mov dword [ebp - 0xc7c], 0xffffffff
mov dword [ebp - 0xc84], 1
mov dword [ebp - 0xc8c], 0
mov dword [ebp - 0x90], 0
jmp 0x1001c511
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x1001c52d
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0xd5c], 0x5912491e
jmp 0x1001c504
mov dword [ebp - 0x90], 0
jmp 0x1001c546
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x1001c562
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x9a8], 0
jmp 0x1001c539
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x9a8], 1
cmp dword [0x10675d80], 0
jne 0x10020a15
mov dword [ebp - 0xc94], 0x2db58e46
mov byte [ebp - 0xd7], 0
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x1001c5aa
push 0
push 0x395a
call fcn.1001ab22
pop ecx
pop ecx
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x1001c5ca
push 0
push 0x3d06
call fcn.1001ad65
pop ecx
pop ecx
mov dword [ebp - 0x10], 0xbb74
mov dword [ebp - 0x24], 0x68cb667f
mov dword [ebp - 0x164], 0xffffffff
mov dword [ebp - 0x7c8], 0x6a6d983a
mov dword [ebp - 0x264], 0
jmp 0x1001c605
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 2
jge 0x1001c621
mov eax, dword [ebp - 0x264]
mov dword [ebp + eax*4 - 0x348], 0x17cd9532
jmp 0x1001c5f8
cmp dword [ebp - 0x10], 0
jne 0x1001c702
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc9c], eax
mov eax, dword [ebp - 0x10]
neg eax
jne 0x1001c648
xor eax, eax
jne 0x1001c648
and dword [ebp - 0x7c4], 0
jmp 0x1001c652
mov dword [ebp - 0x7c4], 1
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x7c4]
cmp eax, dword [ebp - 0x10]
jge 0x1001c66c
mov dword [ebp - 0x440], 1
jmp 0x1001c673
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x440]
cmp eax, dword [ebp - 0x10]
jne 0x1001c68e
mov dword [ebp - 0x620], 1
jmp 0x1001c695
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x620], eax
je 0x1001c6ac
mov dword [ebp - 0x448], 1
jmp 0x1001c6b3
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xca4], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xcac], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xce8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xce4], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xcd8], eax
mov eax, 0xb9ba5e0b
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x164], eax
jne 0x1001c702
and dword [ebp - 0x710], 0
jmp 0x1001c70c
mov dword [ebp - 0x710], 1
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x710]
jge 0x1001c723
mov dword [ebp - 0x450], 1
jmp 0x1001c72a
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x450], eax
jl 0x1001c74a
cmp dword [ebp - 0x164], 0
je 0x1001c74a
mov dword [ebp - 0x370], 1
jmp 0x1001c751
and dword [ebp - 0x370], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x370]
mov dword [ebp + eax - 0x348], ecx
cmp dword [ebp - 0x370], 0x6e87
jge 0x1001c77c
mov dword [ebp - 0x628], 1
jmp 0x1001c783
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x628]
jge 0x1001c99f
mov dword [ebp - 0x468], 1
mov dword [ebp - 0x1f8], 0
jmp 0x1001c7b5
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 4
jge 0x1001c7d1
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0xa58], 0
jmp 0x1001c7a8
mov dword [ebp - 0x10], 0xa
jmp 0x1001c7e1
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x1d
jle 0x1001c954
mov dword [ebp - 0x36c], 0x6e3f0e26
mov dword [ebp - 0x470], 1
mov dword [ebp - 0x83c], 0x663b8b2e
cmp dword [ebp - 0x468], 0x28ae
jl 0x1001c821
mov dword [ebp - 0x458], 1
jmp 0x1001c828
and dword [ebp - 0x458], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x348]
cmp dword [ebp - 0x458], eax
jge 0x1001c84f
cmp dword [ebp - 0x164], 0
jne 0x1001c84f
and dword [ebp - 0x788], 0
jmp 0x1001c859
mov dword [ebp - 0x788], 1
mov dword [ebp - 0x36c], 1
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x788]
push 4
pop ecx
shl ecx, 0
mov edx, dword [ebp - 0x36c]
imul edx, dword [ebp + ecx - 0x348]
cmp edx, eax
jne 0x1001c898
mov dword [ebp - 0x460], 1
jmp 0x1001c89f
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x7c8]
cmp dword [ebp - 0x460], eax
jge 0x1001c8c2
cmp dword [ebp - 0x36c], 0
je 0x1001c8c2
mov dword [ebp - 0x630], 1
jmp 0x1001c8c9
and dword [ebp - 0x630], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x630]
mov dword [ebp + eax - 0xa58], ecx
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa58]
sub eax, dword [ebp - 0x470]
jne 0x1001c913
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa58], 0
jne 0x1001c913
cmp dword [ebp - 0x468], 0
jne 0x1001c913
and dword [ebp - 0x718], 0
jmp 0x1001c91d
mov dword [ebp - 0x718], 1
mov eax, dword [ebp - 0x718]
sub eax, 0x61b912b3
cmp eax, dword [ebp - 0x470]
jg 0x1001c93c
mov dword [ebp - 0x638], 1
jmp 0x1001c943
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x83c], eax
jmp 0x1001c7da
mov dword [ebp - 0x24], 3
jmp 0x1001c964
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1001c99d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa58], 0xffffffff
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x348], 0xffffffff
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa58], 0
je 0x1001c99b
jmp 0x1001c99d
jmp 0x1001c95d
jmp 0x1001c9f2
mov dword [ebp - 0x92c], 0xfffffff8
mov byte [ebp - 0x101], 0
push 1
lea eax, [ebp - 0x101]
push eax
call fcn.1001ab22
pop ecx
pop ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x348]
mov dword [ebp - 0x478], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x478]
mov dword [ebp + eax - 0x348], ecx
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x92c], eax
mov dword [ebp - 0x10], 0
jmp 0x1001ca02
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x1b
jl 0x1001cbc4
mov dword [ebp - 0x488], 0x53f3
mov dword [ebp - 0x790], 0x6afe108d
mov dword [ebp - 0xa00], 0x66f8
mov dword [ebp - 0x84c], 0xfffffffc
mov dword [ebp - 0x26c], 0
jmp 0x1001ca4d
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 2
jge 0x1001ca69
mov eax, dword [ebp - 0x26c]
mov dword [ebp + eax*4 - 0x95c], 0xd6f4
jmp 0x1001ca40
mov eax, dword [ebp - 0x7c8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x24], eax
jl 0x1001ca86
mov dword [ebp - 0x480], 1
jmp 0x1001ca8d
and dword [ebp - 0x480], 0
cmp dword [ebp - 0x480], 0x4d35
jg 0x1001caa5
mov dword [ebp - 0x720], 1
jmp 0x1001caac
and dword [ebp - 0x720], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x348]
cmp dword [ebp + eax - 0x95c], ecx
jle 0x1001cad4
mov dword [ebp - 0x640], 1
jmp 0x1001cadb
and dword [ebp - 0x640], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x95c]
cmp dword [ebp - 0x640], eax
jle 0x1001cafc
mov dword [ebp - 0x844], 1
jmp 0x1001cb03
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x488]
cmp dword [ebp - 0x488], eax
jg 0x1001cb1d
mov dword [ebp - 0x490], 1
jmp 0x1001cb24
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x720]
cmp eax, dword [ebp - 0x490]
jne 0x1001cb44
cmp dword [ebp - 0x24], 0
je 0x1001cb44
mov dword [ebp - 0x648], 1
jmp 0x1001cb4b
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x648]
jg 0x1001cb5f
cmp dword [ebp - 0x164], 0
jne 0x1001cb71
cmp dword [ebp - 0x790], 0
jne 0x1001cb71
and dword [ebp - 0x498], 0
jmp 0x1001cb7b
mov dword [ebp - 0x498], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x95c]
imul eax, dword [ebp - 0x498]
cmp eax, dword [ebp - 0x790]
jle 0x1001cbac
cmp dword [ebp - 0xa00], 0
je 0x1001cbac
mov dword [ebp - 0x4a0], 1
jmp 0x1001cbb3
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x84c], eax
jmp 0x1001c9fb
mov dword [ebp - 0x170], 1
mov dword [ebp - 0xc50], 0
mov dword [ebp - 0x170], 0x17
jmp 0x1001cbf1
mov eax, dword [ebp - 0x170]
dec eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0xffffffe9
je 0x1001ccd5
mov dword [ebp - 0x188], 0xa876e6ba
mov dword [ebp - 0x190], 0xec79cf18
mov dword [ebp - 0x188], 0
jmp 0x1001cc2b
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xffffffef
je 0x1001cc7e
mov dword [ebp - 0x200], 0
jmp 0x1001cc4d
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 3
jge 0x1001cc69
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0xd1c], 1
jmp 0x1001cc40
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd1c]
mov dword [ebp - 0x190], eax
jmp 0x1001cc1e
mov dword [ebp - 0x190], 0
jmp 0x1001cc97
mov eax, dword [ebp - 0x190]
dec eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0xffffffe3
jle 0x1001ccd0
mov dword [ebp - 0x934], 0xaa96141e
lea eax, [ebp - 0x934]
push eax
lea eax, [ebp - 0x170]
push eax
push 0
lea eax, [ebp - 0x188]
push eax
push 0x7960
call fcn.1002323e
add esp, 0x14
jmp 0x1001cc8a
jmp 0x1001cbe4
mov byte [ebp - 0x2e4], 6
mov byte [ebp - 0x2e3], 0xfc
mov byte [ebp - 0x2e2], 0xa
mov byte [ebp - 0x2e1], 0x5f
mov byte [ebp - 0x2e0], 7
mov byte [ebp - 0x2df], 0x5e
mov byte [ebp - 0x2de], 0
mov byte [ebp - 0x2dd], 0x79
mov byte [ebp - 0x2dc], 3
mov byte [ebp - 0x2db], 0x25
mov byte [ebp - 0x2da], 2
mov byte [ebp - 0x2d9], 0x1c
mov byte [ebp - 0x2d8], 5
mov byte [ebp - 0x2d7], 0x1e
mov byte [ebp - 0x2d6], 0x2a
mov byte [ebp - 0x2d5], 0x86
mov byte [ebp - 0x2d4], 0x6c
mov byte [ebp - 0x2d3], 0xe5
mov byte [ebp - 0x2d2], 0x5f
mov byte [ebp - 0x2d1], 0x43
mov byte [ebp - 0x2d0], 0xdf
mov byte [ebp - 0x2cf], 0x35
mov byte [ebp - 0x2ce], 0x61
mov byte [ebp - 0x2cd], 0x8d
mov byte [ebp - 0x2cc], 0x95
mov byte [ebp - 0x2cb], 0x53
mov byte [ebp - 0x2ca], 0xf8
mov byte [ebp - 0x2c9], 7
mov byte [ebp - 0x2c8], 0x46
mov byte [ebp - 0x2c7], 0xdb
mov byte [ebp - 0x2c6], 0xa3
mov byte [ebp - 0x2c5], 0x67
mov byte [ebp - 0x2c4], 0x6d
mov byte [ebp - 0x2c3], 0x42
mov byte [ebp - 0x2c2], 0x25
mov byte [ebp - 0x2c1], 0x56
mov byte [ebp - 0x2c0], 0x7f
mov byte [ebp - 0x2bf], 0xb2
mov byte [ebp - 0x2be], 0x24
mov byte [ebp - 0x2bd], 0x27
mov byte [ebp - 0x2bc], 0xfe
mov byte [ebp - 0x2bb], 0x5e
mov byte [ebp - 0x2ba], 0x15
mov byte [ebp - 0x2b9], 0x8e
mov byte [ebp - 0x2b8], 0x3c
mov byte [ebp - 0x2b7], 0x5b
mov byte [ebp - 0x2b6], 0x79
mov byte [ebp - 0x2b5], 0x99
mov byte [ebp - 0x2b4], 0xb0
mov byte [ebp - 0x2b3], 0x88
mov byte [ebp - 0x2b2], 0xe9
mov byte [ebp - 0x2b1], 4
mov byte [ebp - 0x2b0], 0x55
mov byte [ebp - 0x2af], 0x3f
mov byte [ebp - 0x2ae], 0x6f
mov byte [ebp - 0x2ad], 0xc0
mov byte [ebp - 0x2ac], 0x56
mov byte [ebp - 0x2ab], 0xb
mov byte [ebp - 0x2aa], 0
mov byte [ebp - 0x2a9], 8
mov byte [ebp - 0x2a8], 0x42
mov byte [ebp - 0x2a7], 1
mov byte [ebp - 0x2a6], 0x4b
mov byte [ebp - 0x2a5], 4
mov byte [ebp - 0x2a4], 0
mov byte [ebp - 0x2a3], 9
mov byte [ebp - 0x2a2], 1
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x4c8], 0x8e548e01
mov dword [ebp - 0x274], 0
jmp 0x1001ced4
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 2
jge 0x1001cef0
mov eax, dword [ebp - 0x274]
mov dword [ebp + eax*4 - 0x2ec], 0x52f76ec7
jmp 0x1001cec7
mov dword [ebp - 0x44], 0
jmp 0x1001cf00
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xfffffff5
jne 0x1001cf75
mov dword [ebp - 0x208], 0x3c69
mov dword [ebp - 0xaec], 0xffffffff
mov dword [ebp - 0x854], 0
push 0
lea eax, [ebp - 0x854]
push eax
push 0x5e37
call fcn.1001ab75
add esp, 0xc
mov dword [ebp - 0x208], 0xfffffffd
jmp 0x1001cf53
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 8
je 0x1001cf73
mov dword [ebp - 0x9b0], 0
cmp dword [ebp - 0x9b0], 0
je 0x1001cf71
jmp 0x1001cf73
jmp 0x1001cf46
jmp 0x1001cef9
mov dword [ebp - 0x44], 0
jmp 0x1001cf85
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jg 0x1001d28f
mov dword [ebp - 0x85c], 0xda7209c3
mov dword [ebp - 0x27c], 0
jmp 0x1001cfb2
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 1
jge 0x1001cfcb
mov eax, dword [ebp - 0x27c]
mov dword [ebp + eax*4 - 0x58], 0xfffffffa
jmp 0x1001cfa5
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x58], 1
jmp 0x1001cff0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x58], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x58], 0
jl 0x1001d26d
mov dword [ebp - 0x7d0], 0x628eaf60
mov dword [ebp - 0x86c], 0x5618d7c
mov dword [ebp - 0x210], 0
jmp 0x1001d02e
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 1
jge 0x1001d04a
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0x9d0], 0xffffffff
jmp 0x1001d021
cmp dword [ebp - 0x85c], 0
je 0x1001d11d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58]
cmp dword [ebp + eax*4 - 0x2ec], 0x637b3047
jne 0x1001d07a
mov dword [ebp - 0x93c], 1
jmp 0x1001d081
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0x7d0]
mov dword [ebp - 0xc04], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58]
cmp dword [ebp + eax*4 - 0x2ec], 0
ja 0x1001d0ad
mov dword [ebp - 0x650], 1
jmp 0x1001d0b4
and dword [ebp - 0x650], 0
cmp dword [ebp - 0x650], 0xfff7
jb 0x1001d0cc
mov dword [ebp - 0x4a8], 1
jmp 0x1001d0d3
and dword [ebp - 0x4a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58]
mov eax, dword [ebp + eax*4 - 0x2ec]
cmp dword [ebp - 0x4a8], eax
jg 0x1001d0f8
mov dword [ebp - 0x864], 1
jmp 0x1001d0ff
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xafc], eax
mov eax, 0xbf7c
test eax, eax
je 0x1001d11d
mov dword [ebp - 0x728], 1
jmp 0x1001d124
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x728]
jne 0x1001d13b
mov dword [ebp - 0x4b0], 1
jmp 0x1001d142
and dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x4b0], 1
jge 0x1001d157
mov dword [ebp - 0x658], 1
jmp 0x1001d15e
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x658], eax
jne 0x1001d175
mov dword [ebp - 0x4b8], 1
jmp 0x1001d17c
and dword [ebp - 0x4b8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58]
mov eax, dword [ebp + eax*4 - 0x2ec]
sub eax, dword [ebp - 0x4b8]
add eax, 4
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x2ec]
jne 0x1001d1be
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2ec], 0
jne 0x1001d1be
and dword [ebp - 0x4c0], 0
jmp 0x1001d1c8
mov dword [ebp - 0x4c0], 1
mov eax, dword [ebp - 0x7d0]
cmp dword [ebp - 0x4c0], eax
je 0x1001d1f2
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2ec], 0
je 0x1001d1f2
mov dword [ebp - 0x660], 1
jmp 0x1001d1f9
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x660]
mov dword [ebp - 0x4c8], eax
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x730], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x730]
mov dword [ebp + eax - 0x9d0], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58]
mov eax, dword [ebp + eax*4 - 0x2ec]
imul eax, dword [ebp - 0x730]
mov dword [ebp - 0x86c], eax
mov byte [ebp - 0xc8], 0
movzx eax, byte [ebp - 0xc8]
test eax, eax
je 0x1001d268
push 0xc60
push 0x422a
push 0
call fcn.1001ad24
add esp, 0xc
jmp 0x1001cfdb
mov byte [ebp - 0x123], 0
push 1
push 0x7d58
lea eax, [ebp - 0x123]
push eax
call fcn.1001ab75
add esp, 0xc
jmp 0x1001cf7e
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x2e4]
or eax, 0xcf
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x2e4]
and ecx, 0xcf
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x2e4]
mov word [ebp + ecx*2 - 0xae8], ax
mov dword [ebp - 0xe8], 0xb5bf2d3f
mov dword [ebp - 0x340], 1
mov dword [ebp - 0x944], 0xcf81320f
mov dword [ebp - 0x284], 0
jmp 0x1001d305
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 1
jge 0x1001d321
mov eax, dword [ebp - 0x284]
mov dword [ebp + eax*4 - 0x13c], 0xfffffff6
jmp 0x1001d2f8
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x13c], 0xffffffe8
jmp 0x1001d34f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x13c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x13c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x13c], 0x18
jg 0x1001d464
mov dword [ebp - 0x308], 0xa00f47a6
mov dword [ebp - 0x218], 1
mov eax, 0x8f6c
test eax, eax
je 0x1001d3a9
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
imul eax, dword [ebp - 0x308]
test eax, eax
je 0x1001d3a9
mov dword [ebp - 0x4d0], 1
jmp 0x1001d3b0
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x308], eax
jg 0x1001d43b
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0xca8], eax
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0xb04], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x13c], 0
jne 0x1001d414
mov eax, 0xe75cb554
test eax, eax
jne 0x1001d414
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x13c], 0
jne 0x1001d414
and dword [ebp - 0x668], 0
jmp 0x1001d41e
mov dword [ebp - 0x668], 1
mov eax, dword [ebp - 0xe8]
add eax, dword [ebp - 0x668]
mov dword [ebp - 0x340], eax
jne 0x1001d43b
and dword [ebp - 0x4d8], 0
jmp 0x1001d445
mov dword [ebp - 0x4d8], 1
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x944], eax
cmp dword [ebp - 0x340], 0
je 0x1001d45f
jmp 0x1001d334
jmp 0x1001d334
mov dword [ebp - 0xe8], 0
jmp 0x1001d47d
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0xffffffe7
jle 0x1001d4a8
mov byte [ebp - 0xca], 0
movzx eax, byte [ebp - 0xca]
test eax, eax
je 0x1001d4a6
push 1
push 0x29f5
call fcn.1001abc3
pop ecx
pop ecx
jmp 0x1001d470
mov dword [ebp - 0x14], 2
and dword [ebp - 0x180], 0
jmp 0x1001d4c0
mov eax, dword [ebp - 0x14]
inc eax
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x43
jae 0x1001e1da
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x2e4]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x14], eax
jne 0x1001dd25
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xb0], 0xffffffee
jmp 0x1001d508
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x1c
jle 0x1001d52a
mov byte [ebp - 0xd2], 0
lea eax, [ebp - 0xd2]
push eax
push 0
call fcn.1001aee9
pop ecx
pop ecx
jmp 0x1001d4fb
mov dword [ebp - 0xb0], 0xffffffff
jmp 0x1001d543
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0xffffffe8
jge 0x1001d5ae
mov dword [ebp - 0xacc], 0x961c0f80
mov dword [ebp - 0xac8], 0x961c0f80
mov dword [ebp - 0xac4], 0x961c0f80
mov dword [ebp - 0xac0], 0x961c0f80
mov byte [ebp - 0x109], 0
movzx eax, byte [ebp - 0x109]
test eax, eax
je 0x1001d59a
push 0x26d9
push 0x78d3
push 1
call fcn.1001ac08
add esp, 0xc
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xacc], 0
je 0x1001d5ac
jmp 0x1001d536
jmp 0x1001d536
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x2e4]
inc eax
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x28c], 0x4e064826
mov dword [ebp - 0x28c], 5
jmp 0x1001d5e3
mov eax, dword [ebp - 0x28c]
dec eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0xfffffff3
jle 0x1001d764
mov dword [ebp - 0x294], 0xd925b0e4
mov dword [ebp - 0x294], 0
jmp 0x1001d613
mov eax, dword [ebp - 0x294]
dec eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0xfffffff4
jl 0x1001d75f
mov dword [ebp - 0x70], 0
jmp 0x1001d630
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1001d646
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xd64], 0x7cf2
jmp 0x1001d629
mov dword [ebp - 0x70], 0
jmp 0x1001d656
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x1001d66c
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xa1c], 0x9ba07e4f
jmp 0x1001d64f
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xa1c], 1
jmp 0x1001d69a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa1c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa1c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa1c], 0
jl 0x1001d75a
mov dword [ebp - 0x9e8], 1
mov dword [ebp - 0x9e4], 1
mov dword [ebp - 0x9e0], 1
mov dword [ebp - 0x9dc], 1
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x9e8], 1
jmp 0x1001d704
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9e8]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x9e8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9e8], 0
jl 0x1001d738
mov byte [ebp - 0xcc], 0
push 0
lea eax, [ebp - 0xcc]
push eax
push 0x7e7
push 0x721f
call fcn.1001b388
add esp, 0x10
jmp 0x1001d6e9
mov byte [ebp - 0xce], 0
push 0x2f8c
push 1
lea eax, [ebp - 0xce]
push eax
call fcn.1001ac89
add esp, 0xc
jmp 0x1001d67f
jmp 0x1001d606
jmp 0x1001d5d6
mov byte [ebp - 0x111], 0
movzx eax, byte [ebp - 0x111]
test eax, eax
je 0x1001d77e
push 0
call fcn.1001b28f
pop ecx
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x2e4]
mov ecx, dword [ebp - 0x14]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc0], 0x9841b3c6
mov dword [ebp - 0x14c], 0xce96f8f9
mov dword [ebp - 0x87c], 9
mov dword [ebp - 0x9b8], 0x9a26
mov byte [ebp - 0xd0], 0
movzx eax, byte [ebp - 0xd0]
test eax, eax
je 0x1001d7d5
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [ebp - 0xc0], 0
jmp 0x1001d7ee
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 8
jg 0x1001dd20
mov dword [ebp - 0x178], 5
mov dword [ebp - 0xf0], 0xffffffff
mov dword [ebp - 0x94c], 1
mov dword [ebp - 0x268], 0
jmp 0x1001d832
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 2
jge 0x1001d84e
mov eax, dword [ebp - 0x268]
mov dword [ebp + eax*4 - 0xb80], 1
jmp 0x1001d825
cmp dword [ebp - 0xc0], 0
jne 0x1001d863
mov dword [ebp - 0x798], 1
jmp 0x1001d86a
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x798]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jne 0x1001d925
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x178], eax
jl 0x1001d89d
mov dword [ebp - 0x4e0], 1
jmp 0x1001d8a4
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x4e0], eax
jne 0x1001d8be
mov dword [ebp - 0x670], 1
jmp 0x1001d8c5
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x670], eax
jg 0x1001d8df
mov dword [ebp - 0x4e8], 1
jmp 0x1001d8e6
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x4e8], eax
jle 0x1001d909
cmp dword [ebp - 0x178], 0
je 0x1001d909
mov dword [ebp - 0x738], 1
jmp 0x1001d910
and dword [ebp - 0x738], 0
cmp dword [ebp - 0x738], 0xfff0
je 0x1001d925
and dword [ebp - 0x4f0], 0
jmp 0x1001d92f
mov dword [ebp - 0x4f0], 1
mov eax, dword [ebp - 0x178]
sub eax, dword [ebp - 0x4f0]
jne 0x1001d946
cmp dword [ebp - 0xc0], 0
je 0x1001d993
mov dword [ebp - 0x874], 1
mov byte [ebp - 0x127], 0
movzx eax, byte [ebp - 0x127]
test eax, eax
je 0x1001d976
push 1
push 0x43bb
push 0x7a2a
call fcn.1001ace0
add esp, 0xc
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0x874]
push eax
push 1
call fcn.1001ad24
add esp, 0xc
jmp 0x1001dd1b
mov dword [ebp - 0x198], 0x434392f2
mov dword [ebp - 0x508], 0x609d70ca
mov dword [ebp - 0x688], 4
mov dword [ebp - 0x228], 0
jmp 0x1001d9ca
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 1
jge 0x1001d9e6
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0x310], 0xfffffff7
jmp 0x1001d9bd
push 1
lea eax, [ebp - 0x688]
push eax
call fcn.1001ad65
pop ecx
pop ecx
mov dword [ebp - 0x198], 0
jmp 0x1001da0f
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0x17
jne 0x1001dd1b
mov dword [ebp - 0xa10], 0xffffffff
mov dword [ebp - 0xa0c], 0xffffffff
mov dword [ebp - 0xa08], 0xffffffff
mov dword [ebp - 0xa04], 0xffffffff
mov dword [ebp - 0x538], 0x7e9a03a1
mov dword [ebp - 0x14c], 0
jmp 0x1001da67
mov eax, dword [ebp - 0x14c]
dec eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jl 0x1001da84
mov eax, dword [ebp - 0x14c]
cmp dword [ebp + eax*4 - 0x310], 0
je 0x1001da82
jmp 0x1001da84
jmp 0x1001da5a
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xa10]
cmp dword [ebp + eax - 0x310], ecx
jg 0x1001daac
mov dword [ebp - 0x740], 1
jmp 0x1001dab3
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xc0c], eax
mov eax, 0x17c0
test eax, eax
jne 0x1001dad6
or eax, 0xffffffff
jne 0x1001dad6
and dword [ebp - 0x678], 0
jmp 0x1001dae0
mov dword [ebp - 0x678], 1
cmp dword [ebp - 0x678], 0x46ac1dea
je 0x1001daf8
mov dword [ebp - 0x4f8], 1
jmp 0x1001daff
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x9b8]
cmp dword [ebp - 0x4f8], eax
je 0x1001db19
mov dword [ebp - 0x7e4], 1
jmp 0x1001db20
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x7e4]
sub eax, 0x5f98
je 0x1001db42
cmp dword [ebp - 0x538], 0
je 0x1001db42
mov dword [ebp - 0x500], 1
jmp 0x1001db49
and dword [ebp - 0x500], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb80]
cmp dword [ebp - 0x500], eax
jg 0x1001db6a
mov dword [ebp - 0x680], 1
jmp 0x1001db71
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x680]
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x508], 0
jne 0x1001db98
cmp dword [ebp - 0x178], 0
jne 0x1001db98
and dword [ebp - 0x510], 0
jmp 0x1001dba2
mov dword [ebp - 0x510], 1
mov eax, dword [ebp - 0x740]
cmp eax, dword [ebp - 0x510]
jl 0x1001dbbc
mov dword [ebp - 0x518], 1
jmp 0x1001dbc3
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x688]
cmp dword [ebp - 0x518], eax
jle 0x1001dbdd
mov dword [ebp - 0x7a0], 1
jmp 0x1001dbe4
and dword [ebp - 0x7a0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa10]
cmp dword [ebp - 0x7a0], eax
jle 0x1001dc04
mov dword [ebp - 0x520], 1
jmp 0x1001dc0b
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x87c]
cmp dword [ebp - 0x520], eax
jl 0x1001dc25
mov dword [ebp - 0x690], 1
jmp 0x1001dc2c
and dword [ebp - 0x690], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x310]
cmp dword [ebp - 0x690], eax
jg 0x1001dc4d
mov dword [ebp - 0x528], 1
jmp 0x1001dc54
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x528], eax
je 0x1001dc6e
mov dword [ebp - 0x748], 1
jmp 0x1001dc75
and dword [ebp - 0x748], 0
cmp dword [ebp - 0x748], 0xffffffff
ja 0x1001dc8a
mov dword [ebp - 0x530], 1
jmp 0x1001dc91
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x530]
jg 0x1001dcab
mov dword [ebp - 0x698], 1
jmp 0x1001dcb2
and dword [ebp - 0x698], 0
cmp dword [ebp - 0x698], 0x9fd40fd7
jbe 0x1001dcca
mov dword [ebp - 0x7d4], 1
jmp 0x1001dcd1
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0x538]
cmp dword [ebp - 0x7d4], eax
jl 0x1001dceb
mov dword [ebp - 0x540], 1
jmp 0x1001dcf2
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0xf0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa10]
sub eax, dword [ebp - 0xf0]
mov dword [ebp - 0x94c], eax
jmp 0x1001da02
jmp 0x1001d7e1
jmp 0x1001d4b8
mov dword [ebp - 0x88], 0x32ffab8c
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x2a0], 0
jmp 0x1001dd4f
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 1
jge 0x1001dd6b
mov eax, dword [ebp - 0x2a0]
mov dword [ebp + eax*4 - 0x318], 8
jmp 0x1001dd42
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x6a0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6a0]
mov dword [ebp + eax - 0x318], ecx
cmp dword [ebp - 0x6a0], 1
je 0x1001dd9c
mov dword [ebp - 0x548], 1
jmp 0x1001dda3
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x548]
jg 0x1001ddbd
mov dword [ebp - 0x750], 1
jmp 0x1001ddc4
and dword [ebp - 0x750], 0
cmp dword [ebp - 0x750], 0xe843631e
je 0x1001dddc
mov dword [ebp - 0x550], 1
jmp 0x1001dde3
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x550]
cmp eax, dword [ebp - 0x28]
je 0x1001ddfd
mov dword [ebp - 0x6a8], 1
jmp 0x1001de04
and dword [ebp - 0x6a8], 0
cmp dword [ebp - 0x6a8], 0xb770
jne 0x1001de1c
mov dword [ebp - 0x558], 1
jmp 0x1001de23
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x558]
jne 0x1001de3d
mov dword [ebp - 0x884], 1
jmp 0x1001de44
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xb0c], eax
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x88], eax
jle 0x1001df84
mov dword [ebp - 0x988], 1
mov dword [ebp - 0x28], 0
jmp 0x1001de7c
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x23
jg 0x1001df7f
mov dword [ebp - 0x364], 0x2da
mov dword [ebp - 0x88c], 0xc51978e6
mov dword [ebp - 0x88], 0
jmp 0x1001deb3
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xfffffffc
jl 0x1001df7a
mov dword [ebp - 0x230], 0
jmp 0x1001ded9
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 1
jge 0x1001def5
mov eax, dword [ebp - 0x230]
mov dword [ebp + eax*4 - 0x954], 0x9843334a
jmp 0x1001decc
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x318]
mov dword [ebp - 0xc80], eax
cmp dword [ebp - 0x364], 1
jbe 0x1001df58
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0xb14], eax
mov eax, dword [ebp - 0x364]
cmp dword [ebp - 0x988], eax
jge 0x1001df37
mov dword [ebp - 0x7a8], 1
jmp 0x1001df3e
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x7a8]
cmp eax, dword [ebp - 0x88c]
jne 0x1001df58
and dword [ebp - 0x560], 0
jmp 0x1001df62
mov dword [ebp - 0x560], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x560]
mov dword [ebp + eax - 0x954], ecx
jmp 0x1001dea6
jmp 0x1001de75
jmp 0x1001e088
mov dword [ebp - 0x894], 0xffffffff
mov dword [ebp - 0xc1c], 0xfffffffb
mov dword [ebp - 0xb1c], 6
mov dword [ebp - 0xc30], 0xf1a0197c
mov dword [ebp - 0xb24], 4
mov dword [ebp - 0xc2c], 0xbfa08552
mov dword [ebp - 0xb2c], 0
mov dword [ebp - 0xc34], 0
mov dword [ebp - 0xb34], 4
mov dword [ebp - 0xc3c], 0
mov dword [ebp - 0x6b0], 0x5b04ce9d
mov dword [ebp - 0x28], 0
jmp 0x1001e002
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jg 0x1001e068
mov dword [ebp - 0xb3c], 0xffffffff
mov dword [ebp - 0xc38], 0xfffffffa
mov dword [ebp - 0xcc0], 0x7df2ddfd
mov dword [ebp - 0xcbc], 0x7df2ddfd
mov dword [ebp - 0xcb8], 0x7df2ddfd
mov dword [ebp - 0xcb4], 0x7df2ddfd
mov eax, dword [ebp - 0x6b0]
dec eax
mov dword [ebp - 0x6b0], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x318]
add eax, 0x12bfcc1e
mov dword [ebp - 0x894], eax
jmp 0x1001dffb
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x1001e088
push 0x254b
push 0
call fcn.1001b358
pop ecx
pop ecx
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x2e3]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x180]
movzx ecx, byte [ebp + ecx - 0x2e6]
movzx ecx, word [ebp + ecx*2 - 0xae8]
add eax, ecx
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ebp + ecx - 0x2e3]
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x180]
movzx edx, byte [ebp + edx - 0x2e6]
movzx edx, word [ebp + edx*2 - 0xae8]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ebp + ecx - 0x2e3]
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x180]
movzx edx, byte [ebp + edx - 0x2e6]
movzx edx, word [ebp + edx*2 - 0xae8]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ebp + ecx - 0x2e4]
mov word [ebp + ecx*2 - 0xae8], ax
mov dword [ebp - 0x270], 5
mov dword [ebp - 0x570], 1
xor eax, eax
inc eax
je 0x1001e1b1
cmp dword [ebp - 0x270], 0
jne 0x1001e149
cmp dword [ebp - 0x270], 0
jne 0x1001e149
and dword [ebp - 0x568], 0
jmp 0x1001e153
mov dword [ebp - 0x568], 1
mov eax, dword [ebp - 0x270]
cmp eax, dword [ebp - 0x568]
jg 0x1001e16d
mov dword [ebp - 0x758], 1
jmp 0x1001e174
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0x570], eax
mov eax, dword [ebp - 0x270]
add eax, dword [ebp - 0x570]
je 0x1001e1b1
mov byte [ebp - 0xd6], 0
movzx eax, byte [ebp - 0xd6]
test eax, eax
je 0x1001e1af
push 0
push 0x2654
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
jmp 0x1001e1ce
mov byte [ebp - 0x119], 0
push 0x3ca0
push 1
lea eax, [ebp - 0x119]
push eax
call fcn.1001adaf
add esp, 0xc
and dword [ebp - 0x180], 0
jmp 0x1001d4b8
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0xae8], cx
mov dword [ebp - 0xf8], 7
mov dword [ebp - 0x6c0], 0xd5943e2f
mov dword [ebp - 0x78], 0
jmp 0x1001e20e
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1001e224
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x598], 0xd386
jmp 0x1001e207
mov dword [ebp - 0x78], 0
jmp 0x1001e234
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1001e24a
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x768], 0x7c7128ab
jmp 0x1001e22d
push 0x1950
lea eax, [ebp - 0xf8]
push eax
push 0
call fcn.1001b1af
add esp, 0xc
mov dword [ebp - 0xf8], 0
jmp 0x1001e279
mov eax, dword [ebp - 0xf8]
dec eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jl 0x1001e463
mov dword [ebp - 0x238], 0x54bcd76c
mov dword [ebp - 0x7e8], 0xeab3cf81
cmp dword [ebp - 0x238], 0
je 0x1001e2b8
cmp dword [ebp - 0xf8], 0
je 0x1001e2b8
mov dword [ebp - 0x590], 1
jmp 0x1001e2bf
and dword [ebp - 0x590], 0
cmp dword [ebp - 0xf8], 0
je 0x1001e2d4
mov dword [ebp - 0x6b8], 1
jmp 0x1001e2db
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x238]
cmp eax, dword [ebp - 0x6b8]
jge 0x1001e2f5
mov dword [ebp - 0x578], 1
jmp 0x1001e2fc
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x578]
mov dword [ebp - 0x7e8], eax
mov eax, dword [ebp - 0x7e8]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x598]
jle 0x1001e32b
mov dword [ebp - 0x580], 1
jmp 0x1001e332
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x580]
mov dword [ebp - 0x6c0], eax
cmp dword [ebp - 0x6c0], 0
jne 0x1001e359
mov eax, 0x629c
test eax, eax
jne 0x1001e359
and dword [ebp - 0x588], 0
jmp 0x1001e363
mov dword [ebp - 0x588], 1
mov eax, dword [ebp - 0x238]
cmp dword [ebp - 0x588], eax
jl 0x1001e37d
mov dword [ebp - 0x760], 1
jmp 0x1001e384
and dword [ebp - 0x760], 0
imul eax, dword [ebp - 0x760], 0x61ec
cmp eax, 0xb7d6
je 0x1001e3a1
mov dword [ebp - 0x6c8], 1
jmp 0x1001e3a8
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x590]
cmp eax, dword [ebp - 0x6c8]
jne 0x1001e3c2
mov dword [ebp - 0x7b0], 1
jmp 0x1001e3c9
and dword [ebp - 0x7b0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x598]
cmp dword [ebp - 0x7b0], eax
jne 0x1001e3ea
mov dword [ebp - 0x5a0], 1
jmp 0x1001e3f1
and dword [ebp - 0x5a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x768]
cmp dword [ebp - 0x5a0], eax
jne 0x1001e416
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x1001e416
and dword [ebp - 0x6d0], 0
jmp 0x1001e420
mov dword [ebp - 0x6d0], 1
mov eax, dword [ebp - 0x238]
imul eax, dword [ebp - 0x6d0]
test eax, eax
jne 0x1001e441
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x1001e441
and dword [ebp - 0x5a8], 0
jmp 0x1001e44b
mov dword [ebp - 0x5a8], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5a8]
mov dword [ebp + eax - 0x768], ecx
jmp 0x1001e26c
lea eax, [ebp - 0xae8]
push eax
lea ecx, [ebp - 0xdb8]
call fcn.1002360b
mov dword [ebp - 0x98c], eax
mov eax, dword [ebp - 0x98c]
mov dword [ebp - 0x89c], eax
mov byte [ebp - 4], 2
push dword [ebp - 0x89c]
call fcn.10019b15
pop ecx
mov dword [ebp - 0x674], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xdb8]
call fcn.10015b29
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x160], 0x715c
mov dword [ebp - 0x960], 0xbf495e3b
mov dword [ebp - 0x404], 0xffffffff
mov dword [ebp - 0xb44], 1
mov dword [ebp - 0x99c], 0
mov dword [ebp - 0xc88], 0xffffffff
mov dword [ebp - 0x8b4], 1
mov dword [ebp - 0xa78], 0xfffffffc
mov dword [ebp - 0xa74], 0xfffffffc
mov dword [ebp - 0xa70], 0xfffffffc
mov dword [ebp - 0xa6c], 0xfffffffc
mov dword [ebp - 0x8bc], 0x91f13110
mov dword [ebp - 0x9a4], 0x3bd3a577
cmp dword [ebp - 0x160], 1
jge 0x1001e54d
mov dword [ebp - 0x5b0], 1
jmp 0x1001e554
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x5b0]
jge 0x1001e577
mov eax, 0xf74
test eax, eax
je 0x1001e577
mov dword [ebp - 0x6d8], 1
jmp 0x1001e57e
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x960]
cmp dword [ebp - 0x6d8], eax
jne 0x1001e59e
mov eax, 0x6718
test eax, eax
jne 0x1001e59e
and dword [ebp - 0x5b8], 0
jmp 0x1001e5a8
mov dword [ebp - 0x5b8], 1
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x160], 0xffffffe5
jmp 0x1001e5cd
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xfffffffd
jl 0x1001e9f5
mov dword [ebp - 0x3e4], 0x761ac7eb
mov dword [ebp - 0x3a4], 1
mov dword [ebp - 0xb4c], 0
mov dword [ebp - 0x3d4], 0x925b974d
mov dword [ebp - 0x320], 1
mov dword [ebp - 0xa68], 8
mov dword [ebp - 0xa64], 8
mov dword [ebp - 0xa60], 8
mov dword [ebp - 0xa5c], 8
mov dword [ebp - 0xa4], 0xf
jmp 0x1001e64d
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x1d
je 0x1001e9f0
mov dword [ebp - 0x7dc], 0x9f0dc4b6
mov dword [ebp - 0xabc], 0x253674f9
mov dword [ebp - 0xab8], 0x253674f9
mov dword [ebp - 0xab4], 0x253674f9
mov dword [ebp - 0xab0], 0x253674f9
mov dword [ebp - 0x96c], 0xe26e
mov dword [ebp - 0xc40], 2
mov dword [ebp - 0x34c], 0xffffffff
mov dword [ebp - 0x35c], 0xfffffffc
mov dword [ebp - 0x40c], 1
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x7dc], eax
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0x994], eax
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x8a4]
cmp eax, dword [ebp - 0x994]
jl 0x1001e709
mov dword [ebp - 0x5c0], 1
jmp 0x1001e710
and dword [ebp - 0x5c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa78]
cmp dword [ebp - 0x5c0], eax
jl 0x1001e731
mov dword [ebp - 0x6e0], 1
jmp 0x1001e738
and dword [ebp - 0x6e0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x6e0]
mov dword [ebp + eax - 0xabc], ecx
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa68]
inc eax
jne 0x1001e768
xor eax, eax
inc eax
jne 0x1001e768
and dword [ebp - 0x5c8], 0
jmp 0x1001e772
mov dword [ebp - 0x5c8], 1
cmp dword [ebp - 0x5c8], 0xfffffffe
jb 0x1001e787
mov dword [ebp - 0x770], 1
jmp 0x1001e78e
and dword [ebp - 0x770], 0
cmp dword [ebp - 0x770], 4
jne 0x1001e7a3
mov dword [ebp - 0x3a0], 1
jmp 0x1001e7aa
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x3a0]
neg eax
mov dword [ebp - 0x3a4], eax
mov eax, dword [ebp - 0x320]
cmp dword [ebp - 0x3a4], eax
jge 0x1001e7d2
mov dword [ebp - 0x3ac], 1
jmp 0x1001e7d9
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x320]
cmp dword [ebp - 0x3ac], eax
jg 0x1001e7f3
mov dword [ebp - 0x3b4], 1
jmp 0x1001e7fa
and dword [ebp - 0x3b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa68]
add eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x3d4], 0x4b5bc68
jle 0x1001e82b
mov dword [ebp - 0x8ac], 1
jmp 0x1001e832
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0xb54], eax
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x35c], eax
jle 0x1001e858
mov dword [ebp - 0x3bc], 1
jmp 0x1001e85f
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x96c]
cmp dword [ebp - 0x3bc], eax
jne 0x1001e879
mov dword [ebp - 0x3c4], 1
jmp 0x1001e880
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x8b4]
cmp dword [ebp - 0x3c4], eax
jge 0x1001e89a
mov dword [ebp - 0x3cc], 1
jmp 0x1001e8a1
and dword [ebp - 0x3cc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3cc]
sub ecx, dword [ebp + eax - 0xa78]
cmp ecx, dword [ebp - 0x3d4]
jl 0x1001e8c8
mov dword [ebp - 0x3dc], 1
jmp 0x1001e8cf
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x99c]
cmp dword [ebp - 0x3dc], eax
jle 0x1001e8e9
mov dword [ebp - 0x3ec], 1
jmp 0x1001e8f0
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x3e4]
cmp eax, dword [ebp - 0x3ec]
jne 0x1001e90a
mov dword [ebp - 0x3f4], 1
jmp 0x1001e911
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x404]
add eax, dword [ebp - 0x3f4]
cmp eax, 0x15809f11
jl 0x1001e930
mov dword [ebp - 0x3fc], 1
jmp 0x1001e937
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x8bc]
add eax, dword [ebp - 0x3fc]
je 0x1001e97c
mov dword [ebp - 0x974], 1
lea eax, [ebp - 0x320]
push eax
push 1
lea eax, [ebp - 0x974]
push eax
push 0x1120
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.1001adf8
add esp, 0x18
jmp 0x1001e9de
mov dword [ebp - 0x290], 0
jmp 0x1001e995
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 1
jge 0x1001e9b1
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0x8c4], 0xffffffff
jmp 0x1001e988
mov byte [ebp - 0xd4], 0
movzx eax, byte [ebp - 0xd4]
test eax, eax
je 0x1001e9cb
push 1
call fcn.1001aead
pop ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c4]
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0x40c]
dec eax
mov dword [ebp - 0x40c], eax
jmp 0x1001e640
jmp 0x1001e5c0
and dword [ebp - 0x278], 0
jmp 0x1001ea0b
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xd
jae 0x1001ee23
mov dword [ebp - 0x50], 0xac204e2
mov dword [ebp - 0x984], 0x85e3970c
mov dword [ebp - 0xcb0], 1
mov dword [ebp - 0x240], 0
jmp 0x1001ea4c
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 3
jge 0x1001ea68
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0xd88], 0xfffe
jmp 0x1001ea3f
mov dword [ebp - 0x50], 0xfffffff9
jmp 0x1001ea78
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xf
jne 0x1001edc2
mov dword [ebp - 0x8cc], 0xfb1a
mov dword [ebp - 0x8d4], 0xfffffffc
mov dword [ebp - 0x9ac], 0xcbf7935d
mov dword [ebp - 0x98], 0
jmp 0x1001eab9
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x1001ead5
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x328], 0xffffffff
jmp 0x1001eaac
mov dword [ebp - 0x98], 0
jmp 0x1001eaee
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x1001eb0a
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x100], 0
jmp 0x1001eae1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x100], 0
jmp 0x1001eb38
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x100]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x100], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x100], 0
jg 0x1001edbd
mov dword [ebp - 0x16c], 0xffffffff
mov dword [ebp - 0x16c], 0
jmp 0x1001eb6f
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
jg 0x1001edb8
mov dword [ebp - 0xb5c], 0xfffffffe
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x328], 0x9105fa2e
ja 0x1001eba5
mov dword [ebp - 0x41c], 1
jmp 0x1001ebac
and dword [ebp - 0x41c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x328]
mov dword [ebp - 0xc48], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x328]
cmp dword [ebp - 0x50], eax
jg 0x1001ebdd
mov dword [ebp - 0x414], 1
jmp 0x1001ebe4
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x414]
add eax, 4
mov ecx, dword [ebp - 0x41c]
sub ecx, eax
add ecx, dword [ebp - 0x8cc]
cmp ecx, 0x6de6
je 0x1001ec0f
mov dword [ebp - 0x97c], 1
jmp 0x1001ec16
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x50]
sub eax, 0xf3cf
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x100]
je 0x1001ec39
mov dword [ebp - 0x424], 1
jmp 0x1001ec40
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x8d4]
add eax, dword [ebp - 0x424]
je 0x1001ec63
cmp dword [ebp - 0x16c], 0
je 0x1001ec63
mov dword [ebp - 0x394], 1
jmp 0x1001ec6a
and dword [ebp - 0x394], 0
cmp dword [ebp - 0x394], 0xffff
jbe 0x1001ec82
mov dword [ebp - 0x434], 1
jmp 0x1001ec89
and dword [ebp - 0x434], 0
cmp dword [ebp - 0x434], 0x94d0e834
jne 0x1001eca1
mov dword [ebp - 0x43c], 1
jmp 0x1001eca8
and dword [ebp - 0x43c], 0
cmp dword [ebp - 0x43c], 1
jne 0x1001ecbd
mov dword [ebp - 0x444], 1
jmp 0x1001ecc4
and dword [ebp - 0x444], 0
cmp dword [ebp - 0x444], 0xb69c
je 0x1001ecdc
mov dword [ebp - 0x44c], 1
jmp 0x1001ece3
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x9ac]
cmp dword [ebp - 0x44c], eax
jge 0x1001ecfd
mov dword [ebp - 0x454], 1
jmp 0x1001ed04
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x454]
sub eax, 0x5d932117
cmp eax, 0x90aec51a
jne 0x1001ed38
mov byte [ebp - 0x129], 0
movzx eax, byte [ebp - 0x129]
test eax, eax
je 0x1001ed36
push 0x47b7
push 1
call fcn.1001aee9
pop ecx
pop ecx
jmp 0x1001ed8d
mov dword [ebp - 0x8dc], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x100]
mov dword [ebp - 0xb64], eax
cmp dword [ebp - 0x8dc], 0
jne 0x1001ed77
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x100], 0
jne 0x1001ed77
and dword [ebp - 0x45c], 0
jmp 0x1001ed81
mov dword [ebp - 0x45c], 1
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x984], eax
mov byte [ebp - 0x121], 0
movzx eax, byte [ebp - 0x121]
test eax, eax
je 0x1001edb3
push 0x4965
push 0x4a82
push 0
call fcn.1001affb
add esp, 0xc
jmp 0x1001eb62
jmp 0x1001eb1d
jmp 0x1001ea71
mov dword [ebp - 0x50], 0
jmp 0x1001edd2
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jg 0x1001ee0e
push 0x72e6
push 1
call fcn.1001af22
pop ecx
pop ecx
mov byte [ebp - 0xd8], 0
movzx eax, byte [ebp - 0xd8]
test eax, eax
je 0x1001ee0c
push 1
push 0x5763
push 0x701d
call fcn.1001af99
add esp, 0xc
jmp 0x1001edcb
xor eax, eax
mov ecx, dword [ebp - 0x278]
mov word [ebp + ecx*2 - 0xae8], ax
jmp 0x1001e9fe
mov dword [ebp - 0x9b4], 0x8acc4b7c
mov dword [ebp - 0x248], 0
jmp 0x1001ee46
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 3
jge 0x1001ee62
mov eax, dword [ebp - 0x248]
mov dword [ebp + eax*4 - 0x390], 0x7ddc85f7
jmp 0x1001ee39
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x390], 0
jmp 0x1001ee8d
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x390]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x390], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x390], 0xfffffff4
jge 0x1001ef76
mov dword [ebp - 0x8e4], 1
mov dword [ebp - 0x46c], 0xc58bdfad
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x390], 0xfffffffd
jl 0x1001eecf
mov dword [ebp - 0x464], 1
jmp 0x1001eed6
and dword [ebp - 0x464], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x390]
cmp eax, dword [ebp - 0x464]
jne 0x1001ef13
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x390]
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0x390]
mov dword [ebp - 0x46c], eax
jne 0x1001ef13
and dword [ebp - 0x474], 0
jmp 0x1001ef1d
mov dword [ebp - 0x474], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x390]
cmp dword [ebp - 0x474], eax
jl 0x1001ef3d
mov dword [ebp - 0x47c], 1
jmp 0x1001ef44
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x8e4]
cmp eax, dword [ebp - 0x47c]
jle 0x1001ef5e
mov dword [ebp - 0x484], 1
jmp 0x1001ef65
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x9b4], eax
jmp 0x1001ee74
cmp dword [ebp - 0x674], 0
je 0x10020a15
mov dword [ebp - 0x3c], 0x6a48
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x144], 0xcc1dab97
mov dword [ebp - 0x108], 0xbdb88dcf
mov dword [ebp - 0x4bc], 6
mov dword [ebp - 0xc90], 0xfffffff8
mov dword [ebp - 0x60], 0
jmp 0x1001efc9
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1001efdf
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x968], 0x12ef314d
jmp 0x1001efc2
mov dword [ebp - 0x60], 0
jmp 0x1001efef
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1001f005
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x814], 2
jmp 0x1001efe8
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xb6c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x3c], eax
jge 0x1001f02b
mov dword [ebp - 0x48c], 1
jmp 0x1001f032
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x48c]
sub eax, 3
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
add eax, 0xfffd
cmp dword [ebp - 0x144], eax
jge 0x1001f069
mov dword [ebp - 0x494], 1
jmp 0x1001f070
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x494], eax
jge 0x1001f087
mov dword [ebp - 0x8ec], 1
jmp 0x1001f08e
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xb78], eax
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x3c]
cmp eax, 1
jbe 0x1001f0af
mov dword [ebp - 0x49c], 1
jmp 0x1001f0b6
and dword [ebp - 0x49c], 0
cmp dword [ebp - 0x49c], 0x1f7b4007
jl 0x1001f0ce
mov dword [ebp - 0x4a4], 1
jmp 0x1001f0d5
and dword [ebp - 0x4a4], 0
cmp dword [ebp - 0x4a4], 0xffff
jne 0x1001f0ed
mov dword [ebp - 0x9bc], 1
jmp 0x1001f0f4
and dword [ebp - 0x9bc], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xbb0], eax
cmp dword [ebp - 0x3c], 0xe2c2377
jle 0x1001f112
mov dword [ebp - 0x4ac], 1
jmp 0x1001f119
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x4ac], eax
jle 0x1001f130
mov dword [ebp - 0x358], 1
jmp 0x1001f137
and dword [ebp - 0x358], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x358]
mov dword [ebp + eax - 0x968], ecx
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x358], eax
jne 0x1001f161
mov dword [ebp - 0x4b4], 1
jmp 0x1001f168
and dword [ebp - 0x4b4], 0
cmp dword [ebp - 0x4b4], 0xfffffff9
jae 0x1001f17d
mov dword [ebp - 0x330], 1
jmp 0x1001f184
and dword [ebp - 0x330], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x330]
mov dword [ebp + eax - 0x814], ecx
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x4bc], eax
mov eax, dword [ebp - 0x4bc]
cmp dword [ebp - 0x3c], eax
je 0x1001f1ba
mov dword [ebp - 0x4c4], 1
jmp 0x1001f1c1
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x4c4]
imul eax, dword [ebp - 0x3c]
sub eax, 0xe5ab
je 0x1001f1f7
mov byte [ebp - 0x12b], 0
push 0xf7
push 0
lea eax, [ebp - 0x12b]
push eax
call fcn.1002188d
add esp, 0xc
jmp 0x1001f466
mov dword [ebp - 0x4e4], 0xbaaeea3a
mov dword [ebp - 0x29c], 0
jmp 0x1001f21a
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 1
jge 0x1001f236
mov eax, dword [ebp - 0x29c]
mov dword [ebp + eax*4 - 0x8f4], 1
jmp 0x1001f20d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x8f4], 0xa0b8914b
mov dword [ebp - 0x144], 0
jmp 0x1001f260
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xfffffff5
jle 0x1001f466
mov dword [ebp - 0x9c0], 9
mov dword [ebp - 0x108], 1
jmp 0x1001f290
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jl 0x1001f461
mov dword [ebp - 0x1c0], 0x2e49d2a5
mov dword [ebp - 0x250], 0
jmp 0x1001f2c0
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 1
jge 0x1001f2dc
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0x4f4], 0x43af
jmp 0x1001f2b3
mov dword [ebp - 0x34], 0
jmp 0x1001f2ec
cmp dword [ebp - 0x34], 1
jg 0x1001f45c
mov dword [ebp - 0x8fc], 0xfff6
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3c]
cmp dword [ebp + eax - 0x4f4], ecx
je 0x1001f31e
mov dword [ebp - 0x4cc], 1
jmp 0x1001f325
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0x4cc], eax
jl 0x1001f33f
mov dword [ebp - 0x990], 1
jmp 0x1001f346
and dword [ebp - 0x990], 0
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0x8fc]
mov dword [ebp - 0xbb8], eax
xor eax, eax
jne 0x1001f36e
mov dword [ebp - 0x4d4], 1
jmp 0x1001f375
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp + eax*4 - 0x814]
cmp eax, dword [ebp - 0x4d4]
jge 0x1001f396
mov dword [ebp - 0x4dc], 1
jmp 0x1001f39d
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x1c0]
imul eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x4e4], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x814]
dec eax
jne 0x1001f3ea
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x968]
xor ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x9c0]
mov edx, dword [ebp - 0x34]
add ecx, dword [ebp + edx*4 - 0x814]
add eax, ecx
jne 0x1001f3ea
and dword [ebp - 0x4ec], 0
jmp 0x1001f3f4
mov dword [ebp - 0x4ec], 1
mov eax, dword [ebp - 0x4e4]
cmp dword [ebp - 0x4ec], eax
jl 0x1001f40e
mov dword [ebp - 0x4fc], 1
jmp 0x1001f415
and dword [ebp - 0x4fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4f4]
imul eax, dword [ebp - 0x4fc]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x968]
jge 0x1001f444
jmp 0x1001f283
jmp 0x1001f253
mov byte [ebp - 0x1bc], 2
mov byte [ebp - 0x1bb], 0x25
mov byte [ebp - 0x1ba], 8
mov byte [ebp - 0x1b9], 0
mov byte [ebp - 0x1b8], 5
mov byte [ebp - 0x1b7], 8
mov byte [ebp - 0x1b6], 4
mov byte [ebp - 0x1b5], 0xa1
mov byte [ebp - 0x1b4], 0xcc
mov byte [ebp - 0x1b3], 0xd1
mov byte [ebp - 0x1b2], 0x71
mov byte [ebp - 0x1b1], 0xb
mov byte [ebp - 0x1b0], 0x3e
mov byte [ebp - 0x1af], 0
mov byte [ebp - 0x1ae], 0x1b
mov byte [ebp - 0x1ad], 6
mov byte [ebp - 0x1ac], 0x2e
mov byte [ebp - 0x1ab], 9
mov byte [ebp - 0x1aa], 0x10
mov byte [ebp - 0x1a9], 4
mov byte [ebp - 0x1a8], 0x3e
mov byte [ebp - 0x1a7], 3
mov byte [ebp - 0x1a6], 0x28
mov byte [ebp - 0x1a5], 0xa
mov byte [ebp - 0x1a4], 0x1d
mov byte [ebp - 0x1a3], 1
mov byte [ebp - 0x1a2], 0x16
mov byte [ebp - 0x1a1], 7
mov byte [ebp - 0x1a0], 0x1d
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1bc]
or eax, 0x44
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1bc]
and ecx, 0x44
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x1bc]
mov byte [ebp + ecx - 0x824], al
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x174], 1
mov eax, 0xd8e6
sub eax, dword [ebp - 0x64]
sub eax, dword [ebp - 0x64]
sub eax, dword [ebp - 0x64]
cmp eax, 0x9d
jne 0x1001f5aa
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0x64]
push eax
push 1
call fcn.1001affb
add esp, 0xc
jmp 0x1001f657
mov dword [ebp - 0x174], 0xfffffffd
jmp 0x1001f5c3
mov eax, dword [ebp - 0x174]
dec eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0xfffffff9
jle 0x1001f657
mov dword [ebp - 0x258], 0
jmp 0x1001f5e9
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 2
jge 0x1001f605
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0xb8c], 0xe033c225
jmp 0x1001f5dc
mov byte [ebp - 0xda], 0
push 0x4408
lea eax, [ebp - 0xda]
push eax
push 0xe0a
push 0
push 0x7dc4
call fcn.100231d6
add esp, 0x14
mov dword [ebp - 0x64], 0
jmp 0x1001f63c
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x1001f652
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xb8c], 6
jmp 0x1001f635
jmp 0x1001f5b6
mov dword [ebp - 0x2c], 2
and dword [ebp - 0x234], 0
jmp 0x1001f66f
cmp dword [ebp - 0x2c], 0x1d
jae 0x1001fcc8
mov dword [ebp - 0x6c], 0
jmp 0x1001f689
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1001f69f
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x360], 0x5b57fd54
jmp 0x1001f682
mov dword [ebp - 0x6c], 0
jmp 0x1001f6af
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1001f6c5
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x298], 2
jmp 0x1001f6a8
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x298], 0
jmp 0x1001f6f3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x298], 0
jl 0x1001f8ad
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x74], 0
jmp 0x1001f71e
cmp dword [ebp - 0x74], 1
jge 0x1001f734
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1bc]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x2c], eax
jne 0x1001fb2a
mov dword [ebp - 0x224], 0x860b4ffb
mov dword [ebp - 0x21c], 0
jmp 0x1001f8eb
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x7c], 0
jmp 0x1001fb44
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x824], 0
mov dword [ebp - 0x38], 0x13638ecf
mov dword [ebp - 0x1d4], 0x409884cb
mov dword [ebp - 0x40], 0xe9934b0b
mov dword [ebp - 0x110], 9
mov dword [ebp - 0x1cc], 0x8f985589
mov dword [ebp - 0x140], 0x1c587c7a
mov dword [ebp - 0x5c], 0
jmp 0x1001fd1c
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x1001fd32
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x354], 0x342eb90d
jmp 0x1001fd15
mov dword [ebp - 0x5c], 0
jmp 0x1001fd42
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x1001fd58
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x80c], 0xf18c
jmp 0x1001fd3b
mov dword [ebp - 0x38], 1
jmp 0x1001fd68
cmp dword [ebp - 0x38], 0
jl 0x1001ff1c
mov dword [ebp - 0x53c], 1
mov dword [ebp - 0x91c], 0
mov dword [ebp - 0x9a0], 0
mov dword [ebp - 0xb9c], 0x8f928d9b
mov dword [ebp - 0x1c4], 0
jmp 0x1001fdb3
cmp dword [ebp - 0x1c4], 2
jge 0x1001fdcf
mov dword [ebp - 0x40], 1
jmp 0x1001ff2c
cmp dword [ebp - 0x40], 0
jl 0x100201b8
mov dword [ebp - 0xa0], 0xffffffff
mov dword [ebp - 0x30c], 0xffffffff
mov dword [ebp - 0x314], 0xf6128b29
mov dword [ebp - 0x94], 0
jmp 0x10020a4c
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 4
jge 0x10020a68
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x800], 1
jmp 0x10020a3f
mov dword [ebp - 0x94], 0
jmp 0x10020a81
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 4
jge 0x10020a9d
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x2fc], 9
jmp 0x10020a74
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2fc], 3
jmp 0x10020ac8
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2fc]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2fc], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2fc], 0
jl 0x10020e71
mov dword [ebp - 0xc4], 0xa82e77e8
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2fc]
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x2fc]
cmp dword [ebp + eax*4 - 0x800], ecx
jge 0x10020bf6
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2fc], 0xffffffff
je 0x10020b26
mov dword [ebp - 0x67c], 1
jmp 0x10020b2d
and dword [ebp - 0x67c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2fc]
mov eax, dword [ebp + eax*4 - 0x800]
cmp eax, dword [ebp - 0x67c]
jg 0x10020b54
mov dword [ebp - 0x684], 1
jmp 0x10020b5b
and dword [ebp - 0x684], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2fc]
mov ecx, dword [ebp - 0x684]
sub ecx, dword [ebp - 0xa0]
cmp dword [ebp + eax*4 - 0x800], ecx
jle 0x10020b88
mov dword [ebp - 0x68c], 1
jmp 0x10020b8f
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x68c]
sub eax, 6
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x2fc]
cmp eax, dword [ebp + ecx*4 - 0x800]
jg 0x10020bcb
cmp dword [ebp - 0xa0], 0
je 0x10020bcb
cmp dword [ebp - 0xa0], 0
je 0x10020bcb
mov dword [ebp - 0x694], 1
jmp 0x10020bd2
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xffff
jb 0x10020bf6
mov dword [ebp - 0x69c], 1
jmp 0x10020bfd
and dword [ebp - 0x69c], 0
cmp dword [ebp - 0x69c], 0x1e70
jne 0x10020c15
mov dword [ebp - 0x6a4], 1
jmp 0x10020c1c
and dword [ebp - 0x6a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x800]
cmp dword [ebp - 0x6a4], eax
je 0x10020c3d
mov dword [ebp - 0x880], 1
jmp 0x10020c44
and dword [ebp - 0x880], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2fc]
mov dword [ebp - 0xbdc], eax
cmp dword [ebp - 0xa0], 0
je 0x10020c82
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x800], 0
je 0x10020c82
mov eax, 0x886255d5
test eax, eax
je 0x10020c82
push 1
call fcn.1001b28f
pop ecx
jmp 0x10020c8d
push 1
push 0x1b
call fcn.1001b2c6
pop ecx
pop ecx
cmp dword [ebp - 0xc4], 0
jne 0x10020ca8
cmp dword [ebp - 0xc4], 0
jne 0x10020ca8
and dword [ebp - 0x6c4], 0
jmp 0x10020cb2
mov dword [ebp - 0x6c4], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2fc]
cmp dword [ebp + eax*4 - 0x800], 1
je 0x10020cd4
mov dword [ebp - 0x6ac], 1
jmp 0x10020cdb
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x6ac]
jle 0x10020d01
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2fc], 0
jne 0x10020d01
and dword [ebp - 0x888], 0
jmp 0x10020d0b
mov dword [ebp - 0x888], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x800]
mov dword [ebp - 0xc68], eax
mov dword [ebp - 0x30c], 0x2cf3e4c9
cmp dword [ebp - 0x30c], 0
jne 0x10020d43
cmp dword [ebp - 0xa0], 0
jne 0x10020d43
and dword [ebp - 0x6b4], 0
jmp 0x10020d4d
mov dword [ebp - 0x6b4], 1
imul eax, dword [ebp - 0x6b4], 0xb2b
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0x2fc]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0x2a5b4d63
jl 0x10020d81
mov dword [ebp - 0x6bc], 1
jmp 0x10020d88
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0xc4]
add eax, dword [ebp - 0x6bc]
cmp dword [ebp - 0x6c4], eax
jl 0x10020e5c
mov dword [ebp - 0x890], 1
cmp dword [ebp - 0x890], 0
jne 0x10020ddc
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x800]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x314]
cmp dword [ebp - 0xc4], eax
jne 0x10020ddc
and dword [ebp - 0x898], 0
jmp 0x10020de6
mov dword [ebp - 0x898], 1
cmp dword [ebp - 0x30c], 0xfc5c
jle 0x10020dfe
mov dword [ebp - 0x6cc], 1
jmp 0x10020e05
and dword [ebp - 0x6cc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2fc]
mov eax, dword [ebp + eax*4 - 0x800]
cmp dword [ebp - 0x6cc], eax
jle 0x10020e2c
mov dword [ebp - 0x8a0], 1
jmp 0x10020e33
and dword [ebp - 0x8a0], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2fc]
mov dword [ebp - 0xbe4], eax
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0xc4], eax
push 1
call fcn.1001b31c
pop ecx
jmp 0x10020e6c
lea eax, [ebp - 0xa0]
push eax
push 1
call fcn.1001b358
pop ecx
pop ecx
jmp 0x10020aaf
mov byte [ebp - 0xc7], 0
movzx eax, byte [ebp - 0xc7]
test eax, eax
je 0x10020e9c
push 0x4025
push 0
push 0x4066
push 0x663e
call fcn.10021839
add esp, 0x10
cmp dword [0x10675d80], 0
je 0x10020eba
mov ecx, dword [ebp + 8]
call fcn.10023630
push eax
call dword [0x10675d80]
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x714], 0
mov dword [ebp - 0x150], 0x70c3099c
mov dword [ebp - 0x8a8], 0xfd9d0890
mov dword [ebp - 0x8b8], 0xffffffff
mov dword [ebp - 0x8c0], 0x9b69
mov dword [ebp - 0xca0], 0xdad816f9
mov dword [ebp - 0x6fc], 0
mov dword [ebp - 0xa48], 1
mov dword [ebp - 0xa44], 1
mov dword [ebp - 0xa40], 1
mov dword [ebp - 0xa3c], 1
mov dword [ebp - 0x8d0], 1
mov dword [ebp - 0x8d8], 1
mov dword [ebp - 0x9c], 0
jmp 0x10020f55
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x10020f71
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0xa84], 0x3718bd85
jmp 0x10020f48
mov dword [ebp - 0x9c], 0
jmp 0x10020f8a
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x10020fa6
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0xa28], 0
jmp 0x10020f7d
push 1
push 0x71ac
lea eax, [ebp - 0x714]
push eax
lea eax, [ebp - 0x150]
push eax
call fcn.1001b388
add esp, 0x10
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa28]
sub eax, 0x30b6
cmp eax, dword [ebp - 0x150]
jg 0x10020fe8
mov dword [ebp - 0x6d4], 1
jmp 0x10020fef
and dword [ebp - 0x6d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa28]
cmp dword [ebp - 0x6d4], eax
jle 0x10021010
mov dword [ebp - 0x6e4], 1
jmp 0x10021017
and dword [ebp - 0x6e4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa84]
mov dword [ebp - 0x6dc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6dc]
mov dword [ebp + eax - 0xa84], ecx
mov eax, dword [ebp - 0x6dc]
cmp eax, dword [ebp - 0x6e4]
jle 0x10021057
mov dword [ebp - 0x6ec], 1
jmp 0x1002105e
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x8a8]
cmp dword [ebp - 0x6ec], eax
jne 0x10021078
mov dword [ebp - 0x8b0], 1
jmp 0x1002107f
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0xbec], eax
mov eax, dword [ebp - 0x8c0]
add eax, dword [ebp - 0x150]
cmp eax, 0x8491f199
ja 0x100210aa
mov dword [ebp - 0x704], 1
jmp 0x100210b1
and dword [ebp - 0x704], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa48]
dec eax
mov dword [ebp - 0x6f4], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x6f4]
mov dword [ebp + eax - 0xa48], ecx
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x6fc], eax
mov eax, dword [ebp - 0x6fc]
imul eax, dword [ebp - 0x704]
sub eax, dword [ebp - 0x150]
cmp dword [ebp - 0x150], eax
jl 0x10021109
mov dword [ebp - 0x70c], 1
jmp 0x10021110
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x70c]
shl eax, 3
cmp dword [ebp - 0x714], eax
jl 0x1002112d
mov dword [ebp - 0x71c], 1
jmp 0x10021134
and dword [ebp - 0x71c], 0
cmp dword [ebp - 0x71c], 0xc769867f
je 0x1002114c
mov dword [ebp - 0x8c8], 1
jmp 0x10021153
and dword [ebp - 0x8c8], 0
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0xc70], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa28]
mov dword [ebp - 0xbf4], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa28]
cmp dword [ebp - 0x8d0], eax
je 0x10021189
xor eax, eax
je 0x100211a5
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa84], 0
je 0x100211a5
mov dword [ebp - 0x724], 1
jmp 0x100211ac
and dword [ebp - 0x724], 0
imul eax, dword [ebp - 0x724], 0xf455
mov dword [ebp - 0x8d8], eax
cmp dword [ebp - 0x158], 0
je 0x10021706
movzx eax, byte [0x10675d86]
test eax, eax
je 0x100211e9
mov ecx, 0x10675e44
call fcn.100236b9
movzx eax, al
test eax, eax
jne 0x10021706
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x194], 0xfff7
mov dword [ebp - 0xce0], 0xffffffff
mov dword [ebp - 0x20], 0
jmp 0x10021214
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1002122a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x9fc], 0xfffffffb
jmp 0x1002120d
mov dword [ebp - 0x20], 0
jmp 0x1002123a
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x10021250
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xcf8], 0xbc4aee50
jmp 0x10021233
mov dword [ebp - 0x20], 0
jmp 0x10021260
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10021276
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc28], 7
jmp 0x10021259
mov dword [ebp - 0x30], 0
jmp 0x10021286
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jg 0x100215ad
mov dword [ebp - 0x1fc], 0xffffffff
mov dword [ebp - 0xbfc], 0x35240ca7
mov dword [ebp - 0x72c], 0xb7b2415f
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x100212cc
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov dword [ebp - 0x1fc], 3
jmp 0x100212e5
mov eax, dword [ebp - 0x1fc]
dec eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0
jl 0x100215a8
mov dword [ebp - 0x8f0], 0x28f0
mov dword [ebp - 0x204], 0
jmp 0x10021315
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 1
jge 0x10021331
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0x744], 0xfda0246c
jmp 0x10021308
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x9fc]
mov dword [ebp - 0xc78], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x9fc], 0x59eeda5b
je 0x1002135d
mov dword [ebp - 0x8e0], 1
jmp 0x10021364
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x9fc]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xaf8], eax
mov dword [ebp - 0x194], 0xa5dec4f
mov dword [ebp - 0x194], 0
jmp 0x100213a0
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 3
jg 0x100215a3
mov dword [ebp - 0x19c], 0xd5fe
mov dword [ebp - 0x324], 0x612d29ed
mov dword [ebp - 0xb00], 0xc4e7ccce
mov dword [ebp - 0x31c], 0xffff
push 1
lea eax, [ebp - 0x19c]
push eax
call fcn.1001b3f6
pop ecx
pop ecx
mov dword [ebp - 0x19c], 0
jmp 0x100213fe
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 3
jg 0x1002159e
mov dword [ebp - 0x32c], 0xda301817
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x9fc]
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp - 0x31c]
dec eax
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0xb10], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xc28], 0x1cd25bb5
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0xb18], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xcf8], 0
je 0x100214f3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x744], 0
jne 0x100214de
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x9fc]
shl eax, 1
mov dword [ebp - 0x8e8], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x8e8]
mov dword [ebp + eax*4 - 0x9fc], ecx
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0xb20], eax
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0xb28], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc28], 0
je 0x100214f3
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x9fc], 0
je 0x100214f3
mov eax, 0xd88b
test eax, eax
je 0x100214f3
mov dword [ebp - 0x734], 1
jmp 0x100214fa
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x72c]
cmp eax, dword [ebp - 0x734]
jle 0x10021514
mov dword [ebp - 0x73c], 1
jmp 0x1002151b
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x73c]
sub eax, dword [ebp - 0x32c]
mov dword [ebp - 0x74c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x74c]
mov dword [ebp + eax - 0x744], ecx
cmp dword [ebp - 0x74c], 0
je 0x1002155e
cmp dword [ebp - 0x32c], 0
je 0x1002155e
mov dword [ebp - 0x754], 1
jmp 0x10021565
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x8f0]
cmp dword [ebp - 0x754], eax
jl 0x1002157f
mov dword [ebp - 0x75c], 1
jmp 0x10021586
and dword [ebp - 0x75c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x75c]
mov dword [ebp + eax - 0xcf8], ecx
jmp 0x100213f1
jmp 0x10021393
jmp 0x100212d8
jmp 0x1002127f
lea eax, [ebp - 0x764]
push eax
mov ecx, 0x10675e44
call fcn.1002367b
mov ecx, dword [ebp - 0x158]
mov dword [eax], ecx
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x120], 0xc3099cfe
mov dword [ebp - 0x77c], 0xcf79
mov dword [ebp - 0x774], 7
mov dword [ebp - 0x908], 0x3bd5de1f
mov byte [ebp - 0xcb], 0
movzx eax, byte [ebp - 0xcb]
test eax, eax
je 0x10021618
push 0xabd
push 1
call fcn.1001b42a
pop ecx
pop ecx
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x100216d0
mov eax, dword [ebp - 0x20c]
cmp dword [ebp - 0x120], eax
jne 0x1002164b
mov dword [ebp - 0x76c], 1
jmp 0x10021652
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x20c]
cmp eax, dword [ebp - 0x76c]
jle 0x1002166c
mov dword [ebp - 0x8f8], 1
jmp 0x10021673
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x120], eax
je 0x1002168d
mov dword [ebp - 0x900], 1
jmp 0x10021694
and dword [ebp - 0x900], 0
imul eax, dword [ebp - 0x77c], 0
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x774], eax
mov eax, dword [ebp - 0x20c]
cmp dword [ebp - 0x774], eax
je 0x100216c4
cmp dword [ebp - 0x77c], 0
je 0x100216d0
mov dword [ebp - 0x784], 1
jmp 0x100216d7
and dword [ebp - 0x784], 0
cmp dword [ebp - 0x784], 7
jb 0x100216ec
mov dword [ebp - 0x398], 1
jmp 0x100216f3
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x908], eax
mov byte [0x10675d86], 1
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x80], 0
jmp 0x10021720
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
jge 0x10021736
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xd44], 0xe48d327c
jmp 0x10021719
mov dword [ebp - 0x80], 0
jmp 0x10021746
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
jge 0x1002175c
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xa38], 0xdb505206
jmp 0x1002173f
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xa38], 0
jmp 0x1002178a
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa38]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xa38], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa38], 4
jge 0x100217b4
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa38]
mov dword [ebp + eax*4 - 0xd44], 0
jmp 0x1002176f
mov dword [ebp - 0x214], 0xfffffff8
jmp 0x100217cd
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xfffffffa
jne 0x1002180a
mov dword [ebp - 0x910], 0x3707
cmp dword [ebp - 0x910], 0
je 0x100217eb
jmp 0x1002180a
mov byte [ebp - 0xcd], 0
push 1
lea eax, [ebp - 0xcd]
push eax
push 0x40ba
call fcn.1001b480
add esp, 0xc
jmp 0x100217c0
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x918], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa9c]
call fcn.10015b29
mov eax, dword [ebp - 0x918]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret