Function at 0x1003805d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a421
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x164ac
call fcn.10064bd0
push esi
push edi
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100380b1
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xd34], eax
push dword [ebp - 0xd34]
push 1
push 0x268b
push 0x1c08
call fcn.100419be
add esp, 0x10
jmp 0x100419ae
lea eax, [ebp + 0x18]
mov dword [ebp - 0xb9c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xbcc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc64], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xbd4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0xb9c]
movzx eax, byte [eax]
test eax, eax
je 0x1003816b
mov eax, dword [ebp - 0xba4]
mov dword [ebp - 0xbb4], eax
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xbbc], eax
mov eax, dword [ebp - 0xbb4]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0xbbc]
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 0x1f8]
mov dword [eax], 0
jmp 0x10038143
mov eax, dword [ebp - 0x1f8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1f8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1f8]
cmp dword [eax], 2
jge 0x10038166
mov eax, dword [ebp - 0x1f8]
push dword [eax]
mov ecx, dword [ebp - 0xbc4]
call fcn.1000f296
and dword [eax], 0
jmp 0x10038132
jmp 0x100419ae
mov eax, dword [ebp - 0xbcc]
mov dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0xbd4]
mov dword [ebp - 0xb44], eax
mov eax, dword [ebp - 0xc64]
mov dword [ebp - 0x264], eax
push 2
lea ecx, [ebp - 0x1094]
call fcn.1000f19e
and dword [ebp - 4], 0
mov dword [ebp - 0x33c], 0xffffffff
mov dword [ebp - 0xc6c], 0x1621
cmp dword [ebp - 0xc6c], 0x1110
jge 0x100381f2
lea eax, [ebp - 0xc74]
push eax
push 0x1000785c
call fcn.1004fe8b
pop ecx
pop ecx
mov eax, dword [ebp - 0xc74]
and eax, 0x80000001
jns 0x100381e5
dec eax
or eax, 0xfffffffe
inc eax
push eax
push 0x10007888
call fcn.1005018c
pop ecx
pop ecx
mov dword [ebp - 0x26c], 0
jmp 0x1003820b
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 2
jge 0x1003822d
push dword [ebp - 0x26c]
lea ecx, [ebp - 0x1094]
call fcn.1000f296
mov dword [eax], 5
jmp 0x100381fe
mov dword [ebp - 0x33c], 1
jmp 0x10038246
mov eax, dword [ebp - 0x33c]
dec eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0
jl 0x10038275
mov byte [ebp - 0x12d], 0
push 0x6580
push 0x7ef8
push 1
lea eax, [ebp - 0x12d]
push eax
push 0
call fcn.10029d42
add esp, 0x14
jmp 0x10038239
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1094]
call fcn.1000f22f
push 1
lea ecx, [ebp - 0xd98]
call fcn.1000f19e
mov dword [ebp - 4], 1
mov dword [ebp - 0xe60], 0x5cdbe8e5
mov dword [ebp - 0xe5c], 0x5cdbe8e5
mov dword [ebp - 0xe58], 0x5cdbe8e5
mov dword [ebp - 0xe54], 0x5cdbe8e5
lea ecx, [ebp - 0x415]
call fcn.1000fd8a
push eax
lea eax, [ebp - 0xe50]
push eax
lea eax, [ebp - 0xe60]
push eax
lea ecx, [ebp - 0x127c]
call fcn.100226a1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa94]
call fcn.1002267b
mov byte [ebp - 4], 2
push 4
lea ecx, [ebp - 0xed4]
call fcn.1000f19e
mov byte [ebp - 4], 3
mov dword [ebp - 0x104c], 0xa8fe2430
mov dword [ebp - 0xc4], 0
jmp 0x1003832d
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jge 0x1003834f
push dword [ebp - 0xc4]
lea ecx, [ebp - 0xd98]
call fcn.1000f296
mov dword [eax], 0xb26bdde0
jmp 0x10038320
mov dword [ebp - 0xc4], 0
jmp 0x10038368
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 4
jge 0x1003838a
push dword [ebp - 0xc4]
lea ecx, [ebp - 0xed4]
call fcn.1000f296
mov dword [eax], 0xfffffff7
jmp 0x1003835b
push 1
lea ecx, [ebp - 0xa94]
call fcn.1000f296
and dword [eax], 0
jmp 0x100383c0
push 1
lea ecx, [ebp - 0xa94]
call fcn.1000f296
mov dword [ebp - 0x5e0], eax
mov eax, dword [ebp - 0x5e0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x5e0]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xa94]
call fcn.1000f296
cmp dword [eax], 1
jge 0x100383f8
push 1
push 0x238a
lea eax, [ebp - 0xa94]
push eax
push 0x116b
push 0
lea eax, [ebp - 0xd98]
push eax
call fcn.1002ebed
add esp, 0x18
jmp 0x1003839c
push 0
push 0x6ab7
push 0
push 0x15d6
push 0x1595
lea eax, [ebp - 0xed4]
push eax
push 0x3bb5
push 0x18b3
push 0x7deb
lea eax, [ebp - 0xd98]
push eax
push 0x32b2
push 0x672e
push 0x5000
lea eax, [ebp - 0xa94]
push eax
push 0x575d
push 0x35a1
push 0x6626
call fcn.1003296a
add esp, 0x44
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xed4]
call fcn.1000f22f
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa94]
call fcn.1000f22f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd98]
call fcn.1000f22f
mov dword [ebp - 0x114c], 0xfffffffe
mov byte [ebp - 0x16e], 0
movzx eax, byte [ebp - 0x16e]
test eax, eax
je 0x100384be
push 0
push 0x5822
push 0x4708
push 0x42ee
push 0x1089
push 0
call fcn.10048d9d
add esp, 0x18
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x100384f0
push 0
push 0x6e5c
push 0x16a7
push 0
push 0x1ad2
push 0x5d91
call fcn.1002efab
add esp, 0x18
mov dword [ebp - 0x240], 0x8d327cb3
mov dword [ebp - 0xc7c], 0x1922
cmp dword [ebp - 0xc7c], 0xa92
jge 0x1003863f
lea eax, [ebp - 0x380]
push eax
push 0x1000785c
call fcn.1004fe8b
pop ecx
pop ecx
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0xc84], eax
mov eax, dword [ebp - 0x380]
dec eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0xc84], 0
je 0x1003863f
lea eax, [ebp - 0xc8c]
push eax
lea eax, [ebp - 0x64]
push eax
push 0x100079c4
call fcn.1004fe8b
add esp, 0xc
mov dword [ebp - 0x388], 3
jmp 0x1003857e
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x388]
cmp eax, dword [ebp - 0xc8c]
jge 0x100385a0
push 0x10007e6c
call fcn.1005018c
pop ecx
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
jmp 0x10038571
mov eax, dword [ebp - 0x64]
and eax, 0x80000001
jns 0x100385af
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x100385d4
mov eax, dword [ebp - 0x64]
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [ebp - 0x64]
cdq
sub eax, edx
sar eax, 1
push eax
push 0x10007e70
call fcn.1005018c
add esp, 0xc
jmp 0x1003863a
mov eax, dword [ebp - 0x64]
and eax, 0x80000003
jns 0x100385e3
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x10038619
mov eax, dword [ebp - 0x64]
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [ebp - 0x64]
cdq
and edx, 3
add eax, edx
sar eax, 2
push eax
mov eax, dword [ebp - 0x64]
cdq
and edx, 3
add eax, edx
sar eax, 2
push eax
push 0x10007a24
call fcn.1005018c
add esp, 0x10
jmp 0x1003863a
mov eax, dword [ebp - 0x64]
cdq
sub eax, edx
sar eax, 1
dec eax
push eax
mov eax, dword [ebp - 0x64]
cdq
sub eax, edx
sar eax, 1
dec eax
push eax
push 0x10007e7c
call fcn.1005018c
add esp, 0xc
jmp 0x10038527
mov dword [ebp - 0x1194], 0x177e8edf
mov dword [ebp - 0x1190], 0x177e8edf
mov dword [ebp - 0x118c], 0x177e8edf
mov dword [ebp - 0x1188], 0x177e8edf
mov dword [ebp - 0x274], 0xfffffffc
mov dword [ebp - 0x1030], 0xfffffffe
mov dword [ebp - 0x274], 3
jmp 0x10038694
mov eax, dword [ebp - 0x274]
dec eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0
jl 0x100386f4
mov dword [ebp - 0xc94], 6
push 0x3b44
push 0x65ae
push 0
push 0x700a
push 0xc15
push 1
push 0x264
lea eax, [ebp - 0xc94]
push eax
call fcn.10030458
add esp, 0x20
mov byte [ebp - 0x170], 0
movzx eax, byte [ebp - 0x170]
test eax, eax
je 0x100386f2
push 0xe36
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
jmp 0x10038687
mov dword [ebp - 0x11fc], 0xc3707822
mov dword [ebp - 0x90], 0xfffffffa
mov dword [ebp - 0x27c], 0xb9c279a2
mov dword [ebp - 0x9c0], 0x712c5197
mov dword [ebp - 0x9fc], 0x7cf8fb6f
mov dword [ebp - 0x1038], 0xffffffff
mov dword [ebp - 0x344], 0
jmp 0x10038749
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 3
jge 0x10038765
mov eax, dword [ebp - 0x344]
mov dword [ebp + eax*4 - 0x10a4], 0x85f70ad6
jmp 0x1003873c
mov dword [ebp - 0x90], 2
jmp 0x1003877e
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x10038999
mov dword [ebp - 0xd8], 0x6d058a83
mov dword [ebp - 0xcdc], 0x197cbb4
cmp dword [ebp - 0x27c], 0
je 0x10038809
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x90], eax
jg 0x100387c2
mov dword [ebp - 0xc9c], 1
jmp 0x100387c9
and dword [ebp - 0xc9c], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0xd8], eax
jge 0x100387e3
mov dword [ebp - 0x9a0], 1
jmp 0x100387ea
and dword [ebp - 0x9a0], 0
mov eax, dword [ebp - 0x9a0]
sub eax, dword [ebp - 0xd8]
cmp eax, 0x64d6
je 0x10038809
mov dword [ebp - 0x9a8], 1
jmp 0x10038810
and dword [ebp - 0x9a8], 0
mov eax, dword [ebp - 0x9a8]
add eax, dword [ebp - 0xd8]
mov dword [ebp - 0x9b0], eax
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x9b0]
mov dword [ebp + eax*4 - 0x10a4], ecx
cmp dword [ebp - 0x9b0], 0xfff6
jb 0x1003884d
mov dword [ebp - 0x9b8], 1
jmp 0x10038854
and dword [ebp - 0x9b8], 0
mov eax, dword [ebp - 0x9b8]
mov dword [ebp - 0x9c0], eax
cmp dword [ebp - 0x9c0], 1
jne 0x10038875
mov dword [ebp - 0x9c8], 1
jmp 0x1003887c
and dword [ebp - 0x9c8], 0
cmp dword [ebp - 0x9c8], 0x9984333
jl 0x10038894
mov dword [ebp - 0x9d0], 1
jmp 0x1003889b
and dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x9d0], eax
jg 0x100388b5
mov dword [ebp - 0x9e4], 1
jmp 0x100388bc
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x9e4], eax
jne 0x100388d6
mov dword [ebp - 0x9ec], 1
jmp 0x100388dd
and dword [ebp - 0x9ec], 0
mov eax, dword [ebp - 0x9ec]
sub eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x90]
je 0x100388fd
mov dword [ebp - 0xcd4], 1
jmp 0x10038904
and dword [ebp - 0xcd4], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x1064], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x1040], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xd8]
cmp dword [ebp + eax - 0x10a4], ecx
jle 0x1003893c
mov dword [ebp - 0x9f4], 1
jmp 0x10038943
and dword [ebp - 0x9f4], 0
mov eax, dword [ebp - 0x27c]
imul eax, dword [ebp - 0x9f4]
mov dword [ebp - 0x9fc], eax
mov eax, dword [ebp - 0xd8]
sub eax, dword [ebp - 0x9fc]
cmp eax, dword [ebp - 0x90]
je 0x10038976
mov dword [ebp - 0xa04], 1
jmp 0x1003897d
and dword [ebp - 0xa04], 0
mov eax, dword [ebp - 0xa04]
mov dword [ebp - 0xcdc], eax
cmp dword [ebp - 0x27c], 0
je 0x10038994
jmp 0x10038999
jmp 0x10038771
mov dword [ebp - 0x348], 4
mov dword [ebp - 0xce4], 0x1538
cmp dword [ebp - 0xce4], 0xea6
jge 0x10038b30
lea eax, [ebp - 0x48]
push eax
push 0x1000785c
call fcn.1004fe8b
pop ecx
pop ecx
mov eax, dword [ebp - 0x48]
and eax, 1
je 0x10038b25
push 0x10007868
call fcn.100507b6
pop ecx
cmp dword [ebp - 0x48], 1
jne 0x100389fa
push 0x10007e88
call fcn.1005018c
pop ecx
jmp 0x10038b23
mov eax, dword [ebp - 0x48]
inc eax
inc eax
imul eax, dword [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x48]
lea eax, [eax + eax + 4]
push eax
push 0x10007a44
call fcn.1005018c
add esp, 0xc
mov eax, dword [ebp - 0x48]
add eax, 3
push eax
push 0x10007e94
call fcn.1005018c
pop ecx
pop ecx
mov dword [ebp - 0x88], 1
jmp 0x10038a45
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x48]
inc eax
inc eax
cmp dword [ebp - 0x88], eax
jg 0x10038b23
mov dword [ebp - 0x180], 1
jmp 0x10038a6f
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
cmp eax, dword [ebp - 0x48]
jg 0x10038b1e
mov eax, dword [ebp - 0x88]
and eax, 0x80000001
jns 0x10038a90
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x10038a9d
cmp dword [ebp - 0x180], 1
je 0x10038b19
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x88]
lea eax, [ecx + eax - 1]
mov ecx, dword [ebp - 0x48]
inc ecx
inc ecx
cdq
idiv ecx
inc edx
cmp edx, dword [ebp - 0x88]
jle 0x10038b19
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x88]
lea eax, [ecx + eax - 1]
mov ecx, dword [ebp - 0x48]
inc ecx
inc ecx
cdq
idiv ecx
mov eax, dword [ebp - 0x48]
lea eax, [edx + eax + 3]
push eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x88]
lea eax, [ecx + eax + 2]
push eax
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x88]
lea eax, [ecx + eax - 1]
mov ecx, dword [ebp - 0x48]
inc ecx
inc ecx
cdq
idiv ecx
inc edx
push edx
push dword [ebp - 0x88]
push 0x10007e9c
call fcn.1005018c
add esp, 0x14
jmp 0x10038a62
jmp 0x10038a38
jmp 0x10038b30
push 0x1000786c
call fcn.100507b6
pop ecx
mov dword [ebp - 0xd0], 0xe0648261
mov dword [ebp - 0x390], 0x167d3d8e
mov dword [ebp - 0xd0], 0
jmp 0x10038b5d
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xffffffeb
jne 0x10039068
push 2
lea ecx, [ebp - 0xa3c]
call fcn.1000f19e
mov dword [ebp - 4], 4
mov dword [ebp - 0x34c], 0
jmp 0x10038b97
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 2
jge 0x10038bb9
push dword [ebp - 0x34c]
lea ecx, [ebp - 0xa3c]
call fcn.1000f296
mov dword [eax], 0xfffffffb
jmp 0x10038b8a
push 0
lea ecx, [ebp - 0xa3c]
call fcn.1000f296
mov dword [eax], 0x16
jmp 0x10038bf2
push 0
lea ecx, [ebp - 0xa3c]
call fcn.1000f296
mov dword [ebp - 0xa0c], eax
mov eax, dword [ebp - 0xa0c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xa0c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xa3c]
call fcn.1000f296
cmp dword [eax], 0xfffffff0
jg 0x10039054
mov dword [ebp - 0x174], 0xfffffffb
mov dword [ebp - 0x108], 0x14c5530c
mov dword [ebp - 0xb8], 0
jmp 0x10038c35
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 3
jge 0x10038c51
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0xa2c], 2
jmp 0x10038c28
mov dword [ebp - 0xb8], 0
jmp 0x10038c6a
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 4
jge 0x10038c86
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0xa64], 3
jmp 0x10038c5d
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xa64], 2
jmp 0x10038cb4
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa64]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xa64], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xa64], 0
jl 0x1003904f
mov dword [ebp - 0xcf4], 1
push 4
pop eax
test eax, eax
je 0x10038eb6
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa64]
mov ecx, dword [ebp - 0xd0]
cmp dword [ebp + eax*4 - 0xa2c], ecx
jge 0x10038d05
mov dword [ebp - 0xa14], 1
jmp 0x10038d0c
and dword [ebp - 0xa14], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa64]
mov eax, dword [ebp + eax*4 - 0xa2c]
cmp eax, dword [ebp - 0xa14]
je 0x10038d34
mov dword [ebp - 0x784], 1
jmp 0x10038d3b
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x106c], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0xa64]
cmp dword [ebp + eax - 0xa64], ecx
jl 0x10038d6f
mov dword [ebp - 0xa1c], 1
jmp 0x10038d76
and dword [ebp - 0xa1c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa64]
mov eax, dword [ebp + eax*4 - 0xa2c]
cmp dword [ebp - 0xa1c], eax
jle 0x10038d9e
mov dword [ebp - 0xa54], 1
jmp 0x10038da5
and dword [ebp - 0xa54], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa2c]
cmp dword [ebp - 0xa54], eax
jg 0x10038dc5
mov dword [ebp - 0x998], 1
jmp 0x10038dcc
and dword [ebp - 0x998], 0
mov eax, dword [ebp - 0x784]
cmp eax, dword [ebp - 0x998]
jne 0x10038de6
mov dword [ebp - 0x4ac], 1
jmp 0x10038ded
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x174], eax
jge 0x10038e13
mov dword [ebp - 0x77c], 1
jmp 0x10038e1a
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x108]
imul eax, dword [ebp - 0x77c]
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0xa64]
cmp eax, dword [ebp + ecx*4 - 0xa2c]
jl 0x10038e49
mov dword [ebp - 0x4b4], 1
jmp 0x10038e50
and dword [ebp - 0x4b4], 0
push 0
lea ecx, [ebp - 0xa3c]
call fcn.1000f296
mov ecx, dword [ebp - 0x4b4]
cmp ecx, dword [eax]
jl 0x10038e73
mov dword [ebp - 0x790], 1
jmp 0x10038e7a
and dword [ebp - 0x790], 0
push 0
lea ecx, [ebp - 0xa3c]
call fcn.1000f296
mov ecx, dword [ebp - 0x790]
cmp ecx, dword [eax]
jl 0x10038eb6
mov byte [ebp - 0x13d], 0
movzx eax, byte [ebp - 0x13d]
test eax, eax
je 0x10038eb4
push 0
push 1
push 0xbd
call fcn.10032560
add esp, 0xc
jmp 0x10038f0b
mov dword [ebp - 0x174], 0
jmp 0x10038ecf
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 3
jge 0x10038eeb
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0xa2c], 0xfffffffb
jmp 0x10038ec2
push 0
push 1
push 0x63fa
push 0x70ce
push 0x5af9
push 0x13c
call fcn.100328ac
add esp, 0x18
mov dword [ebp - 0x108], 0
jmp 0x10038f24
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 2
jg 0x1003904a
mov dword [ebp - 0x3f0], 0
mov dword [ebp - 0xcfc], 6
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x1048], eax
xor eax, eax
inc eax
je 0x10038f6b
cmp dword [ebp - 0x3f0], 0
je 0x10038f6b
mov dword [ebp - 0xcec], 1
jmp 0x10038f72
and dword [ebp - 0xcec], 0
push 0
lea ecx, [ebp - 0xa3c]
call fcn.1000f296
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa2c], 0
jne 0x10038fb1
cmp dword [ebp - 0xd0], 0
jne 0x10038fb1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa2c], 0
jne 0x10038fb1
and dword [ebp - 0x4bc], 0
jmp 0x10038fbb
mov dword [ebp - 0x4bc], 1
mov eax, dword [ebp - 0xcf4]
cmp dword [ebp - 0x4bc], eax
jge 0x10038fdb
cmp dword [ebp - 0xd0], 0
jne 0x10038fdb
and dword [ebp - 0x98c], 0
jmp 0x10038fe5
mov dword [ebp - 0x98c], 1
mov eax, dword [ebp - 0x108]
add eax, dword [ebp - 0x98c]
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 0xffffffff
je 0x1003900c
mov dword [ebp - 0x4c4], 1
jmp 0x10039013
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x3f0]
cmp dword [ebp - 0x4c4], eax
jg 0x1003902d
mov dword [ebp - 0x78c], 1
jmp 0x10039034
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x78c]
sub eax, 0xffff
mov dword [ebp - 0xcfc], eax
jmp 0x10038f17
jmp 0x10038c99
jmp 0x10038bce
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa3c]
call fcn.1000f22f
jmp 0x10038b50
push 0x486
push 0x7b71
push 0x3b64
push 0x3383
push 0
lea eax, [ebp - 0xd0]
push eax
push 1
push 1
lea eax, [ebp - 0x390]
push eax
call fcn.10030300
add esp, 0x24
mov dword [ebp - 0x328], 0
mov dword [ebp - 0x1074], 0xe3edfa83
mov dword [ebp - 0x4cc], 0
mov dword [ebp - 0xf50], 0
mov dword [ebp - 0xf4c], 0
mov dword [ebp - 0xf48], 0
mov dword [ebp - 0xf44], 0
mov dword [ebp - 0x1050], 0x3c633843
mov eax, dword [ebp - 0x4cc]
cmp dword [ebp - 0x4cc], eax
jl 0x10039102
mov dword [ebp - 0x8e4], 1
jmp 0x10039109
and dword [ebp - 0x8e4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x8e4]
mov dword [ebp + eax - 0xf50], ecx
mov dword [ebp - 0xd04], 0x19dc
cmp dword [ebp - 0xd04], 0x10e7
jge 0x10039223
lea eax, [ebp - 0x354]
push eax
mov ecx, 0x1065b2b0
call fcn.1000ed56
push dword [ebp - 0x354]
mov ecx, 0x11382170
call fcn.1000f234
and dword [ebp - 0x284], 0
jmp 0x1003916d
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x284]
cmp eax, dword [ebp - 0x354]
jge 0x10039198
push dword [ebp - 0x284]
mov ecx, 0x11382170
call fcn.1000f296
push eax
mov ecx, 0x1065b2b0
call fcn.1000ed56
jmp 0x10039160
or dword [ebp - 0x458], 0xffffffff
and dword [ebp - 0x10c], 0
jmp 0x100391b5
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x354]
jge 0x10039207
mov eax, dword [ebp - 0x10c]
inc eax
inc eax
cmp eax, dword [ebp - 0x354]
jge 0x100391f8
mov eax, dword [ebp - 0x10c]
inc eax
inc eax
push eax
mov ecx, 0x11382170
call fcn.1000f296
cmp dword [eax], 0
jne 0x100391f8
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x458]
inc eax
mov dword [ebp - 0x458], eax
jmp 0x100391a8
push fcn.100137d9
push dword [ebp - 0x458]
mov ecx, 0x1065b1f8
call fcn.10022337
mov ecx, eax
call fcn.1000ef45
mov byte [ebp - 0x175], 0
movzx eax, byte [ebp - 0x175]
test eax, eax
je 0x10039255
push 0x1654
push 0
push 0
push 0x4bfd
push 0x5686
push 0x3aff
call fcn.1002f23f
add esp, 0x18
push 0
push 0
call fcn.1002b226
pop ecx
pop ecx
mov dword [ebp - 0x214], 0x5d36
push 3
lea ecx, [ebp - 0x194]
call fcn.1000f19e
mov dword [ebp - 4], 5
mov dword [ebp - 0x35c], 0x4a71a6e4
mov dword [ebp - 0x204], 5
mov dword [ebp - 0x28c], 0
jmp 0x100392ab
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 3
jge 0x100392cd
push dword [ebp - 0x28c]
lea ecx, [ebp - 0x194]
call fcn.1000f296
mov dword [eax], 0xffff
jmp 0x1003929e
push 2
lea ecx, [ebp - 0x194]
call fcn.1000f296
push 1
lea ecx, [ebp - 0x194]
call fcn.1000f296
push 2
lea ecx, [ebp - 0x194]
call fcn.1000f296
mov esi, eax
push 0
lea ecx, [ebp - 0x194]
call fcn.1000f296
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x10039315
mov dword [ebp - 0x4d4], 1
jmp 0x1003931c
and dword [ebp - 0x4d4], 0
push 2
lea ecx, [ebp - 0x194]
call fcn.1000f296
mov ecx, dword [ebp - 0x4d4]
cmp ecx, dword [eax]
jne 0x10039345
cmp dword [ebp - 0x35c], 0
jne 0x10039345
and dword [ebp - 0x794], 0
jmp 0x1003934f
mov dword [ebp - 0x794], 1
push 2
lea ecx, [ebp - 0x194]
call fcn.1000f296
mov eax, dword [eax]
cmp eax, dword [ebp - 0x794]
jg 0x10039372
mov dword [ebp - 0x4dc], 1
jmp 0x10039379
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0
jne 0x1003939c
or eax, 0xffffffff
jne 0x1003939c
and dword [ebp - 0x9e8], 0
jmp 0x100393a6
mov dword [ebp - 0x9e8], 1
push 1
lea ecx, [ebp - 0x194]
call fcn.1000f296
mov esi, dword [ebp - 0x9e8]
imul esi, dword [eax]
push 2
lea ecx, [ebp - 0x194]
call fcn.1000f296
cmp esi, dword [eax]
jl 0x100393d9
mov dword [ebp - 0x4e4], 1
jmp 0x100393e0
and dword [ebp - 0x4e4], 0
cmp dword [ebp - 0x4e4], 0x5f9c7104
jg 0x100393f8
mov dword [ebp - 0x79c], 1
jmp 0x100393ff
and dword [ebp - 0x79c], 0
cmp dword [ebp - 0x79c], 0x1a88af16
jge 0x10039417
mov dword [ebp - 0xd2c], 1
jmp 0x1003941e
and dword [ebp - 0xd2c], 0
push 2
lea ecx, [ebp - 0x194]
call fcn.1000f296
push 0
lea ecx, [ebp - 0x194]
call fcn.1000f296
mov esi, dword [eax]
add esi, 0x7312
push 2
lea ecx, [ebp - 0x194]
call fcn.1000f296
cmp esi, dword [eax]
jge 0x1003945d
mov dword [ebp - 0x4ec], 1
jmp 0x10039464
and dword [ebp - 0x4ec], 0
push 2
lea ecx, [ebp - 0x194]
call fcn.1000f296
mov ecx, dword [ebp - 0x4ec]
cmp ecx, dword [eax]
jle 0x10039487
mov dword [ebp - 0x8ec], 1
jmp 0x1003948e
and dword [ebp - 0x8ec], 0
push 1
lea ecx, [ebp - 0x194]
call fcn.1000f296
mov ecx, dword [ebp - 0x8ec]
cmp ecx, dword [eax]
je 0x100394b1
mov dword [ebp - 0x4f4], 1
jmp 0x100394b8
and dword [ebp - 0x4f4], 0
imul eax, dword [ebp - 0x4f4], 0x5009
test eax, eax
je 0x100394e4
push 2
lea ecx, [ebp - 0x194]
call fcn.1000f296
cmp dword [eax], 0
je 0x100394e4
mov dword [ebp - 0x7a4], 1
jmp 0x100394eb
and dword [ebp - 0x7a4], 0
push 2
lea ecx, [ebp - 0x194]
call fcn.1000f296
mov ecx, dword [ebp - 0x7a4]
cmp ecx, dword [eax]
jne 0x1003950e
mov dword [ebp - 0x4fc], 1
jmp 0x10039515
and dword [ebp - 0x4fc], 0
push 2
lea ecx, [ebp - 0x194]
call fcn.1000f296
mov ecx, dword [ebp - 0x4fc]
cmp ecx, dword [eax]
jle 0x10039538
mov dword [ebp - 0x994], 1
jmp 0x1003953f
and dword [ebp - 0x994], 0
push 1
lea ecx, [ebp - 0x194]
call fcn.1000f296
mov ecx, dword [ebp - 0x994]
cmp ecx, dword [eax]
jge 0x10039562
mov dword [ebp - 0x504], 1
jmp 0x10039569
and dword [ebp - 0x504], 0
push 1
lea ecx, [ebp - 0x194]
call fcn.1000f296
mov ecx, dword [ebp - 0x504]
cmp ecx, dword [eax]
jle 0x1003958c
mov dword [ebp - 0x7ac], 1
jmp 0x10039593
and dword [ebp - 0x7ac], 0
mov esi, dword [ebp - 0x7ac]
sub esi, 3
push 2
lea ecx, [ebp - 0x194]
call fcn.1000f296
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x194]
call fcn.1000f296
imul esi, dword [eax]
mov dword [ebp - 0x204], esi
mov dword [ebp - 0x204], 0
jmp 0x100395db
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0x16
jne 0x10039603
push 0x2853
lea eax, [ebp - 0x35c]
push eax
push 0x7429
push 1
push 0
call fcn.10029c71
add esp, 0x14
jmp 0x100395ce
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x194]
call fcn.1000f22f
mov dword [ebp - 0x107c], 0x1b76e1ee
push 2
lea ecx, [ebp - 0x10b4]
call fcn.1000f19e
mov dword [ebp - 4], 6
mov dword [ebp - 0x294], 0xffffffff
push 0x680c
push 0x7bfa
lea eax, [ebp - 0x1154]
push eax
push 0x5266
push 0x2136
push 0x417c
push 0
push 0x5047
push 0x18a5
lea eax, [ebp - 0x10b4]
push eax
push 0x14b7
push 0
call fcn.10036fd7
add esp, 0x30
mov dword [ebp - 0x294], 1
jmp 0x10039695
mov eax, dword [ebp - 0x294]
dec eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0
jl 0x100396ba
mov byte [ebp - 0x145], 0
push 0
push 1
lea eax, [ebp - 0x145]
push eax
call fcn.1002ae0e
add esp, 0xc
jmp 0x10039688
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10b4]
call fcn.1000f22f
and dword [ebp - 0xdfc], 0
and dword [ebp - 0xdf8], 0
and dword [ebp - 0xdf4], 0
and dword [ebp - 0xdf0], 0
lea ecx, [ebp - 0x3e9]
call fcn.1000fd8a
push eax
lea eax, [ebp - 0xdec]
push eax
lea eax, [ebp - 0xdfc]
push eax
lea ecx, [ebp - 0x125c]
call fcn.100226a1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf34]
call fcn.1002267b
mov dword [ebp - 4], 7
mov dword [ebp - 0x208], 0x184c506d
mov dword [ebp - 0x208], 3
jmp 0x10039744
mov eax, dword [ebp - 0x208]
dec eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
jl 0x10039808
mov dword [ebp - 0x198], 0xffffffff
mov dword [ebp - 0x50c], 0x544d1878
mov dword [ebp - 0x198], 3
jmp 0x1003977e
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
jl 0x10039803
mov dword [ebp - 0xab0], 1
mov dword [ebp - 0xd30], 0
lea eax, [ebp - 0x50c]
push eax
push 0x468f
push 1
push 0
push 0
push 0x2315
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0xf34]
push eax
call fcn.1002ed1a
add esp, 0x20
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x50c]
push eax
push 0
lea eax, [ebp - 0xf34]
push eax
lea eax, [ebp - 0xab0]
push eax
lea eax, [ebp - 0xd30]
push eax
push 1
call fcn.1002fd51
add esp, 0x20
jmp 0x10039771
jmp 0x10039737
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf34]
call fcn.1000f22f
mov dword [ebp - 0x364], 0
jmp 0x10039830
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 3
jge 0x1003984c
mov eax, dword [ebp - 0x364]
mov dword [ebp + eax*4 - 0x1248], 0xfffffffb
jmp 0x10039823
push 3
lea ecx, [ebp - 0xeec]
call fcn.1000f19e
mov dword [ebp - 4], 8
mov dword [ebp - 0x8f4], 0x4a71a6e4
mov dword [ebp - 0x248], 5
mov dword [ebp - 0x36c], 0
jmp 0x1003988d
mov eax, dword [ebp - 0x36c]
inc eax
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 3
jge 0x100398af
push dword [ebp - 0x36c]
lea ecx, [ebp - 0xeec]
call fcn.1000f296
mov dword [eax], 0xffff
jmp 0x10039880
push 0x1c1a
push 0x1157
push 0
lea eax, [ebp - 0x248]
push eax
push 0
lea eax, [ebp - 0xeec]
push eax
push 0xa1a
lea eax, [ebp - 0x8f4]
push eax
call fcn.1003390c
add esp, 0x20
mov dword [ebp - 0x248], 0
jmp 0x100398f8
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0x16
jne 0x10039943
push 0x7262
push 0
push 0xd02
push 0x56e4
push 0x4ba9
push 0
lea eax, [ebp - 0x8f4]
push eax
push 0x4b4
push 0x65c8
push 0x3401
push 0x58ed
push 0x572d
call fcn.1002f4f4
add esp, 0x30
jmp 0x100398eb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xeec]
call fcn.1000f22f
cmp dword [ebp - 0x240], 0
je 0x1003b86c
push 2
lea ecx, [ebp - 0x10d4]
call fcn.1000f19e
mov dword [ebp - 4], 9
mov dword [ebp - 0x38], 0xdebf889e
mov dword [ebp - 0x7d4], 0xffffffff
mov dword [ebp - 0xcf8], 0xcdab
mov dword [ebp - 0x29c], 0
jmp 0x100399a7
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 1
jge 0x100399c0
mov eax, dword [ebp - 0x29c]
mov dword [ebp + eax*4 - 0x14], 0xfffffffe
jmp 0x1003999a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x14], 0
jmp 0x100399e5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x14], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x14], 0x1b
je 0x10039c35
mov dword [ebp - 0x8c], 0xbf390197
mov dword [ebp - 0x524], 1
mov dword [ebp - 0x360], 0
jmp 0x10039a23
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 4
jge 0x10039a3f
mov eax, dword [ebp - 0x360]
mov dword [ebp + eax*4 - 0x11a8], 0
jmp 0x10039a16
mov dword [ebp - 0x8c], 0
jmp 0x10039a58
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jg 0x10039bfb
mov dword [ebp - 0x2b0], 0xb90f9986
mov dword [ebp - 0xb94], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11a8]
cmp dword [ebp - 0x8c], eax
jle 0x10039a9a
mov dword [ebp - 0x7bc], 1
jmp 0x10039aa1
and dword [ebp - 0x7bc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2b0]
sub ecx, dword [ebp - 0x2b0]
cmp dword [ebp + eax - 0x11a8], ecx
jle 0x10039ac8
mov dword [ebp - 0x514], 1
jmp 0x10039acf
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jb 0x10039aea
mov dword [ebp - 0x7b4], 1
jmp 0x10039af1
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0x7b4], eax
jle 0x10039b0b
mov dword [ebp - 0xab8], 1
jmp 0x10039b12
and dword [ebp - 0xab8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
mov dword [ebp - 0x1070], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
cmp dword [ebp - 0x2b0], eax
jne 0x10039b40
mov dword [ebp - 0x51c], 1
jmp 0x10039b47
and dword [ebp - 0x51c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
cmp dword [ebp - 0x51c], eax
je 0x10039b65
mov dword [ebp - 0xa30], 1
jmp 0x10039b6c
and dword [ebp - 0xa30], 0
mov eax, dword [ebp - 0xa30]
mov dword [ebp - 0x524], eax
mov eax, dword [ebp - 0x524]
cmp dword [ebp - 0x7bc], eax
jl 0x10039b92
mov dword [ebp - 0x52c], 1
jmp 0x10039b99
and dword [ebp - 0x52c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
cmp dword [ebp - 0x52c], eax
jl 0x10039bbb
push 2
pop eax
test eax, eax
jne 0x10039bbb
and dword [ebp - 0x8fc], 0
jmp 0x10039bc5
mov dword [ebp - 0x8fc], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
cmp dword [ebp - 0x8fc], eax
jg 0x10039be3
mov dword [ebp - 0x534], 1
jmp 0x10039bea
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0xb94], eax
jmp 0x10039a4b
mov dword [ebp - 0x8c], 0
jmp 0x10039c14
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 4
jge 0x10039c30
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x11a8], 0x86a6c65b
jmp 0x10039c07
jmp 0x100399d0
mov dword [ebp - 0x38], 0
jmp 0x10039c45
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x10039eb6
mov dword [ebp - 0x56c], 0xd385e397
push 1
lea ecx, [ebp - 0xdb0]
call fcn.1000f19e
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x310], 0
jmp 0x10039c83
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 1
jge 0x10039ca5
push dword [ebp - 0x310]
lea ecx, [ebp - 0xdb0]
call fcn.1000f296
mov dword [eax], 1
jmp 0x10039c76
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x14], 0
je 0x10039cc3
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xdb0]
call fcn.1000f22f
jmp 0x10039eb6
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x14]
mov dword [ebp - 0x11ac], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x14], 0x8394
jg 0x10039cec
cmp dword [ebp - 0x38], 0
jne 0x10039cec
and dword [ebp - 0x7c4], 0
jmp 0x10039cf6
mov dword [ebp - 0x7c4], 1
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x14]
cmp eax, dword [ebp - 0x7c4]
jle 0x10039d11
mov dword [ebp - 0x53c], 1
jmp 0x10039d18
and dword [ebp - 0x53c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
cmp eax, dword [ebp - 0x53c]
jne 0x10039d36
mov dword [ebp - 0x99c], 1
jmp 0x10039d3d
and dword [ebp - 0x99c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
cmp eax, dword [ebp - 0x99c]
jle 0x10039d5b
mov dword [ebp - 0x544], 1
jmp 0x10039d62
and dword [ebp - 0x544], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
cmp dword [ebp - 0x544], eax
jne 0x10039d80
mov dword [ebp - 0x7cc], 1
jmp 0x10039d87
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x7d4]
cmp dword [ebp - 0x7cc], eax
jge 0x10039da1
mov dword [ebp - 0x54c], 1
jmp 0x10039da8
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp + ecx*4 - 0x14]
add ecx, dword [ebp - 0x54c]
cmp dword [ebp + eax*4 - 0x14], ecx
jne 0x10039dca
mov dword [ebp - 0x904], 1
jmp 0x10039dd1
and dword [ebp - 0x904], 0
cmp dword [ebp - 0x904], 2
je 0x10039ded
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x14], 0
jne 0x10039ded
and dword [ebp - 0x554], 0
jmp 0x10039df7
mov dword [ebp - 0x554], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x554]
sub ecx, dword [ebp + eax - 0x14]
mov eax, dword [ebp - 0x38]
cmp ecx, dword [ebp + eax*4 - 0x14]
jne 0x10039e1c
mov dword [ebp - 0x55c], 1
jmp 0x10039e23
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x7d4]
cmp dword [ebp - 0x55c], eax
jge 0x10039e3d
mov dword [ebp - 0x9f0], 1
jmp 0x10039e44
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0xcf8]
cmp dword [ebp - 0x9f0], eax
jge 0x10039e5e
mov dword [ebp - 0x564], 1
jmp 0x10039e65
and dword [ebp - 0x564], 0
cmp dword [ebp - 0x564], 7
jb 0x10039e7a
mov dword [ebp - 0x7dc], 1
jmp 0x10039e81
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0x56c], eax
mov esi, dword [ebp - 0x56c]
push 0
lea ecx, [ebp - 0xdb0]
call fcn.1000f296
mov dword [eax], esi
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xdb0]
call fcn.1000f22f
jmp 0x10039c3e
mov dword [ebp - 0x1078], 0xffffffff
mov dword [ebp - 0x115c], 0xffffffff
mov dword [ebp - 0xe10], 1
mov dword [ebp - 0xe0c], 1
mov dword [ebp - 0xe08], 1
mov dword [ebp - 0xe04], 1
lea ecx, [ebp - 0x3f1]
call fcn.1000fd8a
push eax
lea eax, [ebp - 0xe00]
push eax
lea eax, [ebp - 0xe10]
push eax
lea ecx, [ebp - 0x1294]
call fcn.100226a1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xebc]
call fcn.1002267b
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x1dc], 1
mov dword [ebp - 0x1080], 0xba1bf2b
mov dword [ebp - 0x11e4], 0xcf09cc25
mov dword [ebp - 0x1088], 0xd1878abc
mov dword [ebp - 0x1164], 0xe54ee87f
mov dword [ebp - 0x1dc], 0
jmp 0x10039f76
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 3
jg 0x1003a468
mov dword [ebp - 0x1098], 0xfffffff9
mov dword [ebp - 0x11c0], 1
mov dword [ebp - 0xcd8], 0xfffc
mov dword [ebp - 0xac0], 0x2240
cmp dword [ebp - 0xac0], 0x531
jge 0x1003a41e
lea eax, [ebp - 0xc48]
push eax
push 0x10007858
call fcn.1004fe8b
pop ecx
pop ecx
mov dword [ebp - 0x398], 1
jmp 0x10039fe7
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x398]
cmp eax, dword [ebp - 0xc48]
jg 0x1003a41e
lea eax, [ebp - 0x24]
push eax
push 0x10007858
call fcn.1004fe8b
pop ecx
pop ecx
mov eax, dword [ebp - 0x24]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x90c], eax
mov eax, dword [ebp - 0x90c]
dec eax
mov dword [ebp - 0xae8], eax
and dword [ebp - 0x40], 0
jmp 0x1003a030
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x24]
jge 0x1003a0ed
mov eax, dword [ebp - 0x40]
lea eax, [ebp + eax*4 - 0x2018]
push eax
mov eax, dword [ebp - 0x40]
lea eax, [ebp + eax*4 - 0x2304]
push eax
mov eax, dword [ebp - 0x40]
lea eax, [ebp + eax*4 - 0x1a40]
push eax
mov eax, dword [ebp - 0x40]
lea eax, [ebp + eax*4 - 0x1754]
push eax
lea eax, [ebp - 0xcd0]
push eax
lea eax, [ebp - 0xac8]
push eax
push 0x10007eb0
call fcn.1004fe8b
add esp, 0x1c
imul eax, dword [ebp - 0xac8], 0x3c
add eax, dword [ebp - 0xcd0]
mov ecx, dword [ebp - 0x40]
mov dword [ebp + ecx*4 - 0x1d2c], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x1754]
sub eax, dword [ebp + ecx*4 - 0x2304]
push eax
call fcn.10050956
pop ecx
mov ecx, dword [ebp - 0x40]
mov esi, dword [ebp + ecx*4 - 0x1d2c]
add esi, eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x1a40]
sub eax, dword [ebp + ecx*4 - 0x2018]
push eax
call fcn.10050956
pop ecx
add esi, eax
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x25f0], esi
jmp 0x1003a029
push 0x11132
push 0
push 0x10e674c0
call fcn.1000ea1a
add esp, 0xc
push 0x11132
push 0
push 0x10bce310
call fcn.1000ea1a
add esp, 0xc
mov eax, dword [ebp - 0x24]
lea eax, [eax + eax + 1]
mov dword [ebp - 0x2b8], eax
jmp 0x1003a131
mov eax, dword [ebp - 0x2b8]
dec eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
jl 0x1003a153
push dword [ebp - 0x2b8]
mov ecx, 0x113821a0
call fcn.1002266e
mov ecx, eax
call fcn.1004950f
jmp 0x1003a124
and dword [ebp - 0x1e0], 0
jmp 0x1003a169
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x1e0]
cmp eax, dword [ebp - 0x24]
jge 0x1003a1e0
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0xad0], eax
lea eax, [ebp - 0xad0]
push eax
push 0
mov ecx, 0x113821a0
call fcn.1002266e
mov ecx, eax
call fcn.1000f1da
and dword [ebp - 0xc50], 0
lea eax, [ebp - 0xc50]
push eax
mov eax, dword [ebp - 0x1e0]
inc eax
push eax
mov ecx, 0x113821a0
call fcn.1002266e
mov ecx, eax
call fcn.1000f1da
mov eax, 0x176
imul eax, eax, 0
xor ecx, ecx
inc ecx
mov edx, dword [ebp - 0x1e0]
mov word [eax + edx*2 + 0x10bce312], cx
jmp 0x1003a15c
and dword [ebp - 0x1e8], 0
jmp 0x1003a1f6
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x1e8]
cmp eax, dword [ebp - 0x24]
jge 0x1003a293
mov eax, dword [ebp - 0x24]
lea eax, [eax + eax + 1]
mov dword [ebp - 0xad8], eax
lea eax, [ebp - 0xad8]
push eax
mov eax, dword [ebp - 0x1e8]
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + eax + 1]
push eax
mov ecx, 0x113821a0
call fcn.1002266e
mov ecx, eax
call fcn.1000f1da
mov eax, dword [ebp - 0x1e8]
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + eax + 1]
mov dword [ebp - 0xd18], eax
lea eax, [ebp - 0xd18]
push eax
mov eax, dword [ebp - 0x24]
lea eax, [eax + eax + 1]
push eax
mov ecx, 0x113821a0
call fcn.1002266e
mov ecx, eax
call fcn.1000f1da
mov eax, dword [ebp - 0x1e8]
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + eax + 1]
imul eax, eax, 0x176
mov ecx, dword [ebp - 0x24]
shl ecx, 1
xor edx, edx
inc edx
mov word [eax + ecx*2 + 0x10bce312], dx
jmp 0x1003a1e9
and dword [ebp - 0x94], 0
jmp 0x1003a2a9
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x24]
jge 0x1003a3de
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0xc0], eax
jmp 0x1003a2d4
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0x24]
jge 0x1003a3d9
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0x2304]
sub eax, dword [ebp + ecx*4 - 0x1754]
push eax
call fcn.10050956
pop ecx
mov ecx, dword [ebp - 0x94]
mov esi, dword [ebp + ecx*4 - 0x25f0]
add esi, eax
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0xc0]
mov eax, dword [ebp + eax*4 - 0x2018]
sub eax, dword [ebp + ecx*4 - 0x1a40]
push eax
call fcn.10050956
pop ecx
add esi, eax
mov eax, dword [ebp - 0xc0]
cmp esi, dword [ebp + eax*4 - 0x1d2c]
jge 0x1003a3d4
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + eax + 1]
mov dword [ebp - 0xae0], eax
lea eax, [ebp - 0xae0]
push eax
mov eax, dword [ebp - 0x94]
inc eax
push eax
mov ecx, 0x113821a0
call fcn.1002266e
mov ecx, eax
call fcn.1000f1da
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0xc58], eax
lea eax, [ebp - 0xc58]
push eax
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + eax + 1]
push eax
mov ecx, 0x113821a0
call fcn.1002266e
mov ecx, eax
call fcn.1000f1da
mov eax, dword [ebp - 0x94]
inc eax
imul eax, eax, 0x176
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ebp - 0x24]
lea ecx, [edx + ecx + 1]
xor edx, edx
inc edx
mov word [eax + ecx*2 + 0x10bce310], dx
jmp 0x1003a2c7
jmp 0x1003a29c
and dword [0x10e674ac], 0
lea eax, [ebp - 0xae8]
push eax
lea eax, [ebp - 0x90c]
push eax
call fcn.10037de5
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x1003a403
jmp 0x1003a3e5
mov eax, dword [ebp - 0x24]
sub eax, dword [0x10e674ac]
push eax
push 0x10007870
call fcn.1005018c
pop ecx
pop ecx
jmp 0x10039fda
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0xebc]
call fcn.1000f296
mov esi, eax
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0xebc]
call fcn.1000f296
mov ecx, dword [esi]
mov dword [eax], ecx
push 0x3eae
push 0
push 0
push 0x505e
lea eax, [ebp - 0xcd8]
push eax
call fcn.1002b09d
add esp, 0x14
jmp 0x10039f69
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xebc]
call fcn.1000f22f
mov dword [ebp - 0x10a8], 1
mov dword [ebp - 0xf68], 0xffffffff
mov dword [ebp - 0x1a4], 1
mov dword [ebp - 0x340], 0xad94e8fe
mov dword [ebp - 0x574], 0
mov dword [ebp - 0x438], 0x62c5d177
mov dword [ebp - 0xc60], 9
mov dword [ebp - 0xe0], 0
jmp 0x1003a4d6
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jge 0x1003a4f2
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0x3a0], 0x1ae9a07b
jmp 0x1003a4c9
mov dword [ebp - 0xe0], 0
jmp 0x1003a50b
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jge 0x1003a527
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0x120c], 0xffffffff
jmp 0x1003a4fe
mov eax, dword [ebp - 0x1a4]
add eax, 0x23fe
jne 0x1003a639
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x574], eax
cmp dword [ebp - 0x574], 0
jne 0x1003a55f
cmp dword [ebp - 0x340], 0
jne 0x1003a55f
and dword [ebp - 0x7e4], 0
jmp 0x1003a569
mov dword [ebp - 0x7e4], 1
mov eax, dword [ebp - 0x340]
cmp eax, dword [ebp - 0x7e4]
jg 0x1003a583
mov dword [ebp - 0x57c], 1
jmp 0x1003a58a
and dword [ebp - 0x57c], 0
cmp dword [ebp - 0x57c], 0xd96753f3
ja 0x1003a5a2
mov dword [ebp - 0x9a4], 1
jmp 0x1003a5a9
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0x340], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x340]
mov dword [ebp + eax - 0x3a0], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3a0]
mov dword [ebp - 0xf6c], eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0xf74], eax
cmp dword [ebp - 0x438], 0x764c
jle 0x1003a5ff
mov dword [ebp - 0x3f8], 1
jmp 0x1003a606
and dword [ebp - 0x3f8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3f8]
mov dword [ebp + eax - 0x120c], ecx
mov eax, dword [ebp - 0x438]
mov ecx, dword [ebp - 0x3f8]
lea eax, [ecx + eax - 2]
cmp eax, 0x94be3d0e
jb 0x1003a639
and dword [ebp - 0x584], 0
jmp 0x1003a643
mov dword [ebp - 0x584], 1
imul eax, dword [ebp - 0x584], 0x34cc
test eax, eax
je 0x1003a65a
mov eax, 0x4adc
test eax, eax
jne 0x1003a673
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3a0], 0
jne 0x1003a673
and dword [ebp - 0x7ec], 0
jmp 0x1003a67d
mov dword [ebp - 0x7ec], 1
mov eax, dword [ebp - 0x438]
add eax, dword [ebp - 0x7ec]
cmp eax, dword [ebp - 0x1a4]
jg 0x1003a69d
mov dword [ebp - 0x58c], 1
jmp 0x1003a6a4
and dword [ebp - 0x58c], 0
cmp dword [ebp - 0x58c], 0xffffffff
je 0x1003a6b9
mov dword [ebp - 0xaf0], 1
jmp 0x1003a6c0
and dword [ebp - 0xaf0], 0
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0xf7c], eax
mov eax, 0xfddf34ff
sub eax, dword [ebp - 0x1a4]
mov dword [ebp - 0xc60], eax
mov dword [ebp - 0xf84], 0x1cb4e76a
mov dword [ebp - 0xf8c], 0xde0980db
push 3
lea ecx, [ebp - 0x10c4]
call fcn.1000f19e
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x404], 0xec56
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0xaf8], 0x1c17854c
mov dword [ebp - 0xd00], 0x1364f2ca
mov dword [ebp - 0xb00], 0xb5b06a83
mov dword [ebp - 0x2c0], 0
jmp 0x1003a74d
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 1
jge 0x1003a766
mov eax, dword [ebp - 0x2c0]
mov dword [ebp + eax*4 - 0x6c], 0
jmp 0x1003a740
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6c]
mov dword [ebp - 0xf94], eax
mov eax, 0x2885
test eax, eax
je 0x1003a8a5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6c], 0xffffffff
ja 0x1003a79c
mov dword [ebp - 0x914], 1
jmp 0x1003a7a3
and dword [ebp - 0x914], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6c]
cmp dword [ebp - 0x914], eax
je 0x1003a7c1
mov dword [ebp - 0x594], 1
jmp 0x1003a7c8
and dword [ebp - 0x594], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x594]
sub ecx, dword [ebp + eax - 0x6c]
cmp ecx, 8
jg 0x1003a7ef
mov eax, 0xf63a
test eax, eax
jne 0x1003a7ef
and dword [ebp - 0x7f4], 0
jmp 0x1003a7f9
mov dword [ebp - 0x7f4], 1
mov eax, dword [ebp - 0x7f4]
mov dword [ebp - 0x404], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6c]
cmp dword [ebp - 0x404], eax
jle 0x1003a823
mov dword [ebp - 0x59c], 1
jmp 0x1003a82a
and dword [ebp - 0x59c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6c]
cmp eax, dword [ebp - 0x59c]
jg 0x1003a848
mov dword [ebp - 0xa18], 1
jmp 0x1003a84f
and dword [ebp - 0xa18], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6c]
cmp dword [ebp - 0xa18], eax
jge 0x1003a871
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x1003a871
and dword [ebp - 0x5a4], 0
jmp 0x1003a87b
mov dword [ebp - 0x5a4], 1
cmp dword [ebp - 0x5a4], 0xffff
ja 0x1003a8a5
xor eax, eax
inc eax
je 0x1003a8a5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6c], 0
je 0x1003a8a5
mov dword [ebp - 0x7fc], 1
jmp 0x1003a8ac
and dword [ebp - 0x7fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6c]
imul eax, dword [ebp - 0x7fc]
cmp eax, dword [ebp - 0xfc]
je 0x1003a8d1
mov dword [ebp - 0x3a8], 1
jmp 0x1003a8d8
and dword [ebp - 0x3a8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3a8]
mov dword [ebp + eax - 0x6c], ecx
mov eax, dword [ebp - 0xfc]
imul eax, dword [ebp - 0x3a8]
imul eax, eax, 0xf8d3
sub eax, dword [ebp - 0xfc]
mov dword [ebp - 0xaf8], eax
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x404], eax
jle 0x1003a921
mov dword [ebp - 0x5ac], 1
jmp 0x1003a928
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x5ac]
sub eax, 0xb1aa
je 0x1003a94a
cmp dword [ebp - 0xfc], 0
je 0x1003a94a
mov dword [ebp - 0x91c], 1
jmp 0x1003a951
and dword [ebp - 0x91c], 0
cmp dword [ebp - 0x91c], 5
jl 0x1003a966
mov dword [ebp - 0x5b4], 1
jmp 0x1003a96d
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x5b4]
sub eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0xfc]
je 0x1003a98d
mov dword [ebp - 0x804], 1
jmp 0x1003a994
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x804], eax
jg 0x1003a9b8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6c], 0
jne 0x1003a9b8
and dword [ebp - 0x5bc], 0
jmp 0x1003a9c2
mov dword [ebp - 0x5bc], 1
mov eax, dword [ebp - 0xd00]
imul eax, dword [ebp - 0x5bc]
mov dword [ebp - 0xb00], eax
mov byte [ebp - 0x177], 0
movzx eax, byte [ebp - 0x177]
test eax, eax
je 0x1003a9ef
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [ebp - 0xb40], 0x41ce3cb5
mov dword [ebp - 0xf9c], 0xeac8b13e
push 1
push 0x5432
push 0x7034
push 0x1635
push 1
push 0x4cca
push 0
push 0x5f3b
push 0x3ae2
call fcn.1002a31a
add esp, 0x24
mov byte [ebp - 0x14d], 0
lea eax, [ebp - 0x14d]
push eax
push 1
push 0
push 0x608a
push 0x60da
call fcn.1002b09d
add esp, 0x14
push 3
lea ecx, [ebp - 0xf04]
call fcn.1000f19e
mov byte [ebp - 4], 0xd
push 3
lea ecx, [ebp - 0xd14]
call fcn.1000f19e
mov byte [ebp - 4], 0xe
push 0x1e9e
push 0
push 0
lea eax, [ebp - 0xc68]
push eax
push 0x5f
lea eax, [ebp - 0xf04]
push eax
push 1
call fcn.10033c31
add esp, 0x1c
push 1
push 0x4023
lea eax, [ebp - 0xc68]
push eax
push 0x5a8d
push 0
lea eax, [ebp - 0xd14]
push eax
call fcn.1002b141
add esp, 0x18
push 0
lea ecx, [ebp - 0xd14]
call fcn.1000f296
and dword [eax], 0
jmp 0x1003aaf2
push 0
lea ecx, [ebp - 0xd14]
call fcn.1000f296
mov dword [ebp - 0x9ac], eax
mov eax, dword [ebp - 0x9ac]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x9ac]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xd14]
call fcn.1000f296
cmp dword [eax], 2
jg 0x1003ac3d
mov dword [ebp - 0x54], 0xfffffffa
mov dword [ebp - 0x54], 2
jmp 0x1003ab1f
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x1003abbb
mov dword [ebp - 0xb08], 0x1a9565e0
push 0x6f7b
push 0x2695
push 0x2119
push 0x1420
push 0
push 0x1284
lea eax, [ebp - 0xf04]
push eax
push 0x1074
push 0x40c
lea eax, [ebp - 0xb08]
push eax
push 0x24e
push 1
push 0x25c2
push 0x35d8
push 0x3f01
push 0x13e5
call fcn.10032338
add esp, 0x40
mov byte [ebp - 0x179], 0
movzx eax, byte [ebp - 0x179]
test eax, eax
je 0x1003abb6
push 0x53c5
push 0x61ac
push 0x7346
push 1
push 1
call fcn.10029c71
add esp, 0x14
jmp 0x1003ab18
mov dword [ebp - 0x54], 0
jmp 0x1003abcb
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jg 0x1003ac03
mov byte [ebp - 0x155], 0
push 0
push 0x3e19
push 0x36b2
push 1
lea eax, [ebp - 0x155]
push eax
push 0x116d
push 1
push 0x6f1f
call fcn.10037320
add esp, 0x20
jmp 0x1003abc4
mov dword [ebp - 0x54], 0
jmp 0x1003ac13
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jg 0x1003ac38
mov byte [ebp - 0x15d], 0
movzx eax, byte [ebp - 0x15d]
test eax, eax
je 0x1003ac36
push 0
push 1
call fcn.1002b226
pop ecx
pop ecx
jmp 0x1003ac0c
jmp 0x1003aace
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xd14]
call fcn.1000f22f
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xf04]
call fcn.1000f22f
push 0
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10d4]
push eax
push 0x301b
push 0
call fcn.1002aeae
add esp, 0x14
mov dword [ebp - 0x5c], 0x73ff82ff
mov dword [ebp - 0xc8], 0x244c
mov dword [ebp - 0x114], 0xa52b4b5a
mov dword [ebp - 0xce0], 0x24be
cmp dword [ebp - 0xce0], 0xb20
jge 0x1003aeb4
push 4
pop eax
imul eax, eax, 0
and dword [eax + 0x107f8f58], 0
push 4
pop eax
shl eax, 0
mov dword [eax + 0x107f8f58], 1
mov dword [ebp - 0x1cc], 2
jmp 0x1003ace5
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0x98
jg 0x1003ad22
mov eax, dword [ebp - 0x1cc]
mov eax, dword [eax*4 + 0x107f8f54]
mov ecx, dword [ebp - 0x1cc]
add eax, dword [ecx*4 + 0x107f8f50]
cdq
mov ecx, 0x98
idiv ecx
mov eax, dword [ebp - 0x1cc]
mov dword [eax*4 + 0x107f8f58], edx
jmp 0x1003acd8
lea eax, [ebp - 0x3b0]
push eax
mov ecx, 0x1065b2b0
call fcn.1000ed56
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0xb10], eax
mov eax, dword [ebp - 0x3b0]
dec eax
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0xb10], 0
je 0x1003aeb4
mov ecx, 0x11382158
call fcn.1004950f
lea eax, [ebp - 0x5c4]
push eax
mov ecx, 0x1065b2b0
call fcn.1000ed56
and dword [ebp - 0x210], 0
jmp 0x1003ad8a
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0x98
jg 0x1003adbe
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 0x5c4]
cmp ecx, dword [eax*4 + 0x107f8f58]
jne 0x1003adbc
lea eax, [ebp - 0x210]
push eax
mov ecx, 0x11382158
call fcn.1000f1da
jmp 0x1003ad7d
mov ecx, 0x11382158
call fcn.100494eb
movzx eax, al
test eax, eax
je 0x1003adef
push fcn.100137d9
mov edx, 0x10007ec4
mov ecx, 0x1065b1f8
call fcn.10022d5e
mov ecx, eax
call fcn.1000ef45
jmp 0x1003aeaf
mov edx, 0x10007ee4
mov ecx, 0x1065b1f8
call fcn.10022d5e
and dword [ebp - 0x230], 0
jmp 0x1003ae14
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
mov ecx, 0x11382158
call fcn.1000f28d
cmp dword [ebp - 0x230], eax
jae 0x1003ae7e
push dword [ebp - 0x230]
mov ecx, 0x11382158
call fcn.1000f296
push dword [eax]
mov edx, 0x10007f04
mov ecx, 0x1065b1f8
call fcn.10022d5e
mov ecx, eax
call fcn.10022337
mov edx, 0x10007f00
mov ecx, eax
call fcn.10022d5e
mov ecx, 0x11382158
call fcn.1000f28d
dec eax
cmp dword [ebp - 0x230], eax
jae 0x1003ae7c
mov edx, 0x10007f08
mov ecx, 0x1065b1f8
call fcn.10022d5e
jmp 0x1003ae07
push fcn.100137d9
push dword [ebp - 0x5c4]
mov edx, 0x10007f0c
mov ecx, 0x1065b1f8
call fcn.10022d5e
mov ecx, eax
call fcn.10022337
mov dl, 0x5d
mov ecx, eax
call fcn.10029611
mov ecx, eax
call fcn.1000ef45
jmp 0x1003ad33
mov dword [ebp - 0xe24], 0xfffffffc
mov dword [ebp - 0xe20], 0xfffffffc
mov dword [ebp - 0xe1c], 0xfffffffc
mov dword [ebp - 0xe18], 0xfffffffc
lea ecx, [ebp - 0x3d1]
call fcn.1000fd8a
push eax
lea eax, [ebp - 0xe14]
push eax
lea eax, [ebp - 0xe24]
push eax
lea ecx, [ebp - 0x126c]
call fcn.100226a1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xe8c]
call fcn.1002267b
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x318], 0
jmp 0x1003af2e
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 3
jge 0x1003af4a
mov eax, dword [ebp - 0x318]
mov dword [ebp + eax*4 - 0x434], 0x951e
jmp 0x1003af21
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x434], 0
jne 0x1003aff4
cmp dword [ebp - 0xc8], 0
je 0x1003af74
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x434], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x434]
cmp dword [ebp + eax - 0x434], ecx
jl 0x1003af9b
mov dword [ebp - 0x80c], 1
jmp 0x1003afa2
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x80c]
add eax, 0x1eca6c84
imul eax, dword [ebp - 0xc8]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x434]
jne 0x1003afcf
mov dword [ebp - 0x5cc], 1
jmp 0x1003afd6
and dword [ebp - 0x5cc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x434]
add eax, dword [ebp - 0x5cc]
jne 0x1003aff4
and dword [ebp - 0x924], 0
jmp 0x1003affe
mov dword [ebp - 0x924], 1
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x924], eax
jg 0x1003b018
mov dword [ebp - 0x5d4], 1
jmp 0x1003b01f
and dword [ebp - 0x5d4], 0
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x5c]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x434]
sub eax, dword [ebp - 0x5d4]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x434]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x434]
je 0x1003b065
mov dword [ebp - 0x814], 1
jmp 0x1003b06c
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0xc8], 0
jmp 0x1003b091
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jg 0x1003b366
push 2
lea ecx, [ebp - 0xdc8]
call fcn.1000f19e
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x5dc], 1
mov dword [ebp - 0x92c], 6
mov dword [ebp - 0xca0], 0
lea eax, [ebp - 0xfa4]
push eax
push 0
lea eax, [ebp - 0xdc8]
push eax
push 0x49d9
push 0x7914
push 0
call fcn.1002e84d
add esp, 0x18
mov dword [ebp - 0x114], 0
jmp 0x1003b10a
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 2
jg 0x1003b167
mov eax, dword [ebp - 0xc8]
cmp dword [ebp + eax*4 - 0x434], 0
je 0x1003b125
jmp 0x1003b167
mov dword [ebp - 0x5c], 2
jmp 0x1003b135
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x1003b165
mov dword [ebp - 0xc70], 3
mov eax, dword [ebp - 0xc70]
mov dword [ebp - 0xfac], eax
mov esi, dword [ebp - 0x5c]
push 2
lea ecx, [ebp - 0xe8c]
call fcn.1000f296
mov dword [eax], esi
jmp 0x1003b12e
jmp 0x1003b0fd
mov dword [ebp - 0x5c], 2
jmp 0x1003b177
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x1003b352
mov dword [ebp - 0x1ac], 0x4707
push 0
lea ecx, [ebp - 0xdc8]
call fcn.1000f296
cmp dword [eax], 0
jne 0x1003b1b6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x434], 0
jne 0x1003b1b6
and dword [ebp - 0x5e4], 0
jmp 0x1003b1c0
mov dword [ebp - 0x5e4], 1
mov dword [ebp - 0x5dc], 0xe9f81a77
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x1003b1fd
cmp dword [ebp - 0x1ac], 0
je 0x1003b1fd
mov eax, 0x8c46158e
test eax, eax
je 0x1003b1fd
mov dword [ebp - 0x9f8], 1
jmp 0x1003b204
and dword [ebp - 0x9f8], 0
imul eax, dword [ebp - 0x9f8], 0xfffffffe
add eax, dword [ebp - 0x5e4]
cmp eax, 9
jg 0x1003b222
mov dword [ebp - 0xb18], 1
jmp 0x1003b229
and dword [ebp - 0xb18], 0
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0xfb4], eax
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x1ac], eax
jg 0x1003b24c
mov dword [ebp - 0x81c], 1
jmp 0x1003b253
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x81c], eax
jle 0x1003b273
cmp dword [ebp - 0x1ac], 0
jne 0x1003b273
and dword [ebp - 0x5ec], 0
jmp 0x1003b27d
mov dword [ebp - 0x5ec], 1
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0x92c], eax
mov eax, dword [ebp - 0x92c]
mov dword [ebp - 0x5f4], eax
push 2
lea ecx, [ebp - 0xe8c]
call fcn.1000f296
mov ecx, dword [ebp - 0x5f4]
mov dword [eax], ecx
mov esi, dword [ebp - 0x1ac]
push 1
lea ecx, [ebp - 0xdc8]
call fcn.1000f296
mov ecx, dword [ebp - 0x5f4]
sub ecx, dword [eax]
add ecx, esi
cmp dword [ebp - 0x1ac], ecx
jl 0x1003b2e1
mov eax, 0xb1ed
test eax, eax
jne 0x1003b2e1
and dword [ebp - 0x824], 0
jmp 0x1003b2eb
mov dword [ebp - 0x824], 1
mov eax, dword [ebp - 0x824]
mov dword [ebp - 0xca0], eax
mov byte [ebp - 0x183], 0
push 0x7322
push 0x8ec
push 0x58f3
push 0x478d
push 0x2807
push 0x78ab
lea eax, [ebp - 0x183]
push eax
push 0x369a
push 0
push 0x34ab
push 0x34f3
push 1
push 0x2b7e
push 0x4847
push 0x757a
call fcn.10029e04
add esp, 0x3c
jmp 0x1003b170
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xdc8]
call fcn.1000f22f
jmp 0x1003b084
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xe8c]
call fcn.1000f22f
mov dword [ebp - 0x218], 0
jmp 0x1003b38e
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 3
jge 0x1003b3b0
push dword [ebp - 0x218]
lea ecx, [ebp - 0x10c4]
call fcn.1000f296
mov dword [eax], 0xfffffffd
jmp 0x1003b381
mov dword [ebp - 0x240], 0
jmp 0x1003b3c9
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0xf
jl 0x1003b834
mov dword [ebp - 0x49c], 0
mov dword [ebp - 0x498], 0
mov dword [ebp - 0x494], 0
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x460], 9
mov dword [ebp - 0xfbc], 1
mov dword [ebp - 0xc78], 0xfffffff7
mov dword [ebp - 0x2c8], 0
jmp 0x1003b435
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 3
jge 0x1003b451
mov eax, dword [ebp - 0x2c8]
mov dword [ebp + eax*4 - 0xa88], 0xfffffffc
jmp 0x1003b428
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x49c], 2
jmp 0x1003b47f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x49c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x49c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x49c], 0
jl 0x1003b5a8
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x49c]
mov ecx, dword [ebp + ecx*4 - 0xa88]
cmp dword [ebp + eax - 0xa88], ecx
jg 0x1003b4c2
mov dword [ebp - 0x5fc], 1
jmp 0x1003b4c9
and dword [ebp - 0x5fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x49c]
mov eax, dword [ebp + eax*4 - 0xa88]
cmp eax, dword [ebp - 0x5fc]
jge 0x1003b501
mov dword [ebp - 0x460], 1
cmp dword [ebp - 0x460], 0
jne 0x1003b501
and dword [ebp - 0x9b4], 0
jmp 0x1003b50b
mov dword [ebp - 0x9b4], 1
cmp dword [ebp - 0x9b4], 0xffffffff
je 0x1003b520
mov dword [ebp - 0xb20], 1
jmp 0x1003b527
and dword [ebp - 0xb20], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x49c]
mov eax, dword [ebp + eax*4 - 0xa88]
mov dword [ebp - 0xfc4], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x49c]
mov eax, dword [ebp + eax - 0xa88]
mov dword [ebp + ecx*4 - 0xa88], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x49c]
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x49c]
cmp dword [ebp + eax*4 - 0xa88], ecx
jge 0x1003b590
mov dword [ebp - 0x604], 1
jmp 0x1003b597
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x460], eax
jmp 0x1003b464
push 0
push 0
push 1
push 0x78c6
lea eax, [ebp - 0xc78]
push eax
call fcn.1002e963
add esp, 0x14
mov byte [ebp - 0x165], 0
movzx eax, byte [ebp - 0x165]
test eax, eax
je 0x1003b82f
push 3
lea ecx, [ebp - 0xdbc]
call fcn.1000f19e
mov byte [ebp - 4], 0x11
push 4
lea ecx, [ebp - 0xd5c]
call fcn.1000f19e
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x1b4], 0x21ec2184
mov dword [ebp - 0x1ec], 0
mov dword [ebp - 0xcac], 4
mov dword [ebp - 0xb30], 0xffffffff
push 0x1a23
push 0
lea eax, [ebp - 0xdbc]
push eax
push 0x3284
push 0x23fc
push 0xe96
push 0
lea eax, [ebp - 0xb28]
push eax
call fcn.1002af9a
add esp, 0x20
push 0x7e43
push 0
push 0x26f5
push 0x26e5
push 0x48a2
push 0
push 0x4aa4
lea eax, [ebp - 0xb28]
push eax
push 0x244f
push 0x523a
push 0x3f0e
push 0x99f
lea eax, [ebp - 0xd5c]
push eax
push 0x2886
push 1
push 0x5b12
push 0x2e66
call fcn.10032b28
add esp, 0x44
push 0x2146
lea eax, [ebp - 0x1ec]
push eax
lea eax, [ebp - 0xdbc]
push eax
push 0
push 1
push 0x7fd
lea eax, [ebp - 0x1b4]
push eax
push 0
push 0x471b
lea eax, [ebp - 0xd5c]
push eax
push 0x51da
call fcn.100442ee
add esp, 0x2c
mov dword [ebp - 0x1b4], 0
jmp 0x1003b6ff
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jg 0x1003b7f8
mov dword [ebp - 0xc80], 0xffffffff
mov dword [ebp - 0x1ec], 2
jmp 0x1003b72f
mov eax, dword [ebp - 0x1ec]
dec eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0
jl 0x1003b7f3
mov dword [ebp - 0xb38], 0x2449ef
mov dword [ebp - 0x82c], 0x130268d9
mov dword [ebp - 0xca4], 0x1e9426ce
push 0x1752
lea eax, [ebp - 0x1ec]
push eax
lea eax, [ebp - 0x1b4]
push eax
push 0
lea eax, [ebp - 0xd5c]
push eax
lea eax, [ebp - 0xca4]
push eax
push 1
push 0
push 0x2525
lea eax, [ebp - 0xb30]
push eax
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0xdbc]
push eax
push 0x54ea
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0xb38]
push eax
lea eax, [ebp - 0xcac]
push eax
push 0x4f48
push 0x1dc1
call fcn.1002a677
add esp, 0x48
lea eax, [ebp - 0x82c]
push eax
push 0x76be
push 0x59da
push 0
push 0x18ee
push 1
push 0x1d0d
call fcn.100374e6
add esp, 0x1c
jmp 0x1003b722
jmp 0x1003b6f2
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xd5c]
call fcn.1000f22f
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xdbc]
call fcn.1000f22f
push 0x1e2b
push 0x786
push 0
push 0x4cd
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
jmp 0x1003b3bc
push 1
push 1
push 0
lea eax, [ebp - 0xb40]
push eax
call fcn.100332bd
add esp, 0x10
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x10c4]
call fcn.1000f22f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10d4]
call fcn.1000f22f
jmp 0x1003cc70
mov dword [ebp - 0xc88], 1
mov dword [ebp - 0x358], 0
jmp 0x1003b88f
mov eax, dword [ebp - 0x358]
inc eax
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 3
jge 0x1003b8ab
mov eax, dword [ebp - 0x358]
mov dword [ebp + eax*4 - 0x12c8], 0xffffffff
jmp 0x1003b882
lea eax, [ebp - 0xc88]
push eax
push 0
push 1
push 0x5ffc
push 0x589d
push 0x61fe
push 0
push 0x77bf
push 0x68be
call fcn.1003110b
add esp, 0x24
mov dword [ebp - 0xb80], 0x23dd
mov dword [ebp - 0x238], 0x68ec0ae9
mov dword [ebp - 0xb48], 0x14ac
cmp dword [ebp - 0xb48], 0xd0c
jge 0x1003bb49
xor eax, eax
inc eax
je 0x1003bb49
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x320]
push eax
mov ecx, 0x1065b2b0
call fcn.1000ed56
mov ecx, eax
call fcn.1000ed56
cmp dword [ebp - 0x320], 0
jne 0x1003b946
cmp dword [ebp - 0x3b8], 0
jne 0x1003b946
jmp 0x1003bb49
and dword [ebp - 0x2d0], 0
jmp 0x1003b95c
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x2d0]
cmp eax, dword [ebp - 0x320]
jge 0x1003b984
mov eax, dword [ebp - 0x2d0]
lea eax, [ebp + eax*4 - 0x1468]
push eax
mov ecx, 0x1065b2b0
call fcn.1000ed56
jmp 0x1003b94f
push 0x13ec8
push 0
lea eax, [ebp - 0x164b8]
push eax
call fcn.1000ea1a
add esp, 0xc
and dword [ebp - 0xf4], 0
jmp 0x1003b9b0
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0x320]
jge 0x1003baba
imul eax, dword [ebp - 0xf4], 0x328
lea eax, [ebp + eax - 0x164b8]
push 8
pop ecx
shl ecx, 0
mov dword [eax + ecx], 1
and dword [eax + ecx + 4], 0
and dword [ebp - 0x220], 0
jmp 0x1003b9fb
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
cmp eax, dword [ebp - 0xf4]
jge 0x1003bab5
mov eax, dword [ebp - 0x220]
mov ecx, dword [ebp - 0xf4]
mov eax, dword [ebp + eax*4 - 0x1468]
cmp eax, dword [ebp + ecx*4 - 0x1468]
jl 0x1003ba2b
jmp 0x1003b9ee
mov dword [ebp - 0x1d4], 1
jmp 0x1003ba44
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x1d4]
cmp eax, dword [ebp - 0x3b8]
jge 0x1003bab0
imul eax, dword [ebp - 0xf4], 0x328
lea eax, [ebp + eax - 0x164b8]
imul ecx, dword [ebp - 0x220], 0x328
lea ecx, [ebp + ecx - 0x164b8]
mov edx, dword [ebp - 0x1d4]
mov esi, dword [ebp - 0x1d4]
mov edi, dword [eax + edx*8 + 8]
add edi, dword [ecx + esi*8]
mov eax, dword [eax + edx*8 + 0xc]
adc eax, dword [ecx + esi*8 + 4]
imul ecx, dword [ebp - 0xf4], 0x328
lea ecx, [ebp + ecx - 0x164b8]
mov edx, dword [ebp - 0x1d4]
mov dword [ecx + edx*8 + 8], edi
mov dword [ecx + edx*8 + 0xc], eax
jmp 0x1003ba37
jmp 0x1003b9ee
jmp 0x1003b9a3
xorpd xmm0, xmm0
movlpd qword [ebp - 0x48c], xmm0
and dword [ebp - 0x2d8], 0
jmp 0x1003badc
mov eax, dword [ebp - 0x2d8]
inc eax
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x2d8]
cmp eax, dword [ebp - 0x320]
jge 0x1003bb22
imul eax, dword [ebp - 0x2d8], 0x328
lea eax, [ebp + eax - 0x164b8]
mov ecx, dword [ebp - 0x3b8]
mov edx, dword [ebp - 0x48c]
add edx, dword [eax + ecx*8]
mov esi, dword [ebp - 0x488]
adc esi, dword [eax + ecx*8 + 4]
mov dword [ebp - 0x48c], edx
mov dword [ebp - 0x488], esi
jmp 0x1003bacf
push fcn.100137d9
push dword [ebp - 0x488]
push dword [ebp - 0x48c]
mov ecx, 0x1065b1f8
call fcn.10022449
mov ecx, eax
call fcn.1000ef45
jmp 0x1003b907
mov dword [ebp - 0xb50], 0xf06702e6
mov dword [ebp - 0x238], 0
jmp 0x1003bb6c
mov eax, dword [ebp - 0x238]
dec eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0xfffffffb
jge 0x1003bbbd
mov dword [ebp - 0xc90], 1
mov dword [ebp - 0xcb4], 1
push 0x45b1
lea eax, [ebp - 0xcb4]
push eax
push 0x64c2
push 0
push 0
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0xb50]
push eax
lea eax, [ebp - 0xc90]
push eax
call fcn.1002e5a5
add esp, 0x20
jmp 0x1003bb5f
push 0x7f1b
push 0
push 0
call fcn.1002e7c9
add esp, 0xc
mov dword [ebp - 0x348], 0
jmp 0x1003bbe7
mov eax, dword [ebp - 0x348]
dec eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0xffffffeb
jle 0x1003c6d6
mov dword [ebp - 0x11c], 0xfe0a8eac
mov dword [ebp - 0x1e4], 0xf3d4210e
mov dword [ebp - 0x414], 1
push 2
lea ecx, [ebp - 0xd74]
call fcn.1000f19e
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x3c0], 1
mov dword [ebp - 0xb58], 0x1c17
cmp dword [ebp - 0xb58], 0x97c
jge 0x1003bcb3
lea eax, [ebp - 0x410]
push eax
push 0x1000785c
call fcn.1004fe8b
pop ecx
pop ecx
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0xcbc], eax
mov eax, dword [ebp - 0x410]
dec eax
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0xcbc], 0
je 0x1003bcb3
lea eax, [ebp - 0xb60]
push eax
lea eax, [ebp - 0xc98]
push eax
push 0x100079c4
call fcn.1004fe8b
add esp, 0xc
push dword [ebp - 0xb60]
mov eax, dword [ebp - 0xc98]
dec eax
push eax
push 0x10007a44
call fcn.1005018c
add esp, 0xc
jmp 0x1003bc59
mov dword [ebp - 0x200], 1
mov dword [ebp - 0x624], 0
mov dword [ebp - 0xbec], 0xfffffff6
mov dword [ebp - 0x2e0], 0
jmp 0x1003bcea
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 2
jge 0x1003bd0c
push dword [ebp - 0x2e0]
lea ecx, [ebp - 0xd74]
call fcn.1000f296
mov dword [eax], 0x9753589f
jmp 0x1003bcdd
mov dword [ebp - 0x11c], 0
jmp 0x1003bd25
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 9
jg 0x1003bf62
mov dword [ebp - 0xec], 0xfffd
mov dword [ebp - 0x1bc], 1
mov dword [ebp - 0xb70], 0x5309757a
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xfcc], eax
mov dword [ebp - 0x1e4], 0xfffffffe
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0xfd4], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xfdc], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xfe4], eax
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0xec], eax
je 0x1003bda4
mov dword [ebp - 0x60c], 1
jmp 0x1003bdab
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x60c], eax
jle 0x1003bdc5
mov dword [ebp - 0x934], 1
jmp 0x1003bdcc
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x934], eax
je 0x1003bde6
mov dword [ebp - 0x614], 1
jmp 0x1003bded
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x614]
sub eax, dword [ebp - 0x414]
je 0x1003bf52
mov dword [ebp - 0xb78], 0xffffffff
mov dword [ebp - 0xec], 0
jmp 0x1003be22
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 1
jg 0x1003bf50
mov dword [ebp - 0x834], 0xffff
mov dword [ebp - 0xb68], 0xfffffffe
mov dword [ebp - 0xcc4], 0xffffffff
push 4
lea ecx, [ebp - 0xec8]
call fcn.1000f19e
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0xec8]
push eax
lea eax, [ebp - 0xfec]
push eax
push 1
push 0x26ae
push 1
call fcn.10029d42
add esp, 0x14
push 1
push 0x75d8
lea eax, [ebp - 0x834]
push eax
push 0
push 0x2b15
push 0x37b8
push 0
push 0x1b00
call fcn.10037320
add esp, 0x20
mov dword [ebp - 0x1bc], 0
jmp 0x1003bebf
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 1
jg 0x1003bf3c
mov dword [ebp - 0xbe8], 0
lea eax, [ebp - 0xd74]
push eax
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0xec8]
push eax
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0xb68]
push eax
lea eax, [ebp - 0xcc4]
push eax
push 0xca6
lea eax, [ebp - 0x1bc]
push eax
push 1
lea eax, [ebp - 0xb70]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
lea eax, [ebp - 0xbe8]
push eax
lea eax, [ebp - 0x3c0]
push eax
lea eax, [ebp - 0xb78]
push eax
call fcn.10029e04
add esp, 0x3c
jmp 0x1003beb2
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xec8]
call fcn.1000f22f
jmp 0x1003be15
jmp 0x1003bf5d
cmp dword [ebp - 0x1bc], 0
je 0x1003bf5d
jmp 0x1003bf62
jmp 0x1003bd18
mov dword [ebp - 0x3c0], 0x463028ec
cmp dword [ebp - 0x3c0], 0
je 0x1003c00b
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0xff4], eax
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x624], eax
je 0x1003bf9f
mov dword [ebp - 0x61c], 1
jmp 0x1003bfa6
and dword [ebp - 0x61c], 0
push 0
lea ecx, [ebp - 0xd74]
call fcn.1000f296
mov eax, dword [eax]
cmp eax, dword [ebp - 0x61c]
jl 0x1003bfc9
mov dword [ebp - 0xa50], 1
jmp 0x1003bfd0
and dword [ebp - 0xa50], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0xa50], eax
jg 0x1003bfea
mov dword [ebp - 0x83c], 1
jmp 0x1003bff1
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x624]
cmp dword [ebp - 0x83c], eax
jge 0x1003c00b
mov dword [ebp - 0x62c], 1
jmp 0x1003c012
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x62c]
sub eax, 8
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x200], eax
je 0x1003c03b
mov dword [ebp - 0x93c], 1
jmp 0x1003c042
and dword [ebp - 0x93c], 0
mov eax, dword [ebp - 0xbec]
cmp dword [ebp - 0x93c], eax
jle 0x1003c05c
mov dword [ebp - 0x634], 1
jmp 0x1003c063
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x414]
add ecx, dword [ebp - 0x634]
sub eax, ecx
mov dword [ebp - 0x11c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd74]
call fcn.1000f22f
push 1
push 0x480a
push 0x217a
push 0x5d16
push 0
push 1
lea eax, [ebp - 0xb80]
push eax
push 0x50da
push 0x7ea9
call fcn.100375ce
add esp, 0x24
mov dword [ebp - 0x328], 0
jmp 0x1003c0d3
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 6
jle 0x1003c6d1
mov dword [ebp - 0x214], 0
jmp 0x1003c0f9
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 3
jge 0x1003c6cc
mov dword [ebp - 0x7c], 0x4d9e
mov dword [ebp - 0x20c], 0xffffffff
push 4
lea ecx, [ebp - 0x46c]
call fcn.1000f19e
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x3c8], 0xd2da
mov dword [ebp - 0x1c4], 3
mov dword [ebp - 0xbfc], 0xfafe
mov dword [ebp - 0x2e8], 0
jmp 0x1003c162
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 4
jge 0x1003c184
push dword [ebp - 0x2e8]
lea ecx, [ebp - 0x46c]
call fcn.1000f296
mov dword [eax], 0xe0710dd0
jmp 0x1003c155
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xffc], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x1004], eax
push 3
lea ecx, [ebp - 0x46c]
call fcn.1000f296
cmp dword [eax], 0x653d
jl 0x1003c1b7
mov dword [ebp - 0x844], 1
jmp 0x1003c1be
and dword [ebp - 0x844], 0
push 3
lea ecx, [ebp - 0x46c]
call fcn.1000f296
mov ecx, dword [ebp - 0x844]
cmp ecx, dword [eax]
jle 0x1003c1e1
mov dword [ebp - 0x63c], 1
jmp 0x1003c1e8
and dword [ebp - 0x63c], 0
mov esi, dword [ebp - 0x7c]
push 0
lea ecx, [ebp - 0x46c]
call fcn.1000f296
mov ecx, dword [ebp - 0x63c]
imul ecx, dword [eax]
cmp esi, ecx
jne 0x1003c218
push 8
pop eax
test eax, eax
je 0x1003c218
mov dword [ebp - 0x9bc], 1
jmp 0x1003c21f
and dword [ebp - 0x9bc], 0
push 3
lea ecx, [ebp - 0x46c]
call fcn.1000f296
mov ecx, dword [ebp - 0x9bc]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x7c]
jne 0x1003c245
mov dword [ebp - 0xbf4], 1
jmp 0x1003c24c
and dword [ebp - 0xbf4], 0
mov eax, dword [ebp - 0x3c8]
inc eax
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x100c], eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x1014], eax
cmp dword [ebp - 0x7c], 0x187
jge 0x1003c289
cmp dword [ebp - 0x7c], 0
jne 0x1003c289
and dword [ebp - 0x644], 0
jmp 0x1003c293
mov dword [ebp - 0x644], 1
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x644], eax
jge 0x1003c2aa
mov dword [ebp - 0x84c], 1
jmp 0x1003c2b1
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x84c], eax
je 0x1003c2c8
mov dword [ebp - 0x64c], 1
jmp 0x1003c2cf
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x7c]
add eax, dword [ebp - 0x64c]
cmp eax, 0x4b54c5f6
jg 0x1003c2eb
mov dword [ebp - 0xb88], 1
jmp 0x1003c2f2
and dword [ebp - 0xb88], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x7c], eax
jge 0x1003c306
mov dword [ebp - 0x944], 1
jmp 0x1003c30d
and dword [ebp - 0x944], 0
push 3
lea ecx, [ebp - 0x46c]
call fcn.1000f296
mov ecx, dword [ebp - 0x944]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x1c4]
jl 0x1003c337
mov dword [ebp - 0x654], 1
jmp 0x1003c33e
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x1c4]
cmp dword [ebp - 0x654], eax
jge 0x1003c358
mov dword [ebp - 0x854], 1
jmp 0x1003c35f
and dword [ebp - 0x854], 0
push 3
lea ecx, [ebp - 0x46c]
call fcn.1000f296
mov ecx, dword [ebp - 0x854]
cmp ecx, dword [eax]
jne 0x1003c382
mov dword [ebp - 0x65c], 1
jmp 0x1003c389
and dword [ebp - 0x65c], 0
push 2
lea ecx, [ebp - 0x46c]
call fcn.1000f296
mov ecx, dword [ebp - 0x65c]
imul ecx, dword [eax]
add ecx, dword [ebp - 0xbfc]
cmp ecx, 0xb2cfb115
ja 0x1003c3bf
mov eax, 0x30b5
test eax, eax
jne 0x1003c3bf
and dword [ebp - 0xa00], 0
jmp 0x1003c3c9
mov dword [ebp - 0xa00], 1
push 1
lea ecx, [ebp - 0x46c]
call fcn.1000f296
mov ecx, dword [ebp - 0xa00]
mov dword [eax], ecx
mov dword [ebp - 0x1c4], 0x14
jmp 0x1003c3f7
mov eax, dword [ebp - 0x1c4]
dec eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 1
jl 0x1003c6a7
mov dword [ebp - 0xc04], 2
mov dword [ebp - 0xb90], 0x1f4b
cmp dword [ebp - 0xb90], 0x67f
jge 0x1003c61d
push 0x10bfd57c
push 0x10e674a8
push 0x10007860
call fcn.1004fe8b
add esp, 0xc
and dword [ebp - 0x41c], 0
jmp 0x1003c455
mov eax, dword [ebp - 0x41c]
inc eax
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp - 0x41c]
cmp eax, dword [0x10e674a8]
jge 0x1003c4d6
push 0x10e785f8
push 0x100079f8
call fcn.1004fe8b
pop ecx
pop ecx
and dword [ebp - 0x124], 0
jmp 0x1003c48a
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
cmp eax, dword [0x10bfd57c]
jge 0x1003c4d1
imul eax, dword [ebp - 0x124], 0x68
mov ecx, dword [ebp - 0x124]
movsx ecx, byte [ecx + 0x10e785f8]
mov eax, dword [eax + ecx*4 + 0x10e6538c]
inc eax
mov ecx, dword [ebp - 0x124]
movsx ecx, byte [ecx + 0x10e785f8]
imul edx, dword [ebp - 0x124], 0x68
mov dword [edx + ecx*4 + 0x10e6538c], eax
jmp 0x1003c47d
jmp 0x1003c448
and dword [ebp - 0x19c], 0
jmp 0x1003c4ec
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x19c]
cmp eax, dword [0x10bfd57c]
jge 0x1003c56a
and dword [ebp - 0x368], 0
jmp 0x1003c510
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp dword [ebp - 0x368], 0x1a
jge 0x1003c565
imul eax, dword [ebp - 0x19c], 0x68
mov ecx, dword [ebp - 0x368]
cmp dword [eax + ecx*4 + 0x10e65490], 0
je 0x1003c53c
mov dword [ebp - 0x664], 1
jmp 0x1003c543
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax*4 + 0x10714528]
add eax, dword [ebp - 0x664]
mov ecx, dword [ebp - 0x19c]
mov dword [ecx*4 + 0x10714528], eax
jmp 0x1003c503
jmp 0x1003c4df
mov dword [ebp - 0x400], 1
and dword [ebp - 0x3fc], 0
and dword [ebp - 0x1fc], 0
jmp 0x1003c591
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x1fc]
cmp eax, dword [0x10bfd57c]
jge 0x1003c604
mov eax, dword [ebp - 0x1fc]
cmp dword [eax*4 + 0x10714528], 0
jne 0x1003c5bb
mov dword [ebp - 0x85c], 1
jmp 0x1003c5ce
mov eax, dword [ebp - 0x1fc]
mov eax, dword [eax*4 + 0x10714528]
mov dword [ebp - 0x85c], eax
mov eax, dword [ebp - 0x85c]
cdq
push edx
push eax
push dword [ebp - 0x3fc]
push dword [ebp - 0x400]
call fcn.10056140
push 0
push 0x3b9aca07
push edx
push eax
call fcn.10068dd0
mov dword [ebp - 0x400], eax
mov dword [ebp - 0x3fc], edx
jmp 0x1003c584
push dword [ebp - 0x3fc]
push dword [ebp - 0x400]
push 0x10007890
call fcn.1005018c
add esp, 0xc
mov dword [ebp - 0xb98], 0xf0c0ed6
mov dword [ebp - 0x20c], 0xfffffffa
jmp 0x1003c640
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xfffffffa
jne 0x1003c6a2
cmp dword [ebp - 0xc04], 0
jl 0x1003c65e
mov dword [ebp - 0x66c], 1
jmp 0x1003c665
and dword [ebp - 0x66c], 0
imul eax, dword [ebp - 0x66c], 0x8d98
mov dword [ebp - 0xb98], eax
mov byte [ebp - 0x187], 0
movzx eax, byte [ebp - 0x187]
test eax, eax
je 0x1003c6a0
push 0x2b68
push 0
push 0x380d
push 0x2307
call fcn.1004396c
add esp, 0x10
jmp 0x1003c633
jmp 0x1003c3ea
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x46c]
call fcn.1000f22f
mov eax, dword [ebp - 0x214]
mov dword [ebp + eax*4 - 0x1248], 0x2e26595a
jmp 0x1003c0ec
jmp 0x1003c0c6
jmp 0x1003bbda
mov dword [ebp - 0x1a8], 0xe0a8eac8
mov dword [ebp - 0xba0], 0x2aff6358
mov dword [ebp - 0x2f0], 0
jmp 0x1003c703
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 3
jge 0x1003c71f
mov eax, dword [ebp - 0x2f0]
mov dword [ebp + eax*4 - 0x1230], 1
jmp 0x1003c6f6
mov dword [ebp - 0x1a8], 0
jmp 0x1003c738
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0xf
jl 0x1003c8c3
mov dword [ebp - 0x1a0], 1
mov dword [ebp - 0x674], 7
mov dword [ebp - 0x101c], 0xe74e8003
mov dword [ebp - 0x67c], 0
mov dword [ebp - 0xc0c], 7
mov dword [ebp - 0x330], 0
jmp 0x1003c790
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 3
jge 0x1003c7ac
mov eax, dword [ebp - 0x330]
mov dword [ebp + eax*4 - 0x1218], 0xfffffff7
jmp 0x1003c783
mov dword [ebp - 0x1a0], 0xffffffef
jmp 0x1003c7c5
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0xfffffff9
jle 0x1003c8be
mov eax, dword [ebp - 0x1a0]
sub eax, dword [ebp - 0x1a8]
inc eax
jne 0x1003c7f3
cmp dword [ebp - 0x67c], 0
jne 0x1003c7f3
and dword [ebp - 0x864], 0
jmp 0x1003c7fd
mov dword [ebp - 0x864], 1
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x94c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x94c]
mov dword [ebp + eax - 0x1230], ecx
mov eax, dword [ebp - 0x94c]
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x674]
cmp eax, dword [ebp - 0x864]
jg 0x1003c841
mov dword [ebp - 0x9c4], 1
jmp 0x1003c848
and dword [ebp - 0x9c4], 0
mov eax, dword [ebp - 0x67c]
cmp dword [ebp - 0x9c4], eax
jl 0x1003c86b
mov eax, 0xffff
test eax, eax
je 0x1003c86b
mov dword [ebp - 0x684], 1
jmp 0x1003c872
and dword [ebp - 0x684], 0
cmp dword [ebp - 0x684], 0x283d1f0d
je 0x1003c893
cmp dword [ebp - 0x1a8], 0
je 0x1003c893
mov dword [ebp - 0x3d0], 1
jmp 0x1003c89a
and dword [ebp - 0x3d0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3d0]
mov dword [ebp + eax - 0x1218], ecx
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0xc0c], eax
jmp 0x1003c7b8
jmp 0x1003c72b
push 0xe09
push 0xd39
lea eax, [ebp - 0xba0]
push eax
push 0
push 1
push 0x7eb
push 0x4915
push 0x244e
call fcn.1002e5a5
add esp, 0x20
mov byte [ebp - 0x169], 0
mov dword [ebp - 0xc14], 0xffffffff
mov dword [ebp - 0xc1c], 0xfffffff7
mov dword [ebp - 0xbb0], 0x66c93ee
mov dword [ebp - 0xba8], 0xe9fb1c03
push 1
lea eax, [ebp - 0xc14]
push eax
push 0x594a
lea eax, [ebp - 0xba8]
push eax
push 1
lea eax, [ebp - 0xc1c]
push eax
push 1
lea eax, [ebp - 0xbb0]
push eax
push 0x665c
call fcn.1002a31a
add esp, 0x24
mov byte [ebp - 0x168], 0
movzx eax, byte [ebp - 0x168]
test eax, eax
je 0x1003c984
push 0x77fd
push 0
push 0x2826
push 0x1fcf
push 0x390b
push 1
call fcn.1002e84d
add esp, 0x18
movzx eax, byte [ebp - 0x169]
test eax, eax
je 0x1003cc70
mov dword [ebp - 0x2f8], 0
jmp 0x1003c9ac
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 1
jge 0x1003c9c5
mov eax, dword [ebp - 0x2f8]
mov dword [ebp + eax*4 - 0x74], 0xc204e2db
jmp 0x1003c99f
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x74], 3
jmp 0x1003c9ea
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x74]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x74], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x74], 0x10
jl 0x1003cc1c
mov dword [ebp - 0x68c], 0xffff
mov dword [ebp - 0x350], 0xba22e974
push 2
lea ecx, [ebp - 0xef8]
call fcn.1000f19e
mov dword [ebp - 4], 0x16
mov dword [ebp - 0xc24], 4
mov dword [ebp - 0x69c], 0xffffffff
push 1
lea ecx, [ebp - 0xee0]
call fcn.1000f19e
mov byte [ebp - 4], 0x17
push 1
push 0
push 0x47d7
push 0x16c6
push 1
push 0x6d40
lea eax, [ebp - 0xef8]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.1002acf0
add esp, 0x20
mov dword [ebp - 0x21c], 0
jmp 0x1003ca8c
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 1
jge 0x1003caae
push dword [ebp - 0x21c]
lea ecx, [ebp - 0xee0]
call fcn.1000f296
mov dword [eax], 0xfffffffd
jmp 0x1003ca7f
mov byte [ebp - 0x16a], 0
movzx eax, byte [ebp - 0x16a]
test eax, eax
je 0x1003cad2
push 0x25f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x74]
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0
jne 0x1003cb05
mov eax, dword [ebp - 0x350]
imul eax, dword [ebp - 0x350]
test eax, eax
jne 0x1003cb05
and dword [ebp - 0x86c], 0
jmp 0x1003cb0f
mov dword [ebp - 0x86c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x74]
neg eax
cmp eax, dword [ebp - 0x86c]
jge 0x1003cb35
mov eax, 0xffff
test eax, eax
jne 0x1003cb35
and dword [ebp - 0x448], 0
jmp 0x1003cb3f
mov dword [ebp - 0x448], 1
push 1
lea ecx, [ebp - 0xef8]
call fcn.1000f296
mov ecx, dword [ebp - 0x448]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc24]
cmp dword [ebp - 0x448], eax
jle 0x1003cb6e
mov dword [ebp - 0x954], 1
jmp 0x1003cb75
and dword [ebp - 0x954], 0
mov dword [ebp - 0x68c], 0xffff
mov eax, dword [ebp - 0x68c]
cmp eax, dword [ebp - 0x954]
jle 0x1003cb9f
mov eax, 0x45bbbdeb
test eax, eax
jne 0x1003cb9f
and dword [ebp - 0x694], 0
jmp 0x1003cba9
mov dword [ebp - 0x694], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x74]
cmp dword [ebp - 0x694], eax
jg 0x1003cbc7
mov dword [ebp - 0x874], 1
jmp 0x1003cbce
and dword [ebp - 0x874], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x874]
sub ecx, dword [ebp + eax - 0x74]
mov dword [ebp - 0x69c], ecx
mov esi, dword [ebp - 0x69c]
push 0
lea ecx, [ebp - 0xee0]
call fcn.1000f296
mov dword [eax], esi
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xee0]
call fcn.1000f22f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xef8]
call fcn.1000f22f
jmp 0x1003c9d5
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x74]
mov dword [ebp - 0x1024], eax
xor eax, eax
inc eax
je 0x1003cc4a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x74], 0
je 0x1003cc4a
mov dword [ebp - 0xa20], 1
jmp 0x1003cc51
and dword [ebp - 0xa20], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa20]
mov dword [ebp + eax - 0x74], ecx
push 0x1a74
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
or dword [ebp - 0xe4c], 0xffffffff
or dword [ebp - 0xe48], 0xffffffff
or dword [ebp - 0xe44], 0xffffffff
or dword [ebp - 0xe40], 0xffffffff
lea ecx, [ebp - 0x3d9]
call fcn.1000fd8a
push eax
lea eax, [ebp - 0xe3c]
push eax
lea eax, [ebp - 0xe4c]
push eax
lea ecx, [ebp - 0x1274]
call fcn.100226a1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2a8]
call fcn.1002267b
mov dword [ebp - 4], 0x18
mov dword [ebp - 0xb4], 0xffffffff
mov dword [ebp - 0x6b4], 0x196e86ff
mov dword [ebp - 0x300], 0
jmp 0x1003ccf5
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 2
jge 0x1003cd11
mov eax, dword [ebp - 0x300]
mov dword [ebp + eax*4 - 0x1f4], 0
jmp 0x1003cce8
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1f4], 0
jmp 0x1003cd3f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f4]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1f4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1f4], 3
jg 0x1003d289
mov dword [ebp - 0x84], 0xffffffff
mov dword [ebp - 0xbc0], 0x6fc75dfc
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x1f4]
lea ecx, [ebp - 0x2a8]
call fcn.1000f296
cmp dword [eax], 0
je 0x1003cf41
mov dword [ebp - 0x1b0], 0xf0ed1ad6
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x102c], eax
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x1034], eax
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x103c], eax
cmp dword [ebp - 0x1b0], 0
jne 0x1003ce4e
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x1f4]
lea ecx, [ebp - 0x2a8]
call fcn.1000f296
cmp dword [eax], 0xfffffffb
jle 0x1003cdec
mov dword [ebp - 0x6a4], 1
jmp 0x1003cdf3
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x6a4]
add eax, 0x71c097bc
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x1044], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1f4]
mov dword [ebp - 0xf64], eax
mov esi, dword [ebp - 0x1b0]
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x1f4]
lea ecx, [ebp - 0x2a8]
call fcn.1000f296
cmp esi, dword [eax]
jle 0x1003ce4e
and dword [ebp - 0x87c], 0
jmp 0x1003ce58
mov dword [ebp - 0x87c], 1
mov eax, dword [ebp - 0x6b4]
imul eax, dword [ebp - 0x87c]
test eax, eax
je 0x1003ce7e
mov eax, 0x85ec4150
test eax, eax
je 0x1003ce7e
mov dword [ebp - 0x6ac], 1
jmp 0x1003ce85
and dword [ebp - 0x6ac], 0
push 2
lea ecx, [ebp - 0x2a8]
call fcn.1000f296
mov ecx, dword [ebp - 0x6ac]
cmp ecx, dword [eax]
jl 0x1003cea8
mov dword [ebp - 0x95c], 1
jmp 0x1003ceaf
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x1b0]
cmp dword [ebp - 0x95c], eax
jge 0x1003ced2
cmp dword [ebp - 0x84], 0
je 0x1003ced2
mov dword [ebp - 0x884], 1
jmp 0x1003ced9
and dword [ebp - 0x884], 0
mov eax, dword [ebp - 0x6b4]
cmp dword [ebp - 0x884], eax
jle 0x1003cef3
mov dword [ebp - 0xbb8], 1
jmp 0x1003cefa
and dword [ebp - 0xbb8], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x1054], eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x1f4]
lea ecx, [ebp - 0x2a8]
call fcn.1000f296
mov esi, eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x1f4]
lea ecx, [ebp - 0x2a8]
call fcn.1000f296
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1003d284
mov dword [ebp - 0xac], 0xfe3d2f55
mov dword [ebp - 0xc34], 0
push 0
push 0x5e8c
push 0x6605
push 0xefd
push 0x7ccd
push 1
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xb4]
push eax
push 0x2cd
call fcn.1003016f
add esp, 0x24
mov dword [ebp - 0xac], 0
jmp 0x1003cfa1
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xfffffffa
jge 0x1003d284
mov dword [ebp - 0x224], 5
mov dword [ebp - 0x6d4], 0xe38b13f4
mov dword [ebp - 0x84], 0
jmp 0x1003cfdb
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jg 0x1003d27f
mov dword [ebp - 0x338], 0
jmp 0x1003d001
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 4
jge 0x1003d01d
mov eax, dword [ebp - 0x338]
mov dword [ebp + eax*4 - 0x11bc], 0xfffffff6
jmp 0x1003cff4
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
push dword [ebp - 0x84]
lea ecx, [ebp - 0x2a8]
call fcn.1000f296
cmp dword [eax], 0
je 0x1003d1a7
mov dword [ebp - 0x88c], 0xffffffff
mov dword [ebp - 0x9cc], 0xcec8167b
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x1f4]
lea ecx, [ebp - 0x2a8]
call fcn.1000f296
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x1060], eax
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0x1084], eax
push dword [ebp - 0x84]
lea ecx, [ebp - 0x2a8]
call fcn.1000f296
cmp dword [eax], 0xbad9
jl 0x1003d0ad
mov dword [ebp - 0x6bc], 1
jmp 0x1003d0b4
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x9cc], eax
mov esi, dword [ebp - 0x9cc]
push dword [ebp - 0x84]
lea ecx, [ebp - 0x2a8]
call fcn.1000f296
cmp esi, dword [eax]
je 0x1003d0e7
mov dword [ebp - 0xc2c], 1
jmp 0x1003d0ee
and dword [ebp - 0xc2c], 0
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x1150], eax
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x11bc], 0xffffffff
push 2
lea ecx, [ebp - 0x2a8]
call fcn.1000f296
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x1158], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x6c4], eax
push dword [ebp - 0x84]
lea ecx, [ebp - 0x2a8]
call fcn.1000f296
mov ecx, dword [ebp - 0x6c4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c4]
sub eax, dword [ebp - 0xac]
sub eax, dword [ebp - 0x88c]
cmp eax, dword [ebp - 0x224]
je 0x1003d16e
mov dword [ebp - 0x6cc], 1
jmp 0x1003d175
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x6cc], eax
je 0x1003d18f
mov dword [ebp - 0x964], 1
jmp 0x1003d196
and dword [ebp - 0x964], 0
mov eax, dword [ebp - 0x964]
mov dword [ebp - 0x6d4], eax
jmp 0x1003d27a
cmp dword [ebp - 0x6d4], 0
je 0x1003d1b5
jmp 0x1003d27f
mov dword [ebp - 0xb4], 3
jmp 0x1003d1ce
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
jl 0x1003d27a
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x1f4]
lea ecx, [ebp - 0x2a8]
call fcn.1000f296
mov eax, dword [eax]
neg eax
cmp eax, 1
je 0x1003d208
mov dword [ebp - 0x894], 1
jmp 0x1003d20f
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0xbc0]
cmp eax, dword [ebp - 0x894]
jl 0x1003d229
mov dword [ebp - 0x6dc], 1
jmp 0x1003d230
and dword [ebp - 0x6dc], 0
cmp dword [ebp - 0x6dc], 4
jb 0x1003d245
mov dword [ebp - 0xa08], 1
jmp 0x1003d24c
and dword [ebp - 0xa08], 0
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp + eax*4 - 0x11bc]
mov ecx, dword [ebp - 0xc34]
imul ecx, dword [ebp - 0xa08]
sub eax, ecx
mov ecx, dword [ebp - 0xb4]
mov dword [ebp + ecx*4 - 0x11bc], eax
jmp 0x1003d1c1
jmp 0x1003cfce
jmp 0x1003cf94
jmp 0x1003cd24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a8]
call fcn.1000f22f
mov eax, dword [ebp - 0x264]
mov eax, dword [eax + 4]
mov dword [ebp - 0x8d8], eax
mov dword [ebp - 0xf0], 0x73ff82ff
mov dword [ebp - 0xbc], 0x244c
mov dword [ebp - 0x12c], 0xa52b4b5a
mov dword [ebp - 0xe74], 0xfffffffc
mov dword [ebp - 0xe70], 0xfffffffc
mov dword [ebp - 0xe6c], 0xfffffffc
mov dword [ebp - 0xe68], 0xfffffffc
lea ecx, [ebp - 0x3e1]
call fcn.1000fd8a
push eax
lea eax, [ebp - 0xe64]
push eax
lea eax, [ebp - 0xe74]
push eax
lea ecx, [ebp - 0x12a4]
call fcn.100226a1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf10]
call fcn.1002267b
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x308], 0
jmp 0x1003d342
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 3
jge 0x1003d35e
mov eax, dword [ebp - 0x308]
mov dword [ebp + eax*4 - 0x444], 0x951e
jmp 0x1003d335
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x444], 0
jne 0x1003d408
cmp dword [ebp - 0xbc], 0
je 0x1003d388
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x444], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x444]
cmp dword [ebp + eax - 0x444], ecx
jl 0x1003d3af
mov dword [ebp - 0x6e4], 1
jmp 0x1003d3b6
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x6e4]
add eax, 0x1eca6c84
imul eax, dword [ebp - 0xbc]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x444]
jne 0x1003d3e3
mov dword [ebp - 0x89c], 1
jmp 0x1003d3ea
and dword [ebp - 0x89c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x444]
add eax, dword [ebp - 0x89c]
jne 0x1003d408
and dword [ebp - 0x6ec], 0
jmp 0x1003d412
mov dword [ebp - 0x6ec], 1
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x6ec], eax
jg 0x1003d42c
mov dword [ebp - 0x96c], 1
jmp 0x1003d433
and dword [ebp - 0x96c], 0
mov dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0xf0]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x444]
sub eax, dword [ebp - 0x96c]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x444]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x444]
je 0x1003d47f
mov dword [ebp - 0x6f4], 1
jmp 0x1003d486
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0xbc], 0
jmp 0x1003d4ab
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jg 0x1003d768
push 2
lea ecx, [ebp - 0xda4]
call fcn.1000f19e
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x8a4], 1
mov dword [ebp - 0x70c], 6
mov dword [ebp - 0xc3c], 0
push 0
push 0x4850
lea eax, [ebp - 0x1160]
push eax
push 0x5618
lea eax, [ebp - 0xda4]
push eax
call fcn.10044c07
add esp, 0x14
mov dword [ebp - 0x12c], 0
jmp 0x1003d522
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 2
jg 0x1003d568
mov eax, dword [ebp - 0xbc]
cmp dword [ebp + eax*4 - 0x444], 0
je 0x1003d53d
jmp 0x1003d568
lea eax, [ebp - 0xf0]
push eax
push 0x6b32
push 1
lea eax, [ebp - 0xf10]
push eax
push 0
push 0x3697
push 0xc05
call fcn.1002a576
add esp, 0x1c
jmp 0x1003d515
mov dword [ebp - 0xf0], 2
jmp 0x1003d581
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jl 0x1003d754
mov dword [ebp - 0x1b8], 0x4707
push 0
lea ecx, [ebp - 0xda4]
call fcn.1000f296
cmp dword [eax], 0
jne 0x1003d5c3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x444], 0
jne 0x1003d5c3
and dword [ebp - 0x9d4], 0
jmp 0x1003d5cd
mov dword [ebp - 0x9d4], 1
mov dword [ebp - 0x8a4], 0xe9f81a77
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
je 0x1003d60a
cmp dword [ebp - 0x1b8], 0
je 0x1003d60a
mov eax, 0x8c46158e
test eax, eax
je 0x1003d60a
mov dword [ebp - 0x6fc], 1
jmp 0x1003d611
and dword [ebp - 0x6fc], 0
imul eax, dword [ebp - 0x6fc], 0xfffffffe
add eax, dword [ebp - 0x9d4]
cmp eax, 9
jg 0x1003d62f
mov dword [ebp - 0xbc8], 1
jmp 0x1003d636
and dword [ebp - 0xbc8], 0
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x1168], eax
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x1b8], eax
jg 0x1003d65c
mov dword [ebp - 0x704], 1
jmp 0x1003d663
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x704], eax
jle 0x1003d683
cmp dword [ebp - 0x1b8], 0
jne 0x1003d683
and dword [ebp - 0x8ac], 0
jmp 0x1003d68d
mov dword [ebp - 0x8ac], 1
mov eax, dword [ebp - 0x8ac]
mov dword [ebp - 0x70c], eax
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x974], eax
push 2
lea ecx, [ebp - 0xf10]
call fcn.1000f296
mov ecx, dword [ebp - 0x974]
mov dword [eax], ecx
mov esi, dword [ebp - 0x1b8]
push 1
lea ecx, [ebp - 0xda4]
call fcn.1000f296
mov ecx, dword [ebp - 0x974]
sub ecx, dword [eax]
add ecx, esi
cmp dword [ebp - 0x1b8], ecx
jl 0x1003d6f1
mov eax, 0xb1ed
test eax, eax
jne 0x1003d6f1
and dword [ebp - 0x714], 0
jmp 0x1003d6fb
mov dword [ebp - 0x714], 1
mov eax, dword [ebp - 0x714]
mov dword [ebp - 0xc3c], eax
mov byte [ebp - 0x16b], 0
movzx eax, byte [ebp - 0x16b]
test eax, eax
je 0x1003d74f
push 0x5a33
push 0x12e3
push 0x5ea7
push 1
push 1
push 0x1130
push 0xa67
push 0
push 0x4129
push 0x5814
push 0x51f8
call fcn.100442ee
add esp, 0x2c
jmp 0x1003d574
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0xda4]
call fcn.1000f22f
jmp 0x1003d49e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf10]
call fcn.1000f22f
mov dword [ebp - 0xde0], 0xfffffffc
mov dword [ebp - 0xddc], 0xfffffffc
mov dword [ebp - 0xdd8], 0xfffffffc
mov dword [ebp - 0xdd4], 0xfffffffc
mov dword [ebp - 0x1c0], 0x29a3df60
mov byte [ebp - 0x178], 0
movzx eax, byte [ebp - 0x178]
test eax, eax
je 0x1003d7d6
push 1
push 0x5a21
push 0x2afc
push 0x53bd
push 0
call fcn.1002aeae
add esp, 0x14
mov dword [ebp - 0x1c0], 0
jmp 0x1003d7ef
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 3
jg 0x1003d836
mov dword [ebp - 0xbd0], 0xfffffffb
mov eax, dword [ebp - 0x1c0]
mov eax, dword [ebp + eax*4 - 0xde0]
mov dword [ebp - 0x8b4], eax
mov eax, dword [ebp - 0x1c0]
mov ecx, dword [ebp - 0x8b4]
mov dword [ebp + eax*4 - 0xde0], ecx
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0xbd0], eax
jmp 0x1003d7e2
mov dword [ebp - 0xbd8], 0xe0648261
mov dword [ebp - 0xc44], 2
push 0x43f9
push 1
push 0
push 0x640e
lea eax, [ebp - 0xc44]
push eax
lea eax, [ebp - 0xbd8]
push eax
call fcn.1002f23f
add esp, 0x18
mov byte [ebp - 0x16d], 0
movzx eax, byte [ebp - 0x16d]
test eax, eax
je 0x1003d8cf
push 0x6b13
push 0x22ce
push 0x2d24
push 0xc3b
push 0x4f02
push 0x11dd
push 0x2ef4
push 0
push 0x44fa
push 0x203e
push 0x1e6a
push 0x7098
push 0
push 1
push 0x74a1
push 0x801
call fcn.10036c6d
add esp, 0x40
push 1
lea ecx, [ebp - 0x1104]
call fcn.1000f19e
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x3c], 0xdebf889e
mov dword [ebp - 0xa10], 0xffffffff
mov dword [ebp - 0xc54], 0xcdab
mov dword [ebp - 0x298], 0
jmp 0x1003d917
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 1
jge 0x1003d930
mov eax, dword [ebp - 0x298]
mov dword [ebp + eax*4 - 0x10], 0xfffffffe
jmp 0x1003d90a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x10], 0
jmp 0x1003d955
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x10], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10], 0x1b
je 0x1003dba5
mov dword [ebp - 0x9c], 0xbf390197
mov dword [ebp - 0x72c], 1
mov dword [ebp - 0x2ac], 0
jmp 0x1003d993
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 4
jge 0x1003d9af
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0x11d0], 0
jmp 0x1003d986
mov dword [ebp - 0x9c], 0
jmp 0x1003d9c8
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jg 0x1003db6b
mov dword [ebp - 0x2b4], 0xb90f9986
mov dword [ebp - 0xbe4], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11d0]
cmp dword [ebp - 0x9c], eax
jle 0x1003da0a
mov dword [ebp - 0x97c], 1
jmp 0x1003da11
and dword [ebp - 0x97c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2b4]
sub ecx, dword [ebp - 0x2b4]
cmp dword [ebp + eax - 0x11d0], ecx
jle 0x1003da38
mov dword [ebp - 0x71c], 1
jmp 0x1003da3f
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x71c]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jb 0x1003da5a
mov dword [ebp - 0xa40], 1
jmp 0x1003da61
and dword [ebp - 0xa40], 0
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0xa40], eax
jle 0x1003da7b
mov dword [ebp - 0xc4c], 1
jmp 0x1003da82
and dword [ebp - 0xc4c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
mov dword [ebp - 0x1170], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp dword [ebp - 0x2b4], eax
jne 0x1003dab0
mov dword [ebp - 0x724], 1
jmp 0x1003dab7
and dword [ebp - 0x724], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp dword [ebp - 0x724], eax
je 0x1003dad5
mov dword [ebp - 0x8bc], 1
jmp 0x1003dadc
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0x72c], eax
mov eax, dword [ebp - 0x72c]
cmp dword [ebp - 0x97c], eax
jl 0x1003db02
mov dword [ebp - 0x734], 1
jmp 0x1003db09
and dword [ebp - 0x734], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp dword [ebp - 0x734], eax
jl 0x1003db2b
push 2
pop eax
test eax, eax
jne 0x1003db2b
and dword [ebp - 0x8c4], 0
jmp 0x1003db35
mov dword [ebp - 0x8c4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp dword [ebp - 0x8c4], eax
jg 0x1003db53
mov dword [ebp - 0x73c], 1
jmp 0x1003db5a
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0xbe4], eax
jmp 0x1003d9bb
mov dword [ebp - 0x9c], 0
jmp 0x1003db84
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 4
jge 0x1003dba0
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x11d0], 0x86a6c65b
jmp 0x1003db77
jmp 0x1003d940
mov dword [ebp - 0x3c], 0
jmp 0x1003dbb5
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x1003de26
mov dword [ebp - 0x774], 0xd385e397
push 1
lea ecx, [ebp - 0xd8c]
call fcn.1000f19e
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x2bc], 0
jmp 0x1003dbf3
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 1
jge 0x1003dc15
push dword [ebp - 0x2bc]
lea ecx, [ebp - 0xd8c]
call fcn.1000f296
mov dword [eax], 1
jmp 0x1003dbe6
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x10], 0
je 0x1003dc33
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xd8c]
call fcn.1000f22f
jmp 0x1003de26
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x10]
mov dword [ebp - 0x1178], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x10], 0x8394
jg 0x1003dc5c
cmp dword [ebp - 0x3c], 0
jne 0x1003dc5c
and dword [ebp - 0x9e0], 0
jmp 0x1003dc66
mov dword [ebp - 0x9e0], 1
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x10]
cmp eax, dword [ebp - 0x9e0]
jle 0x1003dc81
mov dword [ebp - 0x744], 1
jmp 0x1003dc88
and dword [ebp - 0x744], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp eax, dword [ebp - 0x744]
jne 0x1003dca6
mov dword [ebp - 0x8cc], 1
jmp 0x1003dcad
and dword [ebp - 0x8cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp eax, dword [ebp - 0x8cc]
jle 0x1003dccb
mov dword [ebp - 0x74c], 1
jmp 0x1003dcd2
and dword [ebp - 0x74c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp dword [ebp - 0x74c], eax
jne 0x1003dcf0
mov dword [ebp - 0x984], 1
jmp 0x1003dcf7
and dword [ebp - 0x984], 0
mov eax, dword [ebp - 0xa10]
cmp dword [ebp - 0x984], eax
jge 0x1003dd11
mov dword [ebp - 0x754], 1
jmp 0x1003dd18
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ebp + ecx*4 - 0x10]
add ecx, dword [ebp - 0x754]
cmp dword [ebp + eax*4 - 0x10], ecx
jne 0x1003dd3a
mov dword [ebp - 0x8d4], 1
jmp 0x1003dd41
and dword [ebp - 0x8d4], 0
cmp dword [ebp - 0x8d4], 2
je 0x1003dd5d
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x10], 0
jne 0x1003dd5d
and dword [ebp - 0x75c], 0
jmp 0x1003dd67
mov dword [ebp - 0x75c], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x75c]
sub ecx, dword [ebp + eax - 0x10]
mov eax, dword [ebp - 0x3c]
cmp ecx, dword [ebp + eax*4 - 0x10]
jne 0x1003dd8c
mov dword [ebp - 0x764], 1
jmp 0x1003dd93
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0xa10]
cmp dword [ebp - 0x764], eax
jge 0x1003ddad
mov dword [ebp - 0x8dc], 1
jmp 0x1003ddb4
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0xc54]
cmp dword [ebp - 0x8dc], eax
jge 0x1003ddce
mov dword [ebp - 0x76c], 1
jmp 0x1003ddd5
and dword [ebp - 0x76c], 0
cmp dword [ebp - 0x76c], 7
jb 0x1003ddea
mov dword [ebp - 0x780], 1
jmp 0x1003ddf1
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x774], eax
mov esi, dword [ebp - 0x774]
push 0
lea ecx, [ebp - 0xd8c]
call fcn.1000f296
mov dword [eax], esi
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xd8c]
call fcn.1000f22f
jmp 0x1003dbae
mov dword [ebp - 0xf8], 0xffffffff
mov dword [ebp - 0x2c4], 0xffffffff
and dword [ebp - 0xe38], 0
and dword [ebp - 0xe34], 0
and dword [ebp - 0xe30], 0
and dword [ebp - 0xe2c], 0
lea ecx, [ebp - 0x421]
call fcn.1000fd8a
push eax
lea eax, [ebp - 0xe28]
push eax
lea eax, [ebp - 0xe38]
push eax
lea ecx, [ebp - 0x129c]
call fcn.100226a1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1224]
call fcn.1002267b
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x2c4], 0
jmp 0x1003dea8
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 5
je 0x1003df50
mov dword [ebp - 0x2cc], 0xffffffff
mov byte [ebp - 0x186], 0
movzx eax, byte [ebp - 0x186]
test eax, eax
je 0x1003def8
push 0x1081
push 0x290d
push 1
push 0x6896
push 0x5870
push 0
push 0x7e2d
push 1
call fcn.10030872
add esp, 0x20
mov dword [ebp - 0x2cc], 0
jmp 0x1003df11
mov eax, dword [ebp - 0x2cc]
dec eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 0xfffffffc
jg 0x1003df4b
mov byte [ebp - 0x16f], 0
movzx eax, byte [ebp - 0x16f]
test eax, eax
je 0x1003df49
push 0x9d5
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
jmp 0x1003df04
jmp 0x1003de9b
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1224]
call fcn.1000f22f
mov dword [ebp - 0x2d4], 0
jmp 0x1003df78
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 1
jge 0x1003df97
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0x1104]
call fcn.1000f296
or dword [eax], 0xffffffff
jmp 0x1003df6b
mov dword [ebp - 0x58], 0xfffffffc
push 2
lea ecx, [ebp - 0xa4c]
call fcn.1000f19e
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x4b8], 0xbf5cd53b
mov dword [ebp - 0x68], 0
mov dword [ebp - 0xccc], 0
mov dword [ebp - 0x2dc], 0
jmp 0x1003dfe3
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 2
jge 0x1003e005
push dword [ebp - 0x2dc]
lea ecx, [ebp - 0xa4c]
call fcn.1000f296
mov dword [eax], 0x56915a13
jmp 0x1003dfd6
lea eax, [ebp - 0x68]
push eax
push 0x2288
push 0x523d
push 0
push 0x1bba
call fcn.100442ba
add esp, 0x14
mov dword [ebp - 0x58], 1
jmp 0x1003e032
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x1003e291
mov dword [ebp - 0x3d8], 2
push dword [ebp - 0x58]
lea ecx, [ebp - 0xa4c]
call fcn.1000f296
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0xc5c], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0xbf0], eax
mov eax, dword [ebp - 0x3d8]
dec eax
mov dword [ebp - 0x3d8], eax
mov eax, dword [ebp - 0xc5c]
cmp eax, dword [ebp - 0xbf0]
je 0x1003e090
mov dword [ebp - 0x788], 1
jmp 0x1003e097
and dword [ebp - 0x788], 0
mov eax, 0x75ff
sub eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x788]
jge 0x1003e0b3
mov dword [ebp - 0x4a4], 1
jmp 0x1003e0ba
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x4a4], eax
je 0x1003e0d1
mov dword [ebp - 0x4a8], 1
jmp 0x1003e0d8
and dword [ebp - 0x4a8], 0
mov esi, dword [ebp - 0x4a8]
sub esi, dword [ebp - 0xccc]
push dword [ebp - 0x58]
lea ecx, [ebp - 0xa4c]
call fcn.1000f296
imul esi, dword [eax]
push dword [ebp - 0x58]
lea ecx, [ebp - 0xa4c]
call fcn.1000f296
cmp esi, dword [eax]
jne 0x1003e113
mov dword [ebp - 0x4b0], 1
jmp 0x1003e11a
and dword [ebp - 0x4b0], 0
push dword [ebp - 0x58]
lea ecx, [ebp - 0xa4c]
call fcn.1000f296
mov ecx, dword [ebp - 0x4b0]
imul ecx, dword [eax]
test ecx, ecx
je 0x1003e1ae
mov dword [ebp - 0x68], 0
jmp 0x1003e145
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jg 0x1003e1a9
lea eax, [ebp - 0x4b8]
push eax
push 0x16b6
push 0x16d3
push 0
push 0x3bb1
push 0x3e7c
push 1
push 1
push 0x15ea
push 0x6b21
push 0x6b72
push 0x5e5e
lea eax, [ebp - 0xa4c]
push eax
push 0x1c8d
push 0x2103
push 0x6229
lea eax, [ebp - 0x58]
push eax
push 0x6f27
call fcn.1002a677
add esp, 0x48
jmp 0x1003e13e
jmp 0x1003e28c
push 3
lea ecx, [ebp - 0xd50]
call fcn.1000f19e
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x260], 0
jmp 0x1003e1d8
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 3
jge 0x1003e1fa
push dword [ebp - 0x260]
lea ecx, [ebp - 0xd50]
call fcn.1000f296
mov dword [eax], 0xce5fef40
jmp 0x1003e1cb
mov dword [ebp - 0x68], 0
jmp 0x1003e20a
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jg 0x1003e27d
mov dword [ebp - 0xbf8], 0x27eed050
push 0x3be6
lea eax, [ebp - 0xd50]
push eax
push 0
push 0x745e
push 0x4d6a
push 1
push 0x127c
push 0
call fcn.10030872
add esp, 0x20
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xbf8]
push eax
push 0xab
push 0
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0xa4c]
push eax
push 0x31af
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xd50]
push eax
call fcn.1004489e
add esp, 0x24
jmp 0x1003e203
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xd50]
call fcn.1000f22f
jmp 0x1003e02b
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xa4c]
call fcn.1000f22f
mov dword [ebp - 0xf8], 0
jmp 0x1003e2b9
mov eax, dword [ebp - 0xf8]
dec eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jl 0x1003f1d4
push 2
lea ecx, [ebp - 0x454]
call fcn.1000f19e
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x2e4], 0x8fb0b44c
push 0
push 0x4460
push 1
push 0x468
push 0x30bd
push 0x1db0
lea eax, [ebp - 0x1180]
push eax
push 0x6bfd
push 0x3eb0
push 0x1362
push 0x46f2
push 0x20f
push 0x50cf
push 0x7c00
lea eax, [ebp - 0x454]
push eax
push 0xd23
push 0x4c2c
call fcn.1003296a
add esp, 0x44
mov dword [ebp - 0x2c], 1
jmp 0x1003e353
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x1003e61c
mov dword [ebp - 0xa8], 1
mov dword [ebp - 0xca8], 0x1b870004
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x454]
call fcn.1000f296
mov esi, eax
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x454]
call fcn.1000f296
mov ecx, dword [esi]
sub ecx, dword [eax]
jne 0x1003e3a1
mov dword [ebp - 0x4e8], 1
jmp 0x1003e3a8
and dword [ebp - 0x4e8], 0
or eax, 0xffffffff
je 0x1003e3bf
cmp dword [ebp - 0x2c], 0
je 0x1003e3bf
mov dword [ebp - 0x4c0], 1
jmp 0x1003e3c6
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x4c0]
jne 0x1003e3ec
push 0
lea ecx, [ebp - 0x454]
call fcn.1000f296
cmp dword [eax], 0
jne 0x1003e3ec
and dword [ebp - 0x4c8], 0
jmp 0x1003e3f6
mov dword [ebp - 0x4c8], 1
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x454]
call fcn.1000f296
mov eax, dword [eax]
cmp eax, dword [ebp - 0x4c8]
je 0x1003e41a
mov dword [ebp - 0x4d0], 1
jmp 0x1003e421
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa8], eax
mov esi, dword [ebp - 0xa8]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x454]
call fcn.1000f296
cmp dword [eax], esi
jl 0x1003e451
mov dword [ebp - 0x4d8], 1
jmp 0x1003e458
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x2e4], eax
mov esi, dword [ebp - 0x2e4]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x454]
call fcn.1000f296
imul esi, dword [eax]
cmp esi, dword [ebp - 0x2c]
jg 0x1003e48c
mov dword [ebp - 0x4e0], 1
jmp 0x1003e493
and dword [ebp - 0x4e0], 0
mov esi, dword [ebp - 0x4e0]
sub esi, 0xda8e
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x454]
call fcn.1000f296
cmp esi, dword [eax]
jl 0x1003e4bd
mov dword [ebp - 0x4f0], 1
jmp 0x1003e4c4
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x4e8]
cmp eax, dword [ebp - 0x4f0]
jne 0x1003e4fd
mov byte [ebp - 0x184], 0
push 0
push 0x5fce
push 0x4610
lea eax, [ebp - 0x184]
push eax
push 0x10c1
push 1
call fcn.10048d9d
add esp, 0x18
jmp 0x1003e536
mov dword [ebp - 0xa8], 0
jmp 0x1003e516
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 1
jg 0x1003e536
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x454]
call fcn.1000f296
cmp dword [eax], 0
je 0x1003e534
jmp 0x1003e536
jmp 0x1003e509
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x454]
call fcn.1000f296
cmp dword [eax], 0
jne 0x1003e5f5
cmp dword [ebp - 0x2e4], 0
je 0x1003e5d1
cmp dword [ebp - 0xa8], 0
jne 0x1003e5c5
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0xca8], eax
jl 0x1003e576
mov dword [ebp - 0x4f8], 1
jmp 0x1003e57d
and dword [ebp - 0x4f8], 0
cmp dword [ebp - 0x4f8], 0
jbe 0x1003e592
mov dword [ebp - 0x500], 1
jmp 0x1003e599
and dword [ebp - 0x500], 0
cmp dword [ebp - 0x500], 0x90a
jne 0x1003e5b1
mov dword [ebp - 0x508], 1
jmp 0x1003e5b8
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x508]
sub eax, 0xdf78
je 0x1003e5d1
mov dword [ebp - 0x510], 1
jmp 0x1003e5d8
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x510]
sub eax, 0xfffb
je 0x1003e5ec
push 4
pop eax
test eax, eax
jne 0x1003e5f5
and dword [ebp - 0x518], 0
jmp 0x1003e5ff
mov dword [ebp - 0x518], 1
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x2e4], eax
jmp 0x1003e34c
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x454]
call fcn.1000f22f
mov byte [ebp - 0x10d], 0
mov dword [ebp - 0xc20], 0xfffffff6
mov dword [ebp - 0x11d8], 0xb6069300
mov dword [ebp - 0x2f4], 0xfffffff6
mov dword [ebp - 0x11e0], 0xfffffffd
mov dword [ebp - 0x3e0], 0x563ffaf0
mov dword [ebp - 0xa0], 0xffffffff
push 4
lea ecx, [ebp - 0x10f4]
call fcn.1000f19e
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x11e8], 0xacb8f2ba
mov dword [ebp - 0xc00], 0x20a9
cmp dword [ebp - 0xc00], 0xec4
jge 0x1003e90e
lea eax, [ebp - 0x420]
push eax
mov ecx, 0x1065b2b0
call fcn.1000ed56
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0xce8], eax
mov eax, dword [ebp - 0x420]
dec eax
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0xce8], 0
je 0x1003e90e
lea ecx, [ebp - 0xaac]
call fcn.1000ec0a
mov byte [ebp - 4], 0x22
lea edx, [ebp - 0xaac]
mov ecx, 0x1065b2b0
call fcn.100137d1
xorpd xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
and dword [ebp - 0x60], 0
lea ecx, [ebp - 0xaac]
call fcn.1000ed0d
mov dword [ebp - 0xc08], eax
jmp 0x1003e720
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0xc08]
jge 0x1003e8d2
push dword [ebp - 0x60]
lea ecx, [ebp - 0xaac]
call fcn.1000ecf9
movsx eax, byte [eax]
cmp eax, 0x31
jne 0x1003e75c
mov eax, dword [ebp - 0x1c]
add eax, 2
mov ecx, dword [ebp - 0x18]
adc ecx, 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
jmp 0x1003e8cd
push dword [ebp - 0x60]
lea ecx, [ebp - 0xaac]
call fcn.1000ecf9
movsx eax, byte [eax]
cmp eax, 0x32
jne 0x1003e789
mov eax, dword [ebp - 0x1c]
add eax, 5
mov ecx, dword [ebp - 0x18]
adc ecx, 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
jmp 0x1003e8cd
push dword [ebp - 0x60]
lea ecx, [ebp - 0xaac]
call fcn.1000ecf9
movsx eax, byte [eax]
cmp eax, 0x33
jne 0x1003e7b6
mov eax, dword [ebp - 0x1c]
add eax, 5
mov ecx, dword [ebp - 0x18]
adc ecx, 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
jmp 0x1003e8cd
push dword [ebp - 0x60]
lea ecx, [ebp - 0xaac]
call fcn.1000ecf9
movsx eax, byte [eax]
cmp eax, 0x34
jne 0x1003e7e3
mov eax, dword [ebp - 0x1c]
add eax, 4
mov ecx, dword [ebp - 0x18]
adc ecx, 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
jmp 0x1003e8cd
push dword [ebp - 0x60]
lea ecx, [ebp - 0xaac]
call fcn.1000ecf9
movsx eax, byte [eax]
cmp eax, 0x35
jne 0x1003e810
mov eax, dword [ebp - 0x1c]
add eax, 5
mov ecx, dword [ebp - 0x18]
adc ecx, 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
jmp 0x1003e8cd
push dword [ebp - 0x60]
lea ecx, [ebp - 0xaac]
call fcn.1000ecf9
movsx eax, byte [eax]
cmp eax, 0x36
jne 0x1003e83d
mov eax, dword [ebp - 0x1c]
add eax, 6
mov ecx, dword [ebp - 0x18]
adc ecx, 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
jmp 0x1003e8cd
push dword [ebp - 0x60]
lea ecx, [ebp - 0xaac]
call fcn.1000ecf9
movsx eax, byte [eax]
cmp eax, 0x37
jne 0x1003e867
mov eax, dword [ebp - 0x1c]
add eax, 3
mov ecx, dword [ebp - 0x18]
adc ecx, 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
jmp 0x1003e8cd
push dword [ebp - 0x60]
lea ecx, [ebp - 0xaac]
call fcn.1000ecf9
movsx eax, byte [eax]
cmp eax, 0x38
jne 0x1003e891
mov eax, dword [ebp - 0x1c]
add eax, 7
mov ecx, dword [ebp - 0x18]
adc ecx, 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
jmp 0x1003e8cd
push dword [ebp - 0x60]
lea ecx, [ebp - 0xaac]
call fcn.1000ecf9
movsx eax, byte [eax]
cmp eax, 0x39
jne 0x1003e8bb
mov eax, dword [ebp - 0x1c]
add eax, 6
mov ecx, dword [ebp - 0x18]
adc ecx, 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
jmp 0x1003e8cd
mov eax, dword [ebp - 0x1c]
add eax, 6
mov ecx, dword [ebp - 0x18]
adc ecx, 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
jmp 0x1003e719
push fcn.100137d9
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
mov ecx, 0x1065b1f8
call fcn.10022449
mov edx, 0x10007f14
mov ecx, eax
call fcn.10022d5e
mov ecx, eax
call fcn.1000ef45
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xaac]
call fcn.1000ec6d
jmp 0x1003e6b4
mov dword [ebp - 0x5a8], 0
mov dword [ebp - 0xc10], 0xa2fc53d8
mov dword [ebp - 0xcb8], 0xbf4d75db
mov dword [ebp - 0x98], 0
jmp 0x1003e945
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x1003e961
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x1264], 0xae355683
jmp 0x1003e938
mov dword [ebp - 0x98], 0
jmp 0x1003e97a
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x1003e996
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x478], 0x3606de71
jmp 0x1003e96d
push 0x5980
push 0x12af
push 0x442e
push 1
push 0x2276
push 0x3d9f
push 1
push 1
lea eax, [ebp - 0x10f4]
push eax
push 0x47fc
push 0x7814
push 0x1fee
push 0x617b
push 0x1d9a
push 0x237f
push 0x4a24
push 0x39b0
lea eax, [ebp - 0x98]
push eax
call fcn.1002a677
add esp, 0x48
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x478], 0
jmp 0x1003ea21
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x478]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x478], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x478], 1
jg 0x1003eb04
mov dword [ebp - 0x11f0], 0
mov dword [ebp - 0x11f8], 0xfffffffc
mov dword [ebp - 0x1200], 9
mov dword [ebp - 0x11ec], 0xffffffff
mov dword [ebp - 0x1068], 0x3dc0e3e7
mov dword [ebp - 0x116c], 0xe82aa9da
push 1
lea ecx, [ebp - 0x10e4]
call fcn.1000f19e
mov byte [ebp - 4], 0x23
mov dword [ebp - 0xcb0], 0xfffffff9
mov dword [ebp - 0x2ec], 0
jmp 0x1003eaa5
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 1
jge 0x1003eac7
push dword [ebp - 0x2ec]
lea ecx, [ebp - 0x10e4]
call fcn.1000f296
mov dword [eax], 1
jmp 0x1003ea98
push 0
push 1
push 0xe63
lea eax, [ebp - 0xcb0]
push eax
push 1
push 0x6102
push 0x18d5
push 0x440d
call fcn.1002acf0
add esp, 0x20
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x10e4]
call fcn.1000f22f
jmp 0x1003ea06
mov dword [ebp - 0x2f4], 0
jmp 0x1003eb1d
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 7
je 0x1003ee73
mov dword [ebp - 0x70], 1
mov dword [ebp - 0x538], 0x8c81983
mov dword [ebp - 0x540], 1
mov dword [ebp - 0xa0], 0
jmp 0x1003eb5e
cmp dword [ebp - 0xa0], 2
jg 0x1003ee6e
mov dword [ebp - 0x550], 0x6a33997
mov dword [ebp - 0xc18], 2
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp + eax*4 - 0x478]
mov dword [ebp - 0xf70], eax
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x70], eax
jg 0x1003ebac
cmp dword [ebp - 0x70], 0
je 0x1003ebac
mov dword [ebp - 0x520], 1
jmp 0x1003ebb3
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0xc10]
cmp dword [ebp - 0x520], eax
jle 0x1003ebcd
mov dword [ebp - 0x528], 1
jmp 0x1003ebd4
and dword [ebp - 0x528], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x478]
cmp dword [ebp - 0x528], eax
jne 0x1003ebf5
mov dword [ebp - 0x530], 1
jmp 0x1003ebfc
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x538], eax
imul eax, dword [ebp - 0x538], 0xeaca
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 0xa3ae4374
je 0x1003ec30
mov dword [ebp - 0x548], 1
jmp 0x1003ec37
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0x550], eax
cmp dword [ebp - 0x550], 0
jne 0x1003ec5c
push 8
pop eax
test eax, eax
jne 0x1003ec5c
and dword [ebp - 0x558], 0
jmp 0x1003ec66
mov dword [ebp - 0x558], 1
cmp dword [ebp - 0x558], 0x355dd176
jle 0x1003ec7e
mov dword [ebp - 0x560], 1
jmp 0x1003ec85
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp + eax*4 - 0x478]
cmp dword [ebp - 0x560], eax
jl 0x1003eca6
mov dword [ebp - 0x568], 1
jmp 0x1003ecad
and dword [ebp - 0x568], 0
cmp dword [ebp - 0x568], 0
jae 0x1003ecc2
mov dword [ebp - 0x570], 1
jmp 0x1003ecc9
and dword [ebp - 0x570], 0
cmp dword [ebp - 0x570], 4
jge 0x1003ecde
mov dword [ebp - 0x578], 1
jmp 0x1003ece5
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x578], eax
jge 0x1003ed05
mov eax, 0xed14
test eax, eax
je 0x1003ed05
mov dword [ebp - 0xd08], 1
jmp 0x1003ed0c
and dword [ebp - 0xd08], 0
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x10b8], eax
mov eax, dword [ebp - 0x5a8]
mov dword [ebp - 0xf78], eax
mov eax, dword [ebp - 0xa0]
cmp dword [ebp + eax*4 - 0x478], 0
jne 0x1003ed4f
cmp dword [ebp - 0xc18], 0
jne 0x1003ed4f
cmp dword [ebp - 0xcb8], 0
jne 0x1003ed4f
and dword [ebp - 0x580], 0
jmp 0x1003ed59
mov dword [ebp - 0x580], 1
cmp dword [ebp - 0x580], 0xd18e14f0
jae 0x1003ed71
mov dword [ebp - 0x588], 1
jmp 0x1003ed78
and dword [ebp - 0x588], 0
cmp dword [ebp - 0x588], 0xfffa
jae 0x1003ed90
mov dword [ebp - 0x590], 1
jmp 0x1003ed97
and dword [ebp - 0x590], 0
cmp dword [ebp - 0x590], 0x7513d964
jge 0x1003edaf
jmp 0x1003eb10
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x10f4]
call fcn.1000f22f
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x1003f1cf
mov dword [ebp - 0x5b0], 0x8de637c5
mov dword [ebp - 0x3e8], 0xd99ea7eb
mov dword [ebp - 0x428], 0xfffffffb
mov dword [ebp - 0x5f8], 0xa0cec519
mov dword [ebp - 0x618], 0xfffffff8
mov dword [ebp - 0xc28], 0
mov dword [ebp - 0x44], 0
jmp 0x1003eedd
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x1003eef3
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xcc], 0x54a
jmp 0x1003eed6
mov dword [ebp - 0x44], 0
jmp 0x1003ef03
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x1003ef19
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xdd0], 0x3fc0233f
jmp 0x1003eefc
mov dword [ebp - 0x44], 0
jmp 0x1003ef29
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x1003ef3f
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x128c], 0x7bd55fd0
jmp 0x1003ef22
mov dword [ebp - 0x3e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcc]
cmp dword [ebp - 0x3e8], eax
jl 0x1003ef6a
mov dword [ebp - 0x5b8], 1
jmp 0x1003ef71
and dword [ebp - 0x5b8], 0
mov dword [ebp - 0x5b0], 0x3648bd92
mov eax, dword [ebp - 0x5b0]
cmp eax, dword [ebp - 0x5b8]
jg 0x1003ef95
mov dword [ebp - 0x45c], 1
jmp 0x1003ef9c
and dword [ebp - 0x45c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x45c]
mov dword [ebp + eax - 0xdd0], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcc]
cmp dword [ebp - 0x45c], eax
je 0x1003efd0
mov dword [ebp - 0x5c0], 1
jmp 0x1003efd7
and dword [ebp - 0x5c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcc]
imul eax, dword [ebp - 0x5c0]
mov dword [ebp - 0x5c8], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5c8]
mov dword [ebp + eax - 0x128c], ecx
cmp dword [ebp - 0x5c8], 0
jae 0x1003f019
mov dword [ebp - 0x5d0], 1
jmp 0x1003f020
and dword [ebp - 0x5d0], 0
cmp dword [ebp - 0x5d0], 1
jne 0x1003f035
mov dword [ebp - 0x5d8], 1
jmp 0x1003f03c
and dword [ebp - 0x5d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcc]
cmp dword [ebp - 0x5d8], eax
jl 0x1003f05d
mov dword [ebp - 0x4a0], 1
jmp 0x1003f064
and dword [ebp - 0x4a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcc]
mov dword [ebp - 0x11f4], eax
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0xf80], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xcc]
cmp dword [ebp + eax - 0xdd0], ecx
jne 0x1003f0b7
mov dword [ebp - 0x5e8], 1
jmp 0x1003f0be
and dword [ebp - 0x5e8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5e8]
sub ecx, dword [ebp + eax - 0xcc]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0xcc]
jl 0x1003f0f5
cmp dword [ebp - 0x3e8], 0
je 0x1003f0f5
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x5f8], eax
cmp dword [ebp - 0x5f8], 0
je 0x1003f126
jmp 0x1003e2ac
mov dword [ebp - 0x1c8], 0x2f67
push 1
lea ecx, [ebp - 0xd68]
call fcn.1000f19e
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x648], 0xbd5de1fc
mov dword [ebp - 0xcc0], 0xfffffffd
mov dword [ebp - 0xd4], 0
jmp 0x1003f21c
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 1
jge 0x1003f23e
push dword [ebp - 0xd4]
lea ecx, [ebp - 0xd68]
call fcn.1000f296
mov dword [eax], 0x41fd9d08
jmp 0x1003f20f
mov dword [ebp - 0xd4], 0
jmp 0x1003f257
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 2
jge 0x1003f273
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x105c], 0x17ab
jmp 0x1003f24a
cmp dword [ebp - 0x1c8], 0
jge 0x1003f288
mov dword [ebp - 0x628], 1
jmp 0x1003f28f
and dword [ebp - 0x628], 0
cmp dword [ebp - 0x1c8], 0
je 0x1003f2ad
cmp dword [ebp - 0x1c8], 0
je 0x1003f2ad
mov dword [ebp - 0x630], 1
jmp 0x1003f2b4
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x628]
sub eax, dword [ebp - 0x630]
sub eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x638], eax
push 0
lea ecx, [ebp - 0xd68]
call fcn.1000f296
mov ecx, dword [ebp - 0x638]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0x638], eax
jne 0x1003f308
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x105c], 0
jne 0x1003f308
and dword [ebp - 0x640], 0
jmp 0x1003f312
mov dword [ebp - 0x640], 1
mov eax, dword [ebp - 0x640]
mov dword [ebp - 0x648], eax
mov eax, dword [ebp - 0x648]
add eax, dword [ebp - 0x1c8]
jne 0x1003f347
push 0
lea ecx, [ebp - 0xd68]
call fcn.1000f296
cmp dword [eax], 0
jne 0x1003f347
and dword [ebp - 0x650], 0
jmp 0x1003f351
mov dword [ebp - 0x650], 1
cmp dword [ebp - 0x650], 6
jg 0x1003f366
mov dword [ebp - 0x658], 1
jmp 0x1003f36d
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0xcc0], eax
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xd68]
call fcn.1000f22f
mov dword [ebp - 0xf8], 0x11
jmp 0x1003f3a1
mov eax, dword [ebp - 0xf8]
dec eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0xffffffe8
je 0x1003fab1
mov dword [ebp - 0xc30], 0x2653
cmp dword [ebp - 0xc30], 0x5ac
jge 0x1003f5a1
mov edx, 0x11382188
mov ecx, 0x1065b2b0
call fcn.100137d1
mov dword [ebp - 0x660], eax
mov eax, dword [ebp - 0x660]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x660]
add ecx, dword [eax + 4]
call fcn.10029886
movzx eax, al
test eax, eax
je 0x1003f5a1
mov edx, 0x10007f1c
mov ecx, 0x11382188
call fcn.10049ba0
movzx eax, al
test eax, eax
je 0x1003f5a1
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x304], eax
and dword [ebp - 0x134], 0
jmp 0x1003f459
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
mov ecx, 0x11382188
call fcn.1000ed0d
cmp dword [ebp - 0x134], eax
jge 0x1003f508
push dword [ebp - 0x134]
mov ecx, 0x11382188
call fcn.1000ecf9
movsx eax, byte [eax]
cmp eax, 0x59
jne 0x1003f494
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
push dword [ebp - 0x134]
mov ecx, 0x11382188
call fcn.1000ecf9
movsx eax, byte [eax]
cmp eax, 0x4e
jne 0x1003f4b9
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
push dword [ebp - 0x134]
mov ecx, 0x11382188
call fcn.1000ecf9
movsx eax, byte [eax]
cmp eax, 0x50
jne 0x1003f4de
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
push dword [ebp - 0x134]
mov ecx, 0x11382188
call fcn.1000ecf9
movsx eax, byte [eax]
cmp eax, 0x41
jne 0x1003f503
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
jmp 0x1003f44c
mov ecx, 0x11382188
call fcn.1000ed0d
xor edx, edx
push 2
pop ecx
div ecx
cmp edx, 1
jne 0x1003f52a
mov dword [ebp - 0x668], 1
jmp 0x1003f531
and dword [ebp - 0x668], 0
mov ecx, 0x11382188
call fcn.1000ed0d
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x668]
cmp dword [ebp - 0x2fc], eax
jl 0x1003f55b
push 0x10007f20
call fcn.100507b6
pop ecx
jmp 0x1003f59c
mov eax, dword [ebp - 0x304]
cmp eax, dword [ebp - 0x22c]
jle 0x1003f576
push 0x10007e1c
call fcn.100507b6
pop ecx
jmp 0x1003f59c
mov eax, dword [ebp - 0x22c]
cmp eax, dword [ebp - 0x304]
jle 0x1003f591
push 0x10007e18
call fcn.100507b6
pop ecx
jmp 0x1003f59c
push 0x10007f2c
call fcn.100507b6
pop ecx
jmp 0x1003f3c8
mov dword [ebp - 0x78], 0x36951ad3
mov dword [ebp - 0x38c], 0xfffffff9
mov dword [ebp - 0x394], 0x7d7c869b
mov dword [ebp - 0x6b0], 0
mov dword [ebp - 0x6a8], 0x61718bc6
mov dword [ebp - 0xc38], 9
mov dword [ebp - 0x6c0], 3
mov dword [ebp - 0x6c8], 0xfffffffb
mov dword [ebp - 0xf60], 0x289aa508
mov dword [ebp - 0xf5c], 0x289aa508
mov dword [ebp - 0xf58], 0x289aa508
mov dword [ebp - 0xf54], 0x289aa508
mov dword [ebp - 0x10c8], 0x9e68fc78
mov byte [ebp - 0x182], 0
movzx eax, byte [ebp - 0x182]
test eax, eax
je 0x1003f641
push 0xae8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [ebp - 0x78], 0
je 0x1003f7b7
xor eax, eax
jne 0x1003f684
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x78], eax
jle 0x1003f663
mov dword [ebp - 0x670], 1
jmp 0x1003f66a
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x78]
sub eax, dword [ebp - 0x670]
jne 0x1003f684
cmp dword [ebp - 0x78], 0
jne 0x1003f684
and dword [ebp - 0xd28], 0
jmp 0x1003f68e
mov dword [ebp - 0xd28], 1
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xf88], eax
cmp dword [ebp - 0x38c], 0xffffffff
jb 0x1003f6ac
mov dword [ebp - 0x678], 1
jmp 0x1003f6b3
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x78]
add eax, dword [ebp - 0x678]
imul eax, eax, 0xf7c6
cmp eax, 0xffff
jbe 0x1003f6d5
mov dword [ebp - 0x680], 1
jmp 0x1003f6dc
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x680]
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x394], eax
jle 0x1003f6ff
mov dword [ebp - 0x688], 1
jmp 0x1003f706
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0x38c]
cmp dword [ebp - 0x688], eax
jle 0x1003f720
mov dword [ebp - 0x690], 1
jmp 0x1003f727
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x690], eax
je 0x1003f73e
mov dword [ebp - 0x698], 1
jmp 0x1003f745
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0x6b0], eax
mov eax, dword [ebp - 0x38c]
cmp dword [ebp - 0x394], eax
jge 0x1003f76b
mov dword [ebp - 0x6a0], 1
jmp 0x1003f772
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x1174], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xf90], eax
cmp dword [ebp - 0x78], 1
jb 0x1003f7a2
cmp dword [ebp - 0x6b0], 0
jne 0x1003f7ab
cmp dword [ebp - 0xc38], 0
je 0x1003f7b7
mov dword [ebp - 0x6b8], 1
jmp 0x1003f7be
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x6b8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp - 0x6c0]
mov dword [ebp - 0x6c8], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x6c8]
mov dword [ebp + eax - 0xf60], ecx
push 4
lea ecx, [ebp - 0xf28]
call fcn.1000f19e
mov byte [ebp - 4], 0x25
mov dword [ebp - 0xcc8], 0x7d1afd06
mov dword [ebp - 0xc40], 9
mov dword [ebp - 0xdc], 0
jmp 0x1003f826
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 4
jge 0x1003f845
push dword [ebp - 0xdc]
lea ecx, [ebp - 0xf28]
call fcn.1000f296
and dword [eax], 0
jmp 0x1003f819
mov dword [ebp - 0xdc], 0
jmp 0x1003f85e
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 3
jge 0x1003f87a
mov eax, dword [ebp - 0xdc]
mov dword [ebp + eax*4 - 0x12d4], 0xd1649bc0
jmp 0x1003f851
push 0x160d
lea eax, [ebp - 0xf28]
push eax
push 0x73dd
lea eax, [ebp - 0xcc8]
push eax
push 0x5c2
lea eax, [ebp - 0xc40]
push eax
push 1
push 0
push 0x223
push 0x48e7
push 0x7d9a
push 0x7b66
call fcn.10030648
add esp, 0x30
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xf28]
call fcn.1000f22f
mov byte [ebp - 0x176], 0
movzx eax, byte [ebp - 0x176]
test eax, eax
je 0x1003faac
mov dword [ebp - 0x13c], 1
mov dword [ebp - 0x39c], 1
mov dword [ebp - 0xab4], 0xffffffff
mov dword [ebp - 0x10d8], 0xfffffff6
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x13c], eax
jg 0x1003f925
mov dword [ebp - 0x6d0], 1
jmp 0x1003f92c
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x6d0]
mov dword [ebp - 0x39c], eax
mov dword [ebp - 0x39c], 1
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0xf98], eax
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x13c], eax
je 0x1003f968
mov dword [ebp - 0x6d8], 1
jmp 0x1003f96f
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0x6d8]
je 0x1003f989
mov dword [ebp - 0x6e0], 1
jmp 0x1003f990
and dword [ebp - 0x6e0], 0
cmp dword [ebp - 0x6e0], 0x3d188047
jg 0x1003f9a8
mov dword [ebp - 0x6e8], 1
jmp 0x1003f9af
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x6e8], eax
je 0x1003f9d2
cmp dword [ebp - 0x13c], 0
je 0x1003f9d2
mov dword [ebp - 0x6f0], 1
jmp 0x1003f9d9
and dword [ebp - 0x6f0], 0
cmp dword [ebp - 0x6f0], 0
jne 0x1003fa13
mov eax, 0x6e5b14f4
test eax, eax
je 0x1003fa13
mov byte [ebp - 0x181], 0
push 0x16e1
push 0x34cb
push 0
lea eax, [ebp - 0x181]
push eax
push 0
push 1
call fcn.10044f25
add esp, 0x18
jmp 0x1003fa7c
mov dword [ebp - 0xabc], 0x56e74e80
mov byte [ebp - 0x166], 0
push 0
push 0x44ab
lea eax, [ebp - 0x166]
push eax
push 0x819
call fcn.10037d1f
add esp, 0x10
lea eax, [ebp - 0xab4]
push eax
push 0xf3f
push 0x4c87
push 0x6ee
push 0x7d39
push 0x7b6c
push 0x6ac2
push 1
lea eax, [ebp - 0xabc]
push eax
push 0x5f96
push 0
call fcn.10033386
add esp, 0x2c
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x1003fa9f
push 0x455
push 0
push 1
call fcn.1002e7c9
add esp, 0xc
push 0xa35
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x1003f394
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1104]
call fcn.1000f22f
push 1
lea ecx, [ebp - 0x1114]
call fcn.1000f19e
mov dword [ebp - 4], 0x26
mov dword [ebp - 0x30c], 0
jmp 0x1003faed
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 1
jge 0x1003fb0f
push dword [ebp - 0x30c]
lea ecx, [ebp - 0x1114]
call fcn.1000f296
mov dword [eax], 0xea7
jmp 0x1003fae0
mov byte [ebp - 0x167], 0
lea eax, [ebp - 0x167]
push eax
push 0x5264
push 0x4c29
push 0x5e04
push 1
push 0x2cc5
push 1
push 0
push 0x345c
call fcn.10030300
add esp, 0x24
mov byte [ebp - 0x11d], 0
push 1
push 1
lea eax, [ebp - 0x11d]
push eax
push 0xa8f
push 1
push 0x3afb
push 0x634e
push 0x1052
call fcn.1002acf0
add esp, 0x20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1114]
call fcn.1000f22f
mov dword [ebp - 0xac4], 0x5b57fd54
lea eax, [ebp - 0xac4]
push eax
push 0x7af6
push 0x7e2f
push 0x3676
push 1
push 0x736f
push 0
push 0x543
call fcn.1002f39a
add esp, 0x20
mov dword [ebp - 0x1d0], 0xffffffff
mov dword [ebp - 0x4c], 0xcec79e67
mov dword [ebp - 0x710], 0xf592
mov dword [ebp - 0x738], 0x40a16501
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x11d4], eax
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x1d0]
cmp eax, 0x2d2c87a7
jle 0x1003fc0a
cmp dword [ebp - 0x4c], 0
je 0x1003fc0a
mov dword [ebp - 0x6f8], 1
jmp 0x1003fc11
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x6f8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x1d0], eax
jle 0x1003fc31
mov dword [ebp - 0x700], 1
jmp 0x1003fc38
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x700]
dec eax
dec eax
cmp dword [ebp - 0x1d0], eax
jle 0x1003fc54
mov dword [ebp - 0xacc], 1
jmp 0x1003fc5b
and dword [ebp - 0xacc], 0
mov eax, dword [ebp - 0x738]
cmp dword [ebp - 0x710], eax
jne 0x1003fc97
cmp dword [ebp - 0x4c], 0
je 0x1003fc97
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1003fc92
push 1
push 1
push 0x553e
call fcn.1002ae0e
add esp, 0xc
jmp 0x1003ff45
mov dword [ebp - 0x314], 0
jmp 0x1003fcb0
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 3
jge 0x1003fccc
mov eax, dword [ebp - 0x314]
mov dword [ebp + eax*4 - 0x484], 2
jmp 0x1003fca3
mov dword [ebp - 0x4c], 0
jmp 0x1003fcdc
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jg 0x1003fcf3
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0x484], 0
je 0x1003fcf1
jmp 0x1003fcf3
jmp 0x1003fcd5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x484], 0
je 0x1003fd1e
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x484], 0
je 0x1003fd1e
mov dword [ebp - 0x728], 1
jmp 0x1003fd25
and dword [ebp - 0x728], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, 0xffff
sub ecx, dword [ebp + eax - 0x484]
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp + eax - 0x484]
sub ecx, dword [ebp - 0x1d0]
cmp ecx, 0x8de
jg 0x1003fd5f
mov dword [ebp - 0x708], 1
jmp 0x1003fd66
and dword [ebp - 0x708], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x484]
cmp dword [ebp - 0x708], eax
jl 0x1003fd82
push 8
pop eax
test eax, eax
je 0x1003fd97
mov eax, 0x603d2cf3
test eax, eax
je 0x1003fd97
mov dword [ebp - 0x718], 1
jmp 0x1003fd9e
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x710]
cmp dword [ebp - 0x718], eax
je 0x1003fdb8
mov dword [ebp - 0x720], 1
jmp 0x1003fdbf
and dword [ebp - 0x720], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x484]
cmp dword [ebp - 0x720], eax
jne 0x1003fde0
push 3
lea ecx, [ebp - 0xa7c]
call fcn.1000f19e
mov dword [ebp - 4], 0x27
mov dword [ebp - 0xd44], 0xec46bc22
mov dword [ebp - 0xd40], 0xec46bc22
mov dword [ebp - 0xd3c], 0xec46bc22
mov dword [ebp - 0xd38], 0xec46bc22
push 1
lea eax, [ebp - 0xa7c]
push eax
push 0xb22
push 0
push 0x4a6c
lea eax, [ebp - 0xfa0]
push eax
call fcn.1002efab
add esp, 0x18
push 1
lea ecx, [ebp - 0xa7c]
call fcn.1000f296
and dword [eax], 0
jmp 0x1003ffdb
push 1
lea ecx, [ebp - 0xa7c]
call fcn.1000f296
mov dword [ebp - 0x7a0], eax
mov eax, dword [ebp - 0x7a0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x7a0]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0xa7c]
call fcn.1000f296
cmp dword [eax], 0x14
jg 0x1004027c
mov dword [ebp - 0x50], 0xd97a888a
push 1
push 0x6c33
push 0x1c93
push 0
push 0x5899
lea eax, [ebp - 0x50]
push eax
push 1
push 0x2fe9
call fcn.10037320
add esp, 0x20
mov dword [ebp - 0x50], 0
jmp 0x1004002e
cmp dword [ebp - 0x50], 0xd
je 0x10040277
push 2
lea ecx, [ebp - 0xd80]
call fcn.1000f19e
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x7b8], 0x3ac25417
mov dword [ebp - 0xadc], 2
mov dword [ebp - 0x31c], 0
jmp 0x10040076
cmp dword [ebp - 0x31c], 2
jge 0x10040098
push dword [ebp - 0x31c]
lea ecx, [ebp - 0xd80]
call fcn.1000f296
mov dword [eax], 0x77045b3
jmp 0x10040069
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x10e8], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xd44]
mov dword [ebp - 0xfa8], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
je 0x100400c8
jmp 0x1003ffb7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa7c]
call fcn.1000f22f
mov eax, dword [ebp - 0x264]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x264]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x117c], 0xdb58e469
mov dword [ebp - 0xfb0], 0x7ad95e17
mov dword [ebp - 0x800], 0xfffffffe
mov dword [ebp - 0x324], 0
jmp 0x100402e0
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 1
jge 0x100402fc
mov eax, dword [ebp - 0x324]
mov dword [ebp + eax*4 - 0x10f8], 0xbf390197
jmp 0x100402d3
mov eax, dword [ebp - 0x800]
inc eax
mov dword [ebp - 0x800], eax
mov byte [ebp - 0x16c], 0
push 0x489e
push 0x8a9
push 0x7fa8
push 0x2971
push 0x2f92
push 0x555c
push 0x549c
push 1
push 0x2f60
push 0x7a03
lea eax, [ebp - 0x16c]
push eax
push 0x4b12
push 0
push 1
push 0x796e
push 0x60e5
call fcn.10036c6d
add esp, 0x40
mov dword [ebp - 0x32c], 0xeaa32b1c
push 1
lea ecx, [ebp - 0xa70]
call fcn.1000f19e
mov dword [ebp - 4], 0x29
mov dword [ebp - 0xae4], 0xfffffffa
mov dword [ebp - 0x830], 1
mov dword [ebp - 0xaec], 0xfffffff7
mov dword [ebp - 0xa4], 0
jmp 0x100403b6
cmp dword [ebp - 0xa4], 1
jge 0x100403d8
push dword [ebp - 0xa4]
lea ecx, [ebp - 0xa70]
call fcn.1000f296
mov dword [eax], 0xe81d534a
jmp 0x100403a9
mov dword [ebp - 0xa4], 0
jmp 0x100403f1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret