Function at 0x1003d492
Capabilities:
Contain obfuscated stackstrings
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10084f2e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa64
push esi
push edi
push 2
lea ecx, [ebp - 0x638]
call fcn.10028d1f
and dword [ebp - 4], 0
mov dword [ebp - 0x264], 0x16d21b18
mov dword [ebp - 0x6e4], 0x1d4b082b
lea eax, [ebp - 0x2c]
push eax
push 0
lea eax, [ebp - 0x638]
push eax
call fcn.1003bc68
add esp, 0xc
mov dword [ebp - 0x2c], 0
jmp 0x1003d4fc
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x1003d512
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x790], 0x3245f1db
jmp 0x1003d4f5
mov dword [ebp - 0x2c], 0
jmp 0x1003d522
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1003d538
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xa70], 0xfffffff9
jmp 0x1003d51b
push 1
lea ecx, [ebp - 0x638]
call fcn.10028dbd
mov dword [eax], 0xffffffe5
jmp 0x1003d571
push 1
lea ecx, [ebp - 0x638]
call fcn.10028dbd
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x378]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x378]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x638]
call fcn.10028dbd
cmp dword [eax], 8
jge 0x1003d697
mov dword [ebp - 0x1b8], 0xd37ad43
mov dword [ebp - 0x6dc], 0xffffffff
mov dword [ebp - 0x938], 0xa61bf079
mov dword [ebp - 0x1b8], 0
jmp 0x1003d5be
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0
jg 0x1003d687
mov dword [ebp - 0x8f4], 0xfffffffa
mov dword [ebp - 0x94c], 0x8593f9be
mov dword [ebp - 0x1d8], 0
jmp 0x1003d5f8
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 3
jge 0x1003d614
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0xa4c], 0x9a2b441a
jmp 0x1003d5eb
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x790], 0
jle 0x1003d630
mov dword [ebp - 0x540], 1
jmp 0x1003d637
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0x264], eax
mov esi, dword [ebp - 0x264]
push 1
lea ecx, [ebp - 0x638]
call fcn.10028dbd
cmp esi, dword [eax]
jl 0x1003d66f
cmp dword [ebp - 0x6dc], 0
je 0x1003d66f
mov dword [ebp - 0x574], 1
jmp 0x1003d676
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x6e4], eax
jmp 0x1003d5b1
cmp dword [ebp - 0x264], 0
je 0x1003d692
jmp 0x1003d697
jmp 0x1003d54d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x638]
call fcn.10028da1
mov eax, dword [0x126777f0]
and eax, 1
jne 0x1003d6dd
mov eax, dword [0x126777f0]
or eax, 1
mov dword [0x126777f0], eax
mov dword [ebp - 4], 1
mov ecx, 0x12677760
call fcn.10043b88
push 0x1008615b
call fcn.1006bb96
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x6ec], 0
mov dword [ebp - 0x6f4], 0x6bde64f
mov dword [ebp - 0x14c], 0
jmp 0x1003d70a
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 1
jge 0x1003d723
mov eax, dword [ebp - 0x14c]
mov dword [ebp + eax*4 - 0x78], 1
jmp 0x1003d6fd
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x78], 0
jne 0x1003d73c
mov dword [ebp - 0x57c], 1
jmp 0x1003d743
and dword [ebp - 0x57c], 0
mov dword [ebp - 0x6ec], 7
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x78], 0x3a6c
cmp dword [ebp - 0x57c], eax
jg 0x1003d76f
mov dword [ebp - 0x578], 1
jmp 0x1003d776
and dword [ebp - 0x578], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x578]
sub ecx, dword [ebp + eax - 0x78]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x78]
jg 0x1003d79e
mov dword [ebp - 0x2cc], 1
jmp 0x1003d7a5
and dword [ebp - 0x2cc], 0
cmp dword [ebp - 0x2cc], 0x92758e92
ja 0x1003d7bd
mov dword [ebp - 0x538], 1
jmp 0x1003d7c4
and dword [ebp - 0x538], 0
cmp dword [ebp - 0x538], 0xfffffff6
je 0x1003d7d9
mov dword [ebp - 0x44c], 1
jmp 0x1003d7e0
and dword [ebp - 0x44c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
sub eax, dword [ebp - 0x44c]
jne 0x1003d804
mov eax, 0x6501874d
test eax, eax
jne 0x1003d804
and dword [ebp - 0x2d4], 0
jmp 0x1003d80e
mov dword [ebp - 0x2d4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
add eax, 0x3c044b15
cmp eax, dword [ebp - 0x2d4]
jg 0x1003d831
mov dword [ebp - 0x50c], 1
jmp 0x1003d838
and dword [ebp - 0x50c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
imul eax, dword [ebp - 0x50c]
mov dword [ebp - 0x6f4], eax
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x1003d86f
push 1
push 0x2296
call fcn.1003b3c6
pop ecx
pop ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x810]
call fcn.10043ac3
mov dword [ebp - 4], 2
mov dword [ebp - 0x20], 0
push 2
lea ecx, [ebp - 0x614]
call fcn.10028d1f
mov byte [ebp - 4], 3
mov dword [ebp - 0x10c], 0xb2f67ab6
mov dword [ebp - 0x58], 0xfffffff6
mov dword [ebp - 0x80], 0x69097d93
mov dword [ebp - 0x19c], 0x8a4198fe
mov dword [ebp - 0x38], 0
jmp 0x1003d8ce
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1003d8ea
push dword [ebp - 0x38]
lea ecx, [ebp - 0x614]
call fcn.10028dbd
mov dword [eax], 0xfffffffa
jmp 0x1003d8c7
mov dword [ebp - 0x38], 0
jmp 0x1003d8fa
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1003d910
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xf8], 0x18158fb5
jmp 0x1003d8f3
cmp dword [ebp - 0x20], 0
je 0x1003d920
cmp dword [ebp - 0x20], 0
jne 0x1003db8d
cmp dword [ebp - 0x20], 0x2c512dc6
jg 0x1003d935
mov dword [ebp - 0x2dc], 1
jmp 0x1003d93c
and dword [ebp - 0x2dc], 0
cmp dword [ebp - 0x2dc], 0xfffffff8
jg 0x1003d951
mov dword [ebp - 0x454], 1
jmp 0x1003d958
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x454]
neg eax
mov dword [ebp - 0x2e4], eax
push 0
lea ecx, [ebp - 0x614]
call fcn.10028dbd
mov ecx, dword [ebp - 0x2e4]
mov dword [eax], ecx
cmp dword [ebp - 0x2e4], 0xf5aee0cd
je 0x1003d993
mov dword [ebp - 0x590], 1
jmp 0x1003d99a
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x590]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x1a812c00
jle 0x1003d9c7
mov eax, 0xc727
test eax, eax
je 0x1003d9c7
mov dword [ebp - 0x2ec], 1
jmp 0x1003d9ce
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x2ec], eax
je 0x1003d9e5
mov dword [ebp - 0x45c], 1
jmp 0x1003d9ec
and dword [ebp - 0x45c], 0
cmp dword [ebp - 0x45c], 0xfffffff7
je 0x1003da01
mov dword [ebp - 0x2f4], 1
jmp 0x1003da08
and dword [ebp - 0x2f4], 0
cmp dword [ebp - 0x2f4], 1
jl 0x1003da1d
mov dword [ebp - 0x514], 1
jmp 0x1003da24
and dword [ebp - 0x514], 0
cmp dword [ebp - 0x514], 0x84ab
jne 0x1003da3c
mov dword [ebp - 0x2fc], 1
jmp 0x1003da43
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x2fc], eax
jge 0x1003da5a
mov dword [ebp - 0x464], 1
jmp 0x1003da61
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x464], eax
jl 0x1003da78
mov dword [ebp - 0x304], 1
jmp 0x1003da7f
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x304]
jl 0x1003da96
mov dword [ebp - 0x570], 1
jmp 0x1003da9d
and dword [ebp - 0x570], 0
cmp dword [ebp - 0x570], 0xa9e1a0e1
jne 0x1003dab5
mov dword [ebp - 0x294], 1
jmp 0x1003dabc
and dword [ebp - 0x294], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x294]
mov dword [ebp + eax - 0xf8], ecx
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x294], eax
je 0x1003dae6
mov dword [ebp - 0x30c], 1
jmp 0x1003daed
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x1003db09
push 1
lea ecx, [ebp - 0x614]
call fcn.10028dbd
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x10c], eax
jg 0x1003db18
cmp dword [ebp - 0x58], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x80], eax
jge 0x1003db2c
mov dword [ebp - 0x46c], 1
jmp 0x1003db33
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x46c]
neg eax
mov ecx, dword [ebp - 0x80]
lea eax, [eax + ecx - 1]
cmp eax, dword [ebp - 0x20]
jg 0x1003db53
mov dword [ebp - 0x314], 1
jmp 0x1003db5a
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x314], eax
jle 0x1003db71
mov dword [ebp - 0x51c], 1
jmp 0x1003db78
and dword [ebp - 0x51c], 0
cmp dword [ebp - 0x51c], 0xa381e168
ja 0x1003db8d
and dword [ebp - 0x31c], 0
jmp 0x1003db97
mov dword [ebp - 0x31c], 1
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x19c], eax
mov eax, 0xfffb
add eax, 0x41f5
imul eax, eax, 0x5c25
test eax, eax
je 0x1003dbd3
mov byte [ebp - 0x6d], 0
movzx eax, byte [ebp - 0x6d]
test eax, eax
je 0x1003dbd1
push 0
push 0x1f94
call fcn.1003bd55
pop ecx
pop ecx
jmp 0x1003dbf0
mov byte [ebp - 0xb1], 0
lea eax, [ebp - 0xb1]
push eax
push 0
push 0x3517
call fcn.1003b45c
add esp, 0xc
mov dword [ebp - 0x80], 1
jmp 0x1003dc00
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jl 0x1003dfec
mov dword [ebp - 0x118], 0x7c508211
mov dword [ebp - 0xc8], 1
push 3
lea ecx, [ebp - 0x5b4]
call fcn.10028d1f
mov byte [ebp - 4], 4
push 0x3d18
push 0
push 0x7cf9
lea eax, [ebp - 0x878]
push eax
lea eax, [ebp - 0x5b4]
push eax
call fcn.1003d227
add esp, 0x14
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf8], 0x9c4d3557
jbe 0x1003dc70
mov dword [ebp - 0x474], 1
jmp 0x1003dc77
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jne 0x1003dca2
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x1003dca2
and dword [ebp - 0x324], 0
jmp 0x1003dcac
mov dword [ebp - 0x324], 1
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x324], eax
jl 0x1003dcc6
mov dword [ebp - 0x5a4], 1
jmp 0x1003dccd
and dword [ebp - 0x5a4], 0
cmp dword [ebp - 0x5a4], 0x5453
je 0x1003dce5
mov dword [ebp - 0x32c], 1
jmp 0x1003dcec
and dword [ebp - 0x32c], 0
cmp dword [ebp - 0x32c], 0
jge 0x1003dd01
mov dword [ebp - 0x47c], 1
jmp 0x1003dd08
and dword [ebp - 0x47c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x880], eax
push 0
lea ecx, [ebp - 0x5b4]
call fcn.10028dbd
mov ecx, dword [ebp - 0x47c]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x5b4]
call fcn.10028dbd
cmp dword [eax], 1
jge 0x1003dd5a
mov dword [ebp - 0x334], 1
jmp 0x1003dd61
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x334], eax
jne 0x1003dd7b
mov dword [ebp - 0x524], 1
jmp 0x1003dd82
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x524], eax
jle 0x1003dd9c
mov dword [ebp - 0x33c], 1
jmp 0x1003dda3
and dword [ebp - 0x33c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
cmp dword [ebp - 0x33c], eax
jle 0x1003ddcd
mov eax, 0xd363bf15
test eax, eax
je 0x1003ddcd
mov dword [ebp - 0x344], 1
jmp 0x1003ddd4
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x484], eax
push 0
lea ecx, [ebp - 0x614]
call fcn.10028dbd
mov ecx, dword [ebp - 0x484]
mov dword [eax], ecx
mov eax, dword [ebp - 0x484]
cmp eax, dword [ebp - 0x344]
je 0x1003de18
cmp dword [ebp - 0xc8], 0
jne 0x1003de18
mov dword [ebp - 0x548], 1
jmp 0x1003de1f
and dword [ebp - 0x548], 0
cmp dword [ebp - 0x548], 0xfffffff9
jle 0x1003de34
mov dword [ebp - 0x34c], 1
jmp 0x1003de3b
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x118]
add eax, dword [ebp - 0x34c]
imul eax, dword [ebp - 0x19c]
add eax, 0x437f
imul eax, eax, 0x9070
cmp eax, dword [ebp - 0x118]
jle 0x1003dea9
mov dword [ebp - 0x6fc], 0xe108d8c4
mov byte [ebp - 0x6f], 0
push 0x2a96
lea eax, [ebp - 0x6f]
push eax
push 0
push 0x1dbc
call fcn.1003baf2
add esp, 0x10
cmp dword [ebp - 0x6fc], 0
je 0x1003dea4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5b4]
call fcn.10028da1
jmp 0x1003dfec
jmp 0x1003dfaa
mov dword [ebp - 0x2a8], 0x49d4
mov dword [ebp - 0x70c], 0x296c032b
mov byte [ebp - 0xbf], 0
push 1
lea eax, [ebp - 0xbf]
push eax
call fcn.1003b409
pop ecx
pop ecx
cmp dword [ebp - 0x2a8], 0
je 0x1003df8b
cmp dword [ebp - 0x58], 0
jne 0x1003df23
imul eax, dword [ebp - 0x2a8], 0
mov dword [ebp - 0x48c], eax
push 1
lea ecx, [ebp - 0x5b4]
call fcn.10028dbd
mov ecx, dword [ebp - 0x48c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc8]
imul eax, dword [ebp - 0x48c]
test eax, eax
jne 0x1003df23
and dword [ebp - 0x354], 0
jmp 0x1003df2d
mov dword [ebp - 0x354], 1
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x354], eax
jne 0x1003df44
mov dword [ebp - 0x52c], 1
jmp 0x1003df4b
and dword [ebp - 0x52c], 0
cmp dword [ebp - 0x52c], 0x25d30f6
jl 0x1003df63
mov dword [ebp - 0x35c], 1
jmp 0x1003df6a
and dword [ebp - 0x35c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
cmp dword [ebp - 0x35c], eax
jge 0x1003df8b
mov dword [ebp - 0x704], 1
jmp 0x1003df92
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x888], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x70c], eax
lea eax, [ebp - 0x5b4]
push eax
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0xc8]
push eax
push 0
lea eax, [ebp - 0x80]
push eax
call fcn.1003bb9b
add esp, 0x1c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5b4]
call fcn.10028da1
jmp 0x1003dbf9
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x614]
call fcn.10028da1
lea eax, [ebp - 0x890]
push eax
lea ecx, [ebp - 0x810]
call fcn.10043b1a
push dword [eax]
lea eax, [ebp - 0x898]
push eax
lea ecx, [ebp - 0x810]
call fcn.10043b2e
push dword [eax]
lea eax, [ebp - 0x8a0]
push eax
lea ecx, [ebp - 0x810]
call fcn.10043b1a
push dword [eax]
mov edx, 0x100390da
lea ecx, [ebp - 0x8a8]
call fcn.10044274
add esp, 0xc
push 4
lea ecx, [ebp - 0x58c]
call fcn.10028d1f
mov byte [ebp - 4], 5
mov dword [ebp - 0xdc], 0xaa32b1ce
push 4
lea ecx, [ebp - 0x7ec]
call fcn.10028d1f
mov byte [ebp - 4], 6
push 0
push 0x348b
lea eax, [ebp - 0x58c]
push eax
push 0x70f7
lea eax, [ebp - 0x108]
push eax
call fcn.1003ceb8
add esp, 0x14
mov dword [ebp - 0x108], 0
jmp 0x1003e0b1
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 4
jge 0x1003e0d3
push dword [ebp - 0x108]
lea ecx, [ebp - 0x7ec]
call fcn.10028dbd
mov dword [eax], 5
jmp 0x1003e0a4
mov dword [ebp - 0xdc], 0
jmp 0x1003e0ec
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 3
jg 0x1003e30e
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0xec], 0xcaad9015
mov dword [ebp - 0x54c], 0xfffffffd
mov dword [ebp - 0x5c], 3
jmp 0x1003e124
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x1003e2f3
mov dword [ebp - 0x8b0], 0xf609d70c
mov dword [ebp - 0x8b8], 0xfffffffb
mov dword [ebp - 0x100], 0xfffffffa
mov dword [ebp - 0x734], 1
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x58c]
call fcn.10028dbd
cmp dword [eax], 0
je 0x1003e171
jmp 0x1003e2f3
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x58c]
call fcn.10028dbd
cmp dword [eax], 0
jne 0x1003e213
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x58c]
call fcn.10028dbd
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x58c]
call fcn.10028dbd
mov eax, dword [eax]
neg eax
sub eax, 0x2e41
jns 0x1003e1be
mov dword [ebp - 0x714], 1
jmp 0x1003e1c5
and dword [ebp - 0x714], 0
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x58c]
call fcn.10028dbd
cmp dword [eax], 7
jne 0x1003e1e4
mov dword [ebp - 0x494], 1
jmp 0x1003e1eb
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x494], 4
jl 0x1003e200
mov dword [ebp - 0x364], 1
jmp 0x1003e207
and dword [ebp - 0x364], 0
cmp dword [ebp - 0x364], 0x1a652065
jle 0x1003e236
mov dword [ebp - 0x8c0], 0xfffffffc
mov dword [ebp - 0x8c8], 0xfffffff8
mov dword [ebp - 0x54c], 1
jmp 0x1003e2ee
mov dword [ebp - 0x71c], 0x919b17c0
mov dword [ebp - 0xec], 3
jmp 0x1003e259
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x1003e2ee
mov dword [ebp - 0x72c], 0x5746ac1
mov dword [ebp - 0x100], 3
jmp 0x1003e289
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jl 0x1003e2e9
mov dword [ebp - 0x724], 1
lea eax, [ebp - 0x71c]
push eax
lea eax, [ebp - 0x7ec]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0x127
push 0
lea eax, [ebp - 0x58c]
push eax
lea eax, [ebp - 0x724]
push eax
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x72c]
push eax
lea eax, [ebp - 0x734]
push eax
lea eax, [ebp - 0x54c]
push eax
call fcn.1003c013
add esp, 0x2c
jmp 0x1003e27c
jmp 0x1003e24c
jmp 0x1003e11d
push 0x1168
push 1
lea eax, [ebp - 0xec]
push eax
call fcn.1003b45c
add esp, 0xc
jmp 0x1003e0df
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x7ec]
call fcn.10028da1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x58c]
call fcn.10028da1
lea ecx, [ebp - 0x810]
call fcn.10039065
mov dword [ebp - 0x500], eax
push 0x79ec
push 0x3485
push 0x4444
push 1
push 0x7e94
call fcn.1003b4af
add esp, 0x14
movzx eax, byte [0x126776c0]
test eax, eax
je 0x1003e7cb
mov ecx, 0x12677760
call fcn.10043c4d
movzx eax, al
test eax, eax
jne 0x1003e7cb
lea eax, [ebp - 0x500]
push eax
lea eax, [ebp - 0x3a4]
push eax
mov ecx, 0x12677760
call fcn.10043c56
mov dword [ebp - 0x154], 1
mov dword [ebp - 0x7a4], 0x8ef6b8f
mov dword [ebp - 0x754], 0x31aa08
mov dword [ebp - 0x744], 0xff63588c
mov dword [ebp - 0x8d0], 0xd2668451
mov dword [ebp - 0x648], 0x3d1f0dfb
mov dword [ebp - 0x8d8], 0xc8cac31e
mov dword [ebp - 0x708], 0xfffb
mov dword [ebp - 0x154], 0xfffffff0
jmp 0x1003e400
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xa
jge 0x1003e4a8
mov dword [ebp - 0x63c], 1
mov dword [ebp - 0x7bc], 0x47d2038
mov dword [ebp - 0x74c], 0xd4a1cf04
mov dword [ebp - 0x73c], 0x6d0c11e0
mov dword [ebp - 0x8e0], 1
mov dword [ebp - 0x6d4], 0x46983c17
lea eax, [ebp - 0x73c]
push eax
push 1
lea eax, [ebp - 0x744]
push eax
lea eax, [ebp - 0x74c]
push eax
push 0x2a46
lea eax, [ebp - 0x754]
push eax
lea eax, [ebp - 0x7bc]
push eax
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x708]
push eax
lea eax, [ebp - 0x6d4]
push eax
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x7a4]
push eax
push 0x2756
call fcn.1003b7b4
add esp, 0x34
jmp 0x1003e3f3
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x1003e4bc
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [ebp - 0x8e8]
push eax
mov ecx, 0x12677760
call fcn.10043c3f
push eax
lea ecx, [ebp - 0x3a4]
call fcn.10043c71
movzx eax, al
test eax, eax
je 0x1003e7cb
mov dword [ebp - 0x88], 0x2ee7
mov dword [ebp - 0x710], 0x58a835a
mov dword [ebp - 0x650], 0x7b5c
mov dword [ebp - 0x49c], 0
mov dword [ebp - 0x718], 0xfffffffd
mov dword [ebp - 0x1a4], 0
jmp 0x1003e52f
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 1
jge 0x1003e54b
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0x4ac], 0xfffffffd
jmp 0x1003e522
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x8f0], eax
push 6
pop eax
test eax, eax
je 0x1003e6a4
mov dword [ebp - 0x2b0], 0x369bd69
mov dword [ebp - 0x38c], 0xfffffff7
mov dword [ebp - 0x4a4], 0xb28787d
cmp dword [ebp - 0x49c], 0xfffffff6
jbe 0x1003e595
mov dword [ebp - 0x36c], 1
jmp 0x1003e59c
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x36c], eax
jl 0x1003e5b6
mov dword [ebp - 0x374], 1
jmp 0x1003e5bd
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x38c]
add eax, dword [ebp - 0x49c]
cmp dword [ebp - 0x374], eax
jl 0x1003e5dd
mov dword [ebp - 0x534], 1
jmp 0x1003e5e4
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x4a4]
cmp dword [ebp - 0x534], eax
jg 0x1003e5fe
mov dword [ebp - 0x37c], 1
jmp 0x1003e605
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x650]
cmp dword [ebp - 0x37c], eax
jge 0x1003e625
cmp dword [ebp - 0x4a4], 0
jne 0x1003e625
and dword [ebp - 0x384], 0
jmp 0x1003e62f
mov dword [ebp - 0x384], 1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x4ac], 0x52c58fb7
mov eax, dword [ebp - 0x2b0]
sub eax, dword [ebp - 0x384]
mov ecx, 0x52c58fb7
sub ecx, eax
mov dword [ebp - 0x658], ecx
mov eax, dword [ebp - 0x710]
mov dword [ebp - 0x788], eax
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x658]
cmp eax, dword [ebp - 0x788]
jge 0x1003e68c
mov dword [ebp - 0x554], 1
jmp 0x1003e693
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x554]
mov dword [ebp - 0x38c], eax
jmp 0x1003e79d
mov dword [ebp - 0x290], 7
mov dword [ebp - 0x668], 0xb6f85a06
mov dword [ebp - 0x88], 0
jmp 0x1003e6d1
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x2a
jle 0x1003e772
mov dword [ebp - 0x660], 0xffffffff
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x8f8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4ac]
cmp dword [ebp - 0x290], eax
jne 0x1003e715
mov dword [ebp - 0x394], 1
jmp 0x1003e71c
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x290]
cmp eax, dword [ebp - 0x394]
jl 0x1003e736
mov dword [ebp - 0x53c], 1
jmp 0x1003e73d
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x53c]
sub eax, dword [ebp - 0x660]
cmp eax, 1
jb 0x1003e75a
mov dword [ebp - 0x39c], 1
jmp 0x1003e761
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x718], eax
jmp 0x1003e6c4
cmp dword [ebp - 0x290], 0xf0c3da55
jne 0x1003e78a
mov dword [ebp - 0x4b4], 1
jmp 0x1003e791
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x668], eax
lea ecx, [ebp - 0x3a4]
call fcn.10043c6b
mov eax, dword [eax + 4]
mov dword [ebp - 0x7ac], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x810]
call fcn.10043b10
mov eax, dword [ebp - 0x7ac]
jmp 0x1004206e
mov dword [ebp - 0x15c], 7
mov dword [ebp - 0x15c], 0
jmp 0x1003e7ee
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xa
jge 0x1003e8c8
push 1
lea ecx, [ebp - 0x764]
call fcn.10028d1f
mov byte [ebp - 4], 7
mov dword [ebp - 0x1ac], 0
jmp 0x1003e825
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 1
jge 0x1003e847
push dword [ebp - 0x1ac]
lea ecx, [ebp - 0x764]
call fcn.10028dbd
mov dword [eax], 0x22124f84
jmp 0x1003e818
push 0
lea ecx, [ebp - 0x764]
call fcn.10028dbd
mov dword [eax], 9
jmp 0x1003e880
push 0
lea ecx, [ebp - 0x764]
call fcn.10028dbd
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp - 0x55c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x55c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x764]
call fcn.10028dbd
cmp dword [eax], 8
jle 0x1003e8b4
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x1003e8b2
push 0x5c5
push 1
call fcn.1003b9eb
pop ecx
pop ecx
jmp 0x1003e85c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x764]
call fcn.10028da1
jmp 0x1003e7e1
and dword [ebp - 0xe8], 0
mov dword [ebp - 0x60], 0xd837
mov dword [ebp - 0x16c], 0xca9869ec
mov dword [ebp - 0x3d4], 1
mov dword [ebp - 0x900], 1
mov dword [ebp - 0x2b4], 1
mov dword [ebp - 0x7b4], 0x51cfd1f2
mov dword [ebp - 0x1bc], 1
mov dword [ebp - 0x114], 0xc7c6f1fd
mov dword [ebp - 0x678], 7
mov dword [ebp - 0x270], 1
mov dword [ebp - 0x164], 0
jmp 0x1003e949
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 3
jge 0x1003e965
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x9c8], 0x860ec01e
jmp 0x1003e93c
cmp dword [ebp - 0x60], 0
jne 0x1003e989
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x908], eax
mov eax, 0x849968cb
test eax, eax
jne 0x1003e989
and dword [ebp - 0x3ac], 0
jmp 0x1003e993
mov dword [ebp - 0x3ac], 1
mov eax, dword [ebp - 0x60]
imul eax, dword [ebp - 0x3ac]
imul eax, dword [ebp - 0x60]
mov dword [ebp - 0x16c], eax
xor eax, eax
sub eax, dword [ebp - 0x114]
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x720], eax
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x670]
cmp eax, dword [ebp - 0x720]
je 0x1003e9e8
mov dword [ebp - 0x4bc], 1
jmp 0x1003e9ef
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x60]
sub eax, dword [ebp - 0x4bc]
cmp eax, 0x5734cb44
jge 0x1003ea5c
mov dword [ebp - 0x1bc], 0
jmp 0x1003ea18
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 2
jg 0x1003ea52
mov dword [ebp - 0x60], 2
jmp 0x1003ea31
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x1003ea50
mov byte [ebp - 0x89], 0
lea eax, [ebp - 0x89]
push eax
push 0
call fcn.1003bd89
pop ecx
pop ecx
jmp 0x1003ea2a
jmp 0x1003ea0b
push 0
call fcn.1003c336
pop ecx
jmp 0x1003ea66
mov dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x270]
mov ecx, dword [ebp - 0x270]
dec ecx
mov dword [ebp - 0x270], ecx
cmp eax, 0xa644184
jne 0x1003eb38
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0x910], eax
cmp dword [ebp - 0x3d4], 3
jne 0x1003eaa5
mov dword [ebp - 0x3b4], 1
jmp 0x1003eaac
and dword [ebp - 0x3b4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9c8]
cmp dword [ebp - 0x3b4], eax
jge 0x1003eacd
mov dword [ebp - 0x544], 1
jmp 0x1003ead4
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0x544], eax
jne 0x1003eaee
mov dword [ebp - 0x3bc], 1
jmp 0x1003eaf5
and dword [ebp - 0x3bc], 0
cmp dword [ebp - 0x3bc], 0xffff
je 0x1003eb1f
cmp dword [ebp - 0x114], 0
je 0x1003eb1f
mov eax, 0x5c25cceb
test eax, eax
je 0x1003eb1f
mov dword [ebp - 0x4c4], 1
jmp 0x1003eb26
and dword [ebp - 0x4c4], 0
cmp dword [ebp - 0x4c4], 0
jl 0x1003eb38
and dword [ebp - 0x3c4], 0
jmp 0x1003eb42
mov dword [ebp - 0x3c4], 1
mov eax, dword [ebp - 0x7b4]
cmp dword [ebp - 0x3c4], eax
jle 0x1003eb5c
mov dword [ebp - 0x564], 1
jmp 0x1003eb63
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x564]
jne 0x1003eb7d
mov dword [ebp - 0x3cc], 1
jmp 0x1003eb84
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
jne 0x1003ebab
mov eax, 0xb6ac
test eax, eax
jne 0x1003ebab
and dword [ebp - 0x4cc], 0
jmp 0x1003ebb5
mov dword [ebp - 0x4cc], 1
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x3d4], eax
lea eax, [ebp - 0x810]
push eax
call fcn.10039da8
pop ecx
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jne 0x10041a0d
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x298], 0x69896260
mov dword [ebp - 0x41c], 0x5bdf607d
mov dword [ebp - 0x918], 0x961dfa23
mov dword [ebp - 0x558], 0x9b5f277f
mov dword [ebp - 0x580], 0xe7f6f8f6
mov dword [ebp - 0x730], 0x1bd8e702
mov dword [ebp - 0x1c4], 0
jmp 0x1003ec3d
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 4
jge 0x1003ec59
mov eax, dword [ebp - 0x1c4]
mov dword [ebp + eax*4 - 0x9f8], 7
jmp 0x1003ec30
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x10]
je 0x1003edfd
push 1
lea ecx, [ebp - 0x5c0]
call fcn.10028d1f
mov byte [ebp - 4], 8
mov dword [ebp - 0x4c], 0
jmp 0x1003ec86
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1003eca2
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x5c0]
call fcn.10028dbd
mov dword [eax], 0xfffffffe
jmp 0x1003ec7f
mov dword [ebp - 0x4c], 0
jmp 0x1003ecb2
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x1003ecc8
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x85c], 0x5b641b44
jmp 0x1003ecab
mov esi, dword [ebp - 0x10]
push 0
lea ecx, [ebp - 0x5c0]
call fcn.10028dbd
cmp esi, dword [eax]
jg 0x1003ece8
mov dword [ebp - 0x680], 1
jmp 0x1003ecef
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x920], eax
push 0
lea ecx, [ebp - 0x5c0]
call fcn.10028dbd
mov esi, eax
push 0
lea ecx, [ebp - 0x5c0]
call fcn.10028dbd
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x1003ed26
mov dword [ebp - 0x56c], 1
jmp 0x1003ed2d
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x56c]
cmp eax, 0x7104
jle 0x1003ed49
mov dword [ebp - 0x3dc], 1
jmp 0x1003ed50
and dword [ebp - 0x3dc], 0
push 0
lea ecx, [ebp - 0x5c0]
call fcn.10028dbd
mov ecx, dword [ebp - 0x3dc]
cmp ecx, dword [eax]
jne 0x1003ed73
mov dword [ebp - 0x4d4], 1
jmp 0x1003ed7a
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x4d4], eax
jle 0x1003ed91
mov dword [ebp - 0x728], 1
jmp 0x1003ed98
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x928], eax
push 0
lea ecx, [ebp - 0x5c0]
call fcn.10028dbd
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x930], eax
cmp dword [ebp - 0x10], 0
je 0x1003edcf
cmp dword [ebp - 0x10], 0
je 0x1003edcf
mov dword [ebp - 0x3e4], 1
jmp 0x1003edd6
and dword [ebp - 0x3e4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3e4]
mov dword [ebp + eax - 0x85c], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c0]
call fcn.10028da1
jmp 0x1003ef8c
mov dword [ebp - 0x7a8], 0xa71a6e48
mov dword [ebp - 0x10], 0
jmp 0x1003ee17
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x31
jne 0x1003ef8c
mov dword [ebp - 0x688], 2
mov dword [ebp - 0x278], 0x2b500989
mov dword [ebp - 0x4e4], 0x1cf717c9
lea eax, [ebp - 0x688]
push eax
push 0x7f42
push 1
lea eax, [ebp - 0x10]
push eax
call fcn.1003baf2
add esp, 0x10
mov eax, dword [ebp - 0x7a8]
mov dword [ebp - 0x854], eax
mov eax, 0xbb66efe0
test eax, eax
jne 0x1003ef62
cmp dword [ebp - 0x278], 0
je 0x1003eead
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jl 0x1003ee8f
mov dword [ebp - 0x550], 1
jmp 0x1003ee96
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x550]
sub eax, dword [ebp - 0x10]
je 0x1003eead
mov dword [ebp - 0x3ec], 1
jmp 0x1003eeb4
and dword [ebp - 0x3ec], 0
cmp dword [ebp - 0x3ec], 0xa3396d56
je 0x1003eecc
mov dword [ebp - 0x4dc], 1
jmp 0x1003eed3
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x4e4]
cmp dword [ebp - 0x4dc], eax
jle 0x1003eeed
mov dword [ebp - 0x3f4], 1
jmp 0x1003eef4
and dword [ebp - 0x3f4], 0
cmp dword [ebp - 0x3f4], 0x1832d748
jne 0x1003ef0c
mov dword [ebp - 0x5a0], 1
jmp 0x1003ef13
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x5a0], eax
jle 0x1003ef2a
mov dword [ebp - 0x3fc], 1
jmp 0x1003ef31
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x278]
cmp dword [ebp - 0x3fc], eax
jg 0x1003ef4b
mov dword [ebp - 0x690], 1
jmp 0x1003ef52
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x9ac], eax
cmp dword [ebp - 0x278], 9
cmp dword [ebp - 0x4e4], 0
je 0x1003ef76
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x298], eax
jmp 0x1003ef87
mov byte [ebp - 0x79], 0
lea eax, [ebp - 0x79]
push eax
push 1
call fcn.1003bb46
pop ecx
pop ecx
jmp 0x1003ee10
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x404], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x404]
mov dword [ebp + eax - 0x9f8], ecx
cmp dword [ebp - 0x404], 0xfffffffc
jl 0x1003efc0
mov dword [ebp - 0x424], 1
jmp 0x1003efc7
and dword [ebp - 0x424], 0
mov dword [ebp - 0x558], 1
cmp dword [ebp - 0x558], 0x8e16
jg 0x1003efe9
mov dword [ebp - 0x40c], 1
jmp 0x1003eff0
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x40c]
cmp eax, 0xd85a
jge 0x1003f00d
mov dword [ebp - 0x4ec], 1
jmp 0x1003f014
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x4ec], eax
je 0x1003f02b
mov dword [ebp - 0x414], 1
jmp 0x1003f032
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x580], eax
mov eax, dword [ebp - 0x580]
sub eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
jl 0x1003f058
mov dword [ebp - 0x4f4], 1
jmp 0x1003f05f
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x41c]
cmp dword [ebp - 0x4f4], eax
je 0x1003f079
mov dword [ebp - 0x560], 1
jmp 0x1003f080
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x424]
cmp eax, dword [ebp - 0x560]
jg 0x1003f09a
mov dword [ebp - 0x42c], 1
jmp 0x1003f0a1
and dword [ebp - 0x42c], 0
mov dword [ebp - 0x298], 0x8b9abc19
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x42c]
sub eax, dword [ebp - 0x10]
cmp dword [ebp - 0x298], eax
jge 0x1003f0cc
mov dword [ebp - 0x4fc], 1
jmp 0x1003f0d3
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x730], eax
cmp dword [0x126776bc], 0
jne 0x100418f9
mov dword [ebp - 0x174], 0x261f9c28
mov dword [ebp - 0x698], 1
mov dword [ebp - 0x9b4], 0
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x1003f12a
push 0x6041
push 0
call fcn.1003cd81
pop ecx
pop ecx
mov dword [ebp - 0x174], 0
jmp 0x1003f143
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0x17
jne 0x1003f1c7
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x1cc], 0
jmp 0x1003f16f
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0x18
jg 0x1003f1b4
mov byte [ebp - 0xbe], 0
movzx eax, byte [ebp - 0xbe]
test eax, eax
je 0x1003f1b2
push 0x19eb
push 0x6877
push 0x38ea
push 0xef5
push 0x27b3
push 1
push 0x2a79
call fcn.1003bb9b
add esp, 0x1c
jmp 0x1003f162
cmp dword [ebp - 0x698], 0
je 0x1003f1c2
jmp 0x1003f136
jmp 0x1003f136
mov dword [ebp - 0x1d4], 0xffffffff
mov dword [ebp - 0x17c], 0
jmp 0x1003f1ea
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 2
jge 0x1003f206
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0xa00], 0
jmp 0x1003f1dd
mov dword [ebp - 0x1d4], 1
jmp 0x1003f21f
mov eax, dword [ebp - 0x1d4]
dec eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0
jl 0x1003f23e
push 0x2a5d
push 1
push 0x2e3e
call fcn.1003bc68
add esp, 0xc
jmp 0x1003f212
mov byte [ebp - 0x260], 5
mov byte [ebp - 0x25f], 0xcd
mov byte [ebp - 0x25e], 6
mov byte [ebp - 0x25d], 0x5f
mov byte [ebp - 0x25c], 0xb
mov byte [ebp - 0x25b], 0x5f
mov byte [ebp - 0x25a], 0
mov byte [ebp - 0x259], 0x27
mov byte [ebp - 0x258], 4
mov byte [ebp - 0x257], 0x2e
mov byte [ebp - 0x256], 0xa
mov byte [ebp - 0x255], 9
mov byte [ebp - 0x254], 0x4e
mov byte [ebp - 0x253], 0xd
mov byte [ebp - 0x252], 0x8a
mov byte [ebp - 0x251], 0x13
mov byte [ebp - 0x250], 0x76
mov byte [ebp - 0x24f], 0x83
mov byte [ebp - 0x24e], 0xd8
mov byte [ebp - 0x24d], 0xba
mov byte [ebp - 0x24c], 0xb3
mov byte [ebp - 0x24b], 0xea
mov byte [ebp - 0x24a], 0x17
mov byte [ebp - 0x249], 0xbc
mov byte [ebp - 0x248], 0xb2
mov byte [ebp - 0x247], 0x99
mov byte [ebp - 0x246], 0xc3
mov byte [ebp - 0x245], 0x40
mov byte [ebp - 0x244], 0xe3
mov byte [ebp - 0x243], 0xde
mov byte [ebp - 0x242], 0x62
mov byte [ebp - 0x241], 0x34
mov byte [ebp - 0x240], 0xbe
mov byte [ebp - 0x23f], 0xb2
mov byte [ebp - 0x23e], 0x27
mov byte [ebp - 0x23d], 0x66
mov byte [ebp - 0x23c], 0x5e
mov byte [ebp - 0x23b], 0xf9
mov byte [ebp - 0x23a], 0x82
mov byte [ebp - 0x239], 0x70
mov byte [ebp - 0x238], 6
mov byte [ebp - 0x237], 5
mov byte [ebp - 0x236], 0xec
mov byte [ebp - 0x235], 0xd1
mov byte [ebp - 0x234], 0x95
mov byte [ebp - 0x233], 0xc2
mov byte [ebp - 0x232], 0xaa
mov byte [ebp - 0x231], 0x5b
mov byte [ebp - 0x230], 0xb2
mov byte [ebp - 0x22f], 0x5c
mov byte [ebp - 0x22e], 0xc6
mov byte [ebp - 0x22d], 0x9e
mov byte [ebp - 0x22c], 0xa6
mov byte [ebp - 0x22b], 0x1f
mov byte [ebp - 0x22a], 0x15
mov byte [ebp - 0x229], 0x21
mov byte [ebp - 0x228], 0x36
mov byte [ebp - 0x227], 0x86
mov byte [ebp - 0x226], 0xfa
mov byte [ebp - 0x225], 0x7b
mov byte [ebp - 0x224], 3
mov byte [ebp - 0x223], 0x39
mov byte [ebp - 0x222], 0xb4
mov byte [ebp - 0x221], 0x96
mov byte [ebp - 0x220], 0x1e
mov byte [ebp - 0x21f], 0x45
mov byte [ebp - 0x21e], 0xfe
mov byte [ebp - 0x21d], 0x52
mov byte [ebp - 0x21c], 0xf6
mov byte [ebp - 0x21b], 2
mov byte [ebp - 0x21a], 0x37
mov byte [ebp - 0x219], 0xa4
mov byte [ebp - 0x218], 0x40
mov byte [ebp - 0x217], 0x53
mov byte [ebp - 0x216], 0x67
mov byte [ebp - 0x215], 0x88
mov byte [ebp - 0x214], 0x77
mov byte [ebp - 0x213], 0xbe
mov byte [ebp - 0x212], 0xdc
mov byte [ebp - 0x211], 0xd2
mov byte [ebp - 0x210], 0xb0
mov byte [ebp - 0x20f], 1
mov byte [ebp - 0x20e], 0x25
mov byte [ebp - 0x20d], 0xc0
mov byte [ebp - 0x20c], 0x43
mov byte [ebp - 0x20b], 0x29
mov byte [ebp - 0x20a], 0x9e
mov byte [ebp - 0x209], 0xd2
mov byte [ebp - 0x208], 0xc
mov byte [ebp - 0x207], 0xd4
mov byte [ebp - 0x206], 0x89
mov byte [ebp - 0x205], 7
mov byte [ebp - 0x204], 0x5e
mov byte [ebp - 0x203], 9
mov byte [ebp - 0x202], 0x56
mov byte [ebp - 0x201], 8
mov byte [ebp - 0x200], 0x4a
mov byte [ebp - 0x1ff], 1
mov byte [ebp - 0x1fe], 0x4b
mov byte [ebp - 0x1fd], 3
mov byte [ebp - 0x1fc], 0xb
mov byte [ebp - 0x1fb], 2
mov byte [ebp - 0x1fa], 0x1c
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xe4], 0x4f46db50
mov dword [ebp - 0x434], 0x980db959
push 3
lea ecx, [ebp - 0x7e0]
call fcn.10028d1f
mov byte [ebp - 4], 9
push 2
lea ecx, [ebp - 0x828]
call fcn.10028d1f
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x798], 1
mov dword [ebp - 0xd4], 0
jmp 0x1003f572
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 3
jge 0x1003f58e
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x948], 0xffffffff
jmp 0x1003f565
push 0
push 0x4918
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x7e0]
push eax
call fcn.1003bce2
add esp, 0x10
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0xd4]
push eax
push 0
call fcn.1003c8ee
add esp, 0xc
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0xe4], eax
je 0x1003f5e9
mov dword [ebp - 0x5a8], 1
jmp 0x1003f5f0
and dword [ebp - 0x5a8], 0
mov dword [ebp - 0x434], 0x4ba8b35e
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x434]
mov dword [ebp + eax - 0x948], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x948]
cmp dword [ebp - 0x5a8], eax
jge 0x1003f62d
mov dword [ebp - 0x43c], 1
jmp 0x1003f634
and dword [ebp - 0x43c], 0
cmp dword [ebp - 0x43c], 1
jae 0x1003f649
mov dword [ebp - 0x504], 1
jmp 0x1003f650
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0x504]
jne 0x1003f66a
mov dword [ebp - 0x444], 1
jmp 0x1003f671
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x444], eax
jl 0x1003f68b
mov dword [ebp - 0x568], 1
jmp 0x1003f692
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0x568]
lea eax, [ecx + eax - 0xf791]
cmp dword [ebp - 0xe4], eax
jl 0x1003f6b9
mov dword [ebp - 0x2c8], 1
jmp 0x1003f6c0
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x2d0], eax
push 2
lea ecx, [ebp - 0x7e0]
call fcn.10028dbd
mov ecx, dword [ebp - 0x2d0]
mov dword [eax], ecx
cmp dword [ebp - 0x2d0], 0
jne 0x1003f708
cmp dword [ebp - 0xe4], 0
jne 0x1003f708
and dword [ebp - 0x280], 0
jmp 0x1003f712
mov dword [ebp - 0x280], 1
push 1
lea ecx, [ebp - 0x828]
call fcn.10028dbd
mov ecx, dword [ebp - 0x280]
mov dword [eax], ecx
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x280], eax
jl 0x1003f741
mov dword [ebp - 0x2d8], 1
jmp 0x1003f748
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x798], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x828]
call fcn.10028da1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x7e0]
call fcn.10028da1
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x260]
or eax, 0xa1
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x260]
and ecx, 0xa1
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x260]
mov word [ebp + ecx*2 - 0x850], ax
mov dword [ebp - 0x24], 0x2526041
push 2
lea ecx, [ebp - 0x620]
call fcn.10028d1f
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x90], 0xffffffff
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x68], 0xffffffff
push 0x5c23
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0x620]
push eax
push 0
call fcn.100420e3
add esp, 0x10
mov dword [ebp - 0xf0], 0
jmp 0x1003f81a
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 2
jge 0x1003f836
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x5d4], 0xffffffff
jmp 0x1003f80d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x1003f984
cmp dword [ebp - 0x24], 0xea5f34bd
jb 0x1003f85b
mov dword [ebp - 0x2ac], 1
jmp 0x1003f862
and dword [ebp - 0x2ac], 0
push 1
lea ecx, [ebp - 0x620]
call fcn.10028dbd
mov ecx, dword [ebp - 0x2ac]
mov dword [eax], ecx
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x2ac], eax
jge 0x1003f894
cmp dword [ebp - 0x24], 0
je 0x1003f894
mov dword [ebp - 0x2e0], 1
jmp 0x1003f89b
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x1003f8b7
cmp dword [ebp - 0x288], 0
push 0
lea ecx, [ebp - 0x620]
call fcn.10028dbd
mov ecx, dword [ebp - 0x288]
cmp dword [eax], ecx
je 0x1003f8da
mov dword [ebp - 0x2e8], 1
jmp 0x1003f8e1
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x2e8], eax
jne 0x1003f8f8
mov dword [ebp - 0x6a0], 1
jmp 0x1003f8ff
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x9bc], eax
mov eax, 0xfffc
test eax, eax
je 0x1003f923
cmp dword [ebp - 0x68], 0
je 0x1003f923
mov dword [ebp - 0x2f0], 1
jmp 0x1003f92a
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
push 4
pop edx
shl edx, 0
mov edx, dword [ebp + edx - 0x5d4]
add edx, dword [ebp - 0x2f0]
sub ecx, edx
sub eax, ecx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jae 0x1003f95c
mov dword [ebp - 0x2f8], 1
jmp 0x1003f963
and dword [ebp - 0x2f8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2f8]
sub ecx, dword [ebp + eax - 0x5d4]
jne 0x1003f984
mov dword [ebp - 0x738], 1
jmp 0x1003f98b
and dword [ebp - 0x738], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5d4]
mov dword [ebp - 0x9b0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5d4], 0x65f5
jg 0x1003fa7e
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x1003f9cf
push 0
call fcn.1003c953
pop ecx
mov dword [ebp - 0x68], 0
jmp 0x1003f9df
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jg 0x1003fa79
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x1003fa09
push 0x3ce
push 0
push 0x16e4
call fcn.1003c381
add esp, 0xc
push dword [ebp - 0x68]
lea ecx, [ebp - 0x620]
call fcn.10028dbd
mov esi, eax
push dword [ebp - 0x68]
lea ecx, [ebp - 0x620]
call fcn.10028dbd
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0x90], 0
jmp 0x1003fa44
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jg 0x1003fa74
mov dword [ebp - 0x6a8], 0xeabf
push 1
lea eax, [ebp - 0x6a8]
push eax
push 0x5d6f
push 0x420e
call fcn.1003bce2
add esp, 0x10
jmp 0x1003fa37
jmp 0x1003f9d8
jmp 0x1003fbee
push 1
lea ecx, [ebp - 0x774]
call fcn.10028d1f
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x3c], 0
jmp 0x1003fa9f
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1003fabb
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x774]
call fcn.10028dbd
mov dword [eax], 0x2a41536c
jmp 0x1003fa98
mov dword [ebp - 0x3c], 0
jmp 0x1003facb
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1003fae1
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x2a4], 0xea418246
jmp 0x1003fac4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a4]
mov dword [ebp - 0x860], eax
cmp dword [ebp - 0x288], 0
je 0x1003fb10
push 5
pop eax
test eax, eax
je 0x1003fb10
mov dword [ebp - 0x300], 1
jmp 0x1003fb17
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x300]
je 0x1003fb31
mov dword [ebp - 0x308], 1
jmp 0x1003fb38
and dword [ebp - 0x308], 0
cmp dword [ebp - 0x308], 0xc338
jl 0x1003fb50
mov dword [ebp - 0x310], 1
jmp 0x1003fb57
and dword [ebp - 0x310], 0
push 0
lea ecx, [ebp - 0x774]
call fcn.10028dbd
mov esi, eax
push 0
lea ecx, [ebp - 0x774]
call fcn.10028dbd
mov ecx, dword [esi]
imul ecx, dword [eax]
cmp ecx, dword [ebp - 0x310]
jne 0x1003fb8c
mov dword [ebp - 0x318], 1
jmp 0x1003fb93
and dword [ebp - 0x318], 0
cmp dword [ebp - 0x318], 1
jb 0x1003fba8
mov dword [ebp - 0x320], 1
jmp 0x1003fbaf
and dword [ebp - 0x320], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x2a4]
add esi, dword [ebp - 0x320]
push 4
pop eax
imul eax, eax, 0
imul esi, dword [ebp + eax - 0x2a4]
push 0
lea ecx, [ebp - 0x774]
call fcn.10028dbd
mov dword [eax], esi
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x774]
call fcn.10028da1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x620]
call fcn.10028da1
mov dword [ebp - 0x1c], 2
and dword [ebp - 0x1e8], 0
jmp 0x1003fc15
mov eax, dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x67
jae 0x10040668
mov dword [ebp - 0x870], 2
mov dword [ebp - 0x7b8], 0x566a927
mov dword [ebp - 0x7a0], 0xfffffffd
mov dword [ebp - 0x6c0], 0xfffffffe
mov dword [ebp - 0x748], 0
mov dword [ebp - 0x6b0], 0x8fecf792
mov dword [ebp - 0x740], 0xfffd
mov dword [ebp - 0x6b8], 0xfffffffc
lea eax, [ebp - 0x7b8]
push eax
lea eax, [ebp - 0x6b0]
push eax
lea eax, [ebp - 0x740]
push eax
push 0x338e
lea eax, [ebp - 0x6b8]
push eax
lea eax, [ebp - 0x7a0]
push eax
lea eax, [ebp - 0x6c0]
push eax
push 0
lea eax, [ebp - 0x748]
push eax
call fcn.1003d2d1
add esp, 0x24
mov byte [ebp - 0xc0], 0
movzx eax, byte [ebp - 0xc0]
test eax, eax
je 0x1003fcd7
push 0x1201
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x260]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x1c], eax
jne 0x10040286
mov dword [ebp - 0xd0], 0xf6af1124
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x328], 0xffffffff
mov dword [ebp - 0x7b0], 0x14f98caf
mov dword [ebp - 0x184], 0
jmp 0x1003fd33
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 3
jge 0x1003fd4f
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x958], 1
jmp 0x1003fd26
mov dword [ebp - 0xd0], 0
jmp 0x1003fd68
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0x1a
jl 0x1003ffd6
mov dword [ebp - 0x6d0], 0xfffffff6
mov dword [ebp - 0x6c8], 0x1a4e6659
mov dword [ebp - 0x8fc], 0
mov dword [ebp - 0x18c], 0x376fbfcc
mov dword [ebp - 0x86c], 0xffffffff
mov dword [ebp - 0x268], 0x5de2caea
mov dword [ebp - 0x274], 0xcf8610f1
mov dword [ebp - 0x1dc], 0
jmp 0x1003fdd4
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 4
jge 0x1003fdf0
mov eax, dword [ebp - 0x1dc]
mov dword [ebp + eax*4 - 0x9e0], 0x486aeba4
jmp 0x1003fdc7
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x99c], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x874], eax
mov eax, dword [ebp - 0x6c8]
mov dword [ebp - 0x904], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x87c], eax
mov eax, dword [ebp - 0x7b0]
mov dword [ebp - 0x330], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x330]
mov dword [ebp + eax - 0x9e0], ecx
mov eax, dword [ebp - 0x328]
add eax, dword [ebp - 0x330]
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x95c], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x884], eax
mov eax, dword [ebp - 0x268]
dec eax
mov dword [ebp - 0x268], eax
mov eax, 0xb48fe2d5
test eax, eax
jne 0x1003fe8f
push 8
pop eax
test eax, eax
jne 0x1003fe8f
and dword [ebp - 0x340], 0
jmp 0x1003fe99
mov dword [ebp - 0x340], 1
mov eax, dword [ebp - 0xd0]
cmp eax, dword [ebp - 0x340]
jne 0x1003feb3
mov dword [ebp - 0x348], 1
jmp 0x1003feba
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x348], eax
jge 0x1003fed4
mov dword [ebp - 0x350], 1
jmp 0x1003fedb
and dword [ebp - 0x350], 0
imul eax, dword [ebp - 0x350], 0x8f53
mov dword [ebp - 0x274], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6d0]
add ecx, dword [ebp - 0x274]
cmp ecx, dword [ebp + eax - 0x958]
jne 0x1003ff12
mov dword [ebp - 0x26c], 1
jmp 0x1003ff19
and dword [ebp - 0x26c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x26c]
mov dword [ebp + eax - 0x958], ecx
cmp dword [ebp - 0x26c], 0xfffffffc
jl 0x1003ff40
mov dword [ebp - 0x358], 1
jmp 0x1003ff47
and dword [ebp - 0x358], 0
imul eax, dword [ebp - 0x358], 0xc2
cmp eax, dword [ebp - 0x18c]
je 0x1003ff65
mov dword [ebp - 0x360], 1
jmp 0x1003ff6c
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x274], 0
je 0x1003ff9f
mov byte [ebp - 0xbc], 0
movzx eax, byte [ebp - 0xbc]
test eax, eax
je 0x1003ff9d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
jmp 0x1003ffd1
mov dword [ebp - 0x90c], 0xfffffff9
mov dword [ebp - 0x88c], 9
mov dword [ebp - 0x9a0], 9
mov dword [ebp - 0x750], 0x66c5d899
mov dword [ebp - 0x750], 1
jmp 0x1003fd5b
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x260]
inc eax
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0xd8], 1
mov dword [ebp - 0x2c4], 0xffffffff
mov dword [ebp - 0x398], 1
push 4
lea ecx, [ebp - 0x81c]
call fcn.10028d1f
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x40], 0
jmp 0x10040027
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1004003d
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x868], 0xffffffff
jmp 0x10040020
mov dword [ebp - 0x40], 0
jmp 0x1004004d
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x10040069
push dword [ebp - 0x40]
lea ecx, [ebp - 0x81c]
call fcn.10028dbd
mov dword [eax], 0x25062d7b
jmp 0x10040046
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x894], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x914], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x368], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x368]
mov dword [ebp + eax - 0x868], ecx
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x368]
jg 0x100400ba
mov dword [ebp - 0x370], 1
jmp 0x100400c1
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0
jne 0x100400e8
cmp dword [ebp - 0xd8], 0
jne 0x100400e8
and dword [ebp - 0x380], 0
jmp 0x100400f2
mov dword [ebp - 0x380], 1
mov eax, dword [ebp - 0xd8]
add eax, dword [ebp - 0x380]
cmp eax, 0x65251c60
jg 0x10040111
mov dword [ebp - 0x388], 1
jmp 0x10040118
and dword [ebp - 0x388], 0
cmp dword [ebp - 0x388], 1
jg 0x1004012d
mov dword [ebp - 0x390], 1
jmp 0x10040134
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x398], eax
mov esi, dword [ebp - 0x398]
push 0
lea ecx, [ebp - 0x81c]
call fcn.10028dbd
mov dword [eax], esi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x81c]
call fcn.10028da1
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x260]
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1ec], 5
mov dword [ebp - 0x89c], 0xffffffff
mov dword [ebp - 0x1e4], 0
jmp 0x100401a6
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 1
jge 0x100401c2
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0x78c], 0xffffffff
jmp 0x10040199
mov dword [ebp - 0x1ec], 0xffffffec
jmp 0x100401db
cmp dword [ebp - 0x1ec], 1
jl 0x10040261
mov dword [ebp - 0x6d8], 0x1aae
mov dword [ebp - 0x54], 0
jmp 0x100401fe
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x10040214
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xa20], 0xfd4914d2
jmp 0x100401f7
mov dword [ebp - 0x54], 0
jmp 0x10040224
cmp dword [ebp - 0x54], 2
jge 0x1004023a
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x10040281
push 0x64cc
push 1
call fcn.1003bd89
pop ecx
pop ecx
jmp 0x1003fc0d
push 2
lea ecx, [ebp - 0x62c]
call fcn.10028d1f
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x27c], 0x16d21b18
mov dword [ebp - 0x6e8], 0x1d4b082b
mov dword [ebp - 0x18], 0
jmp 0x100402bb
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x100402d7
push dword [ebp - 0x18]
lea ecx, [ebp - 0x62c]
call fcn.10028dbd
mov dword [eax], 1
jmp 0x100402b4
mov dword [ebp - 0x18], 0
jmp 0x100402e7
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x100402fd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6e0], 0x3245f1db
jmp 0x100402e0
mov dword [ebp - 0x18], 0
jmp 0x1004030d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10040323
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa34], 0xfffffff9
jmp 0x10040306
push 1
lea ecx, [ebp - 0x62c]
call fcn.10028dbd
mov dword [eax], 0xffffffe5
jmp 0x1004035c
push 1
lea ecx, [ebp - 0x62c]
call fcn.10028dbd
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0x3a0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3a0]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x62c]
call fcn.10028dbd
cmp dword [eax], 8
jge 0x10040482
mov dword [ebp - 0x198], 0xd37ad43
mov dword [ebp - 0x758], 0xffffffff
mov dword [ebp - 0x96c], 0xa61bf079
mov dword [ebp - 0x198], 0
jmp 0x100403a9
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
jg 0x10040472
mov dword [ebp - 0x8a4], 0xfffffffa
mov dword [ebp - 0x91c], 0x8593f9be
mov dword [ebp - 0x1c8], 0
jmp 0x100403e3
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
jge 0x100403ff
mov eax, dword [ebp - 0x1c8]
mov dword [ebp + eax*4 - 0xa40], 0x9a2b441a
jmp 0x100403d6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6e0], 0
jle 0x1004041b
mov dword [ebp - 0x3a8], 1
jmp 0x10040422
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x27c], eax
mov esi, dword [ebp - 0x27c]
push 1
lea ecx, [ebp - 0x62c]
call fcn.10028dbd
cmp esi, dword [eax]
jl 0x1004045a
cmp dword [ebp - 0x758], 0
je 0x1004045a
mov dword [ebp - 0x3b0], 1
jmp 0x10040461
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x6e8], eax
jmp 0x1004039c
cmp dword [ebp - 0x27c], 0
je 0x1004047d
jmp 0x10040482
jmp 0x10040338
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x62c]
call fcn.10028da1
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x25f]
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x1e8]
movzx ecx, byte [ebp + ecx - 0x262]
movzx ecx, word [ebp + ecx*2 - 0x850]
or eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x25f]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x1e8]
movzx edx, byte [ebp + edx - 0x262]
movzx edx, word [ebp + edx*2 - 0x850]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x260]
mov word [ebp + ecx*2 - 0x850], ax
mov dword [ebp - 0x1a0], 0x13b91020
mov dword [ebp - 0x8ac], 0xfffffffd
push 1
lea ecx, [ebp - 0x978]
call fcn.10028d1f
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x794], 0xfff7
push 0x377b
push 0x1413
lea eax, [ebp - 0x978]
push eax
push 1
lea eax, [ebp - 0x9a4]
push eax
call fcn.1003bdcd
add esp, 0x14
mov dword [ebp - 0x1a0], 0
jmp 0x1004055c
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0x1b
jl 0x1004064d
mov dword [ebp - 0x8b4], 0xffffffff
mov dword [ebp - 0x924], 0xffffffff
mov dword [ebp - 0x8bc], 1
mov dword [ebp - 0x97c], 0x9d43467
mov dword [ebp - 0x8c4], 3
push 2
lea ecx, [ebp - 0x968]
call fcn.10028d1f
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x92c], 0x23ccde6b
mov dword [ebp - 0x8cc], 0x5cd3
push 0x6a35
push 1
lea eax, [ebp - 0x968]
push eax
lea eax, [ebp - 0x9a8]
push eax
push 0x4b9e
push 0xaa3
call fcn.1003be64
add esp, 0x18
push 0x12ac
push 1
push 0x6e69
call fcn.1003bf9c
add esp, 0xc
push 0x48e4
push 0x4ec8
push 0x64e5
lea eax, [ebp - 0x794]
push eax
push 1
push 0x11a0
push 0x732b
push 0x4f8e
push 0x52ef
push 0x6a90
push 0x2803
call fcn.1003c013
add esp, 0x2c
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x968]
call fcn.10028da1
jmp 0x1004054f
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x978]
call fcn.10028da1
and dword [ebp - 0x1e8], 0
jmp 0x1003fc0d
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0x850], cx
mov dword [ebp - 0xe0], 0xfff7
push 1
lea ecx, [ebp - 0x988]
call fcn.10028d1f
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x1a8], 0
jmp 0x100406ac
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 1
jge 0x100406ce
push dword [ebp - 0x1a8]
lea ecx, [ebp - 0x988]
call fcn.10028dbd
mov dword [eax], 9
jmp 0x1004069f
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xe0], 0
jmp 0x100406f4
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0x1e
jge 0x100407a1
mov dword [ebp - 0x1d0], 0x5c7a00f4
mov dword [ebp - 0x1d0], 0
jmp 0x10040724
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0
jg 0x10040782
mov dword [ebp - 0x144], 0x4aa0d722
mov dword [ebp - 0x144], 0
jmp 0x10040750
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
jl 0x10040780
mov dword [ebp - 0x6f0], 0xffffffff
lea eax, [ebp - 0x6f0]
push eax
push 1
push 0x157e
push 0xc85
call fcn.1003c1ad
add esp, 0x10
jmp 0x10040743
jmp 0x10040717
mov byte [ebp - 0xba], 0
movzx eax, byte [ebp - 0xba]
test eax, eax
je 0x1004079c
push 1
call fcn.1003c336
pop ecx
jmp 0x100406e7
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x988]
call fcn.10028da1
lea eax, [ebp - 0x850]
push eax
lea ecx, [ebp - 0xa64]
call fcn.10043aeb
mov dword [ebp - 0x768], eax
mov eax, dword [ebp - 0x768]
mov dword [ebp - 0x6f8], eax
mov byte [ebp - 4], 0x12
push dword [ebp - 0x6f8]
call fcn.10039da8
pop ecx
mov dword [ebp - 0x4e0], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa64]
call fcn.10043b10
push 1
lea ecx, [ebp - 0x834]
call fcn.10028d1f
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x3b8], 0xffffffff
mov dword [ebp - 0x700], 0x1636717b
mov dword [ebp - 0x640], 0x5f7a
push 4
lea ecx, [ebp - 0x5f0]
call fcn.10028d1f
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x3e0], 0x653649d9
push 2
lea ecx, [ebp - 0x7f8]
call fcn.10028d1f
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x778], 9
mov dword [ebp - 0x79c], 0xffffffff
mov dword [ebp - 0x644], 2
mov dword [ebp - 0x3c8], 0
lea eax, [ebp - 0x834]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.1003c381
add esp, 0xc
mov dword [ebp - 0x28], 0
jmp 0x100408a1
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x100408bd
push dword [ebp - 0x28]
lea ecx, [ebp - 0x5f0]
call fcn.10028dbd
mov dword [eax], 1
jmp 0x1004089a
mov dword [ebp - 0x28], 0
jmp 0x100408cd
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x100408e9
push dword [ebp - 0x28]
lea ecx, [ebp - 0x7f8]
call fcn.10028dbd
mov dword [eax], 0x945cb296
jmp 0x100408c6
lea eax, [ebp - 0x79c]
push eax
lea eax, [ebp - 0x700]
push eax
lea eax, [ebp - 0x7f8]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x778]
push eax
lea eax, [ebp - 0x5f0]
push eax
push 1
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x834]
push eax
push 0x5dbd
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x3e0]
push eax
call fcn.1003c3ec
add esp, 0x34
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x3c0], eax
push 0
lea ecx, [ebp - 0x5f0]
call fcn.10028dbd
mov ecx, dword [ebp - 0x3c0]
mov dword [eax], ecx
cmp dword [ebp - 0x3c0], 0
je 0x100409c6
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x8d4], eax
push 1
lea ecx, [ebp - 0x5f0]
call fcn.10028dbd
cmp dword [eax], 0xfff7
jae 0x1004099c
mov dword [ebp - 0x3d0], 1
jmp 0x100409a3
and dword [ebp - 0x3d0], 0
push 3
lea ecx, [ebp - 0x5f0]
call fcn.10028dbd
mov eax, dword [eax]
sub eax, dword [ebp - 0x3d0]
je 0x100409c6
mov dword [ebp - 0x3d8], 1
jmp 0x100409cd
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x3e0], eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x7f8]
call fcn.10028da1
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x5f0]
call fcn.10028da1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x834]
call fcn.10028da1
and dword [ebp - 0x1b0], 0
jmp 0x10040a1c
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0xd
jae 0x10040a37
xor eax, eax
mov ecx, dword [ebp - 0x1b0]
mov word [ebp + ecx*2 - 0x850], ax
jmp 0x10040a0f
mov dword [ebp - 0x1b4], 0
mov dword [ebp - 0x1b4], 0xfffffff5
jmp 0x10040a5a
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0xfffffff7
jne 0x10040caa
mov dword [ebp - 0x1e0], 0xb0647dc4
mov dword [ebp - 0x1e0], 0
jmp 0x10040a8a
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 6
jle 0x10040ca5
push 4
lea ecx, [ebp - 0x784]
call fcn.10028d1f
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x1c0], 0
jmp 0x10040ac1
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 4
jge 0x10040ae3
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0x784]
call fcn.10028dbd
mov dword [eax], 0xfaaaeb9a
jmp 0x10040ab4
push 3
lea ecx, [ebp - 0x784]
call fcn.10028dbd
and dword [eax], 0
jmp 0x10040b19
push 3
lea ecx, [ebp - 0x784]
call fcn.10028dbd
cmp dword [eax], 0xb
jge 0x10040c91
mov dword [ebp - 0x194], 6
push 1
lea ecx, [ebp - 0x998]
call fcn.10028d1f
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x190], 0
jmp 0x10040b63
cmp dword [ebp - 0x190], 1
jge 0x10040b85
push dword [ebp - 0x190]
lea ecx, [ebp - 0x998]
call fcn.10028dbd
mov dword [eax], 2
jmp 0x10040b56
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x10040ba6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x784]
call fcn.10028da1
jmp 0x10040a7d
jmp 0x10040a4d
cmp dword [ebp - 0x4e0], 0
je 0x100418f9
mov dword [ebp - 0x50], 0xfffffffa
mov dword [ebp - 0x65c], 0x2891f433
mov dword [ebp - 0x50], 0
jmp 0x10040cd8
cmp dword [ebp - 0x50], 5
je 0x100410f5
push 2
lea ecx, [ebp - 0x1f8]
call fcn.10028d1f
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x158], 0
jmp 0x10040d0c
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 2
jge 0x10040d2e
push dword [ebp - 0x158]
lea ecx, [ebp - 0x1f8]
call fcn.10028dbd
mov dword [eax], 5
jmp 0x10040cff
push 0
lea ecx, [ebp - 0x1f8]
call fcn.10028dbd
cmp dword [eax], 0
je 0x10040d57
or eax, 0xffffffff
je 0x10040d57
cmp dword [ebp - 0x50], 0
je 0x10040d57
mov dword [ebp - 0x3f0], 1
jmp 0x10040d5e
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x3f0]
sub eax, dword [ebp - 0x50]
je 0x10040e5f
push 4
lea ecx, [ebp - 0x5fc]
call fcn.10028d1f
mov byte [ebp - 4], 0x19
push 0x5be0
lea eax, [ebp - 0x5fc]
push eax
lea eax, [ebp - 0x934]
push eax
push 0x2829
push 1
call fcn.1003c7be
add esp, 0x14
push 0
lea ecx, [ebp - 0x1f8]
call fcn.10028dbd
cmp dword [eax], 0
je 0x10040dd5
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x5fc]
call fcn.10028da1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1f8]
call fcn.10028da1
jmp 0x100410f5
push 2
lea ecx, [ebp - 0x5fc]
call fcn.10028dbd
and dword [eax], 0
jmp 0x10040e0b
mov dword [ebp - 0x64], 0xfffffffa
mov dword [ebp - 0x460], 1
mov dword [ebp - 0x64], 0
jmp 0x10040e80
cmp dword [ebp - 0x64], 1
jg 0x100410bb
mov byte [ebp - 0x140], 0xb
mov byte [ebp - 0x13f], 0xbb
mov byte [ebp - 0x13e], 8
mov byte [ebp - 0x13d], 0x36
mov byte [ebp - 0x13c], 4
mov byte [ebp - 0x13b], 0x2d
mov byte [ebp - 0x13a], 3
mov byte [ebp - 0x139], 0x28
mov byte [ebp - 0x138], 0
mov byte [ebp - 0x137], 0x28
mov byte [ebp - 0x136], 0xa
mov byte [ebp - 0x135], 0x35
mov byte [ebp - 0x134], 1
mov byte [ebp - 0x133], 0x16
mov byte [ebp - 0x132], 9
mov byte [ebp - 0x131], 0x1d
mov byte [ebp - 0x130], 6
mov byte [ebp - 0x12f], 0x10
mov byte [ebp - 0x12e], 7
mov byte [ebp - 0x12d], 0x10
mov byte [ebp - 0x12c], 5
mov byte [ebp - 0x12b], 0x1b
mov byte [ebp - 0x12a], 2
mov byte [ebp - 0x129], 8
mov byte [ebp - 0x128], 0xc
mov byte [ebp - 0x127], 0xb9
mov byte [ebp - 0x126], 0x44
mov byte [ebp - 0x125], 0xd2
mov byte [ebp - 0x124], 0xef
mov byte [ebp - 0x123], 0x84
mov byte [ebp - 0x122], 0xea
mov byte [ebp - 0x121], 0x47
mov byte [ebp - 0x120], 0x44
mov byte [ebp - 0x11f], 0x9a
mov byte [ebp - 0x11e], 0x60
mov byte [ebp - 0x11d], 0x6b
mov byte [ebp - 0x11c], 0xca
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x140]
or eax, 0xec
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x140]
and ecx, 0xec
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x140]
mov byte [ebp + ecx - 0x5e4], al
mov dword [ebp - 0x14], 2
and dword [ebp - 0xf4], 0
jmp 0x1004124e
mov eax, dword [ebp - 0x14]
inc eax
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x25
jae 0x1004132c
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x140]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x14], eax
jne 0x10041298
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x140]
inc eax
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x140]
mov ecx, dword [ebp - 0x14]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x14], eax
jmp 0x10041246
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x13f]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0xf4]
movzx ecx, byte [ebp + ecx - 0x142]
movsx ecx, byte [ebp + ecx - 0x5e4]
add eax, ecx
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ebp + ecx - 0x13f]
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0xf4]
movzx edx, byte [ebp + edx - 0x142]
movsx edx, byte [ebp + edx - 0x5e4]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ebp + ecx - 0x13f]
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0xf4]
movzx edx, byte [ebp + edx - 0x142]
movsx edx, byte [ebp + edx - 0x5e4]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ebp + ecx - 0x140]
mov byte [ebp + ecx - 0x5e4], al
and dword [ebp - 0xf4], 0
jmp 0x10041246
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x5e4], 0
push 1
call fcn.1003c953
pop ecx
lea eax, [ebp - 0x5e4]
push eax
lea ecx, [ebp - 0xa18]
call fcn.10028bf8
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x284], 0x149febb6
mov dword [ebp - 0xa0], 0x9f7fd1e8
mov dword [ebp - 0x98], 0xfffffff8
mov dword [ebp - 0x44], 0
jmp 0x10041386
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x1004139c
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xfc], 0x3c633843
jmp 0x1004137f
mov dword [ebp - 0x44], 0
jmp 0x100413ac
cmp dword [ebp - 0x44], 1
jge 0x100413c2
mov dword [ebp - 0x180], 5
mov dword [ebp - 0x8e4], 0xffffffff
mov dword [ebp - 0x178], 0
jmp 0x10041926
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 1
jge 0x10041942
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x68c], 0xffffffff
jmp 0x10041919
mov dword [ebp - 0x180], 0xffffffec
jmp 0x1004195b
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 1
jl 0x100419de
mov dword [ebp - 0x4e8], 0x1aae
mov dword [ebp - 0x48], 0
jmp 0x1004197e
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x10041994
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0xa28], 0xfd4914d2
jmp 0x10041977
mov dword [ebp - 0x48], 0
jmp 0x100419a4
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x100419ba
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x9d0], 0xfa9d19ac
jmp 0x1004199d
mov eax, dword [ebp - 0x4e8]
dec eax
mov dword [ebp - 0x4e8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x68c], 0
je 0x100419d9
jmp 0x100419de
jmp 0x1004194e
mov byte [ebp - 0x6e], 0
lea eax, [ebp - 0x6e]
push eax
push 1
call fcn.1003cd81
pop ecx
pop ecx
cmp dword [0x126776bc], 0
je 0x10041a0d
mov ecx, dword [ebp + 8]
call fcn.10043b4c
push eax
call dword [0x126776bc]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xb8], 0xfffffffa
mov dword [ebp - 0x6a4], 0x2891f433
mov dword [ebp - 0xb8], 0
jmp 0x10041a3a
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 5
je 0x10041c8e
push 2
lea ecx, [ebp - 0x2c0]
call fcn.10028d1f
mov byte [ebp - 4], 0x1d
push 0x7b64
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x93c]
push eax
push 1
call fcn.1003cdcd
add esp, 0x10
push 0
lea ecx, [ebp - 0x2c0]
call fcn.10028dbd
cmp dword [eax], 0
je 0x10041aa1
or eax, 0xffffffff
je 0x10041aa1
cmp dword [ebp - 0xb8], 0
je 0x10041aa1
mov dword [ebp - 0x4f0], 1
jmp 0x10041aa8
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x4f0]
sub eax, dword [ebp - 0xb8]
je 0x10041ba2
push 4
lea ecx, [ebp - 0x608]
call fcn.10028d1f
mov byte [ebp - 4], 0x1e
push 1
lea eax, [ebp - 0x608]
push eax
lea eax, [ebp - 0x8ec]
push eax
call fcn.1003ce4a
add esp, 0xc
push 0
lea ecx, [ebp - 0x2c0]
call fcn.10028dbd
cmp dword [eax], 0
je 0x10041b18
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x608]
call fcn.10028da1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c0]
call fcn.10028da1
jmp 0x10041c8e
push 2
lea ecx, [ebp - 0x608]
call fcn.10028dbd
and dword [eax], 0
jmp 0x10041b4e
push 2
lea ecx, [ebp - 0x608]
call fcn.10028dbd
mov dword [ebp - 0x4f8], eax
mov eax, dword [ebp - 0x4f8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4f8]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x608]
call fcn.10028dbd
cmp dword [eax], 0x14
jne 0x10041b8e
mov dword [ebp - 0x694], 1
push 1
lea eax, [ebp - 0x2c0]
push eax
push 0x3e6d
lea eax, [ebp - 0x694]
push eax
push 0x2022
call fcn.1003ceb8
add esp, 0x14
jmp 0x10041b2a
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x608]
call fcn.10028da1
jmp 0x10041c54
mov dword [ebp - 0x104], 0xfffffffa
mov dword [ebp - 0x6ac], 1
mov dword [ebp - 0x104], 0
jmp 0x10041bcf
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 1
jg 0x10041c54
mov dword [ebp - 0x6b4], 0x54e7f13b
mov dword [ebp - 0x69c], 0xffffffff
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x6a4]
push eax
lea eax, [ebp - 0x6ac]
push eax
push 0x73af
push 0x6feb
push 0x27e9
lea eax, [ebp - 0x104]
push eax
push 1
push 0x738b
lea eax, [ebp - 0x6b4]
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.1003cf63
add esp, 0x30
mov byte [ebp - 0x70], 0
movzx eax, byte [ebp - 0x70]
test eax, eax
je 0x10041c4f
push 1
call fcn.1003d1a2
pop ecx
jmp 0x10041bc2
push 0
lea ecx, [ebp - 0x2c0]
call fcn.10028dbd
cmp dword [eax], 0
je 0x10041c7a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c0]
call fcn.10028da1
jmp 0x10041a2d
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c0]
call fcn.10028da1
jmp 0x10041a2d
cmp dword [ebp - 0xe8], 0
je 0x10041cf3
movzx eax, byte [0x126776c0]
test eax, eax
je 0x10041cb3
mov ecx, 0x12677760
call fcn.10043c4d
movzx eax, al
test eax, eax
jne 0x10041cf3
push 0x12677760
push 1
lea eax, [ebp - 0x500]
push eax
push 0x30d3
lea eax, [ebp - 0xe8]
push eax
call fcn.1003d1c8
add esp, 0x14
push 0x126776c0
push 0x5c7
push 0x16c4
push 0x4d4c
push 0
call fcn.10043909
add esp, 0x14
push 2
lea ecx, [ebp - 0x59c]
call fcn.10028d1f
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x30], 5
push 1
lea ecx, [ebp - 0x7d4]
call fcn.10028d1f
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x110], 0xa165f5c9
lea eax, [ebp - 0x34]
push eax
push 1
lea eax, [ebp - 0x59c]
push eax
push 0x5799
push 0x5f0c
call fcn.1003d227
add esp, 0x14
mov dword [ebp - 0x34], 0
jmp 0x10041d55
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x10041d71
push dword [ebp - 0x34]
lea ecx, [ebp - 0x7d4]
call fcn.10028dbd
mov dword [eax], 0xd0e72ee7
jmp 0x10041d4e
mov dword [ebp - 0x34], 0
jmp 0x10041d81
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x10041d97
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x6c4], 0
jmp 0x10041d7a
push 1
lea ecx, [ebp - 0x59c]
call fcn.10028dbd
cmp dword [eax], 1
jl 0x10041db5
mov dword [ebp - 0x508], 1
jmp 0x10041dbc
and dword [ebp - 0x508], 0
push 1
lea ecx, [ebp - 0x59c]
call fcn.10028dbd
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x9b8], eax
push 1
lea ecx, [ebp - 0x59c]
call fcn.10028dbd
mov esi, eax
push 0
lea ecx, [ebp - 0x59c]
call fcn.10028dbd
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x10041e00
mov dword [ebp - 0x510], 1
jmp 0x10041e07
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x508]
imul eax, dword [ebp - 0x510]
test eax, eax
je 0x10041fdc
mov dword [ebp - 0x6bc], 0
mov dword [ebp - 0x30], 0
jmp 0x10041e36
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jg 0x10041fda
mov dword [ebp - 0x188], 0
jmp 0x10041e59
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 2
jge 0x10041e75
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0x2a0], 0xffffffff
jmp 0x10041e4c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2a0], 0
jmp 0x10041ea3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2a0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2a0], 1
jg 0x10041fb3
mov dword [ebp - 0x518], 6
mov dword [ebp - 0x518], 1
cmp dword [ebp - 0x518], 0
je 0x10041ee2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2a0], 0
cmp dword [ebp - 0x6bc], 1
jl 0x10041ef7
mov dword [ebp - 0x520], 1
jmp 0x10041efe
and dword [ebp - 0x520], 0
push 0
lea ecx, [ebp - 0x7d4]
call fcn.10028dbd
mov ecx, dword [ebp - 0x520]
cmp ecx, dword [eax]
jl 0x10041f21
mov dword [ebp - 0x528], 1
jmp 0x10041f28
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x528], eax
jle 0x10041f42
mov dword [ebp - 0x530], 1
jmp 0x10041f49
and dword [ebp - 0x530], 0
push dword [ebp - 0x30]
lea ecx, [ebp - 0x59c]
call fcn.10028dbd
mov esi, dword [eax]
sub esi, dword [ebp - 0x530]
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x2a0]
lea ecx, [ebp - 0x59c]
call fcn.10028dbd
mov dword [eax], esi
mov byte [ebp - 0x6b], 0
push 0x5781
push 0x2b04
push 0x6d8a
lea eax, [ebp - 0x6b]
push eax
push 0x2c46
push 0x2bc8
push 0x5d4a
push 1
push 0x759f
call fcn.1003d2d1
add esp, 0x24
jmp 0x10041e88
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x6c4], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2a0], 0
jmp 0x10041e2f
jmp 0x1004202f
mov dword [ebp - 0x110], 0
jmp 0x10041ff5
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jg 0x1004202f
mov dword [ebp - 0x30], 0
jmp 0x1004200e
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1004202d
mov byte [ebp - 0xbd], 0
lea eax, [ebp - 0xbd]
push eax
push 1
call fcn.1003d44b
pop ecx
pop ecx
jmp 0x10042007
jmp 0x10041fe8
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x7d4]
call fcn.10028da1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x59c]
call fcn.10028da1
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x6cc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x810]
call fcn.10043b10
mov eax, dword [ebp - 0x6cc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret