Function at 0x100285eb
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100748e7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x540
push esi
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10028649
push 0x5ceb
push 0x6cd2
push 0x2522
push 1
push 0x5125
push 0x5558
push 0xcff
push 0x4f1a
push 0x39ae
call fcn.1002ab34
add esp, 0x24
jmp 0x1002ab12
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2cc], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x23c]
movzx eax, byte [eax]
test eax, eax
je 0x1002aaad
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0xf8], eax
push 0x39b7
push 0x7522
push 1
push 0x693c
push 0
call fcn.1000e87e
add esp, 0x14
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xf8]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x428], 0xfdbd0176
mov dword [ebp - 0x2c4], 0xffffffff
mov dword [ebp - 0x4b4], 0x2280643b
mov dword [ebp - 0x42c], 0
push 2
lea ecx, [ebp - 0x480]
call fcn.1002fcd7
and dword [ebp - 4], 0
mov dword [ebp - 0x30c], 0xb49
mov dword [ebp - 0x90], 0
jmp 0x10028736
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 4
jge 0x10028752
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x54c], 0xe9ab5c29
jmp 0x10028729
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x480]
push eax
push 0
call fcn.10017695
add esp, 0xc
mov dword [ebp - 0x2d4], 0x1ab0
cmp dword [ebp - 0x2d4], 0xed2
jge 0x10028a1f
push 0x10668be8
push 0x11286550
mov ecx, 0x10667850
call fcn.1002f796
mov ecx, eax
call fcn.1002f796
mov edx, 0x1173be8c
mov ecx, 0x10667850
call fcn.10034a84
mov edx, 0x1173bee0
mov ecx, eax
call fcn.10034a84
or dword [ebp - 0x34], 0xffffffff
and dword [ebp - 0xac], 0
jmp 0x100287d4
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
mov ecx, 0x1173be8c
call fcn.1002f591
cmp dword [ebp - 0xac], eax
jae 0x1002880b
push dword [ebp - 0xac]
mov ecx, 0x1173be8c
call fcn.1002f57d
movsx eax, byte [eax]
cmp eax, 0x2a
jne 0x10028809
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x34], eax
jmp 0x1002880b
jmp 0x100287c7
cmp dword [ebp - 0x34], 0xffffffff
jne 0x10028834
mov edx, 0x1173bee0
mov ecx, 0x1173be8c
call fcn.10034b59
movzx eax, al
test eax, eax
je 0x10028834
push 0x10007768
call fcn.1005d752
pop ecx
jmp 0x1002885b
cmp dword [ebp - 0x34], 0xffffffff
jne 0x1002885b
mov edx, 0x1173bee0
mov ecx, 0x1173be8c
call fcn.10034b68
movzx eax, al
test eax, eax
je 0x1002885b
push 0x1000776c
call fcn.1005d752
pop ecx
mov ecx, 0x1173be8c
call fcn.1002f591
mov esi, eax
dec esi
mov ecx, 0x1173bee0
call fcn.1002f591
cmp esi, eax
jne 0x100288fa
cmp dword [ebp - 0x34], 0xffffffff
je 0x100288ef
push dword [ebp - 0x34]
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x434]
push eax
mov ecx, 0x1173be8c
call fcn.1002f54c
mov ecx, eax
call fcn.1003027f
mov eax, dword [eax]
mov dword [ebp - 0x2dc], eax
push dword [ebp - 0x2dc]
lea eax, [ebp - 0x4b8]
push eax
mov ecx, 0x1173be8c
call fcn.1002f512
mov edx, 0x1173bee0
mov ecx, 0x1173be8c
call fcn.10034b68
movzx eax, al
test eax, eax
je 0x100288e4
push 0x1000776c
call fcn.1005d752
pop ecx
jmp 0x100288ef
push 0x10007768
call fcn.1005d752
pop ecx
push 0x10007768
call fcn.1005d752
pop ecx
mov ecx, 0x1173be8c
call fcn.1002f591
mov esi, eax
mov ecx, 0x1173bee0
call fcn.1002f591
cmp esi, eax
jbe 0x1002891f
push 0x10007768
call fcn.1005d752
pop ecx
and dword [ebp - 0xa8], 0
jmp 0x10028935
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0x34]
jge 0x10028977
push dword [ebp - 0xa8]
mov ecx, 0x1173be8c
call fcn.1002f57d
movsx esi, byte [eax]
push dword [ebp - 0xa8]
mov ecx, 0x1173bee0
call fcn.1002f57d
movsx eax, byte [eax]
cmp esi, eax
je 0x10028975
push 0x10007768
call fcn.1005d752
pop ecx
jmp 0x10028928
mov ecx, 0x1173bee0
call fcn.1002f591
mov esi, eax
mov ecx, 0x1173be8c
call fcn.1002f591
sub esi, eax
inc esi
mov dword [ebp - 0x2e4], esi
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x108], eax
jmp 0x100289cb
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
mov ecx, 0x1173bee0
call fcn.1002f591
cmp dword [ebp - 0x108], eax
jae 0x10028a14
push dword [ebp - 0x114]
mov ecx, 0x1173be8c
call fcn.1002f57d
movsx esi, byte [eax]
push dword [ebp - 0x108]
mov ecx, 0x1173bee0
call fcn.1002f57d
movsx eax, byte [eax]
cmp esi, eax
je 0x10028a12
push 0x10007768
call fcn.1005d752
pop ecx
jmp 0x100289b1
push 0x1000776c
call fcn.1005d752
pop ecx
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x11a8
push 0
call fcn.1000eebd
add esp, 0x10
mov dword [ebp - 0x84], 0xa
jmp 0x10028a52
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xfffffff5
jg 0x10028bf8
push 3
lea ecx, [ebp - 0x358]
call fcn.1002fcd7
mov byte [ebp - 4], 1
mov dword [ebp - 0x1d8], 6
mov dword [ebp - 0x43c], 0x42b9193c
mov dword [ebp - 0x484], 0xfffffffa
mov dword [ebp - 0x444], 1
mov dword [ebp - 0x454], 0x96a0b597
mov dword [ebp - 0x314], 0xb441791e
mov dword [ebp - 0x2ec], 2
mov dword [ebp - 0x4a4], 0xffffffff
mov dword [ebp - 0x25c], 0xb3f4b141
push 3
lea ecx, [ebp - 0x470]
call fcn.1002fcd7
mov byte [ebp - 4], 2
lea eax, [ebp - 0xa0]
push eax
push 0x381
push 1
lea eax, [ebp - 0x358]
push eax
push 1
call fcn.1000b646
add esp, 0x14
mov dword [ebp - 0xa0], 0
jmp 0x10028b13
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jge 0x10028b32
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x470]
call fcn.1002fdaa
or dword [eax], 0xffffffff
jmp 0x10028b06
mov dword [ebp - 0x74], 2
jmp 0x10028b42
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jl 0x10028b9a
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x2a82
push 0x1439
push 1
push 0x6a10
push 0x7a2f
push 0x4fee
push 0x32dd
push 0x6778
lea eax, [ebp - 0x1d8]
push eax
push 0x5aa2
push 1
push 0x7547
push 0x64d
call fcn.1000b76b
add esp, 0x3c
jmp 0x10028b3b
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x1d8]
push eax
push 0
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x25c]
push eax
call fcn.1000cdce
add esp, 0x20
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x470]
call fcn.1002fd7f
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x358]
call fcn.1002fd7f
jmp 0x10028a45
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x480]
call fcn.1002fd7f
and dword [ebp - 0x144], 0
jmp 0x10028c26
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x28]
add eax, 0x28
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x144], eax
jge 0x1002aaab
push 2
lea ecx, [ebp - 0x490]
call fcn.1002fcd7
mov dword [ebp - 4], 3
mov dword [ebp - 0xf4], 0
mov dword [ebp - 0x408], 0x5c5735e4
mov dword [ebp - 0x410], 0x52835357
mov dword [ebp - 0x244], 0x1b1d
cmp dword [ebp - 0x244], 0x5fe
jge 0x10029058
lea eax, [ebp - 0x38]
push eax
push 0x1000773c
call fcn.1005cf7b
pop ecx
pop ecx
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2a8]
call fcn.1002fcd7
mov byte [ebp - 4], 4
and dword [ebp - 0x104], 0
jmp 0x10028cc2
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0x38]
jge 0x10028ced
push dword [ebp - 0x104]
lea ecx, [ebp - 0x2a8]
call fcn.1002fdaa
push eax
push 0x1000773c
call fcn.1005cf7b
pop ecx
pop ecx
jmp 0x10028cb5
or dword [ebp - 0x218], 0xffffffff
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x370]
call fcn.1002fd13
mov byte [ebp - 4], 5
or dword [ebp - 0x230], 0xffffffff
lea eax, [ebp - 0x230]
push eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x400]
call fcn.1002fd13
mov byte [ebp - 4], 6
mov dword [ebp - 0x308], 1
lea eax, [ebp - 0x308]
push eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x334]
call fcn.1002fd13
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x214]
call fcn.100303b3
mov byte [ebp - 4], 8
and dword [ebp - 0x24], 0
jmp 0x10028d6c
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x38]
jge 0x10028ee8
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2a8]
call fcn.1002fdaa
mov eax, dword [eax]
dec eax
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x214]
call fcn.1002ffd7
test eax, eax
je 0x10028ebe
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2a8]
call fcn.1002fdaa
mov eax, dword [eax]
dec eax
mov dword [ebp - 0x2b0], eax
lea eax, [ebp - 0x2b0]
push eax
lea ecx, [ebp - 0x214]
call fcn.100303c8
push eax
lea ecx, [ebp - 0x3e8]
call fcn.1002fd35
mov byte [ebp - 4], 9
and dword [ebp - 0xbc], 0
jmp 0x10028df8
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
lea ecx, [ebp - 0x3e8]
call fcn.1002fda1
cmp dword [ebp - 0xbc], eax
jae 0x10028eaf
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x3e8]
call fcn.1002fdaa
mov eax, dword [eax]
mov dword [ebp - 0x98], eax
push dword [ebp - 0x98]
lea ecx, [ebp - 0x370]
call fcn.1002fdaa
cmp dword [eax], 0
jle 0x10028e5a
push dword [ebp - 0x98]
lea ecx, [ebp - 0x370]
call fcn.1002fdaa
mov eax, dword [eax]
cmp eax, dword [ebp - 0x24]
jge 0x10028e5a
jmp 0x10028deb
push dword [ebp - 0x98]
lea ecx, [ebp - 0x370]
call fcn.1002fdaa
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
push dword [ebp - 0x24]
lea ecx, [ebp - 0x400]
call fcn.1002fdaa
mov ecx, dword [ebp - 0x98]
mov dword [eax], ecx
push dword [ebp - 0x98]
lea ecx, [ebp - 0x334]
call fcn.1002fdaa
mov esi, dword [eax]
inc esi
push dword [ebp - 0x24]
lea ecx, [ebp - 0x334]
call fcn.1002fdaa
mov dword [eax], esi
jmp 0x10028deb
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x3e8]
call fcn.1002fd7f
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2a8]
call fcn.1002fdaa
push eax
lea ecx, [ebp - 0x214]
call fcn.100303c8
mov ecx, eax
call fcn.1002fdc0
jmp 0x10028d65
and dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x88], eax
and dword [ebp - 0x7c], 0
jmp 0x10028f06
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x38]
jge 0x10028f49
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x334]
call fcn.1002fdaa
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1e0]
jge 0x10028f28
jmp 0x10028eff
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x334]
call fcn.1002fdaa
mov eax, dword [eax]
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x88], eax
jmp 0x10028eff
lea ecx, [ebp - 0x324]
call fcn.1002fcca
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x88], 0
jl 0x10028f8e
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x324]
call fcn.1002fdc0
push dword [ebp - 0x88]
lea ecx, [ebp - 0x400]
call fcn.1002fdaa
mov eax, dword [eax]
mov dword [ebp - 0x88], eax
jmp 0x10028f58
lea ecx, [ebp - 0x324]
call fcn.1002fda1
push eax
push 0x10007760
call fcn.1005d3c8
pop ecx
pop ecx
lea ecx, [ebp - 0x324]
call fcn.1002fda1
dec eax
mov dword [ebp - 0xec], eax
jmp 0x10028fc7
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x10028ff3
push dword [ebp - 0xec]
lea ecx, [ebp - 0x324]
call fcn.1002fdaa
mov eax, dword [eax]
inc eax
push eax
push 0x10007770
call fcn.1005d3c8
pop ecx
pop ecx
jmp 0x10028fba
push 0x100076a5
call fcn.1005d752
pop ecx
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x324]
call fcn.1002fd7f
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x214]
call fcn.10030419
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x334]
call fcn.1002fd7f
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x400]
call fcn.1002fd7f
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x370]
call fcn.1002fd7f
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2a8]
call fcn.1002fd7f
mov dword [ebp - 0x418], 0xa0a5dec4
mov dword [ebp - 0xc4], 0
jmp 0x1002907b
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 2
jge 0x1002909d
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x490]
call fcn.1002fdaa
mov dword [eax], 0xfffffff7
jmp 0x1002906e
mov dword [ebp - 0xf4], 1
jmp 0x100290b6
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
jl 0x100291d3
mov dword [ebp - 0xd0], 4
mov dword [ebp - 0x420], 0x2fb5a5ef
mov dword [ebp - 0x240], 0x8a94b2ab
mov dword [ebp - 0xfc], 0
jmp 0x100290fa
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
jge 0x10029116
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x404], 0x644accb2
jmp 0x100290ed
mov dword [ebp - 0xd0], 1
jmp 0x1002912f
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jl 0x100291ce
mov dword [ebp - 0xf0], 0
jmp 0x10029155
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 2
jge 0x10029171
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x394], 0xffff
jmp 0x10029148
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x394]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x394], eax
push 0x656f
push 0x7284
push 0x2a6c
push 0
push 0xd07
push 1
push 0x509f
push 0x4a4f
push 0x19ac
push 1
push 0x807
lea eax, [ebp - 0x240]
push eax
call fcn.1000f60e
add esp, 0x30
jmp 0x10029122
jmp 0x100290a9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x490]
call fcn.1002fd7f
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x24]
and eax, 0x20000000
je 0x100291fb
mov dword [ebp - 0x1e8], 1
jmp 0x10029202
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x318], eax
mov dword [ebp - 0x2e8], 6
push 3
lea ecx, [ebp - 0x3f4]
call fcn.1002fcd7
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x430], 1
mov dword [ebp - 0xd8], 0
jmp 0x1002924f
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x10029271
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x3f4]
call fcn.1002fdaa
mov dword [eax], 3
jmp 0x10029242
lea eax, [ebp - 0x2e8]
push eax
push 1
push 0x6cf5
push 0x2105
push 0x572b
push 1
push 0x5a66
push 1
lea eax, [ebp - 0x3f4]
push eax
push 0x7dd3
call fcn.1000bef1
add esp, 0x28
mov byte [ebp - 0x45], 0
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x100292b8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3f4]
call fcn.1002fd7f
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x24]
and eax, 0x40000000
je 0x100292e0
mov dword [ebp - 0x1f0], 1
jmp 0x100292e7
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x1c], 7
push 2
lea ecx, [ebp - 0x364]
call fcn.1002fcd7
mov dword [ebp - 4], 0xc
push 2
lea ecx, [ebp - 0x3dc]
call fcn.1002fcd7
mov byte [ebp - 4], 0xd
push 1
lea ecx, [ebp - 0x34c]
call fcn.1002fcd7
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x174], 0xfffffffc
mov dword [ebp - 0x1e4], 0xaf86f25d
mov dword [ebp - 0x194], 0x215169ff
mov dword [ebp - 0x248], 0x37f4a7d2
mov dword [ebp - 0x30], 0
jmp 0x10029368
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x10029384
push dword [ebp - 0x30]
lea ecx, [ebp - 0x364]
call fcn.1002fdaa
mov dword [eax], 5
jmp 0x10029361
push 0x5433
push 1
push 0x2473
push 0x560d
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x3dc]
push eax
push 1
call fcn.1000c051
add esp, 0x1c
mov dword [ebp - 0x30], 0
jmp 0x100293ba
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x100293d3
push dword [ebp - 0x30]
lea ecx, [ebp - 0x34c]
call fcn.1002fdaa
or dword [eax], 0xffffffff
jmp 0x100293b3
cmp dword [ebp - 0x1c], 0
jne 0x100293e7
xor eax, eax
inc eax
jne 0x100293e7
and dword [ebp - 0x1f8], 0
jmp 0x100293f1
mov dword [ebp - 0x1f8], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1f8], eax
jle 0x10029408
mov dword [ebp - 0x1f4], 1
jmp 0x1002940f
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1f4], eax
jl 0x10029426
mov dword [ebp - 0x130], 1
jmp 0x1002942d
and dword [ebp - 0x130], 0
push 1
lea ecx, [ebp - 0x3dc]
call fcn.1002fdaa
mov ecx, dword [ebp - 0x130]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x130], eax
jle 0x10029459
mov dword [ebp - 0x140], 1
jmp 0x10029460
and dword [ebp - 0x140], 0
push 0
lea ecx, [ebp - 0x34c]
call fcn.1002fdaa
mov ecx, dword [ebp - 0x140]
mov dword [eax], ecx
cmp dword [ebp - 0x140], 1
ja 0x1002948a
mov dword [ebp - 0x158], 1
jmp 0x10029491
and dword [ebp - 0x158], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x158], eax
jge 0x100294b7
push 0
lea ecx, [ebp - 0x34c]
call fcn.1002fdaa
cmp dword [eax], 0
jne 0x100294b7
and dword [ebp - 0x1bc], 0
jmp 0x100294c1
mov dword [ebp - 0x1bc], 1
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x1c], eax
jne 0x100294f0
mov dword [ebp - 0x17c], 1
jmp 0x100294f7
and dword [ebp - 0x17c], 0
cmp dword [ebp - 0x17c], 0xfffffff6
je 0x1002950c
mov dword [ebp - 0x184], 1
jmp 0x10029513
and dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c4], eax
push 0
lea ecx, [ebp - 0x364]
call fcn.1002fdaa
mov ecx, dword [ebp - 0x1c4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c4]
cmp eax, dword [ebp - 0x184]
jne 0x1002954b
mov dword [ebp - 0x20c], 1
jmp 0x10029552
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x20c], eax
jne 0x10029569
mov dword [ebp - 0x18c], 1
jmp 0x10029570
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x18c]
cmp eax, dword [ebp - 0x1c]
je 0x1002959d
push 0
lea ecx, [ebp - 0x364]
call fcn.1002fdaa
cmp dword [eax], 0
je 0x1002959d
mov dword [ebp - 0x1cc], 1
jmp 0x100295a4
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x194], eax
jl 0x100295cb
mov dword [ebp - 0x1ec], 1
jmp 0x100295d2
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x248], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x34c]
call fcn.1002fd7f
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x3dc]
call fcn.1002fd7f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x364]
call fcn.1002fd7f
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x24]
and eax, 0x80000000
je 0x10029624
mov dword [ebp - 0x19c], 1
jmp 0x1002962b
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x20], 7
push 2
lea ecx, [ebp - 0x340]
call fcn.1002fcd7
mov dword [ebp - 4], 0xf
push 2
lea ecx, [ebp - 0x3c4]
call fcn.1002fcd7
mov byte [ebp - 4], 0x10
push 1
lea ecx, [ebp - 0x37c]
call fcn.1002fcd7
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x1dc], 0xfffffffc
mov dword [ebp - 0x1b4], 0xaf86f25d
mov dword [ebp - 0x190], 0x215169ff
mov dword [ebp - 0x2b8], 0x37f4a7d2
push 0x38ac
lea eax, [ebp - 0x2c]
push eax
push 0xf51
push 0
lea eax, [ebp - 0x340]
push eax
call fcn.1000eb6a
add esp, 0x14
mov dword [ebp - 0x2c], 0
jmp 0x100296cb
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x100296e7
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x3c4]
call fcn.1002fdaa
mov dword [eax], 0x509e71b3
jmp 0x100296c4
mov dword [ebp - 0x2c], 0
jmp 0x100296f7
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10029710
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x37c]
call fcn.1002fdaa
or dword [eax], 0xffffffff
jmp 0x100296f0
cmp dword [ebp - 0x20], 0
jne 0x10029724
xor eax, eax
inc eax
jne 0x10029724
and dword [ebp - 0x1d4], 0
jmp 0x1002972e
mov dword [ebp - 0x1d4], 1
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1d4], eax
jle 0x10029745
mov dword [ebp - 0x1a4], 1
jmp 0x1002974c
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1a4], eax
jl 0x10029763
mov dword [ebp - 0x120], 1
jmp 0x1002976a
and dword [ebp - 0x120], 0
push 1
lea ecx, [ebp - 0x3c4]
call fcn.1002fdaa
mov ecx, dword [ebp - 0x120]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x120], eax
jle 0x10029796
mov dword [ebp - 0x138], 1
jmp 0x1002979d
and dword [ebp - 0x138], 0
push 0
lea ecx, [ebp - 0x37c]
call fcn.1002fdaa
mov ecx, dword [ebp - 0x138]
mov dword [eax], ecx
cmp dword [ebp - 0x138], 1
ja 0x100297c7
mov dword [ebp - 0x1fc], 1
jmp 0x100297ce
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1fc], eax
jge 0x100297f4
push 0
lea ecx, [ebp - 0x37c]
call fcn.1002fdaa
cmp dword [eax], 0
jne 0x100297f4
and dword [ebp - 0x1ac], 0
jmp 0x100297fe
mov dword [ebp - 0x1ac], 1
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x20], eax
jne 0x1002982d
mov dword [ebp - 0x15c], 1
jmp 0x10029834
and dword [ebp - 0x15c], 0
cmp dword [ebp - 0x15c], 0xfffffff6
je 0x10029849
mov dword [ebp - 0x170], 1
jmp 0x10029850
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x160], eax
push 0
lea ecx, [ebp - 0x340]
call fcn.1002fdaa
mov ecx, dword [ebp - 0x160]
mov dword [eax], ecx
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x170]
jne 0x10029888
mov dword [ebp - 0x178], 1
jmp 0x1002988f
and dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x178], eax
jne 0x100298a6
mov dword [ebp - 0x180], 1
jmp 0x100298ad
and dword [ebp - 0x180], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x180]
cmp eax, dword [ebp - 0x20]
je 0x100298da
push 0
lea ecx, [ebp - 0x340]
call fcn.1002fdaa
cmp dword [eax], 0
je 0x100298da
mov dword [ebp - 0x188], 1
jmp 0x100298e1
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x188]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x190], eax
jl 0x10029908
mov dword [ebp - 0x198], 1
jmp 0x1002990f
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x2b8], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x37c]
call fcn.1002fd7f
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x3c4]
call fcn.1002fd7f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x340]
call fcn.1002fd7f
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x24]
and eax, 0x2000000
je 0x1002997e
push 0x4000
mov eax, dword [ebp - 0x28]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x28]
push dword [eax + 8]
push 0x9101
push 0xb082
call fcn.10051be4
pop ecx
pop ecx
call eax
jmp 0x10028c10
mov dword [ebp - 0x80], 0xeac8
mov dword [ebp - 0x438], 0x48708ef6
mov dword [ebp - 0x440], 0x6e6a3735
mov dword [ebp - 0x448], 1
mov dword [ebp - 0x3b8], 0x85a7b051
mov dword [ebp - 0x3b4], 0x85a7b051
mov dword [ebp - 0x3b0], 0x85a7b051
mov dword [ebp - 0x3ac], 0x85a7b051
lea ecx, [ebp - 0x139]
call fcn.1002fec9
push eax
lea eax, [ebp - 0x3a8]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea ecx, [ebp - 0x514]
call fcn.1002fecc
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x4b0]
call fcn.1002fe18
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x4cc], 0xf1e283d1
mov dword [ebp - 0x100], 0
jmp 0x10029a2a
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 3
jge 0x10029a46
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x4a0], 0
jmp 0x10029a1d
cmp dword [ebp - 0x80], 0
je 0x10029af9
mov dword [ebp - 0x494], 0xffffffff
mov dword [ebp - 0x44c], 0xfffffff6
mov dword [ebp - 0x450], 0xfe77dd68
mov dword [ebp - 0x458], 0x210e164c
mov dword [ebp - 0x460], 0xfffffffb
mov dword [ebp - 0x4c8], 0xf30836b1
mov dword [ebp - 0x4c4], 0xf30836b1
mov dword [ebp - 0x4c0], 0xf30836b1
mov dword [ebp - 0x4bc], 0xf30836b1
mov dword [ebp - 0x4d4], 0x89fe
mov byte [ebp - 0x50], 0
push 0x2db7
push 0x26cb
push 0x47f3
push 0x9ed
lea eax, [ebp - 0x50]
push eax
push 0
push 1
call fcn.10022435
add esp, 0x1c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4a0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x4a0], eax
jmp 0x10029b20
mov byte [ebp - 0x4d], 0
movzx eax, byte [ebp - 0x4d]
test eax, eax
je 0x10029b20
push 0x2f80
push 1
push 0xa6f
push 0x58fe
push 1
call fcn.1000c123
add esp, 0x14
mov dword [ebp - 0x80], 0
jmp 0x10029b30
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jg 0x10029b4d
push 0
lea eax, [ebp - 0x4b0]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.1000d4df
add esp, 0xc
jmp 0x10029b29
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4b0]
call fcn.1002fd7f
push 0x8d3
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x26c]
push eax
push 0x7bb
push 0x213d
push 1
lea eax, [ebp - 0x318]
push eax
push 0
push 1
push 0x755b
lea eax, [ebp - 0x28]
push eax
push 0x31cd
push 0x7659
push 0x31f1
push 0x5ed6
push 0x2719
lea eax, [ebp - 0x258]
push eax
call fcn.1000ce1a
add esp, 0x44
mov dword [ebp - 0x8c], 0x399841b3
mov dword [ebp - 0x2c0], 0x383cc47d
mov dword [ebp - 0x310], 2
mov dword [ebp - 0x2f0], 6
mov dword [ebp - 0x270], 0xa9b65cab
mov dword [ebp - 0x2c8], 0x28cbd6cd
push 3
lea ecx, [ebp - 0x3d0]
call fcn.1002fcd7
mov dword [ebp - 4], 0x13
mov dword [ebp - 0xe0], 0
jmp 0x10029c20
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jge 0x10029c42
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x3d0]
call fcn.1002fdaa
mov dword [eax], 0xa38c8a25
jmp 0x10029c13
mov dword [ebp - 0x8c], 0xc
jmp 0x10029c5b
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xf
jne 0x10029cf9
mov dword [ebp - 0x268], 0xdad5a519
mov dword [ebp - 0x260], 0x3624b674
push 0x6787
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x3d0]
push eax
push 0x389d
push 1
push 0xbd7
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x2f0]
push eax
push 0x528c
push 0x148a
push 0x5877
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x268]
push eax
push 0x4b67
push 1
lea eax, [ebp - 0x2c8]
push eax
lea eax, [ebp - 0x270]
push eax
push 0x7c81
lea eax, [ebp - 0x310]
push eax
push 0x2c30
call fcn.1000c2fb
add esp, 0x50
jmp 0x10029c4e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3d0]
call fcn.1002fd7f
push 0x2d1
push 0x2bc2
lea eax, [ebp - 0x1d0]
push eax
push 0
push 0x3a82
push dword [ebp - 0xf8]
push 1
push 0x41c
push dword [ebp - 0x28]
push 1
push 0x62f2
push 0x364c
push 0x5361
push 0x5d4b
call fcn.1002ab6f
add esp, 0x38
mov dword [ebp - 0x9c], 0xe1757117
mov dword [ebp - 0x22c], 0xfffffff7
mov dword [ebp - 0x278], 0x188a
cmp dword [ebp - 0x278], 0x133e
jge 0x10029ed8
call fcn.1005d0b5
push 0x20
pop ecx
imul ecx, ecx, 0
add eax, ecx
push eax
push 0x10007884
push 0x10007888
call fcn.1005d60f
add esp, 0xc
call fcn.1005d0b5
push 0x20
pop ecx
shl ecx, 0
add eax, ecx
push eax
push 0x10007890
push 0x10007894
call fcn.1005d60f
add esp, 0xc
mov dword [ebp - 0x128], 1
xor eax, eax
inc eax
je 0x10029ed8
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x44]
push eax
push 0x1000782c
call fcn.1005cf7b
add esp, 0x10
cmp dword [ebp - 0x44], 0
jne 0x10029dff
cmp dword [ebp - 0x4c], 0
jne 0x10029dff
cmp dword [ebp - 0x40], 0
jne 0x10029dff
jmp 0x10029ed8
push dword [ebp - 0x128]
push 0x10007924
call fcn.1005d3c8
pop ecx
pop ecx
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x44], 0xffffffff
jne 0x10029e64
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x4c]
jge 0x10029e39
push 0x10007934
call fcn.1005d3c8
pop ecx
jmp 0x10029e62
mov ecx, dword [ebp - 0x40]
imul ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x4c]
sub ecx, eax
call fcn.10034b84
push ecx
push ecx
movsd qword [esp], xmm0
push 0x10007944
call fcn.1005d3c8
add esp, 0xc
jmp 0x10029ed3
cmp dword [ebp - 0x4c], 0xffffffff
jne 0x10029eaa
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x44]
jge 0x10029e7f
push 0x10007934
call fcn.1005d3c8
pop ecx
jmp 0x10029ea8
mov ecx, dword [ebp - 0x40]
imul ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x44]
sub ecx, eax
call fcn.10034b84
push ecx
push ecx
movsd qword [esp], xmm0
push 0x10007950
call fcn.1005d3c8
add esp, 0xc
jmp 0x10029ed3
mov ecx, dword [ebp - 0x44]
imul ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x4c]
add ecx, eax
call fcn.10034b84
push ecx
push ecx
movsd qword [esp], xmm0
push 0x1000795c
call fcn.1005d3c8
add esp, 0xc
jmp 0x10029dc6
mov dword [ebp - 0x4dc], 0x5196ee4e
mov dword [ebp - 0x2d0], 0x21a8
cmp dword [ebp - 0x2d0], 0x7d4
jge 0x1002a33c
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x68]
push eax
push 0x10007744
call fcn.1005cf7b
add esp, 0xc
and dword [ebp - 0x280], 0
lea eax, [ebp - 0x280]
push eax
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x4e8]
call fcn.1002fd13
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x288], eax
mov dword [ebp - 4], 0x14
push dword [ebp - 0x288]
push dword [ebp - 0x68]
lea ecx, [ebp - 0x16c]
call fcn.1002ff47
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x4e8]
call fcn.1002fd7f
and dword [ebp - 0x2d8], 0
lea eax, [ebp - 0x2d8]
push eax
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x4f4]
call fcn.1002fd13
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x328], eax
mov byte [ebp - 4], 0x17
push dword [ebp - 0x328]
push dword [ebp - 0x68]
lea ecx, [ebp - 0x208]
call fcn.1002ff47
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x4f4]
call fcn.1002fd7f
and dword [ebp - 0xc8], 0
jmp 0x10029fd4
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0x68]
jge 0x1002a02f
and dword [ebp - 0xe8], 0
jmp 0x10029ff5
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0x6c]
jge 0x1002a02d
push dword [ebp - 0xe8]
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x16c]
call fcn.1002ff6e
mov ecx, eax
call fcn.1002fdaa
push eax
push 0x1000773c
call fcn.1005cf7b
pop ecx
pop ecx
jmp 0x10029fe8
jmp 0x10029fc7
and dword [ebp - 0xd4], 0
jmp 0x1002a045
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x68]
jge 0x1002a0a0
and dword [ebp - 0xcc], 0
jmp 0x1002a066
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0x6c]
jge 0x1002a09e
push dword [ebp - 0xcc]
push dword [ebp - 0xd4]
lea ecx, [ebp - 0x208]
call fcn.1002ff6e
mov ecx, eax
call fcn.1002fdaa
push eax
push 0x1000773c
call fcn.1005cf7b
pop ecx
pop ecx
jmp 0x1002a059
jmp 0x1002a038
and dword [ebp - 0x54], 0
jmp 0x1002a0ad
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x68]
jge 0x1002a1ac
and dword [ebp - 0x3c], 0
jmp 0x1002a0c6
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x6c]
jge 0x1002a1a7
push dword [ebp - 0x3c]
push dword [ebp - 0x54]
lea ecx, [ebp - 0x16c]
call fcn.1002ff6e
mov ecx, eax
call fcn.1002fdaa
mov eax, dword [eax]
mov dword [ebp - 0xdc], eax
push dword [ebp - 0x3c]
push dword [ebp - 0x54]
lea ecx, [ebp - 0x208]
call fcn.1002ff6e
mov ecx, eax
call fcn.1002fdaa
mov eax, dword [eax]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0xe4]
jge 0x1002a12e
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x1a0], eax
jmp 0x1002a13a
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x1a0], eax
push dword [ebp - 0x3c]
push dword [ebp - 0x54]
lea ecx, [ebp - 0x16c]
call fcn.1002ff6e
mov ecx, eax
call fcn.1002fdaa
mov ecx, dword [ebp - 0x1a0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0xe4]
jle 0x1002a176
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x1a8], eax
jmp 0x1002a182
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x1a8], eax
push dword [ebp - 0x3c]
push dword [ebp - 0x54]
lea ecx, [ebp - 0x208]
call fcn.1002ff6e
mov ecx, eax
call fcn.1002fdaa
mov ecx, dword [ebp - 0x1a8]
mov dword [eax], ecx
jmp 0x1002a0bf
jmp 0x1002a0a6
mov byte [ebp - 0xd], 1
and dword [ebp - 0x14], 0
jmp 0x1002a1bd
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x68]
jge 0x1002a2f4
and dword [ebp - 0x18], 0
jmp 0x1002a1d6
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x6c]
jge 0x1002a2ef
cmp dword [ebp - 0x14], 0
jle 0x1002a222
push dword [ebp - 0x18]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x16c]
call fcn.1002ff6e
mov ecx, eax
call fcn.1002fdaa
mov esi, eax
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
dec eax
push eax
lea ecx, [ebp - 0x16c]
call fcn.1002ff6e
mov ecx, eax
call fcn.1002fdaa
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x1002a262
cmp dword [ebp - 0x18], 0
jle 0x1002a266
push dword [ebp - 0x18]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x16c]
call fcn.1002ff6e
mov ecx, eax
call fcn.1002fdaa
mov esi, eax
mov eax, dword [ebp - 0x18]
dec eax
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x16c]
call fcn.1002ff6e
mov ecx, eax
call fcn.1002fdaa
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x1002a266
mov byte [ebp - 0xd], 0
cmp dword [ebp - 0x14], 0
jle 0x1002a2a6
push dword [ebp - 0x18]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x208]
call fcn.1002ff6e
mov ecx, eax
call fcn.1002fdaa
mov esi, eax
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
dec eax
push eax
lea ecx, [ebp - 0x208]
call fcn.1002ff6e
mov ecx, eax
call fcn.1002fdaa
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x1002a2e6
cmp dword [ebp - 0x18], 0
jle 0x1002a2ea
push dword [ebp - 0x18]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x208]
call fcn.1002ff6e
mov ecx, eax
call fcn.1002fdaa
mov esi, eax
mov eax, dword [ebp - 0x18]
dec eax
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x208]
call fcn.1002ff6e
mov ecx, eax
call fcn.1002fdaa
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x1002a2ea
mov byte [ebp - 0xd], 0
jmp 0x1002a1cf
jmp 0x1002a1b6
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x1002a308
mov dword [ebp - 0x1b0], 0x100077f8
jmp 0x1002a312
mov dword [ebp - 0x1b0], 0x10007804
push dword [ebp - 0x1b0]
call fcn.1005d752
pop ecx
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x208]
call fcn.1002ff69
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16c]
call fcn.1002ff69
mov dword [ebp - 0x21c], 5
mov dword [ebp - 0x298], 0x1997
cmp dword [ebp - 0x298], 0x966
jge 0x1002a544
lea eax, [ebp - 0x1b8]
push eax
push 0x10007738
call fcn.1005cf7b
pop ecx
pop ecx
xorpd xmm0, xmm0
movlpd qword [ebp - 0x64], xmm0
and dword [ebp - 0x94], 0
jmp 0x1002a392
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x1b8]
jge 0x1002a3d6
mov eax, dword [ebp - 0x94]
lea eax, [eax*4 + 0x10906ce8]
push eax
push 0x10007738
call fcn.1005cf7b
pop ecx
pop ecx
mov eax, dword [ebp - 0x94]
mov eax, dword [eax*4 + 0x10906ce8]
cdq
add eax, dword [ebp - 0x64]
adc edx, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
jmp 0x1002a385
push 0
push 3
push dword [ebp - 0x60]
push dword [ebp - 0x64]
call fcn.10073b80
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x2f4], edx
mov eax, dword [ebp - 0x2f8]
or eax, dword [ebp - 0x2f4]
je 0x1002a40f
push 0x10007880
call fcn.1005d752
pop ecx
jmp 0x1002a544
push 0
push 3
push dword [ebp - 0x60]
push dword [ebp - 0x64]
call fcn.10073ad0
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
xorpd xmm0, xmm0
movlpd qword [ebp - 0x110], xmm0
xorpd xmm0, xmm0
movlpd qword [ebp - 0x14c], xmm0
xorpd xmm0, xmm0
movlpd qword [ebp - 0x154], xmm0
and dword [ebp - 0xb0], 0
jmp 0x1002a45e
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x1b8]
dec eax
cmp dword [ebp - 0xb0], eax
jge 0x1002a52b
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax*4 + 0x10906ce8]
cdq
add eax, dword [ebp - 0x110]
adc edx, dword [ebp - 0x10c]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], edx
push 0
push 2
push dword [ebp - 0x60]
push dword [ebp - 0x64]
call fcn.10060fc0
mov dword [ebp - 0x304], eax
mov dword [ebp - 0x300], edx
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x304]
jne 0x1002a4f2
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x300]
jne 0x1002a4f2
mov eax, dword [ebp - 0x14c]
add eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0x148]
adc ecx, dword [ebp - 0x150]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], ecx
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x64]
jne 0x1002a526
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x60]
jne 0x1002a526
mov eax, dword [ebp - 0x154]
add eax, 1
mov ecx, dword [ebp - 0x150]
adc ecx, 0
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], ecx
jmp 0x1002a451
push dword [ebp - 0x148]
push dword [ebp - 0x14c]
push 0x1000774c
call fcn.1005d3c8
add esp, 0xc
mov dword [ebp - 0x4d8], 0x950a4ba3
mov dword [ebp - 0xa4], 0xbeab1d6a
mov dword [ebp - 0x9c], 0xffffffe4
jmp 0x1002a571
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xfffffffe
jge 0x1002a79d
mov dword [ebp - 0x2e0], 0xffffffff
mov dword [ebp - 0xb4], 0xfffffffb
mov dword [ebp - 0x40c], 0xe00f6802
mov dword [ebp - 0x228], 0xfffffff7
cmp dword [ebp - 0x9c], 8
jae 0x1002a5bb
mov dword [ebp - 0x1c0], 1
jmp 0x1002a5c2
and dword [ebp - 0x1c0], 0
cmp dword [ebp - 0x2e0], 0xdcb3
jg 0x1002a5da
mov dword [ebp - 0x1c8], 1
jmp 0x1002a5e1
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x1c0]
add eax, dword [ebp - 0x1c8]
je 0x1002a634
mov dword [ebp - 0x45c], 0xba1a
mov dword [ebp - 0x414], 0x1f09a2b4
mov dword [ebp - 0x4d0], 0xc694a61b
mov dword [ebp - 0x41c], 0xeb449523
lea eax, [ebp - 0xa4]
push eax
push 0
push 0x3be0
push 0x187d
call fcn.10015585
add esp, 0x10
jmp 0x1002a669
mov dword [ebp - 0x234], 1
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x22c]
push eax
push 1
push 0x6713
lea eax, [ebp - 0x234]
push eax
push 1
push 0x7289
call fcn.1000c79e
add esp, 0x1c
mov dword [ebp - 0xa4], 0xfffffff0
jmp 0x1002a682
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x25
jge 0x1002a798
mov dword [ebp - 0xb4], 0x17
jmp 0x1002a6a8
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0xfffffffd
je 0x1002a793
mov dword [ebp - 0x224], 0x1944
cmp dword [ebp - 0x224], 0xba0
jge 0x1002a72e
lea eax, [ebp - 0x12c]
push eax
push 0x1000773c
call fcn.1005cf7b
pop ecx
pop ecx
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x220], 0
je 0x1002a72e
lea eax, [ebp - 0x24c]
push eax
push 0x1000773c
call fcn.1005cf7b
pop ecx
pop ecx
mov eax, dword [ebp - 0x24c]
inc eax
cdq
sub eax, edx
sar eax, 1
push eax
push 0x10007760
call fcn.1005d3c8
pop ecx
pop ecx
jmp 0x1002a6de
mov dword [ebp - 0x254], 0xeaa3e8f0
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x21c], eax
mov byte [ebp - 0x4e], 0
movzx eax, byte [ebp - 0x4e]
test eax, eax
je 0x1002a78e
push 1
push 0x3fda
push 0xefb
push 0x570a
push 0xeda
push 0x7a0a
push 0x56ac
push 0x280c
push 0x1878
push 0x2e58
push 0x19b4
push 1
call fcn.1000c919
add esp, 0x30
jmp 0x1002a69b
jmp 0x1002a675
jmp 0x1002a564
cmp dword [ebp - 0x1d0], 0
jbe 0x1002aaa6
mov dword [ebp - 0x264], 0x1b31
cmp dword [ebp - 0x264], 0x6e9
jge 0x1002aa7a
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push 0x10007754
call fcn.1005cf7b
add esp, 0xc
mov byte [ebp - 0x4f], 0
lea eax, [ebp - 0x4f]
push eax
push dword [ebp - 0x70]
lea ecx, [ebp - 0x38c]
call fcn.10030442
mov dword [ebp - 4], 0x1a
mov byte [ebp - 0x55], 0
lea eax, [ebp - 0x55]
push eax
push dword [ebp - 0x78]
lea ecx, [ebp - 0x3a4]
call fcn.10030442
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0x11c]
push eax
push 0x10007738
call fcn.1005cf7b
pop ecx
pop ecx
and dword [ebp - 0x134], 0
jmp 0x1002a839
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x134]
cmp eax, dword [ebp - 0x11c]
jge 0x1002a87d
lea eax, [ebp - 0x124]
push eax
push 0x10007738
call fcn.1005cf7b
pop ecx
pop ecx
push 1
push dword [ebp - 0x124]
lea eax, [ebp - 0x4fc]
push eax
lea ecx, [ebp - 0x38c]
call fcn.100304c3
mov ecx, eax
call fcn.1003050a
jmp 0x1002a82c
lea eax, [ebp - 0x11c]
push eax
push 0x10007738
call fcn.1005cf7b
pop ecx
pop ecx
and dword [ebp - 0x118], 0
jmp 0x1002a8a6
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x11c]
jge 0x1002a8ea
lea eax, [ebp - 0x124]
push eax
push 0x10007738
call fcn.1005cf7b
pop ecx
pop ecx
push 1
push dword [ebp - 0x124]
lea eax, [ebp - 0x524]
push eax
lea ecx, [ebp - 0x3a4]
call fcn.100304c3
mov ecx, eax
call fcn.1003050a
jmp 0x1002a899
and dword [ebp - 0x464], 0
and dword [ebp - 0x5c], 0
jmp 0x1002a8fe
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x78]
imul eax, dword [ebp - 0x78]
imul eax, dword [ebp - 0x70]
imul eax, dword [ebp - 0x70]
cmp dword [ebp - 0x5c], eax
jge 0x1002a9a9
mov eax, dword [ebp - 0x5c]
cdq
idiv dword [ebp - 0x70]
push edx
lea eax, [ebp - 0x51c]
push eax
lea ecx, [ebp - 0x38c]
call fcn.100304c3
mov ecx, eax
call fcn.1003052f
movzx esi, al
mov eax, dword [ebp - 0x5c]
cdq
idiv dword [ebp - 0x78]
push edx
lea eax, [ebp - 0x53c]
push eax
lea ecx, [ebp - 0x3a4]
call fcn.100304c3
mov ecx, eax
call fcn.1003052f
movzx eax, al
or esi, eax
push esi
mov eax, dword [ebp - 0x5c]
cdq
idiv dword [ebp - 0x78]
push edx
lea eax, [ebp - 0x504]
push eax
lea ecx, [ebp - 0x3a4]
call fcn.100304c3
mov ecx, eax
call fcn.1003050a
push eax
mov eax, dword [ebp - 0x5c]
cdq
idiv dword [ebp - 0x70]
push edx
lea eax, [ebp - 0x534]
push eax
lea ecx, [ebp - 0x38c]
call fcn.100304c3
mov ecx, eax
call fcn.100304e2
jmp 0x1002a8f7
and dword [ebp - 0xb8], 0
jmp 0x1002a9bf
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x70]
jge 0x1002a9fd
push dword [ebp - 0xb8]
lea eax, [ebp - 0x50c]
push eax
lea ecx, [ebp - 0x38c]
call fcn.100304c3
mov ecx, eax
call fcn.1003052f
movzx eax, al
test eax, eax
jne 0x1002a9fb
push 0x10007788
call fcn.1005d752
pop ecx
jmp 0x1002a9b2
and dword [ebp - 0xc0], 0
jmp 0x1002aa13
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0x78]
jge 0x1002aa51
push dword [ebp - 0xc0]
lea eax, [ebp - 0x52c]
push eax
lea ecx, [ebp - 0x3a4]
call fcn.100304c3
mov ecx, eax
call fcn.1003052f
movzx eax, al
test eax, eax
jne 0x1002aa4f
push 0x10007788
call fcn.1005d752
pop ecx
jmp 0x1002aa06
push 0x10007784
call fcn.1005d752
pop ecx
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x3a4]
call fcn.100304a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38c]
call fcn.100304a3
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x26c]
push dword [ebp - 0x1d0]
mov eax, dword [ebp - 0x28]
push dword [eax + 8]
push 0x9101
push 0xaa35
call fcn.10051be4
pop ecx
pop ecx
call eax
jmp 0x10028c10
jmp 0x1002ab12
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x294], eax
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x2ac]
push dword [eax]
mov ecx, dword [ebp - 0x2b4]
call fcn.1002fdaa
mov ecx, dword [ebp - 0x2bc]
mov eax, dword [eax]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret