Function at 0x10033b24
Capabilities:
Encrypt data using speck

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100602f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xaa8
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x30]
test eax, eax
je 0x10038868
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x5dc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x67c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x784], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x788], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x5e8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x74c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x674], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x684], eax
mov eax, dword [ebp - 0x784]
movzx eax, byte [eax]
test eax, eax
je 0x10033c12
mov eax, dword [ebp - 0x67c]
mov dword [ebp - 0x754], eax
mov eax, dword [ebp - 0x684]
mov dword [ebp - 0x75c], eax
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0x764], eax
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0x77c], eax
mov eax, dword [ebp - 0x75c]
mov dword [ebp - 0x774], eax
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0x76c], eax
mov eax, dword [ebp - 0x76c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x774]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x77c]
mov dword [eax], ecx
jmp 0x10038866
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0x6b8], eax
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0x73c], eax
mov eax, dword [ebp - 0x674]
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x240], eax
push 1
lea ecx, [ebp - 0x278]
call fcn.1000f8c8
and dword [ebp - 4], 0
mov dword [ebp - 0x568], 0
mov dword [ebp - 0x580], 0xffffffff
mov dword [ebp - 0x7fc], 0x1920b245
mov dword [ebp - 0x7f8], 0x1920b245
mov dword [ebp - 0x7f4], 0x1920b245
mov dword [ebp - 0x7f0], 0x1920b245
lea ecx, [ebp - 0x209]
call fcn.1000f975
push eax
lea eax, [ebp - 0x7ec]
push eax
lea eax, [ebp - 0x7fc]
push eax
lea ecx, [ebp - 0xa70]
call fcn.1000f978
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x864]
call fcn.1000f924
mov byte [ebp - 4], 1
push 2
lea ecx, [ebp - 0x888]
call fcn.1000f8c8
mov byte [ebp - 4], 2
mov dword [ebp - 0x20], 0
jmp 0x10033ce9
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x10033d05
push dword [ebp - 0x20]
lea ecx, [ebp - 0x278]
call fcn.1000f966
mov dword [eax], 0x53b26bdd
jmp 0x10033ce2
mov dword [ebp - 0x20], 0
jmp 0x10033d15
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x10033d2b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x5f0], 4
jmp 0x10033d0e
mov dword [ebp - 0x20], 0
jmp 0x10033d3b
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10033d57
push dword [ebp - 0x20]
lea ecx, [ebp - 0x888]
call fcn.1000f966
mov dword [eax], 0xf944dcd6
jmp 0x10033d34
push 0
lea ecx, [ebp - 0x278]
call fcn.1000f966
and dword [eax], 0
jmp 0x10033d8d
push 0
lea ecx, [ebp - 0x278]
call fcn.1000f966
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0x324]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x324]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x278]
call fcn.1000f966
cmp dword [eax], 0xffffffee
jge 0x10033f75
mov dword [ebp - 0x214], 0xfffffffb
mov dword [ebp - 0x578], 0x88e1
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x994], eax
push 0
lea ecx, [ebp - 0x278]
call fcn.1000f966
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x91c], eax
mov esi, dword [ebp - 0x578]
push 0
lea ecx, [ebp - 0x278]
call fcn.1000f966
cmp esi, dword [eax]
je 0x10033dff
mov dword [ebp - 0x758], 1
jmp 0x10033e06
and dword [ebp - 0x758], 0
push 0
lea ecx, [ebp - 0x278]
call fcn.1000f966
cmp dword [eax], 0x60389a9b
jle 0x10033e27
mov dword [ebp - 0x234], 1
jmp 0x10033e2e
and dword [ebp - 0x234], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x234]
mov dword [ebp + eax - 0x5f0], ecx
mov eax, dword [ebp - 0x234]
add eax, 0x62a49ee1
mov dword [ebp - 0x568], eax
cmp dword [ebp - 0x568], 1
je 0x10033e67
mov dword [ebp - 0x570], 1
jmp 0x10033e6e
and dword [ebp - 0x570], 0
cmp dword [ebp - 0x570], 1
jg 0x10033e83
mov dword [ebp - 0x708], 1
jmp 0x10033e8a
and dword [ebp - 0x708], 0
mov esi, dword [ebp - 0x578]
push 0
lea ecx, [ebp - 0x278]
call fcn.1000f966
mov eax, dword [eax]
neg eax
sub eax, esi
mov dword [ebp - 0x580], eax
mov esi, dword [ebp - 0x580]
push 3
lea ecx, [ebp - 0x864]
call fcn.1000f966
cmp esi, dword [eax]
jge 0x10033ecc
mov dword [ebp - 0x588], 1
jmp 0x10033ed3
and dword [ebp - 0x588], 0
cmp dword [ebp - 0x588], 0x65816309
jge 0x10033eeb
mov dword [ebp - 0x560], 1
jmp 0x10033ef2
and dword [ebp - 0x560], 0
push 3
lea ecx, [ebp - 0x864]
call fcn.1000f966
mov ecx, dword [ebp - 0x560]
cmp ecx, dword [eax]
je 0x10033f15
mov dword [ebp - 0x288], 1
jmp 0x10033f1c
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x214]
add eax, dword [ebp - 0x288]
cmp eax, 0xfe4d
jne 0x10033f3b
mov dword [ebp - 0x418], 1
jmp 0x10033f42
and dword [ebp - 0x418], 0
push 1
lea ecx, [ebp - 0x888]
call fcn.1000f966
mov ecx, dword [ebp - 0x418]
mov dword [eax], ecx
mov byte [ebp - 0x72], 0
movzx eax, byte [ebp - 0x72]
test eax, eax
je 0x10033f70
push 0
push 0xce7
call dword [sym.imp.GDI32.dll_RectVisible]
jmp 0x10033d69
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x888]
call fcn.1000f94a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x864]
call fcn.1000f94a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x278]
call fcn.1000f94a
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x138], 0x8efa
mov dword [ebp - 0x18], 0
jmp 0x10033fc3
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffe9
jg 0x10034142
mov dword [ebp - 0x98], 4
mov dword [ebp - 0x174], 0
jmp 0x10033ff0
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 2
jge 0x1003400c
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x7e0], 0x124f84b8
jmp 0x10033fe3
mov dword [ebp - 0x98], 0
jmp 0x10034025
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jg 0x1003413d
mov dword [ebp - 0x290], 0x79ab
mov dword [ebp - 0x5f8], 0x1000a538
cmp dword [ebp - 0x290], 0x7ce3
jle 0x100340c9
and dword [ebp - 0x130], 0
jmp 0x10034068
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0x1184
jge 0x100340c9
and dword [ebp - 0x198], 0
jmp 0x1003408a
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0x2755
jge 0x100340c7
mov eax, dword [ebp - 0x130]
add eax, dword [ebp - 0x198]
cdq
mov dword [ebp - 0x690], eax
mov dword [ebp - 0x68c], edx
push dword [ebp - 0x68c]
push dword [ebp - 0x690]
mov ecx, 0x106081f8
call fcn.1000f7b3
jmp 0x1003407d
jmp 0x1003405b
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x7e0], 2
mov dword [ebp - 4], 3
cmp dword [ebp - 0x290], 0x789c
jge 0x100340fd
mov edx, dword [ebp - 0x5f8]
mov ecx, 0x106081f8
call fcn.1001125d
jmp 0x10034119
or dword [ebp - 4], 0xffffffff
jmp 0x10034123
mov eax, dword [ebp - 0x98]
cmp dword [ebp + eax*4 - 0x7e0], 0
je 0x10034138
jmp 0x10034018
jmp 0x10034018
jmp 0x10033fbc
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jge 0x10034156
mov dword [ebp - 0x298], 1
jmp 0x1003415d
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x18]
sub eax, 0x50d8af87
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jg 0x10034179
mov dword [ebp - 0x4e0], 1
jmp 0x10034180
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x4e0], eax
jle 0x100341a0
cmp dword [ebp - 0x138], 0
je 0x100341a0
mov dword [ebp - 0x780], 1
jmp 0x100341a7
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x18]
jl 0x100341cb
cmp dword [ebp - 0x138], 0
je 0x100341cb
mov dword [ebp - 0x420], 1
jmp 0x100341d2
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x298]
sub eax, dword [ebp - 0x420]
cmp eax, dword [ebp - 0x138]
jg 0x100341f2
mov dword [ebp - 0x2a0], 1
jmp 0x100341f9
and dword [ebp - 0x2a0], 0
cmp dword [ebp - 0x2a0], 0x37f4
jle 0x10034211
mov dword [ebp - 0x540], 1
jmp 0x10034218
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x540]
jge 0x1003422f
mov dword [ebp - 0x600], 1
jmp 0x10034236
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
push 1
lea ecx, [ebp - 0x26c]
call fcn.1000f8c8
mov dword [ebp - 4], 5
mov dword [ebp - 0x50], 0xca4f833f
mov dword [ebp - 0x4e8], 0x556123d4
mov dword [ebp - 0x7d8], 1
mov dword [ebp - 0x7d4], 1
mov dword [ebp - 0x7d0], 1
mov dword [ebp - 0x7cc], 1
mov dword [ebp - 0x710], 0
mov dword [ebp - 0x2e8], 5
mov dword [ebp - 0x1f0], 0
jmp 0x100342bf
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 3
jge 0x100342db
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0x798], 0
jmp 0x100342b2
mov dword [ebp - 0x50], 2
jmp 0x100342eb
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x100345d5
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x2d0], 1
mov dword [ebp - 0x34], 2
jmp 0x10034316
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x100345d0
mov dword [ebp - 0x2c0], 0x31aa08e
mov dword [ebp - 0x608], 0x82ec
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x798], 0
je 0x100345b5
mov dword [ebp - 0x428], 0xffffffff
mov dword [ebp - 0x760], 0xfffffffb
push 2
lea ecx, [ebp - 0x87c]
call fcn.1000f8c8
mov byte [ebp - 4], 6
mov dword [ebp - 0x440], 1
mov dword [ebp - 0x140], 0
jmp 0x1003438d
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 2
jge 0x100343af
push dword [ebp - 0x140]
lea ecx, [ebp - 0x87c]
call fcn.1000f966
mov dword [eax], 5
jmp 0x10034380
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7d8]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x7d8]
dec ecx
push 4
pop edx
shl edx, 0
mov dword [ebp + edx - 0x7d8], ecx
test eax, eax
je 0x10034418
cmp dword [ebp - 0x710], 0
jne 0x100343f0
mov dword [ebp - 0x2a8], 1
jmp 0x100343f7
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
je 0x10034418
mov dword [ebp - 0x548], 1
jmp 0x1003441f
and dword [ebp - 0x548], 0
cmp dword [ebp - 0x608], 1
jg 0x10034434
mov dword [ebp - 0x2b0], 1
jmp 0x1003443b
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x4e8], eax
cmp dword [ebp - 0x4e8], 0xfffffffc
jg 0x1003445c
mov dword [ebp - 0x2b8], 1
jmp 0x10034463
and dword [ebp - 0x2b8], 0
cmp dword [ebp - 0x2b8], 4
jl 0x10034478
mov dword [ebp - 0x430], 1
jmp 0x1003447f
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x2c0]
cmp eax, dword [ebp - 0x50]
jl 0x100344a2
mov dword [ebp - 0x2c8], 1
jmp 0x100344a9
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x548]
cmp eax, dword [ebp - 0x2c8]
je 0x100344c3
mov dword [ebp - 0x438], 1
jmp 0x100344ca
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x2d0]
add ecx, dword [ebp - 0x438]
cmp ecx, dword [ebp + eax*4 - 0x798]
jge 0x100344f4
cmp dword [ebp - 0x2d0], 0
jne 0x100344f4
and dword [ebp - 0x4f0], 0
jmp 0x100344fe
mov dword [ebp - 0x4f0], 1
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x798]
cmp eax, dword [ebp - 0x4f0]
jl 0x10034526
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x798], 0
jne 0x10034526
and dword [ebp - 0x2d8], 0
jmp 0x10034530
mov dword [ebp - 0x2d8], 1
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x440]
cmp eax, dword [ebp - 0x760]
jl 0x10034556
mov dword [ebp - 0x2e0], 1
jmp 0x1003455d
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x798]
cmp eax, dword [ebp - 0x2e0]
jne 0x10034581
mov eax, 0xe1f2
test eax, eax
jne 0x10034581
and dword [ebp - 0x54c], 0
jmp 0x1003458b
mov dword [ebp - 0x54c], 1
mov esi, dword [ebp - 0x34]
imul esi, dword [ebp - 0x54c]
push 0
lea ecx, [ebp - 0x87c]
call fcn.1000f966
mov dword [eax], esi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x87c]
call fcn.1000f94a
jmp 0x100345cb
push 1
push 0
push 0x5480
push 0x4996
call fcn.1002a7eb
add esp, 0x10
jmp 0x1003430f
jmp 0x100342e4
mov dword [ebp - 0x50], 3
jmp 0x100345e5
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x100345fa
mov eax, dword [ebp - 0x2e8]
inc eax
mov dword [ebp - 0x2e8], eax
jmp 0x100345de
mov dword [ebp - 0x620], 0xfffffffc
mov dword [ebp - 0x718], 0xa88e00f6
mov dword [ebp - 0x448], 0x3db6
mov dword [ebp - 0x610], 0x1000a57c
cmp dword [ebp - 0x448], 0x3ee0
jle 0x100346b3
and dword [ebp - 0x1a0], 0
jmp 0x10034648
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0x969
jge 0x100346ab
and dword [ebp - 0x148], 0
jmp 0x1003466a
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0x4919
jge 0x100346a9
mov eax, dword [ebp - 0x1a0]
mov ecx, dword [ebp - 0x148]
shl eax, cl
cdq
mov dword [ebp - 0x69c], eax
mov dword [ebp - 0x698], edx
push dword [ebp - 0x698]
push dword [ebp - 0x69c]
mov ecx, 0x106081f8
call fcn.1000f7b3
jmp 0x1003465d
jmp 0x1003463b
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov dword [ebp - 0x618], 3
mov byte [ebp - 4], 7
cmp dword [ebp - 0x448], 0x3bfe
jge 0x100346dd
mov edx, dword [ebp - 0x610]
mov ecx, 0x106081f8
call fcn.1001125d
jmp 0x100346f9
mov dword [ebp - 4], 5
jmp 0x10034709
push 1
lea ecx, [ebp - 0x8b8]
call fcn.1000f8c8
mov byte [ebp - 4], 9
mov dword [ebp - 0x7bc], 0xfff6
mov dword [ebp - 0x720], 5
push 0
push 0x2b56
lea eax, [ebp - 0x8b8]
push eax
lea eax, [ebp - 0x924]
push eax
push 0x398d
push 0
push 0x6820
call fcn.100388a1
add esp, 0x1c
lea eax, [ebp - 0x718]
push eax
push 0xbb9
lea eax, [ebp - 0x8b8]
push eax
push 0x1657
lea eax, [ebp - 0x618]
push eax
push 0
lea eax, [ebp - 0x7bc]
push eax
push 1
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x720]
push eax
call fcn.10029e1e
add esp, 0x28
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x8b8]
call fcn.1000f94a
mov dword [ebp - 0x3b8], 0
mov dword [ebp - 0x7c], 0xcea5d6c0
mov dword [ebp - 0x4f8], 0xffffffff
mov dword [ebp - 0x2f8], 0xbefa1e1c
mov dword [ebp - 0x308], 0x93fe6966
mov dword [ebp - 0x9f0], 5
mov dword [ebp - 0x92c], 0xffffffff
mov dword [ebp - 0x9ac], 3
mov dword [ebp - 0x934], 2
mov dword [ebp - 0xa10], 0xffffffff
mov dword [ebp - 0x93c], 8
mov dword [ebp - 0x9bc], 0xffffffff
mov dword [ebp - 0x768], 0x123020f6
mov dword [ebp - 0x7c], 0x1d
jmp 0x10034835
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0x18
je 0x10034a35
push 2
lea ecx, [ebp - 0x7b8]
call fcn.1000f8c8
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x8f8], 0
mov dword [ebp - 0x8f4], 0
mov dword [ebp - 0x8f0], 0
mov dword [ebp - 0x8ec], 0
mov dword [ebp - 0xc4], 0
jmp 0x10034891
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jge 0x100348ad
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x7a8], 0xfffffffe
jmp 0x10034884
lea eax, [ebp - 0xc4]
push eax
push 0x7816
push 0
lea eax, [ebp - 0x7b8]
push eax
push 0
call fcn.1002b21d
add esp, 0x14
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x944], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7a8]
cmp eax, dword [ebp - 0x7c]
jl 0x100348f2
mov dword [ebp - 0x2f0], 1
jmp 0x100348f9
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x4f8], eax
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0
jbe 0x1003493f
mov eax, 0xf4039ee4
test eax, eax
je 0x1003493f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x7a8], 0
je 0x1003493f
mov dword [ebp - 0x450], 1
jmp 0x10034946
and dword [ebp - 0x450], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7a8]
cmp dword [ebp - 0x450], eax
je 0x10034967
mov dword [ebp - 0x300], 1
jmp 0x1003496e
and dword [ebp - 0x300], 0
cmp dword [ebp - 0x300], 0xab653b1d
jb 0x10034986
mov dword [ebp - 0x574], 1
jmp 0x1003498d
and dword [ebp - 0x574], 0
mov eax, 0xaaed6b65
sub eax, dword [ebp - 0x574]
cmp eax, 0xffffffff
je 0x100349a9
mov dword [ebp - 0x628], 1
jmp 0x100349b0
and dword [ebp - 0x628], 0
push 0
lea ecx, [ebp - 0x7b8]
call fcn.1000f966
push 0
lea ecx, [ebp - 0x7b8]
call fcn.1000f966
mov eax, dword [eax]
mov dword [ebp - 0x308], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7a8]
mov dword [ebp - 0x9d4], eax
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x94c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x984], eax
push 4
pop eax
shl eax, 1
mov esi, dword [ebp + eax - 0x7a8]
push 0
lea ecx, [ebp - 0x7b8]
call fcn.1000f966
imul esi, dword [eax]
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x8f8], esi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x7b8]
call fcn.1000f94a
jmp 0x1003482e
push 0x542d
push 0x17b1
lea eax, [ebp - 0x768]
push eax
push 0
push 0
call fcn.1002b049
add esp, 0x14
mov dword [ebp - 0x584], 0xffffffff
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x58], 0xab72b21a
mov dword [ebp - 0x3c], 0x2ca12535
mov dword [ebp - 0x1d0], 0
jmp 0x10034a91
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 3
jge 0x10034aad
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0x24c], 6
jmp 0x10034a84
mov dword [ebp - 0x30], 2
jmp 0x10034abd
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x10034af7
push 0
push 0xd7b
push 0x63bd
push 0x680c
push 0
push 1
push 0x49
push 0x1d2c
push 0x2379
lea eax, [ebp - 0x28]
push eax
push 0x870
call fcn.10031c17
add esp, 0x2c
jmp 0x10034ab6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24c]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x10034bdb
cmp dword [ebp - 0x28], 0
jne 0x10034b20
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x9e0], eax
mov eax, 0xf908
test eax, eax
jne 0x10034b38
cmp dword [ebp - 0x30], 0
jne 0x10034b38
and dword [ebp - 0x458], 0
jmp 0x10034b42
mov dword [ebp - 0x458], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x458]
sub ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp + eax - 0x24c]
jl 0x10034b66
mov dword [ebp - 0x310], 1
jmp 0x10034b6d
and dword [ebp - 0x310], 0
cmp dword [ebp - 0x310], 0xe155
jg 0x10034b85
mov dword [ebp - 0x500], 1
jmp 0x10034b8c
and dword [ebp - 0x500], 0
cmp dword [ebp - 0x500], 1
jge 0x10034ba1
mov dword [ebp - 0x318], 1
jmp 0x10034ba8
and dword [ebp - 0x318], 0
cmp dword [ebp - 0x318], 0xfc7127b1
je 0x10034bc0
mov dword [ebp - 0x460], 1
jmp 0x10034bc7
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x460]
jne 0x10034bdb
and dword [ebp - 0x320], 0
jmp 0x10034be5
mov dword [ebp - 0x320], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x320], eax
jge 0x10034bfc
mov dword [ebp - 0x554], 1
jmp 0x10034c03
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x554]
mov dword [ebp - 0x30], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp + eax - 0x24c]
jge 0x10034c2a
mov dword [ebp - 0x328], 1
jmp 0x10034c31
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x328], eax
jl 0x10034c4e
cmp dword [ebp - 0x30], 0
je 0x10034c4e
mov dword [ebp - 0x468], 1
jmp 0x10034c55
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x468], eax
jle 0x10034c6c
mov dword [ebp - 0x630], 1
jmp 0x10034c73
and dword [ebp - 0x630], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x24c]
mov dword [ebp - 0x98c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xa08], eax
cmp dword [ebp - 0x3c], 0xa83cd0cd
jb 0x10034ca7
cmp dword [ebp - 0x3c], 0
jne 0x10034ca7
and dword [ebp - 0x330], 0
jmp 0x10034cb1
mov dword [ebp - 0x330], 1
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x330], eax
je 0x10034cc8
mov dword [ebp - 0x728], 1
jmp 0x10034ccf
and dword [ebp - 0x728], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x24c]
mov dword [ebp - 0x8fc], eax
cmp dword [ebp - 0x30], 0
je 0x10034cfa
cmp dword [ebp - 0x28], 0
je 0x10034cfa
mov dword [ebp - 0x508], 1
jmp 0x10034d01
and dword [ebp - 0x508], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x24c]
imul ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp + eax - 0x24c]
jne 0x10034d2f
mov dword [ebp - 0x638], 1
jmp 0x10034d36
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x900], eax
xor eax, eax
inc eax
je 0x10034d56
cmp dword [ebp - 0x3c], 0
je 0x10034d56
mov dword [ebp - 0x338], 1
jmp 0x10034d5d
and dword [ebp - 0x338], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x338]
sub edx, dword [ebp + ecx - 0x24c]
cmp edx, dword [ebp + eax - 0x24c]
jne 0x10034d8b
mov dword [ebp - 0x470], 1
jmp 0x10034d92
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x470], eax
jg 0x10034da9
mov dword [ebp - 0x340], 1
jmp 0x10034db0
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0x340]
add eax, dword [ebp - 0x3c]
je 0x10034dd4
mov eax, 0x1817
test eax, eax
je 0x10034dd4
mov dword [ebp - 0x58c], 1
jmp 0x10034ddb
and dword [ebp - 0x58c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x58]
add ecx, dword [ebp - 0x58c]
cmp ecx, dword [ebp + eax - 0x24c]
jle 0x10035114
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x358], 1
mov dword [ebp - 0x480], 1
push 3
lea ecx, [ebp - 0x8e8]
call fcn.1000f8c8
mov byte [ebp - 4], 0xb
mov dword [ebp - 0xec], 0
jmp 0x10034e3c
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jge 0x10034e58
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x8d0], 0x315bb970
jmp 0x10034e2f
push 1
push 0x79a5
push 0x11c1
push 0
push 0x15e7
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0x8e8]
push eax
push 0x6c30
push 0xb6a
push 0x30cb
call fcn.10031dae
add esp, 0x28
mov byte [ebp - 0x75], 0
push 1
push 0
push 0x34f8
push 0
push 0x730d
push 0x4baf
lea eax, [ebp - 0x75]
push eax
push 0x6a92
call fcn.100318fc
add esp, 0x20
mov dword [ebp - 0x68], 0
cmp dword [ebp - 0x68], 0
je 0x10034fc6
cmp dword [ebp - 0x68], 1
je 0x10034edd
mov dword [ebp - 0x360], 1
jmp 0x10034ee4
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x908], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x910], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x24c]
cmp eax, dword [ebp - 0x68]
jg 0x10034f13
mov dword [ebp - 0x348], 1
jmp 0x10034f1a
and dword [ebp - 0x348], 0
cmp dword [ebp - 0x348], 9
jle 0x10034f2f
mov dword [ebp - 0x478], 1
jmp 0x10034f36
and dword [ebp - 0x478], 0
cmp dword [ebp - 0x478], 0x1663317a
jg 0x10034f4e
mov dword [ebp - 0x350], 1
jmp 0x10034f55
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x350]
cmp eax, dword [ebp - 0x58]
jle 0x10034f6f
mov dword [ebp - 0x510], 1
jmp 0x10034f76
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x480]
cmp eax, dword [ebp - 0x68]
jne 0x10034fa5
mov dword [ebp - 0x55c], 1
jmp 0x10034fac
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x360]
cmp eax, dword [ebp - 0x55c]
je 0x10034fc6
mov dword [ebp - 0x78c], 1
jmp 0x10034fcd
and dword [ebp - 0x78c], 0
cmp dword [ebp - 0x68], 0
jne 0x10034fe5
mov eax, 0xcff42703
test eax, eax
jne 0x10034fe5
and dword [ebp - 0x368], 0
jmp 0x10034fef
mov dword [ebp - 0x368], 1
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x368], eax
jg 0x10035006
mov dword [ebp - 0x488], 1
jmp 0x1003500d
and dword [ebp - 0x488], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8d0]
cmp dword [ebp - 0x488], eax
jg 0x1003502e
mov dword [ebp - 0x370], 1
jmp 0x10035035
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x370], eax
je 0x10035052
cmp dword [ebp - 0x68], 0
je 0x10035052
mov dword [ebp - 0x518], 1
jmp 0x10035059
and dword [ebp - 0x518], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8d0]
imul eax, dword [ebp - 0x518]
cmp eax, 0xfffffff7
jb 0x1003507e
mov dword [ebp - 0x378], 1
jmp 0x10035085
and dword [ebp - 0x378], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x378]
mov dword [ebp + eax - 0x8d0], ecx
cmp dword [ebp - 0x58], 1
jbe 0x100350aa
mov dword [ebp - 0x490], 1
jmp 0x100350b1
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x490], eax
jle 0x100350c8
mov dword [ebp - 0x380], 1
jmp 0x100350cf
and dword [ebp - 0x380], 0
cmp dword [ebp - 0x380], 0xfffc
jne 0x100350e7
mov dword [ebp - 0x640], 1
jmp 0x100350ee
and dword [ebp - 0x640], 0
mov esi, dword [ebp - 0x28]
push 2
lea ecx, [ebp - 0x8e8]
call fcn.1000f966
mov dword [eax], esi
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x8e8]
call fcn.1000f94a
jmp 0x10035264
mov dword [ebp - 0x150], 0
jmp 0x1003512d
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 1
jge 0x10035149
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x730], 0x925c1f9a
jmp 0x10035120
mov dword [ebp - 0x3c], 0xffffffe8
jmp 0x10035159
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x1c
jle 0x10035264
mov dword [ebp - 0x1a8], 0
mov dword [ebp - 0x388], 0xffffffff
mov dword [ebp - 0x4a0], 0x16c6279e
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x918], eax
mov eax, 0xc19e
sub eax, dword [ebp - 0x1a8]
sub eax, 0x31d611cf
jne 0x100351ab
mov dword [ebp - 0x57c], 1
jmp 0x100351b2
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffff9
jg 0x100351cd
mov dword [ebp - 0x498], 1
jmp 0x100351d4
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x388]
cmp dword [ebp - 0x498], eax
jg 0x100351ee
mov dword [ebp - 0x390], 1
jmp 0x100351f5
and dword [ebp - 0x390], 0
imul eax, dword [ebp - 0x390], 0xfffffff9
cmp eax, dword [ebp - 0x1a8]
jne 0x10035210
mov dword [ebp - 0x520], 1
jmp 0x10035217
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
inc eax
cmp dword [ebp - 0x1a8], eax
jl 0x10035232
mov dword [ebp - 0x398], 1
jmp 0x10035239
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x1a8]
imul eax, dword [ebp - 0x398]
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x4a0]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x730], eax
jmp 0x10035152
mov dword [ebp - 0x824], 0x1920b245
mov dword [ebp - 0x820], 0x1920b245
mov dword [ebp - 0x81c], 0x1920b245
mov dword [ebp - 0x818], 0x1920b245
lea ecx, [ebp - 0x25d]
call fcn.1000f975
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x824]
push eax
lea ecx, [ebp - 0xa40]
call fcn.1000f978
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x858]
call fcn.1000f924
mov byte [ebp - 4], 0xc
push 2
lea ecx, [ebp - 0x8dc]
call fcn.1000f8c8
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x920], 0x847d
mov byte [ebp - 0x77], 0
movzx eax, byte [ebp - 0x77]
test eax, eax
je 0x10035307
push 0
push 0x5c3f
push 0x547c
push 0x112a
push 0
call fcn.1003964e
add esp, 0x14
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x10035324
push 0
push 1
call fcn.1002d1fe
pop ecx
pop ecx
mov dword [ebp - 0x38], 0
jmp 0x10035334
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x10035350
push dword [ebp - 0x38]
lea ecx, [ebp - 0x26c]
call fcn.1000f966
mov dword [eax], 0x53b26bdd
jmp 0x1003532d
mov dword [ebp - 0xcc], 0xfffffffa
mov dword [ebp - 0x3a8], 5
mov dword [ebp - 0xa0], 0x658d83f7
mov dword [ebp - 0x3a0], 0x1f7d
mov dword [ebp - 0x648], 0x1000a5b8
cmp dword [ebp - 0x3a0], 0x20ec
jle 0x1003546d
and dword [ebp - 0x1b0], 0
jmp 0x100353a8
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0x1260
jge 0x1003546d
and dword [ebp - 0x158], 0
jmp 0x100353ce
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0x5af
jge 0x10035468
and dword [ebp - 0x1e8], 0
jmp 0x100353f4
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0x23c3
jge 0x10035463
and dword [ebp - 0x160], 0
jmp 0x10035416
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0x73ef
jge 0x10035461
mov eax, dword [ebp - 0x158]
add eax, dword [ebp - 0x1e8]
mov ecx, dword [ebp - 0x160]
sar eax, cl
or eax, dword [ebp - 0x1b0]
cdq
mov dword [ebp - 0x6a8], eax
mov dword [ebp - 0x6a4], edx
push dword [ebp - 0x6a4]
push dword [ebp - 0x6a8]
mov ecx, 0x106081f8
call fcn.1000f7b3
jmp 0x10035409
jmp 0x100353e7
jmp 0x100353c1
jmp 0x1003539b
mov dword [ebp - 0x168], 0
jmp 0x10035486
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 2
jge 0x100354a2
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0x9d0], 7
jmp 0x10035479
mov byte [ebp - 4], 0xe
cmp dword [ebp - 0x3a0], 0x1e9b
jge 0x100354c2
mov edx, dword [ebp - 0x648]
mov ecx, 0x106081f8
call fcn.1001125d
jmp 0x100354de
mov dword [ebp - 4], 0xd
jmp 0x100354ee
mov dword [ebp - 0xcc], 0
jmp 0x10035507
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x1a
jne 0x10035606
mov dword [ebp - 0x770], 0x5b7d
mov dword [ebp - 0x658], 0x59cdc345
mov dword [ebp - 0x738], 0
mov dword [ebp - 0x650], 0x3acb6d6
mov dword [ebp - 0x564], 0x6a0122d8
push 0
lea eax, [ebp - 0x564]
push eax
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x770]
push eax
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 0x738]
push eax
lea eax, [ebp - 0x3a8]
push eax
push 0x5eb5
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x658]
push eax
call fcn.1003895f
add esp, 0x28
mov dword [ebp - 0xa0], 0
jmp 0x100355a6
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jg 0x10035601
mov dword [ebp - 0x7ac], 0xfffffffd
mov eax, dword [ebp - 0xa0]
cmp dword [ebp + eax*4 - 0x9d0], 0
je 0x100355cb
jmp 0x10035601
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x928], eax
cmp dword [ebp - 0x3a8], 0xfffffff6
je 0x100355ec
mov dword [ebp - 0x4a8], 1
jmp 0x100355f3
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x7ac], eax
jmp 0x10035599
jmp 0x100354fa
mov byte [ebp - 0x70], 0
movzx eax, byte [ebp - 0x70]
test eax, eax
je 0x1003562a
push 0
push 0x6344
push 1
push 0x3ea8
push 0
call fcn.1002c16d
add esp, 0x14
mov dword [ebp - 0x38], 0
jmp 0x1003563a
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x10035650
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x678], 4
jmp 0x10035633
mov dword [ebp - 0x1d8], 0xfffffffb
mov dword [ebp - 0x1d8], 0xfffffff6
jmp 0x10035673
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0xe
je 0x100356da
mov byte [ebp - 0x94], 0
movzx eax, byte [ebp - 0x94]
test eax, eax
je 0x100356b0
push 0x5d67
push 0x35e8
push 0
push 0x3e6
push 0
push 1
push 0xffb
call fcn.1004264e
add esp, 0x1c
mov byte [ebp - 0x93], 0
movzx eax, byte [ebp - 0x93]
test eax, eax
je 0x100356d8
push 0
push 0x6a28
push 0
push 0x6595
call fcn.1002d7fd
add esp, 0x10
jmp 0x10035666
push 0x24c9
push 0x75ca
lea eax, [ebp - 0x38]
push eax
push 0x781a
push 0x7c85
lea eax, [ebp - 0x8dc]
push eax
push 0
push 0x2a2e
call fcn.1004149f
add esp, 0x20
mov dword [ebp - 0x100], 0xfffffff9
mov dword [ebp - 0x2c], 1
push 1
lea ecx, [ebp - 0x8c4]
call fcn.1000f8c8
mov byte [ebp - 4], 0x10
push 0
push 0x71c3
lea eax, [ebp - 0x930]
push eax
lea eax, [ebp - 0x8c4]
push eax
push 0x76e5
push 1
push 1
call fcn.1002d121
add esp, 0x1c
mov dword [ebp - 0x100], 0
jmp 0x10035769
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0x1c
jl 0x10035829
mov dword [ebp - 0x660], 0x6874be76
mov dword [ebp - 0x2c], 5
cmp dword [ebp - 0x2c], 0
je 0x100357d9
lea eax, [ebp - 0x100]
push eax
push 0
push 1
lea eax, [ebp - 0x660]
push eax
lea eax, [ebp - 0x2c]
push eax
push 1
call fcn.100322c7
add esp, 0x18
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x100357d7
push 0
push 0xb3e
push 0
push 1
push 0x2755
call fcn.1002d412
add esp, 0x14
jmp 0x10035824
mov dword [ebp - 0x2c], 0
jmp 0x100357e9
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x10035824
push 0x4697
push 0x35c5
push 0x8a3
lea eax, [ebp - 0x2c]
push eax
push 0x6887
push 0x3e3c
push 0
lea eax, [ebp - 0x8c4]
push eax
push 0x4031
call fcn.1004225c
add esp, 0x24
jmp 0x100357e2
jmp 0x1003575c
mov dword [ebp - 0x2c], 0
jmp 0x10035839
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x10035890
mov dword [ebp - 0x740], 0xfffffff8
mov byte [ebp - 0x74], 0
push 0xc41
push 0
push 0x6f3b
push 0x1a2b
push 0
lea eax, [ebp - 0x74]
push eax
push 0x7232
call fcn.1002a173
add esp, 0x1c
push 0x897
lea eax, [ebp - 0x740]
push eax
push 0
push 0x7621
push 1
call fcn.1002b21d
add esp, 0x14
jmp 0x10035832
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x8c4]
call fcn.1000f94a
push 0
lea ecx, [ebp - 0x26c]
call fcn.1000f966
and dword [eax], 0
jmp 0x100358d5
push 0
lea ecx, [ebp - 0x26c]
call fcn.1000f966
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x3b0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x3b0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x26c]
call fcn.1000f966
cmp dword [eax], 0xffffffee
jge 0x1003652f
mov dword [ebp - 0x21c], 0xfffffffb
mov dword [ebp - 0xd4], 0xfffffff9
mov dword [ebp - 0x24], 1
push 1
lea ecx, [ebp - 0x870]
call fcn.1000f8c8
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x870]
push eax
lea eax, [ebp - 0x938]
push eax
push 1
push 0x3835
push 0
push 1
push 0x3cf4
call fcn.1004264e
add esp, 0x1c
mov dword [ebp - 0xd4], 0
jmp 0x10035956
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x1c
jl 0x10035a49
mov dword [ebp - 0x778], 0x6874be76
mov dword [ebp - 0x24], 5
cmp dword [ebp - 0x24], 0
je 0x10035a10
cmp dword [ebp - 0x24], 0
je 0x100359a5
mov eax, dword [ebp - 0x24]
add eax, 0x3773672
cmp eax, 0x8cafa32f
ja 0x10035999
cmp dword [ebp - 0x24], 0
je 0x100359a5
mov dword [ebp - 0x528], 1
jmp 0x100359ac
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x528]
neg eax
mov ecx, dword [ebp - 0xd4]
add ecx, 0x12e
sub ecx, eax
cmp ecx, 0xa41449c9
jae 0x100359d6
mov dword [ebp - 0x668], 1
jmp 0x100359dd
and dword [ebp - 0x668], 0
mov dword [ebp - 0x778], 0xffffffff
mov byte [ebp - 0x6d], 0
movzx eax, byte [ebp - 0x6d]
test eax, eax
je 0x10035a0e
push 0x5530
push 1
push 0x4d25
push 0
push 0x8f
call fcn.1003075f
add esp, 0x14
jmp 0x10035a44
mov dword [ebp - 0x24], 0
jmp 0x10035a20
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x10035a44
push 0
lea eax, [ebp - 0x870]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x1e51
push 1
call fcn.1003964e
add esp, 0x14
jmp 0x10035a19
jmp 0x10035949
mov dword [ebp - 0x24], 0
jmp 0x10035a59
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x10035aaa
mov dword [ebp - 0x670], 0xfffffff8
push 0x505d
push 1
push 0x2359
push 0x4b12
push 0
push 0x6478
push 1
call fcn.1002c87f
add esp, 0x1c
push 0
push 1
push 0x690d
lea eax, [ebp - 0x670]
push eax
push 0x62d6
call fcn.1002c3e2
add esp, 0x14
jmp 0x10035a52
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x870]
call fcn.1000f94a
mov dword [ebp - 0x3c0], 0x88e1
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x940], eax
push 0
lea ecx, [ebp - 0x26c]
call fcn.1000f966
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x948], eax
mov esi, dword [ebp - 0x3c0]
push 0
lea ecx, [ebp - 0x26c]
call fcn.1000f966
cmp esi, dword [eax]
je 0x10035b0b
mov dword [ebp - 0x748], 1
jmp 0x10035b12
and dword [ebp - 0x748], 0
push 0
lea ecx, [ebp - 0x26c]
call fcn.1000f966
cmp dword [eax], 0x60389a9b
jle 0x10035b33
mov dword [ebp - 0x25c], 1
jmp 0x10035b3a
and dword [ebp - 0x25c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x25c]
mov dword [ebp + eax - 0x678], ecx
mov eax, dword [ebp - 0x25c]
add eax, 0x62a49ee1
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 1
je 0x10035b73
mov dword [ebp - 0x4b0], 1
jmp 0x10035b7a
and dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x4b0], 1
jg 0x10035b8f
mov dword [ebp - 0x79c], 1
jmp 0x10035b96
and dword [ebp - 0x79c], 0
mov esi, dword [ebp - 0x3c0]
push 0
lea ecx, [ebp - 0x26c]
call fcn.1000f966
mov eax, dword [eax]
neg eax
sub eax, esi
mov dword [ebp - 0x584], eax
mov esi, dword [ebp - 0x584]
push 3
lea ecx, [ebp - 0x858]
call fcn.1000f966
cmp esi, dword [eax]
jge 0x10035bd8
mov dword [ebp - 0x3c8], 1
jmp 0x10035bdf
and dword [ebp - 0x3c8], 0
cmp dword [ebp - 0x3c8], 0x65816309
jge 0x10035bf7
mov dword [ebp - 0x4b8], 1
jmp 0x10035bfe
and dword [ebp - 0x4b8], 0
push 3
lea ecx, [ebp - 0x858]
call fcn.1000f966
mov ecx, dword [ebp - 0x4b8]
cmp ecx, dword [eax]
je 0x10035c21
mov dword [ebp - 0x3d0], 1
jmp 0x10035c28
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x21c]
add eax, dword [ebp - 0x3d0]
cmp eax, 0xfe4d
jne 0x10035c47
mov dword [ebp - 0x530], 1
jmp 0x10035c4e
and dword [ebp - 0x530], 0
push 1
lea ecx, [ebp - 0x8dc]
call fcn.1000f966
mov ecx, dword [ebp - 0x530]
mov dword [eax], ecx
mov dword [ebp - 0x3d8], 0x137
mov dword [ebp - 0x750], 0x1000a658
cmp dword [ebp - 0x3d8], 0x4a0
jle 0x10035d61
and dword [ebp - 0x170], 0
jmp 0x10035c9d
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0x6972
jge 0x10035d61
and dword [ebp - 0x1b8], 0
jmp 0x10035cc3
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0x2a73
jge 0x10035d5c
and dword [ebp - 0x178], 0
jmp 0x10035ce9
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x6100
jge 0x10035d57
mov eax, dword [ebp - 0x170]
cdq
idiv dword [ebp - 0x1b8]
mov ecx, dword [ebp - 0x178]
shl edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x6b4], eax
mov dword [ebp - 0x6b0], edx
push dword [ebp - 0x6b0]
push dword [ebp - 0x6b4]
lea ecx, [ebp - 0xaa8]
call fcn.1000cfb0
pop ecx
pop ecx
mov dword [ebp - 0x680], eax
mov ecx, dword [ebp - 0x680]
call fcn.1000f793
push eax
call fcn.1004a046
pop ecx
lea ecx, [ebp - 0xaa8]
call fcn.1000f789
jmp 0x10035cdc
jmp 0x10035cb6
jmp 0x10035c90
mov byte [ebp - 4], 0x12
cmp dword [ebp - 0x3d8], 0xfffffe96
jge 0x10035d7d
push dword [ebp - 0x750]
call fcn.1004a046
pop ecx
jmp 0x10035d99
mov dword [ebp - 4], 0xd
jmp 0x10035da9
mov dword [ebp - 0x23c], 0xfffffff6
mov dword [ebp - 0x180], 2
mov dword [ebp - 0x224], 0xd59ff446
mov dword [ebp - 0x400], 7
mov dword [ebp - 0x6f8], 0xf0bd907c
mov dword [ebp - 0x1f8], 0
jmp 0x10035df4
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 3
jge 0x10035e10
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0x5c8], 0xffffffff
jmp 0x10035de7
cmp dword [ebp - 0x23c], 0x5a83d87e
jne 0x10035e28
mov dword [ebp - 0x4c0], 1
jmp 0x10035e2f
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x4c0], eax
jl 0x10035e49
mov dword [ebp - 0x3e0], 1
jmp 0x10035e50
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x224]
cmp dword [ebp - 0x3e0], eax
je 0x10035e6a
mov dword [ebp - 0x56c], 1
jmp 0x10035e71
and dword [ebp - 0x56c], 0
cmp dword [ebp - 0x56c], 0
jbe 0x10035e86
mov dword [ebp - 0x3e8], 1
jmp 0x10035e8d
and dword [ebp - 0x3e8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5c8]
cmp dword [ebp - 0x3e8], eax
jge 0x10035eae
mov dword [ebp - 0x4c8], 1
jmp 0x10035eb5
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x224]
imul eax, dword [ebp - 0x4c8]
cmp eax, 0x451d77f1
jg 0x10035ede
cmp dword [ebp - 0x23c], 0
je 0x10035ede
mov dword [ebp - 0x3f0], 1
jmp 0x10035ee5
and dword [ebp - 0x3f0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5c8]
imul eax, dword [ebp - 0x3f0]
test eax, eax
jne 0x10035f0e
cmp dword [ebp - 0x180], 0
jne 0x10035f0e
and dword [ebp - 0x538], 0
jmp 0x10035f18
mov dword [ebp - 0x538], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5c8]
cmp dword [ebp - 0x538], eax
jle 0x10035f39
mov dword [ebp - 0x3f8], 1
jmp 0x10035f40
and dword [ebp - 0x3f8], 0
cmp dword [ebp - 0x3f8], 0x2835
jl 0x10035f58
mov dword [ebp - 0x4d0], 1
jmp 0x10035f5f
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 0xfffffffd
jle 0x10035f80
mov dword [ebp - 0x688], 1
jmp 0x10035f87
and dword [ebp - 0x688], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5c8]
mov dword [ebp - 0x950], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x95c], eax
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x968], eax
mov eax, dword [ebp - 0x6f8]
mov dword [ebp - 0x974], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x5c8], 0x7ccc
jne 0x10035fdc
mov dword [ebp - 0x544], 1
jmp 0x10035fe3
and dword [ebp - 0x544], 0
cmp dword [ebp - 0x544], 0x97a8
jg 0x10035ffb
mov dword [ebp - 0x408], 1
jmp 0x10036002
and dword [ebp - 0x408], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5c8]
cmp dword [ebp - 0x408], eax
je 0x10036023
mov dword [ebp - 0x694], 1
jmp 0x1003602a
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x180], eax
mov byte [ebp - 0x91], 0
mov dword [ebp - 0x6c], 0x9d29
push 3
lea ecx, [ebp - 0x5a4]
call fcn.1000f8c8
mov byte [ebp - 4], 0x14
mov dword [ebp - 0xb0], 9
push 3
lea ecx, [ebp - 0x5bc]
call fcn.1000f8c8
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x1c0], 0x8307b364
mov dword [ebp - 0x704], 0xfffffffb
mov dword [ebp - 0x2ac], 1
mov dword [ebp - 0x6ac], 0xffffffff
mov dword [ebp - 0x70c], 0xfffffff8
mov dword [ebp - 0x84c], 0x5916
mov dword [ebp - 0x848], 0x5916
mov dword [ebp - 0x844], 0x5916
mov dword [ebp - 0x840], 0x5916
lea ecx, [ebp - 0x1fd]
call fcn.1000f975
push eax
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x84c]
push eax
lea ecx, [ebp - 0xa68]
call fcn.1000f978
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9b8]
call fcn.1000f924
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x1c], 0
jmp 0x10036113
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1003612f
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x5a4]
call fcn.1000f966
mov dword [eax], 0xfffffffa
jmp 0x1003610c
mov dword [ebp - 0x1c], 0
jmp 0x1003613f
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x1003615b
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x5bc]
call fcn.1000f966
mov dword [eax], 0x69b41dbc
jmp 0x10036138
mov dword [ebp - 0x1c], 0
jmp 0x1003616b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10036181
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x958], 0
jmp 0x10036164
cmp dword [ebp - 0x6c], 0
jne 0x100361fa
imul eax, dword [ebp - 0x6c], 0
mov ecx, dword [ebp - 0xb0]
imul ecx, eax
mov dword [ebp - 0x6fc], ecx
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x6a0], eax
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x6fc]
cmp eax, dword [ebp - 0x6a0]
je 0x100361ca
mov dword [ebp - 0x254], 1
jmp 0x100361d1
and dword [ebp - 0x254], 0
push 2
lea ecx, [ebp - 0x5bc]
call fcn.1000f966
mov ecx, dword [ebp - 0x254]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x254], eax
jge 0x100361fa
and dword [ebp - 0x4d8], 0
jmp 0x10036204
mov dword [ebp - 0x4d8], 1
cmp dword [ebp - 0x4d8], 1
jbe 0x10036219
mov dword [ebp - 0x410], 1
jmp 0x10036220
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x410]
jge 0x10036237
mov dword [ebp - 0x280], 1
jmp 0x1003623e
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x704], eax
push 1
lea ecx, [ebp - 0x5bc]
call fcn.1000f966
cmp dword [eax], 0
jne 0x10036387
push 0
lea ecx, [ebp - 0x5a4]
call fcn.1000f966
mov esi, eax
push 0
lea ecx, [ebp - 0x5a4]
call fcn.1000f966
mov edi, dword [eax]
add edi, dword [esi]
push 0
lea ecx, [ebp - 0x5bc]
call fcn.1000f966
imul edi, dword [eax]
mov dword [ebp - 0x284], edi
push 0
lea ecx, [ebp - 0x5bc]
call fcn.1000f966
mov ecx, dword [ebp - 0x284]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x284], eax
jne 0x100362ce
mov dword [ebp - 0x28c], 1
jmp 0x100362d5
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x2ac]
cmp dword [ebp - 0x28c], eax
jle 0x100362ef
mov dword [ebp - 0x294], 1
jmp 0x100362f6
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0x294]
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x1c0]
jge 0x1003631f
mov dword [ebp - 0x29c], 1
jmp 0x10036326
and dword [ebp - 0x29c], 0
imul eax, dword [ebp - 0x29c], 0
mov dword [ebp - 0x2a4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp + eax - 0x958], ecx
push 1
lea ecx, [ebp - 0x5a4]
call fcn.1000f966
mov ecx, dword [ebp - 0x2a4]
cmp ecx, dword [eax]
jle 0x10036369
mov dword [ebp - 0x2b4], 1
jmp 0x10036370
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x2ac]
cmp dword [ebp - 0x2b4], eax
je 0x10036387
and dword [ebp - 0x2bc], 0
jmp 0x10036391
mov dword [ebp - 0x2bc], 1
mov eax, dword [ebp - 0x6ac]
cmp dword [ebp - 0x2bc], eax
jl 0x100363ab
mov dword [ebp - 0x2c4], 1
jmp 0x100363b2
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x2c4], eax
jge 0x100363cc
mov dword [ebp - 0x2cc], 1
jmp 0x100363d3
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x70c]
imul eax, dword [ebp - 0x2cc]
cmp eax, 0x91de2fc2
jae 0x100363f3
mov dword [ebp - 0x2d4], 1
jmp 0x100363fa
and dword [ebp - 0x2d4], 0
cmp dword [ebp - 0x2d4], 0
ja 0x1003640f
mov dword [ebp - 0x2dc], 1
jmp 0x10036416
and dword [ebp - 0x2dc], 0
cmp dword [ebp - 0x2dc], 0
jle 0x1003642b
mov dword [ebp - 0x2e4], 1
jmp 0x10036432
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x2e4], eax
jle 0x1003644c
mov dword [ebp - 0x2ec], 1
jmp 0x10036453
and dword [ebp - 0x2ec], 0
cmp dword [ebp - 0x2ec], 0x8c33
jge 0x1003646b
mov dword [ebp - 0x2f4], 1
jmp 0x10036472
and dword [ebp - 0x2f4], 0
mov esi, dword [ebp - 0x6c]
push 0
lea ecx, [ebp - 0x5a4]
call fcn.1000f966
mov edi, dword [eax]
add edi, dword [ebp - 0x2f4]
imul edi, esi
push 2
lea ecx, [ebp - 0x5a4]
call fcn.1000f966
cmp edi, dword [eax]
jle 0x100364aa
mov dword [ebp - 0x2fc], 1
jmp 0x100364b1
and dword [ebp - 0x2fc], 0
cmp dword [ebp - 0x2fc], 0xffff
jne 0x100364c9
mov dword [ebp - 0x304], 1
jmp 0x100364d0
and dword [ebp - 0x304], 0
push 1
lea ecx, [ebp - 0x9b8]
call fcn.1000f966
mov ecx, dword [ebp - 0x304]
mov dword [eax], ecx
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x9b8]
call fcn.1000f94a
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x5bc]
call fcn.1000f94a
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x5a4]
call fcn.1000f94a
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x1003652a
push 0
push 0xce7
call dword [sym.imp.GDI32.dll_RectVisible]
jmp 0x100358b1
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x8dc]
call fcn.1000f94a
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x858]
call fcn.1000f94a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x26c]
call fcn.1000f94a
mov eax, dword [ebp - 0x6b8]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0xdc], 0x1a35ca42
mov dword [ebp - 0x188], 4
mov dword [ebp - 0xfc], 1
push 2
lea ecx, [ebp - 0x5b0]
call fcn.1000f8c8
mov dword [ebp - 4], 0x17
mov dword [ebp - 0xf4], 0
jmp 0x100365b6
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jge 0x100365d2
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x118], 1
jmp 0x100365a9
push 0
lea eax, [ebp - 0x5b0]
push eax
push 0x186f
push 1
lea eax, [ebp - 0xf4]
push eax
call fcn.10031627
add esp, 0x14
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x118], 0
jne 0x1003664f
mov dword [ebp - 0xdc], 0x2daa
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x188], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
push 4
pop edx
shl edx, 0
mov esi, dword [ebp - 0xfc]
add esi, dword [ebp + edx - 0x118]
sub esi, dword [ebp + ecx - 0x118]
sub esi, dword [ebp + eax - 0x118]
jne 0x1003664f
and dword [ebp - 0x714], 0
jmp 0x10036659
mov dword [ebp - 0x714], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x118]
mov dword [ebp - 0x980], eax
mov eax, 0x4432
cmp eax, 0x3b28
je 0x10036684
mov dword [ebp - 0x30c], 1
jmp 0x1003668b
and dword [ebp - 0x30c], 0
cmp dword [ebp - 0x30c], 0xffff
je 0x100366a3
mov dword [ebp - 0x314], 1
jmp 0x100366aa
and dword [ebp - 0x314], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x118]
cmp eax, dword [ebp - 0x314]
jg 0x100366cb
mov dword [ebp - 0x31c], 1
jmp 0x100366d2
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xdc], 0
je 0x100367a1
push 1
lea ecx, [ebp - 0x5b0]
call fcn.1000f966
push 1
lea ecx, [ebp - 0x5b0]
call fcn.1000f966
cmp dword [eax], 0
je 0x1003671a
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x118], 0
jne 0x1003672c
cmp dword [ebp - 0x188], 0
jne 0x1003672c
and dword [ebp - 0x6c4], 0
jmp 0x10036736
mov dword [ebp - 0x6c4], 1
push 1
lea ecx, [ebp - 0x5b0]
call fcn.1000f966
cmp dword [eax], 0x8d36
jg 0x10036758
xor eax, eax
jne 0x10036758
and dword [ebp - 0x27c], 0
jmp 0x10036762
mov dword [ebp - 0x27c], 1
cmp dword [ebp - 0x27c], 0x1c17854c
jne 0x1003677a
mov dword [ebp - 0x32c], 1
jmp 0x10036781
and dword [ebp - 0x32c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x118]
add eax, dword [ebp - 0x32c]
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
push 1
lea ecx, [ebp - 0x5b0]
call fcn.1000f966
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x118]
mov dword [ebp - 0x988], eax
push 1
lea ecx, [ebp - 0x5b0]
call fcn.1000f966
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xfc]
cmp ecx, dword [ebp + eax - 0x118]
jle 0x100367ef
mov dword [ebp - 0x334], 1
jmp 0x100367f6
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x188]
add eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0x334]
jg 0x10036816
mov dword [ebp - 0x33c], 1
jmp 0x1003681d
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x33c], eax
jl 0x10036837
mov dword [ebp - 0x344], 1
jmp 0x1003683e
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0xfc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5b0]
call fcn.1000f94a
cmp dword [ebp - 0x238], 0
jle 0x10038866
mov dword [ebp - 0x84], 0xa61928c1
mov dword [ebp - 0x48], 0
jmp 0x10036880
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x10036896
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0xab8], 1
jmp 0x10036879
mov dword [ebp - 0x48], 0
jmp 0x100368a6
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x100368bc
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x9dc], 0xcb64b693
jmp 0x1003689f
mov dword [ebp - 0x84], 0
jmp 0x100368d5
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0xffffffe4
je 0x10036a64
mov dword [ebp - 0xe4], 0x3938
mov dword [ebp - 0xa8], 2
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x84]
jle 0x10036910
mov dword [ebp - 0x34c], 1
jmp 0x10036917
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x34c]
jl 0x10036931
mov dword [ebp - 0x354], 1
jmp 0x10036938
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x354]
jge 0x10036952
mov dword [ebp - 0x35c], 1
jmp 0x10036959
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
add eax, 0xfffc
je 0x100369a3
mov byte [ebp - 0x76], 0
movzx eax, byte [ebp - 0x76]
test eax, eax
je 0x1003699e
push 0x6055
push 0
push 0x5e37
push 0xeef
push 0x6c56
push 0
call fcn.1002d870
add esp, 0x18
jmp 0x10036a5f
mov dword [ebp - 0x990], 0x77c422d5
mov dword [ebp - 0xe4], 0
jmp 0x100369c6
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 3
jg 0x100369f5
mov byte [ebp - 0x78], 0
movzx eax, byte [ebp - 0x78]
test eax, eax
je 0x100369f3
push 1
push 0
push 0
push 0x44f4
push 0x3b5a
call fcn.1002d26c
add esp, 0x14
jmp 0x100369b9
mov dword [ebp - 0xa8], 0
jmp 0x10036a0e
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 7
jge 0x10036a5f
mov dword [ebp - 0x1e0], 0
jmp 0x10036a30
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 1
jge 0x10036a4c
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0x998], 9
jmp 0x10036a23
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x9dc], 1
jmp 0x10036a01
jmp 0x100368c8
mov dword [ebp - 0x22c], 0xbf8f0aa6
mov dword [ebp - 0x8c], 0x3bd65256
mov dword [ebp - 0xbc], 4
mov dword [ebp - 0x71c], 0x535dd253
mov dword [ebp - 0x6d0], 0xfffffffe
mov dword [ebp - 0x190], 0
jmp 0x10036aaf
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 4
jge 0x10036acb
mov eax, dword [ebp - 0x190]
mov dword [ebp + eax*4 - 0x5d8], 0xf5a9c4c8
jmp 0x10036aa2
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5d8]
mov dword [ebp - 0x22c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x22c]
cmp ecx, dword [ebp + eax - 0x5d8]
jl 0x10036b51
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x5d8]
mov dword [ebp - 0x9a0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5d8], 0xd7249aae
jbe 0x10036b35
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x5d8], 0
je 0x10036b35
mov dword [ebp - 0x364], 1
jmp 0x10036b3c
and dword [ebp - 0x364], 0
cmp dword [ebp - 0x364], 0x43c6
jge 0x10036b51
and dword [ebp - 0x36c], 0
jmp 0x10036b5b
mov dword [ebp - 0x36c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5d8]
cmp dword [ebp - 0x36c], eax
jge 0x10036b7c
mov dword [ebp - 0x374], 1
jmp 0x10036b83
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
je 0x10036bb4
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5d8], 0
je 0x10036bb4
mov dword [ebp - 0x37c], 1
jmp 0x10036bbb
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0x8c], 0
je 0x10036cc3
mov eax, dword [ebp - 0x8c]
sub eax, 0x35731705
cmp eax, dword [ebp - 0xbc]
je 0x10036bf3
mov dword [ebp - 0x384], 1
jmp 0x10036bfa
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0xbc]
dec eax
cmp eax, dword [ebp - 0x384]
jg 0x10036c1e
mov eax, 0xd7d04549
test eax, eax
je 0x10036c1e
mov dword [ebp - 0x38c], 1
jmp 0x10036c25
and dword [ebp - 0x38c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5d8]
cmp eax, dword [ebp - 0x38c]
je 0x10036c45
mov dword [ebp - 0x394], 1
jmp 0x10036c4c
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x71c]
cmp dword [ebp - 0x394], eax
je 0x10036c6a
mov eax, 0x5123020f
test eax, eax
je 0x10036c6a
cmp dword [ebp - 0x22c], 0
mov dword [ebp - 0x8c], 0x18eb
mov eax, dword [ebp - 0x8c]
sub eax, 0x19bd
cmp eax, 0x8ba79672
jae 0x10036c92
mov dword [ebp - 0x39c], 1
jmp 0x10036c99
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jne 0x10036cb7
cmp dword [ebp - 0x8c], 0
je 0x10036cc3
mov dword [ebp - 0x3a4], 1
jmp 0x10036cca
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x6d0], eax
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xc0], 0
jmp 0x10036cf9
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0xfffffff7
jl 0x10036d2a
push 1
push 0x28a
push 0x37c0
push 0
push 0x3b80
call fcn.1002a9cf
add esp, 0x14
cmp dword [ebp - 0xc0], 0
je 0x10036d28
jmp 0x10036d2a
jmp 0x10036cec
mov dword [ebp - 0xc8], 0x1a35ca42
mov dword [ebp - 0x128], 4
mov dword [ebp - 0xd0], 1
push 2
lea ecx, [ebp - 0x598]
call fcn.1000f8c8
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x60], 0
jmp 0x10036d6c
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x10036d82
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x110], 1
jmp 0x10036d65
mov dword [ebp - 0x11c], 0xe91a049f
mov dword [ebp - 0x9a8], 1
mov dword [ebp - 0x11c], 0x19
jmp 0x10036daf
mov eax, dword [ebp - 0x11c]
dec eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xffffffea
jg 0x10036dee
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x10036dec
push 0
push 0
push 0x2225
push 0
push 0x269e
push 0
push 0x17f7
push 0xc42
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x10036da2
mov dword [ebp - 0x60], 0
jmp 0x10036dfe
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x10036e1a
push dword [ebp - 0x60]
lea ecx, [ebp - 0x598]
call fcn.1000f966
mov dword [eax], 4
jmp 0x10036df7
mov dword [ebp - 0x724], 0xffffffff
mov dword [ebp - 0x6dc], 0xfffffffd
mov dword [ebp - 0x4c], 0
jmp 0x10036e3e
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x10036e54
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xa48], 0xfffffffa
jmp 0x10036e37
mov dword [ebp - 0x4c], 0
jmp 0x10036e64
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x10036e7a
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x964], 0xfffffffe
jmp 0x10036e5d
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0x9ec], eax
mov eax, dword [ebp - 0x6dc]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x964], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x110], 0
jne 0x10036ef7
mov dword [ebp - 0xc8], 0x2daa
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x128], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
push 4
pop edx
shl edx, 0
mov esi, dword [ebp - 0xd0]
add esi, dword [ebp + edx - 0x110]
sub esi, dword [ebp + ecx - 0x110]
sub esi, dword [ebp + eax - 0x110]
jne 0x10036ef7
and dword [ebp - 0x72c], 0
jmp 0x10036f01
mov dword [ebp - 0x72c], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x110]
mov dword [ebp - 0x9f4], eax
mov eax, 0x4432
cmp eax, 0x3b28
je 0x10036f2c
mov dword [ebp - 0x3ac], 1
jmp 0x10036f33
and dword [ebp - 0x3ac], 0
cmp dword [ebp - 0x3ac], 0xffff
je 0x10036f4b
mov dword [ebp - 0x3b4], 1
jmp 0x10036f52
and dword [ebp - 0x3b4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x110]
cmp eax, dword [ebp - 0x3b4]
jg 0x10036f73
mov dword [ebp - 0x3bc], 1
jmp 0x10036f7a
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xc8], 0
je 0x10037049
push 1
lea ecx, [ebp - 0x598]
call fcn.1000f966
push 1
lea ecx, [ebp - 0x598]
call fcn.1000f966
cmp dword [eax], 0
je 0x10036fc2
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x110], 0
jne 0x10036fd4
cmp dword [ebp - 0x128], 0
jne 0x10036fd4
and dword [ebp - 0x6e8], 0
jmp 0x10036fde
mov dword [ebp - 0x6e8], 1
push 1
lea ecx, [ebp - 0x598]
call fcn.1000f966
cmp dword [eax], 0x8d36
jg 0x10037000
xor eax, eax
jne 0x10037000
and dword [ebp - 0x3c4], 0
jmp 0x1003700a
mov dword [ebp - 0x3c4], 1
cmp dword [ebp - 0x3c4], 0x1c17854c
jne 0x10037022
mov dword [ebp - 0x3cc], 1
jmp 0x10037029
and dword [ebp - 0x3cc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x110]
add eax, dword [ebp - 0x3cc]
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
push 1
lea ecx, [ebp - 0x598]
call fcn.1000f966
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x110]
mov dword [ebp - 0x9fc], eax
push 1
lea ecx, [ebp - 0x598]
call fcn.1000f966
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd0]
cmp ecx, dword [ebp + eax - 0x110]
jle 0x10037097
mov dword [ebp - 0x3d4], 1
jmp 0x1003709e
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x128]
add eax, dword [ebp - 0xd0]
cmp eax, dword [ebp - 0x3d4]
jg 0x100370be
mov dword [ebp - 0x3dc], 1
jmp 0x100370c5
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x3dc], eax
jl 0x100370df
mov dword [ebp - 0x3e4], 1
jmp 0x100370e6
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0xd0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x598]
call fcn.1000f94a
mov dword [ebp - 0xd8], 0x24a8c6a5
mov dword [ebp - 0xd8], 0
jmp 0x10037124
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 7
jle 0x10037149
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x10037147
push 0x2cef
push 0
call fcn.100421db
pop ecx
pop ecx
jmp 0x10037117
push 1
lea eax, [ebp - 0xd8]
push eax
push 0x29c
push 0x5164
push 0x6d6a
push 0
push 0
push 0x495e
call fcn.10047362
add esp, 0x20
mov dword [ebp - 0x3ec], 0x13f0
mov dword [ebp - 0x6f4], 0x1000a6bc
cmp dword [ebp - 0x3ec], 0x14b5
jle 0x1003726b
and dword [ebp - 0x13c], 0
jmp 0x100371ac
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0x2b54
jge 0x1003726b
and dword [ebp - 0x12c], 0
jmp 0x100371d2
cmp dword [ebp - 0x12c], 0x287b
jge 0x10037266
and dword [ebp - 0x134], 0
jmp 0x100371f8
cmp dword [ebp - 0x134], 0x1522
jge 0x10037261
mov eax, dword [ebp - 0x12c]
add eax, dword [ebp - 0x134]
and eax, dword [ebp - 0x13c]
cdq
mov dword [ebp - 0x6c0], eax
mov dword [ebp - 0x6bc], edx
push dword [ebp - 0x6bc]
push dword [ebp - 0x6c0]
lea ecx, [ebp - 0xa90]
call fcn.1000cfb0
pop ecx
pop ecx
mov dword [ebp - 0x734], eax
mov ecx, dword [ebp - 0x734]
call fcn.1000f793
push eax
call fcn.1004a046
pop ecx
lea ecx, [ebp - 0xa90]
call fcn.1000f789
jmp 0x100371eb
jmp 0x100371c5
jmp 0x1003719f
mov dword [ebp - 4], 0x19
cmp dword [ebp - 0x3ec], 0x1353
jge 0x1003728a
push dword [ebp - 0x6f4]
call fcn.1004a046
pop ecx
jmp 0x100372a6
or dword [ebp - 4], 0xffffffff
jmp 0x100372b0
push 4
push 0x1000
push dword [ebp - 0x238]
mov eax, dword [ebp - 0x558]
mov ecx, dword [ebp - 0x73c]
add ecx, dword [eax + 0xc]
push ecx
push 0x4e72
push 0x5592
call fcn.1001c16d
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x240]
mov dword [ecx], eax
mov dword [ebp - 0x14], 5
mov dword [ebp - 0xe8], 0xfff8
mov dword [ebp - 0x3f4], 0x6dab
mov dword [ebp - 0x744], 0x1000a708
cmp dword [ebp - 0x3f4], 0x7034
jle 0x100373f9
and dword [ebp - 0x154], 0
jmp 0x10037333
cmp dword [ebp - 0x154], 0x63ec
jge 0x100373f9
and dword [ebp - 0x144], 0
jmp 0x10037359
mov dword [ebp - 0x208], 0xfffffff9
mov dword [ebp - 4], 0x1b
cmp dword [ebp - 0x3f4], 0x6d68
jge 0x10037426
mov edx, dword [ebp - 0x744]
mov ecx, 0x106081f8
call fcn.1001125d
jmp 0x10037442
or dword [ebp - 4], 0xffffffff
jmp 0x1003744c
jmp 0x10038890
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x664], eax
push dword [ebp - 0x664]
push 0
push dword [ebp - 0x66c]
call fcn.100424e3
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret