Function at 0x10040150
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x39c
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + 0x1a]
cmp ecx, 1
je 0x10040187
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0
jg 0x100401cc
push ecx
mov dword [ebp - 0x70], esp
mov eax, dword [ebp + 8]
sub eax, 0x10
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x68]
push ecx
call fcn.100306c0
add esp, 4
mov dword [ebp - 0x6c], eax
mov edx, dword [ebp - 0x6c]
add edx, 0x10
mov eax, dword [ebp - 0x70]
mov dword [eax], edx
mov ecx, dword [ebp - 0xc]
call fcn.10033510
mov ecx, dword [ebp + 8]
sub ecx, 0x10
mov dword [ebp - 0x74], ecx
mov ecx, dword [ebp - 0x74]
call fcn.10003260
jmp 0x10042601
call fcn.10003470
push eax
lea ecx, [ebp - 0x18]
call fcn.100302f0
push ecx
mov dword [ebp - 0x80], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x34]
sub eax, 0x10
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0x78]
push ecx
call fcn.100306c0
add esp, 4
mov dword [ebp - 0x7c], eax
mov edx, dword [ebp - 0x7c]
add edx, 0x10
mov eax, dword [ebp - 0x80]
mov dword [eax], edx
mov ecx, dword [ebp - 0xc]
call fcn.10034d40
mov dword [ebp - 0x84], eax
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
cmp eax, dword [edx + 0x1c]
jge 0x1004022f
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0xd], 0
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x20]
jg 0x1004027b
push ecx
mov eax, esp
push 1
mov ecx, dword [ebp - 0x24]
sub ecx, 1
push ecx
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
mov ecx, dword [ebp - 0xc]
call fcn.10036eb0
movzx edx, al
test edx, edx
je 0x10040270
mov byte [ebp - 0xd], 1
jmp 0x1004027b
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x24], eax
jmp 0x1004023b
movzx ecx, byte [ebp - 0xd]
test ecx, ecx
jne 0x100402f7
push ecx
mov dword [ebp - 0x90], esp
mov edx, dword [ebp + 8]
sub edx, 0x10
mov dword [ebp - 0x88], edx
mov eax, dword [ebp - 0x88]
push eax
call fcn.100306c0
add esp, 4
mov dword [ebp - 0x8c], eax
mov ecx, dword [ebp - 0x8c]
add ecx, 0x10
mov edx, dword [ebp - 0x90]
mov dword [edx], ecx
mov ecx, dword [ebp - 0xc]
call fcn.10033510
mov eax, dword [ebp - 0x18]
sub eax, 0x10
mov dword [ebp - 0x94], eax
mov ecx, dword [ebp - 0x94]
call fcn.10003260
mov ecx, dword [ebp + 8]
sub ecx, 0x10
mov dword [ebp - 0x98], ecx
mov ecx, dword [ebp - 0x98]
call fcn.10003260
jmp 0x10042601
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x24]
jl 0x10040337
push ecx
mov eax, esp
push 1
mov ecx, dword [ebp - 0x20]
sub ecx, 1
push ecx
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
mov ecx, dword [ebp - 0xc]
call fcn.10036eb0
movzx edx, al
test edx, edx
je 0x1004032c
mov byte [ebp - 0xd], 1
jmp 0x10040337
mov eax, dword [ebp - 0x20]
sub eax, 1
mov dword [ebp - 0x20], eax
jmp 0x100402f7
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x24]
jge 0x10040345
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x14]
jl 0x10040398
push ecx
mov eax, esp
push 1
mov ecx, dword [ebp - 0x24]
sub ecx, 1
push ecx
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
mov ecx, dword [ebp - 0xc]
call fcn.10036eb0
movzx edx, al
test edx, edx
je 0x1004038b
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x24]
cmp eax, 3
jle 0x1004038d
jmp 0x10040398
mov ecx, dword [ebp - 0x24]
sub ecx, 1
mov dword [ebp - 0x24], ecx
jmp 0x10040351
mov edx, dword [ebp - 0x24]
cmp edx, dword [ebp - 0x14]
jge 0x100403a6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x24]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x24]
sub edx, 1
push edx
lea eax, [ebp - 0xa0]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
mov dword [ebp - 0x9c], eax
mov ecx, dword [ebp - 0x9c]
push ecx
lea ecx, [ebp - 0x18]
call fcn.10030240
mov edx, dword [ebp - 0xa0]
sub edx, 0x10
mov dword [ebp - 0xa4], edx
mov ecx, dword [ebp - 0xa4]
call fcn.10003260
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [eax]
jge 0x10040583
or dword [ebp - 4], 1
mov edx, dword [ebp + 8]
mov dword [ebp - 0xa8], edx
push 0
mov eax, dword [ebp - 0xa8]
push eax
push 0x10068078
lea ecx, [ebp - 0xb8]
call fcn.1002fa40
mov ecx, eax
call fcn.1002f110
add eax, 1
test eax, eax
jle 0x100404ae
or dword [ebp - 4], 2
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
mov dword [ebp - 0x44], ecx
cmp dword [ebp - 0x20], 0
jl 0x10040466
mov edx, dword [ebp - 0x44]
mov eax, dword [edx]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0xac], ecx
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0xac]
jle 0x10040470
push 0x80070057
call fcn.10002e80
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x20]
mov ax, word [ecx + edx*2]
mov word [ebp - 0x3e], ax
push 0
movzx ecx, word [ebp - 0x3e]
push ecx
push str.c_t_p
lea ecx, [ebp - 0xb0]
call fcn.1002fa40
mov ecx, eax
call fcn.10048d30
add eax, 1
test eax, eax
jle 0x100404ae
mov dword [ebp - 0x48], 1
jmp 0x100404b5
mov dword [ebp - 0x48], 0
mov dl, byte [ebp - 0x48]
mov byte [ebp - 0x2d], dl
mov eax, dword [ebp - 4]
and eax, 2
je 0x100404e1
and dword [ebp - 4], 0xfffffffd
mov ecx, dword [ebp - 0xb0]
sub ecx, 0x10
mov dword [ebp - 0xb4], ecx
mov ecx, dword [ebp - 0xb4]
call fcn.10003260
mov edx, dword [ebp - 4]
and edx, 1
je 0x10040507
and dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0xb8]
sub eax, 0x10
mov dword [ebp - 0xbc], eax
mov ecx, dword [ebp - 0xbc]
call fcn.10003260
movzx ecx, byte [ebp - 0x2d]
test ecx, ecx
je 0x10040583
push ecx
mov dword [ebp - 0xc8], esp
mov edx, dword [ebp + 8]
sub edx, 0x10
mov dword [ebp - 0xc0], edx
mov eax, dword [ebp - 0xc0]
push eax
call fcn.100306c0
add esp, 4
mov dword [ebp - 0xc4], eax
mov ecx, dword [ebp - 0xc4]
add ecx, 0x10
mov edx, dword [ebp - 0xc8]
mov dword [edx], ecx
mov ecx, dword [ebp - 0xc]
call fcn.10033510
mov eax, dword [ebp - 0x18]
sub eax, 0x10
mov dword [ebp - 0xcc], eax
mov ecx, dword [ebp - 0xcc]
call fcn.10003260
mov ecx, dword [ebp + 8]
sub ecx, 0x10
mov dword [ebp - 0xd0], ecx
mov ecx, dword [ebp - 0xd0]
call fcn.10003260
jmp 0x10042601
mov edx, dword [ebp - 0x39c]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x3c], 1
je 0x100405b4
cmp dword [ebp - 0x3c], 2
je 0x1004073e
cmp dword [ebp - 0x3c], 3
je 0x10041c92
jmp 0x10041f88
cmp dword [ebp - 0x20], 1
jle 0x10040733
or dword [ebp - 4], 4
or dword [ebp - 4], 8
push str.QUIGUQOAEQUGIAYAIOIUIUAOEOAOEUAUYQUAOU
push 1
mov edx, dword [ebp - 0x20]
push edx
lea eax, [ebp - 0xe4]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
push eax
lea ecx, [ebp - 0xdc]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx edx, al
test edx, edx
je 0x10040638
or dword [ebp - 4], 0x10
push 0x1006808c
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0xd4]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx edx, al
test edx, edx
je 0x10040638
mov dword [ebp - 0x4c], 1
jmp 0x1004063f
mov dword [ebp - 0x4c], 0
mov al, byte [ebp - 0x4c]
mov byte [ebp - 0x2e], al
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x1004066b
and dword [ebp - 4], 0xffffffef
mov edx, dword [ebp - 0xd4]
sub edx, 0x10
mov dword [ebp - 0xd8], edx
mov ecx, dword [ebp - 0xd8]
call fcn.10003260
mov eax, dword [ebp - 4]
and eax, 8
je 0x10040691
and dword [ebp - 4], 0xfffffff7
mov ecx, dword [ebp - 0xdc]
sub ecx, 0x10
mov dword [ebp - 0xe0], ecx
mov ecx, dword [ebp - 0xe0]
call fcn.10003260
mov edx, dword [ebp - 4]
and edx, 4
je 0x100406b7
and dword [ebp - 4], 0xfffffffb
mov eax, dword [ebp - 0xe4]
sub eax, 0x10
mov dword [ebp - 0xe8], eax
mov ecx, dword [ebp - 0xe8]
call fcn.10003260
movzx ecx, byte [ebp - 0x2e]
test ecx, ecx
je 0x10040733
push ecx
mov dword [ebp - 0xf4], esp
mov edx, dword [ebp + 8]
sub edx, 0x10
mov dword [ebp - 0xec], edx
mov eax, dword [ebp - 0xec]
push eax
call fcn.100306c0
add esp, 4
mov dword [ebp - 0xf0], eax
mov ecx, dword [ebp - 0xf0]
add ecx, 0x10
mov edx, dword [ebp - 0xf4]
mov dword [edx], ecx
mov ecx, dword [ebp - 0xc]
call fcn.10033510
mov eax, dword [ebp - 0x18]
sub eax, 0x10
mov dword [ebp - 0xf8], eax
mov ecx, dword [ebp - 0xf8]
call fcn.10003260
mov ecx, dword [ebp + 8]
sub ecx, 0x10
mov dword [ebp - 0xfc], ecx
mov ecx, dword [ebp - 0xfc]
call fcn.10003260
jmp 0x10042601
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x14], edx
jmp 0x10041f88
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x34]
mov edx, dword [ecx - 0xc]
mov dword [ebp - 0x100], edx
mov eax, dword [ebp - 0x24]
sub eax, 2
cmp dword [ebp - 0x100], eax
jle 0x100409f6
or dword [ebp - 4], 0x20
or dword [ebp - 4], 0x40
push 0x10068090
push 1
lea ecx, [ebp - 0x13c]
push ecx
lea ecx, [ebp - 0x18]
call fcn.1002ef20
push eax
lea edx, [ebp - 0x134]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx eax, al
test eax, eax
je 0x100407ef
or dword [ebp - 4], 0x80
or dword [ebp - 4], 0x100
push 0x10068094
push 1
mov ecx, dword [ebp - 0x24]
sub ecx, 2
push ecx
lea edx, [ebp - 0x12c]
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
push eax
lea eax, [ebp - 0x124]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x1004088a
or dword [ebp - 4], 0x200
or dword [ebp - 4], 0x400
push 0x10068098
push 1
lea edx, [ebp - 0x11c]
push edx
lea ecx, [ebp - 0x18]
call fcn.1002ef20
push eax
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10040881
or dword [ebp - 4], 0x800
or dword [ebp - 4], 0x1000
push 0x1006809c
push 1
mov edx, dword [ebp - 0x24]
sub edx, 2
push edx
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
push eax
lea ecx, [ebp - 0x104]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx edx, al
test edx, edx
jne 0x1004088a
mov dword [ebp - 0x50], 0
jmp 0x10040891
mov dword [ebp - 0x50], 1
mov al, byte [ebp - 0x50]
mov byte [ebp - 0x2f], al
mov ecx, dword [ebp - 4]
and ecx, 0x1000
je 0x100408c3
and dword [ebp - 4], 0xffffefff
mov edx, dword [ebp - 0x104]
sub edx, 0x10
mov dword [ebp - 0x108], edx
mov ecx, dword [ebp - 0x108]
call fcn.10003260
mov eax, dword [ebp - 4]
and eax, 0x800
je 0x100408ee
and dword [ebp - 4], 0xfffff7ff
mov ecx, dword [ebp - 0x10c]
sub ecx, 0x10
mov dword [ebp - 0x110], ecx
mov ecx, dword [ebp - 0x110]
call fcn.10003260
mov edx, dword [ebp - 4]
and edx, 0x400
je 0x1004091a
and dword [ebp - 4], 0xfffffbff
mov eax, dword [ebp - 0x114]
sub eax, 0x10
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x118]
call fcn.10003260
mov ecx, dword [ebp - 4]
and ecx, 0x200
je 0x10040946
and dword [ebp - 4], 0xfffffdff
mov edx, dword [ebp - 0x11c]
sub edx, 0x10
mov dword [ebp - 0x120], edx
mov ecx, dword [ebp - 0x120]
call fcn.10003260
mov eax, dword [ebp - 4]
and eax, 0x100
je 0x10040971
and dword [ebp - 4], 0xfffffeff
mov ecx, dword [ebp - 0x124]
sub ecx, 0x10
mov dword [ebp - 0x128], ecx
mov ecx, dword [ebp - 0x128]
call fcn.10003260
mov edx, dword [ebp - 4]
and edx, 0x80
je 0x1004099d
and dword [ebp - 4], 0xffffff7f
mov eax, dword [ebp - 0x12c]
sub eax, 0x10
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x130]
call fcn.10003260
mov ecx, dword [ebp - 4]
and ecx, 0x40
je 0x100409c3
and dword [ebp - 4], 0xffffffbf
mov edx, dword [ebp - 0x134]
sub edx, 0x10
mov dword [ebp - 0x138], edx
mov ecx, dword [ebp - 0x138]
call fcn.10003260
mov eax, dword [ebp - 4]
and eax, 0x20
je 0x100409e9
and dword [ebp - 4], 0xffffffdf
mov ecx, dword [ebp - 0x13c]
sub ecx, 0x10
mov dword [ebp - 0x140], ecx
mov ecx, dword [ebp - 0x140]
call fcn.10003260
movzx edx, byte [ebp - 0x2f]
test edx, edx
je 0x100409f6
jmp 0x100405b4
or dword [ebp - 4], 0x2000
or dword [ebp - 4], 0x4000
push 0x100680a0
push 1
lea eax, [ebp - 0x184]
push eax
lea ecx, [ebp - 0x18]
call fcn.10048bf0
push eax
lea ecx, [ebp - 0x17c]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx edx, al
test edx, edx
je 0x10040b39
or dword [ebp - 4], 0x8000
or dword [ebp - 4], 0x10000
or dword [ebp - 4], 0x20000
push 0x100680a4
push 1
lea eax, [ebp - 0x16c]
push eax
push ecx
mov ecx, esp
push 1
push ecx
lea ecx, [ebp - 0x18]
call fcn.1002ef20
lea edx, [ebp - 0x174]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.100376b0
mov ecx, eax
call fcn.1002ef20
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x144]
push eax
lea ecx, [ebp - 0x164]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048a20
add esp, 8
mov byte [ebp - 0x30], al
movzx edx, byte [ebp - 0x30]
test edx, edx
je 0x10040b39
or dword [ebp - 4], 0x40000
or dword [ebp - 4], 0x80000
or dword [ebp - 4], 0x100000
push 0x100680a8
push 1
lea eax, [ebp - 0x154]
push eax
push ecx
mov ecx, esp
push 1
push ecx
lea ecx, [ebp - 0x18]
call fcn.1002ef20
lea edx, [ebp - 0x15c]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.100376b0
mov ecx, eax
call fcn.1002ef20
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
push eax
lea ecx, [ebp - 0x14c]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048a20
add esp, 8
mov byte [ebp - 0x31], al
movzx edx, byte [ebp - 0x31]
test edx, edx
je 0x10040b39
mov dword [ebp - 0x54], 1
jmp 0x10040b40
mov dword [ebp - 0x54], 0
mov al, byte [ebp - 0x54]
mov byte [ebp - 0x32], al
mov ecx, dword [ebp - 4]
and ecx, 0x100000
je 0x10040b72
and dword [ebp - 4], 0xffefffff
mov edx, dword [ebp - 0x14c]
sub edx, 0x10
mov dword [ebp - 0x150], edx
mov ecx, dword [ebp - 0x150]
call fcn.10003260
mov eax, dword [ebp - 4]
and eax, 0x80000
je 0x10040b9d
and dword [ebp - 4], 0xfff7ffff
mov ecx, dword [ebp - 0x154]
sub ecx, 0x10
mov dword [ebp - 0x158], ecx
mov ecx, dword [ebp - 0x158]
call fcn.10003260
mov edx, dword [ebp - 4]
and edx, 0x40000
je 0x10040bc9
and dword [ebp - 4], 0xfffbffff
mov eax, dword [ebp - 0x15c]
sub eax, 0x10
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x160]
call fcn.10003260
mov ecx, dword [ebp - 4]
and ecx, 0x20000
je 0x10040bf5
and dword [ebp - 4], 0xfffdffff
mov edx, dword [ebp - 0x164]
sub edx, 0x10
mov dword [ebp - 0x168], edx
mov ecx, dword [ebp - 0x168]
call fcn.10003260
mov eax, dword [ebp - 4]
and eax, 0x10000
je 0x10040c20
and dword [ebp - 4], 0xfffeffff
mov ecx, dword [ebp - 0x16c]
sub ecx, 0x10
mov dword [ebp - 0x170], ecx
mov ecx, dword [ebp - 0x170]
call fcn.10003260
mov edx, dword [ebp - 4]
and edx, 0x8000
je 0x10040c4c
and dword [ebp - 4], 0xffff7fff
mov eax, dword [ebp - 0x174]
sub eax, 0x10
mov dword [ebp - 0x178], eax
mov ecx, dword [ebp - 0x178]
call fcn.10003260
mov ecx, dword [ebp - 4]
and ecx, 0x4000
je 0x10040c78
and dword [ebp - 4], 0xffffbfff
mov edx, dword [ebp - 0x17c]
sub edx, 0x10
mov dword [ebp - 0x180], edx
mov ecx, dword [ebp - 0x180]
call fcn.10003260
mov eax, dword [ebp - 4]
and eax, 0x2000
je 0x10040ca3
and dword [ebp - 4], 0xffffdfff
mov ecx, dword [ebp - 0x184]
sub ecx, 0x10
mov dword [ebp - 0x188], ecx
mov ecx, dword [ebp - 0x188]
call fcn.10003260
movzx edx, byte [ebp - 0x32]
test edx, edx
je 0x10040d1f
push ecx
mov dword [ebp - 0x194], esp
mov eax, dword [ebp + 8]
sub eax, 0x10
mov dword [ebp - 0x18c], eax
mov ecx, dword [ebp - 0x18c]
push ecx
call fcn.100306c0
add esp, 4
mov dword [ebp - 0x190], eax
mov edx, dword [ebp - 0x190]
add edx, 0x10
mov eax, dword [ebp - 0x194]
mov dword [eax], edx
mov ecx, dword [ebp - 0xc]
call fcn.10033510
mov ecx, dword [ebp - 0x18]
sub ecx, 0x10
mov dword [ebp - 0x198], ecx
mov ecx, dword [ebp - 0x198]
call fcn.10003260
mov edx, dword [ebp + 8]
sub edx, 0x10
mov dword [ebp - 0x19c], edx
mov ecx, dword [ebp - 0x19c]
call fcn.10003260
jmp 0x10042601
cmp dword [ebp - 0x24], 1
jle 0x10040dc6
or dword [ebp - 4], 0x200000
or dword [ebp - 4], 0x400000
push 0x100680ac
push 1
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp - 0x1d8]
push ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
push eax
lea edx, [ebp - 0x1d0]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx eax, al
test eax, eax
je 0x10040dc6
or dword [ebp - 4], 0x800000
or dword [ebp - 4], 0x1000000
push 0x100680b0
push 1
mov ecx, dword [ebp - 0x24]
sub ecx, 1
push ecx
lea edx, [ebp - 0x1c8]
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
push eax
lea eax, [ebp - 0x1c0]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x10040e68
or dword [ebp - 4], 0x2000000
or dword [ebp - 4], 0x4000000
push 0x100680b4
push 1
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp - 0x1b8]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
push eax
lea ecx, [ebp - 0x1b0]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx edx, al
test edx, edx
je 0x10040e5f
or dword [ebp - 4], 0x8000000
or dword [ebp - 4], 0x10000000
push 0x100680b8
push 1
mov eax, dword [ebp - 0x24]
sub eax, 1
push eax
lea ecx, [ebp - 0x1a8]
push ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
push eax
lea edx, [ebp - 0x1a0]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx eax, al
test eax, eax
jne 0x10040e68
mov dword [ebp - 0x58], 0
jmp 0x10040e6f
mov dword [ebp - 0x58], 1
mov cl, byte [ebp - 0x58]
mov byte [ebp - 0x33], cl
mov edx, dword [ebp - 4]
and edx, 0x10000000
je 0x10040ea1
and dword [ebp - 4], 0xefffffff
mov eax, dword [ebp - 0x1a0]
sub eax, 0x10
mov dword [ebp - 0x1a4], eax
mov ecx, dword [ebp - 0x1a4]
call fcn.10003260
mov ecx, dword [ebp - 4]
and ecx, 0x8000000
je 0x10040ecd
and dword [ebp - 4], 0xf7ffffff
mov edx, dword [ebp - 0x1a8]
sub edx, 0x10
mov dword [ebp - 0x1ac], edx
mov ecx, dword [ebp - 0x1ac]
call fcn.10003260
mov eax, dword [ebp - 4]
and eax, 0x4000000
je 0x10040ef8
and dword [ebp - 4], 0xfbffffff
mov ecx, dword [ebp - 0x1b0]
sub ecx, 0x10
mov dword [ebp - 0x1b4], ecx
mov ecx, dword [ebp - 0x1b4]
call fcn.10003260
mov edx, dword [ebp - 4]
and edx, 0x2000000
je 0x10040f24
and dword [ebp - 4], 0xfdffffff
mov eax, dword [ebp - 0x1b8]
sub eax, 0x10
mov dword [ebp - 0x1bc], eax
mov ecx, dword [ebp - 0x1bc]
call fcn.10003260
mov ecx, dword [ebp - 4]
and ecx, 0x1000000
je 0x10040f50
and dword [ebp - 4], 0xfeffffff
mov edx, dword [ebp - 0x1c0]
sub edx, 0x10
mov dword [ebp - 0x1c4], edx
mov ecx, dword [ebp - 0x1c4]
call fcn.10003260
mov eax, dword [ebp - 4]
and eax, 0x800000
je 0x10040f7b
and dword [ebp - 4], 0xff7fffff
mov ecx, dword [ebp - 0x1c8]
sub ecx, 0x10
mov dword [ebp - 0x1cc], ecx
mov ecx, dword [ebp - 0x1cc]
call fcn.10003260
mov edx, dword [ebp - 4]
and edx, 0x400000
je 0x10040fa7
and dword [ebp - 4], 0xffbfffff
mov eax, dword [ebp - 0x1d0]
sub eax, 0x10
mov dword [ebp - 0x1d4], eax
mov ecx, dword [ebp - 0x1d4]
call fcn.10003260
mov ecx, dword [ebp - 4]
and ecx, 0x200000
je 0x10040fd3
and dword [ebp - 4], 0xffdfffff
mov edx, dword [ebp - 0x1d8]
sub edx, 0x10
mov dword [ebp - 0x1dc], edx
mov ecx, dword [ebp - 0x1dc]
call fcn.10003260
movzx eax, byte [ebp - 0x33]
test eax, eax
je 0x10040fe6
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
jmp 0x10041c8d
or dword [ebp - 4], 0x20000000
or dword [ebp - 4], 0x40000000
push 0x100680bc
push 1
lea edx, [ebp - 0x298]
push edx
lea ecx, [ebp - 0x18]
call fcn.1002ef20
push eax
lea eax, [ebp - 0x290]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x1004106f
or dword [ebp - 4], 0x80000000
or dword [ebp - 8], 1
push 0x100680c0
push 1
lea edx, [ebp - 0x288]
push edx
lea ecx, [ebp - 0x18]
call fcn.10048bf0
push eax
lea eax, [ebp - 0x280]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x1004131e
or dword [ebp - 8], 2
or dword [ebp - 8], 4
push 0x100680c4
push 1
lea edx, [ebp - 0x278]
push edx
lea ecx, [ebp - 0x18]
call fcn.1002ef20
push eax
lea eax, [ebp - 0x270]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x100410ef
or dword [ebp - 8], 8
or dword [ebp - 8], 0x10
push 0x100680c8
push 1
lea edx, [ebp - 0x268]
push edx
lea ecx, [ebp - 0x18]
call fcn.10048bf0
push eax
lea eax, [ebp - 0x260]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x1004131e
or dword [ebp - 8], 0x20
or dword [ebp - 8], 0x40
push 0x100680cc
push 1
lea edx, [ebp - 0x258]
push edx
lea ecx, [ebp - 0x18]
call fcn.1002ef20
push eax
lea eax, [ebp - 0x250]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10041175
or dword [ebp - 8], 0x80
or dword [ebp - 8], 0x100
push 0x100680d0
push 1
lea edx, [ebp - 0x248]
push edx
lea ecx, [ebp - 0x18]
call fcn.10048bf0
push eax
lea eax, [ebp - 0x240]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x1004131e
or dword [ebp - 8], 0x200
or dword [ebp - 8], 0x400
push 0x100680d4
push 1
lea edx, [ebp - 0x238]
push edx
lea ecx, [ebp - 0x18]
call fcn.1002ef20
push eax
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10041201
or dword [ebp - 8], 0x800
or dword [ebp - 8], 0x1000
push 0x100680d8
push 1
lea edx, [ebp - 0x228]
push edx
lea ecx, [ebp - 0x18]
call fcn.10048bf0
push eax
lea eax, [ebp - 0x220]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x1004131e
or dword [ebp - 8], 0x2000
or dword [ebp - 8], 0x4000
push 0x100680dc
push 1
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x18]
call fcn.1002ef20
push eax
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x1004128d
or dword [ebp - 8], 0x8000
or dword [ebp - 8], 0x10000
push 0x100680e0
push 1
lea edx, [ebp - 0x208]
push edx
lea ecx, [ebp - 0x18]
call fcn.10048bf0
push eax
lea eax, [ebp - 0x200]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x1004131e
or dword [ebp - 8], 0x20000
or dword [ebp - 8], 0x40000
push 0x100680e4
push 1
lea edx, [ebp - 0x1f8]
push edx
lea ecx, [ebp - 0x18]
call fcn.1002ef20
push eax
lea eax, [ebp - 0x1f0]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10041315
or dword [ebp - 8], 0x80000
or dword [ebp - 8], 0x100000
push 0x100680e8
push 1
lea edx, [ebp - 0x1e8]
push edx
lea ecx, [ebp - 0x18]
call fcn.10048bf0
push eax
lea eax, [ebp - 0x1e0]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x1004131e
mov dword [ebp - 0x5c], 0
jmp 0x10041325
mov dword [ebp - 0x5c], 1
mov dl, byte [ebp - 0x5c]
mov byte [ebp - 0x34], dl
mov eax, dword [ebp - 8]
and eax, 0x100000
je 0x10041356
and dword [ebp - 8], 0xffefffff
mov ecx, dword [ebp - 0x1e0]
sub ecx, 0x10
mov dword [ebp - 0x1e4], ecx
mov ecx, dword [ebp - 0x1e4]
call fcn.10003260
mov edx, dword [ebp - 8]
and edx, 0x80000
je 0x10041382
and dword [ebp - 8], 0xfff7ffff
mov eax, dword [ebp - 0x1e8]
sub eax, 0x10
mov dword [ebp - 0x1ec], eax
mov ecx, dword [ebp - 0x1ec]
call fcn.10003260
mov ecx, dword [ebp - 8]
and ecx, 0x40000
je 0x100413ae
and dword [ebp - 8], 0xfffbffff
mov edx, dword [ebp - 0x1f0]
sub edx, 0x10
mov dword [ebp - 0x1f4], edx
mov ecx, dword [ebp - 0x1f4]
call fcn.10003260
mov eax, dword [ebp - 8]
and eax, 0x20000
je 0x100413d9
and dword [ebp - 8], 0xfffdffff
mov ecx, dword [ebp - 0x1f8]
sub ecx, 0x10
mov dword [ebp - 0x1fc], ecx
mov ecx, dword [ebp - 0x1fc]
call fcn.10003260
mov edx, dword [ebp - 8]
and edx, 0x10000
je 0x10041405
and dword [ebp - 8], 0xfffeffff
mov eax, dword [ebp - 0x200]
sub eax, 0x10
mov dword [ebp - 0x204], eax
mov ecx, dword [ebp - 0x204]
call fcn.10003260
mov ecx, dword [ebp - 8]
and ecx, 0x8000
je 0x10041431
and dword [ebp - 8], 0xffff7fff
mov edx, dword [ebp - 0x208]
sub edx, 0x10
mov dword [ebp - 0x20c], edx
mov ecx, dword [ebp - 0x20c]
call fcn.10003260
mov eax, dword [ebp - 8]
and eax, 0x4000
je 0x1004145c
and dword [ebp - 8], 0xffffbfff
mov ecx, dword [ebp - 0x210]
sub ecx, 0x10
mov dword [ebp - 0x214], ecx
mov ecx, dword [ebp - 0x214]
call fcn.10003260
mov edx, dword [ebp - 8]
and edx, 0x2000
je 0x10041488
and dword [ebp - 8], 0xffffdfff
mov eax, dword [ebp - 0x218]
sub eax, 0x10
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x21c]
call fcn.10003260
mov ecx, dword [ebp - 8]
and ecx, 0x1000
je 0x100414b4
and dword [ebp - 8], 0xffffefff
mov edx, dword [ebp - 0x220]
sub edx, 0x10
mov dword [ebp - 0x224], edx
mov ecx, dword [ebp - 0x224]
call fcn.10003260
mov eax, dword [ebp - 8]
and eax, 0x800
je 0x100414df
and dword [ebp - 8], 0xfffff7ff
mov ecx, dword [ebp - 0x228]
sub ecx, 0x10
mov dword [ebp - 0x22c], ecx
mov ecx, dword [ebp - 0x22c]
call fcn.10003260
mov edx, dword [ebp - 8]
and edx, 0x400
je 0x1004150b
and dword [ebp - 8], 0xfffffbff
mov eax, dword [ebp - 0x230]
sub eax, 0x10
mov dword [ebp - 0x234], eax
mov ecx, dword [ebp - 0x234]
call fcn.10003260
mov ecx, dword [ebp - 8]
and ecx, 0x200
je 0x10041537
and dword [ebp - 8], 0xfffffdff
mov edx, dword [ebp - 0x238]
sub edx, 0x10
mov dword [ebp - 0x23c], edx
mov ecx, dword [ebp - 0x23c]
call fcn.10003260
mov eax, dword [ebp - 8]
and eax, 0x100
je 0x10041562
and dword [ebp - 8], 0xfffffeff
mov ecx, dword [ebp - 0x240]
sub ecx, 0x10
mov dword [ebp - 0x244], ecx
mov ecx, dword [ebp - 0x244]
call fcn.10003260
mov edx, dword [ebp - 8]
and edx, 0x80
je 0x1004158e
and dword [ebp - 8], 0xffffff7f
mov eax, dword [ebp - 0x248]
sub eax, 0x10
mov dword [ebp - 0x24c], eax
mov ecx, dword [ebp - 0x24c]
call fcn.10003260
mov ecx, dword [ebp - 8]
and ecx, 0x40
je 0x100415b4
and dword [ebp - 8], 0xffffffbf
mov edx, dword [ebp - 0x250]
sub edx, 0x10
mov dword [ebp - 0x254], edx
mov ecx, dword [ebp - 0x254]
call fcn.10003260
mov eax, dword [ebp - 8]
and eax, 0x20
je 0x100415da
and dword [ebp - 8], 0xffffffdf
mov ecx, dword [ebp - 0x258]
sub ecx, 0x10
mov dword [ebp - 0x25c], ecx
mov ecx, dword [ebp - 0x25c]
call fcn.10003260
mov edx, dword [ebp - 8]
and edx, 0x10
je 0x10041600
and dword [ebp - 8], 0xffffffef
mov eax, dword [ebp - 0x260]
sub eax, 0x10
mov dword [ebp - 0x264], eax
mov ecx, dword [ebp - 0x264]
call fcn.10003260
mov ecx, dword [ebp - 8]
and ecx, 8
je 0x10041626
and dword [ebp - 8], 0xfffffff7
mov edx, dword [ebp - 0x268]
sub edx, 0x10
mov dword [ebp - 0x26c], edx
mov ecx, dword [ebp - 0x26c]
call fcn.10003260
mov eax, dword [ebp - 8]
and eax, 4
je 0x1004164c
and dword [ebp - 8], 0xfffffffb
mov ecx, dword [ebp - 0x270]
sub ecx, 0x10
mov dword [ebp - 0x274], ecx
mov ecx, dword [ebp - 0x274]
call fcn.10003260
mov edx, dword [ebp - 8]
and edx, 2
je 0x10041672
and dword [ebp - 8], 0xfffffffd
mov eax, dword [ebp - 0x278]
sub eax, 0x10
mov dword [ebp - 0x27c], eax
mov ecx, dword [ebp - 0x27c]
call fcn.10003260
mov ecx, dword [ebp - 8]
and ecx, 1
je 0x10041698
and dword [ebp - 8], 0xfffffffe
mov edx, dword [ebp - 0x280]
sub edx, 0x10
mov dword [ebp - 0x284], edx
mov ecx, dword [ebp - 0x284]
call fcn.10003260
mov eax, dword [ebp - 4]
and eax, 0x80000000
je 0x100416c3
and dword [ebp - 4], 0x7fffffff
mov ecx, dword [ebp - 0x288]
sub ecx, 0x10
mov dword [ebp - 0x28c], ecx
mov ecx, dword [ebp - 0x28c]
call fcn.10003260
mov edx, dword [ebp - 4]
and edx, 0x40000000
je 0x100416ef
and dword [ebp - 4], 0xbfffffff
mov eax, dword [ebp - 0x290]
sub eax, 0x10
mov dword [ebp - 0x294], eax
mov ecx, dword [ebp - 0x294]
call fcn.10003260
mov ecx, dword [ebp - 4]
and ecx, 0x20000000
je 0x1004171b
and dword [ebp - 4], 0xdfffffff
mov edx, dword [ebp - 0x298]
sub edx, 0x10
mov dword [ebp - 0x29c], edx
mov ecx, dword [ebp - 0x29c]
call fcn.10003260
movzx eax, byte [ebp - 0x34]
test eax, eax
je 0x10041731
mov ecx, dword [ebp - 0x20]
sub ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x10041c8d
push ecx
mov edx, esp
push 1
push edx
lea ecx, [ebp - 0x18]
call fcn.10048bf0
mov ecx, dword [ebp - 0xc]
call fcn.10036eb0
movzx eax, al
cmp eax, 1
jle 0x1004175a
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
jmp 0x10041c8d
push ecx
mov edx, esp
push 1
push edx
lea ecx, [ebp - 0x18]
call fcn.1002ef20
mov ecx, dword [ebp - 0xc]
call fcn.10036eb0
movzx eax, al
cmp eax, 1
jle 0x10041786
mov ecx, dword [ebp - 0x20]
sub ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x10041c8d
or dword [ebp - 8], 0x200000
or dword [ebp - 8], 0x400000
push 0x100680ec
push 1
lea edx, [ebp - 0x318]
push edx
lea ecx, [ebp - 0x18]
call fcn.1002ef20
push eax
lea eax, [ebp - 0x310]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10041812
or dword [ebp - 8], 0x800000
or dword [ebp - 8], 0x1000000
push 0x100680f0
push 1
lea edx, [ebp - 0x308]
push edx
lea ecx, [ebp - 0x18]
call fcn.10048bf0
push eax
lea eax, [ebp - 0x300]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x100419ac
or dword [ebp - 8], 0x2000000
or dword [ebp - 8], 0x4000000
push 0x100680f4
push 1
lea edx, [ebp - 0x2f8]
push edx
lea ecx, [ebp - 0x18]
call fcn.1002ef20
push eax
lea eax, [ebp - 0x2f0]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x1004189e
or dword [ebp - 8], 0x8000000
or dword [ebp - 8], 0x10000000
push 0x100680f8
push 1
lea edx, [ebp - 0x2e8]
push edx
lea ecx, [ebp - 0x18]
call fcn.10048bf0
push eax
lea eax, [ebp - 0x2e0]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x100419ac
or dword [ebp - 8], 0x20000000
or dword [ebp - 8], 0x40000000
push 0x100680fc
push 1
lea edx, [ebp - 0x2d8]
push edx
lea ecx, [ebp - 0x18]
call fcn.1002ef20
push eax
lea eax, [ebp - 0x2d0]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10041927
or dword [ebp - 8], 0x80000000
or dword [ebp - 0x1c], 1
push 0x10068100
push 1
lea edx, [ebp - 0x2c8]
push edx
lea ecx, [ebp - 0x18]
call fcn.10048bf0
push eax
lea eax, [ebp - 0x2c0]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x100419ac
or dword [ebp - 0x1c], 2
or dword [ebp - 0x1c], 4
push 0x10068104
push 1
lea edx, [ebp - 0x2b8]
push edx
lea ecx, [ebp - 0x18]
call fcn.1002ef20
push eax
lea eax, [ebp - 0x2b0]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x100419a3
or dword [ebp - 0x1c], 8
or dword [ebp - 0x1c], 0x10
push 0x10068108
push 1
lea edx, [ebp - 0x2a8]
push edx
lea ecx, [ebp - 0x18]
call fcn.10048bf0
push eax
lea eax, [ebp - 0x2a0]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x100419ac
mov dword [ebp - 0x60], 0
jmp 0x100419b3
mov dword [ebp - 0x60], 1
mov dl, byte [ebp - 0x60]
mov byte [ebp - 0x35], dl
mov eax, dword [ebp - 0x1c]
and eax, 0x10
je 0x100419df
and dword [ebp - 0x1c], 0xffffffef
mov ecx, dword [ebp - 0x2a0]
sub ecx, 0x10
mov dword [ebp - 0x2a4], ecx
mov ecx, dword [ebp - 0x2a4]
call fcn.10003260
mov edx, dword [ebp - 0x1c]
and edx, 8
je 0x10041a05
and dword [ebp - 0x1c], 0xfffffff7
mov eax, dword [ebp - 0x2a8]
sub eax, 0x10
mov dword [ebp - 0x2ac], eax
mov ecx, dword [ebp - 0x2ac]
call fcn.10003260
mov ecx, dword [ebp - 0x1c]
and ecx, 4
je 0x10041a2b
and dword [ebp - 0x1c], 0xfffffffb
mov edx, dword [ebp - 0x2b0]
sub edx, 0x10
mov dword [ebp - 0x2b4], edx
mov ecx, dword [ebp - 0x2b4]
call fcn.10003260
mov eax, dword [ebp - 0x1c]
and eax, 2
je 0x10041a51
and dword [ebp - 0x1c], 0xfffffffd
mov ecx, dword [ebp - 0x2b8]
sub ecx, 0x10
mov dword [ebp - 0x2bc], ecx
mov ecx, dword [ebp - 0x2bc]
call fcn.10003260
mov edx, dword [ebp - 0x1c]
and edx, 1
je 0x10041a77
and dword [ebp - 0x1c], 0xfffffffe
mov eax, dword [ebp - 0x2c0]
sub eax, 0x10
mov dword [ebp - 0x2c4], eax
mov ecx, dword [ebp - 0x2c4]
call fcn.10003260
mov ecx, dword [ebp - 8]
and ecx, 0x80000000
je 0x10041aa3
and dword [ebp - 8], 0x7fffffff
mov edx, dword [ebp - 0x2c8]
sub edx, 0x10
mov dword [ebp - 0x2cc], edx
mov ecx, dword [ebp - 0x2cc]
call fcn.10003260
mov eax, dword [ebp - 8]
and eax, 0x40000000
je 0x10041ace
and dword [ebp - 8], 0xbfffffff
mov ecx, dword [ebp - 0x2d0]
sub ecx, 0x10
mov dword [ebp - 0x2d4], ecx
mov ecx, dword [ebp - 0x2d4]
call fcn.10003260
mov edx, dword [ebp - 8]
and edx, 0x20000000
je 0x10041afa
and dword [ebp - 8], 0xdfffffff
mov eax, dword [ebp - 0x2d8]
sub eax, 0x10
mov dword [ebp - 0x2dc], eax
mov ecx, dword [ebp - 0x2dc]
call fcn.10003260
mov ecx, dword [ebp - 8]
and ecx, 0x10000000
je 0x10041b26
and dword [ebp - 8], 0xefffffff
mov edx, dword [ebp - 0x2e0]
sub edx, 0x10
mov dword [ebp - 0x2e4], edx
mov ecx, dword [ebp - 0x2e4]
call fcn.10003260
mov eax, dword [ebp - 8]
and eax, 0x8000000
je 0x10041b51
and dword [ebp - 8], 0xf7ffffff
mov ecx, dword [ebp - 0x2e8]
sub ecx, 0x10
mov dword [ebp - 0x2ec], ecx
mov ecx, dword [ebp - 0x2ec]
call fcn.10003260
mov edx, dword [ebp - 8]
and edx, 0x4000000
je 0x10041b7d
and dword [ebp - 8], 0xfbffffff
mov eax, dword [ebp - 0x2f0]
sub eax, 0x10
mov dword [ebp - 0x2f4], eax
mov ecx, dword [ebp - 0x2f4]
call fcn.10003260
mov ecx, dword [ebp - 8]
and ecx, 0x2000000
je 0x10041ba9
and dword [ebp - 8], 0xfdffffff
mov edx, dword [ebp - 0x2f8]
sub edx, 0x10
mov dword [ebp - 0x2fc], edx
mov ecx, dword [ebp - 0x2fc]
call fcn.10003260
mov eax, dword [ebp - 8]
and eax, 0x1000000
je 0x10041bd4
and dword [ebp - 8], 0xfeffffff
mov ecx, dword [ebp - 0x300]
sub ecx, 0x10
mov dword [ebp - 0x304], ecx
mov ecx, dword [ebp - 0x304]
call fcn.10003260
mov edx, dword [ebp - 8]
and edx, 0x800000
je 0x10041c00
and dword [ebp - 8], 0xff7fffff
mov eax, dword [ebp - 0x308]
sub eax, 0x10
mov dword [ebp - 0x30c], eax
mov ecx, dword [ebp - 0x30c]
call fcn.10003260
mov ecx, dword [ebp - 8]
and ecx, 0x400000
je 0x10041c2c
and dword [ebp - 8], 0xffbfffff
mov edx, dword [ebp - 0x310]
sub edx, 0x10
mov dword [ebp - 0x314], edx
mov ecx, dword [ebp - 0x314]
call fcn.10003260
mov eax, dword [ebp - 8]
and eax, 0x200000
je 0x10041c57
and dword [ebp - 8], 0xffdfffff
mov ecx, dword [ebp - 0x318]
sub ecx, 0x10
mov dword [ebp - 0x31c], ecx
mov ecx, dword [ebp - 0x31c]
call fcn.10003260
movzx edx, byte [ebp - 0x35]
test edx, edx
je 0x10041c8d
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax + 4]
test ecx, ecx
je 0x10041c87
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
cmp eax, dword [edx]
jge 0x10041c7c
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
jmp 0x10041c85
mov edx, dword [ebp - 0x20]
sub edx, 1
mov dword [ebp - 0x14], edx
jmp 0x10041c8d
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
jmp 0x10041f88
cmp dword [ebp - 0x24], 1
jle 0x10041df9
or dword [ebp - 0x1c], 0x20
or dword [ebp - 0x1c], 0x40
push 0x1006810c
push 1
mov ecx, dword [ebp - 0x24]
push ecx
lea edx, [ebp - 0x338]
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
push eax
lea eax, [ebp - 0x330]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x10041d38
or dword [ebp - 0x1c], 0x80
or dword [ebp - 0x1c], 0x100
push 0x10068110
push 1
mov edx, dword [ebp - 0x24]
sub edx, 1
push edx
lea eax, [ebp - 0x328]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
push eax
lea ecx, [ebp - 0x320]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.10048aa0
add esp, 8
movzx edx, al
test edx, edx
je 0x10041d38
mov dword [ebp - 0x64], 1
jmp 0x10041d3f
mov dword [ebp - 0x64], 0
mov al, byte [ebp - 0x64]
mov byte [ebp - 0x36], al
mov ecx, dword [ebp - 0x1c]
and ecx, 0x100
je 0x10041d71
and dword [ebp - 0x1c], 0xfffffeff
mov edx, dword [ebp - 0x320]
sub edx, 0x10
mov dword [ebp - 0x324], edx
mov ecx, dword [ebp - 0x324]
call fcn.10003260
mov eax, dword [ebp - 0x1c]
and eax, 0x80
je 0x10041d9c
and dword [ebp - 0x1c], 0xffffff7f
mov ecx, dword [ebp - 0x328]
sub ecx, 0x10
mov dword [ebp - 0x32c], ecx
mov ecx, dword [ebp - 0x32c]
call fcn.10003260
mov edx, dword [ebp - 0x1c]
and edx, 0x40
je 0x10041dc2
and dword [ebp - 0x1c], 0xffffffbf
mov eax, dword [ebp - 0x330]
sub eax, 0x10
mov dword [ebp - 0x334], eax
mov ecx, dword [ebp - 0x334]
call fcn.10003260
mov ecx, dword [ebp - 0x1c]
and ecx, 0x20
je 0x10041de8
and dword [ebp - 0x1c], 0xffffffdf
mov edx, dword [ebp - 0x338]
sub edx, 0x10
mov dword [ebp - 0x33c], edx
mov ecx, dword [ebp - 0x33c]
call fcn.10003260
movzx eax, byte [ebp - 0x36]
test eax, eax
je 0x10041df9
mov ecx, dword [ebp - 0x20]
sub ecx, 1
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0xd], 0
mov edx, dword [ebp - 0x18]
mov eax, dword [edx - 0xc]
mov dword [ebp - 0x28], eax
jmp 0x10041e11
mov ecx, dword [ebp - 0x28]
sub ecx, 1
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 1
jl 0x10041e44
push ecx
mov edx, esp
push 1
mov eax, dword [ebp - 0x28]
sub eax, 1
push eax
push edx
lea ecx, [ebp - 0x18]
call fcn.1002efb0
mov ecx, dword [ebp - 0xc]
call fcn.10036eb0
movzx ecx, al
cmp ecx, 4
jne 0x10041e42
mov byte [ebp - 0xd], 1
jmp 0x10041e44
jmp 0x10041e08
movzx edx, byte [ebp - 0xd]
test edx, edx
jne 0x10041e99
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x28], ecx
jmp 0x10041e64
mov edx, dword [ebp - 0x28]
sub edx, 1
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 1
jl 0x10041e97
push ecx
mov eax, esp
push 1
mov ecx, dword [ebp - 0x28]
sub ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.1002efb0
mov ecx, dword [ebp - 0xc]
call fcn.10036eb0
movzx edx, al
cmp edx, 3
jne 0x10041e95
mov byte [ebp - 0xd], 1
jmp 0x10041e97
jmp 0x10041e5b
jmp 0x10041ec4
cmp dword [ebp - 0x28], 3
jne 0x10041ea7
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
jmp 0x10041ec4
cmp dword [ebp - 0x28], 2
jne 0x10041eb8
mov ecx, dword [ebp - 0x20]
sub ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x10041ec4
cmp dword [ebp - 0x28], 1
jne 0x10041ec4
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x14], edx
movzx eax, byte [ebp - 0xd]
test eax, eax
jne 0x10041f19
mov byte [ebp - 0xd], 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx - 0xc]
mov dword [ebp - 0x28], edx
jmp 0x10041ee4
mov eax, dword [ebp - 0x28]
sub eax, 1
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jl 0x10041f17
push ecx
mov ecx, esp
push 1
mov edx, dword [ebp - 0x28]
sub edx, 1
push edx
push ecx
lea ecx, [ebp - 0x18]
call fcn.1002efb0
mov ecx, dword [ebp - 0xc]
call fcn.10036eb0
movzx eax, al
cmp eax, 2
jne 0x10041f15
mov byte [ebp - 0xd], 1
jmp 0x10041f17
jmp 0x10041edb
jmp 0x10041f47
cmp dword [ebp - 0x28], 3
jne 0x10041f27
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
jmp 0x10041f47
cmp dword [ebp - 0x28], 2
jne 0x10041f38
mov edx, dword [ebp - 0x20]
sub edx, 1
mov dword [ebp - 0x14], edx
jmp 0x10041f47
cmp dword [ebp - 0x28], 1
jne 0x10041f47
mov eax, dword [ebp - 0x20]
sub eax, 2
mov dword [ebp - 0x14], eax
movzx ecx, byte [ebp - 0xd]
test ecx, ecx
jne 0x10041f5a
mov edx, dword [ebp - 0x20]
sub edx, 1
mov dword [ebp - 0x14], edx
jmp 0x10041f88
cmp dword [ebp - 0x28], 3
jne 0x10041f68
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
jmp 0x10041f88
cmp dword [ebp - 0x28], 2
jne 0x10041f79
mov ecx, dword [ebp - 0x20]
sub ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x10041f88
cmp dword [ebp - 0x28], 1
jne 0x10041f88
mov edx, dword [ebp - 0x20]
sub edx, 2
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x14]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x14]
sub edx, 1
push edx
lea eax, [ebp - 0x348]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
mov dword [ebp - 0x340], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x2c
mov dword [ebp - 0x344], ecx
mov edx, dword [ebp - 0x340]
push edx
mov ecx, dword [ebp - 0x344]
call fcn.10030240
mov eax, dword [ebp - 0x348]
sub eax, 0x10
mov dword [ebp - 0x34c], eax
mov ecx, dword [ebp - 0x34c]
call fcn.10003260
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x2c]
mov eax, dword [edx - 0xc]
mov dword [ebp - 0x350], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x350]
mov dword [ecx + 0x30], edx
call fcn.10003470
push eax
lea ecx, [ebp - 0x2c]
call fcn.100302f0
push ecx
mov eax, esp
push 1
mov ecx, dword [ebp - 0x14]
sub ecx, 1
push ecx
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
lea edx, [ebp - 0x358]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.100376b0
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x354]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10030240
mov ecx, dword [ebp - 0x358]
sub ecx, 0x10
mov dword [ebp - 0x35c], ecx
mov ecx, dword [ebp - 0x35c]
call fcn.10003260
push ecx
mov edx, esp
push 1
mov eax, dword [ebp - 0x14]
sub eax, 1
push eax
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
mov ecx, dword [ebp - 0xc]
call fcn.10036eb0
movzx ecx, al
cmp ecx, 1
jne 0x1004214c
push 1
push ecx
mov esi, esp
push ecx
mov edi, esp
lea edx, [ebp + 8]
push edx
push 1
mov eax, dword [ebp - 0x14]
sub eax, 1
push eax
lea ecx, [ebp - 0x360]
push ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
push eax
push edi
call fcn.1002edd0
add esp, 0xc
push esi
mov ecx, dword [ebp - 0xc]
call fcn.100370b0
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0xc]
add eax, 0x34
push eax
mov ecx, dword [ebp - 0xc]
call fcn.10031d90
lea ecx, [ebp - 0x360]
call fcn.1002f760
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x14]
add edx, 1
push edx
mov eax, dword [ebp - 0x14]
sub eax, 1
push eax
lea ecx, [ebp - 0x364]
push ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x2c
call fcn.1002f740
lea ecx, [ebp - 0x364]
call fcn.1002f760
lea ecx, [ebp - 0x2c]
call fcn.1002f760
lea ecx, [ebp - 0x18]
call fcn.1002f760
lea ecx, [ebp + 8]
call fcn.1002f760
jmp 0x10042601
push ecx
mov edx, esp
push 1
mov eax, dword [ebp - 0x14]
sub eax, 1
push eax
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
mov ecx, dword [ebp - 0xc]
call fcn.10036eb0
movzx ecx, al
cmp ecx, 2
jne 0x1004220b
push 1
push ecx
mov esi, esp
push ecx
mov edx, esp
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push edx
call fcn.1002edd0
add esp, 0xc
push esi
mov ecx, dword [ebp - 0xc]
call fcn.100370b0
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0xc]
add eax, 0x34
push eax
mov ecx, dword [ebp - 0xc]
call fcn.10031d90
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x14]
add edx, 1
push edx
mov eax, dword [ebp - 0x14]
sub eax, 1
push eax
lea ecx, [ebp - 0x368]
push ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x2c
call fcn.1002f740
lea ecx, [ebp - 0x368]
call fcn.1002f760
lea ecx, [ebp - 0x2c]
call fcn.1002f760
lea ecx, [ebp - 0x18]
call fcn.1002f760
lea ecx, [ebp + 8]
call fcn.1002f760
jmp 0x10042601
push ecx
mov edx, esp
push 1
mov eax, dword [ebp - 0x14]
sub eax, 1
push eax
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
mov ecx, dword [ebp - 0xc]
call fcn.10036eb0
movzx ecx, al
cmp ecx, 3
jne 0x100423f8
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x374]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
push 1
lea ecx, [ebp - 0x370]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.10048bf0
push eax
lea edx, [ebp - 0x36c]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.1002ec30
add esp, 8
mov byte [ebp - 0x37], al
lea ecx, [ebp - 0x36c]
call fcn.1002f760
lea ecx, [ebp - 0x370]
call fcn.1002f760
lea ecx, [ebp - 0x374]
call fcn.1002f760
movzx eax, byte [ebp - 0x37]
test eax, eax
je 0x1004234c
push 1
push ecx
mov ecx, esp
push 1
push ecx
lea ecx, [ebp - 0x2c]
call fcn.1002ef20
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0xc]
add eax, 0x34
push eax
mov ecx, dword [ebp - 0xc]
call fcn.10031d90
push ecx
mov ecx, esp
lea edx, [ebp + 8]
push edx
call fcn.1002fb10
mov ecx, dword [ebp - 0xc]
call fcn.10033510
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1a], 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x14]
add edx, 1
push edx
mov eax, dword [ebp - 0x14]
sub eax, 1
push eax
lea ecx, [ebp - 0x378]
push ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x2c
call fcn.1002f740
lea ecx, [ebp - 0x378]
call fcn.1002f760
lea ecx, [ebp - 0x2c]
call fcn.1002f760
lea ecx, [ebp - 0x18]
call fcn.1002f760
lea ecx, [ebp + 8]
call fcn.1002f760
jmp 0x10042601
push 1
push ecx
mov esi, esp
push ecx
mov edi, esp
lea edx, [ebp + 8]
push edx
push 1
lea eax, [ebp - 0x37c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.1002ef20
push eax
push edi
call fcn.1002edd0
add esp, 0xc
push esi
mov ecx, dword [ebp - 0xc]
call fcn.100370b0
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xc]
add edx, 0x34
push edx
mov ecx, dword [ebp - 0xc]
call fcn.10031d90
lea ecx, [ebp - 0x37c]
call fcn.1002f760
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
sub ecx, dword [ebp - 0x14]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x14]
sub edx, 1
push edx
lea eax, [ebp - 0x380]
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x2c
call fcn.1002f740
lea ecx, [ebp - 0x380]
call fcn.1002f760
lea ecx, [ebp - 0x2c]
call fcn.1002f760
lea ecx, [ebp - 0x18]
call fcn.1002f760
lea ecx, [ebp + 8]
call fcn.1002f760
jmp 0x10042601
push ecx
mov ecx, esp
push 1
mov edx, dword [ebp - 0x14]
sub edx, 1
push edx
push ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
mov ecx, dword [ebp - 0xc]
call fcn.10036eb0
movzx eax, al
cmp eax, 4
jne 0x100425e9
lea ecx, [ebp + 8]
push ecx
lea edx, [ebp - 0x38c]
push edx
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
push 1
lea eax, [ebp - 0x388]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10048bf0
push eax
lea ecx, [ebp - 0x384]
push ecx
mov ecx, dword [ebp - 0xc]
call fcn.100475d0
push eax
call fcn.1002ec30
add esp, 8
mov byte [ebp - 0x38], al
lea ecx, [ebp - 0x384]
call fcn.1002f760
lea ecx, [ebp - 0x388]
call fcn.1002f760
lea ecx, [ebp - 0x38c]
call fcn.1002f760
movzx edx, byte [ebp - 0x38]
test edx, edx
je 0x10042545
push 1
push ecx
mov esi, esp
push ecx
mov eax, esp
push 2
push eax
lea ecx, [ebp - 0x2c]
call fcn.1002ef20
push esi
mov ecx, dword [ebp - 0xc]
call fcn.100370b0
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xc]
add edx, 0x34
push edx
mov ecx, dword [ebp - 0xc]
call fcn.10031d90
push ecx
mov ecx, esp
lea eax, [ebp + 8]
push eax
call fcn.1002fb10
mov ecx, dword [ebp - 0xc]
call fcn.10033510
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
mov dword [ecx + 0x1c], eax
mov ecx, dword [ebp - 0xc]
mov byte [ecx + 0x1a], 1
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
sub eax, dword [ebp - 0x14]
add eax, 1
push eax
mov ecx, dword [ebp - 0x14]
sub ecx, 1
push ecx
lea edx, [ebp - 0x390]
push edx
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x2c
call fcn.1002f740
lea ecx, [ebp - 0x390]
call fcn.1002f760
lea ecx, [ebp - 0x2c]
call fcn.1002f760
lea ecx, [ebp - 0x18]
call fcn.1002f760
lea ecx, [ebp + 8]
call fcn.1002f760
jmp 0x10042601
push 1
push ecx
mov esi, esp
push ecx
mov edi, esp
lea eax, [ebp + 8]
push eax
push 2
lea ecx, [ebp - 0x394]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.1002ef20
push eax
push edi
call fcn.1002edd0
add esp, 0xc
push esi
mov ecx, dword [ebp - 0xc]
call fcn.100370b0
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0xc]
add eax, 0x34
push eax
mov ecx, dword [ebp - 0xc]
call fcn.10031d90
lea ecx, [ebp - 0x394]
call fcn.1002f760
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
sub edx, dword [ebp - 0x14]
add edx, 1
push edx
mov eax, dword [ebp - 0x14]
sub eax, 1
push eax
lea ecx, [ebp - 0x398]
push ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x34
call fcn.1002efb0
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x2c
call fcn.1002f740
lea ecx, [ebp - 0x398]
call fcn.1002f760
lea ecx, [ebp - 0x2c]
call fcn.1002f760
lea ecx, [ebp - 0x18]
call fcn.1002f760
lea ecx, [ebp + 8]
call fcn.1002f760
jmp 0x10042601
lea ecx, [ebp - 0x2c]
call fcn.1002f760
lea ecx, [ebp - 0x18]
call fcn.1002f760
lea ecx, [ebp + 8]
call fcn.1002f760
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4