Function at 0x10003630
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [section..vmxle]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push dword [0x1001af2c]
mov ebx, ecx
mov dword [ebp - 0x2c], 0
push dword [0x1001b2ec]
mov dword [ebp - 0x24], ebx
push ebx
push 0x157
push 0x1ff
push 0
push 0
push 0x54010040
push 0x10015ee3
push 0x10016bfc
push 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x4c], 0xb
mov dword [ebp - 0x38], 0xffffffff
call dword [sym.imp.User32.DlL_CreateWindowExA]
mov edi, dword [sym.imp.User32.DlL_SendMessageA]
push 1
push dword [0x1001b2bc]
mov dword [0x1001ae74], eax
push 0x30
push eax
call edi
xor ebx, ebx
lea esi, [ebx + 0x138a]
lea eax, [esi - 0x1389]
push eax
lea eax, [ebp - 0xc]
push 0x10016c0c
push eax
call fcn.100057a0
add esp, 0xc
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x4c]
push eax
push ebx
push 0x1307
push dword [0x1001ae74]
call edi
inc ebx
cmp ebx, 5
jl 0x100036b2
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x40], 0x10016d14
push eax
push 5
push 0x1307
push dword [0x1001ae74]
mov dword [ebp - 0x34], 0x138f
call edi
mov ebx, dword [ebp - 0x24]
push 0
push dword [0x1001af2c]
mov esi, dword [sym.imp.User32.DlL_CreateWindowExA]
push dword [0x1001b290]
push ebx
push 0x10
push 0x43
push 0x12
push 0xde
push 0x50000300
push 0x10016d70
push 0x10016d80
push 0
call esi
push 0
push dword [0x1001af2c]
mov dword [0x1001af00], eax
push dword [0x1001b294]
push ebx
push 0x10
push 0x4a
push 0x18
push 0x47
push 0x50000300
push 0x10016d88
push 0x10016d98
push 0
call esi
push 0
push dword [0x1001af2c]
mov dword [0x1001af04], eax
push dword [0x1001b298]
push ebx
push 0x10
push 0x4a
push 0x18
push 0x159
push 0x50000300
push 0x10016da0
push 0x10016db0
push 0
call esi
push 0
push dword [0x1001af2c]
mov dword [0x1001af08], eax
push dword [0x1001b29c]
push ebx
push 0x10
push 0x52
push 0xd7
push 0xe1
push 0x50000300
push 0x10016db8
push 0x10016dc8
push 0
call esi
push 0
push dword [0x1001af2c]
mov dword [0x1001af0c], eax
push dword [0x1001b2a0]
push ebx
push 0x10
push 0x4a
push 0xdd
push 0x47
push 0x50000300
push 0x10016dd0
push 0x10016de0
push 0
call esi
mov dword [0x1001af10], eax
push 0
push dword [0x1001af2c]
push dword [0x1001b2a4]
push ebx
push 0x10
push 0x4a
push 0xdd
push 0x159
push 0x50000300
push 0x10016de8
push 0x10016df8
push 0
call esi
mov edi, dword [sym.imp.User32.DlL_SetWindowLongA]
mov dword [0x1001af14], eax
mov eax, 0x1001bc14
mov dword [ebp - 0x10], 0x138a
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 8], 5
jmp 0x10003880
push 0
push dword [0x1001af2c]
push dword [eax - 0x14]
push ebx
push 0xc
push 0xc
push 0x19
push 0x14b
push 0x50010003
push 0x10015f13
push 0x10016e00
push 0
call esi
mov ecx, dword [ebp - 0x20]
push 1
push dword [0x1001b2bc]
push 0x30
push eax
mov dword [ecx + 0x1001bbd0], eax
call dword [sym.imp.User32.DlL_SendMessageA]
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
push 0xffffffffffffffeb
push dword [eax + 0x1001bbd0]
call edi
mov eax, dword [ebp - 0x1c]
push 0
push dword [0x1001af2c]
push dword [eax]
push ebx
push 0x19
push 0x72
push 0xa3
push 0xa
push 0x50012f00
push 0x10016e08
push 0x10016e14
push 0
call esi
mov ecx, dword [ebp - 0x18]
push 1
push dword [0x1001b2bc]
push 0x30
push eax
mov dword [ecx + 0x1001bd40], eax
call dword [sym.imp.User32.DlL_SendMessageA]
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
push 0xffffffffffffffeb
push dword [eax + 0x1001bd40]
call edi
mov eax, dword [ebp - 0x1c]
push 0
push dword [0x1001af2c]
push dword [eax + 0x14]
push ebx
push 0x19
push 0x71
push 0xa3
push 0x7f
push 0x50012f00
push 0x10016e1c
push 0x10016e2c
push 0
call esi
mov ecx, dword [ebp - 0x18]
push 1
push dword [0x1001b2bc]
push 0x30
push eax
mov dword [ecx + 0x1001ae80], eax
call dword [sym.imp.User32.DlL_SendMessageA]
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
push 0xffffffffffffffeb
push dword [eax + 0x1001ae80]
call edi
mov eax, dword [ebp - 0x1c]
push 0
push dword [0x1001af2c]
push dword [eax + 0x28]
push ebx
push 0x19
push 0x72
push 0xa3
push 0xff
push 0x50012f00
push 0x10016e34
push 0x10016e40
push 0
call esi
mov ecx, dword [ebp - 0x18]
push 1
push dword [0x1001b2bc]
push 0x30
push eax
mov dword [ecx + 0x1001bd44], eax
call dword [sym.imp.User32.DlL_SendMessageA]
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
push 0xffffffffffffffeb
push dword [eax + 0x1001bd44]
call edi
mov eax, dword [ebp - 0x1c]
push 0
push dword [0x1001af2c]
push dword [eax + 0x3c]
push ebx
push 0x19
push 0x71
push 0xa3
push 0x176
push 0x50012f00
push 0x10016e48
push 0x10016e58
push 0
call esi
mov ecx, dword [ebp - 0x18]
push 1
push dword [0x1001b2bc]
push 0x30
push eax
mov dword [ecx + 0x1001ae84], eax
call dword [sym.imp.User32.DlL_SendMessageA]
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
push 0xffffffffffffffeb
push dword [eax + 0x1001ae84]
call edi
mov eax, dword [ebp - 0x1c]
push 0
push dword [0x1001af2c]
push dword [eax + 0x50]
push ebx
push 0x19
push 0xe8
push 0xbf
push 0xa
push 0x50012f00
push 0x10016e60
push 0x10016e68
push 0
call esi
mov ecx, dword [ebp - 0x20]
push 1
push dword [0x1001b2bc]
push 0x30
push eax
mov dword [ecx + 0x1001b410], eax
call dword [sym.imp.User32.DlL_SendMessageA]
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
push 0xffffffffffffffeb
push dword [eax + 0x1001b410]
call edi
mov eax, dword [ebp - 0x1c]
push 0
push dword [0x1001af2c]
push dword [eax + 0x64]
push ebx
push 0x19
push 0xe8
push 0xbf
push 0xff
push 0x50012f00
push 0x10016e70
push 0x10016e78
push 0
call esi
mov ebx, dword [ebp - 0x20]
push 1
push dword [0x1001b2bc]
push 0x30
push eax
mov dword [ebx + 0x1001b2c0], eax
call dword [sym.imp.User32.DlL_SendMessageA]
push dword [ebp - 0x10]
push 0xffffffffffffffeb
push dword [ebx + 0x1001b2c0]
call edi
mov esi, dword [ebp - 0x28]
xor eax, eax
mov dword [ebp - 0x30], eax
lea ebx, [eax + 0x28]
push 0
push dword [0x1001af2c]
cmp eax, 5
jge 0x10003c4a
mov eax, dword [ebp - 0x2c]
push dword [eax*4 + 0x1001b2f0]
push dword [ebp - 0x24]
push 0x13
push 0xb4
push ebx
push 0xa
push 0x50210203
push 0x10015f45
push 0x10016e80
push 0
call dword [sym.imp.User32.DlL_CreateWindowExA]
push dword [ebp - 0x10]
mov dword [esi + 0x1001b440], eax
push 0xffffffffffffffeb
push eax
call edi
mov eax, dword [ebp - 0x2c]
push 0
push dword [0x1001af2c]
push dword [eax*4 + 0x1001b6a0]
push dword [ebp - 0x24]
push 0x13
push 0x2d
push ebx
push 0xc3
push 0x50012080
push 0x10015f46
push 0x10016e8c
push 0x200
call dword [sym.imp.User32.DlL_CreateWindowExA]
push 1
push dword [0x1001b2bc]
mov dword [esi + 0x1001b170], eax
push 0x30
push eax
call dword [sym.imp.User32.DlL_SendMessageA]
push dword [ebp - 0x10]
push 0xffffffffffffffeb
push dword [esi + 0x1001b170]
call edi
mov eax, dword [ebp - 0x2c]
push 0
push dword [0x1001af2c]
push dword [eax*4 + 0x1001b354]
push dword [ebp - 0x24]
push 0x13
push 0xb4
push ebx
push 0xff
push 0x50210203
push 0x10015f47
push 0x10016e94
push 0
call dword [sym.imp.User32.DlL_CreateWindowExA]
push dword [ebp - 0x10]
mov dword [esi + 0x1001b45c], eax
push 0xffffffffffffffeb
push eax
call edi
mov eax, dword [ebp - 0x2c]
push 0
push dword [0x1001af2c]
push dword [eax*4 + 0x1001b704]
push dword [ebp - 0x24]
push 0x13
push 0x2d
push ebx
push 0x1ba
push 0x50012080
push 0x10015f65
push 0x10016ea0
push 0x200
call dword [sym.imp.User32.DlL_CreateWindowExA]
push 1
push dword [0x1001b2bc]
mov dword [esi + 0x1001b18c], eax
push 0x30
push eax
call dword [sym.imp.User32.DlL_SendMessageA]
push dword [ebp - 0x10]
push 0xffffffffffffffeb
push dword [esi + 0x1001b18c]
call edi
inc dword [ebp - 0x2c]
jmp 0x10003d9f
mov eax, dword [ebp - 0x14]
lea edi, [ebx + 0x48]
push dword [eax*4 + 0x1001b3b8]
push dword [ebp - 0x24]
push 0x13
push 0xb4
push edi
push 0xa
push 0x50210203
push 0x10015f66
push 0x10016ea8
push 0
call dword [sym.imp.User32.DlL_CreateWindowExA]
push dword [ebp - 0x10]
mov dword [esi + 0x1001b440], eax
push 0xffffffffffffffeb
push eax
call dword [sym.imp.User32.DlL_SetWindowLongA]
mov eax, dword [ebp - 0x14]
push 0
push dword [0x1001af2c]
push dword [eax*4 + 0x1001b768]
push dword [ebp - 0x24]
push 0x13
push 0x2d
push edi
push 0xc3
push 0x50012080
push 0x10015f67
push 0x10016eb4
push 0x200
call dword [sym.imp.User32.DlL_CreateWindowExA]
push 1
push dword [0x1001b2bc]
mov dword [esi + 0x1001b170], eax
push 0x30
push eax
call dword [sym.imp.User32.DlL_SendMessageA]
push dword [ebp - 0x10]
push 0xffffffffffffffeb
push dword [esi + 0x1001b170]
call dword [sym.imp.User32.DlL_SetWindowLongA]
mov eax, dword [ebp - 0x14]
push 0
push dword [0x1001af2c]
push dword [eax*4 + 0x1001b3e0]
push dword [ebp - 0x24]
push 0x13
push 0xb4
push edi
push 0xff
push 0x50210203
push 0x10015f6b
push 0x10016ebc
push 0
call dword [sym.imp.User32.DlL_CreateWindowExA]
push dword [ebp - 0x10]
mov dword [esi + 0x1001b45c], eax
push 0xffffffffffffffeb
push eax
call dword [sym.imp.User32.DlL_SetWindowLongA]
mov eax, dword [ebp - 0x14]
push 0
push dword [0x1001af2c]
push dword [eax*4 + 0x1001b790]
push dword [ebp - 0x24]
push 0x13
push 0x2d
push edi
push 0x1ba
push 0x50012080
push 0x10015f6f
push 0x10016ec8
push 0x200
call dword [sym.imp.User32.DlL_CreateWindowExA]
push 1
push dword [0x1001b2bc]
mov dword [esi + 0x1001b18c], eax
push 0x30
push eax
call dword [sym.imp.User32.DlL_SendMessageA]
push dword [ebp - 0x10]
mov edi, dword [sym.imp.User32.DlL_SetWindowLongA]
push 0xffffffffffffffeb
push dword [esi + 0x1001b18c]
call edi
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
add ebx, 0x19
inc eax
add esi, 4
mov dword [ebp - 0x30], eax
cmp ebx, 0xd7
jl 0x10003af4
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x24]
push 0
push dword [0x1001af2c]
mov esi, dword [sym.imp.User32.DlL_CreateWindowExA]
push dword [eax + 0x78]
push ebx
push 0xc
push 0xc
push 0xde
push 0x14b
push 0x50010003
push 0x10015f9f
push 0x10016ed0
push 0
call esi
mov ecx, dword [ebp - 0x20]
push 1
push dword [0x1001b2bc]
push 0x30
push eax
mov dword [ecx + 0x1001bbd4], eax
call dword [sym.imp.User32.DlL_SendMessageA]
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
push 0xffffffffffffffeb
push dword [eax + 0x1001bbd4]
call edi
mov eax, dword [ebp - 0x1c]
push 0
push dword [0x1001af2c]
push dword [eax + 0x8c]
push ebx
push 0x19
push 0x72
push 0x11a
push 0xa
push 0x50012f00
push 0x10016ed8
push 0x10016ee4
push 0
call esi
mov ecx, dword [ebp - 0x18]
push 1
push dword [0x1001b2bc]
push 0x30
push eax
mov dword [ecx + 0x1001bd48], eax
call dword [sym.imp.User32.DlL_SendMessageA]
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
push 0xffffffffffffffeb
push dword [eax + 0x1001bd48]
call edi
mov eax, dword [ebp - 0x1c]
push 0
push dword [0x1001af2c]
push dword [eax + 0xa0]
push ebx
push 0x19
push 0x71
push 0x11a
push 0x7f
push 0x50012f00
push 0x10016eec
push 0x10016efc
push 0
call esi
mov ecx, dword [ebp - 0x18]
push 1
push dword [0x1001b2bc]
push 0x30
push eax
mov dword [ecx + 0x1001ae88], eax
call dword [sym.imp.User32.DlL_SendMessageA]
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
push 0xffffffffffffffeb
push dword [eax + 0x1001ae88]
call edi
push 0
push dword [0x1001af2c]
mov eax, dword [ebp - 0x1c]
push dword [eax + 0xb4]
push ebx
push 0x19
push 0x72
push 0x11a
push 0xff
push 0x50012f00
push 0x10016f04
push 0x10016f10
push 0
call esi
mov ecx, dword [ebp - 0x18]
push 1
push dword [0x1001b2bc]
push 0x30
push eax
mov dword [ecx + 0x1001bd4c], eax
call dword [sym.imp.User32.DlL_SendMessageA]
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
push 0xffffffffffffffeb
push dword [eax + 0x1001bd4c]
call edi
mov eax, dword [ebp - 0x1c]
push 0
push dword [0x1001af2c]
push dword [eax + 0xc8]
push ebx
push 0x19
push 0x71
push 0x11a
push 0x176
push 0x50012f00
push 0x10016f18
push 0x10016f28
push 0
call esi
mov ecx, dword [ebp - 0x18]
push 1
push dword [0x1001b2bc]
push 0x30
push eax
mov dword [ecx + 0x1001ae8c], eax
call dword [sym.imp.User32.DlL_SendMessageA]
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
push 0xffffffffffffffeb
push dword [eax + 0x1001ae8c]
call edi
mov eax, dword [ebp - 0x1c]
push 0
push dword [0x1001af2c]
push dword [eax + 0xdc]
push ebx
push 0x19
push 0xe8
push 0x138
push 0xa
push 0x50012f00
push 0x10016f30
push 0x10016f38
push 0
call esi
mov ecx, dword [ebp - 0x20]
push 1
push dword [0x1001b2bc]
push 0x30
push eax
mov dword [ecx + 0x1001b414], eax
call dword [sym.imp.User32.DlL_SendMessageA]
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
push 0xffffffffffffffeb
push dword [eax + 0x1001b414]
call edi
mov eax, dword [ebp - 0x1c]
push 0
push dword [0x1001af2c]
push dword [eax + 0xf0]
push ebx
push 0x19
push 0xe8
push 0x138
push 0xff
push 0x50012f00
push 0x10016f40
push 0x10016f48
push 0
call esi
mov ecx, dword [ebp - 0x20]
push 1
push dword [0x1001b2bc]
push 0x30
push eax
mov dword [ecx + 0x1001b2c4], eax
call dword [sym.imp.User32.DlL_SendMessageA]
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
push 0xffffffffffffffeb
push dword [eax + 0x1001b2c4]
call edi
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x28], 0x38
add eax, 4
add dword [ebp - 0x18], 0x10
inc dword [ebp - 0x10]
add dword [ebp - 0x20], 8
dec dword [ebp - 8]
mov dword [ebp - 0x1c], eax
jne 0x10003880
push 0
push dword [0x1001af2c]
push dword [0x1001b2a8]
push ebx
push 0x11
push 0x56
push 0x1a
push 0xa
push 0x50000300
push 0x10016f50
push 0x10016f64
push 0
call esi
push 0
push dword [0x1001af2c]
mov dword [0x1001af18], eax
push dword [0x1001b7b8]
push ebx
push 0x13
push 0x3c
push 0x19
push 0x62
push 0x50012080
push 0x10016f6c
push 0x10016f70
push 0x200
call esi
push 0
push dword [0x1001af2c]
mov dword [0x1001bd30], eax
push dword [0x1001b2ac]
push ebx
push 0x11
push 0xa6
push 0x32
push 0xa
push 0x50000300
push 0x10016f78
push 0x10016f98
push 0
call esi
push 0
push dword [0x1001af2c]
mov dword [0x1001af1c], eax
push dword [0x1001b7bc]
push ebx
push 0x13
push 0x3c
push 0x30
push 0xb2
push 0x50012080
push 0x10016fa0
push 0x10016fa8
push 0x200
call esi
push 0
push dword [0x1001af2c]
mov dword [0x1001bd34], eax
push dword [0x1001bd18]
push ebx
push 0x14
push 0x4b
push 0x30
push 0xf0
push 0x50012f00
push 0x10016fb0
push 0x10016fbc
push 0
call esi
push 0
push dword [0x1001af2c]
mov dword [0x1001bd90], eax
push dword [0x1001b2b0]
push ebx
push 0x11
push 0x91
push 0x4a
push 0x1d
push 0x50000300
push 0x10016fc4
push 0x10016fe0
push 0
call esi
push 0
push dword [0x1001af2c]
mov dword [0x1001af20], eax
push dword [0x1001b7c0]
push ebx
push 0x13
push 0x3c
push 0x48
push 0xb2
push 0x50012080
push 0x10016fe8
push 0x10016ff0
push 0x200
call esi
push 0
push dword [0x1001af2c]
mov dword [0x1001bd38], eax
push dword [0x1001bd1c]
push ebx
push 0x14
push 0x4b
push 0x48
push 0xf0
push 0x50012f00
push 0x10016ff8
push 0x10017004
push 0
call esi
push 0
push dword [0x1001af2c]
mov dword [0x1001bd94], eax
push dword [0x1001bd20]
push ebx
push 0xc
push 0xc
push 0x62
push 0xa
push 0x50010003
push 0x10015fd1
push 0x1001700c
push 0
call esi
push 0
push dword [0x1001af2c]
mov dword [0x1001bd98], eax
push dword [0x1001b2b4]
push ebx
push 0x10
push 0x3a
push 0x61
push 0x19
push 0x50000300
push 0x10017014
push 0x10017020
push 0
call esi
push 0
push dword [0x1001af2c]
mov dword [0x1001af24], eax
push dword [0x1001bd24]
push ebx
push 0xc
push 0xc
push 0x77
push 0xa
push 0x50010003
push 0x10015fd2
push 0x10017028
push 0
call esi
push 0
push dword [0x1001af2c]
mov dword [0x1001bd9c], eax
push dword [0x1001b2b8]
push ebx
push 0x10
push 0x3e
push 0x76
push 0x19
push 0x50000300
push 0x10017030
push 0x1001703c
push 0
call esi
push 0
push dword [0x1001af2c]
mov dword [0x1001af28], eax
push dword [0x1001bd28]
push ebx
push 0x19
push 0xe8
push 0x138
push 0xa
push 0x50012f00
push 0x10017044
push 0x10017050
push 0
call esi
push 0
push dword [0x1001af2c]
mov dword [0x1001bda0], eax
push dword [0x1001bd2c]
push ebx
push 0x19
push 0xe8
push 0x138
push 0xff
push 0x50012f00
push 0x10017058
push 0x10017068
push 0
call esi
mov edi, dword [sym.imp.User32.DlL_ShowWindow]
mov esi, dword [sym.imp.User32.DlL_SendMessageA]
mov dword [0x1001bda4], eax
xor eax, eax
mov dword [ebp - 0x14], eax
push 1
push dword [0x1001b2bc]
push 0x30
push dword [eax*4 + 0x1001af00]
call esi
mov eax, dword [ebp - 0x14]
mov ebx, dword [sym.imp.User32.DlL_SetWindowLongA]
cmp eax, 5
jle 0x10004376
push 0x138f
push 0xffffffffffffffeb
push dword [eax*4 + 0x1001af00]
call ebx
mov eax, dword [ebp - 0x14]
push 0
push dword [eax*4 + 0x1001af00]
call edi
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0xb
jb 0x10004334
xor eax, eax
mov dword [ebp - 0x14], eax
push 1
push dword [0x1001b2bc]
push 0x30
push dword [eax + 0x1001bd90]
call esi
mov eax, dword [ebp - 0x14]
push 0x138f
push 0xffffffffffffffeb
push dword [eax + 0x1001bd90]
call ebx
mov eax, dword [ebp - 0x14]
push 0
push dword [eax + 0x1001bd90]
call edi
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 0x14], eax
cmp eax, 0x18
jb 0x10004384
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x100043d0
push 1
push dword [0x1001b2bc]
push 0x30
push dword [eax + 0x1001bd30]
call esi
mov eax, dword [ebp - 0x14]
push 0x138f
push 0xffffffffffffffeb
push dword [eax + 0x1001bd30]
call ebx
mov eax, dword [ebp - 0x14]
push 0
push dword [eax + 0x1001bd30]
call edi
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 0x14], eax
cmp eax, 0x10
jb 0x100043d0
xor eax, eax
mov dword [ebp - 0x28], eax
test eax, eax
je 0x10004471
mov esi, eax
xor ebx, ebx
shl esi, 4
mov dword [ebp - 8], esi
cmp ebx, 2
jge 0x1000444e
lea esi, [ebx + eax*2]
push 0
push dword [esi*4 + 0x1001bbd0]
call edi
push 0
push dword [esi*4 + 0x1001b410]
call edi
push 0
push dword [esi*4 + 0x1001b2c0]
call edi
mov esi, dword [ebp - 8]
push 0
push dword [esi + 0x1001bd40]
call edi
push 0
push dword [esi + 0x1001ae80]
call edi
mov eax, dword [ebp - 0x28]
inc ebx
add esi, 4
mov dword [ebp - 8], esi
cmp ebx, 4
jl 0x10004422
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 5
jl 0x10004414
call fcn.10001bd0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100057d9
mov esp, ebp
pop ebp
ret