Function at 0x10e8620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11b5979
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x5528
call sub.ntdll.dll__chkstk
push esi
push edi
mov dword [ebp - 0x5214], ecx
push 1
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x24]
call eax
mov dword [ebp - 0x74], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
push edx
mov eax, dword [ecx + 0x10]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x5214]
mov eax, dword [edx + 0x18]
mov ecx, dword [ebp - 0x5214]
mov ecx, dword [ecx + 0x18]
mov edx, dword [eax]
mov eax, dword [edx + 0x24]
call eax
push eax
call fcn.010d05e0
mov dword [ebp - 0xc4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
push edx
mov eax, dword [ecx + 0x18]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call fcn.010d05e0
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc4]
mov edx, dword [eax + 0x68]
call edx
test eax, eax
je 0x10e86fe
push 1
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0xf0]
call eax
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x64]
call eax
test eax, eax
je 0x10e8727
push 1
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0xec]
call eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x5214]
mov ecx, dword [eax + 0x18]
mov edx, dword [ebp - 0x5214]
mov eax, dword [edx + 0x18]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 0x24]
call eax
mov dword [ebp - 0x7c], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x5214]
mov eax, dword [edx + 0x18]
mov ecx, dword [ebp - 0x5214]
mov ecx, dword [ecx + 0x18]
mov edx, dword [eax]
mov eax, dword [edx + 0x24]
call eax
push eax
call fcn.010d0510
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp - 0x5214]
mov eax, dword [edx + 0x18]
mov ecx, dword [ebp - 0x5214]
mov ecx, dword [ecx + 0x18]
mov edx, dword [eax]
mov eax, dword [edx + 0x24]
call eax
push eax
call fcn.010d0510
mov dword [ebp - 0xe0], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call fcn.010d0510
mov dword [ebp - 0xdc], eax
mov edx, dword [ebp - 0xdc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xdc]
mov edx, dword [eax + 0x20]
call edx
mov dword [ebp - 0x78], eax
push 0
mov eax, dword [ebp - 0xdc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xdc]
mov eax, dword [edx + 0x3c]
call eax
test eax, eax
je 0x10e8857
mov ecx, dword [ebp - 0xdc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xdc]
mov eax, dword [edx + 0x40]
call eax
push 8
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x20]
call eax
call fcn.010947d0
mov dword [ebp - 0x5218], eax
push 0x169d
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100c880
mov ecx, dword [ebp - 0x5218]
push ecx
mov edx, dword [ebp - 0x5218]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
call ecx
add esp, 0xc
xor eax, eax
jmp 0x10eddb3
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x2c]
mov dword [ebp - 0xac], eax
mov ecx, dword [ebp - 0xac]
mov edx, dword [ecx + 4]
mov dword [ebp - 0xd4], edx
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0x64], 0
cmp dword [ebp - 0xd4], 0
je 0x10e92a6
call fcn.010cea20
mov eax, dword [ebp - 0xac]
cmp dword [eax + 0xc], 0
je 0x10e89a9
mov dword [ebp - 0xf0], 0
mov ecx, dword [ebp - 0xe0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xe0]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0xf4], eax
jmp 0x10e890b
mov ecx, dword [ebp - 0xe0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xe0]
mov eax, dword [edx + 0x1c]
call eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0
je 0x10e896c
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xf4]
mov eax, dword [edx + 0x3c]
call eax
movzx ecx, al
test ecx, ecx
je 0x10e896a
call fcn.010946d0
mov dword [ebp - 0xf8], eax
mov edx, dword [ebp - 0xf4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xf4]
mov edx, dword [eax + 0x28]
call edx
push eax
mov eax, dword [ebp - 0xf8]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xf8]
mov eax, dword [edx + 0x10]
call eax
mov dword [ebp - 0xf0], 1
jmp 0x10e88f2
cmp dword [ebp - 0xf0], 0
je 0x10e89a9
mov ecx, dword [ebp - 0xe0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xe0]
mov eax, dword [edx + 8]
call eax
push 0
push 0
mov ecx, dword [ebp - 0xe0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xe0]
mov eax, dword [edx + 0x2c]
call eax
push 0x3e8
call fcn.0108fe30
mov ecx, dword [ebp - 0xdc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xdc]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0xe4], eax
jmp 0x10e89dd
mov ecx, dword [ebp - 0xdc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xdc]
mov eax, dword [edx + 0x1c]
call eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
je 0x10e8a17
mov ecx, dword [ebp - 0xe4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xe4]
mov eax, dword [edx + 0x70]
call eax
test eax, eax
je 0x10e8a15
push 0
mov ecx, dword [ebp - 0xe4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xe4]
mov eax, dword [edx + 0xc8]
call eax
jmp 0x10e89c4
lea ecx, [ebp - 0xb8]
push ecx
lea edx, [ebp - 0x64]
push edx
mov eax, dword [ebp - 0x7c]
push eax
mov ecx, dword [ebp - 0x5214]
call fcn.010d80d0
call fcn.0108fc30
push eax
call fcn.0114afc4
add esp, 4
mov ecx, dword [ebp - 0xb8]
mov dword [ebp - 0xd8], ecx
mov edx, dword [ebp - 0xb8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xb8]
mov edx, dword [eax + 0x18]
call edx
mov dword [ebp - 0x521c], eax
mov eax, dword [ebp - 0x521c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x521c]
mov eax, dword [edx + 0x58]
call eax
mov ecx, eax
mov eax, 0x25800000
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], edx
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0xb8]
je 0x10e8ae1
call fcn.010e21b0
test eax, eax
jne 0x10e8ae1
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [edx + 0x34]
call eax
mov dword [ebp - 0x5224], eax
mov dword [ebp - 0x5220], edx
mov ecx, dword [ebp - 0x5220]
cmp ecx, dword [ebp - 0xe8]
jl 0x10e8af6
jg 0x10e8ae1
mov edx, dword [ebp - 0x5224]
cmp edx, dword [ebp - 0xec]
jb 0x10e8af6
mov eax, dword [ebp - 0x78]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x78]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
je 0x10e9239
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], edx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
add eax, dword [ebp - 0xec]
adc edx, dword [ebp - 0xe8]
push edx
push eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x80]
call eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x20]
call eax
sub eax, dword [ebp - 0xec]
sbb edx, dword [ebp - 0xe8]
push edx
push eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x84]
call eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x44]
call eax
sub eax, dword [ebp - 0xec]
sbb edx, dword [ebp - 0xe8]
push edx
push eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0xa8]
call eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x5228], eax
push 0
mov ecx, dword [ebp - 0x5228]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5228]
mov eax, dword [edx + 0x44]
call eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], edx
xor esi, esi
mov edx, dword [ebp - 0x50]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x50]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x16a
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [ebp - 0x1b8], 0
jmp 0x10e8c08
mov eax, dword [ebp - 0x1b8]
add eax, 1
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 8
jae 0x10e8c5e
call fcn.0114afd8
mov dword [ebp - 0x522c], eax
fild dword [ebp - 0x522c]
fdiv qword [0x1009848]
fmul qword [0x1009840]
fadd qword [0x1009838]
fistp qword [ebp - 0x5234]
mov si, word [ebp - 0x5234]
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [ebp - 0x1b8]
mov word [eax + ecx*2 + 0x16a], si
jmp 0x10e8bf9
push 0xa9
push 0
lea edx, [ebp - 0x1b4]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x1b4], eax
mov ecx, dword [ebp - 0x100]
mov dword [ebp - 0x1b0], ecx
mov edx, dword [ebp - 0xec]
sub edx, 1
mov eax, dword [ebp - 0xe8]
sbb eax, 0
mov dword [ebp - 0x1ac], edx
mov dword [ebp - 0x1a8], eax
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x5238], eax
mov ecx, dword [ebp - 0x5238]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5238]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x523c], eax
mov ecx, dword [ebp - 0x523c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x523c]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
je 0x10e8d89
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x5240], eax
mov ecx, dword [ebp - 0x5240]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5240]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x5244], eax
mov ecx, dword [ebp - 0x5244]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5244]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
jne 0x10e8d89
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x5248], eax
mov ecx, dword [ebp - 0x5248]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5248]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x524c], eax
mov ecx, dword [ebp - 0x524c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x524c]
mov eax, dword [edx + 0x2c]
call eax
test eax, eax
jne 0x10e8d89
mov dword [ebp - 0x116], 1
jmp 0x10e8da2
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [edx + 0x24]
call eax
mov dword [ebp - 0x116], eax
mov dword [ebp - 0x19a], 1
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [edx + 0x6c]
call eax
mov dword [ebp - 0x19e], eax
mov dword [ebp - 0x1a2], 1
mov word [ebp - 0x1a4], 0x2a
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5250], eax
mov ecx, dword [ebp - 0x5250]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5250]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
je 0x10e8e3d
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5254], eax
mov ecx, dword [ebp - 0x5254]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5254]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
jne 0x10e8e3d
mov word [ebp - 0x112], 8
jmp 0x10e8e57
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [edx + 0x30]
call eax
mov word [ebp - 0x112], ax
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [edx + 0x108]
call eax
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [edx + 0x3c]
call eax
mov byte [ebp - 0x10c], al
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [edx + 0x2c]
call eax
push eax
lea ecx, [ebp - 0x196]
push ecx
call sub.ntdll.dll_swprintf
add esp, 8
mov edx, dword [ebp - 0xdc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xdc]
mov edx, dword [eax + 0x20]
call edx
push eax
mov eax, dword [ebp - 0xdc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xdc]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0xbc], eax
lea ecx, [ebp - 0xc0]
push ecx
lea edx, [ebp - 0x1b4]
push edx
mov eax, dword [ebp - 0xbc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xbc]
mov eax, dword [edx + 0x24]
call eax
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [edx + 0x34]
call eax
push edx
push eax
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc0]
mov eax, dword [edx + 0x98]
call eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x5258], eax
mov ecx, dword [ebp - 0x5258]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5258]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x525c], eax
mov ecx, dword [ebp - 0x525c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x525c]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
je 0x10e9237
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc0]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x1bc], eax
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x1c0], eax
push 0x17a
push 0
lea ecx, [ebp - 0x344]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov ecx, 0x5e
mov esi, dword [ebp - 0x1bc]
lea edi, [ebp - 0x344]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edx, dword [ebp - 0xb8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xb8]
mov edx, dword [eax + 0x18]
call edx
mov dword [ebp - 0x5260], eax
mov eax, dword [ebp - 0x5260]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x5260]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
je 0x10e906b
mov ecx, dword [ebp - 0x1c0]
mov edx, dword [ecx + 0x15a]
mov dword [ebp - 0x1ea], edx
mov eax, dword [ebp - 0x1c0]
mov cx, word [eax + 0x15e]
mov word [ebp - 0x1e6], cx
mov edx, dword [ebp - 0x1c0]
mov ax, word [edx + 0x160]
mov word [ebp - 0x1e4], ax
mov ecx, dword [ebp - 0x1c0]
mov edx, dword [ecx + 0x162]
mov dword [ebp - 0x1e2], edx
mov eax, dword [ecx + 0x166]
mov dword [ebp - 0x1de], eax
mov ecx, dword [ebp - 0x1c0]
mov edx, dword [ecx + 0xf2]
mov dword [ebp - 0x252], edx
jmp 0x10e9205
mov eax, dword [ebp - 0xb8]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5264], eax
mov ecx, dword [ebp - 0x5264]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5264]
mov eax, dword [edx + 0x2c]
call eax
test eax, eax
jne 0x10e9205
mov byte [ebp - 0x354], 0x28
mov byte [ebp - 0x353], 0x73
mov byte [ebp - 0x352], 0x2a
mov byte [ebp - 0x351], 0xc1
mov byte [ebp - 0x350], 0x1f
mov byte [ebp - 0x34f], 0xf8
mov byte [ebp - 0x34e], 0xd2
mov byte [ebp - 0x34d], 0x11
mov byte [ebp - 0x34c], 0xba
mov byte [ebp - 0x34b], 0x4b
mov byte [ebp - 0x34a], 0
mov byte [ebp - 0x349], 0xa0
mov byte [ebp - 0x348], 0xc9
mov byte [ebp - 0x347], 0x3e
mov byte [ebp - 0x346], 0xc9
mov byte [ebp - 0x345], 0x3b
mov ecx, dword [ebp - 0x354]
mov dword [ebp - 0x1ea], ecx
mov edx, dword [ebp - 0x350]
mov dword [ebp - 0x1e6], edx
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0x1e2], eax
mov ecx, dword [ebp - 0x348]
mov dword [ebp - 0x1de], ecx
mov dword [ebp - 0x252], 1
mov edx, dword [ebp - 0xc0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc0]
mov edx, dword [eax + 0x1c]
call edx
mov dword [ebp - 0x24a], eax
mov dword [ebp - 0x246], edx
mov eax, dword [ebp - 0xc0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc0]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x242], eax
mov dword [ebp - 0x23e], edx
xor ecx, ecx
mov dword [ebp - 0x1da], ecx
mov dword [ebp - 0x1d6], ecx
mov dword [ebp - 0x1d2], ecx
mov dword [ebp - 0x1ce], ecx
mov dword [ebp - 0x358], 0
jmp 0x10e91bc
mov edx, dword [ebp - 0x358]
add edx, 1
mov dword [ebp - 0x358], edx
cmp dword [ebp - 0x358], 8
jae 0x10e9205
call fcn.0114afd8
mov dword [ebp - 0x5268], eax
fild dword [ebp - 0x5268]
fdiv qword [0x1009848]
fmul qword [0x1009840]
fadd qword [0x1009838]
fistp qword [ebp - 0x5270]
mov ax, word [ebp - 0x5270]
mov ecx, dword [ebp - 0x358]
mov word [ebp + ecx*2 - 0x1da], ax
jmp 0x10e91ad
lea edx, [ebp - 0x344]
push edx
mov eax, dword [ebp - 0xc0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc0]
mov eax, dword [edx + 0x10]
call eax
push 0
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc0]
mov eax, dword [edx + 0x88]
call eax
jmp 0x10e924b
push 1
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0xc8]
call eax
mov ecx, dword [ebp - 0x64]
cmp ecx, dword [ebp - 0xb8]
je 0x10e92a6
call fcn.010e21b0
test eax, eax
jne 0x10e92a6
mov edx, dword [ebp - 0xb8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xb8]
mov edx, dword [eax + 0x34]
call edx
mov dword [ebp - 0x5278], eax
mov dword [ebp - 0x5274], edx
mov eax, dword [ebp - 0x5274]
cmp eax, dword [ebp - 0xe8]
jl 0x10e92a6
jg 0x10e929c
mov ecx, dword [ebp - 0x5278]
cmp ecx, dword [ebp - 0xec]
jb 0x10e92a6
mov dword [ebp - 0xa8], 1
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc4]
mov edx, dword [eax + 0x18]
call edx
mov dword [ebp - 0x527c], eax
mov eax, dword [ebp - 0x527c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x527c]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
je 0x10e9368
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5280], eax
mov ecx, dword [ebp - 0x5280]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5280]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
je 0x10e9368
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x58]
call eax
mov dword [ebp - 0x360], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x58]
call eax
mov dword [ebp - 0x35c], eax
mov ecx, dword [ebp - 0x35c]
mov edx, dword [ebp - 0x360]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x360]
add ecx, 0x68
mov edx, dword [ebp - 0x35c]
add edx, 0x68
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov eax, dword [ecx + 8]
mov dword [edx + 8], eax
mov ecx, dword [ecx + 0xc]
mov dword [edx + 0xc], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x20]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x6c], 0
mov ecx, dword [ebp - 0x68]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x5284], eax
mov ecx, dword [ebp - 0x5284]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5284]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0xdc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xdc]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x5288], eax
mov ecx, dword [ebp - 0x5288]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5288]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0xb4], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x24]
call eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x60], 0
mov ecx, dword [ebp - 0xac]
cmp dword [ecx + 8], 0
je 0x10e9429
mov edx, dword [ebp - 0xac]
cmp dword [edx + 4], 0
je 0x10e9429
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
mov ecx, dword [ebp - 0x5214]
call fcn.010e7ee0
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x60], 1
jmp 0x10e9476
cmp dword [ebp - 0xb4], 0
jne 0x10e9476
mov edx, dword [ebp - 0x78]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x78]
mov edx, dword [eax + 0x30]
call edx
test eax, eax
jne 0x10e9476
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
mov ecx, dword [ebp - 0x5214]
call fcn.010e8080
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x60], 1
mov edx, dword [ebp - 0xb4]
push edx
mov eax, dword [ebp - 0x78]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x78]
mov eax, dword [edx + 0x64]
call eax
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x1c]
call eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], edx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], edx
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0x5c], ecx
mov edx, dword [ebp - 0x90]
mov dword [ebp - 0x58], edx
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0x48], ecx
mov edx, dword [ebp - 0x70]
mov dword [ebp - 0x54], edx
mov esi, dword [ebp + 8]
mov ecx, 0xe
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0xa0], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x88], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x20]
call eax
mov esi, eax
mov edi, edx
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x34]
call eax
mov dword [ebp - 0x5290], esi
mov dword [ebp - 0x528c], edi
mov dword [ebp - 0x5298], eax
mov dword [ebp - 0x5294], edx
mov ecx, dword [ebp - 0x528c]
cmp ecx, dword [ebp - 0x5294]
jg 0x10e95a7
jl 0x10e9557
mov edx, dword [ebp - 0x5290]
cmp edx, dword [ebp - 0x5298]
ja 0x10e95a7
call fcn.010947d0
mov dword [ebp - 0x529c], eax
push 0x1785
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d2d0
mov eax, dword [ebp - 0x529c]
push eax
mov ecx, dword [ebp - 0x529c]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
add esp, 0xc
push 0xd6
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x20]
call eax
xor eax, eax
jmp 0x10eddb3
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
mov dword [ebp - 0x52a4], eax
mov dword [ebp - 0x52a0], edx
mov ecx, dword [ebp - 0x52a4]
or ecx, dword [ebp - 0x52a0]
jne 0x10e961b
call fcn.010947d0
mov dword [ebp - 0x52a8], eax
push 0x178c
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100cdbc
mov edx, dword [ebp - 0x52a8]
push edx
mov eax, dword [ebp - 0x52a8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
call edx
add esp, 0xc
push 0x20
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x20]
call eax
xor eax, eax
jmp 0x10eddb3
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], edx
mov ecx, dword [ebp - 0xdc]
push ecx
mov edx, dword [ebp - 0x50]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x50]
mov edx, dword [eax + 4]
call edx
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x100]
call eax
push eax
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb0]
mov eax, dword [edx + 0xf0]
call eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0xfc]
call eax
push eax
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb0]
mov eax, dword [edx + 0xec]
call eax
mov dword [ebp - 0x364], 0
jmp 0x10e96b4
mov ecx, dword [ebp - 0x364]
add ecx, 1
mov dword [ebp - 0x364], ecx
cmp dword [ebp - 0x364], 2
jge 0x10eda75
mov edx, dword [ebp - 0x50]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x50]
mov edx, dword [eax + 0x24]
call edx
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0x364], 1
jne 0x10e9ae1
cmp dword [ebp - 0xc0], 0
je 0x10e9ae1
mov eax, dword [ebp - 0xc0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc0]
mov eax, dword [edx + 0x24]
call eax
cmp eax, 1
jne 0x10e9ae1
mov ecx, dword [ebp - 0x68]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x52ac], eax
mov ecx, dword [ebp - 0x52ac]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x52ac]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
je 0x10e9ae1
mov ecx, dword [ebp - 0xdc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xdc]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x52b0], eax
mov ecx, dword [ebp - 0x52b0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x52b0]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
jne 0x10e9ae1
mov dword [ebp - 0x430], 0xffffffff
call fcn.010946d0
mov dword [ebp - 0x36c], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x52b4], eax
mov ecx, dword [ebp - 0x52b4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x52b4]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x52b8], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x52b8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x52b8]
mov eax, dword [edx + 0x28]
call eax
push eax
lea ecx, [ebp - 0x430]
push ecx
mov edx, dword [ebp - 0x36c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x36c]
mov edx, dword [eax]
call edx
test eax, eax
jne 0x10e98bb
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x52bc], eax
mov ecx, dword [ebp - 0x52bc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x52bc]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x52c0], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x52c0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x52c0]
mov eax, dword [edx + 0x28]
call eax
push eax
mov ecx, dword [ebp - 0x36c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x36c]
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x52c4], eax
mov ecx, dword [ebp - 0x52c4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x52c4]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x52c8], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x52c8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x52c8]
mov eax, dword [edx + 0x28]
call eax
push eax
lea ecx, [ebp - 0x430]
push ecx
mov edx, dword [ebp - 0x36c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x36c]
mov edx, dword [eax]
call edx
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x52cc], eax
mov ecx, dword [ebp - 0x52cc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x52cc]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x52d0], eax
push 0
lea ecx, [ebp - 0x378]
push ecx
lea edx, [ebp - 0x434]
push edx
lea eax, [ebp - 0x380]
push eax
lea ecx, [ebp - 0x374]
push ecx
mov edx, dword [ebp - 0x52d0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x52d0]
mov edx, dword [eax + 0x18]
call edx
push 0xa8
push 0
lea eax, [ebp - 0x42c]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x52d4], eax
mov ecx, dword [ebp - 0x52d4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x52d4]
mov eax, dword [edx + 0x28]
call eax
mov dword [ebp - 0x42c], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x30]
call eax
mov word [ebp - 0x38c], ax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x38]
call eax
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x410], edx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x420], edx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x44]
call eax
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x418], edx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x2c]
call eax
mov ecx, 0x20
mov esi, eax
lea edi, [ebp - 0x40c]
rep movsd dword es:[edi], dword [esi]
mov cx, word [ebp - 0x380]
mov word [ebp - 0x38a], cx
mov dx, word [ebp - 0x434]
mov word [ebp - 0x388], dx
call fcn.01177170
mov dword [ebp - 0x368], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x42c]
push ecx
mov edx, dword [ebp - 0x368]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x368]
mov edx, dword [eax + 0x20]
call edx
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x10e9a98
mov eax, dword [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x5214]
call fcn.010d8730
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x52d8], eax
mov ecx, dword [ebp - 0x52d8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x52d8]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x52dc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x50]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x50]
mov edx, dword [eax + 0x1c]
call edx
push edx
push eax
mov eax, dword [ebp - 0x52dc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x52dc]
mov eax, dword [edx + 0x28]
call eax
push eax
push 0x2a
mov ecx, dword [ebp - 0x5214]
call fcn.010d5fd0
mov ecx, dword [ebp - 0x430]
push ecx
mov edx, dword [ebp - 0x36c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x36c]
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x52e0], eax
push 0
push 0
mov ecx, dword [ebp - 0x52e0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x52e0]
mov eax, dword [edx + 0x2c]
call eax
jmp 0x10ea8f8
cmp dword [ebp - 0xa4], 4
jne 0x10e9c6f
push 0x60
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x2c]
call eax
call fcn.01144a60
mov dword [ebp - 0x438], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x20]
call eax
mov esi, eax
mov edi, edx
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x52e8], esi
mov dword [ebp - 0x52e4], edi
mov dword [ebp - 0x52f0], eax
mov dword [ebp - 0x52ec], edx
mov ecx, dword [ebp - 0x52e8]
cmp ecx, dword [ebp - 0x52f0]
jne 0x10e9c6a
mov edx, dword [ebp - 0x52e4]
cmp edx, dword [ebp - 0x52ec]
jne 0x10e9c6a
push 0x48
push 0
lea eax, [ebp - 0x484]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0x480], ecx
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x46c], edx
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x47c], eax
mov ecx, dword [ebp - 0x90]
mov dword [ebp - 0x478], ecx
mov edx, dword [ebp - 0xcc]
mov dword [ebp - 0x464], edx
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x460], eax
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x450], edx
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x448], edx
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x34]
call eax
mov dword [ebp - 0x474], eax
mov dword [ebp - 0x470], edx
mov dword [ebp - 0x484], 0xffffffff
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x60]
call eax
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x444], 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x484]
push edx
mov eax, dword [ebp - 0x438]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x438]
mov eax, dword [edx + 0x2c]
call eax
mov dword [ebp - 0x6c], eax
jmp 0x10ea8f8
cmp dword [ebp - 0xd0], 0
jne 0x10e9cbb
cmp dword [ebp - 0xa4], 5
je 0x10e9cbb
cmp dword [ebp - 0xa4], 0xc
je 0x10e9cbb
cmp dword [ebp - 0xa4], 0xa
je 0x10e9cbb
cmp dword [ebp - 0xa4], 6
je 0x10e9cbb
cmp dword [ebp - 0xa4], 7
je 0x10e9cbb
cmp dword [ebp - 0xa4], 8
je 0x10e9cbb
cmp dword [ebp - 0xa4], 9
jne 0x10e9da9
push 0x60
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x2c]
call eax
push 0x30
push 0
lea ecx, [ebp - 0x504]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x504], 0xffffffff
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov dword [ebp - 0x500], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x4f4], edx
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x4ec], eax
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc4]
mov edx, dword [eax + 0x44]
call edx
mov dword [ebp - 0x4fc], eax
mov dword [ebp - 0x4f8], edx
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x4dc], eax
mov ecx, dword [ebp - 0x90]
mov dword [ebp - 0x4d8], ecx
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc4]
mov edx, dword [eax + 0x78]
call edx
mov dword [ebp - 0x4e4], eax
lea eax, [ebp - 0x504]
push eax
lea ecx, [ebp - 0x4d4]
call fcn.0111e550
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x4d4]
call fcn.0111e5a0
mov dword [ebp - 0x6c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4d4]
call fcn.01092b10
jmp 0x10ea8f8
cmp dword [ebp - 0xa4], 1
jne 0x10ea31b
push 0x60
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 0x2c]
call edx
call fcn.01177170
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x20]
call eax
mov esi, eax
mov edi, edx
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x52f8], esi
mov dword [ebp - 0x52f4], edi
mov dword [ebp - 0x5300], eax
mov dword [ebp - 0x52fc], edx
mov ecx, dword [ebp - 0x52f4]
cmp ecx, dword [ebp - 0x52fc]
jl 0x10ea139
jg 0x10e9e32
mov edx, dword [ebp - 0x52f8]
cmp edx, dword [ebp - 0x5300]
jb 0x10ea139
push 0x50
push 0
lea eax, [ebp - 0x55c]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 0xa0]
mov dword [ebp - 0x55c], ecx
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x544], edx
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x554], eax
mov ecx, dword [ebp - 0x90]
mov dword [ebp - 0x550], ecx
mov edx, dword [ebp - 0xcc]
mov dword [ebp - 0x53c], edx
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x538], eax
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x524], eax
mov dword [ebp - 0x520], edx
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x518], edx
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x34]
call eax
mov dword [ebp - 0x54c], eax
mov dword [ebp - 0x548], edx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x30]
call eax
movzx ecx, ax
mov dword [ebp - 0x52c], ecx
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc4]
mov edx, dword [eax + 0x30]
call edx
movzx eax, ax
cdq
push edx
push eax
mov eax, dword [ebp - 0x520]
push eax
mov ecx, dword [ebp - 0x524]
push ecx
call sub.ntdll.dll__alldiv
mov dword [ebp - 0x534], eax
mov dword [ebp - 0x530], edx
mov edx, dword [ebp - 0x50]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x50]
mov edx, dword [eax + 0x60]
call edx
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x514], 1
push 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x55c]
push ecx
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x508]
mov edx, dword [eax + 0x38]
call edx
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x10ea134
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x5308], eax
mov dword [ebp - 0x5304], edx
mov ecx, dword [ebp - 0x5304]
cmp ecx, dword [ebp - 0x520]
jl 0x10ea134
jg 0x10e9fc1
mov edx, dword [ebp - 0x5308]
cmp edx, dword [ebp - 0x524]
jbe 0x10ea134
push 0x148
push 0
lea eax, [ebp - 0x6a4]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x6a4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x69c], ecx
mov edx, dword [eax + 0x1c]
mov dword [ebp - 0x698], edx
mov eax, dword [ebp - 0xc4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x44]
call eax
mov dword [ebp - 0x694], eax
mov dword [ebp - 0x690], edx
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x68c], eax
mov dword [ebp - 0x688], edx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x44]
call eax
mov dword [ebp - 0x684], eax
mov dword [ebp - 0x680], edx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x30]
call eax
mov word [ebp - 0x678], ax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x60]
call eax
mov dword [ebp - 0x67c], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x530c], eax
mov ecx, dword [ebp - 0x530c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x530c]
mov eax, dword [edx + 0x50]
call eax
mov word [ebp - 0x674], ax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5310], eax
mov ecx, dword [ebp - 0x5310]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5310]
mov eax, dword [edx + 0x54]
call eax
mov word [ebp - 0x676], ax
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x2c]
call eax
push eax
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x28]
call eax
movzx ecx, ax
push ecx
push 0x100c9d0
lea edx, [ebp - 0x672]
push edx
call sub.ntdll.dll_swprintf
add esp, 0x10
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x6a4]
push ecx
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x508]
mov edx, dword [eax + 0x34]
call edx
mov dword [ebp - 0x6c], eax
jmp 0x10ea2da
push 0x148
push 0
lea eax, [ebp - 0x7ec]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x7ec], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x7e4], ecx
mov edx, dword [eax + 0x14]
mov dword [ebp - 0x7e0], edx
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x30]
call eax
mov word [ebp - 0x7c0], ax
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x44]
call eax
mov dword [ebp - 0x7dc], eax
mov dword [ebp - 0x7d8], edx
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x7d4], eax
mov dword [ebp - 0x7d0], edx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x44]
call eax
mov dword [ebp - 0x7cc], eax
mov dword [ebp - 0x7c8], edx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x60]
call eax
mov dword [ebp - 0x7c4], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5314], eax
mov ecx, dword [ebp - 0x5314]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5314]
mov eax, dword [edx + 0x50]
call eax
mov word [ebp - 0x7bc], ax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5318], eax
mov ecx, dword [ebp - 0x5318]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5318]
mov eax, dword [edx + 0x54]
call eax
mov word [ebp - 0x7be], ax
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x2c]
call eax
push eax
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x28]
call eax
movzx ecx, ax
push ecx
push 0x100c9d0
lea edx, [ebp - 0x7ba]
push edx
call sub.ntdll.dll_swprintf
add esp, 0x10
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x6b8], eax
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0x6b4], ecx
mov edx, dword [ebp - 0xc8]
mov dword [ebp - 0x6b0], edx
mov dword [ebp - 0x6ac], 1
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x7ec]
push ecx
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x508]
mov edx, dword [eax + 0x34]
call edx
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x10ea316
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x2c]
call eax
push eax
mov ecx, dword [ebp - 0xc8]
push ecx
mov edx, dword [ebp - 0xcc]
push edx
mov eax, dword [ebp - 0x88]
push eax
mov ecx, dword [ebp - 0x508]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x508]
mov eax, dword [edx + 0x28]
call eax
jmp 0x10ea8f8
cmp dword [ebp - 0xa4], 2
je 0x10ea33a
cmp dword [ebp - 0xa4], 3
je 0x10ea33a
cmp dword [ebp - 0xa4], 0
jne 0x10ea8f8
push 0x60
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x2c]
call eax
call fcn.0114bb20
mov dword [ebp - 0x800], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x20]
call eax
mov esi, eax
mov edi, edx
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x20]
call eax
sub esi, eax
sbb edi, edx
mov dword [ebp - 0x7f4], esi
mov dword [ebp - 0x7f0], edi
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x531c], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5320], eax
mov ecx, dword [ebp - 0x5320]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5320]
mov eax, dword [edx + 0x54]
call eax
mov esi, eax
mov ecx, dword [ebp - 0x531c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x531c]
mov eax, dword [edx + 0x50]
call eax
imul eax, esi
xor ecx, ecx
mov dword [ebp - 0x7fc], eax
mov dword [ebp - 0x7f8], ecx
cmp dword [ebp - 0x7f0], 0
jl 0x10ea419
jg 0x10ea3fb
cmp dword [ebp - 0x7f4], 0
jb 0x10ea419
mov edx, dword [ebp - 0x7f0]
cmp edx, dword [ebp - 0x7f8]
jl 0x10ea42f
jg 0x10ea419
mov eax, dword [ebp - 0x7f4]
cmp eax, dword [ebp - 0x7fc]
jb 0x10ea42f
cmp dword [ebp - 0xa4], 2
je 0x10ea42f
cmp dword [ebp - 0xa4], 3
jne 0x10ea5e0
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x20]
call eax
mov esi, eax
mov edi, edx
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x5328], esi
mov dword [ebp - 0x5324], edi
mov dword [ebp - 0x5330], eax
mov dword [ebp - 0x532c], edx
mov ecx, dword [ebp - 0x5324]
cmp ecx, dword [ebp - 0x532c]
jg 0x10ea4d9
jl 0x10ea489
mov edx, dword [ebp - 0x5328]
cmp edx, dword [ebp - 0x5330]
jae 0x10ea4d9
call fcn.010947d0
mov dword [ebp - 0x5334], eax
push 0x1842
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d2d0
mov eax, dword [ebp - 0x5334]
push eax
mov ecx, dword [ebp - 0x5334]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
add esp, 0xc
push 0xd6
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x20]
call eax
xor eax, eax
jmp 0x10eddb3
push 0x48
push 0
lea ecx, [ebp - 0x84c]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x84c], 0xffffffff
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x848], edx
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x834], eax
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0x844], ecx
mov edx, dword [ebp - 0x90]
mov dword [ebp - 0x840], edx
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x82c], eax
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0x828], ecx
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc4]
mov edx, dword [eax + 0x20]
call edx
mov dword [ebp - 0x81c], eax
mov dword [ebp - 0x818], edx
mov eax, dword [ebp - 0xc4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x814], eax
mov dword [ebp - 0x810], edx
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x34]
call eax
mov dword [ebp - 0x83c], eax
mov dword [ebp - 0x838], edx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x60]
call eax
mov dword [ebp - 0x824], eax
mov dword [ebp - 0x80c], 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x84c]
push edx
mov eax, dword [ebp - 0x800]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x800]
mov eax, dword [edx + 0x30]
call eax
mov dword [ebp - 0x6c], eax
jmp 0x10ea8bc
cmp dword [ebp - 0xa4], 0
jne 0x10ea8bc
mov dword [ebp - 0x850], 1
cmp dword [ebp - 0xb8], 0
je 0x10ea7ae
cmp dword [ebp - 0x64], 0
je 0x10ea7ae
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5338], eax
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x64]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x533c], eax
mov ecx, dword [ebp - 0x533c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x533c]
mov eax, dword [edx + 0x28]
call eax
mov esi, eax
mov ecx, dword [ebp - 0x5338]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5338]
mov eax, dword [edx + 0x28]
call eax
cmp eax, esi
jne 0x10ea713
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [edx + 0x1c]
call eax
mov esi, eax
mov edi, edx
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x64]
mov eax, dword [edx + 0x1c]
call eax
mov dword [ebp - 0x5344], esi
mov dword [ebp - 0x5340], edi
mov dword [ebp - 0x534c], eax
mov dword [ebp - 0x5348], edx
mov ecx, dword [ebp - 0x5344]
cmp ecx, dword [ebp - 0x534c]
jne 0x10ea713
mov edx, dword [ebp - 0x5340]
cmp edx, dword [ebp - 0x5348]
jne 0x10ea713
mov eax, dword [ebp - 0x78]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x78]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
je 0x10ea713
mov ecx, dword [ebp - 0x68]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x5350], eax
mov ecx, dword [ebp - 0x5350]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5350]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
jne 0x10ea713
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0x850], 0
jmp 0x10ea7ae
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5354], eax
mov ecx, dword [ebp - 0x5354]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5354]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
jne 0x10ea7ae
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5358], eax
mov ecx, dword [ebp - 0x5358]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5358]
mov eax, dword [edx + 0x2c]
call eax
test eax, eax
jne 0x10ea7ae
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x535c], eax
mov ecx, dword [ebp - 0x535c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x535c]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
je 0x10ea7ae
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0x850], 0
cmp dword [ebp - 0x850], 0
je 0x10ea8bc
push 0x40
push 0
lea ecx, [ebp - 0x894]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0xa0]
mov dword [ebp - 0x894], edx
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x86c], eax
mov ecx, dword [ebp - 0x94]
mov dword [ebp - 0x88c], ecx
mov edx, dword [ebp - 0x90]
mov dword [ebp - 0x888], edx
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x864], eax
mov ecx, dword [ebp - 0xc8]
mov dword [ebp - 0x860], ecx
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc4]
mov edx, dword [eax + 0x30]
call edx
mov word [ebp - 0x874], ax
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x30]
call eax
mov word [ebp - 0x872], ax
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x884], eax
mov dword [ebp - 0x880], edx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x87c], eax
mov dword [ebp - 0x878], edx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x24]
call eax
mov dword [ebp - 0x870], eax
mov dword [ebp - 0x85c], 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x894]
push edx
mov eax, dword [ebp - 0x800]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x800]
mov eax, dword [edx + 0x34]
call eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x10ea8f8
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x2c]
call eax
push eax
mov ecx, dword [ebp - 0xc8]
push ecx
mov edx, dword [ebp - 0xcc]
push edx
mov eax, dword [ebp - 0x88]
push eax
mov ecx, dword [ebp - 0x800]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x800]
mov eax, dword [edx + 0x28]
call eax
cmp dword [ebp - 0x6c], 0
je 0x10ea923
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x24]
call eax
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
push edx
mov eax, dword [ecx + 0x18]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
call fcn.010cb6e0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x5214]
call fcn.010d6450
test eax, eax
jne 0x10ea971
call fcn.010947d0
mov dword [ebp - 0x5360], eax
push 0x1892
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d2b4
mov edx, dword [ebp - 0x5360]
push edx
mov eax, dword [ebp - 0x5360]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
call edx
add esp, 0xc
push 4
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x2c]
call eax
cmp dword [ebp - 0x6c], 0
je 0x10ed919
push 0x100d28c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x3c]
call eax
mov dword [ebp - 0x898], 0x100cb60
cmp dword [ebp - 0x74], 0
je 0x10eaa35
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc0]
call eax
mov dword [ebp - 0x8ac], eax
xor ecx, ecx
mov byte [ebp - 0x51ed], cl
lea edx, [ebp - 0x51ed]
push edx
mov eax, dword [ebp - 0x8ac]
push eax
lea ecx, [ebp - 0x8a8]
call fcn.01089110
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x898]
push ecx
lea ecx, [ebp - 0x8a8]
call fcn.0109e490
lea ecx, [ebp - 0x8a8]
call fcn.01089160
push eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 0xbc]
call edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8a8]
call fcn.01089140
mov dword [ebp - 0x74], 0
push 0
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
call eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x60]
call eax
test eax, eax
je 0x10eaa84
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x24]
call eax
push eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x5214]
call fcn.010e7900
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 0xc]
je 0x10eaaf5
mov eax, dword [ebp - 0x78]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x78]
mov eax, dword [edx + 0x54]
call eax
mov dword [ebp - 0x8b4], eax
mov ecx, dword [ebp - 0x78]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x78]
mov eax, dword [edx + 0x50]
call eax
mov dword [ebp - 0x8b0], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x24]
call eax
push eax
mov ecx, dword [ebp - 0x8b0]
push ecx
mov edx, dword [ebp - 0x8b4]
push edx
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov ecx, dword [ebp - 0x5214]
call fcn.010e7ce0
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x70]
call eax
test eax, eax
je 0x10eab30
mov ecx, dword [ebp - 0x78]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x78]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
jne 0x10eab30
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
mov ecx, dword [ebp - 0x5214]
call fcn.010e82f0
push 0
push 0
mov edx, dword [ebp - 0xdc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xdc]
mov edx, dword [eax + 0x2c]
call edx
test eax, eax
jne 0x10eab98
push 6
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x20]
call eax
call fcn.010947d0
mov dword [ebp - 0x5364], eax
push 0x18c0
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d26c
mov ecx, dword [ebp - 0x5364]
push ecx
mov edx, dword [ebp - 0x5364]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
call ecx
add esp, 0xc
xor eax, eax
jmp 0x10eddb3
push 0x9c4
call fcn.0108fe30
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x28]
call eax
push eax
mov ecx, dword [ebp - 0x5214]
call fcn.010d5fd0
test eax, eax
jne 0x10eac10
call fcn.010947d0
mov dword [ebp - 0x5368], eax
push 0x18c7
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d248
mov ecx, dword [ebp - 0x5368]
push ecx
mov edx, dword [ebp - 0x5368]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
call ecx
add esp, 0xc
push 0x32
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 8]
call edx
cmp dword [ebp - 0xd4], 0
je 0x10eac4b
cmp dword [ebp - 0x364], 0
jne 0x10eac4b
mov eax, dword [ebp - 0xa8]
push eax
mov ecx, dword [ebp - 0x50]
push ecx
mov edx, dword [ebp - 0x7c]
push edx
mov ecx, dword [ebp - 0x5214]
call fcn.010d8190
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
push eax
mov ecx, dword [ebp - 0x5214]
call fcn.010d7180
test eax, eax
je 0x10eac7c
cmp dword [ebp - 0x364], 0
jne 0x10eac7c
mov ecx, dword [ebp - 0x5214]
call fcn.010d64f0
mov ecx, dword [ebp - 0xc4]
push ecx
mov edx, dword [ebp - 0xe0]
push edx
mov ecx, dword [ebp - 0x5214]
call fcn.010d8660
test eax, eax
je 0x10eaca3
mov dword [ebp - 0xd4], 1
cmp dword [ebp - 0xd4], 0
je 0x10ead19
mov eax, dword [ebp - 0xd4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xdc]
push edx
mov eax, dword [ebp - 0x68]
push eax
mov ecx, dword [ebp - 0x5214]
call fcn.010d58b0
test eax, eax
jne 0x10ead17
call fcn.010947d0
mov dword [ebp - 0x536c], eax
push 0x18de
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100bb88
mov ecx, dword [ebp - 0x536c]
push ecx
mov edx, dword [ebp - 0x536c]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
call ecx
add esp, 0xc
push 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 0x20]
call edx
jmp 0x10ead87
mov eax, dword [ebp - 0xd4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xdc]
push edx
mov eax, dword [ebp - 0xe0]
push eax
mov ecx, dword [ebp - 0x5214]
call fcn.010d58b0
test eax, eax
jne 0x10ead87
call fcn.010947d0
mov dword [ebp - 0x5370], eax
push 0x18e7
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100bb88
mov ecx, dword [ebp - 0x5370]
push ecx
mov edx, dword [ebp - 0x5370]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
call ecx
add esp, 0xc
push 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax + 0x20]
call edx
cmp dword [ebp - 0x60], 0
je 0x10eadb1
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
mov ecx, dword [ebp - 0x5214]
call fcn.010e8540
mov dword [ebp - 0x8b8], eax
mov edx, dword [ebp - 0x8b8]
mov dword [ebp - 0xb4], edx
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x5374], eax
mov ecx, dword [ebp - 0x5374]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5374]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
jne 0x10eae26
mov ecx, dword [ebp - 0x78]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x78]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
jne 0x10eae26
mov ecx, dword [ebp - 0xc8]
push ecx
mov edx, dword [ebp - 0xcc]
push edx
mov eax, dword [ebp - 0x90]
push eax
mov ecx, dword [ebp - 0x94]
push ecx
mov edx, dword [ebp - 0x50]
push edx
mov eax, dword [ebp - 0xb4]
push eax
mov ecx, dword [ebp - 0x70]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x5214]
call fcn.010f2cd0
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x5378], eax
mov ecx, dword [ebp - 0x5378]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5378]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
jne 0x10eae84
mov ecx, dword [ebp - 0xdc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xdc]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x537c], eax
mov ecx, dword [ebp - 0x537c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x537c]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
je 0x10ed631
cmp dword [ebp - 0xd4], 0
je 0x10ed631
mov dword [ebp - 0x8c0], 0xffffffff
call fcn.010946d0
mov dword [ebp - 0x8bc], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x5380], eax
mov ecx, dword [ebp - 0x5380]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5380]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x5384], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x5384]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5384]
mov eax, dword [edx + 0x28]
call eax
push eax
mov ecx, dword [ebp - 0x8bc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8bc]
mov eax, dword [edx + 0x18]
call eax
test eax, eax
jne 0x10eaf17
call fcn.0108f8f0
mov dword [ebp - 0x8c0], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x5388], eax
mov ecx, dword [ebp - 0x5388]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5388]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x538c], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x538c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x538c]
mov eax, dword [edx + 0x28]
call eax
push eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x28]
call eax
push eax
mov ecx, dword [ebp - 0x8bc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8bc]
mov eax, dword [edx + 0xc]
call eax
test eax, eax
jne 0x10eaf96
call fcn.0108f8f0
mov dword [ebp - 0x8c0], eax
mov ecx, dword [ebp - 0xdc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xdc]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x5390], eax
mov ecx, dword [ebp - 0x5390]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5390]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
je 0x10ecaf2
call fcn.0109c520
mov dword [ebp - 0x8cc], eax
cmp dword [ebp - 0x8cc], 0
jne 0x10eb015
call fcn.010947d0
mov dword [ebp - 0x5394], eax
push 0x1910
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d22c
mov ecx, dword [ebp - 0x5394]
push ecx
mov edx, dword [ebp - 0x5394]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
call ecx
add esp, 0xc
mov edx, dword [ebp - 0x8cc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x8cc]
mov edx, dword [eax + 4]
call edx
test eax, eax
jne 0x10eb063
call fcn.010947d0
mov dword [ebp - 0x5398], eax
push 0x1914
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d214
mov eax, dword [ebp - 0x5398]
push eax
mov ecx, dword [ebp - 0x5398]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
add esp, 0xc
mov dword [ebp - 0x8c4], 0
mov dword [ebp - 0x8c8], 0
mov ecx, dword [ebp - 0x8cc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8cc]
mov eax, dword [edx + 0x10]
call eax
mov dword [ebp - 0x8d0], eax
jmp 0x10eb0ab
mov ecx, dword [ebp - 0x8cc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8cc]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x8d0], eax
cmp dword [ebp - 0x8d0], 0
je 0x10eb281
cmp dword [ebp - 0x8c4], 0
jne 0x10eb281
mov ecx, dword [ebp - 0x8d0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8d0]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x8d4], eax
jmp 0x10eb0f9
mov ecx, dword [ebp - 0x8d0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8d0]
mov eax, dword [edx + 0x10]
call eax
mov dword [ebp - 0x8d4], eax
cmp dword [ebp - 0x8d4], 0
je 0x10eb27c
cmp dword [ebp - 0x8c4], 0
jne 0x10eb27c
mov ecx, dword [ebp - 0x8d4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8d4]
mov eax, dword [edx + 0x28]
call eax
mov ecx, dword [ebp + 8]
cmp eax, dword [ecx + 0xc]
jne 0x10eb277
mov edx, dword [ebp - 0x8d4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x8d4]
mov edx, dword [eax + 0x3c]
call edx
mov dword [ebp - 0x8dc], eax
cmp dword [ebp - 0x8dc], 0
jne 0x10eb156
jmp 0x10eb0e0
mov eax, dword [ebp - 0x8dc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x8dc]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x8d8], eax
jmp 0x10eb18a
mov ecx, dword [ebp - 0x8dc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8dc]
mov eax, dword [edx + 0x1c]
call eax
mov dword [ebp - 0x8d8], eax
cmp dword [ebp - 0x8d8], 0
je 0x10eb277
cmp dword [ebp - 0x8c4], 0
jne 0x10eb277
mov ecx, dword [ebp - 0x8d8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8d8]
mov eax, dword [edx + 0x1c]
call eax
mov esi, eax
mov edi, edx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
mov dword [ebp - 0x53a0], esi
mov dword [ebp - 0x539c], edi
mov dword [ebp - 0x53a8], eax
mov dword [ebp - 0x53a4], edx
mov ecx, dword [ebp - 0x53a0]
cmp ecx, dword [ebp - 0x53a8]
jne 0x10eb208
mov edx, dword [ebp - 0x539c]
cmp edx, dword [ebp - 0x53a4]
jne 0x10eb208
mov eax, dword [ebp - 0x8d8]
mov dword [ebp - 0x8c4], eax
mov ecx, dword [ebp - 0x8d8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8d8]
mov eax, dword [edx + 0x1c]
call eax
mov esi, eax
mov edi, edx
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb0]
mov eax, dword [edx + 0x1c]
call eax
mov dword [ebp - 0x53b0], esi
mov dword [ebp - 0x53ac], edi
mov dword [ebp - 0x53b8], eax
mov dword [ebp - 0x53b4], edx
mov ecx, dword [ebp - 0x53b0]
cmp ecx, dword [ebp - 0x53b8]
jne 0x10eb272
mov edx, dword [ebp - 0x53ac]
cmp edx, dword [ebp - 0x53b4]
jne 0x10eb272
mov eax, dword [ebp - 0x8d8]
mov dword [ebp - 0x8c8], eax
jmp 0x10eb171
jmp 0x10eb0e0
jmp 0x10eb092
cmp dword [ebp - 0x8c4], 0
je 0x10eb475
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x53bc], eax
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x64]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x53c0], eax
mov ecx, dword [ebp - 0x53c0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x53c0]
mov eax, dword [edx + 0x28]
call eax
mov esi, eax
mov ecx, dword [ebp - 0x53bc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x53bc]
mov eax, dword [edx + 0x28]
call eax
cmp eax, esi
jne 0x10eb414
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [edx + 0x1c]
call eax
mov esi, eax
mov edi, edx
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x64]
mov eax, dword [edx + 0x1c]
call eax
mov dword [ebp - 0x53c8], esi
mov dword [ebp - 0x53c4], edi
mov dword [ebp - 0x53d0], eax
mov dword [ebp - 0x53cc], edx
mov ecx, dword [ebp - 0x53c8]
cmp ecx, dword [ebp - 0x53d0]
jne 0x10eb414
mov edx, dword [ebp - 0x53c4]
cmp edx, dword [ebp - 0x53cc]
jne 0x10eb414
mov eax, dword [ebp - 0x78]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x78]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
je 0x10eb414
mov ecx, dword [ebp - 0x68]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x53d4], eax
mov ecx, dword [ebp - 0x53d4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x53d4]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
jne 0x10eb414
cmp dword [ebp - 0x364], 1
jne 0x10eb414
mov ecx, dword [ebp - 0x8c4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8c4]
mov eax, dword [edx + 0x58]
call eax
mov esi, eax
add esi, 0x68
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x58]
call eax
add eax, 0x68
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 8]
mov dword [eax + 8], ecx
mov edx, dword [esi + 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0x8c4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x8c4]
mov eax, dword [edx + 0x58]
call eax
mov esi, eax
add esi, 0x78
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x58]
call eax
add eax, 0x78
mov ecx, dword [esi]
mov dword [eax], ecx
mov edx, dword [esi + 4]
mov dword [eax + 4], edx
mov ecx, dword [esi + 8]
mov dword [eax + 8], ecx
mov edx, dword [esi + 0xc]
mov dword [eax + 0xc], edx
jmp 0x10eb475
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x30]
call eax
mov word [ebp - 0x8e0], ax
mov ecx, dword [ebp - 0x8c4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8c4]
mov eax, dword [edx + 0xc]
call eax
push eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x30]
call eax
movzx ecx, ax
test ecx, ecx
jne 0x10eb475
mov dx, word [ebp - 0x8e0]
push edx
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x94]
call eax
cmp dword [ebp - 0x8c8], 0
je 0x10eb4a5
mov ecx, dword [ebp - 0x8c8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8c8]
mov eax, dword [edx + 0xc]
call eax
push eax
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb0]
mov eax, dword [edx + 0x10]
call eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x64]
call eax
test eax, eax
jne 0x10eb4e6
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x58]
call eax
cmp dword [eax], 1
je 0x10eb4e6
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x24]
call eax
test eax, eax
je 0x10eb4e6
cmp dword [ebp - 0x364], 1
jne 0x10ec609
mov dword [ebp - 0x8e4], 0
mov ecx, dword [ebp - 0x68]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x53d8], eax
mov ecx, dword [ebp - 0x53d8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x53d8]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
je 0x10ebb8b
mov ecx, dword [ebp - 0x68]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x53dc], eax
mov ecx, dword [ebp - 0x53dc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x53dc]
mov eax, dword [edx + 0x2c]
call eax
test eax, eax
jne 0x10ebb8b
mov word [ebp - 0x9e4], 0
push 0xfe
push 0
lea ecx, [ebp - 0x9e2]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x9e8], 0
mov word [ebp - 0xaec], 0
push 0xfe
push 0
lea edx, [ebp - 0xaea]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x53e0], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x53e0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x53e0]
mov eax, dword [edx + 0x28]
call eax
push eax
push 0x80
lea ecx, [ebp - 0xaec]
push ecx
mov edx, dword [ebp - 0x8bc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x8bc]
mov edx, dword [eax + 0x2c]
call edx
test eax, eax
je 0x10eb5ef
jmp 0x10eb65d
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x53e4], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x53e4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x53e4]
mov eax, dword [edx + 0x28]
call eax
push eax
mov ecx, dword [ebp - 0x8bc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8bc]
mov eax, dword [edx + 0x54]
call eax
push 0x64
call fcn.0108fe30
mov ecx, dword [ebp - 0x9e8]
mov edx, dword [ebp - 0x9e8]
add edx, 1
mov dword [ebp - 0x9e8], edx
cmp ecx, 0x64
jl 0x10eb594
cmp dword [ebp - 0x9e8], 0x64
jl 0x10eb6a4
call fcn.010947d0
mov dword [ebp - 0x53e8], eax
push 0x1964
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d1f8
mov eax, dword [ebp - 0x53e8]
push eax
mov ecx, dword [ebp - 0x53e8]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
add esp, 0xc
xor eax, eax
jmp 0x10eddb3
mov dword [ebp - 0x9e8], 0
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x53ec], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x53ec]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x53ec]
mov eax, dword [edx + 0x28]
call eax
push eax
push 0x80
lea ecx, [ebp - 0x9e4]
push ecx
mov edx, dword [ebp - 0x8bc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x8bc]
mov edx, dword [eax + 0x2c]
call edx
test eax, eax
je 0x10eb709
jmp 0x10eb777
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x53f0], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x53f0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x53f0]
mov eax, dword [edx + 0x28]
call eax
push eax
mov ecx, dword [ebp - 0x8bc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8bc]
mov eax, dword [edx + 0x54]
call eax
push 0x64
call fcn.0108fe30
mov ecx, dword [ebp - 0x9e8]
mov edx, dword [ebp - 0x9e8]
add edx, 1
mov dword [ebp - 0x9e8], edx
cmp ecx, 0x64
jl 0x10eb6ae
cmp dword [ebp - 0x9e8], 0x64
jl 0x10eb7be
call fcn.010947d0
mov dword [ebp - 0x53f4], eax
push 0x1974
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100c130
mov eax, dword [ebp - 0x53f4]
push eax
mov ecx, dword [ebp - 0x53f4]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
add esp, 0xc
xor eax, eax
jmp 0x10eddb3
push 0
mov ecx, dword [ebp - 0x5214]
call fcn.010d9a90
test eax, eax
je 0x10eba06
mov word [ebp - 0x18f4], 0
push 0x1fe
push 0
lea ecx, [ebp - 0x18f2]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov word [ebp - 0xcec], 0
push 0x1fe
push 0
lea edx, [ebp - 0xcea]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov word [ebp - 0xef4], 0
push 0x1fe
push 0
lea eax, [ebp - 0xef2]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x9e4]
push ecx
push 0x10085b8
lea edx, [ebp - 0xef4]
push edx
call sub.ntdll.dll_swprintf
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 7
push 0xc0000000
lea eax, [ebp - 0xef4]
push eax
call fcn.01091ef0
mov dword [ebp - 0xcf0], eax
cmp dword [ebp - 0xcf0], 0xffffffff
je 0x10eb8b0
mov dword [ebp - 0x18f8], 0
push 0
lea ecx, [ebp - 0x18f8]
push ecx
push 0
push 0
push 0
push 0
push 0x56c008
mov edx, dword [ebp - 0xcf0]
push edx
call fcn.010927b0
mov eax, dword [ebp - 0xcf0]
push eax
call fcn.01092350
lea ecx, [ebp - 0x9e4]
push ecx
push 0x10081b8
lea edx, [ebp - 0x18f4]
push edx
call sub.ntdll.dll_swprintf
add esp, 0xc
lea eax, [ebp - 0x18f4]
push eax
call fcn.01092120
cmp eax, 0xffffffff
je 0x10eb8e8
lea ecx, [ebp - 0x18f4]
push ecx
call fcn.010922c0
push 0x100d1e4
mov edx, dword [ebp - 0x64]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x64]
mov edx, dword [eax + 0x28]
call edx
movzx eax, ax
push eax
push 0x100d1c4
lea ecx, [ebp - 0xcec]
push ecx
call sub.ntdll.dll_swprintf
add esp, 0x10
lea edx, [ebp - 0xcec]
push edx
call fcn.01092120
cmp eax, 0xffffffff
jne 0x10eb961
call fcn.010947d0
mov dword [ebp - 0x53f8], eax
push 0x1999
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d1a4
mov eax, dword [ebp - 0x53f8]
push eax
mov ecx, dword [ebp - 0x53f8]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
add esp, 0xc
xor eax, eax
jmp 0x10eddb3
lea ecx, [ebp - 0x16f4]
call fcn.011b1f30
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x18f4]
push ecx
lea edx, [ebp - 0xcec]
push edx
lea ecx, [ebp - 0x16f4]
call fcn.0111d810
test eax, eax
jne 0x10eb9f4
call fcn.010947d0
mov dword [ebp - 0x53fc], eax
call fcn.0108f8f0
push eax
push 0x19a1
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d180
mov eax, dword [ebp - 0x53fc]
push eax
mov ecx, dword [ebp - 0x53fc]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
add esp, 0x10
mov dword [ebp - 0x51f4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16f4]
call fcn.01092b10
mov eax, dword [ebp - 0x51f4]
jmp 0x10eddb3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16f4]
call fcn.01092b10
mov ecx, dword [ebp - 0xb0]
push ecx
mov edx, dword [ebp - 0x50]
push edx
mov eax, dword [ebp - 0x64]
push eax
mov ecx, dword [ebp - 0xb8]
push ecx
mov ecx, dword [ebp - 0x5214]
call fcn.010d8a80
mov dword [ebp - 0x8e4], eax
cmp dword [ebp - 0x8e4], 0
je 0x10ebb86
mov word [ebp - 0x1afc], 0
push 0x1fe
push 0
lea edx, [ebp - 0x1afa]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x9e4]
push eax
push 0x100882c
lea ecx, [ebp - 0x1afc]
push ecx
call sub.ntdll.dll_swprintf
add esp, 0xc
lea edx, [ebp - 0x1afc]
push edx
call fcn.01092120
cmp eax, 0xffffffff
jne 0x10ebb86
push 0x200
push 0
lea eax, [ebp - 0x1afc]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x9e4]
push ecx
push 0x1008808
lea edx, [ebp - 0x1afc]
push edx
call sub.ntdll.dll_swprintf
add esp, 0xc
push 0
lea eax, [ebp - 0x1afc]
push eax
call fcn.01092930
test eax, eax
jne 0x10ebade
lea ecx, [ebp - 0x1afc]
push ecx
mov ecx, dword [ebp - 0x5214]
call fcn.010d8fe0
lea ecx, [ebp - 0x24fc]
call fcn.011b1f30
mov dword [ebp - 4], 3
mov word [ebp - 0x1cfc], 0
push 0x1fe
push 0
lea edx, [ebp - 0x1cfa]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
push 0x200
push 0
lea eax, [ebp - 0x1afc]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x9e4]
push ecx
push 0x1008258
lea edx, [ebp - 0x1afc]
push edx
call sub.ntdll.dll_swprintf
add esp, 0xc
lea eax, [ebp - 0x9e4]
push eax
push 0x1008210
lea ecx, [ebp - 0x1cfc]
push ecx
call sub.ntdll.dll_swprintf
add esp, 0xc
lea edx, [ebp - 0x1cfc]
push edx
lea eax, [ebp - 0x1afc]
push eax
lea ecx, [ebp - 0x24fc]
call fcn.0111d810
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24fc]
call fcn.01092b10
jmp 0x10ec609
mov ecx, dword [ebp - 0x68]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x5400], eax
mov ecx, dword [ebp - 0x5400]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5400]
mov eax, dword [edx + 0x2c]
call eax
test eax, eax
jne 0x10ec609
mov dword [ebp - 0x36e0], 0xffffffff
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5404], eax
push 0
lea ecx, [ebp - 0x36dc]
push ecx
lea edx, [ebp - 0x2b10]
push edx
lea eax, [ebp - 0x36d8]
push eax
lea ecx, [ebp - 0x2d1c]
push ecx
mov edx, dword [ebp - 0x5404]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x5404]
mov edx, dword [eax + 0x18]
call edx
push 0
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x88]
call eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20]
mov dword [ebp - 0x2708], edx
call fcn.0114bb20
mov dword [ebp - 0x3520], eax
push 0xb0
push 0
lea eax, [ebp - 0x36d4]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5408], eax
mov ecx, dword [ebp - 0x5408]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5408]
mov eax, dword [edx + 0x28]
call eax
mov dword [ebp - 0x36d4], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
mov dword [ebp - 0x36cc], eax
mov dword [ebp - 0x36c8], edx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x36c4], eax
mov dword [ebp - 0x36c0], edx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x38]
call eax
mov dword [ebp - 0x36bc], eax
mov dword [ebp - 0x36b8], edx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x24]
call eax
mov dword [ebp - 0x3634], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x30]
call eax
mov word [ebp - 0x3630], ax
mov cx, word [ebp - 0x36d8]
mov word [ebp - 0x362e], cx
mov dx, word [ebp - 0x2b10]
mov word [ebp - 0x362c], dx
mov eax, dword [ebp - 0x2708]
mov dword [ebp - 0x3628], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x2c]
call eax
mov dword [ebp - 0x540c], eax
lea ecx, [ebp - 0x36b4]
mov dword [ebp - 0x5410], ecx
mov edx, dword [ebp - 0x5410]
mov dword [ebp - 0x5414], edx
mov eax, dword [ebp - 0x540c]
mov cx, word [eax]
mov word [ebp - 0x5416], cx
mov edx, dword [ebp - 0x5410]
mov ax, word [ebp - 0x5416]
mov word [edx], ax
mov ecx, dword [ebp - 0x540c]
add ecx, 2
mov dword [ebp - 0x540c], ecx
mov edx, dword [ebp - 0x5410]
add edx, 2
mov dword [ebp - 0x5410], edx
cmp word [ebp - 0x5416], 0
jne 0x10ebd37
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x541c], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x541c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x541c]
mov eax, dword [edx + 0x28]
call eax
push eax
mov ecx, dword [ebp - 0x8bc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8bc]
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5420], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x5420]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5420]
mov eax, dword [edx + 0x28]
call eax
push eax
lea ecx, [ebp - 0x36e0]
push ecx
mov edx, dword [ebp - 0x8bc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x8bc]
mov edx, dword [eax]
call edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x36d4]
push ecx
mov edx, dword [ebp - 0x3520]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x3520]
mov edx, dword [eax + 0x14]
call edx
test eax, eax
jne 0x10ebe85
call fcn.010947d0
mov dword [ebp - 0x5424], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x68]
call eax
push eax
push 0x19e4
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d150
mov ecx, dword [ebp - 0x5424]
push ecx
mov edx, dword [ebp - 0x5424]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
call ecx
add esp, 0x10
xor eax, eax
jmp 0x10eddb3
mov edx, dword [ebp - 0x36e0]
push edx
mov eax, dword [ebp - 0x8bc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x8bc]
mov eax, dword [edx + 8]
call eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5428], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x5428]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5428]
mov eax, dword [edx + 0x28]
call eax
push eax
mov ecx, dword [ebp - 0x8bc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8bc]
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x542c], eax
push 0
push 0
mov ecx, dword [ebp - 0x542c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x542c]
mov eax, dword [edx + 0x2c]
call eax
mov dword [ebp - 0x2b14], 0
mov word [ebp - 0x2d14], 0
push 0xfe
push 0
lea ecx, [ebp - 0x2d12]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x50]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x50]
mov edx, dword [eax + 0x18]
call edx
mov dword [ebp - 0x5430], eax
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x5430]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5430]
mov eax, dword [edx + 0x28]
call eax
push eax
push 0x80
lea ecx, [ebp - 0x2d14]
push ecx
mov edx, dword [ebp - 0x8bc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x8bc]
mov edx, dword [eax + 0x2c]
call edx
test eax, eax
je 0x10ebf96
jmp 0x10ec004
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5434], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x5434]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5434]
mov eax, dword [edx + 0x28]
call eax
push eax
mov ecx, dword [ebp - 0x8bc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8bc]
mov eax, dword [edx + 0x54]
call eax
push 0x64
call fcn.0108fe30
mov ecx, dword [ebp - 0x2b14]
mov edx, dword [ebp - 0x2b14]
add edx, 1
mov dword [ebp - 0x2b14], edx
cmp ecx, 0x64
jl 0x10ebf3b
cmp dword [ebp - 0x2b14], 0x64
jl 0x10ec044
call fcn.010947d0
mov dword [ebp - 0x5438], eax
push 0x19f9
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d1f8
mov eax, dword [ebp - 0x5438]
push eax
mov ecx, dword [ebp - 0x5438]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
add esp, 0xc
push 0xbb8
call fcn.0108fe30
mov word [ebp - 0x3624], 0
push 0xfe
push 0
lea ecx, [ebp - 0x3622]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov word [ebp - 0x2c14], 0
push 0xfe
push 0
lea edx, [ebp - 0x2c12]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x64]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x64]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x543c], eax
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x64]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x543c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x543c]
mov eax, dword [edx + 0x28]
call eax
push eax
push 0x80
lea ecx, [ebp - 0x3624]
push ecx
mov edx, dword [ebp - 0x8bc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x8bc]
mov edx, dword [eax + 0x2c]
call edx
test eax, eax
jne 0x10ec11c
call fcn.010947d0
mov dword [ebp - 0x5440], eax
push 0x1a04
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d12c
mov eax, dword [ebp - 0x5440]
push eax
mov ecx, dword [ebp - 0x5440]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
add esp, 0xc
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5444], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x5444]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5444]
mov eax, dword [edx + 0x28]
call eax
push eax
push 0x80
lea ecx, [ebp - 0x2c14]
push ecx
mov edx, dword [ebp - 0x8bc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x8bc]
mov edx, dword [eax + 0x2c]
call edx
test eax, eax
jne 0x10ec1ac
call fcn.010947d0
mov dword [ebp - 0x5448], eax
push 0x1a09
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d104
mov eax, dword [ebp - 0x5448]
push eax
mov ecx, dword [ebp - 0x5448]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
add esp, 0xc
mov word [ebp - 0x2704], 0
push 0x1fe
push 0
lea ecx, [ebp - 0x2702]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov word [ebp - 0x2b0c], 0
push 0x1fe
push 0
lea edx, [ebp - 0x2b0a]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
push 0x100d0e0
lea eax, [ebp - 0x3624]
push eax
push 0x10085f8
lea ecx, [ebp - 0x2704]
push ecx
call sub.ntdll.dll_swprintf
add esp, 0x10
mov word [ebp - 0x290c], 0
push 0x1fe
push 0
lea edx, [ebp - 0x290a]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2c14]
push eax
push 0x10085b8
lea ecx, [ebp - 0x290c]
push ecx
call sub.ntdll.dll_swprintf
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 7
push 0xc0000000
lea edx, [ebp - 0x290c]
push edx
call fcn.01091ef0
mov dword [ebp - 0x2500], eax
cmp dword [ebp - 0x2500], 0xffffffff
je 0x10ec2a9
mov dword [ebp - 0x36e4], 0
push 0
lea eax, [ebp - 0x36e4]
push eax
push 0
push 0
push 0
push 0
push 0x56c008
mov ecx, dword [ebp - 0x2500]
push ecx
call fcn.010927b0
mov edx, dword [ebp - 0x2500]
push edx
call fcn.01092350
lea eax, [ebp - 0x2c14]
push eax
push 0x1008394
lea ecx, [ebp - 0x2b0c]
push ecx
call sub.ntdll.dll_swprintf
add esp, 0xc
push 0
lea edx, [ebp - 0x2b0c]
push edx
call fcn.01092930
test eax, eax
jne 0x10ec2f3
lea eax, [ebp - 0x2b0c]
push eax
mov ecx, dword [ebp - 0x5214]
call fcn.010d8fe0
test eax, eax
jne 0x10ec2f3
xor eax, eax
jmp 0x10eddb3
push 0x200
push 0
lea ecx, [ebp - 0x2b0c]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
lea edx, [ebp - 0x2c14]
push edx
push 0x1008368
lea eax, [ebp - 0x2b0c]
push eax
call sub.ntdll.dll_swprintf
add esp, 0xc
push 0
lea ecx, [ebp - 0x2b0c]
push ecx
call fcn.01092930
test eax, eax
jne 0x10ec353
lea edx, [ebp - 0x2b0c]
push edx
mov ecx, dword [ebp - 0x5214]
call fcn.010d8fe0
test eax, eax
jne 0x10ec353
xor eax, eax
jmp 0x10eddb3
push 0x200
push 0
lea eax, [ebp - 0x2b0c]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x2c14]
push ecx
push 0x1008330
lea edx, [ebp - 0x2b0c]
push edx
call sub.ntdll.dll_swprintf
add esp, 0xc
push 0
lea eax, [ebp - 0x2b0c]
push eax
call fcn.01092930
test eax, eax
jne 0x10ec3b3
lea ecx, [ebp - 0x2b0c]
push ecx
mov ecx, dword [ebp - 0x5214]
call fcn.010d8fe0
test eax, eax
jne 0x10ec3b3
xor eax, eax
jmp 0x10eddb3
push 0x200
push 0
lea edx, [ebp - 0x2b0c]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2c14]
push eax
push 0x10082f0
lea ecx, [ebp - 0x2b0c]
push ecx
call sub.ntdll.dll_swprintf
add esp, 0xc
push 0
lea edx, [ebp - 0x2b0c]
push edx
call fcn.01092930
test eax, eax
jne 0x10ec413
lea eax, [ebp - 0x2b0c]
push eax
mov ecx, dword [ebp - 0x5214]
call fcn.010d8fe0
test eax, eax
jne 0x10ec413
xor eax, eax
jmp 0x10eddb3
lea ecx, [ebp - 0x351c]
call fcn.011b1f30
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x2b0c]
push ecx
lea edx, [ebp - 0x2704]
push edx
lea ecx, [ebp - 0x351c]
call fcn.0111d760
test eax, eax
jne 0x10ec469
mov dword [ebp - 0x51f8], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x351c]
call fcn.01092b10
mov eax, dword [ebp - 0x51f8]
jmp 0x10eddb3
push 0x200
push 0
lea eax, [ebp - 0x2704]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push 0x200
push 0
lea ecx, [ebp - 0x2b0c]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
push 0x100d0a0
lea edx, [ebp - 0x2c14]
push edx
push 0x10085f8
lea eax, [ebp - 0x2704]
push eax
call sub.ntdll.dll_swprintf
add esp, 0x10
lea ecx, [ebp - 0x2c14]
push ecx
push 0x1008210
lea edx, [ebp - 0x2b0c]
push edx
call sub.ntdll.dll_swprintf
add esp, 0xc
lea eax, [ebp - 0x2b0c]
push eax
lea ecx, [ebp - 0x2704]
push ecx
lea ecx, [ebp - 0x351c]
call fcn.0111d810
test eax, eax
jne 0x10ec514
mov dword [ebp - 0x51fc], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x351c]
call fcn.01092b10
mov eax, dword [ebp - 0x51fc]
jmp 0x10eddb3
push 0x200
push 0
lea edx, [ebp - 0x2704]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
push 0x200
push 0
lea eax, [ebp - 0x2b0c]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push 0x100d1e4
lea ecx, [ebp - 0x3624]
push ecx
push 0x10084b4
lea edx, [ebp - 0x2704]
push edx
call sub.ntdll.dll_swprintf
add esp, 0x10
lea eax, [ebp - 0x2c14]
push eax
push 0x10081b8
lea ecx, [ebp - 0x2b0c]
push ecx
call sub.ntdll.dll_swprintf
add esp, 0xc
lea edx, [ebp - 0x2b0c]
push edx
lea eax, [ebp - 0x2704]
push eax
lea ecx, [ebp - 0x351c]
call fcn.0111d810
test eax, eax
jne 0x10ec5bf
mov dword [ebp - 0x5200], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x351c]
call fcn.01092b10
mov eax, dword [ebp - 0x5200]
jmp 0x10eddb3
lea ecx, [ebp - 0x2704]
push ecx
call fcn.010922c0
mov edx, dword [ebp - 0xb0]
push edx
mov eax, dword [ebp - 0x50]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x5214]
call fcn.010d8a80
mov dword [ebp - 0x8e4], eax
lea ecx, [ebp - 0x2704]
push ecx
call fcn.010922c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x351c]
call fcn.01092b10
cmp dword [ebp - 0x364], 0
jne 0x10ecad2
lea ecx, [ebp - 0x38f8]
call fcn.01114a50
mov dword [ebp - 4], 5
mov word [ebp - 0x3a0c], 0
push 0xfe
push 0
lea edx, [ebp - 0x3a0a]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov word [ebp - 0x38f4], 0
push 0x1fe
push 0
lea eax, [ebp - 0x38f2]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x36f4], 0
xor ecx, ecx
mov dword [ebp - 0x36f0], ecx
mov dword [ebp - 0x36ec], ecx
mov dword [ebp - 0x36e8], ecx
mov dword [ebp - 0x3908], 0
xor edx, edx
mov dword [ebp - 0x3904], edx
mov dword [ebp - 0x3900], edx
mov dword [ebp - 0x38fc], edx
mov eax, dword [ebp - 0x64]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x64]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x36f4], eax
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x64]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x544c], eax
mov ecx, dword [ebp - 0x544c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x544c]
mov eax, dword [edx + 0x28]
call eax
mov dword [ebp - 0x36e8], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3908], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5450], eax
mov ecx, dword [ebp - 0x5450]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5450]
mov eax, dword [edx + 0x28]
call eax
mov dword [ebp - 0x38fc], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5454], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x5454]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5454]
mov eax, dword [edx + 0x28]
call eax
push eax
push 0x80
lea ecx, [ebp - 0x3a0c]
push ecx
mov edx, dword [ebp - 0x8bc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x8bc]
mov edx, dword [eax + 0x2c]
call edx
lea eax, [ebp - 0x3a0c]
push eax
push 0x10087b0
lea ecx, [ebp - 0x38f4]
push ecx
call sub.ntdll.dll_swprintf
add esp, 0xc
mov edx, dword [ebp - 0x68]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x68]
mov edx, dword [eax + 0x20]
call edx
mov dword [ebp - 0x5458], eax
mov eax, dword [ebp - 0x5458]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x5458]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
je 0x10ec821
push 2
lea ecx, [ebp - 0x3908]
push ecx
lea edx, [ebp - 0x36f4]
push edx
push 0x100d084
lea eax, [ebp - 0x38f4]
push eax
lea ecx, [ebp - 0x38f8]
call fcn.011174f0
test eax, eax
jne 0x10ec81c
call fcn.010947d0
mov dword [ebp - 0x545c], eax
push 0x1a89
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d05c
mov ecx, dword [ebp - 0x545c]
push ecx
mov edx, dword [ebp - 0x545c]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
call ecx
add esp, 0xc
jmp 0x10ec8ef
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc4]
mov edx, dword [eax + 0x18]
call edx
mov dword [ebp - 0x5460], eax
mov eax, dword [ebp - 0x5460]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x5460]
mov eax, dword [edx + 0x2c]
call eax
test eax, eax
jne 0x10ec8ef
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x64]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5464], eax
mov ecx, dword [ebp - 0x5464]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5464]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x3a10], eax
lea ecx, [ebp - 0x3a10]
mov dword [ebp - 0x36f0], ecx
push 3
lea edx, [ebp - 0x3908]
push edx
lea eax, [ebp - 0x36f4]
push eax
push 0x100d084
lea ecx, [ebp - 0x38f4]
push ecx
lea ecx, [ebp - 0x38f8]
call fcn.011174f0
test eax, eax
jne 0x10ec8ef
call fcn.010947d0
mov dword [ebp - 0x5468], eax
push 0x1a93
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d05c
mov edx, dword [ebp - 0x5468]
push edx
mov eax, dword [ebp - 0x5468]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
call edx
add esp, 0xc
mov eax, dword [ebp - 0xc4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x546c], eax
mov ecx, dword [ebp - 0x546c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x546c]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
je 0x10eca64
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x3a14], eax
mov dword [ebp - 0x3a18], 0
cmp dword [ebp - 0x3a14], 0
je 0x10ec968
mov ecx, dword [ebp - 0x3a14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x3a14]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x3a18], eax
jmp 0x10ec983
mov ecx, dword [ebp - 0x3a14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x3a14]
mov eax, dword [edx + 0x1c]
call eax
mov dword [ebp - 0x3a18], eax
cmp dword [ebp - 0x3a18], 0
je 0x10ec9a8
mov ecx, dword [ebp - 0x3a18]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x3a18]
mov eax, dword [edx + 0x58]
call eax
cmp dword [eax], 6
jne 0x10ec9a6
jmp 0x10ec9a8
jmp 0x10ec96a
cmp dword [ebp - 0x3a18], 0
je 0x10eca06
push 1
mov ecx, dword [ebp - 0x50]
push ecx
mov edx, dword [ebp - 0x3a18]
push edx
mov ecx, dword [ebp - 0x5214]
call fcn.010d90c0
test eax, eax
jne 0x10eca04
call fcn.010947d0
mov dword [ebp - 0x5470], eax
push 0x1aa9
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d03c
mov eax, dword [ebp - 0x5470]
push eax
mov ecx, dword [ebp - 0x5470]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
add esp, 0xc
jmp 0x10eca62
cmp dword [ebp - 0xb8], 0
je 0x10eca62
push 1
mov ecx, dword [ebp - 0x50]
push ecx
mov edx, dword [ebp - 0xb8]
push edx
mov ecx, dword [ebp - 0x5214]
call fcn.010d90c0
test eax, eax
jne 0x10eca62
call fcn.010947d0
mov dword [ebp - 0x5474], eax
push 0x1ab0
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d03c
mov eax, dword [ebp - 0x5474]
push eax
mov ecx, dword [ebp - 0x5474]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
add esp, 0xc
jmp 0x10ecac0
cmp dword [ebp - 0xb8], 0
je 0x10ecac0
push 1
mov ecx, dword [ebp - 0x50]
push ecx
mov edx, dword [ebp - 0xb8]
push edx
mov ecx, dword [ebp - 0x5214]
call fcn.010d90c0
test eax, eax
jne 0x10ecac0
call fcn.010947d0
mov dword [ebp - 0x5478], eax
push 0x1abb
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d03c
mov eax, dword [ebp - 0x5478]
push eax
mov ecx, dword [ebp - 0x5478]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38f8]
call fcn.01092b10
cmp dword [ebp - 0x8cc], 0
je 0x10ecaed
mov ecx, dword [ebp - 0x8cc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x8cc]
mov eax, dword [edx]
call eax
jmp 0x10ed62c
mov ecx, dword [ebp - 0x68]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x547c], eax
mov ecx, dword [ebp - 0x547c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x547c]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
je 0x10ed62c
mov ecx, dword [ebp - 0xdc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xdc]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x5480], eax
mov ecx, dword [ebp - 0x5480]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5480]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
jne 0x10ed62c
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x64]
call eax
test eax, eax
jne 0x10ecb7a
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x70]
call eax
test eax, eax
je 0x10ed2f7
call fcn.010946d0
mov dword [ebp - 0x3c20], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x5484], eax
mov ecx, dword [ebp - 0x5484]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5484]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x5488], eax
push 0
lea ecx, [ebp - 0x4468]
push ecx
lea edx, [ebp - 0x4e98]
push edx
lea eax, [ebp - 0x446c]
push eax
lea ecx, [ebp - 0x4264]
push ecx
mov edx, dword [ebp - 0x5488]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x5488]
mov edx, dword [eax + 0x18]
call edx
mov word [ebp - 0x4464], 0
push 0x1fe
push 0
lea eax, [ebp - 0x4462]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov word [ebp - 0x4e94], 0
push 0x1fe
push 0
lea ecx, [ebp - 0x4e92]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x64]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x64]
mov edx, dword [eax + 0x14]
call edx
mov dword [ebp - 0x548c], eax
mov eax, dword [ebp - 0x548c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x548c]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x5490], eax
mov ecx, dword [ebp - 0x64]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x64]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x5490]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5490]
mov eax, dword [edx + 0x28]
call eax
push eax
push 0x100
lea ecx, [ebp - 0x4464]
push ecx
mov edx, dword [ebp - 0x3c20]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x3c20]
mov edx, dword [eax + 0x2c]
call edx
test eax, eax
jne 0x10eccc9
call fcn.010947d0
mov dword [ebp - 0x5494], eax
push 0x1ad7
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d12c
mov eax, dword [ebp - 0x5494]
push eax
mov ecx, dword [ebp - 0x5494]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
add esp, 0xc
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x5498], eax
mov ecx, dword [ebp - 0x5498]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5498]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x549c], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x549c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x549c]
mov eax, dword [edx + 0x28]
call eax
push eax
push 0x100
lea ecx, [ebp - 0x4e94]
push ecx
mov edx, dword [ebp - 0x3c20]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x3c20]
mov edx, dword [eax + 0x2c]
call edx
test eax, eax
jne 0x10ecd72
call fcn.010947d0
mov dword [ebp - 0x54a0], eax
push 0x1add
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d104
mov eax, dword [ebp - 0x54a0]
push eax
mov ecx, dword [ebp - 0x54a0]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
add esp, 0xc
mov word [ebp - 0x3e24], 0
push 0x1fe
push 0
lea ecx, [ebp - 0x3e22]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov word [ebp - 0x4224], 0
push 0x1fe
push 0
lea edx, [ebp - 0x4222]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
push 0x1008618
lea eax, [ebp - 0x4464]
push eax
push 0x10085f8
lea ecx, [ebp - 0x3e24]
push ecx
call sub.ntdll.dll_swprintf
add esp, 0x10
mov word [ebp - 0x4024], 0
push 0x1fe
push 0
lea edx, [ebp - 0x4022]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x4e94]
push eax
push 0x10085b8
lea ecx, [ebp - 0x4024]
push ecx
call sub.ntdll.dll_swprintf
add esp, 0xc
push 0
push 0x80
push 3
push 0
push 7
push 0xc0000000
lea edx, [ebp - 0x4024]
push edx
call fcn.01091ef0
mov dword [ebp - 0x3c24], eax
cmp dword [ebp - 0x3c24], 0xffffffff
je 0x10ece6f
mov dword [ebp - 0x4e9c], 0
push 0
lea eax, [ebp - 0x4e9c]
push eax
push 0
push 0
push 0
push 0
push 0x56c008
mov ecx, dword [ebp - 0x3c24]
push ecx
call fcn.010927b0
mov edx, dword [ebp - 0x3c24]
push edx
call fcn.01092350
lea eax, [ebp - 0x4e94]
push eax
push 0x10085d4
lea ecx, [ebp - 0x4224]
push ecx
call sub.ntdll.dll_swprintf
add esp, 0xc
push 0
lea edx, [ebp - 0x4224]
push edx
call fcn.01092930
test eax, eax
jne 0x10eceb9
lea eax, [ebp - 0x4224]
push eax
mov ecx, dword [ebp - 0x5214]
call fcn.010d8fe0
test eax, eax
jne 0x10eceb9
xor eax, eax
jmp 0x10eddb3
lea ecx, [ebp - 0x4c6c]
call fcn.011b1f30
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x4224]
push ecx
lea edx, [ebp - 0x3e24]
push edx
lea ecx, [ebp - 0x4c6c]
call fcn.0111d760
test eax, eax
jne 0x10ecf0f
mov dword [ebp - 0x5204], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c6c]
call fcn.01092b10
mov eax, dword [ebp - 0x5204]
jmp 0x10eddb3
push 0x200
push 0
lea eax, [ebp - 0x3e24]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push 0x200
push 0
lea ecx, [ebp - 0x4224]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
push 0x1008570
lea edx, [ebp - 0x4e94]
push edx
push 0x10085f8
lea eax, [ebp - 0x3e24]
push eax
call sub.ntdll.dll_swprintf
add esp, 0x10
lea ecx, [ebp - 0x4e94]
push ecx
push 0x100d010
lea edx, [ebp - 0x4224]
push edx
call sub.ntdll.dll_swprintf
add esp, 0xc
lea eax, [ebp - 0x4224]
push eax
lea ecx, [ebp - 0x3e24]
push ecx
lea ecx, [ebp - 0x4c6c]
call fcn.0111d810
test eax, eax
jne 0x10ecfba
mov dword [ebp - 0x5208], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c6c]
call fcn.01092b10
mov eax, dword [ebp - 0x5208]
jmp 0x10eddb3
push 0x200
push 0
lea edx, [ebp - 0x3e24]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
push 0x200
push 0
lea eax, [ebp - 0x4224]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push 0x100d1e4
lea ecx, [ebp - 0x4464]
push ecx
push 0x10084b4
lea edx, [ebp - 0x3e24]
push edx
call sub.ntdll.dll_swprintf
add esp, 0x10
lea eax, [ebp - 0x4e94]
push eax
push 0x1008488
lea ecx, [ebp - 0x4224]
push ecx
call sub.ntdll.dll_swprintf
add esp, 0xc
lea edx, [ebp - 0x4224]
push edx
lea eax, [ebp - 0x3e24]
push eax
lea ecx, [ebp - 0x4c6c]
call fcn.0111d810
test eax, eax
jne 0x10ed065
mov dword [ebp - 0x520c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c6c]
call fcn.01092b10
mov eax, dword [ebp - 0x520c]
jmp 0x10eddb3
lea ecx, [ebp - 0x3e24]
push ecx
call fcn.010922c0
mov word [ebp - 0x3c1c], 0
push 0x1fe
push 0
lea edx, [ebp - 0x3c1a]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x4e94]
push eax
push 0x10085b8
lea ecx, [ebp - 0x3c1c]
push ecx
call sub.ntdll.dll_swprintf
add esp, 0xc
mov edx, dword [ebp - 0x50]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x50]
mov edx, dword [eax + 0x14]
call edx
mov dword [ebp - 0x54a4], eax
mov eax, dword [ebp - 0x54a4]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x54a4]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x54a8], eax
mov ecx, dword [ebp - 0x54a8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x54a8]
mov eax, dword [edx + 0x28]
call eax
push eax
lea ecx, [ebp - 0x4c94]
call fcn.01119d00
mov byte [ebp - 4], 7
push 0
mov ecx, dword [ebp - 0x5214]
call fcn.010d9a90
test eax, eax
je 0x10ed183
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x54ac], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x54b0], eax
mov ecx, dword [ebp - 0x80]
push ecx
mov edx, dword [ebp - 0x84]
push edx
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x54ac]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x54ac]
mov eax, dword [edx + 0x14]
call eax
push eax
mov ecx, dword [ebp - 0x54b0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x54b0]
mov eax, dword [edx + 0x28]
call eax
push eax
lea ecx, [ebp - 0x4c94]
call fcn.0111c6f0
jmp 0x10ed254
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
mov dword [ebp - 0x54b8], eax
mov dword [ebp - 0x54b4], edx
mov ecx, dword [ebp - 0x54b8]
cmp ecx, dword [ebp - 0x84]
jne 0x10ed1b5
mov edx, dword [ebp - 0x54b4]
cmp edx, dword [ebp - 0x80]
je 0x10ed1cc
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x54c0], eax
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x54bc], ecx
jmp 0x10ed1e5
mov edx, dword [ebp - 0x50]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x50]
mov edx, dword [eax + 0x1c]
call edx
mov dword [ebp - 0x54c0], eax
mov dword [ebp - 0x54bc], edx
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x54c4], eax
mov ecx, dword [ebp - 0x54c4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x54c4]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x54c8], eax
mov ecx, dword [ebp - 0x54bc]
push ecx
mov edx, dword [ebp - 0x54c0]
push edx
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x54c8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x54c8]
mov eax, dword [edx + 0x14]
call eax
push eax
lea ecx, [ebp - 0x3c1c]
push ecx
lea ecx, [ebp - 0x4c94]
call fcn.0111bb70
push 0x38
push 0
lea edx, [ebp - 0x425c]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x5214]
mov ecx, dword [eax + 0x18]
mov edx, dword [ebp - 0x5214]
mov eax, dword [edx + 0x18]
mov edx, dword [ecx]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x4258], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x54cc], eax
mov ecx, dword [ebp - 0x54cc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x54cc]
mov eax, dword [edx + 0x28]
call eax
mov dword [ebp - 0x4254], eax
mov dword [ebp - 0x423c], 2
push 0
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x425c]
push edx
mov ecx, dword [ebp - 0x5214]
call fcn.010f4500
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x4c94]
call fcn.01092b10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c6c]
call fcn.01092b10
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
mov esi, eax
mov edi, edx
mov ecx, dword [ebp - 0xc0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc0]
mov eax, dword [edx + 0x1c]
call eax
mov dword [ebp - 0x54d4], esi
mov dword [ebp - 0x54d0], edi
mov dword [ebp - 0x54dc], eax
mov dword [ebp - 0x54d8], edx
mov ecx, dword [ebp - 0x54d4]
cmp ecx, dword [ebp - 0x54dc]
jne 0x10ed353
mov edx, dword [ebp - 0x54d0]
cmp edx, dword [ebp - 0x54d8]
je 0x10ed618
call fcn.010946d0
mov dword [ebp - 0x4ea4], eax
lea ecx, [ebp - 0x50b8]
call fcn.01114a50
mov dword [ebp - 4], 8
mov word [ebp - 0x51cc], 0
push 0xfe
push 0
lea eax, [ebp - 0x51ca]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x54e0], eax
mov ecx, dword [ebp - 0x54e0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x54e0]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x54e4], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x54e4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x54e4]
mov eax, dword [edx + 0x28]
call eax
push eax
push 0x80
lea ecx, [ebp - 0x51cc]
push ecx
mov edx, dword [ebp - 0x4ea4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x4ea4]
mov edx, dword [eax + 0x2c]
call edx
mov word [ebp - 0x50b4], 0
push 0x1fe
push 0
lea eax, [ebp - 0x50b2]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x54e8], eax
mov ecx, dword [ebp - 0x54e8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x54e8]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x54ec], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x54ec]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x54ec]
mov eax, dword [edx + 0x28]
call eax
push eax
mov ecx, dword [ebp - 0x4ea4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x4ea4]
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x54f0], eax
mov ecx, dword [ebp - 0x54f0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x54f0]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x54f4], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x54f4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x54f4]
mov eax, dword [edx + 0x28]
call eax
push eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x28]
call eax
push eax
mov ecx, dword [ebp - 0x4ea4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x4ea4]
mov eax, dword [edx + 0xc]
call eax
lea ecx, [ebp - 0x51cc]
push ecx
push 0x100cfb8
lea edx, [ebp - 0x50b4]
push edx
call sub.ntdll.dll_swprintf
add esp, 0xc
mov dword [ebp - 0x4eb4], 0
xor eax, eax
mov dword [ebp - 0x4eb0], eax
mov dword [ebp - 0x4eac], eax
mov dword [ebp - 0x4ea8], eax
mov dword [ebp - 0x50c8], 0
xor ecx, ecx
mov dword [ebp - 0x50c4], ecx
mov dword [ebp - 0x50c0], ecx
mov dword [ebp - 0x50bc], ecx
mov edx, dword [ebp - 0xc4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xc4]
mov edx, dword [eax + 0xc]
call edx
mov dword [ebp - 0x4eb4], eax
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x50c8], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x54f8], eax
mov ecx, dword [ebp - 0x54f8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x54f8]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x4ea0], eax
lea ecx, [ebp - 0x4ea0]
mov dword [ebp - 0x50c4], ecx
mov dword [ebp - 0x50c0], 4
push 0
mov edx, dword [ebp - 0x50]
push edx
mov eax, dword [ebp - 0xb8]
push eax
mov ecx, dword [ebp - 0x5214]
call fcn.010d90c0
test eax, eax
jne 0x10ed606
call fcn.010947d0
mov dword [ebp - 0x54fc], eax
push 0x1b5d
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100d03c
mov ecx, dword [ebp - 0x54fc]
push ecx
mov edx, dword [ebp - 0x54fc]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
call ecx
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50b8]
call fcn.01092b10
cmp dword [ebp - 0x50], 0
je 0x10ed62c
push 0x100cfa0
mov edx, dword [ebp - 0x50]
push edx
call fcn.011144e0
jmp 0x10ed74f
cmp dword [ebp - 0xd4], 0
je 0x10ed74f
cmp dword [ebp - 0x364], 1
jne 0x10ed6c1
cmp dword [ebp - 0xc0], 0
je 0x10ed6c1
mov eax, dword [ebp - 0x68]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x68]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x5500], eax
mov ecx, dword [ebp - 0x5500]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5500]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
jne 0x10ed6bc
mov ecx, dword [ebp - 0x78]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x78]
mov eax, dword [edx + 0x30]
call eax
test eax, eax
jne 0x10ed6bc
mov ecx, dword [ebp - 0x48]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
mov eax, dword [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
mov edx, dword [ebp - 0xc0]
push edx
mov eax, dword [ebp - 0xb4]
push eax
mov ecx, dword [ebp - 0x54]
push ecx
lea edx, [ebp - 0x44]
push edx
mov ecx, dword [ebp - 0x5214]
call fcn.010f2cd0
jmp 0x10ed74f
lea ecx, [ebp - 0x51d0]
call fcn.01114a50
mov dword [ebp - 4], 9
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
push ecx
mov edx, dword [eax + 0x18]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [edx + 0x10]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
lea ecx, [ebp - 0x51d0]
call fcn.01114f60
test eax, eax
jne 0x10ed73d
call fcn.010947d0
mov dword [ebp - 0x5504], eax
push 0x1b78
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100cad4
mov ecx, dword [ebp - 0x5504]
push ecx
mov edx, dword [ebp - 0x5504]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
call ecx
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x51d0]
call fcn.01092b10
mov edx, dword [ebp - 0x68]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x68]
mov edx, dword [eax + 0x20]
call edx
mov dword [ebp - 0x5508], eax
mov eax, dword [ebp - 0xdc]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xdc]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 0x550c], eax
mov ecx, dword [ebp - 0x550c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x550c]
mov eax, dword [edx + 0x28]
call eax
mov esi, eax
mov ecx, dword [ebp - 0x5508]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5508]
mov eax, dword [edx + 0x28]
call eax
cmp eax, esi
jne 0x10ed7fe
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0xdc]
push edx
mov eax, dword [ebp - 0x68]
push eax
mov ecx, dword [ebp - 0x5214]
call fcn.010d58b0
test eax, eax
jne 0x10ed7fe
call fcn.010947d0
mov dword [ebp - 0x5510], eax
push 0x1b84
push 0x100c14c
call fcn.010d9b60
push eax
push 0x100cf70
mov ecx, dword [ebp - 0x5510]
push ecx
mov edx, dword [ebp - 0x5510]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
call ecx
add esp, 0xc
mov edx, dword [ebp - 0x50]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x50]
mov edx, dword [eax + 0x18]
call edx
mov dword [ebp - 0x5514], eax
mov eax, dword [ebp - 0x5514]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x5514]
mov eax, dword [edx + 0x68]
call eax
test eax, eax
je 0x10ed87c
call fcn.010946d0
mov dword [ebp - 0x51d4], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5518], eax
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x5518]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5518]
mov eax, dword [edx + 0x28]
call eax
push eax
mov ecx, dword [ebp - 0x51d4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x51d4]
mov eax, dword [edx + 0x18]
call eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc0]
call eax
mov dword [ebp - 0x51e8], eax
xor ecx, ecx
mov byte [ebp - 0x520d], cl
lea edx, [ebp - 0x520d]
push edx
mov eax, dword [ebp - 0x51e8]
push eax
lea ecx, [ebp - 0x51e4]
call fcn.01089110
mov dword [ebp - 4], 0xa
push 0x1001464
lea ecx, [ebp - 0x51e4]
call fcn.0109e490
lea ecx, [ebp - 0x51e4]
call fcn.01089160
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0xbc]
call eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x51e4]
call fcn.01089140
push 0x1004afc
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 0x3c]
call eax
push 0x64
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx + 8]
call eax
cmp dword [ebp - 0xd4], 0
je 0x10eda51
cmp dword [ebp - 0xc0], 0
je 0x10eda51
cmp dword [ebp - 0x364], 0
jne 0x10eda51
mov ecx, dword [ebp - 0xc0]
mov dword [ebp - 0x50], ecx
mov edx, dword [ebp - 0xd8]
mov dword [ebp - 0xc4], edx
mov eax, dword [ebp - 0xc0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xc0]
mov eax, dword [edx + 0x48]
call eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], edx
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x551c], eax
mov ecx, dword [ebp - 0x551c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x551c]
mov eax, dword [edx + 0x28]
call eax
mov dword [ebp - 0xa0], eax
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x1c]
call eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x90], edx
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov eax, dword [edx + 0x1c]
call eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], edx
mov ecx, dword [ebp - 0xc4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5520], eax
mov ecx, dword [ebp - 0x5520]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5520]
mov eax, dword [edx + 0x14]
call eax
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xa0]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x94]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 0x90]
mov dword [eax + 0x14], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xcc]
mov dword [eax + 0x18], ecx
mov edx, dword [ebp - 0xc8]
mov dword [eax + 0x1c], edx
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xdc], eax
jmp 0x10eda70
cmp dword [ebp - 0x364], 1
jne 0x10eda6e
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xbc]
mov eax, dword [edx]
call eax
jmp 0x10eda70
jmp 0x10eda75
jmp 0x10e96a5
cmp dword [ebp - 0x6c], 1
jne 0x10edab2
cmp dword [ebp - 0xd4], 0
je 0x10edab2
cmp dword [ebp - 0xb0], 0
je 0x10edab2
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb0]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x51ec], eax
mov ecx, dword [ebp - 0x51ec]
push ecx
call fcn.010cb770
cmp dword [ebp - 0xd4], 0
je 0x10edd2f
cmp dword [ebp - 0xb0], 0
je 0x10edd2f
mov edx, dword [ebp - 0xb0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xb0]
mov edx, dword [eax + 0x100]
call edx
test eax, eax
je 0x10edc14
mov eax, dword [ebp - 0xb0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xb0]
mov eax, dword [edx + 0xfc]
call eax
test eax, eax
je 0x10edc14
mov ecx, dword [ebp - 0x9c]
or ecx, dword [ebp - 0x98]
jne 0x10edc14
mov edx, dword [ebp - 0xb0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xb0]
mov edx, dword [eax + 0x18]
call edx
mov dword [ebp - 0x5524], eax
mov eax, dword [ebp - 0xb0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0xb0]
mov eax, dword [edx + 0x48]
call eax
push edx
push eax
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb0]
mov eax, dword [edx + 0x48]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x5524]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5524]
mov eax, dword [edx + 0x28]
call eax
push eax
call fcn.010cd8d0
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb0]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5528], eax
mov ecx, dword [ebp - 0x5528]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5528]
mov eax, dword [edx + 0x28]
call eax
mov ecx, dword [ebp - 0x5214]
mov dword [ecx + 0x107c], eax
mov edx, dword [ebp - 0xb0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xb0]
mov edx, dword [eax + 0x1c]
call edx
mov ecx, dword [ebp - 0x5214]
mov dword [ecx + 0x1080], eax
mov dword [ecx + 0x1084], edx
mov edx, dword [ebp - 0x5214]
mov eax, dword [ebp - 0x5214]
mov ecx, dword [eax + 0x107c]
mov dword [edx + 0x1088], ecx
mov edx, dword [ebp - 0x5214]
mov eax, dword [ebp - 0x5214]
mov ecx, dword [eax + 0x1080]
mov dword [edx + 0x1090], ecx
mov eax, dword [eax + 0x1084]
mov dword [edx + 0x1094], eax
jmp 0x10edcfc
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb0]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x552c], eax
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb0]
mov eax, dword [edx + 0x48]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x98]
push ecx
mov edx, dword [ebp - 0x9c]
push edx
mov eax, dword [ebp - 0x552c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x552c]
mov eax, dword [edx + 0x28]
call eax
push eax
call fcn.010cd8d0
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb0]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5530], eax
mov ecx, dword [ebp - 0x5530]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5530]
mov eax, dword [edx + 0x28]
call eax
mov ecx, dword [ebp - 0x5214]
mov dword [ecx + 0x107c], eax
mov edx, dword [ebp - 0xb0]
mov eax, dword [edx]
mov ecx, dword [ebp - 0xb0]
mov edx, dword [eax + 0x1c]
call edx
mov ecx, dword [ebp - 0x5214]
mov dword [ecx + 0x1080], eax
mov dword [ecx + 0x1084], edx
mov edx, dword [ebp - 0x5214]
mov eax, dword [ebp - 0x5214]
mov ecx, dword [eax + 0x107c]
mov dword [edx + 0x1088], ecx
mov edx, dword [ebp - 0x5214]
mov eax, dword [ebp - 0x9c]
mov dword [edx + 0x1090], eax
mov ecx, dword [ebp - 0x98]
mov dword [edx + 0x1094], ecx
mov edx, dword [ebp - 0x5214]
mov byte [edx + 0x1078], 1
mov eax, dword [ebp - 0x5214]
mov byte [eax + 0x1079], 1
mov ecx, dword [ebp - 0x5214]
mov edx, dword [ecx + 0x18]
mov eax, dword [ebp - 0x5214]
mov ecx, dword [eax + 0x18]
mov edx, dword [edx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x5214]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5214]
mov eax, dword [edx + 0xe0]
call eax
cmp dword [ebp - 0xd4], 0
je 0x10edd95
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb0]
mov eax, dword [edx + 0x18]
call eax
mov dword [ebp - 0x5534], eax
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb0]
mov eax, dword [edx + 0x48]
call eax
push edx
push eax
mov ecx, dword [ebp - 0x5534]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x5534]
mov eax, dword [edx + 0x28]
call eax
push eax
call fcn.010ceae0
cmp dword [ebp - 0xb0], 0
je 0x10eddb0
mov ecx, dword [ebp - 0xb0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xb0]
mov eax, dword [edx]
call eax
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8