Function at 0x10026d03
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006cda9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1174
call fcn.10068b20
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100291df
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x394], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x304], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x304]
movzx eax, byte [eax]
test eax, eax
je 0x10026da3
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x38c]
movzx eax, byte [eax]
test eax, eax
je 0x10026d9e
push 0x1a75
push 0x15ae
push 0x259b
push 0x3a7
push 0x78f
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
jmp 0x100291dd
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x374], 0xb26bdde0
push 0x173b
push 0x7404
push 0
lea eax, [ebp - 0x374]
push eax
call fcn.1002b814
add esp, 0x10
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc0]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x88], 7
mov dword [ebp - 0x3a8], 0x75b167d3
mov dword [ebp - 0x1c], 0
jmp 0x10026e13
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x10026e26
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x34], 1
jmp 0x10026e0c
mov dword [ebp - 0x1c], 0
jmp 0x10026e36
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x10026e4c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x94], 0xd77cccae
jmp 0x10026e2f
mov dword [ebp - 0x1c], 0
jmp 0x10026e5c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10026e72
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3e0], 0xffffffff
jmp 0x10026e55
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x34], 0
jmp 0x10026e97
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x34], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34], 0x1b
jg 0x10027133
mov dword [ebp - 0x78], 0xfffffffa
mov dword [ebp - 0x318], 0x7276
mov dword [ebp - 0xbc], 0
jmp 0x10026ed2
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x10026eee
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0xec], 0xfffffff9
jmp 0x10026ec5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x34], 0
jne 0x10026f07
mov dword [ebp - 0x240], 1
jmp 0x10026f0e
and dword [ebp - 0x240], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x370], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xec], eax
mov eax, dword [ebp - 0x310]
cmp eax, dword [ebp - 0x370]
jne 0x10026f5f
mov dword [ebp - 0x188], 1
jmp 0x10026f66
and dword [ebp - 0x188], 0
cmp dword [ebp - 0x188], 0x600d5493
jle 0x10026f7e
mov dword [ebp - 0x2ec], 1
jmp 0x10026f85
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x2ec], eax
jle 0x10026f9c
mov dword [ebp - 0x2f4], 1
jmp 0x10026fa3
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x88], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
cmp dword [ebp - 0x88], eax
jle 0x10026fcd
mov dword [ebp - 0x28c], 1
jmp 0x10026fd4
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x240]
add eax, dword [ebp - 0x28c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x94]
je 0x10026ffb
mov dword [ebp - 0x130], 1
jmp 0x10027002
and dword [ebp - 0x130], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
cmp dword [ebp - 0x130], eax
jle 0x10027020
mov dword [ebp - 0x294], 1
jmp 0x10027027
and dword [ebp - 0x294], 0
cmp dword [ebp - 0x294], 6
je 0x1002703c
mov dword [ebp - 0x138], 1
jmp 0x10027043
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x138], eax
jl 0x1002705a
mov dword [ebp - 0x29c], 1
jmp 0x10027061
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x29c], eax
jg 0x10027078
mov dword [ebp - 0x140], 1
jmp 0x1002707f
and dword [ebp - 0x140], 0
cmp dword [ebp - 0x140], 8
jne 0x10027094
mov dword [ebp - 0x2a4], 1
jmp 0x1002709b
and dword [ebp - 0x2a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x94]
cmp dword [ebp - 0x2a4], eax
je 0x100270bc
mov dword [ebp - 0x148], 1
jmp 0x100270c3
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x148], eax
jl 0x100270e7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x94], 0
jne 0x100270e7
and dword [ebp - 0x2ac], 0
jmp 0x100270f1
mov dword [ebp - 0x2ac], 1
cmp dword [ebp - 0x2ac], 1
jne 0x10027106
mov dword [ebp - 0x150], 1
jmp 0x1002710d
and dword [ebp - 0x150], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x150]
mov dword [ebp + eax - 0x94], ecx
cmp dword [ebp - 0x318], 0
je 0x1002712e
jmp 0x10026e82
jmp 0x10026e82
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x2b4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2b4]
mov dword [ebp + eax - 0x94], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
cmp dword [ebp - 0x2b4], eax
je 0x10027170
mov dword [ebp - 0x168], 1
jmp 0x10027177
and dword [ebp - 0x168], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
cmp dword [ebp - 0x88], eax
jg 0x10027195
mov dword [ebp - 0x158], 1
jmp 0x1002719c
and dword [ebp - 0x158], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3e0]
cmp dword [ebp - 0x158], eax
jne 0x100271bc
mov dword [ebp - 0x2bc], 1
jmp 0x100271c3
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x3a8]
cmp dword [ebp - 0x2bc], eax
jl 0x100271dd
mov dword [ebp - 0x160], 1
jmp 0x100271e4
and dword [ebp - 0x160], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x160]
sub ecx, dword [ebp + eax - 0x3e0]
cmp ecx, dword [ebp - 0x88]
jg 0x1002720b
mov dword [ebp - 0x2c4], 1
jmp 0x10027212
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x2c4]
add eax, 0xfff6
cmp eax, 0xa103363
jle 0x10027230
mov dword [ebp - 0x320], 1
jmp 0x10027237
and dword [ebp - 0x320], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3e0], 0xffffffff
jne 0x10027253
mov dword [ebp - 0x2cc], 1
jmp 0x1002725a
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x168]
cmp eax, dword [ebp - 0x2cc]
jge 0x10027274
mov dword [ebp - 0x170], 1
jmp 0x1002727b
and dword [ebp - 0x170], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3e0]
cmp eax, dword [ebp - 0x170]
je 0x1002729b
mov dword [ebp - 0x2d4], 1
jmp 0x100272a2
and dword [ebp - 0x2d4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2d4]
mov dword [ebp + eax - 0x34], ecx
and dword [ebp - 0x114], 0
jmp 0x100272d1
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x24]
add eax, 0x28
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc0]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x114], eax
jge 0x100291dd
mov dword [ebp - 0x68], 0xffffffff
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x460], 0xfffffffa
lea eax, [ebp - 0x64]
push eax
push 0x1f3b
lea eax, [ebp - 0x68]
push eax
push 1
push 0
call fcn.100249d3
add esp, 0x14
mov dword [ebp - 0x64], 0xa
jmp 0x1002732a
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x13
jg 0x10027444
mov dword [ebp - 0x2dc], 0xe00f6802
mov dword [ebp - 0x68], 0xfffffff7
jmp 0x1002734e
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x10
jg 0x1002743f
mov dword [ebp - 0xc8], 0
jmp 0x10027371
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jge 0x1002738d
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x300], 0xffffffff
jmp 0x10027364
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x300], 1
jmp 0x100273bb
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x300]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x300], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x300], 0xfffffff3
jle 0x10027427
mov dword [ebp - 0x378], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x300]
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x440], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x68]
cmp dword [ebp + eax - 0x300], ecx
jne 0x1002740f
mov dword [ebp - 0x178], 1
jmp 0x10027416
and dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x378], eax
jmp 0x100273a0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2dc]
mov dword [ebp + eax - 0x300], ecx
jmp 0x10027347
jmp 0x10027323
mov dword [ebp - 0x3bc], 0x32667a87
mov dword [ebp - 0x328], 0x1b08
cmp dword [ebp - 0x328], 0x101e
jge 0x100278b2
and dword [ebp - 0x420], 0
and dword [ebp - 0x41c], 0
and dword [ebp - 0x418], 0
mov dword [ebp - 0x414], 1
or dword [ebp - 0x410], 0xffffffff
and dword [ebp - 0x40c], 0
mov dword [ebp - 0x408], 1
or dword [ebp - 0x404], 0xffffffff
and dword [ebp - 0x400], 0
and dword [ebp - 0x3fc], 0
lea eax, [ebp - 0x90]
push eax
push 0x100076f4
call fcn.1005533b
pop ecx
pop ecx
and dword [ebp - 0xd0], 0
jmp 0x100274dd
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0x10
jge 0x10027502
mov eax, dword [ebp - 0xd0]
lea eax, [ebp + eax*4 - 0x500]
push eax
push 0x100076f4
call fcn.1005533b
pop ecx
pop ecx
jmp 0x100274d0
and dword [ebp - 0xa8], 0
jmp 0x10027518
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x14
jge 0x10027572
and dword [ebp - 0xac], 0
jmp 0x10027537
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x14
jge 0x10027570
mov eax, 0x640
imul eax, eax, 0
lea eax, [ebp + eax - 0x1180]
imul ecx, dword [ebp - 0xa8], 0x50
add eax, ecx
mov ecx, dword [ebp - 0xac]
lea eax, [eax + ecx*4]
push eax
push 0x100076f4
call fcn.1005533b
pop ecx
pop ecx
jmp 0x1002752a
jmp 0x1002750b
mov dword [ebp - 0x2c], 1
jmp 0x10027582
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x90]
jg 0x10027782
and dword [ebp - 0x28], 0
jmp 0x1002759e
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x14
jge 0x1002777d
and dword [ebp - 0x30], 0
jmp 0x100275b5
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x14
jge 0x10027778
and dword [ebp - 0x108], 0
and dword [ebp - 0x80], 0
jmp 0x100275d3
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 5
jge 0x10027667
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x28]
add ecx, dword [ebp + eax*4 - 0x420]
mov dword [ebp - 0x110], ecx
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x30]
add ecx, dword [ebp + eax*4 - 0x40c]
mov dword [ebp - 0xf4], ecx
cmp dword [ebp - 0x110], 0
jl 0x10027662
cmp dword [ebp - 0x110], 0x14
jge 0x10027662
cmp dword [ebp - 0xf4], 0
jl 0x10027662
cmp dword [ebp - 0xf4], 0x14
jge 0x10027662
mov eax, dword [ebp - 0x2c]
dec eax
and eax, 0x80000001
jns 0x10027637
dec eax
or eax, 0xfffffffe
inc eax
imul eax, eax, 0x640
lea eax, [ebp + eax - 0x1180]
imul ecx, dword [ebp - 0x110], 0x50
add eax, ecx
mov ecx, dword [ebp - 0xf4]
mov edx, dword [ebp - 0x108]
add edx, dword [eax + ecx*4]
mov dword [ebp - 0x108], edx
jmp 0x100275cc
mov eax, dword [ebp - 0x2c]
dec eax
and eax, 0x80000001
jns 0x10027677
dec eax
or eax, 0xfffffffe
inc eax
imul eax, eax, 0x640
lea eax, [ebp + eax - 0x1180]
imul ecx, dword [ebp - 0x28], 0x50
add eax, ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x108]
add eax, dword [ebp + ecx*4 - 0x500]
mov ecx, dword [ebp - 0x2c]
and ecx, 0x80000001
jns 0x100276ad
dec ecx
or ecx, 0xfffffffe
inc ecx
imul ecx, ecx, 0x640
lea ecx, [ebp + ecx - 0x1180]
imul edx, dword [ebp - 0x28], 0x50
add ecx, edx
mov edx, dword [ebp - 0x30]
mov dword [ecx + edx*4], eax
mov eax, dword [ebp - 0x2c]
and eax, 0x80000001
jns 0x100276d5
dec eax
or eax, 0xfffffffe
inc eax
imul eax, eax, 0x640
lea eax, [ebp + eax - 0x1180]
imul ecx, dword [ebp - 0x28], 0x50
add eax, ecx
mov ecx, dword [ebp - 0x30]
cmp dword [eax + ecx*4], 3
jle 0x1002771f
mov eax, dword [ebp - 0x2c]
and eax, 0x80000001
jns 0x10027700
dec eax
or eax, 0xfffffffe
inc eax
imul eax, eax, 0x640
lea eax, [ebp + eax - 0x1180]
imul ecx, dword [ebp - 0x28], 0x50
add eax, ecx
mov ecx, dword [ebp - 0x30]
mov dword [eax + ecx*4], 3
jmp 0x10027773
mov eax, dword [ebp - 0x2c]
and eax, 0x80000001
jns 0x1002772e
dec eax
or eax, 0xfffffffe
inc eax
imul eax, eax, 0x640
lea eax, [ebp + eax - 0x1180]
imul ecx, dword [ebp - 0x28], 0x50
add eax, ecx
mov ecx, dword [ebp - 0x30]
cmp dword [eax + ecx*4], 0
jge 0x10027773
mov eax, dword [ebp - 0x2c]
and eax, 0x80000001
jns 0x10027759
dec eax
or eax, 0xfffffffe
inc eax
imul eax, eax, 0x640
lea eax, [ebp + eax - 0x1180]
imul ecx, dword [ebp - 0x28], 0x50
add eax, ecx
mov ecx, dword [ebp - 0x30]
and dword [eax + ecx*4], 0
jmp 0x100275ae
jmp 0x10027597
jmp 0x1002757b
and dword [ebp - 0x5c], 0
jmp 0x1002778f
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0x14
jge 0x100278b2
and dword [ebp - 0x58], 0
jmp 0x100277a6
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0x14
jge 0x100278a2
mov eax, dword [ebp - 0x90]
and eax, 0x80000001
jns 0x100277c2
dec eax
or eax, 0xfffffffe
inc eax
imul eax, eax, 0x640
lea eax, [ebp + eax - 0x1180]
imul ecx, dword [ebp - 0x5c], 0x50
add eax, ecx
mov ecx, dword [ebp - 0x58]
cmp dword [eax + ecx*4], 0
jne 0x100277ee
push 0x10007c64
call fcn.1005556f
pop ecx
jmp 0x1002789d
mov eax, dword [ebp - 0x90]
and eax, 0x80000001
jns 0x10027800
dec eax
or eax, 0xfffffffe
inc eax
imul eax, eax, 0x640
lea eax, [ebp + eax - 0x1180]
imul ecx, dword [ebp - 0x5c], 0x50
add eax, ecx
mov ecx, dword [ebp - 0x58]
cmp dword [eax + ecx*4], 1
jne 0x10027829
push 0x10007ed4
call fcn.1005556f
pop ecx
jmp 0x1002789d
mov eax, dword [ebp - 0x90]
and eax, 0x80000001
jns 0x1002783b
dec eax
or eax, 0xfffffffe
inc eax
imul eax, eax, 0x640
lea eax, [ebp + eax - 0x1180]
imul ecx, dword [ebp - 0x5c], 0x50
add eax, ecx
mov ecx, dword [ebp - 0x58]
cmp dword [eax + ecx*4], 2
jne 0x10027864
push 0x10007ed8
call fcn.1005556f
pop ecx
jmp 0x1002789d
mov eax, dword [ebp - 0x90]
and eax, 0x80000001
jns 0x10027876
dec eax
or eax, 0xfffffffe
inc eax
imul eax, eax, 0x640
lea eax, [ebp + eax - 0x1180]
imul ecx, dword [ebp - 0x5c], 0x50
add eax, ecx
mov ecx, dword [ebp - 0x58]
cmp dword [eax + ecx*4], 3
jne 0x1002789d
push 0x10007edc
call fcn.1005556f
pop ecx
jmp 0x1002779f
push 0x10007ee0
call fcn.1005556f
pop ecx
jmp 0x10027788
mov dword [ebp - 0x448], 0xbf25cbd9
mov dword [ebp - 0x450], 0x734
mov dword [ebp - 0xcc], 0
jmp 0x100278df
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x100278fb
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x4c0], 0xf99f
jmp 0x100278d2
push 0x42e0
lea eax, [ebp - 0x3bc]
push eax
push 0
call fcn.100296bd
add esp, 0xc
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x24]
and eax, 0x20000000
je 0x1002792a
mov dword [ebp - 0x2e4], 1
jmp 0x10027931
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x3d4], eax
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0x330], 0xb7e59501
mov dword [ebp - 0x1b4], 0xafd55be9
mov dword [ebp - 0x380], 1
mov dword [ebp - 0xb4], 0
jmp 0x1002797b
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 4
jge 0x10027997
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x3d0], 4
jmp 0x1002796e
mov dword [ebp - 0x74], 0xb
jmp 0x100279a7
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jg 0x10027ce6
push 2
lea ecx, [ebp - 0xe8]
call fcn.1001e8dc
and dword [ebp - 4], 0
mov dword [ebp - 0xc4], 0xb3895196
mov dword [ebp - 0x23c], 0xffffffff
push 1
push 0x233a
push 0x50fd
push 0x4cf7
push 0x20c9
lea eax, [ebp - 0xe8]
push eax
push 0x67a6
push 0
push 0x62d0
push 1
push 0x12ba
push 0x30d8
lea eax, [ebp - 0x458]
push eax
push 0x222c
call fcn.10024d85
add esp, 0x38
push 0
lea ecx, [ebp - 0xe8]
call fcn.1001e97a
and dword [eax], 0
jmp 0x10027a55
push 0
lea ecx, [ebp - 0xe8]
call fcn.1001e97a
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x184]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x184]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xe8]
call fcn.1001e97a
cmp dword [eax], 4
jge 0x10027a83
push 0
lea ecx, [ebp - 0xe8]
call fcn.1001e97a
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x3d0], 0xce1e2c0d
jmp 0x10027a31
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3d0]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x10027aab
mov dword [ebp - 0x18c], 1
jmp 0x10027ab2
and dword [ebp - 0x18c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x74]
add ecx, dword [ebp - 0x18c]
cmp dword [ebp + eax - 0x3d0], ecx
je 0x10027ad6
mov dword [ebp - 0x2c8], 1
jmp 0x10027add
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x2c8], eax
jge 0x10027af7
mov dword [ebp - 0x194], 1
jmp 0x10027afe
and dword [ebp - 0x194], 0
push 0
lea ecx, [ebp - 0xe8]
call fcn.1001e97a
mov ecx, dword [ebp - 0x194]
cmp ecx, dword [eax]
jge 0x10027b21
mov dword [ebp - 0x248], 1
jmp 0x10027b28
and dword [ebp - 0x248], 0
push 0
lea ecx, [ebp - 0xe8]
call fcn.1001e97a
mov eax, dword [eax]
mov ecx, dword [ebp - 0x248]
lea eax, [ecx + eax + 0x680c3771]
test eax, eax
je 0x10027b5b
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x10027b5b
mov dword [ebp - 0x19c], 1
jmp 0x10027b62
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x330]
cmp dword [ebp - 0x19c], eax
jl 0x10027b8b
push 0
lea ecx, [ebp - 0xe8]
call fcn.1001e97a
cmp dword [eax], 0
jne 0x10027b8b
and dword [ebp - 0x2a0], 0
jmp 0x10027b95
mov dword [ebp - 0x2a0], 1
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x2a0], eax
je 0x10027baf
mov dword [ebp - 0x1a4], 1
jmp 0x10027bb6
and dword [ebp - 0x1a4], 0
push 1
lea ecx, [ebp - 0xe8]
call fcn.1001e97a
mov ecx, dword [ebp - 0x1a4]
cmp ecx, dword [eax]
jge 0x10027bd9
mov dword [ebp - 0x250], 1
jmp 0x10027be0
and dword [ebp - 0x250], 0
mov esi, dword [ebp - 0xc4]
push 0
lea ecx, [ebp - 0xe8]
call fcn.1001e97a
mov eax, dword [eax]
imul eax, dword [ebp - 0x250]
neg eax
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x3d0]
sub esi, eax
cmp esi, dword [ebp - 0x1b4]
jg 0x10027c21
mov dword [ebp - 0x1ac], 1
jmp 0x10027c28
and dword [ebp - 0x1ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3d0]
cmp dword [ebp - 0x1ac], eax
jle 0x10027c49
mov dword [ebp - 0x2e0], 1
jmp 0x10027c50
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x2e0], eax
jg 0x10027c6a
mov dword [ebp - 0xfc], 1
jmp 0x10027c71
and dword [ebp - 0xfc], 0
push 1
lea ecx, [ebp - 0xe8]
call fcn.1001e97a
mov ecx, dword [ebp - 0xfc]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3d0]
cmp dword [ebp - 0xfc], eax
jne 0x10027ca7
mov dword [ebp - 0x10c], 1
jmp 0x10027cae
and dword [ebp - 0x10c], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x10c]
mov dword [ebp + eax - 0x3d0], ecx
mov eax, 0xd5d51814
sub eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x380], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.1001e95e
jmp 0x100279a0
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x24]
and eax, 0x40000000
je 0x10027cff
mov dword [ebp - 0x258], 1
jmp 0x10027d06
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0x398], eax
mov dword [ebp - 0x338], 2
mov dword [ebp - 0x7c], 8
mov dword [ebp - 0x424], 0xf2e5664d
mov dword [ebp - 0x3b8], 0x3d37a5b7
mov dword [ebp - 0xa4], 0
jmp 0x10027d50
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 1
jge 0x10027d6c
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x468], 0x25b0
jmp 0x10027d43
push 0
lea eax, [ebp - 0x7c]
push eax
push 1
lea eax, [ebp - 0x338]
push eax
push 0x2b95
call fcn.100242b1
add esp, 0x14
mov dword [ebp - 0x7c], 0
jmp 0x10027d98
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jg 0x10027dca
mov dword [ebp - 0x470], 4
mov dword [ebp - 0x478], 3
push 0x6073
lea eax, [ebp - 0x3b8]
push eax
push 0
call fcn.1002c316
add esp, 0xc
jmp 0x10027d91
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x24]
and eax, 0x80000000
je 0x10027de3
mov dword [ebp - 0x1bc], 1
jmp 0x10027dea
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x360], eax
push 3
lea ecx, [ebp - 0x3f8]
call fcn.1001e8dc
mov dword [ebp - 4], 1
mov dword [ebp - 0x340], 0
lea eax, [ebp - 0x3f8]
push eax
lea eax, [ebp - 0x480]
push eax
push 1
push 0
push 0x2a6f
call fcn.1002c963
add esp, 0x14
lea eax, [ebp - 0x3f8]
push eax
lea eax, [ebp - 0x340]
push eax
push 0
push 0x130d
push 0
call fcn.1002c7ad
add esp, 0x14
mov byte [ebp - 0x45], 0
push 0x3958
push 1
push 0x3ab0
push 1
push 1
push 0x6be
push 0x2239
lea eax, [ebp - 0x45]
push eax
call fcn.10021e85
add esp, 0x20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3f8]
call fcn.1001e95e
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x24]
and eax, 0x2000000
je 0x1002871f
push 0x4000
mov eax, dword [ebp - 0x24]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x24]
push dword [eax + 8]
push 0x6d78
push 0x5b3c
call fcn.1001dc7d
pop ecx
pop ecx
call eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x18], 0x896e6a37
push 1
lea ecx, [ebp - 0xdc]
call fcn.1001e8dc
mov dword [ebp - 4], 2
push 4
lea ecx, [ebp - 0x120]
call fcn.1001e8dc
mov byte [ebp - 4], 3
mov dword [ebp - 0x17c], 0xffffffff
lea eax, [ebp - 0x388]
push eax
push 0x2411
push 0x293a
push 0x65a1
lea eax, [ebp - 0xdc]
push eax
push 0
call fcn.10033d99
add esp, 0x18
lea eax, [ebp - 0x388]
push eax
push 0x6f9a
push 0
push 0xb50
lea eax, [ebp - 0x120]
push eax
call fcn.1002e196
add esp, 0x14
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x20], eax
jle 0x10027f79
mov dword [ebp - 0x2a8], 1
jmp 0x10027f80
and dword [ebp - 0x2a8], 0
cmp dword [ebp - 0x2a8], 0
jge 0x10027f95
mov dword [ebp - 0x1c4], 1
jmp 0x10027f9c
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1c4], eax
jge 0x10027fb3
mov dword [ebp - 0x260], 1
jmp 0x10027fba
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x260]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0
jmp 0x10027fd6
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x100286fc
mov dword [ebp - 0x4c], 0x1dba1dd7
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x4a8], 0x9a85
mov dword [ebp - 0x42c], 0x4c941e8e
mov dword [ebp - 0x474], 0xfffffff9
push 2
lea ecx, [ebp - 0x490]
call fcn.1001e8dc
mov byte [ebp - 4], 4
mov dword [ebp - 0x198], 2
mov dword [ebp - 0x70], 0
jmp 0x1002803a
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x10028050
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x3a4], 0xffff
jmp 0x10028033
push 0
push 0x93a
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x490]
push eax
push 1
push 0x7d83
call fcn.1002252d
add esp, 0x18
mov dword [ebp - 0x20], 0
jmp 0x10028081
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x100286db
mov dword [ebp - 0x54], 1
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x358], 0
mov esi, dword [ebp - 0x4c]
push dword [ebp - 0x18]
lea ecx, [ebp - 0xdc]
call fcn.1001e97a
cmp esi, dword [eax]
jl 0x100280c4
mov dword [ebp - 0x1cc], 1
jmp 0x100280cb
and dword [ebp - 0x1cc], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0xdc]
call fcn.1001e97a
mov esi, dword [eax]
imul esi, dword [ebp - 0x1cc]
push dword [ebp - 0x18]
lea ecx, [ebp - 0xdc]
call fcn.1001e97a
cmp esi, dword [eax]
jne 0x10028100
mov dword [ebp - 0x2d0], 1
jmp 0x10028107
and dword [ebp - 0x2d0], 0
cmp dword [ebp - 0x2d0], 0
jae 0x1002811c
mov dword [ebp - 0x348], 1
jmp 0x10028123
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x20], eax
jl 0x10028140
mov dword [ebp - 0x1d4], 1
jmp 0x10028147
and dword [ebp - 0x1d4], 0
cmp dword [ebp - 0x1d4], 0x8694a219
ja 0x1002815f
mov dword [ebp - 0x268], 1
jmp 0x10028166
and dword [ebp - 0x268], 0
cmp dword [ebp - 0x268], 0x73d4c46
jg 0x1002817e
mov dword [ebp - 0x1dc], 1
jmp 0x10028185
and dword [ebp - 0x1dc], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0xdc]
call fcn.1001e97a
mov ecx, dword [ebp - 0x1dc]
sub ecx, dword [eax]
cmp ecx, 0x5996
jg 0x100281af
mov dword [ebp - 0x2b0], 1
jmp 0x100281b6
and dword [ebp - 0x2b0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x3a4]
cmp dword [ebp - 0x2b0], eax
jl 0x100281d6
mov dword [ebp - 0x1e4], 1
jmp 0x100281dd
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x10028204
cmp dword [ebp - 0x18], 0
je 0x10028204
mov dword [ebp - 0x270], 1
jmp 0x1002820b
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x270], eax
jl 0x10028222
mov dword [ebp - 0x1ec], 1
jmp 0x10028229
and dword [ebp - 0x1ec], 0
push 0xfffffffffffffffc
pop eax
sub eax, dword [ebp - 0x1ec]
jne 0x10028243
cmp dword [ebp - 0x44], 0
jne 0x10028243
and dword [ebp - 0x2f0], 0
jmp 0x1002824d
mov dword [ebp - 0x2f0], 1
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x2f0], eax
jl 0x10028264
mov dword [ebp - 0x1f4], 1
jmp 0x1002826b
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x1f4]
add eax, 8
jne 0x10028293
push dword [ebp - 0x18]
lea ecx, [ebp - 0xdc]
call fcn.1001e97a
cmp dword [eax], 0
jne 0x10028293
cmp dword [ebp - 0x54], 0
je 0x10028341
mov dword [ebp - 0x350], 0x7d62
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x6c], 0xffffffff
mov eax, dword [ebp - 0x20]
inc eax
cmp dword [ebp - 0x6c], eax
jle 0x100282cb
mov dword [ebp - 0x278], 1
jmp 0x100282d2
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x278], eax
jle 0x100282e9
mov dword [ebp - 0x1fc], 1
jmp 0x100282f0
and dword [ebp - 0x1fc], 0
push 8
pop eax
sub eax, dword [ebp - 0x1fc]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x3a4]
cmp eax, dword [ebp - 0x44]
je 0x10028317
mov dword [ebp - 0x3c0], 1
jmp 0x1002831e
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x47c], eax
mov esi, dword [ebp - 0x4c]
push 2
lea ecx, [ebp - 0x120]
call fcn.1001e97a
mov dword [eax], esi
jmp 0x100284bb
mov dword [ebp - 0x214], 0x7fbcb15e
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3a4], 0
je 0x10028493
push 2
lea ecx, [ebp - 0x120]
call fcn.1001e97a
cmp dword [eax], 0
je 0x10028382
cmp dword [ebp - 0x20], 0
je 0x10028382
mov dword [ebp - 0x2b8], 1
jmp 0x10028389
and dword [ebp - 0x2b8], 0
cmp dword [ebp - 0x2b8], 1
ja 0x1002839e
mov dword [ebp - 0x204], 1
jmp 0x100283a5
and dword [ebp - 0x204], 0
push 2
lea ecx, [ebp - 0x120]
call fcn.1001e97a
mov ecx, dword [ebp - 0x204]
sub ecx, dword [eax]
cmp ecx, 0x5bddf9c2
jne 0x100283ce
mov dword [ebp - 0x280], 1
jmp 0x100283d5
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x280]
sub eax, 0x2645
cmp eax, dword [ebp - 0x6c]
jle 0x100283f1
mov dword [ebp - 0x104], 1
jmp 0x100283f8
and dword [ebp - 0x104], 0
push 2
lea ecx, [ebp - 0x120]
call fcn.1001e97a
mov ecx, dword [ebp - 0x104]
mov dword [eax], ecx
cmp dword [ebp - 0x104], 0xeef3aa79
ja 0x10028425
mov dword [ebp - 0x20c], 1
jmp 0x1002842c
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x214]
cmp dword [ebp - 0x20c], eax
jg 0x10028446
mov dword [ebp - 0x390], 1
jmp 0x1002844d
and dword [ebp - 0x390], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0xdc]
call fcn.1001e97a
push 3
lea ecx, [ebp - 0x120]
call fcn.1001e97a
cmp dword [ebp - 0x54], 0
jne 0x1002847d
cmp dword [ebp - 0x4c], 0
jne 0x1002847d
and dword [ebp - 0x2d8], 0
jmp 0x10028487
mov dword [ebp - 0x2d8], 1
mov eax, dword [ebp - 0x2d8]
sub eax, dword [ebp - 0x214]
cmp dword [ebp - 0x54], 0x6b47
jg 0x100284a8
mov dword [ebp - 0x288], 1
jmp 0x100284af
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x98], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x3a4], 0
je 0x10028547
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x444], eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0xdc]
call fcn.1001e97a
mov esi, eax
push 0
lea ecx, [ebp - 0xdc]
call fcn.1001e97a
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x10028505
mov dword [ebp - 0x21c], 1
jmp 0x1002850c
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x21c], eax
jge 0x10028523
mov dword [ebp - 0x2c0], 1
jmp 0x1002852a
and dword [ebp - 0x2c0], 0
push 2
lea ecx, [ebp - 0x120]
call fcn.1001e97a
mov ecx, dword [ebp - 0x2c0]
imul ecx, dword [eax]
mov dword [ebp - 0x6c], ecx
cmp dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x6c], eax
jle 0x1002855b
mov dword [ebp - 0x224], 1
jmp 0x10028562
and dword [ebp - 0x224], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x224]
imul ecx, dword [ebp + eax - 0x3a4]
mov dword [ebp - 0x290], ecx
push dword [ebp - 0x18]
lea ecx, [ebp - 0xdc]
call fcn.1001e97a
mov ecx, dword [ebp - 0x290]
mov dword [eax], ecx
cmp dword [ebp - 0x290], 0
je 0x100285ac
cmp dword [ebp - 0x18], 0
je 0x100285ac
mov dword [ebp - 0x22c], 1
jmp 0x100285b3
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x358]
add eax, dword [ebp - 0x22c]
cmp eax, 0x2a7
jl 0x100285d2
mov dword [ebp - 0x2e8], 1
jmp 0x100285d9
and dword [ebp - 0x2e8], 0
cmp dword [ebp - 0x2e8], 0xffffffff
jge 0x100285ee
mov dword [ebp - 0x234], 1
jmp 0x100285f5
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x234]
je 0x1002861e
push 0
lea ecx, [ebp - 0xdc]
call fcn.1001e97a
cmp dword [eax], 0
je 0x1002861e
mov dword [ebp - 0x298], 1
jmp 0x10028625
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x298], eax
jg 0x10028642
cmp dword [ebp - 0x17c], 0
jne 0x10028642
and dword [ebp - 0x180], 0
jmp 0x1002864c
mov dword [ebp - 0x180], 1
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x180], eax
je 0x10028663
mov dword [ebp - 0x124], 1
jmp 0x1002866a
and dword [ebp - 0x124], 0
cmp dword [ebp - 0x124], 0xffffffff
jbe 0x1002867f
mov dword [ebp - 0x190], 1
jmp 0x10028686
and dword [ebp - 0x190], 0
mov esi, dword [ebp - 0x54]
push 1
lea ecx, [ebp - 0x120]
call fcn.1001e97a
mov ecx, dword [ebp - 0x190]
sub ecx, dword [eax]
cmp esi, ecx
jle 0x100286ae
mov dword [ebp - 0xf0], 1
jmp 0x100286b5
and dword [ebp - 0xf0], 0
push 2
lea ecx, [ebp - 0x120]
call fcn.1001e97a
mov ecx, dword [ebp - 0xf0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x98], eax
jmp 0x1002807a
mov eax, dword [ebp - 0x198]
dec eax
mov dword [ebp - 0x198], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x490]
call fcn.1001e95e
jmp 0x10027fcf
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x120]
call fcn.1001e95e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc]
call fcn.1001e95e
jmp 0x100272bb
lea eax, [ebp - 0x3d4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x398]
push eax
push 0
lea eax, [ebp - 0x35c]
push eax
call fcn.1002942b
add esp, 0x18
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x3c], 0x6a77d77f
mov dword [ebp - 0x40], 0xfffc
mov dword [ebp - 0x13c], 0xffffffff
mov dword [ebp - 0xa0], 0
jmp 0x10028781
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x1002879a
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x14], 1
jmp 0x10028774
mov dword [ebp - 0x10], 0
jmp 0x100287aa
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1002898d
mov dword [ebp - 0x308], 0xfffffff6
mov dword [ebp - 0x30c], 0xffffffff
mov dword [ebp - 0x1d8], 0xda781b5f
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x14]
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x44c], eax
mov eax, 0x1e2d
test eax, eax
je 0x10028807
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x14], 0
je 0x10028807
mov dword [ebp - 0x1a0], 1
jmp 0x1002880e
and dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0x1a0]
sub eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp eax, dword [ebp + ecx*4 - 0x14]
jl 0x1002882c
mov dword [ebp - 0x1a8], 1
jmp 0x10028833
and dword [ebp - 0x1a8], 0
cmp dword [ebp - 0x1a8], 0x3ec5
jl 0x1002884b
mov dword [ebp - 0x1b0], 1
jmp 0x10028852
and dword [ebp - 0x1b0], 0
cmp dword [ebp - 0x1b0], 1
jne 0x10028867
mov dword [ebp - 0x1b8], 1
jmp 0x1002886e
and dword [ebp - 0x1b8], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x14]
add eax, dword [ebp - 0x1b8]
je 0x10028893
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x14], 0
je 0x10028893
mov dword [ebp - 0x368], 1
jmp 0x1002889a
and dword [ebp - 0x368], 0
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0x14], 5
add eax, 0xfff6
mov ecx, dword [ebp - 0x10]
cmp eax, dword [ebp + ecx*4 - 0x14]
je 0x100288c9
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x14], 0
je 0x100288c9
mov dword [ebp - 0x1c0], 1
jmp 0x100288d0
and dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x14], 0x2c4e
jle 0x100288f5
mov dword [ebp - 0x1c8], 1
jmp 0x100288fc
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x1c8]
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x10]
je 0x1002891d
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x14], 0
jne 0x1002891d
and dword [ebp - 0x1d0], 0
jmp 0x10028927
mov dword [ebp - 0x1d0], 1
mov eax, dword [ebp - 0x30c]
cmp dword [ebp - 0x1d0], eax
jg 0x10028941
mov dword [ebp - 0x314], 1
jmp 0x10028948
and dword [ebp - 0x314], 0
mov dword [ebp - 0x1d8], 0x1fa6
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x14]
cmp eax, dword [ebp - 0x1d8]
je 0x1002896d
mov dword [ebp - 0x1e0], 1
jmp 0x10028974
and dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x14]
add eax, dword [ebp - 0x1e0]
imul eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
jmp 0x100287a3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x454], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
mov dword [ebp - 0x498], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x3c], eax
je 0x100289d0
mov dword [ebp - 0x1e8], 1
jmp 0x100289d7
and dword [ebp - 0x1e8], 0
cmp dword [ebp - 0x1e8], 0xfffc
jne 0x100289ef
mov dword [ebp - 0x1f0], 1
jmp 0x100289f6
and dword [ebp - 0x1f0], 0
cmp dword [ebp - 0x1f0], 0x93af
jg 0x10028a0e
mov dword [ebp - 0x1f8], 1
jmp 0x10028a15
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x1f8]
add eax, 6
jne 0x10028a29
mov eax, 0xf554c62b
test eax, eax
je 0x10028a3b
cmp dword [ebp - 0x10], 0
je 0x10028a3b
mov dword [ebp - 0x200], 1
jmp 0x10028a42
and dword [ebp - 0x200], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
cmp eax, dword [ebp - 0x200]
je 0x10028a60
mov dword [ebp - 0x208], 1
jmp 0x10028a67
and dword [ebp - 0x208], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x208]
sub ecx, dword [ebp + eax - 0x14]
je 0x10028a8b
cmp dword [ebp - 0x3c], 0
je 0x10028a8b
mov dword [ebp - 0x210], 1
jmp 0x10028a92
and dword [ebp - 0x210], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x210]
sub ecx, dword [ebp + eax - 0x14]
je 0x10028abd
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x14], 0
je 0x10028abd
mov dword [ebp - 0x218], 1
jmp 0x10028ac4
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x218], eax
jne 0x10028adb
mov dword [ebp - 0x220], 1
jmp 0x10028ae2
and dword [ebp - 0x220], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x14]
cmp dword [ebp - 0x220], eax
jle 0x10028b00
mov dword [ebp - 0x228], 1
jmp 0x10028b07
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x228]
neg eax
cmp eax, 0xfff7
ja 0x10028b22
mov dword [ebp - 0x230], 1
jmp 0x10028b29
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x230]
imul eax, dword [ebp - 0x40]
cmp eax, 0xc5cc
je 0x10028b4a
mov dword [ebp - 0x238], 1
jmp 0x10028b51
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x238]
sub eax, 4
je 0x10028b72
mov byte [ebp - 0x4d], 0
push 0
lea eax, [ebp - 0x4d]
push eax
call fcn.100383d5
pop ecx
pop ecx
jmp 0x10028f57
mov dword [ebp - 0xb8], 0x9888327b
push 1
lea ecx, [ebp - 0x3b4]
call fcn.1001e8dc
mov dword [ebp - 4], 5
lea eax, [ebp - 0x3b4]
push eax
push 0x2c72
push 0x538d
push 0
push 0
lea eax, [ebp - 0x84]
push eax
call fcn.1002d45f
add esp, 0x18
mov dword [ebp - 0x84], 0
jmp 0x10028bcd
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x10028be9
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xb0], 3
jmp 0x10028bc0
mov eax, 0x3df1
test eax, eax
je 0x10028c17
mov dword [ebp - 0x31c], 4
push 0
push 0x2b2d
lea eax, [ebp - 0x31c]
push eax
call fcn.1002cb17
add esp, 0xc
jmp 0x10028da5
mov dword [ebp - 0xf8], 1
mov dword [ebp - 0x274], 0xfffffffb
push 0x444a
push 0
push 0x2d02
push 1
push 0
push 0x6ebd
lea eax, [ebp - 0x10]
push eax
push 0x689c
call fcn.10021e85
add esp, 0x20
cmp dword [ebp - 0x3c], 0
je 0x10028d5e
cmp dword [ebp - 0x3c], 0
je 0x10028c76
cmp dword [ebp - 0xf8], 0
je 0x10028c76
mov dword [ebp - 0x254], 1
jmp 0x10028c7d
and dword [ebp - 0x254], 0
cmp dword [ebp - 0x40], 0x81c31070
je 0x10028c92
mov dword [ebp - 0x244], 1
jmp 0x10028c99
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x244]
add eax, 0x2c352423
cmp eax, dword [ebp - 0xf8]
jle 0x10028cb8
mov dword [ebp - 0x24c], 1
jmp 0x10028cbf
and dword [ebp - 0x24c], 0
push 0
lea ecx, [ebp - 0x3b4]
call fcn.1001e97a
mov ecx, dword [ebp - 0x24c]
sub ecx, dword [eax]
jne 0x10028ce8
mov eax, 0x50090e7a
test eax, eax
jne 0x10028ce8
and dword [ebp - 0x25c], 0
jmp 0x10028cf2
mov dword [ebp - 0x25c], 1
mov eax, dword [ebp - 0x254]
cmp eax, dword [ebp - 0x25c]
jl 0x10028d0c
mov dword [ebp - 0x264], 1
jmp 0x10028d13
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x264], eax
jle 0x10028d2d
mov dword [ebp - 0x100], 1
jmp 0x10028d34
and dword [ebp - 0x100], 0
push 0
lea ecx, [ebp - 0x3b4]
call fcn.1001e97a
mov ecx, dword [ebp - 0x100]
mov dword [eax], ecx
cmp dword [ebp - 0x100], 0
je 0x10028d5e
mov dword [ebp - 0x26c], 1
jmp 0x10028d65
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x274], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x274]
add ecx, 8
mov edx, dword [ebp - 0xb8]
add edx, ecx
add edx, dword [ebp + eax - 0xb0]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xb0], edx
push 0
lea ecx, [ebp - 0x3b4]
call fcn.1001e97a
cmp dword [eax], 0
jne 0x10028dc3
mov dword [ebp - 0x154], 1
jmp 0x10028dca
and dword [ebp - 0x154], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xb0]
cmp dword [ebp + eax - 0xb0], ecx
jle 0x10028df8
cmp dword [ebp - 0x3c], 0
je 0x10028df8
mov dword [ebp - 0x27c], 1
jmp 0x10028dff
and dword [ebp - 0x27c], 0
cmp dword [ebp - 0x27c], 0xffffffff
jl 0x10028e14
mov dword [ebp - 0x324], 1
jmp 0x10028e1b
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x45c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x14], 0
jne 0x10028e40
cmp dword [ebp - 0x40], 0
jne 0x10028e40
and dword [ebp - 0x284], 0
jmp 0x10028e4a
mov dword [ebp - 0x284], 1
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x40], eax
je 0x10028e6d
cmp dword [ebp - 0x13c], 0
jne 0x10028e6d
and dword [ebp - 0x128], 0
jmp 0x10028e77
mov dword [ebp - 0x128], 1
cmp dword [ebp - 0x128], 0xffffffff
je 0x10028e8c
mov dword [ebp - 0x12c], 1
jmp 0x10028e93
and dword [ebp - 0x12c], 0
cmp dword [ebp - 0x12c], 0
jg 0x10028ea8
mov dword [ebp - 0x134], 1
jmp 0x10028eaf
and dword [ebp - 0x134], 0
imul eax, dword [ebp - 0x134], 0xae89
cmp eax, 0xf13354a9
jae 0x10028ecc
mov dword [ebp - 0x144], 1
jmp 0x10028ed3
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x144], eax
jle 0x10028eed
mov dword [ebp - 0x14c], 1
jmp 0x10028ef4
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x14c], eax
jg 0x10028f0e
mov dword [ebp - 0x32c], 1
jmp 0x10028f15
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x154], eax
je 0x10028f38
mov dword [ebp - 0x15c], 1
jmp 0x10028f3f
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x3c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3b4]
call fcn.1001e95e
push 1
push 0x5128
push 0
lea eax, [ebp - 0x24]
push eax
push 0
push 0x5d3e
push 0x2c86
push 0x3bd7
lea eax, [ebp - 0x174]
push eax
push 0x2a84
push 0x20b9
push 0x412b
push 0x10b4
push 0x492
push 0x2f69
lea eax, [ebp - 0xc0]
push eax
call fcn.100347d2
add esp, 0x40
mov dword [ebp - 0x16c], 0xbd2ab60
mov dword [ebp - 0x164], 0xfffffffa
mov dword [ebp - 0x33c], 0x303f0244
push 3
lea ecx, [ebp - 0x3ec]
call fcn.1001e8dc
mov dword [ebp - 4], 6
mov dword [ebp - 0x34c], 0xa8cc
mov dword [ebp - 0x334], 0x85fcb444
mov dword [ebp - 0x344], 0xf13bcf59
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x464]
push eax
push 0
call fcn.1002cece
add esp, 0xc
push 0
push 0xcb3
push 0xa4a
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x16c]
push eax
push 0x329c
lea eax, [ebp - 0x334]
push eax
push 1
lea eax, [ebp - 0x33c]
push eax
push 0
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x164]
push eax
push 0x6829
lea eax, [ebp - 0x34c]
push eax
call fcn.10024d85
add esp, 0x38
push 0x64a
lea eax, [ebp - 0x164]
push eax
push 0x306b
push 0
push 0
push 0x32c9
push 0x2b83
push 0x53c1
lea eax, [ebp - 0x16c]
push eax
call fcn.10029792
add esp, 0x24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3ec]
call fcn.1001e95e
cmp dword [ebp - 0x174], 0
jbe 0x100291d8
mov dword [ebp - 0x38], 0x20f89b54
mov dword [ebp - 0x9c], 0
jmp 0x100290d3
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x100290ef
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x354], 0xfffffffd
jmp 0x100290c6
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4a4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x430], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x354], 0xfffffffb
mov dword [ebp - 0x38], 0
jmp 0x1002913d
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
je 0x100291ac
mov dword [ebp - 0x8c], 0x9f8d19c9
mov dword [ebp - 0x8c], 0xffffffeb
jmp 0x10029166
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 6
jge 0x1002918d
mov byte [ebp - 0x5d], 0
lea eax, [ebp - 0x5d]
push eax
push 0x266f
push 0x4875
push 0
call fcn.10033b49
add esp, 0x10
jmp 0x10029159
push 1
push 0x3c16
push 0x83
lea eax, [ebp - 0x8c]
push eax
push 0
call fcn.10025d7e
add esp, 0x14
jmp 0x10029136
lea eax, [ebp - 0x438]
push eax
push dword [ebp - 0x35c]
push dword [ebp - 0x174]
mov eax, dword [ebp - 0x24]
push dword [eax + 8]
push 0x6d78
push 0x4d8f
call fcn.1001dc7d
pop ecx
pop ecx
call eax
jmp 0x100272bb
jmp 0x10029207
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x364], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x36c], eax
push dword [ebp - 0x364]
push 0
push dword [ebp - 0x36c]
call fcn.10036725
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret