Function at 0x1002873d
Capabilities:
Check os version
Contain obfuscated stackstrings
Create thread
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007f85a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xcec
push esi
push edi
and dword [ebp - 0x1c], 0
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002e831
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xa0], 0xfffc
push 1
lea ecx, [ebp - 0x824]
call fcn.10012956
and dword [ebp - 4], 0
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x824]
push eax
push 0x7df1
push 1
call fcn.100271c7
add esp, 0x10
mov dword [ebp - 0x160], 0
jmp 0x100287c4
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 3
jge 0x100287e0
mov eax, dword [ebp - 0x160]
mov dword [ebp + eax*4 - 0x900], 0x1b71
jmp 0x100287b7
cmp dword [ebp - 0xa0], 5
je 0x100287f5
mov dword [ebp - 0x33c], 1
jmp 0x100287fc
and dword [ebp - 0x33c], 0
push 0
lea ecx, [ebp - 0x824]
call fcn.100129c3
mov ecx, dword [ebp - 0x33c]
mov dword [eax], ecx
cmp dword [ebp - 0x33c], 0
jne 0x100288fb
push 0
lea ecx, [ebp - 0x824]
call fcn.100129c3
mov eax, 0x1f0c5f1b
cmp eax, 1
je 0x10028841
mov dword [ebp - 0x778], 1
jmp 0x10028848
and dword [ebp - 0x778], 0
push 0
lea ecx, [ebp - 0x824]
call fcn.100129c3
mov ecx, dword [ebp - 0x778]
imul ecx, dword [eax]
neg ecx
push 4
pop eax
shl eax, 1
cmp ecx, dword [ebp + eax - 0x900]
jl 0x1002887a
mov dword [ebp - 0x76c], 1
jmp 0x10028881
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x76c], eax
je 0x1002889b
mov dword [ebp - 0x394], 1
jmp 0x100288a2
and dword [ebp - 0x394], 0
push 0
lea ecx, [ebp - 0x824]
call fcn.100129c3
mov ecx, dword [ebp - 0x394]
mov dword [eax], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x900]
cmp dword [ebp - 0x394], eax
jg 0x100288d7
mov dword [ebp - 0x774], 1
jmp 0x100288de
and dword [ebp - 0x774], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x774]
sub ecx, dword [ebp + eax - 0x900]
jne 0x100288fb
and dword [ebp - 0x7c8], 0
jmp 0x10028905
mov dword [ebp - 0x7c8], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x900]
cmp dword [ebp - 0x7c8], eax
jl 0x10028925
mov dword [ebp - 0x7c4], 1
jmp 0x1002892c
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x7c4]
jle 0x10028946
mov dword [ebp - 0x780], 1
jmp 0x1002894d
and dword [ebp - 0x780], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x900]
cmp dword [ebp - 0x780], eax
jne 0x100289ef
push 2
lea ecx, [ebp - 0xa58]
call fcn.10012956
mov byte [ebp - 4], 1
mov dword [ebp - 0x224], 0
jmp 0x1002898f
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 2
jge 0x100289b1
push dword [ebp - 0x224]
lea ecx, [ebp - 0xa58]
call fcn.100129c3
mov dword [eax], 6
jmp 0x10028982
push 0x67f2
lea eax, [ebp - 0xa58]
push eax
push 0x663c
push 0x32fc
push 0x19de
push 0x1b49
push 0
call fcn.10027b95
add esp, 0x1c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa58]
call fcn.100129be
jmp 0x10028b35
mov dword [ebp - 0x930], 0
mov dword [ebp - 0xa0], 0xffffffe4
jmp 0x10028a12
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 4
je 0x10028b21
push 1
lea ecx, [ebp - 0xa40]
call fcn.10012956
mov byte [ebp - 4], 2
mov dword [ebp - 0x888], 0xfffffff8
push 1
lea ecx, [ebp - 0xb50]
call fcn.10012956
mov byte [ebp - 4], 3
lea eax, [ebp - 0xa40]
push eax
push 0
push 0x4bca
lea eax, [ebp - 0xc8]
push eax
call fcn.10027ae1
add esp, 0x10
mov dword [ebp - 0xc8], 0
jmp 0x10028a81
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jge 0x10028a9d
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0xc50], 0x8ac29ba1
jmp 0x10028a74
lea eax, [ebp - 0xb50]
push eax
push 0
lea eax, [ebp - 0xc8]
push eax
call fcn.10027957
add esp, 0xc
lea eax, [ebp - 0xa40]
push eax
lea eax, [ebp - 0x888]
push eax
push 1
call fcn.1002723d
add esp, 0xc
cmp dword [ebp - 0x930], 1
jle 0x10028ae2
mov dword [ebp - 0x678], 1
jmp 0x10028ae9
and dword [ebp - 0x678], 0
push 0
lea ecx, [ebp - 0x824]
call fcn.100129c3
mov ecx, dword [ebp - 0x678]
mov dword [eax], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb50]
call fcn.100129be
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa40]
call fcn.100129be
jmp 0x10028a05
push 0x3cc1
push 0
push 0x4152
call fcn.10027a44
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x824]
call fcn.100129be
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3ec], eax
mov dword [ebp - 0x22c], 0
jmp 0x10028b66
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 3
jge 0x10028b82
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0xca4], 0xec0ae971
jmp 0x10028b59
push 0
push 0x2dc8
call fcn.100280eb
pop ecx
pop ecx
mov byte [ebp - 0x98], 0
movzx eax, byte [ebp - 0x98]
test eax, eax
je 0x10028baa
push 0
call fcn.10027b61
pop ecx
mov eax, dword [ebp - 0x3ec]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10028bbf
jmp 0x1002e851
mov dword [ebp - 0x24], 0x48c4
mov dword [ebp - 0x39c], 0xc17c7747
mov dword [ebp - 0xbd8], 0
mov dword [ebp - 0x210], 0
jmp 0x10028bf3
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 3
jge 0x10028c0f
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0xa64], 0xfffffff6
jmp 0x10028be6
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xb18], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jge 0x10028c38
mov dword [ebp - 0x63c], 1
jmp 0x10028c3f
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x63c]
jne 0x10028c56
mov dword [ebp - 0x3c4], 1
jmp 0x10028c5d
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x3c4], eax
jne 0x10028c74
mov dword [ebp - 0x644], 1
jmp 0x10028c7b
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x644], eax
jne 0x10028c92
mov dword [ebp - 0x3cc], 1
jmp 0x10028c99
and dword [ebp - 0x3cc], 0
cmp dword [ebp - 0x3cc], 0x5d09ea9
jle 0x10028cb1
mov dword [ebp - 0x64c], 1
jmp 0x10028cb8
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x39c]
sub eax, dword [ebp - 0x24]
add eax, 0x6316
je 0x10028ea2
mov eax, 0x82aa9dad
test eax, eax
je 0x10028ea2
mov dword [ebp - 0x3a4], 0xa04f7772
mov dword [ebp - 0x1f8], 0
jmp 0x10028d08
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 4
jge 0x10028d24
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0x988], 0xfffffff8
jmp 0x10028cfb
mov dword [ebp - 0x24], 0
jmp 0x10028d34
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x10028ea0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x988]
mov dword [ebp - 0xb20], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp + ecx*4 - 0x988]
cmp dword [ebp + eax*4 - 0x988], ecx
jne 0x10028d70
mov dword [ebp - 0x3dc], 1
jmp 0x10028d77
and dword [ebp - 0x3dc], 0
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x988]
cmp dword [ebp + eax - 0x988], ecx
jge 0x10028d9f
mov dword [ebp - 0x3d4], 1
jmp 0x10028da6
and dword [ebp - 0x3d4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa64]
cmp dword [ebp - 0x3d4], eax
jge 0x10028dc7
mov dword [ebp - 0x960], 1
jmp 0x10028dce
and dword [ebp - 0x960], 0
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x3a4], eax
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0xaf0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x988]
mov dword [ebp - 0xb28], eax
cmp dword [ebp - 0x3a4], 0x4ed0
jge 0x10028e10
mov dword [ebp - 0x654], 1
jmp 0x10028e17
and dword [ebp - 0x654], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x988]
cmp dword [ebp - 0x654], eax
jge 0x10028e38
mov dword [ebp - 0x65c], 1
jmp 0x10028e3f
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x3dc]
cmp eax, dword [ebp - 0x65c]
jge 0x10028e59
mov dword [ebp - 0x3e4], 1
jmp 0x10028e60
and dword [ebp - 0x3e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa64]
cmp dword [ebp - 0x3e4], eax
je 0x10028e81
mov dword [ebp - 0x664], 1
jmp 0x10028e88
and dword [ebp - 0x664], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x664]
mov dword [ebp + eax - 0xa64], ecx
jmp 0x10028d2d
jmp 0x10028f16
mov dword [ebp - 0xb30], 1
push 3
lea ecx, [ebp - 0xb60]
call fcn.10012956
mov dword [ebp - 4], 4
mov dword [ebp - 0x938], 0
push 0
push 0x46a8
lea eax, [ebp - 0xb0c]
push eax
push 0x42b1
lea eax, [ebp - 0xb60]
push eax
call fcn.1002771b
add esp, 0x14
push 0x3a33
lea eax, [ebp - 0x938]
push eax
push 0
push 0x17b3
call fcn.10027dbf
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb60]
call fcn.100129be
mov eax, dword [ebp - 0x3ec]
mov ecx, dword [ebp - 0x30]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0x200], 0x2799ac78
push 2
lea ecx, [ebp - 0x9b0]
call fcn.10012956
mov dword [ebp - 4], 5
mov dword [ebp - 0x188], 0
jmp 0x10028f5f
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 2
jge 0x10028f81
push dword [ebp - 0x188]
lea ecx, [ebp - 0x9b0]
call fcn.100129c3
mov dword [eax], 0x914d2edc
jmp 0x10028f52
mov byte [ebp - 0xa9], 0
lea eax, [ebp - 0xa9]
push eax
push 0x10f3
push 1
call fcn.10027289
add esp, 0xc
mov dword [ebp - 0x200], 0
jmp 0x10028fb7
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0xe
jge 0x10029063
mov dword [ebp - 0xd0], 0xa9d19ac1
mov dword [ebp - 0xd0], 1
jmp 0x10028fe7
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jl 0x10029049
mov dword [ebp - 0x104], 0xf38c0887
mov dword [ebp - 0x104], 1
jmp 0x10029013
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jl 0x10029047
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x9b0]
push eax
lea eax, [ebp - 0xd0]
push eax
push 0x4f82
push 0
push 0x1217
call fcn.10027553
add esp, 0x18
jmp 0x10029006
jmp 0x10028fda
lea eax, [ebp - 0x9b0]
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.100272e7
pop ecx
pop ecx
jmp 0x10028faa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9b0]
call fcn.100129be
mov eax, dword [ebp - 0xcc]
cmp dword [eax], 0x4550
je 0x10029085
jmp 0x1002e851
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xcc]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x60], 0xfffffffb
mov dword [ebp - 0x674], 0x7f737a9a
mov dword [ebp - 0x60], 0
jmp 0x100290b9
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xc
jne 0x100292c1
mov dword [ebp - 0xf0], 5
mov dword [ebp - 0x3ac], 0xdb959c45
mov dword [ebp - 0x414], 6
mov dword [ebp - 0x404], 0xffffffff
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x60]
sub eax, 0x74ca1253
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x3ac]
add eax, dword [ebp - 0xf0]
cmp eax, dword [ebp - 0xf0]
jge 0x10029122
mov dword [ebp - 0x66c], 1
jmp 0x10029129
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x66c]
sub eax, dword [ebp - 0xf0]
je 0x1002914c
cmp dword [ebp - 0x3ac], 0
je 0x1002914c
mov dword [ebp - 0x978], 1
jmp 0x10029153
and dword [ebp - 0x978], 0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xb84], eax
xor eax, eax
add eax, 0xd2b5
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x60]
imul eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0xf0]
jge 0x10029187
mov dword [ebp - 0x3f4], 1
jmp 0x1002918e
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x414]
cmp dword [ebp - 0x3f4], eax
jl 0x100291be
mov byte [ebp - 0xc0], 0
lea eax, [ebp - 0xc0]
push eax
push 1
push 0xfc4
call fcn.1002732d
add esp, 0xc
jmp 0x100292bc
mov dword [ebp - 0x68c], 0x2fa5d872
mov dword [ebp - 0x898], 0x90638325
cmp dword [ebp - 0x674], 0
jne 0x100291e7
mov dword [ebp - 0x3fc], 1
jmp 0x100291ee
and dword [ebp - 0x3fc], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x3fc]
imul eax, dword [ebp - 0x68c]
cmp eax, 1
je 0x1002920f
mov dword [ebp - 0x88c], 1
jmp 0x10029216
and dword [ebp - 0x88c], 0
push 7
pop eax
test eax, eax
je 0x1002922f
cmp dword [ebp - 0x60], 0
je 0x1002922f
mov dword [ebp - 0x67c], 1
jmp 0x10029236
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x404]
cmp dword [ebp - 0x67c], eax
jge 0x10029250
mov dword [ebp - 0x684], 1
jmp 0x10029257
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x404]
cmp dword [ebp - 0x684], eax
jge 0x10029271
mov dword [ebp - 0x40c], 1
jmp 0x10029278
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x40c], eax
jg 0x10029295
cmp dword [ebp - 0x68c], 0
jne 0x10029295
and dword [ebp - 0x890], 0
jmp 0x1002929f
mov dword [ebp - 0x890], 1
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0xb14], eax
mov eax, 0xa87e
imul eax, eax, 0x5db
mov dword [ebp - 0x898], eax
jmp 0x100290b2
mov eax, dword [ebp - 0x58]
cmp dword [eax + 4], 0
jne 0x100292cf
jmp 0x1002e851
mov dword [ebp - 0xbd4], 0xd327cb3f
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x100292f9
push 0x55e8
push 0
call fcn.100276a0
pop ecx
pop ecx
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x10029315
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0xcc]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0xcc]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0x5cc], eax
mov dword [ebp - 0x6c], 0xfffffffc
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x8a8], 0xffffffff
mov dword [ebp - 0x6dc], 2
mov dword [ebp - 0x8b8], 0xfffffffa
mov dword [ebp - 0x190], 0
jmp 0x10029378
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 1
jge 0x10029394
mov eax, dword [ebp - 0x190]
mov dword [ebp + eax*4 - 0x84], 1
jmp 0x1002936b
mov dword [ebp - 0x6c], 0
jmp 0x100293a4
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xfffffff8
jge 0x10029569
mov dword [ebp - 0x694], 0xfffffffa
push 2
lea ecx, [ebp - 0xa88]
call fcn.10012956
mov dword [ebp - 4], 6
mov dword [ebp - 0x70], 0
jmp 0x100293dc
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x100293f2
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x8a0], 0x62b0
jmp 0x100293d5
mov dword [ebp - 0x70], 0
jmp 0x10029402
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1002941e
push dword [ebp - 0x70]
lea ecx, [ebp - 0xa88]
call fcn.100129c3
mov dword [eax], 8
jmp 0x100293fb
cmp dword [ebp - 0x694], 0
jne 0x10029439
cmp dword [ebp - 0x694], 0
jne 0x10029439
and dword [ebp - 0x42c], 0
jmp 0x10029443
mov dword [ebp - 0x42c], 1
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], eax
jg 0x10029457
mov dword [ebp - 0x69c], 1
jmp 0x1002945e
and dword [ebp - 0x69c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8a0]
cmp dword [ebp - 0x6c], eax
jge 0x1002947c
mov dword [ebp - 0x41c], 1
jmp 0x10029483
and dword [ebp - 0x41c], 0
cmp dword [ebp - 0x41c], 0x4057
jl 0x100294a1
cmp dword [ebp - 0x6c], 0
je 0x100294a1
mov dword [ebp - 0x424], 1
jmp 0x100294a8
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x69c]
cmp eax, dword [ebp - 0x424]
je 0x100294c2
mov dword [ebp - 0x6a4], 1
jmp 0x100294c9
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x6a4], eax
jne 0x100294e0
mov dword [ebp - 0x6ac], 1
jmp 0x100294e7
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x42c]
cmp eax, dword [ebp - 0x6ac]
jge 0x10029505
push 0xfffffffffffffff8
pop eax
test eax, eax
jne 0x10029505
and dword [ebp - 0x434], 0
jmp 0x1002950f
mov dword [ebp - 0x434], 1
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x434], eax
jne 0x10029526
mov dword [ebp - 0x3b4], 1
jmp 0x1002952d
and dword [ebp - 0x3b4], 0
push 1
lea ecx, [ebp - 0xa88]
call fcn.100129c3
mov ecx, dword [ebp - 0x3b4]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3b4]
mov dword [ebp + eax - 0x84], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa88]
call fcn.100129be
jmp 0x1002939d
mov dword [ebp - 0x44], 0
jmp 0x10029579
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jg 0x10029848
mov dword [ebp - 0x6bc], 0xb1c5adf
mov dword [ebp - 0x208], 1
mov dword [ebp - 0x474], 0xfffffffa
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x84], 0
jne 0x100297f4
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x84]
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x6b4]
mov dword [ebp + eax*4 - 0x84], ecx
cmp dword [ebp - 0x6b4], 0
je 0x100296e2
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x84], 0
je 0x10029648
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0xb1c], eax
mov eax, dword [ebp - 0x8a8]
inc eax
je 0x10029614
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x84], 0
je 0x10029614
and dword [ebp - 0x43c], 0
jmp 0x1002961e
mov dword [ebp - 0x43c], 1
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x6bc], eax
cmp dword [ebp - 0x6bc], 0
je 0x10029648
cmp dword [ebp - 0x6dc], 0
je 0x10029648
mov dword [ebp - 0x444], 1
jmp 0x1002964f
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x444], eax
je 0x10029666
mov dword [ebp - 0x6c4], 1
jmp 0x1002966d
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x6c4]
sub eax, 0x7a83
cmp eax, 0x97bd
jne 0x10029691
mov eax, 0x56be8236
test eax, eax
jne 0x10029691
and dword [ebp - 0x44c], 0
jmp 0x1002969b
mov dword [ebp - 0x44c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x84]
cmp dword [ebp - 0x44c], eax
je 0x100296bc
mov dword [ebp - 0x6cc], 1
jmp 0x100296c3
and dword [ebp - 0x6cc], 0
cmp dword [ebp - 0x6cc], 0x870b1b9b
ja 0x100296db
mov dword [ebp - 0x454], 1
jmp 0x100296e2
and dword [ebp - 0x454], 0
mov eax, 0x2be8
cmp eax, 0xae73
jl 0x100296fa
mov dword [ebp - 0x6d4], 1
jmp 0x10029701
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x208]
cmp dword [ebp - 0x6d4], eax
jne 0x1002971b
mov dword [ebp - 0x45c], 1
jmp 0x10029722
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x208]
cmp dword [ebp - 0x45c], eax
jne 0x1002973c
mov dword [ebp - 0x8b0], 1
jmp 0x10029743
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x84]
mov dword [ebp - 0xb94], eax
cmp dword [ebp - 0x6dc], 1
jne 0x10029768
mov dword [ebp - 0x464], 1
jmp 0x1002976f
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x464]
sub eax, 0x6a332e52
cmp eax, 0xc6aee34d
jbe 0x1002978d
mov dword [ebp - 0x6e4], 1
jmp 0x10029794
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x8b8]
cmp dword [ebp - 0x6e4], eax
jge 0x100297ae
mov dword [ebp - 0x46c], 1
jmp 0x100297b5
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x474]
cmp dword [ebp - 0x208], eax
je 0x100297db
mov dword [ebp - 0x6ec], 1
jmp 0x100297e2
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x6ec]
dec eax
jne 0x100297f4
and dword [ebp - 0x6f4], 0
jmp 0x100297fe
mov dword [ebp - 0x6f4], 1
mov eax, dword [ebp - 0x474]
cmp dword [ebp - 0x6f4], eax
jg 0x10029823
mov dword [ebp - 0x8c0], 0x6a10b913
cmp dword [ebp - 0x8c0], 0
je 0x10029821
jmp 0x10029848
jmp 0x10029843
mov byte [ebp - 0xc4], 0
movzx eax, byte [ebp - 0xc4]
test eax, eax
je 0x10029843
push 0x730c
push 1
call fcn.1002738c
pop ecx
pop ecx
jmp 0x10029572
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x5cc]
push eax
push 0
lea eax, [ebp - 0x28]
push eax
call fcn.10027ea9
add esp, 0x14
mov dword [ebp - 0x198], 0
jmp 0x10029881
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 3
jge 0x1002989d
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x884], 0x25b9b55b
jmp 0x10029874
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x884], 0
jmp 0x100298cb
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x884]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x884], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x884], 7
jg 0x10029968
push 3
lea ecx, [ebp - 0xa1c]
call fcn.10012956
mov dword [ebp - 4], 7
mov dword [ebp - 0x214], 0
jmp 0x1002990c
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 3
jge 0x1002992b
push dword [ebp - 0x214]
lea ecx, [ebp - 0xa1c]
call fcn.100129c3
or dword [eax], 0xffffffff
jmp 0x100298ff
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x884]
push 4
pop eax
imul eax, eax, 0
sub esi, dword [ebp + eax - 0x884]
push 0
lea ecx, [ebp - 0xa1c]
call fcn.100129c3
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa1c]
call fcn.100129be
jmp 0x100298b0
cmp dword [ebp - 0x28], 0
jne 0x10029973
jmp 0x1002e851
push 2
lea ecx, [ebp - 0x13c]
call fcn.10012956
mov dword [ebp - 4], 8
mov dword [ebp - 0x74], 0
lea eax, [ebp - 0x13c]
push eax
push 0
lea eax, [ebp - 0xb24]
push eax
push 0x608f
call fcn.100273be
add esp, 0x10
push 0
lea ecx, [ebp - 0x13c]
call fcn.100129c3
and dword [eax], 0
jmp 0x100299e1
push 0
lea ecx, [ebp - 0x13c]
call fcn.100129c3
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x47c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x47c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x13c]
call fcn.100129c3
cmp dword [eax], 6
jle 0x10029d03
mov dword [ebp - 0xd8], 0xddca2728
mov dword [ebp - 0x1a4], 0x2afd77cc
mov dword [ebp - 0x21c], 0
jmp 0x10029a24
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 1
jge 0x10029a40
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0x164], 0
jmp 0x10029a17
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x164], 0
jne 0x10029a5c
mov dword [ebp - 0x6fc], 1
jmp 0x10029a63
and dword [ebp - 0x6fc], 0
mov esi, dword [ebp - 0x6fc]
add esi, 0xffff
mov edi, dword [ebp - 0xd8]
push 0
lea ecx, [ebp - 0x13c]
call fcn.100129c3
sub edi, dword [eax]
cmp esi, edi
jle 0x10029a94
mov dword [ebp - 0x8c8], 1
jmp 0x10029a9b
and dword [ebp - 0x8c8], 0
push 0
lea ecx, [ebp - 0x13c]
call fcn.100129c3
push 0
lea ecx, [ebp - 0x13c]
call fcn.100129c3
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x164]
cmp dword [eax], ecx
je 0x10029ad2
mov dword [ebp - 0x484], 1
jmp 0x10029ad9
and dword [ebp - 0x484], 0
mov dword [ebp - 0x74], 0xa5b7
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x484]
je 0x10029af7
mov dword [ebp - 0x704], 1
jmp 0x10029afe
and dword [ebp - 0x704], 0
push 0
lea ecx, [ebp - 0x13c]
call fcn.100129c3
mov eax, dword [eax]
cmp eax, dword [ebp - 0x704]
jg 0x10029b21
mov dword [ebp - 0x48c], 1
jmp 0x10029b28
and dword [ebp - 0x48c], 0
cmp dword [ebp - 0x48c], 0x9ba87a5e
jb 0x10029b41
push 0
lea ecx, [ebp - 0x13c]
call fcn.100129c3
mov esi, dword [ebp - 0xd8]
push 0
lea ecx, [ebp - 0x13c]
call fcn.100129c3
add esi, dword [eax]
cmp esi, 1
je 0x10029b67
mov dword [ebp - 0x70c], 1
jmp 0x10029b6e
and dword [ebp - 0x70c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x164]
add eax, dword [ebp - 0x70c]
mov dword [ebp - 0x1a4], eax
mov esi, dword [ebp - 0x1a4]
push 0
lea ecx, [ebp - 0x13c]
call fcn.100129c3
cmp esi, dword [eax]
jge 0x10029baa
mov dword [ebp - 0x494], 1
jmp 0x10029bb1
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xbc4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x164], 0
je 0x10029cca
mov dword [ebp - 0x74], 0
mov esi, dword [ebp - 0x74]
push 0
lea ecx, [ebp - 0x13c]
call fcn.100129c3
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x13c]
call fcn.100129c3
cmp dword [eax], esi
jl 0x10029c10
mov dword [ebp - 0x714], 1
jmp 0x10029c17
and dword [ebp - 0x714], 0
cmp dword [ebp - 0x714], 0xfffffff6
je 0x10029c2c
mov dword [ebp - 0x49c], 1
jmp 0x10029c33
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x49c], eax
jge 0x10029c4d
mov dword [ebp - 0x71c], 1
jmp 0x10029c54
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x1a4]
cmp dword [ebp - 0x71c], eax
jne 0x10029c80
push 0
lea ecx, [ebp - 0x13c]
call fcn.100129c3
cmp dword [eax], 0
je 0x10029c80
mov dword [ebp - 0x4a4], 1
jmp 0x10029c87
and dword [ebp - 0x4a4], 0
push 0
lea ecx, [ebp - 0x13c]
call fcn.100129c3
mov ecx, dword [ebp - 0x4a4]
add ecx, dword [eax]
imul ecx, dword [ebp - 0xd8]
test ecx, ecx
jne 0x10029cb5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x164], 0
mov eax, 0xc88307b
test eax, eax
je 0x10029cca
mov dword [ebp - 0x724], 1
jmp 0x10029cd1
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x724], eax
jl 0x10029ceb
mov dword [ebp - 0x4ac], 1
jmp 0x10029cf2
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x1a4], eax
jmp 0x100299bd
mov dword [ebp - 0x74], 0xffffffe9
jmp 0x10029d13
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x1c
jge 0x10029dcb
mov dword [ebp - 0x1ac], 0x57520c25
push 1
lea ecx, [ebp - 0xa34]
call fcn.10012956
mov byte [ebp - 4], 9
mov dword [ebp - 0x1ec], 0
jmp 0x10029d51
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 1
jge 0x10029d73
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0xa34]
call fcn.100129c3
mov dword [eax], 0x7c927db4
jmp 0x10029d44
push 1
lea ecx, [ebp - 0x13c]
call fcn.100129c3
and dword [eax], 0
mov dword [ebp - 0x1ac], 0xfffffff1
jmp 0x10029d9c
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0xc
jne 0x10029db7
lea eax, [ebp - 0xa34]
push eax
push 0
call fcn.100277c5
pop ecx
pop ecx
jmp 0x10029d8f
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa34]
call fcn.100129be
jmp 0x10029d0c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.100129be
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x28]
add ecx, dword [eax]
add ecx, dword [ebp - 0x30]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10c], 5
mov dword [ebp - 0xb2c], 0xfffffff7
mov dword [ebp - 0xba4], 0x7cf7a021
mov dword [ebp - 0xb34], 0
mov dword [ebp - 0x10c], 0
jmp 0x10029e29
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xc
jne 0x10029f75
push 2
lea ecx, [ebp - 0xb70]
call fcn.10012956
mov dword [ebp - 4], 0xa
mov dword [ebp - 0xbe4], 0xdb74a71a
mov dword [ebp - 0xa8], 0x467b
mov dword [ebp - 0xb3c], 0xfffffff7
mov dword [ebp - 0x20c], 0
jmp 0x10029e81
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 2
jge 0x10029ea3
push dword [ebp - 0x20c]
lea ecx, [ebp - 0xb70]
call fcn.100129c3
mov dword [eax], 0xcf45
jmp 0x10029e74
xor eax, eax
inc eax
je 0x10029ebd
cmp dword [ebp - 0xa8], 0
je 0x10029ebd
mov dword [ebp - 0x8d0], 1
jmp 0x10029ec4
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xbac], eax
cmp dword [ebp - 0x10c], 0
je 0x10029f4b
mov dword [ebp - 0xa8], 0xe
jmp 0x10029ef2
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
je 0x10029f49
mov byte [ebp - 0xbb], 0
push 0x157d
push 1
push 0x312b
lea eax, [ebp - 0xbb]
push eax
call fcn.100273be
add esp, 0x10
mov byte [ebp - 0xc3], 0
movzx eax, byte [ebp - 0xc3]
test eax, eax
je 0x10029f47
push 0
push 0x604
push 0
push 0
push 0x1cb9
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10029ee5
jmp 0x10029f61
mov dword [ebp - 0x8d8], 0xffff
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x8d8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb70]
call fcn.100129be
jmp 0x10029e1c
xor ecx, ecx
call fcn.100131c9
push eax
call fcn.10067bba
pop ecx
mov dword [ebp - 0x1b4], 0
jmp 0x10029f9c
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jge 0x10029fb8
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x850], 0x261f9c28
jmp 0x10029f8f
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x850], 0
jmp 0x10029fe6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x850]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x850], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x850], 0
jl 0x1002a015
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x1002a013
push 0x1861
call dword [sym.imp.USER32.dll_GetKeyboardType]
jmp 0x10029fcb
mov byte [ebp - 0x96], 0
movzx eax, byte [ebp - 0x96]
test eax, eax
je 0x1002a035
push 1
push 0x5ed2
call fcn.10027469
pop ecx
pop ecx
push 2
lea ecx, [ebp - 0x9d4]
call fcn.10012956
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x144], 5
mov dword [ebp - 0xb0], 0xc5eb2006
mov dword [ebp - 0xe8], 0xa11015aa
mov dword [ebp - 0x1f4], 0
jmp 0x1002a080
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 2
jge 0x1002a09f
push dword [ebp - 0x1f4]
lea ecx, [ebp - 0x9d4]
call fcn.100129c3
or dword [eax], 0xffffffff
jmp 0x1002a073
mov dword [ebp - 0x144], 1
jmp 0x1002a0b8
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
jl 0x1002a287
mov dword [ebp - 0x88], 0xfffffffb
mov dword [ebp - 0xe0], 0x96ce028f
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x88], eax
jl 0x1002a0f3
mov dword [ebp - 0x72c], 1
jmp 0x1002a0fa
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
je 0x1002a16f
imul eax, dword [ebp - 0x88], 0x3cc9
cmp eax, dword [ebp - 0xe0]
jne 0x1002a12d
mov dword [ebp - 0x4b4], 1
jmp 0x1002a134
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x4b4], eax
jle 0x1002a14e
mov dword [ebp - 0x734], 1
jmp 0x1002a155
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x734]
jle 0x1002a16f
mov dword [ebp - 0x4bc], 1
jmp 0x1002a176
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x4bc], eax
jne 0x1002a190
mov dword [ebp - 0x73c], 1
jmp 0x1002a197
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x73c]
jl 0x1002a246
mov dword [ebp - 0xe8], 1
jmp 0x1002a1c2
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jl 0x1002a244
mov dword [ebp - 0xe0], 0
jmp 0x1002a1e4
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 1
jg 0x1002a23f
mov dword [ebp - 0x88], 0
jmp 0x1002a206
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jg 0x1002a23d
push 0x3ab0
push 0x37c1
push 0x63a0
lea eax, [ebp - 0x9d4]
push eax
lea eax, [ebp - 0xb0]
push eax
push 0
push 0x3612
call fcn.10028696
add esp, 0x1c
jmp 0x1002a1f9
jmp 0x1002a1d7
jmp 0x1002a1b5
jmp 0x1002a282
mov dword [ebp - 0xb0], 0
jmp 0x1002a25f
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jg 0x1002a282
push dword [ebp - 0xb0]
lea ecx, [ebp - 0x9d4]
call fcn.100129c3
cmp dword [eax], 0
je 0x1002a280
jmp 0x1002a282
jmp 0x1002a252
jmp 0x1002a0ab
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9d4]
call fcn.100129be
mov byte [ebp - 0x2d8], 2
mov byte [ebp - 0x2d7], 0x49
mov byte [ebp - 0x2d6], 0
mov byte [ebp - 0x2d5], 6
mov byte [ebp - 0x2d4], 9
mov byte [ebp - 0x2d3], 1
mov byte [ebp - 0x2d2], 0x50
mov byte [ebp - 0x2d1], 0x8b
mov byte [ebp - 0x2d0], 0x39
mov byte [ebp - 0x2cf], 0xa8
mov byte [ebp - 0x2ce], 0x4f
mov byte [ebp - 0x2cd], 0x9b
mov byte [ebp - 0x2cc], 0x5a
mov byte [ebp - 0x2cb], 0x4c
mov byte [ebp - 0x2ca], 0x70
mov byte [ebp - 0x2c9], 0x46
mov byte [ebp - 0x2c8], 0x9e
mov byte [ebp - 0x2c7], 0xea
mov byte [ebp - 0x2c6], 0x97
mov byte [ebp - 0x2c5], 0x5b
mov byte [ebp - 0x2c4], 0xfe
mov byte [ebp - 0x2c3], 0xa8
mov byte [ebp - 0x2c2], 0x84
mov byte [ebp - 0x2c1], 0xdb
mov byte [ebp - 0x2c0], 0x7b
mov byte [ebp - 0x2bf], 0x3f
mov byte [ebp - 0x2be], 0x16
mov byte [ebp - 0x2bd], 0xc8
mov byte [ebp - 0x2bc], 0xf9
mov byte [ebp - 0x2bb], 0xfc
mov byte [ebp - 0x2ba], 0x9b
mov byte [ebp - 0x2b9], 0xbe
mov byte [ebp - 0x2b8], 0xc7
mov byte [ebp - 0x2b7], 0xd0
mov byte [ebp - 0x2b6], 6
mov byte [ebp - 0x2b5], 0x6b
mov byte [ebp - 0x2b4], 6
mov byte [ebp - 0x2b3], 0x91
mov byte [ebp - 0x2b2], 0xe5
mov byte [ebp - 0x2b1], 0x36
mov byte [ebp - 0x2b0], 9
mov byte [ebp - 0x2af], 0xf1
mov byte [ebp - 0x2ae], 0x49
mov byte [ebp - 0x2ad], 0xa6
mov byte [ebp - 0x2ac], 0x65
mov byte [ebp - 0x2ab], 0x6c
mov byte [ebp - 0x2aa], 0x68
mov byte [ebp - 0x2a9], 0x6b
mov byte [ebp - 0x2a8], 0xb7
mov byte [ebp - 0x2a7], 0x73
mov byte [ebp - 0x2a6], 0xcd
mov byte [ebp - 0x2a5], 7
mov byte [ebp - 0x2a4], 0x66
mov byte [ebp - 0x2a3], 0x3e
mov byte [ebp - 0x2a2], 0x42
mov byte [ebp - 0x2a1], 0
mov byte [ebp - 0x2a0], 0xe7
mov byte [ebp - 0x29f], 0x95
mov byte [ebp - 0x29e], 0x43
mov byte [ebp - 0x29d], 0xa6
mov byte [ebp - 0x29c], 0xbf
mov byte [ebp - 0x29b], 0xd1
mov byte [ebp - 0x29a], 0xca
mov byte [ebp - 0x299], 0xbc
mov byte [ebp - 0x298], 0xd1
mov byte [ebp - 0x297], 9
mov byte [ebp - 0x296], 0x9e
mov byte [ebp - 0x295], 0xa1
mov byte [ebp - 0x294], 0x36
mov byte [ebp - 0x293], 0x16
mov byte [ebp - 0x292], 1
mov byte [ebp - 0x291], 0xc8
mov byte [ebp - 0x290], 0x9e
mov byte [ebp - 0x28f], 0xf7
mov byte [ebp - 0x28e], 0xec
mov byte [ebp - 0x28d], 0x16
mov byte [ebp - 0x28c], 0x14
mov byte [ebp - 0x28b], 0xb2
mov byte [ebp - 0x28a], 0xc2
mov byte [ebp - 0x289], 0xf4
mov byte [ebp - 0x288], 6
mov byte [ebp - 0x287], 0xab
mov byte [ebp - 0x286], 0x7b
mov byte [ebp - 0x285], 0xb7
mov byte [ebp - 0x284], 0xf5
mov byte [ebp - 0x283], 0xb2
mov byte [ebp - 0x282], 0xde
mov byte [ebp - 0x281], 8
mov byte [ebp - 0x280], 0
mov byte [ebp - 0x27f], 4
mov byte [ebp - 0x27e], 8
mov byte [ebp - 0x27d], 5
mov byte [ebp - 0x27c], 9
mov byte [ebp - 0x27b], 6
mov byte [ebp - 0x27a], 0
mov byte [ebp - 0x279], 7
mov byte [ebp - 0x278], 7
mov byte [ebp - 0x277], 3
mov byte [ebp - 0x276], 1
mov byte [ebp - 0x275], 1
mov byte [ebp - 0x274], 2
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x2d8]
or eax, 0x7e
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x2d8]
and ecx, 0x7e
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x2d8]
mov byte [ebp + ecx - 0x7e4], al
mov dword [ebp - 0x34], 2
and dword [ebp - 0x114], 0
jmp 0x1002a5aa
mov eax, dword [ebp - 0x34]
inc eax
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x65
jae 0x1002a697
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x2d8]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x34], eax
jne 0x1002a5f4
mov eax, dword [ebp - 0x34]
movzx eax, byte [ebp + eax - 0x2d8]
inc eax
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [ebp + eax - 0x2d8]
mov ecx, dword [ebp - 0x34]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x34], eax
jmp 0x1002a5a2
mov eax, dword [ebp - 0x34]
movzx eax, byte [ebp + eax - 0x2d7]
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x114]
movzx ecx, byte [ebp + ecx - 0x2da]
movsx ecx, byte [ebp + ecx - 0x7e4]
add eax, ecx
mov ecx, dword [ebp - 0x34]
movzx ecx, byte [ebp + ecx - 0x2d7]
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x114]
movzx edx, byte [ebp + edx - 0x2da]
movsx edx, byte [ebp + edx - 0x7e4]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x34]
movzx ecx, byte [ebp + ecx - 0x2d7]
mov edx, dword [ebp - 0x34]
sub edx, dword [ebp - 0x114]
movzx edx, byte [ebp + edx - 0x2da]
movsx edx, byte [ebp + edx - 0x7e4]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x34]
movzx ecx, byte [ebp + ecx - 0x2d8]
mov byte [ebp + ecx - 0x7e4], al
push 0x3f93
push 0
lea eax, [ebp - 0x114]
push eax
call fcn.10028526
add esp, 0xc
jmp 0x1002a5a2
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x7e4], 0
mov dword [ebp - 0x1c4], 0xfffffff9
mov dword [ebp - 0x3a8], 0x27d2703d
mov dword [ebp - 0x348], 0xfffffffd
mov dword [ebp - 0x398], 0xffffffff
mov dword [ebp - 0x380], 0
mov dword [ebp - 0x754], 0
mov dword [ebp - 0x15c], 0xffffffff
mov dword [ebp - 0x350], 0xce6bb2f1
mov dword [ebp - 0x220], 0x6d8bc0d1
mov dword [ebp - 0x688], 0xea1dc7e9
mov dword [ebp - 0x8e0], 0x149f7fae
mov dword [ebp - 0x1bc], 0
jmp 0x1002a72c
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 3
jge 0x1002a748
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0xcc8], 0xffff
jmp 0x1002a71f
lea eax, [ebp - 0x398]
push eax
lea eax, [ebp - 0x1c4]
push eax
push 0x7a25
lea eax, [ebp - 0x3a8]
push eax
push 0x29d8
push 0x13f9
lea eax, [ebp - 0x348]
push eax
push 0
call fcn.10027ff8
add esp, 0x20
mov eax, dword [ebp - 0x220]
dec eax
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0xb44], eax
cmp dword [ebp - 0x15c], 0
jne 0x1002a7b1
cmp dword [ebp - 0x398], 0
jne 0x1002a7b1
and dword [ebp - 0x4c4], 0
jmp 0x1002a7bb
mov dword [ebp - 0x4c4], 1
mov eax, dword [ebp - 0x380]
cmp dword [ebp - 0x4c4], eax
jle 0x1002a7d5
mov dword [ebp - 0x744], 1
jmp 0x1002a7dc
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x398]
cmp dword [ebp - 0x744], eax
jl 0x1002a7f6
mov dword [ebp - 0x4cc], 1
jmp 0x1002a7fd
and dword [ebp - 0x4cc], 0
cmp dword [ebp - 0x4cc], 0xdbef
jge 0x1002a815
mov dword [ebp - 0x74c], 1
jmp 0x1002a81c
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x74c]
sub eax, dword [ebp - 0x1c4]
cmp eax, dword [ebp - 0x350]
jl 0x1002a83c
mov dword [ebp - 0x4d4], 1
jmp 0x1002a843
and dword [ebp - 0x4d4], 0
cmp dword [ebp - 0x4d4], 0
jl 0x1002a858
mov dword [ebp - 0x4dc], 1
jmp 0x1002a85f
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x754], eax
mov eax, dword [ebp - 0x754]
add eax, dword [ebp - 0x4dc]
cmp eax, 0xd994ad4d
jae 0x1002a88a
mov dword [ebp - 0x75c], 1
jmp 0x1002a891
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x75c]
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0
ja 0x1002a8b2
mov dword [ebp - 0x764], 1
jmp 0x1002a8b9
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x350]
cmp dword [ebp - 0x764], eax
jge 0x1002a8d3
mov dword [ebp - 0x4e8], 1
jmp 0x1002a8da
and dword [ebp - 0x4e8], 0
cmp dword [ebp - 0x4e8], 0
jl 0x1002a8ef
mov dword [ebp - 0x7bc], 1
jmp 0x1002a8f6
and dword [ebp - 0x7bc], 0
cmp dword [ebp - 0x7bc], 0
jae 0x1002a90b
mov dword [ebp - 0x4f0], 1
jmp 0x1002a912
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x380], eax
jl 0x1002a938
mov dword [ebp - 0x680], 1
jmp 0x1002a93f
and dword [ebp - 0x680], 0
mov eax, dword [ebp - 0x15c]
cmp eax, dword [ebp - 0x680]
jl 0x1002a959
mov dword [ebp - 0x4f8], 1
jmp 0x1002a960
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
jne 0x1002a987
mov eax, 0xa6ce
test eax, eax
jne 0x1002a987
and dword [ebp - 0x748], 0
jmp 0x1002a991
mov dword [ebp - 0x748], 1
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
je 0x1002a9bb
mov eax, 0xac89d693
test eax, eax
je 0x1002a9bb
mov dword [ebp - 0x500], 1
jmp 0x1002a9c2
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x350]
mov ecx, dword [ebp - 0x500]
lea eax, [ecx + eax - 3]
mov dword [ebp - 0x688], eax
mov eax, dword [ebp - 0x3a8]
cmp dword [ebp - 0x688], eax
jl 0x1002a9f2
mov dword [ebp - 0x508], 1
jmp 0x1002a9f9
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x508]
sub eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x8e0], eax
lea eax, [ebp - 0x7e4]
push eax
lea ecx, [ebp - 0xc98]
call fcn.1002ec02
mov dword [ebp - 0x8e8], eax
mov eax, dword [ebp - 0x8e8]
mov dword [ebp - 0x8f0], eax
mov dword [ebp - 4], 0xc
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x8f0]
call fcn.10013189
pop ecx
mov dword [ebp - 0x8c4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc98]
call fcn.1002ec8a
mov dword [ebp - 0x68], 0xe83c7730
mov dword [ebp - 0x518], 0xd35da2a
mov dword [ebp - 0x358], 0x52570e81
mov dword [ebp - 0x970], 0xfffffffd
mov dword [ebp - 0x1fc], 0
jmp 0x1002aa99
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 1
jge 0x1002aab5
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0x990], 0xfffffff9
jmp 0x1002aa8c
lea eax, [ebp - 0x68]
push eax
push 0xaa6
push 0
call fcn.100274a9
add esp, 0xc
mov dword [ebp - 0x68], 1
jmp 0x1002aad8
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x30
jne 0x1002acea
mov dword [ebp - 0x11c], 0xffffffff
mov dword [ebp - 0x7cc], 1
mov dword [ebp - 0x1cc], 0
jmp 0x1002ab0f
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 3
jge 0x1002ab2b
mov eax, dword [ebp - 0x1cc]
mov dword [ebp + eax*4 - 0xb80], 1
jmp 0x1002ab02
cmp dword [ebp - 0x68], 0
jne 0x1002ab3d
mov dword [ebp - 0x698], 1
jmp 0x1002ab44
and dword [ebp - 0x698], 0
cmp dword [ebp - 0x68], 0
jne 0x1002ab59
cmp dword [ebp - 0x68], 0
jne 0x1002ab59
and dword [ebp - 0x7ac], 0
jmp 0x1002ab63
mov dword [ebp - 0x7ac], 1
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x7ac], eax
jl 0x1002ab7a
mov dword [ebp - 0x510], 1
jmp 0x1002ab81
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x11c]
imul eax, dword [ebp - 0x510]
test eax, eax
jg 0x1002ab9e
mov dword [ebp - 0x690], 1
jmp 0x1002aba5
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x690]
mov dword [ebp - 0x518], eax
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0
je 0x1002abdb
cmp dword [ebp - 0x358], 0
je 0x1002abdb
mov dword [ebp - 0x750], 1
jmp 0x1002abe2
and dword [ebp - 0x750], 0
cmp dword [ebp - 0x750], 0xffffffff
je 0x1002abf7
mov dword [ebp - 0x974], 1
jmp 0x1002abfe
and dword [ebp - 0x974], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xbcc], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb80], 0
je 0x1002ac2e
cmp dword [ebp - 0x11c], 0
je 0x1002ac2e
mov dword [ebp - 0x520], 1
jmp 0x1002ac35
and dword [ebp - 0x520], 0
imul eax, dword [ebp - 0x520], 0x85ca
cmp eax, dword [ebp - 0x11c]
jge 0x1002ac53
mov dword [ebp - 0x528], 1
jmp 0x1002ac5a
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x698]
imul eax, dword [ebp - 0x528]
sub eax, dword [ebp - 0x11c]
mov dword [ebp - 0x7cc], eax
mov eax, dword [ebp - 0x7cc]
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0xb80]
neg eax
jne 0x1002ac9c
xor eax, eax
jne 0x1002ac9c
cmp dword [ebp - 0x68], 0
jne 0x1002ac9c
and dword [ebp - 0x388], 0
jmp 0x1002aca6
mov dword [ebp - 0x388], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x388]
mov dword [ebp + eax - 0x990], ecx
mov eax, dword [ebp - 0x388]
sub eax, 9
mov dword [ebp - 0x970], eax
mov byte [ebp - 0x97], 0
push 0x32db
lea eax, [ebp - 0x97]
push eax
push 1
call fcn.100274a9
add esp, 0xc
jmp 0x1002aad1
and dword [ebp - 0x218], 0
jmp 0x1002ad00
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0xb
jae 0x1002ad19
mov eax, dword [ebp - 0x218]
mov byte [ebp + eax - 0x7e4], 0
jmp 0x1002acf3
mov dword [ebp - 0x14c], 0x53d8da8e
push 2
lea ecx, [ebp - 0x86c]
call fcn.10012956
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x360], 0x598aaf0a
mov dword [ebp - 0x530], 0x7e7c14ab
mov dword [ebp - 0x6a0], 0xdab551fa
mov dword [ebp - 0x548], 0xfffffff8
mov dword [ebp - 0x204], 1
mov dword [ebp - 0x550], 0xdd2e91c8
mov dword [ebp - 0x558], 0x38ca8c98
mov dword [ebp - 0x968], 0xc914a3a6
mov dword [ebp - 0xb54], 0x550e3526
mov dword [ebp - 0x1d4], 0
jmp 0x1002adaa
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 2
jge 0x1002adcc
push dword [ebp - 0x1d4]
lea ecx, [ebp - 0x86c]
call fcn.100129c3
mov dword [eax], 9
jmp 0x1002ad9d
push 0
lea ecx, [ebp - 0x86c]
call fcn.100129c3
mov eax, dword [ebp - 0x14c]
sub eax, dword [ebp - 0x14c]
mov dword [ebp - 0x940], eax
push 0
lea ecx, [ebp - 0x86c]
call fcn.100129c3
mov ecx, dword [ebp - 0x940]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0xbb4], eax
mov eax, dword [ebp - 0x360]
dec eax
mov dword [ebp - 0x360], eax
mov dword [ebp - 0x530], 0xfffffff9
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x6a0], eax
mov eax, dword [ebp - 0x360]
dec eax
cmp eax, dword [ebp - 0x6a0]
jl 0x1002ae4a
mov dword [ebp - 0x538], 1
jmp 0x1002ae51
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x548], eax
cmp dword [ebp - 0x204], 1
jb 0x1002ae72
mov dword [ebp - 0x758], 1
jmp 0x1002ae79
and dword [ebp - 0x758], 0
cmp dword [ebp - 0x758], 0x1f90ef30
je 0x1002ae91
mov dword [ebp - 0x540], 1
jmp 0x1002ae98
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x540], eax
je 0x1002aeb2
mov dword [ebp - 0x6a8], 1
jmp 0x1002aeb9
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0x6a8], eax
jl 0x1002aeeb
cmp dword [ebp - 0x548], 0
jne 0x1002aeeb
push 1
lea ecx, [ebp - 0x86c]
call fcn.100129c3
cmp dword [eax], 0
jne 0x1002aeeb
and dword [ebp - 0x7b4], 0
jmp 0x1002aef5
mov dword [ebp - 0x7b4], 1
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x550]
cmp dword [ebp - 0x14c], eax
je 0x1002af27
mov dword [ebp - 0x6b0], 1
jmp 0x1002af2e
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x558], eax
cmp dword [ebp - 0x558], 0
je 0x1002af65
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x1002af63
push 0x444d
push 1
call fcn.10027505
pop ecx
pop ecx
jmp 0x1002af9b
mov dword [ebp - 0x98c], 0xfff8
mov dword [ebp - 0x894], 0xfa8fad74
push 0x3162
push 0x3189
lea eax, [ebp - 0x98c]
push eax
lea eax, [ebp - 0x894]
push eax
push 0
call fcn.1002761f
add esp, 0x14
push 0x310b
push 0x63fe
push 0x11a6
lea eax, [ebp - 0x86c]
push eax
push 1
lea eax, [ebp - 0x968]
push eax
call fcn.10027553
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x86c]
call fcn.100129be
mov byte [ebp - 0x270], 3
mov byte [ebp - 0x26f], 0xb5
mov byte [ebp - 0x26e], 8
mov byte [ebp - 0x26d], 2
mov byte [ebp - 0x26c], 6
mov byte [ebp - 0x26b], 9
mov byte [ebp - 0x26a], 9
mov byte [ebp - 0x269], 9
mov byte [ebp - 0x268], 0x2d
mov byte [ebp - 0x267], 0x25
mov byte [ebp - 0x266], 0x89
mov byte [ebp - 0x265], 0x40
mov byte [ebp - 0x264], 0x63
mov byte [ebp - 0x263], 0xfc
mov byte [ebp - 0x262], 0x5b
mov byte [ebp - 0x261], 0xe4
mov byte [ebp - 0x260], 0x29
mov byte [ebp - 0x25f], 0x19
mov byte [ebp - 0x25e], 0x2e
mov byte [ebp - 0x25d], 0x28
mov byte [ebp - 0x25c], 0x17
mov byte [ebp - 0x25b], 0x4c
mov byte [ebp - 0x25a], 0xa0
mov byte [ebp - 0x259], 0x1b
mov byte [ebp - 0x258], 9
mov byte [ebp - 0x257], 0x2c
mov byte [ebp - 0x256], 0x3e
mov byte [ebp - 0x255], 0x85
mov byte [ebp - 0x254], 0x96
mov byte [ebp - 0x253], 0x42
mov byte [ebp - 0x252], 0xa4
mov byte [ebp - 0x251], 0x11
mov byte [ebp - 0x250], 5
mov byte [ebp - 0x24f], 0x57
mov byte [ebp - 0x24e], 5
mov byte [ebp - 0x24d], 0x51
mov byte [ebp - 0x24c], 0xe5
mov byte [ebp - 0x24b], 0x94
mov byte [ebp - 0x24a], 0x84
mov byte [ebp - 0x249], 0x32
mov byte [ebp - 0x248], 0x96
mov byte [ebp - 0x247], 0x9f
mov byte [ebp - 0x246], 0xbc
mov byte [ebp - 0x245], 0x8b
mov byte [ebp - 0x244], 0x77
mov byte [ebp - 0x243], 0xfa
mov byte [ebp - 0x242], 0xe6
mov byte [ebp - 0x241], 0x23
mov byte [ebp - 0x240], 0x8c
mov byte [ebp - 0x23f], 0xc5
mov byte [ebp - 0x23e], 0xf0
mov byte [ebp - 0x23d], 0x89
mov byte [ebp - 0x23c], 0xd8
mov byte [ebp - 0x23b], 0x2b
mov byte [ebp - 0x23a], 2
mov byte [ebp - 0x239], 7
mov byte [ebp - 0x238], 1
mov byte [ebp - 0x237], 1
mov byte [ebp - 0x236], 7
mov byte [ebp - 0x235], 0
mov byte [ebp - 0x234], 4
mov byte [ebp - 0x233], 2
mov byte [ebp - 0x232], 5
mov byte [ebp - 0x231], 5
mov byte [ebp - 0x230], 0
mov byte [ebp - 0x22f], 0
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x270]
or eax, 0x87
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x270]
and ecx, 0x87
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x270]
mov byte [ebp + ecx - 0x848], al
mov dword [ebp - 0x3c], 2
and dword [ebp - 0x1dc], 0
jmp 0x1002b1f5
mov eax, dword [ebp - 0x3c]
inc eax
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x42
jae 0x1002b2ba
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x270]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x3c], eax
jne 0x1002b23f
mov eax, dword [ebp - 0x3c]
movzx eax, byte [ebp + eax - 0x270]
inc eax
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [ebp + eax - 0x270]
mov ecx, dword [ebp - 0x3c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x3c], eax
jmp 0x1002b1ed
mov eax, dword [ebp - 0x3c]
movzx eax, byte [ebp + eax - 0x26f]
mov ecx, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x1dc]
movzx ecx, byte [ebp + ecx - 0x272]
movsx ecx, byte [ebp + ecx - 0x848]
or eax, ecx
mov ecx, dword [ebp - 0x3c]
movzx ecx, byte [ebp + ecx - 0x26f]
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x1dc]
movzx edx, byte [ebp + edx - 0x272]
movsx edx, byte [ebp + edx - 0x848]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x3c]
movzx ecx, byte [ebp + ecx - 0x270]
mov byte [ebp + ecx - 0x848], al
push 0
lea eax, [ebp - 0x1dc]
push eax
push 0x2f45
call fcn.10028458
add esp, 0xc
jmp 0x1002b1ed
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x848], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x170], 0x108f8256
mov byte [ebp - 0x9b], 0
movzx eax, byte [ebp - 0x9b]
test eax, eax
je 0x1002b2fc
push 0
push 0x15dc
call fcn.1002873d
pop ecx
pop ecx
mov dword [ebp - 0x124], 5
jmp 0x1002b315
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0x1a
jle 0x1002b3bd
push 1
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x124]
push eax
push 0x17da
call fcn.100275d6
add esp, 0x10
mov dword [ebp - 0x170], 0xc
jmp 0x1002b358
mov eax, dword [ebp - 0x170]
dec eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0xfffffff5
je 0x1002b3b8
push 2
lea ecx, [ebp - 0xa7c]
call fcn.10012956
mov dword [ebp - 4], 0xe
lea eax, [ebp - 0xb64]
push eax
lea eax, [ebp - 0xa7c]
push eax
push 0x6e20
push 0x3784
push 1
call fcn.1002761f
add esp, 0x14
push 1
lea ecx, [ebp - 0xa7c]
call fcn.100129c3
and dword [eax], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa7c]
call fcn.100129be
jmp 0x1002b34b
jmp 0x1002b308
lea eax, [ebp - 0x848]
push eax
lea ecx, [ebp - 0xcf8]
call fcn.1002ec02
mov dword [ebp - 0x89c], eax
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0x948], eax
mov dword [ebp - 4], 0xf
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x948]
call fcn.10013189
pop ecx
mov dword [ebp - 0x91c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcf8]
call fcn.1002ec8a
mov dword [ebp - 0x64], 0xe83c7730
mov dword [ebp - 0x568], 0xd35da2a
mov dword [ebp - 0x3a0], 0x52570e81
mov dword [ebp - 0x8ac], 0xfffffffd
mov dword [ebp - 0x228], 0
jmp 0x1002b44b
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 1
jge 0x1002b467
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0x994], 0xfffffff9
jmp 0x1002b43e
push 0
lea eax, [ebp - 0x64]
push eax
push 0x6118
push 0xab3
push 0x2623
call fcn.10028220
add esp, 0x14
mov dword [ebp - 0x64], 1
jmp 0x1002b494
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x30
jne 0x1002b6b8
mov dword [ebp - 0x12c], 0xffffffff
mov dword [ebp - 0x768], 1
mov dword [ebp - 0x17c], 0
jmp 0x1002b4cb
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 3
jge 0x1002b4e7
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0xb90], 1
jmp 0x1002b4be
cmp dword [ebp - 0x64], 0
jne 0x1002b4f9
mov dword [ebp - 0x6c0], 1
jmp 0x1002b500
and dword [ebp - 0x6c0], 0
cmp dword [ebp - 0x64], 0
jne 0x1002b515
cmp dword [ebp - 0x64], 0
jne 0x1002b515
and dword [ebp - 0x760], 0
jmp 0x1002b51f
mov dword [ebp - 0x760], 1
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x760], eax
jl 0x1002b536
mov dword [ebp - 0x560], 1
jmp 0x1002b53d
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x12c]
imul eax, dword [ebp - 0x560]
test eax, eax
jg 0x1002b55a
mov dword [ebp - 0x6b8], 1
jmp 0x1002b561
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x6b8]
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 0
je 0x1002b597
cmp dword [ebp - 0x3a0], 0
je 0x1002b597
mov dword [ebp - 0x79c], 1
jmp 0x1002b59e
and dword [ebp - 0x79c], 0
cmp dword [ebp - 0x79c], 0xffffffff
je 0x1002b5b3
mov dword [ebp - 0x8a4], 1
jmp 0x1002b5ba
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0xbdc], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb90], 0
je 0x1002b5ea
cmp dword [ebp - 0x12c], 0
je 0x1002b5ea
mov dword [ebp - 0x570], 1
jmp 0x1002b5f1
and dword [ebp - 0x570], 0
imul eax, dword [ebp - 0x570], 0x85ca
cmp eax, dword [ebp - 0x12c]
jge 0x1002b60f
mov dword [ebp - 0x578], 1
jmp 0x1002b616
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x6c0]
imul eax, dword [ebp - 0x578]
sub eax, dword [ebp - 0x12c]
mov dword [ebp - 0x768], eax
mov eax, dword [ebp - 0x768]
push 4
pop ecx
shl ecx, 1
sub eax, dword [ebp + ecx - 0xb90]
neg eax
jne 0x1002b658
xor eax, eax
jne 0x1002b658
cmp dword [ebp - 0x64], 0
jne 0x1002b658
and dword [ebp - 0x368], 0
jmp 0x1002b662
mov dword [ebp - 0x368], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x368]
mov dword [ebp + eax - 0x994], ecx
mov eax, dword [ebp - 0x368]
sub eax, 9
mov dword [ebp - 0x8ac], eax
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x1002b6b3
push 0
push 0x1f08
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
jmp 0x1002b48d
and dword [ebp - 0x1e4], 0
jmp 0x1002b6ce
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 0xb
jae 0x1002b6e7
mov eax, dword [ebp - 0x1e4]
mov byte [ebp + eax - 0x848], 0
jmp 0x1002b6c1
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x8c], 1
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x5e0], 0xffffffff
mov dword [ebp - 0x8b4], 5
mov dword [ebp - 0x78], 0
jmp 0x1002b726
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1002b739
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x40], 0xffffffff
jmp 0x1002b71f
mov dword [ebp - 0x78], 0
jmp 0x1002b749
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 4
jge 0x1002b75f
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x9a4], 0xfffffff8
jmp 0x1002b742
mov dword [ebp - 0x18], 0
jmp 0x1002b76f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x1002ba1c
mov dword [ebp - 0x390], 0xb372
mov dword [ebp - 0x770], 0xffffffff
mov dword [ebp - 0x5b8], 4
mov dword [ebp - 0x950], 0xffffffff
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x40]
mov dword [ebp - 0xabc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
cmp dword [ebp - 0x18], eax
je 0x1002b7c9
mov dword [ebp - 0x580], 1
jmp 0x1002b7d0
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x40]
cmp dword [ebp - 0x580], eax
je 0x1002b7eb
mov dword [ebp - 0x6c8], 1
jmp 0x1002b7f2
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x6c8]
sub eax, dword [ebp - 0x390]
cmp eax, 0x9cbc21b0
ja 0x1002b811
mov dword [ebp - 0x588], 1
jmp 0x1002b818
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x40]
imul eax, dword [ebp - 0x588]
cmp eax, 0x3a79cc09
jl 0x1002b839
mov dword [ebp - 0x77c], 1
jmp 0x1002b840
and dword [ebp - 0x77c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
cmp dword [ebp - 0x77c], eax
je 0x1002b85e
mov dword [ebp - 0x590], 1
jmp 0x1002b865
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x590], eax
jle 0x1002b87f
mov dword [ebp - 0x6d0], 1
jmp 0x1002b886
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x6d0], eax
jge 0x1002b89d
mov dword [ebp - 0x598], 1
jmp 0x1002b8a4
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0x770], eax
mov eax, dword [ebp - 0x390]
cmp dword [ebp - 0x770], eax
jle 0x1002b8ca
mov dword [ebp - 0x5a0], 1
jmp 0x1002b8d1
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x5a0], eax
jl 0x1002b8eb
mov dword [ebp - 0x6d8], 1
jmp 0x1002b8f2
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x390]
cmp eax, dword [ebp - 0x6d8]
jl 0x1002b90c
mov dword [ebp - 0x5a8], 1
jmp 0x1002b913
and dword [ebp - 0x5a8], 0
cmp dword [ebp - 0x5a8], 3
jg 0x1002b928
mov dword [ebp - 0x784], 1
jmp 0x1002b92f
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x40]
cmp eax, dword [ebp - 0x784]
jg 0x1002b94a
mov dword [ebp - 0x5b0], 1
jmp 0x1002b951
and dword [ebp - 0x5b0], 0
cmp dword [ebp - 0x5b0], 0xbd77
jg 0x1002b969
mov dword [ebp - 0x6e0], 1
jmp 0x1002b970
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x6e0]
mov dword [ebp - 0x5b8], eax
mov eax, dword [ebp - 0x5b8]
mov ecx, dword [ebp - 0x18]
add eax, dword [ebp + ecx*4 - 0x40]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x40]
jl 0x1002b9a1
mov dword [ebp - 0x3b8], 1
jmp 0x1002b9a8
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x40]
add eax, dword [ebp - 0x3b8]
cmp eax, dword [ebp - 0x18]
jle 0x1002b9c6
mov dword [ebp - 0x5c0], 1
jmp 0x1002b9cd
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x40]
imul eax, dword [ebp - 0x5c0]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x9a4]
test eax, eax
je 0x1002ba02
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x40], 0
je 0x1002ba02
mov dword [ebp - 0x6e8], 1
jmp 0x1002ba09
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x6e8]
neg eax
mov dword [ebp - 0x950], eax
jmp 0x1002b768
mov dword [ebp - 0x154], 0
jmp 0x1002ba35
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xe
je 0x1002bfb4
mov dword [ebp - 0x80], 0x335a
mov dword [ebp - 0x618], 0xfffffff9
mov dword [ebp - 0x710], 0xffffffff
mov dword [ebp - 0x8c], 0
jmp 0x1002ba76
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0x17
jle 0x1002bfaf
mov dword [ebp - 0x100], 0
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xacc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x80]
cmp dword [ebp + eax - 0x40], ecx
jl 0x1002bac6
mov dword [ebp - 0x5c8], 1
jmp 0x1002bacd
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x5c8], eax
jl 0x1002bae7
mov dword [ebp - 0x78c], 1
jmp 0x1002baee
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x78c]
sub eax, dword [ebp - 0x80]
cmp dword [ebp - 0x100], eax
jne 0x1002bb0b
mov dword [ebp - 0x5d0], 1
jmp 0x1002bb12
and dword [ebp - 0x5d0], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x9a4]
cmp eax, dword [ebp - 0x5d0]
je 0x1002bb33
mov dword [ebp - 0x6f0], 1
jmp 0x1002bb3a
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x6f0]
jne 0x1002bb63
cmp dword [ebp - 0x18], 0
jne 0x1002bb63
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x9a4], 0
jne 0x1002bb63
and dword [ebp - 0x5d8], 0
jmp 0x1002bb6d
mov dword [ebp - 0x5d8], 1
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x5d8], eax
jne 0x1002bb87
mov dword [ebp - 0x794], 1
jmp 0x1002bb8e
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x5e0], eax
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x5e0], eax
jl 0x1002bbb1
mov dword [ebp - 0x6f8], 1
jmp 0x1002bbb8
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x6f8]
sub eax, dword [ebp - 0x8c]
je 0x1002bdd4
push 1
lea ecx, [ebp - 0x830]
call fcn.10012956
mov dword [ebp - 4], 0x10
push 2
lea ecx, [ebp - 0xa94]
call fcn.10012956
mov byte [ebp - 4], 0x11
push 0x391f
push 0
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x830]
push eax
push 0x7ceb
call fcn.100278b3
add esp, 0x14
mov dword [ebp - 0xfc], 0
jmp 0x1002bc2a
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 2
jge 0x1002bc4c
push dword [ebp - 0xfc]
lea ecx, [ebp - 0xa94]
call fcn.100129c3
mov dword [eax], 0x405a8158
jmp 0x1002bc1d
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x80], eax
je 0x1002bc69
mov dword [ebp - 0x7a0], 1
jmp 0x1002bc70
and dword [ebp - 0x7a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
mov dword [ebp - 0x5e8], eax
push 1
lea ecx, [ebp - 0xa94]
call fcn.100129c3
mov ecx, dword [ebp - 0x5e8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5e8]
cmp eax, dword [ebp - 0x7a0]
jle 0x1002bcaf
mov dword [ebp - 0x5f0], 1
jmp 0x1002bcb6
and dword [ebp - 0x5f0], 0
push 0
lea ecx, [ebp - 0x830]
call fcn.100129c3
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5f0]
je 0x1002bcd9
mov dword [ebp - 0x700], 1
jmp 0x1002bce0
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x700]
jge 0x1002bcf7
mov dword [ebp - 0x5f8], 1
jmp 0x1002bcfe
and dword [ebp - 0x5f8], 0
imul esi, dword [ebp - 0x5f8], 0x996b
push 0
lea ecx, [ebp - 0x830]
call fcn.100129c3
sub esi, dword [eax]
sub esi, dword [ebp - 0x8b4]
push 0
lea ecx, [ebp - 0x830]
call fcn.100129c3
sub esi, dword [eax]
cmp esi, 0x3d18
jne 0x1002bd40
push 3
lea ecx, [ebp - 0x83c]
call fcn.10012956
mov dword [ebp - 4], 0x12
push 0x276d
lea eax, [ebp - 0xadc]
push eax
lea eax, [ebp - 0x83c]
push eax
push 0x5ed3
push 0
push 0x747b
push 0xae7
call fcn.10027c86
add esp, 0x1c
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x9a4], 0
jne 0x1002bf1c
xor eax, eax
inc eax
je 0x1002be4b
push 0
lea ecx, [ebp - 0x83c]
call fcn.100129c3
cmp dword [eax], 0
je 0x1002be4b
mov dword [ebp - 0x608], 1
jmp 0x1002be52
and dword [ebp - 0x608], 0
push 0
lea ecx, [ebp - 0x83c]
call fcn.100129c3
mov ecx, dword [ebp - 0x608]
cmp ecx, dword [eax]
jg 0x1002be75
mov dword [ebp - 0x7a8], 1
jmp 0x1002be7c
and dword [ebp - 0x7a8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9a4]
imul eax, dword [ebp - 0x7a8]
test eax, eax
je 0x1002bea6
cmp dword [ebp - 0x80], 0
je 0x1002bea6
mov dword [ebp - 0x918], 1
jmp 0x1002bead
and dword [ebp - 0x918], 0
push 2
lea ecx, [ebp - 0x83c]
call fcn.100129c3
push 5
pop eax
test eax, eax
je 0x1002bedf
push 2
lea ecx, [ebp - 0x83c]
call fcn.100129c3
cmp dword [eax], 0
je 0x1002bedf
mov dword [ebp - 0x610], 1
jmp 0x1002bee6
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0x710], eax
mov eax, dword [ebp - 0x710]
mov dword [ebp - 0xae4], eax
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0xaec], eax
cmp dword [ebp - 0x8c], 0
jne 0x1002bf1c
and dword [ebp - 0x8bc], 0
jmp 0x1002bf26
mov dword [ebp - 0x8bc], 1
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xaf4], eax
push 0
lea ecx, [ebp - 0x83c]
call fcn.100129c3
cmp dword [eax], 0
jne 0x1002bf59
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x9a4], 0
jne 0x1002bf59
and dword [ebp - 0x790], 0
jmp 0x1002bf63
mov dword [ebp - 0x790], 1
cmp dword [ebp - 0x790], 0x7caf8ba4
jg 0x1002bf7b
mov dword [ebp - 0x620], 1
jmp 0x1002bf82
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0x100], eax
lea eax, [ebp - 0x18]
push eax
push 1
call fcn.100276a0
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x83c]
call fcn.100129be
jmp 0x1002ba69
jmp 0x1002ba28
push dword [ebp - 0x91c]
push dword [ebp - 0x8c4]
call fcn.10024ed3
pop ecx
pop ecx
mov dword [ebp - 0x668], eax
mov dword [ebp - 0x628], 0xfffffffe
mov dword [ebp - 0x718], 0
mov dword [ebp - 0x108], 0xffffffff
mov dword [ebp - 0x19c], 0
jmp 0x1002c004
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 1
jge 0x1002c020
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x924], 1
jmp 0x1002bff7
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x718], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x924]
cmp dword [ebp - 0x718], eax
jle 0x1002c054
push 3
pop eax
test eax, eax
je 0x1002c054
mov dword [ebp - 0x7b0], 1
jmp 0x1002c05b
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x628]
cmp dword [ebp - 0x7b0], eax
jl 0x1002c075
mov dword [ebp - 0x630], 1
jmp 0x1002c07c
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x108], 0
jmp 0x1002c0a1
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jg 0x1002c0cc
mov byte [ebp - 0xbe], 0
movzx eax, byte [ebp - 0xbe]
test eax, eax
je 0x1002c0ca
push 1
push 0x2911
call fcn.100276d9
pop ecx
pop ecx
jmp 0x1002c094
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0x668]
mov dword [eax + 8], ecx
mov dword [ebp - 0x50], 0x6e3245f1
mov dword [ebp - 0x370], 2
mov dword [ebp - 0x94], 0xb1857497
mov dword [ebp - 0xf8], 0x950169ff
push 1
lea ecx, [ebp - 0xa28]
call fcn.10012956
mov dword [ebp - 4], 0x13
push 1
lea eax, [ebp - 0xa28]
push eax
push 0xd72
lea eax, [ebp - 0xb00]
push eax
push 0x39f1
call fcn.1002771b
add esp, 0x14
cmp dword [ebp - 0x50], 0xeccc
jge 0x1002c14b
mov dword [ebp - 0x660], 1
jmp 0x1002c152
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x370], eax
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0xb38], eax
cmp dword [ebp - 0x50], 0x507af9ca
jl 0x1002c17c
mov dword [ebp - 0x720], 1
jmp 0x1002c183
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x720], eax
jg 0x1002c19f
xor eax, eax
inc eax
je 0x1002c19f
mov dword [ebp - 0x638], 1
jmp 0x1002c1a6
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x638], eax
jge 0x1002c1c0
mov dword [ebp - 0x798], 1
jmp 0x1002c1c7
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x798], eax
jne 0x1002c1de
mov dword [ebp - 0x640], 1
jmp 0x1002c1e5
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x640]
sub eax, dword [ebp - 0x94]
imul eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x50]
jg 0x1002c209
mov dword [ebp - 0x728], 1
jmp 0x1002c210
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x728], eax
je 0x1002c227
mov dword [ebp - 0x648], 1
jmp 0x1002c22e
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0xf8]
imul eax, dword [ebp - 0x648]
imul eax, dword [ebp - 0x50]
cmp eax, 0xbb9a67b9
jb 0x1002c252
mov dword [ebp - 0x7b8], 1
jmp 0x1002c259
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x7b8], eax
jge 0x1002c273
mov dword [ebp - 0x650], 1
jmp 0x1002c27a
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
je 0x1002c2a4
cmp dword [ebp - 0x370], 0
je 0x1002c2a4
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xb40], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xba8], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x94], eax
jne 0x1002c2d4
push 0
push 0x1e0a
push 0
push 0x24c4
push 0x958
push 0
push 0xe63
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret