Function at 0x1002d1c5
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10063af4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x5c4
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x78], 1
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x108], eax
push 1
push 1
push 0x6d81
push 0x217d
call fcn.100244cd
add esp, 0x10
push 8
pop eax
shl eax, 0
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x88], 1
mov dword [ebp - 0x88], 0
jmp 0x1002d24b
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x1d
jg 0x1002d27e
mov byte [ebp - 0x51], 0
push 0
push 0x1e35
push 0x58e8
push 1
lea eax, [ebp - 0x51]
push eax
push 0x7414
call fcn.100303e0
add esp, 0x18
call fcn.1002cbc4
jmp 0x1002d23e
mov byte [ebp - 0x41], 0
lea eax, [ebp - 0x41]
push eax
call fcn.1002ccbb
pop ecx
mov eax, dword [ebp - 0x1b4]
cmp dword [eax + 4], 0
jbe 0x1002f81b
mov dword [ebp - 0x4c0], 8
call fcn.1002ccf5
mov byte [ebp - 0x54], 0
movzx eax, byte [ebp - 0x54]
test eax, eax
je 0x1002d2d2
push 1
push 0x7faf
push 0x7c25
push 0x45ca
push 1
call fcn.1002ad11
add esp, 0x14
mov eax, dword [ebp - 0x1b4]
mov ecx, dword [ebp - 0x108]
add ecx, dword [eax]
mov dword [ebp - 0x60], ecx
jmp 0x1002d2ee
mov eax, dword [ebp - 0x60]
add eax, 0x14
mov dword [ebp - 0x60], eax
push dword [ebp - 0x60]
call fcn.10024183
pop ecx
movzx eax, al
test eax, eax
jne 0x1002f81b
mov eax, dword [ebp - 0x60]
cmp dword [eax + 0xc], 0
je 0x1002f81b
mov dword [ebp - 0x90], 0x71c7
mov dword [ebp - 0x2b0], 0xab274bf9
mov dword [ebp - 0x154], 0xf3f17e2f
mov dword [ebp - 0x228], 0xffffffff
mov dword [ebp - 0x100], 0
jmp 0x1002d350
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 3
jge 0x1002d36c
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x560], 0xf145ba13
jmp 0x1002d343
mov byte [ebp - 0x49], 0
push 1
push 0x3350
push 0x111d
push 0x5d01
push 1
push 0
push 0xfa0
lea eax, [ebp - 0x49]
push eax
call fcn.10031558
add esp, 0x20
mov dword [ebp - 0x2b0], 0x43250e6d
cmp dword [ebp - 0x2b0], 0
je 0x1002d3be
mov eax, 0xdcad2086
test eax, eax
je 0x1002d3be
mov dword [ebp - 0x220], 1
jmp 0x1002d3c5
and dword [ebp - 0x220], 0
mov eax, 0xaab72b21
test eax, eax
je 0x1002d3e3
cmp dword [ebp - 0x90], 0
je 0x1002d3e3
mov dword [ebp - 0x2dc], 1
jmp 0x1002d3ea
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
cmp eax, dword [ebp - 0x90]
jne 0x1002d419
mov eax, 0x39ecf4a4
test eax, eax
je 0x1002d419
mov dword [ebp - 0x158], 1
jmp 0x1002d420
and dword [ebp - 0x158], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x158], eax
jl 0x1002d43a
mov dword [ebp - 0x160], 1
jmp 0x1002d441
and dword [ebp - 0x160], 0
mov eax, dword [ebp - 0x220]
cmp eax, dword [ebp - 0x160]
jle 0x1002d45b
mov dword [ebp - 0x284], 1
jmp 0x1002d462
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x284]
jne 0x1002d47c
mov dword [ebp - 0x168], 1
jmp 0x1002d483
and dword [ebp - 0x168], 0
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x560], eax
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x108]
add ecx, dword [eax + 0xc]
push ecx
push 0x6c69
push 0x43c5
call fcn.10044bca
pop ecx
pop ecx
call eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x74], 0x8b13
mov dword [ebp - 0x40], 0x64896e6a
mov dword [ebp - 0x3f8], 0x2d683a7e
lea eax, [ebp - 0x74]
push eax
call fcn.1002cd24
pop ecx
mov dword [ebp - 0x74], 5
jmp 0x1002d4fa
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x14
jge 0x1002da2a
mov dword [ebp - 0x18], 0x47597a61
mov dword [ebp - 0xfc], 0
jmp 0x1002d524
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 2
jge 0x1002d540
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x4e8], 0
jmp 0x1002d517
cmp dword [ebp - 0x18], 5
ja 0x1002d552
mov dword [ebp - 0x170], 1
jmp 0x1002d559
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x170]
jl 0x1002d570
mov dword [ebp - 0x36c], 1
jmp 0x1002d577
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x40], 0xfffffff8
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x18], 0
je 0x1002d5bb
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x1002d5bb
mov dword [ebp - 0x288], 1
jmp 0x1002d5c2
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x288]
je 0x1002d8c8
mov dword [ebp - 0x40], 0xfffffff0
jmp 0x1002d5e1
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xfffffff8
jl 0x1002d8b5
push 3
lea ecx, [ebp - 0x418]
call fcn.1001b7ad
and dword [ebp - 4], 0
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.1002cd3d
pop ecx
pop ecx
mov dword [ebp - 0x68], 0
jmp 0x1002d61e
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x1002d634
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x58c], 0xfffffffa
jmp 0x1002d617
mov dword [ebp - 0x18], 0
jmp 0x1002d644
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x1002d8a1
mov dword [ebp - 0x52c], 1
mov dword [ebp - 0x4d4], 0xa54e5878
mov dword [ebp - 0x98], 0
jmp 0x1002d67b
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x1002d697
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x408], 0xfffffffb
jmp 0x1002d66e
mov dword [ebp - 0x178], 0x2c58
mov dword [ebp - 0x3e0], 0x1000a540
cmp dword [ebp - 0x178], 0x2e80
jle 0x1002d7a1
and dword [ebp - 0x7c], 0
jmp 0x1002d6c8
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0x4c2
jge 0x1002d78a
and dword [ebp - 0xa0], 0
jmp 0x1002d6eb
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0x404f
jge 0x1002d785
and dword [ebp - 0xec], 0
jmp 0x1002d711
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x322a
jge 0x1002d780
and dword [ebp - 0xa8], 0
jmp 0x1002d733
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x3307
jge 0x1002d77e
mov eax, dword [ebp - 0x7c]
cdq
idiv dword [ebp - 0xa0]
imul edx, dword [ebp - 0xec]
imul edx, dword [ebp - 0xa8]
mov eax, edx
cdq
mov dword [ebp - 0x378], eax
mov dword [ebp - 0x374], edx
push dword [ebp - 0x374]
push dword [ebp - 0x378]
mov ecx, 0x1060c3d8
call fcn.1001b57c
jmp 0x1002d726
jmp 0x1002d704
jmp 0x1002d6de
jmp 0x1002d6c1
push 0
push 0x161c
push 0x8d5
push 0x1a2c
call dword [sym.imp.KERNEL32.dll_RaiseException]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.1002cd85
pop ecx
pop ecx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x178], 0x2a69
jge 0x1002d7d3
mov edx, dword [ebp - 0x3e0]
mov ecx, 0x1060c3d8
call fcn.1001da87
jmp 0x1002d7ef
and dword [ebp - 4], 0
jmp 0x1002d7f9
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x408], 2
jmp 0x1002d827
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x408]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x408], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x408], 0
jl 0x1002d89c
mov dword [ebp - 0x3e8], 0xfffffffe
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x408]
lea ecx, [ebp - 0x418]
call fcn.1001b84b
mov esi, eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x418]
call fcn.1001b84b
mov eax, dword [eax]
mov dword [esi], eax
push 0x6e74
push 0x7597
push 0
push 0xce4
push 0x110b
push 0x6ac2
lea eax, [ebp - 0x3e8]
push eax
call fcn.1002fa9e
add esp, 0x1c
jmp 0x1002d80c
jmp 0x1002d63d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x418]
call fcn.1001b82f
jmp 0x1002d5da
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x4e8], 0xa1dd7933
jmp 0x1002d8d9
mov byte [ebp - 0x56], 0
movzx eax, byte [ebp - 0x56]
test eax, eax
je 0x1002d8d9
call fcn.1002cee4
mov dword [ebp - 0x230], 0x6652
mov dword [ebp - 0x320], 0x1000a58c
cmp dword [ebp - 0x230], 0x6964
jle 0x1002d9d2
and dword [ebp - 0x10c], 0
jmp 0x1002d913
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x4e24
jge 0x1002d9d2
and dword [ebp - 0xb0], 0
jmp 0x1002d939
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x5afe
jge 0x1002d9cd
and dword [ebp - 0xf4], 0
jmp 0x1002d95f
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0x2e5b
jge 0x1002d9c8
mov eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0xf4]
cdq
mov dword [ebp - 0x384], eax
mov dword [ebp - 0x380], edx
push dword [ebp - 0x380]
push dword [ebp - 0x384]
lea ecx, [ebp - 0x5bc]
call fcn.1000db9a
pop ecx
pop ecx
mov dword [ebp - 0x3f0], eax
mov ecx, dword [ebp - 0x3f0]
call fcn.1001b55c
push eax
call fcn.1004de26
pop ecx
lea ecx, [ebp - 0x5bc]
call fcn.1001b552
jmp 0x1002d952
jmp 0x1002d92c
jmp 0x1002d906
cmp dword [ebp - 0x3f8], 0
je 0x1002d9e0
jmp 0x1002d4f3
mov dword [ebp - 4], 3
cmp dword [ebp - 0x230], 0x626b
jge 0x1002d9ff
push dword [ebp - 0x320]
call fcn.1004de26
pop ecx
jmp 0x1002da1b
or dword [ebp - 4], 0xffffffff
jmp 0x1002da25
jmp 0x1002d4f3
cmp dword [ebp - 0x11c], 0
jne 0x1002e3e2
and dword [ebp - 0x78], 0
mov dword [ebp - 0x2c], 0x72a72759
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x180], 0x7dd0
mov dword [ebp - 0x314], 0x1000a5d4
cmp dword [ebp - 0x180], 0x80c6
jle 0x1002db49
and dword [ebp - 0xc0], 0
jmp 0x1002da83
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x52d7
jge 0x1002db49
and dword [ebp - 0xb8], 0
jmp 0x1002daa9
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0x6d77
jge 0x1002db44
and dword [ebp - 0x104], 0
jmp 0x1002dacf
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x2b72
jge 0x1002db3f
and dword [ebp - 0xe0], 0
jmp 0x1002daf1
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0x301b
jge 0x1002db3d
mov ecx, dword [ebp - 0xb8]
imul ecx, dword [ebp - 0x104]
mov eax, dword [ebp - 0xc0]
shl eax, cl
and eax, dword [ebp - 0xe0]
cdq
mov dword [ebp - 0x390], eax
mov dword [ebp - 0x38c], edx
push dword [ebp - 0x38c]
push dword [ebp - 0x390]
mov ecx, 0x1060c3d8
call fcn.1001b57c
jmp 0x1002dae4
jmp 0x1002dac2
jmp 0x1002da9c
jmp 0x1002da76
mov dword [ebp - 0x2c8], 0xa52b4b5a
mov dword [ebp - 4], 5
cmp dword [ebp - 0x180], 0x7d58
jge 0x1002db76
mov edx, dword [ebp - 0x314]
mov ecx, 0x1060c3d8
call fcn.1001da87
jmp 0x1002db92
or dword [ebp - 4], 0xffffffff
jmp 0x1002db9c
mov dword [ebp - 0x248], 2
mov dword [ebp - 0x5c], 0x90200244
mov dword [ebp - 0x3dc], 0x4f6f4846
mov dword [ebp - 0x1d0], 0x3d58e56a
mov dword [ebp - 0x4f8], 0x6158e9d2
mov dword [ebp - 0x4dc], 0x268d9a6
mov dword [ebp - 0x500], 0x6e2e31b5
push 1
lea ecx, [ebp - 0x528]
call fcn.1001b7ad
mov dword [ebp - 4], 7
mov dword [ebp - 0x508], 0x395b915f
push 3
lea ecx, [ebp - 0x518]
call fcn.1001b7ad
mov byte [ebp - 4], 8
push 0x7122
push 0x62e8
push 0x7027
push 1
push 0x2192
push 0x540d
push 0
push 0x1224
push 1
push 0x4b86
push 0x656a
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x33c]
push eax
call fcn.1002bc40
add esp, 0x34
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x33c]
push eax
call fcn.1002ceef
pop ecx
pop ecx
cmp dword [ebp - 0x2c], 0
jne 0x1002dc77
cmp dword [ebp - 0x48], 0
je 0x1002dd66
mov dword [ebp - 0x2c8], 0x93c86992
cmp dword [ebp - 0x2c8], 0
mov eax, 0xb39d2057
sub eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x48]
jl 0x1002dca5
mov dword [ebp - 0x188], 1
jmp 0x1002dcac
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x188]
add eax, 0xa4d9
cmp eax, dword [ebp - 0x2c]
jge 0x1002dcc8
mov dword [ebp - 0x238], 1
jmp 0x1002dccf
and dword [ebp - 0x238], 0
cmp dword [ebp - 0x238], 0xfffffff7
jg 0x1002dce4
mov dword [ebp - 0x190], 1
jmp 0x1002dceb
and dword [ebp - 0x190], 0
cmp dword [ebp - 0x190], 0xffffffff
jg 0x1002dd00
mov dword [ebp - 0x290], 1
jmp 0x1002dd07
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x290], eax
jl 0x1002dd16
cmp dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x2c]
jle 0x1002dd2a
mov dword [ebp - 0x198], 1
jmp 0x1002dd31
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x198], eax
jl 0x1002dd48
mov dword [ebp - 0x240], 1
jmp 0x1002dd4f
and dword [ebp - 0x240], 0
imul eax, dword [ebp - 0x240], 0xffffffff
test eax, eax
je 0x1002dd66
mov dword [ebp - 0x1a0], 1
jmp 0x1002dd6d
and dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x1a0], eax
jge 0x1002dd84
mov dword [ebp - 0x2b8], 1
jmp 0x1002dd8b
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x2b8]
jle 0x1002dda2
mov dword [ebp - 0x1a8], 1
jmp 0x1002dda9
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
je 0x1002ddd0
cmp dword [ebp - 0x2c], 0
je 0x1002ddd0
mov dword [ebp - 0x1b0], 1
jmp 0x1002ddd7
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x1b0]
imul eax, eax, 0xe487
cmp eax, dword [ebp - 0x2c]
jg 0x1002ddf7
mov dword [ebp - 0x298], 1
jmp 0x1002ddfe
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x5c], 0x13
jmp 0x1002de17
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jle 0x1002e3bf
mov dword [ebp - 0x1b8], 0x74d
mov dword [ebp - 0x3fc], 0x1000a620
cmp dword [ebp - 0x1b8], 0xb0d
jle 0x1002df31
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
and dword [ebp - 0xd0], 0
jmp 0x1002de6b
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0x43c2
jge 0x1002df31
and dword [ebp - 0xc8], 0
jmp 0x1002de91
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0xb32
jge 0x1002df2c
and dword [ebp - 0xe8], 0
jmp 0x1002deb7
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0x7dea
jge 0x1002df27
and dword [ebp - 0xf0], 0
jmp 0x1002ded9
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0x3e57
jge 0x1002df25
mov eax, dword [ebp - 0xc8]
cdq
idiv dword [ebp - 0xe8]
and edx, dword [ebp - 0xd0]
xor edx, dword [ebp - 0xf0]
mov eax, edx
cdq
mov dword [ebp - 0x39c], eax
mov dword [ebp - 0x398], edx
push dword [ebp - 0x398]
push dword [ebp - 0x39c]
mov ecx, 0x1060c3d8
call fcn.1001b57c
jmp 0x1002decc
jmp 0x1002deaa
jmp 0x1002de84
jmp 0x1002de5e
mov dword [ebp - 0x120], 6
mov byte [ebp - 4], 9
cmp dword [ebp - 0x1b8], 0x5c5
jge 0x1002df5b
mov edx, dword [ebp - 0x3fc]
mov ecx, 0x1060c3d8
call fcn.1001da87
jmp 0x1002df77
mov dword [ebp - 4], 8
jmp 0x1002df87
mov dword [ebp - 0x250], 0x2ed0
mov dword [ebp - 0x394], 0x1000a678
cmp dword [ebp - 0x250], 0x316c
jle 0x1002e073
and dword [ebp - 0x80], 0
jmp 0x1002dfb8
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x3d06
jge 0x1002e073
and dword [ebp - 0xd8], 0
jmp 0x1002dfdb
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x50ae
jge 0x1002e06e
and dword [ebp - 0xf8], 0
jmp 0x1002e001
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0x46ae
jge 0x1002e069
mov ecx, dword [ebp - 0xd8]
sub ecx, dword [ebp - 0xf8]
mov eax, dword [ebp - 0x80]
shl eax, cl
cdq
mov dword [ebp - 0x3a8], eax
mov dword [ebp - 0x3a4], edx
push dword [ebp - 0x3a4]
push dword [ebp - 0x3a8]
lea ecx, [ebp - 0x5a4]
call fcn.1000db9a
pop ecx
pop ecx
mov dword [ebp - 0x328], eax
mov ecx, dword [ebp - 0x328]
call fcn.1001b55c
push eax
call fcn.1004de26
pop ecx
lea ecx, [ebp - 0x5a4]
call fcn.1001b552
jmp 0x1002dff4
jmp 0x1002dfce
jmp 0x1002dfb1
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x250], 0x2bab
jge 0x1002e08f
push dword [ebp - 0x394]
call fcn.1004de26
pop ecx
jmp 0x1002e0ab
mov dword [ebp - 4], 8
jmp 0x1002e0bb
mov dword [ebp - 0x130], 0x7b5881f6
mov dword [ebp - 0x1c0], 0x2b33
mov dword [ebp - 0x330], 0x1000a6f4
cmp dword [ebp - 0x1c0], 0x2e82
jle 0x1002e15e
and dword [ebp - 0x84], 0
jmp 0x1002e0fb
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0x6377
jge 0x1002e15e
and dword [ebp - 0x8c], 0
jmp 0x1002e11d
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0x5538
jge 0x1002e15c
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0x8c]
shl eax, cl
cdq
mov dword [ebp - 0x3b4], eax
mov dword [ebp - 0x3b0], edx
push dword [ebp - 0x3b0]
push dword [ebp - 0x3b4]
mov ecx, 0x1060c3d8
call fcn.1001b57c
jmp 0x1002e110
jmp 0x1002e0ee
mov dword [ebp - 0x440], 0xfffffffc
mov dword [ebp - 0x43c], 0xfffffffc
mov dword [ebp - 0x438], 0xfffffffc
mov dword [ebp - 0x434], 0xfffffffc
lea ecx, [ebp - 0x111]
call fcn.1001b85a
push eax
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x580]
call fcn.1001b85d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x4f4]
call fcn.1001b809
mov byte [ebp - 4], 0xd
mov byte [ebp - 4], 0xe
cmp dword [ebp - 0x1c0], 0x284e
jge 0x1002e1df
mov edx, dword [ebp - 0x330]
mov ecx, 0x1060c3d8
call fcn.1001da87
jmp 0x1002e1fb
mov dword [ebp - 4], 0xd
jmp 0x1002e20b
mov dword [ebp - 0x94], 0
jmp 0x1002e224
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 4
jge 0x1002e240
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x498], 0x76e9f81a
jmp 0x1002e217
push 0x66ec
push 0x7a27
push 0x443b
lea eax, [ebp - 0x5c]
push eax
push 0x4246
push 1
lea eax, [ebp - 0x120]
push eax
push 0x624b
push 0x33ff
push 0x5d64
push 0x5b3e
push 0x4dac
push 0x6a84
push 1
call fcn.1002b049
add esp, 0x38
mov eax, 0x654a
test eax, eax
je 0x1002e2ad
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x498], 0
je 0x1002e2ad
mov dword [ebp - 0x2d8], 1
jmp 0x1002e2b4
and dword [ebp - 0x2d8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x498]
imul eax, dword [ebp - 0x2d8]
test eax, eax
jne 0x1002e2de
mov eax, 0x8ba3
test eax, eax
jne 0x1002e2de
and dword [ebp - 0x1c8], 0
jmp 0x1002e2e8
mov dword [ebp - 0x1c8], 1
mov eax, dword [ebp - 0x1d0]
cmp dword [ebp - 0x1c8], eax
je 0x1002e302
mov dword [ebp - 0x258], 1
jmp 0x1002e309
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x258]
add eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x338], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x338]
mov dword [ebp + eax - 0x498], ecx
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x548], eax
mov dword [ebp - 0x120], 0xa471
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x3a0], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x130]
add ecx, dword [ebp + eax - 0x498]
mov dword [ebp - 0x340], ecx
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x3a0]
cmp eax, dword [ebp - 0x340]
je 0x1002e38f
mov dword [ebp - 0x2a0], 1
jmp 0x1002e396
and dword [ebp - 0x2a0], 0
push 1
lea ecx, [ebp - 0x4f4]
call fcn.1001b84b
mov ecx, dword [ebp - 0x2a0]
mov dword [eax], ecx
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x4f4]
call fcn.1001b82f
jmp 0x1002de10
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x518]
call fcn.1001b82f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x528]
call fcn.1001b82f
jmp 0x1002f81b
push 0x3d1d
lea eax, [ebp + 8]
push eax
push 0x4bee
push 0
call fcn.10031240
add esp, 0x10
mov dword [ebp - 0x504], 8
mov byte [ebp - 0x53], 0
lea eax, [ebp - 0x53]
push eax
call fcn.1002cf37
pop ecx
mov byte [ebp - 0x58], 0
push 0x5c70
push 0x4145
push 0
lea eax, [ebp - 0x58]
push eax
call fcn.100306d7
add esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
jne 0x1002ec50
mov dword [ebp - 0x20], 0xbd94543b
mov dword [ebp - 0x128], 6
mov dword [ebp - 0x268], 8
mov dword [ebp - 0x270], 0x3c017f21
mov dword [ebp - 0x30], 0
jmp 0x1002e470
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1002e486
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x3f4], 7
jmp 0x1002e469
mov dword [ebp - 0x30], 0
jmp 0x1002e496
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x1002e4ac
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x578], 0x5bb00289
jmp 0x1002e48f
cmp dword [ebp - 0x20], 0
jne 0x1002e4c1
cmp dword [ebp - 0x20], 0
jne 0x1002e4c1
and dword [ebp - 0x260], 0
jmp 0x1002e4cb
mov dword [ebp - 0x260], 1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x4a0], eax
cmp dword [ebp - 0x20], 0
jne 0x1002e4e9
cmp dword [ebp - 0x20], 0
jne 0x1002e4e9
and dword [ebp - 0x1d8], 0
jmp 0x1002e4f3
mov dword [ebp - 0x1d8], 1
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x128], eax
je 0x1002e516
cmp dword [ebp - 0x20], 0
je 0x1002e516
mov dword [ebp - 0x1e0], 1
jmp 0x1002e51d
and dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x260]
imul eax, dword [ebp - 0x1e0]
test eax, eax
jne 0x1002e540
cmp dword [ebp - 0x128], 0
jne 0x1002e540
and dword [ebp - 0x2c0], 0
jmp 0x1002e54a
mov dword [ebp - 0x2c0], 1
cmp dword [ebp - 0x2c0], 0xffffffff
je 0x1002e55f
mov dword [ebp - 0x1e8], 1
jmp 0x1002e566
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x268], eax
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x1f0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1f0]
mov dword [ebp + eax - 0x3f4], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1f0]
add ecx, 0x68c81f2f
mov edx, dword [ebp - 0x20]
add edx, ecx
lea eax, [edx + eax - 0x2395e2de]
cmp eax, dword [ebp - 0x20]
jl 0x1002e5bd
mov dword [ebp - 0x2a8], 1
jmp 0x1002e5c4
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x2a8], eax
jle 0x1002e5db
mov dword [ebp - 0x1f8], 1
jmp 0x1002e5e2
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x270]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x578], eax
push 0x50bd
lea eax, [ebp - 0x78]
push eax
push 0x71c7
push 1
push 1
push 1
push 0x40b4
push 0x37d0
call fcn.1002b769
add esp, 0x20
mov dword [ebp - 0x38], 0x61f
push 2
lea ecx, [ebp - 0x2f4]
call fcn.1001b7ad
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x14c], 0xfffffff8
mov dword [ebp - 0x4a8], 0xfffffffc
mov dword [ebp - 0x16c], 0x948e
mov dword [ebp - 0x4b0], 5
mov dword [ebp - 0x200], 0x1057
mov dword [ebp - 0x348], 0x1000a740
cmp dword [ebp - 0x200], 0x1288
jle 0x1002e707
call dword [sym.imp.USER32.dll_GetMessageTime]
and dword [ebp - 0x9c], 0
jmp 0x1002e6a6
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0x4724
jge 0x1002e707
and dword [ebp - 0xa4], 0
jmp 0x1002e6c8
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x4bf2
jge 0x1002e705
mov eax, dword [ebp - 0x9c]
or eax, dword [ebp - 0xa4]
cdq
mov dword [ebp - 0x3c0], eax
mov dword [ebp - 0x3bc], edx
push dword [ebp - 0x3bc]
push dword [ebp - 0x3c0]
mov ecx, 0x1060c3d8
call fcn.1001b57c
jmp 0x1002e6bb
jmp 0x1002e699
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x200], 0xd0d
jge 0x1002e727
mov edx, dword [ebp - 0x348]
mov ecx, 0x1060c3d8
call fcn.1001da87
jmp 0x1002e743
mov dword [ebp - 4], 0x10
jmp 0x1002e753
push 1
push 1
push 0x39b4
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0x2f4]
push eax
push 1
push 0x702d
call fcn.1002b971
add esp, 0x1c
cmp dword [ebp - 0x38], 0xd327cb3f
jb 0x1002e8c0
mov dword [ebp - 0x3ac], 0xdcba
mov dword [ebp - 0xb4], 0xffffffff
mov dword [ebp - 0xac], 0
jmp 0x1002e7b3
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jge 0x1002e7cf
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x538], 0
jmp 0x1002e7a6
mov dword [ebp - 0xb4], 1
mov eax, dword [ebp - 0x3ac]
cmp eax, dword [ebp - 0xb4]
jl 0x1002e7f3
mov dword [ebp - 0x350], 1
jmp 0x1002e7fa
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0xb4]
je 0x1002e81d
mov dword [ebp - 0x2d0], 1
jmp 0x1002e824
and dword [ebp - 0x2d0], 0
cmp dword [ebp - 0x2d0], 0x1cb4e76a
jne 0x1002e83c
mov dword [ebp - 0x208], 1
jmp 0x1002e843
and dword [ebp - 0x208], 0
cmp dword [ebp - 0x208], 0xffffffff
jb 0x1002e858
mov dword [ebp - 0x3e4], 1
jmp 0x1002e85f
and dword [ebp - 0x3e4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x538]
mov dword [ebp - 0x4c8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x538]
sub eax, 0x9c23
jne 0x1002e88e
mov eax, 0x39523dd9
test eax, eax
je 0x1002e89f
or eax, 0xffffffff
je 0x1002e89f
mov dword [ebp - 0x278], 1
jmp 0x1002e8a6
and dword [ebp - 0x278], 0
push 1
lea ecx, [ebp - 0x2f4]
call fcn.1001b84b
mov ecx, dword [ebp - 0x278]
mov dword [eax], ecx
jmp 0x1002ec3c
push 2
lea ecx, [ebp - 0x464]
call fcn.1001b7ad
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x210], 0x6899
mov dword [ebp - 0x358], 0x1000a7b0
cmp dword [ebp - 0x210], 0x6b78
jle 0x1002e968
and dword [ebp - 0xbc], 0
jmp 0x1002e907
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0x7a25
jge 0x1002e968
and dword [ebp - 0xc4], 0
jmp 0x1002e929
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x6b24
jge 0x1002e966
mov eax, dword [ebp - 0xbc]
add eax, dword [ebp - 0xc4]
cdq
mov dword [ebp - 0x3cc], eax
mov dword [ebp - 0x3c8], edx
push dword [ebp - 0x3c8]
push dword [ebp - 0x3cc]
mov ecx, 0x1060c3d8
call fcn.1001b57c
jmp 0x1002e91c
jmp 0x1002e8fa
mov dword [ebp - 0x4d0], 0xe5ff1fc5
mov byte [ebp - 4], 0x14
cmp dword [ebp - 0x210], 0x6503
jge 0x1002e992
mov edx, dword [ebp - 0x358]
mov ecx, 0x1060c3d8
call fcn.1001da87
jmp 0x1002e9ae
mov dword [ebp - 4], 0x13
jmp 0x1002e9be
push 0x195e
push 0x40a9
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x464]
push eax
push 0x3bc6
push 0
call fcn.10030484
add esp, 0x18
mov dword [ebp - 0x6c], 0
jmp 0x1002e9f2
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1002ea08
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x4d8], 0x67e7924a
jmp 0x1002e9eb
mov dword [ebp - 0x38], 0
jmp 0x1002ea18
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jg 0x1002ec2d
mov dword [ebp - 0x34], 0xee67b38e
mov dword [ebp - 0x15c], 0xe7a32987
mov dword [ebp - 0x40c], 0x6657
mov dword [ebp - 0x3c4], 0xad540778
mov dword [ebp - 0x4e0], 0x9718b2f1
mov dword [ebp - 0x54c], 0x8e8dce9d
mov dword [ebp - 0x554], 0xffffffff
mov dword [ebp - 0x550], 0
mov dword [ebp - 0x4fc], 0xfffffffd
mov dword [ebp - 0x4a4], 0xfffffff8
mov dword [ebp - 0x34], 1
jmp 0x1002ea93
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1002ec1b
mov dword [ebp - 0x280], 0xefc72fa5
mov dword [ebp - 0x218], 0x725fc1c5
mov dword [ebp - 0xcc], 0
jmp 0x1002eaca
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 1
jge 0x1002eae6
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x360], 0xfffffffb
jmp 0x1002eabd
push dword [ebp - 0x34]
lea ecx, [ebp - 0x2f4]
call fcn.1001b84b
mov eax, dword [eax]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x218], eax
mov esi, dword [ebp - 0x218]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x2f4]
call fcn.1001b84b
cmp dword [eax], esi
jne 0x1002eb2c
mov dword [ebp - 0x3b8], 1
jmp 0x1002eb33
and dword [ebp - 0x3b8], 0
push dword [ebp - 0x34]
lea ecx, [ebp - 0x2f4]
call fcn.1001b84b
push 1
lea ecx, [ebp - 0x464]
call fcn.1001b84b
mov esi, eax
push dword [ebp - 0x34]
lea ecx, [ebp - 0x2f4]
call fcn.1001b84b
mov eax, dword [eax]
add eax, dword [esi]
cmp dword [ebp - 0x38], eax
jne 0x1002eb73
mov dword [ebp - 0x150], 1
jmp 0x1002eb7a
and dword [ebp - 0x150], 0
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
jl 0x1002eba7
mov dword [ebp - 0x118], 1
jmp 0x1002ebae
and dword [ebp - 0x118], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x118]
mov dword [ebp + eax - 0x360], ecx
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x118], eax
jge 0x1002ebd8
mov dword [ebp - 0x164], 1
jmp 0x1002ebdf
and dword [ebp - 0x164], 0
mov eax, dword [ebp - 0x164]
sub eax, dword [ebp - 0x40c]
cmp dword [ebp - 0x38], eax
jne 0x1002ec05
mov eax, 0xffff
test eax, eax
je 0x1002ec05
mov dword [ebp - 0x368], 1
jmp 0x1002ec0c
and dword [ebp - 0x368], 0
mov dword [ebp - 0x3c4], 0
jmp 0x1002ea8c
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
jmp 0x1002ea11
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x464]
call fcn.1001b82f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2f4]
call fcn.1001b82f
jmp 0x1002f81b
push 2
lea ecx, [ebp - 0x470]
call fcn.1001b7ad
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x3ec], 0x25fa5fef
mov dword [ebp - 0x370], 7
mov dword [ebp - 0x3d0], 0xe60e
mov dword [ebp - 0x388], 0xfffffffa
mov dword [ebp - 0x31c], 0xffffffff
mov dword [ebp - 0x37c], 0xfffffff9
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x53c]
push eax
call fcn.1002cf6d
pop ecx
pop ecx
lea eax, [ebp - 0x370]
push eax
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x37c]
push eax
push 1
lea eax, [ebp - 0x3d0]
push eax
push 0x602d
push 1
lea eax, [ebp - 0x388]
push eax
push 1
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x31c]
push eax
push 0x37a9
push 0x4d75
call fcn.1002bc40
add esp, 0x34
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x470]
call fcn.1001b82f
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x344]
push eax
push dword [ebp - 0x108]
push dword [ebp - 0x60]
lea eax, [ebp - 0x11c]
push eax
push dword [ebp + 8]
call fcn.1002429a
add esp, 0x18
push 2
lea ecx, [ebp - 0x144]
call fcn.1001b7ad
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x50], 0xfffffff7
mov dword [ebp - 0x174], 0x656f
mov dword [ebp - 0x32c], 0x1000a814
cmp dword [ebp - 0x174], 0x6857
jle 0x1002ee33
and dword [ebp - 0xd4], 0
jmp 0x1002ed90
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x35bf
jge 0x1002ee21
and dword [ebp - 0xdc], 0
jmp 0x1002edb6
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0x4839
jge 0x1002ee1c
mov eax, dword [ebp - 0xd4]
cdq
idiv dword [ebp - 0xdc]
mov eax, edx
cdq
mov dword [ebp - 0x3d8], eax
mov dword [ebp - 0x3d4], edx
push dword [ebp - 0x3d4]
push dword [ebp - 0x3d8]
lea ecx, [ebp - 0x5d4]
call fcn.1000db9a
pop ecx
pop ecx
mov dword [ebp - 0x324], eax
mov ecx, dword [ebp - 0x324]
call fcn.1001b55c
push eax
call fcn.1004de26
pop ecx
lea ecx, [ebp - 0x5d4]
call fcn.1001b552
jmp 0x1002eda9
jmp 0x1002ed83
push 0x87c
push 0x6b3
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
mov byte [ebp - 4], 0x18
cmp dword [ebp - 0x174], 0x62d4
jge 0x1002ee4f
push dword [ebp - 0x32c]
call fcn.1004de26
pop ecx
jmp 0x1002ee6b
mov dword [ebp - 4], 0x17
jmp 0x1002ee7b
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x4ac]
push eax
call fcn.1002cfb5
pop ecx
pop ecx
mov byte [ebp - 0x57], 0
lea eax, [ebp - 0x57]
push eax
push 0
push 0x362a
call fcn.10031e79
add esp, 0xc
push 1
lea ecx, [ebp - 0x144]
call fcn.1001b84b
cmp dword [eax], 6
jbe 0x1002eec5
mov dword [ebp - 0x17c], 1
jmp 0x1002eecc
and dword [ebp - 0x17c], 0
imul esi, dword [ebp - 0x17c], 0x5b05
push 0
lea ecx, [ebp - 0x144]
call fcn.1001b84b
cmp esi, dword [eax]
jl 0x1002eef3
mov dword [ebp - 0x184], 1
jmp 0x1002eefa
and dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 7
jl 0x1002ef15
mov dword [ebp - 0x18c], 1
jmp 0x1002ef1c
and dword [ebp - 0x18c], 0
push 0
lea ecx, [ebp - 0x144]
call fcn.1001b84b
mov ecx, dword [ebp - 0x18c]
cmp ecx, dword [eax]
je 0x1002ef3f
mov dword [ebp - 0x194], 1
jmp 0x1002ef46
and dword [ebp - 0x194], 0
push 1
lea ecx, [ebp - 0x144]
call fcn.1001b84b
mov esi, dword [eax]
imul esi, dword [ebp - 0x194]
push 1
lea ecx, [ebp - 0x144]
call fcn.1001b84b
cmp dword [eax], esi
jge 0x1002ef79
mov dword [ebp - 0x19c], 1
jmp 0x1002ef80
and dword [ebp - 0x19c], 0
push 0
lea ecx, [ebp - 0x144]
call fcn.1001b84b
mov esi, dword [ebp - 0x19c]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x144]
call fcn.1001b84b
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0x144]
call fcn.1001b84b
add esi, dword [eax]
je 0x1002f028
mov dword [ebp - 0x334], 0
push 1
lea ecx, [ebp - 0x47c]
call fcn.1001b7ad
mov byte [ebp - 4], 0x1a
push 0x1101
push 0x5f3
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x47c]
push eax
push 1
push 1
push 1
push 0x4c4
push 0x3836
call fcn.1002c2bd
add esp, 0x24
imul esi, dword [ebp - 0x334], 0xfffffff9
push 0
lea ecx, [ebp - 0x47c]
call fcn.1001b84b
mov dword [eax], esi
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x47c]
call fcn.1001b82f
jmp 0x1002f055
mov dword [ebp - 0x50], 0xde57413
mov dword [ebp - 0x50], 0xfffffff6
jmp 0x1002f03f
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x16
jle 0x1002f055
mov byte [ebp - 0x39], 0
lea eax, [ebp - 0x39]
push eax
call fcn.1002d0fd
pop ecx
jmp 0x1002f038
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.1001b82f
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x344]
push eax
push dword [ebp - 0x108]
lea eax, [ebp - 0x11c]
push eax
call fcn.100243fa
add esp, 0x14
push 2
lea ecx, [ebp - 0x310]
call fcn.1001b7ad
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x34c], 0xffffffff
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x4b4]
push eax
call fcn.1002d11d
pop ecx
pop ecx
mov dword [ebp - 0x24], 1
jmp 0x1002f0d5
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1002f40a
mov dword [ebp - 0x304], 0xffffffff
mov dword [ebp - 0x300], 0xffffffff
mov dword [ebp - 0x2fc], 0xffffffff
mov dword [ebp - 0x2f8], 0xffffffff
mov dword [ebp - 0x1bc], 0xe974ca77
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x304], 1
jmp 0x1002f13c
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x304]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x304], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x304], 0
jl 0x1002f3f0
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x124], 0xfffb
mov dword [ebp - 0x1f4], 0
mov dword [ebp - 0x12c], 0xfffffff7
mov dword [ebp - 0x64], 0
jmp 0x1002f184
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jg 0x1002f3eb
mov dword [ebp - 0x354], 1
mov dword [ebp - 0x35c], 1
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jg 0x1002f1b6
mov dword [ebp - 0x1a4], 1
jmp 0x1002f1bd
and dword [ebp - 0x1a4], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x310]
call fcn.1001b84b
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1a4]
jle 0x1002f1e1
mov dword [ebp - 0x1ac], 1
jmp 0x1002f1e8
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x1ac], eax
jle 0x1002f1ff
mov dword [ebp - 0x148], 1
jmp 0x1002f206
and dword [ebp - 0x148], 0
cmp dword [ebp - 0x148], 0x31e
jge 0x1002f21e
mov dword [ebp - 0x1c4], 1
jmp 0x1002f225
and dword [ebp - 0x1c4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x304]
mov dword [ebp - 0x1bc], eax
mov esi, dword [ebp - 0x1bc]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x310]
call fcn.1001b84b
mov eax, dword [eax]
sub eax, esi
cmp eax, dword [ebp - 0x1c4]
jl 0x1002f264
mov dword [ebp - 0x1cc], 1
jmp 0x1002f26b
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x1cc], eax
je 0x1002f282
mov dword [ebp - 0x1d4], 1
jmp 0x1002f289
and dword [ebp - 0x1d4], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x1d4], eax
jne 0x1002f2a3
mov dword [ebp - 0x1dc], 1
jmp 0x1002f2aa
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x1dc], eax
jl 0x1002f2c4
mov dword [ebp - 0x1e4], 1
jmp 0x1002f2cb
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x1e4], eax
je 0x1002f2e5
mov dword [ebp - 0x1ec], 1
jmp 0x1002f2ec
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0xffffffff
jg 0x1002f31a
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x304], 0
jne 0x1002f31a
and dword [ebp - 0x1fc], 0
jmp 0x1002f324
mov dword [ebp - 0x1fc], 1
mov eax, dword [ebp - 0x1fc]
sub eax, 0x5569325e
je 0x1002f344
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x1002f344
mov dword [ebp - 0x204], 1
jmp 0x1002f34b
and dword [ebp - 0x204], 0
cmp dword [ebp - 0x204], 0x46f26339
jne 0x1002f363
mov dword [ebp - 0x20c], 1
jmp 0x1002f36a
and dword [ebp - 0x20c], 0
mov esi, dword [ebp - 0x34c]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x310]
call fcn.1001b84b
mov ecx, dword [ebp - 0x20c]
add ecx, dword [eax]
imul eax, ecx, 0xf80c
cmp eax, esi
jl 0x1002f39c
mov dword [ebp - 0x214], 1
jmp 0x1002f3a3
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0xb281
je 0x1002f3c7
mov dword [ebp - 0x21c], 1
jmp 0x1002f3ce
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x12c], eax
jmp 0x1002f17d
jmp 0x1002f123
push dword [ebp - 0x24]
lea ecx, [ebp - 0x310]
call fcn.1001b84b
cmp dword [eax], 0
je 0x1002f405
jmp 0x1002f40a
jmp 0x1002f0ce
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x310]
call fcn.1001b82f
cmp dword [ebp - 0x78], 0
jne 0x1002f816
mov dword [ebp - 0x42c], 0xf99ff606
mov dword [ebp - 0x428], 0xf99ff606
mov dword [ebp - 0x424], 0xf99ff606
mov dword [ebp - 0x420], 0xf99ff606
lea ecx, [ebp - 0x135]
call fcn.1001b85a
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x568]
call fcn.1001b85d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2e8]
call fcn.1001b809
mov dword [ebp - 4], 0x1c
mov dword [ebp - 0x28], 0xfffffffb
push 3
lea ecx, [ebp - 0x44c]
call fcn.1001b7ad
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x224], 0xfffffffa
mov dword [ebp - 0x264], 0
push 2
lea ecx, [ebp - 0x488]
call fcn.1001b7ad
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x44c]
push eax
push 0xee6
push 1
push 1
call fcn.1002c4c0
add esp, 0x14
mov dword [ebp - 0x70], 0
jmp 0x1002f4f0
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1002f50c
push dword [ebp - 0x70]
lea ecx, [ebp - 0x488]
call fcn.1001b84b
mov dword [eax], 4
jmp 0x1002f4e9
mov dword [ebp - 0x28], 3
jmp 0x1002f51c
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x1002f7e7
mov dword [ebp - 0x14], 0xab6e
mov dword [ebp - 0x22c], 0xc795c380
mov dword [ebp - 0x24c], 0x3eec73f5
mov dword [ebp - 0x254], 4
push 0x6c1a
push 0x3a15
push 0x3e3e
push 1
lea eax, [ebp - 0x14]
push eax
push 0x455b
push 1
call fcn.1002c63f
add esp, 0x1c
mov dword [ebp - 0x14], 3
jmp 0x1002f57f
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1002f7e2
mov esi, dword [ebp - 0x14]
imul esi, dword [ebp - 0x14]
push 2
lea ecx, [ebp - 0x44c]
call fcn.1001b84b
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x540], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x22c], eax
mov esi, dword [ebp - 0x22c]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2e8]
call fcn.1001b84b
cmp dword [eax], esi
jne 0x1002f5e1
mov dword [ebp - 0x364], 1
jmp 0x1002f5e8
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x14], 1
jge 0x1002f603
mov dword [ebp - 0x234], 1
jmp 0x1002f60a
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x234], eax
jg 0x1002f621
mov dword [ebp - 0x23c], 1
jmp 0x1002f628
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x23c], eax
jle 0x1002f63f
mov dword [ebp - 0x244], 1
jmp 0x1002f646
and dword [ebp - 0x244], 0
imul eax, dword [ebp - 0x244], 0xfffffffb
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x254], eax
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x254]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2e8]
call fcn.1001b84b
imul edi, dword [eax]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2e8]
call fcn.1001b84b
imul edi, dword [eax]
cmp edi, esi
jne 0x1002f69a
mov dword [ebp - 0x25c], 1
jmp 0x1002f6a1
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 0xf25ce5ab
je 0x1002f6ca
or eax, 0xffffffff
je 0x1002f6ca
mov dword [ebp - 0x26c], 1
jmp 0x1002f6d1
and dword [ebp - 0x26c], 0
push 0
lea ecx, [ebp - 0x488]
call fcn.1001b84b
mov esi, dword [ebp - 0x26c]
add esi, dword [eax]
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2e8]
call fcn.1001b84b
cmp esi, dword [eax]
jge 0x1002f704
mov dword [ebp - 0x274], 1
jmp 0x1002f70b
and dword [ebp - 0x274], 0
cmp dword [ebp - 0x274], 1
jg 0x1002f720
mov dword [ebp - 0x27c], 1
jmp 0x1002f727
and dword [ebp - 0x27c], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2e8]
call fcn.1001b84b
mov ecx, dword [ebp - 0x27c]
cmp ecx, dword [eax]
jne 0x1002f74b
mov dword [ebp - 0x28c], 1
jmp 0x1002f752
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x28c]
sub eax, 0x5bbd0d56
cmp eax, dword [ebp - 0x14]
jl 0x1002f76e
mov dword [ebp - 0x294], 1
jmp 0x1002f775
and dword [ebp - 0x294], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2e8]
call fcn.1001b84b
mov ecx, dword [ebp - 0x294]
cmp ecx, dword [eax]
je 0x1002f79d
mov byte [ebp - 0x55], 0
lea eax, [ebp - 0x55]
push eax
call fcn.1002d165
pop ecx
jmp 0x1002f7dd
mov byte [ebp - 0x3a], 0
movzx eax, byte [ebp - 0x3a]
test eax, eax
je 0x1002f7d8
push 1
push 0x2e3
push 0x595d
push 0x5e2f
push 0x28c
push 1
push 0x2e5c
push 0x24d5
push 0x5be6
call fcn.1002c734
add esp, 0x24
call fcn.1002d18e
jmp 0x1002f578
jmp 0x1002f515
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x488]
call fcn.1001b82f
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x44c]
call fcn.1001b82f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2e8]
call fcn.1001b82f
jmp 0x1002f81b
jmp 0x1002d2e5
mov dword [ebp - 0x1c], 0xdeb77278
mov dword [ebp - 0x110], 0
jmp 0x1002f83b
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 3
jge 0x1002f857
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x458], 0x6ee97341
jmp 0x1002f82e
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jge 0x1002f86b
mov dword [ebp - 0x29c], 1
jmp 0x1002f872
and dword [ebp - 0x29c], 0
cmp dword [ebp - 0x1c], 0xffffffff
jg 0x1002f884
mov dword [ebp - 0x2a4], 1
jmp 0x1002f88b
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x29c]
sub eax, dword [ebp - 0x2a4]
jne 0x1002f8a5
mov dword [ebp - 0x2ac], 1
jmp 0x1002f8ac
and dword [ebp - 0x2ac], 0
cmp dword [ebp - 0x2ac], 0xffffffff
jl 0x1002f8c1
mov dword [ebp - 0x2b4], 1
jmp 0x1002f8c8
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x2b4], eax
jg 0x1002f8df
mov dword [ebp - 0x2bc], 1
jmp 0x1002f8e6
and dword [ebp - 0x2bc], 0
cmp dword [ebp - 0x2bc], 0xfffffffd
jne 0x1002f8fb
mov dword [ebp - 0x2c4], 1
jmp 0x1002f902
and dword [ebp - 0x2c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x458]
add eax, dword [ebp - 0x2c4]
imul eax, eax, 0xa8fe
test eax, eax
je 0x1002f931
cmp dword [ebp - 0x1c], 0
je 0x1002f931
mov dword [ebp - 0x2cc], 1
jmp 0x1002f938
and dword [ebp - 0x2cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x458]
cmp dword [ebp - 0x2cc], eax
jge 0x1002f959
mov dword [ebp - 0x134], 1
jmp 0x1002f960
and dword [ebp - 0x134], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x134]
mov dword [ebp + eax - 0x458], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x134], eax
jge 0x1002f989
mov dword [ebp - 0x2d4], 1
jmp 0x1002f990
and dword [ebp - 0x2d4], 0
imul eax, dword [ebp - 0x2d4], 0xbcd8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 3
jmp 0x1002f9ad
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff6
jne 0x1002f9f4
mov dword [ebp - 0xe4], 3
mov dword [ebp - 0xe4], 0xfffffff2
jmp 0x1002f9d6
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0xfffffff9
jle 0x1002f9f2
mov byte [ebp - 0x52], 0
movzx eax, byte [ebp - 0x52]
test eax, eax
je 0x1002f9f0
call fcn.1002d1b0
jmp 0x1002f9c9
jmp 0x1002f9a6
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret