Function at 0x10015721
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008d1fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2f0
push esi
push edi
and dword [ebp - 0x4c], 0
mov dword [ebp - 0x58], 0xfffffffe
mov dword [ebp - 0x124], 0x5c7a00f4
mov byte [ebp - 0x2e], 0
movzx eax, byte [ebp - 0x2e]
test eax, eax
je 0x1001576a
push 0
call fcn.10016b3e
pop ecx
mov dword [ebp - 0x58], 2
jmp 0x1001577a
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xfffffffe
jle 0x100157e3
push 4
lea ecx, [ebp - 0x20c]
call fcn.10016f54
and dword [ebp - 4], 0
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
call fcn.10014a49
add esp, 0xc
mov byte [ebp - 0x32], 0
movzx eax, byte [ebp - 0x32]
test eax, eax
je 0x100157bd
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 1
lea ecx, [ebp - 0x20c]
call fcn.10016fe2
mov eax, dword [eax]
mov dword [ebp - 0x124], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.10016fdd
jmp 0x10015773
mov eax, dword [0x10681900]
and eax, 1
jne 0x1001581a
mov eax, dword [0x10681900]
or eax, 1
mov dword [0x10681900], eax
mov dword [ebp - 4], 1
mov ecx, 0x1068189c
call fcn.100171a9
push 0x1008f7ae
call fcn.10075a76
pop ecx
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
call fcn.1001121e
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 6
jae 0x100159da
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x194], eax
lea eax, [ebp - 0x23c]
push eax
mov ecx, 0x1068189c
call fcn.100170bc
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x244]
push eax
mov ecx, 0x1068189c
call fcn.100170ca
mov ecx, eax
call fcn.100170df
movzx eax, al
test eax, eax
je 0x100159da
mov dword [ebp - 0x1c], 0xb4f
mov dword [ebp - 0x9c], 0xfffffff6
mov dword [ebp - 0x164], 0
mov dword [ebp - 0x13c], 0xffff
push 0x509a
push 1
lea eax, [ebp - 0x1c]
push eax
call fcn.10014ab0
add esp, 0xc
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x1c]
add eax, 0x53e5
cmp eax, dword [ebp - 0x1c]
jg 0x100158ce
mov dword [ebp - 0x110], 1
jmp 0x100158d5
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x110]
cmp dword [ebp - 0x1c], eax
jne 0x10015901
mov dword [ebp - 0x180], 0xb72b21a3
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x180], eax
jmp 0x100159a6
mov dword [ebp - 0x134], 2
push 1
lea ecx, [ebp - 0x1d0]
call fcn.10016f54
mov dword [ebp - 4], 2
mov dword [ebp - 0x148], 0xfffffffa
push 0xfd3
push 1
lea eax, [ebp - 0x1d0]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.10014aff
add esp, 0x10
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x164]
push eax
push 1
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x1d0]
push eax
lea eax, [ebp - 0x13c]
push eax
call fcn.10014b8a
add esp, 0x20
mov byte [ebp - 0x30], 0
movzx eax, byte [ebp - 0x30]
test eax, eax
je 0x10015997
push 0x1704
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d0]
call fcn.10016fdd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x17c], eax
lea eax, [ebp - 0x17c]
push eax
mov ecx, 0x1068189c
call fcn.100171fd
push eax
mov ecx, dword [ebp + 8]
call fcn.10016d09
mov eax, dword [ebp - 0x4c]
or eax, 1
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 8]
jmp 0x1001684d
mov dword [ebp - 0x90], 8
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0x144], 0xaad8
mov dword [ebp - 0x64], 0
jmp 0x10015a08
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x10015a1e
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x218], 0xbf9f3617
jmp 0x10015a01
mov dword [ebp - 0x90], 0xf390197f
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0xdc], eax
jge 0x10015a5a
mov dword [ebp - 0xa4], 1
jmp 0x10015a61
and dword [ebp - 0xa4], 0
mov eax, dword [ebp - 0x90]
add eax, 0xffff
imul eax, dword [ebp - 0xa4]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x218], eax
mov byte [ebp - 0x34], 0
movzx eax, byte [ebp - 0x34]
test eax, eax
je 0x10015a92
call dword [sym.imp.USER32.dll_WaitMessage]
lea ecx, [ebp - 0x2ac]
call fcn.10016d31
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x50]
xor edx, edx
push 2
pop ecx
div ecx
test edx, edx
jne 0x1001664e
mov dword [ebp - 0x18], 0xc0ae
mov dword [ebp - 0x14c], 2
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x60], 0x7c7128ab
push 1
lea ecx, [ebp - 0x1a4]
call fcn.10016f54
mov byte [ebp - 4], 4
mov dword [ebp - 0x20], 0x12fd89d6
mov dword [ebp - 0x40], 0xa832
mov dword [ebp - 0xc4], 0x94d8
push 2
lea ecx, [ebp - 0x200]
call fcn.10016f54
mov byte [ebp - 4], 5
mov dword [ebp - 0x44], 0
jmp 0x10015b1f
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x10015b38
push dword [ebp - 0x44]
lea ecx, [ebp - 0x1a4]
call fcn.10016fe2
or dword [eax], 0xffffffff
jmp 0x10015b18
push 1
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.10014cc0
add esp, 0xc
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x60], 1
mov eax, dword [ebp - 0x60]
inc eax
je 0x10015b73
cmp dword [ebp - 0x18], 0
je 0x10015b73
mov dword [ebp - 0xfc], 1
jmp 0x10015b7a
and dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xfc]
jne 0x10015b91
mov dword [ebp - 0xac], 1
jmp 0x10015b98
and dword [ebp - 0xac], 0
cmp dword [ebp - 0xac], 0x86cce57b
jb 0x10015bba
push 0
lea ecx, [ebp - 0x1a4]
call fcn.10016fe2
cmp dword [eax], 0
je 0x10015c3e
mov dword [ebp - 0x16c], 0xa88f
mov byte [ebp - 0x2a], 0
movzx eax, byte [ebp - 0x2a]
test eax, eax
je 0x10015bde
push 0x23ba
push 0
call fcn.100169f5
pop ecx
pop ecx
push 0x9d5
lea eax, [ebp - 0x60]
push eax
push 0x1493
lea eax, [ebp - 0x16c]
push eax
push 0x228e
lea eax, [ebp - 0xc4]
push eax
push 0x5355
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x2ab3
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 0x3b5a
lea eax, [ebp - 0x3c]
push eax
push 0x7e2f
push 0x2fb9
call fcn.10014d39
add esp, 0x44
jmp 0x10015e9d
mov dword [ebp - 0xbc], 0xb1b5b3a0
mov dword [ebp - 0x154], 0xffffffff
mov dword [ebp - 0x78], 0
jmp 0x10015c62
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x10015c78
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x220], 0
jmp 0x10015c5b
mov dword [ebp - 0x3c], 0x16
jmp 0x10015c88
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x1c
jge 0x10015cf1
mov dword [ebp - 0x40], 3
jmp 0x10015c9e
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xfffffff8
jle 0x10015cc6
mov byte [ebp - 0x2b], 0
movzx eax, byte [ebp - 0x2b]
test eax, eax
je 0x10015cc4
push 0x51dc
push 0x7ae1
push 1
call fcn.100150f3
add esp, 0xc
jmp 0x10015c97
mov dword [ebp - 0x20], 0
jmp 0x10015cd6
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff3
jl 0x10015cef
mov byte [ebp - 0x2d], 0
lea eax, [ebp - 0x2d]
push eax
push 0
call fcn.10015583
pop ecx
pop ecx
jmp 0x10015ccf
jmp 0x10015c81
mov dword [ebp - 0x18], 0
jmp 0x10015d01
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 5
jne 0x10015e9d
mov dword [ebp - 0x8c], 2
mov dword [ebp - 0x198], 0
cmp dword [ebp - 0x8c], 0
je 0x10015e00
cmp dword [ebp - 0x20], 0
jne 0x10015d42
push 9
pop eax
test eax, eax
jne 0x10015d42
and dword [ebp - 0xe4], 0
jmp 0x10015d4c
mov dword [ebp - 0xe4], 1
cmp dword [ebp - 0xe4], 0x1506
jl 0x10015d64
mov dword [ebp - 0xb4], 1
jmp 0x10015d6b
and dword [ebp - 0xb4], 0
push 0
lea ecx, [ebp - 0x1a4]
call fcn.10016fe2
cmp dword [eax], 0xfffffff9
jb 0x10015d89
mov dword [ebp - 0x94], 1
jmp 0x10015d90
and dword [ebp - 0x94], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb4]
mov dword [ebp + eax - 0x220], ecx
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x8c], eax
jl 0x10015dde
cmp dword [ebp - 0x198], 0
je 0x10015dde
mov dword [ebp - 0xec], 1
jmp 0x10015de5
and dword [ebp - 0xec], 0
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x10015e00
mov dword [ebp - 0x104], 1
jmp 0x10015e07
and dword [ebp - 0x104], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x104], eax
jle 0x10015e21
mov dword [ebp - 0xcc], 1
jmp 0x10015e28
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0xcc], eax
jg 0x10015e42
mov dword [ebp - 0xf4], 1
jmp 0x10015e49
and dword [ebp - 0xf4], 0
push 1
lea ecx, [ebp - 0x200]
call fcn.10016fe2
mov ecx, dword [ebp - 0xf4]
cmp ecx, dword [eax]
je 0x10015e6c
mov dword [ebp - 0xd4], 1
jmp 0x10015e73
and dword [ebp - 0xd4], 0
cmp dword [ebp - 0xd4], 0xfffffff6
je 0x10015e88
mov dword [ebp - 0x10c], 1
jmp 0x10015e8f
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x60], eax
jmp 0x10015cfa
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x200]
call fcn.10016fdd
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1a4]
call fcn.10016fdd
lea eax, [ebp - 0x2e4]
push eax
call fcn.100094b9
pop ecx
mov esi, eax
lea edi, [ebp - 0x2b8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x2b8]
lea edi, [ebp - 0x2d0]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x38], 0xe2db
push 2
lea ecx, [ebp - 0x1e8]
call fcn.10016f54
mov byte [ebp - 4], 6
mov dword [ebp - 0x70], 0
jmp 0x10015f0a
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x10015f26
push dword [ebp - 0x70]
lea ecx, [ebp - 0x1e8]
call fcn.10016fe2
mov dword [eax], 0x9e57
jmp 0x10015f03
lea eax, [ebp - 0x38]
push eax
push 0
call fcn.100168be
pop ecx
pop ecx
mov dword [ebp - 0x38], 0
jmp 0x10015f43
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jg 0x10015f6a
push 1
lea eax, [ebp - 0x38]
push eax
push 0x5999
lea eax, [ebp - 0x1e8]
push eax
push 0x3f76
call fcn.1001513d
add esp, 0x14
jmp 0x10015f3c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1e8]
call fcn.10016fdd
mov ecx, dword [ebp + 0xc]
call fcn.10011437
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x10], 5
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x190], 0x7017a68f
mov dword [ebp - 0x18c], 0x7017a68f
mov dword [ebp - 0x188], 0x7017a68f
mov dword [ebp - 0x184], 0x7017a68f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x10], 0
jne 0x100160d0
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x10]
cmp eax, 3
jle 0x10015fee
mov dword [ebp - 0x174], 1
jmp 0x10015ff5
and dword [ebp - 0x174], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x10], 0
je 0x1001601f
cmp dword [ebp - 0x10], 0
je 0x1001601f
mov dword [ebp - 0x98], 1
jmp 0x10016026
and dword [ebp - 0x98], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x98], eax
je 0x10016041
push 0xfffffffffffffffe
pop eax
test eax, eax
jne 0x10016041
and dword [ebp - 0xa0], 0
jmp 0x1001604b
mov dword [ebp - 0xa0], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xa0], eax
jne 0x10016062
mov dword [ebp - 0xa8], 1
jmp 0x10016069
and dword [ebp - 0xa8], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xa8], eax
jne 0x10016080
mov dword [ebp - 0xb0], 1
jmp 0x10016087
and dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xb0]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x10]
cmp eax, 0x44653ffd
je 0x100160af
cmp dword [ebp - 0x28], 0
jne 0x100160af
and dword [ebp - 0xb8], 0
jmp 0x100160b9
mov dword [ebp - 0xb8], 1
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x10], eax
jl 0x100160d0
and dword [ebp - 0xc0], 0
jmp 0x100160da
mov dword [ebp - 0xc0], 1
cmp dword [ebp - 0xc0], 0
jl 0x100160ef
mov dword [ebp - 0x15c], 1
jmp 0x100160f6
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x10016145
mov byte [ebp - 0x2f], 0
movzx eax, byte [ebp - 0x2f]
test eax, eax
je 0x10016140
push 0x5871
push 0x867
push 0x2f47
push 1
push 0x4a4c
push 0x2a40
call fcn.100151d6
add esp, 0x18
jmp 0x10016401
push 4
lea ecx, [ebp - 0x120]
call fcn.10016f54
mov byte [ebp - 4], 7
mov dword [ebp - 0x138], 0xffffffff
mov dword [ebp - 0x68], 0
jmp 0x10016170
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x1001618c
push dword [ebp - 0x68]
lea ecx, [ebp - 0x120]
call fcn.10016fe2
mov dword [eax], 0x84cb
jmp 0x10016169
mov dword [ebp - 0x28], 0x1b
jmp 0x1001619c
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x34
jne 0x100163cc
mov dword [ebp - 0x54], 0
jmp 0x100161b6
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x100161cc
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x1c4], 7
jmp 0x100161af
mov dword [ebp - 0x10], 0
jmp 0x100161dc
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x100163b0
mov dword [ebp - 0x84], 0xffffffff
mov dword [ebp - 0x24], 3
jmp 0x10016200
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1001621f
mov byte [ebp - 0x33], 0
push 1
push 0x4558
lea eax, [ebp - 0x33]
push eax
call fcn.100153db
add esp, 0xc
jmp 0x100161f9
push 2
lea ecx, [ebp - 0x120]
call fcn.10016fe2
cmp dword [eax], 0
je 0x10016361
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + eax*4 - 0x190]
push 2
lea ecx, [ebp - 0x120]
call fcn.10016fe2
cmp esi, dword [eax]
je 0x1001625c
mov dword [ebp - 0xc8], 1
jmp 0x10016263
and dword [ebp - 0xc8], 0
push 2
lea ecx, [ebp - 0x120]
call fcn.10016fe2
mov ecx, dword [ebp - 0xc8]
imul ecx, dword [eax]
test ecx, ecx
je 0x10016292
mov eax, 0xb1a7
test eax, eax
je 0x10016292
mov dword [ebp - 0x12c], 1
jmp 0x10016299
and dword [ebp - 0x12c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x190]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x100162d0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1c4], 0
je 0x100162d0
mov dword [ebp - 0xd0], 1
jmp 0x100162d7
and dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0xd0]
neg eax
cmp eax, 0x5b81
jne 0x100162f2
mov dword [ebp - 0xd8], 1
jmp 0x100162f9
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0xd8], eax
jge 0x10016310
mov dword [ebp - 0x130], 1
jmp 0x10016317
and dword [ebp - 0x130], 0
mov dword [ebp - 0x24], 0x5b60
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x210], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1c4]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x190]
mov dword [ebp - 0x22c], eax
mov eax, 0xae2e
test eax, eax
je 0x10016361
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1c4], 0
mov eax, 0xa349
cmp eax, 0xdd31
je 0x10016379
mov dword [ebp - 0xe0], 1
jmp 0x10016380
and dword [ebp - 0xe0], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x190]
add eax, dword [ebp - 0xe0]
jne 0x1001639f
push 2
lea ecx, [ebp - 0x120]
call fcn.10016fe2
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x138], eax
jmp 0x100161d5
mov byte [ebp - 0x2c], 0
push 1
lea eax, [ebp - 0x2c]
push eax
push 0x126c
call fcn.10015437
add esp, 0xc
jmp 0x10016195
mov dword [ebp - 0x10], 0
jmp 0x100163dc
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x100163f2
push 0x4f5d
push 0
call fcn.1001698f
pop ecx
pop ecx
jmp 0x100163d5
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x120]
call fcn.10016fdd
lea eax, [ebp - 0x2d0]
push eax
push dword [ebp - 0x140]
push dword [ebp - 0x50]
lea eax, [ebp - 0x2fc]
push eax
call fcn.10013b67
add esp, 0x10
mov dword [ebp - 0x128], eax
push dword [ebp - 0x128]
lea ecx, [ebp - 0x2ac]
call fcn.10016d69
lea ecx, [ebp - 0x2fc]
call fcn.10016d8e
push 2
lea ecx, [ebp - 0x1dc]
call fcn.10016f54
mov byte [ebp - 4], 8
mov dword [ebp - 0x48], 0x57976326
mov dword [ebp - 0x158], 0x1d82c32b
mov dword [ebp - 0x5c], 0
jmp 0x10016474
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x10016490
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x1dc]
call fcn.10016fe2
mov dword [eax], 0xfffffffb
jmp 0x1001646d
mov dword [ebp - 0x48], 1
jmp 0x100164a0
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x100164da
mov dword [ebp - 0x150], 0xf6f9
push 1
push 0x6330
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x1dc]
push eax
lea eax, [ebp - 0x158]
push eax
call fcn.1001548d
add esp, 0x18
jmp 0x10016499
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1dc]
call fcn.10016fdd
cmp dword [ebp - 0x50], 6
jae 0x1001664e
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 1
mov dword [ebp - 0x274], 0xffffffff
mov dword [ebp - 0x238], 9
mov dword [ebp - 0x270], 0xfffffff6
mov dword [ebp - 0x240], 0xf47a6d
mov dword [ebp - 0x290], 0x51328f6c
mov dword [ebp - 0x248], 1
mov dword [ebp - 0x278], 0xfa51669
mov dword [ebp - 0x250], 0xb5bf2d3f
mov dword [ebp - 0x288], 0xd1454bcd
mov dword [ebp - 0x1b8], 0x2d62
mov dword [ebp - 0x1b4], 0x2d62
mov dword [ebp - 0x1b0], 0x2d62
mov dword [ebp - 0x1ac], 0x2d62
lea ecx, [ebp - 0x7d]
call fcn.10009273
push eax
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x1b8]
push eax
lea ecx, [ebp - 0x2d8]
call fcn.10016ff1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2c4]
call fcn.10016fb3
mov byte [ebp - 4], 9
mov dword [ebp - 0x258], 0x21fafbf2
mov dword [ebp - 0x160], 0x8c2a
mov dword [ebp - 0x6c], 0
jmp 0x100165e3
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x100165f9
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x268], 0x44401d1b
jmp 0x100165dc
lea eax, [ebp - 0x160]
push eax
call fcn.1001556a
pop ecx
mov byte [ebp - 0x31], 0
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x10016620
push 0x1812
push 1
call fcn.10015583
pop ecx
pop ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c4]
call fcn.10016fdd
push 1
lea eax, [ebp - 0x2ac]
push eax
push 0x7fe1
lea eax, [ebp + 0xc]
push eax
push 0x1068189c
call fcn.100155d4
add esp, 0x14
mov dword [ebp - 0x14], 0xb4f
mov dword [ebp - 0xf0], 0xfffffff6
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x100], 0xffff
lea eax, [ebp - 0x14]
push eax
push 1
push 0x7673
call fcn.1001563f
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x14]
add eax, 0x53e5
cmp eax, dword [ebp - 0x14]
jg 0x100166a5
mov dword [ebp - 0xe8], 1
jmp 0x100166ac
and dword [ebp - 0xe8], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xe8]
cmp dword [ebp - 0x14], eax
jne 0x100166e4
mov dword [ebp - 0x168], 0xb72b21a3
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0xf0]
push eax
push 1
call fcn.10015686
add esp, 0xc
jmp 0x10016823
mov dword [ebp - 0x88], 2
push 1
lea ecx, [ebp - 0x1f4]
call fcn.10016f54
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x178], 0xfffffffa
mov dword [ebp - 0x74], 0
jmp 0x10016719
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x10016735
push dword [ebp - 0x74]
lea ecx, [ebp - 0x1f4]
call fcn.10016fe2
mov dword [eax], 1
jmp 0x10016712
mov eax, dword [ebp - 0x88]
add eax, 0xccfd
mov dword [ebp - 0x7c], eax
mov eax, 0x31f145ba
sub eax, dword [ebp - 0x7c]
je 0x1001678f
cmp dword [ebp - 0xf0], 0
jne 0x10016768
cmp dword [ebp - 0x88], 0
jne 0x10016768
and dword [ebp - 0xf8], 0
jmp 0x10016772
mov dword [ebp - 0xf8], 1
mov eax, dword [ebp - 0xf8]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x100], eax
je 0x1001678f
mov dword [ebp - 0x108], 1
jmp 0x10016796
and dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x108], eax
jl 0x100167ad
mov dword [ebp - 0x170], 1
jmp 0x100167b4
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x26c], eax
mov esi, dword [ebp - 0x88]
push 0
lea ecx, [ebp - 0x1f4]
call fcn.10016fe2
mov dword [eax], esi
cmp dword [ebp - 0x7c], 0
jne 0x100167e7
cmp dword [ebp - 0x7c], 0
jne 0x100167e7
and dword [ebp - 0x114], 0
jmp 0x100167f1
mov dword [ebp - 0x114], 1
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x178], eax
mov byte [ebp - 0x29], 0
push 1
push 0x4389
lea eax, [ebp - 0x29]
push eax
call fcn.100156ce
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1f4]
call fcn.10016fdd
lea eax, [ebp - 0x2ac]
push eax
mov ecx, dword [ebp + 8]
call fcn.10016d44
mov eax, dword [ebp - 0x4c]
or eax, 1
mov dword [ebp - 0x4c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2ac]
call fcn.10016d8e
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret