Function at 0x1002f40b
Capabilities:
Run powershell expression

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10073d0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x444
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x10031346
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x31c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0x26c]
movzx eax, byte [eax]
test eax, eax
je 0x100312e1
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x54], 1
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x78], eax
push 8
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
cmp dword [eax + 4], 0
jbe 0x100310c1
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x78]
add ecx, dword [eax]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x34], 0
push 1
lea ecx, [ebp - 0x344]
call fcn.10027044
and dword [ebp - 4], 0
mov dword [ebp - 0x32c], 0x9cd3
push 1
lea ecx, [ebp - 0x3f8]
call fcn.10027044
mov byte [ebp - 4], 1
push 0
lea eax, [ebp - 0x324]
push eax
push 0x6f1b
push 0x7920
lea eax, [ebp - 0x344]
push eax
call fcn.10035f00
add esp, 0x14
lea eax, [ebp - 0x3f8]
push eax
push 1
push 1
push 0xdf1
lea eax, [ebp - 0x324]
push eax
call fcn.1002df31
add esp, 0x14
lea eax, [ebp - 0x34]
push eax
push 0
push 0xb01
push 0x6b34
lea eax, [ebp - 0x344]
push eax
call fcn.10034f5b
add esp, 0x14
mov dword [ebp - 0x34], 0
jmp 0x1002f575
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jg 0x1002f5c5
push dword [ebp - 0x34]
lea ecx, [ebp - 0x344]
call fcn.100270e2
or dword [eax], 0xffffffff
push 0x5924
push 0x42d1
lea eax, [ebp - 0x344]
push eax
push 0x4924
push 0x731e
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x32c]
push eax
push 1
push 0
push 0x18e0
call fcn.100358f9
add esp, 0x28
jmp 0x1002f56e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3f8]
call fcn.100270c6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x344]
call fcn.100270c6
jmp 0x1002f5ee
mov eax, dword [ebp - 0x44]
add eax, 0x14
mov dword [ebp - 0x44], eax
push dword [ebp - 0x44]
call fcn.1002d169
pop ecx
movzx eax, al
test eax, eax
jne 0x100310c1
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0xc], 0
je 0x100310c1
mov dword [ebp - 0x254], 0xffc
mov dword [ebp - 0x308], 0x1000e598
cmp dword [ebp - 0x254], 0x12e4
jle 0x1002f6cf
push 0
push 0x199b
push 0x602
push 0x268a
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
and dword [ebp - 0xa4], 0
jmp 0x1002f660
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x30ce
jge 0x1002f6cf
and dword [ebp - 0x70], 0
jmp 0x1002f679
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x6074
jge 0x1002f6cd
and dword [ebp - 0x7c], 0
jmp 0x1002f68f
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0x77c4
jge 0x1002f6cb
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x7c]
shl eax, cl
cdq
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 0x2d4], edx
push dword [ebp - 0x2d4]
push dword [ebp - 0x2d8]
mov ecx, 0x1061aa98
call fcn.10026e04
jmp 0x1002f688
jmp 0x1002f672
jmp 0x1002f653
push 3
lea ecx, [ebp - 0x3a8]
call fcn.10027044
mov dword [ebp - 4], 2
mov dword [ebp - 0x278], 0x6aabecba
mov dword [ebp - 0x2c4], 0
lea eax, [ebp - 0x3fc]
push eax
lea eax, [ebp - 0x3a8]
push eax
push 0
push 0x30c0
call fcn.100366b7
add esp, 0x10
push 1
push 1
lea eax, [ebp - 0x3a8]
push eax
lea eax, [ebp - 0x2c4]
push eax
push 0x2f60
lea eax, [ebp - 0x278]
push eax
call fcn.1002e8e9
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3a8]
call fcn.100270c6
mov dword [ebp - 4], 3
cmp dword [ebp - 0x254], 0xca2
jge 0x1002f76c
mov edx, dword [ebp - 0x308]
mov ecx, 0x1061aa98
call fcn.10029b1c
jmp 0x1002f788
or dword [ebp - 4], 0xffffffff
jmp 0x1002f792
mov dword [ebp - 0x3c], 0xfffffffc
mov dword [ebp - 0xc4], 0xba339924
mov dword [ebp - 0xbc], 0x8112def9
push 1
lea ecx, [ebp - 0x390]
call fcn.10027044
mov dword [ebp - 4], 5
mov dword [ebp - 0x280], 0xa025ec56
push 1
push 0x6f66
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x3bc]
push eax
push 0x68e8
push 0
call fcn.10038634
add esp, 0x18
cmp dword [ebp - 0x3c], 0
je 0x1002f7f9
cmp dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x3c]
inc eax
cmp eax, dword [ebp - 0x3c]
jg 0x1002f80e
mov dword [ebp - 0x25c], 1
jmp 0x1002f815
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x25c], eax
jl 0x1002f82c
mov dword [ebp - 0x1b8], 1
jmp 0x1002f833
and dword [ebp - 0x1b8], 0
mov eax, dword [ebp - 0xbc]
imul eax, dword [ebp - 0x1b8]
cmp eax, 0x74bf90ed
jg 0x1002f853
mov dword [ebp - 0x100], 1
jmp 0x1002f85a
and dword [ebp - 0x100], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x100]
sub eax, dword [ebp - 0xbc]
cmp dword [ebp - 0xc4], eax
jle 0x1002f883
mov dword [ebp - 0x244], 1
jmp 0x1002f88a
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x244]
sub eax, 0x29c8ddac
cmp eax, dword [ebp - 0xbc]
jg 0x1002f8dd
lea eax, [ebp - 0xbc]
push eax
push 0x4471
push 0x128f
lea eax, [ebp - 0x390]
push eax
push 0
call fcn.10031565
add esp, 0x14
mov byte [ebp - 0x2e], 0
push 0x7181
push 0
lea eax, [ebp - 0x2e]
push eax
push 0x2674
call fcn.10033e78
add esp, 0x10
jmp 0x1002f92d
mov dword [ebp - 0x84], 0
jmp 0x1002f8f6
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x1002f912
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x358], 0x5610
jmp 0x1002f8e9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x358]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x358], eax
push 0x5d80
push 0x3c88
push 0
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0xc4]
push eax
push 0x3754
push 1
push 0x218a
push 1
call fcn.10038817
add esp, 0x24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x390]
call fcn.100270c6
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x78]
add ecx, dword [eax + 0xc]
push ecx
push 0x106da
push 0xf21c
call fcn.1002607f
pop ecx
pop ecx
call eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x24], 0xfffffffe
mov dword [ebp - 0x28], 4
mov dword [ebp - 0xcc], 0x54114571
mov dword [ebp - 0x24], 9
jmp 0x1002f9b7
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x11
jne 0x1002fbb3
mov dword [ebp - 0x288], 0x37c57f39
mov dword [ebp - 0xa0], 0
jmp 0x1002f9e4
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x1002fa00
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0xe8], 0x2a83
jmp 0x1002f9d7
mov dword [ebp - 0x28], 0xfffffff9
cmp dword [ebp - 0x28], 0
je 0x1002fab2
cmp dword [ebp - 0x24], 0
jne 0x1002faa6
imul eax, dword [ebp - 0x24], 0x28ed
test eax, eax
je 0x1002fa42
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe8], 0
je 0x1002fa42
mov dword [ebp - 0x24c], 1
jmp 0x1002fa49
and dword [ebp - 0x24c], 0
cmp dword [ebp - 0x24c], 0xab2
jg 0x1002fa61
mov dword [ebp - 0x10c], 1
jmp 0x1002fa68
and dword [ebp - 0x10c], 0
cmp dword [ebp - 0x10c], 6
jb 0x1002fa7d
mov dword [ebp - 0x1b4], 1
jmp 0x1002fa84
and dword [ebp - 0x1b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe8]
add eax, dword [ebp - 0x1b4]
push 4
pop ecx
imul ecx, ecx, 0
cmp dword [ebp + ecx - 0xe8], eax
jle 0x1002fab2
mov dword [ebp - 0x114], 1
jmp 0x1002fab9
and dword [ebp - 0x114], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe8]
cmp dword [ebp - 0x114], eax
jge 0x1002fada
mov dword [ebp - 0x248], 1
jmp 0x1002fae1
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x248], eax
je 0x1002faf8
mov dword [ebp - 0x11c], 1
jmp 0x1002faff
and dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x28], 0
jmp 0x1002fb1b
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jg 0x1002fbae
mov dword [ebp - 0x2f0], 0xfffffffe
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp + ecx*4 - 0xe8]
cmp ecx, dword [ebp + eax*4 - 0xe8]
jg 0x1002fb51
mov dword [ebp - 0x1c0], 1
jmp 0x1002fb58
and dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1c0], eax
jge 0x1002fb6f
mov dword [ebp - 0x124], 1
jmp 0x1002fb76
and dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x2f0], eax
push 0x71d4
push 0
push 0x1186
push 0x5bcd
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x288]
push eax
call fcn.1003fba3
add esp, 0x18
jmp 0x1002fb14
jmp 0x1002f9b0
mov dword [ebp - 0xcc], 0xfffffffc
cmp dword [ebp - 0xd4], 0
jne 0x1002fcd7
push 0
push 1
lea eax, [ebp - 0x54]
push eax
call fcn.1002f04a
add esp, 0xc
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x48], 0xfffffffc
jmp 0x1002fbf1
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xd
jl 0x1002fccc
push 1
lea ecx, [ebp - 0x408]
call fcn.10027044
mov dword [ebp - 4], 6
mov dword [ebp - 0x8c], 0xd5816210
push 0x4f4c
push 0x518a
push 0x4adb
push 0
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x3c4]
push eax
call fcn.100374f4
add esp, 0x18
mov dword [ebp - 0x8c], 0
jmp 0x1002fc59
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jl 0x1002fc93
mov byte [ebp - 0x35], 0
movzx eax, byte [ebp - 0x35]
test eax, eax
je 0x1002fc89
push 0
push 0x79a
push 0
push 0
push 0xca2
push 0x258b
call dword [sym.imp.USER32.dll_ToAsciiEx]
push 0
call fcn.100412fd
pop ecx
jmp 0x1002fc4c
push 0
push 0x5ae7
push 0x3d8b
push 1
push 0x16ec
push 0x6851
push 0x71eb
call fcn.1003faff
add esp, 0x1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x408]
call fcn.100270c6
jmp 0x1002fbea
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
jmp 0x100310c1
push 1
lea ecx, [ebp - 0x378]
call fcn.10027044
mov dword [ebp - 4], 7
mov dword [ebp - 0x50], 5
mov dword [ebp - 0x210], 0x473
mov dword [ebp - 0x290], 0x1000e618
cmp dword [ebp - 0x210], 0x770
jle 0x1002fe1f
and dword [ebp - 0xa8], 0
jmp 0x1002fd2c
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x2f16
jge 0x1002fe1f
and dword [ebp - 0x94], 0
jmp 0x1002fd52
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0x1b85
jge 0x1002fe1a
and dword [ebp - 0xb0], 0
jmp 0x1002fd78
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x1354
jge 0x1002fe15
and dword [ebp - 0x9c], 0
jmp 0x1002fd9e
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0x3302
jge 0x1002fe10
mov eax, dword [ebp - 0xa8]
cdq
idiv dword [ebp - 0x94]
add edx, dword [ebp - 0xb0]
sub edx, dword [ebp - 0x9c]
mov eax, edx
cdq
mov dword [ebp - 0x2e4], eax
mov dword [ebp - 0x2e0], edx
push dword [ebp - 0x2e0]
push dword [ebp - 0x2e4]
lea ecx, [ebp - 0x454]
call fcn.10010ade
pop ecx
pop ecx
mov dword [ebp - 0x2f4], eax
mov ecx, dword [ebp - 0x2f4]
call fcn.10026de4
push eax
call fcn.10058cdf
pop ecx
lea ecx, [ebp - 0x454]
call fcn.10026dda
jmp 0x1002fd91
jmp 0x1002fd6b
jmp 0x1002fd45
jmp 0x1002fd1f
mov byte [ebp - 4], 8
cmp dword [ebp - 0x210], 0x1ec
jge 0x1002fe3b
push dword [ebp - 0x290]
call fcn.10058cdf
pop ecx
jmp 0x1002fe57
mov dword [ebp - 4], 7
jmp 0x1002fe67
push 0
lea eax, [ebp - 0x424]
push eax
push 0x56a9
push 0
push 0x3a30
push 0x7c1
push 0x3bcf
push 1
lea eax, [ebp - 0x378]
push eax
push 0x3a3c
push 0xae6
push 0x4639
call fcn.10041a98
add esp, 0x30
mov dword [ebp - 0x50], 0
jmp 0x1002feb6
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x1002ff52
push dword [ebp - 0x50]
lea ecx, [ebp - 0x378]
call fcn.100270e2
cmp dword [eax], 0
je 0x1002fefc
push 0x4d8f
push 0
push 0x2098
push 1
push 0x547a
push 0xf68
push 0x4707
push 1
call fcn.1002f40b
add esp, 0x20
jmp 0x1002ff2a
push 0x30cb
push 0
call fcn.100313ed
pop ecx
pop ecx
push 0
push 0x4dc3
push 0x50fe
push 0x133c
push 1
push 0xa88
call fcn.10038002
add esp, 0x18
mov byte [ebp - 0x30], 0
lea eax, [ebp - 0x30]
push eax
push 1
push 1
push 0x887
push 0x2bea
push 0x7944
call fcn.1002ed92
add esp, 0x18
jmp 0x1002feaf
mov byte [ebp - 0x37], 0
movzx eax, byte [ebp - 0x37]
test eax, eax
je 0x1002ff72
push 0x7962
push 0
push 0x2cbb
call fcn.100380d6
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x378]
call fcn.100270c6
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 0xc]
lea eax, [eax*4 + 4]
push eax
mov eax, dword [ebp - 0x2c]
push dword [eax + 8]
call fcn.10059087
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 8], eax
mov dword [ebp - 0x144], 0xffffffff
mov dword [ebp - 0x58], 0xfffffff7
mov dword [ebp - 0x3cc], 0xfffffff7
mov dword [ebp - 0xdc], 0xe507
mov dword [ebp - 0x328], 0x20b7
mov dword [ebp - 0x1d8], 0xb911
mov dword [ebp - 0x12c], 0x24cf
mov dword [ebp - 0x318], 0x1000e678
cmp dword [ebp - 0x12c], 0x285c
jle 0x100300db
and dword [ebp - 0xb4], 0
jmp 0x10030015
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x65ea
jge 0x100300db
and dword [ebp - 0xac], 0
jmp 0x1003003b
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x2c0
jge 0x100300d6
and dword [ebp - 0xb8], 0
jmp 0x10030061
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0x515a
jge 0x100300d1
and dword [ebp - 0xc0], 0
jmp 0x10030083
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x592a
jge 0x100300cf
mov eax, dword [ebp - 0xb8]
imul eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xb4]
xor ecx, dword [ebp - 0xac]
or eax, ecx
cdq
mov dword [ebp - 0x314], eax
mov dword [ebp - 0x310], edx
push dword [ebp - 0x310]
push dword [ebp - 0x314]
mov ecx, 0x1061aa98
call fcn.10026e04
jmp 0x10030076
jmp 0x10030054
jmp 0x1003002e
jmp 0x10030008
mov dword [ebp - 4], 0xa
cmp dword [ebp - 0x12c], 0x2168
jge 0x100300fe
mov edx, dword [ebp - 0x318]
mov ecx, 0x1061aa98
call fcn.10029b1c
jmp 0x1003011a
or dword [ebp - 4], 0xffffffff
jmp 0x10030124
mov dword [ebp - 0x18], 0
jmp 0x10030134
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1003014a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x218], 0xfffffffa
jmp 0x1003012d
mov dword [ebp - 0x18], 0
jmp 0x1003015a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x10030170
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x338], 0xffffffff
jmp 0x10030153
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x298]
cmp eax, dword [ebp - 0x2fc]
jg 0x100301af
mov dword [ebp - 0x258], 1
jmp 0x100301b6
and dword [ebp - 0x258], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x218], 0
jne 0x100302a2
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x58], 0x557bc775
jle 0x100301e8
mov dword [ebp - 0x2a0], 1
jmp 0x100301ef
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x328], 0
jne 0x10030208
cmp dword [ebp - 0x1d8], 0
mov eax, 0x278b
cmp eax, 0xffffffff
jle 0x1003021e
mov dword [ebp - 0x1c8], 1
jmp 0x10030225
and dword [ebp - 0x1c8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x338]
cmp dword [ebp - 0x1c8], eax
je 0x10030245
mov dword [ebp - 0x134], 1
jmp 0x1003024c
and dword [ebp - 0x134], 0
cmp dword [ebp - 0x134], 9
je 0x10030261
mov dword [ebp - 0x238], 1
jmp 0x10030268
and dword [ebp - 0x238], 0
cmp dword [ebp - 0x238], 0
jbe 0x1003027d
mov dword [ebp - 0x13c], 1
jmp 0x10030284
and dword [ebp - 0x13c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x338]
cmp dword [ebp - 0x13c], eax
jle 0x100302a2
and dword [ebp - 0x1d0], 0
jmp 0x100302ac
mov dword [ebp - 0x1d0], 1
mov eax, dword [ebp - 0x1d0]
sub eax, dword [ebp - 0x144]
mov dword [ebp - 0x14c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x14c]
mov dword [ebp + eax - 0x218], ecx
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x14c]
sub ecx, dword [ebp - 0x1d8]
imul ecx, dword [ebp + eax - 0x338]
add ecx, 9
je 0x1003030a
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x338], 0
je 0x1003030a
mov dword [ebp - 0x154], 1
jmp 0x10030311
and dword [ebp - 0x154], 0
cmp dword [ebp - 0x154], 0
jbe 0x10030326
mov dword [ebp - 0x15c], 1
jmp 0x1003032d
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x258]
neg eax
cmp eax, dword [ebp - 0x15c]
je 0x10030349
mov dword [ebp - 0x1e0], 1
jmp 0x10030350
and dword [ebp - 0x1e0], 0
cmp dword [ebp - 0x1e0], 4
jg 0x10030365
mov dword [ebp - 0x164], 1
jmp 0x1003036c
and dword [ebp - 0x164], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x338]
cmp dword [ebp - 0x164], eax
jge 0x1003038c
mov dword [ebp - 0x220], 1
jmp 0x10030393
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x220], eax
jl 0x100303aa
mov dword [ebp - 0x16c], 1
jmp 0x100303b1
and dword [ebp - 0x16c], 0
cmp dword [ebp - 0x16c], 0x5f5dda30
jle 0x100303c9
mov dword [ebp - 0x1e8], 1
jmp 0x100303d0
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 8], 0
jne 0x10030999
and dword [ebp - 0x36c], 0
and dword [ebp - 0x368], 0
and dword [ebp - 0x364], 0
and dword [ebp - 0x360], 0
lea ecx, [ebp - 0xd5]
call fcn.100270f1
push eax
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x36c]
push eax
lea ecx, [ebp - 0x43c]
call fcn.100270f4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x6c]
call fcn.100270a0
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x108], 0xbad2ce6c
mov dword [ebp - 0x2b8], 0xe53bdbb3
push 0
lea ecx, [ebp - 0x6c]
call fcn.100270e2
mov dword [eax], 0xfffffffe
jmp 0x10030482
push 0
lea ecx, [ebp - 0x6c]
call fcn.100270e2
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x174]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x6c]
call fcn.100270e2
cmp dword [eax], 0xffffffed
jg 0x10030825
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x2a8], 0x4bdb
mov dword [ebp - 0x228], 0xa4f2a6ca
mov dword [ebp - 0x320], 0xac245771
mov dword [ebp - 0x74], 0
jmp 0x100304ca
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x100304e0
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x384], 0xffffffff
jmp 0x100304c3
push 0x4ba2
push 0x1a3c
push 0x75f7
push 1
push 0
lea eax, [ebp - 0x40]
push eax
call fcn.10041d62
add esp, 0x18
mov eax, 0x17a9413e
test eax, eax
je 0x10030523
push 1
lea ecx, [ebp - 0x6c]
call fcn.100270e2
cmp dword [eax], 0
je 0x10030523
mov dword [ebp - 0x240], 1
jmp 0x1003052a
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x240]
jne 0x10030541
mov dword [ebp - 0x17c], 1
jmp 0x10030548
and dword [ebp - 0x17c], 0
push 2
lea ecx, [ebp - 0x6c]
call fcn.100270e2
mov eax, dword [eax]
cmp eax, dword [ebp - 0x17c]
jl 0x10030574
push 0
lea ecx, [ebp - 0x6c]
call fcn.100270e2
cmp dword [eax], 0
jne 0x10030574
and dword [ebp - 0x1f0], 0
jmp 0x1003057e
mov dword [ebp - 0x1f0], 1
mov eax, dword [ebp - 0x1f0]
sub eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x184], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x184]
mov dword [ebp + eax - 0x384], ecx
mov esi, dword [ebp - 0x40]
push 1
lea ecx, [ebp - 0x6c]
call fcn.100270e2
mov ecx, dword [ebp - 0x184]
add ecx, dword [eax]
add ecx, esi
mov dword [ebp - 0x228], ecx
cmp dword [ebp - 0x228], 3
jl 0x100305d5
mov dword [ebp - 0x304], 1
jmp 0x100305dc
and dword [ebp - 0x304], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x384], 0
jne 0x100305fb
push 0
lea ecx, [ebp - 0x6c]
call fcn.100270e2
cmp dword [eax], 0
je 0x1003060b
xor eax, eax
je 0x1003060b
mov dword [ebp - 0x18c], 1
jmp 0x10030612
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x18c]
add eax, 0x95b
je 0x1003063b
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x384], 0
je 0x1003063b
mov dword [ebp - 0x1f8], 1
jmp 0x10030642
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x1f8]
jne 0x10030665
push 1
lea ecx, [ebp - 0x6c]
call fcn.100270e2
cmp dword [eax], 0
jne 0x10030665
and dword [ebp - 0x194], 0
jmp 0x1003066f
mov dword [ebp - 0x194], 1
push 0
lea ecx, [ebp - 0x6c]
call fcn.100270e2
mov ecx, dword [ebp - 0x194]
cmp ecx, dword [eax]
jge 0x1003068f
mov dword [ebp - 0x250], 1
jmp 0x10030696
and dword [ebp - 0x250], 0
push 0
lea ecx, [ebp - 0x6c]
call fcn.100270e2
mov ecx, dword [ebp - 0x250]
cmp ecx, dword [eax]
jl 0x100306b6
mov dword [ebp - 0x2b0], 1
jmp 0x100306bd
and dword [ebp - 0x2b0], 0
push 1
lea ecx, [ebp - 0x6c]
call fcn.100270e2
cmp dword [ebp - 0x40], 0
jne 0x100306d9
mov dword [ebp - 0x19c], 1
jmp 0x100306e0
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x19c], eax
jg 0x100306f7
mov dword [ebp - 0x200], 1
jmp 0x100306fe
and dword [ebp - 0x200], 0
push 0
lea ecx, [ebp - 0x6c]
call fcn.100270e2
mov ecx, dword [ebp - 0x200]
cmp ecx, dword [eax]
jge 0x1003071e
mov dword [ebp - 0x1a4], 1
jmp 0x10030725
and dword [ebp - 0x1a4], 0
push 3
lea ecx, [ebp - 0x6c]
call fcn.100270e2
mov ecx, dword [ebp - 0x1a4]
cmp ecx, dword [eax]
jg 0x10030745
mov dword [ebp - 0x230], 1
jmp 0x1003074c
and dword [ebp - 0x230], 0
push 0
lea ecx, [ebp - 0x6c]
call fcn.100270e2
mov ecx, dword [ebp - 0x230]
cmp ecx, dword [eax]
jl 0x1003076c
mov dword [ebp - 0x1ac], 1
jmp 0x10030773
and dword [ebp - 0x1ac], 0
cmp dword [ebp - 0x1ac], 0xb650ebf0
ja 0x1003078b
mov dword [ebp - 0x208], 1
jmp 0x10030792
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x208], eax
jne 0x100307ac
mov dword [ebp - 0x104], 1
jmp 0x100307b3
and dword [ebp - 0x104], 0
cmp dword [ebp - 0x104], 0xafe0
jl 0x100307cb
mov dword [ebp - 0x110], 1
jmp 0x100307d2
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x110], eax
jne 0x100307ec
mov dword [ebp - 0x118], 1
jmp 0x100307f3
and dword [ebp - 0x118], 0
mov eax, dword [ebp - 0x320]
cmp dword [ebp - 0x118], eax
jle 0x1003080d
mov dword [ebp - 0x120], 1
jmp 0x10030814
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x2b8], eax
jmp 0x10030461
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.100270c6
push 0x7dfd
push 0x7b94
push 0x7398
push 1
push 1
push 0x39b7
lea eax, [ebp - 0x54]
push eax
call fcn.1002e0ea
add esp, 0x1c
mov dword [ebp - 0x60], 0xe3556834
push 1
lea ecx, [ebp - 0x350]
call fcn.10027044
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x2c0], 4
push 1
lea ecx, [ebp - 0x39c]
call fcn.10027044
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x350]
push eax
push 0x54e6
lea eax, [ebp - 0x30c]
push eax
push 0
call fcn.100344e9
add esp, 0x10
push 0x57c7
push 0x3f11
push 1
push 1
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x39c]
push eax
call fcn.1002e249
add esp, 0x18
mov dword [ebp - 0x60], 0
jmp 0x100308e6
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xfffffff6
jge 0x10030976
mov dword [ebp - 0x128], 0x98311173
push 0x1f94
lea eax, [ebp - 0x130]
push eax
push 0
push 0x10de
lea eax, [ebp - 0x128]
push eax
push 0x3f3b
lea eax, [ebp - 0x350]
push eax
push 0
call fcn.10033d31
add esp, 0x20
push 0x7dad
push 1
lea eax, [ebp - 0x128]
push eax
push 0x57dd
push 0x786e
lea eax, [ebp - 0x130]
push eax
push 1
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x39c]
push eax
lea eax, [ebp - 0x350]
push eax
push 0x5e58
lea eax, [ebp - 0x60]
push eax
call fcn.1002ee53
add esp, 0x30
jmp 0x100308df
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x39c]
call fcn.100270c6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x350]
call fcn.100270c6
jmp 0x100310c1
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x3dc], 0xd03248c6
mov dword [ebp - 0x41c], 0x891c5534
mov dword [ebp - 0x3e4], 0
mov dword [ebp - 0x40c], 0xf90ef307
push 1
lea ecx, [ebp - 0x418]
call fcn.10027044
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x2c8], 0xffffffff
mov dword [ebp - 0x2ec], 0xfff8
push 1
push 0x55f0
push 0x49b5
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x418]
push eax
push 0x3d5d
push 0
call fcn.10038301
add esp, 0x1c
push 0
push 0x47b3
push 0x657a
push 1
push 0xc6d
push 0x4a77
push 0x793f
push 1
push 0x21e8
push 0x30c1
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.10041a98
add esp, 0x30
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x138], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x418]
call fcn.100270c6
lea eax, [ebp - 0x2e8]
push eax
lea eax, [ebp - 0x2d0]
push eax
push dword [ebp - 0x78]
push dword [ebp - 0x44]
lea eax, [ebp - 0xd4]
push eax
push dword [ebp - 0x2c]
call fcn.1002d2f1
add esp, 0x18
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x2e8]
push eax
lea eax, [ebp - 0x2d0]
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0xd4]
push eax
call fcn.1002db8e
add esp, 0x14
push 4
lea ecx, [ebp - 0xf4]
call fcn.10027044
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x88], 0xfffffffa
mov dword [ebp - 0x4c], 0xfffffffa
mov dword [ebp - 0x20], 0
push 0x1b9
push 1
lea eax, [ebp - 0xf4]
push eax
push 0
push 0x5fef
push 0x4e8
lea eax, [ebp - 0x3c0]
push eax
push 1
call fcn.1002f40b
add esp, 0x20
push 2
lea ecx, [ebp - 0xf4]
call fcn.100270e2
mov dword [eax], 8
jmp 0x10030b50
push 2
lea ecx, [ebp - 0xf4]
call fcn.100270e2
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x140]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xf4]
call fcn.100270e2
cmp dword [eax], 0x1b
jne 0x10030d6a
mov dword [ebp - 0x2f8], 1
mov dword [ebp - 0x160], 7
mov dword [ebp - 0x80], 0
jmp 0x10030b8a
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 4
jge 0x10030ba0
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x434], 0xfffffff8
jmp 0x10030b83
push 3
lea ecx, [ebp - 0xf4]
call fcn.100270e2
cmp dword [eax], 0xaa810d21
jne 0x10030bc1
mov dword [ebp - 0x168], 1
jmp 0x10030bc8
and dword [ebp - 0x168], 0
mov eax, dword [ebp - 0x2f8]
neg eax
cmp eax, 4
je 0x10030be1
mov dword [ebp - 0x158], 1
jmp 0x10030be8
and dword [ebp - 0x158], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x434], 1
jg 0x10030c04
mov dword [ebp - 0x148], 1
jmp 0x10030c0b
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x148], eax
jne 0x10030c37
push 2
lea ecx, [ebp - 0xf4]
call fcn.100270e2
cmp dword [eax], 0
je 0x10030c37
mov dword [ebp - 0x2dc], 1
jmp 0x10030c3e
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x3c8], eax
mov eax, 0x4dfecbe9
test eax, eax
jne 0x10030c61
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x434], 0
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x4c], eax
mov esi, dword [ebp - 0x4c]
push 2
lea ecx, [ebp - 0xf4]
call fcn.100270e2
cmp esi, dword [eax]
jge 0x10030c8a
mov dword [ebp - 0xf8], 1
jmp 0x10030c91
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x158]
sub eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x88]
je 0x10030cbd
mov dword [ebp - 0x170], 1
jmp 0x10030cc4
and dword [ebp - 0x170], 0
mov esi, dword [ebp - 0x168]
sub esi, dword [ebp - 0x170]
push 2
lea ecx, [ebp - 0xf4]
call fcn.100270e2
cmp esi, dword [eax]
je 0x10030ced
mov dword [ebp - 0x178], 1
jmp 0x10030cf4
and dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0
jmp 0x10030d0d
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x3c
jne 0x10030d65
mov byte [ebp - 0x2d], 0
movzx eax, byte [ebp - 0x2d]
test eax, eax
je 0x10030d3a
push 1
push 1
push 0x10db
push 0x7dc6
push 0x21e2
call fcn.1002e828
add esp, 0x14
mov dword [ebp - 0x4c], 3
jmp 0x10030d4a
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x10030d63
push 1
push 1
push 0x1593
call fcn.1002f04a
add esp, 0xc
jmp 0x10030d43
jmp 0x10030d06
jmp 0x10030b2c
mov dword [ebp - 0x20], 0
jmp 0x10030d7a
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2c
jle 0x10030da7
push 0x5207
push 0
push 0x1c96
call fcn.10040900
add esp, 0xc
mov byte [ebp - 0x36], 0
push 0
lea eax, [ebp - 0x36]
push eax
call fcn.1003f7b3
pop ecx
pop ecx
jmp 0x10030d73
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf4]
call fcn.100270c6
cmp dword [ebp - 0x54], 0
jne 0x100310bc
mov dword [ebp - 0x14], 0x56a9ef72
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x1cc], 0x4a104acd
mov dword [ebp - 0x90], 0
jmp 0x10030df4
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 1
jge 0x10030e10
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x300], 0
jmp 0x10030de7
mov byte [ebp - 0x2f], 0
push 1
push 1
push 0x7abc
push 0x2be1
push 0x3bcb
lea eax, [ebp - 0x2f]
push eax
push 0x5645
push 0x2aba
push 0x5861
push 0x7abd
push 0x58c3
call fcn.1002f24f
add esp, 0x2c
mov eax, dword [ebp - 0x14]
neg eax
je 0x1003109c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3d0], eax
imul eax, dword [ebp - 0x14], 0xaf7b
cmp eax, dword [ebp - 0x14]
jl 0x10030e78
mov dword [ebp - 0x180], 1
jmp 0x10030e7f
and dword [ebp - 0x180], 0
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x14], 0
je 0x10030ea3
cmp dword [ebp - 0x98], 0
jne 0x10030ea3
and dword [ebp - 0x188], 0
jmp 0x10030ead
mov dword [ebp - 0x188], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x188], eax
jge 0x10030ec4
mov dword [ebp - 0x190], 1
jmp 0x10030ecb
and dword [ebp - 0x190], 0
cmp dword [ebp - 0x190], 0x1e2d
jg 0x10030ee3
mov dword [ebp - 0x198], 1
jmp 0x10030eea
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x198], eax
jle 0x10030f01
mov dword [ebp - 0x1a0], 1
jmp 0x10030f08
and dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0x1a0]
sub eax, 0x3d47
cmp eax, 0xb2c4
jge 0x10030f2c
cmp dword [ebp - 0x98], 0
jne 0x10030f2c
and dword [ebp - 0x1a8], 0
jmp 0x10030f36
mov dword [ebp - 0x1a8], 1
cmp dword [ebp - 0x1a8], 0xffffffff
jne 0x10030f4b
mov dword [ebp - 0x1b0], 1
jmp 0x10030f52
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x1b0]
sub eax, dword [ebp - 0x14]
je 0x10030f73
cmp dword [ebp - 0x14], 0
je 0x10030f73
mov dword [ebp - 0x1bc], 1
jmp 0x10030f7a
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1bc], eax
jge 0x10030f89
cmp dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jle 0x10030f9d
mov dword [ebp - 0x1c4], 1
jmp 0x10030fa4
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x1cc], eax
je 0x10030fca
cmp dword [ebp - 0x98], 0
je 0x10030fca
mov dword [ebp - 0x1d4], 1
jmp 0x10030fd1
and dword [ebp - 0x1d4], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x1d4]
je 0x10030fe8
mov dword [ebp - 0x1dc], 1
jmp 0x10030fef
and dword [ebp - 0x1dc], 0
cmp dword [ebp - 0x1dc], 0xffffffff
jb 0x10031004
mov dword [ebp - 0x1e4], 1
jmp 0x1003100b
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1e4], eax
jl 0x10031022
mov dword [ebp - 0x1ec], 1
jmp 0x10031029
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1ec], eax
jg 0x10031040
mov dword [ebp - 0x1f4], 1
jmp 0x10031047
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x1f4]
cmp eax, dword [ebp - 0x14]
je 0x10031062
mov dword [ebp - 0x1fc], 1
jmp 0x10031069
and dword [ebp - 0x1fc], 0
cmp dword [ebp - 0x1fc], 0xffffffff
jae 0x1003107e
mov dword [ebp - 0x204], 1
jmp 0x10031085
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x204], eax
jge 0x1003109c
mov dword [ebp - 0x20c], 1
jmp 0x100310a3
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x20c]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x300], eax
jmp 0x100310c1
jmp 0x1002f5e5
mov dword [ebp - 0xe0], 0x35357f45
mov dword [ebp - 0xc8], 0xe3bc4aee
mov dword [ebp - 0x224], 0x59ea
mov dword [ebp - 0x270], 1
mov dword [ebp - 0x3b8], 1
mov dword [ebp - 0x3b4], 1
mov dword [ebp - 0x3b0], 1
mov dword [ebp - 0x3ac], 1
mov dword [ebp - 0x1c], 0
jmp 0x10031121
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10031137
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x268], 0xfffffffc
jmp 0x1003111a
mov dword [ebp - 0x1c], 0
jmp 0x10031147
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1003115d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x274], 0xfffffff6
jmp 0x10031140
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x268]
mov dword [ebp - 0x3e0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x268], 0x1c1c9bff
je 0x1003118f
mov dword [ebp - 0x214], 1
jmp 0x10031196
and dword [ebp - 0x214], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xe0]
add ecx, dword [ebp - 0x214]
mov edx, dword [ebp - 0xe0]
sub edx, ecx
cmp edx, dword [ebp + eax - 0x268]
jne 0x100311ca
mov eax, 0x3b8c105a
test eax, eax
jne 0x100311ca
and dword [ebp - 0x21c], 0
jmp 0x100311d4
mov dword [ebp - 0x21c], 1
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x420], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x224]
cmp ecx, dword [ebp + eax - 0x268]
jg 0x10031219
mov dword [ebp - 0x22c], 1
jmp 0x10031220
and dword [ebp - 0x22c], 0
cmp dword [ebp - 0x22c], 0xfffffffd
je 0x10031235
mov dword [ebp - 0x234], 1
jmp 0x1003123c
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0xe0]
add eax, dword [ebp - 0x234]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0xc8], 0
je 0x1003126c
mov eax, 0x45c2
test eax, eax
je 0x1003126c
mov dword [ebp - 0x23c], 1
jmp 0x10031273
and dword [ebp - 0x23c], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x268]
imul ecx, dword [ebp - 0x23c]
cmp ecx, dword [ebp + eax - 0x268]
je 0x100312a2
mov dword [ebp - 0xd0], 1
jmp 0x100312a9
and dword [ebp - 0xd0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd0]
mov dword [ebp + eax - 0x274], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xd0]
mov dword [ebp + eax - 0x3b8], ecx
mov eax, dword [ebp - 0x27c]
mov ecx, dword [ebp - 0x54]
mov dword [eax], ecx
jmp 0x100313a6
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x294], eax
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x5c]
mov dword [eax], 0
jmp 0x10031324
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x5c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x5c]
cmp dword [eax], 4
jge 0x10031344
mov eax, dword [ebp - 0x5c]
push dword [eax]
mov ecx, dword [ebp - 0x2a4]
call fcn.100270e2
mov dword [eax], 0x824a8c6a
jmp 0x10031319
jmp 0x100313a6
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2b4], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x2ac]
movzx eax, byte [eax]
test eax, eax
je 0x1003137d
mov byte [ebp - 0x38], 0
movzx eax, byte [ebp - 0x38]
test eax, eax
je 0x1003137b
push 0
push 0
call dword [sym.imp.GDI32.dll_RectInRegion]
jmp 0x100313a6
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xfc]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret