Function at 0x10020d7b
Capabilities:
Contain obfuscated stackstrings
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008aa4d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb98
push esi
push 1
lea ecx, [ebp - 0xa40]
call fcn.10018d3c
and dword [ebp - 4], 0
mov dword [ebp - 0x12c], 0
jmp 0x10020dc4
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 1
jge 0x10020de6
push dword [ebp - 0x12c]
lea ecx, [ebp - 0xa40]
call fcn.10018dda
mov dword [eax], 1
jmp 0x10020db7
mov byte [ebp - 0xb9], 0
lea eax, [ebp - 0xb9]
push eax
push 0
call fcn.1001f8a3
pop ecx
pop ecx
push 0x1b55
push 1
call fcn.1001f8a3
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa40]
call fcn.10018dbe
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x5e0], 0x89e022a5
mov dword [ebp - 0x5f0], 0xd2cc9105
mov dword [ebp - 0x600], 1
mov dword [ebp - 0x6f4], 0
mov dword [ebp - 0xa24], 3
mov dword [ebp - 0x9ec], 1
mov dword [ebp - 0xa88], 0
mov dword [ebp - 0x9f4], 7
mov dword [ebp - 0xa8c], 0xb462a77b
mov dword [ebp - 0x9fc], 0x883e
mov dword [ebp - 0xa90], 0x5cbf7935
mov dword [ebp - 0xa04], 4
mov dword [ebp - 0xadc], 6
mov dword [ebp - 0xa0c], 0xfffffff6
mov dword [ebp - 0x6fc], 8
mov dword [ebp - 0x50], 0
jmp 0x10020ec7
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jge 0x10020edd
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x7e8], 0xa29
jmp 0x10020ec0
mov dword [ebp - 0x50], 0
jmp 0x10020eed
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x10020f03
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0xb54], 0xc06e3268
jmp 0x10020ee6
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x958], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x78]
cmp dword [ebp + eax - 0x7e8], ecx
jne 0x10020f2a
mov dword [ebp - 0x3e0], 1
jmp 0x10020f31
and dword [ebp - 0x3e0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3e0]
sub ecx, dword [ebp + eax - 0x7e8]
mov dword [ebp - 0x5e0], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7e8]
cmp eax, dword [ebp - 0x5e0]
je 0x10020f6b
mov dword [ebp - 0x5e8], 1
jmp 0x10020f72
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x5f0], eax
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x5f0], eax
jl 0x10020f95
mov dword [ebp - 0x764], 1
jmp 0x10020f9c
and dword [ebp - 0x764], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7e8]
mov dword [ebp - 0x960], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x968], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x7e8]
cmp dword [ebp - 0x78], eax
jge 0x10020fd6
mov dword [ebp - 0x5f8], 1
jmp 0x10020fdd
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x5f8]
mov dword [ebp - 0x600], eax
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x600], eax
jne 0x10021000
mov dword [ebp - 0x614], 1
jmp 0x10021007
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x614]
jge 0x1002101e
mov dword [ebp - 0x61c], 1
jmp 0x10021025
and dword [ebp - 0x61c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7e8]
imul eax, dword [ebp - 0x61c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x7e8]
jge 0x10021054
mov dword [ebp - 0x624], 1
jmp 0x1002105b
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x624]
sub eax, 0x4a71b966
mov dword [ebp - 0x6f4], eax
push 0x58fa
push 0x5b0b
push 0
lea eax, [ebp - 0x6fc]
push eax
call fcn.1001fb26
add esp, 0x10
mov eax, dword [0x1067e968]
and eax, 1
jne 0x100210be
mov eax, dword [0x1067e968]
or eax, 1
mov dword [0x1067e968], eax
mov dword [ebp - 4], 1
mov ecx, 0x1067e9a8
call fcn.10018eea
push 0x1008cede
call fcn.100713f6
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x170], 0xe76f5020
mov dword [ebp - 0x128], 0
jmp 0x100210e1
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 4
jge 0x100210fd
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0xb00], 0xdc85
jmp 0x100210d4
mov dword [ebp - 0x170], 3
jmp 0x10021116
mov eax, dword [ebp - 0x170]
dec eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0
jl 0x100211de
push 2
lea ecx, [ebp - 0x934]
call fcn.10018d3c
mov dword [ebp - 4], 2
mov dword [ebp - 0xc4], 0x35a23e86
mov dword [ebp - 0x130], 0
jmp 0x1002115a
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jge 0x1002117c
push dword [ebp - 0x130]
lea ecx, [ebp - 0x934]
call fcn.10018dda
mov dword [eax], 0xafa2fafd
jmp 0x1002114d
push 0
lea ecx, [ebp - 0x934]
call fcn.10018dda
and dword [eax], 0
mov dword [ebp - 0xc4], 0
jmp 0x100211a5
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jg 0x100211ca
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [ebp + eax*4 - 0xb00]
mov dword [ebp + ecx*4 - 0xaf8], eax
jmp 0x10021198
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x934]
call fcn.10018dbe
jmp 0x10021109
push dword [ebp + 8]
lea ecx, [ebp - 0x910]
call fcn.10018af1
mov dword [ebp - 4], 3
mov dword [ebp - 0x2cc], 0xd7be7e55
push 1
lea ecx, [ebp - 0x8e0]
call fcn.10018d3c
mov byte [ebp - 4], 4
mov dword [ebp - 0x65c], 0
mov dword [ebp - 0x6d0], 0xffffffff
push 0
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0x8e0]
push eax
call fcn.1001fac2
add esp, 0xc
mov dword [ebp - 0xf0], 0
jmp 0x10021253
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 1
jge 0x1002126f
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x704], 0x1b552bf3
jmp 0x10021246
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x970], eax
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x978], eax
push 0
lea ecx, [ebp - 0x8e0]
call fcn.10018dda
mov dword [eax], 4
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x704], 4
push 4
pop eax
cmp eax, 0x33c2
jg 0x100212ca
cmp dword [ebp - 0x65c], 0
je 0x100212ca
mov dword [ebp - 0x62c], 1
jmp 0x100212d1
and dword [ebp - 0x62c], 0
cmp dword [ebp - 0x62c], 0
jle 0x100212e6
mov dword [ebp - 0x6cc], 1
jmp 0x100212ed
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x6d0]
mov dword [ebp - 0x980], eax
xor eax, eax
inc eax
cmp eax, 4
jb 0x1002130d
mov dword [ebp - 0x634], 1
jmp 0x10021314
and dword [ebp - 0x634], 0
imul eax, dword [ebp - 0x634], 0xffff
cmp eax, 0xd982
jne 0x10021331
mov dword [ebp - 0x63c], 1
jmp 0x10021338
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x63c], eax
jne 0x10021352
mov dword [ebp - 0x644], 1
jmp 0x10021359
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x644]
mov dword [ebp - 0x65c], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x8e0]
call fcn.10018dbe
lea eax, [ebp - 0x988]
push eax
lea ecx, [ebp - 0x910]
call fcn.1001935d
push dword [eax]
lea eax, [ebp - 0x990]
push eax
lea ecx, [ebp - 0x910]
call fcn.10019371
push dword [eax]
lea eax, [ebp - 0x998]
push eax
lea ecx, [ebp - 0x910]
call fcn.1001935d
push dword [eax]
mov edx, 0x1001d241
lea ecx, [ebp - 0x9a0]
call fcn.10027cf4
add esp, 0xc
push 2
lea ecx, [ebp - 0x2ec]
call fcn.10018d3c
mov byte [ebp - 4], 5
mov dword [ebp - 0x734], 0x9ff446cd
mov dword [ebp - 0x73c], 0x2d29ed7d
mov dword [ebp - 0x9a8], 0xba92
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x2ec]
push eax
push 0x5dc5
push 1
push 0x720e
call fcn.1001f90d
add esp, 0x14
mov dword [ebp - 0x100], 0
jmp 0x1002142d
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 3
jge 0x10021449
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x264], 0xbdba76aa
jmp 0x10021420
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x264], 1
jmp 0x10021477
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x264]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x264], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x264], 0
jl 0x1002171a
mov dword [ebp - 0xcc], 0xae8c9f36
mov dword [ebp - 0xcc], 1
jmp 0x100214ae
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jl 0x10021715
mov dword [ebp - 0x5ac], 1
mov dword [ebp - 0x4e4], 0x586fa66f
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x264]
lea ecx, [ebp - 0x2ec]
call fcn.10018dda
push 0
lea ecx, [ebp - 0x2ec]
call fcn.10018dda
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x264], 0
jne 0x1002152a
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x264]
lea ecx, [ebp - 0x2ec]
call fcn.10018dda
cmp dword [eax], 0
jne 0x1002152a
and dword [ebp - 0x4d4], 0
jmp 0x10021534
mov dword [ebp - 0x4d4], 1
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x264]
lea ecx, [ebp - 0x2ec]
call fcn.10018dda
mov ecx, dword [ebp - 0x4d4]
add ecx, dword [eax]
je 0x10021574
push 0
lea ecx, [ebp - 0x2ec]
call fcn.10018dda
cmp dword [eax], 0
je 0x10021574
mov dword [ebp - 0x5d8], 1
jmp 0x1002157b
and dword [ebp - 0x5d8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x264]
cmp eax, dword [ebp - 0x5d8]
jg 0x1002159b
mov dword [ebp - 0x6d8], 1
jmp 0x100215a2
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x9b0], eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x264]
lea ecx, [ebp - 0x2ec]
call fcn.10018dda
mov dword [ebp - 0x32c], eax
push 1
lea ecx, [ebp - 0x2ec]
call fcn.10018dda
mov ecx, dword [ebp - 0x32c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x32c]
mov eax, dword [eax]
mov dword [ebp - 0x5ac], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x264]
cmp dword [ebp - 0x5ac], eax
jl 0x10021612
mov dword [ebp - 0x334], 1
jmp 0x10021619
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x734]
cmp dword [ebp - 0x334], eax
jg 0x10021633
mov dword [ebp - 0x4dc], 1
jmp 0x1002163a
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x4dc]
sub eax, 0x2273
jne 0x10021659
mov eax, 0x828451d7
test eax, eax
jne 0x10021659
and dword [ebp - 0x33c], 0
jmp 0x10021663
mov dword [ebp - 0x33c], 1
cmp dword [ebp - 0x33c], 0xfffffffb
jb 0x10021678
mov dword [ebp - 0x668], 1
jmp 0x1002167f
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x668], eax
jle 0x10021699
mov dword [ebp - 0x344], 1
jmp 0x100216a0
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x4e4]
cmp dword [ebp - 0x344], eax
jge 0x100216ba
mov dword [ebp - 0x34c], 1
jmp 0x100216c1
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x4e4]
cmp dword [ebp - 0x34c], eax
je 0x100216db
mov dword [ebp - 0x5b4], 1
jmp 0x100216e2
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x5b4]
mov dword [ebp - 0x73c], eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x264]
lea ecx, [ebp - 0x2ec]
call fcn.10018dda
cmp dword [eax], 0
je 0x10021710
jmp 0x100214a1
jmp 0x100214a1
jmp 0x1002145c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2ec]
call fcn.10018dbe
lea ecx, [ebp - 0x910]
call fcn.1001d1cc
mov dword [ebp - 0x5d0], eax
mov dword [ebp - 0x18], 0xa4a9bdba
push 2
lea ecx, [ebp - 0x6b4]
call fcn.10018d3c
mov byte [ebp - 4], 6
mov dword [ebp - 0x754], 9
push 0
push 0x2807
lea eax, [ebp - 0x6b4]
push eax
lea eax, [ebp - 0xf8]
push eax
push 0x1d9d
call fcn.1001fa18
add esp, 0x14
mov dword [ebp - 0xf8], 0
jmp 0x10021797
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jge 0x100217b3
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x284], 0xfffffff6
jmp 0x1002178a
cmp dword [ebp - 0x18], 0
je 0x100217fe
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x100217d3
push 0
call fcn.10020806
pop ecx
mov byte [ebp - 0xbc], 0
movzx eax, byte [ebp - 0xbc]
test eax, eax
je 0x100217f9
push 1
push 0x1599
push 0x1a3f
call fcn.1001f9b4
add esp, 0xc
jmp 0x10021d48
push 3
lea ecx, [ebp - 0x304]
call fcn.10018d3c
mov byte [ebp - 4], 7
mov dword [ebp - 0x1b0], 0
jmp 0x10021828
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 3
jge 0x1002184a
push dword [ebp - 0x1b0]
lea ecx, [ebp - 0x304]
call fcn.10018dda
mov dword [eax], 1
jmp 0x1002181b
mov dword [ebp - 0x18], 0
jmp 0x1002185a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jg 0x1002199c
mov dword [ebp - 0x138], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x6b4]
call fcn.10018dda
mov esi, eax
push 1
lea ecx, [ebp - 0x304]
call fcn.10018dda
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0x138], 0
jmp 0x100218a8
mov eax, dword [ebp - 0x138]
dec eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0xffffffeb
jl 0x10021997
mov dword [ebp - 0x744], 0x57a6
push dword [ebp - 0x18]
lea ecx, [ebp - 0x6b4]
call fcn.10018dda
push dword [ebp - 0x18]
lea ecx, [ebp - 0x6b4]
call fcn.10018dda
mov esi, eax
push 1
lea ecx, [ebp - 0x304]
call fcn.10018dda
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x100218fc
mov dword [ebp - 0x354], 1
jmp 0x10021903
and dword [ebp - 0x354], 0
push 0
lea ecx, [ebp - 0x6b4]
call fcn.10018dda
mov eax, dword [eax]
add eax, 0xd62e652
jne 0x10021925
mov dword [ebp - 0x4ec], 1
jmp 0x1002192c
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x354]
cmp eax, dword [ebp - 0x4ec]
jne 0x10021946
mov dword [ebp - 0x35c], 1
jmp 0x1002194d
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x35c]
neg eax
cmp eax, 0xffffffff
jle 0x1002196a
push 4
pop eax
test eax, eax
jne 0x1002196a
and dword [ebp - 0x620], 0
jmp 0x10021974
mov dword [ebp - 0x620], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x620]
mov dword [ebp + eax - 0x284], ecx
cmp dword [ebp - 0x744], 0
je 0x10021992
jmp 0x10021997
jmp 0x1002189b
jmp 0x10021853
mov dword [ebp - 0x18], 0
jmp 0x100219ac
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xe
jle 0x10021d39
mov dword [ebp - 0x178], 0x67bbda73
mov dword [ebp - 0x5c], 0
jmp 0x100219d0
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x100219e6
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x290], 0x7e3bc4ae
jmp 0x100219c9
mov dword [ebp - 0x5c], 0
jmp 0x100219f6
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x10021a0c
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x274], 0xd413053b
jmp 0x100219ef
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x290], 0xfffffffa
jmp 0x10021a3a
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x290]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x290], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x290], 0xffffffe7
jg 0x10021d34
mov dword [ebp - 0x36c], 0xc0b8072
mov dword [ebp - 0x80], 0xfffffffa
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x284]
mov dword [ebp - 0x9b8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
jne 0x10021b8e
push 2
lea ecx, [ebp - 0x304]
call fcn.10018dda
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x284]
cmp dword [ebp + eax - 0x284], ecx
jg 0x10021abd
mov dword [ebp - 0x364], 1
jmp 0x10021ac4
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x364], eax
jge 0x10021ade
mov dword [ebp - 0x74c], 1
jmp 0x10021ae5
and dword [ebp - 0x74c], 0
push 1
lea ecx, [ebp - 0x304]
call fcn.10018dda
mov eax, dword [ebp - 0x178]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x290]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x284]
test eax, eax
jne 0x10021b31
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x284], 0
jne 0x10021b31
and dword [ebp - 0x4f4], 0
jmp 0x10021b3b
mov dword [ebp - 0x4f4], 1
push 1
lea ecx, [ebp - 0x304]
call fcn.10018dda
mov eax, dword [eax]
neg eax
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x4f4]
lea eax, [ecx + eax - 1]
cmp dword [ebp - 0x36c], eax
jle 0x10021b73
mov dword [ebp - 0x5bc], 1
jmp 0x10021b7a
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x5bc], eax
jg 0x10021b8e
and dword [ebp - 0x4fc], 0
jmp 0x10021b98
mov dword [ebp - 0x4fc], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x290]
mov dword [ebp - 0x374], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x374]
mov dword [ebp + eax - 0x274], ecx
mov eax, dword [ebp - 0x374]
add eax, dword [ebp - 0x4fc]
cmp eax, dword [ebp - 0x80]
jl 0x10021bde
cmp dword [ebp - 0x18], 0
jne 0x10021bde
and dword [ebp - 0x37c], 0
jmp 0x10021be8
mov dword [ebp - 0x37c], 1
mov eax, dword [ebp - 0x80]
imul eax, dword [ebp - 0x37c]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x284]
jl 0x10021c0d
mov dword [ebp - 0x654], 1
jmp 0x10021c14
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x754]
cmp dword [ebp - 0x654], eax
jne 0x10021c35
push 3
pop eax
test eax, eax
je 0x10021c35
mov dword [ebp - 0x384], 1
jmp 0x10021c3c
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x80], eax
push 1
lea ecx, [ebp - 0x304]
call fcn.10018dda
mov esi, eax
push 1
lea ecx, [ebp - 0x304]
call fcn.10018dda
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x10021c73
mov dword [ebp - 0x504], 1
jmp 0x10021c7a
and dword [ebp - 0x504], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x290]
sub eax, dword [ebp - 0x504]
cmp eax, 1
jge 0x10021c9e
mov dword [ebp - 0x38c], 1
jmp 0x10021ca5
and dword [ebp - 0x38c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x274]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0xd9258c0f
je 0x10021cca
mov dword [ebp - 0x5c4], 1
jmp 0x10021cd1
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0x38c]
cmp eax, dword [ebp - 0x5c4]
je 0x10021ceb
mov dword [ebp - 0x394], 1
jmp 0x10021cf2
and dword [ebp - 0x394], 0
push 1
lea ecx, [ebp - 0x304]
call fcn.10018dda
mov ecx, dword [ebp - 0x394]
cmp ecx, dword [eax]
jle 0x10021d15
mov dword [ebp - 0x50c], 1
jmp 0x10021d1c
and dword [ebp - 0x50c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x50c]
mov dword [ebp + eax - 0x274], ecx
jmp 0x10021a1f
jmp 0x100219a5
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x304]
call fcn.10018dbe
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x6b4]
call fcn.10018dbe
movzx eax, byte [0x1067e899]
test eax, eax
je 0x10022a3f
mov ecx, 0x1067e9a8
call fcn.100279d7
movzx eax, al
test eax, eax
jne 0x10022a3f
mov dword [ebp - 0x14], 0xa4a9bdba
push 2
lea ecx, [ebp - 0x6a8]
call fcn.10018d3c
mov byte [ebp - 4], 8
mov dword [ebp - 0x76c], 9
push 1
lea eax, [ebp - 0xe8]
push eax
push 0x4a4e
push 0x664e
lea eax, [ebp - 0x6a8]
push eax
call fcn.1001fa18
add esp, 0x14
mov dword [ebp - 0xe8], 0
jmp 0x10021dd8
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 2
jge 0x10021df4
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0x29c], 0xfffffff6
jmp 0x10021dcb
cmp dword [ebp - 0x14], 0
je 0x10021e27
push 0
call fcn.10020688
pop ecx
mov byte [ebp - 0x6e], 0
movzx eax, byte [ebp - 0x6e]
test eax, eax
je 0x10021e22
push 1
push 0x3a6e
push 0xcb6
call fcn.1001fac2
add esp, 0xc
jmp 0x1002236b
push 3
lea ecx, [ebp - 0x310]
call fcn.10018d3c
mov byte [ebp - 4], 9
lea eax, [ebp - 0x9c0]
push eax
lea eax, [ebp - 0x310]
push eax
push 1
push 0x587b
call fcn.1001fb26
add esp, 0x10
mov dword [ebp - 0x14], 0
jmp 0x10021e65
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jg 0x10021fa7
mov dword [ebp - 0x140], 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x6a8]
call fcn.10018dda
mov esi, eax
push 1
lea ecx, [ebp - 0x310]
call fcn.10018dda
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0x140], 0
jmp 0x10021eb3
mov eax, dword [ebp - 0x140]
dec eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xffffffeb
jl 0x10021fa2
mov dword [ebp - 0x75c], 0x57a6
push dword [ebp - 0x14]
lea ecx, [ebp - 0x6a8]
call fcn.10018dda
push dword [ebp - 0x14]
lea ecx, [ebp - 0x6a8]
call fcn.10018dda
mov esi, eax
push 1
lea ecx, [ebp - 0x310]
call fcn.10018dda
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x10021f07
mov dword [ebp - 0x39c], 1
jmp 0x10021f0e
and dword [ebp - 0x39c], 0
push 0
lea ecx, [ebp - 0x6a8]
call fcn.10018dda
mov eax, dword [eax]
add eax, 0xd62e652
jne 0x10021f30
mov dword [ebp - 0x628], 1
jmp 0x10021f37
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x39c]
cmp eax, dword [ebp - 0x628]
jne 0x10021f51
mov dword [ebp - 0x3a4], 1
jmp 0x10021f58
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x3a4]
neg eax
cmp eax, 0xffffffff
jle 0x10021f75
push 4
pop eax
test eax, eax
jne 0x10021f75
and dword [ebp - 0x514], 0
jmp 0x10021f7f
mov dword [ebp - 0x514], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x514]
mov dword [ebp + eax - 0x29c], ecx
cmp dword [ebp - 0x75c], 0
je 0x10021f9d
jmp 0x10021fa2
jmp 0x10021ea6
jmp 0x10021e5e
mov dword [ebp - 0x14], 0
jmp 0x10021fb7
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xe
jle 0x1002235c
mov dword [ebp - 0x198], 0x67bbda73
mov dword [ebp - 0x58], 0
jmp 0x10021fdb
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x10021ff1
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x2a8], 0x7e3bc4ae
jmp 0x10021fd4
mov dword [ebp - 0x58], 0
jmp 0x10022001
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x10022017
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x2c0], 0xd413053b
jmp 0x10021ffa
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2a8], 0xfffffffa
jmp 0x10022045
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2a8]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2a8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2a8], 0xffffffe7
jg 0x10022357
mov dword [ebp - 0x3b4], 0xc0b8072
mov dword [ebp - 0x88], 0xfffffffa
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x29c]
mov dword [ebp - 0x9c8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
jne 0x100221a2
push 2
lea ecx, [ebp - 0x310]
call fcn.10018dda
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x29c]
cmp dword [ebp + eax - 0x29c], ecx
jg 0x100220cb
mov dword [ebp - 0x3ac], 1
jmp 0x100220d2
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x198]
cmp dword [ebp - 0x3ac], eax
jge 0x100220ec
mov dword [ebp - 0x6c8], 1
jmp 0x100220f3
and dword [ebp - 0x6c8], 0
push 1
lea ecx, [ebp - 0x310]
call fcn.10018dda
mov eax, dword [ebp - 0x198]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x2a8]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x29c]
test eax, eax
jne 0x1002213f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x29c], 0
jne 0x1002213f
and dword [ebp - 0x5cc], 0
jmp 0x10022149
mov dword [ebp - 0x5cc], 1
push 1
lea ecx, [ebp - 0x310]
call fcn.10018dda
mov eax, dword [eax]
neg eax
mov dword [ebp - 0x3b4], eax
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x5cc]
lea eax, [ecx + eax - 1]
cmp dword [ebp - 0x3b4], eax
jle 0x10022184
mov dword [ebp - 0x51c], 1
jmp 0x1002218b
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x51c], eax
jg 0x100221a2
and dword [ebp - 0x664], 0
jmp 0x100221ac
mov dword [ebp - 0x664], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2a8]
mov dword [ebp - 0x3bc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3bc]
mov dword [ebp + eax - 0x2c0], ecx
mov eax, dword [ebp - 0x3bc]
add eax, dword [ebp - 0x664]
cmp eax, dword [ebp - 0x88]
jl 0x100221f5
cmp dword [ebp - 0x14], 0
jne 0x100221f5
and dword [ebp - 0x3c4], 0
jmp 0x100221ff
mov dword [ebp - 0x3c4], 1
mov eax, dword [ebp - 0x88]
imul eax, dword [ebp - 0x3c4]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x29c]
jl 0x10022227
mov dword [ebp - 0x524], 1
jmp 0x1002222e
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x76c]
cmp dword [ebp - 0x524], eax
jne 0x1002224f
push 3
pop eax
test eax, eax
je 0x1002224f
mov dword [ebp - 0x3cc], 1
jmp 0x10022256
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x88], eax
push 1
lea ecx, [ebp - 0x310]
call fcn.10018dda
mov esi, eax
push 1
lea ecx, [ebp - 0x310]
call fcn.10018dda
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x10022290
mov dword [ebp - 0x5d4], 1
jmp 0x10022297
and dword [ebp - 0x5d4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2a8]
sub eax, dword [ebp - 0x5d4]
cmp eax, 1
jge 0x100222bb
mov dword [ebp - 0x3d4], 1
jmp 0x100222c2
and dword [ebp - 0x3d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c0]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xd9258c0f
je 0x100222ed
mov dword [ebp - 0x52c], 1
jmp 0x100222f4
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x3d4]
cmp eax, dword [ebp - 0x52c]
je 0x1002230e
mov dword [ebp - 0x3dc], 1
jmp 0x10022315
and dword [ebp - 0x3dc], 0
push 1
lea ecx, [ebp - 0x310]
call fcn.10018dda
mov ecx, dword [ebp - 0x3dc]
cmp ecx, dword [eax]
jle 0x10022338
mov dword [ebp - 0x630], 1
jmp 0x1002233f
and dword [ebp - 0x630], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x630]
mov dword [ebp + eax - 0x2c0], ecx
jmp 0x1002202a
jmp 0x10021fb0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x310]
call fcn.10018dbe
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x6a8]
call fcn.10018dbe
lea eax, [ebp - 0x5d0]
push eax
lea eax, [ebp - 0x434]
push eax
mov ecx, 0x1067e9a8
call fcn.10018ec2
mov dword [ebp - 0xdc], 0xfffffffc
push 1
lea ecx, [ebp - 0x2f8]
call fcn.10018d3c
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x774], 0xffffffff
push 3
lea ecx, [ebp - 0x7f4]
call fcn.10018d3c
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x784], 0xffffffff
mov dword [ebp - 0x38], 0
jmp 0x100223e2
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x100223fe
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2f8]
call fcn.10018dda
mov dword [eax], 3
jmp 0x100223db
mov dword [ebp - 0x38], 0
jmp 0x1002240e
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x10022424
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x90], 0xdb6084ed
jmp 0x10022407
push 0
lea eax, [ebp - 0x7f4]
push eax
push 0x156e
lea eax, [ebp - 0x38]
push eax
call fcn.100201ef
add esp, 0x10
mov esi, dword [ebp - 0xdc]
push 0
lea ecx, [ebp - 0x2f8]
call fcn.10018dda
mov dword [eax], esi
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x9d0], eax
push 0
lea ecx, [ebp - 0x2f8]
call fcn.10018dda
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x90]
cmp dword [eax], ecx
jg 0x10022489
mov dword [ebp - 0x3e4], 1
jmp 0x10022490
and dword [ebp - 0x3e4], 0
push 0
lea ecx, [ebp - 0x2f8]
call fcn.10018dda
mov ecx, dword [ebp - 0x3e4]
cmp ecx, dword [eax]
jne 0x100224b3
mov dword [ebp - 0x534], 1
jmp 0x100224ba
and dword [ebp - 0x534], 0
cmp dword [ebp - 0x534], 0
je 0x100224df
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x90], 0
je 0x100224df
mov dword [ebp - 0x3ec], 1
jmp 0x100224e6
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x774], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x90], 0x81c1d99e
jb 0x10022511
mov dword [ebp - 0x5dc], 1
jmp 0x10022518
and dword [ebp - 0x5dc], 0
push 0
lea ecx, [ebp - 0x2f8]
call fcn.10018dda
mov ecx, dword [ebp - 0x5dc]
sub ecx, dword [eax]
cmp ecx, 0x64854668
jne 0x10022541
mov dword [ebp - 0x3f4], 1
jmp 0x10022548
and dword [ebp - 0x3f4], 0
push 0
lea ecx, [ebp - 0x2f8]
call fcn.10018dda
mov ecx, dword [ebp - 0x3f4]
sub ecx, dword [eax]
cmp ecx, 0xffff
jne 0x10022571
mov dword [ebp - 0x77c], 1
jmp 0x10022578
and dword [ebp - 0x77c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x90]
mov dword [ebp - 0x9d8], eax
push 0
lea ecx, [ebp - 0x2f8]
call fcn.10018dda
mov eax, dword [eax]
sub eax, dword [ebp - 0xdc]
cmp eax, 0x5520f303
jge 0x100225b3
mov dword [ebp - 0x53c], 1
jmp 0x100225ba
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x53c], eax
jl 0x100225d4
mov dword [ebp - 0x27c], 1
jmp 0x100225db
and dword [ebp - 0x27c], 0
push 0
lea ecx, [ebp - 0x2f8]
call fcn.10018dda
mov ecx, dword [ebp - 0x27c]
mov dword [eax], ecx
cmp dword [ebp - 0x27c], 0
jne 0x1002260b
mov eax, 0xffff
test eax, eax
jne 0x1002260b
and dword [ebp - 0x3fc], 0
jmp 0x10022615
mov dword [ebp - 0x3fc], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3fc]
sub ecx, dword [ebp + eax - 0x90]
je 0x1002263f
cmp dword [ebp - 0xdc], 0
je 0x1002263f
mov dword [ebp - 0x64c], 1
jmp 0x10022646
and dword [ebp - 0x64c], 0
push 1
lea ecx, [ebp - 0x7f4]
call fcn.10018dda
mov ecx, dword [ebp - 0x64c]
cmp ecx, dword [eax]
je 0x10022669
mov dword [ebp - 0x404], 1
jmp 0x10022670
and dword [ebp - 0x404], 0
push 1
lea ecx, [ebp - 0x7f4]
call fcn.10018dda
mov ecx, dword [ebp - 0x404]
cmp ecx, dword [eax]
jne 0x10022693
mov dword [ebp - 0x544], 1
jmp 0x1002269a
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x544]
neg eax
cmp dword [ebp - 0xdc], eax
je 0x100226b6
mov dword [ebp - 0x40c], 1
jmp 0x100226bd
and dword [ebp - 0x40c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x90]
imul eax, dword [ebp - 0x40c]
cmp eax, 0xdeb47635
jbe 0x100226e4
mov dword [ebp - 0x5e4], 1
jmp 0x100226eb
and dword [ebp - 0x5e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x90]
cmp dword [ebp - 0x5e4], eax
jl 0x1002270c
mov dword [ebp - 0x414], 1
jmp 0x10022713
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x784], eax
push 0
lea ecx, [ebp - 0x2f8]
call fcn.10018dda
mov dword [eax], 0xbc35cf45
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x7f4]
call fcn.10018dbe
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2f8]
call fcn.10018dbe
lea eax, [ebp - 0x9e0]
push eax
mov ecx, 0x1067e9a8
call fcn.10018eb4
push eax
lea ecx, [ebp - 0x434]
call fcn.10018ed7
movzx eax, al
test eax, eax
je 0x10022a3f
mov dword [ebp - 0x9e8], 0x845d811f
mov dword [ebp - 0x9f0], 0x662a2b3b
push 3
lea ecx, [ebp - 0x674]
call fcn.10018d3c
mov byte [ebp - 4], 0xc
push 4
lea ecx, [ebp - 0x824]
call fcn.10018d3c
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x78c], 0x8637
push 2
lea ecx, [ebp - 0x80c]
call fcn.10018d3c
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x7d4], 0x40dfe9f4
push 0
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x674]
push eax
call fcn.1002082a
add esp, 0xc
mov dword [ebp - 0xd4], 0
jmp 0x10022804
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 4
jge 0x10022826
push dword [ebp - 0xd4]
lea ecx, [ebp - 0x824]
call fcn.10018dda
mov dword [eax], 0xa927213e
jmp 0x100227f7
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x80c]
push eax
push 0
call fcn.1001fd91
add esp, 0xc
push 3
lea ecx, [ebp - 0x824]
call fcn.10018dda
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x2d0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x2d0]
mov dword [ecx], eax
mov eax, dword [ebp - 0x2d0]
cmp dword [eax], 0
jne 0x1002296d
push 3
lea ecx, [ebp - 0x824]
call fcn.10018dda
push 1
lea ecx, [ebp - 0x80c]
call fcn.10018dda
mov eax, dword [eax]
neg eax
cmp eax, 0x6721f7d
jne 0x100228a2
mov dword [ebp - 0x54c], 1
jmp 0x100228a9
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x78c]
cmp eax, dword [ebp - 0x54c]
je 0x100228d2
push 0
lea ecx, [ebp - 0x674]
call fcn.10018dda
cmp dword [eax], 0
jne 0x100228d2
and dword [ebp - 0x41c], 0
jmp 0x100228dc
mov dword [ebp - 0x41c], 1
push 0
lea ecx, [ebp - 0x674]
call fcn.10018dda
mov ecx, dword [ebp - 0x41c]
imul ecx, dword [eax]
test ecx, ecx
je 0x1002290b
mov eax, 0xfffb
test eax, eax
je 0x1002290b
mov dword [ebp - 0x638], 1
jmp 0x10022912
and dword [ebp - 0x638], 0
push 0
lea ecx, [ebp - 0x674]
call fcn.10018dda
mov ecx, dword [ebp - 0x638]
cmp ecx, dword [eax]
jge 0x10022935
mov dword [ebp - 0x424], 1
jmp 0x1002293c
and dword [ebp - 0x424], 0
cmp dword [ebp - 0x424], 0xa9d9e177
ja 0x10022954
mov dword [ebp - 0x554], 1
jmp 0x1002295b
and dword [ebp - 0x554], 0
cmp dword [ebp - 0x554], 0xfffffffb
jne 0x1002296d
and dword [ebp - 0x42c], 0
jmp 0x10022977
mov dword [ebp - 0x42c], 1
cmp dword [ebp - 0x42c], 1
je 0x1002298c
mov dword [ebp - 0x7cc], 1
jmp 0x10022993
and dword [ebp - 0x7cc], 0
push 1
lea ecx, [ebp - 0x80c]
call fcn.10018dda
mov esi, eax
push 2
lea ecx, [ebp - 0x674]
call fcn.10018dda
mov esi, dword [esi]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x674]
call fcn.10018dda
cmp esi, dword [eax]
jle 0x100229d1
mov dword [ebp - 0x5ec], 1
jmp 0x100229d8
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0x7d4], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x80c]
call fcn.10018dbe
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x824]
call fcn.10018dbe
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x674]
call fcn.10018dbe
lea ecx, [ebp - 0x434]
call fcn.100279e0
mov eax, dword [eax + 4]
mov dword [ebp - 0x6f0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x910]
call fcn.10018b76
mov eax, dword [ebp - 0x6f0]
jmp 0x10025f57
push 2
lea ecx, [ebp - 0x1f0]
call fcn.10018d3c
mov byte [ebp - 4], 0xf
push 2
lea ecx, [ebp - 0x31c]
call fcn.10018d3c
mov byte [ebp - 4], 0x10
mov dword [ebp - 0xec], 0xffffffff
mov dword [ebp - 0x3c], 0
jmp 0x10022a7b
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x10022a94
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1f0]
call fcn.10018dda
and dword [eax], 0
jmp 0x10022a74
mov dword [ebp - 0x3c], 0
jmp 0x10022aa4
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x10022ac0
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x31c]
call fcn.10018dda
mov dword [eax], 0x9f5954e3
jmp 0x10022a9d
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10018dda
mov esi, eax
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10018dda
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x10022afd
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10018dda
cmp dword [eax], 0
jne 0x10022afd
and dword [ebp - 0x70c], 0
jmp 0x10022b07
mov dword [ebp - 0x70c], 1
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10018dda
push 0
lea ecx, [ebp - 0x1f0]
call fcn.10018dda
push 1
lea ecx, [ebp - 0x31c]
call fcn.10018dda
mov esi, eax
push 1
lea ecx, [ebp - 0x31c]
call fcn.10018dda
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x10022b4f
mov dword [ebp - 0x55c], 1
jmp 0x10022b56
and dword [ebp - 0x55c], 0
push 0
lea ecx, [ebp - 0x1f0]
call fcn.10018dda
mov eax, dword [eax]
imul eax, dword [ebp - 0x55c]
test eax, eax
jne 0x10022b82
mov eax, 0x21dd
test eax, eax
jne 0x10022b82
and dword [ebp - 0x43c], 0
jmp 0x10022b8c
mov dword [ebp - 0x43c], 1
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10018dda
mov eax, dword [eax]
imul eax, dword [ebp - 0x43c]
mov dword [ebp - 0x650], eax
push 1
lea ecx, [ebp - 0x31c]
call fcn.10018dda
mov ecx, dword [ebp - 0x650]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10018dda
mov eax, dword [eax]
cmp eax, dword [ebp - 0x650]
jge 0x10022be0
mov dword [ebp - 0x444], 1
jmp 0x10022be7
and dword [ebp - 0x444], 0
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10018dda
mov ecx, dword [ebp - 0x444]
cmp ecx, dword [eax]
jne 0x10022c0a
mov dword [ebp - 0x564], 1
jmp 0x10022c11
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0xec]
add eax, dword [ebp - 0x564]
cmp eax, dword [ebp - 0xec]
jne 0x10022c31
mov dword [ebp - 0x44c], 1
jmp 0x10022c38
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
dec eax
cmp eax, dword [ebp - 0xec]
je 0x10022c53
mov dword [ebp - 0x6ec], 1
jmp 0x10022c5a
and dword [ebp - 0x6ec], 0
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10018dda
cmp dword [eax], 0
je 0x10022df7
mov dword [ebp - 0xc8], 0xfffffff9
mov dword [ebp - 0x6d4], 5
mov dword [ebp - 0x148], 0
jmp 0x10022c9d
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 2
jge 0x10022cb9
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x85c], 0xd2f55126
jmp 0x10022c90
cmp dword [ebp - 0xc8], 0
jne 0x10022cfc
push 1
lea ecx, [ebp - 0x31c]
call fcn.10018dda
cmp dword [ebp - 0xc8], 0
je 0x10022cf3
push 1
lea ecx, [ebp - 0x31c]
call fcn.10018dda
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0xc8], eax
jge 0x10022cfc
and dword [ebp - 0x5f4], 0
jmp 0x10022d06
mov dword [ebp - 0x5f4], 1
cmp dword [ebp - 0x5f4], 0xfff6
je 0x10022d24
push 1
lea ecx, [ebp - 0x1f0]
call fcn.10018dda
cmp dword [eax], 0
jne 0x10022d36
mov eax, 0xffff
test eax, eax
jne 0x10022d36
and dword [ebp - 0x56c], 0
jmp 0x10022d40
mov dword [ebp - 0x56c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x85c]
dec eax
mov dword [ebp - 0x454], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x454]
mov dword [ebp + eax - 0x85c], ecx
mov eax, dword [ebp - 0x454]
cmp eax, dword [ebp - 0x56c]
jle 0x10022d81
mov dword [ebp - 0x45c], 1
jmp 0x10022d88
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x6d4]
cmp dword [ebp - 0xc8], eax
jg 0x10022dae
mov dword [ebp - 0x640], 1
jmp 0x10022db5
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x640], eax
jge 0x10022dcf
mov dword [ebp - 0x464], 1
jmp 0x10022dd6
and dword [ebp - 0x464], 0
push 0
lea ecx, [ebp - 0x31c]
call fcn.10018dda
mov ecx, dword [ebp - 0x464]
mov dword [eax], ecx
mov dword [ebp - 0xec], 0x8d6db9e
jmp 0x10022e3c
mov dword [ebp - 0x288], 0x1ed5297f
mov dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x288]
dec eax
mov dword [ebp - 0x288], eax
lea eax, [ebp - 0x714]
push eax
push 0
lea eax, [ebp - 0x288]
push eax
push 0x469d
lea eax, [ebp - 0x31c]
push eax
call fcn.10020414
add esp, 0x14
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x31c]
call fcn.10018dbe
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1f0]
call fcn.10018dbe
and dword [ebp - 0xe0], 0
lea eax, [ebp - 0x910]
push eax
call fcn.1001ddc7
pop ecx
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jne 0x10025daf
mov dword [ebp - 0xf4], 0x29c1464f
mov dword [ebp - 0x574], 1
mov dword [ebp - 0x474], 0xfffffffe
mov dword [ebp - 0x658], 0
mov dword [ebp - 0x574], 1
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x574], eax
jl 0x10022ecd
mov dword [ebp - 0x46c], 1
jmp 0x10022ed4
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0xf4]
sub eax, dword [ebp - 0x46c]
cmp eax, 0xfffffff6
jbe 0x10022ef1
mov dword [ebp - 0x5fc], 1
jmp 0x10022ef8
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x5fc]
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x474], eax
jl 0x10022f1e
mov dword [ebp - 0x57c], 1
jmp 0x10022f25
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x57c], eax
jle 0x10022f3f
mov dword [ebp - 0x47c], 1
jmp 0x10022f46
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x47c]
inc eax
inc eax
mov dword [ebp - 0x658], eax
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x658], eax
jne 0x10022f8d
mov byte [ebp - 0x70], 0
movzx eax, byte [ebp - 0x70]
test eax, eax
je 0x10022f8b
push 0
push 0x345
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
jmp 0x10022fc9
mov byte [ebp - 0x6f], 0
lea eax, [ebp - 0x6f]
push eax
push 0xa28
push 1
push 0x89a
call fcn.1001fb9c
add esp, 0x10
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x10022fc9
push 0
push 0x6324
call fcn.1002050d
pop ecx
pop ecx
mov dword [ebp - 0x60], 0x9841b3c6
mov dword [ebp - 0x150], 2
mov dword [ebp - 0x49c], 8
mov dword [ebp - 0x71c], 0x888c5540
mov dword [ebp - 0x6e8], 1
mov dword [ebp - 0x724], 0xfffffffd
push 2
lea ecx, [ebp - 0xa50]
call fcn.10018d3c
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x594], 0x1919b17c
mov dword [ebp - 0x40], 0
jmp 0x1002302d
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x10023043
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x6e4], 0xfffffff9
jmp 0x10023026
mov dword [ebp - 0x40], 0
jmp 0x10023053
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1002306f
push dword [ebp - 0x40]
lea ecx, [ebp - 0xa50]
call fcn.10018dda
mov dword [eax], 7
jmp 0x1002304c
mov dword [ebp - 0x60], 0xffffffe4
jmp 0x1002307f
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x19
jne 0x1002329c
mov dword [ebp - 0x484], 0x649b
mov dword [ebp - 0x180], 0
jmp 0x100230ac
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 2
jge 0x100230c8
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x60c], 0xfffb
jmp 0x1002309f
mov dword [ebp - 0x150], 0x9febb674
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x60c], 0
jne 0x1002312e
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x484], eax
jg 0x10023102
mov dword [ebp - 0x2c8], 1
jmp 0x10023109
and dword [ebp - 0x2c8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2c8]
mov dword [ebp + eax - 0x6e4], ecx
cmp dword [ebp - 0x2c8], 0
jne 0x1002312e
and dword [ebp - 0x584], 0
jmp 0x10023138
mov dword [ebp - 0x584], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x60c]
cmp dword [ebp - 0x584], eax
jle 0x10023169
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6e4], 0
je 0x10023169
mov dword [ebp - 0x6dc], 1
jmp 0x10023170
and dword [ebp - 0x6dc], 0
cmp dword [ebp - 0x71c], 0xb357
jge 0x10023188
mov dword [ebp - 0x48c], 1
jmp 0x1002318f
and dword [ebp - 0x48c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x60c]
imul eax, dword [ebp - 0x48c]
cmp eax, dword [ebp - 0x150]
jl 0x100231b7
mov dword [ebp - 0x604], 1
jmp 0x100231be
and dword [ebp - 0x604], 0
cmp dword [ebp - 0x604], 0
je 0x100231d3
mov dword [ebp - 0x494], 1
jmp 0x100231da
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x494], 0x7473
jle 0x100231f2
mov dword [ebp - 0x58c], 1
jmp 0x100231f9
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x6e8]
imul eax, dword [ebp - 0x58c]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x60c]
cmp eax, dword [ebp - 0x60]
jl 0x10023224
mov dword [ebp - 0x648], 1
jmp 0x1002322b
and dword [ebp - 0x648], 0
mov dword [ebp - 0x49c], 0xfffffffb
mov eax, dword [ebp - 0x49c]
cmp eax, dword [ebp - 0x648]
je 0x10023247
cmp dword [ebp - 0x60], 0
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x9f8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x150]
cmp dword [ebp + eax - 0x6e4], ecx
jle 0x10023284
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x60c], 0
je 0x10023284
mov dword [ebp - 0x4a4], 1
jmp 0x1002328b
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x724], eax
jmp 0x10023078
mov eax, dword [ebp - 0x594]
inc eax
mov dword [ebp - 0x594], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xa50]
call fcn.10018dbe
cmp dword [0x1067e8a4], 0
jne 0x10025bb8
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x610], 0x89e022a5
mov dword [ebp - 0x59c], 0xd2cc9105
mov dword [ebp - 0x660], 1
mov dword [ebp - 0x794], 0
mov dword [ebp - 0xa00], 3
mov dword [ebp - 0xa08], 1
mov dword [ebp - 0xa10], 0
mov dword [ebp - 0xa18], 7
mov dword [ebp - 0xa20], 0xb462a77b
mov dword [ebp - 0xa28], 0x883e
mov dword [ebp - 0xa30], 0x5cbf7935
mov dword [ebp - 0xa94], 4
mov dword [ebp - 0xaa0], 6
mov dword [ebp - 0xaa8], 0xfffffff6
mov dword [ebp - 0x6f8], 8
mov dword [ebp - 0x44], 0
jmp 0x10023375
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x1002338b
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x7c0], 0xa29
jmp 0x1002336e
mov dword [ebp - 0x44], 0
jmp 0x1002339b
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x100233b1
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xb6c], 0xc06e3268
jmp 0x10023394
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xab0], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x98]
cmp dword [ebp + eax - 0x7c0], ecx
jne 0x100233de
mov dword [ebp - 0x4ac], 1
jmp 0x100233e5
and dword [ebp - 0x4ac], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4ac]
sub ecx, dword [ebp + eax - 0x7c0]
mov dword [ebp - 0x610], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7c0]
cmp eax, dword [ebp - 0x610]
je 0x1002341f
mov dword [ebp - 0x4b4], 1
jmp 0x10023426
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x59c], eax
jl 0x1002344c
mov dword [ebp - 0x72c], 1
jmp 0x10023453
and dword [ebp - 0x72c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7c0]
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xad0], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x7c0]
cmp dword [ebp - 0x98], eax
jge 0x10023493
mov dword [ebp - 0x4bc], 1
jmp 0x1002349a
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x660], eax
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x660], eax
jne 0x100234c0
mov dword [ebp - 0x4c4], 1
jmp 0x100234c7
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x4c4]
jge 0x100234e1
mov dword [ebp - 0x5a4], 1
jmp 0x100234e8
and dword [ebp - 0x5a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c0]
imul eax, dword [ebp - 0x5a4]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x7c0]
jge 0x10023517
mov dword [ebp - 0x4cc], 1
jmp 0x1002351e
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x4cc]
sub eax, 0x4a71b966
mov dword [ebp - 0x794], eax
push 1
lea eax, [ebp - 0x6f8]
push eax
call fcn.1001fc14
pop ecx
pop ecx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0xa0], 0xd6273d59
mov dword [ebp - 0xad8], 0
mov dword [ebp - 0xae0], 0x87b3
push 0x7313
push 0x6931
push 0x2558
push 0x1b1f
push 0x243a
push 0x6ad1
push 0x335
push 1
lea eax, [ebp - 0x20]
push eax
push 0x8a1
push 0x3f4c
call fcn.1001fc46
add esp, 0x2c
mov dword [ebp - 0x20], 0
jmp 0x100235af
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x39
jge 0x1002378a
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x1a8], 0
jmp 0x100235d9
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 4
jge 0x100235f5
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0xb10], 0xffffffff
jmp 0x100235cc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xae8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb10], 1
jge 0x1002361a
mov dword [ebp - 0x778], 1
jmp 0x10023621
and dword [ebp - 0x778], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb10]
mov dword [ebp - 0xaf0], eax
cmp dword [ebp - 0x20], 0xa516
jl 0x1002364c
cmp dword [ebp - 0x20], 0
jne 0x1002364c
and dword [ebp - 0x618], 0
jmp 0x10023656
mov dword [ebp - 0x618], 1
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x618], eax
jl 0x1002366d
mov dword [ebp - 0x324], 1
jmp 0x10023674
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x324]
cmp eax, dword [ebp - 0x20]
jg 0x1002368e
mov dword [ebp - 0x328], 1
jmp 0x10023695
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x20], eax
jg 0x100236c3
push 0
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.1001ff6c
add esp, 0xc
jmp 0x100236f6
mov dword [ebp - 0x48], 0
jmp 0x100236d3
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jg 0x100236f6
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x100236f4
push 0
push 0x241f
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x100236cc
mov dword [ebp - 0x48], 0x15
jmp 0x10023706
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xf
jg 0x10023785
mov dword [ebp - 0x700], 0x585fafe4
mov dword [ebp - 0xa0], 0xffffffe9
jmp 0x1002372f
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xfffffff5
jge 0x10023780
mov dword [ebp - 0xabc], 0x18bc698d
mov byte [ebp - 0xbe], 0
movzx eax, byte [ebp - 0xbe]
test eax, eax
je 0x10023768
push 0x3798
push 0x899
push 1
call fcn.1001fd91
add esp, 0xc
push 0x1633
push 0
lea eax, [ebp - 0x700]
push eax
call fcn.10020b29
add esp, 0xc
jmp 0x10023722
jmp 0x100236ff
jmp 0x100235a8
mov dword [ebp - 0x6c4], 0xa5d6c05b
mov dword [ebp - 0x6c0], 0xa5d6c05b
mov dword [ebp - 0x6bc], 0xa5d6c05b
mov dword [ebp - 0x6b8], 0xa5d6c05b
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x2a0], 0x966ef3b0
mov dword [ebp - 0x2d8], 0xc98aac1e
mov dword [ebp - 0x780], 0xffffffff
mov dword [ebp - 0xac4], 9
mov dword [ebp - 0x158], 0
jmp 0x10023804
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 3
jge 0x10023820
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0xba4], 0xf903a798
jmp 0x100237f7
mov dword [ebp - 0x24], 0
jmp 0x10023830
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x10023a75
mov dword [ebp - 0x708], 4
mov dword [ebp - 0x188], 0
jmp 0x1002385d
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 2
jge 0x10023879
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0x2b4], 0
jmp 0x10023850
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2b4], 3
jmp 0x100238a7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2b4]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2b4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2b4], 0
jl 0x10023a70
mov dword [ebp - 0x160], 0
jmp 0x100238d4
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 1
jge 0x100238f0
mov eax, dword [ebp - 0x160]
mov dword [ebp + eax*4 - 0x798], 0xd49598aa
jmp 0x100238c7
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x6c4]
mov dword [ebp - 0x95c], eax
cmp dword [ebp - 0x24], 0
jne 0x10023916
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x798], 0
je 0x10023994
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2b4]
mov dword [ebp - 0xa14], eax
mov eax, 0xf4039ee4
test eax, eax
jb 0x1002393e
mov dword [ebp - 0x330], 1
jmp 0x10023945
and dword [ebp - 0x330], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x6c4]
cmp dword [ebp - 0x330], eax
jl 0x10023966
mov dword [ebp - 0x338], 1
jmp 0x1002396d
and dword [ebp - 0x338], 0
imul eax, dword [ebp - 0x338], 3
test eax, eax
je 0x10023988
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2b4], 0
je 0x10023994
mov dword [ebp - 0x340], 1
jmp 0x1002399b
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jne 0x100239c6
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x6c4], 0
jne 0x100239c6
and dword [ebp - 0x348], 0
jmp 0x100239d0
mov dword [ebp - 0x348], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6c4]
cmp dword [ebp - 0x348], eax
jl 0x100239f1
mov dword [ebp - 0x350], 1
jmp 0x100239f8
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x2a0], eax
imul eax, dword [ebp - 0x2a0], 0xe6a4
cmp eax, 0x1dd2e91c
jge 0x10023a21
mov dword [ebp - 0x358], 1
jmp 0x10023a28
and dword [ebp - 0x358], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6c4]
imul eax, dword [ebp - 0x358]
mov dword [ebp - 0x2d8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2b4]
mov dword [ebp - 0xacc], eax
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x964], eax
mov dword [ebp - 0x708], 0x8fc5674f
jmp 0x1002388c
jmp 0x10023829
mov dword [ebp - 0x24], 0
jmp 0x10023a85
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x10023d2c
mov dword [ebp - 0x2e0], 0
mov dword [ebp - 0x11c], 6
mov dword [ebp - 0x1a0], 0
jmp 0x10023abc
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 1
jge 0x10023ad8
mov eax, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0x124], 0x123020f6
jmp 0x10023aaf
push 4
pop eax
imul eax, eax, 0
mov ecx, 0x1c8
sub ecx, dword [ebp + eax - 0x124]
jne 0x10023b30
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x124], 0x9150040b
jne 0x10023b0b
mov dword [ebp - 0x360], 1
jmp 0x10023b12
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0
jne 0x10023b30
and dword [ebp - 0x368], 0
jmp 0x10023b3a
mov dword [ebp - 0x368], 1
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
je 0x10023bde
mov dword [ebp - 0x294], 0xfffffffd
push 4
lea ecx, [ebp - 0x8ec]
call fcn.10018d3c
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x168], 0
jmp 0x10023b87
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 4
jge 0x10023ba9
push dword [ebp - 0x168]
lea ecx, [ebp - 0x8ec]
call fcn.10018dda
mov dword [eax], 0x7903899
jmp 0x10023b7a
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x294], eax
mov esi, dword [ebp - 0x294]
push 2
lea ecx, [ebp - 0x8ec]
call fcn.10018dda
mov dword [eax], esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x8ec]
call fcn.10018dbe
jmp 0x10023d14
mov dword [ebp - 0x380], 0xffffffff
mov dword [ebp - 0x710], 0x20245597
mov dword [ebp - 0x388], 0x2f725dc8
mov dword [ebp - 0x2ac], 0x46fac5ad
push 1
push 0x7472
call fcn.1001fdf8
pop ecx
pop ecx
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0xa1c], eax
mov eax, 0x266c0953
test eax, eax
je 0x10023cc0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x124], 0
jne 0x10023c52
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x10023c78
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x96c], eax
mov eax, dword [ebp - 0x388]
cmp dword [ebp - 0x2a0], eax
je 0x10023c78
mov dword [ebp - 0x370], 1
jmp 0x10023c7f
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x710]
cmp dword [ebp - 0x370], eax
jne 0x10023c99
mov dword [ebp - 0x378], 1
jmp 0x10023ca0
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x378]
sub eax, dword [ebp - 0x380]
cmp eax, dword [ebp - 0x388]
jg 0x10023cc0
mov dword [ebp - 0x390], 1
jmp 0x10023cc7
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x7a0], eax
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x7a0], 8
ja 0x10023d01
mov dword [ebp - 0x398], 1
jmp 0x10023d08
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x11c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x124]
mov dword [ebp - 0x11c], eax
jmp 0x10023a7e
mov byte [ebp - 0x1e4], 6
mov byte [ebp - 0x1e3], 0x54
mov byte [ebp - 0x1e2], 5
mov byte [ebp - 0x1e1], 0x5f
mov byte [ebp - 0x1e0], 2
mov byte [ebp - 0x1df], 0x1e
mov byte [ebp - 0x1de], 7
mov byte [ebp - 0x1dd], 0x40
mov byte [ebp - 0x1dc], 9
mov byte [ebp - 0x1db], 0x56
mov byte [ebp - 0x1da], 0xa
mov byte [ebp - 0x1d9], 8
mov byte [ebp - 0x1d8], 0
mov byte [ebp - 0x1d7], 0x27
mov byte [ebp - 0x1d6], 0x14
mov byte [ebp - 0x1d5], 0xe7
mov byte [ebp - 0x1d4], 0x7d
mov byte [ebp - 0x1d3], 0x21
mov byte [ebp - 0x1d2], 0x58
mov byte [ebp - 0x1d1], 0xa8
mov byte [ebp - 0x1d0], 0x7c
mov byte [ebp - 0x1cf], 0x85
mov byte [ebp - 0x1ce], 0x26
mov byte [ebp - 0x1cd], 0xed
mov byte [ebp - 0x1cc], 0xb6
mov byte [ebp - 0x1cb], 0xed
mov byte [ebp - 0x1ca], 0x11
mov byte [ebp - 0x1c9], 0x20
mov byte [ebp - 0x1c8], 0x48
mov byte [ebp - 0x1c7], 0x46
mov byte [ebp - 0x1c6], 0x49
mov byte [ebp - 0x1c5], 0x7f
mov byte [ebp - 0x1c4], 0x35
mov byte [ebp - 0x1c3], 0x7c
mov byte [ebp - 0x1c2], 0xd4
mov byte [ebp - 0x1c1], 4
mov byte [ebp - 0x1c0], 0x2e
mov byte [ebp - 0x1bf], 0xb
mov byte [ebp - 0x1be], 9
mov byte [ebp - 0x1bd], 3
mov byte [ebp - 0x1bc], 2
mov byte [ebp - 0x1bb], 1
mov byte [ebp - 0x1ba], 0xb
mov byte [ebp - 0x1b9], 8
mov byte [ebp - 0x1b8], 0x4b
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0x718], 0xfffffffd
push 3
lea ecx, [ebp - 0x83c]
call fcn.10018d3c
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x134], 0
jmp 0x10023eac
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 3
jge 0x10023ecb
push dword [ebp - 0x134]
lea ecx, [ebp - 0x83c]
call fcn.10018dda
and dword [eax], 0
jmp 0x10023e9f
mov dword [ebp - 0x64], 0xfffffffa
jmp 0x10023edb
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x1c
jle 0x10023f6f
mov dword [ebp - 0x878], 0x25b0e446
mov dword [ebp - 0x874], 0x25b0e446
mov dword [ebp - 0x870], 0x25b0e446
mov dword [ebp - 0x86c], 0x25b0e446
lea ecx, [ebp - 0x2c1]
call fcn.100092b3
push eax
lea eax, [ebp - 0x868]
push eax
lea eax, [ebp - 0x878]
push eax
lea ecx, [ebp - 0xb2c]
call fcn.10018de9
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa60]
call fcn.10018d98
mov byte [ebp - 4], 0x14
push 1
lea ecx, [ebp - 0xa60]
call fcn.10018dda
mov eax, dword [eax]
mov dword [ebp - 0xfc], eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xa60]
call fcn.10018dbe
jmp 0x10023ed4
cmp dword [ebp - 0xfc], 0
jne 0x10023f7c
xor eax, eax
je 0x10023f8e
cmp dword [ebp - 0x64], 0
je 0x10023f8e
mov dword [ebp - 0x3a0], 1
jmp 0x10023f95
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x3a0], eax
jg 0x10023fac
mov dword [ebp - 0x3a8], 1
jmp 0x10023fb3
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x3a8], eax
je 0x10023fca
mov dword [ebp - 0x3b0], 1
jmp 0x10023fd1
and dword [ebp - 0x3b0], 0
cmp dword [ebp - 0x3b0], 7
jg 0x10023fe6
mov dword [ebp - 0x3b8], 1
jmp 0x10023fed
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0xfc]
sub eax, dword [ebp - 0x3b8]
cmp dword [ebp - 0x64], eax
je 0x1002400a
mov dword [ebp - 0x3c0], 1
jmp 0x10024011
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x3c0]
neg eax
cmp eax, 0xa5b7
jne 0x1002402c
mov dword [ebp - 0x3c8], 1
jmp 0x10024033
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x718]
cmp dword [ebp - 0x3c8], eax
jl 0x1002404d
mov dword [ebp - 0x3d0], 1
jmp 0x10024054
and dword [ebp - 0x3d0], 0
push 2
lea ecx, [ebp - 0x83c]
call fcn.10018dda
mov ecx, dword [ebp - 0x3d0]
cmp ecx, dword [eax]
jne 0x10024077
mov dword [ebp - 0x3d8], 1
jmp 0x1002407e
and dword [ebp - 0x3d8], 0
push 2
lea ecx, [ebp - 0x83c]
call fcn.10018dda
mov ecx, dword [ebp - 0x3d8]
imul ecx, dword [eax]
sub ecx, dword [ebp - 0xfc]
mov dword [ebp - 0xfc], ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x83c]
call fcn.10018dbe
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1e4]
or eax, 0x67
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1e4]
and ecx, 0x67
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x1e4]
mov word [ebp + ecx*2 - 0x950], ax
mov dword [ebp - 0x1c], 2
and dword [ebp - 0x110], 0
jmp 0x10024101
mov eax, dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2d
jae 0x10024a33
mov dword [ebp - 0xa8], 0xfffffff7
mov dword [ebp - 0x30], 0xfffffffd
push 1
lea ecx, [ebp - 0x68c]
call fcn.10018d3c
mov byte [ebp - 4], 0x15
mov dword [ebp - 0xe4], 7
mov dword [ebp - 0x468], 6
mov dword [ebp - 0x4c], 0
jmp 0x10024151
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1002416d
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x68c]
call fcn.10018dda
mov dword [eax], 0x6986d6d
jmp 0x1002414a
mov dword [ebp - 0x4c], 0
jmp 0x1002417d
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x10024193
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x854], 0xffffffff
jmp 0x10024176
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0x30], 0
je 0x10024252
cmp dword [ebp - 0x30], 0
jne 0x100241e6
cmp dword [ebp - 0x30], 0
je 0x100241c8
cmp dword [ebp - 0x30], 0
je 0x100241c8
mov dword [ebp - 0x320], 1
jmp 0x100241cf
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x320], eax
je 0x100241e6
mov dword [ebp - 0x3e8], 1
jmp 0x100241ed
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x3e8], eax
jle 0x10024204
mov dword [ebp - 0x3f0], 1
jmp 0x1002420b
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x3f0], eax
jg 0x10024222
mov dword [ebp - 0x3f8], 1
jmp 0x10024229
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x30], eax
mov esi, dword [ebp - 0x30]
push 0
lea ecx, [ebp - 0x68c]
call fcn.10018dda
sub esi, dword [eax]
je 0x10024252
mov dword [ebp - 0x400], 1
jmp 0x10024259
and dword [ebp - 0x400], 0
cmp dword [ebp - 0x400], 0
jge 0x1002426e
mov dword [ebp - 0x408], 1
jmp 0x10024275
and dword [ebp - 0x408], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x854]
cmp dword [ebp - 0x408], eax
je 0x10024295
mov dword [ebp - 0x410], 1
jmp 0x1002429c
and dword [ebp - 0x410], 0
cmp dword [ebp - 0x410], 0x4562
jne 0x100242bd
mov eax, 0x2a4b15d3
test eax, eax
je 0x100242bd
mov dword [ebp - 0x418], 1
jmp 0x100242c4
and dword [ebp - 0x418], 0
cmp dword [ebp - 0x418], 0
jae 0x100242d9
mov dword [ebp - 0x420], 1
jmp 0x100242e0
and dword [ebp - 0x420], 0
cmp dword [ebp - 0x420], 0x9730
jne 0x100242f8
mov dword [ebp - 0x428], 1
jmp 0x100242ff
and dword [ebp - 0x428], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x854]
cmp dword [ebp - 0x428], eax
je 0x1002431f
mov dword [ebp - 0x430], 1
jmp 0x10024326
and dword [ebp - 0x430], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x854]
imul eax, dword [ebp - 0x430]
test eax, eax
jne 0x1002434f
cmp dword [ebp - 0xe4], 0
jne 0x1002434f
and dword [ebp - 0x438], 0
jmp 0x10024359
mov dword [ebp - 0x438], 1
cmp dword [ebp - 0x438], 0xa67f
jg 0x10024371
mov dword [ebp - 0x2d4], 1
jmp 0x10024378
and dword [ebp - 0x2d4], 0
push 0
lea ecx, [ebp - 0x68c]
call fcn.10018dda
mov ecx, dword [ebp - 0x2d4]
mov dword [eax], ecx
cmp dword [ebp - 0x2d4], 0
je 0x100243ca
mov dword [ebp - 0xe4], 0
jmp 0x100243af
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0x1d
jl 0x100243c5
cmp dword [ebp - 0xa8], 0
je 0x100243c3
jmp 0x100243c5
jmp 0x100243a2
jmp 0x1002456a
mov dword [ebp - 0xd0], 0xcedda565
mov dword [ebp - 0x13c], 0x133ecb4
mov dword [ebp - 0x788], 0xffffffff
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x974], eax
push 0
lea ecx, [ebp - 0x68c]
call fcn.10018dda
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x13c], eax
jge 0x10024439
cmp dword [ebp - 0x13c], 0
je 0x10024439
mov dword [ebp - 0x440], 1
jmp 0x10024440
and dword [ebp - 0x440], 0
imul eax, dword [ebp - 0x440], 0x9b4c
cmp eax, dword [ebp - 0xd0]
jne 0x10024467
cmp dword [ebp - 0xa8], 0
je 0x10024467
mov dword [ebp - 0x448], 1
jmp 0x1002446e
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0xd0]
add eax, dword [ebp - 0x448]
cmp eax, dword [ebp - 0xa8]
jge 0x1002448e
mov dword [ebp - 0x450], 1
jmp 0x10024495
and dword [ebp - 0x450], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x854]
add eax, dword [ebp - 0x450]
imul eax, dword [ebp - 0xd0]
test eax, eax
jle 0x100244be
mov dword [ebp - 0x458], 1
jmp 0x100244c5
and dword [ebp - 0x458], 0
push 0
lea ecx, [ebp - 0x68c]
call fcn.10018dda
mov ecx, dword [ebp - 0x458]
cmp ecx, dword [eax]
jne 0x100244ee
mov eax, 0xfecf47a0
test eax, eax
jne 0x100244ee
and dword [ebp - 0x460], 0
jmp 0x100244f8
mov dword [ebp - 0x460], 1
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x468], eax
jg 0x1002451e
mov dword [ebp - 0x470], 1
jmp 0x10024525
and dword [ebp - 0x470], 0
mov esi, dword [ebp - 0xd0]
add esi, dword [ebp - 0x470]
push 0
lea ecx, [ebp - 0x68c]
call fcn.10018dda
sub esi, dword [eax]
cmp esi, 1
jbe 0x10024551
mov dword [ebp - 0x478], 1
jmp 0x10024558
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0xd0]
add eax, dword [ebp - 0x478]
mov dword [ebp - 0x788], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x68c]
call fcn.10018dbe
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1e4]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x1c], eax
jne 0x100246fa
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x1e4]
inc eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x14c], 0xffffffff
mov dword [ebp - 0x954], 0x35f394a2
mov dword [ebp - 0x97c], 0x15747814
mov dword [ebp - 0xaec], 0xfffffffc
mov dword [ebp - 0x984], 0x60f7e730
mov dword [ebp - 0xa2c], 0xd7d711e7
mov dword [ebp - 0x98c], 0xcff8ee1d
mov dword [ebp - 0x720], 0xffff
mov dword [ebp - 0x144], 0
jmp 0x1002460f
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 2
jge 0x1002462b
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0xb64], 0
jmp 0x10024602
mov dword [ebp - 0x14c], 0
jmp 0x10024644
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0x1b
je 0x10024670
mov dword [ebp - 0xaac], 0x31d83293
mov dword [ebp - 0x480], 0x6715f0ed
mov eax, dword [ebp - 0x480]
dec eax
mov dword [ebp - 0x480], eax
jmp 0x10024637
lea eax, [ebp - 0x720]
push eax
push 0x568c
push 1
call fcn.1001fe39
add esp, 0xc
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x1e4]
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x1c], eax
push 4
lea ecx, [ebp - 0x928]
call fcn.10018d3c
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x7a8], 0
push 1
lea eax, [ebp - 0x994]
push eax
lea eax, [ebp - 0x928]
push eax
call fcn.1001fe7d
add esp, 0xc
push 1
lea eax, [ebp - 0x7a8]
push eax
lea eax, [ebp - 0x928]
push eax
call fcn.1001fee7
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x928]
call fcn.10018dbe
jmp 0x100240f9
mov dword [ebp - 0x15c], 0xffffffff
or dword [ebp - 0x88c], 0xffffffff
or dword [ebp - 0x888], 0xffffffff
or dword [ebp - 0x884], 0xffffffff
or dword [ebp - 0x880], 0xffffffff
lea ecx, [ebp - 0x275]
call fcn.100092b3
push eax
lea eax, [ebp - 0x87c]
push eax
lea eax, [ebp - 0x88c]
push eax
lea ecx, [ebp - 0xb74]
call fcn.10018de9
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x830]
call fcn.10018d98
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x154], 0x6ce4a6f4
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x4d0], 0xffffffff
push 0
push 0x3b25
call fcn.10020adc
pop ecx
pop ecx
mov eax, dword [ebp - 0x15c]
neg eax
jne 0x10024914
push 3
lea ecx, [ebp - 0x830]
call fcn.10018dda
mov eax, dword [eax]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0xa34], eax
mov dword [ebp - 0x154], 0xfff6
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x99c], eax
mov eax, 0x2afa
test eax, eax
je 0x100247e8
cmp dword [ebp - 0x154], 0
je 0x100247e8
mov dword [ebp - 0x488], 1
jmp 0x100247ef
and dword [ebp - 0x488], 0
push 3
lea ecx, [ebp - 0x830]
call fcn.10018dda
mov ecx, dword [ebp - 0x488]
cmp ecx, dword [eax]
jle 0x10024812
mov dword [ebp - 0x490], 1
jmp 0x10024819
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x490], eax
jge 0x10024833
mov dword [ebp - 0x498], 1
jmp 0x1002483a
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0x498], eax
jg 0x1002485d
cmp dword [ebp - 0x15c], 0
je 0x1002485d
mov dword [ebp - 0x4a0], 1
jmp 0x10024864
and dword [ebp - 0x4a0], 0
cmp dword [ebp - 0x4a0], 0x73d5
jne 0x1002488c
cmp dword [ebp - 0x2b8], 0
je 0x1002488c
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x1002488c
and dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x4a8], 0xfffffffc
jne 0x100248a8
mov dword [ebp - 0x4b0], 1
jmp 0x100248af
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x4d0]
cmp dword [ebp - 0x4b0], eax
jne 0x100248c9
mov dword [ebp - 0x4c8], 1
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x4d0], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x830]
call fcn.10018dbe
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x1e3]
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x110]
movzx ecx, byte [ebp + ecx - 0x1e6]
movzx ecx, word [ebp + ecx*2 - 0x950]
or eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x1e3]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x110]
movzx edx, byte [ebp + edx - 0x1e6]
movzx edx, word [ebp + edx*2 - 0x950]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x1e4]
mov word [ebp + ecx*2 - 0x950], ax
mov dword [ebp - 0x164], 5
mov dword [ebp - 0x164], 0
jmp 0x100249bd
mov eax, dword [ebp - 0x164]
dec eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0xfffffffd
jl 0x10024a27
mov dword [ebp - 0x104], 0x8e5ccc90
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x100249f6
push 1
push 0x4cc9
push 0x1af1
call fcn.1001ff6c
add esp, 0xc
mov dword [ebp - 0x104], 0
jmp 0x10024a0f
cmp dword [ebp - 0x104], 0xffffffed
je 0x10024a25
cmp dword [ebp - 0x104], 0
je 0x10024a23
jmp 0x10024a25
jmp 0x10024a02
jmp 0x100249b0
and dword [ebp - 0x110], 0
jmp 0x100240f9
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0x950], cx
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x26c], 0xd9e177c4
mov dword [ebp - 0x738], 0
lea eax, [ebp - 0x2c]
push eax
push 0x4d73
push 0x163c
push 1
call fcn.1001ffaa
add esp, 0x10
mov dword [ebp - 0x2c], 0
jmp 0x10024a86
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffff3
je 0x10024d08
mov dword [ebp - 0x8a0], 0x62a2
mov dword [ebp - 0x89c], 0x62a2
mov dword [ebp - 0x898], 0x62a2
mov dword [ebp - 0x894], 0x62a2
lea ecx, [ebp - 0x2d9]
call fcn.100092b3
push eax
lea eax, [ebp - 0x890]
push eax
lea eax, [ebp - 0x8a0]
push eax
lea ecx, [ebp - 0xb5c]
call fcn.10018de9
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x680]
call fcn.10018d98
mov byte [ebp - 4], 0x18
push 3
lea ecx, [ebp - 0x91c]
call fcn.10018d3c
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x16c], 0
jmp 0x10024b1b
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 3
jge 0x10024b3d
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x91c]
call fcn.10018dda
mov dword [eax], 3
jmp 0x10024b0e
cmp dword [ebp - 0x2c], 0
jne 0x10024b52
cmp dword [ebp - 0x2c], 0
jne 0x10024b52
and dword [ebp - 0x728], 0
jmp 0x10024b5c
mov dword [ebp - 0x728], 1
cmp dword [ebp - 0x2c], 0xffff8d28
jg 0x10024b71
mov dword [ebp - 0x4d8], 1
jmp 0x10024b78
and dword [ebp - 0x4d8], 0
push 2
lea ecx, [ebp - 0x680]
call fcn.10018dda
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [eax]
jne 0x10024b9b
mov dword [ebp - 0x4e0], 1
jmp 0x10024ba2
and dword [ebp - 0x4e0], 0
cmp dword [ebp - 0x4e0], 8
jge 0x10024bba
cmp dword [ebp - 0x2c], 0
jne 0x10024bba
and dword [ebp - 0x790], 0
jmp 0x10024bc4
mov dword [ebp - 0x790], 1
cmp dword [ebp - 0x2c], 1
jne 0x10024bd6
mov dword [ebp - 0x4e8], 1
jmp 0x10024bdd
and dword [ebp - 0x4e8], 0
cmp dword [ebp - 0x4e8], 0x223d
jge 0x10024bf5
mov dword [ebp - 0x4f0], 1
jmp 0x10024bfc
and dword [ebp - 0x4f0], 0
push 2
lea ecx, [ebp - 0x680]
call fcn.10018dda
mov ecx, dword [ebp - 0x4f0]
imul ecx, dword [eax]
mov dword [ebp - 0x26c], ecx
cmp dword [ebp - 0x26c], 0
je 0x10024c36
mov eax, 0x5fba2522
test eax, eax
je 0x10024c36
mov dword [ebp - 0x4f8], 1
jmp 0x10024c3d
and dword [ebp - 0x4f8], 0
imul esi, dword [ebp - 0x4f8], 0xffff
push 2
lea ecx, [ebp - 0x680]
call fcn.10018dda
cmp esi, dword [eax]
jg 0x10024c64
mov dword [ebp - 0x730], 1
jmp 0x10024c6b
and dword [ebp - 0x730], 0
push 2
lea ecx, [ebp - 0x680]
call fcn.10018dda
push 2
lea ecx, [ebp - 0x680]
call fcn.10018dda
push 7
pop eax
test eax, eax
je 0x10024cc9
mov dword [ebp - 0x7b0], 0x867f5d1c
lea eax, [ebp - 0x7b0]
push eax
lea eax, [ebp - 0x738]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x680]
push eax
lea eax, [ebp - 0x91c]
push eax
lea eax, [ebp - 0x26c]
push eax
push 1
call fcn.10020044
add esp, 0x1c
jmp 0x10024ce5
mov byte [ebp - 0x79], 0
push 0xe2c
push 0x4380
push 1
lea eax, [ebp - 0x79]
push eax
call fcn.10020171
add esp, 0x10
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x91c]
call fcn.10018dbe
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x680]
call fcn.10018dbe
jmp 0x10024a7f
lea eax, [ebp - 0x950]
push eax
lea ecx, [ebp - 0xb98]
call fcn.10027929
mov dword [ebp - 0x7c4], eax
mov eax, dword [ebp - 0x7c4]
mov dword [ebp - 0x740], eax
mov byte [ebp - 4], 0x1a
push dword [ebp - 0x740]
call fcn.1001ddc7
pop ecx
mov dword [ebp - 0x5b0], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xb98]
call fcn.10018b76
mov dword [ebp - 0x54], 3
mov dword [ebp - 0xb0], 0xdc0e3e76
mov dword [ebp - 0x270], 1
mov dword [ebp - 0x748], 0xc56d
mov dword [ebp - 0x7d0], 3
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xad4], eax
push 4
pop eax
sub eax, dword [ebp - 0x54]
cmp dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x54], eax
jle 0x10024da6
mov dword [ebp - 0x500], 1
jmp 0x10024dad
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x500]
cmp eax, dword [ebp - 0x54]
jl 0x10024dc8
mov dword [ebp - 0x508], 1
jmp 0x10024dcf
and dword [ebp - 0x508], 0
cmp dword [ebp - 0x508], 0x47bb7ab6
jne 0x10024de7
mov dword [ebp - 0x510], 1
jmp 0x10024dee
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jne 0x10024e21
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x9a4], eax
cmp dword [ebp - 0xb0], 0
jne 0x10024e21
and dword [ebp - 0x518], 0
jmp 0x10024e2b
mov dword [ebp - 0x518], 1
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x518]
jge 0x10024e42
mov dword [ebp - 0x520], 1
jmp 0x10024e49
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x520], eax
jl 0x10024e60
mov dword [ebp - 0x528], 1
jmp 0x10024e67
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x270]
cmp dword [ebp - 0x528], eax
jl 0x10024e81
mov dword [ebp - 0x79c], 1
jmp 0x10024e88
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xa44], eax
xor eax, eax
inc eax
je 0x10024ee6
mov byte [ebp - 0x81], 0
push 1
push 0x24fe
lea eax, [ebp - 0x81]
push eax
push 0x2173
call fcn.100201ef
add esp, 0x10
mov byte [ebp - 0xbf], 0
movzx eax, byte [ebp - 0xbf]
test eax, eax
je 0x10024ee1
push 1
push 0x79de
push 0x1c3b
call fcn.1002026c
add esp, 0xc
jmp 0x10024fa8
mov dword [ebp - 0x750], 0xffffffff
mov dword [ebp - 0x174], 0
jmp 0x10024f09
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 2
jge 0x10024f25
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x864], 0
jmp 0x10024efc
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x864]
mov dword [ebp - 0x9ac], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x748]
cmp dword [ebp + eax - 0x864], ecx
jge 0x10024f5f
cmp dword [ebp - 0x7d0], 0
jne 0x10024f5f
and dword [ebp - 0x530], 0
jmp 0x10024f69
mov dword [ebp - 0x530], 1
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x530]
sub eax, dword [ebp - 0x270]
cmp dword [ebp - 0xb0], eax
jle 0x10024f95
mov dword [ebp - 0x538], 1
jmp 0x10024f9c
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x750], eax
and dword [ebp - 0x17c], 0
jmp 0x10024fbe
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0xd
jae 0x10024fd9
xor eax, eax
mov ecx, dword [ebp - 0x17c]
mov word [ebp + ecx*2 - 0x950], ax
jmp 0x10024fb1
mov dword [ebp - 0xab4], 0xd33a4a9b
mov byte [ebp - 0x6d], 0
movzx eax, byte [ebp - 0x6d]
test eax, eax
je 0x10025008
push 0x7499
push 0x4a8e
push 0
push 0x5ffd
call fcn.10027701
add esp, 0x10
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x10025022
push 1
call fcn.100202b8
pop ecx
cmp dword [ebp - 0x5b0], 0
je 0x10025bb8
mov dword [ebp - 0x28], 0x96dd1e1e
mov dword [ebp - 0x6c], 5
mov dword [ebp - 0x9b4], 0xb8846b51
mov dword [ebp - 0x184], 0
jmp 0x10025060
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 1
jge 0x1002507c
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x10c], 0
jmp 0x10025053
mov dword [ebp - 0x28], 0
jmp 0x1002508c
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x100250c6
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp + ecx*4 - 0x10c]
cmp dword [ebp + eax*4 - 0x10c], ecx
jge 0x100250b4
mov dword [ebp - 0x540], 1
jmp 0x100250bb
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0x6c], eax
jmp 0x10025085
mov dword [ebp - 0x6c], 0
jmp 0x100250d6
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jg 0x10025235
mov dword [ebp - 0x550], 0xffffffff
mov dword [ebp - 0x570], 0xf553
mov dword [ebp - 0x758], 0x80335900
mov eax, dword [ebp - 0x6c]
cmp dword [ebp + eax*4 - 0x10c], 0
je 0x10025110
jmp 0x10025235
mov dword [ebp - 0x28], 0
jmp 0x10025120
cmp dword [ebp - 0x28], 0
jl 0x10025230
mov dword [ebp - 0x7a4], 0x360de574
mov eax, 0xfffb
test eax, eax
je 0x10025152
cmp dword [ebp - 0x7a4], 0
je 0x10025152
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp + eax*4 - 0x10c]
mov ecx, dword [ebp - 0x548]
sub ecx, dword [ebp - 0x28]
inc ecx
add eax, ecx
mov dword [ebp - 0x550], eax
cmp dword [ebp - 0x550], 0xfffffff6
jne 0x10025193
jmp 0x100250cf
mov dword [ebp - 0xa54], 0x3009ce45
mov dword [ebp - 0x9bc], 0x3ffaf072
mov dword [ebp - 0xab8], 0xffffffff
mov dword [ebp - 0x9c4], 0xe3e7
mov dword [ebp - 0xa64], 0xffffffff
mov dword [ebp - 0x9cc], 0x77722aba
push 1
lea ecx, [ebp - 0xa80]
call fcn.10018d3c
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x34], 0
jmp 0x10025292
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x100252a8
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x818], 9
jmp 0x1002528b
mov dword [ebp - 0x34], 0
jmp 0x100252b8
cmp dword [ebp - 0x34], 3
jge 0x100252ce
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xb80], 1
jmp 0x100252b1
lea eax, [ebp - 0xa80]
push eax
push 0x13c3
lea eax, [ebp - 0x34]
push eax
push 1
call fcn.100202ec
add esp, 0x10
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x818], 0xffffffe4
jmp 0x10025316
mov dword [ebp - 0x68], 0xce125d16
mov dword [ebp - 0x19c], 0
jmp 0x10025bd8
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 1
jge 0x10025bf4
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0xd8], 0
jmp 0x10025bcb
mov dword [ebp - 0x68], 0
jmp 0x10025c04
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x10025cff
mov dword [ebp - 0xb8], 0x1891f782
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x10025c32
push 1
call fcn.10020806
pop ecx
mov dword [ebp - 0xb8], 0
jmp 0x10025c4b
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jl 0x10025cfa
mov dword [ebp - 0x1a4], 0
jmp 0x10025c71
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 3
jge 0x10025c8d
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0x800], 0xdfe4b283
jmp 0x10025c64
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x800], 0
jmp 0x10025cb8
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x800]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x800], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x800], 0
jl 0x10025cf5
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [ebp + eax*4 - 0xd8]
mov dword [ebp + ecx*4 - 0xd8], eax
mov eax, dword [ebp - 0xb8]
cmp dword [ebp + eax*4 - 0xd8], 0
je 0x10025cf3
jmp 0x10025c9f
jmp 0x10025c9f
jmp 0x10025c3e
jmp 0x10025bfd
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd8], 0
je 0x10025d81
mov eax, dword [ebp - 0x68]
add eax, dword [ebp - 0x68]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xd8]
jl 0x10025d5c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd8], 0x3563
je 0x10025d43
mov dword [ebp - 0x5b8], 1
jmp 0x10025d4a
and dword [ebp - 0x5b8], 0
cmp dword [ebp - 0x5b8], 3
jb 0x10025d5c
and dword [ebp - 0x5c0], 0
jmp 0x10025d66
mov dword [ebp - 0x5c0], 1
imul eax, dword [ebp - 0x5c0], 0xe55a
cmp eax, dword [ebp - 0x68]
jg 0x10025d81
mov dword [ebp - 0x5c8], 1
jmp 0x10025d88
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x5c8]
mov dword [ebp - 0x68], eax
cmp dword [0x1067e8a4], 0
je 0x10025daf
mov ecx, dword [ebp + 8]
call fcn.1002794e
push eax
call dword [0x1067e8a4]
mov dword [ebp - 0xe0], eax
push 1
push 0x271b
push 0x110c
call fcn.1002082a
add esp, 0xc
cmp dword [ebp - 0xe0], 0
je 0x10025e0f
movzx eax, byte [0x1067e899]
test eax, eax
je 0x10025de8
mov ecx, 0x1067e9a8
call fcn.100279d7
movzx eax, al
test eax, eax
jne 0x10025e0f
lea eax, [ebp - 0x5d0]
push eax
mov ecx, 0x1067e9a8
call fcn.10027999
mov ecx, dword [ebp - 0xe0]
mov dword [eax], ecx
push 1
push 0x1067e899
call fcn.10020adc
pop ecx
pop ecx
mov dword [ebp - 0xa84], 0x2ca3c0bf
mov dword [ebp - 0x1ac], 0
jmp 0x10025e32
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 2
jge 0x10025e4e
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0xa9c], 0x93b4
jmp 0x10025e25
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa9c], 0
je 0x10025e77
mov dword [ebp - 0x7d8], 0x33ef
mov dword [ebp - 0x7d8], 0x643cdf98
jmp 0x10025f36
mov dword [ebp - 0x1b4], 8
mov dword [ebp - 0x1b4], 1
jmp 0x10025e9a
mov eax, dword [ebp - 0x1b4]
dec eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0
jl 0x10025f36
mov dword [ebp - 0x190], 0xffffffff
mov byte [ebp - 0xa1], 0
lea eax, [ebp - 0xa1]
push eax
push 1
push 0x4b1c
call fcn.10020b29
add esp, 0xc
mov dword [ebp - 0x190], 0
jmp 0x10025ee7
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 1
jg 0x10025f31
mov byte [ebp - 0xba], 0
movzx eax, byte [ebp - 0xba]
test eax, eax
je 0x10025f2f
push 0x190d
push 0x7936
push 0x5654
push 1
push 0x6747
push 0x513c
push 0x69b3
push 0x3b9f
call fcn.10020b72
add esp, 0x20
jmp 0x10025eda
jmp 0x10025e8d
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x770], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x910]
call fcn.10018b76
mov eax, dword [ebp - 0x770]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret