Function at 0x10016212
Capabilities:
Check for software breakpoints
Compare security identifiers
Contain obfuscated stackstrings
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ae01
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd54
push esi
push edi
movzx eax, byte [ebp + 0x2c]
test eax, eax
je 0x1001c496
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x918], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x8c0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x920], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x894], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x910], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x89c], eax
mov eax, dword [ebp - 0x8c0]
movzx eax, byte [eax]
test eax, eax
je 0x100162fb
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0x900], eax
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0x908], eax
mov eax, dword [ebp - 0x128]
mov dword [eax], 0
jmp 0x100162d0
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x128]
mov dword [ecx], eax
mov eax, dword [ebp - 0x128]
cmp dword [eax], 3
jge 0x100162f6
mov eax, dword [ebp - 0x128]
push dword [eax]
mov ecx, dword [ebp - 0x908]
call fcn.1000d4c0
mov dword [eax], 0x385d06f
jmp 0x100162bf
jmp 0x1001c491
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0x824], eax
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x880], eax
mov eax, dword [ebp - 0x920]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1c4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x670], eax
mov dword [ebp - 0x74], 0xfffffffc
mov dword [ebp - 0x48], 0x3dec995f
mov dword [ebp - 0x80], 2
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x188], 0xe2e4bcb8
push 3
lea ecx, [ebp - 0x9f4]
call fcn.1000d3e3
and dword [ebp - 4], 0
push 0
push 1
lea eax, [ebp - 0xba0]
push eax
push 0x115
push 0xf39
lea eax, [ebp - 0x9f4]
push eax
push 0x399e
call fcn.10012a8c
add esp, 0x1c
mov dword [ebp - 0x74], 0
jmp 0x1001639e
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xffffffe7
jl 0x1001655e
mov dword [ebp - 0x72c], 0xf845
mov dword [ebp - 0x9e0], 0x5aa05d76
mov dword [ebp - 0xc84], 0xc422d5fb
mov dword [ebp - 0xbdc], 0
mov dword [ebp - 0x6f8], 0x81230b63
push 3
lea ecx, [ebp - 0x764]
call fcn.1000d3e3
mov byte [ebp - 4], 1
push 0
push 0x736
lea eax, [ebp - 0x764]
push eax
push 0x6550
lea eax, [ebp - 0xc9c]
push eax
push 0x5470
push 0x5671
push 0x7c2f
push 0x1e20
call fcn.10026b5e
add esp, 0x24
cmp dword [ebp - 0x48], 1
jne 0x10016433
mov dword [ebp - 0x928], 1
jmp 0x1001643a
and dword [ebp - 0x928], 0
push 0
lea ecx, [ebp - 0x764]
call fcn.1000d4c0
push 0
lea ecx, [ebp - 0x764]
call fcn.1000d4c0
mov eax, dword [ebp - 0x9e0]
cmp dword [ebp - 0x74], eax
jl 0x1001646b
mov dword [ebp - 0x438], 1
jmp 0x10016472
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x6f8], eax
cmp dword [ebp - 0x6f8], 0
jne 0x100164a2
push 0
lea ecx, [ebp - 0x764]
call fcn.1000d4c0
cmp dword [eax], 0
jne 0x100164a2
and dword [ebp - 0x718], 0
jmp 0x100164ac
mov dword [ebp - 0x718], 1
push 0
lea ecx, [ebp - 0x764]
call fcn.1000d4c0
mov ecx, dword [ebp - 0x718]
cmp ecx, dword [eax]
jge 0x100164cf
mov dword [ebp - 0x720], 1
jmp 0x100164d6
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x720]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0xec6f0d4a
jae 0x100164f4
mov dword [ebp - 0x728], 1
jmp 0x100164fb
and dword [ebp - 0x728], 0
cmp dword [ebp - 0x728], 0xffffffff
jle 0x10016510
mov dword [ebp - 0x6f0], 1
jmp 0x10016517
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x72c], eax
mov eax, dword [ebp - 0x72c]
cmp eax, dword [ebp - 0x6f0]
je 0x1001653a
mov dword [ebp - 0x314], 1
jmp 0x10016541
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x764]
call fcn.1000d445
jmp 0x10016397
mov dword [ebp - 0x80], 0xe6b87c26
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xbe4], eax
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x30], eax
je 0x10016582
mov dword [ebp - 0x524], 1
jmp 0x10016589
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x524]
sub eax, 6
neg eax
cmp eax, dword [ebp - 0x30]
jle 0x100165a5
mov dword [ebp - 0x9e8], 1
jmp 0x100165ac
and dword [ebp - 0x9e8], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xc94], eax
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x30]
mov dword [ebp - 0x188], eax
jne 0x100165d2
cmp dword [ebp - 0x30], 0
jne 0x100165d2
and dword [ebp - 0x31c], 0
jmp 0x100165dc
mov dword [ebp - 0x31c], 1
mov eax, dword [ebp - 0x31c]
sub eax, 0x24a0b0a9
jne 0x100165ef
cmp dword [ebp - 0x48], 0
je 0x10016604
cmp dword [ebp - 0x188], 0
je 0x10016604
mov dword [ebp - 0x62c], 1
jmp 0x1001660b
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x62c]
imul eax, dword [ebp - 0x48]
test eax, eax
jne 0x1001662c
push 8
pop eax
test eax, eax
jne 0x1001662c
and dword [ebp - 0x324], 0
jmp 0x10016636
mov dword [ebp - 0x324], 1
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x324], eax
jge 0x1001664d
mov dword [ebp - 0x52c], 1
jmp 0x10016654
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x52c]
jle 0x10016671
mov dword [ebp - 0x32c], 1
jmp 0x10016678
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x32c]
je 0x10016698
cmp dword [ebp - 0x188], 0
je 0x10016698
mov dword [ebp - 0x6c0], 1
jmp 0x1001669f
and dword [ebp - 0x6c0], 0
cmp dword [ebp - 0x6c0], 0x94ae
jge 0x100166b7
mov dword [ebp - 0x334], 1
jmp 0x100166be
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x334], eax
jge 0x100166d5
mov dword [ebp - 0x534], 1
jmp 0x100166dc
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x534], eax
jge 0x10016798
push 2
lea ecx, [ebp - 0xaac]
call fcn.1000d3e3
mov byte [ebp - 4], 2
mov dword [ebp - 0x9e4], 0xfffffffe
lea eax, [ebp - 0xbec]
push eax
push 0x3195
lea eax, [ebp - 0xaac]
push eax
push 0
push 0x4e09
push 1
push 1
push 0x2f09
call fcn.1001f209
add esp, 0x20
mov dword [ebp - 0x80], 0
jmp 0x10016741
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jg 0x10016787
mov dword [ebp - 0x780], 0x74ed7b97
mov dword [ebp - 0x88c], 0x2aba01c9
lea eax, [ebp - 0xaac]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
lea eax, [ebp - 0x9e4]
push eax
lea eax, [ebp - 0x88c]
push eax
lea eax, [ebp - 0x780]
push eax
call fcn.1001cfc8
add esp, 0x18
jmp 0x1001673a
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xaac]
call fcn.1000d445
jmp 0x100167f3
mov dword [ebp - 0xb1c], 0xfffffff6
mov dword [ebp - 0x30], 0
jmp 0x100167b2
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jg 0x100167f3
mov dword [ebp - 0x33c], 0xa031
mov eax, dword [ebp - 0x33c]
dec eax
mov dword [ebp - 0x33c], eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x9f4]
call fcn.1000d4c0
mov esi, eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x9f4]
call fcn.1000d4c0
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x100167ab
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9f4]
call fcn.1000d445
mov dword [ebp - 0x790], 0xfffffffb
mov dword [ebp - 0x774], 1
mov dword [ebp - 0x8f8], 0x266d
mov dword [ebp - 0x8f0], 0x9bca7b5c
mov dword [ebp - 0x798], 0xffffffff
push 3
lea ecx, [ebp - 0xadc]
call fcn.1000d3e3
mov dword [ebp - 4], 3
mov dword [ebp - 0x788], 1
mov dword [ebp - 0x18c], 0
jmp 0x1001686b
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 3
jge 0x1001688a
push dword [ebp - 0x18c]
lea ecx, [ebp - 0xadc]
call fcn.1000d4c0
and dword [eax], 0
jmp 0x1001685e
push 0x444e
push 0x263
lea eax, [ebp - 0x774]
push eax
push 0x59ae
lea eax, [ebp - 0xadc]
push eax
push 0x1f31
push 0xe1
push 0x1056
lea eax, [ebp - 0x788]
push eax
push 0x2faf
lea eax, [ebp - 0x8f0]
push eax
push 0x7186
push 0x2be0
lea eax, [ebp - 0x790]
push eax
push 0
push 0x2fd
lea eax, [ebp - 0x8f8]
push eax
lea eax, [ebp - 0x798]
push eax
push 0x7769
push 0
push 0xcfd
call fcn.10029a49
add esp, 0x54
mov byte [ebp - 0xa1], 0
push 0x6989
push 1
push 0x23c9
push 0x4ef0
push 0x759b
push 0
push 0
push 0x3383
lea eax, [ebp - 0xa1]
push eax
call fcn.10029871
add esp, 0x24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xadc]
call fcn.1000d445
mov dword [ebp - 0xb20], 0xffffffff
mov dword [ebp - 0xb38], 0xb3c692be
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x10016994
push 0x66f0
push 0x2ca4
push 0
push 0x2f99
push 0x7e7
push 1
push 0
push 0x4997
call fcn.100293f2
add esp, 0x20
mov byte [ebp - 0xd3], 0
movzx eax, byte [ebp - 0xd3]
test eax, eax
je 0x100169c1
push 0
push 0
push 0x2c0d
push 0xf54
push 0x2e89
call fcn.100140e3
add esp, 0x14
push 1
lea ecx, [ebp - 0xc50]
call fcn.1000d3e3
mov dword [ebp - 4], 4
mov dword [ebp - 0x7a0], 0x42a4
mov dword [ebp - 0x7a8], 0xcbad86e5
mov dword [ebp - 0x8cc], 0xfffffffd
push 1
lea ecx, [ebp - 0xac4]
call fcn.1000d3e3
mov byte [ebp - 4], 5
mov dword [ebp - 0x95c], 0xa56718e5
mov dword [ebp - 0xb40], 1
mov dword [ebp - 0x190], 0
jmp 0x10016a31
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 1
jge 0x10016a53
push dword [ebp - 0x190]
lea ecx, [ebp - 0xac4]
call fcn.1000d4c0
mov dword [eax], 1
jmp 0x10016a24
push 0x64b4
lea eax, [ebp - 0x8cc]
push eax
lea eax, [ebp - 0xac4]
push eax
lea eax, [ebp - 0x7a0]
push eax
push 0
push 0x37dd
lea eax, [ebp - 0x95c]
push eax
lea eax, [ebp - 0x7a8]
push eax
call fcn.1001f346
add esp, 0x20
mov byte [ebp - 0xcf], 0
movzx eax, byte [ebp - 0xcf]
test eax, eax
je 0x10016ad7
push 0x27da
push 1
push 0x485b
push 1
push 0x7988
push 0x5908
push 0x1fb5
push 0x13aa
push 0x5c4f
push 0
push 0x145b
push 0x34de
call fcn.1001f7f9
add esp, 0x30
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xac4]
call fcn.1000d445
mov dword [ebp - 0xb48], 0x43046b6e
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x2c0], 2
mov dword [ebp - 0x208], 0
jmp 0x10016b1a
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 1
jge 0x10016b36
mov eax, dword [ebp - 0x208]
mov dword [ebp + eax*4 - 0x90], 0x57fd
jmp 0x10016b0d
mov dword [ebp - 0x24], 0
jmp 0x10016b46
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x10016d46
mov dword [ebp - 0x168], 1
mov dword [ebp - 0x7b0], 0x7bc41bbb
mov dword [ebp - 0x1fc], 0
jmp 0x10016b7d
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 2
jge 0x10016b99
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0xa44], 0xffffffff
jmp 0x10016b70
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x90], 0
je 0x10016ce5
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x90]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jge 0x10016bce
mov dword [ebp - 0x634], 1
jmp 0x10016bd5
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
je 0x10016bf1
cmp dword [ebp - 0x168], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x90]
cmp dword [ebp + eax - 0xa44], ecx
jge 0x10016c19
mov dword [ebp - 0x344], 1
jmp 0x10016c20
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jg 0x10016c38
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x90], 0
je 0x10016c4d
mov eax, 0x5c3421ad
test eax, eax
je 0x10016c4d
mov dword [ebp - 0x8d4], 1
jmp 0x10016c54
and dword [ebp - 0x8d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x90]
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x2c0]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0xa44]
lea eax, [eax + ecx - 9]
test eax, eax
jne 0x10016c94
mov eax, 0x74fd5744
test eax, eax
jne 0x10016c94
and dword [ebp - 0x53c], 0
jmp 0x10016c9e
mov dword [ebp - 0x53c], 1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x53c]
sub ecx, dword [ebp + eax*4 - 0x90]
dec ecx
cmp ecx, 0x3279329b
jle 0x10016cc7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x90], 0
je 0x10016ce5
cmp dword [ebp - 0x168], 0
je 0x10016ce5
cmp dword [ebp - 0x2c0], 0
je 0x10016ce5
mov dword [ebp - 0x34c], 1
jmp 0x10016cec
and dword [ebp - 0x34c], 0
cmp dword [ebp - 0x34c], 1
je 0x10016d03
or eax, 0xffffffff
jne 0x10016d03
and dword [ebp - 0x724], 0
jmp 0x10016d0d
mov dword [ebp - 0x724], 1
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x90]
cmp eax, dword [ebp - 0x724]
jne 0x10016d2b
mov dword [ebp - 0x354], 1
jmp 0x10016d32
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x354]
sub eax, 8
mov dword [ebp - 0x7b0], eax
jmp 0x10016b3f
mov dword [ebp - 0x7e0], 1
mov dword [ebp - 0x40], 0x34fd
mov dword [ebp - 0xa0], 2
mov dword [ebp - 0x6c], 0xa1e94870
push 3
lea ecx, [ebp - 0x938]
call fcn.1000d3e3
mov byte [ebp - 4], 6
mov dword [ebp - 0x28], 0
jmp 0x10016d89
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10016da5
push dword [ebp - 0x28]
lea ecx, [ebp - 0x938]
call fcn.1000d4c0
mov dword [eax], 7
jmp 0x10016d82
mov dword [ebp - 0x28], 0
jmp 0x10016db5
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10016dcb
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xd04], 0xfffffffa
jmp 0x10016dae
mov dword [ebp - 0x9c0], 0x218d
cmp dword [ebp - 0x9c0], 0x61e
jge 0x10016f49
push 0x1e8480
push 0xffffffffffffffff
push 0x106ef960
call fcn.100480ec
add esp, 0xc
push 0x1068d9f0
push 0x1000b344
call fcn.100527da
pop ecx
pop ecx
cmp eax, 0xffffffff
je 0x10016f49
and dword [ebp - 0x1a4], 0
jmp 0x10016e29
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 6
jge 0x10016e45
mov eax, dword [ebp - 0x1a4]
mov dword [eax*4 + 0x108d7de0], 4
jmp 0x10016e1c
and dword [ebp - 0x22c], 0
push 0x1068d9f0
call fcn.10050960
pop ecx
mov dword [ebp - 0x544], eax
and dword [ebp - 0xdc], 0
jmp 0x10016e73
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0x544]
jge 0x10016ec9
mov eax, dword [ebp - 0xdc]
movsx eax, byte [eax + 0x1068d9f0]
mov ecx, dword [ebp - 0x22c]
lea eax, [ecx + eax - 0x30]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0xdc]
movsx eax, byte [eax + 0x1068d9f0]
mov eax, dword [eax*4 + 0x108d7d1c]
dec eax
mov ecx, dword [ebp - 0xdc]
movsx ecx, byte [ecx + 0x1068d9f0]
mov dword [ecx*4 + 0x108d7d1c], eax
jmp 0x10016e66
mov eax, dword [ebp - 0x544]
and eax, 1
je 0x10016f0d
push dword [ebp - 0x22c]
call fcn.10015fe4
pop ecx
movzx eax, al
test eax, eax
je 0x10016efa
push 0x1068d9f0
push 0x1000b348
call fcn.10052b7f
pop ecx
pop ecx
jmp 0x10016f0b
push 0x1068d9f0
push 0x1000b350
call fcn.10052b7f
pop ecx
pop ecx
jmp 0x10016f44
push dword [ebp - 0x22c]
call fcn.10015fe4
pop ecx
movzx eax, al
test eax, eax
je 0x10016f33
push 0x1068d9f0
push 0x1000b350
call fcn.10052b7f
pop ecx
pop ecx
jmp 0x10016f44
push 0x1068d9f0
push 0x1000b348
call fcn.10052b7f
pop ecx
pop ecx
jmp 0x10016df9
mov dword [ebp - 0x28], 0
jmp 0x10016f59
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10016f6f
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xd3c], 0xfffffff7
jmp 0x10016f52
mov dword [ebp - 0x40], 0xeca4f833
mov dword [ebp - 0xa0], 0xfffffffd
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x40], eax
jg 0x10016f9d
mov dword [ebp - 0x35c], 1
jmp 0x10016fa4
and dword [ebp - 0x35c], 0
push 1
lea ecx, [ebp - 0x938]
call fcn.1000d4c0
mov ecx, dword [ebp - 0x35c]
mov dword [eax], ecx
mov dword [ebp - 0xa0], 1
jmp 0x10016fd2
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xfffffff3
jle 0x10017387
mov dword [ebp - 0x138], 0x31e13ca4
mov dword [ebp - 0x2a8], 1
mov dword [ebp - 0x158], 0xffffffff
mov dword [ebp - 0x40], 0
jmp 0x1001700d
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x29
jg 0x10017350
mov dword [ebp - 0x130], 0xb051af7f
mov dword [ebp - 0x270], 3
cmp dword [ebp - 0x40], 1
jge 0x1001703d
mov dword [ebp - 0x7b8], 1
jmp 0x10017044
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0xb50], eax
mov eax, dword [ebp - 0x130]
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x63c], eax
push 1
lea ecx, [ebp - 0x938]
call fcn.1000d4c0
mov ecx, dword [ebp - 0x63c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x63c], eax
jg 0x1001708e
mov dword [ebp - 0x364], 1
jmp 0x10017095
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0x364]
je 0x100170b5
cmp dword [ebp - 0xa0], 0
je 0x100170b5
mov dword [ebp - 0x54c], 1
jmp 0x100170bc
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x54c], eax
jg 0x100170d3
mov dword [ebp - 0x36c], 1
jmp 0x100170da
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x270]
add eax, 0x4faf
je 0x10017105
cmp dword [ebp - 0x6c], 0
je 0x10017105
mov dword [ebp - 0x8dc], 1
jmp 0x1001710c
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0xb58], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x2a8]
sub eax, dword [ebp - 0x138]
sub eax, dword [ebp - 0x6c]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0x138]
je 0x1001714d
mov dword [ebp - 0x6c4], 1
jmp 0x10017154
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x130]
add eax, dword [ebp - 0x6c4]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0xb60], eax
cmp dword [ebp - 0x158], 0
je 0x1001732a
mov dword [ebp - 0x644], 0xffffffff
cmp dword [ebp - 0x130], 0
je 0x10017235
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x644]
test eax, eax
jne 0x100171b4
push 0xfffffffffffffff8
pop eax
test eax, eax
jne 0x100171b4
and dword [ebp - 0x374], 0
jmp 0x100171be
mov dword [ebp - 0x374], 1
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x374], eax
jle 0x100171d5
mov dword [ebp - 0x554], 1
jmp 0x100171dc
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x554]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
add eax, dword [ebp - 0x138]
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0xb68], eax
mov eax, 0x16ce65c5
cmp eax, 0xf785b8ee
ja 0x10017218
mov dword [ebp - 0x37c], 1
jmp 0x1001721f
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x37c]
sub eax, 0x7d62
je 0x10017235
and dword [ebp - 0x384], 0
jmp 0x1001723f
mov dword [ebp - 0x384], 1
mov eax, dword [ebp - 0x644]
cmp eax, dword [ebp - 0x384]
je 0x10017259
mov dword [ebp - 0x55c], 1
jmp 0x10017260
and dword [ebp - 0x55c], 0
cmp dword [ebp - 0x55c], 0xfff8
jae 0x10017278
mov dword [ebp - 0x38c], 1
jmp 0x1001727f
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x38c], eax
jg 0x10017299
mov dword [ebp - 0x278], 1
jmp 0x100172a0
and dword [ebp - 0x278], 0
push 2
lea ecx, [ebp - 0x938]
call fcn.1000d4c0
mov ecx, dword [ebp - 0x278]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xd04]
sub eax, dword [ebp - 0x278]
cmp eax, 0x230b56bf
jge 0x100172db
mov dword [ebp - 0x6fc], 1
jmp 0x100172e2
and dword [ebp - 0x6fc], 0
cmp dword [ebp - 0x6fc], 0xfffffffb
je 0x100172f7
mov dword [ebp - 0x394], 1
jmp 0x100172fe
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x394]
inc eax
cmp eax, 0x3e85184b
jge 0x10017318
mov dword [ebp - 0x564], 1
jmp 0x1001731f
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x6c], eax
jmp 0x1001734b
mov dword [ebp - 0xb70], 1
mov dword [ebp - 0x39c], 4
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
jmp 0x10017006
mov byte [ebp - 0xd7], 0
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x10017382
push 0x212
push 0x42da
push 1
push 0
push 0x5f7c
push 0x42b6
call fcn.100264f8
add esp, 0x18
jmp 0x10016fc5
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x938]
call fcn.1000d445
mov dword [ebp - 0x204], 0x13dd33a4
mov dword [ebp - 0x1ac], 0
jmp 0x100173b9
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 1
jge 0x100173d5
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0xb78], 1
jmp 0x100173ac
mov dword [ebp - 0x204], 0xffffffef
jmp 0x100173ee
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0x19
je 0x1001744f
mov dword [ebp - 0x1b4], 0x8c9f3690
mov dword [ebp - 0x1b4], 0
jmp 0x1001741a
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0
jg 0x1001744d
mov byte [ebp - 0x96], 0
movzx eax, byte [ebp - 0x96]
test eax, eax
je 0x1001744b
push 0x1baa
push 0
push 0
push 0x6423
call fcn.1001d152
add esp, 0x10
jmp 0x1001740d
jmp 0x100173e1
mov dword [ebp - 0x178], 0
jmp 0x10017468
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 3
jge 0x10017484
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0xd60], 0xffffffff
jmp 0x1001745b
mov dword [ebp - 0x1bc], 0xfffffffa
mov dword [ebp - 0xb80], 0
mov dword [ebp - 0xb88], 1
push 1
lea ecx, [ebp - 0xc20]
call fcn.1000d3e3
mov byte [ebp - 4], 7
mov dword [ebp - 0x64c], 0x12f3ccd2
mov dword [ebp - 0x244], 0
jmp 0x100174d6
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 1
jge 0x100174f8
push dword [ebp - 0x244]
lea ecx, [ebp - 0xc20]
call fcn.1000d4c0
mov dword [eax], 0xfffffff8
jmp 0x100174c9
mov dword [ebp - 0x1bc], 0
jmp 0x10017511
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0x1a
jle 0x10017542
mov byte [ebp - 0x98], 0
movzx eax, byte [ebp - 0x98]
test eax, eax
je 0x10017540
push 0xec2
push 0
push 0x2f37
call fcn.10021a8e
add esp, 0xc
jmp 0x10017504
mov eax, dword [ebp - 0x64c]
inc eax
mov dword [ebp - 0x64c], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xc20]
call fcn.1000d445
push 0
push 0x45f1
lea eax, [ebp - 0xc50]
push eax
lea eax, [ebp - 0x178]
push eax
push 0x3acb
push 0x47a3
call fcn.1002ac9b
add esp, 0x18
push 1
lea ecx, [ebp - 0xa0c]
call fcn.1000d3e3
mov byte [ebp - 4], 8
mov dword [ebp - 0x280], 0x813a3dbc
mov dword [ebp - 0x7c0], 0xee507704
mov dword [ebp - 0x96c], 0xffffffff
lea eax, [ebp - 0xa0c]
push eax
push 0x7985
push 0
push 0x4a06
push 0x5813
lea eax, [ebp - 0x20]
push eax
push 0x4609
call fcn.1002740e
add esp, 0x1c
mov dword [ebp - 0x20], 0
jmp 0x100175ed
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10017603
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc30], 0x97a888ad
jmp 0x100175e6
mov dword [ebp - 0x20], 0
jmp 0x10017613
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10017629
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x740], 0xd8987f2f
jmp 0x1001760c
mov dword [ebp - 0x20], 0
jmp 0x10017639
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1001764f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x56c], 0xffffffff
jmp 0x10017632
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xc30], 0
jne 0x10017710
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7c0]
cmp dword [ebp + eax - 0x740], ecx
jge 0x10017684
mov dword [ebp - 0x2d0], 1
jmp 0x1001768b
and dword [ebp - 0x2d0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2d0]
mov dword [ebp + eax - 0xc30], ecx
push 0
lea ecx, [ebp - 0xa0c]
call fcn.1000d4c0
mov eax, dword [eax]
cmp eax, dword [ebp - 0x2d0]
jg 0x100176e8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x56c]
mov dword [ebp - 0xb90], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x740], 0
jne 0x100176e8
push 0xfffffffffffffff7
pop eax
test eax, eax
jne 0x100176e8
and dword [ebp - 0x3a4], 0
jmp 0x100176f2
mov dword [ebp - 0x3a4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x740]
cmp dword [ebp - 0x3a4], eax
jne 0x10017710
mov eax, 0x2f1fcc10
test eax, eax
je 0x10017720
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x56c], 0
jne 0x1001772e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x740], 0
mov eax, dword [ebp - 0x280]
dec eax
mov dword [ebp - 0x280], eax
mov esi, dword [ebp - 0x280]
push 0
lea ecx, [ebp - 0xa0c]
call fcn.1000d4c0
cmp esi, dword [eax]
jne 0x1001775e
mov dword [ebp - 0x3ac], 1
jmp 0x10017765
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x96c], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa0c]
call fcn.1000d445
push 1
lea ecx, [ebp - 0xc40]
call fcn.1000d3e3
mov byte [ebp - 4], 9
mov dword [ebp - 0x20c], 0
jmp 0x100177aa
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 1
jge 0x100177cc
push dword [ebp - 0x20c]
lea ecx, [ebp - 0xc40]
call fcn.1000d4c0
mov dword [eax], 1
jmp 0x1001779d
push 0x4a5b
push 0
push 1
push 0x4e7c
call fcn.1001d152
add esp, 0x10
mov byte [ebp - 0x9a], 0
movzx eax, byte [ebp - 0x9a]
test eax, eax
je 0x10017819
push 0x3c8e
push 0x4f12
push 0x32ce
push 1
push 0x218a
push 0x2d64
push 0
call fcn.100122ff
add esp, 0x1c
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xc40]
call fcn.1000d445
mov byte [ebp - 0x97], 0
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0xb98], 0xf58382bd
mov dword [ebp - 0x7d0], 0xe0752570
mov dword [ebp - 0xb0c], 0x829cbc21
push 0xb41
push 0x29e4
push 0x5db8
push 0
push 0x20a0
push 0x5637
push 0
push 0x10e9
lea eax, [ebp - 0x64]
push eax
call fcn.10013787
add esp, 0x24
mov dword [ebp - 0x64], 0xe
jmp 0x10017892
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0xd
je 0x100179f5
push 1
lea ecx, [ebp - 0x738]
call fcn.1000d3e3
mov byte [ebp - 4], 0xa
push 0
push 0x5355
push 0x43b9
push 0x4334
push 1
push 0x6e7a
push 0
lea eax, [ebp - 0x738]
push eax
push 0x3f89
lea eax, [ebp - 0xba8]
push eax
call fcn.10016212
add esp, 0x28
cmp dword [ebp - 0x64], 2
jg 0x100178f4
mov dword [ebp - 0x7c8], 1
jmp 0x100178fb
and dword [ebp - 0x7c8], 0
xor eax, eax
inc eax
cmp eax, 0xffffffff
jae 0x1001790f
mov dword [ebp - 0x6cc], 1
jmp 0x10017916
and dword [ebp - 0x6cc], 0
cmp dword [ebp - 0x6cc], 1
jg 0x1001792b
mov dword [ebp - 0x3b4], 1
jmp 0x10017932
and dword [ebp - 0x3b4], 0
push 0
lea ecx, [ebp - 0x738]
call fcn.1000d4c0
mov esi, dword [ebp - 0x64]
push 0
lea ecx, [ebp - 0x738]
call fcn.1000d4c0
mov edi, eax
push 0
lea ecx, [ebp - 0x738]
call fcn.1000d4c0
mov ecx, dword [edi]
sub ecx, dword [eax]
cmp esi, ecx
je 0x10017972
mov dword [ebp - 0x8e4], 1
jmp 0x10017979
and dword [ebp - 0x8e4], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xbb0], eax
push 0
lea ecx, [ebp - 0x738]
call fcn.1000d4c0
mov esi, eax
push 0
lea ecx, [ebp - 0x738]
call fcn.1000d4c0
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x100179b0
mov dword [ebp - 0x574], 1
jmp 0x100179b7
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x574], eax
jle 0x100179ce
mov dword [ebp - 0x3bc], 1
jmp 0x100179d5
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x7d0], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x738]
call fcn.1000d445
jmp 0x1001788b
lea eax, [ebp - 0x97]
push eax
push 0
push 0x7bb8
call fcn.1002bbf5
add esp, 0xc
mov dword [ebp - 0x140], 0xfffffffc
mov dword [ebp - 0x9dc], 0xfffffffd
mov dword [ebp - 0x140], 0
jmp 0x10017a38
mov eax, dword [ebp - 0x140]
dec eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xfffffffb
je 0x10017a89
mov dword [ebp - 0x7d8], 0xfffb
mov dword [ebp - 0x8ec], 8
push 0
lea eax, [ebp - 0x9dc]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x139a
push 0x1688
lea eax, [ebp - 0x7d8]
push eax
push 0
lea eax, [ebp - 0x8ec]
push eax
call fcn.1001efcf
add esp, 0x20
jmp 0x10017a2b
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x10017ac7
push 0xc88
push 0x7b76
push 0x83b
push 0
push 0x3bd5
push 0xf
push 1
push 0x214
push 0xa6c
call fcn.10013787
add esp, 0x24
push 0x7e89
push 0x851
push 1
lea eax, [ebp - 0x7e0]
push eax
push 0x6181
push 0x3a41
push 0
push 0x4976
call fcn.10013662
add esp, 0x20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc50]
call fcn.1000d445
mov eax, dword [ebp - 0x1c4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c4]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x58], eax
and dword [ebp - 0x2b0], 0
jmp 0x10017b3c
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x58]
add eax, 0x28
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x1c4]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x2b0], eax
jge 0x1001c491
mov dword [ebp - 0x5c], 0xe60f951f
mov dword [ebp - 0xbb8], 3
mov dword [ebp - 0xbc0], 0x735b263d
mov dword [ebp - 0xbc8], 0x7d2038e8
mov dword [ebp - 0xbd0], 0xf3e76e5b
mov dword [ebp - 0x7e8], 0
mov dword [ebp - 0xbd8], 0x91b4956e
mov dword [ebp - 0xbe0], 5
push 3
lea ecx, [ebp - 0xc60]
call fcn.1000d3e3
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x9b0], 0x6bc97de2
mov dword [ebp - 0x160], 0
jmp 0x10017bd8
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 3
jge 0x10017bf4
mov eax, dword [ebp - 0x160]
mov dword [ebp + eax*4 - 0xa24], 0
jmp 0x10017bcb
push 0x6e21
lea eax, [ebp - 0xc60]
push eax
push 1
push 0x2a40
push 0
push 1
lea eax, [ebp - 0x160]
push eax
call fcn.10028c60
add esp, 0x1c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa24]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xa24], eax
mov dword [ebp - 0x5c], 2
jmp 0x10017c45
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x10017e86
mov dword [ebp - 0x97c], 0xffffffff
mov dword [ebp - 0x7f8], 0xfe57f6cc
mov dword [ebp - 0xbe8], 0x23d4a1cf
mov dword [ebp - 0x71c], 0x736d0c11
mov dword [ebp - 0x57c], 0xf7d26684
mov dword [ebp - 0xbf0], 1
mov dword [ebp - 0x7f0], 0xfffffffd
mov dword [ebp - 0xce8], 1
mov dword [ebp - 0xce4], 1
mov dword [ebp - 0xce0], 1
mov dword [ebp - 0xcdc], 1
mov dword [ebp - 0x8f4], 0x81c37f5e
mov dword [ebp - 0x234], 0
jmp 0x10017ce0
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 2
jge 0x10017cfc
mov eax, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0x704], 0x3b88
jmp 0x10017cd3
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0xa24]
mov dword [ebp - 0x97c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x704]
sub eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ebp + ecx*4 - 0xa24]
push 4
pop edx
imul edx, edx, 0
mov edx, dword [ebp + edx - 0x704]
dec edx
push 4
pop esi
imul esi, esi, 0
mov dword [ebp + esi - 0x704], edx
cmp ecx, eax
jg 0x10017e24
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x704]
sub eax, dword [ebp - 0x7e8]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x704]
jg 0x10017d77
mov dword [ebp - 0x654], 1
jmp 0x10017d7e
and dword [ebp - 0x654], 0
cmp dword [ebp - 0x654], 0xfffffffb
jbe 0x10017d93
mov dword [ebp - 0x3c4], 1
jmp 0x10017d9a
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x57c], eax
mov eax, dword [ebp - 0x8f4]
cmp dword [ebp - 0x57c], eax
jl 0x10017dc0
mov dword [ebp - 0x3cc], 1
jmp 0x10017dc7
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x71c], eax
mov eax, dword [ebp - 0x7f0]
cmp dword [ebp - 0x71c], eax
jle 0x10017ded
mov dword [ebp - 0x3d4], 1
jmp 0x10017df4
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x3d4], eax
jg 0x10017e0b
mov dword [ebp - 0x584], 1
jmp 0x10017e12
and dword [ebp - 0x584], 0
cmp dword [ebp - 0x584], 1
je 0x10017e24
and dword [ebp - 0x3dc], 0
jmp 0x10017e2e
mov dword [ebp - 0x3dc], 1
mov eax, dword [ebp - 0x3dc]
sub eax, 0x2b0969e0
je 0x10017e4d
cmp dword [ebp - 0x5c], 0
je 0x10017e4d
mov dword [ebp - 0x65c], 1
jmp 0x10017e54
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x9b0]
cmp dword [ebp - 0x65c], eax
je 0x10017e6e
mov dword [ebp - 0x3e4], 1
jmp 0x10017e75
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x7f8], eax
jmp 0x10017c3e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc60]
call fcn.1000d445
mov eax, dword [ebp - 0x58]
cmp dword [eax + 0x10], 0
jne 0x1001b639
push 1
lea ecx, [ebp - 0xaa0]
call fcn.1000d3e3
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x170], 0xffffffff
mov dword [ebp - 0x800], 0xffffffff
mov dword [ebp - 0x8fc], 0x1c28
cmp dword [ebp - 0x8fc], 0xf11
jge 0x10018096
lea ecx, [ebp - 0xa94]
call fcn.1000d03c
mov byte [ebp - 4], 0xd
lea edx, [ebp - 0xa94]
mov ecx, 0x1065b710
call fcn.1003083e
push 0
push 0x68
lea ecx, [ebp - 0xa94]
call fcn.1002f703
mov dword [ebp - 0xe4], eax
push dword [ebp - 0xe4]
push 0x65
lea ecx, [ebp - 0xa94]
call fcn.1002f703
mov dword [ebp - 0x10c], eax
push dword [ebp - 0x10c]
push 0x6c
lea ecx, [ebp - 0xa94]
call fcn.1002f703
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
inc eax
push eax
push 0x6c
lea ecx, [ebp - 0xa94]
call fcn.1002f703
mov dword [ebp - 0x104], eax
push dword [ebp - 0x104]
push 0x6f
lea ecx, [ebp - 0xa94]
call fcn.1002f703
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x10c]
jge 0x1001806c
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0xec]
jge 0x1001806c
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x104]
jge 0x1001806c
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x148]
jge 0x1001806c
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0xec]
jge 0x1001806c
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x104]
jge 0x1001806c
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x148]
jge 0x1001806c
mov eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0x104]
jge 0x1001806c
mov eax, dword [ebp - 0xec]
cmp eax, dword [ebp - 0x148]
jge 0x1001806c
mov eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0x148]
jge 0x1001806c
cmp dword [ebp - 0xe4], 0xffffffff
je 0x1001806c
cmp dword [ebp - 0x10c], 0xffffffff
je 0x1001806c
cmp dword [ebp - 0xec], 0xffffffff
je 0x1001806c
cmp dword [ebp - 0x104], 0xffffffff
je 0x1001806c
cmp dword [ebp - 0x148], 0xffffffff
je 0x1001806c
push fcn.10010bca
mov edx, 0x1000b2ac
mov ecx, 0x1065b658
call fcn.10030864
mov ecx, eax
call fcn.1000d2b8
jmp 0x10018087
push fcn.10010bca
mov edx, 0x1000b2b0
mov ecx, 0x1065b658
call fcn.10030864
mov ecx, eax
call fcn.1000d2b8
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xa94]
call fcn.1000d09f
lea eax, [ebp - 0xbf8]
push eax
push 0
lea eax, [ebp - 0xaa0]
push eax
call fcn.1001cc60
add esp, 0xc
mov dword [ebp - 0x170], 0
jmp 0x100180c7
mov eax, dword [ebp - 0x170]
dec eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0
jl 0x1001812c
mov dword [ebp - 0x98c], 1
lea eax, [ebp - 0x800]
push eax
push 0x7997
push 0x4cd6
push 0x321d
push 0x1f75
push 1
push 0x4ca3
lea eax, [ebp - 0x98c]
push eax
lea eax, [ebp - 0x170]
push eax
push 0
lea eax, [ebp - 0xaa0]
push eax
push 0x7a7f
push 0x145b
push 0x1726
call fcn.1001393d
add esp, 0x38
jmp 0x100180ba
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaa0]
call fcn.1000d445
mov dword [ebp - 0x3ec], 0x39e3
push 2
lea ecx, [ebp - 0x264]
call fcn.1000d3e3
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x58c], 1
mov dword [ebp - 0x3f4], 0xd004dde9
mov dword [ebp - 0x404], 1
mov dword [ebp - 0x664], 0x9097d93c
push 1
lea ecx, [ebp - 0xad0]
call fcn.1000d3e3
mov byte [ebp - 4], 0xf
push 0x796d
push 0xf20
push 0x7f23
lea eax, [ebp - 0x120]
push eax
push 0x47e1
lea eax, [ebp - 0x264]
push eax
push 0
push 0x7bb9
push 0
push 0x375e
push 0x53f
push 0x61de
push 0x26c0
call fcn.1002a941
add esp, 0x34
mov dword [ebp - 0x120], 0
jmp 0x100181f2
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jge 0x10018214
push dword [ebp - 0x120]
lea ecx, [ebp - 0xad0]
call fcn.1000d4c0
mov dword [eax], 4
jmp 0x100181e5
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x58c]
push eax
lea eax, [ebp - 0x3f4]
push eax
push 1
push 0x4dd3
lea eax, [ebp - 0x3ec]
push eax
push 1
call fcn.100122ff
add esp, 0x1c
push 0
lea ecx, [ebp - 0x264]
call fcn.1000d4c0
cmp dword [eax], 0
jne 0x10018289
cmp dword [ebp - 0x58c], 0xb42c
jle 0x1001826b
mov dword [ebp - 0x6d4], 1
jmp 0x10018272
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x3ec]
cmp eax, dword [ebp - 0x6d4]
je 0x10018289
and dword [ebp - 0x40c], 0
jmp 0x10018293
mov dword [ebp - 0x40c], 1
push 1
lea ecx, [ebp - 0x264]
call fcn.1000d4c0
cmp dword [ebp - 0x404], 0xffffffff
ja 0x100182b5
mov dword [ebp - 0x808], 1
jmp 0x100182bc
and dword [ebp - 0x808], 0
push 1
lea ecx, [ebp - 0x264]
call fcn.1000d4c0
push 1
lea ecx, [ebp - 0x264]
call fcn.1000d4c0
push 1
lea ecx, [ebp - 0x264]
call fcn.1000d4c0
push 5
pop eax
test eax, eax
jne 0x100182fc
cmp dword [ebp - 0x3f4], 0
jne 0x100182fc
and dword [ebp - 0x594], 0
jmp 0x10018306
mov dword [ebp - 0x594], 1
push 0
lea ecx, [ebp - 0x264]
call fcn.1000d4c0
mov ecx, dword [ebp - 0x594]
cmp ecx, dword [eax]
jge 0x10018329
mov dword [ebp - 0x3fc], 1
jmp 0x10018330
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 0
jbe 0x10018351
mov dword [ebp - 0x59c], 1
jmp 0x10018358
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x404]
cmp dword [ebp - 0x59c], eax
jg 0x10018372
mov dword [ebp - 0x708], 1
jmp 0x10018379
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x40c]
cmp eax, dword [ebp - 0x708]
jle 0x100183a5
push 0
lea ecx, [ebp - 0x264]
call fcn.1000d4c0
cmp dword [eax], 0
je 0x100183a5
mov dword [ebp - 0x288], 1
jmp 0x100183ac
and dword [ebp - 0x288], 0
push 1
lea ecx, [ebp - 0x264]
call fcn.1000d4c0
mov ecx, dword [ebp - 0x288]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0xad0]
call fcn.1000d4c0
mov ecx, dword [ebp - 0x288]
mov dword [eax], ecx
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xad0]
call fcn.1000d445
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x264]
call fcn.1000d445
mov dword [ebp - 0x180], 0xffffffff
mov dword [ebp - 0x5a4], 0x42a4
mov dword [ebp - 0x1d4], 0xcbad86e5
mov dword [ebp - 0x2c8], 0xfffffffd
push 1
lea ecx, [ebp - 0x948]
call fcn.1000d3e3
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x810], 0xa56718e5
mov dword [ebp - 0xc00], 1
mov dword [ebp - 0x904], 0x153b
cmp dword [ebp - 0x904], 0x839
jge 0x1001861f
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x214]
push eax
mov ecx, 0x1065b710
call fcn.1000d0c9
mov ecx, eax
call fcn.1000d0c9
push dword [ebp - 0x214]
lea ecx, [ebp - 0x2e8]
call fcn.1000d3e3
mov byte [ebp - 4], 0x11
and dword [ebp - 0x1cc], 0
jmp 0x100184a8
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x1cc]
cmp eax, dword [ebp - 0x214]
jge 0x100184d4
push dword [ebp - 0x1cc]
lea ecx, [ebp - 0x2e8]
call fcn.1000d4c0
push eax
mov ecx, 0x1065b710
call fcn.1000d0c9
jmp 0x1001849b
lea eax, [ebp - 0xc08]
push eax
lea ecx, [ebp - 0x2e8]
call fcn.1000d458
push dword [eax]
lea eax, [ebp - 0xc10]
push eax
lea ecx, [ebp - 0x2e8]
call fcn.1000d44a
push dword [eax]
call fcn.100109f0
pop ecx
pop ecx
cmp dword [ebp - 0x124], 0
jne 0x10018564
push 0
lea ecx, [ebp - 0x2e8]
call fcn.1000d4c0
cmp dword [eax], 1
jle 0x10018547
push fcn.10010bca
push 0
lea ecx, [ebp - 0x2e8]
call fcn.1000d4c0
mov eax, dword [eax]
dec eax
push eax
mov ecx, 0x1065b658
call fcn.1000d2c4
mov ecx, eax
call fcn.1000d2b8
jmp 0x1001855f
push fcn.10010bca
push 0xffffffffffffffff
mov ecx, 0x1065b658
call fcn.1000d2c4
mov ecx, eax
call fcn.1000d2b8
jmp 0x10018610
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x214]
jne 0x1001859f
push fcn.10010bca
mov eax, dword [ebp - 0x214]
dec eax
push eax
lea ecx, [ebp - 0x2e8]
call fcn.1000d4c0
push dword [eax]
mov ecx, 0x1065b658
call fcn.1000d2c4
mov ecx, eax
call fcn.1000d2b8
jmp 0x10018610
mov eax, dword [ebp - 0x124]
dec eax
push eax
lea ecx, [ebp - 0x2e8]
call fcn.1000d4c0
mov esi, eax
push dword [ebp - 0x124]
lea ecx, [ebp - 0x2e8]
call fcn.1000d4c0
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x100185e5
push fcn.10010bca
push 0xffffffffffffffff
mov ecx, 0x1065b658
call fcn.1000d2c4
mov ecx, eax
call fcn.1000d2b8
jmp 0x10018610
push fcn.10010bca
mov eax, dword [ebp - 0x124]
dec eax
push eax
lea ecx, [ebp - 0x2e8]
call fcn.1000d4c0
push dword [eax]
mov ecx, 0x1065b658
call fcn.1000d2c4
mov ecx, eax
call fcn.1000d2b8
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x2e8]
call fcn.1000d445
push 0x4091
lea eax, [ebp - 0xcb4]
push eax
lea eax, [ebp - 0x948]
push eax
push 0x4643
push 0x5ec4
push 1
push 1
call fcn.10012488
add esp, 0x1c
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0xcbc], eax
mov dword [ebp - 0x2c8], 0xffffe275
mov esi, dword [ebp - 0x1d4]
add esi, dword [ebp - 0x1d4]
push 0
lea ecx, [ebp - 0x948]
call fcn.1000d4c0
cmp esi, dword [eax]
je 0x10018687
mov dword [ebp - 0x414], 1
jmp 0x1001868e
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x2c8]
add eax, dword [ebp - 0x414]
cmp eax, dword [ebp - 0x1d4]
jne 0x100186ab
cmp dword [ebp - 0x2c8], 0
je 0x100186c0
cmp dword [ebp - 0x5a4], 0
je 0x100186c0
mov dword [ebp - 0x41c], 1
jmp 0x100186c7
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x5a4]
cmp eax, dword [ebp - 0x41c]
jne 0x100186e1
mov dword [ebp - 0x66c], 1
jmp 0x100186e8
and dword [ebp - 0x66c], 0
push 0
lea ecx, [ebp - 0x948]
call fcn.1000d4c0
mov ecx, dword [ebp - 0x66c]
cmp ecx, dword [eax]
jne 0x1001870b
mov dword [ebp - 0x424], 1
jmp 0x10018712
and dword [ebp - 0x424], 0
push 0
lea ecx, [ebp - 0x948]
call fcn.1000d4c0
mov ecx, dword [ebp - 0x424]
add ecx, dword [eax]
mov dword [ebp - 0x810], ecx
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x1001876b
push 0x2fe9
push 0x2f8d
push 0
push 1
push 0xba9
push 0x4816
push 0
push 0x1b8b
push 0x306d
call fcn.100277d3
add esp, 0x24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x948]
call fcn.1000d445
mov dword [ebp - 0x38], 0x89226c31
push 4
lea ecx, [ebp - 0x958]
call fcn.1000d3e3
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x11c], 0x76fb
mov dword [ebp - 0x290], 0x2caeaba4
mov dword [ebp - 0x5bc], 0
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x820], 0xfffffffd
lea eax, [ebp - 0x958]
push eax
push 0
lea eax, [ebp - 0xcc4]
push eax
call fcn.100292df
add esp, 0xc
cmp dword [ebp - 0x38], 0
jne 0x10018936
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xccc], eax
mov eax, 0xfff6
test eax, eax
je 0x1001883f
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0xffff
jne 0x10018820
mov dword [ebp - 0x5ac], 1
jmp 0x10018827
and dword [ebp - 0x5ac], 0
cmp dword [ebp - 0x5ac], 0xfff9
jb 0x1001883f
mov dword [ebp - 0x42c], 1
jmp 0x10018846
and dword [ebp - 0x42c], 0
push 1
lea ecx, [ebp - 0x958]
call fcn.1000d4c0
mov ecx, dword [ebp - 0x42c]
cmp ecx, dword [eax]
jl 0x10018869
mov dword [ebp - 0x6dc], 1
jmp 0x10018870
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x6dc]
cmp eax, 0xfffffff6
jg 0x1001888b
mov dword [ebp - 0x9b4], 1
jmp 0x10018892
and dword [ebp - 0x9b4], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xcd4], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x434], eax
push 1
lea ecx, [ebp - 0x958]
call fcn.1000d4c0
mov ecx, dword [ebp - 0x434]
mov dword [eax], ecx
cmp dword [ebp - 0x434], 0xedf47f28
jbe 0x100188d4
mov dword [ebp - 0x818], 1
jmp 0x100188db
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xcf0], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 0
jne 0x10018914
push 3
lea ecx, [ebp - 0x958]
call fcn.1000d4c0
cmp dword [eax], 0
jne 0x10018914
and dword [ebp - 0x5b4], 0
jmp 0x1001891e
mov dword [ebp - 0x5b4], 1
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x5b4]
cmp eax, dword [ebp - 0x38]
jle 0x10018936
and dword [ebp - 0x43c], 0
jmp 0x10018940
mov dword [ebp - 0x43c], 1
cmp dword [ebp - 0x43c], 0x8c6a
je 0x10018958
mov dword [ebp - 0x90c], 1
jmp 0x1001895f
and dword [ebp - 0x90c], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xcf8], eax
mov eax, dword [ebp - 0x290]
imul eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x38]
jne 0x10018983
mov dword [ebp - 0x674], 1
jmp 0x1001898a
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x674], eax
jne 0x100189a1
mov dword [ebp - 0x444], 1
jmp 0x100189a8
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x5bc], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x5bc], eax
jne 0x100189cb
mov dword [ebp - 0x44c], 1
jmp 0x100189d2
and dword [ebp - 0x44c], 0
cmp dword [ebp - 0x44c], 0xdf60
jl 0x100189ea
mov dword [ebp - 0x70c], 1
jmp 0x100189f1
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x454]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x820], eax
mov byte [ebp - 0xca], 0
movzx eax, byte [ebp - 0xca]
test eax, eax
je 0x10018a36
push 0x1ddf
push 1
push 0x51c2
push 0
push 0
call fcn.1002a81b
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x958]
call fcn.1000d445
push 2
lea ecx, [ebp - 0x988]
call fcn.1000d3e3
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x254], 0x53b26bdd
mov dword [ebp - 0xcd8], 0xffffffff
mov dword [ebp - 0x828], 0xe8e1b881
mov dword [ebp - 0xca4], 6
mov dword [ebp - 0xb18], 0x4f545ee2
mov dword [ebp - 0xb28], 0x3d0b5486
push 3
lea ecx, [ebp - 0x968]
call fcn.1000d3e3
mov byte [ebp - 4], 0x14
mov dword [ebp - 0xb30], 1
mov dword [ebp - 0x5c4], 0
mov dword [ebp - 0x60], 0
jmp 0x10018aca
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x10018ae6
push dword [ebp - 0x60]
lea ecx, [ebp - 0x968]
call fcn.1000d4c0
mov dword [eax], 0xd60a
jmp 0x10018ac3
mov dword [ebp - 0x60], 0
jmp 0x10018af6
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x10018b0c
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x46c], 4
jmp 0x10018aef
mov dword [ebp - 0x254], 0
jmp 0x10018b25
mov eax, dword [ebp - 0x254]
dec eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffe6
je 0x10018d5f
mov dword [ebp - 0xb24], 0
mov dword [ebp - 0x45c], 6
mov dword [ebp - 0x484], 2
mov dword [ebp - 0x914], 0xfffffff9
mov dword [ebp - 0xbf4], 0xfffffff8
mov dword [ebp - 0xaf8], 0xfffffff6
mov dword [ebp - 0xaf4], 0xfffffff6
mov dword [ebp - 0xaf0], 0xfffffff6
mov dword [ebp - 0xaec], 0xfffffff6
mov dword [ebp - 0x1dc], 0
jmp 0x10018ba5
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 3
jge 0x10018bc1
mov eax, dword [ebp - 0x1dc]
mov dword [ebp + eax*4 - 0xc70], 0
jmp 0x10018b98
mov eax, dword [ebp - 0x5c4]
dec eax
mov dword [ebp - 0x5c4], eax
cmp dword [ebp - 0x45c], 0
je 0x10018cd3
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x67c], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x67c]
mov dword [ebp + eax - 0xaf8], ecx
cmp dword [ebp - 0x67c], 0
jne 0x10018c10
xor eax, eax
jne 0x10018c10
and dword [ebp - 0x464], 0
jmp 0x10018c1a
mov dword [ebp - 0x464], 1
push 0
lea ecx, [ebp - 0x968]
call fcn.1000d4c0
mov ecx, dword [ebp - 0x464]
cmp ecx, dword [eax]
jg 0x10018c3d
mov dword [ebp - 0x99c], 1
jmp 0x10018c44
and dword [ebp - 0x99c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc70]
mov dword [ebp - 0xb2c], eax
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x46c]
push 0
lea ecx, [ebp - 0x968]
call fcn.1000d4c0
cmp esi, dword [eax]
jle 0x10018c81
mov dword [ebp - 0x5cc], 1
jmp 0x10018c88
and dword [ebp - 0x5cc], 0
push 0
lea ecx, [ebp - 0x968]
call fcn.1000d4c0
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5cc]
jg 0x10018cab
mov dword [ebp - 0x6e4], 1
jmp 0x10018cb2
and dword [ebp - 0x6e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x46c]
add eax, dword [ebp - 0x6e4]
je 0x10018cd3
mov dword [ebp - 0x474], 1
jmp 0x10018cda
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x484]
cmp dword [ebp - 0x474], eax
jge 0x10018cf4
mov dword [ebp - 0x5d4], 1
jmp 0x10018cfb
and dword [ebp - 0x5d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc70]
add eax, dword [ebp - 0x5d4]
cmp eax, dword [ebp - 0x828]
jg 0x10018d22
mov dword [ebp - 0x47c], 1
jmp 0x10018d29
and dword [ebp - 0x47c], 0
cmp dword [ebp - 0x47c], 0
jae 0x10018d44
cmp dword [ebp - 0x914], 0
jne 0x10018d44
and dword [ebp - 0x684], 0
jmp 0x10018d4e
mov dword [ebp - 0x684], 1
mov eax, dword [ebp - 0x684]
mov dword [ebp - 0x484], eax
jmp 0x10018b18
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x968]
call fcn.1000d445
mov dword [ebp - 0x350], 0xeb9e9d60
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x830], 0x1cbe
cmp dword [ebp - 0x830], 0xa53
jge 0x10018e09
and dword [ebp - 0x21c], 0
jmp 0x10018dab
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 8
jge 0x10018dd2
push dword [ebp - 0x21c]
mov ecx, 0x108d8050
call fcn.1002ff90
mov edx, eax
mov ecx, 0x1065b710
call fcn.10030817
jmp 0x10018d9e
push 0
push 0
push 7
call fcn.10016127
add esp, 0xc
movzx eax, al
test eax, eax
je 0x10018df3
mov dword [ebp - 0x5dc], 0x1000b358
jmp 0x10018dfd
mov dword [ebp - 0x5dc], 0x1000b35c
push dword [ebp - 0x5dc]
call fcn.10052df3
pop ecx
mov dword [ebp - 0x68], 0xffffffff
mov dword [ebp - 0x4dc], 0x8393131e
mov dword [ebp - 0x12c], 0x978c7644
mov dword [ebp - 0x848], 0x2e769e88
cmp dword [ebp - 0x18], 0xf390
jle 0x10018e43
mov dword [ebp - 0x49c], 1
jmp 0x10018e4a
and dword [ebp - 0x49c], 0
cmp dword [ebp - 0x18], 7
jb 0x10018e5c
mov dword [ebp - 0x48c], 1
jmp 0x10018e63
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x48c]
cmp eax, 0x48b08158
jg 0x10018e7f
mov dword [ebp - 0x710], 1
jmp 0x10018e86
and dword [ebp - 0x710], 0
cmp dword [ebp - 0x710], 0xfff9
jb 0x10018e9e
mov dword [ebp - 0x494], 1
jmp 0x10018ea5
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x494], 0xfffffffb
je 0x10018eba
mov dword [ebp - 0x5e4], 1
jmp 0x10018ec1
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x5e4]
sub eax, dword [ebp - 0x18]
cmp dword [ebp - 0x49c], eax
jl 0x10018ede
mov dword [ebp - 0x68c], 1
jmp 0x10018ee5
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x68c], eax
jg 0x10018efc
mov dword [ebp - 0x4a4], 1
jmp 0x10018f03
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x68], 0x12
jmp 0x10018f1c
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jg 0x10019571
mov dword [ebp - 0x6bc], 0x1887
mov dword [ebp - 0x6b8], 0x1887
mov dword [ebp - 0x6b4], 0x1887
mov dword [ebp - 0x6b0], 0x1887
mov dword [ebp - 0x1ec], 3
mov dword [ebp - 0xa8], 0x1ef224b3
mov byte [ebp - 0x9b], 0
movzx eax, byte [ebp - 0x9b]
test eax, eax
je 0x10018f7c
push 0
call fcn.1002b84f
pop ecx
mov dword [ebp - 0x18], 0
jmp 0x10018f8c
cmp dword [ebp - 0x18], 3
jg 0x1001956c
mov dword [ebp - 0x9bc], 0xc844fc37
mov dword [ebp - 0x2b8], 0xffffffff
mov dword [ebp - 0xb0], 0xfffffff7
mov dword [ebp - 0x298], 2
mov dword [ebp - 0x91c], 1
mov dword [ebp - 0x1e4], 0
jmp 0x10018fe1
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 2
jge 0x10018ffd
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0x8b0], 0xbb218ad3
jmp 0x10018fd4
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x6bc], ecx
jge 0x10019018
mov dword [ebp - 0x5ec], 1
jmp 0x1001901f
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x6bc]
cmp dword [ebp - 0x5ec], eax
jl 0x1001903d
mov dword [ebp - 0x4ac], 1
jmp 0x10019044
and dword [ebp - 0x4ac], 0
push 2
pop eax
sub eax, dword [ebp - 0x4ac]
cmp eax, 0xfffffffc
je 0x10019063
or eax, 0xffffffff
je 0x10019063
mov dword [ebp - 0x6ec], 1
jmp 0x1001906a
and dword [ebp - 0x6ec], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6bc]
cmp dword [ebp - 0x6ec], eax
jne 0x10019091
mov eax, 0x7802
test eax, eax
jne 0x10019091
and dword [ebp - 0x4b4], 0
jmp 0x1001909b
mov dword [ebp - 0x4b4], 1
mov eax, dword [ebp - 0x9bc]
cmp dword [ebp - 0x4b4], eax
jl 0x100190b5
mov dword [ebp - 0x5f4], 1
jmp 0x100190bc
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x5f4]
add eax, 0xbab
cmp eax, dword [ebp - 0x1ec]
jg 0x100190db
mov dword [ebp - 0x4bc], 1
jmp 0x100190e2
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x4dc]
cmp dword [ebp - 0x4bc], eax
jl 0x100190fc
mov dword [ebp - 0x694], 1
jmp 0x10019103
and dword [ebp - 0x694], 0
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 0x694], eax
jne 0x1001911d
mov dword [ebp - 0x4c4], 1
jmp 0x10019124
and dword [ebp - 0x4c4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4c4]
mov dword [ebp + eax - 0x8b0], ecx
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0xcac], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xb34], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x6bc]
cmp dword [ebp - 0x68], eax
jne 0x1001916c
jmp 0x10018f15
mov dword [ebp - 0x860], 0x26a7609f
push 1
lea ecx, [ebp - 0xae8]
call fcn.1000d3e3
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x134], 0xffffffff
mov dword [ebp - 0x850], 0xfffffff9
push 0x13e2
push 0
lea eax, [ebp - 0xca0]
push eax
lea eax, [ebp - 0xae8]
push eax
call fcn.1001d674
add esp, 0x10
mov dword [ebp - 0x134], 0
jmp 0x100195d6
mov eax, dword [ebp - 0x134]
dec eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jl 0x10019622
mov dword [ebp - 0x924], 0x76df7e44
push 0x5f3e
lea eax, [ebp - 0x924]
push eax
push 0
lea eax, [ebp - 0xae8]
push eax
push 0x1af4
lea eax, [ebp - 0x134]
push eax
push 0xd2e
push 1
lea eax, [ebp - 0x850]
push eax
call fcn.10012c36
add esp, 0x24
jmp 0x100195c9
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xae8]
call fcn.1000d445
mov dword [ebp - 0x9d8], 0xfffffffa
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 0x2a0], 2
mov dword [ebp - 0x224], 0
jmp 0x10019665
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 1
jge 0x1001967e
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0x78], 0x57fd
jmp 0x10019658
mov dword [ebp - 0x2c], 0
jmp 0x1001968e
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x10019876
mov dword [ebp - 0x13c], 1
mov dword [ebp - 0x858], 0x7bc41bbb
mov dword [ebp - 0x1f4], 0
jmp 0x100196c5
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 2
jge 0x100196e1
mov eax, dword [ebp - 0x1f4]
mov dword [ebp + eax*4 - 0xa4c], 0xffffffff
jmp 0x100196b8
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x78], 0
je 0x10019818
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x78]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jge 0x10019710
mov dword [ebp - 0x50c], 1
jmp 0x10019717
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
je 0x10019733
cmp dword [ebp - 0x13c], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x78]
cmp dword [ebp + eax - 0xa4c], ecx
jge 0x10019758
mov dword [ebp - 0x6ac], 1
jmp 0x1001975f
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jg 0x10019774
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x78], 0
je 0x10019789
mov eax, 0x5c3421ad
test eax, eax
je 0x10019789
and dword [ebp - 0x624], 0
cmp dword [ebp - 0x624], 1
je 0x10019836
or eax, 0xffffffff
jne 0x10019836
and dword [ebp - 0x51c], 0
jmp 0x10019840
mov dword [ebp - 0x51c], 1
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x78]
cmp eax, dword [ebp - 0x51c]
jne 0x1001985b
mov dword [ebp - 0x30c], 1
jmp 0x10019862
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x30c]
sub eax, 8
mov dword [ebp - 0x858], eax
jmp 0x10019687
mov dword [ebp - 0x24c], 0
jmp 0x1001988f
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 2
jge 0x100198ab
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0xd4c], 0
jmp 0x10019882
mov byte [ebp - 0xcc], 0
movzx eax, byte [ebp - 0xcc]
test eax, eax
je 0x100198e2
push 0xe00
push 0
push 0x3017
push 1
push 0xa4d
push 0x1684
push 0x5656
call fcn.100141b6
add esp, 0x1c
mov byte [ebp - 0xce], 0
push 0
push 1
push 1
lea eax, [ebp - 0xce]
push eax
push 0x5115
push 0x1375
call fcn.10014028
add esp, 0x18
mov dword [ebp - 0x144], 0
jmp 0x10019921
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 2
jge 0x1001993d
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0xa54], 0x63e8e1b8
jmp 0x10019914
mov dword [ebp - 0x318], 0x42a4
mov dword [ebp - 0x1a0], 0xcbad86e5
mov dword [ebp - 0x268], 0xfffffffd
push 1
lea ecx, [ebp - 0x978]
call fcn.1000d3e3
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x92c], 0xa56718e5
mov dword [ebp - 0xb44], 1
mov dword [ebp - 0x194], 0
jmp 0x10019999
cmp dword [ebp - 0x194], 1
jge 0x100199bb
push dword [ebp - 0x194]
lea ecx, [ebp - 0x978]
call fcn.1000d4c0
mov dword [eax], 1
jmp 0x1001998c
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0xc04], eax
mov dword [ebp - 0x268], 0xffffe275
mov esi, dword [ebp - 0x1a0]
add esi, dword [ebp - 0x1a0]
push 0
lea ecx, [ebp - 0x978]
call fcn.1000d4c0
cmp esi, dword [eax]
je 0x100199fa
push 1
push 0x1223
push 1
call fcn.1001270c
add esp, 0xc
mov dword [ebp - 0xe0], 0x6ce125d
mov dword [ebp - 0xcb8], 0xaa8e55a4
mov dword [ebp - 0xba4], 0xfffffffd
mov dword [ebp - 0xc54], 0xe5809974
mov dword [ebp - 0xbac], 1
cmp dword [ebp - 0xe0], 0
je 0x1001b77f
mov dword [ebp - 0x7d4], 0x250db856
mov dword [ebp - 0x7e4], 0xfdb69689
mov dword [ebp - 0x7ec], 0xfffffffb
mov byte [ebp - 0xd8], 0
movzx eax, byte [ebp - 0xd8]
test eax, eax
je 0x1001b6dc
push 0
push 0x28bc
push 0x2d17
push 0x614d
push 0x7efe
push 0x1fdd
call fcn.100293cf
add esp, 0x18
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xcec], eax
cmp dword [ebp - 0xe0], 0xcd
jle 0x1001b700
mov dword [ebp - 0x5c8], 1
jmp 0x1001b707
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x7d4]
cmp eax, dword [ebp - 0x5c8]
jl 0x1001b721
mov dword [ebp - 0x5d0], 1
jmp 0x1001b728
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x5d0], eax
jge 0x1001b742
mov dword [ebp - 0x5d8], 1
jmp 0x1001b749
and dword [ebp - 0x5d8], 0
cmp dword [ebp - 0x5d8], 0xaa810d21
ja 0x1001b76a
cmp dword [ebp - 0xe0], 0
je 0x1001b76a
mov dword [ebp - 0x7dc], 1
jmp 0x1001b771
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0x7e4]
mov dword [ebp - 0x7ec], eax
jmp 0x1001b7bf
mov dword [ebp - 0x7f4], 0xfffffffb
push 0
push 0x7783
push 0x1966
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x7f4]
push eax
push 0x3be4
push 0x4b77
push 0x3835
push 0x5f94
call fcn.100265b9
add esp, 0x24
mov dword [ebp - 0x14], 0x9b2c
mov dword [ebp - 0x9d4], 0x88e10e5e
mov dword [ebp - 0x9d0], 0x88e10e5e
mov dword [ebp - 0x9cc], 0x88e10e5e
mov dword [ebp - 0x9c8], 0x88e10e5e
mov dword [ebp - 0x7fc], 0x19d6
cmp dword [ebp - 0x7fc], 0x12d1
jge 0x1001b878
lea eax, [ebp - 0x804]
push eax
mov ecx, 0x1065b710
call fcn.1002f718
and dword [ebp - 0x88], 0
mov eax, dword [ebp - 0x88]
inc eax
imul eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x88]
inc ecx
inc ecx
imul eax, ecx
imul ecx, dword [ebp - 0x804], 6
cmp eax, ecx
jg 0x1001b84f
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
jmp 0x1001b81c
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
push fcn.10010bca
push dword [ebp - 0x88]
mov ecx, 0x1065b658
call fcn.1002f942
mov ecx, eax
call fcn.1000d2b8
mov dword [ebp - 0xf0], 0x23f126c
mov dword [ebp - 0xe8], 0x63090707
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jne 0x1001b8a0
mov dword [ebp - 0x618], 1
jmp 0x1001b8a7
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jg 0x1001b8bb
mov dword [ebp - 0x5e0], 1
jmp 0x1001b8c2
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x5e0], eax
jne 0x1001b8d9
mov dword [ebp - 0x80c], 1
jmp 0x1001b8e0
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x5e8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5e8]
mov dword [ebp + eax - 0x9d4], ecx
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xf0], eax
jne 0x1001b91f
mov dword [ebp - 0x814], 1
jmp 0x1001b926
and dword [ebp - 0x814], 0
or eax, 0xffffffff
cmp eax, 0x5b611fb8
jge 0x1001b942
cmp dword [ebp - 0xf0], 0
jne 0x1001b942
and dword [ebp - 0x5f0], 0
jmp 0x1001b94c
mov dword [ebp - 0x5f0], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x5f0], eax
jne 0x1001b963
mov dword [ebp - 0x5f8], 1
jmp 0x1001b96a
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x5f8], eax
je 0x1001b981
mov dword [ebp - 0x600], 1
jmp 0x1001b988
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x600]
test eax, eax
jne 0x1001b9a5
cmp dword [ebp - 0x14], 0
jne 0x1001b9a5
and dword [ebp - 0x608], 0
jmp 0x1001b9af
mov dword [ebp - 0x608], 1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x608]
sub ecx, dword [ebp - 0x14]
add eax, ecx
cmp eax, dword [ebp - 0x14]
jle 0x1001b9d7
cmp dword [ebp - 0xf0], 0
je 0x1001b9d7
mov dword [ebp - 0x610], 1
jmp 0x1001b9de
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x610], eax
jl 0x1001b9f5
mov dword [ebp - 0x620], 1
jmp 0x1001b9fc
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x618]
imul eax, dword [ebp - 0x620]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe8], 6
jmp 0x1001ba28
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 9
jg 0x1001bbce
mov dword [ebp - 0x174], 6
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x174], eax
jl 0x1001ba56
mov dword [ebp - 0x628], 1
jmp 0x1001ba5d
and dword [ebp - 0x628], 0
imul eax, dword [ebp - 0x628], 0xffffffff
cmp eax, dword [ebp - 0x174]
jg 0x1001ba78
mov dword [ebp - 0x630], 1
jmp 0x1001ba7f
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x630], eax
je 0x1001ba96
mov dword [ebp - 0x638], 1
jmp 0x1001ba9d
and dword [ebp - 0x638], 0
cmp dword [ebp - 0x638], 0xfb861a71
je 0x1001bab5
mov dword [ebp - 0x648], 1
jmp 0x1001babc
and dword [ebp - 0x648], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9d4]
mov dword [ebp - 0x640], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x640]
mov dword [ebp + eax - 0x9d4], ecx
mov eax, dword [ebp - 0x640]
cmp eax, dword [ebp - 0x648]
jle 0x1001bb02
cmp dword [ebp - 0xf0], 0
jne 0x1001bb02
and dword [ebp - 0x650], 0
jmp 0x1001bb0c
mov dword [ebp - 0x650], 1
mov eax, dword [ebp - 0xe8]
cmp eax, dword [ebp - 0x650]
jle 0x1001bb26
mov dword [ebp - 0x658], 1
jmp 0x1001bb2d
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x658], eax
jl 0x1001bb47
mov dword [ebp - 0x81c], 1
jmp 0x1001bb4e
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0xbb4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc64], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9d4]
mov dword [ebp - 0xbbc], eax
imul eax, dword [ebp - 0x174], 0
cmp eax, 0xcbded69b
jae 0x1001bb94
push 0xfffffffffffffffd
pop eax
test eax, eax
jne 0x1001bb94
and dword [ebp - 0x660], 0
jmp 0x1001bb9e
mov dword [ebp - 0x660], 1
cmp dword [ebp - 0x660], 0xc08f497c
jb 0x1001bbb6
mov dword [ebp - 0x668], 1
jmp 0x1001bbbd
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0xf0], eax
jmp 0x1001ba1b
push 4
push 0x1000
mov eax, dword [ebp - 0x58]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x670]
add ecx, dword [eax + 0xc]
push ecx
push 0x2e0d
push 0x38ab
call fcn.108dc000
pop ecx
pop ecx
call eax
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x58]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x824]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x2cc]
call fcn.10048041
add esp, 0xc
push 4
lea ecx, [ebp - 0x9a8]
call fcn.1000d3e3
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x100], 0xdba76aab
mov dword [ebp - 0x82c], 1
push 0x3247
push 0x2dec
push 1
push 0x7051
lea eax, [ebp - 0xcc0]
push eax
push 0x5184
lea eax, [ebp - 0x9a8]
push eax
push 1
push 0x1835
call fcn.10012c36
add esp, 0x24
mov dword [ebp - 0x100], 0
jmp 0x1001bc96
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 3
jg 0x1001bd35
mov dword [ebp - 0xf8], 0xae8c9f36
mov dword [ebp - 0xf8], 0
jmp 0x1001bcc6
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 3
jg 0x1001bd01
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x9a8]
call fcn.1000d4c0
cmp dword [eax], 0
je 0x1001bce7
jmp 0x1001bd01
push dword [ebp - 0x100]
lea ecx, [ebp - 0x9a8]
call fcn.1000d4c0
cmp dword [eax], 0
je 0x1001bcff
jmp 0x1001bcb9
jmp 0x1001bcb9
push 0x6d40
lea eax, [ebp - 0x82c]
push eax
push 1
lea eax, [ebp - 0xf8]
push eax
push 1
push 1
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x9a8]
push eax
call fcn.10012d4a
add esp, 0x20
jmp 0x1001bc89
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9a8]
call fcn.1000d445
mov dword [ebp - 0x44], 0x6e5c7a00
mov dword [ebp - 0x680], 0
mov dword [ebp - 0x834], 0x29a275ff
mov dword [ebp - 0x240], 0
jmp 0x1001bd78
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 3
jge 0x1001bd94
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0xd1c], 0
jmp 0x1001bd6b
cmp dword [ebp - 0x44], 0
jne 0x1001bda9
cmp dword [ebp - 0x44], 0
jne 0x1001bda9
and dword [ebp - 0x678], 0
jmp 0x1001bdb3
mov dword [ebp - 0x678], 1
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x678]
test eax, eax
je 0x1001bdc7
cmp dword [ebp - 0x44], 0
jne 0x1001bdd5
or eax, 0xffffffff
jne 0x1001bdd5
and dword [ebp - 0x28c], 0
jmp 0x1001bddf
mov dword [ebp - 0x28c], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x28c]
mov dword [ebp + eax - 0xd1c], ecx
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x680], eax
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x680], eax
jg 0x1001be13
cmp dword [ebp - 0x44], 0
je 0x1001be13
cmp dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xbc4], eax
mov eax, 0x4aa0d722
dec eax
cmp eax, 0x7d7c
jg 0x1001be35
mov dword [ebp - 0x688], 1
jmp 0x1001be3c
and dword [ebp - 0x688], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x44]
sub eax, 0xfffc
cmp eax, dword [ebp - 0x688]
jg 0x1001be5b
mov dword [ebp - 0x690], 1
jmp 0x1001be62
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x690], eax
jg 0x1001be79
mov dword [ebp - 0x698], 1
jmp 0x1001be80
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0x834], eax
mov byte [ebp - 0xcb], 0
movzx eax, byte [ebp - 0xcb]
test eax, eax
je 0x1001bebb
push 1
push 1
push 0
push 0x263a
push 0x7a27
push 0x2fec
call fcn.10014028
add esp, 0x18
mov dword [ebp - 0x304], 0x462d5e48
mov dword [ebp - 0x300], 0x462d5e48
mov dword [ebp - 0x2fc], 0x462d5e48
mov dword [ebp - 0x2f8], 0x462d5e48
mov dword [ebp - 0x110], 0xfffffffc
push 4
lea ecx, [ebp - 0x770]
call fcn.1000d3e3
mov dword [ebp - 4], 0x1f
mov dword [ebp - 0x248], 0
jmp 0x1001bf1a
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 4
jge 0x1001bf3c
push dword [ebp - 0x248]
lea ecx, [ebp - 0x770]
call fcn.1000d4c0
mov dword [eax], 3
jmp 0x1001bf0d
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x304], 0
jmp 0x1001bf6a
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x304]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x304], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x304], 0x15
jge 0x1001c2e1
mov dword [ebp - 0x17c], 0x9a971867
mov dword [ebp - 0x84c], 1
mov dword [ebp - 0x83c], 0x189f
cmp dword [ebp - 0x83c], 0x1194
jge 0x1001c174
lea ecx, [ebp - 0x758]
call fcn.1000d03c
mov byte [ebp - 4], 0x20
lea edx, [ebp - 0x758]
mov ecx, 0x1065b710
call fcn.1003083e
and dword [ebp - 0x29c], 0
and dword [ebp - 0x2ac], 0
and dword [ebp - 0x2bc], 0
and dword [ebp - 0x108], 0
jmp 0x1001bff6
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
lea ecx, [ebp - 0x758]
call fcn.1000d735
cmp dword [ebp - 0x108], eax
jae 0x1001c084
push dword [ebp - 0x108]
lea ecx, [ebp - 0x758]
call fcn.1000eca0
movsx eax, byte [eax]
cmp eax, 0x31
jne 0x1001c031
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
jmp 0x1001c07f
push dword [ebp - 0x108]
lea ecx, [ebp - 0x758]
call fcn.1000eca0
movsx eax, byte [eax]
cmp eax, 0x32
jne 0x1001c059
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
jmp 0x1001c07f
push dword [ebp - 0x108]
lea ecx, [ebp - 0x758]
call fcn.1000eca0
movsx eax, byte [eax]
cmp eax, 0x33
jne 0x1001c07f
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
jmp 0x1001bfe9
lea ecx, [ebp - 0x758]
call fcn.1002f6a0
and dword [ebp - 0x294], 0
jmp 0x1001c0a5
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
mov eax, dword [ebp - 0x294]
cmp eax, dword [ebp - 0x29c]
jge 0x1001c0c5
push 0x1000b37c
lea ecx, [ebp - 0x758]
call fcn.1002f681
jmp 0x1001c098
and dword [ebp - 0x2a4], 0
jmp 0x1001c0db
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x2a4]
cmp eax, dword [ebp - 0x2ac]
jge 0x1001c0fb
push 0x1000b380
lea ecx, [ebp - 0x758]
call fcn.1002f681
jmp 0x1001c0ce
and dword [ebp - 0x2b4], 0
jmp 0x1001c111
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
cmp eax, dword [ebp - 0x2bc]
jge 0x1001c131
push 0x1000b384
lea ecx, [ebp - 0x758]
call fcn.1002f681
jmp 0x1001c104
lea ecx, [ebp - 0x758]
call fcn.1000d735
dec eax
push eax
lea ecx, [ebp - 0x758]
call fcn.1000ebef
push fcn.10010bca
lea edx, [ebp - 0x758]
mov ecx, 0x1065b658
call fcn.1003067a
mov ecx, eax
call fcn.1000d2b8
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x758]
call fcn.1000d09f
mov dword [ebp - 0x250], 0
jmp 0x1001c18d
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 3
jge 0x1001c1a9
mov eax, dword [ebp - 0x250]
mov dword [ebp + eax*4 - 0xa00], 0x7078
jmp 0x1001c180
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa00]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0xc74], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa00]
mov dword [ebp - 0xbcc], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x304]
sub eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x110], eax
jg 0x1001c202
mov dword [ebp - 0x6a0], 1
jmp 0x1001c209
and dword [ebp - 0x6a0], 0
cmp dword [ebp - 0x6a0], 0x5edade09
je 0x1001c221
mov dword [ebp - 0x6a8], 1
jmp 0x1001c228
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
je 0x1001c259
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa00], 0
je 0x1001c259
mov dword [ebp - 0x6c8], 1
jmp 0x1001c260
and dword [ebp - 0x6c8], 0
cmp dword [ebp - 0x6c8], 6
jle 0x1001c275
mov dword [ebp - 0x844], 1
jmp 0x1001c27c
and dword [ebp - 0x844], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xa00], 0xfffffffc
jne 0x1001c298
mov dword [ebp - 0x2c4], 1
jmp 0x1001c29f
and dword [ebp - 0x2c4], 0
push 1
lea ecx, [ebp - 0x770]
call fcn.1000d4c0
mov ecx, dword [ebp - 0x2c4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x84c], eax
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1001c2dc
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1001bf4f
mov dword [ebp - 0x110], 0x16
jmp 0x1001c2fa
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x1c
je 0x1001c471
mov dword [ebp - 0x118], 1
mov dword [ebp - 0x258], 0
jmp 0x1001c32a
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 1
jge 0x1001c346
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0x6d0], 0xfffffff8
jmp 0x1001c31d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6d0]
imul eax, dword [ebp - 0x110]
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x304], eax
mov dword [ebp - 0x118], 0
jmp 0x1001c380
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 3
jg 0x1001c46c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6d0]
mov dword [ebp - 0xc98], eax
mov eax, dword [ebp - 0x118]
mov esi, dword [ebp + eax*4 - 0x304]
push 1
lea ecx, [ebp - 0x770]
call fcn.1000d4c0
imul eax, dword [eax], 0
cmp esi, eax
jne 0x1001c3cd
mov dword [ebp - 0x6d8], 1
jmp 0x1001c3d4
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp + eax*4 - 0x304]
cmp eax, dword [ebp - 0x6d8]
jne 0x1001c3f5
mov dword [ebp - 0x6e0], 1
jmp 0x1001c3fc
and dword [ebp - 0x6e0], 0
cmp dword [ebp - 0x6e0], 0
jle 0x1001c411
mov dword [ebp - 0x6e8], 1
jmp 0x1001c418
and dword [ebp - 0x6e8], 0
cmp dword [ebp - 0x6e8], 0
jne 0x1001c42d
mov dword [ebp - 0x854], 1
jmp 0x1001c434
and dword [ebp - 0x854], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x304]
mov dword [ebp - 0xbd4], eax
push 1
lea ecx, [ebp - 0x770]
call fcn.1000d4c0
mov esi, eax
push 3
lea ecx, [ebp - 0x770]
call fcn.1000d4c0
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x1001c373
jmp 0x1001c2ed
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x770]
call fcn.1000d445
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x2cc]
mov dword [eax + 8], ecx
jmp 0x10017b26
jmp 0x1001c54c
lea eax, [ebp + 0x14]
mov dword [ebp - 0x85c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x86c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x864], eax
mov eax, dword [ebp - 0x85c]
movzx eax, byte [eax]
test eax, eax
je 0x1001c4d7
push 0x19b7
push 0xab9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x1001c54c
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0x874], eax
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0x87c], eax
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x884], eax
mov eax, dword [ebp - 0x150]
mov dword [eax], 0
jmp 0x1001c526
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x150]
mov dword [ecx], eax
mov eax, dword [ebp - 0x150]
cmp dword [eax], 1
jge 0x1001c54c
mov eax, dword [ebp - 0x150]
push dword [eax]
mov ecx, dword [ebp - 0x884]
call fcn.1000d4c0
mov dword [eax], 1
jmp 0x1001c515
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret