Function at 0x10025662
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006773f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c8
push esi
mov dword [ebp - 0x108], 0x8a61928c
mov dword [ebp - 0x108], 0xffffffe5
jmp 0x100256a4
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0xc
jg 0x10025728
mov dword [ebp - 0xb4], 0
jmp 0x100256c6
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x100256e2
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x414], 8
jmp 0x100256b9
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x414], 0
jmp 0x1002570d
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x414]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x414], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x414], 0xffffffe5
jne 0x10025723
call fcn.1002484e
jmp 0x100256f4
jmp 0x10025697
mov byte [ebp - 0x5f], 0
lea eax, [ebp - 0x5f]
push eax
call fcn.10024887
pop ecx
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x4a4], 1
mov byte [ebp - 0x62], 0
lea eax, [ebp - 0x62]
push eax
call fcn.100248af
pop ecx
mov byte [ebp - 0x46], 0
push 0
push 0x571e
lea eax, [ebp - 0x46]
push eax
push 0x6ce9
push 1
push 0x4cac
push 0x85d
push 0x6f0b
push 0x23c1
call fcn.1001e38c
add esp, 0x24
mov dword [ebp - 0x18], 0xd4e79
mov dword [ebp - 0x38], 8
mov dword [ebp - 0x2c], 0
jmp 0x100257a2
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x100257b5
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x24], 0xe1abe8f2
jmp 0x1002579b
mov dword [ebp - 0x2c], 0
jmp 0x100257c5
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x100257db
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x5b0], 0xb8492355
jmp 0x100257be
cmp dword [ebp - 0x18], 0
je 0x100257f3
cmp dword [ebp - 0x18], 0
je 0x100257f3
mov dword [ebp - 0x240], 1
jmp 0x100257fa
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x3a0], 0
jne 0x1002581f
mov dword [ebp - 0x1cc], 1
jmp 0x10025826
and dword [ebp - 0x1cc], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x24]
cmp dword [ebp + eax - 0x24], ecx
jl 0x10025848
mov dword [ebp - 0x3bc], 1
jmp 0x1002584f
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4b0], eax
imul eax, dword [ebp - 0x18], 0x4cd0
cmp eax, 0xffffffff
jne 0x10025870
mov dword [ebp - 0x3c4], 1
jmp 0x10025877
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c0], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4c8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, 0xc7a2
sub ecx, dword [ebp + eax - 0x24]
jne 0x100258b9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24], 0
jne 0x100258b9
and dword [ebp - 0x2e4], 0
jmp 0x100258c3
mov dword [ebp - 0x2e4], 1
mov eax, dword [ebp - 0x1cc]
cmp eax, dword [ebp - 0x2e4]
je 0x100258e3
cmp dword [ebp - 0x38], 0
je 0x100258e3
mov dword [ebp - 0x2dc], 1
jmp 0x100258ea
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x2dc], eax
je 0x10025901
mov dword [ebp - 0x180], 1
jmp 0x10025908
and dword [ebp - 0x180], 0
cmp dword [ebp - 0x180], 0xb51ad5b4
jae 0x10025920
mov dword [ebp - 0x188], 1
jmp 0x10025927
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x240]
cmp eax, dword [ebp - 0x188]
jg 0x10025a99
mov dword [ebp - 0x88], 7
mov dword [ebp - 0x128], 0x6c1f5e2d
mov dword [ebp - 0x3cc], 0x840ef1f3
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4d0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
mov dword [ebp - 0x4d8], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4f0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
cmp dword [ebp - 0x128], eax
jle 0x100259af
mov dword [ebp - 0x2a0], 1
jmp 0x100259b6
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x2a0], eax
jge 0x100259d0
mov dword [ebp - 0x190], 1
jmp 0x100259d7
and dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x190], eax
je 0x100259ee
mov dword [ebp - 0x248], 1
jmp 0x100259f5
and dword [ebp - 0x248], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
cmp dword [ebp - 0x248], eax
jg 0x10025a13
mov dword [ebp - 0x198], 1
jmp 0x10025a1a
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x88]
imul eax, dword [ebp - 0x88]
add eax, dword [ebp - 0x198]
cmp dword [ebp - 0x88], eax
jle 0x10025a41
mov dword [ebp - 0x2d0], 1
jmp 0x10025a48
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x128]
add eax, dword [ebp - 0x2d0]
cmp eax, dword [ebp - 0x38]
je 0x10025a65
mov dword [ebp - 0x1a0], 1
jmp 0x10025a6c
and dword [ebp - 0x1a0], 0
cmp dword [ebp - 0x1a0], 0xfffffffe
jne 0x10025a81
mov dword [ebp - 0x250], 1
jmp 0x10025a88
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x3cc], eax
jmp 0x10025bf2
push 4
lea ecx, [ebp - 0x420]
call fcn.10028b5c
and dword [ebp - 4], 0
mov dword [ebp - 0x14c], 0x36b6a42
lea eax, [ebp - 0x4f8]
push eax
push 0x5ba2
lea eax, [ebp - 0x420]
push eax
push 1
push 1
push 0x2ed1
call fcn.1001bda8
add esp, 0x18
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x500], eax
cmp dword [ebp - 0x38], 0
je 0x10025af9
cmp dword [ebp - 0x38], 0
je 0x10025af9
mov dword [ebp - 0x1a8], 1
jmp 0x10025b00
and dword [ebp - 0x1a8], 0
push 0
lea ecx, [ebp - 0x420]
call fcn.10028ca3
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1a8]
jne 0x10025b23
mov dword [ebp - 0x2a8], 1
jmp 0x10025b2a
and dword [ebp - 0x2a8], 0
cmp dword [ebp - 0x2a8], 0xac9f
je 0x10025b42
mov dword [ebp - 0x134], 1
jmp 0x10025b49
and dword [ebp - 0x134], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x134]
mov dword [ebp + eax - 0x5b0], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
imul eax, dword [ebp - 0x134]
mov dword [ebp - 0x1b0], eax
push 0
lea ecx, [ebp - 0x420]
call fcn.10028ca3
mov ecx, dword [ebp - 0x1b0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x1b0], eax
jl 0x10025ba2
mov dword [ebp - 0x258], 1
jmp 0x10025ba9
and dword [ebp - 0x258], 0
cmp dword [ebp - 0x258], 3
je 0x10025bbe
mov dword [ebp - 0x1b8], 1
jmp 0x10025bc5
and dword [ebp - 0x1b8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
imul eax, dword [ebp - 0x1b8]
imul eax, dword [ebp - 0x14c]
mov dword [ebp - 0x14c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x420]
call fcn.10028c61
mov dword [ebp - 0x40], 3
mov dword [ebp - 0x68], 0x885ea6ed
mov dword [ebp - 0x354], 4
mov dword [ebp - 0x3d4], 0x1b85
cmp dword [ebp - 0x3d4], 0x69f
jge 0x10025cac
and dword [ebp - 0x2e8], 0
lea eax, [ebp - 0x2e8]
push eax
push 0x10008ae8
call fcn.1004eb10
pop ecx
pop ecx
push dword [ebp - 0x2e8]
lea eax, [ebp - 0x470]
push eax
call fcn.1002554e
pop ecx
pop ecx
mov dword [ebp - 4], 1
and dword [ebp - 0xf0], 0
jmp 0x10025c6f
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
lea ecx, [ebp - 0x470]
call fcn.10028c9a
cmp dword [ebp - 0xf0], eax
jae 0x10025c9d
push dword [ebp - 0xf0]
lea ecx, [ebp - 0x470]
call fcn.10028ca3
push dword [eax]
call fcn.100255d5
pop ecx
jmp 0x10025c62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x470]
call fcn.10028c61
push 2
lea ecx, [ebp - 0x53c]
call fcn.10028b5c
mov dword [ebp - 4], 2
push 0x61ed
push 1
push 0
push 0x24cc
push 0x890
lea eax, [ebp - 0x50c]
push eax
push 0x4bbe
push 1
push 0x6002
lea eax, [ebp - 0x53c]
push eax
call fcn.10021d52
add esp, 0x28
cmp dword [ebp - 0x40], 0
je 0x10025d10
mov eax, 0x4c7b7f60
test eax, eax
je 0x10025d10
mov dword [ebp - 0x1c0], 1
jmp 0x10025d17
and dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0x40], eax
je 0x10025d37
cmp dword [ebp - 0x68], 0
je 0x10025d37
mov dword [ebp - 0x260], 1
jmp 0x10025d3e
and dword [ebp - 0x260], 0
cmp dword [ebp - 0x260], 2
je 0x10025d53
mov dword [ebp - 0x1c8], 1
jmp 0x10025d5a
and dword [ebp - 0x1c8], 0
cmp dword [ebp - 0x1c8], 0xe752
jg 0x10025d72
mov dword [ebp - 0x2b0], 1
jmp 0x10025d79
and dword [ebp - 0x2b0], 0
cmp dword [ebp - 0x2b0], 0xfffffff6
je 0x10025d8e
mov dword [ebp - 0x1d0], 1
jmp 0x10025d95
and dword [ebp - 0x1d0], 0
cmp dword [ebp - 0x1d0], 0x8ea5
jne 0x10025dad
mov dword [ebp - 0x268], 1
jmp 0x10025db4
and dword [ebp - 0x268], 0
cmp dword [ebp - 0x268], 7
jbe 0x10025dc9
mov dword [ebp - 0x1d8], 1
jmp 0x10025dd0
and dword [ebp - 0x1d8], 0
cmp dword [ebp - 0x1d8], 0
jae 0x10025de5
mov dword [ebp - 0x2d8], 1
jmp 0x10025dec
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x2d8], eax
jl 0x10025e06
cmp dword [ebp - 0x68], 0
jne 0x10025e06
and dword [ebp - 0x1e0], 0
jmp 0x10025e10
mov dword [ebp - 0x1e0], 1
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x1e0], eax
jge 0x10025e27
mov dword [ebp - 0x270], 1
jmp 0x10025e2e
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x270], eax
jle 0x10025e5d
mov byte [ebp - 0x41], 0
movzx eax, byte [ebp - 0x41]
test eax, eax
je 0x10025e58
push 1
push 0
push 0x4879
push 1
call fcn.1001e03e
add esp, 0x10
jmp 0x10025ede
mov dword [ebp - 0x3dc], 0
mov dword [ebp - 0x40], 0
jmp 0x10025e77
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x39
je 0x10025ed0
mov dword [ebp - 0x3b4], 2
push 0x6b4f
push 1
lea eax, [ebp - 0x40]
push eax
push 0x1127
push 1
lea eax, [ebp - 0x3dc]
push eax
push 0x1acb
lea eax, [ebp - 0x3b4]
push eax
push 0x50f8
push 0x5abc
lea eax, [ebp - 0x354]
push eax
push 0x68e7
lea eax, [ebp - 0x68]
push eax
call fcn.1001beaa
add esp, 0x34
jmp 0x10025e70
mov byte [ebp - 0x61], 0
lea eax, [ebp - 0x61]
push eax
call fcn.100248e2
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x53c]
call fcn.10028c61
push 1
push 1
push 0x4c9f
lea eax, [ebp + 8]
push eax
push 0x7b85
push 0x3092
push 0x7c7a
lea eax, [ebp - 0x138]
push eax
push 1
call fcn.1001c1d1
add esp, 0x24
mov dword [ebp - 0xbc], 0xd5e48d32
mov byte [ebp - 0x48], 0
lea eax, [ebp - 0x48]
push eax
call fcn.100249d5
pop ecx
mov dword [ebp - 0xbc], 0
jmp 0x10025f4b
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xfffffffe
jg 0x10025f64
mov byte [ebp - 0x4d], 0
lea eax, [ebp - 0x4d]
push eax
call fcn.10024a21
pop ecx
jmp 0x10025f3e
mov eax, dword [ebp - 0x138]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10026302
mov dword [ebp - 0x4c], 0x63f9e923
mov dword [ebp - 0x13c], 0x8593f9be
mov dword [ebp - 0x434], 0x8951
mov dword [ebp - 0x430], 0x8951
mov dword [ebp - 0x42c], 0x8951
mov dword [ebp - 0x428], 0x8951
lea ecx, [ebp - 0x14d]
call fcn.10028cea
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x5c4]
call fcn.10028ced
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x3ec]
call fcn.10028c3b
mov dword [ebp - 4], 3
mov dword [ebp - 0x3d8], 0xe5950169
mov dword [ebp - 0x28], 0
jmp 0x10026007
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1002601d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5a4], 0
jmp 0x10026000
mov dword [ebp - 0x33c], 0x1a70
cmp dword [ebp - 0x33c], 0xd69
jge 0x100260da
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0xfc]
push eax
push 0x10008b0c
call fcn.1004eb10
add esp, 0x10
cmp dword [ebp - 0xf4], 0
jle 0x10026094
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0xfc]
jge 0x10026094
cmp dword [ebp - 0xc4], 0
jle 0x10026094
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0xfc]
jge 0x10026094
push 0x10008cd4
call fcn.1004f621
pop ecx
jmp 0x100260da
cmp dword [ebp - 0xf4], 0
jl 0x100260cf
mov eax, dword [ebp - 0xf4]
cmp eax, dword [ebp - 0xfc]
jg 0x100260cf
cmp dword [ebp - 0xc4], 0
jl 0x100260cf
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0xfc]
jg 0x100260cf
push 0x10008ba0
call fcn.1004f621
pop ecx
jmp 0x100260da
push 0x10008cd8
call fcn.1004f621
pop ecx
mov dword [ebp - 0x28], 0
jmp 0x100260ea
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x10026100
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x348], 0xfffd
jmp 0x100260e3
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], eax
jge 0x10026114
mov dword [ebp - 0x3c0], 1
jmp 0x1002611b
and dword [ebp - 0x3c0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5a4]
inc eax
cmp eax, dword [ebp - 0x4c]
jle 0x1002613a
mov dword [ebp - 0x340], 1
jmp 0x10026141
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x514], eax
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4c]
cmp dword [ebp + eax - 0x5a4], ecx
jl 0x10026178
mov dword [ebp - 0x1e8], 1
jmp 0x1002617f
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x1e8], eax
jg 0x10026196
mov dword [ebp - 0x2b8], 1
jmp 0x1002619d
and dword [ebp - 0x2b8], 0
push 2
lea ecx, [ebp - 0x3ec]
call fcn.10028ca3
mov ecx, dword [ebp - 0x2b8]
cmp ecx, dword [eax]
jg 0x100261c0
mov dword [ebp - 0x1f0], 1
jmp 0x100261c7
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x1f0]
jg 0x100261de
mov dword [ebp - 0x278], 1
jmp 0x100261e5
and dword [ebp - 0x278], 0
cmp dword [ebp - 0x278], 0x29989d22
jl 0x100261fd
mov dword [ebp - 0x1f8], 1
jmp 0x10026204
and dword [ebp - 0x1f8], 0
push 0
lea ecx, [ebp - 0x3ec]
call fcn.10028ca3
mov ecx, dword [ebp - 0x1f8]
cmp ecx, dword [eax]
jl 0x10026227
mov dword [ebp - 0x2f8], 1
jmp 0x1002622e
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x2f8]
neg eax
cmp eax, 0xeaa3
jg 0x10026249
mov dword [ebp - 0x200], 1
jmp 0x10026250
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x200], eax
jle 0x10026267
mov dword [ebp - 0x398], 1
jmp 0x1002626e
and dword [ebp - 0x398], 0
push 1
lea ecx, [ebp - 0x3ec]
call fcn.10028ca3
push 2
lea ecx, [ebp - 0x3ec]
call fcn.10028ca3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x348], 0x34f1d4b0
jne 0x100262a7
mov dword [ebp - 0x280], 1
jmp 0x100262ae
and dword [ebp - 0x280], 0
cmp dword [ebp - 0x280], 0x2500428
jle 0x100262c6
mov dword [ebp - 0x160], 1
jmp 0x100262cd
and dword [ebp - 0x160], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x160]
mov dword [ebp + eax - 0x5a4], ecx
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x3d8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3ec]
call fcn.10028c61
xor eax, eax
jmp 0x10027ffe
push 4
lea ecx, [ebp - 0x2f4]
call fcn.10028b5c
mov dword [ebp - 4], 4
mov dword [ebp - 0x350], 0xc01e6e2b
mov dword [ebp - 0x30], 0
jmp 0x10026330
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x10026346
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x408], 6
jmp 0x10026329
mov dword [ebp - 0x30], 0
jmp 0x10026356
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x10026372
push dword [ebp - 0x30]
lea ecx, [ebp - 0x2f4]
call fcn.10028ca3
mov dword [eax], 0x42c70bb7
jmp 0x1002634f
mov byte [ebp - 0x5e], 0
push 1
push 1
lea eax, [ebp - 0x5e]
push eax
push 0x7cad
push 0x402
call fcn.1001c866
add esp, 0x14
push 3
lea ecx, [ebp - 0x2f4]
call fcn.10028ca3
mov dword [eax], 2
jmp 0x100263c9
push 3
lea ecx, [ebp - 0x2f4]
call fcn.10028ca3
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x208]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x208]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x2f4]
call fcn.10028ca3
cmp dword [eax], 0
jl 0x100264a1
mov dword [ebp - 0x144], 0xfffffff9
push 3
lea ecx, [ebp - 0x2f4]
call fcn.10028ca3
mov eax, dword [eax]
imul esi, dword [ebp + eax*4 - 0x408], 0xffffeb85
push 3
lea ecx, [ebp - 0x2f4]
call fcn.10028ca3
mov eax, dword [eax]
cmp esi, dword [ebp + eax*4 - 0x408]
jg 0x10026427
mov dword [ebp - 0x2c0], 1
jmp 0x1002642e
and dword [ebp - 0x2c0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x408]
cmp dword [ebp - 0x2c0], eax
jl 0x1002644e
mov dword [ebp - 0x210], 1
jmp 0x10026455
and dword [ebp - 0x210], 0
push 3
lea ecx, [ebp - 0x2f4]
call fcn.10028ca3
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x408]
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x144]
imul eax, dword [ebp - 0x210]
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x144], 0
je 0x1002649c
jmp 0x100263a5
jmp 0x100263a5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2f4]
call fcn.10028c61
push 0x72ac
lea eax, [ebp - 0x138]
push eax
push 0xfe1
push 0x6477
lea eax, [ebp + 8]
push eax
push 1
lea eax, [ebp - 0x94]
push eax
push 0x665a
push 1
call fcn.1001c924
add esp, 0x24
mov dword [ebp - 0x290], 0xffffffff
mov dword [ebp - 0x158], 0x63785551
mov dword [ebp - 0x2e0], 0x466e9f08
mov dword [ebp - 0x358], 0xafd77ccc
mov dword [ebp - 0x34], 0
jmp 0x1002651a
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x1002652d
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x70], 0x648261f
jmp 0x10026513
mov dword [ebp - 0x34], 0
jmp 0x1002653d
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x10026553
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x508], 0xf5f40e13
jmp 0x10026536
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x70], 0x17
jmp 0x10026578
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x70]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x70], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x70], 0xfffffff4
jl 0x100266d2
mov dword [ebp - 0x3c], 0x6fd4
mov byte [ebp - 0x55], 0
movzx eax, byte [ebp - 0x55]
test eax, eax
je 0x100265af
push 1
push 1
push 0x5bf0
push 1
call fcn.1001ca25
add esp, 0x10
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
jg 0x100265c3
mov dword [ebp - 0x288], 1
jmp 0x100265ca
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x288]
jne 0x100265e1
mov dword [ebp - 0x218], 1
jmp 0x100265e8
and dword [ebp - 0x218], 0
mov dword [ebp - 0x158], 0xffffffff
mov eax, dword [ebp - 0x158]
sub eax, dword [ebp - 0x218]
mov dword [ebp - 0x2e0], eax
je 0x10026618
cmp dword [ebp - 0x3c], 0
je 0x10026618
mov dword [ebp - 0x320], 1
jmp 0x1002661f
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x158], 0x7d8cf4c5
jne 0x10026640
mov dword [ebp - 0x220], 1
jmp 0x10026647
and dword [ebp - 0x220], 0
cmp dword [ebp - 0x220], 0x709b
je 0x1002665f
mov dword [ebp - 0x228], 1
jmp 0x10026666
and dword [ebp - 0x228], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x70]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x290]
cmp eax, dword [ebp - 0x228]
jne 0x10026688
cmp dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x3c]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x70]
cmp eax, dword [ebp - 0x3c]
jne 0x100266a7
mov dword [ebp - 0x12c], 1
jmp 0x100266ae
and dword [ebp - 0x12c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x12c]
mov dword [ebp + eax - 0x508], ecx
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x358], eax
jmp 0x10026563
mov eax, dword [ebp - 0x94]
cmp dword [eax], 0x4550
je 0x10026796
push 4
lea ecx, [ebp - 0x54c]
call fcn.10028b5c
mov dword [ebp - 4], 5
push 1
lea eax, [ebp - 0x54c]
push eax
push 0x4acb
push 0x5600
push 0xc9
push 1
push 0x4ee9
push 0x376c
push 1
push 0x288d
lea eax, [ebp - 0x52c]
push eax
push 0x54c7
call fcn.1001cb2e
add esp, 0x30
mov byte [ebp - 0x60], 0
lea eax, [ebp - 0x60]
push eax
call fcn.10024a44
pop ecx
mov byte [ebp - 0x42], 0
movzx eax, byte [ebp - 0x42]
test eax, eax
je 0x10026780
push 1
push 0x2f86
push 0x524d
push 0x5387
push 0x29b6
push 0x7a7d
push 0
push 0x25ab
push 0x6bb
call fcn.10020485
add esp, 0x24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54c]
call fcn.10028c61
xor eax, eax
jmp 0x10027ffe
mov dword [ebp - 0x90], 0x24a8c6a5
mov dword [ebp - 0x590], 0xfffffff7
mov dword [ebp - 0x484], 2
mov dword [ebp - 0x490], 0x4198d72a
mov dword [ebp - 0x550], 1
mov dword [ebp - 0x49c], 0
mov dword [ebp - 0x4a0], 0xfffffffc
mov dword [ebp - 0x4a8], 0x826f3938
mov dword [ebp - 0x510], 0x2715ee56
mov dword [ebp - 0x4ac], 0xe2e4ed38
mov dword [ebp - 0x594], 0xfa1a8f1e
push 1
lea ecx, [ebp - 0x55c]
call fcn.10028b5c
mov dword [ebp - 4], 6
mov dword [ebp - 0x4b4], 1
mov dword [ebp - 0x368], 8
mov dword [ebp - 0xcc], 0
jmp 0x10026845
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 1
jge 0x10026867
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x55c]
call fcn.10028ca3
mov dword [eax], 0x6b7be2d3
jmp 0x10026838
mov dword [ebp - 0x90], 0xb
jmp 0x10026880
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x16
jne 0x1002695f
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x3a8], 1
mov dword [ebp - 0x3c8], 0x3187110e
mov dword [ebp - 0xa0], 5
jmp 0x100268c4
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0xfffffffa
jne 0x1002694c
mov dword [ebp - 0x98], 0xfffffffe
call fcn.10024a67
mov dword [ebp - 0x98], 0
jmp 0x100268f5
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xfffffff0
jne 0x10026947
mov dword [ebp - 0x360], 1
lea eax, [ebp - 0x3c8]
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x90]
push eax
push 1
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x3a8]
push eax
lea eax, [ebp - 0xa0]
push eax
push 0x2ee3
push 1
push 1
call fcn.1001d1ab
add esp, 0x28
jmp 0x100268e8
jmp 0x100268b7
mov byte [ebp - 0x43], 0
lea eax, [ebp - 0x43]
push eax
call fcn.10024a9c
pop ecx
jmp 0x10026873
push 0x249
push 1
lea eax, [ebp - 0x368]
push eax
push 0x3e58
push 0x5a60
push 0x582c
push 0x1bff
push 0xab4
push 1
push 0x2e07
push 0x4889
call fcn.1001d46d
add esp, 0x2c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x55c]
call fcn.10028c61
push 0x7e51
push 1
lea eax, [ebp - 0x94]
push eax
push 0x7b26
push 1
push 0x2a95
push 0x4106
lea eax, [ebp - 0xc8]
push eax
push 1
call fcn.1001d58f
add esp, 0x24
mov dword [ebp - 0x3b0], 1
push 1
lea ecx, [ebp - 0x458]
call fcn.10028b5c
mov dword [ebp - 4], 7
mov dword [ebp - 0x3f0], 0x2401dbda
mov dword [ebp - 0x370], 0x868fdadf
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x518]
push eax
call fcn.10024c6b
pop ecx
pop ecx
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x370]
push eax
lea eax, [ebp - 0x3b0]
push eax
call fcn.10024cb3
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x458]
call fcn.10028c61
cmp dword [ebp - 0xc8], 0
jne 0x10026f56
mov dword [ebp - 0x78], 6
mov dword [ebp - 0x378], 0x1c06
cmp dword [ebp - 0x378], 0x807
jge 0x10026b0a
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x2c8]
push eax
lea eax, [ebp - 0x230]
push eax
push 0x10008b0c
call fcn.1004eb10
add esp, 0x10
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x2c8]
cmp eax, dword [ebp - 0x104]
jge 0x10026ad6
mov eax, dword [ebp - 0x104]
sub eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0x230]
jge 0x10026af0
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x298]
sub eax, dword [ebp - 0x238]
inc eax
push eax
push 0x10008afc
call fcn.1004f14f
pop ecx
pop ecx
mov dword [ebp - 0x178], 0x4accb24c
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x4bc], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x560], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
add eax, 0x459eeda5
cmp eax, 0xb783
jge 0x10026b4d
mov dword [ebp - 0x17c], 1
jmp 0x10026b54
and dword [ebp - 0x17c], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x17c], eax
jge 0x10026b6b
mov dword [ebp - 0x184], 1
jmp 0x10026b72
and dword [ebp - 0x184], 0
cmp dword [ebp - 0x184], 1
jne 0x10026b87
mov dword [ebp - 0x18c], 1
jmp 0x10026b8e
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x18c], eax
jg 0x10026ba5
mov dword [ebp - 0x194], 1
jmp 0x10026bac
and dword [ebp - 0x194], 0
cmp dword [ebp - 0x194], 0
jl 0x10026bc1
mov dword [ebp - 0x19c], 1
jmp 0x10026bc8
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x19c]
sub eax, dword [ebp - 0x78]
je 0x10026c72
mov dword [ebp - 0x3d0], 0x14e6
cmp dword [ebp - 0x3d0], 0x5f2
jge 0x10026c5f
lea eax, [ebp - 0x1a4]
push eax
push 0x10008ae4
call fcn.1004eb10
pop ecx
pop ecx
cmp dword [ebp - 0x1a4], 2
jg 0x10026c16
push 0x10008cdc
call fcn.1004f14f
pop ecx
jmp 0x10026c5f
push 0x10008ce0
call fcn.1004f14f
pop ecx
and dword [ebp - 0x130], 0
jmp 0x10026c37
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x1a4]
dec eax
dec eax
cmp dword [ebp - 0x130], eax
jge 0x10026c54
push 0x10008ce8
call fcn.1004f14f
pop ecx
jmp 0x10026c2a
push 0x10008b58
call fcn.1004f14f
pop ecx
mov byte [ebp - 0x45], 0
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x10026c70
call fcn.10024f30
jmp 0x10026c80
mov byte [ebp - 0x47], 0
lea eax, [ebp - 0x47]
push eax
call fcn.10024f4b
pop ecx
mov dword [ebp - 0x84], 0x57ad95e1
mov dword [ebp - 0xd4], 0
jmp 0x10026ca3
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 3
jge 0x10026cbf
mov eax, dword [ebp - 0xd4]
mov dword [ebp + eax*4 - 0x56c], 0x2db5
jmp 0x10026c96
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x56c]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x84], 2
jmp 0x10026cea
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jl 0x10026f4f
mov dword [ebp - 0x10c], 0xffffffff
mov dword [ebp - 0x480], 0x11d01887
mov dword [ebp - 0x47c], 0x11d01887
mov dword [ebp - 0x478], 0x11d01887
mov dword [ebp - 0x474], 0x11d01887
mov dword [ebp - 0x10c], 2
jmp 0x10026d42
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jl 0x10026f4a
push 3
lea ecx, [ebp - 0x310]
call fcn.10028b5c
mov dword [ebp - 4], 8
mov dword [ebp - 0xdc], 0
jmp 0x10026d7c
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 3
jge 0x10026d9e
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x310]
call fcn.10028ca3
mov dword [eax], 0x8ee41b66
jmp 0x10026d6f
push 0
lea ecx, [ebp - 0x310]
call fcn.10028ca3
and dword [eax], 0
jmp 0x10026dd4
push 0
lea ecx, [ebp - 0x310]
call fcn.10028ca3
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1ac]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1ac]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x310]
call fcn.10028ca3
cmp dword [eax], 2
jg 0x10026f36
mov dword [ebp - 0x114], 0xe9bf9f36
mov dword [ebp - 0x114], 0
jmp 0x10026e0d
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 2
jg 0x10026f31
mov dword [ebp - 0xe4], 0xa028ea38
mov dword [ebp - 0xe4], 0
jmp 0x10026e3d
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 2
jg 0x10026f2c
mov dword [ebp - 0x11c], 0xbbbdebf8
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x480], 0x74a52027
mov dword [ebp - 0x380], 0x2627
cmp dword [ebp - 0x380], 0xbc4
jge 0x10026ebc
lea eax, [ebp - 0x3b8]
push eax
push 0x10008afc
call fcn.1004eb10
pop ecx
pop ecx
mov eax, dword [ebp - 0x3b8]
and eax, 0x80000001
jns 0x10026ea0
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x10026eb1
push 0x10008cec
call fcn.1004f621
pop ecx
jmp 0x10026ebc
push 0x10008cf4
call fcn.1004f621
pop ecx
mov dword [ebp - 0x11c], 2
jmp 0x10026ed5
mov eax, dword [ebp - 0x11c]
dec eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jl 0x10026f27
push 0
lea ecx, [ebp - 0x310]
call fcn.10028ca3
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x56c], 0
je 0x10026ef9
jmp 0x10026f27
mov byte [ebp - 0x5d], 0
movzx eax, byte [ebp - 0x5d]
test eax, eax
je 0x10026f25
push 1
push 0x39a8
push 1
push 0x1597
push 0x736b
push 0xf71
call fcn.1001e14b
add esp, 0x18
jmp 0x10026ec8
jmp 0x10026e30
jmp 0x10026e00
jmp 0x10026db0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x310]
call fcn.10028c61
jmp 0x10026d35
jmp 0x10026cdd
xor eax, eax
jmp 0x10027ffe
push 1
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x4c4]
push eax
push 0x7c66
push 1
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.1001e986
add esp, 0x20
mov dword [ebp - 0xec], 0xffffffff
mov dword [ebp - 0xec], 8
jmp 0x10026faa
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0xfffffffa
jne 0x1002702e
mov dword [ebp - 0x8c], 0xf951fe77
mov dword [ebp - 0x124], 0
jmp 0x10026fd6
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 2
jge 0x10026ff2
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x48c], 0
jmp 0x10026fc9
mov dword [ebp - 0x8c], 0
jmp 0x1002700b
mov eax, dword [ebp - 0x8c]
dec eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xfffffff3
jle 0x10027029
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x8c]
mov dword [ebp + eax - 0x48c], ecx
jmp 0x10026ffe
jmp 0x10026f9d
lea eax, [ebp - 0x94]
push eax
push 0x14b0
push 0x72c3
lea eax, [ebp + 8]
push eax
push 1
push 0x7651
lea eax, [ebp - 0x1c]
push eax
push 1
push 0x6a4c
call fcn.1001eab0
add esp, 0x24
mov dword [ebp - 0x140], 0xffffffff
mov dword [ebp - 0x148], 0xa90611bc
mov dword [ebp - 0x1d4], 0x1355
mov dword [ebp - 0x118], 0
jmp 0x10027094
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 3
jge 0x100270b0
mov eax, dword [ebp - 0x118]
mov dword [ebp + eax*4 - 0x31c], 0x24cdb8fa
jmp 0x10027087
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x31c]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
je 0x1002711e
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x140]
cmp dword [ebp + eax - 0x31c], ecx
jg 0x100270f1
mov eax, 0x17c10977
test eax, eax
jne 0x100270f1
and dword [ebp - 0x1b4], 0
jmp 0x100270fb
mov dword [ebp - 0x1b4], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x31c]
imul eax, dword [ebp - 0x1b4]
test eax, eax
je 0x1002711e
mov dword [ebp - 0x1bc], 1
jmp 0x10027125
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x1bc], eax
jge 0x1002713f
mov dword [ebp - 0x388], 1
jmp 0x10027146
and dword [ebp - 0x388], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x31c]
mov dword [ebp - 0x520], eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x148], 0
je 0x10027192
mov eax, 0x32f3f608
test eax, eax
je 0x10027192
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x31c], 0
je 0x10027192
mov dword [ebp - 0x1c4], 1
jmp 0x10027199
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0x1c4], eax
jle 0x100271b3
mov dword [ebp - 0x174], 1
jmp 0x100271ba
and dword [ebp - 0x174], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x174]
mov dword [ebp + eax - 0x31c], ecx
lea eax, [ebp - 0x1d4]
push eax
call fcn.10024f76
pop ecx
push 0x465e
push 0x31f6
lea eax, [ebp - 0x3e0]
push eax
lea eax, [ebp - 0xc8]
push eax
push 0x247f
push 0x5528
lea eax, [ebp - 0x94]
push eax
push 1
push 0x71c1
push 1
push 1
push 0x249f
call fcn.1001ec9c
add esp, 0x30
mov dword [ebp - 0x1dc], 0xfffffff9
push 2
lea ecx, [ebp - 0x440]
call fcn.10028b5c
mov dword [ebp - 4], 9
mov dword [ebp - 0x9c], 0
jmp 0x10027251
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x1002726d
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x5bc], 0xfffffffd
jmp 0x10027244
lea eax, [ebp - 0x9c]
push eax
push 0x1856
push 1
push 1
push 0x3a87
lea eax, [ebp - 0x440]
push eax
push 0x2bb7
push 1
call fcn.1001ee92
add esp, 0x20
mov eax, dword [ebp - 0x1dc]
sub eax, 0x5e7c9335
cmp eax, dword [ebp - 0x1dc]
jne 0x100272b7
mov dword [ebp - 0x1e4], 1
jmp 0x100272be
and dword [ebp - 0x1e4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5bc]
cmp dword [ebp - 0x1e4], eax
jge 0x100272df
mov dword [ebp - 0x1ec], 1
jmp 0x100272e6
and dword [ebp - 0x1ec], 0
cmp dword [ebp - 0x1ec], 0
je 0x100272fb
mov dword [ebp - 0x1f4], 1
jmp 0x10027302
and dword [ebp - 0x1f4], 0
push 1
lea ecx, [ebp - 0x440]
call fcn.10028ca3
mov ecx, dword [ebp - 0x1f4]
mov dword [eax], ecx
call fcn.10024fd1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.10028c61
push 0x6601
push 1
lea eax, [ebp - 0x1c]
push eax
push 1
lea eax, [ebp - 0x3e0]
push eax
call fcn.1001f423
add esp, 0x14
push dword [ebp - 0x1c]
call fcn.10011787
pop ecx
test eax, eax
jne 0x100275ab
mov dword [ebp - 0x390], 0x1ada
cmp dword [ebp - 0x390], 0xe80
jge 0x10027523
lea eax, [ebp - 0x154]
push eax
push 0x10008ae8
call fcn.1004eb10
pop ecx
pop ecx
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x154]
dec eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x32c], 0
je 0x10027523
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x10008af4
call fcn.1004eb10
add esp, 0xc
mov eax, dword [ebp - 0x74]
dec eax
cdq
sub eax, edx
sar eax, 1
cmp dword [ebp - 0xa8], eax
jle 0x100273e1
push 0x10008bf8
call fcn.1004f621
pop ecx
jmp 0x10027385
or dword [ebp - 0x328], 0xffffffff
lea eax, [ebp - 0x328]
push eax
mov eax, dword [ebp - 0x74]
inc eax
push eax
lea ecx, [ebp - 0x3fc]
call fcn.10028e52
mov dword [ebp - 4], 0xa
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xf8], 2
jmp 0x10027433
mov eax, dword [ebp - 0xf8]
inc eax
inc eax
mov dword [ebp - 0xf8], eax
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xf8]
cmp eax, dword [ebp - 0x74]
jg 0x10027466
cmp dword [ebp - 0xa8], 0
jle 0x10027466
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x3fc]
call fcn.10028ca3
mov ecx, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
jmp 0x10027418
mov dword [ebp - 0xa4], 1
jmp 0x1002747f
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x74]
jg 0x100274bf
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x3fc]
call fcn.10028ca3
cmp dword [eax], 0
jge 0x100274bd
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x3fc]
call fcn.10028ca3
mov ecx, dword [ebp - 0x6c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
jmp 0x10027472
mov dword [ebp - 0x110], 1
jmp 0x100274d8
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x74]
jg 0x10027504
push dword [ebp - 0x110]
lea ecx, [ebp - 0x3fc]
call fcn.10028ca3
push dword [eax]
push 0x10008b30
call fcn.1004f14f
pop ecx
pop ecx
jmp 0x100274cb
push 0x10008a51
call fcn.1004f621
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3fc]
call fcn.10028efc
jmp 0x10027385
mov dword [ebp - 0x54], 0xa32b1cec
mov dword [ebp - 0x58c], 0xfff9
mov dword [ebp - 0x100], 0
jmp 0x1002754d
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 4
jge 0x10027569
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x584], 0xfffffff7
jmp 0x10027540
mov dword [ebp - 0x54], 0
jmp 0x10027579
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jg 0x100275a4
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x584]
mov dword [ebp + ecx*4 - 0x584], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp + eax*4 - 0x584], 0
je 0x100275a2
jmp 0x10027572
jmp 0x10027572
xor eax, eax
jmp 0x10027ffe
mov dword [ebp - 0x344], 0xfffffffc
mov dword [ebp - 0xac], 0
mov dword [ebp - 0x4d4], 7
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x324], 0
mov dword [ebp - 0x34c], 0x6092f644
mov dword [ebp - 0x120], 0
jmp 0x10027600
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 4
jge 0x1002761c
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x5d4], 7
jmp 0x100275f3
cmp dword [ebp - 0x344], 0
je 0x10027669
mov dword [ebp - 0x528], 1
mov dword [ebp - 0x4dc], 0xe4b7834d
lea eax, [ebp - 0x34c]
push eax
push 1
push 0x3138
push 0x2331
push 1
call fcn.1001f4df
add esp, 0x14
push 1
push 1
push 0x528c
call fcn.1001f55f
add esp, 0xc
jmp 0x100276e5
mov dword [ebp - 0xac], 0xffffffe2
jmp 0x10027682
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x17
jg 0x100276e5
mov dword [ebp - 0xb0], 3
jmp 0x100276a4
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jl 0x100276d6
mov byte [ebp - 0x44], 0
movzx eax, byte [ebp - 0x44]
test eax, eax
je 0x100276d4
push 1
push 0x13b
push 1
push 0x7e27
push 0x57f
call fcn.1001f6d4
add esp, 0x14
jmp 0x10027697
lea eax, [ebp - 0x324]
push eax
call fcn.10025028
pop ecx
jmp 0x10027675
push 0x7880
push 1
push 0x1fe8
push 0x4db6
push 1
push 0x555d
push dword [ebp - 0x1c]
push 0x6dde
push 0x5dab
push 1
push 0x59ec
push 0x1ebf
call fcn.1000d19d
add esp, 0x30
mov dword [ebp - 0x7c], 0x1cecb457
mov dword [ebp - 0x234], 0xfffffffb
mov dword [ebp - 0x224], 0x7182
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0x204], 0x3624
push 4
lea ecx, [ebp - 0x44c]
call fcn.10028b5c
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x20], 0
jmp 0x10027771
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10027787
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x498], 0xad5a519d
jmp 0x1002776a
mov dword [ebp - 0x20], 0
jmp 0x10027797
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x100277ad
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc0], 0xfffffffd
jmp 0x10027790
push 1
lea eax, [ebp - 0x44c]
push eax
push 0x5fb3
push 1
push 1
lea eax, [ebp - 0x20]
push eax
push 0x6c25
call fcn.10020821
add esp, 0x1c
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0xb8], eax
jle 0x100277ea
mov dword [ebp - 0x1fc], 1
jmp 0x100277f1
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
je 0x10027812
mov dword [ebp - 0x20c], 1
jmp 0x10027819
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x570], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc0]
mov dword [ebp - 0x214], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x214]
mov dword [ebp + eax - 0x498], ecx
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x364], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xc0], eax
mov eax, dword [ebp - 0x35c]
cmp eax, dword [ebp - 0x364]
jle 0x100278a1
mov dword [ebp - 0x21c], 1
jmp 0x100278a8
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x21c]
jge 0x100278c3
xor eax, eax
je 0x100278c3
mov dword [ebp - 0x22c], 1
jmp 0x100278ca
and dword [ebp - 0x22c], 0
mov dword [ebp - 0x224], 0x64f16efa
mov eax, dword [ebp - 0x224]
cmp eax, dword [ebp - 0x22c]
jge 0x100278ee
mov dword [ebp - 0x36c], 1
jmp 0x100278f5
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x4e4], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x530], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc0]
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x7c], 0x538770ce
jge 0x1002792f
mov dword [ebp - 0x23c], 1
jmp 0x10027936
and dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x234]
cmp eax, dword [ebp - 0x23c]
jge 0x10027959
mov dword [ebp - 0x244], 1
jmp 0x10027960
and dword [ebp - 0x244], 0
push 3
lea ecx, [ebp - 0x44c]
call fcn.10028ca3
mov ecx, dword [ebp - 0x244]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44c]
call fcn.10028c61
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10027fd8
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc8]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x26c], ecx
jne 0x100279b0
xor eax, eax
jmp 0x10027ffe
push 2
lea ecx, [ebp - 0x304]
call fcn.10028b5c
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x37c], 0x91e66c61
mov dword [ebp - 0x15c], 0xfffffff8
mov dword [ebp - 0xd0], 0
jmp 0x100279f1
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x10027a13
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x304]
call fcn.10028ca3
mov dword [eax], 0xdf99ff60
jmp 0x100279e4
push 1
lea ecx, [ebp - 0x304]
call fcn.10028ca3
and dword [eax], 0
jmp 0x10027a49
push 1
lea ecx, [ebp - 0x304]
call fcn.10028ca3
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x24c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x24c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x304]
call fcn.10028ca3
cmp dword [eax], 9
jne 0x10027b81
push 3
lea ecx, [ebp - 0x464]
call fcn.10028b5c
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x384], 0xbf25cbd9
mov dword [ebp - 0x374], 0xaa1c
mov dword [ebp - 0x80], 0xfffffffc
mov dword [ebp - 0xd8], 0
jmp 0x10027aa4
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jge 0x10027ac6
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x464]
call fcn.10028ca3
mov dword [eax], 0x3644
jmp 0x10027a97
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x37c]
push eax
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x384]
push eax
call fcn.10025092
add esp, 0x1c
cmp dword [ebp - 0x80], 0xfffffff6
jbe 0x10027b0e
mov dword [ebp - 0x254], 1
jmp 0x10027b15
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x254]
sub eax, dword [ebp - 0x15c]
cmp eax, 0xbdb8
jg 0x10027b3d
mov dword [ebp - 0x25c], 1
jmp 0x10027b44
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x25c]
neg eax
cmp eax, dword [ebp - 0x80]
jl 0x10027b5d
mov dword [ebp - 0x264], 1
jmp 0x10027b64
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x80], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x464]
call fcn.10028c61
jmp 0x10027a25
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x304]
call fcn.10028c61
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x26c]
mov dword [ebp - 0x3ac], eax
push 2
lea ecx, [ebp - 0x170]
call fcn.10028b5c
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x5c], 0xa876e6ba
mov dword [ebp - 0x164], 1
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x574]
push eax
call fcn.100251b4
pop ecx
pop ecx
mov dword [ebp - 0x5c], 1
jmp 0x10027bef
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x10027fb2
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0xc32b96ce
mov dword [ebp - 0x274], 0xa8d6
mov dword [ebp - 0x2bc], 0xffffffff
mov dword [ebp - 0x3a4], 0x66ab0c02
push 0x343c
push 0x1f42
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x3d1
push 1
push 1
lea eax, [ebp - 0x10]
push eax
call fcn.10020da1
add esp, 0x24
mov dword [ebp - 0x14], 0
jmp 0x10027c63
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jg 0x10027d11
mov dword [ebp - 0x394], 1
mov dword [ebp - 0x4f4], 0xffffffff
call fcn.100251fc
mov dword [ebp - 0x10], 1
jmp 0x10027c96
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x10027d0c
mov dword [ebp - 0x38c], 1
mov dword [ebp - 0x39c], 0xffffffff
push dword [ebp - 0x10]
lea ecx, [ebp - 0x170]
call fcn.10028ca3
cmp dword [eax], 0
je 0x10027cc5
jmp 0x10027d0c
push 0x10f4
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x768e
lea eax, [ebp - 0x38c]
push eax
push 1
lea eax, [ebp - 0x394]
push eax
lea eax, [ebp - 0x39c]
push eax
push 1
lea eax, [ebp - 0x5c]
push eax
call fcn.10021084
add esp, 0x30
jmp 0x10027c8f
jmp 0x10027c5c
mov dword [ebp - 0x10], 0
jmp 0x10027d21
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jg 0x10027fad
mov dword [ebp - 0xe0], 0
jmp 0x10027d44
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jge 0x10027d60
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0x338], 0xd2c990b5
jmp 0x10027d37
mov dword [ebp - 0x14], 1
jmp 0x10027d70
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x10027fa8
mov dword [ebp - 0xe8], 0
jmp 0x10027d93
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 1
jge 0x10027daf
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0x2ac], 0xffffffff
jmp 0x10027d86
push dword [ebp - 0x10]
lea ecx, [ebp - 0x170]
call fcn.10028ca3
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x338]
mov dword [ebp - 0x540], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x338]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x338], eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x170]
call fcn.10028ca3
mov eax, dword [eax]
add eax, dword [ebp - 0x274]
mov dword [ebp - 0x27c], eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x170]
call fcn.10028ca3
mov ecx, dword [ebp - 0x27c]
mov dword [eax], ecx
cmp dword [ebp - 0x27c], 0
je 0x10027e6b
push 1
lea ecx, [ebp - 0x170]
call fcn.10028ca3
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x338]
cmp dword [eax], ecx
je 0x10027e4c
mov dword [ebp - 0x284], 1
jmp 0x10027e53
and dword [ebp - 0x284], 0
cmp dword [ebp - 0x284], 0xaed4
jg 0x10027e6b
mov dword [ebp - 0x28c], 1
jmp 0x10027e72
and dword [ebp - 0x28c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ac]
cmp dword [ebp - 0x28c], eax
jle 0x10027e93
mov dword [ebp - 0x294], 1
jmp 0x10027e9a
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x294], eax
je 0x10027ec0
push 0
lea ecx, [ebp - 0x170]
call fcn.10028ca3
cmp dword [eax], 0
jne 0x10027ec0
and dword [ebp - 0x29c], 0
jmp 0x10027eca
mov dword [ebp - 0x29c], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x29c], eax
jne 0x10027ee7
cmp dword [ebp - 0x5c], 0
je 0x10027ee7
mov dword [ebp - 0x2a4], 1
jmp 0x10027eee
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x4fc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ac]
mov dword [ebp - 0x588], eax
cmp dword [ebp - 0x164], 0
je 0x10027f31
cmp dword [ebp - 0x14], 0
je 0x10027f31
and dword [ebp - 0x2b4], 0
jmp 0x10027f3b
mov dword [ebp - 0x2b4], 1
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 0
je 0x10027f65
mov eax, 0xcd6c
test eax, eax
je 0x10027f65
mov dword [ebp - 0x2c4], 1
jmp 0x10027f6c
and dword [ebp - 0x2c4], 0
cmp dword [ebp - 0x2c4], 0
jae 0x10027f8d
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x338], 0
jne 0x10027f8d
and dword [ebp - 0x2cc], 0
jmp 0x10027f97
mov dword [ebp - 0x2cc], 1
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x3a4], eax
jmp 0x10027d69
jmp 0x10027d1a
jmp 0x10027be8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x170]
call fcn.10028c61
cmp dword [ebp - 0x3ac], 0
jne 0x10027fce
xor eax, eax
jmp 0x10027ffe
lea eax, [ebp - 0x1c]
push eax
call fcn.10025227
pop ecx
call fcn.10025241
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x10], 0
je 0x10027ff1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2d4], eax
jmp 0x10027ff8
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2d4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret