Function at 0x1000b6e9
Capabilities:
Create process on windows
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10072f4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x20b24
call fcn.1006e6a0
push esi
push edi
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x100101f1
mov dword [ebp - 0x5e8], 0x15d4
cmp dword [ebp - 0x5e8], 0x75d
jge 0x1000b8a9
lea eax, [ebp - 0x1ac]
push eax
push 0x100080f4
call fcn.1005b040
pop ecx
pop ecx
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x664], eax
mov eax, dword [ebp - 0x1ac]
dec eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x664], 0
je 0x1000b8a9
lea eax, [ebp - 0x1e8]
push eax
lea eax, [ebp - 0x66c]
push eax
push 0x100080f8
call fcn.1005b040
add esp, 0xc
lea ecx, [ebp - 0x57c]
call fcn.1002d984
and dword [ebp - 4], 0
and dword [ebp - 0x1b8], 0
jmp 0x1000b7ac
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x1b8]
cmp eax, dword [ebp - 0x66c]
jge 0x1000b7e8
lea eax, [ebp - 0x674]
push eax
push 0x100080f4
call fcn.1005b040
pop ecx
pop ecx
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0xad4]
push eax
lea ecx, [ebp - 0x57c]
call fcn.1002d999
jmp 0x1000b79f
cmp dword [ebp - 0x1e8], 1
jne 0x1000b830
lea ecx, [ebp - 0x57c]
call fcn.1002d9d9
cmp eax, 1
jbe 0x1000b80d
mov dword [ebp - 0x384], 1
jmp 0x1000b814
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x384]
shl eax, 1
xor ecx, ecx
inc ecx
sub ecx, eax
push ecx
push 0x10008100
call fcn.1005b488
pop ecx
pop ecx
jmp 0x1000b895
lea ecx, [ebp - 0x57c]
call fcn.1002d9d9
mov ecx, dword [ebp - 0x1e8]
lea eax, [eax + ecx - 3]
mov ecx, dword [ebp - 0x1e8]
dec ecx
xor edx, edx
div ecx
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jle 0x1000b86d
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x50c], eax
jmp 0x1000b877
mov dword [ebp - 0x50c], 1
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x12c], eax
push dword [ebp - 0x12c]
push 0x10008100
call fcn.1005b488
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x57c]
call fcn.1002db6f
jmp 0x1000b746
lea eax, [ebp + 0x10]
mov dword [ebp - 0x67c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x694], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x684], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x62c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x624], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x68c], eax
mov eax, dword [ebp - 0x67c]
movzx eax, byte [eax]
test eax, eax
je 0x1001016a
mov eax, dword [ebp - 0x684]
mov dword [ebp - 0x604], eax
mov eax, dword [ebp - 0x68c]
mov dword [ebp - 0x6b0], eax
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0xa7c], 0xfffffffa
push 1
lea ecx, [ebp - 0x7d8]
call fcn.1002d70f
mov dword [ebp - 4], 1
mov dword [ebp - 0x514], 0xffff
push 2
lea ecx, [ebp - 0x7cc]
call fcn.1002d70f
mov byte [ebp - 4], 2
lea eax, [ebp - 0x7d8]
push eax
lea eax, [ebp - 0x108]
push eax
push 0
call fcn.1001078d
add esp, 0xc
mov dword [ebp - 0x108], 0
jmp 0x1000b97e
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 2
jge 0x1000b9a0
push dword [ebp - 0x108]
lea ecx, [ebp - 0x7cc]
call fcn.1002d7f4
mov dword [eax], 0x31d8
jmp 0x1000b971
mov eax, dword [ebp - 0x514]
dec eax
mov dword [ebp - 0x514], eax
push 0x20fc
lea eax, [ebp - 0x7cc]
push eax
push 0x6c43
lea eax, [ebp - 0x7d8]
push eax
push 1
push 1
push 0
call fcn.10027317
add esp, 0x1c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x7cc]
call fcn.1002d7e6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7d8]
call fcn.1002d7e6
mov eax, dword [ebp - 0x180]
mov eax, dword [eax + 4]
mov dword [ebp - 0x4f4], eax
mov dword [ebp - 0x134], 1
push 3
lea ecx, [ebp - 0x7e4]
call fcn.1002d70f
mov dword [ebp - 4], 3
mov dword [ebp - 0x188], 0
jmp 0x1000ba37
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 3
jge 0x1000ba59
push dword [ebp - 0x188]
lea ecx, [ebp - 0x7e4]
call fcn.1002d7f4
mov dword [eax], 1
jmp 0x1000ba2a
mov dword [ebp - 0x134], 0
jmp 0x1000ba72
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x13
je 0x1000bb24
mov dword [ebp - 0x190], 8
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x1000babe
push 0x36c2
push 0x1bf3
push 0x20c0
push 0x12b1
push 0
push 0x6b7d
call fcn.10010246
add esp, 0x18
mov dword [ebp - 0x190], 0
jmp 0x1000bad7
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 9
jle 0x1000bb1f
mov dword [ebp - 0x69c], 0xffffffff
lea eax, [ebp - 0x7e4]
push eax
push 1
push 0x3b3a
push 0x32e4
lea eax, [ebp - 0x69c]
push eax
push 0x65ec
push 0
push 0x193e
push 0x6fec
call fcn.1000b6e9
add esp, 0x24
jmp 0x1000baca
jmp 0x1000ba65
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7e4]
call fcn.1002d7e6
mov dword [ebp - 0x6a4], 0x1da1
cmp dword [ebp - 0x6a4], 0x760
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x8c], 0x9c6fec1b
push 2
lea ecx, [ebp - 0x218]
call fcn.1002d70f
mov dword [ebp - 4], 4
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x1a8], 0xd5f49dcb
mov dword [ebp - 0x1a4], 0xd5f49dcb
mov dword [ebp - 0x1a0], 0xd5f49dcb
mov dword [ebp - 0x19c], 0xd5f49dcb
mov dword [ebp - 0x10], 0xa28d8805
mov dword [ebp - 0x2a0], 0
push 0
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x9e8]
push eax
call fcn.10019f4f
add esp, 0xc
cmp dword [ebp - 0x1c], 0
je 0x1000bd6e
cmp dword [ebp - 0x1c], 0xffffffff
jle 0x1000bbe0
mov dword [ebp - 0x53c], 1
jmp 0x1000bbe7
and dword [ebp - 0x53c], 0
cmp dword [ebp - 0x1c], 0x26f3
je 0x1000bbfc
mov dword [ebp - 0x540], 1
jmp 0x1000bc03
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x540]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x53c], eax
je 0x1000bc29
mov dword [ebp - 0x504], 1
jmp 0x1000bc30
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x504], eax
jge 0x1000bc47
mov dword [ebp - 0x234], 1
jmp 0x1000bc4e
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x234]
cmp eax, dword [ebp - 0x1c]
jne 0x1000bc69
mov dword [ebp - 0x264], 1
jmp 0x1000bc70
and dword [ebp - 0x264], 0
push 0
lea ecx, [ebp - 0x218]
call fcn.1002d7f4
mov esi, dword [ebp - 0x264]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x218]
call fcn.1002d7f4
cmp esi, dword [eax]
jl 0x1000bca2
mov dword [ebp - 0x3c8], 1
jmp 0x1000bca9
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x3c8]
add eax, 0x96e6
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x250], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x250]
mov dword [ebp + eax - 0x1a8], ecx
cmp dword [ebp - 0x250], 0xffffffff
jne 0x1000bce8
mov dword [ebp - 0x488], 1
jmp 0x1000bcef
and dword [ebp - 0x488], 0
cmp dword [ebp - 0x488], 0x3279329b
jge 0x1000bd07
mov dword [ebp - 0x258], 1
jmp 0x1000bd0e
and dword [ebp - 0x258], 0
push 0
lea ecx, [ebp - 0x218]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x258]
cmp ecx, dword [eax]
jne 0x1000bd31
mov dword [ebp - 0x3d0], 1
jmp 0x1000bd38
and dword [ebp - 0x3d0], 0
cmp dword [ebp - 0x3d0], 0
je 0x1000bd4d
mov dword [ebp - 0x260], 1
jmp 0x1000bd54
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x260]
add eax, 6
cmp eax, 0xffffffff
jne 0x1000bd6e
mov dword [ebp - 0x4e8], 1
jmp 0x1000bd75
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x4e8]
jne 0x1000bd92
mov eax, 0x47e29ac9
test eax, eax
jne 0x1000bd92
and dword [ebp - 0x268], 0
jmp 0x1000bd9c
mov dword [ebp - 0x268], 1
mov eax, dword [ebp - 0x268]
neg eax
mov dword [ebp - 0x1c], eax
push 0xfffffffffffffff8
pop eax
cmp eax, 0x7c65
jne 0x1000bdbd
mov dword [ebp - 0x6ac], 1
jmp 0x1000bdc4
and dword [ebp - 0x6ac], 0
push 1
lea ecx, [ebp - 0x218]
call fcn.1002d7f4
mov esi, dword [ebp - 0x8c]
add esi, 0x48279619
push 0
lea ecx, [ebp - 0x218]
call fcn.1002d7f4
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x218]
call fcn.1002d7f4
sub esi, dword [eax]
cmp esi, 0xa2e5
jg 0x1000be0f
mov dword [ebp - 0x3d8], 1
jmp 0x1000be16
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jae 0x1000be31
mov dword [ebp - 0x270], 1
jmp 0x1000be38
and dword [ebp - 0x270], 0
push 0
lea ecx, [ebp - 0x218]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x270]
cmp ecx, dword [eax]
jle 0x1000c1b5
mov dword [ebp - 0xf8], 0xffffffff
push 3
lea ecx, [ebp - 0x7fc]
call fcn.1002d70f
mov byte [ebp - 4], 5
mov dword [ebp - 0x298], 0xffffffff
mov dword [ebp - 0x740], 1
lea eax, [ebp - 0x7fc]
push eax
push 0x6500
push 0x7ef
lea eax, [ebp - 0xa88]
push eax
push 0
call fcn.10015a11
add esp, 0x14
mov dword [ebp - 0x1c], 0
jmp 0x1000beb4
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff6
je 0x1000bf8b
mov dword [ebp - 0x6bc], 0xffffffff
mov dword [ebp - 0x708], 0xc8d67996
mov dword [ebp - 0x6b4], 0x1d10
cmp dword [ebp - 0x6b4], 0xccc
jge 0x1000bf53
lea eax, [ebp - 0x278]
push eax
push 0x100080f4
call fcn.1005b040
pop ecx
pop ecx
mov eax, dword [ebp - 0x278]
and eax, 0x80000001
jns 0x1000bf0d
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x1000bf1d
mov dword [ebp - 0x490], 9
jmp 0x1000bf27
mov dword [ebp - 0x490], 4
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x3e0], eax
push dword [ebp - 0x3e0]
mov eax, dword [ebp - 0x278]
add eax, dword [ebp - 0x3e0]
push eax
push 0x10008118
call fcn.1005b488
add esp, 0xc
lea eax, [ebp - 0x6bc]
push eax
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x708]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x352e
call fcn.10010e36
add esp, 0x20
jmp 0x1000bead
mov dword [ebp - 0x10], 0
jmp 0x1000bf9b
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x1000c1a1
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x1a8], 0
jne 0x1000c082
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x1a8], 0x83b7c1f6
je 0x1000bfd2
mov dword [ebp - 0x710], 1
jmp 0x1000bfd9
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x938], eax
mov eax, dword [ebp - 0xf8]
add eax, 0x2e10f6e6
jne 0x1000bffe
mov dword [ebp - 0x280], 1
jmp 0x1000c005
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x280]
sub eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x10]
cmp eax, dword [ebp + ecx*4 - 0x1a8]
je 0x1000c029
mov dword [ebp - 0x1c0], 1
jmp 0x1000c030
and dword [ebp - 0x1c0], 0
push 2
lea ecx, [ebp - 0x7fc]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x1c0]
mov dword [eax], ecx
cmp dword [ebp - 0x1c0], 0x4f57
jl 0x1000c05d
mov dword [ebp - 0x518], 1
jmp 0x1000c064
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x1a8]
imul eax, dword [ebp - 0x518]
test eax, eax
jne 0x1000c082
and dword [ebp - 0x288], 0
jmp 0x1000c08c
mov dword [ebp - 0x288], 1
imul eax, dword [ebp - 0x288], 0
mov ecx, dword [ebp - 0x10]
cmp eax, dword [ebp + ecx*4 - 0x1a8]
jg 0x1000c0b5
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x1a8], 0
jne 0x1000c0b5
and dword [ebp - 0x3e8], 0
jmp 0x1000c0bf
mov dword [ebp - 0x3e8], 1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x3e8]
add ecx, dword [ebp + eax*4 - 0x1a8]
mov dword [ebp - 0x738], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x738]
mov dword [ebp + eax*4 - 0x1a8], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x954], eax
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xf8]
imul eax, eax, 0xffff
cmp eax, dword [ebp - 0xf8]
jge 0x1000c111
mov dword [ebp - 0x290], 1
jmp 0x1000c118
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x290]
add eax, 0x2ddc
cmp eax, 0x5da4005d
jge 0x1000c136
mov dword [ebp - 0x498], 1
jmp 0x1000c13d
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x298], eax
jge 0x1000c163
mov dword [ebp - 0x3f0], 1
jmp 0x1000c16a
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x740], eax
mov byte [ebp - 0xb7], 0
movzx eax, byte [ebp - 0xb7]
test eax, eax
je 0x1000c19c
push 0
push 0x2d1f
push 0x255c
call fcn.100145d4
add esp, 0xc
jmp 0x1000bf94
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x7fc]
call fcn.1002d7e6
jmp 0x1000c391
mov dword [ebp - 0x200], 0xffffffff
mov dword [ebp - 0x13c], 0
jmp 0x1000c1d8
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 3
jge 0x1000c1f4
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0xa3c], 0x728ef6be
jmp 0x1000c1cb
mov dword [ebp - 0x30], 3
jmp 0x1000c204
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1000c370
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x1a8]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x95c], eax
cmp dword [ebp - 0x2a0], 0
jne 0x1000c240
xor eax, eax
jne 0x1000c240
and dword [ebp - 0x4f0], 0
jmp 0x1000c24a
mov dword [ebp - 0x4f0], 1
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x1a8]
cmp dword [ebp - 0x4f0], eax
jge 0x1000c271
mov eax, 0xe340
test eax, eax
je 0x1000c271
mov dword [ebp - 0x2a8], 1
jmp 0x1000c278
and dword [ebp - 0x2a8], 0
mov eax, dword [ebp - 0x2a8]
sub eax, dword [ebp - 0x10]
jne 0x1000c295
mov eax, 0x701e
test eax, eax
jne 0x1000c295
and dword [ebp - 0x3f8], 0
jmp 0x1000c29f
mov dword [ebp - 0x3f8], 1
push 1
lea ecx, [ebp - 0x218]
call fcn.1002d7f4
mov eax, dword [eax]
cmp eax, dword [ebp - 0x3f8]
jg 0x1000c2c2
mov dword [ebp - 0x2b0], 1
jmp 0x1000c2c9
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x1a8]
cmp dword [ebp - 0x2b0], eax
jle 0x1000c2e7
mov dword [ebp - 0x748], 1
jmp 0x1000c2ee
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x1a8]
mov dword [ebp - 0x964], eax
mov eax, dword [ebp - 0x30]
sub eax, 4
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x96c], eax
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x4a0]
mov dword [ebp + eax*4 - 0x1a8], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa3c]
cmp dword [ebp - 0x4a0], eax
jge 0x1000c352
mov dword [ebp - 0x2b8], 1
jmp 0x1000c359
and dword [ebp - 0x2b8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2b8]
mov dword [ebp + eax - 0xa3c], ecx
jmp 0x1000c1fd
push 1
push 0x2baf
push 0x5d25
lea eax, [ebp - 0x1c]
push eax
push 0x4b56
push 1
push 1
call fcn.1000a623
add esp, 0x1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x218]
call fcn.1002d7e6
push 1
lea ecx, [ebp - 0x720]
call fcn.1002d70f
mov dword [ebp - 4], 6
mov dword [ebp - 0x228], 0xfffffff8
mov dword [ebp - 0x224], 0xfffffff8
mov dword [ebp - 0x220], 0xfffffff8
mov dword [ebp - 0x21c], 0xfffffff8
mov dword [ebp - 0xc0], 0xffffffff
mov dword [ebp - 0x68], 3
mov dword [ebp - 0x198], 0x392f
mov dword [ebp - 0x2d0], 0xfffffffe
mov dword [ebp - 0x5dc], 0x8a25
mov dword [ebp - 0x68], 0x34c8
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x974], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x228]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x97c], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x984], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x228]
mov dword [ebp - 0x98c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x228], 0
je 0x1000c477
cmp dword [ebp - 0x68], 0
je 0x1000c477
mov dword [ebp - 0x400], 1
jmp 0x1000c47e
and dword [ebp - 0x400], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x228]
add eax, dword [ebp - 0x400]
je 0x1000c4d1
mov dword [ebp - 0x750], 0xfffffffb
mov dword [ebp - 0x72c], 0x61a65206
mov eax, dword [ebp - 0x750]
mov dword [ebp - 0x72c], eax
mov byte [ebp - 0x7e], 0
movzx eax, byte [ebp - 0x7e]
test eax, eax
je 0x1000c4cc
push 0
push 0x2b10
call fcn.1001204f
pop ecx
pop ecx
jmp 0x1000c5be
mov dword [ebp - 0x1c8], 0
cmp dword [ebp - 0x198], 1
je 0x1000c4f0
mov dword [ebp - 0x2c0], 1
jmp 0x1000c4f7
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x1c8], eax
je 0x1000c51d
mov dword [ebp - 0x52c], 1
jmp 0x1000c524
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x198]
cmp eax, dword [ebp - 0x52c]
je 0x1000c53e
mov dword [ebp - 0x2c8], 1
jmp 0x1000c545
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0x2c8], eax
jle 0x1000c55f
mov dword [ebp - 0x65c], 1
jmp 0x1000c566
and dword [ebp - 0x65c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x228]
mov dword [ebp - 0x994], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x228], 0x4a2c930f
jl 0x1000c598
mov dword [ebp - 0x408], 1
jmp 0x1000c59f
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x198]
add eax, dword [ebp - 0x408]
add eax, dword [ebp - 0x1c8]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x228], eax
mov eax, dword [ebp - 0x2d0]
dec eax
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x99c], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x9a4], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x5dc]
cmp dword [ebp + eax - 0x228], ecx
jg 0x1000c600
mov dword [ebp - 0x4a8], 1
jmp 0x1000c607
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x4a8], eax
jl 0x1000c61e
mov dword [ebp - 0x2d8], 1
jmp 0x1000c625
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x2d8]
dec eax
cmp dword [ebp - 0xc0], eax
jle 0x1000c640
mov dword [ebp - 0x410], 1
jmp 0x1000c647
and dword [ebp - 0x410], 0
cmp dword [ebp - 0x410], 0x1e1cf2bb
jl 0x1000c65f
mov dword [ebp - 0x6c0], 1
jmp 0x1000c666
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x9ac], eax
mov eax, dword [ebp - 0x68]
inc eax
cmp dword [ebp - 0x68], eax
jle 0x1000c687
mov dword [ebp - 0x2e0], 1
jmp 0x1000c68e
and dword [ebp - 0x2e0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2e0]
mov dword [ebp + eax - 0x228], ecx
mov dword [ebp - 0xc4], 0xffffffff
mov dword [ebp - 0x5f0], 1
mov dword [ebp - 0x174], 0
jmp 0x1000c6cd
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 3
jge 0x1000c6e9
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0xab8], 1
jmp 0x1000c6c0
mov eax, dword [ebp - 0x5f0]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xab8], eax
mov byte [ebp - 0x80], 0
push 0
lea eax, [ebp - 0x80]
push eax
push 1
push 0
push 0x4f1e
call fcn.100198ba
add esp, 0x14
mov dword [ebp - 0x784], 8
mov dword [ebp - 0x780], 8
mov dword [ebp - 0x77c], 8
mov dword [ebp - 0x778], 8
mov dword [ebp - 0x700], 9
mov dword [ebp - 0x148], 0
jmp 0x1000c763
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 3
jge 0x1000c77f
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0xb30], 0x8abc106e
jmp 0x1000c756
mov byte [ebp - 0x83], 0
movzx eax, byte [ebp - 0x83]
test eax, eax
je 0x1000c7aa
push 0x53b7
push 0x3791
push 0
push 0x479c
call fcn.1001528d
add esp, 0x10
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x784], 1
jne 0x1000c7c6
mov dword [ebp - 0x4f8], 1
jmp 0x1000c7cd
and dword [ebp - 0x4f8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x784]
imul eax, dword [ebp - 0x4f8]
mov dword [ebp - 0x700], eax
mov dword [ebp - 0x170], 0
jmp 0x1000c800
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x1000c822
push dword [ebp - 0x170]
lea ecx, [ebp - 0x720]
call fcn.1002d7f4
mov dword [eax], 0x9f9b3198
jmp 0x1000c7f3
mov dword [ebp - 0x118], 0xffff
mov dword [ebp - 0xe8], 0x3afc3718
mov dword [ebp - 0x2f0], 0xc9ebf495
push 1
lea ecx, [ebp - 0x814]
call fcn.1002d70f
mov byte [ebp - 4], 7
lea eax, [ebp - 0x814]
push eax
push 0
lea eax, [ebp - 0x9b4]
push eax
push 0x6d38
call fcn.10019e0b
add esp, 0x10
mov eax, 0x2a43
test eax, eax
je 0x1000c8bf
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x9bc], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x9c4], eax
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0x118]
dec ecx
sub ecx, dword [ebp - 0xe8]
sub ecx, dword [ebp - 0x118]
imul eax, ecx
cmp eax, dword [ebp - 0xe8]
jl 0x1000c8bf
mov dword [ebp - 0x2e8], 1
jmp 0x1000c8c6
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x2e8]
je 0x1000c8e0
mov dword [ebp - 0x418], 1
jmp 0x1000c8e7
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x2f0], eax
push 0x3604
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x2f0]
push eax
push 0
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.100109bb
add esp, 0x18
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x814]
call fcn.1002d7e6
mov dword [ebp - 0xc4], 0
jmp 0x1000c946
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jg 0x1000f194
push 2
lea ecx, [ebp - 0x5c8]
call fcn.1002d70f
mov byte [ebp - 4], 8
mov dword [ebp - 0x9cc], 0x9b7928f
mov dword [ebp - 0x150], 0
jmp 0x1000c987
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 2
jge 0x1000c9a9
push dword [ebp - 0x150]
lea ecx, [ebp - 0x5c8]
call fcn.1002d7f4
mov dword [eax], 0x571177e8
jmp 0x1000c97a
push 1
lea ecx, [ebp - 0x5c8]
call fcn.1002d7f4
and dword [eax], 0
jmp 0x1000c9df
push 1
lea ecx, [ebp - 0x5c8]
call fcn.1002d7f4
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp - 0x4b0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4b0]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x5c8]
call fcn.1002d7f4
cmp dword [eax], 0x11
jne 0x1000ca7a
push 3
lea ecx, [ebp - 0x75c]
call fcn.1002d70f
mov byte [ebp - 4], 9
lea eax, [ebp - 0x9d4]
push eax
lea eax, [ebp - 0x75c]
push eax
push 0
push 0x13c6
push 0x5318
call fcn.10019e37
add esp, 0x14
push 1
lea eax, [ebp - 0x75c]
push eax
push 0x6ff8
push 1
call fcn.1000a733
add esp, 0x10
push 1
lea ecx, [ebp - 0x5c8]
call fcn.1002d7f4
cmp dword [eax], 0
je 0x1000ca66
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x75c]
call fcn.1002d7e6
jmp 0x1000c9bb
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x75c]
call fcn.1002d7e6
jmp 0x1000c9bb
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x5c8]
call fcn.1002d7e6
mov dword [ebp - 0x194], 0xb0ceafd
mov dword [ebp - 0x18], 0x42c70bb7
mov dword [ebp - 0x1f0], 5
push 4
lea ecx, [ebp - 0x838]
call fcn.1002d70f
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x100], 0
jmp 0x1000cace
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 3
jge 0x1000caea
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0xe4], 4
jmp 0x1000cac1
lea eax, [ebp - 0x100]
push eax
push 0x4e48
push 0x5ebf
push 1
push 0xf09
push 1
push 0x39ee
lea eax, [ebp - 0x838]
push eax
call fcn.1000ab5a
add esp, 0x20
mov dword [ebp - 0x18], 0
jmp 0x1000cb28
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x1000cfec
mov dword [ebp - 0x78], 0x9ab5c294
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xe4], 0
je 0x1000cce1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x9dc], eax
push 5
pop eax
cmp eax, 1
jbe 0x1000cb6e
mov dword [ebp - 0x2f8], 1
jmp 0x1000cb75
and dword [ebp - 0x2f8], 0
mov dword [ebp - 0x78], 1
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x2f8]
jg 0x1000cb93
mov dword [ebp - 0x420], 1
jmp 0x1000cb9a
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xe4]
cmp dword [ebp - 0x420], eax
jl 0x1000cbb8
mov dword [ebp - 0x300], 1
jmp 0x1000cbbf
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x300]
inc eax
mov dword [ebp - 0x20], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe4]
cmp dword [ebp - 0x20], eax
jge 0x1000cbe7
mov dword [ebp - 0x5f8], 1
jmp 0x1000cbee
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xe4]
mov dword [ebp - 0x9e4], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xe4]
mov dword [ebp - 0x9ec], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xe4]
cmp dword [ebp - 0x78], eax
jle 0x1000cc29
mov dword [ebp - 0x528], 1
jmp 0x1000cc30
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xe4]
cmp eax, dword [ebp - 0x528]
je 0x1000cc4e
mov dword [ebp - 0x308], 1
jmp 0x1000cc55
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0x308]
sub eax, 0xb2f6
je 0x1000cc7e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xe4], 0
je 0x1000cc7e
mov dword [ebp - 0x428], 1
jmp 0x1000cc85
and dword [ebp - 0x428], 0
cmp dword [ebp - 0x428], 0x12c005d9
je 0x1000cc9d
mov dword [ebp - 0x310], 1
jmp 0x1000cca4
and dword [ebp - 0x310], 0
cmp dword [ebp - 0x310], 0x9c90e69c
je 0x1000ccbc
mov dword [ebp - 0x4b8], 1
jmp 0x1000ccc3
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xe4]
cmp dword [ebp - 0x4b8], eax
jg 0x1000cce1
mov dword [ebp - 0x318], 1
jmp 0x1000cce8
and dword [ebp - 0x318], 0
cmp dword [ebp - 0x318], 0x55f1
jle 0x1000cd05
or eax, 0xffffffff
je 0x1000cd05
mov dword [ebp - 0x430], 1
jmp 0x1000cd0c
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x430]
sub ecx, dword [ebp + eax*4 - 0xe4]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe4]
lea eax, [ecx + eax - 0xa644184]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0xe4]
jge 0x1000cd4b
mov dword [ebp - 0x320], 1
jmp 0x1000cd52
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x320]
sub eax, dword [ebp - 0x18]
je 0x1000cfdc
mov dword [ebp - 0x4c0], 0x17c264f8
mov dword [ebp - 0x78], 2
jmp 0x1000cd7b
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jl 0x1000cfc1
mov dword [ebp - 0x330], 1
mov dword [ebp - 0x7c0], 0x774d2ad0
mov dword [ebp - 0x7bc], 0x774d2ad0
mov dword [ebp - 0x7b8], 0x774d2ad0
mov dword [ebp - 0x7b4], 0x774d2ad0
lea ecx, [ebp - 0x209]
call fcn.1002d803
push eax
lea eax, [ebp - 0x7b0]
push eax
lea eax, [ebp - 0x7c0]
push eax
lea ecx, [ebp - 0xacc]
call fcn.1002d806
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x82c]
call fcn.1002d7c0
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x20], 0
jmp 0x1000ce00
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x1000ce17
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xe4], 0
je 0x1000ce15
jmp 0x1000ce17
jmp 0x1000cdf9
mov dword [ebp - 0x20], 0
jmp 0x1000ce27
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x1000cfad
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x500], eax
push 0
lea ecx, [ebp - 0x82c]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x500]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xe4]
cmp dword [ebp - 0x500], eax
jle 0x1000ce70
mov dword [ebp - 0x328], 1
jmp 0x1000ce77
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0xe4]
cmp dword [ebp - 0x328], eax
jne 0x1000ce95
mov dword [ebp - 0x438], 1
jmp 0x1000ce9c
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x4c0]
neg eax
sub eax, dword [ebp - 0x438]
cmp dword [ebp - 0x330], eax
jle 0x1000cebe
mov dword [ebp - 0x338], 1
jmp 0x1000cec5
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x4c0]
sub eax, dword [ebp - 0x338]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x1f0]
sub eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
cmp dword [ebp + ecx*4 - 0xe4], eax
jl 0x1000cef8
mov dword [ebp - 0x440], 1
jmp 0x1000ceff
and dword [ebp - 0x440], 0
cmp dword [ebp - 0x440], 9
ja 0x1000cf14
mov dword [ebp - 0x340], 1
jmp 0x1000cf1b
and dword [ebp - 0x340], 0
cmp dword [ebp - 0x340], 1
je 0x1000cf30
mov dword [ebp - 0x6cc], 1
jmp 0x1000cf37
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0xe4]
mov dword [ebp - 0x9f4], eax
push 0
lea ecx, [ebp - 0x82c]
call fcn.1002d7f4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xe4]
mov dword [ebp - 0x9fc], eax
push 3
lea ecx, [ebp - 0x838]
call fcn.1002d7f4
mov dword [eax], 0x2f109d40
mov byte [ebp - 0x85], 0
push 0x1b95
lea eax, [ebp - 0x85]
push eax
push 0x71e1
push 0x31c
push 1
push 0xdea
push 1
call fcn.1000ac3b
add esp, 0x1c
jmp 0x1000ce20
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x82c]
call fcn.1002d7e6
jmp 0x1000cd74
mov byte [ebp - 0x7f], 0
movzx eax, byte [ebp - 0x7f]
test eax, eax
je 0x1000cfda
push 0xe14
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1000cfe7
cmp dword [ebp - 0x1f0], 0
je 0x1000cfe7
jmp 0x1000cfec
jmp 0x1000cb21
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x1000d020
push 1
push 0xc60
push 1
push 0x3c81
push 0x2fb4
push 0
push 0x4176
call fcn.100275a3
add esp, 0x1c
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x838]
call fcn.1002d7e6
mov dword [ebp - 0x1b4], 0x37c5b151
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x348], 0x9d56
mov dword [ebp - 0x530], 1
mov dword [ebp - 0x600], 0xffffffff
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0x530], eax
cmp dword [ebp - 0x530], 1
jg 0x1000d0a3
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xa04], eax
mov eax, dword [ebp - 0x348]
imul eax, dword [ebp - 0x110]
add eax, dword [ebp - 0x110]
je 0x1000d0a3
mov dword [ebp - 0x448], 1
jmp 0x1000d0aa
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x448], eax
je 0x1000d0c4
mov dword [ebp - 0x350], 1
jmp 0x1000d0cb
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x110]
add eax, dword [ebp - 0x350]
mov dword [ebp - 0x600], eax
push 0
push 0x5ca1
push 1
push 1
push 0x2982
call fcn.100198ba
add esp, 0x14
mov dword [ebp - 0x194], 0
jmp 0x1000d10e
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0
jg 0x1000eaa2
push 3
lea ecx, [ebp - 0x85c]
call fcn.1002d70f
mov byte [ebp - 4], 0xc
push 1
lea ecx, [ebp - 0x844]
call fcn.1002d70f
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x6d4], 0
mov dword [ebp - 0x608], 0x29a275ff
lea eax, [ebp - 0x85c]
push eax
push 0
lea eax, [ebp - 0x714]
push eax
call fcn.100188ff
add esp, 0xc
push 0
lea eax, [ebp - 0x714]
push eax
lea eax, [ebp - 0x844]
push eax
call fcn.10026804
add esp, 0xc
mov byte [ebp - 0xad], 0
push 0
lea eax, [ebp - 0xad]
push eax
push 0x697a
push 0x7436
call fcn.100147eb
add esp, 0x10
push 0
push 0x61c0
push 0x1fbe
lea eax, [ebp - 0x608]
push eax
lea eax, [ebp - 0x844]
push eax
push 1
push 0x3f6e
lea eax, [ebp - 0x6d4]
push eax
lea eax, [ebp - 0x85c]
push eax
push 0x229f
call fcn.1000ad85
add esp, 0x28
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x844]
call fcn.1002d7e6
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x85c]
call fcn.1002d7e6
push 3
lea ecx, [ebp - 0x524]
call fcn.1002d70f
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x388], 9
mov dword [ebp - 0x628], 0xf3e16851
mov dword [ebp - 0x14], 0
jmp 0x1000d239
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffe5
jl 0x1000d5ab
mov dword [ebp - 0xa0c], 1
mov dword [ebp - 0x158], 0xfffffffe
mov dword [ebp - 0x620], 0x4dbdf902
mov dword [ebp - 0x724], 0xfffffffb
mov dword [ebp - 0x28], 0
jmp 0x1000d27b
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1000d291
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xd4], 6
jmp 0x1000d274
mov dword [ebp - 0x28], 0
jmp 0x1000d2a1
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1000d2b7
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x360], 0
jmp 0x1000d29a
mov dword [ebp - 0x28], 0
jmp 0x1000d2c7
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1000d2dd
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x944], 0
jmp 0x1000d2c0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd4], 0
jmp 0x1000d30b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xd4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd4], 0x16
jle 0x1000d3a3
mov dword [ebp - 0x610], 0x5155
cmp dword [ebp - 0x610], 0
jg 0x1000d33e
mov dword [ebp - 0x4c8], 1
jmp 0x1000d345
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x4c8], eax
jge 0x1000d35c
mov dword [ebp - 0x358], 1
jmp 0x1000d363
and dword [ebp - 0x358], 0
cmp dword [ebp - 0x358], 0xffffffff
je 0x1000d378
mov dword [ebp - 0x450], 1
jmp 0x1000d37f
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x158], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x158]
mov dword [ebp + eax - 0x360], ecx
jmp 0x1000d2f0
xor eax, eax
inc eax
je 0x1000d3e6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x360]
sub eax, 6
imul eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jne 0x1000d3cd
mov dword [ebp - 0x73c], 1
jmp 0x1000d3d4
and dword [ebp - 0x73c], 0
cmp dword [ebp - 0x14], 0xfc5
je 0x1000d3f5
mov eax, 0x2739425a
test eax, eax
jne 0x1000d3f5
cmp dword [ebp - 0x14], 0
jne 0x1000d3f5
and dword [ebp - 0x508], 0
jmp 0x1000d3ff
mov dword [ebp - 0x508], 1
cmp dword [ebp - 0x508], 0xea13
jl 0x1000d417
mov dword [ebp - 0x618], 1
jmp 0x1000d41e
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa14], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x14]
cmp dword [ebp + eax - 0xd4], ecx
je 0x1000d445
mov dword [ebp - 0x6dc], 1
jmp 0x1000d44c
and dword [ebp - 0x6dc], 0
cmp dword [ebp - 0x14], 1
jbe 0x1000d45e
mov dword [ebp - 0x368], 1
jmp 0x1000d465
and dword [ebp - 0x368], 0
cmp dword [ebp - 0x368], 4
jb 0x1000d47a
mov dword [ebp - 0x458], 1
jmp 0x1000d481
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x158]
cmp dword [ebp - 0x458], eax
jl 0x1000d49b
mov dword [ebp - 0x370], 1
jmp 0x1000d4a2
and dword [ebp - 0x370], 0
cmp dword [ebp - 0x370], 5
jne 0x1000d4b7
mov dword [ebp - 0x4d0], 1
jmp 0x1000d4be
and dword [ebp - 0x4d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd4]
cmp dword [ebp - 0x4d0], eax
jge 0x1000d4df
mov dword [ebp - 0x1d0], 1
jmp 0x1000d4e6
and dword [ebp - 0x1d0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1d0]
mov dword [ebp + eax - 0x944], ecx
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1d0], eax
jne 0x1000d510
mov dword [ebp - 0x378], 1
jmp 0x1000d517
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x620]
cmp dword [ebp - 0x378], eax
jne 0x1000d531
mov dword [ebp - 0x460], 1
jmp 0x1000d538
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x460]
add eax, 0x4cbed562
cmp eax, dword [ebp - 0x14]
je 0x1000d554
mov dword [ebp - 0x380], 1
jmp 0x1000d55b
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x380]
cmp eax, dword [ebp - 0x724]
jle 0x1000d582
cmp dword [ebp - 0x158], 0
je 0x1000d582
mov dword [ebp - 0x538], 1
jmp 0x1000d589
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x388]
add eax, 0xb878
mov dword [ebp - 0x628], eax
jmp 0x1000d232
and dword [ebp - 0x7ac], 0
and dword [ebp - 0x7a8], 0
and dword [ebp - 0x7a4], 0
and dword [ebp - 0x7a0], 0
lea ecx, [ebp - 0x1f9]
call fcn.1002d803
push eax
lea eax, [ebp - 0x79c]
push eax
lea eax, [ebp - 0x7ac]
push eax
lea ecx, [ebp - 0xadc]
call fcn.1002d806
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa4c]
call fcn.1002d7c0
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x94], 4
mov dword [ebp - 0xa1c], 0xffffffff
mov dword [ebp - 0xa24], 0xf38d927f
mov dword [ebp - 0xa2c], 0x6d39c7c6
mov dword [ebp - 0xa74], 9
mov dword [ebp - 0x934], 0xebd004dd
mov dword [ebp - 0xa84], 0xc29478c9
mov dword [ebp - 0xa8c], 0xfffffffb
mov dword [ebp - 0x17c], 0
jmp 0x1000d669
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 1
jge 0x1000d685
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x6e4], 8
jmp 0x1000d65c
mov byte [ebp - 0x86], 0
movzx eax, byte [ebp - 0x86]
test eax, eax
je 0x1000d6b7
push 0
push 1
push 0x504c
push 0x1d28
push 0x642a
push 0x6297
call fcn.1001d258
add esp, 0x18
mov dword [ebp - 0x94], 0
jmp 0x1000d6d0
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jg 0x1000d88c
mov dword [ebp - 0xa94], 7
mov dword [ebp - 0xa9c], 0x2e96673e
mov dword [ebp - 0xaa4], 0x1860ec01
mov dword [ebp - 0xaac], 0x8cf5a8b
mov dword [ebp - 0xa68], 0xd0176df7
mov dword [ebp - 0x93c], 0x1de6fc60
mov dword [ebp - 0x94c], 5
mov dword [ebp - 0x58], 0
jmp 0x1000d733
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x1000d749
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x7f0], 0x5849968c
jmp 0x1000d72c
mov dword [ebp - 0x58], 0
jmp 0x1000d759
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x1000d76f
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x820], 0x4179
jmp 0x1000d752
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp + eax*4 - 0x6e4]
mov dword [ebp - 0x9f0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x820]
add eax, 0x6964bd3b
mov dword [ebp - 0x630], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x820]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x820], eax
cmp dword [ebp - 0x630], 0xdc6d0f06
jne 0x1000d7ca
mov dword [ebp - 0x468], 1
jmp 0x1000d7d1
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x468]
je 0x1000d7eb
mov dword [ebp - 0x390], 1
jmp 0x1000d7f2
and dword [ebp - 0x390], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7f0]
mov dword [ebp - 0x948], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xa60], eax
cmp dword [ebp - 0x390], 0xe1a8
jge 0x1000d828
mov dword [ebp - 0x4d8], 1
jmp 0x1000d82f
and dword [ebp - 0x4d8], 0
cmp dword [ebp - 0x4d8], 0x5d9c7279
jle 0x1000d847
mov dword [ebp - 0x398], 1
jmp 0x1000d84e
and dword [ebp - 0x398], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7f0]
cmp dword [ebp - 0x398], eax
jl 0x1000d86e
mov dword [ebp - 0x470], 1
jmp 0x1000d875
and dword [ebp - 0x470], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x470]
mov dword [ebp + eax - 0x7f0], ecx
jmp 0x1000d6c3
mov dword [ebp - 0xcc], 0xf37d45db
mov dword [ebp - 0x160], 1
mov dword [ebp - 0x18c], 0xc4e2bf5
mov dword [ebp - 0x6ec], 0xe9f9034e
push 3
lea ecx, [ebp - 0x5a4]
call fcn.1002d70f
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x478], 0xf3bd791f
push 0
push 0x7ba5
push 0x3bdf
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0x5a4]
push eax
call fcn.1001d2e3
add esp, 0x14
mov dword [ebp - 0xec], 0
jmp 0x1000d90a
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jge 0x1000d926
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x768], 0xfffffff6
jmp 0x1000d8fd
cmp dword [ebp - 0xcc], 0
je 0x1000da97
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x160], eax
je 0x1000d94d
mov dword [ebp - 0x728], 1
jmp 0x1000d954
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x950], eax
mov eax, 0x1aa12afd
cmp eax, 1
jne 0x1000d976
mov dword [ebp - 0x3a0], 1
jmp 0x1000d97d
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x3a0], eax
jge 0x1000d997
mov dword [ebp - 0x638], 1
jmp 0x1000d99e
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x9f8], eax
cmp dword [ebp - 0x18c], 0x3acb6d6
jl 0x1000d9c2
mov dword [ebp - 0x510], 1
jmp 0x1000d9c9
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x6ec], eax
cmp dword [ebp - 0x160], 0
je 0x1000d9fc
push 0
lea ecx, [ebp - 0x5a4]
call fcn.1002d7f4
cmp dword [eax], 0
je 0x1000d9fc
mov dword [ebp - 0x3a8], 1
jmp 0x1000da03
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x478], eax
cmp dword [ebp - 0x478], 0xffffffff
jg 0x1000da24
mov dword [ebp - 0x3b0], 1
jmp 0x1000da2b
and dword [ebp - 0x3b0], 0
push 2
lea ecx, [ebp - 0x5a4]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x3b0]
cmp ecx, dword [eax]
je 0x1000da4e
mov dword [ebp - 0x4e0], 1
jmp 0x1000da55
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x4e0], eax
jne 0x1000da6f
mov dword [ebp - 0x640], 1
jmp 0x1000da76
and dword [ebp - 0x640], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x768]
cmp dword [ebp - 0x160], eax
jne 0x1000da97
mov dword [ebp - 0x3b8], 1
jmp 0x1000da9e
and dword [ebp - 0x3b8], 0
push 0
lea ecx, [ebp - 0x5a4]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x3b8]
imul ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x768]
jge 0x1000dacf
mov dword [ebp - 0x480], 1
jmp 0x1000dad6
and dword [ebp - 0x480], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x768]
cmp dword [ebp - 0x480], eax
je 0x1000daf7
mov dword [ebp - 0x3c0], 1
jmp 0x1000dafe
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0x3c0]
jge 0x1000db1e
mov eax, 0x15e0c0a
test eax, eax
jne 0x1000db1e
and dword [ebp - 0x534], 0
jmp 0x1000db28
mov dword [ebp - 0x534], 1
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0xcc], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x18c]
cmp dword [ebp + eax - 0x768], ecx
je 0x1000db54
mov dword [ebp - 0x238], 1
jmp 0x1000db5b
and dword [ebp - 0x238], 0
push 0
lea ecx, [ebp - 0x5a4]
call fcn.1002d7f4
mov eax, dword [eax]
add eax, 6
cmp dword [ebp - 0x238], eax
jg 0x1000db81
mov dword [ebp - 0x24c], 1
jmp 0x1000db88
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x5a4]
call fcn.1002d7e6
lea eax, [ebp - 0x524]
push eax
push 0x2976
push 0xf72
push 0x3ec0
push 0
push 0x21e9
lea eax, [ebp - 0x958]
push eax
call fcn.10011d05
add esp, 0x1c
mov byte [ebp - 0xbb], 0
push 0x8be
push 0x5da
push 0x3c1
lea eax, [ebp - 0xbb]
push eax
push 0
push 0x27af
push 1
push 0x4e0d
call fcn.10018471
add esp, 0x20
push 1
lea ecx, [ebp - 0x524]
call fcn.1002d7f4
and dword [eax], 0
jmp 0x1000dc38
push 1
lea ecx, [ebp - 0x524]
call fcn.1002d7f4
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x254]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x254]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x524]
call fcn.1002d7f4
cmp dword [eax], 0
jg 0x1000ea7f
mov dword [ebp - 0x74], 0x815cbcef
push 0x4444
push 0
push 0x111e
call fcn.1001125d
add esp, 0xc
mov dword [ebp - 0x168], 0
jmp 0x1000dc82
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 1
jge 0x1000dc9e
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0x744], 0xfffffffa
jmp 0x1000dc75
mov dword [ebp - 0x74], 0
jmp 0x1000dcae
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jl 0x1000e6d5
mov dword [ebp - 0x54], 0x24039b64
mov dword [ebp - 0x74c], 0x983a5c25
mov dword [ebp - 0x54], 0x1a
jmp 0x1000dcd9
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xffffffed
jle 0x1000e33b
mov dword [ebp - 0xf4], 9
mov dword [ebp - 0x1d8], 0xffffffff
mov dword [ebp - 0x730], 0x2580
cmp dword [ebp - 0x730], 0x12a0
jge 0x1000df4c
and dword [ebp - 0x930], 0
mov dword [ebp - 0x92c], 4
mov dword [ebp - 0x928], 0x16
mov dword [ebp - 0x924], 0x1b
mov dword [ebp - 0x920], 0x3a
mov dword [ebp - 0x91c], 0x55
mov dword [ebp - 0x918], 0x5e
mov dword [ebp - 0x914], 0xbf
mov dword [ebp - 0x910], 0xbf
mov dword [ebp - 0x90c], 0xbf
mov dword [ebp - 0x908], 0xbf
mov dword [ebp - 0x904], 0xbf
mov dword [ebp - 0x900], 0xbf
mov dword [ebp - 0x8fc], 0xbf
mov dword [ebp - 0x8f8], 0xbf
mov dword [ebp - 0x8f4], 0xbf
mov dword [ebp - 0x8f0], 0xbf
mov dword [ebp - 0x8ec], 0xbf
mov dword [ebp - 0x8e8], 0xbf
mov dword [ebp - 0x8e4], 0xbf
mov dword [ebp - 0x8e0], 0xbf
mov dword [ebp - 0x8dc], 0xbf
mov dword [ebp - 0x8d8], 0xbf
mov dword [ebp - 0x8d4], 0xbf
mov dword [ebp - 0x8d0], 0xbf
mov dword [ebp - 0x8cc], 0xbf
mov dword [ebp - 0x8c8], 0xbf
mov dword [ebp - 0x8c4], 0xbf
mov dword [ebp - 0x8c0], 0xbf
mov dword [ebp - 0x8bc], 0xbf
mov dword [ebp - 0x8b8], 0xbf
mov dword [ebp - 0x8b4], 0xbf
mov dword [ebp - 0x8b0], 0xbf
mov dword [ebp - 0x8ac], 0xbf
mov dword [ebp - 0x8a8], 0xbf
mov dword [ebp - 0x8a4], 0xbf
mov dword [ebp - 0x8a0], 0xbf
mov dword [ebp - 0x89c], 0xbf
mov dword [ebp - 0x898], 0xbf
mov dword [ebp - 0x894], 0xbf
mov dword [ebp - 0x890], 0xbf
mov dword [ebp - 0x88c], 0xbf
mov dword [ebp - 0x888], 0xbf
mov dword [ebp - 0x884], 0xbf
mov dword [ebp - 0x880], 0xbf
mov dword [ebp - 0x87c], 0xbf
mov dword [ebp - 0x878], 0xbf
mov dword [ebp - 0x874], 0xbf
mov dword [ebp - 0x870], 0xbf
mov dword [ebp - 0x86c], 0xbf
mov dword [ebp - 0x868], 0xbf
mov dword [ebp - 0x864], 0xbf
mov dword [ebp - 0x860], 0xbf
lea eax, [ebp - 0x648]
push eax
push 0x100080f0
call fcn.1005b040
pop ecx
pop ecx
mov eax, dword [ebp - 0x648]
push dword [ebp + eax*4 - 0x930]
push 0x10008114
call fcn.1005b488
pop ecx
pop ecx
mov dword [ebp - 0x2ac], 0xb2cbd72f
mov dword [ebp - 0xf4], 0
jmp 0x1000df6f
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0x15
jl 0x1000e336
mov dword [ebp - 0x6c], 0xf8067e3
mov dword [ebp - 0x140], 0xffffffff
mov dword [ebp - 0x6c], 0
jmp 0x1000df9d
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 9
jl 0x1000e331
mov dword [ebp - 0x4c], 0xc4185a1f
mov dword [ebp - 0x1f8], 0x18cb0b9d
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x4c], 3
jmp 0x1000dfd2
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffea
jl 0x1000e32c
mov dword [ebp - 0x208], 0x9968cb66
mov dword [ebp - 0x3c], 0x3f4b1415
mov dword [ebp - 0x274], 0x955f1bb1
mov dword [ebp - 0x6fc], 0x9d40
mov dword [ebp - 0x184], 0
jmp 0x1000e01a
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 3
jge 0x1000e036
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x5b0], 0xfffffffe
jmp 0x1000e00d
mov eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x6c]
je 0x1000e131
cmp dword [ebp - 0x54], 0
je 0x1000e0db
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0xa64], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x960], eax
cmp dword [ebp - 0x6c], 0
je 0x1000e085
cmp dword [ebp - 0x4c], 0
je 0x1000e085
mov dword [ebp - 0x25c], 1
jmp 0x1000e08c
and dword [ebp - 0x25c], 0
cmp dword [ebp - 0x25c], 0x2c512dc6
je 0x1000e0ad
cmp dword [ebp - 0x208], 0
je 0x1000e0ad
mov dword [ebp - 0x230], 1
jmp 0x1000e0b4
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
je 0x1000e0db
mov dword [ebp - 0x6f4], 1
jmp 0x1000e0e2
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xa00], eax
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x968], eax
cmp dword [ebp - 0x54], 0xc90e
jl 0x1000e10c
mov dword [ebp - 0x650], 1
jmp 0x1000e113
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xa6c], eax
cmp dword [ebp - 0x274], 0
je 0x1000e131
mov dword [ebp - 0x26c], 1
jmp 0x1000e138
and dword [ebp - 0x26c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x26c]
mov dword [ebp + eax - 0x5b0], ecx
mov dword [ebp - 0x3c], 0
jmp 0x1000e15b
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jg 0x1000e327
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x5b0], 0
je 0x1000e223
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp + eax*4 - 0x5b0], 0x144157db
mov dword [ebp - 0x74c], eax
cmp dword [ebp - 0x274], 0xeb8a064f
jne 0x1000e1a2
mov dword [ebp - 0x27c], 1
jmp 0x1000e1a9
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x27c]
cmp eax, dword [ebp - 0x1f8]
jne 0x1000e1c6
mov dword [ebp - 0x284], 1
jmp 0x1000e1cd
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0x284]
cmp eax, 0x3f0e
jl 0x1000e1e9
mov dword [ebp - 0x28c], 1
jmp 0x1000e1f0
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0x28c], eax
je 0x1000e20a
mov dword [ebp - 0x658], 1
jmp 0x1000e211
and dword [ebp - 0x658], 0
cmp dword [ebp - 0x54], 0
je 0x1000e223
mov dword [ebp - 0x294], 1
jmp 0x1000e22a
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x294]
neg eax
cmp eax, 0xfffffffb
je 0x1000e243
mov dword [ebp - 0x29c], 1
jmp 0x1000e24a
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x6fc], eax
mov eax, dword [ebp - 0x1d8]
sub eax, dword [ebp - 0x1f8]
cmp eax, 1
jle 0x1000e273
mov dword [ebp - 0x2a4], 1
jmp 0x1000e27a
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x1f8]
imul eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x970], eax
mov eax, dword [ebp - 0x2ac]
cmp dword [ebp - 0x4c], eax
je 0x1000e2f2
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x5b0]
mov dword [ebp - 0xa08], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x5b0]
mov dword [ebp - 0x978], eax
cmp dword [ebp - 0x4c], 0
jne 0x1000e2dc
cmp dword [ebp - 0x660], 0
jne 0x1000e2dc
and dword [ebp - 0x2b4], 0
jmp 0x1000e2e6
mov dword [ebp - 0x2b4], 1
mov eax, dword [ebp - 0x2b4]
sub eax, dword [ebp - 0x6c]
inc eax
je 0x1000e304
cmp dword [ebp - 0x54], 0
je 0x1000e304
mov dword [ebp - 0x2bc], 1
jmp 0x1000e30b
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp + eax*4 - 0x5b0]
imul eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x140], eax
jmp 0x1000e154
jmp 0x1000dfcb
jmp 0x1000df96
jmp 0x1000df62
jmp 0x1000dcd2
push 0
call fcn.10010776
pop ecx
mov dword [ebp - 0x40], 0x5db34e6d
mov dword [ebp - 0x2f4], 0x37855514
mov dword [ebp - 0xfc], 0x725245f5
push 2
lea ecx, [ebp - 0x850]
call fcn.1002d70f
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x1e0], 0x709ba87a
mov dword [ebp - 0x2ec], 0
mov dword [ebp - 0x144], 0
jmp 0x1000e39c
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 2
jge 0x1000e3be
push dword [ebp - 0x144]
lea ecx, [ebp - 0x850]
call fcn.1002d7f4
mov dword [eax], 0xfffffffe
jmp 0x1000e38f
cmp dword [ebp - 0x40], 0
jne 0x1000e3d3
cmp dword [ebp - 0x40], 0
jne 0x1000e3d3
and dword [ebp - 0x734], 0
jmp 0x1000e3dd
mov dword [ebp - 0x734], 1
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x1e0]
sub eax, 0xfffffffb
mov dword [ebp - 0x2c4], eax
push 0
lea ecx, [ebp - 0x850]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x2c4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x2c4], eax
jle 0x1000e431
cmp dword [ebp - 0x40], 0
jne 0x1000e431
and dword [ebp - 0x2cc], 0
jmp 0x1000e43b
mov dword [ebp - 0x2cc], 1
cmp dword [ebp - 0x2cc], 0xfffffff7
jle 0x1000e450
mov dword [ebp - 0x668], 1
jmp 0x1000e457
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x980], eax
mov eax, dword [ebp - 0x2f4]
cmp dword [ebp - 0xfc], eax
jg 0x1000e47d
mov dword [ebp - 0x2d4], 1
jmp 0x1000e484
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x2d4]
jg 0x1000e49b
mov dword [ebp - 0x2dc], 1
jmp 0x1000e4a2
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x2ec]
cmp dword [ebp - 0x2dc], eax
jle 0x1000e4bc
mov dword [ebp - 0x2e4], 1
jmp 0x1000e4c3
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x2e4]
imul eax, eax, 0xffffffff
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x40], 0x12
jmp 0x1000e4e6
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x17
jle 0x1000e545
mov dword [ebp - 0x704], 0xffffffff
push 0
push 1
push 0x12f9
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x704]
push eax
lea eax, [ebp - 0xfc]
push eax
push 0x6b7d
push 0x28dd
call fcn.1000b264
add esp, 0x20
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x2f4]
push eax
push 0
push 0x236f
call fcn.10018c76
add esp, 0x10
jmp 0x1000e4df
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x850]
call fcn.1002d7e6
mov dword [ebp - 0x14c], 0
jmp 0x1000e56d
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 1
jge 0x1000e589
mov eax, dword [ebp - 0x14c]
mov dword [ebp + eax*4 - 0x670], 1
jmp 0x1000e560
push 1
lea ecx, [ebp - 0x524]
call fcn.1002d7f4
push dword [eax]
lea ecx, [ebp - 0x720]
call fcn.1002d7f4
cmp dword [eax], 0x9ea7eb8e
je 0x1000e5b7
mov dword [ebp - 0x30c], 1
jmp 0x1000e5be
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x74]
lea eax, [eax + ecx + 0xbd4a]
cmp eax, dword [ebp - 0x74]
jg 0x1000e5dc
mov dword [ebp - 0x314], 1
jmp 0x1000e5e3
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x2fc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2fc]
mov dword [ebp + eax - 0x670], ecx
push 1
lea ecx, [ebp - 0x524]
call fcn.1002d7f4
push dword [eax]
lea ecx, [ebp - 0x720]
call fcn.1002d7f4
mov eax, dword [eax]
sub eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x304], eax
push 0
lea ecx, [ebp - 0xa4c]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x304]
mov dword [eax], ecx
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x30c]
sub eax, dword [ebp - 0x314]
cmp dword [ebp - 0x1b4], eax
je 0x1000e668
mov dword [ebp - 0x31c], 1
jmp 0x1000e66f
and dword [ebp - 0x31c], 0
push 1
lea ecx, [ebp - 0x524]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x31c]
cmp ecx, dword [eax]
jle 0x1000e692
mov dword [ebp - 0x324], 1
jmp 0x1000e699
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x324]
sub eax, 8
cmp eax, dword [ebp - 0xc4]
jg 0x1000e6b6
mov dword [ebp - 0x32c], 1
jmp 0x1000e6bd
and dword [ebp - 0x32c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x32c]
mov dword [ebp + eax - 0x744], ecx
jmp 0x1000dca7
mov dword [ebp - 0x5c], 0x80c170c
push 1
lea ecx, [ebp - 0x54c]
call fcn.1002d70f
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x104], 0x9942796a
mov dword [ebp - 0x120], 0
jmp 0x1000e710
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jge 0x1000e732
push dword [ebp - 0x120]
lea ecx, [ebp - 0x54c]
call fcn.1002d7f4
mov dword [eax], 0xa1654207
jmp 0x1000e703
cmp dword [ebp - 0x5c], 0
je 0x1000e74b
push 5
pop eax
test eax, eax
je 0x1000e74b
mov dword [ebp - 0x334], 1
jmp 0x1000e752
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x334]
cmp eax, dword [ebp - 0x5c]
jne 0x1000e76c
mov dword [ebp - 0x34c], 1
jmp 0x1000e773
and dword [ebp - 0x34c], 0
cmp dword [ebp - 0x5c], 0xfffffffd
jl 0x1000e785
mov dword [ebp - 0x33c], 1
jmp 0x1000e78c
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x33c], eax
jge 0x1000e7a3
mov dword [ebp - 0x1b0], 1
jmp 0x1000e7aa
and dword [ebp - 0x1b0], 0
push 0
lea ecx, [ebp - 0x54c]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x1b0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x1b0], eax
jge 0x1000e7d6
mov dword [ebp - 0x344], 1
jmp 0x1000e7dd
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x344], eax
je 0x1000e7fa
mov eax, 0xfffd
test eax, eax
jne 0x1000e7fa
and dword [ebp - 0x354], 0
jmp 0x1000e804
mov dword [ebp - 0x354], 1
mov eax, dword [ebp - 0x34c]
sub eax, dword [ebp - 0x354]
imul eax, eax, 0xf6b3
test eax, eax
je 0x1000e99c
mov dword [ebp - 0x374], 0xb3847d22
mov dword [ebp - 0x70c], 0
mov dword [ebp - 0x680], 0xfffffffe
push 0
lea ecx, [ebp - 0x54c]
call fcn.1002d7f4
mov esi, eax
push 0
lea ecx, [ebp - 0x54c]
call fcn.1002d7f4
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x1000e86a
mov dword [ebp - 0x678], 1
jmp 0x1000e871
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x70c]
mov dword [ebp - 0xa10], eax
mov esi, 0x3e1b8d81
inc esi
push 0
lea ecx, [ebp - 0x54c]
call fcn.1002d7f4
cmp esi, dword [eax]
jl 0x1000e8a0
mov dword [ebp - 0x35c], 1
jmp 0x1000e8a7
and dword [ebp - 0x35c], 0
cmp dword [ebp - 0x35c], 0
je 0x1000e8bc
mov dword [ebp - 0x364], 1
jmp 0x1000e8c3
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x364]
sub ecx, dword [ebp - 0x374]
imul eax, ecx
imul eax, dword [ebp - 0x104]
cmp eax, 9
jg 0x1000e8ed
mov dword [ebp - 0x36c], 1
jmp 0x1000e8f4
and dword [ebp - 0x36c], 0
cmp dword [ebp - 0x36c], 0xfffffffd
jle 0x1000e909
mov dword [ebp - 0x37c], 1
jmp 0x1000e910
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x374]
imul eax, dword [ebp - 0x37c]
mov dword [ebp - 0x22c], eax
push 0
lea ecx, [ebp - 0x54c]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x22c]
mov dword [eax], ecx
cmp dword [ebp - 0x22c], 0
jne 0x1000e94d
mov dword [ebp - 0x38c], 1
jmp 0x1000e954
and dword [ebp - 0x38c], 0
cmp dword [ebp - 0x38c], 1
je 0x1000e969
mov dword [ebp - 0x394], 1
jmp 0x1000e970
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x394], eax
jl 0x1000e987
mov dword [ebp - 0x39c], 1
jmp 0x1000e98e
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x680], eax
jmp 0x1000ea1a
mov dword [ebp - 0x6c4], 9
mov dword [ebp - 0x104], 0
jmp 0x1000e9bf
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x14
jg 0x1000e9ee
mov byte [ebp - 0x81], 0
push 0x7ba4
push 0x3541
push 0
lea eax, [ebp - 0x81]
push eax
push 0
call fcn.10014550
add esp, 0x14
jmp 0x1000e9b2
push 1
push 1
lea eax, [ebp - 0x6c4]
push eax
push 0x75b4
push 0x544
push 0x7c83
push 0x1091
push 0x5ab0
call fcn.1000b264
add esp, 0x20
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x54c]
call fcn.1002d7e6
lea eax, [ebp - 0x1b4]
push eax
push 0x322e
push 0
push 0x1495
push 0x274c
push 0x5abe
push 0x45fb
push 0x2ec4
push 0x39a1
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x720]
push eax
push 0xa77
push 0x70f8
push 0x4eea
call fcn.10014f82
add esp, 0x38
jmp 0x1000dc14
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xa4c]
call fcn.1002d7e6
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x524]
call fcn.1002d7e6
jmp 0x1000d101
mov dword [ebp - 0x10c], 0xac204e2d
mov dword [ebp - 0x10c], 0xfffffffb
jmp 0x1000eac5
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffe2
jne 0x1000ebc3
mov dword [ebp - 0x154], 0xe17ca002
mov dword [ebp - 0x154], 0x15
jmp 0x1000eaf5
mov eax, dword [ebp - 0x154]
dec eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xfffffff1
jg 0x1000eba1
mov dword [ebp - 0x15c], 0
jmp 0x1000eb1b
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 2
jge 0x1000eb37
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x58c], 1
jmp 0x1000eb0e
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x58c], 0
jmp 0x1000eb65
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x58c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x58c], 0xffffffee
jg 0x1000eb9c
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x1000eb9a
push 0
push 0x1df0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x1000eb4a
jmp 0x1000eae8
mov byte [ebp - 0x84], 0
push 0x5a44
push 0
lea eax, [ebp - 0x84]
push eax
call fcn.100250f4
add esp, 0xc
jmp 0x1000eab8
push 0
lea eax, [ebp - 0x10c]
push eax
push 0x2b75
push 0x425d
push 0x65b8
call fcn.10016a7d
add esp, 0x14
mov dword [ebp - 0x7c], 0xfffffffb
mov dword [ebp - 0x1cc], 0x6893
mov dword [ebp - 0x3b4], 0xfffffffb
mov dword [ebp - 0x574], 7
mov dword [ebp - 0x570], 7
mov dword [ebp - 0x56c], 7
mov dword [ebp - 0x568], 7
mov dword [ebp - 0x7c], 0xffffffe7
jmp 0x1000ec36
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xffffffe9
je 0x1000f166
mov dword [ebp - 0x48], 0x73d2d672
push 3
lea ecx, [ebp - 0x598]
call fcn.1002d70f
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x164], 0
jmp 0x1000ec71
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 3
jge 0x1000ec90
push dword [ebp - 0x164]
lea ecx, [ebp - 0x598]
call fcn.1002d7f4
or dword [eax], 0xffffffff
jmp 0x1000ec64
lea eax, [ebp - 0x3b4]
push eax
push 0x33bd
push 0x2e89
push 1
lea eax, [ebp - 0x1cc]
push eax
push 0x7f39
push 0xd0b
push 0x2082
push 1
push 0
call fcn.10026db5
add esp, 0x28
cmp dword [ebp - 0x48], 0x358b
jl 0x1000f007
mov dword [ebp - 0xc8], 8
mov dword [ebp - 0x1c4], 0x64c7b7f6
push 1
lea ecx, [ebp - 0x774]
call fcn.1002d70f
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x16c], 0
jmp 0x1000ed10
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 1
jge 0x1000ed2f
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x774]
call fcn.1002d7f4
and dword [eax], 0
jmp 0x1000ed03
cmp dword [ebp - 0x48], 0
jne 0x1000ee7e
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x3a4], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3a4]
mov dword [ebp + eax - 0x574], ecx
cmp dword [ebp - 0x3a4], 0
jne 0x1000ed78
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x988], eax
mov eax, 0x2c5d177c
test eax, eax
jne 0x1000ed78
and dword [ebp - 0x3ac], 0
jmp 0x1000ed82
mov dword [ebp - 0x3ac], 1
mov eax, dword [ebp - 0x3ac]
sub eax, dword [ebp - 0xc8]
je 0x1000eda2
cmp dword [ebp - 0x48], 0
je 0x1000eda2
mov dword [ebp - 0x688], 1
jmp 0x1000eda9
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xa70], eax
mov eax, dword [ebp - 0x3b4]
cmp dword [ebp - 0x48], eax
jne 0x1000edcc
mov dword [ebp - 0x3bc], 1
jmp 0x1000edd3
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x3bc], eax
jle 0x1000edf9
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x574], 0
jne 0x1000edf9
and dword [ebp - 0x3c4], 0
jmp 0x1000ee03
mov dword [ebp - 0x3c4], 1
mov eax, dword [ebp - 0xc8]
add eax, dword [ebp - 0x3c4]
jne 0x1000ee20
cmp dword [ebp - 0x7c], 0
jne 0x1000ee20
and dword [ebp - 0x3cc], 0
jmp 0x1000ee2a
mov dword [ebp - 0x3cc], 1
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1c4]
cmp eax, dword [ebp - 0x3cc]
je 0x1000ee50
mov dword [ebp - 0x3d4], 1
jmp 0x1000ee57
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x3d4]
jg 0x1000ee74
cmp dword [ebp - 0xc8], 0
jne 0x1000ee74
and dword [ebp - 0x3dc], 0
jmp 0x1000ee7e
mov dword [ebp - 0x3dc], 1
push 0
lea ecx, [ebp - 0x774]
call fcn.1002d7f4
mov dword [eax], 0xfffffffd
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x48]
add eax, 0xffff
cmp eax, dword [ebp - 0x7c]
jl 0x1000eeae
mov dword [ebp - 0x3e4], 1
jmp 0x1000eeb5
and dword [ebp - 0x3e4], 0
cmp dword [ebp - 0x3e4], 0
je 0x1000eeca
mov dword [ebp - 0x1bc], 1
jmp 0x1000eed1
and dword [ebp - 0x1bc], 0
push 0
lea ecx, [ebp - 0x774]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x1bc]
mov dword [eax], ecx
cmp dword [ebp - 0x1bc], 7
jae 0x1000ef07
cmp dword [ebp - 0x7c], 0
jne 0x1000ef07
mov eax, 0xbacd
test eax, eax
jne 0x1000ef07
and dword [ebp - 0x3ec], 0
jmp 0x1000ef11
mov dword [ebp - 0x3ec], 1
push 1
lea ecx, [ebp - 0x598]
call fcn.1002d7f4
mov dword [eax], 0x99f2dc87
cmp dword [ebp - 0x3ec], 0x99f2dc87
jge 0x1000ef3c
mov dword [ebp - 0x3f4], 1
jmp 0x1000ef43
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x1cc]
cmp eax, dword [ebp - 0x3f4]
jl 0x1000ef5d
mov dword [ebp - 0x404], 1
jmp 0x1000ef64
and dword [ebp - 0x404], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x574]
mov dword [ebp - 0x3fc], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3fc]
mov dword [ebp + eax - 0x574], ecx
mov eax, dword [ebp - 0x3fc]
cmp eax, dword [ebp - 0x404]
je 0x1000efa3
mov dword [ebp - 0x40c], 1
jmp 0x1000efaa
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x40c]
jne 0x1000efc1
mov dword [ebp - 0x414], 1
jmp 0x1000efc8
and dword [ebp - 0x414], 0
cmp dword [ebp - 0x414], 0x8d550032
jae 0x1000efe0
mov dword [ebp - 0x41c], 1
jmp 0x1000efe7
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x1c4], eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x774]
call fcn.1002d7e6
jmp 0x1000f152
mov dword [ebp - 0xd0], 0
mov byte [ebp - 0x82], 0
movzx eax, byte [ebp - 0x82]
test eax, eax
je 0x1000f039
push 1
push 0x6993
push 0x2762
push 1
call fcn.1000b37a
add esp, 0x10
cmp dword [ebp - 0x1cc], 0
je 0x1000f057
cmp dword [ebp - 0xd0], 0
je 0x1000f057
mov dword [ebp - 0x6c8], 1
jmp 0x1000f05e
and dword [ebp - 0x6c8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x574]
sub eax, dword [ebp - 0x48]
jne 0x1000f081
cmp dword [ebp - 0xd0], 0
jne 0x1000f081
and dword [ebp - 0x424], 0
jmp 0x1000f08b
mov dword [ebp - 0x424], 1
cmp dword [ebp - 0x424], 0xfffffffe
jle 0x1000f0a0
mov dword [ebp - 0x690], 1
jmp 0x1000f0a7
and dword [ebp - 0x690], 0
push 2
lea ecx, [ebp - 0x598]
call fcn.1002d7f4
push 0
lea ecx, [ebp - 0x598]
call fcn.1002d7f4
mov ecx, dword [ebp - 0xd0]
cmp dword [eax], ecx
jg 0x1000f0d7
mov dword [ebp - 0x6d0], 1
jmp 0x1000f0de
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x990], eax
push 1
lea ecx, [ebp - 0x598]
call fcn.1002d7f4
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xa18], eax
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0xd0], eax
jle 0x1000f11a
mov dword [ebp - 0x42c], 1
jmp 0x1000f121
and dword [ebp - 0x42c], 0
cmp dword [ebp - 0x42c], 0x26ebb4d
je 0x1000f139
mov dword [ebp - 0x434], 1
jmp 0x1000f140
and dword [ebp - 0x434], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x434]
mov dword [ebp + eax - 0x574], ecx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x598]
call fcn.1002d7e6
jmp 0x1000ec2f
mov byte [ebp - 0xba], 0
push 0x2a1a
push 0
lea eax, [ebp - 0xba]
push eax
push 0x2203
push 1
push 0x47da
call fcn.10011d6d
add esp, 0x18
jmp 0x1000c939
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x720]
call fcn.1002d7e6
mov dword [ebp - 0x1dc], 3
mov dword [ebp - 0x45c], 1
mov dword [ebp - 0x9c], 1
mov dword [ebp - 0x1d4], 1
mov dword [ebp - 0x178], 0
jmp 0x1000f1e4
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 4
jge 0x1000f200
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x248], 0xffffffff
jmp 0x1000f1d7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x248]
mov dword [ebp - 0x9c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x248]
mov dword [ebp - 0x998], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa90], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x248], 0
je 0x1000f250
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x248], 0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x9a0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x248]
cmp dword [ebp - 0x9c], eax
jle 0x1000f289
mov dword [ebp - 0x43c], 1
jmp 0x1000f290
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0x43c], eax
jle 0x1000f2aa
mov dword [ebp - 0x444], 1
jmp 0x1000f2b1
and dword [ebp - 0x444], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x444]
sub ecx, dword [ebp + eax - 0x248]
imul eax, ecx, 0x3927
cmp eax, 0xee56
jl 0x1000f2dd
mov dword [ebp - 0x44c], 1
jmp 0x1000f2e4
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0x44c], eax
jg 0x1000f2fe
mov dword [ebp - 0x454], 1
jmp 0x1000f305
and dword [ebp - 0x454], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x248]
cmp dword [ebp - 0x454], eax
jne 0x1000f325
mov dword [ebp - 0x698], 1
jmp 0x1000f32c
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa20], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1d4]
cmp dword [ebp + eax - 0x248], ecx
jne 0x1000f359
mov dword [ebp - 0x464], 1
jmp 0x1000f360
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x6d8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x248]
imul eax, dword [ebp - 0x464]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x248]
sub ecx, eax
mov dword [ebp - 0x6a0], ecx
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x6d8]
cmp eax, dword [ebp - 0x6a0]
jg 0x1000f3c8
mov dword [ebp - 0x46c], 1
jmp 0x1000f3cf
and dword [ebp - 0x46c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x46c]
mov dword [ebp + eax - 0x248], ecx
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x1000f58a
push 0xde3
push 0
call fcn.1001695a
pop ecx
pop ecx
mov dword [ebp - 0x6e0], 0x1b90
cmp dword [ebp - 0x6e0], 0xfc0
jge 0x1000f58a
push 0x20000
push 0
lea eax, [ebp - 0x20b30]
push eax
call fcn.10039b0d
add esp, 0xc
and dword [ebp - 0x24], 0
jmp 0x1000f443
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x9f
jg 0x1000f54c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
jmp 0x1000f45f
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c]
add eax, ecx
cmp eax, 0x8000
jge 0x1000f547
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
jmp 0x1000f489
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c]
add eax, ecx
mov ecx, dword [ebp - 0x34]
imul ecx, dword [ebp - 0x34]
add eax, ecx
cmp eax, 0x8000
jge 0x1000f542
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x70], eax
jmp 0x1000f4bc
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c]
add eax, ecx
mov ecx, dword [ebp - 0x34]
imul ecx, dword [ebp - 0x34]
add eax, ecx
mov ecx, dword [ebp - 0x70]
imul ecx, dword [ebp - 0x70]
add eax, ecx
cmp eax, 0x8000
jge 0x1000f53d
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
imul ecx, dword [ebp - 0x2c]
add eax, ecx
mov ecx, dword [ebp - 0x34]
imul ecx, dword [ebp - 0x34]
add eax, ecx
mov ecx, dword [ebp - 0x70]
imul ecx, dword [ebp - 0x70]
add eax, ecx
mov eax, dword [ebp + eax*4 - 0x20b30]
inc eax
mov ecx, dword [ebp - 0x70]
imul ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x34]
imul edx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x2c]
imul esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x24]
imul edi, dword [ebp - 0x24]
add edi, esi
add edi, edx
add edi, ecx
mov dword [ebp + edi*4 - 0x20b30], eax
jmp 0x1000f4b5
jmp 0x1000f482
jmp 0x1000f458
jmp 0x1000f43c
xor eax, eax
inc eax
je 0x1000f58a
lea eax, [ebp - 0x474]
push eax
push 0x100080f0
call fcn.1005b040
pop ecx
pop ecx
cmp dword [ebp - 0x474], 0
jne 0x1000f56f
jmp 0x1000f58a
mov eax, dword [ebp - 0x474]
push dword [ebp + eax*4 - 0x20b30]
push 0x10008114
call fcn.1005b488
pop ecx
pop ecx
jmp 0x1000f54c
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x180]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0xa4], 0xc0d37ad4
mov dword [ebp - 0xd8], 1
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0xd8], eax
jle 0x1000f63f
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x9a8], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xa78], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x9b0], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xa28], eax
cmp dword [ebp - 0xd8], 0
jne 0x1000f61e
cmp dword [ebp - 0xa4], 0
jne 0x1000f61e
and dword [ebp - 0x47c], 0
jmp 0x1000f628
mov dword [ebp - 0x47c], 1
mov eax, dword [ebp - 0xa4]
sub eax, dword [ebp - 0x47c]
jne 0x1000f63f
and dword [ebp - 0x484], 0
jmp 0x1000f649
mov dword [ebp - 0x484], 1
cmp dword [ebp - 0x484], 0xdf1febae
jne 0x1000f67a
mov byte [ebp - 0x8d], 0
lea eax, [ebp - 0x8d]
push eax
push 0
call fcn.1001989e
pop ecx
pop ecx
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xd8], eax
jmp 0x1000f6ab
mov dword [ebp - 0x6e8], 0xa96950a4
mov dword [ebp - 0x6a8], 0x9f7a9d2e
lea eax, [ebp - 0x6a8]
push eax
lea eax, [ebp - 0x6e8]
push eax
push 0
push 0x62f4
call fcn.1001999c
add esp, 0x10
and dword [ebp - 0x1e4], 0
jmp 0x1000f6ca
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x60]
add eax, 0x28
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x180]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x1e4], eax
jge 0x10010165
push 3
lea ecx, [ebp - 0x558]
call fcn.1002d70f
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x114], 0
jmp 0x1000f70f
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 3
jge 0x1000f72b
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0xa5c], 0x7117
jmp 0x1000f702
push 0x3df6
lea eax, [ebp - 0x114]
push eax
push 0x4daa
lea eax, [ebp - 0x558]
push eax
push 1
push 0x16c7
push 0x6a4e
push 1
call fcn.1000b4ee
add esp, 0x20
push 0
lea ecx, [ebp - 0x558]
call fcn.1002d7f4
mov dword [eax], 2
jmp 0x1000f792
push 0
lea ecx, [ebp - 0x558]
call fcn.1002d7f4
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x48c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x48c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x558]
call fcn.1002d7f4
cmp dword [eax], 0
jl 0x1000f7f5
push 0
lea ecx, [ebp - 0x558]
call fcn.1002d7f4
mov esi, dword [eax]
push 0
lea ecx, [ebp - 0x558]
call fcn.1002d7f4
mov eax, dword [eax]
mov ecx, dword [ebp + esi*4 - 0xa5c]
mov dword [ebp + eax*4 - 0xa5c], ecx
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x1000f7f0
push 0x139
push 0
push 0x4616
call fcn.10027459
add esp, 0xc
jmp 0x1000f76e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x558]
call fcn.1002d7e6
mov eax, dword [ebp - 0x60]
cmp dword [eax + 0x10], 0
jne 0x1000fdbb
push 1
push dword [ebp - 0x60]
push 0
push dword [ebp - 0x6b0]
lea eax, [ebp - 0x1f4]
push eax
push 1
push 0x4fd7
push dword [ebp - 0x4f4]
push 0x201a
push 0x7d03
call fcn.1001d66c
add esp, 0x28
push 4
lea ecx, [ebp - 0x808]
call fcn.1002d70f
mov dword [ebp - 4], 0x16
push 1
lea ecx, [ebp - 0x564]
call fcn.1002d70f
mov byte [ebp - 4], 0x17
push 0x5c9e
push 0x3a54
push 0x7f1e
push 0x7875
lea eax, [ebp - 0x808]
push eax
push 1
push 0x288b
push 0x43
lea eax, [ebp - 0x50]
push eax
push 0x1690
push 0
push 0xc1d
push 0x55f4
push 1
call fcn.10026480
add esp, 0x38
mov dword [ebp - 0x50], 0
jmp 0x1000f8bc
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x1000f8d8
push dword [ebp - 0x50]
lea ecx, [ebp - 0x564]
call fcn.1002d7f4
mov dword [eax], 0x1febaeef
jmp 0x1000f8b5
mov dword [ebp - 0x50], 0
jmp 0x1000f8e8
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x1000f8fe
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x584], 0xe00f6802
jmp 0x1000f8e1
push 0
lea ecx, [ebp - 0x564]
call fcn.1002d7f4
and dword [eax], 0
jmp 0x1000f934
push 0
lea ecx, [ebp - 0x564]
call fcn.1002d7f4
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x494]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x494]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x564]
call fcn.1002d7f4
cmp dword [eax], 3
jg 0x1000fd98
mov dword [ebp - 0x5d8], 0xfffe
mov dword [ebp - 0x5d4], 0xfffe
mov dword [ebp - 0x5d0], 0xfffe
mov dword [ebp - 0x5cc], 0xfffe
push 4
lea ecx, [ebp - 0x5bc]
call fcn.1002d70f
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x38], 0xa2b441a6
mov dword [ebp - 0x6f0], 0x24ad
cmp dword [ebp - 0x6f0], 0xc60
jge 0x1000fa06
call fcn.1005b17a
push 0x20
pop ecx
imul ecx, ecx, 0
add eax, ecx
push eax
push 0x1000812c
push 0x10008130
call fcn.1005b6cf
add esp, 0xc
push 0x108c2d88
push 0x100080f0
call fcn.1005b040
pop ecx
pop ecx
push 0x3d0904
push 0xffffffffffffffff
push 0x108c3198
call fcn.10039b0d
add esp, 0xc
push dword [0x108c2d88]
call fcn.1000b661
pop ecx
cdq
mov ecx, 0x3b9aca07
idiv ecx
push edx
push 0x10008114
call fcn.1005b488
pop ecx
pop ecx
mov dword [ebp - 0x124], 0
jmp 0x1000fa1f
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 4
jge 0x1000fa3e
push dword [ebp - 0x124]
lea ecx, [ebp - 0x5bc]
call fcn.1002d7f4
and dword [eax], 0
jmp 0x1000fa12
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5d8]
mov dword [ebp - 0x9b8], eax
push 0
lea ecx, [ebp - 0x564]
call fcn.1002d7f4
push 0
lea ecx, [ebp - 0x5bc]
call fcn.1002d7f4
mov dword [eax], 0x895196ee
mov dword [ebp - 0x38], 0x895196ee
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x584]
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x9c0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5d8]
mov dword [ebp - 0xa30], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x584]
cmp dword [ebp + eax - 0x584], ecx
je 0x1000fad6
xor eax, eax
jne 0x1000fad6
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5d8], 0
je 0x1000fb13
mov dword [ebp - 0x38], 0
jmp 0x1000fae6
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jg 0x1000fb0e
mov byte [ebp - 0xb8], 0
movzx eax, byte [ebp - 0xb8]
test eax, eax
je 0x1000fb0c
push 0
push 0x3468
call fcn.10010c4f
pop ecx
pop ecx
jmp 0x1000fadf
jmp 0x1000fd84
mov dword [ebp - 0x1ec], 0x60d1
mov dword [ebp - 0x6f8], 0x1d4b4ea6
mov dword [ebp - 0x9c8], 8
mov dword [ebp - 0xa80], 1
mov dword [ebp - 0x9d0], 0x203d7e6d
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x584], 1
mov dword [ebp - 0x38], 3
jmp 0x1000fb66
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1000fd84
mov dword [ebp - 0x64], 0xc88fed6c
mov dword [ebp - 0xa40], 0x99fffbc9
mov dword [ebp - 0x9d8], 0xfc6bf2a6
mov dword [ebp - 0x4ec], 0x6852
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xa98], eax
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 0x64], eax
jne 0x1000fbb5
mov dword [ebp - 0x49c], 1
jmp 0x1000fbbc
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x49c]
neg eax
cmp eax, 0x6c1d
je 0x1000fbe6
push 3
lea ecx, [ebp - 0x5bc]
call fcn.1002d7f4
cmp dword [eax], 0
jne 0x1000fbe6
and dword [ebp - 0x4a4], 0
jmp 0x1000fbf0
mov dword [ebp - 0x4a4], 1
mov esi, dword [ebp - 0x64]
add esi, dword [ebp - 0x4a4]
push 0
lea ecx, [ebp - 0x564]
call fcn.1002d7f4
cmp esi, dword [eax]
jl 0x1000fc16
mov dword [ebp - 0x4ac], 1
jmp 0x1000fc1d
and dword [ebp - 0x4ac], 0
cmp dword [ebp - 0x4ac], 0x60d4
jl 0x1000fc35
mov dword [ebp - 0x4b4], 1
jmp 0x1000fc3c
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x1ec]
add eax, dword [ebp - 0x4b4]
je 0x1000fc65
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x5d8], 0
je 0x1000fc65
mov dword [ebp - 0x4bc], 1
jmp 0x1000fc6c
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 0x4bc], eax
jle 0x1000fc8c
cmp dword [ebp - 0x64], 0
je 0x1000fc8c
mov dword [ebp - 0x4c4], 1
jmp 0x1000fc93
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x4c4], eax
je 0x1000fcaa
mov dword [ebp - 0x4cc], 1
jmp 0x1000fcb1
and dword [ebp - 0x4cc], 0
push 2
lea ecx, [ebp - 0x808]
call fcn.1002d7f4
mov eax, dword [eax]
cmp eax, dword [ebp - 0x4cc]
jl 0x1000fcd4
mov dword [ebp - 0x4d4], 1
jmp 0x1000fcdb
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x64]
add eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x4dc], eax
push 3
lea ecx, [ebp - 0x5bc]
call fcn.1002d7f4
mov ecx, dword [ebp - 0x4dc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x4dc]
cmp eax, dword [ebp - 0x64]
je 0x1000fd1a
mov dword [ebp - 0x6b8], 1
jmp 0x1000fd21
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x9e0], eax
push 3
lea ecx, [ebp - 0x5bc]
call fcn.1002d7f4
imul eax, dword [eax], 0xbb35
add eax, 0x330167c3
sub eax, dword [ebp - 0x64]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x5d8]
jl 0x1000fd5f
mov dword [ebp - 0x4e4], 1
jmp 0x1000fd66
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x6f8], eax
mov eax, dword [ebp - 0x4ec]
dec eax
mov dword [ebp - 0x4ec], eax
jmp 0x1000fb5f
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x5bc]
call fcn.1002d7e6
jmp 0x1000f910
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x564]
call fcn.1002d7e6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x808]
call fcn.1002d7e6
jmp 0x1000f6b4
mov dword [ebp - 0xf0], 0xbd035c57
mov dword [ebp - 0x5ec], 0x6fda0246
mov dword [ebp - 0x5e4], 0xbc35
mov dword [ebp - 0x5e0], 0xfffffffa
mov dword [ebp - 0x11c], 1
mov dword [ebp - 0x798], 0x7f17245c
mov dword [ebp - 0x794], 0x7f17245c
mov dword [ebp - 0x790], 0x7f17245c
mov dword [ebp - 0x78c], 0x7f17245c
lea ecx, [ebp - 0x201]
call fcn.1002d803
push eax
lea eax, [ebp - 0x788]
push eax
lea eax, [ebp - 0x798]
push eax
lea ecx, [ebp - 0xae4]
call fcn.1002d806
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xac4]
call fcn.1002d7c0
mov dword [ebp - 4], 0x19
lea eax, [ebp - 0x5e0]
push eax
push 0
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0x5e4]
push eax
lea eax, [ebp - 0x5ec]
push eax
push 0xf1a
call fcn.10011d3f
add esp, 0x1c
mov dword [ebp - 0x11c], 0
jmp 0x1000fe9c
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 3
jg 0x1000ff2d
mov dword [ebp - 0x5f4], 0xfffe
mov dword [ebp - 0x5fc], 0xfffffffe
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x1000feea
push 0x5b0c
push 0x4ab7
push 1
push 0x2af2
push 0
call fcn.10014550
add esp, 0x14
mov dword [ebp - 0xf0], 0
jmp 0x1000ff03
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 3
jg 0x1000ff28
mov dword [ebp - 0x5f4], 1
lea eax, [ebp - 0x5fc]
push eax
push 0
call fcn.10010d3d
pop ecx
pop ecx
jmp 0x1000fef6
jmp 0x1000fe8f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac4]
call fcn.1002d7e6
push 4
push 0x1000
mov eax, dword [ebp - 0x60]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x4f4]
add ecx, dword [eax + 0xc]
push ecx
push 0x41df
push 0x4930
call fcn.10039911
pop ecx
pop ecx
call eax
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x60]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x604]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x1f4]
call fcn.10039a62
add esp, 0xc
mov dword [ebp - 0x60c], 0x1f7f
cmp dword [ebp - 0x60c], 0x6b3
jge 0x10010154
mov dword [ebp - 0xa50], 4
and dword [ebp - 0xb24], 0
push 0x3c
push 0
lea eax, [ebp - 0xb20]
push eax
call fcn.1005b540
add esp, 0xc
and dword [ebp - 0x128], 0
jmp 0x1000ffe4
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 4
jge 0x10010057
and dword [ebp - 0x130], 0
jmp 0x10010003
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 4
jge 0x1001004a
lea eax, [ebp - 0xb6]
push eax
push 0x10008110
call fcn.1005b040
pop ecx
pop ecx
movsx eax, byte [ebp - 0xb6]
cmp eax, 0x2e
jne 0x10010048
mov eax, dword [ebp - 0x128]
shl eax, 4
lea eax, [ebp + eax - 0xb24]
mov ecx, dword [ebp - 0x130]
mov dword [eax + ecx*4], 1
jmp 0x1000fff6
push 0x1000813c
call fcn.1005b040
pop ecx
jmp 0x1000ffd7
mov byte [ebp - 0x41], 0
and dword [ebp - 0xac], 0
jmp 0x10010071
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jge 0x10010128
and dword [ebp - 0xb4], 0
jmp 0x10010094
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x10010123
mov eax, dword [ebp - 0xac]
shl eax, 4
lea eax, [ebp + eax - 0xb24]
mov ecx, dword [ebp - 0xac]
inc ecx
shl ecx, 4
lea ecx, [ebp + ecx - 0xb24]
mov edx, dword [ebp - 0xb4]
mov eax, dword [eax + edx*4]
mov edx, dword [ebp - 0xb4]
add eax, dword [ecx + edx*4 + 4]
mov ecx, dword [ebp - 0xac]
inc ecx
shl ecx, 4
lea ecx, [ebp + ecx - 0xb24]
mov edx, dword [ebp - 0xb4]
add eax, dword [ecx + edx*4]
mov ecx, dword [ebp - 0xac]
shl ecx, 4
lea ecx, [ebp + ecx - 0xb24]
mov edx, dword [ebp - 0xb4]
add eax, dword [ecx + edx*4 + 4]
mov dword [ebp - 0x614], eax
cmp dword [ebp - 0x614], 2
je 0x1001011e
mov byte [ebp - 0x41], 1
jmp 0x10010123
jmp 0x10010087
jmp 0x10010064
movzx eax, byte [ebp - 0x41]
test eax, eax
je 0x10010143
push 0x10008140
call fcn.1005b488
pop ecx
mov dword [ebp - 0x61c], eax
jmp 0x10010154
push 0x10008148
call fcn.1005b488
pop ecx
mov dword [ebp - 0x61c], eax
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x1f4]
mov dword [eax + 8], ecx
jmp 0x1000f6b4
jmp 0x100101ef
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x63c]
mov dword [ebp - 0x644], eax
mov eax, dword [ebp - 0x138]
mov dword [eax], 0x16
jmp 0x100101b9
mov eax, dword [ebp - 0x138]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x138]
mov dword [ecx], eax
mov eax, dword [ebp - 0x138]
cmp dword [eax], 0xfffffff7
jg 0x100101ef
mov dword [ebp - 0x4fc], 0xfffffffa
mov dword [ebp - 0x4fc], 0
mov esi, dword [ebp - 0x4fc]
push 2
mov ecx, dword [ebp - 0x644]
call fcn.1002d7f4
mov dword [eax], esi
jmp 0x100101a8
jmp 0x10010223
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x64c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x654], eax
push dword [ebp - 0x64c]
push dword [ebp - 0x654]
push 0x6ddd
push 0x63a4
push 0
call fcn.1000a5df
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret