Function at 0x1001e9fb
Capabilities:
Contain obfuscated stackstrings
Modify service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080a33
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb88
push esi
push edi
mov eax, dword [0x10cbe764]
and eax, 1
jne 0x1001ea4f
mov eax, dword [0x10cbe764]
or eax, 1
mov dword [0x10cbe764], eax
and dword [ebp - 4], 0
mov ecx, 0x10cbe7c8
call fcn.10017279
push 0x1008279e
call fcn.10068f86
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x708], 0xffffffff
mov dword [ebp - 0xa8], 1
push 4
lea ecx, [ebp - 0x938]
call fcn.100170df
mov dword [ebp - 4], 1
mov dword [ebp - 0x118], 0
jmp 0x1001ea90
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 4
jge 0x1001eaaf
push dword [ebp - 0x118]
lea ecx, [ebp - 0x938]
call fcn.10017169
or dword [eax], 0xffffffff
jmp 0x1001ea83
lea eax, [ebp - 0xa8]
push eax
push 0
lea eax, [ebp - 0x708]
push eax
push 0x3c54
call fcn.1001da17
add esp, 0x10
mov dword [ebp - 0xa8], 0
jmp 0x1001eae5
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 4
jge 0x1001eb12
push 0
push 0x215b
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x938]
push eax
push 0x714f
call fcn.1001de1e
add esp, 0x14
jmp 0x1001ead8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x938]
call fcn.10017164
push dword [ebp + 8]
lea ecx, [ebp - 0x92c]
call fcn.10016e94
mov dword [ebp - 4], 2
mov dword [ebp - 0x970], 0xf112
mov dword [ebp - 0xab0], 0x8901f2c2
mov dword [ebp - 0x9f0], 0x3fa75c19
mov dword [ebp - 0xafc], 0xfddd3f46
mov dword [ebp - 0x9f8], 2
push 4
lea ecx, [ebp - 0xa10]
call fcn.100170df
mov byte [ebp - 4], 3
mov dword [ebp - 0xa38], 0x4e665969
mov dword [ebp - 0x3b4], 3
lea eax, [ebp - 0xa10]
push eax
lea eax, [ebp - 0xaec]
push eax
push 1
call fcn.1001d78c
add esp, 0xc
mov eax, dword [ebp - 0x3b4]
inc eax
mov dword [ebp - 0x3b4], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa10]
call fcn.10017164
lea eax, [ebp - 0xa48]
push eax
lea ecx, [ebp - 0x92c]
call fcn.10017649
push dword [eax]
lea eax, [ebp - 0x96c]
push eax
lea ecx, [ebp - 0x92c]
call fcn.1001765d
push dword [eax]
lea eax, [ebp - 0x974]
push eax
lea ecx, [ebp - 0x92c]
call fcn.10017649
push dword [eax]
mov edx, 0x1001b598
lea ecx, [ebp - 0x97c]
call fcn.10025891
add esp, 0xc
mov dword [ebp - 0x914], 0xfffffffb
mov dword [ebp - 0x910], 0xfffffffb
mov dword [ebp - 0x90c], 0xfffffffb
mov dword [ebp - 0x908], 0xfffffffb
lea ecx, [ebp - 0x2bd]
call fcn.10008a53
push eax
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0x914]
push eax
lea ecx, [ebp - 0xb60]
call fcn.10017178
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb1c]
call fcn.1001713e
mov byte [ebp - 4], 4
mov dword [ebp - 0x170], 0x8094a188
mov dword [ebp - 0x170], 0
jmp 0x1001ec94
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 3
jg 0x1001ecad
push 0x36e9
push 0
call fcn.1001db4d
pop ecx
pop ecx
jmp 0x1001ec87
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb1c]
call fcn.10017164
lea ecx, [ebp - 0x92c]
call fcn.1001b523
mov dword [ebp - 0x374], eax
push 3
lea ecx, [ebp - 0x1d4]
call fcn.100170df
mov byte [ebp - 4], 5
mov dword [ebp - 0xcc], 1
mov dword [ebp - 0x120], 0
jmp 0x1001ed01
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 3
jge 0x1001ed23
push dword [ebp - 0x120]
lea ecx, [ebp - 0x1d4]
call fcn.10017169
mov dword [eax], 0x27cb3f4f
jmp 0x1001ecf4
push 2
lea ecx, [ebp - 0x1d4]
call fcn.10017169
cmp dword [eax], 0
je 0x1001ef3d
mov dword [ebp - 0xe0], 0xdcba
mov dword [ebp - 0x754], 0
cmp dword [ebp - 0xe0], 0
jne 0x1001ed68
mov eax, 0xb5725d36
test eax, eax
jne 0x1001ed68
and dword [ebp - 0x66c], 0
jmp 0x1001ed72
mov dword [ebp - 0x66c], 1
push 1
lea ecx, [ebp - 0x1d4]
call fcn.10017169
mov esi, eax
push 0
lea ecx, [ebp - 0x1d4]
call fcn.10017169
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x1001eda0
mov dword [ebp - 0x690], 1
jmp 0x1001eda7
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x66c]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0x690]
jne 0x1001eddf
push 2
lea ecx, [ebp - 0x1d4]
call fcn.10017169
cmp dword [eax], 0
je 0x1001eddf
mov dword [ebp - 0x698], 1
jmp 0x1001ede6
and dword [ebp - 0x698], 0
mov esi, dword [ebp - 0x698]
sub esi, dword [ebp - 0xe0]
push 2
lea ecx, [ebp - 0x1d4]
call fcn.10017169
cmp esi, dword [eax]
jl 0x1001ee0f
mov dword [ebp - 0x6a0], 1
jmp 0x1001ee16
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x6a0], eax
jl 0x1001ee30
mov dword [ebp - 0x6a8], 1
jmp 0x1001ee37
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x6a8]
add eax, 0x68d3bf57
cmp eax, 0x9a85
jne 0x1001ee55
mov dword [ebp - 0x6b0], 1
jmp 0x1001ee5c
and dword [ebp - 0x6b0], 0
mov esi, dword [ebp - 0xe0]
push 2
lea ecx, [ebp - 0x1d4]
call fcn.10017169
mov edi, dword [ebp - 0x6b0]
imul edi, dword [eax]
push 2
lea ecx, [ebp - 0x1d4]
call fcn.10017169
imul edi, dword [eax]
cmp esi, edi
jle 0x1001ee98
mov dword [ebp - 0x6b8], 1
jmp 0x1001ee9f
and dword [ebp - 0x6b8], 0
push 1
lea ecx, [ebp - 0x1d4]
call fcn.10017169
mov ecx, dword [ebp - 0x6b8]
cmp ecx, dword [eax]
jne 0x1001eec2
mov dword [ebp - 0x6c0], 1
jmp 0x1001eec9
and dword [ebp - 0x6c0], 0
mov esi, dword [ebp - 0xe0]
imul esi, dword [ebp - 0x6c0]
push 1
lea ecx, [ebp - 0x1d4]
call fcn.10017169
cmp esi, dword [eax]
jne 0x1001eef3
mov dword [ebp - 0x74c], 1
jmp 0x1001eefa
and dword [ebp - 0x74c], 0
push 2
lea ecx, [ebp - 0x1d4]
call fcn.10017169
push 0
lea ecx, [ebp - 0x1d4]
call fcn.10017169
cmp dword [eax], 0xfffb
jne 0x1001ef28
mov dword [ebp - 0x6c8], 1
jmp 0x1001ef2f
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x6c8]
mov dword [ebp - 0x754], eax
jmp 0x1001ef83
mov dword [ebp - 0xcc], 0
jmp 0x1001ef56
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x1c
jge 0x1001ef83
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x1001ef79
push 0x4ffc
push 0
call fcn.1001e771
pop ecx
pop ecx
push 1
call fcn.1001d802
pop ecx
jmp 0x1001ef49
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1d4]
call fcn.10017164
movzx eax, byte [0x10cbe691]
test eax, eax
je 0x1001f117
mov ecx, 0x10cbe7c8
call fcn.10025572
movzx eax, al
test eax, eax
jne 0x1001f117
push 2
lea ecx, [ebp - 0xa24]
call fcn.100170df
mov byte [ebp - 4], 6
lea eax, [ebp - 0xa24]
push eax
lea eax, [ebp - 0x984]
push eax
push 0
push 0x2dce
call fcn.1001e703
add esp, 0x10
mov byte [ebp - 0xa2], 0
push 0x29e9
lea eax, [ebp - 0xa2]
push eax
push 0
push 0x716f
call fcn.1001df17
add esp, 0x10
mov byte [ebp - 0x9c], 0
push 0
push 0x1a4e
lea eax, [ebp - 0x9c]
push eax
push 0x61db
call fcn.1001dea5
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa24]
call fcn.10017164
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x6b4]
push eax
mov ecx, 0x10cbe7c8
call fcn.10017251
lea eax, [ebp - 0x98c]
push eax
mov ecx, 0x10cbe7c8
call fcn.10017243
push eax
lea ecx, [ebp - 0x6b4]
call fcn.10017266
movzx eax, al
test eax, eax
je 0x1001f117
mov dword [ebp - 0x70], 0xcea5d6c0
mov dword [ebp - 0x70], 0
jmp 0x1001f08e
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 9
jle 0x1001f0e3
mov dword [ebp - 0x198], 1
mov dword [ebp - 0x198], 0
jmp 0x1001f0b7
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
jne 0x1001f0e1
mov dword [ebp - 0x794], 0xfffffff7
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x794]
push eax
push 0
call fcn.1001e893
add esp, 0xc
jmp 0x1001f0aa
jmp 0x1001f087
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x70], eax
lea ecx, [ebp - 0x6b4]
call fcn.1002557b
mov eax, dword [eax + 4]
mov dword [ebp - 0x79c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x92c]
call fcn.10016f19
mov eax, dword [ebp - 0x79c]
jmp 0x10023c5a
mov dword [ebp - 0x78], 0xc865b49d
mov dword [ebp - 0x2b4], 1
mov dword [ebp - 0x2e8], 0xc00eadd5
mov dword [ebp - 0x8ec], 0xf888c554
mov dword [ebp - 0x8e8], 0xf888c554
mov dword [ebp - 0x8e4], 0xf888c554
mov dword [ebp - 0x8e0], 0xf888c554
lea ecx, [ebp - 0x2a5]
call fcn.10008a53
push eax
lea eax, [ebp - 0x8dc]
push eax
lea eax, [ebp - 0x8ec]
push eax
lea ecx, [ebp - 0xb30]
call fcn.10017178
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x890]
call fcn.1001713e
mov byte [ebp - 4], 7
mov dword [ebp - 0x350], 0xd6cd
cmp dword [ebp - 0x78], 1
jae 0x1001f1af
mov dword [ebp - 0x348], 1
jmp 0x1001f1b6
and dword [ebp - 0x348], 0
mov dword [ebp - 0x2e8], 0xfbb9cf7d
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x2e8], eax
jg 0x1001f1d7
mov dword [ebp - 0x380], 1
jmp 0x1001f1de
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x380], eax
jne 0x1001f1f5
mov dword [ebp - 0x328], 1
jmp 0x1001f1fc
and dword [ebp - 0x328], 0
push 0
lea ecx, [ebp - 0x890]
call fcn.10017169
mov ecx, dword [ebp - 0x328]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x78]
jge 0x1001f222
mov dword [ebp - 0x60c], 1
jmp 0x1001f229
and dword [ebp - 0x60c], 0
cmp dword [ebp - 0x60c], 0xfffffffb
jg 0x1001f23e
mov dword [ebp - 0x330], 1
jmp 0x1001f245
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0x330], eax
jl 0x1001f25f
mov dword [ebp - 0x614], 1
jmp 0x1001f266
and dword [ebp - 0x614], 0
cmp dword [ebp - 0x614], 0x3068
je 0x1001f27e
mov dword [ebp - 0x338], 1
jmp 0x1001f285
and dword [ebp - 0x338], 0
push 0
lea ecx, [ebp - 0x890]
call fcn.10017169
mov ecx, dword [ebp - 0x338]
cmp ecx, dword [eax]
jge 0x1001f2a8
mov dword [ebp - 0x61c], 1
jmp 0x1001f2af
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x2b4]
sub eax, dword [ebp - 0x61c]
imul eax, eax, 0x2bc8
cmp eax, 1
jl 0x1001f2d2
mov dword [ebp - 0x7a4], 1
jmp 0x1001f2d9
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x994], eax
cmp dword [ebp - 0x78], 0
je 0x1001f2fd
cmp dword [ebp - 0x78], 0
je 0x1001f2fd
mov dword [ebp - 0x340], 1
jmp 0x1001f304
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x340]
add eax, dword [ebp - 0x78]
mov dword [ebp - 0x624], eax
push 0
lea ecx, [ebp - 0x890]
call fcn.10017169
mov ecx, dword [ebp - 0x624]
mov dword [eax], ecx
mov eax, dword [ebp - 0x624]
sub eax, 0x69438ed5
neg eax
cmp dword [ebp - 0x348], eax
je 0x1001f349
mov dword [ebp - 0x62c], 1
jmp 0x1001f350
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x62c]
sub eax, 0x479e
jne 0x1001f364
cmp dword [ebp - 0x2b4], 0
cmp dword [ebp - 0x2e8], 0xffff
jne 0x1001f37c
mov dword [ebp - 0x634], 1
jmp 0x1001f383
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x350]
cmp dword [ebp - 0x634], eax
jle 0x1001f39d
mov dword [ebp - 0x358], 1
jmp 0x1001f3a4
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x358]
inc eax
cmp eax, 0xfffffffb
jle 0x1001f3bc
mov dword [ebp - 0x63c], 1
jmp 0x1001f3c3
and dword [ebp - 0x63c], 0
cmp dword [ebp - 0x63c], 0xfffffffd
je 0x1001f3d8
mov dword [ebp - 0x360], 1
jmp 0x1001f3df
and dword [ebp - 0x360], 0
cmp dword [ebp - 0x360], 0
jne 0x1001f406
mov byte [ebp - 0x6a], 0
push 0x3be1
push 1
push 0x39ca
lea eax, [ebp - 0x6a]
push eax
call fcn.1001da17
add esp, 0x10
jmp 0x1001f41a
mov byte [ebp - 0x6b], 0
movzx eax, byte [ebp - 0x6b]
test eax, eax
je 0x1001f41a
push 0
call fcn.1001dff0
pop ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x890]
call fcn.10017164
and dword [ebp - 0xd0], 0
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x178], 0xfffffffb
mov dword [ebp - 0x7b4], 0xf18c9a01
mov dword [ebp - 0x128], 0
jmp 0x1001f464
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 2
jge 0x1001f480
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x6d0], 0x3342eb9
jmp 0x1001f457
mov dword [ebp - 0x34], 0
jmp 0x1001f490
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jg 0x1001f4b8
mov byte [ebp - 0xa0], 0
movzx eax, byte [ebp - 0xa0]
test eax, eax
je 0x1001f4b6
push 0x3ff2
push 0
call fcn.1001df91
pop ecx
pop ecx
jmp 0x1001f489
cmp dword [ebp - 0x34], 1
jne 0x1001f4ca
mov dword [ebp - 0x644], 1
jmp 0x1001f4d1
and dword [ebp - 0x644], 0
mov dword [ebp - 0x178], 1
mov eax, dword [ebp - 0x178]
cmp eax, dword [ebp - 0x644]
jne 0x1001f4f5
mov dword [ebp - 0x7ac], 1
jmp 0x1001f4fc
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x99c], eax
cmp dword [ebp - 0x178], 0xfffffffe
jg 0x1001f51a
mov dword [ebp - 0x368], 1
jmp 0x1001f521
and dword [ebp - 0x368], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6d0]
cmp dword [ebp - 0x368], eax
jge 0x1001f542
mov dword [ebp - 0x64c], 1
jmp 0x1001f549
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x64c], eax
jl 0x1001f579
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x6d0], 0
je 0x1001f579
cmp dword [ebp - 0x178], 0
je 0x1001f579
mov dword [ebp - 0x370], 1
jmp 0x1001f580
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x7b4]
cmp dword [ebp - 0x370], eax
jl 0x1001f59a
mov dword [ebp - 0x654], 1
jmp 0x1001f5a1
and dword [ebp - 0x654], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6d0]
sub eax, dword [ebp - 0x654]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x6d0]
jl 0x1001f5cf
mov dword [ebp - 0x378], 1
jmp 0x1001f5d6
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x378], eax
je 0x1001f5ed
mov dword [ebp - 0x65c], 1
jmp 0x1001f5f4
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x65c], eax
jne 0x1001f60b
mov dword [ebp - 0x664], 1
jmp 0x1001f612
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x92c]
push eax
call fcn.1001c066
pop ecx
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jne 0x100239e8
mov dword [ebp - 0x10], 0xdd1e1e87
mov dword [ebp - 0x130], 0xffffffff
mov dword [ebp - 0xb4], 6
mov dword [ebp - 0x3d8], 6
mov dword [ebp - 0x9a4], 0xc2b2a8f3
mov dword [ebp - 0x7c4], 0xa16747b1
mov dword [ebp - 0x2cc], 0x5d09421a
mov dword [ebp - 0x550], 0x823388
mov dword [ebp - 0x18], 0
jmp 0x1001f698
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1001f6ae
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2d8], 0xfffffffd
jmp 0x1001f691
mov dword [ebp - 0x18], 0
jmp 0x1001f6be
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1001f6d4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa2c], 0x45cb296a
jmp 0x1001f6b7
mov dword [ebp - 0x18], 0
jmp 0x1001f6e4
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1001f6fa
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7cc], 0x50090e7a
jmp 0x1001f6dd
mov dword [ebp - 0x10], 0
jmp 0x1001f70a
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x1001f9b1
mov dword [ebp - 0x2c8], 0xc407
mov dword [ebp - 0x538], 0x7c70ab22
push 1
lea ecx, [ebp - 0x8b4]
call fcn.100170df
mov byte [ebp - 4], 8
mov dword [ebp - 0x8d8], 0xfffffffd
mov dword [ebp - 0x8d4], 0xfffffffd
mov dword [ebp - 0x8d0], 0xfffffffd
mov dword [ebp - 0x8cc], 0xfffffffd
lea eax, [ebp - 0x9ac]
push eax
lea eax, [ebp - 0x8b4]
push eax
push 0x3ee5
push 0
call fcn.100252f5
add esp, 0x10
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x2d8], 0x1328
jle 0x1001f79a
mov dword [ebp - 0x530], 1
jmp 0x1001f7a1
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x2d8]
mov eax, dword [ebp - 0x2c8]
add eax, dword [ebp - 0x10]
jne 0x1001f7cc
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x2d8], 0
jne 0x1001f7cc
and dword [ebp - 0x388], 0
jmp 0x1001f7d6
mov dword [ebp - 0x388], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x2d8]
cmp dword [ebp - 0x388], eax
jl 0x1001f7f4
mov dword [ebp - 0x608], 1
jmp 0x1001f7fb
and dword [ebp - 0x608], 0
cmp dword [ebp - 0x608], 0xffffffff
je 0x1001f810
mov dword [ebp - 0x390], 1
jmp 0x1001f817
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x538], eax
mov esi, dword [ebp - 0x538]
push 0
lea ecx, [ebp - 0x8b4]
call fcn.10017169
mov dword [eax], esi
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8d8], 0xb0881dda
jbe 0x1001f857
mov dword [ebp - 0x398], 1
jmp 0x1001f85e
and dword [ebp - 0x398], 0
cmp dword [ebp - 0x398], 1
jne 0x1001f873
mov dword [ebp - 0x3a0], 1
jmp 0x1001f87a
and dword [ebp - 0x3a0], 0
cmp dword [ebp - 0x2c8], 9
jg 0x1001f88f
mov dword [ebp - 0x680], 1
jmp 0x1001f896
and dword [ebp - 0x680], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2d8]
cmp dword [ebp - 0x680], eax
jg 0x1001f8b7
mov dword [ebp - 0x540], 1
jmp 0x1001f8be
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x3a0]
cmp eax, dword [ebp - 0x540]
jle 0x1001f8d8
mov dword [ebp - 0x3a8], 1
jmp 0x1001f8df
and dword [ebp - 0x3a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2d8]
cmp dword [ebp - 0x3a8], eax
je 0x1001f900
mov dword [ebp - 0x610], 1
jmp 0x1001f907
and dword [ebp - 0x610], 0
cmp dword [ebp - 0x610], 0xd4856cd8
jbe 0x1001f91f
mov dword [ebp - 0x3b0], 1
jmp 0x1001f926
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x3b0]
cmp eax, dword [ebp - 0x10]
jl 0x1001f951
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2d8], 0
je 0x1001f951
mov dword [ebp - 0x548], 1
jmp 0x1001f958
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x548]
sub eax, dword [ebp - 0x2c8]
je 0x1001f981
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x8d8], 0
je 0x1001f981
mov dword [ebp - 0x3b8], 1
jmp 0x1001f988
and dword [ebp - 0x3b8], 0
push 0
lea ecx, [ebp - 0x8b4]
call fcn.10017169
mov ecx, dword [ebp - 0x3b8]
mov dword [eax], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8b4]
call fcn.10017164
jmp 0x1001f703
cmp dword [ebp - 0xb4], 0
je 0x1001f9cf
cmp dword [ebp - 0xb4], 0
je 0x1001f9cf
mov dword [ebp - 0x688], 1
jmp 0x1001f9d6
and dword [ebp - 0x688], 0
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0x688]
jge 0x1001f9f0
mov dword [ebp - 0x2e4], 1
jmp 0x1001f9f7
and dword [ebp - 0x2e4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2e4]
mov dword [ebp + eax - 0xa2c], ecx
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x9b4], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x9bc], eax
cmp dword [ebp - 0x3d8], 0xa3a768fb
ja 0x1001fa43
mov dword [ebp - 0x7bc], 1
jmp 0x1001fa4a
and dword [ebp - 0x7bc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2d8]
mov dword [ebp - 0x9c4], eax
cmp dword [ebp - 0xb4], 0xceeec855
je 0x1001fa75
mov dword [ebp - 0x3c0], 1
jmp 0x1001fa7c
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x2cc]
dec eax
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x550], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2cc]
imul ecx, dword [ebp - 0x550]
cmp ecx, dword [ebp + eax - 0x2d8]
jle 0x1001fabc
mov dword [ebp - 0x3c8], 1
jmp 0x1001fac3
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x3c8]
jle 0x1001fada
mov dword [ebp - 0x618], 1
jmp 0x1001fae1
and dword [ebp - 0x618], 0
mov eax, dword [ebp - 0x7c4]
cmp dword [ebp - 0x618], eax
jle 0x1001fafb
mov dword [ebp - 0x3d0], 1
jmp 0x1001fb02
and dword [ebp - 0x3d0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3d0]
sub ecx, dword [ebp + eax - 0x2d8]
cmp ecx, dword [ebp - 0x10]
jne 0x1001fb26
mov dword [ebp - 0x558], 1
jmp 0x1001fb2d
and dword [ebp - 0x558], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2d8]
cmp dword [ebp - 0x558], eax
jle 0x1001fb54
cmp dword [ebp - 0x130], 0
jne 0x1001fb54
and dword [ebp - 0x2a4], 0
jmp 0x1001fb5e
mov dword [ebp - 0x2a4], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2a4]
mov dword [ebp + eax - 0x7cc], ecx
cmp dword [ebp - 0x2a4], 0xa104
jg 0x1001fb89
mov dword [ebp - 0x7d4], 1
jmp 0x1001fb90
and dword [ebp - 0x7d4], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x9cc], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x9d4], eax
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x3d8]
lea eax, [eax + ecx + 6]
mov dword [ebp - 0x10], eax
push 2
lea ecx, [ebp - 0x7e4]
call fcn.100170df
mov byte [ebp - 4], 9
mov dword [ebp - 0x1c8], 0
jmp 0x1001fbe5
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 2
jge 0x1001fc07
push dword [ebp - 0x1c8]
lea ecx, [ebp - 0x7e4]
call fcn.10017169
mov dword [eax], 0xfffffff7
jmp 0x1001fbd8
push 1
lea ecx, [ebp - 0x7e4]
call fcn.10017169
and dword [eax], 0
jmp 0x1001fc3d
push 1
lea ecx, [ebp - 0x7e4]
call fcn.10017169
mov dword [ebp - 0x67c], eax
mov eax, dword [ebp - 0x67c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x67c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x7e4]
call fcn.10017169
cmp dword [eax], 0xfffffff9
jle 0x1001fd5a
mov dword [ebp - 0x138], 4
mov dword [ebp - 0x138], 0x14
jmp 0x1001fc76
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x15
jne 0x1001fd55
mov dword [ebp - 0x140], 0xf25cbd94
mov dword [ebp - 0x180], 0
jmp 0x1001fca6
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 1
jge 0x1001fcc2
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x86c], 0x292c5eb2
jmp 0x1001fc99
mov dword [ebp - 0x140], 0
jmp 0x1001fcdb
mov eax, dword [ebp - 0x140]
dec eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xffffffe6
jg 0x1001fd35
mov dword [ebp - 0x1b0], 0
jmp 0x1001fcfd
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 2
jge 0x1001fd19
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0xa04], 0xfffffffd
jmp 0x1001fcf0
push 4
pop eax
shl eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0xa04]
mov dword [ebp + ecx - 0x86c], eax
jmp 0x1001fcce
mov byte [ebp - 0x6c], 0
movzx eax, byte [ebp - 0x6c]
test eax, eax
je 0x1001fd50
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
jmp 0x1001fc69
jmp 0x1001fc19
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x7e4]
call fcn.10017164
cmp dword [0x10cbe69c], 0
jne 0x100236bf
mov dword [ebp - 0x54], 0
jmp 0x1001fd86
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x1001fd9c
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x3e0], 0x8eac8b13
jmp 0x1001fd7f
mov dword [ebp - 0x54], 0
jmp 0x1001fdac
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x1001fdc2
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x310], 0xcb50bf34
jmp 0x1001fda5
mov byte [ebp - 0x9e], 0
movzx eax, byte [ebp - 0x9e]
test eax, eax
je 0x1001fddc
push 1
call fcn.1001db1b
pop ecx
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x310], 0
jmp 0x1001fe0a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x310]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x310], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x310], 0
jl 0x1001fea1
mov dword [ebp - 0x80], 2
mov dword [ebp - 0x80], 0
jmp 0x1001fe35
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x1001fe4b
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x3e0], 0x1e948708
jmp 0x1001fe2e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x310]
mov eax, dword [ebp + eax*4 - 0x3e0]
mov dword [ebp - 0x9dc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x310], 0
je 0x1001fe87
cmp dword [ebp - 0x80], 0
je 0x1001fe87
mov dword [ebp - 0x560], 1
jmp 0x1001fe8e
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x560]
add eax, 0x6b471dfd
mov dword [ebp - 0x80], eax
jmp 0x1001fdef
mov dword [ebp - 0xc4], 0xcff0ea75
mov dword [ebp - 0x188], 0x8f8256a9
mov dword [ebp - 0x9e4], 1
mov dword [ebp - 0x868], 0x999d94b4
mov dword [ebp - 0x420], 0x21f1eb32
mov dword [ebp - 0x9ec], 0xfffffffb
mov dword [ebp - 0x9f4], 0
mov dword [ebp - 0x410], 0xffffffff
mov dword [ebp - 0x148], 0xfffffffe
mov dword [ebp - 0x568], 0xffffffff
mov dword [ebp - 0xc4], 0
jmp 0x1001ff1e
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xffffffeb
jge 0x100202ac
mov dword [ebp - 0x684], 0xfffffffd
push 2
lea ecx, [ebp - 0x6dc]
call fcn.100170df
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x430], 0x5900b088
mov dword [ebp - 0x58], 0
jmp 0x1001ff60
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x1001ff79
push dword [ebp - 0x58]
lea ecx, [ebp - 0x6dc]
call fcn.10017169
and dword [eax], 0
jmp 0x1001ff59
mov dword [ebp - 0x58], 0
jmp 0x1001ff89
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x1001ff9f
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x7f4], 0x37c57f39
jmp 0x1001ff82
mov eax, dword [ebp - 0x148]
dec eax
mov dword [ebp - 0x148], eax
push 1
lea ecx, [ebp - 0x6dc]
call fcn.10017169
push 1
lea ecx, [ebp - 0x6dc]
call fcn.10017169
mov eax, dword [ebp - 0x148]
add eax, 0xfffffff7
mov dword [ebp - 0x874], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x874]
mov dword [ebp + eax - 0x7f4], ecx
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x9fc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7f4]
sub eax, 0x4073
sub eax, dword [ebp - 0x430]
cmp eax, dword [ebp - 0x684]
jl 0x10020020
mov dword [ebp - 0x3e8], 1
jmp 0x10020027
and dword [ebp - 0x3e8], 0
push 1
lea ecx, [ebp - 0x6dc]
call fcn.10017169
mov eax, dword [eax]
add eax, dword [ebp - 0x3e8]
cmp eax, dword [ebp - 0x148]
jle 0x10020050
mov dword [ebp - 0x620], 1
jmp 0x10020057
and dword [ebp - 0x620], 0
cmp dword [ebp - 0x620], 0
je 0x10020261
mov dword [ebp - 0x100], 1
mov dword [ebp - 0x188], 0
jmp 0x10020087
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0xc
jg 0x100200a2
lea eax, [ebp - 0x100]
push eax
push 1
call fcn.1001db4d
pop ecx
pop ecx
jmp 0x1002007a
cmp dword [ebp - 0x100], 0xffffffff
jg 0x100200b7
mov dword [ebp - 0x6a4], 1
jmp 0x100200be
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x568], eax
jg 0x100200d8
mov dword [ebp - 0x3f0], 1
jmp 0x100200df
and dword [ebp - 0x3f0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7f4]
cmp dword [ebp - 0x3f0], eax
jl 0x10020100
mov dword [ebp - 0x3f8], 1
jmp 0x10020107
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x568]
cmp dword [ebp - 0x3f8], eax
jge 0x10020121
mov dword [ebp - 0x400], 1
jmp 0x10020128
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x6a4]
cmp eax, dword [ebp - 0x400]
jne 0x1002014b
cmp dword [ebp - 0xc4], 0
je 0x1002014b
mov dword [ebp - 0x570], 1
jmp 0x10020152
and dword [ebp - 0x570], 0
cmp dword [ebp - 0x570], 1
jne 0x10020167
mov dword [ebp - 0x408], 1
jmp 0x1002016e
and dword [ebp - 0x408], 0
cmp dword [ebp - 0x408], 0xc84a
jg 0x10020186
mov dword [ebp - 0x628], 1
jmp 0x1002018d
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x578], eax
push 1
lea ecx, [ebp - 0x6dc]
call fcn.10017169
mov ecx, dword [ebp - 0x578]
mov dword [eax], ecx
cmp dword [ebp - 0x578], 0
je 0x100201d8
cmp dword [ebp - 0x100], 0
je 0x100201d8
mov dword [ebp - 0x418], 1
jmp 0x100201df
and dword [ebp - 0x418], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7f4]
cmp eax, dword [ebp - 0x418]
jl 0x10020206
cmp dword [ebp - 0x100], 0
jne 0x10020206
and dword [ebp - 0x580], 0
jmp 0x10020210
mov dword [ebp - 0x580], 1
mov eax, dword [ebp - 0x684]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x420]
sub eax, dword [ebp - 0x580]
cmp eax, 0xfffffffd
jne 0x10020239
mov dword [ebp - 0x2ec], 1
jmp 0x10020240
and dword [ebp - 0x2ec], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2ec]
mov dword [ebp + eax - 0x7f4], ecx
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x868], eax
jmp 0x10020298
mov dword [ebp - 0x428], 0x863e3202
mov eax, dword [ebp - 0x428]
cmp dword [ebp - 0x428], eax
jg 0x10020285
mov dword [ebp - 0x630], 1
jmp 0x1002028c
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x430], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6dc]
call fcn.10017164
jmp 0x1001ff11
mov byte [ebp - 0x278], 0
mov byte [ebp - 0x277], 0xb
mov byte [ebp - 0x276], 0x3b
mov byte [ebp - 0x275], 0x27
mov byte [ebp - 0x274], 0x18
mov byte [ebp - 0x273], 0x3c
mov byte [ebp - 0x272], 2
mov byte [ebp - 0x271], 0x99
mov byte [ebp - 0x270], 0x57
mov byte [ebp - 0x26f], 4
mov byte [ebp - 0x26e], 0xab
mov byte [ebp - 0x26d], 0xd9
mov byte [ebp - 0x26c], 0xa2
mov byte [ebp - 0x26b], 0xc6
mov byte [ebp - 0x26a], 0x34
mov byte [ebp - 0x269], 0x23
mov byte [ebp - 0x268], 0x9f
mov byte [ebp - 0x267], 0x3b
mov byte [ebp - 0x266], 0xb2
mov byte [ebp - 0x265], 0x3c
mov byte [ebp - 0x264], 0x9d
mov byte [ebp - 0x263], 0xd1
mov byte [ebp - 0x262], 0x7f
mov byte [ebp - 0x261], 0xde
mov byte [ebp - 0x260], 0xe3
mov byte [ebp - 0x25f], 0xf
mov byte [ebp - 0x25e], 0x33
mov byte [ebp - 0x25d], 0x8d
mov byte [ebp - 0x25c], 0x46
mov byte [ebp - 0x25b], 0xac
mov byte [ebp - 0x25a], 0xd4
mov byte [ebp - 0x259], 0xd9
mov byte [ebp - 0x258], 0x60
mov byte [ebp - 0x257], 0x24
mov byte [ebp - 0x256], 0x4c
mov byte [ebp - 0x255], 0xda
mov byte [ebp - 0x254], 0x44
mov byte [ebp - 0x253], 0x81
mov byte [ebp - 0x252], 0xec
mov byte [ebp - 0x251], 0x5b
mov byte [ebp - 0x250], 0xf7
mov byte [ebp - 0x24f], 0xb1
mov byte [ebp - 0x24e], 0x2d
mov byte [ebp - 0x24d], 7
mov byte [ebp - 0x24c], 0x8b
mov byte [ebp - 0x24b], 0x1b
mov byte [ebp - 0x24a], 0xdf
mov byte [ebp - 0x249], 0x11
mov byte [ebp - 0x248], 0x26
mov byte [ebp - 0x247], 0x38
mov byte [ebp - 0x246], 0x7e
mov byte [ebp - 0x245], 0xa1
mov byte [ebp - 0x244], 0xd5
mov byte [ebp - 0x243], 0x87
mov byte [ebp - 0x242], 0xd9
mov byte [ebp - 0x241], 0xf
mov byte [ebp - 0x240], 0xfc
mov byte [ebp - 0x23f], 0x84
mov byte [ebp - 0x23e], 0x4f
mov byte [ebp - 0x23d], 0x15
mov byte [ebp - 0x23c], 0xa8
mov byte [ebp - 0x23b], 1
mov byte [ebp - 0x23a], 8
mov byte [ebp - 0x239], 0x65
mov byte [ebp - 0x238], 9
mov byte [ebp - 0x237], 0x4a
mov byte [ebp - 0x236], 2
mov byte [ebp - 0x235], 0x16
mov byte [ebp - 0x234], 3
mov byte [ebp - 0x233], 0x1c
mov byte [ebp - 0x232], 5
mov byte [ebp - 0x231], 2
mov byte [ebp - 0x230], 0xa
mov byte [ebp - 0x22f], 0
mov byte [ebp - 0x22e], 7
mov byte [ebp - 0x22d], 0x5e
mov byte [ebp - 0x22c], 1
mov byte [ebp - 0x22b], 0x57
mov byte [ebp - 0x22a], 6
mov byte [ebp - 0x229], 0x56
mov byte [ebp - 0x228], 0xb
mov byte [ebp - 0x227], 0x5f
mov byte [ebp - 0x226], 4
mov byte [ebp - 0x225], 9
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x64], 0xfffffffe
mov dword [ebp - 0x5a8], 0x458af326
mov dword [ebp - 0x7c8], 0xfffffffe
mov dword [ebp - 0x150], 0
jmp 0x10020533
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 4
jge 0x1002054f
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x294], 0xffffffff
jmp 0x10020526
cmp dword [ebp - 0x2c], 0
je 0x1002055b
cmp dword [ebp - 0x2c], 0
jne 0x1002056a
cmp dword [ebp - 0x2c], 0
jne 0x1002056a
and dword [ebp - 0x588], 0
jmp 0x10020574
mov dword [ebp - 0x588], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x588]
mov dword [ebp + eax - 0x294], ecx
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x294]
cmp dword [ebp + eax - 0x294], ecx
jge 0x100205ad
mov dword [ebp - 0x458], 1
jmp 0x100205b4
and dword [ebp - 0x458], 0
cmp dword [ebp - 0x2c], 0x6de6
je 0x100205c9
mov dword [ebp - 0x438], 1
jmp 0x100205d0
and dword [ebp - 0x438], 0
imul eax, dword [ebp - 0x438], 0x8886
cmp eax, 0xc65b
jle 0x100205ed
mov dword [ebp - 0x6c4], 1
jmp 0x100205f4
and dword [ebp - 0x6c4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x294]
sub eax, dword [ebp - 0x6c4]
jne 0x10020620
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x294], 0
jne 0x10020620
and dword [ebp - 0x7e8], 0
jmp 0x1002062a
mov dword [ebp - 0x7e8], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x294]
mov dword [ebp - 0xaac], eax
cmp dword [ebp - 0x2c], 0x3e3f
jl 0x10020651
mov dword [ebp - 0x440], 1
jmp 0x10020658
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jne 0x10020673
mov dword [ebp - 0x590], 1
jmp 0x1002067a
and dword [ebp - 0x590], 0
cmp dword [ebp - 0x590], 0x94d0
je 0x10020692
mov dword [ebp - 0x448], 1
jmp 0x10020699
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x448]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x294]
jl 0x100206bc
mov dword [ebp - 0x638], 1
jmp 0x100206c3
and dword [ebp - 0x638], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x294]
cmp dword [ebp - 0x638], eax
jne 0x100206e4
mov dword [ebp - 0x450], 1
jmp 0x100206eb
and dword [ebp - 0x450], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x294]
imul eax, dword [ebp - 0x450]
cmp eax, 0xa22e
jne 0x10020712
mov dword [ebp - 0x598], 1
jmp 0x10020719
and dword [ebp - 0x598], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x294]
cmp dword [ebp - 0x598], eax
jg 0x10020739
mov dword [ebp - 0x68c], 1
jmp 0x10020740
and dword [ebp - 0x68c], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x294], 0xffffffff
jne 0x1002076a
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x294], 0
je 0x1002076a
mov dword [ebp - 0x710], 1
jmp 0x10020771
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xab4], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x294]
cmp dword [ebp + eax - 0x294], ecx
jge 0x100207a0
mov dword [ebp - 0x460], 1
jmp 0x100207a7
and dword [ebp - 0x460], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x294]
cmp dword [ebp - 0x460], eax
je 0x10020968
mov dword [ebp - 0x2b0], 0xb6d700d1
mov dword [ebp - 0x478], 0xffffffff
mov dword [ebp - 0x2ac], 0xa3fa0b5b
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0xacc], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0x64]
inc eax
cmp eax, dword [ebp - 0x64]
jle 0x10020819
mov dword [ebp - 0x5a0], 1
jmp 0x10020820
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0x5a0], eax
jne 0x1002083a
mov dword [ebp - 0x468], 1
jmp 0x10020841
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x468], eax
je 0x10020858
mov dword [ebp - 0x640], 1
jmp 0x1002085f
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x2ac]
cmp dword [ebp - 0x640], eax
jl 0x10020879
mov dword [ebp - 0x470], 1
jmp 0x10020880
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x5a8], eax
cmp dword [ebp - 0x5a8], 0
jl 0x100208aa
cmp dword [ebp - 0x2ac], 0
je 0x100208aa
mov dword [ebp - 0x6ac], 1
jmp 0x100208b1
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x478]
mov ecx, dword [ebp - 0x6ac]
sub ecx, 0xa1d5
imul eax, ecx
cmp eax, 0x5f05
jl 0x100208e2
mov dword [ebp - 0x744], 1
jmp 0x100208e9
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xaf8], eax
cmp dword [ebp - 0x64], 1
jle 0x10020910
mov dword [ebp - 0x5b0], 1
jmp 0x10020917
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x480], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x480]
mov dword [ebp + eax - 0x294], ecx
mov eax, dword [ebp - 0x480]
imul eax, dword [ebp - 0x5b0]
cmp dword [ebp - 0x64], eax
jge 0x10020953
mov dword [ebp - 0x488], 1
jmp 0x1002095a
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x7c8], eax
jmp 0x10020999
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x10020999
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1408
push 0xa72
push 0x168
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x278]
or eax, 0x40
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x278]
and ecx, 0x40
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x278]
mov word [ebp + ecx*2 - 0x964], ax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x68], 0xde9bf9f
push 4
lea ecx, [ebp - 0x6e8]
call fcn.100170df
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x738], 0
mov dword [ebp - 0x1c0], 0
jmp 0x10020a15
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 4
jge 0x10020a37
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0x6e8]
call fcn.10017169
mov dword [eax], 0x4515fdc8
jmp 0x10020a08
push 0x191d
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6e8]
push eax
push 1
lea eax, [ebp - 0x30]
push eax
call fcn.1001db8f
add esp, 0x14
xor eax, eax
je 0x10020b31
mov dword [ebp - 0x848], 0
mov dword [ebp - 0x7d0], 0xfffffffc
mov dword [ebp - 0x728], 0xffffffff
mov dword [ebp - 0x720], 0
mov dword [ebp - 0x718], 0xfffffffe
mov dword [ebp - 0x30], 3
jmp 0x10020a9f
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x10020b2c
mov dword [ebp - 0x730], 0x5fa2ef7
mov dword [ebp - 0xb00], 0xffffffff
mov dword [ebp - 0x7d8], 1
mov dword [ebp - 0x858], 0xe3970c0f
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x718]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x848]
push eax
push 0
lea eax, [ebp - 0x720]
push eax
lea eax, [ebp - 0x7d0]
push eax
lea eax, [ebp - 0x6e8]
push eax
lea eax, [ebp - 0x728]
push eax
push 0x6aac
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0x730]
push eax
lea eax, [ebp - 0x7d8]
push eax
call fcn.1001e49e
add esp, 0x34
jmp 0x10020a98
jmp 0x10020dda
mov dword [ebp - 0x4b8], 0
push 1
lea ecx, [ebp - 0x89c]
call fcn.100170df
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x5b8], 0x49175055
mov dword [ebp - 0x860], 0xfffd
lea eax, [ebp - 0x89c]
push eax
lea eax, [ebp - 0xb08]
push eax
push 1
call fcn.1001dc7d
add esp, 0xc
mov dword [ebp - 0x68], 0x19
jmp 0x10020b88
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x17
jle 0x10020dcb
mov dword [ebp - 0x740], 0xd569f207
mov dword [ebp - 0x158], 0
jmp 0x10020bb5
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 2
jge 0x10020bd1
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x760], 0xffffffff
jmp 0x10020ba8
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0xb10], eax
xor eax, eax
jne 0x10020c06
push 0
lea ecx, [ebp - 0x89c]
call fcn.10017169
mov dword [eax], 0xffff43f7
mov eax, 0xffff43f7
test eax, eax
jne 0x10020c06
and dword [ebp - 0x648], 0
jmp 0x10020c10
mov dword [ebp - 0x648], 1
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x648]
cmp eax, dword [ebp - 0x30]
jg 0x10020c39
cmp dword [ebp - 0x68], 0
je 0x10020c39
mov eax, 0x399d6db7
test eax, eax
je 0x10020c39
mov dword [ebp - 0x490], 1
jmp 0x10020c40
and dword [ebp - 0x490], 0
mov esi, dword [ebp - 0x5b8]
imul esi, dword [ebp - 0x490]
push 3
lea ecx, [ebp - 0x6e8]
call fcn.10017169
mov dword [eax], esi
mov eax, dword [ebp - 0x5b8]
cmp dword [ebp - 0x68], eax
jg 0x10020c73
mov dword [ebp - 0x498], 1
jmp 0x10020c7a
and dword [ebp - 0x498], 0
cmp dword [ebp - 0x498], 0xbf3a
je 0x10020ca2
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x760], 0
je 0x10020ca2
mov dword [ebp - 0x694], 1
jmp 0x10020ca9
and dword [ebp - 0x694], 0
cmp dword [ebp - 0x694], 0x9a64
jge 0x10020cc1
mov dword [ebp - 0x4a0], 1
jmp 0x10020cc8
and dword [ebp - 0x4a0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x760]
cmp dword [ebp - 0x4a0], eax
je 0x10020ce9
mov dword [ebp - 0x5c0], 1
jmp 0x10020cf0
and dword [ebp - 0x5c0], 0
cmp dword [ebp - 0x5c0], 0x17de
jl 0x10020d08
mov dword [ebp - 0x4a8], 1
jmp 0x10020d0f
and dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x4a8], 0xa66b
jle 0x10020d27
mov dword [ebp - 0x650], 1
jmp 0x10020d2e
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x650]
sub eax, 0x62993103
cmp eax, 0x4b502d48
jle 0x10020d4c
mov dword [ebp - 0x4b0], 1
jmp 0x10020d53
and dword [ebp - 0x4b0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x760]
cmp dword [ebp - 0x4b0], eax
jne 0x10020d74
mov dword [ebp - 0x5c8], 1
jmp 0x10020d7b
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x5c8]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x6e8]
push eax
lea eax, [ebp - 0x738]
push eax
lea eax, [ebp - 0x4b8]
push eax
push 1
push 0x6d9d
lea eax, [ebp - 0x860]
push eax
push 0x6fc5
lea eax, [ebp - 0x740]
push eax
lea eax, [ebp - 0x89c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.1001dceb
add esp, 0x28
jmp 0x10020b81
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x89c]
call fcn.10017164
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6e8]
call fcn.10017164
mov dword [ebp - 0x1c], 2
and dword [ebp - 0x168], 0
jmp 0x10020e01
mov eax, dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x54
jae 0x100217b9
mov dword [ebp - 0xe8], 0xfffffffd
mov dword [ebp - 0x6bc], 0x1bf07968
mov dword [ebp - 0xe8], 0xffffffe7
jmp 0x10020e38
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0xfffffff5
jg 0x10020e92
mov dword [ebp - 0x748], 0x63f9
mov dword [ebp - 0x768], 0xfffffffb
lea eax, [ebp - 0x768]
push eax
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x6bc]
push eax
push 0x467c
lea eax, [ebp - 0x748]
push eax
push 0x39c9
push 0
call fcn.1001e05f
add esp, 0x1c
cmp dword [ebp - 0x6bc], 0
je 0x10020e90
jmp 0x10020e2b
jmp 0x10020e2b
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x278]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x1c], eax
jne 0x100213e1
mov dword [ebp - 0x190], 0
jmp 0x10020ec6
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 4
jge 0x10020ee2
mov eax, dword [ebp - 0x190]
mov dword [ebp + eax*4 - 0x884], 0
jmp 0x10020eb9
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x884], 0x13
jmp 0x10020f0d
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x884]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x884], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x884], 0xfffffffa
jg 0x10020fbb
mov dword [ebp - 0x160], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x884]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x160]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x884]
cmp eax, 0xfff7
jne 0x10020f61
mov dword [ebp - 0x4c0], 1
jmp 0x10020f68
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x4c0]
add eax, 0x80c3
cmp eax, dword [ebp - 0x160]
jne 0x10020f87
mov dword [ebp - 0x5d0], 1
jmp 0x10020f8e
and dword [ebp - 0x5d0], 0
cmp dword [ebp - 0x5d0], 0xfffffff9
jne 0x10020fa3
mov dword [ebp - 0x4c8], 1
jmp 0x10020faa
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x160], eax
jmp 0x10020ef4
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x278]
inc eax
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x278]
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xbc], 0xcff0ea75
mov dword [ebp - 0x750], 0x8f8256a9
mov dword [ebp - 0xaa0], 1
mov dword [ebp - 0x774], 0x999d94b4
mov dword [ebp - 0x5f0], 0x21f1eb32
mov dword [ebp - 0xab8], 0xfffffffb
mov dword [ebp - 0x968], 0
mov dword [ebp - 0x5e8], 0xffffffff
mov dword [ebp - 0x2b8], 0xfffffffe
mov dword [ebp - 0x4d8], 0xffffffff
mov dword [ebp - 0xbc], 0
jmp 0x1002105f
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xffffffeb
jge 0x100213dc
mov dword [ebp - 0x500], 0xfffffffd
push 2
lea ecx, [ebp - 0x6f4]
call fcn.100170df
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x668], 0x5900b088
push 1
lea eax, [ebp - 0xf8]
push eax
push 0x15f6
push 0x2a5d
lea eax, [ebp - 0x6f4]
push eax
call fcn.1001de1e
add esp, 0x14
mov dword [ebp - 0xf8], 0
jmp 0x100210cc
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 3
jge 0x100210e8
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x804], 0x37c57f39
jmp 0x100210bf
push 0x17ba
push 0
push 0x289f
lea eax, [ebp - 0x2b8]
push eax
call fcn.1001e428
add esp, 0x10
push 1
lea ecx, [ebp - 0x6f4]
call fcn.10017169
push 1
lea ecx, [ebp - 0x6f4]
call fcn.10017169
mov eax, dword [ebp - 0x2b8]
add eax, 0xfffffff7
mov dword [ebp - 0x76c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x76c]
mov dword [ebp + eax - 0x804], ecx
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xac0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x804]
sub eax, 0x4073
sub eax, dword [ebp - 0x668]
cmp eax, dword [ebp - 0x500]
jl 0x10021177
mov dword [ebp - 0x658], 1
jmp 0x1002117e
and dword [ebp - 0x658], 0
push 1
lea ecx, [ebp - 0x6f4]
call fcn.10017169
mov eax, dword [eax]
add eax, dword [ebp - 0x658]
cmp eax, dword [ebp - 0x2b8]
jle 0x100211a7
mov dword [ebp - 0x4d0], 1
jmp 0x100211ae
and dword [ebp - 0x4d0], 0
cmp dword [ebp - 0x4d0], 0
je 0x100213a1
mov dword [ebp - 0xd8], 1
push 0xf2c
lea eax, [ebp - 0xd8]
push eax
push 0
lea eax, [ebp - 0x750]
push eax
call fcn.1001e1bc
add esp, 0x10
cmp dword [ebp - 0xd8], 0xffffffff
jg 0x100211f7
mov dword [ebp - 0x4e0], 1
jmp 0x100211fe
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x4d8], eax
jg 0x10021218
mov dword [ebp - 0x5d8], 1
jmp 0x1002121f
and dword [ebp - 0x5d8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x804]
cmp dword [ebp - 0x5d8], eax
jl 0x10021240
mov dword [ebp - 0x69c], 1
jmp 0x10021247
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x4d8]
cmp dword [ebp - 0x69c], eax
jge 0x10021261
mov dword [ebp - 0x5e0], 1
jmp 0x10021268
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x4e0]
cmp eax, dword [ebp - 0x5e0]
jne 0x1002128b
cmp dword [ebp - 0xbc], 0
je 0x1002128b
mov dword [ebp - 0x4e8], 1
jmp 0x10021292
and dword [ebp - 0x4e8], 0
cmp dword [ebp - 0x4e8], 1
jne 0x100212a7
mov dword [ebp - 0x660], 1
jmp 0x100212ae
and dword [ebp - 0x660], 0
cmp dword [ebp - 0x660], 0xc84a
jg 0x100212c6
mov dword [ebp - 0x4f0], 1
jmp 0x100212cd
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x5e8], eax
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x4f8], eax
push 1
lea ecx, [ebp - 0x6f4]
call fcn.10017169
mov ecx, dword [ebp - 0x4f8]
mov dword [eax], ecx
cmp dword [ebp - 0x4f8], 0
je 0x10021318
cmp dword [ebp - 0xd8], 0
je 0x10021318
mov dword [ebp - 0x674], 1
jmp 0x1002131f
and dword [ebp - 0x674], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x804]
cmp eax, dword [ebp - 0x674]
jl 0x10021346
cmp dword [ebp - 0xd8], 0
jne 0x10021346
and dword [ebp - 0x508], 0
jmp 0x10021350
mov dword [ebp - 0x508], 1
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x5f0], eax
mov eax, dword [ebp - 0x5f0]
sub eax, dword [ebp - 0x508]
cmp eax, 0xfffffffd
jne 0x10021379
mov dword [ebp - 0x2dc], 1
jmp 0x10021380
and dword [ebp - 0x2dc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2dc]
mov dword [ebp + eax - 0x804], ecx
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x774], eax
jmp 0x100213c8
mov dword [ebp - 0x758], 0x863e3202
push 1
lea eax, [ebp - 0x668]
push eax
push 0x1645
lea eax, [ebp - 0x758]
push eax
call fcn.1001dea5
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6f4]
call fcn.10017164
jmp 0x10021052
jmp 0x10020df9
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x978], 1
mov dword [ebp - 0x40], 0
jmp 0x10021402
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x10021418
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xb70], 0xa8eac8b
jmp 0x100213fb
mov dword [ebp - 0x40], 0
jmp 0x10021428
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1002143e
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xa34], 0x4caf14c9
jmp 0x10021421
mov dword [ebp - 0x4c], 3
jmp 0x1002144e
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x100214b7
mov dword [ebp - 0x1b8], 1
mov dword [ebp - 0x1b8], 3
jmp 0x10021477
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0
jl 0x100214b5
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0xb70], 0
ja 0x10021499
mov dword [ebp - 0x510], 1
jmp 0x100214a0
and dword [ebp - 0x510], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x510]
mov dword [ebp + eax - 0xa34], ecx
jmp 0x1002146a
jmp 0x10021447
mov dword [ebp - 0x4c], 9
jmp 0x100214c7
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xfffffff1
jle 0x10021553
mov dword [ebp - 0x77c], 0xffffffff
mov dword [ebp - 0x764], 0xb263d188
mov dword [ebp - 0xa58], 0x89fe57f6
mov dword [ebp - 0xae8], 0
mov dword [ebp - 0xae4], 0
mov dword [ebp - 0xae0], 0
mov dword [ebp - 0xadc], 0
mov dword [ebp - 0x784], 0xe043
lea eax, [ebp - 0x77c]
push eax
push 0x6155
push 1
lea eax, [ebp - 0x764]
push eax
call fcn.1001df17
add esp, 0x10
lea eax, [ebp - 0x784]
push eax
push 1
call fcn.1001df91
pop ecx
pop ecx
jmp 0x100214c0
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x277]
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x168]
movzx ecx, byte [ebp + ecx - 0x27a]
movzx ecx, word [ebp + ecx*2 - 0x964]
or eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x277]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x168]
movzx edx, byte [ebp + edx - 0x27a]
movzx edx, word [ebp + edx*2 - 0x964]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x278]
mov word [ebp + ecx*2 - 0x964], ax
mov dword [ebp - 0x3c], 0x6038
mov dword [ebp - 0x670], 0x1d7feae2
mov dword [ebp - 0x3ac], 0xc857617c
mov dword [ebp - 0x770], 0x243b9c30
cmp dword [ebp - 0x3c], 1
je 0x100215eb
mov dword [ebp - 0x5f8], 1
jmp 0x100215f2
and dword [ebp - 0x5f8], 0
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x5f8]
cmp eax, 1
jl 0x1002160c
mov dword [ebp - 0x518], 1
jmp 0x10021613
and dword [ebp - 0x518], 0
cmp dword [ebp - 0x518], 0xffffffff
jle 0x10021628
mov dword [ebp - 0x678], 1
jmp 0x1002162f
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x678], eax
jg 0x10021646
mov dword [ebp - 0x78c], 1
jmp 0x1002164d
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x980], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], eax
jl 0x1002166a
mov dword [ebp - 0x520], 1
jmp 0x10021671
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x520]
cmp eax, 7
jl 0x1002168b
mov dword [ebp - 0x600], 1
jmp 0x10021692
and dword [ebp - 0x600], 0
cmp dword [ebp - 0x600], 0xc6548aa
jg 0x100216aa
mov dword [ebp - 0x528], 1
jmp 0x100216b1
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x528]
mov dword [ebp - 0x670], eax
je 0x100216d7
mov eax, 0x169f
test eax, eax
je 0x100216d7
mov dword [ebp - 0x37c], 1
jmp 0x100216de
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x37c], eax
jne 0x100216f5
mov dword [ebp - 0x384], 1
jmp 0x100216fc
and dword [ebp - 0x384], 0
cmp dword [ebp - 0x384], 0x2a3b3f36
jg 0x10021714
mov dword [ebp - 0x38c], 1
jmp 0x1002171b
and dword [ebp - 0x38c], 0
cmp dword [ebp - 0x38c], 5
jge 0x10021730
mov dword [ebp - 0x394], 1
jmp 0x10021737
and dword [ebp - 0x394], 0
cmp dword [ebp - 0x394], 4
jb 0x10021751
or eax, 0xffffffff
je 0x10021751
mov dword [ebp - 0x39c], 1
jmp 0x10021758
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x39c]
neg eax
cmp eax, 0xfffffff7
jle 0x10021771
mov dword [ebp - 0x3a4], 1
jmp 0x10021778
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x3ac]
add eax, dword [ebp - 0x3c]
mov dword [ebp - 0x770], eax
mov byte [ebp - 0x9f], 0
movzx eax, byte [ebp - 0x9f]
test eax, eax
je 0x100217ad
push 1
call fcn.1001dfc5
pop ecx
and dword [ebp - 0x168], 0
jmp 0x10020df9
push 2
lea ecx, [ebp - 0x284]
call fcn.100170df
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x1a8], 1
mov dword [ebp - 0x1a4], 1
mov dword [ebp - 0x1a0], 1
mov dword [ebp - 0x19c], 1
mov dword [ebp - 0x320], 0xfffffffa
mov dword [ebp - 0x404], 0
mov dword [ebp - 0x44], 0
jmp 0x10021816
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x10021832
push dword [ebp - 0x44]
lea ecx, [ebp - 0x284]
call fcn.10017169
mov dword [eax], 2
jmp 0x1002180f
mov dword [ebp - 0x44], 0
jmp 0x10021842
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x10021858
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xa18], 0xffffffff
jmp 0x1002183b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1a8], 1
jmp 0x10021886
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1a8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a8], 0
jl 0x10021b25
mov dword [ebp - 0x110], 0xf9a4d91f
mov dword [ebp - 0x40c], 0xffffffff
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a8]
mov dword [ebp - 0x320], eax
mov esi, dword [ebp - 0x320]
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1a8]
lea ecx, [ebp - 0x284]
call fcn.10017169
cmp dword [eax], esi
jne 0x100218ef
mov dword [ebp - 0x854], 1
jmp 0x100218f6
and dword [ebp - 0x854], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1a8]
lea ecx, [ebp - 0x284]
call fcn.10017169
push 1
lea ecx, [ebp - 0x284]
call fcn.10017169
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0xa18]
mov dword [ebp - 0x3bc], eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1a8]
lea ecx, [ebp - 0x284]
call fcn.10017169
mov ecx, dword [ebp - 0x3bc]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x3bc]
cmp dword [eax], 0
jg 0x10021967
mov dword [ebp - 0x3c4], 1
jmp 0x1002196e
and dword [ebp - 0x3c4], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1a8]
lea ecx, [ebp - 0x284]
call fcn.10017169
push 4
pop ecx
imul ecx, ecx, 0
mov esi, dword [eax]
sub esi, dword [ebp + ecx - 0x1a8]
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1a8]
lea ecx, [ebp - 0x284]
call fcn.10017169
mov ecx, dword [ebp - 0x3c4]
sub ecx, dword [eax]
sub esi, ecx
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1a8]
lea ecx, [ebp - 0x284]
call fcn.10017169
cmp esi, dword [eax]
jg 0x100219df
mov dword [ebp - 0x3cc], 1
jmp 0x100219e6
and dword [ebp - 0x3cc], 0
push 4
pop eax
shl eax, 1
mov esi, dword [ebp - 0x3cc]
sub esi, dword [ebp + eax - 0x1a8]
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1a8]
lea ecx, [ebp - 0x284]
call fcn.10017169
cmp esi, dword [eax]
jge 0x10021a20
mov dword [ebp - 0x3d4], 1
jmp 0x10021a27
and dword [ebp - 0x3d4], 0
cmp dword [ebp - 0x3d4], 0
je 0x10021a45
cmp dword [ebp - 0x110], 0
je 0x10021a45
mov dword [ebp - 0x3dc], 1
jmp 0x10021a4c
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x3dc], eax
je 0x10021a66
mov dword [ebp - 0x3e4], 1
jmp 0x10021a6d
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x3e4], eax
jle 0x10021a87
mov dword [ebp - 0x3ec], 1
jmp 0x10021a8e
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x3ec], eax
jge 0x10021aa8
mov dword [ebp - 0x3f4], 1
jmp 0x10021aaf
and dword [ebp - 0x3f4], 0
imul esi, dword [ebp - 0x3f4], 0xf59f
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1a8]
lea ecx, [ebp - 0x284]
call fcn.10017169
cmp esi, dword [eax]
jg 0x10021ae1
mov dword [ebp - 0x3fc], 1
jmp 0x10021ae8
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x40c], eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1a8]
lea ecx, [ebp - 0x284]
call fcn.10017169
mov eax, dword [eax]
mov dword [ebp - 0x40c], eax
jmp 0x1002186b
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x284]
call fcn.10017164
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0x964], cx
mov dword [ebp - 0x7f8], 0xe2632c5b
mov dword [ebp - 0x114], 0
jmp 0x10021b67
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 3
jge 0x10021b83
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x814], 0
jmp 0x10021b5a
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x814], 0
jmp 0x10021bb1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x814]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x814], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x814], 0x1c
jne 0x10021d19
mov dword [ebp - 0x434], 0xd3ecf04
mov dword [ebp - 0x11c], 0
jmp 0x10021be8
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 1
jge 0x10021c01
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x60], 0xffffffff
jmp 0x10021bdb
mov byte [ebp - 0x9a], 0
movzx eax, byte [ebp - 0x9a]
test eax, eax
je 0x10021c1b
push 1
call fcn.1001dff0
pop ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x60], 0
jne 0x10021c3e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x60], 0
jne 0x10021c3e
and dword [ebp - 0x41c], 0
jmp 0x10021c48
mov dword [ebp - 0x41c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x60]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x60]
jne 0x10021c74
mov dword [ebp - 0x414], 1
jmp 0x10021c7b
and dword [ebp - 0x414], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x814]
cmp dword [ebp - 0x414], eax
je 0x10021c9c
mov dword [ebp - 0x424], 1
jmp 0x10021ca3
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x41c]
sub eax, dword [ebp - 0x424]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x60]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x60]
jle 0x10021cd2
mov dword [ebp - 0x42c], 1
jmp 0x10021cd9
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0x7555b7ce
jle 0x10021cfd
mov dword [ebp - 0x778], 1
jmp 0x10021d04
and dword [ebp - 0x778], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x60]
mov dword [ebp - 0x7f8], eax
jmp 0x10021b96
lea eax, [ebp - 0x964]
push eax
lea ecx, [ebp - 0xb88]
call fcn.100254c4
mov dword [ebp - 0x780], eax
mov eax, dword [ebp - 0x780]
mov dword [ebp - 0x864], eax
mov byte [ebp - 4], 0xf
push dword [ebp - 0x864]
call fcn.1001c066
pop ecx
mov dword [ebp - 0x5fc], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb88]
call fcn.10016f19
and dword [ebp - 0x12c], 0
jmp 0x10021d78
cmp dword [ebp - 0x12c], 0xd
jae 0x1002202c
mov dword [ebp - 0x24], 0xffff
mov dword [ebp - 0x2bc], 1
mov dword [ebp - 0x2e0], 3
mov dword [ebp - 0xac], 0xffffffff
mov dword [ebp - 0xb0c], 0x511c25c5
mov dword [ebp - 0x124], 0
jmp 0x10021dcd
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 1
jge 0x10021de9
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x454], 0
jmp 0x10021dc0
push 1
lea eax, [ebp - 0x24]
push eax
push 0x6741
call fcn.1001e01d
add esp, 0xc
cmp dword [ebp - 0x24], 0
jne 0x10021e0e
mov dword [ebp - 0x47c], 1
jmp 0x10021e15
and dword [ebp - 0x47c], 0
cmp dword [ebp - 0x24], 0
je 0x10021e39
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x988], eax
cmp dword [ebp - 0x24], 0x3b16
jg 0x10021e39
mov dword [ebp - 0x788], 1
jmp 0x10021e40
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xa68], eax
xor eax, eax
add eax, 7
cmp eax, 0x585ca258
jl 0x10021e61
mov dword [ebp - 0x43c], 1
jmp 0x10021e68
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x2e0]
imul eax, dword [ebp - 0x24]
mov dword [ebp - 0x444], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x444]
mov dword [ebp + eax - 0x454], ecx
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x444], eax
jle 0x10021eba
mov dword [ebp - 0x44c], 1
jmp 0x10021ec1
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x44c]
test eax, eax
jne 0x10021ee1
cmp dword [ebp - 0x2bc], 0
jne 0x10021ee1
and dword [ebp - 0x808], 0
jmp 0x10021eeb
mov dword [ebp - 0x808], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x24]
cmp dword [ebp + eax - 0x454], ecx
jg 0x10021f09
mov dword [ebp - 0x45c], 1
jmp 0x10021f10
and dword [ebp - 0x45c], 0
cmp dword [ebp - 0x45c], 0x92bd42ca
jae 0x10021f28
mov dword [ebp - 0x464], 1
jmp 0x10021f2f
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x464], eax
jne 0x10021f49
mov dword [ebp - 0x46c], 1
jmp 0x10021f50
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x46c]
sub eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xac]
je 0x10021f70
mov dword [ebp - 0x474], 1
jmp 0x10021f77
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x474], eax
je 0x10021f91
mov dword [ebp - 0x790], 1
jmp 0x10021f98
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x990], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0x47c], eax
jne 0x10021fc4
mov dword [ebp - 0x484], 1
jmp 0x10021fcb
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x484], eax
jl 0x10021fe5
cmp dword [ebp - 0x5fc], 0
je 0x100236bf
mov dword [ebp - 0x85c], 3
mov dword [ebp - 0x134], 0
jmp 0x1002205c
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 4
jge 0x10022078
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x948], 0xffffffff
jmp 0x1002204f
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x948], 7
jmp 0x100220a3
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x948]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x948], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x948], 0xa
jl 0x10022104
mov dword [ebp - 0x798], 0xcf54c3c6
push 0x42d9
push 0x524
push 0x1628
lea eax, [ebp - 0x85c]
push eax
push 0x691
lea eax, [ebp - 0x798]
push eax
push 1
call fcn.1001e05f
add esp, 0x1c
mov byte [ebp - 0x9b], 0
movzx eax, byte [ebp - 0x9b]
test eax, eax
je 0x10022102
push 0
call fcn.1001e3f9
pop ecx
jmp 0x1002208a
mov dword [ebp - 0x818], 0xfffffffd
lea eax, [ebp - 0x818]
push eax
push 0x4a9f
push 1
push 0x4926
call fcn.1001e1bc
add esp, 0x10
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x1002214f
push 1
push 0x807
push 0x259e
call fcn.1001e24f
add esp, 0xc
mov dword [ebp - 0xdc], 0xcea5d6c0
mov dword [ebp - 0xdc], 0xffffffed
jmp 0x10022172
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xfffffff4
jg 0x10022194
mov byte [ebp - 0x69], 0
push 0x7a64
push 0
lea eax, [ebp - 0x69]
push eax
call fcn.1001e7e0
add esp, 0xc
jmp 0x10022165
push 1
lea eax, [ebp - 0xdc]
push eax
call fcn.1001e2ca
pop ecx
pop ecx
mov byte [ebp - 0x224], 0
mov byte [ebp - 0x223], 0xa7
mov byte [ebp - 0x222], 0x36
mov byte [ebp - 0x221], 0x6d
mov byte [ebp - 0x220], 0xb2
mov byte [ebp - 0x21f], 0xb
mov byte [ebp - 0x21e], 0x4f
mov byte [ebp - 0x21d], 2
mov byte [ebp - 0x21c], 0x66
mov byte [ebp - 0x21b], 0x8b
mov byte [ebp - 0x21a], 0x1b
mov byte [ebp - 0x219], 0x55
mov byte [ebp - 0x218], 0x6b
mov byte [ebp - 0x217], 0x15
mov byte [ebp - 0x216], 0x5d
mov byte [ebp - 0x215], 0xd1
mov byte [ebp - 0x214], 0x84
mov byte [ebp - 0x213], 0x9b
mov byte [ebp - 0x212], 0x60
mov byte [ebp - 0x211], 0xee
mov byte [ebp - 0x210], 3
mov byte [ebp - 0x20f], 0xca
mov byte [ebp - 0x20e], 0xf7
mov byte [ebp - 0x20d], 0xe3
mov byte [ebp - 0x20c], 0x6f
mov byte [ebp - 0x20b], 0x21
mov byte [ebp - 0x20a], 0xe
mov byte [ebp - 0x209], 4
mov byte [ebp - 0x208], 0x5e
mov byte [ebp - 0x207], 0x91
mov byte [ebp - 0x206], 0x89
mov byte [ebp - 0x205], 0x1f
mov byte [ebp - 0x204], 0x83
mov byte [ebp - 0x203], 0xc9
mov byte [ebp - 0x202], 0xc5
mov byte [ebp - 0x201], 0x37
mov byte [ebp - 0x200], 0xf5
mov byte [ebp - 0x1ff], 0xf6
mov byte [ebp - 0x1fe], 0x1a
mov byte [ebp - 0x1fd], 0x61
mov byte [ebp - 0x1fc], 0xca
mov byte [ebp - 0x1fb], 0x90
mov byte [ebp - 0x1fa], 0x48
mov byte [ebp - 0x1f9], 0x25
mov byte [ebp - 0x1f8], 0x5a
mov byte [ebp - 0x1f7], 0x87
mov byte [ebp - 0x1f6], 0x3f
mov byte [ebp - 0x1f5], 0x2e
mov byte [ebp - 0x1f4], 0x6c
mov byte [ebp - 0x1f3], 0xe6
mov byte [ebp - 0x1f2], 9
mov byte [ebp - 0x1f1], 0xa0
mov byte [ebp - 0x1f0], 0x93
mov byte [ebp - 0x1ef], 0xbd
mov byte [ebp - 0x1ee], 0xdb
mov byte [ebp - 0x1ed], 0xec
mov byte [ebp - 0x1ec], 0x75
mov byte [ebp - 0x1eb], 6
mov byte [ebp - 0x1ea], 0x2e
mov byte [ebp - 0x1e9], 1
mov byte [ebp - 0x1e8], 0xd
mov byte [ebp - 0x1e7], 2
mov byte [ebp - 0x1e6], 0xe
mov byte [ebp - 0x1e5], 4
mov byte [ebp - 0x1e4], 0x2d
mov byte [ebp - 0x1e3], 8
mov byte [ebp - 0x1e2], 0x2d
mov byte [ebp - 0x1e1], 7
mov byte [ebp - 0x1e0], 0x13
mov byte [ebp - 0x1df], 5
mov byte [ebp - 0x1de], 0x1b
mov byte [ebp - 0x1dd], 9
mov byte [ebp - 0x1dc], 0x1b
mov byte [ebp - 0x1db], 0xb
mov byte [ebp - 0x1da], 0x25
mov byte [ebp - 0x1d9], 3
mov byte [ebp - 0x1d8], 0x33
mov byte [ebp - 0x1d7], 0xa
mov byte [ebp - 0x1d6], 0x1d
mov dword [ebp - 0xe4], 0xffffffff
mov dword [ebp - 0x144], 1
mov dword [ebp - 0x870], 1
cmp dword [ebp - 0xe4], 0
je 0x10022449
mov dword [ebp - 0x13c], 0
jmp 0x1002240d
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 2
jge 0x10022429
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x8c8], 0x37bc
jmp 0x10022400
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x8c8], eax
jmp 0x10022580
push 2
lea ecx, [ebp - 0x8a8]
call fcn.100170df
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x108], 0
jmp 0x10022473
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 2
jge 0x10022495
push dword [ebp - 0x108]
lea ecx, [ebp - 0x8a8]
call fcn.10017169
mov dword [eax], 0x51cf
jmp 0x10022466
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x998], eax
push 0
lea ecx, [ebp - 0x8a8]
call fcn.10017169
mov esi, eax
push 0
lea ecx, [ebp - 0x8a8]
call fcn.10017169
mov ecx, dword [esi]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x144]
jge 0x100224d5
mov dword [ebp - 0x49c], 1
jmp 0x100224dc
and dword [ebp - 0x49c], 0
cmp dword [ebp - 0x49c], 1
je 0x100224f1
mov dword [ebp - 0x4a4], 1
jmp 0x100224f8
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x4a4]
sub eax, dword [ebp - 0x144]
jns 0x1002251c
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x1002259a
push 1
call fcn.1001e3f9
pop ecx
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x224]
or eax, 0xeb
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x224]
and ecx, 0xeb
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x224]
mov byte [ebp + ecx - 0x704], al
mov dword [ebp - 0x20], 2
and dword [ebp - 0x154], 0
jmp 0x100225f0
mov dword [ebp - 0xc0], 0xd29be1d9
mov dword [ebp - 0x2a0], 0x34e1054
mov dword [ebp - 0x1bc], 0x791f
mov dword [ebp - 0x724], 0x4f20
mov dword [ebp - 0x72c], 1
mov dword [ebp - 0x1ac], 0
jmp 0x1002370a
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 1
jge 0x10023723
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0x28], 0x648261f
jmp 0x100236fd
mov dword [ebp - 0xc0], 0
jmp 0x1002373c
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jl 0x100237d6
mov dword [ebp - 0xd4], 4
mov dword [ebp - 0xd4], 0
jmp 0x1002376c
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jg 0x100237d1
mov dword [ebp - 0x1b4], 0x9ba07e4f
mov dword [ebp - 0x1b4], 0
jmp 0x10023798
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0
jg 0x100237cf
mov byte [ebp - 0x91], 0
lea eax, [ebp - 0x91]
push eax
push 1
push 0x4ce0
call fcn.1001e7e0
add esp, 0xc
mov eax, dword [ebp - 0xd4]
cmp dword [ebp + eax*4 - 0x28], 0
je 0x100237cd
jmp 0x1002378b
jmp 0x1002378b
jmp 0x1002375f
jmp 0x1002372f
mov dword [ebp - 0x2a0], 0x9da97273
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x28]
cmp dword [ebp + eax - 0x28], ecx
jle 0x1002380f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x28], 0
je 0x1002380f
mov dword [ebp - 0x604], 1
jmp 0x10023816
and dword [ebp - 0x604], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x604], eax
jge 0x10023834
mov dword [ebp - 0x324], 1
jmp 0x1002383b
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x1bc]
imul eax, dword [ebp - 0x324]
test eax, eax
jne 0x10023855
cmp dword [ebp - 0x1bc], 0
je 0x1002386a
cmp dword [ebp - 0x2a0], 0
je 0x1002386a
mov dword [ebp - 0x32c], 1
jmp 0x10023871
and dword [ebp - 0x32c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
add eax, dword [ebp - 0x32c]
add eax, dword [ebp - 0x724]
imul eax, dword [ebp - 0x1bc]
cmp eax, 0xaa4f
jge 0x100238a1
mov dword [ebp - 0x334], 1
jmp 0x100238a8
and dword [ebp - 0x334], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
imul ecx, dword [ebp - 0x334], 0x66e9
sub eax, ecx
je 0x100238d5
cmp dword [ebp - 0x2a0], 0
je 0x100238d5
mov dword [ebp - 0x33c], 1
jmp 0x100238dc
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x33c]
sub eax, dword [ebp - 0x1bc]
js 0x100238f6
mov dword [ebp - 0x344], 1
jmp 0x100238fd
and dword [ebp - 0x344], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp eax, dword [ebp - 0x344]
jle 0x1002391b
mov dword [ebp - 0x34c], 1
jmp 0x10023922
and dword [ebp - 0x34c], 0
cmp dword [ebp - 0x34c], 0xffffffff
je 0x10023937
mov dword [ebp - 0x354], 1
jmp 0x1002393e
and dword [ebp - 0x354], 0
cmp dword [ebp - 0x354], 0x767c
jl 0x10023956
mov dword [ebp - 0x35c], 1
jmp 0x1002395d
and dword [ebp - 0x35c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
imul eax, dword [ebp - 0x35c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x28]
jle 0x10023992
mov dword [ebp - 0x364], 1
jmp 0x10023999
and dword [ebp - 0x364], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x364], eax
jle 0x100239b7
mov dword [ebp - 0x36c], 1
jmp 0x100239be
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x72c], eax
cmp dword [0x10cbe69c], 0
je 0x100239e8
mov ecx, dword [ebp + 8]
call fcn.100254e9
push eax
call dword [0x10cbe69c]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xb04], 0xffffffff
mov dword [ebp - 0x9d8], 0xfffffffe
mov dword [ebp - 0xaa8], 9
mov dword [ebp - 0x9e0], 0x7ca0029b
mov dword [ebp - 0xad8], 0x3617
mov dword [ebp - 0x734], 0
mov dword [ebp - 0x1c4], 0
jmp 0x10023a3d
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 3
jge 0x10023a59
mov eax, dword [ebp - 0x1c4]
mov dword [ebp + eax*4 - 0xb94], 0xfffffffd
jmp 0x10023a30
lea eax, [ebp - 0x734]
push eax
push 1
push 0x20a5
call fcn.1001e840
add esp, 0xc
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x10023a95
push 0x1bc2
push 0x1c5d
push 1
call fcn.1001e893
add esp, 0xc
cmp dword [ebp - 0xd0], 0
je 0x10023ada
movzx eax, byte [0x10cbe691]
test eax, eax
je 0x10023aba
mov ecx, 0x10cbe7c8
call fcn.10025572
movzx eax, al
test eax, eax
jne 0x10023ada
lea eax, [ebp - 0x374]
push eax
mov ecx, 0x10cbe7c8
call fcn.10025534
mov ecx, dword [ebp - 0xd0]
mov dword [eax], ecx
mov byte [0x10cbe691], 1
push 1
lea ecx, [ebp - 0xa94]
call fcn.100170df
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0xc8], 2
mov dword [ebp - 0x9e8], 0
push 3
lea ecx, [ebp - 0xa84]
call fcn.100170df
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0xf0], 0xc58f5537
lea eax, [ebp - 0xa94]
push eax
lea eax, [ebp - 0x38]
push eax
push 1
push 0x7293
call fcn.1001e8df
add esp, 0x10
mov dword [ebp - 0x38], 0
jmp 0x10023b44
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x10023b5a
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xb28], 0xfffffffc
jmp 0x10023b3d
mov dword [ebp - 0x38], 0
jmp 0x10023b6a
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x10023b83
push dword [ebp - 0x38]
lea ecx, [ebp - 0xa84]
call fcn.10017169
and dword [eax], 0
jmp 0x10023b63
push 0x42d2
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0xc8]
push eax
push 0
call fcn.1001e963
add esp, 0x10
mov dword [ebp - 0xf0], 8
jmp 0x10023bb9
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0x19
jg 0x10023c1b
mov dword [ebp - 0xc8], 0
jmp 0x10023bdb
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 3
jge 0x10023bf7
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0xb28], 0x74fd5228
jmp 0x10023bce
mov byte [ebp - 0xa3], 0
lea eax, [ebp - 0xa3]
push eax
push 0xe86
push 0x8f4
push 1
call fcn.1001e963
add esp, 0x10
jmp 0x10023bac
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xa84]
call fcn.10017164
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa94]
call fcn.10017164
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x73c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x92c]
call fcn.10016f19
mov eax, dword [ebp - 0x73c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret