Function at 0x10040347
Capabilities:
Contain obfuscated stackstrings
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007a5a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc9c
push esi
push edi
mov eax, dword [0x1066acdc]
and eax, 1
jne 0x1004039b
mov eax, dword [0x1066acdc]
or eax, 1
mov dword [0x1066acdc], eax
and dword [ebp - 4], 0
mov ecx, 0x1066ad40
call fcn.10047b21
push 0x1007b20b
call fcn.100625b6
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x884], 0xa5d6c05b
mov dword [ebp - 0x880], 0xa5d6c05b
mov dword [ebp - 0x87c], 0xa5d6c05b
mov dword [ebp - 0x878], 0xa5d6c05b
mov dword [ebp - 0xec], 0x7eede0b4
push 1
lea ecx, [ebp - 0x8b8]
call fcn.10028c09
mov dword [ebp - 4], 1
mov dword [ebp - 0x690], 0
mov dword [ebp - 0x1dc], 0
jmp 0x10040404
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 1
jge 0x10040423
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0x8b8]
call fcn.10028ca7
and dword [eax], 0
jmp 0x100403f7
mov dword [ebp - 0xec], 3
jmp 0x1004043c
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
jl 0x1004064b
mov dword [ebp - 0x38], 0xc891c553
mov dword [ebp - 0x680], 0xe491ba6b
mov dword [ebp - 0x38], 0
jmp 0x1004046a
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jg 0x10040646
mov dword [ebp - 0x804], 0xfffffffd
mov dword [ebp - 0x754], 1
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp + ecx*4 - 0x884]
cmp dword [ebp + eax*4 - 0x884], ecx
jg 0x100404aa
mov dword [ebp - 0x698], 1
jmp 0x100404b1
and dword [ebp - 0x698], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x884], 0xa1e1c5a3
ja 0x100404c7
cmp dword [ebp - 0x38], 0
je 0x100404e0
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x884], 0
je 0x100404e0
mov dword [ebp - 0x440], 1
jmp 0x100404e7
and dword [ebp - 0x440], 0
push 0
lea ecx, [ebp - 0x8b8]
call fcn.10028ca7
mov ecx, dword [ebp - 0x440]
cmp ecx, dword [eax]
jne 0x1004050a
mov dword [ebp - 0x660], 1
jmp 0x10040511
and dword [ebp - 0x660], 0
cmp dword [ebp - 0x660], 1
je 0x10040526
mov dword [ebp - 0x668], 1
jmp 0x1004052d
and dword [ebp - 0x668], 0
cmp dword [ebp - 0x668], 1
ja 0x10040542
mov dword [ebp - 0x670], 1
jmp 0x10040549
and dword [ebp - 0x670], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x670], eax
jle 0x10040560
mov dword [ebp - 0x678], 1
jmp 0x10040567
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0x680], eax
cmp dword [ebp - 0x680], 0
jne 0x1004058e
cmp dword [ebp - 0x804], 0
jne 0x1004058e
and dword [ebp - 0x688], 0
jmp 0x10040598
mov dword [ebp - 0x688], 1
mov eax, dword [ebp - 0x688]
mov dword [ebp - 0x690], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x690], eax
jg 0x100405bb
mov dword [ebp - 0x6a0], 1
jmp 0x100405c2
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x698]
cmp eax, dword [ebp - 0x6a0]
jg 0x100405dc
mov dword [ebp - 0x6a8], 1
jmp 0x100405e3
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0xec]
imul eax, dword [ebp - 0x6a8]
test eax, eax
je 0x10040612
push 0
lea ecx, [ebp - 0x8b8]
call fcn.10028ca7
cmp dword [eax], 0
je 0x10040612
mov dword [ebp - 0x6b0], 1
jmp 0x10040619
and dword [ebp - 0x6b0], 0
cmp dword [ebp - 0x6b0], 0
jae 0x1004062e
mov dword [ebp - 0x6dc], 1
jmp 0x10040635
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x6dc]
mov dword [ebp - 0x754], eax
jmp 0x10040463
jmp 0x1004042f
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x1004066f
push 0x2470
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8b8]
call fcn.10028c8b
push dword [ebp + 8]
lea ecx, [ebp - 0x9d4]
call fcn.10047a5c
mov dword [ebp - 4], 2
mov dword [ebp - 0x6e4], 0xa136951a
mov dword [ebp - 0xbb8], 0xffffffff
mov dword [ebp - 0xb00], 0x9c4ddb84
mov dword [ebp - 0x24], 0
jmp 0x100406c1
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x100406d7
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x8fc], 0xfffffffb
jmp 0x100406ba
mov dword [ebp - 0x24], 0
jmp 0x100406e7
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x100406fd
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc34], 0xfffffffa
jmp 0x100406e0
mov dword [ebp - 0x24], 0
jmp 0x1004070d
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10040723
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xbf0], 1
jmp 0x10040706
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8fc]
mov dword [ebp - 0x6e4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8fc]
cmp dword [ebp - 0x6e4], eax
jne 0x10040757
mov dword [ebp - 0x6d8], 1
jmp 0x1004075e
and dword [ebp - 0x6d8], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6d8]
mov dword [ebp + eax - 0xbf0], ecx
lea eax, [ebp - 0xa20]
push eax
lea ecx, [ebp - 0x9d4]
call fcn.10047ab3
push dword [eax]
lea eax, [ebp - 0xa28]
push eax
lea ecx, [ebp - 0x9d4]
call fcn.10047ac7
push dword [eax]
lea eax, [ebp - 0xa30]
push eax
lea ecx, [ebp - 0x9d4]
call fcn.10047ab3
push dword [eax]
mov edx, 0x1003ace7
lea ecx, [ebp - 0xa38]
call fcn.1004820f
add esp, 0xc
mov dword [ebp - 0x910], 2
mov dword [ebp - 0x90c], 2
mov dword [ebp - 0x908], 2
mov dword [ebp - 0x904], 2
lea ecx, [ebp - 0x26d]
call fcn.10008842
push eax
lea eax, [ebp - 0x900]
push eax
lea eax, [ebp - 0x910]
push eax
lea ecx, [ebp - 0xc1c]
call fcn.10028cb6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb2c]
call fcn.10028c65
mov byte [ebp - 4], 3
mov dword [ebp - 0x170], 0xffffffff
mov dword [ebp - 0x178], 0xffff
mov dword [ebp - 0x314], 4
mov dword [ebp - 0xa54], 0x36fbc6a6
mov dword [ebp - 0x170], 0
jmp 0x10040862
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 3
jg 0x10040986
mov dword [ebp - 0x1b0], 0xdba33992
mov dword [ebp - 0xa5c], 1
mov dword [ebp - 0xa64], 0xfffffffb
mov dword [ebp - 0xa6c], 0xe708bee
mov dword [ebp - 0xa74], 0xf744ed25
mov dword [ebp - 0xa7c], 0x7854c3eb
mov dword [ebp - 0x1b0], 0
jmp 0x100408c4
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 3
jg 0x10040981
mov dword [ebp - 0xa84], 0xffffffff
mov dword [ebp - 0xa8c], 0xed55c59c
mov dword [ebp - 0x314], 1
cmp dword [ebp - 0x314], 0
jne 0x1004090a
push 1
lea ecx, [ebp - 0xb2c]
call fcn.10028ca7
cmp dword [eax], 0
je 0x10040947
mov dword [ebp - 0x178], 0
jmp 0x10040923
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 3
jg 0x10040945
mov byte [ebp - 0x90], 0
lea eax, [ebp - 0x90]
push eax
push 0
call fcn.1003ead3
pop ecx
pop ecx
jmp 0x10040916
jmp 0x10040968
mov dword [ebp - 0xa94], 0xffffffff
mov dword [ebp - 0x658], 0x1aa435c5
mov eax, dword [ebp - 0x658]
dec eax
mov dword [ebp - 0x658], eax
push 0
push 0x5ab6
push 0x5f44
call fcn.1003f257
add esp, 0xc
jmp 0x100408b7
jmp 0x10040855
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb2c]
call fcn.10028c8b
lea ecx, [ebp - 0x9d4]
call fcn.1003ac72
mov dword [ebp - 0x620], eax
mov dword [ebp - 0xa9c], 0xffffffff
mov dword [ebp - 0xaa4], 0xfcb50bf3
mov dword [ebp - 0xaac], 0x60f951fe
mov dword [ebp - 0xab4], 2
mov dword [ebp - 0xabc], 0xfe57
mov dword [ebp - 0x75c], 0x31a
mov dword [ebp - 0x1d0], 0
jmp 0x100409fb
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 2
jge 0x10040a17
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0xc24], 0x876942a1
jmp 0x100409ee
lea eax, [ebp - 0x75c]
push eax
push 1
call fcn.1003e716
pop ecx
pop ecx
movzx eax, byte [0x1066ac2c]
test eax, eax
je 0x10040de9
mov ecx, 0x1066ad40
call fcn.10047be6
movzx eax, al
test eax, eax
jne 0x10040de9
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x674]
push eax
mov ecx, 0x1066ad40
call fcn.10047bef
lea eax, [ebp - 0xac4]
push eax
mov ecx, 0x1066ad40
call fcn.10047bd8
push eax
lea ecx, [ebp - 0x674]
call fcn.10047c0a
movzx eax, al
test eax, eax
je 0x10040de9
mov dword [ebp - 0x2dc], 0x3b26bdde
mov dword [ebp - 0x2d8], 0x3b26bdde
mov dword [ebp - 0x2d4], 0x3b26bdde
mov dword [ebp - 0x2d0], 0x3b26bdde
mov dword [ebp - 0x514], 0
mov dword [ebp - 0x7c4], 0x82a74db5
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2dc], 0xffffffe3
jmp 0x10040af5
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2dc]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2dc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2dc], 0x15
jne 0x10040dbb
push 2
lea ecx, [ebp - 0x6f0]
call fcn.10028c09
mov byte [ebp - 4], 4
mov dword [ebp - 0x764], 9
mov dword [ebp - 0x7cc], 0xffffffff
push 0x3b1e
lea eax, [ebp - 0xacc]
push eax
lea eax, [ebp - 0x6f0]
push eax
push 1
push 0x189
call fcn.1003e74b
add esp, 0x14
push 0
lea ecx, [ebp - 0x6f0]
call fcn.10028ca7
cmp dword [eax], 0
je 0x10040c3a
push 0
lea ecx, [ebp - 0x6f0]
call fcn.10028ca7
cmp dword [eax], 0x8ea2
jl 0x10040b87
mov dword [ebp - 0x5f4], 1
jmp 0x10040b8e
and dword [ebp - 0x5f4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2dc]
add eax, dword [ebp - 0x5f4]
cmp eax, 0xfaa23240
ja 0x10040bb4
mov dword [ebp - 0x31c], 1
jmp 0x10040bbb
and dword [ebp - 0x31c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2dc]
cmp eax, dword [ebp - 0x31c]
jg 0x10040bdc
mov dword [ebp - 0x504], 1
jmp 0x10040be3
and dword [ebp - 0x504], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2dc]
imul eax, dword [ebp - 0x504]
cmp eax, 0x8cdf8abf
jbe 0x10040c0a
mov dword [ebp - 0x324], 1
jmp 0x10040c11
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x324]
sub eax, 8
je 0x10040c3a
mov eax, 0xffff
test eax, eax
je 0x10040c3a
cmp dword [ebp - 0x764], 0
je 0x10040c3a
mov dword [ebp - 0x6ac], 1
jmp 0x10040c41
and dword [ebp - 0x6ac], 0
cmp dword [ebp - 0x6ac], 0x56fd8c65
jne 0x10040c59
mov dword [ebp - 0x32c], 1
jmp 0x10040c60
and dword [ebp - 0x32c], 0
imul eax, dword [ebp - 0x32c], 0
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x2dc]
jge 0x10040c82
mov dword [ebp - 0x76c], 1
jmp 0x10040c89
and dword [ebp - 0x76c], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2dc], 0
je 0x10040cae
cmp dword [ebp - 0x514], 0
je 0x10040cae
mov dword [ebp - 0x50c], 1
jmp 0x10040cb5
and dword [ebp - 0x50c], 0
cmp dword [ebp - 0x50c], 0xe465
jg 0x10040ccd
mov dword [ebp - 0x334], 1
jmp 0x10040cd4
and dword [ebp - 0x334], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2dc]
imul eax, dword [ebp - 0x334]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x2dc]
cmp eax, dword [ebp - 0x7c4]
je 0x10040d0a
mov dword [ebp - 0x5fc], 1
jmp 0x10040d11
and dword [ebp - 0x5fc], 0
push 1
lea ecx, [ebp - 0x6f0]
call fcn.10028ca7
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5fc]
jl 0x10040d34
mov dword [ebp - 0x33c], 1
jmp 0x10040d3b
and dword [ebp - 0x33c], 0
push 1
lea ecx, [ebp - 0x6f0]
call fcn.10028ca7
mov ecx, dword [ebp - 0x33c]
cmp ecx, dword [eax]
jge 0x10040d5e
mov dword [ebp - 0x298], 1
jmp 0x10040d65
and dword [ebp - 0x298], 0
push 1
lea ecx, [ebp - 0x6f0]
call fcn.10028ca7
mov ecx, dword [ebp - 0x298]
mov dword [eax], ecx
mov eax, dword [ebp - 0x514]
cmp dword [ebp - 0x298], eax
jl 0x10040d94
mov dword [ebp - 0x344], 1
jmp 0x10040d9b
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x7cc], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6f0]
call fcn.10028c8b
jmp 0x10040ada
lea ecx, [ebp - 0x674]
call fcn.10047c04
mov eax, dword [eax + 4]
mov dword [ebp - 0x7d4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9d4]
call fcn.10047aa9
mov eax, dword [ebp - 0x7d4]
jmp 0x10045b8f
mov dword [ebp - 0x34], 0xd29be1d9
mov dword [ebp - 0x98], 0x390f3bd7
mov dword [ebp - 0x180], 0
jmp 0x10040e13
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 1
jge 0x10040e2c
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x28], 0x648261f
jmp 0x10040e06
mov dword [ebp - 0x34], 0
jmp 0x10040e3c
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jg 0x10040e50
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x28], 0
je 0x10040e4e
jmp 0x10040e50
jmp 0x10040e35
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
mov dword [ebp - 0xad4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x28], 0
jne 0x10040f1a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x28], 0xfffd
jl 0x10040e8d
mov dword [ebp - 0x34c], 1
jmp 0x10040e94
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x34c]
add eax, 0x68d8c852
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x28]
jg 0x10040eb7
mov dword [ebp - 0x7dc], 1
jmp 0x10040ebe
and dword [ebp - 0x7dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
mov dword [ebp - 0xadc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
mov dword [ebp - 0xae4], eax
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x34], eax
jne 0x10040ef5
mov dword [ebp - 0x51c], 1
jmp 0x10040efc
and dword [ebp - 0x51c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
imul eax, dword [ebp - 0x51c]
test eax, eax
jne 0x10040f1a
and dword [ebp - 0x354], 0
jmp 0x10040f24
mov dword [ebp - 0x354], 1
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x354], eax
jg 0x10040f3e
mov dword [ebp - 0x7e4], 1
jmp 0x10040f45
and dword [ebp - 0x7e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
mov dword [ebp - 0xaec], eax
mov eax, dword [ebp - 0x98]
sub eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x98]
jl 0x10040f72
mov dword [ebp - 0x604], 1
jmp 0x10040f79
and dword [ebp - 0x604], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp eax, dword [ebp - 0x604]
jne 0x10040f9b
xor eax, eax
je 0x10040f9b
mov dword [ebp - 0x35c], 1
jmp 0x10040fa2
and dword [ebp - 0x35c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
add eax, dword [ebp - 0x35c]
cmp dword [ebp - 0x34], eax
jge 0x10040fc3
mov dword [ebp - 0x7ec], 1
jmp 0x10040fca
and dword [ebp - 0x7ec], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x28], 0
jne 0x10040fe0
cmp dword [ebp - 0x98], 0
je 0x10040ff5
cmp dword [ebp - 0x98], 0
je 0x10040ff5
mov dword [ebp - 0x524], 1
jmp 0x10040ffc
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x524], eax
jg 0x10041013
mov dword [ebp - 0x7f4], 1
jmp 0x1004101a
and dword [ebp - 0x7f4], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xaf4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
cmp dword [ebp - 0x34], eax
jg 0x1004103e
mov dword [ebp - 0x364], 1
jmp 0x10041045
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x364], eax
jg 0x1004105f
mov dword [ebp - 0x6e0], 1
jmp 0x10041066
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x6e0]
mov dword [ebp - 0x34], eax
and dword [ebp - 0xd4], 0
mov dword [ebp - 0x1b8], 0
jmp 0x1004108f
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 1
jge 0x100410ab
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x36c], 6
jmp 0x10041082
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x36c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x36c], eax
mov byte [ebp - 0x92], 0
push 1
lea eax, [ebp - 0x92]
push eax
call fcn.1003e7e9
pop ecx
pop ecx
lea eax, [ebp - 0x9d4]
push eax
call fcn.1003c925
pop ecx
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jne 0x100458ed
push 2
lea ecx, [ebp - 0x1ec]
call fcn.10028c09
mov byte [ebp - 4], 5
mov dword [ebp - 0x374], 1
mov dword [ebp - 0x188], 0xca6c8490
mov dword [ebp - 0x80c], 7
lea eax, [ebp - 0xafc]
push eax
push 0
lea eax, [ebp - 0x1ec]
push eax
call fcn.10040031
add esp, 0xc
push 1
lea ecx, [ebp - 0x1ec]
call fcn.10028ca7
cmp dword [eax], 0
jne 0x10041196
push 1
lea ecx, [ebp - 0x1ec]
call fcn.10028ca7
mov esi, eax
push 1
lea ecx, [ebp - 0x1ec]
call fcn.10028ca7
mov ecx, dword [esi]
imul ecx, dword [eax]
test ecx, ecx
jne 0x10041196
push 1
lea ecx, [ebp - 0x1ec]
call fcn.10028ca7
cmp dword [eax], 0
jne 0x10041196
and dword [ebp - 0x534], 0
jmp 0x100411a0
mov dword [ebp - 0x534], 1
push 1
lea ecx, [ebp - 0x1ec]
call fcn.10028ca7
mov esi, eax
push 1
lea ecx, [ebp - 0x1ec]
call fcn.10028ca7
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x100411ce
mov dword [ebp - 0x52c], 1
jmp 0x100411d5
and dword [ebp - 0x52c], 0
mov esi, dword [ebp - 0x374]
imul esi, dword [ebp - 0x52c]
push 1
lea ecx, [ebp - 0x1ec]
call fcn.10028ca7
cmp esi, dword [eax]
jl 0x100411ff
mov dword [ebp - 0x7fc], 1
jmp 0x10041206
and dword [ebp - 0x7fc], 0
push 1
lea ecx, [ebp - 0x1ec]
call fcn.10028ca7
cmp dword [ebp - 0x374], 0
je 0x1004123a
push 0
lea ecx, [ebp - 0x1ec]
call fcn.10028ca7
cmp dword [eax], 0
je 0x1004123a
mov dword [ebp - 0x60c], 1
jmp 0x10041241
and dword [ebp - 0x60c], 0
push 1
lea ecx, [ebp - 0x1ec]
call fcn.10028ca7
mov ecx, dword [ebp - 0x60c]
cmp ecx, dword [eax]
jle 0x10041264
mov dword [ebp - 0x37c], 1
jmp 0x1004126b
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x37c]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x188]
cmp dword [ebp - 0x534], eax
jl 0x100412a1
mov byte [ebp - 0x7f], 0
lea eax, [ebp - 0x7f]
push eax
push 0
push 0x6b97
call fcn.1003ef56
add esp, 0xc
jmp 0x100413cb
mov dword [ebp - 0x78], 0x20578cca
mov dword [ebp - 0x384], 1
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xb04], eax
push 1
lea ecx, [ebp - 0x1ec]
call fcn.10028ca7
mov eax, dword [eax]
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0xb0c], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xb14], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0xb1c], eax
mov esi, dword [ebp - 0x78]
push 1
lea ecx, [ebp - 0x1ec]
call fcn.10028ca7
cmp esi, dword [eax]
jg 0x10041311
mov dword [ebp - 0x67c], 1
jmp 0x10041318
and dword [ebp - 0x67c], 0
cmp dword [ebp - 0x67c], 0xffffffff
jb 0x1004132d
mov dword [ebp - 0x38c], 1
jmp 0x10041334
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x38c]
jge 0x1004134b
mov dword [ebp - 0x53c], 1
jmp 0x10041352
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x53c], eax
jne 0x10041369
mov dword [ebp - 0x394], 1
jmp 0x10041370
and dword [ebp - 0x394], 0
cmp dword [ebp - 0x394], 0x1867
jge 0x10041388
mov dword [ebp - 0x614], 1
jmp 0x1004138f
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x614], eax
jg 0x100413a6
mov dword [ebp - 0x710], 1
jmp 0x100413ad
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xb6c], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x80c], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1ec]
call fcn.10028c8b
cmp dword [0x1066ac30], 0
jne 0x10045633
mov dword [ebp - 0x190], 0x9be1d925
mov dword [ebp - 0xb7c], 0xffffffff
mov dword [ebp - 0x39c], 0x3ac
mov dword [ebp - 0x1e0], 0
jmp 0x1004141e
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 3
jge 0x1004143a
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0xca8], 0x648261f9
jmp 0x10041411
mov dword [ebp - 0x190], 2
jmp 0x10041453
mov eax, dword [ebp - 0x190]
dec eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jl 0x100414a6
mov byte [ebp - 0x86], 0
movzx eax, byte [ebp - 0x86]
test eax, eax
je 0x10041482
push 0x19f9
push 0x38f1
push 0
call fcn.1003eb1b
add esp, 0xc
mov byte [ebp - 0x81], 0
push 0
push 0xce6
push 0x1a59
lea eax, [ebp - 0x81]
push eax
call fcn.1003fd6c
add esp, 0x10
jmp 0x10041446
mov eax, dword [ebp - 0x39c]
inc eax
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x23c], 2
mov byte [ebp - 0x23b], 0x1e
mov byte [ebp - 0x23a], 3
mov byte [ebp - 0x239], 0x1c
mov byte [ebp - 0x238], 6
mov byte [ebp - 0x237], 0x5d
mov byte [ebp - 0x236], 0x34
mov byte [ebp - 0x235], 0x2c
mov byte [ebp - 0x234], 0x9d
mov byte [ebp - 0x233], 0x6d
mov byte [ebp - 0x232], 0xb3
mov byte [ebp - 0x231], 0x17
mov byte [ebp - 0x230], 0xf2
mov byte [ebp - 0x22f], 0xf
mov byte [ebp - 0x22e], 0x31
mov byte [ebp - 0x22d], 0xa7
mov byte [ebp - 0x22c], 0xaa
mov byte [ebp - 0x22b], 0x29
mov byte [ebp - 0x22a], 0xad
mov byte [ebp - 0x229], 0x2c
mov byte [ebp - 0x228], 0x10
mov byte [ebp - 0x227], 0x6f
mov byte [ebp - 0x226], 0x79
mov byte [ebp - 0x225], 0xb6
mov byte [ebp - 0x224], 0xad
mov byte [ebp - 0x223], 0xc1
mov byte [ebp - 0x222], 0x5c
mov byte [ebp - 0x221], 0x90
mov byte [ebp - 0x220], 0x8a
mov byte [ebp - 0x21f], 0x20
mov byte [ebp - 0x21e], 0x33
mov byte [ebp - 0x21d], 0xb0
mov byte [ebp - 0x21c], 0xd2
mov byte [ebp - 0x21b], 0x26
mov byte [ebp - 0x21a], 0xa9
mov byte [ebp - 0x219], 0x67
mov byte [ebp - 0x218], 0x59
mov byte [ebp - 0x217], 0xb3
mov byte [ebp - 0x216], 0xba
mov byte [ebp - 0x215], 0x23
mov byte [ebp - 0x214], 0x6a
mov byte [ebp - 0x213], 0x5e
mov byte [ebp - 0x212], 0xfb
mov byte [ebp - 0x211], 0xea
mov byte [ebp - 0x210], 0x69
mov byte [ebp - 0x20f], 0xe1
mov byte [ebp - 0x20e], 0x57
mov byte [ebp - 0x20d], 0x74
mov byte [ebp - 0x20c], 0x98
mov byte [ebp - 0x20b], 0x13
mov byte [ebp - 0x20a], 0xb5
mov byte [ebp - 0x209], 0xfc
mov byte [ebp - 0x208], 0x1a
mov byte [ebp - 0x207], 0xab
mov byte [ebp - 0x206], 0x41
mov byte [ebp - 0x205], 0x4a
mov byte [ebp - 0x204], 0xb
mov byte [ebp - 0x203], 0x57
mov byte [ebp - 0x202], 0x41
mov byte [ebp - 0x201], 0xa
mov byte [ebp - 0x200], 0x5f
mov byte [ebp - 0x1ff], 4
mov byte [ebp - 0x1fe], 9
mov byte [ebp - 0x1fd], 1
mov byte [ebp - 0x1fc], 0
mov byte [ebp - 0x1fb], 8
mov byte [ebp - 0x1fa], 0x4b
mov byte [ebp - 0x1f9], 0
mov byte [ebp - 0x1f8], 0x65
mov byte [ebp - 0x1f7], 5
mov byte [ebp - 0x1f6], 0x27
mov byte [ebp - 0x1f5], 7
mov byte [ebp - 0x1f4], 0x5e
mov byte [ebp - 0x1f3], 9
mov byte [ebp - 0x1f2], 0x56
mov byte [ebp - 0x1f1], 0xb
mov byte [ebp - 0x1f0], 8
mov dword [ebp - 0x4c], 6
mov dword [ebp - 0x2c], 0xe08974b6
mov dword [ebp - 0x2a8], 0xfffffffe
mov dword [ebp - 0x4c], 0
jmp 0x100416f6
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
je 0x10041a04
mov dword [ebp - 0x14], 0xade2167f
mov dword [ebp - 0x74], 0xfffffff6
mov dword [ebp - 0x248], 0x6335c0de
mov dword [ebp - 0x868], 0x3d8e66c
mov dword [ebp - 0x1c0], 0
jmp 0x1004173b
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 2
jge 0x10041757
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x2e4], 1
jmp 0x1004172e
xor eax, eax
sub eax, dword [ebp - 0x14]
jne 0x1004176c
or eax, 0xffffffff
jne 0x1004176c
and dword [ebp - 0x544], 0
jmp 0x10041776
mov dword [ebp - 0x544], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x544], eax
je 0x10041793
mov eax, 0xbe856dfc
test eax, eax
jne 0x10041793
and dword [ebp - 0x3a4], 0
jmp 0x1004179d
mov dword [ebp - 0x3a4], 1
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x248]
add eax, dword [ebp - 0x4c]
sub eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x74], eax
je 0x100417c6
mov dword [ebp - 0x6b4], 1
jmp 0x100417cd
and dword [ebp - 0x6b4], 0
cmp dword [ebp - 0x6b4], 0x3ff14eb4
je 0x100417e5
mov dword [ebp - 0x3ac], 1
jmp 0x100417ec
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x74]
add eax, dword [ebp - 0x3ac]
cmp dword [ebp - 0x14], eax
jg 0x10041806
mov dword [ebp - 0x54c], 1
jmp 0x1004180d
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x54c], eax
je 0x10041824
mov dword [ebp - 0x3b4], 1
jmp 0x1004182b
and dword [ebp - 0x3b4], 0
cmp dword [ebp - 0x3b4], 1
jae 0x10041840
mov dword [ebp - 0x61c], 1
jmp 0x10041847
and dword [ebp - 0x61c], 0
cmp dword [ebp - 0x61c], 0xffff
jne 0x1004185f
mov dword [ebp - 0x3bc], 1
jmp 0x10041866
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x3bc], eax
jl 0x1004187d
mov dword [ebp - 0x554], 1
jmp 0x10041884
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x554]
jl 0x10041983
mov dword [ebp - 0x14], 0
jmp 0x100418a9
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jg 0x1004195b
mov dword [ebp - 0x860], 0xfff9
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp + ecx*4 - 0x2e4]
cmp dword [ebp + eax*4 - 0x2e4], ecx
jle 0x100418df
mov dword [ebp - 0x3c4], 1
jmp 0x100418e6
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x2e4]
imul eax, dword [ebp - 0x3c4]
cmp eax, dword [ebp - 0x2c]
jg 0x10041915
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x2e4], 0
je 0x10041915
mov dword [ebp - 0x684], 1
jmp 0x1004191c
and dword [ebp - 0x684], 0
mov eax, dword [ebp - 0x684]
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x74]
push eax
push 0x7a48
lea eax, [ebp - 0x860]
push eax
push 0x59ed
push 0x6dec
push 1
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x1e07
call fcn.1003e82f
add esp, 0x24
jmp 0x100418a2
mov dword [ebp - 0x14], 0xffffffe6
jmp 0x1004196b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffee
jle 0x10041981
push 0x38e9
push 1
call fcn.1003ead3
pop ecx
pop ecx
jmp 0x10041964
jmp 0x100419c9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2e4], 0
je 0x10041995
jmp 0x10041a04
mov dword [ebp - 0x74], 0
jmp 0x100419a5
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x16
je 0x100419c9
mov byte [ebp - 0x88], 0
movzx eax, byte [ebp - 0x88]
test eax, eax
je 0x100419c7
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1004199e
cmp dword [ebp - 0x248], 1
jle 0x100419de
mov dword [ebp - 0x3cc], 1
jmp 0x100419e5
and dword [ebp - 0x3cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2e4]
imul eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x868], eax
jmp 0x100416ef
cmp dword [ebp - 0x2c], 0
je 0x10041a59
cmp dword [ebp - 0x2c], 0xabb00f6
je 0x10041a1f
mov dword [ebp - 0x55c], 1
jmp 0x10041a26
and dword [ebp - 0x55c], 0
cmp dword [ebp - 0x55c], 0xffffffff
jl 0x10041a3b
mov dword [ebp - 0x3d4], 1
jmp 0x10041a42
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x3d4], eax
jne 0x10041a59
mov dword [ebp - 0x624], 1
jmp 0x10041a60
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x2a8]
inc eax
cmp eax, 0xfffffffc
jge 0x10041a84
mov dword [ebp - 0x3dc], 1
jmp 0x10041a8b
and dword [ebp - 0x3dc], 0
cmp dword [ebp - 0x3dc], 0x5f89
jl 0x10041aa3
mov dword [ebp - 0x870], 1
jmp 0x10041aaa
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xb84], eax
push 8
pop eax
test eax, eax
jne 0x10041ac9
cmp dword [ebp - 0x2c], 0
jne 0x10041ac9
and dword [ebp - 0x778], 0
jmp 0x10041ad3
mov dword [ebp - 0x778], 1
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0xb94], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], eax
jle 0x10041b02
mov dword [ebp - 0x564], 1
jmp 0x10041b09
and dword [ebp - 0x564], 0
cmp dword [ebp - 0x564], 0x7051
jge 0x10041b21
mov dword [ebp - 0x3e4], 1
jmp 0x10041b28
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x2c], eax
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x23c]
or eax, 0x6c
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x23c]
and ecx, 0x6c
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x23c]
mov word [ebp + ecx*2 - 0xa18], ax
mov dword [ebp - 0x18], 2
and dword [ebp - 0x118], 0
jmp 0x10041b83
mov eax, dword [ebp - 0x18]
inc eax
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x4d
jae 0x1004262a
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x23c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x18], eax
jne 0x10042080
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x23c]
inc eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0xdc], 0x62d5e48d
mov dword [ebp - 0x718], 0x83c8fc55
push 2
lea ecx, [ebp - 0x980]
call fcn.10028c09
mov byte [ebp - 4], 6
mov dword [ebp - 0x64], 0
jmp 0x10041bef
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x10041c0b
push dword [ebp - 0x64]
lea ecx, [ebp - 0x980]
call fcn.10028ca7
mov dword [eax], 0xe7d214c4
jmp 0x10041be8
mov dword [ebp - 0x64], 0
jmp 0x10041c1b
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x10041c31
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x2bc], 1
jmp 0x10041c14
mov dword [ebp - 0xdc], 0x1c
jmp 0x10041c4a
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0x1d
jne 0x10041c70
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2bc]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2bc], eax
jmp 0x10041c3d
push 0
lea ecx, [ebp - 0x980]
call fcn.10028ca7
mov eax, dword [eax]
mov dword [ebp - 0xdc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2bc]
cmp eax, dword [ebp - 0xdc]
je 0x10041ca6
mov dword [ebp - 0x6c8], 1
jmp 0x10041cad
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x6c8]
mov dword [ebp - 0x718], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x980]
call fcn.10028c8b
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x23c]
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x18], eax
push 2
lea ecx, [ebp - 0x154]
call fcn.10028c09
mov byte [ebp - 4], 7
mov dword [ebp - 0xc8], 1
mov dword [ebp - 0x198], 0x79a46bb2
push 1
lea ecx, [ebp - 0x9a4]
call fcn.10028c09
mov byte [ebp - 4], 8
mov dword [ebp - 0xf0], 0
jmp 0x10041d2c
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 2
jge 0x10041d4e
push dword [ebp - 0xf0]
lea ecx, [ebp - 0x154]
call fcn.10028ca7
mov dword [eax], 0x90ac204e
jmp 0x10041d1f
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0x9a4]
push eax
push 1
call fcn.1003eb1b
add esp, 0xc
lea eax, [ebp - 0xc8]
push eax
push 1
lea eax, [ebp - 0x154]
push eax
push 0xdc2
push 0x6087
call fcn.1003eb99
add esp, 0x14
mov dword [ebp - 0xc8], 0xffffffeb
jmp 0x10041da1
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0x34
jne 0x1004205d
mov dword [ebp - 0x30], 0xfffffffb
mov byte [ebp - 0x87], 0
movzx eax, byte [ebp - 0x87]
test eax, eax
je 0x10041dcf
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 0x30], 0
jmp 0x10041ddf
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jg 0x10042058
push dword [ebp - 0x30]
lea ecx, [ebp - 0x154]
call fcn.10028ca7
mov esi, eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x154]
call fcn.10028ca7
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x10041e3d
mov byte [ebp - 0x8a], 0
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x10041e38
push 0x3a92
push 0x3e82
push 0x2339
push 0
call fcn.1003f7f4
add esp, 0x10
jmp 0x10042053
mov dword [ebp - 0x3fc], 0x7935
mov dword [ebp - 0x254], 0xa755
mov dword [ebp - 0x62c], 0xbda3fa0b
mov dword [ebp - 0x720], 0xb8f83f3a
push dword [ebp - 0x30]
lea ecx, [ebp - 0x154]
call fcn.10028ca7
cmp dword [eax], 0
je 0x10041e7d
jmp 0x10042058
push 1
lea ecx, [ebp - 0x154]
call fcn.10028ca7
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xb9c], eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x154]
call fcn.10028ca7
cmp dword [eax], 0
je 0x10041ebe
cmp dword [ebp - 0x3fc], 0
je 0x10041ebe
mov dword [ebp - 0x3ec], 1
jmp 0x10041ec5
and dword [ebp - 0x3ec], 0
push 0
lea ecx, [ebp - 0x154]
call fcn.10028ca7
mov ecx, dword [ebp - 0x3ec]
cmp ecx, dword [eax]
je 0x10041ee8
mov dword [ebp - 0x74c], 1
jmp 0x10041eef
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0xbb4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xbbc], eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x154]
call fcn.10028ca7
mov ecx, dword [ebp - 0x30]
cmp dword [eax], ecx
jge 0x10041f49
mov dword [ebp - 0x56c], 1
jmp 0x10041f50
and dword [ebp - 0x56c], 0
push 1
lea ecx, [ebp - 0x154]
call fcn.10028ca7
mov esi, dword [ebp - 0x56c]
imul esi, dword [eax]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x154]
call fcn.10028ca7
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x9a4]
call fcn.10028ca7
cmp esi, dword [eax]
jne 0x10041f93
mov dword [ebp - 0x888], 1
jmp 0x10041f9a
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0xbc4], eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x154]
call fcn.10028ca7
mov esi, eax
push 0
lea ecx, [ebp - 0x154]
call fcn.10028ca7
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x10041fd5
mov dword [ebp - 0x3f4], 1
jmp 0x10041fdc
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x62c], eax
mov esi, dword [ebp - 0x62c]
add esi, 0x6e3268dd
push 0
lea ecx, [ebp - 0x154]
call fcn.10028ca7
imul esi, dword [eax]
cmp esi, 0x651e
je 0x10042018
mov dword [ebp - 0x574], 1
jmp 0x1004201f
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x3fc]
imul eax, dword [ebp - 0x574]
cmp eax, dword [ebp - 0x254]
jl 0x10042040
mov dword [ebp - 0x404], 1
jmp 0x10042047
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0x720], eax
jmp 0x10041dd8
jmp 0x10041d94
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x9a4]
call fcn.10028c8b
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x154]
call fcn.10028c8b
jmp 0x10041b7b
mov dword [ebp - 0x898], 0xa5d6c05b
mov dword [ebp - 0x894], 0xa5d6c05b
mov dword [ebp - 0x890], 0xa5d6c05b
mov dword [ebp - 0x88c], 0xa5d6c05b
mov dword [ebp - 0x120], 0x7eede0b4
push 1
lea ecx, [ebp - 0x8dc]
call fcn.10028c09
mov byte [ebp - 4], 9
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x1d8], 0
jmp 0x100420e6
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 1
jge 0x10042105
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0x8dc]
call fcn.10028ca7
and dword [eax], 0
jmp 0x100420d9
mov dword [ebp - 0x120], 3
jmp 0x1004211e
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jl 0x1004232d
mov dword [ebp - 0x3c], 0xc891c553
mov dword [ebp - 0x41c], 0xe491ba6b
mov dword [ebp - 0x3c], 0
jmp 0x1004214c
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jg 0x10042328
mov dword [ebp - 0x7f8], 0xfffffffd
mov dword [ebp - 0x728], 1
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ebp + ecx*4 - 0x898]
cmp dword [ebp + eax*4 - 0x898], ecx
jg 0x1004218c
mov dword [ebp - 0x6c4], 1
jmp 0x10042193
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x898], 0xa1e1c5a3
ja 0x100421a9
cmp dword [ebp - 0x3c], 0
je 0x100421c2
mov eax, dword [ebp - 0x3c]
cmp dword [ebp + eax*4 - 0x898], 0
je 0x100421c2
mov dword [ebp - 0x68c], 1
jmp 0x100421c9
and dword [ebp - 0x68c], 0
push 0
lea ecx, [ebp - 0x8dc]
call fcn.10028ca7
mov ecx, dword [ebp - 0x68c]
cmp ecx, dword [eax]
jne 0x100421ec
mov dword [ebp - 0x40c], 1
jmp 0x100421f3
and dword [ebp - 0x40c], 0
cmp dword [ebp - 0x40c], 1
je 0x10042208
mov dword [ebp - 0x57c], 1
jmp 0x1004220f
and dword [ebp - 0x57c], 0
cmp dword [ebp - 0x57c], 1
ja 0x10042224
mov dword [ebp - 0x414], 1
jmp 0x1004222b
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x414], eax
jle 0x10042242
mov dword [ebp - 0x634], 1
jmp 0x10042249
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
jne 0x10042270
cmp dword [ebp - 0x7f8], 0
jne 0x10042270
and dword [ebp - 0x584], 0
jmp 0x1004227a
mov dword [ebp - 0x584], 1
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x424], eax
jg 0x1004229d
mov dword [ebp - 0x42c], 1
jmp 0x100422a4
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x6c4]
cmp eax, dword [ebp - 0x42c]
jg 0x100422be
mov dword [ebp - 0x58c], 1
jmp 0x100422c5
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x120]
imul eax, dword [ebp - 0x58c]
test eax, eax
je 0x100422f4
push 0
lea ecx, [ebp - 0x8dc]
call fcn.10028ca7
cmp dword [eax], 0
je 0x100422f4
mov dword [ebp - 0x434], 1
jmp 0x100422fb
and dword [ebp - 0x434], 0
cmp dword [ebp - 0x434], 0
jae 0x10042310
mov dword [ebp - 0x63c], 1
jmp 0x10042317
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x63c]
mov dword [ebp - 0x728], eax
jmp 0x10042145
jmp 0x10042111
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x10042351
push 0x2470
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8dc]
call fcn.10028c8b
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x23b]
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x118]
movzx ecx, byte [ebp + ecx - 0x23e]
movzx ecx, word [ebp + ecx*2 - 0xa18]
add eax, ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0x23b]
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x118]
movzx edx, byte [ebp + edx - 0x23e]
movzx edx, word [ebp + edx*2 - 0xa18]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0x23b]
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x118]
movzx edx, byte [ebp + edx - 0x23e]
movzx edx, word [ebp + edx*2 - 0xa18]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0x23c]
mov word [ebp + ecx*2 - 0xa18], ax
push 1
lea ecx, [ebp - 0x8f4]
call fcn.10028c09
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x85c], 5
mov dword [ebp - 0x59c], 0xffffffff
push 0x17a3
push 0x2eff
push 0x47ce
push 0x781b
lea eax, [ebp - 0x8f4]
push eax
push 0xb6e
push 0x22d3
push 0
push 0x4dc8
push 0xa4c
lea eax, [ebp - 0xf8]
push eax
push 0x377b
push 0x4493
push 0x220
push 0x4904
call fcn.1003f42d
add esp, 0x3c
mov dword [ebp - 0xf8], 0
jmp 0x1004247b
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 4
jge 0x10042497
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x2f4], 0x1f94964a
jmp 0x1004246e
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2f4], 0
jmp 0x100424c5
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2f4]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2f4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2f4], 0
jl 0x100425a5
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x2f4]
cmp dword [ebp + eax - 0x2f4], ecx
jge 0x10042500
mov dword [ebp - 0x43c], 1
jmp 0x10042507
and dword [ebp - 0x43c], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x2f4]
cmp dword [ebp + eax - 0x2f4], ecx
jne 0x1004252f
mov dword [ebp - 0x594], 1
jmp 0x10042536
and dword [ebp - 0x594], 0
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x2f4]
lea ecx, [ebp - 0x8f4]
call fcn.10028ca7
mov dword [ebp - 0x444], eax
push 4
pop eax
shl eax, 0
push dword [ebp + eax - 0x2f4]
lea ecx, [ebp - 0x8f4]
call fcn.10028ca7
mov ecx, dword [ebp - 0x444]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x43c]
imul eax, dword [ebp - 0x594]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x2f4]
mov ecx, dword [ebp - 0x444]
imul eax, dword [ecx]
mov dword [ebp - 0x85c], eax
jmp 0x100424aa
mov eax, 0x1546
test eax, eax
je 0x100425ca
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2f4], 0
je 0x100425ca
mov dword [ebp - 0x694], 1
jmp 0x100425d1
and dword [ebp - 0x694], 0
cmp dword [ebp - 0x694], 0xffff0006
jle 0x100425e9
mov dword [ebp - 0x44c], 1
jmp 0x100425f0
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x59c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x59c]
mov dword [ebp + eax - 0x2f4], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8f4]
call fcn.10028c8b
and dword [ebp - 0x118], 0
jmp 0x10041b7b
mov dword [ebp - 0x54], 0x477862fd
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0x77c], 0xffffffff
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x10042677
push 1
push 0x14b8
push 0x698d
push 0x3fe4
call fcn.1003edf3
add esp, 0x10
mov dword [ebp - 0x54], 3
jmp 0x10042687
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x1c
jl 0x10042ad1
push 1
lea ecx, [ebp - 0x308]
call fcn.10028c09
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x454], 0xffffffff
mov dword [ebp - 0x960], 9
mov dword [ebp - 0x95c], 9
mov dword [ebp - 0x958], 9
mov dword [ebp - 0x954], 9
lea ecx, [ebp - 0x279]
call fcn.10008842
push eax
lea eax, [ebp - 0x950]
push eax
lea eax, [ebp - 0x960]
push eax
lea ecx, [ebp - 0xc2c]
call fcn.10028cb6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb3c]
call fcn.10028c65
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x25c], 0xe255
push 1
lea ecx, [ebp - 0x9e0]
call fcn.10028c09
mov byte [ebp - 4], 0xd
push 0x5941
push 0
lea eax, [ebp - 0x100]
push eax
push 0x577a
lea eax, [ebp - 0x308]
push eax
call fcn.1003f389
add esp, 0x14
mov dword [ebp - 0x100], 0
jmp 0x10042763
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 1
jge 0x10042782
push dword [ebp - 0x100]
lea ecx, [ebp - 0x9e0]
call fcn.10028ca7
or dword [eax], 0xffffffff
jmp 0x10042756
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xbcc], eax
push 0
lea ecx, [ebp - 0x308]
call fcn.10028ca7
mov eax, dword [eax]
mov dword [ebp - 0x454], eax
mov esi, dword [ebp - 0x454]
push 0
lea ecx, [ebp - 0x308]
call fcn.10028ca7
cmp esi, dword [eax]
jle 0x100427ca
mov dword [ebp - 0x644], 1
jmp 0x100427d1
and dword [ebp - 0x644], 0
push 0
lea ecx, [ebp - 0x308]
call fcn.10028ca7
mov ecx, dword [ebp - 0x644]
cmp ecx, dword [eax]
jge 0x100427f4
mov dword [ebp - 0x45c], 1
jmp 0x100427fb
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x45c]
sub eax, dword [ebp - 0x54]
cmp eax, 2
je 0x10042815
mov dword [ebp - 0x5a4], 1
jmp 0x1004281c
and dword [ebp - 0x5a4], 0
push 0
lea ecx, [ebp - 0x308]
call fcn.10028ca7
mov ecx, dword [ebp - 0x5a4]
cmp ecx, dword [eax]
jle 0x1004283f
mov dword [ebp - 0x464], 1
jmp 0x10042846
and dword [ebp - 0x464], 0
push 0
lea ecx, [ebp - 0x308]
call fcn.10028ca7
mov ecx, dword [ebp - 0x464]
sub ecx, dword [eax]
cmp ecx, 1
jge 0x1004286c
mov dword [ebp - 0x6cc], 1
jmp 0x10042873
and dword [ebp - 0x6cc], 0
cmp dword [ebp - 0x6cc], 0x2053
je 0x1004288b
mov dword [ebp - 0x294], 1
jmp 0x10042892
and dword [ebp - 0x294], 0
push 0
lea ecx, [ebp - 0xb3c]
call fcn.10028ca7
mov ecx, dword [ebp - 0x294]
mov dword [eax], ecx
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x294], eax
jle 0x100428be
mov dword [ebp - 0x46c], 1
jmp 0x100428c5
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x46c], eax
jg 0x100428dc
mov dword [ebp - 0x730], 1
jmp 0x100428e3
and dword [ebp - 0x730], 0
push 0
lea ecx, [ebp - 0x308]
call fcn.10028ca7
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0xbd4], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xbdc], eax
cmp dword [ebp - 0xd8], 0
jne 0x10042912
cmp dword [ebp - 0x7c], 0
xor eax, eax
je 0x10042922
mov dword [ebp - 0x5ac], 1
jmp 0x10042929
and dword [ebp - 0x5ac], 0
cmp dword [ebp - 0x5ac], 0xd441
jl 0x10042941
mov dword [ebp - 0x474], 1
jmp 0x10042948
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x474]
sub eax, dword [ebp - 0xd8]
sub eax, dword [ebp - 0x25c]
cmp eax, dword [ebp - 0xd8]
je 0x1004296e
mov dword [ebp - 0x64c], 1
jmp 0x10042975
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x64c]
jne 0x1004298c
mov dword [ebp - 0x47c], 1
jmp 0x10042993
and dword [ebp - 0x47c], 0
cmp dword [ebp - 0x47c], 0xfffffffd
je 0x100429a8
mov dword [ebp - 0x5b4], 1
jmp 0x100429af
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x5b4], eax
jge 0x100429c6
mov dword [ebp - 0x484], 1
jmp 0x100429cd
and dword [ebp - 0x484], 0
push 0
lea ecx, [ebp - 0x308]
call fcn.10028ca7
mov ecx, dword [ebp - 0x484]
cmp ecx, dword [eax]
jl 0x100429f0
mov dword [ebp - 0x69c], 1
jmp 0x100429f7
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x69c], eax
je 0x10042a11
mov dword [ebp - 0x774], 1
jmp 0x10042a18
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xbe4], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xb58], eax
cmp dword [ebp - 0xd8], 0
je 0x10042a3f
cmp dword [ebp - 0x25c], 0
jne 0x10042a4e
cmp dword [ebp - 0x54], 0
jne 0x10042a4e
and dword [ebp - 0x738], 0
jmp 0x10042a58
mov dword [ebp - 0x738], 1
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xa24], eax
push 0xfffffffffffffffa
pop eax
cmp eax, 0x6ba8a7e8
je 0x10042a77
mov dword [ebp - 0x2ac], 1
jmp 0x10042a7e
and dword [ebp - 0x2ac], 0
push 0
lea ecx, [ebp - 0x9e0]
call fcn.10028ca7
mov ecx, dword [ebp - 0x2ac]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x77c], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x9e0]
call fcn.10028c8b
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xb3c]
call fcn.10028c8b
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x308]
call fcn.10028c8b
jmp 0x10042680
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0xa18], cx
push 2
lea ecx, [ebp - 0x110]
call fcn.10028c09
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x60], 0x4cff15cc
mov dword [ebp - 0x278], 0
mov dword [ebp - 0x29c], 0x60039c1d
mov dword [ebp - 0xa4c], 0xcec8
mov dword [ebp - 0x6c], 0
jmp 0x10042b27
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x10042b3d
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x244], 0x8bbca631
jmp 0x10042b20
mov dword [ebp - 0x6c], 0
jmp 0x10042b4d
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x10042b69
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x110]
call fcn.10028ca7
mov dword [eax], 0xfffffffa
jmp 0x10042b46
push 1
lea ecx, [ebp - 0x110]
call fcn.10028ca7
mov dword [eax], 1
jmp 0x10042ba2
push 1
lea ecx, [ebp - 0x110]
call fcn.10028ca7
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x48c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x48c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x110]
call fcn.10028ca7
cmp dword [eax], 0
jl 0x10042d95
mov dword [ebp - 0x494], 0
mov dword [ebp - 0x4a4], 0xb11f3813
push 1
lea ecx, [ebp - 0x110]
call fcn.10028ca7
mov esi, dword [eax]
push 1
lea ecx, [ebp - 0x110]
call fcn.10028ca7
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x244]
cmp dword [ebp + esi*4 - 0x244], eax
jne 0x10042c0b
xor eax, eax
inc eax
je 0x10042c0b
mov dword [ebp - 0x5bc], 1
jmp 0x10042c12
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x494], eax
push 1
lea ecx, [ebp - 0x110]
call fcn.10028ca7
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x244]
mov edi, dword [ebp - 0x494]
push 1
lea ecx, [ebp - 0x110]
call fcn.10028ca7
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x244]
imul eax, edi
sub eax, esi
cmp eax, 0xffff
jae 0x10042c68
mov dword [ebp - 0x654], 1
jmp 0x10042c6f
and dword [ebp - 0x654], 0
push 1
lea ecx, [ebp - 0x110]
call fcn.10028ca7
mov eax, dword [eax]
mov ecx, dword [ebp - 0x654]
imul ecx, dword [ebp + eax*4 - 0x244]
mov dword [ebp - 0x49c], ecx
push 1
lea ecx, [ebp - 0x110]
call fcn.10028ca7
mov eax, dword [eax]
mov ecx, dword [ebp - 0x49c]
mov dword [ebp + eax*4 - 0x244], ecx
cmp dword [ebp - 0x49c], 0
je 0x10042cd3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x244], 0
je 0x10042cd3
mov dword [ebp - 0x5c4], 1
jmp 0x10042cda
and dword [ebp - 0x5c4], 0
mov esi, dword [ebp - 0x5c4]
neg esi
sub esi, dword [ebp - 0x4a4]
push 0
lea ecx, [ebp - 0x110]
call fcn.10028ca7
cmp esi, dword [eax]
jle 0x10042d05
mov dword [ebp - 0x740], 1
jmp 0x10042d0c
and dword [ebp - 0x740], 0
push 1
lea ecx, [ebp - 0x110]
call fcn.10028ca7
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0xb88], eax
mov esi, dword [ebp - 0x60]
sub esi, 0x884f
push 1
lea ecx, [ebp - 0x110]
call fcn.10028ca7
cmp esi, dword [eax]
je 0x10042d4b
mov dword [ebp - 0x6d4], 1
jmp 0x10042d52
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x60], 0
jmp 0x10042d6e
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x1b
jg 0x10042d90
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x10042d8e
push 0
push 0x7793
call fcn.100476e2
pop ecx
pop ecx
jmp 0x10042d67
jmp 0x10042b7e
mov dword [ebp - 0x60], 0xffffffed
jmp 0x10042da5
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x17
jne 0x10043029
mov dword [ebp - 0x924], 1
mov dword [ebp - 0x920], 1
mov dword [ebp - 0x91c], 1
mov dword [ebp - 0x918], 1
lea ecx, [ebp - 0x29d]
call fcn.10008842
push eax
lea eax, [ebp - 0x914]
push eax
lea eax, [ebp - 0x924]
push eax
lea ecx, [ebp - 0xc6c]
call fcn.10028cb6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x6c0]
call fcn.10028c65
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x784], 0xd6ca138d
push 1
lea ecx, [ebp - 0x6c0]
call fcn.10028ca7
cmp dword [eax], 0xfffffff7
jae 0x10042fb1
push 1
lea ecx, [ebp - 0x6c0]
call fcn.10028ca7
push 2
lea ecx, [ebp - 0x6c0]
call fcn.10028ca7
push 1
lea ecx, [ebp - 0x6c0]
call fcn.10028ca7
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x244]
cmp dword [eax], ecx
jne 0x10042e7e
mov dword [ebp - 0x4ac], 1
jmp 0x10042e85
and dword [ebp - 0x4ac], 0
push 1
lea ecx, [ebp - 0x110]
call fcn.10028ca7
mov ecx, dword [ebp - 0x4ac]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x29c]
jl 0x10042eae
mov dword [ebp - 0x5cc], 1
jmp 0x10042eb5
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x29c]
imul eax, dword [ebp - 0x5cc]
test eax, eax
je 0x10042ee4
push 1
lea ecx, [ebp - 0x6c0]
call fcn.10028ca7
cmp dword [eax], 0
je 0x10042ee4
mov dword [ebp - 0x4b4], 1
jmp 0x10042eeb
and dword [ebp - 0x4b4], 0
cmp dword [ebp - 0x4b4], 0xcfb1
jle 0x10042f03
mov dword [ebp - 0x264], 1
jmp 0x10042f0a
and dword [ebp - 0x264], 0
push 1
lea ecx, [ebp - 0x110]
call fcn.10028ca7
mov ecx, dword [ebp - 0x264]
mov dword [eax], ecx
cmp dword [ebp - 0x264], 0
je 0x10042f4f
mov eax, 0x5d7d
test eax, eax
je 0x10042f4f
cmp dword [ebp - 0x26c], 0
je 0x10042f4f
mov eax, 0x82e70d5
test eax, eax
je 0x10042f4f
mov dword [ebp - 0x65c], 1
jmp 0x10042f56
and dword [ebp - 0x65c], 0
mov esi, dword [ebp - 0x65c]
sub esi, dword [ebp - 0x26c]
push 1
lea ecx, [ebp - 0x6c0]
call fcn.10028ca7
cmp esi, dword [eax]
jl 0x10042f7f
mov dword [ebp - 0x4bc], 1
jmp 0x10042f86
and dword [ebp - 0x4bc], 0
cmp dword [ebp - 0x4bc], 0x833686a8
jae 0x10042f9e
mov dword [ebp - 0x5d4], 1
jmp 0x10042fa5
and dword [ebp - 0x5d4], 0
cmp dword [ebp - 0x5d4], 0x7a64a0f0
jle 0x10042fbe
push 1
lea ecx, [ebp - 0x6c0]
call fcn.10028ca7
mov eax, dword [ebp - 0x29c]
imul eax, dword [ebp - 0x26c]
cmp eax, 0x8e5e
jne 0x10042fde
mov dword [ebp - 0x4c4], 1
jmp 0x10042fe5
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x278], eax
lea eax, [ebp - 0x784]
push eax
push 0x3fda
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x278]
push eax
push 1
call fcn.1003eebb
add esp, 0x14
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x6c0]
call fcn.10028c8b
jmp 0x10042d9e
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x110]
call fcn.10028c8b
lea eax, [ebp - 0xa18]
push eax
lea ecx, [ebp - 0xc90]
call fcn.10047a84
mov dword [ebp - 0x748], eax
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x78c], eax
mov byte [ebp - 4], 0x10
push dword [ebp - 0x78c]
call fcn.1003c925
pop ecx
mov dword [ebp - 0x5e8], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xc90]
call fcn.10047aa9
mov dword [ebp - 0x1a0], 0xc2e0cf57
mov byte [ebp - 0x89], 0
lea eax, [ebp - 0x89]
push eax
push 0
call fcn.1003ffea
pop ecx
pop ecx
mov dword [ebp - 0x1a0], 0xe
jmp 0x100430bb
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0x14
jle 0x10043111
mov dword [ebp - 0x1c8], 1
mov dword [ebp - 0x1c8], 0
jmp 0x100430e7
mov eax, dword [ebp - 0x1c8]
dec eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0xfffffffd
jg 0x1004310f
mov byte [ebp - 0xa1], 0
push 0x28c3
push 1
lea eax, [ebp - 0xa1]
push eax
call fcn.1003ef56
add esp, 0xc
jmp 0x100430da
jmp 0x100430ae
and dword [ebp - 0x1a8], 0
jmp 0x10043127
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0xd
jae 0x10043407
mov dword [ebp - 0x8ac], 0xa5d6c05b
mov dword [ebp - 0x8a8], 0xa5d6c05b
mov dword [ebp - 0x8a4], 0xa5d6c05b
mov dword [ebp - 0x8a0], 0xa5d6c05b
mov dword [ebp - 0xe0], 0x7eede0b4
push 1
lea ecx, [ebp - 0x8d0]
call fcn.10028c09
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x4e4], 0
push 1
lea eax, [ebp - 0x8d0]
push eax
lea eax, [ebp - 0xa2c]
push eax
call fcn.1003efb3
add esp, 0xc
mov dword [ebp - 0xe0], 3
jmp 0x100431b2
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jl 0x100433c1
mov dword [ebp - 0x40], 0xc891c553
mov dword [ebp - 0x4dc], 0xe491ba6b
mov dword [ebp - 0x40], 0
jmp 0x100431e0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jg 0x100433bc
mov dword [ebp - 0x750], 0xfffffffd
mov dword [ebp - 0x794], 1
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ebp + ecx*4 - 0x8ac]
cmp dword [ebp + eax*4 - 0x8ac], ecx
jg 0x10043220
mov dword [ebp - 0x6d0], 1
jmp 0x10043227
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x8ac], 0xa1e1c5a3
ja 0x1004323d
cmp dword [ebp - 0x40], 0
je 0x10043256
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x8ac], 0
je 0x10043256
mov dword [ebp - 0x6a4], 1
jmp 0x1004325d
and dword [ebp - 0x6a4], 0
push 0
lea ecx, [ebp - 0x8d0]
call fcn.10028ca7
mov ecx, dword [ebp - 0x6a4]
cmp ecx, dword [eax]
jne 0x10043280
mov dword [ebp - 0x4cc], 1
jmp 0x10043287
and dword [ebp - 0x4cc], 0
cmp dword [ebp - 0x4cc], 1
je 0x1004329c
mov dword [ebp - 0x5dc], 1
jmp 0x100432a3
and dword [ebp - 0x5dc], 0
cmp dword [ebp - 0x5dc], 1
ja 0x100432b8
mov dword [ebp - 0x4d4], 1
jmp 0x100432bf
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x4d4], eax
jle 0x100432d6
mov dword [ebp - 0x664], 1
jmp 0x100432dd
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x664]
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0
jne 0x10043304
cmp dword [ebp - 0x750], 0
jne 0x10043304
and dword [ebp - 0x5e4], 0
jmp 0x1004330e
mov dword [ebp - 0x5e4], 1
mov eax, dword [ebp - 0x5e4]
mov dword [ebp - 0x4e4], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x4e4], eax
jg 0x10043331
mov dword [ebp - 0x4ec], 1
jmp 0x10043338
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x6d0]
cmp eax, dword [ebp - 0x4ec]
jg 0x10043352
mov dword [ebp - 0x5ec], 1
jmp 0x10043359
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0xe0]
imul eax, dword [ebp - 0x5ec]
test eax, eax
je 0x10043388
push 0
lea ecx, [ebp - 0x8d0]
call fcn.10028ca7
cmp dword [eax], 0
je 0x10043388
mov dword [ebp - 0x4f4], 1
jmp 0x1004338f
and dword [ebp - 0x4f4], 0
cmp dword [ebp - 0x4f4], 0
jae 0x100433a4
mov dword [ebp - 0x66c], 1
jmp 0x100433ab
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x66c]
mov dword [ebp - 0x794], eax
jmp 0x100431d9
jmp 0x100431a5
mov byte [ebp - 0x93], 0
push 0x740a
push 1
lea eax, [ebp - 0x93]
push eax
push 0xd99
call fcn.1003f1d0
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8d0]
call fcn.10028c8b
xor eax, eax
mov ecx, dword [ebp - 0x1a8]
mov word [ebp + ecx*2 - 0xa18], ax
jmp 0x1004311a
mov dword [ebp - 0x20], 0xffffffff
push 3
lea ecx, [ebp - 0x2c8]
call fcn.10028c09
mov byte [ebp - 4], 0x12
mov dword [ebp - 0xa0], 0
push 1
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x2c8]
push eax
call fcn.1003f257
add esp, 0xc
mov dword [ebp - 0x128], 0
jmp 0x1004345a
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 3
jge 0x10043476
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x9bc], 0xae446f94
jmp 0x1004344d
mov dword [ebp - 0x20], 4
jmp 0x10043486
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe4
je 0x10043aae
push 2
lea ecx, [ebp - 0x2b8]
call fcn.10028c09
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x280], 0xfff6
mov dword [ebp - 0x16c], 0xfffffffa
mov dword [ebp - 0x3c0], 0x6446
mov dword [ebp - 0x288], 0x711a53fd
mov dword [ebp - 0x398], 1
push 0x70f0
lea eax, [ebp - 0x2b8]
push eax
push 0xa1f
lea eax, [ebp - 0xb08]
push eax
push 1
call fcn.1003f2df
add esp, 0x14
push 0
lea ecx, [ebp - 0x2b8]
call fcn.10028ca7
mov esi, eax
push 0
lea ecx, [ebp - 0x2b8]
call fcn.10028ca7
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x10043523
mov dword [ebp - 0x318], 1
jmp 0x1004352a
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0xa34], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xa1c], eax
push 0
lea ecx, [ebp - 0x2b8]
call fcn.10028ca7
mov eax, dword [eax]
add eax, 0x234a
jne 0x10043562
xor eax, eax
jne 0x10043562
and dword [ebp - 0x758], 0
jmp 0x1004356c
mov dword [ebp - 0x758], 1
push 0
lea ecx, [ebp - 0x2b8]
call fcn.10028ca7
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0xa3c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xb10], eax
mov eax, dword [ebp - 0x16c]
add eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jg 0x100435a8
mov dword [ebp - 0x4fc], 1
jmp 0x100435af
and dword [ebp - 0x4fc], 0
cmp dword [ebp - 0x4fc], 0x3f300457
jg 0x100435c7
mov dword [ebp - 0x310], 1
jmp 0x100435ce
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x318], 4
je 0x100435ef
mov dword [ebp - 0x320], 1
jmp 0x100435f6
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x288]
cmp dword [ebp - 0x320], eax
jge 0x10043610
mov dword [ebp - 0x328], 1
jmp 0x10043617
and dword [ebp - 0x328], 0
mov esi, dword [ebp - 0x20]
imul esi, dword [ebp - 0x328]
push 0
lea ecx, [ebp - 0x2b8]
call fcn.10028ca7
cmp esi, dword [eax]
jl 0x1004363e
mov dword [ebp - 0x330], 1
jmp 0x10043645
and dword [ebp - 0x330], 0
cmp dword [ebp - 0x330], 0xc3d076c5
jbe 0x1004365d
mov dword [ebp - 0x274], 1
jmp 0x10043664
and dword [ebp - 0x274], 0
push 0
lea ecx, [ebp - 0x2c8]
call fcn.10028ca7
mov ecx, dword [ebp - 0x274]
mov dword [eax], ecx
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0xa0], eax
mov esi, dword [ebp - 0xa0]
push 1
lea ecx, [ebp - 0x2b8]
call fcn.10028ca7
cmp esi, dword [eax]
jg 0x1004385f
mov dword [ebp - 0x15c], 0xca4d2440
mov dword [ebp - 0x360], 9
mov esi, dword [ebp - 0x20]
sub esi, 0x3cd9e638
push 0
lea ecx, [ebp - 0x2b8]
call fcn.10028ca7
cmp esi, dword [eax]
jg 0x100436da
mov dword [ebp - 0x338], 1
jmp 0x100436e1
and dword [ebp - 0x338], 0
cmp dword [ebp - 0x338], 0
jb 0x100436f6
mov dword [ebp - 0x340], 1
jmp 0x100436fd
and dword [ebp - 0x340], 0
mov esi, dword [ebp - 0x16c]
add esi, dword [ebp - 0x340]
push 0
lea ecx, [ebp - 0x2c8]
call fcn.10028ca7
cmp esi, dword [eax]
jg 0x10043726
mov dword [ebp - 0x348], 1
jmp 0x1004372d
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0xa0]
sub eax, dword [ebp - 0x348]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x350], eax
push 0
lea ecx, [ebp - 0x2c8]
call fcn.10028ca7
mov ecx, dword [ebp - 0x350]
mov dword [eax], ecx
cmp dword [ebp - 0x350], 1
jl 0x10043775
mov dword [ebp - 0x79c], 1
jmp 0x1004377c
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xa48], eax
push 0
lea ecx, [ebp - 0x2c8]
call fcn.10028ca7
mov ecx, dword [ebp - 0x15c]
cmp dword [eax], ecx
je 0x100437a8
mov dword [ebp - 0x358], 1
jmp 0x100437af
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0x8b7552f0
jne 0x100437d3
mov dword [ebp - 0x760], 1
jmp 0x100437da
and dword [ebp - 0x760], 0
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0xb90], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0xa50], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0xb18], eax
cmp dword [ebp - 0x398], 0
jge 0x10043813
mov dword [ebp - 0x368], 1
jmp 0x1004381a
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x280]
imul eax, dword [ebp - 0x368]
sub eax, 0x42f27e99
cmp eax, dword [ebp - 0x15c]
jg 0x10043840
mov dword [ebp - 0x370], 1
jmp 0x10043847
and dword [ebp - 0x370], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x370]
mov dword [ebp + eax - 0x9bc], ecx
jmp 0x10043a9a
mov dword [ebp - 0xa8], 0xafb1
mov dword [ebp - 0x388], 0xffffffff
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x9bc]
mov dword [ebp - 0xa58], eax
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xa8], eax
jg 0x100438a0
mov dword [ebp - 0x378], 1
jmp 0x100438a7
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xbd0], eax
push 2
lea ecx, [ebp - 0x2c8]
call fcn.10028ca7
mov esi, dword [ebp - 0xa8]
push 0
lea ecx, [ebp - 0x2c8]
call fcn.10028ca7
cmp esi, dword [eax]
je 0x100438e3
mov dword [ebp - 0x380], 1
jmp 0x100438ea
and dword [ebp - 0x380], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x378]
mov dword [ebp + eax - 0x9bc], ecx
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0xa60], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xb20], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xa0], eax
jge 0x10043935
mov dword [ebp - 0x390], 1
jmp 0x1004393c
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x288]
add eax, dword [ebp - 0x390]
je 0x1004395f
cmp dword [ebp - 0x398], 0
je 0x1004395f
mov dword [ebp - 0x3a0], 1
jmp 0x10043966
and dword [ebp - 0x3a0], 0
mov esi, dword [ebp - 0x3a0]
sub esi, dword [ebp - 0xa8]
push 0
lea ecx, [ebp - 0x2c8]
call fcn.10028ca7
cmp esi, dword [eax]
je 0x1004398f
mov dword [ebp - 0x3a8], 1
jmp 0x10043996
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a8]
neg eax
imul eax, dword [ebp - 0x288]
cmp eax, dword [ebp - 0x20]
jge 0x100439b6
mov dword [ebp - 0x3b0], 1
jmp 0x100439bd
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x3b0]
sub eax, 8
cmp eax, dword [ebp - 0xa8]
jge 0x100439da
mov dword [ebp - 0x7a4], 1
jmp 0x100439e1
and dword [ebp - 0x7a4], 0
push 0
lea ecx, [ebp - 0x2b8]
call fcn.10028ca7
cmp dword [ebp - 0xa8], 0
jne 0x10043a07
push 0xfffffffffffffffe
pop eax
test eax, eax
jne 0x10043a07
and dword [ebp - 0x3b8], 0
jmp 0x10043a11
mov dword [ebp - 0x3b8], 1
push 0
lea ecx, [ebp - 0x2c8]
call fcn.10028ca7
mov ecx, dword [ebp - 0x3b8]
cmp ecx, dword [eax]
jge 0x10043a34
mov dword [ebp - 0x3c8], 1
jmp 0x10043a3b
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x3c0]
imul eax, dword [ebp - 0x3c8]
test eax, eax
jne 0x10043a5e
cmp dword [ebp - 0xa8], 0
jne 0x10043a5e
and dword [ebp - 0x3d0], 0
jmp 0x10043a68
mov dword [ebp - 0x3d0], 1
push 0
lea ecx, [ebp - 0x2c8]
call fcn.10028ca7
mov ecx, dword [ebp - 0x3d0]
mov dword [eax], ecx
cmp dword [ebp - 0x16c], 0
je 0x10043a9a
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x2b8]
call fcn.10028c8b
jmp 0x1004347f
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x2b8]
call fcn.10028c8b
jmp 0x1004347f
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c8]
call fcn.10028c8b
cmp dword [ebp - 0x5e8], 0
je 0x10045633
mov dword [ebp - 0x50], 0xd4e06482
mov dword [ebp - 0xe4], 0x3bd7
mov dword [ebp - 0x448], 0xbbe75688
mov dword [ebp - 0x7ac], 0xb4c5108d
mov dword [ebp - 0x50], 0x13
jmp 0x10043aff
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x1d
jl 0x10043f6a
mov dword [ebp - 0x48], 0xe6d4f288
mov dword [ebp - 0xe8], 0x3f5e3d1a
mov dword [ebp - 0x174], 0x2095e04a
mov dword [ebp - 0x770], 1
push 1
lea ecx, [ebp - 0x81c]
call fcn.10028c09
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x7bc], 0xb28c330c
mov dword [ebp - 0x780], 0xdea8f443
mov dword [ebp - 0x800], 0xd7547197
lea eax, [ebp - 0xa68]
push eax
push 1
push 0x314f
lea eax, [ebp - 0x81c]
push eax
push 0x46d2
call fcn.1003f389
add esp, 0x14
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xb98], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xa70], eax
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xb30], eax
cmp dword [ebp - 0x50], 0
je 0x10043ccb
cmp dword [ebp - 0xe8], 0xfd77ccca
jae 0x10043bc2
xor eax, eax
inc eax
jne 0x10043bc2
cmp dword [ebp - 0x50], 0
je 0x10043bd4
cmp dword [ebp - 0x48], 0
je 0x10043bd4
mov dword [ebp - 0x3d8], 1
jmp 0x10043bdb
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x3d8]
neg eax
cmp eax, dword [ebp - 0x48]
jle 0x10043bf4
mov dword [ebp - 0x3e0], 1
jmp 0x10043bfb
and dword [ebp - 0x3e0], 0
cmp dword [ebp - 0x3e0], 0xfffffff9
ja 0x10043c10
mov dword [ebp - 0x3e8], 1
jmp 0x10043c17
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x3e8], eax
jg 0x10043c2e
mov dword [ebp - 0x3f0], 1
jmp 0x10043c35
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x3f0], eax
jge 0x10043c4c
mov dword [ebp - 0x3f8], 1
jmp 0x10043c53
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x3f8], eax
jle 0x10043c73
mov eax, 0x2c78
test eax, eax
je 0x10043c73
mov dword [ebp - 0x768], 1
jmp 0x10043c7a
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xa78], eax
cmp dword [ebp - 0xe8], 0xfffffff9
jne 0x10043ca1
cmp dword [ebp - 0xe4], 0
jne 0x10043ca1
and dword [ebp - 0x400], 0
jmp 0x10043cab
mov dword [ebp - 0x400], 1
mov eax, dword [ebp - 0x400]
add eax, 8
je 0x10043ccb
mov eax, 0x2d80
test eax, eax
je 0x10043ccb
mov dword [ebp - 0x408], 1
jmp 0x10043cd2
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
je 0x10043cf9
cmp dword [ebp - 0x48], 0
je 0x10043cf9
mov dword [ebp - 0x410], 1
jmp 0x10043d00
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x410]
neg eax
cmp eax, dword [ebp - 0x48]
jl 0x10043d19
mov dword [ebp - 0x418], 1
jmp 0x10043d20
and dword [ebp - 0x418], 0
cmp dword [ebp - 0x418], 0
ja 0x10043d35
mov dword [ebp - 0x420], 1
jmp 0x10043d3c
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0xe4]
add eax, dword [ebp - 0x420]
cmp eax, dword [ebp - 0xe4]
jne 0x10043e40
mov dword [ebp - 0x428], 0x4dbc0ba
push 1
lea ecx, [ebp - 0x8e8]
call fcn.10028c09
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x7b4], 0xc3393a39
push 0
push 0x58a
push 0x58e6
lea eax, [ebp - 0xbc0]
push eax
lea eax, [ebp - 0x8e8]
push eax
call fcn.1003ff09
add esp, 0x14
lea eax, [ebp - 0x8e8]
push eax
lea eax, [ebp - 0x7ac]
push eax
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x448]
push eax
push 0x791e
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0xe4]
push eax
push 1
lea eax, [ebp - 0x770]
push eax
lea eax, [ebp - 0x7b4]
push eax
push 0x5c06
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x7bc]
push eax
lea eax, [ebp - 0x174]
push eax
call fcn.1003f42d
add esp, 0x3c
cmp dword [ebp - 0x428], 0
je 0x10043e2c
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x8e8]
call fcn.10028c8b
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x81c]
call fcn.10028c8b
jmp 0x10043af8
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x8e8]
call fcn.10028c8b
jmp 0x10043f56
push 1
lea ecx, [ebp - 0x8c4]
call fcn.10028c09
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x788], 8
lea eax, [ebp - 0x8c4]
push eax
push 1
push 0x7ca
push 0x3630
lea eax, [ebp - 0xa80]
push eax
call fcn.1003f74a
add esp, 0x14
mov eax, dword [ebp - 0x800]
mov dword [ebp - 0xb40], eax
push 0
lea ecx, [ebp - 0x8c4]
call fcn.10028ca7
mov eax, 0x53c4a2fb
test eax, eax
jne 0x10043ead
xor eax, eax
inc eax
jne 0x10043ead
and dword [ebp - 0x430], 0
jmp 0x10043eb7
mov dword [ebp - 0x430], 1
push 0
lea ecx, [ebp - 0x8c4]
call fcn.10028ca7
mov ecx, dword [ebp - 0x430]
cmp ecx, dword [eax]
jl 0x10043eda
mov dword [ebp - 0x438], 1
jmp 0x10043ee1
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x780]
cmp eax, dword [ebp - 0x438]
jg 0x10043efe
mov dword [ebp - 0x874], 1
jmp 0x10043f05
and dword [ebp - 0x874], 0
push 0
lea ecx, [ebp - 0x81c]
call fcn.10028ca7
xor eax, eax
sub eax, dword [ebp - 0xe8]
cmp eax, 1
je 0x10043f2b
mov dword [ebp - 0x30c], 1
jmp 0x10043f32
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x788]
add eax, dword [ebp - 0x30c]
sub eax, dword [ebp - 0x50]
mov dword [ebp - 0x174], eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x8c4]
call fcn.10028c8b
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x81c]
call fcn.10028c8b
jmp 0x10043af8
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x448]
push eax
push 1
call fcn.1003f7f4
add esp, 0x10
mov dword [ebp - 0xb0], 5
mov dword [ebp - 0x798], 0xffffffff
mov dword [ebp - 0x7a0], 3
mov dword [ebp - 0x810], 0xfffd
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xb0], 0
jmp 0x10043fd4
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x29
je 0x100440bc
mov dword [ebp - 0x834], 0xffffffff
mov dword [ebp - 0x808], 0xbb2f
mov dword [ebp - 0x790], 0xaa435c52
push 3
lea ecx, [ebp - 0x98c]
call fcn.10028c09
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x864], 0xfffffff6
mov dword [ebp - 0x17c], 0
jmp 0x10044033
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 3
jge 0x10044055
push dword [ebp - 0x17c]
lea ecx, [ebp - 0x98c]
call fcn.10028ca7
mov dword [eax], 0xea1dc7e9
jmp 0x10044026
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x98c]
push eax
push 0x5ea0
push 0x250e
lea eax, [ebp - 0x790]
push eax
lea eax, [ebp - 0x864]
push eax
lea eax, [ebp - 0x798]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x7a0]
push eax
lea eax, [ebp - 0x834]
push eax
push 1
call fcn.1003f884
add esp, 0x30
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x98c]
call fcn.10028c8b
jmp 0x10043fc7
mov dword [ebp - 0xd0], 0xfffffffb
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0x10], 0xfffffff7
mov dword [ebp - 0x2cc], 0xfffffffd
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0xb8]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.10040098
add esp, 0x10
mov dword [ebp - 0xd0], 0xffffffeb
jmp 0x10044116
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0x24
jle 0x100444ca
mov dword [ebp - 0x184], 0
jmp 0x1004413c
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 2
jge 0x10044158
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0xc0], 0x6e3e45bb
jmp 0x1004412f
mov dword [ebp - 0x10], 1
jmp 0x10044168
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x100441d2
mov dword [ebp - 0x7a8], 0
mov dword [ebp - 0xb8], 0
jmp 0x10044191
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jg 0x100441bc
mov dword [ebp - 0xa88], 4
push 0x48fe
lea eax, [ebp - 0x7a8]
push eax
push 0
call fcn.1004022a
add esp, 0xc
jmp 0x10044184
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xc0]
mov dword [ebp + ecx*4 - 0xc0], eax
jmp 0x10044161
mov dword [ebp - 0x10], 1
jmp 0x100441e2
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x100444c5
mov dword [ebp - 0x458], 7
mov dword [ebp - 0x194], 1
push 2
lea ecx, [ebp - 0x998]
call fcn.10028c09
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x18c], 0
jmp 0x1004422a
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 2
jge 0x1004424c
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x998]
call fcn.10028ca7
mov dword [eax], 1
jmp 0x1004421d
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xc0], 0
je 0x10044431
mov eax, 0x3e731e7b
test eax, eax
je 0x10044421
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp + eax*4 - 0xc0], 0xb82
cmp eax, 0x218ad385
jg 0x10044294
cmp dword [ebp - 0x2cc], 0
je 0x10044294
mov dword [ebp - 0x450], 1
jmp 0x1004429b
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xc0]
cmp dword [ebp - 0x458], eax
jle 0x100442c5
mov dword [ebp - 0x460], 1
jmp 0x100442cc
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xc0]
cmp dword [ebp - 0x460], eax
jl 0x100442ea
mov dword [ebp - 0x468], 1
jmp 0x100442f1
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xc0]
cmp eax, dword [ebp - 0x468]
jle 0x1004430f
mov dword [ebp - 0x470], 1
jmp 0x10044316
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0xb8]
add eax, dword [ebp - 0x470]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xc0]
jge 0x1004433d
mov dword [ebp - 0x478], 1
jmp 0x10044344
and dword [ebp - 0x478], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x478]
cmp eax, dword [ebp - 0x10]
jne 0x1004435e
mov dword [ebp - 0x480], 1
jmp 0x10044365
and dword [ebp - 0x480], 0
cmp dword [ebp - 0x480], 0x5945
je 0x1004437d
mov dword [ebp - 0x488], 1
jmp 0x10044384
and dword [ebp - 0x488], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc0]
cmp dword [ebp - 0x488], eax
jle 0x100443a5
mov dword [ebp - 0x820], 1
jmp 0x100443ac
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xc0]
mov dword [ebp - 0xb54], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0xb50], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xa98], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xc0]
mov dword [ebp - 0xb5c], eax
cmp dword [ebp - 0xd0], 0xb5bc
jl 0x10044408
mov dword [ebp - 0x490], 1
jmp 0x1004440f
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x2cc]
add eax, dword [ebp - 0x490]
cmp eax, dword [ebp - 0x194]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc0], 0
jne 0x1004443f
xor eax, eax
inc eax
jne 0x1004443f
and dword [ebp - 0x498], 0
jmp 0x10044449
mov dword [ebp - 0x498], 1
push 1
lea ecx, [ebp - 0x998]
call fcn.10028ca7
mov ecx, dword [ebp - 0x498]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x194]
cmp dword [ebp + eax - 0xc0], ecx
jg 0x1004447f
mov dword [ebp - 0x4a0], 1
jmp 0x10044486
and dword [ebp - 0x4a0], 0
cmp dword [ebp - 0x4a0], 0x819afca6
jae 0x1004449e
mov dword [ebp - 0x4a8], 1
jmp 0x100444a5
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x2cc], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x998]
call fcn.10028c8b
jmp 0x100441db
jmp 0x10044109
mov byte [ebp - 0x148], 0
mov byte [ebp - 0x147], 0xfc
mov byte [ebp - 0x146], 2
mov byte [ebp - 0x145], 0x47
mov byte [ebp - 0x144], 0x62
mov byte [ebp - 0x143], 6
mov byte [ebp - 0x142], 0x2e
mov byte [ebp - 0x141], 1
mov byte [ebp - 0x140], 0xd
mov byte [ebp - 0x13f], 4
mov byte [ebp - 0x13e], 0x23
mov byte [ebp - 0x13d], 0xa
mov byte [ebp - 0x13c], 0x35
mov byte [ebp - 0x13b], 7
mov byte [ebp - 0x13a], 0xb
mov byte [ebp - 0x139], 0xb
mov byte [ebp - 0x138], 0x25
mov byte [ebp - 0x137], 2
mov byte [ebp - 0x136], 0x36
mov byte [ebp - 0x135], 5
mov byte [ebp - 0x134], 8
mov byte [ebp - 0x133], 9
mov byte [ebp - 0x132], 0x1b
mov byte [ebp - 0x131], 3
mov byte [ebp - 0x130], 0x16
mov byte [ebp - 0x12f], 8
mov byte [ebp - 0x12e], 5
mov dword [ebp - 0x848], 0x48261f9c
mov dword [ebp - 0xaa0], 0x9d29be1d
mov dword [ebp - 0x89c], 0x446df37d
mov dword [ebp - 0x7d0], 0x4f2887cf
mov dword [ebp - 0x830], 0xc9ed9ba0
mov dword [ebp - 0xb64], 0xffffffff
mov dword [ebp - 0xaa8], 0x72d9ee1c
mov dword [ebp - 0xba0], 0
mov dword [ebp - 0x7c0], 0x7d8cf4c5
mov dword [ebp - 0xab0], 5
mov dword [ebp - 0xb60], 0xfffffffa
mov dword [ebp - 0xab8], 0x10c13fe6
mov dword [ebp - 0xbe0], 0
mov dword [ebp - 0x7b0], 0x55145ccb
mov dword [ebp - 0x850], 1
mov dword [ebp - 0x858], 0xddca2728
mov dword [ebp - 0x284], 0x2466e9f0
mov dword [ebp - 0x7c8], 0x31af6658
mov dword [ebp - 0x7b8], 0x41db
mov eax, dword [ebp - 0x284]
dec eax
mov dword [ebp - 0x284], eax
push 0x2eca
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x7b0]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x7b8]
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x7c0]
push eax
lea eax, [ebp - 0x850]
push eax
lea eax, [ebp - 0x7c8]
push eax
lea eax, [ebp - 0x858]
push eax
push 1
lea eax, [ebp - 0x7d0]
push eax
lea eax, [ebp - 0x89c]
push eax
call fcn.1003fb7d
add esp, 0x34
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x148]
or eax, 0xb0
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x148]
and ecx, 0xb0
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x148]
mov byte [ebp + ecx - 0x70c], al
mov dword [ebp - 0x1c], 2
and dword [ebp - 0xfc], 0
jmp 0x10044704
mov eax, dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1b
jae 0x10044e3e
mov dword [ebp - 0xc4], 0x1713b910
mov dword [ebp - 0x9fc], 1
mov dword [ebp - 0x9f8], 1
mov dword [ebp - 0x9f4], 1
mov dword [ebp - 0x9f0], 1
mov dword [ebp - 0x2a4], 0xfffffff6
mov dword [ebp - 0xc4], 0xe
jmp 0x10044763
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xfffffff5
je 0x1004491b
mov dword [ebp - 0x58], 0x7937d8e6
mov dword [ebp - 0x58], 0
jmp 0x10044787
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xfffffff6
je 0x100447f4
mov dword [ebp - 0x158], 0x215e1abe
mov dword [ebp - 0x158], 3
jmp 0x100447b0
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0
jl 0x100447d5
mov byte [ebp - 0x8b], 0
movzx eax, byte [ebp - 0x8b]
test eax, eax
je 0x100447d3
push 0
call fcn.100401fd
pop ecx
jmp 0x100447a3
mov byte [ebp - 0xb1], 0
push 0x7b56
lea eax, [ebp - 0xb1]
push eax
push 1
call fcn.1003fd08
add esp, 0xc
jmp 0x10044780
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0xc4], eax
jne 0x1004480b
mov dword [ebp - 0x4b0], 1
jmp 0x10044812
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x4b0]
jle 0x10044829
mov dword [ebp - 0x4b8], 1
jmp 0x10044830
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x4b8]
jge 0x10044847
mov dword [ebp - 0x4c0], 1
jmp 0x1004484e
and dword [ebp - 0x4c0], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x4c0]
mov dword [ebp + eax - 0x9fc], ecx
mov eax, 0xd562b994
cmp eax, 0xfffffffd
jae 0x10044880
cmp dword [ebp - 0x2a4], 0
je 0x10044880
mov dword [ebp - 0x4c8], 1
jmp 0x10044887
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x4c8]
jle 0x100448a1
mov dword [ebp - 0x4d0], 1
jmp 0x100448a8
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x4d0], eax
jne 0x100448bf
mov dword [ebp - 0x4d8], 1
jmp 0x100448c6
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
jbe 0x100448e7
mov dword [ebp - 0x4e0], 1
jmp 0x100448ee
and dword [ebp - 0x4e0], 0
cmp dword [ebp - 0x4e0], 0xe1b1b552
jne 0x10044906
mov dword [ebp - 0x4e8], 1
jmp 0x1004490d
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x58], eax
jmp 0x10044756
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x148]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x1c], eax
jne 0x1004495e
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x148]
inc eax
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x148]
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x1c], eax
jmp 0x100446fc
mov dword [ebp - 0x94c], 1
mov dword [ebp - 0x948], 1
mov dword [ebp - 0x944], 1
mov dword [ebp - 0x940], 1
lea ecx, [ebp - 0x28d]
call fcn.10008842
push eax
lea eax, [ebp - 0x93c]
push eax
lea eax, [ebp - 0x94c]
push eax
lea ecx, [ebp - 0xc64]
call fcn.10028cb6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x168]
call fcn.10028c65
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x520], 0xffffffff
mov dword [ebp - 0x538], 0xffffffff
push 0
lea ecx, [ebp - 0x168]
call fcn.10028ca7
mov dword [eax], 7
jmp 0x10044a0c
push 0
lea ecx, [ebp - 0x168]
call fcn.10028ca7
mov dword [ebp - 0x4f0], eax
mov eax, dword [ebp - 0x4f0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x4f0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x168]
call fcn.10028ca7
cmp dword [eax], 5
jg 0x10044d9b
push 2
lea ecx, [ebp - 0x6fc]
call fcn.10028c09
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x28c], 0xe74fd574
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x528], 0xaead2214
push 1
lea eax, [ebp - 0x6fc]
push eax
lea eax, [ebp - 0xf4]
push eax
push 0x33e8
call fcn.1003fd6c
add esp, 0x10
mov dword [ebp - 0xf4], 0
jmp 0x10044a87
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 3
jge 0x10044aa3
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0xbfc], 0x46bac60
jmp 0x10044a7a
push 0
lea ecx, [ebp - 0x168]
call fcn.10028ca7
cmp dword [eax], 0xffff
jbe 0x10044ac4
mov dword [ebp - 0x7d8], 1
jmp 0x10044acb
and dword [ebp - 0x7d8], 0
push 1
lea ecx, [ebp - 0x168]
call fcn.10028ca7
mov esi, eax
push 0
lea ecx, [ebp - 0x6fc]
call fcn.10028ca7
mov ecx, dword [esi]
imul ecx, dword [eax]
cmp ecx, 0x3650
jle 0x10044b00
mov dword [ebp - 0x4f8], 1
jmp 0x10044b07
and dword [ebp - 0x4f8], 0
push 0
lea ecx, [ebp - 0x168]
call fcn.10028ca7
mov esi, dword [ebp - 0x4f8]
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0x6fc]
call fcn.10028ca7
cmp esi, dword [eax]
jg 0x10044b39
mov dword [ebp - 0x500], 1
jmp 0x10044b40
and dword [ebp - 0x500], 0
push 3
lea ecx, [ebp - 0x168]
call fcn.10028ca7
mov eax, dword [eax]
cmp eax, dword [ebp - 0x500]
jg 0x10044b63
mov dword [ebp - 0x508], 1
jmp 0x10044b6a
and dword [ebp - 0x508], 0
push 0
lea ecx, [ebp - 0x168]
call fcn.10028ca7
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [eax]
jle 0x10044b8d
mov dword [ebp - 0x84c], 1
jmp 0x10044b94
and dword [ebp - 0x84c], 0
push 1
lea ecx, [ebp - 0x6fc]
call fcn.10028ca7
push 1
lea ecx, [ebp - 0x168]
call fcn.10028ca7
mov esi, eax
push 0
lea ecx, [ebp - 0x6fc]
call fcn.10028ca7
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x10044bcf
mov dword [ebp - 0x510], 1
jmp 0x10044bd6
and dword [ebp - 0x510], 0
cmp dword [ebp - 0x510], 0
jae 0x10044beb
mov dword [ebp - 0x518], 1
jmp 0x10044bf2
and dword [ebp - 0x518], 0
push 2
lea ecx, [ebp - 0x168]
call fcn.10028ca7
mov ecx, dword [ebp - 0x518]
cmp ecx, dword [eax]
jge 0x10044c15
mov dword [ebp - 0x7e0], 1
jmp 0x10044c1c
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0xac0], eax
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x520], eax
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x528], eax
mov eax, dword [ebp - 0x528]
mov dword [ebp - 0xb68], eax
push 0
lea ecx, [ebp - 0x6fc]
call fcn.10028ca7
mov esi, dword [ebp - 0x19c]
push 0
lea ecx, [ebp - 0x168]
call fcn.10028ca7
cmp esi, dword [eax]
jne 0x10044c7c
mov dword [ebp - 0x530], 1
jmp 0x10044c83
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x530]
mov dword [ebp - 0x538], eax
mov esi, dword [ebp - 0x538]
push 1
lea ecx, [ebp - 0x168]
call fcn.10028ca7
cmp esi, dword [eax]
jne 0x10044cb2
mov dword [ebp - 0x540], 1
jmp 0x10044cb9
and dword [ebp - 0x540], 0
cmp dword [ebp - 0x540], 0
jb 0x10044cce
mov dword [ebp - 0x548], 1
jmp 0x10044cd5
and dword [ebp - 0x548], 0
push 3
lea ecx, [ebp - 0x168]
call fcn.10028ca7
mov ecx, dword [ebp - 0x548]
add ecx, dword [eax]
cmp ecx, 0x63446b7d
jg 0x10044cfe
mov dword [ebp - 0x550], 1
jmp 0x10044d05
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x550], eax
jl 0x10044d1f
mov dword [ebp - 0x558], 1
jmp 0x10044d26
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x558]
sub eax, dword [ebp - 0x19c]
cmp eax, 1
jg 0x10044d43
mov dword [ebp - 0x86c], 1
jmp 0x10044d4a
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0xac8], eax
cmp dword [ebp - 0x28c], 0x8a28
jg 0x10044d6e
mov dword [ebp - 0x560], 1
jmp 0x10044d75
and dword [ebp - 0x560], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x560]
mov dword [ebp + eax - 0xbfc], ecx
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x6fc]
call fcn.10028c8b
jmp 0x100449e8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x168]
call fcn.10028c8b
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x147]
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0xfc]
movzx ecx, byte [ebp + ecx - 0x14a]
movsx ecx, byte [ebp + ecx - 0x70c]
add eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x147]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xfc]
movzx edx, byte [ebp + edx - 0x14a]
movsx edx, byte [ebp + edx - 0x70c]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x147]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xfc]
movzx edx, byte [ebp + edx - 0x14a]
movsx edx, byte [ebp + edx - 0x70c]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x148]
mov byte [ebp + ecx - 0x70c], al
and dword [ebp - 0xfc], 0
jmp 0x100446fc
mov dword [ebp - 0x104], 0xb26bdde0
mov dword [ebp - 0x854], 0
mov dword [ebp - 0xba8], 0x8e10e5e5
mov dword [ebp - 0xad0], 8
mov dword [ebp - 0xb70], 0x12a2ef7e
mov dword [ebp - 0x974], 4
mov dword [ebp - 0x970], 4
mov dword [ebp - 0x96c], 4
mov dword [ebp - 0x968], 4
lea ecx, [ebp - 0x25d]
call fcn.10008842
push eax
lea eax, [ebp - 0x964]
push eax
lea eax, [ebp - 0x974]
push eax
lea ecx, [ebp - 0xc3c]
call fcn.10028cb6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb4c]
call fcn.10028c65
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x104], 0xfffffff2
jmp 0x10044eea
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0xffffffe7
jne 0x10045118
mov dword [ebp - 0xad8], 0x348f4a8f
mov dword [ebp - 0xbc8], 0xc2489102
mov dword [ebp - 0xae0], 0x8fa48a2b
mov dword [ebp - 0x1a4], 0
jmp 0x10044f2e
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 2
jge 0x10044f4a
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0x2fc], 0x2cfb6318
jmp 0x10044f21
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2fc], 0x1b
jmp 0x10044f78
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2fc]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2fc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2fc], 2
jg 0x100450fd
mov dword [ebp - 0x7e8], 1
mov dword [ebp - 0xb78], 0xf05f4326
mov dword [ebp - 0xae8], 1
mov dword [ebp - 0x590], 9
mov eax, dword [ebp - 0x7e8]
mov dword [ebp - 0xbb0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2fc], 0
jb 0x10044fdc
mov dword [ebp - 0x568], 1
jmp 0x10044fe3
and dword [ebp - 0x568], 0
cmp dword [ebp - 0x568], 0xfffffffe
jb 0x10044ff8
mov dword [ebp - 0x570], 1
jmp 0x10044fff
and dword [ebp - 0x570], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2fc]
cmp eax, dword [ebp - 0x570]
jge 0x10045020
mov dword [ebp - 0x578], 1
jmp 0x10045027
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x104]
cmp dword [ebp - 0x578], eax
je 0x10045041
mov dword [ebp - 0x580], 1
jmp 0x10045048
and dword [ebp - 0x580], 0
cmp dword [ebp - 0x580], 3
je 0x1004505d
mov dword [ebp - 0x588], 1
jmp 0x10045064
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x854], eax
mov eax, 0xd60a2215
cmp eax, 0xfffffff8
je 0x100450be
mov dword [ebp - 0x1ac], 0
jmp 0x10045093
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 3
jge 0x100450af
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0xc9c], 0xffffffff
jmp 0x10045086
mov eax, dword [ebp - 0x590]
dec eax
mov dword [ebp - 0x590], eax
jmp 0x100450de
mov dword [ebp - 0x7f0], 4
lea eax, [ebp - 0x7f0]
push eax
push 1
push 0x5161
call fcn.1003fe01
add esp, 0xc
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x100450f8
push 1
call fcn.1003fe48
pop ecx
jmp 0x10044f5d
lea eax, [ebp - 0xb4c]
push eax
push 0
push 0x5276
call fcn.1003fe71
add esp, 0xc
jmp 0x10044edd
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb4c]
call fcn.10028c8b
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x70c], 0
mov dword [ebp - 0xaf0], 0
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x1004515f
push 0
push 0x1ab7
call fcn.10040315
pop ecx
pop ecx
mov byte [ebp - 0x8f], 0
push 0xe52
push 1
lea eax, [ebp - 0x8f]
push eax
call fcn.1003fe71
add esp, 0xc
lea eax, [ebp - 0x70c]
push eax
lea ecx, [ebp - 0xc5c]
call fcn.10028ae2
mov byte [ebp - 4], 0x1c
push 1
lea ecx, [ebp - 0x9b0]
call fcn.10028c09
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x11c], 0xfe5e81a7
mov dword [ebp - 0xcc], 0xa0bdbdf7
push 1
lea eax, [ebp - 0x9b0]
push eax
lea eax, [ebp - 0x114]
push eax
push 0x7018
push 0x7f57
call fcn.1003ff09
add esp, 0x14
mov dword [ebp - 0x114], 0
jmp 0x100451f2
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 3
jge 0x1004520e
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0xc78], 0
jmp 0x100451e5
cmp dword [ebp - 0x11c], 0
jl 0x10045223
mov dword [ebp - 0x598], 1
jmp 0x1004522a
and dword [ebp - 0x598], 0
push 0
lea ecx, [ebp - 0x9b0]
call fcn.10028ca7
mov ecx, dword [ebp - 0x598]
cmp ecx, dword [eax]
jge 0x1004524d
mov dword [ebp - 0x5a0], 1
jmp 0x10045254
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0xcc], eax
imul eax, dword [ebp - 0xcc], 0xfffffffa
cmp eax, 1
jl 0x10045329
mov dword [ebp - 0x71c], 1
mov dword [ebp - 0xcc], 0
jmp 0x10045293
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jl 0x10045327
mov dword [ebp - 0x714], 0
mov dword [ebp - 0x11c], 0
jmp 0x100452c3
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jg 0x10045322
mov dword [ebp - 0x1b4], 1
mov dword [ebp - 0x1b4], 0
jmp 0x100452ef
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0
jg 0x10045320
mov byte [ebp - 0x83], 0
movzx eax, byte [ebp - 0x83]
test eax, eax
je 0x10045312
push 1
call fcn.1003ffb0
pop ecx
mov eax, dword [ebp - 0x714]
mov dword [ebp - 0x71c], eax
jmp 0x100452e2
jmp 0x100452b6
jmp 0x10045286
jmp 0x10045369
mov byte [ebp - 0x84], 0
movzx eax, byte [ebp - 0x84]
test eax, eax
je 0x10045349
push 0x78ac
push 1
call fcn.1003ffea
pop ecx
pop ecx
mov byte [ebp - 0x7e], 0
movzx eax, byte [ebp - 0x7e]
test eax, eax
je 0x10045369
push 0x39d7
push 1
push 0x784f
call fcn.10040031
add esp, 0xc
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x9b0]
call fcn.10028c8b
and dword [ebp - 0x1bc], 0
jmp 0x1004538e
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0xd
jae 0x100453a7
mov eax, dword [ebp - 0x1bc]
mov byte [ebp + eax - 0x70c], 0
jmp 0x10045381
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x5c], 0
jmp 0x100453c1
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x100453d7
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x12c], 0xffffffff
jmp 0x100453ba
mov dword [ebp - 0x5c], 0
jmp 0x100453e7
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jge 0x100453fd
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xa44], 0xffffffff
jmp 0x100453e0
mov dword [ebp - 0x124], 0
jmp 0x10045416
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xfffffffa
jge 0x10045606
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x24c], 0x755261fc
mov dword [ebp - 0x68], 0
jmp 0x10045444
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x100455f6
push 2
lea ecx, [ebp - 0x9ec]
call fcn.10028c09
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0x9ec]
push eax
push 0
lea eax, [ebp - 0xb80]
push eax
call fcn.10040267
add esp, 0xc
mov eax, dword [ebp - 0x68]
cmp dword [ebp + eax*4 - 0x12c], 0
jne 0x10045490
mov dword [ebp - 0x5a8], 1
jmp 0x10045497
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp + eax*4 - 0x12c]
cmp eax, dword [ebp - 0x5a8]
jg 0x10045509
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x12c]
mov dword [ebp - 0xaf8], eax
push 1
lea ecx, [ebp - 0x9ec]
call fcn.10028ca7
cmp dword [eax], 0x5833
jle 0x100454dd
mov dword [ebp - 0x5b0], 1
jmp 0x100454e4
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x5b0]
inc eax
inc eax
je 0x100454f7
mov eax, 0x8d9ba5f2
test eax, eax
jne 0x100454fd
cmp dword [ebp - 0x68], 0
je 0x10045509
mov dword [ebp - 0x5b8], 1
jmp 0x10045510
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x24c], eax
jne 0x10045546
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x12c], 0
je 0x10045546
mov dword [ebp - 0x5c0], 1
jmp 0x1004554d
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp + eax*4 - 0x12c]
cmp dword [ebp - 0x5c0], eax
jle 0x1004556b
mov dword [ebp - 0x5c8], 1
jmp 0x10045572
and dword [ebp - 0x5c8], 0
cmp dword [ebp - 0x5c8], 0xfffffffa
jle 0x10045587
mov dword [ebp - 0x5d0], 1
jmp 0x1004558e
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x5d0], eax
jge 0x100455a5
mov dword [ebp - 0x5d8], 1
jmp 0x100455ac
and dword [ebp - 0x5d8], 0
mov eax, 0x565e
sub eax, dword [ebp - 0x5d8]
cmp eax, 7
ja 0x100455c8
mov dword [ebp - 0x5e0], 1
jmp 0x100455cf
and dword [ebp - 0x5e0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5e0]
mov dword [ebp + eax - 0xa44], ecx
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x9ec]
call fcn.10028c8b
jmp 0x1004543d
cmp dword [ebp - 0x24c], 0
je 0x10045601
jmp 0x10045606
jmp 0x10045409
push 0
push 0
lea eax, [ebp - 0xc5c]
push eax
push dword [ebp - 0x5e8]
call fcn.100465bd
add esp, 0x10
mov dword [0x1066ac30], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xc5c]
call fcn.10028b6a
mov dword [ebp - 0x844], 0x3556
mov dword [ebp - 0x840], 0x3556
mov dword [ebp - 0x83c], 0x3556
mov dword [ebp - 0x838], 0x3556
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x610], 0x6d6dbc1c
mov dword [ebp - 0x1c4], 0
jmp 0x10045685
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 3
jge 0x100456a1
mov eax, dword [ebp - 0x1c4]
mov dword [ebp + eax*4 - 0xc14], 0
jmp 0x10045678
mov dword [ebp - 0x70], 3
jmp 0x100456b1
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jl 0x10045704
mov byte [ebp - 0x80], 0
movzx eax, byte [ebp - 0x80]
test eax, eax
je 0x100456dc
push 0x758e
push 0x31d6
push 1
push 0x487c
call fcn.10040098
add esp, 0x10
mov byte [ebp - 0x82], 0
movzx eax, byte [ebp - 0x82]
test eax, eax
je 0x10045702
push 0x19b2
push 1
push 0x2617
call fcn.1004016a
add esp, 0xc
jmp 0x100456aa
mov dword [ebp - 0x70], 0x19
jmp 0x10045714
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x1b
jg 0x100458cf
mov dword [ebp - 0x938], 0xe8588d0d
mov dword [ebp - 0x934], 0xe8588d0d
mov dword [ebp - 0x930], 0xe8588d0d
mov dword [ebp - 0x92c], 0xe8588d0d
lea ecx, [ebp - 0x265]
call fcn.10008842
push eax
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0x938]
push eax
lea ecx, [ebp - 0xc44]
call fcn.10028cb6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x82c]
call fcn.10028c65
mov byte [ebp - 4], 0x1f
push 0
lea ecx, [ebp - 0x82c]
call fcn.10028ca7
and dword [eax], 0
jmp 0x100457b5
push 0
lea ecx, [ebp - 0x82c]
call fcn.10028ca7
mov dword [ebp - 0x5f0], eax
mov eax, dword [ebp - 0x5f0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x5f0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x82c]
call fcn.10028ca7
cmp dword [eax], 3
jg 0x100457e3
mov byte [ebp - 0x8c], 0
movzx eax, byte [ebp - 0x8c]
test eax, eax
je 0x100457e1
push 1
call fcn.100401fd
pop ecx
jmp 0x10045791
xor eax, eax
inc eax
je 0x10045821
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x844]
push 3
lea ecx, [ebp - 0x82c]
call fcn.10028ca7
cmp esi, dword [eax]
jg 0x10045815
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x844], 0
je 0x10045821
mov dword [ebp - 0x5f8], 1
jmp 0x10045828
and dword [ebp - 0x5f8], 0
cmp dword [ebp - 0x5f8], 0xffff
jbe 0x1004584d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x844], 0
jne 0x1004584d
and dword [ebp - 0x600], 0
jmp 0x10045857
mov dword [ebp - 0x600], 1
cmp dword [ebp - 0x600], 0
jl 0x1004586c
mov dword [ebp - 0x608], 1
jmp 0x10045873
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x608]
inc eax
mov dword [ebp - 0x610], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x844]
cmp dword [ebp - 0x610], eax
jg 0x100458a1
mov dword [ebp - 0x618], 1
jmp 0x100458a8
and dword [ebp - 0x618], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x618]
mov dword [ebp + eax - 0xc14], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x82c]
call fcn.10028c8b
jmp 0x1004570d
cmp dword [0x1066ac30], 0
je 0x100458ed
mov ecx, dword [ebp + 8]
call fcn.10047ae5
push eax
call dword [0x1066ac30]
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
je 0x1004593f
movzx eax, byte [0x1066ac2c]
test eax, eax
je 0x10045912
mov ecx, 0x1066ad40
call fcn.10047be6
movzx eax, al
test eax, eax
jne 0x1004593f
lea eax, [ebp - 0x620]
push eax
mov ecx, 0x1066ad40
call fcn.10047b75
mov ecx, dword [ebp - 0xd4]
mov dword [eax], ecx
push 0x1066ac2c
push 0x7dda
push 1
call fcn.1004022a
add esp, 0xc
mov dword [ebp - 0x44], 8
mov dword [ebp - 0x724], 0xffffffff
mov dword [ebp - 0x648], 0x5f7626a9
mov dword [ebp - 0xbd8], 1
mov dword [ebp - 0x44], 0
jmp 0x10045974
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x17
jg 0x10045b16
mov dword [ebp - 0x250], 1
mov dword [ebp - 0x1d4], 0xfffffffc
mov dword [ebp - 0x72c], 0
mov dword [ebp - 0x734], 0xfffffffa
mov dword [ebp - 0x1cc], 0
jmp 0x100459bf
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 3
jge 0x100459db
mov eax, dword [ebp - 0x1cc]
mov dword [ebp + eax*4 - 0xc08], 0x3d3b0cf5
jmp 0x100459b2
cmp dword [ebp - 0x250], 0
je 0x10045a7b
cmp dword [ebp - 0x250], 0
je 0x10045a00
cmp dword [ebp - 0x250], 0
je 0x10045a00
cmp dword [ebp - 0x44], 0
jne 0x10045a0f
cmp dword [ebp - 0x44], 0
jne 0x10045a0f
and dword [ebp - 0x628], 0
jmp 0x10045a19
mov dword [ebp - 0x628], 1
mov eax, dword [ebp - 0x1d4]
cmp dword [ebp - 0x628], eax
jge 0x10045a33
mov dword [ebp - 0x630], 1
jmp 0x10045a3a
and dword [ebp - 0x630], 0
cmp dword [ebp - 0x630], 0xdc41
jl 0x10045a52
mov dword [ebp - 0x258], 1
jmp 0x10045a59
and dword [ebp - 0x258], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x258]
mov dword [ebp + eax - 0xc08], ecx
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x258]
add eax, dword [ebp - 0x1d4]
imul eax, dword [ebp - 0x1d4], 0xfff7
test eax, eax
je 0x10045a9e
cmp dword [ebp - 0x724], 0
je 0x10045a9e
mov dword [ebp - 0x638], 1
jmp 0x10045aa5
and dword [ebp - 0x638], 0
cmp dword [ebp - 0x638], 0x2b3b7bed
jge 0x10045abd
mov dword [ebp - 0x640], 1
jmp 0x10045ac4
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x640]
mov dword [ebp - 0x648], eax
mov eax, dword [ebp - 0x72c]
cmp dword [ebp - 0x648], eax
jg 0x10045af0
mov eax, 0xf5a2
test eax, eax
jne 0x10045af0
and dword [ebp - 0x650], 0
jmp 0x10045afa
mov dword [ebp - 0x650], 1
mov eax, dword [ebp - 0x650]
add eax, 0x1c1d99ea
sub eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x734], eax
jmp 0x1004596d
mov dword [ebp - 0x44], 8
jmp 0x10045b26
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xffffffe8
jge 0x10045b6e
mov dword [ebp - 0x73c], 0xf30385d0
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x10045b5c
push 0x6417
push 1
push 0x6c1f
call fcn.10040267
add esp, 0xc
push 1
lea eax, [ebp - 0x73c]
push eax
call fcn.10040315
pop ecx
pop ecx
jmp 0x10045b1f
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x744], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9d4]
call fcn.10047aa9
mov eax, dword [ebp - 0x744]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret