Function at 0x100277f5
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064756
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x3b74
call fcn.1005f560
push esi
push edi
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1002c47f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x698], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x750], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6a0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x740], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x75c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x748], eax
mov eax, dword [ebp - 0x75c]
movzx eax, byte [eax]
test eax, eax
je 0x100278b4
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp - 0x6a0]
mov dword [ebp - 0x6b0], eax
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x6c0], eax
mov eax, dword [ebp - 0x6b0]
mov dword [ebp - 0x6b8], eax
mov eax, dword [ebp - 0x6b8]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x6c0]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [ecx + 4], eax
jmp 0x1002c47d
mov eax, dword [ebp - 0x740]
mov dword [ebp - 0x688], eax
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x750]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x254], 1
mov dword [ebp - 0x24c], 1
mov dword [ebp - 0x100], 0xea0e
mov dword [ebp - 0x25c], 0x8d
mov dword [ebp - 0x290], 0xbf4a3ca5
mov dword [ebp - 0x1d4], 0
jmp 0x1002792a
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 2
jge 0x10027946
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0x1dc], 0xfffffffd
jmp 0x1002791d
mov dword [ebp - 0x2c], 0
jmp 0x10027956
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jg 0x10027dc8
mov dword [ebp - 0x2a8], 0xffffffff
mov dword [ebp - 0x598], 1
mov dword [ebp - 0x104], 0xcfcb8f1f
mov dword [ebp - 0x19c], 0xfffffff7
mov dword [ebp - 0x37c], 1
mov dword [ebp - 0x690], 0xf34fa629
push 4
lea ecx, [ebp - 0x854]
call fcn.1000d8e5
and dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x854]
push eax
push 0x711e
push 0xb9a
push 0x3cb7
push 0xe12
push 0
push 0x1afc
push 1
push 0x232c
push 0x5b89
lea eax, [ebp - 0x94c]
push eax
call fcn.10024aa7
add esp, 0x30
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x950], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x1dc]
mov dword [ebp - 0xa0c], eax
mov eax, dword [ebp - 0x25c]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x1dc]
mov ecx, dword [ebp - 0x19c]
lea eax, [eax + ecx - 0x44a3e12b]
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0xffffffff
jae 0x10027a43
mov dword [ebp - 0x558], 1
jmp 0x10027a4a
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0x558]
jle 0x10027a64
mov dword [ebp - 0x560], 1
jmp 0x10027a6b
and dword [ebp - 0x560], 0
cmp dword [ebp - 0x560], 0
je 0x10027a84
xor eax, eax
je 0x10027a84
mov dword [ebp - 0x568], 1
jmp 0x10027a8b
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x568]
neg eax
mov ecx, dword [ebp - 0x104]
lea eax, [eax + ecx + 1]
cmp eax, 0xffffffff
je 0x10027aae
mov dword [ebp - 0x570], 1
jmp 0x10027ab5
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x570]
sub eax, dword [ebp - 0x24c]
mov ecx, dword [ebp - 0x2c]
sub eax, dword [ebp + ecx*4 - 0x1dc]
mov dword [ebp - 0x598], eax
cmp dword [ebp - 0x598], 4
jbe 0x10027ae6
mov dword [ebp - 0x758], 1
jmp 0x10027aed
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x958], eax
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x19c], eax
jle 0x10027b1d
mov dword [ebp - 0x760], 1
jmp 0x10027b24
and dword [ebp - 0x760], 0
mov dword [ebp - 0x19c], 0xffff
cmp dword [ebp - 0x19c], 0xc438
jne 0x10027b46
mov dword [ebp - 0x550], 1
jmp 0x10027b4d
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0x550], eax
jg 0x10027b67
mov dword [ebp - 0x278], 1
jmp 0x10027b6e
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x254], eax
push 0xfffffffffffffff8
pop eax
neg eax
sub eax, dword [ebp - 0x104]
jne 0x10027b97
push 2
pop eax
test eax, eax
jne 0x10027b97
and dword [ebp - 0x768], 0
jmp 0x10027ba1
mov dword [ebp - 0x768], 1
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x9d0], eax
cmp dword [ebp - 0x24c], 3
jg 0x10027bc2
mov dword [ebp - 0x408], 1
jmp 0x10027bc9
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x690]
cmp dword [ebp - 0x408], eax
jge 0x10027be3
mov dword [ebp - 0x280], 1
jmp 0x10027bea
and dword [ebp - 0x280], 0
cmp dword [ebp - 0x280], 0x64e38b13
jg 0x10027c02
mov dword [ebp - 0x4d0], 1
jmp 0x10027c09
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x1dc]
cmp dword [ebp - 0x4d0], eax
jle 0x10027c27
mov dword [ebp - 0x288], 1
jmp 0x10027c2e
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x24c]
cmp dword [ebp - 0x288], eax
jg 0x10027c48
mov dword [ebp - 0x5d4], 1
jmp 0x10027c4f
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x1dc]
mov dword [ebp - 0x960], eax
cmp dword [ebp - 0x100], 0
jne 0x10027c7a
cmp dword [ebp - 0x254], 0
jne 0x10027c7a
and dword [ebp - 0x410], 0
jmp 0x10027c84
mov dword [ebp - 0x410], 1
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0x104], eax
jl 0x10027caa
mov dword [ebp - 0x540], 1
jmp 0x10027cb1
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x540]
add ecx, 6
cmp dword [ebp + eax*4 - 0x1dc], ecx
jl 0x10027cd2
mov dword [ebp - 0x298], 1
jmp 0x10027cd9
and dword [ebp - 0x298], 0
cmp dword [ebp - 0x298], 0xffffffff
jne 0x10027cee
mov dword [ebp - 0x6f4], 1
jmp 0x10027cf5
and dword [ebp - 0x6f4], 0
cmp dword [ebp - 0x100], 0
je 0x10027d11
push 5
pop eax
test eax, eax
je 0x10027d11
mov dword [ebp - 0x418], 1
jmp 0x10027d18
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x418]
sub eax, 8
cmp eax, 0x71e8ee62
jl 0x10027d34
mov dword [ebp - 0x2a0], 1
jmp 0x10027d3b
and dword [ebp - 0x2a0], 0
cmp dword [ebp - 0x2a0], 0x10d52c88
je 0x10027d53
mov dword [ebp - 0x4d8], 1
jmp 0x10027d5a
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x4d8]
sub ecx, dword [ebp + eax*4 - 0x1dc]
mov eax, dword [ebp - 0x2c]
cmp ecx, dword [ebp + eax*4 - 0x1dc]
jle 0x10027d82
mov dword [ebp - 0x420], 1
jmp 0x10027d89
and dword [ebp - 0x420], 0
mov dword [ebp - 0x2a8], 7
mov esi, dword [ebp - 0x2a8]
sub esi, dword [ebp - 0x420]
add esi, dword [ebp - 0x25c]
push 2
lea ecx, [ebp - 0x854]
call fcn.1000d926
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x854]
call fcn.1000d921
jmp 0x1002794f
push 2
lea ecx, [ebp - 0x778]
call fcn.1000d8e5
mov dword [ebp - 4], 1
mov dword [ebp - 0xa28], 0xf680
mov dword [ebp - 0x40], 0
jmp 0x10027df6
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x10027e0f
push dword [ebp - 0x40]
lea ecx, [ebp - 0x778]
call fcn.1000d926
and dword [eax], 0
jmp 0x10027def
mov dword [ebp - 0x40], 0
jmp 0x10027e1f
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x10027e35
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0xa74], 0xf1dbeccc
jmp 0x10027e18
push 0
lea ecx, [ebp - 0x778]
call fcn.1000d926
mov dword [eax], 0xfffffff0
jmp 0x10027e6e
push 0
lea ecx, [ebp - 0x778]
call fcn.1000d926
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x2b0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x2b0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x778]
call fcn.1000d926
cmp dword [eax], 0xffffffe3
jg 0x10027ef9
mov dword [ebp - 0x118], 0xffffffff
mov dword [ebp - 0x118], 1
jmp 0x10027ea3
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jl 0x10027ef4
mov dword [ebp - 0x1a4], 0
jmp 0x10027ec5
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 3
jge 0x10027ee1
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0xa54], 0xffffffff
jmp 0x10027eb8
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xa54], 1
jmp 0x10027e96
jmp 0x10027e4a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x778]
call fcn.1000d921
mov dword [ebp - 0x80], 0xffffffff
push 4
lea ecx, [ebp - 0x860]
call fcn.1000d8e5
mov dword [ebp - 4], 2
push 0x5204
push 0x4859
push 0x3e4c
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x968]
push eax
push 0
push 1
call fcn.100200fa
add esp, 0x1c
push 2
lea ecx, [ebp - 0x860]
call fcn.1000d926
mov dword [ebp - 0x580], eax
mov eax, dword [ebp - 0x580]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x580]
mov dword [ecx], eax
mov byte [ebp - 0x8b], 0
movzx eax, byte [ebp - 0x8b]
test eax, eax
je 0x10027fae
push 0x12a2
push 0x17f4
push 0x2849
push 0x1703
push 0
push 1
push 0
push 0x2171
push 0x185f
call fcn.100244f5
add esp, 0x24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x860]
call fcn.1000d921
mov dword [ebp - 0x9e0], 0
mov dword [ebp - 0x7b8], 0xf5ed9a92
mov dword [ebp - 0x6e0], 1
mov dword [ebp - 0x5dc], 0x1bc4
cmp dword [ebp - 0x5dc], 0xd6a
jge 0x100281a3
xorpd xmm0, xmm0
movlpd qword [ebp - 0x188], xmm0
lea eax, [ebp - 0x188]
push eax
push 0x100087cc
call fcn.1004a47b
pop ecx
pop ecx
push dword [ebp - 0x184]
push dword [ebp - 0x188]
call fcn.100382ac
pop ecx
pop ecx
subsd xmm0, qword [0x10008900]
call fcn.10063a1f
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], edx
cmp dword [ebp - 0x264], 0
jg 0x10028065
jl 0x10028054
cmp dword [ebp - 0x268], 1
jae 0x10028065
mov dword [ebp - 0x268], 1
and dword [ebp - 0x264], 0
push dword [ebp - 0x184]
push dword [ebp - 0x188]
call fcn.100382ac
pop ecx
pop ecx
call fcn.10063a1f
mov dword [ebp - 0x6cc], eax
mov dword [ebp - 0x6c8], edx
or dword [ebp - 0x57c], 0xffffffff
or dword [ebp - 0x578], 0xffffffff
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x60], eax
jmp 0x100280bd
mov eax, dword [ebp - 0x64]
add eax, 1
mov ecx, dword [ebp - 0x60]
adc ecx, 0
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], ecx
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x6c8]
jg 0x1002818a
jl 0x100280dd
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x6cc]
ja 0x1002818a
push dword [ebp - 0x60]
push dword [ebp - 0x64]
push dword [ebp - 0x184]
push dword [ebp - 0x188]
call fcn.10063760
mov dword [ebp - 0x700], eax
mov dword [ebp - 0x6fc], edx
mov eax, dword [ebp - 0x700]
or eax, dword [ebp - 0x6fc]
jne 0x10028185
push dword [ebp - 0x60]
push dword [ebp - 0x64]
call fcn.100277a1
pop ecx
pop ecx
cdq
mov esi, eax
mov edi, edx
push dword [ebp - 0x60]
push dword [ebp - 0x64]
push dword [ebp - 0x184]
push dword [ebp - 0x188]
call fcn.100636b0
sub eax, dword [ebp - 0x64]
sbb edx, dword [ebp - 0x60]
mov dword [ebp - 0x70c], esi
mov dword [ebp - 0x708], edi
mov dword [ebp - 0x718], eax
mov dword [ebp - 0x714], edx
mov eax, dword [ebp - 0x70c]
cmp eax, dword [ebp - 0x718]
jne 0x10028185
mov eax, dword [ebp - 0x708]
cmp eax, dword [ebp - 0x714]
jne 0x10028185
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x57c], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x578], eax
jmp 0x1002818a
jmp 0x100280ab
push dword [ebp - 0x578]
push dword [ebp - 0x57c]
push 0x100086a8
call fcn.1004a80c
add esp, 0xc
mov dword [ebp - 0x5ec], 0xf11bbb4f
mov dword [ebp - 0x5e4], 1
mov dword [ebp - 0x6d8], 1
lea eax, [ebp - 0x6d8]
push eax
lea eax, [ebp - 0x5e4]
push eax
lea eax, [ebp - 0x7b8]
push eax
push 0x295
lea eax, [ebp - 0x5ec]
push eax
push 0
lea eax, [ebp - 0x6e0]
push eax
call fcn.1002e070
add esp, 0x1c
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x1002822e
push 0x76d4
push 0x7a91
push 1
push 0x354d
push 0x48ba
push 0x73b1
push 0
push 0x5c9a
push 0x441a
call fcn.100213fa
add esp, 0x24
mov dword [ebp - 0x8c8], 0xd6525681
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1ac], 0xffffffff
mov dword [ebp - 0x2c8], 1
mov dword [ebp - 0x120], 0
jmp 0x1002826c
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jge 0x10028285
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x3c], 0xfffffffa
jmp 0x1002825f
mov dword [ebp - 0x1c], 0
jmp 0x10028295
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x100282a8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x3c], 1
jmp 0x1002828e
mov dword [ebp - 0x1c], 0
jmp 0x100282b8
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jg 0x1002849f
mov dword [ebp - 0x1e8], 3
push 2
lea ecx, [ebp - 0x7cc]
call fcn.1000d8e5
mov dword [ebp - 4], 3
push 0x2512
lea eax, [ebp - 0x7cc]
push eax
push 0
lea eax, [ebp - 0x8cc]
push eax
push 0x7c2c
push 0x3451
push 0
call fcn.10023e67
add esp, 0x1c
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x3c], 0
jl 0x1002831f
mov dword [ebp - 0x428], 1
jmp 0x10028326
and dword [ebp - 0x428], 0
cmp dword [ebp - 0x1c], 0
je 0x1002835f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3c], 0
je 0x1002833d
cmp dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x3c]
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0
je 0x1002835f
mov dword [ebp - 0x2b8], 1
jmp 0x10028366
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x3c]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1ac]
sub eax, dword [ebp - 0x2b8]
imul eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0x1c]
cmp eax, dword [ebp + ecx*4 - 0x3c]
jne 0x1002839b
mov dword [ebp - 0x2c0], 1
jmp 0x100283a2
and dword [ebp - 0x2c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
cmp dword [ebp - 0x2c0], eax
jl 0x100283c6
mov eax, 0xf5fa3187
test eax, eax
jne 0x100283c6
and dword [ebp - 0x4e0], 0
jmp 0x100283d0
mov dword [ebp - 0x4e0], 1
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0xffff
je 0x100283f4
mov dword [ebp - 0x430], 1
jmp 0x100283fb
and dword [ebp - 0x430], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp - 0x430]
sub esi, dword [ebp + eax - 0x3c]
push 1
lea ecx, [ebp - 0x7cc]
call fcn.1000d926
mov dword [eax], esi
cmp dword [ebp - 0x1ac], 0
je 0x10028467
or eax, 0xffffffff
je 0x10028446
push 1
lea ecx, [ebp - 0x7cc]
call fcn.1000d926
cmp dword [eax], 0
je 0x10028446
mov dword [ebp - 0x2d0], 1
jmp 0x1002844d
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x1e8]
sub eax, dword [ebp - 0x2d0]
je 0x10028467
mov dword [ebp - 0x5f4], 1
jmp 0x1002846e
and dword [ebp - 0x5f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3c]
mov dword [ebp - 0x8d4], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x3c]
mov dword [ebp - 0x1ac], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7cc]
call fcn.1000d921
jmp 0x100282b1
mov dword [ebp - 0x8b8], 0xa9b27fa
push 3
lea ecx, [ebp - 0x884]
call fcn.1000d8e5
mov dword [ebp - 4], 4
mov dword [ebp - 0x10c], 0xb457102d
mov dword [ebp - 0x614], 0xadd5d088
mov dword [ebp - 0x60c], 0xffffffff
mov dword [ebp - 0x5c8], 0xdf2ab2bc
mov dword [ebp - 0x5fc], 0xe99b96bc
push 0x4eb5
push 0x6d03
push 1
push 1
push 0x3705
lea eax, [ebp - 0x8f4]
push eax
push 0x3f5c
lea eax, [ebp - 0x884]
push eax
call fcn.100191c9
add esp, 0x20
mov dword [ebp - 0x10c], 0
jmp 0x10028536
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 2
jg 0x100286fe
push 1
lea ecx, [ebp - 0x5b8]
call fcn.1000d8e5
mov byte [ebp - 4], 5
mov dword [ebp - 0x7ac], 0x4b38b4b7
mov dword [ebp - 0x6f0], 0xcd53
push 0
lea eax, [ebp - 0x8fc]
push eax
lea eax, [ebp - 0x5b8]
push eax
call fcn.10031932
add esp, 0xc
mov byte [ebp - 0xa6], 0
movzx eax, byte [ebp - 0xa6]
test eax, eax
je 0x100285a8
push 0xeec
push 0
push 0x7c2
push 1
call fcn.1001f261
add esp, 0x10
push 0
lea ecx, [ebp - 0x5b8]
call fcn.1000d926
mov dword [eax], 2
jmp 0x100285e1
push 0
lea ecx, [ebp - 0x5b8]
call fcn.1000d926
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x544]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x544]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x5b8]
call fcn.1000d926
cmp dword [eax], 0
jl 0x100286ea
mov dword [ebp - 0x604], 0xfffffffb
mov dword [ebp - 0x6e8], 0
push 3
lea ecx, [ebp - 0x890]
call fcn.1000d8e5
mov byte [ebp - 4], 6
mov dword [ebp - 0x1b4], 0
jmp 0x10028635
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 3
jge 0x10028654
push dword [ebp - 0x1b4]
lea ecx, [ebp - 0x890]
call fcn.1000d926
or dword [eax], 0xffffffff
jmp 0x10028628
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x10028678
push 1
push 1
push 0x264
push 0
push 0xb1
call fcn.1001ef2e
add esp, 0x14
lea eax, [ebp - 0x5c8]
push eax
lea eax, [ebp - 0x5fc]
push eax
lea eax, [ebp - 0x6e8]
push eax
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x7ac]
push eax
lea eax, [ebp - 0x60c]
push eax
lea eax, [ebp - 0x5b8]
push eax
push 1
lea eax, [ebp - 0x6f0]
push eax
push 0x68c
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x884]
push eax
push 0
lea eax, [ebp - 0x890]
push eax
call fcn.10024e53
add esp, 0x38
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x890]
call fcn.1000d921
jmp 0x100285bd
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x5b8]
call fcn.1000d921
jmp 0x10028529
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x884]
call fcn.1000d921
mov dword [ebp - 0x904], 0x3fe6966e
mov dword [ebp - 0x90c], 7
mov dword [ebp - 0x438], 0x66bafcb1
mov dword [ebp - 0x180], 0xaad8530d
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x108], 1
mov dword [ebp - 0x914], 8
mov dword [ebp - 0x130], 0
jmp 0x1002876c
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jge 0x10028788
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x724], 0xf687
jmp 0x1002875f
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x228]
push eax
push 0x61e8
push 1
push 0
push 1
lea eax, [ebp - 0x438]
push eax
push 0x28b
call fcn.100244f5
add esp, 0x24
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x91c], eax
cmp dword [ebp - 0x108], 0
je 0x100287e6
cmp dword [ebp - 0x180], 0
je 0x100287e6
mov dword [ebp - 0x2d8], 1
jmp 0x100287ed
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x228]
cmp dword [ebp - 0x2d8], eax
jne 0x10028807
mov dword [ebp - 0x764], 1
jmp 0x1002880e
and dword [ebp - 0x764], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x724]
mov dword [ebp - 0x924], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x438]
cmp dword [ebp + eax - 0x724], ecx
jge 0x10028842
mov dword [ebp - 0x61c], 1
jmp 0x10028849
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x92c], eax
push 9
pop eax
test eax, eax
jl 0x10028868
mov dword [ebp - 0x6f8], 1
jmp 0x1002886f
and dword [ebp - 0x6f8], 0
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x934], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x724], 0xfffffffe
jne 0x10028897
mov dword [ebp - 0x2e0], 1
jmp 0x1002889e
and dword [ebp - 0x2e0], 0
cmp dword [ebp - 0x2e0], 0
jg 0x100288b3
mov dword [ebp - 0x4e8], 1
jmp 0x100288ba
and dword [ebp - 0x4e8], 0
cmp dword [ebp - 0x4e8], 0xdd2a
jl 0x100288d2
mov dword [ebp - 0x2e8], 1
jmp 0x100288d9
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x93c], 0xdd2e91c8
mov dword [ebp - 0x30], 0x39ba095a
mov dword [ebp - 0xf4], 0xfffffff7
mov dword [ebp - 0x1f0], 0x1eb64d07
mov dword [ebp - 0x248], 0xfff6
mov dword [ebp - 0x30], 0xffffffff
cmp dword [ebp - 0x30], 0xfffffff8
jne 0x1002898e
mov eax, dword [ebp - 0x30]
sub eax, 0x6febfb2c
imul eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x10028950
mov eax, 0xfffd
test eax, eax
jne 0x10028950
and dword [ebp - 0x440], 0
jmp 0x1002895a
mov dword [ebp - 0x440], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x440], eax
jle 0x10028971
mov dword [ebp - 0x2f0], 1
jmp 0x10028978
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0xf4], eax
imul eax, dword [ebp - 0xf4], 0xbe85
cmp dword [ebp - 0xf4], 8
jl 0x100289a3
mov dword [ebp - 0x56c], 1
jmp 0x100289aa
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0x56c], eax
jg 0x100289c4
mov dword [ebp - 0x624], 1
jmp 0x100289cb
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x248]
mov dword [ebp - 0x944], eax
cmp dword [ebp - 0x248], 0x3a60
jl 0x100289ef
mov dword [ebp - 0x2f8], 1
jmp 0x100289f6
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x1f0], eax
mov dword [ebp - 0x30], 0x15
jmp 0x10028a12
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffff1
jl 0x10028b9e
mov dword [ebp - 0x94], 0xbf748bbe
mov dword [ebp - 0x138], 0xfda6c2e3
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x94]
push eax
push 0xc12
push 0x66c5
push 0x37ce
push 0
push 1
call fcn.10021826
add esp, 0x1c
cmp dword [ebp - 0xf4], 0
je 0x10028b84
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x8b4], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x94], eax
jne 0x10028a89
mov dword [ebp - 0x448], 1
jmp 0x10028a90
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x94]
add eax, dword [ebp - 0x448]
cmp eax, dword [ebp - 0x94]
jge 0x10028ab0
mov dword [ebp - 0x300], 1
jmp 0x10028ab7
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
add eax, 0x5ff74f57
sub eax, dword [ebp - 0x94]
cmp eax, dword [ebp - 0x94]
jl 0x10028ae8
mov dword [ebp - 0x4f0], 1
jmp 0x10028aef
and dword [ebp - 0x4f0], 0
cmp dword [ebp - 0x4f0], 0xfbdedbec
jne 0x10028b10
cmp dword [ebp - 0x94], 0
je 0x10028b10
mov dword [ebp - 0x308], 1
jmp 0x10028b17
and dword [ebp - 0x308], 0
cmp dword [ebp - 0x1f0], 0
je 0x10028b84
mov dword [ebp - 0x7c0], 0xb4499c77
cmp dword [ebp - 0x248], 0xffff
jb 0x10028b42
mov dword [ebp - 0x450], 1
jmp 0x10028b49
and dword [ebp - 0x450], 0
cmp dword [ebp - 0x450], 0xec6c0484
jae 0x10028b61
mov dword [ebp - 0x310], 1
jmp 0x10028b68
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x7c0], eax
cmp dword [ebp - 0x138], 0
je 0x10028b82
jmp 0x10028a0b
jmp 0x10028b99
mov dword [ebp - 0x62c], 0xffff
cmp dword [ebp - 0x62c], 0
je 0x10028b99
jmp 0x10028b9e
jmp 0x10028a0b
mov dword [ebp - 0x954], 1
mov dword [ebp - 0x1b0], 0
jmp 0x10028bc1
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 3
jge 0x10028bdd
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0x788], 0xfffffff8
jmp 0x10028bb4
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x788], 0xffffffe3
jmp 0x10028c0b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x788]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x788], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x788], 0x15
jg 0x10028d7f
mov dword [ebp - 0x704], 0x1cab
cmp dword [ebp - 0x704], 0x722
jge 0x10028d26
lea eax, [ebp - 0x190]
push eax
mov ecx, 0x10654250
call fcn.10017fa7
push dword [ebp - 0x190]
mov ecx, 0x11134d84
call fcn.10018276
and dword [ebp - 0x140], 0
jmp 0x10028c70
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
cmp eax, dword [ebp - 0x190]
jge 0x10028c9b
push dword [ebp - 0x140]
mov ecx, 0x11134d84
call fcn.1000d926
push eax
mov ecx, 0x10654250
call fcn.10017fa7
jmp 0x10028c63
or dword [ebp - 0x1f8], 0xffffffff
and dword [ebp - 0x9c], 0
jmp 0x10028cb8
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x190]
jge 0x10028d0a
mov eax, dword [ebp - 0x9c]
inc eax
inc eax
cmp eax, dword [ebp - 0x190]
jge 0x10028cfb
mov eax, dword [ebp - 0x9c]
inc eax
inc eax
push eax
mov ecx, 0x11134d84
call fcn.1000d926
cmp dword [eax], 0
jne 0x10028cfb
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
jmp 0x10028cab
push fcn.10011fcc
push dword [ebp - 0x1f8]
mov ecx, 0x10654198
call fcn.100180e7
mov ecx, eax
call fcn.1000d598
mov dword [ebp - 0x148], 0
jmp 0x10028d3f
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 3
jge 0x10028d5b
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0xa6c], 0xccb0
jmp 0x10028d32
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x788]
add eax, 0x4e76e088
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xa6c], eax
jmp 0x10028bf0
mov byte [ebp - 0xa8], 0
movzx eax, byte [ebp - 0xa8]
test eax, eax
je 0x10028d99
push 0
call fcn.10031275
pop ecx
mov dword [ebp - 0x95c], 0xfffffff6
mov dword [ebp - 0x964], 8
mov dword [ebp - 0x96c], 0x42c70bb7
mov dword [ebp - 0x974], 0xbc75286e
mov dword [ebp - 0x97c], 0x6ff55e00
mov dword [ebp - 0x984], 7
mov dword [ebp - 0x98c], 6
mov dword [ebp - 0x994], 0xf1fdbd01
mov dword [ebp - 0x99c], 0xde9ab5c2
mov dword [ebp - 0xa08], 7
mov dword [ebp - 0x54c], 0xffffffff
mov dword [ebp - 0x318], 1
mov dword [ebp - 0x1d0], 0
jmp 0x10028e2a
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 3
jge 0x10028e46
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0xaac], 1
jmp 0x10028e1d
mov eax, dword [ebp - 0x54c]
dec eax
mov dword [ebp - 0x54c], eax
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
mov dword [ebp - 0xa10], 0
mov dword [ebp - 0xe4], 0xa5043c4a
mov dword [ebp - 0x200], 6
mov dword [ebp - 0x848], 0x703d9b95
mov dword [ebp - 0x844], 0x703d9b95
mov dword [ebp - 0x840], 0x703d9b95
mov dword [ebp - 0x83c], 0x703d9b95
lea ecx, [ebp - 0x241]
call fcn.1000e4ba
push eax
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x848]
push eax
lea ecx, [ebp - 0xa84]
call fcn.1003765d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7e4]
call fcn.10037555
mov dword [ebp - 4], 7
mov dword [ebp - 0x198], 0x6b3b
mov dword [ebp - 0x150], 0
jmp 0x10028f05
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jge 0x10028f21
mov eax, dword [ebp - 0x150]
mov dword [ebp + eax*4 - 0x594], 1
jmp 0x10028ef8
mov dword [ebp - 0xe4], 0x3992
cmp dword [ebp - 0xe4], 0
jne 0x10028fa6
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x634], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x594]
mov dword [ebp - 0x76c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x594]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x594], eax
mov eax, dword [ebp - 0x634]
cmp eax, dword [ebp - 0x76c]
je 0x10028f88
mov dword [ebp - 0x458], 1
jmp 0x10028f8f
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0xe4]
cmp eax, dword [ebp - 0x458]
jg 0x10028fa6
and dword [ebp - 0x320], 0
jmp 0x10028fb0
mov dword [ebp - 0x320], 1
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
je 0x10028fda
cmp dword [ebp - 0x200], 0
je 0x10028fda
mov dword [ebp - 0x230], 1
jmp 0x10028fe1
and dword [ebp - 0x230], 0
push 1
lea ecx, [ebp - 0x7e4]
call fcn.1000d926
mov ecx, dword [ebp - 0x230]
mov dword [eax], ecx
cmp dword [ebp - 0x230], 0
jne 0x100290cb
cmp dword [ebp - 0x198], 1
jle 0x10029018
mov dword [ebp - 0x4f8], 1
jmp 0x1002901f
and dword [ebp - 0x4f8], 0
push 1
lea ecx, [ebp - 0x7e4]
call fcn.1000d926
mov ecx, dword [ebp - 0x4f8]
cmp ecx, dword [eax]
jle 0x10029042
mov dword [ebp - 0x328], 1
jmp 0x10029049
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x198]
add eax, dword [ebp - 0x328]
cmp eax, 0xfffffff8
jle 0x10029066
mov dword [ebp - 0x460], 1
jmp 0x1002906d
and dword [ebp - 0x460], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x594]
cmp dword [ebp - 0x460], eax
je 0x10029091
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x594], 0
je 0x100290ad
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x594], 0
je 0x100290ad
mov dword [ebp - 0x330], 1
jmp 0x100290b4
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x200]
add eax, dword [ebp - 0x330]
jne 0x100290cb
and dword [ebp - 0x584], 0
jmp 0x100290d5
mov dword [ebp - 0x584], 1
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x200], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xe4]
cmp dword [ebp + eax - 0x594], ecx
jle 0x10029102
mov dword [ebp - 0x338], 1
jmp 0x10029109
and dword [ebp - 0x338], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x594]
cmp eax, dword [ebp - 0x338]
jg 0x1002912a
mov dword [ebp - 0x468], 1
jmp 0x10029131
and dword [ebp - 0x468], 0
push 1
lea ecx, [ebp - 0x7e4]
call fcn.1000d926
mov ecx, dword [ebp - 0x468]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7e4]
call fcn.1000d921
mov dword [ebp - 0x6a4], 0xfffffff9
mov dword [ebp - 0x20], 0xb26bdde0
mov dword [ebp - 0xd8], 0xd1456b86
push 1
lea ecx, [ebp - 0x5c4]
call fcn.1000d8e5
mov dword [ebp - 4], 8
mov dword [ebp - 0x158], 0
jmp 0x1002919d
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 1
jge 0x100291bf
push dword [ebp - 0x158]
lea ecx, [ebp - 0x5c4]
call fcn.1000d926
mov dword [eax], 0x38361cd5
jmp 0x10029190
mov dword [ebp - 0x20], 0
jmp 0x100291cf
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffff2
jg 0x100298fa
mov dword [ebp - 0x34], 0xb7f37c04
mov dword [ebp - 0x50], 0x8c65
mov dword [ebp - 0x490], 1
mov dword [ebp - 0x710], 0xffffffff
mov dword [ebp - 0x71c], 0x20cfa827
mov dword [ebp - 0x14], 0
jmp 0x10029215
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x1002922b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x820], 0x7e294b5
jmp 0x1002920e
mov dword [ebp - 0x14], 0
jmp 0x1002923b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10029251
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x810], 0
jmp 0x10029234
mov dword [ebp - 0x14], 0
jmp 0x10029261
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x10029277
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x644], 0xfffffff6
jmp 0x1002925a
mov dword [ebp - 0x14], 0
jmp 0x10029287
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1002929d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x64c], 0x9bc9383a
jmp 0x10029280
cmp dword [ebp - 0x34], 0
jne 0x100294c2
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xa18], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xa20], eax
cmp dword [ebp - 0x50], 0
jne 0x100292cb
mov dword [ebp - 0x258], 1
jmp 0x100292d2
and dword [ebp - 0x258], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x258]
mov dword [ebp + eax - 0x820], ecx
cmp dword [ebp - 0x258], 0
je 0x10029300
cmp dword [ebp - 0x20], 0
je 0x10029300
mov dword [ebp - 0x340], 1
jmp 0x10029307
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x340]
sub eax, dword [ebp - 0x20]
add eax, 0x64fc41ba
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x7da19ae8
je 0x10029333
mov dword [ebp - 0x500], 1
jmp 0x1002933a
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x500]
shl eax, 2
cmp dword [ebp - 0x34], eax
jl 0x10029357
mov dword [ebp - 0x348], 1
jmp 0x1002935e
and dword [ebp - 0x348], 0
cmp dword [ebp - 0x348], 9
jne 0x10029373
mov dword [ebp - 0x470], 1
jmp 0x1002937a
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x470]
add eax, 0x3b5b0d6
neg eax
imul eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x50]
jge 0x1002939c
mov dword [ebp - 0x350], 1
jmp 0x100293a3
and dword [ebp - 0x350], 0
cmp dword [ebp - 0x350], 0x22f8dc70
jg 0x100293bb
mov dword [ebp - 0x554], 1
jmp 0x100293c2
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x554], eax
jl 0x100293d9
mov dword [ebp - 0x358], 1
jmp 0x100293e0
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x358]
sub eax, dword [ebp - 0x50]
jne 0x100293fd
mov eax, 0x83fa
test eax, eax
jne 0x100293fd
and dword [ebp - 0x478], 0
jmp 0x10029407
mov dword [ebp - 0x478], 1
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x478], eax
jg 0x1002941e
mov dword [ebp - 0x360], 1
jmp 0x10029425
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x360], eax
jle 0x1002943c
mov dword [ebp - 0x63c], 1
jmp 0x10029443
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xa14], eax
push 0
lea ecx, [ebp - 0x5c4]
call fcn.1000d926
mov dword [eax], 0xbb64
imul eax, dword [ebp - 0x34], 0xbb64
imul eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
je 0x1002947b
mov dword [ebp - 0x508], 1
jmp 0x10029482
and dword [ebp - 0x508], 0
cmp dword [ebp - 0x508], 1
jle 0x10029497
mov dword [ebp - 0x368], 1
jmp 0x1002949e
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x368], eax
jne 0x100294b9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x820], 0
jne 0x100294c2
and dword [ebp - 0x480], 0
jmp 0x100294cc
mov dword [ebp - 0x480], 1
mov eax, dword [ebp - 0x480]
neg eax
cmp eax, dword [ebp - 0x34]
jge 0x100294eb
cmp dword [ebp - 0xd8], 0
jne 0x100294eb
and dword [ebp - 0x370], 0
jmp 0x100294f5
mov dword [ebp - 0x370], 1
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x370], eax
jge 0x1002955b
mov dword [ebp - 0x34], 0
jmp 0x10029510
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x1d
jl 0x10029556
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x10029554
push 0x3565
push 0x788a
push 1
push 0x1e24
push 0
push 1
push 0x2b79
push 0x7ded
push 0x52df
call fcn.1001fd61
add esp, 0x24
jmp 0x10029509
jmp 0x100298e3
mov dword [ebp - 0xb4], 0x3585f1c2
mov dword [ebp - 0x654], 1
mov dword [ebp - 0x50], 0
jmp 0x1002957f
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xfffffffa
jne 0x100298e3
mov dword [ebp - 0x208], 0xbb11fe8b
mov dword [ebp - 0x4a8], 0xb51ecc88
push 0
lea ecx, [ebp - 0x5c4]
call fcn.1000d926
cmp dword [eax], 0xffffffff
ja 0x100295bb
mov dword [ebp - 0x574], 1
jmp 0x100295c2
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0x574]
jg 0x100295e2
cmp dword [ebp - 0xd8], 0
jne 0x100295e2
and dword [ebp - 0x378], 0
jmp 0x100295ec
mov dword [ebp - 0x378], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x810]
imul eax, dword [ebp - 0x378]
cmp eax, dword [ebp - 0x50]
jge 0x10029611
mov dword [ebp - 0x488], 1
jmp 0x10029618
and dword [ebp - 0x488], 0
push 0
lea ecx, [ebp - 0x5c4]
call fcn.1000d926
mov ecx, dword [ebp - 0x488]
cmp ecx, dword [eax]
jge 0x1002964a
push 0
lea ecx, [ebp - 0x5c4]
call fcn.1000d926
cmp dword [eax], 0
jne 0x1002964a
and dword [ebp - 0x380], 0
jmp 0x10029654
mov dword [ebp - 0x380], 1
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x208]
imul eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0xb4]
jl 0x10029681
mov dword [ebp - 0x510], 1
jmp 0x10029688
and dword [ebp - 0x510], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x820]
add eax, dword [ebp - 0x510]
je 0x100296b2
cmp dword [ebp - 0xd8], 0
je 0x100296b2
mov dword [ebp - 0x388], 1
jmp 0x100296b9
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x490], eax
cmp dword [ebp - 0x490], 0
jne 0x100296e0
cmp dword [ebp - 0x208], 0
jne 0x100296e0
and dword [ebp - 0x390], 0
jmp 0x100296ea
mov dword [ebp - 0x390], 1
cmp dword [ebp - 0x390], 0xe8e3
je 0x10029702
mov dword [ebp - 0x55c], 1
jmp 0x10029709
and dword [ebp - 0x55c], 0
cmp dword [ebp - 0x55c], 0xfffffff9
jle 0x10029729
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x810], 0
je 0x10029729
cmp dword [ebp - 0xb4], 0
cmp dword [ebp - 0xb4], 0
jg 0x1002973e
mov dword [ebp - 0x398], 1
jmp 0x10029745
and dword [ebp - 0x398], 0
cmp dword [ebp - 0x398], 1
jge 0x1002975a
mov dword [ebp - 0x498], 1
jmp 0x10029761
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x498]
sub eax, dword [ebp - 0x710]
imul eax, dword [ebp - 0xb4]
mov dword [ebp - 0x3a0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3a0]
mov dword [ebp + eax - 0x644], ecx
mov eax, dword [ebp - 0x4a8]
cmp dword [ebp - 0x3a0], eax
jg 0x100297a7
mov dword [ebp - 0x518], 1
jmp 0x100297ae
and dword [ebp - 0x518], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x820]
cmp eax, dword [ebp - 0x518]
jle 0x100297d8
mov eax, 0xe384
test eax, eax
je 0x100297d8
mov dword [ebp - 0x7b4], 1
jmp 0x100297df
and dword [ebp - 0x7b4], 0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x64c], 0x64ce
cmp dword [ebp - 0x20], 0x64ce
jne 0x10029812
cmp dword [ebp - 0x71c], 0
je 0x10029812
xor eax, eax
je 0x10029812
mov dword [ebp - 0x3a8], 1
jmp 0x10029819
and dword [ebp - 0x3a8], 0
cmp dword [ebp - 0x3a8], 0
jne 0x10029834
mov eax, 0x2bf4
test eax, eax
jne 0x10029834
and dword [ebp - 0x4a0], 0
jmp 0x1002983e
mov dword [ebp - 0x4a0], 1
cmp dword [ebp - 0x4a0], 0x1712
jne 0x10029856
mov dword [ebp - 0x3b0], 1
jmp 0x1002985d
and dword [ebp - 0x3b0], 0
cmp dword [ebp - 0x3b0], 0xfffffff6
jle 0x10029872
mov dword [ebp - 0x588], 1
jmp 0x10029879
and dword [ebp - 0x588], 0
cmp dword [ebp - 0x588], 0
jl 0x1002988e
mov dword [ebp - 0x3b8], 1
jmp 0x10029895
and dword [ebp - 0x3b8], 0
cmp dword [ebp - 0x3b8], 0xfffffffa
jae 0x100298aa
mov dword [ebp - 0x3c0], 1
jmp 0x100298b1
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x4a8]
cmp dword [ebp - 0x3c0], eax
jle 0x100298cb
mov dword [ebp - 0x520], 1
jmp 0x100298d2
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x654], eax
jmp 0x10029578
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x820], 0
je 0x100298f5
jmp 0x100298fa
jmp 0x100291c8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c4]
call fcn.1000d921
mov dword [ebp - 0x970], 3
mov dword [ebp - 0x1b8], 0xa8eac8b1
mov byte [ebp - 0xaa], 0
movzx eax, byte [ebp - 0xaa]
test eax, eax
je 0x10029940
push 0x2c23
push 1
push 0
call fcn.1002044b
add esp, 0xc
mov dword [ebp - 0x1b8], 0
jmp 0x10029959
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0xfffffff0
jle 0x100299ff
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x160], 0
jmp 0x10029989
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 3
jge 0x100299a5
mov eax, dword [ebp - 0x160]
mov dword [ebp + eax*4 - 0xaa0], 0xe77d
jmp 0x1002997c
mov dword [ebp - 0x1a0], 2
jmp 0x100299be
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
jl 0x100299fa
push 1
push 0x7e7b
push 0x5848
push 1
push 0x247c
push 0x6abd
push 0x4b2f
push 0
push 0x1350
push 0x75ed
call fcn.1002528e
add esp, 0x28
jmp 0x100299b1
jmp 0x1002994c
mov dword [ebp - 0x754], 5
mov dword [ebp - 0x8dc], 7
push 1
lea ecx, [ebp - 0xd4]
call fcn.1000d8e5
mov dword [ebp - 4], 9
mov dword [ebp - 0xc4], 1
mov dword [ebp - 0x238], 0xffffffff
mov dword [ebp - 0xec], 0x2dd8607f
mov dword [ebp - 0xc8], 3
lea eax, [ebp - 0xd4]
push eax
push 0
lea eax, [ebp - 0x8c4]
push eax
call fcn.10030dc0
add esp, 0xc
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x10029abc
push 0x7799
push 0x53cd
push 0
push 0
push 0x4187
push 0x294c
push 0x5375
push 0x75d7
push 0x2e5c
push 0x4baf
push 0x15f5
push 0x78e8
push 0x387b
call fcn.100253ed
add esp, 0x34
push 0
lea ecx, [ebp - 0xd4]
call fcn.1000d926
push 0
lea ecx, [ebp - 0xd4]
call fcn.1000d926
push 0
lea ecx, [ebp - 0xd4]
call fcn.1000d926
cmp dword [eax], 0
je 0x10029b06
push 0
lea ecx, [ebp - 0xd4]
call fcn.1000d926
cmp dword [eax], 0
je 0x10029b06
mov dword [ebp - 0x3c8], 1
jmp 0x10029b0d
and dword [ebp - 0x3c8], 0
push 0
lea ecx, [ebp - 0xd4]
call fcn.1000d926
mov ecx, dword [ebp - 0x3c8]
cmp ecx, dword [eax]
jg 0x10029b30
mov dword [ebp - 0x4b0], 1
jmp 0x10029b37
and dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x4b0], 0xffffffff
jl 0x10029b4c
mov dword [ebp - 0x3d0], 1
jmp 0x10029b53
and dword [ebp - 0x3d0], 0
push 0
lea ecx, [ebp - 0xd4]
call fcn.1000d926
mov ecx, dword [ebp - 0x3d0]
cmp ecx, dword [eax]
jge 0x10029b76
mov dword [ebp - 0x564], 1
jmp 0x10029b7d
and dword [ebp - 0x564], 0
push 0
lea ecx, [ebp - 0xd4]
call fcn.1000d926
mov ecx, dword [ebp - 0x564]
cmp ecx, dword [eax]
jge 0x10029baf
push 0
lea ecx, [ebp - 0xd4]
call fcn.1000d926
cmp dword [eax], 0
jne 0x10029baf
and dword [ebp - 0x3d8], 0
jmp 0x10029bb9
mov dword [ebp - 0x3d8], 1
mov eax, dword [ebp - 0x3d8]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x5cd1d2a6
je 0x10029bdd
mov dword [ebp - 0x4b8], 1
jmp 0x10029be4
and dword [ebp - 0x4b8], 0
push 0
lea ecx, [ebp - 0xd4]
call fcn.1000d926
mov ecx, dword [ebp - 0x4b8]
cmp ecx, dword [eax]
jge 0x10029c07
mov dword [ebp - 0x77c], 1
jmp 0x10029c0e
and dword [ebp - 0x77c], 0
push 0
lea ecx, [ebp - 0xd4]
call fcn.1000d926
imul eax, dword [eax], 0xbc25
cmp eax, 0xffffffff
jge 0x10029c44
push 0
lea ecx, [ebp - 0xd4]
call fcn.1000d926
cmp dword [eax], 0
je 0x10029c44
mov dword [ebp - 0x3e0], 1
jmp 0x10029c4b
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x238], eax
mov esi, dword [ebp - 0x238]
push 0
lea ecx, [ebp - 0xd4]
call fcn.1000d926
cmp esi, dword [eax]
jg 0x10029c7a
mov dword [ebp - 0x528], 1
jmp 0x10029c81
and dword [ebp - 0x528], 0
push 0
lea ecx, [ebp - 0xd4]
call fcn.1000d926
mov ecx, dword [ebp - 0x528]
cmp ecx, dword [eax]
jne 0x10029ca4
mov dword [ebp - 0x65c], 1
jmp 0x10029cab
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x8e4], eax
cmp dword [ebp - 0x238], 0
jne 0x10029cdb
push 0
lea ecx, [ebp - 0xd4]
call fcn.1000d926
cmp dword [eax], 0
jne 0x10029cdb
and dword [ebp - 0x3e8], 0
jmp 0x10029ce5
mov dword [ebp - 0x3e8], 1
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 1
jle 0x10029d06
mov dword [ebp - 0x728], 1
jmp 0x10029d0d
and dword [ebp - 0x728], 0
push 0
lea ecx, [ebp - 0xd4]
call fcn.1000d926
xor eax, eax
inc eax
cmp eax, 0x9035a60c
jae 0x10029d30
mov dword [ebp - 0x4c0], 1
jmp 0x10029d37
and dword [ebp - 0x4c0], 0
push 0
lea ecx, [ebp - 0xd4]
call fcn.1000d926
mov ecx, dword [ebp - 0x4c0]
cmp ecx, dword [eax]
je 0x10029dac
mov dword [ebp - 0xec], 0
jmp 0x10029d67
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x3b
jg 0x10029daa
mov dword [ebp - 0x664], 6
push 0x7066
push 0x551a
push 0
push 0x7f65
push 1
lea eax, [ebp - 0xd4]
push eax
push 0x48dd
lea eax, [ebp - 0x664]
push eax
call fcn.10020b8b
add esp, 0x20
jmp 0x10029d5a
jmp 0x10029e1a
mov dword [ebp - 0xc8], 0xfffffff8
jmp 0x10029dc5
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0xfffffff8
jne 0x10029e1a
mov dword [ebp - 0xc4], 0
jmp 0x10029de7
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jl 0x10029e18
mov byte [ebp - 0xac], 0
movzx eax, byte [ebp - 0xac]
test eax, eax
je 0x10029e16
push 0
push 0x52d8
push 0x95f
call fcn.1003169d
add esp, 0xc
jmp 0x10029dda
jmp 0x10029db8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd4]
call fcn.1000d921
push 2
lea ecx, [ebp - 0x9ac]
call fcn.1000d8e5
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x168], 0xfffffff9
push 1
push 0x7719
push 1
push 0x3527
push 0x49f6
push 0x4c4c
lea eax, [ebp - 0x8ec]
push eax
push 0x4693
push 0x2e80
push 0x9f7
push 0x503f
lea eax, [ebp - 0x9ac]
push eax
call fcn.1001944f
add esp, 0x30
mov dword [ebp - 0x168], 1
jmp 0x10029ea2
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jl 0x10029efd
mov byte [ebp - 0xae], 0
movzx eax, byte [ebp - 0xae]
test eax, eax
je 0x10029efb
push 1
push 0x6d67
push 0x4f1e
push 0x6632
push 0x5280
push 0
push 0xcde
push 0x22e
push 0x2842
push 0x1a49
push 0xad
push 0x39f9
call fcn.1001f6ef
add esp, 0x30
jmp 0x10029e95
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9ac]
call fcn.1000d921
mov dword [ebp - 0x6ac], 0x2302
mov dword [ebp - 0x7bc], 0x1ba028ea
mov dword [ebp - 0x1c8], 0
jmp 0x10029f39
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 1
jge 0x10029f55
mov eax, dword [ebp - 0x1c8]
mov dword [ebp + eax*4 - 0xc0], 2
jmp 0x10029f2c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xc0], 0
jmp 0x10029f83
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xc0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc0], 7
jg 0x1002a0b2
mov dword [ebp - 0x170], 0
jmp 0x10029fb0
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x10029fcc
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x1a8], 0xfffffffd
jmp 0x10029fa3
mov byte [ebp - 0xa5], 0
push 0x3b7c
push 0
lea eax, [ebp - 0xa5]
push eax
call fcn.1003289b
add esp, 0xc
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a8]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0xc0]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xc0]
jg 0x1002a01e
mov dword [ebp - 0x3f0], 1
jmp 0x1002a025
and dword [ebp - 0x3f0], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a8], 0
je 0x1002a051
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1a8], 0
je 0x1002a051
mov dword [ebp - 0x530], 1
jmp 0x1002a058
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x3f0]
cmp eax, dword [ebp - 0x530]
jle 0x1002a072
mov dword [ebp - 0x3f8], 1
jmp 0x1002a079
and dword [ebp - 0x3f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a8]
cmp eax, dword [ebp - 0x3f8]
jg 0x1002a09a
mov dword [ebp - 0x4c8], 1
jmp 0x1002a0a1
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x7bc], eax
jmp 0x10029f68
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x1002a0d8
push 0x5383
push 0
push 0x5aab
call fcn.10031f2f
add esp, 0xc
mov dword [ebp - 0x178], 0
jmp 0x1002a0f1
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 2
jge 0x1002a10d
mov eax, dword [ebp - 0x178]
mov dword [ebp + eax*4 - 0x8c0], 0x4b05ef13
jmp 0x1002a0e4
push 4
lea ecx, [ebp - 0x5ac]
call fcn.1000d8e5
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xfc], 0
jmp 0x1002a13a
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
jge 0x1002a156
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x66c], 0x841b
jmp 0x1002a12d
push 0x77b9
push 0
lea eax, [ebp - 0x5ac]
push eax
push 0x2a6e
lea eax, [ebp - 0xfc]
push eax
push 0x613d
push 0x42ec
push 1
push 0
push 0x6f97
call fcn.1002d0f7
add esp, 0x28
push 2
lea ecx, [ebp - 0x5ac]
call fcn.1000d926
and dword [eax], 0
jmp 0x1002a1c1
push 2
lea ecx, [ebp - 0x5ac]
call fcn.1000d926
mov dword [ebp - 0x400], eax
mov eax, dword [ebp - 0x400]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x400]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x5ac]
call fcn.1000d926
cmp dword [eax], 0
jl 0x1002a228
mov dword [ebp - 0x72c], 0xfd1e814b
mov byte [ebp - 0xad], 0
movzx eax, byte [ebp - 0xad]
test eax, eax
je 0x1002a207
push 1
push 1
push 0x5955
push 1
push 0x40bc
call fcn.1001ef2e
add esp, 0x14
push 2
lea ecx, [ebp - 0x5ac]
call fcn.1000d926
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x66c]
mov dword [ebp - 0x72c], eax
jmp 0x1002a19d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5ac]
call fcn.1000d921
mov dword [ebp - 0x80], 0
jmp 0x1002a247
cmp dword [ebp - 0x80], 0x16
jne 0x1002b3a3
mov dword [ebp - 0x1c0], 0xfffffffa
mov dword [ebp - 0x1c0], 0xfffffff8
jmp 0x1002a274
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0xffffffef
je 0x1002a2a8
mov dword [ebp - 0x674], 7
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x1002a29b
push 0
call fcn.10031d27
pop ecx
cmp dword [ebp - 0x674], 0
je 0x1002a2a6
jmp 0x1002a2a8
jmp 0x1002a267
mov dword [ebp - 0x69c], 0x1f90ef30
mov dword [ebp - 0x45c], 0x188e17b8
push 1
lea ecx, [ebp - 0x7f0]
call fcn.1000d8e5
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xa4], 0xfffffffb
mov dword [ebp - 0xdc], 1
mov dword [ebp - 0x240], 0x72b90f99
mov dword [ebp - 0x78c], 0xff2fd6b2
mov dword [ebp - 0x260], 0xfffffffd
mov dword [ebp - 0x67c], 6
push 1
lea ecx, [ebp - 0x7a8]
call fcn.1000d8e5
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x12c], 0xffffffff
mov dword [ebp - 0x210], 0x356d9de3
mov dword [ebp - 0x33c], 0x2983
mov dword [ebp - 0x364], 0x9aeb8efb
mov dword [ebp - 0x28], 0
jmp 0x1002a355
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1002a36b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x798], 0xffffffff
jmp 0x1002a34e
mov dword [ebp - 0x28], 0
jmp 0x1002a37b
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1002a394
push dword [ebp - 0x28]
lea ecx, [ebp - 0x7a8]
call fcn.1000d926
and dword [eax], 0
jmp 0x1002a374
mov dword [ebp - 0x28], 0
jmp 0x1002a3a4
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1002a3ba
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x5a0], 1
jmp 0x1002a39d
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x8d0], eax
cmp dword [ebp - 0xa4], 0
je 0x1002a41b
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x270], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x270]
mov dword [ebp + eax - 0x798], ecx
cmp dword [ebp - 0x270], 0x8884515f
jbe 0x1002a406
mov dword [ebp - 0x274], 1
jmp 0x1002a40d
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x274], eax
je 0x1002a429
xor eax, eax
inc eax
jne 0x1002a429
and dword [ebp - 0x27c], 0
jmp 0x1002a433
mov dword [ebp - 0x27c], 1
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x27c]
je 0x1002a44d
mov dword [ebp - 0x284], 1
jmp 0x1002a454
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x9f4], eax
push 9
pop eax
cmp eax, 1
je 0x1002a480
mov dword [ebp - 0x28c], 1
jmp 0x1002a487
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x28c]
lea eax, [ecx + eax - 0xe1e0]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x240], eax
jg 0x1002a838
mov dword [ebp - 0x68], 1
push 1
lea ecx, [ebp - 0x7fc]
call fcn.1000d8e5
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x2a4], 1
mov dword [ebp - 0x2d4], 1
mov dword [ebp - 0x250], 0xfffffff7
mov dword [ebp - 0x314], 0xce5f1497
mov dword [ebp - 0x32c], 2
mov dword [ebp - 0x128], 0
jmp 0x1002a515
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 1
jge 0x1002a537
push dword [ebp - 0x128]
lea ecx, [ebp - 0x7fc]
call fcn.1000d926
mov dword [eax], 9
jmp 0x1002a508
push 0
lea ecx, [ebp - 0x7fc]
call fcn.1000d926
and dword [eax], 0
push 0
lea ecx, [ebp - 0x7a8]
call fcn.1000d926
xor ecx, ecx
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x68]
jg 0x1002a569
mov dword [ebp - 0x294], 1
jmp 0x1002a570
and dword [ebp - 0x294], 0
cmp dword [ebp - 0x294], 8
ja 0x1002a585
mov dword [ebp - 0x29c], 1
jmp 0x1002a58c
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x2ac], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2ac]
mov dword [ebp + eax - 0x5a0], ecx
cmp dword [ebp - 0x2ac], 1
je 0x1002a5cc
mov dword [ebp - 0x2b4], 1
jmp 0x1002a5d3
and dword [ebp - 0x2b4], 0
cmp dword [ebp - 0x2b4], 0xfffffffe
jne 0x1002a5f7
push 0
lea ecx, [ebp - 0x7fc]
call fcn.1000d926
cmp dword [eax], 0
jne 0x1002a5f7
and dword [ebp - 0x2bc], 0
jmp 0x1002a601
mov dword [ebp - 0x2bc], 1
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x2bc], eax
jne 0x1002a618
mov dword [ebp - 0x2c4], 1
jmp 0x1002a61f
and dword [ebp - 0x2c4], 0
cmp dword [ebp - 0x2c4], 0xffff
jb 0x1002a637
mov dword [ebp - 0x2cc], 1
jmp 0x1002a63e
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x210]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x798]
lea eax, [ecx + eax - 0xca0b]
imul eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0
je 0x1002a690
cmp dword [ebp - 0x12c], 0
je 0x1002a690
mov dword [ebp - 0x2dc], 1
jmp 0x1002a697
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x2dc]
sub eax, dword [ebp - 0x33c]
mov dword [ebp - 0x250], eax
je 0x1002a6b9
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x798], 0
or eax, 0xffffffff
je 0x1002a6ca
mov dword [ebp - 0x2e4], 1
jmp 0x1002a6d1
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x2e4], eax
jl 0x1002a6e8
mov dword [ebp - 0x2ec], 1
jmp 0x1002a6ef
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x260], eax
jl 0x1002a712
mov dword [ebp - 0x2f4], 1
jmp 0x1002a719
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x2f4], eax
jle 0x1002a730
mov dword [ebp - 0x2fc], 1
jmp 0x1002a737
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x2fc]
sub eax, dword [ebp - 0x68]
cmp eax, 0x83f3a8a1
ja 0x1002a753
mov dword [ebp - 0x304], 1
jmp 0x1002a75a
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x304]
jge 0x1002a771
mov dword [ebp - 0x30c], 1
jmp 0x1002a778
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x8d8], eax
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0x978], eax
mov dword [ebp - 0x314], 0xfffffffa
cmp dword [ebp - 0x250], 0xfffffff6
jg 0x1002a7c7
mov dword [ebp - 0x31c], 1
jmp 0x1002a7ce
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x31c]
jne 0x1002a7e5
mov dword [ebp - 0x324], 1
jmp 0x1002a7ec
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x8e0], eax
push 0
lea ecx, [ebp - 0x7a8]
call fcn.1000d926
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x798]
mov dword [ebp - 0x364], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x7fc]
call fcn.1000d921
jmp 0x1002aade
push 1
lea ecx, [ebp - 0x7d8]
call fcn.1000d8e5
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x26c], 9
mov dword [ebp - 0x38c], 0x62d45007
push 0xe42
push 0
push 0xeff
push 0x6c0f
push 0x69d1
lea eax, [ebp - 0x7d8]
push eax
push 1
push 0x1aa5
push 0x62bb
lea eax, [ebp - 0x9f0]
push eax
push 0x835
push 0x579c
push 0xd35
push 0x2c8b
push 0x16ff
push 0x19dc
push 0x6cd2
push 0x19b4
push 0x67fa
push 0
push 0x6c3f
call fcn.1002c503
add esp, 0x54
cmp dword [ebp - 0x78c], 0
je 0x1002a9d6
mov eax, dword [ebp - 0x67c]
mov dword [ebp - 0x8e8], eax
push 0
lea ecx, [ebp - 0x7d8]
call fcn.1000d926
cmp dword [eax], 0x766298a2
jg 0x1002a903
mov dword [ebp - 0x334], 1
jmp 0x1002a90a
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x334], eax
jl 0x1002a924
mov dword [ebp - 0x344], 1
jmp 0x1002a92b
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x33c]
cmp dword [ebp - 0x344], eax
jge 0x1002a945
mov dword [ebp - 0x218], 1
jmp 0x1002a94c
and dword [ebp - 0x218], 0
push 0
lea ecx, [ebp - 0x7d8]
call fcn.1000d926
mov ecx, dword [ebp - 0x218]
mov dword [eax], ecx
cmp dword [ebp - 0x218], 0xffffffff
jae 0x1002a976
mov dword [ebp - 0x34c], 1
jmp 0x1002a97d
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x26c]
cmp dword [ebp - 0x34c], eax
je 0x1002a997
mov dword [ebp - 0x354], 1
jmp 0x1002a99e
and dword [ebp - 0x354], 0
cmp dword [ebp - 0x354], 0x5570
jl 0x1002a9b6
mov dword [ebp - 0x35c], 1
jmp 0x1002a9bd
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x240]
add eax, dword [ebp - 0x35c]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x5a0]
mov eax, 0xfff6
test eax, eax
je 0x1002a9f4
cmp dword [ebp - 0x364], 0
je 0x1002a9f4
mov dword [ebp - 0x36c], 1
jmp 0x1002a9fb
and dword [ebp - 0x36c], 0
push 0
lea ecx, [ebp - 0x7a8]
call fcn.1000d926
mov ecx, dword [ebp - 0x36c]
cmp ecx, dword [eax]
jge 0x1002aa1e
mov dword [ebp - 0x374], 1
jmp 0x1002aa25
and dword [ebp - 0x374], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5a0]
cmp eax, dword [ebp - 0x374]
jl 0x1002aa46
mov dword [ebp - 0x220], 1
jmp 0x1002aa4d
and dword [ebp - 0x220], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x220]
mov dword [ebp + eax - 0x5a0], ecx
mov eax, dword [ebp - 0x26c]
cmp dword [ebp - 0x220], eax
jl 0x1002aa7a
mov dword [ebp - 0x384], 1
jmp 0x1002aa81
and dword [ebp - 0x384], 0
cmp dword [ebp - 0x384], 0xffff9249
jg 0x1002aa92
xor eax, eax
inc eax
jne 0x1002aaa0
xor eax, eax
inc eax
jne 0x1002aaa0
and dword [ebp - 0x744], 0
jmp 0x1002aaaa
mov dword [ebp - 0x744], 1
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x980], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x798]
add eax, dword [ebp - 0x38c]
mov dword [ebp - 0x260], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x7d8]
call fcn.1000d921
lea eax, [ebp - 0x12c]
push eax
push 0x485a
push 0
call fcn.1003246c
add esp, 0xc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x7a8]
call fcn.1000d921
mov dword [ebp - 0x204], 1
mov dword [ebp - 0x1ec], 0xffffffff
mov dword [ebp - 0xe0], 1
mov dword [ebp - 0x3c4], 0xfff9
mov dword [ebp - 0x134], 0x2db8e964
mov dword [ebp - 0x1e4], 0x3ddca272
mov dword [ebp - 0x3bc], 0xcd2466e9
mov dword [ebp - 0x7b0], 0xffff
mov dword [ebp - 0x74c], 0xffffffff
mov dword [ebp - 0x684], 0xffffffff
mov dword [ebp - 0x68c], 0xdbc46d76
mov dword [ebp - 0x8f0], 1
cmp dword [ebp - 0x1ec], 0
jne 0x1002ac54
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x9f8], eax
mov eax, dword [ebp - 0x3c4]
cmp dword [ebp - 0x1ec], eax
jge 0x1002abae
mov dword [ebp - 0x394], 1
jmp 0x1002abb5
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x394], eax
jle 0x1002abcf
mov dword [ebp - 0x39c], 1
jmp 0x1002abd6
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0x39c]
jl 0x1002abf0
mov dword [ebp - 0x3a4], 1
jmp 0x1002abf7
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x3a4]
sub eax, dword [ebp - 0xe0]
imul eax, dword [ebp - 0x134]
cmp eax, dword [ebp - 0xe0]
jl 0x1002ac1e
mov dword [ebp - 0x3ac], 1
jmp 0x1002ac25
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0xe0]
imul eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x1e4], eax
mov eax, 0x37d45db3
sub eax, dword [ebp - 0x1e4]
cmp eax, dword [ebp - 0x134]
jge 0x1002ac54
and dword [ebp - 0x3b4], 0
jmp 0x1002ac5e
mov dword [ebp - 0x3b4], 1
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x3bc], eax
lea eax, [ebp - 0x1e4]
push eax
push 0
push 0x4276
push 0x22ec
lea eax, [ebp - 0x684]
push eax
push 0x66a4
push 1
push 0x2bcd
lea eax, [ebp - 0x3bc]
push eax
push 0x5a4
push 0x18f3
lea eax, [ebp - 0x3c4]
push eax
lea eax, [ebp - 0x7b0]
push eax
lea eax, [ebp - 0x68c]
push eax
push 0x246d
push 0x7901
push 0x6bb6
lea eax, [ebp - 0x1ec]
push eax
lea eax, [ebp - 0x74c]
push eax
push 1
lea eax, [ebp - 0x134]
push eax
call fcn.1002c503
add esp, 0x54
mov dword [ebp - 0x8f8], 9
mov dword [ebp - 0x70], 0xfffffffc
mov dword [ebp - 0x3e4], 5
mov dword [ebp - 0x988], 0xcdead9ba
mov dword [ebp - 0x3d4], 1
mov dword [ebp - 0x900], 0xffffffff
mov dword [ebp - 0x1f4], 0x26c4f32b
mov dword [ebp - 0x694], 0xffffffff
mov dword [ebp - 0x13c], 0
jmp 0x1002ad4a
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 4
jge 0x1002ad66
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0xa38], 0xffffffff
jmp 0x1002ad3d
mov dword [ebp - 0x70], 0
jmp 0x1002ad76
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x11
jg 0x1002ae99
push 1
lea ecx, [ebp - 0x9bc]
call fcn.1000d8e5
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x144], 1
mov dword [ebp - 0xa00], 0xfdeb7727
mov dword [ebp - 0x908], 0x3d0b5486
mov dword [ebp - 0x990], 0x389a
mov dword [ebp - 0x48], 0
jmp 0x1002adc9
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x1002ade5
push dword [ebp - 0x48]
lea ecx, [ebp - 0x9bc]
call fcn.1000d926
mov dword [eax], 1
jmp 0x1002adc2
mov dword [ebp - 0x48], 0
jmp 0x1002adf5
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x1002ae0b
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0xa7c], 0
jmp 0x1002adee
mov dword [ebp - 0x144], 0
jmp 0x1002ae24
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
jg 0x1002ae78
mov byte [ebp - 0x8c], 0
movzx eax, byte [ebp - 0x8c]
test eax, eax
je 0x1002ae6b
push 0x2e49
push 0
push 0
push 0x3d77
push 0x1d0d
push 0x7630
push 0x6483
push 0x60c9
push 1
call fcn.10031960
add esp, 0x24
push 0
push 1
call fcn.100210a5
pop ecx
pop ecx
jmp 0x1002ae17
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x9bc]
call fcn.1000d921
jmp 0x1002ad6f
mov eax, 0xfffb
test eax, eax
je 0x1002aeba
cmp dword [ebp - 0x70], 0
je 0x1002aeba
cmp dword [ebp - 0x70], 0
je 0x1002aeba
mov dword [ebp - 0x3dc], 1
jmp 0x1002aec1
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x694]
cmp dword [ebp - 0x70], eax
jle 0x1002aed8
mov dword [ebp - 0x3cc], 1
jmp 0x1002aedf
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0x3d4], eax
je 0x1002af05
mov dword [ebp - 0x3ec], 1
jmp 0x1002af0c
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x3e4], eax
mov eax, dword [ebp - 0x3e4]
cmp eax, dword [ebp - 0x3ec]
jl 0x1002af32
mov dword [ebp - 0x3f4], 1
jmp 0x1002af39
and dword [ebp - 0x3f4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa38]
cmp dword [ebp - 0x3f4], eax
jge 0x1002af59
mov dword [ebp - 0x3fc], 1
jmp 0x1002af60
and dword [ebp - 0x3fc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3fc]
mov dword [ebp + eax - 0xa38], ecx
mov dword [ebp - 0x14c], 0
jmp 0x1002af8c
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 1
jge 0x1002afab
push dword [ebp - 0x14c]
lea ecx, [ebp - 0x7f0]
call fcn.1000d926
and dword [eax], 0
jmp 0x1002af7f
mov dword [ebp - 0x78], 0xfffffffc
mov dword [ebp - 0x41c], 5
mov dword [ebp - 0x910], 0xcdead9ba
mov dword [ebp - 0x40c], 1
mov dword [ebp - 0x9fc], 0xffffffff
mov dword [ebp - 0x1fc], 0x26c4f32b
mov dword [ebp - 0x79c], 0xffffffff
mov dword [ebp - 0x154], 0
jmp 0x1002b007
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 4
jge 0x1002b023
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0xa48], 0xffffffff
jmp 0x1002affa
mov dword [ebp - 0x78], 0
jmp 0x1002b033
cmp dword [ebp - 0x78], 0x11
jg 0x1002b19c
push 1
lea ecx, [ebp - 0x9cc]
call fcn.1000d8e5
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x15c], 1
mov dword [ebp - 0x918], 0xfdeb7727
mov dword [ebp - 0x998], 0x3d0b5486
mov dword [ebp - 0x920], 0x389a
mov dword [ebp - 0x4c], 0
jmp 0x1002b086
cmp dword [ebp - 0x4c], 1
jge 0x1002b0a2
mov eax, 0xfffb
test eax, eax
je 0x1002b1bd
cmp dword [ebp - 0x78], 0
je 0x1002b1bd
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x79c]
cmp dword [ebp - 0x78], eax
jle 0x1002b1db
mov eax, dword [ebp - 0x124]
mov eax, dword [eax + 4]
mov dword [ebp - 0x548], eax
mov dword [ebp - 0x6bc], 0xffffffff
push 4
lea ecx, [ebp - 0x878]
call fcn.1000d8e5
mov dword [ebp - 4], 0x12
push 4
lea ecx, [ebp - 0x86c]
call fcn.1000d8e5
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x6dc], 0xb44cf59
mov dword [ebp - 0x6e4], 9
mov dword [ebp - 0x6c4], 0x8e00457a
mov dword [ebp - 0x6ec], 0xfffffffd
mov dword [ebp - 0x6b4], 0xc5cecce0
mov dword [ebp - 0xe8], 0
jmp 0x1002b42c
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 4
jge 0x1002b44e
push dword [ebp - 0xe8]
lea ecx, [ebp - 0x878]
call fcn.1000d926
mov dword [eax], 0x759609c3
jmp 0x1002b41f
push 1
lea eax, [ebp - 0xe8]
push eax
push 1
lea eax, [ebp - 0x86c]
push eax
call fcn.1001f359
add esp, 0x10
push 1
lea eax, [ebp - 0x6b4]
push eax
lea eax, [ebp - 0x6dc]
push eax
lea eax, [ebp - 0x6bc]
push eax
push 0x2f2
push 1
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x6e4]
push eax
lea eax, [ebp - 0x6c4]
push eax
lea eax, [ebp - 0x878]
push eax
lea eax, [ebp - 0x6ec]
push eax
push 0x7b0f
call fcn.1001f6ef
add esp, 0x30
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x86c]
call fcn.1000d921
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.1000d921
mov dword [ebp - 0xf8], 0x8cff0ea7
mov dword [ebp - 0x5e8], 0x121a
mov dword [ebp - 0x5cc], 0x928c176b
push 0x7a72
push 0x5516
push 1
push 0x3518
push 1
push 0
lea eax, [ebp - 0x5cc]
push eax
push 0x22e5
push 0x719d
call fcn.1001fd61
add esp, 0x24
mov dword [ebp - 0x5e0], 0x2a831d26
mov dword [ebp - 0xf0], 0xa5043c4a
mov dword [ebp - 0x214], 6
mov dword [ebp - 0x834], 0x703d9b95
mov dword [ebp - 0x830], 0x703d9b95
mov dword [ebp - 0x82c], 0x703d9b95
mov dword [ebp - 0x828], 0x703d9b95
lea ecx, [ebp - 0x1dd]
call fcn.1000e4ba
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x834]
push eax
lea ecx, [ebp - 0xa8c]
call fcn.1003765d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x808]
call fcn.10037555
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x16c], 0x6b3b
mov dword [ebp - 0x164], 0
jmp 0x1002b5c5
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 3
jge 0x1002b5e1
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x53c], 1
jmp 0x1002b5b8
mov dword [ebp - 0xf0], 0x3992
cmp dword [ebp - 0xf0], 0
jne 0x1002b666
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x5d0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x53c]
mov dword [ebp - 0x5d8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x53c]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x53c], eax
mov eax, dword [ebp - 0x5d0]
cmp eax, dword [ebp - 0x5d8]
je 0x1002b648
mov dword [ebp - 0x464], 1
jmp 0x1002b64f
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0xf0]
cmp eax, dword [ebp - 0x464]
jg 0x1002b666
and dword [ebp - 0x46c], 0
jmp 0x1002b670
mov dword [ebp - 0x46c], 1
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
je 0x1002b69a
cmp dword [ebp - 0x214], 0
je 0x1002b69a
mov dword [ebp - 0x20c], 1
jmp 0x1002b6a1
and dword [ebp - 0x20c], 0
push 1
lea ecx, [ebp - 0x808]
call fcn.1000d926
mov ecx, dword [ebp - 0x20c]
mov dword [eax], ecx
cmp dword [ebp - 0x20c], 0
jne 0x1002b78b
cmp dword [ebp - 0x16c], 1
jle 0x1002b6d8
mov dword [ebp - 0x474], 1
jmp 0x1002b6df
and dword [ebp - 0x474], 0
push 1
lea ecx, [ebp - 0x808]
call fcn.1000d926
mov ecx, dword [ebp - 0x474]
cmp ecx, dword [eax]
jle 0x1002b702
mov dword [ebp - 0x47c], 1
jmp 0x1002b709
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x16c]
add eax, dword [ebp - 0x47c]
cmp eax, 0xfffffff8
jle 0x1002b726
mov dword [ebp - 0x484], 1
jmp 0x1002b72d
and dword [ebp - 0x484], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x53c]
cmp dword [ebp - 0x484], eax
je 0x1002b751
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x53c], 0
je 0x1002b76d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x53c], 0
je 0x1002b76d
mov dword [ebp - 0x48c], 1
jmp 0x1002b774
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x214]
add eax, dword [ebp - 0x48c]
jne 0x1002b78b
and dword [ebp - 0x494], 0
jmp 0x1002b795
mov dword [ebp - 0x494], 1
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x214], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xf0]
cmp dword [ebp + eax - 0x53c], ecx
jle 0x1002b7c2
mov dword [ebp - 0x49c], 1
jmp 0x1002b7c9
and dword [ebp - 0x49c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x53c]
cmp eax, dword [ebp - 0x49c]
jg 0x1002b7ea
mov dword [ebp - 0x4a4], 1
jmp 0x1002b7f1
and dword [ebp - 0x4a4], 0
push 1
lea ecx, [ebp - 0x808]
call fcn.1000d926
mov ecx, dword [ebp - 0x4a4]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x808]
call fcn.1000d921
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x1002b82f
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
mov dword [ebp - 0xf8], 0xffffffe2
jmp 0x1002b848
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 3
jge 0x1002b8e6
mov dword [ebp - 0x5f0], 0x13281d21
mov byte [ebp - 0xab], 0
movzx eax, byte [ebp - 0xab]
test eax, eax
je 0x1002b887
push 0x60ce
push 0
push 0
push 0x1037
call fcn.100311ea
add esp, 0x10
lea eax, [ebp - 0x5e0]
push eax
push 0x47ae
push 0x7021
push 0x3cb1
push 0xf62
push 0x544
lea eax, [ebp - 0x5e8]
push eax
push 0x3781
push 0x54b5
push 0x167b
push 0x16cc
lea eax, [ebp - 0x5f0]
push eax
push 1
push 0
lea eax, [ebp - 0xf8]
push eax
push 0x7a3f
call fcn.10036e0c
add esp, 0x40
jmp 0x1002b83b
mov dword [ebp - 0x38], 0xa61928c1
mov dword [ebp - 0x17c], 0xd9e177c4
mov dword [ebp - 0x610], 0x92e7baa9
mov dword [ebp - 0x928], 0xfffffffd
mov dword [ebp - 0x174], 0
jmp 0x1002b924
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 3
jge 0x1002b940
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0xa60], 0xe3d3b0cf
jmp 0x1002b917
mov dword [ebp - 0x38], 8
jmp 0x1002b950
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x15
jne 0x1002bb34
mov dword [ebp - 0x54], 0xfffffff6
mov dword [ebp - 0x4d4], 0x7c1abdf1
cmp dword [ebp - 0x54], 0
jne 0x1002bb12
or eax, 0xffffffff
je 0x1002ba58
mov dword [ebp - 0x17c], 1
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x9a0], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x5f8], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5f8]
mov dword [ebp + eax - 0xa60], ecx
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x930], eax
mov eax, dword [ebp - 0x54]
inc eax
imul eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x38]
jne 0x1002b9d2
mov dword [ebp - 0x4ac], 1
jmp 0x1002b9d9
and dword [ebp - 0x4ac], 0
cmp dword [ebp - 0x4ac], 0xfffe
jb 0x1002b9f1
mov dword [ebp - 0x4b4], 1
jmp 0x1002b9f8
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x4b4], eax
jne 0x1002ba0f
mov dword [ebp - 0x4bc], 1
jmp 0x1002ba16
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x4bc]
jne 0x1002ba2d
mov dword [ebp - 0x600], 1
jmp 0x1002ba34
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0xa04], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x938], eax
cmp dword [ebp - 0x54], 0
je 0x1002ba58
mov dword [ebp - 0x4c4], 1
jmp 0x1002ba5f
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x4c4]
sub eax, 0x20f30385
cmp eax, dword [ebp - 0x54]
jl 0x1002ba7b
mov dword [ebp - 0x4cc], 1
jmp 0x1002ba82
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x4cc]
sub eax, 5
mov dword [ebp - 0x4d4], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x4d4], eax
jl 0x1002baa8
mov dword [ebp - 0x4dc], 1
jmp 0x1002baaf
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x4dc], eax
je 0x1002bacc
cmp dword [ebp - 0x17c], 0
jne 0x1002bacc
and dword [ebp - 0x4e4], 0
jmp 0x1002bad6
mov dword [ebp - 0x4e4], 1
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x4e4], eax
jne 0x1002baf6
cmp dword [ebp - 0x17c], 0
je 0x1002baf6
mov dword [ebp - 0x4ec], 1
jmp 0x1002bafd
and dword [ebp - 0x4ec], 0
cmp dword [ebp - 0x4ec], 0x9867f5d1
jbe 0x1002bb12
and dword [ebp - 0x608], 0
jmp 0x1002bb1c
mov dword [ebp - 0x608], 1
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x9b0], eax
mov dword [ebp - 0x610], 2
jmp 0x1002b949
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x124]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x620], 0x2e56
mov dword [ebp - 0x4fc], 0xfffffff8
mov dword [ebp - 0x4f4], 0x8959
mov dword [ebp - 0x618], 1
lea eax, [ebp - 0x4f4]
push eax
push 0
lea eax, [ebp - 0x618]
push eax
push 1
lea eax, [ebp - 0x4fc]
push eax
lea eax, [ebp - 0x620]
push eax
push 0x38a4
call fcn.1002cf0d
add esp, 0x1c
lea eax, [ebp - 0x4f4]
push eax
push 0x5bc5
push 1
push 0x7625
lea eax, [ebp - 0x4fc]
push eax
push 0x2137
push 0
call fcn.10023e67
add esp, 0x1c
mov dword [ebp - 0x628], 0x1f37
cmp dword [ebp - 0x628], 0x1290
jge 0x1002bf17
or dword [ebp - 0x8a0], 0xffffffff
and dword [ebp - 0x89c], 0
mov dword [ebp - 0x898], 1
and dword [ebp - 0x894], 0
and dword [ebp - 0x8b0], 0
mov dword [ebp - 0x8ac], 1
and dword [ebp - 0x8a8], 0
or dword [ebp - 0x8a4], 0xffffffff
lea eax, [ebp - 0x630]
push eax
push 0x10008670
call fcn.1004a47b
pop ecx
pop ecx
mov dword [ebp - 0x21c], 1
jmp 0x1002bc51
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x21c]
cmp eax, dword [ebp - 0x630]
jg 0x1002bf17
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x88]
push eax
push 0x100086cc
call fcn.1004a47b
add esp, 0xc
and dword [ebp - 0x18c], 0
jmp 0x1002bc94
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp - 0x18c]
cmp eax, dword [ebp - 0x88]
jge 0x1002bce2
and dword [ebp - 0x194], 0
jmp 0x1002bcb8
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
cmp eax, dword [ebp - 0x88]
jge 0x1002bce0
imul eax, dword [ebp - 0x18c], 0x32
lea eax, [ebp + eax - 0x1470]
mov ecx, dword [ebp - 0x194]
mov byte [eax + ecx], 0
jmp 0x1002bcab
jmp 0x1002bc87
and dword [ebp - 0x224], 0
jmp 0x1002bcf8
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x224]
cmp eax, dword [ebp - 0x638]
jge 0x1002bd3d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x100086cc
call fcn.1004a47b
add esp, 0xc
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
imul eax, dword [ebp - 0x10], 0x32
lea eax, [ebp + eax - 0x1470]
mov ecx, dword [ebp - 0x18]
mov byte [eax + ecx], 1
jmp 0x1002bceb
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x100086cc
call fcn.1004a47b
add esp, 0xc
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x88]
jne 0x1002bd71
and dword [ebp - 0x5c], 0
jmp 0x1002bd96
cmp dword [ebp - 0x18], 0xffffffff
jne 0x1002bd80
mov dword [ebp - 0x5c], 1
jmp 0x1002bd96
cmp dword [ebp - 0x10], 0xffffffff
jne 0x1002bd8f
mov dword [ebp - 0x5c], 2
jmp 0x1002bd96
mov dword [ebp - 0x5c], 3
and dword [ebp - 0x110], 0
jmp 0x1002bdac
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x88]
jge 0x1002be2a
and dword [ebp - 0x114], 0
jmp 0x1002bdd0
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x88]
jge 0x1002be25
and dword [ebp - 0x11c], 0
jmp 0x1002bdf4
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 4
jge 0x1002be23
imul eax, dword [ebp - 0x110], 0xc8
lea eax, [ebp + eax - 0x3b80]
mov ecx, dword [ebp - 0x114]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp - 0x11c]
mov byte [eax + ecx], 0
jmp 0x1002bde7
jmp 0x1002bdc3
jmp 0x1002bd9f
xor eax, eax
inc eax
je 0x1002bf12
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp + eax*4 - 0x8a0]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp + eax*4 - 0x8b0]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x10], 0xffffffff
je 0x1002be75
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x88]
je 0x1002be75
cmp dword [ebp - 0x18], 0xffffffff
je 0x1002be75
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x88]
jne 0x1002be98
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push 0x100087ac
call fcn.1004a80c
add esp, 0xc
jmp 0x1002bf12
imul eax, dword [ebp - 0x10], 0xc8
lea eax, [ebp + eax - 0x3b80]
mov ecx, dword [ebp - 0x18]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp - 0x5c]
movzx eax, byte [eax + ecx]
test eax, eax
je 0x1002bed2
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
push 0x100087d4
call fcn.1004a80c
pop ecx
jmp 0x1002bf12
imul eax, dword [ebp - 0x10], 0xc8
lea eax, [ebp + eax - 0x3b80]
mov ecx, dword [ebp - 0x18]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp - 0x5c]
mov byte [eax + ecx], 1
imul eax, dword [ebp - 0x10], 0x32
lea eax, [ebp + eax - 0x1470]
mov ecx, dword [ebp - 0x18]
movzx eax, byte [eax + ecx]
test eax, eax
je 0x1002bf0d
mov eax, dword [ebp - 0x5c]
inc eax
and eax, 3
mov dword [ebp - 0x5c], eax
jmp 0x1002be2a
jmp 0x1002bc44
mov dword [ebp - 0xbc], 0xd6f2ee76
mov dword [ebp - 0xb8], 0xf3de0369
mov dword [ebp - 0x648], 0xfffffffa
cmp dword [ebp - 0xbc], 0
je 0x1002c075
mov dword [ebp - 0x640], 0
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x1002bf79
push 0x4528
push 1
push 0x6f93
push 1
push 0x59ba
call fcn.1001face
add esp, 0x14
mov dword [ebp - 0xbc], 0
jmp 0x1002bf92
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xd
je 0x1002c073
mov dword [ebp - 0x73c], 0xfffffffe
mov dword [ebp - 0x738], 0xfffffffe
mov dword [ebp - 0x734], 0xfffffffe
mov dword [ebp - 0x730], 0xfffffffe
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x73c], 0
jmp 0x1002bff5
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x73c]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x73c], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x73c], 0xffffffe5
jg 0x1002c02a
cmp dword [ebp - 0x640], 0
je 0x1002c010
jmp 0x1002c02a
lea eax, [ebp - 0xb8]
push eax
push 0x4488
push 1
push 0
call fcn.10020cce
add esp, 0x10
jmp 0x1002bfda
mov dword [ebp - 0xb8], 0xfffffffb
jmp 0x1002c043
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xfffffff1
jne 0x1002c06e
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x1002c06c
push 0
push 0
push 1
call fcn.10031289
add esp, 0xc
jmp 0x1002c036
jmp 0x1002bf85
jmp 0x1002c0e9
mov dword [ebp - 0x668], 1
mov dword [ebp - 0x650], 0xfffffff9
mov dword [ebp - 0x660], 1
mov dword [ebp - 0x658], 0x1e525036
push 0x4e77
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x650]
push eax
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x660]
push eax
push 0x5aff
push 0
lea eax, [ebp - 0xbc]
push eax
push 1
push 0x7531
lea eax, [ebp - 0x668]
push eax
call fcn.1002468a
add esp, 0x30
and dword [ebp - 0x22c], 0
jmp 0x1002c108
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x44]
add eax, 0x28
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x124]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x22c], eax
jge 0x1002c47d
push 2
lea ecx, [ebp - 0x9dc]
call fcn.1000d8e5
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x1bc], 0x490c4d8e
lea eax, [ebp - 0x9dc]
push eax
push 1
lea eax, [ebp - 0x940]
push eax
push 1
call fcn.1001fb9a
add esp, 0x10
mov dword [ebp - 0x1bc], 0
jmp 0x1002c171
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 1
jg 0x1002c1ae
mov byte [ebp - 0x8a], 0
push 0xcbd
lea eax, [ebp - 0x8a]
push eax
push 1
push 0x33b1
push 1
push 1
push 0x68
push 0xa1a
push 0x4ff6
call fcn.1001fd61
add esp, 0x24
jmp 0x1002c164
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9dc]
call fcn.1000d921
mov eax, dword [ebp - 0x44]
cmp dword [eax + 0x10], 0
jne 0x1002c201
push 1
push 0x3e89
push 0x689e
push 0
lea eax, [ebp - 0x670]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x548]
push eax
push 1
lea eax, [ebp - 0x23c]
push eax
push 0x7acc
call fcn.1002528e
add esp, 0x28
jmp 0x1002c0f2
mov dword [ebp - 0x24], 0xbc78
mov dword [ebp - 0x52c], 0x56c37fc0
mov dword [ebp - 0x58], 0
jmp 0x1002c222
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1002c238
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x678], 3
jmp 0x1002c21b
mov dword [ebp - 0x58], 0
jmp 0x1002c248
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1002c25e
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x680], 9
jmp 0x1002c241
cmp dword [ebp - 0x24], 0
je 0x1002c2b5
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xa1c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x948], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x9c0], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jl 0x1002c293
mov dword [ebp - 0x504], 1
jmp 0x1002c29a
and dword [ebp - 0x504], 0
cmp dword [ebp - 0x504], 1
jl 0x1002c2b5
cmp dword [ebp - 0x24], 0
je 0x1002c2b5
mov dword [ebp - 0x50c], 1
jmp 0x1002c2bc
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x50c], eax
je 0x1002c2d3
mov dword [ebp - 0x514], 1
jmp 0x1002c2da
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x514], eax
jg 0x1002c2f1
mov dword [ebp - 0x51c], 1
jmp 0x1002c2f8
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
sub eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x24]
je 0x1002c318
cmp dword [ebp - 0x24], 0
je 0x1002c318
mov dword [ebp - 0x234], 1
jmp 0x1002c31f
and dword [ebp - 0x234], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x234]
mov dword [ebp + eax - 0x678], ecx
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x234], eax
jg 0x1002c349
mov dword [ebp - 0x524], 1
jmp 0x1002c350
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x524]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x52c], eax
mov eax, dword [ebp - 0x52c]
sub eax, dword [ebp - 0x24]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x680], eax
push 4
push 0x1000
mov eax, dword [ebp - 0x44]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x548]
add ecx, dword [eax + 0xc]
push ecx
push 0x8043
push 0x5ed1
call fcn.1001791d
pop ecx
pop ecx
call eax
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x44]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x688]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x23c]
call fcn.10017e49
add esp, 0xc
push 2
lea ecx, [ebp - 0x9ec]
call fcn.1000d8e5
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x1cc], 0x490c4d8e
mov dword [ebp - 0x1c4], 0
jmp 0x1002c400
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 2
jge 0x1002c422
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x9ec]
call fcn.1000d926
mov dword [eax], 0xd3df
jmp 0x1002c3f3
mov dword [ebp - 0x1cc], 0
jmp 0x1002c43b
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 1
jg 0x1002c45d
mov byte [ebp - 0x8e], 0
lea eax, [ebp - 0x8e]
push eax
push 0
call fcn.1002fad6
pop ecx
pop ecx
jmp 0x1002c42e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9ec]
call fcn.1000d921
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x23c]
mov dword [eax + 8], ecx
jmp 0x1002c0f2
jmp 0x1002c493
push 0x6868
push 0xde9
push 0
call fcn.10030622
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret