Function at 0x10034043
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100753ba
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb08
push esi
mov dword [ebp - 0x9d0], 0xca631852
mov dword [ebp - 0xa40], 0xffffffff
mov dword [ebp - 0x990], 0xc4b4e126
mov dword [ebp - 0xa30], 0xa624cdb8
push 2
lea ecx, [ebp - 0x7c4]
call fcn.10022f94
and dword [ebp - 4], 0
mov dword [ebp - 0x3a8], 0xe4d9
lea eax, [ebp - 0x7c4]
push eax
push 0x107a
push 0
push 0x6741
lea eax, [ebp - 0x998]
push eax
call fcn.10033d9a
add esp, 0x14
mov eax, dword [ebp - 0x3a8]
dec eax
mov dword [ebp - 0x3a8], eax
push 1
lea ecx, [ebp - 0x7c4]
call fcn.10023032
mov esi, eax
push 1
lea ecx, [ebp - 0x7c4]
call fcn.10023032
mov ecx, dword [esi]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c4]
call fcn.10023016
mov eax, dword [0x10666e24]
and eax, 1
jne 0x1003413a
mov eax, dword [0x10666e24]
or eax, 1
mov dword [0x10666e24], eax
mov dword [ebp - 4], 1
mov ecx, 0x10666de8
call fcn.1002f698
push 0x10076548
call fcn.1005d2b6
pop ecx
or dword [ebp - 4], 0xffffffff
push 1
call fcn.10032732
pop ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x8e8]
call fcn.1002f3ce
mov dword [ebp - 4], 2
lea eax, [ebp - 0x9ac]
push eax
lea ecx, [ebp - 0x8e8]
call fcn.1002f93a
push dword [eax]
lea eax, [ebp - 0xa8c]
push eax
lea ecx, [ebp - 0x8e8]
call fcn.1002f94e
push dword [eax]
lea eax, [ebp - 0x9b4]
push eax
lea ecx, [ebp - 0x8e8]
call fcn.1002f93a
push dword [eax]
mov edx, 0x10030ffe
lea ecx, [ebp - 0xa44]
call fcn.1003ace2
add esp, 0xc
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x1a0], 0xffffffff
mov dword [ebp - 0x138], 6
push 3
lea ecx, [ebp - 0x8b8]
call fcn.10022f94
mov byte [ebp - 4], 3
mov dword [ebp - 0x28c], 0xfffffff7
mov dword [ebp - 0x184], 0xec767dbf
mov dword [ebp - 0x55c], 8
mov dword [ebp - 0x720], 0xfffffffa
mov dword [ebp - 0x5c], 0
jmp 0x1003420a
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x10034220
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x608], 0xfffffff6
jmp 0x10034203
mov dword [ebp - 0x5c], 0
jmp 0x10034230
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x1003424c
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x8b8]
call fcn.10023032
mov dword [eax], 0xfffffff9
jmp 0x10034229
mov dword [ebp - 0x34], 2
jmp 0x1003425c
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x100342a3
mov dword [ebp - 0xf0], 1
mov dword [ebp - 0xf0], 0
jmp 0x10034285
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 3
jge 0x100342a1
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0x608], 7
jmp 0x10034278
jmp 0x10034255
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x608], 0xfffd
jbe 0x100342c2
mov dword [ebp - 0x5c0], 1
jmp 0x100342c9
and dword [ebp - 0x5c0], 0
cmp dword [ebp - 0x5c0], 0xfffffff6
je 0x100342de
mov dword [ebp - 0x5c8], 1
jmp 0x100342e5
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x5c8]
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
je 0x1003430f
cmp dword [ebp - 0x1a0], 0
je 0x1003430f
mov dword [ebp - 0x5d0], 1
jmp 0x10034316
and dword [ebp - 0x5d0], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x5d0], eax
jge 0x1003432d
mov dword [ebp - 0x5f8], 1
jmp 0x10034334
and dword [ebp - 0x5f8], 0
cmp dword [ebp - 0x5f8], 0x8ff7673e
jne 0x1003434c
mov dword [ebp - 0x48c], 1
jmp 0x10034353
and dword [ebp - 0x48c], 0
cmp dword [ebp - 0x48c], 0xfffffff7
jg 0x10034368
mov dword [ebp - 0x5b8], 1
jmp 0x1003436f
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x138]
test eax, eax
je 0x1003439e
cmp dword [ebp - 0x1a0], 0
je 0x1003439e
mov dword [ebp - 0x2fc], 1
jmp 0x100343a5
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x740], eax
push 2
lea ecx, [ebp - 0x8b8]
call fcn.10023032
mov ecx, dword [ebp - 0x740]
mov dword [eax], ecx
mov eax, dword [ebp - 0x138]
sub eax, dword [ebp - 0x34]
jne 0x100343e1
mov dword [ebp - 0x5bc], 1
jmp 0x100343e8
and dword [ebp - 0x5bc], 0
imul eax, dword [ebp - 0x5bc], 0xce5f
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
jne 0x10034413
cmp dword [ebp - 0x184], 0
jne 0x10034413
and dword [ebp - 0x304], 0
jmp 0x1003441d
mov dword [ebp - 0x304], 1
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x304], eax
jl 0x10034437
mov dword [ebp - 0x6bc], 1
jmp 0x1003443e
and dword [ebp - 0x6bc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x608]
mov dword [ebp - 0x9bc], eax
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x138], eax
jl 0x1003446b
mov dword [ebp - 0x494], 1
jmp 0x10034472
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x494], eax
jl 0x10034489
mov dword [ebp - 0x30c], 1
jmp 0x10034490
and dword [ebp - 0x30c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x30c]
sub ecx, dword [ebp + eax - 0x608]
mov dword [ebp - 0x55c], ecx
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0xa7c], eax
mov eax, dword [ebp - 0x28c]
cmp dword [ebp - 0x34], eax
jne 0x100344cc
mov dword [ebp - 0x314], 1
jmp 0x100344d3
and dword [ebp - 0x314], 0
cmp dword [ebp - 0x314], 1
je 0x100344e8
mov dword [ebp - 0x49c], 1
jmp 0x100344ef
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x49c]
neg eax
je 0x10034514
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x608], 0
je 0x10034514
mov dword [ebp - 0x31c], 1
jmp 0x1003451b
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x34], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x608]
cmp dword [ebp - 0x34], eax
jle 0x10034542
mov dword [ebp - 0x5dc], 1
jmp 0x10034549
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x5dc]
sub eax, 0x53c8
jne 0x10034563
xor eax, eax
jne 0x10034563
and dword [ebp - 0x324], 0
jmp 0x1003456d
mov dword [ebp - 0x324], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x324]
sub ecx, dword [ebp + eax - 0x608]
je 0x1003458d
mov dword [ebp - 0x4a4], 1
jmp 0x10034594
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x4a4], eax
jle 0x100345ae
mov dword [ebp - 0x718], 1
jmp 0x100345b5
and dword [ebp - 0x718], 0
mov dword [ebp - 0x720], 0xfffffffd
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8b8]
call fcn.10023016
lea ecx, [ebp - 0x8e8]
call fcn.10030f89
mov dword [ebp - 0x578], eax
mov dword [ebp - 0x140], 0x90ac204e
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x730], 0x948b0815
mov dword [ebp - 0x140], 0
jmp 0x10034616
mov eax, dword [ebp - 0x140]
dec eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xfffffff3
jg 0x100346b6
mov dword [ebp - 0x728], 0x29bf390
mov dword [ebp - 0x738], 0xffffffff
push 0x3c62
push 0
push 0x3cf9
lea eax, [ebp - 0x728]
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.10032870
add esp, 0x14
mov dword [ebp - 0x12c], 0xfffffff1
jmp 0x10034672
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 8
jge 0x100346b1
mov dword [ebp - 0x32c], 0x43e95aad
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
lea eax, [ebp - 0x730]
push eax
push 0x427c
push 0
lea eax, [ebp - 0x738]
push eax
call fcn.1003333d
add esp, 0x10
jmp 0x10034665
jmp 0x10034609
mov byte [ebp - 0xb7], 0
movzx eax, byte [ebp - 0xb7]
test eax, eax
je 0x100346df
push 0xf52
push 0x19c9
push 0x11c7
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
movzx eax, byte [0x10666ccd]
test eax, eax
je 0x10034dfc
mov ecx, 0x10666de8
call fcn.1003aae3
movzx eax, al
test eax, eax
jne 0x10034dfc
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x18c], 0xffffffff
mov dword [ebp - 0x148], 6
push 3
lea ecx, [ebp - 0x8d0]
call fcn.10022f94
mov byte [ebp - 4], 4
mov dword [ebp - 0x2b8], 0xfffffff7
mov dword [ebp - 0x194], 0xec767dbf
mov dword [ebp - 0x35c], 8
mov dword [ebp - 0x758], 0xfffffffa
mov dword [ebp - 0x4c], 0
jmp 0x10034767
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x1003477d
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x620], 0xfffffff6
jmp 0x10034760
mov dword [ebp - 0x4c], 0
jmp 0x1003478d
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x100347a9
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x8d0]
call fcn.10023032
mov dword [eax], 0xfffffff9
jmp 0x10034786
mov dword [ebp - 0x30], 2
jmp 0x100347b9
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x10034800
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x110], 0
jmp 0x100347e2
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 3
jge 0x100347fe
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x620], 7
jmp 0x100347d5
jmp 0x100347b2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x620], 0xfffd
jbe 0x1003481f
mov dword [ebp - 0x564], 1
jmp 0x10034826
and dword [ebp - 0x564], 0
cmp dword [ebp - 0x564], 0xfffffff6
je 0x1003483b
mov dword [ebp - 0x334], 1
jmp 0x10034842
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0
je 0x1003486c
cmp dword [ebp - 0x18c], 0
je 0x1003486c
mov dword [ebp - 0x4ac], 1
jmp 0x10034873
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x4ac], eax
jge 0x1003488a
mov dword [ebp - 0x33c], 1
jmp 0x10034891
and dword [ebp - 0x33c], 0
cmp dword [ebp - 0x33c], 0x8ff7673e
jne 0x100348a9
mov dword [ebp - 0x5c4], 1
jmp 0x100348b0
and dword [ebp - 0x5c4], 0
cmp dword [ebp - 0x5c4], 0xfffffff7
jg 0x100348c5
mov dword [ebp - 0x344], 1
jmp 0x100348cc
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x148]
test eax, eax
je 0x100348fb
cmp dword [ebp - 0x18c], 0
je 0x100348fb
mov dword [ebp - 0x4b4], 1
jmp 0x10034902
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x674], eax
push 2
lea ecx, [ebp - 0x8d0]
call fcn.10023032
mov ecx, dword [ebp - 0x674]
mov dword [eax], ecx
mov eax, dword [ebp - 0x148]
sub eax, dword [ebp - 0x30]
jne 0x1003493e
mov dword [ebp - 0x34c], 1
jmp 0x10034945
and dword [ebp - 0x34c], 0
imul eax, dword [ebp - 0x34c], 0xce5f
mov dword [ebp - 0x2b8], eax
cmp dword [ebp - 0x2b8], 0
jne 0x10034970
cmp dword [ebp - 0x194], 0
jne 0x10034970
and dword [ebp - 0x56c], 0
jmp 0x1003497a
mov dword [ebp - 0x56c], 1
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x56c], eax
jl 0x10034994
mov dword [ebp - 0x748], 1
jmp 0x1003499b
and dword [ebp - 0x748], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x620]
mov dword [ebp - 0x9c4], eax
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x148], eax
jl 0x100349c8
mov dword [ebp - 0x354], 1
jmp 0x100349cf
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x354], eax
jl 0x100349e6
mov dword [ebp - 0x4bc], 1
jmp 0x100349ed
and dword [ebp - 0x4bc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4bc]
sub ecx, dword [ebp + eax - 0x620]
mov dword [ebp - 0x35c], ecx
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0x30], eax
jne 0x10034a29
mov dword [ebp - 0x5e4], 1
jmp 0x10034a30
and dword [ebp - 0x5e4], 0
cmp dword [ebp - 0x5e4], 1
je 0x10034a45
mov dword [ebp - 0x364], 1
jmp 0x10034a4c
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x364]
neg eax
je 0x10034a71
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x620], 0
je 0x10034a71
mov dword [ebp - 0x4c4], 1
jmp 0x10034a78
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x30], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x620]
cmp dword [ebp - 0x30], eax
jle 0x10034a9f
mov dword [ebp - 0x36c], 1
jmp 0x10034aa6
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x36c]
sub eax, 0x53c8
jne 0x10034ac0
xor eax, eax
jne 0x10034ac0
and dword [ebp - 0x574], 0
jmp 0x10034aca
mov dword [ebp - 0x574], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x574]
sub ecx, dword [ebp + eax - 0x620]
je 0x10034aea
mov dword [ebp - 0x374], 1
jmp 0x10034af1
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x374], eax
jle 0x10034b0b
mov dword [ebp - 0x750], 1
jmp 0x10034b12
and dword [ebp - 0x750], 0
mov dword [ebp - 0x758], 0xfffffffd
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8d0]
call fcn.10023016
lea eax, [ebp - 0x578]
push eax
lea eax, [ebp - 0x39c]
push eax
mov ecx, 0x10666de8
call fcn.1002f670
lea eax, [ebp - 0x9cc]
push eax
mov ecx, 0x10666de8
call fcn.1002f662
push eax
lea ecx, [ebp - 0x39c]
call fcn.1002f685
movzx eax, al
test eax, eax
je 0x10034dfc
mov dword [ebp - 0x4dc], 0x58e1
mov dword [ebp - 0x150], 0x6dd3ed23
mov dword [ebp - 0xc0], 0xbf81606d
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x2cc], 0x8188558b
mov dword [ebp - 0x19c], 0xa237ff9b
mov dword [ebp - 0x394], 1
lea eax, [ebp - 0x150]
push eax
push 0x797e
push 0x1702
lea eax, [ebp - 0x4dc]
push eax
push 0
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.10032eb8
add esp, 0x1c
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x91c], eax
cmp dword [ebp - 0xc0], 0
jbe 0x10034bf9
mov dword [ebp - 0x4cc], 1
jmp 0x10034c00
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x4cc], eax
je 0x10034c1d
cmp dword [ebp - 0x50], 0
je 0x10034c1d
mov dword [ebp - 0x7b8], 1
jmp 0x10034c24
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x924], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x50], eax
jge 0x10034c44
mov dword [ebp - 0x37c], 1
jmp 0x10034c4b
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x37c], eax
jl 0x10034c62
mov dword [ebp - 0x5cc], 1
jmp 0x10034c69
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x2cc], eax
jle 0x10034ca1
mov dword [ebp - 0x384], 1
jmp 0x10034ca8
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0xc0]
add eax, dword [ebp - 0x384]
sub eax, dword [ebp - 0xc0]
mov dword [ebp - 0x19c], eax
je 0x10034cd7
cmp dword [ebp - 0x19c], 0
je 0x10034cd7
mov dword [ebp - 0x4d4], 1
jmp 0x10034cde
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x4d4]
add eax, 0xc50e
cmp eax, 0x38dbec8b
jle 0x10034cfc
mov dword [ebp - 0x38c], 1
jmp 0x10034d03
and dword [ebp - 0x38c], 0
cmp dword [ebp - 0x38c], 1
jg 0x10034d18
mov dword [ebp - 0x57c], 1
jmp 0x10034d1f
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x394]
cmp dword [ebp - 0xc0], eax
jl 0x10034d45
mov dword [ebp - 0x794], 1
jmp 0x10034d4c
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x92c], eax
cmp dword [ebp - 0x19c], 0
jne 0x10034d7f
mov byte [ebp - 0x7a], 0
push 0x7f28
push 0x629
lea eax, [ebp - 0x7a]
push eax
push 0
call fcn.100334fe
add esp, 0x10
jmp 0x10034dce
mov dword [ebp - 0x744], 0
mov byte [ebp - 0x7c], 0
movzx eax, byte [ebp - 0x7c]
test eax, eax
je 0x10034dac
push 0xfdb
push 0x144
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
lea eax, [ebp - 0x744]
push eax
push 1
lea eax, [ebp - 0x2cc]
push eax
push 0xcdb
push 0x679
call fcn.10032870
add esp, 0x14
lea ecx, [ebp - 0x39c]
call fcn.1003aaec
mov eax, dword [eax + 4]
mov dword [ebp - 0x6c4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8e8]
call fcn.1002f453
mov eax, dword [ebp - 0x6c4]
jmp 0x10038f57
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x6c8], 0
mov dword [ebp - 0x158], 0
jmp 0x10034e30
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 3
jge 0x10034e4c
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x614], 0xf3b0639e
jmp 0x10034e23
mov dword [ebp - 0x1c], 0x13
jmp 0x10034e5c
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff3
jle 0x1003500a
mov dword [ebp - 0x3b4], 1
mov dword [ebp - 0x1a4], 1
mov dword [ebp - 0x6b4], 0x6193
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x10034e96
mov dword [ebp - 0x4e4], 1
jmp 0x10034e9d
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x1a4]
sub eax, dword [ebp - 0x1c]
je 0x10034ebd
cmp dword [ebp - 0x1a4], 0
je 0x10034ebd
mov dword [ebp - 0x5ec], 1
jmp 0x10034ec4
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x5ec]
add eax, 6
cmp eax, dword [ebp - 0x1a4]
jl 0x10034ee7
cmp dword [ebp - 0x1a4], 0
jne 0x10034ee7
and dword [ebp - 0x3a4], 0
jmp 0x10034ef1
mov dword [ebp - 0x3a4], 1
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x4e4], eax
je 0x10034f17
mov dword [ebp - 0x3ac], 1
jmp 0x10034f1e
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x3ac], eax
jge 0x10034f35
mov dword [ebp - 0x584], 1
jmp 0x10034f3c
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x584], eax
jg 0x10034f53
mov dword [ebp - 0x4ec], 1
jmp 0x10034f5a
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3b4], eax
mov eax, dword [ebp - 0x3b4]
cmp eax, dword [ebp - 0x4ec]
je 0x10034f7d
mov dword [ebp - 0x3bc], 1
jmp 0x10034f84
and dword [ebp - 0x3bc], 0
cmp dword [ebp - 0x3bc], 4
je 0x10034f9c
cmp dword [ebp - 0x1c], 0
jne 0x10034f9c
and dword [ebp - 0x5d4], 0
jmp 0x10034fa6
mov dword [ebp - 0x5d4], 1
cmp dword [ebp - 0x5d4], 0x667120dd
jle 0x10034fc7
mov eax, 0xba6a
test eax, eax
je 0x10034fc7
mov dword [ebp - 0x3c4], 1
jmp 0x10034fce
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x3c4]
jg 0x10034fe5
mov dword [ebp - 0x4f4], 1
jmp 0x10034fec
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x6b4]
add eax, dword [ebp - 0x4f4]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x614], eax
jmp 0x10034e55
cmp dword [ebp - 0x1c], 0
jne 0x10035051
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp + eax - 0x614], ecx
jge 0x1003502d
mov dword [ebp - 0x3cc], 1
jmp 0x10035034
and dword [ebp - 0x3cc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x614]
cmp dword [ebp - 0x3cc], eax
jg 0x10035051
and dword [ebp - 0x680], 0
jmp 0x1003505b
mov dword [ebp - 0x680], 1
xor eax, eax
inc eax
jne 0x10035078
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x614], 0
jne 0x10035078
and dword [ebp - 0x58c], 0
jmp 0x10035082
mov dword [ebp - 0x58c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x614]
add eax, dword [ebp - 0x58c]
cmp eax, dword [ebp - 0x6c8]
jne 0x100350a9
mov dword [ebp - 0x3d4], 1
jmp 0x100350b0
and dword [ebp - 0x3d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x614]
sub eax, 0x528b6b3
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x3d4]
jge 0x100350e2
mov dword [ebp - 0x4fc], 1
jmp 0x100350e9
and dword [ebp - 0x4fc], 0
imul eax, dword [ebp - 0x4fc], 0xca8c
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x614]
mov dword [ebp - 0x1c], eax
and dword [ebp - 0xe4], 0
lea eax, [ebp - 0x8e8]
push eax
call fcn.100319c3
pop ecx
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jne 0x10038d62
mov dword [ebp - 0x8f8], 0xd6c0
mov dword [ebp - 0x8f4], 0xd6c0
mov dword [ebp - 0x8f0], 0xd6c0
mov dword [ebp - 0x8ec], 0xd6c0
mov dword [ebp - 0x1ac], 0
jmp 0x1003516b
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 2
jge 0x10035187
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0x2ec], 0x8da8e97e
jmp 0x1003515e
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2ec], 0
jmp 0x100351b5
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2ec]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2ec], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2ec], 3
jg 0x100351e0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2ec]
cmp dword [ebp + eax*4 - 0x8f8], 0
je 0x100351de
jmp 0x100351e0
jmp 0x1003519a
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2ec], 0xfffffffe
cmp dword [0x10666cc4], 0
jne 0x10038889
mov dword [ebp - 0x688], 2
mov dword [ebp - 0xf8], 0x97a4a12b
push 1
lea ecx, [ebp - 0x9e0]
call fcn.10022f94
mov byte [ebp - 4], 5
mov dword [ebp - 0x168], 0
jmp 0x1003523c
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 1
jge 0x1003525e
push dword [ebp - 0x168]
lea ecx, [ebp - 0x9e0]
call fcn.10023032
mov dword [eax], 1
jmp 0x1003522f
mov eax, dword [ebp - 0x688]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf8], 0
jmp 0x10035283
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jg 0x100352f0
mov byte [ebp - 0x7e], 0
movzx eax, byte [ebp - 0x7e]
test eax, eax
je 0x100352d4
push 0x946
push 0x23c0
push 0x15fd
push 0x181f
push 0xdff
push 0x173
push 0xb6d
push 0x7e5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
mov byte [ebp - 0x80], 0
movzx eax, byte [ebp - 0x80]
test eax, eax
je 0x100352ee
push 0x18c6
push 1
call fcn.100328db
pop ecx
pop ecx
jmp 0x10035276
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9e0]
call fcn.10023016
mov dword [ebp - 0x6c], 6
mov dword [ebp - 0x6c], 0x11
jmp 0x10035316
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x11
jle 0x100355ed
mov dword [ebp - 0x88], 0xfffffffe
mov dword [ebp - 0x6d8], 0xaffa898c
push 0
lea eax, [ebp - 0x88]
push eax
push 0x7ba9
push 0x7ffc
call fcn.10033cb0
add esp, 0x10
mov eax, dword [ebp - 0x6c]
neg eax
je 0x10035377
mov byte [ebp - 0x7b], 0
lea eax, [ebp - 0x7b]
push eax
push 0x160c
push 0x3b1d
push 1
call fcn.1003292f
add esp, 0x10
jmp 0x100355e8
push 3
lea ecx, [ebp - 0x768]
call fcn.10022f94
mov byte [ebp - 4], 6
mov dword [ebp - 0x3ec], 1
push 1
lea eax, [ebp - 0x768]
push eax
push 0x1136
lea eax, [ebp - 0x934]
push eax
call fcn.100329ac
add esp, 0x10
mov dword [ebp - 0x88], 0
jmp 0x100353c8
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x2e
jl 0x100355d9
push 2
lea ecx, [ebp - 0x654]
call fcn.10022f94
mov byte [ebp - 4], 7
mov dword [ebp - 0xc8], 0xa18e418a
push 0
lea eax, [ebp - 0x93c]
push eax
lea eax, [ebp - 0x654]
push eax
call fcn.10032e0b
add esp, 0xc
mov dword [ebp - 0xc8], 1
jmp 0x10035421
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jl 0x10035458
mov dword [ebp - 0x6d0], 0x17c10977
push 1
push 0x7b97
push 0x2e3f
lea eax, [ebp - 0x654]
push eax
lea eax, [ebp - 0x6d0]
push eax
call fcn.10032a20
add esp, 0x14
jmp 0x10035414
cmp dword [ebp - 0x88], 0
je 0x100354ea
push 0
lea ecx, [ebp - 0x654]
call fcn.10023032
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xc8]
sub eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], eax
jne 0x10035494
mov dword [ebp - 0x3dc], 1
jmp 0x1003549b
and dword [ebp - 0x3dc], 0
cmp dword [ebp - 0x3dc], 0xbf3b
jle 0x100354b3
mov dword [ebp - 0x690], 1
jmp 0x100354ba
and dword [ebp - 0x690], 0
push 1
lea ecx, [ebp - 0x654]
call fcn.10023032
mov esi, dword [ebp - 0x88]
push 0
lea ecx, [ebp - 0x768]
call fcn.10023032
cmp esi, dword [eax]
jle 0x100354ea
mov dword [ebp - 0x5f4], 1
jmp 0x100354f1
and dword [ebp - 0x5f4], 0
push 0
lea ecx, [ebp - 0x768]
call fcn.10023032
mov eax, dword [eax]
sub eax, dword [ebp - 0x5f4]
cmp eax, 1
ja 0x10035517
mov dword [ebp - 0x3e4], 1
jmp 0x1003551e
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x3e4], eax
jl 0x10035535
mov dword [ebp - 0x504], 1
jmp 0x1003553c
and dword [ebp - 0x504], 0
push 0
lea ecx, [ebp - 0x768]
call fcn.10023032
mov ecx, dword [ebp - 0x504]
sub ecx, dword [eax]
mov dword [ebp - 0x3ec], ecx
cmp dword [ebp - 0x3ec], 0xffffffff
jne 0x1003556c
mov dword [ebp - 0x594], 1
jmp 0x10035573
and dword [ebp - 0x594], 0
cmp dword [ebp - 0x594], 1
jb 0x10035588
mov dword [ebp - 0x3f4], 1
jmp 0x1003558f
and dword [ebp - 0x3f4], 0
push 0
lea ecx, [ebp - 0x654]
call fcn.10023032
mov ecx, dword [ebp - 0x3f4]
cmp ecx, dword [eax]
jle 0x100355b2
mov dword [ebp - 0x50c], 1
jmp 0x100355b9
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x6d8], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x654]
call fcn.10023016
jmp 0x100353bb
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x768]
call fcn.10023016
jmp 0x1003530f
mov byte [ebp - 0xba], 0
push 1
push 0x6831
lea eax, [ebp - 0xba]
push eax
call fcn.10032aab
add esp, 0xc
mov byte [ebp - 0x218], 3
mov byte [ebp - 0x217], 0x6a
mov byte [ebp - 0x216], 8
mov byte [ebp - 0x215], 0x40
mov byte [ebp - 0x214], 4
mov byte [ebp - 0x213], 0x4b
mov byte [ebp - 0x212], 0xa
mov byte [ebp - 0x211], 9
mov byte [ebp - 0x210], 0x38
mov byte [ebp - 0x20f], 0x9c
mov byte [ebp - 0x20e], 0xe
mov byte [ebp - 0x20d], 0xdb
mov byte [ebp - 0x20c], 0x52
mov byte [ebp - 0x20b], 0xa2
mov byte [ebp - 0x20a], 0x57
mov byte [ebp - 0x209], 0x4e
mov byte [ebp - 0x208], 0xd2
mov byte [ebp - 0x207], 0x51
mov byte [ebp - 0x206], 0x26
mov byte [ebp - 0x205], 0xa1
mov byte [ebp - 0x204], 0x34
mov byte [ebp - 0x203], 0x57
mov byte [ebp - 0x202], 0xf3
mov byte [ebp - 0x201], 0x8f
mov byte [ebp - 0x200], 0x95
mov byte [ebp - 0x1ff], 0xa6
mov byte [ebp - 0x1fe], 0x33
mov byte [ebp - 0x1fd], 0x1f
mov byte [ebp - 0x1fc], 0x7e
mov byte [ebp - 0x1fb], 0x26
mov byte [ebp - 0x1fa], 0x8b
mov byte [ebp - 0x1f9], 0xc
mov byte [ebp - 0x1f8], 0x6c
mov byte [ebp - 0x1f7], 0x86
mov byte [ebp - 0x1f6], 0xa6
mov byte [ebp - 0x1f5], 0xe3
mov byte [ebp - 0x1f4], 0x4d
mov byte [ebp - 0x1f3], 0xec
mov byte [ebp - 0x1f2], 0x7f
mov byte [ebp - 0x1f1], 0x30
mov byte [ebp - 0x1f0], 0xdd
mov byte [ebp - 0x1ef], 0xea
mov byte [ebp - 0x1ee], 0xd3
mov byte [ebp - 0x1ed], 0x31
mov byte [ebp - 0x1ec], 0x32
mov byte [ebp - 0x1eb], 0xee
mov byte [ebp - 0x1ea], 0x92
mov byte [ebp - 0x1e9], 0x99
mov byte [ebp - 0x1e8], 0x6e
mov byte [ebp - 0x1e7], 0xad
mov byte [ebp - 0x1e6], 1
mov byte [ebp - 0x1e5], 0x3d
mov byte [ebp - 0x1e4], 0x73
mov byte [ebp - 0x1e3], 0xab
mov byte [ebp - 0x1e2], 0x60
mov byte [ebp - 0x1e1], 0xa4
mov byte [ebp - 0x1e0], 0x7e
mov byte [ebp - 0x1df], 0x66
mov byte [ebp - 0x1de], 0xcb
mov byte [ebp - 0x1dd], 5
mov byte [ebp - 0x1dc], 0xd
mov byte [ebp - 0x1db], 0x45
mov byte [ebp - 0x1da], 0xac
mov byte [ebp - 0x1d9], 0
mov byte [ebp - 0x1d8], 0xf6
mov byte [ebp - 0x1d7], 6
mov byte [ebp - 0x1d6], 0x5f
mov byte [ebp - 0x1d5], 5
mov byte [ebp - 0x1d4], 0x5f
mov byte [ebp - 0x1d3], 0
mov byte [ebp - 0x1d2], 0x27
mov byte [ebp - 0x1d1], 2
mov byte [ebp - 0x1d0], 0x39
mov byte [ebp - 0x1cf], 7
mov byte [ebp - 0x1ce], 0x40
mov byte [ebp - 0x1cd], 9
mov byte [ebp - 0x1cc], 0x56
mov byte [ebp - 0x1cb], 0xb
mov byte [ebp - 0x1ca], 8
mov byte [ebp - 0x1c9], 1
mov byte [ebp - 0x1c8], 9
mov dword [ebp - 0x1b4], 0x25b9b55b
mov dword [ebp - 0x944], 0x89351f20
push 2
lea ecx, [ebp - 0x87c]
call fcn.10022f94
mov byte [ebp - 4], 8
mov dword [ebp - 0x698], 0x4c266d8f
push 0x5cd4
push 1
lea eax, [ebp - 0x87c]
push eax
lea eax, [ebp - 0x94c]
push eax
call fcn.10032b0c
add esp, 0x10
mov dword [ebp - 0x1b4], 0
jmp 0x100358a6
mov eax, dword [ebp - 0x1b4]
dec eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0xfffffff0
jne 0x10035960
mov dword [ebp - 0x954], 0xffffffff
mov dword [ebp - 0x95c], 3
mov dword [ebp - 0x964], 0xffffffff
push 3
lea ecx, [ebp - 0x864]
call fcn.10022f94
mov byte [ebp - 4], 9
mov dword [ebp - 0x96c], 1
mov dword [ebp - 0x170], 0
jmp 0x10035905
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 3
jge 0x10035924
push dword [ebp - 0x170]
lea ecx, [ebp - 0x864]
call fcn.10023032
and dword [eax], 0
jmp 0x100358f8
lea eax, [ebp - 0x698]
push eax
push 0
call fcn.1003327c
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x87c]
push eax
lea eax, [ebp - 0x864]
push eax
call fcn.10032c09
add esp, 0xc
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x864]
call fcn.10023016
jmp 0x10035899
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x87c]
call fcn.10023016
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x218]
or eax, 4
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x218]
and ecx, 4
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x218]
mov word [ebp + ecx*2 - 0x914], ax
mov dword [ebp - 0x64], 0x20f89b54
mov dword [ebp - 0x294], 0xfffffff6
mov dword [ebp - 0x68], 0
jmp 0x100359ca
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x100359e0
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0xa78], 0xc85f70ad
jmp 0x100359c3
mov dword [ebp - 0x68], 0
jmp 0x100359f0
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x10035a06
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0xa68], 0xfffffff9
jmp 0x100359e9
mov dword [ebp - 0x64], 0
jmp 0x10035a16
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jg 0x10035a6e
mov dword [ebp - 0x6e0], 5
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x10035a40
push 0x163a
push 0
call fcn.10032e83
pop ecx
pop ecx
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0xa78]
mov dword [ebp - 0x3fc], eax
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x3fc]
mov dword [ebp + eax*4 - 0xa78], ecx
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x6e0], eax
jmp 0x10035a0f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa78], 0xd058a835
jne 0x10035a8d
mov dword [ebp - 0x404], 1
jmp 0x10035a94
and dword [ebp - 0x404], 0
cmp dword [ebp - 0x294], 0
je 0x10035aa3
cmp dword [ebp - 0x64], 0
jne 0x10035ab2
cmp dword [ebp - 0x64], 0
jne 0x10035ab2
and dword [ebp - 0x5fc], 0
jmp 0x10035abc
mov dword [ebp - 0x5fc], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa68]
cmp dword [ebp - 0x5fc], eax
jne 0x10035ad8
cmp dword [ebp - 0x294], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x294]
je 0x10035af8
mov eax, 0x787d6364
test eax, eax
je 0x10035af8
mov dword [ebp - 0x514], 1
jmp 0x10035aff
and dword [ebp - 0x514], 0
mov eax, dword [ebp - 0x404]
cmp eax, dword [ebp - 0x514]
jg 0x10035b19
mov dword [ebp - 0x40c], 1
jmp 0x10035b20
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x2c], 2
and dword [ebp - 0x190], 0
jmp 0x10035b41
mov eax, dword [ebp - 0x2c]
inc eax
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x51
jae 0x1003627e
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x218]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x2c], eax
jne 0x10035df1
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x218]
inc eax
mov dword [ebp - 0x190], eax
push 3
lea ecx, [ebp - 0x9f0]
call fcn.10022f94
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x1c4], 0
mov dword [ebp - 0x1bc], 0
jmp 0x10035bac
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 3
jge 0x10035bce
push dword [ebp - 0x1bc]
lea ecx, [ebp - 0x9f0]
call fcn.10023032
mov dword [eax], 0x7571177e
jmp 0x10035b9f
mov dword [ebp - 0x1c4], 2
jmp 0x10035be7
mov eax, dword [ebp - 0x1c4]
dec eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
jl 0x10035c6c
mov dword [ebp - 0x178], 0x1e2c0d37
mov dword [ebp - 0x178], 2
jmp 0x10035c13
mov eax, dword [ebp - 0x178]
dec eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
jl 0x10035c4d
mov dword [ebp - 0x6a0], 1
cmp dword [ebp - 0x6a0], 0
je 0x10035c31
jmp 0x10035c4d
mov byte [ebp - 0xb3], 0
movzx eax, byte [ebp - 0xb3]
test eax, eax
je 0x10035c4b
push 1
call fcn.10032b82
pop ecx
jmp 0x10035c06
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x10035c67
push 1
call fcn.10032bab
pop ecx
jmp 0x10035bda
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9f0]
call fcn.10023016
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x218]
mov ecx, dword [ebp - 0x2c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x2c], eax
push 4
lea ecx, [ebp - 0x894]
call fcn.10022f94
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x180], 0x532fe223
push 0x3625
push 0x7d63
lea eax, [ebp - 0x894]
push eax
lea eax, [ebp - 0x974]
push eax
push 0
call fcn.10033133
add esp, 0x14
mov dword [ebp - 0x180], 3
jmp 0x10035ce6
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jl 0x10035ddd
mov dword [ebp - 0x1c0], 0
jmp 0x10035d0c
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 1
jge 0x10035d28
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0x130], 8
jmp 0x10035cff
mov byte [ebp - 0x7f], 0
movzx eax, byte [ebp - 0x7f]
test eax, eax
je 0x10035d48
push 1
push 0x51ca
push 0x1fc3
call fcn.10032c09
add esp, 0xc
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x130], 0
jmp 0x10035d76
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x130]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x130], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x130], 3
jg 0x10035dd8
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x120], 0
jmp 0x10035da9
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 4
jge 0x10035dd6
push 0x2050
push 0x53d8
push 1
lea eax, [ebp - 0x894]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.10032c79
add esp, 0x14
jmp 0x10035d9c
jmp 0x10035d5b
jmp 0x10035cd9
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x894]
call fcn.10023016
jmp 0x10035b39
mov dword [ebp - 0x48], 0x2eb90da1
mov dword [ebp - 0x48], 0
jmp 0x10035e08
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xffffffe3
jne 0x100360c8
mov dword [ebp - 0x90], 1
mov dword [ebp - 0xd8], 3
mov dword [ebp - 0x90], 0xffffffeb
jmp 0x10035e3f
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 8
jg 0x100360c3
mov dword [ebp - 0x51c], 4
push 4
lea ecx, [ebp - 0x8ac]
call fcn.10022f94
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x6e8], 0x3637b304
mov dword [ebp - 0x6a8], 1
push 0
lea eax, [ebp - 0x97c]
push eax
lea eax, [ebp - 0x8ac]
push eax
push 0x794f
push 0x2102
call fcn.10032d61
add esp, 0x14
cmp dword [ebp - 0x48], 0xa5f2
jge 0x10035eb2
mov dword [ebp - 0x59c], 1
jmp 0x10035eb9
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x48]
cmp dword [ebp - 0x59c], eax
jg 0x10035ed9
cmp dword [ebp - 0x51c], 0
jne 0x10035ed9
and dword [ebp - 0x414], 0
jmp 0x10035ee3
mov dword [ebp - 0x414], 1
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x414], eax
je 0x10035f03
mov eax, 0xd022
test eax, eax
jne 0x10035f03
and dword [ebp - 0x41c], 0
jmp 0x10035f0d
mov dword [ebp - 0x41c], 1
mov eax, dword [ebp - 0x51c]
cmp dword [ebp - 0x41c], eax
je 0x10035f27
mov dword [ebp - 0x2c8], 1
jmp 0x10035f2e
and dword [ebp - 0x2c8], 0
push 3
lea ecx, [ebp - 0x8ac]
call fcn.10023032
mov ecx, dword [ebp - 0x2c8]
mov dword [eax], ecx
cmp dword [ebp - 0x2c8], 0
jne 0x10035f5b
cmp dword [ebp - 0x48], 0
jne 0x10035f5b
and dword [ebp - 0x5e0], 0
jmp 0x10035f65
mov dword [ebp - 0x5e0], 1
imul eax, dword [ebp - 0x5e0], 0xb0b4
test eax, eax
jne 0x10035f82
cmp dword [ebp - 0x48], 0
jne 0x10035f82
and dword [ebp - 0x424], 0
jmp 0x10035f8c
mov dword [ebp - 0x424], 1
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jne 0x10035fad
mov dword [ebp - 0x524], 1
jmp 0x10035fb4
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x6e8]
cmp dword [ebp - 0x524], eax
je 0x10035fce
mov dword [ebp - 0x42c], 1
jmp 0x10035fd5
and dword [ebp - 0x42c], 0
cmp dword [ebp - 0x42c], 0x2718
jge 0x10035fed
mov dword [ebp - 0x5a4], 1
jmp 0x10035ff4
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x5a4]
add eax, 0x628e
cmp eax, dword [ebp - 0x90]
je 0x10036013
mov dword [ebp - 0x434], 1
jmp 0x1003601a
and dword [ebp - 0x434], 0
cmp dword [ebp - 0x434], 0xffffffff
jb 0x1003602f
mov dword [ebp - 0x52c], 1
jmp 0x10036036
and dword [ebp - 0x52c], 0
cmp dword [ebp - 0x52c], 0xfffffffe
jae 0x10036054
cmp dword [ebp - 0x90], 0
je 0x10036054
mov dword [ebp - 0x43c], 1
jmp 0x1003605b
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x43c]
lea eax, [eax + ecx + 1]
mov dword [ebp - 0x6a8], eax
mov dword [ebp - 0xd8], 0
jmp 0x10036087
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jg 0x100360af
mov byte [ebp - 0x91], 0
lea eax, [ebp - 0x91]
push eax
push 0
push 0x1e95
call fcn.10033f9e
add esp, 0xc
jmp 0x1003607a
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8ac]
call fcn.10023016
jmp 0x10035e32
jmp 0x10035e01
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x217]
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x190]
movzx ecx, byte [ebp + ecx - 0x21a]
movzx ecx, word [ebp + ecx*2 - 0x914]
or eax, ecx
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x217]
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x190]
movzx edx, byte [ebp + edx - 0x21a]
movzx edx, word [ebp + edx*2 - 0x914]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x218]
mov word [ebp + ecx*2 - 0x914], ax
mov dword [ebp - 0x98], 1
mov dword [ebp - 0x1a8], 0xf0796840
mov dword [ebp - 0x6f0], 0
mov dword [ebp - 0x188], 0
jmp 0x10036160
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 2
jge 0x1003617c
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0x820], 0xffffffff
jmp 0x10036153
mov eax, 0x51cd
test eax, eax
je 0x1003619a
cmp dword [ebp - 0x98], 0
je 0x1003619a
mov dword [ebp - 0x444], 1
jmp 0x100361a1
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x984], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x98c], eax
mov eax, dword [ebp - 0x98]
sub eax, 0x3b2c57e7
mov dword [ebp - 0x5f0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5f0]
mov dword [ebp + eax - 0x820], ecx
mov eax, dword [ebp - 0x5f0]
add eax, 0xa31e
imul eax, eax, 0x7c69
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x994], eax
mov eax, dword [ebp - 0x1a8]
cmp dword [ebp - 0x444], eax
jge 0x1003621c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x820], 0
mov eax, dword [ebp - 0x1a8]
add eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x98]
jl 0x1003623c
mov dword [ebp - 0x534], 1
jmp 0x10036243
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
sub eax, dword [ebp - 0x98]
mov dword [ebp - 0x6f0], eax
mov byte [ebp - 0x81], 0
push 0
lea eax, [ebp - 0x81]
push eax
push 0x5a61
call fcn.10032d03
add esp, 0xc
and dword [ebp - 0x190], 0
jmp 0x10035b39
push 4
lea ecx, [ebp - 0x2d8]
call fcn.10022f94
mov byte [ebp - 4], 0xd
push 2
lea ecx, [ebp - 0x778]
call fcn.10022f94
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x20], 0
jmp 0x100362b0
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x100362c6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x838], 0
jmp 0x100362a9
mov dword [ebp - 0x20], 0
jmp 0x100362d6
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x100362f2
push dword [ebp - 0x20]
lea ecx, [ebp - 0x2d8]
call fcn.10023032
mov dword [eax], 0x743d837b
jmp 0x100362cf
mov dword [ebp - 0x20], 0
jmp 0x10036302
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1003631e
push dword [ebp - 0x20]
lea ecx, [ebp - 0x778]
call fcn.10023032
mov dword [eax], 0x5c29478c
jmp 0x100362fb
push 0
lea ecx, [ebp - 0x2d8]
call fcn.10023032
mov dword [eax], 3
jmp 0x10036357
push 0
lea ecx, [ebp - 0x2d8]
call fcn.10023032
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x44c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x44c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x2d8]
call fcn.10023032
cmp dword [eax], 0
jl 0x100364cd
mov dword [ebp - 0xa0], 0x61c0f806
mov dword [ebp - 0x6f8], 1
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x1003639e
push 0x1411
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
mov dword [ebp - 0xa0], 0
jmp 0x100363b7
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jg 0x100364c8
mov dword [ebp - 0x6b0], 0xfc6088b9
push 0
lea ecx, [ebp - 0x2d8]
call fcn.10023032
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x838]
mov dword [ebp - 0x99c], eax
push 0
lea ecx, [ebp - 0x2d8]
call fcn.10023032
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x838]
mov dword [ebp - 0x9a8], eax
cmp dword [ebp - 0xa0], 0
jl 0x10036431
push 0
lea ecx, [ebp - 0x2d8]
call fcn.10023032
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x838], 0
jne 0x10036431
and dword [ebp - 0x5ac], 0
jmp 0x1003643b
mov dword [ebp - 0x5ac], 1
cmp dword [ebp - 0x5ac], 0xf1fdbd01
jbe 0x10036453
mov dword [ebp - 0x454], 1
jmp 0x1003645a
and dword [ebp - 0x454], 0
push 0
lea ecx, [ebp - 0x2d8]
call fcn.10023032
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x838]
add eax, dword [ebp - 0x454]
mov dword [ebp - 0x53c], eax
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x53c]
mov dword [ebp + eax*4 - 0x838], ecx
mov eax, dword [ebp - 0x6b0]
imul eax, dword [ebp - 0x53c]
cmp eax, dword [ebp - 0xa0]
jne 0x100364b0
mov dword [ebp - 0x45c], 1
jmp 0x100364b7
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x6f8], eax
jmp 0x100363aa
jmp 0x10036333
push 1
lea ecx, [ebp - 0x778]
call fcn.10023032
and dword [eax], 0
jmp 0x10036503
push 1
lea ecx, [ebp - 0x778]
call fcn.10023032
mov dword [ebp - 0x5e8], eax
mov eax, dword [ebp - 0x5e8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x5e8]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x778]
call fcn.10023032
cmp dword [eax], 3
jg 0x1003656a
mov dword [ebp - 0xe8], 0xcd9796a
mov dword [ebp - 0xe8], 0
jmp 0x10036538
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 4
jge 0x10036565
push 0
push 0x605a
push 0x3675
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x2d8]
push eax
call fcn.1003370c
add esp, 0x14
jmp 0x1003652b
jmp 0x100364df
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x778]
call fcn.10023016
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2d8]
call fcn.10023016
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0x914], cx
lea eax, [ebp - 0x914]
push eax
lea ecx, [ebp - 0xb14]
call fcn.1003aa75
mov dword [ebp - 0x6b8], eax
mov eax, dword [ebp - 0x6b8]
mov dword [ebp - 0x700], eax
mov byte [ebp - 4], 0xf
push dword [ebp - 0x700]
call fcn.100319c3
pop ecx
mov dword [ebp - 0x4e8], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xb14]
call fcn.1002f453
mov dword [ebp - 0x100], 0xfff6
push 1
lea ecx, [ebp - 0x870]
call fcn.10022f94
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x9b0], 0xdb8e9646
push 0x4f8f
push 0x5a01
lea eax, [ebp - 0x9b8]
push eax
lea eax, [ebp - 0x870]
push eax
push 0x4eda
push 0
call fcn.10033a46
add esp, 0x18
cmp dword [ebp - 0x100], 0
je 0x10036658
mov byte [ebp - 0x89], 0
push 1
push 0x6e17
lea eax, [ebp - 0x89]
push eax
call fcn.10032d03
add esp, 0xc
jmp 0x10036746
mov dword [ebp - 0x6c0], 3
mov dword [ebp - 0x100], 0x17
jmp 0x1003667b
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0xe
jg 0x10036746
mov dword [ebp - 0x70], 1
mov dword [ebp - 0x9c0], 0x4fc2285f
push 1
lea ecx, [ebp - 0xa00]
call fcn.10022f94
mov byte [ebp - 4], 0x11
push 1
push 0x14f1
push 0x2ff1
lea eax, [ebp - 0xa00]
push eax
lea eax, [ebp - 0x9c8]
push eax
call fcn.10032d61
add esp, 0x14
mov dword [ebp - 0x70], 9
jmp 0x100366dc
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xfffffff5
jl 0x1003670a
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x10036708
push 1
push 0x7f5e
push 0x5628
call fcn.10032e0b
add esp, 0xc
jmp 0x100366d5
mov dword [ebp - 0x70], 0
jmp 0x1003671a
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x16
je 0x10036732
lea eax, [ebp - 0x6c0]
push eax
push 1
call fcn.10032e83
pop ecx
pop ecx
jmp 0x10036713
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xa00]
call fcn.10023016
jmp 0x1003666e
push 0x7bb2
push 0
lea eax, [ebp - 0x870]
push eax
call fcn.10033996
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x870]
call fcn.10023016
and dword [ebp - 0x1b8], 0
jmp 0x10036781
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0xd
jae 0x10036e84
mov dword [ebp - 0x630], 0x3c692bea
mov dword [ebp - 0x62c], 0x3c692bea
mov dword [ebp - 0x628], 0x3c692bea
mov dword [ebp - 0x624], 0x3c692bea
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x79c], 0x310e27a8
push 1
lea ecx, [ebp - 0x8c4]
call fcn.10022f94
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x6d4], 0xaa97
push 0x710
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x8c4]
push eax
push 0x2bee
push 1
push 0x55bf
push 0x7b04
call fcn.10032eb8
add esp, 0x1c
mov dword [ebp - 0x118], 0
jmp 0x10036827
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 2
jge 0x10036843
mov eax, dword [ebp - 0x118]
mov dword [ebp + eax*4 - 0x9a4], 0x9fc89503
jmp 0x1003681a
mov dword [ebp - 0x78], 3
jmp 0x10036853
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jl 0x10036e60
mov dword [ebp - 0x14], 0x3c633843
push 1
lea ecx, [ebp - 0x800]
call fcn.10022f94
mov byte [ebp - 4], 0x13
push 2
lea ecx, [ebp - 0x788]
call fcn.10022f94
mov byte [ebp - 4], 0x14
mov dword [ebp - 0xd0], 0xffffffff
mov dword [ebp - 0x108], 0
jmp 0x100368a9
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jge 0x100368cb
push dword [ebp - 0x108]
lea ecx, [ebp - 0x800]
call fcn.10023032
mov dword [eax], 0xbb9cf7d1
jmp 0x1003689c
lea eax, [ebp - 0x788]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x291b
push 0x60a9
push 1
call fcn.10033133
add esp, 0x14
mov dword [ebp - 0x14], 3
jmp 0x100368fd
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x10036e0b
mov dword [ebp - 0x3c], 0xd81479b6
mov dword [ebp - 0x29c], 0xffffffff
push 2
lea ecx, [ebp - 0x660]
call fcn.10022f94
mov byte [ebp - 4], 0x15
push 1
push 0x56b8
lea eax, [ebp - 0x660]
push eax
lea eax, [ebp - 0x918]
push eax
call fcn.100331dd
add esp, 0x10
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x14], eax
jne 0x1003696a
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x630], 0
je 0x1003696a
mov dword [ebp - 0x708], 1
jmp 0x10036971
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa48], eax
cmp dword [ebp - 0x14], 0
jne 0x1003698f
cmp dword [ebp - 0x3c], 0
jne 0x1003698f
and dword [ebp - 0x464], 0
jmp 0x10036999
mov dword [ebp - 0x464], 1
cmp dword [ebp - 0x464], 0x2bc8
jg 0x100369ba
mov eax, 0x611ca4b3
test eax, eax
je 0x100369ba
mov dword [ebp - 0x544], 1
jmp 0x100369c1
and dword [ebp - 0x544], 0
cmp dword [ebp - 0x544], 0x2b416c28
je 0x100369d9
mov dword [ebp - 0x46c], 1
jmp 0x100369e0
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x46c], eax
jl 0x100369fa
cmp dword [ebp - 0x3c], 0
jne 0x100369fa
and dword [ebp - 0x5b4], 0
jmp 0x10036a04
mov dword [ebp - 0x5b4], 1
cmp dword [ebp - 0x5b4], 0
jg 0x10036a19
mov dword [ebp - 0x474], 1
jmp 0x10036a20
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x474], eax
jge 0x10036a37
mov dword [ebp - 0x54c], 1
jmp 0x10036a3e
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x54c], eax
jle 0x10036a55
mov dword [ebp - 0x47c], 1
jmp 0x10036a5c
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x47c]
sub eax, dword [ebp - 0x3c]
jne 0x10036a87
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x630], 0
je 0x10036a87
mov dword [ebp - 0x5d8], 1
jmp 0x10036a8e
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x5d8], eax
je 0x10036aa5
mov dword [ebp - 0x484], 1
jmp 0x10036aac
and dword [ebp - 0x484], 0
cmp dword [ebp - 0x484], 0x563
jle 0x10036ac4
mov dword [ebp - 0x554], 1
jmp 0x10036acb
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x554]
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x29c]
imul eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jge 0x10036af2
mov dword [ebp - 0x710], 1
jmp 0x10036af9
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xa50], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa58], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x630]
mov dword [ebp - 0xa60], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x14]
cmp dword [ebp + eax - 0x630], ecx
jge 0x10036b3b
mov dword [ebp - 0x6cc], 1
jmp 0x10036b42
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xa98], eax
push 1
lea ecx, [ebp - 0x788]
call fcn.10023032
mov dword [eax], 0xc5ebb4ee
push 0
lea ecx, [ebp - 0x660]
call fcn.10023032
mov ecx, dword [ebp - 0x78]
cmp dword [eax], ecx
jg 0x10036b87
mov dword [ebp - 0x2f4], 1
jmp 0x10036b8e
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x2f4]
cmp eax, 0xcfe74d02
jae 0x10036baa
mov dword [ebp - 0x2f8], 1
jmp 0x10036bb1
and dword [ebp - 0x2f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x630]
cmp dword [ebp - 0x2f8], eax
jne 0x10036bd2
mov dword [ebp - 0x300], 1
jmp 0x10036bd9
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x300], eax
jg 0x10036bf0
mov dword [ebp - 0x308], 1
jmp 0x10036bf7
and dword [ebp - 0x308], 0
mov esi, dword [ebp - 0x308]
neg esi
push 0
lea ecx, [ebp - 0x660]
call fcn.10023032
cmp esi, dword [eax]
jl 0x10036c1c
mov dword [ebp - 0x310], 1
jmp 0x10036c23
and dword [ebp - 0x310], 0
push 0
lea ecx, [ebp - 0x660]
call fcn.10023032
mov ecx, dword [ebp - 0x310]
cmp ecx, dword [eax]
jle 0x10036c46
mov dword [ebp - 0x318], 1
jmp 0x10036c4d
and dword [ebp - 0x318], 0
imul eax, dword [ebp - 0x318], 0x76f0
test eax, eax
jne 0x10036c76
push 1
lea ecx, [ebp - 0x660]
call fcn.10023032
cmp dword [eax], 0
jne 0x10036c76
and dword [ebp - 0x320], 0
jmp 0x10036c80
mov dword [ebp - 0x320], 1
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x320], eax
jg 0x10036c97
mov dword [ebp - 0x328], 1
jmp 0x10036c9e
and dword [ebp - 0x328], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x630]
add eax, dword [ebp - 0x328]
cmp dword [ebp - 0x14], eax
je 0x10036cc2
mov dword [ebp - 0x330], 1
jmp 0x10036cc9
and dword [ebp - 0x330], 0
push 1
lea ecx, [ebp - 0x788]
call fcn.10023032
mov esi, eax
push 1
lea ecx, [ebp - 0x788]
call fcn.10023032
mov ecx, dword [ebp - 0x330]
imul ecx, dword [eax]
sub ecx, 0xe685
cmp dword [esi], ecx
jle 0x10036d04
mov dword [ebp - 0x338], 1
jmp 0x10036d0b
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x29c]
cmp dword [ebp - 0x338], eax
jle 0x10036d25
mov dword [ebp - 0x340], 1
jmp 0x10036d2c
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x79c], eax
push 0
lea ecx, [ebp - 0x8c4]
call fcn.10023032
mov dword [eax], 8
push 8
pop eax
sub eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x78]
jge 0x10036d62
mov dword [ebp - 0x348], 1
jmp 0x10036d69
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x348]
je 0x10036d80
mov dword [ebp - 0x350], 1
jmp 0x10036d87
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0xd0], eax
mov esi, dword [ebp - 0xd0]
push 0
lea ecx, [ebp - 0x800]
call fcn.10023032
add esi, dword [eax]
mov dword [ebp - 0x358], esi
push 0
lea ecx, [ebp - 0x800]
call fcn.10023032
mov ecx, dword [ebp - 0x358]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6d4]
cmp dword [ebp - 0x358], eax
jg 0x10036ddd
mov dword [ebp - 0x360], 1
jmp 0x10036de4
and dword [ebp - 0x360], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x360]
mov dword [ebp + eax - 0x9a4], ecx
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x660]
call fcn.10023016
jmp 0x100368f6
mov dword [ebp - 0xd0], 3
jmp 0x10036e24
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jl 0x10036e3d
push 0x727a
push 1
call fcn.1003327c
pop ecx
pop ecx
jmp 0x10036e17
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x788]
call fcn.10023016
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x800]
call fcn.10023016
jmp 0x1003684c
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8c4]
call fcn.10023016
xor eax, eax
mov ecx, dword [ebp - 0x1b8]
mov word [ebp + ecx*2 - 0x914], ax
jmp 0x10036774
push 2
lea ecx, [ebp - 0x63c]
call fcn.10022f94
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x6f4], 0xffffffff
mov dword [ebp - 0x7ac], 0xffffffff
mov dword [ebp - 0x198], 0
jmp 0x10036ec2
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 2
jge 0x10036ee4
push dword [ebp - 0x198]
lea ecx, [ebp - 0x63c]
call fcn.10023032
mov dword [eax], 0x13b91020
jmp 0x10036eb5
push 0
lea ecx, [ebp - 0x63c]
call fcn.10023032
and dword [eax], 0
jmp 0x10036f1a
push 0
lea ecx, [ebp - 0x63c]
call fcn.10023032
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x368]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x368]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x63c]
call fcn.10023032
cmp dword [eax], 0x1a
jge 0x10037026
mov dword [ebp - 0x74c], 0
mov dword [ebp - 0x6dc], 0x3923ccde
mov dword [ebp - 0x6e4], 0xb994b748
mov dword [ebp - 0x7a4], 0xfffffff9
push 3
lea ecx, [ebp - 0x888]
call fcn.10022f94
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x6ec], 0x30b91300
mov dword [ebp - 0x754], 0xad5b481d
push 0
lea eax, [ebp - 0x888]
push eax
push 0x203c
lea eax, [ebp - 0xa84]
push eax
push 0x3a91
push 0x73da
call fcn.1003a885
add esp, 0x18
push 0xcfb
push 0x7f16
push 0x5b60
push 1
call fcn.100332bd
add esp, 0x10
lea eax, [ebp - 0x74c]
push eax
lea eax, [ebp - 0x888]
push eax
lea eax, [ebp - 0x6dc]
push eax
push 0x15c6
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x7ac]
push eax
lea eax, [ebp - 0x6e4]
push eax
lea eax, [ebp - 0x754]
push eax
lea eax, [ebp - 0x6ec]
push eax
lea eax, [ebp - 0x7a4]
push eax
push 0
lea eax, [ebp - 0x6f4]
push eax
call fcn.10033adf
add esp, 0x30
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x888]
call fcn.10023016
jmp 0x10036ef6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x63c]
call fcn.10023016
cmp dword [ebp - 0x4e8], 0
je 0x10038889
mov dword [ebp - 0x128], 0x53b26bdd
mov dword [ebp - 0x128], 6
jmp 0x10037065
mov eax, dword [ebp - 0x128]
dec eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xfffffff1
jle 0x10037097
cmp dword [ebp - 0x128], 0
je 0x10037079
jmp 0x10037097
mov byte [ebp - 0x79], 0
push 0x4eb8
lea eax, [ebp - 0x79]
push eax
push 1
push 0x235e
call fcn.1003333d
add esp, 0x10
jmp 0x10037058
mov dword [ebp - 0xe0], 1
mov dword [ebp - 0x1b0], 0
jmp 0x100370ba
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 4
jge 0x100370d6
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0xaa8], 0xa8eac8b
jmp 0x100370ad
mov dword [ebp - 0xe0], 0
jmp 0x100370ef
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jg 0x10037114
mov eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0xe0]
mov eax, dword [ebp + eax*4 - 0xaa8]
mov dword [ebp + ecx*4 - 0xaa8], eax
jmp 0x100370e2
mov byte [ebp - 0xb4], 0
movzx eax, byte [ebp - 0xb4]
test eax, eax
je 0x1003713a
push 0
push 0xfb0
push 0x51b
push 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [ebp - 0x288], 1
mov byte [ebp - 0x287], 0x1c
mov byte [ebp - 0x286], 2
mov byte [ebp - 0x285], 0xe
mov byte [ebp - 0x284], 0x55
mov byte [ebp - 0x283], 0x22
mov byte [ebp - 0x282], 2
mov byte [ebp - 0x281], 0xdb
mov byte [ebp - 0x280], 0x64
mov byte [ebp - 0x27f], 0xc4
mov byte [ebp - 0x27e], 0x52
mov byte [ebp - 0x27d], 0x9b
mov byte [ebp - 0x27c], 0xab
mov byte [ebp - 0x27b], 0x2c
mov byte [ebp - 0x27a], 8
mov byte [ebp - 0x279], 0xc4
mov byte [ebp - 0x278], 0x96
mov byte [ebp - 0x277], 0xe0
mov byte [ebp - 0x276], 0x80
mov byte [ebp - 0x275], 0x36
mov byte [ebp - 0x274], 0xec
mov byte [ebp - 0x273], 0xaa
mov byte [ebp - 0x272], 0x43
mov byte [ebp - 0x271], 0x61
mov byte [ebp - 0x270], 0xfd
mov byte [ebp - 0x26f], 0x79
mov byte [ebp - 0x26e], 0x37
mov byte [ebp - 0x26d], 0x42
mov byte [ebp - 0x26c], 4
mov byte [ebp - 0x26b], 0x3e
mov byte [ebp - 0x26a], 0xd1
mov byte [ebp - 0x269], 0x5d
mov byte [ebp - 0x268], 0xb
mov byte [ebp - 0x267], 0xe0
mov byte [ebp - 0x266], 0xc
mov byte [ebp - 0x265], 0x6d
mov byte [ebp - 0x264], 0x24
mov byte [ebp - 0x263], 0x9b
mov byte [ebp - 0x262], 0x22
mov byte [ebp - 0x261], 0xc1
mov byte [ebp - 0x260], 0x28
mov byte [ebp - 0x25f], 0x56
mov byte [ebp - 0x25e], 0x54
mov byte [ebp - 0x25d], 0x76
mov byte [ebp - 0x25c], 0x57
mov byte [ebp - 0x25b], 0xc8
mov byte [ebp - 0x25a], 0xc3
mov byte [ebp - 0x259], 0x83
mov byte [ebp - 0x258], 6
mov byte [ebp - 0x257], 0x8d
mov byte [ebp - 0x256], 0x99
mov byte [ebp - 0x255], 0xc8
mov byte [ebp - 0x254], 0x36
mov byte [ebp - 0x253], 0x64
mov byte [ebp - 0x252], 9
mov byte [ebp - 0x251], 0x23
mov byte [ebp - 0x250], 0xc2
mov byte [ebp - 0x24f], 0xc1
mov byte [ebp - 0x24e], 0xe8
mov byte [ebp - 0x24d], 0x20
mov byte [ebp - 0x24c], 0xfc
mov byte [ebp - 0x24b], 0x81
mov byte [ebp - 0x24a], 0x73
mov byte [ebp - 0x249], 0xdc
mov byte [ebp - 0x248], 0xe3
mov byte [ebp - 0x247], 0xd0
mov byte [ebp - 0x246], 0x63
mov byte [ebp - 0x245], 0x3c
mov byte [ebp - 0x244], 0xde
mov byte [ebp - 0x243], 0x14
mov byte [ebp - 0x242], 0xf9
mov byte [ebp - 0x241], 0xe1
mov byte [ebp - 0x240], 0x90
mov byte [ebp - 0x23f], 0xf7
mov byte [ebp - 0x23e], 0x2f
mov byte [ebp - 0x23d], 0x2e
mov byte [ebp - 0x23c], 0xb7
mov byte [ebp - 0x23b], 0xe8
mov byte [ebp - 0x23a], 0x15
mov byte [ebp - 0x239], 0x2d
mov byte [ebp - 0x238], 0x2f
mov byte [ebp - 0x237], 0x8f
mov byte [ebp - 0x236], 0xa9
mov byte [ebp - 0x235], 0x2a
mov byte [ebp - 0x234], 0x87
mov byte [ebp - 0x233], 0x2e
mov byte [ebp - 0x232], 0xa1
mov byte [ebp - 0x231], 0xdd
mov byte [ebp - 0x230], 0xc5
mov byte [ebp - 0x22f], 0xde
mov byte [ebp - 0x22e], 8
mov byte [ebp - 0x22d], 0
mov byte [ebp - 0x22c], 0
mov byte [ebp - 0x22b], 0x2d
mov byte [ebp - 0x22a], 0xa
mov byte [ebp - 0x229], 0x35
mov byte [ebp - 0x228], 5
mov byte [ebp - 0x227], 0x10
mov byte [ebp - 0x226], 6
mov byte [ebp - 0x225], 0xb
mov byte [ebp - 0x224], 9
mov byte [ebp - 0x223], 0x10
mov byte [ebp - 0x222], 7
mov byte [ebp - 0x221], 0
mov byte [ebp - 0x220], 3
mov byte [ebp - 0x21f], 0x16
mov byte [ebp - 0x21e], 4
mov byte [ebp - 0x21d], 0x28
mov byte [ebp - 0x21c], 0xb
mov byte [ebp - 0x21b], 0x1b
mov dword [ebp - 0x44], 0x9fdf99ff
mov dword [ebp - 0x380], 0x943af780
mov dword [ebp - 0x174], 0
jmp 0x10037466
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 3
jge 0x10037482
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0xac4], 9
jmp 0x10037459
mov dword [ebp - 0x44], 0
jmp 0x10037492
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xfffffff2
jge 0x1003767e
mov dword [ebp - 0x2bc], 0xeb71
push 1
lea ecx, [ebp - 0x818]
call fcn.10022f94
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x3a0], 7
mov dword [ebp - 0x17c], 0
jmp 0x100374da
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 1
jge 0x100374fc
push dword [ebp - 0x17c]
lea ecx, [ebp - 0x818]
call fcn.10023032
mov dword [eax], 0x62395e2d
jmp 0x100374cd
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x10037522
push 0
push 0x781b
push 0x1c18
call fcn.10033d26
add esp, 0xc
mov eax, dword [ebp - 0x2bc]
sub eax, dword [ebp - 0x44]
jne 0x1003762f
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x2bc]
test eax, eax
jbe 0x1003754b
mov dword [ebp - 0x370], 1
jmp 0x10037552
and dword [ebp - 0x370], 0
push 0
lea ecx, [ebp - 0x818]
call fcn.10023032
mov ecx, dword [ebp - 0x370]
cmp ecx, dword [eax]
jg 0x10037575
mov dword [ebp - 0x378], 1
jmp 0x1003757c
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x378]
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x380]
sub eax, 0x3cc3fe81
jne 0x100375aa
cmp dword [ebp - 0x2bc], 0
jne 0x100375aa
and dword [ebp - 0x388], 0
jmp 0x100375b4
mov dword [ebp - 0x388], 1
imul eax, dword [ebp - 0x388], 0x3b01
test eax, eax
je 0x100375e0
push 0
lea ecx, [ebp - 0x818]
call fcn.10023032
cmp dword [eax], 0
je 0x100375e0
mov dword [ebp - 0x390], 1
jmp 0x100375e7
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x390]
add eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x44]
jne 0x10037608
mov dword [ebp - 0x398], 1
jmp 0x1003760f
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0x3a0]
add eax, 3
jne 0x1003762f
and dword [ebp - 0x2f0], 0
jmp 0x10037639
mov dword [ebp - 0x2f0], 1
cmp dword [ebp - 0x2f0], 0xfffb
ja 0x10037651
mov dword [ebp - 0x3b0], 1
jmp 0x10037658
and dword [ebp - 0x3b0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3b0]
mov dword [ebp + eax - 0xac4], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x818]
call fcn.10023016
jmp 0x1003748b
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x288]
or eax, 0x73
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x288]
and ecx, 0x73
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x288]
mov byte [ebp + ecx - 0x670], al
mov dword [ebp - 0x28], 2
and dword [ebp - 0x154], 0
jmp 0x100376cf
mov eax, dword [ebp - 0x28]
inc eax
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x6e
jae 0x10038165
mov dword [ebp - 0xec], 1
mov dword [ebp - 0x75c], 4
mov dword [ebp - 0xec], 0x17
jmp 0x10037706
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x11
jg 0x100377c0
mov dword [ebp - 0xc4], 0
mov dword [ebp - 0x134], 0
jmp 0x10037736
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 4
jge 0x10037752
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0xae4], 0xa2768935
jmp 0x10037729
mov dword [ebp - 0xc4], 0
jmp 0x1003776b
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jg 0x10037788
mov eax, dword [ebp - 0xc4]
cmp dword [ebp + eax*4 - 0xae4], 0
je 0x10037786
jmp 0x10037788
jmp 0x1003775e
lea eax, [ebp - 0xec]
push eax
push 0x6042
push 0x40bc
lea eax, [ebp - 0xc4]
push eax
push 1
push 0x11fa
lea eax, [ebp - 0x75c]
push eax
push 0x1365
call fcn.10033397
add esp, 0x20
jmp 0x100376f9
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x288]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x28], eax
jne 0x10037d8d
push 2
lea ecx, [ebp - 0x8a0]
call fcn.10022f94
mov byte [ebp - 4], 0x19
push 3
lea ecx, [ebp - 0x648]
call fcn.10022f94
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0xf4], 0
jmp 0x10037816
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jge 0x10037835
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x8a0]
call fcn.10023032
and dword [eax], 0
jmp 0x10037809
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x648]
push eax
push 0x6550
push 1
call fcn.100334fe
add esp, 0x10
push 1
lea ecx, [ebp - 0x648]
call fcn.10023032
and dword [eax], 0
jmp 0x10037888
push 1
lea ecx, [ebp - 0x648]
call fcn.10023032
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3b8]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x648]
call fcn.10023032
cmp dword [eax], 1
jg 0x1003797f
mov dword [ebp - 0x6fc], 0xa50b5f0
mov dword [ebp - 0x704], 7
mov dword [ebp - 0x790], 0xcf456574
push 2
lea ecx, [ebp - 0x84c]
call fcn.10022f94
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x76c], 0xe483bbb6
mov dword [ebp - 0x13c], 0
jmp 0x100378f0
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 2
jge 0x10037912
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x84c]
call fcn.10023032
mov dword [eax], 0xfffffffd
jmp 0x100378e3
push 0x391
lea eax, [ebp - 0x6fc]
push eax
lea eax, [ebp - 0x8a0]
push eax
lea eax, [ebp - 0x790]
push eax
push 0x3cd4
push 1
lea eax, [ebp - 0x704]
push eax
lea eax, [ebp - 0x648]
push eax
call fcn.10033587
add esp, 0x20
push 1
lea eax, [ebp - 0x76c]
push eax
lea eax, [ebp - 0x84c]
push eax
push 0x4d0b
push 0xb21
call fcn.1003370c
add esp, 0x14
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x84c]
call fcn.10023016
jmp 0x10037864
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x648]
call fcn.10023016
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8a0]
call fcn.10023016
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x288]
inc eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x40], 0xfffffff7
mov dword [ebp - 0x798], 0x5169ff4c
mov dword [ebp - 0x40], 0
jmp 0x100379d0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xe
jge 0x10037b99
mov dword [ebp - 0xfc], 9
mov dword [ebp - 0x2a4], 0xffffffff
cmp dword [ebp - 0xfc], 0
je 0x10037a3b
mov dword [ebp - 0xfc], 0
jmp 0x10037a10
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0xfffffff6
jg 0x10037a36
push 0x3aa4
push 0x7e4
lea eax, [ebp - 0x2a4]
push eax
push 1
call fcn.10033774
add esp, 0x10
jmp 0x10037a03
jmp 0x10037b94
mov dword [ebp - 0x3c0], 0xffffffff
push 3
lea ecx, [ebp - 0x7dc]
call fcn.10022f94
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x7dc]
push eax
push 1
push 0x481f
push 0x1099
lea eax, [ebp - 0xa94]
push eax
call fcn.100337e5
add esp, 0x14
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x10037a9b
push 0
push 0
push 0x1d48
push 0
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
mov eax, dword [ebp - 0x3c0]
add eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x2a4]
cmp eax, dword [ebp - 0x3c0]
jl 0x10037abe
mov dword [ebp - 0x3c8], 1
jmp 0x10037ac5
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x3c8], eax
jg 0x10037ae2
cmp dword [ebp - 0x2a4], 0
jne 0x10037ae2
and dword [ebp - 0x70c], 0
jmp 0x10037aec
mov dword [ebp - 0x70c], 1
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x920], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xa80], eax
push 1
lea ecx, [ebp - 0x7dc]
call fcn.10023032
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x40], eax
jge 0x10037b31
push 1
lea ecx, [ebp - 0x7dc]
call fcn.10023032
cmp dword [eax], 0
je 0x10037b31
mov dword [ebp - 0x3d0], 1
jmp 0x10037b38
and dword [ebp - 0x3d0], 0
cmp dword [ebp - 0x3d0], 0x87642760
jbe 0x10037b53
cmp dword [ebp - 0x40], 0
je 0x10037b53
and dword [ebp - 0x3d8], 0
jmp 0x10037b5d
mov dword [ebp - 0x3d8], 1
cmp dword [ebp - 0x3d8], 0xfffffffd
jne 0x10037b72
mov dword [ebp - 0x3e0], 1
jmp 0x10037b79
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x798], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x7dc]
call fcn.10023016
jmp 0x100379c9
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x288]
mov ecx, dword [ebp - 0x28]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x104], 0xfffffff8
mov dword [ebp - 0x714], 0x715cc48b
mov dword [ebp - 0x3e8], 0x95e3b372
push 4
lea ecx, [ebp - 0x80c]
call fcn.10022f94
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x928], 0xe4c2
mov dword [ebp - 0x77c], 0x859bb7a1
mov dword [ebp - 0x2c0], 1
mov dword [ebp - 0x54], 0
jmp 0x10037c0b
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x10037c27
push dword [ebp - 0x54]
lea ecx, [ebp - 0x80c]
call fcn.10023032
mov dword [eax], 0x58382bdb
jmp 0x10037c04
mov dword [ebp - 0x54], 0
jmp 0x10037c37
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x10037c4d
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xab8], 1
jmp 0x10037c30
cmp dword [ebp - 0x104], 2
jle 0x10037cb1
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x714], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x9d4], eax
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x930], eax
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0xa54], eax
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x938], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xab8]
mov dword [ebp - 0x9e4], eax
mov eax, dword [ebp - 0x77c]
cmp dword [ebp - 0x104], eax
je 0x10037cd2
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x10037cd2
mov dword [ebp - 0x3f0], 1
jmp 0x10037cd9
and dword [ebp - 0x3f0], 0
cmp dword [ebp - 0x3f0], 1
jge 0x10037cee
mov dword [ebp - 0x3f8], 1
jmp 0x10037cf5
and dword [ebp - 0x3f8], 0
push 1
lea ecx, [ebp - 0x80c]
call fcn.10023032
mov ecx, dword [ebp - 0x3f8]
cmp ecx, dword [eax]
jge 0x10037d18
mov dword [ebp - 0x71c], 1
jmp 0x10037d1f
and dword [ebp - 0x71c], 0
push 1
lea ecx, [ebp - 0x80c]
call fcn.10023032
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x104]
mov dword [ebp + eax - 0xab8], ecx
mov byte [ebp - 0xb6], 0
push 0x1110
lea eax, [ebp - 0xb6]
push eax
push 0x4333
push 0x7002
push 0x7d77
push 1
push 0x7ed6
push 0x54ae
push 0x410c
call fcn.1003387c
add esp, 0x24
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x80c]
call fcn.10023016
jmp 0x100376c7
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x287]
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x154]
movzx ecx, byte [ebp + ecx - 0x28a]
movsx ecx, byte [ebp + ecx - 0x670]
or eax, ecx
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [ebp + ecx - 0x287]
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x154]
movzx edx, byte [ebp + edx - 0x28a]
movsx edx, byte [ebp + edx - 0x670]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [ebp + ecx - 0x288]
mov byte [ebp + ecx - 0x670], al
mov dword [ebp - 0xd4], 1
mov dword [ebp - 0x940], 0x5cf0adc1
mov dword [ebp - 0xa88], 6
mov dword [ebp - 0x948], 0xb69c93e3
mov dword [ebp - 0x410], 1
mov dword [ebp - 0x724], 9
mov dword [ebp - 0x9f4], 0x26cdee94
mov dword [ebp - 0x2ac], 0xaec5
mov dword [ebp - 0x78c], 0
mov dword [ebp - 0xd4], 0xfffffffa
jmp 0x10037e60
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0xe
jge 0x100380a1
push 2
lea ecx, [ebp - 0x7f4]
call fcn.10022f94
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0xcc], 9
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x58], 0
jmp 0x10037ea2
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x10037ebe
push dword [ebp - 0x58]
lea ecx, [ebp - 0x7f4]
call fcn.10023032
mov dword [eax], 1
jmp 0x10037e9b
mov dword [ebp - 0x58], 0
jmp 0x10037ece
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x10037ee4
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x828], 0
jmp 0x10037ec7
mov byte [ebp - 0xa9], 0
push 0
lea eax, [ebp - 0xa9]
push eax
call fcn.10033fef
pop ecx
pop ecx
mov dword [ebp - 0xcc], 1
jmp 0x10037f14
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jl 0x1003808d
mov dword [ebp - 0xa8], 0x1220985a
mov dword [ebp - 0xa8], 1
jmp 0x10037f44
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x10038088
mov dword [ebp - 0x144], 0xb143e95a
mov dword [ebp - 0x144], 1
jmp 0x10037f74
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
jl 0x10038083
mov dword [ebp - 0x14c], 0x898f01ba
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x7f4]
call fcn.10023032
mov esi, eax
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x7f4]
call fcn.10023032
mov ecx, dword [esi]
mov dword [eax], ecx
mov dword [ebp - 0x14c], 0
jmp 0x10037fcc
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 8
jle 0x1003807e
mov dword [ebp - 0x7a0], 0xae7b1b0c
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x950], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xcc]
mov dword [ebp + eax - 0x828], ecx
mov dword [ebp - 0x10c], 0
jmp 0x1003801b
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffe4
jle 0x10038079
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xa5c], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x958], eax
cmp dword [ebp - 0x7a0], 0xfffc
jg 0x1003805a
mov eax, 0xb1af9d66
test eax, eax
jne 0x1003805a
and dword [ebp - 0x400], 0
jmp 0x10038064
mov dword [ebp - 0x400], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x400]
mov dword [ebp + eax - 0x828], ecx
jmp 0x1003800e
jmp 0x10037fbf
jmp 0x10037f67
jmp 0x10037f37
jmp 0x10037f07
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x7f4]
call fcn.10023016
jmp 0x10037e53
mov eax, dword [ebp - 0x724]
cmp dword [ebp - 0xd4], eax
jge 0x100380bb
mov dword [ebp - 0x408], 1
jmp 0x100380c2
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x2ac]
sub eax, dword [ebp - 0x408]
cmp eax, 0xffffffff
ja 0x100380ec
mov dword [ebp - 0x418], 1
jmp 0x100380f3
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x410], eax
je 0x10038113
cmp dword [ebp - 0x410], 0
jne 0x10038113
and dword [ebp - 0x420], 0
jmp 0x1003811d
mov dword [ebp - 0x420], 1
mov eax, dword [ebp - 0x418]
cmp eax, dword [ebp - 0x420]
jg 0x10038137
mov dword [ebp - 0x428], 1
jmp 0x1003813e
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x78c], eax
lea eax, [ebp - 0x154]
push eax
push 1
push 0x2baf
call fcn.10033996
add esp, 0xc
jmp 0x100376c7
push 2
lea ecx, [ebp - 0x7d0]
call fcn.10022f94
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x478], 1
lea eax, [ebp - 0x114]
push eax
push 1
lea eax, [ebp - 0x7d0]
push eax
call fcn.100339d8
add esp, 0xc
mov dword [ebp - 0x114], 0
jmp 0x100381b8
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 2
jge 0x100381d4
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0xa3c], 0xfffffffc
jmp 0x100381ab
mov dword [ebp - 0x18], 1
jmp 0x100381e4
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x10038489
mov dword [ebp - 0x15c], 0xb8faaaeb
mov dword [ebp - 0xdc], 0x132d7af2
mov dword [ebp - 0x2c4], 0
mov dword [ebp - 0x470], 0x3b839bf5
mov dword [ebp - 0x72c], 0x8de905f4
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x7d0]
push eax
push 0x3c3d
push 0x312
lea eax, [ebp - 0x18]
push eax
push 1
call fcn.10033a46
add esp, 0x18
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x430], eax
push 1
lea ecx, [ebp - 0x7d0]
call fcn.10023032
mov ecx, dword [ebp - 0x430]
mov dword [eax], ecx
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xaa32f3f6
ja 0x1003828b
mov dword [ebp - 0x468], 1
jmp 0x10038292
and dword [ebp - 0x468], 0
cmp dword [ebp - 0xdc], 0
je 0x1003835d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xa04], eax
cmp dword [ebp - 0x18], 0
je 0x100382c0
cmp dword [ebp - 0x18], 0
je 0x100382c0
mov dword [ebp - 0x438], 1
jmp 0x100382c7
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x438]
cmp eax, dword [ebp - 0xdc]
jg 0x100382e4
mov dword [ebp - 0x440], 1
jmp 0x100382eb
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x440], eax
je 0x10038305
cmp dword [ebp - 0x18], 0
jne 0x10038305
and dword [ebp - 0x448], 0
jmp 0x1003830f
mov dword [ebp - 0x448], 1
cmp dword [ebp - 0x448], 0x2f23d37f
jne 0x10038327
mov dword [ebp - 0x450], 1
jmp 0x1003832e
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0x2c4]
add ecx, dword [ebp - 0x450]
imul eax, ecx
sub eax, dword [ebp - 0x18]
jne 0x10038351
cmp dword [ebp - 0xdc], 0
je 0x1003835d
mov dword [ebp - 0x458], 1
jmp 0x10038364
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x2c4]
imul eax, dword [ebp - 0x458]
cmp eax, dword [ebp - 0x18]
jne 0x10038382
mov dword [ebp - 0x460], 1
jmp 0x10038389
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x460]
imul eax, dword [ebp - 0x468]
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x478], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x478]
mov dword [ebp + eax - 0xa3c], ecx
cmp dword [ebp - 0x72c], 1
jb 0x100383d3
mov dword [ebp - 0x480], 1
jmp 0x100383da
and dword [ebp - 0x480], 0
cmp dword [ebp - 0x480], 0xb209
jl 0x100383f2
mov dword [ebp - 0x488], 1
jmp 0x100383f9
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x2c4]
imul eax, dword [ebp - 0x488]
test eax, eax
je 0x10038416
mov dword [ebp - 0x490], 1
jmp 0x1003841d
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x490], eax
jl 0x10038434
mov dword [ebp - 0x498], 1
jmp 0x1003843b
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x498], eax
jl 0x10038455
mov dword [ebp - 0x4a0], 1
jmp 0x1003845c
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x4a0], eax
jge 0x10038473
mov dword [ebp - 0x7a8], 1
jmp 0x1003847a
and dword [ebp - 0x7a8], 0
mov dword [ebp - 0xdc], 0
jmp 0x100381dd
mov byte [ebp - 0xb8], 0
push 0x421d
push 0x1a32
push 0xf7c
lea eax, [ebp - 0xb8]
push eax
push 0xc77
push 0x2f79
push 0xec4
push 0x71b
push 0x4ded
push 0x1f78
push 1
push 0x339
call fcn.10033adf
add esp, 0x30
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x7d0]
call fcn.10023016
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x670], 0
lea eax, [ebp - 0x670]
push eax
lea ecx, [ebp - 0xafc]
call fcn.10022e6d
mov byte [ebp - 4], 0x20
push 1
lea ecx, [ebp - 0x858]
call fcn.10022f94
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x960], 0x606de713
push 1
lea ecx, [ebp - 0xa10]
call fcn.10022f94
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x2b4], 0xd568d526
mov dword [ebp - 0x11c], 0
jmp 0x10038555
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 1
jge 0x10038577
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x858]
call fcn.10023032
mov dword [eax], 0x5568
jmp 0x10038548
push 1
push 0x58df
lea eax, [ebp - 0xa10]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.10033cb0
add esp, 0x10
mov eax, dword [ebp - 0x2b4]
dec eax
mov dword [ebp - 0x2b4], eax
push 1
lea eax, [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x858]
push eax
call fcn.10033d26
add esp, 0xc
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xa10]
call fcn.10023016
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x858]
call fcn.10023016
and dword [ebp - 0x164], 0
jmp 0x100385ed
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0xd
jae 0x1003885c
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x2a0], 0x6717b38e
mov dword [ebp - 0x4d0], 0x7c8a36a7
mov dword [ebp - 0x4e0], 0xd6ba8dad
mov dword [ebp - 0x73c], 0x33f2a6ad
mov dword [ebp - 0x60], 0
jmp 0x10038639
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 4
jge 0x1003864f
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0xad4], 0xfffffffa
jmp 0x10038632
mov dword [ebp - 0x60], 0
jmp 0x1003865f
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x10038675
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0xa20], 0x6ae3d475
jmp 0x10038658
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jne 0x10038689
mov dword [ebp - 0x4a8], 1
jmp 0x10038690
and dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x4a8], 0xfffffff8
jne 0x100386ab
cmp dword [ebp - 0x10], 0
je 0x100386ab
mov dword [ebp - 0x4b0], 1
jmp 0x100386b2
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x4b0], eax
jle 0x100386c9
mov dword [ebp - 0x4b8], 1
jmp 0x100386d0
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x4b8], eax
jne 0x100386e7
mov dword [ebp - 0x734], 1
jmp 0x100386ee
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xa28], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x968], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x10]
jl 0x10038717
mov dword [ebp - 0x4c0], 1
jmp 0x1003871e
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x4c0]
cmp eax, 0xfd52
je 0x1003873b
mov dword [ebp - 0x290], 1
jmp 0x10038742
and dword [ebp - 0x290], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x290]
mov dword [ebp + eax - 0xad4], ecx
cmp dword [ebp - 0x290], 9
jle 0x1003876d
cmp dword [ebp - 0x10], 0
jne 0x1003876d
and dword [ebp - 0x298], 0
jmp 0x10038777
mov dword [ebp - 0x298], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x298]
mov dword [ebp + eax - 0xa20], ecx
cmp dword [ebp - 0x298], 0
jne 0x100387a3
push 6
pop eax
test eax, eax
jne 0x100387a3
and dword [ebp - 0x7b0], 0
jmp 0x100387ad
mov dword [ebp - 0x7b0], 1
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0xa14], eax
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x970], eax
push 3
pop eax
sub eax, dword [ebp - 0x2a0]
imul eax, dword [ebp - 0x10]
cmp eax, 0x81b5
jne 0x100387e5
mov dword [ebp - 0x4c8], 1
jmp 0x100387ec
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0xa2c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x10]
cmp dword [ebp + eax - 0xa20], ecx
jle 0x10038826
mov dword [ebp - 0x4d8], 1
jmp 0x1003882d
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x73c], eax
mov eax, dword [ebp - 0x164]
mov byte [ebp + eax - 0x670], 0
jmp 0x100385e0
push 0
push 0
lea eax, [ebp - 0xafc]
push eax
push dword [ebp - 0x4e8]
call fcn.1003993e
add esp, 0x10
mov dword [0x10666cc4], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xafc]
call fcn.10022ef5
mov dword [ebp - 0x38], 0xe1a3622b
push 2
lea ecx, [ebp - 0x2e4]
call fcn.10022f94
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x518], 0
mov dword [ebp - 0x568], 0x1361131e
mov dword [ebp - 0x550], 0xa603d2cf
push 0x2e4d
lea eax, [ebp - 0x2e4]
push eax
push 1
lea eax, [ebp - 0x124]
push eax
push 0x30d
call fcn.10033d9a
add esp, 0x14
mov dword [ebp - 0x124], 0
jmp 0x100388fa
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 1
jge 0x10038916
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x978], 8
jmp 0x100388ed
mov esi, dword [ebp - 0x38]
push 1
lea ecx, [ebp - 0x2e4]
call fcn.10023032
mov dword [eax], esi
mov dword [ebp - 0x38], 0
jmp 0x10038938
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jg 0x10038d35
mov dword [ebp - 0x24], 0xcb8ce3e6
mov dword [ebp - 0x24], 1
jmp 0x10038959
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x10038d30
push 1
lea ecx, [ebp - 0x7e8]
call fcn.10022f94
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x520], 0xa3bd
lea eax, [ebp - 0xa24]
push eax
push 0x5451
push 0x6fc3
lea eax, [ebp - 0x7e8]
push eax
push 1
push 0x492d
call fcn.10033e44
add esp, 0x18
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2e4]
call fcn.10023032
cmp dword [eax], 0
jne 0x100389c4
mov dword [ebp - 0x2a8], 1
jmp 0x100389cb
and dword [ebp - 0x2a8], 0
cmp dword [ebp - 0x24], 0
je 0x100389e3
cmp dword [ebp - 0x24], 0
je 0x100389e3
mov dword [ebp - 0x4f0], 1
jmp 0x100389ea
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x4f0], eax
jne 0x10038a01
mov dword [ebp - 0x7b4], 1
jmp 0x10038a08
and dword [ebp - 0x7b4], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2e4]
call fcn.10023032
cmp dword [eax], 7
je 0x10038a27
mov dword [ebp - 0x4f8], 1
jmp 0x10038a2e
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x518]
cmp dword [ebp - 0x4f8], eax
jg 0x10038a48
mov dword [ebp - 0x500], 1
jmp 0x10038a4f
and dword [ebp - 0x500], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2e4]
call fcn.10023032
mov eax, dword [eax]
add eax, dword [ebp - 0x500]
cmp eax, dword [ebp - 0x24]
jge 0x10038a76
mov dword [ebp - 0x508], 1
jmp 0x10038a7d
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x520]
cmp dword [ebp - 0x508], eax
jle 0x10038a97
mov dword [ebp - 0x510], 1
jmp 0x10038a9e
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x510]
inc eax
cmp eax, dword [ebp - 0x518]
jg 0x10038ab9
mov dword [ebp - 0x678], 1
jmp 0x10038ac0
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x980], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xa34], eax
push 0
lea ecx, [ebp - 0x7e8]
call fcn.10023032
mov ecx, dword [ebp - 0x2a8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x520]
add eax, 0x758e
cmp dword [ebp - 0x2a8], eax
je 0x10038b06
mov dword [ebp - 0x528], 1
jmp 0x10038b0d
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x528], eax
jl 0x10038b24
mov dword [ebp - 0x530], 1
jmp 0x10038b2b
and dword [ebp - 0x530], 0
cmp dword [ebp - 0x530], 0xb8e0
jle 0x10038b43
mov dword [ebp - 0x538], 1
jmp 0x10038b4a
and dword [ebp - 0x538], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2e4]
call fcn.10023032
mov ecx, dword [ebp - 0x538]
cmp ecx, dword [eax]
jl 0x10038b6e
mov dword [ebp - 0x540], 1
jmp 0x10038b75
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x540], eax
jle 0x10038b8c
mov dword [ebp - 0x548], 1
jmp 0x10038b93
and dword [ebp - 0x548], 0
cmp dword [ebp - 0x548], 0x1e9942c3
jl 0x10038bab
mov dword [ebp - 0x67c], 1
jmp 0x10038bb2
and dword [ebp - 0x67c], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x2e4]
call fcn.10023032
mov eax, dword [eax]
inc eax
je 0x10038be1
mov dword [ebp - 0x988], 0xf162
mov eax, dword [ebp - 0x550]
inc eax
mov dword [ebp - 0x550], eax
jmp 0x10038d1c
mov dword [ebp - 0x68c], 0xe161e417
mov dword [ebp - 0x16c], 0
jmp 0x10038c04
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 2
jge 0x10038c20
mov eax, dword [ebp - 0x16c]
mov dword [ebp + eax*4 - 0x840], 0xd14a
jmp 0x10038bf7
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x840]
inc eax
cmp eax, 0xfce24956
jne 0x10038c41
mov dword [ebp - 0x558], 1
jmp 0x10038c48
and dword [ebp - 0x558], 0
push 1
lea ecx, [ebp - 0x2e4]
call fcn.10023032
cmp dword [eax], 0x6128b293
jl 0x10038c6c
cmp dword [ebp - 0x24], 0
je 0x10038c6c
and dword [ebp - 0x560], 0
jmp 0x10038c76
mov dword [ebp - 0x560], 1
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0x560]
sub eax, dword [ebp - 0x38]
cmp dword [ebp - 0x568], eax
jge 0x10038c9f
mov dword [ebp - 0x2b0], 1
jmp 0x10038ca6
and dword [ebp - 0x2b0], 0
push 0
lea ecx, [ebp - 0x7e8]
call fcn.10023032
mov ecx, dword [ebp - 0x2b0]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x840]
cmp dword [ebp - 0x2b0], eax
jl 0x10038cdc
mov dword [ebp - 0x570], 1
jmp 0x10038ce3
and dword [ebp - 0x570], 0
imul eax, dword [ebp - 0x570], 0xffff
test eax, eax
jne 0x10038cfd
mov dword [ebp - 0x684], 1
jmp 0x10038d04
and dword [ebp - 0x684], 0
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2e4]
call fcn.10023032
mov dword [ebp - 0x68c], 0x9d3b05e2
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x7e8]
call fcn.10023016
jmp 0x10038952
jmp 0x10038931
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2e4]
call fcn.10023016
cmp dword [0x10666cc4], 0
je 0x10038d62
mov ecx, dword [ebp + 8]
call fcn.1003aa9a
push eax
call dword [0x10666cc4]
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
je 0x10038dae
movzx eax, byte [0x10666ccd]
test eax, eax
je 0x10038d87
mov ecx, 0x10666de8
call fcn.1003aae3
movzx eax, al
test eax, eax
jne 0x10038dae
lea eax, [ebp - 0x578]
push eax
mov ecx, 0x10666de8
call fcn.1003aaa5
mov ecx, dword [ebp - 0xe4]
mov dword [eax], ecx
push 1
push 0x10666ccd
call fcn.10033f71
pop ecx
pop ecx
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0xb0], 0x2cb3a3fc
mov dword [ebp - 0x694], 1
mov dword [ebp - 0x74], 0xffffffe5
jmp 0x10038dd9
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 7
je 0x10038dfe
mov byte [ebp - 0xb1], 0
push 0x840
push 1
lea eax, [ebp - 0xb1]
push eax
call fcn.10033f9e
add esp, 0xc
jmp 0x10038dd2
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0xb0], eax
jg 0x10038e1d
xor eax, eax
inc eax
je 0x10038e1d
mov dword [ebp - 0x580], 1
jmp 0x10038e24
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x580], eax
jl 0x10038e3e
mov dword [ebp - 0x588], 1
jmp 0x10038e45
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x588]
jg 0x10038e68
cmp dword [ebp - 0xb0], 0
jne 0x10038e68
and dword [ebp - 0x590], 0
jmp 0x10038e72
mov dword [ebp - 0x590], 1
mov eax, dword [ebp - 0x694]
cmp dword [ebp - 0x590], eax
jle 0x10038e8c
mov dword [ebp - 0x598], 1
jmp 0x10038e93
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
je 0x10038efd
mov dword [ebp - 0x5a0], 0xafbd13d
mov dword [ebp - 0x69c], 0x7eb8e136
cmp dword [ebp - 0x5a0], 0
jne 0x10038ed7
cmp dword [ebp - 0x5a0], 0
jne 0x10038ed7
and dword [ebp - 0x5a8], 0
jmp 0x10038ee1
mov dword [ebp - 0x5a8], 1
mov eax, dword [ebp - 0x5a8]
mov dword [ebp - 0x69c], eax
push 1
push 0x4bfe
call fcn.10033fef
pop ecx
pop ecx
jmp 0x10038f36
mov dword [ebp - 0x6a4], 0x58c458a9
mov eax, dword [ebp - 0x74]
add eax, 0x69d1fe90
cmp eax, dword [ebp - 0x6a4]
jle 0x10038f23
mov dword [ebp - 0x5b0], 1
jmp 0x10038f2a
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x5b0]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x6ac], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8e8]
call fcn.1002f453
mov eax, dword [ebp - 0x6ac]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret