Function at 0x1002d369
Capabilities:
Encrypt data using speck
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006147b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0xab0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x30]
test eax, eax
je 0x1002d74d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x700], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x708], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x6d8], eax
mov eax, dword [ebp + 0x40]
mov dword [ebp - 0x648], eax
lea eax, [ebp + 0x3c]
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x59c]
movzx eax, byte [eax]
test eax, eax
je 0x1002d6d3
mov dword [ebp - 0x388], 0x6ba8
mov dword [ebp - 0x650], 0x1000a348
cmp dword [ebp - 0x388], 0x6d4a
jle 0x1002d4a5
and dword [ebp - 0x1c8], 0
jmp 0x1002d412
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0x34f3
jge 0x1002d4a5
and dword [ebp - 0xf4], 0
jmp 0x1002d438
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0x5cf1
jge 0x1002d4a0
and dword [ebp - 0xec], 0
jmp 0x1002d45a
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x43f8
jge 0x1002d49e
mov eax, dword [ebp - 0x1c8]
imul eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0xec]
cdq
mov dword [ebp - 0x65c], eax
mov dword [ebp - 0x658], edx
push dword [ebp - 0x658]
push dword [ebp - 0x65c]
mov ecx, 0x10609ad8
call fcn.1000f5cf
jmp 0x1002d44d
jmp 0x1002d42b
jmp 0x1002d405
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0x6e8], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x388], 0x6a63
jge 0x1002d4d1
mov edx, dword [ebp - 0x650]
mov ecx, 0x10609ad8
call fcn.10011079
jmp 0x1002d4ed
or dword [ebp - 4], 0xffffffff
jmp 0x1002d4f7
mov dword [ebp - 0x4f0], 0x2224
mov dword [ebp - 0x6e0], 0x1000a3bc
cmp dword [ebp - 0x4f0], 0x2243
jle 0x1002d623
and dword [ebp - 0xfc], 0
jmp 0x1002d531
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0x7e74
jge 0x1002d623
and dword [ebp - 0x188], 0
jmp 0x1002d557
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0x41f6
jge 0x1002d61e
and dword [ebp - 0x104], 0
jmp 0x1002d57d
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x415d
jge 0x1002d619
and dword [ebp - 0x1bc], 0
jmp 0x1002d5a3
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0x27d0
jge 0x1002d614
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x188]
sar eax, cl
and eax, dword [ebp - 0x104]
xor eax, dword [ebp - 0x1bc]
cdq
mov dword [ebp - 0x668], eax
mov dword [ebp - 0x664], edx
push dword [ebp - 0x664]
push dword [ebp - 0x668]
lea ecx, [ebp - 0xa78]
call fcn.1000d000
pop ecx
pop ecx
mov dword [ebp - 0x6d0], eax
mov ecx, dword [ebp - 0x6d0]
call fcn.1000f5af
push eax
call fcn.1004b356
pop ecx
lea ecx, [ebp - 0xa78]
call fcn.1000f5a5
jmp 0x1002d596
jmp 0x1002d570
jmp 0x1002d54a
jmp 0x1002d524
mov eax, dword [ebp - 0x6d8]
mov dword [ebp - 0x6f0], eax
mov dword [ebp - 4], 2
cmp dword [ebp - 0x4f0], 0x2111
jge 0x1002d64e
push dword [ebp - 0x6e0]
call fcn.1004b356
pop ecx
jmp 0x1002d66a
or dword [ebp - 4], 0xffffffff
jmp 0x1002d674
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0x6f0]
mov dword [ebp - 0x6f8], eax
mov eax, dword [ebp - 0xdc]
mov dword [eax], 0
jmp 0x1002d6ab
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xdc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xdc]
cmp dword [eax], 4
jge 0x1002d6d1
mov eax, dword [ebp - 0xdc]
push dword [eax]
mov ecx, dword [ebp - 0x6f8]
call fcn.1000f782
mov dword [eax], 0xb99
jmp 0x1002d69a
jmp 0x1002d748
mov eax, dword [ebp - 0x700]
mov dword [ebp - 0x710], eax
mov eax, dword [ebp - 0x708]
mov dword [ebp - 0x788], eax
mov eax, dword [ebp - 0x710]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0x640], eax
mov eax, dword [ebp - 0xd8]
mov dword [eax], 0
jmp 0x1002d722
mov eax, dword [ebp - 0xd8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xd8]
mov dword [ecx], eax
mov eax, dword [ebp - 0xd8]
cmp dword [eax], 3
jge 0x1002d748
mov eax, dword [ebp - 0xd8]
push dword [eax]
mov ecx, dword [ebp - 0x640]
call fcn.1000f782
mov dword [eax], 0x37b04800
jmp 0x1002d711
jmp 0x1003213b
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x5c8], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x56c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x5d8], eax
mov eax, dword [ebp + 0x44]
mov dword [ebp - 0x6a8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x564], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x5c0], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x5e0], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x5f0], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x5d0], eax
mov eax, dword [ebp + 0x48]
mov dword [ebp - 0x760], eax
mov eax, dword [ebp - 0x55c]
movzx eax, byte [eax]
test eax, eax
je 0x10031e55
mov eax, dword [ebp - 0x6a8]
mov dword [ebp - 0x60c], eax
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x5a8], eax
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0x1e8], eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x518], 0x7d0fa516
mov dword [ebp - 0x6b4], 4
mov dword [ebp - 0x8c], 0xfffd
mov dword [ebp - 0x10c], 0
jmp 0x1002d82f
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 2
jge 0x1002d84b
mov eax, dword [ebp - 0x10c]
mov dword [ebp + eax*4 - 0x904], 0x273d
jmp 0x1002d822
cmp dword [ebp - 0x44], 9
ja 0x1002d85d
mov dword [ebp - 0x510], 1
jmp 0x1002d864
and dword [ebp - 0x510], 0
or eax, 0xffffffff
je 0x1002d86f
cmp dword [ebp - 0x44], 0
jne 0x1002d87c
xor eax, eax
jne 0x1002d87c
and dword [ebp - 0x4f8], 0
jmp 0x1002d886
mov dword [ebp - 0x4f8], 1
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x4f8], eax
jle 0x1002d89d
mov dword [ebp - 0x500], 1
jmp 0x1002d8a4
and dword [ebp - 0x500], 0
cmp dword [ebp - 0x500], 0xfff6
jae 0x1002d8bc
mov dword [ebp - 0x508], 1
jmp 0x1002d8c3
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x508]
je 0x1002d8e0
cmp dword [ebp - 0x44], 0
je 0x1002d8e0
mov dword [ebp - 0x520], 1
jmp 0x1002d8e7
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x518], eax
mov eax, dword [ebp - 0x518]
add eax, dword [ebp - 0x520]
cmp eax, 0xfffffffa
jge 0x1002d910
mov dword [ebp - 0x3bc], 1
jmp 0x1002d917
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x3bc], eax
jle 0x1002d92e
mov dword [ebp - 0x4e8], 1
jmp 0x1002d935
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x4e8]
sub eax, dword [ebp - 0x44]
cmp eax, 7
jg 0x1002d94f
mov dword [ebp - 0x260], 1
jmp 0x1002d956
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0x44]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x8c], 0
jmp 0x1002d988
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jg 0x1002d9a5
mov eax, dword [ebp - 0x8c]
cmp dword [ebp + eax*4 - 0x904], 0
je 0x1002d9a3
jmp 0x1002d9a5
jmp 0x1002d97b
push 2
lea ecx, [ebp - 0x9c]
call fcn.1000f6e4
mov dword [ebp - 4], 4
mov dword [ebp - 0x1d8], 0xdc5336de
push 0x5077
push 0x607e
push 0x233a
push 1
push 0x2bfa
push 0x806
lea eax, [ebp - 0x9fc]
push eax
push 0x3b09
push 0x1b25
push 0
push 0x43f4
push 0x4fd2
lea eax, [ebp - 0x9c]
push eax
push 0
call fcn.10019e08
add esp, 0x38
push 0
lea ecx, [ebp - 0x9c]
call fcn.1000f782
cmp dword [eax], 0xffffffff
jne 0x1002da2a
mov dword [ebp - 0x25c], 1
jmp 0x1002da31
and dword [ebp - 0x25c], 0
push 1
lea ecx, [ebp - 0x9c]
call fcn.1000f782
mov eax, dword [eax]
cmp eax, dword [ebp - 0x25c]
jle 0x1002da59
xor eax, eax
inc eax
je 0x1002da59
mov dword [ebp - 0x4f4], 1
jmp 0x1002da60
and dword [ebp - 0x4f4], 0
push 1
lea ecx, [ebp - 0x9c]
call fcn.1000f782
mov ecx, dword [ebp - 0x4f4]
cmp ecx, dword [eax]
jne 0x1002da83
mov dword [ebp - 0x574], 1
jmp 0x1002da8a
and dword [ebp - 0x574], 0
push 1
lea ecx, [ebp - 0x9c]
call fcn.1000f782
push 0
lea ecx, [ebp - 0x9c]
call fcn.1000f782
cmp dword [eax], 0xfffffffe
jl 0x1002dab5
mov dword [ebp - 0x264], 1
jmp 0x1002dabc
and dword [ebp - 0x264], 0
push 1
lea ecx, [ebp - 0x9c]
call fcn.1000f782
mov eax, dword [eax]
mov dword [ebp - 0x1d8], eax
push 1
lea ecx, [ebp - 0x9c]
call fcn.1000f782
mov ecx, dword [ebp - 0x264]
add ecx, dword [eax]
mov eax, dword [ebp - 0x1d8]
add eax, 0x3ff14eb4
cmp eax, ecx
jg 0x1002db01
mov dword [ebp - 0x780], 1
jmp 0x1002db08
and dword [ebp - 0x780], 0
push 1
lea ecx, [ebp - 0x9c]
call fcn.1000f782
mov esi, dword [ebp - 0x1d8]
push 1
lea ecx, [ebp - 0x9c]
call fcn.1000f782
cmp dword [eax], esi
je 0x1002db4a
push 1
lea ecx, [ebp - 0x9c]
call fcn.1000f782
cmp dword [eax], 0
je 0x1002db4a
mov dword [ebp - 0x57c], 1
jmp 0x1002db51
and dword [ebp - 0x57c], 0
push 1
lea ecx, [ebp - 0x9c]
call fcn.1000f782
push 1
lea ecx, [ebp - 0x9c]
call fcn.1000f782
mov esi, eax
push 1
lea ecx, [ebp - 0x9c]
call fcn.1000f782
mov eax, dword [eax]
cmp eax, dword [esi]
je 0x1002db8c
mov dword [ebp - 0x3c4], 1
jmp 0x1002db93
and dword [ebp - 0x3c4], 0
push 1
lea ecx, [ebp - 0x9c]
call fcn.1000f782
mov esi, dword [ebp - 0x3c4]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x9c]
call fcn.1000f782
cmp esi, dword [eax]
jl 0x1002dbc6
mov dword [ebp - 0x26c], 1
jmp 0x1002dbcd
and dword [ebp - 0x26c], 0
push 0
lea ecx, [ebp - 0x9c]
call fcn.1000f782
mov ecx, dword [ebp - 0x26c]
cmp ecx, dword [eax]
je 0x1002dbf0
mov dword [ebp - 0x474], 1
jmp 0x1002dbf7
and dword [ebp - 0x474], 0
push 0
lea ecx, [ebp - 0x9c]
call fcn.1000f782
mov ecx, dword [ebp - 0x474]
add ecx, dword [eax]
je 0x1002dd41
mov byte [ebp - 0x77], 0
lea eax, [ebp - 0x77]
push eax
push 0x705b
push 0
push 0x4748
call fcn.1002a964
add esp, 0x10
mov byte [ebp - 0x75], 0
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x1002dd3c
mov dword [ebp - 0x274], 0x4fa1
mov dword [ebp - 0x6c0], 0x1000a42c
cmp dword [ebp - 0x274], 0x4fc1
jle 0x1002dcd5
and dword [ebp - 0x190], 0
jmp 0x1002dc74
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0x6fb6
jge 0x1002dcd5
and dword [ebp - 0x114], 0
jmp 0x1002dc96
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x17a5
jge 0x1002dcd3
mov eax, dword [ebp - 0x190]
sub eax, dword [ebp - 0x114]
cdq
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x670], edx
push dword [ebp - 0x670]
push dword [ebp - 0x674]
mov ecx, 0x10609ad8
call fcn.1000f5cf
jmp 0x1002dc89
jmp 0x1002dc67
push 0
push 0x6eb2
push 1
push 0x21b3
push 0x2627
call fcn.1001810c
add esp, 0x14
mov byte [ebp - 4], 5
cmp dword [ebp - 0x274], 0x4e75
jge 0x1002dd10
mov edx, dword [ebp - 0x6c0]
mov ecx, 0x10609ad8
call fcn.10011079
jmp 0x1002dd2c
mov dword [ebp - 4], 4
jmp 0x1002dd3c
jmp 0x1002ddd5
mov dword [ebp - 0x584], 3
mov dword [ebp - 0x27c], 0xfffffff7
mov esi, dword [ebp - 0x584]
push 1
lea ecx, [ebp - 0x9c]
call fcn.1000f782
cmp dword [eax], esi
jl 0x1002dd78
mov dword [ebp - 0x3cc], 1
jmp 0x1002dd7f
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0
je 0x1002ddb8
push 0x7b0c
push 1
push 0
push 0x645c
push 0x75a2
push 0x4de4
push 0
call fcn.1001852d
add esp, 0x1c
jmp 0x1002ddd5
mov byte [ebp - 0x86], 0
movzx eax, byte [ebp - 0x86]
test eax, eax
je 0x1002ddd5
push 0xc37
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call fcn.1000f766
mov dword [ebp - 0x3d4], 0xffffffff
mov dword [ebp - 0x9e8], 0
mov dword [ebp - 0x808], 1
mov dword [ebp - 0x804], 1
mov dword [ebp - 0x800], 1
mov dword [ebp - 0x7fc], 1
mov dword [ebp - 0x768], 0x87697ab8
mov dword [ebp - 0x4cc], 0xfffffffd
mov dword [ebp - 0x58c], 0x8a064f57
mov dword [ebp - 0x1b4], 0
jmp 0x1002de57
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jge 0x1002de73
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x928], 0xfff6
jmp 0x1002de4a
mov byte [ebp - 0x88], 0
push 0x6be5
push 0
lea eax, [ebp - 0x88]
push eax
push 0x14fa
push 0x642b
push 0
push 0x397e
call fcn.1001d91f
add esp, 0x1c
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x9f0], eax
cmp dword [ebp - 0x4cc], 1
jge 0x1002dec8
cmp dword [ebp - 0x4cc], 0
jne 0x1002dec8
and dword [ebp - 0x284], 0
jmp 0x1002ded2
mov dword [ebp - 0x284], 1
cmp dword [ebp - 0x284], 0x94628aea
jb 0x1002dee5
cmp dword [ebp - 0x768], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x928]
mov dword [ebp - 0x9f8], eax
mov eax, dword [ebp - 0x58c]
mov dword [ebp - 0x8dc], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x808], 0xd2ad05b3
jae 0x1002df23
mov dword [ebp - 0x28c], 1
jmp 0x1002df2a
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x3d4]
cmp dword [ebp - 0x28c], eax
je 0x1002df4d
mov eax, 0xa3ebef27
test eax, eax
je 0x1002df4d
mov dword [ebp - 0x47c], 1
jmp 0x1002df54
and dword [ebp - 0x47c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x47c]
mov dword [ebp + eax - 0x808], ecx
mov dword [ebp - 0x5c4], 0
mov dword [ebp - 0x28], 8
mov dword [ebp - 0xbc], 0x4f3d4e6
mov dword [ebp - 0x11c], 0
jmp 0x1002df9b
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 3
jge 0x1002dfb7
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x7a8], 0x4b25b3b9
jmp 0x1002df8e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7a8], 0
je 0x1002dfd5
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x7a8], 0
mov dword [ebp - 0x28], 0xea66e58d
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x7a8]
sub ecx, dword [ebp + eax - 0x7a8]
cmp ecx, dword [ebp - 0x28]
jg 0x1002e007
mov dword [ebp - 0x294], 1
jmp 0x1002e00e
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xbc], 0xb
jmp 0x1002e033
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0xfffffff8
jne 0x1002e140
mov dword [ebp - 0x28], 0
jmp 0x1002e050
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffffa
jge 0x1002e07f
mov dword [ebp - 0x6cc], 1
push 0xab2
push 0x7208
push 0
lea eax, [ebp - 0x6cc]
push eax
push 0
call fcn.1002d191
add esp, 0x14
jmp 0x1002e049
mov dword [ebp - 0x28], 0xa
jmp 0x1002e08f
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffffd
jle 0x1002e13b
push 1
lea ecx, [ebp - 0x7b4]
call fcn.1000f6e4
mov dword [ebp - 4], 7
mov dword [ebp - 0x168], 0
jmp 0x1002e0c6
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 1
jge 0x1002e0e8
push dword [ebp - 0x168]
lea ecx, [ebp - 0x7b4]
call fcn.1000f782
mov dword [eax], 0x945c
jmp 0x1002e0b9
mov byte [ebp - 0x59], 0
push 0x42dc
push 0
push 0x49d8
lea eax, [ebp - 0x59]
push eax
call fcn.100181e6
add esp, 0x10
push 0
lea ecx, [ebp - 0x7b4]
call fcn.1000f782
cmp dword [eax], 0
je 0x1002e127
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7b4]
call fcn.1000f766
jmp 0x1002e13b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7b4]
call fcn.1000f766
jmp 0x1002e088
jmp 0x1002e026
mov dword [ebp - 0x6e4], 0x7d0fa516
mov dword [ebp - 0x74c], 4
mov dword [ebp - 0x64], 8
mov dword [ebp - 0x6c], 0xfffffff8
mov dword [ebp - 0x550], 0xe04a276a
mov dword [ebp - 0x6d4], 0xfffffffd
mov dword [ebp - 0x790], 0xffffffff
mov dword [ebp - 0x64], 0xffffffe4
jmp 0x1002e190
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0xfffffff2
jle 0x1002e3dc
mov dword [ebp - 0x124], 0xd37a5b7d
mov dword [ebp - 0x20c], 0xfff8
mov dword [ebp - 0x484], 0xcccaea0a
mov byte [ebp - 0x7b], 0
movzx eax, byte [ebp - 0x7b]
test eax, eax
je 0x1002e1d1
push 0
push 0x25c8
call dword [sym.imp.GDI32.dll_GetClipBox]
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x92c], eax
mov eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x124]
jge 0x1002e1f7
mov dword [ebp - 0x50c], 1
jmp 0x1002e1fe
and dword [ebp - 0x50c], 0
cmp dword [ebp - 0x124], 0
jne 0x1002e219
cmp dword [ebp - 0x20c], 0
jne 0x1002e219
and dword [ebp - 0x3dc], 0
jmp 0x1002e223
mov dword [ebp - 0x3dc], 1
cmp dword [ebp - 0x3dc], 0x9fff
jg 0x1002e23b
mov dword [ebp - 0x29c], 1
jmp 0x1002e242
and dword [ebp - 0x29c], 0
imul eax, dword [ebp - 0x29c], 0
dec eax
dec eax
cmp eax, dword [ebp - 0x20c]
je 0x1002e25f
mov dword [ebp - 0x2a4], 1
jmp 0x1002e266
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x50c]
cmp eax, dword [ebp - 0x2a4]
jge 0x1002e280
mov dword [ebp - 0x594], 1
jmp 0x1002e287
and dword [ebp - 0x594], 0
mov eax, 0x1cb6
imul eax, eax, 0xba87
cmp eax, 0x14c5530c
jne 0x1002e2a5
mov dword [ebp - 0x3e4], 1
jmp 0x1002e2ac
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x20c]
add eax, dword [ebp - 0x3e4]
add eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x6c]
jle 0x1002e2cc
mov dword [ebp - 0x2ac], 1
jmp 0x1002e2d3
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x484]
cmp eax, dword [ebp - 0x64]
jg 0x1002e2f6
mov dword [ebp - 0x2b4], 1
jmp 0x1002e2fd
and dword [ebp - 0x2b4], 0
imul eax, dword [ebp - 0x2b4], 9
test eax, eax
je 0x1002e32d
mov byte [ebp - 0x87], 0
movzx eax, byte [ebp - 0x87]
test eax, eax
je 0x1002e328
push 0
push 0x39f1
call fcn.100192da
pop ecx
pop ecx
jmp 0x1002e3d7
push 2
lea ecx, [ebp - 0x8ac]
call fcn.1000f6e4
mov dword [ebp - 4], 8
mov dword [ebp - 0x38], 0
jmp 0x1002e351
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1002e36d
push dword [ebp - 0x38]
lea ecx, [ebp - 0x8ac]
call fcn.1000f782
mov dword [eax], 0xfffffffc
jmp 0x1002e34a
mov dword [ebp - 0x38], 0
jmp 0x1002e37d
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x1002e393
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xa60], 0
jmp 0x1002e376
mov dword [ebp - 0x6c], 0
jmp 0x1002e3a3
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jg 0x1002e3c8
push 4
pop eax
imul esi, eax, 0
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x8ac]
call fcn.1000f782
mov eax, dword [eax]
mov dword [ebp + esi - 0xa60], eax
jmp 0x1002e39c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8ac]
call fcn.1000f766
jmp 0x1002e189
lea eax, [ebp - 0x790]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x550]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x6d4]
push eax
push 0
call fcn.1001a8ae
add esp, 0x18
mov dword [ebp - 0xb0], 0xfffd
mov dword [ebp - 0x16c], 0xffffffff
push 2
lea ecx, [ebp - 0x954]
call fcn.1000f6e4
mov dword [ebp - 4], 9
mov dword [ebp - 0x5a4], 0xfffffffd
lea eax, [ebp - 0x9a8]
push eax
push 0
push 0x1f45
push 0
push 0x7aab
lea eax, [ebp - 0x954]
push eax
call fcn.1002c591
add esp, 0x18
mov dword [ebp - 0x16c], 0
jmp 0x1002e472
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0xffffffe7
je 0x1002e51d
mov dword [ebp - 0x12c], 0
jmp 0x1002e498
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 3
jge 0x1002e4b4
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0x7c0], 1
jmp 0x1002e48b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x7c0], 0
jmp 0x1002e4e2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7c0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x7c0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7c0], 1
jg 0x1002e50e
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x1002e50c
push 0
push 0x51df
call fcn.1001bb8f
pop ecx
pop ecx
jmp 0x1002e4c7
mov dword [ebp - 0x5a4], 0x5efa20bd
jmp 0x1002e465
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x954]
call fcn.1000f766
mov dword [ebp - 0x494], 0
mov dword [ebp - 0x2dc], 0x73838a1f
mov dword [ebp - 0x134], 0xffffffff
mov dword [ebp - 0x3fc], 0xfffffff7
mov dword [ebp - 0x174], 0
jmp 0x1002e56d
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 4
jge 0x1002e589
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x530], 0xaa9a
jmp 0x1002e560
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x530]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x530], eax
cmp dword [ebp - 0x134], 0
je 0x1002e772
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x530]
mov dword [ebp - 0x8e8], eax
cmp dword [ebp - 0x494], 1
jbe 0x1002e5e8
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x530], 0
je 0x1002e5e8
mov dword [ebp - 0x3ec], 1
jmp 0x1002e5ef
and dword [ebp - 0x3ec], 0
cmp dword [ebp - 0x3ec], 1
jb 0x1002e604
mov dword [ebp - 0x2bc], 1
jmp 0x1002e60b
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x134]
imul eax, dword [ebp - 0x2bc]
test eax, eax
jae 0x1002e631
cmp dword [ebp - 0x3fc], 0
je 0x1002e631
mov dword [ebp - 0x4d4], 1
jmp 0x1002e638
and dword [ebp - 0x4d4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x530]
add eax, dword [ebp - 0x4d4]
jne 0x1002e65b
or eax, 0xffffffff
jne 0x1002e65b
and dword [ebp - 0x2c4], 0
jmp 0x1002e665
mov dword [ebp - 0x2c4], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x530]
cmp dword [ebp - 0x2c4], eax
je 0x1002e686
mov dword [ebp - 0x3f4], 1
jmp 0x1002e68d
and dword [ebp - 0x3f4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x530]
cmp dword [ebp - 0x3f4], eax
jne 0x1002e6ae
mov dword [ebp - 0x2cc], 1
jmp 0x1002e6b5
and dword [ebp - 0x2cc], 0
cmp dword [ebp - 0x2cc], 0x668d
jl 0x1002e6d2
xor eax, eax
inc eax
je 0x1002e6d2
mov dword [ebp - 0x48c], 1
jmp 0x1002e6d9
and dword [ebp - 0x48c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x530]
cmp dword [ebp - 0x48c], eax
jl 0x1002e6f9
mov dword [ebp - 0x2d4], 1
jmp 0x1002e700
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2d4]
add eax, 0x496cfaf7
cmp eax, dword [ebp - 0x3fc]
jl 0x1002e71f
mov dword [ebp - 0x4fc], 1
jmp 0x1002e726
and dword [ebp - 0x4fc], 0
mov dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x2dc]
cmp eax, dword [ebp - 0x4fc]
jne 0x1002e74a
mov dword [ebp - 0x770], 1
jmp 0x1002e751
and dword [ebp - 0x770], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x134]
add ecx, dword [ebp + eax - 0x530]
je 0x1002e772
mov dword [ebp - 0x2e4], 1
jmp 0x1002e779
and dword [ebp - 0x2e4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x530]
cmp eax, dword [ebp - 0x2e4]
jne 0x1002e79a
mov dword [ebp - 0x404], 1
jmp 0x1002e7a1
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x134]
imul eax, dword [ebp - 0x404]
cmp eax, 0x1f199e1f
jg 0x1002e7c1
mov dword [ebp - 0x2ec], 1
jmp 0x1002e7c8
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x494], eax
mov dword [ebp - 0x840], 7
mov dword [ebp - 0x83c], 7
mov dword [ebp - 0x838], 7
mov dword [ebp - 0x834], 7
lea ecx, [ebp - 0x1f5]
call fcn.1000f791
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x840]
push eax
lea ecx, [ebp - 0xa50]
call fcn.1000f794
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x964]
call fcn.1000f740
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x17c], 0
jmp 0x1002e851
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 2
jge 0x1002e86d
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x54c], 2
jmp 0x1002e844
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x54c], 3
jmp 0x1002e89b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x54c]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x54c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x54c], 0
jl 0x1002e94d
mov dword [ebp - 0x13c], 0x2e31d83
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x1002e8d9
push 0
push 0xd1a
call fcn.10019590
pop ecx
pop ecx
mov dword [ebp - 0x13c], 3
jmp 0x1002e8f2
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jl 0x1002e948
mov dword [ebp - 0x5ac], 0x4ad72d76
mov byte [ebp - 0x85], 0
lea eax, [ebp - 0x85]
push eax
push 0x4145
push 0
push 0x27d4
call fcn.100195ca
add esp, 0x10
lea eax, [ebp - 0x5ac]
push eax
push 0x7686
lea eax, [ebp - 0x964]
push eax
push 0
push 0
call fcn.100190ed
add esp, 0x14
jmp 0x1002e8e5
jmp 0x1002e880
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x964]
call fcn.1000f766
mov dword [ebp - 0x184], 0
jmp 0x1002e975
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 2
jge 0x1002e991
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x910], 0x273d
jmp 0x1002e968
mov dword [ebp - 0x194], 9
push 1
lea ecx, [ebp - 0x8b8]
call fcn.1000f6e4
mov dword [ebp - 4], 0xb
push 1
lea ecx, [ebp - 0x23c]
call fcn.1000f6e4
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x7f8], 0xfffa
mov dword [ebp - 0x7f4], 0xfffa
mov dword [ebp - 0x7f0], 0xfffa
mov dword [ebp - 0x7ec], 0xfffa
mov dword [ebp - 0x314], 0
mov dword [ebp - 0x2f4], 0x6952
mov dword [ebp - 0x5b4], 0x1000a484
cmp dword [ebp - 0x2f4], 0x6c25
jle 0x1002eaf8
and dword [ebp - 0x14c], 0
jmp 0x1002ea2c
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0x241
jge 0x1002eaec
and dword [ebp - 0x144], 0
jmp 0x1002ea52
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0x1d3e
jge 0x1002eae7
and dword [ebp - 0x18c], 0
jmp 0x1002ea78
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0x7239
jge 0x1002eae2
mov eax, dword [ebp - 0x144]
imul eax, dword [ebp - 0x18c]
or eax, dword [ebp - 0x14c]
cdq
mov dword [ebp - 0x680], eax
mov dword [ebp - 0x67c], edx
push dword [ebp - 0x67c]
push dword [ebp - 0x680]
lea ecx, [ebp - 0xaa8]
call fcn.1000d000
pop ecx
pop ecx
mov dword [ebp - 0x6dc], eax
mov ecx, dword [ebp - 0x6dc]
call fcn.1000f5af
push eax
call fcn.1004b356
pop ecx
lea ecx, [ebp - 0xaa8]
call fcn.1000f5a5
jmp 0x1002ea6b
jmp 0x1002ea45
jmp 0x1002ea1f
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
mov dword [ebp - 0x5bc], 0xfffffffb
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x2f4], 0x6666
jge 0x1002eb1e
push dword [ebp - 0x5b4]
call fcn.1004b356
pop ecx
jmp 0x1002eb3a
mov dword [ebp - 4], 0xc
jmp 0x1002eb4a
mov dword [ebp - 0x48], 0
jmp 0x1002eb5a
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x1002eb73
push dword [ebp - 0x48]
lea ecx, [ebp - 0x8b8]
call fcn.1000f782
or dword [eax], 0xffffffff
jmp 0x1002eb53
mov dword [ebp - 0x48], 0
jmp 0x1002eb83
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x1002eb9f
push dword [ebp - 0x48]
lea ecx, [ebp - 0x23c]
call fcn.1000f782
mov dword [eax], 0xfffffff9
jmp 0x1002eb7c
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x9e4], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x8f0], eax
push 0
lea ecx, [ebp - 0x23c]
call fcn.1000f782
mov esi, eax
push 0
lea ecx, [ebp - 0x23c]
call fcn.1000f782
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x1002ebe5
mov dword [ebp - 0x40c], 1
jmp 0x1002ebec
and dword [ebp - 0x40c], 0
imul esi, dword [ebp - 0x40c], 0
push 0
lea ecx, [ebp - 0x23c]
call fcn.1000f782
add esi, dword [eax]
mov dword [ebp - 0x748], esi
push 0
lea ecx, [ebp - 0x8b8]
call fcn.1000f782
mov ecx, dword [ebp - 0x748]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x23c]
call fcn.1000f782
cmp dword [eax], 0
jne 0x1002ec4a
push 0
lea ecx, [ebp - 0x23c]
call fcn.1000f782
cmp dword [eax], 0
jne 0x1002ec4a
and dword [ebp - 0x2fc], 0
jmp 0x1002ec54
mov dword [ebp - 0x2fc], 1
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x2fc], eax
jge 0x1002ec6e
mov dword [ebp - 0x304], 1
jmp 0x1002ec75
and dword [ebp - 0x304], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7f8]
inc eax
mov dword [ebp - 0x4dc], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x4dc]
mov dword [ebp + eax - 0x7f8], ecx
mov esi, dword [ebp - 0x4dc]
add esi, dword [ebp - 0x304]
push 0
lea ecx, [ebp - 0x23c]
call fcn.1000f782
cmp esi, dword [eax]
je 0x1002ecc3
mov dword [ebp - 0x414], 1
jmp 0x1002ecca
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x314]
cmp dword [ebp - 0x414], eax
jne 0x1002ece4
mov dword [ebp - 0x30c], 1
jmp 0x1002eceb
and dword [ebp - 0x30c], 0
cmp dword [ebp - 0x30c], 1
jae 0x1002ed00
mov dword [ebp - 0x49c], 1
jmp 0x1002ed07
and dword [ebp - 0x49c], 0
push 0
lea ecx, [ebp - 0x23c]
call fcn.1000f782
mov ecx, dword [ebp - 0x49c]
cmp ecx, dword [eax]
jl 0x1002ed2a
mov dword [ebp - 0x41c], 1
jmp 0x1002ed31
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x314]
cmp dword [ebp - 0x41c], eax
jge 0x1002ed4b
mov dword [ebp - 0x31c], 1
jmp 0x1002ed52
and dword [ebp - 0x31c], 0
push 0
lea ecx, [ebp - 0x23c]
call fcn.1000f782
mov ecx, dword [ebp - 0x31c]
cmp ecx, dword [eax]
jle 0x1002ed75
mov dword [ebp - 0x51c], 1
jmp 0x1002ed7c
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x5bc], eax
push 0x76ab
push 0
lea eax, [ebp - 0x194]
push eax
push 0x6d48
call fcn.1001822b
add esp, 0x10
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x23c]
call fcn.1000f766
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8b8]
call fcn.1000f766
lea eax, [ebp - 0x6e4]
push eax
push 0xc23
push 0x13a0
lea eax, [ebp - 0x5c4]
push eax
push 0x1771
push 0x1be0
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x74c]
push eax
push 0
call fcn.1001dc3e
add esp, 0x24
mov dword [ebp - 0x6ec], 0xb8e
mov dword [ebp - 0x754], 0xba22e974
mov dword [ebp - 0x9b8], 0xffffffff
mov dword [ebp - 0x5d4], 0x111d0188
mov dword [ebp - 0x6fc], 0x1b17d72
mov dword [ebp - 0x5e4], 0xfffffffa
mov dword [ebp - 0x6f4], 0xbbbdebf8
mov dword [ebp - 0x5ec], 0xa5bc4220
mov dword [ebp - 0x5cc], 1
mov dword [ebp - 0x5dc], 0x5764
mov dword [ebp - 0x75c], 0xb1b0cadf
lea eax, [ebp - 0x5cc]
push eax
lea eax, [ebp - 0x6ec]
push eax
lea eax, [ebp - 0x5d4]
push eax
push 0
push 0x4b25
lea eax, [ebp - 0x754]
push eax
push 0x1080
push 1
lea eax, [ebp - 0x5dc]
push eax
lea eax, [ebp - 0x6f4]
push eax
lea eax, [ebp - 0x5e4]
push eax
push 0x3ebe
lea eax, [ebp - 0x75c]
push eax
lea eax, [ebp - 0x5ec]
push eax
lea eax, [ebp - 0x6fc]
push eax
push 0
call fcn.100333d2
add esp, 0x40
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x1002eeec
push 0x6c3f
push 0
push 0x66e
call fcn.10018d3b
add esp, 0xc
mov dword [ebp - 0x324], 0x5496
mov dword [ebp - 0x704], 0x1000a4dc
cmp dword [ebp - 0x324], 0x55e9
jle 0x1002eff8
push 0x34f
push 0x1a2e
call dword [sym.imp.GDI32.dll_SetLayout]
and dword [ebp - 0x15c], 0
jmp 0x1002ef36
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0x3625
jge 0x1002eff8
and dword [ebp - 0x154], 0
jmp 0x1002ef5c
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0x38d9
jge 0x1002eff3
and dword [ebp - 0x1a8], 0
jmp 0x1002ef82
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0x6005
jge 0x1002efee
mov eax, dword [ebp - 0x154]
cdq
idiv dword [ebp - 0x1a8]
add edx, dword [ebp - 0x15c]
mov eax, edx
cdq
mov dword [ebp - 0x68c], eax
mov dword [ebp - 0x688], edx
push dword [ebp - 0x688]
push dword [ebp - 0x68c]
lea ecx, [ebp - 0xa90]
call fcn.1000d000
pop ecx
pop ecx
mov dword [ebp - 0x5f4], eax
mov ecx, dword [ebp - 0x5f4]
call fcn.1000f5af
push eax
call fcn.1004b356
pop ecx
lea ecx, [ebp - 0xa90]
call fcn.1000f5a5
jmp 0x1002ef75
jmp 0x1002ef4f
jmp 0x1002ef29
mov dword [ebp - 0xb0], 0
jmp 0x1002f011
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jg 0x1002f097
mov dword [ebp - 0xb4], 7
mov dword [ebp - 0xb4], 0xf
jmp 0x1002f03d
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0xffffffed
je 0x1002f080
mov dword [ebp - 0x5fc], 0xfffffff7
mov dword [ebp - 0x764], 0xdcc590f0
lea eax, [ebp - 0x764]
push eax
lea eax, [ebp - 0xb4]
push eax
push 0
push 0x23ce
lea eax, [ebp - 0x5fc]
push eax
call fcn.1001a7f3
add esp, 0x14
jmp 0x1002f030
mov eax, dword [ebp - 0xb0]
cmp dword [ebp + eax*4 - 0x910], 0
je 0x1002f092
jmp 0x1002f097
jmp 0x1002f004
mov dword [ebp - 4], 0xf
cmp dword [ebp - 0x324], 0x50c9
jge 0x1002f0b6
push dword [ebp - 0x704]
call fcn.1004b356
pop ecx
jmp 0x1002f0d2
or dword [ebp - 4], 0xffffffff
jmp 0x1002f0dc
push 3
lea ecx, [ebp - 0x974]
call fcn.1000f6e4
mov dword [ebp - 4], 0x11
push 2
lea ecx, [ebp - 0x720]
call fcn.1000f6e4
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x1b0], 0xea122098
push 0
lea eax, [ebp - 0x974]
push eax
push 0x5807
lea eax, [ebp - 0x604]
push eax
call fcn.100181c1
add esp, 0x10
lea eax, [ebp - 0x604]
push eax
push 0
lea eax, [ebp - 0x720]
push eax
call fcn.1002c714
add esp, 0xc
push 0
lea ecx, [ebp - 0x720]
call fcn.1000f782
mov dword [eax], 2
jmp 0x1002f179
push 0
lea ecx, [ebp - 0x720]
call fcn.1000f782
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x424]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x424]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x720]
call fcn.1000f782
cmp dword [eax], 0
jl 0x1002f1a7
mov byte [ebp - 0x83], 0
movzx eax, byte [ebp - 0x83]
test eax, eax
je 0x1002f1a5
push 0
call fcn.1001aa7f
pop ecx
jmp 0x1002f155
mov dword [ebp - 0x1b0], 0
jmp 0x1002f1c0
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 7
jg 0x1002f240
mov dword [ebp - 0x76c], 0xfffffffb
mov dword [ebp - 0xc4], 0xe9bf9f36
mov eax, dword [ebp - 0x76c]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc4], 0xffffffef
jmp 0x1002f202
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x16
jle 0x1002f23b
mov byte [ebp - 0x7f], 0
lea eax, [ebp - 0x7f]
push eax
push 0
push 0x2f0a
call fcn.100322ce
add esp, 0xc
mov byte [ebp - 0x76], 0
push 0x407d
push 0
lea eax, [ebp - 0x76]
push eax
call fcn.1002c943
add esp, 0xc
jmp 0x1002f1f5
jmp 0x1002f1b3
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x720]
call fcn.1000f766
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x974]
call fcn.1000f766
mov eax, dword [ebp - 0x60c]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0xac], 0xf9c28ade
mov dword [ebp - 0x164], 0
jmp 0x1002f290
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 1
jge 0x1002f2ac
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x70c], 0xffff
jmp 0x1002f283
mov dword [ebp - 0xac], 0
jmp 0x1002f2c5
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x1002f2e1
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x70c], 0xd29b
jmp 0x1002f2b8
lea eax, [ebp - 0xac]
push eax
push 0x2504
push 0
call fcn.1002a629
add esp, 0xc
push 3
lea ecx, [ebp - 0x9a4]
call fcn.1000f6e4
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x2c], 0xdc4b4e12
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0x354], 0xd2daffa8
mov byte [ebp - 0x78], 0
lea eax, [ebp - 0x78]
push eax
push 0
push 0x6bc1
push 0x2221
call fcn.1001a30e
add esp, 0x10
cmp dword [ebp - 0x2c], 0
je 0x1002f3ce
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x8f8], eax
cmp dword [ebp - 0x2c], 0
jne 0x1002f36a
cmp dword [ebp - 0x2c], 0
jne 0x1002f36a
and dword [ebp - 0x32c], 0
jmp 0x1002f374
mov dword [ebp - 0x32c], 1
cmp dword [ebp - 0x32c], 1
jne 0x1002f389
mov dword [ebp - 0x4a4], 1
jmp 0x1002f390
and dword [ebp - 0x4a4], 0
mov eax, 0xffff
sub eax, dword [ebp - 0x4a4]
cmp eax, dword [ebp - 0x2c]
jne 0x1002f3ac
mov dword [ebp - 0x614], 1
jmp 0x1002f3b3
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x9bc], eax
cmp dword [ebp - 0x2c], 6
jle 0x1002f3ce
mov dword [ebp - 0x334], 1
jmp 0x1002f3d5
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
je 0x1002f4e2
mov dword [ebp - 0x434], 0x13d0bb94
mov dword [ebp - 0x42c], 0xb91ee4c
mov dword [ebp - 0x4e4], 0x7c44d996
mov dword [ebp - 0x344], 0x6af9031e
or eax, 0xffffffff
je 0x1002f446
mov dword [ebp - 0xd4], 0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 0
je 0x1002f446
mov dword [ebp - 0x33c], 1
jmp 0x1002f44d
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x4e4], eax
mov eax, dword [ebp - 0x4e4]
add eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x93c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x9c0], eax
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x938], eax
mov eax, 0x23c5ad05
test eax, eax
jne 0x1002f4a6
push 0xfffffffffffffffd
pop eax
test eax, eax
jne 0x1002f4a6
and dword [ebp - 0x34c], 0
jmp 0x1002f4b0
mov dword [ebp - 0x34c], 1
mov eax, dword [ebp - 0x434]
sub eax, dword [ebp - 0x34c]
cmp eax, 1
jne 0x1002f4cd
mov dword [ebp - 0x4ac], 1
jmp 0x1002f4d4
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x354], eax
jmp 0x1002f524
mov dword [ebp - 0x774], 0x3f121f20
lea eax, [ebp - 0x774]
push eax
push 0x389a
push 0
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x354]
push eax
call fcn.1001ca4a
add esp, 0x14
mov byte [ebp - 0x5a], 0
movzx eax, byte [ebp - 0x5a]
test eax, eax
je 0x1002f524
push 0
call fcn.1002aa49
pop ecx
push 2
lea ecx, [ebp - 0x740]
call fcn.1000f6e4
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x100], 0xea122098
mov dword [ebp - 0x1b8], 0xfffffffe
mov dword [ebp - 0x1b8], 0
jmp 0x1002f562
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0xe
jle 0x1002f590
mov byte [ebp - 0x5b], 0
movzx eax, byte [ebp - 0x5b]
test eax, eax
je 0x1002f58e
push 0
push 0x1345
push 0x1a0c
push 0x96c
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
jmp 0x1002f555
mov byte [ebp - 0x5d], 0
push 0x5600
push 0x6afc
push 0x235a
push 0x108b
push 0x68ea
push 0x33f5
lea eax, [ebp - 0x5d]
push eax
push 0x677c
push 0x7ab3
push 0
push 0
push 0x4c2b
push 0x56ac
push 1
push 0x293c
call fcn.1001bc90
add esp, 0x3c
mov dword [ebp - 0xcc], 0
jmp 0x1002f5f6
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 3
jge 0x1002f618
push dword [ebp - 0xcc]
lea ecx, [ebp - 0x9a4]
call fcn.1000f782
mov dword [eax], 0x2db58e46
jmp 0x1002f5e9
mov dword [ebp - 0x43c], 0x7c55
mov dword [ebp - 0x61c], 0x1000a524
cmp dword [ebp - 0x43c], 0x7d9f
jle 0x1002f6af
and dword [ebp - 0x1c0], 0
jmp 0x1002f64e
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0x3d27
jge 0x1002f6af
and dword [ebp - 0x170], 0
jmp 0x1002f670
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0x795c
jge 0x1002f6ad
mov eax, dword [ebp - 0x1c0]
and eax, dword [ebp - 0x170]
cdq
mov dword [ebp - 0x698], eax
mov dword [ebp - 0x694], edx
push dword [ebp - 0x694]
push dword [ebp - 0x698]
mov ecx, 0x10609ad8
call fcn.1000f5cf
jmp 0x1002f663
jmp 0x1002f641
mov byte [ebp - 4], 0x15
cmp dword [ebp - 0x43c], 0x7905
jge 0x1002f6cf
mov edx, dword [ebp - 0x61c]
mov ecx, 0x10609ad8
call fcn.10011079
jmp 0x1002f6eb
mov dword [ebp - 4], 0x14
jmp 0x1002f6fb
push 1
lea ecx, [ebp - 0x7cc]
call fcn.1000f6e4
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x35c], 4
push 3
lea ecx, [ebp - 0x53c]
call fcn.1000f6e4
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x204], 0xffffffff
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x444], 0x5034859b
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x7cc]
push eax
push 0
call fcn.1001d25f
add esp, 0xc
push 0x29c
lea eax, [ebp - 0xa4]
push eax
push 1
push 0x546f
push 0
push 0x2c03
lea eax, [ebp - 0x53c]
push eax
push 0x6d02
push 0
push 0x1887
call fcn.100195fb
add esp, 0x28
mov dword [ebp - 0xa4], 0
jmp 0x1002f7ab
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x1002f7c7
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x934], 0xa2a0c0e0
jmp 0x1002f79e
push 0
lea ecx, [ebp - 0x53c]
call fcn.1000f782
cmp dword [eax], 0
je 0x1002f924
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x9c4], eax
push 0
lea ecx, [ebp - 0x53c]
call fcn.1000f782
mov eax, dword [eax]
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x940], eax
push 0
lea ecx, [ebp - 0x53c]
call fcn.1000f782
cmp dword [eax], 1
je 0x1002f828
mov dword [ebp - 0x504], 1
jmp 0x1002f82f
and dword [ebp - 0x504], 0
cmp dword [ebp - 0x504], 3
je 0x1002f844
mov dword [ebp - 0x364], 1
jmp 0x1002f84b
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x444], eax
mov esi, dword [ebp - 0x444]
push 0
lea ecx, [ebp - 0x7cc]
call fcn.1000f782
cmp esi, dword [eax]
je 0x1002f87a
mov dword [ebp - 0x36c], 1
jmp 0x1002f881
and dword [ebp - 0x36c], 0
push 0
lea ecx, [ebp - 0x53c]
call fcn.1000f782
mov eax, dword [eax]
cmp eax, dword [ebp - 0x36c]
jge 0x1002f8a4
mov dword [ebp - 0x4b4], 1
jmp 0x1002f8ab
and dword [ebp - 0x4b4], 0
push 0
lea ecx, [ebp - 0x7cc]
call fcn.1000f782
mov ecx, dword [ebp - 0x4b4]
cmp ecx, dword [eax]
jl 0x1002f8ce
mov dword [ebp - 0x374], 1
jmp 0x1002f8d5
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x374], eax
je 0x1002f8ef
mov dword [ebp - 0x214], 1
jmp 0x1002f8f6
and dword [ebp - 0x214], 0
push 0
lea ecx, [ebp - 0x53c]
call fcn.1000f782
mov ecx, dword [ebp - 0x214]
mov dword [eax], ecx
mov eax, dword [ebp - 0x214]
sub eax, 0xfff8
je 0x1002f924
mov dword [ebp - 0x44c], 1
jmp 0x1002f92b
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
neg eax
imul eax, eax, 0xfffa
mov ecx, dword [ebp - 0x204]
add ecx, eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x934], ecx
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
mov dword [ebp - 0x90], 0
jmp 0x1002f974
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x1b
je 0x1002f9e2
mov dword [ebp - 0xa0c], 0xc7eb
mov dword [ebp - 0xa08], 0xc7eb
mov dword [ebp - 0xa04], 0xc7eb
mov dword [ebp - 0xa00], 0xc7eb
mov dword [ebp - 0x9ec], 1
mov dword [ebp - 0x948], 5
mov dword [ebp - 0x714], 0x7dfcc86f
push 0x900
lea eax, [ebp - 0x714]
push eax
push 0x6575
push 1
push 0
call fcn.100190ed
add esp, 0x14
jmp 0x1002f967
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x53c]
call fcn.1000f766
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x7cc]
call fcn.1000f766
push 0x5f96
push 0
lea eax, [ebp - 0x740]
push eax
push 1
lea eax, [ebp - 0xcc]
push eax
push 0x6274
call fcn.1002c591
add esp, 0x18
push 1
lea ecx, [ebp - 0x984]
call fcn.1000f6e4
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x624], 0xcc25bfc8
mov dword [ebp - 0x3c], 0
jmp 0x1002fa4f
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1002fa6b
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x984]
call fcn.1000f782
mov dword [eax], 0xe91a
jmp 0x1002fa48
mov dword [ebp - 0x3c], 0
jmp 0x1002fa7b
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x1002fa91
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x544], 0xb0b02971
jmp 0x1002fa74
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x544], 0
jmp 0x1002fabf
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x544]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x544], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x544], 0
jg 0x1002fb68
mov dword [ebp - 0x198], 0
jmp 0x1002faec
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 4
jge 0x1002fb08
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0x8c8], 0x39ed080c
jmp 0x1002fadf
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x8c8], 0
jmp 0x1002fb36
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8c8]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x8c8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8c8], 0
jg 0x1002fb52
mov dword [ebp - 0x624], 0x5653d423
jmp 0x1002fb1b
mov byte [ebp - 0x5f], 0
push 0
lea eax, [ebp - 0x5f]
push eax
call fcn.1002c676
pop ecx
pop ecx
jmp 0x1002faa4
push 0x25a0
push 0x151
push 0
push 0x1a0a
push 0x5aca
push 0x2390
call fcn.1001b99d
add esp, 0x18
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x984]
call fcn.1000f766
push 0
lea ecx, [ebp - 0x740]
call fcn.1000f782
mov dword [eax], 2
jmp 0x1002fbd3
push 0
lea ecx, [ebp - 0x740]
call fcn.1000f782
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x37c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x37c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x740]
call fcn.1000f782
cmp dword [eax], 0
jl 0x1003032d
mov dword [ebp - 0x4c4], 0x9b
mov dword [ebp - 0x744], 0x1000a578
cmp dword [ebp - 0x4c4], 0x36c
jle 0x1002fc80
and dword [ebp - 0x178], 0
jmp 0x1002fc1f
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x8028
jge 0x1002fc80
and dword [ebp - 0x1c4], 0
jmp 0x1002fc41
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0x19e0
jge 0x1002fc7e
mov eax, dword [ebp - 0x178]
sub eax, dword [ebp - 0x1c4]
cdq
mov dword [ebp - 0x6a4], eax
mov dword [ebp - 0x6a0], edx
push dword [ebp - 0x6a0]
push dword [ebp - 0x6a4]
mov ecx, 0x10609ad8
call fcn.1000f5cf
jmp 0x1002fc34
jmp 0x1002fc12
push 2
lea ecx, [ebp - 0x1d4]
call fcn.1000f6e4
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x74], 0x2ee76f50
push 2
lea ecx, [ebp - 0x7d8]
call fcn.1000f6e4
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x734], 0xf0427242
push 0x2ed9
push 0x1c5
lea eax, [ebp - 0x77c]
push eax
push 0
lea eax, [ebp - 0x1d4]
push eax
call fcn.1001937f
add esp, 0x14
lea eax, [ebp - 0x77c]
push eax
push 1
push 1
lea eax, [ebp - 0x7d8]
push eax
push 0x16ca
push 0x1129
push 0
call fcn.1001852d
add esp, 0x1c
mov dword [ebp - 0x74], 1
jmp 0x1002fd0b
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jl 0x1003012d
mov dword [ebp - 0x82c], 0xffab8c3a
mov dword [ebp - 0x828], 0xffab8c3a
mov dword [ebp - 0x824], 0xffab8c3a
mov dword [ebp - 0x820], 0xffab8c3a
lea ecx, [ebp - 0x1ed]
call fcn.1000f791
push eax
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x82c]
push eax
lea ecx, [ebp - 0xa48]
call fcn.1000f794
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1a4]
call fcn.1000f740
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x3a4], 0x6364d64e
mov dword [ebp - 0x1e4], 0xbd2e84cb
mov dword [ebp - 0x784], 1
mov dword [ebp - 0x634], 0x74357240
mov dword [ebp - 0x63c], 2
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1000f782
and dword [eax], 0
jmp 0x1002fdde
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1000f782
mov dword [ebp - 0x4ec], eax
mov eax, dword [ebp - 0x4ec]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4ec]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1000f782
cmp dword [eax], 1
jg 0x100300ec
mov dword [ebp - 0xa0], 0x7cbb4028
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1000f782
push dword [eax]
lea ecx, [ebp - 0x1d4]
call fcn.1000f782
cmp dword [eax], 0
jne 0x1002fe29
mov dword [ebp - 0x4bc], 1
jmp 0x1002fe30
and dword [ebp - 0x4bc], 0
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1000f782
push dword [eax]
lea ecx, [ebp - 0x1d4]
call fcn.1000f782
cmp dword [eax], 0
je 0x1002fea9
push 1
lea ecx, [ebp - 0x1d4]
call fcn.1000f782
cmp dword [eax], 0
jle 0x1002fe6d
mov dword [ebp - 0x384], 1
jmp 0x1002fe74
and dword [ebp - 0x384], 0
push 0
lea ecx, [ebp - 0x1d4]
call fcn.1000f782
mov ecx, dword [ebp - 0x384]
add ecx, dword [eax]
je 0x1002fea9
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1000f782
cmp dword [eax], 0
je 0x1002fea9
mov dword [ebp - 0x62c], 1
jmp 0x1002feb0
and dword [ebp - 0x62c], 0
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1000f782
push dword [eax]
lea ecx, [ebp - 0x1d4]
call fcn.1000f782
mov esi, dword [ebp - 0x3a4]
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1000f782
add esi, dword [eax]
je 0x1002ff0c
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1000f782
push dword [eax]
lea ecx, [ebp - 0x1d4]
call fcn.1000f782
cmp dword [eax], 0
je 0x1002ff0c
mov dword [ebp - 0x454], 1
jmp 0x1002ff13
and dword [ebp - 0x454], 0
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1000f782
mov ecx, dword [ebp - 0x454]
cmp ecx, dword [eax]
jge 0x1002ff36
mov dword [ebp - 0x38c], 1
jmp 0x1002ff3d
and dword [ebp - 0x38c], 0
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1000f782
push dword [eax]
lea ecx, [ebp - 0x1d4]
call fcn.1000f782
mov eax, dword [eax]
cmp eax, dword [ebp - 0x38c]
jge 0x1002ff6d
mov dword [ebp - 0x394], 1
jmp 0x1002ff74
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x4bc]
cmp eax, dword [ebp - 0x394]
jl 0x10030045
mov dword [ebp - 0x514], 3
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x9cc], eax
push 0
lea ecx, [ebp - 0x1d4]
call fcn.1000f782
push 0
lea ecx, [ebp - 0x7d8]
call fcn.1000f782
cmp dword [eax], 0
jne 0x1002ffc4
mov dword [ebp - 0x45c], 1
jmp 0x1002ffcb
and dword [ebp - 0x45c], 0
cmp dword [ebp - 0x45c], 0x18b359bf
jle 0x1002ffe3
mov dword [ebp - 0x39c], 1
jmp 0x1002ffea
and dword [ebp - 0x39c], 0
push 0
lea ecx, [ebp - 0x1a4]
call fcn.1000f782
push dword [eax]
lea ecx, [ebp - 0x1d4]
call fcn.1000f782
mov ecx, dword [ebp - 0x39c]
cmp ecx, dword [eax]
jne 0x1003001a
mov dword [ebp - 0x724], 1
jmp 0x10030021
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x958], eax
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0xa14], eax
mov dword [ebp - 0xa0], 0xf85a06c0
jmp 0x1003008e
mov dword [ebp - 0xa0], 1
jmp 0x1003005e
mov eax, dword [ebp - 0xa0]
dec eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jl 0x1003008e
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x1e4], eax
mov byte [ebp - 0x7a], 0
push 0x7dbf
push 0x6701
lea eax, [ebp - 0x7a]
push eax
push 0
call fcn.10018d20
add esp, 0x10
jmp 0x10030051
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7d8]
push eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x3a4]
push eax
lea eax, [ebp - 0x1e4]
push eax
push 0x1535
lea eax, [ebp - 0x1d4]
push eax
lea eax, [ebp - 0x784]
push eax
push 1
push 0
push 0x1169
push 0x3a91
push 1
lea eax, [ebp - 0x1a4]
push eax
call fcn.1001bc90
add esp, 0x3c
jmp 0x1002fdba
mov eax, dword [ebp - 0x1e4]
cmp eax, dword [ebp - 0x63c]
jl 0x10030106
mov dword [ebp - 0x464], 1
jmp 0x1003010d
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x734], eax
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1a4]
call fcn.1000f766
jmp 0x1002fd04
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x7d8]
call fcn.1000f766
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x1d4]
call fcn.1000f766
mov byte [ebp - 0x5c], 0
push 3
lea ecx, [ebp - 0x870]
call fcn.1000f6e4
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x968], 0xffffffff
mov dword [ebp - 0x644], 0xfddd3f46
mov dword [ebp - 0x64c], 2
mov dword [ebp - 0x78c], 0xfffffffa
push 3
lea ecx, [ebp - 0x858]
call fcn.1000f6e4
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x3ac], 0xc3d4e703
push 3
lea ecx, [ebp - 0x894]
call fcn.1000f6e4
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x20], 0
jmp 0x100301c4
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x100301e0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x870]
call fcn.1000f782
mov dword [eax], 0xc08901f2
jmp 0x100301bd
push 0
lea eax, [ebp - 0x20]
push eax
push 0x3b7f
push 0x3f58
lea eax, [ebp - 0x858]
push eax
push 0x567c
push 0x1f75
call fcn.1001a4b9
add esp, 0x1c
mov dword [ebp - 0x20], 0
jmp 0x10030219
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x10030232
push dword [ebp - 0x20]
lea ecx, [ebp - 0x894]
call fcn.1000f782
or dword [eax], 0xffffffff
jmp 0x10030212
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
push 0x35e2
push 0x24d8
push 0x3856
push 1
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0x870]
push eax
push 0
push 0x645d
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x78c]
push eax
lea eax, [ebp - 0x894]
push eax
push 0
lea eax, [ebp - 0x64c]
push eax
push 0x2357
push 0x5b14
push 0x1269
push 0x5bbf
call fcn.1002d369
add esp, 0x44
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x894]
call fcn.1000f766
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x858]
call fcn.1000f766
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x870]
call fcn.1000f766
movzx eax, byte [ebp - 0x5c]
test eax, eax
je 0x100302dc
push 0
call fcn.1001a2fd
pop ecx
mov byte [ebp - 4], 0x20
cmp dword [ebp - 0x4c4], 0xfffffcfe
jge 0x100302fc
mov edx, dword [ebp - 0x744]
mov ecx, 0x10609ad8
call fcn.10011079
jmp 0x10030318
mov dword [ebp - 4], 0x14
jmp 0x10030328
jmp 0x1002fbaf
push 3
lea ecx, [ebp - 0x248]
call fcn.1000f6e4
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x654], 0xbe4438be
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x9d4], 1
mov dword [ebp - 0x40], 0
jmp 0x1003036c
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x10030382
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x208], 0xfffffff8
jmp 0x10030365
mov dword [ebp - 0x40], 0
jmp 0x10030392
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x100303ab
push dword [ebp - 0x40]
lea ecx, [ebp - 0x248]
call fcn.1000f782
and dword [eax], 0
jmp 0x1003038b
push 0
lea ecx, [ebp - 0x248]
call fcn.1000f782
and dword [eax], 0
jmp 0x100303e1
push 0
lea ecx, [ebp - 0x248]
call fcn.1000f782
mov dword [ebp - 0x3b4], eax
mov eax, dword [ebp - 0x3b4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3b4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x248]
call fcn.1000f782
cmp dword [eax], 0
jg 0x1003043d
push 0
lea ecx, [ebp - 0x248]
call fcn.1000f782
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x208]
push 0
lea ecx, [ebp - 0x248]
call fcn.1000f782
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x208], esi
push 0
lea ecx, [ebp - 0x248]
call fcn.1000f782
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x208]
mov dword [ebp - 0x654], eax
jmp 0x100303bd
mov dword [ebp - 0x46c], 0x2dd2
mov dword [ebp - 0x79c], 0x1000a5c8
cmp dword [ebp - 0x46c], 0x2df1
jle 0x10030570
and dword [ebp - 0x180], 0
jmp 0x10030477
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0x7340
jge 0x10030570
and dword [ebp - 0x1ac], 0
jmp 0x1003049d
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0x6a11
jge 0x1003056b
and dword [ebp - 0xf0], 0
jmp 0x100304c3
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0x67e
jge 0x10030566
and dword [ebp - 0xf8], 0
jmp 0x100304e9
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0x6d48
jge 0x10030561
mov eax, dword [ebp - 0x180]
mov ecx, dword [ebp - 0x1ac]
sar eax, cl
mov ecx, dword [ebp - 0xf0]
sar eax, cl
mov ecx, dword [ebp - 0xf8]
shl eax, cl
cdq
mov dword [ebp - 0x6b0], eax
mov dword [ebp - 0x6ac], edx
push dword [ebp - 0x6ac]
push dword [ebp - 0x6b0]
lea ecx, [ebp - 0xac0]
call fcn.1000d000
pop ecx
pop ecx
mov dword [ebp - 0x794], eax
mov ecx, dword [ebp - 0x794]
call fcn.1000f5af
push eax
call fcn.1004b356
pop ecx
lea ecx, [ebp - 0xac0]
call fcn.1000f5a5
jmp 0x100304dc
jmp 0x100304b6
jmp 0x10030490
jmp 0x1003046a
push 1
lea ecx, [ebp - 0x248]
call fcn.1000f782
mov eax, dword [eax]
mov dword [ebp - 0x660], eax
mov byte [ebp - 4], 0x23
cmp dword [ebp - 0x46c], 0x2ca6
jge 0x100305a1
push dword [ebp - 0x79c]
call fcn.1004b356
pop ecx
jmp 0x100305bd
mov dword [ebp - 4], 0x22
jmp 0x100305cd
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x248]
call fcn.1000f766
mov dword [ebp - 0x100], 0
jmp 0x100305f5
cmp dword [ebp - 0x100], 7
jg 0x10031b01
mov dword [ebp - 0x684], 0xfffffffb
push 3
lea ecx, [ebp - 0xe8]
call fcn.1000f6e4
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x1ec], 0xe4f1f13b
mov dword [ebp - 0x58], 0x2ea21e1d
mov dword [ebp - 0x2a0], 0x314d41bd
mov dword [ebp - 0x750], 5
lea eax, [ebp - 0x978]
push eax
push 0x788d
push 1
lea eax, [ebp - 0xe8]
push eax
push 1
push 0x42cd
push 0x5577
push 0x2100
push 0
push 0x6687
call fcn.100195fb
add esp, 0x28
push 1
lea ecx, [ebp - 0xe8]
call fcn.1000f782
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
je 0x100307be
push 1
lea ecx, [ebp - 0xe8]
call fcn.1000f782
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov esi, dword [ebp - 0x58]
push 1
lea ecx, [ebp - 0xe8]
call fcn.1000f782
cmp esi, dword [eax]
je 0x100306c5
mov dword [ebp - 0x254], 1
jmp 0x100306cc
and dword [ebp - 0x254], 0
imul eax, dword [ebp - 0x254], 0xf34e
test eax, eax
jne 0x100306e9
cmp dword [ebp - 0x58], 0
jne 0x100306e9
and dword [ebp - 0x258], 0
jmp 0x100306f3
mov dword [ebp - 0x258], 1
cmp dword [ebp - 0x258], 0
jle 0x1003070b
cmp dword [ebp - 0x58], 0
jne 0x1003070b
and dword [ebp - 0x250], 0
jmp 0x10030715
mov dword [ebp - 0x250], 1
cmp dword [ebp - 0x250], 7
jbe 0x1003072a
mov dword [ebp - 0x66c], 1
jmp 0x10030731
and dword [ebp - 0x66c], 0
push 2
lea ecx, [ebp - 0xe8]
call fcn.1000f782
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x9f4], eax
push 1
lea ecx, [ebp - 0xe8]
call fcn.1000f782
push 0
lea ecx, [ebp - 0xe8]
call fcn.1000f782
cmp dword [eax], 0xfffa
jbe 0x10030775
and dword [ebp - 0x278], 0
push 0
lea ecx, [ebp - 0xe8]
call fcn.1000f782
mov ecx, dword [ebp - 0x278]
cmp ecx, dword [eax]
jle 0x100307e8
mov dword [ebp - 0x280], 1
jmp 0x100307ef
and dword [ebp - 0x280], 0
mov esi, dword [ebp - 0x1ec]
push 1
lea ecx, [ebp - 0xe8]
call fcn.1000f782
add esi, dword [eax]
cmp esi, dword [ebp - 0x280]
jne 0x10030818
mov dword [ebp - 0x288], 1
jmp 0x1003081f
and dword [ebp - 0x288], 0
push 1
lea ecx, [ebp - 0xe8]
call fcn.1000f782
mov ecx, dword [ebp - 0x288]
cmp ecx, dword [eax]
jge 0x10030842
mov dword [ebp - 0x290], 1
jmp 0x10030849
and dword [ebp - 0x290], 0
cmp dword [ebp - 0x290], 1
jle 0x1003085e
mov dword [ebp - 0x298], 1
jmp 0x10030865
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x988], eax
push 2
lea ecx, [ebp - 0xe8]
call fcn.1000f782
mov eax, dword [ebp - 0x1ec]
cmp eax, dword [ebp - 0x1ec]
jle 0x100308a8
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x740]
call fcn.1000f766
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9a4]
call fcn.1000f766
cmp dword [ebp - 0x1e0], 0
jle 0x10031e50
push 0
push 0x692c
push 0x15b1
push 0x1b76
push 0
push 1
push 0x4a85
call fcn.100188f4
add esp, 0x1c
push 4
push 0x1000
push dword [ebp - 0x1e0]
mov eax, dword [ebp - 0x4a8]
mov ecx, dword [ebp - 0x5a8]
add ecx, dword [eax + 0xc]
push ecx
push 0x2d22
push 0x5037
call fcn.10016449
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x1e8]
mov dword [ecx], eax
mov dword [ebp - 0x200], 0x4ccb63e8
mov dword [ebp - 0x1dc], 0xfffffff9
push 3
lea ecx, [ebp - 0x87c]
call fcn.1000f6e4
mov dword [ebp - 4], 0x2e
mov dword [ebp - 0x7e8], 1
mov dword [ebp - 0x7e4], 1
mov dword [ebp - 0x7e0], 1
mov dword [ebp - 0x7dc], 1
mov dword [ebp - 0x498], 0xa2324015
push 2
lea ecx, [ebp - 0x8a0]
call fcn.1000f6e4
mov byte [ebp - 4], 0x2f
mov dword [ebp - 0x30], 0
jmp 0x10031c01
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x10031c17
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x9b4], 0x6ee97341
jmp 0x10031bfa
mov dword [ebp - 0x30], 0
jmp 0x10031c27
cmp dword [ebp - 0x30], 3
jge 0x10031c43
push dword [ebp - 0x30]
lea ecx, [ebp - 0x87c]
call fcn.1000f782
mov dword [eax], 0xfffffffe
jmp 0x10031c20
push 0
lea eax, [ebp - 0x30]
push eax
push 0x6ad9
lea eax, [ebp - 0x8a0]
push eax
push 1
push 1
push 0x75c
call fcn.100188f4
add esp, 0x1c
cmp dword [ebp - 0x200], 0xfffffffa
je 0x10031c7b
jmp 0x1003213b
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0x5f8], eax
mov eax, dword [ebp - 0x5c8]
mov dword [ebp - 0x600], eax
mov eax, dword [ebp - 0x5d0]
mov dword [ebp - 0x608], eax
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 0x610], eax
mov dword [ebp - 0x4b0], 0x6c94
mov dword [ebp - 0x5e8], 0x1000a640
cmp dword [ebp - 0x4b0], 0x6cf1
jle 0x10031f58
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
and dword [ebp - 0x140], 0
jmp 0x10031ec5
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0x61ae
jge 0x10031f58
and dword [ebp - 0x148], 0
jmp 0x10031eeb
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0x750c
jge 0x10031f53
and dword [ebp - 0x150], 0
jmp 0x10031f0d
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0x490c
jge 0x10031f51
mov eax, dword [ebp - 0x140]
imul eax, dword [ebp - 0x148]
xor eax, dword [ebp - 0x150]
cdq
mov dword [ebp - 0x6c8], eax
mov dword [ebp - 0x6c4], edx
push dword [ebp - 0x6c4]
push dword [ebp - 0x6c8]
mov ecx, 0x10609ad8
call fcn.1000f5cf
jmp 0x10031f00
jmp 0x10031ede
jmp 0x10031eb8
mov eax, dword [ebp - 0x5e0]
mov dword [ebp - 0x618], eax
mov dword [ebp - 4], 0x30
cmp dword [ebp - 0x4b0], 0x6920
jge 0x10031f87
mov edx, dword [ebp - 0x5e8]
mov ecx, 0x10609ad8
call fcn.10011079
jmp 0x10031fa3
or dword [ebp - 4], 0xffffffff
jmp 0x10031fad
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x620], eax
mov eax, dword [ebp - 0x5f8]
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x600]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x610]
mov dword [ebp - 0x628], eax
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0x638], eax
push 2
mov ecx, dword [ebp - 0x158]
call fcn.1000f782
cmp dword [eax], 0
je 0x1003211a
push 2
mov ecx, dword [ebp - 0x4b8]
call fcn.1000f782
mov esi, eax
push 1
mov ecx, dword [ebp - 0x158]
call fcn.1000f782
mov eax, dword [eax]
cmp eax, dword [esi]
jl 0x10032045
mov dword [ebp - 0x4d8], 1
jmp 0x1003204c
and dword [ebp - 0x4d8], 0
push 2
mov ecx, dword [ebp - 0x158]
call fcn.1000f782
mov eax, dword [ebp - 0x4e0]
mov esi, dword [eax]
push 2
mov ecx, dword [ebp - 0x4d0]
call fcn.1000f782
cmp esi, dword [eax]
jne 0x1003207e
mov dword [ebp - 0x4c0], 1
jmp 0x10032085
and dword [ebp - 0x4c0], 0
push 2
mov ecx, dword [ebp - 0x4b8]
call fcn.1000f782
mov ecx, dword [ebp - 0x4c0]
cmp ecx, dword [eax]
jl 0x100320b7
push 2
mov ecx, dword [ebp - 0x158]
call fcn.1000f782
cmp dword [eax], 0
jne 0x100320b7
and dword [ebp - 0x4c8], 0
jmp 0x100320c1
mov dword [ebp - 0x4c8], 1
cmp dword [ebp - 0x4c8], 0xffffffff
je 0x100320d6
mov dword [ebp - 0x160], 1
jmp 0x100320dd
and dword [ebp - 0x160], 0
push 2
mov ecx, dword [ebp - 0x4d0]
call fcn.1000f782
mov ecx, dword [ebp - 0x160]
mov dword [eax], ecx
mov eax, dword [ebp - 0x628]
mov ecx, dword [ebp - 0x160]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4d8]
add eax, dword [ebp - 0x160]
je 0x1003211a
mov dword [ebp - 0x630], 1
jmp 0x10032121
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x638]
mov eax, dword [eax]
mov dword [ebp - 0x9e0], eax
mov eax, dword [ebp - 0x4e0]
mov dword [eax], 0xfffffffd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret