Function at 0x1001d19b
Capabilities:
Compare security identifiers
Connect pipe
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008598e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xafc
push esi
push 4
lea ecx, [ebp - 0x7f4]
call fcn.10016d92
and dword [ebp - 4], 0
mov dword [ebp - 0x1c0], 4
mov dword [ebp - 0xa7c], 0x4f3f7e81
push 1
lea ecx, [ebp - 0x9ec]
call fcn.10016d92
mov byte [ebp - 4], 1
mov dword [ebp - 0x58], 0
jmp 0x1001d200
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 4
jge 0x1001d21c
push dword [ebp - 0x58]
lea ecx, [ebp - 0x7f4]
call fcn.10016e0a
mov dword [eax], 7
jmp 0x1001d1f9
mov dword [ebp - 0x58], 0
jmp 0x1001d22c
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1001d248
push dword [ebp - 0x58]
lea ecx, [ebp - 0x9ec]
call fcn.10016e0a
mov dword [eax], 0x76fda024
jmp 0x1001d225
mov dword [ebp - 0x1c0], 3
jmp 0x1001d261
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jl 0x1001d4b5
mov dword [ebp - 0x6c], 1
push 2
lea ecx, [ebp - 0x9dc]
call fcn.10016d92
mov byte [ebp - 4], 2
lea eax, [ebp - 0x96c]
push eax
push 0x497
lea eax, [ebp - 0x9dc]
push eax
push 0x194d
push 0
push 0x2a12
call fcn.10023798
add esp, 0x18
mov dword [ebp - 0x6c], 0
jmp 0x1001d2bd
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jg 0x1001d30a
mov byte [ebp - 0xa9], 0
push 0x7d4f
push 0
lea eax, [ebp - 0xa9]
push eax
call fcn.1001ccbc
add esp, 0xc
push 0x5c84
push 0x2734
push 0x2aad
push 0x78be
push 0x78a1
push 0
push 0x2b52
call fcn.1001c955
add esp, 0x1c
jmp 0x1001d2b6
mov dword [ebp - 0x6c], 3
jmp 0x1001d31a
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jl 0x1001d4a1
mov dword [ebp - 0x12c], 0x20bd035c
push 1
lea ecx, [ebp - 0x8c0]
call fcn.10016d92
mov byte [ebp - 4], 3
mov dword [ebp - 0x298], 0
push 0x26c0
lea eax, [ebp - 0x984]
push eax
push 1
lea eax, [ebp - 0x8c0]
push eax
call fcn.1001af67
add esp, 0x10
mov dword [ebp - 0x12c], 3
jmp 0x1001d37f
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jl 0x1001d48d
mov dword [ebp - 0xe8], 0x92f644a
mov dword [ebp - 0x980], 0x7e3bc4ae
mov dword [ebp - 0xa30], 0x45b3659e
mov dword [ebp - 0x988], 0xfffffffe
mov dword [ebp - 0xe8], 0
jmp 0x1001d3cd
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 3
jg 0x1001d488
mov dword [ebp - 0xa3c], 0xffffffff
push 2
lea ecx, [ebp - 0x9cc]
call fcn.10016d92
mov byte [ebp - 4], 4
push 0x1a8b
lea eax, [ebp - 0x9cc]
push eax
lea eax, [ebp - 0x990]
push eax
push 0
push 0x3589
call fcn.1001d013
add esp, 0x14
mov eax, dword [ebp - 0x298]
inc eax
mov dword [ebp - 0x298], eax
lea eax, [ebp - 0x298]
push eax
push 0xff8
push 0x2a94
push 0xee
push 0
push 0x63b2
lea eax, [ebp - 0x7f4]
push eax
push 0x4fd2
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x8c0]
push eax
push 0x24fc
push 0x5579
call fcn.1001c21a
add esp, 0x34
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x9cc]
call fcn.10016dee
jmp 0x1001d3c0
jmp 0x1001d372
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8c0]
call fcn.10016dee
jmp 0x1001d313
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x9dc]
call fcn.10016dee
jmp 0x1001d254
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x9ec]
call fcn.10016dee
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7f4]
call fcn.10016dee
mov dword [ebp - 0x110], 0x97f6af11
mov dword [ebp - 0x110], 0xfffffff2
jmp 0x1001d4f6
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x19
jle 0x1001d723
mov dword [ebp - 0x124], 0x5c19c5a6
mov dword [ebp - 0x1c8], 0
jmp 0x1001d526
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 2
jge 0x1001d542
mov eax, dword [ebp - 0x1c8]
mov dword [ebp + eax*4 - 0x97c], 0xa414
jmp 0x1001d519
cmp dword [ebp - 0x124], 0
je 0x1001d550
jmp 0x1001d723
mov dword [ebp - 0x124], 0x11
jmp 0x1001d569
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0x17
jl 0x1001d71e
mov dword [ebp - 0x6bc], 0
mov dword [ebp - 0x68], 0
jmp 0x1001d590
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x1001d5a6
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x98], 1
jmp 0x1001d589
mov dword [ebp - 0x68], 0
jmp 0x1001d5b6
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x1001d5cc
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x7a0], 0xfffffffb
jmp 0x1001d5af
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x98], 0
jmp 0x1001d5fa
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x98]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x98], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x98], 1
jg 0x1001d620
push 0x27bd
push 0
push 0x69f8
call fcn.1001b8bb
add esp, 0xc
jmp 0x1001d5df
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x7a0], 0
jmp 0x1001d64e
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7a0]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x7a0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x7a0], 1
jg 0x1001d719
mov dword [ebp - 0x3c8], 0x3672d714
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7a0]
mov eax, dword [ebp + eax*4 - 0x97c]
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x3c8], eax
jne 0x1001d6a0
mov dword [ebp - 0x2a0], 1
jmp 0x1001d6a7
and dword [ebp - 0x2a0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2a0]
mov dword [ebp + eax - 0x98], ecx
cmp dword [ebp - 0x2a0], 0
je 0x1001d701
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x98]
mov dword [ebp - 0x548], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x548]
mov dword [ebp + eax - 0x98], ecx
cmp dword [ebp - 0x548], 0x85b6478c
je 0x1001d701
mov dword [ebp - 0x550], 1
jmp 0x1001d708
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x6bc], eax
jmp 0x1001d633
jmp 0x1001d55c
jmp 0x1001d4e9
mov eax, dword [0x1067a5d0]
and eax, 1
jne 0x1001d75a
mov eax, dword [0x1067a5d0]
or eax, 1
mov dword [0x1067a5d0], eax
mov dword [ebp - 4], 5
mov ecx, 0x1067a5a8
call fcn.10016f06
push 0x100880de
call fcn.1006b7e6
pop ecx
or dword [ebp - 4], 0xffffffff
push dword [ebp + 8]
lea ecx, [ebp - 0x8d8]
call fcn.10016b47
mov dword [ebp - 4], 6
lea eax, [ebp - 0xa44]
push eax
lea ecx, [ebp - 0x8d8]
call fcn.10017379
push dword [eax]
lea eax, [ebp - 0x998]
push eax
lea ecx, [ebp - 0x8d8]
call fcn.1001738d
push dword [eax]
lea eax, [ebp - 0xa68]
push eax
lea ecx, [ebp - 0x8d8]
call fcn.10017379
push dword [eax]
mov edx, 0x10019d31
lea ecx, [ebp - 0x9a0]
call fcn.10023f78
add esp, 0xc
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x504], 1
mov dword [ebp - 0x8e8], 1
mov dword [ebp - 0x8e4], 1
mov dword [ebp - 0x8e0], 1
mov dword [ebp - 0x8dc], 1
push 1
lea ecx, [ebp - 0x9fc]
call fcn.10016d92
mov byte [ebp - 4], 7
mov dword [ebp - 0x184], 0
jmp 0x1001d821
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 1
jge 0x1001d843
push dword [ebp - 0x184]
lea ecx, [ebp - 0x9fc]
call fcn.10016e0a
mov dword [eax], 0xe7eb6652
jmp 0x1001d814
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x1001d86e
push 0x48f3
push 0x33a9
push 1
push 0xf9e
call fcn.1001afda
add esp, 0x10
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
je 0x1001d882
mov dword [ebp - 0x558], 1
jmp 0x1001d889
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xa40], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x9a8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xa80], eax
push 6
pop eax
test eax, eax
je 0x1001d8bd
cmp dword [ebp - 0x10], 0
je 0x1001d8bd
mov dword [ebp - 0x590], 1
jmp 0x1001d8c4
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x558]
cmp eax, dword [ebp - 0x590]
je 0x1001d917
mov dword [ebp - 0x618], 0xd07
mov dword [ebp - 0x10], 0xfffffff7
jmp 0x1001d8ec
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xf
jge 0x1001d902
push 0x4da3
push 0
call fcn.1001b10f
pop ecx
pop ecx
jmp 0x1001d8e5
lea eax, [ebp - 0x618]
push eax
push 1
call fcn.1001b10f
pop ecx
pop ecx
jmp 0x1001daed
mov dword [ebp - 0x144], 1
push 1
lea ecx, [ebp - 0x80c]
call fcn.10016d92
mov byte [ebp - 4], 8
lea eax, [ebp - 0x80c]
push eax
push 0x23cb
lea eax, [ebp - 0x9b0]
push eax
push 0
call fcn.1002382d
add esp, 0x10
mov byte [ebp - 0x93], 0
movzx eax, byte [ebp - 0x93]
test eax, eax
je 0x1001d975
push 0x1afb
push 1
push 0x6eb0
call fcn.1001b169
add esp, 0xc
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0xa48], eax
cmp dword [ebp - 0x10], 0x27f3
je 0x1001d996
mov dword [ebp - 0x564], 1
jmp 0x1001d99d
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x564], eax
jl 0x1001d9bd
cmp dword [ebp - 0x10], 0
je 0x1001d9bd
mov dword [ebp - 0x44c], 1
jmp 0x1001d9c4
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x44c]
jg 0x1001d9db
mov dword [ebp - 0x540], 1
jmp 0x1001d9e2
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x540]
inc eax
inc eax
cmp eax, dword [ebp - 0x144]
jne 0x1001d9fe
mov dword [ebp - 0x61c], 1
jmp 0x1001da05
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x9b8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xa70], eax
cmp dword [ebp - 0x10], 0x7a7b
jg 0x1001da32
mov eax, 0xbe26b5cf
test eax, eax
jne 0x1001da32
and dword [ebp - 0x2e4], 0
jmp 0x1001da3c
mov dword [ebp - 0x2e4], 1
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x504], eax
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x2ec], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2ec]
mov dword [ebp + eax - 0x8e8], ecx
cmp dword [ebp - 0x2ec], 0
jne 0x1001da82
cmp dword [ebp - 0x144], 0
jne 0x1001da82
and dword [ebp - 0x454], 0
jmp 0x1001da8c
mov dword [ebp - 0x454], 1
cmp dword [ebp - 0x454], 0x5c2dd78f
jle 0x1001daa4
mov dword [ebp - 0x2f4], 1
jmp 0x1001daab
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x2f4], eax
jle 0x1001dac2
mov dword [ebp - 0x580], 1
jmp 0x1001dac9
and dword [ebp - 0x580], 0
push 0
lea ecx, [ebp - 0x80c]
call fcn.10016e0a
mov ecx, dword [ebp - 0x580]
mov dword [eax], ecx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x80c]
call fcn.10016dee
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x9fc]
call fcn.10016dee
lea ecx, [ebp - 0x8d8]
call fcn.10019cbc
mov dword [ebp - 0x530], eax
movzx eax, byte [0x1067a4ee]
test eax, eax
je 0x1001e231
mov ecx, 0x1067a5a8
call fcn.10023c46
movzx eax, al
test eax, eax
jne 0x1001e231
mov dword [ebp - 0x78], 0
push 2
lea ecx, [ebp - 0x730]
call fcn.10016d92
mov byte [ebp - 4], 9
mov dword [ebp - 0x31c], 0
mov dword [ebp - 0x20], 0
jmp 0x1001db63
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1001db7f
push dword [ebp - 0x20]
lea ecx, [ebp - 0x730]
call fcn.10016e0a
mov dword [eax], 1
jmp 0x1001db5c
mov dword [ebp - 0x20], 0
jmp 0x1001db8f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1001dba5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x464], 8
jmp 0x1001db88
mov dword [ebp - 0x20], 0
jmp 0x1001dbb5
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1001dbcb
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xaa0], 0xfffffff7
jmp 0x1001dbae
push 0x274
push 1
lea eax, [ebp - 0x78]
push eax
call fcn.1001b1de
add esp, 0xc
mov dword [ebp - 0x78], 0
jmp 0x1001dbee
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x1a
jg 0x1001de1a
push 3
lea ecx, [ebp - 0x5f0]
call fcn.10016d92
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x17c], 0xde0184dc
mov dword [ebp - 0x624], 0xc0c8fbfc
push 0x7b94
push 0x1ab8
push 0
push 0x24ac
lea eax, [ebp - 0x5f0]
push eax
push 0x640
push 0x12aa
lea eax, [ebp - 0x9c0]
push eax
call fcn.1001b611
add esp, 0x20
mov eax, 0x5ed9a924
test eax, eax
je 0x1001dda5
push 1
lea ecx, [ebp - 0x5f0]
call fcn.10016e0a
mov eax, dword [eax]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
je 0x1001dd09
push 0
lea ecx, [ebp - 0x5f0]
call fcn.10016e0a
cmp dword [eax], 0
je 0x1001dc9d
mov eax, 0xb4f5
test eax, eax
je 0x1001dc9d
xor eax, eax
inc eax
jne 0x1001dcb8
push 1
lea ecx, [ebp - 0x5f0]
call fcn.10016e0a
cmp dword [eax], 0
jne 0x1001dcb8
and dword [ebp - 0x2fc], 0
jmp 0x1001dcc2
mov dword [ebp - 0x2fc], 1
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x2fc]
jne 0x1001dcd9
mov dword [ebp - 0x45c], 1
jmp 0x1001dce0
and dword [ebp - 0x45c], 0
mov esi, dword [ebp - 0x45c]
sub esi, dword [ebp - 0x17c]
push 1
lea ecx, [ebp - 0x5f0]
call fcn.10016e0a
cmp esi, dword [eax]
je 0x1001dd09
mov dword [ebp - 0x304], 1
jmp 0x1001dd10
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x78]
cmp eax, dword [ebp - 0x304]
jl 0x1001dd2d
cmp dword [ebp - 0x78], 0
je 0x1001dd2d
mov dword [ebp - 0x50c], 1
jmp 0x1001dd34
and dword [ebp - 0x50c], 0
push 0
lea ecx, [ebp - 0x730]
call fcn.10016e0a
mov ecx, dword [ebp - 0x50c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x30c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x30c]
mov dword [ebp + eax - 0x464], ecx
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x624], eax
push 0
lea ecx, [ebp - 0x730]
call fcn.10016e0a
cmp dword [eax], 0xd188
jge 0x1001dd99
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x464], 0
je 0x1001dda5
mov dword [ebp - 0x314], 1
jmp 0x1001ddac
and dword [ebp - 0x314], 0
cmp dword [ebp - 0x314], 0
jg 0x1001ddc1
mov dword [ebp - 0x588], 1
jmp 0x1001ddc8
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0x7a7bf748
jg 0x1001ddec
mov dword [ebp - 0x46c], 1
jmp 0x1001ddf3
and dword [ebp - 0x46c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x46c]
mov dword [ebp + eax - 0xaa0], ecx
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x5f0]
call fcn.10016dee
jmp 0x1001dbe7
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x730]
call fcn.10016dee
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x33c]
push eax
mov ecx, 0x1067a5a8
call fcn.10016ede
mov dword [ebp - 0xdc], 1
mov dword [ebp - 0xdc], 0xfffffff5
jmp 0x1001de64
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xffffffe7
jg 0x1001e107
push 2
lea ecx, [ebp - 0x59c]
call fcn.10016d92
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0x64], 0
jmp 0x1001de99
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x1001deb5
push dword [ebp - 0x64]
lea ecx, [ebp - 0x59c]
call fcn.10016e0a
mov dword [eax], 0x7e8b72fd
jmp 0x1001de92
mov dword [ebp - 0x64], 0
jmp 0x1001dec5
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1001dedb
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x57c], 1
jmp 0x1001debe
mov dword [ebp - 0x5c], 1
jmp 0x1001deeb
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x1001e0cd
mov dword [ebp - 0x70], 0x62c9cc14
mov dword [ebp - 0x2a8], 0x3e34b64b
mov dword [ebp - 0x2c0], 0xb641b44a
push 3
lea ecx, [ebp - 0x824]
call fcn.10016d92
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x824]
push eax
push 0
lea eax, [ebp - 0xa50]
push eax
call fcn.1001ba9a
add esp, 0xc
mov dword [ebp - 0x70], 0
jmp 0x1001df49
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jg 0x1001e036
push 1
call fcn.1001b23c
pop ecx
cmp dword [ebp - 0x70], 0
jne 0x1001df65
cmp dword [ebp - 0x70], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x324], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x324]
mov dword [ebp + eax - 0x57c], ecx
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x2c0]
sub eax, 0x1a1f0506
imul eax, dword [ebp - 0x70]
imul eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x5c]
jg 0x1001dfb1
mov dword [ebp - 0x32c], 1
jmp 0x1001dfb8
and dword [ebp - 0x32c], 0
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x59c]
call fcn.10016e0a
mov dword [ebp - 0x514], eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x59c]
call fcn.10016e0a
mov ecx, dword [ebp - 0x514]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x514]
mov eax, dword [eax]
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x2a8]
sub eax, 5
imul eax, dword [ebp - 0x32c]
cmp eax, 0x83bc
je 0x1001e015
mov dword [ebp - 0x474], 1
jmp 0x1001e01c
and dword [ebp - 0x474], 0
push 1
lea ecx, [ebp - 0x824]
call fcn.10016e0a
mov ecx, dword [ebp - 0x474]
mov dword [eax], ecx
jmp 0x1001df42
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x59c]
call fcn.10016e0a
imul eax, dword [eax], 0x280b
test eax, eax
jne 0x1001e099
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x2a8], eax
jg 0x1001e068
mov dword [ebp - 0x334], 1
jmp 0x1001e06f
and dword [ebp - 0x334], 0
imul eax, dword [ebp - 0x334], 0x7cf7
cmp eax, 0x211e9a9d
jge 0x1001e099
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x57c], 0
jne 0x1001e099
and dword [ebp - 0x62c], 0
jmp 0x1001e0a3
mov dword [ebp - 0x62c], 1
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x90c], eax
mov dword [ebp - 0x2c0], 0xfffffff8
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x824]
call fcn.10016dee
jmp 0x1001dee4
push 1
lea ecx, [ebp - 0x59c]
call fcn.10016e0a
cmp dword [eax], 0
je 0x1001e0f3
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x59c]
call fcn.10016dee
jmp 0x1001de57
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x59c]
call fcn.10016dee
jmp 0x1001de57
lea eax, [ebp - 0x910]
push eax
mov ecx, 0x1067a5a8
call fcn.10016ed0
push eax
lea ecx, [ebp - 0x33c]
call fcn.10016ef3
movzx eax, al
test eax, eax
je 0x1001e231
push 1
lea ecx, [ebp - 0x83c]
call fcn.10016d92
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x634], 0x60b4ffb8
mov dword [ebp - 0xd0], 0x35ca4204
mov dword [ebp - 0x918], 0
mov dword [ebp - 0x14c], 0
jmp 0x1001e177
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 1
jge 0x1001e196
push dword [ebp - 0x14c]
lea ecx, [ebp - 0x83c]
call fcn.10016e0a
or dword [eax], 0xffffffff
jmp 0x1001e16a
push 0xa5f
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0xd0]
push eax
push 1
call fcn.1001b3e0
add esp, 0x14
mov dword [ebp - 0xd0], 0
jmp 0x1001e1d3
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0xfffffff0
jge 0x1001e1f4
mov dword [ebp - 0x63c], 0xfffffffd
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x63c], eax
jmp 0x1001e1c6
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x83c]
call fcn.10016dee
lea ecx, [ebp - 0x33c]
call fcn.10023c4f
mov eax, dword [eax + 4]
mov dword [ebp - 0x644], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8d8]
call fcn.10016bcc
mov eax, dword [ebp - 0x644]
jmp 0x1002222a
mov dword [ebp - 0x74], 8
mov dword [ebp - 0x188], 0
jmp 0x1001e251
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 3
jge 0x1001e26d
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0xaac], 6
jmp 0x1001e244
mov dword [ebp - 0x74], 0
jmp 0x1001e27d
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jg 0x1001e2de
mov dword [ebp - 0xf0], 0x88a137b1
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x1001e2a7
push 1
call fcn.1001b513
pop ecx
mov dword [ebp - 0xf0], 0
jmp 0x1001e2c0
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 3
jge 0x1001e2dc
mov eax, dword [ebp - 0xf0]
mov dword [ebp + eax*4 - 0xaac], 0x1f782a18
jmp 0x1001e2b3
jmp 0x1001e276
mov dword [ebp - 0x74], 0xffffffee
jmp 0x1001e2ee
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xffffffe9
jne 0x1001e318
mov byte [ebp - 0x90], 0
push 0x6623
push 0
lea eax, [ebp - 0x90]
push eax
push 0x2476
call fcn.1001c840
add esp, 0x10
jmp 0x1001e2e7
and dword [ebp - 0xd4], 0
mov dword [ebp - 0x190], 0xba772304
push 4
lea ecx, [ebp - 0x854]
call fcn.10016d92
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x154], 0
jmp 0x1001e353
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 4
jge 0x1001e375
push dword [ebp - 0x154]
lea ecx, [ebp - 0x854]
call fcn.10016e0a
mov dword [eax], 1
jmp 0x1001e346
push 1
call fcn.1001b569
pop ecx
mov eax, dword [ebp - 0x190]
imul eax, dword [ebp - 0x190]
mov dword [ebp - 0x190], eax
mov esi, dword [ebp - 0x190]
push 2
lea ecx, [ebp - 0x854]
call fcn.10016e0a
mov dword [eax], esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x854]
call fcn.10016dee
lea eax, [ebp - 0x8d8]
push eax
call fcn.1001a5b4
pop ecx
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
jne 0x10021db8
cmp dword [0x1067a4e4], 0
jne 0x10021d92
mov dword [ebp - 0x15c], 0xfeba
mov dword [ebp - 0x7c0], 0xffffffff
mov dword [ebp - 0x7bc], 0xffffffff
mov dword [ebp - 0x7b8], 0xffffffff
mov dword [ebp - 0x7b4], 0xffffffff
mov dword [ebp - 0x64c], 0xf09a2b44
mov dword [ebp - 0x65c], 0x40eb
push 4
lea ecx, [ebp - 0x86c]
call fcn.10016d92
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x920], 0
push 0
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x928]
push eax
call fcn.1001cbd9
add esp, 0xc
cmp dword [ebp - 0x15c], 0
je 0x1001e53e
cmp dword [ebp - 0x15c], 0x9e923e64
jbe 0x1001e47f
mov dword [ebp - 0x34c], 1
jmp 0x1001e486
and dword [ebp - 0x34c], 0
cmp dword [ebp - 0x15c], 0
ja 0x1001e49b
mov dword [ebp - 0x47c], 1
jmp 0x1001e4a2
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x64c]
cmp dword [ebp - 0x47c], eax
jg 0x1001e4bc
mov dword [ebp - 0x344], 1
jmp 0x1001e4c3
and dword [ebp - 0x344], 0
cmp dword [ebp - 0x344], 0xf6802998
je 0x1001e4db
mov dword [ebp - 0x51c], 1
jmp 0x1001e4e2
and dword [ebp - 0x51c], 0
cmp dword [ebp - 0x51c], 0
jbe 0x1001e4f7
mov dword [ebp - 0x654], 1
jmp 0x1001e4fe
and dword [ebp - 0x654], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x34c]
mov dword [ebp + eax - 0x7c0], ecx
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x930], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x65c]
cmp dword [ebp + eax - 0x7c0], ecx
jg 0x1001e53e
mov dword [ebp - 0x484], 1
jmp 0x1001e545
and dword [ebp - 0x484], 0
push 0
lea ecx, [ebp - 0x86c]
call fcn.10016e0a
mov ecx, dword [ebp - 0x484]
mov dword [eax], ecx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x86c]
call fcn.10016dee
push 1
lea ecx, [ebp - 0x884]
call fcn.10016d92
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x664], 0xffffffff
push 0x60b9
push 0
lea eax, [ebp - 0x938]
push eax
lea eax, [ebp - 0x884]
push eax
push 0x2f0e
call fcn.1001b811
add esp, 0x14
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x1001e5cc
push 0
push 0x15fd
push 0x695a
call fcn.1001c64f
add esp, 0xc
push 0
lea ecx, [ebp - 0x884]
call fcn.10016e0a
mov eax, dword [eax]
mov dword [ebp - 0x664], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x884]
call fcn.10016dee
mov byte [ebp - 0x288], 5
mov byte [ebp - 0x287], 0x43
mov byte [ebp - 0x286], 2
mov byte [ebp - 0x285], 0x1e
mov byte [ebp - 0x284], 9
mov byte [ebp - 0x283], 0x16
mov byte [ebp - 0x282], 1
mov byte [ebp - 0x281], 1
mov byte [ebp - 0x280], 0xa
mov byte [ebp - 0x27f], 9
mov byte [ebp - 0x27e], 4
mov byte [ebp - 0x27d], 9
mov byte [ebp - 0x27c], 0x49
mov byte [ebp - 0x27b], 0xdb
mov byte [ebp - 0x27a], 0x5c
mov byte [ebp - 0x279], 0x14
mov byte [ebp - 0x278], 0x1f
mov byte [ebp - 0x277], 0x1f
mov byte [ebp - 0x276], 0x5c
mov byte [ebp - 0x275], 0x46
mov byte [ebp - 0x274], 0xd5
mov byte [ebp - 0x273], 0xd2
mov byte [ebp - 0x272], 0xd0
mov byte [ebp - 0x271], 0xcf
mov byte [ebp - 0x270], 0xb1
mov byte [ebp - 0x26f], 0x5a
mov byte [ebp - 0x26e], 0xf4
mov byte [ebp - 0x26d], 0x21
mov byte [ebp - 0x26c], 0xad
mov byte [ebp - 0x26b], 0x83
mov byte [ebp - 0x26a], 0x4a
mov byte [ebp - 0x269], 0xb6
mov byte [ebp - 0x268], 0xa2
mov byte [ebp - 0x267], 0xb0
mov byte [ebp - 0x266], 0x2f
mov byte [ebp - 0x265], 0x99
mov byte [ebp - 0x264], 0xbd
mov byte [ebp - 0x263], 0x30
mov byte [ebp - 0x262], 0xf0
mov byte [ebp - 0x261], 0
mov byte [ebp - 0x260], 0xbd
mov byte [ebp - 0x25f], 0x5e
mov byte [ebp - 0x25e], 0x6a
mov byte [ebp - 0x25d], 0x46
mov byte [ebp - 0x25c], 0x99
mov byte [ebp - 0x25b], 6
mov byte [ebp - 0x25a], 0xfd
mov byte [ebp - 0x259], 0xc1
mov byte [ebp - 0x258], 6
mov byte [ebp - 0x257], 0x11
mov byte [ebp - 0x256], 0x89
mov byte [ebp - 0x255], 0x44
mov byte [ebp - 0x254], 0x19
mov byte [ebp - 0x253], 0x7b
mov byte [ebp - 0x252], 0x22
mov byte [ebp - 0x251], 0x32
mov byte [ebp - 0x250], 0xf0
mov byte [ebp - 0x24f], 0xa7
mov byte [ebp - 0x24e], 0xa6
mov byte [ebp - 0x24d], 0x1c
mov byte [ebp - 0x24c], 0x1e
mov byte [ebp - 0x24b], 0xf5
mov byte [ebp - 0x24a], 8
mov byte [ebp - 0x249], 0xb3
mov byte [ebp - 0x248], 0x39
mov byte [ebp - 0x247], 0xc8
mov byte [ebp - 0x246], 0x54
mov byte [ebp - 0x245], 0x7d
mov byte [ebp - 0x244], 0xe7
mov byte [ebp - 0x243], 0x4e
mov byte [ebp - 0x242], 0xd7
mov byte [ebp - 0x241], 0x3a
mov byte [ebp - 0x240], 0x36
mov byte [ebp - 0x23f], 0xc7
mov byte [ebp - 0x23e], 0xef
mov byte [ebp - 0x23d], 0x44
mov byte [ebp - 0x23c], 0x7e
mov byte [ebp - 0x23b], 0x19
mov byte [ebp - 0x23a], 0x55
mov byte [ebp - 0x239], 0x77
mov byte [ebp - 0x238], 0xd4
mov byte [ebp - 0x237], 0xd9
mov byte [ebp - 0x236], 6
mov byte [ebp - 0x235], 0xd2
mov byte [ebp - 0x234], 0x27
mov byte [ebp - 0x233], 0x43
mov byte [ebp - 0x232], 3
mov byte [ebp - 0x231], 0xb
mov byte [ebp - 0x230], 0xb
mov byte [ebp - 0x22f], 2
mov byte [ebp - 0x22e], 8
mov byte [ebp - 0x22d], 0x42
mov byte [ebp - 0x22c], 6
mov byte [ebp - 0x22b], 0x1d
mov byte [ebp - 0x22a], 0
mov byte [ebp - 0x229], 0x78
mov byte [ebp - 0x228], 7
mov byte [ebp - 0x227], 0x79
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x288]
or eax, 0x2f
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x288]
and ecx, 0x2f
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x288]
mov word [ebp + ecx*2 - 0x904], ax
mov dword [ebp - 0x724], 0x15de
mov dword [ebp - 0x714], 0x486b6feb
mov dword [ebp - 0x71c], 0x8e10e5e5
mov dword [ebp - 0x680], 0
mov byte [ebp - 0x92], 0
movzx eax, byte [ebp - 0x92]
test eax, eax
je 0x1001e920
push 1
push 0x34cc
call fcn.1001b5a8
pop ecx
pop ecx
push 0
lea eax, [ebp - 0x714]
push eax
lea eax, [ebp - 0x71c]
push eax
lea eax, [ebp - 0x724]
push eax
lea eax, [ebp - 0x680]
push eax
call fcn.1001bbaf
add esp, 0x14
mov dword [ebp - 0x28], 2
and dword [ebp - 0x1a8], 0
jmp 0x1001e95e
mov eax, dword [ebp - 0x28]
inc eax
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x62
jae 0x1001f376
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0x6ac], 0xa27289ff
push 2
lea ecx, [ebp - 0x8a8]
call fcn.10016d92
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x6a4], 0x5e3d1aa1
mov dword [ebp - 0x130], 0xfffffff8
mov dword [ebp - 0x198], 0
jmp 0x1001e9ba
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 2
jge 0x1001e9d9
push dword [ebp - 0x198]
lea ecx, [ebp - 0x8a8]
call fcn.10016e0a
and dword [eax], 0
jmp 0x1001e9ad
lea eax, [ebp - 0x8a8]
push eax
lea eax, [ebp - 0x130]
push eax
push 1
lea eax, [ebp - 0xe0]
push eax
push 0xd48
lea eax, [ebp - 0x6ac]
push eax
lea eax, [ebp - 0x6a4]
push eax
push 0x495a
call fcn.1001b611
add esp, 0x20
mov dword [ebp - 0x130], 0
jmp 0x1001ea29
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0x18
jne 0x1001eaab
mov dword [ebp - 0xf8], 0x76cc72b7
mov dword [ebp - 0xe0], 0xa
jmp 0x1001ea55
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0x2b
jne 0x1001eaa6
cmp dword [ebp - 0xf8], 0
je 0x1001ea69
jmp 0x1001eaa6
mov dword [ebp - 0xf8], 0
jmp 0x1001ea82
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 1
jg 0x1001eaa4
mov byte [ebp - 0x8a], 0
push 1
lea eax, [ebp - 0x8a]
push eax
call fcn.1001b7ce
pop ecx
pop ecx
jmp 0x1001ea75
jmp 0x1001ea48
jmp 0x1001ea1c
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x8a8]
call fcn.10016dee
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x288]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x28], eax
jne 0x1001ed63
mov dword [ebp - 0x354], 1
mov dword [ebp - 0xc8], 0xfffffffc
mov dword [ebp - 0x164], 0
jmp 0x1001eb02
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 1
jge 0x1001eb1e
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x524], 0xffffffff
jmp 0x1001eaf5
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
je 0x1001eb45
cmp dword [ebp - 0x354], 0
jne 0x1001eb45
and dword [ebp - 0x56c], 0
jmp 0x1001eb4f
mov dword [ebp - 0x56c], 1
cmp dword [ebp - 0x56c], 0xfffffffd
jne 0x1001eb64
mov dword [ebp - 0x35c], 1
jmp 0x1001eb6b
and dword [ebp - 0x35c], 0
cmp dword [ebp - 0x35c], 0xabfc3938
jne 0x1001eb83
mov dword [ebp - 0x2bc], 1
jmp 0x1001eb8a
and dword [ebp - 0x2bc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2bc]
mov dword [ebp + eax - 0x524], ecx
cmp dword [ebp - 0x2bc], 0
je 0x1001ebe3
cmp dword [ebp - 0xc8], 0
jne 0x1001ebb8
cmp dword [ebp - 0xc8], 0
je 0x1001ebe3
mov byte [ebp - 0x8b], 0
movzx eax, byte [ebp - 0x8b]
test eax, eax
je 0x1001ebde
push 0x54e9
push 0
push 0x7bf9
call fcn.1001c129
add esp, 0xc
jmp 0x1001ed37
push 3
lea ecx, [ebp - 0x73c]
call fcn.10016d92
mov byte [ebp - 4], 0x12
push 2
lea ecx, [ebp - 0x8b4]
call fcn.10016d92
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x118], 0
jmp 0x1001ec1e
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 3
jge 0x1001ec40
push dword [ebp - 0x118]
lea ecx, [ebp - 0x73c]
call fcn.10016e0a
mov dword [eax], 3
jmp 0x1001ec11
lea eax, [ebp - 0x8b4]
push eax
push 1
push 0x3686
push 0x5d8d
lea eax, [ebp - 0x118]
push eax
call fcn.1001b811
add esp, 0x14
push 0
lea ecx, [ebp - 0x73c]
call fcn.10016e0a
cmp dword [eax], 0
jg 0x1001ec80
mov dword [ebp - 0x48c], 1
jmp 0x1001ec87
and dword [ebp - 0x48c], 0
push 0
lea ecx, [ebp - 0x73c]
call fcn.10016e0a
mov ecx, dword [ebp - 0x48c]
cmp ecx, dword [eax]
jg 0x1001ecaa
mov dword [ebp - 0x364], 1
jmp 0x1001ecb1
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0xdad816f9
ja 0x1001ecd5
mov dword [ebp - 0x36c], 1
jmp 0x1001ecdc
and dword [ebp - 0x36c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x524]
cmp eax, dword [ebp - 0x36c]
jg 0x1001ecfd
mov dword [ebp - 0x494], 1
jmp 0x1001ed04
and dword [ebp - 0x494], 0
push 0
lea ecx, [ebp - 0x8b4]
call fcn.10016e0a
mov ecx, dword [ebp - 0x494]
mov dword [eax], ecx
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x8b4]
call fcn.10016dee
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x73c]
call fcn.10016dee
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x288]
inc eax
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x288]
mov ecx, dword [ebp - 0x28]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x28], eax
jmp 0x1001e956
push 1
lea ecx, [ebp - 0xbc]
call fcn.10016d92
mov byte [ebp - 4], 0x14
mov dword [ebp - 0xa0], 0xf7bf48c4
mov dword [ebp - 0x7c], 0x513244d5
mov dword [ebp - 0x16c], 0xfffffffa
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x100], 0
jmp 0x1001edb2
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 2
jge 0x1001edce
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x138], 9
jmp 0x1001eda5
lea eax, [ebp - 0x100]
push eax
push 1
lea eax, [ebp - 0xbc]
push eax
call fcn.1001b8bb
add esp, 0xc
push 0
lea ecx, [ebp - 0xbc]
call fcn.10016e0a
mov dword [eax], 1
jmp 0x1001ee1f
push 0
lea ecx, [ebp - 0xbc]
call fcn.10016e0a
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x374]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x374]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xbc]
call fcn.10016e0a
cmp dword [eax], 0
jl 0x1001f168
mov dword [ebp - 0x1a0], 0
jmp 0x1001ee4e
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 3
jge 0x1001ee6a
mov eax, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0xac4], 0xffffffff
jmp 0x1001ee41
push 0
lea ecx, [ebp - 0xbc]
call fcn.10016e0a
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x138]
mov dword [ebp - 0xa0], eax
push 0
lea ecx, [ebp - 0xbc]
call fcn.10016e0a
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x138], 2
je 0x1001eeab
mov dword [ebp - 0x58c], 1
jmp 0x1001eeb2
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x58c], eax
jg 0x1001eecc
mov dword [ebp - 0x37c], 1
jmp 0x1001eed3
and dword [ebp - 0x37c], 0
cmp dword [ebp - 0x37c], 0x9fa8bc07
jbe 0x1001eeeb
mov dword [ebp - 0x49c], 1
jmp 0x1001eef2
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0xa0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x138]
cmp eax, dword [ebp - 0xa0]
jle 0x1001ef1f
mov dword [ebp - 0x384], 1
jmp 0x1001ef26
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x384]
jne 0x1001ef3d
mov dword [ebp - 0x52c], 1
jmp 0x1001ef44
and dword [ebp - 0x52c], 0
mov esi, dword [ebp - 0x7c]
push 0
lea ecx, [ebp - 0xbc]
call fcn.10016e0a
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x138]
imul eax, dword [ebp - 0x52c]
sub esi, eax
imul esi, esi, 0xa167
push 0
lea ecx, [ebp - 0xbc]
call fcn.10016e0a
cmp esi, dword [eax]
jne 0x1001ef8d
push 6
pop eax
test eax, eax
jne 0x1001ef8d
and dword [ebp - 0x38c], 0
jmp 0x1001ef97
mov dword [ebp - 0x38c], 1
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7c], eax
push 0
lea ecx, [ebp - 0xbc]
call fcn.10016e0a
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x138], 0
je 0x1001efce
mov eax, 0xab79ae4f
test eax, eax
je 0x1001efce
mov dword [ebp - 0x534], 1
jmp 0x1001efd5
and dword [ebp - 0x534], 0
push 0
lea ecx, [ebp - 0xbc]
call fcn.10016e0a
mov esi, dword [ebp - 0x16c]
push 0
lea ecx, [ebp - 0xbc]
call fcn.10016e0a
mov eax, dword [eax]
add esi, dword [ebp + eax*4 - 0x138]
je 0x1001f011
xor eax, eax
inc eax
je 0x1001f011
mov dword [ebp - 0x4a4], 1
jmp 0x1001f018
and dword [ebp - 0x4a4], 0
push 4
pop eax
shl eax, 0
imul ecx, dword [ebp - 0x4a4], 0
add ecx, 0xda56
cmp dword [ebp + eax - 0x138], ecx
jl 0x1001f040
mov dword [ebp - 0x394], 1
jmp 0x1001f047
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xf529
jg 0x1001f065
mov dword [ebp - 0x574], 1
jmp 0x1001f06c
and dword [ebp - 0x574], 0
push 0
lea ecx, [ebp - 0xbc]
call fcn.10016e0a
mov ecx, dword [ebp - 0x574]
cmp ecx, dword [eax]
jne 0x1001f08f
mov dword [ebp - 0x294], 1
jmp 0x1001f096
and dword [ebp - 0x294], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x294]
mov dword [ebp + eax - 0xac4], ecx
push 0
lea ecx, [ebp - 0xbc]
call fcn.10016e0a
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x138]
cmp dword [ebp - 0x294], eax
jge 0x1001f0d6
push 2
pop eax
test eax, eax
jne 0x1001f0d6
and dword [ebp - 0x39c], 0
jmp 0x1001f0e0
mov dword [ebp - 0x39c], 1
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x39c], eax
je 0x1001f0fa
mov dword [ebp - 0x4ac], 1
jmp 0x1001f101
and dword [ebp - 0x4ac], 0
push 0
lea ecx, [ebp - 0xbc]
call fcn.10016e0a
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x138]
cmp dword [ebp - 0x4ac], eax
jg 0x1001f12b
mov dword [ebp - 0x3a4], 1
jmp 0x1001f132
and dword [ebp - 0x3a4], 0
cmp dword [ebp - 0x3a4], 0xaecaa705
jbe 0x1001f14a
mov dword [ebp - 0x3ac], 1
jmp 0x1001f151
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x534]
add eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x128], eax
jmp 0x1001edfb
push 0
lea ecx, [ebp - 0xbc]
call fcn.10016e0a
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x7c], eax
jg 0x1001f18c
mov dword [ebp - 0x4b4], 1
jmp 0x1001f193
and dword [ebp - 0x4b4], 0
push 0
lea ecx, [ebp - 0xbc]
call fcn.10016e0a
mov ecx, dword [ebp - 0x4b4]
cmp ecx, dword [eax]
jl 0x1001f1b6
mov dword [ebp - 0x3b4], 1
jmp 0x1001f1bd
and dword [ebp - 0x3b4], 0
push 0
lea ecx, [ebp - 0xbc]
call fcn.10016e0a
mov ecx, dword [ebp - 0x3b4]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x16c]
jl 0x1001f1e6
mov dword [ebp - 0x584], 1
jmp 0x1001f1ed
and dword [ebp - 0x584], 0
cmp dword [ebp - 0x584], 0x3559
je 0x1001f205
mov dword [ebp - 0x3bc], 1
jmp 0x1001f20c
and dword [ebp - 0x3bc], 0
push 0
lea ecx, [ebp - 0xbc]
call fcn.10016e0a
mov eax, dword [eax]
cmp eax, dword [ebp - 0x3bc]
je 0x1001f22f
mov dword [ebp - 0x620], 1
jmp 0x1001f236
and dword [ebp - 0x620], 0
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x940], eax
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x128], eax
jge 0x1001f25c
mov dword [ebp - 0x6b4], 1
jmp 0x1001f263
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x948], eax
cmp dword [ebp - 0x16c], 0
je 0x1001f28d
mov eax, 0x5571
test eax, eax
je 0x1001f28d
mov dword [ebp - 0x4bc], 1
jmp 0x1001f294
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x16c]
cmp eax, dword [ebp - 0x4bc]
jl 0x1001f2ae
mov dword [ebp - 0x628], 1
jmp 0x1001f2b5
and dword [ebp - 0x628], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x138], 0
jne 0x1001f2c9
cmp dword [ebp - 0x7c], 0
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x950], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x138]
mov dword [ebp - 0x958], eax
push 0
lea ecx, [ebp - 0xbc]
call fcn.10016e0a
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xbc]
call fcn.10016dee
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x287]
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x1a8]
movzx ecx, byte [ebp + ecx - 0x28a]
movzx ecx, word [ebp + ecx*2 - 0x904]
or eax, ecx
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [ebp + ecx - 0x287]
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x1a8]
movzx edx, byte [ebp + edx - 0x28a]
movzx edx, word [ebp + edx*2 - 0x904]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [ebp + ecx - 0x288]
mov word [ebp + ecx*2 - 0x904], ax
and dword [ebp - 0x1a8], 0
jmp 0x1001e956
mov dword [ebp - 0x108], 0x69fdf99f
mov dword [ebp - 0x614], 1
mov dword [ebp - 0x108], 0
jmp 0x1001f3a3
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0xfffffffc
jne 0x1001f445
mov dword [ebp - 0x630], 0x887e08a1
push 1
lea ecx, [ebp - 0x800]
call fcn.10016d92
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x800]
push eax
push 0x1792
lea eax, [ebp - 0x960]
push eax
push 0x3b5a
push 0
call fcn.1001c032
add esp, 0x14
push 0x4c70
push 0
push 0x768a
call fcn.1001c8ca
add esp, 0xc
push 0x5b7b
lea eax, [ebp - 0x800]
push eax
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x630]
push eax
push 0x798b
push 1
lea eax, [ebp - 0x108]
push eax
call fcn.1001b929
add esp, 0x1c
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x800]
call fcn.10016dee
jmp 0x1001f396
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0x904], cx
mov dword [ebp - 0x174], 0
jmp 0x1001f46e
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 1
jge 0x1001f48a
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x6c4], 0
jmp 0x1001f461
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x6c4], 0xae355683
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x1001f4b7
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
lea eax, [ebp - 0x904]
push eax
lea ecx, [ebp - 0xb08]
call fcn.10023b98
mov dword [ebp - 0x638], eax
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x6cc], eax
mov byte [ebp - 4], 0x16
push dword [ebp - 0x6cc]
call fcn.1001a5b4
pop ecx
mov dword [ebp - 0x510], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xb08]
call fcn.10016bcc
mov dword [ebp - 0xd8], 5
mov dword [ebp - 0x6d4], 0x5dea
mov dword [ebp - 0xd8], 0x13
jmp 0x1001f52d
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 3
jne 0x1001f712
mov dword [ebp - 0x29c], 6
mov dword [ebp - 0x1b0], 0
jmp 0x1001f55d
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 1
jge 0x1001f579
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0x2ac], 0xbcef054a
jmp 0x1001f550
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x3c4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3c4]
mov dword [ebp + eax - 0x2ac], ecx
cmp dword [ebp - 0x3c4], 0
je 0x1001f5f1
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp - 0x29c], 0xfffffff6
imul ecx, ecx, 0xc383
cmp dword [ebp + eax - 0x2ac], ecx
jle 0x1001f5c9
mov dword [ebp - 0x53c], 1
jmp 0x1001f5d0
and dword [ebp - 0x53c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ac]
cmp dword [ebp - 0x53c], eax
jle 0x1001f5f1
mov dword [ebp - 0x3cc], 1
jmp 0x1001f5f8
and dword [ebp - 0x3cc], 0
imul eax, dword [ebp - 0x3cc], 6
test eax, eax
jne 0x1001f615
mov eax, 0xa968
test eax, eax
jne 0x1001f615
and dword [ebp - 0x640], 0
jmp 0x1001f61f
mov dword [ebp - 0x640], 1
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x968], eax
cmp dword [ebp - 0xd8], 0x37c5b151
jne 0x1001f643
mov dword [ebp - 0x4c4], 1
jmp 0x1001f64a
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x29c]
add eax, dword [ebp - 0x4c4]
je 0x1001f6dc
push 3
lea ecx, [ebp - 0x748]
call fcn.10016d92
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x13c], 0
jmp 0x1001f686
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 3
jge 0x1001f6a8
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x748]
call fcn.10016e0a
mov dword [eax], 0xd99ea7eb
jmp 0x1001f679
push 2
lea ecx, [ebp - 0x748]
call fcn.10016e0a
cmp dword [eax], 0
je 0x1001f6cb
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x748]
call fcn.10016dee
jmp 0x1001f712
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x748]
call fcn.10016dee
jmp 0x1001f70d
mov byte [ebp - 0x86], 0
movzx eax, byte [ebp - 0x86]
test eax, eax
je 0x1001f702
push 0x1e85
push 1
push 0x2511
call fcn.1001ba9a
add esp, 0xc
cmp dword [ebp - 0x6d4], 0
je 0x1001f70d
jmp 0x1001f712
jmp 0x1001f520
and dword [ebp - 0x1b8], 0
jmp 0x1001f728
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0xd
jae 0x1001fb00
mov dword [ebp - 0x30], 0xf6af1124
mov dword [ebp - 0x30], 0
jmp 0x1001f74c
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffff6
jg 0x1001faeb
push 4
lea ecx, [ebp - 0x5b4]
call fcn.10016d92
mov byte [ebp - 4], 0x18
mov dword [ebp - 0xc0], 0xffffffff
mov dword [ebp - 0x4dc], 0x266d991
mov dword [ebp - 0x44], 0
jmp 0x1001f78b
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x1001f7a7
push dword [ebp - 0x44]
lea ecx, [ebp - 0x5b4]
call fcn.10016e0a
mov dword [eax], 5
jmp 0x1001f784
mov dword [ebp - 0x44], 0
jmp 0x1001f7b7
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x1001f7cd
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x2d4], 0xa654fddd
jmp 0x1001f7b0
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x2d4], 0
jmp 0x1001f7fb
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x2d4]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x2d4], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2d4], 3
jg 0x1001fabd
mov dword [ebp - 0x40], 0xbb6bc3ec
mov dword [ebp - 0x404], 0xeb81f947
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x2d4]
lea ecx, [ebp - 0x5b4]
call fcn.10016e0a
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x4e70
jg 0x1001f9c6
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x970], eax
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x2d4]
lea ecx, [ebp - 0x5b4]
call fcn.10016e0a
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x2d4]
cmp dword [eax], ecx
je 0x1001f888
mov dword [ebp - 0x3d4], 1
jmp 0x1001f88f
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x3d4]
sub eax, dword [ebp - 0x30]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x2d4]
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x2d4]
jg 0x1001f8bf
mov dword [ebp - 0x560], 1
jmp 0x1001f8c6
and dword [ebp - 0x560], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2d4]
cmp eax, dword [ebp - 0x560]
jl 0x1001f8e6
mov dword [ebp - 0x3dc], 1
jmp 0x1001f8ed
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x3dc], eax
jge 0x1001f907
mov dword [ebp - 0x4cc], 1
jmp 0x1001f90e
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x4cc], eax
jg 0x1001f925
mov dword [ebp - 0x3e4], 1
jmp 0x1001f92c
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3e4]
lea eax, [ecx + eax + 0x229e0466]
cmp eax, dword [ebp - 0x30]
je 0x1001f94d
mov dword [ebp - 0x544], 1
jmp 0x1001f954
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x544], eax
je 0x1001f96b
mov dword [ebp - 0x3ec], 1
jmp 0x1001f972
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x3ec], eax
jne 0x1001f989
mov dword [ebp - 0x4d4], 1
jmp 0x1001f990
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x4d4], eax
jg 0x1001f9aa
mov dword [ebp - 0x3f4], 1
jmp 0x1001f9b1
and dword [ebp - 0x3f4], 0
cmp dword [ebp - 0x3f4], 0x3303
jge 0x1001f9c6
and dword [ebp - 0x568], 0
jmp 0x1001f9d0
mov dword [ebp - 0x568], 1
push 4
pop eax
imul eax, eax, 3
mov esi, dword [ebp - 0x568]
sub esi, dword [ebp + eax - 0x2d4]
push 4
pop eax
imul eax, eax, 3
push dword [ebp + eax - 0x2d4]
lea ecx, [ebp - 0x5b4]
call fcn.10016e0a
cmp esi, dword [eax]
je 0x1001fa05
cmp dword [ebp - 0x30], 0
je 0x1001fa3b
cmp dword [ebp - 0x404], 0xf41adf89
jbe 0x1001fa1d
mov dword [ebp - 0x3fc], 1
jmp 0x1001fa24
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x4dc], eax
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x40], eax
jmp 0x1001fa41
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0xc0], 0
jmp 0x1001fa5a
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jg 0x1001fab8
mov dword [ebp - 0x40], 3
jmp 0x1001fa73
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x1001fab6
push 0x839
lea eax, [ebp - 0x5b4]
push eax
push 0x1208
push 0xf4a
lea eax, [ebp - 0x404]
push eax
push 0x1050
push 0
push 0x798a
push 0x3d75
push 0x19f0
call fcn.1001beb7
add esp, 0x28
jmp 0x1001fa6c
jmp 0x1001fa4d
jmp 0x1001f7e0
cmp dword [ebp - 0x30], 0
je 0x1001fad7
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x5b4]
call fcn.10016dee
jmp 0x1001f745
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x5b4]
call fcn.10016dee
jmp 0x1001f745
xor eax, eax
mov ecx, dword [ebp - 0x1b8]
mov word [ebp + ecx*2 - 0x904], ax
jmp 0x1001f71b
mov dword [ebp - 0x48], 0
push 2
lea ecx, [ebp - 0x760]
call fcn.10016d92
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x554], 0
mov dword [ebp - 0x18], 0
jmp 0x1001fb32
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1001fb4e
push dword [ebp - 0x18]
lea ecx, [ebp - 0x760]
call fcn.10016e0a
mov dword [eax], 1
jmp 0x1001fb2b
mov dword [ebp - 0x18], 0
jmp 0x1001fb5e
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1001fb74
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x41c], 8
jmp 0x1001fb57
mov dword [ebp - 0x18], 0
jmp 0x1001fb84
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1001fb9a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xab8], 0xfffffff7
jmp 0x1001fb7d
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 0
jmp 0x1001fbb0
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x1a
jg 0x1001fde3
push 3
lea ecx, [ebp - 0x5e4]
call fcn.10016d92
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x1c4], 0xde0184dc
mov dword [ebp - 0x648], 0xc0c8fbfc
mov dword [ebp - 0x180], 0
jmp 0x1001fbf8
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 3
jge 0x1001fc17
push dword [ebp - 0x180]
lea ecx, [ebp - 0x5e4]
call fcn.10016e0a
or dword [eax], 0xffffffff
jmp 0x1001fbeb
mov eax, 0x5ed9a924
test eax, eax
je 0x1001fd6e
push 1
lea ecx, [ebp - 0x5e4]
call fcn.10016e0a
mov eax, dword [eax]
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
je 0x1001fcd2
push 0
lea ecx, [ebp - 0x5e4]
call fcn.10016e0a
cmp dword [eax], 0
je 0x1001fc66
mov eax, 0xb4f5
test eax, eax
je 0x1001fc66
xor eax, eax
inc eax
jne 0x1001fc81
push 1
lea ecx, [ebp - 0x5e4]
call fcn.10016e0a
cmp dword [eax], 0
jne 0x1001fc81
and dword [ebp - 0x54c], 0
jmp 0x1001fc8b
mov dword [ebp - 0x54c], 1
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x54c]
jne 0x1001fca2
mov dword [ebp - 0x40c], 1
jmp 0x1001fca9
and dword [ebp - 0x40c], 0
mov esi, dword [ebp - 0x40c]
sub esi, dword [ebp - 0x1c4]
push 1
lea ecx, [ebp - 0x5e4]
call fcn.10016e0a
cmp esi, dword [eax]
je 0x1001fcd2
mov dword [ebp - 0x4e4], 1
jmp 0x1001fcd9
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x4e4]
jl 0x1001fcf6
cmp dword [ebp - 0x48], 0
je 0x1001fcf6
mov dword [ebp - 0x414], 1
jmp 0x1001fcfd
and dword [ebp - 0x414], 0
push 0
lea ecx, [ebp - 0x760]
call fcn.10016e0a
mov ecx, dword [ebp - 0x414]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x570], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x570]
mov dword [ebp + eax - 0x41c], ecx
mov eax, dword [ebp - 0x570]
mov dword [ebp - 0x648], eax
push 0
lea ecx, [ebp - 0x760]
call fcn.10016e0a
cmp dword [eax], 0xd188
jge 0x1001fd62
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x41c], 0
je 0x1001fd6e
mov dword [ebp - 0x4ec], 1
jmp 0x1001fd75
and dword [ebp - 0x4ec], 0
cmp dword [ebp - 0x4ec], 0
jg 0x1001fd8a
mov dword [ebp - 0x424], 1
jmp 0x1001fd91
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 0x7a7bf748
jg 0x1001fdb5
mov dword [ebp - 0x42c], 1
jmp 0x1001fdbc
and dword [ebp - 0x42c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x42c]
mov dword [ebp + eax - 0xab8], ecx
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x5e4]
call fcn.10016dee
jmp 0x1001fba9
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x760]
call fcn.10016dee
cmp dword [ebp - 0x510], 0
je 0x10021d92
mov dword [ebp - 0x1c], 0xf6af1124
mov dword [ebp - 0xc4], 0xfffffff6
mov dword [ebp - 0x2f0], 0xffffffff
push 2
lea ecx, [ebp - 0xa0c]
call fcn.10016d92
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x6fc], 0x1c63cc5d
mov dword [ebp - 0x38], 0
jmp 0x1001fe45
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x1001fe5b
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x7d0], 0x2f7f1c74
jmp 0x1001fe3e
lea eax, [ebp - 0x38]
push eax
push 1
lea eax, [ebp - 0xa0c]
push eax
push 0x52fd
push 0x3e19
call fcn.1001bb16
add esp, 0x14
mov dword [ebp - 0x38], 0
jmp 0x1001fe8a
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1001fea0
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x668], 6
jmp 0x1001fe83
mov dword [ebp - 0x1c], 0xffffffe6
jmp 0x1001feb0
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe3
jle 0x1002053d
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x194], 0x376fbfcc
mov dword [ebp - 0x350], 1
mov dword [ebp - 0x2a4], 0xffffffff
mov dword [ebp - 0x6ec], 0xfffffffe
mov dword [ebp - 0x378], 0xf10aa6f3
mov dword [ebp - 0x6f4], 0xffffffff
mov dword [ebp - 0x7b0], 9
mov dword [ebp - 0x7ac], 9
mov dword [ebp - 0x7a8], 9
mov dword [ebp - 0x7a4], 9
mov dword [ebp - 0x4c], 0
jmp 0x1001ff35
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 5
jge 0x1002035f
mov dword [ebp - 0x1ac], 0x49c9
mov dword [ebp - 0x24], 0x53fc2f92
mov dword [ebp - 0x2e8], 0xaaf7cc73
mov dword [ebp - 0x660], 0xd46d8da5
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x98c], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x994], eax
cmp dword [ebp - 0x1c], 0x33920027
jl 0x1001ff8e
mov dword [ebp - 0x4f4], 1
jmp 0x1001ff95
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x99c], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
je 0x1001ffce
mov dword [ebp - 0x434], 1
jmp 0x1001ffd5
and dword [ebp - 0x434], 0
cmp dword [ebp - 0x434], 0x89afca86
jae 0x1001ffed
mov dword [ebp - 0x578], 1
jmp 0x1001fff4
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x578], eax
je 0x1002000b
mov dword [ebp - 0x43c], 1
jmp 0x10020012
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x43c], eax
jg 0x10020029
mov dword [ebp - 0x4fc], 1
jmp 0x10020030
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x4fc], eax
jge 0x10020047
mov dword [ebp - 0x444], 1
jmp 0x1002004e
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x444], eax
je 0x10020068
mov dword [ebp - 0x6dc], 1
jmp 0x1002006f
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x9ac], eax
cmp dword [ebp - 0x24], 0xc0266d99
jbe 0x10020093
cmp dword [ebp - 0x24], 0
je 0x10020093
mov dword [ebp - 0x650], 1
jmp 0x1002009a
and dword [ebp - 0x650], 0
mov dword [ebp - 0xc4], 0xbc3e
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x9b4], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x9bc], eax
cmp dword [ebp - 0x1c], 0
je 0x100200d0
xor eax, eax
inc eax
je 0x100200d0
mov dword [ebp - 0x55c], 1
jmp 0x100200d7
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x55c]
cmp dword [ebp - 0x4c], eax
jle 0x100200f1
mov dword [ebp - 0x2dc], 1
jmp 0x100200f8
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x1ac]
dec eax
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1ac]
cmp eax, dword [ebp - 0x2dc]
jge 0x1002011f
mov dword [ebp - 0x2e0], 1
jmp 0x10020126
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x2e8], eax
mov dword [ebp - 0x24], 0
jmp 0x10020142
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x18
je 0x1002035a
mov dword [ebp - 0x6e4], 0xffff
push 1
lea ecx, [ebp - 0x784]
call fcn.10016d92
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x18c], 0
jmp 0x10020180
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 1
jge 0x1002019f
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x784]
call fcn.10016e0a
and dword [eax], 0
jmp 0x10020173
cmp dword [ebp - 0x2e8], 2
jb 0x100201b4
mov dword [ebp - 0x320], 1
jmp 0x100201bb
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xa4c], eax
mov dword [ebp - 0x2f0], 0xffffffff
mov eax, dword [ebp - 0x6e4]
cmp dword [ebp - 0x2f0], eax
je 0x100201e8
mov dword [ebp - 0x2c4], 1
jmp 0x100201ef
and dword [ebp - 0x2c4], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x2c4]
mov dword [ebp + eax - 0x7d0], ecx
push 0
lea ecx, [ebp - 0x784]
call fcn.10016e0a
mov ecx, dword [ebp - 0x2c4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xa54], eax
cmp dword [ebp - 0x24], 0
je 0x1002023e
cmp dword [ebp - 0x2a4], 0
je 0x1002023e
mov dword [ebp - 0x2f8], 1
jmp 0x10020245
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x2f8], eax
jne 0x1002025f
mov dword [ebp - 0x300], 1
jmp 0x10020266
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x300]
jle 0x1002027d
mov dword [ebp - 0x308], 1
jmp 0x10020284
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x308], eax
je 0x1002029e
mov dword [ebp - 0x310], 1
jmp 0x100202a5
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0x310], eax
jg 0x100202bf
mov dword [ebp - 0x658], 1
jmp 0x100202c6
and dword [ebp - 0x658], 0
push 0
lea ecx, [ebp - 0x784]
call fcn.10016e0a
mov ecx, dword [ebp - 0x2a4]
cmp dword [eax], ecx
jl 0x100202e9
mov dword [ebp - 0x318], 1
jmp 0x100202f0
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x318]
jne 0x10020313
mov eax, 0x4435
test eax, eax
je 0x10020313
mov dword [ebp - 0x328], 1
jmp 0x1002031a
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x320]
imul eax, dword [ebp - 0x328]
imul eax, eax, 0xe059
sub eax, 0xbfe1
imul eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x6ec]
mov dword [ebp - 0x660], eax
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x784]
call fcn.10016dee
jmp 0x1002013b
jmp 0x1001ff2e
cmp dword [ebp - 0x4c], 0
jne 0x1002037d
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x7d0], 0
jne 0x1002037d
and dword [ebp - 0x380], 0
jmp 0x10020387
mov dword [ebp - 0x380], 1
cmp dword [ebp - 0x6f4], 0
je 0x1002039c
mov dword [ebp - 0x338], 1
jmp 0x100203a3
and dword [ebp - 0x338], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7b0]
inc eax
mov dword [ebp - 0x330], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x330]
mov dword [ebp + eax - 0x7b0], ecx
mov eax, dword [ebp - 0x330]
cmp eax, dword [ebp - 0x338]
jle 0x100203e2
mov dword [ebp - 0x340], 1
jmp 0x100203e9
and dword [ebp - 0x340], 0
imul eax, dword [ebp - 0x340], 0x5eab
test eax, eax
je 0x10020409
cmp dword [ebp - 0x1c], 0
je 0x10020409
mov dword [ebp - 0x348], 1
jmp 0x10020410
and dword [ebp - 0x348], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7d0]
add eax, dword [ebp - 0x348]
cmp eax, dword [ebp - 0x378]
jne 0x10020436
mov dword [ebp - 0x358], 1
jmp 0x1002043d
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x350]
cmp dword [ebp - 0x358], eax
jne 0x1002045d
mov eax, 0xc90fa27c
test eax, eax
jne 0x1002045d
and dword [ebp - 0x360], 0
jmp 0x10020467
mov dword [ebp - 0x360], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7d0]
cmp eax, dword [ebp - 0x360]
jl 0x10020488
mov dword [ebp - 0x368], 1
jmp 0x1002048f
and dword [ebp - 0x368], 0
cmp dword [ebp - 0x368], 0x80272671
jae 0x100204a7
mov dword [ebp - 0x370], 1
jmp 0x100204ae
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x378], eax
mov dword [ebp - 0xc4], 6
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x388], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x388]
mov dword [ebp + eax - 0x668], ecx
mov eax, dword [ebp - 0x380]
cmp eax, dword [ebp - 0x388]
jle 0x100204fd
mov dword [ebp - 0x390], 1
jmp 0x10020504
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x6fc]
cmp dword [ebp - 0x390], eax
jne 0x1002051e
mov dword [ebp - 0x398], 1
jmp 0x10020525
and dword [ebp - 0x398], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x398]
mov dword [ebp + eax - 0x7d0], ecx
jmp 0x1001fea9
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa0c]
call fcn.10016dee
mov dword [ebp - 0x34], 0xf4672159
mov dword [ebp - 0x3a0], 0x3773672
mov dword [ebp - 0x3a8], 0x8cafa32f
mov dword [ebp - 0x2d8], 0xfffffffc
mov dword [ebp - 0x704], 5
mov dword [ebp - 0x3d8], 1
mov dword [ebp - 0x70c], 0x3f6a0837
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jge 0x100205a3
mov dword [ebp - 0x3b0], 1
jmp 0x100205aa
and dword [ebp - 0x3b0], 0
cmp dword [ebp - 0x34], 0x26874be7
jne 0x100205bf
mov dword [ebp - 0x3b8], 1
jmp 0x100205c6
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp - 0x3a8]
sub eax, dword [ebp - 0x3b0]
cmp eax, dword [ebp - 0x3b8]
jge 0x100205fb
mov dword [ebp - 0x3c0], 1
jmp 0x10020602
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x2d8], eax
jle 0x10020625
mov dword [ebp - 0x3d0], 1
jmp 0x1002062c
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x3d0]
cmp eax, dword [ebp - 0x34]
jne 0x10020647
mov dword [ebp - 0x678], 1
jmp 0x1002064e
and dword [ebp - 0x678], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xa5c], eax
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x704]
mov dword [ebp - 0x3d8], eax
mov eax, dword [ebp - 0x3d8]
cmp dword [ebp - 0x34], eax
jle 0x1002067d
mov dword [ebp - 0x3e0], 1
jmp 0x10020684
and dword [ebp - 0x3e0], 0
cmp dword [ebp - 0x3e0], 0xc2f9
jg 0x1002069c
mov dword [ebp - 0x3e8], 1
jmp 0x100206a3
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x70c], eax
mov byte [ebp - 0x8c], 0
movzx eax, byte [ebp - 0x8c]
test eax, eax
je 0x100206d2
push 0
push 0x1f0
call fcn.10023a0f
pop ecx
pop ecx
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0x3f0], 0xa27289ff
push 2
lea ecx, [ebp - 0x5a8]
call fcn.10016d92
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x420], 0x5e3d1aa1
mov dword [ebp - 0x120], 0xfffffff8
mov dword [ebp - 0x1bc], 0
jmp 0x10020724
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 2
jge 0x10020743
push dword [ebp - 0x1bc]
lea ecx, [ebp - 0x5a8]
call fcn.10016e0a
and dword [eax], 0
jmp 0x10020717
mov eax, 0x5b0e
test eax, eax
je 0x1002086a
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x100207d4
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xa64], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x3f0], eax
mov esi, dword [ebp - 0x3f0]
push 0
lea ecx, [ebp - 0x5a8]
call fcn.10016e0a
add esi, dword [eax]
push 0
lea ecx, [ebp - 0x5a8]
call fcn.10016e0a
add esi, dword [eax]
cmp esi, 0x310c
je 0x100207a7
mov dword [ebp - 0x3f8], 1
jmp 0x100207ae
and dword [ebp - 0x3f8], 0
mov esi, dword [ebp - 0x3f8]
add esi, 6
push 0
lea ecx, [ebp - 0x5a8]
call fcn.10016e0a
cmp esi, dword [eax]
jge 0x100207d4
mov dword [ebp - 0x400], 1
jmp 0x100207db
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x400], eax
je 0x100207fe
mov eax, 0xcb6a7f4e
test eax, eax
je 0x100207fe
mov dword [ebp - 0x408], 1
jmp 0x10020805
and dword [ebp - 0x408], 0
cmp dword [ebp - 0x408], 0xfffffffa
jge 0x10020829
push 1
lea ecx, [ebp - 0x5a8]
call fcn.10016e0a
cmp dword [eax], 0
jne 0x10020829
and dword [ebp - 0x410], 0
jmp 0x10020833
mov dword [ebp - 0x410], 1
cmp dword [ebp - 0x410], 0xa07e
je 0x1002084b
mov dword [ebp - 0x418], 1
jmp 0x10020852
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x418]
shl eax, 1
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0x77cc
push 0
lea ecx, [ebp - 0x5a8]
call fcn.10016e0a
cmp dword [eax], 0
jne 0x10020889
xor eax, eax
jne 0x10020889
and dword [ebp - 0x428], 0
jmp 0x10020893
mov dword [ebp - 0x428], 1
cmp dword [ebp - 0x428], 0xffffffff
jge 0x100208a8
mov dword [ebp - 0x430], 1
jmp 0x100208af
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x120], 0
jmp 0x100208d4
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x18
jne 0x10020970
mov dword [ebp - 0xe4], 0x76cc72b7
mov dword [ebp - 0xa8], 0xa
jmp 0x10020904
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x2b
jne 0x1002096b
cmp dword [ebp - 0xe4], 0
je 0x10020918
jmp 0x1002096b
mov dword [ebp - 0xe4], 0
jmp 0x10020931
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 1
jg 0x10020969
mov byte [ebp - 0x88], 0
movzx eax, byte [ebp - 0x88]
test eax, eax
je 0x10020967
push 1
push 0x73
push 0x58d2
push 0x6280
push 0x3987
call fcn.1001bbaf
add esp, 0x14
jmp 0x10020924
jmp 0x100208f7
jmp 0x100208c7
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x5a8]
call fcn.10016dee
mov byte [ebp - 0x224], 9
mov byte [ebp - 0x223], 0x4e
mov byte [ebp - 0x222], 0xa
mov byte [ebp - 0x221], 0xb
mov byte [ebp - 0x220], 4
mov byte [ebp - 0x21f], 0x35
mov byte [ebp - 0x21e], 7
mov byte [ebp - 0x21d], 0x3e
mov byte [ebp - 0x21c], 2
mov byte [ebp - 0x21b], 0x13
mov byte [ebp - 0x21a], 8
mov byte [ebp - 0x219], 0
mov byte [ebp - 0x218], 6
mov byte [ebp - 0x217], 3
mov byte [ebp - 0x216], 5
mov byte [ebp - 0x215], 0xb
mov byte [ebp - 0x214], 0xb
mov byte [ebp - 0x213], 0x3e
mov byte [ebp - 0x212], 0
mov byte [ebp - 0x211], 0x1b
mov byte [ebp - 0x210], 0x42
mov byte [ebp - 0x20f], 0xf2
mov byte [ebp - 0x20e], 0x17
mov byte [ebp - 0x20d], 0x71
mov byte [ebp - 0x20c], 0xf3
mov byte [ebp - 0x20b], 0xd3
mov byte [ebp - 0x20a], 0xe4
mov byte [ebp - 0x209], 0x22
mov byte [ebp - 0x208], 0x45
mov byte [ebp - 0x207], 0xd
mov byte [ebp - 0x206], 0xaf
mov byte [ebp - 0x205], 0xf3
mov byte [ebp - 0x204], 0xc
mov byte [ebp - 0x203], 0x22
mov byte [ebp - 0x202], 0xdc
mov byte [ebp - 0x201], 0x9b
mov byte [ebp - 0x200], 0x23
mov byte [ebp - 0x1ff], 0x45
mov byte [ebp - 0x1fe], 0xd8
mov byte [ebp - 0x1fd], 0xc
mov byte [ebp - 0x1fc], 0x57
mov byte [ebp - 0x1fb], 5
mov byte [ebp - 0x1fa], 0xdd
mov byte [ebp - 0x1f9], 0xb0
mov byte [ebp - 0x1f8], 0xdf
mov byte [ebp - 0x1f7], 0xf2
mov byte [ebp - 0x1f6], 0xca
mov byte [ebp - 0x1f5], 0x66
mov byte [ebp - 0x1f4], 0xdf
mov byte [ebp - 0x1f3], 0xb2
mov byte [ebp - 0x1f2], 0xcc
mov byte [ebp - 0x1f1], 0x28
mov byte [ebp - 0x1f0], 0x33
mov byte [ebp - 0x1ef], 0x25
mov byte [ebp - 0x1ee], 0xa3
mov byte [ebp - 0x1ed], 0xc3
mov byte [ebp - 0x1ec], 0x85
mov byte [ebp - 0x1eb], 0xad
mov byte [ebp - 0x1ea], 0x2e
mov byte [ebp - 0x1e9], 0xc2
mov byte [ebp - 0x1e8], 0x83
mov byte [ebp - 0x1e7], 0xb5
mov byte [ebp - 0x1e6], 0xaa
mov byte [ebp - 0x1e5], 0x40
mov byte [ebp - 0x1e4], 0x9d
mov byte [ebp - 0x1e3], 0xeb
mov byte [ebp - 0x1e2], 0x44
mov byte [ebp - 0x1e1], 0x4c
mov byte [ebp - 0x1e0], 0xaa
mov byte [ebp - 0x1df], 0xf5
mov byte [ebp - 0x1de], 0xd8
mov byte [ebp - 0x1dd], 0xb2
mov byte [ebp - 0x1dc], 0xe3
mov byte [ebp - 0x1db], 0
mov byte [ebp - 0x1da], 0x8d
mov byte [ebp - 0x1d9], 0xb8
mov byte [ebp - 0x1d8], 0x8d
mov byte [ebp - 0x1d7], 0xe2
mov byte [ebp - 0x1d6], 0x34
mov byte [ebp - 0x1d5], 0x16
mov byte [ebp - 0x1d4], 0x3a
mov byte [ebp - 0x1d3], 0xd7
mov byte [ebp - 0x1d2], 0x7f
mov byte [ebp - 0x1d1], 0xdb
mov byte [ebp - 0x1d0], 0x86
mov byte [ebp - 0x1cf], 0xe7
mov byte [ebp - 0x1ce], 3
mov byte [ebp - 0x1cd], 1
mov byte [ebp - 0x1cc], 0x23
mov byte [ebp - 0x1cb], 3
mov byte [ebp - 0x1ca], 0xb
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x224]
or eax, 0x3c
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x224]
and ecx, 0x3c
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x224]
mov byte [ebp + ecx - 0x610], al
mov dword [ebp - 0x600], 0
mov dword [ebp - 0x5fc], 0
mov dword [ebp - 0x5f8], 0
mov dword [ebp - 0x5f4], 0
push 1
lea ecx, [ebp - 0x790]
call fcn.10016d92
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0xa6c], 0x58099740
mov dword [ebp - 0xa74], 6
mov dword [ebp - 0x60], 0
jmp 0x10020c92
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x10020ca8
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x438], 0x4a8c6a53
jmp 0x10020c8b
mov dword [ebp - 0x60], 0
jmp 0x10020cb8
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x10020cd1
push dword [ebp - 0x60]
lea ecx, [ebp - 0x790]
call fcn.10016e0a
or dword [eax], 0xffffffff
jmp 0x10020cb1
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x600], 0
jmp 0x10020cff
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x600]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x600], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x600], 0
jg 0x10020db4
mov dword [ebp - 0x19c], 0xfffffff8
push 0x19c7
push 0x98b
lea eax, [ebp - 0x790]
push eax
push 0
call fcn.1001ce2f
add esp, 0x10
mov dword [ebp - 0x19c], 0
jmp 0x10020d51
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
jl 0x10020daf
mov byte [ebp - 0x87], 0
movzx eax, byte [ebp - 0x87]
test eax, eax
je 0x10020d94
push 0x2afc
push 1
push 0x3985
push 0x1fec
push 0x4ad5
push 0x4c18
push 0x77e3
call fcn.1001bcc2
add esp, 0x1c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x600]
cmp dword [ebp + eax*4 - 0x438], 0
je 0x10020dad
jmp 0x10020daf
jmp 0x10020d44
jmp 0x10020ce4
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x438]
shl esi, 3
push 0
lea ecx, [ebp - 0x790]
call fcn.10016e0a
mov dword [eax], esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x790]
call fcn.10016dee
mov dword [ebp - 0x2c], 2
and dword [ebp - 0x148], 0
jmp 0x10020dfa
mov eax, dword [ebp - 0x2c]
inc eax
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x5b
jae 0x1002159b
mov dword [ebp - 0x1b4], 0x9fdf99ff
mov dword [ebp - 0x1b4], 0xfffffffa
jmp 0x10020e27
mov eax, dword [ebp - 0x1b4]
dec eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0xffffffec
je 0x10020e7a
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x1a4], 0xfffffffb
jmp 0x10020e53
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 1
jl 0x10020e78
mov byte [ebp - 0x94], 0
movzx eax, byte [ebp - 0x94]
test eax, eax
je 0x10020e76
push 1
call fcn.1001bddb
pop ecx
jmp 0x10020e46
jmp 0x10020e1a
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x224]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x2c], eax
jne 0x100211fb
push 2
lea ecx, [ebp - 0x5d8]
call fcn.10016d92
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x6d8], 0x1e9c96c7
push 1
lea ecx, [ebp - 0x878]
call fcn.10016d92
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x710], 7
mov dword [ebp - 0x448], 0xffffffff
mov dword [ebp - 0xec], 0
jmp 0x10020eee
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 2
jge 0x10020f10
push dword [ebp - 0xec]
lea ecx, [ebp - 0x5d8]
call fcn.10016e0a
mov dword [eax], 0x571177e8
jmp 0x10020ee1
lea eax, [ebp - 0x878]
push eax
lea eax, [ebp - 0xec]
push eax
push 0x13f5
push 1
push 0x17ea
call fcn.1001be10
add esp, 0x14
push 1
lea ecx, [ebp - 0x5d8]
call fcn.10016e0a
mov dword [eax], 1
jmp 0x10020f6b
push 1
lea ecx, [ebp - 0x5d8]
call fcn.10016e0a
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x440]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x440]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x5d8]
call fcn.10016e0a
cmp dword [eax], 0x14
jne 0x10021001
mov dword [ebp - 0x450], 0x9b7928fb
mov dword [ebp - 0x688], 0xffff
lea eax, [ebp - 0x710]
push eax
push 0x474d
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x5d8]
push eax
push 0x2763
lea eax, [ebp - 0x878]
push eax
push 1
lea eax, [ebp - 0x688]
push eax
lea eax, [ebp - 0x6d8]
push eax
lea eax, [ebp - 0x448]
push eax
call fcn.1001beb7
add esp, 0x28
push 0x2cc9
lea eax, [ebp - 0x448]
push eax
push 0xf52
lea eax, [ebp - 0x450]
push eax
push 1
call fcn.1001c032
add esp, 0x14
jmp 0x10020f47
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x878]
call fcn.10016dee
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x5d8]
call fcn.10016dee
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x224]
inc eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0xfc], 0x8c6a53d0
mov dword [ebp - 0x6e0], 0xcd333563
mov dword [ebp - 0x700], 1
push 4
lea ecx, [ebp - 0x7dc]
call fcn.10016d92
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x7dc]
push eax
push 0x6090
lea eax, [ebp - 0x908]
push eax
push 1
call fcn.1001c0b3
add esp, 0x10
mov dword [ebp - 0xfc], 2
jmp 0x10021096
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0xfffffff8
jl 0x100211d2
mov dword [ebp - 0xf4], 0xf4288a13
mov dword [ebp - 0x6a0], 0xfffffffd
mov dword [ebp - 0x698], 0
mov dword [ebp - 0xf4], 0xfffffff5
jmp 0x100210da
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xf
jle 0x10021179
mov dword [ebp - 0x140], 0xffffffff
mov dword [ebp - 0x140], 0
jmp 0x1002110a
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
je 0x10021174
push 2
lea ecx, [ebp - 0x818]
call fcn.10016d92
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x690], 0xffffffff
lea eax, [ebp - 0xa84]
push eax
push 1
lea eax, [ebp - 0x818]
push eax
call fcn.1001c129
add esp, 0xc
push 0x443b
lea eax, [ebp - 0x690]
push eax
lea eax, [ebp - 0x818]
push eax
push 1
call fcn.1001c194
add esp, 0x10
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x818]
call fcn.10016dee
jmp 0x100210fd
jmp 0x100210cd
push 0x2039
lea eax, [ebp - 0x7dc]
push eax
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x700]
push eax
push 1
lea eax, [ebp - 0xfc]
push eax
push 0x6229
lea eax, [ebp - 0x698]
push eax
push 0x2047
push 0x795d
push 0x338f
lea eax, [ebp - 0x6e0]
push eax
lea eax, [ebp - 0x6a0]
push eax
call fcn.1001c21a
add esp, 0x34
jmp 0x10021089
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x7dc]
call fcn.10016dee
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x224]
mov ecx, dword [ebp - 0x2c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x2c], eax
jmp 0x10020df2
push 2
lea ecx, [ebp - 0x778]
call fcn.10016d92
mov byte [ebp - 4], 0x23
push 4
lea ecx, [ebp - 0x754]
call fcn.10016d92
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x720], 0x7c7747bb
mov dword [ebp - 0x6a8], 0x167c28ca
mov dword [ebp - 0x50], 0
jmp 0x10021241
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x1002125d
push dword [ebp - 0x50]
lea ecx, [ebp - 0x778]
call fcn.10016e0a
mov dword [eax], 0xfffffffb
jmp 0x1002123a
mov dword [ebp - 0x50], 0
jmp 0x1002126d
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jge 0x10021286
push dword [ebp - 0x50]
lea ecx, [ebp - 0x754]
call fcn.10016e0a
and dword [eax], 0
jmp 0x10021266
lea eax, [ebp - 0x754]
push eax
push 1
lea eax, [ebp - 0x778]
push eax
push 0x6cee
call fcn.1001c4c6
add esp, 0x10
lea eax, [ebp - 0x720]
push eax
lea eax, [ebp - 0x6a8]
push eax
lea eax, [ebp - 0x778]
push eax
push 1
lea eax, [ebp - 0x754]
push eax
call fcn.1001c52f
add esp, 0x14
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x754]
call fcn.10016dee
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x778]
call fcn.10016dee
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x223]
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x148]
movzx ecx, byte [ebp + ecx - 0x226]
movsx ecx, byte [ebp + ecx - 0x610]
or eax, ecx
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x223]
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x148]
movzx edx, byte [ebp + edx - 0x226]
movsx edx, byte [ebp + edx - 0x610]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x224]
mov byte [ebp + ecx - 0x610], al
push 2
lea ecx, [ebp - 0x2b8]
call fcn.10016d92
mov byte [ebp - 4], 0x25
push 1
lea ecx, [ebp - 0x830]
call fcn.10016d92
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x478], 0xf6b34c26
mov dword [ebp - 0x28c], 0xfffffffe
mov dword [ebp - 0x708], 0xfffffffd
push 1
lea eax, [ebp - 0x6e8]
push eax
lea eax, [ebp - 0x2b8]
push eax
call fcn.1001c64f
add esp, 0xc
push 0x39db
push 0x1440
lea eax, [ebp - 0x6e8]
push eax
push 0x5ad3
push 0x715a
push 0x4918
lea eax, [ebp - 0x830]
push eax
push 0x7db1
push 1
call fcn.1001c6cc
add esp, 0x24
push 0
lea ecx, [ebp - 0x2b8]
call fcn.10016e0a
push 1
lea ecx, [ebp - 0x2b8]
call fcn.10016e0a
cmp dword [eax], 0
je 0x10021412
push 1
lea ecx, [ebp - 0x2b8]
call fcn.10016e0a
cmp dword [eax], 0
je 0x10021412
mov dword [ebp - 0x6b0], 1
jmp 0x10021419
and dword [ebp - 0x6b0], 0
push 0
lea ecx, [ebp - 0x2b8]
call fcn.10016e0a
push 1
lea ecx, [ebp - 0x2b8]
call fcn.10016e0a
cmp dword [eax], 0x64c7b7f6
jl 0x10021447
mov dword [ebp - 0x458], 1
jmp 0x1002144e
and dword [ebp - 0x458], 0
push 1
lea ecx, [ebp - 0x2b8]
call fcn.10016e0a
mov eax, dword [eax]
sub eax, dword [ebp - 0x458]
je 0x10021483
push 0
lea ecx, [ebp - 0x2b8]
call fcn.10016e0a
cmp dword [eax], 0
je 0x10021483
mov dword [ebp - 0x460], 1
jmp 0x1002148a
and dword [ebp - 0x460], 0
imul eax, dword [ebp - 0x460], 0xfffffff6
mov dword [ebp - 0x468], eax
push 0
lea ecx, [ebp - 0x830]
call fcn.10016e0a
mov ecx, dword [ebp - 0x468]
mov dword [eax], ecx
cmp dword [ebp - 0x468], 0
je 0x100214c8
push 8
pop eax
test eax, eax
je 0x100214c8
mov dword [ebp - 0x470], 1
jmp 0x100214cf
and dword [ebp - 0x470], 0
push 0
lea ecx, [ebp - 0x2b8]
call fcn.10016e0a
mov ecx, dword [ebp - 0x470]
sub ecx, dword [eax]
sub ecx, 6
mov dword [ebp - 0x478], ecx
je 0x10021500
or eax, 0xffffffff
je 0x10021500
mov dword [ebp - 0x480], 1
jmp 0x10021507
and dword [ebp - 0x480], 0
cmp dword [ebp - 0x480], 0xd162
jle 0x1002151f
mov dword [ebp - 0x488], 1
jmp 0x10021526
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x28c], eax
mov esi, dword [ebp - 0x28c]
push 1
lea ecx, [ebp - 0x2b8]
call fcn.10016e0a
cmp dword [eax], esi
jl 0x1002155e
cmp dword [ebp - 0x28c], 0
je 0x1002155e
mov dword [ebp - 0x490], 1
jmp 0x10021565
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x708], eax
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x830]
call fcn.10016dee
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2b8]
call fcn.10016dee
and dword [ebp - 0x148], 0
jmp 0x10020df2
mov dword [ebp - 0x84], 0xe0648261
push 1
lea ecx, [ebp - 0x890]
call fcn.10016d92
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0xa8c]
push eax
push 1
push 0x4b7e
lea eax, [ebp - 0x890]
push eax
call fcn.1001c840
add esp, 0x10
mov dword [ebp - 0x84], 0xfffffff3
jmp 0x100215ec
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0x12
jge 0x100216a3
mov dword [ebp - 0x6b8], 6
push 1
lea ecx, [ebp - 0x674]
call fcn.10016d92
mov byte [ebp - 4], 0x28
mov dword [ebp - 0x150], 0
jmp 0x1002162d
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 1
jge 0x1002164f
push dword [ebp - 0x150]
lea ecx, [ebp - 0x674]
call fcn.10016e0a
mov dword [eax], 0x87cf2e56
jmp 0x10021620
cmp dword [ebp - 0x6b8], 0
je 0x10021669
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x674]
call fcn.10016dee
jmp 0x100216a3
push 0
lea ecx, [ebp - 0x674]
call fcn.10016e0a
cmp dword [eax], 0
je 0x1002168f
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x674]
call fcn.10016dee
jmp 0x100215df
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x674]
call fcn.10016dee
jmp 0x100215df
mov dword [ebp - 0x84], 0
jmp 0x100216bc
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jl 0x10021712
mov dword [ebp - 0x104], 0xc97412df
mov dword [ebp - 0x104], 0
jmp 0x100216e8
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
jg 0x10021710
lea eax, [ebp - 0x890]
push eax
push 0
push 0x7eb9
lea eax, [ebp - 0x104]
push eax
call fcn.1001cc52
add esp, 0x10
jmp 0x100216db
jmp 0x100216af
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x890]
call fcn.10016dee
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x610], 0
push 3
lea ecx, [ebp - 0x76c]
call fcn.10016d92
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x6f0], 0x128abf8b
mov dword [ebp - 0x6c0], 0xc698dc50
mov dword [ebp - 0x6c8], 0xfafe44fa
push 4
lea ecx, [ebp - 0x848]
call fcn.10016d92
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0x718], 0x4ce5fef4
lea eax, [ebp - 0x10c]
push eax
push 1
lea eax, [ebp - 0x76c]
push eax
call fcn.1001c8ca
add esp, 0xc
mov dword [ebp - 0x10c], 0
jmp 0x100217aa
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 4
jge 0x100217cc
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x848]
call fcn.10016e0a
mov dword [eax], 0x3222c7e1
jmp 0x1002179d
push 2
lea ecx, [ebp - 0x76c]
call fcn.10016e0a
mov dword [ebp - 0x498], eax
mov eax, dword [ebp - 0x498]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x498]
mov dword [ecx], eax
lea eax, [ebp - 0x6f0]
push eax
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x6c0]
push eax
lea eax, [ebp - 0x718]
push eax
lea eax, [ebp - 0x76c]
push eax
push 1
lea eax, [ebp - 0x6c8]
push eax
call fcn.1001c955
add esp, 0x1c
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x848]
call fcn.10016dee
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x76c]
call fcn.10016dee
lea eax, [ebp - 0x610]
push eax
lea ecx, [ebp - 0xae4]
call fcn.10023bc8
mov byte [ebp - 4], 0x2b
push 3
lea ecx, [ebp - 0x5cc]
call fcn.10016d92
mov byte [ebp - 4], 0x2c
mov dword [ebp - 0x54], 0
jmp 0x10021879
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x1002188f
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x89c], 9
jmp 0x10021872
mov dword [ebp - 0x54], 0
jmp 0x1002189f
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x100218bb
push dword [ebp - 0x54]
lea ecx, [ebp - 0x5cc]
call fcn.10016e0a
mov dword [eax], 0x596960f5
jmp 0x10021898
push 1
lea ecx, [ebp - 0x5cc]
call fcn.10016e0a
mov dword [eax], 2
jmp 0x100218f4
push 1
lea ecx, [ebp - 0x5cc]
call fcn.10016e0a
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x4a0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x4a0]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x5cc]
call fcn.10016e0a
cmp dword [eax], 0
jl 0x10021a3b
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x4d0], 0xc2dd78f4
mov dword [ebp - 0xb0], 0
jmp 0x10021937
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jg 0x10021a36
mov dword [ebp - 0x290], 0x336de018
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp + eax*4 - 0x89c]
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0x4a8]
mov dword [ebp + eax*4 - 0x89c], ecx
cmp dword [ebp - 0x4a8], 7
je 0x10021989
mov dword [ebp - 0x4b8], 1
jmp 0x10021990
and dword [ebp - 0x4b8], 0
push 1
lea ecx, [ebp - 0x5cc]
call fcn.10016e0a
mov ecx, dword [ebp - 0xb0]
add ecx, dword [ebp - 0x290]
neg ecx
cmp dword [eax], ecx
je 0x100219bb
mov dword [ebp - 0x4b0], 1
jmp 0x100219c2
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0x4b0], eax
jl 0x100219dc
mov dword [ebp - 0x4c0], 1
jmp 0x100219e3
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x4b8]
cmp eax, dword [ebp - 0x4c0]
je 0x100219fd
mov dword [ebp - 0x4c8], 1
jmp 0x10021a04
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x290], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x89c], 0
je 0x10021a31
jmp 0x1002192a
jmp 0x1002192a
jmp 0x100218d0
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x5cc]
call fcn.10016dee
and dword [ebp - 0x158], 0
jmp 0x10021a60
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0xd
jae 0x10021a79
mov eax, dword [ebp - 0x158]
mov byte [ebp + eax - 0x610], 0
jmp 0x10021a53
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xcc], 1
mov dword [ebp - 0x114], 1
mov dword [ebp - 0x160], 0
jmp 0x10021aad
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 1
jge 0x10021ac9
mov eax, dword [ebp - 0x160]
mov dword [ebp + eax*4 - 0x6f8], 0xd8c53784
jmp 0x10021aa0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa94], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x6f8], 0x4774c80
mov eax, 0x4774c80
cmp eax, 4
je 0x10021af9
mov dword [ebp - 0x4d8], 1
jmp 0x10021b00
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x4d8], eax
jge 0x10021b17
mov dword [ebp - 0x6d0], 1
jmp 0x10021b1e
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa38], eax
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
cmp eax, 0xbd4aa41a
je 0x10021b41
mov dword [ebp - 0x4e0], 1
jmp 0x10021b48
and dword [ebp - 0x4e0], 0
imul eax, dword [ebp - 0x4e0], 0xc1d6
cmp eax, dword [ebp - 0x14]
jne 0x10021b63
mov dword [ebp - 0x4e8], 1
jmp 0x10021b6a
and dword [ebp - 0x4e8], 0
cmp dword [ebp - 0x4e8], 0xa3205f5a
ja 0x10021b82
mov dword [ebp - 0x67c], 1
jmp 0x10021b89
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa34], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x14], eax
jl 0x10021bb2
mov dword [ebp - 0x4f0], 1
jmp 0x10021bb9
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x4f0]
cmp eax, dword [ebp - 0x14]
jl 0x10021bd3
mov dword [ebp - 0x4f8], 1
jmp 0x10021bda
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x4f8]
sub eax, dword [ebp - 0x114]
je 0x10021d26
mov dword [ebp - 0x9d0], 0xde0d6158
mov dword [ebp - 0xcc], 0xa
jmp 0x10021c0f
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x11
jle 0x10021d24
mov dword [ebp - 0x500], 0x8afb
mov dword [ebp - 0x114], 0
jmp 0x10021c3f
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x37
jne 0x10021d1f
mov dword [ebp - 0x508], 0xf085ffff
mov dword [ebp - 0x14], 0
jmp 0x10021c66
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x10021d1a
mov dword [ebp - 0x168], 1
mov dword [ebp - 0x914], 0x6658069d
mov dword [ebp - 0xa90], 7
mov dword [ebp - 0x168], 0
jmp 0x10021ca7
mov eax, dword [ebp - 0x168]
dec eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jl 0x10021d08
mov dword [ebp - 0x170], 0
jmp 0x10021cc9
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 2
jge 0x10021ce5
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0xacc], 2
jmp 0x10021cbc
push 1
push 0x7494
push 0x5950
call fcn.1001cbd9
add esp, 0xc
mov eax, dword [ebp - 0x500]
dec eax
mov dword [ebp - 0x500], eax
jmp 0x10021c9a
mov eax, dword [ebp - 0x508]
dec eax
mov dword [ebp - 0x508], eax
jmp 0x10021c5f
jmp 0x10021c32
jmp 0x10021c02
jmp 0x10021d65
mov byte [ebp - 0x85], 0
push 0x1c8e
push 1
lea eax, [ebp - 0x85]
push eax
push 0x4862
call fcn.1001cc52
add esp, 0x10
mov byte [ebp - 0x8e], 0
lea eax, [ebp - 0x8e]
push eax
push 1
push 0x243b
call fcn.1001ccbc
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0xae4]
push eax
push dword [ebp - 0x510]
call fcn.10022a21
add esp, 0x10
mov dword [0x1067a4e4], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xae4]
call fcn.10016cf4
push 1
call fcn.1001cd13
pop ecx
cmp dword [0x1067a4e4], 0
je 0x10021db8
mov ecx, dword [ebp + 8]
call fcn.10023bbd
push eax
call dword [0x1067a4e4]
mov dword [ebp - 0xd4], eax
push 2
lea ecx, [ebp - 0x5c0]
call fcn.10016d92
mov byte [ebp - 4], 0x2d
mov dword [ebp - 0x684], 0x1e9c96c7
push 1
lea ecx, [ebp - 0x860]
call fcn.10016d92
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x68c], 7
mov dword [ebp - 0x520], 0xffffffff
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x5c0]
push eax
push 0x42f0
push 1
call fcn.1001ce2f
add esp, 0x10
mov dword [ebp - 0x11c], 0
jmp 0x10021e2e
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 1
jge 0x10021e4d
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x860]
call fcn.10016e0a
or dword [eax], 0xffffffff
jmp 0x10021e21
push 1
lea ecx, [ebp - 0x5c0]
call fcn.10016e0a
mov dword [eax], 1
jmp 0x10021e86
push 1
lea ecx, [ebp - 0x5c0]
call fcn.10016e0a
mov dword [ebp - 0x518], eax
mov eax, dword [ebp - 0x518]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x518]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x5c0]
call fcn.10016e0a
cmp dword [eax], 0x14
jne 0x10021f1c
mov dword [ebp - 0x528], 0x9b7928fb
mov dword [ebp - 0x694], 0xffff
push 0x923
lea eax, [ebp - 0x684]
push eax
push 0x6d13
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x5c0]
push eax
lea eax, [ebp - 0x694]
push eax
push 1
lea eax, [ebp - 0x520]
push eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x860]
push eax
call fcn.1001ceaa
add esp, 0x28
lea eax, [ebp - 0x520]
push eax
push 0x787a
push 0x5a8e
push 1
lea eax, [ebp - 0x528]
push eax
call fcn.1001d013
add esp, 0x14
jmp 0x10021e62
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x860]
call fcn.10016dee
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x5c0]
call fcn.10016dee
cmp dword [ebp - 0xd4], 0
je 0x10021f8c
movzx eax, byte [0x1067a4ee]
test eax, eax
je 0x10021f5f
mov ecx, 0x1067a5a8
call fcn.10023c46
movzx eax, al
test eax, eax
jne 0x10021f8c
lea eax, [ebp - 0x530]
push eax
mov ecx, 0x1067a5a8
call fcn.10023c08
mov ecx, dword [ebp - 0xd4]
mov dword [eax], ecx
push 0x1067a4ee
push 1
push 0x2227
call fcn.1001d094
add esp, 0xc
mov dword [ebp - 0x80], 0x860b4ffb
mov dword [ebp - 0x91c], 0x6da5043c
mov dword [ebp - 0x9e0], 0xd2086bd0
mov dword [ebp - 0x924], 0x58bfc4f2
mov dword [ebp - 0xa58], 0xd9b95031
mov dword [ebp - 0x92c], 0xb72b21a3
mov dword [ebp - 0x9f0], 0x452a26f3
mov dword [ebp - 0x934], 0xd44c039e
push 4
lea ecx, [ebp - 0xa2c]
call fcn.10016d92
mov byte [ebp - 4], 0x2f
mov dword [ebp - 0xa78], 0xe6bb2f14
mov dword [ebp - 0x93c], 0x7127
push 2
lea ecx, [ebp - 0x7e8]
call fcn.10016d92
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x3c], 0
jmp 0x1002201f
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x10022035
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xaf0], 0xffffffff
jmp 0x10022018
mov dword [ebp - 0x3c], 0
jmp 0x10022045
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 4
jge 0x10022061
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xa2c]
call fcn.10016e0a
mov dword [eax], 0x637c1d6b
jmp 0x1002203e
push 1
lea eax, [ebp - 0x3c]
push eax
push 0x75f9
push 0x2b5c
lea eax, [ebp - 0x7e8]
push eax
call fcn.1001d0f4
add esp, 0x14
mov dword [ebp - 0x80], 2
jmp 0x10022090
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jl 0x1002218c
mov dword [ebp - 0xa00], 0x9924
mov dword [ebp - 0x944], 0
mov dword [ebp - 0xa60], 1
mov dword [ebp - 0x94c], 0x45ba13b2
mov dword [ebp - 0xa10], 0xd5d70512
mov dword [ebp - 0x954], 1
mov dword [ebp - 0xa88], 0
mov dword [ebp - 0x95c], 0xae4f9dbc
mov dword [ebp - 0xa20], 0xa284868f
mov dword [ebp - 0x964], 1
mov dword [ebp - 0x974], 0xffffffff
push 1
lea ecx, [ebp - 0xa1c]
call fcn.10016d92
mov byte [ebp - 4], 0x31
mov dword [ebp - 0x178], 0
jmp 0x10022132
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 1
jge 0x10022154
push dword [ebp - 0x178]
lea ecx, [ebp - 0xa1c]
call fcn.10016e0a
mov dword [eax], 0x25ec560
jmp 0x10022125
push 1
lea ecx, [ebp - 0x7e8]
call fcn.10016e0a
mov dword [ebp - 0x538], eax
mov eax, dword [ebp - 0x538]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x538]
mov dword [ecx], eax
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0xa1c]
call fcn.10016dee
jmp 0x10022089
mov dword [ebp - 0x80], 0xffffffe9
jmp 0x1002219c
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0xfffffff6
jge 0x100221eb
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x100221be
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x100221e9
push 0x5664
push 0x4e2d
push 0
push 0x1d89
call fcn.10022239
add esp, 0x10
jmp 0x10022195
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x7e8]
call fcn.10016dee
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa2c]
call fcn.10016dee
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x69c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8d8]
call fcn.10016bcc
mov eax, dword [ebp - 0x69c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret