Function at 0x1002c70c
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10072164
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe14
push esi
push edi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100332ea
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x834], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x894], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x89c], eax
mov eax, dword [ebp - 0x8a4]
movzx eax, byte [eax]
test eax, eax
je 0x1002c784
push 0
push 0
push 0x12ff
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x100332e8
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0x864], eax
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x764], 1
mov dword [ebp - 0x784], 0xffffffff
mov dword [ebp - 0xcc4], 1
mov dword [ebp - 0x218], 0
jmp 0x1002c7e9
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0x19
jl 0x1002c8ff
mov dword [ebp - 0x108], 0x4ccb63e8
mov dword [ebp - 0x8ac], 0
cmp dword [ebp - 0x108], 0
je 0x1002c877
cmp dword [ebp - 0x108], 0
jae 0x1002c828
mov dword [ebp - 0x3cc], 1
jmp 0x1002c82f
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x764], eax
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x764], eax
je 0x1002c855
mov dword [ebp - 0x76c], 1
jmp 0x1002c85c
and dword [ebp - 0x76c], 0
imul eax, dword [ebp - 0x76c], 0xffffffff
add eax, dword [ebp - 0x108]
je 0x1002c877
mov dword [ebp - 0x774], 1
jmp 0x1002c87e
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 0x774]
sub ecx, dword [ebp - 0x108]
add eax, ecx
cmp eax, 0xd15de05d
ja 0x1002c8a5
mov dword [ebp - 0x77c], 1
jmp 0x1002c8ac
and dword [ebp - 0x77c], 0
mov eax, dword [ebp - 0x77c]
mov dword [ebp - 0x784], eax
mov eax, dword [ebp - 0x784]
sub eax, 0xfff6
cmp eax, 0x9ef4a042
jbe 0x1002c8d6
mov dword [ebp - 0x79c], 1
jmp 0x1002c8dd
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x79c]
mov dword [ebp - 0x8ac], eax
push 0x6ae8
push 1
push 0
call fcn.100388fe
add esp, 0xc
jmp 0x1002c7dc
mov dword [ebp - 0x1b0], 5
mov dword [ebp - 0x8b4], 8
mov dword [ebp - 0xd30], 0xc38ec326
mov dword [ebp - 0x588], 8
mov dword [ebp - 0x33c], 0xeba4
mov dword [ebp - 0x8bc], 0xd88101ae
mov dword [ebp - 0x1b0], 4
jmp 0x1002c954
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0x1c
jg 0x1002cc1a
mov dword [ebp - 0x250], 1
mov dword [ebp - 0xd38], 0x3989226c
mov dword [ebp - 0x388], 0x4e665969
mov dword [ebp - 0xd54], 0xffffffff
mov dword [ebp - 0x250], 0xffffffe5
jmp 0x1002c9a2
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0x13
je 0x1002cc15
push 4
lea ecx, [ebp - 0x7b8]
call fcn.10009afa
and dword [ebp - 4], 0
mov dword [ebp - 0x58], 0
jmp 0x1002c9d0
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 4
jge 0x1002c9e9
push dword [ebp - 0x58]
lea ecx, [ebp - 0x7b8]
call fcn.10009b6a
and dword [eax], 0
jmp 0x1002c9c9
mov dword [ebp - 0x58], 0
jmp 0x1002c9f9
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1002ca0f
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x38c], 0xdfe0091d
jmp 0x1002c9f2
push 2
lea ecx, [ebp - 0x7b8]
call fcn.10009b6a
mov dword [eax], 0x18
jmp 0x1002ca48
push 2
lea ecx, [ebp - 0x7b8]
call fcn.10009b6a
mov dword [ebp - 0x778], eax
mov eax, dword [ebp - 0x778]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x778]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x7b8]
call fcn.10009b6a
cmp dword [eax], 0x17
jl 0x1002cc01
mov dword [ebp - 0x964], 0
mov dword [ebp - 0x95c], 0xffffffff
push 1
lea ecx, [ebp - 0xa50]
call fcn.10009afa
mov byte [ebp - 4], 1
mov dword [ebp - 0x96c], 0x890ba5fc
push 0
push 1
lea eax, [ebp - 0xa50]
push eax
lea eax, [ebp - 0xd60]
push eax
push 0x3a5d
push 0x6df8
push 0
push 0x6adc
call fcn.1004058c
add esp, 0x20
mov dword [ebp - 0x8b4], 2
push 0
lea ecx, [ebp - 0xa50]
call fcn.10009b6a
cmp dword [eax], 0
jne 0x1002caf2
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x388]
cmp dword [ebp + eax - 0x38c], ecx
jle 0x1002caf2
and dword [ebp - 0x72c], 0
jmp 0x1002cafc
mov dword [ebp - 0x72c], 1
cmp dword [ebp - 0x72c], 0x93dd61fb
jne 0x1002cb1a
cmp dword [ebp - 0x588], 0
jne 0x1002cb1a
and dword [ebp - 0x378], 0
jmp 0x1002cb24
mov dword [ebp - 0x378], 1
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x38c]
imul esi, dword [ebp - 0x378]
imul esi, dword [ebp - 0x8bc]
push 2
lea ecx, [ebp - 0x7b8]
call fcn.10009b6a
cmp esi, dword [eax]
jl 0x1002cb5c
mov dword [ebp - 0x8c4], 1
jmp 0x1002cb63
and dword [ebp - 0x8c4], 0
mov esi, dword [ebp - 0x588]
push 2
lea ecx, [ebp - 0x7b8]
call fcn.10009b6a
cmp esi, dword [eax]
je 0x1002cb86
mov dword [ebp - 0x380], 1
jmp 0x1002cb8d
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x33c]
cmp eax, dword [ebp - 0x380]
jl 0x1002cbb4
mov dword [ebp - 0x690], 1
jmp 0x1002cbbb
and dword [ebp - 0x690], 0
mov eax, dword [ebp - 0x690]
mov dword [ebp - 0x95c], eax
mov eax, dword [ebp - 0x964]
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x96c], 0
je 0x1002cbed
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa50]
call fcn.10009b5c
jmp 0x1002cc01
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xa50]
call fcn.10009b5c
jmp 0x1002ca24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7b8]
call fcn.10009b5c
jmp 0x1002c995
jmp 0x1002c947
mov dword [ebp - 0x84], 0xe8cff0ea
mov dword [ebp - 0x2b4], 3
mov dword [ebp - 0x7ac], 1
mov dword [ebp - 0x7a8], 1
mov dword [ebp - 0x7a4], 1
mov dword [ebp - 0x7a0], 1
mov dword [ebp - 0x274], 0xdb80ebbd
mov dword [ebp - 0x390], 0xcff29c21
mov dword [ebp - 0x304], 0x7c8a36a7
mov dword [ebp - 0x84], 3
jmp 0x1002cc8d
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jg 0x1002ce6b
push 3
lea ecx, [ebp - 0x9bc]
call fcn.10009afa
mov dword [ebp - 4], 2
mov dword [ebp - 0x1b8], 0
jmp 0x1002ccc7
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 3
jge 0x1002cce9
push dword [ebp - 0x1b8]
lea ecx, [ebp - 0x9bc]
call fcn.10009b6a
mov dword [eax], 0xb108f825
jmp 0x1002ccba
push 2
lea ecx, [ebp - 0x9bc]
call fcn.10009b6a
and dword [eax], 0
jmp 0x1002cd1f
push 2
lea ecx, [ebp - 0x9bc]
call fcn.10009b6a
mov dword [ebp - 0x590], eax
mov eax, dword [ebp - 0x590]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x590]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x9bc]
call fcn.10009b6a
cmp dword [eax], 0xffffffec
jg 0x1002ce4b
mov dword [ebp - 0x1c0], 0x888999d9
mov dword [ebp - 0x220], 0
jmp 0x1002cd58
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 2
jge 0x1002cd74
mov eax, dword [ebp - 0x220]
mov dword [ebp + eax*4 - 0xdb8], 0xbbef
jmp 0x1002cd4b
mov dword [ebp - 0x974], 0x179a
cmp dword [ebp - 0x974], 0x11ce
jge 0x1002cdee
push 0x157c2198
push 0x1530c984
push 0x1530c988
push 0x1530c98c
push 0x10007a64
call fcn.10057e4b
add esp, 0x14
push 0x4b5644
push 0xffffffffffffffff
push 0x1530c998
call fcn.100147c2
add esp, 0xc
push fcn.1000d301
push 0
push 0
push 0
push 0
call fcn.1002c570
add esp, 0x10
cdq
mov ecx, 0x5f5e100
idiv ecx
push edx
mov ecx, 0x10663bb8
call fcn.10040b71
mov ecx, eax
call fcn.100099cf
mov dword [ebp - 0x1c0], 0
jmp 0x1002ce07
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 1
jg 0x1002ce46
mov byte [ebp - 0xf9], 0
movzx eax, byte [ebp - 0xf9]
test eax, eax
je 0x1002ce44
push 0x18f3
push 0x103
push 0x5636
push 0
push 0
push 1
push 0x2947
call fcn.10038061
add esp, 0x1c
jmp 0x1002cdfa
jmp 0x1002ccfb
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x2b4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9bc]
call fcn.10009b5c
jmp 0x1002cc80
mov eax, dword [ebp - 0x274]
dec eax
mov dword [ebp - 0x274], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7ac]
mov dword [ebp - 0xd68], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7ac]
mov dword [ebp - 0xd70], eax
cmp dword [ebp - 0x2b4], 0
jne 0x1002cec2
cmp dword [ebp - 0x274], 0
jne 0x1002cec2
cmp dword [ebp - 0x390], 0
jne 0x1002cec2
and dword [ebp - 0x71c], 0
jmp 0x1002cecc
mov dword [ebp - 0x71c], 1
mov eax, dword [ebp - 0x390]
cmp eax, dword [ebp - 0x71c]
jle 0x1002cee6
mov dword [ebp - 0x398], 1
jmp 0x1002ceed
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x304]
cmp dword [ebp - 0x398], eax
jge 0x1002cf07
mov dword [ebp - 0x598], 1
jmp 0x1002cf0e
and dword [ebp - 0x598], 0
cmp dword [ebp - 0x598], 0xf3c5a4a1
je 0x1002cf26
mov dword [ebp - 0x3a0], 1
jmp 0x1002cf2d
and dword [ebp - 0x3a0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3a0]
sub ecx, dword [ebp + eax - 0x7ac]
cmp ecx, dword [ebp - 0x2b4]
jg 0x1002cf53
mov dword [ebp - 0x698], 1
jmp 0x1002cf5a
and dword [ebp - 0x698], 0
cmp dword [ebp - 0x698], 0xd73c
je 0x1002cf72
mov dword [ebp - 0x3a8], 1
jmp 0x1002cf79
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a8]
sub eax, 0x140a
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x7ac]
jge 0x1002cf9e
mov dword [ebp - 0x5a0], 1
jmp 0x1002cfa5
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x274]
cmp dword [ebp - 0x5a0], eax
jge 0x1002cfbf
mov dword [ebp - 0x3b0], 1
jmp 0x1002cfc6
and dword [ebp - 0x3b0], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x7ac]
add eax, dword [ebp - 0x3b0]
cmp eax, dword [ebp - 0x304]
jg 0x1002cfed
mov dword [ebp - 0x97c], 1
jmp 0x1002cff4
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xd78], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0xcdc], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x7ac]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x1002d034
mov dword [ebp - 0x718], 1
jmp 0x1002d03b
and dword [ebp - 0x718], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x718]
mov dword [ebp + eax - 0x7ac], ecx
mov dword [ebp - 0x130], 0xfffffffc
push 3
lea ecx, [ebp - 0x280]
call fcn.10009afa
mov dword [ebp - 4], 3
mov dword [ebp - 0xad4], 0xce695ef
mov dword [ebp - 0xad0], 0xce695ef
mov dword [ebp - 0xacc], 0xce695ef
mov dword [ebp - 0xac8], 0xce695ef
lea ecx, [ebp - 0x33d]
call fcn.10009bd3
push eax
lea eax, [ebp - 0xac4]
push eax
lea eax, [ebp - 0xad4]
push eax
lea ecx, [ebp - 0xdb0]
call fcn.10009bd6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc40]
call fcn.10009b36
mov byte [ebp - 4], 4
mov dword [ebp - 0x994], 0x5036ffe6
push 1
push 0x21d7
push 0x3ef1
push 0x3d75
lea eax, [ebp - 0x168]
push eax
push 0x2342
lea eax, [ebp - 0x280]
push eax
push 1
call fcn.1001fd53
add esp, 0x20
mov dword [ebp - 0x168], 0
jmp 0x1002d11d
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 2
jge 0x1002d139
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0x738], 0xbdfadf62
jmp 0x1002d110
push 1
lea ecx, [ebp - 0x280]
call fcn.10009b6a
and dword [eax], 0
jmp 0x1002d16f
push 1
lea ecx, [ebp - 0x280]
call fcn.10009b6a
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x3b8]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x280]
call fcn.10009b6a
cmp dword [eax], 0xffffffe4
jne 0x1002d480
push 1
lea ecx, [ebp - 0xa74]
call fcn.10009afa
mov byte [ebp - 4], 5
mov dword [ebp - 0x984], 0xfffffffe
mov dword [ebp - 0xcfc], 1
mov dword [ebp - 0x32c], 0xfffffffe
mov dword [ebp - 0x3d8], 0xc6d21cd
push 0
lea eax, [ebp - 0xa74]
push eax
push 0x7fe9
lea eax, [ebp - 0x148]
push eax
push 1
push 0x326c
push 0x64bd
call fcn.100258a1
add esp, 0x1c
mov dword [ebp - 0x148], 0
jmp 0x1002d200
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 1
jge 0x1002d21c
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x2c4], 3
jmp 0x1002d1f3
push 0
lea ecx, [ebp - 0xa74]
call fcn.10009b6a
cmp dword [ebp - 0x984], 1
jne 0x1002d23e
mov dword [ebp - 0x5a8], 1
jmp 0x1002d245
and dword [ebp - 0x5a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x738]
cmp dword [ebp - 0x5a8], eax
jl 0x1002d266
mov dword [ebp - 0x3c0], 1
jmp 0x1002d26d
and dword [ebp - 0x3c0], 0
cmp dword [ebp - 0x3c0], 0x210c
je 0x1002d285
mov dword [ebp - 0x6a0], 1
jmp 0x1002d28c
and dword [ebp - 0x6a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x738]
cmp dword [ebp - 0x6a0], eax
je 0x1002d2b3
push 2
lea ecx, [ebp - 0x280]
call fcn.10009b6a
cmp dword [eax], 0
je 0x1002d2cf
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c4], 0
je 0x1002d2cf
mov dword [ebp - 0x3c8], 1
jmp 0x1002d2d6
and dword [ebp - 0x3c8], 0
push 1
lea ecx, [ebp - 0x280]
call fcn.10009b6a
mov ecx, dword [ebp - 0x3c8]
cmp ecx, dword [eax]
jle 0x1002d2f9
mov dword [ebp - 0x5b0], 1
jmp 0x1002d300
and dword [ebp - 0x5b0], 0
cmp dword [ebp - 0x5b0], 9
jne 0x1002d315
mov dword [ebp - 0x3d0], 1
jmp 0x1002d31c
and dword [ebp - 0x3d0], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x738]
push 0
lea ecx, [ebp - 0x280]
call fcn.10009b6a
mov edi, dword [ebp - 0x3d0]
imul edi, dword [eax]
push 4
pop eax
imul eax, eax, 0
imul edi, dword [ebp + eax - 0x2c4]
push 1
lea ecx, [ebp - 0x280]
call fcn.10009b6a
imul edi, dword [eax]
cmp esi, edi
je 0x1002d371
push 4
pop eax
test eax, eax
jne 0x1002d371
and dword [ebp - 0x760], 0
jmp 0x1002d37b
mov dword [ebp - 0x760], 1
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp - 0x760], 0x4cbf
cmp dword [ebp + eax - 0x738], ecx
jne 0x1002d3a0
mov dword [ebp - 0x2bc], 1
jmp 0x1002d3a7
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x3d8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2bc]
mov dword [ebp + eax - 0x738], ecx
mov eax, dword [ebp - 0x3d8]
add eax, dword [ebp - 0x2bc]
mov ecx, dword [ebp - 0x32c]
dec ecx
mov dword [ebp - 0x32c], ecx
test eax, eax
jne 0x1002d3fc
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c4], 0
jne 0x1002d3fc
and dword [ebp - 0x5b8], 0
jmp 0x1002d406
mov dword [ebp - 0x5b8], 1
push 0
lea ecx, [ebp - 0xa74]
call fcn.10009b6a
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5b8]
jle 0x1002d429
mov dword [ebp - 0x98c], 1
jmp 0x1002d430
and dword [ebp - 0x98c], 0
push 1
lea ecx, [ebp - 0x280]
call fcn.10009b6a
push 1
lea ecx, [ebp - 0x280]
call fcn.10009b6a
push 0
lea ecx, [ebp - 0x280]
call fcn.10009b6a
push 2
lea ecx, [ebp - 0xc40]
call fcn.10009b6a
mov eax, dword [eax]
mov dword [ebp - 0x994], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa74]
call fcn.10009b5c
jmp 0x1002d14b
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xc40]
call fcn.10009b5c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x280]
call fcn.10009b5c
mov dword [ebp - 0xa2c], 0xf0415773
push 0
push 0x166d
push 0xf2a
push 0x68a4
push 0x57c7
push 0x1803
push 0x653d
push 0x7be
push 1
push 0x2d98
push 0x6b45
push 0
push 0x6a99
push 0x525a
push 0x5534
call fcn.1003b9f6
add esp, 0x3c
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0x110], 0xffff
mov dword [ebp - 0x74], 0x45ee28fd
mov dword [ebp - 0x818], 0x78fa8f90
mov dword [ebp - 0x814], 0x78fa8f90
mov dword [ebp - 0x810], 0x78fa8f90
mov dword [ebp - 0x80c], 0x78fa8f90
mov dword [ebp - 0x30c], 0xe93d0b54
mov dword [ebp - 0x330], 0x8361
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xc04], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x818], 0xfa85f88e
jbe 0x1002d574
mov dword [ebp - 0x3e0], 1
jmp 0x1002d57b
and dword [ebp - 0x3e0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x818]
cmp dword [ebp - 0x3e0], eax
je 0x1002d59c
mov dword [ebp - 0x6a8], 1
jmp 0x1002d5a3
and dword [ebp - 0x6a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x818]
cmp eax, dword [ebp - 0x6a8]
jge 0x1002d5c4
mov dword [ebp - 0x99c], 1
jmp 0x1002d5cb
and dword [ebp - 0x99c], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xd2c], eax
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0xc0c], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xcf4], eax
mov eax, dword [ebp - 0x30c]
dec eax
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0xb0]
push 4
pop ecx
imul ecx, ecx, 3
add eax, dword [ebp + ecx - 0x818]
imul eax, eax, 0x389
cmp eax, 1
jg 0x1002d623
mov dword [ebp - 0x3e8], 1
jmp 0x1002d62a
and dword [ebp - 0x3e8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x818]
cmp dword [ebp - 0x3e8], eax
jge 0x1002d64b
mov dword [ebp - 0x5c0], 1
jmp 0x1002d652
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x5c0], eax
jl 0x1002d66c
mov dword [ebp - 0x2cc], 1
jmp 0x1002d673
and dword [ebp - 0x2cc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2cc]
mov dword [ebp + eax - 0x818], ecx
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x74], eax
jne 0x1002d6a5
mov dword [ebp - 0x9a4], 1
jmp 0x1002d6ac
and dword [ebp - 0x9a4], 0
cmp dword [ebp - 0x74], 0
je 0x1002d6e4
mov dword [ebp - 0x9ac], 0xff5ecce3
push 1
push 1
push 0x4776
push 0x5be4
lea eax, [ebp - 0x9ac]
push eax
push 0
lea eax, [ebp - 0x74]
push eax
call fcn.10033d0b
add esp, 0x1c
jmp 0x1002d875
mov dword [ebp - 0xa1c], 0xfffffffd
mov dword [ebp - 0x1c8], 0
jmp 0x1002d707
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 1
jge 0x1002d723
mov eax, dword [ebp - 0x1c8]
mov dword [ebp + eax*4 - 0x188], 0xfaa058a1
jmp 0x1002d6fa
mov dword [ebp - 0x110], 8
jmp 0x1002d73c
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x23
jle 0x1002d79e
mov byte [ebp - 0xaa], 0
movzx eax, byte [ebp - 0xaa]
test eax, eax
je 0x1002d79c
push 0x4b18
push 0x54d2
push 0x43da
push 0
push 0x11db
push 0x5468
push 1
push 0
push 0x616f
push 0x7615
push 0x3077
push 0x1874
push 0x1c88
push 0xa97
call fcn.1003784d
add esp, 0x38
jmp 0x1002d72f
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xc34], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x188]
cmp dword [ebp - 0xb0], eax
jg 0x1002d7c8
mov dword [ebp - 0x3f0], 1
jmp 0x1002d7cf
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0xb0]
mov ecx, dword [ebp - 0x3f0]
sub ecx, dword [ebp - 0x74]
lea eax, [eax + ecx - 0xa6a4]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x188]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x188]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x330]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x188]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xd34], eax
mov eax, dword [ebp - 0xb0]
push 4
pop ecx
imul ecx, ecx, 0
imul ecx, dword [ebp + ecx - 0x188], 0xe89b
imul eax, ecx
test eax, eax
jne 0x1002d84a
cmp dword [ebp - 0x330], 0
cmp dword [ebp - 0xb0], 0xffff
je 0x1002d862
mov dword [ebp - 0x720], 1
jmp 0x1002d869
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x720]
mov dword [ebp - 0xa1c], eax
mov dword [ebp - 0x228], 0
jmp 0x1002d88e
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 1
jge 0x1002d8aa
mov eax, dword [ebp - 0x228]
mov dword [ebp + eax*4 - 0xb8], 0xfb6f65e7
jmp 0x1002d881
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
mov dword [ebp - 0xc44], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xb8]
cmp dword [ebp + eax - 0xb8], ecx
jg 0x1002d8e5
mov dword [ebp - 0x3f8], 1
jmp 0x1002d8ec
and dword [ebp - 0x3f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
cmp eax, dword [ebp - 0x3f8]
jl 0x1002d90d
mov dword [ebp - 0x5c8], 1
jmp 0x1002d914
and dword [ebp - 0x5c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
cmp dword [ebp - 0x5c8], eax
jl 0x1002d935
mov dword [ebp - 0x2d4], 1
jmp 0x1002d93c
and dword [ebp - 0x2d4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2d4]
mov dword [ebp + eax - 0xb8], ecx
mov eax, dword [ebp - 0x130]
imul eax, dword [ebp - 0x2d4]
test eax, eax
jne 0x1002d979
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb8], 0
jne 0x1002d979
and dword [ebp - 0xa24], 0
jmp 0x1002d983
mov dword [ebp - 0xa24], 1
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xd04], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xc54], eax
cmp dword [ebp - 0x130], 2
ja 0x1002d9b0
mov dword [ebp - 0x400], 1
jmp 0x1002d9b7
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x400], eax
jge 0x1002d9d1
mov dword [ebp - 0x6b0], 1
jmp 0x1002d9d8
and dword [ebp - 0x6b0], 0
mov eax, dword [ebp - 0x130]
add eax, dword [ebp - 0x6b0]
mov dword [ebp - 0xa2c], eax
push 4
lea ecx, [ebp - 0x9cc]
call fcn.10009afa
mov dword [ebp - 4], 6
mov dword [ebp - 0x5d0], 0xccd2466e
mov dword [ebp - 0x1d0], 0
jmp 0x1002da21
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 4
jge 0x1002da43
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0x9cc]
call fcn.10009b6a
mov dword [eax], 0x4e064826
jmp 0x1002da14
push 2
lea ecx, [ebp - 0x9cc]
call fcn.10009b6a
and dword [eax], 0
jmp 0x1002da79
push 2
lea ecx, [ebp - 0x9cc]
call fcn.10009b6a
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x408]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x9cc]
call fcn.10009b6a
cmp dword [eax], 4
jg 0x1002df08
push 3
lea ecx, [ebp - 0x7d0]
call fcn.10009afa
mov byte [ebp - 4], 7
mov dword [ebp - 0x150], 1
lea eax, [ebp - 0x7d0]
push eax
push 0x5c6a
lea eax, [ebp - 0xd6c]
push eax
push 0
push 1
push 1
push 0x5fe5
call fcn.10038061
add esp, 0x1c
mov dword [ebp - 0x150], 2
jmp 0x1002dae9
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jl 0x1002decc
mov dword [ebp - 0x60], 0xdc9ed9ba
mov dword [ebp - 0x60], 2
jmp 0x1002db0d
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x1002dec7
mov dword [ebp - 0x1d8], 0xd9ee1c97
mov dword [ebp - 0x258], 0
jmp 0x1002db3a
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 3
jge 0x1002db56
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0xd84], 0x2afd77cc
jmp 0x1002db2d
mov dword [ebp - 0x1d8], 0
jmp 0x1002db6f
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 2
jg 0x1002dec2
mov dword [ebp - 0x44], 0xffffffff
push 2
lea ecx, [ebp - 0xb50]
call fcn.10009afa
mov byte [ebp - 4], 8
mov dword [ebp - 0x230], 0
jmp 0x1002dbad
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 2
jge 0x1002dbcc
push dword [ebp - 0x230]
lea ecx, [ebp - 0xb50]
call fcn.10009b6a
and dword [eax], 0
jmp 0x1002dba0
mov dword [ebp - 0x44], 2
jmp 0x1002dbdc
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x1002dc16
push 0x67b3
lea eax, [ebp - 0x60]
push eax
push 0
push 0x61ec
lea eax, [ebp - 0x150]
push eax
push 0x2c63
push 0x14c4
lea eax, [ebp - 0x7d0]
push eax
push 1
call fcn.10027db7
add esp, 0x24
jmp 0x1002dbd5
mov dword [ebp - 0x44], 0
jmp 0x1002dc26
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jg 0x1002deae
mov dword [ebp - 0xa18], 0x2375
cmp dword [ebp - 0xa18], 0x900
jge 0x1002dda8
lea eax, [ebp - 0x990]
push eax
lea eax, [ebp - 0x270]
push eax
mov ecx, 0x10663c70
call fcn.1000980b
mov ecx, eax
call fcn.1000980b
and dword [ebp - 0xa20], 0
lea eax, [ebp - 0xa20]
push eax
mov eax, dword [ebp - 0x270]
shl eax, 2
push eax
lea ecx, [ebp - 0xa5c]
call fcn.10040d95
mov byte [ebp - 4], 9
mov dword [ebp - 0x90], 1
mov dword [ebp - 0x1e0], 1
jmp 0x1002dcb3
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x1e0]
cmp eax, dword [ebp - 0x990]
jg 0x1002dd20
push dword [ebp - 0x90]
lea ecx, [ebp - 0xa5c]
call fcn.10009b6a
mov ecx, dword [ebp - 0x1e0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
inc eax
inc eax
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x270]
shl eax, 2
cmp dword [ebp - 0x90], eax
jle 0x1002dd1e
mov ecx, dword [ebp - 0x270]
shl ecx, 2
mov eax, dword [ebp - 0x90]
cdq
idiv ecx
mov dword [ebp - 0x90], edx
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
jmp 0x1002dca6
and dword [ebp - 0x170], 0
jmp 0x1002dd36
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x270]
shl eax, 2
cmp dword [ebp - 0x170], eax
jge 0x1002dd8a
push dword [ebp - 0x170]
lea ecx, [ebp - 0xa5c]
call fcn.10009b6a
cmp dword [eax], 0
jg 0x1002dd5f
jmp 0x1002dd29
push dword [ebp - 0x170]
lea ecx, [ebp - 0xa5c]
call fcn.10009b6a
push dword [eax]
mov ecx, 0x10663bb8
call fcn.100099db
mov edx, 0x10007818
mov ecx, eax
call fcn.1000d12a
jmp 0x1002dd29
push fcn.1000d301
mov ecx, 0x10663bb8
call fcn.100099cf
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa5c]
call fcn.1000a086
mov byte [ebp - 0x9f], 0
movzx eax, byte [ebp - 0x9f]
test eax, eax
je 0x1002ddcc
push 0x222e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp dword [ebp - 0x60], 0
jne 0x1002de62
mov esi, dword [ebp - 0x60]
sub esi, 0x4c5530c4
push 2
lea ecx, [ebp - 0x7d0]
call fcn.10009b6a
cmp esi, dword [eax]
je 0x1002ddfc
mov dword [ebp - 0x410], 1
jmp 0x1002de03
and dword [ebp - 0x410], 0
push dword [ebp - 0x60]
lea ecx, [ebp - 0x7d0]
call fcn.10009b6a
mov eax, dword [eax]
mov dword [ebp - 0x5d0], eax
mov eax, dword [ebp - 0x5d0]
mov dword [ebp - 0x788], eax
push 0
lea ecx, [ebp - 0xb50]
call fcn.10009b6a
mov ecx, dword [ebp - 0x788]
mov dword [eax], ecx
push dword [ebp - 0x44]
lea ecx, [ebp - 0x7d0]
call fcn.10009b6a
mov ecx, dword [ebp - 0x410]
imul ecx, dword [eax]
cmp dword [ebp - 0x788], ecx
jg 0x1002de62
and dword [ebp - 0x418], 0
jmp 0x1002de6c
mov dword [ebp - 0x418], 1
push dword [ebp - 0x60]
lea ecx, [ebp - 0x7d0]
call fcn.10009b6a
mov eax, dword [eax]
cmp eax, dword [ebp - 0x418]
jne 0x1002de90
mov dword [ebp - 0x5d8], 1
jmp 0x1002de97
and dword [ebp - 0x5d8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x5d8]
mov dword [ebp + eax - 0xd84], ecx
jmp 0x1002dc1f
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xb50]
call fcn.10009b5c
jmp 0x1002db62
jmp 0x1002db06
jmp 0x1002dadc
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x1002def4
push 0x2ea5
push 0x30c7
push 1
push 0
call fcn.10026946
add esp, 0x10
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x7d0]
call fcn.10009b5c
jmp 0x1002da55
mov byte [ebp - 0x100], 0
push 0x77b1
push 0
push 1
lea eax, [ebp - 0x100]
push eax
push 0x4a2f
push 0x53cf
push 0x65e5
push 0
call fcn.10033343
add esp, 0x20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9cc]
call fcn.10009b5c
mov byte [ebp - 0xa5], 0
push 1
lea ecx, [ebp - 0xc50]
call fcn.10009afa
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x238], 6
mov dword [ebp - 0x1e8], 0
jmp 0x1002df85
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jge 0x1002dfa7
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0xc50]
call fcn.10009b6a
mov dword [eax], 8
jmp 0x1002df78
mov byte [ebp - 0xa3], 0
push 0x19d1
lea eax, [ebp - 0xa3]
push eax
push 0x49d9
push 0
push 0x47e
push 0x7d9d
push 1
push 1
push 0x6231
push 0x1b6e
push 0x59e2
push 0x4d98
push 0x112c
push 0x187
call fcn.1003784d
add esp, 0x38
mov dword [ebp - 0x238], 0
jmp 0x1002e00e
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jg 0x1002e030
mov byte [ebp - 0xf1], 0
lea eax, [ebp - 0xf1]
push eax
push 0
call fcn.10037e20
pop ecx
pop ecx
jmp 0x1002e001
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc50]
call fcn.10009b5c
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x1002e29d
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0x48], 0xfffffffc
mov dword [ebp - 0xc8], 0x40ed3c15
mov dword [ebp - 0x158], 0xd06bde64
xor eax, eax
inc eax
je 0x1002e08d
cmp dword [ebp - 0xc0], 0
je 0x1002e08d
mov dword [ebp - 0x420], 1
jmp 0x1002e094
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0x420]
jle 0x1002e0ae
mov dword [ebp - 0x6b8], 1
jmp 0x1002e0b5
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0x6b8]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x1002e0fb
cmp dword [ebp - 0x48], 0x2337
jle 0x1002e0d9
mov dword [ebp - 0x428], 1
jmp 0x1002e0e0
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x1002e0fb
mov dword [ebp - 0x5e0], 1
jmp 0x1002e102
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x5e0]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0xc8], eax
jne 0x1002e128
mov dword [ebp - 0x430], 1
jmp 0x1002e12f
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
sub eax, dword [ebp - 0xc0]
cmp eax, 0xa7525d2d
jae 0x1002e14e
mov dword [ebp - 0x728], 1
jmp 0x1002e155
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x728], eax
je 0x1002e16f
mov dword [ebp - 0x88c], 1
jmp 0x1002e176
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xc64], eax
cmp dword [ebp - 0xc0], 0
je 0x1002e203
mov dword [ebp - 0xc8], 0
jmp 0x1002e1a4
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0x12
jl 0x1002e201
mov byte [ebp - 0x102], 0
movzx eax, byte [ebp - 0x102]
test eax, eax
je 0x1002e1cd
push 0
push 0x51cd
call fcn.10033318
pop ecx
pop ecx
mov dword [ebp - 0x48], 0
jmp 0x1002e1dd
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xe
jne 0x1002e1ff
push 0
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x158]
push eax
push 0
call fcn.100338f7
add esp, 0x10
jmp 0x1002e1d6
jmp 0x1002e197
jmp 0x1002e27d
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x1002e23c
push 0x1e89
push 0
push 0x2259
push 0x2551
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
mov dword [ebp - 0x158], 0xfffffff9
jmp 0x1002e255
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0x17
jne 0x1002e27d
mov byte [ebp - 0xe9], 0
push 0
push 0x713f
lea eax, [ebp - 0xe9]
push eax
call fcn.10038174
add esp, 0xc
jmp 0x1002e248
push 1
push 0
push 0x1498
push 0x6aa7
push 0x5901
push 0x1035
call fcn.10027c8c
add esp, 0x18
mov eax, dword [ebp - 0x22c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x724], eax
mov dword [ebp - 0x260], 0xdb3ae355
push 1
lea ecx, [ebp - 0xc60]
call fcn.10009afa
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x1f0], 0
jmp 0x1002e2e3
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 1
jge 0x1002e302
push dword [ebp - 0x1f0]
lea ecx, [ebp - 0xc60]
call fcn.10009b6a
or dword [eax], 0xffffffff
jmp 0x1002e2d6
mov dword [ebp - 0x260], 0xffffffea
jmp 0x1002e31b
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0xd
jle 0x1002e3bc
mov dword [ebp - 0x1f8], 0x98311173
push 0x76c3
push 0x99d
push 0x15e6
push 1
push 0x32b9
push 0x7726
push 0
push 0x2054
call fcn.10026008
add esp, 0x20
mov dword [ebp - 0x1f8], 0
jmp 0x1002e375
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0
jg 0x1002e3b7
mov byte [ebp - 0xa7], 0
movzx eax, byte [ebp - 0xa7]
test eax, eax
je 0x1002e3b5
push 0x936
push 1
push 0x479b
push 0x70c9
push 0
push 0x24ac
push 0x5f22
call fcn.10026661
add esp, 0x1c
jmp 0x1002e368
jmp 0x1002e30e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc60]
call fcn.10009b5c
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0x118], 0xfffffffc
mov dword [ebp - 0xd8], 0x40ed3c15
mov dword [ebp - 0x160], 0xd06bde64
xor eax, eax
inc eax
je 0x1002e40d
cmp dword [ebp - 0xd0], 0
je 0x1002e40d
mov dword [ebp - 0x438], 1
jmp 0x1002e414
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0xd0]
cmp eax, dword [ebp - 0x438]
jle 0x1002e42e
mov dword [ebp - 0x5e8], 1
jmp 0x1002e435
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je 0x1002e48a
cmp dword [ebp - 0x118], 0x2337
jle 0x1002e462
mov dword [ebp - 0x440], 1
jmp 0x1002e469
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je 0x1002e48a
mov dword [ebp - 0x6c0], 1
jmp 0x1002e491
and dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x6c0]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0xd8], eax
jne 0x1002e4b7
mov dword [ebp - 0x448], 1
jmp 0x1002e4be
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x448]
sub eax, dword [ebp - 0xd0]
cmp eax, 0xa7525d2d
jae 0x1002e4dd
mov dword [ebp - 0x5f0], 1
jmp 0x1002e4e4
and dword [ebp - 0x5f0], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x5f0], eax
je 0x1002e4fe
mov dword [ebp - 0x840], 1
jmp 0x1002e505
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xd0c], eax
cmp dword [ebp - 0xd0], 0
je 0x1002e7cd
mov dword [ebp - 0x970], 0x1466
cmp dword [ebp - 0x970], 0x11b0
jge 0x1002e75d
movsd xmm0, qword [0x10007fa8]
movsd qword [ebp - 0xc18], xmm0
lea eax, [ebp - 0xaa0]
push eax
lea eax, [ebp - 0x240]
push eax
push 0x10007a70
call fcn.10057e4b
add esp, 0xc
push dword [ebp - 0x240]
lea ecx, [ebp - 0xa68]
call fcn.10041074
mov dword [ebp - 4], 0xc
push dword [ebp - 0x240]
lea ecx, [ebp - 0xb44]
call fcn.10041074
mov byte [ebp - 4], 0xd
and dword [ebp - 0x180], 0
jmp 0x1002e5a6
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x180]
cmp eax, dword [ebp - 0x240]
jge 0x1002e5e7
push dword [ebp - 0x180]
lea ecx, [ebp - 0xb44]
call fcn.10040f6e
push eax
push dword [ebp - 0x180]
lea ecx, [ebp - 0xa68]
call fcn.10040f6e
push eax
push 0x10007a78
call fcn.10057e4b
add esp, 0xc
jmp 0x1002e599
movsd xmm0, qword [0x10007f88]
movsd qword [ebp - 0x8d0], xmm0
and dword [ebp - 0x200], 0
jmp 0x1002e60d
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x200]
cmp eax, dword [ebp - 0x240]
jge 0x1002e642
push dword [ebp - 0x200]
lea ecx, [ebp - 0xa68]
call fcn.10040f6e
movsd xmm0, qword [ebp - 0x8d0]
addsd xmm0, qword [eax]
movsd qword [ebp - 0x8d0], xmm0
jmp 0x1002e600
movsd xmm0, qword [ebp - 0xaa0]
comisd xmm0, xmmword [ebp - 0x8d0]
jb 0x1002e65f
push 0x1000782c
call fcn.10058226
pop ecx
movsd xmm0, qword [0x10007f88]
movsd qword [ebp - 0x7f0], xmm0
movsd xmm0, qword [0x10007fe8]
movsd qword [ebp - 0x7e8], xmm0
movsd xmm0, qword [ebp - 0x7e8]
subsd xmm0, qword [ebp - 0x7f0]
comisd xmm0, xmmword [ebp - 0xc18]
jbe 0x1002e713
movsd xmm0, qword [ebp - 0x7f0]
addsd xmm0, qword [ebp - 0x7e8]
divsd xmm0, qword [0x10007fc0]
movsd qword [ebp - 0x8dc], xmm0
push ecx
push ecx
movsd xmm0, qword [ebp - 0x8dc]
movsd qword [esp], xmm0
lea eax, [ebp - 0xaa0]
push eax
lea eax, [ebp - 0xb44]
push eax
lea eax, [ebp - 0xa68]
push eax
call fcn.1002c659
add esp, 0x14
movzx eax, al
test eax, eax
je 0x1002e6fe
movsd xmm0, qword [ebp - 0x8dc]
movsd qword [ebp - 0x7f0], xmm0
jmp 0x1002e70e
movsd xmm0, qword [ebp - 0x8dc]
movsd qword [ebp - 0x7e8], xmm0
jmp 0x1002e67f
movsd xmm0, qword [ebp - 0x7f0]
addsd xmm0, qword [ebp - 0x7e8]
divsd xmm0, qword [0x10007fc0]
push ecx
push ecx
movsd qword [esp], xmm0
push 0x10007a80
call fcn.10058066
add esp, 0xc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xb44]
call fcn.10009b5c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa68]
call fcn.10009b5c
mov dword [ebp - 0xd8], 0
jmp 0x1002e776
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x12
jl 0x1002e7c8
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x1002e7a7
push 0
push 0
push 0x12ff
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 0x160]
push eax
push 0
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0xd8]
push eax
call fcn.1003af2c
add esp, 0x10
jmp 0x1002e769
jmp 0x1002e84e
mov byte [ebp - 0x104], 0
movzx eax, byte [ebp - 0x104]
test eax, eax
je 0x1002e806
push 0x1e89
push 0
push 0x2259
push 0x2551
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
mov dword [ebp - 0x160], 0xfffffff9
jmp 0x1002e81f
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0x17
jne 0x1002e84e
mov byte [ebp - 0xb9], 0
push 0x68fa
lea eax, [ebp - 0xb9]
push eax
push 0x1c61
push 0
push 0
call fcn.10027e96
add esp, 0x14
jmp 0x1002e812
mov dword [ebp - 0x358], 0x3b26bdde
mov dword [ebp - 0x354], 0x3b26bdde
mov dword [ebp - 0x350], 0x3b26bdde
mov dword [ebp - 0x34c], 0x3b26bdde
mov dword [ebp - 0x208], 0xdb3ae355
push 1
lea ecx, [ebp - 0xc70]
call fcn.10009afa
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x26c], 0
jmp 0x1002e8ad
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 1
jge 0x1002e8cc
push dword [ebp - 0x26c]
lea ecx, [ebp - 0xc70]
call fcn.10009b6a
or dword [eax], 0xffffffff
jmp 0x1002e8a0
mov dword [ebp - 0x208], 0xffffffea
jmp 0x1002e8e5
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0xd
jle 0x1002e983
mov dword [ebp - 0x248], 0x98311173
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x1002e927
push 0x4def
push 0x1906
push 0x517e
push 0
call fcn.100404db
add esp, 0x10
mov dword [ebp - 0x248], 0
jmp 0x1002e940
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jg 0x1002e97e
mov byte [ebp - 0xfd], 0
push 0x2512
push 1
push 0x72bf
lea eax, [ebp - 0xfd]
push eax
push 0x1d68
push 0
push 0x4268
push 0x54f
call fcn.100252c5
add esp, 0x20
jmp 0x1002e933
jmp 0x1002e8d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc70]
call fcn.10009b5c
push 3
lea ecx, [ebp - 0x298]
call fcn.10009afa
mov dword [ebp - 4], 0xf
mov dword [ebp - 0xb24], 0xce695ef
mov dword [ebp - 0xb20], 0xce695ef
mov dword [ebp - 0xb1c], 0xce695ef
mov dword [ebp - 0xb18], 0xce695ef
lea ecx, [ebp - 0x331]
call fcn.10009bd3
push eax
lea eax, [ebp - 0xb14]
push eax
lea eax, [ebp - 0xb24]
push eax
lea ecx, [ebp - 0xdc8]
call fcn.10009bd6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc80]
call fcn.10009b36
mov byte [ebp - 4], 0x10
mov dword [ebp - 0xa0c], 0x5036ffe6
mov dword [ebp - 0x4c], 0
jmp 0x1002ea21
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x1002ea3d
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x298]
call fcn.10009b6a
mov dword [eax], 0x7ddc85f7
jmp 0x1002ea1a
mov dword [ebp - 0x848], 0x267c
cmp dword [ebp - 0x848], 0x10d1
jge 0x1002eaee
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x850]
push eax
lea eax, [ebp - 0x9f0]
push eax
push 0x10007a88
call fcn.10057e4b
add esp, 0x10
xor eax, eax
inc eax
je 0x1002eaee
push dword [ebp - 0x88]
push dword [ebp - 0x9f0]
call fcn.1001fd25
pop ecx
pop ecx
mov ecx, dword [ebp - 0x88]
sub ecx, eax
mov dword [ebp - 0x88], ecx
cmp dword [ebp - 0x88], 0
jg 0x1002eab5
push 0x10007a94
call fcn.10058066
pop ecx
jmp 0x1002eaee
push dword [ebp - 0x88]
push dword [ebp - 0x850]
call fcn.1001fd25
pop ecx
pop ecx
mov ecx, dword [ebp - 0x88]
sub ecx, eax
mov dword [ebp - 0x88], ecx
cmp dword [ebp - 0x88], 0
jg 0x1002eaec
push 0x10007a98
call fcn.10058066
pop ecx
jmp 0x1002eaee
jmp 0x1002ea79
mov dword [ebp - 0x4c], 0
jmp 0x1002eafe
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x1002eb14
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x744], 0xbdfadf62
jmp 0x1002eaf7
push 1
lea ecx, [ebp - 0x298]
call fcn.10009b6a
and dword [eax], 0
jmp 0x1002eb4a
push 1
lea ecx, [ebp - 0x298]
call fcn.10009b6a
mov dword [ebp - 0x450], eax
mov eax, dword [ebp - 0x450]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x450]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x298]
call fcn.10009b6a
cmp dword [eax], 0xffffffe4
jne 0x1002ee4f
push 1
lea ecx, [ebp - 0xa80]
call fcn.10009afa
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x978], 0xfffffffe
mov dword [ebp - 0xc74], 1
mov dword [ebp - 0x2dc], 0xfffffffe
mov dword [ebp - 0x470], 0xc6d21cd
mov dword [ebp - 0x78], 0
jmp 0x1002eba9
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1002ebc5
push dword [ebp - 0x78]
lea ecx, [ebp - 0xa80]
call fcn.10009b6a
mov dword [eax], 0xf8d1
jmp 0x1002eba2
mov dword [ebp - 0x78], 0
jmp 0x1002ebd5
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1002ebeb
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x338], 3
jmp 0x1002ebce
push 0
lea ecx, [ebp - 0xa80]
call fcn.10009b6a
cmp dword [ebp - 0x978], 1
jne 0x1002ec0d
mov dword [ebp - 0x768], 1
jmp 0x1002ec14
and dword [ebp - 0x768], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x744]
cmp dword [ebp - 0x768], eax
jl 0x1002ec35
mov dword [ebp - 0x458], 1
jmp 0x1002ec3c
and dword [ebp - 0x458], 0
cmp dword [ebp - 0x458], 0x210c
je 0x1002ec54
mov dword [ebp - 0x5f8], 1
jmp 0x1002ec5b
and dword [ebp - 0x5f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x744]
cmp dword [ebp - 0x5f8], eax
je 0x1002ec82
push 2
lea ecx, [ebp - 0x298]
call fcn.10009b6a
cmp dword [eax], 0
je 0x1002ec9e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x338], 0
je 0x1002ec9e
mov dword [ebp - 0x460], 1
jmp 0x1002eca5
and dword [ebp - 0x460], 0
push 1
lea ecx, [ebp - 0x298]
call fcn.10009b6a
mov ecx, dword [ebp - 0x460]
cmp ecx, dword [eax]
jle 0x1002ecc8
mov dword [ebp - 0x6c8], 1
jmp 0x1002eccf
and dword [ebp - 0x6c8], 0
cmp dword [ebp - 0x6c8], 9
jne 0x1002ece4
mov dword [ebp - 0x468], 1
jmp 0x1002eceb
and dword [ebp - 0x468], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x744]
push 0
lea ecx, [ebp - 0x298]
call fcn.10009b6a
mov edi, dword [ebp - 0x468]
imul edi, dword [eax]
push 4
pop eax
imul eax, eax, 0
imul edi, dword [ebp + eax - 0x338]
push 1
lea ecx, [ebp - 0x298]
call fcn.10009b6a
imul edi, dword [eax]
cmp esi, edi
je 0x1002ed40
push 4
pop eax
test eax, eax
jne 0x1002ed40
and dword [ebp - 0x600], 0
jmp 0x1002ed4a
mov dword [ebp - 0x600], 1
push 4
pop eax
imul eax, eax, 0
imul ecx, dword [ebp - 0x600], 0x4cbf
cmp dword [ebp + eax - 0x744], ecx
jne 0x1002ed6f
mov dword [ebp - 0x314], 1
jmp 0x1002ed76
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x470], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x314]
mov dword [ebp + eax - 0x744], ecx
mov eax, dword [ebp - 0x470]
add eax, dword [ebp - 0x314]
mov ecx, dword [ebp - 0x2dc]
dec ecx
mov dword [ebp - 0x2dc], ecx
test eax, eax
jne 0x1002edcb
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x338], 0
jne 0x1002edcb
and dword [ebp - 0x730], 0
jmp 0x1002edd5
mov dword [ebp - 0x730], 1
push 0
lea ecx, [ebp - 0xa80]
call fcn.10009b6a
mov eax, dword [eax]
cmp eax, dword [ebp - 0x730]
jle 0x1002edf8
mov dword [ebp - 0x858], 1
jmp 0x1002edff
and dword [ebp - 0x858], 0
push 1
lea ecx, [ebp - 0x298]
call fcn.10009b6a
push 1
lea ecx, [ebp - 0x298]
call fcn.10009b6a
push 0
lea ecx, [ebp - 0x298]
call fcn.10009b6a
push 2
lea ecx, [ebp - 0xc80]
call fcn.10009b6a
mov eax, dword [eax]
mov dword [ebp - 0xa0c], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xa80]
call fcn.10009b5c
jmp 0x1002eb26
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xc80]
call fcn.10009b5c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x298]
call fcn.10009b5c
mov dword [ebp - 0x444], 8
mov dword [ebp - 0x478], 9
mov dword [ebp - 0xae8], 0xa485bf25
mov dword [ebp - 0xae4], 0xa485bf25
mov dword [ebp - 0xae0], 0xa485bf25
mov dword [ebp - 0xadc], 0xa485bf25
lea ecx, [ebp - 0x325]
call fcn.10009bd3
push eax
lea eax, [ebp - 0xad8]
push eax
lea eax, [ebp - 0xae8]
push eax
lea ecx, [ebp - 0xde0]
call fcn.10009bd6
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc90]
call fcn.10009b36
mov dword [ebp - 4], 0x12
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0xd3c], eax
cmp dword [ebp - 0x478], 0
je 0x1002ef13
mov byte [ebp - 0xab], 0
lea eax, [ebp - 0xab]
push eax
push 0
call fcn.100336ca
pop ecx
pop ecx
jmp 0x1002ef4b
mov dword [ebp - 0x860], 0
lea eax, [ebp - 0x860]
push eax
push 0
push 0x6c6e
push 0x5b71
push 0xc0b
push 0x6826
lea eax, [ebp - 0xc90]
push eax
push 0
call fcn.1002837c
add esp, 0x20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc90]
call fcn.10009b5c
mov dword [ebp - 0x44c], 0xfffffffa
mov dword [ebp - 0x68], 7
mov dword [ebp - 0x128], 0x15d7249a
mov dword [ebp - 0x480], 0x43d2717f
push 3
lea ecx, [ebp - 0xb74]
call fcn.10009afa
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x980], 0x94df
mov dword [ebp - 0x210], 0
jmp 0x1002efb6
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 3
jge 0x1002efd5
push dword [ebp - 0x210]
lea ecx, [ebp - 0xb74]
call fcn.10009b6a
and dword [eax], 0
jmp 0x1002efa9
mov dword [ebp - 0x68], 0xfffffffa
jmp 0x1002efe5
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0xffffffee
jl 0x1002f203
mov dword [ebp - 0x120], 9
mov dword [ebp - 0xa14], 0xd7d04549
mov dword [ebp - 0x268], 0
jmp 0x1002f01c
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 2
jge 0x1002f038
mov eax, dword [ebp - 0x268]
mov dword [ebp + eax*4 - 0x8e8], 0
jmp 0x1002f00f
cmp dword [ebp - 0x128], 0
jne 0x1002f12d
mov eax, dword [ebp - 0x120]
neg eax
cmp dword [ebp - 0x128], eax
jg 0x1002f061
mov dword [ebp - 0x608], 1
jmp 0x1002f068
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x480], eax
jne 0x1002f08e
mov dword [ebp - 0x6d0], 1
jmp 0x1002f095
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x128], eax
jl 0x1002f0b5
mov dword [ebp - 0x488], 1
jmp 0x1002f0bc
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x488], eax
jl 0x1002f0d3
mov dword [ebp - 0x610], 1
jmp 0x1002f0da
and dword [ebp - 0x610], 0
mov eax, dword [ebp - 0x68]
add eax, dword [ebp - 0x610]
cmp eax, dword [ebp - 0x68]
jge 0x1002f0fa
cmp dword [ebp - 0x68], 0
je 0x1002f0fa
mov dword [ebp - 0x2e4], 1
jmp 0x1002f101
and dword [ebp - 0x2e4], 0
push 2
lea ecx, [ebp - 0xb74]
call fcn.10009b6a
mov ecx, dword [ebp - 0x2e4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x2e4], eax
jne 0x1002f12d
and dword [ebp - 0x490], 0
jmp 0x1002f137
mov dword [ebp - 0x490], 1
mov eax, dword [ebp - 0x128]
cmp dword [ebp - 0x490], eax
je 0x1002f151
mov dword [ebp - 0x780], 1
jmp 0x1002f158
and dword [ebp - 0x780], 0
mov eax, dword [ebp - 0x780]
sub eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x68]
je 0x1002f175
mov dword [ebp - 0x498], 1
jmp 0x1002f17c
and dword [ebp - 0x498], 0
cmp dword [ebp - 0x498], 2
jae 0x1002f191
mov dword [ebp - 0x618], 1
jmp 0x1002f198
and dword [ebp - 0x618], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x618]
mov dword [ebp + eax - 0x8e8], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8e8]
imul eax, dword [ebp - 0x120]
test eax, eax
jne 0x1002f1d5
cmp dword [ebp - 0x980], 0
jne 0x1002f1d5
and dword [ebp - 0x868], 0
jmp 0x1002f1df
mov dword [ebp - 0x868], 1
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0xc84], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8e8]
mov dword [ebp - 0xa14], eax
jmp 0x1002efde
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb74]
call fcn.10009b5c
mov dword [ebp - 0x198], 0
jmp 0x1002f22b
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 4
jge 0x1002f247
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0xdd8], 0xfffffff9
jmp 0x1002f21e
mov dword [ebp - 0x2ec], 0xfffffffe
mov dword [ebp - 0x988], 0xb6ec79cf
mov dword [ebp - 0x4b0], 0xfffffff9
mov dword [ebp - 0x73c], 0xeb200688
mov dword [ebp - 0x4b8], 0x11015aa9
mov dword [ebp - 0x1b4], 0x28f4e1c
mov dword [ebp - 0x31c], 0xab97
mov dword [ebp - 0x1ac], 0
jmp 0x1002f2a6
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 1
jge 0x1002f2c2
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0x870], 3
jmp 0x1002f299
or eax, 0xffffffff
je 0x1002f413
mov eax, dword [ebp - 0x31c]
neg eax
mov dword [ebp - 0x4a0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4a0]
mov dword [ebp + eax - 0x870], ecx
mov eax, dword [ebp - 0x4a0]
mov ecx, dword [ebp - 0x31c]
inc ecx
mov dword [ebp - 0x31c], ecx
test eax, eax
jne 0x1002f315
mov eax, 0x2395e2de
test eax, eax
jne 0x1002f315
and dword [ebp - 0x6d8], 0
jmp 0x1002f31f
mov dword [ebp - 0x6d8], 1
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x6d8], eax
jle 0x1002f339
mov dword [ebp - 0x4a8], 1
jmp 0x1002f340
and dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x4a8], 0xfffffff6
je 0x1002f355
mov dword [ebp - 0x620], 1
jmp 0x1002f35c
and dword [ebp - 0x620], 0
mov eax, 0xe66c
sub eax, dword [ebp - 0x620]
cmp eax, dword [ebp - 0x1b4]
jle 0x1002f37b
mov dword [ebp - 0x628], 1
jmp 0x1002f382
and dword [ebp - 0x628], 0
mov dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x73c], eax
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0x4b8], eax
mov eax, dword [ebp - 0x988]
sub eax, dword [ebp - 0x4b8]
cmp eax, dword [ebp - 0x628]
je 0x1002f3c4
mov dword [ebp - 0x4c0], 1
jmp 0x1002f3cb
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x2ec]
dec eax
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp - 0x2ec]
cmp eax, dword [ebp - 0x4c0]
je 0x1002f3f2
mov dword [ebp - 0x6e0], 1
jmp 0x1002f3f9
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x6e0], eax
jle 0x1002f413
mov dword [ebp - 0x4c8], 1
jmp 0x1002f41a
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x1b4], eax
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x358], 0
jmp 0x1002f451
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x358], 0xffffffec
jl 0x10031a3c
push 1
lea ecx, [ebp - 0xba4]
call fcn.10009afa
mov dword [ebp - 4], 0x14
push 0x5d8e
push 0x25b9
push 0
push 0
lea eax, [ebp - 0xd14]
push eax
push 0x2b9f
lea eax, [ebp - 0xba4]
push eax
call fcn.10026c3e
add esp, 0x1c
push 0
lea ecx, [ebp - 0xba4]
call fcn.10009b6a
mov dword [ebp - 0x630], eax
mov eax, dword [ebp - 0x630]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x630]
mov dword [ecx], eax
mov byte [ebp - 0xfb], 0
push 0x3785
push 0x2046
lea eax, [ebp - 0xfb]
push eax
push 1
push 0
call fcn.1002540c
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xba4]
call fcn.10009b5c
mov dword [ebp - 0x43c], 2
push 1
lea ecx, [ebp - 0x824]
call fcn.10009afa
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x138], 0x471dfd94
mov dword [ebp - 0x20], 0
jmp 0x1002f530
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x1002f546
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xe14], 0xa8eac8b1
jmp 0x1002f529
mov dword [ebp - 0x20], 0
jmp 0x1002f556
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1002f572
push dword [ebp - 0x20]
lea ecx, [ebp - 0x824]
call fcn.10009b6a
mov dword [eax], 0x3fcb50bf
jmp 0x1002f54f
mov dword [ebp - 0x20], 0
jmp 0x1002f582
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x1002f598
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xdf0], 0x4c90d297
jmp 0x1002f57b
push 0
lea ecx, [ebp - 0x824]
call fcn.10009b6a
mov dword [eax], 2
jmp 0x1002f5d1
push 0
lea ecx, [ebp - 0x824]
call fcn.10009b6a
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x4d0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x4d0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x824]
call fcn.10009b6a
cmp dword [eax], 0
jl 0x1002f676
mov dword [ebp - 0x1bc], 6
mov dword [ebp - 0x1bc], 2
jmp 0x1002f60a
mov eax, dword [ebp - 0x1bc]
dec eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0
jl 0x1002f64f
mov byte [ebp - 0x103], 0
movzx eax, byte [ebp - 0x103]
test eax, eax
je 0x1002f639
push 0x7299
push 0
push 0x345d
call fcn.10039983
add esp, 0xc
push 0
lea ecx, [ebp - 0x824]
call fcn.10009b6a
cmp dword [eax], 0
je 0x1002f64d
jmp 0x1002f64f
jmp 0x1002f5fd
push 0
push 1
push 0x74cf
push 0x3338
lea eax, [ebp - 0x138]
push eax
push 0x5766
call fcn.10025b20
add esp, 0x18
jmp 0x1002f5ad
mov dword [ebp - 0x138], 0
jmp 0x1002f68f
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jg 0x1002f6ec
mov dword [ebp - 0x1c4], 0x3735b263
mov dword [ebp - 0x1c4], 2
jmp 0x1002f6bb
mov eax, dword [ebp - 0x1c4]
dec eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
jl 0x1002f6ea
mov byte [ebp - 0xc1], 0
push 0x547f
lea eax, [ebp - 0xc1]
push eax
push 0x676f
push 0
push 1
call fcn.10025d01
add esp, 0x14
jmp 0x1002f6ae
jmp 0x1002f682
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x824]
call fcn.10009b5c
mov dword [ebp - 0xbd8], 0x15fb26c4
mov dword [ebp - 0xbd4], 0x15fb26c4
mov dword [ebp - 0xbd0], 0x15fb26c4
mov dword [ebp - 0xbcc], 0x15fb26c4
mov dword [ebp - 0x10c], 0xffffffff
mov dword [ebp - 0x640], 0xffffffff
mov dword [ebp - 0x878], 0x1714
cmp dword [ebp - 0x878], 0x952
jge 0x1002f9bf
xor eax, eax
mov word [ebp - 0x1c], ax
xor eax, eax
mov word [ebp - 0xe0], ax
xor eax, eax
mov word [ebp - 0x344], ax
xor eax, eax
mov word [ebp - 0x10], ax
lea ecx, [ebp - 0xa44]
call fcn.100097ac
mov dword [ebp - 4], 0x16
lea eax, [ebp - 0x34]
push eax
mov ecx, 0x10663c70
call fcn.100407c8
lea edx, [ebp - 0xa44]
mov ecx, eax
call fcn.10041625
mov ax, word [ebp - 0x34]
sub ax, 1
mov word [ebp - 0x34], ax
movsx eax, word [ebp - 0x10]
movsx ecx, word [ebp - 0x34]
cmp eax, ecx
jg 0x1002f97e
xor eax, eax
mov word [ebp - 0x1c], ax
movsx eax, word [ebp - 0x10]
push eax
lea ecx, [ebp - 0xa44]
call fcn.1000b3cf
movsx eax, byte [eax]
cmp eax, 0x5f
jne 0x1002f817
movsx eax, word [ebp - 0xe0]
movsx ecx, word [ebp - 0x1c]
cmp eax, ecx
jge 0x1002f7ff
mov ax, word [ebp - 0x1c]
mov word [ebp - 0xe0], ax
movsx eax, word [ebp - 0xe0]
mov dword [ebp - 0x9fc], eax
jmp 0x1002f806
and dword [ebp - 0x9fc], 0
mov ax, word [ebp - 0x10]
add ax, 1
mov word [ebp - 0x10], ax
jmp 0x1002f979
movsx eax, word [ebp - 0x10]
push eax
lea ecx, [ebp - 0xa44]
call fcn.1000b3cf
movsx eax, byte [eax]
cmp eax, 0x28
jne 0x1002f8f3
mov ax, word [ebp - 0x10]
add ax, 1
mov word [ebp - 0x10], ax
movsx eax, word [ebp - 0x10]
push eax
lea ecx, [ebp - 0xa44]
call fcn.1000b3cf
movsx eax, byte [eax]
cmp eax, 0x29
je 0x1002f8e2
movsx eax, word [ebp - 0x10]
push eax
lea ecx, [ebp - 0xa44]
call fcn.1000b3cf
movsx eax, byte [eax]
cmp eax, 0x5f
je 0x1002f8d1
movsx eax, word [ebp - 0x10]
push eax
lea ecx, [ebp - 0xa44]
call fcn.1000b3cf
movsx eax, byte [eax]
cmp eax, 0x5f
je 0x1002f8bd
movsx eax, word [ebp - 0x10]
push eax
lea ecx, [ebp - 0xa44]
call fcn.1000b3cf
movsx eax, byte [eax]
cmp eax, 0x29
je 0x1002f8bd
movsx eax, word [ebp - 0x10]
movsx ecx, word [ebp - 0x34]
cmp eax, ecx
jg 0x1002f8bd
mov ax, word [ebp - 0x10]
add ax, 1
mov word [ebp - 0x10], ax
jmp 0x1002f873
mov ax, word [ebp - 0x344]
add ax, 1
mov word [ebp - 0x344], ax
jmp 0x1002f8dd
mov ax, word [ebp - 0x10]
add ax, 1
mov word [ebp - 0x10], ax
jmp 0x1002f83f
mov ax, word [ebp - 0x10]
add ax, 1
mov word [ebp - 0x10], ax
jmp 0x1002f979
movsx eax, word [ebp - 0x10]
push eax
lea ecx, [ebp - 0xa44]
call fcn.1000b3cf
movsx eax, byte [eax]
cmp eax, 0x5f
je 0x1002f949
movsx eax, word [ebp - 0x10]
push eax
lea ecx, [ebp - 0xa44]
call fcn.1000b3cf
movsx eax, byte [eax]
cmp eax, 0x28
je 0x1002f949
movsx eax, word [ebp - 0x10]
movsx ecx, word [ebp - 0x34]
cmp eax, ecx
jg 0x1002f949
mov ax, word [ebp - 0x1c]
add ax, 1
mov word [ebp - 0x1c], ax
mov ax, word [ebp - 0x10]
add ax, 1
mov word [ebp - 0x10], ax
jmp 0x1002f8f3
movsx eax, word [ebp - 0xe0]
movsx ecx, word [ebp - 0x1c]
cmp eax, ecx
jge 0x1002f972
mov ax, word [ebp - 0x1c]
mov word [ebp - 0xe0], ax
movsx eax, word [ebp - 0xe0]
mov dword [ebp - 0x880], eax
jmp 0x1002f979
and dword [ebp - 0x880], 0
jmp 0x1002f7a8
push fcn.1000d301
push dword [ebp - 0x344]
push dword [ebp - 0xe0]
mov ecx, 0x10663bb8
call fcn.10040a38
mov dl, 0x20
mov ecx, eax
call fcn.1004187b
mov ecx, eax
call fcn.10040a38
mov ecx, eax
call fcn.100099cf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa44]
call fcn.100097ec
mov dword [ebp - 0x2f4], 0xae28de6
mov dword [ebp - 0x8f0], 0xd52a42bb
mov dword [ebp - 0x888], 0
mov dword [ebp - 0x80], 0
jmp 0x1002f9ed
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x1002fa03
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x4f8], 0x82ca9683
jmp 0x1002f9e6
mov dword [ebp - 0x80], 0
jmp 0x1002fa13
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x1002fa29
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0xbbc], 0xed9
jmp 0x1002fa0c
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x10c], eax
jl 0x1002fa43
mov dword [ebp - 0x4e0], 1
jmp 0x1002fa4a
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x640]
mov dword [ebp - 0xc94], eax
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x770], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x770]
mov dword [ebp + eax - 0x4f8], ecx
mov eax, dword [ebp - 0x770]
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0xffffffff
jl 0x1002fa96
mov dword [ebp - 0x4d8], 1
jmp 0x1002fa9d
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x4d8]
add eax, 5
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xbbc]
jg 0x1002fac1
mov dword [ebp - 0x638], 1
jmp 0x1002fac8
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x638]
jge 0x1002fae2
mov dword [ebp - 0x6e8], 1
jmp 0x1002fae9
and dword [ebp - 0x6e8], 0
mov eax, dword [ebp - 0x4e0]
cmp eax, dword [ebp - 0x6e8]
jne 0x1002fb0c
mov eax, 0xe136dc99
test eax, eax
je 0x1002fb0c
mov dword [ebp - 0x4e8], 1
jmp 0x1002fb13
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x4e8]
cmp eax, dword [ebp - 0x10c]
jg 0x1002fb33
mov dword [ebp - 0x4f0], 1
jmp 0x1002fb3a
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x640]
imul eax, dword [ebp - 0x4f0]
test eax, eax
je 0x1002fb54
cmp dword [ebp - 0x2f4], 0
jne 0x1002fb66
cmp dword [ebp - 0x8f0], 0
jne 0x1002fb66
and dword [ebp - 0x748], 0
jmp 0x1002fb70
mov dword [ebp - 0x748], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x748]
sub ecx, dword [ebp + eax - 0xbbc]
jne 0x1002fb92
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbbc]
mov dword [ebp - 0x888], eax
mov dword [ebp - 0x38], 0xc755
mov dword [ebp - 0x13c], 0xffffffff
mov dword [ebp - 0x890], 0xffff
mov dword [ebp - 0x914], 1
mov dword [ebp - 0xd64], 0
push 1
lea ecx, [ebp - 0xcb0]
call fcn.10009afa
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x24], 0
jmp 0x1002fbf8
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1002fc0e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x7f8], 0
jmp 0x1002fbf1
mov dword [ebp - 0x24], 0
jmp 0x1002fc1e
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1002fc34
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xda8], 1
jmp 0x1002fc17
mov dword [ebp - 0x24], 0
jmp 0x1002fc44
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1002fc60
push dword [ebp - 0x24]
lea ecx, [ebp - 0xcb0]
call fcn.10009b6a
mov dword [eax], 0xca7cee7e
jmp 0x1002fc3d
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
je 0x1002fc74
mov dword [ebp - 0x648], 1
jmp 0x1002fc7b
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x648]
je 0x1002fcce
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x38], eax
jle 0x1002fca0
cmp dword [ebp - 0x38], 0
jne 0x1002fca0
and dword [ebp - 0x500], 0
jmp 0x1002fcaa
mov dword [ebp - 0x500], 1
imul eax, dword [ebp - 0x500], 0x505b
cmp dword [ebp - 0x38], eax
jne 0x1002fcce
mov eax, 0xbffb
test eax, eax
je 0x1002fcce
mov dword [ebp - 0x6f0], 1
jmp 0x1002fcd5
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x6f0], eax
jne 0x1002fcef
mov dword [ebp - 0x324], 1
jmp 0x1002fcf6
and dword [ebp - 0x324], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x324]
mov dword [ebp + eax - 0x7f8], ecx
cmp dword [ebp - 0x324], 0
je 0x1002fe52
mov dword [ebp - 0x8f4], 0xe263
mov dword [ebp - 0x2fc], 0xffffffff
mov dword [ebp - 0x650], 0x4489
mov dword [ebp - 0x8fc], 0xc5c3c3ae
mov eax, dword [ebp - 0x2fc]
sub eax, 0x456574b6
jne 0x1002fd94
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7f8], 0x3bbb66ef
jge 0x1002fd6a
mov dword [ebp - 0x508], 1
jmp 0x1002fd71
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x650], eax
mov eax, dword [ebp - 0x13c]
imul eax, dword [ebp - 0x650]
test eax, eax
jne 0x1002fd94
cmp dword [ebp - 0x38], 0
je 0x1002fda9
cmp dword [ebp - 0x13c], 0
je 0x1002fda9
mov dword [ebp - 0x510], 1
jmp 0x1002fdb0
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x2fc]
cmp dword [ebp - 0x510], eax
jle 0x1002fdca
mov dword [ebp - 0x798], 1
jmp 0x1002fdd1
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x8f4]
sub eax, dword [ebp - 0x798]
cmp eax, dword [ebp - 0x2fc]
je 0x1002fdf1
mov dword [ebp - 0x1d4], 0
mov dword [ebp - 0xca4], 0xb742d63d
mov dword [ebp - 0x6f8], 0xfffffffe
push 2
lea ecx, [ebp - 0xca0]
call fcn.10009afa
mov byte [ebp - 4], 0x18
push 1
lea ecx, [ebp - 0xbc8]
call fcn.10009afa
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x2ac], 1
mov dword [ebp - 0x904], 0x20822c3
push 0
push 0
lea eax, [ebp - 0xca0]
push eax
push 1
lea eax, [ebp - 0x178]
push eax
push 0x197e
push 0xd5
call fcn.1002599c
add esp, 0x1c
mov dword [ebp - 0x178], 0
jmp 0x1002fee5
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 1
jge 0x1002ff07
push dword [ebp - 0x178]
lea ecx, [ebp - 0xbc8]
call fcn.10009b6a
mov dword [eax], 0x277f
jmp 0x1002fed8
mov dword [ebp - 0x38], 0
jmp 0x1002ff17
cmp dword [ebp - 0x38], 0x21
je 0x1003016d
mov dword [ebp - 0x164], 0xa1c1
mov dword [ebp - 0x54c], 0x7cbae8b0
mov dword [ebp - 0x56c], 1
mov dword [ebp - 0x938], 0x6a191a83
mov dword [ebp - 0x54], 0
jmp 0x10031a74
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x10031a8a
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xab8], 0x8cae2fe8
jmp 0x10031a6d
mov dword [ebp - 0x54], 0
jmp 0x10031a9a
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x10031ab0
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xcd0], 0xffffffff
jmp 0x10031a93
xor eax, eax
inc eax
je 0x10031b87
mov eax, dword [ebp - 0x164]
xor ecx, ecx
sub ecx, dword [ebp - 0x164]
sub eax, ecx
je 0x10031ae7
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xab8], 0
je 0x10031ae7
mov dword [ebp - 0x52c], 1
jmp 0x10031aee
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x164]
cmp eax, dword [ebp - 0x52c]
jne 0x10031b08
mov dword [ebp - 0x534], 1
jmp 0x10031b0f
and dword [ebp - 0x534], 0
cmp dword [ebp - 0x534], 0x986d
je 0x10031b27
mov dword [ebp - 0x53c], 1
jmp 0x10031b2e
and dword [ebp - 0x53c], 0
cmp dword [ebp - 0x53c], 1
je 0x10031b50
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xab8], 0
jne 0x10031b50
and dword [ebp - 0x544], 0
jmp 0x10031b5a
mov dword [ebp - 0x544], 1
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0x54c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xab8]
cmp dword [ebp - 0x54c], eax
jge 0x10031b87
mov dword [ebp - 0x554], 1
jmp 0x10031b8e
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x164]
cmp dword [ebp - 0x554], eax
je 0x10031ba8
mov dword [ebp - 0x55c], 1
jmp 0x10031baf
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x55c]
neg eax
cmp eax, dword [ebp - 0x164]
jg 0x10031bcb
mov dword [ebp - 0x564], 1
jmp 0x10031bd2
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x56c], eax
mov eax, dword [ebp - 0x56c]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0xab8]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xcd0]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0xcd0]
jg 0x10031c1b
mov dword [ebp - 0x574], 1
jmp 0x10031c22
and dword [ebp - 0x574], 0
cmp dword [ebp - 0x574], 0xf3004570
jae 0x10031c3a
mov dword [ebp - 0x57c], 1
jmp 0x10031c41
and dword [ebp - 0x57c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xab8]
cmp dword [ebp - 0x57c], eax
jle 0x10031c62
mov dword [ebp - 0x584], 1
jmp 0x10031c69
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x938], eax
mov byte [ebp - 0xe1], 0
push 1
push 0x46a0
push 0x76b3
push 0x4631
push 1
lea eax, [ebp - 0xe1]
push eax
push 0x5c6a
call fcn.100258a1
add esp, 0x1c
mov eax, dword [ebp - 0x22c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x22c]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x6c], eax
and dword [ebp - 0x2e0], 0
jmp 0x10031cdd
mov eax, dword [ebp - 0x22c]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x2e0], eax
jge 0x100332e8
mov dword [ebp - 0x16c], 0xffffffff
mov dword [ebp - 0x5c], 0
jmp 0x10031d0f
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x10031d25
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xd9c], 0xf75d
jmp 0x10031d08
mov dword [ebp - 0x5c], 0
jmp 0x10031d35
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x10031d4b
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x234], 0
jmp 0x10031d2e
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x234], 0
jmp 0x10031d79
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x234]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x234], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x234], 2
jg 0x10031db5
mov byte [ebp - 0xfe], 0
movzx eax, byte [ebp - 0xfe]
test eax, eax
je 0x10031db3
push 1
push 0
push 0
push 0xcbf
push 0x561e
call fcn.10027f77
add esp, 0x14
jmp 0x10031d5e
mov dword [ebp - 0x16c], 0
jmp 0x10031dce
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 3
jge 0x10031dea
mov eax, dword [ebp - 0x16c]
mov dword [ebp + eax*4 - 0xd9c], 0xfff8
jmp 0x10031dc1
mov dword [ebp - 0xa10], 3
mov dword [ebp - 0x940], 0xfffffffb
mov dword [ebp - 0x9c0], 0x5cf1c946
mov dword [ebp - 0xc10], 0xffffffff
push 0
push 0x3caf
push 0x3bc6
lea eax, [ebp - 0xa10]
push eax
lea eax, [ebp - 0x940]
push eax
lea eax, [ebp - 0x9c0]
push eax
push 1
push 0
call fcn.10027104
add esp, 0x20
mov dword [ebp - 0x3c], 3
push 4
lea ecx, [ebp - 0x2a4]
call fcn.10009afa
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x5c4], 0xfffffff6
mov dword [ebp - 0x28], 0
jmp 0x10031e74
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10031e8d
push dword [ebp - 0x28]
lea ecx, [ebp - 0x2a4]
call fcn.10009b6a
or dword [eax], 0xffffffff
jmp 0x10031e6d
mov dword [ebp - 0x28], 0
jmp 0x10031e9d
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10031eb3
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x808], 0
jmp 0x10031e96
mov dword [ebp - 0x28], 0
jmp 0x10031ec3
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10031ed9
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xd4c], 0
jmp 0x10031ebc
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x808], 3
jmp 0x10031f04
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x808]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x808], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x808], 0
jl 0x10032301
mov dword [ebp - 0xf0], 0x25260
mov dword [ebp - 0x948], 0
mov dword [ebp - 0x64], 0
jmp 0x10031f3b
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x10031f51
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x604], 0x694486ca
jmp 0x10031f34
mov dword [ebp - 0x64], 0
jmp 0x10031f61
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 4
jge 0x10031f77
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xe00], 1
jmp 0x10031f5a
mov dword [ebp - 0xf0], 3
jmp 0x10031f90
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
jl 0x10032160
mov dword [ebp - 0x98], 0xffffffff
mov dword [ebp - 0x5a4], 0xfbebf0a0
mov dword [ebp - 0x98], 3
jmp 0x10031fca
cmp dword [ebp - 0x98], 0
jl 0x1003215b
mov dword [ebp - 0x9f4], 9
push dword [ebp - 0x98]
lea ecx, [ebp - 0x2a4]
call fcn.10009b6a
push 2
lea ecx, [ebp - 0x2a4]
call fcn.10009b6a
cmp dword [eax], 0
jne 0x10032063
cmp dword [ebp - 0xf0], 0x2d564c7b
jne 0x1003201c
mov dword [ebp - 0x59c], 1
cmp dword [ebp - 0x59c], 0x5ea6
jl 0x10032139
jmp 0x10031f83
mov dword [ebp - 0x5c4], 0xfffffff7
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x808]
lea ecx, [ebp - 0x2a4]
call fcn.10009b6a
cmp dword [eax], 0
je 0x100322ba
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x808]
lea ecx, [ebp - 0x2a4]
call fcn.10009b6a
mov eax, dword [eax]
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
push 3
lea ecx, [ebp - 0x2a4]
call fcn.10009b6a
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x808]
cmp dword [eax], ecx
jne 0x100321da
mov dword [ebp - 0x5cc], 1
jmp 0x100321e1
and dword [ebp - 0x5cc], 0
cmp dword [ebp - 0x5cc], 0xcb6e
je 0x100321f9
mov dword [ebp - 0x5d4], 1
jmp 0x10032200
and dword [ebp - 0x5d4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xd4c]
cmp dword [ebp - 0x5d4], eax
je 0x10032220
and dword [ebp - 0x5f4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xe00]
cmp dword [ebp - 0x5f4], eax
jle 0x100322e2
mov dword [ebp - 0x5fc], 1
jmp 0x100322e9
and dword [ebp - 0x5fc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5fc]
mov dword [ebp + eax - 0x604], ecx
jmp 0x10031eeb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a4]
call fcn.10009b5c
mov dword [ebp - 0x244], 0x7e2799ac
mov dword [ebp - 0xc28], 0xe0cd1b7e
mov dword [ebp - 0xc2c], 0x374489b4
mov dword [ebp - 0xc30], 0xffffffff
mov dword [ebp - 0x23c], 0
jmp 0x10032351
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 2
jge 0x1003236d
mov eax, dword [ebp - 0x23c]
mov dword [ebp + eax*4 - 0xac0], 0xa162
jmp 0x10032344
mov dword [ebp - 0x244], 0
jmp 0x10032386
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 0x1a
je 0x100325e0
mov dword [ebp - 0x12c], 0x8b72fd49
mov dword [ebp - 0xcf0], 0xfffffffc
mov byte [ebp - 0x9e], 0
movzx eax, byte [ebp - 0x9e]
test eax, eax
je 0x100323cf
push 0x1ad
push 1
push 0
push 0x5320
call fcn.10026f52
add esp, 0x10
mov dword [ebp - 0x12c], 6
jmp 0x100323e8
cmp dword [ebp - 0x12c], 0xf
jge 0x100325db
mov dword [ebp - 0xf8], 9
mov dword [ebp - 0x24c], 0
jmp 0x10032418
cmp dword [ebp - 0x24c], 2
jge 0x10032434
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0xc24], 0x92c6eed1
jmp 0x1003240b
mov byte [ebp - 0xa0], 0
movzx eax, byte [ebp - 0xa0]
test eax, eax
je 0x10032468
jmp 0x10032379
mov dword [ebp - 0x254], 0x58b39d20
push 1
lea ecx, [ebp - 0x9ec]
call fcn.10009afa
mov dword [ebp - 4], 0x23
push 3
lea ecx, [ebp - 0x9dc]
call fcn.10009afa
mov byte [ebp - 4], 0x24
push 1
lea ecx, [ebp - 0x830]
call fcn.10009afa
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x684], 0
mov dword [ebp - 0x308], 0x31b54653
mov dword [ebp - 0x6fc], 0xffffffff
mov dword [ebp - 0xcf8], 0x6d0a
mov dword [ebp - 0x174], 0x7fb90efd
mov dword [ebp - 0x18], 0
jmp 0x10032662
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10032678
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7e0], 2
jmp 0x1003265b
push 1
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x9ec]
push eax
call fcn.10028756
add esp, 0x10
lea eax, [ebp - 0x18]
push eax
push 0x2ef8
lea eax, [ebp - 0x9dc]
push eax
push 1
push 0
call fcn.10027e96
add esp, 0x14
mov dword [ebp - 0x18], 0
jmp 0x100326bb
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x100326d7
push dword [ebp - 0x18]
lea ecx, [ebp - 0x830]
call fcn.10009b6a
mov dword [eax], 0xfffffff9
jmp 0x100326b4
mov dword [ebp - 0x18], 0
jmp 0x100326e7
cmp dword [ebp - 0x18], 2
jge 0x100326fd
jmp 0x10033308
mov eax, dword [ebp + 8]
mov dword [ebp - 0x884], eax
push 0
push 0x602e
push dword [ebp - 0x884]
call fcn.10038174
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret