Function at 0x1001f61b
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100730f2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xae4
push esi
push edi
and dword [ebp - 0x18], 0
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10024782
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x24c], 0
jmp 0x1001f671
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 1
jge 0x1001f68d
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0x990], 0xfffffff9
jmp 0x1001f664
mov dword [ebp - 0x70], 0
jmp 0x1001f69d
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jl 0x1001f6ad
push 0
call fcn.1001ea4e
pop ecx
jmp 0x1001f696
mov dword [ebp - 0x70], 0
jmp 0x1001f6bd
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jg 0x1001f6dc
mov byte [ebp - 0x92], 0
push 0
lea eax, [ebp - 0x92]
push eax
call fcn.1001ea10
pop ecx
pop ecx
jmp 0x1001f6b6
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x118], 0xffffffff
mov dword [ebp - 0x118], 9
jmp 0x1001f708
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 1
jne 0x1001f749
mov dword [ebp - 0x748], 0xc69a
mov byte [ebp - 0xd6], 0
movzx eax, byte [ebp - 0xd6]
test eax, eax
je 0x1001f73b
push 0x6aa7
push 0
call fcn.1001e625
pop ecx
pop ecx
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x748], eax
jmp 0x1001f6fb
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x1001f763
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov eax, dword [ebp - 0x334]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1001f778
jmp 0x1002479b
mov eax, dword [ebp - 0x334]
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xa0], ecx
mov eax, dword [ebp - 0xa0]
cmp dword [eax], 0x4550
je 0x1001f79d
jmp 0x1002479b
mov dword [ebp - 0x120], 0x9b55bb2c
mov dword [ebp - 0x120], 0x13
jmp 0x1001f7c0
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xffffffe9
je 0x1001f829
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x250], 0xfffffff7
jmp 0x1001f7ec
mov eax, dword [ebp - 0x250]
dec eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0xffffffed
jle 0x1001f827
mov dword [ebp - 0x650], 0xf7a73d2d
push 0x1da9
push 1
lea eax, [ebp - 0x650]
push eax
push 0x7e96
call fcn.1001dc57
add esp, 0x10
cmp dword [ebp - 0x120], 0
je 0x1001f825
jmp 0x1001f7df
jmp 0x1001f7df
jmp 0x1001f7b3
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa0]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x90], 1
mov dword [ebp - 0x56c], 0
mov dword [ebp - 0x1d0], 0
jmp 0x1001f869
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 3
jge 0x1001f885
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0x804], 0x7fd5
jmp 0x1001f85c
mov dword [ebp - 0x90], 2
jmp 0x1001f89e
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x1001f98c
mov eax, dword [ebp - 0x90]
cmp dword [ebp + eax*4 - 0x804], 0
je 0x1001f8e5
mov byte [ebp - 0x86], 0
movzx eax, byte [ebp - 0x86]
test eax, eax
je 0x1001f8e0
push 1
push 0
push 0x4d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
jmp 0x1001f987
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp + eax*4 - 0x804]
mov ecx, dword [ebp - 0x90]
sub eax, dword [ebp + ecx*4 - 0x804]
je 0x1001f92d
mov byte [ebp - 0x88], 0
push 0x6d4
push 0
lea eax, [ebp - 0x88]
push eax
push 0x2e40
call fcn.1001e17e
add esp, 0x10
push 0
call fcn.1001dfa9
pop ecx
jmp 0x1001f987
mov dword [ebp - 0x124], 0xcf09cc25
mov dword [ebp - 0x124], 2
jmp 0x1001f950
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jl 0x1001f97c
push 0x5455
push 0
lea eax, [ebp - 0x56c]
push eax
call fcn.1001e248
add esp, 0xc
cmp dword [ebp - 0x56c], 0
je 0x1001f97a
jmp 0x1001f943
jmp 0x1001f943
cmp dword [ebp - 0x124], 0
je 0x1001f987
jmp 0x1001f98c
jmp 0x1001f891
mov eax, dword [ebp - 0x34]
cmp dword [eax + 4], 0
jne 0x1001f99a
jmp 0x1002479b
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0xa0]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0xa0]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x69c], 0xa9d19ac1
mov dword [ebp - 0x6a4], 0x83bc1b0f
mov dword [ebp - 0x29c], 0xd0127420
push 1
lea ecx, [ebp - 0x768]
call fcn.10024d89
and dword [ebp - 4], 0
mov dword [ebp - 0x590], 2
mov dword [ebp - 0xe0], 0
push 1
lea ecx, [ebp - 0x81c]
call fcn.10024d89
mov byte [ebp - 4], 1
push 0
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x768]
push eax
push 0x20ce
push 0xe44
call fcn.1001f1a0
add esp, 0x14
push 0x4e9c
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x81c]
push eax
push 0x6c7
push 0
call fcn.1001e0f5
add esp, 0x14
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x81c]
push eax
push 0x27ae
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x768]
push eax
lea eax, [ebp - 0x590]
push eax
push 0
lea eax, [ebp - 0x6a4]
push eax
call fcn.1001edcf
add esp, 0x24
mov dword [ebp - 0xe0], 0x1b
jmp 0x1001faa9
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0xfffffff1
je 0x1001fc42
mov dword [ebp - 0x218], 0x7e8f8848
mov dword [ebp - 0x110], 0x7dbc1552
mov dword [ebp - 0x5a0], 0xd45ab60a
mov dword [ebp - 0x564], 0xa6c9c6c2
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jne 0x1001fbe3
mov eax, dword [ebp - 0x110]
xor ecx, ecx
sub ecx, dword [ebp - 0x590]
add ecx, 0x7f794fc7
add eax, ecx
cmp eax, 0x7e7f6f8
je 0x1001fb20
mov dword [ebp - 0x598], 1
jmp 0x1001fb27
and dword [ebp - 0x598], 0
imul eax, dword [ebp - 0x598], 0xffffffff
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
add eax, dword [ebp - 0x218]
mov dword [ebp - 0x5a0], eax
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x29c], eax
je 0x1001fb6c
mov dword [ebp - 0x2c4], 1
jmp 0x1001fb73
and dword [ebp - 0x2c4], 0
push 0
lea ecx, [ebp - 0x768]
call fcn.10024e10
mov ecx, dword [ebp - 0x2c4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x218]
cmp dword [ebp - 0x2c4], eax
je 0x1001fba2
mov dword [ebp - 0x5a8], 1
jmp 0x1001fba9
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x5a8]
add eax, 4
cmp eax, 0xbb2d3f57
jb 0x1001fbc5
mov dword [ebp - 0x5c0], 1
jmp 0x1001fbcc
and dword [ebp - 0x5c0], 0
imul eax, dword [ebp - 0x5c0], 7
cmp eax, 0x79a9257d
jge 0x1001fbe3
and dword [ebp - 0x5c8], 0
jmp 0x1001fbed
mov dword [ebp - 0x5c8], 1
mov eax, dword [ebp - 0xe0]
imul eax, dword [ebp - 0x5c8]
cmp eax, dword [ebp - 0x564]
jle 0x1001fc0e
mov dword [ebp - 0x5bc], 1
jmp 0x1001fc15
and dword [ebp - 0x5bc], 0
cmp dword [ebp - 0x5bc], 0
je 0x1001fc2a
mov dword [ebp - 0x478], 1
jmp 0x1001fc31
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x564], eax
jmp 0x1001fa9c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x81c]
call fcn.10024e0b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x768]
call fcn.10024e0b
and dword [ebp - 0x2f0], 0
jmp 0x1001fc85
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0xe4]
add eax, 0x28
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xa0]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x2f0], eax
jge 0x1001fd10
mov eax, dword [ebp - 0xe4]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x318]
jb 0x1001fd0b
mov eax, dword [ebp - 0xa0]
push dword [eax + 0x38]
mov eax, dword [ebp - 0xe4]
push dword [eax + 8]
call fcn.1001db68
pop ecx
pop ecx
add eax, dword [ebp - 0x318]
mov dword [ebp - 0x6ac], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x6ac]
jae 0x1001fd0b
push 0x128c
push 0x40b7
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 0xe4]
push eax
push 0x16fa
call fcn.1001e7ef
add esp, 0x18
jmp 0x1001fd10
jmp 0x1001fc69
mov dword [ebp - 0x8a4], 0x70ad
push 0x1dc1
push 1
call fcn.1001dcca
pop ecx
pop ecx
mov byte [ebp - 0x8a], 0
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x1001fd4e
push 0x296d
push 0
push 0x3ec1
call fcn.1001de6f
add esp, 0xc
cmp dword [ebp - 0x24], 0
jne 0x1001fd59
jmp 0x1002479b
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x24]
add ecx, dword [eax]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x98], 0xb110c93b
mov dword [ebp - 0x6c4], 4
mov dword [ebp - 0x6cc], 0x49562184
mov dword [ebp - 0x1d8], 0
jmp 0x1001fd9e
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 3
jge 0x1001fdba
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0x7f8], 0xfffffffe
jmp 0x1001fd91
mov dword [ebp - 0x98], 8
jmp 0x1001fdd3
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xb
jle 0x10020238
mov dword [ebp - 0xe8], 0
push 1
lea ecx, [ebp - 0x600]
call fcn.10024d89
mov dword [ebp - 4], 2
mov dword [ebp - 0x530], 0x90ae73
mov dword [ebp - 0x340], 0xffffffff
lea eax, [ebp - 0x8e8]
push eax
push 1
lea eax, [ebp - 0x600]
push eax
call fcn.1001dd26
add esp, 0xc
mov dword [ebp - 0xe8], 0
jmp 0x1001fe43
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0xe
jne 0x10020224
mov dword [ebp - 0x60], 0
jmp 0x1001fe60
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x1001fe73
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x50], 0x9609c3fb
jmp 0x1001fe59
mov dword [ebp - 0x60], 0
jmp 0x1001fe83
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x1001fe99
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x78c], 0xb56095db
jmp 0x1001fe7c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x50], 0
jmp 0x1001febe
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x50], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 0xfffffffa
jle 0x10020203
mov dword [ebp - 0x80], 0xadf1adb2
mov dword [ebp - 0x338], 0xfffffffc
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x980], eax
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x584], eax
push 0
lea ecx, [ebp - 0x600]
call fcn.10024e10
mov ecx, dword [ebp - 0x584]
mov dword [eax], ecx
cmp dword [ebp - 0x584], 0
jne 0x1001ffb0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x8d4], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x960], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x98]
cmp dword [ebp + eax - 0x50], ecx
jne 0x1001ff4a
mov dword [ebp - 0x320], 1
jmp 0x1001ff51
and dword [ebp - 0x320], 0
push 0
lea ecx, [ebp - 0x600]
call fcn.10024e10
mov eax, dword [eax]
cmp eax, dword [ebp - 0x320]
jl 0x1001ff7d
mov eax, 0xe707
test eax, eax
je 0x1001ff7d
mov dword [ebp - 0x2d0], 1
jmp 0x1001ff84
and dword [ebp - 0x2d0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2d0]
mov dword [ebp + eax - 0x7f8], ecx
mov eax, dword [ebp - 0x98]
imul eax, dword [ebp - 0x2d0]
test eax, eax
jne 0x1001ffb0
and dword [ebp - 0x480], 0
jmp 0x1001ffba
mov dword [ebp - 0x480], 1
cmp dword [ebp - 0x480], 0x4886
jl 0x1001ffd2
mov dword [ebp - 0x328], 1
jmp 0x1001ffd9
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0x530]
cmp dword [ebp - 0x80], eax
jg 0x1001fffc
mov dword [ebp - 0x330], 1
jmp 0x10020003
and dword [ebp - 0x330], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x330]
sub ecx, dword [ebp + eax - 0x50]
imul ecx, dword [ebp - 0xe8]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x78c], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 0
je 0x1002016f
mov eax, 0xe158
test eax, eax
je 0x10020053
cmp dword [ebp - 0x80], 0
je 0x10020053
mov dword [ebp - 0x488], 1
jmp 0x1002005a
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 0xa0b2b040
jne 0x1002007e
mov dword [ebp - 0x6b4], 1
jmp 0x10020085
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x8dc], eax
mov eax, dword [ebp - 0x340]
add eax, 3
jne 0x100200b1
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x7f8], 0
jne 0x100200b1
and dword [ebp - 0x5cc], 0
jmp 0x100200bb
mov dword [ebp - 0x5cc], 1
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x5cc], eax
jge 0x100200d2
mov dword [ebp - 0x490], 1
jmp 0x100200d9
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x340]
sub eax, dword [ebp - 0x490]
cmp eax, dword [ebp - 0x80]
jle 0x100200f6
mov dword [ebp - 0x348], 1
jmp 0x100200fd
and dword [ebp - 0x348], 0
push 0
lea ecx, [ebp - 0x600]
call fcn.10024e10
mov ecx, dword [ebp - 0x348]
cmp ecx, dword [eax]
jle 0x10020120
mov dword [ebp - 0x6bc], 1
jmp 0x10020127
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x9a0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
cmp dword [ebp - 0x6c4], eax
jne 0x1002014e
mov dword [ebp - 0x538], 1
jmp 0x10020155
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x6cc]
cmp dword [ebp - 0x538], eax
jge 0x1002016f
mov dword [ebp - 0x350], 1
jmp 0x10020176
and dword [ebp - 0x350], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
cmp dword [ebp - 0x350], eax
jge 0x10020194
mov dword [ebp - 0x498], 1
jmp 0x1002019b
and dword [ebp - 0x498], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x78c]
cmp dword [ebp - 0x498], eax
jge 0x100201bc
mov dword [ebp - 0x358], 1
jmp 0x100201c3
and dword [ebp - 0x358], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x78c]
cmp eax, dword [ebp - 0x358]
jne 0x100201e4
mov dword [ebp - 0x58c], 1
jmp 0x100201eb
and dword [ebp - 0x58c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x58c]
mov dword [ebp + eax - 0x7f8], ecx
jmp 0x1001fea9
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x78c]
push 0
lea ecx, [ebp - 0x600]
call fcn.10024e10
mov dword [eax], esi
jmp 0x1001fe36
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x600]
call fcn.10024e0b
jmp 0x1001fdc6
xor ecx, ecx
call fcn.1000902a
push eax
call fcn.1005b10c
pop ecx
and dword [ebp - 0x7c4], 0
and dword [ebp - 0x7c0], 0
and dword [ebp - 0x7bc], 0
and dword [ebp - 0x7b8], 0
lea ecx, [ebp - 0x2b9]
call fcn.10009032
push eax
lea eax, [ebp - 0x7b4]
push eax
lea eax, [ebp - 0x7c4]
push eax
lea ecx, [ebp - 0xa40]
call fcn.10024e1f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9b0]
call fcn.10024de5
mov dword [ebp - 4], 3
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x220], 0
jmp 0x100202c1
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 3
jg 0x1002031c
push 3
lea ecx, [ebp - 0x834]
call fcn.10024d89
mov byte [ebp - 4], 4
push 0x5e62
push 1
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x8e4]
push eax
call fcn.1001ddad
add esp, 0x10
push 0
lea ecx, [ebp - 0x834]
call fcn.10024e10
mov dword [eax], 0x4a2a4f40
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x834]
call fcn.10024e0b
jmp 0x100202b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9b0]
call fcn.10024e0b
mov dword [ebp - 0x74], 6
mov dword [ebp - 0x74], 2
jmp 0x10020342
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x14
jge 0x100204c8
mov dword [ebp - 0x228], 0xfda0e60f
push 1
lea ecx, [ebp - 0x8a0]
call fcn.10024d89
mov dword [ebp - 4], 5
mov dword [ebp - 0x6d4], 0xffffffff
mov dword [ebp - 0x1e0], 0
jmp 0x1002038d
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 1
jge 0x100203ac
push dword [ebp - 0x1e0]
lea ecx, [ebp - 0x8a0]
call fcn.10024e10
and dword [eax], 0
jmp 0x10020380
mov dword [ebp - 0x228], 0xffffffef
jmp 0x100203c5
mov eax, dword [ebp - 0x228]
dec eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0xffffffe7
jg 0x100204b4
mov dword [ebp - 0x164], 0x10e164ca
mov dword [ebp - 0x968], 1
mov dword [ebp - 0x164], 0
jmp 0x100203ff
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0
jg 0x100204af
mov dword [ebp - 0x360], 1
mov byte [ebp - 0x87], 0
movzx eax, byte [ebp - 0x87]
test eax, eax
je 0x10020441
push 0
push 0x139
push 0x239e
push 0x3648
call fcn.1001e44f
add esp, 0x10
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0
je 0x10020487
mov dword [ebp - 0x8ec], 0xffffffff
mov dword [ebp - 0x988], 1
push 0x530c
push 0
lea eax, [ebp - 0x6d4]
push eax
push 0x1c62
call fcn.1001e99a
add esp, 0x10
jmp 0x100204aa
push 0x785c
push 0
push 0xe86
push 0x6858
push 0x3cf4
push 0x33c8
call fcn.1001f26c
add esp, 0x18
jmp 0x100203f2
jmp 0x100203b8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8a0]
call fcn.10024e0b
jmp 0x1002033b
mov dword [ebp - 0x74], 0
jmp 0x100204d8
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x14
jle 0x10020505
mov dword [ebp - 0x6dc], 0xc9ca
push 0
lea eax, [ebp - 0x6dc]
push eax
push 0x40e6
push 0x105f
call fcn.1001df35
add esp, 0x10
jmp 0x100204d1
mov byte [ebp - 0x194], 5
mov byte [ebp - 0x193], 0x20
mov byte [ebp - 0x192], 1
mov byte [ebp - 0x191], 4
mov byte [ebp - 0x190], 9
mov byte [ebp - 0x18f], 5
mov byte [ebp - 0x18e], 0
mov byte [ebp - 0x18d], 1
mov byte [ebp - 0x18c], 6
mov byte [ebp - 0x18b], 0
mov byte [ebp - 0x18a], 4
mov byte [ebp - 0x189], 9
mov byte [ebp - 0x188], 5
mov byte [ebp - 0x187], 0xeb
mov byte [ebp - 0x186], 0x53
mov byte [ebp - 0x185], 0xd8
mov byte [ebp - 0x184], 0xee
mov byte [ebp - 0x183], 0xec
mov byte [ebp - 0x182], 3
mov byte [ebp - 0x181], 0xf
mov byte [ebp - 0x180], 7
mov byte [ebp - 0x17f], 1
mov byte [ebp - 0x17e], 2
mov byte [ebp - 0x17d], 1
mov byte [ebp - 0x17c], 8
mov byte [ebp - 0x17b], 7
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x194]
or eax, 0x11
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x194]
and ecx, 0x11
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x194]
mov byte [ebp + ecx - 0x5e8], al
mov dword [ebp - 0x2c], 2
and dword [ebp - 0x1e8], 0
jmp 0x1002060c
mov eax, dword [ebp - 0x2c]
inc eax
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x1a
jae 0x100206cb
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x194]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x2c], eax
jne 0x10020656
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x194]
inc eax
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x194]
mov ecx, dword [ebp - 0x2c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x2c], eax
jmp 0x10020604
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x193]
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x1e8]
movzx ecx, byte [ebp + ecx - 0x196]
movsx ecx, byte [ebp + ecx - 0x5e8]
or eax, ecx
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x193]
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x1e8]
movzx edx, byte [ebp + edx - 0x196]
movsx edx, byte [ebp + edx - 0x5e8]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x194]
mov byte [ebp + ecx - 0x5e8], al
push 0
lea eax, [ebp - 0x1e8]
push eax
call fcn.1001ecba
pop ecx
pop ecx
jmp 0x10020604
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x5e8], 0
mov dword [ebp - 0x2c8], 0xffff
mov dword [ebp - 0x7c], 0xfffffff6
mov dword [ebp - 0x740], 0xfffffffb
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x8fc], eax
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x2c8]
sub eax, dword [ebp - 0x7c]
jne 0x1002075d
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x970], eax
cmp dword [ebp - 0x7c], 0x4bcd
jl 0x10020732
mov dword [ebp - 0x4a0], 1
jmp 0x10020739
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a0]
add eax, 0x7d0fa516
cmp eax, 0x401d1b98
jle 0x1002075d
mov eax, 0x6eea5306
test eax, eax
jne 0x1002075d
and dword [ebp - 0x368], 0
jmp 0x10020767
mov dword [ebp - 0x368], 1
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x740], eax
mov dword [ebp - 0x7c], 0xfffffffa
jmp 0x10020783
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 7
je 0x10020836
mov dword [ebp - 0x7ec], 0xfffffff7
mov dword [ebp - 0x7e8], 0xfffffff7
mov dword [ebp - 0x7e4], 0xfffffff7
mov dword [ebp - 0x7e0], 0xfffffff7
lea ecx, [ebp - 0x2a9]
call fcn.10009032
push eax
lea eax, [ebp - 0x7dc]
push eax
lea eax, [ebp - 0x7ec]
push eax
lea ecx, [ebp - 0x9e8]
call fcn.10024e1f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x84c]
call fcn.10024de5
mov dword [ebp - 4], 6
push 1
push 0x28e5
call fcn.1001de2f
pop ecx
pop ecx
push 3
lea ecx, [ebp - 0x84c]
call fcn.10024e10
cmp dword [eax], 0
je 0x10020822
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84c]
call fcn.10024e0b
jmp 0x10020836
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84c]
call fcn.10024e0b
jmp 0x1002077c
lea eax, [ebp - 0x5e8]
push eax
lea ecx, [ebp - 0xaa8]
call fcn.10024c62
mov dword [ebp - 0x61c], eax
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0x73c], eax
mov dword [ebp - 4], 7
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x73c]
call fcn.10008fea
pop ecx
mov dword [ebp - 0x62c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaa8]
call fcn.10024cea
mov dword [ebp - 0x230], 0x2fe22364
mov dword [ebp - 0x90c], 0x417be18
mov dword [ebp - 0x998], 0x5e81a7ec
mov dword [ebp - 0x540], 0xc5d177cc
mov dword [ebp - 0x91c], 2
mov dword [ebp - 0x28], 0
jmp 0x100208c8
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x100208de
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x978], 1
jmp 0x100208c1
mov dword [ebp - 0x28], 0
jmp 0x100208ee
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10020904
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa48], 0xddcd1665
jmp 0x100208e7
mov dword [ebp - 0x28], 0
jmp 0x10020914
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1002092a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x92c], 0xa5f34bda
jmp 0x1002090d
mov dword [ebp - 0x230], 0
jmp 0x10020943
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0
jg 0x10020a2a
push 1
lea ecx, [ebp - 0x8c4]
call fcn.10024d89
mov dword [ebp - 4], 8
mov dword [ebp - 0x950], 0
mov dword [ebp - 0x93c], 7
mov dword [ebp - 0x854], 0x7cd95da2
push 4
lea ecx, [ebp - 0x8b0]
call fcn.10024d89
mov byte [ebp - 4], 9
lea eax, [ebp - 0x8c4]
push eax
push 1
lea eax, [ebp - 0x12c]
push eax
call fcn.1001de6f
add esp, 0xc
mov dword [ebp - 0x12c], 0
jmp 0x100209c4
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 4
jge 0x100209e6
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x8b0]
call fcn.10024e10
mov dword [eax], 1
jmp 0x100209b7
push 0xac1
push 1
push 0x5237
call fcn.1001dee2
add esp, 0xc
mov eax, dword [ebp - 0x540]
inc eax
mov dword [ebp - 0x540], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x8b0]
call fcn.10024e0b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c4]
call fcn.10024e0b
jmp 0x10020936
and dword [ebp - 0x1f0], 0
jmp 0x10020a40
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0xb
jae 0x10020a59
mov eax, dword [ebp - 0x1f0]
mov byte [ebp + eax - 0x5e8], 0
jmp 0x10020a33
push 1
lea ecx, [ebp - 0x298]
call fcn.10024d89
mov dword [ebp - 4], 0xa
push 4
lea ecx, [ebp - 0x810]
call fcn.10024d89
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x154], 0
jmp 0x10020a97
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 1
jge 0x10020ab9
push dword [ebp - 0x154]
lea ecx, [ebp - 0x298]
call fcn.10024e10
mov dword [eax], 0xfffffffb
jmp 0x10020a8a
push 1
push 0x247a
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x154]
push eax
call fcn.1001df35
add esp, 0x10
mov byte [ebp - 0xd8], 0
movzx eax, byte [ebp - 0xd8]
test eax, eax
je 0x10020af0
push 1
call fcn.1001dfa9
pop ecx
push 0
lea ecx, [ebp - 0x298]
call fcn.10024e10
push 0
lea ecx, [ebp - 0x298]
call fcn.10024e10
push 0
lea ecx, [ebp - 0x298]
call fcn.10024e10
mov esi, eax
push 0
lea ecx, [ebp - 0x298]
call fcn.10024e10
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x10020b38
mov dword [ebp - 0x6d0], 1
jmp 0x10020b3f
and dword [ebp - 0x6d0], 0
push 0
lea ecx, [ebp - 0x298]
call fcn.10024e10
push 0
lea ecx, [ebp - 0x298]
call fcn.10024e10
mov esi, eax
push 0
lea ecx, [ebp - 0x298]
call fcn.10024e10
mov edi, eax
push 0
lea ecx, [ebp - 0x298]
call fcn.10024e10
mov ecx, dword [edi]
imul ecx, dword [eax]
sub ecx, 0x1fdb
imul ecx, dword [esi]
test ecx, ecx
jne 0x10020ba4
push 0
lea ecx, [ebp - 0x298]
call fcn.10024e10
cmp dword [eax], 0
jne 0x10020ba4
and dword [ebp - 0x370], 0
jmp 0x10020bae
mov dword [ebp - 0x370], 1
push 0
lea ecx, [ebp - 0x298]
call fcn.10024e10
mov esi, dword [ebp - 0x370]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x298]
call fcn.10024e10
cmp esi, dword [eax]
je 0x10020be0
mov dword [ebp - 0x4a8], 1
jmp 0x10020be7
and dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x4a8], 0xc608
jg 0x10020bff
mov dword [ebp - 0x378], 1
jmp 0x10020c06
and dword [ebp - 0x378], 0
push 3
lea ecx, [ebp - 0x810]
call fcn.10024e10
mov ecx, dword [ebp - 0x378]
mov dword [eax], ecx
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x810]
call fcn.10024e0b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x298]
call fcn.10024e0b
mov byte [ebp - 0x28c], 4
mov byte [ebp - 0x28b], 0x8f
mov byte [ebp - 0x28a], 9
mov byte [ebp - 0x289], 4
mov byte [ebp - 0x288], 0
mov byte [ebp - 0x287], 1
mov byte [ebp - 0x286], 8
mov byte [ebp - 0x285], 1
mov byte [ebp - 0x284], 3
mov byte [ebp - 0x283], 2
mov byte [ebp - 0x282], 0x26
mov byte [ebp - 0x281], 0x54
mov byte [ebp - 0x280], 0xe2
mov byte [ebp - 0x27f], 0x22
mov byte [ebp - 0x27e], 0x12
mov byte [ebp - 0x27d], 0x96
mov byte [ebp - 0x27c], 0xa6
mov byte [ebp - 0x27b], 0xa7
mov byte [ebp - 0x27a], 0x3b
mov byte [ebp - 0x279], 0x6e
mov byte [ebp - 0x278], 0xb7
mov byte [ebp - 0x277], 0xfe
mov byte [ebp - 0x276], 0x9a
mov byte [ebp - 0x275], 0x26
mov byte [ebp - 0x274], 0x13
mov byte [ebp - 0x273], 0xdc
mov byte [ebp - 0x272], 0xbc
mov byte [ebp - 0x271], 0x41
mov byte [ebp - 0x270], 0xe9
mov byte [ebp - 0x26f], 0x3e
mov byte [ebp - 0x26e], 0xd1
mov byte [ebp - 0x26d], 0x28
mov byte [ebp - 0x26c], 0xef
mov byte [ebp - 0x26b], 2
mov byte [ebp - 0x26a], 0x84
mov byte [ebp - 0x269], 0x1e
mov byte [ebp - 0x268], 0xc5
mov byte [ebp - 0x267], 0x39
mov byte [ebp - 0x266], 0x86
mov byte [ebp - 0x265], 0x36
mov byte [ebp - 0x264], 0x74
mov byte [ebp - 0x263], 0x4d
mov byte [ebp - 0x262], 0xca
mov byte [ebp - 0x261], 0x37
mov byte [ebp - 0x260], 0x87
mov byte [ebp - 0x25f], 0x3e
mov byte [ebp - 0x25e], 0xb1
mov byte [ebp - 0x25d], 0x29
mov byte [ebp - 0x25c], 0x37
mov byte [ebp - 0x25b], 7
mov byte [ebp - 0x25a], 4
mov byte [ebp - 0x259], 6
mov byte [ebp - 0x258], 0xf
mov byte [ebp - 0x257], 2
mov byte [ebp - 0x256], 0xe
mov byte [ebp - 0x255], 5
mov byte [ebp - 0x254], 6
mov byte [ebp - 0x253], 1
mov byte [ebp - 0x252], 7
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x28c]
or eax, 0xbb
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x28c]
and ecx, 0xbb
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x28c]
mov byte [ebp + ecx - 0x5f4], al
mov dword [ebp - 0x30], 2
and dword [ebp - 0x238], 0
jmp 0x10020e2c
mov eax, dword [ebp - 0x30]
inc eax
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x3b
jae 0x10020f05
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x28c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x30], eax
jne 0x10020e76
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x28c]
inc eax
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x28c]
mov ecx, dword [ebp - 0x30]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x30], eax
jmp 0x10020e24
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x28b]
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x238]
movzx ecx, byte [ebp + ecx - 0x28e]
movsx ecx, byte [ebp + ecx - 0x5f4]
or eax, ecx
mov ecx, dword [ebp - 0x30]
movzx ecx, byte [ebp + ecx - 0x28b]
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x238]
movzx edx, byte [ebp + edx - 0x28e]
movsx edx, byte [ebp + edx - 0x5f4]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x30]
movzx ecx, byte [ebp + ecx - 0x28c]
mov byte [ebp + ecx - 0x5f4], al
lea eax, [ebp - 0x238]
push eax
push 1
push 0x7401
push 0x3e68
push 0x45b4
push 0x4940
push 0x41fa
call fcn.1001dff6
add esp, 0x1c
jmp 0x10020e24
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x5f4], 0
mov dword [ebp - 0x858], 0xffffffff
mov dword [ebp - 0x860], 0x1897a4a
push 3
lea ecx, [ebp - 0x8f8]
call fcn.10024d89
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x6c], 0
jmp 0x10020f4b
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x10020f67
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x8f8]
call fcn.10024e10
mov dword [eax], 0x2fd4914d
jmp 0x10020f44
mov dword [ebp - 0x6c], 0
jmp 0x10020f77
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x10020f8d
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x7a0], 0xffff
jmp 0x10020f70
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7a0]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x7a0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8f8]
call fcn.10024e0b
lea eax, [ebp - 0x5f4]
push eax
lea ecx, [ebp - 0xa60]
call fcn.10024c62
mov dword [ebp - 0x624], eax
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0x648], eax
mov dword [ebp - 4], 0xd
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x648]
call fcn.10008fea
pop ecx
mov dword [ebp - 0x658], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa60]
call fcn.10024cea
and dword [ebp - 0x240], 0
jmp 0x1002101d
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0xb
jae 0x10021036
mov eax, dword [ebp - 0x240]
mov byte [ebp + eax - 0x5f4], 0
jmp 0x10021010
push dword [ebp - 0x658]
push dword [ebp - 0x62c]
call fcn.1001b922
pop ecx
pop ecx
mov dword [ebp - 0x380], eax
push 3
lea ecx, [ebp - 0x6ec]
call fcn.10024d89
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x634], 0x4b733c63
mov dword [ebp - 0x65c], 8
push 1
lea ecx, [ebp - 0x908]
call fcn.10024d89
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x6ec]
push eax
push 0
push 0x3898
lea eax, [ebp - 0x134]
push eax
call fcn.1001f12a
add esp, 0x10
mov dword [ebp - 0x134], 0
jmp 0x100210be
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jge 0x100210e0
push dword [ebp - 0x134]
lea ecx, [ebp - 0x908]
call fcn.10024e10
mov dword [eax], 0xeaa29c14
jmp 0x100210b1
push 0
lea ecx, [ebp - 0x6ec]
call fcn.10024e10
mov dword [eax], 0x18
jmp 0x10021119
push 0
lea ecx, [ebp - 0x6ec]
call fcn.10024e10
mov dword [ebp - 0x5ac], eax
mov eax, dword [ebp - 0x5ac]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x5ac]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x6ec]
call fcn.10024e10
cmp dword [eax], 0x18
jl 0x1002114f
lea eax, [ebp - 0x65c]
push eax
push 0x48c4
push 0x1716
lea eax, [ebp - 0x634]
push eax
push 1
call fcn.1001e0f5
add esp, 0x14
jmp 0x100210f5
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x908]
call fcn.10024e0b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6ec]
call fcn.10024e0b
push 0x3f08
push 0x5e3b
push 0x5598
lea eax, [ebp - 0x380]
push eax
lea eax, [ebp - 0xa0]
push eax
push 0
call fcn.1001e676
add esp, 0x18
push 0xf
push 5
call fcn.1001b922
pop ecx
pop ecx
add eax, dword [ebp - 0x380]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], eax
mov dword [ebp - 0x7d8], 0x7dfa860b
mov dword [ebp - 0x7d4], 0x7dfa860b
mov dword [ebp - 0x7d0], 0x7dfa860b
mov dword [ebp - 0x7cc], 0x7dfa860b
lea ecx, [ebp - 0x2b1]
call fcn.10009032
push eax
lea eax, [ebp - 0x7c8]
push eax
lea eax, [ebp - 0x7d8]
push eax
lea ecx, [ebp - 0xa20]
call fcn.10024e1f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9e0]
call fcn.10024de5
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x13c], 0x37c1d6b3
mov dword [ebp - 0x4d0], 0xa30a4ccf
push 2
lea ecx, [ebp - 0x774]
call fcn.10024d89
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x174], 0
jmp 0x1002124d
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 1
jge 0x10021269
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x84], 3
jmp 0x10021240
lea eax, [ebp - 0x174]
push eax
push 1
push 0x3a30
lea eax, [ebp - 0x774]
push eax
call fcn.1001e17e
add esp, 0x10
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x100212a6
push 0x30e7
push 0
call fcn.1001f0a7
pop ecx
pop ecx
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x84], 0
jmp 0x100212d4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x84]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x84], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x84], 3
jg 0x10021816
mov dword [ebp - 0x5dc], 8
mov dword [ebp - 0x5d8], 8
mov dword [ebp - 0x5d4], 8
mov dword [ebp - 0x5d0], 8
mov dword [ebp - 0x64c], 0xa7f359a1
mov dword [ebp - 0x1fc], 0
jmp 0x10021333
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 1
jge 0x1002134f
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0xa8], 0xe6da504
jmp 0x10021326
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xa8], 3
jmp 0x1002137d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa8], 0
jl 0x10021678
mov dword [ebp - 0x664], 1
mov dword [ebp - 0x868], 1
mov dword [ebp - 0x388], 0xd44c039e
mov dword [ebp - 0x63c], 9
mov dword [ebp - 0x3b0], 0xba13b288
mov dword [ebp - 0x870], 0
mov dword [ebp - 0x878], 0x87fce6bb
mov dword [ebp - 0x880], 0x8112def9
mov dword [ebp - 0x888], 0x133f29c8
push 2
lea ecx, [ebp - 0x840]
call fcn.10024d89
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x2a8], 0x59c3f908
mov dword [ebp - 0x22c], 0
jmp 0x1002141f
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 2
jge 0x10021441
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x840]
call fcn.10024e10
mov dword [eax], 5
jmp 0x10021412
push 1
lea eax, [ebp - 0x664]
push eax
call fcn.1001e202
pop ecx
pop ecx
mov eax, dword [ebp - 0x63c]
mov dword [ebp - 0x890], eax
imul eax, dword [ebp - 0x13c], 0xffff
test eax, eax
je 0x10021480
cmp dword [ebp - 0x13c], 0
je 0x10021480
mov dword [ebp - 0x4b0], 1
jmp 0x10021487
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 0
je 0x100214a9
push 0
lea ecx, [ebp - 0x774]
call fcn.10024e10
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x5dc]
cmp dword [ebp + eax - 0x84], ecx
jg 0x100214d0
mov dword [ebp - 0x548], 1
jmp 0x100214d7
and dword [ebp - 0x548], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5dc]
cmp dword [ebp - 0x548], eax
jle 0x100214f7
mov dword [ebp - 0x390], 1
jmp 0x100214fe
and dword [ebp - 0x390], 0
cmp dword [ebp - 0x390], 0xd28a2181
jne 0x10021516
mov dword [ebp - 0x4b8], 1
jmp 0x1002151d
and dword [ebp - 0x4b8], 0
push 1
lea ecx, [ebp - 0x840]
call fcn.10024e10
imul ecx, dword [ebp - 0x4b8], 0x31fc
cmp dword [eax], ecx
je 0x10021544
mov dword [ebp - 0x398], 1
jmp 0x1002154b
and dword [ebp - 0x398], 0
cmp dword [ebp - 0x398], 0x4174
jge 0x10021563
mov dword [ebp - 0x594], 1
jmp 0x1002156a
and dword [ebp - 0x594], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5dc]
cmp dword [ebp - 0x594], eax
jg 0x1002158a
mov dword [ebp - 0x3a0], 1
jmp 0x10021591
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x3a0]
neg eax
cmp eax, dword [ebp - 0x3b0]
jne 0x100215ad
mov dword [ebp - 0x66c], 1
jmp 0x100215b4
and dword [ebp - 0x66c], 0
mov eax, 0x43ad
cmp eax, 0xbf2f
jle 0x100215cc
mov dword [ebp - 0x4c0], 1
jmp 0x100215d3
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
je 0x100215f8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x84], 0
jne 0x10021608
push 0xfffffffffffffffc
pop eax
test eax, eax
jne 0x10021608
and dword [ebp - 0x3a8], 0
jmp 0x10021612
mov dword [ebp - 0x3a8], 1
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x644], eax
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x2a8]
dec eax
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x644]
cmp eax, dword [ebp - 0x674]
jne 0x10021651
mov dword [ebp - 0x550], 1
jmp 0x10021658
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x3b0], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x840]
call fcn.10024e0b
jmp 0x10021362
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x84]
cmp dword [ebp + eax - 0x5dc], ecx
jne 0x1002169f
mov dword [ebp - 0x4c8], 1
jmp 0x100216a6
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x4c8]
add eax, 0x3ffcd553
je 0x100216c8
mov eax, 0x87d1
test eax, eax
je 0x100216c8
mov dword [ebp - 0x3b8], 1
jmp 0x100216cf
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x3b8]
neg eax
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x5dc]
jne 0x10021703
cmp dword [ebp - 0x64c], 0
je 0x10021703
mov eax, 0xc4fb
test eax, eax
je 0x10021703
mov dword [ebp - 0x5c4], 1
jmp 0x1002170a
and dword [ebp - 0x5c4], 0
push 1
lea ecx, [ebp - 0x774]
call fcn.10024e10
mov dword [eax], 0xdd14a140
cmp dword [ebp - 0x5c4], 0xdd14a140
jle 0x10021735
mov dword [ebp - 0x3c0], 1
jmp 0x1002173c
and dword [ebp - 0x3c0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5dc]
add eax, dword [ebp - 0x3c0]
add eax, dword [ebp - 0x13c]
mov dword [ebp - 0x4d0], eax
je 0x10021779
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa8], 0
je 0x10021779
mov dword [ebp - 0x3c8], 1
jmp 0x10021780
and dword [ebp - 0x3c8], 0
cmp dword [ebp - 0x3c8], 0xfffe
jbe 0x10021798
mov dword [ebp - 0x67c], 1
jmp 0x1002179f
and dword [ebp - 0x67c], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xa8]
cmp dword [ebp + eax - 0x5dc], ecx
jge 0x100217cc
mov eax, 0x2cd4
test eax, eax
jne 0x100217cc
and dword [ebp - 0x558], 0
jmp 0x100217d6
mov dword [ebp - 0x558], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x84]
cmp dword [ebp - 0x558], eax
je 0x100217f7
mov dword [ebp - 0x3d0], 1
jmp 0x100217fe
and dword [ebp - 0x3d0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3d0]
mov dword [ebp + eax - 0xa8], ecx
jmp 0x100212b9
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x774]
call fcn.10024e0b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9e0]
call fcn.10024e0b
and dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x18], 0
jbe 0x1002185e
push 0x5d6c
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x130]
push eax
call fcn.1001ece9
add esp, 0x10
mov dword [ebp - 0x3c], 0x5c80
mov dword [ebp - 0x560], 0x7eb8e136
push 3
lea ecx, [ebp - 0x780]
call fcn.10024d89
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x574], 0xffff
mov dword [ebp - 0x3f8], 0
lea eax, [ebp - 0x780]
push eax
push 0
push 0x7f0b
push 0x710d
lea eax, [ebp - 0x15c]
push eax
call fcn.1001e2c9
add esp, 0x14
mov dword [ebp - 0x15c], 0
jmp 0x100218d2
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 3
jge 0x100218ee
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x9d4], 0x865e1bfe
jmp 0x100218c5
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x96c], eax
cmp dword [ebp - 0x3c], 0x1b0ae28d
je 0x10021906
cmp dword [ebp - 0x3c], 0
je 0x10021918
cmp dword [ebp - 0x3c], 0
je 0x10021918
mov dword [ebp - 0x4d8], 1
jmp 0x1002191f
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x4d8], eax
je 0x10021936
mov dword [ebp - 0x3d8], 1
jmp 0x1002193d
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x3d8]
sub eax, dword [ebp - 0x560]
mov dword [ebp - 0x59c], eax
push 0
lea ecx, [ebp - 0x780]
call fcn.10024e10
mov ecx, dword [ebp - 0x59c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x59c], eax
jle 0x1002197b
mov dword [ebp - 0x3e0], 1
jmp 0x10021982
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x3e0]
je 0x10021999
mov dword [ebp - 0x4e0], 1
jmp 0x100219a0
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x4e0], eax
jle 0x100219b7
mov dword [ebp - 0x3e8], 1
jmp 0x100219be
and dword [ebp - 0x3e8], 0
imul eax, dword [ebp - 0x3e8], 0
cmp eax, 0xa37b
jl 0x100219d8
mov dword [ebp - 0x654], 1
jmp 0x100219df
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x560]
neg eax
cmp eax, dword [ebp - 0x3c]
jle 0x100219f8
mov dword [ebp - 0x3f0], 1
jmp 0x100219ff
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x574], eax
push 0
lea ecx, [ebp - 0x780]
call fcn.10024e10
mov ecx, dword [ebp - 0x3c]
cmp dword [eax], ecx
je 0x10021a2b
mov dword [ebp - 0x4e8], 1
jmp 0x10021a32
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x3f8], eax
cmp dword [ebp - 0x3f8], 0
jne 0x10021a59
cmp dword [ebp - 0x574], 0
jne 0x10021a59
and dword [ebp - 0x400], 0
jmp 0x10021a63
mov dword [ebp - 0x400], 1
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x400]
jle 0x10021a7a
mov dword [ebp - 0x4f0], 1
jmp 0x10021a81
and dword [ebp - 0x4f0], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x4f0]
mov dword [ebp + eax - 0x9d4], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x780]
call fcn.10024e0b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
sub eax, dword [ebp - 0x130]
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xb0], 0xffff
push 2
lea ecx, [ebp - 0x5b8]
call fcn.10024d89
mov dword [ebp - 4], 0x14
mov dword [ebp - 0xf8], 0x9729cf30
mov dword [ebp - 0xf0], 0x4e80031a
mov dword [ebp - 0x2cc], 1
mov dword [ebp - 0x144], 0
mov dword [ebp - 0x100], 0x9f196e6c
mov dword [ebp - 0x68], 0
jmp 0x10021b1d
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x10021b36
push dword [ebp - 0x68]
lea ecx, [ebp - 0x5b8]
call fcn.10024e10
or dword [eax], 0xffffffff
jmp 0x10021b16
mov dword [ebp - 0x68], 0
jmp 0x10021b46
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x10021b5c
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0xacc], 0x3c17a3f0
jmp 0x10021b3f
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x974], eax
cmp dword [ebp - 0xb0], 0xffff
jae 0x10021b80
mov dword [ebp - 0x408], 1
jmp 0x10021b87
and dword [ebp - 0x408], 0
push 1
lea ecx, [ebp - 0x5b8]
call fcn.10024e10
mov ecx, dword [ebp - 0x408]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x5b8]
call fcn.10024e10
mov eax, dword [eax]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xb0]
sub eax, dword [ebp - 0xf0]
cmp eax, dword [ebp - 0x2cc]
je 0x10021bd1
mov dword [ebp - 0x568], 1
jmp 0x10021bd8
and dword [ebp - 0x568], 0
push 0
lea ecx, [ebp - 0x5b8]
call fcn.10024e10
mov ecx, dword [ebp - 0x568]
add ecx, dword [eax]
cmp ecx, 1
je 0x10021bfe
mov dword [ebp - 0x410], 1
jmp 0x10021c05
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x2cc]
imul eax, dword [ebp - 0x410]
cmp eax, 1
je 0x10021c1e
cmp dword [ebp - 0x144], 0
push 1
lea ecx, [ebp - 0x5b8]
call fcn.10024e10
mov esi, eax
push 1
lea ecx, [ebp - 0x5b8]
call fcn.10024e10
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x10021c4c
mov dword [ebp - 0x4f8], 1
jmp 0x10021c53
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x4f8], eax
jle 0x10021c6d
mov dword [ebp - 0x418], 1
jmp 0x10021c74
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x100], eax
mov esi, dword [ebp - 0x100]
push 0
lea ecx, [ebp - 0x5b8]
call fcn.10024e10
cmp dword [eax], esi
jge 0x10021cac
cmp dword [ebp - 0xf8], 0
je 0x10021cac
mov dword [ebp - 0x578], 1
jmp 0x10021cb3
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0xf8]
cmp eax, dword [ebp - 0x578]
jle 0x10021ccd
mov dword [ebp - 0x420], 1
jmp 0x10021cd4
and dword [ebp - 0x420], 0
cmp dword [ebp - 0x420], 0xd9a54e58
jbe 0x10021cec
mov dword [ebp - 0x500], 1
jmp 0x10021cf3
and dword [ebp - 0x500], 0
cmp dword [ebp - 0x500], 0xd7c3b7c3
jbe 0x10021d0b
mov dword [ebp - 0x428], 1
jmp 0x10021d12
and dword [ebp - 0x428], 0
cmp dword [ebp - 0x428], 0xd940
jge 0x10021d84
mov dword [ebp - 0x684], 0x14186e14
mov dword [ebp - 0x68c], 0xba1dd793
mov dword [ebp - 0xf8], 0
jmp 0x10021d4b
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0x17
jne 0x10021d73
mov byte [ebp - 0xd1], 0
lea eax, [ebp - 0xd1]
push eax
push 1
push 0x4088
call fcn.1001e248
add esp, 0xc
jmp 0x10021d3e
mov eax, dword [ebp - 0x684]
mov dword [ebp - 0x68c], eax
jmp 0x10021ebc
mov dword [ebp - 0x660], 9
mov dword [ebp - 0xb0], 0
jmp 0x10021da7
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x37
jg 0x10021eac
mov dword [ebp - 0x7b0], 0xfffffffd
mov dword [ebp - 0x7ac], 0xfffffffd
mov dword [ebp - 0x7a8], 0xfffffffd
mov dword [ebp - 0x7a4], 0xfffffffd
mov dword [ebp - 0xf0], 0
jmp 0x10021df5
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0x11
jge 0x10021ea7
mov byte [ebp - 0x8b], 0
movzx eax, byte [ebp - 0x8b]
test eax, eax
je 0x10021e22
push 0x3c36
push 0
call fcn.1001e291
pop ecx
pop ecx
mov dword [ebp - 0x144], 0
jmp 0x10021e3b
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0x10
jg 0x10021ea2
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x7b0]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x7b0], eax
mov dword [ebp - 0x100], 0
jmp 0x10021e78
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 3
jg 0x10021ea0
mov byte [ebp - 0xd5], 0
lea eax, [ebp - 0xd5]
push eax
push 0
push 0x5a16
call fcn.1001f0d9
add esp, 0xc
jmp 0x10021e6b
jmp 0x10021e2e
jmp 0x10021de8
jmp 0x10021d9a
lea eax, [ebp - 0x660]
push eax
push 1
call fcn.1001e291
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5b8]
call fcn.10024e0b
and dword [ebp - 0x16c], 0
jmp 0x10021ee1
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x16c]
cmp eax, dword [ebp - 0xf4]
jge 0x10021f68
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
sub eax, dword [ecx + 0x18]
cmp dword [ebp - 0x16c], eax
jae 0x10021f20
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
add ecx, dword [eax + 0x1c]
add ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x16c]
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x570], eax
jmp 0x10021f38
push 0
lea eax, [ebp - 0x570]
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.1001ea8c
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push 0x239a
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x570]
push eax
call fcn.1001e5a5
add esp, 0x18
mov eax, dword [ebp - 0x10]
add eax, 4
mov dword [ebp - 0x10], eax
jmp 0x10021ed4
push 4
lea ecx, [ebp - 0x2fc]
call fcn.10024d89
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x2b0], 1
mov dword [ebp - 0x508], 1
push 0x1e1d
push 1
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x2fc]
push eax
push 0x74c5
call fcn.1001e2c9
add esp, 0x14
mov dword [ebp - 0x11c], 0
jmp 0x10021fcb
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 4
jge 0x10021fe7
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x2e8], 0
jmp 0x10021fbe
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2e8], 3
jmp 0x10022012
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2e8]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2e8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2e8], 0
jl 0x1002221b
mov dword [ebp - 0x448], 9
mov dword [ebp - 0x72c], 0x3bed162c
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2e8]
mov dword [ebp - 0x97c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2e8], 0xfffffffb
jbe 0x10022066
mov dword [ebp - 0x430], 1
jmp 0x1002206d
and dword [ebp - 0x430], 0
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x2e8]
lea ecx, [ebp - 0x2fc]
call fcn.10024e10
mov eax, dword [eax]
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x508], eax
mov esi, dword [ebp - 0x508]
mov edi, dword [ebp - 0x2b0]
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x2e8]
lea ecx, [ebp - 0x2fc]
call fcn.10024e10
add edi, dword [eax]
cmp edi, esi
jl 0x100220dc
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2e8], 0
je 0x100220dc
mov dword [ebp - 0x438], 1
jmp 0x100220e3
and dword [ebp - 0x438], 0
cmp dword [ebp - 0x438], 0xffffffff
jg 0x100220f8
mov dword [ebp - 0x580], 1
jmp 0x100220ff
and dword [ebp - 0x580], 0
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x2e8]
lea ecx, [ebp - 0x2fc]
call fcn.10024e10
mov ecx, dword [ebp - 0x580]
imul ecx, dword [eax]
test ecx, ecx
je 0x1002213f
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x2e8]
lea ecx, [ebp - 0x2fc]
call fcn.10024e10
cmp dword [eax], 0
jne 0x10022156
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x2e8]
lea ecx, [ebp - 0x2fc]
call fcn.10024e10
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x2e8]
lea ecx, [ebp - 0x2fc]
call fcn.10024e10
cmp dword [eax], 0
jne 0x10022197
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x2e8]
lea ecx, [ebp - 0x2fc]
call fcn.10024e10
cmp dword [eax], 0
jne 0x10022197
and dword [ebp - 0x440], 0
jmp 0x100221a1
mov dword [ebp - 0x440], 1
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x2e8]
lea ecx, [ebp - 0x2fc]
call fcn.10024e10
mov eax, dword [eax]
cmp eax, dword [ebp - 0x440]
jl 0x100221ce
mov dword [ebp - 0x510], 1
jmp 0x100221d5
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0x448], eax
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x984], eax
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x72c], eax
mov byte [ebp - 0xda], 0
push 0x69e0
push 0
lea eax, [ebp - 0xda]
push eax
call fcn.1001eae5
add esp, 0xc
jmp 0x10021ff9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2fc]
call fcn.10024e0b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
sub eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 0x14], eax
push 3
lea ecx, [ebp - 0x918]
call fcn.10024d89
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x1c8], 0xb02971c1
push 0
lea eax, [ebp - 0x918]
push eax
lea eax, [ebp - 0x98c]
push eax
call fcn.1001e514
add esp, 0xc
mov dword [ebp - 0x1c8], 2
jmp 0x1002228b
mov eax, dword [ebp - 0x1c8]
dec eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 0
jl 0x100222e7
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x100222bf
push 1
push 0x3ae9
push 0x18f2
push 0x73bc
call fcn.1001e373
add esp, 0x10
mov byte [ebp - 0xd3], 0
movzx eax, byte [ebp - 0xd3]
test eax, eax
je 0x100222e5
push 0x452
push 1
push 0x17f3
call fcn.1001e3e8
add esp, 0xc
jmp 0x1002227e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x918]
call fcn.10024e0b
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x130]
push eax
call fcn.1001e44f
add esp, 0x10
push 1
lea ecx, [ebp - 0x618]
call fcn.10024d89
mov dword [ebp - 4], 0x17
mov dword [ebp - 0x204], 0
jmp 0x1002233f
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 1
jge 0x10022361
push dword [ebp - 0x204]
lea ecx, [ebp - 0x618]
call fcn.10024e10
mov dword [eax], 0xf6af1124
jmp 0x10022332
push 0
lea ecx, [ebp - 0x618]
call fcn.10024e10
mov dword [eax], 0xffffffee
jmp 0x1002239a
push 0
lea ecx, [ebp - 0x618]
call fcn.10024e10
mov dword [ebp - 0x588], eax
mov eax, dword [ebp - 0x588]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x588]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x618]
call fcn.10024e10
cmp dword [eax], 7
jle 0x1002261a
push 1
lea ecx, [ebp - 0x70c]
call fcn.10024d89
mov byte [ebp - 4], 0x18
push 2
lea ecx, [ebp - 0x60c]
call fcn.10024d89
mov byte [ebp - 4], 0x19
push 1
lea eax, [ebp - 0x70c]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.1001e49f
add esp, 0xc
mov dword [ebp - 0x114], 0
jmp 0x10022403
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 2
jge 0x10022425
push dword [ebp - 0x114]
lea ecx, [ebp - 0x60c]
call fcn.10024e10
mov dword [eax], 0xdd3f4672
jmp 0x100223f6
push 0
lea ecx, [ebp - 0x60c]
call fcn.10024e10
and dword [eax], 0
jmp 0x1002245b
push 0
lea ecx, [ebp - 0x60c]
call fcn.10024e10
mov dword [ebp - 0x450], eax
mov eax, dword [ebp - 0x450]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x450]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x60c]
call fcn.10024e10
cmp dword [eax], 0
jg 0x100225c2
mov dword [ebp - 0x128], 1
mov dword [ebp - 0x128], 0
jmp 0x10022494
cmp dword [ebp - 0x128], 0
jl 0x100225bd
mov dword [ebp - 0x54], 0
jmp 0x100224b1
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x100224c7
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x6fc], 0x8a012e1d
jmp 0x100224aa
mov dword [ebp - 0x54], 0
jmp 0x100224d7
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x100224ed
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x244], 0xec3d4e70
jmp 0x100224d0
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x6fc], 0
jmp 0x1002251b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6fc], 0
jl 0x1002254c
jmp 0x10022437
push 0
lea ecx, [ebp - 0x618]
call fcn.10024e10
cmp dword [eax], 0
je 0x100225f7
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x60c]
call fcn.10024e0b
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x70c]
call fcn.10024e0b
jmp 0x10022376
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x60c]
call fcn.10024e0b
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x70c]
call fcn.10024e0b
jmp 0x10022376
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x618]
call fcn.10024e0b
and dword [ebp - 0x2d4], 0
jmp 0x1002263f
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x2d4]
cmp eax, dword [ebp - 0xf4]
jge 0x10022665
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
and dword [ecx + eax], 0
mov eax, dword [ebp - 0x10]
add eax, 4
mov dword [ebp - 0x10], eax
jmp 0x10022632
mov dword [ebp - 0x20c], 0x1928c176
mov byte [ebp - 0x99], 0
push 0x53d6
lea eax, [ebp - 0x99]
push eax
push 0x7cb
push 1
push 0xcfc
push 0x2be
call fcn.1001e5a5
add esp, 0x18
mov dword [ebp - 0x20c], 0
jmp 0x100226b4
mov eax, dword [ebp - 0x20c]
dec eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xffffffee
je 0x100226d9
mov dword [ebp - 0x668], 0x3099
lea eax, [ebp - 0x668]
push eax
push 1
call fcn.1001e625
pop ecx
pop ecx
jmp 0x100226a7
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xf4]
push eax
push 0x40fe
push 0xdda
push 1
call fcn.1001e676
add esp, 0x18
push 1
push 0x5054
call fcn.1001e6ea
pop ecx
pop ecx
push 0x64dc
push 0x24e8
push 0
push 0x2245
lea eax, [ebp - 0x14]
push eax
push 0x18db
lea eax, [ebp - 0x130]
push eax
call fcn.1001f592
add esp, 0x1c
mov dword [ebp - 0x138], 0xffffffff
mov dword [ebp - 0x74c], 1
mov dword [ebp - 0x678], 0xe7aebb1b
mov dword [ebp - 0x234], 0
jmp 0x1002276a
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 1
jge 0x10022786
mov eax, dword [ebp - 0x234]
mov dword [ebp + eax*4 - 0x310], 0x13638ecf
jmp 0x1002275d
mov dword [ebp - 0x138], 0
jmp 0x1002279f
cmp dword [ebp - 0x138], 0x11
jl 0x10022aba
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xc0], 0
jmp 0x100227cf
cmp dword [ebp - 0xc0], 0
jg 0x10022aaa
mov dword [ebp - 0xec], 0x7222631
mov dword [ebp - 0x6d8], 0x3d069f49
mov dword [ebp - 0xec], 0
jmp 0x10022809
cmp dword [ebp - 0xec], 0
jl 0x10022aa5
cmp dword [ebp - 0xc0], 0
je 0x10022ab5
jmp 0x10022aba
jmp 0x10022792
mov byte [ebp - 0xd7], 0
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x10022ae0
push 1
push 0x4d5f
push 0xd9e
call fcn.1001e87a
add esp, 0xc
and dword [ebp - 0x214], 0
jmp 0x10022af6
mov eax, dword [ebp - 0x214]
cmp eax, dword [ebp - 0xf4]
jge 0x10022b44
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x214]
lea eax, [ecx + eax*2]
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x20]
mov ax, word [esi + eax]
mov word [edx + ecx], ax
lea eax, [ebp - 0x10]
push eax
push 0x1b2b
push 0x5740
push 1
call fcn.1001e8d0
add esp, 0x10
jmp 0x10022ae9
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x78], 0
jmp 0x10022b5b
push 0
push 0x22b1
push 0
push 0x2449
push 0x17f6
call dword [sym.imp.GDI32.dll_ExtCreatePen]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret