Function at 0x1002d67b
Capabilities:
Delete file
Query environment variable
Query or enumerate registry key
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065faa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1044
call fcn.10061b80
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1003537d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xb20], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x8bc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xb30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x96c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xb28], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xb38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x974], eax
mov eax, dword [ebp - 0xb38]
movzx eax, byte [eax]
test eax, eax
je 0x1002d8d7
mov eax, dword [ebp - 0x96c]
mov dword [ebp - 0xb00], eax
mov eax, dword [ebp - 0x974]
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp - 0xb00]
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x49c], 0x3bc2
mov dword [ebp - 0xb10], 0x10009e88
cmp dword [ebp - 0x49c], 0x3f51
jle 0x1002d83b
push 0x269c
push 0x2e2
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
and dword [ebp - 0x340], 0
jmp 0x1002d76e
mov eax, dword [ebp - 0x340]
inc eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0x691a
jge 0x1002d831
and dword [ebp - 0x348], 0
jmp 0x1002d794
mov eax, dword [ebp - 0x348]
inc eax
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0x20c4
jge 0x1002d82c
and dword [ebp - 0x350], 0
jmp 0x1002d7ba
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 0x33c6
jge 0x1002d827
and dword [ebp - 0x2f4], 0
jmp 0x1002d7dc
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0x22f1
jge 0x1002d825
mov eax, dword [ebp - 0x340]
add eax, dword [ebp - 0x348]
sub eax, dword [ebp - 0x350]
or eax, dword [ebp - 0x2f4]
cdq
mov dword [ebp - 0x980], eax
mov dword [ebp - 0x97c], edx
push dword [ebp - 0x97c]
push dword [ebp - 0x980]
mov ecx, 0x1060f618
call fcn.1001d301
jmp 0x1002d7cf
jmp 0x1002d7ad
jmp 0x1002d787
jmp 0x1002d761
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov eax, dword [ebp - 0xb08]
mov dword [ebp - 0xb18], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x49c], 0x39ac
jge 0x1002d867
mov edx, dword [ebp - 0xb10]
mov ecx, 0x1060f618
call fcn.1001f80c
jmp 0x1002d883
or dword [ebp - 4], 0xffffffff
jmp 0x1002d88d
mov eax, dword [ebp - 0x1a4]
mov dword [eax], 0
jmp 0x1002d8ac
mov eax, dword [ebp - 0x1a4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1a4]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1a4]
cmp dword [eax], 1
jge 0x1002d8d2
mov eax, dword [ebp - 0x1a4]
push dword [eax]
mov ecx, dword [ebp - 0xb18]
call fcn.1001d5d0
mov dword [eax], 0xae8c9f36
jmp 0x1002d89b
jmp 0x1003537b
mov eax, dword [ebp - 0xb20]
mov dword [ebp - 0xb40], eax
mov eax, dword [ebp - 0xb28]
mov dword [ebp - 0x9d8], eax
mov eax, dword [ebp - 0xb30]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0xb40]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 0
jle 0x1003537b
push 1
lea ecx, [ebp - 0x8ac]
call fcn.1001d532
mov dword [ebp - 4], 2
push 3
lea ecx, [ebp - 0xd10]
call fcn.1001d532
mov byte [ebp - 4], 3
mov dword [ebp - 0x3ec], 0xfffffffb
mov dword [ebp - 0x3c0], 9
mov dword [ebp - 0x86c], 0x96f8f9ed
mov dword [ebp - 0x874], 0x9ec0021f
mov dword [ebp - 0x188], 0
jmp 0x1002d989
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 1
jge 0x1002d9a8
push dword [ebp - 0x188]
lea ecx, [ebp - 0x8ac]
call fcn.1001d5d0
and dword [eax], 0
jmp 0x1002d97c
push 0
push 1
lea eax, [ebp - 0xd10]
push eax
lea eax, [ebp - 0x188]
push eax
push 0
push 0x49f4
call fcn.1002ca5f
add esp, 0x18
push 0
lea ecx, [ebp - 0x8ac]
call fcn.1001d5d0
and dword [eax], 0
jmp 0x1002d9ff
push 0
lea ecx, [ebp - 0x8ac]
call fcn.1001d5d0
mov dword [ebp - 0x84c], eax
mov eax, dword [ebp - 0x84c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x84c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x8ac]
call fcn.1001d5d0
cmp dword [eax], 0xfffffff6
jge 0x1002dc8d
mov dword [ebp - 0xf8], 9
push 1
lea ecx, [ebp - 0xcbc]
call fcn.1001d532
mov byte [ebp - 4], 4
mov dword [ebp - 0x400], 8
mov dword [ebp - 0xb48], 0xffffffff
push 0x591d
push 0x69d7
lea eax, [ebp - 0xe58]
push eax
lea eax, [ebp - 0xcbc]
push eax
push 0
push 0x4409
push 1
push 1
call fcn.10021309
add esp, 0x20
mov esi, dword [ebp - 0xf8]
push 0
lea ecx, [ebp - 0x8ac]
call fcn.1001d5d0
cmp dword [eax], esi
je 0x1002da92
mov dword [ebp - 0x854], 1
jmp 0x1002da99
and dword [ebp - 0x854], 0
cmp dword [ebp - 0x854], 0x920a6ff6
ja 0x1002dab1
mov dword [ebp - 0x85c], 1
jmp 0x1002dab8
and dword [ebp - 0x85c], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x85c], eax
jl 0x1002dad2
mov dword [ebp - 0x864], 1
jmp 0x1002dad9
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0x3c0], eax
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x86c], eax
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0x874], eax
cmp dword [ebp - 0x874], 0
jne 0x1002db18
cmp dword [ebp - 0xf8], 0
jne 0x1002db18
and dword [ebp - 0x87c], 0
jmp 0x1002db22
mov dword [ebp - 0x87c], 1
mov eax, dword [ebp - 0xf8]
cmp eax, dword [ebp - 0x87c]
jne 0x1002db3c
mov dword [ebp - 0x844], 1
jmp 0x1002db43
and dword [ebp - 0x844], 0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x884], eax
push 2
lea ecx, [ebp - 0xd10]
call fcn.1001d5d0
mov ecx, dword [ebp - 0x884]
mov dword [eax], ecx
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0x844]
lea eax, [ecx + eax + 0x9b2e]
sub eax, 0xbc00
mov dword [ebp - 0x3f4], eax
push 0
lea ecx, [ebp - 0xcbc]
call fcn.1001d5d0
mov ecx, dword [ebp - 0x3f4]
mov dword [eax], ecx
mov esi, dword [ebp - 0x3ec]
push 0
lea ecx, [ebp - 0x8ac]
call fcn.1001d5d0
mov eax, dword [eax]
add eax, esi
add eax, dword [ebp - 0x3f4]
jne 0x1002dbd4
mov eax, 0x10ca
test eax, eax
jne 0x1002dbd4
and dword [ebp - 0x3f8], 0
jmp 0x1002dbde
mov dword [ebp - 0x3f8], 1
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x3f8], eax
jl 0x1002dbf8
mov dword [ebp - 0x640], 1
jmp 0x1002dbff
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x640]
mov dword [ebp - 0x400], eax
cmp dword [ebp - 0x400], 0xa2c930f8
ja 0x1002dc23
mov dword [ebp - 0x868], 1
jmp 0x1002dc2a
and dword [ebp - 0x868], 0
cmp dword [ebp - 0x868], 0xffffffff
jl 0x1002dc3f
mov dword [ebp - 0x408], 1
jmp 0x1002dc46
and dword [ebp - 0x408], 0
imul eax, dword [ebp - 0x408], 0xffffffff
test eax, eax
je 0x1002dc66
cmp dword [ebp - 0x3c0], 0
je 0x1002dc66
mov dword [ebp - 0x648], 1
jmp 0x1002dc6d
and dword [ebp - 0x648], 0
mov eax, dword [ebp - 0x648]
mov dword [ebp - 0xb48], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xcbc]
call fcn.1001d5b4
jmp 0x1002d9db
mov byte [ebp - 0xe7], 0
push 0
push 0x9eb
push 1
lea eax, [ebp - 0xe7]
push eax
call fcn.10021241
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xd10]
call fcn.1001d5b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8ac]
call fcn.1001d5b4
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x110], 0xf
jmp 0x1002dced
mov eax, dword [ebp - 0x110]
dec eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0xffffffe5
je 0x1002e341
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x238], 0
jmp 0x1002dd1d
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 3
jge 0x1002dd39
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0xee0], 0xfffffffc
jmp 0x1002dd10
mov dword [ebp - 0xb0], 0xfffffff6
jmp 0x1002dd52
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
je 0x1002e33c
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x964], 1
mov dword [ebp - 0x770], 0x39956a21
cmp dword [ebp - 0x74], 0
je 0x1002df7d
mov dword [ebp - 0x8c8], 0x8abb75da
mov dword [ebp - 0xae0], 0x4cd021aa
mov dword [ebp - 0x74], 0
jmp 0x1002dda8
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xd
jl 0x1002de0d
mov dword [ebp - 0xb50], 0xbf35dd75
push 0
push 0x51de
push 0xd15
push 0x1b9e
lea eax, [ebp - 0xb50]
push eax
push 0x247f
push 1
lea eax, [ebp - 0x964]
push eax
lea eax, [ebp - 0xb0]
push eax
push 0
lea eax, [ebp - 0x770]
push eax
lea eax, [ebp - 0x8c8]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0xae0]
push eax
call fcn.1003a5a4
add esp, 0x38
jmp 0x1002dda1
mov dword [ebp - 0x410], 0x6625
mov dword [ebp - 0x8d0], 0x10009f10
cmp dword [ebp - 0x410], 0x6913
jle 0x1002df13
and dword [ebp - 0x1c4], 0
jmp 0x1002de47
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0x1978
jge 0x1002df0b
and dword [ebp - 0x240], 0
jmp 0x1002de6d
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0x6db
jge 0x1002df06
and dword [ebp - 0x1cc], 0
jmp 0x1002de93
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0x49ae
jge 0x1002df01
and dword [ebp - 0x248], 0
jmp 0x1002deb5
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0x7f6b
jge 0x1002deff
mov eax, dword [ebp - 0x1c4]
imul eax, dword [ebp - 0x240]
sub eax, dword [ebp - 0x1cc]
add eax, dword [ebp - 0x248]
cdq
mov dword [ebp - 0x98c], eax
mov dword [ebp - 0x988], edx
push dword [ebp - 0x988]
push dword [ebp - 0x98c]
mov ecx, 0x1060f618
call fcn.1001d301
jmp 0x1002dea8
jmp 0x1002de86
jmp 0x1002de60
jmp 0x1002de3a
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov byte [ebp - 0xf0], 0
mov dword [ebp - 4], 5
cmp dword [ebp - 0x410], 0x62a5
jge 0x1002df3d
mov edx, dword [ebp - 0x8d0]
mov ecx, 0x1060f618
call fcn.1001f80c
jmp 0x1002df59
or dword [ebp - 4], 0xffffffff
jmp 0x1002df63
push 1
lea eax, [ebp - 0xf0]
push eax
push 0
push 0
call fcn.1002d3d2
add esp, 0x10
jmp 0x1002e337
or dword [ebp - 0xc44], 0xffffffff
or dword [ebp - 0xc40], 0xffffffff
or dword [ebp - 0xc3c], 0xffffffff
or dword [ebp - 0xc38], 0xffffffff
lea ecx, [ebp - 0x3b5]
call fcn.1001d5df
push eax
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0xc44]
push eax
lea ecx, [ebp - 0xf14]
call fcn.1001d5e2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc74]
call fcn.1001d58e
mov dword [ebp - 4], 7
push 2
lea ecx, [ebp - 0xd1c]
call fcn.1001d532
mov byte [ebp - 4], 8
push 3
lea ecx, [ebp - 0xd28]
call fcn.1001d532
mov byte [ebp - 4], 9
mov dword [ebp - 0x658], 0
mov dword [ebp - 0x8d8], 9
push 0
lea eax, [ebp - 0xd1c]
push eax
push 0
lea eax, [ebp - 0x190]
push eax
call fcn.100362a5
add esp, 0x10
mov dword [ebp - 0x190], 0
jmp 0x1002e03e
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 3
jge 0x1002e060
push dword [ebp - 0x190]
lea ecx, [ebp - 0xd28]
call fcn.1001d5d0
mov dword [eax], 7
jmp 0x1002e031
push 1
push 0x310d
push 0x2e9f
push 0x54be
push 1
lea eax, [ebp - 0xc74]
push eax
lea eax, [ebp - 0x770]
push eax
lea eax, [ebp - 0x110]
push eax
push 0x63e5
push 0
call fcn.10020b24
add esp, 0x28
mov dword [ebp - 0x74], 0x17
jmp 0x1002e0a7
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 9
jle 0x1002e30a
mov dword [ebp - 0x430], 0x48f
mov dword [ebp - 0x418], 0x620
mov dword [ebp - 0xa94], 0x10009f68
cmp dword [ebp - 0x418], 0x72a
jle 0x1002e18a
and dword [ebp - 0x1d4], 0
jmp 0x1002e0f5
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0x7933
jge 0x1002e18a
and dword [ebp - 0x250], 0
jmp 0x1002e11b
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0x6360
jge 0x1002e185
and dword [ebp - 0x1b8], 0
jmp 0x1002e13d
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0x481c
jge 0x1002e183
mov eax, dword [ebp - 0x1d4]
cdq
idiv dword [ebp - 0x250]
or edx, dword [ebp - 0x1b8]
mov eax, edx
cdq
mov dword [ebp - 0x998], eax
mov dword [ebp - 0x994], edx
push dword [ebp - 0x994]
push dword [ebp - 0x998]
mov ecx, 0x1060f618
call fcn.1001d301
jmp 0x1002e130
jmp 0x1002e10e
jmp 0x1002e0e8
mov dword [ebp - 0xb24], 0x38e70e9e
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x418], 0x271
jge 0x1002e1b4
mov edx, dword [ebp - 0xa94]
mov ecx, 0x1060f618
call fcn.1001f80c
jmp 0x1002e1d0
mov dword [ebp - 4], 9
jmp 0x1002e1e0
push 1
lea ecx, [ebp - 0xd1c]
call fcn.1001d5d0
mov dword [eax], 0xb1beba42
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xee0], 0xb1beba42
push 1
lea ecx, [ebp - 0xd28]
call fcn.1001d5d0
mov dword [eax], 0xb1beba42
mov eax, 0xb1beba42
test eax, eax
je 0x1002e22b
mov dword [ebp - 0x650], 1
jmp 0x1002e232
and dword [ebp - 0x650], 0
mov eax, dword [ebp - 0x430]
cmp dword [ebp - 0x650], eax
jge 0x1002e24c
mov dword [ebp - 0x420], 1
jmp 0x1002e253
and dword [ebp - 0x420], 0
mov esi, dword [ebp - 0x420]
add esi, 0x3190c4eb
push 3
lea ecx, [ebp - 0xc74]
call fcn.1001d5d0
cmp dword [eax], esi
jge 0x1002e27c
mov dword [ebp - 0x800], 1
jmp 0x1002e283
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x800], eax
jge 0x1002e29d
mov dword [ebp - 0x428], 1
jmp 0x1002e2a4
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x658], eax
mov eax, dword [ebp - 0x658]
add eax, dword [ebp - 0x430]
cmp dword [ebp - 0xb0], eax
jle 0x1002e2d0
mov dword [ebp - 0x778], 1
jmp 0x1002e2d7
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x778]
mov dword [ebp - 0x8d8], eax
lea eax, [ebp - 0xb24]
push eax
push 0
push 0x45b6
push 0x6fd6
push 0x1a94
push 0
call fcn.10020700
add esp, 0x18
jmp 0x1002e0a0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xd28]
call fcn.1001d5b4
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xd1c]
call fcn.1001d5b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc74]
call fcn.1001d5b4
jmp 0x1002dd45
jmp 0x1002dce0
push 1
lea ecx, [ebp - 0x8a0]
call fcn.1001d532
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x34], 0xb743d837
mov dword [ebp - 0x11c], 0x25f8a419
mov dword [ebp - 0xb9c], 0xb52f
mov dword [ebp - 0x258], 0
jmp 0x1002e389
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 3
jge 0x1002e3a5
mov eax, dword [ebp - 0x258]
mov dword [ebp + eax*4 - 0x16c], 0x20624039
jmp 0x1002e37c
mov dword [ebp - 0x34], 2
jmp 0x1002e3b5
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1002e65c
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0xa9c], 1
mov dword [ebp - 0x13c], 0
jmp 0x1002e3f6
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 2
jg 0x1002e429
mov byte [ebp - 0xfa], 0
movzx eax, byte [ebp - 0xfa]
test eax, eax
je 0x1002e427
push 0
push 0x1afc
push 0x714c
push 0
call fcn.10039932
add esp, 0x10
jmp 0x1002e3e9
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp + eax*4 - 0x16c], 0
test eax, eax
jne 0x1002e449
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x16c], 1
ja 0x1002e5ce
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x16c], 0
je 0x1002e5ce
mov eax, 0xf1860ec0
test eax, eax
je 0x1002e5ce
mov dword [ebp - 0x1e4], 0
jmp 0x1002e483
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 3
jge 0x1002e49f
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0xe44], 0xffff
jmp 0x1002e476
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x16c], 0
jne 0x1002e4be
push 0xfffffffffffffffd
pop eax
test eax, eax
jne 0x1002e4be
and dword [ebp - 0x848], 0
jmp 0x1002e4c8
mov dword [ebp - 0x848], 1
mov eax, dword [ebp - 0x34]
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x16c]
add ecx, dword [ebp + eax*4 - 0x16c]
cmp ecx, 0xe584
jge 0x1002e4f2
mov dword [ebp - 0x438], 1
jmp 0x1002e4f9
and dword [ebp - 0x438], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xe44]
add eax, dword [ebp - 0x438]
cmp eax, 0xb59
jge 0x1002e517
xor eax, eax
inc eax
jne 0x1002e52f
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xe44], 0
jne 0x1002e52f
and dword [ebp - 0x660], 0
jmp 0x1002e539
mov dword [ebp - 0x660], 1
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x16c]
cmp dword [ebp - 0x660], eax
jne 0x1002e557
mov dword [ebp - 0x440], 1
jmp 0x1002e55e
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x440], eax
jle 0x1002e575
mov dword [ebp - 0x448], 1
jmp 0x1002e57c
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0x448]
jne 0x1002e5a2
mov dword [ebp - 0x668], 1
jmp 0x1002e5a9
and dword [ebp - 0x668], 0
mov eax, dword [ebp - 0x668]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x16c]
mov ecx, dword [ebp - 0x34]
mov dword [ebp + ecx*4 - 0x16c], eax
jmp 0x1002e657
mov dword [ebp - 0x17c], 0x1d
jmp 0x1002e5e7
mov eax, dword [ebp - 0x17c]
dec eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0x12
jl 0x1002e657
mov dword [ebp - 0x8e0], 0
push 0
push 0x715d
push 0x7373
push 0x7dd3
push 0x4e7d
lea eax, [ebp - 0x8e0]
push eax
push 0
lea eax, [ebp - 0xa9c]
push eax
push 0x5165
push 0x4d36
call fcn.100207ca
add esp, 0x28
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x1002e655
push 0
push 0
push 0x29b7
call fcn.1002cc11
add esp, 0xc
jmp 0x1002e5da
jmp 0x1002e3ae
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x16c]
mov dword [ebp - 0xd4c], eax
mov dword [ebp - 0x34], 0
cmp dword [ebp - 0x34], 0
jne 0x1002e710
cmp dword [ebp - 0x11c], 0x28ae
jl 0x1002e697
mov dword [ebp - 0x450], 1
jmp 0x1002e69e
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x450], eax
jne 0x1002e6b8
mov dword [ebp - 0x780], 1
jmp 0x1002e6bf
and dword [ebp - 0x780], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x16c]
cmp dword [ebp - 0x780], eax
jg 0x1002e6ef
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x16c], 0
je 0x1002e6ef
mov dword [ebp - 0x458], 1
jmp 0x1002e6f6
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x11c]
imul eax, dword [ebp - 0x458]
test eax, eax
jne 0x1002e710
and dword [ebp - 0x670], 0
jmp 0x1002e71a
mov dword [ebp - 0x670], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x16c]
cmp dword [ebp - 0x670], eax
je 0x1002e73b
mov dword [ebp - 0x460], 1
jmp 0x1002e742
and dword [ebp - 0x460], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov edx, dword [ebp - 0x460]
sub edx, dword [ebp - 0x11c]
add edx, dword [ebp + ecx - 0x16c]
cmp edx, dword [ebp + eax - 0x16c]
jg 0x1002e776
mov dword [ebp - 0x808], 1
jmp 0x1002e77d
and dword [ebp - 0x808], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x16c]
cmp eax, dword [ebp - 0x808]
jg 0x1002e79e
mov dword [ebp - 0x8e8], 1
jmp 0x1002e7a5
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xe20], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x16c]
mov dword [ebp - 0xd54], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xed0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x16c]
mov dword [ebp - 0xd5c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x16c], 0xfffffffb
jl 0x1002e7fd
mov dword [ebp - 0x468], 1
jmp 0x1002e804
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0xb9c], eax
push 3
lea ecx, [ebp - 0xc68]
call fcn.1001d532
mov byte [ebp - 4], 0xd
push 3
lea ecx, [ebp - 0xb60]
call fcn.1001d532
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x1b4], 0x7b6fe6d3
mov dword [ebp - 0x1f4], 0xfffffff9
mov dword [ebp - 0x798], 0x2777
mov dword [ebp - 0xb2c], 0x2b60d90c
mov dword [ebp - 0xe28], 0xfffffff8
mov dword [ebp - 0x908], 0xf849
mov dword [ebp - 0x1ac], 0
jmp 0x1002e887
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 2
jge 0x1002e8a3
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0x150], 1
jmp 0x1002e87a
push 0x9f7
push 0
lea eax, [ebp - 0xb60]
push eax
lea eax, [ebp - 0x1ac]
push eax
push 0x991
push 0
call fcn.1002d460
add esp, 0x18
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x150], 0xb919
je 0x1002e8e6
mov dword [ebp - 0x678], 1
jmp 0x1002e8ed
and dword [ebp - 0x678], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x150]
cmp dword [ebp - 0x678], eax
je 0x1002e90e
mov dword [ebp - 0x8f0], 1
jmp 0x1002e915
and dword [ebp - 0x8f0], 0
mov dword [ebp - 0x1b4], 0xfffffffb
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0xd64], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x150]
mov dword [ebp - 0xe98], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x150]
mov dword [ebp - 0xd6c], eax
cmp dword [ebp - 0x1f4], 0x7f5a
jne 0x1002e969
mov dword [ebp - 0x470], 1
jmp 0x1002e970
and dword [ebp - 0x470], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x150]
cmp eax, dword [ebp - 0x470]
je 0x1002e991
mov dword [ebp - 0x788], 1
jmp 0x1002e998
and dword [ebp - 0x788], 0
cmp dword [ebp - 0x788], 2
je 0x1002e9ad
mov dword [ebp - 0x478], 1
jmp 0x1002e9b4
and dword [ebp - 0x478], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x150]
cmp dword [ebp - 0x478], eax
jg 0x1002e9d5
mov dword [ebp - 0x680], 1
jmp 0x1002e9dc
and dword [ebp - 0x680], 0
cmp dword [ebp - 0x680], 0x969b
jne 0x1002e9f4
mov dword [ebp - 0x888], 1
jmp 0x1002e9fb
and dword [ebp - 0x888], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x150]
mov dword [ebp - 0x480], eax
push 1
lea ecx, [ebp - 0xb60]
call fcn.1001d5d0
mov ecx, dword [ebp - 0x480]
mov dword [eax], ecx
imul eax, dword [ebp - 0x480], 0x7bc7
sub eax, dword [ebp - 0x888]
je 0x1002ea72
push 0x3b19
push 0x66f3
push 0x74bd
push 0x545e
push 0x66a
lea eax, [ebp - 0x1f4]
push eax
push 0
push 0x42df
lea eax, [ebp - 0xb60]
push eax
push 1
call fcn.100272c1
add esp, 0x28
jmp 0x1002ef5f
mov dword [ebp - 0x184], 0xffffffff
mov dword [ebp - 0x3c8], 0x2ef5ead4
push 1
lea ecx, [ebp - 0xcd4]
call fcn.1001d532
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x900], 0xb6af4a9b
lea eax, [ebp - 0xe30]
push eax
push 0x433
push 0x7012
push 1
push 0x7b1f
push 0x63e1
lea eax, [ebp - 0xcd4]
push eax
push 0
push 0x3a5c
push 0x4f08
push 0x4a62
push 0x4654
push 0
push 0x7d64
push 0x6c6b
push 0x35fc
call fcn.100299dd
add esp, 0x40
mov byte [ebp - 0xfc], 0
movzx eax, byte [ebp - 0xfc]
test eax, eax
je 0x1002eb11
push 0
push 0
call fcn.1002c808
pop ecx
pop ecx
mov dword [ebp - 0x7a0], 0x130d
mov dword [ebp - 0xaac], 0x10009ff0
cmp dword [ebp - 0x7a0], 0x15e1
jle 0x1002ec0c
and dword [ebp - 0x324], 0
jmp 0x1002eb4b
mov eax, dword [ebp - 0x324]
inc eax
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0x3c26
jge 0x1002ec0c
and dword [ebp - 0x29c], 0
jmp 0x1002eb71
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0x197e
jge 0x1002ec07
and dword [ebp - 0x1ec], 0
jmp 0x1002eb97
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0x15da
jge 0x1002ec02
mov ecx, dword [ebp - 0x29c]
sub ecx, dword [ebp - 0x1ec]
mov eax, dword [ebp - 0x324]
sar eax, cl
cdq
mov dword [ebp - 0x9a4], eax
mov dword [ebp - 0x9a0], edx
push dword [ebp - 0x9a0]
push dword [ebp - 0x9a4]
lea ecx, [ebp - 0xfdc]
call fcn.1000d93a
pop ecx
pop ecx
mov dword [ebp - 0xaa4], eax
mov ecx, dword [ebp - 0xaa4]
call fcn.1001d2e1
push eax
call fcn.10050266
pop ecx
lea ecx, [ebp - 0xfdc]
call fcn.1001d2d7
jmp 0x1002eb8a
jmp 0x1002eb64
jmp 0x1002eb3e
push 9
pop eax
test eax, eax
je 0x1002ed98
cmp dword [ebp - 0x184], 0
jne 0x1002ed8c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x150], 1
jle 0x1002ec40
mov dword [ebp - 0x488], 1
jmp 0x1002ec47
and dword [ebp - 0x488], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x150]
cmp dword [ebp - 0x488], eax
jg 0x1002ec68
mov dword [ebp - 0x688], 1
jmp 0x1002ec6f
and dword [ebp - 0x688], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x150]
cmp dword [ebp - 0x688], eax
jl 0x1002ec90
mov dword [ebp - 0x490], 1
jmp 0x1002ec97
and dword [ebp - 0x490], 0
cmp dword [ebp - 0x490], 0
jl 0x1002ecac
mov dword [ebp - 0x790], 1
jmp 0x1002ecb3
and dword [ebp - 0x790], 0
cmp dword [ebp - 0x790], 7
je 0x1002ecc8
mov dword [ebp - 0x498], 1
jmp 0x1002eccf
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x498]
dec eax
dec eax
push 4
pop ecx
imul ecx, ecx, 0
cmp dword [ebp + ecx - 0x150], eax
jne 0x1002ecfb
mov eax, 0xb8a0
test eax, eax
je 0x1002ecfb
mov dword [ebp - 0x690], 1
jmp 0x1002ed02
and dword [ebp - 0x690], 0
cmp dword [ebp - 0x690], 0xffffffff
je 0x1002ed17
mov dword [ebp - 0x4a0], 1
jmp 0x1002ed1e
and dword [ebp - 0x4a0], 0
cmp dword [ebp - 0x4a0], 0xfffffffc
jle 0x1002ed33
mov dword [ebp - 0x810], 1
jmp 0x1002ed3a
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0x810], eax
jle 0x1002ed54
mov dword [ebp - 0x4a8], 1
jmp 0x1002ed5b
and dword [ebp - 0x4a8], 0
cmp dword [ebp - 0x4a8], 1
jge 0x1002ed70
mov dword [ebp - 0x698], 1
jmp 0x1002ed77
and dword [ebp - 0x698], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x150]
cmp dword [ebp - 0x698], eax
jne 0x1002ed98
mov dword [ebp - 0x4b0], 1
jmp 0x1002ed9f
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x798], eax
cmp dword [ebp - 0x798], 6
jge 0x1002edc0
mov dword [ebp - 0x4b8], 1
jmp 0x1002edc7
and dword [ebp - 0x4b8], 0
cmp dword [ebp - 0x4b8], 1
jne 0x1002eddc
mov dword [ebp - 0x6a0], 1
jmp 0x1002ede3
and dword [ebp - 0x6a0], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x6a0], eax
jge 0x1002edfd
mov dword [ebp - 0x4c0], 1
jmp 0x1002ee04
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x3c8]
add eax, 0x2f10
mov dword [ebp - 0x850], eax
push 0
lea ecx, [ebp - 0xcd4]
call fcn.1001d5d0
mov ecx, dword [ebp - 0x850]
mov dword [eax], ecx
mov eax, dword [ebp - 0x850]
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0xd74], eax
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0xec8], eax
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x8f8], eax
push 0
lea ecx, [ebp - 0xb60]
call fcn.1001d5d0
mov ecx, dword [ebp - 0x8f8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb2c]
mov dword [ebp - 0xd7c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x150]
neg eax
jne 0x1002eeaa
cmp dword [ebp - 0x3c8], 0
jne 0x1002eeaa
and dword [ebp - 0x4c8], 0
jmp 0x1002eeb4
mov dword [ebp - 0x4c8], 1
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x4c8], eax
jl 0x1002eece
mov dword [ebp - 0x6a8], 1
jmp 0x1002eed5
and dword [ebp - 0x6a8], 0
mov eax, dword [ebp - 0x184]
add eax, dword [ebp - 0x6a8]
cmp eax, dword [ebp - 0x1f4]
jle 0x1002eef5
mov dword [ebp - 0x4d0], 1
jmp 0x1002eefc
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x4d0]
mov dword [ebp - 0x900], eax
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x7a0], 0x1290
jge 0x1002ef24
push dword [ebp - 0xaac]
call fcn.10050266
pop ecx
jmp 0x1002ef40
mov dword [ebp - 4], 0xf
jmp 0x1002ef50
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xcd4]
call fcn.1001d5b4
push 0
push 0x3ac5
push 0x49e3
push 0x63f0
push 0
push 0x6fd9
push 0x3a77
push 0x4235
lea eax, [ebp - 0x908]
push eax
push 1
call fcn.10020b24
add esp, 0x28
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xb60]
call fcn.1001d5b4
mov dword [ebp - 0x630], 0xfffffffb
mov dword [ebp - 0x1a0], 0x9fdf99ff
mov dword [ebp - 0x3c4], 0x95e2de4b
mov dword [ebp - 0xe38], 0xfffffffe
mov dword [ebp - 0x1a0], 0x12
jmp 0x1002efe2
mov eax, dword [ebp - 0x1a0]
dec eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 4
jl 0x1002f31c
mov dword [ebp - 0x120], 0xbacd7953
mov dword [ebp - 0x3e0], 0xfffffffd
mov dword [ebp - 0x4d8], 0x1825
mov dword [ebp - 0xb90], 0x1000a04c
cmp dword [ebp - 0x4d8], 0x1bb0
jle 0x1002f0dd
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
and dword [ebp - 0x2fc], 0
jmp 0x1002f04b
mov eax, dword [ebp - 0x2fc]
inc eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0x43ae
jge 0x1002f0dd
and dword [ebp - 0x2a4], 0
jmp 0x1002f071
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0x53f5
jge 0x1002f0d8
and dword [ebp - 0x1fc], 0
jmp 0x1002f093
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0x675d
jge 0x1002f0d6
mov eax, dword [ebp - 0x2a4]
sub eax, dword [ebp - 0x1fc]
or eax, dword [ebp - 0x2fc]
cdq
mov dword [ebp - 0x9b0], eax
mov dword [ebp - 0x9ac], edx
push dword [ebp - 0x9ac]
push dword [ebp - 0x9b0]
mov ecx, 0x1060f618
call fcn.1001d301
jmp 0x1002f086
jmp 0x1002f064
jmp 0x1002f03e
mov dword [ebp - 0x4e0], 0
mov byte [ebp - 4], 0x12
cmp dword [ebp - 0x4d8], 0x1564
jge 0x1002f107
mov edx, dword [ebp - 0xb90]
mov ecx, 0x1060f618
call fcn.1001f80c
jmp 0x1002f123
mov dword [ebp - 4], 0xd
jmp 0x1002f133
mov dword [ebp - 0xd84], 7
push 3
lea ecx, [ebp - 0xc8c]
call fcn.1001d532
mov byte [ebp - 4], 0x14
push 0x39a7
push 0x1ac1
lea eax, [ebp - 0xc8c]
push eax
push 0
lea eax, [ebp - 0xdc8]
push eax
push 1
push 0x5ee6
call fcn.10021166
add esp, 0x1c
mov dword [ebp - 0x120], 0xffffffe2
jmp 0x1002f190
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xffffffe6
jne 0x1002f308
mov dword [ebp - 0x910], 0x9cf1
mov dword [ebp - 0x3d0], 4
mov dword [ebp - 0x204], 0
jmp 0x1002f1ca
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 3
jge 0x1002f1e6
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0xeec], 0xffffffff
jmp 0x1002f1bd
push 0
push 0x3492
lea eax, [ebp - 0x3d0]
push eax
lea eax, [ebp - 0x3c4]
push eax
lea eax, [ebp - 0x910]
push eax
push 0x4a12
push 0x1092
lea eax, [ebp - 0x120]
push eax
push 0
push 1
lea eax, [ebp - 0x3e0]
push eax
lea eax, [ebp - 0x1a0]
push eax
call fcn.10020429
add esp, 0x30
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0xd8c], eax
mov eax, dword [ebp - 0x3d0]
sub eax, dword [ebp - 0x3d0]
jne 0x1002f259
mov eax, 0x2ed5
test eax, eax
jne 0x1002f259
and dword [ebp - 0x3d8], 0
jmp 0x1002f263
mov dword [ebp - 0x3d8], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3d8]
mov dword [ebp + eax - 0xeec], ecx
mov eax, dword [ebp - 0x3d8]
inc eax
inc eax
cmp eax, dword [ebp - 0x120]
jg 0x1002f292
mov dword [ebp - 0x6b0], 1
jmp 0x1002f299
and dword [ebp - 0x6b0], 0
cmp dword [ebp - 0x6b0], 0
jbe 0x1002f2ae
mov dword [ebp - 0x818], 1
jmp 0x1002f2b5
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x4e0]
cmp eax, dword [ebp - 0x818]
je 0x1002f2e7
mov dword [ebp - 0x4e8], 1
jmp 0x1002f2ee
and dword [ebp - 0x4e8], 0
push 2
lea ecx, [ebp - 0xc8c]
call fcn.1001d5d0
mov ecx, dword [ebp - 0x4e8]
mov dword [eax], ecx
jmp 0x1002f183
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xc8c]
call fcn.1001d5b4
jmp 0x1002efd5
mov dword [ebp - 0x3cc], 9
mov dword [ebp - 0xa4], 0xfffffff6
mov dword [ebp - 0xb4], 0x80d4
mov dword [ebp - 0x3ac], 0x71808adc
mov dword [ebp - 0x518], 0xffffffff
mov dword [ebp - 0x520], 0xffffffff
mov dword [ebp - 0xab4], 2
mov dword [ebp - 0x918], 0xc25c5395
mov dword [ebp - 0x78], 0
jmp 0x1002f37c
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x1002f392
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xd04], 0x8700d35d
jmp 0x1002f375
mov dword [ebp - 0x78], 0
jmp 0x1002f3a2
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1002f3b8
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x500], 0xfffffff7
jmp 0x1002f39b
mov dword [ebp - 0xa4], 0
jmp 0x1002f3d1
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0xa
jge 0x1002f409
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x1002f407
push 0x3297
push 0x1adf
push 0
push 0
push 0x1262
call fcn.100355b3
add esp, 0x14
jmp 0x1002f3c4
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xdd0], eax
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0xb4]
jle 0x1002f42f
mov dword [ebp - 0x510], 1
jmp 0x1002f436
and dword [ebp - 0x510], 0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xd04], 1
xor eax, eax
inc eax
cmp eax, 0xffffffff
jl 0x1002f45a
mov dword [ebp - 0x6b8], 1
jmp 0x1002f461
and dword [ebp - 0x6b8], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x6b8], eax
je 0x1002f47b
mov dword [ebp - 0x4f0], 1
jmp 0x1002f482
and dword [ebp - 0x4f0], 0
cmp dword [ebp - 0x4f0], 0xb07d
jne 0x1002f49a
mov dword [ebp - 0x7a8], 1
jmp 0x1002f4a1
and dword [ebp - 0x7a8], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x7a8], eax
je 0x1002f4bb
mov dword [ebp - 0x4f8], 1
jmp 0x1002f4c2
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x4f8], eax
je 0x1002f4dc
mov dword [ebp - 0x374], 1
jmp 0x1002f4e3
and dword [ebp - 0x374], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x374]
mov dword [ebp + eax - 0x500], ecx
cmp dword [ebp - 0x374], 0
je 0x1002f508
mov eax, 0x589d
test eax, eax
jne 0x1002f529
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xd04], 0
jne 0x1002f529
mov eax, 0x511bd77d
test eax, eax
jne 0x1002f529
and dword [ebp - 0x6c0], 0
jmp 0x1002f533
mov dword [ebp - 0x6c0], 1
mov eax, dword [ebp - 0xb4]
sub eax, dword [ebp - 0x6c0]
je 0x1002f54f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x500], 0
cmp dword [ebp - 0xb4], 0x6200
jl 0x1002f567
mov dword [ebp - 0x870], 1
jmp 0x1002f56e
and dword [ebp - 0x870], 0
cmp dword [ebp - 0x870], 0xfffffff8
jle 0x1002f583
mov dword [ebp - 0x508], 1
jmp 0x1002f58a
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x3ac]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd04]
cmp eax, dword [ebp - 0x3ac]
jg 0x1002f5b1
mov dword [ebp - 0x6c8], 1
jmp 0x1002f5b8
and dword [ebp - 0x6c8], 0
mov eax, dword [ebp - 0x3ac]
cmp dword [ebp - 0x6c8], eax
jne 0x1002f5db
mov eax, 0x4325
test eax, eax
je 0x1002f5db
mov dword [ebp - 0x7b0], 1
jmp 0x1002f5e2
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x510]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x7b0]
mov dword [ebp - 0x518], eax
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x518]
jle 0x1002f614
mov dword [ebp - 0x6d0], 1
jmp 0x1002f61b
and dword [ebp - 0x6d0], 0
mov eax, dword [ebp - 0x6d0]
mov dword [ebp - 0x520], eax
mov eax, dword [ebp - 0x520]
cmp eax, dword [ebp - 0xab4]
jne 0x1002f641
mov dword [ebp - 0x820], 1
jmp 0x1002f648
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x918]
cmp dword [ebp - 0x820], eax
jne 0x1002f6a8
mov dword [ebp - 0xb34], 0xffffffff
mov byte [ebp - 0xfe], 0
push 0
push 0x4c4a
push 0x3b7c
push 0
lea eax, [ebp - 0xfe]
push eax
call fcn.1003ad70
add esp, 0x14
push 0
lea eax, [ebp - 0xa4]
push eax
push 0x3d37
lea eax, [ebp - 0xb34]
push eax
push 0x113b
call fcn.1003bc6f
add esp, 0x14
jmp 0x1002f6f4
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x1002f6cb
push 0
push 0x1f5e
push 1
call fcn.10020938
add esp, 0xc
mov byte [ebp - 0x100], 0
push 0
push 0
push 0x2640
push 0x1ed1
push 0x5592
lea eax, [ebp - 0x100]
push eax
call fcn.10020f52
add esp, 0x18
mov dword [ebp - 0x750], 0x96f8f9ed
mov dword [ebp - 0x620], 0x9ec0021f
mov dword [ebp - 0x2c], 0x824a8c6a
mov dword [ebp - 0x528], 0x3307
mov dword [ebp - 0x920], 0x1000a078
cmp dword [ebp - 0x528], 0x368c
jle 0x1002f812
and dword [ebp - 0x214], 0
jmp 0x1002f749
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0x488b
jge 0x1002f812
and dword [ebp - 0x2ac], 0
jmp 0x1002f76f
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0x7e8e
jge 0x1002f80d
and dword [ebp - 0x20c], 0
jmp 0x1002f795
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0x4291
jge 0x1002f808
and dword [ebp - 0x33c], 0
jmp 0x1002f7b7
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0x2895
jge 0x1002f806
mov eax, dword [ebp - 0x2ac]
cdq
idiv dword [ebp - 0x20c]
mov eax, edx
cdq
idiv dword [ebp - 0x33c]
mov eax, dword [ebp - 0x214]
sub eax, edx
cdq
mov dword [ebp - 0x9bc], eax
mov dword [ebp - 0x9b8], edx
push dword [ebp - 0x9b8]
push dword [ebp - 0x9bc]
mov ecx, 0x1060f618
call fcn.1001d301
jmp 0x1002f7aa
jmp 0x1002f788
jmp 0x1002f762
jmp 0x1002f73c
mov dword [ebp - 0x560], 2
mov byte [ebp - 4], 0x15
cmp dword [ebp - 0x528], 0x2f3b
jge 0x1002f83c
mov edx, dword [ebp - 0x920]
mov ecx, 0x1060f618
call fcn.1001f80c
jmp 0x1002f858
mov dword [ebp - 4], 0xd
jmp 0x1002f868
mov dword [ebp - 0x6d8], 0x75ef
mov dword [ebp - 0x928], 0x1000a0c8
cmp dword [ebp - 0x6d8], 0x7754
jle 0x1002f99a
and dword [ebp - 0x224], 0
jmp 0x1002f8a2
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0x464c
jge 0x1002f99a
and dword [ebp - 0x2b4], 0
jmp 0x1002f8c8
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 0x75fb
jge 0x1002f995
and dword [ebp - 0x21c], 0
jmp 0x1002f8ee
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 0x549b
jge 0x1002f990
and dword [ebp - 0x304], 0
jmp 0x1002f914
mov eax, dword [ebp - 0x304]
inc eax
mov dword [ebp - 0x304], eax
cmp dword [ebp - 0x304], 0x2a60
jge 0x1002f98b
mov eax, dword [ebp - 0x2b4]
cdq
idiv dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x304]
shl edx, cl
or edx, dword [ebp - 0x224]
mov eax, edx
cdq
mov dword [ebp - 0x9c8], eax
mov dword [ebp - 0x9c4], edx
push dword [ebp - 0x9c4]
push dword [ebp - 0x9c8]
lea ecx, [ebp - 0xf88]
call fcn.1000d93a
pop ecx
pop ecx
mov dword [ebp - 0xabc], eax
mov ecx, dword [ebp - 0xabc]
call fcn.1001d2e1
push eax
call fcn.10050266
pop ecx
lea ecx, [ebp - 0xf88]
call fcn.1001d2d7
jmp 0x1002f907
jmp 0x1002f8e1
jmp 0x1002f8bb
jmp 0x1002f895
mov byte [ebp - 4], 0x17
cmp dword [ebp - 0x6d8], 0x7441
jge 0x1002f9b6
push dword [ebp - 0x928]
call fcn.10050266
pop ecx
jmp 0x1002f9d2
mov dword [ebp - 4], 0xd
jmp 0x1002f9e2
mov dword [ebp - 0x68], 0
jmp 0x1002f9f2
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1002fa08
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0xdfc], 0xfffffffd
jmp 0x1002f9eb
mov dword [ebp - 0x68], 0
jmp 0x1002fa18
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x1002fa2e
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0xf58], 0x5156
jmp 0x1002fa11
mov dword [ebp - 0x2c], 0
jmp 0x1002fa3e
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffff5
je 0x1002fd13
mov dword [ebp - 0x548], 0xfffffff7
mov dword [ebp - 0x2bc], 0
jmp 0x1002fa6b
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 3
jge 0x1002fa87
mov eax, dword [ebp - 0x2bc]
mov dword [ebp + eax*4 - 0x894], 0x8900fdb6
jmp 0x1002fa5e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x894]
mov dword [ebp - 0xd94], eax
cmp dword [ebp - 0x2c], 0x1871
jle 0x1002faaf
mov dword [ebp - 0xb88], 1
jmp 0x1002fab6
and dword [ebp - 0xb88], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xdd8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xd9c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x894], 0
jne 0x1002faf1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x894], 0
jne 0x1002faf1
and dword [ebp - 0x530], 0
jmp 0x1002fafb
mov dword [ebp - 0x530], 1
cmp dword [ebp - 0x530], 0x8b4d
jle 0x1002fb13
mov dword [ebp - 0x7b8], 1
jmp 0x1002fb1a
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x7b8], eax
jle 0x1002fb35
push 7
pop eax
test eax, eax
jne 0x1002fb35
and dword [ebp - 0x538], 0
jmp 0x1002fb3f
mov dword [ebp - 0x538], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x538]
add ecx, 0xe327
cmp ecx, dword [ebp + eax - 0x894]
je 0x1002fb69
cmp dword [ebp - 0x2c], 0
jne 0x1002fb69
and dword [ebp - 0x6e0], 0
jmp 0x1002fb73
mov dword [ebp - 0x6e0], 1
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x6e0], eax
jge 0x1002fb8a
mov dword [ebp - 0x540], 1
jmp 0x1002fb91
and dword [ebp - 0x540], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x894]
cmp dword [ebp - 0x540], eax
je 0x1002fbb2
mov dword [ebp - 0x858], 1
jmp 0x1002fbb9
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x858]
je 0x1002fc0e
mov dword [ebp - 0xac4], 0xed383de4
mov dword [ebp - 0x930], 0xe0fa1a8f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x894], 0
je 0x1002fbed
jmp 0x1002fd13
lea eax, [ebp - 0x930]
push eax
push 0
push 1
push 0
lea eax, [ebp - 0xac4]
push eax
call fcn.1003a3fd
add esp, 0x14
jmp 0x1002fd0e
mov dword [ebp - 0x6e8], 0x1bd53d2a
mov dword [ebp - 0x938], 0xab0c3e5f
cmp dword [ebp - 0x2c], 0
je 0x1002fc6e
mov eax, dword [ebp - 0x6e8]
cmp eax, dword [ebp - 0x2c]
jl 0x1002fc3f
mov dword [ebp - 0x37c], 1
jmp 0x1002fc46
and dword [ebp - 0x37c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x37c]
mov dword [ebp + eax - 0xdfc], ecx
cmp dword [ebp - 0x37c], 0
je 0x1002fc6e
mov dword [ebp - 0x550], 1
jmp 0x1002fc75
and dword [ebp - 0x550], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x894]
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x548]
imul eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x6e8]
cmp dword [ebp - 0x550], eax
jge 0x1002fcad
mov dword [ebp - 0x7c0], 1
jmp 0x1002fcb4
and dword [ebp - 0x7c0], 0
cmp dword [ebp - 0x7c0], 0xffffffff
jge 0x1002fcc9
mov dword [ebp - 0x558], 1
jmp 0x1002fcd0
and dword [ebp - 0x558], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x894]
cmp eax, dword [ebp - 0x558]
jl 0x1002fcf1
mov dword [ebp - 0x6f0], 1
jmp 0x1002fcf8
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0x6f0]
mov dword [ebp - 0x560], eax
mov dword [ebp - 0x938], 0x1c5adf85
jmp 0x1002fa37
mov dword [ebp - 0x560], 0x40cc74bf
push 1
lea ecx, [ebp - 0xe54]
call fcn.1001d532
mov byte [ebp - 4], 0x19
push 2
lea ecx, [ebp - 0x768]
call fcn.1001d532
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0xb3c], 0xba4d3ec9
mov dword [ebp - 0x3d4], 0xfffffffe
push 0x1fa7
push 1
push 0x1a37
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0xe54]
push eax
push 0
call fcn.10020700
add esp, 0x18
mov dword [ebp - 0x18c], 0
jmp 0x1002fd90
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 2
jge 0x1002fdb2
push dword [ebp - 0x18c]
lea ecx, [ebp - 0x768]
call fcn.1001d5d0
mov dword [eax], 0x1f2c29a
jmp 0x1002fd83
push 0
lea ecx, [ebp - 0x768]
call fcn.1001d5d0
and dword [eax], 0
jmp 0x1002fde8
push 0
lea ecx, [ebp - 0x768]
call fcn.1001d5d0
mov dword [ebp - 0x828], eax
mov eax, dword [ebp - 0x828]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x828]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x768]
call fcn.1001d5d0
cmp dword [eax], 0
jl 0x1002fe22
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x1002fe20
push 0x7c0
push 0
push 0x50b3
call fcn.1003c662
add esp, 0xc
jmp 0x1002fdc4
push 1
lea ecx, [ebp - 0x768]
call fcn.1001d5d0
mov esi, dword [ebp - 0xb3c]
push 0
lea ecx, [ebp - 0x768]
call fcn.1001d5d0
cmp esi, dword [eax]
jl 0x1002fe52
mov dword [ebp - 0x568], 1
jmp 0x1002fe59
and dword [ebp - 0x568], 0
cmp dword [ebp - 0x3d4], 0
je 0x1002fe77
mov eax, 0xffff
test eax, eax
je 0x1002fe77
mov dword [ebp - 0x940], 1
jmp 0x1002fe7e
and dword [ebp - 0x940], 0
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0xde0], eax
mov esi, dword [ebp - 0x3d4]
push 0
lea ecx, [ebp - 0x768]
call fcn.1001d5d0
mov dword [eax], esi
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x768]
call fcn.1001d5b4
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xe54]
call fcn.1001d5b4
push 0x7b81
lea eax, [ebp - 0xb98]
push eax
push 0
lea eax, [ebp - 0x8a0]
push eax
push 0
call fcn.10020376
add esp, 0x14
mov dword [ebp - 0x6f8], 0x4ed
mov dword [ebp - 0x948], 0x1000a114
cmp dword [ebp - 0x6f8], 0x8b7
jle 0x1002ffa0
and dword [ebp - 0x22c], 0
jmp 0x1002ff16
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0x3d6b
jge 0x1002ffa0
and dword [ebp - 0x32c], 0
jmp 0x1002ff38
mov eax, dword [ebp - 0x32c]
inc eax
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0x5e58
jge 0x1002ff9b
mov eax, dword [ebp - 0x22c]
and eax, dword [ebp - 0x32c]
cdq
mov dword [ebp - 0x9d4], eax
mov dword [ebp - 0x9d0], edx
push dword [ebp - 0x9d0]
push dword [ebp - 0x9d4]
lea ecx, [ebp - 0x103c]
call fcn.1000d93a
pop ecx
pop ecx
mov dword [ebp - 0xacc], eax
mov ecx, dword [ebp - 0xacc]
call fcn.1001d2e1
push eax
call fcn.10050266
pop ecx
lea ecx, [ebp - 0x103c]
call fcn.1001d2d7
jmp 0x1002ff2b
jmp 0x1002ff09
push 4
lea ecx, [ebp - 0x8b8]
call fcn.1001d532
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x6f8], 0x208
jge 0x1002ffcd
push dword [ebp - 0x948]
call fcn.10050266
pop ecx
jmp 0x1002ffe9
mov dword [ebp - 4], 0x1b
jmp 0x1002fff9
mov dword [ebp - 0x88], 0
jmp 0x10030012
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x1003002e
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x7c8], 1
jmp 0x10030005
mov dword [ebp - 0x88], 0
jmp 0x10030047
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 4
jge 0x10030069
push dword [ebp - 0x88]
lea ecx, [ebp - 0x8b8]
call fcn.1001d5d0
mov dword [eax], 0xe83c773
jmp 0x1003003a
mov byte [ebp - 0x102], 0
movzx eax, byte [ebp - 0x102]
test eax, eax
je 0x10030092
push 0
push 0x2378
push 0x9bd
push 0x1faf
call dword [sym.imp.USER32.dll_SetScrollPos]
push 3
lea ecx, [ebp - 0x8b8]
call fcn.1001d5d0
and dword [eax], 0
jmp 0x100300c8
push 3
lea ecx, [ebp - 0x8b8]
call fcn.1001d5d0
mov dword [ebp - 0x570], eax
mov eax, dword [ebp - 0x570]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x570]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x8b8]
call fcn.1001d5d0
cmp dword [eax], 0
jl 0x1003011e
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x7c8]
push 3
lea ecx, [ebp - 0x8b8]
call fcn.1001d5d0
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x7c8], esi
mov byte [ebp - 0xd5], 0
push 0
push 1
lea eax, [ebp - 0xd5]
push eax
push 0x7e3
call fcn.10026858
add esp, 0x10
jmp 0x100300a4
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x8b8]
call fcn.1001d5b4
push 0x693a
push 0
push 0
lea eax, [ebp - 0xc68]
push eax
lea eax, [ebp - 0xb98]
push eax
call fcn.10026a50
add esp, 0x14
push 0
lea ecx, [ebp - 0x8a0]
call fcn.1001d5d0
and dword [eax], 0
jmp 0x10030182
push 0
lea ecx, [ebp - 0x8a0]
call fcn.1001d5d0
cmp dword [eax], 0xfffffff6
jge 0x100316af
mov dword [ebp - 0x700], 0x686a
mov dword [ebp - 0x950], 0x1000a150
cmp dword [ebp - 0x700], 0x687c
jle 0x10030297
and dword [ebp - 0x23c], 0
jmp 0x100301d2
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0x6733
jge 0x10030297
and dword [ebp - 0x30c], 0
jmp 0x100301f8
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0x3e9e
jge 0x10030292
and dword [ebp - 0x234], 0
jmp 0x1003021e
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0x14d7
jge 0x1003028d
and dword [ebp - 0x2c4], 0
jmp 0x10030240
mov eax, dword [ebp - 0x2c4]
inc eax
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0x6af
jge 0x1003028b
mov eax, dword [ebp - 0x234]
sub eax, dword [ebp - 0x2c4]
mov ecx, dword [ebp - 0x23c]
or ecx, dword [ebp - 0x30c]
or eax, ecx
cdq
mov dword [ebp - 0x9e0], eax
mov dword [ebp - 0x9dc], edx
push dword [ebp - 0x9dc]
push dword [ebp - 0x9e0]
mov ecx, 0x1060f618
call fcn.1001d301
jmp 0x10030233
jmp 0x10030211
jmp 0x100301eb
jmp 0x100301c5
mov dword [ebp - 0x138], 0x399841b3
mov byte [ebp - 4], 0x1e
cmp dword [ebp - 0x700], 0x64bb
jge 0x100302c1
mov edx, dword [ebp - 0x950]
mov ecx, 0x1060f618
call fcn.1001f80c
jmp 0x100302dd
mov dword [ebp - 4], 0xd
jmp 0x100302ed
mov dword [ebp - 0xadc], 0xd538770c
mov dword [ebp - 0xda4], 0x332e0c28
mov dword [ebp - 0xde8], 0
mov dword [ebp - 0xdac], 0xa227283a
mov dword [ebp - 0x138], 0
jmp 0x1003032e
mov eax, dword [ebp - 0x138]
dec eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0xfffffffc
je 0x100307df
mov dword [ebp - 0x1b0], 0xffffffff
mov dword [ebp - 0x588], 0xd0657689
mov dword [ebp - 0xdf0], 9
mov dword [ebp - 0x968], 0
cmp dword [ebp - 0x1b0], 0
je 0x1003077e
push 1
lea ecx, [ebp - 0xbe4]
call fcn.1001d532
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x708], 0x72b416c2
mov dword [ebp - 0x244], 0
jmp 0x100303a4
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 1
jge 0x100303c6
push dword [ebp - 0x244]
lea ecx, [ebp - 0xbe4]
call fcn.1001d5d0
mov dword [eax], 0x9c14
jmp 0x10030397
mov dword [ebp - 0x1b0], 0
jmp 0x100303df
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0x10
jl 0x10030755
mov dword [ebp - 0x194], 0x33c63384
mov dword [ebp - 0x194], 0x1a
jmp 0x1003040f
mov eax, dword [ebp - 0x194]
dec eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 0xffffffee
jge 0x10030750
mov dword [ebp - 0x3c], 0x42b48371
push 3
lea ecx, [ebp - 0xca4]
call fcn.1001d532
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x580], 0x33eb
mov dword [ebp - 0xad4], 0x1000a1e0
cmp dword [ebp - 0x580], 0x3616
jle 0x10030503
and dword [ebp - 0x2cc], 0
jmp 0x1003046e
mov eax, dword [ebp - 0x2cc]
inc eax
mov dword [ebp - 0x2cc], eax
cmp dword [ebp - 0x2cc], 0x39f9
jge 0x10030503
and dword [ebp - 0x24c], 0
jmp 0x10030494
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0x51a7
jge 0x100304fe
and dword [ebp - 0x34c], 0
jmp 0x100304b6
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0x6d6e
jge 0x100304fc
mov eax, dword [ebp - 0x2cc]
cdq
idiv dword [ebp - 0x24c]
or edx, dword [ebp - 0x34c]
mov eax, edx
cdq
mov dword [ebp - 0x9ec], eax
mov dword [ebp - 0x9e8], edx
push dword [ebp - 0x9e8]
push dword [ebp - 0x9ec]
mov ecx, 0x1060f618
call fcn.1001d301
jmp 0x100304a9
jmp 0x10030487
jmp 0x10030461
lea eax, [ebp - 0xca4]
push eax
push 0
lea eax, [ebp - 0xdb4]
push eax
push 0x5139
push 0
push 0x6995
call fcn.1003c5c3
add esp, 0x18
mov byte [ebp - 4], 0x22
cmp dword [ebp - 0x580], 0x31e1
jge 0x10030547
mov edx, dword [ebp - 0xad4]
mov ecx, 0x1060f618
call fcn.1001f80c
jmp 0x10030563
mov dword [ebp - 4], 0x21
jmp 0x10030573
mov dword [ebp - 0x880], 0x64b0
mov dword [ebp - 0xb44], 0x1000a254
cmp dword [ebp - 0x880], 0x65ec
jle 0x10030637
and dword [ebp - 0x254], 0
jmp 0x100305ad
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0x31db
jge 0x10030637
and dword [ebp - 0x2d4], 0
jmp 0x100305cf
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 0x70c3
jge 0x10030632
mov eax, dword [ebp - 0x254]
xor eax, dword [ebp - 0x2d4]
cdq
mov dword [ebp - 0x9f8], eax
mov dword [ebp - 0x9f4], edx
push dword [ebp - 0x9f4]
push dword [ebp - 0x9f8]
lea ecx, [ebp - 0xf34]
call fcn.1000d93a
pop ecx
pop ecx
mov dword [ebp - 0x958], eax
mov ecx, dword [ebp - 0x958]
call fcn.1001d2e1
push eax
call fcn.10050266
pop ecx
lea ecx, [ebp - 0xf34]
call fcn.1001d2d7
jmp 0x100305c2
jmp 0x100305a0
mov dword [ebp - 0x3c], 0
jmp 0x10030647
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x10030683
push 0x7e9f
push 0
push 1
lea eax, [ebp - 0x588]
push eax
push 1
push 0x40d0
call fcn.1002c679
add esp, 0x18
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xbe4]
call fcn.1001d5d0
cmp dword [eax], 0
je 0x10030681
jmp 0x10030640
jmp 0x10030640
mov byte [ebp - 4], 0x24
cmp dword [ebp - 0x880], 0x6400
jge 0x1003069f
push dword [ebp - 0xb44]
call fcn.10050266
pop ecx
jmp 0x100306bb
mov dword [ebp - 4], 0x21
jmp 0x100306cb
mov dword [ebp - 0x3c], 0xfffffff9
jmp 0x100306db
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x1c
jg 0x1003073c
mov dword [ebp - 0x960], 0xad901516
push 1
lea eax, [ebp - 0xbe4]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0x2241
push 0
push 0x7088
lea eax, [ebp - 0x588]
push eax
lea eax, [ebp - 0x960]
push eax
call fcn.100207ca
add esp, 0x28
mov esi, dword [ebp - 0x3c]
push 0
lea ecx, [ebp - 0xca4]
call fcn.1001d5d0
mov dword [eax], esi
jmp 0x100306d4
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xca4]
call fcn.1001d5b4
jmp 0x10030402
jmp 0x100303d2
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x708], eax
mov eax, dword [ebp - 0x708]
mov dword [ebp - 0xadc], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xbe4]
call fcn.1001d5b4
jmp 0x100307da
mov dword [ebp - 0xea8], 1
mov dword [ebp - 0xdd4], 0xe45a9172
mov dword [ebp - 0x25c], 0
jmp 0x100307ab
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 1
jge 0x100307c7
mov eax, dword [ebp - 0x25c]
mov dword [ebp + eax*4 - 0xe48], 0xfffffffb
jmp 0x1003079e
lea eax, [ebp - 0x968]
push eax
push 0
push 1
call fcn.10020df6
add esp, 0xc
jmp 0x10030321
mov dword [ebp - 0xcc], 9
mov dword [ebp - 0x9c], 0xfffffff6
mov dword [ebp - 0xbc], 0x80d4
mov dword [ebp - 0x3b4], 0x71808adc
mov dword [ebp - 0x720], 0xffffffff
mov dword [ebp - 0x860], 0xffffffff
mov dword [ebp - 0xb74], 2
mov dword [ebp - 0x970], 0xc25c5395
mov dword [ebp - 0x70], 0
jmp 0x1003083f
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x10030855
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xcec], 0x8700d35d
jmp 0x10030838
mov dword [ebp - 0x70], 0
jmp 0x10030865
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1003087b
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x830], 0xfffffff7
jmp 0x1003085e
mov dword [ebp - 0x9c], 0
jmp 0x10030894
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0xa
jge 0x100308b5
push 1
push 0xc76
push 0
push 0x10c5
call fcn.100362a5
add esp, 0x10
jmp 0x10030887
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xddc], eax
mov eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0xbc]
jle 0x100308db
mov dword [ebp - 0x7d8], 1
jmp 0x100308e2
and dword [ebp - 0x7d8], 0
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xcec], 1
xor eax, eax
inc eax
cmp eax, 0xffffffff
jl 0x10030906
mov dword [ebp - 0x590], 1
jmp 0x1003090d
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x590], eax
je 0x10030927
mov dword [ebp - 0x7d0], 1
jmp 0x1003092e
and dword [ebp - 0x7d0], 0
cmp dword [ebp - 0x7d0], 0xb07d
jne 0x10030946
mov dword [ebp - 0x598], 1
jmp 0x1003094d
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x598], eax
je 0x10030967
mov dword [ebp - 0x710], 1
jmp 0x1003096e
and dword [ebp - 0x710], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x710], eax
je 0x10030988
mov dword [ebp - 0x384], 1
jmp 0x1003098f
and dword [ebp - 0x384], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x384]
mov dword [ebp + eax - 0x830], ecx
cmp dword [ebp - 0x384], 0
je 0x100309b4
mov eax, 0x589d
test eax, eax
jne 0x100309d5
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xcec], 0
jne 0x100309d5
mov eax, 0x511bd77d
test eax, eax
jne 0x100309d5
and dword [ebp - 0x5a0], 0
jmp 0x100309df
mov dword [ebp - 0x5a0], 1
mov eax, dword [ebp - 0xbc]
sub eax, dword [ebp - 0x5a0]
je 0x100309fb
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x830], 0
cmp dword [ebp - 0xbc], 0x6200
jl 0x10030a13
mov dword [ebp - 0x5a8], 1
jmp 0x10030a1a
and dword [ebp - 0x5a8], 0
cmp dword [ebp - 0x5a8], 0xfffffff8
jle 0x10030a2f
mov dword [ebp - 0x718], 1
jmp 0x10030a36
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x3b4]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xcec]
cmp eax, dword [ebp - 0x3b4]
jg 0x10030a5d
mov dword [ebp - 0x5b0], 1
jmp 0x10030a64
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x3b4]
cmp dword [ebp - 0x5b0], eax
jne 0x10030a87
mov eax, 0x4325
test eax, eax
je 0x10030a87
mov dword [ebp - 0x5b8], 1
jmp 0x10030a8e
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x5b8]
mov dword [ebp - 0x720], eax
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x720]
jle 0x10030ac0
mov dword [ebp - 0x5c0], 1
jmp 0x10030ac7
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x5c0]
mov dword [ebp - 0x860], eax
mov eax, dword [ebp - 0x860]
cmp eax, dword [ebp - 0xb74]
jne 0x10030aed
mov dword [ebp - 0x5c8], 1
jmp 0x10030af4
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x970]
cmp dword [ebp - 0x5c8], eax
jne 0x10030b4b
mov dword [ebp - 0xae4], 0xffffffff
push 0x32d8
push 0x11d
push 0x328c
push 0
push 0x1aa4
push 0x24ca
push 1
push 0x6ab9
push 0
push 0x3e06
call fcn.10027103
add esp, 0x28
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xae4], eax
jmp 0x10030b98
mov byte [ebp - 0x104], 0
push 0
push 0xcda
push 0
push 0x7f2
lea eax, [ebp - 0x104]
push eax
call fcn.1002924c
add esp, 0x14
mov byte [ebp - 0xdd], 0
push 0x385b
push 0
push 1
push 0x7a29
lea eax, [ebp - 0xdd]
push eax
push 0x1450
call fcn.1002c879
add esp, 0x18
push 1
lea ecx, [ebp - 0xc50]
call fcn.1001d532
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x5d0], 0x439beb06
mov dword [ebp - 0xebc], 0x265ab3e9
push 1
lea ecx, [ebp - 0xe64]
call fcn.1001d532
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x984], 0x1bc383c6
mov dword [ebp - 0xde4], 0xfffffff7
mov dword [ebp - 0xc4], 0x813bf58a
mov dword [ebp - 0x7e0], 0x8cbdb62b
mov dword [ebp - 0x80], 0
jmp 0x10030c06
cmp dword [ebp - 0x80], 1
jge 0x10030c22
push dword [ebp - 0x80]
lea ecx, [ebp - 0xe64]
call fcn.1001d5d0
mov dword [eax], 0xfffffff7
jmp 0x10030bff
mov dword [ebp - 0x728], 0x64a6
mov dword [ebp - 0xb4c], 0x1000a290
cmp dword [ebp - 0x728], 0x676d
jle 0x10030ce6
mov dword [ebp - 0x3bc], 0xe6768459
mov dword [ebp - 0x4c], 0
jmp 0x100316c9
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x100316df
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xe84], 1
jmp 0x100316c2
mov dword [ebp - 0x4c], 0
jmp 0x100316ef
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x10031705
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xbb4], 0xffffffff
jmp 0x100316e8
mov byte [ebp - 0xe5], 0
movzx eax, byte [ebp - 0xe5]
test eax, eax
je 0x10031732
push 0x63f6
push 0x7553
push 0
push 1
push 0x2d5d
call fcn.100209bb
add esp, 0x14
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xbb4], 0
jmp 0x10031760
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xbb4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xbb4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xbb4], 2
jg 0x10031a8d
mov dword [ebp - 0x94], 0x54fddd3f
mov dword [ebp - 0x98], 0x2542
mov dword [ebp - 0x94], 0
jmp 0x100317a1
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jg 0x10031a14
mov dword [ebp - 0x394], 0xc3d4e703
push 3
lea ecx, [ebp - 0xc5c]
call fcn.1001d532
mov byte [ebp - 4], 0x2e
mov dword [ebp - 0x414], 0x4252
mov dword [ebp - 0xb54], 0x1000a2c8
cmp dword [ebp - 0x414], 0x4619
jle 0x1003188d
and dword [ebp - 0x274], 0
jmp 0x10031803
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0x4a35
jge 0x1003188d
and dword [ebp - 0x2e4], 0
jmp 0x10031825
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0x271b
jge 0x10031888
mov eax, dword [ebp - 0x274]
xor eax, dword [ebp - 0x2e4]
cdq
mov dword [ebp - 0xa10], eax
mov dword [ebp - 0xa0c], edx
push dword [ebp - 0xa0c]
push dword [ebp - 0xa10]
lea ecx, [ebp - 0xf4c]
call fcn.1000d93a
pop ecx
pop ecx
mov dword [ebp - 0x9a8], eax
mov ecx, dword [ebp - 0x9a8]
call fcn.1001d2e1
push eax
call fcn.10050266
pop ecx
lea ecx, [ebp - 0xf4c]
call fcn.1001d2d7
jmp 0x10031818
jmp 0x100317f6
mov byte [ebp - 4], 0x2f
cmp dword [ebp - 0x414], 0x413c
jge 0x100318a9
push dword [ebp - 0xb54]
call fcn.10050266
pop ecx
jmp 0x100318c5
mov dword [ebp - 4], 0x2e
jmp 0x100318d5
push 0
lea eax, [ebp - 0xe08]
push eax
push 0x4d1a
push 0x4355
push 0x4afd
push 0x5244
lea eax, [ebp - 0xc5c]
push eax
push 0x24c7
push 1
push 1
push 0x281b
push 0x18b3
call fcn.10020429
add esp, 0x30
cmp dword [ebp - 0x394], 0
jne 0x10031950
cmp dword [ebp - 0x98], 1
jge 0x10031932
mov dword [ebp - 0x41c], 1
jmp 0x10031939
and dword [ebp - 0x41c], 0
imul eax, dword [ebp - 0x41c], 0xa47c
test eax, eax
jne 0x10031950
and dword [ebp - 0x424], 0
jmp 0x1003195a
mov dword [ebp - 0x424], 1
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x394]
add eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x98]
jl 0x1003198a
xor eax, eax
je 0x1003198a
mov dword [ebp - 0x42c], 1
jmp 0x10031991
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x42c], eax
jne 0x100319ab
mov dword [ebp - 0x434], 1
jmp 0x100319b2
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp + eax*4 - 0xe84]
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x43c]
mov dword [ebp + eax*4 - 0xe84], ecx
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x3bc], eax
mov esi, dword [ebp - 0x3bc]
imul esi, dword [ebp - 0x43c]
push 2
lea ecx, [ebp - 0xc5c]
call fcn.1001d5d0
mov dword [eax], esi
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xc5c]
call fcn.1001d5b4
jmp 0x10031794
mov dword [ebp - 0x98], 0
jmp 0x10031a2d
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xd
jle 0x10031a88
mov dword [ebp - 0xb04], 0x8a99
mov dword [ebp - 0x9b4], 0xffffffff
push 0
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x9b4]
push eax
push 0x38ea
push 0x5ebc
lea eax, [ebp - 0xb04]
push eax
push 0x6b6d
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x3bc]
push eax
call fcn.1003896a
add esp, 0x24
jmp 0x10031a20
jmp 0x10031745
mov byte [ebp - 0x10a], 0
mov dword [ebp - 0x1a8], 0xfffffff8
mov byte [ebp - 0x108], 0
movzx eax, byte [ebp - 0x108]
test eax, eax
je 0x10031ac6
push 0
push 0x28b0
push 0
push 0x3366
call fcn.1003a267
add esp, 0x10
mov dword [ebp - 0x1a8], 3
jmp 0x10031adf
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0x1c
jne 0x10031ba5
push 1
lea ecx, [ebp - 0xb70]
call fcn.1001d532
mov byte [ebp - 4], 0x31
push 0x4ad0
push 1
lea eax, [ebp - 0xe78]
push eax
push 0x5983
push 0
lea eax, [ebp - 0xb70]
push eax
push 0x5cc1
push 0x3889
push 0x39b6
push 0x1622
push 0
push 0x17d0
call fcn.10026638
add esp, 0x30
push 0
lea ecx, [ebp - 0xb70]
call fcn.1001d5d0
and dword [eax], 0
jmp 0x10031b72
push 0
lea ecx, [ebp - 0xb70]
call fcn.1001d5d0
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x444]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x444]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xb70]
call fcn.1001d5d0
cmp dword [eax], 0xffffffff
jle 0x10031b91
cmp dword [ebp - 0x1a8], 0
je 0x10031b8f
jmp 0x10031b91
jmp 0x10031b4e
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xb70]
call fcn.1001d5b4
jmp 0x10031ad2
movzx eax, byte [ebp - 0x10a]
test eax, eax
je 0x10031bb8
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xc68]
call fcn.1001d5b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8a0]
call fcn.1001d5b4
push 1
lea ecx, [ebp - 0x160]
call fcn.1001d532
mov dword [ebp - 4], 0x32
mov dword [ebp - 0x64], 2
mov dword [ebp - 0x39c], 0xceef
mov dword [ebp - 0x44c], 0x43af
mov dword [ebp - 0x9c0], 0x1000a358
cmp dword [ebp - 0x44c], 0x45c5
jle 0x10031c92
and dword [ebp - 0x27c], 0
jmp 0x10031c31
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0xe6c
jge 0x10031c92
and dword [ebp - 0x31c], 0
jmp 0x10031c53
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x31c], 0x1865
jge 0x10031c90
mov eax, dword [ebp - 0x27c]
sub eax, dword [ebp - 0x31c]
cdq
mov dword [ebp - 0xa1c], eax
mov dword [ebp - 0xa18], edx
push dword [ebp - 0xa18]
push dword [ebp - 0xa1c]
mov ecx, 0x1060f618
call fcn.1001d301
jmp 0x10031c46
jmp 0x10031c24
mov dword [ebp - 0x5c], 0
jmp 0x10031ca2
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x10031cb8
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x368], 0
jmp 0x10031c9b
mov byte [ebp - 4], 0x33
cmp dword [ebp - 0x44c], 0x4212
jge 0x10031cd8
mov edx, dword [ebp - 0x9c0]
mov ecx, 0x1060f618
call fcn.1001f80c
jmp 0x10031cf4
mov dword [ebp - 4], 0x32
jmp 0x10031d04
mov dword [ebp - 0x5c], 0
jmp 0x10031d14
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x10031d30
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x160]
call fcn.1001d5d0
mov dword [eax], 0x3f4f46db
jmp 0x10031d0d
push 0
lea ecx, [ebp - 0x160]
call fcn.1001d5d0
mov dword [eax], 2
jmp 0x10031d69
push 0
lea ecx, [ebp - 0x160]
call fcn.1001d5d0
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x454]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x454]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x160]
call fcn.1001d5d0
cmp dword [eax], 0
jl 0x10031fd8
mov dword [ebp - 0xb0c], 0xcbfcf419
mov dword [ebp - 0x64], 0xffffffff
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x10031f82
push 0
lea ecx, [ebp - 0x160]
call fcn.1001d5d0
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x368], 0
jne 0x10031ec4
mov esi, dword [ebp - 0x64]
push 0
lea ecx, [ebp - 0x160]
call fcn.1001d5d0
imul esi, dword [eax]
mov dword [ebp - 0x64], esi
push 0
lea ecx, [ebp - 0x160]
call fcn.1001d5d0
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x368]
push 0
lea ecx, [ebp - 0x160]
call fcn.1001d5d0
mov eax, dword [eax]
mov ecx, dword [ebp - 0x64]
imul ecx, dword [ebp + eax*4 - 0x368]
cmp ecx, esi
jge 0x10031e0e
mov dword [ebp - 0x45c], 1
jmp 0x10031e15
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x39c]
cmp dword [ebp - 0x45c], eax
jne 0x10031e3a
push 0
lea ecx, [ebp - 0x160]
call fcn.1001d5d0
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x368], 0
push 0
lea ecx, [ebp - 0x160]
call fcn.1001d5d0
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x368]
push 0
lea ecx, [ebp - 0x160]
call fcn.1001d5d0
cmp dword [eax], esi
jne 0x10031e6d
mov dword [ebp - 0x464], 1
jmp 0x10031e74
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x464]
sub eax, 0x508d4a8e
je 0x10031e96
cmp dword [ebp - 0x39c], 0
je 0x10031e96
mov dword [ebp - 0x46c], 1
jmp 0x10031e9d
and dword [ebp - 0x46c], 0
push 0
lea ecx, [ebp - 0x160]
call fcn.1001d5d0
mov eax, dword [eax]
mov ecx, dword [ebp - 0x46c]
sub ecx, dword [ebp + eax*4 - 0x368]
jne 0x10031ec4
and dword [ebp - 0xb8c], 0
jmp 0x10031ece
mov dword [ebp - 0xb8c], 1
push 0
lea ecx, [ebp - 0x160]
call fcn.1001d5d0
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x368]
mov dword [ebp - 0xe10], eax
push 0
lea ecx, [ebp - 0x160]
call fcn.1001d5d0
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x368]
push 0
lea ecx, [ebp - 0x160]
call fcn.1001d5d0
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x368], esi
jl 0x10031f24
mov dword [ebp - 0x474], 1
jmp 0x10031f2b
and dword [ebp - 0x474], 0
push 0
lea ecx, [ebp - 0x160]
call fcn.1001d5d0
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x368]
cmp dword [ebp - 0x474], eax
je 0x10031f55
mov dword [ebp - 0x47c], 1
jmp 0x10031f5c
and dword [ebp - 0x47c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x368]
imul eax, dword [ebp - 0x47c]
cmp eax, 0x5b042041
jle 0x10031f82
mov dword [ebp - 0x9cc], 1
jmp 0x10031f89
and dword [ebp - 0x9cc], 0
push 0
lea ecx, [ebp - 0x160]
call fcn.1001d5d0
push 0
lea ecx, [ebp - 0x160]
call fcn.1001d5d0
mov eax, dword [eax]
mov ecx, 0x5d872072
inc ecx
cmp ecx, dword [ebp + eax*4 - 0x368]
jne 0x10031fc0
mov dword [ebp - 0x484], 1
jmp 0x10031fc7
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0xb0c], eax
jmp 0x10031d45
mov dword [ebp - 0x64], 0
jmp 0x10031fe8
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jg 0x10032049
push 0x4129
lea eax, [ebp - 0x39c]
push eax
lea eax, [ebp - 0x64]
push eax
push 0
lea eax, [ebp - 0x160]
push eax
push 0x6fa2
push 0x1e33
push 0x12d9
call fcn.10039a8d
add esp, 0x20
mov byte [ebp - 0x103], 0
push 0
lea eax, [ebp - 0x103]
push eax
push 0x7ba1
push 0x1376
push 0
push 0x48f5
call fcn.1003bab6
add esp, 0x18
jmp 0x10031fe1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.1001d5b4
push 4
push 0x1000
push dword [ebp - 0x398]
mov eax, dword [ebp - 0x83c]
mov ecx, dword [ebp - 0x9d8]
add ecx, dword [eax + 0xc]
push ecx
push 0x5f29
push 0x8b0f
call fcn.1004442c
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x3a0]
mov dword [ecx], eax
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x20], 0xffbefa5f
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28c], 1
mov dword [ebp - 0x284], 0
jmp 0x100320c8
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 1
jge 0x100320e4
mov eax, dword [ebp - 0x284]
mov dword [ebp + eax*4 - 0x128], 0x574b
jmp 0x100320bb
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xd30], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jl 0x10032101
mov dword [ebp - 0x48c], 1
jmp 0x10032108
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xd38], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xd40], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xaa53f0d3
ja 0x1003213e
mov dword [ebp - 0x494], 1
jmp 0x10032145
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x494], eax
jg 0x1003215c
mov dword [ebp - 0x3e4], 1
jmp 0x10032163
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x3e4], eax
jge 0x1003217a
mov dword [ebp - 0x4a4], 1
jmp 0x10032181
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x4a4]
neg eax
sub eax, 0xe0fc
cmp eax, dword [ebp - 0x20]
jg 0x1003219f
mov dword [ebp - 0x4ac], 1
jmp 0x100321a6
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xd48], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xd50], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xd58], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + eax - 0x128]
jne 0x100321e8
jmp 0x10035385
push 1
call fcn.100294e0
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret