Function at 0x1003f3b6
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006e819
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x240
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1004036a
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x154], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
movzx eax, byte [eax]
test eax, eax
je 0x1003f48b
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x38]
mov dword [eax], 0
jmp 0x1003f466
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
mov eax, dword [ebp - 0x38]
cmp dword [eax], 3
jge 0x1003f486
mov eax, dword [ebp - 0x38]
push dword [eax]
mov ecx, dword [ebp - 0x12c]
call fcn.10018487
mov dword [eax], 0x8bfa0855
jmp 0x1003f45b
jmp 0x10040368
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x13c]
add ecx, dword [eax]
mov dword [ebp - 0xfc], ecx
mov dword [ebp - 0x20], 0xac204e2
mov dword [ebp - 0x130], 0xa36042c8
push 3
lea ecx, [ebp - 0x1e4]
call fcn.100183ab
and dword [ebp - 4], 0
mov dword [ebp - 0xf8], 0x505c00d4
mov dword [ebp - 0x18c], 0x6b8cc39b
mov dword [ebp - 0x20c], 0x81dc493
mov dword [ebp - 0x178], 0x69acb3b3
mov dword [ebp - 0x44], 0
jmp 0x1003f519
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x1003f535
push dword [ebp - 0x44]
lea ecx, [ebp - 0x1e4]
call fcn.10018487
mov dword [eax], 1
jmp 0x1003f512
mov dword [ebp - 0x20], 9
jmp 0x1003f545
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 7
jne 0x1003f651
mov dword [ebp - 0x4c], 9
mov dword [ebp - 0x144], 0x5fa2ef70
mov dword [ebp - 0x64], 0
jmp 0x1003f570
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1003f586
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x228], 0xfffb
jmp 0x1003f569
mov dword [ebp - 0x4c], 0
jmp 0x1003f596
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x1003f64c
push 1
lea ecx, [ebp - 0x164]
call fcn.100183ab
mov byte [ebp - 4], 1
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x70], 0
jmp 0x1003f5cb
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1003f5e4
push dword [ebp - 0x70]
lea ecx, [ebp - 0x164]
call fcn.10018487
or dword [eax], 0xffffffff
jmp 0x1003f5c4
push 0
lea ecx, [ebp - 0x164]
call fcn.10018487
and dword [eax], 0
jmp 0x1003f61a
push 0
lea ecx, [ebp - 0x164]
call fcn.10018487
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xe0]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x164]
call fcn.10018487
cmp dword [eax], 0
jg 0x1003f638
mov dword [ebp - 0x144], 1
jmp 0x1003f5f6
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x164]
call fcn.1001845c
jmp 0x1003f58f
jmp 0x1003f53e
mov dword [ebp - 0x20], 0
jmp 0x1003f661
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe7
je 0x1003f78d
mov dword [ebp - 0x16c], 0xfffffffd
push 3
lea ecx, [ebp - 0x1fc]
call fcn.100183ab
mov byte [ebp - 4], 2
mov dword [ebp - 0x128], 1
mov dword [ebp - 0x174], 0xffffffff
push 1
lea ecx, [ebp - 0x208]
call fcn.100183ab
mov byte [ebp - 4], 3
mov dword [ebp - 0x214], 0x74591f80
push 0x381d
push 0
push 0
lea eax, [ebp - 0x120]
push eax
push 0x7f5e
push 0x3570
push 0x1000
lea eax, [ebp - 0x1fc]
push eax
call fcn.10034800
add esp, 0x20
push 0
push 0
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x120]
push eax
push 0x52d6
push 0x10c0
call fcn.10040517
add esp, 0x18
push 0
lea eax, [ebp - 0x18c]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x1fc]
push eax
call fcn.100417c9
add esp, 0x2c
push 0x6e86
lea eax, [ebp - 0x178]
push eax
push 0
call fcn.1004104a
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x208]
call fcn.1001845c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1fc]
call fcn.1001845c
jmp 0x1003f65a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1e4]
call fcn.1001845c
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
add eax, 8
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x6c], 2
mov dword [ebp - 0x54], 0
jmp 0x1003f7be
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x1003f7d4
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x24c], 0xac8b
jmp 0x1003f7b7
mov byte [ebp - 0x27], 0
movzx eax, byte [ebp - 0x27]
test eax, eax
je 0x1003f7ee
push 0x282b
push 0
call fcn.10040da4
pop ecx
pop ecx
mov dword [ebp - 0x6c], 0
jmp 0x1003f7fe
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jg 0x1003f828
mov byte [ebp - 0x29], 0
movzx eax, byte [ebp - 0x29]
test eax, eax
je 0x1003f826
push 0x4a13
push 0x497a
push 0
push 0
call fcn.1003e999
add esp, 0x10
jmp 0x1003f7f7
and dword [ebp - 0x74], 0
jmp 0x1003f83d
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x60]
inc eax
inc eax
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov eax, dword [eax + 4]
sub eax, 8
shr eax, 1
cmp dword [ebp - 0x74], eax
jae 0x10040356
and dword [ebp - 0x1d8], 0
and dword [ebp - 0x1d4], 0
and dword [ebp - 0x1d0], 0
and dword [ebp - 0x1cc], 0
lea ecx, [ebp - 0x79]
call fcn.100184bc
push eax
lea eax, [ebp - 0x1c8]
push eax
lea eax, [ebp - 0x1d8]
push eax
lea ecx, [ebp - 0x23c]
call fcn.100184bf
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1b4]
call fcn.10018496
mov dword [ebp - 4], 4
mov dword [ebp - 0x22c], 0x1b55e973
mov dword [ebp - 0x140], 0
push 0
lea ecx, [ebp - 0x1b4]
call fcn.10018487
mov dword [eax], 0x19
jmp 0x1003f8f5
push 0
lea ecx, [ebp - 0x1b4]
call fcn.10018487
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xc4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1b4]
call fcn.10018487
cmp dword [eax], 0xfffffffc
jne 0x1003fba4
mov dword [ebp - 0x1c4], 0xc7555b7c
mov dword [ebp - 0x1c0], 0xc7555b7c
mov dword [ebp - 0x1bc], 0xc7555b7c
mov dword [ebp - 0x1b8], 0xc7555b7c
mov dword [ebp - 0x5c], 0
jmp 0x1003f943
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x1003f959
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x188], 4
jmp 0x1003f93c
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x188], 3
jmp 0x1003f984
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x188]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x188], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x188], 0
jl 0x1003fb8c
push 1
lea ecx, [ebp - 0xf4]
call fcn.100183ab
mov byte [ebp - 4], 5
mov dword [ebp - 0x3c], 0
jmp 0x1003f9b8
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1003f9d4
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xf4]
call fcn.10018487
mov dword [eax], 0x89a69576
jmp 0x1003f9b1
push 0
lea ecx, [ebp - 0xf4]
call fcn.10018487
mov dword [eax], 3
jmp 0x1003fa0d
push 0
lea ecx, [ebp - 0xf4]
call fcn.10018487
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xe8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xf4]
call fcn.10018487
cmp dword [eax], 0
jl 0x1003fb4e
push 3
lea ecx, [ebp - 0x19c]
call fcn.100183ab
mov byte [ebp - 4], 6
push 0x7183
push 1
push 0x7d8b
lea eax, [ebp - 0x19c]
push eax
push 1
push 0
push 0x72d3
lea eax, [ebp - 0x230]
push eax
call fcn.1003cbc5
add esp, 0x20
push 0
lea ecx, [ebp - 0x19c]
call fcn.10018487
mov dword [eax], 3
jmp 0x1003fa98
push 0
lea ecx, [ebp - 0x19c]
call fcn.10018487
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x98]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x19c]
call fcn.10018487
cmp dword [eax], 0
jl 0x1003fb3a
mov dword [ebp - 0x40], 8
push 0
push 1
push 0x7642
call fcn.1003ed56
add esp, 0xc
mov dword [ebp - 0x40], 0
jmp 0x1003fad6
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jg 0x1003fb35
mov byte [ebp - 0x22], 0
movzx eax, byte [ebp - 0x22]
test eax, eax
je 0x1003fb10
push 0
push 0x6d4
push 0x502
push 0xaa1
push 0x1640
push 0x198e
push 0x13e4
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov byte [ebp - 0x24], 0
movzx eax, byte [ebp - 0x24]
test eax, eax
je 0x1003fb33
push 0x23eb
push 0
push 0x1027
push 0x16f9
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
jmp 0x1003facf
jmp 0x1003fa74
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x19c]
call fcn.1001845c
jmp 0x1003f9e9
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x188]
cmp dword [ebp + eax*4 - 0x1c4], 0
je 0x1003fb78
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xf4]
call fcn.1001845c
jmp 0x1003f96b
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xf4]
call fcn.1001845c
jmp 0x1003f96b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1c4]
mov dword [ebp - 0x140], eax
jmp 0x1003f8d1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b4]
call fcn.1001845c
mov dword [ebp - 0x10], 0x8a137b18
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x34], 0x3274
mov dword [ebp - 0x18], 0xc2da8afc
push 2
lea ecx, [ebp - 0x1a8]
call fcn.100183ab
mov dword [ebp - 4], 7
mov dword [ebp - 0xdc], 1
mov dword [ebp - 0x170], 0xe3aa9c1c
push 1
push 0
push 0x36b5
push 0x1113
lea eax, [ebp - 0x234]
push eax
push 0x753
lea eax, [ebp - 0x1a8]
push eax
call fcn.1003d323
add esp, 0x1c
cmp dword [ebp - 0x10], 0
je 0x1003fc38
cmp dword [ebp - 0x14], 0xfffffff6
je 0x1003fc38
mov dword [ebp - 0xc0], 1
jmp 0x1003fc3f
and dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0x10]
neg eax
cmp dword [ebp - 0xc0], eax
jle 0x1003fc58
mov dword [ebp - 0xa0], 1
jmp 0x1003fc5f
and dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0xa0], eax
je 0x1003fd6d
mov dword [ebp - 0x14], 0xffffffec
jmp 0x1003fc7e
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1b
jl 0x1003fcee
mov dword [ebp - 0x148], 1
mov dword [ebp - 0x34], 0xffffffe9
jmp 0x1003fc9e
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x3b
jl 0x1003fcc8
mov dword [ebp - 0x190], 3
push 0
lea eax, [ebp - 0x190]
push eax
push 0x495a
push 1
call fcn.1003433b
add esp, 0x10
jmp 0x1003fc97
push 0x4882
push 1
lea eax, [ebp - 0x148]
push eax
push 0
push 0x605f
push 1
push 0x2e02
call fcn.1003e77e
add esp, 0x1c
jmp 0x1003fc77
mov dword [ebp - 0x14], 1
jmp 0x1003fcfe
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1003fd68
mov dword [ebp - 0x10], 0
jmp 0x1003fd14
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jg 0x1003fd51
mov dword [ebp - 0x18], 0
jmp 0x1003fd2a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jg 0x1003fd4f
mov byte [ebp - 0x26], 0
movzx eax, byte [ebp - 0x26]
test eax, eax
je 0x1003fd4d
push 0x63e4
push 1
push 0
call fcn.1003bb63
add esp, 0xc
jmp 0x1003fd23
jmp 0x1003fd0d
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1a8]
call fcn.10018487
cmp dword [eax], 0
je 0x1003fd66
jmp 0x1003fd68
jmp 0x1003fcf7
jmp 0x1003fe97
mov dword [ebp - 0x78], 0xe4ed383d
push 1
lea ecx, [ebp - 0x1f0]
call fcn.100183ab
mov byte [ebp - 4], 8
mov dword [ebp - 0x48], 0
jmp 0x1003fd95
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x1003fdb1
push dword [ebp - 0x48]
lea ecx, [ebp - 0x1f0]
call fcn.10018487
mov dword [eax], 0xe141b6ba
jmp 0x1003fd8e
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x10], eax
jl 0x1003fdc5
mov dword [ebp - 0xcc], 1
jmp 0x1003fdcc
and dword [ebp - 0xcc], 0
mov eax, 0xbe2d3d47
test eax, eax
je 0x1003fe0d
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xe4], eax
push 0
lea ecx, [ebp - 0x1f0]
call fcn.10018487
mov ecx, dword [ebp - 0xe4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xdc]
add eax, dword [ebp - 0xe4]
je 0x1003fe0d
mov dword [ebp - 0xa8], 1
jmp 0x1003fe14
and dword [ebp - 0xa8], 0
mov eax, dword [ebp - 0xa8]
sub eax, dword [ebp - 0x78]
jne 0x1003fe2b
mov dword [ebp - 0xb0], 1
jmp 0x1003fe32
and dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0xcc]
neg eax
cmp eax, dword [ebp - 0xb0]
jge 0x1003fe54
mov eax, 0xd2ae
test eax, eax
jne 0x1003fe54
and dword [ebp - 0xb8], 0
jmp 0x1003fe5e
mov dword [ebp - 0xb8], 1
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0xb8]
jge 0x1003fe78
mov dword [ebp - 0xd4], 1
jmp 0x1003fe7f
and dword [ebp - 0xd4], 0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1f0]
call fcn.1001845c
mov dword [ebp - 0x10], 2
jmp 0x1003fea7
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x39
je 0x1003ff42
mov dword [ebp - 0x168], 1
mov dword [ebp - 0x150], 0x30ae734f
mov dword [ebp - 0x18], 1
jmp 0x1003fed5
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1003ff3d
mov dword [ebp - 0x158], 0x605a
push 1
push 0x6538
push 0x715b
push 0x2f47
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x1a8]
push eax
push 0x23ff
push 0x5a2a
lea eax, [ebp - 0x168]
push eax
push 0x5f3f
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x7fcc
call fcn.1003a59c
add esp, 0x3c
jmp 0x1003fece
jmp 0x1003fea0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a8]
call fcn.1001845c
mov dword [ebp - 0x50], 0
jmp 0x1003ff61
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x1003ff74
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x58], 0
jmp 0x1003ff5a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x58], 0xfffffff3
jmp 0x1003ff99
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x58], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x58], 6
jg 0x1003ffed
mov byte [ebp - 0x28], 0
push 0
push 0x385a
push 0x2b7c
push 0x3915
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.1003b8f7
add esp, 0x18
mov byte [ebp - 0x23], 0
movzx eax, byte [ebp - 0x23]
test eax, eax
je 0x1003ffeb
push 0
push 1
push 0x44d2
push 0x3f68
call fcn.1003d2bd
add esp, 0x10
jmp 0x1003ff84
mov eax, dword [ebp - 0x60]
movzx eax, word [eax]
sar eax, 0xc
mov dword [ebp - 0x118], eax
push 3
lea ecx, [ebp - 0x224]
call fcn.100183ab
mov dword [ebp - 4], 9
lea eax, [ebp - 0x224]
push eax
push 0
push 1
push 0x21ef
lea eax, [ebp - 0x218]
push eax
push 0x7cc0
push 0x5efa
push 0x2978
call fcn.10034800
add esp, 0x20
mov byte [ebp - 0x21], 0
push 0x7845
push 0
lea eax, [ebp - 0x21]
push eax
push 0x6165
push 0xe84
push 1
call fcn.1003e1ef
add esp, 0x18
mov byte [ebp - 0x25], 0
movzx eax, byte [ebp - 0x25]
test eax, eax
je 0x1004008a
push 1
push 0x407e
push 0x7287
push 0x266d
push 1
push 1
call fcn.10033c87
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.1001845c
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x100]
push eax
push 1
push 1
call fcn.10033f6b
add esp, 0x10
mov dword [ebp - 0x1c], 0x91a049fe
mov dword [ebp - 0xd8], 0xb058efa9
mov dword [ebp - 0x1c], 0
jmp 0x100400d1
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xfffffff2
jl 0x100402e1
push 4
lea ecx, [ebp - 0x88]
call fcn.100183ab
mov dword [ebp - 4], 0xa
mov dword [ebp - 0xa4], 0x9953e80c
mov dword [ebp - 0x17c], 0xff4caa5d
mov dword [ebp - 0x68], 0
jmp 0x10040113
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 4
jge 0x1004012f
push dword [ebp - 0x68]
lea ecx, [ebp - 0x88]
call fcn.10018487
mov dword [eax], 0xc25bfc88
jmp 0x1004010c
push 3
lea ecx, [ebp - 0x88]
call fcn.10018487
cmp dword [eax], 0
je 0x1004024c
push 1
lea ecx, [ebp - 0x88]
call fcn.10018487
push 1
lea ecx, [ebp - 0x88]
call fcn.10018487
cmp dword [eax], 0
je 0x10040176
push 3
lea ecx, [ebp - 0x88]
call fcn.10018487
cmp dword [eax], 0
jne 0x10040191
push 3
lea ecx, [ebp - 0x88]
call fcn.10018487
cmp dword [eax], 0
jne 0x10040191
and dword [ebp - 0x90], 0
jmp 0x1004019b
mov dword [ebp - 0x90], 1
push 3
lea ecx, [ebp - 0x88]
call fcn.10018487
mov eax, dword [eax]
cmp eax, dword [ebp - 0x90]
je 0x100401b6
cmp dword [ebp - 0x1c], 0
push 3
lea ecx, [ebp - 0x88]
call fcn.10018487
cmp dword [eax], 0x847d
jl 0x100401da
cmp dword [ebp - 0x1c], 0
jne 0x100401da
and dword [ebp - 0x94], 0
jmp 0x100401e4
mov dword [ebp - 0x94], 1
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0x94], eax
jg 0x100401fe
mov dword [ebp - 0x9c], 1
jmp 0x10040205
and dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
je 0x1004022c
cmp dword [ebp - 0x1c], 0
je 0x1004022c
mov dword [ebp - 0xac], 1
jmp 0x10040233
and dword [ebp - 0xac], 0
mov eax, dword [ebp - 0xac]
add eax, 0xb68d
je 0x1004024c
mov dword [ebp - 0xb4], 1
jmp 0x10040253
and dword [ebp - 0xb4], 0
push 3
lea ecx, [ebp - 0x88]
call fcn.10018487
mov ecx, dword [ebp - 0xb4]
cmp ecx, dword [eax]
jge 0x1004027a
push 7
pop eax
test eax, eax
jne 0x1004027a
and dword [ebp - 0xbc], 0
jmp 0x10040284
mov dword [ebp - 0xbc], 1
cmp dword [ebp - 0xbc], 0x9ed080c1
je 0x1004029c
mov dword [ebp - 0xc8], 1
jmp 0x100402a3
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xc8], eax
je 0x100402ba
mov dword [ebp - 0xd0], 1
jmp 0x100402c1
and dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x17c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.1001845c
jmp 0x100400ca
lea eax, [ebp - 0x1c]
push eax
push 1
push 0x418d
push 1
push 0x3af6
lea eax, [ebp - 0xd8]
push eax
push 0
push 0x1b23
push 0x7e63
call fcn.1003b78d
add esp, 0x24
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 3
je 0x10040327
jmp 0x10040351
mov eax, dword [ebp - 0xfc]
add eax, dword [ebp - 0x100]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x108]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x8c]
mov dword [ecx], eax
jmp 0x1003f82e
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ecx]
add ecx, dword [eax + 4]
mov eax, dword [ebp - 0x30]
mov dword [eax], ecx
jmp 0x10040382
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x110], eax
push dword [ebp - 0x110]
push 1
call fcn.1002a70b
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret