Function at 0x10026b83
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f7b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x754
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10029e4f
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x464], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x344]
movzx eax, byte [eax]
test eax, eax
je 0x10026bfc
push 0x3de
push 0
push 0x10b8
call dword [sym.imp.GDI32.dll_Polygon]
jmp 0x10029e4d
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x60], 0x3606de71
push 3
lea ecx, [ebp - 0x48c]
call fcn.1001ab0d
and dword [ebp - 4], 0
mov dword [ebp - 0x478], 0
mov dword [ebp - 0xa8], 0
jmp 0x10026c5b
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 1
jge 0x10026c77
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x184], 0xe3556834
jmp 0x10026c4e
push 1
push 0xba3
push 0x1d3d
lea eax, [ebp - 0xa8]
push eax
push 0
push 0x769d
lea eax, [ebp - 0x48c]
push eax
call fcn.1002dc52
add esp, 0x1c
mov dword [ebp - 0x60], 0
jmp 0x10026cb0
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jg 0x1002706c
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x74], 0x661fbc9f
mov dword [ebp - 0x628], 0xffffffff
mov eax, dword [ebp - 0x24]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x184]
neg ecx
cmp ecx, eax
jg 0x10026cf5
mov dword [ebp - 0x2c0], 1
jmp 0x10026cfc
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x60]
sub eax, dword [ebp - 0x2c0]
je 0x10026d56
mov dword [ebp - 0x24], 0
jmp 0x10026d17
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x10026d54
mov dword [ebp - 0x634], 0x1c17
mov dword [ebp - 0x5e4], 0xb7ab61b5
mov dword [ebp - 0x6b4], 0x1615e82a
mov dword [ebp - 0x2f8], 1
mov eax, dword [ebp - 0x2f8]
inc eax
mov dword [ebp - 0x2f8], eax
jmp 0x10026d10
jmp 0x10026d6a
mov dword [ebp - 0x46c], 0xd70
mov dword [ebp - 0x46c], 0x167c28ca
mov dword [ebp - 0x74], 0
jmp 0x10026d7a
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jg 0x10027067
mov dword [ebp - 0x47c], 0xda5659cd
mov dword [ebp - 0x2f0], 0x2c8e
mov dword [ebp - 0x3c0], 0x10009cd8
cmp dword [ebp - 0x2f0], 0x2e9a
jle 0x10026ec1
and dword [ebp - 0xc4], 0
jmp 0x10026dc8
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x2bbd
jge 0x10026ec1
and dword [ebp - 0xbc], 0
jmp 0x10026dee
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0x46cd
jge 0x10026ebc
and dword [ebp - 0xe8], 0
jmp 0x10026e14
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0x3026
jge 0x10026eb7
and dword [ebp - 0xb0], 0
jmp 0x10026e3a
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x7970
jge 0x10026eb2
mov eax, dword [ebp - 0xbc]
cdq
idiv dword [ebp - 0xe8]
imul edx, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xc4]
mov ecx, edx
sar eax, cl
cdq
mov dword [ebp - 0x3d4], eax
mov dword [ebp - 0x3d0], edx
push dword [ebp - 0x3d0]
push dword [ebp - 0x3d4]
lea ecx, [ebp - 0x724]
call fcn.1000d6fa
pop ecx
pop ecx
mov dword [ebp - 0x474], eax
mov ecx, dword [ebp - 0x474]
call fcn.1001a8bc
push eax
call fcn.10049b86
pop ecx
lea ecx, [ebp - 0x724]
call fcn.1001a8b2
jmp 0x10026e2d
jmp 0x10026e07
jmp 0x10026de1
jmp 0x10026dbb
mov eax, dword [ebp - 0x60]
cmp dword [ebp + eax*4 - 0x184], 1
jl 0x10026eda
mov dword [ebp - 0x1b4], 1
jmp 0x10026ee1
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp + eax*4 - 0x184]
cmp eax, dword [ebp - 0x1b4]
je 0x10026eff
mov dword [ebp - 0x16c], 1
jmp 0x10026f06
and dword [ebp - 0x16c], 0
push 1
lea ecx, [ebp - 0x48c]
call fcn.1001abab
mov ecx, dword [ebp - 0x16c]
mov dword [eax], ecx
cmp dword [ebp - 0x16c], 0
je 0x10026fca
push 4
lea ecx, [ebp - 0x548]
call fcn.1001ab0d
mov byte [ebp - 4], 1
mov dword [ebp - 0xc8], 0
jmp 0x10026f52
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 4
jge 0x10026f74
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x548]
call fcn.1001abab
mov dword [eax], 4
jmp 0x10026f45
mov dword [ebp - 0x24], 0
jmp 0x10026f84
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x10026fb9
lea eax, [ebp - 0x48c]
push eax
push 0x1702
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x47c]
push eax
push 0x5062
lea eax, [ebp - 0x74]
push eax
push 0
call fcn.100332de
add esp, 0x1c
jmp 0x10026f7d
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x548]
call fcn.1001ab8f
jmp 0x10027020
mov dword [ebp - 0x5ec], 0x648a
mov byte [ebp - 0x3f], 0
push 1
push 1
push 0x4b76
lea eax, [ebp - 0x3f]
push eax
push 0x555a
call fcn.1001f818
add esp, 0x14
push 0x1efe
push 0x2c81
push 0
push 0x4ffc
push 0
lea eax, [ebp - 0x48c]
push eax
push 0x7071
lea eax, [ebp - 0x478]
push eax
call fcn.10032aa8
add esp, 0x20
mov byte [ebp - 4], 2
cmp dword [ebp - 0x2f0], 0x29dd
jge 0x1002703c
push dword [ebp - 0x3c0]
call fcn.10049b86
pop ecx
jmp 0x10027058
and dword [ebp - 4], 0
jmp 0x10027062
jmp 0x10026d73
jmp 0x10026ca9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48c]
call fcn.1001ab8f
mov dword [ebp - 0x368], 0
push 1
lea ecx, [ebp - 0x53c]
call fcn.1001ab0d
mov dword [ebp - 4], 4
mov dword [ebp - 0x34c], 0xe42a
mov dword [ebp - 0x644], 5
lea eax, [ebp - 0x5f4]
push eax
push 1
lea eax, [ebp - 0x53c]
push eax
push 0
call fcn.100200c0
add esp, 0x10
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x1ac], eax
push 0
lea ecx, [ebp - 0x53c]
call fcn.1001abab
mov ecx, dword [ebp - 0x1ac]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x34c], eax
mov byte [ebp - 0x3c], 0
push 0
push 0x5e13
push 0x688f
lea eax, [ebp - 0x3c]
push eax
push 1
call fcn.100202c3
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x53c]
call fcn.1001ab8f
mov dword [ebp - 0x6c], 0x2b29949d
mov dword [ebp - 0x88], 4
mov dword [ebp - 0x88], 0xfffffff5
jmp 0x1002714b
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0x13
jl 0x10027202
mov dword [ebp - 0x98], 0xa3df603f
mov dword [ebp - 0x458], 4
mov dword [ebp - 0x354], 0x1e29ea41
mov dword [ebp - 0x3f0], 0x7b04800f
mov dword [ebp - 0x98], 0
jmp 0x10027199
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xfffffff9
jg 0x100271cb
push 0x3cb
push 0
push 0
push 0x45e
push 0x4039
lea eax, [ebp - 0x3f0]
push eax
push 0x38d4
call fcn.1002a3f5
add esp, 0x1c
jmp 0x1002718c
push 0
lea eax, [ebp - 0x354]
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x88]
push eax
push 0x34bf
push 0
push 0x57b8
lea eax, [ebp - 0x458]
push eax
call fcn.1001fed8
add esp, 0x20
jmp 0x1002713e
push 3
lea ecx, [ebp - 0x194]
call fcn.1001ab0d
mov dword [ebp - 4], 5
mov dword [ebp - 0x1b8], 0x1d6
mov dword [ebp - 0x3fc], 0x10009d30
cmp dword [ebp - 0x1b8], 0x4f4
jle 0x1002734a
and dword [ebp - 0x154], 0
jmp 0x10027250
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0x497d
jge 0x1002734a
and dword [ebp - 0xf0], 0
jmp 0x10027276
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0x49e
jge 0x10027345
and dword [ebp - 0xd4], 0
jmp 0x1002729c
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x1b5f
jge 0x10027340
and dword [ebp - 0xdc], 0
jmp 0x100272c2
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xc1e
jge 0x1002733b
mov eax, dword [ebp - 0xf0]
cdq
idiv dword [ebp - 0xd4]
mov eax, dword [ebp - 0x154]
mov ecx, edx
shl eax, cl
mov ecx, dword [ebp - 0xdc]
shl eax, cl
cdq
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 0x3dc], edx
push dword [ebp - 0x3dc]
push dword [ebp - 0x3e0]
lea ecx, [ebp - 0x70c]
call fcn.1000d6fa
pop ecx
pop ecx
mov dword [ebp - 0x35c], eax
mov ecx, dword [ebp - 0x35c]
call fcn.1001a8bc
push eax
call fcn.10049b86
pop ecx
lea ecx, [ebp - 0x70c]
call fcn.1001a8b2
jmp 0x100272b5
jmp 0x1002728f
jmp 0x10027269
jmp 0x10027243
mov byte [ebp - 4], 6
cmp dword [ebp - 0x1b8], 0xffffffae
jge 0x10027363
push dword [ebp - 0x3fc]
call fcn.10049b86
pop ecx
jmp 0x1002737f
mov dword [ebp - 4], 5
jmp 0x1002738f
mov dword [ebp - 0x1c], 0x90e8
mov dword [ebp - 0x17c], 0x403132d6
mov dword [ebp - 0x36c], 0x4aec7014
mov dword [ebp - 0x11c], 0
jmp 0x100273c3
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 1
jge 0x100273dc
mov eax, dword [ebp - 0x11c]
mov dword [ebp + eax*4 - 0x34], 0
jmp 0x100273b6
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x694], eax
mov dword [ebp - 0x17c], 0xffffffff
mov eax, dword [ebp - 0x17c]
cmp eax, dword [ebp - 0x1c]
jg 0x10027406
mov dword [ebp - 0x25c], 1
jmp 0x1002740d
and dword [ebp - 0x25c], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x17c]
neg eax
cmp eax, 0x451d
je 0x1002742b
mov dword [ebp - 0x1bc], 1
jmp 0x10027432
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1bc], eax
jne 0x10027449
mov dword [ebp - 0x2ec], 1
jmp 0x10027450
and dword [ebp - 0x2ec], 0
cmp dword [ebp - 0x2ec], 0
jle 0x10027465
mov dword [ebp - 0x1c4], 1
jmp 0x1002746c
and dword [ebp - 0x1c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
imul eax, dword [ebp - 0x1c4]
add eax, 0x3782ecc9
je 0x10027495
xor eax, eax
inc eax
je 0x10027495
mov dword [ebp - 0x264], 1
jmp 0x1002749c
and dword [ebp - 0x264], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x264]
imul ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp + eax - 0x34]
jne 0x100274c2
mov dword [ebp - 0x1cc], 1
jmp 0x100274c9
and dword [ebp - 0x1cc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1cc]
sub ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp + eax - 0x34]
jle 0x100274ea
mov dword [ebp - 0x2b4], 1
jmp 0x100274f1
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x2b4], eax
jne 0x10027508
mov dword [ebp - 0x1d4], 1
jmp 0x1002750f
and dword [ebp - 0x1d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
cmp dword [ebp - 0x1d4], eax
je 0x1002752d
mov dword [ebp - 0x26c], 1
jmp 0x10027534
and dword [ebp - 0x26c], 0
cmp dword [ebp - 0x26c], 0xfffffffb
ja 0x10027549
mov dword [ebp - 0x1dc], 1
jmp 0x10027550
and dword [ebp - 0x1dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
mov ecx, dword [ebp - 0x1dc]
lea eax, [ecx + eax - 0x66902f02]
cmp eax, dword [ebp - 0x1c]
jne 0x10027578
mov dword [ebp - 0x364], 1
jmp 0x1002757f
and dword [ebp - 0x364], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
push 4
pop edx
imul edx, edx, 0
mov edx, dword [ebp + edx - 0x34]
sub edx, dword [ebp + ecx - 0x34]
add edx, dword [ebp + eax - 0x34]
sub edx, dword [ebp - 0x1c]
cmp edx, 0x5309
jg 0x100275b4
mov dword [ebp - 0x470], 1
jmp 0x100275bb
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x568], eax
mov dword [ebp - 0x36c], 0xfffffffb
mov byte [ebp - 0x45], 0
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x100275ec
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2dc], 0xe53d8da8
mov dword [ebp - 0x408], 0xffffffff
mov dword [ebp - 0x56c], 0
mov dword [ebp - 0x574], 0x9c4c8d3c
mov dword [ebp - 0x57c], 6
push 3
lea ecx, [ebp - 0x650]
call fcn.1001ab0d
mov byte [ebp - 4], 8
or dword [ebp - 0x500], 0xffffffff
or dword [ebp - 0x4fc], 0xffffffff
or dword [ebp - 0x4f8], 0xffffffff
or dword [ebp - 0x4f4], 0xffffffff
lea ecx, [ebp - 0x161]
call fcn.1001abba
push eax
lea eax, [ebp - 0x4f0]
push eax
lea eax, [ebp - 0x500]
push eax
lea ecx, [ebp - 0x6d8]
call fcn.1001abbd
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x640]
call fcn.1001ab69
mov byte [ebp - 4], 9
mov dword [ebp - 0x598], 0x4cd49598
mov dword [ebp - 0xe4], 0
jmp 0x100276a7
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 3
jge 0x100276c9
push dword [ebp - 0xe4]
lea ecx, [ebp - 0x650]
call fcn.1001abab
mov dword [eax], 0xe6f7fbf2
jmp 0x1002769a
mov dword [ebp - 0x2dc], 0x6c05baf4
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x408], eax
push 0x4ce6
lea eax, [ebp - 0x640]
push eax
push 0
push 1
call fcn.10023a1c
add esp, 0x10
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x640]
call fcn.1001ab8f
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x650]
call fcn.1001ab8f
mov dword [ebp - 0x13c], 0x7e2799ac
mov dword [ebp - 0x5a0], 0xffffffff
mov dword [ebp - 0x13c], 0
jmp 0x10027742
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xffffffea
je 0x10027779
mov dword [ebp - 0x374], 0xd4914d2e
mov dword [ebp - 0x1e4], 0xfa9d19ac
cmp dword [ebp - 0x374], 0
je 0x1002776a
jmp 0x10027779
mov eax, dword [ebp - 0x1e4]
dec eax
mov dword [ebp - 0x1e4], eax
jmp 0x10027735
push 0
push 0
lea eax, [ebp - 0x194]
push eax
push 0xf19
push 0x462f
push 0x1cff
lea eax, [ebp - 0x20]
push eax
call fcn.10032e44
add esp, 0x1c
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x384], 0xffffffff
mov dword [ebp - 0x14c], 0x137b1891
mov dword [ebp - 0x2bc], 0xfffffff8
mov dword [ebp - 0x27c], 0xa810d21d
mov dword [ebp - 0xf4], 0xffffffff
mov dword [ebp - 0xec], 0
jmp 0x100277f1
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jge 0x1002780d
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x670], 1
jmp 0x100277e4
mov dword [ebp - 0x7c], 0xfffffff2
jmp 0x1002781d
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0x12
jne 0x100278db
mov dword [ebp - 0x5a8], 5
push 2
lea ecx, [ebp - 0x660]
call fcn.1001ab0d
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x460], 0xfffe
mov dword [ebp - 0x124], 0
jmp 0x10027865
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 2
jge 0x10027887
push dword [ebp - 0x124]
lea ecx, [ebp - 0x660]
call fcn.1001abab
mov dword [eax], 0xdb85613
jmp 0x10027858
push 0x4722
push 1
lea eax, [ebp - 0x460]
push eax
push 0
call fcn.1002ef8a
add esp, 0x10
mov byte [ebp - 0x3e], 0
movzx eax, byte [ebp - 0x3e]
test eax, eax
je 0x100278c7
push 0
push 0x1f3a
push 0xeb9
push 0x1213
push 0xfef
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x660]
call fcn.1001ab8f
jmp 0x10027816
cmp dword [ebp - 0x27c], 0
cmp dword [ebp - 0xf4], 0xc443
jg 0x100278fa
mov dword [ebp - 0x274], 1
jmp 0x10027901
and dword [ebp - 0x274], 0
cmp dword [ebp - 0x274], 0xfffffff8
jae 0x10027916
mov dword [ebp - 0x1ec], 1
jmp 0x1002791d
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x2bc]
cmp dword [ebp - 0x1ec], eax
jg 0x10027937
mov dword [ebp - 0x37c], 1
jmp 0x1002793e
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x5b0], eax
mov eax, dword [ebp - 0x2bc]
cmp eax, dword [ebp - 0xf4]
jge 0x10027968
xor eax, eax
je 0x10027968
mov dword [ebp - 0x1f4], 1
jmp 0x1002796f
and dword [ebp - 0x1f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x670]
cmp eax, dword [ebp - 0x1f4]
jne 0x10027990
mov dword [ebp - 0x414], 1
jmp 0x10027997
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x5b8], eax
mov eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x384]
jge 0x100279bd
mov dword [ebp - 0x1fc], 1
jmp 0x100279c4
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x27c]
cmp dword [ebp - 0x1fc], eax
jge 0x100279de
mov dword [ebp - 0x2fc], 1
jmp 0x100279e5
and dword [ebp - 0x2fc], 0
imul eax, dword [ebp - 0x2fc], 0xf851
test eax, eax
ja 0x100279ff
mov dword [ebp - 0x204], 1
jmp 0x10027a06
and dword [ebp - 0x204], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x670]
cmp dword [ebp - 0x204], eax
jge 0x10027a27
mov dword [ebp - 0x284], 1
jmp 0x10027a2e
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x284]
jl 0x10027a45
mov dword [ebp - 0x20c], 1
jmp 0x10027a4c
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x20c], eax
jg 0x10027a66
mov dword [ebp - 0x2c4], 1
jmp 0x10027a6d
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x2c4], eax
je 0x10027a87
mov dword [ebp - 0x214], 1
jmp 0x10027a8e
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x20], 0
jmp 0x10027aaa
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10027ac0
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x4d0], 0xffffffff
jmp 0x10027aa3
mov dword [ebp - 0xfc], 0
jmp 0x10027ad9
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
jge 0x10027af2
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x44], 1
jmp 0x10027acc
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x44], 0x19
jmp 0x10027b17
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x44], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x44], 0xfffffff6
jne 0x10027bba
mov dword [ebp - 0x21c], 5
mov dword [ebp - 0x38c], 0xd658edf
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x5c0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
mov dword [ebp - 0x5c8], eax
xor eax, eax
jne 0x10027b68
mov dword [ebp - 0x28c], 1
jmp 0x10027b6f
and dword [ebp - 0x28c], 0
cmp dword [ebp - 0x28c], 0xbf90a233
jb 0x10027b87
mov dword [ebp - 0x434], 1
jmp 0x10027b8e
and dword [ebp - 0x434], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
mov dword [ebp - 0x5d0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
imul eax, dword [ebp - 0x21c]
mov dword [ebp - 0x38c], eax
jmp 0x10027b02
mov dword [ebp - 0x20], 0
jmp 0x10027bca
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x10027be0
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x444], 0x6f37911b
jmp 0x10027bc3
mov dword [ebp - 0x5d8], 0x3c692bea
mov dword [ebp - 0x5e0], 1
mov dword [ebp - 0x5e8], 0xffffffff
mov dword [ebp - 0x5f0], 0x6748f69f
mov dword [ebp - 0x5f8], 0x14b733c6
mov dword [ebp - 0x420], 0xf16efa42
mov dword [ebp - 0x12c], 0
jmp 0x10027c35
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 3
jge 0x10027c51
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0x6f4], 1
jmp 0x10027c28
push 0x5ec
push 0x1727
push 0xcc3
push 0x54c9
push 0x3752
push 0
push 0
lea eax, [ebp - 0x420]
push eax
push 0x7b69
call fcn.10020545
add esp, 0x24
push 2
lea ecx, [ebp - 0x194]
call fcn.1001abab
cmp dword [eax], 0
je 0x10027cae
push 1
lea ecx, [ebp - 0x194]
call fcn.1001abab
push 2
lea ecx, [ebp - 0x194]
call fcn.1001abab
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x600], eax
push 2
lea ecx, [ebp - 0x194]
call fcn.1001abab
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x608], eax
mov esi, dword [ebp - 0x6c]
push 0
lea ecx, [ebp - 0x194]
call fcn.1001abab
cmp dword [eax], esi
jge 0x10027ced
mov dword [ebp - 0x2e4], 1
jmp 0x10027cf4
and dword [ebp - 0x2e4], 0
mov esi, dword [ebp - 0x2e4]
neg esi
push 2
lea ecx, [ebp - 0x194]
call fcn.1001abab
cmp esi, dword [eax]
jge 0x10027d1f
cmp dword [ebp - 0x6c], 0
je 0x10027d1f
mov dword [ebp - 0x394], 1
jmp 0x10027d26
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x610], eax
cmp dword [ebp - 0x6c], 0x19a6fdd8
je 0x10027d44
mov dword [ebp - 0x224], 1
jmp 0x10027d4b
and dword [ebp - 0x224], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x224]
imul ecx, dword [ebp + eax - 0x4d0]
mov dword [ebp - 0x294], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x294]
mov dword [ebp + eax - 0x444], ecx
cmp dword [ebp - 0x294], 0xd3650dfa
je 0x10027d90
mov dword [ebp - 0x22c], 1
jmp 0x10027d97
and dword [ebp - 0x22c], 0
push 2
lea ecx, [ebp - 0x194]
call fcn.1001abab
mov ecx, dword [ebp - 0x22c]
cmp ecx, dword [eax]
jg 0x10027dba
mov dword [ebp - 0x2cc], 1
jmp 0x10027dc1
and dword [ebp - 0x2cc], 0
push 1
lea ecx, [ebp - 0x194]
call fcn.1001abab
mov ecx, dword [ebp - 0x2cc]
sub ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x4d0], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x194]
call fcn.1001ab8f
mov dword [ebp - 0xa0], 0xfffe
mov dword [ebp - 0x90], 0x506e60b0
push 2
lea ecx, [ebp - 0x690]
call fcn.1001ab0d
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x618], 0x3a3fc4b0
mov dword [ebp - 0x620], 0x93dda37b
mov dword [ebp - 0x564], 1
mov dword [ebp - 0x630], 6
mov dword [ebp - 0x6c8], 0xab4456e3
push 3
lea ecx, [ebp - 0x560]
call fcn.1001ab0d
mov byte [ebp - 4], 0xc
push 0
push 0x568d
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x690]
push eax
call fcn.1002eb6e
add esp, 0x10
mov dword [ebp - 0x64], 0
jmp 0x10027e87
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x10027e9d
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x6d0], 0xffffffff
jmp 0x10027e80
lea eax, [ebp - 0x560]
push eax
push 0x7e87
lea eax, [ebp - 0x64]
push eax
push 0
call fcn.1002d089
add esp, 0x10
mov dword [ebp - 0x234], 0x4c91
mov dword [ebp - 0x39c], 0x10009d7c
cmp dword [ebp - 0x234], 0x4e02
jle 0x10027f87
and dword [ebp - 0x104], 0
jmp 0x10027ef1
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x8cb
jge 0x10027f87
and dword [ebp - 0x144], 0
jmp 0x10027f17
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0x77b9
jge 0x10027f82
and dword [ebp - 0x10c], 0
jmp 0x10027f39
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x75f1
jge 0x10027f80
mov eax, dword [ebp - 0x104]
cdq
idiv dword [ebp - 0x144]
imul edx, dword [ebp - 0x10c]
mov eax, edx
cdq
mov dword [ebp - 0x3ec], eax
mov dword [ebp - 0x3e8], edx
push dword [ebp - 0x3e8]
push dword [ebp - 0x3ec]
mov ecx, 0x106086b8
call fcn.1001a8dc
jmp 0x10027f2c
jmp 0x10027f0a
jmp 0x10027ee4
push 0x364e
lea eax, [ebp - 0xa0]
push eax
push 1
lea eax, [ebp - 0x90]
push eax
push 0x7f15
push 0x68dc
push 0
call fcn.100260d2
add esp, 0x1c
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x234], 0x4a58
jge 0x10027fd0
mov edx, dword [ebp - 0x39c]
mov ecx, 0x106086b8
call fcn.1001cde7
jmp 0x10027fec
mov dword [ebp - 4], 0xc
jmp 0x10027ffc
mov dword [ebp - 0x90], 1
jmp 0x10028015
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x100280df
mov dword [ebp - 0x42c], 0xffffffff
mov dword [ebp - 0x5fc], 0x648bd921
mov dword [ebp - 0x590], 1
mov dword [ebp - 0x570], 0
mov dword [ebp - 0x654], 0x5378470e
push 2
lea ecx, [ebp - 0x680]
call fcn.1001ab0d
mov byte [ebp - 4], 0xf
push 0x1b33
lea eax, [ebp - 0x680]
push eax
push 0x7cc3
push 0
lea eax, [ebp - 0x578]
push eax
call fcn.1002e370
add esp, 0x14
mov dword [ebp - 0xa0], 0
jmp 0x100280a0
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jg 0x100280b5
mov dword [ebp - 0x42c], 0xfffffffe
jmp 0x10028093
lea eax, [ebp - 0x560]
push eax
push 0
push 0x1fe2
call fcn.1002fb7d
add esp, 0xc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x680]
call fcn.1001ab8f
jmp 0x10028008
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x560]
call fcn.1001ab8f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x690]
call fcn.1001ab8f
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax + 4]
mov dword [ebp - 0x290], eax
push 2
lea ecx, [ebp - 0x6a0]
call fcn.1001ab0d
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x134], 1
lea eax, [ebp - 0x604]
push eax
push 0x68e4
push 0xda3
push 0
push 1
lea eax, [ebp - 0x6a0]
push eax
push 0x7cb0
call fcn.10020e0c
add esp, 0x1c
mov dword [ebp - 0x134], 0
jmp 0x1002816c
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jg 0x100281ad
mov byte [ebp - 0x35], 0
movzx eax, byte [ebp - 0x35]
test eax, eax
je 0x100281ab
push 0
push 0x573
push 0x148a
push 0x6daa
push 0x78ad
push 1
push 0x179b
push 0x4ced
call fcn.1001fed8
add esp, 0x20
jmp 0x1002815f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6a0]
call fcn.1001ab8f
push 4
lea ecx, [ebp - 0x440]
call fcn.1001ab0d
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x580], 0x9f3690f1
mov dword [ebp - 0x6cc], 0x51c6076f
mov dword [ebp - 0x18], 0
jmp 0x100281f4
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1002820d
push dword [ebp - 0x18]
lea ecx, [ebp - 0x440]
call fcn.1001abab
or dword [eax], 0xffffffff
jmp 0x100281ed
mov dword [ebp - 0x18], 0
jmp 0x1002821d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10028233
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x338], 9
jmp 0x10028216
mov dword [ebp - 0x18], 0
jmp 0x10028243
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x10028259
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x304], 0
jmp 0x1002823c
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x338], 3
jmp 0x10028284
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x338]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x338], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x338], 0
jl 0x100286e3
mov dword [ebp - 0x58c], 1
mov dword [ebp - 0x60c], 0xffffffff
push 1
lea ecx, [ebp - 0x4bc]
call fcn.1001ab0d
mov byte [ebp - 4], 0x12
push 2
lea ecx, [ebp - 0x554]
call fcn.1001ab0d
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x3ac], 1
push 2
lea ecx, [ebp - 0x524]
call fcn.1001ab0d
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x14], 0
jmp 0x100282f8
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x10028314
push dword [ebp - 0x14]
lea ecx, [ebp - 0x4bc]
call fcn.1001abab
mov dword [eax], 0x5e4b
jmp 0x100282f1
mov dword [ebp - 0x14], 0
jmp 0x10028324
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002833a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6e8], 0xffffffff
jmp 0x1002831d
mov dword [ebp - 0x14], 0
jmp 0x1002834a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 4
jge 0x10028360
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x764], 0x15fb
jmp 0x10028343
push 0x48df
push 1
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x554]
push eax
call fcn.100311ac
add esp, 0x14
mov dword [ebp - 0x29c], 0x3d42
mov dword [ebp - 0x3a4], 0x10009dc0
cmp dword [ebp - 0x29c], 0x4059
jle 0x1002845a
and dword [ebp - 0xcc], 0
jmp 0x100283b6
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x6ccf
jge 0x10028448
and dword [ebp - 0xd0], 0
jmp 0x100283dc
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0x7fa8
jge 0x10028443
and dword [ebp - 0xd8], 0
jmp 0x100283fe
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x6ba1
jge 0x10028441
mov eax, dword [ebp - 0xcc]
add eax, dword [ebp - 0xd0]
or eax, dword [ebp - 0xd8]
cdq
mov dword [ebp - 0x3f8], eax
mov dword [ebp - 0x3f4], edx
push dword [ebp - 0x3f4]
push dword [ebp - 0x3f8]
mov ecx, 0x106086b8
call fcn.1001a8dc
jmp 0x100283f1
jmp 0x100283cf
jmp 0x100283a9
push 0x169a
push 1
push 0x99
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x14], 0
jmp 0x1002846a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x10028486
push dword [ebp - 0x14]
lea ecx, [ebp - 0x524]
call fcn.1001abab
mov dword [eax], 0x5f18
jmp 0x10028463
mov byte [ebp - 4], 0x15
cmp dword [ebp - 0x29c], 0x3b2e
jge 0x100284a6
mov edx, dword [ebp - 0x3a4]
mov ecx, 0x106086b8
call fcn.1001cde7
jmp 0x100284c2
mov dword [ebp - 4], 0x14
jmp 0x100284d2
push 0
lea ecx, [ebp - 0x4bc]
call fcn.1001abab
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x23c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x23c]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x554]
call fcn.1001abab
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
mov dword [ebp - 0x430], eax
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x174]
mov dword [ecx], eax
cmp dword [ebp - 0x430], 0xa0a5
jge 0x10028540
mov dword [ebp - 0x2a4], 1
jmp 0x10028547
and dword [ebp - 0x2a4], 0
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x338]
lea ecx, [ebp - 0x440]
call fcn.1001abab
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x304], 7
je 0x1002857a
mov dword [ebp - 0x2f4], 1
jmp 0x10028581
and dword [ebp - 0x2f4], 0
push 0
lea ecx, [ebp - 0x4bc]
call fcn.1001abab
mov ecx, dword [ebp - 0x2f4]
cmp ecx, dword [eax]
jne 0x100285a4
mov dword [ebp - 0x244], 1
jmp 0x100285ab
and dword [ebp - 0x244], 0
push 4
pop eax
shl eax, 1
mov esi, dword [ebp + eax - 0x338]
imul esi, dword [ebp - 0x244]
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x338]
lea ecx, [ebp - 0x440]
call fcn.1001abab
mov eax, dword [eax]
sub eax, esi
sub eax, 0x7d7bae29
cmp eax, 0x1cc0e426
jg 0x100285f1
mov dword [ebp - 0x24c], 1
jmp 0x100285f8
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x2a4]
cmp eax, dword [ebp - 0x24c]
jg 0x10028612
mov dword [ebp - 0x2d4], 1
jmp 0x10028619
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x3ac], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x304], 8
jne 0x10028641
mov dword [ebp - 0x254], 1
jmp 0x10028648
and dword [ebp - 0x254], 0
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x338]
lea ecx, [ebp - 0x440]
call fcn.1001abab
mov ecx, dword [ebp - 0x254]
cmp ecx, dword [eax]
jg 0x10028675
mov dword [ebp - 0x160], 1
jmp 0x1002867c
and dword [ebp - 0x160], 0
push 0
lea ecx, [ebp - 0x524]
call fcn.1001abab
mov ecx, dword [ebp - 0x160]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x304]
add eax, dword [ebp - 0x160]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x304], eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x524]
call fcn.1001ab8f
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x554]
call fcn.1001ab8f
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x4bc]
call fcn.1001ab8f
jmp 0x1002826b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.1001ab8f
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0xe0]
mov ecx, dword [ecx]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x594], 0xfffffffe
mov byte [ebp - 0x37], 0
movzx eax, byte [ebp - 0x37]
test eax, eax
je 0x10028740
push 1
push 0x53d0
push 0x3713
push 1
push 0
push 0x7c54
call fcn.1002ec5f
add esp, 0x18
mov byte [ebp - 0x39], 0
movzx eax, byte [ebp - 0x39]
test eax, eax
je 0x1002875c
push 0x1b54
push 0x185e
call dword [sym.imp.KERNEL32.dll_Beep]
and dword [ebp - 0x168], 0
jmp 0x1002877b
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x2c]
add eax, 0x28
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x168], eax
jge 0x10029e4d
mov dword [ebp - 0x2ac], 0x6ab1
mov dword [ebp - 0x454], 0x10009e54
cmp dword [ebp - 0x2ac], 0x6d5a
jle 0x10028892
and dword [ebp - 0xc0], 0
jmp 0x100287cd
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x436c
jge 0x10028892
and dword [ebp - 0xb4], 0
jmp 0x100287f3
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x4141
jge 0x1002888d
and dword [ebp - 0xb8], 0
jmp 0x10028819
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0x71f5
jge 0x10028888
and dword [ebp - 0xf8], 0
jmp 0x1002883b
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0x7f72
jge 0x10028886
mov ecx, dword [ebp - 0xb4]
add ecx, dword [ebp - 0xb8]
mov eax, dword [ebp - 0xc0]
sar eax, cl
and eax, dword [ebp - 0xf8]
cdq
mov dword [ebp - 0x404], eax
mov dword [ebp - 0x400], edx
push dword [ebp - 0x400]
push dword [ebp - 0x404]
mov ecx, 0x106086b8
call fcn.1001a8dc
jmp 0x1002882e
jmp 0x1002880c
jmp 0x100287e6
jmp 0x100287c0
mov dword [ebp - 0x84], 0x1a049fe3
mov dword [ebp - 4], 0x17
cmp dword [ebp - 0x2ac], 0x692e
jge 0x100288bf
mov edx, dword [ebp - 0x454]
mov ecx, 0x106086b8
call fcn.1001cde7
jmp 0x100288db
or dword [ebp - 4], 0xffffffff
jmp 0x100288e5
mov dword [ebp - 0x3b4], 1
mov dword [ebp - 0x84], 0x11
jmp 0x10028908
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0x1d
jl 0x10028af1
push 1
lea ecx, [ebp - 0x4a4]
call fcn.1001ab0d
mov dword [ebp - 4], 0x19
mov dword [ebp - 0x68], 0xfffffffc
mov dword [ebp - 0x1b0], 0xfebdab6a
lea eax, [ebp - 0x4a4]
push eax
push 0x2ab2
push 0
push 1
push 0x67bf
push 0x73c
push 0x7a5c
push 0x7c1b
lea eax, [ebp - 0x664]
push eax
push 0x3d85
push 0x3c95
push 0
call fcn.1002fec2
add esp, 0x30
mov dword [ebp - 0x68], 0
jmp 0x10028989
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0
jl 0x10028add
mov dword [ebp - 0x80], 0x9978f3c
mov dword [ebp - 0x44c], 0xae857b1a
mov dword [ebp - 0x3bc], 0xe10ef7d5
mov dword [ebp - 0x80], 0
jmp 0x100289be
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jg 0x10028ac2
push 2
lea ecx, [ebp - 0x50c]
call fcn.1001ab0d
mov byte [ebp - 4], 0x1a
push 0x79b5
push 0x3870
push 0x50b1
push 0x3ed1
push 0x438b
push 0x91e
push 1
lea eax, [ebp - 0x50c]
push eax
push 0x7b93
push 0x7877
lea eax, [ebp - 0x59c]
push eax
push 0x10a4
push 0x5286
push 0
push 0x7a7c
push 0x2f4a
push 0x3c2e
call fcn.10020177
add esp, 0x44
push 0x7cac
push 0x494e
lea eax, [ebp - 0x80]
push eax
push 1
lea eax, [ebp - 0x1b0]
push eax
push 0
lea eax, [ebp - 0x3b4]
push eax
push 0xd42
lea eax, [ebp - 0x84]
push eax
push 0x5ed0
push 0x48af
lea eax, [ebp - 0x44c]
push eax
push 0
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x3bc]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x50c]
push eax
call fcn.10026631
add esp, 0x44
mov byte [ebp - 0x3b], 0
movzx eax, byte [ebp - 0x3b]
test eax, eax
je 0x10028aae
push 0
push 0x4d7a
call fcn.100313f2
pop ecx
pop ecx
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x50c]
call fcn.1001ab8f
jmp 0x100289b7
push dword [ebp - 0x68]
lea ecx, [ebp - 0x4a4]
call fcn.1001abab
mov eax, dword [eax]
mov dword [ebp - 0x1b0], eax
jmp 0x10028982
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4a4]
call fcn.1001ab8f
jmp 0x100288fb
mov dword [ebp - 0x8c], 0xad59e57a
mov dword [ebp - 0x100], 0
jmp 0x10028b14
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 2
jge 0x10028b30
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x588], 0xac204e2d
jmp 0x10028b07
mov dword [ebp - 0x8c], 0
jmp 0x10028b49
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x10028b65
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x588], 0x5e17ca00
jmp 0x10028b3c
mov byte [ebp - 0x3d], 0
push 0x6290
push 0
lea eax, [ebp - 0x3d]
push eax
push 1
call fcn.1002fb03
add esp, 0x10
mov dword [ebp - 0x4c], 0x5540d7f8
mov dword [ebp - 0x1a8], 0x4f88039d
mov dword [ebp - 0x108], 0
jmp 0x10028ba8
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 3
jge 0x10028bc4
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x6b0], 0xa7275995
jmp 0x10028b9b
mov dword [ebp - 0x4c], 0xfffffffb
jmp 0x10028bd4
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xfffffff4
jl 0x10028c17
mov dword [ebp - 0x480], 0xdce9d05b
mov dword [ebp - 0x614], 0xfffffffa
push 0x73f3
lea eax, [ebp - 0x480]
push eax
push 0
push 0x3949
push 0xbcf
push 1
push 0xbd1
call fcn.10020b2b
add esp, 0x1c
jmp 0x10028bcd
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6b0], 0xffffffff
jb 0x10028c33
mov dword [ebp - 0x1c8], 1
jmp 0x10028c3a
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1a8], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1a8]
cmp ecx, dword [ebp + eax - 0x6b0]
jge 0x10028c64
mov dword [ebp - 0x1c0], 1
jmp 0x10028c6b
and dword [ebp - 0x1c0], 0
cmp dword [ebp - 0x1c0], 0xec2184e5
je 0x10028c83
mov dword [ebp - 0x1d0], 1
jmp 0x10028c8a
and dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x1c8]
cmp eax, dword [ebp - 0x1d0]
jle 0x10028ca4
mov dword [ebp - 0x1d8], 1
jmp 0x10028cab
and dword [ebp - 0x1d8], 0
cmp dword [ebp - 0x1d8], 0xfffffffa
jl 0x10028cc0
mov dword [ebp - 0x1e0], 1
jmp 0x10028cc7
and dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x1e0]
jg 0x10028ce7
mov eax, 0xeca6c849
test eax, eax
je 0x10028ce7
mov dword [ebp - 0x1e8], 1
jmp 0x10028cee
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x4c], eax
push 3
lea ecx, [ebp - 0x31c]
call fcn.1001ab0d
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0x54], 0xfffffffd
mov dword [ebp - 0x1f8], 1
mov dword [ebp - 0x28], 0
jmp 0x10028d2c
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10028d48
push dword [ebp - 0x28]
lea ecx, [ebp - 0x31c]
call fcn.1001abab
mov dword [eax], 0x3342eb90
jmp 0x10028d25
mov dword [ebp - 0x28], 0
jmp 0x10028d58
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10028d6e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x41c], 0xffffffff
jmp 0x10028d51
mov dword [ebp - 0x54], 2
jmp 0x10028d7e
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x100290a4
mov dword [ebp - 0x70], 0xfffffffd
mov dword [ebp - 0x3cc], 5
mov dword [ebp - 0x110], 0
jmp 0x10028db2
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 1
jge 0x10028dce
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x468], 0x3196
jmp 0x10028da5
mov dword [ebp - 0x70], 0
jmp 0x10028dde
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jg 0x10028f38
mov byte [ebp - 0x36], 0
movzx eax, byte [ebp - 0x36]
test eax, eax
je 0x10028f0c
mov dword [ebp - 0x1f0], 0x55d
mov dword [ebp - 0x448], 0x10009ea8
cmp dword [ebp - 0x1f0], 0x600
jle 0x10028ebc
and dword [ebp - 0x118], 0
jmp 0x10028e32
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0x222e
jge 0x10028ebc
and dword [ebp - 0x120], 0
jmp 0x10028e54
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x6a0b
jge 0x10028eb7
mov eax, dword [ebp - 0x118]
xor eax, dword [ebp - 0x120]
cdq
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], edx
push dword [ebp - 0x40c]
push dword [ebp - 0x410]
lea ecx, [ebp - 0x754]
call fcn.1000d6fa
pop ecx
pop ecx
mov dword [ebp - 0x3c4], eax
mov ecx, dword [ebp - 0x3c4]
call fcn.1001a8bc
push eax
call fcn.10049b86
pop ecx
lea ecx, [ebp - 0x754]
call fcn.1001a8b2
jmp 0x10028e47
jmp 0x10028e25
push 0
call fcn.1002e722
pop ecx
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x1f0], 0x382
jge 0x10028ee0
push dword [ebp - 0x448]
call fcn.10049b86
pop ecx
jmp 0x10028efc
mov dword [ebp - 4], 0x1b
jmp 0x10028f0c
mov byte [ebp - 0x55], 0
movzx eax, byte [ebp - 0x55]
test eax, eax
je 0x10028f33
push 0x734c
push 0
push 0
push 0x2d55
push 0x5b69
call fcn.1001fff9
add esp, 0x14
jmp 0x10028dd7
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x41c], 1
jg 0x10028f54
mov dword [ebp - 0x200], 1
jmp 0x10028f5b
and dword [ebp - 0x200], 0
push dword [ebp - 0x54]
lea ecx, [ebp - 0x31c]
call fcn.1001abab
mov esi, eax
push 1
lea ecx, [ebp - 0x31c]
call fcn.1001abab
mov eax, dword [eax]
imul eax, dword [esi]
mov dword [ebp - 0x1f8], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1f8]
imul ecx, dword [ebp - 0x200]
cmp ecx, dword [ebp + eax - 0x41c]
jge 0x10028fab
mov dword [ebp - 0x208], 1
jmp 0x10028fb2
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x208], eax
jge 0x10028fc9
mov dword [ebp - 0x210], 1
jmp 0x10028fd0
and dword [ebp - 0x210], 0
cmp dword [ebp - 0x210], 0xffffffff
jge 0x10028fe5
mov dword [ebp - 0x218], 1
jmp 0x10028fec
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x3cc]
cmp dword [ebp - 0x218], eax
je 0x10029006
mov dword [ebp - 0x220], 1
jmp 0x1002900d
and dword [ebp - 0x220], 0
push dword [ebp - 0x54]
lea ecx, [ebp - 0x31c]
call fcn.1001abab
mov esi, dword [eax]
add esi, dword [ebp - 0x220]
push 2
lea ecx, [ebp - 0x31c]
call fcn.1001abab
imul esi, dword [eax]
test esi, esi
jne 0x10029050
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x468], 0
jne 0x10029050
and dword [ebp - 0x3d8], 0
jmp 0x1002905a
mov dword [ebp - 0x3d8], 1
cmp dword [ebp - 0x70], 0xec1f
jl 0x1002906f
mov dword [ebp - 0x228], 1
jmp 0x10029076
and dword [ebp - 0x228], 0
imul eax, dword [ebp - 0x228], 0
mov dword [ebp - 0x230], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x230]
mov dword [ebp + eax - 0x41c], ecx
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x70], eax
jmp 0x10028d77
mov byte [ebp - 0x38], 0
movzx eax, byte [ebp - 0x38]
test eax, eax
je 0x100290c6
push 0x7973
push 0x3a05
push 0
push 1
call fcn.10026194
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x31c]
call fcn.1001ab8f
push 1
lea ecx, [ebp - 0x518]
call fcn.1001ab0d
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0x450], 0xffffffff
push 0x794c
push 0x7570
push 0x2d71
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x5a4]
push eax
push 1
push 0
push 0x62f8
push 0x5138
call fcn.10020545
add esp, 0x24
push 0x5dd0
push 1
lea eax, [ebp - 0x518]
push eax
push 0x655a
push 0
lea eax, [ebp - 0x450]
push eax
call fcn.100259c6
add esp, 0x18
mov byte [ebp - 0x40], 0
push 0x7d0
push 0x509a
lea eax, [ebp - 0x40]
push eax
push 0
push 0x5647
call fcn.100329d4
add esp, 0x14
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x518]
call fcn.1001ab8f
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x10], 0
jne 0x10029427
mov dword [ebp - 0x238], 0x3ee2
mov dword [ebp - 0x348], 0x10009ef8
cmp dword [ebp - 0x238], 0x421d
jle 0x10029292
and dword [ebp - 0x138], 0
jmp 0x100291c1
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x40c8
jge 0x10029280
and dword [ebp - 0x128], 0
jmp 0x100291e7
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0x7639
jge 0x1002927b
and dword [ebp - 0x130], 0
jmp 0x1002920d
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0x134d
jge 0x10029276
mov eax, dword [ebp - 0x128]
sub eax, dword [ebp - 0x130]
or eax, dword [ebp - 0x138]
cdq
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], edx
push dword [ebp - 0x424]
push dword [ebp - 0x428]
lea ecx, [ebp - 0x73c]
call fcn.1000d6fa
pop ecx
pop ecx
mov dword [ebp - 0x3e4], eax
mov ecx, dword [ebp - 0x3e4]
call fcn.1001a8bc
push eax
call fcn.10049b86
pop ecx
lea ecx, [ebp - 0x73c]
call fcn.1001a8b2
jmp 0x10029200
jmp 0x100291da
jmp 0x100291b4
push 0xfba
push 0x9a9
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 1
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x63fa
lea eax, [ebp - 0x33c]
push eax
push 0
push 0x795
push 0x7049
push 0x387d
lea eax, [ebp - 0x2c]
push eax
push 1
call fcn.1002a91c
add esp, 0x2c
mov dword [ebp - 4], 0x1f
cmp dword [ebp - 0x238], 0x3e1c
jge 0x100292ec
push dword [ebp - 0x348]
call fcn.10049b86
pop ecx
jmp 0x10029308
or dword [ebp - 4], 0xffffffff
jmp 0x10029312
and dword [ebp - 0x4ec], 0
and dword [ebp - 0x4e8], 0
and dword [ebp - 0x4e4], 0
and dword [ebp - 0x4e0], 0
lea ecx, [ebp - 0x159]
call fcn.1001abba
push eax
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0x4ec]
push eax
lea ecx, [ebp - 0x6e0]
call fcn.1001abbd
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x6c0]
call fcn.1001ab69
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x140], 0x5c8094a1
mov dword [ebp - 0x6a4], 0xffffffff
mov dword [ebp - 0x350], 0x648bd921
mov dword [ebp - 0x140], 3
jmp 0x100293a1
mov eax, dword [ebp - 0x140]
dec eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jl 0x10029413
mov dword [ebp - 0x358], 0xffffffff
mov dword [ebp - 0x5ac], 0x23607a98
mov dword [ebp - 0x61c], 0xffffffff
mov dword [ebp - 0x5b4], 2
mov dword [ebp - 0x674], 1
lea eax, [ebp - 0x350]
push eax
push 0x47ba
lea eax, [ebp - 0x6c0]
push eax
push 0x74ab
push 0x76e1
push 1
lea eax, [ebp - 0x358]
push eax
push 1
push 0xd9b
call fcn.1001fd5d
add esp, 0x24
jmp 0x10029394
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c0]
call fcn.1001ab8f
jmp 0x10028765
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x170], 0x17b844a7
push 1
lea ecx, [ebp - 0x4b0]
call fcn.1001ab0d
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x370], 0xfffffffe
mov dword [ebp - 0x340], 0x6d7d0454
mov dword [ebp - 0x360], 0x6a9bebb
push 0
push 1
push 0x5cb8
lea eax, [ebp - 0x4b0]
push eax
lea eax, [ebp - 0x5bc]
push eax
push 0x2ed8
push 0x1af8
call fcn.10032e44
add esp, 0x1c
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x148], 0
jne 0x100294bb
push 2
pop eax
test eax, eax
jne 0x100294bb
and dword [ebp - 0x240], 0
jmp 0x100294c5
mov dword [ebp - 0x240], 1
mov eax, 0xffff
dec eax
cmp dword [ebp - 0x240], eax
je 0x100294df
mov dword [ebp - 0x248], 1
jmp 0x100294e6
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x248], eax
jg 0x10029500
mov dword [ebp - 0x250], 1
jmp 0x10029507
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x170], eax
mov esi, dword [ebp - 0x170]
push 0
lea ecx, [ebp - 0x4b0]
call fcn.1001abab
mov dword [eax], esi
push 0
push 0x3030
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x340]
push eax
push 0x4ef4
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x370]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x4b0]
push eax
call fcn.1002cdf8
add esp, 0x24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4b0]
call fcn.1001ab8f
mov dword [ebp - 0xa4], 0xffffffff
push 3
lea ecx, [ebp - 0x1a0]
call fcn.1001ab0d
mov dword [ebp - 4], 0x23
mov dword [ebp - 0x270], 0xfffffff6
mov dword [ebp - 0x5c4], 5
lea eax, [ebp - 0x1a0]
push eax
push 0
push 1
push 0x5bee
lea eax, [ebp - 0x6c4]
push eax
call fcn.1001fff9
add esp, 0x14
mov dword [ebp - 0xa4], 0
jmp 0x100295df
cmp dword [ebp - 0xa4], 0xffffffea
jle 0x100298a9
mov dword [ebp - 0x78], 0xfffffff9
push 3
lea ecx, [ebp - 0x4c8]
call fcn.1001ab0d
mov byte [ebp - 4], 0x24
push 0
push 0x47a6
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x4c8]
push eax
call fcn.1002e492
add esp, 0x10
mov dword [ebp - 0x94], 0
jmp 0x1002963a
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x10029656
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0xac], 0xffffffff
jmp 0x1002962d
mov dword [ebp - 0x78], 2
jmp 0x10029666
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jl 0x10029701
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x9c], 2
jmp 0x10029693
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jl 0x100296fc
mov dword [ebp - 0x378], 0xe356ec7e
lea eax, [ebp - 0x78]
push eax
push 0x34ed
lea eax, [ebp - 0x1a0]
push eax
push 0x527a
lea eax, [ebp - 0x270]
push eax
push 0x7b2
push 0
lea eax, [ebp - 0x9c]
push eax
push 0x762
push 0x1c05
call fcn.10031661
add esp, 0x28
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x378]
push eax
push 0
call fcn.1002fc1b
add esp, 0xc
jmp 0x10029686
jmp 0x1002965f
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x5cc], eax
xor eax, eax
inc eax
je 0x1002973f
push 0
lea ecx, [ebp - 0x1a0]
call fcn.1001abab
cmp dword [eax], 0
je 0x1002973f
push 1
lea ecx, [ebp - 0x4c8]
call fcn.1001abab
cmp dword [eax], 0
je 0x1002973f
mov dword [ebp - 0x258], 1
jmp 0x10029746
and dword [ebp - 0x258], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xac]
cmp dword [ebp - 0x258], eax
jl 0x10029767
mov dword [ebp - 0x260], 1
jmp 0x1002976e
and dword [ebp - 0x260], 0
cmp dword [ebp - 0x260], 0xfffffffa
jne 0x10029783
mov dword [ebp - 0x268], 1
jmp 0x1002978a
and dword [ebp - 0x268], 0
push 1
lea ecx, [ebp - 0x1a0]
call fcn.1001abab
mov ecx, dword [ebp - 0x268]
cmp ecx, dword [eax]
jg 0x100297b3
cmp dword [ebp - 0x270], 0
jne 0x100297b3
and dword [ebp - 0x278], 0
jmp 0x100297bd
mov dword [ebp - 0x278], 1
push 0
lea ecx, [ebp - 0x1a0]
call fcn.1001abab
mov eax, dword [eax]
cmp eax, dword [ebp - 0x278]
jle 0x100297e0
mov dword [ebp - 0x280], 1
jmp 0x100297e7
and dword [ebp - 0x280], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xac]
cmp dword [ebp - 0x280], eax
jle 0x10029808
mov dword [ebp - 0x380], 1
jmp 0x1002980f
and dword [ebp - 0x380], 0
push 2
lea ecx, [ebp - 0x1a0]
call fcn.1001abab
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xac], 0
jne 0x1002983a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a0]
call fcn.1001ab8f
push 4
push 0x1000
mov eax, dword [ebp - 0x2c]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x290]
add ecx, dword [eax + 0xc]
push ecx
push 0x4c79
push 0x75a0
call fcn.100418d6
pop ecx
pop ecx
call eax
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x2c]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x388]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x188]
call fcn.10041c8f
add esp, 0xc
mov dword [ebp - 0x150], 0x3606de71
push 1
lea ecx, [ebp - 0x328]
call fcn.1001ab0d
mov dword [ebp - 4], 0x25
mov dword [ebp - 0x5c], 0x198ab79a
mov dword [ebp - 0x2e0], 1
mov dword [ebp - 0x30], 0
jmp 0x1002994b
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x10029961
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x4d8], 0xae355683
jmp 0x10029944
mov dword [ebp - 0x30], 0
jmp 0x10029971
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1002998d
push dword [ebp - 0x30]
lea ecx, [ebp - 0x328]
call fcn.1001abab
mov dword [eax], 0x7563ffa
jmp 0x1002996a
mov dword [ebp - 0x150], 0
jmp 0x100299a6
cmp dword [ebp - 0x150], 1
jg 0x10029bcf
mov dword [ebp - 0x180], 0xf7bf
mov dword [ebp - 0x390], 0x9eb8
mov dword [ebp - 0x158], 0
jmp 0x100299e0
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 3
jge 0x100299fc
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x498], 0xa167c28c
jmp 0x100299d3
push 0
lea ecx, [ebp - 0x328]
call fcn.1001abab
cmp dword [eax], 0x7631615e
jg 0x10029a1d
mov dword [ebp - 0x178], 1
jmp 0x10029a24
and dword [ebp - 0x178], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x178]
mov dword [ebp + eax - 0x498], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4d8]
cmp dword [ebp - 0x178], eax
je 0x10029a58
mov dword [ebp - 0x298], 1
jmp 0x10029a5f
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x180]
cmp dword [ebp - 0x298], eax
je 0x10029a79
mov dword [ebp - 0x5c], 0
jmp 0x10029bdf
cmp dword [ebp - 0x5c], 0x1c
je 0x10029c8d
mov dword [ebp - 0x398], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2e0]
add ecx, dword [ebp + eax - 0x4d8]
je 0x10029c30
lea eax, [ebp - 0x2e0]
push eax
push 0x286f
push 0x3424
push 0
call fcn.1002d7e3
add esp, 0x10
cmp dword [ebp - 0x398], 0
je 0x10029c2e
jmp 0x10029c8d
jmp 0x10029c63
mov dword [ebp - 0x3a0], 0xecaa7054
push 0x3b64
push 0x5075
push 1
push 1
lea eax, [ebp - 0x3a0]
push eax
push 0x35ae
push 0
push 0x796a
call fcn.1002643e
add esp, 0x20
mov byte [ebp - 0x3a], 0
movzx eax, byte [ebp - 0x3a]
test eax, eax
je 0x10029c88
push 0x2d0a
push 0
push 0x47be
push 0xeee
call fcn.100316a2
add esp, 0x10
jmp 0x10029bd8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x328]
call fcn.1001ab8f
mov dword [ebp - 0x114], 0
push 1
lea ecx, [ebp - 0x530]
call fcn.1001ab0d
mov dword [ebp - 4], 0x26
mov dword [ebp - 0x3a8], 0x11151
push 0x65db
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x684]
push eax
push 1
push 0
push 0x5d97
push 1
call fcn.10021248
add esp, 0x1c
mov dword [ebp - 0x114], 0xfffffff1
jmp 0x10029d03
cmp dword [ebp - 0x114], 0xfffffffd
jle 0x10029e12
push 3
lea ecx, [ebp - 0x310]
call fcn.1001ab0d
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x5dc]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
call fcn.1002ab7a
add esp, 0xc
push 2
lea ecx, [ebp - 0x310]
call fcn.1001abab
and dword [eax], 0
jmp 0x10029d6f
push 0x33e3
lea eax, [ebp - 0x3a8]
push eax
push 0x48a
push 0
call fcn.10032cba
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x530]
call fcn.1001ab8f
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x188]
mov dword [eax + 8], ecx
jmp 0x10028765
jmp 0x10029e81
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3b0], eax
push 0x7000
push dword [ebp - 0x3b0]
push 0
push 0x4928
push dword [ebp - 0x3b8]
call fcn.1001f49a
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret