Function at 0x1002af3c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100733f4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xacc
push esi
push edi
mov dword [ebp - 0x19c], 0xf6af1124
mov dword [ebp - 0x98c], 0xffffffff
push 2
lea ecx, [ebp - 0x8f8]
call fcn.10024d89
and dword [ebp - 4], 0
mov dword [ebp - 0x15c], 0
jmp 0x1002af9a
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 2
jge 0x1002afbc
push dword [ebp - 0x15c]
lea ecx, [ebp - 0x8f8]
call fcn.10024e10
mov dword [eax], 0xfffffff8
jmp 0x1002af8d
mov dword [ebp - 0x19c], 6
jmp 0x1002afd5
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0xffffffef
jge 0x1002b375
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x698], 1
mov dword [ebp - 0x3c], 0
jmp 0x1002b003
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1002b019
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x6c8], 0x91e29ea4
jmp 0x1002affc
mov dword [ebp - 0x3c], 0
jmp 0x1002b029
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1002b03f
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x690], 0xfffffff8
jmp 0x1002b022
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x54], 0
jmp 0x1002b056
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jg 0x1002b370
mov dword [ebp - 0x130], 0xfca86293
mov dword [ebp - 0x8fc], 0xfffffffa
mov dword [ebp - 0x164], 0
jmp 0x1002b08d
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 4
jge 0x1002b0a9
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0xa00], 0x9a22db78
jmp 0x1002b080
cmp dword [ebp - 0x54], 0
je 0x1002b333
mov dword [ebp - 0x88], 0xfffffffb
mov dword [ebp - 0x58c], 0xffff
mov dword [ebp - 0xe4], 6
push 2
lea ecx, [ebp - 0x814]
call fcn.10024d89
mov byte [ebp - 4], 1
mov dword [ebp - 0x1a4], 0
jmp 0x1002b0fb
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 2
jge 0x1002b11d
push dword [ebp - 0x1a4]
lea ecx, [ebp - 0x814]
call fcn.10024e10
mov dword [eax], 1
jmp 0x1002b0ee
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xa00]
cmp dword [ebp - 0x88], eax
jne 0x1002b13e
mov dword [ebp - 0x5c4], 1
jmp 0x1002b145
and dword [ebp - 0x5c4], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xa00], 0
jne 0x1002b16d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6c8], 0
jne 0x1002b16d
and dword [ebp - 0x35c], 0
jmp 0x1002b177
mov dword [ebp - 0x35c], 1
cmp dword [ebp - 0x35c], 0x53fc
jg 0x1002b18f
mov dword [ebp - 0x57c], 1
jmp 0x1002b196
and dword [ebp - 0x57c], 0
cmp dword [ebp - 0x57c], 0x4593f6a0
je 0x1002b1b4
cmp dword [ebp - 0x88], 0
jne 0x1002b1b4
and dword [ebp - 0x584], 0
jmp 0x1002b1be
mov dword [ebp - 0x584], 1
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x58c], eax
mov eax, dword [ebp - 0x58c]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x9c8], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x88], eax
je 0x1002b1f9
mov dword [ebp - 0x5a8], 1
jmp 0x1002b200
and dword [ebp - 0x5a8], 0
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xa00], 0x26d8f9c3
mov eax, 0xc312fbb6
cmp eax, 0x26d8f9c3
jbe 0x1002b229
mov dword [ebp - 0x2f8], 1
jmp 0x1002b230
and dword [ebp - 0x2f8], 0
cmp dword [ebp - 0x2f8], 0xa3d8
jle 0x1002b248
mov dword [ebp - 0x574], 1
jmp 0x1002b24f
and dword [ebp - 0x574], 0
cmp dword [ebp - 0x574], 0xfff7
je 0x1002b267
mov dword [ebp - 0x580], 1
jmp 0x1002b26e
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x580]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x130], 0
jmp 0x1002b293
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 3
jg 0x1002b322
mov dword [ebp - 0x88], 0
jmp 0x1002b2b9
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jg 0x1002b31d
mov dword [ebp - 0xe4], 0
jmp 0x1002b2db
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 3
jg 0x1002b31b
mov byte [ebp - 0x71], 0
lea eax, [ebp - 0x71]
push eax
push 0
call fcn.10029a64
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x814]
call fcn.10024e10
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x300]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x300]
mov dword [ecx], eax
jmp 0x1002b2ce
jmp 0x1002b2ac
jmp 0x1002b286
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x814]
call fcn.10024e0b
jmp 0x1002b350
mov dword [ebp - 0x688], 0x5708880d
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x688]
mov dword [ebp + eax - 0x690], ecx
push 0x49f7
lea eax, [ebp - 0x698]
push eax
push 0x7c5c
push 0
call fcn.10029d6c
add esp, 0x10
jmp 0x1002b04f
jmp 0x1002afc8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8f8]
call fcn.10024e0b
mov dword [ebp - 0xcc], 0x4ccb63e8
mov dword [ebp - 0x470], 0xe28fdeb7
push 1
lea ecx, [ebp - 0x748]
call fcn.10024d89
mov dword [ebp - 4], 2
mov dword [ebp - 0x478], 0xa329ef4a
mov dword [ebp - 0x6a0], 0xfffffff8
lea eax, [ebp - 0x748]
push eax
push 0
push 0x764f
lea eax, [ebp - 0x91c]
push eax
push 0x72b3
call fcn.1002a224
add esp, 0x14
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x1002b408
push 0
push 0x1a88
push 0xaa3
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0xa14], eax
mov dword [ebp - 0x470], 0x94f9
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x470], eax
jge 0x1002b438
mov dword [ebp - 0x308], 1
jmp 0x1002b43f
and dword [ebp - 0x308], 0
mov esi, dword [ebp - 0xcc]
add esi, dword [ebp - 0x308]
push 0
lea ecx, [ebp - 0x748]
call fcn.10024e10
mov dword [eax], esi
push 0
lea ecx, [ebp - 0x748]
call fcn.10024e10
mov ecx, dword [ebp - 0xcc]
cmp dword [eax], ecx
jle 0x1002b47d
mov dword [ebp - 0x528], 1
jmp 0x1002b484
and dword [ebp - 0x528], 0
cmp dword [ebp - 0x528], 0x10b9
jle 0x1002b4a2
mov eax, 0x5256ee97
test eax, eax
jne 0x1002b4a2
and dword [ebp - 0x310], 0
jmp 0x1002b4ac
mov dword [ebp - 0x310], 1
mov eax, dword [ebp - 0xcc]
add eax, dword [ebp - 0x310]
sub eax, dword [ebp - 0xcc]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x6a0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x748]
call fcn.10024e0b
mov eax, dword [0x10cb1190]
and eax, 1
jne 0x1002b516
mov eax, dword [0x10cb1190]
or eax, 1
mov dword [0x10cb1190], eax
mov dword [ebp - 4], 3
mov ecx, 0x10cb1208
call fcn.1003178e
push 0x100746db
call fcn.1005b0d6
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x16c], 0
jmp 0x1002b536
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 1
jge 0x1002b552
mov eax, dword [ebp - 0x16c]
mov dword [ebp + eax*4 - 0x92c], 0xfffffff9
jmp 0x1002b529
mov dword [ebp - 0x64], 0
jmp 0x1002b562
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x1002b57e
mov byte [ebp - 0x73], 0
movzx eax, byte [ebp - 0x73]
test eax, eax
je 0x1002b57c
push 0
call fcn.10029de2
pop ecx
jmp 0x1002b55b
mov dword [ebp - 0x64], 0
jmp 0x1002b58e
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jg 0x1002b5bd
mov byte [ebp - 0x81], 0
push 0x4d65
lea eax, [ebp - 0x81]
push eax
push 0x2ef9
push 0x66f7
push 0
call fcn.10031505
add esp, 0x14
jmp 0x1002b587
push dword [ebp + 8]
lea ecx, [ebp - 0x838]
call fcn.100316c9
mov dword [ebp - 4], 4
mov dword [ebp - 0xf8], 0xffffffff
mov dword [ebp - 0xf8], 9
jmp 0x1002b5f5
mov eax, dword [ebp - 0xf8]
dec eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 1
jne 0x1002b649
mov dword [ebp - 0x6a8], 0xc69a
mov byte [ebp - 0x75], 0
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x1002b632
push 0x7974
push 0x7b73
push 1
push 0x5881
push 0x755d
call fcn.100295c0
add esp, 0x14
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x6a8]
push eax
call fcn.10029673
pop ecx
pop ecx
jmp 0x1002b5e8
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x1002b669
push 0x5ffe
push 1
call fcn.10029692
pop ecx
pop ecx
lea eax, [ebp - 0x9d0]
push eax
lea ecx, [ebp - 0x838]
call fcn.10031720
push dword [eax]
lea eax, [ebp - 0x93c]
push eax
lea ecx, [ebp - 0x838]
call fcn.10031734
push dword [eax]
lea eax, [ebp - 0xa04]
push eax
lea ecx, [ebp - 0x838]
call fcn.10031720
push dword [eax]
mov edx, 0x10026433
lea ecx, [ebp - 0x94c]
call fcn.10031e78
add esp, 0xc
lea ecx, [ebp - 0x838]
call fcn.100263be
mov dword [ebp - 0x56c], eax
movzx eax, byte [0x10cb10ea]
test eax, eax
je 0x1002b8be
mov ecx, 0x10cb1208
call fcn.10031853
movzx eax, al
test eax, eax
jne 0x1002b8be
mov dword [ebp - 0x6b8], 0xa9d19ac1
mov dword [ebp - 0x6c0], 0x83bc1b0f
mov dword [ebp - 0x318], 0xd0127420
push 1
lea ecx, [ebp - 0x778]
call fcn.10024d89
mov byte [ebp - 4], 5
mov dword [ebp - 0x5b8], 2
mov dword [ebp - 0x320], 0
push 1
lea ecx, [ebp - 0x85c]
call fcn.10024d89
mov byte [ebp - 4], 6
lea eax, [ebp - 0x778]
push eax
lea eax, [ebp - 0x6b0]
push eax
push 0
call fcn.1002aaf7
add esp, 0xc
lea eax, [ebp - 0x85c]
push eax
lea eax, [ebp - 0x6b0]
push eax
push 1
call fcn.100296c1
add esp, 0xc
push 0x5ea7
lea eax, [ebp - 0x6b8]
push eax
lea eax, [ebp - 0x778]
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x5b8]
push eax
lea eax, [ebp - 0x85c]
push eax
push 0
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x6c0]
push eax
call fcn.1002ac31
add esp, 0x24
push 0xd91
lea eax, [ebp - 0x778]
push eax
push 1
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x5b8]
push eax
lea eax, [ebp - 0x320]
push eax
call fcn.1002972d
add esp, 0x18
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x85c]
call fcn.10024e0b
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x778]
call fcn.10024e0b
lea eax, [ebp - 0x56c]
push eax
lea eax, [ebp - 0x480]
push eax
mov ecx, 0x10cb1208
call fcn.1003185c
mov dword [ebp - 0x9d8], 0x70ad
mov byte [ebp - 0x77], 0
movzx eax, byte [ebp - 0x77]
test eax, eax
je 0x1002b83c
push 0x1b90
push 1
push 0x4159
call fcn.100298c5
add esp, 0xc
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x1002b86c
push 0x3ef6
push 0x57fd
push 1
push 0x6a43
push 0x57b6
call fcn.10029931
add esp, 0x14
lea eax, [ebp - 0x95c]
push eax
mov ecx, 0x10cb1208
call fcn.10031845
push eax
lea ecx, [ebp - 0x480]
call fcn.10031877
movzx eax, al
test eax, eax
je 0x1002b8be
lea ecx, [ebp - 0x480]
call fcn.10031871
mov eax, dword [eax + 4]
mov dword [ebp - 0x628], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x838]
call fcn.10031716
mov eax, dword [ebp - 0x628]
jmp 0x1002fd5c
mov dword [ebp - 0x120], 0x9b55bb2c
mov dword [ebp - 0x120], 0x13
jmp 0x1002b8e1
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xffffffe9
je 0x1002b93f
mov dword [ebp - 0x1ac], 0
mov dword [ebp - 0x1ac], 0xfffffff7
jmp 0x1002b90d
mov eax, dword [ebp - 0x1ac]
dec eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0xffffffed
jle 0x1002b93d
mov dword [ebp - 0x724], 0xf7a73d2d
lea eax, [ebp - 0x724]
push eax
push 0
call fcn.10029c94
pop ecx
pop ecx
cmp dword [ebp - 0x120], 0
je 0x1002b93b
jmp 0x1002b900
jmp 0x1002b900
jmp 0x1002b8d4
and dword [ebp - 0xbc], 0
mov dword [ebp - 0x90], 1
mov dword [ebp - 0x72c], 0
mov dword [ebp - 0x174], 0
jmp 0x1002b973
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 3
jge 0x1002b98f
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x808], 0x7fd5
jmp 0x1002b966
mov dword [ebp - 0x90], 2
jmp 0x1002b9a8
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x1002ba64
mov eax, dword [ebp - 0x90]
cmp dword [ebp + eax*4 - 0x808], 0
je 0x1002b9e1
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x1002b9df
push 0x2336
push 1
call fcn.10029a64
pop ecx
pop ecx
jmp 0x1002ba5f
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp + eax*4 - 0x808]
mov ecx, dword [ebp - 0x90]
sub eax, dword [ebp + ecx*4 - 0x808]
je 0x1002ba2d
mov byte [ebp - 0xa1], 0
movzx eax, byte [ebp - 0xa1]
test eax, eax
je 0x1002ba17
push 0
call fcn.10029b25
pop ecx
mov byte [ebp - 0x7b], 0
movzx eax, byte [ebp - 0x7b]
test eax, eax
je 0x1002ba2b
push 0
call fcn.1002a00b
pop ecx
jmp 0x1002ba5f
mov dword [ebp - 0x328], 0xcf09cc25
lea eax, [ebp - 0x328]
push eax
push 0
lea eax, [ebp - 0x72c]
push eax
push 0x2c07
call fcn.1002a85e
add esp, 0x10
cmp dword [ebp - 0x328], 0
je 0x1002ba5f
jmp 0x1002ba64
jmp 0x1002b99b
lea eax, [ebp - 0x838]
push eax
call fcn.1002799b
pop ecx
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jne 0x1002fce4
mov dword [ebp - 0x98], 0xb110c93b
mov dword [ebp - 0x668], 4
mov dword [ebp - 0x638], 0x49562184
mov dword [ebp - 0x1b4], 0
jmp 0x1002babb
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 3
jge 0x1002bad7
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x7e4], 0xfffffffe
jmp 0x1002baae
mov dword [ebp - 0x98], 8
jmp 0x1002baf0
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xb
jle 0x1002bf57
mov dword [ebp - 0xdc], 0
push 1
lea ecx, [ebp - 0x5f0]
call fcn.10024d89
mov byte [ebp - 4], 7
mov dword [ebp - 0x588], 0x90ae73
mov dword [ebp - 0x350], 0xffffffff
push 0
push 0x21c1
lea eax, [ebp - 0xa24]
push eax
lea eax, [ebp - 0x5f0]
push eax
call fcn.10029bc5
add esp, 0x10
mov dword [ebp - 0xdc], 0
jmp 0x1002bb62
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0xe
jne 0x1002bf43
mov dword [ebp - 0x34], 0
jmp 0x1002bb7f
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x1002bb92
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x44], 0x9609c3fb
jmp 0x1002bb78
mov dword [ebp - 0x34], 0
jmp 0x1002bba2
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x1002bbb8
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x754], 0xb56095db
jmp 0x1002bb9b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x44], 0
jmp 0x1002bbdd
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x44], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x44], 0xfffffffa
jle 0x1002bf22
mov dword [ebp - 0x58], 0xadf1adb2
mov dword [ebp - 0x348], 0xfffffffc
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x96c], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x530], eax
push 0
lea ecx, [ebp - 0x5f0]
call fcn.10024e10
mov ecx, dword [ebp - 0x530]
mov dword [eax], ecx
cmp dword [ebp - 0x530], 0
jne 0x1002bccf
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x9e0], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x880], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x98]
cmp dword [ebp + eax - 0x44], ecx
jne 0x1002bc69
mov dword [ebp - 0x330], 1
jmp 0x1002bc70
and dword [ebp - 0x330], 0
push 0
lea ecx, [ebp - 0x5f0]
call fcn.10024e10
mov eax, dword [eax]
cmp eax, dword [ebp - 0x330]
jl 0x1002bc9c
mov eax, 0xe707
test eax, eax
je 0x1002bc9c
mov dword [ebp - 0x2bc], 1
jmp 0x1002bca3
and dword [ebp - 0x2bc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2bc]
mov dword [ebp + eax - 0x7e4], ecx
mov eax, dword [ebp - 0x98]
imul eax, dword [ebp - 0x2bc]
test eax, eax
jne 0x1002bccf
and dword [ebp - 0x488], 0
jmp 0x1002bcd9
mov dword [ebp - 0x488], 1
cmp dword [ebp - 0x488], 0x4886
jl 0x1002bcf1
mov dword [ebp - 0x338], 1
jmp 0x1002bcf8
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x588], eax
mov eax, dword [ebp - 0x588]
cmp dword [ebp - 0x58], eax
jg 0x1002bd1b
mov dword [ebp - 0x340], 1
jmp 0x1002bd22
and dword [ebp - 0x340], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x340]
sub ecx, dword [ebp + eax - 0x44]
imul ecx, dword [ebp - 0xdc]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x754], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x44], 0
je 0x1002be8e
mov eax, 0xe158
test eax, eax
je 0x1002bd72
cmp dword [ebp - 0x58], 0
je 0x1002bd72
mov dword [ebp - 0x490], 1
jmp 0x1002bd79
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0xa0b2b040
jne 0x1002bd9d
mov dword [ebp - 0x708], 1
jmp 0x1002bda4
and dword [ebp - 0x708], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x888], eax
mov eax, dword [ebp - 0x350]
add eax, 3
jne 0x1002bdd0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x7e4], 0
jne 0x1002bdd0
and dword [ebp - 0x538], 0
jmp 0x1002bdda
mov dword [ebp - 0x538], 1
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x538], eax
jge 0x1002bdf1
mov dword [ebp - 0x498], 1
jmp 0x1002bdf8
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x350]
sub eax, dword [ebp - 0x498]
cmp eax, dword [ebp - 0x58]
jle 0x1002be15
mov dword [ebp - 0x358], 1
jmp 0x1002be1c
and dword [ebp - 0x358], 0
push 0
lea ecx, [ebp - 0x5f0]
call fcn.10024e10
mov ecx, dword [ebp - 0x358]
cmp ecx, dword [eax]
jle 0x1002be3f
mov dword [ebp - 0x644], 1
jmp 0x1002be46
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x890], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
cmp dword [ebp - 0x668], eax
jne 0x1002be6d
mov dword [ebp - 0x5a4], 1
jmp 0x1002be74
and dword [ebp - 0x5a4], 0
mov eax, dword [ebp - 0x638]
cmp dword [ebp - 0x5a4], eax
jge 0x1002be8e
mov dword [ebp - 0x360], 1
jmp 0x1002be95
and dword [ebp - 0x360], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x44]
cmp dword [ebp - 0x360], eax
jge 0x1002beb3
mov dword [ebp - 0x4a0], 1
jmp 0x1002beba
and dword [ebp - 0x4a0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x754]
cmp dword [ebp - 0x4a0], eax
jge 0x1002bedb
mov dword [ebp - 0x368], 1
jmp 0x1002bee2
and dword [ebp - 0x368], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x754]
cmp eax, dword [ebp - 0x368]
jne 0x1002bf03
mov dword [ebp - 0x540], 1
jmp 0x1002bf0a
and dword [ebp - 0x540], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x540]
mov dword [ebp + eax - 0x7e4], ecx
jmp 0x1002bbc8
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x754]
push 0
lea ecx, [ebp - 0x5f0]
call fcn.10024e10
mov dword [eax], esi
jmp 0x1002bb55
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x5f0]
call fcn.10024e0b
jmp 0x1002bae3
and dword [ebp - 0x7b0], 0
and dword [ebp - 0x7ac], 0
and dword [ebp - 0x7a8], 0
and dword [ebp - 0x7a4], 0
lea ecx, [ebp - 0x2a5]
call fcn.10009032
push eax
lea eax, [ebp - 0x7a0]
push eax
lea eax, [ebp - 0x7b0]
push eax
lea ecx, [ebp - 0xa6c]
call fcn.10024e1f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa34]
call fcn.10024de5
mov byte [ebp - 4], 8
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x150], 0
jmp 0x1002bfcf
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jg 0x1002c02d
push 3
lea ecx, [ebp - 0x850]
call fcn.10024d89
mov byte [ebp - 4], 9
push 0x7e9e
push 0
lea eax, [ebp - 0x898]
push eax
lea eax, [ebp - 0x850]
push eax
call fcn.10029cf8
add esp, 0x10
push 0x78cb
lea eax, [ebp - 0x850]
push eax
push 0
call fcn.10029e99
add esp, 0xc
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x850]
call fcn.10024e0b
jmp 0x1002bfc2
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa34]
call fcn.10024e0b
cmp dword [0x10cb10e0], 0
jne 0x1002fb18
mov dword [ebp - 0x2b4], 0xffff
mov dword [ebp - 0x60], 0xfffffff6
mov dword [ebp - 0x634], 0xfffffffb
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x8a0], eax
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x2b4]
sub eax, dword [ebp - 0x60]
jne 0x1002c0cd
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x8a8], eax
cmp dword [ebp - 0x60], 0x4bcd
jl 0x1002c0a2
mov dword [ebp - 0x370], 1
jmp 0x1002c0a9
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x370]
add eax, 0x7d0fa516
cmp eax, 0x401d1b98
jle 0x1002c0cd
mov eax, 0x6eea5306
test eax, eax
jne 0x1002c0cd
and dword [ebp - 0x4a8], 0
jmp 0x1002c0d7
mov dword [ebp - 0x4a8], 1
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x634], eax
mov dword [ebp - 0x60], 0xfffffffa
jmp 0x1002c0f3
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 7
je 0x1002c1a9
mov dword [ebp - 0x7d8], 0xfffffff7
mov dword [ebp - 0x7d4], 0xfffffff7
mov dword [ebp - 0x7d0], 0xfffffff7
mov dword [ebp - 0x7cc], 0xfffffff7
lea ecx, [ebp - 0x28d]
call fcn.10009032
push eax
lea eax, [ebp - 0x7c8]
push eax
lea eax, [ebp - 0x7d8]
push eax
lea ecx, [ebp - 0xa94]
call fcn.10024e1f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x844]
call fcn.10024de5
mov byte [ebp - 4], 0xa
push 0xff3
push 0
push 0x2a75
call fcn.1002a8d4
add esp, 0xc
push 3
lea ecx, [ebp - 0x844]
call fcn.10024e10
cmp dword [eax], 0
je 0x1002c195
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x844]
call fcn.10024e0b
jmp 0x1002c1a9
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x844]
call fcn.10024e0b
jmp 0x1002c0ec
mov dword [ebp - 0x1bc], 0x2fe22364
mov dword [ebp - 0x8b0], 0x417be18
mov dword [ebp - 0x8b8], 0x5e81a7ec
mov dword [ebp - 0x378], 0xc5d177cc
mov dword [ebp - 0x8c0], 2
mov dword [ebp - 0x14], 0
jmp 0x1002c1eb
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1002c201
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8c8], 1
jmp 0x1002c1e4
mov dword [ebp - 0x14], 0
jmp 0x1002c211
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002c227
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa8c], 0xddcd1665
jmp 0x1002c20a
mov dword [ebp - 0x14], 0
jmp 0x1002c237
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x1002c24d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8d0], 0xa5f34bda
jmp 0x1002c230
mov dword [ebp - 0x1bc], 0
jmp 0x1002c266
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0
jg 0x1002c35d
push 1
lea ecx, [ebp - 0x928]
call fcn.10024d89
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x8d8], 0
mov dword [ebp - 0x8e0], 7
mov dword [ebp - 0x8e8], 0x7cd95da2
push 4
lea ecx, [ebp - 0x908]
call fcn.10024d89
mov byte [ebp - 4], 0xc
push 0x6218
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x928]
push eax
push 1
call fcn.10029aaf
add esp, 0x10
mov dword [ebp - 0x100], 0
jmp 0x1002c2e9
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 4
jge 0x1002c30b
push dword [ebp - 0x100]
lea ecx, [ebp - 0x908]
call fcn.10024e10
mov dword [eax], 1
jmp 0x1002c2dc
mov byte [ebp - 0x91], 0
lea eax, [ebp - 0x91]
push eax
push 0x74bb
push 0x7a0b
push 0
call fcn.1002a2cb
add esp, 0x10
mov eax, dword [ebp - 0x378]
inc eax
mov dword [ebp - 0x378], eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x908]
call fcn.10024e0b
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x928]
call fcn.10024e0b
jmp 0x1002c259
mov byte [ebp - 0x214], 2
mov byte [ebp - 0x213], 0x44
mov byte [ebp - 0x212], 9
mov byte [ebp - 0x211], 0x16
mov byte [ebp - 0x210], 3
mov byte [ebp - 0x20f], 0xa
mov byte [ebp - 0x20e], 0x1d
mov byte [ebp - 0x20d], 0x54
mov byte [ebp - 0x20c], 0x77
mov byte [ebp - 0x20b], 0xeb
mov byte [ebp - 0x20a], 0x32
mov byte [ebp - 0x209], 0xfb
mov byte [ebp - 0x208], 0x70
mov byte [ebp - 0x207], 0xe9
mov byte [ebp - 0x206], 0x65
mov byte [ebp - 0x205], 0xa9
mov byte [ebp - 0x204], 0x30
mov byte [ebp - 0x203], 0x85
mov byte [ebp - 0x202], 0xdc
mov byte [ebp - 0x201], 0x55
mov byte [ebp - 0x200], 0x20
mov byte [ebp - 0x1ff], 0x54
mov byte [ebp - 0x1fe], 0x22
mov byte [ebp - 0x1fd], 0x48
mov byte [ebp - 0x1fc], 0x7d
mov byte [ebp - 0x1fb], 0x96
mov byte [ebp - 0x1fa], 0xcd
mov byte [ebp - 0x1f9], 0x67
mov byte [ebp - 0x1f8], 0x4c
mov byte [ebp - 0x1f7], 0x6c
mov byte [ebp - 0x1f6], 0x3b
mov byte [ebp - 0x1f5], 0x2f
mov byte [ebp - 0x1f4], 0xae
mov byte [ebp - 0x1f3], 0x61
mov byte [ebp - 0x1f2], 0xb3
mov byte [ebp - 0x1f1], 0x3c
mov byte [ebp - 0x1f0], 6
mov byte [ebp - 0x1ef], 0x5d
mov byte [ebp - 0x1ee], 5
mov byte [ebp - 0x1ed], 0x5f
mov byte [ebp - 0x1ec], 7
mov byte [ebp - 0x1eb], 0x5e
mov byte [ebp - 0x1ea], 0
mov byte [ebp - 0x1e9], 0x79
mov byte [ebp - 0x1e8], 1
mov byte [ebp - 0x1e7], 0x2e
mov byte [ebp - 0x1e6], 0xb
mov byte [ebp - 0x1e5], 9
mov byte [ebp - 0x1e4], 8
mov byte [ebp - 0x1e3], 0x42
mov byte [ebp - 0x1e2], 0xa
mov byte [ebp - 0x1e1], 0x42
mov byte [ebp - 0x1e0], 4
mov byte [ebp - 0x1df], 9
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x214]
or eax, 0x36
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x214]
and ecx, 0x36
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x214]
mov word [ebp + ecx*2 - 0x878], ax
push 3
lea ecx, [ebp - 0x6d8]
call fcn.10024d89
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x380], 0x4b733c63
mov dword [ebp - 0x670], 8
push 1
lea ecx, [ebp - 0x938]
call fcn.10024d89
mov byte [ebp - 4], 0xe
mov dword [ebp - 0xec], 0
jmp 0x1002c560
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 3
jge 0x1002c582
push dword [ebp - 0xec]
lea ecx, [ebp - 0x6d8]
call fcn.10024e10
mov dword [eax], 0x399841b3
jmp 0x1002c553
lea eax, [ebp - 0xec]
push eax
push 0
lea eax, [ebp - 0x938]
push eax
call fcn.1002abb2
add esp, 0xc
push 0
lea ecx, [ebp - 0x6d8]
call fcn.10024e10
mov dword [eax], 0x18
jmp 0x1002c5d3
push 0
lea ecx, [ebp - 0x6d8]
call fcn.10024e10
mov dword [ebp - 0x590], eax
mov eax, dword [ebp - 0x590]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x590]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x6d8]
call fcn.10024e10
cmp dword [eax], 0x18
jl 0x1002c5fd
mov dword [ebp - 0x380], 0x6748f69f
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x670], eax
jmp 0x1002c5af
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x938]
call fcn.10024e0b
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x6d8]
call fcn.10024e0b
mov dword [ebp - 0x1c], 2
and dword [ebp - 0x188], 0
jmp 0x1002c633
mov eax, dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x36
jae 0x1002d612
mov dword [ebp - 0x7c4], 0x7dfa860b
mov dword [ebp - 0x7c0], 0x7dfa860b
mov dword [ebp - 0x7bc], 0x7dfa860b
mov dword [ebp - 0x7b8], 0x7dfa860b
lea ecx, [ebp - 0x2ad]
call fcn.10009032
push eax
lea eax, [ebp - 0x7b4]
push eax
lea eax, [ebp - 0x7c4]
push eax
lea ecx, [ebp - 0xa9c]
call fcn.10024e1f
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xa58]
call fcn.10024de5
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x128], 0x37c1d6b3
mov dword [ebp - 0x4d0], 0xa30a4ccf
push 2
lea ecx, [ebp - 0x76c]
call fcn.10024d89
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x108], 0
jmp 0x1002c6dc
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 1
jge 0x1002c6f5
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0x68], 3
jmp 0x1002c6cf
lea eax, [ebp - 0x108]
push eax
push 0
lea eax, [ebp - 0x76c]
push eax
call fcn.1002a04d
add esp, 0xc
mov byte [ebp - 0x6a], 0
movzx eax, byte [ebp - 0x6a]
test eax, eax
je 0x1002c721
push 1
call fcn.10029b25
pop ecx
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x68], 0
jmp 0x1002c746
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x68]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x68], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x68], 3
jg 0x1002cc61
mov dword [ebp - 0x5d8], 8
mov dword [ebp - 0x5d4], 8
mov dword [ebp - 0x5d0], 8
mov dword [ebp - 0x5cc], 8
mov dword [ebp - 0x710], 0xa7f359a1
mov dword [ebp - 0x184], 0
jmp 0x1002c7a2
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 1
jge 0x1002c7be
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0xa0], 0xe6da504
jmp 0x1002c795
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xa0], 3
jmp 0x1002c7ec
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa0], 0
jl 0x1002cac9
mov dword [ebp - 0x63c], 1
mov dword [ebp - 0x9cc], 1
mov dword [ebp - 0x388], 0xd44c039e
mov dword [ebp - 0x678], 9
mov dword [ebp - 0x3b0], 0xba13b288
mov dword [ebp - 0x9d4], 0
mov dword [ebp - 0x9dc], 0x87fce6bb
mov dword [ebp - 0x9e4], 0x8112def9
mov dword [ebp - 0x9ec], 0x133f29c8
push 2
lea ecx, [ebp - 0x820]
call fcn.10024d89
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x29c], 0x59c3f908
push 1
lea eax, [ebp - 0xa08]
push eax
lea eax, [ebp - 0x820]
push eax
call fcn.10029b4b
add esp, 0xc
push 1
lea eax, [ebp - 0x63c]
push eax
push 0x526e
push 0x10ce
call fcn.10029bc5
add esp, 0x10
mov eax, dword [ebp - 0x678]
mov dword [ebp - 0xa10], eax
imul eax, dword [ebp - 0x128], 0xffff
test eax, eax
je 0x1002c8d7
cmp dword [ebp - 0x128], 0
je 0x1002c8d7
mov dword [ebp - 0x4b0], 1
jmp 0x1002c8de
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x4b0]
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 0
je 0x1002c900
push 0
lea ecx, [ebp - 0x76c]
call fcn.10024e10
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x5d8]
cmp dword [ebp + eax - 0x68], ecx
jg 0x1002c924
mov dword [ebp - 0x548], 1
jmp 0x1002c92b
and dword [ebp - 0x548], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5d8]
cmp dword [ebp - 0x548], eax
jle 0x1002c94b
mov dword [ebp - 0x390], 1
jmp 0x1002c952
and dword [ebp - 0x390], 0
cmp dword [ebp - 0x390], 0xd28a2181
jne 0x1002c96a
mov dword [ebp - 0x4b8], 1
jmp 0x1002c971
and dword [ebp - 0x4b8], 0
push 1
lea ecx, [ebp - 0x820]
call fcn.10024e10
imul ecx, dword [ebp - 0x4b8], 0x31fc
cmp dword [eax], ecx
je 0x1002c998
mov dword [ebp - 0x398], 1
jmp 0x1002c99f
and dword [ebp - 0x398], 0
cmp dword [ebp - 0x398], 0x4174
jge 0x1002c9b7
mov dword [ebp - 0x5ac], 1
jmp 0x1002c9be
and dword [ebp - 0x5ac], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5d8]
cmp dword [ebp - 0x5ac], eax
jg 0x1002c9de
mov dword [ebp - 0x3a0], 1
jmp 0x1002c9e5
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x3a0]
neg eax
cmp eax, dword [ebp - 0x3b0]
jne 0x1002ca01
mov dword [ebp - 0x680], 1
jmp 0x1002ca08
and dword [ebp - 0x680], 0
mov eax, 0x43ad
cmp eax, 0xbf2f
jle 0x1002ca20
mov dword [ebp - 0x4c0], 1
jmp 0x1002ca27
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
je 0x1002ca49
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x68], 0
jne 0x1002ca59
push 0xfffffffffffffffc
pop eax
test eax, eax
jne 0x1002ca59
and dword [ebp - 0x3a8], 0
jmp 0x1002ca63
mov dword [ebp - 0x3a8], 1
mov eax, dword [ebp - 0x29c]
mov dword [ebp - 0x6bc], eax
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x64c], eax
mov eax, dword [ebp - 0x29c]
dec eax
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x6bc]
cmp eax, dword [ebp - 0x64c]
jne 0x1002caa2
mov dword [ebp - 0x550], 1
jmp 0x1002caa9
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x3b0], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x820]
call fcn.10024e0b
jmp 0x1002c7d1
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x68]
cmp dword [ebp + eax - 0x5d8], ecx
jne 0x1002caed
mov dword [ebp - 0x4c8], 1
jmp 0x1002caf4
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x4c8]
add eax, 0x3ffcd553
je 0x1002cb16
mov eax, 0x87d1
test eax, eax
je 0x1002cb16
mov dword [ebp - 0x3b8], 1
jmp 0x1002cb1d
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x3b8]
neg eax
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x5d8]
jne 0x1002cb51
cmp dword [ebp - 0x710], 0
je 0x1002cb51
mov eax, 0xc4fb
test eax, eax
je 0x1002cb51
mov dword [ebp - 0x5a0], 1
jmp 0x1002cb58
and dword [ebp - 0x5a0], 0
push 1
lea ecx, [ebp - 0x76c]
call fcn.10024e10
mov dword [eax], 0xdd14a140
cmp dword [ebp - 0x5a0], 0xdd14a140
jle 0x1002cb83
mov dword [ebp - 0x3c0], 1
jmp 0x1002cb8a
and dword [ebp - 0x3c0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5d8]
add eax, dword [ebp - 0x3c0]
add eax, dword [ebp - 0x128]
mov dword [ebp - 0x4d0], eax
je 0x1002cbc7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa0], 0
je 0x1002cbc7
mov dword [ebp - 0x3c8], 1
jmp 0x1002cbce
and dword [ebp - 0x3c8], 0
cmp dword [ebp - 0x3c8], 0xfffe
jbe 0x1002cbe6
mov dword [ebp - 0x654], 1
jmp 0x1002cbed
and dword [ebp - 0x654], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xa0]
cmp dword [ebp + eax - 0x5d8], ecx
jge 0x1002cc1a
mov eax, 0x2cd4
test eax, eax
jne 0x1002cc1a
and dword [ebp - 0x558], 0
jmp 0x1002cc24
mov dword [ebp - 0x558], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x68]
cmp dword [ebp - 0x558], eax
je 0x1002cc42
mov dword [ebp - 0x3d0], 1
jmp 0x1002cc49
and dword [ebp - 0x3d0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3d0]
mov dword [ebp + eax - 0xa0], ecx
jmp 0x1002c731
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x76c]
call fcn.10024e0b
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa58]
call fcn.10024e0b
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x214]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x1c], eax
jne 0x1002d35a
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x214]
inc eax
mov dword [ebp - 0x188], eax
mov dword [ebp - 0xc0], 0xffff
push 2
lea ecx, [ebp - 0x59c]
call fcn.10024d89
mov byte [ebp - 4], 0x12
mov dword [ebp - 0xd4], 0x9729cf30
mov dword [ebp - 0xc8], 0x4e80031a
mov dword [ebp - 0x2b8], 1
mov dword [ebp - 0x110], 0
mov dword [ebp - 0xd0], 0x9f196e6c
mov dword [ebp - 0x50], 0
jmp 0x1002cd09
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x1002cd22
push dword [ebp - 0x50]
lea ecx, [ebp - 0x59c]
call fcn.10024e10
or dword [eax], 0xffffffff
jmp 0x1002cd02
mov dword [ebp - 0x50], 0
jmp 0x1002cd32
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x1002cd48
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0xad8], 0x3c17a3f0
jmp 0x1002cd2b
push 0x5577
lea eax, [ebp - 0xc0]
push eax
push 0
lea eax, [ebp - 0x59c]
push eax
push 0x1861
call fcn.10029edb
add esp, 0x14
push 1
lea ecx, [ebp - 0x59c]
call fcn.10024e10
mov eax, dword [eax]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xc0]
sub eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0x2b8]
je 0x1002cd9f
mov dword [ebp - 0x4d8], 1
jmp 0x1002cda6
and dword [ebp - 0x4d8], 0
push 0
lea ecx, [ebp - 0x59c]
call fcn.10024e10
mov ecx, dword [ebp - 0x4d8]
add ecx, dword [eax]
cmp ecx, 1
je 0x1002cdcc
mov dword [ebp - 0x3d8], 1
jmp 0x1002cdd3
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x2b8]
imul eax, dword [ebp - 0x3d8]
cmp eax, 1
je 0x1002cdec
cmp dword [ebp - 0x110], 0
push 1
lea ecx, [ebp - 0x59c]
call fcn.10024e10
mov esi, eax
push 1
lea ecx, [ebp - 0x59c]
call fcn.10024e10
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x1002ce1a
mov dword [ebp - 0x5b4], 1
jmp 0x1002ce21
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0x5b4], eax
jle 0x1002ce3b
mov dword [ebp - 0x3e0], 1
jmp 0x1002ce42
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0xd0], eax
mov esi, dword [ebp - 0xd0]
push 0
lea ecx, [ebp - 0x59c]
call fcn.10024e10
cmp dword [eax], esi
jge 0x1002ce7a
cmp dword [ebp - 0xd4], 0
je 0x1002ce7a
mov dword [ebp - 0x4e0], 1
jmp 0x1002ce81
and dword [ebp - 0x4e0], 0
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x4e0]
jle 0x1002ce9b
mov dword [ebp - 0x3e8], 1
jmp 0x1002cea2
and dword [ebp - 0x3e8], 0
cmp dword [ebp - 0x3e8], 0xd9a54e58
jbe 0x1002ceba
mov dword [ebp - 0x560], 1
jmp 0x1002cec1
and dword [ebp - 0x560], 0
cmp dword [ebp - 0x560], 0xd7c3b7c3
jbe 0x1002ced9
mov dword [ebp - 0x3f0], 1
jmp 0x1002cee0
and dword [ebp - 0x3f0], 0
cmp dword [ebp - 0x3f0], 0xd940
jge 0x1002cf4c
mov dword [ebp - 0x6c4], 0x14186e14
mov dword [ebp - 0x65c], 0xba1dd793
mov dword [ebp - 0xd4], 0
jmp 0x1002cf19
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x17
jne 0x1002cf3b
mov byte [ebp - 0x6c], 0
push 0x22e7
push 1
lea eax, [ebp - 0x6c]
push eax
call fcn.10029c3b
add esp, 0xc
jmp 0x1002cf0c
mov eax, dword [ebp - 0x6c4]
mov dword [ebp - 0x65c], eax
jmp 0x1002d080
mov dword [ebp - 0x720], 9
mov dword [ebp - 0xc0], 0
jmp 0x1002cf6f
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x37
jg 0x1002d065
mov dword [ebp - 0x79c], 0xfffffffd
mov dword [ebp - 0x798], 0xfffffffd
mov dword [ebp - 0x794], 0xfffffffd
mov dword [ebp - 0x790], 0xfffffffd
mov dword [ebp - 0xc8], 0
jmp 0x1002cfbd
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0x11
jge 0x1002d060
mov byte [ebp - 0x6e], 0
movzx eax, byte [ebp - 0x6e]
test eax, eax
je 0x1002cfe4
push 0x5e65
push 1
call fcn.10029c94
pop ecx
pop ecx
mov dword [ebp - 0x110], 0
jmp 0x1002cffd
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0x10
jg 0x1002d05b
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x79c]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x79c], eax
mov dword [ebp - 0xd0], 0
jmp 0x1002d03a
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 3
jg 0x1002d059
mov byte [ebp - 0x70], 0
movzx eax, byte [ebp - 0x70]
test eax, eax
je 0x1002d057
push 1
call fcn.10029cce
pop ecx
jmp 0x1002d02d
jmp 0x1002cff0
jmp 0x1002cfb0
jmp 0x1002cf62
lea eax, [ebp - 0x720]
push eax
push 1
push 0x1718
push 0xc48
call fcn.10029cf8
add esp, 0x10
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x59c]
call fcn.10024e0b
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x214]
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x1c], eax
push 4
lea ecx, [ebp - 0x2e0]
call fcn.10024d89
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x2a4], 1
mov dword [ebp - 0x3f8], 1
lea eax, [ebp - 0x2e0]
push eax
push 0x8d
lea eax, [ebp - 0x138]
push eax
push 1
call fcn.10029d6c
add esp, 0x10
mov dword [ebp - 0x138], 0
jmp 0x1002d0ff
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 4
jge 0x1002d11b
mov eax, dword [ebp - 0x138]
mov dword [ebp + eax*4 - 0x2d4], 0
jmp 0x1002d0f2
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x2d4], 3
jmp 0x1002d146
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2d4]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x2d4], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2d4], 0
jl 0x1002d346
mov dword [ebp - 0x568], 9
mov dword [ebp - 0x664], 0x3bed162c
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2d4]
mov dword [ebp - 0xa18], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2d4], 0xfffffffb
jbe 0x1002d19a
mov dword [ebp - 0x4e8], 1
jmp 0x1002d1a1
and dword [ebp - 0x4e8], 0
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x2d4]
lea ecx, [ebp - 0x2e0]
call fcn.10024e10
mov eax, dword [eax]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x4e8]
mov dword [ebp - 0x3f8], eax
mov esi, dword [ebp - 0x3f8]
mov edi, dword [ebp - 0x2a4]
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x2d4]
lea ecx, [ebp - 0x2e0]
call fcn.10024e10
add edi, dword [eax]
cmp edi, esi
jl 0x1002d210
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2d4], 0
je 0x1002d210
mov dword [ebp - 0x5bc], 1
jmp 0x1002d217
and dword [ebp - 0x5bc], 0
cmp dword [ebp - 0x5bc], 0xffffffff
jg 0x1002d22c
mov dword [ebp - 0x400], 1
jmp 0x1002d233
and dword [ebp - 0x400], 0
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x2d4]
lea ecx, [ebp - 0x2e0]
call fcn.10024e10
mov ecx, dword [ebp - 0x400]
imul ecx, dword [eax]
test ecx, ecx
je 0x1002d273
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x2d4]
lea ecx, [ebp - 0x2e0]
call fcn.10024e10
cmp dword [eax], 0
jne 0x1002d28a
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x2d4]
lea ecx, [ebp - 0x2e0]
call fcn.10024e10
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x2d4]
lea ecx, [ebp - 0x2e0]
call fcn.10024e10
cmp dword [eax], 0
jne 0x1002d2cb
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x2d4]
lea ecx, [ebp - 0x2e0]
call fcn.10024e10
cmp dword [eax], 0
jne 0x1002d2cb
and dword [ebp - 0x4f0], 0
jmp 0x1002d2d5
mov dword [ebp - 0x4f0], 1
push 4
pop eax
shl eax, 1
push dword [ebp + eax - 0x2d4]
lea ecx, [ebp - 0x2e0]
call fcn.10024e10
mov eax, dword [eax]
cmp eax, dword [ebp - 0x4f0]
jl 0x1002d302
mov dword [ebp - 0x408], 1
jmp 0x1002d309
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0xa20], eax
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x664], eax
mov byte [ebp - 0x72], 0
movzx eax, byte [ebp - 0x72]
test eax, eax
je 0x1002d341
push 1
call fcn.10029de2
pop ecx
jmp 0x1002d12d
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2e0]
call fcn.10024e0b
jmp 0x1002c62b
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x213]
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x188]
movzx ecx, byte [ebp + ecx - 0x216]
movzx ecx, word [ebp + ecx*2 - 0x878]
or eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x213]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x188]
movzx edx, byte [ebp + edx - 0x216]
movzx edx, word [ebp + edx*2 - 0x878]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x214]
mov word [ebp + ecx*2 - 0x878], ax
mov dword [ebp - 0x20], 0x5c80
mov dword [ebp - 0x428], 0x7eb8e136
push 3
lea ecx, [ebp - 0x784]
call fcn.10024d89
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x438], 0xffff
mov dword [ebp - 0x508], 0
push 1
lea eax, [ebp - 0x784]
push eax
push 0x7f21
lea eax, [ebp - 0x118]
push eax
call fcn.10029e17
add esp, 0x10
mov dword [ebp - 0x118], 0
jmp 0x1002d427
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 3
jge 0x1002d443
mov eax, dword [ebp - 0x118]
mov dword [ebp + eax*4 - 0xa40], 0x865e1bfe
jmp 0x1002d41a
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xa28], eax
cmp dword [ebp - 0x20], 0x1b0ae28d
je 0x1002d45b
cmp dword [ebp - 0x20], 0
je 0x1002d46d
cmp dword [ebp - 0x20], 0
je 0x1002d46d
mov dword [ebp - 0x410], 1
jmp 0x1002d474
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x410], eax
je 0x1002d48b
mov dword [ebp - 0x4f8], 1
jmp 0x1002d492
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x4f8]
sub eax, dword [ebp - 0x428]
mov dword [ebp - 0x418], eax
push 0
lea ecx, [ebp - 0x784]
call fcn.10024e10
mov ecx, dword [ebp - 0x418]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x418], eax
jle 0x1002d4d0
mov dword [ebp - 0x5c8], 1
jmp 0x1002d4d7
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x5c8]
je 0x1002d4ee
mov dword [ebp - 0x420], 1
jmp 0x1002d4f5
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x420], eax
jle 0x1002d50c
mov dword [ebp - 0x500], 1
jmp 0x1002d513
and dword [ebp - 0x500], 0
imul eax, dword [ebp - 0x500], 0
cmp eax, 0xa37b
jl 0x1002d52d
mov dword [ebp - 0x6cc], 1
jmp 0x1002d534
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x428]
neg eax
cmp eax, dword [ebp - 0x20]
jle 0x1002d54d
mov dword [ebp - 0x570], 1
jmp 0x1002d554
and dword [ebp - 0x570], 0
mov eax, dword [ebp - 0x570]
mov dword [ebp - 0x438], eax
push 0
lea ecx, [ebp - 0x784]
call fcn.10024e10
mov ecx, dword [ebp - 0x20]
cmp dword [eax], ecx
je 0x1002d580
mov dword [ebp - 0x430], 1
jmp 0x1002d587
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x508], 0
jne 0x1002d5ae
cmp dword [ebp - 0x438], 0
jne 0x1002d5ae
and dword [ebp - 0x5b0], 0
jmp 0x1002d5b8
mov dword [ebp - 0x5b0], 1
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x5b0]
jle 0x1002d5cf
mov dword [ebp - 0x440], 1
jmp 0x1002d5d6
and dword [ebp - 0x440], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x440]
mov dword [ebp + eax - 0xa40], ecx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x784]
call fcn.10024e0b
lea eax, [ebp - 0x188]
push eax
push 0x7e4d
push 1
call fcn.10029e99
add esp, 0xc
jmp 0x1002c62b
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0x878], cx
lea eax, [ebp - 0x878]
push eax
lea ecx, [ebp - 0xab4]
call fcn.100316f1
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp - 0x66c]
mov dword [ebp - 0x718], eax
mov byte [ebp - 4], 0x15
push dword [ebp - 0x718]
call fcn.1002799b
pop ecx
mov dword [ebp - 0x554], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xab4]
call fcn.10031716
push 1
lea ecx, [ebp - 0x7fc]
call fcn.10024d89
mov byte [ebp - 4], 0x16
push 4
lea ecx, [ebp - 0x7f0]
call fcn.10024d89
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x7fc]
push eax
push 0x7763
push 1
push 0x5fed
lea eax, [ebp - 0xf0]
push eax
call fcn.10029edb
add esp, 0x14
mov dword [ebp - 0xf0], 0
jmp 0x1002d6c8
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 4
jge 0x1002d6ea
push dword [ebp - 0xf0]
lea ecx, [ebp - 0x7f0]
call fcn.10024e10
mov dword [eax], 0x80643b8a
jmp 0x1002d6bb
mov byte [ebp - 0x74], 0
push 0x695a
push 0x553
push 1
lea eax, [ebp - 0x74]
push eax
push 0x58df
call fcn.10029f81
add esp, 0x14
push 0
lea eax, [ebp - 0x7f0]
push eax
push 0x1e62
lea eax, [ebp - 0x7fc]
push eax
push 0x7891
call fcn.1002a0c0
add esp, 0x14
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x7f0]
call fcn.10024e0b
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x7fc]
call fcn.10024e0b
and dword [ebp - 0x1b8], 0
jmp 0x1002d761
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0xd
jae 0x1002d831
push 3
lea ecx, [ebp - 0x948]
call fcn.10024d89
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x190], 0xb02971c1
mov dword [ebp - 0x1c8], 0
jmp 0x1002d7a2
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
jge 0x1002d7c1
push dword [ebp - 0x1c8]
lea ecx, [ebp - 0x948]
call fcn.10024e10
and dword [eax], 0
jmp 0x1002d795
mov dword [ebp - 0x190], 2
jmp 0x1002d7da
mov eax, dword [ebp - 0x190]
dec eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0
jl 0x1002d80d
mov byte [ebp - 0x76], 0
movzx eax, byte [ebp - 0x76]
test eax, eax
je 0x1002d7f7
push 1
call fcn.1002a00b
pop ecx
push 0x30c0
push 1
push 0x5c5d
call fcn.1002a04d
add esp, 0xc
jmp 0x1002d7cd
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x948]
call fcn.10024e0b
xor eax, eax
mov ecx, dword [ebp - 0x1b8]
mov word [ebp + ecx*2 - 0x878], ax
jmp 0x1002d754
mov dword [ebp - 0x9e8], 0xffffffff
mov dword [ebp - 0x910], 0x1897a4a
push 3
lea ecx, [ebp - 0x958]
call fcn.10024d89
mov byte [ebp - 4], 0x19
push 1
push 0x81f
lea eax, [ebp - 0xf4]
push eax
push 0x1eda
lea eax, [ebp - 0x958]
push eax
call fcn.1002a0c0
add esp, 0x14
mov dword [ebp - 0xf4], 0
jmp 0x1002d891
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jge 0x1002d8ad
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x78c], 0xffff
jmp 0x1002d884
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x78c]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x78c], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x958]
call fcn.10024e0b
cmp dword [ebp - 0x554], 0
je 0x1002fb18
push 1
lea ecx, [ebp - 0x614]
call fcn.10024d89
mov byte [ebp - 4], 0x1a
push 0x48ff
push 1
lea eax, [ebp - 0x884]
push eax
push 0x3c25
lea eax, [ebp - 0x614]
push eax
call fcn.1002a224
add esp, 0x14
push 0
lea ecx, [ebp - 0x614]
call fcn.10024e10
mov dword [eax], 0xffffffee
jmp 0x1002d950
push 0
lea ecx, [ebp - 0x614]
call fcn.10024e10
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x510]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x510]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x614]
call fcn.10024e10
cmp dword [eax], 7
jle 0x1002dbb8
push 1
lea ecx, [ebp - 0x6f8]
call fcn.10024d89
mov byte [ebp - 4], 0x1b
push 2
lea ecx, [ebp - 0x608]
call fcn.10024d89
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x6f8]
push eax
lea eax, [ebp - 0x674]
push eax
push 0
call fcn.1002a94a
add esp, 0xc
push 0xfdf
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x608]
push eax
push 1
call fcn.1002a2cb
add esp, 0x10
push 0
lea ecx, [ebp - 0x608]
call fcn.10024e10
and dword [eax], 0
jmp 0x1002d9f3
push 0
lea ecx, [ebp - 0x608]
call fcn.10024e10
mov dword [ebp - 0x448], eax
mov eax, dword [ebp - 0x448]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x448]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x608]
call fcn.10024e10
cmp dword [eax], 0
jg 0x1002db60
mov dword [ebp - 0xfc], 1
mov dword [ebp - 0xfc], 0
jmp 0x1002da2c
mov eax, dword [ebp - 0xfc]
dec eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
jl 0x1002db5b
mov dword [ebp - 0x4c], 0
jmp 0x1002da49
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x1002da5f
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x6e8], 0x8a012e1d
jmp 0x1002da42
mov dword [ebp - 0x4c], 0
jmp 0x1002da6f
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x1002da85
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x198], 0xec3d4e70
jmp 0x1002da68
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x6e8], 0
jmp 0x1002dab3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6e8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x6e8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6e8], 0
jl 0x1002dae4
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x6e8]
lea ecx, [ebp - 0x6f8]
call fcn.10024e10
cmp dword [eax], 0
je 0x1002dae2
jmp 0x1002dae4
jmp 0x1002da98
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x198], 0
jmp 0x1002db12
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x198]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x198], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x198], 0
jg 0x1002db56
mov byte [ebp - 0x78], 0
movzx eax, byte [ebp - 0x78]
test eax, eax
je 0x1002db3c
push 1
push 0x69bc
call fcn.1002a351
pop ecx
pop ecx
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x6f8]
call fcn.10024e10
cmp dword [eax], 0
je 0x1002db54
jmp 0x1002daf7
jmp 0x1002daf7
jmp 0x1002da1f
jmp 0x1002d9cf
push 0
lea ecx, [ebp - 0x614]
call fcn.10024e10
cmp dword [eax], 0
je 0x1002db95
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x608]
call fcn.10024e0b
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x6f8]
call fcn.10024e0b
jmp 0x1002d92c
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x608]
call fcn.10024e0b
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x6f8]
call fcn.10024e0b
jmp 0x1002d92c
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x614]
call fcn.10024e0b
mov dword [ebp - 0x1d8], 0x1928c176
mov byte [ebp - 0x7a], 0
movzx eax, byte [ebp - 0x7a]
test eax, eax
je 0x1002dbeb
push 1
push 0x51f3
call fcn.1002a3b0
pop ecx
pop ecx
mov dword [ebp - 0x1d8], 0
jmp 0x1002dc04
mov eax, dword [ebp - 0x1d8]
dec eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0xffffffee
je 0x1002dc26
mov dword [ebp - 0x578], 0x3099
mov eax, dword [ebp - 0x578]
dec eax
mov dword [ebp - 0x578], eax
jmp 0x1002dbf7
push 4
lea ecx, [ebp - 0x14c]
call fcn.10024d89
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x97c], 0x9b6f3608
mov dword [ebp - 0x10], 0
jmp 0x1002dc51
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002dc6d
push dword [ebp - 0x10]
lea ecx, [ebp - 0x14c]
call fcn.10024e10
mov dword [eax], 0xfffc
jmp 0x1002dc4a
mov dword [ebp - 0x10], 0
jmp 0x1002dc7d
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1002dc90
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x30], 0
jmp 0x1002dc76
mov dword [ebp - 0x10], 0
jmp 0x1002dca0
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002dcb6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x73c], 0xffffffff
jmp 0x1002dc99
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 8
jle 0x1002dccf
mov dword [ebp - 0x450], 1
jmp 0x1002dcd6
and dword [ebp - 0x450], 0
cmp dword [ebp - 0x450], 1
jle 0x1002dceb
mov dword [ebp - 0x518], 1
jmp 0x1002dcf2
and dword [ebp - 0x518], 0
push 3
lea ecx, [ebp - 0x14c]
call fcn.10024e10
mov eax, dword [eax]
cmp eax, dword [ebp - 0x518]
jg 0x1002dd15
mov dword [ebp - 0x458], 1
jmp 0x1002dd1c
and dword [ebp - 0x458], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x458]
sub ecx, dword [ebp + eax - 0x30]
jne 0x1002dd44
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0
jne 0x1002dd44
and dword [ebp - 0x5c0], 0
jmp 0x1002dd4e
mov dword [ebp - 0x5c0], 1
push 0
lea ecx, [ebp - 0x14c]
call fcn.10024e10
mov ecx, dword [ebp - 0x5c0]
cmp ecx, dword [eax]
je 0x1002dd71
mov dword [ebp - 0x460], 1
jmp 0x1002dd78
and dword [ebp - 0x460], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
cmp dword [ebp - 0x460], eax
je 0x1002dda8
push 3
lea ecx, [ebp - 0x14c]
call fcn.10024e10
cmp dword [eax], 0
je 0x1002dda8
mov dword [ebp - 0x520], 1
jmp 0x1002ddaf
and dword [ebp - 0x520], 0
push 1
lea ecx, [ebp - 0x14c]
call fcn.10024e10
mov ecx, dword [ebp - 0x520]
cmp ecx, dword [eax]
jge 0x1002ddd2
mov dword [ebp - 0x468], 1
jmp 0x1002ddd9
and dword [ebp - 0x468], 0
push 3
lea ecx, [ebp - 0x14c]
call fcn.10024e10
mov esi, dword [ebp - 0x468]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0x14c]
call fcn.10024e10
cmp esi, dword [eax]
jge 0x1002de0c
mov dword [ebp - 0x2f4], 1
jmp 0x1002de13
and dword [ebp - 0x2f4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2f4]
mov dword [ebp + eax - 0x30], ecx
push 3
lea ecx, [ebp - 0x14c]
call fcn.10024e10
mov esi, eax
push 3
lea ecx, [ebp - 0x14c]
call fcn.10024e10
mov ecx, dword [esi]
sub ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x30]
je 0x1002de5b
mov dword [ebp - 0x2fc], 1
jmp 0x1002de62
and dword [ebp - 0x2fc], 0
push 3
lea ecx, [ebp - 0x14c]
call fcn.10024e10
mov ecx, dword [ebp - 0x2fc]
add ecx, dword [eax]
cmp ecx, 7
jne 0x1002de88
mov dword [ebp - 0x304], 1
jmp 0x1002de8f
and dword [ebp - 0x304], 0
push 3
lea ecx, [ebp - 0x14c]
call fcn.10024e10
mov ecx, dword [ebp - 0x304]
cmp ecx, dword [eax]
jle 0x1002deb2
mov dword [ebp - 0x30c], 1
jmp 0x1002deb9
and dword [ebp - 0x30c], 0
cmp dword [ebp - 0x30c], 7
ja 0x1002dece
mov dword [ebp - 0x314], 1
jmp 0x1002ded5
and dword [ebp - 0x314], 0
push 2
lea ecx, [ebp - 0x14c]
call fcn.10024e10
mov ecx, dword [ebp - 0x314]
imul ecx, dword [eax]
cmp ecx, 0x25f321ee
jle 0x1002df09
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0
jne 0x1002df09
and dword [ebp - 0x31c], 0
jmp 0x1002df13
mov dword [ebp - 0x31c], 1
push 0
lea ecx, [ebp - 0x14c]
call fcn.10024e10
mov ecx, dword [ebp - 0x31c]
sub ecx, dword [eax]
cmp ecx, 0x7c15
jne 0x1002df3c
mov dword [ebp - 0x324], 1
jmp 0x1002df43
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x324]
neg eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x73c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0
je 0x1002e128
mov dword [ebp - 0x104], 0xffffffff
mov dword [ebp - 0x6dc], 0x8f874340
mov dword [ebp - 0x67c], 0xfffffff7
mov dword [ebp - 0x104], 0xfffffff1
jmp 0x1002dfa0
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 3
jl 0x1002e115
mov dword [ebp - 0x28], 0x9acb085b
mov dword [ebp - 0x28], 0
jmp 0x1002dfc4
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jg 0x1002e0f4
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x73c], 0
jne 0x1002e009
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x73c], 0
ja 0x1002dff4
mov dword [ebp - 0x32c], 1
jmp 0x1002dffb
and dword [ebp - 0x32c], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x14c]
call fcn.10024e10
xor eax, eax
sub eax, 0x5032
jne 0x1002e01b
mov eax, 0x5443c7f3
test eax, eax
je 0x1002e02d
cmp dword [ebp - 0x28], 0
je 0x1002e02d
mov dword [ebp - 0x334], 1
jmp 0x1002e034
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x6dc]
cmp dword [ebp - 0x334], eax
jge 0x1002e04e
mov dword [ebp - 0x33c], 1
jmp 0x1002e055
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x33c], eax
jle 0x1002e06c
mov dword [ebp - 0x344], 1
jmp 0x1002e073
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x344]
sub eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0x67c]
jle 0x1002e09a
push dword [ebp - 0x28]
lea ecx, [ebp - 0x14c]
call fcn.10024e10
cmp dword [eax], 0
je 0x1002e0b6
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x73c], 0
je 0x1002e0b6
mov dword [ebp - 0x34c], 1
jmp 0x1002e0bd
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x34c]
add eax, 9
mov dword [ebp - 0x354], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x354]
mov dword [ebp + eax - 0x30], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x354]
mov dword [ebp + eax - 0x73c], ecx
jmp 0x1002dfbd
mov byte [ebp - 0x7c], 0
push 0x30a7
push 1
push 0x52c2
lea eax, [ebp - 0x7c]
push eax
call fcn.1002a3f5
add esp, 0x10
jmp 0x1002df93
push 0x4100
push 0
call fcn.1002a698
pop ecx
pop ecx
jmp 0x1002e1b8
mov dword [ebp - 0x700], 0x59e0ea8e
mov dword [ebp - 0x684], 0x8c41cee3
xor eax, eax
inc eax
je 0x1002e15a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0
je 0x1002e15a
mov dword [ebp - 0x2f0], 1
jmp 0x1002e161
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x700]
cmp dword [ebp - 0x2f0], eax
jl 0x1002e181
cmp dword [ebp - 0x684], 0
jne 0x1002e181
and dword [ebp - 0x364], 0
jmp 0x1002e18b
mov dword [ebp - 0x364], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x364]
mov dword [ebp + eax - 0x73c], ecx
mov byte [ebp - 0x7e], 0
movzx eax, byte [ebp - 0x7e]
test eax, eax
je 0x1002e1b8
push 0x4602
push 1
call fcn.1002a476
pop ecx
pop ecx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x14c]
call fcn.10024e0b
mov byte [ebp - 0x28c], 5
mov byte [ebp - 0x28b], 0x81
mov byte [ebp - 0x28a], 8
mov byte [ebp - 0x289], 8
mov byte [ebp - 0x288], 6
mov byte [ebp - 0x287], 3
mov byte [ebp - 0x286], 1
mov byte [ebp - 0x285], 0xd
mov byte [ebp - 0x284], 2
mov byte [ebp - 0x283], 0xe
mov byte [ebp - 0x282], 0
mov byte [ebp - 0x281], 0x2d
mov byte [ebp - 0x280], 0x5c
mov byte [ebp - 0x27f], 0xda
mov byte [ebp - 0x27e], 0xd2
mov byte [ebp - 0x27d], 0xd8
mov byte [ebp - 0x27c], 0xb5
mov byte [ebp - 0x27b], pe_nt_image_headers32
mov byte [ebp - 0x27a], 0x80
mov byte [ebp - 0x279], 0x98
mov byte [ebp - 0x278], 0x18
mov byte [ebp - 0x277], 6
mov byte [ebp - 0x276], 0xec
mov byte [ebp - 0x275], 0x80
mov byte [ebp - 0x274], 0x90
mov byte [ebp - 0x273], 0xdc
mov byte [ebp - 0x272], 0xc0
mov byte [ebp - 0x271], 0x44
mov byte [ebp - 0x270], 0xc9
mov byte [ebp - 0x26f], 0x67
mov byte [ebp - 0x26e], 0xb6
mov byte [ebp - 0x26d], 0xf3
mov byte [ebp - 0x26c], 0x90
mov byte [ebp - 0x26b], 0xb
mov byte [ebp - 0x26a], 0xfe
mov byte [ebp - 0x269], 0xa3
mov byte [ebp - 0x268], 0xe4
mov byte [ebp - 0x267], 0xc4
mov byte [ebp - 0x266], 0x6d
mov byte [ebp - 0x265], 0x44
mov byte [ebp - 0x264], 0x92
mov byte [ebp - 0x263], 0xae
mov byte [ebp - 0x262], 0x78
mov byte [ebp - 0x261], 0xd6
mov byte [ebp - 0x260], 0x89
mov byte [ebp - 0x25f], 0xc8
mov byte [ebp - 0x25e], 0x76
mov byte [ebp - 0x25d], 0x23
mov byte [ebp - 0x25c], 0x68
mov byte [ebp - 0x25b], 0xa8
mov byte [ebp - 0x25a], 0x92
mov byte [ebp - 0x259], 0x12
mov byte [ebp - 0x258], 0x69
mov byte [ebp - 0x257], 0xfa
mov byte [ebp - 0x256], 0xe4
mov byte [ebp - 0x255], 0x43
mov byte [ebp - 0x254], 0xb2
mov byte [ebp - 0x253], 0xf4
mov byte [ebp - 0x252], 0x2f
mov byte [ebp - 0x251], 0xa5
mov byte [ebp - 0x250], 0xaa
mov byte [ebp - 0x24f], 0x13
mov byte [ebp - 0x24e], 0x9a
mov byte [ebp - 0x24d], 0x83
mov byte [ebp - 0x24c], 0x54
mov byte [ebp - 0x24b], 0x61
mov byte [ebp - 0x24a], 0xe
mov byte [ebp - 0x249], 0xd9
mov byte [ebp - 0x248], 0xe1
mov byte [ebp - 0x247], 0x8e
mov byte [ebp - 0x246], 0xe9
mov byte [ebp - 0x245], 0x76
mov byte [ebp - 0x244], 0x6d
mov byte [ebp - 0x243], 0x90
mov byte [ebp - 0x242], 0xbe
mov byte [ebp - 0x241], 0x97
mov byte [ebp - 0x240], 0x15
mov byte [ebp - 0x23f], 0xa1
mov byte [ebp - 0x23e], 0xd7
mov byte [ebp - 0x23d], 0x2e
mov byte [ebp - 0x23c], 0xe7
mov byte [ebp - 0x23b], 0x4f
mov byte [ebp - 0x23a], 0xa3
mov byte [ebp - 0x239], 0x5c
mov byte [ebp - 0x238], 0x57
mov byte [ebp - 0x237], 0x72
mov byte [ebp - 0x236], 0xe0
mov byte [ebp - 0x235], 0xde
mov byte [ebp - 0x234], 0x9e
mov byte [ebp - 0x233], 0xb8
mov byte [ebp - 0x232], 0x86
mov byte [ebp - 0x231], 5
mov byte [ebp - 0x230], 0xe8
mov byte [ebp - 0x22f], 0xa5
mov byte [ebp - 0x22e], 0x59
mov byte [ebp - 0x22d], 0x4f
mov byte [ebp - 0x22c], 0x82
mov byte [ebp - 0x22b], 0x2b
mov byte [ebp - 0x22a], 0x34
mov byte [ebp - 0x229], 0x69
mov byte [ebp - 0x228], 0x73
mov byte [ebp - 0x227], 0xbb
mov byte [ebp - 0x226], 0x53
mov byte [ebp - 0x225], 0x17
mov byte [ebp - 0x224], 0xdb
mov byte [ebp - 0x223], 9
mov byte [ebp - 0x222], 0x3e
mov byte [ebp - 0x221], 0xb
mov byte [ebp - 0x220], 0x25
mov byte [ebp - 0x21f], 7
mov byte [ebp - 0x21e], 0x25
mov byte [ebp - 0x21d], 0xa
mov byte [ebp - 0x21c], 0xb
mov byte [ebp - 0x21b], 3
mov byte [ebp - 0x21a], 0x1d
mov byte [ebp - 0x219], 4
mov byte [ebp - 0x218], 0x28
mov dword [ebp - 0x2c], 0x20f89b54
mov dword [ebp - 0x1a0], 0
jmp 0x1002e51a
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 3
jge 0x1002e536
mov eax, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0x2ec], 0x85f70ad6
jmp 0x1002e50d
mov dword [ebp - 0x2c], 0
jmp 0x1002e546
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x1002e867
mov dword [ebp - 0x24], 0x52c58fb7
mov dword [ebp - 0x1a8], 1
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x1c0], 0
jmp 0x1002e584
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 3
jge 0x1002e5a0
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0xa4c], 4
jmp 0x1002e577
mov dword [ebp - 0x24], 2
jmp 0x1002e5b0
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1002e744
mov dword [ebp - 0x68c], 0x1540ee1d
mov byte [ebp - 0x80], 0
movzx eax, byte [ebp - 0x80]
test eax, eax
je 0x1002e5fd
push 0x1a26
push 0x688f
push 0x6ad3
push 0x6028
push 0x5922
push 0x20c8
push 1
push 0x4938
call fcn.1002a4c3
add esp, 0x20
cmp dword [ebp - 0x2c], 0xc279a20b
jb 0x1002e612
mov dword [ebp - 0x6ec], 1
jmp 0x1002e619
and dword [ebp - 0x6ec], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2ec]
mov dword [ebp - 0x88c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xa0c], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x24]
cmp eax, 0xfffd
je 0x1002e64d
mov dword [ebp - 0x36c], 1
jmp 0x1002e654
and dword [ebp - 0x36c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2ec]
cmp dword [ebp - 0x36c], eax
jl 0x1002e674
mov dword [ebp - 0x374], 1
jmp 0x1002e67b
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x374], eax
je 0x1002e692
mov dword [ebp - 0x37c], 1
jmp 0x1002e699
and dword [ebp - 0x37c], 0
cmp dword [ebp - 0x37c], 0xfffffffc
jg 0x1002e6ae
mov dword [ebp - 0x384], 1
jmp 0x1002e6b5
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x2ec]
cmp dword [ebp - 0x384], eax
jne 0x1002e6d3
mov dword [ebp - 0x38c], 1
jmp 0x1002e6da
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x68c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0xf8c7b5c6
ja 0x1002e707
mov dword [ebp - 0x394], 1
jmp 0x1002e70e
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x2ec]
cmp eax, dword [ebp - 0x394]
je 0x1002e72c
mov dword [ebp - 0x39c], 1
jmp 0x1002e733
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x2c0], eax
jmp 0x1002e5a9
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x2ec], 0
je 0x1002e824
cmp dword [ebp - 0x1a8], 0
jne 0x1002e76d
cmp dword [ebp - 0x24], 0
jne 0x1002e76d
and dword [ebp - 0x3a4], 0
jmp 0x1002e777
mov dword [ebp - 0x3a4], 1
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x894], eax
push 4
pop eax
shl eax, 1
imul eax, dword [ebp + eax - 0x2ec], 0x6fe1
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x2ec]
jge 0x1002e7ae
mov dword [ebp - 0x3ac], 1
jmp 0x1002e7b5
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x3a4]
cmp eax, dword [ebp - 0x3ac]
jl 0x1002e7d2
cmp dword [ebp - 0x2c], 0
jne 0x1002e7d2
and dword [ebp - 0x3b4], 0
jmp 0x1002e7dc
mov dword [ebp - 0x3b4], 1
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x2ec]
cmp eax, dword [ebp - 0x3b4]
jg 0x1002e7fa
mov dword [ebp - 0x70c], 1
jmp 0x1002e801
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x87c], eax
mov eax, dword [ebp - 0x2c0]
sub eax, 6
je 0x1002e824
mov dword [ebp - 0x3bc], 1
jmp 0x1002e82b
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x2ec]
cmp dword [ebp - 0x3bc], eax
jg 0x1002e849
mov dword [ebp - 0x3c4], 1
jmp 0x1002e850
and dword [ebp - 0x3c4], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3c4]
mov dword [ebp + eax - 0xa4c], ecx
jmp 0x1002e53f
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x28c]
or eax, 0xe8
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x28c]
and ecx, 0xe8
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x28c]
mov byte [ebp + ecx - 0x624], al
mov dword [ebp - 0x10c], 0xa860b4ff
push 4
lea ecx, [ebp - 0x760]
call fcn.10024d89
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x89c], 1
mov dword [ebp - 0xd8], 0x9e53
mov dword [ebp - 0x1d0], 0
jmp 0x1002e8ed
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 4
jge 0x1002e90f
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0x760]
call fcn.10024e10
mov dword [eax], 5
jmp 0x1002e8e0
lea eax, [ebp - 0xd8]
push eax
push 1
call fcn.1002a698
pop ecx
pop ecx
mov dword [ebp - 0x10c], 0
jmp 0x1002e938
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffe2
jne 0x1002e9e9
mov dword [ebp - 0x694], 0xfffffff6
mov byte [ebp - 0x6b], 0
movzx eax, byte [ebp - 0x6b]
test eax, eax
je 0x1002e96f
push 0
push 0x1fa4
push 0x5aaf
call fcn.1002aa39
add esp, 0xc
mov dword [ebp - 0xd8], 0xfffffffd
jmp 0x1002e988
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x33
jge 0x1002e9e4
mov dword [ebp - 0x3cc], 0x26f3
mov esi, dword [ebp - 0x3cc]
push 3
lea ecx, [ebp - 0x760]
call fcn.10024e10
mov dword [eax], esi
push 1
lea eax, [ebp - 0x3cc]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x45db
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x760]
push eax
call fcn.1002a6d9
add esp, 0x1c
jmp 0x1002e97b
jmp 0x1002e92b
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x760]
call fcn.10024e0b
mov dword [ebp - 0x18], 2
and dword [ebp - 0x158], 0
jmp 0x1002ea10
mov eax, dword [ebp - 0x18]
inc eax
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x75
jae 0x1002efe7
mov dword [ebp - 0x414], 0x7013
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x114], 0xec5e
mov dword [ebp - 0x9b0], 1
mov dword [ebp - 0x8a4], 0x7073e70d
mov dword [ebp - 0x99c], 1
mov dword [ebp - 0x714], 0
mov dword [ebp - 0x8ac], 0
push 1
lea ecx, [ebp - 0x988]
call fcn.10024d89
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x6a4], 0xb80c
mov dword [ebp - 0x180], 0
jmp 0x1002ea9b
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 1
jge 0x1002eaba
push dword [ebp - 0x180]
lea ecx, [ebp - 0x988]
call fcn.10024e10
or dword [eax], 0xffffffff
jmp 0x1002ea8e
cmp dword [ebp - 0x48], 0
je 0x1002eadb
mov eax, 0xb81eca6c
test eax, eax
je 0x1002eadb
cmp dword [ebp - 0x48], 0
je 0x1002eadb
mov dword [ebp - 0x3d4], 1
jmp 0x1002eae2
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x3d4], eax
jge 0x1002eaf9
mov dword [ebp - 0x3dc], 1
jmp 0x1002eb00
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x3dc], eax
jne 0x1002eb1a
mov dword [ebp - 0x3e4], 1
jmp 0x1002eb21
and dword [ebp - 0x3e4], 0
cmp dword [ebp - 0x3e4], 0xfff8
jne 0x1002eb39
mov dword [ebp - 0x3ec], 1
jmp 0x1002eb40
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x3ec], eax
jl 0x1002eb5a
mov dword [ebp - 0x3f4], 1
jmp 0x1002eb61
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x3f4], eax
jl 0x1002eb78
mov dword [ebp - 0x6fc], 1
jmp 0x1002eb7f
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x48], eax
jge 0x1002eb96
mov dword [ebp - 0x3fc], 1
jmp 0x1002eb9d
and dword [ebp - 0x3fc], 0
cmp dword [ebp - 0x3fc], 0xffffffff
jae 0x1002ebb2
mov dword [ebp - 0x69c], 1
jmp 0x1002ebb9
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x9b4], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x8b4], eax
cmp dword [ebp - 0x114], 0xfffffffe
jg 0x1002ebe3
mov dword [ebp - 0x404], 1
jmp 0x1002ebea
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x404], eax
jl 0x1002ec01
mov dword [ebp - 0x40c], 1
jmp 0x1002ec08
and dword [ebp - 0x40c], 0
imul eax, dword [ebp - 0x40c], 0x5ab
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jne 0x1002ec27
mov dword [ebp - 0x41c], 1
jmp 0x1002ec2e
and dword [ebp - 0x41c], 0
mov dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x414]
cmp eax, dword [ebp - 0x41c]
jl 0x1002ecb9
mov dword [ebp - 0x9ac], 0x70fc2448
mov dword [ebp - 0x8bc], 0x9020024
mov dword [ebp - 0x9bc], 0x55752783
mov dword [ebp - 0x17c], 0
jmp 0x1002ec7d
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 3
jge 0x1002ec99
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0xacc], 0xffffffff
jmp 0x1002ec70
push 0x232b
push 1
push 0x7e4a
lea eax, [ebp - 0x714]
push eax
call fcn.1002a85e
add esp, 0x10
jmp 0x1002ed73
push 1
lea ecx, [ebp - 0x978]
call fcn.10024d89
mov byte [ebp - 4], 0x20
push 3
lea ecx, [ebp - 0x968]
call fcn.10024d89
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x8c4], 8
lea eax, [ebp - 0x11c]
push eax
push 1
lea eax, [ebp - 0x978]
push eax
call fcn.1002a8d4
add esp, 0xc
mov dword [ebp - 0x11c], 0
jmp 0x1002ed16
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 3
jge 0x1002ed35
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x968]
call fcn.10024e10
or dword [eax], 0xffffffff
jmp 0x1002ed09
push 0x490
push 0x599
push 0x31f6
lea eax, [ebp - 0x6a4]
push eax
push 0
call fcn.1002fd6c
add esp, 0x14
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x968]
call fcn.10024e0b
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x978]
call fcn.10024e0b
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x988]
call fcn.10024e0b
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x28c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x18], eax
jne 0x1002ef7b
mov dword [ebp - 0x42c], 0xbdb9
mov dword [ebp - 0x38], 0
jmp 0x1002edb7
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1002edcd
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x18c], 0xfffffffa
jmp 0x1002edb0
mov dword [ebp - 0x38], 0
jmp 0x1002eddd
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1002edf3
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x424], 0x9532bb11
jmp 0x1002edd6
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x18c], 0xfffffff2
jmp 0x1002ee21
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x18c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x18c], 0x1d
je 0x1002ee7b
mov dword [ebp - 0xe0], 0xe52d8cb4
mov dword [ebp - 0xe0], 0
jmp 0x1002ee54
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
jl 0x1002ee79
mov eax, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0xe0]
mov eax, dword [ebp + eax*4 - 0x424]
mov dword [ebp + ecx*4 - 0x424], eax
jmp 0x1002ee47
jmp 0x1002ee06
mov eax, dword [ebp - 0x42c]
inc eax
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x28c]
inc eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], 0xe2799ac7
mov dword [ebp - 0x9c4], 0x8c08
mov dword [ebp - 0x194], 0
jmp 0x1002eec7
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 3
jge 0x1002eee3
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0xa64], 0x72fd4914
jmp 0x1002eeba
mov dword [ebp - 0x154], 0
jmp 0x1002eefc
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0x1b
jge 0x1002ef61
mov dword [ebp - 0x124], 0x7cefa9d1
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x1002ef29
push 0
push 0x52b4
call fcn.1002ab6a
pop ecx
pop ecx
mov dword [ebp - 0x124], 2
jmp 0x1002ef42
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jl 0x1002ef5f
mov eax, dword [ebp - 0x124]
cmp dword [ebp + eax*4 - 0xa64], 0
je 0x1002ef5d
jmp 0x1002ef5f
jmp 0x1002ef35
jmp 0x1002eeef
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x28c]
mov ecx, dword [ebp - 0x18]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x18], eax
jmp 0x1002ea08
mov eax, dword [ebp - 0x18]
movzx eax, byte [ebp + eax - 0x28b]
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x158]
movzx ecx, byte [ebp + ecx - 0x28e]
movsx ecx, byte [ebp + ecx - 0x624]
or eax, ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0x28b]
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x158]
movzx edx, byte [ebp + edx - 0x28e]
movsx edx, byte [ebp + edx - 0x624]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ebp + ecx - 0x28c]
mov byte [ebp + ecx - 0x624], al
and dword [ebp - 0x158], 0
jmp 0x1002ea08
mov dword [ebp - 0xe8], 0x9bdba76a
push 2
lea ecx, [ebp - 0x5fc]
call fcn.10024d89
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x44c], 0x5c2f
mov dword [ebp - 0x160], 0
jmp 0x1002f025
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 2
jge 0x1002f047
push dword [ebp - 0x160]
lea ecx, [ebp - 0x5fc]
call fcn.10024e10
mov dword [eax], 0xfffffffc
jmp 0x1002f018
cmp dword [ebp - 0xe8], 0
je 0x1002f3d4
mov dword [ebp - 0x2c4], 0xda58
push 4
lea ecx, [ebp - 0x5e4]
call fcn.10024d89
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x6ac], 0x2966b911
mov dword [ebp - 0x168], 0
jmp 0x1002f092
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 4
jge 0x1002f0b1
push dword [ebp - 0x168]
lea ecx, [ebp - 0x5e4]
call fcn.10024e10
or dword [eax], 0xffffffff
jmp 0x1002f085
cmp dword [ebp - 0xe8], 0
je 0x1002f154
mov dword [ebp - 0x2ac], 3
mov eax, dword [ebp - 0x2ac]
cmp dword [ebp - 0x2ac], eax
jne 0x1002f0eb
cmp dword [ebp - 0x2ac], 0
je 0x1002f0eb
mov dword [ebp - 0x434], 1
jmp 0x1002f0f2
and dword [ebp - 0x434], 0
cmp dword [ebp - 0x2c4], 0x835357f4
jae 0x1002f10a
mov dword [ebp - 0x43c], 1
jmp 0x1002f111
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x434]
cmp eax, dword [ebp - 0x43c]
jg 0x1002f12b
mov dword [ebp - 0x444], 1
jmp 0x1002f132
and dword [ebp - 0x444], 0
mov esi, dword [ebp - 0x444]
sub esi, 0x2aa0a5de
neg esi
push 1
lea ecx, [ebp - 0x5fc]
call fcn.10024e10
mov dword [eax], esi
jmp 0x1002f3c3
mov dword [ebp - 0xc4], 0xffffffff
mov dword [ebp - 0x494], 0x5f1871d0
mov esi, dword [ebp - 0x2c4]
inc esi
push 0
lea ecx, [ebp - 0x5e4]
call fcn.10024e10
cmp esi, dword [eax]
jl 0x1002f18c
mov dword [ebp - 0x454], 1
jmp 0x1002f193
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x44c], eax
mov esi, dword [ebp - 0x44c]
push 2
lea ecx, [ebp - 0x5e4]
call fcn.10024e10
mov ecx, dword [ebp - 0x454]
sub ecx, dword [eax]
add esi, ecx
cmp esi, dword [ebp - 0xc4]
je 0x1002f1d0
mov dword [ebp - 0x45c], 1
jmp 0x1002f1d7
and dword [ebp - 0x45c], 0
push 1
lea ecx, [ebp - 0x5fc]
call fcn.10024e10
mov ecx, dword [ebp - 0x45c]
cmp ecx, dword [eax]
jge 0x1002f1fa
mov dword [ebp - 0x464], 1
jmp 0x1002f201
and dword [ebp - 0x464], 0
cmp dword [ebp - 0x464], 0xfffffff6
jae 0x1002f216
mov dword [ebp - 0x46c], 1
jmp 0x1002f21d
and dword [ebp - 0x46c], 0
push 1
lea ecx, [ebp - 0x5fc]
call fcn.10024e10
mov eax, dword [eax]
cmp eax, dword [ebp - 0x46c]
jg 0x1002f240
mov dword [ebp - 0x474], 1
jmp 0x1002f247
and dword [ebp - 0x474], 0
cmp dword [ebp - 0x474], 0x67b
jl 0x1002f25f
mov dword [ebp - 0x71c], 1
jmp 0x1002f266
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x8cc], eax
push 2
lea ecx, [ebp - 0x5e4]
call fcn.10024e10
cmp dword [eax], 0
je 0x1002f299
mov eax, 0x5bb5
test eax, eax
je 0x1002f299
mov dword [ebp - 0x47c], 1
jmp 0x1002f2a0
and dword [ebp - 0x47c], 0
cmp dword [ebp - 0x47c], 0xca7
jg 0x1002f2b9
xor eax, eax
jne 0x1002f2b9
and dword [ebp - 0x484], 0
jmp 0x1002f2c3
mov dword [ebp - 0x484], 1
push 0
lea ecx, [ebp - 0x5e4]
call fcn.10024e10
mov ecx, dword [ebp - 0x484]
cmp ecx, dword [eax]
je 0x1002f2e6
mov dword [ebp - 0x48c], 1
jmp 0x1002f2ed
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x494], eax
mov esi, dword [ebp - 0x494]
push 0
lea ecx, [ebp - 0x5e4]
call fcn.10024e10
cmp esi, dword [eax]
je 0x1002f31c
mov dword [ebp - 0x294], 1
jmp 0x1002f323
and dword [ebp - 0x294], 0
push 1
lea ecx, [ebp - 0x5fc]
call fcn.10024e10
mov ecx, dword [ebp - 0x294]
mov dword [eax], ecx
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x6ac], eax
mov dword [ebp - 0xe8], 0
jmp 0x1002f35d
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0x15
jge 0x1002f3c3
mov byte [ebp - 0x6d], 0
movzx eax, byte [ebp - 0x6d]
test eax, eax
je 0x1002f386
push 0xb94
push 0x379c
push 1
call fcn.1002a94a
add esp, 0xc
mov dword [ebp - 0xc4], 3
jmp 0x1002f39f
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
jl 0x1002f3c1
mov dword [ebp - 0x49c], 0x9191d4d0
mov eax, dword [ebp - 0x49c]
inc eax
mov dword [ebp - 0x49c], eax
jmp 0x1002f392
jmp 0x1002f350
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x5e4]
call fcn.10024e0b
jmp 0x1002f3ee
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x1002f3ee
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x5fc]
call fcn.10024e0b
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x624], 0
mov dword [ebp - 0x6b4], 0xe9714a02
mov dword [ebp - 0x704], 0xfffffffb
mov dword [ebp - 0x9b8], 0x57bf5cd5
mov dword [ebp - 0x8d4], 5
mov dword [ebp - 0xa1c], 0xfffffff6
mov dword [ebp - 0x8dc], 1
push 2
lea ecx, [ebp - 0x998]
call fcn.10024d89
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x4a4], 0x4bcd76ce
mov dword [ebp - 0x12c], 0
jmp 0x1002f47b
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 3
jge 0x1002f497
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0xac0], 0
jmp 0x1002f46e
push 1
push 0x36fb
lea eax, [ebp - 0x998]
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.1002a9b0
add esp, 0x10
push 1
lea eax, [ebp - 0x704]
push eax
lea eax, [ebp - 0x6b4]
push eax
call fcn.1002aa39
add esp, 0xc
mov eax, dword [ebp - 0x4a4]
dec eax
mov dword [ebp - 0x4a4], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x998]
call fcn.10024e0b
lea eax, [ebp - 0x624]
push eax
lea ecx, [ebp - 0xa84]
call fcn.10024c62
mov byte [ebp - 4], 0x25
mov dword [ebp - 0x134], 0xffffffff
mov dword [ebp - 0x648], 1
mov dword [ebp - 0x650], 0xe7aebb1b
mov dword [ebp - 0x170], 0
jmp 0x1002f535
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 1
jge 0x1002f551
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0x4fc], 0x13638ecf
jmp 0x1002f528
mov dword [ebp - 0x134], 0
jmp 0x1002f56a
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x11
jl 0x1002f88f
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb8], 0
jmp 0x1002f59a
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jg 0x1002f87f
mov dword [ebp - 0xa8], 0x7222631
mov dword [ebp - 0x728], 0x3d069f49
mov dword [ebp - 0xa8], 0
jmp 0x1002f5d4
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x1002f87a
mov dword [ebp - 0xb0], 0xcddd1d8f
mov dword [ebp - 0x4c4], 0
mov dword [ebp - 0x40], 0
jmp 0x1002f605
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x1002f61b
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x4d4], 0
jmp 0x1002f5fe
mov dword [ebp - 0x40], 0
jmp 0x1002f62b
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1002f641
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x918], 0xfffffffb
jmp 0x1002f624
mov dword [ebp - 0xb0], 0
jmp 0x1002f65a
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jg 0x1002f875
mov dword [ebp - 0x4b4], 0xc4df8e3b
mov dword [ebp - 0x640], 0xfffffff6
mov eax, dword [ebp - 0xa8]
add eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x134], eax
jl 0x1002f69b
mov dword [ebp - 0x4ac], 1
jmp 0x1002f6a2
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x728], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x9c0], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebp - 0x640]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x4fc]
cmp dword [ebp - 0x4b4], eax
jle 0x1002f6ed
mov dword [ebp - 0x4bc], 1
jmp 0x1002f6f4
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0xa8]
sub eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x4c4], eax
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x4c4], eax
jne 0x1002f720
mov dword [ebp - 0x4cc], 1
jmp 0x1002f727
and dword [ebp - 0x4cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4d4]
cmp dword [ebp - 0x4cc], eax
jne 0x1002f748
mov dword [ebp - 0x298], 1
jmp 0x1002f74f
and dword [ebp - 0x298], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x298]
mov dword [ebp + eax - 0x4d4], ecx
cmp dword [ebp - 0x298], 0
jne 0x1002f777
mov dword [ebp - 0x4dc], 1
jmp 0x1002f77e
and dword [ebp - 0x4dc], 0
cmp dword [ebp - 0x4dc], 0x55b6
jne 0x1002f796
mov dword [ebp - 0x2a0], 1
jmp 0x1002f79d
and dword [ebp - 0x2a0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2a0]
mov dword [ebp + eax - 0x918], ecx
cmp dword [ebp - 0x2a0], 0x658
jle 0x1002f7c8
mov dword [ebp - 0x4e4], 1
jmp 0x1002f7cf
and dword [ebp - 0x4e4], 0
cmp dword [ebp - 0x4e4], 0xa7ab5bf7
jae 0x1002f7e7
mov dword [ebp - 0x4ec], 1
jmp 0x1002f7ee
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4ec]
sub eax, dword [ebp - 0xb8]
cmp eax, 0xa7b7e80d
jae 0x1002f80d
mov dword [ebp - 0x4f4], 1
jmp 0x1002f814
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x4f4], eax
jle 0x1002f82e
mov dword [ebp - 0x504], 1
jmp 0x1002f835
and dword [ebp - 0x504], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4fc]
imul eax, dword [ebp - 0x504]
cmp eax, dword [ebp - 0x648]
jg 0x1002f85d
mov dword [ebp - 0x50c], 1
jmp 0x1002f864
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x650], eax
jmp 0x1002f64d
jmp 0x1002f5c7
jmp 0x1002f58d
cmp dword [ebp - 0xb8], 0
je 0x1002f88a
jmp 0x1002f88f
jmp 0x1002f55d
push 0x2dc8
push 0x4f16
push 1
call fcn.1002aa7a
add esp, 0xc
and dword [ebp - 0x178], 0
jmp 0x1002f8b9
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0xd
jae 0x1002f8d2
mov eax, dword [ebp - 0x178]
mov byte [ebp + eax - 0x624], 0
jmp 0x1002f8ac
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x5c], 0
jmp 0x1002f8e9
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 5
jl 0x1002facb
mov dword [ebp - 0x54c], 0xb5fb49a5
mov dword [ebp - 0x62c], 0xc821f997
mov dword [ebp - 0x1c4], 0
jmp 0x1002f920
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 1
jge 0x1002f93c
mov eax, dword [ebp - 0x1c4]
mov dword [ebp + eax*4 - 0x1d4], 0x5ed9a924
jmp 0x1002f913
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1d4], 0
jne 0x1002f984
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1d4], 0xfffb
jne 0x1002f96b
mov dword [ebp - 0x514], 1
jmp 0x1002f972
and dword [ebp - 0x514], 0
cmp dword [ebp - 0x514], 1
je 0x1002f984
and dword [ebp - 0x51c], 0
jmp 0x1002f98e
mov dword [ebp - 0x51c], 1
imul eax, dword [ebp - 0x51c], 3
cmp eax, dword [ebp - 0x5c]
jl 0x1002f9f8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1d4], 0
je 0x1002f9f8
mov dword [ebp - 0x1cc], 0xffffffff
mov dword [ebp - 0x658], 1
mov dword [ebp - 0x1cc], 0xfffffff4
jmp 0x1002f9d7
mov eax, dword [ebp - 0x1cc]
dec eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0xfffffff3
jl 0x1002f9f6
mov dword [ebp - 0x8e4], 0x66ac3a60
mov dword [ebp - 0x658], 1
jmp 0x1002f9ca
jmp 0x1002fa10
mov dword [ebp - 0x660], 0xffffffff
cmp dword [ebp - 0x660], 0
je 0x1002fa10
jmp 0x1002facb
cmp dword [ebp - 0x5c], 0xe2ff
jl 0x1002fa25
mov dword [ebp - 0x524], 1
jmp 0x1002fa2c
and dword [ebp - 0x524], 0
push 4
pop eax
imul eax, eax, 0
xor ecx, ecx
sub ecx, dword [ebp + eax - 0x1d4]
cmp dword [ebp - 0x524], ecx
jge 0x1002fa4f
mov dword [ebp - 0x52c], 1
jmp 0x1002fa56
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x52c]
je 0x1002fa6d
mov dword [ebp - 0x534], 1
jmp 0x1002fa74
and dword [ebp - 0x534], 0
cmp dword [ebp - 0x534], 1
jae 0x1002fa89
mov dword [ebp - 0x53c], 1
jmp 0x1002fa90
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x53c], eax
jne 0x1002faa7
mov dword [ebp - 0x544], 1
jmp 0x1002faae
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0x54c], eax
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x62c], eax
jmp 0x1002f8e2
mov byte [ebp - 0x6f], 0
movzx eax, byte [ebp - 0x6f]
test eax, eax
je 0x1002faeb
push 0x3909
push 0xb9
push 1
call fcn.1002aaf7
add esp, 0xc
push 0
push 0
lea eax, [ebp - 0xa84]
push eax
push dword [ebp - 0x554]
call fcn.10030556
add esp, 0x10
mov dword [0x10cb10e0], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa84]
call fcn.10024cea
mov dword [ebp - 0x140], 6
mov dword [ebp - 0x140], 2
jmp 0x1002fb3b
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0x14
jge 0x1002fc92
mov dword [ebp - 0x1b0], 0xfda0e60f
push 1
lea ecx, [ebp - 0x9a8]
call fcn.10024d89
mov byte [ebp - 4], 0x26
mov dword [ebp - 0x564], 0xffffffff
mov dword [ebp - 0x1dc], 0
jmp 0x1002fb86
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 1
jge 0x1002fba5
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0x9a8]
call fcn.10024e10
and dword [eax], 0
jmp 0x1002fb79
mov dword [ebp - 0x1b0], 0xffffffef
jmp 0x1002fbbe
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0xffffffe7
jg 0x1002fc7e
mov dword [ebp - 0x13c], 0x10e164ca
mov dword [ebp - 0x9f0], 1
mov dword [ebp - 0x13c], 0
jmp 0x1002fbf8
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jg 0x1002fc79
mov dword [ebp - 0x55c], 1
mov byte [ebp - 0x7f], 0
push 1
lea eax, [ebp - 0x7f]
push eax
call fcn.1002ab6a
pop ecx
pop ecx
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x55c], eax
cmp dword [ebp - 0x55c], 0
je 0x1002fc54
mov dword [ebp - 0x8ec], 0xffffffff
mov dword [ebp - 0x90c], 1
mov eax, dword [ebp - 0x564]
dec eax
mov dword [ebp - 0x564], eax
jmp 0x1002fc74
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x1002fc74
push 0x6b37
push 1
push 0x47b2
call fcn.1002abb2
add esp, 0xc
jmp 0x1002fbeb
jmp 0x1002fbb1
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x9a8]
call fcn.10024e0b
jmp 0x1002fb2e
lea eax, [ebp - 0x140]
push eax
push 0x28ab
push 0x691
push 0x36df
push 0x3155
push 0x29c9
push 1
push 0x17b1
push 0x55c7
call fcn.1002ac31
add esp, 0x24
cmp dword [0x10cb10e0], 0
je 0x1002fce4
mov ecx, dword [ebp + 8]
call fcn.10031752
push eax
call dword [0x10cb10e0]
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
je 0x1002fd3b
movzx eax, byte [0x10cb10ea]
test eax, eax
je 0x1002fd09
mov ecx, 0x10cb1208
call fcn.10031853
movzx eax, al
test eax, eax
jne 0x1002fd3b
lea eax, [ebp - 0x56c]
push eax
mov ecx, 0x10cb1208
call fcn.100317e2
mov ecx, dword [ebp - 0xbc]
mov dword [eax], ecx
push 0xb0d
push 0x69ea
push 0x10cb10ea
push 1
call fcn.1002aecb
add esp, 0x10
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x630], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x838]
call fcn.10031716
mov eax, dword [ebp - 0x630]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret