Function at 0x10034fcf
Capabilities:
Contain obfuscated stackstrings
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008b08d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xcf4
push esi
and dword [ebp - 0x20], 0
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1003b015
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xe4], 0x6a53
push 2
lea ecx, [ebp - 0xa34]
call fcn.1001a32c
and dword [ebp - 4], 0
mov dword [ebp - 0x1f4], 0
jmp 0x10035038
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 2
jge 0x1003505a
push dword [ebp - 0x1f4]
lea ecx, [ebp - 0xa34]
call fcn.1001a399
mov dword [eax], 1
jmp 0x1003502b
lea eax, [ebp - 0xe4]
push eax
push 0
call fcn.100335d1
pop ecx
pop ecx
mov dword [ebp - 0xe4], 0
jmp 0x10035083
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 2
jge 0x100350ab
push 0x569e
push 0
lea eax, [ebp - 0xa34]
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.10033d02
add esp, 0x10
jmp 0x10035076
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa34]
call fcn.1001a394
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x704], eax
mov dword [ebp - 0xa4], 0x5031
mov dword [ebp - 0xec], 2
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x88], 0xfdadf860
mov dword [ebp - 0x848], 0x506ed55c
mov dword [ebp - 0x21c], 0
jmp 0x1003510e
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 1
jge 0x1003512a
mov eax, dword [ebp - 0x21c]
mov dword [ebp + eax*4 - 0x7b4], 0xc178
jmp 0x10035101
push 0
push 0x153e
push 0x2e1c
call fcn.100339ef
add esp, 0xc
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x440]
cmp dword [ebp - 0xa4], eax
jg 0x10035164
mov dword [ebp - 0x6e0], 1
jmp 0x1003516b
and dword [ebp - 0x6e0], 0
cmp dword [ebp - 0x6e0], 0x9c8d
jge 0x10035183
mov dword [ebp - 0x6e8], 1
jmp 0x1003518a
and dword [ebp - 0x6e8], 0
cmp dword [ebp - 0x6e8], 0xfffffff8
jne 0x1003519f
mov dword [ebp - 0x6f0], 1
jmp 0x100351a6
and dword [ebp - 0x6f0], 0
mov eax, dword [ebp - 0xec]
cmp dword [ebp - 0x6f0], eax
je 0x100351c0
mov dword [ebp - 0x71c], 1
jmp 0x100351c7
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 0x71c]
neg eax
je 0x100351e6
mov eax, 0x9b78
test eax, eax
je 0x100351e6
mov dword [ebp - 0x724], 1
jmp 0x100351ed
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x724], eax
je 0x10035207
mov dword [ebp - 0x72c], 1
jmp 0x1003520e
and dword [ebp - 0x72c], 0
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x72c]
je 0x10035228
mov dword [ebp - 0x75c], 1
jmp 0x1003522f
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x75c]
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jg 0x10035250
mov dword [ebp - 0x720], 1
jmp 0x10035257
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0x720]
jne 0x1003526c
cmp dword [ebp - 0x88], 0
cmp dword [ebp - 0xec], 0
je 0x1003528a
cmp dword [ebp - 0x88], 0
je 0x1003528a
mov dword [ebp - 0x574], 1
jmp 0x10035291
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x574]
add eax, 0x24f63abe
je 0x100352aa
mov dword [ebp - 0x6d8], 1
jmp 0x100352b1
and dword [ebp - 0x6d8], 0
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x6d8]
je 0x100352cb
mov dword [ebp - 0x38c], 1
jmp 0x100352d2
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x38c]
inc eax
inc eax
neg eax
cmp eax, dword [ebp - 0xec]
jge 0x100352f0
mov dword [ebp - 0x850], 1
jmp 0x100352f7
and dword [ebp - 0x850], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xbcc], eax
cmp dword [ebp - 0xec], 0
jae 0x10035318
mov dword [ebp - 0x66c], 1
jmp 0x1003531f
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0x66c]
sub eax, dword [ebp - 0xa4]
je 0x10035345
cmp dword [ebp - 0x848], 0
je 0x10035345
cmp dword [ebp - 0xec], 0
jne 0x1003534c
push 9
pop eax
test eax, eax
je 0x10035374
mov byte [ebp - 0xd7], 0
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x10035372
push 0x5339
push 1
push 0x766c
call fcn.10033427
add esp, 0xc
jmp 0x100353d6
mov dword [ebp - 0x88], 0
jmp 0x1003538d
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jg 0x100353d6
mov byte [ebp - 0xde], 0
push 0x2508
push 1
lea eax, [ebp - 0xde]
push eax
push 0x7081
push 0x7aff
push 0x110a
call fcn.10033479
add esp, 0x18
mov eax, dword [ebp - 0x88]
cmp dword [ebp + eax*4 - 0x7b4], 0
je 0x100353d4
jmp 0x10035380
jmp 0x10035380
mov eax, dword [ebp - 0x704]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x100353eb
jmp 0x1003b03f
push 2
lea ecx, [ebp - 0x37c]
call fcn.1001a32c
mov dword [ebp - 4], 1
mov dword [ebp - 0x58c], 1
mov dword [ebp - 0x10c], 1
mov dword [ebp - 0x3b4], 2
mov dword [ebp - 0x3bc], 0xedf66798
mov dword [ebp - 0x874], 0xc8ff
mov dword [ebp - 0x3c4], 0xfffffffd
mov dword [ebp - 0x594], 0x49c90605
mov dword [ebp - 0x24], 0
jmp 0x10035455
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10035471
push dword [ebp - 0x24]
lea ecx, [ebp - 0x37c]
call fcn.1001a399
mov dword [eax], 0xede0b407
jmp 0x1003544e
mov dword [ebp - 0x24], 0
jmp 0x10035481
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10035497
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x368], 0x7f40
jmp 0x1003547a
mov dword [ebp - 0x24], 0
jmp 0x100354a7
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x100354bd
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x8c4], 0xfffffff7
jmp 0x100354a0
mov dword [ebp - 0x24], 0
jmp 0x100354cd
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x100354e3
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x86c], 3
jmp 0x100354c6
mov eax, dword [ebp - 0x58c]
mov dword [ebp - 0xba0], eax
push 1
lea ecx, [ebp - 0x37c]
call fcn.1001a399
cmp dword [ebp - 0x10c], 9
jne 0x10035517
cmp dword [ebp - 0x10c], 0
jne 0x10035517
and dword [ebp - 0x858], 0
jmp 0x10035521
mov dword [ebp - 0x858], 1
push 1
lea ecx, [ebp - 0x37c]
call fcn.1001a399
mov eax, 0xffff
test eax, eax
je 0x10035555
push 1
lea ecx, [ebp - 0x37c]
call fcn.1001a399
cmp dword [eax], 0
je 0x10035555
mov dword [ebp - 0x394], 1
jmp 0x1003555c
and dword [ebp - 0x394], 0
push 0
lea ecx, [ebp - 0x37c]
call fcn.1001a399
mov eax, dword [eax]
cmp eax, dword [ebp - 0x394]
jl 0x1003558c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x368], 0
jne 0x1003558c
and dword [ebp - 0x57c], 0
jmp 0x10035596
mov dword [ebp - 0x57c], 1
cmp dword [ebp - 0x57c], 0x2be197e7
jge 0x100355b0
or eax, 0xffffffff
jne 0x100355b0
and dword [ebp - 0x39c], 0
jmp 0x100355ba
mov dword [ebp - 0x39c], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x39c]
mov dword [ebp + eax - 0x8c4], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8c4]
imul eax, dword [ebp - 0x10c]
cmp eax, 0xd25bb086
jne 0x100355f4
mov dword [ebp - 0x6fc], 1
jmp 0x100355fb
and dword [ebp - 0x6fc], 0
cmp dword [ebp - 0x6fc], 0xffffffff
jb 0x10035610
mov dword [ebp - 0x3a4], 1
jmp 0x10035617
and dword [ebp - 0x3a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x368]
cmp dword [ebp - 0x3a4], eax
jl 0x10035638
mov dword [ebp - 0x584], 1
jmp 0x1003563f
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x584], eax
jg 0x10035659
mov dword [ebp - 0x3ac], 1
jmp 0x10035660
and dword [ebp - 0x3ac], 0
push 1
lea ecx, [ebp - 0x37c]
call fcn.1001a399
mov eax, dword [eax]
add eax, dword [ebp - 0x3ac]
cmp eax, 1
jb 0x10035686
mov dword [ebp - 0x674], 1
jmp 0x1003568d
and dword [ebp - 0x674], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x674]
mov dword [ebp + eax - 0x86c], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x368], 9
jge 0x100356bc
mov dword [ebp - 0x3cc], 1
jmp 0x100356c3
and dword [ebp - 0x3cc], 0
mov eax, 0xcb06a9be
sub eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x10c]
mov dword [ebp - 0x3b4], eax
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0x58c]
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0x3bc], 0xffffffff
cmp dword [ebp - 0x3bc], 0
jne 0x1003570e
cmp dword [ebp - 0x874], 0
je 0x10035717
mov eax, 0x8a2db637
test eax, eax
jne 0x10035730
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8c4], 0
jne 0x10035730
and dword [ebp - 0x6ec], 0
jmp 0x1003573a
mov dword [ebp - 0x6ec], 1
mov eax, dword [ebp - 0x6ec]
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x3c4]
mov dword [ebp - 0x594], eax
cmp dword [ebp - 0x594], 0
jne 0x1003576b
push 4
pop eax
test eax, eax
jne 0x1003576b
and dword [ebp - 0x87c], 0
jmp 0x10035775
mov dword [ebp - 0x87c], 1
push 0
lea ecx, [ebp - 0x37c]
call fcn.1001a399
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x368]
cmp dword [ebp + eax - 0x368], ecx
jg 0x100357aa
mov dword [ebp - 0x67c], 1
jmp 0x100357b1
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x3cc]
cmp eax, dword [ebp - 0x67c]
jl 0x100357dd
push 1
lea ecx, [ebp - 0x37c]
call fcn.1001a399
cmp dword [eax], 0
je 0x100357dd
mov dword [ebp - 0x3d4], 1
jmp 0x100357e4
and dword [ebp - 0x3d4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8c4]
imul eax, dword [ebp - 0x3d4]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x368]
jg 0x10035812
mov dword [ebp - 0x59c], 1
jmp 0x10035819
and dword [ebp - 0x59c], 0
cmp dword [ebp - 0x59c], 0xff74
jne 0x10035831
mov dword [ebp - 0x3dc], 1
jmp 0x10035838
and dword [ebp - 0x3dc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x3dc]
mov dword [ebp + eax - 0x8c4], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x37c]
call fcn.1001a394
mov eax, dword [ebp - 0x704]
mov ecx, dword [ebp - 0x28]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xf4], ecx
push 3
lea ecx, [ebp - 0xa4c]
call fcn.1001a32c
mov dword [ebp - 4], 2
mov dword [ebp - 0x178], 0xfffffffe
mov dword [ebp - 0x894], 0
mov dword [ebp - 0x884], 0x914cc5c6
push 1
lea eax, [ebp - 0xae8]
push eax
lea eax, [ebp - 0xa4c]
push eax
call fcn.10033552
add esp, 0xc
mov dword [ebp - 0x178], 0
jmp 0x100358ce
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 2
jg 0x1003593a
mov dword [ebp - 0x88c], 6
lea eax, [ebp - 0x884]
push eax
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x88c]
push eax
lea eax, [ebp - 0x894]
push eax
lea eax, [ebp - 0xa4c]
push eax
push 0
push 0x230b
push 0x2277
call fcn.10033f40
add esp, 0x20
mov byte [ebp - 0xe0], 0
movzx eax, byte [ebp - 0xe0]
test eax, eax
je 0x10035938
push 0x683f
push 1
call fcn.100335d1
pop ecx
pop ecx
jmp 0x100358c1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa4c]
call fcn.1001a394
mov eax, dword [ebp - 0xf4]
cmp dword [eax], 0x4550
je 0x1003595c
jmp 0x1003b03f
push 4
lea ecx, [ebp - 0x780]
call fcn.1001a32c
mov dword [ebp - 4], 3
mov dword [ebp - 0xa8], 0xfffffffb
mov dword [ebp - 0x8ac], 0xffffffff
mov dword [ebp - 0x228], 0
jmp 0x1003599d
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 4
jge 0x100359bf
push dword [ebp - 0x228]
lea ecx, [ebp - 0x780]
call fcn.1001a399
mov dword [eax], 0x6f5020f8
jmp 0x10035990
push 2
lea ecx, [ebp - 0x780]
call fcn.1001a399
cmp dword [eax], 0
jle 0x10035b29
mov dword [ebp - 0x128], 0
mov dword [ebp - 0xb2c], 4
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x780]
push eax
push 0x3628
push 0x7080
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.10034a4b
add esp, 0x18
mov dword [ebp - 0xa8], 0
jmp 0x10035a2b
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jg 0x10035b27
mov dword [ebp - 0xbb0], 0
push dword [ebp - 0xa8]
lea ecx, [ebp - 0x780]
call fcn.1001a399
cmp dword [eax], 0
je 0x10035b0b
mov dword [ebp - 0x8a4], 7
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x10035a80
push 0
call fcn.10033de4
pop ecx
mov dword [ebp - 0x128], 0
jmp 0x10035a99
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 3
jg 0x10035b09
mov dword [ebp - 0x158], 0xe9e84363
mov dword [ebp - 0x158], 0
jmp 0x10035ac5
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 3
jg 0x10035b07
mov dword [ebp - 0x89c], 0xdf628589
lea eax, [ebp - 0x89c]
push eax
lea eax, [ebp - 0x780]
push eax
push 0
lea eax, [ebp - 0x8a4]
push eax
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x158]
push eax
call fcn.100340cf
add esp, 0x18
jmp 0x10035ab8
jmp 0x10035a8c
jmp 0x10035b22
mov dword [ebp - 0x3e4], 1
mov eax, dword [ebp - 0x3e4]
inc eax
mov dword [ebp - 0x3e4], eax
jmp 0x10035a1e
jmp 0x10035b39
push 1
lea eax, [ebp - 0xa8]
push eax
call fcn.10033610
pop ecx
pop ecx
mov dword [ebp - 0x8ac], 0x96d402da
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x780]
call fcn.1001a394
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xf4]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x948], 0x34bf8f0a
mov dword [ebp - 0x950], 0x4a754320
mov dword [ebp - 0x8b4], 7
mov dword [ebp - 0xa54], 0xe1c5a3d7
lea eax, [ebp - 0x8b4]
push eax
push 1
push 0x65fc
lea eax, [ebp - 0x948]
push eax
lea eax, [ebp - 0x950]
push eax
call fcn.10033656
add esp, 0x14
mov byte [ebp - 0xdf], 0
movzx eax, byte [ebp - 0xdf]
test eax, eax
je 0x10035bcb
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov eax, dword [ebp - 0x60]
cmp dword [eax + 4], 0
jne 0x10035bd9
jmp 0x1003b03f
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0xa5c], 7
mov dword [ebp - 0xa64], 7
mov dword [ebp - 0xa6c], 0xdf66
mov dword [ebp - 0x1b4], 0
jmp 0x10035c21
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 3
jge 0x10035c3d
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0xb6c], 0xfffffffd
jmp 0x10035c14
cmp dword [ebp - 0x4c], 0
je 0x10035c58
mov eax, 0x6e6f
test eax, eax
je 0x10035c58
mov dword [ebp - 0x96c], 1
jmp 0x10035c5f
and dword [ebp - 0x96c], 0
cmp dword [ebp - 0x4c], 0
jne 0x10035cf1
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], eax
jge 0x10035c7d
mov dword [ebp - 0x5a4], 1
jmp 0x10035c84
and dword [ebp - 0x5a4], 0
cmp dword [ebp - 0x5a4], 0xfffffff9
jle 0x10035c9f
cmp dword [ebp - 0x4c], 0
je 0x10035c9f
mov dword [ebp - 0x3ec], 1
jmp 0x10035ca6
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x3ec]
cmp eax, dword [ebp - 0x4c]
jge 0x10035cc1
mov dword [ebp - 0x954], 1
jmp 0x10035cc8
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xa74], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xa7c], eax
or eax, 0xffffffff
je 0x10035ce8
mov eax, 0x7f4039ee
test eax, eax
jne 0x10035cf1
and dword [ebp - 0x684], 0
jmp 0x10035cfb
mov dword [ebp - 0x684], 1
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x684]
cmp eax, 0xe7c14ab6
jne 0x10035d18
mov dword [ebp - 0x3f4], 1
jmp 0x10035d1f
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x3f4]
je 0x10035d3c
cmp dword [ebp - 0x4c], 0
je 0x10035d3c
mov dword [ebp - 0x7bc], 1
jmp 0x10035d43
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xa84], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb6c], 7
jne 0x10035d68
mov dword [ebp - 0x5ac], 1
jmp 0x10035d6f
and dword [ebp - 0x5ac], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5ac]
mov dword [ebp + eax - 0xb6c], ecx
mov eax, 0x8661
cmp eax, 1
jne 0x10035d98
mov dword [ebp - 0x3fc], 1
jmp 0x10035d9f
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x130], 0xffffffee
jmp 0x10035dc4
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xfffffffb
jle 0x10035e87
mov dword [ebp - 0xa8c], 0xfffffffa
mov dword [ebp - 0xa94], 6
mov dword [ebp - 0xa9c], 0xffffffff
mov dword [ebp - 0xaa4], 0x494dfd99
mov dword [ebp - 0xaac], 0xc914a3a6
mov dword [ebp - 0xab4], 6
push 2
lea ecx, [ebp - 0xb7c]
call fcn.1001a32c
mov dword [ebp - 4], 4
mov dword [ebp - 0x840], 0x2ea6ae20
mov dword [ebp - 0x1f0], 0
jmp 0x10035e44
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 2
jge 0x10035e63
push dword [ebp - 0x1f0]
lea ecx, [ebp - 0xb7c]
call fcn.1001a399
or dword [eax], 0xffffffff
jmp 0x10035e37
lea eax, [ebp - 0x840]
push eax
push 0
call fcn.100343af
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb7c]
call fcn.1001a394
jmp 0x10035db7
and dword [ebp - 0x30], 0
mov dword [ebp - 0x5c], 8
mov dword [ebp - 0x170], 0x2934
mov dword [ebp - 0xac], 0xaaf7cc73
mov dword [ebp - 0x1c8], 0xfffffffc
mov dword [ebp - 0x7dc], 5
mov dword [ebp - 0x5c], 0
jmp 0x10035eca
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 5
je 0x100366ac
push 4
lea ecx, [ebp - 0x118]
call fcn.1001a32c
mov dword [ebp - 4], 5
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x5e4], 0x9e56e623
mov dword [ebp - 0x1c4], 0xffffffff
mov dword [ebp - 0x32c], 0xfffffffd
mov dword [ebp - 0x694], 0x80e44e38
mov dword [ebp - 0x908], 0xb159bbc0
mov dword [ebp - 0x2e8], 0x60950c43
mov dword [ebp - 0x8b8], 1
mov dword [ebp - 0x1bc], 0
jmp 0x10035f4e
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 4
jge 0x10035f70
push dword [ebp - 0x1bc]
lea ecx, [ebp - 0x118]
call fcn.1001a399
mov dword [eax], 0xfffffff8
jmp 0x10035f41
mov dword [ebp - 0x10], 0
jmp 0x10035f80
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x1003660c
mov dword [ebp - 0xbc], 0xffffffff
mov dword [ebp - 0x7d4], 0xb872
mov dword [ebp - 0x7e4], 0xa27c819a
mov dword [ebp - 0x1c0], 0
jmp 0x10035fc1
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 2
jge 0x10035fdd
mov eax, dword [ebp - 0x1c0]
mov dword [ebp + eax*4 - 0xb28], 1
jmp 0x10035fb4
push dword [ebp - 0x10]
lea ecx, [ebp - 0x118]
call fcn.1001a399
mov esi, eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x118]
call fcn.1001a399
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x1003600d
mov dword [ebp - 0x414], 1
jmp 0x10036014
and dword [ebp - 0x414], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x118]
call fcn.1001a399
cmp dword [eax], 0
je 0x10036043
push dword [ebp - 0x10]
lea ecx, [ebp - 0x118]
call fcn.1001a399
cmp dword [eax], 0
jne 0x10036043
and dword [ebp - 0x900], 0
jmp 0x1003604d
mov dword [ebp - 0x900], 1
mov eax, dword [ebp - 0xbc]
imul eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x5c]
jge 0x10036068
mov dword [ebp - 0x6f4], 1
jmp 0x1003606f
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0x5e4], eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x118]
call fcn.1001a399
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], eax
jge 0x1003609d
mov dword [ebp - 0x7c4], 1
jmp 0x100360a4
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xac4], eax
mov esi, 0xb26d8f9c
sub esi, dword [ebp - 0x5c]
push 2
lea ecx, [ebp - 0x118]
call fcn.1001a399
cmp esi, dword [eax]
jne 0x100360db
mov dword [ebp - 0x8a8], 1
jmp 0x100360e2
and dword [ebp - 0x8a8], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x118]
call fcn.1001a399
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x10], eax
jg 0x1003611a
push dword [ebp - 0x10]
lea ecx, [ebp - 0x118]
call fcn.1001a399
cmp dword [eax], 0
je 0x1003611a
mov dword [ebp - 0x404], 1
jmp 0x10036121
and dword [ebp - 0x404], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x118]
call fcn.1001a399
mov esi, dword [ebp - 0x404]
sub esi, dword [eax]
push 2
lea ecx, [ebp - 0x118]
call fcn.1001a399
cmp esi, dword [eax]
jge 0x10036154
mov dword [ebp - 0x5b4], 1
jmp 0x1003615b
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x5b4], eax
je 0x10036172
mov dword [ebp - 0x40c], 1
jmp 0x10036179
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
je 0x100361b9
push dword [ebp - 0x10]
lea ecx, [ebp - 0x118]
call fcn.1001a399
cmp dword [eax], 0
je 0x100361b9
mov dword [ebp - 0x68c], 1
jmp 0x100361c0
and dword [ebp - 0x68c], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x118]
call fcn.1001a399
mov ecx, dword [ebp - 0x68c]
cmp ecx, dword [eax]
jge 0x100361ed
cmp dword [ebp - 0x1c4], 0
je 0x100361ed
mov dword [ebp - 0x5bc], 1
jmp 0x100361f4
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x414]
add eax, dword [ebp - 0x5bc]
cmp eax, dword [ebp - 0x170]
jne 0x10036214
mov dword [ebp - 0x41c], 1
jmp 0x1003621b
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0xbc]
cmp dword [ebp - 0x41c], eax
jg 0x10036235
mov dword [ebp - 0x70c], 1
jmp 0x1003623c
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x70c]
sub eax, 0x2fdfb9ed
mov dword [ebp - 0xac], eax
je 0x10036269
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x10036267
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100362a7
mov dword [ebp - 0xbc], 0
jmp 0x10036282
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jg 0x100362a7
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x100362a5
push 1
call fcn.10033764
pop ecx
jmp 0x10036275
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xacc], eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x118]
call fcn.1001a399
cmp dword [eax], 0
je 0x100362e2
push dword [ebp - 0x10]
lea ecx, [ebp - 0x118]
call fcn.1001a399
cmp dword [eax], 0
je 0x100362e2
mov dword [ebp - 0x5c4], 1
jmp 0x100362e9
and dword [ebp - 0x5c4], 0
cmp dword [ebp - 0xac], 0x351d
jle 0x10036301
mov dword [ebp - 0x424], 1
jmp 0x10036308
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x424], eax
jle 0x10036322
mov dword [ebp - 0x42c], 1
jmp 0x10036329
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x5c4]
sub eax, dword [ebp - 0x42c]
add eax, 0x7bfe1a27
mov dword [ebp - 0x694], eax
jne 0x1003634f
xor eax, eax
jne 0x1003634f
and dword [ebp - 0x434], 0
jmp 0x10036359
mov dword [ebp - 0x434], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x434], eax
jne 0x10036370
mov dword [ebp - 0x5cc], 1
jmp 0x10036377
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0x5cc], eax
jne 0x10036391
mov dword [ebp - 0x43c], 1
jmp 0x10036398
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x43c], eax
jne 0x100363b2
mov dword [ebp - 0x714], 1
jmp 0x100363b9
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x714], eax
jle 0x100363d3
mov dword [ebp - 0x7cc], 1
jmp 0x100363da
and dword [ebp - 0x7cc], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x118]
call fcn.1001a399
push dword [ebp - 0x10]
lea ecx, [ebp - 0x118]
call fcn.1001a399
cmp dword [eax], 0xffff
jne 0x1003640a
mov dword [ebp - 0x444], 1
jmp 0x10036411
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x908]
cmp dword [ebp - 0x444], eax
jle 0x1003642b
mov dword [ebp - 0x5d4], 1
jmp 0x10036432
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x5d4]
sub eax, dword [ebp - 0x7d4]
cmp eax, dword [ebp - 0x170]
je 0x10036452
mov dword [ebp - 0x44c], 1
jmp 0x10036459
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
sub eax, dword [ebp - 0x10]
cmp eax, 0xfffffffa
jle 0x10036473
mov dword [ebp - 0x8b0], 1
jmp 0x1003647a
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xad4], eax
cmp dword [ebp - 0x10], 0
je 0x100364a1
mov eax, 0xf6a0
test eax, eax
je 0x100364a1
mov dword [ebp - 0x69c], 1
jmp 0x100364a8
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x1c8]
cmp dword [ebp - 0x69c], eax
jg 0x100364c2
mov dword [ebp - 0x454], 1
jmp 0x100364c9
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x454]
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x2e8], 0
je 0x100364f3
or eax, 0xffffffff
je 0x100364f3
mov dword [ebp - 0x5dc], 1
jmp 0x100364fa
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x5dc]
add eax, 0x8171
imul esi, eax, 0x61f6
push dword [ebp - 0x10]
lea ecx, [ebp - 0x118]
call fcn.1001a399
imul esi, dword [eax]
cmp esi, 0xffff
je 0x10036530
mov dword [ebp - 0x45c], 1
jmp 0x10036537
and dword [ebp - 0x45c], 0
imul eax, dword [ebp - 0x45c], 0xf331
test eax, eax
jne 0x1003655a
cmp dword [ebp - 0x7dc], 0
jne 0x1003655a
mov dword [ebp - 0x700], 1
jmp 0x10036561
and dword [ebp - 0x700], 0
cmp dword [ebp - 0x700], 0
jg 0x10036576
mov dword [ebp - 0x464], 1
jmp 0x1003657d
and dword [ebp - 0x464], 0
cmp dword [ebp - 0x464], 0x67d69bdf
jg 0x10036595
mov dword [ebp - 0x910], 1
jmp 0x1003659c
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0xadc], eax
xor eax, eax
inc eax
je 0x100365b6
cmp dword [ebp - 0x5e4], 0
jne 0x100365c8
cmp dword [ebp - 0x1c8], 0
jne 0x100365c8
and dword [ebp - 0x46c], 0
jmp 0x100365d2
mov dword [ebp - 0x46c], 1
imul eax, dword [ebp - 0x46c], 0xfffffffa
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xb28]
jge 0x100365f4
mov dword [ebp - 0x6a4], 1
jmp 0x100365fb
and dword [ebp - 0x6a4], 0
mov eax, dword [ebp - 0x6a4]
mov dword [ebp - 0x7e4], eax
jmp 0x10035f79
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0xae4], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xaec], eax
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0xaf8], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xb04], eax
push 0
lea ecx, [ebp - 0x118]
call fcn.1001a399
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x2e8], eax
je 0x10036663
mov dword [ebp - 0x474], 1
jmp 0x1003666a
and dword [ebp - 0x474], 0
cmp dword [ebp - 0x474], 1
jae 0x1003667f
mov dword [ebp - 0x5ec], 1
jmp 0x10036686
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x5ec]
sub eax, dword [ebp - 0x1c8]
mov dword [ebp - 0xac], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x118]
call fcn.1001a394
jmp 0x10035ec3
mov eax, dword [ebp - 0xf4]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0xf4]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0x458], eax
lea eax, [ebp - 0x60]
push eax
push 0
lea eax, [ebp - 0x30]
push eax
push 0x5272
push 0x4707
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.10033836
add esp, 0x1c
mov dword [ebp - 0x90], 0xffffffff
mov dword [ebp - 0x9c], 0xb2b534de
mov dword [ebp - 0x1d0], 0x2fb29d94
mov dword [ebp - 0x5fc], 1
push 3
lea ecx, [ebp - 0x798]
call fcn.1001a32c
mov dword [ebp - 4], 6
mov dword [ebp - 0xb10], 0xee692d35
mov dword [ebp - 0x11c], 8
mov dword [ebp - 0xb1c], 0xfffffffa
push 2
lea ecx, [ebp - 0xb8c]
call fcn.1001a32c
mov byte [ebp - 4], 7
mov dword [ebp - 0x138], 0
jmp 0x10036774
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 3
jge 0x10036796
push dword [ebp - 0x138]
lea ecx, [ebp - 0x798]
call fcn.1001a399
mov dword [eax], 0xdbac
jmp 0x10036767
push 1
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0xb8c]
push eax
call fcn.10033783
add esp, 0xc
mov dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb54], eax
cmp dword [ebp - 0x90], 0xffffffff
jge 0x100367d9
mov dword [ebp - 0x7ec], 1
jmp 0x100367e0
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xb5c], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xa50], eax
cmp dword [ebp - 0x90], 0xb0ad
jg 0x1003681c
mov dword [ebp - 0x47c], 1
jmp 0x10036823
and dword [ebp - 0x47c], 0
mov eax, dword [ebp - 0x90]
imul eax, dword [ebp - 0x47c]
test eax, eax
je 0x10036849
cmp dword [ebp - 0x90], 0
je 0x10036849
mov dword [ebp - 0x758], 1
jmp 0x10036850
and dword [ebp - 0x758], 0
cmp dword [ebp - 0x758], 0x6432a276
jl 0x10036868
mov dword [ebp - 0x484], 1
jmp 0x1003686f
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x90]
imul eax, dword [ebp - 0x484]
test eax, eax
jne 0x10036c15
mov dword [ebp - 0x350], 0x4486cae8
mov dword [ebp - 0x9d4], 2
mov dword [ebp - 0x9d0], 2
mov dword [ebp - 0x9cc], 2
mov dword [ebp - 0x9c8], 2
lea ecx, [ebp - 0x345]
call fcn.1000ac73
push eax
lea eax, [ebp - 0x9c4]
push eax
lea eax, [ebp - 0x9d4]
push eax
lea ecx, [ebp - 0xc70]
call fcn.1001a3a8
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x8d4]
call fcn.1001a36e
mov byte [ebp - 4], 8
mov dword [ebp - 0x918], 0x382fd978
mov dword [ebp - 0xbd4], 0x66aa6f69
mov dword [ebp - 0xbdc], 0xffffffff
mov dword [ebp - 0xbf0], 0x89c297e1
mov dword [ebp - 0x4ac], 0x6972
mov dword [ebp - 0x9c], 0
jmp 0x1003693a
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0x11
jge 0x10036bf7
mov dword [ebp - 0x160], 0xbebf
mov dword [ebp - 0x9ac], 0x448071c3
mov dword [ebp - 0x9a8], 0x448071c3
mov dword [ebp - 0x9a4], 0x448071c3
mov dword [ebp - 0x9a0], 0x448071c3
mov dword [ebp - 0x1fc], 0
jmp 0x10036992
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 2
jge 0x100369ae
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0xaf4], 0x8ceaaf2c
jmp 0x10036985
cmp dword [ebp - 0x160], 0
je 0x10036a61
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xbf8], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0xc00], eax
mov eax, dword [ebp - 0x350]
cmp dword [ebp - 0x9c], eax
je 0x100369ed
mov dword [ebp - 0x5f4], 1
jmp 0x100369f4
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0
jne 0x10036a1b
cmp dword [ebp - 0x350], 0
jne 0x10036a1b
and dword [ebp - 0x48c], 0
jmp 0x10036a25
mov dword [ebp - 0x48c], 1
cmp dword [ebp - 0x48c], 0x7974
jne 0x10036a3d
mov dword [ebp - 0x6ac], 1
jmp 0x10036a44
and dword [ebp - 0x6ac], 0
mov eax, dword [ebp - 0x9c]
imul eax, dword [ebp - 0x6ac]
test eax, eax
je 0x10036a61
mov dword [ebp - 0x494], 1
jmp 0x10036a68
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x5fc], eax
mov eax, dword [ebp - 0x5fc]
sub eax, 0x2700732d
cmp eax, dword [ebp - 0x160]
jl 0x10036bdd
mov dword [ebp - 0x708], 0xd552
push 0
lea eax, [ebp - 0x350]
push eax
lea eax, [ebp - 0x8d4]
push eax
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x798]
push eax
lea eax, [ebp - 0x708]
push eax
call fcn.10033bdd
add esp, 0x18
push 1
lea ecx, [ebp - 0x798]
call fcn.1001a399
cmp dword [eax], 0
je 0x10036b19
mov eax, dword [ebp - 0x1d0]
cmp dword [ebp - 0x918], eax
jne 0x10036aee
mov dword [ebp - 0x49c], 1
jmp 0x10036af5
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x1d0]
add eax, dword [ebp - 0x49c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x9ac]
jg 0x10036b3d
mov eax, 0x4b74
test eax, eax
jne 0x10036b3d
push 0
lea ecx, [ebp - 0x8d4]
call fcn.1001a399
cmp dword [eax], 0
jne 0x10036b3d
cmp dword [ebp - 0x90], 0
jne 0x10036b3d
and dword [ebp - 0x7f4], 0
jmp 0x10036b47
mov dword [ebp - 0x7f4], 1
mov eax, dword [ebp - 0x708]
mov dword [ebp - 0xbf4], eax
cmp dword [ebp - 0x160], 0
jne 0x10036b75
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9ac], 0
jne 0x10036b75
and dword [ebp - 0x4a4], 0
jmp 0x10036b7f
mov dword [ebp - 0x4a4], 1
push 2
lea ecx, [ebp - 0x8d4]
call fcn.1001a399
mov esi, dword [ebp - 0x4a4]
imul esi, dword [eax]
push 2
lea ecx, [ebp - 0x8d4]
call fcn.1001a399
cmp esi, dword [eax]
jle 0x10036bb2
mov dword [ebp - 0x604], 1
jmp 0x10036bb9
and dword [ebp - 0x604], 0
push 2
lea ecx, [ebp - 0x798]
call fcn.1001a399
mov eax, dword [eax]
add eax, dword [ebp - 0x604]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xaf4], eax
jmp 0x10036bf2
mov dword [ebp - 0x8c8], 8
cmp dword [ebp - 0x8c8], 0
je 0x10036bf2
jmp 0x10036bf7
jmp 0x1003692d
mov eax, dword [ebp - 0x4ac]
inc eax
mov dword [ebp - 0x4ac], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x8d4]
call fcn.1001a394
jmp 0x10036c50
mov dword [ebp - 0x11c], 0
jmp 0x10036c2e
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 3
jge 0x10036c50
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x798]
call fcn.1001a399
mov dword [eax], 0xb4c7
jmp 0x10036c21
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xb8c]
call fcn.1001a394
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x798]
call fcn.1001a394
cmp dword [ebp - 0x30], 0
jne 0x10036c79
jmp 0x1003b03f
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x30]
add ecx, dword [eax]
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x14], ecx
xor ecx, ecx
call fcn.1001c2aa
push eax
call fcn.100724a4
pop ecx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x214], 0
jmp 0x10036cb5
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 1
jge 0x10036cce
mov eax, dword [ebp - 0x214]
mov dword [ebp + eax*4 - 0x40], 0x624039b
jmp 0x10036ca8
mov dword [ebp - 0x1c], 0
jmp 0x10036cde
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jg 0x10036cf2
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x40], 0
je 0x10036cf0
jmp 0x10036cf2
jmp 0x10036cd7
mov dword [ebp - 0x1c], 0
jmp 0x10036d02
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x1003707c
push 3
lea ecx, [ebp - 0x7b0]
call fcn.1001a32c
mov dword [ebp - 4], 9
mov dword [ebp - 0x4d4], 0xffffffff
mov dword [ebp - 0x80c], 0x9e46ed4d
push 0x10c3
push 0x6cbb
lea eax, [ebp - 0x7b0]
push eax
push 0x78c4
push 0
push 0x6b25
lea eax, [ebp - 0xbfc]
push eax
push 0x126
call fcn.10034ca1
add esp, 0x20
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x40], 0xffffffff
je 0x10036d7b
mov dword [ebp - 0x4cc], 1
jmp 0x10036d82
and dword [ebp - 0x4cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
mov dword [ebp - 0xa58], eax
imul eax, dword [ebp - 0x1c], 0x12c0
cmp eax, 0x7cd9
jle 0x10036dac
mov dword [ebp - 0x7fc], 1
jmp 0x10036db3
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xb38], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x40], 0
jbe 0x10036ddc
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x40], 0
jne 0x10036ddc
and dword [ebp - 0x6b4], 0
jmp 0x10036de6
mov dword [ebp - 0x6b4], 1
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x40]
cmp dword [ebp - 0x6b4], eax
jge 0x10036e01
mov dword [ebp - 0x4b4], 1
jmp 0x10036e08
and dword [ebp - 0x4b4], 0
cmp dword [ebp - 0x4b4], 0
jne 0x10036e1d
mov dword [ebp - 0x60c], 1
jmp 0x10036e24
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x60c], eax
jg 0x10036e42
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x40], 0
jne 0x10036e42
and dword [ebp - 0x4bc], 0
jmp 0x10036e4c
mov dword [ebp - 0x4bc], 1
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x4bc]
cmp eax, 0xc4ce
jne 0x10036e69
mov dword [ebp - 0x920], 1
jmp 0x10036e70
and dword [ebp - 0x920], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp + eax - 0x40], ecx
jne 0x10036e8b
mov dword [ebp - 0x728], 1
jmp 0x10036e92
and dword [ebp - 0x728], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x40]
cmp dword [ebp - 0x728], eax
jl 0x10036eb4
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x40], 0
jne 0x10036eb4
and dword [ebp - 0x4c4], 0
jmp 0x10036ebe
mov dword [ebp - 0x4c4], 1
cmp dword [ebp - 0x4c4], 0x83de37d6
jb 0x10036ed6
mov dword [ebp - 0x614], 1
jmp 0x10036edd
and dword [ebp - 0x614], 0
cmp dword [ebp - 0x614], 0xf181
jge 0x10036ef5
mov dword [ebp - 0x804], 1
jmp 0x10036efc
and dword [ebp - 0x804], 0
push 1
lea ecx, [ebp - 0x7b0]
call fcn.1001a399
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0xa60], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x40], 0xb81fdf20
jne 0x10036f31
mov dword [ebp - 0x8d8], 1
jmp 0x10036f38
and dword [ebp - 0x8d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
mov dword [ebp - 0xbe0], eax
cmp dword [ebp - 0x1c], 0
jg 0x10036f5a
mov dword [ebp - 0x6bc], 1
jmp 0x10036f61
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x4cc]
sub eax, dword [ebp - 0x6bc]
je 0x10036f84
cmp dword [ebp - 0x4d4], 0
je 0x10036f84
mov dword [ebp - 0x61c], 1
jmp 0x10036f8b
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x61c], eax
jg 0x10036fa2
mov dword [ebp - 0x4dc], 1
jmp 0x10036fa9
and dword [ebp - 0x4dc], 0
push 1
lea ecx, [ebp - 0x7b0]
call fcn.1001a399
mov ecx, dword [ebp - 0x4dc]
cmp ecx, dword [eax]
jg 0x10036fcc
mov dword [ebp - 0x710], 1
jmp 0x10036fd3
and dword [ebp - 0x710], 0
cmp dword [ebp - 0x710], 1
je 0x10036fe8
mov dword [ebp - 0x4e4], 1
jmp 0x10036fef
and dword [ebp - 0x4e4], 0
cmp dword [ebp - 0x4e4], 0xffffffff
je 0x10037004
mov dword [ebp - 0x624], 1
jmp 0x1003700b
and dword [ebp - 0x624], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x40]
cmp dword [ebp - 0x624], eax
jl 0x10037038
push 1
lea ecx, [ebp - 0x7b0]
call fcn.1001a399
cmp dword [eax], 0
jne 0x10037038
and dword [ebp - 0x354], 0
jmp 0x10037042
mov dword [ebp - 0x354], 1
push 1
lea ecx, [ebp - 0x7b0]
call fcn.1001a399
mov ecx, dword [ebp - 0x354]
mov dword [eax], ecx
mov eax, dword [ebp - 0x354]
sub eax, 0x5485c142
mov dword [ebp - 0x80c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7b0]
call fcn.1001a394
jmp 0x10036cfb
mov byte [ebp - 0x280], 0
mov byte [ebp - 0x27f], 5
mov byte [ebp - 0x27e], 0x43
mov byte [ebp - 0x27d], 0xe6
mov byte [ebp - 0x27c], 0x9d
mov byte [ebp - 0x27b], 0xdf
mov byte [ebp - 0x27a], 0x3e
mov byte [ebp - 0x279], 0xde
mov byte [ebp - 0x278], 4
mov byte [ebp - 0x277], 0x96
mov byte [ebp - 0x276], 0x43
mov byte [ebp - 0x275], 0x89
mov byte [ebp - 0x274], 0x36
mov byte [ebp - 0x273], 0x4b
mov byte [ebp - 0x272], 0xaa
mov byte [ebp - 0x271], 0x99
mov byte [ebp - 0x270], 0x22
mov byte [ebp - 0x26f], 0x52
mov byte [ebp - 0x26e], 0xcd
mov byte [ebp - 0x26d], 0x4b
mov byte [ebp - 0x26c], 0x89
mov byte [ebp - 0x26b], 0xcf
mov byte [ebp - 0x26a], 0xc1
mov byte [ebp - 0x269], 0xc
mov byte [ebp - 0x268], 0x4c
mov byte [ebp - 0x267], 0x64
mov byte [ebp - 0x266], 0x28
mov byte [ebp - 0x265], 0x27
mov byte [ebp - 0x264], 0xbc
mov byte [ebp - 0x263], 0x3a
mov byte [ebp - 0x262], 0xdf
mov byte [ebp - 0x261], 0x3c
mov byte [ebp - 0x260], 0xb
mov byte [ebp - 0x25f], 0xdb
mov byte [ebp - 0x25e], 0xc1
mov byte [ebp - 0x25d], 0x9b
mov byte [ebp - 0x25c], 0x7b
mov byte [ebp - 0x25b], 0x96
mov byte [ebp - 0x25a], 0x46
mov byte [ebp - 0x259], 0xdb
mov byte [ebp - 0x258], 0x79
mov byte [ebp - 0x257], 0x5d
mov byte [ebp - 0x256], 0x46
mov byte [ebp - 0x255], 0xbb
mov byte [ebp - 0x254], 0xc1
mov byte [ebp - 0x253], 0xcb
mov byte [ebp - 0x252], 0xa2
mov byte [ebp - 0x251], 0x22
mov byte [ebp - 0x250], 0xb0
mov byte [ebp - 0x24f], 0xda
mov byte [ebp - 0x24e], 0x14
mov byte [ebp - 0x24d], 0xd3
mov byte [ebp - 0x24c], 0xf2
mov byte [ebp - 0x24b], 0xdb
mov byte [ebp - 0x24a], 0x6c
mov byte [ebp - 0x249], 0xb2
mov byte [ebp - 0x248], 0x91
mov byte [ebp - 0x247], 0xcd
mov byte [ebp - 0x246], 2
mov byte [ebp - 0x245], 0x19
mov byte [ebp - 0x244], 0x43
mov byte [ebp - 0x243], 0x24
mov byte [ebp - 0x242], 0x16
mov byte [ebp - 0x241], 0x1e
mov byte [ebp - 0x240], 0xcc
mov byte [ebp - 0x23f], 0x87
mov byte [ebp - 0x23e], 0x71
mov byte [ebp - 0x23d], 0xed
mov byte [ebp - 0x23c], 0x71
mov byte [ebp - 0x23b], 0xb6
mov byte [ebp - 0x23a], 6
mov byte [ebp - 0x239], 0
mov byte [ebp - 0x238], 2
mov byte [ebp - 0x237], 6
mov byte [ebp - 0x236], 1
mov byte [ebp - 0x235], 2
mov byte [ebp - 0x234], 8
mov byte [ebp - 0x233], 5
mov byte [ebp - 0x232], 4
mov byte [ebp - 0x231], 8
mov byte [ebp - 0x230], 3
mov byte [ebp - 0x22f], 0xf
mov byte [ebp - 0x22e], 5
mov byte [ebp - 0x22d], 6
mov byte [ebp - 0x22c], 9
mov byte [ebp - 0x22b], 1
mov byte [ebp - 0x22a], 7
mov byte [ebp - 0x229], 6
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x280]
or eax, 0x34
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x280]
and ecx, 0x34
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x280]
mov byte [ebp + ecx - 0x774], al
mov dword [ebp - 0x44], 2
and dword [ebp - 0x1d8], 0
jmp 0x10037335
mov eax, dword [ebp - 0x44]
inc eax
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x58
jae 0x100373fa
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x280]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x44], eax
jne 0x1003737f
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x280]
inc eax
mov dword [ebp - 0x1d8], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x280]
mov ecx, dword [ebp - 0x44]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x44], eax
jmp 0x1003732d
mov eax, dword [ebp - 0x44]
movzx eax, byte [ebp + eax - 0x27f]
mov ecx, dword [ebp - 0x44]
sub ecx, dword [ebp - 0x1d8]
movzx ecx, byte [ebp + ecx - 0x282]
movsx ecx, byte [ebp + ecx - 0x774]
or eax, ecx
mov ecx, dword [ebp - 0x44]
movzx ecx, byte [ebp + ecx - 0x27f]
mov edx, dword [ebp - 0x44]
sub edx, dword [ebp - 0x1d8]
movzx edx, byte [ebp + edx - 0x282]
movsx edx, byte [ebp + edx - 0x774]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x44]
movzx ecx, byte [ebp + ecx - 0x280]
mov byte [ebp + ecx - 0x774], al
push 0x1d93
lea eax, [ebp - 0x1d8]
push eax
push 1
call fcn.100337eb
add esp, 0xc
jmp 0x1003732d
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x774], 0
push 2
lea ecx, [ebp - 0xb9c]
call fcn.1001a32c
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x964], 9
mov dword [ebp - 0x960], 9
mov dword [ebp - 0x95c], 9
mov dword [ebp - 0x958], 9
mov dword [ebp - 0xa68], 0x2b441a62
mov dword [ebp - 0xa0], 0
jmp 0x10037467
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x10037489
push dword [ebp - 0xa0]
lea ecx, [ebp - 0xb9c]
call fcn.1001a399
mov dword [eax], 0xfffffffb
jmp 0x1003745a
mov dword [ebp - 0xa0], 0
jmp 0x100374a2
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x100374be
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0xb34], 0x29989d2
jmp 0x10037495
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x964], 0
jmp 0x100374e9
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x964]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x964], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x964], 1
jg 0x10037645
push 1
lea ecx, [ebp - 0x8e4]
call fcn.1001a32c
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x2f0], 0xfffffff7
mov dword [ebp - 0x74], 0
jmp 0x10037527
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x10037543
push dword [ebp - 0x74]
lea ecx, [ebp - 0x8e4]
call fcn.1001a399
mov dword [eax], 0xe2c0d37a
jmp 0x10037520
mov dword [ebp - 0x74], 0
jmp 0x10037553
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x10037569
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x928], 0xba1a4d63
jmp 0x1003754c
push 0
lea ecx, [ebp - 0x8e4]
call fcn.1001a399
mov dword [eax], 1
jmp 0x100375a2
push 0
lea ecx, [ebp - 0x8e4]
call fcn.1001a399
mov dword [ebp - 0x4ec], eax
mov eax, dword [ebp - 0x4ec]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x4ec]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x8e4]
call fcn.1001a399
cmp dword [eax], 0
jl 0x10037631
mov dword [ebp - 0x204], 0
jmp 0x100375cd
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 1
jge 0x100375e9
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0xb44], 0
jmp 0x100375c0
imul eax, dword [ebp - 0x2f0], 0xfbc7
mov dword [ebp - 0x6c4], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6c4]
mov dword [ebp + eax - 0x928], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6c4]
mov dword [ebp + eax - 0xb34], ecx
mov eax, dword [ebp - 0x2f0]
dec eax
mov dword [ebp - 0x2f0], eax
jmp 0x1003757e
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x8e4]
call fcn.1001a394
jmp 0x100374d0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb9c]
call fcn.1001a394
lea eax, [ebp - 0x774]
push eax
lea ecx, [ebp - 0xd00]
call fcn.1003b4c5
mov dword [ebp - 0x814], eax
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0x8e8], eax
mov dword [ebp - 4], 0xc
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x8e8]
call fcn.1001c26f
pop ecx
mov dword [ebp - 0x904], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd00]
call fcn.1001a28e
mov dword [ebp - 0x744], 0x8f6c218e
mov dword [ebp - 0x930], 0xfffffffc
push 2
lea ecx, [ebp - 0x9f8]
call fcn.1001a32c
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x140], 0
jmp 0x100376e5
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 4
jge 0x10037701
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x740], 0x5252cb13
jmp 0x100376d8
push 0x17a3
push 1
push 0x2ddd
lea eax, [ebp - 0x9f8]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x6874
push 0x1d9c
call fcn.10033836
add esp, 0x1c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x740], 0xffffffff
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x740]
mov dword [ebp - 0x744], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x740], 0xb0b4
je 0x10037770
mov dword [ebp - 0x4f4], 1
jmp 0x10037777
and dword [ebp - 0x4f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x740]
push 4
pop ecx
imul ecx, ecx, 3
add eax, dword [ebp + ecx - 0x740]
cmp eax, dword [ebp - 0x4f4]
jg 0x100377a5
mov dword [ebp - 0x62c], 1
jmp 0x100377ac
and dword [ebp - 0x62c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x740]
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x62c]
sub edx, dword [ebp + ecx - 0x740]
sub eax, edx
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x740]
jg 0x100377eb
mov dword [ebp - 0x4fc], 1
jmp 0x100377f2
and dword [ebp - 0x4fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x740]
cmp dword [ebp - 0x4fc], eax
jle 0x10037813
mov dword [ebp - 0x81c], 1
jmp 0x1003781a
and dword [ebp - 0x81c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x740]
mov dword [ebp - 0xa70], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x740]
cmp dword [ebp - 0x744], eax
jg 0x1003784e
mov dword [ebp - 0x504], 1
jmp 0x10037855
and dword [ebp - 0x504], 0
mov esi, dword [ebp - 0x930]
add esi, dword [ebp - 0x504]
push 1
lea ecx, [ebp - 0x9f8]
call fcn.1001a399
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9f8]
call fcn.1001a394
and dword [ebp - 0x1e0], 0
jmp 0x10037895
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0xb
jae 0x100378ae
mov eax, dword [ebp - 0x1e0]
mov byte [ebp + eax - 0x774], 0
jmp 0x10037888
mov dword [ebp - 0x514], 0x8f6c218e
mov dword [ebp - 0x8f8], 0xfffffffc
push 2
lea ecx, [ebp - 0xa28]
call fcn.1001a32c
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x98], 0
jmp 0x100378ef
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 4
jge 0x1003790b
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x754], 0x5252cb13
jmp 0x100378e2
mov dword [ebp - 0x98], 0
jmp 0x10037924
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x10037943
push dword [ebp - 0x98]
lea ecx, [ebp - 0xa28]
call fcn.1001a399
and dword [eax], 0
jmp 0x10037917
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x754], 0xffffffff
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x754]
mov dword [ebp - 0x514], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x754], 0xb0b4
je 0x10037986
mov dword [ebp - 0x634], 1
jmp 0x1003798d
and dword [ebp - 0x634], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x754]
push 4
pop ecx
imul ecx, ecx, 3
add eax, dword [ebp + ecx - 0x754]
cmp eax, dword [ebp - 0x634]
jg 0x100379bb
mov dword [ebp - 0x50c], 1
jmp 0x100379c2
and dword [ebp - 0x50c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x754]
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x50c]
sub edx, dword [ebp + ecx - 0x754]
sub eax, edx
neg eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x754]
jg 0x10037a01
mov dword [ebp - 0x6cc], 1
jmp 0x10037a08
and dword [ebp - 0x6cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x754]
cmp dword [ebp - 0x6cc], eax
jle 0x10037a29
mov dword [ebp - 0x824], 1
jmp 0x10037a30
and dword [ebp - 0x824], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x754]
mov dword [ebp - 0xbc0], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x754]
cmp dword [ebp - 0x514], eax
jg 0x10037a64
mov dword [ebp - 0x63c], 1
jmp 0x10037a6b
and dword [ebp - 0x63c], 0
mov esi, dword [ebp - 0x8f8]
add esi, dword [ebp - 0x63c]
push 1
lea ecx, [ebp - 0xa28]
call fcn.1001a399
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa28]
call fcn.1001a394
mov byte [ebp - 0x19c], 1
mov byte [ebp - 0x19b], 0x99
mov byte [ebp - 0x19a], 5
mov byte [ebp - 0x199], 7
mov byte [ebp - 0x198], 0xb
mov byte [ebp - 0x197], 0x89
mov byte [ebp - 0x196], 0x2e
mov byte [ebp - 0x195], 0x58
mov byte [ebp - 0x194], 0x52
mov byte [ebp - 0x193], 0x6f
mov byte [ebp - 0x192], 0xcb
mov byte [ebp - 0x191], 0xe4
mov byte [ebp - 0x190], 0xfd
mov byte [ebp - 0x18f], 0x72
mov byte [ebp - 0x18e], 0x4b
mov byte [ebp - 0x18d], 0x6e
mov byte [ebp - 0x18c], 7
mov byte [ebp - 0x18b], 7
mov byte [ebp - 0x18a], 2
mov byte [ebp - 0x189], 1
mov byte [ebp - 0x188], 8
mov byte [ebp - 0x187], 7
mov byte [ebp - 0x186], 9
mov byte [ebp - 0x185], 0
mov byte [ebp - 0x184], 3
mov byte [ebp - 0x183], 2
mov byte [ebp - 0x182], 0
mov byte [ebp - 0x181], 3
mov byte [ebp - 0x180], 4
mov byte [ebp - 0x17f], 5
mov byte [ebp - 0x17e], 6
mov byte [ebp - 0x17d], 0xd
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x19c]
or eax, 0xaf
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x19c]
and ecx, 0xaf
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x19c]
mov byte [ebp + ecx - 0x768], al
mov dword [ebp - 0x2c], 2
and dword [ebp - 0x17c], 0
jmp 0x10037bcb
mov eax, dword [ebp - 0x2c]
inc eax
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x20
jae 0x10037ca9
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x19c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x2c], eax
jne 0x10037c15
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x19c]
inc eax
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x19c]
mov ecx, dword [ebp - 0x2c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x2c], eax
jmp 0x10037bc3
mov eax, dword [ebp - 0x2c]
movzx eax, byte [ebp + eax - 0x19b]
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x17c]
movzx ecx, byte [ebp + ecx - 0x19e]
movsx ecx, byte [ebp + ecx - 0x768]
add eax, ecx
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x19b]
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x17c]
movzx edx, byte [ebp + edx - 0x19e]
movsx edx, byte [ebp + edx - 0x768]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x19b]
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x17c]
movzx edx, byte [ebp + edx - 0x19e]
movsx edx, byte [ebp + edx - 0x768]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ebp + ecx - 0x19c]
mov byte [ebp + ecx - 0x768], al
and dword [ebp - 0x17c], 0
jmp 0x10037bc3
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x768], 0
mov dword [ebp - 0xc4], 8
mov dword [ebp - 0x51c], 0xffffffff
mov dword [ebp - 0x330], 0x4f77722a
mov dword [ebp - 0x534], 0xfffffff9
mov dword [ebp - 0xa78], 0xfc53d8b3
mov dword [ebp - 0xb50], 0x3046aa1d
mov dword [ebp - 0xa80], 0xfffffffe
mov dword [ebp - 0xbe4], 0xb0be945d
mov dword [ebp - 0x654], 0
mov dword [ebp - 0x224], 0
jmp 0x10037d2a
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 1
jge 0x10037d46
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0x938], 0xa5659cde
jmp 0x10037d1d
mov dword [ebp - 0xc4], 0
jmp 0x10037d5f
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xfffffff5
jg 0x10037f77
mov dword [ebp - 0x148], 0x3eb6
mov dword [ebp - 0x2f8], 0xd700698
mov dword [ebp - 0x334], 0x2a3062a
mov dword [ebp - 0x82c], 0x56d20a2e
cmp dword [ebp - 0x148], 0
je 0x10037e75
mov dword [ebp - 0x51c], 0xf2ba167c
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x2f8]
sub eax, 0x34ac0198
cmp eax, 1
jne 0x10037dd5
xor eax, eax
inc eax
jne 0x10037dd5
and dword [ebp - 0x718], 0
jmp 0x10037ddf
mov dword [ebp - 0x718], 1
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x718], eax
jg 0x10037e02
cmp dword [ebp - 0x148], 0
je 0x10037e02
mov dword [ebp - 0x524], 1
jmp 0x10037e09
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x334]
cmp dword [ebp - 0x524], eax
jl 0x10037e23
mov dword [ebp - 0x644], 1
jmp 0x10037e2a
and dword [ebp - 0x644], 0
imul eax, dword [ebp - 0x644], 0x5d3e
cmp dword [ebp - 0xc4], eax
jl 0x10037e48
mov dword [ebp - 0x52c], 1
jmp 0x10037e4f
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x334]
cmp dword [ebp - 0x330], eax
jge 0x10037e75
mov dword [ebp - 0x6d4], 1
jmp 0x10037e7c
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 0
jge 0x10037e9d
mov dword [ebp - 0x64c], 1
jmp 0x10037ea4
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x148]
cmp eax, dword [ebp - 0x64c]
je 0x10037ebe
mov dword [ebp - 0x53c], 1
jmp 0x10037ec5
and dword [ebp - 0x53c], 0
cmp dword [ebp - 0x53c], 0x5702377d
jge 0x10037ee6
mov eax, 0xa67f6a19
test eax, eax
je 0x10037ee6
mov dword [ebp - 0x730], 1
jmp 0x10037eed
and dword [ebp - 0x730], 0
mov eax, dword [ebp - 0xc4]
add eax, dword [ebp - 0x730]
cmp eax, dword [ebp - 0xc4]
jl 0x10037f0d
mov dword [ebp - 0x544], 1
jmp 0x10037f14
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x334]
cmp dword [ebp - 0x544], eax
je 0x10037f2e
mov dword [ebp - 0x2f8], 0x504ed09e
jmp 0x10037f5f
push 0x47b7
lea eax, [ebp - 0x82c]
push eax
push 0
push 0x75af
lea eax, [ebp - 0x330]
push eax
push 0x70d1
push 0x6dba
push 0x5a43
call fcn.10034ec7
add esp, 0x20
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x148]
mov dword [ebp + eax - 0x938], ecx
jmp 0x10037d52
mov eax, dword [ebp - 0x654]
dec eax
mov dword [ebp - 0x654], eax
lea eax, [ebp - 0x768]
push eax
lea ecx, [ebp - 0xca0]
call fcn.1003b4c5
mov dword [ebp - 0x834], eax
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x940], eax
mov dword [ebp - 4], 0xf
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x940]
call fcn.1001c26f
pop ecx
mov dword [ebp - 0x83c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xca0]
call fcn.1001a28e
and dword [ebp - 0x1e8], 0
jmp 0x10037fea
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0xb
jae 0x10038003
mov eax, dword [ebp - 0x1e8]
mov byte [ebp + eax - 0x768], 0
jmp 0x10037fdd
push dword [ebp - 0x83c]
push dword [ebp - 0x904]
call fcn.1002fffb
pop ecx
pop ecx
mov dword [ebp - 0x54c], eax
lea eax, [ebp - 0x54c]
push eax
push 1
lea eax, [ebp - 0xf4]
push eax
call fcn.10033946
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0x360c
push 1
lea eax, [ebp - 0x54c]
push eax
call fcn.10033989
add esp, 0x10
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x18], 0
jbe 0x10038073
push 1
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.100339ef
add esp, 0xc
mov dword [ebp - 0x150], 1
push 3
lea ecx, [ebp - 0x7a4]
call fcn.1001a32c
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x300], 0xffffffff
mov dword [ebp - 0x104], 3
push 3
lea ecx, [ebp - 0xbac]
call fcn.1001a32c
mov byte [ebp - 4], 0x11
push 0x135
lea eax, [ebp - 0x168]
push eax
push 1
lea eax, [ebp - 0x7a4]
push eax
call fcn.10033a47
add esp, 0x10
mov dword [ebp - 0x168], 0
jmp 0x100380f6
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 3
jge 0x10038115
push dword [ebp - 0x168]
lea ecx, [ebp - 0xbac]
call fcn.1001a399
and dword [eax], 0
jmp 0x100380e9
imul eax, dword [ebp - 0x150], 0xb0cb
test eax, eax
je 0x10038141
push 1
lea ecx, [ebp - 0x7a4]
call fcn.1001a399
cmp dword [eax], 0
je 0x10038141
mov dword [ebp - 0x384], 1
jmp 0x10038148
and dword [ebp - 0x384], 0
cmp dword [ebp - 0x338], 0
jne 0x10038260
cmp dword [ebp - 0x150], 0xa7a81a82
push 2
lea ecx, [ebp - 0x7a4]
call fcn.1001a399
cmp dword [eax], 0xfffffffc
jg 0x1003817d
mov dword [ebp - 0x6dc], 1
jmp 0x10038184
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x6dc], eax
jl 0x1003819e
mov dword [ebp - 0x554], 1
jmp 0x100381a5
and dword [ebp - 0x554], 0
push 2
lea ecx, [ebp - 0x7a4]
call fcn.1001a399
mov ecx, dword [ebp - 0x554]
imul ecx, dword [eax]
test ecx, ecx
jne 0x100381d4
mov dword [ebp - 0x664], 1
cmp dword [ebp - 0x664], 0xfffffff7
jne 0x1003827f
mov dword [ebp - 0x56c], 1
jmp 0x10038286
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
je 0x100382b0
cmp dword [ebp - 0x300], 0
je 0x100382b0
and dword [ebp - 0x6e4], 0
imul eax, dword [ebp - 0x6e4], 0xffffffff
cmp eax, dword [ebp - 0x338]
jne 0x100382d2
mov eax, dword [ebp + 8]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x838]
movzx eax, byte [eax]
test eax, eax
je 0x1003b03f
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret