Function at 0x100277b0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10058a22
mov eax, dword fs:[0]
push eax
sub esp, 0x7b0
mov eax, dword [0x1006a010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 8
mov dword [ebp - 0x56c], 0
lea ecx, [ebp - 0x7bc]
call fcn.10009ae0
mov ecx, str.WantedLevelEditor.xml
mov dword [ebp - 4], 0
call fcn.1003bb90
push eax
lea ecx, [ebp - 0x7bc]
call fcn.10009f70
mov dword [0x1006ab3c], eax
test eax, eax
jne 0x100299c3
mov edx, str.Helicopters
mov ecx, 0x1006ad80
call fcn.10037de0
test al, al
je 0x100299c3
mov edx, str.none
mov ecx, 0x1006ad80
call fcn.10037de0
test al, al
je 0x1002785b
movzx eax, byte [0x100ec940]
push eax
mov eax, 0x580750
call eax
add esp, 4
push 0xb
push str.Helicopters
mov ecx, 0x1006ad80
call fcn.10037420
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
mov eax, dword [0x1006b1b8]
inc eax
mov dword [ebp - 0x18], 0
push eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x56c], 1
call fcn.10038e60
mov edx, dword [ebp - 0x14]
mov eax, edx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
push 1
push 0x1006359c
cmp eax, 1
jb 0x100278d2
cmp edx, 0x10
lea esi, [ebp - 0x28]
lea eax, [ecx + 1]
cmovae esi, dword [ebp - 0x28]
add esi, ecx
mov dword [ebp - 0x18], eax
push esi
call fcn.1003ef40
add esp, 0xc
mov byte [esi + 1], 0
jmp 0x100278e9
mov byte [ebp - 0x570], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x570]
push 1
call fcn.10038840
push 0x1006b1a8
lea ecx, [ebp - 0x28]
call fcn.10037170
mov edx, dword [ebp - 0x14]
mov eax, edx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
push 1
push 0x10063598
cmp eax, 1
jb 0x10027930
cmp edx, 0x10
lea esi, [ebp - 0x28]
lea eax, [ecx + 1]
cmovae esi, dword [ebp - 0x28]
add esi, ecx
mov dword [ebp - 0x18], eax
push esi
call fcn.1003ef40
add esp, 0xc
mov byte [esi + 1], 0
lea eax, [ebp - 0x28]
jmp 0x10027947
mov byte [ebp - 0x570], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x570]
push 1
call fcn.10038840
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
movups xmm0, xmmword [eax]
mov dword [ebp - 0x56c], 3
movups xmmword [ebp - 0x70], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x60], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
push 0x1006af38
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 2
call fcn.10037170
mov ecx, 0x1006b3b8
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x250], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x250]
push eax
movq qword [ebp - 0x240], xmm0
call fcn.100372d0
mov edx, dword [ebp - 0x23c]
cmp edx, 0x10
jb 0x10027a05
mov ecx, dword [ebp - 0x250]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100279fb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100299e9
push edx
push ecx
call fcn.1003bfed
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x5c]
cmp edx, 0x10
jb 0x10027a3d
mov ecx, dword [ebp - 0x70]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10027a33
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100299ee
push edx
push ecx
call fcn.1003bfed
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
cmp edx, 0x10
jb 0x10027a87
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10027a7d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100299f3
push edx
push ecx
call fcn.1003bfed
add esp, 8
cmp dword [0x1006b3cc], 0x10
mov eax, 0x1006b3b8
cmovae eax, dword [0x1006b3b8]
mov dword [0x1013c9b0], eax
mov eax, dword [0x1025c244]
test al, 1
jne 0x10027ad3
or eax, 1
mov dword [0x1025b6cc], 0x1006353c
mov dword [0x1025c244], eax
mov dword [0x1025b6d4], 0
mov dword [0x1025b6d0], 0
call fcn.1000c4c0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x18]
push eax
push 0x40
mov esi, 0x582029
mov dword [ebp - 0x1c], 4
push 4
push esi
mov dword [ebp - 0x20], esi
call edi
test eax, eax
setne byte [ebp - 0x14]
mov dword [esi], 7
cmp byte [ebp - 0x14], 0
je 0x10027b1e
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x570]
push ecx
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x570], eax
push dword [ebp - 0x20]
call edi
mov eax, dword [0x1025c244]
test al, 1
jne 0x10027b52
or eax, 1
mov dword [0x1025b6cc], 0x1006353c
mov dword [0x1025c244], eax
mov dword [0x1025b6d4], 0
mov dword [0x1025b6d0], 0
call fcn.1000c4c0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], 4
push eax
push 0x40
mov esi, 0x582432
push 4
push esi
mov dword [ebp - 0x20], esi
call edi
test eax, eax
setne byte [ebp - 0x14]
mov dword [esi], 6
cmp byte [ebp - 0x14], 0
je 0x10027b97
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x570]
push ecx
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x570], eax
push dword [ebp - 0x20]
call edi
push ecx
mov dl, 6
mov ecx, 0x58242b
call fcn.1003b5b0
add esp, 4
mov eax, 0x582300
push 0
push 1
push 1
push 3
sub esp, 0xc
mov dword [esp + 8], 0x435c0000
mov dword [esp + 4], 0x432a0000
mov dword [esp], 0x41e80000
push str.DUMMY
push 0
call eax
movzx eax, al
add esp, 0x24
mov dword [0x100ec940], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
mov eax, dword [0x1006acb8]
add eax, dword [0x1006aea0]
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x56c], 0xe
call fcn.10038e60
push 0x1006ae90
lea ecx, [ebp - 0x28]
call fcn.10037170
push 0x1006aca8
lea ecx, [ebp - 0x28]
call fcn.10037170
mov edx, dword [ebp - 0x14]
mov eax, edx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
push 0xc
push str._helicopter1
cmp eax, 0xc
jb 0x10027c6a
cmp edx, 0x10
lea esi, [ebp - 0x28]
lea eax, [ecx + 0xc]
cmovae esi, dword [ebp - 0x28]
add esi, ecx
mov dword [ebp - 0x18], eax
push esi
call fcn.1003ef40
add esp, 0xc
mov byte [esi + 0xc], 0
lea eax, [ebp - 0x28]
jmp 0x10027c81
mov byte [ebp - 0x570], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x570]
push 0xc
call fcn.10038840
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xd0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xc0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x10027cf5
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10027ceb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100299f8
push edx
push ecx
call fcn.1003bfed
add esp, 8
mov dword [ebp - 0x574], 0x1e7
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
mov eax, dword [0x1006acb8]
add eax, dword [0x1006aea0]
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x56c], 0x36
call fcn.10038e60
push 0x1006ae90
lea ecx, [ebp - 0x28]
call fcn.10037170
push 0x1006aca8
lea ecx, [ebp - 0x28]
call fcn.10037170
mov edx, dword [ebp - 0x14]
mov eax, edx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
push 0xc
push str._helicopter2
cmp eax, 0xc
jb 0x10027d87
cmp edx, 0x10
lea esi, [ebp - 0x28]
lea eax, [ecx + 0xc]
cmovae esi, dword [ebp - 0x28]
add esi, ecx
mov dword [ebp - 0x18], eax
push esi
call fcn.1003ef40
add esp, 0xc
mov byte [esi + 0xc], 0
lea eax, [ebp - 0x28]
jmp 0x10027d9e
mov byte [ebp - 0x570], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x570]
push 0xc
call fcn.10038840
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xb8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xa8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x10027e12
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10027e08
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100299fd
push edx
push ecx
call fcn.1003bfed
add esp, 8
mov dword [ebp - 0x578], 0x1e7
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x28]
mov eax, dword [0x1006acb8]
add eax, dword [0x1006aea0]
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x56c], 0xd6
call fcn.10038e60
push 0x1006ae90
lea ecx, [ebp - 0x28]
call fcn.10037170
push 0x1006aca8
lea ecx, [ebp - 0x28]
call fcn.10037170
mov edx, dword [ebp - 0x14]
mov eax, edx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
push 0xc
push str._helicopter3
cmp eax, 0xc
jb 0x10027ea4
cmp edx, 0x10
lea esi, [ebp - 0x28]
lea eax, [ecx + 0xc]
cmovae esi, dword [ebp - 0x28]
add esi, ecx
mov dword [ebp - 0x18], eax
push esi
call fcn.1003ef40
add esp, 0xc
mov byte [esi + 0xc], 0
lea eax, [ebp - 0x28]
jmp 0x10027ebb
mov byte [ebp - 0x570], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x570]
push 0xc
call fcn.10038840
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xa0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x90], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x10027f2f
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10027f25
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10029a02
push edx
push ecx
call fcn.1003bfed
add esp, 8
mov dword [ebp - 0x57c], 0x1e7
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x28]
mov eax, dword [0x1006acb8]
add eax, dword [0x1006aea0]
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x56c], 0x356
call fcn.10038e60
push 0x1006ae90
lea ecx, [ebp - 0x28]
call fcn.10037170
push 0x1006aca8
lea ecx, [ebp - 0x28]
call fcn.10037170
mov edx, dword [ebp - 0x14]
mov eax, edx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
push 0xc
push str._helicopter4
cmp eax, 0xc
jb 0x10027fc1
cmp edx, 0x10
lea esi, [ebp - 0x28]
lea eax, [ecx + 0xc]
cmovae esi, dword [ebp - 0x28]
add esi, ecx
mov dword [ebp - 0x18], eax
push esi
call fcn.1003ef40
add esp, 0xc
mov byte [esi + 0xc], 0
lea eax, [ebp - 0x28]
jmp 0x10027fd8
mov byte [ebp - 0x570], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x570]
push 0xc
call fcn.10038840
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x88], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x78], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x10028043
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10028039
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10029a07
push edx
push ecx
call fcn.1003bfed
add esp, 8
mov dword [ebp - 0x580], 0x1e7
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x28]
mov eax, dword [0x1006acb8]
add eax, dword [0x1006aea0]
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x56c], 0xd56
call fcn.10038e60
push 0x1006ae90
lea ecx, [ebp - 0x28]
call fcn.10037170
push 0x1006aca8
lea ecx, [ebp - 0x28]
call fcn.10037170
mov edx, dword [ebp - 0x14]
mov eax, edx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
push 0xc
push str._helicopter5
cmp eax, 0xc
jb 0x100280d5
cmp edx, 0x10
lea esi, [ebp - 0x28]
lea eax, [ecx + 0xc]
cmovae esi, dword [ebp - 0x28]
add esi, ecx
mov dword [ebp - 0x18], eax
push esi
call fcn.1003ef40
add esp, 0xc
mov byte [esi + 0xc], 0
lea eax, [ebp - 0x28]
jmp 0x100280ec
mov byte [ebp - 0x570], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x570]
push 0xc
call fcn.10038840
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xe8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xd8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x11
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x584], 0x1e7
lea ecx, [ebp - 0x40]
call fcn.10037a80
push str._helicopter6
mov edx, eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x148]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x14
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x588], 0x1e7
lea ecx, [ebp - 0x58]
call fcn.10037a80
push str._helicopter_pilot1
mov edx, eax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x160]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x17
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x58c], 0xa5
lea ecx, [ebp - 0x40]
call fcn.10037a80
push str._helicopter_pilot2
mov edx, eax
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x178]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x1a
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x590], 0xa5
lea ecx, [ebp - 0x58]
call fcn.10037a80
push str._helicopter_pilot3
mov edx, eax
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x190]
call fcn.10037c00
add esp, 8
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x58]
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x5b4], 0xa5
lea ecx, [ebp - 0x40]
call fcn.10037a80
push str._helicopter_pilot4
mov edx, eax
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x1a8]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x20
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x5b0], 0xa5
lea ecx, [ebp - 0x58]
call fcn.10037a80
push str._helicopter_pilot5
mov edx, eax
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x1c0]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x23
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x5b8], 0xa5
lea ecx, [ebp - 0x40]
call fcn.10037a80
push str._helicopter_pilot6
mov edx, eax
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x1d8]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x26
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x5ac], 0xa5
lea ecx, [ebp - 0x58]
call fcn.10037a80
push str._helicopter_occupants1
mov edx, eax
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x1f0]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x29
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x5a8], 1
lea ecx, [ebp - 0x40]
call fcn.10037a80
push str._helicopter_occupants2
mov edx, eax
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x208]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x2c
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x5a4], 1
lea ecx, [ebp - 0x58]
call fcn.10037a80
push str._helicopter_occupants3
mov edx, eax
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x220]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x2f
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x5a0], 1
lea ecx, [ebp - 0x40]
call fcn.10037a80
push str._helicopter_occupants4
mov edx, eax
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x238]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x32
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x59c], 1
lea ecx, [ebp - 0x58]
call fcn.10037a80
push str._helicopter_occupants5
mov edx, eax
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x130]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x35
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x598], 1
lea ecx, [ebp - 0x40]
call fcn.10037a80
push str._helicopter_occupants6
mov edx, eax
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x118]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x38
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x594], 1
lea ecx, [ebp - 0x58]
call fcn.10037a80
mov byte [ebp - 4], 0x39
push str._max_helicopters
mov edx, eax
lea ecx, [ebp - 0x100]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x3b
call fcn.10037280
cmp dword [0x1006b0b4], 0x10
mov eax, 0x1006b0a0
mov edi, dword [ebp - 0x7a0]
cmovae eax, dword [0x1006b0a0]
mov dword [ebp - 0x5bc], 1
mov dword [ebp - 0x56c], eax
test edi, edi
je 0x10028544
nop
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax]
call eax
mov esi, eax
test esi, esi
je 0x1002853d
cmp dword [ebp - 0x56c], 0
je 0x10028546
mov edx, dword [esi]
mov ecx, esi
mov edx, dword [edx + 0x18]
call edx
test eax, eax
je 0x10028518
xor eax, eax
jmp 0x10028520
lea ecx, [esi + 0xc]
call fcn.10007e00
mov ecx, dword [ebp - 0x56c]
cmp eax, ecx
je 0x10028546
push 0x7fffffff
push ecx
push eax
call fcn.10043530
add esp, 0xc
test eax, eax
je 0x10028546
mov edi, dword [edi + 0x28]
test edi, edi
jne 0x100284f0
xor esi, esi
cmp dword [ebp - 0xbc], 0x10
lea eax, [ebp - 0xd0]
mov esi, dword [esi + 0x1c]
cmovae eax, dword [ebp - 0xd0]
mov dword [ebp - 0x56c], eax
test esi, esi
je 0x100285bb
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax]
call eax
mov edi, eax
test edi, edi
je 0x100285b4
cmp dword [ebp - 0x56c], 0
je 0x100285bd
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x18]
call eax
test eax, eax
je 0x1002858f
xor eax, eax
jmp 0x10028597
lea ecx, [edi + 0xc]
call fcn.10007e00
mov ecx, dword [ebp - 0x56c]
cmp eax, ecx
je 0x100285bd
push 0x7fffffff
push ecx
push eax
call fcn.10043530
add esp, 0xc
test eax, eax
je 0x100285bd
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028567
xor edi, edi
lea eax, [ebp - 0x574]
mov ecx, edi
push eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov eax, 0x1006b0a0
mov esi, dword [ebp - 0x7a0]
cmovae eax, dword [0x1006b0a0]
mov dword [ebp - 0x56c], eax
test esi, esi
je 0x10028644
nop
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax]
call eax
mov edi, eax
test edi, edi
je 0x1002863d
cmp dword [ebp - 0x56c], 0
je 0x10028646
mov edx, dword [edi]
mov ecx, edi
mov edx, dword [edx + 0x18]
call edx
test eax, eax
je 0x10028618
xor eax, eax
jmp 0x10028620
lea ecx, [edi + 0xc]
call fcn.10007e00
mov ecx, dword [ebp - 0x56c]
cmp eax, ecx
je 0x10028646
push 0x7fffffff
push ecx
push eax
call fcn.10043530
add esp, 0xc
test eax, eax
je 0x10028646
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x100285f0
xor edi, edi
cmp dword [ebp - 0xa4], 0x10
lea eax, [ebp - 0xb8]
mov esi, dword [edi + 0x1c]
cmovae eax, dword [ebp - 0xb8]
mov dword [ebp - 0x56c], eax
test esi, esi
je 0x100286bb
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax]
call eax
mov edi, eax
test edi, edi
je 0x100286b4
cmp dword [ebp - 0x56c], 0
je 0x100286bd
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x18]
call eax
test eax, eax
je 0x1002868f
xor eax, eax
jmp 0x10028697
lea ecx, [edi + 0xc]
call fcn.10007e00
mov ecx, dword [ebp - 0x56c]
cmp eax, ecx
je 0x100286bd
push 0x7fffffff
push ecx
push eax
call fcn.10043530
add esp, 0xc
test eax, eax
je 0x100286bd
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028667
xor edi, edi
lea eax, [ebp - 0x578]
mov ecx, edi
push eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov eax, 0x1006b0a0
mov esi, dword [ebp - 0x7a0]
cmovae eax, dword [0x1006b0a0]
mov dword [ebp - 0x56c], eax
test esi, esi
je 0x10028744
nop
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax]
call eax
mov edi, eax
test edi, edi
je 0x1002873d
cmp dword [ebp - 0x56c], 0
je 0x10028746
mov edx, dword [edi]
mov ecx, edi
mov edx, dword [edx + 0x18]
call edx
test eax, eax
je 0x10028718
xor eax, eax
jmp 0x10028720
lea ecx, [edi + 0xc]
call fcn.10007e00
mov ecx, dword [ebp - 0x56c]
cmp eax, ecx
je 0x10028746
push 0x7fffffff
push ecx
push eax
call fcn.10043530
add esp, 0xc
test eax, eax
je 0x10028746
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x100286f0
xor edi, edi
cmp dword [ebp - 0x8c], 0x10
lea eax, [ebp - 0xa0]
mov esi, dword [edi + 0x1c]
cmovae eax, dword [ebp - 0xa0]
mov dword [ebp - 0x56c], eax
test esi, esi
je 0x100287bb
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax]
call eax
mov edi, eax
test edi, edi
je 0x100287b4
cmp dword [ebp - 0x56c], 0
je 0x100287bd
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x18]
call eax
test eax, eax
je 0x1002878f
xor eax, eax
jmp 0x10028797
lea ecx, [edi + 0xc]
call fcn.10007e00
mov ecx, dword [ebp - 0x56c]
cmp eax, ecx
je 0x100287bd
push 0x7fffffff
push ecx
push eax
call fcn.10043530
add esp, 0xc
test eax, eax
je 0x100287bd
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028767
xor edi, edi
lea eax, [ebp - 0x57c]
mov ecx, edi
push eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov eax, 0x1006b0a0
mov esi, dword [ebp - 0x7a0]
cmovae eax, dword [0x1006b0a0]
mov dword [ebp - 0x56c], eax
test esi, esi
je 0x10028844
nop
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax]
call eax
mov edi, eax
test edi, edi
je 0x1002883d
cmp dword [ebp - 0x56c], 0
je 0x10028846
mov edx, dword [edi]
mov ecx, edi
mov edx, dword [edx + 0x18]
call edx
test eax, eax
je 0x10028818
xor eax, eax
jmp 0x10028820
lea ecx, [edi + 0xc]
call fcn.10007e00
mov ecx, dword [ebp - 0x56c]
cmp eax, ecx
je 0x10028846
push 0x7fffffff
push ecx
push eax
call fcn.10043530
add esp, 0xc
test eax, eax
je 0x10028846
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x100287f0
xor edi, edi
cmp dword [ebp - 0x74], 0x10
lea eax, [ebp - 0x88]
mov esi, dword [edi + 0x1c]
cmovae eax, dword [ebp - 0x88]
mov dword [ebp - 0x570], eax
test esi, esi
je 0x1002887d
push eax
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002887f
mov esi, dword [esi + 0x28]
mov eax, dword [ebp - 0x570]
test esi, esi
jne 0x10028864
xor eax, eax
lea ecx, [ebp - 0x580]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x7a0]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x100288c3
nop word [eax + eax]
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x100288c5
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x100288b0
xor eax, eax
cmp dword [ebp - 0xd4], 0x10
lea edi, [ebp - 0xe8]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0xe8]
test esi, esi
je 0x100288f3
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x100288f5
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x100288e0
xor eax, eax
lea ecx, [ebp - 0x584]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x7a0]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x10028933
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028935
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028920
xor eax, eax
cmp dword [ebp - 0x134], 0x10
lea edi, [ebp - 0x148]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x148]
test esi, esi
je 0x10028963
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028965
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028950
xor eax, eax
lea ecx, [ebp - 0x588]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x7a0]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x100289a3
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x100289a5
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028990
xor eax, eax
cmp dword [ebp - 0x14c], 0x10
lea edi, [ebp - 0x160]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x160]
test esi, esi
je 0x100289d3
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x100289d5
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x100289c0
xor eax, eax
lea ecx, [ebp - 0x58c]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x7a0]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x10028a13
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028a15
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028a00
xor eax, eax
cmp dword [ebp - 0x164], 0x10
lea edi, [ebp - 0x178]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x178]
test esi, esi
je 0x10028a43
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028a45
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028a30
xor eax, eax
lea ecx, [ebp - 0x590]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x7a0]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x10028a83
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028a85
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028a70
xor eax, eax
cmp dword [ebp - 0x17c], 0x10
lea edi, [ebp - 0x190]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x190]
test esi, esi
je 0x10028ab3
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028ab5
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028aa0
xor eax, eax
lea ecx, [ebp - 0x5b4]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x7a0]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x10028af3
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028af5
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028ae0
xor eax, eax
cmp dword [ebp - 0x194], 0x10
lea edi, [ebp - 0x1a8]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x1a8]
test esi, esi
je 0x10028b23
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028b25
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028b10
xor eax, eax
lea ecx, [ebp - 0x5b0]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x7a0]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x10028b63
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028b65
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028b50
xor eax, eax
cmp dword [ebp - 0x1ac], 0x10
lea edi, [ebp - 0x1c0]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x1c0]
test esi, esi
je 0x10028b93
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028b95
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028b80
xor eax, eax
lea ecx, [ebp - 0x5b8]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x7a0]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x10028bd3
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028bd5
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028bc0
xor eax, eax
cmp dword [ebp - 0x1c4], 0x10
lea edi, [ebp - 0x1d8]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x1d8]
test esi, esi
je 0x10028c03
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028c05
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028bf0
xor eax, eax
lea ecx, [ebp - 0x5ac]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x7a0]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x10028c43
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028c45
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028c30
xor eax, eax
cmp dword [ebp - 0x1dc], 0x10
lea edi, [ebp - 0x1f0]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x1f0]
test esi, esi
je 0x10028c73
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028c75
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028c60
xor eax, eax
lea ecx, [ebp - 0x5a8]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x7a0]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x10028cb3
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028cb5
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028ca0
xor eax, eax
cmp dword [ebp - 0x1f4], 0x10
lea edi, [ebp - 0x208]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x208]
test esi, esi
je 0x10028ce3
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028ce5
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028cd0
xor eax, eax
lea ecx, [ebp - 0x5a4]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x7a0]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x10028d23
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028d25
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028d10
xor eax, eax
cmp dword [ebp - 0x20c], 0x10
lea edi, [ebp - 0x220]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x220]
test esi, esi
je 0x10028d53
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028d55
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028d40
xor eax, eax
lea ecx, [ebp - 0x5a0]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x7a0]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x10028d93
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028d95
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028d80
xor eax, eax
cmp dword [ebp - 0x224], 0x10
lea edi, [ebp - 0x238]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x238]
test esi, esi
je 0x10028dc3
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028dc5
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028db0
xor eax, eax
lea ecx, [ebp - 0x59c]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x7a0]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x10028e03
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028e05
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028df0
xor eax, eax
cmp dword [ebp - 0x11c], 0x10
lea edi, [ebp - 0x130]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x130]
test esi, esi
je 0x10028e33
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028e35
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028e20
xor eax, eax
lea ecx, [ebp - 0x598]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x7a0]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x10028e73
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028e75
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028e60
xor eax, eax
cmp dword [ebp - 0x104], 0x10
lea edi, [ebp - 0x118]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x118]
test esi, esi
je 0x10028ea3
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028ea5
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028e90
xor eax, eax
lea ecx, [ebp - 0x594]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x7a0]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x10028ee3
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028ee5
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028ed0
xor eax, eax
cmp dword [ebp - 0xec], 0x10
lea edi, [ebp - 0x100]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x100]
test esi, esi
je 0x10028f13
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x10028f15
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x10028f00
xor eax, eax
lea ecx, [ebp - 0x5bc]
push ecx
mov ecx, eax
call fcn.10009370
mov edx, dword [ebp - 0x574]
lea ecx, [ebp - 0x40]
sub edx, 0x190
mov dword [ebp - 0x574], edx
call fcn.1000c860
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x58]
mov edx, dword [ebp - 0x578]
sub edx, 0x190
mov dword [ebp - 0x578], edx
call fcn.1000c860
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x268]
mov edx, dword [ebp - 0x57c]
sub edx, 0x190
mov dword [ebp - 0x57c], edx
call fcn.1000c860
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x280]
mov edx, dword [ebp - 0x580]
sub edx, 0x190
mov dword [ebp - 0x580], edx
call fcn.1000c860
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x298]
mov edx, dword [ebp - 0x584]
sub edx, 0x190
mov dword [ebp - 0x584], edx
call fcn.1000c860
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x2b0]
mov edx, dword [ebp - 0x588]
sub edx, 0x190
mov dword [ebp - 0x588], edx
call fcn.1000c860
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x2c8]
mov edx, dword [ebp - 0x58c]
call fcn.1000c860
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x2e0]
mov edx, dword [ebp - 0x590]
call fcn.1000c860
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x2f8]
mov edx, dword [ebp - 0x5b4]
call fcn.1000c860
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x3a0]
mov edx, dword [ebp - 0x5b0]
call fcn.1000c860
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x310]
mov edx, dword [ebp - 0x5b8]
call fcn.1000c860
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x328]
mov edx, dword [ebp - 0x5ac]
call fcn.1000c860
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x340]
mov edx, dword [ebp - 0x5a8]
call fcn.1000c860
mov byte [ebp - 4], 0x48
mov edx, dword [ebp - 0x5a4]
lea ecx, [ebp - 0x358]
call fcn.1000c860
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x370]
mov edx, dword [ebp - 0x5a0]
call fcn.1000c860
mov byte [ebp - 4], 0x4a
lea ecx, [ebp - 0x388]
mov edx, dword [ebp - 0x59c]
call fcn.1000c860
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x598]
call fcn.1000c860
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x70]
mov edx, dword [ebp - 0x594]
call fcn.1000c860
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x250]
mov edx, dword [ebp - 0x5bc]
call fcn.1000c860
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x4e
push eax
mov edx, 0x100637f4
lea ecx, [ebp - 0x4a8]
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0xd0]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x4a8]
call fcn.10037280
cmp dword [ebp - 0xbc], 0x10
lea eax, [ebp - 0xd0]
mov edx, 0x100637f4
lea ecx, [ebp - 0x4c0]
cmovae eax, dword [ebp - 0xd0]
mov dword [ebp - 0x5e8], eax
lea eax, [ebp - 0x58]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0xb8]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x4c0]
call fcn.10037280
cmp dword [ebp - 0xa4], 0x10
lea eax, [ebp - 0xb8]
mov edx, 0x100637f4
lea ecx, [ebp - 0x4d8]
cmovae eax, dword [ebp - 0xb8]
mov dword [ebp - 0x5ec], eax
lea eax, [ebp - 0x268]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0xa0]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x4d8]
call fcn.10037280
cmp dword [ebp - 0x8c], 0x10
lea eax, [ebp - 0xa0]
mov edx, 0x100637f4
lea ecx, [ebp - 0x4f0]
cmovae eax, dword [ebp - 0xa0]
mov dword [ebp - 0x5f0], eax
lea eax, [ebp - 0x280]
push eax
call fcn.10037c50
add esp, 4
push eax
lea ecx, [ebp - 0x88]
call fcn.100372d0
lea ecx, [ebp - 0x4f0]
call fcn.10037280
cmp dword [ebp - 0x74], 0x10
lea eax, [ebp - 0x88]
mov edx, 0x100637f4
lea ecx, [ebp - 0x508]
cmovae eax, dword [ebp - 0x88]
mov dword [ebp - 0x5f4], eax
lea eax, [ebp - 0x298]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0xe8]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x508]
call fcn.10037280
cmp dword [ebp - 0xd4], 0x10
lea eax, [ebp - 0xe8]
mov edx, 0x100637f4
lea ecx, [ebp - 0x520]
cmovae eax, dword [ebp - 0xe8]
mov dword [ebp - 0x56c], eax
lea eax, [ebp - 0x2b0]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x148]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x520]
call fcn.10037280
cmp dword [ebp - 0x134], 0x10
lea eax, [ebp - 0x148]
mov edx, 0x100637f8
lea ecx, [ebp - 0x538]
cmovae eax, dword [ebp - 0x148]
mov dword [ebp - 0x570], eax
lea eax, [ebp - 0x2c8]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x160]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x538]
call fcn.10037280
cmp dword [ebp - 0x14c], 0x10
lea eax, [ebp - 0x160]
mov edx, 0x100637f8
lea ecx, [ebp - 0x550]
cmovae eax, dword [ebp - 0x160]
mov dword [ebp - 0x5c8], eax
lea eax, [ebp - 0x2e0]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x178]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x550]
call fcn.10037280
cmp dword [ebp - 0x164], 0x10
lea eax, [ebp - 0x178]
mov edx, 0x100637f8
lea ecx, [ebp - 0x490]
cmovae eax, dword [ebp - 0x178]
mov dword [ebp - 0x5cc], eax
lea eax, [ebp - 0x2f8]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x190]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x490]
call fcn.10037280
lea eax, [ebp - 0x190]
cmp dword [ebp - 0x17c], 0x10
lea ecx, [ebp - 0x568]
mov edx, 0x100637f8
cmovae eax, dword [ebp - 0x190]
mov dword [ebp - 0x5d0], eax
lea eax, [ebp - 0x3a0]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x1a8]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x568]
call fcn.10037280
cmp dword [ebp - 0x194], 0x10
lea eax, [ebp - 0x1a8]
mov edx, 0x100637f8
lea ecx, [ebp - 0x3b8]
cmovae eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x5d8], eax
lea eax, [ebp - 0x310]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x1c0]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x3b8]
call fcn.10037280
cmp dword [ebp - 0x1ac], 0x10
lea eax, [ebp - 0x1c0]
mov edx, 0x100637f8
lea ecx, [ebp - 0x3d0]
cmovae eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x5dc], eax
lea eax, [ebp - 0x328]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x1d8]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x3d0]
call fcn.10037280
cmp dword [ebp - 0x1c4], 0x10
lea eax, [ebp - 0x1d8]
mov edx, 0x10064f08
lea ecx, [ebp - 0x3e8]
cmovae eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x5e4], eax
lea eax, [ebp - 0x340]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x1f0]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x3e8]
call fcn.10037280
cmp dword [ebp - 0x1dc], 0x10
lea eax, [ebp - 0x1f0]
mov edx, 0x10064f08
lea ecx, [ebp - 0x400]
cmovae eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x5e0], eax
lea eax, [ebp - 0x358]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x208]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x400]
call fcn.10037280
cmp dword [ebp - 0x1f4], 0x10
lea eax, [ebp - 0x208]
mov edx, 0x10064f08
cmovae eax, dword [ebp - 0x208]
mov dword [ebp - 0x5d4], eax
lea eax, [ebp - 0x370]
push eax
lea ecx, [ebp - 0x418]
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x220]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x418]
call fcn.10037280
cmp dword [ebp - 0x20c], 0x10
lea eax, [ebp - 0x220]
mov edx, 0x10064f08
lea ecx, [ebp - 0x430]
cmovae eax, dword [ebp - 0x220]
mov dword [ebp - 0x5f8], eax
lea eax, [ebp - 0x388]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x238]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x430]
call fcn.10037280
cmp dword [ebp - 0x224], 0x10
lea eax, [ebp - 0x238]
mov edx, 0x10064f08
lea ecx, [ebp - 0x448]
cmovae eax, dword [ebp - 0x238]
mov dword [ebp - 0x5fc], eax
lea eax, [ebp - 0x28]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x130]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x448]
call fcn.10037280
cmp dword [ebp - 0x11c], 0x10
lea eax, [ebp - 0x130]
mov edx, 0x10064f08
lea ecx, [ebp - 0x460]
cmovae eax, dword [ebp - 0x130]
mov dword [ebp - 0x5c0], eax
lea eax, [ebp - 0x70]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x118]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x460]
call fcn.10037280
cmp dword [ebp - 0x104], 0x10
lea eax, [ebp - 0x118]
mov edx, 0x10064c4c
lea ecx, [ebp - 0x478]
cmovae eax, dword [ebp - 0x118]
mov dword [ebp - 0x5c4], eax
lea eax, [ebp - 0x250]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x100]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x478]
call fcn.10037280
cmp dword [ebp - 0xec], 0x10
lea edi, [ebp - 0x100]
mov ecx, 0xc9bee4
cmovae edi, dword [ebp - 0x100]
call fcn.1003b890
mov ecx, 0xc9bee8
mov word [0x1023ca64], ax
call fcn.1003b890
mov ax, word [0x1023ca64]
mov ecx, 0xc9bee4
shr ax, 1
mov word [0x1009c908], ax
call fcn.1003b890
mov ecx, 0xc9bee8
mov word [0x1023ca64], ax
call fcn.1003b890
movzx esi, word [0x1023ca64]
mov eax, 0x66666667
mov ecx, esi
shr ecx, 1
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov word [0x1009c908], ax
mov eax, 0xcccccccd
mul esi
mov esi, 0x582050
shr edx, 2
movzx eax, dx
push eax
movzx eax, byte [0x100ec940]
push 0
push eax
mov word [0x1017ca00], dx
call esi
movzx eax, word [0x1017ca00]
push eax
movzx eax, byte [0x100ec940]
push 1
push eax
call esi
movzx eax, word [0x1017ca00]
push eax
movzx eax, byte [0x100ec940]
push 2
push eax
call esi
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
movzx eax, byte [0x100ec940]
mov esi, 0x581e00
push str.DUMMY
push dword [ebp - 0x570]
push dword [ebp - 0x56c]
push dword [ebp - 0x5f4]
push dword [ebp - 0x5f0]
push dword [ebp - 0x5ec]
push dword [ebp - 0x5e8]
push str.HELI
push 0
push eax
call esi
add esp, 0x60
movzx eax, byte [0x100ec940]
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.HMAX
push dword [ebp - 0x5e4]
push dword [ebp - 0x5dc]
push dword [ebp - 0x5d8]
push dword [ebp - 0x5d0]
push dword [ebp - 0x5cc]
push dword [ebp - 0x5c8]
push str.PILOT
push 1
push eax
call esi
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
push edi
push dword [ebp - 0x5c4]
push dword [ebp - 0x5c0]
push dword [ebp - 0x5fc]
push dword [ebp - 0x5f8]
movzx eax, byte [0x100ec940]
push dword [ebp - 0x5d4]
push dword [ebp - 0x5e0]
push 0x10064f08
push 2
push eax
call esi
mov eax, dword [0xb7cb84]
lea ecx, [ebp - 0x250]
add esp, 0x78
mov dword [0x1025b6c8], eax
mov byte [0x1006c842], 0xff
call fcn.10037280
lea ecx, [ebp - 0x70]
call fcn.10037280
lea ecx, [ebp - 0x28]
call fcn.10037280
lea ecx, [ebp - 0x388]
call fcn.10037280
lea ecx, [ebp - 0x370]
call fcn.10037280
lea ecx, [ebp - 0x358]
call fcn.10037280
lea ecx, [ebp - 0x340]
call fcn.10037280
lea ecx, [ebp - 0x328]
call fcn.10037280
lea ecx, [ebp - 0x310]
call fcn.10037280
lea ecx, [ebp - 0x3a0]
call fcn.10037280
lea ecx, [ebp - 0x2f8]
call fcn.10037280
lea ecx, [ebp - 0x2e0]
call fcn.10037280
lea ecx, [ebp - 0x2c8]
call fcn.10037280
lea ecx, [ebp - 0x2b0]
call fcn.10037280
lea ecx, [ebp - 0x298]
call fcn.10037280
lea ecx, [ebp - 0x280]
call fcn.10037280
lea ecx, [ebp - 0x268]
call fcn.10037280
lea ecx, [ebp - 0x58]
call fcn.10037280
lea ecx, [ebp - 0x40]
call fcn.10037280
lea ecx, [ebp - 0x100]
call fcn.10037280
lea ecx, [ebp - 0x118]
call fcn.10037280
lea ecx, [ebp - 0x130]
call fcn.10037280
lea ecx, [ebp - 0x238]
call fcn.10037280
lea ecx, [ebp - 0x220]
call fcn.10037280
lea ecx, [ebp - 0x208]
call fcn.10037280
lea ecx, [ebp - 0x1f0]
call fcn.10037280
lea ecx, [ebp - 0x1d8]
call fcn.10037280
lea ecx, [ebp - 0x1c0]
call fcn.10037280
lea ecx, [ebp - 0x1a8]
call fcn.10037280
lea ecx, [ebp - 0x190]
call fcn.10037280
lea ecx, [ebp - 0x178]
call fcn.10037280
lea ecx, [ebp - 0x160]
call fcn.10037280
lea ecx, [ebp - 0x148]
call fcn.10037280
lea ecx, [ebp - 0xe8]
call fcn.10037280
lea ecx, [ebp - 0x88]
call fcn.10037280
lea ecx, [ebp - 0xa0]
call fcn.10037280
lea ecx, [ebp - 0xb8]
call fcn.10037280
lea ecx, [ebp - 0xd0]
call fcn.10037280
lea ecx, [ebp - 0x7bc]
call fcn.10009d40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003bfa7
mov esp, ebp
pop ebp
ret
call fcn.1004910a
call fcn.1004910a
call fcn.1004910a
call fcn.1004910a
call fcn.1004910a
call fcn.1004910a
call fcn.1004910a
int3