Function at 0x1000ce4e
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100655c1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc28
push esi
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x100128f1
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x794], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x78c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x800], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x7f8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x7f0], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x810], eax
mov eax, dword [ebp - 0x810]
movzx eax, byte [eax]
test eax, eax
je 0x1000cf33
mov eax, dword [ebp - 0x78c]
mov dword [ebp - 0x79c], eax
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebp - 0x79c]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x7a4]
mov dword [ebp - 0x7e8], eax
mov eax, dword [ebp - 0x118]
mov dword [eax], 0
jmp 0x1000cf0b
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x118]
mov dword [ecx], eax
mov eax, dword [ebp - 0x118]
cmp dword [eax], 1
jge 0x1000cf2e
mov eax, dword [ebp - 0x118]
push dword [eax]
mov ecx, dword [ebp - 0x7e8]
call fcn.10028a8b
and dword [eax], 0
jmp 0x1000cefa
jmp 0x100128ef
mov eax, dword [ebp - 0x7f0]
mov dword [ebp - 0x754], eax
mov eax, dword [ebp - 0x7f8]
mov dword [ebp - 0x714], eax
mov eax, dword [ebp - 0x800]
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x808], 0x1b76
cmp dword [ebp - 0x808], 0xec5
jge 0x1000d159
lea eax, [ebp - 0x6b8]
push eax
lea eax, [ebp - 0xbc]
push eax
push 0x10007ad4
call fcn.1004d62b
add esp, 0xc
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x848]
call fcn.10028987
and dword [ebp - 4], 0
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x838]
call fcn.10028987
mov byte [ebp - 4], 1
and dword [ebp - 0x1c4], 0
jmp 0x1000cfcc
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x1c4]
cmp eax, dword [ebp - 0xbc]
jge 0x1000cffa
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0x848]
call fcn.10028a8b
push eax
push 0x10007ad0
call fcn.1004d62b
pop ecx
pop ecx
jmp 0x1000cfbf
and dword [ebp - 0x128], 0
jmp 0x1000d010
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0xbc]
jge 0x1000d03e
push dword [ebp - 0x128]
lea ecx, [ebp - 0x838]
call fcn.10028a8b
push eax
push 0x10007ad0
call fcn.1004d62b
pop ecx
pop ecx
jmp 0x1000d003
lea eax, [ebp - 0xa44]
push eax
lea ecx, [ebp - 0x848]
call fcn.10028a73
push dword [eax]
lea eax, [ebp - 0xa84]
push eax
lea ecx, [ebp - 0x848]
call fcn.10028a65
push dword [eax]
call fcn.1002c9f6
pop ecx
pop ecx
lea eax, [ebp - 0xa70]
push eax
lea ecx, [ebp - 0x838]
call fcn.10028a73
push dword [eax]
lea eax, [ebp - 0xa88]
push eax
lea ecx, [ebp - 0x838]
call fcn.10028a65
push dword [eax]
call fcn.1002c9f6
pop ecx
pop ecx
and dword [ebp - 0x1f8], 0
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0x1c0], eax
jmp 0x1000d0c6
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0xbc]
jge 0x1000d129
cmp dword [ebp - 0x1c0], 0
jl 0x1000d129
push dword [ebp - 0x138]
lea ecx, [ebp - 0x848]
call fcn.10028a8b
mov esi, eax
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0x838]
call fcn.10028a8b
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0x6b8]
jl 0x1000d127
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
jmp 0x1000d0b9
push dword [ebp - 0x1f8]
push 0x10007b4c
call fcn.1004dfbc
pop ecx
pop ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x838]
call fcn.10028a60
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x848]
call fcn.10028a60
push 1
lea ecx, [ebp - 0xae0]
call fcn.10028987
mov dword [ebp - 4], 2
mov dword [ebp - 0x140], 0
jmp 0x1000d186
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 1
jge 0x1000d1a5
push dword [ebp - 0x140]
lea ecx, [ebp - 0xae0]
call fcn.10028a8b
or dword [eax], 0xffffffff
jmp 0x1000d179
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x1000d1de
push 1
push 0
push 0
push 0x4a2d
push 0x2acf
push 0x266c
push 0x5fad
push 0xe8c
call fcn.1002229a
add esp, 0x20
mov byte [ebp - 0x93], 0
movzx eax, byte [ebp - 0x93]
test eax, eax
je 0x1000d1f8
push 0
call fcn.10023b73
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xae0]
call fcn.10028a60
mov dword [ebp - 0x388], 1
mov dword [ebp - 0x634], 0xfffffff9
mov dword [ebp - 0x48], 0
jmp 0x1000d22b
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x1000d241
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x928], 0
jmp 0x1000d224
mov dword [ebp - 0x48], 0
jmp 0x1000d251
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x1000d267
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0xbcc], 1
jmp 0x1000d24a
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x928]
mov dword [ebp - 0xa8c], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x928]
mov dword [ebp - 0x388], eax
mov eax, 0x12e
test eax, eax
je 0x1000d2a4
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x928], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x928]
cmp dword [ebp - 0x388], eax
jl 0x1000d2c5
mov dword [ebp - 0x5f8], 1
jmp 0x1000d2cc
and dword [ebp - 0x5f8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x928]
add eax, dword [ebp - 0x5f8]
cmp eax, 1
jge 0x1000d2f0
mov dword [ebp - 0x62c], 1
jmp 0x1000d2f7
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0x634], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x634]
mov dword [ebp + eax - 0xbcc], ecx
mov dword [ebp - 0x98], 0x5c96dd1e
mov dword [ebp - 0x210], 0
mov dword [ebp - 0x674], 0xa36a77d7
mov dword [ebp - 0x820], 0xfffc
cmp dword [ebp - 0x98], 0
je 0x1000d53b
push 2
lea ecx, [ebp - 0x858]
call fcn.10028987
mov dword [ebp - 4], 3
mov dword [ebp - 0x880], 0xffffffff
mov dword [ebp - 0x198], 0
jmp 0x1000d382
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 2
jge 0x1000d3a1
push dword [ebp - 0x198]
lea ecx, [ebp - 0x858]
call fcn.10028a8b
or dword [eax], 0xffffffff
jmp 0x1000d375
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x1000d3cc
push 0x7eba
push 0x3818
push 0
push 0x7e37
call fcn.100215c9
add esp, 0x10
mov dword [ebp - 0x98], 0x17
jmp 0x1000d3e5
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x10
jge 0x1000d527
mov dword [ebp - 0x828], 0xfffffffd
push 1
lea ecx, [ebp - 0x858]
call fcn.10028a8b
cmp dword [eax], 0
je 0x1000d43a
push 0x3ce0
push 0
push 0x1e06
push 0
push 0x5ad6
push 0x81f
push 0x1d53
push 0x7748
call fcn.1000b6e9
add esp, 0x20
jmp 0x1000d44a
lea eax, [ebp - 0x210]
push eax
push 0
call fcn.10012cfb
pop ecx
pop ecx
mov eax, 0xb541
cmp eax, 9
jge 0x1000d460
mov dword [ebp - 0x63c], 1
jmp 0x1000d467
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x63c]
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x210]
cmp dword [ebp - 0x674], eax
jne 0x1000d48d
mov dword [ebp - 0x818], 1
jmp 0x1000d494
and dword [ebp - 0x818], 0
push 1
lea ecx, [ebp - 0x858]
call fcn.10028a8b
mov eax, dword [ebp - 0x820]
cmp dword [ebp - 0x98], eax
jle 0x1000d4bf
push 3
pop eax
test eax, eax
jne 0x1000d4bf
and dword [ebp - 0x5f0], 0
jmp 0x1000d4c9
mov dword [ebp - 0x5f0], 1
imul eax, dword [ebp - 0x5f0], 0x4938
cmp eax, dword [ebp - 0x828]
jge 0x1000d4e7
mov dword [ebp - 0x5f4], 1
jmp 0x1000d4ee
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x5f4]
imul eax, dword [ebp - 0x98]
mov dword [ebp - 0x2cc], eax
push 1
lea ecx, [ebp - 0x858]
call fcn.10028a8b
mov ecx, dword [ebp - 0x2cc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x880], eax
jmp 0x1000d3d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x858]
call fcn.10028a60
jmp 0x1000d6e1
mov dword [ebp - 0x888], 0x237d
cmp dword [ebp - 0x888], 0x607
jge 0x1000d6b3
mov dword [ebp - 0x288], 1
xor eax, eax
inc eax
je 0x1000d6b3
push 0x10f4b414
push 0x10689578
push 0x11071014
push 0x10689784
push 0x10007b54
call fcn.1004d62b
add esp, 0x14
cmp dword [0x10689578], 0
jne 0x1000d597
jmp 0x1000d6b3
mov eax, dword [0x10f4b414]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
and dword [ebp - 0xa0], 0
lea eax, [ebp - 0x40]
push eax
call fcn.1000ce2c
pop ecx
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x14]
push eax
call fcn.1000ce2c
pop ecx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call fcn.1000ce2c
pop ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x14]
jne 0x1000d5ac
mov eax, dword [0x10f4b414]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
and dword [ebp - 0x1fc], 0
jmp 0x1000d60c
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x1fc]
cmp eax, dword [ebp - 0xa0]
jge 0x1000d629
lea eax, [ebp - 0x14]
push eax
call fcn.1000ce2c
pop ecx
mov dword [ebp - 0x14], eax
jmp 0x1000d5ff
and dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x14]
je 0x1000d654
lea eax, [ebp - 0x40]
push eax
call fcn.1000ce2c
pop ecx
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x14]
push eax
call fcn.1000ce2c
pop ecx
mov dword [ebp - 0x14], eax
jmp 0x1000d630
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call fcn.1000ce2c
pop ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x40]
jne 0x1000d65a
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0x890], eax
push dword [ebp - 0xa0]
push dword [ebp - 0x890]
push 0x10007b60
call fcn.1004dfbc
add esp, 0xc
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
jmp 0x1000d55f
mov dword [ebp - 0x784], 0xe520c3d8
lea eax, [ebp - 0x784]
push eax
push 1
push 0x1cb0
push 0xc84
lea eax, [ebp - 0x210]
push eax
push 0
call fcn.10009b28
add esp, 0x18
mov dword [ebp - 0x20], 0xb3ae3556
mov dword [ebp - 0xe8], 0xa3062a4b
mov dword [ebp - 0x1c], 0xae4c
mov dword [ebp - 0x218], 0x457023
mov dword [ebp - 0x584], 0xffffffff
mov dword [ebp - 0x58c], 0x1cc545e2
mov dword [ebp - 0x2f4], 0x46aa1dd
mov dword [ebp - 0x148], 0
jmp 0x1000d73a
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 4
jge 0x1000d756
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0xb7c], 0x3b00
jmp 0x1000d72d
mov dword [ebp - 0x20], 9
jmp 0x1000d766
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffea
jl 0x1000d8ea
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x1000d797
push 0x4572
push 0
push 0x19e
push 0x1771
push 1
call fcn.10009a5c
add esp, 0x14
mov dword [ebp - 0x70c], 0x2663
cmp dword [ebp - 0x70c], 0xbc1
jge 0x1000d8c5
lea eax, [ebp - 0x1d8]
push eax
lea eax, [ebp - 0x7a8]
push eax
push 0x10007ad4
call fcn.1004d62b
add esp, 0xc
and dword [ebp - 0x6c8], 0
lea eax, [ebp - 0x6c8]
push eax
push dword [ebp - 0x1d8]
lea ecx, [ebp - 0x97c]
call fcn.100289c3
mov dword [ebp - 4], 4
and dword [ebp - 0x124], 0
and dword [ebp - 0x250], 0
jmp 0x1000d80f
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x250]
cmp eax, dword [ebp - 0x7a8]
jge 0x1000d8b6
lea eax, [ebp - 0x6d0]
push eax
push 0x10007ad0
call fcn.1004d62b
pop ecx
pop ecx
mov eax, dword [ebp - 0x6d0]
cdq
idiv dword [ebp - 0x1d8]
push edx
lea ecx, [ebp - 0x97c]
call fcn.10028a8b
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x49c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x49c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x124]
cdq
idiv dword [ebp - 0x1d8]
push edx
lea ecx, [ebp - 0x97c]
call fcn.10028a8b
mov ecx, eax
mov eax, dword [ebp - 0x124]
cdq
idiv dword [ebp - 0x1d8]
cmp dword [ecx], eax
jle 0x1000d89f
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
jmp 0x1000d864
push dword [ebp - 0x124]
push 0x10007adc
call fcn.1004dfbc
pop ecx
pop ecx
jmp 0x1000d802
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x97c]
call fcn.10028a60
mov byte [ebp - 0xb4], 0
movzx eax, byte [ebp - 0xb4]
test eax, eax
je 0x1000d8e5
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
jmp 0x1000d75f
cmp dword [ebp - 0x20], 0
jne 0x1000d936
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xb28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xa94], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0xe8], eax
je 0x1000d91c
mov dword [ebp - 0x2d4], 1
jmp 0x1000d923
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
imul eax, dword [ebp - 0xe8], 0x3fde
mov dword [ebp - 0x584], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x584]
je 0x1000d955
cmp dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x58c]
jle 0x1000d96f
mov dword [ebp - 0x2dc], 1
jmp 0x1000d976
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x2dc], eax
je 0x1000d98d
mov dword [ebp - 0x4a4], 1
jmp 0x1000d994
and dword [ebp - 0x4a4], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x4a4]
cmp dword [ebp - 0x20], eax
je 0x1000d9ae
mov dword [ebp - 0x2e4], 1
jmp 0x1000d9b5
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x2e4], eax
jle 0x1000d9cc
mov dword [ebp - 0x7e0], 1
jmp 0x1000d9d3
and dword [ebp - 0x7e0], 0
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xb30], eax
cmp dword [ebp - 0x218], 0
je 0x1000d9fa
cmp dword [ebp - 0x20], 0
je 0x1000d9fa
mov dword [ebp - 0x614], 1
jmp 0x1000da01
and dword [ebp - 0x614], 0
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x1000da21
or eax, 0xffffffff
je 0x1000da21
mov dword [ebp - 0x2ec], 1
jmp 0x1000da28
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x2ec], eax
jne 0x1000da3f
mov dword [ebp - 0x4ac], 1
jmp 0x1000da46
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 0x54f86fc3
jl 0x1000da6a
mov dword [ebp - 0x2fc], 1
jmp 0x1000da71
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x58c]
imul eax, dword [ebp - 0x2fc]
cmp eax, dword [ebp - 0xe8]
jl 0x1000db41
mov byte [ebp - 0xb6], 0
movzx eax, byte [ebp - 0xb6]
test eax, eax
je 0x1000dab9
push 0xb8
push 0
push 0x745e
push 1
push 0
push 0x5426
call fcn.10024b33
add esp, 0x18
mov dword [ebp - 0x1c], 0
jmp 0x1000dac9
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x1000db3c
push 3
lea ecx, [ebp - 0x988]
call fcn.10028987
mov dword [ebp - 4], 5
mov dword [ebp - 0x150], 0
jmp 0x1000dafc
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jge 0x1000db1b
push dword [ebp - 0x150]
lea ecx, [ebp - 0x988]
call fcn.10028a8b
or dword [eax], 0xffffffff
jmp 0x1000daef
push 0
lea eax, [ebp - 0x988]
push eax
call fcn.10014d99
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x988]
call fcn.10028a60
jmp 0x1000dac2
jmp 0x1000dbf9
mov dword [ebp - 0x1c], 0
jmp 0x1000db51
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jg 0x1000dbf9
mov dword [ebp - 0x270], 1
mov dword [ebp - 0x6e0], 0xe8e103ca
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xb7c]
mov dword [ebp - 0x6d8], eax
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x270]
add ecx, dword [ebp + eax*4 - 0xb7c]
mov dword [ebp - 0x814], ecx
mov eax, dword [ebp - 0x270]
dec eax
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x6d8]
cmp eax, dword [ebp - 0x814]
je 0x1000dbbc
mov dword [ebp - 0x4b4], 1
jmp 0x1000dbc3
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xb7c]
cmp eax, dword [ebp - 0x4b4]
jl 0x1000dbe1
mov dword [ebp - 0x304], 1
jmp 0x1000dbe8
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x6e0], eax
jmp 0x1000db4a
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x4ec], 0xa964a90c
push 0
call fcn.10013f4f
pop ecx
mov dword [ebp - 0x6e8], 0
mov dword [ebp - 0x7c4], 0xfffffff9
mov dword [ebp - 0x87c], 0xffffffff
push 4
lea ecx, [ebp - 0x9a0]
call fcn.10028987
mov dword [ebp - 4], 6
lea eax, [ebp - 0x9a0]
push eax
push 0x7a95
push 0x471d
push 0x194e
push 0x68f6
push 1
push 0
push 1
push 0xa7
lea eax, [ebp - 0xa9c]
push eax
push 0x3a80
push 0x30f1
call fcn.1002452b
add esp, 0x30
mov byte [ebp - 0x8a], 0
movzx eax, byte [ebp - 0x8a]
test eax, eax
je 0x1000dca3
push 0x282
call dword [sym.imp.USER32.dll_IsWindow]
lea eax, [ebp - 0x7c4]
push eax
push 0x8fe
lea eax, [ebp - 0x6e8]
push eax
push 0x7b73
push 0xd59
push 1
lea eax, [ebp - 0x9a0]
push eax
lea eax, [ebp - 0x87c]
push eax
push 0
call fcn.1000a886
add esp, 0x24
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9a0]
call fcn.10028a60
mov dword [ebp - 0x1a0], 0
jmp 0x1000dd02
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 1
jge 0x1000dd1b
mov eax, dword [ebp - 0x1a0]
mov dword [ebp + eax*4 - 0x5c], 0xfffffff7
jmp 0x1000dcf5
mov dword [ebp - 0x6f0], 0
push 3
lea ecx, [ebp - 0x9b8]
call fcn.10028987
mov dword [ebp - 4], 7
mov dword [ebp - 0x7cc], 0xffff
push 0x4a7b
lea eax, [ebp - 0x9b8]
push eax
push 0
lea eax, [ebp - 0xba0]
push eax
call fcn.1002499a
add esp, 0x10
push 0
lea eax, [ebp - 0x6f0]
push eax
push 1
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x9b8]
push eax
push 0x3929
call fcn.1000abf2
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9b8]
call fcn.10028a60
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x5c], 5
jmp 0x1000ddba
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x5c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5c], 0xfffffff2
jle 0x1000e87e
mov dword [ebp - 0x68], 0x643cdf98
mov dword [ebp - 0xaa4], 0xfffffffa
mov dword [ebp - 0x708], 0xe63e3155
mov dword [ebp - 0x6f8], 0x21bd
cmp dword [ebp - 0x6f8], 0x96e
jge 0x1000de55
lea eax, [ebp - 0xb34]
push eax
lea eax, [ebp - 0xaac]
push eax
lea eax, [ebp - 0x700]
push eax
lea eax, [ebp - 0x81c]
push eax
push 0x10007b70
call fcn.1004d62b
add esp, 0x14
mov eax, dword [ebp - 0x81c]
cmp eax, dword [ebp - 0x700]
jle 0x1000de3f
mov dword [ebp - 0x5fc], 0x10007b80
jmp 0x1000de49
mov dword [ebp - 0x5fc], 0x10007b88
push dword [ebp - 0x5fc]
call fcn.1004e532
pop ecx
mov dword [ebp - 0x31c], 0x2a149cec
mov dword [ebp - 0x7d4], 0xffffffff
push 4
lea ecx, [ebp - 0xa00]
call fcn.10028987
mov dword [ebp - 4], 8
push 3
lea ecx, [ebp - 0x9e8]
call fcn.10028987
mov byte [ebp - 4], 9
mov dword [ebp - 0x4cc], 0xfffffffb
mov dword [ebp - 0xb64], 0xeb7f464f
mov dword [ebp - 0xab4], 0xe262
push 4
lea ecx, [ebp - 0x9d0]
call fcn.10028987
mov byte [ebp - 4], 0xa
mov dword [ebp - 0xb3c], 0x74484a86
mov dword [ebp - 0x70], 0
jmp 0x1000ded7
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 4
jge 0x1000deed
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xb90], 0xb4e1
jmp 0x1000ded0
lea eax, [ebp - 0x70]
push eax
push 1
push 1
push 0
lea eax, [ebp - 0xa00]
push eax
call fcn.10012a15
add esp, 0x14
push 0
push 0x7734
push 1
push 0x2dc2
lea eax, [ebp - 0x9e8]
push eax
push 0
push 0x49b6
push 0x1743
push 0x7ba2
lea eax, [ebp - 0x70]
push eax
call fcn.1000c0b2
add esp, 0x28
push 0x499b
lea eax, [ebp - 0x9d0]
push eax
push 0x4834
lea eax, [ebp - 0x70]
push eax
push 0x157c
push 0x6bc6
push 1
push 1
push 0x7b98
push 0x23c7
push 0x3338
push 0
push 0x5da7
call fcn.1000c2be
add esp, 0x34
mov byte [ebp - 0xb3], 0
movzx eax, byte [ebp - 0xb3]
test eax, eax
je 0x1000dfa6
push 0x3d50
push 0x124a
push 0x764e
push 0
push 0
call fcn.1002377b
add esp, 0x14
mov dword [ebp - 0x68], 0
jmp 0x1000dfb6
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jg 0x1000e2a0
push 3
lea ecx, [ebp - 0x8d0]
call fcn.10028987
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x4bc], 0x87a7525d
mov dword [ebp - 0x334], 3
mov dword [ebp - 0x85c], 0xb4ff5102
push 0x1c95
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x8d0]
push eax
push 0x359f
push 1
push 0x4e4
push 0x7a75
push 0
call fcn.10024332
add esp, 0x20
mov dword [ebp - 0x108], 0
jmp 0x1000e036
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 2
jge 0x1000e052
mov eax, dword [ebp - 0x108]
mov dword [ebp + eax*4 - 0xa7c], 0xfffffffb
jmp 0x1000e029
push 2
lea ecx, [ebp - 0xa00]
call fcn.10028a8b
mov dword [eax], 0xfa0b
push 1
lea ecx, [ebp - 0x8d0]
call fcn.10028a8b
mov eax, dword [eax]
add eax, 0xfa0b
mov ecx, dword [ebp - 0x68]
imul ecx, eax
cmp ecx, 0xfffffffc
je 0x1000e090
mov dword [ebp - 0x30c], 1
jmp 0x1000e097
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x4bc], eax
mov eax, dword [ebp - 0x4bc]
cmp dword [ebp - 0x7d4], eax
jg 0x1000e0bd
mov dword [ebp - 0x314], 1
jmp 0x1000e0c4
and dword [ebp - 0x314], 0
cmp dword [ebp - 0x314], 4
ja 0x1000e0d9
mov dword [ebp - 0x220], 1
jmp 0x1000e0e0
and dword [ebp - 0x220], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x220]
mov dword [ebp + eax - 0xa7c], ecx
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp + eax*4 - 0xb90]
cmp dword [ebp - 0x220], eax
jle 0x1000e111
mov dword [ebp - 0x594], 1
jmp 0x1000e118
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 0x708]
cmp dword [ebp - 0x31c], eax
je 0x1000e13e
mov dword [ebp - 0x4c4], 1
jmp 0x1000e145
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp + eax*4 - 0xb90]
cmp dword [ebp - 0x4c4], eax
jne 0x1000e163
mov dword [ebp - 0x324], 1
jmp 0x1000e16a
and dword [ebp - 0x324], 0
push 1
lea ecx, [ebp - 0x8d0]
call fcn.10028a8b
mov ecx, dword [ebp - 0x324]
cmp ecx, dword [eax]
jg 0x1000e18d
mov dword [ebp - 0x61c], 1
jmp 0x1000e194
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x4cc]
add ecx, dword [ebp - 0x61c]
cmp dword [ebp + eax*4 - 0xb90], ecx
je 0x1000e1b8
mov dword [ebp - 0x32c], 1
jmp 0x1000e1bf
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x4cc]
cmp dword [ebp - 0x334], eax
jg 0x1000e1e5
mov dword [ebp - 0x59c], 1
jmp 0x1000e1ec
and dword [ebp - 0x59c], 0
cmp dword [ebp - 0x59c], 0
jg 0x1000e201
mov dword [ebp - 0x33c], 1
jmp 0x1000e208
and dword [ebp - 0x33c], 0
push 1
lea ecx, [ebp - 0x9e8]
call fcn.10028a8b
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x258]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x258]
mov dword [ecx], eax
mov eax, dword [ebp - 0x258]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x33c]
jl 0x1000e248
mov dword [ebp - 0x4d4], 1
jmp 0x1000e24f
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x85c], eax
push 0x77e8
push 0x741c
lea eax, [ebp - 0x9d0]
push eax
push 0x539a
push 0x6a03
push 1
push 0x33dd
push 0x6213
push 0
call fcn.1000bb9b
add esp, 0x24
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x8d0]
call fcn.10028a60
jmp 0x1000dfaf
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x9d0]
call fcn.10028a60
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x9e8]
call fcn.10028a60
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa00]
call fcn.10028a60
mov dword [ebp - 0x7bc], 1
mov dword [ebp - 0x7b8], 1
mov dword [ebp - 0x7b4], 1
mov dword [ebp - 0x7b0], 1
push 1
lea ecx, [ebp - 0x868]
call fcn.10028987
mov dword [ebp - 4], 0xc
mov dword [ebp - 0xabc], 0xf7d65121
mov dword [ebp - 0x158], 0
jmp 0x1000e32c
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 1
jge 0x1000e34e
push dword [ebp - 0x158]
lea ecx, [ebp - 0x868]
call fcn.10028a8b
mov dword [eax], 0x8cff0ea7
jmp 0x1000e31f
push 0
lea ecx, [ebp - 0x868]
call fcn.10028a8b
and dword [eax], 0
jmp 0x1000e384
push 0
lea ecx, [ebp - 0x868]
call fcn.10028a8b
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x344]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x344]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x868]
call fcn.10028a8b
cmp dword [eax], 0xb
je 0x1000e45f
push 3
lea ecx, [ebp - 0xa24]
call fcn.10028987
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x1c8], 0
jmp 0x1000e3c4
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
jge 0x1000e3e6
push dword [ebp - 0x1c8]
lea ecx, [ebp - 0xa24]
call fcn.10028a8b
mov dword [eax], 0xfffffff9
jmp 0x1000e3b7
lea eax, [ebp - 0xa24]
push eax
push 0xd11
push 1
push 0x801
push 0
push 1
call fcn.100211bd
add esp, 0x18
mov byte [ebp - 0x8c], 0
movzx eax, byte [ebp - 0x8c]
test eax, eax
je 0x1000e44b
push 1
push 0x7912
push 0x1c63
push 0x6c75
push 0x1acc
push 0x941
push 0x6b2f
push 0x47c3
push 0
push 0x61d
call fcn.10018998
add esp, 0x28
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xa24]
call fcn.10028a60
jmp 0x1000e360
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x868]
call fcn.10028a60
push 2
lea ecx, [ebp - 0x64c]
call fcn.10028987
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x2ac], 0xffffffff
mov dword [ebp - 0x2a8], 0xffffffff
mov dword [ebp - 0x2a4], 0xffffffff
mov dword [ebp - 0x2a0], 0xffffffff
mov dword [ebp - 0x34c], 9
mov dword [ebp - 0x710], 0xffffffff
mov dword [ebp - 0x160], 0
jmp 0x1000e4d7
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 2
jge 0x1000e4f6
push dword [ebp - 0x160]
lea ecx, [ebp - 0x64c]
call fcn.10028a8b
and dword [eax], 0
jmp 0x1000e4ca
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2ac], 0
jmp 0x1000e524
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ac]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2ac], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2ac], 1
jg 0x1000e6dc
mov dword [ebp - 0xb94], 0xffffffff
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x2ac]
lea ecx, [ebp - 0x64c]
call fcn.10028a8b
cmp dword [eax], 0
jne 0x1000e585
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x2ac]
lea ecx, [ebp - 0x64c]
call fcn.10028a8b
cmp dword [eax], 0
jne 0x1000e585
and dword [ebp - 0x5a4], 0
jmp 0x1000e58f
mov dword [ebp - 0x5a4], 1
push 0
lea ecx, [ebp - 0x64c]
call fcn.10028a8b
cmp dword [eax], 0
jne 0x1000e5ad
mov dword [ebp - 0x624], 1
jmp 0x1000e5b4
and dword [ebp - 0x624], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x2ac]
lea ecx, [ebp - 0x64c]
call fcn.10028a8b
mov ecx, dword [ebp - 0x624]
cmp ecx, dword [eax]
jge 0x1000e5ee
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x2ac]
lea ecx, [ebp - 0x64c]
call fcn.10028a8b
mov dword [ebp - 0x34c], 0xffffffff
cmp dword [ebp - 0x34c], 0xb44cf592
je 0x1000e610
mov dword [ebp - 0x4dc], 1
jmp 0x1000e617
and dword [ebp - 0x4dc], 0
cmp dword [ebp - 0x4dc], 1
jle 0x1000e62c
mov dword [ebp - 0x354], 1
jmp 0x1000e633
and dword [ebp - 0x354], 0
cmp dword [ebp - 0x354], 0xa149cec7
jne 0x1000e64b
mov dword [ebp - 0x35c], 1
jmp 0x1000e652
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x5a4]
cmp eax, dword [ebp - 0x35c]
jg 0x1000e66c
mov dword [ebp - 0x4e4], 1
jmp 0x1000e673
and dword [ebp - 0x4e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2ac]
cmp dword [ebp - 0x4e4], eax
jne 0x1000e694
mov dword [ebp - 0x364], 1
jmp 0x1000e69b
and dword [ebp - 0x364], 0
push 1
lea ecx, [ebp - 0x64c]
call fcn.10028a8b
mov ecx, dword [ebp - 0x364]
mov dword [eax], ecx
push 0
push 0x409c
push 0x5261
push 1
push 0x647d
push 0x4e7c
lea eax, [ebp - 0x710]
push eax
call fcn.1000c584
add esp, 0x1c
jmp 0x1000e509
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64c]
call fcn.10028a60
mov dword [ebp - 0x1a8], 0
jmp 0x1000e704
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 4
jge 0x1000e720
mov eax, dword [ebp - 0x1a8]
mov dword [ebp + eax*4 - 0xc08], 0x364d64ea
jmp 0x1000e6f7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5c]
mov dword [ebp - 0x638], eax
cmp dword [ebp - 0x638], 0
je 0x1000e752
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5c], 0
je 0x1000e752
mov dword [ebp - 0x37c], 1
jmp 0x1000e759
and dword [ebp - 0x37c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7bc]
mov dword [ebp - 0xac4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5c]
inc eax
inc eax
cmp eax, 0x7008b15e
jle 0x1000e78b
mov dword [ebp - 0x36c], 1
jmp 0x1000e792
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x4ec], 0
je 0x1000e7c3
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x7bc], 0
je 0x1000e7c3
mov dword [ebp - 0x374], 1
jmp 0x1000e7ca
and dword [ebp - 0x374], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x374]
cmp eax, 1
je 0x1000e7e4
mov dword [ebp - 0x5ac], 1
jmp 0x1000e7eb
and dword [ebp - 0x5ac], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7bc]
imul eax, dword [ebp - 0x5ac]
cmp dword [ebp - 0x37c], eax
jne 0x1000e812
mov dword [ebp - 0x4f4], 1
jmp 0x1000e819
and dword [ebp - 0x4f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5c]
cmp dword [ebp - 0x4f4], eax
je 0x1000e837
mov dword [ebp - 0x384], 1
jmp 0x1000e83e
and dword [ebp - 0x384], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7bc]
cmp dword [ebp - 0x384], eax
je 0x1000e85f
mov dword [ebp - 0x618], 1
jmp 0x1000e866
and dword [ebp - 0x618], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x618]
mov dword [ebp + eax - 0xc08], ecx
jmp 0x1000dda5
mov dword [ebp - 0x610], 0
mov dword [ebp - 0x60c], 0
mov dword [ebp - 0x608], 0
mov dword [ebp - 0x604], 0
mov dword [ebp - 0x168], 0xe13a6c9c
mov dword [ebp - 0xdc], 0xfffffff8
mov dword [ebp - 0xf0], 0xffffffff
mov dword [ebp - 0xd0], 0xbcb1a7a8
mov dword [ebp - 0x228], 0xc3fa
mov dword [ebp - 0x5bc], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x610]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x610], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x610], 0
je 0x1000e9de
cmp dword [ebp - 0x168], 1
jbe 0x1000e926
mov dword [ebp - 0x38c], 1
jmp 0x1000e92d
and dword [ebp - 0x38c], 0
cmp dword [ebp - 0x38c], 0
jne 0x1000e942
mov dword [ebp - 0x4fc], 1
jmp 0x1000e949
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x4fc], eax
jl 0x1000e96c
cmp dword [ebp - 0x168], 0
je 0x1000e96c
mov dword [ebp - 0x394], 1
jmp 0x1000e973
and dword [ebp - 0x394], 0
cmp dword [ebp - 0x394], 3
jb 0x1000e988
mov dword [ebp - 0x5b4], 1
jmp 0x1000e98f
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x5b4]
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0x5018
jle 0x1000e9b3
mov dword [ebp - 0x39c], 1
jmp 0x1000e9ba
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x39c]
shl eax, 3
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0
je 0x1000e9de
mov dword [ebp - 0x504], 1
jmp 0x1000e9e5
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x504], eax
jl 0x1000e9ff
mov dword [ebp - 0x7dc], 1
jmp 0x1000ea06
and dword [ebp - 0x7dc], 0
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xb44], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xacc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x610]
mov dword [ebp - 0xb6c], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xb4c], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0xae4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x610]
inc eax
cmp eax, dword [ebp - 0x228]
jne 0x1000ea83
mov dword [ebp - 0x3a4], 1
jmp 0x1000ea8a
and dword [ebp - 0x3a4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x610]
cmp dword [ebp - 0x3a4], eax
jg 0x1000eaab
mov dword [ebp - 0x670], 1
jmp 0x1000eab2
and dword [ebp - 0x670], 0
cmp dword [ebp - 0x670], 0xffff
jne 0x1000ead3
cmp dword [ebp - 0xdc], 0
je 0x1000ead3
mov dword [ebp - 0x3ac], 1
jmp 0x1000eada
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0xdc]
imul eax, dword [ebp - 0x3ac]
mov dword [ebp - 0xd0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x610]
cmp dword [ebp - 0xd0], eax
jne 0x1000eb0e
mov dword [ebp - 0x50c], 1
jmp 0x1000eb15
and dword [ebp - 0x50c], 0
cmp dword [ebp - 0x50c], 0x219f
jge 0x1000eb2d
mov dword [ebp - 0x3b4], 1
jmp 0x1000eb34
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x5bc], eax
mov eax, dword [ebp - 0x228]
cmp dword [ebp - 0x5bc], eax
jle 0x1000eb5a
mov dword [ebp - 0x3bc], 1
jmp 0x1000eb61
and dword [ebp - 0x3bc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x610]
cmp dword [ebp - 0x3bc], eax
je 0x1000eb87
cmp dword [ebp - 0x168], 0
jne 0x1000eb87
and dword [ebp - 0x514], 0
jmp 0x1000eb91
mov dword [ebp - 0x514], 1
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xf0], 0x36f914a1
mov eax, dword [ebp - 0x1b4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x5d0], eax
push 2
lea ecx, [ebp - 0xaf0]
call fcn.10028987
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x50], 0
jmp 0x1000ebda
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x1000ebf6
push dword [ebp - 0x50]
lea ecx, [ebp - 0xaf0]
call fcn.10028a8b
mov dword [eax], 0x13b91020
jmp 0x1000ebd3
mov dword [ebp - 0x50], 0
jmp 0x1000ec06
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x1000ec1c
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x67c], 0
jmp 0x1000ebff
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x67c], 0
jmp 0x1000ec4a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x67c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x67c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x67c], 1
jg 0x1000ecbf
mov dword [ebp - 0x1e8], 0x751c76d7
mov dword [ebp - 0x1e8], 1
jmp 0x1000ec7d
mov eax, dword [ebp - 0x1e8]
dec eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0
jl 0x1000ecba
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x1000ecb8
push 0x6d25
push 1
push 0x6234
push 0xbf6
push 0x590c
push 1
call fcn.10009b28
add esp, 0x18
jmp 0x1000ec70
jmp 0x1000ec2f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaf0]
call fcn.10028a60
mov dword [ebp - 0x64], 0xfffffffa
mov dword [ebp - 0x170], 0
jmp 0x1000ecee
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 4
jge 0x1000ed0a
mov eax, dword [ebp - 0x170]
mov dword [ebp + eax*4 - 0xc34], 0x664dc9ed
jmp 0x1000ece1
mov dword [ebp - 0x64], 0x12
jmp 0x1000ed1a
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x18
jle 0x1000edc1
mov dword [ebp - 0x178], 0x6df37d45
mov dword [ebp - 0x1b0], 0
jmp 0x1000ed47
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 2
jge 0x1000ed63
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0xc10], 0x9be1
jmp 0x1000ed3a
mov dword [ebp - 0x178], 0
jmp 0x1000ed7c
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 1
jg 0x1000edbc
mov byte [ebp - 0xa1], 0
push 0x377b
lea eax, [ebp - 0xa1]
push eax
push 0x1149
push 0x70f3
push 1
push 0x4f3a
push 0
push 0
push 0x79d2
call fcn.10023c86
add esp, 0x24
jmp 0x1000ed6f
jmp 0x1000ed13
mov dword [ebp - 0x64], 0
jmp 0x1000edd1
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jg 0x1000ee0b
push 0
call fcn.10013760
pop ecx
mov byte [ebp - 0x8e], 0
movzx eax, byte [ebp - 0x8e]
test eax, eax
je 0x1000ee09
push 0x287d
push 1
push 0
push 0x416c
push 0
call fcn.10013db5
add esp, 0x14
jmp 0x1000edca
mov dword [ebp - 0xa34], 0xe91a049f
mov dword [ebp - 0xa30], 0xe91a049f
mov dword [ebp - 0xa2c], 0xe91a049f
mov dword [ebp - 0xa28], 0xe91a049f
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0
jmp 0x1000ee4a
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x1000ee60
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xa34], 0
jmp 0x1000ee43
mov dword [ebp - 0x34], 0
jmp 0x1000ee70
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xa
jge 0x1000ee80
push 0
call fcn.100129f7
pop ecx
jmp 0x1000ee69
mov dword [ebp - 0xc4], 0x5c96dd1e
push 4
lea ecx, [ebp - 0xa18]
call fcn.10028987
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x718], 0xee76f502
mov dword [ebp - 0xb98], 0xcd430964
mov dword [ebp - 0xaf4], 0x8ab9c279
mov dword [ebp - 0xa3c], 0x787d6364
mov dword [ebp - 0xa38], 4
mov dword [ebp - 0x1d0], 0
jmp 0x1000eee9
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 4
jge 0x1000ef0b
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0xa18]
call fcn.10028a8b
mov dword [eax], 0xfffffffa
jmp 0x1000eedc
push 0x5b70
push 0x244
push 0x2647
lea eax, [ebp - 0xa18]
push eax
push 0x1bbf
push 0x1f8
push 0x5b6d
push 0
push 1
push 0x4ed1
push 0xbb2
push 0x3640
push 0x60c2
push 0x2246
lea eax, [ebp - 0x718]
push eax
push 0x304d
call fcn.100217aa
add esp, 0x40
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa18]
call fcn.10028a60
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x778], 0xa36a77d7
push 3
lea ecx, [ebp - 0x65c]
call fcn.10028987
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x964], 0x282d564c
mov dword [ebp - 0x960], 0x282d564c
mov dword [ebp - 0x95c], 0x282d564c
mov dword [ebp - 0x958], 0x282d564c
lea ecx, [ebp - 0x1ed]
call fcn.10028a9a
push eax
lea eax, [ebp - 0x954]
push eax
lea eax, [ebp - 0x964]
push eax
lea ecx, [ebp - 0xbe0]
call fcn.10028a9d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x9dc]
call fcn.10028a3a
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x720], 0xffffffff
push 1
lea ecx, [ebp - 0x8e8]
call fcn.10028987
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x7e4], 0xf6b34c26
push 0
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x824]
push eax
push 0x3750
push 0
push 1
call fcn.10022a16
add esp, 0x18
push 0x7ae4
push 0
lea eax, [ebp - 0x8e8]
push eax
push 0x612b
lea eax, [ebp - 0x824]
push eax
call fcn.100215ab
add esp, 0x14
push 2
lea ecx, [ebp - 0x65c]
call fcn.10028a8b
cmp dword [eax], 0
je 0x1000f171
push 2
lea ecx, [ebp - 0x65c]
call fcn.10028a8b
push 0
lea ecx, [ebp - 0x65c]
call fcn.10028a8b
push 2
lea ecx, [ebp - 0x65c]
call fcn.10028a8b
push 1
lea ecx, [ebp - 0x9dc]
call fcn.10028a8b
imul eax, dword [ebp - 0x720], 0xf885
sub eax, 0x1a17e582
je 0x1000f0da
push 0
lea ecx, [ebp - 0x8e8]
call fcn.10028a8b
cmp dword [eax], 0
je 0x1000f0da
mov dword [ebp - 0x3c4], 1
jmp 0x1000f0e1
and dword [ebp - 0x3c4], 0
push 2
lea ecx, [ebp - 0x65c]
call fcn.10028a8b
mov ecx, dword [ebp - 0x3c4]
cmp ecx, dword [eax]
jg 0x1000f113
push 2
lea ecx, [ebp - 0x65c]
call fcn.10028a8b
cmp dword [eax], 0
jne 0x1000f113
and dword [ebp - 0x620], 0
jmp 0x1000f11d
mov dword [ebp - 0x620], 1
push 3
lea ecx, [ebp - 0x9dc]
call fcn.10028a8b
mov ecx, dword [ebp - 0x620]
cmp ecx, dword [eax]
jge 0x1000f140
mov dword [ebp - 0x280], 1
jmp 0x1000f147
and dword [ebp - 0x280], 0
push 0
lea ecx, [ebp - 0x8e8]
call fcn.10028a8b
mov ecx, dword [ebp - 0x280]
mov dword [eax], ecx
cmp dword [ebp - 0x280], 0
je 0x1000f171
mov dword [ebp - 0x3cc], 1
jmp 0x1000f178
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x7e4], eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x8e8]
call fcn.10028a60
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x9dc]
call fcn.10028a60
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x65c]
call fcn.10028a60
mov dword [ebp - 0x780], 0xfffc
mov dword [ebp - 0x1b8], 0x26d2
mov dword [ebp - 0x51c], 0xd0d3f7bf
mov dword [ebp - 0x728], 0x7631615e
mov dword [ebp - 0x730], 0xae2f
mov dword [ebp - 0x180], 0
jmp 0x1000f1fc
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 1
jge 0x1000f218
mov eax, dword [ebp - 0x180]
mov dword [ebp + eax*4 - 0x3dc], 0xc9fa8bc0
jmp 0x1000f1ef
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x51c], eax
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x1b8], eax
jg 0x1000f24a
mov dword [ebp - 0x3d4], 1
jmp 0x1000f251
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x3d4]
sub eax, 0x448549e5
cmp eax, dword [ebp - 0x728]
jl 0x1000f270
mov dword [ebp - 0x5c4], 1
jmp 0x1000f277
and dword [ebp - 0x5c4], 0
imul eax, dword [ebp - 0x5c4], 0x2aec39e4
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x3dc]
jne 0x1000f29c
mov dword [ebp - 0x88c], 1
jmp 0x1000f2a3
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x730]
mov dword [ebp - 0xa54], eax
mov eax, 0xd70
test eax, eax
je 0x1000f2d4
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3dc], 0
je 0x1000f2d4
mov dword [ebp - 0x524], 1
jmp 0x1000f2db
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x1b8]
cmp dword [ebp - 0x524], eax
jge 0x1000f339
mov dword [ebp - 0x188], 0
jmp 0x1000f302
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 4
jge 0x1000f31e
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0xbb0], 0xfffc
jmp 0x1000f2f5
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbb0]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xbb0], eax
jmp 0x1000f38b
mov byte [ebp - 0xb1], 0
push 1
push 1
push 0
push 0x4099
lea eax, [ebp - 0xb1]
push eax
push 0x2ab5
push 0x24a1
push 0x76dc
call fcn.1002229a
add esp, 0x20
mov byte [ebp - 0x90], 0
push 0x61e3
push 0x62d5
push 0
lea eax, [ebp - 0x90]
push eax
call fcn.10013e5f
add esp, 0x10
cmp dword [ebp - 0xc4], 0
je 0x10010613
mov dword [ebp - 0x58], 0x7cb3f4f4
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0xa5c], eax
cmp dword [ebp - 0x58], 0xffffffff
je 0x1000f3b4
cmp dword [ebp - 0x58], 0
jne 0x1000f3c4
push 6
pop eax
test eax, eax
jne 0x1000f3c4
and dword [ebp - 0x3e4], 0
jmp 0x1000f3ce
mov dword [ebp - 0x3e4], 1
cmp dword [ebp - 0x3e4], 0
jne 0x1000f412
mov byte [ebp - 0xa3], 0
movzx eax, byte [ebp - 0xa3]
test eax, eax
je 0x1000f410
push 0x395
push 0x305d
push 0
push 0
push 0x65b
push 1
push 0x2e18
push 0x53dd
call fcn.1000c813
add esp, 0x20
jmp 0x1000f473
mov dword [ebp - 0x58], 0xfffffff2
jmp 0x1000f422
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xffffffec
jl 0x1000f452
mov dword [ebp - 0x7ec], 0x391cb4e7
lea eax, [ebp - 0x7ec]
push eax
push 0
push 0x4f74
call fcn.100136d8
add esp, 0xc
cmp dword [ebp - 0x58], 0
je 0x1000f450
jmp 0x1000f452
jmp 0x1000f41b
mov byte [ebp - 0x92], 0
push 0
push 1
lea eax, [ebp - 0x92]
push eax
push 0
push 0x7a48
call fcn.100132cb
add esp, 0x14
push 2
lea ecx, [ebp - 0x8f4]
call fcn.10028987
mov dword [ebp - 4], 0x14
mov dword [ebp - 0x3c], 3
push 1
lea ecx, [ebp - 0x994]
call fcn.10028987
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x5cc], 0xfffffffa
mov dword [ebp - 0x24], 0
jmp 0x1000f4b9
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x1000f4cf
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x900], 0
jmp 0x1000f4b2
mov dword [ebp - 0x24], 0
jmp 0x1000f4df
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1000f4fb
push dword [ebp - 0x24]
lea ecx, [ebp - 0x994]
call fcn.10028a8b
mov dword [eax], 0xfffffff6
jmp 0x1000f4d8
mov dword [ebp - 0x24], 0
jmp 0x1000f50b
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1000f521
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x7f4], 0x5900
jmp 0x1000f504
mov dword [ebp - 0x3c], 2
jmp 0x1000f531
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x1000f54a
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x900], 0
je 0x1000f548
jmp 0x1000f54a
jmp 0x1000f52a
mov dword [ebp - 0x3c], 0
jmp 0x1000f55a
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 4
jl 0x1000f846
mov dword [ebp - 0x268], 0xbe56
mov dword [ebp - 0x248], 0xffffffff
mov dword [ebp - 0x738], 0x1feb
cmp dword [ebp - 0x738], 0x69e
jge 0x1000f6f0
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x230]
push eax
mov ecx, 0x10657790
call fcn.10027fdd
mov ecx, eax
call fcn.10027fdd
mov ecx, eax
call fcn.10027fdd
and dword [ebp - 0x240], 0
mov dword [ebp - 0x278], 1
mov eax, dword [ebp - 0x230]
and eax, 0x80000001
jns 0x1000f5e2
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x1000f6d4
mov eax, dword [ebp - 0x260]
and eax, 0x80000001
jns 0x1000f5fc
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x1000f6d4
mov eax, dword [ebp - 0x238]
and eax, 0x80000001
jns 0x1000f616
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x1000f6d4
cvtsi2sd xmm0, dword [ebp - 0x278]
ucomisd xmm0, qword [0x10008120]
lahf
test ah, 0x44
jp 0x1000f64c
push fcn.1002c976
push 0xffffffffffffffff
mov ecx, 0x106576d8
call fcn.1002852f
mov ecx, eax
call fcn.10028523
mov eax, dword [ebp - 0x230]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0x260]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x52c], eax
mov eax, dword [ebp - 0x238]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x640], eax
mov eax, dword [ebp - 0x52c]
add eax, dword [ebp - 0x640]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x3ec]
add eax, dword [ebp - 0x640]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x3ec]
add eax, dword [ebp - 0x52c]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
jmp 0x1000f5d0
push fcn.1002c976
push dword [ebp - 0x240]
mov ecx, 0x106576d8
call fcn.1002852f
mov ecx, eax
call fcn.10028523
mov dword [ebp - 0x1e0], 0
jmp 0x1000f709
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 4
jge 0x1000f725
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0xbf0], 0xab227d3
jmp 0x1000f6fc
push 0
lea ecx, [ebp - 0x994]
call fcn.10028a8b
mov dword [eax], 6
cmp dword [ebp - 0x268], 6
jl 0x1000f74d
mov dword [ebp - 0x3f4], 1
jmp 0x1000f754
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x5cc], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x900]
mov dword [ebp - 0x3fc], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x3fc]
mov dword [ebp + eax - 0xbf0], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x900]
sub eax, dword [ebp - 0x5cc]
cmp eax, dword [ebp - 0x3fc]
jne 0x1000f7ac
mov dword [ebp - 0x534], 1
jmp 0x1000f7b3
and dword [ebp - 0x534], 0
mov dword [ebp - 0x248], 0xfffffff9
mov eax, dword [ebp - 0x248]
neg eax
je 0x1000f7d9
cmp dword [ebp - 0x3c], 0
je 0x1000f7d9
mov dword [ebp - 0x82c], 1
jmp 0x1000f7e0
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0xa64], eax
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0xa6c], eax
mov eax, dword [ebp - 0x248]
cmp dword [ebp - 0x534], eax
jle 0x1000f812
mov dword [ebp - 0x740], 1
jmp 0x1000f819
and dword [ebp - 0x740], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x900]
mov dword [ebp - 0xa74], eax
xor eax, eax
inc eax
imul eax, eax, 0xf7bd
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x7f4], eax
jmp 0x1000f553
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x994]
call fcn.10028a60
mov dword [ebp - 0x84c], 0xffffffff
mov dword [ebp - 0xa8], 0xffffffff
mov dword [ebp - 0x628], 0xfbefa5f9
mov dword [ebp - 0xa8], 0
jmp 0x1000f88c
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x14
jle 0x1000f9ac
mov dword [ebp - 0x86c], 0xffffffff
mov dword [ebp - 0x750], 0xfffffffe
mov eax, 0xdc75
test eax, eax
je 0x1000f92d
push 7
pop eax
test eax, eax
je 0x1000f90c
cmp dword [ebp - 0xa8], 0
jge 0x1000f8d2
mov dword [ebp - 0x748], 1
jmp 0x1000f8d9
and dword [ebp - 0x748], 0
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0xa80], eax
cmp dword [ebp - 0xa8], 0
je 0x1000f90c
mov eax, 0xa75a592c
test eax, eax
je 0x1000f90c
cmp dword [ebp - 0xa8], 0
je 0x1000f90c
mov dword [ebp - 0x404], 1
jmp 0x1000f913
and dword [ebp - 0x404], 0
mov eax, dword [ebp - 0x86c]
cmp dword [ebp - 0x404], eax
je 0x1000f92d
mov dword [ebp - 0x40c], 1
jmp 0x1000f934
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x628]
cmp dword [ebp - 0x40c], eax
jl 0x1000f95b
mov dword [ebp - 0x53c], 1
mov eax, dword [ebp - 0x53c]
inc eax
mov dword [ebp - 0x53c], eax
jmp 0x1000f9a7
push 1
lea eax, [ebp - 0x750]
push eax
push 0
push 0x6545
push 0x5ed2
push 0x2556
push 0x665d
push 1
push 0x232a
push 0x7139
push 0x6e93
push 0x2cc5
push 0x6e7b
push 0x649c
push 0x4533
call fcn.10014302
add esp, 0x3c
jmp 0x1000f87f
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x544], 0xfffffffb
mov dword [ebp - 0x13c], 0x812c005d
mov dword [ebp - 0x1f4], 0
push 3
lea ecx, [ebp - 0x918]
call fcn.10028987
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x41c], 1
mov dword [ebp - 0x130], 0
jmp 0x1000fa08
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 3
jge 0x1000fa2a
push dword [ebp - 0x130]
lea ecx, [ebp - 0x918]
call fcn.10028a8b
mov dword [eax], 0x1e758769
jmp 0x1000f9fb
mov dword [ebp - 0xb0], 0
jmp 0x1000fa43
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0xffffffe8
jge 0x1000fb2a
mov dword [ebp - 0x7fc], 0x441791e6
mov dword [ebp - 0x83c], 5
mov dword [ebp - 0x758], 0x60f181e2
push 2
lea ecx, [ebp - 0xa0c]
call fcn.10028987
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x760], 1
mov dword [ebp - 0x134], 0
jmp 0x1000faa2
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 2
jge 0x1000fac4
push dword [ebp - 0x134]
lea ecx, [ebp - 0xa0c]
call fcn.10028a8b
mov dword [eax], 0x95506909
jmp 0x1000fa95
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x7fc]
push eax
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0x918]
push eax
lea eax, [ebp - 0x1f4]
push eax
push 1
push 1
lea eax, [ebp - 0x758]
push eax
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x544]
push eax
lea eax, [ebp - 0x760]
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.10009e27
add esp, 0x30
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xa0c]
call fcn.10028a60
jmp 0x1000fa36
mov dword [ebp - 0x13c], 0x5c25cceb
cmp dword [ebp - 0x13c], 0
jne 0x1000fb49
mov dword [ebp - 0x414], 1
jmp 0x1000fb50
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x41c]
cmp dword [ebp - 0x414], eax
jge 0x1000fb6a
mov dword [ebp - 0x5d4], 1
jmp 0x1000fb71
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x1f4]
cmp dword [ebp - 0x5d4], eax
je 0x1000fb8b
mov dword [ebp - 0x424], 1
jmp 0x1000fb92
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x804], eax
push 2
lea ecx, [ebp - 0x918]
call fcn.10028a8b
mov ecx, dword [ebp - 0x804]
mov dword [eax], ecx
mov eax, dword [ebp - 0x544]
mov dword [ebp - 0xa98], eax
push 4
pop eax
cmp eax, 0x98e4
ja 0x1000fbe1
mov dword [ebp - 0x660], 1
jmp 0x1000fbe8
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x424]
imul eax, dword [ebp - 0x660]
cmp eax, dword [ebp - 0x1f4]
jne 0x1000fc0f
cmp dword [ebp - 0x13c], 0
jne 0x1000fc0f
and dword [ebp - 0x42c], 0
jmp 0x1000fc19
mov dword [ebp - 0x42c], 1
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x918]
call fcn.10028a60
lea eax, [ebp - 0xaa0]
push eax
push 0
push 0x1abc
lea eax, [ebp - 0x8f4]
push eax
push 0x76d5
call fcn.1001e089
add esp, 0x14
mov dword [ebp - 0x2c4], 0
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2bc], 0
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x144], 0xe13a6c9c
mov dword [ebp - 0xd8], 0xfffffff8
mov dword [ebp - 0xe0], 0xffffffff
mov dword [ebp - 0xc8], 0xbcb1a7a8
mov dword [ebp - 0x20c], 0xc3fa
mov dword [ebp - 0x45c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c4]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2c4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c4], 0
je 0x1000fdb6
cmp dword [ebp - 0x144], 1
jbe 0x1000fcfe
mov dword [ebp - 0x54c], 1
jmp 0x1000fd05
and dword [ebp - 0x54c], 0
cmp dword [ebp - 0x54c], 0
jne 0x1000fd1a
mov dword [ebp - 0x434], 1
jmp 0x1000fd21
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x434], eax
jl 0x1000fd44
cmp dword [ebp - 0x144], 0
je 0x1000fd44
mov dword [ebp - 0x5dc], 1
jmp 0x1000fd4b
and dword [ebp - 0x5dc], 0
cmp dword [ebp - 0x5dc], 3
jb 0x1000fd60
mov dword [ebp - 0x43c], 1
jmp 0x1000fd67
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x5018
jle 0x1000fd8b
mov dword [ebp - 0x554], 1
jmp 0x1000fd92
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x554]
shl eax, 3
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
je 0x1000fdb6
mov dword [ebp - 0x444], 1
jmp 0x1000fdbd
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x444], eax
jl 0x1000fdd7
mov dword [ebp - 0x768], 1
jmp 0x1000fdde
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xab0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c4]
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0xac0], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0xad0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c4]
inc eax
cmp eax, dword [ebp - 0x20c]
jne 0x1000fe5b
mov dword [ebp - 0x630], 1
jmp 0x1000fe62
and dword [ebp - 0x630], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c4]
cmp dword [ebp - 0x630], eax
jg 0x1000fe83
mov dword [ebp - 0x44c], 1
jmp 0x1000fe8a
and dword [ebp - 0x44c], 0
cmp dword [ebp - 0x44c], 0xffff
jne 0x1000feab
cmp dword [ebp - 0xd8], 0
je 0x1000feab
mov dword [ebp - 0x55c], 1
jmp 0x1000feb2
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0xd8]
imul eax, dword [ebp - 0x55c]
mov dword [ebp - 0xc8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c4]
cmp dword [ebp - 0xc8], eax
jne 0x1000fee6
mov dword [ebp - 0x454], 1
jmp 0x1000feed
and dword [ebp - 0x454], 0
cmp dword [ebp - 0x454], 0x219f
jge 0x1000ff05
mov dword [ebp - 0x5e4], 1
jmp 0x1000ff0c
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x5e4]
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp - 0x20c]
cmp dword [ebp - 0x45c], eax
jle 0x1000ff32
mov dword [ebp - 0x564], 1
jmp 0x1000ff39
and dword [ebp - 0x564], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2c4]
cmp dword [ebp - 0x564], eax
je 0x1000ff5f
cmp dword [ebp - 0x144], 0
jne 0x1000ff5f
and dword [ebp - 0x464], 0
jmp 0x1000ff69
mov dword [ebp - 0x464], 1
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xe0], 0x36f914a1
push 3
lea ecx, [ebp - 0x66c]
call fcn.10028987
mov byte [ebp - 4], 0x18
push 4
lea ecx, [ebp - 0x208]
call fcn.10028987
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x214], 0xb64fda7e
push 3
lea ecx, [ebp - 0x9ac]
call fcn.10028987
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0xc0], 0
jmp 0x1000ffd5
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jge 0x1000fff4
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x66c]
call fcn.10028a8b
or dword [eax], 0xffffffff
jmp 0x1000ffc8
push 0x15d0
push 0
lea eax, [ebp - 0x208]
push eax
push 1
push 1
lea eax, [ebp - 0xc0]
push eax
call fcn.10024b33
add esp, 0x18
lea eax, [ebp - 0x9ac]
push eax
lea eax, [ebp - 0xc0]
push eax
push 1
push 1
call fcn.1000a51e
add esp, 0x10
push 0x8a8
push 0x6de7
push 0x1143
push 0
push 1
call fcn.1000b671
add esp, 0x14
push 1
lea ecx, [ebp - 0x208]
call fcn.10028a8b
mov dword [eax], 2
jmp 0x10010083
push 1
lea ecx, [ebp - 0x208]
call fcn.10028a8b
mov dword [ebp - 0x650], eax
mov eax, dword [ebp - 0x650]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x650]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x208]
call fcn.10028a8b
cmp dword [eax], 0
jl 0x100102fc
push 3
lea ecx, [ebp - 0x8c4]
call fcn.10028987
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x770], 0xc3e1
lea eax, [ebp - 0xb38]
push eax
push 0x4fc7
push 0x3a68
lea eax, [ebp - 0x8c4]
push eax
push 0
push 0x602c
push 0x13ae
push 0x13e8
push 0x4247
push 0
call fcn.1001e4b8
add esp, 0x28
mov eax, dword [ebp - 0x214]
sub eax, dword [ebp - 0x214]
jne 0x10010108
xor eax, eax
inc eax
jne 0x10010108
and dword [ebp - 0x46c], 0
jmp 0x10010112
mov dword [ebp - 0x46c], 1
push 1
lea ecx, [ebp - 0x208]
call fcn.10028a8b
mov ecx, dword [ebp - 0x46c]
cmp ecx, dword [eax]
jg 0x10010135
mov dword [ebp - 0x56c], 1
jmp 0x1001013c
and dword [ebp - 0x56c], 0
push 1
lea ecx, [ebp - 0x208]
call fcn.10028a8b
push dword [eax]
lea ecx, [ebp - 0x66c]
call fcn.10028a8b
mov eax, dword [eax]
cmp eax, dword [ebp - 0x56c]
jne 0x1001016c
mov dword [ebp - 0x474], 1
jmp 0x10010173
and dword [ebp - 0x474], 0
push 1
lea ecx, [ebp - 0x208]
call fcn.10028a8b
push dword [eax]
lea ecx, [ebp - 0x66c]
call fcn.10028a8b
mov esi, dword [eax]
imul esi, dword [ebp - 0x474]
push 2
lea ecx, [ebp - 0x66c]
call fcn.10028a8b
cmp esi, dword [eax]
jge 0x100101b3
mov dword [ebp - 0x5ec], 1
jmp 0x100101ba
and dword [ebp - 0x5ec], 0
push 1
lea ecx, [ebp - 0x208]
call fcn.10028a8b
push dword [eax]
lea ecx, [ebp - 0x66c]
call fcn.10028a8b
mov eax, dword [eax]
cmp eax, dword [ebp - 0x5ec]
jge 0x1001029a
mov dword [ebp - 0x884], 0x5158018d
push 3
lea ecx, [ebp - 0x90c]
call fcn.10028987
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x14c], 0
jmp 0x10010216
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 3
jge 0x10010235
push dword [ebp - 0x14c]
lea ecx, [ebp - 0x90c]
call fcn.10028a8b
or dword [eax], 0xffffffff
jmp 0x10010209
mov esi, dword [ebp - 0x884]
push 1
lea ecx, [ebp - 0x208]
call fcn.10028a8b
push dword [eax]
lea ecx, [ebp - 0x66c]
call fcn.10028a8b
mov dword [eax], esi
push 1
lea ecx, [ebp - 0x90c]
call fcn.10028a8b
cmp dword [eax], 0
je 0x10010289
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x90c]
call fcn.10028a60
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x8c4]
call fcn.10028a60
jmp 0x100102fc
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x90c]
call fcn.10028a60
jmp 0x100102a8
push 0x6a4d
push 0
call fcn.1002446e
pop ecx
pop ecx
push 0x3664
lea eax, [ebp - 0x770]
push eax
lea eax, [ebp - 0x8c4]
push eax
push 0x2b2
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x66c]
push eax
push 1
push 0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x9ac]
push eax
call fcn.1000a60b
add esp, 0x28
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x8c4]
call fcn.10028a60
jmp 0x1001005f
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x9ac]
call fcn.10028a60
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x208]
call fcn.10028a60
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x66c]
call fcn.10028a60
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x10010354
push 0x188e
push 0x369
push 0
push 0x1fce
push 0
call dword [sym.imp.USER32.dll_GetMenuStringW]
mov dword [ebp - 0xb40], 1
mov dword [ebp - 0xb48], 0xffffffff
mov dword [ebp - 0x950], 0x876e6bac
mov dword [ebp - 0x94c], 0x876e6bac
mov dword [ebp - 0x948], 0x876e6bac
mov dword [ebp - 0x944], 0x876e6bac
lea ecx, [ebp - 0x279]
call fcn.10028a9a
push eax
lea eax, [ebp - 0x940]
push eax
lea eax, [ebp - 0x950]
push eax
lea ecx, [ebp - 0xc18]
call fcn.10028a9d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xbd8]
call fcn.10028a3a
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0xb50], 8
push 2
lea ecx, [ebp - 0x9f4]
call fcn.10028987
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x44], 0
jmp 0x100103f4
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x1001040a
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xb58], 0xb2006887
jmp 0x100103ed
mov dword [ebp - 0x44], 0
jmp 0x1001041a
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x10010436
push dword [ebp - 0x44]
lea ecx, [ebp - 0x9f4]
call fcn.10028a8b
mov dword [eax], 4
jmp 0x10010413
push 0
lea eax, [ebp - 0x9f4]
push eax
push 0x7d1c
call fcn.1001f103
add esp, 0xc
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x9f4]
call fcn.10028a60
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0xbd8]
call fcn.10028a60
mov dword [ebp - 0xc4], 0x17
jmp 0x10010483
mov eax, dword [ebp - 0xc4]
dec eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x10
jge 0x10010602
mov dword [ebp - 0x7ac], 0xfffffffd
push 1
lea ecx, [ebp - 0x8f4]
call fcn.10028a8b
cmp dword [eax], 0
je 0x100104b6
push 0
call fcn.10014d67
pop ecx
jmp 0x100104d3
push 0
lea eax, [ebp - 0x224]
push eax
push 0x6931
push 0
push 0x534d
call fcn.1000cb50
add esp, 0x14
mov dword [ebp - 0x80c], 0x183a
cmp dword [ebp - 0x80c], 0x4d0
jge 0x100105b6
lea eax, [ebp - 0x21c]
push eax
mov ecx, 0x10657790
call fcn.10027fdd
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x9c4]
call fcn.10028987
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x154], 1
jmp 0x1001052c
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
cmp eax, dword [ebp - 0x21c]
jg 0x10010558
push dword [ebp - 0x154]
lea ecx, [ebp - 0x9c4]
call fcn.10028a8b
push eax
mov ecx, 0x10657790
call fcn.10027fdd
jmp 0x1001051f
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x15c], eax
jmp 0x10010573
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 1
jl 0x100105a7
push dword [ebp - 0x15c]
lea ecx, [ebp - 0x9c4]
call fcn.10028a8b
push dword [eax]
mov ecx, 0x106576d8
call fcn.1002852f
mov edx, 0x10007b90
mov ecx, eax
call fcn.1002c79f
jmp 0x10010566
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x9c4]
call fcn.10028a60
lea eax, [ebp - 0x224]
push eax
push 0
lea eax, [ebp - 0x8f4]
push eax
push 0x585d
push 0x5060
lea eax, [ebp - 0x778]
push eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x780]
push eax
push 1
lea eax, [ebp - 0x7ac]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.10012d7c
add esp, 0x2c
jmp 0x10010476
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8f4]
call fcn.10028a60
jmp 0x1001063f
mov dword [ebp - 0x788], 0xe520c3d8
push 0x67de
push 0x6c8
lea eax, [ebp - 0x224]
push eax
push 0
lea eax, [ebp - 0x788]
push eax
call fcn.100216ab
add esp, 0x14
mov dword [ebp - 0xf8], 0x477862f
mov dword [ebp - 0xf8], 0
jmp 0x10010662
mov eax, dword [ebp - 0xf8]
dec eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0xfffffffa
jg 0x10010843
push 1
lea ecx, [ebp - 0x6b4]
call fcn.10028987
mov dword [ebp - 4], 0x20
mov dword [ebp - 0x7c8], 0x9c79ebef
push 0
push 0x636e
lea eax, [ebp - 0x6b4]
push eax
push 1
push 0
lea eax, [ebp - 0xb60]
push eax
push 0x22a8
call fcn.1000c6d0
add esp, 0x1c
push 1
push 0x395e
push 0x761a
push 1
push 0
push 0x2974
push 0x6075
call fcn.1000c6d0
add esp, 0x1c
push 0
lea ecx, [ebp - 0x6b4]
call fcn.10028a8b
mov dword [eax], 0x13
jmp 0x1001070e
push 0
lea ecx, [ebp - 0x6b4]
call fcn.10028a8b
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x47c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x47c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x6b4]
call fcn.10028a8b
cmp dword [eax], 0x14
jne 0x1001082f
mov dword [ebp - 0x7c0], 0xffffffff
push 2
lea ecx, [ebp - 0x970]
call fcn.10028987
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x4c], 0
jmp 0x1001074f
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x10010765
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x8dc], 0xffffffff
jmp 0x10010748
mov dword [ebp - 0x4c], 0
jmp 0x10010775
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x10010791
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x970]
call fcn.10028a8b
mov dword [eax], 0xfffffff6
jmp 0x1001076e
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x8dc], 0
jmp 0x100107bf
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8dc]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x8dc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x8dc], 0
je 0x1001081b
mov dword [ebp - 0x790], 0
push 0x36a3
lea eax, [ebp - 0x970]
push eax
lea eax, [ebp - 0x7c0]
push eax
push 0x53f4
push 0
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0x790]
push eax
lea eax, [ebp - 0x7c8]
push eax
lea eax, [ebp - 0x6b4]
push eax
push 1
call fcn.1001e4b8
add esp, 0x28
jmp 0x100107a4
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x970]
call fcn.10028a60
jmp 0x100106ea
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6b4]
call fcn.10028a60
jmp 0x10010655
mov dword [ebp - 0x74], 5
mov dword [ebp - 0x22c], 0x813f1a07
mov dword [ebp - 0x100], 0x2a3cc92e
mov dword [ebp - 0x7d0], 0xfff9
mov dword [ebp - 0x7d8], 0xfffffffc
mov dword [ebp - 0x164], 0
jmp 0x1001088b
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 3
jge 0x100108a7
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x8ac], 0xc017f215
jmp 0x1001087e
mov dword [ebp - 0x74], 0xffffffed
jmp 0x100108b7
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xfffffff7
je 0x10010bef
mov dword [ebp - 0x110], 0x161ab6ec
mov dword [ebp - 0x174], 0x91e66c61
mov dword [ebp - 0x16c], 0x5e2de4bf
mov eax, dword [ebp - 0x74]
add eax, dword [ebp - 0x100]
cmp dword [ebp - 0x100], eax
jne 0x100108fc
mov dword [ebp - 0x574], 1
jmp 0x10010903
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x174]
imul eax, dword [ebp - 0x574]
cmp eax, 0x9378f1e0
jbe 0x10010923
mov dword [ebp - 0x484], 1
jmp 0x1001092a
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x484], eax
jge 0x10010944
mov dword [ebp - 0x798], 1
jmp 0x1001094b
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xb68], eax
mov dword [ebp - 0x110], 0xfffa
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x174]
imul ecx, dword [ebp - 0x16c]
add eax, ecx
cmp eax, 0xffffffff
jne 0x10010990
mov dword [ebp - 0x600], 1
jmp 0x10010997
and dword [ebp - 0x600], 0
mov eax, dword [ebp - 0x600]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x8ac], eax
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0xb9c], eax
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x16c], eax
jg 0x100109d0
mov dword [ebp - 0x48c], 1
jmp 0x100109d7
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x48c], eax
jge 0x100109f1
mov dword [ebp - 0x57c], 1
jmp 0x100109f8
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x7d0]
cmp dword [ebp - 0x57c], eax
jg 0x10010a12
mov dword [ebp - 0x494], 1
jmp 0x10010a19
and dword [ebp - 0x494], 0
mov eax, dword [ebp - 0x22c]
imul eax, dword [ebp - 0x494]
test eax, eax
je 0x10010a3f
mov eax, 0xfa2
test eax, eax
je 0x10010a3f
mov dword [ebp - 0x7a0], 1
jmp 0x10010a46
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xb2c], eax
mov eax, dword [ebp - 0x110]
add eax, dword [ebp - 0x7d8]
cmp eax, 0x4d33
jle 0x10010a71
mov dword [ebp - 0x2b4], 1
jmp 0x10010a78
and dword [ebp - 0x2b4], 0
cmp dword [ebp - 0x2b4], 0xf314
jg 0x10010a90
mov dword [ebp - 0x2c8], 1
jmp 0x10010a97
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x2c8]
jl 0x10010ab1
mov dword [ebp - 0x2d0], 1
jmp 0x10010ab8
and dword [ebp - 0x2d0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8ac]
cmp dword [ebp - 0x2d0], eax
jl 0x10010ad8
mov dword [ebp - 0x2d8], 1
jmp 0x10010adf
and dword [ebp - 0x2d8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8ac]
cmp dword [ebp - 0x2d8], eax
jge 0x10010aff
mov dword [ebp - 0x2e0], 1
jmp 0x10010b06
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x2e0], eax
je 0x10010b20
mov dword [ebp - 0x2e8], 1
jmp 0x10010b27
and dword [ebp - 0x2e8], 0
cmp dword [ebp - 0x2e8], 0xfffffffa
je 0x10010b3c
mov dword [ebp - 0x2f0], 1
jmp 0x10010b43
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x100]
imul eax, dword [ebp - 0x2f0]
cmp eax, 0xffff
ja 0x10010b63
mov dword [ebp - 0x2f8], 1
jmp 0x10010b6a
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x2f8]
add eax, 0x2ed5bb0c
cmp eax, 0xac411777
jbe 0x10010b88
mov dword [ebp - 0x300], 1
jmp 0x10010b8f
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x300]
sub eax, 0x6da9a16d
sub eax, dword [ebp - 0x74]
cmp eax, 0x9c74
jne 0x10010bb0
mov dword [ebp - 0x308], 1
jmp 0x10010bb7
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x308], eax
jl 0x10010bd1
mov dword [ebp - 0x310], 1
jmp 0x10010bd8
and dword [ebp - 0x310], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x310]
mov dword [ebp + eax - 0x8ac], ecx
jmp 0x100108b0
mov dword [ebp - 0x184], 0x26d2
mov dword [ebp - 0x318], 0xd0d3f7bf
mov dword [ebp - 0x6c0], 0x7631615e
mov dword [ebp - 0x6cc], 0xae2f
mov dword [ebp - 0x17c], 0
jmp 0x10010c30
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 1
jge 0x10010c4c
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0x330], 0xc9fa8bc0
jmp 0x10010c23
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0xb24], eax
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x184], eax
jg 0x10010c7e
mov dword [ebp - 0x320], 1
jmp 0x10010c85
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0x320]
sub eax, 0x448549e5
cmp eax, dword [ebp - 0x6c0]
jl 0x10010ca4
mov dword [ebp - 0x328], 1
jmp 0x10010cab
and dword [ebp - 0x328], 0
imul eax, dword [ebp - 0x328], 0x2aec39e4
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x330]
jne 0x10010cd0
mov dword [ebp - 0x6c4], 1
jmp 0x10010cd7
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x6cc]
mov dword [ebp - 0xa40], eax
mov eax, 0xd70
test eax, eax
je 0x10010d08
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x330], 0
je 0x10010d08
mov dword [ebp - 0x338], 1
jmp 0x10010d0f
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x338], eax
jge 0x10010d6d
mov dword [ebp - 0x18c], 0
jmp 0x10010d36
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 4
jge 0x10010d52
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0xbc0], 0xfffc
jmp 0x10010d29
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xbc0]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xbc0], eax
jmp 0x10010db9
mov byte [ebp - 0x94], 0
movzx eax, byte [ebp - 0x94]
test eax, eax
je 0x10010d87
push 0
call fcn.100229f3
pop ecx
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x10010db9
push 1
push 0x10fe
push 1
push 0x6c4a
push 0x3a78
push 0x748c
call fcn.1000abf2
add esp, 0x18
mov eax, dword [ebp - 0x1b4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1b4]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x30], eax
push 2
lea ecx, [ebp - 0x88]
call fcn.10028987
mov dword [ebp - 4], 0x22
mov dword [ebp - 0x10], 0x57976326
push 1
lea ecx, [ebp - 0x6a8]
call fcn.10028987
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x8a0], 0
mov dword [ebp - 0x89c], 0
mov dword [ebp - 0x898], 0
mov dword [ebp - 0x894], 0
mov dword [ebp - 0x120], 0
jmp 0x10010e41
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 2
jge 0x10010e60
push dword [ebp - 0x120]
lea ecx, [ebp - 0x88]
call fcn.10028a8b
or dword [eax], 0xffffffff
jmp 0x10010e34
lea eax, [ebp - 0x6a8]
push eax
push 0x10da
push 0
lea eax, [ebp - 0x120]
push eax
push 0
push 0x330a
call fcn.100183c4
add esp, 0x18
mov dword [ebp - 0x10], 1
jmp 0x10010e94
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x10011528
mov dword [ebp - 0x3b0], 0xfffffffe
mov dword [ebp - 0x3c0], 0x95e148cb
push 0
lea ecx, [ebp - 0x6a8]
call fcn.10028a8b
mov dword [ebp - 0x340], eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x88]
call fcn.10028a8b
mov ecx, dword [ebp - 0x340]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x340]
cmp dword [eax], 0
je 0x10011500
mov dword [ebp - 0xe4], 0x64f943af
mov dword [ebp - 0x194], 0x622b6078
push 2
lea ecx, [ebp - 0x29c]
call fcn.10028987
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x234], 1
lea eax, [ebp - 0x29c]
push eax
push 0x5eec
push 0x7705
push 1
push 1
lea eax, [ebp - 0xb54]
push eax
push 0x6332
push 0x794c
push 0x7210
call fcn.1000b24b
add esp, 0x24
push dword [ebp - 0x10]
lea ecx, [ebp - 0x88]
call fcn.10028a8b
mov eax, dword [eax]
mov dword [ebp - 0xe4], eax
mov esi, dword [ebp - 0xe4]
neg esi
push dword [ebp - 0x10]
lea ecx, [ebp - 0x88]
call fcn.10028a8b
cmp esi, dword [eax]
jle 0x10010f8a
mov dword [ebp - 0x348], 1
jmp 0x10010f91
and dword [ebp - 0x348], 0
push 1
lea ecx, [ebp - 0x88]
call fcn.10028a8b
mov ecx, dword [ebp - 0x348]
cmp ecx, dword [eax]
jne 0x10010fb4
mov dword [ebp - 0x350], 1
jmp 0x10010fbb
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x350]
add eax, 0x17f2
jne 0x10010fd4
mov dword [ebp - 0x358], 1
jmp 0x10010fdb
and dword [ebp - 0x358], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x88]
call fcn.10028a8b
mov ecx, dword [ebp - 0x358]
cmp ecx, dword [eax]
jle 0x10011012
push dword [ebp - 0x10]
lea ecx, [ebp - 0x88]
call fcn.10028a8b
cmp dword [eax], 0
je 0x10011012
mov dword [ebp - 0x360], 1
jmp 0x10011019
and dword [ebp - 0x360], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x88]
call fcn.10028a8b
mov esi, dword [ebp - 0x360]
sub esi, dword [eax]
push 0
lea ecx, [ebp - 0x6a8]
call fcn.10028a8b
cmp esi, dword [eax]
jge 0x1001104c
mov dword [ebp - 0x6d4], 1
jmp 0x10011053
and dword [ebp - 0x6d4], 0
push 0
lea ecx, [ebp - 0x6a8]
call fcn.10028a8b
mov esi, dword [ebp - 0xe4]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x88]
call fcn.10028a8b
cmp esi, dword [eax]
jg 0x10011084
mov dword [ebp - 0x368], 1
jmp 0x1001108b
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x194], eax
mov esi, dword [ebp - 0x194]
push 0
lea ecx, [ebp - 0x29c]
call fcn.10028a8b
cmp esi, dword [eax]
jge 0x100110ba
mov dword [ebp - 0x370], 1
jmp 0x100110c1
and dword [ebp - 0x370], 0
cmp dword [ebp - 0x370], 7
jg 0x100110d6
mov dword [ebp - 0x378], 1
jmp 0x100110dd
and dword [ebp - 0x378], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x88]
call fcn.10028a8b
mov esi, dword [ebp - 0x378]
sub esi, dword [eax]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x88]
call fcn.10028a8b
cmp esi, dword [eax]
jle 0x10011111
mov dword [ebp - 0x380], 1
jmp 0x10011118
and dword [ebp - 0x380], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x88]
call fcn.10028a8b
mov eax, dword [eax]
cmp eax, dword [ebp - 0x380]
je 0x1001113c
mov dword [ebp - 0x2b0], 1
jmp 0x10011143
and dword [ebp - 0x2b0], 0
cmp dword [ebp - 0x2b0], 0xbc79
jl 0x1001115b
mov dword [ebp - 0x390], 1
jmp 0x10011162
and dword [ebp - 0x390], 0
push 0
lea ecx, [ebp - 0x29c]
call fcn.10028a8b
mov ecx, dword [ebp - 0x390]
mov dword [eax], ecx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x88]
call fcn.10028a8b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x88]
call fcn.10028a8b
cmp dword [eax], 0
jne 0x100111b4
push dword [ebp - 0x10]
lea ecx, [ebp - 0x88]
call fcn.10028a8b
cmp dword [eax], 0
jne 0x100111b4
and dword [ebp - 0x398], 0
jmp 0x100111be
mov dword [ebp - 0x398], 1
push 0
lea ecx, [ebp - 0x29c]
call fcn.10028a8b
cmp dword [eax], 0
je 0x100111e5
mov eax, 0xd9c7
test eax, eax
je 0x100111e5
mov dword [ebp - 0x3a0], 1
jmp 0x100111ec
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
je 0x10011211
xor eax, eax
je 0x10011211
mov dword [ebp - 0x3a8], 1
jmp 0x10011218
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x3b0], eax
jl 0x10011247
mov dword [ebp - 0x6dc], 1
jmp 0x1001124e
and dword [ebp - 0x6dc], 0
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x3b8], eax
push 0
lea ecx, [ebp - 0x6a8]
call fcn.10028a8b
mov ecx, dword [ebp - 0x3b8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 0
jne 0x10011290
mov dword [ebp - 0x3c8], 1
jmp 0x10011297
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x3c8]
dec eax
cmp eax, 5
jg 0x100112af
mov dword [ebp - 0x3d0], 1
jmp 0x100112b6
and dword [ebp - 0x3d0], 0
push 0
lea ecx, [ebp - 0x29c]
call fcn.10028a8b
mov eax, dword [eax]
cmp eax, dword [ebp - 0x3d0]
jge 0x100112d9
mov dword [ebp - 0x3d8], 1
jmp 0x100112e0
and dword [ebp - 0x3d8], 0
cmp dword [ebp - 0x3d8], 0x72a3
jle 0x100112f8
mov dword [ebp - 0x6e4], 1
jmp 0x100112ff
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xa48], eax
push 0
lea ecx, [ebp - 0x88]
call fcn.10028a8b
cmp dword [eax], 0x7709c180
jge 0x10011329
mov dword [ebp - 0x3e0], 1
jmp 0x10011330
and dword [ebp - 0x3e0], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x88]
call fcn.10028a8b
mov ecx, dword [ebp - 0x3e0]
cmp ecx, dword [eax]
jg 0x10011354
mov dword [ebp - 0x3e8], 1
jmp 0x1001135b
and dword [ebp - 0x3e8], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x88]
call fcn.10028a8b
mov eax, dword [eax]
sub eax, dword [ebp - 0x3e8]
jne 0x1001138f
push dword [ebp - 0x10]
lea ecx, [ebp - 0x88]
call fcn.10028a8b
cmp dword [eax], 0
jne 0x1001138f
and dword [ebp - 0x3f0], 0
jmp 0x10011399
mov dword [ebp - 0x3f0], 1
mov esi, dword [ebp - 0x3f0]
sub esi, 0x1a3d
push dword [ebp - 0x10]
lea ecx, [ebp - 0x88]
call fcn.10028a8b
cmp esi, dword [eax]
jne 0x100113c3
mov dword [ebp - 0x3f8], 1
jmp 0x100113ca
and dword [ebp - 0x3f8], 0
push 1
lea ecx, [ebp - 0x88]
call fcn.10028a8b
mov ecx, dword [ebp - 0x3f8]
sub ecx, dword [eax]
mov dword [ebp - 0x234], ecx
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8a0]
cmp dword [ebp - 0x234], eax
jle 0x10011405
mov dword [ebp - 0x400], 1
jmp 0x1001140c
and dword [ebp - 0x400], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x88]
call fcn.10028a8b
mov ecx, dword [ebp - 0x400]
cmp ecx, dword [eax]
jle 0x10011430
mov dword [ebp - 0x408], 1
jmp 0x10011437
and dword [ebp - 0x408], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8a0]
cmp dword [ebp - 0x408], eax
jne 0x10011458
mov dword [ebp - 0x410], 1
jmp 0x1001145f
and dword [ebp - 0x410], 0
push 0
lea ecx, [ebp - 0x29c]
call fcn.10028a8b
mov ecx, dword [ebp - 0x410]
cmp ecx, dword [eax]
je 0x10011482
mov dword [ebp - 0x418], 1
jmp 0x10011489
and dword [ebp - 0x418], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x8a0]
cmp dword [ebp - 0x418], eax
jle 0x100114a9
mov dword [ebp - 0x420], 1
jmp 0x100114b0
and dword [ebp - 0x420], 0
push 0
lea ecx, [ebp - 0x29c]
call fcn.10028a8b
mov ecx, dword [ebp - 0x420]
cmp ecx, dword [eax]
jg 0x100114d3
mov dword [ebp - 0x428], 1
jmp 0x100114da
and dword [ebp - 0x428], 0
push 0
lea ecx, [ebp - 0x29c]
call fcn.10028a8b
mov ecx, dword [ebp - 0x428]
mov dword [eax], ecx
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x29c]
call fcn.10028a60
jmp 0x10011523
mov byte [ebp - 0xa2], 0
movzx eax, byte [ebp - 0xa2]
test eax, eax
je 0x10011523
push 0x7eeb
push 0
push 0
call fcn.10012955
add esp, 0xc
jmp 0x10010e8d
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x6a8]
call fcn.10028a60
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.10028a60
mov dword [ebp - 0x6c], 0xfffffffd
mov dword [ebp - 0x54], 0
jmp 0x1001155d
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x10011573
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0xb00], 0x20624039
jmp 0x10011556
mov dword [ebp - 0x54], 0
jmp 0x10011583
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x10011599
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x23c], 0xffffffff
jmp 0x1001157c
mov dword [ebp - 0x6c], 0
jmp 0x100115a9
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jg 0x10011821
mov dword [ebp - 0xcc], 0x76ff55e0
mov byte [ebp - 0x89], 0
push 0x1549
push 1
push 1
lea eax, [ebp - 0x89]
push eax
push 0
call fcn.10013db5
add esp, 0x14
mov dword [ebp - 0xcc], 2
jmp 0x100115f7
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jl 0x1001181c
mov dword [ebp - 0x19c], 0
jmp 0x1001161d
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 2
jge 0x10011639
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0x290], 0
jmp 0x10011610
push 0x6a52
push 1
push 0xa96
push 0x6393
push 0x5a7c
push 1
call fcn.1000b3de
add esp, 0x18
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x290], 0
jmp 0x10011687
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x290]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x290], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x290], 2
jg 0x10011817
push 1
lea ecx, [ebp - 0x878]
call fcn.10028987
mov dword [ebp - 4], 0x25
mov dword [ebp - 0x1a4], 0
jmp 0x100116c8
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 1
jge 0x100116ea
push dword [ebp - 0x1a4]
lea ecx, [ebp - 0x878]
call fcn.10028a8b
mov dword [eax], 0x3aeb5900
jmp 0x100116bb
cmp dword [ebp - 0xcc], 0x76df7e44
jle 0x10011702
mov dword [ebp - 0x430], 1
jmp 0x10011709
and dword [ebp - 0x430], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x290]
cmp eax, dword [ebp - 0x430]
jg 0x1001172a
mov dword [ebp - 0x6ec], 1
jmp 0x10011731
and dword [ebp - 0x6ec], 0
push 0
lea ecx, [ebp - 0x878]
call fcn.10028a8b
mov dword [eax], 8
push 0xfffffffffffffff7
pop eax
test eax, eax
je 0x10011769
push 0
lea ecx, [ebp - 0x878]
call fcn.10028a8b
cmp dword [eax], 0
je 0x10011769
mov dword [ebp - 0x438], 1
jmp 0x10011770
and dword [ebp - 0x438], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x438]
sub ecx, dword [ebp + eax - 0xb00]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0x23c]
jle 0x1001179d
mov dword [ebp - 0x440], 1
jmp 0x100117a4
and dword [ebp - 0x440], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x290]
cmp dword [ebp - 0x440], eax
je 0x100117c5
mov dword [ebp - 0x448], 1
jmp 0x100117cc
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0x448]
mov dword [ebp + eax*4 - 0xb00], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x23c], 0
je 0x10011803
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.10028a60
jmp 0x1001166c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x878]
call fcn.10028a60
jmp 0x1001166c
jmp 0x100115ea
jmp 0x100115a2
mov dword [ebp - 0x6c], 0
jmp 0x10011831
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0xffffffef
je 0x10011899
mov dword [ebp - 0x1ac], 0x7f5aee0c
mov dword [ebp - 0x1ac], 0
jmp 0x1001185a
mov eax, dword [ebp - 0x1ac]
dec eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0xfffffffb
je 0x10011897
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x23c], 0
je 0x10011875
jmp 0x10011897
mov byte [ebp - 0x8b], 0
movzx eax, byte [ebp - 0x8b]
test eax, eax
je 0x10011895
push 0
push 1
push 1
call fcn.10013945
add esp, 0xc
jmp 0x1001184d
jmp 0x1001182a
and dword [ebp - 0x244], 0
jmp 0x100118b8
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x30]
add eax, 0x28
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1b4]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x244], eax
jge 0x100128ef
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x10], 0
jne 0x100122a6
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x78], 0xb8e136dc
mov dword [ebp - 0xf4], 0xffffffff
push 3
lea ecx, [ebp - 0x8b8]
call fcn.10028987
mov dword [ebp - 4], 0x26
mov dword [ebp - 0xfc], 0xffffffff
push 0
push 0x6ba0
lea eax, [ebp - 0xec]
push eax
push 1
lea eax, [ebp - 0x8b8]
push eax
call fcn.1000cb50
add esp, 0x14
mov dword [ebp - 0xec], 0
jmp 0x1001194b
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 1
jge 0x10011967
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x4c8], 0x2a4f2a6c
jmp 0x1001193e
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
jge 0x1001197b
mov dword [ebp - 0x450], 1
jmp 0x10011982
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x450]
sub eax, 0x78470ed9
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xc4365de
jle 0x100119a5
mov dword [ebp - 0x458], 1
jmp 0x100119ac
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xb04], eax
cmp dword [ebp - 0x38], 0xfffffff9
jne 0x100119d6
mov dword [ebp - 0x460], 1
jmp 0x100119dd
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x460], eax
jle 0x100119f4
mov dword [ebp - 0x468], 1
jmp 0x100119fb
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x468]
jg 0x10011a12
mov dword [ebp - 0x24c], 1
jmp 0x10011a19
and dword [ebp - 0x24c], 0
push 1
lea ecx, [ebp - 0x8b8]
call fcn.10028a8b
mov ecx, dword [ebp - 0x24c]
mov dword [eax], ecx
cmp dword [ebp - 0x24c], 0
je 0x10011a43
mov dword [ebp - 0x470], 1
jmp 0x10011a4a
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x470], eax
jg 0x10011a67
cmp dword [ebp - 0xf4], 0
jne 0x10011a67
and dword [ebp - 0x478], 0
jmp 0x10011a71
mov dword [ebp - 0x478], 1
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x478], eax
jg 0x10011a88
mov dword [ebp - 0x480], 1
jmp 0x10011a8f
and dword [ebp - 0x480], 0
cmp dword [ebp - 0x480], 0xffffffff
je 0x10011aa4
mov dword [ebp - 0x488], 1
jmp 0x10011aab
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0xfc], eax
mov eax, dword [ebp - 0xfc]
sub eax, 0x26b01a0d
cmp eax, dword [ebp - 0x38]
jne 0x10011ad3
mov dword [ebp - 0x6f4], 1
jmp 0x10011ada
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x38]
add eax, 0x11de
je 0x10011cca
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4c8], 0
je 0x10011cca
mov dword [ebp - 0x254], 8
mov dword [ebp - 0x25c], 0x7675daaf
mov dword [ebp - 0x4c0], 0xfffffff8
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xa50], eax
mov eax, dword [ebp - 0x254]
cmp dword [ebp - 0xfc], eax
jge 0x10011b40
mov dword [ebp - 0x490], 1
jmp 0x10011b47
and dword [ebp - 0x490], 0
imul eax, dword [ebp - 0x490], 0x91e5
cmp eax, dword [ebp - 0x25c]
je 0x10011b65
mov dword [ebp - 0x498], 1
jmp 0x10011b6c
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0xf4]
imul eax, dword [ebp - 0x498]
cmp eax, 0x341a4633
jl 0x10011b9e
push 2
lea ecx, [ebp - 0x8b8]
call fcn.10028a8b
cmp dword [eax], 0
je 0x10011b9e
mov dword [ebp - 0x4a0], 1
jmp 0x10011ba5
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x25c]
imul eax, dword [ebp - 0x4a0]
cmp eax, 0x718a84d2
je 0x10011bc5
mov dword [ebp - 0x4a8], 1
jmp 0x10011bcc
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0x254]
sub eax, dword [ebp - 0x254]
mov ecx, dword [ebp - 0x25c]
mov edx, dword [ebp - 0x4a8]
lea ecx, [edx + ecx + 0x6568dd4b]
cmp eax, ecx
jle 0x10011bfb
mov dword [ebp - 0x4b0], 1
jmp 0x10011c02
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x4b0]
sub eax, 0xd6b8
cmp eax, 0x4b43
jg 0x10011c20
mov dword [ebp - 0x4b8], 1
jmp 0x10011c27
and dword [ebp - 0x4b8], 0
imul eax, dword [ebp - 0x4b8], 0xfffffffe
test eax, eax
je 0x10011c76
mov dword [ebp - 0x1bc], 0
jmp 0x10011c4b
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 1
jge 0x10011c67
mov eax, dword [ebp - 0x1bc]
mov dword [ebp + eax*4 - 0xb80], 1
jmp 0x10011c3e
mov eax, dword [ebp - 0x4c0]
inc eax
mov dword [ebp - 0x4c0], eax
jmp 0x10011cc8
mov dword [ebp - 0x6bc], 0x8fe30c1a
mov dword [ebp - 0x704], 0x52c4
mov dword [ebp - 0x6fc], 0xfffffffc
lea eax, [ebp - 0xf4]
push eax
push 1
lea eax, [ebp - 0x6fc]
push eax
push 0
lea eax, [ebp - 0x704]
push eax
lea eax, [ebp - 0x6bc]
push eax
lea eax, [ebp - 0xfc]
push eax
push 0x11c4
call fcn.1000b6e9
add esp, 0x20
jmp 0x10011cf1
mov dword [ebp - 0x78], 0
jmp 0x10011cda
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jl 0x10011cf1
mov eax, dword [ebp - 0x78]
cmp dword [ebp + eax*4 - 0x4c8], 0
je 0x10011cef
jmp 0x10011cf1
jmp 0x10011cd3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8b8]
call fcn.10028a60
push 0
push 0x5c52
push dword [ebp - 0x714]
push dword [ebp - 0x30]
push 0x4040
push 0x52c
push 0x26dc
push dword [ebp - 0x5d0]
push 0
lea eax, [ebp - 0x274]
push eax
call fcn.10018998
add esp, 0x28
mov dword [ebp - 0x104], 0xffffffff
mov dword [ebp - 0x72c], 0x2dafbbd
mov dword [ebp - 0x520], 0xc9c3d069
mov dword [ebp - 0xd4], 1
mov dword [ebp - 0x71c], 0x2080
cmp dword [ebp - 0x71c], 0x1253
jge 0x10011ebd
lea eax, [ebp - 0x724]
push eax
push 0x10007acc
call fcn.1004d62b
pop ecx
pop ecx
mov dword [ebp - 0x12c], 1
jmp 0x10011da4
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
cmp eax, dword [ebp - 0x724]
jg 0x10011ebd
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x10007b94
call fcn.1004d62b
add esp, 0xc
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x28]
test edx, edx
jne 0x10011de6
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x1cc], eax
jmp 0x10011e13
cmp dword [ebp - 0x18], 0
jge 0x10011e06
mov eax, dword [ebp - 0x18]
neg eax
mov ecx, dword [ebp - 0x28]
lea eax, [eax + ecx - 1]
neg eax
cdq
idiv dword [ebp - 0x28]
mov dword [ebp - 0x1cc], eax
jmp 0x10011e13
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x28]
mov dword [ebp - 0x1cc], eax
push dword [ebp - 0x1cc]
push dword [ebp - 0x12c]
push 0x10007b9c
call fcn.1004dfbc
add esp, 0xc
mov eax, dword [ebp - 0x1cc]
imul eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x28]
jne 0x10011e53
push 0x10007bac
call fcn.1004dfbc
pop ecx
jmp 0x10011ead
cmp dword [ebp - 0x18], 0
je 0x10011ead
mov eax, dword [ebp - 0x28]
cdq
idiv dword [ebp - 0x18]
test edx, edx
je 0x10011e98
mov eax, dword [ebp - 0x28]
cdq
idiv dword [ebp - 0x18]
push eax
push 0x10007bb0
call fcn.1004dfbc
pop ecx
pop ecx
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x18]
call fcn.1002c78c
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x28]
imul eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov dword [ebp - 0x18], ecx
jmp 0x10011e59
mov eax, dword [ebp - 0x28]
cdq
idiv dword [ebp - 0x18]
dec eax
push eax
push 0x10007bb4
call fcn.1004dfbc
pop ecx
pop ecx
push 0x10007bbc
call fcn.1004dfbc
pop ecx
jmp 0x10011d97
mov dword [ebp - 0x510], 0xffffffff
mov dword [ebp - 0x93c], 0x7736eae1
mov dword [ebp - 0x938], 0x7736eae1
mov dword [ebp - 0x934], 0x7736eae1
mov dword [ebp - 0x930], 0x7736eae1
lea ecx, [ebp - 0x281]
call fcn.10028a9a
push eax
lea eax, [ebp - 0x92c]
push eax
lea eax, [ebp - 0x93c]
push eax
lea ecx, [ebp - 0xbf8]
call fcn.10028a9d
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xb10]
call fcn.10028a3a
mov dword [ebp - 4], 0x27
mov dword [ebp - 0x1d4], 0
jmp 0x10011f44
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 2
jge 0x10011f60
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0x684], 0x2eb90da1
jmp 0x10011f37
mov dword [ebp - 0x104], 0
jmp 0x10011f79
cmp dword [ebp - 0x104], 1
jg 0x1001225c
mov dword [ebp - 0x2c], 0x182eac45
mov dword [ebp - 0xa58], 0xffffffff
mov dword [ebp - 0x518], 0xb4ef66b1
mov dword [ebp - 0x1dc], 0
jmp 0x10011fba
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 3
jge 0x10011fd6
mov eax, dword [ebp - 0x1dc]
mov dword [ebp + eax*4 - 0xc24], 4
jmp 0x10011fad
mov dword [ebp - 0x2c], 1
jmp 0x10011fe6
cmp dword [ebp - 0x2c], 0
jl 0x10012000
mov eax, dword [ebp - 0x104]
cmp dword [ebp + eax*4 - 0x684], 0
je 0x10011ffe
mov dword [ebp - 0x2c], 0
jmp 0x10012010
push 0x2586
push 0
push 0x1bf1
push 0x20d6
push 0x2c58
lea eax, [ebp - 0x72c]
push eax
push 1
push 0x38de
push 0x2b8e
push 0x32a2
call fcn.1000bd52
add esp, 0x28
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb10]
call fcn.10028a60
jmp 0x100118a2
mov dword [ebp - 0x190], 4
mov dword [ebp - 0x114], 0x256915a1
mov dword [ebp - 0x11c], 0xffffffff
mov dword [ebp - 0x26c], 0x7bf5cd53
mov dword [ebp - 0x540], 0xfffffff8
push 2
lea ecx, [ebp - 0x690]
call fcn.10028987
mov dword [ebp - 4], 0x28
push 1
lea ecx, [ebp - 0x69c]
call fcn.10028987
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x73c], 0xde726f2c
mov dword [ebp - 0x1ec], 0x1140ae77
mov dword [ebp - 0x74c], 0x9140
push 1
push 0
lea eax, [ebp - 0x734]
push eax
push 0
push 0x4462
push 0x6ca2
push 0x77c2
lea eax, [ebp - 0x690]
push eax
push 0x7400
push 0x6c56
push 0x51a1
push 0xf2f
push 0x76cc
call fcn.1002284a
add esp, 0x34
push 0x7f34
push 1
push 1
lea eax, [ebp - 0x69c]
push eax
lea eax, [ebp - 0x734]
push eax
call fcn.1000ba82
add esp, 0x14
push 0
lea ecx, [ebp - 0x69c]
call fcn.10028a8b
mov dword [ebp - 0x528], eax
mov eax, dword [ebp - 0x528]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x528]
mov dword [ecx], eax
mov eax, 0xa017779a
test eax, eax
je 0x100126a1
mov eax, 0xeed0
test eax, eax
je 0x100123cd
cmp dword [ebp - 0x11c], 0
je 0x100123cd
mov dword [ebp - 0x530], 1
jmp 0x100123d4
and dword [ebp - 0x530], 0
cmp dword [ebp - 0x530], 0xd4f509e1
jae 0x100123ec
mov dword [ebp - 0x538], 1
jmp 0x100123f3
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 0x5fef4072
jg 0x10012417
mov dword [ebp - 0x548], 1
jmp 0x1001241e
and dword [ebp - 0x548], 0
push 0
lea ecx, [ebp - 0x690]
call fcn.10028a8b
mov ecx, dword [ebp - 0x548]
imul ecx, dword [eax]
test ecx, ecx
jne 0x1001244d
cmp dword [ebp - 0x190], 0
jne 0x1001244d
mov dword [ebp - 0x550], 1
jmp 0x10012454
and dword [ebp - 0x550], 0
push 0
lea ecx, [ebp - 0x69c]
call fcn.10028a8b
mov ecx, dword [ebp - 0x550]
cmp ecx, dword [eax]
jge 0x10012477
mov dword [ebp - 0x558], 1
jmp 0x1001247e
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x11c]
imul eax, dword [ebp - 0x558]
sub eax, dword [ebp - 0x26c]
jne 0x100124a5
mov eax, 0xef5b
test eax, eax
jne 0x100124a5
and dword [ebp - 0x264], 0
jmp 0x100124af
mov dword [ebp - 0x264], 1
push 0
lea ecx, [ebp - 0x690]
call fcn.10028a8b
mov ecx, dword [ebp - 0x264]
mov dword [eax], ecx
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x73c], eax
push 0
lea ecx, [ebp - 0x690]
call fcn.10028a8b
mov dword [ebp - 0x11c], 0xed46
cmp dword [ebp - 0x11c], 0
jne 0x10012505
cmp dword [ebp - 0x114], 0
je 0x10012505
mov dword [ebp - 0x560], 1
jmp 0x1001250c
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0x560]
jne 0x10012526
mov dword [ebp - 0x568], 1
jmp 0x1001252d
and dword [ebp - 0x568], 0
cmp dword [ebp - 0x568], 8
jne 0x10012542
mov dword [ebp - 0x570], 1
jmp 0x10012549
and dword [ebp - 0x570], 0
cmp dword [ebp - 0x570], 0x1521
jg 0x10012561
mov dword [ebp - 0x578], 1
jmp 0x10012568
and dword [ebp - 0x578], 0
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x578], eax
jne 0x10012588
cmp dword [ebp - 0x1ec], 0
jne 0x10012588
and dword [ebp - 0x580], 0
jmp 0x10012592
mov dword [ebp - 0x580], 1
mov eax, dword [ebp - 0x580]
mov dword [ebp - 0x114], eax
mov esi, dword [ebp - 0x114]
push 0
lea ecx, [ebp - 0x69c]
call fcn.10028a8b
cmp esi, dword [eax]
jg 0x100125c1
mov dword [ebp - 0x588], 1
jmp 0x100125c8
and dword [ebp - 0x588], 0
cmp dword [ebp - 0x588], 0x44ba
je 0x100125e0
mov dword [ebp - 0x590], 1
jmp 0x100125e7
and dword [ebp - 0x590], 0
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 0x590], eax
je 0x10012601
mov dword [ebp - 0x598], 1
jmp 0x10012608
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 0x598], eax
jge 0x10012622
mov dword [ebp - 0x5a0], 1
jmp 0x10012629
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x26c]
cmp eax, dword [ebp - 0x5a0]
je 0x10012643
mov dword [ebp - 0x5a8], 1
jmp 0x1001264a
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x5a8], eax
jl 0x10012664
mov dword [ebp - 0x744], 1
jmp 0x1001266b
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0xb14], eax
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0xa60], eax
push 0
lea ecx, [ebp - 0x690]
call fcn.10028a8b
cmp dword [eax], 0
je 0x100126a1
mov dword [ebp - 0x5b0], 1
jmp 0x100126a8
and dword [ebp - 0x5b0], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x5b0], eax
jl 0x100126c2
mov dword [ebp - 0x5b8], 1
jmp 0x100126c9
and dword [ebp - 0x5b8], 0
push 0
lea ecx, [ebp - 0x69c]
call fcn.10028a8b
mov ecx, dword [ebp - 0x5b8]
cmp ecx, dword [eax]
jle 0x100126e9
mov eax, 0xa801
test eax, eax
jne 0x100126f2
mov eax, 0xbfe21dab
test eax, eax
je 0x10012702
xor eax, eax
je 0x10012702
mov dword [ebp - 0x5c0], 1
jmp 0x10012709
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x190]
add eax, dword [ebp - 0x5c0]
je 0x1001272c
cmp dword [ebp - 0x74c], 0
je 0x1001272c
mov dword [ebp - 0x5c8], 1
jmp 0x10012733
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x5c8]
mov dword [ebp - 0x26c], eax
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x69c]
call fcn.10028a60
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x690]
call fcn.10028a60
push 4
push 0x1000
mov eax, dword [ebp - 0x30]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x5d0]
add ecx, dword [eax + 0xc]
push ecx
push 0xb78e
push 0xb330
call fcn.100352d3
pop ecx
pop ecx
call eax
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x30]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x754]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x274]
call fcn.10035488
add esp, 0xc
mov dword [ebp - 0x60], 2
mov dword [ebp - 0x5e0], 0x2d9ee1c9
mov dword [ebp - 0x764], 0x646b
push 1
lea ecx, [ebp - 0xb20]
call fcn.10028987
mov dword [ebp - 4], 0x2a
push 0x421f
push 0x3fcd
push 0x17ff
push 0x7eaa
push 0x7320
push 0xfd9
push 1
push 0
push 0x862
push 0x4ac6
lea eax, [ebp - 0xb20]
push eax
push 1
lea eax, [ebp - 0xb5c]
push eax
call fcn.1000c2be
add esp, 0x34
cmp dword [ebp - 0x60], 0
je 0x10012881
mov dword [ebp - 0x60], 0
cmp dword [ebp - 0x60], 0
je 0x1001284d
mov dword [ebp - 0x60], 0xffffffff
cmp dword [ebp - 0x60], 0
jne 0x1001284d
and dword [ebp - 0x75c], 0
jmp 0x10012857
mov dword [ebp - 0x75c], 1
mov eax, dword [ebp - 0x5e0]
mov dword [ebp - 0xa68], eax
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x60], eax
jne 0x10012877
mov dword [ebp - 0x5d8], 1
jmp 0x1001287e
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x5e0], 0xc13fe66
jg 0x10012899
mov dword [ebp - 0x5e8], 1
jmp 0x100128a0
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x764], eax
mov byte [ebp - 0x91], 0
movzx eax, byte [ebp - 0x91]
test eax, eax
je 0x100128cf
push 0x6f4d
push 1
push 0
call fcn.10012955
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb20]
call fcn.10028a60
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x274]
mov dword [eax + 8], ecx
jmp 0x100118a2
jmp 0x10012946
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x774], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x77c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x76c], eax
push 0x326b
push 0
push 0x2122
push dword [ebp - 0x76c]
push 0x4d57
push dword [ebp - 0x774]
push 0x587
push 0xcb7
push dword [ebp - 0x77c]
push 0x2d2b
call fcn.1002349d
add esp, 0x28
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret