Function at 0x1000c9aa
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068f99
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2b8
push esi
movzx eax, byte [ebp + 0x34]
test eax, eax
je 0x1000dde1
mov eax, dword [ebp + 0x44]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp + 0x40]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1cc], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x194]
movzx eax, byte [eax]
test eax, eax
je 0x1000dd1a
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x1c], 0xb110c93b
mov dword [ebp - 0x108], 0xc87a7525
mov dword [ebp - 0x160], 0xfffffffa
mov dword [ebp - 0x1c], 0
jmp 0x1000ca6b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 8
je 0x1000cbbc
mov dword [ebp - 0x104], 0xfffffffe
mov dword [ebp - 0x58], 0
jmp 0x1000ca8f
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 4
jge 0x1000caa5
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x268], 0x59609c3f
jmp 0x1000ca88
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x268], 0
jne 0x1000cad9
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x278], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp + eax - 0x268], ecx
je 0x1000cad9
and dword [ebp - 0x12c], 0
jmp 0x1000cae3
mov dword [ebp - 0x12c], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x268]
cmp eax, dword [ebp - 0x12c]
jle 0x1000cb04
mov dword [ebp - 0x16c], 1
jmp 0x1000cb0b
and dword [ebp - 0x16c], 0
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x1000cb39
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x268], 0
jne 0x1000cb39
and dword [ebp - 0x164], 0
jmp 0x1000cb43
mov dword [ebp - 0x164], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x164], eax
jne 0x1000cb5a
mov dword [ebp - 0x9c], 1
jmp 0x1000cb61
and dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x104], eax
jl 0x1000cb84
mov dword [ebp - 0xa4], 1
jmp 0x1000cb8b
and dword [ebp - 0xa4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x268]
add eax, dword [ebp - 0xa4]
mov dword [ebp - 0x160], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x160]
mov dword [ebp + eax - 0x268], ecx
jmp 0x1000ca64
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x2c0], 0x20f746e3
mov dword [ebp - 0x140], 0xc0e0752
push 1
lea ecx, [ebp - 0x2bc]
call fcn.1002a3c2
and dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
jmp 0x1000cc06
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x1000cc1c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x178], 0xfffffff8
jmp 0x1000cbff
mov dword [ebp - 0x18], 0
jmp 0x1000cc2c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1000cc48
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2bc]
call fcn.1002a44b
mov dword [eax], 0xbc21b07f
jmp 0x1000cc25
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x178], 0
jmp 0x1000cc73
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x178]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x178], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x178], 0xe
je 0x1000cd26
mov dword [ebp - 0x220], 0x74c7af5a
mov dword [ebp - 0x228], 0x9b3a00d0
cmp dword [ebp - 0x220], 0
je 0x1000cce7
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x178], 0xffffffff
jne 0x1000ccbe
mov dword [ebp - 0xac], 1
jmp 0x1000ccc5
and dword [ebp - 0xac], 0
mov eax, dword [ebp - 0xac]
sub eax, 0x613fc11f
jne 0x1000cce7
mov eax, 0xdb97
test eax, eax
je 0x1000cce7
mov dword [ebp - 0x110], 1
jmp 0x1000ccee
and dword [ebp - 0x110], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x178]
cmp eax, dword [ebp - 0x110]
jne 0x1000cd0e
mov dword [ebp - 0xb4], 1
jmp 0x1000cd15
and dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x228], eax
jmp 0x1000cc5a
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2bc]
call fcn.1002a420
and dword [ebp - 0x68], 0
jmp 0x1000cd58
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x10]
add eax, 0x28
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x68], eax
jge 0x1000dd15
mov dword [ebp - 0x28], 0x76820624
mov dword [ebp - 0xbc], 0xffffffff
mov dword [ebp - 0x60], 0x40424b96
mov dword [ebp - 0x184], 0
mov dword [ebp - 0x64], 0
jmp 0x1000cd9c
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1000cdaf
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x20], 0x76df7e44
jmp 0x1000cd95
mov dword [ebp - 0x28], 0xfffffff5
jmp 0x1000cdbf
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffffb
jl 0x1000ce07
mov byte [ebp - 0x31], 0
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x1000ce05
push 0x1112
push 0x5e2e
push 0x4545
push 1
push 0x26d
push 0x1b7e
push 0x5805
push 0x3cc
push 0x7785
push 0
call fcn.10010561
add esp, 0x28
jmp 0x1000cdb8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
mov dword [ebp - 0xbc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
cmp eax, dword [ebp - 0xbc]
jne 0x1000ce35
mov dword [ebp - 0x118], 1
jmp 0x1000ce3c
and dword [ebp - 0x118], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
sub eax, 0x54a3d6b9
jne 0x1000ce59
mov dword [ebp - 0xc4], 1
jmp 0x1000ce60
and dword [ebp - 0xc4], 0
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0xc4]
jl 0x1000ce7a
mov dword [ebp - 0x158], 1
jmp 0x1000ce81
and dword [ebp - 0x158], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
cmp dword [ebp - 0x158], eax
jne 0x1000ce9f
mov dword [ebp - 0xcc], 1
jmp 0x1000cea6
and dword [ebp - 0xcc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
cmp dword [ebp - 0xcc], eax
jl 0x1000cec1
mov dword [ebp - 0x70], 1
jmp 0x1000cec5
and dword [ebp - 0x70], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x70]
mov dword [ebp + eax - 0x20], ecx
cmp dword [ebp - 0x70], 0
je 0x1000cee3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x20], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
imul eax, dword [ebp - 0x60]
sub eax, 0x3aed2393
cmp eax, 0xf4b3f4b1
jne 0x1000cf09
mov dword [ebp - 0x120], 1
jmp 0x1000cf10
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x120], eax
je 0x1000cf27
mov dword [ebp - 0xd4], 1
jmp 0x1000cf2e
and dword [ebp - 0xd4], 0
cmp dword [ebp - 0xd4], 0xffffffff
jne 0x1000cf43
mov dword [ebp - 0x148], 1
jmp 0x1000cf4a
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x148]
jle 0x1000cf67
mov dword [ebp - 0xdc], 1
jmp 0x1000cf6e
and dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0xdc], eax
jg 0x1000cf85
mov dword [ebp - 0x128], 1
jmp 0x1000cf8c
and dword [ebp - 0x128], 0
cmp dword [ebp - 0x128], 0xb2f67ab
jl 0x1000cfa4
mov dword [ebp - 0xe4], 1
jmp 0x1000cfab
and dword [ebp - 0xe4], 0
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x28]
neg eax
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 0x20000000
je 0x1000cfd8
mov dword [ebp - 0x168], 1
jmp 0x1000cfdf
and dword [ebp - 0x168], 0
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 0x40000000
je 0x1000d004
mov dword [ebp - 0xec], 1
jmp 0x1000d00b
and dword [ebp - 0xec], 0
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x1f0], eax
push 4
lea ecx, [ebp - 0x238]
call fcn.1002a3c2
mov dword [ebp - 4], 1
mov dword [ebp - 0x50], 0
jmp 0x1000d03b
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jge 0x1000d057
push dword [ebp - 0x50]
lea ecx, [ebp - 0x238]
call fcn.1002a44b
mov dword [eax], 1
jmp 0x1000d034
push 2
lea ecx, [ebp - 0x238]
call fcn.1002a44b
mov dword [eax], 0xffffffe9
jmp 0x1000d090
push 2
lea ecx, [ebp - 0x238]
call fcn.1002a44b
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x130]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x238]
call fcn.1002a44b
cmp dword [eax], 0x1b
jne 0x1000d0d8
mov byte [ebp - 0x29], 0
push 0x1fae
push 1
push 0x164
push 0x3721
push 0x1a47
push 0x5662
push 1
push 1
push 0x137d
lea eax, [ebp - 0x29]
push eax
call fcn.1000afc9
add esp, 0x28
jmp 0x1000d06c
mov byte [ebp - 0x2b], 0
push 0x265
push 0x336
push 0x558d
push 0x25e3
push 1
lea eax, [ebp - 0x2b]
push eax
push 1
push 0x5e28
push 0x2781
push 0xb0d
call fcn.1000b384
add esp, 0x28
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.1002a420
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 0x80000000
je 0x1000d137
mov dword [ebp - 0xf4], 1
jmp 0x1000d13e
and dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0x1ac], eax
push 2
lea ecx, [ebp - 0x8c]
call fcn.1002a3c2
mov dword [ebp - 4], 2
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x27c], 0xfffffff8
mov dword [ebp - 0x48], 0
jmp 0x1000d17f
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x1000d195
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x248], 0x648261f9
jmp 0x1000d178
lea eax, [ebp - 0x48]
push eax
push 0x6de8
push 0x46df
push 0
lea eax, [ebp - 0x8c]
push eax
call fcn.10015d69
add esp, 0x14
push 0
lea ecx, [ebp - 0x8c]
call fcn.1002a44b
mov dword [eax], 2
jmp 0x1000d1ed
push 0
lea ecx, [ebp - 0x8c]
call fcn.1002a44b
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x150]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x8c]
call fcn.1002a44b
cmp dword [eax], 0
jl 0x1000d422
mov dword [ebp - 0x3c], 0x887cf2e5
mov dword [ebp - 0x40], 0x5faafe30
lea eax, [ebp - 0x3c]
push eax
push 0xd3a
push 0
call fcn.10011676
add esp, 0xc
mov dword [ebp - 0x40], 0
jmp 0x1000d234
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jg 0x1000d41d
mov dword [ebp - 0x98], 0xfffffff9
mov dword [ebp - 0x1d0], 6
push 0
lea ecx, [ebp - 0x8c]
call fcn.1002a44b
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x248], 0
je 0x1000d402
cmp dword [ebp - 0x3c], 0
je 0x1000d402
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x248], 0
jne 0x1000d299
push 0xfffffffffffffff7
pop eax
test eax, eax
jne 0x1000d299
and dword [ebp - 0xfc], 0
jmp 0x1000d2a3
mov dword [ebp - 0xfc], 1
push 0
lea ecx, [ebp - 0x8c]
call fcn.1002a44b
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x248]
cmp eax, dword [ebp - 0xfc]
je 0x1000d2cd
mov dword [ebp - 0x138], 1
jmp 0x1000d2d4
and dword [ebp - 0x138], 0
push 0
lea ecx, [ebp - 0x8c]
call fcn.1002a44b
mov eax, dword [eax]
mov ecx, dword [ebp - 0x138]
sub ecx, dword [ebp + eax*4 - 0x248]
jne 0x1000d304
mov eax, 0xea0a9f4f
test eax, eax
jne 0x1000d304
and dword [ebp - 0x94], 0
jmp 0x1000d30e
mov dword [ebp - 0x94], 1
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0xd64bda99
jne 0x1000d332
mov dword [ebp - 0xa0], 1
jmp 0x1000d339
and dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0xa0], eax
jge 0x1000d350
mov dword [ebp - 0xa8], 1
jmp 0x1000d357
and dword [ebp - 0xa8], 0
mov esi, dword [ebp - 0xa8]
sub esi, 0x6fcb1efb
push 0
lea ecx, [ebp - 0x8c]
call fcn.1002a44b
mov eax, dword [eax]
cmp esi, dword [ebp + eax*4 - 0x248]
jg 0x1000d387
mov dword [ebp - 0xb0], 1
jmp 0x1000d38e
and dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x1000d3af
mov eax, 0x122
test eax, eax
jne 0x1000d3af
and dword [ebp - 0xb8], 0
jmp 0x1000d3b9
mov dword [ebp - 0xb8], 1
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0xb8], eax
jne 0x1000d3d0
mov dword [ebp - 0xc0], 1
jmp 0x1000d3d7
and dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x3c], eax
mov esi, dword [ebp - 0x3c]
push 1
lea ecx, [ebp - 0x8c]
call fcn.1002a44b
mov eax, dword [eax]
sub eax, esi
je 0x1000d402
mov dword [ebp - 0xc8], 1
jmp 0x1000d409
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0xc8]
sub eax, dword [ebp - 0x40]
mov dword [ebp - 0x1d0], eax
jmp 0x1000d22d
jmp 0x1000d1c9
mov dword [ebp - 0x30], 0x18
jmp 0x1000d432
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffff4
jle 0x1000d4b6
mov dword [ebp - 0x18c], 2
mov dword [ebp - 0x284], 0x7cd3e5c7
mov dword [ebp - 0x28c], 9
mov dword [ebp - 0x294], 0x15e40c88
mov dword [ebp - 0x1d8], 0
push 0x578f
push 0x4ad3
push 0
push 0x3859
lea eax, [ebp - 0x18c]
push eax
push 0x2fb7
lea eax, [ebp - 0x8c]
push eax
push 0x17ac
call fcn.1001626e
add esp, 0x20
push 0
push 0xcf4
lea eax, [ebp - 0x1d8]
push eax
call fcn.1001af43
add esp, 0xc
jmp 0x1000d42b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.1002a420
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 0x2000000
je 0x1000d727
push 0x4000
mov eax, dword [ebp - 0x10]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x10]
push dword [eax + 8]
push 0x1132a
push 0xfcdd
call fcn.10049ada
pop ecx
pop ecx
call eax
mov dword [ebp - 0x54], 0xffff
mov dword [ebp - 0x80], 1
push 2
lea ecx, [ebp - 0x258]
call fcn.1002a3c2
mov dword [ebp - 4], 3
mov dword [ebp - 0xf8], 0x49c4b05e
mov dword [ebp - 0x17c], 3
mov dword [ebp - 0x19c], 0xb319bd12
mov dword [ebp - 0x1e8], 0x68d270c1
mov dword [ebp - 0x1e0], 0x5dc8ff05
push 0x3292
push 0x1880
push 1
push 0x418b
push 0xec7
push 0x4994
push 0x1602
push 1
push 0x23ca
lea eax, [ebp - 0x29c]
push eax
push 0x2642
push 0x74c2
push 0x7bf4
push 0x1cd3
push 0x11b8
lea eax, [ebp - 0x258]
push eax
push 0x5eeb
push 0x5a05
push 0x203f
push 0x5a1e
push 0x73f5
push 0x1a3c
push 0x18c4
push 0x121e
push 0
push 0x474d
call fcn.10027d2f
add esp, 0x68
push 0
lea ecx, [ebp - 0x258]
call fcn.1002a44b
mov dword [eax], 1
push 0
lea ecx, [ebp - 0x258]
call fcn.1002a44b
cmp dword [ebp - 0x54], 0
je 0x1000d608
cmp dword [ebp - 0x80], 0
je 0x1000d608
and dword [ebp - 0xd0], 0
jmp 0x1000d612
mov dword [ebp - 0xd0], 1
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0xd0]
cmp eax, 0xfffffffa
jne 0x1000d62c
mov dword [ebp - 0xd8], 1
jmp 0x1000d633
and dword [ebp - 0xd8], 0
imul eax, dword [ebp - 0xd8], 0xc4c8
test eax, eax
jne 0x1000d651
push 3
pop eax
test eax, eax
jne 0x1000d651
and dword [ebp - 0xe0], 0
jmp 0x1000d65b
mov dword [ebp - 0xe0], 1
mov eax, dword [ebp - 0x80]
imul eax, dword [ebp - 0xe0]
cmp eax, dword [ebp - 0x54]
jge 0x1000d676
mov dword [ebp - 0xe8], 1
jmp 0x1000d67d
and dword [ebp - 0xe8], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0xe8], eax
jle 0x1000d694
mov dword [ebp - 0xf0], 1
jmp 0x1000d69b
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0xf8], eax
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x1e0]
push eax
push 0
push 1
lea eax, [ebp - 0xf8]
push eax
push 0x912
lea eax, [ebp - 0x19c]
push eax
push 0x2725
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x80]
push eax
push 0x72ac
push 0x6db6
push 0x1225
lea eax, [ebp - 0x1e8]
push eax
push 0x3570
push 0x61db
push 0x2b4d
push 0x7d91
push 0x13ee
call fcn.1000e2bf
add esp, 0x4c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x258]
call fcn.1002a420
jmp 0x1000cd48
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0x3e41
push 0x672a
push 0x5526
push 0x1786
push 0xf61
push 0x13ce
push 1
push 0xe2a
push 0x13c5
lea eax, [ebp - 0x1f0]
push eax
push 0x482d
lea eax, [ebp - 0x1c4]
push eax
lea eax, [ebp - 0x1ac]
push eax
push 0x4280
push 1
push 0x5a31
call fcn.1000bd18
add esp, 0x48
push 1
lea ecx, [ebp - 0x274]
call fcn.1002a3c2
mov dword [ebp - 4], 4
push 1
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x274]
push eax
push 0
push 0x6e7a
call fcn.1001b24f
add esp, 0x14
mov byte [ebp - 0x2a], 0
push 1
push 0x4113
push 0x135c
push 0x4cd0
push 0x53f9
push 0x7ab2
lea eax, [ebp - 0x2a]
push eax
push 1
push 0x6685
push 0x5837
call fcn.1000c40e
add esp, 0x28
push 1
push 0x763f
push 0x768e
push 0x6db4
push 0x21ea
lea eax, [ebp - 0x274]
push eax
push 0
push 0x5e97
call fcn.1001a9ce
add esp, 0x20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x274]
call fcn.1002a420
push 1
push 1
push 0x7655
push 0xd88
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x15c]
push eax
call fcn.1000c51b
add esp, 0x1c
mov dword [ebp - 0x1f8], 0x19c9
cmp dword [ebp - 0x1f8], 0xa7d
jge 0x1000d930
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x1065a5f0
call fcn.10029e81
mov eax, dword [ebp - 0x14]
and eax, 0x80000001
jns 0x1000d88b
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x1000d8d1
mov eax, dword [ebp - 0x14]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
push 3
push fcn.1002e4e1
mov eax, dword [ebp - 0x14]
inc eax
push eax
mov ecx, 0x1065a538
call fcn.1002a191
mov ecx, eax
call fcn.1002a185
mov ecx, eax
call fcn.1002a191
mov dl, 0x20
mov ecx, eax
call fcn.1002e513
jmp 0x1000d8f5
mov eax, dword [ebp - 0x14]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x14], eax
push fcn.1002e4e1
push dword [ebp - 0x14]
mov ecx, 0x1065a538
call fcn.1002a191
mov ecx, eax
call fcn.1002a185
and dword [ebp - 0x6c], 0
jmp 0x1000d902
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x14]
jge 0x1000d921
push 2
mov ecx, 0x1065a538
call fcn.1002a191
mov dl, 0x20
mov ecx, eax
call fcn.1002e513
jmp 0x1000d8fb
push fcn.1002e4e1
mov ecx, 0x1065a538
call fcn.1002a185
push 2
lea ecx, [ebp - 0x7c]
call fcn.1002a3c2
mov dword [ebp - 4], 5
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x2ac], 0xfffffff8
mov dword [ebp - 0x44], 0
jmp 0x1000d962
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x1000d978
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x204], 0x648261f9
jmp 0x1000d95b
lea eax, [ebp - 0x7c]
push eax
push 1
push 1
lea eax, [ebp - 0x44]
push eax
call fcn.1000c60b
add esp, 0x10
push 0
lea ecx, [ebp - 0x7c]
call fcn.1002a44b
mov dword [eax], 2
jmp 0x1000d9bf
push 0
lea ecx, [ebp - 0x7c]
call fcn.1002a44b
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x100]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x7c]
call fcn.1002a44b
cmp dword [eax], 0
jl 0x1000dc18
mov dword [ebp - 0x24], 0x887cf2e5
mov dword [ebp - 0x4c], 0x5faafe30
mov dword [ebp - 0x24], 2
jmp 0x1000d9f0
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1000da29
mov dword [ebp - 0x1b4], 0x3d37a5b7
push 1
push 0x2034
push 1
push 0x6122
push 0x39a
lea eax, [ebp - 0x1b4]
push eax
push 0x5730
call fcn.1000c6d5
add esp, 0x1c
jmp 0x1000d9e9
mov dword [ebp - 0x4c], 0
jmp 0x1000da39
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jg 0x1000dc13
mov dword [ebp - 0x124], 0xfffffff9
mov dword [ebp - 0x208], 6
push 0
lea ecx, [ebp - 0x7c]
call fcn.1002a44b
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x204], 0
je 0x1000dbf8
cmp dword [ebp - 0x24], 0
je 0x1000dbf8
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x204], 0
jne 0x1000da9b
push 0xfffffffffffffff7
pop eax
test eax, eax
jne 0x1000da9b
and dword [ebp - 0x10c], 0
jmp 0x1000daa5
mov dword [ebp - 0x10c], 1
push 0
lea ecx, [ebp - 0x7c]
call fcn.1002a44b
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x204]
cmp eax, dword [ebp - 0x10c]
je 0x1000dacc
mov dword [ebp - 0x114], 1
jmp 0x1000dad3
and dword [ebp - 0x114], 0
push 0
lea ecx, [ebp - 0x7c]
call fcn.1002a44b
mov eax, dword [eax]
mov ecx, dword [ebp - 0x114]
sub ecx, dword [ebp + eax*4 - 0x204]
jne 0x1000db00
mov eax, 0xea0a9f4f
test eax, eax
jne 0x1000db00
and dword [ebp - 0x11c], 0
jmp 0x1000db0a
mov dword [ebp - 0x11c], 1
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0xd64bda99
jne 0x1000db2e
mov dword [ebp - 0x90], 1
jmp 0x1000db35
and dword [ebp - 0x90], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x90], eax
jge 0x1000db4c
mov dword [ebp - 0x134], 1
jmp 0x1000db53
and dword [ebp - 0x134], 0
mov esi, dword [ebp - 0x134]
sub esi, 0x6fcb1efb
push 0
lea ecx, [ebp - 0x7c]
call fcn.1002a44b
mov eax, dword [eax]
cmp esi, dword [ebp + eax*4 - 0x204]
jg 0x1000db80
mov dword [ebp - 0x13c], 1
jmp 0x1000db87
and dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x1000dba8
mov eax, 0x122
test eax, eax
jne 0x1000dba8
and dword [ebp - 0x144], 0
jmp 0x1000dbb2
mov dword [ebp - 0x144], 1
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x144], eax
jne 0x1000dbc9
mov dword [ebp - 0x14c], 1
jmp 0x1000dbd0
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x24]
push 1
lea ecx, [ebp - 0x7c]
call fcn.1002a44b
mov eax, dword [eax]
sub eax, esi
je 0x1000dbf8
mov dword [ebp - 0x154], 1
jmp 0x1000dbff
and dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x154]
sub eax, dword [ebp - 0x4c]
mov dword [ebp - 0x208], eax
jmp 0x1000da32
jmp 0x1000d99e
mov dword [ebp - 0x38], 0x18
jmp 0x1000dc28
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xfffffff4
jle 0x1000dccf
mov dword [ebp - 0x210], 2
mov dword [ebp - 0x2c4], 0x7cd3e5c7
mov dword [ebp - 0x280], 9
mov dword [ebp - 0x2a0], 0x15e40c88
mov dword [ebp - 0x1c0], 0
push 0x1af1
push 1
push 0x1c40
push 0x68d5
push 0xf0b
push 0x6833
lea eax, [ebp - 0x210]
push eax
push 1
push 0x55ff
push 0x37a7
push 0xf76
push 0x7f29
lea eax, [ebp - 0x7c]
push eax
call fcn.1000c866
add esp, 0x34
lea eax, [ebp - 0x1c0]
push eax
push 0x5232
push 0x7e22
push 0x2368
push 1
push 0
call fcn.10012be9
add esp, 0x18
jmp 0x1000dc21
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.1002a420
cmp dword [ebp - 0x15c], 0
jbe 0x1000dd10
lea eax, [ebp - 0x288]
push eax
push dword [ebp - 0x1c4]
push dword [ebp - 0x15c]
mov eax, dword [ebp - 0x10]
push dword [eax + 8]
push 0x1132a
push 0x12208
call fcn.10049ada
pop ecx
pop ecx
call eax
jmp 0x1000cd48
jmp 0x1000dddf
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x1b8], eax
push 3
mov ecx, dword [ebp - 0x1b8]
call fcn.1002a44b
mov eax, dword [ebp - 0x1c8]
mov ecx, dword [ebp - 0x180]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1000de4a
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1a8], eax
push dword [ebp - 0x188]
push 0x1af5
push dword [ebp - 0x190]
push dword [ebp - 0x198]
push dword [ebp - 0x1a0]
push 0
push dword [ebp - 0x1a8]
push dword [ebp - 0x1b0]
call fcn.100116a4
add esp, 0x20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret