Function at 0x1001cc85
Capabilities:
Contain obfuscated stackstrings
Create pipe
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007679e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xac0
mov dword [ebp - 0xa4], 0xb7c7ce53
mov dword [ebp - 0x80], 1
mov dword [ebp - 0x888], 0xfffffffd
mov dword [ebp - 0x988], 3
mov dword [ebp - 0x940], 0xffffffff
mov dword [ebp - 0x860], 0xfffffffe
mov dword [ebp - 0x6a8], 0x40b319b
mov dword [ebp - 0x864], 1
mov dword [ebp - 0x1f0], 0
jmp 0x1001cd09
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 3
jge 0x1001cd25
mov eax, dword [ebp - 0x1f0]
mov dword [ebp + eax*4 - 0x77c], 0xffff
jmp 0x1001ccfc
mov dword [ebp - 0xa4], 0
jmp 0x1001cd3e
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jg 0x1001d073
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x5a4], 0xee491ba6
mov dword [ebp - 0x6b0], 0x32d38ca8
mov dword [ebp - 0x86c], 1
mov dword [ebp - 0x9b8], 4
mov dword [ebp - 0x9b4], 4
mov dword [ebp - 0x9b0], 4
mov dword [ebp - 0x9ac], 4
mov dword [ebp - 0x874], 0xd1b4
mov dword [ebp - 0x87c], 0xfffffffd
mov dword [ebp - 0x194], 0
jmp 0x1001cdc5
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 1
jge 0x1001cde1
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x6a0], 0
jmp 0x1001cdb8
mov dword [ebp - 0x44], 2
jmp 0x1001cdf1
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jl 0x1001d048
mov dword [ebp - 0x884], 0xffffffff
mov dword [ebp - 0x88c], 0x50fa8fad
mov dword [ebp - 0x8ac], 0xfffffff7
mov dword [ebp - 0x8b4], 0x5ef13550
mov dword [ebp - 0x5c], 0
jmp 0x1001ce33
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 4
jge 0x1001ce49
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xa9c], 0x253d9751
jmp 0x1001ce2c
mov dword [ebp - 0x5c], 0
jmp 0x1001ce59
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x1001ce6f
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x8fc], 0xbf68
jmp 0x1001ce52
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x77c], 0
je 0x1001cf77
mov eax, dword [ebp - 0xa4]
cmp dword [ebp + eax*4 - 0x77c], 0xd271
je 0x1001ce9f
mov dword [ebp - 0x34c], 1
jmp 0x1001cea6
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0x5a4], eax
mov eax, dword [ebp - 0x5a4]
mov ecx, dword [ebp - 0x44]
imul eax, dword [ebp + ecx*4 - 0x77c]
cmp eax, 0x1c5a3d7f
jg 0x1001ced6
mov dword [ebp - 0x5ac], 1
jmp 0x1001cedd
and dword [ebp - 0x5ac], 0
cmp dword [ebp - 0x5ac], 0xffffffff
jle 0x1001cef2
mov dword [ebp - 0x5dc], 1
jmp 0x1001cef9
and dword [ebp - 0x5dc], 0
imul eax, dword [ebp - 0x5dc], 0
cmp eax, 0xc821
jg 0x1001cf13
mov dword [ebp - 0x5e4], 1
jmp 0x1001cf1a
and dword [ebp - 0x5e4], 0
cmp dword [ebp - 0x5e4], 0
jge 0x1001cf2f
mov dword [ebp - 0x5e0], 1
jmp 0x1001cf36
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x5e0], eax
jge 0x1001cf55
or eax, 0xffffffff
je 0x1001cf55
mov dword [ebp - 0x470], 1
jmp 0x1001cf5c
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
je 0x1001cf77
mov dword [ebp - 0x59c], 1
jmp 0x1001cf7e
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x59c], eax
jle 0x1001cf95
mov dword [ebp - 0x2d8], 1
jmp 0x1001cf9c
and dword [ebp - 0x2d8], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x2d8], eax
je 0x1001cfb3
mov dword [ebp - 0x540], 1
jmp 0x1001cfba
and dword [ebp - 0x540], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x77c]
cmp dword [ebp - 0x540], eax
jle 0x1001cfd8
mov dword [ebp - 0x2e0], 1
jmp 0x1001cfdf
and dword [ebp - 0x2e0], 0
cmp dword [ebp - 0x2e0], 0
jne 0x1001cff4
mov dword [ebp - 0x478], 1
jmp 0x1001cffb
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x478]
shl eax, 2
cmp eax, dword [ebp - 0x44]
je 0x1001d015
mov dword [ebp - 0x2e8], 1
jmp 0x1001d01c
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x6b0], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x8fc]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x8fc], eax
jmp 0x1001cdea
mov dword [ebp - 0x80], 0
jmp 0x1001d058
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x1001d06e
mov eax, dword [ebp - 0x80]
mov dword [ebp + eax*4 - 0x6a0], 8
jmp 0x1001d051
jmp 0x1001cd31
mov dword [ebp - 0x6a8], 0xffffffff
mov eax, dword [0x106679b0]
and eax, 1
jne 0x1001d0b1
mov eax, dword [0x106679b0]
or eax, 1
mov dword [0x106679b0], eax
and dword [ebp - 4], 0
mov ecx, 0x10667924
call fcn.10016927
push 0x1007761e
call fcn.1005f1b6
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x770], 0x6f2e
mov dword [ebp - 0x76c], 0x6f2e
mov dword [ebp - 0x768], 0x6f2e
mov dword [ebp - 0x764], 0x6f2e
mov dword [ebp - 0x40], 0x46158d32
mov dword [ebp - 0x488], 0xc6a3f154
mov dword [ebp - 0x82c], 0
mov dword [ebp - 0x828], 0
mov dword [ebp - 0x824], 0
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x6c], 0
jmp 0x1001d122
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x1001d138
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x9cc], 0x9a20b287
jmp 0x1001d11b
mov dword [ebp - 0x6c], 0
jmp 0x1001d148
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x1001d15e
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xa04], 0xb40e11a7
jmp 0x1001d141
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x770]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xcd43
jl 0x1001d183
mov dword [ebp - 0x5a8], 1
jmp 0x1001d18a
and dword [ebp - 0x5a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x770]
cmp eax, dword [ebp - 0x5a8]
jne 0x1001d1ab
mov dword [ebp - 0x654], 1
jmp 0x1001d1b2
and dword [ebp - 0x654], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x8bc], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x9cc], 0x58905b8b
jg 0x1001d1da
mov dword [ebp - 0x2f0], 1
jmp 0x1001d1e1
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x2f0], eax
jl 0x1001d1f8
mov dword [ebp - 0x480], 1
jmp 0x1001d1ff
and dword [ebp - 0x480], 0
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x480]
jle 0x1001d216
mov dword [ebp - 0x248], 1
jmp 0x1001d21d
and dword [ebp - 0x248], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x248]
mov dword [ebp + eax - 0xa04], ecx
cmp dword [ebp - 0x248], 0
jne 0x1001d249
push 0xfffffffffffffff9
pop eax
test eax, eax
jne 0x1001d249
and dword [ebp - 0x2f8], 0
jmp 0x1001d253
mov dword [ebp - 0x2f8], 1
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x2f8]
cmp eax, dword [ebp - 0x40]
je 0x1001d26e
mov dword [ebp - 0x548], 1
jmp 0x1001d275
and dword [ebp - 0x548], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x770]
cmp dword [ebp - 0x548], eax
jne 0x1001d296
mov dword [ebp - 0x300], 1
jmp 0x1001d29d
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x300]
add eax, 0xffff
imul eax, dword [ebp - 0x488]
cmp eax, dword [ebp - 0x488]
je 0x1001d2c3
mov dword [ebp - 0x308], 1
jmp 0x1001d2ca
and dword [ebp - 0x308], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x9cc]
cmp dword [ebp - 0x308], eax
jg 0x1001d2eb
mov dword [ebp - 0x5c0], 1
jmp 0x1001d2f2
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x5c0], eax
jle 0x1001d322
mov eax, 0x34adc6f7
test eax, eax
je 0x1001d322
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x9cc], 0
je 0x1001d322
mov dword [ebp - 0x310], 1
jmp 0x1001d329
and dword [ebp - 0x310], 0
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x40], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x40]
mov dword [ebp + eax - 0x82c], ecx
push dword [ebp + 8]
lea ecx, [ebp - 0x7dc]
call fcn.100165ef
mov dword [ebp - 4], 1
mov dword [ebp - 0xd0], 0x87013dce
mov dword [ebp - 0x6b8], 0xe2b7
mov dword [ebp - 0x318], 1
mov dword [ebp - 0x28], 0
jmp 0x1001d385
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1001d39b
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x7c4], 0x7f825e7a
jmp 0x1001d37e
mov dword [ebp - 0x28], 0
jmp 0x1001d3ab
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1001d3c1
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1d8], 0x2a83
jmp 0x1001d3a4
mov dword [ebp - 0x28], 0
jmp 0x1001d3d1
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1001d3e7
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x790], 1
jmp 0x1001d3ca
mov dword [ebp - 0xd0], 0
jmp 0x1001d400
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jg 0x1001d4fa
mov dword [ebp - 0x128], 0xffffffff
mov dword [ebp - 0x8c4], 1
mov dword [ebp - 0x8cc], 0xfffffff6
mov dword [ebp - 0x8d4], 0xfffffffa
mov dword [ebp - 0x16c], 0
jmp 0x1001d44e
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 4
jge 0x1001d46a
mov eax, dword [ebp - 0x16c]
mov dword [ebp + eax*4 - 0xaac], 0xffffffff
jmp 0x1001d441
mov dword [ebp - 0x128], 2
jmp 0x1001d483
mov eax, dword [ebp - 0x128]
dec eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jl 0x1001d4da
mov byte [ebp - 0x92], 0
movzx eax, byte [ebp - 0x92]
test eax, eax
je 0x1001d4c6
push 0
push 0xfdb
push 0x440
push 0x197a
push 0x20ee
push 0x1096
push 0x1478
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov eax, dword [ebp - 0x128]
cmp dword [ebp + eax*4 - 0x7c4], 0
je 0x1001d4d8
jmp 0x1001d476
jmp 0x1001d476
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1d8], eax
jmp 0x1001d3f3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d8]
mov dword [ebp - 0x490], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x490]
mov dword [ebp + eax - 0x790], ecx
mov eax, dword [ebp - 0x6b8]
cmp eax, dword [ebp - 0x490]
je 0x1001d53a
mov dword [ebp - 0x550], 1
jmp 0x1001d541
and dword [ebp - 0x550], 0
mov dword [ebp - 0x318], 0xffff
mov eax, dword [ebp - 0x318]
imul eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0x550]
sub ecx, eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x7c4], ecx
jg 0x1001d57a
mov dword [ebp - 0x6c0], 1
jmp 0x1001d581
and dword [ebp - 0x6c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d8]
mov dword [ebp - 0x8dc], eax
mov eax, dword [ebp - 0xd0]
push 4
pop ecx
shl ecx, 0
sub eax, dword [ebp + ecx - 0x790]
jne 0x1001d5bb
mov eax, 0x84365721
test eax, eax
jne 0x1001d5bb
and dword [ebp - 0x320], 0
jmp 0x1001d5c5
mov dword [ebp - 0x320], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x320]
mov dword [ebp + eax - 0x7c4], ecx
lea eax, [ebp - 0x8e4]
push eax
lea ecx, [ebp - 0x7dc]
call fcn.10016d9a
push dword [eax]
lea eax, [ebp - 0x8ec]
push eax
lea ecx, [ebp - 0x7dc]
call fcn.10016dae
push dword [eax]
lea eax, [ebp - 0x954]
push eax
lea ecx, [ebp - 0x7dc]
call fcn.10016d9a
push dword [eax]
mov edx, 0x100185d6
lea ecx, [ebp - 0x95c]
call fcn.10023954
add esp, 0xc
mov dword [ebp - 0x164], 0
jmp 0x1001d63f
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 1
jge 0x1001d65b
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x114], 0x8c6a53d0
jmp 0x1001d632
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x114], 0
jmp 0x1001d689
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x114]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x114], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x114], 0xfffffff7
jg 0x1001d772
mov dword [ebp - 0x498], 0
mov dword [ebp - 0x294], 0xe9fb1c03
mov dword [ebp - 0x338], 0xd9d75405
mov eax, dword [ebp - 0x294]
neg eax
mov dword [ebp - 0x294], eax
mov eax, dword [ebp - 0x338]
sub eax, 0x61fc2da8
cmp dword [ebp - 0x294], eax
jg 0x1001d6e8
mov dword [ebp - 0x328], 1
jmp 0x1001d6ef
and dword [ebp - 0x328], 0
mov dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x498]
cmp eax, dword [ebp - 0x328]
jge 0x1001d713
mov dword [ebp - 0x5b0], 1
jmp 0x1001d71a
and dword [ebp - 0x5b0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x114]
cmp eax, dword [ebp - 0x5b0]
jg 0x1001d73b
mov dword [ebp - 0x330], 1
jmp 0x1001d742
and dword [ebp - 0x330], 0
cmp dword [ebp - 0x330], 0x1f78
jge 0x1001d75a
mov dword [ebp - 0x4a0], 1
jmp 0x1001d761
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x338], eax
jmp 0x1001d66e
lea ecx, [ebp - 0x7dc]
call fcn.10018561
mov dword [ebp - 0x544], eax
mov dword [ebp - 0x5fc], 1
mov dword [ebp - 0x5f8], 1
mov dword [ebp - 0x5f4], 1
mov dword [ebp - 0x5f0], 1
mov dword [ebp - 0x348], 0xffffffff
mov dword [ebp - 0x558], 9
mov dword [ebp - 0x350], 0xc3b7c39c
mov dword [ebp - 0x1e0], 0
jmp 0x1001d7e2
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 1
jge 0x1001d7fe
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0x120], 0
jmp 0x1001d7d5
mov byte [ebp - 0xa0], 0
push 1
lea eax, [ebp - 0xa0]
push eax
call fcn.1001bef6
pop ecx
pop ecx
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x5fc], 0
jmp 0x1001d843
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5fc]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x5fc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5fc], 0
jl 0x1001da07
mov dword [ebp - 0x88], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5fc]
cmp dword [ebp + eax*4 - 0x120], 0
je 0x1001d87d
jmp 0x1001da07
mov dword [ebp - 0x88], 0
jmp 0x1001d896
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jl 0x1001da02
mov dword [ebp - 0x71c], 0
mov dword [ebp - 0x1e8], 0
jmp 0x1001d8c6
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 1
jge 0x1001d8e2
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0x29c], 3
jmp 0x1001d8b9
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x88]
mov eax, dword [ebp + eax - 0x29c]
mov dword [ebp + ecx*4 - 0x120], eax
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp + eax*4 - 0x120]
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0x558]
push 4
pop ecx
shl ecx, 0
add eax, dword [ebp + ecx - 0x5fc]
jne 0x1001d97b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5fc]
mov eax, dword [ebp + eax*4 - 0x120]
add eax, 0xa0e0
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x29c]
jge 0x1001d958
mov dword [ebp - 0x340], 1
jmp 0x1001d95f
and dword [ebp - 0x340], 0
cmp dword [ebp - 0x340], 1
jl 0x1001d974
mov dword [ebp - 0x4a8], 1
jmp 0x1001d97b
and dword [ebp - 0x4a8], 0
mov dword [ebp - 0x348], 0xfff7
mov eax, dword [ebp - 0x348]
mov ecx, dword [ebp - 0x88]
sub eax, dword [ebp + ecx*4 - 0x120]
cmp eax, 1
jge 0x1001d9af
mov eax, 0xac31e13c
test eax, eax
jne 0x1001d9af
and dword [ebp - 0x5c4], 0
jmp 0x1001d9b9
mov dword [ebp - 0x5c4], 1
mov eax, dword [ebp - 0x5c4]
add eax, 0x265ab1a8
neg eax
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x964], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x29c]
mov dword [ebp - 0x96c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x5fc]
mov dword [ebp - 0x71c], eax
jmp 0x1001d889
jmp 0x1001d828
movzx eax, byte [0x10667865]
test eax, eax
je 0x1001da8d
mov ecx, 0x10667924
call fcn.10023635
movzx eax, al
test eax, eax
jne 0x1001da8d
lea eax, [ebp - 0x544]
push eax
lea eax, [ebp - 0x4b0]
push eax
mov ecx, 0x10667924
call fcn.100168ff
lea eax, [ebp - 0x974]
push eax
mov ecx, 0x10667924
call fcn.100168f1
push eax
lea ecx, [ebp - 0x4b0]
call fcn.10016914
movzx eax, al
test eax, eax
je 0x1001da8d
lea ecx, [ebp - 0x4b0]
call fcn.1002363e
mov eax, dword [eax + 4]
mov dword [ebp - 0x724], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7dc]
call fcn.10016674
mov eax, dword [ebp - 0x724]
jmp 0x10021661
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0x64], 0
jmp 0x1001daa7
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1001dabd
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x650], 0
jmp 0x1001daa0
mov dword [ebp - 0x64], 0
jmp 0x1001dacd
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x1001dae3
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x6cc], 0xe1dfe009
jmp 0x1001dac6
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x650], 0xfffffff4
jmp 0x1001db11
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x650]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x650], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x650], 0x16
je 0x1001dcd8
mov dword [ebp - 0x4b8], 1
mov dword [ebp - 0x110], 0x98cafa32
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0x650]
sub eax, dword [ebp + ecx - 0x650]
mov dword [ebp - 0x358], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x358]
mov dword [ebp + eax - 0x6cc], ecx
cmp dword [ebp - 0x358], 0
jne 0x1001db83
or eax, 0xffffffff
jne 0x1001db83
and dword [ebp - 0x560], 0
jmp 0x1001db8d
mov dword [ebp - 0x560], 1
mov eax, dword [ebp - 0x560]
neg eax
cmp eax, 0xfffffffb
jne 0x1001dba6
mov dword [ebp - 0x368], 1
jmp 0x1001dbad
and dword [ebp - 0x368], 0
cmp dword [ebp - 0x4b8], 0xffffffff
jae 0x1001dbc2
mov dword [ebp - 0x360], 1
jmp 0x1001dbc9
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
add eax, dword [ebp - 0x4b8]
cmp eax, 0xe665969a
jb 0x1001dbf4
mov dword [ebp - 0x5bc], 1
jmp 0x1001dbfb
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x368]
cmp eax, dword [ebp - 0x5bc]
jl 0x1001dc22
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6cc], 0
jne 0x1001dc22
and dword [ebp - 0x370], 0
jmp 0x1001dc2c
mov dword [ebp - 0x370], 1
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf8], 0xffffffe9
jmp 0x1001dc51
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0x1c
jg 0x1001dcd3
mov dword [ebp - 0x80c], 0x76a47cde
mov dword [ebp - 0x808], 0x76a47cde
mov dword [ebp - 0x804], 0x76a47cde
mov dword [ebp - 0x800], 0x76a47cde
imul eax, dword [ebp - 0x110], 0
test eax, eax
jne 0x1001dca5
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x80c], 0
jne 0x1001dca5
and dword [ebp - 0x4c0], 0
jmp 0x1001dcaf
mov dword [ebp - 0x4c0], 1
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x110], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x110]
mov dword [ebp + eax - 0x6cc], ecx
jmp 0x1001dc44
jmp 0x1001daf6
and dword [ebp - 0xdc], 0
mov dword [ebp - 0x97c], 0x5ef889a2
mov dword [ebp - 0x2c], 0
jmp 0x1001dcf9
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1001dd0f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x9f8], 0xfffb
jmp 0x1001dcf2
mov dword [ebp - 0x2c], 0
jmp 0x1001dd1f
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x1001dd35
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x984], 0
jmp 0x1001dd18
mov dword [ebp - 0x2c], 0
jmp 0x1001dd45
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x1001dd5b
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x72c], 0
jmp 0x1001dd3e
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x9f8], 0
je 0x1001dd7f
mov eax, 0xdac7
test eax, eax
je 0x1001dd7f
mov dword [ebp - 0x378], 1
jmp 0x1001dd86
and dword [ebp - 0x378], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x9f8]
cmp dword [ebp - 0x378], eax
jl 0x1001dda6
mov dword [ebp - 0x568], 1
jmp 0x1001ddad
and dword [ebp - 0x568], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x568]
mov dword [ebp + eax - 0x72c], ecx
lea eax, [ebp - 0x7dc]
push eax
call fcn.1001a0fd
pop ecx
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jne 0x10021049
mov dword [ebp - 0xb0], 0xfffffffe
mov dword [ebp - 0x2b0], 1
mov dword [ebp - 0x100], 8
mov dword [ebp - 0x1b4], 0x7b568be1
mov dword [ebp - 0x398], 0x5752
mov dword [ebp - 0x2b8], 3
mov dword [ebp - 0x760], 0xcc702b5b
mov dword [ebp - 0x754], 0xffffffff
mov dword [ebp - 0x10], 0
jmp 0x1001de40
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1001de56
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x390], 0x20bd2ab
jmp 0x1001de39
mov dword [ebp - 0x10], 0
jmp 0x1001de66
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1001de7c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x250], 0x57257ea0
jmp 0x1001de5f
mov dword [ebp - 0x10], 0
jmp 0x1001de8c
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1001dea2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x7b8], 1
jmp 0x1001de85
mov dword [ebp - 0x10], 0
jmp 0x1001deb2
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1001dec8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa1c], 0x65392fb3
jmp 0x1001deab
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
je 0x1001def2
cmp dword [ebp - 0xb0], 0
je 0x1001def2
mov dword [ebp - 0x380], 1
jmp 0x1001def9
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0x380]
cmp eax, 0xcbbbc254
jne 0x1001df18
mov dword [ebp - 0x4c8], 1
jmp 0x1001df1f
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x1b4]
cmp eax, dword [ebp - 0x4c8]
jg 0x1001df39
mov dword [ebp - 0x388], 1
jmp 0x1001df40
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0x388], eax
jg 0x1001df5a
mov dword [ebp - 0x5cc], 1
jmp 0x1001df61
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x1b4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x390]
imul eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x734], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x734]
mov dword [ebp + eax - 0x390], ecx
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x98c], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x7b8]
cmp dword [ebp + eax - 0x7b8], ecx
jge 0x1001dfce
mov dword [ebp - 0x4d0], 1
jmp 0x1001dfd5
and dword [ebp - 0x4d0], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x7b8]
cmp dword [ebp - 0x4d0], eax
jle 0x1001e003
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7b8], 0
jne 0x1001e003
and dword [ebp - 0x73c], 0
jmp 0x1001e00d
mov dword [ebp - 0x73c], 1
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x994], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x250]
inc eax
mov dword [ebp - 0x570], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x570]
mov dword [ebp + eax - 0x250], ecx
mov eax, dword [ebp - 0x100]
add eax, dword [ebp - 0xb0]
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0x570], eax
jne 0x1001e078
mov dword [ebp - 0x3a0], 1
jmp 0x1001e07f
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x3a0]
sub eax, 5
cmp eax, dword [ebp - 0xb0]
jge 0x1001e09c
mov dword [ebp - 0x4d8], 1
jmp 0x1001e0a3
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x4d8]
add eax, 0x9d05
cmp dword [ebp - 0xb0], eax
jl 0x1001e0c2
mov dword [ebp - 0x3a8], 1
jmp 0x1001e0c9
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b8], 0
jne 0x1001e1a3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7b8], 0xad8be776
jb 0x1001e101
mov dword [ebp - 0x744], 1
jmp 0x1001e108
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0x99c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x250]
cmp dword [ebp - 0x100], eax
jne 0x1001e135
mov dword [ebp - 0x5d4], 1
jmp 0x1001e13c
and dword [ebp - 0x5d4], 0
cmp dword [ebp - 0x5d4], 0xffffffff
ja 0x1001e151
mov dword [ebp - 0x3b0], 1
jmp 0x1001e158
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x3b0]
sub eax, 0x59a3744a
cmp eax, dword [ebp - 0x1b4]
jge 0x1001e177
mov dword [ebp - 0x288], 1
jmp 0x1001e17e
and dword [ebp - 0x288], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x288]
mov dword [ebp + eax - 0xa1c], ecx
cmp dword [ebp - 0x288], 0
jne 0x1001e1a3
and dword [ebp - 0x4e0], 0
jmp 0x1001e1ad
mov dword [ebp - 0x4e0], 1
mov eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x754], eax
cmp dword [0x10667858], 0
jne 0x10020fac
mov dword [ebp - 0x54], 0x490c4d8e
mov dword [ebp - 0x3e0], 0xa1241a59
mov dword [ebp - 0x698], 7
mov dword [ebp - 0x174], 0
jmp 0x1001e1fa
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 2
jge 0x1001e216
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x620], 0xd3df
jmp 0x1001e1ed
mov dword [ebp - 0x54], 0
jmp 0x1001e226
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jg 0x1001e623
mov dword [ebp - 0xc0], 0xf402e31d
mov dword [ebp - 0xd8], 0xfffffff9
mov dword [ebp - 0x728], 1
mov dword [ebp - 0x258], 0xaf1ba137
mov dword [ebp - 0xc0], 1
jmp 0x1001e271
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jl 0x1001e61e
mov dword [ebp - 0xb8], 0xfc257a10
mov dword [ebp - 0x65c], 0x43f36fc7
mov dword [ebp - 0x1d4], 0
jmp 0x1001e2ab
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 3
jge 0x1001e2c7
mov eax, dword [ebp - 0x1d4]
mov dword [ebp + eax*4 - 0x2c8], 0x478144ad
jmp 0x1001e29e
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x2c8], 0
jmp 0x1001e2f5
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2c8]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x2c8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x2c8], 1
jg 0x1001e4cf
mov dword [ebp - 0xc8], 0xc590f023
mov dword [ebp - 0xc8], 1
jmp 0x1001e32c
mov eax, dword [ebp - 0xc8]
dec eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0
jl 0x1001e354
mov byte [ebp - 0x9d], 0
lea eax, [ebp - 0x9d]
push eax
push 0x3b3c
push 0
call fcn.1001c327
add esp, 0xc
jmp 0x1001e31f
mov eax, dword [ebp - 0x54]
cmp dword [ebp + eax*4 - 0x620], 0
jne 0x1001e483
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0x620]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x3b8]
mov dword [ebp + eax*4 - 0x620], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2c8]
add eax, dword [ebp - 0x3b8]
jne 0x1001e3af
mov eax, 0xd857
test eax, eax
jne 0x1001e3af
and dword [ebp - 0x578], 0
jmp 0x1001e3b9
mov dword [ebp - 0x578], 1
cmp dword [ebp - 0x578], 0x3196e86f
jle 0x1001e3cc
cmp dword [ebp - 0x728], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2c8]
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xb8], 0x421d
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0xb8]
sub ecx, dword [ebp + eax*4 - 0x620]
sub ecx, dword [ebp - 0xc8]
cmp dword [ebp - 0xd8], ecx
jge 0x1001e41f
mov dword [ebp - 0x3c0], 1
jmp 0x1001e426
and dword [ebp - 0x3c0], 0
cmp dword [ebp - 0x3c0], 1
jg 0x1001e43b
mov dword [ebp - 0x4e8], 1
jmp 0x1001e442
and dword [ebp - 0x4e8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2c8]
add eax, dword [ebp - 0x4e8]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x2c8]
jne 0x1001e46f
mov dword [ebp - 0x3c8], 1
jmp 0x1001e476
and dword [ebp - 0x3c8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c8]
cmp dword [ebp - 0x65c], 2
ja 0x1001e498
mov dword [ebp - 0x5c8], 1
jmp 0x1001e49f
and dword [ebp - 0x5c8], 0
cmp dword [ebp - 0x5c8], 0x71d69170
jne 0x1001e4b7
mov dword [ebp - 0x3d0], 1
jmp 0x1001e4be
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x258], eax
jmp 0x1001e2da
mov dword [ebp - 0xb8], 0
jmp 0x1001e4e8
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xffffffeb
jge 0x1001e619
mov dword [ebp - 0x4f0], 0x2a05
push 1
lea eax, [ebp - 0x3e0]
push eax
push 0xf
lea eax, [ebp - 0x258]
push eax
call fcn.1001bf34
add esp, 0x10
mov dword [ebp - 0xd8], 0
jmp 0x1001e532
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x19
jle 0x1001e614
mov dword [ebp - 0x580], 0xfff9
cmp dword [ebp - 0x4f0], 0
je 0x1001e5f5
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x9e0], eax
mov eax, dword [ebp - 0x258]
add eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x4f0]
jge 0x1001e57c
mov dword [ebp - 0x3d8], 1
jmp 0x1001e583
and dword [ebp - 0x3d8], 0
mov eax, dword [ebp - 0x698]
add eax, dword [ebp - 0x3d8]
mov dword [ebp - 0x580], eax
mov eax, dword [ebp - 0x580]
cmp dword [ebp - 0x3e0], eax
je 0x1001e5af
mov dword [ebp - 0x4f8], 1
jmp 0x1001e5b6
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x4f8]
sub eax, 0xac04
cmp eax, 0xffff
je 0x1001e5d4
mov dword [ebp - 0x3e8], 1
jmp 0x1001e5db
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0x3e8]
jne 0x1001e5f5
mov dword [ebp - 0x600], 1
jmp 0x1001e5fc
and dword [ebp - 0x600], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x600]
mov dword [ebp + eax - 0x2c8], ecx
jmp 0x1001e525
jmp 0x1001e4db
jmp 0x1001e264
jmp 0x1001e21f
mov dword [ebp - 0x1bc], 0xfffffff9
mov dword [ebp - 0x17c], 0
jmp 0x1001e646
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 4
jge 0x1001e662
mov eax, dword [ebp - 0x17c]
mov dword [ebp + eax*4 - 0xacc], 1
jmp 0x1001e639
mov dword [ebp - 0x1bc], 0xd
jmp 0x1001e67b
mov eax, dword [ebp - 0x1bc]
dec eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0xffffffef
jl 0x1001e73e
mov dword [ebp - 0x124], 0xe1e2c0d3
push 0
lea eax, [ebp - 0x124]
push eax
call fcn.1001c37d
pop ecx
pop ecx
mov dword [ebp - 0x124], 3
jmp 0x1001e6bb
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jl 0x1001e739
mov dword [ebp - 0x184], 0x928fbc78
mov dword [ebp - 0x184], 3
jmp 0x1001e6e7
mov eax, dword [ebp - 0x184]
dec eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0
jl 0x1001e734
mov byte [ebp - 0x95], 0
lea eax, [ebp - 0x95]
push eax
push 1
call fcn.1001bf81
pop ecx
pop ecx
mov byte [ebp - 0x9b], 0
movzx eax, byte [ebp - 0x9b]
test eax, eax
je 0x1001e732
push 0
push 0x72a9
push 0x1ec4
push 0xd12
call fcn.10023251
add esp, 0x10
jmp 0x1001e6da
jmp 0x1001e6ae
jmp 0x1001e66e
mov dword [ebp - 0xa8], 0xffffffff
mov dword [ebp - 0x9e8], 0x69f4981f
mov dword [ebp - 0x9e4], 3
mov dword [ebp - 0x58], 0
jmp 0x1001e76c
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x1001e782
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x788], 1
jmp 0x1001e765
mov dword [ebp - 0x58], 0
jmp 0x1001e792
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x1001e7a8
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0xa7c], 0x9884cb8
jmp 0x1001e78b
mov byte [ebp - 0x93], 0
movzx eax, byte [ebp - 0x93]
test eax, eax
je 0x1001e7c2
push 0
call fcn.1001c490
pop ecx
mov dword [ebp - 0xa8], 2
jmp 0x1001e7db
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x1001eac8
mov dword [ebp - 0xac], 1
mov dword [ebp - 0x290], 0x22ba7b7e
mov dword [ebp - 0x2b4], 0xf985589b
mov dword [ebp - 0x590], 0x7dcda720
mov dword [ebp - 0xac], 2
jmp 0x1001e829
mov eax, dword [ebp - 0xac]
dec eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0
jl 0x1001eac3
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x738], 0x3489
mov dword [ebp - 0x1e4], 0
jmp 0x1001e863
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 1
jge 0x1001e87f
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0xb4], 0xfbbd0a70
jmp 0x1001e856
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x788]
mov dword [ebp - 0x918], eax
push 4
pop eax
imul eax, eax, 0
imul eax, dword [ebp + eax - 0xb4], 6
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0xb4]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xb4]
jge 0x1001e8c8
mov dword [ebp - 0x3f0], 1
jmp 0x1001e8cf
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0x3f0], eax
jne 0x1001e8e9
mov dword [ebp - 0x500], 1
jmp 0x1001e8f0
and dword [ebp - 0x500], 0
cmp dword [ebp - 0x500], 0xffffffff
jge 0x1001e905
mov dword [ebp - 0x3f8], 1
jmp 0x1001e90c
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x3f8]
sub eax, dword [ebp - 0x290]
je 0x1001e92f
mov eax, 0xeae1
test eax, eax
je 0x1001e92f
mov dword [ebp - 0x588], 1
jmp 0x1001e936
and dword [ebp - 0x588], 0
mov eax, dword [ebp - 0x588]
sub eax, dword [ebp - 0x590]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x788]
je 0x1001e95c
mov dword [ebp - 0x400], 1
jmp 0x1001e963
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0x2b4], eax
jne 0x1001e989
mov dword [ebp - 0x508], 1
jmp 0x1001e990
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x738]
cmp dword [ebp - 0x508], eax
jg 0x1001e9b0
mov eax, 0x79a97a8d
test eax, eax
jne 0x1001e9b0
and dword [ebp - 0x408], 0
jmp 0x1001e9ba
mov dword [ebp - 0x408], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb4]
cmp dword [ebp - 0x408], eax
jl 0x1001e9e4
cmp dword [ebp - 0xa8], 0
je 0x1001e9e4
mov dword [ebp - 0x5d0], 1
jmp 0x1001e9eb
and dword [ebp - 0x5d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb4]
cmp dword [ebp - 0x5d0], eax
jge 0x1001ea19
mov eax, dword [ebp - 0xac]
cmp dword [ebp + eax*4 - 0x788], 0
jne 0x1001ea19
and dword [ebp - 0x410], 0
jmp 0x1001ea23
mov dword [ebp - 0x410], 1
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
imul eax, dword [ebp - 0x410]
test eax, eax
jne 0x1001ea4d
mov dword [ebp - 0x510], 1
jmp 0x1001ea54
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp + eax*4 - 0x788]
cmp eax, dword [ebp - 0x510]
jl 0x1001ea85
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb4], 0
je 0x1001ea85
mov dword [ebp - 0x418], 1
jmp 0x1001ea8c
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x418]
sub eax, dword [ebp - 0x590]
cmp eax, 0x26ff23b1
je 0x1001eaab
mov dword [ebp - 0x420], 1
jmp 0x1001eab2
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x290], eax
jmp 0x1001e81c
jmp 0x1001e7ce
mov byte [ebp - 0x154], 0
mov byte [ebp - 0x153], 0x92
mov byte [ebp - 0x152], 0x12
mov byte [ebp - 0x151], 0xb1
mov byte [ebp - 0x150], 0xc2
mov byte [ebp - 0x14f], 0xb8
mov byte [ebp - 0x14e], 0x4f
mov byte [ebp - 0x14d], 0x82
mov byte [ebp - 0x14c], 0xa0
mov byte [ebp - 0x14b], 0x7a
mov byte [ebp - 0x14a], 0xfa
mov byte [ebp - 0x149], 0x9c
mov byte [ebp - 0x148], 0x3a
mov byte [ebp - 0x147], 0xd3
mov byte [ebp - 0x146], 0xf5
mov byte [ebp - 0x145], 0x9d
mov byte [ebp - 0x144], 0x26
mov byte [ebp - 0x143], 0x57
mov byte [ebp - 0x142], 0xc1
mov byte [ebp - 0x141], 0x2f
mov byte [ebp - 0x140], 0x2d
mov byte [ebp - 0x13f], 1
mov byte [ebp - 0x13e], 0x2e
mov byte [ebp - 0x13d], 4
mov byte [ebp - 0x13c], 0
mov byte [ebp - 0x13b], 7
mov byte [ebp - 0x13a], 0x57
mov byte [ebp - 0x139], 2
mov byte [ebp - 0x138], 0x40
mov byte [ebp - 0x137], 5
mov byte [ebp - 0x136], 0x1e
mov byte [ebp - 0x135], 9
mov byte [ebp - 0x134], 8
mov byte [ebp - 0x133], 0xb
mov byte [ebp - 0x132], 8
mov byte [ebp - 0x131], 0xa
mov byte [ebp - 0x130], 0
mov byte [ebp - 0x12f], 6
mov byte [ebp - 0x12e], 0x5f
mov byte [ebp - 0x12d], 3
mov byte [ebp - 0x12c], 0x5d
mov byte [ebp - 0x12b], 8
mov byte [ebp - 0x12a], 0x40
mov dword [ebp - 0x48], 0xbdba76aa
mov dword [ebp - 0x18c], 0
jmp 0x1001ec15
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 2
jge 0x1001ec31
mov eax, dword [ebp - 0x18c]
mov dword [ebp + eax*4 - 0x244], 0
jmp 0x1001ec08
mov dword [ebp - 0x48], 0
jmp 0x1001ec41
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jg 0x1001ed8c
mov dword [ebp - 0x268], 0xfffffffe
mov dword [ebp - 0x708], 0xfdb7b241
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0x244], 0
je 0x1001ec85
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0x244], 0
je 0x1001ec85
mov dword [ebp - 0x518], 1
jmp 0x1001ec8c
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x518]
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
je 0x1001ed2d
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x244]
mov dword [ebp - 0x9bc], eax
cmp dword [ebp - 0x268], 0x4f3f
jl 0x1001eccd
mov dword [ebp - 0x664], 1
jmp 0x1001ecd4
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x244]
mov dword [ebp - 0x868], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x244]
mov dword [ebp - 0x948], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x870], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x244]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x244]
jne 0x1001ed21
xor eax, eax
inc eax
je 0x1001ed2d
mov dword [ebp - 0x428], 1
jmp 0x1001ed34
and dword [ebp - 0x428], 0
cmp dword [ebp - 0x428], 0x62d7bc3
jl 0x1001ed4c
mov dword [ebp - 0x5e8], 1
jmp 0x1001ed53
and dword [ebp - 0x5e8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x244]
cmp dword [ebp - 0x5e8], eax
jg 0x1001ed74
mov dword [ebp - 0x430], 1
jmp 0x1001ed7b
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x708], eax
jmp 0x1001ec3a
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x154]
or eax, 0xd9
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x154]
and ecx, 0xd9
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x154]
mov word [ebp + ecx*2 - 0x858], ax
mov dword [ebp - 0x78], 0xfffffffc
mov dword [ebp - 0x438], 8
mov dword [ebp - 0x108], 0xca4e8652
mov dword [ebp - 0x2ac], 0x7d1dc6b7
mov dword [ebp - 0x598], 0x6fec1b16
mov dword [ebp - 0x90], 0xffffffff
mov dword [ebp - 0x528], 0x65ee6d54
mov dword [ebp - 0x190], 0
jmp 0x1001ee27
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 3
jge 0x1001ee43
mov eax, dword [ebp - 0x190]
mov dword [ebp + eax*4 - 0x90c], 1
jmp 0x1001ee1a
cmp dword [ebp - 0x78], 0
jne 0x1001eeac
cmp dword [ebp - 0x78], 0
jne 0x1001eeac
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x78], eax
jle 0x1001ee63
mov dword [ebp - 0x520], 1
jmp 0x1001ee6a
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x990], eax
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x878], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x438]
sub eax, dword [ebp - 0x2ac]
je 0x1001eeb5
cmp dword [ebp - 0x108], 0
jne 0x1001eebc
cmp dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x66c], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x66c]
mov dword [ebp + eax - 0x90c], ecx
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x950], eax
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x598], eax
mov eax, dword [ebp - 0x598]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x90], eax
jle 0x1001ef12
mov dword [ebp - 0x440], 1
jmp 0x1001ef19
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 0
je 0x1001ef65
mov dword [ebp - 0x90], 0
jmp 0x1001ef47
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x1001ef63
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x90c], 9
jmp 0x1001ef3a
jmp 0x1001ef85
mov byte [ebp - 0x94], 0
movzx eax, byte [ebp - 0x94]
test eax, eax
je 0x1001ef85
push 1
push 0x2014
call fcn.1001bfdb
pop ecx
pop ecx
mov dword [ebp - 0x20], 2
and dword [ebp - 0x11c], 0
jmp 0x1001ef9d
mov eax, dword [ebp - 0x20]
inc eax
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2b
jae 0x1001f52d
mov dword [ebp - 0x38], 0xa48bbca6
mov dword [ebp - 0x750], 0x30b9
mov dword [ebp - 0x740], 0xffffffff
mov dword [ebp - 0x68c], 9
mov dword [ebp - 0x67c], 0x4c5f6b4a
mov dword [ebp - 0x198], 0
jmp 0x1001efef
mov eax, dword [ebp - 0x198]
inc eax
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 4
jge 0x1001f00b
mov eax, dword [ebp - 0x198]
mov dword [ebp + eax*4 - 0xabc], 0x265d
jmp 0x1001efe2
mov dword [ebp - 0x38], 0
jmp 0x1001f01b
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xf
jle 0x1001f14e
mov dword [ebp - 0x1c4], 0xffffffff
mov dword [ebp - 0x718], 0x6c93846f
mov dword [ebp - 0x710], 0xffffffff
cmp dword [ebp - 0x1c4], 0
jne 0x1001f0b9
imul eax, dword [ebp - 0x38], 0x2a8d
cmp dword [ebp - 0x1c4], eax
jne 0x1001f067
mov dword [ebp - 0x448], 1
jmp 0x1001f06e
and dword [ebp - 0x448], 0
cmp dword [ebp - 0x448], 0x9507
jle 0x1001f086
mov dword [ebp - 0x5d8], 1
jmp 0x1001f08d
and dword [ebp - 0x5d8], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x5d8], eax
jl 0x1001f0a4
mov dword [ebp - 0x450], 1
jmp 0x1001f0ab
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x1c4]
cmp eax, dword [ebp - 0x450]
jg 0x1001f0cc
mov eax, 0x7335
test eax, eax
je 0x1001f0cc
push 1
call fcn.1001c00d
pop ecx
jmp 0x1001f149
mov dword [ebp - 0x674], 0xf2c9a130
mov dword [ebp - 0x530], 0x58b
mov dword [ebp - 0x684], 0xf9491450
lea eax, [ebp - 0x750]
push eax
push 0
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x710]
push eax
lea eax, [ebp - 0x67c]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x740]
push eax
lea eax, [ebp - 0x1c4]
push eax
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x718]
push eax
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x530]
push eax
call fcn.1001c05c
add esp, 0x30
cmp dword [ebp - 0x530], 0
je 0x1001f149
jmp 0x1001f14e
jmp 0x1001f014
mov dword [ebp - 0x38], 3
jmp 0x1001f15e
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1001f1dd
mov dword [ebp - 0x880], 0x942fafec
mov dword [ebp - 0x9dc], 0xa458230b
mov dword [ebp - 0x85c], 1
mov dword [ebp - 0x958], 0x62cc684c
mov dword [ebp - 0x458], 0x3368
mov dword [ebp - 0x19c], 0
jmp 0x1001f1af
mov eax, dword [ebp - 0x19c]
inc eax
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 3
jge 0x1001f1cb
mov eax, dword [ebp - 0x19c]
mov dword [ebp + eax*4 - 0xa58], 0x82e70d5d
jmp 0x1001f1a2
mov eax, dword [ebp - 0x458]
dec eax
mov dword [ebp - 0x458], eax
jmp 0x1001f157
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x154]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x20], eax
jne 0x1001f498
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x538], 0
mov dword [ebp - 0x75c], 0
mov dword [ebp - 0x694], 0
cmp dword [ebp - 0x298], 0xffffffff
jne 0x1001f281
mov byte [ebp - 0x96], 0
movzx eax, byte [ebp - 0x96]
test eax, eax
je 0x1001f27c
push 0x2eb9
push 1
push 0x6520
push 0x1884
push 0x20d1
push 0x4ae6
push 0x555b
push 0x6771
push 0x72ac
push 0x16e4
push 0x542f
push 0x406d
call fcn.1001c05c
add esp, 0x30
jmp 0x1001f36f
mov dword [ebp - 0x1dc], 0
jmp 0x1001f29a
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 1
jge 0x1001f2b6
mov eax, dword [ebp - 0x1dc]
mov dword [ebp + eax*4 - 0x270], 0
jmp 0x1001f28d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x270], 0
jne 0x1001f2e4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x270]
cmp dword [ebp - 0x298], eax
jg 0x1001f2e4
and dword [ebp - 0x5a0], 0
jmp 0x1001f2ee
mov dword [ebp - 0x5a0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x270]
cmp dword [ebp - 0x5a0], eax
jle 0x1001f30f
mov dword [ebp - 0x460], 1
jmp 0x1001f316
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x538], eax
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x890], eax
cmp dword [ebp - 0x298], 0x7979b389
jle 0x1001f346
mov dword [ebp - 0x468], 1
jmp 0x1001f34d
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0x75c], eax
push 1
lea eax, [ebp - 0x694]
push eax
push 0x4eaf
call fcn.1001c291
add esp, 0xc
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x154]
inc eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x74], 0x24a8c6a5
mov dword [ebp - 0x74], 0
jmp 0x1001f398
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0x1b
jne 0x1001f3b7
mov byte [ebp - 0x98], 0
push 1
lea eax, [ebp - 0x98]
push eax
call fcn.1001c2ce
pop ecx
pop ecx
jmp 0x1001f391
mov dword [ebp - 0x74], 0xffffffe7
jmp 0x1001f3c7
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xffffffeb
jg 0x1001f3e9
mov dword [ebp - 0x720], 0
lea eax, [ebp - 0x720]
push eax
push 0
call fcn.1001c3e8
pop ecx
pop ecx
jmp 0x1001f3c0
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x154]
mov ecx, dword [ebp - 0x20]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x998], 0xfffffffe
mov dword [ebp - 0x89c], 0xe53d8da8
mov dword [ebp - 0x960], 0xe0b4074d
mov dword [ebp - 0x8a8], 0xffffffff
mov dword [ebp - 0x9d0], 1
mov dword [ebp - 0x8b0], 1
mov dword [ebp - 0x968], 0xfffffff9
mov dword [ebp - 0x69c], 0x7543
mov dword [ebp - 0x1a4], 0
jmp 0x1001f467
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 4
jge 0x1001f483
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0xa8c], 5
jmp 0x1001f45a
push 0
lea eax, [ebp - 0x69c]
push eax
call fcn.1001c92f
pop ecx
pop ecx
jmp 0x1001ef95
mov eax, dword [ebp - 0x20]
movzx eax, byte [ebp + eax - 0x153]
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x11c]
movzx ecx, byte [ebp + ecx - 0x156]
movzx ecx, word [ebp + ecx*2 - 0x858]
add eax, ecx
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0x153]
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x11c]
movzx edx, byte [ebp + edx - 0x156]
movzx edx, word [ebp + edx*2 - 0x858]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0x153]
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x11c]
movzx edx, byte [ebp + edx - 0x156]
movzx edx, word [ebp + edx*2 - 0x858]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x20]
movzx ecx, byte [ebp + ecx - 0x154]
mov word [ebp + ecx*2 - 0x858], ax
and dword [ebp - 0x11c], 0
jmp 0x1001ef95
mov dword [ebp - 0x4c], 0xd16df251
mov dword [ebp - 0x1cc], 0
jmp 0x1001f54d
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 3
jge 0x1001f569
mov eax, dword [ebp - 0x1cc]
mov dword [ebp + eax*4 - 0xa34], 0xa8c6a53d
jmp 0x1001f540
mov dword [ebp - 0x4c], 0
jmp 0x1001f579
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x1001f58f
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xa34], 0xfffffffd
jmp 0x1001f572
mov dword [ebp - 0x4c], 0
jmp 0x1001f59f
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xfffffff0
jl 0x1001f5c7
mov dword [ebp - 0x748], 0xfffffff8
push 0x3d72
lea eax, [ebp - 0x748]
push eax
push 1
call fcn.1001c327
add esp, 0xc
jmp 0x1001f598
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0x858], cx
lea eax, [ebp - 0x858]
push eax
lea ecx, [ebp - 0xa70]
call fcn.10023587
mov dword [ebp - 0x6a4], eax
mov eax, dword [ebp - 0x6a4]
mov dword [ebp - 0x6e0], eax
mov byte [ebp - 4], 2
push dword [ebp - 0x6e0]
call fcn.1001a0fd
pop ecx
mov dword [ebp - 0x4bc], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa70]
call fcn.10016674
mov dword [ebp - 0xf0], 1
mov dword [ebp - 0x6ac], 0xc6f1bf50
mov dword [ebp - 0xf0], 0
jmp 0x1001f64d
mov eax, dword [ebp - 0xf0]
dec eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0xfffffff5
je 0x1001f684
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x6ac], eax
mov byte [ebp - 0x9a], 0
movzx eax, byte [ebp - 0x9a]
test eax, eax
je 0x1001f682
push 1
push 0x7418
call fcn.1001c37d
pop ecx
pop ecx
jmp 0x1001f640
and dword [ebp - 0x1ec], 0
jmp 0x1001f69a
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 0xd
jae 0x1001fa06
mov dword [ebp - 0x1c], 0x2c7c8a6b
mov dword [ebp - 0x7ec], 0x869e
mov dword [ebp - 0x7e8], 0x869e
mov dword [ebp - 0x7e4], 0x869e
mov dword [ebp - 0x7e0], 0x869e
mov dword [ebp - 0x50], 0
jmp 0x1001f6e6
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x1001f6fc
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x628], 0
jmp 0x1001f6df
mov dword [ebp - 0x50], 0
jmp 0x1001f70c
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 2
jge 0x1001f722
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x6d8], 0x1dc6b79d
jmp 0x1001f705
cmp dword [ebp - 0x1c], 0
jne 0x1001f7bb
or eax, 0xffffffff
sub eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
je 0x1001f743
mov dword [ebp - 0x5ec], 1
jmp 0x1001f74a
and dword [ebp - 0x5ec], 0
imul eax, dword [ebp - 0x5ec], 0xf996
cmp eax, 2
je 0x1001f765
mov dword [ebp - 0x2d0], 1
jmp 0x1001f76c
and dword [ebp - 0x2d0], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x2d0]
jne 0x1001f77d
cmp dword [ebp - 0x1c], 0
je 0x1001f792
mov eax, 0x6ae49a2f
test eax, eax
je 0x1001f792
mov dword [ebp - 0x2d4], 1
jmp 0x1001f799
and dword [ebp - 0x2d4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2d4]
mov dword [ebp + eax - 0x6d8], ecx
cmp dword [ebp - 0x1c], 0
jne 0x1001f7bb
and dword [ebp - 0x2e4], 0
jmp 0x1001f7c5
mov dword [ebp - 0x2e4], 1
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2dc], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2dc]
mov dword [ebp + eax - 0x628], ecx
mov eax, dword [ebp - 0x2dc]
add eax, dword [ebp - 0x2e4]
je 0x1001f826
mov eax, 0x955a
test eax, eax
je 0x1001f826
mov dword [ebp - 0x1c], 0
jmp 0x1001f80b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1001f821
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6d8], 0xdf29855e
jmp 0x1001f804
jmp 0x1001f9f1
mov dword [ebp - 0x314], 0x9ac92d14
mov dword [ebp - 0x1ac], 0
jmp 0x1001f849
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 2
jge 0x1001f865
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0x2a8], 0xec1b16eb
jmp 0x1001f83c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2a8]
mov dword [ebp - 0x8b8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2a8]
mov dword [ebp - 0x9a0], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x628]
cmp dword [ebp + eax - 0x2a8], ecx
jle 0x1001f8b3
mov dword [ebp - 0x2ec], 1
jmp 0x1001f8ba
and dword [ebp - 0x2ec], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x2a8]
cmp dword [ebp - 0x2ec], eax
jne 0x1001f8db
mov dword [ebp - 0x2f4], 1
jmp 0x1001f8e2
and dword [ebp - 0x2f4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a8]
cmp dword [ebp - 0x2f4], eax
je 0x1001f903
mov dword [ebp - 0x2fc], 1
jmp 0x1001f90a
and dword [ebp - 0x2fc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x628]
cmp eax, dword [ebp - 0x2fc]
je 0x1001f92b
mov dword [ebp - 0x304], 1
jmp 0x1001f932
and dword [ebp - 0x304], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x304]
sub ecx, dword [ebp + eax - 0x2a8]
cmp ecx, 0x4380d33b
jne 0x1001f959
mov dword [ebp - 0x30c], 1
jmp 0x1001f960
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x314], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2a8]
cmp dword [ebp - 0x314], eax
jle 0x1001f98d
mov dword [ebp - 0x6e4], 1
jmp 0x1001f994
and dword [ebp - 0x6e4], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x8c0], eax
push 8
pop eax
neg eax
cmp eax, 0xfa014801
jbe 0x1001f9b5
mov dword [ebp - 0x6b4], 1
jmp 0x1001f9bc
and dword [ebp - 0x6b4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7ec]
mov dword [ebp - 0x970], eax
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x6d8]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x628], eax
xor eax, eax
mov ecx, dword [ebp - 0x1ec]
mov word [ebp + ecx*2 - 0x858], ax
jmp 0x1001f68d
mov dword [ebp - 0x278], 0xffffffff
mov dword [ebp - 0x60], 0
jmp 0x1001fa20
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x1001fa36
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x644], 0x41651328
jmp 0x1001fa19
mov dword [ebp - 0x60], 0
jmp 0x1001fa46
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1001fa5c
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x898], 0xffffffff
jmp 0x1001fa3f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x644], 0
jne 0x1001fafa
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x644]
mov dword [ebp - 0x8c8], eax
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x9d4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x644], 0
jne 0x1001faab
mov dword [ebp - 0x31c], 1
jmp 0x1001fab2
and dword [ebp - 0x31c], 0
cmp dword [ebp - 0x31c], 0xadacd7d3
jne 0x1001faca
mov dword [ebp - 0x324], 1
jmp 0x1001fad1
and dword [ebp - 0x324], 0
cmp dword [ebp - 0x324], 3
je 0x1001fae8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x644], 0
mov eax, 0xcee61780
test eax, eax
jne 0x1001fafa
and dword [ebp - 0x32c], 0
jmp 0x1001fb04
mov dword [ebp - 0x32c], 1
mov eax, dword [ebp - 0x32c]
sub eax, dword [ebp - 0x278]
jne 0x1001fb2b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x644], 0
jne 0x1001fb2b
and dword [ebp - 0x334], 0
jmp 0x1001fb35
mov dword [ebp - 0x334], 1
mov eax, 0x951a
sub eax, dword [ebp - 0x334]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x644]
add eax, dword [ebp - 0x278]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x898], eax
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x1001fb7a
push 1
call fcn.1001c3af
pop ecx
cmp dword [ebp - 0x4bc], 0
je 0x10020fac
mov dword [ebp - 0x34], 0xe8cff0ea
mov dword [ebp - 0x83c], 0x9b4a
mov dword [ebp - 0x838], 0x9b4a
mov dword [ebp - 0x834], 0x9b4a
mov dword [ebp - 0x830], 0x9b4a
mov dword [ebp - 0x34], 0
jmp 0x1001fbc6
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x17
jne 0x1001fe02
mov dword [ebp - 0xc4], 0xffffffff
mov dword [ebp - 0xc4], 0
jmp 0x1001fbf3
cmp dword [ebp - 0xc4], 0xffffffea
je 0x1001fdfd
mov dword [ebp - 0xbc], 0x7d65121a
mov dword [ebp - 0xf4], 0x83398963
mov dword [ebp - 0x168], 0
jmp 0x1001fc2d
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 2
jge 0x1001fc49
mov eax, dword [ebp - 0x168]
mov dword [ebp + eax*4 - 0x7a8], 0x1fc3eee2
jmp 0x1001fc20
mov dword [ebp - 0xbc], 1
jmp 0x1001fc62
cmp dword [ebp - 0xbc], 0
jl 0x1001fda9
mov dword [ebp - 0x2bc], 0x43836745
mov eax, dword [ebp - 0xbc]
cmp dword [ebp + eax*4 - 0x7a8], 0
jae 0x1001fc95
mov dword [ebp - 0xf4], 1
jmp 0x1001fdc2
jmp 0x1001fbbf
mov dword [ebp - 0x34], 0
jmp 0x1001fe12
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x1001fe28
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x83c], 0x74fd
jmp 0x1001fe0b
mov dword [ebp - 0x170], 0xe0a8eac8
mov byte [ebp - 0x97], 0
movzx eax, byte [ebp - 0x97]
test eax, eax
je 0x1001fe4e
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0x170], 0
jmp 0x1001fe67
cmp dword [ebp - 0x170], 0xfffffff7
jg 0x1001fec0
mov dword [ebp - 0x178], 0xfffffffb
mov dword [ebp - 0x178], 0
jmp 0x1001fe93
cmp dword [ebp - 0x178], 3
jl 0x1001febe
mov dword [ebp - 0x81c], 1
mov dword [ebp - 0x818], 1
mov dword [ebp - 0x814], 1
mov dword [ebp - 0x810], 1
mov dword [ebp - 0x180], 0
jmp 0x1001ff01
cmp dword [ebp - 0x180], 2
jge 0x1001ff1d
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x758], 0xef72d4ea
push 1
call fcn.1001cb8a
pop ecx
mov dword [ebp - 0x104], 0xffffffe5
jmp 0x10020fe1
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0xfffffff6
jge 0x1002102b
cmp dword [ebp - 0x104], 0
jne 0x10020fff
mov dword [ebp - 0x4c4], 1
jmp 0x10021006
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0x758], eax
mov byte [ebp - 0x91], 0
push 1
lea eax, [ebp - 0x91]
push eax
call fcn.1001cbc8
pop ecx
pop ecx
jmp 0x10020fd4
cmp dword [0x10667858], 0
je 0x10021049
mov ecx, dword [ebp + 8]
call fcn.100235ac
push eax
call dword [0x10667858]
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0x30], 0x8a87013d
mov dword [ebp - 0x658], 0xb4b5a9ce
mov dword [ebp - 0x4fc], 0xfffffffb
mov dword [ebp - 0x15c], 0xfff8
mov dword [ebp - 0x670], 3
mov dword [ebp - 0x978], 1
mov dword [ebp - 0x920], 1
mov dword [ebp - 0x53c], 0x87f9bd85
mov dword [ebp - 0x9a8], 0x2a
mov dword [ebp - 0x68], 0
jmp 0x100210b0
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x100210c6
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x618], 0xffffffff
jmp 0x100210a9
mov dword [ebp - 0x68], 0
jmp 0x100210d6
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x100210ec
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x660], 0xfcb44481
jmp 0x100210cf
mov dword [ebp - 0x30], 0
jmp 0x100210fc
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jg 0x1002140c
mov dword [ebp - 0x10c], 0x60e704f3
mov dword [ebp - 0x160], 1
mov dword [ebp - 0x668], 0xf89f2e07
mov dword [ebp - 0x928], 0xfffffffe
mov dword [ebp - 0x1d0], 0
jmp 0x10021147
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 2
jge 0x10021163
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0x8a4], 0x7e784b52
jmp 0x1002113a
mov dword [ebp - 0x10c], 0xa66e
cmp dword [ebp - 0x10c], 0
je 0x1002124d
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x618]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x618]
cmp eax, dword [ebp - 0x10c]
jge 0x100211ab
mov dword [ebp - 0x4d4], 1
jmp 0x100211b2
and dword [ebp - 0x4d4], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x618], ecx
jne 0x100211d3
mov eax, 0x39d6b9c
test eax, eax
jne 0x100211d3
and dword [ebp - 0x700], 0
jmp 0x100211dd
mov dword [ebp - 0x700], 1
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x980], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp + eax*4 - 0x618], 8
jle 0x100211ff
mov dword [ebp - 0x4cc], 1
jmp 0x10021206
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0
jne 0x10021229
or eax, 0xffffffff
jne 0x10021229
and dword [ebp - 0x4dc], 0
jmp 0x10021233
mov dword [ebp - 0x4dc], 1
mov eax, dword [ebp - 0x4d4]
add eax, dword [ebp - 0x4dc]
je 0x1002124d
mov dword [ebp - 0x4e4], 1
jmp 0x10021254
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x618]
cmp dword [ebp - 0x4e4], eax
je 0x1002127b
cmp dword [ebp - 0x10c], 0
je 0x1002127b
mov dword [ebp - 0x4ec], 1
jmp 0x10021282
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x4ec], eax
jne 0x10021299
mov dword [ebp - 0x4f4], 1
jmp 0x100212a0
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x4f4]
mov dword [ebp - 0x658], eax
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x930], eax
cmp dword [ebp - 0x4fc], 0
jne 0x100212cd
mov dword [ebp - 0x504], 1
jmp 0x100212d4
and dword [ebp - 0x504], 0
cmp dword [ebp - 0x504], 0xfad034e7
jne 0x100212ec
mov dword [ebp - 0x50c], 1
jmp 0x100212f3
and dword [ebp - 0x50c], 0
mov eax, dword [ebp - 0x50c]
add eax, 0x6ee3
cmp eax, 0xfffe
ja 0x10021312
xor eax, eax
jne 0x10021312
and dword [ebp - 0x514], 0
jmp 0x1002131c
mov dword [ebp - 0x514], 1
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x514]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x660]
sub eax, dword [ebp - 0x160]
neg eax
jne 0x1002134f
cmp dword [ebp - 0x668], 0
jne 0x1002134f
and dword [ebp - 0x51c], 0
jmp 0x10021359
mov dword [ebp - 0x51c], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x51c]
mov dword [ebp + eax - 0x8a4], ecx
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x9d8], eax
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp + eax*4 - 0x618]
mov ecx, dword [ebp - 0x30]
sub eax, dword [ebp + ecx*4 - 0x618]
cmp dword [ebp - 0x15c], eax
jl 0x100213b6
cmp dword [ebp - 0x15c], 0
je 0x100213b6
mov dword [ebp - 0x524], 1
jmp 0x100213bd
and dword [ebp - 0x524], 0
cmp dword [ebp - 0x524], 0x426cefc6
jg 0x100213d5
mov dword [ebp - 0x52c], 1
jmp 0x100213dc
and dword [ebp - 0x52c], 0
cmp dword [ebp - 0x52c], 0x39d2
jle 0x100213f4
mov dword [ebp - 0x534], 1
jmp 0x100213fb
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x160], eax
jmp 0x100210f5
mov eax, dword [ebp - 0x53c]
dec eax
mov dword [ebp - 0x53c], eax
cmp dword [ebp - 0xdc], 0
je 0x10021640
movzx eax, byte [0x10667865]
test eax, eax
je 0x10021446
mov ecx, 0x10667924
call fcn.10023635
movzx eax, al
test eax, eax
jne 0x10021640
lea eax, [ebp - 0x544]
push eax
lea eax, [ebp - 0xdc]
push eax
push 0x10667924
push 1
call fcn.1001cc2c
add esp, 0x10
mov dword [ebp - 0x118], 0x3245f1db
mov dword [ebp - 0x574], 0xfffffffd
mov dword [ebp - 0x678], 0
mov dword [ebp - 0x680], 0x89f7a9d2
mov dword [ebp - 0x688], 0x3388a019
mov dword [ebp - 0x70], 0
jmp 0x100214a5
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x100214bb
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x54c], 0xf68029
jmp 0x1002149e
mov dword [ebp - 0x70], 0
jmp 0x100214cb
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x100214e1
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xa28], 0x4ba31e46
jmp 0x100214c4
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x938], eax
cmp dword [ebp - 0x118], 0x208373b2
jle 0x10021502
cmp dword [ebp - 0x118], 0
jne 0x1002151b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x54c], 0
jne 0x1002151b
and dword [ebp - 0x554], 0
jmp 0x10021525
mov dword [ebp - 0x554], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x54c]
cmp eax, dword [ebp - 0x554]
jle 0x10021546
mov dword [ebp - 0x55c], 1
jmp 0x1002154d
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x55c]
jg 0x10021567
mov dword [ebp - 0x564], 1
jmp 0x1002156e
and dword [ebp - 0x564], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x564]
mov dword [ebp + eax - 0xa28], ecx
cmp dword [ebp - 0x574], 0x4a61bf07
jge 0x100215a2
mov eax, 0x8593f9be
test eax, eax
je 0x100215a2
mov dword [ebp - 0x56c], 1
jmp 0x100215a9
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x678]
cmp dword [ebp - 0x56c], eax
jle 0x100215c3
mov dword [ebp - 0x57c], 1
jmp 0x100215ca
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x574]
cmp dword [ebp - 0x57c], eax
jg 0x100215e4
mov dword [ebp - 0x584], 1
jmp 0x100215eb
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x118]
cmp eax, dword [ebp - 0x584]
jle 0x10021605
mov dword [ebp - 0x58c], 1
jmp 0x1002160c
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0x680]
cmp dword [ebp - 0x58c], eax
jle 0x10021626
mov dword [ebp - 0x594], 1
jmp 0x1002162d
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x688], eax
mov byte [0x10667865], 1
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x690], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7dc]
call fcn.10016674
mov eax, dword [ebp - 0x690]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret