Function at 0x1001e125
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10089c82
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x39c
push esi
push 2
lea ecx, [ebp - 0x294]
call fcn.10019343
and dword [ebp - 4], 0
mov dword [ebp - 0x1d4], 0xb0bf2465
mov dword [ebp - 0x1f8], 1
mov dword [ebp - 0x218], 0x859495e0
mov dword [ebp - 0x1d0], 0xa30b9130
mov dword [ebp - 0x200], 0xeed08e15
push 1
lea ecx, [ebp - 0x2ac]
call fcn.10019343
mov byte [ebp - 4], 1
mov dword [ebp - 0x44], 0
jmp 0x1001e1a8
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x1001e1c1
push dword [ebp - 0x44]
lea ecx, [ebp - 0x294]
call fcn.100193d1
or dword [eax], 0xffffffff
jmp 0x1001e1a1
push 0x10b8
push 0x1b7f
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x44]
push eax
push 0
call fcn.10020766
add esp, 0x14
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x1d0]
push eax
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x1d4]
push eax
push 0
push 0x4790
call fcn.1001ddb0
add esp, 0x24
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2ac]
call fcn.100193cc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x294]
call fcn.100193cc
lea eax, [ebp - 0xd0]
push eax
push 0
push 0x4351
call fcn.1001e071
add esp, 0xc
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x30], 0x6ec6e54e
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x58], 0
jmp 0x1001e279
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x1001e28f
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x278], 0xb57f
jmp 0x1001e272
mov dword [ebp - 0x28], 1
jmp 0x1001e29f
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x1001e61a
mov dword [ebp - 0x14c], 0xfb807cfa
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x50], 0xcc424770
mov dword [ebp - 0x238], 0x790660d6
mov dword [ebp - 0x60], 0
jmp 0x1001e2db
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 4
jge 0x1001e2f1
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x288], 0x8ab5457d
jmp 0x1001e2d4
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x278]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x210]
cmp eax, dword [ebp - 0x1dc]
jg 0x1001e32b
mov dword [ebp - 0x138], 1
jmp 0x1001e332
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x138]
sub eax, 0x2879a6db
cmp eax, 0x9017
jl 0x1001e350
mov dword [ebp - 0x184], 1
jmp 0x1001e357
and dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
add eax, 8
cmp eax, 0xfffa
jne 0x1001e379
mov dword [ebp - 0xcc], 1
jmp 0x1001e380
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x1001e3a4
cmp dword [ebp - 0x238], 0
je 0x1001e3a4
mov dword [ebp - 0x1c0], 1
jmp 0x1001e3ab
and dword [ebp - 0x1c0], 0
cmp dword [ebp - 0x1c0], 0xd924
je 0x1001e3c3
mov dword [ebp - 0xd4], 1
jmp 0x1001e3ca
and dword [ebp - 0xd4], 0
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x184]
imul eax, dword [ebp - 0xd4]
test eax, eax
je 0x1001e5ef
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x288], 0
je 0x1001e5ef
mov dword [ebp - 0x1ec], 0xffffffff
mov dword [ebp - 0x50], 0
jmp 0x1001e410
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jg 0x1001e5d9
mov dword [ebp - 0x1e4], 0xac92d14b
push 1
lea ecx, [ebp - 0x224]
call fcn.10019343
mov dword [ebp - 4], 2
mov dword [ebp - 0x80], 0
jmp 0x1001e448
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x1001e464
push dword [ebp - 0x80]
lea ecx, [ebp - 0x224]
call fcn.100193d1
mov dword [eax], 1
jmp 0x1001e441
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x278], 0
jne 0x1001e59e
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x2fc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x288]
imul eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x68]
jle 0x1001e4b2
cmp dword [ebp - 0x1e4], 0
jne 0x1001e4b2
and dword [ebp - 0xdc], 0
jmp 0x1001e4bc
mov dword [ebp - 0xdc], 1
push 0
lea ecx, [ebp - 0x224]
call fcn.100193d1
mov ecx, dword [ebp - 0xdc]
cmp ecx, dword [eax]
je 0x1001e4df
mov dword [ebp - 0x1a4], 1
jmp 0x1001e4e6
and dword [ebp - 0x1a4], 0
cmp dword [ebp - 0x1a4], 0xffffffff
jl 0x1001e4fb
mov dword [ebp - 0x1c4], 1
jmp 0x1001e502
and dword [ebp - 0x1c4], 0
push 0
lea ecx, [ebp - 0x224]
call fcn.100193d1
push 0
lea ecx, [ebp - 0x224]
call fcn.100193d1
cmp dword [eax], 0
je 0x1001e532
or eax, 0xffffffff
je 0x1001e532
mov dword [ebp - 0xe4], 1
jmp 0x1001e539
and dword [ebp - 0xe4], 0
mov eax, dword [ebp - 0x1ec]
cmp dword [ebp - 0xe4], eax
jl 0x1001e553
mov dword [ebp - 0x154], 1
jmp 0x1001e55a
and dword [ebp - 0x154], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x154]
sub ecx, dword [ebp + eax - 0x288]
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xec], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xec]
mov dword [ebp + eax - 0x288], ecx
cmp dword [ebp - 0xec], 0
jne 0x1001e59e
and dword [ebp - 0x18c], 0
jmp 0x1001e5a8
mov dword [ebp - 0x18c], 1
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x31], 0
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x1001e5c5
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.100193cc
jmp 0x1001e409
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x288], 0
je 0x1001e5ed
jmp 0x1001e298
jmp 0x1001e615
mov dword [ebp - 0x30], 1
jmp 0x1001e5ff
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1001e615
push 0
push 0x70cb
call fcn.10024928
pop ecx
pop ecx
jmp 0x1001e5f8
jmp 0x1001e298
cmp dword [ebp - 0xd0], 0
je 0x1001f6f9
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x114], 0x6e74a6e8
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x304], 0x6e48
mov dword [ebp - 0x124], 0xcd1b
mov dword [ebp - 0x318], 0
mov dword [ebp - 0x254], 0xfffffffe
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0x320], 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x328], 0x11b55e97
mov dword [ebp - 0xa8], 0x8214d2fc
mov dword [ebp - 0x17c], 0xae50714b
mov dword [ebp - 0x330], 0x64e62b50
mov dword [ebp - 0x4c], 7
mov dword [ebp - 0x9c], 0x8aee5119
mov dword [ebp - 0x208], 0xfffffffc
mov dword [ebp - 0x338], 0x5ce
mov dword [ebp - 0x88], 0
jmp 0x1001e6ee
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x1001e70a
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0xc0], 1
jmp 0x1001e6e1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
dec ecx
mov dword [ebp - 0x10], ecx
test eax, eax
jne 0x1001e8fd
cmp dword [ebp - 0x10], 0
jne 0x1001e8fd
cmp dword [ebp - 0x12c], 0
jne 0x1001e73b
mov dword [ebp - 0xf4], 1
jmp 0x1001e742
and dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0xf4]
jge 0x1001e769
mov dword [ebp - 0x15c], 1
jmp 0x1001e770
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0xa8]
imul eax, dword [ebp - 0x15c]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0xb8], eax
je 0x1001e79d
mov dword [ebp - 0xfc], 1
jmp 0x1001e7a4
and dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0x124]
add eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0x254]
jge 0x1001e7c4
mov dword [ebp - 0x1b4], 1
jmp 0x1001e7cb
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x1b4], eax
jge 0x1001e7e5
mov dword [ebp - 0x104], 1
jmp 0x1001e7ec
and dword [ebp - 0x104], 0
mov eax, dword [ebp - 0x104]
sub eax, 0x2eb1f3fd
imul eax, eax, 0
cmp eax, 0x720f84b0
jge 0x1001e80d
mov dword [ebp - 0x164], 1
jmp 0x1001e814
and dword [ebp - 0x164], 0
cmp dword [ebp - 0x164], 1
jg 0x1001e829
mov dword [ebp - 0x10c], 1
jmp 0x1001e830
and dword [ebp - 0x10c], 0
cmp dword [ebp - 0x10c], 0x5f9c7104
jne 0x1001e848
mov dword [ebp - 0x194], 1
jmp 0x1001e84f
and dword [ebp - 0x194], 0
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jne 0x1001e876
mov eax, 0xe69a4575
test eax, eax
jne 0x1001e876
and dword [ebp - 0x1f4], 0
jmp 0x1001e880
mov dword [ebp - 0x1f4], 1
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x348], eax
mov eax, 0xfffe
test eax, eax
jne 0x1001e8ae
xor eax, eax
jne 0x1001e8ae
and dword [ebp - 0x16c], 0
jmp 0x1001e8b8
mov dword [ebp - 0x16c], 1
mov eax, dword [ebp - 0x16c]
neg eax
cmp eax, dword [ebp - 0xa8]
jg 0x1001e8d4
mov dword [ebp - 0x11c], 1
jmp 0x1001e8db
and dword [ebp - 0x11c], 0
cmp dword [ebp - 0x11c], 0x2f3c076a
je 0x1001e8f3
mov dword [ebp - 0x1ac], 1
jmp 0x1001e8fa
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x124]
add eax, 0xe8f88485
mov dword [ebp - 0x174], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x174]
mov dword [ebp + eax - 0xc0], ecx
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x174], eax
jle 0x1001e938
mov dword [ebp - 0x19c], 1
jmp 0x1001e93f
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x19c], eax
jle 0x1001e959
mov dword [ebp - 0x134], 1
jmp 0x1001e960
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x4c], 0xffffffe2
jmp 0x1001e97c
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0x12
jge 0x1001eade
mov dword [ebp - 0x70], 0xffffffff
mov dword [ebp - 0x10], 0
jmp 0x1001e99d
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jg 0x1001ead9
mov dword [ebp - 0x1fc], 0xb38
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xc0], 0xf277f141
jae 0x1001e9cd
mov dword [ebp - 0x144], 1
jmp 0x1001e9d4
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x10]
sub eax, dword [ebp + ecx*4 - 0xc0]
je 0x1001e9f8
cmp dword [ebp - 0x70], 0
je 0x1001e9f8
mov dword [ebp - 0x13c], 1
jmp 0x1001e9ff
and dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xc0]
sub eax, dword [ebp - 0x13c]
add eax, 0xf141
cmp eax, dword [ebp - 0xb8]
jle 0x1001ea28
mov dword [ebp - 0x1bc], 1
jmp 0x1001ea2f
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x1bc]
inc eax
cmp dword [ebp - 0x144], eax
jne 0x1001ea4a
mov dword [ebp - 0xc8], 1
jmp 0x1001ea51
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0xc8]
sub eax, 7
cmp eax, dword [ebp - 0x70]
jge 0x1001ea6b
mov dword [ebp - 0xa0], 1
jmp 0x1001ea72
and dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0xc0], ecx
cmp dword [ebp - 0xa0], 0xc6c2cf37
je 0x1001ea9a
mov dword [ebp - 0x228], 1
jmp 0x1001eaa1
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xc0]
mov dword [ebp - 0x1fc], eax
push 0x3cdf
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x208]
push eax
push 1
call fcn.1001dd4e
add esp, 0x10
jmp 0x1001e996
jmp 0x1001e975
push dword [ebp + 8]
lea ecx, [ebp - 0x2c4]
call fcn.100190f8
mov dword [ebp - 4], 3
lea eax, [ebp - 0x368]
push eax
lea ecx, [ebp - 0x2c4]
call fcn.100198b1
push dword [eax]
lea eax, [ebp - 0x370]
push eax
lea ecx, [ebp - 0x2c4]
call fcn.100198c5
push dword [eax]
lea eax, [ebp - 0x398]
push eax
lea ecx, [ebp - 0x2c4]
call fcn.100198b1
push dword [eax]
mov edx, 0x1001cc74
lea ecx, [ebp - 0x394]
call fcn.10026bd2
add esp, 0xc
mov dword [ebp - 0x2e8], 0xfff8
mov byte [ebp - 0x21], 0
push 0x67eb
push 0x55c1
push 0x3973
push 0x5695
push 0x5b7c
push 0x6409
push 0x29a0
push 1
lea eax, [ebp - 0x21]
push eax
call fcn.1001ddb0
add esp, 0x24
mov byte [ebp - 0x3b], 0
movzx eax, byte [ebp - 0x3b]
test eax, eax
je 0x1001eb9e
push 0
push 0
push 0xe7e
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov eax, dword [ebp - 0xd0]
mov eax, dword [eax + 0xc]
add eax, 0x14
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14], 0x97a4
mov dword [ebp - 0x20], 0xfbefa5f9
mov dword [ebp - 0x204], 9
mov dword [ebp - 0x1cc], 0x4d2fc5c3
mov dword [ebp - 0x120], 4
mov dword [ebp - 0x384], 0x5701
mov dword [ebp - 0x380], 0x5701
mov dword [ebp - 0x37c], 0x5701
mov dword [ebp - 0x378], 0x5701
mov dword [ebp - 0x90], 0
jmp 0x1001ec1d
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x1001ec39
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x234], 6
jmp 0x1001ec10
cmp dword [ebp - 0x14], 0
je 0x1001ecd1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xd8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd8]
mov dword [ebp + eax - 0x234], ecx
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xd8], eax
jle 0x1001ec76
mov dword [ebp - 0xe0], 1
jmp 0x1001ec7d
and dword [ebp - 0xe0], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0xe0]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1001ec9e
xor eax, eax
inc eax
jne 0x1001ec9e
and dword [ebp - 0xe8], 0
jmp 0x1001eca8
mov dword [ebp - 0xe8], 1
xor eax, eax
sub eax, dword [ebp - 0xe8]
cmp eax, 1
jl 0x1001ecd1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x234], 0
je 0x1001ecd1
mov dword [ebp - 0xf0], 1
jmp 0x1001ecd8
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0xf0], eax
jle 0x1001ecf2
mov dword [ebp - 0xf8], 1
jmp 0x1001ecf9
and dword [ebp - 0xf8], 0
cmp dword [ebp - 0xf8], 0xd3ecf04b
jbe 0x1001ed11
mov dword [ebp - 0x20c], 1
jmp 0x1001ed18
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2e0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x234], 0
je 0x1001edcb
mov dword [ebp - 0x78], 0
jmp 0x1001ed45
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 4
jge 0x1001ed5b
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x3a8], 0x632c5b64
jmp 0x1001ed3e
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0x3a8]
mov dword [ebp + ecx - 0x3a8], eax
mov dword [ebp - 0x20], 0
jmp 0x1001ed84
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x1001edc6
mov byte [ebp - 0x39], 0
movzx eax, byte [ebp - 0x39]
test eax, eax
je 0x1001ed9e
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov dword [ebp - 0x14], 0
jmp 0x1001edae
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jg 0x1001edc4
push 1
push 0x3df9
call fcn.1001e026
pop ecx
pop ecx
jmp 0x1001eda7
jmp 0x1001ed7d
jmp 0x1001eefb
mov dword [ebp - 0x98], 0
jmp 0x1001ede4
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x1001ee00
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x214], 0xa164e62b
jmp 0x1001edd7
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x100], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x100]
mov dword [ebp + eax - 0x214], ecx
mov eax, dword [ebp - 0x1cc]
cmp eax, dword [ebp - 0x100]
jl 0x1001ee3c
cmp dword [ebp - 0x120], 0
jne 0x1001ee3c
and dword [ebp - 0x108], 0
jmp 0x1001ee46
mov dword [ebp - 0x108], 1
imul eax, dword [ebp - 0x108], 0xe6ea
cmp dword [ebp - 0x20], eax
jl 0x1001ee61
mov dword [ebp - 0x110], 1
jmp 0x1001ee68
and dword [ebp - 0x110], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x234]
cmp dword [ebp - 0x110], eax
je 0x1001ee88
mov dword [ebp - 0x118], 1
jmp 0x1001ee8f
and dword [ebp - 0x118], 0
cmp dword [ebp - 0x118], 0xa6e483bb
jne 0x1001eea7
mov dword [ebp - 0x1c8], 1
jmp 0x1001eeae
and dword [ebp - 0x1c8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x120]
mov dword [ebp + eax - 0x234], ecx
mov dword [ebp - 0x14], 0
jmp 0x1001eed1
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x17
je 0x1001eefb
mov byte [ebp - 0x22], 0
movzx eax, byte [ebp - 0x22]
test eax, eax
je 0x1001eef1
push 0x5041
push 0
call fcn.1001e0c1
pop ecx
pop ecx
push 0
call fcn.1002001b
pop ecx
jmp 0x1001eeca
and dword [ebp - 0xb4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x8c], 0
jmp 0x1001ef22
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x1001ef3e
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x140], 0xb6bc3ec3
jmp 0x1001ef15
mov dword [ebp - 0x18], 0
jmp 0x1001ef4e
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x19
je 0x1001f034
push 2
lea ecx, [ebp - 0x270]
call fcn.10019343
mov byte [ebp - 4], 4
mov dword [ebp - 0x128], 0x3989226c
mov dword [ebp - 0x54], 0
jmp 0x1001ef83
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x1001ef99
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x310], 8
jmp 0x1001ef7c
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x270]
push eax
push 0
call fcn.1002067a
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2f0], eax
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x310]
push 1
lea ecx, [ebp - 0x270]
call fcn.100193d1
mov dword [eax], esi
cmp dword [ebp - 0x18], 6
jne 0x1001f003
mov dword [ebp - 0x128], 0xffffffff
mov esi, dword [ebp - 0x128]
push 0
lea ecx, [ebp - 0x270]
call fcn.100193d1
add esi, dword [eax]
jne 0x1001f003
and dword [ebp - 0x130], 0
jmp 0x1001f00d
mov dword [ebp - 0x130], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x130]
mov dword [ebp + eax - 0x140], ecx
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x270]
call fcn.100193cc
jmp 0x1001ef47
mov dword [ebp - 0x18], 0xfffffff0
jmp 0x1001f044
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffeb
jne 0x1001f08b
mov dword [ebp - 0x1d8], 0x5969a22d
cmp dword [ebp - 0x1d8], 0
je 0x1001f06f
cmp dword [ebp - 0x18], 0
je 0x1001f06f
mov dword [ebp - 0xc4], 1
jmp 0x1001f076
and dword [ebp - 0xc4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xc4]
mov dword [ebp + eax - 0x140], ecx
jmp 0x1001f03d
mov eax, dword [ebp - 0x148]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
jmp 0x1001f0a9
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x148]
je 0x1001f6ea
push 2
lea ecx, [ebp - 0x2a0]
call fcn.10019343
mov byte [ebp - 4], 5
mov dword [ebp - 0x1c], 0x11e7bff4
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0xa4], 0xfffffff6
mov dword [ebp - 0xac], 0xe01e6e83
mov dword [ebp - 0x190], 1
mov dword [ebp - 0x1e0], 0xfffffffe
lea eax, [ebp - 0x2a0]
push eax
lea eax, [ebp - 0x36c]
push eax
push 0x5a79
push 0
call fcn.1001f80e
add esp, 0x10
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x1001f1b4
cmp dword [ebp - 0x38], 0
jne 0x1001f145
push 8
pop eax
test eax, eax
jne 0x1001f145
and dword [ebp - 0x150], 0
jmp 0x1001f14f
mov dword [ebp - 0x150], 1
cmp dword [ebp - 0x150], 0x1993
je 0x1001f167
mov dword [ebp - 0x158], 1
jmp 0x1001f16e
and dword [ebp - 0x158], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x158], eax
jne 0x1001f188
cmp dword [ebp - 0x38], 0
jne 0x1001f188
and dword [ebp - 0x160], 0
jmp 0x1001f192
mov dword [ebp - 0x160], 1
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x160]
imul eax, eax, 0xffffffff
cmp eax, 0xc8b4
jg 0x1001f1ab
cmp dword [ebp - 0x38], 0
jne 0x1001f1b4
and dword [ebp - 0x168], 0
jmp 0x1001f1be
mov dword [ebp - 0x168], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x168], eax
jl 0x1001f1d5
mov dword [ebp - 0x170], 1
jmp 0x1001f1dc
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x170]
sub eax, dword [ebp - 0xa4]
jne 0x1001f208
cmp dword [ebp - 0xac], 0
jne 0x1001f208
cmp dword [ebp - 0x190], 0
jne 0x1001f208
and dword [ebp - 0x178], 0
jmp 0x1001f212
mov dword [ebp - 0x178], 1
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xa4]
cmp eax, 0x71d69170
jg 0x1001f23a
mov dword [ebp - 0x180], 1
jmp 0x1001f241
and dword [ebp - 0x180], 0
mov eax, dword [ebp - 0xac]
add eax, dword [ebp - 0x180]
cmp eax, 0x372625aa
jge 0x1001f263
cmp dword [ebp - 0x38], 0
jne 0x1001f263
and dword [ebp - 0x188], 0
jmp 0x1001f26d
mov dword [ebp - 0x188], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x188], eax
jge 0x1001f284
mov dword [ebp - 0x198], 1
jmp 0x1001f28b
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x198], eax
jne 0x1001f2a5
mov dword [ebp - 0x1a0], 1
jmp 0x1001f2ac
and dword [ebp - 0x1a0], 0
push 0
lea ecx, [ebp - 0x2a0]
call fcn.100193d1
mov dword [eax], 1
imul eax, dword [ebp - 0x1a0], 0xffffffff
cmp eax, 1
je 0x1001f2d7
mov dword [ebp - 0x1a8], 1
jmp 0x1001f2de
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0xac]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2a0]
call fcn.100193cc
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xb4], eax
push 2
lea ecx, [ebp - 0x244]
call fcn.10019343
mov byte [ebp - 4], 6
lea eax, [ebp - 0x2f8]
push eax
lea eax, [ebp - 0x244]
push eax
push 0
call fcn.1001f787
add esp, 0xc
push 1
lea ecx, [ebp - 0x244]
call fcn.100193d1
and dword [eax], 0
jmp 0x1001f370
push 1
lea ecx, [ebp - 0x244]
call fcn.100193d1
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1b0]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x244]
call fcn.100193d1
cmp dword [eax], 0x15
jle 0x1001f3ff
mov dword [ebp - 0x94], 0x76e6bacd
mov dword [ebp - 0x94], 0
jmp 0x1001f3a5
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xffffffeb
je 0x1001f3fa
mov dword [ebp - 0x7c], 0xd94543be
mov byte [ebp - 0x23], 0
push 0x5d4b
push 1
lea eax, [ebp - 0x23]
push eax
call fcn.1001e071
add esp, 0xc
mov dword [ebp - 0x7c], 0
jmp 0x1001f3dc
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xfffffff9
jl 0x1001f3f8
mov byte [ebp - 0x3d], 0
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x1001f3f6
push 0
call fcn.1001f882
pop ecx
jmp 0x1001f3d5
jmp 0x1001f398
jmp 0x1001f34c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x244]
call fcn.100193cc
mov eax, dword [ebp - 0xb4]
push dword [eax + 0x28]
lea ecx, [ebp - 0x2dc]
call fcn.10026805
mov byte [ebp - 4], 7
lea eax, [ebp - 0x344]
push eax
lea ecx, [ebp - 0x2dc]
call fcn.100198b1
push dword [eax]
lea eax, [ebp - 0x300]
push eax
lea ecx, [ebp - 0x2dc]
call fcn.100198c5
push dword [eax]
lea eax, [ebp - 0x38c]
push eax
lea ecx, [ebp - 0x2dc]
call fcn.100198b1
push dword [eax]
mov edx, 0x1001cc74
lea ecx, [ebp - 0x308]
call fcn.10026bd2
add esp, 0xc
push 1
lea ecx, [ebp - 0x250]
call fcn.10019343
mov byte [ebp - 4], 8
mov dword [ebp - 0x34c], 0xfffffffe
mov dword [ebp - 0x314], 5
mov dword [ebp - 0x374], 0x65256810
mov dword [ebp - 0x5c], 0
jmp 0x1001f4b4
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x1001f4d0
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x250]
call fcn.100193d1
mov dword [eax], 0x5d6c05ba
jmp 0x1001f4ad
push 0
lea ecx, [ebp - 0x250]
call fcn.100193d1
and dword [eax], 0
jmp 0x1001f506
push 0
lea ecx, [ebp - 0x250]
call fcn.100193d1
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x1b8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1b8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x250]
call fcn.100193d1
cmp dword [eax], 2
jl 0x1001f670
mov dword [ebp - 0x64], 0xb4074dd
mov dword [ebp - 0x31c], 0xffffffff
mov dword [ebp - 0x354], 0x9aaed6b6
mov dword [ebp - 0x324], 6
mov dword [ebp - 0x390], 0xffffffff
mov dword [ebp - 0x32c], 0xa9bca7b
mov dword [ebp - 0x364], 0x6b43d271
mov byte [ebp - 0x24], 0
movzx eax, byte [ebp - 0x24]
test eax, eax
je 0x1001f579
push 0
push 0x5ea2
call fcn.100209d5
pop ecx
pop ecx
mov dword [ebp - 0x64], 0
jmp 0x1001f589
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x19
jge 0x1001f66b
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x334], 0xfffffffb
push 3
lea ecx, [ebp - 0x360]
call fcn.10019343
mov byte [ebp - 4], 9
mov dword [ebp - 0x1e8], 7
mov dword [ebp - 0x6c], 0
jmp 0x1001f5cf
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x1001f5eb
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x360]
call fcn.100193d1
mov dword [eax], 0x63ab1943
jmp 0x1001f5c8
mov dword [ebp - 0x74], 0
jmp 0x1001f5fb
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xffffffe2
jg 0x1001f657
mov dword [ebp - 0x388], 0x9598aaf0
mov dword [ebp - 0x2e4], 0xd5befa1e
mov dword [ebp - 0x2ec], 0x491ba6b4
mov dword [ebp - 0x2f4], 0xffffffff
mov byte [ebp - 0x3c], 0
lea eax, [ebp - 0x3c]
push eax
push 1
call fcn.1001e0c1
pop ecx
pop ecx
push 0x5796
push 0x688f
lea eax, [ebp - 0x1e8]
push eax
push 0
call fcn.1001fecd
add esp, 0x10
jmp 0x1001f5f4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x360]
call fcn.100193cc
jmp 0x1001f582
jmp 0x1001f4e2
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x250]
call fcn.100193cc
lea edx, [ebp - 0x2dc]
lea ecx, [ebp - 0x2c4]
call fcn.10026c3b
movzx eax, al
test eax, eax
je 0x1001f6d6
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb4]
mov eax, dword [ecx + eax + 0x10]
mov dword [ebp - 0x1f0], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2dc]
call fcn.1001917d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c4]
call fcn.1001917d
mov eax, dword [ebp - 0x1f0]
jmp 0x1001f778
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2dc]
call fcn.1001917d
jmp 0x1001f09b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c4]
call fcn.1001917d
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x258], 0
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x264]
cmp dword [ebp + eax - 0x264], ecx
jg 0x1001f752
mov byte [ebp - 0x29], 0
movzx eax, byte [ebp - 0x29]
test eax, eax
je 0x1001f750
push 0
call fcn.1001f996
pop ecx
jmp 0x1001f776
mov byte [ebp - 0x3a], 0
movzx eax, byte [ebp - 0x3a]
test eax, eax
je 0x1001f766
push 0
call fcn.1001f8dc
pop ecx
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x264], 0x8fb770a7
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret