Function at 0x10029a10
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10058d38
mov eax, dword fs:[0]
push eax
sub esp, 0x798
mov eax, dword [0x1006a010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
sub esp, 8
mov dword [ebp - 0x554], 0
lea ecx, [ebp - 0x7a4]
call fcn.10009ae0
mov ecx, str.WantedLevelEditor.xml
mov dword [ebp - 4], 0
call fcn.1003bb90
push eax
lea ecx, [ebp - 0x7a4]
call fcn.10009f70
mov dword [0x1006ab3c], eax
test eax, eax
jne 0x1002bc36
mov edx, str.Planes
mov ecx, 0x1006ad80
call fcn.10037de0
test al, al
je 0x1002bc36
mov edx, str.none
mov ecx, 0x1006ad80
call fcn.10037de0
test al, al
je 0x10029abb
movzx eax, byte [0x100ec940]
push eax
mov eax, 0x580750
call eax
add esp, 4
push 6
push str.Planes
mov ecx, 0x1006ad80
call fcn.10037420
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
mov eax, dword [0x1006b1b8]
inc eax
mov dword [ebp - 0x18], 0
push eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x554], 1
call fcn.10038e60
mov edx, dword [ebp - 0x14]
mov eax, edx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
push 1
push 0x1006359c
cmp eax, 1
jb 0x10029b32
cmp edx, 0x10
lea esi, [ebp - 0x28]
lea eax, [ecx + 1]
cmovae esi, dword [ebp - 0x28]
add esi, ecx
mov dword [ebp - 0x18], eax
push esi
call fcn.1003ef40
add esp, 0xc
mov byte [esi + 1], 0
jmp 0x10029b49
mov byte [ebp - 0x558], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x558]
push 1
call fcn.10038840
push 0x1006b1a8
lea ecx, [ebp - 0x28]
call fcn.10037170
mov edx, dword [ebp - 0x14]
mov eax, edx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
push 1
push 0x10063598
cmp eax, 1
jb 0x10029b90
cmp edx, 0x10
lea esi, [ebp - 0x28]
lea eax, [ecx + 1]
cmovae esi, dword [ebp - 0x28]
add esi, ecx
mov dword [ebp - 0x18], eax
push esi
call fcn.1003ef40
add esp, 0xc
mov byte [esi + 1], 0
lea eax, [ebp - 0x28]
jmp 0x10029ba7
mov byte [ebp - 0x558], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x558]
push 1
call fcn.10038840
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
movups xmm0, xmmword [eax]
mov dword [ebp - 0x554], 3
movups xmmword [ebp - 0x70], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x60], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
push 0x1006af38
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 2
call fcn.10037170
mov ecx, 0x1006b3b8
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x100], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x100]
push eax
movq qword [ebp - 0xf0], xmm0
call fcn.100372d0
mov edx, dword [ebp - 0xec]
cmp edx, 0x10
jb 0x10029c65
mov ecx, dword [ebp - 0x100]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10029c5b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002bc5c
push edx
push ecx
call fcn.1003bfed
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x5c]
cmp edx, 0x10
jb 0x10029c9d
mov ecx, dword [ebp - 0x70]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10029c93
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002bc61
push edx
push ecx
call fcn.1003bfed
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
cmp edx, 0x10
jb 0x10029ce7
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10029cdd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002bc66
push edx
push ecx
call fcn.1003bfed
add esp, 8
cmp dword [0x1006b3cc], 0x10
mov eax, 0x1006b3b8
cmovae eax, dword [0x1006b3b8]
mov dword [0x1013c9b0], eax
mov eax, dword [0x1025c244]
test al, 1
jne 0x10029d33
or eax, 1
mov dword [0x1025b6cc], 0x1006353c
mov dword [0x1025c244], eax
mov dword [0x1025b6d4], 0
mov dword [0x1025b6d0], 0
call fcn.1000c4c0
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x18]
push eax
push 0x40
mov esi, 0x582029
mov dword [ebp - 0x1c], 4
push 4
push esi
mov dword [ebp - 0x20], esi
call edi
test eax, eax
setne byte [ebp - 0x14]
mov dword [esi], 7
cmp byte [ebp - 0x14], 0
je 0x10029d7e
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x558]
push ecx
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x558], eax
push dword [ebp - 0x20]
call edi
mov eax, dword [0x1025c244]
test al, 1
jne 0x10029db2
or eax, 1
mov dword [0x1025b6cc], 0x1006353c
mov dword [0x1025c244], eax
mov dword [0x1025b6d4], 0
mov dword [0x1025b6d0], 0
call fcn.1000c4c0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], 4
push eax
push 0x40
mov esi, 0x582432
push 4
push esi
mov dword [ebp - 0x20], esi
call edi
test eax, eax
setne byte [ebp - 0x14]
mov dword [esi], 6
cmp byte [ebp - 0x14], 0
je 0x10029df7
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x558]
push ecx
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x558], eax
push dword [ebp - 0x20]
call edi
push ecx
mov dl, 6
mov ecx, 0x58242b
call fcn.1003b5b0
add esp, 4
mov eax, 0x582300
push 0
push 1
push 1
push 3
sub esp, 0xc
mov dword [esp + 8], 0x435c0000
mov dword [esp + 4], 0x432a0000
mov dword [esp], 0x41e80000
push dword [0x1013c9b0]
push 0
call eax
movzx eax, al
add esp, 0x24
mov dword [0x100ec940], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
mov eax, dword [0x1006acb8]
add eax, dword [0x1006aea0]
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x554], 0xe
call fcn.10038e60
push 0x1006ae90
lea ecx, [ebp - 0x28]
call fcn.10037170
push 0x1006aca8
lea ecx, [ebp - 0x28]
call fcn.10037170
mov edx, dword [ebp - 0x14]
mov eax, edx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
push 0xd
push str._plane_model1
cmp eax, 0xd
jb 0x10029ecb
cmp edx, 0x10
lea esi, [ebp - 0x28]
lea eax, [ecx + 0xd]
cmovae esi, dword [ebp - 0x28]
add esi, ecx
mov dword [ebp - 0x18], eax
push esi
call fcn.1003ef40
add esp, 0xc
mov byte [esi + 0xd], 0
lea eax, [ebp - 0x28]
jmp 0x10029ee2
mov byte [ebp - 0x558], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x558]
push 0xd
call fcn.10038840
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xd0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xc0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x10029f56
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10029f4c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002bc6b
push edx
push ecx
call fcn.1003bfed
add esp, 8
mov dword [ebp - 0x55c], 0x1dc
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
mov eax, dword [0x1006acb8]
add eax, dword [0x1006aea0]
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x554], 0x36
call fcn.10038e60
push 0x1006ae90
lea ecx, [ebp - 0x28]
call fcn.10037170
push 0x1006aca8
lea ecx, [ebp - 0x28]
call fcn.10037170
mov edx, dword [ebp - 0x14]
mov eax, edx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
push 0xd
push str._plane_model2
cmp eax, 0xd
jb 0x10029fe8
cmp edx, 0x10
lea esi, [ebp - 0x28]
lea eax, [ecx + 0xd]
cmovae esi, dword [ebp - 0x28]
add esi, ecx
mov dword [ebp - 0x18], eax
push esi
call fcn.1003ef40
add esp, 0xc
mov byte [esi + 0xd], 0
lea eax, [ebp - 0x28]
jmp 0x10029fff
mov byte [ebp - 0x558], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x558]
push 0xd
call fcn.10038840
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xb8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xa8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1002a073
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002a069
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002bc70
push edx
push ecx
call fcn.1003bfed
add esp, 8
mov dword [ebp - 0x560], 0x1dc
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x28]
mov eax, dword [0x1006acb8]
add eax, dword [0x1006aea0]
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x554], 0xd6
call fcn.10038e60
push 0x1006ae90
lea ecx, [ebp - 0x28]
call fcn.10037170
push 0x1006aca8
lea ecx, [ebp - 0x28]
call fcn.10037170
mov edx, dword [ebp - 0x14]
mov eax, edx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
push 0xd
push str._plane_model3
cmp eax, 0xd
jb 0x1002a105
cmp edx, 0x10
lea esi, [ebp - 0x28]
lea eax, [ecx + 0xd]
cmovae esi, dword [ebp - 0x28]
add esi, ecx
mov dword [ebp - 0x18], eax
push esi
call fcn.1003ef40
add esp, 0xc
mov byte [esi + 0xd], 0
lea eax, [ebp - 0x28]
jmp 0x1002a11c
mov byte [ebp - 0x558], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x558]
push 0xd
call fcn.10038840
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xa0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x90], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1002a190
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002a186
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002bc75
push edx
push ecx
call fcn.1003bfed
add esp, 8
mov dword [ebp - 0x564], 0x1dc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x28]
mov eax, dword [0x1006acb8]
add eax, dword [0x1006aea0]
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x554], 0x356
call fcn.10038e60
push 0x1006ae90
lea ecx, [ebp - 0x28]
call fcn.10037170
push 0x1006aca8
lea ecx, [ebp - 0x28]
call fcn.10037170
mov edx, dword [ebp - 0x14]
mov eax, edx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
push 0xd
push str._plane_model4
cmp eax, 0xd
jb 0x1002a222
cmp edx, 0x10
lea esi, [ebp - 0x28]
lea eax, [ecx + 0xd]
cmovae esi, dword [ebp - 0x28]
add esi, ecx
mov dword [ebp - 0x18], eax
push esi
call fcn.1003ef40
add esp, 0xc
mov byte [esi + 0xd], 0
lea eax, [ebp - 0x28]
jmp 0x1002a239
mov byte [ebp - 0x558], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x558]
push 0xd
call fcn.10038840
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x88], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x78], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb 0x1002a2a4
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002a29a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002bc7a
push edx
push ecx
call fcn.1003bfed
add esp, 8
mov dword [ebp - 0x568], 0x1dc
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x28]
mov eax, dword [0x1006acb8]
add eax, dword [0x1006aea0]
push eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x554], 0xd56
call fcn.10038e60
push 0x1006ae90
lea ecx, [ebp - 0x28]
call fcn.10037170
push 0x1006aca8
lea ecx, [ebp - 0x28]
call fcn.10037170
mov edx, dword [ebp - 0x14]
mov eax, edx
mov ecx, dword [ebp - 0x18]
sub eax, ecx
push 0xd
push str._plane_model5
cmp eax, 0xd
jb 0x1002a336
cmp edx, 0x10
lea esi, [ebp - 0x28]
lea eax, [ecx + 0xd]
cmovae esi, dword [ebp - 0x28]
add esi, ecx
mov dword [ebp - 0x18], eax
push esi
call fcn.1003ef40
add esp, 0xc
mov byte [esi + 0xd], 0
lea eax, [ebp - 0x28]
jmp 0x1002a34d
mov byte [ebp - 0x558], 0
lea ecx, [ebp - 0x28]
push dword [ebp - 0x558]
push 0xd
call fcn.10038840
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xe8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xd8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x11
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x56c], 0x1dc
lea ecx, [ebp - 0x40]
call fcn.10037a80
push str._plane_model6
mov edx, eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x178]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x14
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x570], 0x1dc
lea ecx, [ebp - 0x58]
call fcn.10037a80
push str._plane_pilot_1
mov edx, eax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x190]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x17
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x574], 0xa5
lea ecx, [ebp - 0x40]
call fcn.10037a80
push str._plane_pilot_2
mov edx, eax
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x1a8]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x1a
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x5a4], 0xa5
lea ecx, [ebp - 0x58]
call fcn.10037a80
push str._plane_pilot_3
mov edx, eax
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1c0]
call fcn.10037c00
add esp, 8
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x58]
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x59c], 0xa5
lea ecx, [ebp - 0x40]
call fcn.10037a80
push str._plane_pilot_4
mov edx, eax
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x1d8]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x20
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x598], 0xa5
lea ecx, [ebp - 0x58]
call fcn.10037a80
push str._plane_pilot_5
mov edx, eax
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x1f0]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x23
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x5a0], 0xa5
lea ecx, [ebp - 0x40]
call fcn.10037a80
push str._plane_pilot_6
mov edx, eax
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x208]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x26
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x594], 0xa5
lea ecx, [ebp - 0x58]
call fcn.10037a80
push str._plane_occupants1
mov edx, eax
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x220]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x29
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x590], 1
lea ecx, [ebp - 0x40]
call fcn.10037a80
push str._plane_occupants2
mov edx, eax
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x238]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x2c
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x58c], 1
lea ecx, [ebp - 0x58]
call fcn.10037a80
push str._plane_occupants3
mov edx, eax
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x250]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x2f
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x588], 1
lea ecx, [ebp - 0x40]
call fcn.10037a80
push str._plane_occupants4
mov edx, eax
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x160]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0x32
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x584], 1
lea ecx, [ebp - 0x58]
call fcn.10037a80
push str._plane_occupants5
mov edx, eax
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x148]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0x35
call fcn.10037280
push 0x1006aca8
mov edx, 0x1006ae90
mov dword [ebp - 0x580], 1
lea ecx, [ebp - 0x268]
call fcn.10037a80
push str._plane_occupants6
mov edx, eax
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x130]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 0x38
call fcn.10037280
cmp dword [0x1006b0b4], 0x10
mov eax, 0x1006b0a0
mov edi, dword [ebp - 0x788]
cmovae eax, dword [0x1006b0a0]
mov dword [ebp - 0x57c], 1
mov dword [ebp - 0x554], eax
test edi, edi
je 0x1002a769
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax]
call eax
mov esi, eax
test esi, esi
je 0x1002a762
cmp dword [ebp - 0x554], 0
je 0x1002a76b
mov edx, dword [esi]
mov ecx, esi
mov edx, dword [edx + 0x18]
call edx
test eax, eax
je 0x1002a73d
xor eax, eax
jmp 0x1002a745
lea ecx, [esi + 0xc]
call fcn.10007e00
mov ecx, dword [ebp - 0x554]
cmp eax, ecx
je 0x1002a76b
push 0x7fffffff
push ecx
push eax
call fcn.10043530
add esp, 0xc
test eax, eax
je 0x1002a76b
mov edi, dword [edi + 0x28]
test edi, edi
jne 0x1002a715
xor esi, esi
cmp dword [ebp - 0xbc], 0x10
lea eax, [ebp - 0xd0]
mov esi, dword [esi + 0x1c]
cmovae eax, dword [ebp - 0xd0]
mov dword [ebp - 0x554], eax
test esi, esi
je 0x1002a7e4
nop dword [eax]
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax]
call eax
mov edi, eax
test edi, edi
je 0x1002a7dd
cmp dword [ebp - 0x554], 0
je 0x1002a7e6
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x18]
call eax
test eax, eax
je 0x1002a7b8
xor eax, eax
jmp 0x1002a7c0
lea ecx, [edi + 0xc]
call fcn.10007e00
mov ecx, dword [ebp - 0x554]
cmp eax, ecx
je 0x1002a7e6
push 0x7fffffff
push ecx
push eax
call fcn.10043530
add esp, 0xc
test eax, eax
je 0x1002a7e6
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002a790
xor edi, edi
lea eax, [ebp - 0x55c]
mov ecx, edi
push eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov eax, 0x1006b0a0
mov esi, dword [ebp - 0x788]
cmovae eax, dword [0x1006b0a0]
mov dword [ebp - 0x554], eax
test esi, esi
je 0x1002a86b
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax]
call eax
mov edi, eax
test edi, edi
je 0x1002a864
cmp dword [ebp - 0x554], 0
je 0x1002a86d
mov edx, dword [edi]
mov ecx, edi
mov edx, dword [edx + 0x18]
call edx
test eax, eax
je 0x1002a83f
xor eax, eax
jmp 0x1002a847
lea ecx, [edi + 0xc]
call fcn.10007e00
mov ecx, dword [ebp - 0x554]
cmp eax, ecx
je 0x1002a86d
push 0x7fffffff
push ecx
push eax
call fcn.10043530
add esp, 0xc
test eax, eax
je 0x1002a86d
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002a817
xor edi, edi
cmp dword [ebp - 0xa4], 0x10
lea eax, [ebp - 0xb8]
mov esi, dword [edi + 0x1c]
cmovae eax, dword [ebp - 0xb8]
mov dword [ebp - 0x554], eax
test esi, esi
je 0x1002a8e4
nop
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax]
call eax
mov edi, eax
test edi, edi
je 0x1002a8dd
cmp dword [ebp - 0x554], 0
je 0x1002a8e6
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x18]
call eax
test eax, eax
je 0x1002a8b8
xor eax, eax
jmp 0x1002a8c0
lea ecx, [edi + 0xc]
call fcn.10007e00
mov ecx, dword [ebp - 0x554]
cmp eax, ecx
je 0x1002a8e6
push 0x7fffffff
push ecx
push eax
call fcn.10043530
add esp, 0xc
test eax, eax
je 0x1002a8e6
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002a890
xor edi, edi
lea eax, [ebp - 0x560]
mov ecx, edi
push eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov eax, 0x1006b0a0
mov esi, dword [ebp - 0x788]
cmovae eax, dword [0x1006b0a0]
mov dword [ebp - 0x554], eax
test esi, esi
je 0x1002a96b
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax]
call eax
mov edi, eax
test edi, edi
je 0x1002a964
cmp dword [ebp - 0x554], 0
je 0x1002a96d
mov edx, dword [edi]
mov ecx, edi
mov edx, dword [edx + 0x18]
call edx
test eax, eax
je 0x1002a93f
xor eax, eax
jmp 0x1002a947
lea ecx, [edi + 0xc]
call fcn.10007e00
mov ecx, dword [ebp - 0x554]
cmp eax, ecx
je 0x1002a96d
push 0x7fffffff
push ecx
push eax
call fcn.10043530
add esp, 0xc
test eax, eax
je 0x1002a96d
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002a917
xor edi, edi
cmp dword [ebp - 0x8c], 0x10
lea eax, [ebp - 0xa0]
mov esi, dword [edi + 0x1c]
cmovae eax, dword [ebp - 0xa0]
mov dword [ebp - 0x554], eax
test esi, esi
je 0x1002a9e4
nop
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax]
call eax
mov edi, eax
test edi, edi
je 0x1002a9dd
cmp dword [ebp - 0x554], 0
je 0x1002a9e6
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x18]
call eax
test eax, eax
je 0x1002a9b8
xor eax, eax
jmp 0x1002a9c0
lea ecx, [edi + 0xc]
call fcn.10007e00
mov ecx, dword [ebp - 0x554]
cmp eax, ecx
je 0x1002a9e6
push 0x7fffffff
push ecx
push eax
call fcn.10043530
add esp, 0xc
test eax, eax
je 0x1002a9e6
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002a990
xor edi, edi
lea eax, [ebp - 0x564]
mov ecx, edi
push eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov eax, 0x1006b0a0
mov esi, dword [ebp - 0x788]
cmovae eax, dword [0x1006b0a0]
mov dword [ebp - 0x554], eax
test esi, esi
je 0x1002aa6b
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax]
call eax
mov edi, eax
test edi, edi
je 0x1002aa64
cmp dword [ebp - 0x554], 0
je 0x1002aa6d
mov edx, dword [edi]
mov ecx, edi
mov edx, dword [edx + 0x18]
call edx
test eax, eax
je 0x1002aa3f
xor eax, eax
jmp 0x1002aa47
lea ecx, [edi + 0xc]
call fcn.10007e00
mov ecx, dword [ebp - 0x554]
cmp eax, ecx
je 0x1002aa6d
push 0x7fffffff
push ecx
push eax
call fcn.10043530
add esp, 0xc
test eax, eax
je 0x1002aa6d
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002aa17
xor edi, edi
cmp dword [ebp - 0x74], 0x10
lea eax, [ebp - 0x88]
mov esi, dword [edi + 0x1c]
cmovae eax, dword [ebp - 0x88]
mov dword [ebp - 0x558], eax
test esi, esi
je 0x1002aaa9
nop dword [eax + eax]
push eax
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002aaab
mov esi, dword [esi + 0x28]
mov eax, dword [ebp - 0x558]
test esi, esi
jne 0x1002aa90
xor eax, eax
lea ecx, [ebp - 0x568]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x788]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x1002aae9
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002aaeb
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002aad6
xor eax, eax
cmp dword [ebp - 0xd4], 0x10
lea edi, [ebp - 0xe8]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0xe8]
test esi, esi
je 0x1002ab19
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002ab1b
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002ab06
xor eax, eax
lea ecx, [ebp - 0x56c]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x788]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x1002ab59
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002ab5b
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002ab46
xor eax, eax
cmp dword [ebp - 0x164], 0x10
lea edi, [ebp - 0x178]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x178]
test esi, esi
je 0x1002ab89
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002ab8b
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002ab76
xor eax, eax
lea ecx, [ebp - 0x570]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x788]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x1002abc9
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002abcb
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002abb6
xor eax, eax
cmp dword [ebp - 0x17c], 0x10
lea edi, [ebp - 0x190]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x190]
test esi, esi
je 0x1002abf9
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002abfb
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002abe6
xor eax, eax
lea ecx, [ebp - 0x574]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x788]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x1002ac39
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002ac3b
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002ac26
xor eax, eax
cmp dword [ebp - 0x194], 0x10
lea edi, [ebp - 0x1a8]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x1a8]
test esi, esi
je 0x1002ac69
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002ac6b
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002ac56
xor eax, eax
lea ecx, [ebp - 0x5a4]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x788]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x1002aca9
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002acab
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002ac96
xor eax, eax
cmp dword [ebp - 0x1ac], 0x10
lea edi, [ebp - 0x1c0]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x1c0]
test esi, esi
je 0x1002acd9
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002acdb
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002acc6
xor eax, eax
lea ecx, [ebp - 0x59c]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x788]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x1002ad19
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002ad1b
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002ad06
xor eax, eax
cmp dword [ebp - 0x1c4], 0x10
lea edi, [ebp - 0x1d8]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x1d8]
test esi, esi
je 0x1002ad49
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002ad4b
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002ad36
xor eax, eax
lea ecx, [ebp - 0x598]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x788]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x1002ad89
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002ad8b
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002ad76
xor eax, eax
cmp dword [ebp - 0x1dc], 0x10
lea edi, [ebp - 0x1f0]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x1f0]
test esi, esi
je 0x1002adb9
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002adbb
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002ada6
xor eax, eax
lea ecx, [ebp - 0x5a0]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x788]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x1002adf9
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002adfb
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002ade6
xor eax, eax
cmp dword [ebp - 0x1f4], 0x10
lea edi, [ebp - 0x208]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x208]
test esi, esi
je 0x1002ae29
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002ae2b
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002ae16
xor eax, eax
lea ecx, [ebp - 0x594]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x788]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x1002ae69
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002ae6b
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002ae56
xor eax, eax
cmp dword [ebp - 0x20c], 0x10
lea edi, [ebp - 0x220]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x220]
test esi, esi
je 0x1002ae99
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002ae9b
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002ae86
xor eax, eax
lea ecx, [ebp - 0x590]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x788]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x1002aed9
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002aedb
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002aec6
xor eax, eax
cmp dword [ebp - 0x224], 0x10
lea edi, [ebp - 0x238]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x238]
test esi, esi
je 0x1002af09
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002af0b
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002aef6
xor eax, eax
lea ecx, [ebp - 0x58c]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x788]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x1002af49
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002af4b
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002af36
xor eax, eax
cmp dword [ebp - 0x23c], 0x10
lea edi, [ebp - 0x250]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x250]
test esi, esi
je 0x1002af79
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002af7b
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002af66
xor eax, eax
lea ecx, [ebp - 0x588]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x788]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x1002afb9
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002afbb
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002afa6
xor eax, eax
cmp dword [ebp - 0x14c], 0x10
lea edi, [ebp - 0x160]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x160]
test esi, esi
je 0x1002afe9
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002afeb
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002afd6
xor eax, eax
lea ecx, [ebp - 0x584]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x788]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x1002b029
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002b02b
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002b016
xor eax, eax
cmp dword [ebp - 0x134], 0x10
lea edi, [ebp - 0x148]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x148]
test esi, esi
je 0x1002b059
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002b05b
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002b046
xor eax, eax
lea ecx, [ebp - 0x580]
push ecx
mov ecx, eax
call fcn.10009370
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x788]
cmovae edi, dword [0x1006b0a0]
test esi, esi
je 0x1002b099
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002b09b
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002b086
xor eax, eax
cmp dword [ebp - 0x11c], 0x10
lea edi, [ebp - 0x130]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x130]
test esi, esi
je 0x1002b0c9
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002b0cb
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002b0b6
xor eax, eax
lea ecx, [ebp - 0x57c]
push ecx
mov ecx, eax
call fcn.10009370
mov edx, dword [ebp - 0x55c]
lea ecx, [ebp - 0x40]
sub edx, 0x190
mov dword [ebp - 0x55c], edx
call fcn.1000c860
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x58]
mov edx, dword [ebp - 0x560]
sub edx, 0x190
mov dword [ebp - 0x560], edx
call fcn.1000c860
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x268]
mov edx, dword [ebp - 0x564]
sub edx, 0x190
mov dword [ebp - 0x564], edx
call fcn.1000c860
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0x298]
mov edx, dword [ebp - 0x568]
sub edx, 0x190
mov dword [ebp - 0x568], edx
call fcn.1000c860
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x2b0]
mov edx, dword [ebp - 0x56c]
sub edx, 0x190
mov dword [ebp - 0x56c], edx
call fcn.1000c860
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x2c8]
mov edx, dword [ebp - 0x570]
sub edx, 0x190
mov dword [ebp - 0x570], edx
call fcn.1000c860
mov byte [ebp - 4], 0x3e
lea ecx, [ebp - 0x2e0]
mov edx, dword [ebp - 0x574]
call fcn.1000c860
mov byte [ebp - 4], 0x3f
lea ecx, [ebp - 0x2f8]
mov edx, dword [ebp - 0x5a4]
call fcn.1000c860
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x3a0]
mov edx, dword [ebp - 0x59c]
call fcn.1000c860
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x3b8]
mov edx, dword [ebp - 0x598]
call fcn.1000c860
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x310]
mov edx, dword [ebp - 0x5a0]
call fcn.1000c860
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x328]
mov edx, dword [ebp - 0x594]
call fcn.1000c860
mov byte [ebp - 4], 0x44
lea ecx, [ebp - 0x340]
mov edx, dword [ebp - 0x590]
call fcn.1000c860
mov byte [ebp - 4], 0x45
mov edx, dword [ebp - 0x58c]
lea ecx, [ebp - 0x358]
call fcn.1000c860
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x370]
mov edx, dword [ebp - 0x588]
call fcn.1000c860
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x388]
mov edx, dword [ebp - 0x584]
call fcn.1000c860
mov byte [ebp - 4], 0x48
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0x580]
call fcn.1000c860
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x70]
mov edx, dword [ebp - 0x57c]
call fcn.1000c860
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0x4a
push eax
mov edx, 0x100637f4
lea ecx, [ebp - 0x100]
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0xd0]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x100]
call fcn.10037280
cmp dword [ebp - 0xbc], 0x10
lea eax, [ebp - 0xd0]
mov edx, 0x100637f4
lea ecx, [ebp - 0x4a8]
cmovae eax, dword [ebp - 0xd0]
mov dword [ebp - 0x5d4], eax
lea eax, [ebp - 0x58]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0xb8]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x4a8]
call fcn.10037280
cmp dword [ebp - 0xa4], 0x10
lea eax, [ebp - 0xb8]
mov edx, 0x100637f4
lea ecx, [ebp - 0x4c0]
cmovae eax, dword [ebp - 0xb8]
mov dword [ebp - 0x5d8], eax
lea eax, [ebp - 0x268]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0xa0]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x4c0]
call fcn.10037280
cmp dword [ebp - 0x8c], 0x10
lea eax, [ebp - 0xa0]
mov edx, 0x100637f4
lea ecx, [ebp - 0x4d8]
cmovae eax, dword [ebp - 0xa0]
mov dword [ebp - 0x5dc], eax
lea eax, [ebp - 0x298]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x88]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x4d8]
call fcn.10037280
cmp dword [ebp - 0x74], 0x10
lea eax, [ebp - 0x88]
mov edx, 0x100637f4
lea ecx, [ebp - 0x4f0]
cmovae eax, dword [ebp - 0x88]
mov dword [ebp - 0x5e0], eax
lea eax, [ebp - 0x2b0]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0xe8]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x4f0]
call fcn.10037280
cmp dword [ebp - 0xd4], 0x10
lea eax, [ebp - 0xe8]
mov edx, 0x100637f4
lea ecx, [ebp - 0x508]
cmovae eax, dword [ebp - 0xe8]
mov dword [ebp - 0x554], eax
lea eax, [ebp - 0x2c8]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x178]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x508]
call fcn.10037280
cmp dword [ebp - 0x164], 0x10
lea eax, [ebp - 0x178]
mov edx, 0x100637f8
lea ecx, [ebp - 0x520]
cmovae eax, dword [ebp - 0x178]
mov dword [ebp - 0x558], eax
lea eax, [ebp - 0x2e0]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x190]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x520]
call fcn.10037280
cmp dword [ebp - 0x17c], 0x10
lea eax, [ebp - 0x190]
mov edx, 0x100637f8
lea ecx, [ebp - 0x538]
cmovae eax, dword [ebp - 0x190]
mov dword [ebp - 0x5b4], eax
lea eax, [ebp - 0x2f8]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x1a8]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x538]
call fcn.10037280
cmp dword [ebp - 0x194], 0x10
lea eax, [ebp - 0x1a8]
mov edx, 0x100637f8
lea ecx, [ebp - 0x490]
cmovae eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x5b8], eax
lea eax, [ebp - 0x3a0]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x1c0]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x490]
call fcn.10037280
cmp dword [ebp - 0x1ac], 0x10
lea eax, [ebp - 0x1c0]
cmovae eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x5c0], eax
lea eax, [ebp - 0x3b8]
push eax
mov edx, 0x100637f8
lea ecx, [ebp - 0x550]
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x1d8]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x550]
call fcn.10037280
cmp dword [ebp - 0x1c4], 0x10
lea eax, [ebp - 0x1d8]
mov edx, 0x100637f8
lea ecx, [ebp - 0x3d0]
cmovae eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x5c4], eax
lea eax, [ebp - 0x310]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x1f0]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x3d0]
call fcn.10037280
cmp dword [ebp - 0x1dc], 0x10
lea eax, [ebp - 0x1f0]
mov edx, 0x100637f8
lea ecx, [ebp - 0x3e8]
cmovae eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x5c8], eax
lea eax, [ebp - 0x328]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x208]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x3e8]
call fcn.10037280
cmp dword [ebp - 0x1f4], 0x10
lea eax, [ebp - 0x208]
mov edx, 0x10064f08
lea ecx, [ebp - 0x400]
cmovae eax, dword [ebp - 0x208]
mov dword [ebp - 0x5d0], eax
lea eax, [ebp - 0x340]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x220]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x400]
call fcn.10037280
cmp dword [ebp - 0x20c], 0x10
lea eax, [ebp - 0x220]
mov edx, 0x10064f08
lea ecx, [ebp - 0x418]
cmovae eax, dword [ebp - 0x220]
mov dword [ebp - 0x5cc], eax
lea eax, [ebp - 0x358]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x238]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x418]
call fcn.10037280
cmp dword [ebp - 0x224], 0x10
lea eax, [ebp - 0x238]
mov edx, 0x10064f08
lea ecx, [ebp - 0x430]
cmovae eax, dword [ebp - 0x238]
mov dword [ebp - 0x5bc], eax
lea eax, [ebp - 0x370]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x250]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x430]
call fcn.10037280
cmp dword [ebp - 0x23c], 0x10
lea eax, [ebp - 0x250]
mov edx, 0x10064f08
lea ecx, [ebp - 0x448]
cmovae eax, dword [ebp - 0x250]
mov dword [ebp - 0x5e4], eax
lea eax, [ebp - 0x388]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x160]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x448]
call fcn.10037280
cmp dword [ebp - 0x14c], 0x10
lea eax, [ebp - 0x160]
mov edx, 0x10064f08
lea ecx, [ebp - 0x460]
cmovae eax, dword [ebp - 0x160]
mov dword [ebp - 0x5a8], eax
lea eax, [ebp - 0x28]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x148]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x460]
call fcn.10037280
cmp dword [ebp - 0x134], 0x10
lea eax, [ebp - 0x148]
mov edx, 0x10064f08
lea ecx, [ebp - 0x478]
cmovae eax, dword [ebp - 0x148]
mov dword [ebp - 0x5ac], eax
lea eax, [ebp - 0x70]
push eax
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x130]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x478]
call fcn.10037280
cmp dword [ebp - 0x11c], 0x10
lea eax, [ebp - 0x130]
push 0x1006aca8
cmovae eax, dword [ebp - 0x130]
lea ecx, [ebp - 0x280]
mov edx, 0x1006ae90
mov dword [ebp - 0x5b0], eax
call fcn.10037a80
push str._max_planes
mov edx, eax
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x118]
call fcn.10037c00
add esp, 8
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 0x4d
call fcn.10037280
cmp dword [0x1006b0b4], 0x10
mov edi, 0x1006b0a0
mov esi, dword [ebp - 0x788]
cmovae edi, dword [0x1006b0a0]
mov dword [ebp - 0x578], 1
test esi, esi
je 0x1002b843
nop word [eax + eax]
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002b845
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002b830
xor eax, eax
cmp dword [ebp - 0x104], 0x10
lea edi, [ebp - 0x118]
mov esi, dword [eax + 0x1c]
cmovae edi, dword [ebp - 0x118]
test esi, esi
je 0x1002b873
push edi
mov ecx, esi
call fcn.10008b30
test eax, eax
jne 0x1002b875
mov esi, dword [esi + 0x28]
test esi, esi
jne 0x1002b860
xor eax, eax
lea ecx, [ebp - 0x578]
push ecx
mov ecx, eax
call fcn.10009370
mov edx, dword [ebp - 0x578]
lea ecx, [ebp - 0x100]
call fcn.1000c860
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x4e
push eax
mov edx, 0x10064c4c
lea ecx, [ebp - 0x280]
call fcn.10037c50
add esp, 4
lea ecx, [ebp - 0x118]
push eax
call fcn.100372d0
lea ecx, [ebp - 0x280]
call fcn.10037280
cmp dword [ebp - 0x104], 0x10
lea edi, [ebp - 0x118]
mov ecx, 0xc9bee4
cmovae edi, dword [ebp - 0x118]
call fcn.1003b890
mov ecx, 0xc9bee8
mov word [0x1023ca64], ax
call fcn.1003b890
mov ax, word [0x1023ca64]
mov ecx, 0xc9bee4
shr ax, 1
mov word [0x1009c908], ax
call fcn.1003b890
mov ecx, 0xc9bee8
mov word [0x1023ca64], ax
call fcn.1003b890
movzx esi, word [0x1023ca64]
mov eax, 0x66666667
mov ecx, esi
shr ecx, 1
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov word [0x1009c908], ax
mov eax, 0xcccccccd
mul esi
mov esi, 0x582050
shr edx, 2
movzx eax, dx
push eax
movzx eax, byte [0x100ec940]
push 0
push eax
mov word [0x1017ca00], dx
call esi
movzx eax, word [0x1017ca00]
push eax
movzx eax, byte [0x100ec940]
push 1
push eax
call esi
movzx eax, word [0x1017ca00]
push eax
movzx eax, byte [0x100ec940]
push 2
push eax
call esi
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
push dword [ebp - 0x558]
push dword [ebp - 0x554]
push dword [ebp - 0x5e0]
push dword [ebp - 0x5dc]
push dword [ebp - 0x5d8]
push dword [ebp - 0x5d4]
movzx eax, byte [0x100ec940]
mov esi, 0x581e00
push str.PLANE_
push 0
push eax
call esi
add esp, 0x60
movzx eax, byte [0x100ec940]
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.MAXHDR
push dword [ebp - 0x5d0]
push dword [ebp - 0x5c8]
push dword [ebp - 0x5c4]
push dword [ebp - 0x5c0]
push dword [ebp - 0x5b8]
push dword [ebp - 0x5b4]
push str.PILOT
push 1
push eax
call esi
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
push str.DUMMY
movzx eax, byte [0x100ec940]
push edi
push dword [ebp - 0x5b0]
push dword [ebp - 0x5ac]
push dword [ebp - 0x5a8]
push dword [ebp - 0x5e4]
push dword [ebp - 0x5bc]
push dword [ebp - 0x5cc]
push 0x10064f08
push 2
push eax
call esi
mov eax, dword [0xb7cb84]
lea ecx, [ebp - 0x100]
add esp, 0x78
mov dword [0x1025b6c8], eax
mov byte [0x1006c842], 0xff
call fcn.10037280
lea ecx, [ebp - 0x118]
call fcn.10037280
lea ecx, [ebp - 0x70]
call fcn.10037280
lea ecx, [ebp - 0x28]
call fcn.10037280
lea ecx, [ebp - 0x388]
call fcn.10037280
lea ecx, [ebp - 0x370]
call fcn.10037280
lea ecx, [ebp - 0x358]
call fcn.10037280
lea ecx, [ebp - 0x340]
call fcn.10037280
lea ecx, [ebp - 0x328]
call fcn.10037280
lea ecx, [ebp - 0x310]
call fcn.10037280
lea ecx, [ebp - 0x3b8]
call fcn.10037280
lea ecx, [ebp - 0x3a0]
call fcn.10037280
lea ecx, [ebp - 0x2f8]
call fcn.10037280
lea ecx, [ebp - 0x2e0]
call fcn.10037280
lea ecx, [ebp - 0x2c8]
call fcn.10037280
lea ecx, [ebp - 0x2b0]
call fcn.10037280
lea ecx, [ebp - 0x298]
call fcn.10037280
lea ecx, [ebp - 0x268]
call fcn.10037280
lea ecx, [ebp - 0x58]
call fcn.10037280
lea ecx, [ebp - 0x40]
call fcn.10037280
lea ecx, [ebp - 0x130]
call fcn.10037280
lea ecx, [ebp - 0x148]
call fcn.10037280
lea ecx, [ebp - 0x160]
call fcn.10037280
lea ecx, [ebp - 0x250]
call fcn.10037280
lea ecx, [ebp - 0x238]
call fcn.10037280
lea ecx, [ebp - 0x220]
call fcn.10037280
lea ecx, [ebp - 0x208]
call fcn.10037280
lea ecx, [ebp - 0x1f0]
call fcn.10037280
lea ecx, [ebp - 0x1d8]
call fcn.10037280
lea ecx, [ebp - 0x1c0]
call fcn.10037280
lea ecx, [ebp - 0x1a8]
call fcn.10037280
lea ecx, [ebp - 0x190]
call fcn.10037280
lea ecx, [ebp - 0x178]
call fcn.10037280
lea ecx, [ebp - 0xe8]
call fcn.10037280
lea ecx, [ebp - 0x88]
call fcn.10037280
lea ecx, [ebp - 0xa0]
call fcn.10037280
lea ecx, [ebp - 0xb8]
call fcn.10037280
lea ecx, [ebp - 0xd0]
call fcn.10037280
lea ecx, [ebp - 0x7a4]
call fcn.10009d40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003bfa7
mov esp, ebp
pop ebp
ret
call fcn.1004910a
call fcn.1004910a
call fcn.1004910a
call fcn.1004910a
call fcn.1004910a
call fcn.1004910a
call fcn.1004910a
int3