Function at 0x10015460
Capabilities:
Accept command line arguments
Create directory
Modify service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006b30a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe20
push esi
push edi
movzx eax, byte [ebp + 0x40]
test eax, eax
je 0x1001b795
lea eax, [ebp + 0x30]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x884], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x87c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x86c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x874], eax
mov dword [ebp - 0x790], 0x2517
cmp dword [ebp - 0x790], 0x8c8
jge 0x10015836
lea eax, [ebp - 0xc0]
push eax
push 0x100089d8
call fcn.10050e4b
pop ecx
pop ecx
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x6b4]
call fcn.1000dfce
and dword [ebp - 4], 0
and dword [ebp - 0x1b0], 0
jmp 0x10015511
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]
cmp eax, dword [ebp - 0xc0]
jge 0x1001553f
push dword [ebp - 0x1b0]
lea ecx, [ebp - 0x6b4]
call fcn.1000e00f
push eax
push 0x100089d8
call fcn.10050e4b
pop ecx
pop ecx
jmp 0x10015504
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x640]
call fcn.1000dfce
mov byte [ebp - 4], 1
and dword [ebp - 0x254], 0
jmp 0x1001556a
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x254]
cmp eax, dword [ebp - 0xc0]
jge 0x10015598
push dword [ebp - 0x254]
lea ecx, [ebp - 0x640]
call fcn.1000e00f
push eax
push 0x100089d8
call fcn.10050e4b
pop ecx
pop ecx
jmp 0x1001555d
mov dword [ebp - 0x7e4], 0x3b9aca07
lea eax, [ebp - 0x7e4]
push eax
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x69c]
call fcn.1000e01e
mov byte [ebp - 4], 2
and dword [ebp - 0x3c], 0
jmp 0x100155cb
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0xc0]
jge 0x100156c6
and dword [ebp - 0x108], 0
jmp 0x100155f0
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x3c]
jge 0x100156c1
push dword [ebp - 0x108]
lea ecx, [ebp - 0x6b4]
call fcn.1000e00f
mov esi, eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x6b4]
call fcn.1000e00f
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x100156bc
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x69c]
call fcn.1000e00f
mov esi, eax
push dword [ebp - 0x108]
lea ecx, [ebp - 0x640]
call fcn.1000e00f
mov edi, eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x640]
call fcn.1000e00f
mov ecx, dword [edi]
add ecx, dword [eax]
cmp dword [esi], ecx
jge 0x1001567b
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x69c]
call fcn.1000e00f
mov eax, dword [eax]
mov dword [ebp - 0x4b8], eax
jmp 0x100156a6
push dword [ebp - 0x108]
lea ecx, [ebp - 0x640]
call fcn.1000e00f
mov esi, eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x640]
call fcn.1000e00f
mov ecx, dword [esi]
add ecx, dword [eax]
mov dword [ebp - 0x4b8], ecx
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x69c]
call fcn.1000e00f
mov ecx, dword [ebp - 0x4b8]
mov dword [eax], ecx
jmp 0x100155e3
jmp 0x100155c4
mov dword [ebp - 0x148], 0x3b9aca05
and dword [ebp - 0xc8], 0
jmp 0x100156e6
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0xc0]
jge 0x100157cc
and dword [ebp - 0x130], 0
jmp 0x1001570e
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0xc8]
jge 0x100157c7
push dword [ebp - 0x130]
lea ecx, [ebp - 0x6b4]
call fcn.1000e00f
mov esi, eax
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x6b4]
call fcn.1000e00f
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x100157c2
push dword [ebp - 0x130]
lea ecx, [ebp - 0x69c]
call fcn.1000e00f
mov esi, eax
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x640]
call fcn.1000e00f
mov ecx, dword [esi]
add ecx, dword [eax]
cmp dword [ebp - 0x148], ecx
jge 0x10015788
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x620], eax
jmp 0x100157b6
push dword [ebp - 0x130]
lea ecx, [ebp - 0x69c]
call fcn.1000e00f
mov esi, eax
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x640]
call fcn.1000e00f
mov ecx, dword [esi]
add ecx, dword [eax]
mov dword [ebp - 0x620], ecx
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0x148], eax
jmp 0x10015701
jmp 0x100156d9
cvtsi2sd xmm0, dword [ebp - 0x148]
movsd xmm1, qword [0x100091e8]
comisd xmm1, xmm0
jbe 0x100157f0
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x628], eax
jmp 0x100157f7
or dword [ebp - 0x628], 0xffffffff
push dword [ebp - 0x628]
push 0x100089dc
call fcn.10051040
pop ecx
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x69c]
call fcn.1000e040
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x640]
call fcn.1000e040
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6b4]
call fcn.1000e040
mov eax, dword [ebp - 0x7ec]
movzx eax, byte [eax]
test eax, eax
je 0x10015855
push 0x8f2
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
jmp 0x1001b790
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0x88c], eax
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0x7f4], eax
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0x5d8], eax
mov eax, dword [ebp - 0x884]
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x88c]
mov eax, dword [eax + 0x38]
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x110], 0xfffffffa
mov dword [ebp - 0x110], 0
jmp 0x100158b7
mov eax, dword [ebp - 0x110]
dec eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0xfffffffe
jne 0x1001594c
mov dword [ebp - 0x1b8], 0x31e42a43
mov dword [ebp - 0x894], 3
mov dword [ebp - 0x1b8], 0xffffffff
jmp 0x100158f1
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0x1b
je 0x10015947
mov dword [ebp - 0x89c], 0xf495e3b3
push 1
lea eax, [ebp - 0x894]
push eax
push 0x3655
push 0x23cc
push 0x6dd8
lea eax, [ebp - 0x89c]
push eax
push 0
push 0x3232
push 0
push 0x43f7
push 0x1812
lea eax, [ebp - 0x110]
push eax
call fcn.10025843
add esp, 0x30
jmp 0x100158e4
jmp 0x100158aa
push 0x7447
push 0x6e40
push 0x3ad2
lea eax, [ebp - 0x110]
push eax
push 0
call fcn.100268ea
add esp, 0x14
mov dword [ebp - 0x1c0], 0x2c03342e
mov dword [ebp - 0xd08], 0xffffffff
mov dword [ebp - 0xcf8], 0x3b6182ea
mov dword [ebp - 0x8ac], 0xfffffff9
mov dword [ebp - 0xbdc], 0x6a205b29
mov dword [ebp - 0x224], 0
jmp 0x100159b7
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 1
jge 0x100159d3
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0x8b4], 0
jmp 0x100159aa
mov dword [ebp - 0x1c0], 0xffffffeb
jmp 0x100159ec
mov eax, dword [ebp - 0x1c0]
dec eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0xffffffea
je 0x10015aba
mov dword [ebp - 0xd3c], 0x26ff23b1
push 3
lea ecx, [ebp - 0xbfc]
call fcn.1000dfce
mov dword [ebp - 4], 3
mov dword [ebp - 0x8a4], 2
mov dword [ebp - 0x188], 0
jmp 0x10015a3a
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 1
jge 0x10015a56
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0xbe4], 0xfffffffa
jmp 0x10015a2d
push 0
lea eax, [ebp - 0x188]
push eax
push 0x2f0f
lea eax, [ebp - 0xbfc]
push eax
push 1
push 0x4c29
call fcn.10013630
add esp, 0x18
push 0
lea eax, [ebp - 0x8a4]
push eax
call fcn.10020c9d
pop ecx
pop ecx
mov byte [ebp - 0x98], 0
movzx eax, byte [ebp - 0x98]
test eax, eax
je 0x10015aa6
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbfc]
call fcn.1000e00a
jmp 0x100159df
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8ac]
mov dword [ebp + eax - 0x8b4], ecx
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x44], 0
jmp 0x10015ae4
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0xfffffffe
jne 0x10016929
mov dword [ebp - 0x128], 0x9e57ad95
push 3
lea ecx, [ebp - 0xa1c]
call fcn.1000dfce
mov dword [ebp - 4], 4
mov dword [ebp - 0xae8], 0xfff9
mov dword [ebp - 0x5c], 0
jmp 0x10015b26
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x10015b3c
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x1c8], 0xc204e2db
jmp 0x10015b1f
mov dword [ebp - 0x5c], 0
jmp 0x10015b4c
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x10015b65
push dword [ebp - 0x5c]
lea ecx, [ebp - 0xa1c]
call fcn.1000e00f
or dword [eax], 0xffffffff
jmp 0x10015b45
mov dword [ebp - 0x128], 0
jmp 0x10015b7e
mov eax, dword [ebp - 0x128]
dec eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jl 0x10015da8
mov dword [ebp - 0x324], 0x6b719d87
mov dword [ebp - 0x878], 1
mov dword [ebp - 0x27c], 0
jmp 0x10015bb8
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 2
jge 0x10015bd4
mov eax, dword [ebp - 0x27c]
mov dword [ebp + eax*4 - 0x21c], 0
jmp 0x10015bab
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x21c], 0
jmp 0x10015c02
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x21c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x21c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x21c], 0
jl 0x10015da3
mov dword [ebp - 0x29c], 7
mov dword [ebp - 0x5a4], 0xaf9d66de
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x21c]
cmp dword [ebp + eax*4 - 0x1c8], 0
jne 0x10015d7f
or eax, 0xffffffff
je 0x10015c6d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x21c]
cmp dword [ebp + eax*4 - 0x1c8], 0
je 0x10015c6d
mov dword [ebp - 0x630], 1
jmp 0x10015c74
and dword [ebp - 0x630], 0
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x29c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x21c]
mov eax, dword [ebp + eax*4 - 0x1c8]
cmp dword [ebp - 0x29c], eax
jl 0x10015cba
cmp dword [ebp - 0x128], 0
jne 0x10015cba
and dword [ebp - 0x618], 0
jmp 0x10015cc4
mov dword [ebp - 0x618], 1
mov eax, dword [ebp - 0x618]
neg eax
mov dword [ebp - 0x5a4], eax
jne 0x10015ce6
cmp dword [ebp - 0x878], 0
jne 0x10015ce6
and dword [ebp - 0x32c], 0
jmp 0x10015cf0
mov dword [ebp - 0x32c], 1
cmp dword [ebp - 0x32c], 0xffffffff
jle 0x10015d05
mov dword [ebp - 0x4d4], 1
jmp 0x10015d0c
and dword [ebp - 0x4d4], 0
imul eax, dword [ebp - 0x4d4], 6
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x21c]
jne 0x10015d34
cmp dword [ebp - 0x29c], 0
jne 0x10015d34
and dword [ebp - 0x334], 0
jmp 0x10015d3e
mov dword [ebp - 0x334], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x21c]
mov eax, dword [ebp + eax*4 - 0x1c8]
cmp dword [ebp - 0x334], eax
jle 0x10015d66
mov dword [ebp - 0x7dc], 1
jmp 0x10015d6d
and dword [ebp - 0x7dc], 0
cmp dword [ebp - 0x128], 0
jne 0x10015d7f
and dword [ebp - 0x654], 0
jmp 0x10015d89
mov dword [ebp - 0x654], 1
push 0
lea ecx, [ebp - 0xa1c]
call fcn.1000e00f
mov ecx, dword [ebp - 0x654]
mov dword [eax], ecx
jmp 0x10015be7
jmp 0x10015b71
mov byte [ebp - 0xa2], 0
movzx eax, byte [ebp - 0xa2]
test eax, eax
je 0x10015de4
push 0x7309
push 0x377c
push 0x4f21
push 0
push 0x6d38
push 0x3890
push 0
push 0x7e07
call fcn.10025545
add esp, 0x20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa1c]
call fcn.1000e00a
mov dword [ebp - 0x25c], 0x31e42a43
mov dword [ebp - 0xd0], 1
mov dword [ebp - 0x2e8], 0x3bed
mov dword [ebp - 0x2a4], 0xacd4a797
mov dword [ebp - 0x614], 0xfffffff6
mov dword [ebp - 0x36c], 0xffffffff
mov dword [ebp - 0x6d0], 0x1ffc
cmp dword [ebp - 0x6d0], 0xc9c
jge 0x10015fa5
lea eax, [ebp - 0x150]
push eax
mov ecx, 0x1065de18
call fcn.1003217f
push 0x10008aed
lea ecx, [ebp - 0x9b0]
call fcn.1000dd4a
mov dword [ebp - 4], 5
xor eax, eax
mov word [ebp - 0xa0], ax
jmp 0x10015e8e
mov ax, word [ebp - 0xa0]
add ax, 1
mov word [ebp - 0xa0], ax
movsx eax, word [ebp - 0xa0]
movsx ecx, word [ebp - 0x150]
cmp eax, ecx
jge 0x10015eb2
push 0x10008e98
lea ecx, [ebp - 0x9b0]
call fcn.10032097
jmp 0x10015e7c
xor eax, eax
mov word [ebp - 0xb8], ax
jmp 0x10015ecf
mov ax, word [ebp - 0xb8]
add ax, 1
mov word [ebp - 0xb8], ax
movsx eax, word [ebp - 0xb8]
movsx ecx, word [ebp - 0x150]
cmp eax, ecx
jge 0x10015ef3
push 0x10008e9c
lea ecx, [ebp - 0x9b0]
call fcn.10032097
jmp 0x10015ebd
push fcn.10035be1
lea edx, [ebp - 0x9b0]
mov ecx, 0x1065dcf8
call fcn.10035c1b
mov ecx, eax
call fcn.100326db
lea eax, [ebp - 0xaf0]
push eax
lea ecx, [ebp - 0x9b0]
call fcn.1000e6a1
push dword [eax]
lea eax, [ebp - 0xaf8]
push eax
lea ecx, [ebp - 0x9b0]
call fcn.1000e68d
push dword [eax]
call fcn.10035db8
pop ecx
pop ecx
movzx eax, al
test eax, eax
je 0x10015f96
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xb00], esp
lea eax, [ebp - 0x9b0]
push eax
call fcn.100119f0
call fcn.10015252
add esp, 0x18
mov byte [ebp - 0xd1], al
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x10015f91
push fcn.10035be1
lea edx, [ebp - 0x9b0]
mov ecx, 0x1065dcf8
call fcn.10035c1b
mov ecx, eax
call fcn.100326db
jmp 0x10015f0f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9b0]
call fcn.1000dd79
mov dword [ebp - 0x22c], 0
jmp 0x10015fbe
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 3
jge 0x10015fda
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0xdac], 0xfddf34ff
jmp 0x10015fb1
cmp dword [ebp - 0xd0], 0xef51
je 0x10015ff2
mov dword [ebp - 0x33c], 1
jmp 0x10015ff9
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x33c], eax
jle 0x10016013
mov dword [ebp - 0x4dc], 1
jmp 0x1001601a
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x4dc], eax
jle 0x10016034
mov dword [ebp - 0x888], 1
jmp 0x1001603b
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp - 0xd0]
add eax, 0x4ce34aaf
sub eax, dword [ebp - 0x2a4]
jne 0x1001606c
cmp dword [ebp - 0x2a4], 0
jne 0x1001606c
and dword [ebp - 0x344], 0
jmp 0x10016076
mov dword [ebp - 0x344], 1
mov eax, dword [ebp - 0xd0]
cmp eax, dword [ebp - 0x344]
jge 0x10016090
mov dword [ebp - 0x5ac], 1
jmp 0x10016097
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x614]
mov ecx, dword [ebp - 0x5ac]
lea eax, [ecx + eax + 3]
cmp dword [ebp - 0xd0], eax
jge 0x100160bb
mov dword [ebp - 0x34c], 1
jmp 0x100160c2
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x2a4]
cmp dword [ebp - 0x34c], eax
jg 0x100160dc
mov dword [ebp - 0x4e4], 1
jmp 0x100160e3
and dword [ebp - 0x4e4], 0
imul eax, dword [ebp - 0x4e4], 0
cmp eax, 0xa165f5c9
jne 0x100160fd
mov dword [ebp - 0x354], 1
jmp 0x10016104
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0xd0]
add eax, dword [ebp - 0x354]
cmp eax, dword [ebp - 0x614]
je 0x10016124
mov dword [ebp - 0x35c], 1
jmp 0x1001612b
and dword [ebp - 0x35c], 0
cmp dword [ebp - 0x35c], 0xffff
jae 0x10016143
mov dword [ebp - 0x4ec], 1
jmp 0x1001614a
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x4ec], eax
jl 0x10016164
mov dword [ebp - 0x364], 1
jmp 0x1001616b
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0xd0]
imul eax, dword [ebp - 0x364]
cmp eax, 0xfffffff6
jne 0x10016189
mov dword [ebp - 0x5b4], 1
jmp 0x10016190
and dword [ebp - 0x5b4], 0
imul eax, dword [ebp - 0x5b4], 0xae8e
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 1
jne 0x100161b5
mov dword [ebp - 0x4f4], 1
jmp 0x100161bc
and dword [ebp - 0x4f4], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x4f4]
mov dword [ebp + eax - 0xdac], ecx
mov dword [ebp - 0x3c4], 3
mov dword [ebp - 0xb10], 0xea75c96
mov dword [ebp - 0x6d8], 0x7df2f4a8
mov dword [ebp - 0xb18], 3
mov dword [ebp - 0x374], 0xffff
mov dword [ebp - 0x1d0], 0
jmp 0x10016219
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 2
jge 0x10016235
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0xe04], 0x256a9ef7
jmp 0x1001620c
mov eax, dword [ebp - 0x374]
inc eax
mov dword [ebp - 0x374], eax
mov dword [ebp - 0x6d8], 0x2a831d26
mov dword [ebp - 0x25c], 0xffffffff
jmp 0x10016265
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0x1b
je 0x10016924
mov dword [ebp - 0x28], 1
mov dword [ebp - 0xab0], 0xb319bd1
mov dword [ebp - 0xaac], 0xb319bd1
mov dword [ebp - 0xaa8], 0xb319bd1
mov dword [ebp - 0xaa4], 0xb319bd1
push 0x7fc8
push 0
push 0
call fcn.1001c060
add esp, 0xc
mov dword [ebp - 0x28], 0
jmp 0x100162c2
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xfffffffe
jge 0x10016622
mov dword [ebp - 0x118], 0xffffffff
mov dword [ebp - 0x1d8], 0x21046671
mov dword [ebp - 0x504], 1
mov dword [ebp - 0x3ac], 0xfffffff7
mov dword [ebp - 0x3b4], 0xffffffff
mov dword [ebp - 0x8c8], 0xffffffff
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0xb20], eax
mov eax, 0x27fa
cmp eax, 0xad5b
jg 0x1001632c
mov dword [ebp - 0x66c], 1
jmp 0x10016333
and dword [ebp - 0x66c], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x66c]
add eax, dword [ebp - 0x28]
jne 0x10016353
cmp dword [ebp - 0x118], 0
jne 0x10016353
and dword [ebp - 0x37c], 0
jmp 0x1001635d
mov dword [ebp - 0x37c], 1
mov eax, dword [ebp - 0x118]
cmp dword [ebp - 0x37c], eax
jle 0x10016377
mov dword [ebp - 0x4fc], 1
jmp 0x1001637e
and dword [ebp - 0x4fc], 0
cmp dword [ebp - 0x4fc], 0x30a9
je 0x10016396
mov dword [ebp - 0x384], 1
jmp 0x1001639d
and dword [ebp - 0x384], 0
cmp dword [ebp - 0x384], 1
jle 0x100163b2
mov dword [ebp - 0x5bc], 1
jmp 0x100163b9
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x5bc]
neg eax
je 0x100163cc
cmp dword [ebp - 0x118], 0
jne 0x100163db
cmp dword [ebp - 0x28], 0
jne 0x100163db
and dword [ebp - 0x820], 0
jmp 0x100163e5
mov dword [ebp - 0x820], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xb28], eax
imul eax, dword [ebp - 0x118], 0
cmp eax, dword [ebp - 0x1d8]
jle 0x10016425
mov byte [ebp - 0xa4], 0
movzx eax, byte [ebp - 0xa4]
test eax, eax
je 0x10016420
push 0
push 0x5121
push 0
call fcn.10025cf5
add esp, 0xc
jmp 0x1001661d
mov dword [ebp - 0x50c], 0x6a4137d6
mov dword [ebp - 0x5c4], 7
mov dword [ebp - 0x39c], 0xfffffff8
push 2
lea ecx, [ebp - 0x968]
call fcn.1000dfce
mov dword [ebp - 4], 6
push 0
push 0x6208
lea eax, [ebp - 0xb30]
push eax
push 0
lea eax, [ebp - 0x968]
push eax
push 0x4d70
push 0x7942
push 0x2399
push 0x4ea9
push 0x52ab
call fcn.1002ca4f
add esp, 0x28
cmp dword [ebp - 0x50c], 0
jne 0x1001659e
cmp dword [ebp - 0x1d8], 0xffff
jb 0x100164b4
mov dword [ebp - 0x38c], 1
jmp 0x100164bb
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x38c]
neg eax
mov dword [ebp - 0x504], eax
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x394], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x394]
mov dword [ebp + eax - 0xab0], ecx
cmp dword [ebp - 0x394], 0x549c
jle 0x10016500
mov dword [ebp - 0x61c], 1
jmp 0x10016507
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x61c]
add eax, 8
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x5c4]
mov dword [ebp - 0xb38], eax
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0xb40], eax
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0xb48], eax
cmp dword [ebp - 0x1d8], 5
jle 0x1001654f
mov dword [ebp - 0x3a4], 1
jmp 0x10016556
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x50c]
cmp dword [ebp - 0x3a4], eax
jg 0x10016570
mov dword [ebp - 0x6e0], 1
jmp 0x10016577
and dword [ebp - 0x6e0], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xb50], eax
mov eax, dword [ebp - 0x5c4]
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 0
jne 0x1001659e
and dword [ebp - 0x514], 0
jmp 0x100165a8
mov dword [ebp - 0x514], 1
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x3b4], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x3b4], eax
jne 0x100165cb
mov dword [ebp - 0x668], 1
jmp 0x100165d2
and dword [ebp - 0x668], 0
push 0
lea ecx, [ebp - 0x968]
call fcn.1000e00f
mov ecx, dword [ebp - 0x668]
mov dword [eax], ecx
mov dword [ebp - 0x8c8], 4
cmp dword [ebp - 0x1d8], 0
je 0x1001660e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x968]
call fcn.1000e00a
jmp 0x100162bb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x968]
call fcn.1000e00a
jmp 0x100162bb
mov dword [ebp - 0x2d4], 0xf495e3b3
push 4
lea ecx, [ebp - 0x8c4]
call fcn.1000dfce
mov dword [ebp - 4], 7
mov dword [ebp - 0x274], 0
mov dword [ebp - 0x6e8], 0x2ca8cda2
mov dword [ebp - 0x140], 0
jmp 0x1001666d
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 1
jge 0x10016689
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0xb58], 1
jmp 0x10016660
push 0x33e3
lea eax, [ebp - 0x140]
push eax
push 0
lea eax, [ebp - 0x8c4]
push eax
push 0x6c25
call fcn.1001f77c
add esp, 0x14
push 0
lea ecx, [ebp - 0x8c4]
call fcn.1000e00f
and dword [eax], 0
jmp 0x100166e1
push 0
lea ecx, [ebp - 0x8c4]
call fcn.1000e00f
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp - 0x3bc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3bc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x8c4]
call fcn.1000e00f
cmp dword [eax], 0
jg 0x100167cf
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x234], 0
jmp 0x1001671a
mov eax, dword [ebp - 0x234]
dec eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jl 0x100167a2
mov dword [ebp - 0x1e0], 0xffffffff
mov byte [ebp - 0xba], 0
movzx eax, byte [ebp - 0xba]
test eax, eax
je 0x1001675c
push 0x12b7
push 0x2117
push 0
push 1
push 0x36a4
push 0
call fcn.1002d81e
add esp, 0x18
mov dword [ebp - 0x1e0], 0
jmp 0x10016775
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
jg 0x1001679d
mov byte [ebp - 0xa6], 0
lea eax, [ebp - 0xa6]
push eax
push 0
push 0x5091
call fcn.1002e2bf
add esp, 0xc
jmp 0x10016768
jmp 0x1001670d
mov byte [ebp - 0xf1], 0
movzx eax, byte [ebp - 0xf1]
test eax, eax
je 0x100167ca
push 0
push 0x5a38
push 0x197f
push 0
call fcn.1002b969
add esp, 0x10
jmp 0x100166bd
mov dword [ebp - 0x274], 0
jmp 0x100167e8
mov eax, dword [ebp - 0x274]
dec eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xfffffffd
je 0x1001686d
push 0
push 0
lea eax, [ebp - 0x6e8]
push eax
push 0x548a
push 0x4eea
push 0x4a30
push 0x5f4f
call fcn.1001370a
add esp, 0x1c
mov byte [ebp - 0xa8], 0
movzx eax, byte [ebp - 0xa8]
test eax, eax
je 0x10016868
push 0x7220
push 0x4b90
push 0x1a61
push 0x50a0
push 0x5f20
push 1
push 0x652b
push 0x374
push 0x797f
push 0x26e0
push 0
push 0xdab
call fcn.100146fb
add esp, 0x30
jmp 0x100167db
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c4]
call fcn.1000e00a
mov eax, dword [ebp - 0x44]
sub eax, 7
cmp eax, 2
jb 0x10016893
mov dword [ebp - 0x5cc], 1
jmp 0x1001689a
and dword [ebp - 0x5cc], 0
push 0xfffffffffffffff8
pop eax
test eax, eax
je 0x100168eb
mov eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0x44], eax
jl 0x100168c1
cmp dword [ebp - 0x2d4], 0
je 0x100168c1
mov dword [ebp - 0x51c], 1
jmp 0x100168c8
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x3c4], eax
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x3c4], eax
jg 0x100168eb
mov dword [ebp - 0x3cc], 1
jmp 0x100168f2
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x5cc]
cmp eax, dword [ebp - 0x3cc]
je 0x1001690c
mov dword [ebp - 0x524], 1
jmp 0x10016913
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x2d4], eax
jmp 0x10016258
jmp 0x10015add
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
push 3
lea ecx, [ebp - 0x8d4]
call fcn.1000dfce
mov dword [ebp - 4], 8
mov dword [ebp - 0x138], 0x96960f57
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x1e8], 0
jmp 0x1001696d
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 3
jge 0x1001698f
push dword [ebp - 0x1e8]
lea ecx, [ebp - 0x8d4]
call fcn.1000e00f
mov dword [eax], 0xfffa
jmp 0x10016960
mov dword [ebp - 0x138], 0
jmp 0x100169a8
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 2
jg 0x10016ba3
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x100], 0x56df
push dword [ebp - 0x138]
lea ecx, [ebp - 0x8d4]
call fcn.1000e00f
mov esi, eax
push 0
lea ecx, [ebp - 0x8d4]
call fcn.1000e00f
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x100169f8
mov dword [ebp - 0x3d4], 1
jmp 0x100169ff
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x3d4]
neg eax
imul eax, eax, 0xb666
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x64], 0
jmp 0x10016a26
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jg 0x10016b9e
mov dword [ebp - 0x2ac], 0x4c8f0d07
mov dword [ebp - 0x828], 0xfffffff8
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0xb60], eax
cmp dword [ebp - 0x64], 0
je 0x10016a71
cmp dword [ebp - 0x2ac], 0
je 0x10016a71
cmp dword [ebp - 0x64], 0
je 0x10016a71
mov dword [ebp - 0x624], 1
jmp 0x10016a78
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x624], eax
jne 0x10016a98
cmp dword [ebp - 0x100], 0
jne 0x10016a98
and dword [ebp - 0x3dc], 0
jmp 0x10016aa2
mov dword [ebp - 0x3dc], 1
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x828]
add ecx, dword [ebp - 0x3dc]
add ecx, dword [ebp - 0x64]
imul eax, ecx
cmp eax, 0xb64d
jge 0x10016b39
mov dword [ebp - 0x80], 2
jmp 0x10016ad7
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jl 0x10016b37
mov dword [ebp - 0x100], 2
jmp 0x10016af6
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jl 0x10016b35
push 1
lea eax, [ebp - 0x64]
push eax
push 0x59ea
push 0
push 0x1c9e
push 0x29
push 0x2b54
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x8d4]
push eax
push 0x3d7f
call fcn.1002ca4f
add esp, 0x28
jmp 0x10016ae9
jmp 0x10016ad0
jmp 0x10016b99
mov byte [ebp - 0xbc], 0
push 0x5f2e
push 0x30bf
push 0x4e2c
push 0x6ff6
push 0
push 0x6367
lea eax, [ebp - 0xbc]
push eax
push 0x2f92
push 0x486b
push 0xd35
push 0x25bc
push 0xed3
push 0
push 0x3748
push 0x4dc6
push 0x356a
push 0x1a14
call fcn.100200ea
add esp, 0x44
jmp 0x10016a1f
jmp 0x1001699b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8d4]
call fcn.1000e00a
cmp dword [ebp - 0x2d0], 0
jle 0x1001b790
mov dword [ebp - 0x88], 0x85f70ad6
mov dword [ebp - 0x58], 1
push 3
lea ecx, [ebp - 0xa4c]
call fcn.1000dfce
mov dword [ebp - 4], 9
mov dword [ebp - 0x838], 0xfffffffd
mov dword [ebp - 0x710], 0xb53c
mov dword [ebp - 0x23c], 0
jmp 0x10016c11
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 3
jge 0x10016c33
push dword [ebp - 0x23c]
lea ecx, [ebp - 0xa4c]
call fcn.1000e00f
mov dword [eax], 2
jmp 0x10016c04
mov dword [ebp - 0x88], 0
jmp 0x10016c4c
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xfffffffc
jle 0x1001722f
mov dword [ebp - 0x2ec], 0xfffd
mov dword [ebp - 0x1f0], 0x7d6364d6
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0x5537
call fcn.10020da2
add esp, 0x10
mov eax, 0xcde9
test eax, eax
je 0x10016d18
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0xb68], eax
cmp dword [ebp - 0x58], 0x9646
jge 0x10016cb5
mov dword [ebp - 0x52c], 1
jmp 0x10016cbc
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0x52c], eax
jle 0x10016cd6
mov dword [ebp - 0x3e4], 1
jmp 0x10016cdd
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x2ec]
cmp eax, dword [ebp - 0x3e4]
je 0x10016cf7
mov dword [ebp - 0x5d4], 1
jmp 0x10016cfe
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0x5d4], eax
jne 0x10016d18
mov dword [ebp - 0x3ec], 1
jmp 0x10016d1f
and dword [ebp - 0x3ec], 0
cmp dword [ebp - 0x3ec], 0x1b40
jg 0x10016d37
mov dword [ebp - 0x534], 1
jmp 0x10016d3e
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x2ec]
cmp eax, dword [ebp - 0x534]
jl 0x10016d58
mov dword [ebp - 0x3f4], 1
jmp 0x10016d5f
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x3f4], eax
jle 0x10016d79
mov dword [ebp - 0x660], 1
jmp 0x10016d80
and dword [ebp - 0x660], 0
mov eax, dword [ebp - 0x88]
add eax, dword [ebp - 0x660]
jne 0x10016da0
cmp dword [ebp - 0x1f0], 0
jne 0x10016da0
and dword [ebp - 0x3fc], 0
jmp 0x10016daa
mov dword [ebp - 0x3fc], 1
mov eax, dword [ebp - 0x1f0]
cmp dword [ebp - 0x3fc], eax
jge 0x10016dc4
mov dword [ebp - 0x53c], 1
jmp 0x10016dcb
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x53c]
sub eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x58]
jne 0x100171ce
mov dword [ebp - 0x58], 2
jmp 0x10016ded
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jl 0x100171cc
mov byte [ebp - 0xaa], 0
mov dword [ebp - 0x6f0], 0x2608
cmp dword [ebp - 0x6f0], 0xf1d
jge 0x100171ae
mov dword [ebp - 0xd04], 0x15
and dword [ebp - 0xd00], 0
lea eax, [ebp - 0x708]
push eax
lea eax, [ebp - 0x918]
push eax
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x160]
push eax
push 0x10008ea0
call fcn.10050e4b
add esp, 0x14
xorpd xmm0, xmm0
movlpd qword [ebp - 0xbf0], xmm0
lea eax, [ebp - 0xbf0]
push eax
mov eax, dword [ebp - 0x198]
inc eax
push eax
lea ecx, [ebp - 0xdb8]
call fcn.10032c62
mov dword [ebp - 0x890], eax
mov eax, dword [ebp - 0x890]
mov dword [ebp - 0x6f8], eax
mov byte [ebp - 4], 0xa
push dword [ebp - 0x6f8]
mov eax, dword [ebp - 0x160]
inc eax
push eax
lea ecx, [ebp - 0x6c0]
call fcn.10032d00
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xdb8]
call fcn.1000e00a
xorpd xmm0, xmm0
movlpd qword [ebp - 0xd78], xmm0
lea eax, [ebp - 0xd78]
push eax
mov eax, dword [ebp - 0x198]
inc eax
push eax
lea ecx, [ebp - 0xdc4]
call fcn.10032c62
mov dword [ebp - 0x830], eax
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x700], eax
mov byte [ebp - 4], 0xd
push dword [ebp - 0x700]
mov eax, dword [ebp - 0x160]
inc eax
push eax
lea ecx, [ebp - 0x6a8]
call fcn.10032d00
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xdc4]
call fcn.1000e00a
push 0
push 0
lea ecx, [ebp - 0x6c0]
call fcn.10032d27
mov ecx, eax
call fcn.10032cf1
mov dword [eax], 1
and dword [eax + 4], 0
push 0
push 0
lea ecx, [ebp - 0x6a8]
call fcn.10032d27
mov ecx, eax
call fcn.10032cf1
mov dword [eax], 1
and dword [eax + 4], 0
and dword [ebp - 0x30], 0
jmp 0x10016f67
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x160]
jg 0x1001712e
and dword [ebp - 0x2c], 0
jmp 0x10016f83
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x198]
jg 0x10017129
mov dword [ebp - 0x178], 1
jmp 0x10016fab
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
cmp eax, dword [ebp - 0x918]
jg 0x1001701e
mov eax, dword [ebp - 0x178]
cmp eax, dword [ebp - 0x30]
jg 0x1001701e
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x6c0]
call fcn.10032d27
mov ecx, eax
call fcn.10032cf1
mov dword [ebp - 0x404], eax
push dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x178]
push eax
lea ecx, [ebp - 0x6a8]
call fcn.10032d27
mov ecx, eax
call fcn.10032cf1
mov ecx, dword [ebp - 0x404]
mov edx, dword [ecx]
add edx, dword [eax]
mov ecx, dword [ecx + 4]
adc ecx, dword [eax + 4]
mov eax, dword [ebp - 0x404]
mov dword [eax], edx
mov dword [eax + 4], ecx
jmp 0x10016f9e
mov dword [ebp - 0x158], 1
jmp 0x10017037
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x158]
cmp eax, dword [ebp - 0x708]
jg 0x100170aa
mov eax, dword [ebp - 0x158]
cmp eax, dword [ebp - 0x2c]
jg 0x100170aa
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x6a8]
call fcn.10032d27
mov ecx, eax
call fcn.10032cf1
mov dword [ebp - 0x5dc], eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x158]
push eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x6c0]
call fcn.10032d27
mov ecx, eax
call fcn.10032cf1
mov ecx, dword [ebp - 0x5dc]
mov edx, dword [ecx]
add edx, dword [eax]
mov ecx, dword [ecx + 4]
adc ecx, dword [eax + 4]
mov eax, dword [ebp - 0x5dc]
mov dword [eax], edx
mov dword [eax + 4], ecx
jmp 0x1001702a
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x6c0]
call fcn.10032d27
mov ecx, eax
call fcn.10032cf1
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x40c]
push 0
push 0x15
push dword [eax + 4]
push dword [eax]
call fcn.1006a850
mov ecx, dword [ebp - 0x40c]
mov dword [ecx], eax
mov dword [ecx + 4], edx
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
lea ecx, [ebp - 0x6a8]
call fcn.10032d27
mov ecx, eax
call fcn.10032cf1
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x544]
push 0
push 0x15
push dword [eax + 4]
push dword [eax]
call fcn.1006a850
mov ecx, dword [ebp - 0x544]
mov dword [ecx], eax
mov dword [ecx + 4], edx
jmp 0x10016f7c
jmp 0x10016f60
push dword [ebp - 0x198]
push dword [ebp - 0x160]
lea ecx, [ebp - 0x6c0]
call fcn.10032d27
mov ecx, eax
call fcn.10032cf1
mov esi, eax
push dword [ebp - 0x198]
push dword [ebp - 0x160]
lea ecx, [ebp - 0x6a8]
call fcn.10032d27
mov ecx, eax
call fcn.10032cf1
mov ecx, dword [esi]
add ecx, dword [eax]
mov edx, dword [esi + 4]
adc edx, dword [eax + 4]
push 0
push 0x15
push edx
push ecx
call fcn.1006a850
push edx
push eax
push 0x10008e8c
call fcn.10051040
add esp, 0xc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x6a8]
call fcn.10032d22
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x6c0]
call fcn.10032d22
movzx eax, byte [ebp - 0xaa]
test eax, eax
je 0x100171c7
push 0x59e8
push 0
call fcn.1002dc59
pop ecx
pop ecx
jmp 0x10016de6
jmp 0x1001722a
mov dword [ebp - 0x264], 0
jmp 0x100171e7
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 1
jge 0x10017203
mov eax, dword [ebp - 0x264]
mov dword [ebp + eax*4 - 0x414], 0x9843334a
jmp 0x100171da
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x414], 0
je 0x10017215
jmp 0x1001722f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x414], 0
je 0x1001722a
jmp 0x10016c3f
jmp 0x10016c3f
push 0x2cad
push 0
lea eax, [ebp - 0x838]
push eax
push 0x75ea
lea eax, [ebp - 0x58]
push eax
push 0x7397
push 0
push 0x344a
push 0x1bf8
lea eax, [ebp - 0xa4c]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x710]
push eax
push 0x1d03
call fcn.10013e20
add esp, 0x34
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa4c]
call fcn.1000e00a
mov dword [ebp - 0x898], 0x91a049fe
mov dword [ebp - 0xb70], 0xf84b8114
mov dword [ebp - 0xb78], 0x39ed080c
mov dword [ebp - 0xd5c], 0xffffffff
mov dword [ebp - 0xd58], 0xffffffff
mov dword [ebp - 0xd54], 0xffffffff
mov dword [ebp - 0xd50], 0xffffffff
and dword [ebp - 0x9d4], 0
and dword [ebp - 0x9d0], 0
and dword [ebp - 0x9cc], 0
and dword [ebp - 0x9c8], 0
lea ecx, [ebp - 0x289]
call fcn.1000e7d2
push eax
lea eax, [ebp - 0x9c4]
push eax
lea eax, [ebp - 0x9d4]
push eax
lea ecx, [ebp - 0xdfc]
call fcn.10032a42
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc10]
call fcn.100329ab
mov dword [ebp - 4], 0x10
push 0
push 0x7c6d
lea eax, [ebp - 0x898]
push eax
call fcn.10021232
add esp, 0xc
push 0x3b7b
push 0x14c3
lea eax, [ebp - 0xc10]
push eax
push 0x649e
push 0x5154
push 0
push 0
call fcn.1002bb1d
add esp, 0x1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc10]
call fcn.1000e00a
push 3
lea ecx, [ebp - 0x950]
call fcn.1000dfce
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x10c], 0x96960f57
push 2
lea ecx, [ebp - 0xa64]
call fcn.1000dfce
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x180], 0xfb871c7b
push 1
lea ecx, [ebp - 0xa7c]
call fcn.1000dfce
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x718]
push eax
push 0
push 0x5fbb
push 0x6e05
push 0x5b2
lea eax, [ebp - 0xa64]
push eax
call fcn.1001f154
add esp, 0x18
lea eax, [ebp - 0xa7c]
push eax
lea eax, [ebp - 0x718]
push eax
push 0
call fcn.1002bea2
add esp, 0xc
mov byte [ebp - 0xd9], 0
push 0
lea eax, [ebp - 0xd9]
push eax
push 0xf41
push 0x26f4
push 0x7ccc
call fcn.10031f15
add esp, 0x14
mov dword [ebp - 0x180], 1
jmp 0x1001743b
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0
jl 0x100174b6
mov dword [ebp - 0x720], 0x2703d9b9
mov dword [ebp - 0x840], 5
mov byte [ebp - 0xac], 0
movzx eax, byte [ebp - 0xac]
test eax, eax
je 0x1001747f
push 0x10ab
push 0xc2
push 0x1e22
call dword [sym.imp.GDI32.dll_GetPixel]
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x840]
push eax
push 0x5d87
lea eax, [ebp - 0xa64]
push eax
push 0
lea eax, [ebp - 0xa7c]
push eax
lea eax, [ebp - 0x720]
push eax
call fcn.1002c021
add esp, 0x1c
jmp 0x1001742e
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xa7c]
call fcn.1000e00a
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xa64]
call fcn.1000e00a
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0x1a0], 0x459eeda5
xor eax, eax
inc eax
je 0x1001766d
mov dword [ebp - 0x7c], 0xfffffffb
mov dword [ebp - 0x8d8], 0x87e3bc4a
mov dword [ebp - 0x1f8], 0
jmp 0x1001751b
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 3
jge 0x10017537
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0x8e4], 0xabec
jmp 0x1001750e
mov dword [ebp - 0x7c], 2
jmp 0x10017547
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jl 0x10017572
mov eax, dword [ebp - 0x7c]
cmp dword [ebp + eax*4 - 0x8e4], 0
je 0x1001755c
jmp 0x10017572
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x7c]
mov eax, dword [ebp + eax*4 - 0x8e4]
mov dword [ebp + ecx*4 - 0x8e4], eax
jmp 0x10017540
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0xb80], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0xb88], eax
cmp dword [ebp - 0x1a0], 0
jne 0x100175a5
cmp dword [ebp - 0x1a0], 0
jne 0x100175a5
and dword [ebp - 0x62c], 0
jmp 0x100175af
mov dword [ebp - 0x62c], 1
push 4
pop eax
shl eax, 0
imul ecx, dword [ebp - 0x62c], 0x5240
cmp dword [ebp + eax - 0x8e4], ecx
jne 0x100175d4
mov dword [ebp - 0x41c], 1
jmp 0x100175db
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x41c]
dec eax
cmp eax, 1
je 0x100175f3
mov dword [ebp - 0x54c], 1
jmp 0x100175fa
and dword [ebp - 0x54c], 0
cmp dword [ebp - 0x54c], 0x15fb
jle 0x10017612
mov dword [ebp - 0x424], 1
jmp 0x10017619
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x424], eax
je 0x10017630
mov dword [ebp - 0x5e4], 1
jmp 0x10017637
and dword [ebp - 0x5e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8e4]
cmp dword [ebp - 0x5e4], eax
je 0x10017658
mov dword [ebp - 0x42c], 1
jmp 0x1001765f
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x8d8], eax
jmp 0x10017692
push 1
push 0
push 0x54cf
push 0x7fa1
push 0x2b6c
push 0x996
push 0x756
call fcn.1001370a
add esp, 0x1c
mov dword [ebp - 0x730], 0x6580
mov dword [ebp - 0x728], 0x6a927213
mov dword [ebp - 0x554], 0xdc41fd9d
push 2
lea ecx, [ebp - 0x95c]
call fcn.1000dfce
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x848], 0
mov dword [ebp - 0x244], 0
jmp 0x100176e4
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 2
jge 0x10017703
push dword [ebp - 0x244]
lea ecx, [ebp - 0x95c]
call fcn.1000e00f
or dword [eax], 0xffffffff
jmp 0x100176d7
lea eax, [ebp - 0x95c]
push eax
push 1
lea eax, [ebp - 0x728]
push eax
push 0
push 0x6333
push 0
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x554]
push eax
push 0x7340
lea eax, [ebp - 0x730]
push eax
call fcn.1002133a
add esp, 0x28
lea eax, [ebp - 0x554]
push eax
lea eax, [ebp - 0x95c]
push eax
push 0
call fcn.1002c5a8
add esp, 0xc
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x95c]
call fcn.1000e00a
mov dword [ebp - 0x200], 0
jmp 0x1001777e
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 3
jge 0x100177a0
push dword [ebp - 0x200]
lea ecx, [ebp - 0x950]
call fcn.1000e00f
mov dword [eax], 0xfffa
jmp 0x10017771
mov dword [ebp - 0x68], 0xfffd
mov dword [ebp - 0x2b4], 1
mov dword [ebp - 0x168], 0x1078932
mov dword [ebp - 0x208], 0xcd9d754
mov dword [ebp - 0x2dc], 0xffffffff
mov dword [ebp - 0x284], 0
jmp 0x100177e8
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 3
jge 0x10017804
mov eax, dword [ebp - 0x284]
mov dword [ebp + eax*4 - 0xddc], 0xfffffffa
jmp 0x100177db
push 1
lea eax, [ebp - 0x68]
push eax
push 0
call fcn.100138f3
add esp, 0xc
mov eax, dword [ebp - 0x2b4]
dec eax
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x2b4], eax
je 0x10017838
mov dword [ebp - 0x658], 1
jmp 0x1001783f
and dword [ebp - 0x658], 0
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xb90], eax
push 5
pop eax
test eax, eax
jne 0x100178d2
cmp dword [ebp - 0x208], 1
jg 0x1001787a
cmp dword [ebp - 0x2dc], 0
jne 0x1001787a
and dword [ebp - 0x8a0], 0
jmp 0x10017884
mov dword [ebp - 0x8a0], 1
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xb98], eax
mov eax, dword [ebp - 0x2dc]
sub eax, 0xe2
cmp eax, 0xed38
jl 0x100178ae
mov dword [ebp - 0x434], 1
jmp 0x100178b5
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x434]
sub eax, dword [ebp - 0x168]
add eax, dword [ebp - 0x208]
jne 0x100178d2
and dword [ebp - 0x43c], 0
jmp 0x100178dc
mov dword [ebp - 0x43c], 1
mov eax, dword [ebp - 0x658]
add eax, dword [ebp - 0x43c]
sub eax, dword [ebp - 0x68]
jne 0x100178fc
cmp dword [ebp - 0x68], 0
jne 0x100178fc
and dword [ebp - 0x55c], 0
jmp 0x10017906
mov dword [ebp - 0x55c], 1
cmp dword [ebp - 0x55c], 0x4981c586
jl 0x1001791e
mov dword [ebp - 0x444], 1
jmp 0x10017925
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 0x2dc]
mov ecx, dword [ebp - 0x444]
lea eax, [ecx + eax + 0xb6fb96f]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x168], eax
jl 0x10017955
mov dword [ebp - 0x2bc], 1
jmp 0x1001795c
and dword [ebp - 0x2bc], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2bc]
mov dword [ebp + eax - 0xddc], ecx
cmp dword [ebp - 0x2bc], 0
je 0x10017987
push 0x3acf
push 0
call fcn.1001c976
pop ecx
pop ecx
jmp 0x100179f4
mov dword [ebp - 0x68], 0
jmp 0x10017997
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0x2b
jle 0x100179f4
mov byte [ebp - 0xc1], 0
movzx eax, byte [ebp - 0xc1]
test eax, eax
je 0x100179f2
push 0x3e5c
push 1
push 0x442
push 0x669e
push 0x35fd
push 0x1c8f
push 0
push 0x3615
push 0x1d60
push 0x5789
push 0x5b35
push 0x4649
push 0x2e80
call fcn.10013e20
add esp, 0x34
jmp 0x10017990
mov dword [ebp - 0x10c], 0
jmp 0x10017a0d
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 2
jg 0x100193f4
push 1
lea ecx, [ebp - 0xa40]
call fcn.1000dfce
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x740], 1
mov dword [ebp - 0x748], 0xffffffff
mov dword [ebp - 0x768], 0x2038e85a
mov dword [ebp - 0x750], 0xfffffff9
mov dword [ebp - 0x190], 0xffffffff
mov dword [ebp - 0xba0], 0x3589fe57
mov dword [ebp - 0x8a8], 0xa3191b49
mov dword [ebp - 0x908], 0
mov dword [ebp - 0xba8], 0xcb302aff
push 3
lea ecx, [ebp - 0xa28]
call fcn.1000dfce
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x564], 0x1f0d
mov dword [ebp - 0x850], 0x88d514fa
mov dword [ebp - 0x858], 0xa1dd7933
mov dword [ebp - 0x860], 0xfffffffa
mov dword [ebp - 0x758], 0x1692
mov dword [ebp - 0x760], 0
mov dword [ebp - 0xbb0], 0x78453370
lea eax, [ebp - 0x738]
push eax
push 0x4aef
push 0x8b
push 0x6950
push 0x630b
push 0
push 0x565f
push 0x3344
lea eax, [ebp - 0xa40]
push eax
push 0xc6c
push 0x1821
call fcn.10020714
add esp, 0x2c
push 0
push 0x2cdd
push 0x5ad1
lea eax, [ebp - 0xa28]
push eax
push 0
lea eax, [ebp - 0x738]
push eax
push 0x76f6
call fcn.10013b6f
add esp, 0x1c
lea eax, [ebp - 0x850]
push eax
lea eax, [ebp - 0x740]
push eax
lea eax, [ebp - 0x908]
push eax
lea eax, [ebp - 0x190]
push eax
push 1
lea eax, [ebp - 0x748]
push eax
push 0x407
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0x750]
push eax
lea eax, [ebp - 0xa40]
push eax
lea eax, [ebp - 0x8a8]
push eax
lea eax, [ebp - 0x564]
push eax
push 0
lea eax, [ebp - 0x758]
push eax
lea eax, [ebp - 0xa28]
push eax
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x760]
push eax
call fcn.100200ea
add esp, 0x44
mov dword [ebp - 0x190], 0xffffffea
jmp 0x10017bd1
mov eax, dword [ebp - 0x190]
inc eax
mov dword [ebp - 0x190], eax
cmp dword [ebp - 0x190], 0x1b
jge 0x10017d08
mov dword [ebp - 0xbb8], 0xdc071782
mov dword [ebp - 0xbc0], 0xfffffff9
mov dword [ebp - 0x868], 1
mov dword [ebp - 0x60], 0
jmp 0x10017c0c
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x10017c22
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x978], 0x60b96bc9
jmp 0x10017c05
mov dword [ebp - 0x60], 0
jmp 0x10017c32
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x10017c48
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x970], 0xeef3aa79
jmp 0x10017c2b
mov byte [ebp - 0x8e], 0
push 0
push 0x78f0
lea eax, [ebp - 0x8e]
push eax
push 0
push 0x2ddb
push 0x125a
push 1
call fcn.1001c30f
add esp, 0x1c
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x970]
inc eax
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x970]
jge 0x10017c9c
mov dword [ebp - 0x44c], 1
jmp 0x10017ca3
and dword [ebp - 0x44c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x978]
inc eax
mov dword [ebp - 0x5ec], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5ec]
mov dword [ebp + eax - 0x978], ecx
mov eax, dword [ebp - 0x5ec]
cmp eax, dword [ebp - 0x44c]
jg 0x10017ce4
mov dword [ebp - 0x8e8], 1
jmp 0x10017ceb
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0xbc8], eax
mov eax, dword [ebp - 0x768]
mov dword [ebp - 0x868], eax
jmp 0x10017bc4
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0xa28]
call fcn.1000e00a
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xa40]
call fcn.1000e00a
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x84], 0xfffffffb
push 3
lea ecx, [ebp - 0x650]
call fcn.1000dfce
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x8b0], 0xfffffff9
mov dword [ebp - 0x584], 6
lea eax, [ebp - 0x650]
push eax
push 0
push 0x6ff4
lea eax, [ebp - 0xbd0]
push eax
push 0x50f
call fcn.1001f5b1
add esp, 0x14
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xbd8], eax
cmp dword [ebp - 0x84], 1
je 0x10017db3
mov dword [ebp - 0x454], 1
jmp 0x10017dba
and dword [ebp - 0x454], 0
cmp dword [ebp - 0x454], 0xffffffff
jae 0x10017dcf
mov dword [ebp - 0x634], 1
jmp 0x10017dd6
and dword [ebp - 0x634], 0
push 3
pop eax
sub eax, dword [ebp - 0x634]
add eax, dword [ebp - 0x84]
cmp eax, 0xc035
jg 0x10017df8
mov dword [ebp - 0x45c], 1
jmp 0x10017dff
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x84]
add eax, dword [ebp - 0x45c]
jne 0x10017e1a
push 1
lea ecx, [ebp - 0x650]
call fcn.1000e00f
or eax, 0xffffffff
je 0x10017e3d
push 1
lea ecx, [ebp - 0x650]
call fcn.1000e00f
cmp dword [eax], 0
je 0x10017e3d
mov dword [ebp - 0x56c], 1
jmp 0x10017e44
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x56c]
sub eax, dword [ebp - 0x474]
sub eax, dword [ebp - 0x84]
cmp eax, 1
je 0x10017e67
mov dword [ebp - 0x464], 1
jmp 0x10017e6e
and dword [ebp - 0x464], 0
mov eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x464]
je 0x10017e88
mov dword [ebp - 0x5f4], 1
jmp 0x10017e8f
and dword [ebp - 0x5f4], 0
push 0
lea ecx, [ebp - 0x650]
call fcn.1000e00f
mov esi, dword [ebp - 0x5f4]
imul esi, dword [eax]
push 1
lea ecx, [ebp - 0x650]
call fcn.1000e00f
cmp esi, dword [eax]
jle 0x10017ec2
mov dword [ebp - 0x46c], 1
jmp 0x10017ec9
and dword [ebp - 0x46c], 0
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0
je 0x10017f1f
mov dword [ebp - 0x770], 0xa8d7d2a7
push 0
lea eax, [ebp - 0x770]
push eax
call fcn.1001bae5
pop ecx
pop ecx
push 1
push 0x27a0
lea eax, [ebp - 0x8b0]
push eax
push 0x4754
push 1
push 0x5bb3
call fcn.10013630
add esp, 0x18
jmp 0x10018069
mov dword [ebp - 0x24c], 0x37a3
cmp dword [ebp - 0x24c], 0
jne 0x10017f3e
mov dword [ebp - 0x574], 1
jmp 0x10017f45
and dword [ebp - 0x574], 0
mov eax, dword [ebp - 0x24c]
add eax, dword [ebp - 0x574]
je 0x10018014
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0x474]
cmp dword [ebp - 0x24c], eax
jne 0x10017f7d
mov dword [ebp - 0x65c], 1
jmp 0x10017f84
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0x24c]
cmp dword [ebp - 0x65c], eax
jl 0x10017fb0
push 1
lea ecx, [ebp - 0x650]
call fcn.1000e00f
cmp dword [eax], 0
je 0x10017fb0
mov dword [ebp - 0x47c], 1
jmp 0x10017fb7
and dword [ebp - 0x47c], 0
cmp dword [ebp - 0x47c], 2
jle 0x10017fcc
mov dword [ebp - 0x57c], 1
jmp 0x10017fd3
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x57c], eax
jle 0x10017fed
mov dword [ebp - 0x484], 1
jmp 0x10017ff4
and dword [ebp - 0x484], 0
push 1
lea ecx, [ebp - 0x650]
call fcn.1000e00f
mov ecx, dword [ebp - 0x484]
cmp ecx, dword [eax]
jge 0x10018026
cmp dword [ebp - 0x584], 0
jne 0x10018026
mov eax, 0x944c1a1f
test eax, eax
jne 0x10018026
and dword [ebp - 0x5fc], 0
jmp 0x10018030
mov dword [ebp - 0x5fc], 1
mov eax, dword [ebp - 0x5fc]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x170], eax
jne 0x10018056
mov dword [ebp - 0x48c], 1
jmp 0x1001805d
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x584], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x650]
call fcn.1000e00a
mov dword [ebp - 0x114], 0x56df
push 0
call fcn.1001bcec
pop ecx
push 3
lea ecx, [ebp - 0x678]
call fcn.1000dfce
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x50], 0
jmp 0x100180ab
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x100180c1
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0xc1c], 1
jmp 0x100180a4
mov dword [ebp - 0x50], 0
jmp 0x100180d1
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x100180ed
push dword [ebp - 0x50]
lea ecx, [ebp - 0x678]
call fcn.1000e00f
mov dword [eax], 0xd1e1e87d
jmp 0x100180ca
push 1
lea ecx, [ebp - 0x678]
call fcn.1000e00f
mov dword [eax], 2
jmp 0x10018126
push 1
lea ecx, [ebp - 0x678]
call fcn.1000e00f
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x494]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x494]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x678]
call fcn.1000e00f
cmp dword [eax], 0
jl 0x10018166
push 1
lea ecx, [ebp - 0x678]
call fcn.1000e00f
mov esi, dword [eax]
push 1
lea ecx, [ebp - 0x678]
call fcn.1000e00f
mov eax, dword [eax]
mov ecx, dword [ebp + esi*4 - 0xc1c]
mov dword [ebp + eax*4 - 0xc1c], ecx
jmp 0x10018102
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x678]
call fcn.1000e00a
push 0
push 0x292f
push 0x109e
lea eax, [ebp - 0x48]
push eax
push 1
push 0x4821
push 0
lea eax, [ebp - 0xe8]
push eax
push 0x2241
push 0x3e83
lea eax, [ebp - 0x950]
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x6718
push 0x11d
push 0x7747
call fcn.10015460
add esp, 0x3c
mov dword [ebp - 0x9e8], 0xfffffff7
mov dword [ebp - 0x9e4], 0xfffffff7
mov dword [ebp - 0x9e0], 0xfffffff7
mov dword [ebp - 0x9dc], 0xfffffff7
lea ecx, [ebp - 0x291]
call fcn.1000e7d2
push eax
lea eax, [ebp - 0x9d8]
push eax
lea eax, [ebp - 0x9e8]
push eax
lea ecx, [ebp - 0xe14]
call fcn.10032a42
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x8f4]
call fcn.100329ab
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x780], 0xe458c458
mov dword [ebp - 0x38], 3
jmp 0x10018246
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x100185f2
mov dword [ebp - 0x604], 0xfffffffe
mov dword [ebp - 0x928], 0xd0a3
push dword [ebp - 0x38]
lea ecx, [ebp - 0x8f4]
call fcn.1000e00f
cmp dword [eax], 0
je 0x10018368
mov dword [ebp - 0x9c0], 0xa9d69236
mov dword [ebp - 0x9bc], 0xa9d69236
mov dword [ebp - 0x9b8], 0xa9d69236
mov dword [ebp - 0x9b4], 0xa9d69236
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x9c0], 0xffffffff
jae 0x100182bf
mov dword [ebp - 0x644], 1
jmp 0x100182c6
and dword [ebp - 0x644], 0
cmp dword [ebp - 0x644], 0
jne 0x100182db
mov dword [ebp - 0x58c], 1
jmp 0x100182e2
and dword [ebp - 0x58c], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x9c0]
push dword [ebp - 0x38]
lea ecx, [ebp - 0x8f4]
call fcn.1000e00f
mov dword [eax], esi
mov eax, 0xad9d
cmp eax, 9
jb 0x10018328
push dword [ebp - 0x38]
lea ecx, [ebp - 0x8f4]
call fcn.1000e00f
cmp dword [eax], 0
je 0x10018328
mov dword [ebp - 0x49c], 1
jmp 0x1001832f
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x49c]
sub eax, 8
cmp dword [ebp - 0x58c], eax
jle 0x1001834c
mov dword [ebp - 0x4a4], 1
jmp 0x10018353
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x604], eax
jmp 0x100185ca
mov dword [ebp - 0x870], 0xe637c5b1
mov dword [ebp - 0x778], 0x15c4
cmp dword [ebp - 0x778], 0xeff
jge 0x1001859d
mov dword [0x11da52d4], 0x4f
push 8
pop eax
shl eax, 0
mov dword [eax + 0x10cdb568], 1
and dword [eax + 0x10cdb56c], 0
push 8
pop eax
shl eax, 0
mov dword [eax + 0x115409e0], 1
and dword [eax + 0x115409e4], 0
mov dword [ebp - 0xd8], 2
jmp 0x100183dd
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x186a1
jge 0x10018468
mov eax, dword [0x11da52d4]
cdq
mov ecx, dword [ebp - 0xd8]
push edx
push eax
push dword [ecx*8 + 0x115409dc]
push dword [ecx*8 + 0x115409d8]
call fcn.10056fb0
push 0
push 0x3b9aca09
push edx
push eax
call fcn.1006a850
mov ecx, dword [ebp - 0xd8]
mov dword [ecx*8 + 0x115409e0], eax
mov dword [ecx*8 + 0x115409e4], edx
push 0
push 0x3b9aca07
mov eax, dword [ebp - 0xd8]
push dword [eax*8 + 0x115409e4]
push dword [eax*8 + 0x115409e0]
call section..bllvl
add esp, 0x10
mov ecx, dword [ebp - 0xd8]
mov dword [ecx*8 + 0x10cdb568], eax
mov dword [ecx*8 + 0x10cdb56c], edx
jmp 0x100183d0
push 0x1065ee58
push 0x10cdb564
push 0x100089f8
call fcn.10050e4b
add esp, 0xc
and dword [ebp - 0xe0], 0
jmp 0x10018495
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0xe0]
cmp eax, dword [0x1065ee58]
jge 0x1001852a
mov dword [ebp - 0x104], 1
jmp 0x100184c0
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
cmp eax, dword [0x10cdb564]
jg 0x10018519
imul eax, dword [ebp - 0x104], 0x28
mov ecx, dword [ebp - 0xe0]
lea eax, [eax + ecx*4 + 0x11603f58]
push eax
push 0x100089d4
call fcn.10050e4b
pop ecx
pop ecx
imul eax, dword [ebp - 0x104], 0x28
mov ecx, dword [ebp - 0xe0]
imul eax, dword [eax + ecx*4 + 0x11603f58], 0x28
mov ecx, dword [ebp - 0xe0]
mov edx, dword [ebp - 0x104]
mov dword [eax + ecx*4 + 0x119d4888], edx
jmp 0x100184b3
push dword [ebp - 0xe0]
call fcn.1001530c
pop ecx
jmp 0x10018488
xorpd xmm0, xmm0
movlpd qword [ebp - 0x2fc], xmm0
mov dword [ebp - 0x210], 1
jmp 0x1001854f
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x210]
cmp eax, dword [0x10cdb564]
jg 0x10018584
push dword [ebp - 0x210]
call fcn.100153f5
pop ecx
cdq
add eax, dword [ebp - 0x2fc]
adc edx, dword [ebp - 0x2f8]
mov dword [ebp - 0x2fc], eax
mov dword [ebp - 0x2f8], edx
jmp 0x10018542
push dword [ebp - 0x2f8]
push dword [ebp - 0x2fc]
push 0x10008e8c
call fcn.10051040
add esp, 0xc
lea eax, [ebp - 0x870]
push eax
lea eax, [ebp - 0x604]
push eax
push 0x190e
push 0
push 0xe54
call fcn.1002bbed
add esp, 0x14
cmp dword [ebp - 0x38], 0
je 0x100185ca
jmp 0x1001823f
lea eax, [ebp - 0x780]
push eax
lea eax, [ebp - 0x38]
push eax
push 0
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0x8f4]
push eax
call fcn.1001c178
add esp, 0x14
jmp 0x1001823f
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x8f4]
call fcn.1000e00a
mov dword [ebp - 0x48], 0
jmp 0x10018611
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jg 0x100193ef
mov dword [ebp - 0xa10], 1
mov dword [ebp - 0xa0c], 1
mov dword [ebp - 0xa08], 1
mov dword [ebp - 0xa04], 1
lea ecx, [ebp - 0x2f1]
call fcn.1000e7d2
push eax
lea eax, [ebp - 0xa00]
push eax
lea eax, [ebp - 0xa10]
push eax
lea ecx, [ebp - 0xe1c]
call fcn.10032a42
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc28]
call fcn.100329ab
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x26c], 0x29000d4e
mov dword [ebp - 0x26c], 0
jmp 0x1001869f
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 3
jg 0x10018719
mov dword [ebp - 0x144], 0x76d7be7e
mov dword [ebp - 0x144], 0
jmp 0x100186cb
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 3
jg 0x10018714
mov byte [ebp - 0x8f], 0
movzx eax, byte [ebp - 0x8f]
test eax, eax
je 0x100186fa
push 0x7aeb
push 0
push 0x6fc6
call fcn.1002c37a
add esp, 0xc
push dword [ebp - 0x144]
lea ecx, [ebp - 0xc28]
call fcn.1000e00f
cmp dword [eax], 0
je 0x10018712
jmp 0x100186be
jmp 0x100186be
jmp 0x10018692
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xc28]
call fcn.1000e00a
mov dword [ebp - 0x2f0], 0x4c8f0d07
mov dword [ebp - 0x788], 0xfffffff8
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0xbe8], eax
cmp dword [ebp - 0x48], 0
je 0x10018769
cmp dword [ebp - 0x2f0], 0
je 0x10018769
cmp dword [ebp - 0x48], 0
je 0x10018769
mov dword [ebp - 0x4ac], 1
jmp 0x10018770
and dword [ebp - 0x4ac], 0
mov eax, dword [ebp - 0x10c]
cmp dword [ebp - 0x4ac], eax
jne 0x10018790
cmp dword [ebp - 0x114], 0
jne 0x10018790
and dword [ebp - 0x594], 0
jmp 0x1001879a
mov dword [ebp - 0x594], 1
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
mov ecx, dword [ebp - 0x788]
add ecx, dword [ebp - 0x594]
add ecx, dword [ebp - 0x48]
imul eax, ecx
cmp eax, 0xb64d
jge 0x10018f2e
mov dword [ebp - 0x14c], 0xb74c38b6
mov dword [ebp - 0x290], 1
push 2
lea ecx, [ebp - 0x684]
call fcn.1000dfce
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x2c4], 0xc9b6cd04
mov dword [ebp - 0x6c4], 0
mov dword [ebp - 0x1a8], 0
jmp 0x1001881b
mov eax, dword [ebp - 0x1a8]
inc eax
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 2
jge 0x1001883d
push dword [ebp - 0x1a8]
lea ecx, [ebp - 0x684]
call fcn.1000e00f
mov dword [eax], 0x4cbed562
jmp 0x1001880e
mov dword [ebp - 0x290], 1
mov eax, dword [ebp - 0x290]
add eax, dword [ebp - 0x14c]
cmp eax, 4
jbe 0x10018864
mov dword [ebp - 0x4b4], 1
jmp 0x1001886b
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x4b4]
sub eax, dword [ebp - 0x14c]
mov dword [ebp - 0x664], eax
push 1
lea ecx, [ebp - 0x684]
call fcn.1000e00f
mov ecx, dword [ebp - 0x664]
mov dword [eax], ecx
mov eax, dword [ebp - 0x664]
sub eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x14c]
jne 0x100188b2
mov dword [ebp - 0x4bc], 1
jmp 0x100188b9
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x4bc]
je 0x100188d3
mov dword [ebp - 0x59c], 1
jmp 0x100188da
and dword [ebp - 0x59c], 0
cmp dword [ebp - 0x59c], 0xffffffff
jge 0x100188ef
mov dword [ebp - 0x4c4], 1
jmp 0x100188f6
and dword [ebp - 0x4c4], 0
imul eax, dword [ebp - 0x4c4], 0xabe8
test eax, eax
jne 0x10018916
cmp dword [ebp - 0x2c4], 0
jne 0x10018916
and dword [ebp - 0x60c], 0
jmp 0x10018920
mov dword [ebp - 0x60c], 1
mov eax, dword [ebp - 0x60c]
neg eax
cmp eax, 1
jge 0x10018939
mov dword [ebp - 0x4cc], 1
jmp 0x10018940
and dword [ebp - 0x4cc], 0
cmp dword [ebp - 0x4cc], 0
jne 0x1001895b
mov eax, 0x21aa291
test eax, eax
jne 0x1001895b
and dword [ebp - 0x320], 0
jmp 0x10018965
mov dword [ebp - 0x320], 1
mov eax, dword [ebp - 0x2c4]
imul eax, dword [ebp - 0x320]
test eax, eax
je 0x10018989
push 0
push 0x219
call fcn.1001c11d
pop ecx
pop ecx
jmp 0x10018b29
mov dword [ebp - 0x1b4], 5
mov dword [ebp - 0x1ac], 0
jmp 0x100189ac
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 3
jge 0x100189c8
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0xdf4], 0xeea3821c
jmp 0x1001899f
xor eax, eax
inc eax
je 0x10018b16
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x2e4], eax
push 1
lea ecx, [ebp - 0x684]
call fcn.1000e00f
mov ecx, dword [ebp - 0x2e4]
mov dword [eax], ecx
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2e4]
mov dword [ebp + eax - 0xdf4], ecx
cmp dword [ebp - 0x2e4], 0
jne 0x10018a63
mov esi, dword [ebp - 0x1b4]
push 0
lea ecx, [ebp - 0x684]
call fcn.1000e00f
cmp esi, dword [eax]
jne 0x10018a30
mov dword [ebp - 0x7f8], 1
jmp 0x10018a37
and dword [ebp - 0x7f8], 0
push 1
lea ecx, [ebp - 0x684]
call fcn.1000e00f
push 1
lea ecx, [ebp - 0x684]
call fcn.1000e00f
mov ecx, 0xfd29cc02
sub ecx, dword [eax]
jne 0x10018a63
and dword [ebp - 0x328], 0
jmp 0x10018a6d
mov dword [ebp - 0x328], 1
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x328], eax
jne 0x10018a87
mov dword [ebp - 0x330], 1
jmp 0x10018a8e
and dword [ebp - 0x330], 0
cmp dword [ebp - 0x330], 0
jne 0x10018aa9
mov eax, 0xbeba424a
test eax, eax
jne 0x10018aa9
and dword [ebp - 0x338], 0
jmp 0x10018ab3
mov dword [ebp - 0x338], 1
mov eax, dword [ebp - 0x338]
sub eax, dword [ebp - 0x290]
cmp dword [ebp - 0x1b4], eax
jge 0x10018ad3
mov dword [ebp - 0x340], 1
jmp 0x10018ada
and dword [ebp - 0x340], 0
cmp dword [ebp - 0x340], 0
jne 0x10018af5
cmp dword [ebp - 0x1b4], 0
jne 0x10018af5
and dword [ebp - 0x348], 0
jmp 0x10018aff
mov dword [ebp - 0x348], 1
imul eax, dword [ebp - 0x348], 3
test eax, eax
je 0x10018b16
mov dword [ebp - 0x350], 1
jmp 0x10018b1d
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x6c4], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x684]
call fcn.1000e00a
mov dword [ebp - 0xe8], 2
jmp 0x10018b51
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jl 0x10018f29
mov dword [ebp - 0x114], 2
jmp 0x10018b77
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jl 0x10018f24
mov dword [ebp - 0xae4], 0xfffffff6
mov byte [ebp - 0x91], 0
lea eax, [ebp - 0x91]
push eax
push 0x365a
push 0
push 0x1f9e
push 0x4d4e
push 0x5d6c
call fcn.10025376
add esp, 0x18
push 0x339b
push 0
push 0
call fcn.1002be20
add esp, 0xc
push 3
lea ecx, [ebp - 0x904]
call fcn.1000dfce
mov byte [ebp - 4], 0x1c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0xae0], 0xffffffff
mov dword [ebp - 0xadc], 0xffffffff
mov dword [ebp - 0xad8], 0xffffffff
mov dword [ebp - 0xad4], 0xffffffff
mov dword [ebp - 0x7fc], 1
push 1
lea ecx, [ebp - 0xa70]
call fcn.1000dfce
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x54], 0
jmp 0x10018c36
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x10018c4f
push dword [ebp - 0x54]
lea ecx, [ebp - 0x904]
call fcn.1000e00f
and dword [eax], 0
jmp 0x10018c2f
mov dword [ebp - 0x54], 0
jmp 0x10018c5f
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 1
jge 0x10018c7b
push dword [ebp - 0x54]
lea ecx, [ebp - 0xa70]
call fcn.1000e00f
mov dword [eax], 0xfb49a5c1
jmp 0x10018c58
mov dword [ebp - 0x1c], 0
jmp 0x10018c8b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x10018cad
mov byte [ebp - 0x93], 0
movzx eax, byte [ebp - 0x93]
test eax, eax
je 0x10018cab
push 0
call fcn.1002b9f6
pop ecx
jmp 0x10018c84
mov dword [ebp - 0x1c], 2
jmp 0x10018cbd
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x10018ec3
mov dword [ebp - 0x298], 0x9c77509c
mov dword [ebp - 0xd10], 0
mov dword [ebp - 0xd18], 0x466ac3a6
mov dword [ebp - 0xd20], 6
mov dword [ebp - 0xd28], 0xdaa08bbd
mov dword [ebp - 0xd30], 0x5300ce3d
mov dword [ebp - 0xd38], 0xffffffff
push 3
lea ecx, [ebp - 0xc38]
call fcn.1000dfce
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0xd40], 0x5e320525
push 0x3742
push 1
push 0x26b9
push 0
lea eax, [ebp - 0xc38]
push eax
push 1
push 0x2817
push 0x1b45
lea eax, [ebp - 0xd48]
push eax
push 0x7fa3
call fcn.1002133a
add esp, 0x28
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xae0], 0xfffc
cmp dword [ebp - 0x1c], 0xfffc
jl 0x10018d83
mov dword [ebp - 0x358], 1
jmp 0x10018d8a
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xd88], eax
mov eax, dword [ebp - 0x298]
cmp dword [ebp - 0x358], eax
jl 0x10018dad
mov dword [ebp - 0x368], 1
jmp 0x10018db4
and dword [ebp - 0x368], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x904]
call fcn.1000e00f
mov dword [ebp - 0x360], eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x904]
call fcn.1000e00f
mov ecx, dword [ebp - 0x360]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x360]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x368]
jg 0x10018dfc
mov dword [ebp - 0x370], 1
jmp 0x10018e03
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x298]
add eax, dword [ebp - 0x370]
jne 0x10018e2d
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x904]
call fcn.1000e00f
cmp dword [eax], 0
jne 0x10018e2d
and dword [ebp - 0x378], 0
jmp 0x10018e37
mov dword [ebp - 0x378], 1
cmp dword [ebp - 0x378], 0xbe856dfc
je 0x10018e4f
mov dword [ebp - 0x380], 1
jmp 0x10018e56
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x380]
sub eax, dword [ebp - 0x1c]
inc eax
inc eax
cmp eax, dword [ebp - 0x298]
je 0x10018e75
mov dword [ebp - 0x388], 1
jmp 0x10018e7c
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x7fc], eax
push 0x3958
push 0x17fa
lea eax, [ebp - 0xa70]
push eax
push 0x2a6f
push 0
push 0
push 0x5458
call fcn.10014edb
add esp, 0x1c
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xc38]
call fcn.1000e00a
jmp 0x10018cb6
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0xa70]
call fcn.1000e00a
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x904]
call fcn.1000e00a
push 1
push 0x1d65
push 0
push 0x69b7
push 0x5b28
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x3b49
push 0x30d3
push 0x1e1b
lea eax, [ebp - 0x950]
push eax
push 0
call fcn.1002bc26
add esp, 0x30
jmp 0x10018b6a
jmp 0x10018b44
jmp 0x100193ea
mov byte [ebp - 0x95], 0
mov dword [ebp - 0x1bc], 0x3ae35568
mov dword [ebp - 0xd90], 0xeb905d09
mov dword [ebp - 0xd8c], 0x60693009
mov dword [ebp - 0xd60], 0x513244d5
mov dword [ebp - 0xd0c], 3
mov dword [ebp - 0xaec], 0x7563ffaf
mov dword [ebp - 0xc2c], 9
mov dword [ebp - 0xaf4], 0x2076acb8
mov dword [ebp - 0xd44], 0xffffffff
mov dword [ebp - 0xafc], 0xe81720d7
mov dword [ebp - 0xd70], 1
mov dword [ebp - 0xd6c], 1
mov dword [ebp - 0xd68], 1
mov dword [ebp - 0xd64], 1
mov dword [ebp - 0x390], 1
mov dword [ebp - 0x1bc], 0xffffffe2
jmp 0x10018fe4
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0xf
jge 0x10019123
mov dword [ebp - 0x988], 0x1738
mov dword [ebp - 0x984], 0x1738
mov dword [ebp - 0x980], 0x1738
mov dword [ebp - 0x97c], 0x1738
mov dword [ebp - 0xc3c], 0xffffffff
mov dword [ebp - 0xb04], 0
mov dword [ebp - 0xd14], 0xffffffff
mov dword [ebp - 0xb0c], 0xdc0e3e76
mov dword [ebp - 0xc4c], 0xaa9dade6
mov dword [ebp - 0xb14], 4
mov dword [ebp - 0xd7c], 7
mov dword [ebp - 0xb1c], 0xfffffffc
mov dword [ebp - 0xc5c], 7
mov dword [ebp - 0xb24], 6
mov dword [ebp - 0xd1c], 0xffffffff
mov dword [ebp - 0xb2c], 0xd62a04f7
push 1
lea ecx, [ebp - 0xc48]
call fcn.1000dfce
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0xc6c], 0xf529
mov dword [ebp - 0x1c4], 0
jmp 0x100190c5
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 1
jge 0x100190e7
push dword [ebp - 0x1c4]
lea ecx, [ebp - 0xc48]
call fcn.1000e00f
mov dword [eax], 0xfffffff8
jmp 0x100190b8
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x988]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x988], eax
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xc48]
call fcn.1000e00a
jmp 0x10018fd7
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x100193ea
push 2
lea ecx, [ebp - 0x690]
call fcn.1000dfce
mov byte [ebp - 4], 0x20
mov dword [ebp - 0xf0], 0xfffffffd
mov dword [ebp - 0x798], 0xffffffff
lea eax, [ebp - 0x690]
push eax
push 0x404b
push 0x7e04
lea eax, [ebp - 0xb34]
push eax
push 0
push 1
push 0x36ff
call fcn.10014edb
add esp, 0x1c
mov dword [ebp - 0xf0], 0
jmp 0x10019199
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 1
jg 0x100193d3
mov dword [ebp - 0x4c], 0x182eac45
mov dword [ebp - 0x11c], 0x8e99
mov dword [ebp - 0x4c], 1
jmp 0x100191c7
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x1001935c
mov dword [ebp - 0x3d8], 0xc4df8e3b
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x690]
call fcn.1000e00f
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x690]
call fcn.1000e00f
push 1
lea ecx, [ebp - 0x690]
call fcn.1000e00f
cmp dword [eax], 0xfffffff8
jne 0x10019215
mov dword [ebp - 0x398], 1
jmp 0x1001921c
and dword [ebp - 0x398], 0
mov dword [ebp - 0x11c], 1
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0x398]
jle 0x10019240
mov dword [ebp - 0x3a0], 1
jmp 0x10019247
and dword [ebp - 0x3a0], 0
cmp dword [ebp - 0x3a0], 0
ja 0x1001925c
mov dword [ebp - 0x3a8], 1
jmp 0x10019263
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a8]
add eax, 0xffff
cmp eax, dword [ebp - 0x4c]
jge 0x1001927f
mov dword [ebp - 0x3b0], 1
jmp 0x10019286
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x3b0], eax
jg 0x1001929d
mov dword [ebp - 0x3b8], 1
jmp 0x100192a4
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x3b8], eax
jge 0x100192bb
mov dword [ebp - 0x3c0], 1
jmp 0x100192c2
and dword [ebp - 0x3c0], 0
push dword [ebp - 0xf0]
lea ecx, [ebp - 0x690]
call fcn.1000e00f
mov eax, dword [eax]
cmp eax, dword [ebp - 0x3c0]
jge 0x100192e9
mov dword [ebp - 0x3c8], 1
jmp 0x100192f0
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x3c8], eax
jg 0x1001930a
mov dword [ebp - 0x3d0], 1
jmp 0x10019311
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x3d8], eax
mov esi, dword [ebp - 0x3d8]
push dword [ebp - 0xf0]
lea ecx, [ebp - 0x690]
call fcn.1000e00f
cmp esi, dword [eax]
jge 0x10019344
mov dword [ebp - 0x3e0], 1
jmp 0x1001934b
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x798], eax
jmp 0x100191c0
mov byte [ebp - 0x97], 0
movzx eax, byte [ebp - 0x97]
test eax, eax
je 0x10019391
push 0x589b
push 0x4671
push 0x64fd
push 0x55d1
push 0
push 0x22f2
call fcn.1001bb13
add esp, 0x18
mov dword [ebp - 0x11c], 0
jmp 0x100193aa
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 1
jg 0x100193ce
push 0x23b9
push 0x7b8b
push 0x7d51
push 0
call fcn.1001f40f
add esp, 0x10
jmp 0x1001939d
jmp 0x1001918c
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x690]
call fcn.1000e00a
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
jmp 0x1001860a
jmp 0x10017a00
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x950]
call fcn.1000e00a
push 4
push 0x1000
push dword [ebp - 0x2d0]
mov eax, dword [ebp - 0x5d8]
mov ecx, dword [ebp - 0x7f4]
add ecx, dword [eax + 0xc]
push ecx
push 0x4419
push 0x4018
call fcn.1003c06f
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x2d8]
mov dword [ecx], eax
mov dword [ebp - 0x154], 0xac204e2d
mov dword [ebp - 0x80c], 1
mov dword [ebp - 0x7a0], 1
mov dword [ebp - 0x7a8], 0
mov dword [ebp - 0x154], 0xfffffff7
jmp 0x1001947c
mov eax, dword [ebp - 0x154]
dec eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xffffffee
jle 0x100194d0
mov byte [ebp - 0x99], 0
movzx eax, byte [ebp - 0x99]
test eax, eax
je 0x100194a5
push 0x5269
push 0
call fcn.1002d6fa
pop ecx
pop ecx
mov byte [ebp - 0xa1], 0
push 0x488c
push 0
lea eax, [ebp - 0xa1]
push eax
push 0x409d
push 0x4587
push 1
call fcn.10015131
add esp, 0x18
jmp 0x1001946f
push 0
lea eax, [ebp - 0x7a0]
push eax
push 0x26cb
push 0x434a
push 1
push 0x38f8
push 1
push 0x70be
lea eax, [ebp - 0x154]
push eax
push 0x7ac7
push 0x55b9
push 0x65f1
lea eax, [ebp - 0x80c]
push eax
push 0xc92
lea eax, [ebp - 0x7a8]
push eax
call fcn.10015460
add esp, 0x3c
push 3
lea ecx, [ebp - 0x914]
call fcn.1000dfce
mov dword [ebp - 4], 0x21
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0xad0], 0xffffffff
mov dword [ebp - 0xacc], 0xffffffff
mov dword [ebp - 0xac8], 0xffffffff
mov dword [ebp - 0xac4], 0xffffffff
mov dword [ebp - 0x814], 1
push 1
lea ecx, [ebp - 0xa88]
call fcn.1000dfce
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x6c], 0
jmp 0x10019590
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x100195a9
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x914]
call fcn.1000e00f
and dword [eax], 0
jmp 0x10019589
mov dword [ebp - 0x6c], 0
jmp 0x100195b9
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x100195d5
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xa88]
call fcn.1000e00f
mov dword [eax], 0xfb49a5c1
jmp 0x100195b2
mov dword [ebp - 0x18], 0
jmp 0x100195e5
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x1001961b
mov byte [ebp - 0xa3], 0
push 0
push 0x7f8b
push 0x5b09
push 0x5c12
push 1
push 0x35cb
lea eax, [ebp - 0xa3]
push eax
call fcn.10013b6f
add esp, 0x1c
jmp 0x100195de
mov dword [ebp - 0x18], 2
jmp 0x1001962b
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x100197ff
mov dword [ebp - 0x2a0], 0x9c77509c
mov dword [ebp - 0xd4c], 0
mov dword [ebp - 0xb3c], 0x466ac3a6
mov dword [ebp - 0xc7c], 6
mov dword [ebp - 0xb44], 0xdaa08bbd
mov dword [ebp - 0xd24], 0x5300ce3d
mov dword [ebp - 0xb4c], 0xffffffff
push 3
lea ecx, [ebp - 0xc58]
call fcn.1000dfce
mov byte [ebp - 4], 0x23
mov dword [ebp - 0xc8c], 0x5e320525
push 1
lea eax, [ebp - 0xb54]
push eax
lea eax, [ebp - 0xc58]
push eax
push 0
call fcn.1002b969
add esp, 0x10
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xad0], 0xfffc
cmp dword [ebp - 0x18], 0xfffc
jl 0x100196d6
mov dword [ebp - 0x3e8], 1
jmp 0x100196dd
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xd80], eax
mov eax, dword [ebp - 0x2a0]
cmp dword [ebp - 0x3e8], eax
jl 0x10019700
mov dword [ebp - 0x3f8], 1
jmp 0x10019707
and dword [ebp - 0x3f8], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x914]
call fcn.1000e00f
mov dword [ebp - 0x3f0], eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x914]
call fcn.1000e00f
mov ecx, dword [ebp - 0x3f0]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x3f0]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x3f8]
jg 0x1001974f
mov dword [ebp - 0x400], 1
jmp 0x10019756
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x2a0]
add eax, dword [ebp - 0x400]
jne 0x10019780
push dword [ebp - 0x18]
lea ecx, [ebp - 0x914]
call fcn.1000e00f
cmp dword [eax], 0
jne 0x10019780
and dword [ebp - 0x408], 0
jmp 0x1001978a
mov dword [ebp - 0x408], 1
cmp dword [ebp - 0x408], 0xbe856dfc
je 0x100197a2
mov dword [ebp - 0x410], 1
jmp 0x100197a9
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x410]
sub eax, dword [ebp - 0x18]
inc eax
inc eax
cmp eax, dword [ebp - 0x2a0]
je 0x100197c8
mov dword [ebp - 0x418], 1
jmp 0x100197cf
and dword [ebp - 0x418], 0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x814], eax
lea eax, [ebp - 0xa88]
push eax
push 0
call fcn.10026a95
pop ecx
pop ecx
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0xc58]
call fcn.1000e00a
jmp 0x10019624
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0xa88]
call fcn.1000e00a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x914]
call fcn.1000e00a
mov dword [ebp - 0x1a4], 0x2c03342e
mov dword [ebp - 0x1d4], 0x7e2799ac
mov dword [ebp - 0x1cc], 0
jmp 0x1001984a
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 3
jge 0x10019866
mov eax, dword [ebp - 0x1cc]
mov dword [ebp + eax*4 - 0xde8], 0x72fd4914
jmp 0x1001983d
mov dword [ebp - 0x1d4], 0xffffffe6
jmp 0x1001987f
mov eax, dword [ebp - 0x1d4]
inc eax
mov dword [ebp - 0x1d4], eax
cmp dword [ebp - 0x1d4], 0xfffffff7
jle 0x1001996c
mov dword [ebp - 0x1dc], 0
jmp 0x100198a5
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 3
jge 0x100198c1
mov eax, dword [ebp - 0x1dc]
mov dword [ebp + eax*4 - 0x924], 0x7cefa9d1
jmp 0x10019898
mov byte [ebp - 0xa5], 0
movzx eax, byte [ebp - 0xa5]
test eax, eax
je 0x100198e1
push 0x19b3
push 0
call fcn.1001bd5b
pop ecx
pop ecx
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x924], 2
jmp 0x1001990c
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x924]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x924], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x924], 0
jl 0x10019967
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x924]
cmp dword [ebp + eax*4 - 0xde8], 0
je 0x10019933
jmp 0x10019967
mov byte [ebp - 0xa7], 0
movzx eax, byte [ebp - 0xa7]
test eax, eax
je 0x10019965
push 0x6c35
push 0x7a52
push 0x240a
push 0x38cf
push 1
push 0
call fcn.10013c59
add esp, 0x18
jmp 0x100198f3
jmp 0x10019872
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x1001998b
push 0
push 0x1d0c
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov dword [ebp - 0xb5c], 0xffffffff
mov dword [ebp - 0xc9c], 0x3b6182ea
mov dword [ebp - 0x2a8], 0xffffffff
mov dword [ebp - 0x1ec], 2
mov dword [ebp - 0x7b0], 0x1f0b
cmp dword [ebp - 0x7b0], 0x9b3
jge 0x10019ab6
push 0x11da52d8
push 0x100089d4
call fcn.10050e4b
pop ecx
pop ecx
mov eax, dword [0x11da52d8]
mov dword [ebp - 0x81c], eax
mov eax, dword [0x11da52d8]
dec eax
mov dword [0x11da52d8], eax
cmp dword [ebp - 0x81c], 0
je 0x10019ab6
push 0x11603f48
push 0x1065ee50
push 0x11da51b8
push 0x10008eb4
call fcn.10050e4b
add esp, 0x10
mov eax, dword [0x11da51bc]
cmp eax, dword [0x11603f4c]
jl 0x10019a46
jg 0x10019a39
mov eax, dword [0x11da51b8]
cmp eax, dword [0x11603f48]
jbe 0x10019a46
push 0x10008ec4
call fcn.100511a7
pop ecx
jmp 0x100199de
and dword [0x1065ee5c], 0
mov eax, dword [0x11603f4c]
cmp eax, dword [0x11da51bc]
jl 0x10019a9e
jg 0x10019a69
mov eax, dword [0x11603f48]
cmp eax, dword [0x11da51b8]
jb 0x10019a9e
push dword [0x1065ee54]
push dword [0x1065ee50]
push dword [0x11603f4c]
push dword [0x11603f48]
call fcn.1006a7a0
mov dword [0x11603f48], eax
mov dword [0x11603f4c], edx
mov eax, dword [0x1065ee5c]
inc eax
mov dword [0x1065ee5c], eax
jmp 0x10019a4d
mov eax, dword [0x1065ee5c]
dec eax
push eax
push 0x10008a0c
call fcn.10051040
pop ecx
pop ecx
jmp 0x100199de
mov dword [ebp - 0x1e4], 0
jmp 0x10019acf
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 4
jge 0x10019aeb
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0xe2c], 6
jmp 0x10019ac2
mov byte [ebp - 0xab], 0
push 0
lea eax, [ebp - 0xab]
push eax
push 1
push 0
push 0x19ef
push 0x12de
push 0x53c7
push 0x548d
push 0x361e
call fcn.1002dc89
add esp, 0x24
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x7b8], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x7b8]
mov dword [ebp + eax - 0xe2c], ecx
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0xb64], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x2a8], eax
imul eax, dword [ebp - 0x2a8], 0x2d8c
sub eax, dword [ebp - 0x1ec]
cmp eax, 0xffffffff
jg 0x10019b78
mov dword [ebp - 0x420], 1
jmp 0x10019b7f
and dword [ebp - 0x420], 0
cmp dword [ebp - 0x420], 0xfff7
ja 0x10019b97
mov dword [ebp - 0x428], 1
jmp 0x10019b9e
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x70c], 0xfffffff9
push 3
lea ecx, [ebp - 0xc68]
call fcn.1000dfce
mov dword [ebp - 4], 0x24
push 1
push 0
push 0x75af
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0xc68]
push eax
call fcn.10013a61
add esp, 0x14
mov dword [ebp - 0x15c], 0
jmp 0x10019c00
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 4
jge 0x10019c1c
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0xac0], 1
jmp 0x10019bf3
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xac0], 2
jmp 0x10019c4a
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xac0]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xac0], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xac0], 0
jl 0x10019c89
mov byte [ebp - 0xad], 0
movzx eax, byte [ebp - 0xad]
test eax, eax
je 0x10019c87
push 0x398d
push 0x51c5
push 0
push 1
push 0x3d59
call fcn.10014fc6
add esp, 0x14
jmp 0x10019c2f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc68]
call fcn.1000e00a
mov dword [ebp - 0xd2c], 0x6a205b29
mov dword [ebp - 0x1f4], 0
jmp 0x10019cbb
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 1
jge 0x10019cd7
mov eax, dword [ebp - 0x1f4]
mov dword [ebp + eax*4 - 0x714], 0
jmp 0x10019cae
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x82c], 0xa519d814
mov dword [ebp - 0x438], 0xfffffffa
mov dword [ebp - 0x448], 6
mov dword [ebp - 0x83c], 2
mov dword [ebp - 0x1fc], 0
jmp 0x10019d1f
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 4
jge 0x10019d3b
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0x944], 0x9841
jmp 0x10019d12
mov dword [ebp - 0x20], 0
jmp 0x10019d4b
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x1001a07c
mov dword [ebp - 0x204], 0xebb6748f
mov dword [ebp - 0x2b0], 7
mov dword [ebp - 0x7d0], 0xffffffff
push 4
lea ecx, [ebp - 0xaa0]
call fcn.1000dfce
mov dword [ebp - 4], 0x25
mov dword [ebp - 0x74], 0
jmp 0x10019d97
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x10019dad
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0xdd0], 1
jmp 0x10019d90
mov dword [ebp - 0x74], 0
jmp 0x10019dbd
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 4
jge 0x10019dd6
push dword [ebp - 0x74]
lea ecx, [ebp - 0xaa0]
call fcn.1000e00f
or dword [eax], 0xffffffff
jmp 0x10019db6
mov dword [ebp - 0x204], 3
jmp 0x10019def
mov eax, dword [ebp - 0x204]
dec eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 0
jl 0x10019ed5
mov dword [ebp - 0x8c], 0x6b6eb6b9
mov dword [ebp - 0x8c], 0
jmp 0x10019e1f
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jg 0x10019e86
mov byte [ebp - 0xaf], 0
movzx eax, byte [ebp - 0xaf]
test eax, eax
je 0x10019e84
push 0x6104
push 0x7d20
push 0x78ca
push 0x1d30
push 0x360c
push 0x2ef3
push 0x2d90
push 0
push 0x6361
push 1
push 0x1122
push 0x6dab
push 0x5ab7
push 0x24db
push 0
call fcn.1001fa17
add esp, 0x3c
jmp 0x10019e12
mov dword [ebp - 0x8c], 0
jmp 0x10019e9f
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jg 0x10019ed0
mov byte [ebp - 0xb1], 0
movzx eax, byte [ebp - 0xb1]
test eax, eax
je 0x10019ece
push 0xd30
push 0
push 0x5a48
call fcn.1001bf1f
add esp, 0xc
jmp 0x10019e92
jmp 0x10019de2
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x944]
mov dword [ebp - 0x824], eax
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x7c0], eax
mov eax, dword [ebp - 0x2b0]
inc eax
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x824]
cmp eax, dword [ebp - 0x7c0]
jg 0x10019f18
mov dword [ebp - 0x450], 1
jmp 0x10019f1f
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x944]
cmp dword [ebp - 0x82c], eax
jge 0x10019f3d
mov dword [ebp - 0x430], 1
jmp 0x10019f44
and dword [ebp - 0x430], 0
cmp dword [ebp - 0x430], 0xffffffff
je 0x10019f59
mov dword [ebp - 0x7c8], 1
jmp 0x10019f60
and dword [ebp - 0x7c8], 0
cmp dword [ebp - 0x448], 0
jne 0x10019f85
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x944], 0
jne 0x10019f85
cmp dword [ebp - 0x20], 0
jne 0x10019f85
and dword [ebp - 0x440], 0
jmp 0x10019f8f
mov dword [ebp - 0x440], 1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x944]
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x438]
imul eax, dword [ebp - 0x440]
mov dword [ebp - 0x834], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x834]
mov dword [ebp + eax - 0xdd0], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x944]
mov dword [ebp - 0xb6c], eax
mov eax, dword [ebp - 0x7d0]
add eax, 0x7f03
imul eax, eax, 0x3cd3
test eax, eax
jne 0x10019ff1
cmp dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x83c]
cmp dword [ebp - 0x450], eax
jle 0x1001a00b
mov dword [ebp - 0x458], 1
jmp 0x1001a012
and dword [ebp - 0x458], 0
cmp dword [ebp - 0x458], 2
je 0x1001a027
mov dword [ebp - 0x460], 1
jmp 0x1001a02e
and dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x944]
cmp dword [ebp - 0x460], eax
jl 0x1001a04c
mov dword [ebp - 0x468], 1
jmp 0x1001a053
and dword [ebp - 0x468], 0
push 3
lea ecx, [ebp - 0xaa0]
call fcn.1000e00f
mov ecx, dword [ebp - 0x468]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaa0]
call fcn.1000e00a
jmp 0x10019d44
mov dword [ebp - 0x1a4], 0xffffffeb
jmp 0x1001a095
mov eax, dword [ebp - 0x1a4]
dec eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0xffffffea
je 0x1001b461
mov dword [ebp - 0x12c], 0xba2afe01
mov dword [ebp - 0x124], 0x2ab76d60
mov dword [ebp - 0x220], 0xaccb24ce
mov dword [ebp - 0x7d8], 0xeda58528
mov dword [ebp - 0x4e8], 2
mov dword [ebp - 0x4d0], 8
mov dword [ebp - 0x2c8], 1
mov dword [ebp - 0x2c0], 0xdbc56e70
mov dword [ebp - 0x164], 0x251c6076
mov dword [ebp - 0x16c], 0xfffffffc
mov dword [ebp - 0x228], 0xffffffff
mov dword [ebp - 0x20c], 0
jmp 0x1001a129
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 1
jge 0x1001a145
mov eax, dword [ebp - 0x20c]
mov dword [ebp + eax*4 - 0x174], 0x2d7bc352
jmp 0x1001a11c
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x124], 0x5fec46bc
jg 0x1001a1f4
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0xcac], eax
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x470], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x470]
mov dword [ebp + eax - 0x174], ecx
mov eax, dword [ebp - 0x16c]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x470], eax
jg 0x1001a1bf
mov dword [ebp - 0x478], 1
jmp 0x1001a1c6
and dword [ebp - 0x478], 0
cmp dword [ebp - 0x478], 0xffffffff
jge 0x1001a1d6
cmp dword [ebp - 0x4d0], 0
mov eax, 0x2606
test eax, eax
je 0x1001a1f4
cmp dword [ebp - 0x4e8], 0
je 0x1001a1f4
mov dword [ebp - 0x844], 1
jmp 0x1001a1fb
and dword [ebp - 0x844], 0
cmp dword [ebp - 0x164], 0
jne 0x1001a216
cmp dword [ebp - 0x2c8], 0
jne 0x1001a216
and dword [ebp - 0x480], 0
jmp 0x1001a220
mov dword [ebp - 0x480], 1
mov eax, dword [ebp - 0x480]
sub eax, dword [ebp - 0x16c]
cmp eax, 0x32f8296
jg 0x1001a23f
mov dword [ebp - 0x488], 1
jmp 0x1001a246
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x7e0], eax
imul eax, dword [ebp - 0x488], 0xf827
mov dword [ebp - 0x84c], eax
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x7e0]
cmp eax, dword [ebp - 0x84c]
je 0x1001a289
mov dword [ebp - 0x490], 1
jmp 0x1001a290
and dword [ebp - 0x490], 0
mov eax, dword [ebp - 0x220]
cmp dword [ebp - 0x490], eax
jl 0x1001a2de
mov byte [ebp - 0xb3], 0
movzx eax, byte [ebp - 0xb3]
test eax, eax
je 0x1001a2dc
push 0x80
push 0x2a36
push 0x2e41
push 0x7aec
push 0x3906
push 0
push 0x7b0e
push 0
push 1
call fcn.1001f17c
add esp, 0x24
jmp 0x1001a313
mov dword [ebp - 0x164], 0
jmp 0x1001a2f7
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 0x1b
jne 0x1001a313
push 1
push 0x6fbe
push 1
call fcn.100138f3
add esp, 0xc
jmp 0x1001a2ea
cmp dword [ebp - 0x16c], 0
je 0x1001a4ed
mov dword [ebp - 0x4b0], 0x2c90
mov dword [ebp - 0x2b8], 1
mov dword [ebp - 0x7e8], 0
mov dword [ebp - 0x4c0], 0xfffffffd
push 2
lea ecx, [ebp - 0xa34]
call fcn.1000dfce
mov dword [ebp - 4], 0x26
mov dword [ebp - 0x214], 0
jmp 0x1001a375
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 2
jge 0x1001a397
push dword [ebp - 0x214]
lea ecx, [ebp - 0xa34]
call fcn.1000e00f
mov dword [eax], 0x241e9715
jmp 0x1001a368
mov byte [ebp - 0xb9], 0
movzx eax, byte [ebp - 0xb9]
test eax, eax
je 0x1001a3d8
push 0xb13
push 0xae3
push 0x7a49
push 0x3ec1
push 1
push 0x5eaf
push 0x1e00
push 0
push 0x6243
call fcn.100140c7
add esp, 0x24
mov eax, dword [ebp - 0x4b0]
cmp dword [ebp - 0x228], eax
jg 0x1001a4c4
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0xce0], eax
cmp dword [ebp - 0x2b8], 0xfffffff9
jl 0x1001a40b
mov dword [ebp - 0x498], 1
jmp 0x1001a412
and dword [ebp - 0x498], 0
mov eax, dword [ebp - 0x7e8]
cmp dword [ebp - 0x498], eax
jle 0x1001a42c
mov dword [ebp - 0x4a0], 1
jmp 0x1001a433
and dword [ebp - 0x4a0], 0
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0x4a0], eax
jle 0x1001a44d
mov dword [ebp - 0x4a8], 1
jmp 0x1001a454
and dword [ebp - 0x4a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x174]
imul eax, dword [ebp - 0x4a8]
cmp eax, dword [ebp - 0x4b0]
jle 0x1001a47c
mov dword [ebp - 0x31c], 1
jmp 0x1001a483
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x4c0], eax
cmp dword [ebp - 0x4c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x174]
cmp dword [ebp - 0x220], eax
jle 0x1001a4b7
mov dword [ebp - 0x4c8], 1
jmp 0x1001a4be
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x2b8]
mov esi, dword [ebp - 0x2c0]
push 0
lea ecx, [ebp - 0xa34]
call fcn.1000e00f
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa34]
call fcn.1000e00a
jmp 0x1001a6a0
mov dword [ebp - 0x230], 0xaed5a0a0
mov dword [ebp - 0x134], 0x470d16aa
push 0x342a
push 0x22f9
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x12c]
push eax
push 0
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x4d0]
push eax
push 0x4085
push 0x4d09
call fcn.10026540
add esp, 0x2c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x174]
mov dword [ebp - 0xb7c], eax
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0xcbc], eax
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0xb84], eax
mov dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0x2c0]
add eax, dword [ebp - 0x12c]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x134], 0
or eax, 0xffffffff
cmp eax, 0x54ea11ad
ja 0x1001a5ad
mov dword [ebp - 0x4d8], 1
jmp 0x1001a5b4
and dword [ebp - 0x4d8], 0
cmp dword [ebp - 0x4d8], 0xd4aadda3
je 0x1001a5cc
mov dword [ebp - 0x4e0], 1
jmp 0x1001a5d3
and dword [ebp - 0x4e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x174]
cmp dword [ebp - 0x4e0], eax
je 0x1001a5ef
cmp dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x134], eax
jle 0x1001a609
mov dword [ebp - 0x4f0], 1
jmp 0x1001a610
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp - 0x4f0]
jne 0x1001a62a
mov dword [ebp - 0x4f8], 1
jmp 0x1001a631
and dword [ebp - 0x4f8], 0
mov eax, dword [ebp - 0x12c]
imul eax, dword [ebp - 0x4f8]
cmp eax, dword [ebp - 0x230]
je 0x1001a652
mov dword [ebp - 0x500], 1
jmp 0x1001a659
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x134]
cmp dword [ebp - 0x500], eax
jge 0x1001a673
mov dword [ebp - 0x854], 1
jmp 0x1001a67a
and dword [ebp - 0x854], 0
mov dword [ebp - 0x134], 0x204b
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0xce4], eax
imul eax, dword [ebp - 0x230], 0x631a
mov dword [ebp - 0x2c8], eax
mov dword [ebp - 0xb8c], 0x26ff23b1
mov dword [ebp - 0x318], 0x2d5e48d3
mov dword [ebp - 0x314], 0x2d5e48d3
mov dword [ebp - 0x310], 0x2d5e48d3
mov dword [ebp - 0x30c], 0x2d5e48d3
mov dword [ebp - 0x14], 0xf665683c
mov dword [ebp - 0x14], 3
jmp 0x1001a6e9
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1001a865
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x318]
mov dword [ebp - 0xccc], eax
cmp dword [ebp - 0x14], 0
jne 0x1001a715
mov dword [ebp - 0x510], 1
jmp 0x1001a71c
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x318], 0
je 0x1001a742
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x318], 0
je 0x1001a742
mov dword [ebp - 0x508], 1
jmp 0x1001a749
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x508], eax
jge 0x1001a760
mov dword [ebp - 0x518], 1
jmp 0x1001a767
and dword [ebp - 0x518], 0
mov eax, dword [ebp - 0x510]
cmp eax, dword [ebp - 0x518]
jg 0x1001a781
mov dword [ebp - 0x520], 1
jmp 0x1001a788
and dword [ebp - 0x520], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x318]
cmp eax, dword [ebp - 0x520]
jl 0x1001a7a6
mov dword [ebp - 0x528], 1
jmp 0x1001a7ad
and dword [ebp - 0x528], 0
cmp dword [ebp - 0x528], 0xc122
jg 0x1001a7cf
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x318], 0
jne 0x1001a7cf
and dword [ebp - 0x530], 0
jmp 0x1001a7d9
mov dword [ebp - 0x530], 1
cmp dword [ebp - 0x530], 0
jge 0x1001a7ee
mov dword [ebp - 0x538], 1
jmp 0x1001a7f5
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x318]
add eax, dword [ebp - 0x538]
mov ecx, dword [ebp - 0x14]
cmp eax, dword [ebp + ecx*4 - 0x318]
jge 0x1001a81d
mov dword [ebp - 0x540], 1
jmp 0x1001a824
and dword [ebp - 0x540], 0
cmp dword [ebp - 0x540], 0xffffffff
jb 0x1001a839
mov dword [ebp - 0x7f0], 1
jmp 0x1001a840
and dword [ebp - 0x7f0], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb94], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + eax - 0x318]
mov dword [ebp + ecx*4 - 0x318], eax
jmp 0x1001a6e2
push 0x70c4
push 0x4e88
push 0x79db
push 0
push 0xe5d
push 0x4d60
push 0
call fcn.10021a9c
add esp, 0x1c
mov dword [ebp - 0x800], 0x290be443
mov dword [ebp - 0xcec], 0xa9576c3a
mov dword [ebp - 0x808], 1
mov dword [ebp - 0x864], 0
mov dword [ebp - 0x880], 0xffffffff
mov dword [ebp - 0x810], 0x9f361739
mov dword [ebp - 0xb9c], 0xf01ba028
mov dword [ebp - 0x85c], 0x84515fdc
mov dword [ebp - 0xcdc], 0xffffffff
mov dword [ebp - 0x804], 1
mov dword [ebp - 0xba4], 0x52f34111
mov dword [ebp - 0x8b8], 0xfffffffc
push 0x7ba2
lea eax, [ebp - 0x85c]
push eax
push 0x6e5a
lea eax, [ebp - 0x864]
push eax
lea eax, [ebp - 0x804]
push eax
push 0x77aa
push 0x15dc
push 0x4476
lea eax, [ebp - 0x800]
push eax
push 0x1ca
push 0
push 0x3640
push 0x598d
push 0x499e
push 0x316a
lea eax, [ebp - 0x8b8]
push eax
lea eax, [ebp - 0x808]
push eax
push 0x7da8
push 0x26b5
lea eax, [ebp - 0x880]
push eax
lea eax, [ebp - 0x810]
push eax
push 0x3b48
push 0x2568
call fcn.1001bcfd
add esp, 0x5c
mov byte [ebp - 0xbb], 0
push 1
push 1
lea eax, [ebp - 0xbb]
push eax
push 0x3fe0
push 0x7f04
call fcn.10013a61
add esp, 0x14
push 3
lea ecx, [ebp - 0xcd8]
call fcn.1000dfce
mov dword [ebp - 4], 0x27
mov dword [ebp - 0x10], 0xfffffffa
mov dword [ebp - 0xf8], 0xffffffff
mov dword [ebp - 0x238], 0
jmp 0x1001a9ec
mov eax, dword [ebp - 0x238]
inc eax
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 2
jge 0x1001aa08
mov eax, dword [ebp - 0x238]
mov dword [ebp + eax*4 - 0xc04], 0xfffffff9
jmp 0x1001a9df
cmp dword [ebp - 0x10], 0
jne 0x1001aa12
cmp dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xf8]
cmp dword [ebp - 0x10], eax
jl 0x1001aa29
mov dword [ebp - 0x548], 1
jmp 0x1001aa30
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x548], eax
jl 0x1001aa47
mov dword [ebp - 0x8f8], 1
jmp 0x1001aa4e
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0xcf4], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xbac], eax
cmp dword [ebp - 0x10], 0
jne 0x1001aa7e
cmp dword [ebp - 0xf8], 0
jne 0x1001aa7e
mov dword [ebp - 0x550], 1
jmp 0x1001aa85
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x550], eax
jle 0x1001aa9c
mov dword [ebp - 0x558], 1
jmp 0x1001aaa3
and dword [ebp - 0x558], 0
imul eax, dword [ebp - 0x558], 0x7535
imul eax, eax, 0x6cc9
test eax, eax
je 0x1001ac55
mov dword [ebp - 0x6c8], 6
mov dword [ebp - 0x240], 0
jmp 0x1001aade
mov eax, dword [ebp - 0x240]
inc eax
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 3
jge 0x1001aafa
mov eax, dword [ebp - 0x240]
mov dword [ebp + eax*4 - 0x308], 0xffffffff
jmp 0x1001aad1
mov dword [ebp - 0x10], 2
jmp 0x1001ab0a
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1001ac53
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x308], 0
je 0x1001abac
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x308]
mov dword [ebp - 0xcfc], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x308]
cmp dword [ebp + eax - 0x308], ecx
jge 0x1001ab5b
mov dword [ebp - 0x818], 1
jmp 0x1001ab62
and dword [ebp - 0x818], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x308]
cmp dword [ebp + eax*4 - 0x308], ecx
jg 0x1001ab84
mov dword [ebp - 0x560], 1
jmp 0x1001ab8b
and dword [ebp - 0x560], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x308]
cmp dword [ebp - 0x560], eax
jne 0x1001abac
mov dword [ebp - 0x568], 1
jmp 0x1001abb3
and dword [ebp - 0x568], 0
mov eax, dword [ebp - 0x568]
add eax, 4
cmp eax, 1
ja 0x1001abcd
mov dword [ebp - 0x570], 1
jmp 0x1001abd4
and dword [ebp - 0x570], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x308]
cmp dword [ebp - 0x570], eax
jle 0x1001abf4
mov dword [ebp - 0x578], 1
jmp 0x1001abfb
and dword [ebp - 0x578], 0
cmp dword [ebp - 0x578], 0
je 0x1001ac10
mov dword [ebp - 0x580], 1
jmp 0x1001ac17
and dword [ebp - 0x580], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x580], eax
je 0x1001ac38
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x308], 0
jne 0x1001ac38
and dword [ebp - 0x588], 0
jmp 0x1001ac42
mov dword [ebp - 0x588], 1
mov eax, dword [ebp - 0x588]
mov dword [ebp - 0x6c8], eax
jmp 0x1001ab03
jmp 0x1001acca
push 2
lea ecx, [ebp - 0xc78]
call fcn.1000dfce
mov byte [ebp - 4], 0x28
lea eax, [ebp - 0xbb4]
push eax
lea eax, [ebp - 0xc78]
push eax
push 0
push 1
call fcn.10014c52
add esp, 0x10
mov dword [ebp - 0x10], 1
jmp 0x1001ac90
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1001acbb
push 0
push 0x5696
push 0x5c9c
push 0x52e3
push 0x56ca
push 0x499e
call fcn.1001bbd3
add esp, 0x18
jmp 0x1001ac89
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xc78]
call fcn.1000e00a
mov dword [ebp - 0x10], 0
jmp 0x1001acda
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jg 0x1001ad6c
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xc04], 0
je 0x1001ad3e
mov dword [ebp - 0xf8], 1
jmp 0x1001ad0a
mov eax, dword [ebp - 0xf8]
dec eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jl 0x1001ad3c
mov byte [ebp - 0xae], 0
movzx eax, byte [ebp - 0xae]
test eax, eax
je 0x1001ad3a
push 0x20ea
push 0xff
push 0x1de3
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x1001acfd
jmp 0x1001ad67
mov byte [ebp - 0x90], 0
lea eax, [ebp - 0x90]
push eax
push 0x3496
push 0x7686
push 1
push 0x3927
push 0
call fcn.10015087
add esp, 0x18
jmp 0x1001acd3
mov dword [ebp - 0x6e4], 2
mov dword [ebp - 0x9fc], 0xfffffff7
mov dword [ebp - 0x9f8], 0xfffffff7
mov dword [ebp - 0x9f4], 0xfffffff7
mov dword [ebp - 0x9f0], 0xfffffff7
lea ecx, [ebp - 0x2c9]
call fcn.1000e7d2
push eax
lea eax, [ebp - 0x9ec]
push eax
lea eax, [ebp - 0x9fc]
push eax
lea ecx, [ebp - 0xe0c]
call fcn.10032a42
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x934]
call fcn.100329ab
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x40], 0xfffffffe
mov dword [ebp - 0x6dc], 0xe458c458
mov dword [ebp - 0x40], 3
jmp 0x1001adf8
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x1001af7b
mov dword [ebp - 0x5b0], 0xfffffffe
mov dword [ebp - 0x6d4], 0xd0a3
push dword [ebp - 0x40]
lea ecx, [ebp - 0x934]
call fcn.1000e00f
cmp dword [eax], 0
je 0x1001af17
mov dword [ebp - 0x998], 0xa9d69236
mov dword [ebp - 0x994], 0xa9d69236
mov dword [ebp - 0x990], 0xa9d69236
mov dword [ebp - 0x98c], 0xa9d69236
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x998], 0xffffffff
jae 0x1001ae71
mov dword [ebp - 0x590], 1
jmp 0x1001ae78
and dword [ebp - 0x590], 0
cmp dword [ebp - 0x590], 0
jne 0x1001ae8d
mov dword [ebp - 0x5a0], 1
jmp 0x1001ae94
and dword [ebp - 0x5a0], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp + eax - 0x998]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x934]
call fcn.1000e00f
mov dword [eax], esi
mov eax, 0xad9d
cmp eax, 9
jb 0x1001aeda
push dword [ebp - 0x40]
lea ecx, [ebp - 0x934]
call fcn.1000e00f
cmp dword [eax], 0
je 0x1001aeda
mov dword [ebp - 0x598], 1
jmp 0x1001aee1
and dword [ebp - 0x598], 0
mov eax, dword [ebp - 0x598]
sub eax, 8
cmp dword [ebp - 0x5a0], eax
jle 0x1001aefe
mov dword [ebp - 0x5a8], 1
jmp 0x1001af05
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x5a8]
mov dword [ebp - 0x5b0], eax
jmp 0x1001af53
mov dword [ebp - 0x6cc], 0xe637c5b1
lea eax, [ebp - 0x5b0]
push eax
lea eax, [ebp - 0x6cc]
push eax
push 0x3eaf
push 0
push 0x31d9
push 0x1beb
call fcn.10025cc0
add esp, 0x18
cmp dword [ebp - 0x40], 0
je 0x1001af53
jmp 0x1001adf1
lea eax, [ebp - 0x40]
push eax
push 0
lea eax, [ebp - 0x6d4]
push eax
lea eax, [ebp - 0x934]
push eax
lea eax, [ebp - 0x6dc]
push eax
call fcn.10021950
add esp, 0x14
jmp 0x1001adf1
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x934]
call fcn.1000e00a
mov dword [ebp - 0x248], 0xffffffff
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x248], 0xffffffef
jmp 0x1001afb7
mov eax, dword [ebp - 0x248]
inc eax
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0xf
jg 0x1001b0eb
push 3
lea ecx, [ebp - 0xc98]
call fcn.1000dfce
mov byte [ebp - 4], 0x2a
mov dword [ebp - 0x17c], 0
push 0
push 0x3953
lea eax, [ebp - 0xc98]
push eax
lea eax, [ebp - 0xce8]
push eax
call fcn.10021b58
add esp, 0x10
mov dword [ebp - 0x17c], 0
jmp 0x1001b015
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 2
jg 0x1001b0a9
push 1
lea ecx, [ebp - 0xc88]
call fcn.1000dfce
mov byte [ebp - 4], 0x2b
mov dword [ebp - 0x250], 0
jmp 0x1001b04c
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 1
jge 0x1001b06e
push dword [ebp - 0x250]
lea ecx, [ebp - 0xc88]
call fcn.1000e00f
mov dword [eax], 0x73d2d672
jmp 0x1001b03f
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
mov byte [ebp - 0xe9], 0
movzx eax, byte [ebp - 0xe9]
test eax, eax
je 0x1001b095
push 0
call fcn.10020d2c
pop ecx
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xc88]
call fcn.1000e00a
jmp 0x1001b008
mov dword [ebp - 0x13c], 0xfffffff4
jmp 0x1001b0c2
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0x24
jg 0x1001b0d7
mov dword [ebp - 0x17c], 6
jmp 0x1001b0b5
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xc98]
call fcn.1000e00a
jmp 0x1001afaa
mov dword [ebp - 0x184], 0
jmp 0x1001b104
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 1
jge 0x1001b120
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0xbbc], 0xfffffffa
jmp 0x1001b0f7
lea eax, [ebp - 0xcd8]
push eax
push 0
push 0x25e1
lea eax, [ebp - 0x184]
push eax
call fcn.1001f5d4
add esp, 0x10
lea eax, [ebp - 0x6e4]
push eax
push 1
push 0
call fcn.10013da2
add esp, 0xc
push 2
lea ecx, [ebp - 0xca8]
call fcn.1000dfce
mov byte [ebp - 4], 0x2c
mov dword [ebp - 0x258], 0xfffffffa
lea eax, [ebp - 0xd34]
push eax
lea eax, [ebp - 0xca8]
push eax
push 0xbc4
push 0x718f
push 1
push 1
call fcn.10013c59
add esp, 0x18
mov dword [ebp - 0x258], 0
jmp 0x1001b1a8
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 1
jg 0x1001b1e9
mov byte [ebp - 0x92], 0
movzx eax, byte [ebp - 0x92]
test eax, eax
je 0x1001b1cb
push 0
call fcn.1002552c
pop ecx
mov byte [ebp - 0xb0], 0
movzx eax, byte [ebp - 0xb0]
test eax, eax
je 0x1001b1e7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1001b19b
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xca8]
call fcn.1000e00a
mov byte [ebp - 0x96], 0
mov dword [ebp - 0x6ec], 0xe2db58e4
mov dword [ebp - 0xbc4], 0xe57ad95e
mov dword [ebp - 0x260], 0
push 1
lea ecx, [ebp - 0xcb8]
call fcn.1000dfce
mov byte [ebp - 4], 0x2d
mov dword [ebp - 0x120], 0xffff
mov dword [ebp - 0x70], 0
jmp 0x1001b248
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1001b25e
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x6f4], 0x7f0a290b
jmp 0x1001b241
mov dword [ebp - 0x70], 0
jmp 0x1001b26e
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1001b28a
push dword [ebp - 0x70]
lea ecx, [ebp - 0xcb8]
call fcn.1000e00f
mov dword [eax], 0x6c3a0b8e
jmp 0x1001b267
mov eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x260], 0
jmp 0x1001b2b0
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 1
jne 0x1001b335
mov byte [ebp - 0x94], 0
movzx eax, byte [ebp - 0x94]
test eax, eax
je 0x1001b2d6
push 0x4b
push 0
call fcn.1002439f
pop ecx
pop ecx
mov dword [ebp - 0x120], 0
jmp 0x1001b2ef
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0x3b
je 0x1001b330
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x1001b31b
push 1
push 0x73b0
push 0
call fcn.10025cf5
add esp, 0xc
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6ec]
mov dword [ebp + eax - 0x6f4], ecx
jmp 0x1001b2e2
jmp 0x1001b2a3
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xcb8]
call fcn.1000e00a
movzx eax, byte [ebp - 0x96]
test eax, eax
je 0x1001b44d
mov dword [ebp - 0x270], 1
mov dword [ebp - 0xcf0], 4
mov dword [ebp - 0xbcc], 0xfffffff7
mov dword [ebp - 0x6fc], 0xfffffff7
mov dword [ebp - 0x268], 0
jmp 0x1001b394
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 3
jge 0x1001b3b0
mov eax, dword [ebp - 0x268]
mov dword [ebp + eax*4 - 0xcc8], 0xfffffffa
jmp 0x1001b387
mov dword [ebp - 0x270], 0
jmp 0x1001b3c9
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 2
jg 0x1001b428
mov dword [ebp - 0x34], 0x46df37d4
mov dword [ebp - 0x34], 0
jmp 0x1001b3e9
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jg 0x1001b400
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0xcc8], 0
je 0x1001b3fe
jmp 0x1001b400
jmp 0x1001b3e2
mov dword [ebp - 0x34], 0
jmp 0x1001b410
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x1001b426
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0xcc8], 0xffffffff
jmp 0x1001b409
jmp 0x1001b3bc
lea eax, [ebp - 0x6fc]
push eax
push 0x199a
push 0
push 0x64b4
call fcn.1002c4d8
add esp, 0x10
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcd8]
call fcn.1000e00a
jmp 0x1001a088
mov dword [ebp - 0x78], 0xffffffff
push 2
lea ecx, [ebp - 0xa58]
call fcn.1000dfce
mov dword [ebp - 4], 0x2e
mov dword [ebp - 0x278], 0
jmp 0x1001b495
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 2
jge 0x1001b4b7
push dword [ebp - 0x278]
lea ecx, [ebp - 0xa58]
call fcn.1000e00f
mov dword [eax], 1
jmp 0x1001b488
mov dword [ebp - 0x78], 0x1a
jmp 0x1001b4c7
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x12
jg 0x1001b5e3
mov dword [ebp - 0x704], 1
mov dword [ebp - 0x280], 0
jmp 0x1001b4f4
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 4
jge 0x1001b510
mov eax, dword [ebp - 0x280]
mov dword [ebp + eax*4 - 0xda0], 0xfa32a17d
jmp 0x1001b4e7
push 6
pop eax
test eax, eax
je 0x1001b5a1
xor eax, eax
inc eax
je 0x1001b544
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xda0], 3
xor eax, eax
add eax, 3
je 0x1001b544
mov dword [ebp - 0x5b8], 1
jmp 0x1001b54b
and dword [ebp - 0x5b8], 0
mov eax, dword [ebp - 0x5b8]
add eax, 0x77a7902b
cmp dword [ebp - 0x704], eax
jl 0x1001b56a
mov dword [ebp - 0x5c0], 1
jmp 0x1001b571
and dword [ebp - 0x5c0], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x5c0], eax
jle 0x1001b580
cmp dword [ebp - 0x78], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xda0]
imul eax, dword [ebp - 0x78]
test eax, eax
je 0x1001b5a1
mov dword [ebp - 0x5c8], 1
jmp 0x1001b5a8
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x5c8]
add eax, 8
cmp eax, dword [ebp - 0x78]
jl 0x1001b5c2
mov dword [ebp - 0x5d0], 1
jmp 0x1001b5c9
and dword [ebp - 0x5d0], 0
push 1
lea ecx, [ebp - 0xa58]
call fcn.1000e00f
mov ecx, dword [ebp - 0x5d0]
mov dword [eax], ecx
jmp 0x1001b4c0
mov byte [ebp - 0xb2], 0
push 0x28eb
lea eax, [ebp - 0xb2]
push eax
push 1
push 1
push 0x53f4
push 0
call fcn.1002d81e
add esp, 0x18
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa58]
call fcn.1000e00a
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x70c]
mov dword [ebp + eax - 0x714], ecx
mov dword [ebp - 0x18c], 0xffffffff
mov dword [ebp - 0xfc], 0x9a54e587
push 3
lea ecx, [ebp - 0xa94]
call fcn.1000dfce
mov dword [ebp - 4], 0x2f
mov dword [ebp - 0x288], 0
jmp 0x1001b66c
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 3
jge 0x1001b68e
push dword [ebp - 0x288]
lea ecx, [ebp - 0xa94]
call fcn.1000e00f
mov dword [eax], 0xfff8
jmp 0x1001b65f
push 0x2403
push 0
lea eax, [ebp - 0x18c]
push eax
push 0xdcb
lea eax, [ebp - 0xfc]
push eax
call fcn.1002104c
add esp, 0x14
mov dword [ebp - 0x18c], 0
jmp 0x1001b6c9
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 9
jge 0x1001b758
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x1001b70d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x8b8
push 0x228b
push 0x25fc
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 0xfc], 0
jmp 0x1001b726
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 3
jge 0x1001b753
push 0x1551
lea eax, [ebp - 0xa94]
push eax
push 0x4134
push 0
lea eax, [ebp - 0xfc]
push eax
call fcn.1002d90f
add esp, 0x14
jmp 0x1001b719
jmp 0x1001b6bc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa94]
call fcn.1000e00a
mov eax, dword [ebp - 0x5d8]
mov ecx, dword [ebp - 0x2d8]
mov ecx, dword [ecx]
mov dword [eax + 8], ecx
push dword [ebp - 0x2d0]
push 0
mov eax, dword [ebp - 0x2d8]
push dword [eax]
call fcn.1003c587
add esp, 0xc
jmp 0x1001bad5
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x784], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x72c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x73c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x77c], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x774], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0x734], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x71c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x724], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x78c], eax
mov eax, dword [ebp - 0x71c]
movzx eax, byte [eax]
test eax, eax
je 0x1001b910
mov eax, dword [ebp - 0x724]
mov dword [ebp - 0x744], eax
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x74c], eax
mov eax, dword [ebp - 0x734]
mov dword [ebp - 0x754], eax
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0x75c], eax
mov eax, dword [ebp - 0x744]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0x764], eax
mov eax, dword [ebp - 0x75c]
mov dword [ebp - 0x76c], eax
mov eax, dword [ebp - 0x2e0]
cmp dword [eax], 0
jne 0x1001b8fb
mov eax, dword [ebp - 0x194]
mov eax, dword [eax]
mov dword [ebp - 0xd84], eax
mov eax, dword [ebp - 0x2e0]
cmp dword [eax], 0
jne 0x1001b8db
mov eax, dword [ebp - 0x194]
cmp dword [eax], 0
jne 0x1001b896
mov dword [ebp - 0x5e0], 1
jmp 0x1001b89d
and dword [ebp - 0x5e0], 0
mov eax, dword [ebp - 0x194]
mov eax, dword [eax]
cmp dword [ebp - 0x5e0], eax
jle 0x1001b8b9
mov dword [ebp - 0x5e8], 1
jmp 0x1001b8c0
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x764]
mov ecx, dword [ebp - 0x5e8]
mov dword [eax], ecx
xor eax, eax
jne 0x1001b8db
and dword [ebp - 0x5f0], 0
jmp 0x1001b8e5
mov dword [ebp - 0x5f0], 1
mov eax, dword [ebp - 0x194]
mov eax, dword [eax]
add eax, dword [ebp - 0x5f0]
mov ecx, dword [ebp - 0x2e0]
cmp eax, dword [ecx]
mov eax, dword [ebp - 0x194]
mov ecx, dword [ebp - 0x76c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1001bad5
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0x794], eax
mov eax, dword [ebp - 0x77c]
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x7bc], eax
mov eax, dword [ebp - 0x78c]
mov dword [ebp - 0x7c4], eax
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x7d4], eax
mov dword [ebp - 0x79c], 0x1397
cmp dword [ebp - 0x79c], 0x852
jge 0x1001ba50
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x5f8]
push eax
lea eax, [ebp - 0xbd4]
push eax
mov ecx, 0x1065de18
call fcn.10032402
mov ecx, eax
call fcn.10032402
mov ecx, eax
call fcn.10032402
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x5f8]
shl ecx, 1
mov eax, dword [ebp - 0x19c]
cdq
idiv ecx
mov dword [ebp - 0x7ac], eax
mov ecx, dword [ebp - 0x5f8]
shl ecx, 1
mov eax, dword [ebp - 0x19c]
cdq
idiv ecx
mov eax, edx
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebp - 0x19c]
and eax, 0x80000001
jns 0x1001b9e7
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x1001b9f1
mov byte [ebp - 0x21], 0x52
jmp 0x1001b9f5
mov byte [ebp - 0x21], 0x4c
mov al, byte [ebp - 0x21]
mov byte [ebp - 0xe1], al
push fcn.10035be1
mov eax, dword [ebp - 0x7a4]
inc eax
push eax
mov eax, dword [ebp - 0x7ac]
inc eax
push eax
mov ecx, 0x1065dcf8
call fcn.100327f9
mov edx, 0x10008ec8
mov ecx, eax
call fcn.10013070
mov ecx, eax
call fcn.100327f9
mov edx, 0x10008ec8
mov ecx, eax
call fcn.10013070
mov dl, byte [ebp - 0xe1]
mov ecx, eax
call fcn.10035e1e
mov ecx, eax
call fcn.100326db
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0x610], eax
mov eax, dword [ebp - 0x7bc]
mov dword [ebp - 0x600], eax
mov eax, dword [ebp - 0x7c4]
mov dword [ebp - 0x7cc], eax
mov eax, dword [ebp - 0x7cc]
push dword [eax]
mov ecx, dword [ebp - 0x600]
call fcn.1000e00f
mov esi, eax
push 0
mov ecx, dword [ebp - 0x600]
call fcn.1000e00f
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x1001baa8
mov dword [ebp - 0x608], 1
jmp 0x1001baaf
and dword [ebp - 0x608], 0
mov eax, dword [ebp - 0x608]
neg eax
imul eax, eax, 0xb666
mov ecx, dword [ebp - 0x610]
mov dword [ecx], eax
mov eax, dword [ebp - 0x7d4]
mov ecx, dword [ebp - 0x610]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret