Function at 0x10028bf9
Capabilities:
Enumerate pe sections
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006b177
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7d4
push esi
push edi
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1002c55a
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x51c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x524], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x514], eax
mov eax, dword [ebp - 0x478]
movzx eax, byte [eax]
test eax, eax
je 0x1002c52f
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0x4f4], eax
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x4dc], eax
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x12c], 0xffffffff
mov dword [ebp - 0x12c], 0x12
jmp 0x10028caa
mov eax, dword [ebp - 0x12c]
dec eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0xfffffff2
jl 0x10028d5c
push 4
lea ecx, [ebp - 0x5e8]
call fcn.100140c9
and dword [ebp - 4], 0
mov dword [ebp - 0xc8], 0
jmp 0x10028ce1
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 4
jge 0x10028d03
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x5e8]
call fcn.10014130
mov dword [eax], 0xd05b
jmp 0x10028cd4
push 3
lea ecx, [ebp - 0x5e8]
call fcn.10014130
cmp dword [eax], 0
je 0x10028d26
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5e8]
call fcn.1001412b
jmp 0x10028d5c
mov byte [ebp - 0x59], 0
movzx eax, byte [ebp - 0x59]
test eax, eax
je 0x10028d48
push 0
push 1
push 0xe39
push 0x5149
call fcn.1002d595
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5e8]
call fcn.1001412b
jmp 0x10028c9d
mov dword [ebp - 0x534], 1
mov dword [ebp - 0x134], 0
jmp 0x10028d7f
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 3
jge 0x10028d9b
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x7a8], 0xfff7
jmp 0x10028d72
mov byte [ebp - 0x71], 0
push 0x4561
push 0
lea eax, [ebp - 0x71]
push eax
call fcn.10037b8f
add esp, 0xc
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x7a8], 0
je 0x10028e0d
mov byte [ebp - 0x61], 0
push 0
lea eax, [ebp - 0x61]
push eax
call fcn.1002c6dd
pop ecx
pop ecx
mov byte [ebp - 0x55], 0
movzx eax, byte [ebp - 0x55]
test eax, eax
je 0x10028e0b
push 0x2db9
push 1
push 0x6c33
push 0x3849
push 1
push 0xb74
push 0
push 0x90
push 0x46a7
call fcn.1002898d
add esp, 0x24
jmp 0x10028e51
mov dword [ebp - 0x28c], 0x2a43d953
mov dword [ebp - 0x52c], 6
push 0
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x52c]
push eax
push 0
push 0x4a4a
push 0x1c6e
call fcn.100316a4
add esp, 0x18
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x534], eax
mov dword [ebp - 0x60], 0x5595
mov dword [ebp - 0x640], 0x9102
mov dword [ebp - 0x63c], 0x9102
mov dword [ebp - 0x638], 0x9102
mov dword [ebp - 0x634], 0x9102
lea ecx, [ebp - 0x195]
call fcn.1001413f
push eax
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x640]
push eax
lea ecx, [ebp - 0x7b0]
call fcn.10014142
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x730]
call fcn.10014105
mov dword [ebp - 4], 1
mov dword [ebp - 0xac], 0xfffffffa
mov dword [ebp - 0x54c], 0x826a056e
mov dword [ebp - 0xac], 0
jmp 0x10028ee9
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jg 0x10028f46
mov dword [ebp - 0x554], 0xf21009d4
mov dword [ebp - 0x53c], 1
mov dword [ebp - 0x544], 0xfffffffa
lea eax, [ebp - 0x53c]
push eax
lea eax, [ebp - 0x544]
push eax
push 0
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x730]
push eax
lea eax, [ebp - 0x54c]
push eax
lea eax, [ebp - 0x554]
push eax
call fcn.1003c8d2
add esp, 0x1c
jmp 0x10028edc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x730]
call fcn.1001412b
mov dword [ebp - 0x14], 0x90611bc3
mov dword [ebp - 0x28], 0x40c
mov dword [ebp - 0x164], 0xe1ca
mov dword [ebp - 0x3e0], 1
mov dword [ebp - 0x3e8], 9
mov dword [ebp - 0x15c], 0xffffffff
mov dword [ebp - 0x1b0], 0x55f1bb13
mov dword [ebp - 0x55c], 5
mov dword [ebp - 0x564], 1
mov dword [ebp - 0x44], 0
jmp 0x10028fb9
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jge 0x10028fcf
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x90], 0xfffffff9
jmp 0x10028fb2
mov dword [ebp - 0x44], 0
jmp 0x10028fdf
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x10028ff5
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0xb8], 0xffff
jmp 0x10028fd8
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x90], 0
jne 0x10029097
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x90]
inc eax
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x3e8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x90]
cmp dword [ebp - 0x3e8], eax
jle 0x1002904a
mov dword [ebp - 0x3f0], 1
jmp 0x10029051
and dword [ebp - 0x3f0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x90]
cmp dword [ebp - 0x3f0], eax
jne 0x10029072
mov dword [ebp - 0x3f8], 1
jmp 0x10029079
and dword [ebp - 0x3f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x90]
cmp dword [ebp - 0x3f8], eax
jne 0x10029097
and dword [ebp - 0x424], 0
jmp 0x100290a1
mov dword [ebp - 0x424], 1
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x73c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x90]
mov dword [ebp - 0x750], eax
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x6bc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x90]
neg eax
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x90]
jl 0x10029117
cmp dword [ebp - 0x1b0], 0
je 0x10029117
mov dword [ebp - 0x42c], 1
jmp 0x1002911e
and dword [ebp - 0x42c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
cmp dword [ebp - 0x42c], eax
jne 0x1002913f
mov dword [ebp - 0x418], 1
jmp 0x10029146
and dword [ebp - 0x418], 0
cmp dword [ebp - 0x418], 1
jg 0x1002915b
mov dword [ebp - 0x3d8], 1
jmp 0x10029162
and dword [ebp - 0x3d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
cmp dword [ebp - 0x3d8], eax
jge 0x10029183
mov dword [ebp - 0x1e8], 1
jmp 0x1002918a
and dword [ebp - 0x1e8], 0
cmp dword [ebp - 0x1e8], 1
ja 0x1002919f
mov dword [ebp - 0x310], 1
jmp 0x100291a6
and dword [ebp - 0x310], 0
cmp dword [ebp - 0x310], 6
jne 0x100291bb
mov dword [ebp - 0x1f0], 1
jmp 0x100291c2
and dword [ebp - 0x1f0], 0
cmp dword [ebp - 0x1f0], 0xc01e6e2b
je 0x100291da
mov dword [ebp - 0x3a0], 1
jmp 0x100291e1
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x55c], eax
push 4
pop eax
imul eax, eax, 0
push 7
pop ecx
sub ecx, dword [ebp + eax - 0xb8]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0xb8]
jne 0x10029218
mov dword [ebp - 0x1f8], 1
jmp 0x1002921f
and dword [ebp - 0x1f8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x90]
cmp eax, dword [ebp - 0x1f8]
jl 0x10029240
mov dword [ebp - 0x318], 1
jmp 0x10029247
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x564]
cmp dword [ebp - 0x318], eax
jle 0x10029261
mov dword [ebp - 0x200], 1
jmp 0x10029268
and dword [ebp - 0x200], 0
cmp dword [ebp - 0x200], 5
jbe 0x1002927d
mov dword [ebp - 0x3a8], 1
jmp 0x10029284
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
cmp eax, dword [ebp - 0x3a8]
jg 0x100292ab
mov dword [ebp - 0x208], 1
jmp 0x100292b2
and dword [ebp - 0x208], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x90]
cmp dword [ebp - 0x208], eax
jl 0x100292d3
mov dword [ebp - 0x320], 1
jmp 0x100292da
and dword [ebp - 0x320], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
cmp dword [ebp - 0x320], eax
jg 0x100292fb
mov dword [ebp - 0x210], 1
jmp 0x10029302
and dword [ebp - 0x210], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x90]
imul eax, dword [ebp - 0x210]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x90], eax
mov dword [ebp - 0x250], 0xf8de905f
mov dword [ebp - 0x3b4], 0x265d6326
mov dword [ebp - 0x13c], 1
mov dword [ebp - 0x718], 0
mov dword [ebp - 0x6c4], 0x5809
mov dword [ebp - 0x3c], 0
jmp 0x10029365
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x1002937b
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xd0], 2
jmp 0x1002935e
mov dword [ebp - 0x3c], 0
jmp 0x1002938b
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x100293a1
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x7d4], 7
jmp 0x10029384
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xd0], 0xffffffff
jmp 0x100293cf
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xd0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xd0], 0x11
je 0x100293fe
mov dword [ebp - 0x56c], 6
lea eax, [ebp - 0x56c]
push eax
push 1
push 1
call fcn.10027d4b
add esp, 0xc
jmp 0x100293b4
mov dword [ebp - 0x13c], 0
jmp 0x10029417
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
jl 0x100294cb
push 1
lea ecx, [ebp - 0x74c]
call fcn.100140c9
mov dword [ebp - 4], 2
mov dword [ebp - 0x768], 0xc2da8afc
mov dword [ebp - 0x574], 0xffff
mov dword [ebp - 0xd8], 0
jmp 0x10029465
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 1
jge 0x10029484
push dword [ebp - 0xd8]
lea ecx, [ebp - 0x74c]
call fcn.10014130
and dword [eax], 0
jmp 0x10029458
push 1
push 0x78cb
push 0x18fc
lea eax, [ebp - 0x574]
push eax
push 0x43be
push 1
push 0x29a1
push 0x4ce0
push 0
push 0x6ab
call fcn.1003d564
add esp, 0x28
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74c]
call fcn.1001412b
jmp 0x1002940a
imul eax, dword [ebp - 0x14], 0x9e07
add eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
test eax, eax
jne 0x100294ec
cmp dword [ebp - 0x14], 0
jne 0x100294ec
and dword [ebp - 0x3ac], 0
jmp 0x100294f6
mov dword [ebp - 0x3ac], 1
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x3ac], eax
jge 0x1002950d
mov dword [ebp - 0x218], 1
jmp 0x10029514
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x218]
imul eax, eax, 0x4128
imul eax, dword [ebp - 0x14]
cmp eax, 0xe418a527
je 0x1002953a
mov dword [ebp - 0x5c8], 1
jmp 0x10029541
and dword [ebp - 0x5c8], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x6cc], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x50c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x50c]
cmp eax, dword [ebp - 0x46c]
jle 0x1002957d
mov dword [ebp - 0x328], 1
jmp 0x10029584
and dword [ebp - 0x328], 0
imul eax, dword [ebp - 0x328], 0xfff9
cmp eax, dword [ebp - 0x28]
jg 0x1002959f
mov dword [ebp - 0x220], 1
jmp 0x100295a6
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x220], eax
je 0x100295bd
mov dword [ebp - 0x538], 1
jmp 0x100295c4
and dword [ebp - 0x538], 0
cmp dword [ebp - 0x28], 0xcc7c
jg 0x100295d9
mov dword [ebp - 0x3ec], 1
jmp 0x100295e0
and dword [ebp - 0x3ec], 0
cmp dword [ebp - 0x3ec], 0
je 0x10029a59
mov dword [ebp - 0x78], 0x477862f
mov dword [ebp - 0x5a4], 0xdf11bbb4
mov dword [ebp - 0x6f8], 0xfffffffb
mov dword [ebp - 0x78], 0
jmp 0x10029618
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xffffffe2
jl 0x1002966b
mov dword [ebp - 0x480], 0x666a756a
mov dword [ebp - 0x488], 0x184dcc8
cmp dword [ebp - 0x78], 0
je 0x1002963a
jmp 0x1002966b
push 0x46da
push 0
lea eax, [ebp - 0x480]
push eax
push 0x16b3
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x5a4]
push eax
lea eax, [ebp - 0x488]
push eax
push 0
call fcn.1002d2f8
add esp, 0x20
jmp 0x10029611
push 4
lea ecx, [ebp - 0x670]
call fcn.100140c9
mov dword [ebp - 4], 3
mov dword [ebp - 0xbc], 1
lea eax, [ebp - 0x670]
push eax
push 0
push 0x435a
lea eax, [ebp - 0x68c]
push eax
push 0x5f0a
push 0x79d9
push 0x1a8f
push 1
call fcn.1002d2f8
add esp, 0x20
mov dword [ebp - 0xbc], 3
jmp 0x100296d0
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x10029737
mov dword [ebp - 0xe0], 0x1265ab3e
mov dword [ebp - 0xe0], 0
jmp 0x100296fc
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 3
jg 0x10029735
mov dword [ebp - 0x540], 0xe77ab392
push 1
push 0x5965
push 0x719
push 0
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x670]
push eax
call fcn.100316a4
add esp, 0x18
jmp 0x100296ef
jmp 0x100296c3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x670]
call fcn.1001412b
mov dword [ebp - 0x144], 0
jmp 0x1002975f
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jge 0x1002977b
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x5ac], 0xfffffffd
jmp 0x10029752
mov dword [ebp - 0x14c], 0x53b26bdd
mov dword [ebp - 0x14c], 0x12
jmp 0x1002979e
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0x15
jle 0x10029806
mov dword [ebp - 0x490], 3
mov dword [ebp - 0x5bc], 0x999fb023
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x5bc], eax
mov byte [ebp - 0x56], 0
movzx eax, byte [ebp - 0x56]
test eax, eax
je 0x10029804
push 1
push 1
push 0x1779
push 1
push 0x19a6
push 0x282f
push 0x95a
push 0x61dd
push 0x1ebb
push 0x259e
call fcn.10027e55
add esp, 0x28
jmp 0x10029791
mov dword [ebp - 0x14], 0
jmp 0x10029816
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x10029a54
mov dword [ebp - 0x28], 0
jmp 0x10029830
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x10029a4f
mov dword [ebp - 0x148], 1
mov dword [ebp - 0x148], 0x18
jmp 0x1002985d
mov eax, dword [ebp - 0x148]
dec eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0x12
jge 0x10029888
mov dword [ebp - 0x498], 2
push 0
push 0x4824
lea eax, [ebp - 0x498]
push eax
call fcn.1003d7be
add esp, 0xc
jmp 0x10029850
mov byte [ebp - 0x58], 0
push 1
lea eax, [ebp - 0x58]
push eax
push 1
push 0x1e34
push 0
push 0x19e2
push 0x22fa
push 0x2e7d
push 0x18be
call fcn.10031bb5
add esp, 0x24
mov dword [ebp - 0x60], 0
jmp 0x100298c7
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jg 0x10029a4a
mov dword [ebp - 0x548], 0x7730
mov dword [ebp - 0x54], 0x831e42a4
mov dword [ebp - 0x4a0], 0x8cda2ae7
mov dword [ebp - 0xf8], 0
jmp 0x10029905
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 3
jge 0x10029921
mov eax, dword [ebp - 0xf8]
mov dword [ebp + eax*4 - 0x7e0], 0x715cc48b
jmp 0x100298f8
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x54], 0x17
jmp 0x1002993a
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x11
jge 0x100299c9
mov dword [ebp - 0x194], 1
mov dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x690], eax
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x54], eax
jge 0x10029990
mov dword [ebp - 0x330], 1
jmp 0x10029997
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x194]
cmp eax, dword [ebp - 0x330]
jge 0x100299b1
mov dword [ebp - 0x230], 1
jmp 0x100299b8
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x4a0], eax
jmp 0x10029933
mov dword [ebp - 0x128], 1
mov dword [ebp - 0x128], 0
jmp 0x100299ec
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jg 0x10029a45
mov dword [ebp - 0x100], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x5ac], 0
je 0x10029a0e
jmp 0x10029a45
mov dword [ebp - 0x100], 0
jmp 0x10029a27
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0
jl 0x10029a43
mov byte [ebp - 0x72], 0
push 0
lea eax, [ebp - 0x72]
push eax
call fcn.1002c782
pop ecx
pop ecx
jmp 0x10029a1a
jmp 0x100299df
jmp 0x100298c0
jmp 0x10029829
jmp 0x1002980f
jmp 0x10029c21
mov dword [ebp - 0x248], 0xfffffff7
mov dword [ebp - 0x41c], 0xffffffff
mov dword [ebp - 0x140], 0
jmp 0x10029a86
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 2
jge 0x10029aa2
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x724], 7
jmp 0x10029a79
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x698], eax
cmp dword [ebp - 0x14], 0
jne 0x10029ac1
push 0xfffffffffffffff7
pop eax
test eax, eax
jne 0x10029ac1
and dword [ebp - 0x238], 0
jmp 0x10029acb
mov dword [ebp - 0x238], 1
imul eax, dword [ebp - 0x248], 0xffff
mov dword [ebp - 0x3b4], eax
cmp dword [ebp - 0x3b4], 0
je 0x10029af9
cmp dword [ebp - 0x41c], 0
je 0x10029af9
mov dword [ebp - 0x338], 1
jmp 0x10029b00
and dword [ebp - 0x338], 0
mov eax, dword [ebp - 0x238]
cmp eax, dword [ebp - 0x338]
jg 0x10029b1a
mov dword [ebp - 0x240], 1
jmp 0x10029b21
and dword [ebp - 0x240], 0
imul eax, dword [ebp - 0x240], 0xf58a
test eax, eax
je 0x10029b44
cmp dword [ebp - 0x41c], 0
je 0x10029b44
mov dword [ebp - 0x340], 1
jmp 0x10029b4b
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x248]
cmp dword [ebp - 0x340], eax
jg 0x10029b65
mov dword [ebp - 0x16c], 1
jmp 0x10029b6c
and dword [ebp - 0x16c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x16c]
mov dword [ebp + eax - 0x724], ecx
mov eax, dword [ebp - 0x250]
cmp dword [ebp - 0x16c], eax
jge 0x10029ba5
mov eax, 0x435d7d23
test eax, eax
jne 0x10029ba5
cmp dword [ebp - 0x28], 0
jne 0x10029ba5
and dword [ebp - 0x4a8], 0
jmp 0x10029baf
mov dword [ebp - 0x4a8], 1
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x6a0], eax
cmp dword [ebp - 0x14], 0x1082e70d
je 0x10029bd0
mov dword [ebp - 0x550], 1
jmp 0x10029bd7
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x6a8], eax
mov eax, 0xf8d9
cmp eax, 0xffff
ja 0x10029bf8
mov dword [ebp - 0x3bc], 1
jmp 0x10029bff
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x57], 0
movzx eax, byte [ebp - 0x57]
test eax, eax
je 0x10029c21
push 0x23f2
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x84], 0x9207
mov dword [ebp - 0x110], 0xfffffffb
push 1
lea ecx, [ebp - 0x414]
call fcn.100140c9
mov dword [ebp - 4], 4
mov dword [ebp - 0x2a8], 0xb924e19c
mov dword [ebp - 0x2c0], 0xffffffff
push 2
lea ecx, [ebp - 0x658]
call fcn.100140c9
mov byte [ebp - 4], 5
mov dword [ebp - 0x130], 0xfffffff8
mov dword [ebp - 0x19c], 1
mov dword [ebp - 0x9c], 0
jmp 0x10029ca2
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x10029cc4
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x414]
call fcn.10014130
mov dword [eax], 0x78029323
jmp 0x10029c95
push 1
push 0x5459
lea eax, [ebp - 0x658]
push eax
push 0x33c9
push 0x7f7b
push 0x5c4f
push 1
push 0
push 0x72c
lea eax, [ebp - 0x9c]
push eax
push 0x3701
push 0x1010
call fcn.10030a3d
add esp, 0x30
mov dword [ebp - 0x20], 0
jmp 0x10029d13
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xe
jle 0x1002a170
mov dword [ebp - 0x30], 5
push 4
lea ecx, [ebp - 0x438]
call fcn.100140c9
mov byte [ebp - 4], 6
mov dword [ebp - 0x108], 0x1f356d9d
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x6b0]
push eax
push 0x18e1
push 1
push 0x392
push 0x5cf5
push 0x7a1e
push 0x10a7
push 0x4a4c
push 1
push 0x15d1
call fcn.10028069
add esp, 0x2c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x6b8], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
je 0x10029d99
mov dword [ebp - 0x3c4], 1
jmp 0x10029da0
and dword [ebp - 0x3c4], 0
cmp dword [ebp - 0x20], 0
je 0x10029dbb
mov eax, 0x4220
test eax, eax
je 0x10029dbb
mov dword [ebp - 0x1ac], 1
jmp 0x10029dc2
and dword [ebp - 0x1ac], 0
push 3
lea ecx, [ebp - 0x438]
call fcn.10014130
mov ecx, dword [ebp - 0x1ac]
mov dword [eax], ecx
cmp dword [ebp - 0x1ac], 0x764361a6
jle 0x10029def
mov dword [ebp - 0x258], 1
jmp 0x10029df6
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x258]
sub eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jl 0x10029e10
mov dword [ebp - 0x348], 1
jmp 0x10029e17
and dword [ebp - 0x348], 0
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x348]
je 0x10029e2e
mov dword [ebp - 0x260], 1
jmp 0x10029e35
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x260], eax
je 0x10029e4c
mov dword [ebp - 0x3f4], 1
jmp 0x10029e53
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x3f4], eax
jge 0x10029e6a
mov dword [ebp - 0x268], 1
jmp 0x10029e71
and dword [ebp - 0x268], 0
cmp dword [ebp - 0x268], 1
jg 0x10029e86
mov dword [ebp - 0x350], 1
jmp 0x10029e8d
and dword [ebp - 0x350], 0
imul eax, dword [ebp - 0x350], 9
cmp eax, dword [ebp - 0x20]
jg 0x10029ea8
cmp dword [ebp - 0x20], 0
jne 0x10029ea8
and dword [ebp - 0x270], 0
jmp 0x10029eb2
mov dword [ebp - 0x270], 1
mov eax, dword [ebp - 0x270]
sub eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x84]
je 0x10029ecf
mov dword [ebp - 0x278], 1
jmp 0x10029ed6
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x3c4]
cmp eax, dword [ebp - 0x278]
je 0x10029ef3
cmp dword [ebp - 0x30], 0
jne 0x10029ef3
and dword [ebp - 0x358], 0
jmp 0x10029efd
mov dword [ebp - 0x358], 1
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x358], eax
jl 0x10029f17
mov dword [ebp - 0x280], 1
jmp 0x10029f1e
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x110], eax
mov esi, dword [ebp - 0x20]
push 3
lea ecx, [ebp - 0x438]
call fcn.10014130
cmp esi, dword [eax]
jne 0x10029f4a
mov dword [ebp - 0x428], 1
jmp 0x10029f51
and dword [ebp - 0x428], 0
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x428]
add eax, dword [ebp - 0x84]
mov dword [ebp - 0x288], eax
push 0
lea ecx, [ebp - 0x414]
call fcn.10014130
mov ecx, dword [ebp - 0x288]
mov dword [eax], ecx
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x288]
jg 0x10029f9c
mov dword [ebp - 0x360], 1
jmp 0x10029fa3
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x360], eax
jg 0x10029fbd
mov dword [ebp - 0x290], 1
jmp 0x10029fc4
and dword [ebp - 0x290], 0
push 3
lea ecx, [ebp - 0x438]
call fcn.10014130
mov ecx, dword [ebp - 0x290]
cmp ecx, dword [eax]
jge 0x10029fe7
mov dword [ebp - 0x3cc], 1
jmp 0x10029fee
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0xffff
jne 0x1002a012
mov dword [ebp - 0x298], 1
jmp 0x1002a019
and dword [ebp - 0x298], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x298], eax
jl 0x1002a033
mov dword [ebp - 0x368], 1
jmp 0x1002a03a
and dword [ebp - 0x368], 0
cmp dword [ebp - 0x368], 0xbf5c
je 0x1002a052
mov dword [ebp - 0x2a0], 1
jmp 0x1002a059
and dword [ebp - 0x2a0], 0
push 2
lea ecx, [ebp - 0x438]
call fcn.10014130
mov eax, dword [eax]
cmp eax, dword [ebp - 0x2a0]
jge 0x1002a07c
mov dword [ebp - 0x4b0], 1
jmp 0x1002a083
and dword [ebp - 0x4b0], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x6c0], eax
cmp dword [ebp - 0x30], 0
je 0x1002a112
mov dword [ebp - 0x4b8], 0xfffffff6
mov dword [ebp - 0x5c4], 0x142b
cmp dword [ebp - 0x5c4], 0x5ca
jge 0x1002a104
lea eax, [ebp - 0x440]
push eax
push 0x1000c2e0
call fcn.10050cbb
pop ecx
pop ecx
mov eax, dword [ebp - 0x440]
sub eax, 2
mov ecx, dword [ebp - 0x43c]
sbb ecx, 0
mov edx, dword [ebp - 0x440]
sub edx, 2
mov esi, dword [ebp - 0x43c]
sbb esi, 0
push esi
push edx
push ecx
push eax
call fcn.100556d0
push edx
push eax
push 0x1000c2e0
call fcn.10050eef
add esp, 0xc
mov eax, dword [ebp - 0x4b8]
mov dword [ebp - 0x108], eax
jmp 0x1002a15c
mov dword [ebp - 0x558], 2
lea eax, [ebp - 0x108]
push eax
push 0x61e6
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x558]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x438]
push eax
push 1
push 0x3b20
call fcn.100285c3
add esp, 0x28
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x438]
call fcn.1001412b
jmp 0x10029d0c
push 0
lea ecx, [ebp - 0x658]
call fcn.10014130
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x174]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x174]
mov dword [ecx], eax
mov eax, dword [ebp - 0x174]
cmp dword [eax], 0xffff
jne 0x1002a1ae
mov dword [ebp - 0x3fc], 1
jmp 0x1002a1b5
and dword [ebp - 0x3fc], 0
push 0
lea ecx, [ebp - 0x414]
call fcn.10014130
mov ecx, dword [ebp - 0x3fc]
cmp ecx, dword [eax]
jl 0x1002a1d8
mov dword [ebp - 0x3d4], 1
jmp 0x1002a1df
and dword [ebp - 0x3d4], 0
mov eax, 0xb502d480
test eax, eax
je 0x1002a206
push 0
lea ecx, [ebp - 0x414]
call fcn.10014130
cmp dword [eax], 0
je 0x1002a206
mov dword [ebp - 0x4c0], 1
jmp 0x1002a20d
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x6c8], eax
mov eax, 0xb766298a
dec eax
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
imul eax, dword [ebp - 0x2c0]
test eax, eax
je 0x1002a23f
cmp dword [ebp - 0x130], 0
jne 0x1002a248
mov eax, 0x3358b4d4
test eax, eax
je 0x1002a263
cmp dword [ebp - 0x130], 0
je 0x1002a263
cmp dword [ebp - 0x20], 0
je 0x1002a263
mov dword [ebp - 0x370], 1
jmp 0x1002a26a
and dword [ebp - 0x370], 0
push 0
lea ecx, [ebp - 0x414]
call fcn.10014130
mov ecx, dword [ebp - 0x370]
cmp ecx, dword [eax]
jg 0x1002a28d
mov dword [ebp - 0x2b0], 1
jmp 0x1002a294
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x110]
cmp eax, dword [ebp - 0x2b0]
jge 0x1002a2ae
mov dword [ebp - 0x2b8], 1
jmp 0x1002a2b5
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x3d4]
cmp eax, dword [ebp - 0x2b8]
jg 0x1002a2cf
mov dword [ebp - 0x378], 1
jmp 0x1002a2d6
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x378], eax
jne 0x1002a2f0
mov dword [ebp - 0x420], 1
jmp 0x1002a2f7
and dword [ebp - 0x420], 0
mov esi, dword [ebp - 0x2c0]
mov eax, dword [ebp - 0x19c]
imul eax, dword [ebp - 0x420]
imul esi, eax
push 0
lea ecx, [ebp - 0x414]
call fcn.10014130
cmp esi, dword [eax]
jg 0x1002a32a
mov dword [ebp - 0x2c8], 1
jmp 0x1002a331
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x2c8], eax
je 0x1002a348
mov dword [ebp - 0x380], 1
jmp 0x1002a34f
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x19c], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x658]
call fcn.1001412b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.1001412b
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x3c8], eax
mov dword [ebp - 0x94], 0x68044455
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x1a4], 0xd058bbe5
mov dword [ebp - 0x118], 0x98cbdb62
mov dword [ebp - 0x560], 0x2cfb
push 1
lea ecx, [ebp - 0x600]
call fcn.100140c9
mov dword [ebp - 4], 7
mov dword [ebp - 0x6d0], 0xaea2
mov dword [ebp - 0x150], 0
jmp 0x1002a3f8
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 1
jge 0x1002a41a
push dword [ebp - 0x150]
lea ecx, [ebp - 0x600]
call fcn.10014130
mov dword [eax], 0xcdb7cff1
jmp 0x1002a3eb
push 0x1f9a
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xa4]
push eax
push 0x7b01
lea eax, [ebp - 0x94]
push eax
push 0x6bf4
push 0x1767
push 0x448f
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0
push 0x7af1
push 0x55ad
push 0x7b77
call fcn.10030119
add esp, 0x38
cmp dword [ebp - 0x94], 0
je 0x1002a581
push 2
lea ecx, [ebp - 0x618]
call fcn.100140c9
mov byte [ebp - 4], 8
mov dword [ebp - 0x5b4], 0xa458230b
mov dword [ebp - 0x4c8], 0xd231
push 0
push 0x41b
lea eax, [ebp - 0x6dc]
push eax
push 0
lea eax, [ebp - 0x618]
push eax
push 0x77bc
push 0x66b
call fcn.1002cdd3
add esp, 0x1c
lea eax, [ebp - 0x5b4]
push eax
lea eax, [ebp - 0x94]
push eax
push 1
push 0x64ff
push 0x3331
push 0
push 0x7f51
lea eax, [ebp - 0x118]
push eax
push 0x4728
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x4c8]
push eax
push 0x7d03
lea eax, [ebp - 0x560]
push eax
push 0x158d
lea eax, [ebp - 0x24]
push eax
push 0x324b
lea eax, [ebp - 0x618]
push eax
push 1
push 0x996
call fcn.1003a6e4
add esp, 0x50
mov dword [ebp - 0x24], 0
jmp 0x1002a549
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jg 0x1002a56d
push 0
lea eax, [ebp - 0x618]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
push 0x1f5b
call fcn.1002cc79
add esp, 0x14
jmp 0x1002a542
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x618]
call fcn.1001412b
jmp 0x1002a877
mov dword [ebp - 0x59c], 0xcc4e
mov dword [ebp - 0x184], 0x89e6
mov dword [ebp - 0x38], 0
jmp 0x1002a5a5
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x1002a5bb
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x158], 0xffffffff
jmp 0x1002a59e
mov dword [ebp - 0x38], 0
jmp 0x1002a5cb
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x1002a5e1
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x4d8], 0xffffffff
jmp 0x1002a5c4
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x158], 0
je 0x1002a7e5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x158], 0xffffffff
jbe 0x1002a611
mov dword [ebp - 0x388], 1
jmp 0x1002a618
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x6e8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x158]
mov dword [ebp - 0x6f4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x158], 0
jne 0x1002a659
mov eax, 0xc3c3
test eax, eax
jne 0x1002a659
and dword [ebp - 0x2d0], 0
jmp 0x1002a663
mov dword [ebp - 0x2d0], 1
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x2d0], eax
jle 0x1002a67a
mov dword [ebp - 0x4d0], 1
jmp 0x1002a681
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0x6fc], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x158], 0
je 0x1002a6b9
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x158], 0
je 0x1002a6b9
mov dword [ebp - 0x3dc], 1
jmp 0x1002a6c0
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x3dc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x704], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x70c], eax
push 0
lea ecx, [ebp - 0x600]
call fcn.10014130
mov eax, dword [eax]
mov dword [ebp - 0x118], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x158]
cmp dword [ebp - 0x118], eax
jne 0x1002a721
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x158], 0
jne 0x1002a721
and dword [ebp - 0x2d8], 0
jmp 0x1002a72b
mov dword [ebp - 0x2d8], 1
cmp dword [ebp - 0x2d8], 0xfffffff8
jg 0x1002a740
mov dword [ebp - 0x2e0], 1
jmp 0x1002a747
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x388]
add eax, dword [ebp - 0x2e0]
je 0x1002a76a
cmp dword [ebp - 0x184], 0
je 0x1002a76a
mov dword [ebp - 0x408], 1
jmp 0x1002a771
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x408], eax
jg 0x1002a78b
mov dword [ebp - 0x2e8], 1
jmp 0x1002a792
and dword [ebp - 0x2e8], 0
cmp dword [ebp - 0x2e8], 0x8272
je 0x1002a7aa
mov dword [ebp - 0x17c], 1
jmp 0x1002a7b1
and dword [ebp - 0x17c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x17c]
mov dword [ebp + eax - 0x4d8], ecx
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
je 0x1002a7e5
mov dword [ebp - 0x1a0], 1
jmp 0x1002a7ec
and dword [ebp - 0x1a0], 0
push 0
lea ecx, [ebp - 0x600]
call fcn.10014130
mov ecx, dword [ebp - 0x1a0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x1a0], eax
je 0x1002a81b
mov dword [ebp - 0x390], 1
jmp 0x1002a822
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x184]
cmp dword [ebp - 0x390], eax
jg 0x1002a83c
mov dword [ebp - 0x2f0], 1
jmp 0x1002a843
and dword [ebp - 0x2f0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x158]
cmp eax, dword [ebp - 0x2f0]
jl 0x1002a864
mov dword [ebp - 0x3e4], 1
jmp 0x1002a86b
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0x1a4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x600]
call fcn.1001412b
mov dword [ebp - 0x50], 9
mov dword [ebp - 0x3a4], 0xb6feb9e9
mov dword [ebp - 0x4e8], 0xfff8
mov dword [ebp - 0x138], 0
jmp 0x1002a8ba
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 3
jge 0x1002a8d6
mov eax, dword [ebp - 0x138]
mov dword [ebp + eax*4 - 0x75c], 1
jmp 0x1002a8ad
mov dword [ebp - 0x568], 0x1f41
cmp dword [ebp - 0x568], 0xdac
jge 0x1002aa7c
lea eax, [ebp - 0x18c]
push eax
mov ecx, 0x1065aed0
call fcn.10013a74
push fcn.10018a9c
mov edx, 0x1000c598
mov ecx, 0x1065ae18
call fcn.10026cf8
mov ecx, eax
call fcn.10013d78
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x4e0], eax
mov eax, dword [ebp - 0x18c]
dec eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x4e0], 0
je 0x1002aa7c
and dword [ebp - 0x120], 0
jmp 0x1002a958
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xa
jge 0x1002a97b
mov eax, dword [ebp - 0x120]
lea eax, [ebp + eax*4 - 0x79c]
push eax
mov ecx, 0x1065aed0
call fcn.10013a74
jmp 0x1002a94b
mov byte [ebp - 0xd], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0x79c]
cmp eax, dword [ebp + ecx - 0x79c]
jge 0x1002a99f
mov byte [ebp - 0xd], 1
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x1002a9f0
mov byte [ebp - 0xd], 1
and dword [ebp - 0xb4], 0
jmp 0x1002a9c1
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 9
jge 0x1002a9ee
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xb4]
mov eax, dword [ebp + eax*4 - 0x79c]
cmp eax, dword [ebp + ecx*4 - 0x798]
jle 0x1002a9ec
mov byte [ebp - 0xd], 0
jmp 0x1002a9ee
jmp 0x1002a9b4
jmp 0x1002aa37
mov byte [ebp - 0xd], 1
and dword [ebp - 0x98], 0
jmp 0x1002aa0a
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 9
jge 0x1002aa37
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x98]
mov eax, dword [ebp + eax*4 - 0x79c]
cmp eax, dword [ebp + ecx*4 - 0x798]
jge 0x1002aa35
mov byte [ebp - 0xd], 0
jmp 0x1002aa37
jmp 0x1002a9fd
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x1002aa5c
push fcn.10018a9c
mov edx, 0x1000c5a8
mov ecx, 0x1065ae18
call fcn.10026cf8
mov ecx, eax
call fcn.10013d78
jmp 0x1002aa77
push fcn.10018a9c
mov edx, 0x1000c5b0
mov ecx, 0x1065ae18
call fcn.10026cf8
mov ecx, eax
call fcn.10013d78
jmp 0x1002a91c
mov dword [ebp - 0x50], 0x18
jmp 0x1002aa8c
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x18
jl 0x1002ab55
mov dword [ebp - 0x2f8], 6
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x714], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x71c], eax
cmp dword [ebp - 0x2f8], 0xcf33
jge 0x1002aaca
mov dword [ebp - 0x398], 1
jmp 0x1002aad1
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x2f8]
cmp dword [ebp - 0x398], eax
jle 0x1002aaeb
mov dword [ebp - 0x300], 1
jmp 0x1002aaf2
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x300]
mov dword [ebp - 0x3a4], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x3a4], eax
jle 0x1002ab19
mov dword [ebp - 0x5a0], 1
jmp 0x1002ab20
and dword [ebp - 0x5a0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x75c]
mov dword [ebp - 0x764], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x75c]
mov dword [ebp - 0x76c], eax
mov dword [ebp - 0x4e8], 1
jmp 0x1002aa85
push 2
lea ecx, [ebp - 0x1d8]
call fcn.100140c9
mov dword [ebp - 4], 9
push 1
lea ecx, [ebp - 0xf0]
call fcn.100140c9
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x1a8], 0xf7762406
mov dword [ebp - 0x578], 0x8ae0512e
mov dword [ebp - 0x5b0], 0x3b020b2d
mov dword [ebp - 0x508], 4
mov dword [ebp - 0x2c], 0
jmp 0x1002abb2
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1002abcb
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x1d8]
call fcn.10014130
and dword [eax], 0
jmp 0x1002abab
push 0x77e6
push 0
push 0x1eda
push 0x6c57
push 1
lea eax, [ebp - 0xf0]
push eax
push 1
lea eax, [ebp - 0x2c]
push eax
push 0x654d
call fcn.1002898d
add esp, 0x24
mov dword [ebp - 0x2c], 0
jmp 0x1002ac08
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x1002ac1e
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x7c8], 0xffffffff
jmp 0x1002ac01
push 0
lea ecx, [ebp - 0xf0]
call fcn.10014130
mov dword [eax], 1
jmp 0x1002ac57
push 0
lea ecx, [ebp - 0xf0]
call fcn.10014130
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x308]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xf0]
call fcn.10014130
cmp dword [eax], 0
jl 0x1002b061
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x23c], 3
mov dword [ebp - 0x500], 1
mov dword [ebp - 0xe4], 0
jmp 0x1002aca1
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 2
jge 0x1002acbd
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0x6d8], 0x6d21cd43
jmp 0x1002ac94
mov dword [ebp - 0x18], 1
jmp 0x1002accd
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1002b035
mov dword [ebp - 0x1e0], 1
mov dword [ebp - 0x224], 1
mov dword [ebp - 0xf4], 0
jmp 0x1002ad04
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jge 0x1002ad20
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x738], 0x2b5d06de
jmp 0x1002acf7
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1d8]
call fcn.10014130
mov eax, dword [eax]
mov dword [ebp - 0x1e0], eax
mov esi, dword [ebp - 0x1e0]
push 0
lea ecx, [ebp - 0xf0]
call fcn.10014130
push dword [eax]
lea ecx, [ebp - 0x1d8]
call fcn.10014130
cmp esi, dword [eax]
jne 0x1002ad66
mov dword [ebp - 0x1e4], 1
jmp 0x1002ad6d
and dword [ebp - 0x1e4], 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1d8]
call fcn.10014130
mov ecx, dword [ebp - 0x1e4]
sub ecx, dword [eax]
je 0x1002ada3
push 0
lea ecx, [ebp - 0xf0]
call fcn.10014130
cmp dword [eax], 0
je 0x1002ada3
mov dword [ebp - 0x570], 1
jmp 0x1002adaa
and dword [ebp - 0x570], 0
push 0
lea ecx, [ebp - 0xf0]
call fcn.10014130
imul eax, dword [eax], 0
cmp eax, dword [ebp - 0x18]
jle 0x1002adcb
mov dword [ebp - 0x1ec], 1
jmp 0x1002add2
and dword [ebp - 0x1ec], 0
push 0
lea ecx, [ebp - 0xf0]
call fcn.10014130
mov ecx, dword [ebp - 0x1ec]
cmp ecx, dword [eax]
je 0x1002adf5
mov dword [ebp - 0x1f4], 1
jmp 0x1002adfc
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x224]
imul eax, dword [ebp - 0x1f4]
cmp eax, dword [ebp - 0x18]
jne 0x1002ae1a
mov dword [ebp - 0x4f0], 1
jmp 0x1002ae21
and dword [ebp - 0x4f0], 0
push 0
lea ecx, [ebp - 0xf0]
call fcn.10014130
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1a8], eax
mov esi, dword [ebp - 0x1a8]
push 0
lea ecx, [ebp - 0xf0]
call fcn.10014130
cmp esi, dword [eax]
jle 0x1002ae5a
mov dword [ebp - 0x5a8], 1
jmp 0x1002ae61
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x774], eax
xor eax, eax
inc eax
je 0x1002ae80
xor eax, eax
inc eax
je 0x1002ae80
mov dword [ebp - 0x1fc], 1
jmp 0x1002ae87
and dword [ebp - 0x1fc], 0
cmp dword [ebp - 0x1fc], 4
jb 0x1002ae9c
mov dword [ebp - 0x204], 1
jmp 0x1002aea3
and dword [ebp - 0x204], 0
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0x6d8]
mov dword [ebp - 0x20c], eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1d8]
call fcn.10014130
mov ecx, dword [ebp - 0x20c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x204]
mov ecx, dword [ebp - 0x20c]
cmp dword [ecx], eax
jle 0x1002aeee
mov dword [ebp - 0x214], 1
jmp 0x1002aef5
and dword [ebp - 0x214], 0
cmp dword [ebp - 0x214], 0xffffffff
jg 0x1002af1c
push 0
lea ecx, [ebp - 0xf0]
call fcn.10014130
cmp dword [eax], 0
je 0x1002af1c
mov dword [ebp - 0x21c], 1
jmp 0x1002af23
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x21c]
sub eax, dword [ebp - 0x224]
mov dword [ebp - 0x22c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x22c]
mov dword [ebp + eax - 0x738], ecx
push 0
lea ecx, [ebp - 0xf0]
call fcn.10014130
mov esi, dword [eax]
imul esi, dword [ebp - 0x22c]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1d8]
call fcn.10014130
mov edi, eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1d8]
call fcn.10014130
mov eax, dword [eax]
add eax, dword [edi]
cmp eax, esi
jl 0x1002af90
mov dword [ebp - 0x4f8], 1
jmp 0x1002af97
and dword [ebp - 0x4f8], 0
push 0
lea ecx, [ebp - 0xf0]
call fcn.10014130
push dword [eax]
lea ecx, [ebp - 0x1d8]
call fcn.10014130
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x1a8], eax
jl 0x1002afc8
mov dword [ebp - 0x234], 1
jmp 0x1002afcf
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x1002aff9
cmp dword [ebp - 0x578], 0
je 0x1002aff9
mov dword [ebp - 0x244], 1
jmp 0x1002b000
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x244], eax
jl 0x1002b017
mov dword [ebp - 0x24c], 1
jmp 0x1002b01e
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0x24c]
sub eax, dword [ebp - 0x500]
mov dword [ebp - 0x5b0], eax
jmp 0x1002acc6
push 1
push 0x7cc
push 0x255b
push 0
push 0x69b7
push 0x1074
lea eax, [ebp - 0x508]
push eax
call fcn.1002cdd3
add esp, 0x1c
jmp 0x1002ac33
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xf0]
call fcn.1001412b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d8]
call fcn.1001412b
push 2
lea ecx, [ebp - 0x458]
call fcn.100140c9
mov dword [ebp - 4], 0xb
mov dword [ebp - 0xfc], 0
jmp 0x1002b0ac
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 2
jge 0x1002b0cb
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x458]
call fcn.10014130
and dword [eax], 0
jmp 0x1002b09f
push 0
lea ecx, [ebp - 0x458]
call fcn.10014130
and dword [eax], 0
jmp 0x1002b101
push 0
lea ecx, [ebp - 0x458]
call fcn.10014130
mov dword [ebp - 0x254], eax
mov eax, dword [ebp - 0x254]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x254]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x458]
call fcn.10014130
cmp dword [eax], 0xffffffe8
jl 0x1002b384
mov dword [ebp - 0x588], 0x180c
cmp dword [ebp - 0x588], 0x992
jge 0x1002b303
lea eax, [ebp - 0x68]
push eax
push 0x1000c28c
call fcn.10050cbb
pop ecx
pop ecx
push dword [ebp - 0x68]
lea ecx, [ebp - 0x60c]
call fcn.100140c9
mov byte [ebp - 4], 0xc
and dword [ebp - 0x104], 0
jmp 0x1002b169
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x104]
cmp eax, dword [ebp - 0x68]
jge 0x1002b194
push dword [ebp - 0x104]
lea ecx, [ebp - 0x60c]
call fcn.10014130
push eax
push 0x1000c28c
call fcn.10050cbb
pop ecx
pop ecx
jmp 0x1002b15c
lea ecx, [ebp - 0x1c4]
call fcn.10041490
mov byte [ebp - 4], 0xd
and dword [ebp - 0x160], 0
jmp 0x1002b1b9
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x68]
jge 0x1002b1f2
lea eax, [ebp - 0x510]
push eax
push 0x1000c28c
call fcn.10050cbb
pop ecx
pop ecx
lea eax, [ebp - 0x510]
push eax
lea eax, [ebp - 0x760]
push eax
lea ecx, [ebp - 0x1c4]
call fcn.100414ec
jmp 0x1002b1ac
and dword [ebp - 0xa0], 0
jmp 0x1002b208
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x68]
jge 0x1002b2e5
mov esi, dword [ebp - 0x68]
shl esi, 1
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x60c]
call fcn.10014130
sub esi, dword [eax]
mov eax, esi
cdq
idiv dword [ebp - 0x68]
mov dword [ebp - 0x5b8], edx
lea eax, [ebp - 0x5b8]
push eax
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x1c4]
call fcn.10041524
lea eax, [ebp - 0x694]
push eax
lea ecx, [ebp - 0x1c4]
call fcn.10014411
push eax
lea ecx, [ebp - 0x10c]
call fcn.10016965
movzx eax, al
test eax, eax
je 0x1002b293
lea eax, [ebp - 0x740]
push eax
lea ecx, [ebp - 0x1c4]
call fcn.10041514
mov eax, dword [eax]
mov dword [ebp - 0x10c], eax
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x60c]
call fcn.10014130
mov esi, eax
lea ecx, [ebp - 0x10c]
call fcn.10014354
mov ecx, dword [esi]
add ecx, dword [eax]
mov eax, ecx
cdq
idiv dword [ebp - 0x68]
push edx
push 0x1000c2e8
call fcn.10050eef
pop ecx
pop ecx
push dword [ebp - 0x10c]
lea eax, [ebp - 0x69c]
push eax
lea ecx, [ebp - 0x1c4]
call fcn.10016720
jmp 0x1002b1fb
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1c4]
call fcn.100414c3
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x60c]
call fcn.100141a2
push 1
lea ecx, [ebp - 0x64c]
call fcn.100140c9
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x598], 0xce028f4e
mov dword [ebp - 0x518], 1
lea eax, [ebp - 0x708]
push eax
lea eax, [ebp - 0x64c]
push eax
push 0
call fcn.1002f9c3
add esp, 0xc
lea eax, [ebp - 0x64c]
push eax
push 0x33a9
push 0x591b
lea eax, [ebp - 0x518]
push eax
push 0
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x598]
push eax
call fcn.1002e0d2
add esp, 0x1c
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x64c]
call fcn.1001412b
jmp 0x1002b0dd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x458]
call fcn.1001412b
push 2
lea ecx, [ebp - 0x584]
call fcn.100140c9
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x168], 1
mov dword [ebp - 0x5c0], 1
mov dword [ebp - 0x114], 0
jmp 0x1002b3db
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 2
jge 0x1002b3fa
push dword [ebp - 0x114]
lea ecx, [ebp - 0x584]
call fcn.10014130
or dword [eax], 0xffffffff
jmp 0x1002b3ce
mov dword [ebp - 0x7c], 0
jmp 0x1002b40a
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jg 0x1002b53f
mov dword [ebp - 0x80], 0xa3399244
mov dword [ebp - 0x520], 0xfffffffc
mov byte [ebp - 0x63], 0
movzx eax, byte [ebp - 0x63]
test eax, eax
je 0x1002b44a
push 0xb43
push 0x535
push 0xd08
push 0
call fcn.1002c69d
add esp, 0x10
mov dword [ebp - 0x80], 1
jmp 0x1002b45a
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jl 0x1002b53a
mov dword [ebp - 0x25c], 0xa13b2885
push 4
lea ecx, [ebp - 0x688]
call fcn.100140c9
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x11c], 0
jmp 0x1002b498
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 4
jge 0x1002b4ba
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x688]
call fcn.10014130
mov dword [eax], 6
jmp 0x1002b48b
lea eax, [ebp - 0x584]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x25c]
push eax
push 0x4173
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x520]
push eax
push 0
lea eax, [ebp - 0x7c]
push eax
push 0x5814
call fcn.1002d667
add esp, 0x24
lea eax, [ebp - 0x584]
push eax
push 0
lea eax, [ebp - 0x80]
push eax
push 0x2fbb
push 0x2104
lea eax, [ebp - 0x688]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.1002cfc6
add esp, 0x20
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x688]
call fcn.1001412b
jmp 0x1002b453
jmp 0x1002b403
push 0x1ef4
lea eax, [ebp - 0x7c]
push eax
push 0x2297
lea eax, [ebp - 0x5c0]
push eax
lea eax, [ebp - 0x584]
push eax
lea eax, [ebp - 0x168]
push eax
push 0x57e4
push 0
call fcn.100307ff
add esp, 0x20
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x584]
call fcn.1001412b
mov dword [ebp - 0x2dc], 0
mov dword [ebp - 0x6a4], 0x1f3813bf
mov dword [ebp - 0x5dc], 0x7c6dd3ed
mov dword [ebp - 0x5d8], 0x7c6dd3ed
mov dword [ebp - 0x5d4], 0x7c6dd3ed
mov dword [ebp - 0x5d0], 0x7c6dd3ed
mov dword [ebp - 0x2f4], 0x38e5efb4
mov dword [ebp - 0x40], 0
jmp 0x1002b5d6
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1002b5ec
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x1cc], 0x3185299d
jmp 0x1002b5cf
mov dword [ebp - 0x40], 0
jmp 0x1002b5fc
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1002b612
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x6f0], 0x7649
jmp 0x1002b5f5
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1cc], 0
je 0x1002bba8
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x124], 0
jmp 0x1002b646
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 4
jge 0x1002b662
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x468], 6
jmp 0x1002b639
mov dword [ebp - 0x34], 0
jmp 0x1002b672
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jg 0x1002b9b1
push 3
lea ecx, [ebp - 0x44c]
call fcn.100140c9
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x528], 0x25eb
cmp dword [ebp - 0x528], 0x11af
jge 0x1002b731
push 0x10692e24
push 0x1000c288
call fcn.10050cbb
pop ecx
pop ecx
and dword [ebp - 0x770], 0
push 0x10692e24
mov ecx, 0x106c3cb0
call fcn.100142d6
cmp eax, 1
je 0x1002b71a
push 0x10692e24
lea eax, [ebp - 0x7c0]
push eax
mov ecx, 0x106c3cb0
call fcn.100414a5
mov eax, dword [0x10692e24]
inc eax
mov dword [0x10692e24], eax
mov eax, dword [0x10692e24]
cdq
push 0xa
pop ecx
idiv ecx
test edx, edx
jne 0x1002b718
mov eax, dword [0x10692e24]
cdq
push 0xa
pop ecx
idiv ecx
mov dword [0x10692e24], eax
jmp 0x1002b6f7
jmp 0x1002b6c2
mov ecx, 0x106c3cb0
call fcn.1001450d
push eax
push 0x1000c2c4
call fcn.10050eef
pop ecx
pop ecx
mov dword [ebp - 0x5cc], 0xff26af90
mov dword [ebp - 0x1dc], 9
mov dword [ebp - 0xc0], 0
jmp 0x1002b75e
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 3
jge 0x1002b780
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x44c]
call fcn.10014130
mov dword [eax], 0x4cdb8faa
jmp 0x1002b751
push 1
lea ecx, [ebp - 0x44c]
call fcn.10014130
and dword [eax], 0
jmp 0x1002b7b6
push 1
lea ecx, [ebp - 0x44c]
call fcn.10014130
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x264]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x264]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x44c]
call fcn.10014130
cmp dword [eax], 1
jg 0x1002b984
push 4
lea ecx, [ebp - 0x5f4]
call fcn.100140c9
mov byte [ebp - 4], 0x12
mov dword [ebp - 0xa8], 0
jmp 0x1002b7f6
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x1002b812
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x6e4], 0xffffffff
jmp 0x1002b7e9
push 0x5b00
push 0
push 0x76ee
lea eax, [ebp - 0x5f4]
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.10037a55
add esp, 0x14
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x6e4], 1
mov esi, dword [ebp - 0x5cc]
push 1
lea ecx, [ebp - 0x44c]
call fcn.10014130
cmp esi, dword [eax]
jg 0x1002b868
mov dword [ebp - 0x170], 1
jmp 0x1002b86f
and dword [ebp - 0x170], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x170]
mov dword [ebp + eax - 0x5dc], ecx
cmp dword [ebp - 0x170], 0
jne 0x1002b899
xor eax, eax
inc eax
jne 0x1002b899
and dword [ebp - 0x530], 0
jmp 0x1002b8a3
mov dword [ebp - 0x530], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cc]
mov dword [ebp - 0x6ac], eax
push 0
lea ecx, [ebp - 0x5f4]
call fcn.10014130
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp + ecx*4 - 0x1cc]
cmp dword [eax], ecx
jge 0x1002b8dd
mov dword [ebp - 0x26c], 1
jmp 0x1002b8e4
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x26c], eax
je 0x1002b8fb
mov dword [ebp - 0x274], 1
jmp 0x1002b902
and dword [ebp - 0x274], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6f0]
cmp dword [ebp - 0x274], eax
jge 0x1002b923
mov dword [ebp - 0x27c], 1
jmp 0x1002b92a
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x1cc]
cmp dword [ebp - 0x27c], eax
jle 0x1002b948
mov dword [ebp - 0x284], 1
jmp 0x1002b94f
and dword [ebp - 0x284], 0
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x1dc], eax
mov esi, dword [ebp - 0x1dc]
push 1
lea ecx, [ebp - 0x5f4]
call fcn.10014130
mov dword [eax], esi
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x5f4]
call fcn.1001412b
jmp 0x1002b792
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0x5dc]
mov dword [ebp + ecx - 0x468], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44c]
call fcn.1001412b
jmp 0x1002b66b
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x468]
cmp dword [ebp + eax - 0x468], ecx
jg 0x1002b9d9
mov dword [ebp - 0x294], 1
jmp 0x1002b9e0
and dword [ebp - 0x294], 0
cmp dword [ebp - 0x294], 8
ja 0x1002b9f5
mov dword [ebp - 0x29c], 1
jmp 0x1002b9fc
and dword [ebp - 0x29c], 0
cmp dword [ebp - 0x29c], 0xadaf
jl 0x1002ba14
mov dword [ebp - 0x2a4], 1
jmp 0x1002ba1b
and dword [ebp - 0x2a4], 0
cmp dword [ebp - 0x2a4], 0xfffffff8
jge 0x1002ba30
mov dword [ebp - 0x2ac], 1
jmp 0x1002ba37
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2dc]
cmp dword [ebp - 0x34], eax
jge 0x1002ba57
mov dword [ebp - 0x2b4], 1
jmp 0x1002ba5e
and dword [ebp - 0x2b4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x468]
cmp dword [ebp - 0x2b4], eax
jne 0x1002ba7f
mov dword [ebp - 0x2bc], 1
jmp 0x1002ba86
and dword [ebp - 0x2bc], 0
cmp dword [ebp - 0x2bc], 0xf0c0ed6d
jae 0x1002ba9e
mov dword [ebp - 0x2c4], 1
jmp 0x1002baa5
and dword [ebp - 0x2c4], 0
imul eax, dword [ebp - 0x2c4], 0xffff
add eax, dword [ebp - 0x2f4]
jne 0x1002babb
xor eax, eax
je 0x1002bacb
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x468], 0
jne 0x1002bada
cmp dword [ebp - 0x34], 0
jne 0x1002bada
and dword [ebp - 0x2cc], 0
jmp 0x1002bae4
mov dword [ebp - 0x2cc], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x468]
add eax, dword [ebp - 0x2cc]
jne 0x1002bb05
mov dword [ebp - 0x2d4], 1
jmp 0x1002bb0c
and dword [ebp - 0x2d4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x468]
cmp eax, dword [ebp - 0x2d4]
jl 0x1002bb2d
mov dword [ebp - 0x470], 1
jmp 0x1002bb34
and dword [ebp - 0x470], 0
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x710], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1cc], 9
je 0x1002bb5c
mov dword [ebp - 0x2e4], 1
jmp 0x1002bb63
and dword [ebp - 0x2e4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x468]
cmp dword [ebp - 0x2e4], eax
jge 0x1002bb8d
mov eax, 0x38db
test eax, eax
je 0x1002bb8d
mov dword [ebp - 0x2ec], 1
jmp 0x1002bb94
and dword [ebp - 0x2ec], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2ec]
mov dword [ebp + eax - 0x5dc], ecx
jmp 0x1002bbe9
mov dword [ebp - 0x474], 8
mov eax, dword [ebp - 0x2f4]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x1cc]
test eax, eax
jge 0x1002bbd6
mov dword [ebp - 0x2fc], 1
jmp 0x1002bbdd
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xcc]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x4c], eax
push 1
lea ecx, [ebp - 0x664]
call fcn.100140c9
mov dword [ebp - 4], 0x13
mov dword [ebp - 0x62c], 9
mov dword [ebp - 0x628], 9
mov dword [ebp - 0x624], 9
mov dword [ebp - 0x620], 9
lea ecx, [ebp - 0x18d]
call fcn.1001413f
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x7b8]
call fcn.10014142
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x594]
call fcn.10014105
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x47c], 1
mov dword [ebp - 0x484], 0xffffffff
mov dword [ebp - 0x48c], 0x223fa3a9
lea eax, [ebp - 0x6b4]
push eax
push 0
lea eax, [ebp - 0x664]
push eax
call fcn.1002cd16
add esp, 0xc
mov byte [ebp - 0x69], 0
push 0x5510
push 0x5b9e
push 0x457c
push 0x4bc2
push 0x7aa8
push 1
push 0x7a91
push 0x541f
push 1
lea eax, [ebp - 0x69]
push eax
call fcn.100285c3
add esp, 0x28
push 0
lea ecx, [ebp - 0x594]
call fcn.10014130
and dword [eax], 0
jmp 0x1002bd1c
push 0
lea ecx, [ebp - 0x594]
call fcn.10014130
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x304]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x304]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x594]
call fcn.10014130
cmp dword [eax], 0
jg 0x1002bd62
lea eax, [ebp - 0x664]
push eax
push 0x1abb
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x594]
push eax
lea eax, [ebp - 0x484]
push eax
push 0
lea eax, [ebp - 0x48c]
push eax
call fcn.1003cedd
add esp, 0x1c
jmp 0x1002bcf8
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x594]
call fcn.1001412b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x664]
call fcn.1001412b
mov dword [ebp - 0x70], 0xf5540d7f
push 1
lea ecx, [ebp - 0x1bc]
call fcn.100140c9
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x374], 9
mov dword [ebp - 0x3b0], 0x6158e9d2
mov dword [ebp - 0xc4], 0
jmp 0x1002bdc8
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 1
jge 0x1002bdea
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x1bc]
call fcn.10014130
mov dword [eax], 1
jmp 0x1002bdbb
mov dword [ebp - 0x70], 0
jmp 0x1002bdfa
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xffffffe4
je 0x1002c1e1
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x49c], 0xe56a96da
mov dword [ebp - 0x1c], 0
jmp 0x1002be25
cmp dword [ebp - 0x1c], 0
jl 0x1002c1dc
mov dword [ebp - 0x35c], 0xdd8607f4
mov dword [ebp - 0x3b8], 0
mov dword [ebp - 0x48], 0
jmp 0x1002be53
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x1002be69
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x404], 4
jmp 0x1002be4c
mov dword [ebp - 0x48], 0
jmp 0x1002be79
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x1002be8f
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x494], 0x80dda259
jmp 0x1002be72
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1bc]
call fcn.10014130
mov esi, eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1bc]
call fcn.10014130
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x1002bebf
mov dword [ebp - 0x34c], 1
jmp 0x1002bec6
and dword [ebp - 0x34c], 0
cmp dword [ebp - 0x1c], 0xb444
je 0x1002bedb
mov dword [ebp - 0x30c], 1
jmp 0x1002bee2
and dword [ebp - 0x30c], 0
cmp dword [ebp - 0x30c], 0xc254e7f1
je 0x1002befa
mov dword [ebp - 0x314], 1
jmp 0x1002bf01
and dword [ebp - 0x314], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x404]
cmp eax, dword [ebp - 0x314]
jg 0x1002bf22
mov dword [ebp - 0x31c], 1
jmp 0x1002bf29
and dword [ebp - 0x31c], 0
push 0
lea ecx, [ebp - 0x1bc]
call fcn.10014130
mov ecx, dword [ebp - 0x31c]
cmp ecx, dword [eax]
jge 0x1002bf4c
mov dword [ebp - 0x324], 1
jmp 0x1002bf53
and dword [ebp - 0x324], 0
cmp dword [ebp - 0x324], 0x723
je 0x1002bf6b
mov dword [ebp - 0x32c], 1
jmp 0x1002bf72
and dword [ebp - 0x32c], 0
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1bc]
call fcn.10014130
mov ecx, dword [ebp - 0x32c]
cmp ecx, dword [eax]
jle 0x1002bf96
mov dword [ebp - 0x334], 1
jmp 0x1002bf9d
and dword [ebp - 0x334], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x404]
cmp dword [ebp - 0x334], eax
jne 0x1002bfbe
mov dword [ebp - 0x33c], 1
jmp 0x1002bfc5
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x35c]
imul eax, dword [ebp - 0x33c]
cmp eax, dword [ebp - 0x1c]
je 0x1002bfe3
mov dword [ebp - 0x344], 1
jmp 0x1002bfea
and dword [ebp - 0x344], 0
push 0
lea ecx, [ebp - 0x1bc]
call fcn.10014130
mov ecx, dword [ebp - 0x344]
add ecx, dword [eax]
mov eax, dword [ebp - 0x34c]
sub eax, ecx
sub eax, 6
jne 0x1002c01e
mov eax, 0xc09
test eax, eax
jne 0x1002c01e
mov dword [ebp - 0x354], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x404]
cmp dword [ebp - 0x354], eax
jle 0x1002c049
jmp 0x1002bdf3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1bc]
call fcn.1001412b
and dword [ebp - 0x180], 0
jmp 0x1002c20f
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x4c]
add eax, 0x28
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0xcc]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x180], eax
jge 0x1002c52d
mov dword [ebp - 0x4a4], 0x64a6847d
mov dword [ebp - 0x4ac], 0xbfa32a17
mov dword [ebp - 0x4b4], 0xffffffff
mov byte [ebp - 0x62], 0
lea eax, [ebp - 0x62]
push eax
push 1
push 0
push 1
push 0x5d1
push 0x6226
call fcn.1003d21c
add esp, 0x18
push 0x7ca1
push 1
lea eax, [ebp - 0x4a4]
push eax
push 1
lea eax, [ebp - 0x4ac]
push eax
push 0x484a
lea eax, [ebp - 0x4b4]
push eax
call fcn.100287d4
add esp, 0x1c
mov eax, dword [ebp - 0x4c]
cmp dword [eax + 0x10], 0
jne 0x1002c397
mov dword [ebp - 0x4cc], 0xfffffffd
mov dword [ebp - 0x4d4], 0xba4d
mov dword [ebp - 0x4bc], 0xfffffff7
mov dword [ebp - 0x4c4], 0xffffffff
push 1
push 0x95f
push 1
push 0x786d
lea eax, [ebp - 0x4bc]
push eax
lea eax, [ebp - 0x4c4]
push eax
push 0x65e6
lea eax, [ebp - 0x4cc]
push eax
push 0x3895
push 0x5df5
lea eax, [ebp - 0x4d4]
push eax
push 0
call fcn.10039f72
add esp, 0x30
lea eax, [ebp - 0x3c8]
push eax
push 0x5a36
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0x625d
push 0x3ece
call fcn.10040ee5
add esp, 0x20
mov dword [ebp - 0xb0], 0x8c6a53d0
mov dword [ebp - 0xb0], 0xfffffffa
jmp 0x1002c35d
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 4
jl 0x1002c392
mov dword [ebp - 0x4e4], 0xffffffff
push 0
push 0x2f5b
push 0x393
call fcn.1003a322
add esp, 0xc
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x4e4], eax
jmp 0x1002c350
jmp 0x1002c1f9
mov dword [ebp - 0xdc], 0xe1757117
push 2
lea ecx, [ebp - 0x67c]
call fcn.100140c9
mov dword [ebp - 4], 0x16
mov dword [ebp - 0x4ec], 0xee4e9120
mov dword [ebp - 0xd4], 0
jmp 0x1002c3d8
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 2
jge 0x1002c3fa
push dword [ebp - 0xd4]
lea ecx, [ebp - 0x67c]
call fcn.10014130
mov dword [eax], 0x245f
jmp 0x1002c3cb
mov dword [ebp - 0xdc], 8
jmp 0x1002c413
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0x12
jle 0x1002c4ab
mov dword [ebp - 0x88], 0x2c0d37ad
lea eax, [ebp - 0x67c]
push eax
push 1
push 0x9ff
lea eax, [ebp - 0x88]
push eax
push 1
push 0x133c
push 1
push 0x52b0
push 0x72b5
call fcn.1002898d
add esp, 0x24
mov dword [ebp - 0x88], 1
jmp 0x1002c473
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jl 0x1002c4a6
cmp dword [ebp - 0x88], 0
jl 0x1002c491
mov dword [ebp - 0x3c0], 1
jmp 0x1002c498
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x4ec], eax
jmp 0x1002c466
jmp 0x1002c406
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x67c]
call fcn.1001412b
push 4
push 0x1000
mov eax, dword [ebp - 0x4c]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x3c8]
add ecx, dword [eax + 0xc]
push ecx
push 0xc951
push 0xd527
call fcn.100131e6
pop ecx
pop ecx
call eax
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x4c]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x4f4]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x188]
call fcn.10013872
add esp, 0xc
push 0
lea eax, [ebp - 0x4c]
push eax
push 0x788
lea eax, [ebp - 0x188]
push eax
call fcn.1003b369
add esp, 0x10
jmp 0x1002c1f9
jmp 0x1002c558
mov eax, dword [ebp - 0x4fc]
mov dword [ebp - 0x504], eax
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x3d0], eax
mov eax, dword [ebp - 0x3d0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x3d0]
mov dword [ecx], eax
jmp 0x1002c56e
push 0
push 0x32fd
push 0x14f6
call fcn.10039aae
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret