Function at 0x1003f827
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Enumerate pe sections
Get common file path
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007d827
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb4c
push esi
and dword [ebp - 0x14], 0
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10044753
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], 0xd1e1e87d
mov dword [ebp - 0x2e0], 0x4b28ed4a
mov dword [ebp - 0x280], 0x9e149cff
mov dword [ebp - 0x6e8], 0x5653649d
mov dword [ebp - 0x278], 0
jmp 0x1003f89a
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 3
jge 0x1003f8b6
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0x190], 0xfffffffd
jmp 0x1003f88d
mov dword [ebp - 0x1c], 0
jmp 0x1003f8c6
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x1003fd42
mov dword [ebp - 0x89c], 0x5cc99cf4
mov dword [ebp - 0x92c], 0xe67b33df
mov dword [ebp - 0x9a4], 0x5d09421a
mov dword [ebp - 0x934], 0xf20cf680
mov dword [ebp - 0x9f0], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x190], 0xe5c285ce
ja 0x1003f928
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x190], 0
jne 0x1003f928
and dword [ebp - 0x394], 0
jmp 0x1003f932
mov dword [ebp - 0x394], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x190]
cmp dword [ebp - 0x394], eax
jne 0x1003f953
mov dword [ebp - 0x5e4], 1
jmp 0x1003f95a
and dword [ebp - 0x5e4], 0
cmp dword [ebp - 0x5e4], 0xfffb
jbe 0x1003f972
mov dword [ebp - 0x5ec], 1
jmp 0x1003f979
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0x2e0], eax
mov eax, dword [ebp - 0x2e0]
dec eax
mov ecx, dword [ebp - 0x1c]
cmp eax, dword [ebp + ecx*4 - 0x190]
jge 0x1003f9a4
mov dword [ebp - 0x63c], 1
jmp 0x1003f9ab
and dword [ebp - 0x63c], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x190]
sub eax, dword [ebp - 0x63c]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0x190], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x190], 0xb541
jne 0x1003fd2e
mov dword [ebp - 0x71c], 3
mov dword [ebp - 0x348], 0xfffffffe
mov dword [ebp - 0x4d0], 0xf6a91a76
mov dword [ebp - 0x93c], 0xffffffff
mov dword [ebp - 0x9ac], 0xffffffff
mov dword [ebp - 0x944], 0x21a16747
mov dword [ebp - 0x9cc], 0x767a065b
mov dword [ebp - 0x590], 0
mov dword [ebp - 0x58], 0
jmp 0x1003fa39
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1003fa4f
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x178], 0xffffffff
jmp 0x1003fa32
mov dword [ebp - 0x58], 0
jmp 0x1003fa5f
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x1003fa75
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x94c], 0x506ee4f1
jmp 0x1003fa58
cmp dword [ebp - 0x280], 0
jne 0x1003fb81
mov eax, dword [ebp - 0x71c]
mov dword [ebp - 0x9b4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x178], 0
jg 0x1003faaa
mov dword [ebp - 0x638], 1
jmp 0x1003fab1
and dword [ebp - 0x638], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x178]
cmp dword [ebp - 0x638], eax
jne 0x1003fad2
mov dword [ebp - 0x6e0], 1
jmp 0x1003fad9
and dword [ebp - 0x6e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x178]
mov dword [ebp - 0x8b8], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x190]
cmp dword [ebp - 0x6e8], eax
jl 0x1003fb0a
mov dword [ebp - 0x61c], 1
jmp 0x1003fb11
and dword [ebp - 0x61c], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x190]
cmp dword [ebp - 0x61c], eax
jne 0x1003fb2f
mov dword [ebp - 0x6f0], 1
jmp 0x1003fb36
and dword [ebp - 0x6f0], 0
mov eax, 0x6ad9
imul eax, eax, 0x45cb
mov ecx, dword [ebp - 0x1c]
cmp eax, dword [ebp + ecx*4 - 0x190]
jne 0x1003fb59
mov dword [ebp - 0x628], 1
jmp 0x1003fb60
and dword [ebp - 0x628], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x628]
sub ecx, dword [ebp + eax*4 - 0x190]
mov dword [ebp - 0x280], ecx
jne 0x1003fb81
and dword [ebp - 0x5dc], 0
jmp 0x1003fb8b
mov dword [ebp - 0x5dc], 1
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0x348], eax
or eax, 0xffffffff
sub eax, dword [ebp - 0x348]
je 0x1003fbb7
cmp dword [ebp - 0x280], 0
je 0x1003fbb7
mov dword [ebp - 0x4c8], 1
jmp 0x1003fbbe
and dword [ebp - 0x4c8], 0
cmp dword [ebp - 0x4c8], 0xffffffff
je 0x1003fbd3
mov dword [ebp - 0x350], 1
jmp 0x1003fbda
and dword [ebp - 0x350], 0
cmp dword [ebp - 0x350], 1
jle 0x1003fbef
mov dword [ebp - 0x588], 1
jmp 0x1003fbf6
and dword [ebp - 0x588], 0
cmp dword [ebp - 0x588], 0
jne 0x1003fc15
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x190], 0
jne 0x1003fc15
and dword [ebp - 0x358], 0
jmp 0x1003fc1f
mov dword [ebp - 0x358], 1
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0x4d0], eax
cmp dword [ebp - 0x4d0], 0
je 0x1003fc47
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x1003fc47
mov dword [ebp - 0x360], 1
jmp 0x1003fc4e
and dword [ebp - 0x360], 0
cmp dword [ebp - 0x360], 7
jg 0x1003fc63
mov dword [ebp - 0x5e8], 1
jmp 0x1003fc6a
and dword [ebp - 0x5e8], 0
mov eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0x5e8], eax
je 0x1003fc84
mov dword [ebp - 0x368], 1
jmp 0x1003fc8b
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x190]
imul eax, dword [ebp - 0x368]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x178]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x178]
sub eax, 0x559c
je 0x1003fcd2
push 9
pop eax
test eax, eax
je 0x1003fcd2
mov dword [ebp - 0x4d8], 1
jmp 0x1003fcd9
and dword [ebp - 0x4d8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x190]
cmp eax, dword [ebp - 0x4d8]
jle 0x1003fd06
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x190], 0
je 0x1003fd06
mov dword [ebp - 0x370], 1
jmp 0x1003fd0d
and dword [ebp - 0x370], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x370]
mov dword [ebp + eax - 0x190], ecx
mov eax, dword [ebp - 0x590]
inc eax
mov dword [ebp - 0x590], eax
jmp 0x1003fd3d
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x190], 0
je 0x1003fd3d
jmp 0x1003fd42
jmp 0x1003f8bf
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x398], eax
mov dword [ebp - 0x310], 0x2c213532
mov dword [ebp - 0x114], 0xedad
mov dword [ebp - 0x318], 1
mov dword [ebp - 0x288], 0
jmp 0x1003fd82
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 1
jge 0x1003fd9e
mov eax, dword [ebp - 0x288]
mov dword [ebp + eax*4 - 0x598], 0x45d764ce
jmp 0x1003fd75
cmp dword [ebp - 0x310], 0
je 0x1003fdf2
push 1
push 0x54e8
call fcn.1003eaba
pop ecx
pop ecx
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x1003fded
push 0
push 0
push 0
push 0xcf7
push 0x177
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
jmp 0x1003ffd8
mov dword [ebp - 0x24], 0xf3ac9d73
mov eax, dword [ebp - 0x310]
cmp dword [ebp - 0x114], eax
jle 0x1003fe13
mov dword [ebp - 0x378], 1
jmp 0x1003fe1a
and dword [ebp - 0x378], 0
cmp dword [ebp - 0x378], 0xffffffff
je 0x1003fe2f
mov dword [ebp - 0x4e0], 1
jmp 0x1003fe36
and dword [ebp - 0x4e0], 0
mov eax, 0x842f
sub eax, dword [ebp - 0x24]
jne 0x1003fe4f
cmp dword [ebp - 0x24], 0
jne 0x1003fe4f
and dword [ebp - 0x380], 0
jmp 0x1003fe59
mov dword [ebp - 0x380], 1
mov eax, dword [ebp - 0x4e0]
add eax, dword [ebp - 0x380]
je 0x1003fe79
cmp dword [ebp - 0x24], 0
je 0x1003fe79
mov dword [ebp - 0x624], 1
jmp 0x1003fe80
and dword [ebp - 0x624], 0
mov eax, dword [ebp - 0x318]
cmp dword [ebp - 0x624], eax
jne 0x1003fe9a
mov dword [ebp - 0x388], 1
jmp 0x1003fea1
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x388], eax
jl 0x1003feb8
mov dword [ebp - 0x4e8], 1
jmp 0x1003febf
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0x4e8]
imul eax, dword [ebp - 0x24]
mov dword [ebp - 0x6f8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x6f8]
mov dword [ebp + eax - 0x598], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x8c0], eax
mov eax, dword [ebp - 0x318]
add eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jle 0x1003ff05
mov dword [ebp - 0x390], 1
jmp 0x1003ff0c
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x310]
cmp dword [ebp - 0x390], eax
jne 0x1003ff1e
cmp dword [ebp - 0x24], 0
xor eax, eax
sub eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
je 0x1003ff53
mov byte [ebp - 0x10e], 0
movzx eax, byte [ebp - 0x10e]
test eax, eax
je 0x1003ff4e
push 0x618c
push 0x7f33
push 0
call fcn.1003ef38
add esp, 0xc
jmp 0x1003ffd8
mov dword [ebp - 0x24], 0xfffffff5
jmp 0x1003ff63
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x27
je 0x1003ffd8
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x318], eax
jl 0x1003ffab
mov dword [ebp - 0x114], 0
jmp 0x1003ff8d
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 1
jge 0x1003ffa9
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x598], 2
jmp 0x1003ff80
jmp 0x1003ffd6
mov byte [ebp - 0xc5], 0
movzx eax, byte [ebp - 0xc5]
test eax, eax
je 0x1003ffd6
push 0x37be
push 0x261c
push 0xd2a
push 0
call fcn.1003f4fb
add esp, 0x10
jmp 0x1003ff5c
mov eax, dword [ebp - 0x398]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1003ffed
jmp 0x10044764
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x138], 0x4bcd76ce
mov dword [ebp - 0x14c], 7
mov dword [ebp - 0x700], 0xfffffffc
mov dword [ebp - 0x878], 2
mov dword [ebp - 0x874], 2
mov dword [ebp - 0x870], 2
mov dword [ebp - 0x86c], 2
push 0x550a
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x700]
push eax
push 0
call fcn.1003f3e3
add esp, 0x18
mov dword [ebp - 0x140], 0
jmp 0x10040081
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 3
jg 0x10040129
mov dword [ebp - 0x708], 0xffffffff
mov dword [ebp - 0x14c], 0
jmp 0x100400b1
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 3
jg 0x10040119
mov dword [ebp - 0x138], 0
jmp 0x100400d3
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 4
jge 0x100400ef
mov eax, dword [ebp - 0x138]
mov dword [ebp + eax*4 - 0x878], 7
jmp 0x100400c6
mov byte [ebp - 0x108], 0
movzx eax, byte [ebp - 0x108]
test eax, eax
je 0x10040117
push 0
push 0
push 0x865
push 0x2376
push 0
call dword [sym.imp.USER32.dll_ModifyMenuW]
jmp 0x100400a4
cmp dword [ebp - 0x708], 0
je 0x10040124
jmp 0x10040129
jmp 0x10040074
mov eax, dword [ebp - 0x398]
mov ecx, dword [ebp - 0x2c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xb4], ecx
mov eax, dword [ebp - 0xb4]
cmp dword [eax], 0x4550
je 0x1004014e
jmp 0x10044764
mov dword [ebp - 0x8c8], 1
push 0
push 0x6932
call fcn.1003f0e3
pop ecx
pop ecx
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x10040180
push 0
call fcn.1003eaf5
pop ecx
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb4]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x890], 1
mov dword [ebp - 0x4f0], 1
mov dword [ebp - 0x3c], 0
jmp 0x100401b7
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x100401cd
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xa50], 0x5b57
jmp 0x100401b0
mov dword [ebp - 0x3c], 0
jmp 0x100401dd
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x100401f3
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x290], 0xc184c506
jmp 0x100401d6
mov dword [ebp - 0x3c], 0
jmp 0x10040203
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 4
jge 0x10040219
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0xb58], 1
jmp 0x100401fc
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x290], 0
jmp 0x10040247
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x290]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x290], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x290], 1
jg 0x100402b9
mov dword [ebp - 0x8f8], 0xcc25fa5f
mov dword [ebp - 0x900], 0x65925ef2
mov dword [ebp - 0x908], 0
mov dword [ebp - 0x910], 0xffffffff
mov dword [ebp - 0x918], 0xfffffffa
mov dword [ebp - 0x920], 0
mov dword [ebp - 0x928], 0xd7c6ae49
mov dword [ebp - 0x930], 0xd1dc6b79
mov eax, dword [ebp - 0x4f0]
inc eax
mov dword [ebp - 0x4f0], eax
jmp 0x1004022c
mov eax, dword [ebp - 0x50]
cmp dword [eax + 4], 0
jne 0x100402c7
jmp 0x10044764
mov dword [ebp - 0x938], 1
mov byte [ebp - 0x10c], 0
movzx eax, byte [ebp - 0x10c]
test eax, eax
je 0x100402f2
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x1004030c
push 1
call fcn.1003eaf5
pop ecx
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 0xb4]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0xb4]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0x128], eax
push 0x5258
push 0
call fcn.1003f246
pop ecx
pop ecx
and dword [ebp - 0x320], 0
jmp 0x1004035d
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x128]
add eax, 0x28
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0xb4]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x320], eax
jge 0x100403d9
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x3a0]
jb 0x100403d4
mov eax, dword [ebp - 0xb4]
push dword [eax + 0x38]
mov eax, dword [ebp - 0x128]
push dword [eax + 8]
call fcn.1003e8dc
pop ecx
pop ecx
add eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x710], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x710]
jae 0x100403d4
push 1
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.1003eb2c
add esp, 0xc
jmp 0x100403d9
jmp 0x10040341
mov dword [ebp - 0x81c], 0x1813f1a0
mov dword [ebp - 0x818], 0x1813f1a0
mov dword [ebp - 0x814], 0x1813f1a0
mov dword [ebp - 0x810], 0x1813f1a0
mov dword [ebp - 0x3b8], 0x2b96ce02
mov dword [ebp - 0x750], 0xfffffff7
mov dword [ebp - 0x758], 1
mov dword [ebp - 0x70], 0
jmp 0x1004042f
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x10040445
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x80c], 0xeb71
jmp 0x10040428
mov dword [ebp - 0x70], 0
jmp 0x10040455
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 3
jge 0x1004046b
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0xa0c], 0x4df6f978
jmp 0x1004044e
mov eax, 0xfff7
test eax, eax
je 0x1004049a
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x80c]
mov dword [ebp - 0x5f0], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x5f0]
mov dword [ebp + eax - 0x81c], ecx
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x81c], 0
jne 0x100404b6
mov dword [ebp - 0x3a8], 1
jmp 0x100404bd
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a8]
neg eax
je 0x100404dc
mov eax, 0x15aa
test eax, eax
je 0x100404dc
mov dword [ebp - 0x4f8], 1
jmp 0x100404e3
and dword [ebp - 0x4f8], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xa0c], 1
cmp dword [ebp - 0x4f8], 1
jg 0x10040509
mov dword [ebp - 0x3b0], 1
jmp 0x10040510
and dword [ebp - 0x3b0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x80c]
cmp dword [ebp - 0x3b0], eax
jl 0x10040531
mov dword [ebp - 0x5a0], 1
jmp 0x10040538
and dword [ebp - 0x5a0], 0
mov eax, dword [ebp - 0x5a0]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x750]
cmp dword [ebp - 0x3b8], eax
jne 0x1004055e
mov dword [ebp - 0x500], 1
jmp 0x10040565
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x500]
mov dword [ebp - 0x758], eax
cmp dword [ebp - 0x34], 0
jne 0x1004057c
jmp 0x10044764
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x34]
add ecx, dword [eax]
add ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
xor ecx, ecx
call fcn.1002c4fd
push eax
call fcn.10064758
pop ecx
mov dword [ebp - 0x24c], 0x2e91a04
mov dword [ebp - 0x1fc], 0x8dee21af
mov dword [ebp - 0x174], 0xfffffffb
mov dword [ebp - 0x6c], 0
jmp 0x100405c6
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x100405dc
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x760], 0x4edf0ebf
jmp 0x100405bf
mov dword [ebp - 0x6c], 0
jmp 0x100405ec
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x10040602
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x258], 0x8716b5b3
jmp 0x100405e5
mov dword [ebp - 0x24c], 0xfffffff9
jmp 0x1004061b
mov eax, dword [ebp - 0x24c]
dec eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0xfffffff4
jg 0x10040775
mov dword [ebp - 0x120], 0xffffffff
cmp dword [ebp - 0x1fc], 0xb64fda7e
je 0x1004064a
mov dword [ebp - 0x62c], 1
jmp 0x10040651
and dword [ebp - 0x62c], 0
mov eax, dword [ebp - 0x1fc]
sub eax, 0x13e19f23
cmp eax, dword [ebp - 0x120]
jle 0x10040670
mov dword [ebp - 0x3c0], 1
jmp 0x10040677
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x3c0]
jg 0x10040691
mov dword [ebp - 0x254], 1
jmp 0x10040698
and dword [ebp - 0x254], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x254]
mov dword [ebp + eax - 0x760], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x254]
mov dword [ebp + eax - 0x258], ecx
cmp dword [ebp - 0x254], 0
jne 0x100406d9
cmp dword [ebp - 0x120], 0
jne 0x100406d9
and dword [ebp - 0x3c8], 0
jmp 0x100406e3
mov dword [ebp - 0x3c8], 1
mov eax, dword [ebp - 0x62c]
sub eax, dword [ebp - 0x3c8]
cmp eax, 0x55cc
jg 0x10040702
mov dword [ebp - 0x508], 1
jmp 0x10040709
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0x1fc]
cmp dword [ebp - 0x508], eax
je 0x10040723
mov dword [ebp - 0x3d0], 1
jmp 0x1004072a
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x3d0], eax
jl 0x10040744
mov dword [ebp - 0x5a8], 1
jmp 0x1004074b
and dword [ebp - 0x5a8], 0
mov eax, dword [ebp - 0x5a8]
sub eax, dword [ebp - 0x120]
imul eax, dword [ebp - 0x1fc]
add eax, dword [ebp - 0x120]
imul eax, eax, 0xe215
mov dword [ebp - 0x120], eax
jmp 0x1004060e
mov dword [ebp - 0x174], 0xffffffec
jmp 0x1004078e
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0x3a
je 0x100408a4
mov dword [ebp - 0x8c], 0
jmp 0x100407b4
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x100407d0
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x510], 0xffffffff
jmp 0x100407a7
mov dword [ebp - 0x8c], 0
jmp 0x100407e9
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 2
jge 0x10040805
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x898], 0xda87b8b0
jmp 0x100407dc
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x258]
mov dword [ebp - 0x3d8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3d8]
mov dword [ebp + eax - 0x258], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3d8]
mov dword [ebp + eax - 0x510], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x510], 0
je 0x10040882
mov dword [ebp - 0x768], 1
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x258], 0xb83e
imul eax, dword [ebp - 0x768], 0xb83e
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x898], eax
jmp 0x1004089f
mov byte [ebp - 0x10a], 0
lea eax, [ebp - 0x10a]
push eax
push 0
push 0x10e
call fcn.1003f046
add esp, 0xc
jmp 0x10040781
mov byte [ebp - 0x1f0], 7
mov byte [ebp - 0x1ef], 0x1a
mov byte [ebp - 0x1ee], 6
mov byte [ebp - 0x1ed], 7
mov byte [ebp - 0x1ec], 2
mov byte [ebp - 0x1eb], 6
mov byte [ebp - 0x1ea], 5
mov byte [ebp - 0x1e9], 6
mov byte [ebp - 0x1e8], 9
mov byte [ebp - 0x1e7], 1
mov byte [ebp - 0x1e6], 3
mov byte [ebp - 0x1e5], 7
mov byte [ebp - 0x1e4], 8
mov byte [ebp - 0x1e3], 7
mov byte [ebp - 0x1e2], 1
mov byte [ebp - 0x1e1], 5
mov byte [ebp - 0x1e0], 0x18
mov byte [ebp - 0x1df], 0x46
mov byte [ebp - 0x1de], 0xbe
mov byte [ebp - 0x1dd], 6
mov byte [ebp - 0x1dc], 0xc2
mov byte [ebp - 0x1db], 0x9f
mov byte [ebp - 0x1da], 0x29
mov byte [ebp - 0x1d9], 0x6a
mov byte [ebp - 0x1d8], 0x12
mov byte [ebp - 0x1d7], 0x94
mov byte [ebp - 0x1d6], 0x25
mov byte [ebp - 0x1d5], 0xd5
mov byte [ebp - 0x1d4], 0x67
mov byte [ebp - 0x1d3], 0x26
mov byte [ebp - 0x1d2], 0x3d
mov byte [ebp - 0x1d1], 0x3a
mov byte [ebp - 0x1d0], 8
mov byte [ebp - 0x1cf], 0xf7
mov byte [ebp - 0x1ce], 0xd8
mov byte [ebp - 0x1cd], 0xa5
mov byte [ebp - 0x1cc], 0xa6
mov byte [ebp - 0x1cb], 0x93
mov byte [ebp - 0x1ca], 0x42
mov byte [ebp - 0x1c9], 0xd3
mov byte [ebp - 0x1c8], 0xf
mov byte [ebp - 0x1c7], 4
mov byte [ebp - 0x1c6], 0xd
mov byte [ebp - 0x1c5], 0
mov byte [ebp - 0x1c4], 9
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x1f0]
or eax, 0x2c
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x1f0]
and ecx, 0x2c
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x1f0]
mov byte [ebp + ecx - 0x648], al
mov dword [ebp - 0x30], 2
and dword [ebp - 0x154], 0
jmp 0x10040a30
mov eax, dword [ebp - 0x30]
inc eax
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x2d
jae 0x10040b0e
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x1f0]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x30], eax
jne 0x10040a7a
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x1f0]
inc eax
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x1f0]
mov ecx, dword [ebp - 0x30]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x30], eax
jmp 0x10040a28
mov eax, dword [ebp - 0x30]
movzx eax, byte [ebp + eax - 0x1ef]
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x154]
movzx ecx, byte [ebp + ecx - 0x1f2]
movsx ecx, byte [ebp + ecx - 0x648]
add eax, ecx
mov ecx, dword [ebp - 0x30]
movzx ecx, byte [ebp + ecx - 0x1ef]
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x154]
movzx edx, byte [ebp + edx - 0x1f2]
movsx edx, byte [ebp + edx - 0x648]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x30]
movzx ecx, byte [ebp + ecx - 0x1ef]
mov edx, dword [ebp - 0x30]
sub edx, dword [ebp - 0x154]
movzx edx, byte [ebp + edx - 0x1f2]
movsx edx, byte [ebp + edx - 0x648]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x30]
movzx ecx, byte [ebp + ecx - 0x1f0]
mov byte [ebp + ecx - 0x648], al
and dword [ebp - 0x154], 0
jmp 0x10040a28
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x648], 0
mov dword [ebp - 0x260], 0x5299dada
mov dword [ebp - 0x7b4], 1
mov dword [ebp - 0x3e0], 0
mov dword [ebp - 0x204], 0
jmp 0x10040b53
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 1
jge 0x10040b6f
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0x940], 1
jmp 0x10040b46
mov dword [ebp - 0x260], 0
jmp 0x10040b88
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0
jg 0x10040bba
mov dword [ebp - 0x674], 0
lea eax, [ebp - 0x7b4]
push eax
push 0
push 0x7d3d
lea eax, [ebp - 0x674]
push eax
call fcn.1003ef8d
add esp, 0x10
jmp 0x10040b7b
mov eax, dword [ebp - 0x3e0]
inc eax
mov dword [ebp - 0x3e0], eax
lea eax, [ebp - 0x648]
push eax
lea ecx, [ebp - 0xb18]
call fcn.10022e2c
mov dword [ebp - 0x67c], eax
mov eax, dword [ebp - 0x67c]
mov dword [ebp - 0x6d8], eax
and dword [ebp - 4], 0
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x6d8]
call fcn.1002c4bd
pop ecx
mov dword [ebp - 0x694], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb18]
call fcn.100156a4
mov dword [ebp - 0x74], 0
jmp 0x10040c24
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 4
jge 0x10040c3a
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x9e4], 0xfffc
jmp 0x10040c1d
mov dword [ebp - 0x74], 0
jmp 0x10040c4a
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x10040c60
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x778], 0xffffffff
jmp 0x10040c43
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x9e4]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x9e4], eax
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x778], 0
jmp 0x10040ca4
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x778]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x778], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x778], 4
jge 0x10040ccc
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x778]
mov dword [ebp + eax*4 - 0x9e4], 0xf428
jmp 0x10040c8b
and dword [ebp - 0x20c], 0
jmp 0x10040ce2
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0xb
jae 0x10040cfb
mov eax, dword [ebp - 0x20c]
mov byte [ebp + eax - 0x648], 0
jmp 0x10040cd5
mov dword [ebp - 0x834], 0xffffffff
mov dword [ebp - 0x830], 0xffffffff
mov dword [ebp - 0x82c], 0xffffffff
mov dword [ebp - 0x828], 0xffffffff
mov dword [ebp - 0x948], 1
mov dword [ebp - 0x950], 0x4b811476
mov dword [ebp - 0x958], 0xac54c975
mov dword [ebp - 0x38], 0
jmp 0x10040d51
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jge 0x10040d67
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x9b0], 0xfffffffa
jmp 0x10040d4a
mov dword [ebp - 0x38], 0
jmp 0x10040d77
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x10040d8d
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xb24], 1
jmp 0x10040d70
mov dword [ebp - 0x38], 0
jmp 0x10040d9d
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x10040db3
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xa00], 0x71b35d56
jmp 0x10040d96
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x834]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x834], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa00]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xa00], eax
mov byte [ebp - 0x2dc], 2
mov byte [ebp - 0x2db], 0x11
mov byte [ebp - 0x2da], 4
mov byte [ebp - 0x2d9], 3
mov byte [ebp - 0x2d8], 1
mov byte [ebp - 0x2d7], 2
mov byte [ebp - 0x2d6], 0x35
mov byte [ebp - 0x2d5], 0x8c
mov byte [ebp - 0x2d4], 0xac
mov byte [ebp - 0x2d3], 0x47
mov byte [ebp - 0x2d2], 0xf5
mov byte [ebp - 0x2d1], 0x6a
mov byte [ebp - 0x2d0], 0xcc
mov byte [ebp - 0x2cf], 0x64
mov byte [ebp - 0x2ce], 0x36
mov byte [ebp - 0x2cd], 0x35
mov byte [ebp - 0x2cc], 0x5c
mov byte [ebp - 0x2cb], 0xb2
mov byte [ebp - 0x2ca], 0x7e
mov byte [ebp - 0x2c9], 0xd7
mov byte [ebp - 0x2c8], 0xca
mov byte [ebp - 0x2c7], 0x8e
mov byte [ebp - 0x2c6], 0xe6
mov byte [ebp - 0x2c5], 0xbd
mov byte [ebp - 0x2c4], 0x77
mov byte [ebp - 0x2c3], 0x3b
mov byte [ebp - 0x2c2], 0x50
mov byte [ebp - 0x2c1], 0x8e
mov byte [ebp - 0x2c0], 0xce
mov byte [ebp - 0x2bf], 0xf
mov byte [ebp - 0x2be], 0xa5
mov byte [ebp - 0x2bd], 0x75
mov byte [ebp - 0x2bc], 0x3f
mov byte [ebp - 0x2bb], 0x26
mov byte [ebp - 0x2ba], 0xa0
mov byte [ebp - 0x2b9], 0x6e
mov byte [ebp - 0x2b8], 0xa9
mov byte [ebp - 0x2b7], 0xa0
mov byte [ebp - 0x2b6], 0xca
mov byte [ebp - 0x2b5], 0x47
mov byte [ebp - 0x2b4], 0x2b
mov byte [ebp - 0x2b3], 0xd7
mov byte [ebp - 0x2b2], 0x49
mov byte [ebp - 0x2b1], 0x49
mov byte [ebp - 0x2b0], 0x6e
mov byte [ebp - 0x2af], 0x7e
mov byte [ebp - 0x2ae], 0xb8
mov byte [ebp - 0x2ad], 0x43
mov byte [ebp - 0x2ac], 0x59
mov byte [ebp - 0x2ab], 0x1b
mov byte [ebp - 0x2aa], 0x10
mov byte [ebp - 0x2a9], 0x68
mov byte [ebp - 0x2a8], 0x4c
mov byte [ebp - 0x2a7], 0x66
mov byte [ebp - 0x2a6], 0x5b
mov byte [ebp - 0x2a5], 0xb0
mov byte [ebp - 0x2a4], 0xc8
mov byte [ebp - 0x2a3], 0x60
mov byte [ebp - 0x2a2], 0xce
mov byte [ebp - 0x2a1], 0x35
mov byte [ebp - 0x2a0], 8
mov byte [ebp - 0x29f], 6
mov byte [ebp - 0x29e], 0
mov byte [ebp - 0x29d], 1
mov byte [ebp - 0x29c], 9
mov byte [ebp - 0x29b], 1
mov byte [ebp - 0x29a], 7
mov byte [ebp - 0x299], 6
mov byte [ebp - 0x298], 3
mov byte [ebp - 0x297], 4
mov byte [ebp - 0x296], 6
mov byte [ebp - 0x295], 0xb
mov byte [ebp - 0x294], 5
mov byte [ebp - 0x293], 8
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x2dc]
or eax, 0x26
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x2dc]
and ecx, 0x26
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x2dc]
mov byte [ebp + ecx - 0x654], al
mov dword [ebp - 0x28], 2
and dword [ebp - 0x180], 0
jmp 0x10041040
mov eax, dword [ebp - 0x28]
inc eax
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x4a
jae 0x1004112d
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x2dc]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x28], eax
jne 0x1004108a
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x2dc]
inc eax
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x2dc]
mov ecx, dword [ebp - 0x28]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x28], eax
jmp 0x10041038
mov eax, dword [ebp - 0x28]
movzx eax, byte [ebp + eax - 0x2db]
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x180]
movzx ecx, byte [ebp + ecx - 0x2de]
movsx ecx, byte [ebp + ecx - 0x654]
add eax, ecx
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [ebp + ecx - 0x2db]
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x180]
movzx edx, byte [ebp + edx - 0x2de]
movsx edx, byte [ebp + edx - 0x654]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [ebp + ecx - 0x2db]
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x180]
movzx edx, byte [ebp + edx - 0x2de]
movsx edx, byte [ebp + edx - 0x654]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x28]
movzx ecx, byte [ebp + ecx - 0x2dc]
mov byte [ebp + ecx - 0x654], al
push 0
push 0x4a62
lea eax, [ebp - 0x180]
push eax
call fcn.1003f0ab
add esp, 0xc
jmp 0x10041038
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x654], 0
lea eax, [ebp - 0x654]
push eax
lea ecx, [ebp - 0xb3c]
call fcn.10022e2c
mov dword [ebp - 0x734], eax
mov eax, dword [ebp - 0x734]
mov dword [ebp - 0x684], eax
mov dword [ebp - 4], 1
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x684]
call fcn.1002c4bd
pop ecx
mov dword [ebp - 0x73c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb3c]
call fcn.100156a4
mov dword [ebp - 0x84], 0
jmp 0x100411a4
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x100411c0
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x8a4], 8
jmp 0x10041197
mov dword [ebp - 0x84], 0
jmp 0x100411d9
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x100411f5
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x668], 0x915a1369
jmp 0x100411cc
mov byte [ebp - 0x106], 0
movzx eax, byte [ebp - 0x106]
test eax, eax
je 0x10041215
push 0
push 0x207b
call fcn.1003f827
pop ecx
pop ecx
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x668], 0
jmp 0x10041243
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x668]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x668], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x668], 1
jg 0x100412c5
mov dword [ebp - 0x268], 1
mov dword [ebp - 0x268], 1
jmp 0x10041276
mov eax, dword [ebp - 0x268]
dec eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 0
jl 0x100412c0
mov dword [ebp - 0x15c], 1
mov dword [ebp - 0x15c], 0
jmp 0x100412a2
mov eax, dword [ebp - 0x15c]
inc eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 2
jge 0x100412be
mov eax, dword [ebp - 0x15c]
mov dword [ebp + eax*4 - 0x8a4], 0
jmp 0x10041295
jmp 0x10041269
jmp 0x10041228
and dword [ebp - 0x270], 0
jmp 0x100412db
mov eax, dword [ebp - 0x270]
inc eax
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0xb
jae 0x100412f4
mov eax, dword [ebp - 0x270]
mov byte [ebp + eax - 0x654], 0
jmp 0x100412ce
mov dword [ebp - 0x9c], 0x8ade19d2
mov dword [ebp - 0x5b0], 0x8cf4c59c
mov dword [ebp - 0x130], 0xfffffffa
mov dword [ebp - 0x7d4], 0xa023703a
mov dword [ebp - 0x7d0], 0xa023703a
mov dword [ebp - 0x7cc], 0xa023703a
mov dword [ebp - 0x7c8], 0xa023703a
mov dword [ebp - 0x520], 0x91f9e6a0
mov dword [ebp - 0x888], 0xfffffff9
mov dword [ebp - 0x884], 0xfffffff9
mov dword [ebp - 0x880], 0xfffffff9
mov dword [ebp - 0x87c], 0xfffffff9
mov dword [ebp - 0x68c], 0xfffffffe
mov dword [ebp - 0x64], 0
jmp 0x10041386
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1004139c
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x788], 0x648
jmp 0x1004137f
mov dword [ebp - 0x64], 0
jmp 0x100413ac
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x100413c2
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0xa3c], 8
jmp 0x100413a5
mov dword [ebp - 0x9c], 0
jmp 0x100413db
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x100413f7
mov eax, dword [ebp - 0x9c]
mov dword [ebp + eax*4 - 0x788], 0xe1d9
jmp 0x100413ce
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x9b8], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x9c0], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x788]
cmp dword [ebp + eax - 0x788], ecx
jge 0x10041436
mov dword [ebp - 0x5fc], 1
jmp 0x1004143d
and dword [ebp - 0x5fc], 0
mov eax, dword [ebp - 0x130]
add eax, dword [ebp - 0x5fc]
je 0x1004145c
xor eax, eax
inc eax
je 0x1004145c
mov dword [ebp - 0x3e8], 1
jmp 0x10041463
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x3e8], eax
jl 0x1004147d
mov dword [ebp - 0x518], 1
jmp 0x10041484
and dword [ebp - 0x518], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x788]
cmp eax, dword [ebp - 0x518]
jne 0x100414a5
mov dword [ebp - 0x7c4], 1
jmp 0x100414ac
and dword [ebp - 0x7c4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7d4]
mov dword [ebp - 0x9c8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7d4]
imul eax, dword [ebp - 0x130]
sub eax, dword [ebp - 0x130]
jne 0x100414ed
mov eax, 0x276c
test eax, eax
jne 0x100414ed
and dword [ebp - 0x3f0], 0
jmp 0x100414f7
mov dword [ebp - 0x3f0], 1
cmp dword [ebp - 0x3f0], 0x752bf390
jl 0x1004150f
mov dword [ebp - 0x3f8], 1
jmp 0x10041516
and dword [ebp - 0x3f8], 0
mov dword [ebp - 0x5b0], 5
mov eax, dword [ebp - 0x5b0]
sub eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x520], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x788]
cmp dword [ebp - 0x520], eax
jne 0x1004155b
cmp dword [ebp - 0x9c], 0
je 0x1004155b
mov dword [ebp - 0x328], 1
jmp 0x10041562
and dword [ebp - 0x328], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x328]
mov dword [ebp + eax - 0xa3c], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x328]
sub ecx, dword [ebp + eax - 0x7d4]
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x888], ecx
cmp dword [ebp - 0x68c], 0
jne 0x100415ab
xor eax, eax
jne 0x100415ab
and dword [ebp - 0x400], 0
jmp 0x100415b5
mov dword [ebp - 0x400], 1
mov eax, dword [ebp - 0x9c]
add eax, dword [ebp - 0x400]
mov dword [ebp - 0x9c], eax
push dword [ebp - 0x73c]
push dword [ebp - 0x694]
call fcn.1003c081
pop ecx
pop ecx
mov dword [ebp - 0x540], eax
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0xac], 0xffffffff
mov dword [ebp - 0x69c], 0xfffffffd
mov dword [ebp - 0x330], 0x4648a574
mov dword [ebp - 0x428], 0xfffffff8
mov dword [ebp - 0x430], 5
mov dword [ebp - 0x68], 0
jmp 0x1004162c
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x10041642
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x85c], 0xeb606930
jmp 0x10041625
mov dword [ebp - 0x68], 0
jmp 0x10041652
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x10041668
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x854], 0xfffffff8
jmp 0x1004164b
mov dword [ebp - 0x17c], 0xffffffe9
jmp 0x10041681
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 3
jg 0x10041986
mov dword [ebp - 0xa8], 0xffffffff
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x218], 0
jmp 0x100416bb
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 3
jge 0x100416d7
mov eax, dword [ebp - 0x218]
mov dword [ebp + eax*4 - 0xa18], 0
jmp 0x100416ae
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
jne 0x100417cf
mov eax, dword [ebp - 0xac]
sub eax, 0x2377d64
mov dword [ebp - 0x634], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x634]
mov dword [ebp + eax - 0x85c], ecx
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x634], eax
je 0x10041728
mov dword [ebp - 0x408], 1
jmp 0x1004172f
and dword [ebp - 0x408], 0
cmp dword [ebp - 0x408], 0xdd71
jne 0x10041747
mov dword [ebp - 0x528], 1
jmp 0x1004174e
and dword [ebp - 0x528], 0
mov eax, dword [ebp - 0xa8]
add eax, dword [ebp - 0x528]
cmp eax, dword [ebp - 0xa8]
je 0x1004176e
mov dword [ebp - 0x410], 1
jmp 0x10041775
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x410]
sub eax, 0x504ed09e
mov dword [ebp - 0x78c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x78c]
mov dword [ebp + eax - 0x854], ecx
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x9d0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x85c]
mov dword [ebp - 0x9ec], eax
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0xac], eax
jle 0x100417cf
and dword [ebp - 0x5b8], 0
jmp 0x100417d9
mov dword [ebp - 0x5b8], 1
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x5b8], eax
jge 0x100417f3
mov dword [ebp - 0x418], 1
jmp 0x100417fa
and dword [ebp - 0x418], 0
cmp dword [ebp - 0x418], 0xeca6d786
jae 0x10041812
mov dword [ebp - 0x530], 1
jmp 0x10041819
and dword [ebp - 0x530], 0
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x530], eax
jge 0x10041833
mov dword [ebp - 0x420], 1
jmp 0x1004183a
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x69c], eax
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], eax
je 0x10041860
mov dword [ebp - 0x608], 1
jmp 0x10041867
and dword [ebp - 0x608], 0
cmp dword [ebp - 0x608], 1
ja 0x1004187c
mov dword [ebp - 0x744], 1
jmp 0x10041883
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x330]
sub eax, dword [ebp - 0xac]
mov dword [ebp - 0x428], eax
jne 0x100418b0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x854], 0
jne 0x100418b0
and dword [ebp - 0x6a4], 0
jmp 0x100418ba
mov dword [ebp - 0x6a4], 1
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x994], eax
mov eax, 0xfffa
cmp eax, 4
ja 0x100418dc
mov dword [ebp - 0x538], 1
jmp 0x100418e3
and dword [ebp - 0x538], 0
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0
je 0x1004190d
cmp dword [ebp - 0x330], 0
je 0x1004190d
mov dword [ebp - 0x5c0], 1
jmp 0x10041914
and dword [ebp - 0x5c0], 0
cmp dword [ebp - 0x5c0], 1
je 0x10041929
mov dword [ebp - 0x438], 1
jmp 0x10041930
and dword [ebp - 0x438], 0
cmp dword [ebp - 0x438], 0
jge 0x10041945
mov dword [ebp - 0x7bc], 1
jmp 0x1004194c
and dword [ebp - 0x7bc], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6ac]
mov dword [ebp + eax - 0xa18], ecx
mov byte [ebp - 0xe5], 0
push 0
push 0x5dd3
lea eax, [ebp - 0xe5]
push eax
push 0x3926
call fcn.1003eda6
add esp, 0x10
jmp 0x10041674
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0x540]
mov dword [eax + 8], ecx
push 0xf
push 5
call fcn.1003c081
pop ecx
pop ecx
add eax, dword [ebp - 0x540]
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 4], eax
and dword [ebp - 0x16c], 0
mov dword [ebp - 0x60], 0
jmp 0x100419c3
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x100419d9
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0xb48], 0x7571177e
jmp 0x100419bc
mov dword [ebp - 0x60], 0
jmp 0x100419e9
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x100419ff
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x7e0], 0xaeef20fe
jmp 0x100419e2
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x7e0], 2
jmp 0x10041a2d
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x7e0]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x7e0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x7e0], 0
jl 0x10041a5f
mov byte [ebp - 0x107], 0
movzx eax, byte [ebp - 0x107]
test eax, eax
je 0x10041a5d
push 0x754d
push 1
call fcn.1003eb86
pop ecx
pop ecx
jmp 0x10041a12
lea eax, [ebp - 0x16c]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
call fcn.1003ebcc
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xbc], 1
mov dword [ebp - 0x324], 0xfdc8dfba
mov dword [ebp - 0x630], 0xf34111d0
mov dword [ebp - 0x8bc], 0xe01b17d7
mov dword [ebp - 0x79c], 0x9986e3e4
mov dword [ebp - 0x8d0], 9
mov dword [ebp - 0x88c], 0
mov dword [ebp - 0x338], 0x4361a6b7
mov dword [ebp - 0x78], 0
jmp 0x10041add
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x10041af3
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x968], 0xfffffffe
jmp 0x10041ad6
mov dword [ebp - 0x78], 0
jmp 0x10041b03
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x10041b19
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xa88], 0x206dd2cc
jmp 0x10041afc
mov dword [ebp - 0xbc], 2
jmp 0x10041b32
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x10041b8b
mov dword [ebp - 0x274], 0xfffffff9
mov dword [ebp - 0x274], 0
jmp 0x10041b5e
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 2
jg 0x10041b77
push 1
push 0x3f54
call fcn.1003ec27
pop ecx
pop ecx
jmp 0x10041b51
mov eax, dword [ebp - 0xbc]
cmp dword [ebp + eax*4 - 0x968], 0
je 0x10041b89
jmp 0x10041b8b
jmp 0x10041b25
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x968]
mov dword [ebp - 0x324], eax
cmp dword [ebp - 0x324], 0x1ba
jge 0x10041bb6
mov dword [ebp - 0x74c], 1
jmp 0x10041bbd
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x8d8], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x6b4], 0
jle 0x10041bf7
mov dword [ebp - 0x440], 1
jmp 0x10041bfe
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0xbc]
sub eax, dword [ebp - 0x440]
cmp eax, dword [ebp - 0x79c]
jg 0x10041c1e
mov dword [ebp - 0x6bc], 1
jmp 0x10041c25
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x8a8], eax
mov eax, dword [ebp - 0x324]
mov dword [ebp - 0x630], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x14]
sub eax, dword [ebp - 0x16c]
mov dword [ebp - 0x118], eax
and dword [ebp - 0x220], 0
jmp 0x10041c65
mov eax, dword [ebp - 0x220]
inc eax
mov dword [ebp - 0x220], eax
mov eax, dword [ebp - 0x220]
cmp eax, dword [ebp - 0x118]
jge 0x10041cbf
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x220]
push eax
push 1
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x754]
push eax
call fcn.1003ec8e
add esp, 0x1c
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x754]
mov dword [ecx + eax], edx
push 1
lea eax, [ebp - 0x10]
push eax
call fcn.1003ed64
pop ecx
pop ecx
jmp 0x10041c58
mov dword [ebp - 0x228], 0xfffffffb
mov dword [ebp - 0x6c4], 0x971867b8
mov dword [ebp - 0x25c], 0
jmp 0x10041cec
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 3
jge 0x10041d08
mov eax, dword [ebp - 0x25c]
mov dword [ebp + eax*4 - 0xa30], 0xc3707822
jmp 0x10041cdf
mov dword [ebp - 0x228], 0
jmp 0x10041d21
cmp dword [ebp - 0x228], 0xfffffffe
jne 0x10041dd6
mov dword [ebp - 0x284], 0
jmp 0x10041d47
push 1
lea eax, [ebp - 0x16c]
push eax
push 0x2467
lea eax, [ebp - 0x18]
push eax
call fcn.1003eda6
add esp, 0x10
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0x18]
sub eax, dword [ebp - 0x16c]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x164], 0
mov dword [ebp - 0xcc], 0xffffffff
mov dword [ebp - 0x6cc], 0xfffffffd
mov dword [ebp - 0x2ec], 0x4648a574
mov dword [ebp - 0x470], 0xfffffff8
mov dword [ebp - 0x478], 5
mov dword [ebp - 0x5c], 0
jmp 0x10041e4e
push 0
push 0x2605
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret