Function at 0x1003c3c1
Capabilities:
Contain obfuscated stackstrings
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007630a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa08
and dword [ebp - 0x18], 0
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10040765
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x39c], eax
mov dword [ebp - 0x678], 0xffff
mov dword [ebp - 0x1fc], 0
jmp 0x1003c421
mov eax, dword [ebp - 0x1fc]
inc eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 3
jge 0x1003c43d
mov eax, dword [ebp - 0x1fc]
mov dword [ebp + eax*4 - 0x7e8], 0xade19d29
jmp 0x1003c414
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7e8]
mov dword [ebp - 0x748], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7e8]
mov dword [ebp - 0x678], eax
mov byte [ebp - 0x89], 0
lea eax, [ebp - 0x89]
push eax
push 0x355e
push 0
push 0x3442
call fcn.1003c364
add esp, 0x10
mov eax, dword [ebp - 0x39c]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1003c498
jmp 0x1004078f
mov eax, dword [ebp - 0x39c]
mov ecx, dword [ebp - 0x30]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x9c], ecx
mov eax, dword [ebp - 0x9c]
cmp dword [eax], 0x4550
je 0x1003c4bd
jmp 0x1004078f
push 8
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9c]
lea eax, [ecx + eax + 0x78]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], 0xd3df75dc
mov dword [ebp - 0x4d8], 0xd832937a
mov dword [ebp - 0x40], 0x1a
jmp 0x1003c4f1
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffed
jg 0x1003c6cc
mov dword [ebp - 0x200], 0xffffffff
mov dword [ebp - 0x204], 8
mov byte [ebp - 0x9d], 0
movzx eax, byte [ebp - 0x9d]
test eax, eax
je 0x1003c527
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x200], eax
jge 0x1003c547
mov eax, 0x421dd2eb
test eax, eax
je 0x1003c547
mov dword [ebp - 0x524], 1
jmp 0x1003c54e
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x524]
cmp eax, dword [ebp - 0x40]
jne 0x1003c568
mov dword [ebp - 0x638], 1
jmp 0x1003c56f
and dword [ebp - 0x638], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x71c], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x200], eax
jle 0x1003c58f
mov dword [ebp - 0x640], 1
jmp 0x1003c596
and dword [ebp - 0x640], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x724], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x72c], eax
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0x204], eax
jl 0x1003c5c2
mov dword [ebp - 0x554], 1
jmp 0x1003c5c9
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0x554], eax
jl 0x1003c5e3
mov dword [ebp - 0x55c], 1
jmp 0x1003c5ea
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x204]
cmp eax, dword [ebp - 0x55c]
jle 0x1003c604
mov dword [ebp - 0x548], 1
jmp 0x1003c60b
and dword [ebp - 0x548], 0
mov eax, dword [ebp - 0x200]
cmp dword [ebp - 0x548], eax
jle 0x1003c625
mov dword [ebp - 0x560], 1
jmp 0x1003c62c
and dword [ebp - 0x560], 0
mov eax, dword [ebp - 0x200]
cmp eax, dword [ebp - 0x560]
je 0x1003c646
mov dword [ebp - 0x51c], 1
jmp 0x1003c64d
and dword [ebp - 0x51c], 0
mov dword [ebp - 0x4d8], 0xfffffffe
mov eax, dword [ebp - 0x4d8]
cmp eax, dword [ebp - 0x51c]
jge 0x1003c698
mov byte [ebp - 0xb0], 0
push 0x1548
push 0
push 0x104b
push 0x7d73
push 0xb4f
push 0x4c55
lea eax, [ebp - 0xb0]
push eax
call fcn.1003c215
add esp, 0x1c
jmp 0x1003c6c7
mov dword [ebp - 0x648], 0xffffffff
mov byte [ebp - 0xa5], 0
lea eax, [ebp - 0xa5]
push eax
push 1
call fcn.1003b5ce
pop ecx
pop ecx
cmp dword [ebp - 0x648], 0
je 0x1003c6c7
jmp 0x1003c4ea
jmp 0x1003c4ea
mov eax, dword [ebp - 0x44]
cmp dword [eax + 4], 0
jne 0x1003c6da
jmp 0x1004078f
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x9c]
movzx eax, word [eax + 0x14]
mov ecx, dword [ebp - 0x9c]
lea eax, [ecx + eax + 0x18]
mov dword [ebp - 0xc8], eax
and dword [ebp - 0x2bc], 0
jmp 0x1003c71d
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0xc8]
add eax, 0x28
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0x9c]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x2bc], eax
jge 0x1003c79e
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x320]
jb 0x1003c799
mov eax, dword [ebp - 0x9c]
push dword [eax + 0x38]
mov eax, dword [ebp - 0xc8]
push dword [eax + 8]
call fcn.1003b59f
pop ecx
pop ecx
add eax, dword [ebp - 0x320]
mov dword [ebp - 0x650], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x650]
jae 0x1003c799
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0x47ff
call fcn.1003be9f
add esp, 0x10
jmp 0x1003c79e
jmp 0x1003c701
cmp dword [ebp - 0x34], 0
jne 0x1003c7a9
jmp 0x1004078f
mov dword [ebp - 0x7b0], 0x48261f9c
mov byte [ebp - 0xb2], 0
lea eax, [ebp - 0xb2]
push eax
push 1
call fcn.1003b613
pop ecx
pop ecx
mov byte [ebp - 0x86], 0
movzx eax, byte [ebp - 0x86]
test eax, eax
je 0x1003c7ff
push 0x6c1
push 0x26a6
push 0
push 0x6bd9
push 0x647
push 0x6fd6
call fcn.1003bb5d
add esp, 0x18
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x34]
add ecx, dword [eax]
add ecx, dword [ebp - 0x30]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x658], 0xb7e80d68
mov dword [ebp - 0x1d8], 0
jmp 0x1003c830
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 1
jge 0x1003c84c
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0x84], 0xd1d8
jmp 0x1003c823
mov byte [ebp - 0x87], 0
movzx eax, byte [ebp - 0x87]
test eax, eax
je 0x1003c874
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x84], 0
jne 0x1003c89d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x84], 0
jne 0x1003c89d
and dword [ebp - 0x448], 0
jmp 0x1003c8a7
mov dword [ebp - 0x448], 1
cmp dword [ebp - 0x448], 0xfffffffb
ja 0x1003c8bc
mov dword [ebp - 0x328], 1
jmp 0x1003c8c3
and dword [ebp - 0x328], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x84]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x84]
cmp eax, dword [ebp - 0x328]
jge 0x1003c8f1
mov dword [ebp - 0x558], 1
jmp 0x1003c8f8
and dword [ebp - 0x558], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x84]
cmp dword [ebp - 0x558], eax
jg 0x1003c919
mov dword [ebp - 0x330], 1
jmp 0x1003c920
and dword [ebp - 0x330], 0
imul eax, dword [ebp - 0x330], 0xf29a
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x84]
jl 0x1003c945
mov dword [ebp - 0x450], 1
jmp 0x1003c94c
and dword [ebp - 0x450], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x84]
cmp dword [ebp - 0x450], eax
jne 0x1003c96d
mov dword [ebp - 0x338], 1
jmp 0x1003c974
and dword [ebp - 0x338], 0
cmp dword [ebp - 0x338], 0x38ec
jl 0x1003c98c
mov dword [ebp - 0x4e0], 1
jmp 0x1003c993
and dword [ebp - 0x4e0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x84]
imul eax, dword [ebp - 0x4e0]
mov dword [ebp - 0x658], eax
xor ecx, ecx
call fcn.10029e1b
push eax
call fcn.1005d4b8
pop ecx
mov dword [ebp - 0x164], 0xf09cc25f
mov dword [ebp - 0x6f0], 0x12af048
mov dword [ebp - 0x6ec], 0x12af048
mov dword [ebp - 0x6e8], 0x12af048
mov dword [ebp - 0x6e4], 0x12af048
mov dword [ebp - 0x660], 0x9df9481f
mov dword [ebp - 0x668], 0x4adf2985
mov dword [ebp - 0x28], 0
jmp 0x1003ca11
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x1003ca27
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x738], 0x6d444182
jmp 0x1003ca0a
mov dword [ebp - 0x28], 0
jmp 0x1003ca37
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1003ca4d
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x930], 0
jmp 0x1003ca30
mov dword [ebp - 0x28], 0
jmp 0x1003ca5d
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1003ca73
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x8a8], 0x24f20479
jmp 0x1003ca56
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x738], 0
jne 0x1003ca89
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x340], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x340]
mov dword [ebp + eax - 0x930], ecx
mov eax, dword [ebp - 0x340]
imul eax, dword [ebp - 0x164]
mov dword [ebp - 0x2d4], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x2d4]
mov dword [ebp + eax - 0x6f0], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2d4]
mov dword [ebp + eax - 0x8a8], ecx
mov eax, dword [ebp - 0x164]
add eax, dword [ebp - 0x2d4]
cmp eax, dword [ebp - 0x660]
je 0x1003caff
mov dword [ebp - 0x458], 1
jmp 0x1003cb06
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x668], eax
mov dword [ebp - 0x128], 3
mov dword [ebp - 0x624], 1
mov dword [ebp - 0x694], 0x91f0
mov dword [ebp - 0x59c], 1
mov dword [ebp - 0x7b8], 0xa0165d3e
mov dword [ebp - 0x7c0], 0x6cf6d707
mov dword [ebp - 0x7c8], 0xfffffffa
mov dword [ebp - 0x64], 0
jmp 0x1003cb68
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1003cb7e
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x7d0], 0x3dee6ee3
jmp 0x1003cb61
mov dword [ebp - 0x64], 0
jmp 0x1003cb8e
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x1003cba4
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x7f8], 0x926a6722
jmp 0x1003cb87
mov dword [ebp - 0x128], 0
jmp 0x1003cbbd
mov eax, dword [ebp - 0x128]
dec eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0xfffffff2
je 0x1003ccb4
mov dword [ebp - 0x684], 0x39d6b9c2
mov dword [ebp - 0x630], 0xffff
mov dword [ebp - 0x66c], 3
mov dword [ebp - 0x690], 0xc44d4e2b
mov dword [ebp - 0x7d8], 0x48792891
mov dword [ebp - 0x84c], 0xa0c09020
mov dword [ebp - 0x854], 4
mov dword [ebp - 0x85c], 0
mov dword [ebp - 0x1e0], 0
jmp 0x1003cc33
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 1
jge 0x1003cc4f
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0x864], 0xc437ffea
jmp 0x1003cc26
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x128]
push eax
push 0x5865
lea eax, [ebp - 0x690]
push eax
lea eax, [ebp - 0x624]
push eax
push 1
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x59c]
push eax
lea eax, [ebp - 0x66c]
push eax
call fcn.1003b65d
add esp, 0x28
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7f8]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x7f8], eax
jmp 0x1003cbb0
mov byte [ebp - 0x25c], 0
mov byte [ebp - 0x25b], 0xd6
mov byte [ebp - 0x25a], 0x42
mov byte [ebp - 0x259], 0xa3
mov byte [ebp - 0x258], 0xee
mov byte [ebp - 0x257], 0x23
mov byte [ebp - 0x256], 0x4c
mov byte [ebp - 0x255], 0x20
mov byte [ebp - 0x254], 0x9d
mov byte [ebp - 0x253], 0xd0
mov byte [ebp - 0x252], 0xa9
mov byte [ebp - 0x251], 0xa4
mov byte [ebp - 0x250], 0x49
mov byte [ebp - 0x24f], 0x69
mov byte [ebp - 0x24e], 0xb0
mov byte [ebp - 0x24d], 0xb1
mov byte [ebp - 0x24c], 3
mov byte [ebp - 0x24b], 0xcd
mov byte [ebp - 0x24a], 0x4c
mov byte [ebp - 0x249], 0x1b
mov byte [ebp - 0x248], 0x4b
mov byte [ebp - 0x247], 0xb4
mov byte [ebp - 0x246], 0xe0
mov byte [ebp - 0x245], 0x5d
mov byte [ebp - 0x244], 0x71
mov byte [ebp - 0x243], 0x30
mov byte [ebp - 0x242], 0x87
mov byte [ebp - 0x241], 0xfc
mov byte [ebp - 0x240], 0xb9
mov byte [ebp - 0x23f], 0x36
mov byte [ebp - 0x23e], 0x46
mov byte [ebp - 0x23d], 0x6a
mov byte [ebp - 0x23c], 0x8a
mov byte [ebp - 0x23b], 0x3e
mov byte [ebp - 0x23a], 0x8f
mov byte [ebp - 0x239], 0x98
mov byte [ebp - 0x238], 0xea
mov byte [ebp - 0x237], 0x3e
mov byte [ebp - 0x236], 5
mov byte [ebp - 0x235], 0xc3
mov byte [ebp - 0x234], 0x8b
mov byte [ebp - 0x233], 0x35
mov byte [ebp - 0x232], 0xc2
mov byte [ebp - 0x231], 0x13
mov byte [ebp - 0x230], 0x31
mov byte [ebp - 0x22f], 0x71
mov byte [ebp - 0x22e], 0x47
mov byte [ebp - 0x22d], 0xb
mov byte [ebp - 0x22c], 0x26
mov byte [ebp - 0x22b], 0x4e
mov byte [ebp - 0x22a], 0x9b
mov byte [ebp - 0x229], 0x87
mov byte [ebp - 0x228], 0x9b
mov byte [ebp - 0x227], 0x19
mov byte [ebp - 0x226], 0x62
mov byte [ebp - 0x225], 0x34
mov byte [ebp - 0x224], 0x1f
mov byte [ebp - 0x223], 0x50
mov byte [ebp - 0x222], 0xfb
mov byte [ebp - 0x221], 0x28
mov byte [ebp - 0x220], 0x7c
mov byte [ebp - 0x21f], 0xf9
mov byte [ebp - 0x21e], 0x48
mov byte [ebp - 0x21d], 0xb4
mov byte [ebp - 0x21c], 0xc6
mov byte [ebp - 0x21b], 0x31
mov byte [ebp - 0x21a], 0xca
mov byte [ebp - 0x219], 0x76
mov byte [ebp - 0x218], 0xcc
mov byte [ebp - 0x217], 1
mov byte [ebp - 0x216], 4
mov byte [ebp - 0x215], 5
mov byte [ebp - 0x214], 4
mov byte [ebp - 0x213], 3
mov byte [ebp - 0x212], 6
mov byte [ebp - 0x211], 6
mov byte [ebp - 0x210], 6
mov byte [ebp - 0x20f], 8
mov byte [ebp - 0x20e], 1
mov byte [ebp - 0x20d], 2
mov byte [ebp - 0x20c], 7
mov byte [ebp - 0x20b], 7
mov byte [ebp - 0x20a], 1
mov byte [ebp - 0x209], 4
mov byte [ebp - 0x208], 0xe
mov byte [ebp - 0x207], 9
mov byte [ebp - 0x206], 8
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x25c]
or eax, 0xe7
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x25c]
and ecx, 0xe7
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x25c]
mov byte [ebp + ecx - 0x578], al
mov dword [ebp - 0x38], 2
and dword [ebp - 0x16c], 0
jmp 0x1003cf6b
mov eax, dword [ebp - 0x38]
inc eax
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x57
jae 0x1003d030
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x25c]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x38], eax
jne 0x1003cfb5
mov eax, dword [ebp - 0x38]
movzx eax, byte [ebp + eax - 0x25c]
inc eax
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [ebp + eax - 0x25c]
mov ecx, dword [ebp - 0x38]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x38], eax
jmp 0x1003cf63
mov eax, dword [ebp - 0x38]
movzx eax, byte [ebp + eax - 0x25b]
mov ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x16c]
movzx ecx, byte [ebp + ecx - 0x25e]
movsx ecx, byte [ebp + ecx - 0x578]
or eax, ecx
mov ecx, dword [ebp - 0x38]
movzx ecx, byte [ebp + ecx - 0x25b]
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x16c]
movzx edx, byte [ebp + edx - 0x25e]
movsx edx, byte [ebp + edx - 0x578]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x38]
movzx ecx, byte [ebp + ecx - 0x25c]
mov byte [ebp + ecx - 0x578], al
push 0x2303
push 1
lea eax, [ebp - 0x16c]
push eax
call fcn.1003b899
add esp, 0xc
jmp 0x1003cf63
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x578], 0
mov dword [ebp - 0x1b0], 0
jmp 0x1003d057
mov eax, dword [ebp - 0x1b0]
inc eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 3
jge 0x1003d073
mov eax, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0x56c], 0xb110c93b
jmp 0x1003d04a
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x56c], 0
jmp 0x1003d09e
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x56c]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x56c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x56c], 0x1c
jne 0x1003d220
mov dword [ebp - 0x358], 4
mov dword [ebp - 0x174], 0
jmp 0x1003d0d4
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 4
jge 0x1003d0f0
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x6a8], 1
jmp 0x1003d0c7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6a8]
mov dword [ebp - 0x86c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6a8], 0xa8ed
jle 0x1003d11a
xor eax, eax
jne 0x1003d132
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x56c], 0
jne 0x1003d132
and dword [ebp - 0x348], 0
jmp 0x1003d13c
mov dword [ebp - 0x348], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x56c]
cmp dword [ebp - 0x348], eax
je 0x1003d16c
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x6a8], 0
je 0x1003d16c
mov dword [ebp - 0x528], 1
jmp 0x1003d173
and dword [ebp - 0x528], 0
cmp dword [ebp - 0x528], 0xa7a81a82
ja 0x1003d18b
mov dword [ebp - 0x350], 1
jmp 0x1003d192
and dword [ebp - 0x350], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x56c]
cmp eax, dword [ebp - 0x350]
jl 0x1003d1b3
mov dword [ebp - 0x460], 1
jmp 0x1003d1ba
and dword [ebp - 0x460], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6a8]
cmp dword [ebp - 0x460], eax
je 0x1003d1eb
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6a8], 0
je 0x1003d1eb
mov dword [ebp - 0x4e8], 1
jmp 0x1003d1f2
and dword [ebp - 0x4e8], 0
mov dword [ebp - 0x358], 0xffffffff
mov eax, dword [ebp - 0x358]
imul eax, dword [ebp - 0x4e8]
xor ecx, ecx
inc ecx
sub ecx, eax
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x6a8], ecx
jmp 0x1003d085
lea eax, [ebp - 0x578]
push eax
lea ecx, [ebp - 0x960]
call fcn.100212bf
mov dword [ebp - 0x5a4], eax
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x62c], eax
and dword [ebp - 4], 0
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x62c]
call fcn.10029de0
pop ecx
mov dword [ebp - 0x644], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x960]
call fcn.1001616e
mov dword [ebp - 0x2f0], 0
mov dword [ebp - 0x17c], 0xffffffff
mov dword [ebp - 0x94], 0xe21afa9b
mov dword [ebp - 0x2f4], 0xf5d870a3
mov dword [ebp - 0x5b4], 0xaa165420
mov dword [ebp - 0x380], 1
mov dword [ebp - 0x470], 1
mov dword [ebp - 0x634], 7
mov dword [ebp - 0x888], 0xee34edf6
mov dword [ebp - 0x5bc], 0xfffffffc
mov dword [ebp - 0x870], 0xb35d5697
mov dword [ebp - 0x7fc], 0xffffffff
mov dword [ebp - 0x2dc], 0xe80c6548
mov dword [ebp - 0x1b4], 0
jmp 0x1003d308
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 2
jge 0x1003d324
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x58c], 5
jmp 0x1003d2fb
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x5ac], eax
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x674], eax
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0x5ac]
cmp eax, dword [ebp - 0x674]
jge 0x1003d363
mov dword [ebp - 0x370], 1
jmp 0x1003d36a
and dword [ebp - 0x370], 0
cmp dword [ebp - 0x380], 0x5116
jne 0x1003d382
mov dword [ebp - 0x360], 1
jmp 0x1003d389
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x5b4]
cmp dword [ebp - 0x360], eax
jne 0x1003d3a3
mov dword [ebp - 0x468], 1
jmp 0x1003d3aa
and dword [ebp - 0x468], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x58c]
cmp eax, dword [ebp - 0x468]
jl 0x1003d3cb
mov dword [ebp - 0x368], 1
jmp 0x1003d3d2
and dword [ebp - 0x368], 0
cmp dword [ebp - 0x368], 0xb9c309ab
ja 0x1003d3ea
mov dword [ebp - 0x550], 1
jmp 0x1003d3f1
and dword [ebp - 0x550], 0
mov eax, dword [ebp - 0x634]
cmp dword [ebp - 0x550], eax
jg 0x1003d40b
mov dword [ebp - 0x378], 1
jmp 0x1003d412
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x470], eax
mov eax, dword [ebp - 0x470]
cmp eax, dword [ebp - 0x378]
jl 0x1003d43f
push 5
pop eax
test eax, eax
je 0x1003d43f
mov dword [ebp - 0x4f0], 1
jmp 0x1003d446
and dword [ebp - 0x4f0], 0
mov eax, dword [ebp - 0x2f4]
cmp dword [ebp - 0x4f0], eax
jne 0x1003d460
mov dword [ebp - 0x478], 1
jmp 0x1003d467
and dword [ebp - 0x478], 0
mov eax, dword [ebp - 0x380]
cmp dword [ebp - 0x478], eax
jl 0x1003d481
mov dword [ebp - 0x388], 1
jmp 0x1003d488
and dword [ebp - 0x388], 0
mov eax, dword [ebp - 0x2f0]
mov ecx, dword [ebp - 0x2f0]
neg ecx
imul eax, ecx
cmp eax, dword [ebp - 0x388]
jge 0x1003d4ad
mov dword [ebp - 0x534], 1
jmp 0x1003d4b4
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x2f4]
cmp dword [ebp - 0x534], eax
je 0x1003d4d7
mov eax, 0xb148
test eax, eax
je 0x1003d4d7
mov dword [ebp - 0x390], 1
jmp 0x1003d4de
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x2f4], eax
mov dword [ebp - 0x94], 0
jmp 0x1003d503
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jg 0x1003d667
mov dword [ebp - 0x67c], 7
mov dword [ebp - 0x54], 0
jmp 0x1003d52a
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x1003d540
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x744], 0x544b
jmp 0x1003d523
mov dword [ebp - 0x54], 0
jmp 0x1003d550
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jge 0x1003d566
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x8d8], 0
jmp 0x1003d549
mov dword [ebp - 0x17c], 0
jmp 0x1003d57f
mov eax, dword [ebp - 0x17c]
inc eax
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 1
jg 0x1003d662
mov dword [ebp - 0x480], 0xfffa
mov eax, dword [ebp - 0x480]
inc eax
mov dword [ebp - 0x480], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x744]
mov dword [ebp - 0x850], eax
mov eax, dword [ebp - 0x94]
push 4
pop ecx
shl ecx, 0
imul ecx, dword [ebp + ecx - 0x8d8], 0xb221
cmp dword [ebp + eax*4 - 0x58c], ecx
je 0x1003d5e2
mov dword [ebp - 0x398], 1
jmp 0x1003d5e9
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x5bc]
cmp dword [ebp - 0x398], eax
jl 0x1003d60d
xor eax, eax
jne 0x1003d60d
cmp dword [ebp - 0x94], 0
jne 0x1003d60d
and dword [ebp - 0x4f8], 0
jmp 0x1003d617
mov dword [ebp - 0x4f8], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x58c]
sub eax, dword [ebp - 0x4f8]
cmp eax, 0x8045
jg 0x1003d63d
mov dword [ebp - 0x3a0], 1
jmp 0x1003d644
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp + eax*4 - 0x58c]
sub eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x67c], eax
jmp 0x1003d572
jmp 0x1003d4f6
and dword [ebp - 0x1bc], 0
jmp 0x1003d67d
mov eax, dword [ebp - 0x1bc]
inc eax
mov dword [ebp - 0x1bc], eax
cmp dword [ebp - 0x1bc], 0xb
jae 0x1003d696
mov eax, dword [ebp - 0x1bc]
mov byte [ebp + eax - 0x578], 0
jmp 0x1003d670
mov dword [ebp - 0x58], 0xfffffff9
mov dword [ebp - 0x3a8], 0
mov dword [ebp - 0x3b0], 0x5e3d1aa1
mov dword [ebp - 0x2e0], 0xffffffff
mov dword [ebp - 0x6c8], 0x6cc7
mov dword [ebp - 0x6c4], 0x6cc7
mov dword [ebp - 0x6c0], 0x6cc7
mov dword [ebp - 0x6bc], 0x6cc7
mov dword [ebp - 0xec], 0x74f0e4f
mov dword [ebp - 0x184], 0
jmp 0x1003d706
mov eax, dword [ebp - 0x184]
inc eax
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 3
jge 0x1003d722
mov eax, dword [ebp - 0x184]
mov dword [ebp + eax*4 - 0x808], 0xfffffffc
jmp 0x1003d6f9
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x58], 0xffff41e3
jge 0x1003d740
mov dword [ebp - 0x3c8], 1
jmp 0x1003d747
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x58], eax
jl 0x1003d75b
mov dword [ebp - 0x488], 1
jmp 0x1003d762
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 0
jne 0x1003d789
mov eax, 0xf5f4
test eax, eax
jne 0x1003d789
and dword [ebp - 0x538], 0
jmp 0x1003d793
mov dword [ebp - 0x538], 1
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x3b0], eax
cmp dword [ebp - 0x3b0], 0
jne 0x1003d7b7
cmp dword [ebp - 0x58], 0
jne 0x1003d7b7
and dword [ebp - 0x490], 0
jmp 0x1003d7c1
mov dword [ebp - 0x490], 1
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x490], eax
jg 0x1003d7d8
mov dword [ebp - 0x3b8], 1
jmp 0x1003d7df
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x3b8]
sub eax, dword [ebp - 0x58]
imul eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c4], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x5c4]
mov dword [ebp + eax - 0x808], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x808]
add eax, dword [ebp - 0x2e0]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x6c8]
cmp eax, 0xf3d3
je 0x1003d83b
mov dword [ebp - 0x500], 1
jmp 0x1003d842
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x2e0]
cmp dword [ebp - 0x500], eax
jle 0x1003d85e
xor eax, eax
inc eax
jne 0x1003d85e
and dword [ebp - 0x3c0], 0
jmp 0x1003d868
mov dword [ebp - 0x3c0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6c8]
cmp dword [ebp - 0x3c0], eax
jge 0x1003d892
cmp dword [ebp - 0x2e0], 0
je 0x1003d892
mov dword [ebp - 0x498], 1
jmp 0x1003d899
and dword [ebp - 0x498], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x6c8]
add eax, dword [ebp - 0x498]
cmp dword [ebp - 0x3c8], eax
je 0x1003d8c0
mov dword [ebp - 0x53c], 1
jmp 0x1003d8c7
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xec], 0x15
jmp 0x1003d8ec
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0xd
je 0x1003d90e
mov byte [ebp - 0x8a], 0
lea eax, [ebp - 0x8a]
push eax
push 1
call fcn.1003b8dd
pop ecx
pop ecx
jmp 0x1003d8df
mov dword [ebp - 0x18c], 0xffffffff
mov dword [ebp - 0x7ec], 0x6f7fbf21
mov dword [ebp - 0x708], 1
mov dword [ebp - 0x884], 0xffffffff
mov dword [ebp - 0x880], 0x7249aaed
mov dword [ebp - 0x87c], 0x7249aaed
mov dword [ebp - 0x878], 0x7249aaed
mov dword [ebp - 0x874], 0x7249aaed
mov dword [ebp - 0x120], 0x64dbb9a2
mov dword [ebp - 0x1c4], 0
jmp 0x1003d981
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 3
jge 0x1003d99d
mov eax, dword [ebp - 0x1c4]
mov dword [ebp + eax*4 - 0x99c], 0xffffffff
jmp 0x1003d974
mov dword [ebp - 0x18c], 0xffffffe6
jmp 0x1003d9b6
mov eax, dword [ebp - 0x18c]
inc eax
mov dword [ebp - 0x18c], eax
cmp dword [ebp - 0x18c], 0xffffffef
jl 0x1003db24
mov dword [ebp - 0x1cc], 0
mov dword [ebp - 0x710], 0x754320e3
mov dword [ebp - 0x764], 0xfffffffd
mov dword [ebp - 0x718], 0xb0639e6a
mov dword [ebp - 0x68], 0
jmp 0x1003d9fb
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x1003da11
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x768], 1
jmp 0x1003d9f4
mov dword [ebp - 0x68], 0
jmp 0x1003da21
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1003da37
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x8e0], 0x68108531
jmp 0x1003da1a
mov dword [ebp - 0x1cc], 0
jmp 0x1003da50
mov eax, dword [ebp - 0x1cc]
dec eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0
jl 0x1003db1f
mov dword [ebp - 0x720], 0xfffffff8
mov dword [ebp - 0x770], 4
mov dword [ebp - 0x728], 0
mov dword [ebp - 0x194], 0
jmp 0x1003da94
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 3
jge 0x1003dab0
mov eax, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0xa08], 0x39ee491
jmp 0x1003da87
push 0
push 0x5f17
lea eax, [ebp - 0x120]
push eax
call fcn.1003bc5b
add esp, 0xc
mov dword [ebp - 0x120], 0
jmp 0x1003dadf
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
jg 0x1003db1a
mov byte [ebp - 0x8c], 0
movzx eax, byte [ebp - 0x8c]
test eax, eax
je 0x1003db18
push 0x5035
push 0
push 0x355d
push 0x2e00
push 0x2993
call fcn.1003bbec
add esp, 0x14
jmp 0x1003dad2
jmp 0x1003da43
jmp 0x1003d9a9
mov byte [ebp - 0x2b8], 7
mov byte [ebp - 0x2b7], 0xf5
mov byte [ebp - 0x2b6], 8
mov byte [ebp - 0x2b5], 6
mov byte [ebp - 0x2b4], 4
mov byte [ebp - 0x2b3], 4
mov byte [ebp - 0x2b2], 3
mov byte [ebp - 0x2b1], 6
mov byte [ebp - 0x2b0], 5
mov byte [ebp - 0x2af], 3
mov byte [ebp - 0x2ae], 1
mov byte [ebp - 0x2ad], 7
mov byte [ebp - 0x2ac], 0
mov byte [ebp - 0x2ab], 7
mov byte [ebp - 0x2aa], 6
mov byte [ebp - 0x2a9], 8
mov byte [ebp - 0x2a8], 0x47
mov byte [ebp - 0x2a7], 0x84
mov byte [ebp - 0x2a6], 0x19
mov byte [ebp - 0x2a5], 0xda
mov byte [ebp - 0x2a4], 0x3e
mov byte [ebp - 0x2a3], 0xcf
mov byte [ebp - 0x2a2], 0
mov byte [ebp - 0x2a1], 0xb8
mov byte [ebp - 0x2a0], 0x95
mov byte [ebp - 0x29f], 0x86
mov byte [ebp - 0x29e], 0x83
mov byte [ebp - 0x29d], 0x2e
mov byte [ebp - 0x29c], 0x4c
mov byte [ebp - 0x29b], 0xcd
mov byte [ebp - 0x29a], 0x4f
mov byte [ebp - 0x299], 0x9e
mov byte [ebp - 0x298], 0x51
mov byte [ebp - 0x297], 0x52
mov byte [ebp - 0x296], 0xc8
mov byte [ebp - 0x295], 0x5d
mov byte [ebp - 0x294], 0x55
mov byte [ebp - 0x293], 0xc0
mov byte [ebp - 0x292], 0x6b
mov byte [ebp - 0x291], 0x36
mov byte [ebp - 0x290], 1
mov byte [ebp - 0x28f], 0xb7
mov byte [ebp - 0x28e], 0x40
mov byte [ebp - 0x28d], 0x8c
mov byte [ebp - 0x28c], 0xe7
mov byte [ebp - 0x28b], 6
mov byte [ebp - 0x28a], 0x83
mov byte [ebp - 0x289], 3
mov byte [ebp - 0x288], 0x5d
mov byte [ebp - 0x287], 0xbb
mov byte [ebp - 0x286], 0xaf
mov byte [ebp - 0x285], 0xe7
mov byte [ebp - 0x284], 0x89
mov byte [ebp - 0x283], 0xf3
mov byte [ebp - 0x282], 0x79
mov byte [ebp - 0x281], 0xc9
mov byte [ebp - 0x280], 0xeb
mov byte [ebp - 0x27f], 0xdc
mov byte [ebp - 0x27e], 0x81
mov byte [ebp - 0x27d], 0xfc
mov byte [ebp - 0x27c], 0x2d
mov byte [ebp - 0x27b], 0xde
mov byte [ebp - 0x27a], 0x3b
mov byte [ebp - 0x279], 0xf1
mov byte [ebp - 0x278], 0xdb
mov byte [ebp - 0x277], 0x65
mov byte [ebp - 0x276], 0x4d
mov byte [ebp - 0x275], 0x9e
mov byte [ebp - 0x274], 3
mov byte [ebp - 0x273], 0x36
mov byte [ebp - 0x272], 0x77
mov byte [ebp - 0x271], 0x6f
mov byte [ebp - 0x270], 0x3c
mov byte [ebp - 0x26f], 0x4e
mov byte [ebp - 0x26e], 0xb3
mov byte [ebp - 0x26d], 0xdd
mov byte [ebp - 0x26c], 0x95
mov byte [ebp - 0x26b], 0xaf
mov byte [ebp - 0x26a], 0xa0
mov byte [ebp - 0x269], 0x47
mov byte [ebp - 0x268], 0x83
mov byte [ebp - 0x267], 0x2e
mov byte [ebp - 0x266], 0x7f
mov byte [ebp - 0x265], 0x8e
mov byte [ebp - 0x264], 0xb2
mov byte [ebp - 0x263], 0xfe
mov byte [ebp - 0x262], 0xb5
mov byte [ebp - 0x261], 0x9b
mov byte [ebp - 0x260], 2
mov byte [ebp - 0x25f], 0xe
mov byte [ebp - 0x25e], 9
mov byte [ebp - 0x25d], 7
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x2b8]
or eax, 0xc3
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x2b8]
and ecx, 0xc3
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x2b8]
mov byte [ebp + ecx - 0x584], al
mov dword [ebp - 0x3c], 2
and dword [ebp - 0x1d4], 0
jmp 0x1003ddfe
mov eax, dword [ebp - 0x3c]
inc eax
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x5c
jae 0x1003dec0
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x2b8]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x3c], eax
jne 0x1003de48
mov eax, dword [ebp - 0x3c]
movzx eax, byte [ebp + eax - 0x2b8]
inc eax
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [ebp + eax - 0x2b8]
mov ecx, dword [ebp - 0x3c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x3c], eax
jmp 0x1003ddf6
mov eax, dword [ebp - 0x3c]
movzx eax, byte [ebp + eax - 0x2b7]
mov ecx, dword [ebp - 0x3c]
sub ecx, dword [ebp - 0x1d4]
movzx ecx, byte [ebp + ecx - 0x2ba]
movsx ecx, byte [ebp + ecx - 0x584]
or eax, ecx
mov ecx, dword [ebp - 0x3c]
movzx ecx, byte [ebp + ecx - 0x2b7]
mov edx, dword [ebp - 0x3c]
sub edx, dword [ebp - 0x1d4]
movzx edx, byte [ebp + edx - 0x2ba]
movsx edx, byte [ebp + edx - 0x584]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x3c]
movzx ecx, byte [ebp + ecx - 0x2b8]
mov byte [ebp + ecx - 0x584], al
lea eax, [ebp - 0x1d4]
push eax
push 0
push 0x53
call fcn.1003c101
add esp, 0xc
jmp 0x1003ddf6
xor eax, eax
inc eax
imul eax, eax, 0xa
mov byte [ebp + eax - 0x584], 0
mov dword [ebp - 0x778], 0x274952f
mov dword [ebp - 0x730], 0x1b17d72b
mov dword [ebp - 0x780], 9
mov dword [ebp - 0x73c], 0xfffffff7
mov dword [ebp - 0x3d0], 0x4361
mov dword [ebp - 0x788], 0x263b0a6d
mov dword [ebp - 0x2c], 0
jmp 0x1003df1a
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1003df30
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x818], 1
jmp 0x1003df13
mov dword [ebp - 0x2c], 0
jmp 0x1003df40
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x1003df56
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x6f4], 0x57ad95e1
jmp 0x1003df39
mov dword [ebp - 0x2c], 0
jmp 0x1003df66
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1003df7c
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x9d8], 0x576c3a0b
jmp 0x1003df5f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x818]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x818], eax
mov eax, dword [ebp - 0x3d0]
inc eax
mov dword [ebp - 0x3d0], eax
lea eax, [ebp - 0x584]
push eax
lea ecx, [ebp - 0x9f0]
call fcn.100212bf
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp - 0x63c]
mov dword [ebp - 0x5cc], eax
mov dword [ebp - 4], 1
push 0xa
xor edx, edx
mov ecx, dword [ebp - 0x5cc]
call fcn.10029de0
pop ecx
mov dword [ebp - 0x5d4], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9f0]
call fcn.1001616e
mov dword [ebp - 0xb8], 0x60477862
mov dword [ebp - 0x19c], 0xf6d4a0d4
mov dword [ebp - 0x78], 0
jmp 0x1003e018
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1003e02e
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x10c], 3
jmp 0x1003e011
mov dword [ebp - 0x78], 0
jmp 0x1003e03e
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1003e054
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0x590], 0xc5336de0
jmp 0x1003e037
mov dword [ebp - 0xb8], 0
jmp 0x1003e06d
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 7
jne 0x1003e0d5
mov dword [ebp - 0xe8], 9
mov dword [ebp - 0xe8], 0
jmp 0x1003e099
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0
jl 0x1003e0d3
mov byte [ebp - 0x8e], 0
lea eax, [ebp - 0x8e]
push eax
push 0x2936
push 0
call fcn.1003c319
add esp, 0xc
mov eax, dword [ebp - 0xe8]
cmp dword [ebp + eax*4 - 0x10c], 0
je 0x1003e0d1
jmp 0x1003e0d3
jmp 0x1003e08c
jmp 0x1003e060
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x790], eax
mov dword [ebp - 0x19c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10c]
cmp dword [ebp - 0x19c], eax
jl 0x1003e128
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10c]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
je 0x1003e128
mov dword [ebp - 0x2c8], 1
jmp 0x1003e12f
and dword [ebp - 0x2c8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x2c8]
mov dword [ebp + eax - 0x590], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10c]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x10c]
mov ecx, dword [ebp - 0x2c8]
sub ecx, eax
mov dword [ebp - 0xb8], ecx
and dword [ebp - 0x1dc], 0
jmp 0x1003e181
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0xb
jae 0x1003e19a
mov eax, dword [ebp - 0x1dc]
mov byte [ebp + eax - 0x584], 0
jmp 0x1003e174
push dword [ebp - 0x5d4]
push dword [ebp - 0x644]
call fcn.10038ff1
pop ecx
pop ecx
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x4a0]
mov dword [eax + 8], ecx
mov dword [ebp - 0x1ec], 0x1cecb457
mov dword [ebp - 0x754], 0x65c829e
mov dword [ebp - 0x5dc], 0xce96f8f9
mov dword [ebp - 0x1a4], 0
jmp 0x1003e1f9
mov eax, dword [ebp - 0x1a4]
inc eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 3
jge 0x1003e215
mov eax, dword [ebp - 0x1a4]
mov dword [ebp + eax*4 - 0x9fc], 0x9841b3c6
jmp 0x1003e1ec
mov dword [ebp - 0x1ec], 0
jmp 0x1003e22e
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 2
jg 0x1003e2ab
mov dword [ebp - 0x798], 0xfffffffa
mov dword [ebp - 0x1ac], 0
jmp 0x1003e25a
mov eax, dword [ebp - 0x1ac]
inc eax
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 1
jge 0x1003e276
mov eax, dword [ebp - 0x1ac]
mov dword [ebp + eax*4 - 0x760], 2
jmp 0x1003e24d
mov byte [ebp - 0xad], 0
movzx eax, byte [ebp - 0xad]
test eax, eax
je 0x1003e290
push 1
call fcn.1003b914
pop ecx
push 1
lea eax, [ebp - 0x5dc]
push eax
push 0x33c2
call fcn.1003b987
add esp, 0xc
jmp 0x1003e221
push 0x10f2
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
call fcn.1003ba0d
add esp, 0x10
mov dword [ebp - 0xa4], 0x3ae35568
mov dword [ebp - 0x2e4], 0xb61b
mov dword [ebp - 0x158], 0
jmp 0x1003e2f2
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 3
jge 0x1003e30e
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x828], 0xeb905d09
jmp 0x1003e2e5
mov dword [ebp - 0xa4], 0
jmp 0x1003e327
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0xa
je 0x1003e4b5
mov dword [ebp - 0xc0], 0xd526d2e8
mov dword [ebp - 0x3e0], 0x1615e82a
mov dword [ebp - 0x540], 0
mov dword [ebp - 0x698], 0xdd711a53
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x7a0], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x7a8], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x76c], eax
cmp dword [ebp - 0xa4], 0
jne 0x1003e3ae
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x828], 0
jne 0x1003e3ae
and dword [ebp - 0x3d8], 0
jmp 0x1003e3b8
mov dword [ebp - 0x3d8], 1
mov eax, dword [ebp - 0x2e4]
imul eax, dword [ebp - 0x3d8]
add eax, 0x3072c02a
cmp eax, 0x4b15d3e9
jne 0x1003e3dd
mov dword [ebp - 0x508], 1
jmp 0x1003e3e4
and dword [ebp - 0x508], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x508], eax
jg 0x1003e3fe
mov dword [ebp - 0x4a8], 1
jmp 0x1003e405
and dword [ebp - 0x4a8], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x3e0], eax
mov eax, dword [ebp - 0x3e0]
cmp eax, dword [ebp - 0x4a8]
jg 0x1003e42b
mov dword [ebp - 0x3e8], 1
jmp 0x1003e432
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0x540], eax
cmp dword [ebp - 0x540], 0
ja 0x1003e450
cmp dword [ebp - 0xc0], 0
jne 0x1003e462
cmp dword [ebp - 0x2e4], 0
jne 0x1003e462
and dword [ebp - 0x3f0], 0
jmp 0x1003e46c
mov dword [ebp - 0x3f0], 1
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x3f0], eax
jg 0x1003e486
mov dword [ebp - 0x2d0], 1
jmp 0x1003e48d
and dword [ebp - 0x2d0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2d0]
mov dword [ebp + eax - 0x828], ecx
imul eax, dword [ebp - 0x2d0], 0xffff
mov dword [ebp - 0x698], eax
jmp 0x1003e31a
and dword [ebp - 0xe4], 0
mov dword [ebp - 0x5e4], 0xb3895196
mov dword [ebp - 0x5ec], 1
mov dword [ebp - 0x60], 0
jmp 0x1003e4e0
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x1003e4f6
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x6d4], 0x7117
jmp 0x1003e4d9
mov dword [ebp - 0x60], 0
jmp 0x1003e506
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 3
jge 0x1003e51c
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x310], 0
jmp 0x1003e4ff
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x310], 2
jmp 0x1003e54a
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x310]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x310], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x310], 0
jl 0x1003e70b
mov dword [ebp - 0x2e8], 0xb6890635
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x6d4], 0
jne 0x1003e584
mov dword [ebp - 0x4b0], 1
jmp 0x1003e58b
and dword [ebp - 0x4b0], 0
cmp dword [ebp - 0x4b0], 0xfff9
jb 0x1003e5a3
mov dword [ebp - 0x408], 1
jmp 0x1003e5aa
and dword [ebp - 0x408], 0
mov eax, dword [ebp - 0x5e4]
mov dword [ebp - 0x858], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6d4]
push 4
pop ecx
shl ecx, 1
imul eax, dword [ebp + ecx - 0x310]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x310]
jl 0x1003e5eb
mov dword [ebp - 0x3f8], 1
jmp 0x1003e5f2
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x3f8]
add eax, 0x8af
imul eax, eax, 0xffffffff
imul eax, eax, 0xbc6c
add eax, dword [ebp - 0x2e8]
je 0x1003e61f
or eax, 0xffffffff
je 0x1003e61f
mov dword [ebp - 0x510], 1
jmp 0x1003e626
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x510]
sub eax, 0x35c155c2
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x6d4]
jle 0x1003e64b
mov dword [ebp - 0x400], 1
jmp 0x1003e652
and dword [ebp - 0x400], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x400]
sub ecx, dword [ebp + eax - 0x310]
cmp ecx, dword [ebp - 0x2e8]
jge 0x1003e679
mov dword [ebp - 0x4b8], 1
jmp 0x1003e680
and dword [ebp - 0x4b8], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x310]
cmp dword [ebp - 0x4b8], eax
jg 0x1003e6a0
mov dword [ebp - 0x544], 1
jmp 0x1003e6a7
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x408]
cmp eax, dword [ebp - 0x544]
jl 0x1003e6c1
mov dword [ebp - 0x410], 1
jmp 0x1003e6c8
and dword [ebp - 0x410], 0
cmp dword [ebp - 0x410], 0xfed6
jne 0x1003e6e0
mov dword [ebp - 0x64c], 1
jmp 0x1003e6e7
and dword [ebp - 0x64c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x310]
mov dword [ebp - 0x774], eax
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x5ec], eax
jmp 0x1003e52f
lea eax, [ebp - 0x10]
push eax
push 0xa70
push 1
lea eax, [ebp - 0xe4]
push eax
call fcn.1003ba68
add esp, 0x10
mov dword [ebp - 0xf4], 4
mov dword [ebp - 0x1f4], 0
jmp 0x1003e748
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 1
jge 0x1003e764
mov eax, dword [ebp - 0x1f4]
mov dword [ebp + eax*4 - 0x80c], 0x905d09ea
jmp 0x1003e73b
mov dword [ebp - 0xf4], 0xfffffff5
jmp 0x1003e77d
mov eax, dword [ebp - 0xf4]
dec eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xffffffef
jl 0x1003e7b3
cmp dword [ebp - 0xf4], 0
je 0x1003e791
jmp 0x1003e7b3
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x1003e7b1
push 0x41a
push 1
call fcn.1003bac7
pop ecx
pop ecx
jmp 0x1003e770
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x344], 0x881dda8
mov dword [ebp - 0x654], 1
mov dword [ebp - 0x1b8], 0
jmp 0x1003e7e9
mov eax, dword [ebp - 0x1b8]
inc eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 1
jge 0x1003e802
mov eax, dword [ebp - 0x1b8]
mov dword [ebp + eax*4 - 0x24], 0x8cff0ea7
jmp 0x1003e7dc
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x24], 0
jmp 0x1003e827
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x24], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24], 0xfffffff7
je 0x1003ed7b
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x1c0], 0xffffffff
mov dword [ebp - 0x5c], 0xd8339896
mov dword [ebp - 0x1e4], 0
jmp 0x1003e869
mov eax, dword [ebp - 0x1e4]
inc eax
mov dword [ebp - 0x1e4], eax
cmp dword [ebp - 0x1e4], 4
jge 0x1003e885
mov eax, dword [ebp - 0x1e4]
mov dword [ebp + eax*4 - 0x6b8], 0xffffffff
jmp 0x1003e85c
mov dword [ebp - 0x1c], 0xffffffe8
jmp 0x1003e895
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jne 0x1003e993
mov dword [ebp - 0x680], 8
mov dword [ebp - 0x4c0], 0xffffffff
cmp dword [ebp - 0x680], 0
je 0x1003e918
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x77c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x830], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
mov dword [ebp - 0x784], eax
push 3
pop eax
sub eax, dword [ebp - 0x4c0]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x24]
cmp dword [ebp - 0x1c], eax
je 0x1003e8ff
cmp dword [ebp - 0x4c0], 0
jne 0x1003e903
cmp dword [ebp - 0x1c], 0
mov eax, 0x9576
test eax, eax
je 0x1003e918
mov dword [ebp - 0x418], 1
jmp 0x1003e91f
and dword [ebp - 0x418], 0
cmp dword [ebp - 0x418], 0xfffffffa
je 0x1003e935
xor eax, eax
jne 0x1003e935
and dword [ebp - 0x518], 0
jmp 0x1003e93f
mov dword [ebp - 0x518], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
cmp eax, dword [ebp - 0x518]
jg 0x1003e95d
mov dword [ebp - 0x420], 1
jmp 0x1003e964
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0x420], eax
je 0x1003e97e
mov dword [ebp - 0x4c8], 1
jmp 0x1003e985
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x5c], eax
jmp 0x1003e88e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x24], 0
je 0x1003ec23
mov dword [ebp - 0xd0], 0x809b4af7
cmp dword [ebp - 0xd0], 0
je 0x1003e9e5
mov dword [ebp - 0x5f4], 4
lea eax, [ebp - 0x344]
push eax
push 1
lea eax, [ebp - 0xd0]
push eax
call fcn.1003bb03
add esp, 0xc
mov dword [ebp - 0x5f4], 0xb51f0ef2
jmp 0x1003ea23
mov dword [ebp - 0x1c], 3
jmp 0x1003e9f5
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x1003ea23
mov dword [ebp - 0x5c], 0
jmp 0x1003ea0b
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 4
jge 0x1003ea21
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x6b8], 0x214f1636
jmp 0x1003ea04
jmp 0x1003e9ee
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x1003ea3f
cmp dword [ebp - 0x654], 0
je 0x1003ea3f
mov dword [ebp - 0x31c], 1
jmp 0x1003ea46
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0xd0]
cmp dword [ebp - 0x1c0], eax
je 0x1003ea60
mov dword [ebp - 0x428], 1
jmp 0x1003ea67
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x428]
neg eax
je 0x1003ea78
cmp dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x1c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x24]
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x6b8]
jle 0x1003eab0
mov dword [ebp - 0x54c], 1
jmp 0x1003eab7
and dword [ebp - 0x54c], 0
cmp dword [ebp - 0x54c], 0x7519ba60
jne 0x1003eacf
mov dword [ebp - 0x430], 1
jmp 0x1003ead6
and dword [ebp - 0x430], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
cmp dword [ebp - 0x430], eax
jle 0x1003eaf4
mov dword [ebp - 0x2d8], 0xfffffff9
mov dword [ebp - 0x33c], 0xfd24bd9f
cmp dword [ebp - 0x1c], 0
je 0x1003ec4f
cmp dword [ebp - 0x1c], 0
je 0x1003ec4f
mov dword [ebp - 0x34c], 1
jmp 0x1003ec56
and dword [ebp - 0x34c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x6b8]
mov dword [ebp - 0x78c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x834], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x24]
mov dword [ebp - 0x794], eax
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x82c], eax
mov eax, dword [ebp - 0x2d8]
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0
je 0x1003ecb5
cmp dword [ebp - 0x344], 0
je 0x1003ecb5
and dword [ebp - 0x5fc], 0
jmp 0x1003ecbf
mov dword [ebp - 0x5fc], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6b8]
mov dword [ebp - 0x79c], eax
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0x5c], eax
jg 0x1003ece9
mov dword [ebp - 0x354], 1
jmp 0x1003ecf0
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0x34c]
cmp eax, dword [ebp - 0x354]
jl 0x1003ed0a
mov dword [ebp - 0x35c], 1
jmp 0x1003ed11
and dword [ebp - 0x35c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x6b8]
imul eax, dword [ebp - 0x35c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x24]
jl 0x1003ed43
cmp dword [ebp - 0x2d8], 0
jne 0x1003ed43
and dword [ebp - 0x364], 0
jmp 0x1003ed4d
mov dword [ebp - 0x364], 1
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x88], 0
movzx eax, byte [ebp - 0x88]
test eax, eax
je 0x1003ed76
push 0
push 0x838
call fcn.1003bd29
pop ecx
pop ecx
jmp 0x1003e812
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
sub eax, dword [ebp - 0xe4]
mov dword [ebp - 0xcc], eax
and dword [ebp - 0x11c], 0
jmp 0x1003eda3
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
cmp eax, dword [ebp - 0xcc]
jge 0x1003ee3c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
sub eax, dword [ecx + 0x18]
cmp dword [ebp - 0x11c], eax
jae 0x1003edef
lea eax, [ebp - 0x36c]
push eax
lea eax, [ebp - 0x11c]
push eax
push 1
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.1003bb5d
add esp, 0x18
jmp 0x1003ee11
push 0
push 0x1acc
lea eax, [ebp - 0x36c]
push eax
lea eax, [ebp - 0xc8]
push eax
push 0x106a
call fcn.1003c089
add esp, 0x14
lea eax, [ebp - 0x30]
push eax
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x36c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.1003bbec
add esp, 0x14
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 0x14], eax
jmp 0x1003ed96
mov dword [ebp - 0x74], 2
mov dword [ebp - 0x68c], 0xfffffffd
mov dword [ebp - 0x114], 0xffffffff
mov dword [ebp - 0x6c], 0
jmp 0x1003ee67
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x1003ee7d
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x750], 0x4d07ddbf
jmp 0x1003ee60
mov dword [ebp - 0x6c], 0
jmp 0x1003ee8d
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 3
jge 0x1003eea3
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x8cc], 0xfffffff9
jmp 0x1003ee86
mov dword [ebp - 0x74], 0
jmp 0x1003eeb3
cmp dword [ebp - 0x74], 0x1d
jge 0x1003f0c4
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x2ec], 0x86335c0d
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xfc], 0xf285f402
cmp dword [ebp - 0x48], 0x3d6c
jge 0x1003eef7
mov dword [ebp - 0x374], 1
jmp 0x1003eefe
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x68c], eax
mov dword [ebp - 0x2ec], 0xfffffff7
cmp dword [ebp - 0x2ec], 0
je 0x1003ef32
cmp dword [ebp - 0x2ec], 0
je 0x1003ef32
mov dword [ebp - 0x37c], 1
jmp 0x1003ef39
and dword [ebp - 0x37c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x37c]
mov dword [ebp + eax - 0x750], ecx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x83c], eax
mov eax, 0x813c27f
sub eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x74]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x7a4], eax
xor eax, eax
sub eax, 0x7a7b
add eax, dword [ebp - 0x74]
neg eax
mov dword [ebp - 0x384], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x384]
mov dword [ebp + eax - 0x8cc], ecx
mov eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x384]
jne 0x1003efae
mov dword [ebp - 0x604], 1
jmp 0x1003efb5
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x7ac], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x7b4], eax
imul eax, dword [ebp - 0x74], 0xd9e9
cmp eax, dword [ebp - 0x48]
jge 0x1003eff1
mov dword [ebp - 0x38c], 1
jmp 0x1003eff8
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xfc], 0
jmp 0x1003f01d
cmp dword [ebp - 0xfc], 2
jg 0x1003f0bf
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
sub eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x14], eax
mov dword [ebp - 0xc4], 0xfebaeef2
mov dword [ebp - 0x394], 0xa561
mov dword [ebp - 0x1e8], 0x2500428
mov dword [ebp - 0x3bc], 1
mov dword [ebp - 0x860], 1
mov dword [ebp - 0x7c], 0
jmp 0x1003f118
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 4
jge 0x1003f12e
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x8f0], 1
jmp 0x1003f111
mov dword [ebp - 0x7c], 0
jmp 0x1003f13e
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 4
jge 0x1003f154
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x89c], 0xffffffff
jmp 0x1003f137
mov dword [ebp - 0xc4], 3
jmp 0x1003f16d
cmp dword [ebp - 0xc4], 0
jl 0x1003f399
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x620], eax
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0x628], eax
mov eax, dword [ebp - 0x628]
movzx eax, byte [eax]
test eax, eax
je 0x1004078f
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret