Function at 0x7de0854b
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get process heap flags
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xffffffe0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x3f8
mov eax, dword [0x7de403ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x24]
xor ecx, ecx
test dword [ebx + 0x14], 0xfffffffe
mov dword [ebp - 0x2dc], eax
push esi
mov esi, dword [ebx + 0x10]
mov eax, 0x38ee
push edi
mov edi, dword [ebx + 0xc]
mov word [ebp - 0x22c], ax
mov eax, 0x11d1
mov dword [ebp - 0x2ac], edi
mov dword [ebp - 0x2b0], esi
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x27c], ecx
mov dword [ebp - 0x270], ecx
mov dword [ebp - 0x274], ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x248], ecx
mov dword [ebp - 0x2a0], ecx
mov dword [ebp - 0x29c], ecx
mov dword [ebp - 0x254], ecx
mov dword [ebp - 0x2b4], ecx
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x250], ecx
mov dword [ebp - 0x284], ecx
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x2a4], ecx
mov dword [ebp - 0x294], ecx
mov dword [ebp - 0x230], 0xf750e6c3
mov word [ebp - 0x22a], ax
mov byte [ebp - 0x228], 0x85
mov byte [ebp - 0x227], 0xe5
mov byte [ebp - 0x226], cl
mov byte [ebp - 0x225], 0xc0
mov byte [ebp - 0x224], 0x4f
mov byte [ebp - 0x223], 0xc2
mov byte [ebp - 0x222], 0x95
mov byte [ebp - 0x221], 0xee
jne 0x7de086ba
movzx eax, byte [ebx + 8]
mov dword [ebp - 0x280], eax
dec eax
je 0x7de089a6
dec eax
je 0x7de08935
dec eax
dec eax
je 0x7de08935
sub eax, 4
je 0x7de086a5
sub eax, 8
jne 0x7de086ba
cmp edi, ecx
jne 0x7de086ba
cmp esi, ecx
je 0x7de086ba
cmp word [esi], cx
je 0x7de086ba
mov dword [ebp - 0x238], 0x7de09698
jmp 0x7de08a17
cmp esi, ecx
jne 0x7de086ba
cmp edi, ecx
je 0x7de08861
cmp word [edi], cx
jne 0x7de08926
mov dword [ebp - 0x234], 0xc000000d
mov dword [ebp - 0x24c], 1
mov eax, dword [ebp - 0x2dc]
test eax, eax
je 0x7de086e0
mov ecx, dword [ebp - 0x24c]
mov dword [eax], ecx
cmp dword [ebp - 0x264], 0
je 0x7de086fc
push dword [ebp - 0x264]
call dword [sym.imp.ntdll.dll_NtClose]
and dword [ebp - 0x264], 0
cmp dword [ebp - 0x248], 0
je 0x7de08718
push dword [ebp - 0x248]
call dword [sym.imp.ntdll.dll_NtClose]
and dword [ebp - 0x248], 0
cmp dword [ebp - 0x23c], 0
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
je 0x7de0873d
push dword [ebp - 0x23c]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call esi
cmp dword [ebp - 0x254], 0
je 0x7de0875c
push dword [ebp - 0x254]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call esi
mov eax, dword [ebp - 0x260]
mov edi, dword [ebp - 0x284]
test eax, eax
je 0x7de0878b
cmp eax, dword [ebp - 0x2ac]
je 0x7de0878b
cmp edi, eax
jne 0x7de0877a
xor edi, edi
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call esi
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x7de087b4
cmp eax, dword [ebp - 0x2ac]
je 0x7de087b4
cmp edi, eax
jne 0x7de087a3
xor edi, edi
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call esi
mov eax, dword [ebp - 0x27c]
test eax, eax
je 0x7de087dd
cmp eax, dword [ebp - 0x2b0]
je 0x7de087dd
cmp edi, eax
jne 0x7de087cc
xor edi, edi
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call esi
mov eax, dword [ebp - 0x274]
test eax, eax
je 0x7de08806
cmp eax, dword [ebp - 0x2b0]
je 0x7de08806
cmp edi, eax
jne 0x7de087f5
xor edi, edi
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call esi
test edi, edi
je 0x7de0881b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call esi
cmp dword [ebp - 0x294], 0
je 0x7de08832
push 0
push dword [ebp - 0x294]
call dword [ebp - 0x2a4]
cmp dword [ebp - 0x26c], 0
je 0x7de08846
push dword [ebp - 0x26c]
call fcn.7dd724bc
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x234]
pop edi
xor ecx, ebp
pop esi
call fcn.7dd71442
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x20
lea eax, [ebp - 0x2b8]
push eax
mov dword [ebp - 0x2b8], ecx
call dword [sym.imp.ntdll.dll_NtQueryInstallUILanguage]
mov dword [ebp - 0x234], eax
test eax, eax
jl 0x7de086c4
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0xac
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x284], eax
test eax, eax
jne 0x7de088b4
mov dword [ebp - 0x234], 0xc0000017
jmp 0x7de086c4
mov dword [ebp - 0x2bc], eax
mov eax, 0xaa
mov word [ebp - 0x2be], ax
xor eax, eax
mov word [ebp - 0x2c0], ax
lea eax, [ebp - 0x2c0]
push eax
movzx eax, word [ebp - 0x2b8]
push eax
call dword [sym.imp.ntdll.dll_RtlLCIDToCultureName]
test al, al
jne 0x7de088f7
mov dword [ebp - 0x234], 0xc00000e5
jmp 0x7de086c4
mov eax, dword [ebp - 0x2bc]
lea ecx, [ebp - 0x270]
push ecx
push eax
mov dword [ebp - 0x260], eax
call dword [sym.imp.ntdll.dll_RtlpConvertCultureNamesToLCIDs]
mov dword [ebp - 0x234], eax
test eax, eax
jl 0x7de086c4
or dword [ebx + 8], 0x100
mov dword [ebp - 0x238], 0x7de09680
jmp 0x7de089d2
cmp esi, ecx
jne 0x7de086ba
cmp edi, ecx
je 0x7de086ba
cmp word [edi], cx
je 0x7de086ba
push edi
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
cmp word [ebp - 0x25c], 2
jb 0x7de086ba
movzx eax, word [ebp - 0x25c]
mov ecx, dword [ebp - 0x258]
shr eax, 1
cmp word [ecx + eax*2 + 2], 0
jne 0x7de086ba
cmp dword [ebp - 0x280], 2
jne 0x7de0899a
mov dword [ebp - 0x238], 0x7de09670
jmp 0x7de089d2
mov dword [ebp - 0x238], 0x7de0965c
jmp 0x7de089d2
cmp edi, ecx
je 0x7de086ba
cmp esi, ecx
je 0x7de086ba
cmp word [edi], cx
je 0x7de086ba
cmp word [esi], cx
je 0x7de086ba
mov dword [ebp - 0x238], 0x7de09640
test edi, edi
je 0x7de08a17
test dword [ebx + 8], 0x100
je 0x7de089f5
lea eax, [ebp - 0x260]
push eax
push edi
mov dword [ebp - 0x270], edi
call dword [sym.imp.ntdll.dll_RtlpConvertLCIDsToCultureNames]
jmp 0x7de08a09
lea eax, [ebp - 0x270]
push eax
push edi
mov dword [ebp - 0x260], edi
call dword [sym.imp.ntdll.dll_RtlpConvertCultureNamesToLCIDs]
mov dword [ebp - 0x234], eax
test eax, eax
jl 0x7de086c4
test esi, esi
je 0x7de08a5c
test dword [ebx + 8], 0x100
je 0x7de08a3a
lea eax, [ebp - 0x27c]
push eax
push esi
mov dword [ebp - 0x274], esi
call dword [sym.imp.ntdll.dll_RtlpConvertLCIDsToCultureNames]
jmp 0x7de08a4e
lea eax, [ebp - 0x274]
push eax
push esi
mov dword [ebp - 0x27c], esi
call dword [sym.imp.ntdll.dll_RtlpConvertCultureNamesToLCIDs]
mov dword [ebp - 0x234], eax
test eax, eax
jl 0x7de086c4
mov eax, dword [ebx + 0x18]
or eax, dword [ebx + 0x1c]
mov edi, dword [sym.imp.ntdll.dll_EtwEventWrite]
je 0x7de08bde
mov esi, 0x7de09578
push esi
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x7de08bde
and dword [ebp - 0x28c], 0
and dword [ebp - 0x278], 0
lea eax, [ebp - 0x28c]
push eax
push dword [ebp - 0x2ac]
call fcn.7de08421
test eax, eax
jl 0x7de08b98
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x2b0]
call fcn.7de08421
test eax, eax
jl 0x7de08b98
mov edx, dword [ebp - 0x28c]
lea eax, [ebx + 8]
mov dword [ebp - 0x3e0], eax
mov eax, edx
xor ecx, ecx
lea edi, [eax + 2]
mov dword [ebp - 0x3dc], ecx
mov dword [ebp - 0x3d8], 4
mov dword [ebp - 0x3d4], ecx
mov dword [ebp - 0x298], edi
mov di, word [eax]
inc eax
inc eax
cmp di, cx
jne 0x7de08afc
sub eax, dword [ebp - 0x298]
mov dword [ebp - 0x3d0], edx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x3cc], ecx
mov dword [ebp - 0x3c4], ecx
lea edx, [eax + 2]
mov di, word [eax]
inc eax
inc eax
cmp di, cx
jne 0x7de08b33
mov edi, dword [sym.imp.ntdll.dll_EtwEventWrite]
sub eax, edx
mov edx, dword [ebp - 0x278]
sar eax, 1
lea eax, [eax + eax + 2]
push 4
mov dword [ebp - 0x3b8], eax
lea eax, [ebx + 0x14]
mov dword [ebp - 0x3bc], ecx
mov dword [ebp - 0x3b4], ecx
mov dword [ebp - 0x3b0], eax
pop eax
mov dword [ebp - 0x3ac], ecx
mov dword [ebp - 0x3a4], ecx
lea ecx, [ebp - 0x3e0]
push ecx
push eax
push esi
push dword [ebx + 0x1c]
mov dword [ebp - 0x3c0], edx
push dword [ebx + 0x18]
mov dword [ebp - 0x3a8], eax
call edi
cmp dword [ebp - 0x28c], 0
je 0x7de08bbb
push dword [ebp - 0x28c]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x278], 0
je 0x7de08bde
push dword [ebp - 0x278]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push 0x7ddb3938
call sym.KERNEL32.dll_LoadLibraryW
mov dword [ebp - 0x26c], eax
test eax, eax
jne 0x7de08c01
mov dword [ebp - 0x234], 0xc00000e5
jmp 0x7de086ce
push 0x7ddb391c
push dword [ebp - 0x26c]
call fcn.7dd7122f
push 0x7ddb3900
push dword [ebp - 0x26c]
mov esi, eax
call fcn.7dd7122f
mov dword [ebp - 0x2a4], eax
test esi, esi
je 0x7de08bf2
test eax, eax
je 0x7de08bf2
push 0
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x294]
push eax
call esi
test eax, eax
je 0x7de08bf2
push 0x7de095b8
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor eax, eax
mov dword [ebp - 0x2d4], eax
mov dword [ebp - 0x2c8], eax
mov dword [ebp - 0x2c4], eax
lea eax, [ebp - 0x2d8]
push eax
push 0x20019
lea eax, [ebp - 0x264]
lea ecx, [ebp - 0x25c]
push eax
mov dword [ebp - 0x2d8], 0x18
mov dword [ebp - 0x2cc], 0x40
mov dword [ebp - 0x2d0], ecx
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov dword [ebp - 0x234], eax
test eax, eax
jge 0x7de08cc7
cmp eax, 0xc0000034
jne 0x7de086ce
and dword [ebp - 0x234], 0
jmp 0x7de086ce
mov ecx, dword fs:[0x18]
mov esi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov eax, 0x216
push eax
mov dword [ebp - 0x288], eax
mov eax, dword [ecx + 0x30]
push 8
push dword [eax + 0x18]
call esi
mov dword [ebp - 0x23c], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x20a
push 8
push dword [eax + 0x18]
call esi
cmp dword [ebp - 0x23c], 0
mov dword [ebp - 0x254], eax
je 0x7de088a5
test eax, eax
je 0x7de088a5
mov dword [ebp - 0x240], eax
xor eax, eax
and dword [ebp - 0x2a8], 0
mov word [ebp - 0x244], ax
mov eax, 0x208
mov word [ebp - 0x242], ax
lea eax, [ebp - 0x2a0]
push eax
push 0x1fe
lea eax, [ebp - 0x220]
push eax
push 0
push dword [ebp - 0x2a8]
push dword [ebp - 0x264]
call dword [sym.imp.ntdll.dll_NtEnumerateKey]
mov dword [ebp - 0x234], eax
test eax, eax
jl 0x7de094cf
mov eax, dword [ebp - 0x214]
lea ecx, [eax + 1]
cmp ecx, 0x1e8
jbe 0x7de08d97
mov dword [ebp - 0x234], 0xc0000017
jmp 0x7de094da
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x210], cx
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x25c]
push eax
call esi
mov eax, dword [ebp - 0x264]
and dword [ebp - 0x2c8], 0
and dword [ebp - 0x2c4], 0
mov dword [ebp - 0x2d4], eax
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x2d0], eax
lea eax, [ebp - 0x2d8]
push eax
push 0x20019
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 0x2d8], 0x18
mov dword [ebp - 0x2cc], 0x40
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov dword [ebp - 0x234], eax
test eax, eax
jl 0x7de094da
push 0x7de095a8
lea eax, [ebp - 0x25c]
push eax
call esi
mov esi, dword [ebp - 0x23c]
lea eax, [ebp - 0x2a0]
push eax
push dword [ebp - 0x288]
lea eax, [ebp - 0x25c]
push esi
push 2
push eax
push dword [ebp - 0x248]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov dword [ebp - 0x234], eax
test eax, eax
jl 0x7de094da
cmp dword [esi + 4], 4
jne 0x7de094da
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x29c], eax
test dword [ebp - 0x280], eax
je 0x7de094e1
push 0x7de09598
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x2a0]
push eax
push dword [ebp - 0x288]
lea eax, [ebp - 0x25c]
push esi
push 2
push eax
push dword [ebp - 0x248]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov dword [ebp - 0x234], eax
test eax, eax
jge 0x7de08fa3
cmp eax, 0x80000005
jne 0x7de08f96
mov eax, dword [esi + 8]
test eax, eax
jbe 0x7de094da
push dword [ebp - 0x23c]
lea esi, [eax + 2]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 0x254]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea ecx, [esi + 0xc]
push ecx
push 8
push dword [eax + 0x18]
mov dword [ebp - 0x288], ecx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x23c], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
cmp dword [ebp - 0x23c], 0
mov dword [ebp - 0x254], eax
je 0x7de08d88
test eax, eax
je 0x7de08d88
lea eax, [ebp - 0x2a0]
push eax
push dword [ebp - 0x288]
lea eax, [ebp - 0x25c]
push dword [ebp - 0x23c]
push 2
push eax
push dword [ebp - 0x248]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, dword [ebp - 0x23c]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jl 0x7de094da
cmp dword [esi + 4], 2
jne 0x7de094da
mov ecx, dword [esi + 8]
lea eax, [esi + 0xc]
shr ecx, 1
xor edx, edx
push eax
mov word [eax + ecx*2], dx
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov esi, dword [sym.imp.ntdll.dll_RtlExpandEnvironmentStrings_U]
lea eax, [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x25c]
push eax
push 0
call esi
mov dword [ebp - 0x234], eax
test eax, eax
jge 0x7de09060
cmp eax, 0xc0000023
jne 0x7de09058
push dword [ebp - 0x254]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword fs:[0x18]
push dword [ebp - 0x2b4]
mov eax, dword [eax + 0x30]
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x25c]
push eax
push 0
call esi
mov dword [ebp - 0x234], eax
test eax, eax
jl 0x7de094da
movzx eax, word [ebp - 0x244]
mov edx, dword [ebp - 0x240]
shr eax, 1
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x240]
call sub.ntdll.dll__wcslwr
pop ecx
push dword [ebp - 0x240]
call dword [sym.imp.ntdll.dll_RtlDoesFileExists_U]
test al, al
jne 0x7de090f7
mov eax, dword [ebx + 0x18]
or eax, dword [ebx + 0x1c]
je 0x7de094da
mov esi, 0x7de09568
push esi
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x7de094da
mov eax, dword [ebp - 0x240]
and dword [ebp - 0x30c], 0
mov dword [ebp - 0x310], eax
movzx eax, word [ebp - 0x244]
inc eax
inc eax
and dword [ebp - 0x304], 0
mov dword [ebp - 0x308], eax
lea eax, [ebp - 0x310]
push eax
push 1
push esi
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call edi
jmp 0x7de094da
push dword [ebx + 0x20]
push dword [ebp - 0x240]
push dword [ebp - 0x294]
push dword [ebp - 0x26c]
call fcn.7de07905
test al, al
jne 0x7de09188
mov eax, dword [ebx + 0x18]
or dword [ebp - 0x24c], 0x1000
or eax, dword [ebx + 0x1c]
je 0x7de094e1
push 0x7de09558
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x7de094e1
mov eax, dword [ebp - 0x240]
and dword [ebp - 0x2fc], 0
mov dword [ebp - 0x300], eax
movzx eax, word [ebp - 0x244]
inc eax
inc eax
and dword [ebp - 0x2f4], 0
mov dword [ebp - 0x2f8], eax
lea eax, [ebp - 0x300]
push eax
push 1
push 0x7de09558
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call edi
jmp 0x7de094e1
push dword [ebp - 0x240]
call sym.KERNEL32.dll_LoadLibraryW
mov dword [ebp - 0x268], eax
test eax, eax
jne 0x7de091f7
mov eax, dword [ebx + 0x18]
or eax, dword [ebx + 0x1c]
je 0x7de094da
mov esi, 0x7de09538
push esi
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x7de094da
mov eax, dword [ebp - 0x240]
and dword [ebp - 0x2ec], 0
mov dword [ebp - 0x2f0], eax
movzx eax, word [ebp - 0x244]
inc eax
inc eax
and dword [ebp - 0x2e4], 0
mov dword [ebp - 0x2e8], eax
lea eax, [ebp - 0x2f0]
jmp 0x7de090e6
push dword [ebp - 0x238]
mov esi, dword [ebp - 0x280]
push dword [ebp - 0x268]
call fcn.7dd7122f
and esi, 1
je 0x7de092d9
mov dword [ebp - 0x298], eax
test eax, eax
jne 0x7de09393
mov eax, dword [ebx + 0x18]
or eax, dword [ebx + 0x1c]
je 0x7de094da
push 0x7de09548
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x7de094da
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x340], eax
movzx eax, word [ebp - 0x244]
xor ecx, ecx
inc eax
inc eax
mov dword [ebp - 0x338], eax
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x33c], ecx
mov dword [ebp - 0x334], ecx
mov dword [ebp - 0x32c], ecx
mov dword [ebp - 0x328], 4
mov dword [ebp - 0x324], ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, cl
jne 0x7de0929e
mov edx, dword [ebp - 0x238]
sub eax, esi
inc eax
mov dword [ebp - 0x318], eax
mov dword [ebp - 0x320], edx
mov dword [ebp - 0x31c], ecx
mov dword [ebp - 0x314], ecx
lea eax, [ebp - 0x340]
push eax
push 3
push 0x7de09548
jmp 0x7de090ea
mov dword [ebp - 0x290], eax
test eax, eax
jne 0x7de09393
mov eax, dword [ebx + 0x18]
or eax, dword [ebx + 0x1c]
je 0x7de094da
push 0x7de09548
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x7de094da
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x370], eax
movzx eax, word [ebp - 0x244]
xor ecx, ecx
inc eax
inc eax
mov dword [ebp - 0x368], eax
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x36c], ecx
mov dword [ebp - 0x364], ecx
mov dword [ebp - 0x35c], ecx
mov dword [ebp - 0x358], 4
mov dword [ebp - 0x354], ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, cl
jne 0x7de09360
mov edx, dword [ebp - 0x238]
sub eax, esi
inc eax
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x350], edx
mov dword [ebp - 0x34c], ecx
mov dword [ebp - 0x344], ecx
lea eax, [ebp - 0x370]
jmp 0x7de092cc
cmp dword [ebp - 0x234], 0
jl 0x7de094da
test dword [ebp - 0x29c], 0x100
push dword [ebx + 0x14]
je 0x7de093e0
test esi, esi
je 0x7de093c7
push dword [ebp - 0x274]
push dword [ebp - 0x270]
call dword [ebp - 0x298]
jmp 0x7de0940f
test byte [ebp - 0x280], 0x10
je 0x7de093d8
push dword [ebp - 0x274]
jmp 0x7de09409
push dword [ebp - 0x270]
jmp 0x7de09409
test esi, esi
je 0x7de093f2
push dword [ebp - 0x27c]
push dword [ebp - 0x260]
jmp 0x7de093bf
test byte [ebp - 0x280], 0x10
je 0x7de09403
push dword [ebp - 0x27c]
jmp 0x7de09409
push dword [ebp - 0x260]
call dword [ebp - 0x290]
or dword [ebp - 0x24c], eax
mov dword [ebp - 0x250], eax
mov eax, dword [ebx + 0x18]
or eax, dword [ebx + 0x1c]
je 0x7de094e1
push 0x7de09588
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x7de094e1
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x3a0], eax
movzx eax, word [ebp - 0x244]
xor ecx, ecx
inc eax
inc eax
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x39c], ecx
mov dword [ebp - 0x394], ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, cl
jne 0x7de09472
mov edx, dword [ebp - 0x238]
sub eax, esi
inc eax
mov dword [ebp - 0x388], eax
lea eax, [ebp - 0x250]
mov dword [ebp - 0x380], eax
lea eax, [ebp - 0x3a0]
push eax
push 3
mov dword [ebp - 0x390], edx
mov dword [ebp - 0x38c], ecx
mov dword [ebp - 0x384], ecx
mov dword [ebp - 0x37c], ecx
mov dword [ebp - 0x378], 4
mov dword [ebp - 0x374], ecx
push 0x7de09588
jmp 0x7de0917b
cmp eax, 0x8000001a
je 0x7de08cbb
or dword [ebp - 0x24c], 1
cmp dword [ebp - 0x248], 0
je 0x7de094fd
push dword [ebp - 0x248]
call dword [sym.imp.ntdll.dll_NtClose]
and dword [ebp - 0x248], 0
cmp dword [ebp - 0x268], 0
je 0x7de09519
push dword [ebp - 0x268]
call dword [sym.imp.ntdll.dll_LdrUnloadDll]
and dword [ebp - 0x268], 0
inc dword [ebp - 0x2a8]
cmp dword [ebp - 0x234], 0x8000001a
jne 0x7de08d42
jmp 0x7de086ce