Function at 0x10036d69
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd20
mov eax, dword [0x10069224]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push ebx
mov ebx, dword [ebp + 8]
inc eax
push esi
mov dword [ebp - 0xbd8], ebx
cmp dword [ebp + 0xc], eax
jne 0x10041204
xor ebx, ebx
mov edx, 0x1006983c
mov dword [ebp - 0xbec], ebx
mov dword [ebp - 0xbe4], ebx
mov dword [ebp - 0xbcc], ebx
mov dword [ebp - 0xbd0], ebx
mov dword [ebp - 0xb08], ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10036dba
mov eax, dword [0x10069838]
mov esi, 0x7f1137f
mov dword [ebp - 0xb38], 0x10002e7a
mov dword [ebp - 0xb4c], 0x67
mov dword [ebp - 0xb04], 0x337
mov dword [ebp - 0xbac], 0x10b
mov dword [ebp - 0xb48], 0x20b
push edi
push 0
pop ebx
test eax, eax
jne 0x10037458
push 0x338
push ebx
mov dword [ebp - 0xbb0], ebx
mov dword [ebp - 0xad4], ebx
mov dword [ebp - 0xb14], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xadc], edi
test edi, edi
je 0x100373f7
or dword [ebp - 0xaf4], 0xffffffff
mov eax, ebx
mov dword [ebp - 0xae4], eax
mov cl, bl
mov dword [ebp - 0xb74], eax
mov eax, 0x7f1137f
mov edx, eax
mov dword [ebp - 0x3f0], esi
mov dword [ebp - 0xac4], 0x7f1137f
xor dword [ebp - 0xac4], 0xab69605e
mov dword [ebp - 0x3f4], 0xab69605e
movzx esi, word [ebp - 0x3f2]
shr edx, 0x10
add edi, 7
movzx eax, ax
mov dword [ebp - 0xabc], esi
mov esi, 0x10002e7a
mov dword [ebp - 0xae0], ebx
mov dword [ebp - 0xba8], ebx
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xb1c], edi
mov dword [ebp - 0xb18], 0x67
movzx edx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl edx, 8
or edx, eax
shl edi, 8
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
or edi, eax
mov dword [ebp - 0xb0c], edx
movzx eax, byte [esi + 4]
xor ebx, edx
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
add esi, 8
shl edi, 8
or edi, eax
mov dword [ebp - 0xad0], esi
mov eax, dword [ebp - 0xae4]
mov esi, dword [ebp - 0xac4]
xor eax, edi
xor esi, eax
xor esi, ebx
mov eax, esi
rol eax, 0xa
lea edx, [esi + 0x54969fa2]
rol edx, 5
imul edx, dword [ebp - 0xae8]
add edx, eax
xor ebx, edx
mov edx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea edx, [ebx + edx]
ror edx, 9
imul edx, dword [ebp - 0xabc]
sub edx, eax
xor esi, edx
mov eax, esi
sub eax, dword [ebp - 0xae8]
imul edx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xabc]
xor edx, ebx
mov eax, ebx
rol edx, 6
imul edx, dword [ebp - 0xacc]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0xae8]
imul eax, dword [ebp - 0xabc]
ror edx, 6
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
add eax, esi
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor ebx, edx
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
imul edx, dword [ebp - 0xacc]
mov eax, ebx
rol eax, 8
sub edx, eax
xor esi, edx
mov edx, esi
mov eax, esi
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, dword [ebp - 0xae8]
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xacc]
xor edx, ebx
mov eax, ebx
imul edx, dword [ebp - 0xabc]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xacc]
xor ebx, eax
mov esi, ebx
sub esi, dword [ebp - 0xacc]
xor esi, edx
mov edx, dword [ebp - 0xacc]
xor esi, 0xab69605e
xor edx, esi
mov eax, esi
rol edx, 2
imul edx, dword [ebp - 0xae8]
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, eax
mov eax, ebx
ror edx, 6
imul edx, dword [ebp - 0xabc]
rol eax, 7
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, dword [ebp - 0xae8]
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xabc]
xor edx, ebx
mov dword [ebp - 0xb00], ebx
rol edx, 5
mov eax, ebx
imul edx, dword [ebp - 0xacc]
rol eax, 7
add edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov ebx, esi
xor ebx, dword [ebp - 0xb00]
xor ebx, dword [ebp - 0xac4]
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xabc]
imul eax, dword [ebp - 0xae8]
xor esi, eax
mov eax, esi
sub eax, edx
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
lea edx, [ebx - 0x54969fa2]
rol edx, 3
mov eax, ebx
imul edx, dword [ebp - 0xacc]
rol eax, 0xe
add edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xae8]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
shr eax, 3
xor edx, 0x605e
imul edx, dword [ebp - 0xabc]
xor edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov eax, esi
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xaf4]
rol eax, 2
mov dword [ebp - 0xb74], esi
mov esi, dword [ebp - 0xad0]
xor edx, eax
mov dword [ebp - 0xaf4], edi
xor edx, dword [ebp - 0xae0]
xor ebx, edx
mov edx, dword [ebp - 0xb1c]
mov dword [ebp - 0xba8], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb74]
ror dword [ebp - 0xba8], 8
mov byte [edx], al
mov al, byte [ebp - 0xba8]
ror dword [ebp - 0xb74], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb74]
ror dword [ebp - 0xba8], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xba8]
ror dword [ebp - 0xb74], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb74]
ror dword [ebp - 0xba8], 8
mov byte [edx - 2], al
ror dword [ebp - 0xb74], 8
mov al, byte [ebp - 0xba8]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb74]
mov byte [edx - 3], al
add edx, 8
mov eax, dword [ebp - 0xb74]
mov ebx, dword [ebp - 0xba8]
ror eax, 8
ror ebx, 8
sub dword [ebp - 0xb18], 1
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0xb0c]
mov dword [ebp - 0xba8], ebx
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xb1c], edx
jne 0x10036ec9
mov esi, dword [ebp - 0xadc]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x10037237
movzx eax, cl
cdq
cmp eax, dword [0x100031b0]
jne 0x1003726c
cmp edx, dword [0x100031b4]
jne 0x1003726c
mov edi, esi
mov dword [ebp - 0xae4], 0x337
mov dword [ebp - 0xad4], edi
mov esi, ebx
jmp 0x1003727f
or dword [ebp - 0xae4], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xb14], 0xc004d501
test esi, esi
je 0x10037292
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb14], ebx
jl 0x100373f7
mov eax, dword [ebp - 0xae4]
mov esi, edi
push 0x40
push ebx
push 0x10069760
mov byte [eax + edi], bl
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], bl
je 0x100373fe
mov edi, 0x10069760
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xb00], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x100372d3
sub ecx, dword [ebp - 0xb00]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0x100373f7
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xae8], ecx
cmp word [eax], dx
je 0x1003731b
mov ecx, 0xc000007b
mov dword [ebp - 0xae8], ecx
jmp 0x10037363
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x1003730e
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x1003730e
cmp dword [edx], 0x4550
jne 0x1003730e
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xbac]
je 0x10037351
cmp ax, word [ebp - 0xb48]
je 0x10037351
mov ecx, 0xc000000d
jmp 0x10037313
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xad0], eax
mov dword [ebp - 0xae4], ebx
test eax, eax
je 0x100373de
mov edx, esi
mov dword [ebp - 0xb0c], esi
lea eax, [edx + 1]
mov dword [ebp - 0xb00], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x1003738a
sub edx, dword [ebp - 0xb00]
inc esi
add esi, edx
test ecx, ecx
js 0x100373c3
push dword [ebp - 0xb0c]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0x100373e9
mov ecx, dword [ebp - 0xbb0]
mov dword [ecx*4 + 0x10069030], eax
mov ecx, dword [ebp - 0xae8]
mov eax, dword [ebp - 0xae4]
inc dword [ebp - 0xbb0]
inc eax
mov dword [ebp - 0xae4], eax
cmp eax, dword [ebp - 0xad0]
jb 0x10037379
add edi, 0x10
cmp byte [esi], bl
jne 0x100372c6
mov esi, dword [ebp - 0xae8]
mov edi, dword [ebp - 0xad4]
jmp 0x10037400
mov esi, 0xc000007a
jmp 0x100373ef
mov esi, ebx
test edi, edi
je 0x10037413
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0x10037453
mov esi, ebx
mov eax, dword [esi + 0x10069760]
test eax, eax
je 0x1003742a
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x10037419
push 0x40
push ebx
push 0x10069760
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x10001490
mov edi, 0x10069030
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x1003745e
mov eax, dword [0x10069838]
inc eax
mov dword [0x10069838], eax
xor eax, eax
mov ecx, 0x1006983c
xchg dword [ecx], eax
mov eax, dword fs:[0x30]
mov edi, ebx
mov dword [ebp - 0xbfc], ebx
mov dword [ebp - 0xbf8], ebx
cmp dword [eax + 0x1d4], ebx
je 0x10037728
mov esi, dword [0x100690b8]
mov ecx, esi
call dword [0x100ad1dc]
call esi
mov ecx, eax
mov dword [ebp - 0xb00], ecx
test ecx, ecx
jne 0x100374ca
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x100374ba
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x10037730
mov edi, 0x80004005
jmp 0x10037730
mov dword [ebp - 0xbb4], ebx
mov edi, ebx
mov eax, ebx
mov esi, ebx
lea edx, [ebp - 0xc18]
push edx
push eax
push esi
mov esi, dword [0x100690c8]
push 2
push ecx
mov ecx, esi
call dword [0x100ad1dc]
call esi
test eax, eax
jne 0x10037566
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x10037551
cmp dword [ebp - 0xbb4], 0
jne 0x1003754a
push dword [ebp - 0xc18]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
lea ecx, [ebp - 0xbb4]
mov esi, eax
call fcn.10051c8c
test esi, esi
je 0x10037543
mov eax, dword [ebp - 0xc18]
mov ecx, dword [ebp - 0xb00]
mov dword [ebp - 0xbb4], esi
jmp 0x100374d6
mov edi, 0x8007000e
jmp 0x10037572
mov edi, 0x80004005
jmp 0x10037578
test eax, eax
je 0x1003754a
jg 0x1003755b
mov edi, eax
jmp 0x10037578
movzx edi, ax
or edi, 0x80070000
jmp 0x10037578
mov eax, dword [ebp - 0xbb4]
mov dword [ebp - 0xbfc], eax
mov dword [ebp - 0xbb4], ebx
lea ecx, [ebp - 0xbb4]
call fcn.10051c8c
test edi, edi
js 0x10037730
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
mov esi, dword [0x100690c4]
mov ecx, esi
push eax
call dword [0x100ad1dc]
call esi
mov ecx, eax
mov dword [ebp - 0xb00], ecx
test ecx, ecx
je 0x100374a3
mov dword [ebp - 0xbbc], ebx
mov edi, ebx
mov eax, ebx
mov esi, ebx
lea edx, [ebp - 0xc20]
push edx
push eax
push esi
mov esi, dword [0x100690c8]
push 2
push ecx
mov ecx, esi
call dword [0x100ad1dc]
call esi
test eax, eax
jne 0x1003764e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x10037639
cmp dword [ebp - 0xbbc], 0
jne 0x10037632
push dword [ebp - 0xc20]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
lea ecx, [ebp - 0xbbc]
mov esi, eax
call fcn.10051c8c
test esi, esi
je 0x1003762b
mov eax, dword [ebp - 0xc20]
mov ecx, dword [ebp - 0xb00]
mov dword [ebp - 0xbbc], esi
jmp 0x100375be
mov edi, 0x8007000e
jmp 0x1003765a
mov edi, 0x80004005
jmp 0x10037660
test eax, eax
je 0x10037632
jg 0x10037643
mov edi, eax
jmp 0x10037660
movzx edi, ax
or edi, 0x80070000
jmp 0x10037660
mov eax, dword [ebp - 0xbbc]
mov dword [ebp - 0xbf8], eax
mov dword [ebp - 0xbbc], ebx
lea ecx, [ebp - 0xbbc]
call fcn.10051c8c
test edi, edi
js 0x10037730
mov eax, dword [ebp - 0xbfc]
test eax, eax
je 0x10037728
mov ecx, 0x10002a60
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100376af
test dx, dx
je 0x100376a8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100376af
add eax, 4
add ecx, 4
test dx, dx
jne 0x10037686
xor esi, esi
mov eax, ebx
inc esi
jmp 0x100376b6
sbb eax, eax
xor esi, esi
inc esi
or eax, esi
test eax, eax
jne 0x10037728
mov eax, dword [ebp - 0xbf8]
test eax, eax
je 0x10037728
mov ecx, 0x10002a70
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100376ef
test dx, dx
je 0x100376eb
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100376ef
add eax, 4
add ecx, 4
test dx, dx
jne 0x100376c9
mov eax, ebx
jmp 0x100376f3
sbb eax, eax
or eax, esi
test eax, eax
jne 0x10037728
push 4
lea eax, [ebp - 0xc1c]
mov dword [ebp - 0xc1c], ebx
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
je 0x100374a3
test byte [ebp - 0xc1c], 0xf
mov eax, esi
je 0x1003772a
mov eax, ebx
mov dword [ebp - 0xb08], eax
lea ecx, [ebp - 0xbf8]
call fcn.10051c8c
lea ecx, [ebp - 0xbfc]
call fcn.10051c8c
test edi, edi
jns 0x10037750
mov dword [ebp - 0xb08], ebx
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea ecx, [ebp - 0xbd0]
mov dword [ebp - 0xad8], esi
call fcn.10051c75
test esi, esi
jne 0x10037833
mov dword [ebp - 0xbd0], ebx
mov dword [ebp - 0xab4], 0x8007000e
mov eax, dword [ebp - 0xbf0]
mov dword [ebp - 0xbcc], eax
xor ebx, ebx
mov edx, 0x1006983c
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10037798
mov eax, dword [0x10069838]
push 0
pop ebx
test eax, eax
jle 0x100377f5
sub eax, 1
mov dword [0x10069838], eax
jne 0x100377f5
mov edi, ebx
mov eax, dword [edi + 0x10069760]
test eax, eax
je 0x100377ce
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0x100377bd
push 0x40
push ebx
push 0x10069760
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x10001490
mov edi, 0x10069030
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0x1006983c
xchg dword [ecx], eax
lea ecx, [ebp - 0xbd0]
call fcn.10051c75
mov eax, dword [ebp - 0xab4]
pop edi
test eax, eax
jns 0x10041198
cmp eax, 0xd0000034
jne 0x10041159
mov eax, 0xc004f012
mov dword [ebp - 0xbe4], eax
jmp 0x100411af
xor eax, eax
mov dword [ebp - 0xbd0], esi
lea edi, [ebp - 0xb28]
mov dword [ebp - 0xad0], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xae0], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xbc8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xbb0], 0x38
mov dword [ebp - 0xb0c], esi
test esi, esi
jne 0x10037898
mov esi, 0xc0000017
mov edi, ebx
mov dword [ebp - 0xab4], esi
jmp 0x10037934
push edi
push 0x100692e8
push esi
call sub.msvcrt.dll_memcpy
mov edi, esi
add esp, 0xc
mov dword [ebp - 0xab8], edi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xadc], ecx
test ecx, ecx
jne 0x100378d9
mov esi, 0xc0000017
mov dword [ebp - 0xab4], esi
jmp 0x10037934
mov eax, dword [0x100692e0]
mov dword [ecx], eax
mov eax, dword [0x100692e4]
mov dword [ecx + 4], eax
mov dword [ebp - 0xad0], ecx
rdtsc
mov dword [ebp - 0xb44], eax
mov dword [ebp - 0xb34], edx
push 0xc
pop edi
lea eax, [ebp - 0xc00]
mov edx, SysReAllocString
push eax
mov ecx, 0x100026a0
call fcn.10051cc3
test eax, eax
jns 0x10037a3e
mov dword [ebp - 0xc00], ebx
mov esi, 0xc000003e
mov dword [ebp - 0xab4], esi
mov edi, dword [ebp - 0xab8]
cmp dword [ebp - 0xb20], 0
mov dword [ebp - 0xb24], ebx
mov dword [ebp - 0xb28], ebx
je 0x10037963
push dword [ebp - 0xb20]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xb20], ebx
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc4], ebx
mov dword [ebp - 0xbc8], ebx
test eax, eax
je 0x1003798e
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xbc0], ebx
test edi, edi
je 0x100379a1
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xad0]
test eax, eax
je 0x100379ba
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x10037785
mov eax, dword [ebp - 0xb08]
test eax, eax
je 0x10041142
mov dword [0x10069754], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x2c0]
mov dword [ebp - 0xc88], ebx
push eax
push 0x10000000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0x1003f006
cmp eax, esi
jne 0x10037a0e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0x1003f006
mov esi, dword [0x100690ac]
mov ecx, esi
push 0x403
push ebx
push ebx
call dword [0x100ad1dc]
call esi
mov dword [ebp - 0xae8], eax
test eax, eax
jne 0x1003a525
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x1003f006
mov eax, dword [ebp - 0xc00]
inc eax
push 4
mov dword [ebp - 0xc00], eax
pop edx
lea eax, [eax*2 + 4]
cmp eax, edx
jb 0x10037a5d
mov ecx, eax
jmp 0x10037a60
or ecx, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, edx
jb 0x1003792e
mov edi, ecx
lea ecx, [edi + 0xc4]
mov edx, 0xc4
cmp ecx, edx
jb 0x10037a8d
mov eax, ecx
jmp 0x10037a90
or eax, 0xffffffff
cmp ecx, edx
sbb esi, esi
and esi, 0xc0000095
add esi, 0x10000000
mov dword [ebp - 0xab4], esi
cmp ecx, edx
jb 0x1003a502
lea edx, [eax + 8]
cmp edx, eax
jb 0x10037ab9
mov ecx, edx
jmp 0x10037abc
or ecx, 0xffffffff
cmp edx, eax
mov edi, 0xc0000095
sbb esi, esi
and esi, edi
add esi, 0x10000000
mov dword [ebp - 0xab4], esi
cmp edx, eax
jb 0x1003a502
lea eax, [ecx + 8]
cmp eax, ecx
jb 0x10037ae6
mov edx, eax
jmp 0x10037ae9
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, edi
add esi, 0x10000000
mov dword [ebp - 0xab4], esi
cmp eax, ecx
jb 0x1003a502
push edx
push 8
mov dword [ebp - 0xb24], edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x10037b29
mov esi, 0xc0000017
jmp 0x10037928
mov dword [ebp - 0xb20], edx
mov ecx, ebx
mov dword [ebp - 0xb28], ecx
mov dword [ebp - 0xcfc], ebx
lea eax, [edx + 4]
cmp eax, edx
jb 0x10037b48
mov edi, eax
jmp 0x10037b4b
or edi, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, edx
jb 0x10037b8d
mov ecx, dword [ebp - 0xb24]
lea eax, [edx + 8]
add ecx, edx
cmp eax, ecx
jbe 0x10037b78
mov esi, 0xc0000023
jmp 0x10037928
mov dword [edx], 4
mov dword [edi], ebx
mov ecx, dword [ebp - 0xb28]
inc ecx
mov dword [ebp - 0xb28], ecx
test esi, esi
js 0x1003792e
cmp dword [ebp - 0xb20], 0
jne 0x10037bdf
mov edi, dword [ebp - 0xb24]
lea eax, [edi + 0xa4]
cmp eax, edi
jb 0x10037bb2
mov edx, eax
jmp 0x10037bb5
or edx, 0xffffffff
cmp eax, edi
mov dword [ebp - 0xb24], edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, edi
jb 0x10037cdb
inc ecx
mov dword [ebp - 0xb28], ecx
jmp 0x10037ce3
mov edx, dword [ebp - 0xb20]
mov edi, ebx
test ecx, ecx
je 0x10037c75
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xb00], edx
cmp eax, 4
jb 0x10037c07
mov dword [ebp - 0xae4], eax
jmp 0x10037c0e
or dword [ebp - 0xae4], 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, 4
jb 0x10037cd5
mov ebx, dword [ebp - 0xae4]
mov dword [ebp - 0xc58], ebx
xor ebx, ebx
cmp eax, 4
jb 0x10037cd5
mov eax, dword [ebp - 0xc58]
mov esi, edx
add eax, edx
cmp eax, edx
jb 0x10037c51
mov edx, eax
jmp 0x10037c54
or edx, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, dword [ebp - 0xb00]
jb 0x10037cd5
inc edi
cmp edi, ecx
jb 0x10037bef
lea eax, [edx + 4]
cmp eax, edx
jb 0x10037c80
mov edi, eax
jmp 0x10037c83
or edi, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, edx
jb 0x10037cd5
mov ecx, dword [ebp - 0xb24]
lea eax, [edx + 0xa4]
add ecx, dword [ebp - 0xb20]
cmp eax, ecx
ja 0x10037b6e
mov eax, 0xa0
push eax
push dword [ebp - 0xb0c]
mov dword [edx], eax
push edi
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xb28]
add esp, 0xc
inc ecx
mov dword [ebp - 0xb28], ecx
mov edx, dword [ebp - 0xb24]
test esi, esi
js 0x1003792e
cmp dword [ebp - 0xb20], 0
jne 0x10037d3c
mov eax, edx
lea edx, [eax + 0xc]
mov edi, edx
cmp edx, eax
jae 0x10037cfa
or edx, 0xffffffff
cmp edi, eax
mov dword [ebp - 0xb24], edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edi, eax
jb 0x10037e54
mov edi, dword [ebp - 0xb44]
inc ecx
mov dword [ebp - 0xc64], edi
mov edi, dword [ebp - 0xb34]
mov dword [ebp - 0xb28], ecx
mov dword [ebp - 0xc60], edi
jmp 0x10037e7d
mov edi, dword [ebp - 0xb20]
mov dword [ebp - 0xaf4], ebx
test ecx, ecx
je 0x10037de6
mov eax, dword [edi]
add eax, 4
mov dword [ebp - 0xb00], edi
cmp eax, 4
jb 0x10037d68
mov dword [ebp - 0xae4], eax
jmp 0x10037d6f
or dword [ebp - 0xae4], 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, 4
jb 0x10037e54
mov ebx, dword [ebp - 0xae4]
mov dword [ebp - 0xc4c], ebx
xor ebx, ebx
cmp eax, 4
jb 0x10037e54
mov eax, dword [ebp - 0xc4c]
mov esi, edi
add eax, edi
cmp eax, edi
jb 0x10037db2
mov edi, eax
jmp 0x10037db5
or edi, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, dword [ebp - 0xb00]
jb 0x10037e54
mov esi, dword [ebp - 0xaf4]
inc esi
mov dword [ebp - 0xaf4], esi
cmp esi, ecx
jb 0x10037d50
lea eax, [edi + 4]
cmp eax, edi
jb 0x10037df5
mov dword [ebp - 0xae4], eax
jmp 0x10037dfe
or esi, 0xffffffff
mov dword [ebp - 0xae4], esi
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, edi
jb 0x10037e54
mov ecx, dword [ebp - 0xb20]
lea eax, [edi + 0xc]
add ecx, edx
cmp eax, ecx
ja 0x10037b6e
mov edx, dword [ebp - 0xadc]
mov ecx, dword [ebp - 0xae4]
mov dword [edi], 8
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0xb28]
mov edx, dword [ebp - 0xb24]
inc ecx
mov dword [ebp - 0xb28], ecx
test esi, esi
js 0x1003792e
cmp dword [ebp - 0xb20], 0
mov eax, dword [ebp - 0xb44]
mov dword [ebp - 0xc64], eax
mov eax, dword [ebp - 0xb34]
mov dword [ebp - 0xc60], eax
jne 0x10037eb7
lea eax, [edx + 0xc]
cmp eax, edx
jb 0x10037e8c
mov dword [ebp - 0xb24], eax
jmp 0x10037e93
or dword [ebp - 0xb24], 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, edx
jb 0x10037fbd
inc ecx
mov dword [ebp - 0xb28], ecx
jmp 0x10037fc5
mov edi, dword [ebp - 0xb20]
mov dword [ebp - 0xaf4], ebx
test ecx, ecx
je 0x10037f5d
mov eax, dword [edi]
add eax, 4
mov dword [ebp - 0xb00], edi
cmp eax, 4
jb 0x10037ee3
mov dword [ebp - 0xae4], eax
jmp 0x10037eea
or dword [ebp - 0xae4], 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, 4
jb 0x10037fbd
mov ebx, dword [ebp - 0xae4]
mov dword [ebp - 0xc48], ebx
xor ebx, ebx
cmp eax, 4
jb 0x10037fbd
mov eax, dword [ebp - 0xc48]
mov esi, edi
add eax, edi
cmp eax, edi
jb 0x10037f2d
mov edi, eax
jmp 0x10037f30
or edi, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, dword [ebp - 0xb00]
jb 0x10037fbd
mov esi, dword [ebp - 0xaf4]
inc esi
mov dword [ebp - 0xaf4], esi
cmp esi, ecx
jb 0x10037ecb
lea eax, [edi + 4]
cmp eax, edi
jb 0x10037f6c
mov dword [ebp - 0xae4], eax
jmp 0x10037f73
or dword [ebp - 0xae4], 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, edi
jb 0x10037fbd
mov ecx, dword [ebp - 0xb20]
lea eax, [edi + 0xc]
add ecx, edx
cmp eax, ecx
ja 0x10037b6e
mov eax, dword [ebp - 0xae4]
mov dword [edi], 8
mov edi, dword [ebp - 0xb44]
mov dword [eax], edi
mov edi, dword [ebp - 0xb34]
mov dword [eax + 4], edi
inc dword [ebp - 0xb28]
test esi, esi
js 0x1003792e
lea eax, [ebp - 0xc04]
mov edx, SysReAllocString
push eax
mov ecx, 0x100026a0
call fcn.10051cc3
test eax, eax
jns 0x10037fea
mov dword [ebp - 0xc04], ebx
jmp 0x10037923
mov ecx, dword [ebp - 0xc04]
lea eax, [ecx + 1]
cmp eax, ecx
jb 0x10037ffb
mov edi, eax
jmp 0x10037ffe
or edi, 0xffffffff
cmp eax, ecx
mov dword [ebp - 0xc04], edi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, ecx
jb 0x100381b8
add edi, edi
je 0x100381ad
cmp dword [ebp - 0xb20], 0
jne 0x1003809e
push 4
lea eax, [edi + 4]
pop ecx
cmp eax, ecx
jb 0x1003803b
mov edx, eax
jmp 0x1003803e
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, ecx
jae 0x1003805d
mov edx, dword [ebp - 0xc44]
jmp 0x100381b8
mov ecx, dword [ebp - 0xb24]
lea eax, [ecx + edx]
cmp eax, ecx
jb 0x10038072
mov dword [ebp - 0xb24], eax
jmp 0x10038079
or dword [ebp - 0xb24], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, ecx
jb 0x100381b8
inc dword [ebp - 0xb28]
mov esi, ebx
jmp 0x100381b2
cmp dword [ebp - 0xb28], 0
mov ecx, ebx
mov edx, dword [ebp - 0xb20]
jbe 0x10038149
mov eax, dword [ebp - 0xc44]
mov dword [ebp - 0xaf4], eax
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xb00], edx
cmp eax, 4
jb 0x100380d7
mov dword [ebp - 0xae4], eax
jmp 0x100380de
or dword [ebp - 0xae4], 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, 4
jb 0x100381b8
mov ebx, dword [ebp - 0xae4]
mov dword [ebp - 0xaf4], ebx
xor ebx, ebx
cmp eax, 4
jb 0x100381b8
mov eax, dword [ebp - 0xaf4]
mov esi, edx
add eax, edx
cmp eax, edx
jb 0x10038121
mov edx, eax
jmp 0x10038124
or edx, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, dword [ebp - 0xb00]
jb 0x100381b8
inc ecx
cmp ecx, dword [ebp - 0xb28]
jb 0x100380bf
lea eax, [edx + 4]
cmp eax, edx
jb 0x10038158
mov dword [ebp - 0xae4], eax
jmp 0x1003815f
or dword [ebp - 0xae4], 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, edx
jb 0x100381b8
mov ecx, dword [ebp - 0xb24]
lea eax, [edi + 4]
add ecx, dword [ebp - 0xb20]
add eax, edx
cmp eax, ecx
jbe 0x1003818f
mov esi, 0xc0000023
jmp 0x100381b2
push edi
push 0x100026a0
push dword [ebp - 0xae4]
mov dword [edx], edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
inc dword [ebp - 0xb28]
jmp 0x100381b8
mov esi, 0xc000000d
mov dword [ebp - 0xab4], esi
test esi, esi
js 0x1003792e
cmp dword [ebp - 0xb20], 0
mov eax, dword [ebp - 0xb08]
mov dword [ebp - 0xcec], eax
jne 0x1003821e
mov ecx, dword [ebp - 0xb24]
lea eax, [ecx + 8]
cmp eax, ecx
jb 0x100381ea
mov dword [ebp - 0xb24], eax
jmp 0x100381f1
or dword [ebp - 0xb24], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, ecx
jb 0x100382ed
inc dword [ebp - 0xb28]
mov dword [ebp - 0xc3c], 4
jmp 0x10038308
cmp dword [ebp - 0xb28], 0
mov ecx, ebx
mov edx, dword [ebp - 0xb20]
jbe 0x100382a0
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xb00], edx
cmp eax, 4
jb 0x10038243
mov edi, eax
jmp 0x10038246
or edi, 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, 4
jb 0x10038264
mov dword [ebp - 0xc40], edi
jmp 0x1003826a
mov edi, dword [ebp - 0xc40]
cmp eax, 4
jb 0x100382ed
lea eax, [edx + edi]
mov esi, edx
cmp eax, edx
jb 0x1003827c
mov edx, eax
jmp 0x1003827f
or edx, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, dword [ebp - 0xb00]
jb 0x100382ed
inc ecx
cmp ecx, dword [ebp - 0xb28]
jb 0x1003822f
lea eax, [edx + 4]
cmp eax, edx
jb 0x100382ab
mov edi, eax
jmp 0x100382ae
or edi, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, edx
jb 0x100382ed
mov ecx, dword [ebp - 0xb24]
lea eax, [edx + 8]
add ecx, dword [ebp - 0xb20]
cmp eax, ecx
ja 0x10037b6e
mov eax, dword [ebp - 0xb08]
mov dword [edx], 4
mov dword [edi], eax
inc dword [ebp - 0xb28]
test esi, esi
js 0x1003792e
cmp dword [ebp - 0xb20], 0
mov dword [ebp - 0xc3c], 4
jne 0x10038347
mov ecx, dword [ebp - 0xb24]
lea eax, [ecx + 8]
cmp eax, ecx
jb 0x1003831d
mov dword [ebp - 0xb24], eax
jmp 0x10038324
or dword [ebp - 0xb24], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, ecx
jb 0x1003840f
inc dword [ebp - 0xb28]
jmp 0x10038417
cmp dword [ebp - 0xb28], 0
mov ecx, ebx
mov edx, dword [ebp - 0xb20]
jbe 0x100383c9
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xb00], edx
cmp eax, 4
jb 0x1003836c
mov edi, eax
jmp 0x1003836f
or edi, 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, 4
jb 0x1003838d
mov dword [ebp - 0xc38], edi
jmp 0x10038393
mov edi, dword [ebp - 0xc38]
cmp eax, 4
jb 0x1003840f
lea eax, [edx + edi]
mov esi, edx
cmp eax, edx
jb 0x100383a5
mov edx, eax
jmp 0x100383a8
or edx, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, dword [ebp - 0xb00]
jb 0x1003840f
inc ecx
cmp ecx, dword [ebp - 0xb28]
jb 0x10038358
lea eax, [edx + 4]
cmp eax, edx
jb 0x100383d4
mov edi, eax
jmp 0x100383d7
or edi, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, edx
jb 0x1003840f
mov ecx, dword [ebp - 0xb24]
lea eax, [edx + 8]
add ecx, dword [ebp - 0xb20]
cmp eax, ecx
ja 0x10037b6e
push 4
pop eax
mov dword [edx], eax
mov dword [edi], eax
inc dword [ebp - 0xb28]
test esi, esi
js 0x1003792e
rdtsc
mov edi, ebx
mov dword [ebp - 0xb30], ebx
mov dword [ebp - 0xad4], edi
mov dword [ebp - 0xaec], ebx
mov dword [ebp - 0xb1c], ebx
mov dword [ebp - 0xaf0], ebx
mov dword [ebp - 0xadc], ebx
mov dword [ebp - 0xac8], ebx
mov dword [ebp - 0xaf4], ebx
mov dword [ebp - 0xac4], ebx
mov dword [ebp - 0xb18], ebx
mov dword [ebp - 0xb00], eax
mov dword [ebp - 0xb0c], edx
mov ecx, dword [ebp - 0xb24]
add ecx, 8
cmp ecx, 8
jb 0x10038475
mov edx, ecx
jmp 0x10038478
or edx, 0xffffffff
cmp ecx, 8
sbb esi, esi
and esi, 0xc0000095
cmp ecx, 8
jb 0x1003856c
lea eax, [edx + 7]
and eax, 0xfffffff8
mov dword [ebp - 0xae4], eax
cmp eax, edx
jae 0x100384a6
mov esi, 0xc0000095
jmp 0x1003856c
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x100384c8
mov esi, 0xc0000017
mov edi, ebx
jmp 0x1003856c
mov eax, dword [ebp - 0xb28]
mov dword [edi], eax
lea eax, [edi + 4]
cmp eax, edi
jb 0x100384db
mov ecx, eax
jmp 0x100384de
or ecx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x10038553
mov eax, dword [ebp - 0xb24]
mov dword [ecx], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x100384ff
mov edx, eax
jmp 0x10038502
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10038553
mov eax, dword [ebp - 0xae4]
mov ecx, dword [ebp - 0xb00]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0xb0c]
mov dword [edi + eax - 4], ecx
push dword [ebp - 0xb24]
push dword [ebp - 0xb20]
push edx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xae4]
add esp, 0xc
mov dword [ebp - 0xb30], edi
mov edi, ebx
mov dword [ebp - 0xad4], eax
test edi, edi
je 0x10038566
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xad4]
or esi, 0x10000000
mov dword [ebp - 0xab4], esi
jl 0x10039e2f
cmp dword [ebp - 0xb30], 0
mov dword [ebp - 0xb64], ebx
jne 0x10038597
mov esi, 0xc000000d
jmp 0x10038c0a
test edi, edi
je 0x10038c05
lea eax, [edi + 8]
push eax
push ebx
mov dword [ebp - 0xafc], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xb3c], esi
test esi, esi
je 0x10038c05
mov cl, bl
mov edx, ebx
test edi, edi
je 0x100385dd
mov eax, dword [ebp - 0xb30]
xor cl, byte [edx + eax]
inc edx
cmp edx, edi
jb 0x100385d5
mov eax, 0xc81ecb17
mov dword [ebp - 0x3d4], 0xb1b54a58
mov dword [ebp - 0x3d0], eax
or eax, 0xffffffff
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xb7c], eax
mov eax, edi
shr eax, 3
mov dword [ebp - 0xb78], ebx
mov dword [ebp - 0xb2c], eax
test eax, eax
je 0x10038a48
movzx edx, word [ebp - 0x3d2]
mov eax, 0xc81ecb17
movzx esi, ax
shr eax, 0x10
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0xb3c]
add eax, 7
mov dword [ebp - 0xac0], edx
mov edx, dword [ebp - 0xab4]
mov dword [ebp - 0xb14], eax
mov eax, dword [ebp - 0xb30]
add eax, 2
mov dword [ebp - 0xabc], esi
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xacc], ebx
mov dword [ebp - 0xb40], ebx
mov ebx, dword [ebp - 0xae4]
movzx edi, byte [ebx - 2]
movzx eax, byte [ebx - 1]
movzx esi, byte [ebx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [ebx]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 3]
or esi, eax
movzx eax, byte [ebx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [ebx + 5]
add ebx, 8
shl esi, 8
or esi, eax
mov dword [ebp - 0xae4], ebx
xor edx, esi
mov eax, 0xc81ecb17
mov dword [ebp - 0xab4], edx
lea ebx, [edx - 0x4a58]
xor ebx, edi
xor ebx, dword [ebp - 0xb78]
xor ebx, eax
mov edx, ebx
xor edx, eax
mov eax, ebx
ror edx, 0xf
imul edx, dword [ebp - 0xac0]
ror eax, 7
add edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov dword [ebp - 0xab4], eax
lea edx, [eax - 0x4e4ab5a8]
ror eax, 0xa
ror edx, 9
imul edx, dword [ebp - 0xabc]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xabc]
rol eax, 5
rol edx, 4
imul edx, dword [ebp - 0xae8]
add edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xab4], eax
xor edx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, edx
xor ebx, eax
mov eax, ebx
shr eax, 6
lea edx, [ebx - 0x4a58]
imul edx, dword [ebp - 0xac0]
sub edx, eax
xor dword [ebp - 0xab4], edx
mov edx, dword [ebp - 0xab4]
mov eax, edx
ror eax, 0xf
xor eax, dword [ebp - 0xabc]
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, dword [ebp - 0xae8]
imul eax, dword [ebp - 0xabc]
xor edx, eax
mov dword [ebp - 0xab4], edx
lea eax, [edx + 0x37e0ea91]
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0xae8]
imul eax, dword [ebp - 0xac0]
ror edx, 0xa
xor edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xab4], eax
xor edx, 0x4a58
ror eax, 3
rol edx, 6
imul edx, dword [ebp - 0xabc]
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xab4]
mov eax, ebx
ror eax, 0xf
sub eax, dword [ebp - 0xae8]
imul eax, eax, 0x4a58
xor edx, eax
mov dword [ebp - 0xab4], edx
xor edx, dword [ebp - 0xae8]
mov eax, dword [ebp - 0xab4]
imul edx, edx, 0x4a58
shr eax, 1
xor edx, eax
mov eax, dword [ebp - 0xab4]
sub eax, dword [ebp - 0xabc]
xor ebx, edx
rol eax, 3
imul edx, eax, 0x4a58
mov eax, dword [ebp - 0xab4]
shr eax, 0xf
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
sub edx, dword [ebp - 0xabc]
imul edx, dword [ebp - 0xac0]
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0xab4], eax
ror edx, 9
imul edx, dword [ebp - 0xabc]
ror eax, 0xb
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xab4]
mov eax, ebx
sub eax, dword [ebp - 0xae8]
add eax, 0x4e4ab5a8
xor edx, eax
mov dword [ebp - 0xab4], edx
mov eax, dword [ebp - 0xab4]
xor eax, dword [ebp - 0xac0]
ror edx, 7
imul eax, eax, 0x4a58
sub eax, edx
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xae8]
rol edx, 4
imul edx, dword [ebp - 0xac0]
ror eax, 0x10
sub edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0xab4], eax
ror edx, 0xa
imul edx, dword [ebp - 0xabc]
ror eax, 4
add edx, eax
xor ebx, edx
mov eax, ebx
ror eax, 9
lea edx, [ebx + 0x4e4ab5a8]
ror edx, 4
imul edx, dword [ebp - 0xae8]
xor edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov dword [ebp - 0xab4], eax
xor eax, 0xc81ecb17
rol eax, 8
imul edx, eax, 0x4a58
mov eax, dword [ebp - 0xab4]
rol eax, 2
sub edx, eax
xor ebx, edx
mov edx, 0xc81ecb17
sub edx, ebx
mov eax, ebx
ror eax, 0xc
ror edx, 0xb
imul edx, dword [ebp - 0xac0]
sub edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov edx, dword [ebp - 0xac0]
xor edx, eax
mov dword [ebp - 0xab4], eax
imul edx, dword [ebp - 0xabc]
shr eax, 8
xor edx, eax
mov eax, dword [ebp - 0xab4]
xor ebx, edx
xor eax, ebx
xor ebx, dword [ebp - 0xacc]
xor eax, dword [ebp - 0xb40]
xor eax, 0xc81ecb17
mov dword [ebp - 0xb78], ebx
xor eax, 0xb1b54a58
mov dword [ebp - 0xacc], edi
mov dword [ebp - 0xb7c], eax
mov eax, dword [ebp - 0xb14]
mov dword [ebp - 0xb40], esi
mov byte [eax - 4], bl
mov al, byte [ebp - 0xb7c]
mov ebx, dword [ebp - 0xb14]
ror dword [ebp - 0xb78], 8
mov byte [ebx], al
ror dword [ebp - 0xb7c], 8
mov al, byte [ebp - 0xb78]
mov byte [ebx - 5], al
mov al, byte [ebp - 0xb7c]
ror dword [ebp - 0xb78], 8
mov byte [ebx - 1], al
ror dword [ebp - 0xb7c], 8
mov al, byte [ebp - 0xb78]
mov byte [ebx - 6], al
mov al, byte [ebp - 0xb7c]
ror dword [ebp - 0xb78], 8
mov byte [ebx - 2], al
ror dword [ebp - 0xb7c], 8
mov al, byte [ebp - 0xb78]
mov byte [ebx - 7], al
mov al, byte [ebp - 0xb7c]
mov byte [ebx - 3], al
add ebx, 8
mov edx, dword [ebp - 0xb7c]
ror dword [ebp - 0xb78], 8
ror edx, 8
sub dword [ebp - 0xb2c], 1
mov dword [ebp - 0xb7c], edx
mov dword [ebp - 0xb14], ebx
jne 0x1003866e
mov edi, dword [ebp - 0xad4]
xor ebx, ebx
mov esi, dword [ebp - 0xb3c]
movzx eax, cl
cdq
mov dword [esi + edi], eax
mov dword [esi + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x10038a74
mov esi, 0xc0000017
jmp 0x10038b73
mov eax, dword [ebp - 0xafc]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0x10038a97
mov esi, 0xc0000017
jmp 0x10038b12
mov dword [edi + 4], eax
push dword [ebp - 0xafc]
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
pop esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0x10038a90
mov dword [edi + 0xc], eax
push 0xa0
push 0x10069238
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [edi + 0x10], esi
push esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10038a90
mov dword [edi + 0x14], ecx
mov eax, dword [0x100692d8]
mov esi, ebx
mov dword [ecx], eax
mov eax, dword [0x100692dc]
mov dword [ebp - 0xb64], edi
mov edi, ebx
mov dword [ecx + 4], eax
test edi, edi
je 0x10038b73
cmp dword [edi + 4], 0
je 0x10038b30
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x10038b4a
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x10038b64
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x10038b87
mov eax, dword [ebp - 0xb64]
mov edi, ebx
mov dword [ebp - 0xaec], eax
jmp 0x10038b8d
mov edi, dword [ebp - 0xb64]
mov eax, dword [ebp - 0xb3c]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0x10038c0a
cmp dword [edi + 4], 0
je 0x10038bc0
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x10038bda
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x10038bf4
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0x10038c0a
mov esi, 0xc0000001
or esi, 0x10000000
mov dword [ebp - 0xab4], esi
jl 0x10039e2f
mov ecx, dword [ebp - 0xaec]
mov edi, dword [ecx + 8]
mov ecx, dword [ecx]
add ecx, 4
cmp ecx, 4
jb 0x10038c33
mov eax, ecx
jmp 0x10038c36
or eax, 0xffffffff
cmp ecx, 4
sbb esi, esi
and esi, 0xc0000095
cmp ecx, 4
jb 0x10038cc3
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x10038c51
mov edx, ecx
jmp 0x10038c54
or edx, 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
cmp ecx, eax
jb 0x10038cc3
lea eax, [edx + edi]
cmp eax, edx
jb 0x10038c6d
mov ecx, eax
jmp 0x10038c70
or ecx, 0xffffffff
cmp eax, edx
mov edi, 0xc0000095
sbb esi, esi
and esi, edi
cmp eax, edx
jb 0x10038cc3
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x10038c8a
mov eax, edx
jmp 0x10038c8d
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, edi
cmp edx, ecx
jb 0x10038cc3
mov edx, dword [ebp - 0xaec]
mov ecx, dword [edx + 0x10]
add ecx, eax
cmp ecx, eax
jb 0x10038cb0
mov edx, ecx
mov dword [ebp - 0xb14], ecx
jmp 0x10038cb9
or edx, 0xffffffff
mov dword [ebp - 0xb14], edx
cmp ecx, eax
sbb esi, esi
and esi, edi
cmp ecx, eax
jae 0x10038ccf
mov edx, dword [ebp - 0xce4]
mov dword [ebp - 0xb14], edx
test esi, esi
js 0x10038e60
push edx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x10038cf7
mov esi, 0xc0000017
jmp 0x10038e60
mov edx, dword [ebp - 0xaec]
lea ecx, [edi + 4]
mov eax, dword [edx]
mov dword [edi], eax
cmp ecx, edi
jb 0x10038d12
mov eax, ecx
mov dword [ebp - 0xafc], ecx
jmp 0x10038d1b
or eax, 0xffffffff
mov dword [ebp - 0xafc], eax
cmp ecx, edi
sbb esi, esi
and esi, 0xc0000095
cmp ecx, edi
jb 0x10038e4d
push dword [edx]
push dword [edx + 4]
push eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0xaec]
add esp, 0xc
mov ecx, dword [ebp - 0xafc]
mov eax, dword [edx]
add eax, ecx
cmp eax, ecx
jb 0x10038d53
mov edx, eax
jmp 0x10038d56
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10038e4d
mov eax, dword [ebp - 0xaec]
lea ecx, [edx + 4]
mov eax, dword [eax + 8]
mov dword [edx], eax
cmp ecx, edx
jb 0x10038d84
mov eax, ecx
mov dword [ebp - 0xafc], ecx
jmp 0x10038d8d
or eax, 0xffffffff
mov dword [ebp - 0xafc], eax
cmp ecx, edx
sbb esi, esi
and esi, 0xc0000095
cmp ecx, edx
jb 0x10038e4d
mov esi, dword [ebp - 0xaec]
push dword [esi + 8]
push dword [esi + 0xc]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
mov edx, dword [ebp - 0xafc]
add eax, edx
cmp eax, edx
jb 0x10038dc7
mov ecx, eax
jmp 0x10038dca
or ecx, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x10038e4d
mov eax, dword [ebp - 0xaec]
lea edx, [ecx + 4]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
cmp edx, ecx
jb 0x10038df4
mov eax, edx
mov dword [ebp - 0xafc], edx
jmp 0x10038dfd
or eax, 0xffffffff
mov dword [ebp - 0xafc], eax
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
cmp edx, ecx
jb 0x10038e4d
mov esi, dword [ebp - 0xaec]
push dword [esi + 0x10]
push dword [esi + 0x14]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0x10]
add esp, 0xc
mov ecx, dword [ebp - 0xafc]
add eax, ecx
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10038e4d
mov eax, dword [ebp - 0xb14]
mov dword [ebp - 0xb1c], edi
mov edi, ebx
mov dword [ebp - 0xaf0], eax
test edi, edi
je 0x10038e60
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
mov dword [ebp - 0xab4], esi
jl 0x10039e2f
mov dword [ebp - 0xafc], ebx
cmp dword [ebp - 0xb20], 0
jne 0x10038eba
mov esi, 0xc000000d
mov dword [ebp - 0xab4], esi
mov eax, ebx
test esi, esi
js 0x10039e2f
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x10039076
mov esi, 0xd0000017
jmp 0x10039e29
xor eax, eax
inc eax
cmp dword [ebp - 0xb28], eax
jbe 0x10038e81
mov ecx, dword [ebp - 0xb20]
mov edi, ebx
mov eax, dword [ecx]
lea edx, [ecx + 4]
mov dword [ebp - 0xb00], eax
cmp edx, ecx
jb 0x10038ee0
mov eax, edx
jmp 0x10038ee3
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, ecx
jb 0x10038f43
mov ecx, dword [ebp - 0xb00]
add ecx, eax
mov edx, ecx
cmp ecx, eax
jae 0x10038f08
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, eax
jb 0x10038f43
xor eax, eax
inc edi
inc eax
cmp edi, eax
jb 0x10038ecd
lea eax, [ecx + 4]
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, ecx
jb 0x10038f43
mov eax, dword [ecx]
mov dword [ebp - 0xafc], eax
test esi, esi
js 0x10038e8c
cmp dword [ebp - 0xb28], 2
jbe 0x10038e81
mov ecx, dword [ebp - 0xb20]
mov edi, ebx
mov eax, dword [ecx]
lea edx, [ecx + 4]
mov dword [ebp - 0xb00], eax
cmp edx, ecx
jb 0x10038f73
mov eax, edx
jmp 0x10038f76
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, ecx
jb 0x10038fd0
mov ecx, dword [ebp - 0xb00]
add ecx, eax
mov edx, ecx
cmp ecx, eax
jae 0x10038f9b
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, eax
jb 0x10038fd0
inc edi
cmp edi, 2
jb 0x10038f60
lea eax, [ecx + 4]
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, ecx
jb 0x10038fd0
mov edi, dword [ecx]
jmp 0x10038fd2
mov edi, ebx
test esi, esi
js 0x10038e8c
mov eax, dword [ebp - 0xafc]
add eax, 0x50
cmp eax, 0x50
jb 0x10038fec
mov ecx, eax
jmp 0x10038fef
or ecx, 0xffffffff
cmp eax, 0x50
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, 0x50
jb 0x10039049
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x10039010
mov eax, edx
jmp 0x10039013
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, ecx
jb 0x10039049
lea ecx, [eax + edi]
cmp ecx, eax
jb 0x10039032
mov edx, ecx
jmp 0x10039035
or edx, 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp ecx, eax
jae 0x1003904f
mov edx, dword [ebp - 0xce0]
test esi, esi
js 0x10038e8c
cmp edx, 0x400000
jbe 0x10039069
mov esi, 0x8000ffff
jmp 0x10039e29
mov eax, edx
mov dword [ebp - 0xac8], eax
jmp 0x10038e8e
mov dword [ebp - 0xadc], edi
mov eax, dword [ebp - 0xb1c]
test eax, eax
jne 0x10039090
mov esi, 0x80070057
jmp 0x10039e29
mov ecx, dword [ebp - 0xac8]
mov dword [ebp - 0xcac], eax
mov eax, dword [ebp - 0xaf0]
mov dword [ebp - 0xca4], eax
lea eax, [ebp - 0xc34]
push eax
xor eax, eax
mov dword [ebp - 0xca8], edi
push 0x10002a4c
inc eax
mov dword [ebp - 0xca0], ecx
push eax
mov dword [ebp - 0xc9c], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0x1003910c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0xab4], esi
test esi, esi
jle 0x100390f7
movzx esi, si
or esi, 0x80070000
mov dword [ebp - 0xab4], esi
test esi, esi
mov eax, dword [ebp - 0xac8]
js 0x10039160
mov esi, 0x80004005
mov dword [ebp - 0xab4], esi
jmp 0x10039160
push 0x10004e50
push dword [ebp - 0xc34]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x100390d4
push ebx
push 0x14
lea eax, [ebp - 0xcac]
mov ecx, esi
push eax
push 0x86
call dword [0x100ad1dc]
call esi
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xab4], esi
jl 0x1003915a
mov eax, dword [ebp - 0xca0]
mov dword [ebp - 0xac8], eax
jmp 0x10039160
mov eax, dword [ebp - 0xac8]
cmp esi, 0xd0000023
jne 0x10039172
mov esi, 0x8007007a
jmp 0x10039e29
test esi, esi
js 0x10039e2f
mov dword [ebp - 0xb3c], ebx
cmp eax, 4
jae 0x1003918f
mov esi, 0xc000003e
jmp 0x1003956e
mov ecx, dword [edi]
lea eax, [edi + 4]
mov dword [ebp - 0xb14], ecx
cmp eax, edi
jb 0x100391a8
mov edx, eax
mov dword [ebp - 0xacc], eax
jmp 0x100391b1
or edx, 0xffffffff
mov dword [ebp - 0xacc], edx
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x1003956e
mov eax, dword [ebp - 0xac8]
add eax, 0xfffffffc
cmp eax, ecx
jb 0x10039185
lea eax, [ecx + edx]
cmp eax, edx
jb 0x100391db
mov edx, eax
jmp 0x100391de
or edx, 0xffffffff
cmp eax, dword [ebp - 0xacc]
sbb esi, esi
and esi, 0xc0000095
cmp eax, dword [ebp - 0xacc]
jb 0x1003956e
lea eax, [ecx + 4]
cmp eax, 4
jb 0x10039204
mov ecx, eax
jmp 0x10039207
or ecx, 0xffffffff
cmp eax, 4
mov edi, 0xc0000095
sbb esi, esi
and esi, edi
cmp eax, 4
jb 0x1003956e
mov eax, dword [ebp - 0xac8]
sub eax, ecx
cmp eax, 4
jb 0x10039185
mov eax, dword [edx]
mov dword [ebp - 0xaf0], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x10039244
mov dword [ebp - 0xad4], eax
jmp 0x1003924b
or dword [ebp - 0xad4], 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, edi
cmp eax, edx
jb 0x1003956e
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x10039264
mov edi, eax
jmp 0x10039267
or edi, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1003956e
mov eax, dword [ebp - 0xac8]
mov edx, dword [ebp - 0xaf0]
sub eax, edi
cmp eax, edx
jb 0x10039185
mov esi, dword [ebp - 0xad4]
lea eax, [edx + esi]
cmp eax, esi
jb 0x100392a0
mov ecx, eax
jmp 0x100392a3
or ecx, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
cmp eax, dword [ebp - 0xad4]
jb 0x1003956e
lea eax, [edx + edi]
cmp eax, edi
jb 0x100392c4
mov edx, eax
jmp 0x100392c7
or edx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x1003956e
mov eax, dword [ebp - 0xac8]
sub eax, edx
cmp eax, 4
jb 0x10039185
mov edi, dword [ecx]
lea eax, [ecx + 4]
mov dword [ebp - 0xb00], edi
cmp eax, ecx
jb 0x10039301
mov dword [ebp - 0xb64], eax
jmp 0x10039308
or dword [ebp - 0xb64], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1003956e
lea eax, [edx + 4]
cmp eax, edx
jb 0x10039325
mov ecx, eax
jmp 0x10039328
or ecx, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x1003956e
mov eax, dword [ebp - 0xac8]
sub eax, ecx
cmp eax, edi
jb 0x10039185
lea eax, [edi + ecx]
cmp eax, ecx
jb 0x10039355
mov edx, eax
jmp 0x10039358
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1003956e
mov eax, dword [ebp - 0xac8]
sub eax, edx
jne 0x10039185
mov esi, dword [ebp - 0xaf0]
mov ecx, dword [ebp - 0xb14]
add ecx, 0xc
lea eax, [edi + esi]
add eax, ecx
cmp eax, dword [ebp - 0xac8]
jne 0x10039185
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x100393b9
mov esi, 0xc0000017
jmp 0x100394f3
cmp dword [ebp - 0xacc], 0
je 0x10039403
mov eax, dword [ebp - 0xb14]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0x100393e8
mov esi, 0xc0000017
jmp 0x10039492
mov dword [edi + 4], eax
mov ecx, dword [ebp - 0xb14]
push ecx
push dword [ebp - 0xacc]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x10039408
mov dword [edi], ebx
mov dword [edi + 4], ebx
cmp dword [ebp - 0xad4], 0
je 0x1003943d
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0x100393de
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xad4]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x10039443
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
cmp dword [ebp - 0xb64], 0
je 0x10039482
mov esi, dword [ebp - 0xb00]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0x100393de
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xb64]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x10039488
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [ebp - 0xb3c], edi
mov esi, ebx
mov edi, ebx
test edi, edi
je 0x100394f3
cmp dword [edi + 4], 0
je 0x100394b0
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x100394ca
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x100394e4
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x10039507
mov eax, dword [ebp - 0xb3c]
mov edi, ebx
mov dword [ebp - 0xaf4], eax
jmp 0x1003950d
mov edi, dword [ebp - 0xb3c]
test edi, edi
je 0x1003956e
cmp dword [edi + 4], 0
je 0x1003952b
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x10039545
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x1003955f
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
mov dword [ebp - 0xab4], esi
jl 0x10039e2f
mov eax, dword [ebp - 0xaf4]
mov dword [ebp - 0xb3c], ebx
mov dword [ebp - 0xae4], ebx
test eax, eax
jne 0x100395a0
mov esi, 0xd000000d
jmp 0x10039e29
mov esi, dword [eax + 4]
mov dword [ebp - 0xb10], esi
test esi, esi
je 0x10039596
mov edi, dword [eax]
test edi, edi
je 0x10039596
add edi, 0xfffffff8
push edi
push ebx
mov dword [ebp - 0xb2c], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb40], eax
test eax, eax
je 0x10039bc4
mov dword [ebp - 0xb64], esi
mov ecx, 0x7f1137f
mov esi, eax
mov dword [ebp - 0x3cc], 0xab69605e
and edi, 7
mov dword [ebp - 0x3c8], ecx
mov dl, bl
mov dword [ebp - 0xb14], esi
mov dword [ebp - 0xb0c], edi
mov eax, ebx
je 0x10039755
or dword [ebp - 0xb5c], 0xffffffff
mov ecx, ebx
mov dword [ebp - 0xb68], ebx
mov dword [ebp - 0xab4], ebx
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xaf0], ecx
test edi, edi
je 0x10039693
mov eax, dword [ebp - 0xb64]
push 0x38
pop esi
lea ebx, [eax + 1]
movzx eax, byte [eax]
mov dword [ebp - 0xafc], ebx
cmp ecx, 4
jge 0x1003965b
lea ecx, [esi - 0x20]
shl eax, cl
or dword [ebp - 0xac8], eax
jmp 0x10039665
mov ecx, esi
shl eax, cl
or dword [ebp - 0xab4], eax
mov ecx, dword [ebp - 0xaf0]
sub esi, 8
mov eax, dword [ebp - 0xafc]
inc ecx
mov dword [ebp - 0xaf0], ecx
cmp ecx, edi
jl 0x1003963d
mov esi, dword [ebp - 0xb14]
xor ebx, ebx
mov dword [ebp - 0xb64], eax
mov eax, dword [ebp - 0xac8]
mov ecx, dword [ebp - 0xab4]
xor eax, 0x92f65a5
xor ecx, 0x699a899c
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xb68], eax
mov dword [ebp - 0xabc], ecx
mov dword [ebp - 0xb5c], ecx
mov dword [ebp - 0xb00], ebx
test edi, edi
je 0x1003970f
lea edi, [esi + 1]
mov dword [ebp - 0xaf0], edi
cmp ebx, 4
jge 0x100396db
rol eax, 8
mov byte [esi], al
jmp 0x100396e0
rol ecx, 8
mov byte [esi], cl
mov edi, dword [ebp - 0xb0c]
inc ebx
mov esi, dword [ebp - 0xaf0]
cmp ebx, edi
jl 0x100396c6
mov eax, esi
xor ebx, ebx
mov esi, dword [ebp - 0xb5c]
mov dword [ebp - 0xb14], eax
mov eax, dword [ebp - 0xb68]
mov dword [ebp - 0xad4], eax
jmp 0x10039715
mov esi, dword [ebp - 0xabc]
add edi, 0xfffffffc
test edi, edi
jle 0x1003972a
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
jmp 0x10039770
mov esi, ebx
mov dword [ebp - 0xabc], esi
mov dword [ebp - 0xb5c], esi
test edi, edi
jns 0x1003977c
neg edi
shl edi, 3
mov ecx, edi
shr eax, cl
shl eax, cl
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xb68], eax
jmp 0x1003977c
or dword [ebp - 0xab4], 0xffffffff
mov esi, ebx
mov dword [ebp - 0xac8], ebx
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xb68], eax
mov dword [ebp - 0xb5c], esi
mov dword [ebp - 0xabc], esi
mov esi, dword [ebp - 0xb2c]
mov eax, esi
shr eax, 3
mov dword [ebp - 0xafc], eax
test eax, eax
je 0x10039b4e
movzx esi, word [ebp - 0x3ca]
mov eax, 0x7f1137f
mov ebx, dword [ebp - 0xad4]
mov ecx, eax
movzx eax, ax
mov dword [ebp - 0xac0], eax
mov eax, dword [ebp - 0xb14]
mov dword [ebp - 0xae8], esi
add eax, 7
mov esi, dword [ebp - 0xb64]
shr ecx, 0x10
add esi, 2
mov dword [ebp - 0xacc], ecx
mov dword [ebp - 0xaf0], eax
movzx ecx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ecx, 8
or ecx, eax
shl edi, 8
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 3]
or edi, eax
mov dword [ebp - 0xb00], ecx
movzx eax, byte [esi + 4]
xor ebx, ecx
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
add esi, 8
shl edi, 8
or edi, eax
mov dword [ebp - 0xb0c], esi
mov eax, dword [ebp - 0xabc]
mov esi, 0x7f1137f
xor eax, edi
xor eax, ebx
xor eax, esi
xor eax, 0xab69605e
mov dword [ebp - 0xabc], eax
lea ecx, [eax + 0x54969fa2]
rol eax, 0xa
rol ecx, 5
imul ecx, dword [ebp - 0xac0]
add ecx, eax
xor ebx, ecx
mov eax, ebx
rol eax, 2
lea ecx, [esi + ebx]
mov esi, dword [ebp - 0xabc]
ror ecx, 9
imul ecx, dword [ebp - 0xae8]
sub ecx, eax
xor esi, ecx
mov eax, esi
sub eax, dword [ebp - 0xac0]
imul ecx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xae8]
rol ecx, 6
imul ecx, dword [ebp - 0xacc]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, 0xab69605e
sub eax, ecx
xor ebx, eax
mov eax, dword [ebp - 0xac0]
xor eax, ebx
mov ecx, ebx
imul eax, dword [ebp - 0xae8]
ror ecx, 6
xor ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
add eax, esi
ror eax, 0xf
imul ecx, eax, 0x605e
mov eax, esi
rol eax, 2
add ecx, eax
xor ebx, ecx
lea ecx, [ebx + 0x54969fa2]
ror ecx, 0xe
mov eax, ebx
imul ecx, dword [ebp - 0xacc]
rol eax, 8
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, 0xab69605e
ror eax, 0xa
ror ecx, 0xc
imul ecx, dword [ebp - 0xac0]
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xacc]
xor ecx, ebx
mov eax, ebx
imul ecx, dword [ebp - 0xae8]
shr eax, 0xa
xor ecx, eax
xor ecx, esi
mov eax, ecx
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xacc]
xor ebx, eax
mov esi, ebx
sub esi, dword [ebp - 0xacc]
xor esi, ecx
xor esi, 0xab69605e
mov ecx, esi
mov eax, esi
xor ecx, dword [ebp - 0xacc]
rol ecx, 2
imul ecx, dword [ebp - 0xac0]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 6
imul ecx, dword [ebp - 0xae8]
rol eax, 7
add ecx, eax
mov eax, dword [ebp - 0xac0]
xor esi, ecx
xor eax, esi
mov ecx, esi
imul eax, eax, 0x605e
ror ecx, 9
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov dword [ebp - 0xad4], ebx
xor ecx, dword [ebp - 0xae8]
mov eax, ebx
rol ecx, 5
imul ecx, dword [ebp - 0xacc]
rol eax, 7
add ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov ebx, esi
xor ebx, dword [ebp - 0xad4]
xor ebx, ecx
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xae8]
imul eax, dword [ebp - 0xac0]
xor esi, eax
mov eax, esi
sub eax, ecx
ror eax, 1
imul ecx, eax, 0x605e
mov eax, esi
ror eax, 6
sub ecx, eax
xor ebx, ecx
mov eax, ebx
rol eax, 0xe
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul ecx, dword [ebp - 0xacc]
add ecx, eax
xor esi, ecx
mov eax, esi
ror eax, 0xe
lea ecx, [esi - 0x54969fa2]
rol ecx, 0xf
imul ecx, dword [ebp - 0xac0]
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
shr eax, 3
xor ecx, 0x605e
imul ecx, dword [ebp - 0xae8]
xor ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
xor eax, esi
rol eax, 4
imul ecx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xab4]
rol eax, 2
mov dword [ebp - 0xb5c], esi
mov dword [ebp - 0xab4], edi
xor ecx, eax
xor ecx, dword [ebp - 0xac8]
xor ebx, ecx
mov ecx, dword [ebp - 0xaf0]
mov dword [ebp - 0xb68], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xb5c]
ror dword [ebp - 0xb68], 8
mov byte [ecx], al
mov al, byte [ebp - 0xb68]
ror dword [ebp - 0xb5c], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb5c]
ror dword [ebp - 0xb68], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xb68]
ror dword [ebp - 0xb5c], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xb5c]
ror dword [ebp - 0xb68], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xb5c], 8
mov al, byte [ebp - 0xb68]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb5c]
mov byte [ecx - 3], al
add ecx, 8
mov esi, dword [ebp - 0xb5c]
mov ebx, dword [ebp - 0xb68]
mov eax, dword [ebp - 0xb00]
ror esi, 8
ror ebx, 8
sub dword [ebp - 0xafc], 1
mov dword [ebp - 0xabc], esi
mov dword [ebp - 0xb5c], esi
mov esi, dword [ebp - 0xb0c]
mov dword [ebp - 0xb68], ebx
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xaf0], ecx
jne 0x100397d9
mov esi, dword [ebp - 0xb2c]
xor ebx, ebx
mov ecx, dword [ebp - 0xb40]
mov eax, ebx
test esi, esi
je 0x10039b62
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0x10039b5a
mov edi, dword [ebp - 0xb10]
movzx eax, dl
cdq
cmp eax, dword [esi + edi]
jne 0x10039b8b
cmp edx, dword [esi + edi + 4]
jne 0x10039b8b
mov edi, ecx
mov dword [ebp - 0xae4], esi
mov dword [ebp - 0xb3c], edi
mov ecx, ebx
mov esi, ebx
jmp 0x10039b92
mov esi, 0xc004d501
mov edi, ebx
test ecx, ecx
je 0x10039ba5
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x10039bc4
mov dword [ebp - 0xac4], edi
mov eax, ebx
mov edi, dword [ebp - 0xae4]
mov esi, 0x10000000
mov dword [ebp - 0xb18], edi
jmp 0x10039bd1
mov eax, dword [ebp - 0xb3c]
mov esi, 0xd0000001
mov edi, ebx
mov dword [ebp - 0xab4], esi
test eax, eax
je 0x10039bea
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x10039e2f
cmp edi, 4
jb 0x10039e1e
mov edx, dword [ebp - 0xac4]
mov eax, dword [edx]
mov dword [ebp - 0xb10], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x10039c14
mov ecx, eax
jmp 0x10039c17
or ecx, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x10039e23
lea eax, [edi - 4]
cmp eax, 4
jb 0x10039e1e
mov eax, dword [ecx]
mov dword [ebp - 0xb14], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x10039c48
mov edi, eax
jmp 0x10039c4b
or edi, 0xffffffff
cmp eax, ecx
mov edx, 0xc0000095
sbb esi, esi
and esi, edx
cmp eax, ecx
jb 0x10039e23
mov eax, dword [ebp - 0xb18]
mov ecx, dword [ebp - 0xb14]
add eax, 0xfffffff8
cmp eax, ecx
jb 0x10039e1e
lea eax, [ecx + 8]
cmp eax, 8
sbb esi, esi
and esi, edx
cmp eax, 8
jb 0x10039e23
mov eax, dword [ebp - 0xac4]
lea edx, [edi + ecx]
mov esi, dword [ebp - 0xb18]
add eax, esi
cmp eax, edx
jb 0x10039e1e
sub esi, edi
sub esi, ecx
add esi, dword [ebp - 0xac4]
cmp esi, 8
jae 0x10039e1e
mov dword [ebp - 0xb18], ebx
mov eax, ebx
mov dword [ebp - 0xb2c], eax
mov esi, ebx
test edi, edi
je 0x10039db1
mov ecx, edi
cmp edx, edi
jb 0x10039cdc
mov eax, edx
mov dword [ebp - 0xafc], edx
jmp 0x10039ce5
or eax, 0xffffffff
mov dword [ebp - 0xafc], eax
cmp edx, edi
sbb esi, esi
and esi, 0xc0000095
cmp edx, edi
jb 0x10039e0c
cmp edi, eax
jae 0x10039da5
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x10039d0e
mov dword [ebp - 0xaf0], edx
jmp 0x10039d15
or dword [ebp - 0xaf0], 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
cmp edx, ecx
jb 0x10039e0c
cmp dword [ebp - 0xaf0], eax
ja 0x10039dd6
mov eax, dword [ecx]
add eax, 4
cmp eax, 4
jb 0x10039d41
mov edx, eax
jmp 0x10039d44
or edx, 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
cmp eax, 4
jb 0x10039d5c
mov dword [ebp - 0xc30], edx
jmp 0x10039d62
mov edx, dword [ebp - 0xc30]
cmp eax, 4
jb 0x10039e0c
lea eax, [edx + ecx]
cmp eax, ecx
jb 0x10039d76
mov edx, eax
jmp 0x10039d79
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10039e0c
mov eax, dword [ebp - 0xafc]
cmp edx, eax
ja 0x10039dd6
inc dword [ebp - 0xb18]
mov ecx, edx
cmp edx, eax
jb 0x10039cff
cmp ecx, eax
jne 0x10039dd6
mov ecx, dword [ebp - 0xb14]
mov eax, ebx
test ecx, ecx
je 0x10039de5
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb2c], eax
test eax, eax
jne 0x10039ddd
mov esi, 0xc0000017
jmp 0x10039e0c
mov esi, 0xc000000d
jmp 0x10039e23
mov ecx, dword [ebp - 0xb14]
mov esi, ebx
test edi, edi
je 0x10039dfa
push ecx
push edi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xb2c]
add esp, 0xc
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0xbc8], eax
test esi, esi
js 0x10039e23
mov eax, dword [ebp - 0xb10]
cmp eax, dword [ebp - 0xbc8]
je 0x10039e23
mov esi, 0xc000003e
or esi, 0x10000000
mov dword [ebp - 0xab4], esi
mov eax, dword [ebp - 0xb30]
test eax, eax
je 0x10039e48
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xaec]
test edi, edi
je 0x10039eaf
cmp dword [edi + 4], 0
je 0x10039e6c
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x10039e86
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x10039ea0
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb1c]
test eax, eax
je 0x10039ec8
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xadc]
test eax, eax
je 0x10039ee1
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xaf4]
test edi, edi
je 0x10039f48
cmp dword [edi + 4], 0
je 0x10039f05
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x10039f1f
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x10039f39
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xac4]
test eax, eax
je 0x10039f61
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x1003792e
xor eax, eax
inc eax
cmp dword [ebp - 0xbc8], eax
jae 0x10039f7e
mov esi, 0xc004d501
jmp 0x10037928
cmp dword [ebp - 0xbc0], 0
jne 0x1003a003
mov esi, 0xc000000d
mov dword [ebp - 0xab4], esi
mov eax, ebx
test esi, esi
js 0x1003792e
cmp eax, 0xd0000023
jne 0x10039fae
mov eax, 0x8007007a
mov dword [ebp - 0xae0], eax
cmp eax, 0x8007007a
je 0x10039fc5
mov esi, eax
mov dword [ebp - 0xab4], esi
test eax, eax
js 0x1003792e
cmp dword [ebp - 0xbc8], 6
jne 0x10039f74
cmp dword [ebp - 0xbc0], 0
jne 0x1003a076
mov edx, dword [ebp - 0xc78]
mov esi, 0xc000000d
mov ecx, dword [ebp - 0xc7c]
mov dword [ebp - 0xab4], esi
mov dword [ebp - 0xb1c], edx
mov dword [ebp - 0xaf4], ecx
jmp 0x1003a147
cmp dword [ebp - 0xbc8], 0
jbe 0x10039f87
mov eax, dword [ebp - 0xbc0]
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x1003a023
mov edi, ecx
jmp 0x1003a026
or edi, 0xffffffff
cmp ecx, dword [ebp - 0xbc0]
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp ecx, dword [ebp - 0xbc0]
jb 0x1003a04c
mov eax, edx
neg eax
sbb eax, eax
and eax, edi
jmp 0x1003a058
mov edx, dword [ebp - 0xcdc]
mov eax, dword [ebp - 0xcd8]
test esi, esi
js 0x10039f92
cmp edx, 4
jne 0x10037b6e
mov eax, dword [eax]
mov dword [ebp - 0xae0], eax
jmp 0x10039f94
mov eax, dword [ebp - 0xbc0]
mov edi, ebx
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [ebp - 0xb10], ecx
cmp edx, eax
jb 0x1003a091
mov ecx, edx
jmp 0x1003a094
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, eax
jb 0x1003a103
mov eax, dword [ebp - 0xb10]
add eax, ecx
mov edx, eax
cmp eax, ecx
jae 0x1003a0b9
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, ecx
jb 0x1003a103
xor ecx, ecx
inc edi
inc ecx
cmp edi, ecx
jb 0x1003a07e
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x1003a0e2
mov edi, ecx
jmp 0x1003a0e5
or edi, 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp ecx, eax
jb 0x1003a103
mov eax, edx
neg eax
sbb eax, eax
and eax, edi
jmp 0x1003a10f
mov edx, dword [ebp - 0xcd4]
mov eax, dword [ebp - 0xcd0]
test esi, esi
js 0x1003a12f
cmp edx, 8
jne 0x10037b6e
mov ecx, dword [eax]
mov dword [ebp - 0xaf4], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xb1c], ecx
jmp 0x1003a147
mov eax, dword [ebp - 0xc78]
mov dword [ebp - 0xb1c], eax
mov eax, dword [ebp - 0xc7c]
mov dword [ebp - 0xaf4], eax
test esi, esi
js 0x1003792e
cmp dword [ebp - 0xbc0], 0
jne 0x1003a18e
mov esi, 0xc000000d
mov dword [ebp - 0xab4], esi
mov eax, dword [ebp - 0xc70]
mov dword [ebp - 0xac4], eax
test esi, esi
js 0x1003792e
cmp dword [ebp - 0xbc0], 0
jne 0x1003a23d
mov esi, 0xc000000d
jmp 0x10037928
mov eax, dword [ebp - 0xbc0]
mov edi, ebx
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [ebp - 0xb10], ecx
cmp edx, eax
jb 0x1003a1a9
mov ecx, edx
jmp 0x1003a1ac
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, eax
jb 0x1003a219
mov eax, dword [ebp - 0xb10]
add eax, ecx
mov edx, eax
cmp eax, ecx
jae 0x1003a1d1
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, ecx
jb 0x1003a219
inc edi
cmp edi, 2
jb 0x1003a196
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x1003a1f8
mov edi, ecx
jmp 0x1003a1fb
or edi, 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp ecx, eax
jb 0x1003a219
mov eax, edx
neg eax
sbb eax, eax
and eax, edi
jmp 0x1003a225
mov edx, dword [ebp - 0xd10]
mov eax, dword [ebp - 0xd08]
test esi, esi
js 0x1003a163
cmp edx, 4
jne 0x10037b6e
mov eax, dword [eax]
jmp 0x1003a169
mov eax, dword [ebp - 0xbc0]
mov edi, ebx
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [ebp - 0xb10], ecx
cmp edx, eax
jb 0x1003a258
mov ecx, edx
jmp 0x1003a25b
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, eax
jb 0x1003a2cc
mov eax, dword [ebp - 0xb10]
add eax, ecx
mov edx, eax
cmp eax, ecx
jae 0x1003a280
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, ecx
jb 0x1003a2cc
inc edi
cmp edi, 3
jb 0x1003a245
mov edi, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xafc], edi
cmp ecx, eax
jb 0x1003a2ad
mov edx, ecx
jmp 0x1003a2b0
or edx, 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp ecx, eax
jb 0x1003a2cc
neg edi
sbb edi, edi
and edi, edx
jmp 0x1003a2de
mov eax, dword [ebp - 0xd04]
mov edi, dword [ebp - 0xcf4]
mov dword [ebp - 0xafc], eax
test esi, esi
js 0x1003792e
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xadc], ebx
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [ebp - 0xb10], ecx
cmp edx, eax
jb 0x1003a305
mov ecx, edx
jmp 0x1003a308
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, eax
jb 0x1003a38d
mov eax, dword [ebp - 0xb10]
add eax, ecx
mov edx, eax
cmp eax, ecx
jae 0x1003a32d
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, ecx
jb 0x1003a38d
mov ecx, dword [ebp - 0xadc]
inc ecx
mov dword [ebp - 0xadc], ecx
cmp ecx, 4
jb 0x1003a2f2
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x1003a364
mov dword [ebp - 0xadc], ecx
jmp 0x1003a36b
or dword [ebp - 0xadc], 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp ecx, eax
jb 0x1003a38d
mov eax, edx
neg eax
sbb eax, eax
and eax, dword [ebp - 0xadc]
jmp 0x1003a399
mov edx, dword [ebp - 0xcf0]
mov eax, dword [ebp - 0xd0c]
test esi, esi
js 0x1003a3aa
cmp edx, 4
jne 0x10037b6e
mov eax, dword [eax]
jmp 0x1003a3b0
mov eax, dword [ebp - 0xd20]
mov dword [ebp - 0xaf0], eax
test esi, esi
js 0x1003792e
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xadc], ebx
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [ebp - 0xb10], ecx
cmp edx, eax
jb 0x1003a3dd
mov ecx, edx
jmp 0x1003a3e0
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, eax
jb 0x1003a465
mov eax, dword [ebp - 0xb10]
add eax, ecx
mov edx, eax
cmp eax, ecx
jae 0x1003a405
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, ecx
jb 0x1003a465
mov ecx, dword [ebp - 0xadc]
inc ecx
mov dword [ebp - 0xadc], ecx
cmp ecx, 5
jb 0x1003a3ca
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x1003a43c
mov dword [ebp - 0xadc], ecx
jmp 0x1003a443
or dword [ebp - 0xadc], 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp ecx, eax
jb 0x1003a465
mov eax, edx
neg eax
sbb eax, eax
and eax, dword [ebp - 0xadc]
jmp 0x1003a471
mov edx, dword [ebp - 0xd00]
mov eax, dword [ebp - 0xcf8]
test esi, esi
js 0x1003a482
cmp edx, 4
jne 0x10037b6e
mov ecx, dword [eax]
jmp 0x1003a484
mov ecx, ebx
test esi, esi
js 0x1003792e
mov eax, dword [ebp - 0xb44]
cmp eax, dword [ebp - 0xaf4]
jne 0x10039f74
mov eax, dword [ebp - 0xb34]
cmp eax, dword [ebp - 0xb1c]
jne 0x10039f74
cmp dword [ebp - 0xaf0], 4
mov dword [ebp - 0xb08], ecx
jbe 0x1003a4db
mov eax, dword [ebp - 0xac4]
mov esi, 0x8007007a
mov dword [ebp - 0xab4], esi
mov dword [ebp - 0xbcc], eax
jmp 0x1003792e
mov eax, dword [ebp - 0xafc]
cmp eax, 4
ja 0x1003a4bf
push eax
push edi
push dword [ebp - 0xad8]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xac4]
add esp, 0xc
mov dword [ebp - 0xbcc], eax
test esi, esi
js 0x1003792e
mov eax, dword [ebp - 0xae0]
mov edi, dword [ebp - 0xab8]
test eax, eax
je 0x10037934
mov esi, eax
jmp 0x100378d1
mov esi, dword [0x1006907c]
mov ecx, esi
call dword [0x100ad1dc]
call esi
mov dword [0x10069830], eax
mov eax, dword [0x10069754]
push 0x54
mov dword [ebp - 0xb40], eax
lea eax, [ebp - 0x7bc]
push ebx
push eax
mov dword [0x10069834], edx
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0xc54], ebx
lea edi, [ebp - 0x354]
mov dword [ebp - 0xc50], ebx
stosd dword es:[edi], eax
push 0x2c
push ebx
mov dword [ebp - 0xb00], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x500]
push eax
call fcn.10041311
add esp, 0x18
mov dword [ebp - 0xae4], ebx
xor ebx, ebx
mov edx, 0x1006983c
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x1003a597
mov eax, dword [0x10069838]
push 0
pop ebx
test eax, eax
jne 0x1003ac81
push 0x338
push ebx
mov dword [ebp - 0xaf4], ebx
mov dword [ebp - 0xac4], ebx
mov dword [ebp - 0xb2c], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xad8], edi
test edi, edi
je 0x1003ac20
or dword [ebp - 0xaf0], 0xffffffff
mov eax, 0x7f1137f
mov edx, ebx
mov dword [ebp - 0x3d8], eax
mov eax, ebx
mov dword [ebp - 0xadc], ebx
mov cl, bl
mov dword [ebp - 0xac8], edx
mov ebx, 0x7f1137f
mov dword [ebp - 0xb94], edx
mov dword [ebp - 0xabc], eax
mov edx, ebx
mov dword [ebp - 0xb80], eax
shr edx, 0x10
movzx eax, bx
xor ebx, 0xab69605e
add edi, 7
mov dword [ebp - 0x3dc], 0xab69605e
movzx esi, word [ebp - 0x3da]
mov dword [ebp - 0xae0], edi
mov edi, 0x10002e7a
mov dword [ebp - 0xacc], edx
mov edx, dword [ebp - 0xac8]
mov dword [ebp - 0xaec], esi
mov esi, dword [ebp - 0xabc]
mov dword [ebp - 0xad0], ebx
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xb08], edi
mov dword [ebp - 0xafc], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xb08]
xor edx, ebx
mov dword [ebp - 0xac8], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb08]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb08]
shl edi, 8
add dword [ebp - 0xb08], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, dword [ebp - 0xad0]
mov eax, esi
mov dword [ebp - 0xabc], esi
rol eax, 0xa
lea edx, [esi + 0x54969fa2]
mov esi, dword [ebp - 0xac8]
rol edx, 5
imul edx, dword [ebp - 0xac0]
add edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov eax, esi
rol eax, 2
lea edx, [edx + esi]
ror edx, 9
imul edx, dword [ebp - 0xaec]
sub edx, eax
mov eax, dword [ebp - 0xabc]
xor eax, edx
mov dword [ebp - 0xabc], eax
sub eax, dword [ebp - 0xac0]
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xabc]
shr eax, 0xd
sub edx, eax
xor esi, edx
mov edx, dword [ebp - 0xaec]
xor edx, esi
mov eax, esi
rol edx, 6
imul edx, dword [ebp - 0xacc]
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0xabc]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xabc], eax
xor edx, 0xab69605e
mov eax, 0x7f1137f
sub eax, edx
xor esi, eax
mov eax, dword [ebp - 0xac0]
xor eax, esi
mov edx, esi
imul eax, dword [ebp - 0xaec]
ror edx, 6
xor edx, eax
mov eax, dword [ebp - 0xabc]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xabc], eax
add eax, edx
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xabc]
rol eax, 2
add edx, eax
xor esi, edx
mov eax, esi
rol eax, 8
lea edx, [esi + 0x54969fa2]
ror edx, 0xe
imul edx, dword [ebp - 0xacc]
sub edx, eax
mov eax, dword [ebp - 0xabc]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xabc], eax
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, dword [ebp - 0xac0]
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xacc]
xor edx, esi
mov eax, esi
imul edx, dword [ebp - 0xaec]
shr eax, 0xa
xor edx, eax
xor edx, dword [ebp - 0xabc]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xacc]
xor esi, eax
mov dword [ebp - 0xac8], esi
sub esi, dword [ebp - 0xacc]
xor esi, edx
mov edx, dword [ebp - 0xacc]
xor esi, 0xab69605e
xor edx, esi
mov eax, esi
rol edx, 2
imul edx, dword [ebp - 0xac0]
shr eax, 2
add edx, eax
mov eax, dword [ebp - 0xac8]
xor eax, edx
mov dword [ebp - 0xac8], eax
lea edx, [eax - 0x7f1137f]
rol eax, 7
ror edx, 6
imul edx, dword [ebp - 0xaec]
add edx, eax
mov eax, dword [ebp - 0xac0]
xor esi, edx
xor eax, esi
mov edx, esi
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
mov eax, dword [ebp - 0xac8]
xor eax, edx
mov edx, dword [ebp - 0xaec]
xor edx, eax
mov dword [ebp - 0xac8], eax
rol edx, 5
imul edx, dword [ebp - 0xacc]
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xad0]
xor esi, edx
mov edx, dword [ebp - 0xac8]
xor eax, esi
xor edx, eax
mov eax, edx
mov dword [ebp - 0xac8], edx
ror eax, 3
sub eax, dword [ebp - 0xaec]
imul eax, dword [ebp - 0xac0]
xor esi, eax
mov eax, esi
mov edx, 0x7f1137f
sub eax, edx
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
mov eax, dword [ebp - 0xac8]
xor eax, edx
mov dword [ebp - 0xac8], eax
lea edx, [eax - 0x54969fa2]
rol eax, 0xe
rol edx, 3
imul edx, dword [ebp - 0xacc]
add edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xac0]
sub edx, eax
mov eax, dword [ebp - 0xac8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xac8], eax
shr eax, 3
xor edx, 0x605e
imul edx, dword [ebp - 0xaec]
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
xor eax, esi
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xaf0]
rol eax, 2
mov dword [ebp - 0xb80], esi
mov dword [ebp - 0xaf0], edi
xor edx, eax
mov edi, dword [ebp - 0xb08]
xor edx, dword [ebp - 0xadc]
mov eax, dword [ebp - 0xac8]
xor eax, edx
mov dword [ebp - 0xadc], ebx
mov edx, dword [ebp - 0xae0]
mov dword [ebp - 0xb94], eax
add dword [ebp - 0xae0], 8
mov byte [edx - 4], al
mov al, byte [ebp - 0xb80]
ror dword [ebp - 0xb94], 8
mov byte [edx], al
ror dword [ebp - 0xb80], 8
mov al, byte [ebp - 0xb94]
mov byte [edx - 5], al
mov al, byte [ebp - 0xb80]
ror dword [ebp - 0xb94], 8
mov byte [edx - 1], al
ror dword [ebp - 0xb80], 8
mov al, byte [ebp - 0xb94]
mov byte [edx - 6], al
ror dword [ebp - 0xb94], 8
mov al, byte [ebp - 0xb80]
mov byte [edx - 2], al
ror dword [ebp - 0xb80], 8
mov al, byte [ebp - 0xb94]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb80]
mov byte [edx - 3], al
mov edx, dword [ebp - 0xb94]
mov esi, dword [ebp - 0xb80]
ror edx, 8
ror esi, 8
sub dword [ebp - 0xafc], 1
mov dword [ebp - 0xb94], edx
mov dword [ebp - 0xb80], esi
jne 0x1003a685
mov esi, dword [ebp - 0xad8]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x1003aa60
movzx eax, cl
cdq
cmp eax, dword [0x100031b0]
jne 0x1003aa95
cmp edx, dword [0x100031b4]
jne 0x1003aa95
mov edi, esi
mov dword [ebp - 0xad0], 0x337
mov dword [ebp - 0xac4], edi
mov esi, ebx
jmp 0x1003aaa8
or dword [ebp - 0xad0], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xb2c], 0xc004d501
test esi, esi
je 0x1003aabb
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb2c], ebx
jl 0x1003ac20
mov eax, dword [ebp - 0xad0]
mov esi, edi
push 0x40
push ebx
push 0x10069760
mov byte [eax + edi], bl
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], bl
je 0x1003ac27
mov edi, 0x10069760
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xad8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1003aafc
sub ecx, dword [ebp - 0xad8]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0x1003ac20
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xac0], ecx
cmp word [eax], dx
je 0x1003ab44
mov ecx, 0xc000007b
mov dword [ebp - 0xac0], ecx
jmp 0x1003ab8c
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x1003ab37
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x1003ab37
cmp dword [edx], 0x4550
jne 0x1003ab37
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xbac]
je 0x1003ab7a
cmp ax, word [ebp - 0xb48]
je 0x1003ab7a
mov ecx, 0xc000000d
jmp 0x1003ab3c
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xb0c], eax
mov dword [ebp - 0xad0], ebx
test eax, eax
je 0x1003ac07
mov edx, esi
mov dword [ebp - 0xb10], esi
lea eax, [edx + 1]
mov dword [ebp - 0xad8], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x1003abb3
sub edx, dword [ebp - 0xad8]
inc esi
add esi, edx
test ecx, ecx
js 0x1003abec
push dword [ebp - 0xb10]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0x1003ac12
mov ecx, dword [ebp - 0xaf4]
mov dword [ecx*4 + 0x10069030], eax
mov ecx, dword [ebp - 0xac0]
mov eax, dword [ebp - 0xad0]
inc dword [ebp - 0xaf4]
inc eax
mov dword [ebp - 0xad0], eax
cmp eax, dword [ebp - 0xb0c]
jb 0x1003aba2
add edi, 0x10
cmp byte [esi], bl
jne 0x1003aaef
mov esi, dword [ebp - 0xac0]
mov edi, dword [ebp - 0xac4]
jmp 0x1003ac29
mov esi, 0xc000007a
jmp 0x1003ac18
mov esi, ebx
test edi, edi
je 0x1003ac3c
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0x1003ac7c
mov esi, ebx
mov eax, dword [esi + 0x10069760]
test eax, eax
je 0x1003ac53
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x1003ac42
push 0x40
push ebx
push 0x10069760
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x10001490
mov edi, 0x10069030
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x1003ac87
mov eax, dword [0x10069838]
inc eax
mov dword [0x10069838], eax
xor eax, eax
mov edx, 0x1006983c
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0xc], ebx
lea edi, [ebp - 0xc2c]
mov word [ebp - 8], bx
stosd dword es:[edi], eax
mov dword [ebp - 0xb34], ebx
mov dword [ebp - 0xb44], ebx
mov dword [ebp - 0xbe8], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x3c4]
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x1003acc2
mov eax, dword [0x10069838]
push 0
pop ebx
test eax, eax
jne 0x1003b3a1
push 0x338
push ebx
mov dword [ebp - 0xaf4], ebx
mov dword [ebp - 0xab8], ebx
mov dword [ebp - 0xb2c], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xad8], edi
test edi, edi
je 0x1003b340
or dword [ebp - 0xaf0], 0xffffffff
mov eax, 0x7f1137f
mov edx, ebx
mov dword [ebp - 0x3e8], eax
mov eax, ebx
mov dword [ebp - 0xadc], ebx
mov cl, bl
mov dword [ebp - 0xac8], edx
mov ebx, 0x7f1137f
mov dword [ebp - 0xb98], edx
mov dword [ebp - 0xabc], eax
mov edx, ebx
mov dword [ebp - 0xb84], eax
shr edx, 0x10
movzx eax, bx
xor ebx, 0xab69605e
add edi, 7
mov dword [ebp - 0x3ec], 0xab69605e
movzx esi, word [ebp - 0x3ea]
mov dword [ebp - 0xae0], edi
mov edi, 0x10002e7a
mov dword [ebp - 0xacc], edx
mov edx, dword [ebp - 0xac8]
mov dword [ebp - 0xaec], esi
mov esi, dword [ebp - 0xabc]
mov dword [ebp - 0xad0], ebx
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xb08], edi
mov dword [ebp - 0xafc], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xb08]
xor edx, ebx
mov dword [ebp - 0xac8], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb08]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb08]
shl edi, 8
add dword [ebp - 0xb08], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, dword [ebp - 0xad0]
mov eax, esi
mov dword [ebp - 0xabc], esi
rol eax, 0xa
lea edx, [esi + 0x54969fa2]
mov esi, dword [ebp - 0xac8]
rol edx, 5
imul edx, dword [ebp - 0xac0]
add edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov eax, esi
rol eax, 2
lea edx, [edx + esi]
ror edx, 9
imul edx, dword [ebp - 0xaec]
sub edx, eax
mov eax, dword [ebp - 0xabc]
xor eax, edx
mov dword [ebp - 0xabc], eax
sub eax, dword [ebp - 0xac0]
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xabc]
shr eax, 0xd
sub edx, eax
xor esi, edx
mov edx, esi
mov eax, esi
xor edx, dword [ebp - 0xaec]
rol edx, 6
imul edx, dword [ebp - 0xacc]
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0xabc]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xabc], eax
xor edx, 0xab69605e
mov eax, 0x7f1137f
sub eax, edx
xor esi, eax
mov eax, dword [ebp - 0xac0]
xor eax, esi
mov edx, esi
imul eax, dword [ebp - 0xaec]
ror edx, 6
xor edx, eax
mov eax, dword [ebp - 0xabc]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xabc], eax
add eax, edx
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xabc]
rol eax, 2
add edx, eax
xor esi, edx
mov eax, esi
rol eax, 8
lea edx, [esi + 0x54969fa2]
ror edx, 0xe
imul edx, dword [ebp - 0xacc]
sub edx, eax
mov eax, dword [ebp - 0xabc]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xabc], eax
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, dword [ebp - 0xac0]
xor edx, eax
xor esi, edx
mov edx, esi
mov eax, esi
xor edx, dword [ebp - 0xacc]
imul edx, dword [ebp - 0xaec]
shr eax, 0xa
xor edx, eax
xor edx, dword [ebp - 0xabc]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xacc]
xor esi, eax
mov dword [ebp - 0xac8], esi
sub esi, dword [ebp - 0xacc]
xor esi, edx
xor esi, 0xab69605e
mov edx, esi
mov eax, esi
xor edx, dword [ebp - 0xacc]
rol edx, 2
imul edx, dword [ebp - 0xac0]
shr eax, 2
add edx, eax
mov eax, dword [ebp - 0xac8]
xor eax, edx
mov dword [ebp - 0xac8], eax
lea edx, [eax - 0x7f1137f]
rol eax, 7
ror edx, 6
imul edx, dword [ebp - 0xaec]
add edx, eax
mov eax, dword [ebp - 0xac0]
xor esi, edx
xor eax, esi
mov edx, esi
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
mov eax, dword [ebp - 0xac8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xac8], eax
xor edx, dword [ebp - 0xaec]
rol edx, 5
imul edx, dword [ebp - 0xacc]
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xad0]
xor esi, edx
mov edx, dword [ebp - 0xac8]
xor eax, esi
xor edx, eax
mov eax, edx
mov dword [ebp - 0xac8], edx
ror eax, 3
sub eax, dword [ebp - 0xaec]
imul eax, dword [ebp - 0xac0]
xor esi, eax
mov eax, esi
mov edx, 0x7f1137f
sub eax, edx
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
mov eax, dword [ebp - 0xac8]
xor eax, edx
mov dword [ebp - 0xac8], eax
lea edx, [eax - 0x54969fa2]
rol eax, 0xe
rol edx, 3
imul edx, dword [ebp - 0xacc]
add edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xac0]
sub edx, eax
mov eax, dword [ebp - 0xac8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xac8], eax
shr eax, 3
xor edx, 0x605e
imul edx, dword [ebp - 0xaec]
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
xor eax, esi
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xaf0]
rol eax, 2
mov dword [ebp - 0xb84], esi
mov dword [ebp - 0xaf0], edi
xor edx, eax
mov edi, dword [ebp - 0xb08]
xor edx, dword [ebp - 0xadc]
mov eax, dword [ebp - 0xac8]
xor eax, edx
mov dword [ebp - 0xadc], ebx
mov edx, dword [ebp - 0xae0]
mov dword [ebp - 0xb98], eax
add dword [ebp - 0xae0], 8
mov byte [edx - 4], al
mov al, byte [ebp - 0xb84]
ror dword [ebp - 0xb98], 8
mov byte [edx], al
ror dword [ebp - 0xb84], 8
mov al, byte [ebp - 0xb98]
mov byte [edx - 5], al
mov al, byte [ebp - 0xb84]
ror dword [ebp - 0xb98], 8
mov byte [edx - 1], al
ror dword [ebp - 0xb84], 8
mov al, byte [ebp - 0xb98]
mov byte [edx - 6], al
ror dword [ebp - 0xb98], 8
mov al, byte [ebp - 0xb84]
mov byte [edx - 2], al
ror dword [ebp - 0xb84], 8
mov al, byte [ebp - 0xb98]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb84]
mov byte [edx - 3], al
mov edx, dword [ebp - 0xb98]
mov esi, dword [ebp - 0xb84]
ror edx, 8
ror esi, 8
sub dword [ebp - 0xafc], 1
mov dword [ebp - 0xb98], edx
mov dword [ebp - 0xb84], esi
jne 0x1003adb0
mov esi, dword [ebp - 0xad8]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x1003b18b
movzx eax, cl
cdq
cmp eax, dword [0x100031b0]
jne 0x1003b1b9
cmp edx, dword [0x100031b4]
jne 0x1003b1b9
mov dword [ebp - 0xab8], esi
mov edi, 0x337
mov esi, ebx
jmp 0x1003b1c6
mov dword [ebp - 0xb2c], 0xc004d501
or edi, 0xffffffff
test esi, esi
je 0x1003b1d9
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb2c], ebx
jl 0x1003b340
mov eax, dword [ebp - 0xab8]
mov esi, eax
push 0x40
push ebx
push 0x10069760
mov byte [edi + eax], bl
call sub.msvcrt.dll_memset
mov eax, esi
add esp, 0xc
cmp byte [eax], bl
je 0x1003b347
mov edi, 0x10069760
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xad8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1003b21c
sub ecx, dword [ebp - 0xad8]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0x1003b340
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xac0], ecx
cmp word [eax], dx
je 0x1003b264
mov ecx, 0xc000007b
mov dword [ebp - 0xac0], ecx
jmp 0x1003b2ac
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x1003b257
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x1003b257
cmp dword [edx], 0x4550
jne 0x1003b257
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xbac]
je 0x1003b29a
cmp ax, word [ebp - 0xb48]
je 0x1003b29a
mov ecx, 0xc000000d
jmp 0x1003b25c
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xb0c], eax
mov dword [ebp - 0xad0], ebx
test eax, eax
je 0x1003b327
mov edx, esi
mov dword [ebp - 0xb10], esi
lea eax, [edx + 1]
mov dword [ebp - 0xad8], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x1003b2d3
sub edx, dword [ebp - 0xad8]
inc esi
add esi, edx
test ecx, ecx
js 0x1003b30c
push dword [ebp - 0xb10]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0x1003b332
mov ecx, dword [ebp - 0xaf4]
mov dword [ecx*4 + 0x10069030], eax
mov ecx, dword [ebp - 0xac0]
mov eax, dword [ebp - 0xad0]
inc dword [ebp - 0xaf4]
inc eax
mov dword [ebp - 0xad0], eax
cmp eax, dword [ebp - 0xb0c]
jb 0x1003b2c2
add edi, 0x10
cmp byte [esi], bl
jne 0x1003b20f
mov esi, dword [ebp - 0xac0]
mov eax, dword [ebp - 0xab8]
jmp 0x1003b349
mov esi, 0xc000007a
jmp 0x1003b338
mov esi, ebx
test eax, eax
je 0x1003b35c
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0x1003b39c
mov esi, ebx
mov eax, dword [esi + 0x10069760]
test eax, eax
je 0x1003b373
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x1003b362
push 0x40
push ebx
push 0x10069760
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x10001490
mov edi, 0x10069030
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x1003b3a7
mov eax, dword [0x10069838]
inc eax
mov dword [0x10069838], eax
xor eax, eax
mov ecx, 0x1006983c
xchg dword [ecx], eax
push 0x54
lea eax, [ebp - 0x7bc]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xb40]
add esp, 0xc
mov esi, dword [0x100690ac]
mov ecx, eax
mov dword [ebp - 0x354], ebx
push 0xf
pop edx
and ecx, edx
mov dword [ebp - 0xaec], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0xc], cx
mov ecx, eax
shr ecx, 8
push 0x403
and ecx, edx
shr eax, 0xc
push ebx
mov word [ebp - 0xa], cx
and eax, edx
push ebx
mov ecx, esi
mov word [ebp - 8], ax
call dword [0x100ad1dc]
call esi
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xacc], 0xffffff
test eax, eax
jne 0x1003b45d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xab8], edi
test edi, edi
jle 0x1003b448
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xab8], edi
test edi, edi
js 0x1003ca80
mov dword [ebp - 0xab8], 0x80004005
jmp 0x1003ca80
mov esi, dword [0x10069080]
lea eax, [ebp - 0xbf4]
push eax
push ebx
lea eax, [ebp - 0xbdc]
mov dword [ebp - 0xc08], ebx
push eax
mov edi, ebx
mov dword [ebp - 0xbe0], ebx
push 8
mov ecx, esi
mov dword [ebp - 0xb40], ebx
mov dword [ebp - 0xb88], ebx
mov dword [ebp - 0xbd4], ebx
mov dword [ebp - 0xbb8], ebx
mov dword [ebp - 0xab8], edi
mov dword [ebp - 0xbf4], ebx
call dword [0x100ad1dc]
call esi
test eax, eax
jne 0x1003b4ed
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xab8], edi
test edi, edi
jle 0x1003b4d7
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xab8], edi
test edi, edi
js 0x1003b639
mov edi, 0x80004005
mov dword [ebp - 0xab8], edi
jmp 0x1003b639
mov eax, dword [ebp - 0xbf4]
add eax, eax
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
lea ecx, [ebp - 0xbd4]
mov esi, eax
call fcn.10051c8c
test esi, esi
jne 0x1003b522
mov dword [ebp - 0xbd4], ebx
mov edi, 0x8007000e
jmp 0x1003b4e2
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0xbd4], esi
lea eax, [eax*4 + 4]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
lea ecx, [ebp - 0xbb8]
mov esi, eax
call fcn.10051c8c
test esi, esi
jne 0x1003b565
mov edi, 0x8007000e
mov dword [ebp - 0xab8], edi
jmp 0x1003b633
lea eax, [ebp - 0xbf4]
mov dword [ebp - 0xbb8], esi
mov esi, dword [0x10069080]
mov ecx, esi
push eax
push dword [ebp - 0xbd4]
lea eax, [ebp - 0xbdc]
push eax
push 8
call dword [0x100ad1dc]
call esi
test eax, eax
je 0x1003b4b4
cmp dword [ebp - 0xbdc], 0
mov edx, dword [ebp - 0xbb8]
mov eax, dword [ebp - 0xbd4]
mov dword [ebp - 0xad0], edx
mov dword [ebp - 0xadc], ebx
jbe 0x1003b614
mov edi, eax
mov esi, dword [0x10069088]
mov ecx, esi
push ebx
push edi
call dword [0x100ad1dc]
call esi
mov edx, dword [ebp - 0xad0]
mov ecx, edi
mov dword [edx], eax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1003b5db
mov eax, dword [ebp - 0xadc]
sub ecx, esi
sar ecx, 1
add edx, 4
mov dword [ebp - 0xad0], edx
lea edi, [edi + ecx*2]
add edi, 2
inc eax
mov dword [ebp - 0xadc], eax
cmp eax, dword [ebp - 0xbdc]
jb 0x1003b5bc
mov edi, dword [ebp - 0xab8]
mov dword [edx], 0x409
mov eax, dword [ebp - 0xbb8]
mov dword [ebp - 0xc08], eax
mov eax, dword [ebp - 0xbdc]
inc eax
mov dword [ebp - 0xad0], eax
mov dword [ebp - 0xbb8], ebx
lea ecx, [ebp - 0xbb8]
call fcn.10051c8c
lea ecx, [ebp - 0xbd4]
call fcn.10051c8c
test edi, edi
js 0x1003bda5
cmp dword [ebp - 0xad0], 0
mov edi, ebx
mov dword [ebp - 0xae0], edi
mov esi, ebx
jbe 0x1003b697
mov eax, dword [ebp - 0xc08]
mov edx, ebx
mov ecx, dword [eax + esi*4]
cmp ecx, dword [edx*4 + 0x10002a80]
je 0x1003b68f
inc edx
cmp edx, 0x26
jb 0x1003b672
inc esi
cmp esi, dword [ebp - 0xad0]
jb 0x1003b670
jmp 0x1003b697
mov edi, edx
mov dword [ebp - 0xae0], edx
mov esi, dword [0x10069084]
lea eax, [ebp - 0xb8]
push ebx
push 0x55
push eax
push dword [edi*4 + 0x10002a80]
mov ecx, esi
mov dword [ebp - 0xb2c], ebx
call dword [0x100ad1dc]
call esi
test eax, eax
je 0x1003b6fc
mov esi, dword [0x10069078]
lea eax, [ebp - 0x68c]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xb8]
mov ecx, esi
push eax
call dword [0x100ad1dc]
call esi
test eax, eax
jle 0x1003b6fc
mov edi, dword [ebp - 0x680]
xor eax, eax
shr edi, 0x1b
inc eax
and edi, eax
mov dword [ebp - 0xb2c], edi
mov edx, 0x10002b98
mov esi, ebx
mov ecx, edx
mov dword [ebp + esi*4 - 0x344], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1003b70f
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0x1003b703
imul ecx, dword [ebp - 0xae0], 3
movzx eax, byte [ecx + 0x10002b18]
mov esi, dword [ebp + eax*4 - 0x344]
movzx eax, byte [ecx + 0x10002b19]
mov dword [ebp - 0xac4], esi
mov dword [ebp - 0xc2c], esi
mov eax, dword [ebp + eax*4 - 0x344]
mov dword [ebp - 0xb1c], eax
mov dword [ebp - 0xc28], eax
movzx eax, byte [ecx + 0x10002b1a]
mov esi, dword [ebp + eax*4 - 0x344]
mov dword [ebp - 0xaf4], esi
mov dword [ebp - 0xc24], esi
push 0x1c90
mov eax, ebx
push ebx
mov dword [ebp - 0xab8], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xb18], edi
test edi, edi
je 0x1003bc42
or dword [ebp - 0xadc], 0xffffffff
mov ecx, 0x7f1137f
mov edx, ecx
mov dword [ebp - 0x3e4], 0xab69605e
movzx esi, word [ebp - 0x3e2]
mov al, bl
shr edx, 0x10
add edi, 7
mov dword [ebp - 0x3e0], ecx
movzx ecx, cx
mov dword [ebp - 0xac8], esi
mov esi, 0x100031ba
mov dword [ebp - 0xad0], ebx
mov dword [ebp - 0xb70], ebx
mov dword [ebp - 0xb9c], ebx
mov dword [ebp - 0xac0], ecx
mov dword [ebp - 0xad4], edx
mov dword [ebp - 0xaf0], edi
mov dword [ebp - 0xafc], 0x392
movzx edx, byte [esi - 2]
movzx ecx, byte [esi - 1]
movzx edi, byte [esi + 2]
shl edx, 8
or edx, ecx
shl edi, 8
movzx ecx, byte [esi]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 1]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 3]
or edi, ecx
mov dword [ebp - 0xb10], edx
movzx ecx, byte [esi + 4]
xor ebx, edx
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 5]
add esi, 8
shl edi, 8
or edi, ecx
mov dword [ebp - 0xb0c], esi
mov ecx, 0x7f1137f
mov esi, edi
xor esi, ecx
xor esi, dword [ebp - 0xb70]
xor esi, ebx
xor esi, 0xab69605e
mov ecx, esi
rol ecx, 0xa
lea edx, [esi + 0x54969fa2]
rol edx, 5
imul edx, dword [ebp - 0xac0]
add edx, ecx
xor ebx, edx
mov edx, 0x7f1137f
mov ecx, ebx
rol ecx, 2
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [ebp - 0xac8]
sub edx, ecx
xor esi, edx
mov ecx, esi
sub ecx, dword [ebp - 0xac0]
imul edx, ecx, 0x605e
mov ecx, esi
shr ecx, 0xd
sub edx, ecx
xor ebx, edx
mov edx, dword [ebp - 0xac8]
xor edx, ebx
mov ecx, ebx
rol edx, 6
imul edx, dword [ebp - 0xad4]
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub ecx, edx
xor ebx, ecx
mov ecx, dword [ebp - 0xac0]
xor ecx, ebx
mov edx, ebx
imul ecx, dword [ebp - 0xac8]
ror edx, 6
xor edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
add ecx, esi
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, esi
rol ecx, 2
add edx, ecx
xor ebx, edx
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
mov ecx, ebx
imul edx, dword [ebp - 0xad4]
rol ecx, 8
sub edx, ecx
xor esi, edx
mov edx, esi
mov ecx, esi
xor edx, 0xab69605e
ror ecx, 0xa
ror edx, 0xc
imul edx, dword [ebp - 0xac0]
xor edx, ecx
xor ebx, edx
mov edx, dword [ebp - 0xad4]
xor edx, ebx
mov ecx, ebx
imul edx, dword [ebp - 0xac8]
shr ecx, 0xa
xor edx, ecx
xor edx, esi
mov ecx, edx
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, dword [ebp - 0xad4]
xor ebx, ecx
mov esi, ebx
sub esi, dword [ebp - 0xad4]
xor esi, edx
mov edx, dword [ebp - 0xad4]
xor esi, 0xab69605e
xor edx, esi
mov ecx, esi
rol edx, 2
imul edx, dword [ebp - 0xac0]
shr ecx, 2
add edx, ecx
mov ecx, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, ecx
mov ecx, ebx
ror edx, 6
imul edx, dword [ebp - 0xac8]
rol ecx, 7
add edx, ecx
mov ecx, dword [ebp - 0xac0]
xor esi, edx
xor ecx, esi
mov edx, esi
imul ecx, ecx, 0x605e
ror edx, 9
add edx, ecx
xor ebx, edx
mov edx, dword [ebp - 0xac8]
xor edx, ebx
mov dword [ebp - 0xad8], ebx
rol edx, 5
mov ecx, ebx
imul edx, dword [ebp - 0xad4]
rol ecx, 7
add edx, ecx
xor esi, edx
mov edx, 0x7f1137f
mov ebx, esi
xor ebx, edx
xor ebx, dword [ebp - 0xad8]
xor ebx, 0xab69605e
mov ecx, ebx
ror ecx, 3
sub ecx, dword [ebp - 0xac8]
imul ecx, dword [ebp - 0xac0]
xor esi, ecx
mov ecx, esi
sub ecx, edx
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, esi
ror ecx, 6
sub edx, ecx
xor ebx, edx
mov ecx, ebx
rol ecx, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [ebp - 0xad4]
add edx, ecx
xor esi, edx
mov ecx, esi
ror ecx, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xac0]
sub edx, ecx
xor ebx, edx
mov edx, ebx
mov ecx, ebx
shr ecx, 3
xor edx, 0x605e
imul edx, dword [ebp - 0xac8]
xor edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
xor ecx, esi
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, esi
xor esi, dword [ebp - 0xadc]
rol ecx, 2
mov dword [ebp - 0xb70], esi
mov esi, dword [ebp - 0xb0c]
xor edx, ecx
mov dword [ebp - 0xadc], edi
xor edx, dword [ebp - 0xad0]
xor ebx, edx
mov edx, dword [ebp - 0xaf0]
mov dword [ebp - 0xb9c], ebx
mov byte [edx - 4], bl
mov cl, byte [ebp - 0xb70]
ror dword [ebp - 0xb9c], 8
mov byte [edx], cl
mov cl, byte [ebp - 0xb9c]
ror dword [ebp - 0xb70], 8
mov byte [edx - 5], cl
mov cl, byte [ebp - 0xb70]
ror dword [ebp - 0xb9c], 8
mov byte [edx - 1], cl
mov cl, byte [ebp - 0xb9c]
ror dword [ebp - 0xb70], 8
mov byte [edx - 6], cl
mov cl, byte [ebp - 0xb70]
ror dword [ebp - 0xb9c], 8
mov byte [edx - 2], cl
mov cl, byte [ebp - 0xb9c]
ror dword [ebp - 0xb70], 8
mov byte [edx - 7], cl
mov cl, byte [ebp - 0xb70]
mov byte [edx - 3], cl
add edx, 8
mov ebx, dword [ebp - 0xb9c]
ror dword [ebp - 0xb70], 8
mov ecx, dword [ebp - 0xb10]
ror ebx, 8
sub dword [ebp - 0xafc], 1
mov dword [ebp - 0xb9c], ebx
mov dword [ebp - 0xad0], ecx
mov dword [ebp - 0xaf0], edx
jne 0x1003b813
mov ecx, dword [ebp - 0xb18]
xor ebx, ebx
mov edx, ebx
mov esi, 0x1c90
xor al, byte [edx + ecx]
inc edx
cmp edx, esi
jb 0x1003bb7e
movzx eax, al
cdq
cmp eax, dword [0x10004e48]
jne 0x1003bbb0
cmp edx, dword [0x10004e4c]
jne 0x1003bbb0
mov edi, dword [ebp - 0xab8]
mov dword [ebp - 0xbe0], ecx
mov ecx, ebx
mov dword [ebp - 0xb40], esi
jmp 0x1003bbbb
mov edi, 0xc004d501
mov dword [ebp - 0xab8], edi
test ecx, ecx
je 0x1003bbce
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
js 0x1003bdc9
mov edi, dword [ebp - 0xbe0]
mov esi, ebx
mov edx, ebx
mov ebx, dword [ebp - 0xae0]
cmp ebx, edx
jne 0x1003bbf1
mov dword [ebp + esi*4 - 0x2f8], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0xad8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003bbfc
sub ecx, dword [ebp - 0xad8]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0x1003bbe6
inc esi
push 0
pop ebx
cmp esi, 6
jb 0x1003bbde
push 0xc
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
lea ecx, [ebp - 0xb88]
mov edi, eax
call fcn.10051c8c
test edi, edi
jne 0x1003bc52
mov dword [ebp - 0xb88], ebx
mov edi, 0x8007000e
mov dword [ebp - 0xab8], edi
jmp 0x1003bdc9
mov dword [ebp - 0xb88], edi
lea ecx, [ebp - 0xc]
xor eax, eax
mov dword [ebp - 0xad0], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, ebx
movzx edx, word [ecx]
mov eax, ebx
cmp dx, word [eax*2 + 0x10002b8c]
je 0x1003bc82
inc eax
cmp eax, 6
jb 0x1003bc6d
jmp 0x1003bd3b
mov edx, dword [ebp + eax*4 - 0x2f8]
mov ecx, edx
mov dword [ebp - 0xad8], edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003bc94
sub ecx, esi
mov esi, dword [0x10069090]
push ebx
push ebx
lea eax, [ecx + 1]
mov ecx, esi
push eax
push edx
push ebx
push 0xfde9
call dword [0x100ad1dc]
call esi
mov esi, eax
test esi, esi
je 0x1003bd76
lea ecx, [esi + esi]
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0xb88]
mov dword [ecx + edi], eax
mov eax, dword [ebp - 0xb88]
cmp dword [eax + edi], ebx
je 0x1003bc42
mov edx, dword [ebp - 0xad8]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xad8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1003bcff
sub ecx, dword [ebp - 0xad8]
mov eax, dword [ebp - 0xb88]
push esi
mov esi, dword [0x10069090]
push dword [eax + edi]
lea eax, [ecx + 1]
mov ecx, esi
push eax
push edx
push ebx
push 0xfde9
call dword [0x100ad1dc]
call esi
test eax, eax
je 0x1003bd76
mov ecx, dword [ebp - 0xad0]
add ecx, 2
add edi, 4
mov dword [ebp - 0xad0], ecx
cmp edi, 0xc
jb 0x1003bc68
mov eax, dword [ebp - 0xb88]
mov edi, dword [ebp - 0xab8]
mov dword [ebp - 0xbe8], eax
mov eax, dword [ebp - 0xb2c]
mov dword [ebp - 0xb88], ebx
mov dword [ebp - 0x7bc], eax
jmp 0x1003bdc9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xab8], edi
test edi, edi
jle 0x1003bd99
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xab8], edi
test edi, edi
js 0x1003bdc9
mov edi, 0x80004005
jmp 0x1003bc47
mov eax, dword [ebp - 0xc24]
mov dword [ebp - 0xaf4], eax
mov eax, dword [ebp - 0xc28]
mov dword [ebp - 0xb1c], eax
mov eax, dword [ebp - 0xc2c]
mov dword [ebp - 0xac4], eax
cmp dword [ebp - 0xb88], 0
je 0x1003be2f
mov esi, ebx
mov eax, dword [ebp - 0xb88]
cmp dword [eax + esi], ebx
je 0x1003be27
mov ecx, dword [eax + esi]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1003bde5
mov eax, dword [ebp - 0xb88]
sub ecx, edx
sar ecx, 1
mov eax, dword [eax + esi]
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x1003be10
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x1003be08
mov eax, dword [ebp - 0xb88]
push dword [eax + esi]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
add esi, 4
cmp esi, 0xc
jb 0x1003bdd4
mov eax, dword [ebp - 0xbe0]
test eax, eax
je 0x1003be4b
mov ecx, dword [ebp - 0xb40]
test ecx, ecx
je 0x1003be4b
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x1003be43
lea ecx, [ebp - 0xb88]
call fcn.10051c8c
lea ecx, [ebp - 0xbe0]
call fcn.10051c8c
lea ecx, [ebp - 0xc08]
call fcn.10051c8c
test edi, edi
js 0x1003ca69
mov eax, dword [ebp - 0xbe8]
lea edi, [ebp - 0xccc]
mov esi, dword [0x100690e4]
push ebx
mov ecx, dword [eax]
mov dword [ebp - 0x7b4], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x7b0], ecx
mov ecx, esi
mov eax, dword [eax + 8]
mov dword [ebp - 0x7ac], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xccc]
push eax
push ebx
mov edi, ebx
mov dword [ebp - 0xccc], 0xc
push 0x42
mov dword [ebp - 0xab8], edi
call dword [0x100ad1dc]
call esi
test eax, eax
jne 0x1003bf04
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xab8], edi
test edi, edi
jle 0x1003bef3
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xab8], edi
test edi, edi
mov eax, ebx
js 0x1003bf0f
mov edi, 0x80004005
mov dword [ebp - 0xab8], edi
jmp 0x1003bf0f
mov eax, dword [ebp - 0xcc8]
xor ecx, ecx
inc ecx
and eax, ecx
mov dword [ebp - 0x7b8], eax
test edi, edi
js 0x1003ca69
mov eax, dword [ebp - 0xaec]
push 0x2a
pop ecx
mov dword [ebp - 0xb30], ecx
sub eax, 1
je 0x1003bf5a
sub eax, 1
je 0x1003bf4e
sub eax, 1
jne 0x1003bf6a
mov edi, 0xe1
mov dword [ebp - 0xb34], edi
mov dword [ebp - 0xb44], edi
jmp 0x1003bf6a
mov dword [ebp - 0xb34], 0xf
jmp 0x1003bf60
mov dword [ebp - 0xb34], ecx
mov dword [ebp - 0xb44], 0xb
mov esi, 0xdc
mov dword [ebp - 0xb08], 0x60
push esi
lea eax, [ebp - 0x768]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov word [ebp - 0x724], si
mov esi, dword [0x100690a0]
lea eax, [ebp - 0x768]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0x100ad1dc]
call esi
test eax, eax
je 0x1003bffb
mov eax, dword [ebp - 0x6bc]
movzx edi, word [ebp - 0x6c2]
mov ecx, dword [ebp - 0x6b8]
push 0x60
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0x3bc], eax
pop eax
mov dword [ebp - 0xb08], edi
mov dword [ebp - 0x3c0], ebx
mov dword [ebp - 0x3c4], ebx
mov dword [ebp - 0xadc], ecx
mov dword [ebp - 0x3b8], ecx
cmp edi, eax
jae 0x1003c013
mov dword [ebp - 0xb08], eax
jmp 0x1003c013
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0xae0], eax
xor eax, eax
inc eax
cmp dword [ebp - 0xaec], eax
mov eax, dword [ebp - 0xac4]
je 0x1003c02a
mov eax, dword [ebp - 0xaf4]
push 0x5c
mov dword [ebp - 0xad0], eax
lea eax, [ebp - 0x66c]
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x100690ac]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xab8], edi
push 0x403
push ebx
push ebx
call dword [0x100ad1dc]
call esi
mov dword [ebp - 0xad8], eax
test eax, eax
jne 0x1003c0a3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xab8], edi
test edi, edi
jle 0x1003c08e
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xab8], edi
test edi, edi
js 0x1003c158
mov dword [ebp - 0xab8], 0x80004005
jmp 0x1003ca69
mov esi, dword [0x1006908c]
mov ecx, esi
push 0x48
push dword [ebp - 0xb08]
push dword [ebp - 0xb34]
call dword [0x100ad1dc]
call esi
push dword [ebp - 0xad0]
neg eax
mov dword [ebp - 0x65c], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x650]
mov dword [ebp - 0x66c], eax
mov byte [ebp - 0x652], 5
call fcn.10051b1a
mov esi, dword [0x10069040]
lea eax, [ebp - 0x66c]
push eax
mov ecx, esi
call dword [0x100ad1dc]
call esi
test eax, eax
jne 0x1003c13b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xab8], edi
test edi, edi
jle 0x1003c12c
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xab8], edi
test edi, edi
js 0x1003c141
mov edi, 0x80004005
mov dword [ebp - 0xab8], edi
jmp 0x1003c141
mov dword [ebp - 0x7a8], eax
push dword [ebp - 0xad8]
mov esi, dword [0x100690e0]
mov ecx, esi
push ebx
call dword [0x100ad1dc]
call esi
test edi, edi
js 0x1003ca69
xor eax, eax
inc eax
cmp dword [ebp - 0xaec], eax
je 0x1003c177
mov eax, dword [ebp - 0xaf4]
mov dword [ebp - 0xac4], eax
push 0x5c
lea eax, [ebp - 0x610]
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x100690ac]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xab8], edi
push 0x403
push ebx
push ebx
call dword [0x100ad1dc]
call esi
mov dword [ebp - 0xad8], eax
test eax, eax
jne 0x1003c1e0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xab8], edi
test edi, edi
jle 0x1003c1d5
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xab8], edi
test edi, edi
js 0x1003c295
jmp 0x1003c094
mov esi, dword [0x1006908c]
mov ecx, esi
push 0x48
push dword [ebp - 0xb08]
push dword [ebp - 0xb44]
call dword [0x100ad1dc]
call esi
push dword [ebp - 0xac4]
neg eax
mov dword [ebp - 0x600], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x5f4]
mov dword [ebp - 0x610], eax
mov byte [ebp - 0x5f6], 5
call fcn.10051b1a
mov esi, dword [0x10069040]
lea eax, [ebp - 0x610]
push eax
mov ecx, esi
call dword [0x100ad1dc]
call esi
test eax, eax
jne 0x1003c278
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xab8], edi
test edi, edi
jle 0x1003c269
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xab8], edi
test edi, edi
js 0x1003c27e
mov edi, 0x80004005
mov dword [ebp - 0xab8], edi
jmp 0x1003c27e
mov dword [ebp - 0x7a4], eax
push dword [ebp - 0xad8]
mov esi, dword [0x100690e0]
mov ecx, esi
push ebx
call dword [0x100ad1dc]
call esi
test edi, edi
js 0x1003ca69
mov esi, dword [ebp - 0xaec]
mov ecx, ebx
mov eax, esi
mov edx, ebx
sub eax, 1
je 0x1003c2b8
sub eax, 1
je 0x1003c2f6
sub eax, 1
jne 0x1003c2c4
mov ecx, dword [ebp - 0xae0]
mov edx, dword [ebp - 0xadc]
mov dword [ebp - 0x34c], ecx
mov dword [ebp - 0x348], edx
xor edx, edx
inc edx
cmp esi, edx
je 0x1003c336
lea eax, [esi - 2]
cmp eax, edx
ja 0x1003c30a
mov eax, ebx
mov dword [ebp - 0xb30], ebx
mov edx, ebx
mov dword [ebp - 0xb34], eax
mov dword [ebp - 0xb44], ebx
jmp 0x1003c34d
mov eax, dword [ebp - 0xae0]
cdq
and edx, 3
lea ecx, [edx + eax]
mov edx, ebx
sar ecx, 2
jmp 0x1003c2c4
mov eax, dword [ebp - 0xbd8]
mov edx, dword [ebp - 0xbd8]
mov dword [ebp - 0xb44], eax
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xb30], eax
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xb34], eax
jmp 0x1003c34d
mov edx, 0x96
mov dword [ebp - 0xb34], ebx
mov eax, ebx
mov dword [ebp - 0xb44], 0x20
mov dword [ebp - 0xac4], edx
push dword [ebp - 0x7a8]
mov esi, dword [0x1006906c]
sub ecx, edx
push dword [ebp - 0xabc]
mov edi, dword [ebp - 0x7b4]
sub ecx, eax
mov dword [ebp - 0xad4], ecx
mov eax, ebx
mov dword [ebp - 0x780], ecx
mov dword [ebp - 0x790], ecx
mov ecx, esi
mov dword [ebp - 0xab8], eax
call dword [0x100ad1dc]
call esi
mov esi, dword [0x1006909c]
mov ecx, esi
push ebx
push 0xc50
mov dword [ebp - 0xad8], eax
lea eax, [ebp - 0x798]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xabc]
call dword [0x100ad1dc]
call esi
test eax, eax
jne 0x1003c3d0
mov edi, 0x80004005
mov dword [ebp - 0xab8], edi
jmp 0x1003c3d2
mov edi, ebx
mov eax, dword [ebp - 0xad8]
test eax, eax
je 0x1003c3f3
mov esi, dword [0x1006906c]
mov ecx, esi
push eax
push dword [ebp - 0xabc]
call dword [0x100ad1dc]
call esi
test edi, edi
js 0x1003ca69
push dword [ebp - 0x7a4]
mov esi, dword [0x1006906c]
mov eax, ebx
push dword [ebp - 0xabc]
mov edi, dword [ebp - 0x7b0]
mov ecx, esi
mov dword [ebp - 0xab8], eax
call dword [0x100ad1dc]
call esi
mov esi, dword [0x1006909c]
mov ecx, esi
push ebx
push 0xc50
mov dword [ebp - 0xad8], eax
lea eax, [ebp - 0x788]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xabc]
call dword [0x100ad1dc]
call esi
test eax, eax
jne 0x1003c462
mov edi, 0x80004005
mov dword [ebp - 0xab8], edi
jmp 0x1003c464
mov edi, ebx
mov eax, dword [ebp - 0xad8]
test eax, eax
je 0x1003c485
mov esi, dword [0x1006906c]
mov ecx, esi
push eax
push dword [ebp - 0xabc]
call dword [0x100ad1dc]
call esi
test edi, edi
js 0x1003ca69
mov eax, dword [ebp - 0xaec]
cmp eax, 2
je 0x1003c49d
cmp eax, 3
jne 0x1003c4bf
mov edi, dword [ebp - 0x780]
mov dword [ebp - 0xad4], edi
cmp dword [ebp - 0x790], edi
jle 0x1003c4c5
mov edi, dword [ebp - 0x790]
mov dword [ebp - 0xad4], edi
jmp 0x1003c4c5
mov edi, dword [ebp - 0xad4]
cmp dword [ebp - 0x7bc], 0
mov esi, dword [0x100690d8]
mov ecx, esi
push dword [ebp - 0xb30]
je 0x1003c518
mov eax, dword [ebp - 0xb34]
sub eax, dword [ebp - 0x790]
add eax, edi
push eax
lea eax, [ebp - 0x798]
push eax
call dword [0x100ad1dc]
call esi
mov eax, dword [ebp - 0x78c]
add eax, dword [ebp - 0xb44]
push eax
mov eax, dword [ebp - 0xb34]
sub eax, dword [ebp - 0x780]
add eax, edi
push eax
jmp 0x1003c540
push dword [ebp - 0xac4]
lea eax, [ebp - 0x798]
push eax
call dword [0x100ad1dc]
call esi
mov eax, dword [ebp - 0x78c]
add eax, dword [ebp - 0xb44]
push eax
push dword [ebp - 0xac4]
mov esi, dword [0x100690d8]
lea eax, [ebp - 0x788]
push eax
mov ecx, esi
call dword [0x100ad1dc]
call esi
mov eax, dword [ebp - 0xaec]
cmp eax, 2
je 0x1003c858
cmp eax, 3
je 0x1003c858
xor edx, edx
inc edx
cmp eax, edx
jne 0x1003c877
push 0x5c
lea eax, [ebp - 0x5b4]
mov dword [ebp - 0x79c], 0xffffff
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x100690ac]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xab8], edi
push 0x403
push ebx
push ebx
call dword [0x100ad1dc]
call esi
mov dword [ebp - 0xad8], eax
test eax, eax
jne 0x1003c5ed
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xab8], edi
test edi, edi
jle 0x1003c5e2
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xab8], edi
test edi, edi
js 0x1003c69e
jmp 0x1003c094
mov esi, dword [0x1006908c]
mov ecx, esi
push 0x48
push dword [ebp - 0xb08]
push 0xb
call dword [0x100ad1dc]
call esi
push dword [ebp - 0xb1c]
neg eax
mov dword [ebp - 0x5a4], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x598]
mov dword [ebp - 0x5b4], eax
mov byte [ebp - 0x59a], 5
call fcn.10051b1a
mov esi, dword [0x10069040]
lea eax, [ebp - 0x5b4]
push eax
mov ecx, esi
call dword [0x100ad1dc]
call esi
test eax, eax
jne 0x1003c681
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xab8], edi
test edi, edi
jle 0x1003c672
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xab8], edi
test edi, edi
js 0x1003c687
mov edi, 0x80004005
mov dword [ebp - 0xab8], edi
jmp 0x1003c687
mov dword [ebp - 0x7a0], eax
push dword [ebp - 0xad8]
mov esi, dword [0x100690e0]
mov ecx, esi
push ebx
call dword [0x100ad1dc]
call esi
test edi, edi
js 0x1003ca69
push dword [ebp - 0x7a0]
mov eax, dword [ebp - 0xad4]
push dword [ebp - 0xabc]
mov esi, dword [0x1006906c]
mov ecx, esi
mov edi, dword [ebp - 0x7ac]
mov dword [ebp - 0x770], eax
mov eax, ebx
mov dword [ebp - 0xab8], eax
call dword [0x100ad1dc]
call esi
mov esi, dword [0x1006909c]
mov ecx, esi
push ebx
push 0x460
mov dword [ebp - 0xad8], eax
lea eax, [ebp - 0x778]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xabc]
call dword [0x100ad1dc]
call esi
test eax, eax
jne 0x1003c719
mov edi, 0x80004005
mov dword [ebp - 0xab8], edi
jmp 0x1003c71b
mov edi, ebx
mov eax, dword [ebp - 0xad8]
test eax, eax
je 0x1003c73c
mov esi, dword [0x1006906c]
mov ecx, esi
push eax
push dword [ebp - 0xabc]
call dword [0x100ad1dc]
call esi
test edi, edi
js 0x1003ca69
mov eax, dword [ebp - 0x770]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x770], eax
cmp eax, ecx
jge 0x1003c760
mov dword [ebp - 0x770], ecx
mov edi, dword [ebp - 0xb08]
mov esi, dword [0x1006908c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x778]
mov dword [ebp - 0x76c], 0x20
call dword [0x100ad1dc]
call esi
mov esi, dword [0x1006908c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x774]
mov dword [ebp - 0x778], eax
call dword [0x100ad1dc]
call esi
mov esi, dword [0x1006908c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x770]
mov dword [ebp - 0x774], eax
call dword [0x100ad1dc]
call esi
mov esi, dword [0x1006908c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x76c]
mov dword [ebp - 0x770], eax
call dword [0x100ad1dc]
call esi
cmp dword [ebp - 0x7bc], 0
mov dword [ebp - 0x76c], eax
je 0x1003c82d
mov ecx, dword [ebp - 0x798]
cmp ecx, dword [ebp - 0x788]
jl 0x1003c809
mov ecx, dword [ebp - 0x788]
mov eax, dword [ebp - 0x77c]
add eax, 0x24
mov esi, dword [0x100690d8]
push eax
push ecx
lea eax, [ebp - 0x778]
mov ecx, esi
push eax
call dword [0x100ad1dc]
call esi
jmp 0x1003c874
mov ecx, dword [ebp - 0x790]
cmp ecx, dword [ebp - 0x780]
jg 0x1003c841
mov ecx, dword [ebp - 0x780]
mov eax, dword [ebp - 0x77c]
sub ecx, dword [ebp - 0x770]
add eax, 0x24
add ecx, dword [ebp - 0x778]
jmp 0x1003c812
mov eax, dword [ebp - 0x77c]
mov dword [ebp - 0x34c], edi
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x79c], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [ebp - 0x7bc]
lea edi, [ebp - 0x47c]
mov dword [ebp - 0xad8], eax
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0xad0], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xaec]
sub eax, 1
je 0x1003ca57
sub eax, 1
je 0x1003c97e
sub eax, 1
jne 0x1003ca63
mov esi, dword [0x100690d4]
lea edi, [ebp - 0x46c]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0x100ad1dc]
call esi
mov esi, dword [0x100690b4]
lea ecx, [ebp - 0x46c]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x46c], 0x28
call dword [0x100ad1dc]
call esi
test eax, eax
je 0x1003ca63
mov esi, dword [0x100690d0]
lea eax, [ebp - 0x458]
push eax
push ebx
mov ecx, esi
call dword [0x100ad1dc]
call esi
mov esi, dword [0x100690d0]
lea eax, [ebp - 0x450]
push eax
push ebx
mov ecx, esi
call dword [0x100ad1dc]
call esi
mov eax, dword [ebp - 0x450]
lea esi, [ebp - 0x458]
sub eax, dword [ebp - 0xad0]
lea edi, [ebp - 0x47c]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x44c]
sub eax, dword [ebp - 0xadc]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
jmp 0x1003ca4c
mov esi, dword [0x100690d4]
lea edi, [ebp - 0x42c]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0x100ad1dc]
call esi
mov esi, dword [0x100690b4]
lea ecx, [ebp - 0x42c]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x42c], 0x28
call dword [0x100ad1dc]
call esi
test eax, eax
je 0x1003ca63
mov esi, dword [0x100690d0]
lea eax, [ebp - 0x418]
push eax
push ebx
mov ecx, esi
call dword [0x100ad1dc]
call esi
mov esi, dword [0x100690d0]
lea eax, [ebp - 0x410]
push eax
push ebx
mov ecx, esi
call dword [0x100ad1dc]
call esi
cmp dword [ebp - 0xad8], 0
lea esi, [ebp - 0x418]
lea edi, [ebp - 0x47c]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x1003ca25
imul eax, dword [ebp - 0x410], 5
cdq
idiv ecx
add eax, dword [ebp - 0x418]
jmp 0x1003ca37
mov eax, dword [ebp - 0x410]
sub eax, dword [ebp - 0xad0]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x40c]
sub eax, dword [ebp - 0xadc]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x350], eax
jmp 0x1003ca63
mov dword [ebp - 0x354], ebx
mov dword [ebp - 0x350], ebx
mov dword [ebp - 0xab8], ebx
push dword [ebp - 0xabc]
mov esi, dword [0x100690e0]
mov ecx, esi
push ebx
call dword [0x100ad1dc]
call esi
xor esi, esi
mov edi, 0x1006983c
inc esi
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x1003ca88
mov eax, dword [0x10069838]
test eax, eax
jle 0x1003cae9
sub eax, 1
mov dword [0x10069838], eax
jne 0x1003cae9
mov esi, ebx
mov eax, dword [esi + 0x10069760]
test eax, eax
je 0x1003caba
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x1003caa9
push 0x40
push ebx
push 0x10069760
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x10001490
mov edi, 0x10069030
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0x1006983c
inc esi
xor eax, eax
xchg dword [edi], eax
lea ecx, [ebp - 0xbe8]
call fcn.10051c8c
mov eax, dword [ebp - 0xab8]
test eax, eax
js 0x1003e6d8
mov eax, dword [ebp - 0x350]
mov edi, dword [ebp - 0x354]
push 0x54
mov dword [ebp - 0xad0], eax
mov dword [ebp - 0xc50], eax
lea eax, [ebp - 0x810]
push ebx
push eax
mov dword [ebp - 0xc54], edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xadc], esi
mov esi, dword [0x10069058]
mov ecx, esi
push 7
push dword [ebp - 0xae8]
call dword [0x100ad1dc]
call esi
test eax, eax
je 0x1003cb9d
mov esi, dword [0x10069064]
lea ecx, [ebp - 0x810]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100ad1dc]
call esi
test eax, eax
je 0x1003cb9d
push 0x20
pop eax
cmp word [ebp - 0x7fe], ax
jne 0x1003cb9d
cmp dword [ebp - 0x7fc], 0
je 0x1003cb9d
cmp dword [ebp - 0x80c], 0
jle 0x1003cb9d
cmp dword [ebp - 0x808], 0
jg 0x1003cbac
cmp dword [ebp - 0xaec], 1
mov dword [ebp - 0xadc], ebx
jne 0x1003cc20
push dword [ebp - 0xad0]
mov esi, dword [0x100690d8]
lea eax, [ebp - 0x798]
push edi
push eax
mov ecx, esi
call dword [0x100ad1dc]
call esi
push dword [ebp - 0xad0]
mov esi, dword [0x100690d8]
lea eax, [ebp - 0x788]
push edi
push eax
mov ecx, esi
call dword [0x100ad1dc]
call esi
mov edi, dword [ebp - 0xaec]
cmp edi, 1
jne 0x1003cc26
mov eax, dword [ebp - 0x7b8]
mov esi, dword [0x10069044]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0x100ad1dc]
call esi
mov dword [ebp - 0xae4], eax
jmp 0x1003cc26
mov edi, dword [ebp - 0xaec]
mov esi, dword [0x10069070]
mov ecx, esi
push 1
push dword [ebp - 0xae8]
call dword [0x100ad1dc]
call esi
cmp dword [ebp - 0x7bc], 0
mov dword [ebp - 0xaf8], eax
mov dword [ebp - 0xb08], 0x810
je 0x1003cc61
mov dword [ebp - 0xb08], 0x20812
cmp dword [ebp - 0xadc], 0
je 0x1003d797
mov eax, dword [ebp - 0x7b8]
mov esi, dword [ebp - 0x7b4]
mov dword [ebp - 0xb0c], eax
mov eax, dword [ebp - 0x7a8]
push 0x54
mov dword [ebp - 0xad8], eax
lea eax, [ebp - 0x960]
push ebx
push eax
mov dword [ebp - 0xb10], esi
call sub.msvcrt.dll_memset
push 0x54
lea eax, [ebp - 0xa5c]
push ebx
push eax
call sub.msvcrt.dll_memset
push 0x2c
lea eax, [ebp - 0x4a8]
mov dword [ebp - 0xaf0], ebx
push ebx
push eax
mov dword [ebp - 0xadc], ebx
mov dword [ebp - 0xae0], ebx
mov dword [ebp - 0xac4], ebx
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x384]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x1003e6b8
mov edi, dword [ebp - 0xae8]
mov esi, dword [0x10069058]
mov ecx, esi
push 7
push edi
call dword [0x100ad1dc]
call esi
test eax, eax
jne 0x1003cd16
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x1003e6b8
mov esi, dword [0x10069064]
lea ecx, [ebp - 0x960]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100ad1dc]
call esi
test eax, eax
je 0x1003cd58
mov eax, dword [ebp - 0x94c]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0x95c]
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0xac4], eax
mov esi, dword [0x10069038]
mov ecx, esi
push edi
call dword [0x100ad1dc]
call esi
mov esi, eax
mov dword [ebp - 0xad4], esi
test esi, esi
je 0x1003cd0b
push 0x2c
lea eax, [ebp - 0x4a8]
mov dword [ebp - 0xc74], ebx
push ebx
mov edi, ebx
push eax
mov dword [ebp - 0xb40], edi
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x790]
add esp, 0xc
sub eax, dword [ebp - 0x798]
mov dword [ebp - 0x4a4], eax
mov eax, dword [ebp - 0x794]
sub eax, dword [ebp - 0x78c]
mov dword [ebp - 0x4a0], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x4a8], 0x28
mov word [ebp - 0x49c], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x49a], ax
lea eax, [ebp - 0xc74]
push eax
push ebx
lea eax, [ebp - 0x4a8]
push eax
push esi
mov esi, dword [0x1006903c]
mov ecx, esi
call dword [0x100ad1dc]
call esi
mov dword [ebp - 0xb2c], eax
test eax, eax
jne 0x1003ce2a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x1003ce1a
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x1003d1e2
mov edi, 0x80004005
jmp 0x1003d1e2
mov esi, dword [0x10069064]
lea ecx, [ebp - 0xa5c]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100ad1dc]
call esi
test eax, eax
je 0x1003ce54
mov eax, dword [ebp - 0xa48]
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0x790]
sub eax, dword [ebp - 0x798]
push dword [ebp - 0xb2c]
mov esi, dword [0x1006906c]
mov ecx, esi
push dword [ebp - 0xad4]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x78c]
sub eax, dword [ebp - 0x794]
mov dword [ebp - 0x378], eax
call dword [0x100ad1dc]
call esi
mov esi, dword [0x10069070]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xad4]
call dword [0x100ad1dc]
call esi
push dword [ebp - 0xad8]
mov esi, dword [0x1006906c]
mov ecx, esi
push dword [ebp - 0xad4]
call dword [0x100ad1dc]
call esi
mov esi, dword [0x10069068]
mov ecx, esi
push ebx
mov dword [ebp - 0xb14], eax
call dword [0x100ad1dc]
call esi
mov esi, dword [0x100690a4]
mov ecx, esi
push eax
lea eax, [ebp - 0x384]
push eax
push dword [ebp - 0xad4]
call dword [0x100ad1dc]
call esi
mov esi, dword [0x1006909c]
lea eax, [ebp - 0x384]
push ebx
push dword [ebp - 0xb08]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb10]
push dword [ebp - 0xad4]
call dword [0x100ad1dc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xaec], eax
jne 0x1003cf65
cmp dword [ebp - 0xb0c], 0
je 0x1003cf59
mov esi, dword [0x100690bc]
mov ecx, esi
push 8
call dword [0x100ad1dc]
call esi
mov dword [ebp - 0xb30], eax
jmp 0x1003cf6f
mov dword [ebp - 0xb30], 0xffffff
jmp 0x1003cf6f
mov dword [ebp - 0xb30], 0xffa8a8a8
mov esi, dword [ebp - 0x798]
mov edx, ebx
mov eax, dword [ebp - 0x794]
mov ecx, ebx
mov dword [ebp - 0xaf4], esi
mov dword [ebp - 0xad0], ebx
test esi, esi
jns 0x1003cf9f
mov edx, esi
mov dword [ebp - 0xaf4], ebx
neg edx
mov dword [ebp - 0xad0], edx
test eax, eax
jns 0x1003cfa9
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [ebp - 0x37c]
sub esi, edx
mov edx, dword [ebp - 0xae0]
sub edx, dword [ebp - 0xaf4]
mov dword [ebp - 0xb1c], esi
cmp esi, edx
jl 0x1003cfcf
mov esi, edx
mov dword [ebp - 0xb1c], edx
mov edx, dword [ebp - 0x378]
sub dword [ebp - 0xac4], eax
sub edx, ecx
mov dword [ebp - 0xb18], edx
cmp edx, dword [ebp - 0xac4]
jl 0x1003cff7
mov edx, dword [ebp - 0xac4]
mov dword [ebp - 0xb18], edx
test esi, esi
jle 0x1003d1ab
test edx, edx
jle 0x1003d1ab
mov ebx, dword [ebp - 0x37c]
mov edi, dword [ebp - 0xae0]
mov esi, dword [ebp - 0xadc]
imul ecx, ebx
imul eax, edi
shl ebx, 2
mov dword [ebp - 0xad8], ebx
add ecx, dword [ebp - 0xad0]
add eax, dword [ebp - 0xaf4]
shl edi, 2
mov dword [ebp - 0xb10], edi
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0xaf0]
mov dword [ebp - 0xafc], ecx
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xb1c]
mov dword [ebp - 0xaf0], eax
test esi, esi
jle 0x1003d184
mov ebx, eax
mov dword [ebp - 0xadc], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0xac4], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xad0], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x1003d145
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xb30]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xad0]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xac4]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xb30]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac4]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xb2e]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac4]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xadc]
cdq
idiv ecx
mov edx, dword [ebp - 0xac4]
add al, bl
mov ebx, dword [ebp - 0xad0]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [ebp - 0xac4], edx
mov dword [ebp - 0xadc], esi
jne 0x1003d07f
mov edx, dword [ebp - 0xb18]
mov esi, dword [ebp - 0xb1c]
mov ecx, dword [ebp - 0xafc]
mov eax, dword [ebp - 0xaf0]
mov ebx, dword [ebp - 0xad8]
mov edi, dword [ebp - 0xb10]
add ecx, ebx
add eax, edi
sub edx, 1
mov dword [ebp - 0xafc], ecx
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0xb18], edx
jne 0x1003d05b
mov edi, dword [ebp - 0xb40]
xor ebx, ebx
push dword [ebp - 0xb2c]
mov esi, dword [0x1006904c]
mov ecx, esi
call dword [0x100ad1dc]
call esi
mov eax, dword [ebp - 0xb14]
test eax, eax
je 0x1003d1e2
mov esi, dword [0x1006906c]
mov ecx, esi
push eax
push dword [ebp - 0xad4]
call dword [0x100ad1dc]
call esi
push dword [ebp - 0xad4]
mov esi, dword [0x10069048]
mov ecx, esi
call dword [0x100ad1dc]
call esi
test edi, edi
js 0x1003e6b8
mov eax, dword [ebp - 0x7b8]
mov esi, dword [ebp - 0x7b0]
mov dword [ebp - 0xb0c], eax
mov eax, dword [ebp - 0x7a4]
push 0x54
mov dword [ebp - 0xad8], eax
lea eax, [ebp - 0x864]
push ebx
push eax
mov dword [ebp - 0xb10], esi
call sub.msvcrt.dll_memset
push 0x54
lea eax, [ebp - 0x9b4]
push ebx
push eax
call sub.msvcrt.dll_memset
push 0x2c
lea eax, [ebp - 0x4d4]
mov dword [ebp - 0xaf0], ebx
push ebx
push eax
mov dword [ebp - 0xadc], ebx
mov dword [ebp - 0xae0], ebx
mov dword [ebp - 0xac4], ebx
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x394]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x1003e6b8
mov edi, dword [ebp - 0xae8]
mov esi, dword [0x10069058]
mov ecx, esi
push 7
push edi
call dword [0x100ad1dc]
call esi
test eax, eax
je 0x1003cd0b
mov esi, dword [0x10069064]
lea ecx, [ebp - 0x864]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100ad1dc]
call esi
test eax, eax
je 0x1003d2e3
mov eax, dword [ebp - 0x850]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0x85c]
mov dword [ebp - 0xac4], eax
mov esi, dword [0x10069038]
mov ecx, esi
push edi
call dword [0x100ad1dc]
call esi
mov esi, eax
mov dword [ebp - 0xad4], esi
test esi, esi
je 0x1003cd0b
push 0x2c
lea eax, [ebp - 0x4d4]
mov dword [ebp - 0xc68], ebx
push ebx
mov edi, ebx
push eax
mov dword [ebp - 0xb40], edi
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x780]
add esp, 0xc
sub eax, dword [ebp - 0x788]
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x784]
sub eax, dword [ebp - 0x77c]
mov dword [ebp - 0x4cc], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x4d4], 0x28
mov word [ebp - 0x4c8], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x4c6], ax
lea eax, [ebp - 0xc68]
push eax
push ebx
lea eax, [ebp - 0x4d4]
push eax
push esi
mov esi, dword [0x1006903c]
mov ecx, esi
call dword [0x100ad1dc]
call esi
mov dword [ebp - 0xb2c], eax
test eax, eax
jne 0x1003d3b9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x1003d3a9
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x1003d772
mov edi, 0x80004005
jmp 0x1003d772
mov esi, dword [0x10069064]
lea ecx, [ebp - 0x9b4]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100ad1dc]
call esi
test eax, eax
je 0x1003d3e3
mov eax, dword [ebp - 0x9a0]
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0x780]
sub eax, dword [ebp - 0x788]
push dword [ebp - 0xb2c]
mov esi, dword [0x1006906c]
mov ecx, esi
push dword [ebp - 0xad4]
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x77c]
sub eax, dword [ebp - 0x784]
mov dword [ebp - 0x388], eax
call dword [0x100ad1dc]
call esi
mov esi, dword [0x10069070]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xad4]
call dword [0x100ad1dc]
call esi
push dword [ebp - 0xad8]
mov esi, dword [0x1006906c]
mov ecx, esi
push dword [ebp - 0xad4]
call dword [0x100ad1dc]
call esi
mov esi, dword [0x10069068]
mov ecx, esi
push ebx
mov dword [ebp - 0xb64], eax
call dword [0x100ad1dc]
call esi
mov esi, dword [0x100690a4]
mov ecx, esi
push eax
lea eax, [ebp - 0x394]
push eax
push dword [ebp - 0xad4]
call dword [0x100ad1dc]
call esi
mov esi, dword [0x1006909c]
lea eax, [ebp - 0x394]
push ebx
push dword [ebp - 0xb08]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb10]
push dword [ebp - 0xad4]
call dword [0x100ad1dc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xaec], eax
jne 0x1003d4ee
cmp dword [ebp - 0xb0c], 0
je 0x1003d4e2
mov esi, dword [0x100690bc]
mov ecx, esi
push 8
call dword [0x100ad1dc]
call esi
jmp 0x1003d4f3
mov dword [ebp - 0xb1c], 0xffffff
jmp 0x1003d4ff
mov eax, 0xffa8a8a8
mov dword [ebp - 0xb1c], eax
mov dword [ebp - 0xacc], eax
mov esi, dword [ebp - 0x788]
mov edx, ebx
mov eax, dword [ebp - 0x784]
mov ecx, ebx
mov dword [ebp - 0xaf4], esi
mov dword [ebp - 0xad0], ebx
test esi, esi
jns 0x1003d52f
mov edx, esi
mov dword [ebp - 0xaf4], ebx
neg edx
mov dword [ebp - 0xad0], edx
test eax, eax
jns 0x1003d539
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [ebp - 0x38c]
sub esi, edx
mov edx, dword [ebp - 0xae0]
sub edx, dword [ebp - 0xaf4]
mov dword [ebp - 0xb18], esi
cmp esi, edx
jl 0x1003d55f
mov esi, edx
mov dword [ebp - 0xb18], edx
mov edx, dword [ebp - 0x388]
sub dword [ebp - 0xac4], eax
sub edx, ecx
mov dword [ebp - 0xb14], edx
cmp edx, dword [ebp - 0xac4]
jl 0x1003d587
mov edx, dword [ebp - 0xac4]
mov dword [ebp - 0xb14], edx
test esi, esi
jle 0x1003d73b
test edx, edx
jle 0x1003d73b
mov ebx, dword [ebp - 0x38c]
mov edi, dword [ebp - 0xadc]
mov esi, dword [ebp - 0xaf0]
imul ecx, ebx
shl ebx, 2
mov dword [ebp - 0xad8], ebx
add ecx, dword [ebp - 0xad0]
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0xae0]
imul eax, edi
mov dword [ebp - 0xafc], ecx
add eax, dword [ebp - 0xaf4]
shl edi, 2
mov dword [ebp - 0xb10], edi
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xb18]
mov dword [ebp - 0xaf0], eax
test esi, esi
jle 0x1003d714
mov ebx, eax
mov dword [ebp - 0xadc], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0xac4], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xad0], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x1003d6d5
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xacc]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xad0]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xac4]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xacc]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac4]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xb1a]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac4]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xadc]
cdq
idiv ecx
mov edx, dword [ebp - 0xac4]
add al, bl
mov ebx, dword [ebp - 0xad0]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [ebp - 0xac4], edx
mov dword [ebp - 0xadc], esi
jne 0x1003d60f
mov edx, dword [ebp - 0xb14]
mov esi, dword [ebp - 0xb18]
mov ecx, dword [ebp - 0xafc]
mov eax, dword [ebp - 0xaf0]
mov ebx, dword [ebp - 0xad8]
mov edi, dword [ebp - 0xb10]
add ecx, ebx
add eax, edi
sub edx, 1
mov dword [ebp - 0xafc], ecx
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0xb14], edx
jne 0x1003d5eb
mov edi, dword [ebp - 0xb40]
xor ebx, ebx
push dword [ebp - 0xb2c]
mov esi, dword [0x1006904c]
mov ecx, esi
call dword [0x100ad1dc]
call esi
mov eax, dword [ebp - 0xb64]
test eax, eax
je 0x1003d772
mov esi, dword [0x1006906c]
mov ecx, esi
push eax
push dword [ebp - 0xad4]
call dword [0x100ad1dc]
call esi
push dword [ebp - 0xad4]
mov esi, dword [0x10069048]
mov ecx, esi
call dword [0x100ad1dc]
call esi
test edi, edi
js 0x1003e6b8
mov edi, ebx
jmp 0x1003e664
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x7b8], 0
jne 0x1003d7ab
cmp edi, ecx
je 0x1003d7ab
mov al, 0xc0
jmp 0x1003d7ad
or al, 0xff
mov byte [ebp - 0xb12], al
lea edi, [ebp - 0x364]
xor eax, eax
mov esi, dword [0x10069038]
stosd dword es:[edi], eax
push dword [ebp - 0xae8]
mov byte [ebp - 0xb11], cl
mov ecx, esi
mov byte [ebp - 0xb14], bl
stosd dword es:[edi], eax
mov byte [ebp - 0xb13], bl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x374]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [0x100ad1dc]
call esi
mov dword [ebp - 0xabc], eax
test eax, eax
jne 0x1003d808
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x1003e6b8
xor eax, eax
inc eax
cmp dword [ebp - 0xaec], eax
jne 0x1003d933
mov edi, dword [ebp - 0x790]
mov eax, edi
mov edx, dword [ebp - 0x780]
mov ecx, edx
sub ecx, dword [ebp - 0x788]
sub eax, dword [ebp - 0x798]
mov dword [ebp - 0xac8], ecx
cmp ecx, eax
jg 0x1003d845
mov ecx, eax
mov dword [ebp - 0xac8], eax
mov esi, dword [ebp - 0x77c]
mov eax, esi
sub eax, dword [ebp - 0x794]
cmp dword [ebp - 0x7bc], 0
mov dword [ebp - 0xab8], eax
mov dword [ebp - 0xad0], ebx
je 0x1003d8a4
mov eax, dword [ebp - 0x798]
sub eax, edi
add eax, ecx
mov ecx, eax
mov dword [ebp - 0xad0], eax
mov eax, dword [ebp - 0x788]
sub eax, edx
mov dword [ebp - 0xb34], ecx
add eax, dword [ebp - 0xac8]
mov dword [ebp - 0x364], ecx
mov ecx, eax
mov dword [ebp - 0xac0], ecx
mov dword [ebp - 0x374], ecx
jmp 0x1003d8be
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0xb34], eax
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0xac0], eax
mov eax, ebx
sub edi, dword [ebp - 0x798]
add edi, dword [ebp - 0xad0]
sub edx, dword [ebp - 0x788]
sub esi, dword [ebp - 0x784]
add edx, eax
mov eax, dword [ebp - 0x784]
sub eax, dword [ebp - 0x794]
mov dword [ebp - 0xad0], edi
mov dword [ebp - 0x35c], edi
mov edi, dword [ebp - 0x78c]
sub edi, dword [ebp - 0x794]
add esi, eax
mov dword [ebp - 0xae0], edi
mov dword [ebp - 0x358], edi
mov dword [ebp - 0xb64], edx
mov dword [ebp - 0x36c], edx
mov dword [ebp - 0xb0c], eax
mov dword [ebp - 0x370], eax
mov dword [ebp - 0xb1c], esi
mov dword [ebp - 0x368], esi
jmp 0x1003d9bf
mov eax, dword [ebp - 0x34c]
lea esi, [ebp - 0x798]
lea edi, [ebp - 0x364]
mov dword [ebp - 0xac8], eax
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0xab8], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x358]
lea esi, [ebp - 0x788]
lea edi, [ebp - 0x374]
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0x35c]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xad0], eax
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0xb34], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0xb1c], eax
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0xb64], eax
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0xb0c], eax
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0xac0], eax
push 0x2c
lea eax, [ebp - 0x500]
mov dword [ebp - 0xc84], ebx
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xac8]
add esp, 0xc
mov edi, dword [ebp - 0xabc]
mov esi, dword [0x1006903c]
mov ecx, esi
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0xab8]
neg eax
mov dword [ebp - 0x500], 0x28
mov dword [ebp - 0x4f8], eax
xor eax, eax
push 0x20
inc eax
mov word [ebp - 0x4f4], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x4f2], ax
lea eax, [ebp - 0xc84]
push eax
push ebx
lea eax, [ebp - 0x500]
push eax
push edi
call dword [0x100ad1dc]
call esi
mov dword [ebp - 0xb00], eax
test eax, eax
jne 0x1003da4c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x1003e6a3
mov esi, dword [0x1006906c]
mov ecx, esi
push eax
push edi
call dword [0x100ad1dc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xaec], eax
jne 0x1003dac2
mov ecx, dword [ebp - 0xae4]
test ecx, ecx
je 0x1003dac2
xor eax, eax
mov esi, dword [0x100690a4]
lea edi, [ebp - 0x404]
stosd dword es:[edi], eax
push ecx
mov ecx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xac8]
mov dword [ebp - 0x3fc], eax
mov eax, dword [ebp - 0xab8]
mov dword [ebp - 0x3f8], eax
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 0xabc]
push eax
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], ebx
call dword [0x100ad1dc]
call esi
mov eax, dword [ebp - 0x7b8]
mov esi, dword [ebp - 0x7b4]
mov dword [ebp - 0xafc], eax
mov eax, dword [ebp - 0x7a8]
push 0x54
mov dword [ebp - 0xad8], eax
lea eax, [ebp - 0x8b8]
push ebx
push eax
mov dword [ebp - 0xb10], esi
call sub.msvcrt.dll_memset
push 0x54
lea eax, [ebp - 0xa08]
push ebx
push eax
call sub.msvcrt.dll_memset
push 0x2c
lea eax, [ebp - 0x52c]
mov dword [ebp - 0xaf0], ebx
push ebx
push eax
mov dword [ebp - 0xadc], ebx
mov dword [ebp - 0xb44], ebx
mov dword [ebp - 0xac4], ebx
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x3b4]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xabc]
test esi, esi
je 0x1003e688
mov esi, dword [0x10069058]
mov ecx, esi
push 7
push edi
call dword [0x100ad1dc]
call esi
test eax, eax
jne 0x1003db6a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x1003e688
mov esi, dword [0x10069064]
lea ecx, [ebp - 0x8b8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100ad1dc]
call esi
test eax, eax
je 0x1003dbac
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0xb44], eax
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0xac4], eax
mov esi, dword [0x10069038]
mov ecx, esi
push edi
call dword [0x100ad1dc]
call esi
mov esi, eax
mov dword [ebp - 0xad4], esi
test esi, esi
je 0x1003db5f
push 0x2c
lea eax, [ebp - 0x52c]
mov dword [ebp - 0xc6c], ebx
push ebx
push eax
mov dword [ebp - 0xb3c], ebx
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x360]
add esp, 0xc
sub eax, dword [ebp - 0xae0]
mov edi, dword [ebp - 0xad0]
sub edi, dword [ebp - 0xb34]
mov dword [ebp - 0x524], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x52c], 0x28
mov word [ebp - 0x520], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x51e], ax
lea eax, [ebp - 0xc6c]
push eax
push ebx
lea eax, [ebp - 0x52c]
mov dword [ebp - 0x528], edi
push eax
push esi
mov esi, dword [0x1006903c]
mov ecx, esi
call dword [0x100ad1dc]
call esi
mov dword [ebp - 0xb18], eax
test eax, eax
jne 0x1003dc8a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xb3c], eax
test eax, eax
jle 0x1003dc75
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb3c], eax
test eax, eax
js 0x1003e02a
mov dword [ebp - 0xb3c], 0x80004005
jmp 0x1003e02a
mov esi, dword [0x10069064]
lea ecx, [ebp - 0xa08]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100ad1dc]
call esi
test eax, eax
je 0x1003dcb4
mov eax, dword [ebp - 0x9f4]
mov dword [ebp - 0xadc], eax
push dword [ebp - 0xb18]
mov eax, dword [ebp - 0xae0]
push dword [ebp - 0xad4]
mov esi, dword [0x1006906c]
mov ecx, esi
mov dword [ebp - 0x3ac], edi
mov edi, dword [ebp - 0x360]
sub eax, edi
mov dword [ebp - 0x3a8], eax
call dword [0x100ad1dc]
call esi
mov esi, dword [0x10069070]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xad4]
call dword [0x100ad1dc]
call esi
push dword [ebp - 0xad8]
mov esi, dword [0x1006906c]
mov ecx, esi
push dword [ebp - 0xad4]
call dword [0x100ad1dc]
call esi
mov esi, dword [0x10069068]
mov ecx, esi
push ebx
mov dword [ebp - 0xad8], eax
call dword [0x100ad1dc]
call esi
mov esi, dword [0x100690a4]
mov ecx, esi
push eax
lea eax, [ebp - 0x3b4]
push eax
push dword [ebp - 0xad4]
call dword [0x100ad1dc]
call esi
mov esi, dword [0x1006909c]
lea eax, [ebp - 0x3b4]
push ebx
push dword [ebp - 0xb08]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb10]
push dword [ebp - 0xad4]
call dword [0x100ad1dc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xaec], eax
jne 0x1003ddbb
cmp dword [ebp - 0xafc], 0
je 0x1003ddaf
mov esi, dword [0x100690bc]
mov ecx, esi
push 8
call dword [0x100ad1dc]
call esi
mov dword [ebp - 0xb30], eax
jmp 0x1003ddc5
mov dword [ebp - 0xb30], 0xffffff
jmp 0x1003ddc5
mov dword [ebp - 0xb30], 0xffa8a8a8
mov ecx, dword [ebp - 0xb34]
mov edx, ebx
mov dword [ebp - 0xad0], ebx
mov eax, ebx
test ecx, ecx
jns 0x1003dde5
mov edx, ecx
mov ecx, ebx
neg edx
mov dword [ebp - 0xad0], edx
test edi, edi
jns 0x1003ddef
mov eax, edi
mov edi, ebx
neg eax
mov esi, dword [ebp - 0x3ac]
sub esi, edx
mov edx, dword [ebp - 0xb44]
sub edx, ecx
mov dword [ebp - 0xae0], esi
cmp esi, edx
jl 0x1003de11
mov esi, edx
mov dword [ebp - 0xae0], edx
mov edx, dword [ebp - 0x3a8]
sub dword [ebp - 0xac4], edi
sub edx, eax
mov dword [ebp - 0xaf4], edx
cmp edx, dword [ebp - 0xac4]
jl 0x1003de39
mov edx, dword [ebp - 0xac4]
mov dword [ebp - 0xaf4], edx
test esi, esi
jle 0x1003dff3
test edx, edx
jle 0x1003dff3
imul edi, dword [ebp - 0xb44]
mov ebx, dword [ebp - 0x3ac]
mov esi, dword [ebp - 0xadc]
imul eax, ebx
shl ebx, 2
add edi, ecx
mov ecx, dword [ebp - 0xaf0]
mov dword [ebp - 0xaf0], ebx
mov ebx, dword [ebp - 0xb44]
add eax, dword [ebp - 0xad0]
shl ebx, 2
lea ecx, [ecx + edi*4]
mov dword [ebp - 0xafc], ebx
mov ebx, dword [ebp - 0xaf0]
mov edi, dword [ebp - 0xafc]
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xae0]
mov dword [ebp - 0xb2c], eax
mov dword [ebp - 0xb40], ecx
test esi, esi
jle 0x1003dfd2
mov ebx, ecx
mov dword [ebp - 0xadc], esi
lea edx, [ecx + 3]
sub ebx, eax
mov dword [ebp - 0xac4], edx
lea edi, [eax + 2]
mov dword [ebp - 0xad0], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x1003df93
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xb30]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xad0]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xac4]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xb30]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac4]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xb2e]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac4]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xadc]
cdq
idiv ecx
mov edx, dword [ebp - 0xac4]
add al, bl
mov ebx, dword [ebp - 0xad0]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [ebp - 0xac4], edx
mov dword [ebp - 0xadc], esi
jne 0x1003decd
mov edx, dword [ebp - 0xaf4]
mov esi, dword [ebp - 0xae0]
mov eax, dword [ebp - 0xb2c]
mov ecx, dword [ebp - 0xb40]
mov ebx, dword [ebp - 0xaf0]
mov edi, dword [ebp - 0xafc]
add eax, ebx
add ecx, edi
sub edx, 1
mov dword [ebp - 0xb2c], eax
mov dword [ebp - 0xb40], ecx
mov dword [ebp - 0xaf4], edx
jne 0x1003dea9
xor ebx, ebx
push dword [ebp - 0xb18]
mov esi, dword [0x1006904c]
mov ecx, esi
call dword [0x100ad1dc]
call esi
mov eax, dword [ebp - 0xad8]
test eax, eax
je 0x1003e02a
mov esi, dword [0x1006906c]
mov ecx, esi
push eax
push dword [ebp - 0xad4]
call dword [0x100ad1dc]
call esi
push dword [ebp - 0xad4]
mov esi, dword [0x10069048]
mov ecx, esi
call dword [0x100ad1dc]
call esi
cmp dword [ebp - 0xb3c], 0
jl 0x1003e682
mov eax, dword [ebp - 0x7b8]
mov esi, dword [ebp - 0x7b0]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0x7a4]
push 0x54
mov dword [ebp - 0xad8], eax
lea eax, [ebp - 0x90c]
push ebx
push eax
mov dword [ebp - 0xb10], esi
call sub.msvcrt.dll_memset
push 0x54
lea eax, [ebp - 0xab0]
push ebx
push eax
call sub.msvcrt.dll_memset
push 0x2c
lea eax, [ebp - 0x558]
mov dword [ebp - 0xadc], ebx
push ebx
push eax
mov dword [ebp - 0xad0], ebx
mov dword [ebp - 0xb3c], ebx
mov dword [ebp - 0xac4], ebx
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x3a4]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xabc]
test esi, esi
je 0x1003e688
mov esi, dword [0x10069058]
mov ecx, esi
push 7
push edi
call dword [0x100ad1dc]
call esi
test eax, eax
je 0x1003db5f
mov esi, dword [0x10069064]
lea ecx, [ebp - 0x90c]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100ad1dc]
call esi
test eax, eax
je 0x1003e130
mov eax, dword [ebp - 0x8f8]
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0x908]
mov dword [ebp - 0xb3c], eax
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0xac4], eax
mov esi, dword [0x10069038]
mov ecx, esi
push edi
call dword [0x100ad1dc]
call esi
mov esi, eax
mov dword [ebp - 0xad4], esi
test esi, esi
je 0x1003db5f
push 0x2c
lea eax, [ebp - 0x558]
mov dword [ebp - 0xc80], ebx
push ebx
push eax
mov dword [ebp - 0xb34], ebx
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xb64]
add esp, 0xc
sub eax, dword [ebp - 0xac0]
mov edi, dword [ebp - 0xb0c]
mov dword [ebp - 0xb64], eax
mov dword [ebp - 0x554], eax
mov eax, edi
sub eax, dword [ebp - 0xb1c]
mov dword [ebp - 0x550], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x558], 0x28
mov word [ebp - 0x54c], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x54a], ax
lea eax, [ebp - 0xc80]
push eax
push ebx
lea eax, [ebp - 0x558]
push eax
push esi
mov esi, dword [0x1006903c]
mov ecx, esi
call dword [0x100ad1dc]
call esi
mov dword [ebp - 0xb18], eax
test eax, eax
jne 0x1003e21a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xb34], eax
test eax, eax
jle 0x1003e205
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb34], eax
test eax, eax
js 0x1003e5bd
mov dword [ebp - 0xb34], 0x80004005
jmp 0x1003e5bd
mov esi, dword [0x10069064]
lea ecx, [ebp - 0xab0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100ad1dc]
call esi
test eax, eax
je 0x1003e244
mov eax, dword [ebp - 0xa9c]
mov dword [ebp - 0xad0], eax
mov eax, dword [ebp - 0xb64]
push dword [ebp - 0xb18]
mov esi, dword [0x1006906c]
mov ecx, esi
push dword [ebp - 0xad4]
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0xb1c]
sub eax, edi
mov dword [ebp - 0x398], eax
call dword [0x100ad1dc]
call esi
mov esi, dword [0x10069070]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xad4]
call dword [0x100ad1dc]
call esi
push dword [ebp - 0xad8]
mov esi, dword [0x1006906c]
mov ecx, esi
push dword [ebp - 0xad4]
call dword [0x100ad1dc]
call esi
mov esi, dword [0x10069068]
mov ecx, esi
push ebx
mov dword [ebp - 0xad8], eax
call dword [0x100ad1dc]
call esi
mov esi, dword [0x100690a4]
mov ecx, esi
push eax
lea eax, [ebp - 0x3a4]
push eax
push dword [ebp - 0xad4]
call dword [0x100ad1dc]
call esi
mov esi, dword [0x1006909c]
lea eax, [ebp - 0x3a4]
push ebx
push dword [ebp - 0xb08]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb10]
push dword [ebp - 0xad4]
call dword [0x100ad1dc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xaec], eax
jne 0x1003e353
cmp dword [ebp - 0xaf0], 0
je 0x1003e347
mov esi, dword [0x100690bc]
mov ecx, esi
push 8
call dword [0x100ad1dc]
call esi
mov edx, eax
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xae0], edx
jmp 0x1003e364
mov dword [ebp - 0xae0], 0xffffff
jmp 0x1003e364
mov eax, 0xffa8a8a8
mov dword [ebp - 0xacc], eax
mov dword [ebp - 0xae0], eax
mov ecx, dword [ebp - 0xac0]
mov esi, ebx
mov eax, ebx
test ecx, ecx
jns 0x1003e37c
mov esi, ecx
mov dword [ebp - 0xac0], ebx
neg esi
test edi, edi
jns 0x1003e386
mov eax, edi
mov edi, ebx
neg eax
mov edx, dword [ebp - 0x39c]
mov ecx, dword [ebp - 0xb3c]
sub edx, esi
sub ecx, dword [ebp - 0xac0]
mov dword [ebp - 0xaf0], edx
cmp edx, ecx
jl 0x1003e3ac
mov edx, ecx
mov dword [ebp - 0xaf0], ecx
mov ecx, dword [ebp - 0x398]
sub dword [ebp - 0xac4], edi
sub ecx, eax
mov dword [ebp - 0xaf4], ecx
cmp ecx, dword [ebp - 0xac4]
jl 0x1003e3d4
mov ecx, dword [ebp - 0xac4]
mov dword [ebp - 0xaf4], ecx
test edx, edx
jle 0x1003e586
test ecx, ecx
jle 0x1003e586
mov ebx, dword [ebp - 0x39c]
imul edi, dword [ebp - 0xb3c]
imul eax, ebx
shl ebx, 2
add edi, dword [ebp - 0xac0]
add eax, esi
mov esi, dword [ebp - 0xad0]
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xadc]
mov dword [ebp - 0xadc], ebx
mov ebx, dword [ebp - 0xb3c]
shl ebx, 2
lea esi, [esi + edi*4]
mov dword [ebp - 0xafc], ebx
mov ebx, dword [ebp - 0xadc]
mov edi, dword [ebp - 0xafc]
mov dword [ebp - 0xb2c], eax
mov dword [ebp - 0xb40], esi
test edx, edx
jle 0x1003e565
lea ebx, [esi + 3]
mov dword [ebp - 0xad0], edx
sub esi, eax
mov dword [ebp - 0xac4], ebx
lea edi, [eax + 2]
mov dword [ebp - 0xb0c], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x1003e526
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xacc]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb0c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xac4]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xacc]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac4]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xade]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac4]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xb0c]
cdq
idiv ecx
mov edx, dword [ebp - 0xad0]
add al, bl
mov ebx, dword [ebp - 0xac4]
mov byte [ebx], al
add ebx, 4
add edi, 4
sub edx, 1
mov dword [ebp - 0xac4], ebx
mov dword [ebp - 0xad0], edx
jne 0x1003e460
mov ecx, dword [ebp - 0xaf4]
mov edx, dword [ebp - 0xaf0]
mov eax, dword [ebp - 0xb2c]
mov esi, dword [ebp - 0xb40]
mov ebx, dword [ebp - 0xadc]
mov edi, dword [ebp - 0xafc]
add eax, ebx
add esi, edi
sub ecx, 1
mov dword [ebp - 0xb2c], eax
mov dword [ebp - 0xb40], esi
mov dword [ebp - 0xaf4], ecx
jne 0x1003e43e
xor ebx, ebx
push dword [ebp - 0xb18]
mov esi, dword [0x1006904c]
mov ecx, esi
call dword [0x100ad1dc]
call esi
mov eax, dword [ebp - 0xad8]
test eax, eax
je 0x1003e5bd
mov esi, dword [0x1006906c]
mov ecx, esi
push eax
push dword [ebp - 0xad4]
call dword [0x100ad1dc]
call esi
push dword [ebp - 0xad4]
mov esi, dword [0x10069048]
mov ecx, esi
call dword [0x100ad1dc]
call esi
cmp dword [ebp - 0xb34], 0
mov edi, dword [ebp - 0xabc]
jl 0x1003e688
xor eax, eax
inc eax
cmp dword [ebp - 0xaec], eax
jne 0x1003e629
mov esi, dword [0x10069030]
mov ecx, esi
push 0xcc0020
push ebx
push ebx
push edi
push dword [ebp - 0xab8]
push dword [ebp - 0xac8]
push dword [ebp - 0x794]
push dword [ebp - 0x798]
push dword [ebp - 0xae8]
call dword [0x100ad1dc]
call esi
jmp 0x1003e664
push dword [ebp - 0xb14]
mov ecx, dword [ebp - 0xab8]
mov eax, dword [ebp - 0xac8]
mov esi, dword [0x10069050]
push ecx
push eax
push ebx
push ebx
push edi
push ecx
push eax
push dword [ebp - 0x350]
mov ecx, esi
push dword [ebp - 0x354]
push dword [ebp - 0xae8]
call dword [0x100ad1dc]
call esi
push dword [ebp - 0xaf8]
mov esi, dword [0x10069070]
mov ecx, esi
push dword [ebp - 0xae8]
call dword [0x100ad1dc]
call esi
jmp 0x1003e688
mov edi, dword [ebp - 0xabc]
mov eax, dword [ebp - 0xb00]
test eax, eax
je 0x1003e6a3
mov esi, dword [0x1006904c]
mov ecx, esi
push eax
call dword [0x100ad1dc]
call esi
test edi, edi
je 0x1003e6b8
mov esi, dword [0x10069048]
mov ecx, esi
push edi
call dword [0x100ad1dc]
call esi
mov eax, dword [ebp - 0xae4]
test eax, eax
je 0x1003e6d3
mov esi, dword [0x1006904c]
mov ecx, esi
push eax
call dword [0x100ad1dc]
call esi
mov edi, 0x1006983c
mov ecx, dword [ebp - 0x7b4]
test ecx, ecx
je 0x1003e727
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1003e6e5
mov eax, dword [ebp - 0x7b4]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x1003e70d
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x1003e705
push dword [ebp - 0x7b4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x7b4], ebx
mov ecx, dword [ebp - 0x7b0]
test ecx, ecx
je 0x1003e776
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1003e734
mov eax, dword [ebp - 0x7b0]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x1003e75c
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x1003e754
push dword [ebp - 0x7b0]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x7b0], ebx
mov edx, dword [ebp - 0x7ac]
test edx, edx
je 0x1003e7c2
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1003e785
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x1003e7ad
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0x1003e79f
mov edx, dword [ebp - 0x7ac]
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x7ac], ebx
cmp dword [ebp - 0x7a8], 0
je 0x1003e7e7
push dword [ebp - 0x7a8]
mov esi, dword [0x1006904c]
mov ecx, esi
call dword [0x100ad1dc]
call esi
mov dword [ebp - 0x7a8], ebx
cmp dword [ebp - 0x7a4], 0
je 0x1003e80c
push dword [ebp - 0x7a4]
mov esi, dword [0x1006904c]
mov ecx, esi
call dword [0x100ad1dc]
call esi
mov dword [ebp - 0x7a4], ebx
cmp dword [ebp - 0x7a0], 0
je 0x1003e831
push dword [ebp - 0x7a0]
mov esi, dword [0x1006904c]
mov ecx, esi
call dword [0x100ad1dc]
call esi
mov dword [ebp - 0x7a0], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x1003e833
mov eax, dword [0x10069838]
push 0
pop ebx
test eax, eax
jle 0x1003e895
sub eax, 1
mov dword [0x10069838], eax
jne 0x1003e895
mov esi, ebx
mov eax, dword [esi + 0x10069760]
test eax, eax
je 0x1003e869
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x1003e858
push 0x40
push ebx
push 0x10069760
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x10001490
mov edi, 0x10069030
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x1006983c
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0x10069754]
mov esi, dword [0x1006907c]
mov ecx, esi
mov dword [ebp - 0xafc], eax
call dword [0x100ad1dc]
call esi
sub eax, dword [0x10069830]
lea edi, [ebp - 0x2e0]
push 8
mov dword [ebp - 0xaf0], eax
mov edx, 0x1006983c
xor eax, eax
xor ebx, ebx
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x1003e8d4
mov eax, dword [0x10069838]
push 0
pop ebx
test eax, eax
jne 0x1003ef16
push 0x338
push ebx
mov dword [ebp - 0xae0], ebx
mov dword [ebp - 0xac4], ebx
mov dword [ebp - 0xadc], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xb10], edi
test edi, edi
je 0x1003eeb5
or dword [ebp - 0xb0c], 0xffffffff
mov eax, ebx
mov dword [ebp - 0xae4], eax
mov cl, bl
mov dword [ebp - 0xb8c], eax
mov eax, 0x7f1137f
mov edx, eax
mov dword [ebp - 0x444], 0xab69605e
movzx esi, word [ebp - 0x442]
shr edx, 0x10
add edi, 7
movzx eax, ax
mov dword [ebp - 0xac0], esi
mov esi, ebx
mov dword [ebp - 0xb00], ebx
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xacc], eax
mov dword [ebp - 0xb08], edx
mov dword [ebp - 0xad0], edi
mov edi, dword [ebp - 0xb38]
movzx edx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl edx, 8
or edx, eax
movzx eax, byte [edi]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl edx, 8
or edx, eax
shl edi, 8
mov eax, dword [ebp - 0xb38]
xor ebx, edx
mov dword [ebp - 0xad8], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb38]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb38]
shl edi, 8
add dword [ebp - 0xb38], 8
movzx eax, byte [eax + 5]
or edi, eax
mov eax, 0x7f1137f
xor esi, edi
xor esi, ebx
xor esi, eax
xor esi, 0xab69605e
mov eax, esi
rol eax, 0xa
lea edx, [esi + 0x54969fa2]
rol edx, 5
imul edx, dword [ebp - 0xacc]
add edx, eax
xor ebx, edx
mov edx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea edx, [ebx + edx]
ror edx, 9
imul edx, dword [ebp - 0xac0]
sub edx, eax
xor esi, edx
mov eax, esi
sub eax, dword [ebp - 0xacc]
imul edx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xac0]
xor edx, ebx
mov eax, ebx
rol edx, 6
imul edx, dword [ebp - 0xb08]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0xacc]
imul eax, dword [ebp - 0xac0]
ror edx, 6
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
add eax, esi
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 8
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
imul edx, dword [ebp - 0xb08]
sub edx, eax
xor esi, edx
mov edx, esi
mov eax, esi
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, dword [ebp - 0xacc]
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb08]
xor edx, ebx
mov eax, ebx
imul edx, dword [ebp - 0xac0]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xb08]
mov eax, esi
mov dword [ebp - 0xae4], esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, edx
xor ebx, eax
mov esi, ebx
sub esi, edx
xor esi, dword [ebp - 0xae4]
xor esi, 0xab69605e
xor edx, esi
mov eax, esi
rol edx, 2
imul edx, dword [ebp - 0xacc]
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, eax
mov eax, ebx
ror edx, 6
imul edx, dword [ebp - 0xac0]
rol eax, 7
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, dword [ebp - 0xacc]
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xac0]
xor edx, ebx
mov dword [ebp - 0xaf8], ebx
rol edx, 5
mov eax, ebx
imul edx, dword [ebp - 0xb08]
rol eax, 7
add edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov ebx, esi
xor ebx, dword [ebp - 0xaf8]
xor ebx, edx
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xac0]
imul eax, dword [ebp - 0xacc]
xor esi, eax
mov eax, esi
sub eax, edx
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [ebp - 0xb08]
add edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xacc]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, 0x605e
shr eax, 3
imul edx, dword [ebp - 0xac0]
xor edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov eax, esi
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xb0c]
rol eax, 2
mov dword [ebp - 0xb8c], esi
mov dword [ebp - 0xb0c], edi
xor edx, eax
xor edx, dword [ebp - 0xb00]
xor ebx, edx
mov edx, dword [ebp - 0xad0]
mov dword [ebp - 0xba4], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb8c]
ror dword [ebp - 0xba4], 8
mov byte [edx], al
mov al, byte [ebp - 0xba4]
ror dword [ebp - 0xb8c], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb8c]
ror dword [ebp - 0xba4], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xba4]
ror dword [ebp - 0xb8c], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb8c]
ror dword [ebp - 0xba4], 8
mov byte [edx - 2], al
ror dword [ebp - 0xb8c], 8
mov al, byte [ebp - 0xba4]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb8c]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [ebp - 0xba4]
mov esi, dword [ebp - 0xb8c]
mov eax, dword [ebp - 0xad8]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xb4c], 1
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xb8c], esi
mov dword [ebp - 0xb00], eax
mov dword [ebp - 0xad0], edx
jne 0x1003e984
mov esi, dword [ebp - 0xb10]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x1003ecff
movzx eax, cl
cdq
cmp eax, dword [0x100031b0]
jne 0x1003ed2a
cmp edx, dword [0x100031b4]
jne 0x1003ed2a
mov edi, esi
mov esi, ebx
mov dword [ebp - 0xac4], edi
jmp 0x1003ed3d
or dword [ebp - 0xb04], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xadc], 0xc004d501
test esi, esi
je 0x1003ed50
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xadc], ebx
jl 0x1003eeb5
mov eax, dword [ebp - 0xb04]
mov esi, edi
push 0x40
push ebx
push 0x10069760
mov byte [eax + edi], bl
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], bl
je 0x1003eebc
mov edi, 0x10069760
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xaf8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1003ed91
sub ecx, dword [ebp - 0xaf8]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0x1003eeb5
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xacc], ecx
cmp word [eax], dx
je 0x1003edd9
mov ecx, 0xc000007b
mov dword [ebp - 0xacc], ecx
jmp 0x1003ee21
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x1003edcc
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x1003edcc
cmp dword [edx], 0x4550
jne 0x1003edcc
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xbac]
je 0x1003ee0f
cmp ax, word [ebp - 0xb48]
je 0x1003ee0f
mov ecx, 0xc000000d
jmp 0x1003edd1
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xb10], eax
mov dword [ebp - 0xb04], ebx
test eax, eax
je 0x1003ee9c
mov edx, esi
mov dword [ebp - 0xad8], esi
lea eax, [edx + 1]
mov dword [ebp - 0xaf8], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x1003ee48
sub edx, dword [ebp - 0xaf8]
inc esi
add esi, edx
test ecx, ecx
js 0x1003ee81
push dword [ebp - 0xad8]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0x1003eea7
mov ecx, dword [ebp - 0xae0]
mov dword [ecx*4 + 0x10069030], eax
mov ecx, dword [ebp - 0xacc]
mov eax, dword [ebp - 0xb04]
inc dword [ebp - 0xae0]
inc eax
mov dword [ebp - 0xb04], eax
cmp eax, dword [ebp - 0xb10]
jb 0x1003ee37
add edi, 0x10
cmp byte [esi], bl
jne 0x1003ed84
mov esi, dword [ebp - 0xacc]
mov edi, dword [ebp - 0xac4]
jmp 0x1003eebe
mov esi, 0xc000007a
jmp 0x1003eead
mov esi, ebx
test edi, edi
je 0x1003eed1
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0x1003ef11
mov esi, ebx
mov eax, dword [esi + 0x10069760]
test eax, eax
je 0x1003eee8
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x1003eed7
push 0x40
push ebx
push 0x10069760
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x10001490
mov edi, 0x10069030
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x1003ef1c
mov eax, dword [0x10069838]
inc eax
mov dword [0x10069838], eax
xor eax, eax
mov edi, 0x1006983c
xchg dword [edi], eax
mov eax, dword [ebp - 0xaf0]
xor ecx, ecx
mov esi, dword [0x10069098]
inc ecx
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0xafc]
mov dword [ebp - 0x2c4], eax
lea eax, [ebp - 0x2e0]
push eax
push 4
push 0x2021
mov dword [ebp - 0x2e0], ecx
mov dword [ebp - 0x2d8], ecx
mov dword [ebp - 0x2cc], ecx
mov dword [ebp - 0x2d0], ecx
mov dword [ebp - 0x2c8], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x2d4], 0x9966f291
call dword [0x100ad1dc]
call esi
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x1003ef89
mov eax, dword [0x10069838]
push 0
pop ebx
test eax, eax
jle 0x1003efeb
sub eax, 1
mov dword [0x10069838], eax
jne 0x1003efeb
mov esi, ebx
mov eax, dword [esi + 0x10069760]
test eax, eax
je 0x1003efbf
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x1003efae
push 0x40
push ebx
push 0x10069760
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x10001490
mov edi, 0x10069030
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x1006983c
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xae8]
mov esi, dword [0x100690e0]
mov ecx, esi
push ebx
call dword [0x100ad1dc]
call esi
lea ecx, [ebp - 0xc88]
call fcn.10051cac
xor eax, eax
lea edi, [ebp - 0xb58]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xc14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xb10], esi
test esi, esi
je 0x100410d0
push edi
push 0x100692e8
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [ebp - 0xaec], esi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb4c], eax
test eax, eax
je 0x100410d2
mov ecx, dword [0x100692e0]
mov edi, eax
mov dword [eax], ecx
mov ecx, dword [0x100692e4]
mov dword [eax + 4], ecx
mov dword [ebp - 0xac8], edi
rdtsc
mov dword [ebp - 0xb00], eax
mov dword [ebp - 0xb0c], edx
mov eax, 0xc4
push eax
push 8
mov dword [ebp - 0xb54], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x100410d4
mov dword [ebp - 0xb50], edx
mov ecx, ebx
mov dword [ebp - 0xb58], ecx
lea eax, [edx + 4]
cmp eax, edx
jb 0x1003f0e5
mov edi, eax
jmp 0x1003f0e8
or edi, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x1003f11d
mov ecx, dword [ebp - 0xb54]
lea eax, [edx + 8]
add ecx, edx
cmp eax, ecx
ja 0x100410c2
push 4
pop eax
mov dword [edx], eax
mov dword [edi], eax
mov ecx, dword [ebp - 0xb58]
inc ecx
mov dword [ebp - 0xb58], ecx
test esi, esi
js 0x100410c2
cmp dword [ebp - 0xb50], 0
jne 0x1003f169
mov edx, dword [ebp - 0xb54]
lea eax, [edx + 0xa4]
cmp eax, edx
jb 0x1003f142
mov esi, eax
jmp 0x1003f145
or esi, 0xffffffff
cmp eax, edx
mov dword [ebp - 0xb54], esi
sbb edi, edi
and edi, 0xc0000095
cmp eax, edx
jb 0x1003f237
inc ecx
mov dword [ebp - 0xb58], ecx
jmp 0x1003f23f
mov edx, dword [ebp - 0xb50]
mov esi, ebx
test ecx, ecx
je 0x1003f1d7
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xad8], edx
cmp eax, 4
jb 0x1003f189
mov edi, eax
jmp 0x1003f18c
or edi, 0xffffffff
cmp eax, 4
jb 0x1003f199
mov dword [ebp - 0xc8c], edi
jmp 0x1003f19f
mov edi, dword [ebp - 0xc8c]
cmp eax, 4
jb 0x100410c2
lea eax, [edx + edi]
mov dword [ebp - 0xaf8], edx
cmp eax, edx
jb 0x1003f1b9
mov edx, eax
jmp 0x1003f1bc
or edx, 0xffffffff
cmp eax, dword [ebp - 0xaf8]
sbb edi, edi
and edi, 0xc0000095
cmp eax, dword [ebp - 0xad8]
jb 0x1003f231
inc esi
cmp esi, ecx
jb 0x1003f175
lea eax, [edx + 4]
cmp eax, edx
jb 0x1003f1e2
mov esi, eax
jmp 0x1003f1e5
or esi, 0xffffffff
cmp eax, edx
sbb edi, edi
and edi, 0xc0000095
cmp eax, edx
jb 0x1003f231
mov ecx, dword [ebp - 0xb54]
lea eax, [edx + 0xa4]
add ecx, dword [ebp - 0xb50]
cmp eax, ecx
ja 0x100410c2
mov eax, 0xa0
push eax
push dword [ebp - 0xb10]
mov dword [edx], eax
push esi
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xb58]
add esp, 0xc
inc ecx
mov dword [ebp - 0xb58], ecx
mov esi, dword [ebp - 0xb54]
test edi, edi
js 0x100410c2
cmp dword [ebp - 0xb50], 0
jne 0x1003f27a
mov eax, esi
lea esi, [eax + 0xc]
mov edx, esi
cmp esi, eax
jae 0x1003f256
or esi, 0xffffffff
cmp edx, eax
mov dword [ebp - 0xb54], esi
sbb edi, edi
and edi, 0xc0000095
cmp edx, eax
jb 0x1003f360
inc ecx
mov dword [ebp - 0xb58], ecx
jmp 0x1003f371
mov edx, dword [ebp - 0xb50]
mov dword [ebp - 0xb04], ebx
test ecx, ecx
je 0x1003f2f8
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xad8], edx
cmp eax, 4
jb 0x1003f29e
mov edi, eax
jmp 0x1003f2a1
or edi, 0xffffffff
cmp eax, 4
jb 0x1003f2ae
mov dword [ebp - 0xc90], edi
jmp 0x1003f2b4
mov edi, dword [ebp - 0xc90]
cmp eax, 4
jb 0x100410c2
lea eax, [edx + edi]
mov dword [ebp - 0xaf8], edx
cmp eax, edx
jb 0x1003f2ce
mov edx, eax
jmp 0x1003f2d1
or edx, 0xffffffff
cmp eax, dword [ebp - 0xaf8]
sbb edi, edi
and edi, 0xc0000095
cmp eax, dword [ebp - 0xad8]
jb 0x1003f360
mov edi, dword [ebp - 0xb04]
inc edi
mov dword [ebp - 0xb04], edi
cmp edi, ecx
jb 0x1003f28a
lea eax, [edx + 4]
cmp eax, edx
jb 0x1003f307
mov dword [ebp - 0xb04], eax
jmp 0x1003f310
or edi, 0xffffffff
mov dword [ebp - 0xb04], edi
cmp eax, edx
sbb edi, edi
and edi, 0xc0000095
cmp eax, edx
jb 0x1003f360
mov ecx, dword [ebp - 0xb50]
lea eax, [edx + 0xc]
add ecx, esi
cmp eax, ecx
ja 0x100410c2
mov ecx, dword [ebp - 0xb4c]
mov dword [edx], 8
mov edx, dword [ebp - 0xb04]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0xb58]
mov esi, dword [ebp - 0xb54]
inc ecx
mov dword [ebp - 0xb58], ecx
test edi, edi
js 0x100410c2
cmp dword [ebp - 0xb50], 0
jne 0x1003f3a3
mov eax, esi
lea esi, [eax + 0xc]
mov edx, esi
cmp esi, eax
jae 0x1003f37f
or esi, 0xffffffff
cmp edx, eax
mov dword [ebp - 0xb54], esi
sbb edi, edi
and edi, 0xc0000095
cmp edx, eax
jb 0x1003f48a
inc ecx
mov dword [ebp - 0xb58], ecx
jmp 0x1003f492
mov edx, dword [ebp - 0xb50]
mov dword [ebp - 0xb04], ebx
test ecx, ecx
je 0x1003f421
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xad8], edx
cmp eax, 4
jb 0x1003f3c7
mov edi, eax
jmp 0x1003f3ca
or edi, 0xffffffff
cmp eax, 4
jb 0x1003f3d7
mov dword [ebp - 0xc94], edi
jmp 0x1003f3dd
mov edi, dword [ebp - 0xc94]
cmp eax, 4
jb 0x100410c2
lea eax, [edx + edi]
mov dword [ebp - 0xaf8], edx
cmp eax, edx
jb 0x1003f3f7
mov edx, eax
jmp 0x1003f3fa
or edx, 0xffffffff
cmp eax, dword [ebp - 0xaf8]
sbb edi, edi
and edi, 0xc0000095
cmp eax, dword [ebp - 0xad8]
jb 0x1003f48a
mov edi, dword [ebp - 0xb04]
inc edi
mov dword [ebp - 0xb04], edi
cmp edi, ecx
jb 0x1003f3b3
lea eax, [edx + 4]
cmp eax, edx
jb 0x1003f430
mov dword [ebp - 0xb04], eax
jmp 0x1003f439
or edi, 0xffffffff
mov dword [ebp - 0xb04], edi
cmp eax, edx
sbb edi, edi
and edi, 0xc0000095
cmp eax, edx
jb 0x1003f48a
mov ecx, dword [ebp - 0xb50]
lea eax, [edx + 0xc]
add ecx, esi
cmp eax, ecx
ja 0x100410c2
mov eax, dword [ebp - 0xb04]
mov ecx, dword [ebp - 0xb00]
mov dword [edx], 8
mov dword [eax], ecx
mov ecx, dword [ebp - 0xb0c]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0xb58]
mov esi, dword [ebp - 0xb54]
inc ecx
mov dword [ebp - 0xb58], ecx
test edi, edi
js 0x100410c2
rdtsc
mov edi, ebx
mov dword [ebp - 0xac4], ebx
mov dword [ebp - 0xb48], edi
mov dword [ebp - 0xad4], ebx
mov dword [ebp - 0xb1c], ebx
mov dword [ebp - 0xad0], ebx
mov dword [ebp - 0xaf0], ebx
mov dword [ebp - 0xabc], ebx
mov dword [ebp - 0xb18], ebx
mov dword [ebp - 0xb30], ebx
mov dword [ebp - 0xb14], ebx
mov dword [ebp - 0xaf8], eax
mov dword [ebp - 0xad8], edx
lea eax, [esi + 8]
cmp eax, 8
jb 0x1003f4ea
mov edx, eax
jmp 0x1003f4ed
or edx, 0xffffffff
cmp eax, 8
sbb esi, esi
and esi, 0xc0000095
cmp eax, 8
jb 0x1003f5e7
lea eax, [edx + 7]
and eax, 0xfffffff8
mov dword [ebp - 0xb04], eax
cmp eax, edx
jae 0x1003f51b
mov esi, 0xc0000095
jmp 0x1003f5e7
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x1003f53d
mov esi, 0xc0000017
mov edi, ebx
jmp 0x1003f5e1
mov eax, dword [ebp - 0xb58]
mov dword [edi], eax
lea eax, [edi + 4]
cmp eax, edi
jb 0x1003f550
mov ecx, eax
jmp 0x1003f553
or ecx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x1003f5c8
mov eax, dword [ebp - 0xb54]
mov dword [ecx], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x1003f574
mov edx, eax
jmp 0x1003f577
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1003f5c8
mov eax, dword [ebp - 0xb04]
mov ecx, dword [ebp - 0xaf8]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0xad8]
mov dword [edi + eax - 4], ecx
push dword [ebp - 0xb54]
push dword [ebp - 0xb50]
push edx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xb04]
add esp, 0xc
mov dword [ebp - 0xac4], edi
mov edi, ebx
mov dword [ebp - 0xb48], eax
test edi, edi
je 0x1003f5db
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xb48]
mov ecx, dword [ebp - 0xb58]
or esi, 0x10000000
jl 0x10040ed5
cmp dword [ebp - 0xac4], 0
mov dword [ebp - 0xae0], ebx
jne 0x1003f60c
mov esi, 0xc000000d
jmp 0x1003fc98
test edi, edi
je 0x1003fc93
lea eax, [edi + 8]
push eax
push ebx
mov dword [ebp - 0xb0c], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xaf4], esi
test esi, esi
je 0x1003fc8d
mov cl, bl
mov eax, ebx
test edi, edi
je 0x1003f652
mov edx, dword [ebp - 0xac4]
xor cl, byte [eax + edx]
inc eax
cmp eax, edi
jb 0x1003f64a
mov eax, ebx
mov dword [ebp - 0x43c], 0xb1b54a58
mov dword [ebp - 0xaf8], eax
mov dword [ebp - 0xba0], eax
or eax, 0xffffffff
mov dword [ebp - 0xab8], eax
mov dword [ebp - 0xb90], eax
mov eax, edi
shr eax, 3
mov dword [ebp - 0xb00], eax
test eax, eax
je 0x1003faca
movzx edx, word [ebp - 0x43a]
mov eax, 0xc81ecb17
movzx esi, ax
shr eax, 0x10
mov dword [ebp - 0xacc], eax
mov eax, dword [ebp - 0xaf4]
mov dword [ebp - 0xae8], esi
add eax, 7
mov esi, dword [ebp - 0xac4]
add esi, 2
mov dword [ebp - 0xac0], edx
mov edx, dword [ebp - 0xab8]
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xb38], esi
mov dword [ebp - 0xb04], ebx
mov dword [ebp - 0xb4c], ebx
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xb38]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xb38]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xb38]
shl esi, 8
add dword [ebp - 0xb38], 8
movzx eax, byte [eax + 5]
or esi, eax
xor edx, esi
mov dword [ebp - 0xab8], edx
lea eax, [edx - 0x4a58]
mov edx, 0xc81ecb17
xor eax, edx
xor eax, edi
xor ebx, eax
xor edx, ebx
mov eax, ebx
ror edx, 0xf
imul edx, dword [ebp - 0xac0]
ror eax, 7
add edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov dword [ebp - 0xab8], eax
lea edx, [eax - 0x4e4ab5a8]
ror eax, 0xa
ror edx, 9
imul edx, dword [ebp - 0xae8]
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xae8]
xor edx, ebx
mov eax, ebx
rol eax, 5
rol edx, 4
imul edx, dword [ebp - 0xacc]
add edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xab8], eax
xor edx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, edx
xor ebx, eax
mov eax, ebx
shr eax, 6
lea edx, [ebx - 0x4a58]
imul edx, dword [ebp - 0xac0]
sub edx, eax
xor dword [ebp - 0xab8], edx
mov edx, dword [ebp - 0xab8]
mov eax, edx
ror eax, 0xf
xor eax, dword [ebp - 0xae8]
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, dword [ebp - 0xacc]
imul eax, dword [ebp - 0xae8]
xor edx, eax
mov dword [ebp - 0xab8], edx
sub edx, 0xc81ecb17
sub edx, 0x4a58
mov eax, dword [ebp - 0xacc]
xor ebx, edx
xor eax, ebx
mov edx, ebx
imul eax, dword [ebp - 0xac0]
ror edx, 0xa
xor edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xab8], eax
xor edx, 0x4a58
ror eax, 3
rol edx, 6
imul edx, dword [ebp - 0xae8]
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xab8]
mov eax, ebx
ror eax, 0xf
sub eax, dword [ebp - 0xacc]
imul eax, eax, 0x4a58
xor edx, eax
mov eax, dword [ebp - 0xacc]
xor eax, edx
mov dword [ebp - 0xab8], edx
imul edx, eax, 0x4a58
mov eax, dword [ebp - 0xab8]
shr eax, 1
xor edx, eax
mov eax, dword [ebp - 0xab8]
sub eax, dword [ebp - 0xae8]
xor ebx, edx
rol eax, 3
imul edx, eax, 0x4a58
mov eax, dword [ebp - 0xab8]
shr eax, 0xf
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
sub edx, dword [ebp - 0xae8]
imul edx, dword [ebp - 0xac0]
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0xab8], eax
ror edx, 9
imul edx, dword [ebp - 0xae8]
ror eax, 0xb
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xab8]
mov eax, ebx
sub eax, dword [ebp - 0xacc]
add eax, 0x4e4ab5a8
xor edx, eax
mov eax, dword [ebp - 0xac0]
mov dword [ebp - 0xab8], edx
xor eax, dword [ebp - 0xab8]
imul eax, eax, 0x4a58
ror edx, 7
sub eax, edx
mov edx, dword [ebp - 0xacc]
xor ebx, eax
xor edx, ebx
mov eax, ebx
rol edx, 4
imul edx, dword [ebp - 0xac0]
ror eax, 0x10
sub edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0xab8], eax
ror edx, 0xa
imul edx, dword [ebp - 0xae8]
ror eax, 4
add edx, eax
xor ebx, edx
mov eax, ebx
ror eax, 9
lea edx, [ebx + 0x4e4ab5a8]
ror edx, 4
imul edx, dword [ebp - 0xacc]
xor edx, eax
mov eax, 0xc81ecb17
xor dword [ebp - 0xab8], edx
xor eax, dword [ebp - 0xab8]
rol eax, 8
imul edx, eax, 0x4a58
mov eax, dword [ebp - 0xab8]
rol eax, 2
sub edx, eax
xor ebx, edx
mov edx, 0xc81ecb17
sub edx, ebx
mov eax, ebx
ror eax, 0xc
ror edx, 0xb
imul edx, dword [ebp - 0xac0]
sub edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov edx, dword [ebp - 0xac0]
xor edx, eax
mov dword [ebp - 0xab8], eax
imul edx, dword [ebp - 0xae8]
shr eax, 8
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xae4]
mov eax, ebx
add dword [ebp - 0xae4], 8
xor eax, dword [ebp - 0xab8]
xor ebx, dword [ebp - 0xb04]
xor eax, 0xc81ecb17
xor eax, dword [ebp - 0xb4c]
mov dword [ebp - 0xba0], ebx
xor eax, 0xb1b54a58
mov dword [ebp - 0xb90], eax
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb90]
ror dword [ebp - 0xba0], 8
mov byte [edx], al
ror dword [ebp - 0xb90], 8
mov al, byte [ebp - 0xba0]
mov byte [edx - 5], al
mov al, byte [ebp - 0xb90]
ror dword [ebp - 0xba0], 8
mov byte [edx - 1], al
ror dword [ebp - 0xb90], 8
mov al, byte [ebp - 0xba0]
mov byte [edx - 6], al
ror dword [ebp - 0xba0], 8
mov al, byte [ebp - 0xb90]
mov byte [edx - 2], al
ror dword [ebp - 0xb90], 8
mov al, byte [ebp - 0xba0]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb90]
mov byte [edx - 3], al
mov ebx, dword [ebp - 0xba0]
mov edx, dword [ebp - 0xb90]
ror ebx, 8
ror edx, 8
sub dword [ebp - 0xb00], 1
mov dword [ebp - 0xb4c], esi
mov esi, dword [ebp - 0xb38]
mov dword [ebp - 0xba0], ebx
mov dword [ebp - 0xb90], edx
mov dword [ebp - 0xb04], edi
jne 0x1003f6e0
mov edi, dword [ebp - 0xb48]
xor ebx, ebx
mov esi, dword [ebp - 0xaf4]
movzx eax, cl
cdq
mov dword [esi + edi], eax
mov dword [esi + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x1003faf6
mov esi, 0xc0000017
jmp 0x1003fbf5
mov eax, dword [ebp - 0xb0c]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0x1003fb19
mov esi, 0xc0000017
jmp 0x1003fb94
mov dword [edi + 4], eax
push dword [ebp - 0xb0c]
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
pop esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0x1003fb12
mov dword [edi + 0xc], eax
push 0xa0
push 0x10069238
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [edi + 0x10], esi
push esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1003fb12
mov dword [edi + 0x14], ecx
mov eax, dword [0x100692d8]
mov esi, ebx
mov dword [ecx], eax
mov eax, dword [0x100692dc]
mov dword [ebp - 0xae0], edi
mov edi, ebx
mov dword [ecx + 4], eax
test edi, edi
je 0x1003fbf5
cmp dword [edi + 4], 0
je 0x1003fbb2
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x1003fbcc
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x1003fbe6
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x1003fc09
mov eax, dword [ebp - 0xae0]
mov edi, ebx
mov dword [ebp - 0xad4], eax
jmp 0x1003fc0f
mov edi, dword [ebp - 0xae0]
mov eax, dword [ebp - 0xaf4]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0x1003fc85
cmp dword [edi + 4], 0
je 0x1003fc42
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x1003fc5c
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x1003fc76
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ecx, dword [ebp - 0xb58]
jmp 0x1003fc98
mov ecx, dword [ebp - 0xb58]
mov esi, 0xc0000001
or esi, 0x10000000
jl 0x10040ed5
mov edx, dword [ebp - 0xad4]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0xad8], eax
mov eax, dword [edx + 8]
mov edx, dword [edx]
add edx, 4
mov dword [ebp - 0xaf8], eax
cmp edx, 4
jb 0x1003fcca
mov eax, edx
jmp 0x1003fccd
or eax, 0xffffffff
cmp edx, 4
sbb esi, esi
and esi, 0xc0000095
cmp edx, 4
jb 0x1003fd67
lea edx, [eax + 4]
cmp edx, eax
jb 0x1003fcec
mov edi, edx
jmp 0x1003fcef
or edi, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
cmp edx, eax
jb 0x1003fd67
mov eax, dword [ebp - 0xaf8]
add eax, edi
cmp eax, edi
jb 0x1003fd0d
mov edx, eax
jmp 0x1003fd10
or edx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x1003fd67
lea edi, [edx + 4]
cmp edi, edx
jb 0x1003fd29
mov eax, edi
jmp 0x1003fd2c
or eax, 0xffffffff
cmp edi, edx
sbb esi, esi
and esi, 0xc0000095
cmp edi, edx
jb 0x1003fd67
mov edx, dword [ebp - 0xad8]
add edx, eax
cmp edx, eax
jb 0x1003fd50
mov edi, edx
mov dword [ebp - 0xae0], edx
jmp 0x1003fd59
or edi, 0xffffffff
mov dword [ebp - 0xae0], edi
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
cmp edx, eax
jae 0x1003fd73
mov edi, dword [ebp - 0xce8]
mov dword [ebp - 0xae0], edi
test esi, esi
js 0x1003ff3a
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x1003fd9b
mov esi, 0xc0000017
jmp 0x1003ff34
mov edx, dword [ebp - 0xad4]
lea ecx, [edi + 4]
mov eax, dword [edx]
mov dword [edi], eax
cmp ecx, edi
jb 0x1003fdb6
mov eax, ecx
mov dword [ebp - 0xb04], ecx
jmp 0x1003fdbf
or eax, 0xffffffff
mov dword [ebp - 0xb04], eax
cmp ecx, edi
sbb esi, esi
and esi, 0xc0000095
cmp ecx, edi
jb 0x1003ff21
push dword [edx]
push dword [edx + 4]
push eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0xad4]
add esp, 0xc
mov ecx, dword [ebp - 0xb04]
mov esi, dword [edx]
add esi, ecx
mov dword [ebp - 0xaf8], esi
cmp esi, ecx
jb 0x1003fe01
mov dword [ebp - 0xb04], esi
jmp 0x1003fe0a
or eax, 0xffffffff
mov dword [ebp - 0xb04], eax
cmp esi, ecx
sbb esi, esi
and esi, 0xc0000095
cmp dword [ebp - 0xaf8], ecx
jb 0x1003ff21
mov ecx, dword [ebp - 0xb04]
mov eax, dword [edx + 8]
lea esi, [ecx + 4]
mov dword [ecx], eax
mov dword [ebp - 0xaf8], esi
cmp esi, ecx
jb 0x1003fe42
mov eax, esi
mov dword [ebp - 0xae4], esi
jmp 0x1003fe4b
or eax, 0xffffffff
mov dword [ebp - 0xae4], eax
cmp esi, ecx
sbb esi, esi
and esi, 0xc0000095
cmp dword [ebp - 0xaf8], ecx
jb 0x1003ff21
push dword [edx + 8]
push dword [edx + 0xc]
push eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0xad4]
add esp, 0xc
mov esi, dword [ebp - 0xae4]
mov eax, dword [ebp - 0xae4]
add esi, dword [edx + 8]
mov dword [ebp - 0xaf8], esi
cmp esi, eax
jb 0x1003fe93
mov ecx, esi
jmp 0x1003fe96
or ecx, 0xffffffff
cmp esi, eax
sbb esi, esi
and esi, 0xc0000095
cmp dword [ebp - 0xaf8], eax
jb 0x1003ff21
mov eax, dword [edx + 0x10]
lea esi, [ecx + 4]
mov dword [ecx], eax
mov dword [ebp - 0xaf8], esi
cmp esi, ecx
jb 0x1003fec4
mov eax, esi
mov dword [ebp - 0xb04], esi
jmp 0x1003fecd
or eax, 0xffffffff
mov dword [ebp - 0xb04], eax
cmp esi, ecx
sbb esi, esi
and esi, 0xc0000095
cmp dword [ebp - 0xaf8], ecx
jb 0x1003ff21
push dword [edx + 0x10]
push dword [edx + 0x14]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xad4]
add esp, 0xc
mov ecx, dword [ebp - 0xb04]
mov eax, dword [eax + 0x10]
add eax, ecx
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1003ff21
mov eax, dword [ebp - 0xae0]
mov dword [ebp - 0xb1c], edi
mov edi, ebx
mov dword [ebp - 0xad0], eax
test edi, edi
je 0x1003ff34
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ecx, dword [ebp - 0xb58]
or esi, 0x10000000
jl 0x10040ed5
mov dword [ebp - 0xb4c], ebx
cmp dword [ebp - 0xb50], 0
jne 0x1003ff88
mov esi, 0xc000000d
mov eax, ebx
test esi, esi
js 0x10040ed5
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x10040116
mov esi, 0xd0000017
jmp 0x10040ed5
xor eax, eax
inc eax
cmp ecx, eax
jbe 0x1003ff55
mov edx, dword [ebp - 0xb50]
mov dword [ebp - 0xb04], ebx
mov eax, dword [edx]
lea edi, [edx + 4]
mov dword [ebp - 0xaf8], eax
cmp edi, edx
jb 0x1003ffae
mov eax, edi
jmp 0x1003ffb1
or eax, 0xffffffff
cmp edi, edx
sbb esi, esi
and esi, 0xc0000095
cmp edi, edx
jb 0x1004000b
mov edx, dword [ebp - 0xaf8]
add edx, eax
mov edi, edx
cmp edx, eax
jae 0x1003ffd0
or edx, 0xffffffff
cmp edi, eax
sbb esi, esi
and esi, 0xc0000095
cmp edi, eax
jb 0x1004000b
mov eax, dword [ebp - 0xb04]
xor esi, esi
inc eax
inc esi
mov dword [ebp - 0xb04], eax
cmp eax, esi
jb 0x1003ff9b
lea eax, [edx + 4]
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x1004000b
mov eax, dword [edx]
mov dword [ebp - 0xb4c], eax
test esi, esi
js 0x1003ff5a
cmp ecx, 2
jbe 0x1003ff55
mov ecx, dword [ebp - 0xb50]
mov edi, ebx
mov eax, dword [ecx]
lea edx, [ecx + 4]
mov dword [ebp - 0xaf8], eax
cmp edx, ecx
jb 0x10040037
mov eax, edx
jmp 0x1004003a
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
cmp edx, ecx
jb 0x10040082
mov ecx, dword [ebp - 0xaf8]
add ecx, eax
mov edx, ecx
cmp ecx, eax
jae 0x10040059
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
cmp edx, eax
jb 0x10040082
inc edi
cmp edi, 2
jb 0x10040024
lea eax, [ecx + 4]
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10040082
mov edi, dword [ecx]
jmp 0x10040084
mov edi, ebx
test esi, esi
js 0x1003ff5a
mov eax, dword [ebp - 0xb4c]
add eax, 0x30
cmp eax, 0x30
jb 0x1004009e
mov ecx, eax
jmp 0x100400a1
or ecx, 0xffffffff
cmp eax, 0x30
sbb esi, esi
and esi, 0xc0000095
cmp eax, 0x30
jb 0x100400e9
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x100400bc
mov eax, edx
jmp 0x100400bf
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
cmp edx, ecx
jb 0x100400e9
lea edx, [eax + edi]
cmp edx, eax
jb 0x100400d8
mov ecx, edx
jmp 0x100400db
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
cmp edx, eax
jae 0x100400ef
mov ecx, dword [ebp - 0xd1c]
test esi, esi
js 0x1003ff5a
cmp ecx, 0x400000
jbe 0x10040109
mov esi, 0x8000ffff
jmp 0x10040ed5
mov eax, ecx
mov dword [ebp - 0xabc], eax
jmp 0x1003ff5c
mov dword [ebp - 0xaf0], edi
mov eax, dword [ebp - 0xb1c]
test eax, eax
jne 0x10040130
mov esi, 0x80070057
jmp 0x10040ed5
mov dword [ebp - 0xcc0], eax
mov eax, dword [ebp - 0xad0]
mov dword [ebp - 0xcb8], eax
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0xcb4], eax
lea eax, [ebp - 0xbf0]
push eax
xor eax, eax
mov dword [ebp - 0xcbc], edi
push 0x10002a4c
inc eax
mov dword [ebp - 0xcb0], ebx
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0x1004019a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1004018b
movzx esi, si
or esi, 0x80070000
test esi, esi
mov eax, dword [ebp - 0xabc]
js 0x100401e8
mov esi, 0x80004005
jmp 0x100401e8
push 0x10004e50
push dword [ebp - 0xbf0]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10040174
push ebx
push 0x14
lea eax, [ebp - 0xcc0]
mov ecx, esi
push eax
push 0x86
call dword [0x100ad1dc]
call esi
mov esi, eax
or esi, 0x10000000
jl 0x100401e2
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0xabc], eax
jmp 0x100401e8
mov eax, dword [ebp - 0xabc]
cmp esi, 0xd0000023
jne 0x100401fa
mov esi, 0x8007007a
jmp 0x10040ed5
test esi, esi
js 0x10040ed5
mov dword [ebp - 0xaf4], ebx
cmp eax, 4
jae 0x10040217
mov esi, 0xc000003e
jmp 0x10040604
mov ecx, dword [edi]
lea eax, [edi + 4]
mov dword [ebp - 0xae4], ecx
cmp eax, edi
jb 0x10040230
mov edx, eax
mov dword [ebp - 0xb48], eax
jmp 0x10040239
or edx, 0xffffffff
mov dword [ebp - 0xb48], edx
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x10040604
mov eax, dword [ebp - 0xabc]
add eax, 0xfffffffc
cmp eax, ecx
jb 0x1004020d
lea edi, [edx + ecx]
cmp edi, edx
jb 0x10040263
mov edx, edi
jmp 0x10040266
or edx, 0xffffffff
cmp edi, dword [ebp - 0xb48]
sbb esi, esi
and esi, 0xc0000095
cmp edi, dword [ebp - 0xb48]
jb 0x10040604
lea eax, [ecx + 4]
cmp eax, 4
jb 0x1004028c
mov ecx, eax
jmp 0x1004028f
or ecx, 0xffffffff
cmp eax, 4
mov edi, 0xc0000095
sbb esi, esi
and esi, edi
cmp eax, 4
jb 0x10040604
mov eax, dword [ebp - 0xabc]
sub eax, ecx
cmp eax, 4
jb 0x1004020d
mov eax, dword [edx]
mov dword [ebp - 0xb4c], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x100402cc
mov dword [ebp - 0xbac], eax
jmp 0x100402d3
or dword [ebp - 0xbac], 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, edi
cmp eax, edx
jb 0x10040604
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x100402ec
mov edi, eax
jmp 0x100402ef
or edi, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10040604
mov eax, dword [ebp - 0xabc]
mov ecx, dword [ebp - 0xb4c]
sub eax, edi
cmp eax, ecx
jb 0x1004020d
mov edx, dword [ebp - 0xbac]
lea esi, [edx + ecx]
cmp esi, edx
jb 0x1004032c
mov dword [ebp - 0xb04], esi
jmp 0x10040335
or eax, 0xffffffff
mov dword [ebp - 0xb04], eax
cmp esi, edx
lea eax, [edx + ecx]
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x10040604
lea eax, [edi + ecx]
cmp eax, edi
jb 0x10040355
mov edx, eax
jmp 0x10040358
or edx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x10040604
mov eax, dword [ebp - 0xabc]
sub eax, edx
cmp eax, 4
jb 0x1004020d
mov eax, dword [ebp - 0xb04]
mov edi, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xaf8], edi
cmp ecx, eax
jb 0x10040398
mov dword [ebp - 0xae0], ecx
jmp 0x1004039f
or dword [ebp - 0xae0], 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
cmp ecx, eax
jb 0x10040604
lea eax, [edx + 4]
cmp eax, edx
jb 0x100403bc
mov ecx, eax
jmp 0x100403bf
or ecx, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x10040604
mov eax, dword [ebp - 0xabc]
sub eax, ecx
cmp eax, edi
jb 0x1004020d
lea eax, [ecx + edi]
cmp eax, ecx
jb 0x100403ec
mov edx, eax
jmp 0x100403ef
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10040604
mov ecx, dword [ebp - 0xabc]
mov eax, ecx
sub eax, edx
jne 0x1004020d
mov eax, dword [ebp - 0xae4]
mov esi, dword [ebp - 0xb4c]
add eax, 0xc
add eax, esi
add eax, edi
cmp eax, ecx
jne 0x1004020d
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x1004044d
mov esi, 0xc0000017
jmp 0x10040589
cmp dword [ebp - 0xb48], 0
je 0x10040499
mov eax, dword [ebp - 0xae4]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x1004047e
mov esi, 0xc0000017
jmp 0x10040528
mov dword [edi + 4], ecx
mov eax, dword [ebp - 0xae4]
push eax
push dword [ebp - 0xb48]
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x1004049e
mov dword [edi], ebx
mov dword [edi + 4], ebx
cmp dword [ebp - 0xbac], 0
je 0x100404d3
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0x10040474
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xbac]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x100404d9
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
cmp dword [ebp - 0xae0], 0
je 0x10040518
mov esi, dword [ebp - 0xaf8]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0x10040474
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xae0]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x1004051e
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [ebp - 0xaf4], edi
mov esi, ebx
mov edi, ebx
test edi, edi
je 0x10040589
cmp dword [edi + 4], 0
je 0x10040546
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x10040560
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x1004057a
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x1004059d
mov eax, dword [ebp - 0xaf4]
mov edi, ebx
mov dword [ebp - 0xb18], eax
jmp 0x100405a3
mov edi, dword [ebp - 0xaf4]
test edi, edi
je 0x10040604
cmp dword [edi + 4], 0
je 0x100405c1
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x100405db
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x100405f5
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0x10040ed5
mov ecx, dword [ebp - 0xb18]
mov edi, ebx
mov dword [ebp - 0xadc], ebx
test ecx, ecx
jne 0x1004062c
mov esi, 0xd000000d
jmp 0x10040ed5
mov eax, dword [ecx + 4]
mov dword [ebp - 0xad0], eax
test eax, eax
je 0x10040622
mov esi, dword [ecx]
test esi, esi
je 0x10040622
add esi, 0xfffffff8
push esi
push ebx
mov dword [ebp - 0xb48], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb0c], eax
test eax, eax
je 0x10040c56
mov ecx, dword [ebp - 0xad0]
mov edi, esi
and edi, 7
mov dword [ebp - 0xae4], eax
mov dl, bl
mov dword [ebp - 0x434], 0xab69605e
mov dword [ebp - 0xb4c], ecx
mov eax, ebx
mov dword [ebp - 0xad8], edi
je 0x10040bf7
or dword [ebp - 0xb60], 0xffffffff
mov esi, ebx
mov dword [ebp - 0xb6c], ebx
mov dword [ebp - 0xabc], ebx
mov dword [ebp - 0xac0], eax
test edi, edi
je 0x10040705
lea eax, [ecx + 1]
mov dword [ebp - 0xaf8], eax
movzx eax, byte [ecx]
mov ecx, dword [ebp - 0xbb0]
cmp esi, 4
jge 0x100406d9
add ecx, 0xffffffe0
shl eax, cl
or dword [ebp - 0xac0], eax
jmp 0x100406dd
shl eax, cl
or ebx, eax
sub dword [ebp - 0xbb0], 8
inc esi
mov eax, dword [ebp - 0xaf8]
mov ecx, eax
cmp esi, edi
jl 0x100406b5
mov dword [ebp - 0xabc], ebx
xor ebx, ebx
mov dword [ebp - 0xb4c], eax
mov eax, dword [ebp - 0xac0]
mov ecx, dword [ebp - 0xabc]
xor eax, 0x92f65a5
xor ecx, 0x699a899c
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0xb6c], eax
mov dword [ebp - 0xb08], ecx
mov dword [ebp - 0xb60], ecx
mov dword [ebp - 0xaf8], ebx
test edi, edi
je 0x10040787
mov esi, dword [ebp - 0xae4]
lea edi, [esi + 1]
mov dword [ebp - 0xb04], edi
cmp ebx, 4
jge 0x10040753
rol eax, 8
mov byte [esi], al
jmp 0x10040758
rol ecx, 8
mov byte [esi], cl
mov edi, dword [ebp - 0xad8]
inc ebx
mov esi, dword [ebp - 0xb04]
cmp ebx, edi
jl 0x1004073e
mov eax, esi
xor ebx, ebx
mov esi, dword [ebp - 0xb60]
mov dword [ebp - 0xae4], eax
mov eax, dword [ebp - 0xb6c]
mov dword [ebp - 0xae8], eax
jmp 0x1004078d
mov esi, dword [ebp - 0xb08]
add edi, 0xfffffffc
test edi, edi
jle 0x10040bc5
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0xb08], esi
mov dword [ebp - 0xb60], esi
mov edi, dword [ebp - 0xae8]
mov esi, dword [ebp - 0xb48]
mov eax, esi
shr eax, 3
mov dword [ebp - 0xb00], eax
test eax, eax
je 0x10040b8e
movzx esi, word [ebp - 0x432]
mov eax, 0x7f1137f
mov ecx, eax
mov dword [ebp - 0xacc], esi
mov esi, dword [ebp - 0xb4c]
movzx eax, ax
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0xae4]
shr ecx, 0x10
add eax, 7
mov dword [ebp - 0xb38], ecx
add esi, 2
mov dword [ebp - 0xb04], eax
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx ecx, byte [esi + 2]
shl ecx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or ecx, eax
mov dword [ebp - 0xaf8], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl ecx, 8
or ecx, eax
mov dword [ebp - 0xae8], edi
movzx eax, byte [esi + 5]
add esi, 8
mov ebx, dword [ebp - 0xae8]
shl ecx, 8
or ecx, eax
mov dword [ebp - 0xb10], esi
mov edi, ecx
mov esi, dword [ebp - 0xae0]
xor edi, dword [ebp - 0xb08]
mov eax, 0x7f1137f
xor edi, eax
mov dword [ebp - 0xad8], ecx
xor edi, ebx
xor edi, 0xab69605e
mov eax, edi
rol eax, 0xa
lea ecx, [edi + 0x54969fa2]
rol ecx, 5
imul ecx, esi
add ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea ecx, [ebx + ecx]
ror ecx, 9
imul ecx, dword [ebp - 0xacc]
sub ecx, eax
xor edi, ecx
mov eax, edi
sub eax, esi
imul ecx, eax, 0x605e
mov eax, edi
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xacc]
rol ecx, 6
imul ecx, dword [ebp - 0xb38]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor edi, ecx
mov ecx, edi
xor ecx, 0xab69605e
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, esi
ror ecx, 6
imul eax, dword [ebp - 0xacc]
xor ecx, eax
mov eax, 0x7f1137f
xor edi, ecx
add eax, edi
ror eax, 0xf
imul ecx, eax, 0x605e
mov eax, edi
rol eax, 2
add ecx, eax
xor ebx, ecx
mov eax, ebx
rol eax, 8
lea ecx, [ebx + 0x54969fa2]
ror ecx, 0xe
imul ecx, dword [ebp - 0xb38]
sub ecx, eax
xor edi, ecx
mov ecx, edi
mov eax, edi
xor ecx, 0xab69605e
ror eax, 0xa
ror ecx, 0xc
imul ecx, esi
xor ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xb38]
imul ecx, dword [ebp - 0xacc]
shr eax, 0xa
xor ecx, eax
xor edi, ecx
mov eax, edi
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xb38]
xor ebx, eax
mov esi, ebx
sub esi, dword [ebp - 0xb38]
xor esi, edi
xor esi, 0xab69605e
mov ecx, esi
mov eax, esi
xor ecx, dword [ebp - 0xb38]
rol ecx, 2
imul ecx, dword [ebp - 0xae0]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 6
imul ecx, dword [ebp - 0xacc]
rol eax, 7
add ecx, eax
xor esi, ecx
mov eax, esi
mov ecx, esi
xor eax, dword [ebp - 0xae0]
imul eax, eax, 0x605e
ror ecx, 9
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov dword [ebp - 0xae8], ebx
xor ecx, dword [ebp - 0xacc]
mov eax, ebx
rol ecx, 5
imul ecx, dword [ebp - 0xb38]
rol eax, 7
add ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov ebx, esi
xor ebx, dword [ebp - 0xae8]
xor ebx, ecx
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xacc]
imul eax, dword [ebp - 0xae0]
xor esi, eax
mov eax, esi
sub eax, ecx
ror eax, 1
imul ecx, eax, 0x605e
mov eax, esi
ror eax, 6
sub ecx, eax
xor ebx, ecx
mov eax, ebx
rol eax, 0xe
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul ecx, dword [ebp - 0xb38]
add ecx, eax
xor esi, ecx
mov eax, esi
ror eax, 0xe
lea ecx, [esi - 0x54969fa2]
rol ecx, 0xf
imul ecx, dword [ebp - 0xae0]
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
shr eax, 3
xor ecx, 0x605e
imul ecx, dword [ebp - 0xacc]
xor ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov eax, esi
xor eax, ecx
rol eax, 4
imul ecx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xabc]
rol eax, 2
mov dword [ebp - 0xb60], esi
mov esi, dword [ebp - 0xb10]
xor ecx, eax
xor ecx, dword [ebp - 0xac0]
xor ebx, ecx
mov ecx, dword [ebp - 0xb04]
mov dword [ebp - 0xb6c], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xb60]
ror dword [ebp - 0xb6c], 8
mov byte [ecx], al
mov al, byte [ebp - 0xb6c]
ror dword [ebp - 0xb60], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb60]
ror dword [ebp - 0xb6c], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xb6c]
ror dword [ebp - 0xb60], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xb60]
ror dword [ebp - 0xb6c], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xb60], 8
mov al, byte [ebp - 0xb6c]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb60]
mov byte [ecx - 3], al
add ecx, 8
mov eax, dword [ebp - 0xb60]
mov edi, dword [ebp - 0xb6c]
ror eax, 8
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xb60], eax
mov eax, dword [ebp - 0xaf8]
ror edi, 8
sub dword [ebp - 0xb00], 1
mov dword [ebp - 0xac0], eax
mov eax, dword [ebp - 0xad8]
mov dword [ebp - 0xb6c], edi
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xb04], ecx
jne 0x1004080d
mov esi, dword [ebp - 0xb48]
xor ebx, ebx
mov ecx, dword [ebp - 0xb0c]
mov eax, ebx
test esi, esi
je 0x10040ba2
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0x10040b9a
mov edi, dword [ebp - 0xad0]
movzx eax, dl
cdq
cmp eax, dword [esi + edi]
jne 0x10040c1d
cmp edx, dword [esi + edi + 4]
jne 0x10040c1d
mov edi, ecx
mov dword [ebp - 0xadc], esi
mov ecx, ebx
mov esi, ebx
jmp 0x10040c24
mov ecx, ebx
mov dword [ebp - 0xb08], ecx
mov dword [ebp - 0xb60], ecx
test edi, edi
jns 0x100407b0
neg edi
shl edi, 3
mov ecx, edi
shr eax, cl
shl eax, cl
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0xb6c], eax
jmp 0x100407b0
or dword [ebp - 0xabc], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xac0], ebx
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xb60], eax
mov dword [ebp - 0xb6c], edi
jmp 0x100407bc
mov esi, 0xc004d501
mov edi, ebx
test ecx, ecx
je 0x10040c37
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x10040c56
mov eax, dword [ebp - 0xadc]
mov esi, 0x10000000
mov dword [ebp - 0xb30], edi
mov edi, ebx
mov dword [ebp - 0xb14], eax
jmp 0x10040c5b
mov esi, 0xd0000001
test edi, edi
je 0x10040c6e
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x10040ed5
mov edx, dword [ebp - 0xb14]
cmp edx, 4
jb 0x10040eca
mov edi, dword [ebp - 0xb30]
mov eax, dword [edi]
mov dword [ebp - 0xad8], eax
lea eax, [edi + 4]
cmp eax, edi
jb 0x10040c9e
mov ecx, eax
jmp 0x10040ca1
or ecx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x10040ecf
lea eax, [edx - 4]
cmp eax, 4
jb 0x10040eca
mov edx, dword [ecx]
lea eax, [ecx + 4]
mov dword [ebp - 0xb00], edx
cmp eax, ecx
jb 0x10040cd2
mov edi, eax
jmp 0x10040cd5
or edi, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10040ecf
mov eax, dword [ebp - 0xb14]
add eax, 0xfffffff8
cmp eax, edx
jb 0x10040eca
lea eax, [edx + 8]
cmp eax, 8
sbb esi, esi
and esi, 0xc0000095
cmp eax, 8
jb 0x10040ecf
mov eax, dword [ebp - 0xb30]
lea ecx, [edi + edx]
mov esi, dword [ebp - 0xb14]
add eax, esi
mov dword [ebp - 0xaf8], ecx
cmp eax, ecx
jb 0x10040eca
sub esi, edi
sub esi, edx
add esi, dword [ebp - 0xb30]
cmp esi, 8
jae 0x10040eca
mov dword [ebp - 0xae0], ebx
mov eax, ebx
mov dword [ebp - 0xb0c], eax
mov esi, ebx
test edi, edi
je 0x10040e5d
lea esi, [edi + edx]
mov ecx, edi
cmp esi, edi
jb 0x10040d6c
mov eax, esi
mov dword [ebp - 0xb4c], esi
jmp 0x10040d75
or eax, 0xffffffff
mov dword [ebp - 0xb4c], eax
cmp esi, edi
sbb esi, esi
and esi, 0xc0000095
cmp dword [ebp - 0xaf8], edi
jb 0x10040eb8
cmp edi, eax
jae 0x10040e57
lea esi, [ecx + 4]
mov dword [ebp - 0xaf8], esi
cmp esi, ecx
jb 0x10040da8
mov dword [ebp - 0xb04], esi
jmp 0x10040daf
or dword [ebp - 0xb04], 0xffffffff
cmp esi, ecx
sbb esi, esi
and esi, 0xc0000095
cmp dword [ebp - 0xaf8], ecx
jb 0x10040eb8
cmp dword [ebp - 0xb04], eax
ja 0x10040e82
mov eax, dword [ecx]
add eax, 4
cmp eax, 4
jb 0x10040de3
mov dword [ebp - 0xb04], eax
jmp 0x10040dea
or dword [ebp - 0xb04], 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
cmp eax, 4
jb 0x10040eb8
mov edx, dword [ebp - 0xb04]
mov dword [ebp - 0xc98], edx
mov edx, dword [ebp - 0xb00]
mov eax, dword [ebp - 0xc98]
add eax, ecx
cmp eax, ecx
jb 0x10040e24
mov dword [ebp - 0xae4], eax
jmp 0x10040e2b
or dword [ebp - 0xae4], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10040eb8
mov eax, dword [ebp - 0xb4c]
mov ecx, dword [ebp - 0xae4]
cmp ecx, eax
ja 0x10040e82
inc dword [ebp - 0xae0]
cmp ecx, eax
jb 0x10040d93
cmp ecx, eax
jne 0x10040e82
mov eax, ebx
test edx, edx
je 0x10040e91
push edx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb0c], eax
test eax, eax
jne 0x10040e89
mov esi, 0xc0000017
jmp 0x10040eb8
mov esi, 0xc000000d
jmp 0x10040ecf
mov edx, dword [ebp - 0xb00]
mov esi, ebx
test edi, edi
je 0x10040ea6
push edx
push edi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xb0c]
add esp, 0xc
mov dword [ebp - 0xc0c], eax
mov eax, dword [ebp - 0xae0]
mov dword [ebp - 0xc14], eax
test esi, esi
js 0x10040ecf
mov eax, dword [ebp - 0xad8]
cmp eax, dword [ebp - 0xc14]
je 0x10040ecf
mov esi, 0xc000003e
or esi, 0x10000000
mov eax, dword [ebp - 0xac4]
test eax, eax
je 0x10040eee
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xad4]
test edi, edi
je 0x10040f55
cmp dword [edi + 4], 0
je 0x10040f12
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x10040f2c
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x10040f46
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb1c]
test eax, eax
je 0x10040f6e
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xaf0]
test eax, eax
je 0x10040f87
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xb18]
test edi, edi
je 0x10040fee
cmp dword [edi + 4], 0
je 0x10040fab
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x10040fc5
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x10040fdf
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb30]
test eax, eax
je 0x10041007
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x100410c2
xor eax, eax
inc eax
cmp dword [ebp - 0xc14], eax
jb 0x100410c2
mov eax, dword [ebp - 0xc0c]
test eax, eax
je 0x100410c2
cmp dword [ebp - 0xc14], 0
jbe 0x100410c2
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x10041046
mov edi, ecx
jmp 0x10041049
or edi, 0xffffffff
cmp ecx, dword [ebp - 0xc0c]
sbb esi, esi
and esi, 0xc0000095
cmp ecx, dword [ebp - 0xc0c]
jb 0x10041069
mov eax, edx
neg eax
sbb eax, eax
and eax, edi
jmp 0x10041075
mov edx, dword [ebp - 0xd18]
mov eax, dword [ebp - 0xd14]
test esi, esi
js 0x100410c2
cmp edx, 4
jne 0x100410c2
cmp dword [eax], 0
jl 0x100410c2
xor eax, eax
inc eax
cmp dword [ebp - 0xc14], eax
jbe 0x100410c2
mov eax, dword [ebp - 0xc0c]
mov esi, ebx
mov edi, dword [eax]
lea edx, [eax + 4]
cmp edx, eax
jb 0x100410a3
mov ecx, edx
jmp 0x100410a6
or ecx, 0xffffffff
cmp edx, eax
jb 0x100410c2
lea eax, [edi + ecx]
mov edx, eax
cmp eax, ecx
jae 0x100410b6
or eax, 0xffffffff
cmp edx, ecx
jb 0x100410c2
xor ecx, ecx
inc esi
inc ecx
cmp esi, ecx
jb 0x10041096
mov esi, dword [ebp - 0xaec]
mov edi, dword [ebp - 0xac8]
jmp 0x100410d4
mov esi, ebx
mov edi, ebx
cmp dword [ebp - 0xb50], 0
mov dword [ebp - 0xb54], ebx
mov dword [ebp - 0xb58], ebx
je 0x10041103
push dword [ebp - 0xb50]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xb50], ebx
mov eax, dword [ebp - 0xc0c]
test eax, eax
je 0x1004111c
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
je 0x1004112f
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0x10041142
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbd0]
mov dword [ebp - 0xbd0], ebx
mov dword [ebp - 0xbec], eax
jmp 0x10037791
cmp eax, 0xd00000e5
je 0x10041178
cmp eax, 0xc004d501
je 0x10041178
cmp eax, 0xd000003e
jne 0x1004117d
mov eax, 0xc004f028
jmp 0x10037828
mov eax, 0xc004f027
test eax, eax
jns 0x10041198
cmp eax, 0x8007007a
jne 0x10037828
mov dword [ebp - 0xbe4], 0xc004f01e
jmp 0x100411af
cmp dword [ebp - 0xbcc], 4
jne 0x1004118c
mov eax, dword [ebp - 0xbec]
mov eax, dword [eax]
mov dword [ebp - 0xc5c], eax
lea ecx, [ebp - 0xbec]
call fcn.10051c75
cmp dword [ebp - 0xbe4], 0
jl 0x10041200
cmp dword [ebp - 0xc5c], 0
je 0x10041200
mov esi, dword [ebp - 0xbd8]
push esi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_DisableThreadLibraryCalls]
mov eax, 0x100690e8
mov edx, 0x10036ba0
push eax
push eax
mov ecx, 0x100025b0
call fcn.10036cae
cmp byte [0x10069824], 0
mov dword [0x10069750], esi
je 0x1004121a
jmp 0x1004121f
xor eax, eax
jmp 0x10041221
cmp dword [ebp + 0xc], 0
jne 0x10041214
mov ecx, 0x100690e8
call fcn.10036cd9
mov dword [0x10069750], ebx
xor eax, eax
lea ebx, [eax + 1]
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10064210
mov esp, ebp
pop ebp
ret 0xc