Function at 0x1000e6e0
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Parse pe header
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xeec
mov eax, dword [0x10029170]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0xcd0], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xcd4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0xcd8], eax
mov ebx, 0x100297c8
mov dword [ebp - 0xc18], 0x10
mov dword [ebp - 0xccc], 4
mov dword [ebp - 0xae8], edx
mov dword [ebp - 0xc58], edx
mov dword [ebp - 0xc10], edx
mov dword [ebp - 0xc54], edx
mov dword [ebp - 0xda4], edx
mov dword [ebp - 0xc2c], edx
mov dword [ebp - 0xa8c], edx
lea ecx, [edx + 1]
xor eax, eax
lock cmpxchg dword [ebx], ecx
test eax, eax
jne 0x1000e756
mov eax, dword [0x1002977c]
or ebx, 0xffffffff
mov dword [ebp - 0xbe4], ebx
mov dword [ebp - 0xb90], 0x67
mov dword [ebp - 0xba4], 0x10b
mov dword [ebp - 0xba8], 0x20b
push esi
push edi
mov edi, 0x10001bb2
mov dword [ebp - 0xb5c], edi
push 0
pop edx
test eax, eax
jne 0x1000ed92
push 0x338
mov esi, edx
mov dword [ebp - 0xa90], edx
push edx
mov dword [ebp - 0xa70], edx
mov dword [ebp - 0xaac], esi
mov dword [ebp - 0xb4c], edx
mov dword [ebp - 0xab4], edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov dword [ebp - 0xae0], eax
test eax, eax
je 0x1001524b
lea edx, [ebp - 0xb68]
mov dword [ebp - 0xbe8], ebx
mov dword [ebp - 0xe68], edx
xor ecx, ecx
lea edx, [ebp - 0xb2c]
mov dword [ebp - 0x414], 0xab69605e
mov dword [ebp - 0xe64], edx
xor edx, edx
mov esi, edx
mov dword [ebp - 0x410], 0x7f1137f
mov ebx, edx
mov dword [ebp - 0xabc], edx
add eax, 7
mov dword [ebp - 0xb2c], esi
mov dword [ebp - 0xb68], ebx
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xb48], edi
mov dword [ebp - 0xac8], 0x67
movzx edx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl edx, 8
or edx, eax
movzx eax, byte [edi]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl edx, 8
or edx, eax
shl edi, 8
mov eax, dword [ebp - 0xb48]
xor ebx, edx
mov dword [ebp - 0xc28], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb48]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb48]
shl edi, 8
add dword [ebp - 0xb48], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, ebx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub edx, eax
xor esi, edx
lea eax, [esi - 0x137f]
imul edx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xb20], esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea esi, [ebx - 0x7f1]
xor esi, dword [ebp - 0xb20]
xor esi, 0xab69605e
mov eax, esi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, esi
shr eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 7
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor ebx, edx
mov eax, ebx
mov dword [ebp - 0xb20], ebx
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 7
add edx, eax
xor esi, edx
mov ebx, esi
xor ebx, dword [ebp - 0xb20]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor esi, eax
lea eax, [esi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xe
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xbe8]
rol eax, 2
mov dword [ebp - 0xb2c], esi
mov dword [ebp - 0xbe8], edi
xor edx, eax
mov edi, dword [ebp - 0xb48]
xor edx, dword [ebp - 0xabc]
xor ebx, edx
mov edx, dword [ebp - 0xac4]
mov dword [ebp - 0xb68], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb2c]
ror dword [ebp - 0xb68], 8
mov byte [edx], al
mov al, byte [ebp - 0xb68]
ror dword [ebp - 0xb2c], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb2c]
ror dword [ebp - 0xb68], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb68]
ror dword [ebp - 0xb2c], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb2c]
ror dword [ebp - 0xb68], 8
mov byte [edx - 2], al
ror dword [ebp - 0xb2c], 8
mov al, byte [ebp - 0xb68]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb2c]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [ebp - 0xb68]
mov esi, dword [ebp - 0xb2c]
mov eax, dword [ebp - 0xc28]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xac8], 1
mov dword [ebp - 0xb68], ebx
mov dword [ebp - 0xb2c], esi
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xac4], edx
jne 0x1000e84d
mov esi, dword [ebp - 0xae0]
xor eax, eax
mov ebx, 0x338
xor cl, byte [eax + esi]
inc eax
cmp eax, ebx
jb 0x1000eba3
movzx eax, cl
cdq
cmp eax, dword [0x10001ee8]
jne 0x100151e4
cmp edx, dword [0x10001eec]
jne 0x100151e4
mov edi, esi
mov dword [ebp - 0xb4c], ebx
mov ebx, dword [ebp - 0xab4]
xor eax, eax
mov dword [ebp - 0xaac], edi
mov esi, eax
test esi, esi
jne 0x100151f6
test ebx, ebx
js 0x10015245
mov eax, dword [ebp - 0xb4c]
xor ecx, ecx
push 0x40
push ecx
mov ebx, 0x10029788
mov esi, edi
push ebx
mov byte [eax + edi - 1], cl
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
add esp, 0xc
cmp byte [edi], 0
je 0x1000ed64
push 4
pop edi
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xb20], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xae8]
jne 0x1000ec27
sub ecx, dword [ebp - 0xb20]
xor eax, eax
sar ecx, 1
push ebx
push edx
push eax
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0x1001523b
xor eax, eax
mov ecx, 0x5a4d
mov edx, eax
mov eax, dword [ebx]
mov dword [ebp - 0xa70], edx
cmp word [eax], cx
jne 0x1001520a
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0x1001520a
add ecx, dword [ebx]
cmp ecx, dword [ebx]
jb 0x1001520a
cmp dword [ecx], 0x4550
jne 0x1001520a
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xba4]
jne 0x10015221
mov eax, dword [ecx + 0x78]
mov dword [ebx + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [ebx + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [ebx + 4], eax
mov eax, dword [esi]
xor ecx, ecx
add esi, edi
mov dword [ebp - 0xa78], eax
mov dword [ebp - 0xabc], ecx
test eax, eax
je 0x1000ed58
mov ecx, esi
mov dword [ebp - 0xa80], esi
xor eax, eax
mov dword [ebp - 0xc94], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xb20], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000ecec
sub ecx, dword [ebp - 0xb20]
inc esi
add esi, ecx
test edx, edx
js 0x10015230
mov ecx, dword [ebp - 0xa80]
lea eax, [ebp - 0xc94]
push eax
push ebx
xor edx, edx
call fcn.10011a50
mov edx, eax
mov dword [ebp - 0xa70], edx
test edx, edx
js 0x1000ed64
mov eax, dword [ebp - 0xa90]
mov ecx, dword [ebp - 0xc94]
mov dword [eax*4 + section..data], ecx
inc eax
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0xabc]
inc eax
mov dword [ebp - 0xabc], eax
cmp eax, dword [ebp - 0xa78]
jb 0x1000ecd3
add ebx, 0x10
cmp byte [esi], 0
jne 0x1000ec1a
mov ebx, dword [ebp - 0xa70]
mov esi, dword [ebp - 0xaac]
test esi, esi
je 0x1000ed85
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test ebx, ebx
js 0x10015255
mov eax, dword [0x1002977c]
inc eax
mov dword [0x1002977c], eax
xor eax, eax
mov ecx, 0x100297c8
xchg dword [ecx], eax
mov eax, dword fs:[0x30]
xor ecx, ecx
mov dword [ebp - 0xab8], ecx
mov edi, ecx
mov dword [ebp - 0xad4], ecx
mov ebx, ecx
cmp dword [eax + 0x1d4], ecx
jne 0x10015296
mov eax, ecx
mov dword [ebp - 0xa8c], eax
test edi, edi
jne 0x10015516
mov eax, dword [ebp - 0xab8]
test eax, eax
jne 0x1001552c
test ebx, ebx
js 0x100152b8
xor ebx, ebx
push 4
pop esi
push esi
push 0x40
call dword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalAlloc]
mov dword [ebp - 0xb20], eax
test eax, eax
je 0x10015542
mov dword [ebp - 0xabc], eax
lea edi, [ebp - 0xbe0]
xor eax, eax
mov dword [ebp - 0xa68], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xa80], ebx
mov dword [ebp - 0xcb8], ebx
mov dword [ebp - 0xcb4], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xa7c], ebx
mov dword [ebp - 0xad4], ebx
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xb48], 0x38
mov dword [ebp - 0xa78], ebx
test ebx, ebx
je 0x1001555e
push edi
push 0x10029230
push ebx
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov edi, ebx
add esp, 0xc
mov dword [ebp - 0xa68], edi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xaa4], ecx
test ecx, ecx
je 0x10015568
mov eax, dword [0x10029228]
mov dword [ecx], eax
mov eax, dword [0x1002922c]
mov dword [ecx + 4], eax
mov dword [ebp - 0xa80], ecx
rdtsc
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xa74], edx
xor eax, eax
mov edx, esi
mov dword [ebp - 0xa88], eax
mov ecx, esi
lea eax, [ebp - 0xd44]
push eax
call fcn.1000e6b4
mov edi, dword [ebp - 0xd44]
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015572
lea eax, [ebp - 0xa88]
mov edx, edi
push eax
xor ecx, ecx
call fcn.1000e6b4
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa64], ebx
jl 0x10015d76
lea eax, [ebp - 0xd40]
mov edx, 0xa0
push eax
mov ecx, esi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d76
mov edi, dword [ebp - 0xd40]
mov ecx, dword [ebp - 0xa88]
lea eax, [ebp - 0xa88]
push eax
mov edx, edi
call fcn.1000e6b4
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa64], ebx
jl 0x10015d76
lea eax, [ebp - 0xd3c]
mov ecx, esi
push eax
push 8
pop edx
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d76
mov edi, dword [ebp - 0xd3c]
mov ecx, dword [ebp - 0xa88]
lea eax, [ebp - 0xa88]
push eax
mov edx, edi
call fcn.1000e6b4
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa64], ebx
jl 0x10015d76
lea eax, [ebp - 0xd38]
mov ecx, esi
push eax
push 8
pop edx
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d76
mov edi, dword [ebp - 0xd38]
mov ecx, dword [ebp - 0xa88]
lea eax, [ebp - 0xa88]
push eax
mov edx, edi
call fcn.1000e6b4
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa64], ebx
jl 0x10015d76
lea eax, [ebp - 0xc70]
mov edx, 0x7fffffff
push eax
mov ecx, 0x10001b48
call fcn.1000e646
test eax, eax
js 0x1001557d
mov edx, dword [ebp - 0xc70]
lea eax, [ebp - 0xd34]
inc edx
mov ecx, esi
mov dword [ebp - 0xc70], edx
add edx, edx
push eax
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d76
mov edi, dword [ebp - 0xd34]
mov ecx, dword [ebp - 0xa88]
lea eax, [ebp - 0xa88]
push eax
mov edx, edi
call fcn.1000e6b4
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa64], ebx
jl 0x10015d76
lea eax, [ebp - 0xd2c]
mov edx, esi
push eax
mov ecx, esi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d76
mov edi, dword [ebp - 0xd2c]
mov ecx, dword [ebp - 0xa88]
lea eax, [ebp - 0xa88]
push eax
mov edx, edi
call fcn.1000e6b4
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa64], ebx
jl 0x10015d76
lea eax, [ebp - 0xd0c]
mov edx, esi
push eax
mov ecx, esi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d76
mov edi, dword [ebp - 0xd0c]
mov ecx, dword [ebp - 0xa88]
lea eax, [ebp - 0xa88]
push eax
mov edx, edi
call fcn.1000e6b4
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa64], ebx
jl 0x10015d76
push dword [ebp - 0xa88]
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xa70], edi
test edi, edi
je 0x1001555e
mov dword [ebp - 0xcb4], edi
xor eax, eax
mov dword [ebp - 0xa6c], eax
mov dword [ebp - 0xe44], eax
mov dword [ebp - 0xbf0], edi
lea eax, [ebp - 0xdf4]
mov dword [ebp - 0xdf8], esi
push eax
mov edx, esi
mov ecx, edi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015591
mov ecx, dword [ebp - 0xa88]
lea eax, [edi + 8]
add ecx, edi
cmp eax, ecx
ja 0x10015587
mov eax, dword [ebp - 0xdf4]
xor ecx, ecx
mov dword [edi], esi
mov dword [eax], ecx
xor eax, eax
inc eax
mov dword [ebp - 0xa6c], eax
test ebx, ebx
js 0x10015d76
mov dword [ebp - 0xc30], edi
mov dword [ebp - 0xa94], ecx
test eax, eax
je 0x1000f230
mov edx, dword [edi]
lea eax, [ebp - 0xd08]
push eax
mov ecx, esi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x1001559e
mov eax, dword [ebp - 0xd08]
mov dword [ebp - 0xd04], eax
test ebx, ebx
js 0x100155a9
lea ecx, [ebp - 0xc30]
mov edx, eax
push ecx
mov ecx, edi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x100155a9
mov eax, dword [ebp - 0xa94]
mov edi, dword [ebp - 0xc30]
inc eax
mov dword [ebp - 0xa94], eax
cmp eax, dword [ebp - 0xa6c]
jb 0x1000f1c1
lea eax, [ebp - 0xdc4]
mov dword [ebp - 0xdc8], 0xa0
push eax
mov edx, esi
mov ecx, edi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x100155a9
mov ecx, dword [ebp - 0xa88]
lea eax, [edi + 0xa4]
add ecx, dword [ebp - 0xa70]
cmp eax, ecx
ja 0x10015587
mov eax, 0xa0
push eax
push dword [ebp - 0xa78]
mov dword [edi], eax
push dword [ebp - 0xdc4]
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xa6c]
add esp, 0xc
inc eax
mov dword [ebp - 0xa6c], eax
test ebx, ebx
js 0x10015d76
mov edi, dword [ebp - 0xa70]
xor ecx, ecx
mov dword [ebp - 0xc34], edi
mov dword [ebp - 0xa94], ecx
test eax, eax
je 0x1000f32c
mov edx, dword [edi]
lea eax, [ebp - 0xd48]
push eax
mov ecx, esi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x100155b4
mov eax, dword [ebp - 0xd48]
mov dword [ebp - 0xcfc], eax
test ebx, ebx
js 0x100155bf
lea ecx, [ebp - 0xc34]
mov edx, eax
push ecx
mov ecx, edi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x100155bf
mov eax, dword [ebp - 0xa94]
mov edi, dword [ebp - 0xc34]
inc eax
mov dword [ebp - 0xa94], eax
cmp eax, dword [ebp - 0xa6c]
jb 0x1000f2bd
lea eax, [ebp - 0xdcc]
mov dword [ebp - 0xdd0], 8
push eax
mov edx, esi
mov ecx, edi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x100155bf
mov ecx, dword [ebp - 0xa88]
lea eax, [edi + 0xc]
add ecx, dword [ebp - 0xa70]
cmp eax, ecx
ja 0x10015587
mov edx, dword [ebp - 0xaa4]
mov ecx, dword [ebp - 0xdcc]
mov dword [edi], 8
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xa6c]
inc eax
mov dword [ebp - 0xa6c], eax
test ebx, ebx
js 0x10015d76
mov ecx, dword [ebp - 0xab0]
mov edi, dword [ebp - 0xa70]
mov dword [ebp - 0xe70], ecx
mov ecx, dword [ebp - 0xa74]
mov dword [ebp - 0xe6c], ecx
xor ecx, ecx
mov dword [ebp - 0xc38], edi
mov dword [ebp - 0xa94], ecx
test eax, eax
je 0x1000f43d
mov edx, dword [edi]
lea eax, [ebp - 0xcf8]
push eax
mov ecx, esi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x100155ca
mov eax, dword [ebp - 0xcf8]
mov dword [ebp - 0xcf4], eax
test ebx, ebx
js 0x10015d76
lea ecx, [ebp - 0xc38]
mov edx, eax
push ecx
mov ecx, edi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d76
mov eax, dword [ebp - 0xa94]
mov edi, dword [ebp - 0xc38]
inc eax
mov dword [ebp - 0xa94], eax
cmp eax, dword [ebp - 0xa6c]
jb 0x1000f3ce
lea eax, [ebp - 0xddc]
mov dword [ebp - 0xde0], 8
push eax
mov edx, esi
mov ecx, edi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d76
mov ecx, dword [ebp - 0xa88]
lea eax, [edi + 0xc]
add ecx, dword [ebp - 0xa70]
cmp eax, ecx
ja 0x10015587
mov eax, dword [ebp - 0xddc]
mov ecx, dword [ebp - 0xab0]
inc dword [ebp - 0xa6c]
mov dword [edi], 8
mov dword [eax], ecx
mov ecx, dword [ebp - 0xa74]
mov dword [eax + 4], ecx
test ebx, ebx
js 0x10015d76
lea eax, [ebp - 0xc3c]
mov edx, 0x7fffffff
push eax
mov ecx, 0x10001b48
call fcn.1000e646
test eax, eax
js 0x1001557d
mov ecx, dword [ebp - 0xc3c]
lea eax, [ebp - 0xc3c]
push eax
xor eax, eax
lea edx, [eax + 1]
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d76
mov eax, dword [ebp - 0xc3c]
add eax, eax
mov dword [ebp - 0xb44], eax
je 0x100155e7
mov edi, dword [ebp - 0xa70]
xor ecx, ecx
mov dword [ebp - 0xc48], edi
mov dword [ebp - 0xa94], ecx
cmp dword [ebp - 0xa6c], ecx
jbe 0x1000f593
mov edx, dword [edi]
lea eax, [ebp - 0xce0]
push eax
mov ecx, esi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x100155d5
mov eax, dword [ebp - 0xce0]
mov dword [ebp - 0xd5c], eax
test ebx, ebx
js 0x10015d76
lea ecx, [ebp - 0xc48]
mov edx, eax
push ecx
mov ecx, edi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d76
mov eax, dword [ebp - 0xa94]
mov edi, dword [ebp - 0xc48]
inc eax
mov dword [ebp - 0xa94], eax
cmp eax, dword [ebp - 0xa6c]
jb 0x1000f51e
mov eax, dword [ebp - 0xb44]
mov dword [ebp - 0xde8], eax
mov edx, esi
lea eax, [ebp - 0xde4]
mov ecx, edi
push eax
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d76
mov edx, dword [ebp - 0xb44]
mov ecx, dword [ebp - 0xa88]
add ecx, dword [ebp - 0xa70]
lea eax, [edx + 4]
add eax, edi
cmp eax, ecx
ja 0x100155e0
push edx
push 0x10001b48
push dword [ebp - 0xde4]
mov dword [edi], edx
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
add esp, 0xc
inc dword [ebp - 0xa6c]
test ebx, ebx
js 0x10015d76
mov eax, dword [ebp - 0xa8c]
mov edi, dword [ebp - 0xa70]
mov dword [ebp - 0xe4c], eax
xor eax, eax
mov dword [ebp - 0xc40], edi
mov dword [ebp - 0xa94], eax
cmp dword [ebp - 0xa6c], eax
jbe 0x1000f693
mov edx, dword [edi]
lea eax, [ebp - 0xd50]
push eax
mov ecx, esi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x100155f7
mov eax, dword [ebp - 0xd50]
mov dword [ebp - 0xd24], eax
test ebx, ebx
js 0x10015602
lea ecx, [ebp - 0xc40]
mov edx, eax
push ecx
mov ecx, edi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015602
mov eax, dword [ebp - 0xa94]
mov edi, dword [ebp - 0xc40]
inc eax
mov dword [ebp - 0xa94], eax
cmp eax, dword [ebp - 0xa6c]
jb 0x1000f624
lea eax, [ebp - 0xdec]
mov dword [ebp - 0xdf0], esi
push eax
mov edx, esi
mov ecx, edi
call fcn.1000e6b4
mov edx, dword [ebp - 0xa70]
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015608
mov ecx, dword [ebp - 0xa88]
lea eax, [edi + 8]
add ecx, edx
cmp eax, ecx
ja 0x10015587
mov eax, dword [ebp - 0xdec]
mov ecx, dword [ebp - 0xa8c]
mov dword [edi], esi
mov dword [eax], ecx
mov eax, dword [ebp - 0xa6c]
inc eax
mov dword [ebp - 0xa6c], eax
test ebx, ebx
js 0x10015d76
xor ecx, ecx
mov dword [ebp - 0xe50], esi
mov dword [ebp - 0xa94], ecx
mov edi, edx
mov dword [ebp - 0xc44], edi
test eax, eax
je 0x1000f780
mov edx, dword [edi]
lea eax, [ebp - 0xd30]
push eax
mov ecx, esi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015613
mov eax, dword [ebp - 0xd30]
mov dword [ebp - 0xcdc], eax
test ebx, ebx
js 0x10015d76
lea ecx, [ebp - 0xc44]
mov edx, eax
push ecx
mov ecx, edi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d76
mov eax, dword [ebp - 0xa94]
mov edi, dword [ebp - 0xc44]
inc eax
mov dword [ebp - 0xa94], eax
cmp eax, dword [ebp - 0xa6c]
jb 0x1000f711
lea eax, [ebp - 0xdd4]
mov dword [ebp - 0xdd8], esi
push eax
mov edx, esi
mov ecx, edi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d76
mov ecx, dword [ebp - 0xa88]
lea eax, [edi + 8]
add ecx, dword [ebp - 0xa70]
cmp eax, ecx
ja 0x10015587
mov eax, dword [ebp - 0xdd4]
inc dword [ebp - 0xa6c]
mov dword [edi], esi
mov dword [eax], esi
test ebx, ebx
js 0x10015d76
lea eax, [ebp - 0xd00]
mov edx, esi
push eax
mov ecx, esi
call fcn.1000e6b4
mov edi, dword [ebp - 0xd00]
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x1001561e
lea eax, [ebp - 0xd10]
mov dword [ebp - 0xb84], edi
push eax
push 8
pop edx
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015624
mov edi, dword [ebp - 0xd10]
mov ecx, dword [ebp - 0xb84]
lea eax, [ebp - 0xb84]
push eax
mov edx, edi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015624
lea eax, [ebp - 0xd14]
mov edx, esi
push eax
mov ecx, esi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015624
mov edi, dword [ebp - 0xd14]
mov ecx, dword [ebp - 0xb84]
lea eax, [ebp - 0xb84]
push eax
mov edx, edi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015624
lea eax, [ebp - 0xd18]
mov edx, esi
push eax
mov ecx, esi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015624
mov edi, dword [ebp - 0xd18]
mov ecx, dword [ebp - 0xb84]
lea eax, [ebp - 0xb84]
push eax
mov edx, edi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015624
lea eax, [ebp - 0xd1c]
mov edx, esi
push eax
mov ecx, esi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015624
mov edi, dword [ebp - 0xd1c]
mov ecx, dword [ebp - 0xb84]
lea eax, [ebp - 0xb84]
push eax
mov edx, edi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015624
lea eax, [ebp - 0xd20]
mov edx, esi
push eax
mov ecx, esi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015624
mov edi, dword [ebp - 0xd20]
mov ecx, dword [ebp - 0xb84]
lea eax, [ebp - 0xb84]
push eax
mov edx, edi
call fcn.1000e6b4
mov ebx, eax
mov eax, dword [ebp - 0xb84]
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015624
mov dword [ebp - 0xaa4], eax
test ebx, ebx
js 0x10015d76
xor ecx, ecx
rdtsc
mov edi, ecx
mov dword [ebp - 0xae4], ecx
mov dword [ebp - 0xad0], edi
mov dword [ebp - 0xaac], ecx
mov dword [ebp - 0xb44], ecx
mov dword [ebp - 0xa78], ecx
mov dword [ebp - 0xa90], ecx
mov dword [ebp - 0xa98], ecx
mov dword [ebp - 0xa94], ecx
mov dword [ebp - 0xa84], ecx
mov dword [ebp - 0xab8], ecx
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0xaf0], edx
push 8
pop ecx
mov dword [ebp - 0xc4c], ecx
mov edx, dword [ebp - 0xa88]
lea eax, [ebp - 0xc4c]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1000fad9
mov eax, dword [ebp - 0xc4c]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0xad8], ecx
cmp ecx, eax
jb 0x1001562f
mov dword [ebp - 0xc4c], ecx
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x10015639
mov eax, dword [ebp - 0xa6c]
mov edx, esi
mov dword [edi], eax
mov ecx, edi
lea eax, [ebp - 0xc20]
mov dword [ebp - 0xc20], edi
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x10015643
mov ecx, dword [ebp - 0xc20]
mov edx, esi
mov eax, dword [ebp - 0xa88]
mov dword [ecx], eax
lea eax, [ebp - 0xc20]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x10015643
mov eax, dword [ebp - 0xad8]
push dword [ebp - 0xa88]
mov ecx, dword [ebp - 0xaa0]
push dword [ebp - 0xa70]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0xaf0]
push dword [ebp - 0xc20]
mov dword [edi + eax - 4], ecx
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xad8]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xae4], edi
mov edi, ecx
mov dword [ebp - 0xad0], eax
test edi, edi
jne 0x1001564a
mov edi, dword [ebp - 0xad0]
or ebx, 0x10000000
mov dword [ebp - 0xa64], ebx
jl 0x10011197
mov ebx, dword [ebp - 0xae4]
xor ecx, ecx
mov dword [ebp - 0xaf0], ecx
test ebx, ebx
je 0x1001565e
test edi, edi
je 0x10015882
lea eax, [edi + 8]
push eax
push ecx
mov dword [ebp - 0xacc], eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov dword [ebp - 0xad8], eax
test eax, eax
je 0x10015882
xor ecx, ecx
mov dl, cl
test edi, edi
je 0x1000fb3f
xor dl, byte [ebx + ecx]
inc ecx
cmp ecx, edi
jb 0x1000fb37
lea ecx, [ebp - 0xb18]
mov dword [ebp - 0xa64], eax
mov dword [ebp - 0xe78], ecx
xor eax, eax
lea ecx, [ebp - 0xaf8]
mov dword [ebp - 0xaa8], ebx
or ebx, 0xffffffff
mov dword [ebp - 0xe74], ecx
mov ecx, eax
mov dword [ebp - 0x408], 0xb1b54a58
and edi, 7
mov dword [ebp - 0x404], 0xc81ecb17
mov dword [ebp - 0xb18], ecx
mov dword [ebp - 0xaf8], ebx
mov dword [ebp - 0xb00], eax
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0xaa0], edi
jne 0x10015668
mov eax, dword [ebp - 0xad0]
shr eax, 3
mov dword [ebp - 0xaa0], eax
test eax, eax
je 0x1000ffa0
mov eax, dword [ebp - 0xa64]
mov esi, dword [ebp - 0xaa8]
add eax, 7
add esi, 2
mov dword [ebp - 0xb28], eax
mov dword [ebp - 0xac0], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xac0]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xac0]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xac0]
shl esi, 8
add dword [ebp - 0xac0], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov dword [ebp - 0xa64], ebx
add ebx, 0xffffb5a8
xor ebx, edi
xor ebx, ecx
mov ecx, 0xc81ecb17
xor ebx, ecx
mov eax, ebx
xor eax, ecx
ror eax, 0xf
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 7
add ecx, eax
mov eax, dword [ebp - 0xa64]
xor eax, ecx
mov dword [ebp - 0xa64], eax
add eax, 0xb1b54a58
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa64]
ror eax, 0xa
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0xcb17
rol eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
rol eax, 5
add ecx, eax
mov eax, dword [ebp - 0xa64]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xa64], eax
xor ecx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, ecx
xor ebx, eax
lea eax, [ebx - 0x4a58]
imul ecx, eax, 0xb1b5
mov eax, ebx
shr eax, 6
sub ecx, eax
xor dword [ebp - 0xa64], ecx
mov ecx, dword [ebp - 0xa64]
mov eax, ecx
ror eax, 0xf
xor eax, 0xcb17
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, 0xc81e
imul eax, eax, 0xcb17
xor ecx, eax
lea eax, [ecx + 0x37e0ea91]
mov dword [ebp - 0xa64], ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0xc81e
ror ecx, 0xa
imul eax, eax, 0xb1b5
xor ecx, eax
mov eax, dword [ebp - 0xa64]
xor eax, ecx
mov dword [ebp - 0xa64], eax
xor eax, 0x4a58
rol eax, 6
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa64]
ror eax, 3
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa64]
mov eax, ebx
ror eax, 0xf
sub eax, 0xc81e
imul eax, eax, 0x4a58
xor ecx, eax
mov dword [ebp - 0xa64], ecx
xor ecx, 0xc81e
mov eax, dword [ebp - 0xa64]
shr eax, 1
imul ecx, ecx, 0x4a58
xor ecx, eax
mov eax, dword [ebp - 0xa64]
add eax, 0xffff34e9
xor ebx, ecx
rol eax, 3
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xa64]
shr eax, 0xf
xor ecx, eax
xor ebx, ecx
lea eax, [ebx - 0xcb17]
imul ecx, eax, 0xb1b5
mov eax, ebx
shr eax, 0xd
sub ecx, eax
mov eax, 0xb1b54a58
xor dword [ebp - 0xa64], ecx
sub eax, dword [ebp - 0xa64]
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa64]
ror eax, 0xb
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa64]
lea eax, [ebx + 0x4e49ed8a]
xor ecx, eax
mov dword [ebp - 0xa64], ecx
mov eax, dword [ebp - 0xa64]
xor eax, 0xb1b5
ror ecx, 7
imul eax, eax, 0x4a58
sub eax, ecx
xor ebx, eax
mov eax, ebx
xor eax, 0xc81e
rol eax, 4
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0x10
sub ecx, eax
mov eax, 0xb1b54a58
xor dword [ebp - 0xa64], ecx
sub eax, dword [ebp - 0xa64]
ror eax, 0xa
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa64]
ror eax, 4
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x4e4ab5a8]
ror eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
ror eax, 9
xor ecx, eax
mov eax, dword [ebp - 0xa64]
xor eax, ecx
mov dword [ebp - 0xa64], eax
xor eax, 0xc81ecb17
rol eax, 8
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xa64]
rol eax, 2
sub ecx, eax
mov eax, 0xc81ecb17
xor ebx, ecx
sub eax, ebx
ror eax, 0xb
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0xc
sub ecx, eax
mov eax, dword [ebp - 0xa64]
xor eax, ecx
mov dword [ebp - 0xa64], eax
xor eax, 0xb1b5
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa64]
shr eax, 8
xor ecx, eax
mov eax, dword [ebp - 0xa64]
xor ebx, ecx
mov ecx, dword [ebp - 0xb28]
xor eax, ebx
add dword [ebp - 0xb28], 8
xor ebx, dword [ebp - 0xadc]
xor eax, 0x79ab814f
xor eax, dword [ebp - 0xb00]
mov dword [ebp - 0xaf8], eax
mov dword [ebp - 0xb18], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xaf8]
ror dword [ebp - 0xb18], 8
mov byte [ecx], al
ror dword [ebp - 0xaf8], 8
mov al, byte [ebp - 0xb18]
mov byte [ecx - 5], al
mov al, byte [ebp - 0xaf8]
ror dword [ebp - 0xb18], 8
mov byte [ecx - 1], al
ror dword [ebp - 0xaf8], 8
mov al, byte [ebp - 0xb18]
mov byte [ecx - 6], al
ror dword [ebp - 0xb18], 8
mov al, byte [ebp - 0xaf8]
mov byte [ecx - 2], al
ror dword [ebp - 0xaf8], 8
mov al, byte [ebp - 0xb18]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xaf8]
mov byte [ecx - 3], al
mov ecx, dword [ebp - 0xb18]
mov ebx, dword [ebp - 0xaf8]
ror ecx, 8
ror ebx, 8
sub dword [ebp - 0xaa0], 1
mov dword [ebp - 0xb00], esi
mov esi, dword [ebp - 0xac0]
mov dword [ebp - 0xb18], ecx
mov dword [ebp - 0xaf8], ebx
mov dword [ebp - 0xadc], edi
jne 0x1000fbda
push 4
pop esi
mov ecx, dword [ebp - 0xad0]
mov ebx, dword [ebp - 0xad8]
movzx eax, dl
cdq
mov dword [ebx + ecx], eax
mov dword [ebx + ecx + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x10015784
mov ebx, dword [ebp - 0xacc]
push ebx
push 8
mov dword [edi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
test eax, eax
je 0x1001578e
mov dword [edi + 4], eax
push ebx
push dword [ebp - 0xad8]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
pop ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
test eax, eax
je 0x1001578e
mov dword [edi + 0xc], eax
push 0xa0
push 0x10029180
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
add esp, 0xc
mov dword [edi + 0x10], ebx
push ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
je 0x1001579a
mov dword [edi + 0x14], ecx
mov ebx, edx
mov eax, dword [0x10029220]
mov dword [ecx], eax
mov eax, dword [0x10029224]
mov dword [ebp - 0xaf0], edi
mov edi, edx
mov dword [ecx + 4], eax
test edi, edi
jne 0x100157a4
test ebx, ebx
js 0x1001580c
mov eax, dword [ebp - 0xaf0]
mov dword [ebp - 0xaac], eax
xor eax, eax
mov edi, eax
push dword [ebp - 0xad8]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test edi, edi
jne 0x10015819
or ebx, 0x10000000
mov dword [ebp - 0xa64], ebx
jl 0x10011197
mov edi, dword [ebp - 0xaac]
lea eax, [ebp - 0xb9c]
push eax
mov ecx, esi
mov dword [ebp - 0xb9c], esi
mov edx, dword [edi]
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001588c
mov ecx, dword [ebp - 0xb9c]
lea eax, [ebp - 0xb9c]
push eax
mov edx, esi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001588c
mov edx, dword [edi + 8]
lea eax, [ebp - 0xb9c]
mov ecx, dword [ebp - 0xb9c]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001588c
mov ecx, dword [ebp - 0xb9c]
lea eax, [ebp - 0xb9c]
push eax
mov edx, esi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001588c
mov edx, dword [edi + 0x10]
lea eax, [ebp - 0xb9c]
mov ecx, dword [ebp - 0xb9c]
push eax
call fcn.1000e6b4
mov ebx, eax
mov eax, dword [ebp - 0xb9c]
test ebx, ebx
js 0x1001588c
mov dword [ebp - 0xaa0], eax
test ebx, ebx
js 0x100102d2
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x10015897
mov eax, dword [ebp - 0xaac]
mov edx, esi
mov ecx, edi
mov dword [ebp - 0xb30], edi
mov eax, dword [eax]
mov dword [edi], eax
lea eax, [ebp - 0xb30]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x100158a1
mov ebx, dword [ebp - 0xaac]
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0xb30]
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov edx, dword [ebx]
lea eax, [ebp - 0xb30]
mov ecx, dword [ebp - 0xb30]
add esp, 0xc
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x100158a1
mov eax, dword [ebp - 0xaac]
mov edx, esi
mov ecx, dword [ebp - 0xb30]
mov eax, dword [eax + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xb30]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x100158a1
mov ebx, dword [ebp - 0xaac]
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0xb30]
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xb30]
mov ecx, dword [ebp - 0xb30]
add esp, 0xc
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x100158a1
mov eax, dword [ebp - 0xaac]
mov edx, esi
mov ecx, dword [ebp - 0xb30]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xb30]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x100158a1
mov ebx, dword [ebp - 0xaac]
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0xb30]
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xb30]
mov ecx, dword [ebp - 0xb30]
add esp, 0xc
push eax
call fcn.1000e6b4
mov ebx, eax
xor ecx, ecx
test ebx, ebx
js 0x100102ca
mov eax, dword [ebp - 0xaa0]
mov dword [ebp - 0xb44], edi
mov edi, ecx
mov dword [ebp - 0xa78], eax
test edi, edi
jne 0x100158a8
or ebx, 0x10000000
mov dword [ebp - 0xa64], ebx
jl 0x10011197
xor eax, eax
mov dword [ebp - 0xc6c], 8
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0xaf0], eax
mov edx, dword [ebp - 0xaa4]
lea eax, [ebp - 0xc6c]
push eax
push 8
pop ecx
call fcn.1000e6b4
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa64], ebx
jl 0x100158dd
mov eax, dword [ebp - 0xc6c]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jb 0x100158bc
mov dword [ebp - 0xc68], ecx
lea eax, [ebp - 0xc68]
push eax
push 8
pop edx
call fcn.1000e6b4
mov ebx, eax
mov eax, dword [ebp - 0xc68]
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x100158c7
mov dword [ebp - 0xad8], eax
test ebx, ebx
js 0x100158dd
mov edi, dword [ebp - 0xa6c]
xor eax, eax
inc eax
cmp edi, eax
jbe 0x100158d2
mov ecx, dword [ebp - 0xa70]
xor eax, eax
mov dword [ebp - 0xbb8], ecx
mov dword [ebp - 0xaa4], eax
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0xacc], eax
lea eax, [ebp - 0xbb8]
push eax
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x100158dd
mov edx, dword [ebp - 0xacc]
lea eax, [ebp - 0xbb8]
mov ecx, dword [ebp - 0xbb8]
push eax
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x100158dd
mov eax, dword [ebp - 0xaa4]
mov ecx, dword [ebp - 0xbb8]
inc eax
mov dword [ebp - 0xaa4], eax
cmp eax, 1
jb 0x10010397
mov edi, dword [ecx]
lea eax, [ebp - 0xbb8]
push eax
mov edx, esi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10010429
mov dword [ebp - 0xaa0], edi
neg edi
sbb edi, edi
and dword [ebp - 0xbb8], edi
mov edi, dword [ebp - 0xa6c]
test ebx, ebx
js 0x100158dd
cmp edi, 2
jbe 0x100158d2
mov ecx, dword [ebp - 0xa70]
xor eax, eax
mov dword [ebp - 0xbbc], ecx
mov edi, eax
lea eax, [ebp - 0xbbc]
mov edx, esi
push eax
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x100158dd
mov edx, dword [ecx]
lea eax, [ebp - 0xbbc]
mov ecx, dword [ebp - 0xbbc]
push eax
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x100158dd
mov ecx, dword [ebp - 0xbbc]
inc edi
cmp edi, 2
jb 0x10010450
mov edi, dword [ecx]
lea eax, [ebp - 0xbbc]
push eax
mov edx, esi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x100158dd
mov dword [ebp - 0xaf0], edi
neg edi
sbb edi, edi
and dword [ebp - 0xbbc], edi
test ebx, ebx
js 0x100158dd
mov edx, dword [ebp - 0xad8]
lea eax, [ebp - 0xb94]
push eax
mov ecx, esi
mov dword [ebp - 0xb94], esi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x100158e8
mov ecx, dword [ebp - 0xb94]
lea eax, [ebp - 0xb94]
push eax
mov edx, esi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x100158e8
mov edx, dword [ebp - 0xaa0]
lea eax, [ebp - 0xb94]
mov ecx, dword [ebp - 0xb94]
push eax
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x100158e8
mov ecx, dword [ebp - 0xb94]
lea eax, [ebp - 0xb94]
push eax
mov edx, esi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x100158e8
mov edx, dword [ebp - 0xaf0]
lea eax, [ebp - 0xb94]
mov ecx, dword [ebp - 0xb94]
push eax
call fcn.1000e6b4
mov ebx, eax
mov eax, dword [ebp - 0xb94]
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x100158e8
cmp eax, 0x400000
ja 0x100158f7
mov edi, eax
mov dword [ebp - 0xa98], edi
test ebx, ebx
js 0x10011197
push edi
xor eax, eax
push 8
mov ebx, eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
test eax, eax
je 0x10015901
mov ecx, eax
mov dword [ebp - 0xa90], eax
or ebx, 0x10000000
mov dword [ebp - 0xa64], ebx
jl 0x10011197
mov eax, dword [ebp - 0xb44]
test eax, eax
je 0x10015911
test ecx, ecx
je 0x10015911
mov dword [ebp - 0xe0c], eax
xor ebx, ebx
mov eax, dword [ebp - 0xa78]
mov dword [ebp - 0xe04], eax
lea eax, [ebp - 0xd4c]
push eax
xor eax, eax
mov dword [ebp - 0xe08], ecx
push 0x10001b18
inc eax
mov dword [ebp - 0xe00], edi
push eax
mov dword [ebp - 0xdfc], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0x1001591b
push 0x10001b2c
push dword [ebp - 0xd4c]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1001591b
push ebx
push 0x14
lea eax, [ebp - 0xe0c]
mov ecx, edi
push eax
push 0x86
call dword [0x1002a1c8]
call edi
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa64], ebx
jl 0x1001595a
mov eax, dword [ebp - 0xe00]
mov dword [ebp - 0xa98], eax
cmp ebx, 0xd0000023
je 0x10015965
test ebx, ebx
js 0x10011197
mov ecx, dword [ebp - 0xa90]
xor edx, edx
mov dword [ebp - 0xb04], edx
mov edi, edx
mov dword [ebp - 0xb80], ecx
cmp eax, esi
jb 0x1001596f
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0xaa8], eax
lea eax, [ebp - 0xb80]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x10015a87
lea eax, [ebp - 0xb04]
mov edx, esi
push eax
xor ecx, ecx
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x10015a87
mov eax, dword [ebp - 0xa98]
sub eax, dword [ebp - 0xb04]
mov ecx, dword [ebp - 0xaa8]
cmp eax, ecx
jb 0x10015979
mov eax, dword [ebp - 0xb80]
lea edx, [ebp - 0xb80]
push edx
mov edx, ecx
mov dword [ebp - 0xa78], eax
mov ecx, eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x10015a87
mov edx, dword [ebp - 0xaa8]
lea eax, [ebp - 0xb04]
mov ecx, dword [ebp - 0xb04]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x10015a87
mov eax, dword [ebp - 0xa98]
sub eax, dword [ebp - 0xb04]
cmp eax, esi
jb 0x10015979
mov ecx, dword [ebp - 0xb80]
mov edx, esi
mov eax, dword [ecx]
mov dword [ebp - 0xad0], eax
lea eax, [ebp - 0xb80]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x10015a87
mov ecx, dword [ebp - 0xb04]
lea eax, [ebp - 0xb04]
push eax
mov edx, esi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x10015a87
mov eax, dword [ebp - 0xa98]
sub eax, dword [ebp - 0xb04]
mov ecx, dword [ebp - 0xad0]
cmp eax, ecx
jb 0x10015979
mov eax, dword [ebp - 0xb80]
lea edx, [ebp - 0xb80]
push edx
mov edx, ecx
mov dword [ebp - 0xaa4], eax
mov ecx, eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x10015a87
mov edx, dword [ebp - 0xad0]
lea eax, [ebp - 0xb04]
mov ecx, dword [ebp - 0xb04]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x10015a87
mov eax, dword [ebp - 0xa98]
sub eax, dword [ebp - 0xb04]
cmp eax, esi
jb 0x10015979
mov ecx, dword [ebp - 0xb80]
mov edx, esi
mov eax, dword [ecx]
mov dword [ebp - 0xac0], eax
lea eax, [ebp - 0xb80]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x10015a87
mov ecx, dword [ebp - 0xb04]
lea eax, [ebp - 0xb04]
push eax
mov edx, esi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x10015a87
mov eax, dword [ebp - 0xa98]
sub eax, dword [ebp - 0xb04]
mov ecx, dword [ebp - 0xac0]
cmp eax, ecx
jb 0x10015979
lea eax, [ebp - 0xb04]
mov edx, ecx
mov ecx, dword [ebp - 0xb04]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x10015a87
mov edx, dword [ebp - 0xa98]
mov eax, edx
sub eax, dword [ebp - 0xb04]
jne 0x10015979
mov eax, dword [ebp - 0xad0]
mov ecx, dword [ebp - 0xaa8]
add eax, dword [ebp - 0xac0]
add ecx, 0xc
add eax, ecx
cmp eax, edx
jne 0x10015979
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10015983
xor eax, eax
mov ebx, eax
cmp dword [ebp - 0xa78], eax
je 0x10015999
mov eax, dword [ebp - 0xaa8]
push eax
push 8
mov dword [esi], eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
test eax, eax
je 0x1001598d
mov dword [esi + 4], eax
push dword [ebp - 0xaa8]
xor ecx, ecx
push dword [ebp - 0xa78]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
cmp dword [ebp - 0xaa4], edi
je 0x100159a3
mov eax, dword [ebp - 0xad0]
push eax
push 8
mov dword [esi + 8], eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
test eax, eax
je 0x1001598d
mov dword [esi + 0xc], eax
push dword [ebp - 0xad0]
xor ecx, ecx
push dword [ebp - 0xaa4]
mov ebx, ecx
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
cmp dword [ebp - 0xb80], edi
je 0x100159ae
mov eax, dword [ebp - 0xac0]
push eax
push 8
mov dword [esi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
test eax, eax
je 0x1001598d
mov dword [esi + 0x14], eax
xor ecx, ecx
mov ebx, ecx
mov ecx, dword [ebp - 0xac0]
push ecx
push dword [ebp - 0xb80]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
mov edi, esi
mov esi, eax
test esi, esi
jne 0x100159b9
xor edx, edx
test ebx, ebx
js 0x10010a00
mov dword [ebp - 0xa94], edi
mov edi, edx
test edi, edi
jne 0x10015a21
push 4
pop esi
or ebx, 0x10000000
mov dword [ebp - 0xa64], ebx
jl 0x10011197
mov ecx, dword [ebp - 0xa94]
mov ebx, edx
mov dword [ebp - 0xaf0], edx
mov dword [ebp - 0xa6c], edx
mov dword [ebp - 0xa64], ebx
test ecx, ecx
je 0x10015a8e
mov eax, dword [ecx + 4]
mov dword [ebp - 0xa98], eax
test eax, eax
je 0x10015a8e
mov eax, dword [ecx]
mov dword [ebp - 0xaa0], eax
test eax, eax
je 0x10015a8e
lea edi, [eax - 8]
mov dword [ebp - 0xa9c], edx
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov dword [ebp - 0xb28], eax
test eax, eax
je 0x10015c09
xor ecx, ecx
mov dword [ebp - 0x3fc], 0xab69605e
mov dword [ebp - 0x3f8], 0x7f1137f
mov dl, cl
mov dword [ebp - 0xad8], eax
lea ecx, [ebp - 0xb08]
mov dword [ebp - 0xe80], ecx
lea ecx, [ebp - 0xaec]
mov dword [ebp - 0xe7c], ecx
mov ecx, dword [ebp - 0xa98]
mov dword [ebp - 0xadc], ecx
and edi, 7
jne 0x10015a98
xor eax, eax
or dword [ebp - 0xb00], 0xffffffff
mov dword [ebp - 0xac0], eax
mov esi, eax
mov dword [ebp - 0xad0], eax
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xaec], esi
mov ecx, dword [ebp - 0xaa0]
lea eax, [ecx - 8]
shr eax, 3
mov dword [ebp - 0xaa4], eax
test eax, eax
je 0x10010e87
mov eax, dword [ebp - 0xad8]
mov edi, dword [ebp - 0xadc]
add eax, 7
mov ebx, dword [ebp - 0xad0]
add edi, 2
mov dword [ebp - 0xa78], eax
mov dword [ebp - 0xadc], edi
movzx ecx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ecx, 8
or ecx, eax
shl edi, 8
mov eax, dword [ebp - 0xadc]
xor ebx, ecx
mov dword [ebp - 0xacc], ecx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xadc]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xadc]
shl edi, 8
add dword [ebp - 0xadc], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, ebx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul ecx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub ecx, eax
xor esi, ecx
lea eax, [esi - 0x137f]
imul ecx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, 0xab69605e
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0x137f
ror ecx, 6
imul eax, eax, 0xab69
xor ecx, eax
xor esi, ecx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul ecx, eax, 0x605e
mov eax, esi
rol eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub ecx, eax
xor esi, ecx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul ecx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x7f1
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov eax, esi
mov dword [ebp - 0xa70], esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea esi, [ebx - 0x7f1]
xor esi, dword [ebp - 0xa70]
xor esi, 0xab69605e
mov eax, esi
xor eax, 0x7f1
rol eax, 2
imul ecx, eax, 0x137f
mov eax, esi
shr eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 7
add ecx, eax
xor esi, ecx
mov eax, esi
mov ecx, esi
xor eax, 0x137f
ror ecx, 9
imul eax, eax, 0x605e
add ecx, eax
xor ebx, ecx
mov eax, ebx
mov dword [ebp - 0xad0], ebx
xor eax, 0xab69
rol eax, 5
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 7
add ecx, eax
xor esi, ecx
mov ebx, esi
xor ebx, dword [ebp - 0xad0]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor esi, eax
lea eax, [esi - 0x7f1137f]
ror eax, 1
imul ecx, eax, 0x605e
mov eax, esi
ror eax, 6
sub ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add ecx, eax
xor esi, ecx
lea eax, [esi - 0x54969fa2]
rol eax, 0xf
imul ecx, eax, 0x137f
mov eax, esi
ror eax, 0xe
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x605e
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor ecx, eax
xor esi, ecx
mov eax, esi
xor eax, 0x7f1137f
rol eax, 4
imul ecx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xb00]
rol eax, 2
mov dword [ebp - 0xaec], esi
mov dword [ebp - 0xb00], edi
xor ecx, eax
mov edi, dword [ebp - 0xadc]
xor ecx, dword [ebp - 0xac0]
xor ebx, ecx
mov ecx, dword [ebp - 0xa78]
mov dword [ebp - 0xb08], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xaec]
ror dword [ebp - 0xb08], 8
mov byte [ecx], al
mov al, byte [ebp - 0xb08]
ror dword [ebp - 0xaec], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xaec]
ror dword [ebp - 0xb08], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xb08]
ror dword [ebp - 0xaec], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xaec]
ror dword [ebp - 0xb08], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xaec], 8
mov al, byte [ebp - 0xb08]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xaec]
mov byte [ecx - 3], al
add ecx, 8
mov ebx, dword [ebp - 0xb08]
mov esi, dword [ebp - 0xaec]
mov eax, dword [ebp - 0xacc]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xaa4], 1
mov dword [ebp - 0xb08], ebx
mov dword [ebp - 0xaec], esi
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xa78], ecx
jne 0x10010b32
mov ebx, dword [ebp - 0xa64]
mov ecx, dword [ebp - 0xaa0]
lea esi, [ecx - 8]
xor eax, eax
mov ecx, dword [ebp - 0xb28]
test esi, esi
je 0x10010e9e
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0x10010e96
mov edi, dword [ebp - 0xa98]
movzx eax, dl
cdq
cmp eax, dword [esi + edi]
jne 0x10015be3
cmp edx, dword [esi + edi + 4]
jne 0x10015be3
mov edi, ecx
mov dword [ebp - 0xa6c], esi
mov esi, dword [ebp - 0xa9c]
xor eax, eax
mov dword [ebp - 0xaf0], edi
mov ecx, eax
test ecx, ecx
jne 0x10015bf5
test esi, esi
js 0x10015c09
mov ecx, dword [ebp - 0xa6c]
xor edx, edx
mov dword [ebp - 0xa84], edi
mov eax, edx
mov dword [ebp - 0xab8], ecx
test eax, eax
jne 0x10015c1b
or ebx, 0x10000000
push 4
mov dword [ebp - 0xa64], ebx
pop esi
jl 0x10011197
mov edi, dword [ebp - 0xab8]
mov ecx, dword [ebp - 0xa84]
mov dword [ebp - 0xbd4], edx
mov dword [ebp - 0xc1c], ecx
cmp edi, esi
jb 0x10015c50
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0xa9c], eax
lea eax, [ebp - 0xc1c]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001118b
lea eax, [ebp - 0xbd4]
mov edx, esi
push eax
xor ecx, ecx
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001118b
mov eax, edi
sub eax, dword [ebp - 0xbd4]
cmp eax, esi
jb 0x10015c50
mov ecx, dword [ebp - 0xc1c]
lea eax, [ebp - 0xc1c]
push eax
mov edx, esi
mov edi, dword [ecx]
mov dword [ebp - 0xad8], edi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001118b
mov ecx, dword [ebp - 0xbd4]
lea eax, [ebp - 0xbd4]
push eax
mov edx, esi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001118b
mov eax, dword [ebp - 0xab8]
mov ecx, dword [ebp - 0xbd4]
sub eax, ecx
cmp eax, edi
jb 0x10015c50
lea eax, [ebp - 0xbd4]
mov edx, edi
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001118b
mov edi, dword [ebp - 0xc1c]
mov edx, dword [ebp - 0xad8]
mov eax, dword [ebp - 0xa84]
mov ebx, dword [ebp - 0xab8]
add eax, ebx
lea ecx, [edi + edx]
cmp eax, ecx
jb 0x10015c50
sub ebx, edi
sub ebx, edx
add ebx, dword [ebp - 0xa84]
cmp ebx, 8
jae 0x10015c50
xor ecx, ecx
mov dword [ebp - 0xb28], ecx
mov eax, ecx
mov dword [ebp - 0xaf0], eax
mov ebx, ecx
test edi, edi
je 0x10011122
lea eax, [ebp - 0xc60]
mov dword [ebp - 0xa78], edi
push eax
mov ecx, edi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001118b
mov eax, dword [ebp - 0xc60]
cmp edi, eax
jae 0x1001110e
lea eax, [ebp - 0xbec]
mov edx, esi
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001118b
mov eax, dword [ebp - 0xc60]
cmp dword [ebp - 0xbec], eax
ja 0x10015c3c
mov edx, dword [ecx]
lea eax, [ebp - 0xbcc]
push eax
mov ecx, esi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x10015c31
mov eax, dword [ebp - 0xbcc]
mov dword [ebp - 0xd54], eax
test ebx, ebx
js 0x1001118b
lea ecx, [ebp - 0xbc4]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xa78]
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001118b
mov ecx, dword [ebp - 0xbc4]
mov eax, dword [ebp - 0xc60]
mov dword [ebp - 0xa78], ecx
cmp ecx, eax
ja 0x10015c3c
inc dword [ebp - 0xb28]
cmp ecx, eax
jb 0x10011070
cmp ecx, eax
jne 0x10015c3c
mov edx, dword [ebp - 0xad8]
mov eax, dword [ebp - 0xaf0]
test edx, edx
je 0x1001114e
push edx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov dword [ebp - 0xaf0], eax
test eax, eax
je 0x10015c46
mov edx, dword [ebp - 0xad8]
xor ecx, ecx
mov ebx, ecx
test edi, edi
je 0x10011163
push edx
push edi
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xaf0]
add esp, 0xc
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0xb28]
mov dword [ebp - 0xbe0], eax
test ebx, ebx
js 0x1001118b
mov eax, dword [ebp - 0xa9c]
cmp eax, dword [ebp - 0xbe0]
jne 0x10015c50
or ebx, 0x10000000
mov dword [ebp - 0xa64], ebx
mov eax, dword [ebp - 0xae4]
test eax, eax
je 0x100111b2
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
mov edi, dword [ebp - 0xaac]
test edi, edi
je 0x10011220
xor eax, eax
cmp dword [edi + 4], eax
je 0x100111d9
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x100111f5
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0x10011211
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
mov eax, dword [ebp - 0xb44]
test eax, eax
je 0x1001123b
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
mov eax, dword [ebp - 0xa90]
test eax, eax
je 0x10011256
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
mov edi, dword [ebp - 0xa94]
test edi, edi
je 0x100112c4
xor eax, eax
cmp dword [edi + 4], eax
je 0x1001127d
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x10011299
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0x100112b5
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
mov eax, dword [ebp - 0xa84]
test eax, eax
je 0x100112df
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test ebx, ebx
js 0x10015d76
xor eax, eax
inc eax
cmp dword [ebp - 0xbe0], eax
jb 0x10015d6b
cmp dword [ebp - 0xbd8], 0
je 0x10015c5a
cmp dword [ebp - 0xbe0], 0
jbe 0x10015c5a
mov ecx, dword [ebp - 0xbd8]
lea eax, [ebp - 0xbc8]
push eax
mov edx, esi
mov dword [ebp - 0xbc8], ecx
mov edi, dword [ecx]
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015c70
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbc8]
mov dword [ebp - 0xbc8], eax
test ebx, ebx
js 0x10015c65
cmp edi, esi
jne 0x10015587
mov eax, dword [eax]
mov dword [ebp - 0xad4], eax
test ebx, ebx
js 0x10015d76
cmp eax, 0xd0000023
je 0x10015c81
cmp eax, 0x8007007a
je 0x10011390
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test eax, eax
js 0x10015d76
cmp dword [ebp - 0xbe0], 6
jne 0x10015d6b
cmp dword [ebp - 0xbd8], 0
je 0x10015c91
mov ecx, dword [ebp - 0xbd8]
xor eax, eax
mov dword [ebp - 0xbc0], ecx
mov edi, eax
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0xa9c], eax
lea eax, [ebp - 0xbc0]
push eax
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015cb9
mov edx, dword [ebp - 0xa9c]
lea eax, [ebp - 0xbc0]
mov ecx, dword [ebp - 0xbc0]
push eax
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015cb9
mov ecx, dword [ebp - 0xbc0]
xor eax, eax
inc edi
inc eax
cmp edi, eax
jb 0x100113ba
mov edi, dword [ecx]
lea eax, [ebp - 0xbc0]
push eax
mov edx, esi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015cb9
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc0], eax
test ebx, ebx
js 0x10015cca
cmp edi, 8
jne 0x10015587
mov ecx, dword [eax]
mov dword [ebp - 0xa94], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xb44], ecx
test ebx, ebx
js 0x10015d76
cmp dword [ebp - 0xbd8], 0
je 0x10015ce7
mov ecx, dword [ebp - 0xbd8]
xor eax, eax
mov dword [ebp - 0xbac], ecx
mov edi, eax
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0xa9c], eax
lea eax, [ebp - 0xbac]
push eax
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015cfd
mov edx, dword [ebp - 0xa9c]
lea eax, [ebp - 0xbac]
mov ecx, dword [ebp - 0xbac]
push eax
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015cfd
mov ecx, dword [ebp - 0xbac]
inc edi
cmp edi, 2
jb 0x1001148f
mov edi, dword [ecx]
lea eax, [ebp - 0xbac]
push eax
mov edx, esi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015cfd
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbac]
mov dword [ebp - 0xbac], eax
test ebx, ebx
js 0x10015cf2
cmp edi, esi
jne 0x10015587
mov eax, dword [eax]
mov dword [ebp - 0xae4], eax
test ebx, ebx
js 0x10015d76
cmp dword [ebp - 0xbd8], 0
je 0x10015d0e
mov ecx, dword [ebp - 0xbd8]
xor eax, eax
mov dword [ebp - 0xbb0], ecx
mov edi, eax
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0xa9c], eax
lea eax, [ebp - 0xbb0]
push eax
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d15
mov edx, dword [ebp - 0xa9c]
lea eax, [ebp - 0xbb0]
mov ecx, dword [ebp - 0xbb0]
push eax
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d15
mov ecx, dword [ebp - 0xbb0]
inc edi
cmp edi, 3
jb 0x10011558
mov edi, dword [ecx]
lea eax, [ebp - 0xbb0]
push eax
mov edx, esi
mov dword [ebp - 0xaa0], edi
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d15
neg edi
sbb edi, edi
and edi, dword [ebp - 0xbb0]
mov dword [ebp - 0xbb0], edi
test ebx, ebx
js 0x10015d76
mov ecx, dword [ebp - 0xbd8]
xor eax, eax
mov dword [ebp - 0xbb4], ecx
mov dword [ebp - 0xa78], eax
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0xa9c], eax
lea eax, [ebp - 0xbb4]
push eax
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d2c
mov edx, dword [ebp - 0xa9c]
lea eax, [ebp - 0xbb4]
mov ecx, dword [ebp - 0xbb4]
push eax
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d2c
mov eax, dword [ebp - 0xa78]
mov ecx, dword [ebp - 0xbb4]
inc eax
mov dword [ebp - 0xa78], eax
cmp eax, esi
jb 0x10011604
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0xa9c], eax
lea eax, [ebp - 0xbb4]
push eax
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d2c
mov ecx, dword [ebp - 0xa9c]
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbb4]
mov dword [ebp - 0xbb4], eax
test ebx, ebx
js 0x10015d3d
cmp ecx, esi
jne 0x10015587
mov eax, dword [eax]
mov dword [ebp - 0xaa4], eax
test ebx, ebx
js 0x10015d76
mov ecx, dword [ebp - 0xbd8]
xor eax, eax
mov dword [ebp - 0xb14], ecx
mov dword [ebp - 0xa78], eax
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0xa9c], eax
lea eax, [ebp - 0xb14]
push eax
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d48
mov edx, dword [ebp - 0xa9c]
lea eax, [ebp - 0xb14]
mov ecx, dword [ebp - 0xb14]
push eax
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d48
mov eax, dword [ebp - 0xa78]
mov ecx, dword [ebp - 0xb14]
inc eax
mov dword [ebp - 0xa78], eax
cmp eax, 5
jb 0x100116db
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0xa9c], eax
lea eax, [ebp - 0xb14]
push eax
call fcn.1000e6b4
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
js 0x10015d48
mov ecx, dword [ebp - 0xa9c]
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb14]
mov dword [ebp - 0xb14], eax
test ebx, ebx
js 0x10015d59
cmp ecx, esi
jne 0x10015587
mov ecx, dword [eax]
test ebx, ebx
js 0x10015d76
mov eax, dword [ebp - 0xab0]
cmp eax, dword [ebp - 0xa94]
jne 0x10015d6b
mov eax, dword [ebp - 0xa74]
cmp eax, dword [ebp - 0xb44]
jne 0x10015d6b
mov eax, dword [ebp - 0xae4]
mov dword [ebp - 0xa8c], ecx
mov dword [ebp - 0xc2c], eax
cmp dword [ebp - 0xaa4], esi
ja 0x10015d64
mov eax, dword [ebp - 0xaa0]
cmp eax, esi
ja 0x10015d64
push eax
push edi
push dword [ebp - 0xb20]
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0xad4]
mov edi, dword [ebp - 0xa68]
test eax, eax
je 0x10011811
mov ebx, eax
mov dword [ebp - 0xa64], ebx
mov eax, dword [ebp - 0xcb4]
xor edx, edx
mov dword [ebp - 0xcb8], edx
mov dword [ebp - 0xcbc], edx
test eax, eax
je 0x10011840
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0xcb4], edx
mov ecx, dword [ebp - 0xbd8]
mov dword [ebp - 0xbdc], edx
mov dword [ebp - 0xbe0], edx
test ecx, ecx
je 0x1001186d
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0xbd8], edx
test edi, edi
je 0x10011880
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
mov eax, dword [ebp - 0xa80]
test eax, eax
je 0x1001189b
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test ebx, ebx
js 0x1001554d
mov eax, dword [ebp - 0xa8c]
test eax, eax
jne 0x10015d81
mov eax, dword [ebp - 0xb20]
xor edx, edx
mov dword [ebp - 0xabc], edx
mov dword [ebp - 0xc54], eax
xor edx, edx
mov esi, 0x100297c8
lea ecx, [edx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x100118cc
mov eax, dword [0x1002977c]
push 0
pop edx
test eax, eax
jle 0x1001192b
sub eax, 1
mov dword [0x1002977c], eax
jne 0x1001192b
mov edi, edx
mov eax, dword [edi + 0x10029788]
test eax, eax
je 0x10011902
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0x100118f1
push 0x40
xor eax, eax
push eax
push 0x10029788
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x100010a0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0x100297c8
xchg dword [ecx], eax
mov eax, dword [ebp - 0xabc]
test eax, eax
jne 0x1001c7a8
mov eax, dword [ebp - 0xc54]
test ebx, ebx
js 0x1001c7b4
push 4
pop ebx
cmp dword [ebp - 0xc2c], ebx
jne 0x1001c803
mov edi, dword [eax]
mov esi, dword [ebp - 0xda4]
test eax, eax
je 0x1001c813
push eax
call dword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalFree]
xor ecx, ecx
mov dword [ebp - 0xc54], ecx
test esi, esi
js 0x1001c81a
lea eax, [ebp - 0xc10]
push eax
push 0x20019
push ecx
push 0x10001f20
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x100119ca
lea eax, [ebp - 0xccc]
push eax
lea eax, [ebp - 0xc18]
push eax
xor eax, eax
push eax
push eax
push 0x10001ef0
push dword [ebp - 0xc10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test edi, edi
pop edi
pop esi
jne 0x1001c846
mov ecx, dword [ebp - 0xc18]
push 3
pop eax
cmp ecx, 0x10
jb 0x1001c821
cmp ecx, 0x16
jae 0x1001c838
push eax
pop eax
mov ecx, dword [ebp - 0xcd0]
test ecx, ecx
jne 0x10011a3f
mov eax, dword [ebp - 0xcd4]
test eax, eax
je 0x10011a07
mov dword [eax], ebx
mov eax, dword [ebp - 0xcd8]
pop ebx
test eax, eax
je 0x10011a18
mov dword [eax], 5
cmp dword [ebp - 0xc10], 0
je 0x10011a2d
push dword [ebp - 0xc10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.10012ae0
mov esp, ebp
pop ebp
ret 0xc
mov dword [ecx], eax
jmp 0x100119fb
mov edi, dword [ebp - 0xaac]
mov ebx, 0xc004d501
xor eax, eax
jmp 0x1000ebdf
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
jmp 0x1000ebe7
mov edx, 0xc000007b
jmp 0x10015216
mov edx, 0xc000000d
mov dword [ebp - 0xa70], edx
jmp 0x1000ecb9
cmp ax, word [ebp - 0xba8]
je 0x1000eca7
jmp 0x10015211
mov eax, dword [ebp - 0xa90]
jmp 0x1000ed38
mov ebx, 0xc000007a
jmp 0x1000ed6a
mov esi, dword [ebp - 0xaac]
mov ebx, 0xc000007a
jmp 0x1000ed70
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0x10029788]
test eax, eax
je 0x1001526a
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x10015259
push 0x40
push ebx
push 0x10029788
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x100010a0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x1000ed98
mov esi, dword [0x10029088]
mov ecx, esi
call dword [0x1002a1c8]
call esi
mov ecx, eax
mov dword [ebp - 0xb20], ecx
test ecx, ecx
jne 0x100152c5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
xor ebx, ebx
mov dword [ebp - 0xa8c], ebx
jmp 0x1000eded
xor edx, edx
mov eax, edx
mov esi, edx
mov dword [ebp - 0xa90], eax
mov ebx, dword [0x10029098]
lea edx, [ebp - 0xc84]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0x1002a1c8]
call ebx
test eax, eax
jne 0x10015359
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, 0x7a
jne 0x1001533b
xor eax, eax
test esi, esi
jne 0x10015334
push dword [ebp - 0xc84]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1001532a
mov eax, dword [ebp - 0xc84]
mov ecx, dword [ebp - 0xb20]
jmp 0x100152d1
mov ebx, 0x8007000e
jmp 0x1000ede3
mov ebx, 0x80004005
jmp 0x10015369
test eax, eax
jne 0x10015346
mov ebx, 0x80004005
jmp 0x10015355
jg 0x1001534c
mov ebx, eax
jmp 0x10015355
movzx ebx, ax
or ebx, 0x80070000
xor eax, eax
jmp 0x10015369
mov ebx, dword [ebp - 0xa90]
xor eax, eax
mov dword [ebp - 0xab8], esi
mov esi, eax
test esi, esi
je 0x1001537c
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test ebx, ebx
js 0x1000edd5
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentThreadId]
mov esi, dword [0x10029094]
mov ecx, esi
push eax
call dword [0x1002a1c8]
call esi
mov ecx, eax
mov dword [ebp - 0xb20], ecx
test ecx, ecx
jne 0x100153ce
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x100153be
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x1000edd5
mov ebx, 0x80004005
jmp 0x1000edd5
xor edx, edx
mov eax, edx
mov esi, edx
mov dword [ebp - 0xa90], eax
mov ebx, dword [0x10029098]
lea edx, [ebp - 0xca0]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0x1002a1c8]
call ebx
test eax, eax
jne 0x10015462
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, 0x7a
jne 0x10015444
xor eax, eax
test esi, esi
jne 0x1001543d
push dword [ebp - 0xca0]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x10015433
mov eax, dword [ebp - 0xca0]
mov ecx, dword [ebp - 0xb20]
jmp 0x100153da
mov ebx, 0x8007000e
jmp 0x1000edd5
mov ebx, 0x80004005
jmp 0x1001546e
test eax, eax
jne 0x1001544f
mov ebx, 0x80004005
jmp 0x1001545e
jg 0x10015455
mov ebx, eax
jmp 0x1001545e
movzx ebx, ax
or ebx, 0x80070000
xor eax, eax
jmp 0x1001546e
mov ebx, dword [ebp - 0xa90]
xor eax, eax
mov edi, esi
mov esi, eax
test esi, esi
je 0x10015481
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test ebx, ebx
js 0x1000edcd
mov eax, dword [ebp - 0xab8]
test eax, eax
je 0x1001550b
push 4
mov ecx, eax
mov edx, 0x10002014
pop eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x100154c1
test si, si
je 0x100154bd
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x100154c1
add ecx, eax
add edx, eax
test si, si
jne 0x1001549d
xor ecx, ecx
jmp 0x100154c6
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x1001550b
test edi, edi
je 0x1001550b
mov edx, 0x10002024
mov ecx, edi
mov si, word [ecx]
cmp si, word [edx]
jne 0x100154fc
test si, si
je 0x100154f5
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x100154fc
add ecx, eax
add edx, eax
test si, si
jne 0x100154d5
xor ecx, ecx
xor eax, eax
inc ecx
jmp 0x10015503
sbb eax, eax
xor ecx, ecx
inc ecx
or eax, ecx
test eax, eax
je 0x1000edc5
mov eax, dword [ebp - 0xad4]
jmp 0x1000edc7
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
jmp 0x1000edd5
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
jmp 0x1000ede3
mov dword [ebp - 0xabc], ebx
mov ebx, 0x8007000e
mov eax, dword [ebp - 0xc5c]
mov dword [ebp - 0xc2c], eax
jmp 0x100118c5
mov ebx, 0xc0000017
jmp 0x10015d70
mov ebx, 0xc0000017
jmp 0x1001180b
mov edi, dword [ebp - 0xe48]
jmp 0x10015d76
mov ebx, 0xc000003e
jmp 0x10015d70
mov ebx, 0xc0000023
jmp 0x10015d70
mov eax, dword [ebp - 0xa6c]
xor ecx, ecx
jmp 0x1000f1a9
mov eax, dword [ebp - 0xd04]
jmp 0x1000f1ed
mov eax, dword [ebp - 0xa6c]
jmp 0x1000f29d
mov eax, dword [ebp - 0xcfc]
jmp 0x1000f2e9
mov eax, dword [ebp - 0xa6c]
jmp 0x1000f396
mov eax, dword [ebp - 0xcf4]
jmp 0x1000f3fa
mov eax, dword [ebp - 0xd5c]
jmp 0x1000f54a
mov ebx, 0xc0000023
jmp 0x100155ec
mov ebx, 0xc000000d
mov dword [ebp - 0xa64], ebx
jmp 0x1000f5f4
mov eax, dword [ebp - 0xd24]
jmp 0x1000f650
mov edx, dword [ebp - 0xa70]
mov eax, dword [ebp - 0xa6c]
jmp 0x1000f6ef
mov eax, dword [ebp - 0xcdc]
jmp 0x1000f73d
mov edi, dword [ebp - 0xed0]
mov eax, dword [ebp - 0xbf0]
jmp 0x1000f978
mov ebx, 0xc0000095
jmp 0x1000fad9
mov ebx, 0xc0000017
jmp 0x1000fad3
xor ecx, ecx
jmp 0x1000facb
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
jmp 0x1000fad3
mov ebx, 0xc000000d
jmp 0x100100b3
mov dword [ebp - 0xb00], eax
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0xb28], eax
test edi, edi
je 0x100156d2
mov ebx, dword [ebp - 0xb48]
mov ecx, dword [ebp - 0xaa8]
cmp eax, esi
jge 0x100156a4
mov eax, dword [ebp - 0xaa8]
lea ecx, [ebx - 0x20]
movzx eax, byte [eax]
shl eax, cl
or dword [ebp - 0xadc], eax
jmp 0x100156b1
movzx eax, byte [ecx]
mov ecx, ebx
shl eax, cl
or dword [ebp - 0xb00], eax
mov eax, dword [ebp - 0xb28]
sub ebx, 8
mov ecx, dword [ebp - 0xaa8]
inc eax
inc ecx
mov dword [ebp - 0xb28], eax
mov dword [ebp - 0xaa8], ecx
cmp eax, edi
jl 0x1001568a
mov eax, dword [ebp - 0xadc]
xor ecx, ecx
mov ebx, dword [ebp - 0xb00]
xor eax, 0xb17a307a
xor ebx, 0x42f6b18d
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xb18], eax
mov dword [ebp - 0xaf8], ebx
test edi, edi
je 0x1001573a
mov edi, dword [ebp - 0xa64]
cmp ecx, esi
jge 0x10015712
rol eax, 8
mov byte [edi], al
jmp 0x10015717
rol ebx, 8
mov byte [edi], bl
mov edi, dword [ebp - 0xaa0]
inc ecx
inc dword [ebp - 0xa64]
cmp ecx, edi
jl 0x10015701
mov eax, dword [ebp - 0xb18]
mov ebx, dword [ebp - 0xaf8]
mov dword [ebp - 0xac0], eax
add edi, 0xfffffffc
test edi, edi
jle 0x10015754
mov ecx, esi
sub ecx, edi
shl ecx, 3
shr ebx, cl
shl ebx, cl
mov dword [ebp - 0xaf8], ebx
jmp 0x10015779
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0xaf8], ebx
test edi, edi
jns 0x10015779
neg edi
shl edi, 3
mov ecx, edi
shr eax, cl
shl eax, cl
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xb18], eax
mov ecx, dword [ebp - 0xac0]
jmp 0x1000fba5
mov ebx, 0xc0000017
jmp 0x1001007f
mov ebx, 0xc0000017
xor edx, edx
jmp 0x10010077
mov ebx, 0xc0000017
jmp 0x10010077
cmp dword [edi + 4], 0
je 0x100157c0
push dword [edi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 4], edx
cmp dword [edi + 0xc], 0
je 0x100157dc
push dword [edi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0xc], edx
cmp dword [edi + 0x14], 0
je 0x100157f8
push dword [edi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0x14], edx
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
jmp 0x1001007f
mov edi, dword [ebp - 0xaf0]
xor eax, eax
jmp 0x10010097
xor eax, eax
cmp dword [edi + 4], eax
je 0x10015836
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x10015852
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0x1001586e
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
jmp 0x100100b3
mov ebx, 0xc0000001
jmp 0x100100b3
mov eax, dword [ebp - 0xec0]
jmp 0x1001016b
mov ebx, 0xc0000017
jmp 0x100102d2
xor ecx, ecx
jmp 0x100102ca
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
jmp 0x100102d2
mov ebx, 0xc0000095
mov dword [ebp - 0xa64], ebx
mov eax, dword [ebp - 0xd28]
jmp 0x10010364
mov ebx, 0xc000000d
mov dword [ebp - 0xa64], ebx
mov edi, dword [ebp - 0xa98]
jmp 0x100105b1
mov eax, dword [ebp - 0xec4]
test ebx, ebx
js 0x100158dd
jmp 0x1001059e
mov ebx, 0x8000ffff
jmp 0x10011191
mov ecx, dword [ebp - 0xa90]
mov ebx, 0xc0000017
jmp 0x100105dd
mov ebx, 0x80070057
jmp 0x10011191
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xa64], ebx
test ebx, ebx
jle 0x1001593e
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xa64], ebx
test ebx, ebx
mov eax, dword [ebp - 0xa98]
js 0x1001069d
mov ebx, 0x80004005
mov dword [ebp - 0xa64], ebx
jmp 0x1001069d
mov eax, dword [ebp - 0xa98]
jmp 0x1001069d
mov ebx, 0x8007007a
jmp 0x10011191
mov ebx, 0xc000003e
jmp 0x10010a0b
mov ebx, 0xc000003e
jmp 0x10015a87
mov ebx, 0xc0000017
jmp 0x100109f2
mov ebx, 0xc0000017
xor eax, eax
jmp 0x100109ea
mov dword [esi], eax
mov dword [esi + 4], eax
jmp 0x1001094f
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
jmp 0x1001099a
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
jmp 0x100109e6
cmp dword [esi + 4], 0
je 0x100159d5
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0x100159f1
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0x10015a0d
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
jmp 0x100109f2
cmp dword [edi + 4], 0
je 0x10015a3d
push dword [edi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 4], edx
cmp dword [edi + 0xc], 0
je 0x10015a59
push dword [edi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0xc], edx
cmp dword [edi + 0x14], 0
je 0x10015a75
push dword [edi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0x14], edx
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
push 4
pop esi
xor edx, edx
jmp 0x10010a0b
mov ebx, 0xc000000d
jmp 0x10010f01
or dword [ebp - 0xaec], 0xffffffff
xor eax, eax
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xb00], eax
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xa78], eax
test edi, edi
je 0x10015b11
mov ebx, dword [ebp - 0xb48]
cmp eax, esi
jge 0x10015add
mov eax, dword [ebp - 0xadc]
lea ecx, [ebx - 0x20]
movzx eax, byte [eax]
shl eax, cl
or dword [ebp - 0xac0], eax
jmp 0x10015aea
movzx eax, byte [ecx]
mov ecx, ebx
shl eax, cl
or dword [ebp - 0xb00], eax
mov eax, dword [ebp - 0xa78]
sub ebx, 8
mov ecx, dword [ebp - 0xadc]
inc eax
inc ecx
mov dword [ebp - 0xa78], eax
mov dword [ebp - 0xadc], ecx
cmp eax, edi
jl 0x10015ac3
mov ebx, dword [ebp - 0xa64]
mov eax, dword [ebp - 0xac0]
mov ecx, dword [ebp - 0xb00]
xor eax, 0x92f65a5
and dword [ebp - 0xaa8], 0
xor ecx, 0x699a899c
mov dword [ebp - 0xad0], eax
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xa70], ecx
mov dword [ebp - 0xaec], ecx
test edi, edi
je 0x10015b98
mov ebx, dword [ebp - 0xad8]
cmp dword [ebp - 0xaa8], esi
jge 0x10015b60
rol eax, 8
mov byte [ebx], al
jmp 0x10015b65
rol ecx, 8
mov byte [ebx], cl
inc dword [ebp - 0xaa8]
inc ebx
cmp dword [ebp - 0xaa8], edi
jl 0x10015b51
mov eax, dword [ebp - 0xb08]
mov ecx, dword [ebp - 0xaec]
mov dword [ebp - 0xad8], ebx
mov ebx, dword [ebp - 0xa64]
mov dword [ebp - 0xad0], eax
mov dword [ebp - 0xa70], ecx
add edi, 0xfffffffc
test edi, edi
jle 0x10015bb5
mov ecx, esi
mov esi, dword [ebp - 0xa70]
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
jmp 0x10010aee
xor ecx, ecx
mov esi, ecx
mov dword [ebp - 0xaec], esi
test edi, edi
jns 0x10010af4
neg edi
shl edi, 3
mov ecx, edi
shr eax, cl
shl eax, cl
mov dword [ebp - 0xad0], eax
mov dword [ebp - 0xb08], eax
jmp 0x10010af4
mov edi, dword [ebp - 0xaf0]
mov esi, 0xc004d501
xor eax, eax
jmp 0x10010ed3
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
jmp 0x10010edb
mov eax, dword [ebp - 0xaf0]
mov ebx, 0xc0000001
xor edx, edx
jmp 0x10010ef9
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor edx, edx
jmp 0x10010f01
mov eax, dword [ebp - 0xd54]
jmp 0x100110c0
mov ebx, 0xc000000d
jmp 0x1001118b
mov ebx, 0xc0000017
jmp 0x10011175
mov ebx, 0xc000003e
jmp 0x1001118b
mov ebx, 0xc000000d
mov dword [ebp - 0xa64], ebx
mov eax, dword [ebp - 0xad4]
jmp 0x10011366
mov edi, dword [ebp - 0xec8]
mov eax, dword [ebp - 0xecc]
jmp 0x1001134e
mov eax, 0x8007007a
mov dword [ebp - 0xad4], eax
jmp 0x10011379
mov edx, dword [ebp - 0xce4]
mov ebx, 0xc000000d
mov ecx, dword [ebp - 0xce8]
mov dword [ebp - 0xa64], ebx
mov dword [ebp - 0xb44], edx
mov dword [ebp - 0xa94], ecx
jmp 0x1001146a
mov edi, dword [ebp - 0xe54]
mov eax, dword [ebp - 0xe58]
jmp 0x10011448
mov eax, dword [ebp - 0xce4]
mov dword [ebp - 0xb44], eax
mov eax, dword [ebp - 0xce8]
mov dword [ebp - 0xa94], eax
jmp 0x1001146a
mov ebx, 0xc000000d
mov dword [ebp - 0xa64], ebx
mov eax, dword [ebp - 0xd58]
jmp 0x1001152d
mov edi, dword [ebp - 0xe5c]
mov eax, dword [ebp - 0xe60]
jmp 0x1001151b
mov ebx, 0xc000000d
jmp 0x10015d70
mov eax, dword [ebp - 0xe94]
mov edi, dword [ebp - 0xe24]
mov dword [ebp - 0xaa0], eax
jmp 0x100115e8
mov ecx, dword [ebp - 0xe28]
mov eax, dword [ebp - 0xe2c]
jmp 0x100116a7
mov eax, dword [ebp - 0xe30]
jmp 0x100116b9
mov ecx, dword [ebp - 0xe34]
mov eax, dword [ebp - 0xe38]
jmp 0x1001177f
mov ecx, dword [ebp - 0xa7c]
jmp 0x10011791
mov ebx, 0x8007007a
jmp 0x10015d70
mov ebx, 0xc004d501
mov dword [ebp - 0xa64], ebx
mov edi, dword [ebp - 0xa68]
jmp 0x10011811
mov dword [0x10029778], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x2c0]
push eax
push 0x10000000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0x1001a541
cmp eax, esi
jne 0x10015db9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
cmp eax, 0x7a
je 0x1001a541
mov esi, dword [0x1002907c]
xor ebx, ebx
push 0x403
push ebx
push ebx
mov ecx, esi
call dword [0x1002a1c8]
call esi
mov dword [ebp - 0xaac], eax
test eax, eax
jne 0x10015de7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
jmp 0x1001a543
mov esi, dword [0x1002904c]
mov ecx, esi
call dword [0x1002a1c8]
call esi
mov dword [0x10029770], eax
mov eax, dword [0x10029778]
push 0x54
mov dword [ebp - 0xae4], eax
lea eax, [ebp - 0x76c]
push ebx
push eax
mov dword [0x10029774], edx
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
xor eax, eax
mov dword [ebp - 0xcf0], ebx
lea edi, [ebp - 0xc0c]
mov dword [ebp - 0xcec], ebx
stosd dword es:[edi], eax
push 0x2c
push ebx
mov dword [ebp - 0xa98], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xaf0], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x4b0]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
add esp, 0x18
mov dword [ebp - 0xb44], ebx
xor ebx, ebx
mov esi, 0x100297c8
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x10015e5f
mov eax, dword [0x1002977c]
push 0
pop ebx
test eax, eax
jne 0x100164ac
push 0x338
mov esi, ebx
mov dword [ebp - 0xa74], ebx
push ebx
mov dword [ebp - 0xa70], ebx
mov dword [ebp - 0xa6c], esi
mov dword [ebp - 0xabc], ebx
mov dword [ebp - 0xab0], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov dword [ebp - 0xacc], eax
test eax, eax
je 0x1001649e
or dword [ebp - 0xa78], 0xffffffff
lea edx, [ebp - 0xb6c]
mov dword [ebp - 0xe88], edx
add eax, 7
lea edx, [ebp - 0xb34]
mov dword [ebp - 0x3f0], 0xab69605e
mov edi, 0x10001bb2
mov dword [ebp - 0x3ec], 0x7f1137f
mov cl, bl
mov dword [ebp - 0xe84], edx
mov dword [ebp - 0xa80], ebx
mov dword [ebp - 0xb34], esi
mov dword [ebp - 0xb6c], ebx
mov dword [ebp - 0xaa4], eax
mov dword [ebp - 0xa8c], edi
mov dword [ebp - 0xaa0], 0x67
movzx edx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl edx, 8
or edx, eax
movzx eax, byte [edi]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl edx, 8
or edx, eax
shl edi, 8
mov eax, dword [ebp - 0xa8c]
xor ebx, edx
mov dword [ebp - 0xa9c], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xa8c]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xa8c]
shl edi, 8
add dword [ebp - 0xa8c], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, ebx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub edx, eax
xor esi, edx
lea eax, [esi - 0x137f]
imul edx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xa7c], esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea esi, [ebx - 0x7f1]
xor esi, dword [ebp - 0xa7c]
xor esi, 0xab69605e
mov eax, esi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, esi
shr eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 7
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor ebx, edx
mov eax, ebx
mov dword [ebp - 0xa7c], ebx
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 7
add edx, eax
xor esi, edx
mov ebx, esi
xor ebx, dword [ebp - 0xa7c]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor esi, eax
lea eax, [esi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xe
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xa78]
rol eax, 2
mov dword [ebp - 0xb34], esi
mov dword [ebp - 0xa78], edi
xor edx, eax
mov edi, dword [ebp - 0xa8c]
xor edx, dword [ebp - 0xa80]
xor ebx, edx
mov edx, dword [ebp - 0xaa4]
mov dword [ebp - 0xb6c], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb34]
ror dword [ebp - 0xb6c], 8
mov byte [edx], al
mov al, byte [ebp - 0xb6c]
ror dword [ebp - 0xb34], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb34]
ror dword [ebp - 0xb6c], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb6c]
ror dword [ebp - 0xb34], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb34]
ror dword [ebp - 0xb6c], 8
mov byte [edx - 2], al
ror dword [ebp - 0xb34], 8
mov al, byte [ebp - 0xb6c]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb34]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [ebp - 0xb6c]
mov esi, dword [ebp - 0xb34]
mov eax, dword [ebp - 0xa9c]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xaa0], 1
mov dword [ebp - 0xb6c], ebx
mov dword [ebp - 0xb34], esi
mov dword [ebp - 0xa80], eax
mov dword [ebp - 0xaa4], edx
jne 0x10015f22
mov esi, dword [ebp - 0xacc]
xor eax, eax
mov ebx, 0x338
xor cl, byte [eax + esi]
inc eax
cmp eax, ebx
jb 0x10016278
movzx eax, cl
cdq
cmp eax, dword [0x10001ee8]
jne 0x100162ae
cmp edx, dword [0x10001eec]
jne 0x100162ae
mov edi, esi
mov dword [ebp - 0xabc], ebx
mov ebx, dword [ebp - 0xab0]
xor eax, eax
mov dword [ebp - 0xa6c], edi
mov esi, eax
jmp 0x100162bb
mov edi, dword [ebp - 0xa6c]
mov ebx, 0xc004d501
xor eax, eax
test esi, esi
je 0x100162ce
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test ebx, ebx
js 0x10016498
mov eax, dword [ebp - 0xabc]
xor ecx, ecx
push 0x40
push ecx
mov ebx, 0x10029788
mov esi, edi
push ebx
mov byte [eax + edi - 1], cl
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
add esp, 0xc
cmp byte [edi], 0
je 0x1001642e
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xae8]
jne 0x10016307
sub ecx, ebx
xor ebx, ebx
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0x10016491
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa70], edx
cmp word [eax], cx
jne 0x1001637a
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0x1001637a
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0x1001637a
cmp dword [ecx], 0x4550
jne 0x1001637a
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xba4]
je 0x10016387
cmp ax, word [ebp - 0xba8]
je 0x10016387
mov edx, 0xc000000d
jmp 0x1001637f
mov edx, 0xc000007b
mov dword [ebp - 0xa70], edx
jmp 0x10016399
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xacc], eax
test eax, eax
je 0x10016422
mov ecx, esi
mov dword [ebp - 0xa9c], esi
xor eax, eax
mov dword [ebp - 0xb88], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xa7c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100163c2
sub ecx, dword [ebp - 0xa7c]
inc esi
add esi, ecx
test edx, edx
js 0x1001640c
mov ecx, dword [ebp - 0xa9c]
lea eax, [ebp - 0xb88]
push eax
push edi
xor edx, edx
call fcn.10011a50
mov edx, eax
mov dword [ebp - 0xa70], edx
test edx, edx
js 0x1001642e
mov eax, dword [ebp - 0xa74]
mov ecx, dword [ebp - 0xb88]
mov dword [eax*4 + section..data], ecx
jmp 0x10016412
mov eax, dword [ebp - 0xa74]
inc eax
inc ebx
mov dword [ebp - 0xa74], eax
cmp ebx, dword [ebp - 0xacc]
jb 0x100163a9
add edi, 0x10
cmp byte [esi], 0
jne 0x10016300
mov ebx, dword [ebp - 0xa70]
mov esi, dword [ebp - 0xa6c]
test esi, esi
je 0x1001644f
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test ebx, ebx
jns 0x100164a5
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0x10029788]
test eax, eax
je 0x10016468
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x10016457
push 0x40
push ebx
push 0x10029788
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x100010a0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x100164b2
mov ebx, 0xc000007a
jmp 0x10016434
mov esi, dword [ebp - 0xa6c]
mov ebx, 0xc000007a
jmp 0x1001643a
mov eax, dword [0x1002977c]
xor ebx, ebx
inc eax
mov dword [0x1002977c], eax
xor eax, eax
mov edx, 0x100297c8
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0xa], ebx
lea edi, [ebp - 0xc90]
mov dword [ebp - 0xa90], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xab8], ebx
mov dword [ebp - 0xa94], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xdb4]
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x100164e9
mov eax, dword [0x1002977c]
push 0
pop ebx
test eax, eax
jne 0x10016b36
push 0x338
mov esi, ebx
mov dword [ebp - 0xa74], ebx
push ebx
mov dword [ebp - 0xa70], ebx
mov dword [ebp - 0xa6c], esi
mov dword [ebp - 0xabc], ebx
mov dword [ebp - 0xab0], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov dword [ebp - 0xacc], eax
test eax, eax
je 0x10016b28
or dword [ebp - 0xa78], 0xffffffff
lea edx, [ebp - 0xb50]
mov dword [ebp - 0xe90], edx
add eax, 7
lea edx, [ebp - 0xb38]
mov dword [ebp - 0x420], 0xab69605e
mov edi, 0x10001bb2
mov dword [ebp - 0x41c], 0x7f1137f
mov cl, bl
mov dword [ebp - 0xe8c], edx
mov dword [ebp - 0xa80], ebx
mov dword [ebp - 0xb38], esi
mov dword [ebp - 0xb50], ebx
mov dword [ebp - 0xaa4], eax
mov dword [ebp - 0xa8c], edi
mov dword [ebp - 0xaa0], 0x67
movzx edx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl edx, 8
or edx, eax
movzx eax, byte [edi]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl edx, 8
or edx, eax
shl edi, 8
mov eax, dword [ebp - 0xa8c]
xor ebx, edx
mov dword [ebp - 0xa9c], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xa8c]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xa8c]
shl edi, 8
add dword [ebp - 0xa8c], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, ebx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub edx, eax
xor esi, edx
lea eax, [esi - 0x137f]
imul edx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xa7c], esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea esi, [ebx - 0x7f1]
xor esi, dword [ebp - 0xa7c]
xor esi, 0xab69605e
mov eax, esi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, esi
shr eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 7
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor ebx, edx
mov eax, ebx
mov dword [ebp - 0xa7c], ebx
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 7
add edx, eax
xor esi, edx
mov ebx, esi
xor ebx, dword [ebp - 0xa7c]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor esi, eax
lea eax, [esi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xe
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xa78]
rol eax, 2
mov dword [ebp - 0xb38], esi
mov dword [ebp - 0xa78], edi
xor edx, eax
mov edi, dword [ebp - 0xa8c]
xor edx, dword [ebp - 0xa80]
xor ebx, edx
mov edx, dword [ebp - 0xaa4]
mov dword [ebp - 0xb50], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb38]
ror dword [ebp - 0xb50], 8
mov byte [edx], al
mov al, byte [ebp - 0xb50]
ror dword [ebp - 0xb38], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb38]
ror dword [ebp - 0xb50], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb50]
ror dword [ebp - 0xb38], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb38]
ror dword [ebp - 0xb50], 8
mov byte [edx - 2], al
ror dword [ebp - 0xb38], 8
mov al, byte [ebp - 0xb50]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb38]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [ebp - 0xb50]
mov esi, dword [ebp - 0xb38]
mov eax, dword [ebp - 0xa9c]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xaa0], 1
mov dword [ebp - 0xb50], ebx
mov dword [ebp - 0xb38], esi
mov dword [ebp - 0xa80], eax
mov dword [ebp - 0xaa4], edx
jne 0x100165ac
mov esi, dword [ebp - 0xacc]
xor eax, eax
mov ebx, 0x338
xor cl, byte [eax + esi]
inc eax
cmp eax, ebx
jb 0x10016902
movzx eax, cl
cdq
cmp eax, dword [0x10001ee8]
jne 0x10016938
cmp edx, dword [0x10001eec]
jne 0x10016938
mov edi, esi
mov dword [ebp - 0xabc], ebx
mov ebx, dword [ebp - 0xab0]
xor eax, eax
mov dword [ebp - 0xa6c], edi
mov esi, eax
jmp 0x10016945
mov edi, dword [ebp - 0xa6c]
mov ebx, 0xc004d501
xor eax, eax
test esi, esi
je 0x10016958
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test ebx, ebx
js 0x10016b22
mov eax, dword [ebp - 0xabc]
xor ecx, ecx
push 0x40
push ecx
mov ebx, 0x10029788
mov esi, edi
push ebx
mov byte [edi + eax - 1], cl
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
add esp, 0xc
cmp byte [edi], 0
je 0x10016ab8
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xae8]
jne 0x10016991
sub ecx, ebx
xor ebx, ebx
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0x10016b1b
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa70], edx
cmp word [eax], cx
jne 0x10016a04
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0x10016a04
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0x10016a04
cmp dword [ecx], 0x4550
jne 0x10016a04
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xba4]
je 0x10016a11
cmp ax, word [ebp - 0xba8]
je 0x10016a11
mov edx, 0xc000000d
jmp 0x10016a09
mov edx, 0xc000007b
mov dword [ebp - 0xa70], edx
jmp 0x10016a23
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xacc], eax
test eax, eax
je 0x10016aac
mov ecx, esi
mov dword [ebp - 0xa9c], esi
xor eax, eax
mov dword [ebp - 0xb8c], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xa7c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10016a4c
sub ecx, dword [ebp - 0xa7c]
inc esi
add esi, ecx
test edx, edx
js 0x10016a96
mov ecx, dword [ebp - 0xa9c]
lea eax, [ebp - 0xb8c]
push eax
push edi
xor edx, edx
call fcn.10011a50
mov edx, eax
mov dword [ebp - 0xa70], edx
test edx, edx
js 0x10016ab8
mov eax, dword [ebp - 0xa74]
mov ecx, dword [ebp - 0xb8c]
mov dword [eax*4 + section..data], ecx
jmp 0x10016a9c
mov eax, dword [ebp - 0xa74]
inc eax
inc ebx
mov dword [ebp - 0xa74], eax
cmp ebx, dword [ebp - 0xacc]
jb 0x10016a33
add edi, 0x10
cmp byte [esi], 0
jne 0x1001698a
mov ebx, dword [ebp - 0xa70]
mov esi, dword [ebp - 0xa6c]
test esi, esi
je 0x10016ad9
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test ebx, ebx
jns 0x10016b2f
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0x10029788]
test eax, eax
je 0x10016af2
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x10016ae1
push 0x40
push ebx
push 0x10029788
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x100010a0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x10016b3c
mov ebx, 0xc000007a
jmp 0x10016abe
mov esi, dword [ebp - 0xa6c]
mov ebx, 0xc000007a
jmp 0x10016ac4
mov eax, dword [0x1002977c]
xor ebx, ebx
inc eax
mov dword [0x1002977c], eax
xor eax, eax
mov edi, 0x100297c8
xchg dword [edi], eax
push 0x54
lea eax, [ebp - 0x76c]
push ebx
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov eax, dword [ebp - 0xae4]
add esp, 0xc
mov esi, dword [0x1002907c]
mov ecx, eax
mov dword [ebp - 0xc0c], ebx
push 0xf
pop edx
and ecx, edx
mov dword [ebp - 0xa70], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0xc], cx
mov ecx, eax
shr ecx, 8
push 0x403
and ecx, edx
shr eax, 0xc
push ebx
mov word [ebp - 0xa], cx
and eax, edx
push ebx
mov ecx, esi
mov word [ebp - 8], ax
call dword [0x1002a1c8]
call esi
mov dword [ebp - 0xa68], eax
mov dword [ebp - 0xa6c], 0xffffff
test eax, eax
jne 0x10016be1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x10016bd1
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x1001803a
mov ebx, 0x80004005
jmp 0x1001803a
mov esi, dword [0x10029050]
mov eax, ebx
mov dword [ebp - 0xa84], eax
mov edi, ebx
lea eax, [ebp - 0xc50]
mov dword [ebp - 0xae4], edi
push eax
push ebx
lea eax, [ebp - 0xbf8]
mov dword [ebp - 0xbf4], ebx
push eax
push 8
mov ecx, esi
mov dword [ebp - 0xab0], ebx
mov dword [ebp - 0xaa8], ebx
mov dword [ebp - 0xc50], ebx
call dword [0x1002a1c8]
call esi
test eax, eax
jne 0x10016cb7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x10016c49
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x10016e1e
mov ebx, 0x80004005
mov esi, dword [ebp - 0xaa8]
xor edx, edx
mov eax, dword [ebp - 0xbf4]
test eax, eax
je 0x10016c78
mov ecx, dword [ebp - 0xab0]
test ecx, ecx
je 0x10016c78
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0x10016c70
test esi, esi
je 0x10016c8b
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
mov eax, dword [ebp - 0xbf4]
test eax, eax
je 0x100175b5
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0xbf4], ecx
jmp 0x100175b7
mov eax, dword [ebp - 0xc50]
add eax, eax
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xaa4], ebx
test ebx, ebx
je 0x10016d52
mov eax, dword [ebp - 0xbf8]
lea eax, [eax*4 + 4]
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov dword [ebp - 0xa78], eax
test eax, eax
je 0x10016e03
mov esi, eax
lea eax, [ebp - 0xc50]
push eax
push ebx
mov ebx, dword [0x10029050]
lea eax, [ebp - 0xbf8]
push eax
push 8
mov ecx, ebx
call dword [0x1002a1c8]
call ebx
test eax, eax
jne 0x10016d5c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x10016d44
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x10016d4b
mov ebx, 0x80004005
xor ecx, ecx
jmp 0x10016dee
mov ebx, 0x8007000e
jmp 0x10016c54
mov eax, dword [ebp - 0xa78]
xor ecx, ecx
mov ebx, eax
mov edi, dword [ebp - 0xaa4]
mov dword [ebp - 0xa80], ecx
cmp dword [ebp - 0xbf8], ecx
jbe 0x10016dcb
mov esi, dword [0x10029058]
push ecx
push edi
mov ecx, esi
call dword [0x1002a1c8]
call esi
mov ecx, edi
mov dword [ebx], eax
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x10016d95
mov eax, dword [ebp - 0xa80]
sub ecx, edx
sar ecx, 1
add ebx, 4
push 0
lea edi, [edi + ecx*2]
add edi, 2
inc eax
mov dword [ebp - 0xa80], eax
pop ecx
cmp eax, dword [ebp - 0xbf8]
jb 0x10016d7a
mov eax, dword [ebp - 0xa78]
mov dword [ebx], 0x409
mov edi, eax
mov ebx, dword [ebp - 0xa84]
mov esi, ecx
mov dword [ebp - 0xae4], eax
mov eax, dword [ebp - 0xbf8]
inc eax
mov dword [ebp - 0xa80], eax
test esi, esi
je 0x10016e08
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
jmp 0x10016e08
mov ebx, 0x8007000e
push dword [ebp - 0xaa4]
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test ebx, ebx
js 0x10016c54
xor eax, eax
mov ebx, eax
mov edx, eax
mov dword [ebp - 0xa74], ebx
cmp dword [ebp - 0xa80], eax
jbe 0x10016e65
mov ecx, eax
mov eax, dword [edi + edx*4]
cmp eax, dword [ecx*4 + 0x10002868]
je 0x10016e5b
inc ecx
cmp ecx, 0x26
jb 0x10016e3c
inc edx
xor eax, eax
cmp edx, dword [ebp - 0xa80]
jae 0x10016e65
jmp 0x10016e3a
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0xa74], ebx
mov esi, dword [0x10029054]
mov ecx, esi
push eax
mov dword [ebp - 0xabc], eax
lea eax, [ebp - 0xb8]
push 0x55
push eax
push dword [ebx*4 + 0x10002868]
call dword [0x1002a1c8]
call esi
test eax, eax
je 0x10016ed0
mov esi, dword [0x10029048]
lea eax, [ebp - 0x63c]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xb8]
mov ecx, esi
push eax
call dword [0x1002a1c8]
call esi
test eax, eax
jle 0x10016ed0
mov ebx, dword [ebp - 0x630]
xor eax, eax
shr ebx, 0x1b
inc eax
and ebx, eax
mov dword [ebp - 0xabc], ebx
mov ebx, dword [ebp - 0xa74]
xor eax, eax
mov edx, 0x10002038
mov esi, eax
mov ecx, edx
mov dword [ebp + esi*4 - 0x344], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xae8]
jne 0x10016ee5
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0x10016ed9
imul ecx, ebx, 3
movzx eax, byte [ecx + 0x100024a0]
mov eax, dword [ebp + eax*4 - 0x344]
mov dword [ebp - 0xc90], eax
movzx eax, byte [ecx + 0x100024a1]
mov eax, dword [ebp + eax*4 - 0x344]
mov dword [ebp - 0xc8c], eax
movzx eax, byte [ecx + 0x100024a2]
mov eax, dword [ebp + eax*4 - 0x344]
mov dword [ebp - 0xc88], eax
xor ebx, ebx
push 0x1c90
mov eax, ebx
push ebx
mov dword [ebp - 0xa84], eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xacc], ecx
test ecx, ecx
je 0x10016d52
or dword [ebp - 0xa78], 0xffffffff
lea edx, [ebp - 0xb54]
mov dword [ebp - 0xebc], edx
mov esi, ebx
lea edx, [ebp - 0xb3c]
mov dword [ebp - 0x42c], 0xab69605e
add ecx, 7
mov dword [ebp - 0x428], 0x7f1137f
mov edi, 0x10002912
mov dword [ebp - 0xeb8], edx
mov al, bl
mov dword [ebp - 0xa80], ebx
mov dword [ebp - 0xb3c], esi
mov dword [ebp - 0xb54], ebx
mov dword [ebp - 0xaa4], ecx
mov dword [ebp - 0xa8c], edi
mov dword [ebp - 0xaa0], 0x392
movzx edx, byte [edi - 2]
movzx ecx, byte [edi - 1]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
movzx edi, byte [edi + 2]
shl edx, 8
or edx, ecx
shl edi, 8
mov ecx, dword [ebp - 0xa8c]
xor ebx, edx
mov dword [ebp - 0xa9c], edx
movzx ecx, byte [ecx + 3]
or edi, ecx
mov ecx, dword [ebp - 0xa8c]
shl edi, 8
movzx ecx, byte [ecx + 4]
or edi, ecx
mov ecx, dword [ebp - 0xa8c]
shl edi, 8
add dword [ebp - 0xa8c], 8
movzx ecx, byte [ecx + 5]
or edi, ecx
xor esi, edi
xor esi, ebx
xor esi, 0xac987321
lea ecx, [esi + 0x54969fa2]
rol ecx, 5
imul edx, ecx, 0x137f
mov ecx, esi
rol ecx, 0xa
add edx, ecx
xor ebx, edx
lea ecx, [ebx + 0x7f1137f]
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, ebx
rol ecx, 2
sub edx, ecx
xor esi, edx
lea ecx, [esi - 0x137f]
imul edx, ecx, 0x605e
mov ecx, esi
shr ecx, 0xd
sub edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub ecx, edx
xor ebx, ecx
mov ecx, ebx
mov edx, ebx
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
xor esi, edx
lea ecx, [esi + 0x7f1137f]
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, esi
rol ecx, 2
add edx, ecx
xor ebx, edx
lea ecx, [ebx + 0x54969fa2]
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 8
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0xab69605e
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, esi
ror ecx, 0xa
xor edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, ebx
shr ecx, 0xa
xor edx, ecx
xor esi, edx
mov ecx, esi
mov dword [ebp - 0xa7c], esi
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor ebx, ecx
lea esi, [ebx - 0x7f1]
xor esi, dword [ebp - 0xa7c]
xor esi, 0xab69605e
mov ecx, esi
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, esi
shr ecx, 2
add edx, ecx
xor ebx, edx
lea ecx, [ebx - 0x7f1137f]
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, ebx
rol ecx, 7
add edx, ecx
xor esi, edx
mov ecx, esi
mov edx, esi
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor ebx, edx
mov ecx, ebx
mov dword [ebp - 0xa7c], ebx
xor ecx, 0xab69
rol ecx, 5
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 7
add edx, ecx
xor esi, edx
mov ebx, esi
xor ebx, dword [ebp - 0xa7c]
xor ebx, 0xac987321
mov ecx, ebx
ror ecx, 3
sub ecx, 0xab69
imul ecx, ecx, 0x137f
xor esi, ecx
lea ecx, [esi - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, esi
ror ecx, 6
sub edx, ecx
xor ebx, edx
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 0xe
add edx, ecx
xor esi, edx
lea ecx, [esi - 0x54969fa2]
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, esi
ror ecx, 0xe
sub edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, ebx
shr ecx, 3
xor edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0x7f1137f
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, esi
xor esi, dword [ebp - 0xa78]
rol ecx, 2
mov dword [ebp - 0xb3c], esi
mov dword [ebp - 0xa78], edi
xor edx, ecx
mov edi, dword [ebp - 0xa8c]
xor edx, dword [ebp - 0xa80]
xor ebx, edx
mov edx, dword [ebp - 0xaa4]
mov dword [ebp - 0xb54], ebx
mov byte [edx - 4], bl
mov cl, byte [ebp - 0xb3c]
ror dword [ebp - 0xb54], 8
mov byte [edx], cl
mov cl, byte [ebp - 0xb54]
ror dword [ebp - 0xb3c], 8
mov byte [edx - 5], cl
mov cl, byte [ebp - 0xb3c]
ror dword [ebp - 0xb54], 8
mov byte [edx - 1], cl
mov cl, byte [ebp - 0xb54]
ror dword [ebp - 0xb3c], 8
mov byte [edx - 6], cl
mov cl, byte [ebp - 0xb3c]
ror dword [ebp - 0xb54], 8
mov byte [edx - 2], cl
ror dword [ebp - 0xb3c], 8
mov cl, byte [ebp - 0xb54]
mov byte [edx - 7], cl
mov cl, byte [ebp - 0xb3c]
mov byte [edx - 3], cl
add edx, 8
mov ebx, dword [ebp - 0xb54]
mov esi, dword [ebp - 0xb3c]
mov ecx, dword [ebp - 0xa9c]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xaa0], 1
mov dword [ebp - 0xb54], ebx
mov dword [ebp - 0xb3c], esi
mov dword [ebp - 0xa80], ecx
mov dword [ebp - 0xaa4], edx
jne 0x10016fd7
xor ecx, ecx
mov esi, 0x1c90
mov edx, ecx
mov ecx, dword [ebp - 0xacc]
xor al, byte [edx + ecx]
inc edx
cmp edx, esi
jb 0x1001733a
movzx eax, al
cdq
cmp eax, dword [0x100045a0]
jne 0x1001736e
cmp edx, dword [0x100045a4]
jne 0x1001736e
mov ebx, dword [ebp - 0xa84]
xor edx, edx
mov dword [ebp - 0xbf4], ecx
mov ecx, edx
mov dword [ebp - 0xab0], esi
jmp 0x1001737b
mov ebx, 0xc004d501
xor edx, edx
mov dword [ebp - 0xa84], ebx
test ecx, ecx
je 0x1001738e
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test ebx, ebx
js 0x10016c54
mov edi, dword [ebp - 0xbf4]
xor eax, eax
mov ebx, dword [ebp - 0xa74]
mov esi, eax
mov edx, eax
cmp ebx, edx
jne 0x100173b3
mov dword [ebp + esi*4 - 0x2f8], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0xa7c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100173be
sub ecx, dword [ebp - 0xa7c]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0x100173a8
inc esi
push 0
pop eax
cmp esi, 6
jb 0x100173a6
push 0xc
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov ebx, dword [ebp - 0xa84]
mov edx, eax
mov dword [ebp - 0xa80], edx
test edx, edx
jne 0x1001740d
xor edx, edx
mov ebx, 0x8007000e
mov esi, edx
jmp 0x10016c5c
mov edi, edx
xor eax, eax
mov esi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov ecx, eax
mov dword [ebp - 0xa74], eax
movzx edx, word [ebp + ecx*2 - 0xc]
cmp dx, word [eax*2 + 0x10002900]
je 0x1001743a
inc eax
cmp eax, 6
jb 0x10017425
jmp 0x100174f9
mov edx, dword [ebp + eax*4 - 0x2f8]
mov ecx, edx
mov dword [ebp - 0xa7c], edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001744c
xor eax, eax
sub ecx, edi
mov edi, dword [0x10029060]
push eax
push eax
lea eax, [ecx + 1]
mov ecx, edi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0x1002a1c8]
call edi
mov dword [ebp - 0xa9c], eax
test eax, eax
je 0x10017531
lea ecx, [eax + eax]
xor eax, eax
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0xa74]
mov edi, eax
mov eax, dword [ebp - 0xa80]
mov dword [eax + ecx*4], edi
test edi, edi
je 0x1001752a
mov edx, dword [ebp - 0xa7c]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xa7c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100174be
push dword [ebp - 0xa9c]
sub ecx, dword [ebp - 0xa7c]
push edi
mov edi, dword [0x10029060]
lea eax, [ecx + 1]
mov ecx, edi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0x1002a1c8]
call edi
test eax, eax
je 0x10017531
mov ecx, dword [ebp - 0xa74]
inc ecx
mov dword [ebp - 0xa74], ecx
push 0
pop eax
cmp ecx, 3
jb 0x10017420
mov eax, dword [ebp - 0xa80]
xor edx, edx
mov dword [ebp - 0xa94], eax
mov esi, edx
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0x76c], eax
jmp 0x10017551
mov ebx, 0x8007000e
jmp 0x1001754f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x10017548
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x1001754f
mov ebx, 0x80004005
xor edx, edx
test esi, esi
je 0x10016c5c
mov edi, edx
mov edx, dword [esi + edi*4]
test edx, edx
je 0x100175aa
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0xa7c], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xae8]
jne 0x1001756d
sub ecx, dword [ebp - 0xa7c]
xor eax, eax
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x10017599
mov byte [edx], al
inc edx
sub ecx, 1
jne 0x10017591
push dword [esi + edi*4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
inc edi
cmp edi, 3
jb 0x1001755b
jmp 0x10016c5a
xor ecx, ecx
mov eax, dword [ebp - 0xae4]
test eax, eax
je 0x100175d0
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test ebx, ebx
js 0x1001801c
mov eax, dword [ebp - 0xa94]
mov esi, dword [0x100290b4]
mov ecx, dword [eax]
mov dword [ebp - 0x764], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x760], ecx
xor ecx, ecx
mov eax, dword [eax + 8]
mov edi, ecx
push ecx
mov dword [ebp - 0x75c], eax
mov ebx, ecx
lea eax, [ebp - 0xdc0]
mov dword [ebp - 0xdbc], ecx
push eax
push ecx
mov dword [ebp - 0xdb8], ecx
mov ecx, esi
push 0x42
mov dword [ebp - 0xdc0], 0xc
call dword [0x1002a1c8]
call esi
test eax, eax
jne 0x10017653
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1001764a
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x1001765e
mov ebx, 0x80004005
jmp 0x1001765e
mov edi, dword [ebp - 0xdbc]
xor eax, eax
inc eax
and edi, eax
mov dword [ebp - 0x768], edi
test ebx, ebx
js 0x1001801c
mov edi, dword [ebp - 0xa70]
mov eax, edi
push 0xb
pop edx
push 0x2a
pop ecx
mov dword [ebp - 0xa84], ecx
sub eax, 1
je 0x100176ae
sub eax, 1
je 0x100176a2
sub eax, 1
jne 0x100176ba
mov ebx, 0xe1
mov dword [ebp - 0xa90], ebx
mov dword [ebp - 0xab8], ebx
jmp 0x100176ba
mov dword [ebp - 0xa90], 0xf
jmp 0x100176b4
mov dword [ebp - 0xa90], ecx
mov dword [ebp - 0xab8], edx
mov esi, 0xdc
mov dword [ebp - 0xa8c], 0x60
push esi
xor ebx, ebx
lea eax, [ebp - 0x718]
push ebx
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
add esp, 0xc
mov word [ebp - 0x6d4], si
mov esi, dword [0x10029070]
lea eax, [ebp - 0x718]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0x1002a1c8]
call esi
test eax, eax
je 0x100177c2
movzx ebx, word [ebp - 0x672]
xor eax, eax
mov ecx, dword [ebp - 0x668]
mov dword [ebp - 0xdb0], eax
mov dword [ebp - 0xdb4], eax
mov eax, dword [ebp - 0x66c]
push 0x60
mov dword [ebp - 0xa74], eax
mov dword [ebp - 0xdac], eax
pop eax
mov dword [ebp - 0xa8c], ebx
mov dword [ebp - 0xa80], ecx
mov dword [ebp - 0xda8], ecx
cmp ebx, eax
jae 0x10017751
mov dword [ebp - 0xa8c], eax
xor ebx, ebx
xor eax, eax
inc eax
cmp edi, eax
mov edi, dword [ebp - 0xc90]
je 0x10017766
mov edi, dword [ebp - 0xc88]
push 0x5c
lea eax, [ebp - 0x61c]
push ebx
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov esi, dword [0x1002907c]
add esp, 0xc
xor eax, eax
mov ecx, esi
push 0x403
push eax
push eax
call dword [0x1002a1c8]
call esi
mov dword [ebp - 0xa7c], eax
test eax, eax
jne 0x100177df
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x100177b2
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x1001787c
mov ebx, 0x80004005
jmp 0x1001801c
mov eax, dword [ebp - 0xda8]
mov dword [ebp - 0xa80], eax
mov eax, dword [ebp - 0xdac]
mov dword [ebp - 0xa74], eax
jmp 0x10017753
mov esi, dword [0x1002905c]
mov ecx, esi
push 0x48
push dword [ebp - 0xa8c]
push dword [ebp - 0xa90]
call dword [0x1002a1c8]
call esi
neg eax
mov dword [ebp - 0x60c], 0x190
push edi
lea ecx, [ebp - 0x600]
mov dword [ebp - 0x61c], eax
mov byte [ebp - 0x602], 5
call fcn.1001301b
mov esi, dword [0x10029010]
lea eax, [ebp - 0x61c]
push eax
mov ecx, esi
call dword [0x1002a1c8]
call esi
test eax, eax
jne 0x1001785d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x10017854
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x10017863
mov ebx, 0x80004005
jmp 0x10017863
mov dword [ebp - 0x758], eax
push dword [ebp - 0xa7c]
mov esi, dword [0x100290b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0x1002a1c8]
call esi
test ebx, ebx
js 0x1001801c
mov edi, dword [ebp - 0xc90]
xor eax, eax
inc eax
cmp dword [ebp - 0xa70], eax
je 0x1001789b
mov edi, dword [ebp - 0xc88]
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0x5c0]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov esi, dword [0x1002907c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0x1002a1c8]
call esi
mov dword [ebp - 0xa7c], eax
test eax, eax
jne 0x100178f6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x100178eb
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x10017993
jmp 0x100177b8
mov esi, dword [0x1002905c]
mov ecx, esi
push 0x48
push dword [ebp - 0xa8c]
push dword [ebp - 0xab8]
call dword [0x1002a1c8]
call esi
neg eax
mov dword [ebp - 0x5b0], 0x190
push edi
lea ecx, [ebp - 0x5a4]
mov dword [ebp - 0x5c0], eax
mov byte [ebp - 0x5a6], 5
call fcn.1001301b
mov esi, dword [0x10029010]
lea eax, [ebp - 0x5c0]
push eax
mov ecx, esi
call dword [0x1002a1c8]
call esi
test eax, eax
jne 0x10017974
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1001796b
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x1001797a
mov ebx, 0x80004005
jmp 0x1001797a
mov dword [ebp - 0x754], eax
push dword [ebp - 0xa7c]
mov esi, dword [0x100290b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0x1002a1c8]
call esi
test ebx, ebx
js 0x1001801c
mov ebx, dword [ebp - 0xa70]
xor ecx, ecx
mov eax, ecx
mov edx, ecx
mov ecx, ebx
sub ecx, 1
je 0x100179b8
sub ecx, 1
je 0x100179f2
sub ecx, 1
jne 0x100179c4
mov eax, dword [ebp - 0xa74]
mov edx, dword [ebp - 0xa80]
xor ecx, ecx
mov dword [ebp - 0xc04], eax
mov dword [ebp - 0xc00], edx
xor edx, edx
inc edx
cmp ebx, edx
je 0x10017a2a
jbe 0x10017a04
cmp ebx, 3
ja 0x10017a04
xor ebx, ebx
mov edx, ecx
mov dword [ebp - 0xa84], ebx
mov dword [ebp - 0xa90], ebx
jmp 0x10017a39
mov eax, dword [ebp - 0xa74]
push 4
cdq
pop edi
idiv edi
xor ecx, ecx
mov edx, ecx
jmp 0x100179c6
mov ecx, dword [ebp - 0xbf0]
mov edx, dword [ebp - 0xbf0]
mov dword [ebp - 0xa90], ecx
mov ecx, dword [ebp - 0xbf0]
mov dword [ebp - 0xa84], ecx
mov ecx, dword [ebp - 0xbf0]
jmp 0x10017a39
mov edx, 0x96
mov dword [ebp - 0xa90], 0x20
mov dword [ebp - 0xab0], edx
mov dword [ebp - 0xa74], ecx
push dword [ebp - 0x758]
mov esi, dword [0x1002903c]
sub eax, edx
push dword [ebp - 0xa68]
mov edi, dword [ebp - 0x764]
sub eax, ecx
mov dword [ebp - 0xa9c], eax
mov ecx, esi
mov dword [ebp - 0x730], eax
mov dword [ebp - 0x740], eax
xor eax, eax
mov ebx, eax
call dword [0x1002a1c8]
call esi
mov esi, dword [0x1002906c]
mov ecx, esi
mov dword [ebp - 0xa7c], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x748]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xa68]
push edi
call dword [0x1002a1c8]
call esi
test eax, eax
jne 0x10017ab9
mov ebx, 0x80004005
mov eax, dword [ebp - 0xa7c]
test eax, eax
je 0x10017ad5
mov esi, dword [0x1002903c]
mov ecx, esi
push eax
push edi
call dword [0x1002a1c8]
call esi
test ebx, ebx
js 0x1001801c
push dword [ebp - 0x754]
mov esi, dword [0x1002903c]
xor eax, eax
push dword [ebp - 0xa68]
mov edi, dword [ebp - 0x760]
mov ecx, esi
mov ebx, eax
call dword [0x1002a1c8]
call esi
mov esi, dword [0x1002906c]
mov ecx, esi
mov dword [ebp - 0xa7c], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x738]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xa68]
push edi
call dword [0x1002a1c8]
call esi
test eax, eax
jne 0x10017b3b
mov ebx, 0x80004005
mov eax, dword [ebp - 0xa7c]
test eax, eax
je 0x10017b57
mov esi, dword [0x1002903c]
mov ecx, esi
push eax
push edi
call dword [0x1002a1c8]
call esi
test ebx, ebx
js 0x1001801c
mov eax, dword [ebp - 0xa70]
cmp eax, 2
je 0x10017b77
cmp eax, 3
je 0x10017b77
mov edi, dword [ebp - 0xa9c]
jmp 0x10017b8b
mov edi, dword [ebp - 0x730]
cmp dword [ebp - 0x740], edi
jle 0x10017b8b
mov edi, dword [ebp - 0x740]
cmp dword [ebp - 0x76c], 0
mov esi, dword [0x100290a8]
mov ecx, esi
push dword [ebp - 0xa84]
je 0x10017bcc
mov ebx, dword [ebp - 0xa74]
mov eax, ebx
sub eax, dword [ebp - 0x740]
add eax, edi
push eax
lea eax, [ebp - 0x748]
push eax
call dword [0x1002a1c8]
call esi
sub ebx, dword [ebp - 0x730]
add ebx, edi
jmp 0x10017be2
mov ebx, dword [ebp - 0xab0]
lea eax, [ebp - 0x748]
push ebx
push eax
call dword [0x1002a1c8]
call esi
mov eax, dword [ebp - 0x73c]
add eax, dword [ebp - 0xa90]
mov esi, dword [0x100290a8]
mov ecx, esi
push eax
push ebx
lea eax, [ebp - 0x738]
push eax
call dword [0x1002a1c8]
call esi
mov eax, dword [ebp - 0xa70]
cmp eax, 2
je 0x10017ed1
cmp eax, 3
je 0x10017ed1
xor edx, edx
inc edx
cmp eax, edx
jne 0x10017ef0
xor eax, eax
mov dword [ebp - 0x74c], 0xffffff
push 0x5c
push eax
lea eax, [ebp - 0x564]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov esi, dword [0x1002907c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0x1002a1c8]
call esi
mov dword [ebp - 0xa7c], eax
test eax, eax
jne 0x10017c8f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x10017c84
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x10017d2d
jmp 0x100177b8
mov esi, dword [0x1002905c]
mov ecx, esi
push 0x48
push dword [ebp - 0xa8c]
push 0xb
call dword [0x1002a1c8]
call esi
push dword [ebp - 0xc8c]
neg eax
mov dword [ebp - 0x554], 0x190
lea ecx, [ebp - 0x548]
mov dword [ebp - 0x564], eax
mov byte [ebp - 0x54a], 5
call fcn.1001301b
mov esi, dword [0x10029010]
lea eax, [ebp - 0x564]
push eax
mov ecx, esi
call dword [0x1002a1c8]
call esi
test eax, eax
jne 0x10017d0e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x10017d05
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0x10017d14
mov ebx, 0x80004005
jmp 0x10017d14
mov dword [ebp - 0x750], eax
push dword [ebp - 0xa7c]
mov esi, dword [0x100290b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0x1002a1c8]
call esi
test ebx, ebx
js 0x1001801c
push dword [ebp - 0x750]
mov esi, dword [0x1002903c]
xor eax, eax
push dword [ebp - 0xa68]
mov dword [ebp - 0x720], edi
mov ecx, esi
mov edi, dword [ebp - 0x75c]
mov ebx, eax
call dword [0x1002a1c8]
call esi
mov esi, dword [0x1002906c]
mov ecx, esi
mov dword [ebp - 0xa7c], eax
xor eax, eax
push eax
push 0x460
lea eax, [ebp - 0x728]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xa68]
push edi
call dword [0x1002a1c8]
call esi
test eax, eax
jne 0x10017d99
mov ebx, 0x80004005
mov eax, dword [ebp - 0xa7c]
test eax, eax
je 0x10017db5
mov esi, dword [0x1002903c]
mov ecx, esi
push eax
push edi
call dword [0x1002a1c8]
call esi
test ebx, ebx
js 0x1001801c
mov eax, dword [ebp - 0x720]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x720], eax
cmp eax, ecx
jge 0x10017dd9
mov dword [ebp - 0x720], ecx
mov ebx, dword [ebp - 0xa8c]
mov esi, dword [0x1002905c]
mov ecx, esi
push 0x20
pop eax
push 0x60
pop edi
push edi
push ebx
push dword [ebp - 0x728]
mov dword [ebp - 0x71c], eax
call dword [0x1002a1c8]
call esi
mov esi, dword [0x1002905c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x724]
mov dword [ebp - 0x728], eax
call dword [0x1002a1c8]
call esi
mov esi, dword [0x1002905c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x720]
mov dword [ebp - 0x724], eax
call dword [0x1002a1c8]
call esi
mov esi, dword [0x1002905c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x71c]
mov dword [ebp - 0x720], eax
call dword [0x1002a1c8]
call esi
cmp dword [ebp - 0x76c], 0
mov dword [ebp - 0x71c], eax
je 0x10017ec1
mov ecx, dword [ebp - 0x748]
cmp ecx, dword [ebp - 0x738]
jl 0x10017e80
mov ecx, dword [ebp - 0x738]
mov eax, dword [ebp - 0x72c]
add eax, 0x24
jmp 0x10017ea6
mov ecx, dword [ebp - 0x730]
mov eax, dword [ebp - 0x72c]
sub ecx, dword [ebp - 0x720]
add eax, 0x24
add ecx, dword [ebp - 0x728]
mov esi, dword [0x100290a8]
push eax
push ecx
lea eax, [ebp - 0x728]
mov ecx, esi
push eax
call dword [0x1002a1c8]
call esi
jmp 0x10017eed
mov ecx, dword [ebp - 0x740]
cmp ecx, dword [ebp - 0x730]
jg 0x10017e91
jmp 0x10017e8b
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0xc04], edi
mov dword [ebp - 0xc00], eax
mov dword [ebp - 0x74c], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [ebp - 0x76c]
lea edi, [ebp - 0xee0]
mov ebx, dword [ebp - 0xc04]
mov dword [ebp - 0xa7c], eax
mov eax, dword [ebp - 0xc00]
mov dword [ebp - 0xa80], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xa70]
sub eax, 1
je 0x10018232
sub eax, 1
je 0x10018180
sub eax, 1
jne 0x1001801a
mov esi, dword [sym.IPHLPAPI.DLL_DisableMediaSense]
lea edi, [ebp - 0x3e4]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0x1002a1c8]
call esi
mov esi, dword [sym.IPHLPAPI.DLL_DisableMediaSense]
lea ecx, [ebp - 0x3e4]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x3e4], 0x28
call dword [0x1002a1c8]
call esi
test eax, eax
je 0x1001801a
mov esi, dword [sym.IPHLPAPI.DLL_DisableMediaSense]
lea eax, [ebp - 0x3d0]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0x1002a1c8]
call esi
mov esi, dword [sym.IPHLPAPI.DLL_DisableMediaSense]
lea eax, [ebp - 0x3c8]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0x1002a1c8]
call esi
mov eax, dword [ebp - 0x3c8]
lea esi, [ebp - 0x3d0]
sub eax, ebx
lea edi, [ebp - 0xee0]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc0c], eax
mov eax, dword [ebp - 0x3c4]
sub eax, dword [ebp - 0xa80]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
jmp 0x10018011
mov eax, dword [ebp - 0x3a0]
sub eax, ebx
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0xc0c], eax
mov eax, dword [ebp - 0x39c]
sub eax, dword [ebp - 0xa80]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0xc08], eax
xor ebx, ebx
push dword [ebp - 0xa68]
mov esi, dword [0x100290b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0x1002a1c8]
call esi
mov edi, 0x100297c8
xor esi, esi
inc esi
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x1001803d
mov eax, dword [0x1002977c]
test eax, eax
jle 0x100180a2
sub eax, 1
mov dword [0x1002977c], eax
jne 0x100180a2
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0x10029788]
test eax, eax
je 0x10018071
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x10018060
push 0x40
xor eax, eax
push eax
push 0x10029788
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x100010a0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0x100297c8
inc esi
xor eax, eax
xchg dword [edi], eax
mov eax, dword [ebp - 0xa94]
test eax, eax
je 0x100180c1
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test ebx, ebx
js 0x10019c3d
mov edi, dword [ebp - 0xc0c]
xor eax, eax
mov ebx, dword [ebp - 0xc08]
push 0x54
push eax
lea eax, [ebp - 0x7c0]
mov dword [ebp - 0xcf0], edi
push eax
mov dword [ebp - 0xcec], ebx
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0xa74], esi
mov esi, dword [0x10029028]
mov ecx, esi
push 7
push dword [ebp - 0xaac]
call dword [0x1002a1c8]
call esi
test eax, eax
je 0x10018160
mov esi, dword [0x10029034]
lea ecx, [ebp - 0x7c0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x1002a1c8]
call esi
test eax, eax
je 0x10018160
push 0x20
pop eax
cmp word [ebp - 0x7ae], ax
jne 0x10018160
cmp dword [ebp - 0x7ac], 0
je 0x10018160
cmp dword [ebp - 0x7bc], 0
jle 0x10018160
cmp dword [ebp - 0x7b8], 0
jg 0x10018245
xor eax, eax
mov dword [ebp - 0xa74], eax
cmp dword [ebp - 0xa70], 1
je 0x10018245
mov ebx, dword [ebp - 0xa70]
jmp 0x100182ad
mov esi, dword [sym.IPHLPAPI.DLL_DisableMediaSense]
lea edi, [ebp - 0x3bc]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0x1002a1c8]
call esi
mov esi, dword [sym.IPHLPAPI.DLL_DisableMediaSense]
lea ecx, [ebp - 0x3bc]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x3bc], 0x28
call dword [0x1002a1c8]
call esi
test eax, eax
je 0x1001801a
mov esi, dword [sym.IPHLPAPI.DLL_DisableMediaSense]
lea eax, [ebp - 0x3a8]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0x1002a1c8]
call esi
mov esi, dword [sym.IPHLPAPI.DLL_DisableMediaSense]
lea eax, [ebp - 0x3a0]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0x1002a1c8]
call esi
cmp dword [ebp - 0xa7c], 0
lea esi, [ebp - 0x3a8]
lea edi, [ebp - 0xee0]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x10017fee
imul eax, dword [ebp - 0x3a0], 5
cdq
idiv ecx
add eax, dword [ebp - 0x3a8]
jmp 0x10017ffc
xor ebx, ebx
mov dword [ebp - 0xc0c], ebx
mov dword [ebp - 0xc08], ebx
jmp 0x1001801c
mov esi, dword [0x100290a8]
lea eax, [ebp - 0x748]
push ebx
push edi
push eax
mov ecx, esi
call dword [0x1002a1c8]
call esi
mov esi, dword [0x100290a8]
lea eax, [ebp - 0x738]
push ebx
push edi
push eax
mov ecx, esi
call dword [0x1002a1c8]
call esi
mov ebx, dword [ebp - 0xa70]
cmp ebx, 1
jne 0x100182ad
mov eax, dword [ebp - 0x768]
mov esi, dword [0x10029014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0x1002a1c8]
call esi
mov dword [ebp - 0xb44], eax
mov esi, dword [sym.IPHLPAPI.DLL_DisableMediaSense]
mov ecx, esi
push 1
push dword [ebp - 0xaac]
call dword [0x1002a1c8]
call esi
cmp dword [ebp - 0x76c], 0
mov dword [ebp - 0xb28], eax
mov dword [ebp - 0xa8c], 0x810
je 0x100182e8
mov dword [ebp - 0xa8c], 0x20812
cmp dword [ebp - 0xa74], 0
je 0x10018d92
mov eax, dword [ebp - 0x768]
mov ebx, dword [ebp - 0x764]
mov dword [ebp - 0xa9c], eax
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0xa7c], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x814]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa60]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xa78], eax
mov dword [ebp - 0xa80], eax
mov dword [ebp - 0xa90], eax
mov dword [ebp - 0xa84], eax
lea eax, [ebp - 0x458]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
xor eax, eax
lea edi, [ebp - 0x354]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0x10019c1d
mov edi, dword [ebp - 0xaac]
mov esi, dword [0x10029028]
mov ecx, esi
push 7
push edi
call dword [0x1002a1c8]
call esi
test eax, eax
je 0x100184be
mov esi, dword [0x10029034]
lea ecx, [ebp - 0x814]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x1002a1c8]
call esi
test eax, eax
je 0x100183d8
mov eax, dword [ebp - 0x800]
mov dword [ebp - 0xa78], eax
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0xa84], eax
mov esi, dword [0x10029008]
mov ecx, esi
push edi
call dword [0x1002a1c8]
call esi
mov edi, eax
mov dword [ebp - 0xae4], edi
test edi, edi
je 0x100184be
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd60], eax
mov dword [ebp - 0xab8], eax
lea eax, [ebp - 0x458]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov eax, dword [ebp - 0x740]
add esp, 0xc
sub eax, dword [ebp - 0x748]
xor ecx, ecx
mov esi, dword [0x1002900c]
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x744]
sub eax, dword [ebp - 0x73c]
mov dword [ebp - 0x450], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x458], 0x28
mov word [ebp - 0x44c], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x44a], ax
lea eax, [ebp - 0xd60]
push eax
push ecx
lea eax, [ebp - 0x458]
mov ecx, esi
push eax
push edi
call dword [0x1002a1c8]
call esi
mov dword [ebp - 0xa94], eax
test eax, eax
jne 0x100184c9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [ebp - 0xab8], eax
test eax, eax
jle 0x100184a9
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xab8], eax
test eax, eax
js 0x10018815
mov dword [ebp - 0xab8], 0x80004005
jmp 0x10018815
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
jmp 0x10019c1d
mov esi, dword [0x10029034]
lea ecx, [ebp - 0xa60]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x1002a1c8]
call esi
test eax, eax
je 0x100184f3
mov eax, dword [ebp - 0xa4c]
mov dword [ebp - 0xa80], eax
mov eax, dword [ebp - 0x740]
sub eax, dword [ebp - 0x748]
push dword [ebp - 0xa94]
mov esi, dword [0x1002903c]
mov ecx, esi
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x73c]
sub eax, dword [ebp - 0x744]
push edi
mov dword [ebp - 0x348], eax
call dword [0x1002a1c8]
call esi
mov esi, dword [sym.IPHLPAPI.DLL_DisableMediaSense]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0x1002a1c8]
call esi
push dword [ebp - 0xa7c]
mov esi, dword [0x1002903c]
mov ecx, esi
push edi
call dword [0x1002a1c8]
call esi
mov esi, dword [0x10029038]
mov ecx, esi
mov dword [ebp - 0xacc], eax
xor eax, eax
push eax
call dword [0x1002a1c8]
call esi
mov esi, dword [0x10029074]
mov ecx, esi
push eax
lea eax, [ebp - 0x354]
push eax
push edi
call dword [0x1002a1c8]
call esi
mov esi, dword [0x1002906c]
xor eax, eax
push eax
push dword [ebp - 0xa8c]
lea eax, [ebp - 0x354]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push edi
call dword [0x1002a1c8]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xa70], eax
jne 0x100185ea
cmp dword [ebp - 0xa9c], 0
je 0x100185de
mov esi, dword [0x1002908c]
mov ecx, esi
push 8
call dword [0x1002a1c8]
call esi
mov dword [ebp - 0xaa8], eax
jmp 0x100185f4
mov dword [ebp - 0xaa8], 0xffffff
jmp 0x100185f4
mov dword [ebp - 0xaa8], 0xffa8a8a8
mov edi, dword [ebp - 0x748]
xor edx, edx
mov eax, dword [ebp - 0x744]
mov esi, edx
mov ecx, edx
test edi, edi
jns 0x10018610
mov esi, edi
mov edi, edx
neg esi
test eax, eax
jns 0x1001861a
mov ecx, eax
mov eax, edx
neg ecx
mov ebx, dword [ebp - 0x34c]
mov edx, dword [ebp - 0xa90]
sub ebx, esi
sub edx, edi
mov dword [ebp - 0xaa4], ebx
cmp ebx, edx
jl 0x1001863c
mov ebx, edx
mov dword [ebp - 0xaa4], edx
mov edx, dword [ebp - 0x348]
sub dword [ebp - 0xa84], eax
sub edx, ecx
mov dword [ebp - 0xa74], edx
cmp edx, dword [ebp - 0xa84]
jl 0x10018664
mov edx, dword [ebp - 0xa84]
mov dword [ebp - 0xa74], edx
test ebx, ebx
jle 0x100187dd
test edx, edx
jle 0x100187dd
imul ecx, dword [ebp - 0x34c]
imul eax, dword [ebp - 0xa90]
add ecx, esi
mov esi, dword [ebp - 0xa80]
add eax, edi
lea esi, [esi + ecx*4]
mov ecx, dword [ebp - 0xa78]
mov dword [ebp - 0xabc], esi
lea eax, [ecx + eax*4]
mov dword [ebp - 0xab0], eax
test edx, edx
jle 0x100187dd
mov ecx, dword [ebp - 0x34c]
shl ecx, 2
mov dword [ebp - 0xa78], ecx
mov ecx, dword [ebp - 0xa90]
shl ecx, 2
mov dword [ebp - 0xaa0], ecx
mov ecx, dword [ebp - 0xa78]
mov edi, dword [ebp - 0xaa0]
test ebx, ebx
jle 0x100187be
mov edx, esi
mov dword [ebp - 0xa80], ebx
sub edx, eax
lea edi, [eax + 2]
mov dword [ebp - 0xa7c], edx
movzx eax, byte [edi + edx - 2]
movzx ecx, byte [edi + edx - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi + edx]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x10018788
mov eax, dword [ebp - 0xaa8]
movzx eax, al
movzx esi, cl
movzx ecx, byte [edi]
sub eax, ecx
mov ebx, dword [ebp - 0xa80]
imul eax, esi
mov ecx, 0xff
cdq
idiv ecx
add byte [edi], al
movzx ecx, byte [edi - 1]
mov eax, dword [ebp - 0xaa8]
movzx eax, ah
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 1], al
movzx ecx, byte [edi - 2]
movzx eax, byte [ebp - 0xaa6]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 2], al
mov eax, 0xff
movzx ecx, byte [edi + 1]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov edx, dword [ebp - 0xa7c]
add byte [edi + 1], al
add edi, 4
sub ebx, 1
mov dword [ebp - 0xa80], ebx
jne 0x100186f1
mov edx, dword [ebp - 0xa74]
mov ebx, dword [ebp - 0xaa4]
mov eax, dword [ebp - 0xab0]
mov esi, dword [ebp - 0xabc]
mov ecx, dword [ebp - 0xa78]
mov edi, dword [ebp - 0xaa0]
add esi, ecx
add eax, edi
sub edx, 1
mov dword [ebp - 0xabc], esi
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xa74], edx
jne 0x100186d6
push dword [ebp - 0xa94]
mov esi, dword [0x1002901c]
mov ecx, esi
call dword [0x1002a1c8]
call esi
mov eax, dword [ebp - 0xacc]
mov edi, dword [ebp - 0xae4]
test eax, eax
je 0x10018815
mov esi, dword [0x1002903c]
mov ecx, esi
push eax
push edi
call dword [0x1002a1c8]
call esi
mov esi, dword [0x10029018]
mov ecx, esi
push edi
call dword [0x1002a1c8]
call esi
cmp dword [ebp - 0xab8], 0
jl 0x10019c1d
mov eax, dword [ebp - 0x768]
mov ebx, dword [ebp - 0x760]
mov dword [ebp - 0xa9c], eax
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0xa7c], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x910]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x9b8]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xa78], eax
mov dword [ebp - 0xa80], eax
mov dword [ebp - 0xa90], eax
mov dword [ebp - 0xa84], eax
lea eax, [ebp - 0x484]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
xor eax, eax
lea edi, [ebp - 0x364]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0x10019c1d
mov edi, dword [ebp - 0xaac]
mov esi, dword [0x10029028]
mov ecx, esi
push 7
push edi
call dword [0x1002a1c8]
call esi
test eax, eax
je 0x100184be
mov esi, dword [0x10029034]
lea ecx, [ebp - 0x910]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x1002a1c8]
call esi
test eax, eax
je 0x10018916
mov eax, dword [ebp - 0x8fc]
mov dword [ebp - 0xa78], eax
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0x908]
mov dword [ebp - 0xa84], eax
mov esi, dword [0x10029008]
mov ecx, esi
push edi
call dword [0x1002a1c8]
call esi
mov edi, eax
mov dword [ebp - 0xacc], edi
test edi, edi
je 0x100184be
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd64], eax
mov dword [ebp - 0xab8], eax
lea eax, [ebp - 0x484]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov eax, dword [ebp - 0x730]
add esp, 0xc
sub eax, dword [ebp - 0x738]
xor ecx, ecx
mov esi, dword [0x1002900c]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x734]
sub eax, dword [ebp - 0x72c]
mov dword [ebp - 0x47c], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x484], 0x28
mov word [ebp - 0x478], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x476], ax
lea eax, [ebp - 0xd64]
push eax
push ecx
lea eax, [ebp - 0x484]
mov ecx, esi
push eax
push edi
call dword [0x1002a1c8]
call esi
mov dword [ebp - 0xae4], eax
test eax, eax
jne 0x100189fc
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [ebp - 0xab8], eax
test eax, eax
jle 0x100189e7
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xab8], eax
test eax, eax
js 0x10018d69
mov dword [ebp - 0xab8], 0x80004005
jmp 0x10018d69
mov esi, dword [0x10029034]
lea ecx, [ebp - 0x9b8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x1002a1c8]
call esi
test eax, eax
je 0x10018a26
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0xa80], eax
mov eax, dword [ebp - 0x730]
sub eax, dword [ebp - 0x738]
push dword [ebp - 0xae4]
mov esi, dword [0x1002903c]
mov ecx, esi
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x72c]
sub eax, dword [ebp - 0x734]
push edi
mov dword [ebp - 0x358], eax
call dword [0x1002a1c8]
call esi
mov esi, dword [sym.IPHLPAPI.DLL_DisableMediaSense]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0x1002a1c8]
call esi
push dword [ebp - 0xa7c]
mov esi, dword [0x1002903c]
mov ecx, esi
push edi
call dword [0x1002a1c8]
call esi
mov esi, dword [0x10029038]
mov ecx, esi
mov dword [ebp - 0xad8], eax
xor eax, eax
push eax
call dword [0x1002a1c8]
call esi
mov esi, dword [0x10029074]
mov ecx, esi
push eax
lea eax, [ebp - 0x364]
push eax
push edi
call dword [0x1002a1c8]
call esi
mov esi, dword [0x1002906c]
xor eax, eax
push eax
push dword [ebp - 0xa8c]
lea eax, [ebp - 0x364]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push edi
call dword [0x1002a1c8]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xa70], eax
jne 0x10018b25
cmp dword [ebp - 0xa9c], 0
je 0x10018b19
mov esi, dword [0x1002908c]
mov ecx, esi
push 8
call dword [0x1002a1c8]
call esi
mov ebx, eax
mov dword [ebp - 0xa6c], ebx
mov dword [ebp - 0xab0], ebx
jmp 0x10018b36
mov dword [ebp - 0xab0], 0xffffff
jmp 0x10018b36
mov eax, 0xffa8a8a8
mov dword [ebp - 0xa6c], eax
mov dword [ebp - 0xab0], eax
mov edx, dword [ebp - 0x738]
xor ebx, ebx
mov eax, dword [ebp - 0x734]
mov esi, ebx
mov dword [ebp - 0xa74], edx
mov ecx, ebx
test edx, edx
jns 0x10018b5c
mov esi, edx
mov dword [ebp - 0xa74], ebx
neg esi
test eax, eax
jns 0x10018b66
mov ecx, eax
mov eax, ebx
neg ecx
mov ebx, dword [ebp - 0x35c]
mov edx, dword [ebp - 0xa90]
sub ebx, esi
sub edx, dword [ebp - 0xa74]
mov dword [ebp - 0xaa4], ebx
cmp ebx, edx
jl 0x10018b8c
mov ebx, edx
mov dword [ebp - 0xaa4], edx
mov edx, dword [ebp - 0x358]
sub dword [ebp - 0xa84], eax
sub edx, ecx
mov dword [ebp - 0xa94], edx
cmp edx, dword [ebp - 0xa84]
jl 0x10018bb4
mov edx, dword [ebp - 0xa84]
mov dword [ebp - 0xa94], edx
test ebx, ebx
jle 0x10018d37
test edx, edx
jle 0x10018d37
imul ecx, dword [ebp - 0x35c]
imul eax, dword [ebp - 0xa90]
add ecx, esi
mov esi, dword [ebp - 0xa80]
add eax, dword [ebp - 0xa74]
lea esi, [esi + ecx*4]
mov ecx, dword [ebp - 0xa78]
mov dword [ebp - 0xabc], esi
lea eax, [ecx + eax*4]
mov dword [ebp - 0xa74], eax
test edx, edx
jle 0x10018d37
mov ecx, dword [ebp - 0x35c]
shl ecx, 2
mov dword [ebp - 0xa78], ecx
mov ecx, dword [ebp - 0xa90]
shl ecx, 2
mov dword [ebp - 0xaa0], ecx
mov ecx, dword [ebp - 0xa78]
mov edi, dword [ebp - 0xaa0]
test ebx, ebx
jle 0x10018d12
mov edx, esi
mov dword [ebp - 0xa80], ebx
sub edx, eax
lea edi, [eax + 2]
mov dword [ebp - 0xa7c], edx
movzx eax, byte [edi + edx - 2]
movzx ecx, byte [edi + edx - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi + edx]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x10018cdc
mov eax, dword [ebp - 0xa6c]
movzx eax, al
movzx esi, cl
movzx ecx, byte [edi]
sub eax, ecx
mov ebx, dword [ebp - 0xa80]
imul eax, esi
mov ecx, 0xff
cdq
idiv ecx
add byte [edi], al
movzx ecx, byte [edi - 1]
mov eax, dword [ebp - 0xa6c]
movzx eax, ah
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 1], al
movzx ecx, byte [edi - 2]
movzx eax, byte [ebp - 0xaae]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 2], al
mov eax, 0xff
movzx ecx, byte [edi + 1]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov edx, dword [ebp - 0xa7c]
add byte [edi + 1], al
add edi, 4
sub ebx, 1
mov dword [ebp - 0xa80], ebx
jne 0x10018c45
mov edx, dword [ebp - 0xa94]
mov ebx, dword [ebp - 0xaa4]
mov eax, dword [ebp - 0xa74]
mov esi, dword [ebp - 0xabc]
mov ecx, dword [ebp - 0xa78]
mov edi, dword [ebp - 0xaa0]
add esi, ecx
add eax, edi
sub edx, 1
mov dword [ebp - 0xabc], esi
mov dword [ebp - 0xa74], eax
mov dword [ebp - 0xa94], edx
jne 0x10018c2a
mov edi, dword [ebp - 0xacc]
push dword [ebp - 0xae4]
mov esi, dword [0x1002901c]
mov ecx, esi
call dword [0x1002a1c8]
call esi
mov eax, dword [ebp - 0xad8]
test eax, eax
je 0x10018d69
mov esi, dword [0x1002903c]
mov ecx, esi
push eax
push edi
call dword [0x1002a1c8]
call esi
mov esi, dword [0x10029018]
mov ecx, esi
push edi
call dword [0x1002a1c8]
call esi
cmp dword [ebp - 0xab8], 0
jl 0x10019c1d
mov edi, dword [ebp - 0xa98]
jmp 0x10019bc9
xor edx, edx
inc edx
cmp dword [ebp - 0x768], 0
jne 0x10018da6
cmp ebx, edx
je 0x10018da6
mov al, 0xc0
jmp 0x10018da8
or al, 0xff
mov byte [ebp - 0xada], al
lea edi, [ebp - 0xc80]
xor eax, eax
mov esi, dword [0x10029008]
stosd dword es:[edi], eax
xor ecx, ecx
push dword [ebp - 0xaac]
mov byte [ebp - 0xadc], cl
mov byte [ebp - 0xadb], cl
mov ecx, esi
stosd dword es:[edi], eax
mov byte [ebp - 0xad9], dl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xcb0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [0x1002a1c8]
call esi
mov dword [ebp - 0xa98], eax
test eax, eax
jne 0x10018e05
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
jmp 0x10019c1d
xor eax, eax
inc eax
cmp ebx, eax
jne 0x10018f04
mov eax, dword [ebp - 0x740]
mov ecx, dword [ebp - 0x730]
mov ebx, dword [ebp - 0x748]
sub eax, ebx
mov edi, dword [ebp - 0x738]
sub ecx, edi
cmp ecx, eax
jle 0x10018e3a
mov edx, ecx
mov dword [ebp - 0xad4], edx
jmp 0x10018e42
mov edx, eax
mov dword [ebp - 0xad4], eax
mov esi, dword [ebp - 0x72c]
sub esi, dword [ebp - 0x744]
cmp dword [ebp - 0x76c], 0
mov dword [ebp - 0xaa8], esi
je 0x10018e7b
sub ebx, dword [ebp - 0x740]
sub edi, dword [ebp - 0x730]
add ebx, edx
add edi, edx
mov dword [ebp - 0xc80], ebx
mov dword [ebp - 0xcb0], edi
jmp 0x10018e87
mov ebx, dword [ebp - 0xc80]
mov edi, dword [ebp - 0xcb0]
add eax, ebx
mov dword [ebp - 0xa74], ebx
mov ebx, dword [ebp - 0x73c]
sub ebx, dword [ebp - 0x744]
mov dword [ebp - 0xa90], eax
mov dword [ebp - 0xc78], eax
mov eax, dword [ebp - 0x734]
sub eax, dword [ebp - 0x744]
mov dword [ebp - 0xab0], ebx
mov dword [ebp - 0xc74], ebx
mov ebx, eax
sub ebx, dword [ebp - 0x734]
mov dword [ebp - 0xb00], edi
add edi, ecx
add ebx, dword [ebp - 0x72c]
mov dword [ebp - 0xa94], ebx
mov dword [ebp - 0xca4], ebx
mov ebx, dword [ebp - 0xad4]
mov dword [ebp - 0xac0], edi
mov dword [ebp - 0xca8], edi
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xcac], eax
jmp 0x10018f96
mov eax, dword [ebp - 0xc00]
lea esi, [ebp - 0x748]
lea edi, [ebp - 0xc80]
mov ebx, dword [ebp - 0xc04]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xaa8], eax
mov dword [ebp - 0xad4], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xc74]
lea esi, [ebp - 0x738]
lea edi, [ebp - 0xcb0]
mov dword [ebp - 0xab0], eax
mov eax, dword [ebp - 0xc78]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0xc80]
mov dword [ebp - 0xa74], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xca4]
mov esi, dword [ebp - 0xaa8]
mov dword [ebp - 0xa94], eax
mov eax, dword [ebp - 0xca8]
mov dword [ebp - 0xac0], eax
mov eax, dword [ebp - 0xcac]
mov dword [ebp - 0xad8], eax
mov eax, dword [ebp - 0xcb0]
mov dword [ebp - 0xb00], eax
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd68], eax
lea eax, [ebp - 0x4b0]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov edi, dword [ebp - 0xa98]
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x4b0], 0x28
inc eax
mov dword [ebp - 0x4ac], ebx
mov word [ebp - 0x4a4], ax
xor ecx, ecx
push 0x20
pop eax
push ecx
push ecx
mov word [ebp - 0x4a2], ax
neg esi
lea eax, [ebp - 0xd68]
mov dword [ebp - 0x4a8], esi
mov esi, dword [0x1002900c]
push eax
push ecx
lea eax, [ebp - 0x4b0]
mov ecx, esi
push eax
push edi
call dword [0x1002a1c8]
call esi
mov dword [ebp - 0xaf0], eax
test eax, eax
jne 0x1001901b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
jmp 0x10019c08
mov esi, dword [0x1002903c]
mov ecx, esi
push eax
push edi
call dword [0x1002a1c8]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xa70], eax
jne 0x1001908c
mov ecx, dword [ebp - 0xb44]
test ecx, ecx
je 0x1001908c
mov esi, dword [0x10029074]
lea edi, [ebp - 0x390]
xor eax, eax
stosd dword es:[edi], eax
push ecx
mov ecx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x394], eax
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0xaa8]
mov dword [ebp - 0x388], eax
lea eax, [ebp - 0x394]
push eax
mov eax, dword [ebp - 0xa98]
push eax
mov dword [ebp - 0x38c], ebx
call dword [0x1002a1c8]
call esi
mov eax, dword [ebp - 0x768]
mov ebx, dword [ebp - 0x764]
mov dword [ebp - 0xa9c], eax
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0xa7c], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x868]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa0c]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
xor ecx, ecx
lea eax, [ebp - 0x4dc]
push 0x2c
push ecx
push eax
mov dword [ebp - 0xaa0], ecx
mov dword [ebp - 0xaa4], ecx
mov dword [ebp - 0xab8], ecx
mov dword [ebp - 0xa80], ecx
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
xor eax, eax
lea edi, [ebp - 0x374]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xa98]
test ebx, ebx
je 0x10019bed
mov esi, dword [0x10029028]
mov ecx, esi
push 7
push edi
call dword [0x1002a1c8]
call esi
test eax, eax
je 0x1001925d
mov esi, dword [0x10029034]
lea ecx, [ebp - 0x868]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x1002a1c8]
call esi
test eax, eax
je 0x1001916f
mov eax, dword [ebp - 0x854]
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0xa80], eax
mov esi, dword [0x10029008]
mov ecx, esi
push edi
call dword [0x1002a1c8]
call esi
mov esi, eax
mov dword [ebp - 0xa68], esi
test esi, esi
je 0x1001925d
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd6c], eax
mov dword [ebp - 0xad0], eax
lea eax, [ebp - 0x4dc]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov eax, dword [ebp - 0xa90]
add esp, 0xc
mov edi, dword [ebp - 0xa74]
xor ecx, ecx
sub eax, edi
mov dword [ebp - 0x4dc], 0x28
mov dword [ebp - 0xa90], eax
mov dword [ebp - 0x4d8], eax
mov eax, dword [ebp - 0xc7c]
sub eax, dword [ebp - 0xab0]
mov dword [ebp - 0x4d4], eax
xor eax, eax
push 0x20
inc eax
mov word [ebp - 0x4d0], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x4ce], ax
lea eax, [ebp - 0xd6c]
push eax
push ecx
lea eax, [ebp - 0x4dc]
push eax
push esi
mov esi, dword [0x1002900c]
mov ecx, esi
call dword [0x1002a1c8]
call esi
mov dword [ebp - 0xae4], eax
test eax, eax
jne 0x10019268
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [ebp - 0xad0], eax
test eax, eax
jle 0x10019248
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xad0], eax
test eax, eax
js 0x100195d2
mov dword [ebp - 0xad0], 0x80004005
jmp 0x100195d2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
jmp 0x10019bed
mov esi, dword [0x10029034]
lea ecx, [ebp - 0xa0c]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x1002a1c8]
call esi
test eax, eax
je 0x10019292
mov eax, dword [ebp - 0x9f8]
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0xa90]
push dword [ebp - 0xae4]
mov esi, dword [0x1002903c]
mov ecx, esi
push dword [ebp - 0xa68]
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0xab0]
sub eax, dword [ebp - 0xc7c]
mov dword [ebp - 0x368], eax
call dword [0x1002a1c8]
call esi
mov esi, dword [sym.IPHLPAPI.DLL_DisableMediaSense]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xa68]
call dword [0x1002a1c8]
call esi
push dword [ebp - 0xa7c]
mov esi, dword [0x1002903c]
mov ecx, esi
push dword [ebp - 0xa68]
call dword [0x1002a1c8]
call esi
mov esi, dword [0x10029038]
mov ecx, esi
mov dword [ebp - 0xacc], eax
xor eax, eax
push eax
call dword [0x1002a1c8]
call esi
mov esi, dword [0x10029074]
mov ecx, esi
push eax
lea eax, [ebp - 0x374]
push eax
push dword [ebp - 0xa68]
call dword [0x1002a1c8]
call esi
mov esi, dword [0x1002906c]
xor eax, eax
push eax
push dword [ebp - 0xa8c]
lea eax, [ebp - 0x374]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push dword [ebp - 0xa68]
call dword [0x1002a1c8]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xa70], eax
jne 0x1001939c
cmp dword [ebp - 0xa9c], 0
je 0x10019390
mov esi, dword [0x1002908c]
mov ecx, esi
push 8
call dword [0x1002a1c8]
call esi
mov dword [ebp - 0xa84], eax
jmp 0x100193a6
mov dword [ebp - 0xa84], 0xffffff
jmp 0x100193a6
mov dword [ebp - 0xa84], 0xffa8a8a8
xor eax, eax
mov dword [ebp - 0xa78], eax
mov ecx, eax
mov esi, eax
test edi, edi
jns 0x100193c2
mov ecx, edi
mov edi, eax
neg ecx
mov dword [ebp - 0xa78], ecx
mov ebx, dword [ebp - 0xc7c]
test ebx, ebx
jns 0x100193d2
mov esi, ebx
mov ebx, eax
neg esi
mov eax, dword [ebp - 0xab8]
mov edx, dword [ebp - 0x36c]
sub eax, edi
sub edx, ecx
mov dword [ebp - 0xabc], edx
cmp edx, eax
jl 0x100193f4
mov edx, eax
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0xa80]
mov ecx, dword [ebp - 0x368]
sub eax, ebx
sub ecx, esi
mov dword [ebp - 0xab0], ecx
cmp ecx, eax
jl 0x10019416
mov ecx, eax
mov dword [ebp - 0xab0], eax
test edx, edx
jle 0x1001959b
test ecx, ecx
jle 0x1001959b
mov eax, dword [ebp - 0x36c]
imul eax, esi
mov esi, dword [ebp - 0xaa4]
add eax, dword [ebp - 0xa78]
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xaa0]
mov dword [ebp - 0xa74], eax
mov eax, dword [ebp - 0xab8]
imul eax, ebx
add eax, edi
lea eax, [esi + eax*4]
mov dword [ebp - 0xaa0], eax
test ecx, ecx
jle 0x1001959b
mov ebx, dword [ebp - 0x36c]
shl ebx, 2
mov dword [ebp - 0xa78], ebx
mov ebx, dword [ebp - 0xab8]
mov esi, dword [ebp - 0xa78]
shl ebx, 2
mov dword [ebp - 0xaa4], ebx
mov ebx, dword [ebp - 0xa74]
mov edi, dword [ebp - 0xaa4]
test edx, edx
jle 0x1001957c
sub ebx, eax
mov dword [ebp - 0xa80], edx
lea edi, [eax + 2]
mov dword [ebp - 0xa7c], ebx
movzx eax, byte [edi + ebx - 2]
movzx ecx, byte [edi + ebx - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi + ebx]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x10019546
mov eax, dword [ebp - 0xa84]
movzx eax, al
movzx esi, cl
movzx ecx, byte [edi]
sub eax, ecx
mov ebx, dword [ebp - 0xa7c]
imul eax, esi
mov ecx, 0xff
cdq
idiv ecx
add byte [edi], al
movzx ecx, byte [edi - 1]
mov eax, dword [ebp - 0xa84]
movzx eax, ah
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 1], al
movzx ecx, byte [edi - 2]
movzx eax, byte [ebp - 0xa82]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 2], al
mov eax, 0xff
movzx ecx, byte [edi + 1]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov edx, dword [ebp - 0xa80]
add byte [edi + 1], al
add edi, 4
sub edx, 1
mov dword [ebp - 0xa80], edx
jne 0x100194af
mov ecx, dword [ebp - 0xab0]
mov edx, dword [ebp - 0xabc]
mov eax, dword [ebp - 0xaa0]
mov ebx, dword [ebp - 0xa74]
mov esi, dword [ebp - 0xa78]
mov edi, dword [ebp - 0xaa4]
add ebx, esi
add eax, edi
sub ecx, 1
mov dword [ebp - 0xa74], ebx
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0xab0], ecx
jne 0x10019496
push dword [ebp - 0xae4]
mov esi, dword [0x1002901c]
mov ecx, esi
call dword [0x1002a1c8]
call esi
mov eax, dword [ebp - 0xacc]
test eax, eax
je 0x100195d2
mov esi, dword [0x1002903c]
mov ecx, esi
push eax
push dword [ebp - 0xa68]
call dword [0x1002a1c8]
call esi
push dword [ebp - 0xa68]
mov esi, dword [0x10029018]
mov ecx, esi
call dword [0x1002a1c8]
call esi
cmp dword [ebp - 0xad0], 0
jl 0x10019be7
mov eax, dword [ebp - 0x768]
mov ebx, dword [ebp - 0x760]
mov dword [ebp - 0xa9c], eax
mov eax, dword [ebp - 0x754]
mov dword [ebp - 0xa7c], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x8bc]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x964]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xa78], eax
mov dword [ebp - 0xa80], eax
mov dword [ebp - 0xa90], eax
mov dword [ebp - 0xa84], eax
lea eax, [ebp - 0x508]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
xor eax, eax
lea edi, [ebp - 0x384]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xa98]
test ebx, ebx
je 0x10019bed
mov esi, dword [0x10029028]
mov ecx, esi
push 7
push edi
call dword [0x1002a1c8]
call esi
test eax, eax
je 0x1001925d
mov esi, dword [0x10029034]
lea ecx, [ebp - 0x8bc]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x1002a1c8]
call esi
test eax, eax
je 0x100196d8
mov eax, dword [ebp - 0x8a8]
mov dword [ebp - 0xa78], eax
mov eax, dword [ebp - 0x8b8]
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0xa84], eax
mov esi, dword [0x10029008]
mov ecx, esi
push edi
call dword [0x1002a1c8]
call esi
mov esi, eax
mov dword [ebp - 0xa68], esi
test esi, esi
je 0x1001925d
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd70], eax
mov dword [ebp - 0xab8], eax
lea eax, [ebp - 0x508]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov eax, dword [ebp - 0xac0]
add esp, 0xc
sub eax, dword [ebp - 0xb00]
xor ecx, ecx
mov edi, dword [ebp - 0xad8]
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0x504], eax
mov eax, edi
sub eax, dword [ebp - 0xa94]
mov dword [ebp - 0x500], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x508], 0x28
mov word [ebp - 0x4fc], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x4fa], ax
lea eax, [ebp - 0xd70]
push eax
push ecx
lea eax, [ebp - 0x508]
push eax
push esi
mov esi, dword [0x1002900c]
mov ecx, esi
call dword [0x1002a1c8]
call esi
mov dword [ebp - 0xabc], eax
test eax, eax
jne 0x100197c6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov dword [ebp - 0xab8], eax
test eax, eax
jle 0x100197b1
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xab8], eax
test eax, eax
js 0x10019b1d
mov dword [ebp - 0xab8], 0x80004005
jmp 0x10019b1d
mov esi, dword [0x10029034]
lea ecx, [ebp - 0x964]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x1002a1c8]
call esi
test eax, eax
je 0x100197f0
mov eax, dword [ebp - 0x950]
mov dword [ebp - 0xa80], eax
mov eax, dword [ebp - 0xac0]
push dword [ebp - 0xabc]
mov esi, dword [0x1002903c]
mov ecx, esi
push dword [ebp - 0xa68]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0xa94]
sub eax, edi
mov dword [ebp - 0x378], eax
call dword [0x1002a1c8]
call esi
mov esi, dword [sym.IPHLPAPI.DLL_DisableMediaSense]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xa68]
call dword [0x1002a1c8]
call esi
push dword [ebp - 0xa7c]
mov esi, dword [0x1002903c]
mov ecx, esi
push dword [ebp - 0xa68]
call dword [0x1002a1c8]
call esi
mov esi, dword [0x10029038]
mov ecx, esi
mov dword [ebp - 0xa94], eax
xor eax, eax
push eax
call dword [0x1002a1c8]
call esi
mov esi, dword [0x10029074]
mov ecx, esi
push eax
lea eax, [ebp - 0x384]
push eax
push dword [ebp - 0xa68]
call dword [0x1002a1c8]
call esi
mov esi, dword [0x1002906c]
xor eax, eax
push eax
push dword [ebp - 0xa8c]
lea eax, [ebp - 0x384]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push dword [ebp - 0xa68]
call dword [0x1002a1c8]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xa70], eax
jne 0x100198fe
cmp dword [ebp - 0xa9c], 0
je 0x100198f2
mov esi, dword [0x1002908c]
mov ecx, esi
push 8
call dword [0x1002a1c8]
call esi
mov ecx, eax
mov dword [ebp - 0xa6c], ecx
mov dword [ebp - 0xa74], ecx
jmp 0x1001990f
mov dword [ebp - 0xa74], 0xffffff
jmp 0x1001990f
mov eax, 0xffa8a8a8
mov dword [ebp - 0xa6c], eax
mov dword [ebp - 0xa74], eax
mov ebx, dword [ebp - 0xb00]
xor ecx, ecx
mov esi, ecx
mov eax, ecx
test ebx, ebx
jns 0x10019925
mov esi, ebx
mov ebx, ecx
neg esi
test edi, edi
jns 0x1001992f
mov eax, edi
mov edi, ecx
neg eax
mov edx, dword [ebp - 0x37c]
mov ecx, dword [ebp - 0xa90]
sub edx, esi
sub ecx, ebx
mov dword [ebp - 0xaa4], edx
cmp edx, ecx
jl 0x10019951
mov edx, ecx
mov dword [ebp - 0xaa4], ecx
mov ecx, dword [ebp - 0x378]
sub dword [ebp - 0xa84], edi
sub ecx, eax
mov dword [ebp - 0xab0], ecx
cmp ecx, dword [ebp - 0xa84]
jl 0x10019979
mov ecx, dword [ebp - 0xa84]
mov dword [ebp - 0xab0], ecx
test edx, edx
jle 0x10019ae6
test ecx, ecx
jle 0x10019ae6
imul eax, dword [ebp - 0x37c]
imul edi, dword [ebp - 0xa90]
add eax, esi
mov esi, dword [ebp - 0xa80]
add edi, ebx
lea esi, [esi + eax*4]
mov eax, dword [ebp - 0xa78]
mov dword [ebp - 0xaa0], esi
lea eax, [eax + edi*4]
mov dword [ebp - 0xa78], eax
test ecx, ecx
jle 0x10019ae6
mov ebx, dword [ebp - 0x37c]
mov edi, dword [ebp - 0xa90]
shl ebx, 2
shl edi, 2
mov dword [ebp - 0xa9c], ebx
mov dword [ebp - 0xacc], edi
test edx, edx
jle 0x10019ac7
mov ebx, esi
mov dword [ebp - 0xa80], edx
sub ebx, eax
lea edi, [eax + 2]
mov dword [ebp - 0xa7c], ebx
movzx eax, byte [edi + ebx - 2]
movzx ecx, byte [edi + ebx - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi + ebx]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x10019a91
mov eax, dword [ebp - 0xa6c]
movzx eax, al
movzx esi, cl
movzx ecx, byte [edi]
sub eax, ecx
mov ebx, dword [ebp - 0xa7c]
imul eax, esi
mov ecx, 0xff
cdq
idiv ecx
add byte [edi], al
movzx ecx, byte [edi - 1]
mov eax, dword [ebp - 0xa6c]
movzx eax, ah
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 1], al
movzx ecx, byte [edi - 2]
movzx eax, byte [ebp - 0xa72]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 2], al
mov eax, 0xff
movzx ecx, byte [edi + 1]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov edx, dword [ebp - 0xa80]
add byte [edi + 1], al
add edi, 4
sub edx, 1
mov dword [ebp - 0xa80], edx
jne 0x100199fa
mov ecx, dword [ebp - 0xab0]
mov edx, dword [ebp - 0xaa4]
mov eax, dword [ebp - 0xa78]
mov esi, dword [ebp - 0xaa0]
mov ebx, dword [ebp - 0xa9c]
mov edi, dword [ebp - 0xacc]
add esi, ebx
add eax, edi
sub ecx, 1
mov dword [ebp - 0xaa0], esi
mov dword [ebp - 0xa78], eax
mov dword [ebp - 0xab0], ecx
jne 0x100199df
push dword [ebp - 0xabc]
mov esi, dword [0x1002901c]
mov ecx, esi
call dword [0x1002a1c8]
call esi
mov eax, dword [ebp - 0xa94]
test eax, eax
je 0x10019b1d
mov esi, dword [0x1002903c]
mov ecx, esi
push eax
push dword [ebp - 0xa68]
call dword [0x1002a1c8]
call esi
push dword [ebp - 0xa68]
mov esi, dword [0x10029018]
mov ecx, esi
call dword [0x1002a1c8]
call esi
cmp dword [ebp - 0xab8], 0
mov edi, dword [ebp - 0xa98]
jl 0x10019bed
xor eax, eax
inc eax
cmp dword [ebp - 0xa70], eax
jne 0x10019b8c
mov esi, dword [section..data]
xor eax, eax
push 0xcc0020
push eax
push eax
mov eax, dword [ebp - 0xad4]
mov ecx, esi
push edi
push dword [ebp - 0xaa8]
push eax
push dword [ebp - 0x744]
push dword [ebp - 0x748]
push dword [ebp - 0xaac]
call dword [0x1002a1c8]
call esi
jmp 0x10019bc9
push dword [ebp - 0xadc]
mov ecx, dword [ebp - 0xaa8]
xor edx, edx
mov eax, dword [ebp - 0xad4]
mov esi, dword [0x10029020]
push ecx
push eax
push edx
push edx
push edi
push ecx
push eax
push dword [ebp - 0xc08]
mov ecx, esi
push dword [ebp - 0xc0c]
push dword [ebp - 0xaac]
call dword [0x1002a1c8]
call esi
push dword [ebp - 0xb28]
mov esi, dword [sym.IPHLPAPI.DLL_DisableMediaSense]
mov ecx, esi
push dword [ebp - 0xaac]
call dword [0x1002a1c8]
call esi
jmp 0x10019bed
mov edi, dword [ebp - 0xa98]
mov eax, dword [ebp - 0xaf0]
test eax, eax
je 0x10019c08
mov esi, dword [0x1002901c]
mov ecx, esi
push eax
call dword [0x1002a1c8]
call esi
test edi, edi
je 0x10019c1d
mov esi, dword [0x10029018]
mov ecx, esi
push edi
call dword [0x1002a1c8]
call esi
mov eax, dword [ebp - 0xb44]
test eax, eax
je 0x10019c38
mov esi, dword [0x1002901c]
mov ecx, esi
push eax
call dword [0x1002a1c8]
call esi
mov edi, 0x100297c8
mov ebx, dword [ebp - 0x764]
xor edx, edx
test ebx, ebx
je 0x10019c90
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0x10019c4c
mov eax, dword [ebp - 0x764]
sub ebx, ecx
sar ebx, 1
lea ebx, [ebx*2 + 2]
test ebx, ebx
je 0x10019c74
mov byte [eax], dl
inc eax
sub ebx, 1
jne 0x10019c6c
push dword [ebp - 0x764]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0x764], edx
mov ebx, dword [ebp - 0x760]
test ebx, ebx
je 0x10019ce3
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0x10019c9d
mov eax, dword [ebp - 0x760]
sub ebx, ecx
sar ebx, 1
lea ebx, [ebx*2 + 2]
test ebx, ebx
je 0x10019cc5
mov byte [eax], dl
inc eax
sub ebx, 1
jne 0x10019cbd
push dword [ebp - 0x760]
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
mov dword [ebp - 0x760], ebx
jmp 0x10019ce5
xor ebx, ebx
mov edx, dword [ebp - 0x75c]
test edx, edx
je 0x10019d31
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10019cf4
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x10019d1c
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0x10019d0e
mov edx, dword [ebp - 0x75c]
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
mov dword [ebp - 0x75c], ebx
cmp dword [ebp - 0x758], 0
je 0x10019d56
push dword [ebp - 0x758]
mov esi, dword [0x1002901c]
mov ecx, esi
call dword [0x1002a1c8]
call esi
mov dword [ebp - 0x758], ebx
cmp dword [ebp - 0x754], 0
je 0x10019d7b
push dword [ebp - 0x754]
mov esi, dword [0x1002901c]
mov ecx, esi
call dword [0x1002a1c8]
call esi
mov dword [ebp - 0x754], ebx
cmp dword [ebp - 0x750], 0
je 0x10019da0
push dword [ebp - 0x750]
mov esi, dword [0x1002901c]
mov ecx, esi
call dword [0x1002a1c8]
call esi
mov dword [ebp - 0x750], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x10019da2
mov eax, dword [0x1002977c]
push 0
pop ebx
test eax, eax
jle 0x10019e04
sub eax, 1
mov dword [0x1002977c], eax
jne 0x10019e04
mov esi, ebx
mov eax, dword [esi + 0x10029788]
test eax, eax
je 0x10019dd8
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x10019dc7
push 0x40
push ebx
push 0x10029788
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x100010a0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x100297c8
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0x10029778]
mov esi, dword [0x1002904c]
mov ecx, esi
mov dword [ebp - 0xacc], eax
call dword [0x1002a1c8]
call esi
sub eax, dword [0x10029770]
lea edi, [ebp - 0x2e0]
push 8
mov dword [ebp - 0xa9c], eax
mov esi, 0x100297c8
xor eax, eax
xor ebx, ebx
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0x10019e43
mov eax, dword [0x1002977c]
push 0
pop ebx
test eax, eax
jne 0x1001a44d
push 0x338
mov esi, ebx
mov dword [ebp - 0xa74], ebx
push ebx
mov dword [ebp - 0xa70], ebx
mov dword [ebp - 0xa98], esi
mov dword [ebp - 0xa78], ebx
mov dword [ebp - 0xbec], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov dword [ebp - 0xbcc], eax
test eax, eax
je 0x1001a441
or dword [ebp - 0xb88], 0xffffffff
mov cl, bl
add eax, 7
mov dword [ebp - 0xb8c], ebx
mov dword [ebp - 0xb58], esi
mov dword [ebp - 0xb74], ebx
mov dword [ebp - 0xa80], eax
mov edi, dword [ebp - 0xb5c]
movzx edx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl edx, 8
or edx, eax
movzx eax, byte [edi]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl edx, 8
or edx, eax
shl edi, 8
mov eax, dword [ebp - 0xb5c]
xor ebx, edx
mov dword [ebp - 0xbc4], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb5c]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb5c]
shl edi, 8
add dword [ebp - 0xb5c], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, ebx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub edx, eax
xor esi, edx
lea eax, [esi - 0x137f]
imul edx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xa7c], esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea esi, [ebx - 0x7f1]
xor esi, dword [ebp - 0xa7c]
xor esi, 0xab69605e
mov eax, esi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, esi
shr eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 7
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor ebx, edx
mov eax, ebx
mov dword [ebp - 0xa7c], ebx
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 7
add edx, eax
xor esi, edx
mov ebx, esi
xor ebx, dword [ebp - 0xa7c]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor esi, eax
lea eax, [esi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xe
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xb88]
rol eax, 2
mov dword [ebp - 0xb58], esi
mov dword [ebp - 0xb88], edi
xor edx, eax
xor edx, dword [ebp - 0xb8c]
xor ebx, edx
mov edx, dword [ebp - 0xa80]
mov dword [ebp - 0xb74], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb58]
ror dword [ebp - 0xb74], 8
mov byte [edx], al
mov al, byte [ebp - 0xb74]
ror dword [ebp - 0xb58], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb58]
ror dword [ebp - 0xb74], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb74]
ror dword [ebp - 0xb58], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb58]
ror dword [ebp - 0xb74], 8
mov byte [edx - 2], al
ror dword [ebp - 0xb58], 8
mov al, byte [ebp - 0xb74]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb58]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [ebp - 0xb74]
mov esi, dword [ebp - 0xb58]
mov eax, dword [ebp - 0xbc4]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xb90], 1
mov dword [ebp - 0xb74], ebx
mov dword [ebp - 0xb58], esi
mov dword [ebp - 0xb8c], eax
mov dword [ebp - 0xa80], edx
jne 0x10019ec5
mov esi, dword [ebp - 0xbcc]
xor eax, eax
mov ebx, 0x338
xor cl, byte [eax + esi]
inc eax
cmp eax, ebx
jb 0x1001a21b
movzx eax, cl
cdq
cmp eax, dword [0x10001ee8]
jne 0x1001a251
cmp edx, dword [0x10001eec]
jne 0x1001a251
mov edi, esi
mov dword [ebp - 0xa78], ebx
mov ebx, dword [ebp - 0xbec]
xor eax, eax
mov dword [ebp - 0xa98], edi
mov esi, eax
jmp 0x1001a25e
mov edi, dword [ebp - 0xa98]
mov ebx, 0xc004d501
xor eax, eax
test esi, esi
je 0x1001a271
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test ebx, ebx
js 0x1001a43b
mov eax, dword [ebp - 0xa78]
xor ecx, ecx
push 0x40
push ecx
mov ebx, 0x10029788
mov esi, edi
push ebx
mov byte [eax + edi - 1], cl
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
add esp, 0xc
cmp byte [edi], 0
je 0x1001a3d1
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xae8]
jne 0x1001a2aa
sub ecx, ebx
xor ebx, ebx
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0x1001a434
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa70], edx
cmp word [eax], cx
jne 0x1001a31d
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0x1001a31d
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0x1001a31d
cmp dword [ecx], 0x4550
jne 0x1001a31d
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xba4]
je 0x1001a32a
cmp ax, word [ebp - 0xba8]
je 0x1001a32a
mov edx, 0xc000000d
jmp 0x1001a322
mov edx, 0xc000007b
mov dword [ebp - 0xa70], edx
jmp 0x1001a33c
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xbcc], eax
test eax, eax
je 0x1001a3c5
mov ecx, esi
mov dword [ebp - 0xbc4], esi
xor eax, eax
mov dword [ebp - 0xab4], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xa7c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001a365
sub ecx, dword [ebp - 0xa7c]
inc esi
add esi, ecx
test edx, edx
js 0x1001a3af
mov ecx, dword [ebp - 0xbc4]
lea eax, [ebp - 0xab4]
push eax
push edi
xor edx, edx
call fcn.10011a50
mov edx, eax
mov dword [ebp - 0xa70], edx
test edx, edx
js 0x1001a3d1
mov eax, dword [ebp - 0xa74]
mov ecx, dword [ebp - 0xab4]
mov dword [eax*4 + section..data], ecx
jmp 0x1001a3b5
mov eax, dword [ebp - 0xa74]
inc eax
inc ebx
mov dword [ebp - 0xa74], eax
cmp ebx, dword [ebp - 0xbcc]
jb 0x1001a34c
add edi, 0x10
cmp byte [esi], 0
jne 0x1001a2a3
mov ebx, dword [ebp - 0xa70]
mov esi, dword [ebp - 0xa98]
test esi, esi
je 0x1001a3f2
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test ebx, ebx
jns 0x1001a448
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0x10029788]
test eax, eax
je 0x1001a40b
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x1001a3fa
push 0x40
push ebx
push 0x10029788
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x100010a0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x1001a455
mov ebx, 0xc000007a
jmp 0x1001a3d7
mov esi, dword [ebp - 0xa98]
mov ebx, 0xc000007a
jmp 0x1001a3dd
mov eax, dword [0x1002977c]
inc eax
xor ebx, ebx
mov dword [0x1002977c], eax
xor eax, eax
mov edi, 0x100297c8
xchg dword [edi], eax
mov eax, dword [ebp - 0xa9c]
xor ecx, ecx
mov esi, dword [0x10029068]
inc ecx
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0xacc]
mov dword [ebp - 0x2c4], eax
lea eax, [ebp - 0x2e0]
push eax
push 4
push 0x2021
mov dword [ebp - 0x2e0], ecx
mov dword [ebp - 0x2d8], ecx
mov dword [ebp - 0x2cc], ecx
mov dword [ebp - 0x2d0], ecx
mov dword [ebp - 0x2c8], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x2d4], 0x9966f291
call dword [0x1002a1c8]
call esi
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x1001a4c2
mov eax, dword [0x1002977c]
push 0
pop ebx
test eax, eax
jle 0x1001a524
sub eax, 1
mov dword [0x1002977c], eax
jne 0x1001a524
mov esi, ebx
mov eax, dword [esi + 0x10029788]
test eax, eax
je 0x1001a4f8
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x1001a4e7
push 0x40
push ebx
push 0x10029788
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x100010a0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x100297c8
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xaac]
mov esi, dword [0x100290b0]
mov ecx, esi
push ebx
call dword [0x1002a1c8]
call esi
jmp 0x1001a543
xor ebx, ebx
mov eax, ebx
mov dword [ebp - 0xa68], ebx
mov dword [ebp - 0xa78], eax
lea edi, [ebp - 0xcc8]
xor eax, eax
mov dword [ebp - 0xee8], ebx
stosd dword es:[edi], eax
mov esi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xa7c], ebx
test ebx, ebx
je 0x1001c737
push edi
push 0x10029230
push ebx
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov esi, ebx
add esp, 0xc
mov dword [ebp - 0xa88], esi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov dword [ebp - 0xbc4], eax
test eax, eax
je 0x1001c737
mov ecx, dword [0x10029228]
mov ebx, eax
mov dword [eax], ecx
mov ecx, dword [0x1002922c]
mov dword [eax + 4], ecx
mov dword [ebp - 0xa68], ebx
rdtsc
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xbec], edx
xor eax, eax
mov dword [ebp - 0xb7c], eax
lea eax, [ebp - 0xd74]
push eax
push 4
pop edi
mov edx, edi
mov ecx, edi
call fcn.1000e6b4
test eax, eax
js 0x1001c73d
mov edx, dword [ebp - 0xd74]
lea eax, [ebp - 0xb7c]
push eax
xor ecx, ecx
call fcn.1000e6b4
or eax, 0x10000000
jl 0x1001c73d
lea eax, [ebp - 0xd78]
mov edx, 0xa0
push eax
mov ecx, edi
call fcn.1000e6b4
test eax, eax
js 0x1001c73d
mov edx, dword [ebp - 0xd78]
lea eax, [ebp - 0xb7c]
mov ecx, dword [ebp - 0xb7c]
push eax
call fcn.1000e6b4
or eax, 0x10000000
jl 0x1001c73d
lea eax, [ebp - 0xd7c]
mov ecx, edi
push eax
push 8
pop edx
call fcn.1000e6b4
test eax, eax
js 0x1001c73d
mov edx, dword [ebp - 0xd7c]
lea eax, [ebp - 0xb7c]
mov ecx, dword [ebp - 0xb7c]
push eax
call fcn.1000e6b4
or eax, 0x10000000
jl 0x1001c73d
lea eax, [ebp - 0xd80]
mov ecx, edi
push eax
push 8
pop edx
call fcn.1000e6b4
test eax, eax
js 0x1001c73d
mov edx, dword [ebp - 0xd80]
lea eax, [ebp - 0xb7c]
mov ecx, dword [ebp - 0xb7c]
push eax
call fcn.1000e6b4
or eax, 0x10000000
jl 0x1001c73d
mov esi, dword [ebp - 0xb7c]
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xb88], ebx
test ebx, ebx
je 0x1001c731
mov dword [ebp - 0xa78], eax
lea eax, [ebp - 0xe98]
mov edx, edi
push eax
mov ecx, ebx
call fcn.1000e6b4
test eax, eax
js 0x1001c731
lea ecx, [ebx + esi]
lea eax, [ebx + 8]
mov dword [ebp - 0xa74], ecx
cmp eax, ecx
ja 0x1001c731
mov eax, dword [ebp - 0xe98]
mov dword [ebx], edi
mov dword [eax], edi
mov esi, ebx
xor eax, eax
mov dword [ebp - 0xb4c], esi
mov dword [ebp - 0xab4], eax
mov edx, dword [esi]
lea eax, [ebp - 0xd84]
push eax
mov ecx, edi
call fcn.1000e6b4
test eax, eax
js 0x1001c731
mov edx, dword [ebp - 0xd84]
lea eax, [ebp - 0xb4c]
push eax
mov ecx, esi
call fcn.1000e6b4
test eax, eax
js 0x1001c731
mov eax, dword [ebp - 0xab4]
xor ecx, ecx
inc eax
inc ecx
mov dword [ebp - 0xab4], eax
cmp eax, ecx
jae 0x1001a7a0
mov esi, dword [ebp - 0xb4c]
jmp 0x1001a750
mov ecx, dword [ebp - 0xb4c]
lea eax, [ebp - 0xea0]
push eax
mov edx, edi
call fcn.1000e6b4
test eax, eax
js 0x1001c731
lea eax, [ecx + 0xa4]
cmp eax, dword [ebp - 0xa74]
ja 0x1001c731
mov eax, 0xa0
push eax
push dword [ebp - 0xa7c]
mov dword [ecx], eax
push dword [ebp - 0xea0]
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
add esp, 0xc
mov esi, ebx
xor eax, eax
mov dword [ebp - 0xac8], esi
mov dword [ebp - 0xab4], eax
mov edx, dword [esi]
lea eax, [ebp - 0xd88]
push eax
mov ecx, edi
call fcn.1000e6b4
test eax, eax
js 0x1001c731
mov edx, dword [ebp - 0xd88]
lea eax, [ebp - 0xac8]
push eax
mov ecx, esi
call fcn.1000e6b4
test eax, eax
js 0x1001c731
mov eax, dword [ebp - 0xab4]
inc eax
mov dword [ebp - 0xab4], eax
cmp eax, 2
jae 0x1001a848
mov esi, dword [ebp - 0xac8]
jmp 0x1001a7fa
mov ecx, dword [ebp - 0xac8]
lea eax, [ebp - 0xea8]
push eax
mov edx, edi
call fcn.1000e6b4
test eax, eax
js 0x1001c731
lea eax, [ecx + 0xc]
cmp eax, dword [ebp - 0xa74]
ja 0x1001c731
mov edx, dword [ebp - 0xbc4]
mov dword [ecx], 8
mov ecx, dword [ebp - 0xea8]
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
xor eax, eax
mov dword [ebp - 0xac4], ebx
mov esi, eax
mov edx, dword [ebx]
lea eax, [ebp - 0xd8c]
push eax
mov ecx, edi
call fcn.1000e6b4
test eax, eax
js 0x1001c731
mov edx, dword [ebp - 0xd8c]
lea eax, [ebp - 0xac4]
push eax
mov ecx, ebx
call fcn.1000e6b4
test eax, eax
js 0x1001c731
inc esi
cmp esi, 3
jae 0x1001a8db
mov ebx, dword [ebp - 0xac4]
jmp 0x1001a899
mov ecx, dword [ebp - 0xac4]
lea eax, [ebp - 0xeb0]
push eax
mov edx, edi
call fcn.1000e6b4
test eax, eax
js 0x1001c731
lea eax, [ecx + 0xc]
cmp eax, dword [ebp - 0xa74]
ja 0x1001c731
mov eax, dword [ebp - 0xeb0]
push 8
pop ebx
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xbcc]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xbec]
mov dword [eax + 4], ecx
lea eax, [ebp - 0xbfc]
mov edx, edi
push eax
mov ecx, edi
call fcn.1000e6b4
test eax, eax
js 0x1001c731
mov esi, dword [ebp - 0xbfc]
lea eax, [ebp - 0xb70]
push eax
mov edx, ebx
mov dword [ebp - 0xae0], esi
call fcn.1000e6b4
test eax, eax
js 0x1001c731
mov edx, dword [ebp - 0xb70]
lea eax, [ebp - 0xae0]
push eax
mov ecx, esi
call fcn.1000e6b4
test eax, eax
js 0x1001c731
xor ecx, ecx
rdtsc
mov esi, ecx
mov dword [ebp - 0xab0], ecx
mov dword [ebp - 0xb14], esi
mov dword [ebp - 0xaac], ecx
mov dword [ebp - 0xbc8], ecx
mov dword [ebp - 0xa80], ecx
mov dword [ebp - 0xa90], ecx
mov dword [ebp - 0xa70], ecx
mov dword [ebp - 0xa94], ecx
mov dword [ebp - 0xad4], ecx
mov dword [ebp - 0xba4], ecx
mov dword [ebp - 0xb70], eax
mov dword [ebp - 0xbfc], edx
mov dword [ebp - 0xc64], ebx
mov edx, dword [ebp - 0xb7c]
lea eax, [ebp - 0xc64]
push eax
mov ecx, ebx
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001aad1
mov eax, dword [ebp - 0xc64]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0xab4], ecx
cmp ecx, eax
jae 0x1001aa0a
mov ebx, 0xc0000095
jmp 0x1001aad1
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x1001aa2a
mov ebx, 0xc0000017
jmp 0x1001aacb
lea eax, [ebp - 0xaf4]
mov dword [ebp - 0xaf4], esi
push eax
mov edx, edi
mov dword [esi], edi
mov ecx, esi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001aab6
mov ecx, dword [ebp - 0xaf4]
mov edx, edi
mov eax, dword [ebp - 0xb7c]
mov dword [ecx], eax
lea eax, [ebp - 0xaf4]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001aab6
mov eax, dword [ebp - 0xab4]
push dword [ebp - 0xb7c]
mov ecx, dword [ebp - 0xb70]
push dword [ebp - 0xb88]
mov dword [esi + eax - 8], ecx
mov ecx, dword [ebp - 0xbfc]
push dword [ebp - 0xaf4]
mov dword [esi + eax - 4], ecx
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xab4]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xab0], esi
mov esi, ecx
mov dword [ebp - 0xb14], eax
jmp 0x1001aab8
xor ecx, ecx
test esi, esi
je 0x1001aacb
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
mov esi, dword [ebp - 0xb14]
or ebx, 0x10000000
jl 0x1001c54b
mov ebx, dword [ebp - 0xab0]
xor ecx, ecx
mov dword [ebp - 0xac8], ecx
test ebx, ebx
jne 0x1001aaf9
mov ebx, 0xc000000d
jmp 0x1001b269
test esi, esi
je 0x1001b264
lea eax, [esi + 8]
push eax
push ecx
mov dword [ebp - 0xb90], eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov dword [ebp - 0xb8c], eax
test eax, eax
je 0x1001b264
xor ecx, ecx
mov dl, cl
test esi, esi
je 0x1001ab37
xor dl, byte [ecx + ebx]
inc ecx
cmp ecx, esi
jb 0x1001ab2f
mov dword [ebp - 0xaa8], eax
xor eax, eax
mov ecx, eax
mov dword [ebp - 0xb5c], eax
mov dword [ebp - 0xae8], eax
mov eax, esi
mov dword [ebp - 0xba8], ebx
or ebx, 0xffffffff
and eax, 7
mov dword [ebp - 0xb24], ecx
mov dword [ebp - 0xb0c], ebx
mov dword [ebp - 0xaf4], eax
je 0x1001ac89
mov dword [ebp - 0xb5c], ecx
mov esi, eax
mov dword [ebp - 0xae8], ecx
mov dword [ebp - 0xab4], ecx
test eax, eax
je 0x1001abd6
mov ebx, dword [ebp - 0xb48]
mov eax, dword [ebp - 0xba8]
movzx eax, byte [eax]
cmp ecx, edi
jge 0x1001abab
lea ecx, [ebx - 0x20]
shl eax, cl
or dword [ebp - 0xae8], eax
jmp 0x1001abb5
mov ecx, ebx
shl eax, cl
or dword [ebp - 0xb5c], eax
mov ecx, dword [ebp - 0xab4]
sub ebx, 8
mov eax, dword [ebp - 0xba8]
inc ecx
inc eax
mov dword [ebp - 0xab4], ecx
mov dword [ebp - 0xba8], eax
cmp ecx, esi
jl 0x1001ab97
mov eax, dword [ebp - 0xae8]
xor ecx, ecx
mov ebx, dword [ebp - 0xb5c]
xor eax, 0xb17a307a
xor ebx, 0x42f6b18d
mov dword [ebp - 0xa84], eax
mov dword [ebp - 0xb24], eax
mov dword [ebp - 0xb0c], ebx
test esi, esi
je 0x1001ac3e
mov esi, dword [ebp - 0xaa8]
cmp ecx, edi
jge 0x1001ac16
rol eax, 8
mov byte [esi], al
jmp 0x1001ac1b
rol ebx, 8
mov byte [esi], bl
mov esi, dword [ebp - 0xaf4]
inc ecx
inc dword [ebp - 0xaa8]
cmp ecx, esi
jl 0x1001ac05
mov eax, dword [ebp - 0xb24]
mov ebx, dword [ebp - 0xb0c]
mov dword [ebp - 0xa84], eax
add esi, 0xfffffffc
test esi, esi
jle 0x1001ac58
mov ecx, edi
sub ecx, esi
shl ecx, 3
shr ebx, cl
shl ebx, cl
mov dword [ebp - 0xb0c], ebx
jmp 0x1001ac7d
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0xb0c], ebx
test esi, esi
jns 0x1001ac7d
neg esi
shl esi, 3
mov ecx, esi
shr eax, cl
shl eax, cl
mov dword [ebp - 0xa84], eax
mov dword [ebp - 0xb24], eax
mov ecx, dword [ebp - 0xa84]
mov esi, dword [ebp - 0xb14]
mov eax, esi
shr eax, 3
mov dword [ebp - 0xab4], eax
test eax, eax
je 0x1001b086
mov eax, dword [ebp - 0xaa8]
mov esi, dword [ebp - 0xba8]
add eax, 7
add esi, 2
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xa8c], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xa8c]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xa8c]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xa8c]
shl esi, 8
add dword [ebp - 0xa8c], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov dword [ebp - 0xa6c], ebx
add ebx, 0xffffb5a8
xor ebx, edi
xor ebx, ecx
mov ecx, 0xc81ecb17
xor ebx, ecx
mov eax, ebx
xor eax, ecx
ror eax, 0xf
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 7
add ecx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, ecx
mov dword [ebp - 0xa6c], eax
add eax, 0xb1b54a58
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa6c]
ror eax, 0xa
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0xcb17
rol eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
rol eax, 5
add ecx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xa6c], eax
xor ecx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, ecx
xor ebx, eax
lea eax, [ebx - 0x4a58]
imul ecx, eax, 0xb1b5
mov eax, ebx
shr eax, 6
sub ecx, eax
xor dword [ebp - 0xa6c], ecx
mov ecx, dword [ebp - 0xa6c]
mov eax, ecx
ror eax, 0xf
xor eax, 0xcb17
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, 0xc81e
imul eax, eax, 0xcb17
xor ecx, eax
lea eax, [ecx + 0x37e0ea91]
mov dword [ebp - 0xa6c], ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0xc81e
ror ecx, 0xa
imul eax, eax, 0xb1b5
xor ecx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, ecx
mov dword [ebp - 0xa6c], eax
xor eax, 0x4a58
rol eax, 6
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa6c]
ror eax, 3
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa6c]
mov eax, ebx
ror eax, 0xf
sub eax, 0xc81e
imul eax, eax, 0x4a58
xor ecx, eax
mov dword [ebp - 0xa6c], ecx
xor ecx, 0xc81e
mov eax, dword [ebp - 0xa6c]
shr eax, 1
imul ecx, ecx, 0x4a58
xor ecx, eax
mov eax, dword [ebp - 0xa6c]
add eax, 0xffff34e9
xor ebx, ecx
rol eax, 3
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xa6c]
shr eax, 0xf
xor ecx, eax
xor ebx, ecx
lea eax, [ebx - 0xcb17]
imul ecx, eax, 0xb1b5
mov eax, ebx
shr eax, 0xd
sub ecx, eax
mov eax, 0xb1b54a58
xor dword [ebp - 0xa6c], ecx
sub eax, dword [ebp - 0xa6c]
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa6c]
ror eax, 0xb
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa6c]
lea eax, [ebx + 0x4e49ed8a]
xor ecx, eax
mov dword [ebp - 0xa6c], ecx
mov eax, dword [ebp - 0xa6c]
xor eax, 0xb1b5
ror ecx, 7
imul eax, eax, 0x4a58
sub eax, ecx
xor ebx, eax
mov eax, ebx
xor eax, 0xc81e
rol eax, 4
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0x10
sub ecx, eax
mov eax, 0xb1b54a58
xor dword [ebp - 0xa6c], ecx
sub eax, dword [ebp - 0xa6c]
ror eax, 0xa
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa6c]
ror eax, 4
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x4e4ab5a8]
ror eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
ror eax, 9
xor ecx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, ecx
mov dword [ebp - 0xa6c], eax
xor eax, 0xc81ecb17
rol eax, 8
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xa6c]
rol eax, 2
sub ecx, eax
mov eax, 0xc81ecb17
xor ebx, ecx
sub eax, ebx
ror eax, 0xb
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0xc
sub ecx, eax
mov eax, dword [ebp - 0xa6c]
xor eax, ecx
mov dword [ebp - 0xa6c], eax
xor eax, 0xb1b5
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa6c]
shr eax, 8
xor ecx, eax
mov eax, dword [ebp - 0xa6c]
xor ebx, ecx
mov ecx, dword [ebp - 0xac4]
xor eax, ebx
add dword [ebp - 0xac4], 8
xor ebx, dword [ebp - 0xae8]
xor eax, 0x79ab814f
xor eax, dword [ebp - 0xb5c]
mov dword [ebp - 0xb0c], eax
mov dword [ebp - 0xb24], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xb0c]
ror dword [ebp - 0xb24], 8
mov byte [ecx], al
ror dword [ebp - 0xb0c], 8
mov al, byte [ebp - 0xb24]
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb0c]
ror dword [ebp - 0xb24], 8
mov byte [ecx - 1], al
ror dword [ebp - 0xb0c], 8
mov al, byte [ebp - 0xb24]
mov byte [ecx - 6], al
ror dword [ebp - 0xb24], 8
mov al, byte [ebp - 0xb0c]
mov byte [ecx - 2], al
ror dword [ebp - 0xb0c], 8
mov al, byte [ebp - 0xb24]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb0c]
mov byte [ecx - 3], al
mov ecx, dword [ebp - 0xb24]
mov ebx, dword [ebp - 0xb0c]
ror ecx, 8
ror ebx, 8
sub dword [ebp - 0xab4], 1
mov dword [ebp - 0xb5c], esi
mov esi, dword [ebp - 0xa8c]
mov dword [ebp - 0xb24], ecx
mov dword [ebp - 0xb0c], ebx
mov dword [ebp - 0xae8], edi
jne 0x1001acba
mov esi, dword [ebp - 0xb14]
push 4
pop edi
mov ebx, dword [ebp - 0xb8c]
movzx eax, dl
cdq
mov dword [ebx + esi], eax
mov dword [ebx + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x1001b0b8
mov ebx, 0xc0000017
jmp 0x1001b1c8
mov eax, dword [ebp - 0xb90]
push eax
push 8
mov dword [esi], eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
test eax, eax
je 0x1001b13c
mov dword [esi + 4], eax
push dword [ebp - 0xb90]
push ebx
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [esi + 8], eax
push eax
push 8
pop ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
test eax, eax
je 0x1001b13c
mov dword [esi + 0xc], eax
push 0xa0
push 0x10029180
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
add esp, 0xc
mov dword [esi + 0x10], ebx
push ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0x1001b145
mov ebx, 0xc0000017
jmp 0x1001b161
mov ebx, 0xc0000017
xor edx, edx
jmp 0x1001b161
mov dword [esi + 0x14], ecx
mov ebx, edx
mov eax, dword [0x10029220]
mov dword [ecx], eax
mov eax, dword [0x10029224]
mov dword [ebp - 0xac8], esi
mov esi, edx
mov dword [ecx + 4], eax
test esi, esi
je 0x1001b1c8
cmp dword [esi + 4], 0
je 0x1001b181
push dword [esi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 4], edx
cmp dword [esi + 0xc], 0
je 0x1001b19d
push dword [esi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0xc], edx
cmp dword [esi + 0x14], 0
je 0x1001b1b9
push dword [esi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0x14], edx
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test ebx, ebx
js 0x1001b1de
mov eax, dword [ebp - 0xac8]
mov dword [ebp - 0xaac], eax
xor eax, eax
mov esi, eax
jmp 0x1001b1e6
mov esi, dword [ebp - 0xac8]
xor eax, eax
push dword [ebp - 0xb8c]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test esi, esi
je 0x1001b269
xor eax, eax
cmp dword [esi + 4], eax
je 0x1001b21b
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0x1001b237
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0x1001b253
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
jmp 0x1001b269
mov ebx, 0xc0000001
or ebx, 0x10000000
jl 0x1001c54b
mov esi, dword [ebp - 0xaac]
lea eax, [ebp - 0xba0]
push eax
mov ecx, edi
mov dword [ebp - 0xba0], edi
mov edx, dword [esi]
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001b307
mov ecx, dword [ebp - 0xba0]
lea eax, [ebp - 0xba0]
push eax
mov edx, edi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001b307
mov edx, dword [esi + 8]
lea eax, [ebp - 0xba0]
mov ecx, dword [ebp - 0xba0]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001b307
mov ecx, dword [ebp - 0xba0]
lea eax, [ebp - 0xba0]
push eax
mov edx, edi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001b307
mov edx, dword [esi + 0x10]
lea eax, [ebp - 0xba0]
mov ecx, dword [ebp - 0xba0]
push eax
call fcn.1000e6b4
mov ebx, eax
mov eax, dword [ebp - 0xba0]
test ebx, ebx
jns 0x1001b30d
mov eax, dword [ebp - 0xe3c]
mov dword [ebp - 0xab4], eax
test ebx, ebx
js 0x1001b481
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x1001b33b
mov ebx, 0xc0000017
jmp 0x1001b481
mov eax, dword [ebp - 0xaac]
mov edx, edi
mov ecx, esi
mov dword [ebp - 0xb40], esi
mov eax, dword [eax]
mov dword [esi], eax
lea eax, [ebp - 0xb40]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001b46c
mov ebx, dword [ebp - 0xaac]
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0xb40]
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov edx, dword [ebx]
lea eax, [ebp - 0xb40]
mov ecx, dword [ebp - 0xb40]
add esp, 0xc
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001b46c
mov eax, dword [ebp - 0xaac]
mov edx, edi
mov ecx, dword [ebp - 0xb40]
mov eax, dword [eax + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xb40]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001b46c
mov ebx, dword [ebp - 0xaac]
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0xb40]
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xb40]
mov ecx, dword [ebp - 0xb40]
add esp, 0xc
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001b46c
mov eax, dword [ebp - 0xaac]
mov edx, edi
mov ecx, dword [ebp - 0xb40]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xb40]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001b46c
mov ebx, dword [ebp - 0xaac]
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0xb40]
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xb40]
mov ecx, dword [ebp - 0xb40]
add esp, 0xc
push eax
call fcn.1000e6b4
mov ebx, eax
xor ecx, ecx
test ebx, ebx
js 0x1001b46e
mov eax, dword [ebp - 0xab4]
mov dword [ebp - 0xbc8], esi
mov esi, ecx
mov dword [ebp - 0xa80], eax
jmp 0x1001b46e
xor ecx, ecx
test esi, esi
je 0x1001b481
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
mov esi, 0x10000000
or ebx, esi
jl 0x1001c54b
xor eax, eax
mov dword [ebp - 0xc9c], 8
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xac4], eax
mov edx, dword [ebp - 0xae0]
lea eax, [ebp - 0xc9c]
push eax
push 8
pop ecx
call fcn.1000e6b4
mov ebx, eax
or ebx, esi
jl 0x1001b6e8
mov eax, dword [ebp - 0xc9c]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0x1001b4dc
mov ebx, 0xc0000095
jmp 0x1001b4fd
mov dword [ebp - 0xc98], ecx
lea eax, [ebp - 0xc98]
push eax
push 8
pop edx
call fcn.1000e6b4
mov ebx, eax
mov eax, dword [ebp - 0xc98]
test ebx, ebx
jns 0x1001b503
mov eax, dword [ebp - 0xd90]
mov dword [ebp - 0xac8], eax
test ebx, ebx
js 0x1001b6e8
mov esi, dword [ebp - 0xb88]
xor eax, eax
mov ecx, esi
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xb60], ecx
mov eax, dword [ecx]
mov edx, edi
mov dword [ebp - 0xb70], eax
lea eax, [ebp - 0xb60]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001b6e8
mov edx, dword [ebp - 0xb70]
lea eax, [ebp - 0xb60]
mov ecx, dword [ebp - 0xb60]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001b6e8
mov eax, dword [ebp - 0xae0]
xor ecx, ecx
inc eax
inc ecx
cmp eax, ecx
mov dword [ebp - 0xae0], eax
mov ecx, dword [ebp - 0xb60]
jb 0x1001b527
mov eax, dword [ecx]
mov edx, edi
mov dword [ebp - 0xb70], eax
lea eax, [ebp - 0xb60]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001b6e8
mov eax, dword [ebp - 0xb70]
mov dword [ebp - 0xab4], eax
xor eax, eax
mov dword [ebp - 0xb64], esi
mov dword [ebp - 0xae0], eax
lea eax, [ebp - 0xb64]
mov edx, edi
push eax
mov ecx, esi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001b623
mov edx, dword [esi]
lea eax, [ebp - 0xb64]
mov ecx, dword [ebp - 0xb64]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001b623
mov eax, dword [ebp - 0xae0]
inc eax
mov dword [ebp - 0xae0], eax
cmp eax, 2
jae 0x1001b607
mov esi, dword [ebp - 0xb64]
jmp 0x1001b5bd
mov ecx, dword [ebp - 0xb64]
lea eax, [ebp - 0xb64]
push eax
mov edx, edi
mov esi, dword [ecx]
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
jns 0x1001b631
mov esi, dword [ebp - 0xac4]
test ebx, ebx
js 0x1001b6e8
mov edx, dword [ebp - 0xac8]
lea eax, [ebp - 0xb98]
push eax
mov ecx, edi
mov dword [ebp - 0xb98], edi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001b6c3
mov ecx, dword [ebp - 0xb98]
lea eax, [ebp - 0xb98]
push eax
mov edx, edi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001b6c3
mov edx, dword [ebp - 0xab4]
lea eax, [ebp - 0xb98]
mov ecx, dword [ebp - 0xb98]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001b6c3
mov ecx, dword [ebp - 0xb98]
lea eax, [ebp - 0xb98]
push eax
mov edx, edi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001b6c3
mov ecx, dword [ebp - 0xb98]
lea eax, [ebp - 0xb98]
push eax
mov edx, esi
call fcn.1000e6b4
mov ebx, eax
mov eax, dword [ebp - 0xb98]
test ebx, ebx
jns 0x1001b6cd
mov eax, dword [ebp - 0xe40]
test ebx, ebx
js 0x1001b6e8
cmp eax, 0x400000
jbe 0x1001b6de
mov ebx, 0x8000ffff
jmp 0x1001c54b
mov esi, eax
mov dword [ebp - 0xa70], esi
jmp 0x1001b6ee
mov esi, dword [ebp - 0xa70]
test ebx, ebx
js 0x1001c54b
push esi
xor eax, eax
push 8
mov ebx, eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
test eax, eax
jne 0x1001b71b
mov ecx, dword [ebp - 0xa90]
mov ebx, 0xc0000017
jmp 0x1001b723
mov ecx, eax
mov dword [ebp - 0xa90], eax
or ebx, 0x10000000
jl 0x1001c54b
mov eax, dword [ebp - 0xbc8]
test eax, eax
je 0x1001b796
test ecx, ecx
je 0x1001b796
mov dword [ebp - 0xe20], eax
xor ebx, ebx
mov eax, dword [ebp - 0xa80]
mov dword [ebp - 0xe18], eax
lea eax, [ebp - 0xd94]
push eax
xor eax, eax
mov dword [ebp - 0xe1c], ecx
push 0x10001b18
inc eax
mov dword [ebp - 0xe14], esi
push eax
mov dword [ebp - 0xe10], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0x1001b7ba
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1001b7b1
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jmp 0x1001b7b1
mov ebx, 0x80070057
jmp 0x1001c54b
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
mov esi, dword [ebp - 0xa70]
js 0x1001b816
mov ebx, 0x80004005
jmp 0x1001b816
push 0x10001b2c
push dword [ebp - 0xd94]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x1001b7df
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x1001b7ab
jmp 0x1001b7a0
push ebx
push 0x14
lea eax, [ebp - 0xe20]
mov ecx, esi
push eax
push 0x86
call dword [0x1002a1c8]
call esi
mov ebx, eax
or ebx, 0x10000000
jl 0x1001b810
mov esi, dword [ebp - 0xe14]
mov dword [ebp - 0xa70], esi
jmp 0x1001b816
mov esi, dword [ebp - 0xa70]
cmp ebx, 0xd0000023
jne 0x1001b828
mov ebx, 0x8007007a
jmp 0x1001c54b
test ebx, ebx
js 0x1001c54b
mov eax, dword [ebp - 0xa90]
xor edx, edx
mov dword [ebp - 0xac8], edx
mov dword [ebp - 0xb10], edx
mov dword [ebp - 0xb78], eax
cmp esi, edi
jae 0x1001b858
mov ebx, 0xc000003e
jmp 0x1001bc68
mov esi, dword [eax]
lea ecx, [ebp - 0xb78]
push ecx
mov edx, edi
mov dword [ebp - 0xac4], esi
mov ecx, eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001bc66
lea eax, [ebp - 0xb10]
mov edx, edi
push eax
xor ecx, ecx
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001bc66
mov eax, dword [ebp - 0xa70]
sub eax, dword [ebp - 0xb10]
cmp eax, esi
jb 0x1001ba70
mov eax, dword [ebp - 0xb78]
lea ecx, [ebp - 0xb78]
push ecx
mov edx, esi
mov dword [ebp - 0xae0], eax
mov ecx, eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001bc66
mov ecx, dword [ebp - 0xb10]
lea eax, [ebp - 0xb10]
push eax
mov edx, esi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001bc66
mov eax, dword [ebp - 0xa70]
sub eax, dword [ebp - 0xb10]
cmp eax, edi
jb 0x1001ba70
mov ecx, dword [ebp - 0xb78]
lea eax, [ebp - 0xb78]
push eax
mov edx, edi
mov esi, dword [ecx]
mov dword [ebp - 0xab4], esi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001bc66
mov ecx, dword [ebp - 0xb10]
lea eax, [ebp - 0xb10]
push eax
mov edx, edi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001bc66
mov eax, dword [ebp - 0xa70]
sub eax, dword [ebp - 0xb10]
cmp eax, esi
jb 0x1001ba70
mov eax, dword [ebp - 0xb78]
lea ecx, [ebp - 0xb78]
push ecx
mov edx, esi
mov dword [ebp - 0xb90], eax
mov ecx, eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001bc66
mov ecx, dword [ebp - 0xb10]
lea eax, [ebp - 0xb10]
push eax
mov edx, esi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001bc66
mov eax, dword [ebp - 0xa70]
sub eax, dword [ebp - 0xb10]
cmp eax, edi
jb 0x1001ba70
mov ecx, dword [ebp - 0xb78]
mov edx, edi
mov eax, dword [ecx]
mov dword [ebp - 0xaf4], eax
lea eax, [ebp - 0xb78]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001bc66
mov ecx, dword [ebp - 0xb10]
lea eax, [ebp - 0xb10]
push eax
mov edx, edi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001bc66
mov eax, dword [ebp - 0xa70]
sub eax, dword [ebp - 0xb10]
mov ecx, dword [ebp - 0xaf4]
cmp eax, ecx
jb 0x1001ba70
lea eax, [ebp - 0xb10]
mov edx, ecx
mov ecx, dword [ebp - 0xb10]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001bc66
mov edx, dword [ebp - 0xa70]
mov eax, edx
sub eax, dword [ebp - 0xb10]
jne 0x1001ba70
mov eax, dword [ebp - 0xaf4]
mov ecx, dword [ebp - 0xac4]
add eax, esi
add ecx, 0xc
add eax, ecx
cmp eax, edx
jne 0x1001ba70
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x1001ba7a
mov ebx, 0xc0000017
jmp 0x1001bbe3
mov ebx, 0xc000003e
jmp 0x1001bc66
xor eax, eax
mov ebx, eax
cmp dword [ebp - 0xae0], eax
je 0x1001bacd
mov eax, dword [ebp - 0xac4]
push eax
push 8
mov dword [esi], eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
test eax, eax
je 0x1001bac1
mov dword [esi + 4], eax
xor ecx, ecx
mov ecx, dword [ebp - 0xac4]
push ecx
push dword [ebp - 0xae0]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0x1001bad2
mov ebx, 0xc0000017
xor eax, eax
jmp 0x1001bb7c
mov dword [esi], eax
mov dword [esi + 4], eax
cmp dword [ebp - 0xb90], 0
je 0x1001bb18
mov eax, dword [ebp - 0xab4]
push eax
push 8
mov dword [esi + 8], eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
test eax, eax
je 0x1001bac1
mov dword [esi + 0xc], eax
push dword [ebp - 0xab4]
xor ecx, ecx
push dword [ebp - 0xb90]
mov ebx, ecx
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0x1001bb1e
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
cmp dword [ebp - 0xb78], 0
je 0x1001bb6e
mov eax, dword [ebp - 0xaf4]
push eax
push 8
mov dword [esi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x1001bb4f
mov ebx, 0xc0000017
jmp 0x1001bb7c
mov ebx, eax
mov dword [esi + 0x14], ecx
mov eax, dword [ebp - 0xaf4]
push eax
push dword [ebp - 0xb78]
push ecx
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0x1001bb74
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [ebp - 0xac8], esi
mov esi, eax
test esi, esi
je 0x1001bbe3
cmp dword [esi + 4], 0
je 0x1001bb9c
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0x1001bbb8
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0x1001bbd4
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor edx, edx
test ebx, ebx
js 0x1001bbf9
mov eax, dword [ebp - 0xac8]
mov esi, edx
mov dword [ebp - 0xa94], eax
jmp 0x1001bbff
mov esi, dword [ebp - 0xac8]
test esi, esi
je 0x1001bc68
cmp dword [esi + 4], 0
je 0x1001bc1f
push dword [esi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 4], edx
cmp dword [esi + 0xc], 0
je 0x1001bc3b
push dword [esi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0xc], edx
cmp dword [esi + 0x14], 0
je 0x1001bc57
push dword [esi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0x14], edx
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor edx, edx
or ebx, 0x10000000
jl 0x1001c54b
mov ecx, dword [ebp - 0xa94]
mov ebx, edx
mov dword [ebp - 0xa74], edx
mov dword [ebp - 0xa80], edx
mov dword [ebp - 0xb4c], ebx
test ecx, ecx
je 0x1001bd53
mov eax, dword [ecx + 4]
mov dword [ebp - 0xb88], eax
test eax, eax
je 0x1001bd53
mov eax, dword [ecx]
mov dword [ebp - 0xb90], eax
test eax, eax
je 0x1001bd53
lea esi, [eax - 8]
mov dword [ebp - 0xbfc], edx
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov dword [ebp - 0xb8c], eax
test eax, eax
je 0x1001c29b
xor ecx, ecx
mov dword [ebp - 0xac4], eax
mov dl, cl
and esi, 7
mov ecx, dword [ebp - 0xb88]
mov dword [ebp - 0xac8], ecx
mov dword [ebp - 0xab4], esi
je 0x1001be5f
or eax, 0xffffffff
xor ecx, ecx
mov dword [ebp - 0xafc], eax
xor eax, eax
mov dword [ebp - 0xb1c], ecx
mov dword [ebp - 0xbe4], ecx
mov dword [ebp - 0xb60], ecx
mov dword [ebp - 0xae0], eax
test esi, esi
je 0x1001bd90
mov ebx, dword [ebp - 0xac8]
mov ecx, dword [ebp - 0xb48]
cmp eax, edi
movzx eax, byte [ebx]
jge 0x1001bd5d
lea ecx, [ecx - 0x20]
shl eax, cl
mov ecx, dword [ebp - 0xb60]
or ecx, eax
mov dword [ebp - 0xb60], ecx
jmp 0x1001bd6b
mov ebx, 0xc000000d
jmp 0x1001c2bd
shl eax, cl
or dword [ebp - 0xbe4], eax
mov ecx, dword [ebp - 0xb60]
mov eax, dword [ebp - 0xae0]
sub dword [ebp - 0xb48], 8
inc eax
inc ebx
mov dword [ebp - 0xae0], eax
cmp eax, esi
jl 0x1001bd31
mov dword [ebp - 0xac8], ebx
mov ebx, dword [ebp - 0xb4c]
and dword [ebp - 0xaf4], 0
mov eax, ecx
mov ecx, dword [ebp - 0xbe4]
xor eax, 0x92f65a5
xor ecx, 0x699a899c
mov dword [ebp - 0xb64], eax
mov dword [ebp - 0xb1c], eax
mov dword [ebp - 0xa84], ecx
mov dword [ebp - 0xafc], ecx
test esi, esi
je 0x1001be13
mov ebx, dword [ebp - 0xac4]
cmp dword [ebp - 0xaf4], edi
jge 0x1001bddb
rol eax, 8
mov byte [ebx], al
jmp 0x1001bde0
rol ecx, 8
mov byte [ebx], cl
inc dword [ebp - 0xaf4]
inc ebx
cmp dword [ebp - 0xaf4], esi
jl 0x1001bdcc
mov eax, dword [ebp - 0xb1c]
mov esi, dword [ebp - 0xafc]
mov dword [ebp - 0xac4], ebx
mov ebx, dword [ebp - 0xb4c]
mov dword [ebp - 0xb64], eax
mov dword [ebp - 0xa84], esi
mov ecx, dword [ebp - 0xab4]
add ecx, 0xfffffffc
test ecx, ecx
jle 0x1001be3c
mov eax, dword [ebp - 0xab4]
mov ecx, edi
mov esi, dword [ebp - 0xa84]
add eax, 0xfffffffc
sub ecx, eax
shl ecx, 3
shr esi, cl
shl esi, cl
jmp 0x1001be75
xor esi, esi
mov dword [ebp - 0xafc], esi
test ecx, ecx
jns 0x1001be7b
neg ecx
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xb64], eax
mov dword [ebp - 0xb1c], eax
jmp 0x1001be7b
xor eax, eax
mov dword [ebp - 0xb60], eax
mov esi, eax
mov dword [ebp - 0xb64], eax
mov dword [ebp - 0xb1c], eax
mov dword [ebp - 0xafc], esi
mov eax, dword [ebp - 0xb90]
mov ecx, dword [ebp - 0xac4]
lea eax, [eax - 8]
shr eax, 3
mov dword [ebp - 0xab4], eax
test eax, eax
je 0x1001c20b
mov edi, dword [ebp - 0xac8]
add ecx, 7
mov ebx, dword [ebp - 0xb64]
add edi, 2
mov dword [ebp - 0xae0], ecx
mov dword [ebp - 0xae8], edi
movzx ecx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ecx, 8
or ecx, eax
shl edi, 8
mov eax, dword [ebp - 0xae8]
xor ebx, ecx
mov dword [ebp - 0xb70], ecx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xae8]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xae8]
shl edi, 8
add dword [ebp - 0xae8], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, ebx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul ecx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub ecx, eax
xor esi, ecx
lea eax, [esi - 0x137f]
imul ecx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, 0xab69605e
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0x137f
ror ecx, 6
imul eax, eax, 0xab69
xor ecx, eax
xor esi, ecx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul ecx, eax, 0x605e
mov eax, esi
rol eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub ecx, eax
xor esi, ecx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul ecx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x7f1
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov eax, esi
mov dword [ebp - 0xa84], esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea esi, [ebx - 0x7f1]
xor esi, dword [ebp - 0xa84]
xor esi, 0xab69605e
mov eax, esi
xor eax, 0x7f1
rol eax, 2
imul ecx, eax, 0x137f
mov eax, esi
shr eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 7
add ecx, eax
xor esi, ecx
mov eax, esi
mov ecx, esi
xor eax, 0x137f
ror ecx, 9
imul eax, eax, 0x605e
add ecx, eax
xor ebx, ecx
mov eax, ebx
mov dword [ebp - 0xb64], ebx
xor eax, 0xab69
rol eax, 5
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 7
add ecx, eax
xor esi, ecx
mov ebx, esi
xor ebx, dword [ebp - 0xb64]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor esi, eax
lea eax, [esi - 0x7f1137f]
ror eax, 1
imul ecx, eax, 0x605e
mov eax, esi
ror eax, 6
sub ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add ecx, eax
xor esi, ecx
lea eax, [esi - 0x54969fa2]
rol eax, 0xf
imul ecx, eax, 0x137f
mov eax, esi
ror eax, 0xe
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x605e
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor ecx, eax
xor esi, ecx
mov eax, esi
xor eax, 0x7f1137f
rol eax, 4
imul ecx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xbe4]
rol eax, 2
mov dword [ebp - 0xafc], esi
mov dword [ebp - 0xbe4], edi
xor ecx, eax
mov edi, dword [ebp - 0xae8]
xor ecx, dword [ebp - 0xb60]
xor ebx, ecx
mov ecx, dword [ebp - 0xae0]
mov dword [ebp - 0xb1c], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xafc]
ror dword [ebp - 0xb1c], 8
mov byte [ecx], al
mov al, byte [ebp - 0xb1c]
ror dword [ebp - 0xafc], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xafc]
ror dword [ebp - 0xb1c], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xb1c]
ror dword [ebp - 0xafc], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xafc]
ror dword [ebp - 0xb1c], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xafc], 8
mov al, byte [ebp - 0xb1c]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xafc]
mov byte [ecx - 3], al
add ecx, 8
mov ebx, dword [ebp - 0xb1c]
mov esi, dword [ebp - 0xafc]
mov eax, dword [ebp - 0xb70]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xab4], 1
mov dword [ebp - 0xb1c], ebx
mov dword [ebp - 0xafc], esi
mov dword [ebp - 0xb60], eax
mov dword [ebp - 0xae0], ecx
jne 0x1001beb9
mov ebx, dword [ebp - 0xb4c]
push 4
pop edi
mov esi, dword [ebp - 0xb90]
xor eax, eax
mov ecx, dword [ebp - 0xb8c]
add esi, 0xfffffff8
je 0x1001c226
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0x1001c21e
movzx eax, dl
cdq
mov dword [ebp - 0xb70], edx
mov edx, dword [ebp - 0xb88]
cmp eax, dword [esi + edx]
jne 0x1001c25f
mov eax, dword [ebp - 0xb70]
cmp eax, dword [esi + edx + 4]
jne 0x1001c25f
xor eax, eax
mov dword [ebp - 0xa74], ecx
mov dword [ebp - 0xa80], esi
mov ecx, eax
mov esi, dword [ebp - 0xbfc]
jmp 0x1001c266
mov esi, 0xc004d501
xor eax, eax
test ecx, ecx
je 0x1001c279
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test esi, esi
js 0x1001c29b
mov eax, dword [ebp - 0xa74]
xor edx, edx
mov ecx, dword [ebp - 0xa80]
mov dword [ebp - 0xad4], eax
mov eax, edx
mov dword [ebp - 0xba4], ecx
jmp 0x1001c2a8
mov eax, dword [ebp - 0xa74]
mov ebx, 0xc0000001
xor edx, edx
test eax, eax
je 0x1001c2bd
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor edx, edx
or ebx, 0x10000000
jl 0x1001c54b
mov esi, dword [ebp - 0xba4]
mov ecx, dword [ebp - 0xad4]
mov dword [ebp - 0xbd0], edx
mov dword [ebp - 0xc14], ecx
cmp esi, edi
jb 0x1001c540
mov eax, dword [ecx]
mov edx, edi
mov dword [ebp - 0xb70], eax
lea eax, [ebp - 0xc14]
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001c545
lea eax, [ebp - 0xbd0]
mov edx, edi
push eax
xor ecx, ecx
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001c545
mov eax, esi
sub eax, dword [ebp - 0xbd0]
cmp eax, edi
jb 0x1001c540
mov ecx, dword [ebp - 0xc14]
lea eax, [ebp - 0xc14]
push eax
mov edx, edi
mov esi, dword [ecx]
mov dword [ebp - 0xac4], esi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001c545
mov ecx, dword [ebp - 0xbd0]
lea eax, [ebp - 0xbd0]
push eax
mov edx, edi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001c545
mov eax, dword [ebp - 0xba4]
mov ecx, dword [ebp - 0xbd0]
sub eax, ecx
cmp eax, esi
jb 0x1001c540
lea eax, [ebp - 0xbd0]
mov edx, esi
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001c545
mov esi, dword [ebp - 0xc14]
mov edx, dword [ebp - 0xac4]
mov eax, dword [ebp - 0xad4]
mov ebx, dword [ebp - 0xba4]
add eax, ebx
lea ecx, [esi + edx]
cmp eax, ecx
jb 0x1001c540
sub ebx, esi
sub ebx, edx
add ebx, dword [ebp - 0xad4]
cmp ebx, 8
jae 0x1001c540
xor ecx, ecx
mov dword [ebp - 0xb4c], ecx
mov eax, ecx
mov dword [ebp - 0xac8], eax
mov ebx, ecx
test esi, esi
je 0x1001c4d1
lea eax, [ebp - 0xbe8]
mov dword [ebp - 0xae0], esi
push eax
mov ecx, esi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001c545
mov eax, dword [ebp - 0xbe8]
cmp esi, eax
jae 0x1001c4c1
lea eax, [ebp - 0xd98]
mov edx, edi
push eax
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001c545
mov eax, dword [ebp - 0xbe8]
cmp dword [ebp - 0xd98], eax
ja 0x1001c4f6
mov edx, dword [ecx]
lea eax, [ebp - 0xd9c]
push eax
mov ecx, edi
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001c471
mov eax, dword [ebp - 0xd9c]
mov dword [ebp - 0xda0], eax
jmp 0x1001c477
mov eax, dword [ebp - 0xda0]
test ebx, ebx
js 0x1001c545
lea ecx, [ebp - 0xc5c]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xae0]
call fcn.1000e6b4
mov ebx, eax
test ebx, ebx
js 0x1001c545
mov ecx, dword [ebp - 0xc5c]
mov eax, dword [ebp - 0xbe8]
mov dword [ebp - 0xae0], ecx
cmp ecx, eax
ja 0x1001c4f6
inc dword [ebp - 0xb4c]
cmp ecx, eax
jb 0x1001c423
cmp ecx, eax
jne 0x1001c4f6
mov edx, dword [ebp - 0xac4]
mov eax, dword [ebp - 0xac8]
test edx, edx
je 0x1001c507
push edx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov dword [ebp - 0xac8], eax
test eax, eax
jne 0x1001c4fd
mov ebx, 0xc0000017
jmp 0x1001c52e
mov ebx, 0xc000000d
jmp 0x1001c545
mov edx, dword [ebp - 0xac4]
xor ecx, ecx
mov ebx, ecx
test esi, esi
je 0x1001c51c
push edx
push esi
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xac8]
add esp, 0xc
mov dword [ebp - 0xcc0], eax
mov eax, dword [ebp - 0xb4c]
mov dword [ebp - 0xcc8], eax
test ebx, ebx
js 0x1001c545
mov eax, dword [ebp - 0xb70]
cmp eax, dword [ebp - 0xcc8]
je 0x1001c545
mov ebx, 0xc000003e
or ebx, 0x10000000
mov eax, dword [ebp - 0xab0]
test eax, eax
je 0x1001c566
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
mov esi, dword [ebp - 0xaac]
test esi, esi
je 0x1001c5d4
xor eax, eax
cmp dword [esi + 4], eax
je 0x1001c58d
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0x1001c5a9
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0x1001c5c5
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
mov eax, dword [ebp - 0xbc8]
test eax, eax
je 0x1001c5ef
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
mov eax, dword [ebp - 0xa90]
test eax, eax
je 0x1001c60a
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
mov esi, dword [ebp - 0xa94]
test esi, esi
je 0x1001c678
xor eax, eax
cmp dword [esi + 4], eax
je 0x1001c631
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0x1001c64d
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0x1001c669
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
mov eax, dword [ebp - 0xad4]
test eax, eax
je 0x1001c693
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test ebx, ebx
js 0x1001c731
mov esi, dword [ebp - 0xcc8]
xor ebx, ebx
inc ebx
cmp esi, ebx
jb 0x1001c731
mov ecx, dword [ebp - 0xcc0]
test ecx, ecx
je 0x1001c731
test esi, esi
je 0x1001c731
lea eax, [ebp - 0xc28]
mov dword [ebp - 0xc28], ecx
push eax
mov edx, edi
call fcn.1000e6b4
test eax, eax
js 0x1001c731
mov eax, dword [ecx]
neg eax
sbb eax, eax
and eax, dword [ebp - 0xc28]
cmp dword [ecx], edi
jne 0x1001c731
cmp dword [eax], 0
jl 0x1001c731
cmp esi, ebx
jbe 0x1001c731
xor eax, eax
mov dword [ebp - 0xc24], ecx
mov esi, eax
mov ebx, dword [ecx]
lea eax, [ebp - 0xc24]
push eax
mov edx, edi
call fcn.1000e6b4
test eax, eax
js 0x1001c731
mov ecx, dword [ebp - 0xc24]
lea eax, [ebp - 0xc24]
push eax
mov edx, ebx
call fcn.1000e6b4
test eax, eax
js 0x1001c731
xor eax, eax
inc esi
inc eax
cmp esi, eax
jae 0x1001c731
mov ecx, dword [ebp - 0xc24]
jmp 0x1001c6f5
mov esi, dword [ebp - 0xa88]
mov ebx, dword [ebp - 0xa68]
mov eax, dword [ebp - 0xa78]
test eax, eax
je 0x1001c758
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
mov ecx, dword [ebp - 0xcc0]
test ecx, ecx
je 0x1001c773
push ecx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test esi, esi
je 0x1001c788
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
test ebx, ebx
je 0x1001c79d
push ebx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapFree]
mov ebx, dword [ebp - 0xa64]
jmp 0x100118b1
push eax
call dword [sym.imp.api_ms_win_core_heap_obsolete_l1_1_0.dll_LocalFree]
jmp 0x10011942
cmp ebx, 0xd0000034
jne 0x1001c7c8
mov ebx, 0xc004f012
mov esi, ebx
push 4
pop ebx
jmp 0x1001c808
cmp ebx, 0xd00000e5
je 0x1001c7e7
cmp ebx, 0xc004d501
je 0x1001c7e7
cmp ebx, 0xd000003e
jne 0x1001c7ec
mov ebx, 0xc004f028
jmp 0x1001c7c1
mov ebx, 0xc004f027
test ebx, ebx
jns 0x10011950
cmp ebx, 0x8007007a
jne 0x1001c7c1
mov esi, 0xc004f01e
jmp 0x1001c7c3
mov esi, 0xc004f01e
mov edi, dword [ebp - 0xc58]
jmp 0x10011967
xor ecx, ecx
jmp 0x1001197e
mov edi, ecx
jmp 0x10011986
cmp ecx, 0x16
jae 0x1001c838
push 0x20
pop edx
cmp ecx, edx
jb 0x100119f1
push 7
jmp 0x100119f0
push 0x20
pop eax
cmp ecx, eax
jae 0x1001c831
push 5
jmp 0x100119f0
call fcn.10022c5d
test al, al
jne 0x1001c853
mov eax, ebx
jmp 0x1001c872
cmp dword [ebp - 0xc18], 0x16
jae 0x1001c861
push 3
pop eax
jmp 0x1001c872
push 0x20
pop eax
cmp dword [ebp - 0xc18], eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 7
push 3
pop ebx
jmp 0x100119f1