Function at 0xcad332
Capabilities:
Encode data using xor
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x9d4
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, ecx
push 0x40
push eax
mov dword [ebp - 0x8e0], eax
lea eax, [ebp - 0x450]
push eax
mov dword [ebp - 0x954], esi
call fcn.00bc259b
add esp, 0xc
lea eax, [ebp - 0x450]
push eax
push dword [esi + 0x18]
call dword [sym.imp.ext_ms_win_ntuser_draw_l1_1_0.dll_BeginPaint]
mov ebx, eax
mov dword [ebp - 0x920], ebx
test ebx, ebx
jne 0xcad3af
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcad39f
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcb16e6
mov ebx, 0x80004005
jmp 0xcb16e6
xor eax, eax
lea edi, [ebp - 0x188]
mov dword [ebp - 0x988], eax
mov dword [ebp - 0x984], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [esi + 0x4c]
neg eax
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov esi, eax
test esi, esi
jne 0xcad3ed
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xcad42d
xor eax, eax
push 0x4e
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], eax
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
push 0x4f
mov dword [ebp - 0x180], eax
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
mov dword [ebp - 0x17c], eax
lea eax, [ebp - 0x188]
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_FillRect]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ebx, dword [ebp - 0x954]
xor eax, eax
inc eax
push eax
lea eax, [ebp - 0x988]
push eax
push dword [ebx + 0x18]
xor eax, eax
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_MapWindowPoints]
mov eax, dword [ebx + 0x44]
xor ebx, ebx
push 0x54
mov dword [ebp - 0x91c], eax
lea eax, [ebp - 0x588]
push ebx
push eax
call fcn.00bc259b
xor eax, eax
mov dword [ebp - 0x9a4], ebx
lea edi, [ebp - 0x940]
mov dword [ebp - 0x9a0], ebx
stosd dword es:[edi], eax
add esp, 0xc
mov dword [ebp - 0x918], ebx
mov dword [ebp - 0x930], ebx
stosd dword es:[edi], eax
push 0x2c
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x274]
push eax
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0x944], ebx
mov edx, 0xd0aed4
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xcad4a8
mov eax, dword [0xd0a150]
mov ebx, 0xb2bef2
mov dword [ebp - 0x8d0], ebx
mov dword [ebp - 0x8d8], 0x67
mov dword [ebp - 0x8a8], 0x337
mov dword [ebp - 0x8dc], 0x10b
mov dword [ebp - 0x8d4], 0x20b
test eax, eax
jne 0xcadb06
push 0x338
mov esi, eax
mov dword [ebp - 0x8ac], eax
push eax
mov dword [ebp - 0x8b4], eax
mov dword [ebp - 0x8e4], esi
mov dword [ebp - 0x8f4], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x8f0], eax
test eax, eax
je 0xcadafa
or dword [ebp - 0x8c0], 0xffffffff
xor edx, edx
mov edi, edx
mov dword [ebp - 0x1c0], 0xab69605e
add eax, 7
mov dword [ebp - 0x1bc], 0x7f1137f
mov cl, dl
mov dword [ebp - 0x8b0], edx
mov dword [ebp - 0x8f8], edx
mov esi, ebx
mov dword [ebp - 0x904], edi
mov dword [ebp - 0x8cc], eax
mov dword [ebp - 0x8e8], 0x67
movzx edx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx ebx, byte [esi + 2]
shl edx, 8
or edx, eax
shl ebx, 8
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
or ebx, eax
mov dword [ebp - 0x8a4], edx
movzx eax, byte [esi + 4]
xor edi, edx
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 5]
add esi, 8
shl ebx, 8
or ebx, eax
mov dword [ebp - 0x8c8], esi
mov esi, ebx
xor esi, dword [ebp - 0x8f8]
xor esi, edi
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor edi, edx
lea eax, [edi + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, edi
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor edi, edx
mov eax, edi
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor edi, eax
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor edi, edx
lea eax, [edi + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, edi
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edi, eax
mov dword [ebp - 0x8bc], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0x8bc]
xor edi, 0xab69605e
mov eax, edi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, edi
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0x8bc], esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
mov eax, esi
xor edi, edx
xor eax, edi
xor eax, 0xac987321
mov dword [ebp - 0x8bc], eax
ror eax, 3
sub eax, 0xab69
mov esi, dword [ebp - 0x8bc]
imul eax, eax, 0x137f
xor edi, eax
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, edi
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
xor edi, edx
lea eax, [edi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, edi
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0x8bc], esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, edi
xor edi, dword [ebp - 0x8c0]
rol eax, 2
mov dword [ebp - 0x8f8], edi
mov dword [ebp - 0x8c0], ebx
xor edx, eax
mov eax, esi
xor edx, dword [ebp - 0x8b0]
xor eax, edx
mov esi, dword [ebp - 0x8c8]
mov edx, dword [ebp - 0x8cc]
mov dword [ebp - 0x904], eax
mov byte [edx - 4], al
mov al, byte [ebp - 0x8f8]
ror dword [ebp - 0x904], 8
mov byte [edx], al
mov al, byte [ebp - 0x904]
ror dword [ebp - 0x8f8], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0x8f8]
ror dword [ebp - 0x904], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0x904]
ror dword [ebp - 0x8f8], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0x8f8]
ror dword [ebp - 0x904], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0x904]
ror dword [ebp - 0x8f8], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0x8f8]
mov byte [edx - 3], al
add edx, 8
mov eax, dword [ebp - 0x904]
ror dword [ebp - 0x8f8], 8
ror eax, 8
sub dword [ebp - 0x8e8], 1
mov dword [ebp - 0x8bc], eax
mov edi, dword [ebp - 0x8bc]
mov dword [ebp - 0x904], eax
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0x8b0], eax
mov dword [ebp - 0x8cc], edx
jne 0xcad578
mov esi, dword [ebp - 0x8f0]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xcad8d2
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xcad904
cmp edx, dword [0xb2c22c]
jne 0xcad904
mov edi, esi
xor eax, eax
mov dword [ebp - 0x8e4], edi
mov esi, eax
mov ebx, 0x337
jmp 0xcad919
mov edi, dword [ebp - 0x8e4]
or ebx, 0xffffffff
mov dword [ebp - 0x8f4], 0xc004d501
xor eax, eax
test esi, esi
je 0xcad92c
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0x8f4], 0
jl 0xcadaf4
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xd0ae80
push eax
push ebx
call fcn.00bc259b
add esp, 0xc
cmp byte [edi], 0
je 0xcada8a
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x8e0]
jne 0xcad963
sub ecx, ebx
xor ebx, ebx
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xcadaed
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0x8b4], edx
cmp word [eax], cx
je 0xcad9ad
mov edx, 0xc000007b
mov dword [ebp - 0x8b4], edx
jmp 0xcad9f5
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xcad9a0
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xcad9a0
cmp dword [ecx], 0x4550
jne 0xcad9a0
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0x8dc]
je 0xcad9e3
cmp ax, word [ebp - 0x8d4]
je 0xcad9e3
mov edx, 0xc000000d
jmp 0xcad9a5
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0x8f0], eax
test eax, eax
je 0xcada7e
mov ecx, esi
mov dword [ebp - 0x8c8], esi
xor eax, eax
mov dword [ebp - 0x94c], eax
lea eax, [ecx + 1]
mov dword [ebp - 0x8a4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xcada1e
sub ecx, dword [ebp - 0x8a4]
inc esi
add esi, ecx
test edx, edx
js 0xcada68
mov ecx, dword [ebp - 0x8c8]
lea eax, [ebp - 0x94c]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0x8b4], edx
test edx, edx
js 0xcada8a
mov eax, dword [ebp - 0x8ac]
mov ecx, dword [ebp - 0x94c]
mov dword [eax*4 + section..data], ecx
jmp 0xcada6e
mov eax, dword [ebp - 0x8ac]
inc eax
inc ebx
mov dword [ebp - 0x8ac], eax
cmp ebx, dword [ebp - 0x8f0]
jb 0xcada05
add edi, 0x10
cmp byte [esi], 0
jne 0xcad95c
mov ebx, dword [ebp - 0x8b4]
mov esi, dword [ebp - 0x8e4]
test esi, esi
je 0xcadaab
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xcadb01
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xcadac4
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xcadab3
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xcadb0e
mov ebx, 0xc000007a
jmp 0xcada90
mov esi, dword [ebp - 0x8e4]
mov ebx, 0xc000007a
jmp 0xcada96
mov eax, dword [0xd0a150]
inc eax
xor ebx, ebx
mov dword [0xd0a150], eax
xor eax, eax
mov edx, 0xd0aed4
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0xa], ebx
lea edi, [ebp - 0x970]
mov dword [ebp - 0x8ec], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x8c4], ebx
mov dword [ebp - 0x8f4], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x9b4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xcadb43
mov eax, dword [0xd0a150]
test eax, eax
jne 0xcae146
push 0x338
mov esi, ebx
mov dword [ebp - 0x8ac], ebx
push ebx
mov dword [ebp - 0x8b4], ebx
mov dword [ebp - 0x8e4], esi
mov dword [ebp - 0x910], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x914], eax
test eax, eax
je 0xcae138
or dword [ebp - 0x8c0], 0xffffffff
mov edi, ebx
add eax, 7
mov dword [ebp - 0x1c8], 0xab69605e
mov cl, bl
mov dword [ebp - 0x1c4], 0x7f1137f
mov dword [ebp - 0x8b0], ebx
mov dword [ebp - 0x8fc], ebx
mov dword [ebp - 0x908], edi
mov dword [ebp - 0x8cc], eax
mov esi, dword [ebp - 0x8d0]
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edx, byte [esi + 2]
shl edx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edx, eax
mov dword [ebp - 0x8c8], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl edx, 8
mov ebx, 0xab69605e
or edx, eax
movzx eax, byte [esi + 5]
shl edx, 8
add esi, 8
or edx, eax
mov dword [ebp - 0x8d0], esi
mov esi, edx
mov dword [ebp - 0x8f0], edx
xor esi, dword [ebp - 0x8fc]
xor esi, edi
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor edi, edx
lea eax, [edi + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, edi
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor edi, edx
mov eax, edi
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, ebx
sub eax, edx
xor edi, eax
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor edi, edx
lea eax, [edi + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, ebx
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, edi
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edi, eax
mov dword [ebp - 0x8a4], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0x8a4]
xor edi, ebx
mov eax, edi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, edi
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov ebx, edi
xor ebx, esi
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor edi, eax
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, edi
ror eax, 6
sub edx, eax
xor ebx, edx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add edx, eax
xor edi, edx
lea eax, [edi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, edi
ror eax, 0xe
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, edi
xor edi, dword [ebp - 0x8c0]
rol eax, 2
mov dword [ebp - 0x8fc], edi
xor edx, eax
xor edx, dword [ebp - 0x8b0]
xor ebx, edx
mov edx, dword [ebp - 0x8cc]
mov dword [ebp - 0x908], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0x8fc]
ror dword [ebp - 0x908], 8
mov byte [edx], al
mov al, byte [ebp - 0x908]
ror dword [ebp - 0x8fc], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0x8fc]
ror dword [ebp - 0x908], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0x908]
ror dword [ebp - 0x8fc], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0x8fc]
ror dword [ebp - 0x908], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0x908]
ror dword [ebp - 0x8fc], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0x8fc]
mov byte [edx - 3], al
add edx, 8
mov edi, dword [ebp - 0x908]
mov eax, dword [ebp - 0x8c8]
ror dword [ebp - 0x8fc], 8
ror edi, 8
sub dword [ebp - 0x8d8], 1
mov dword [ebp - 0x8b0], eax
mov eax, dword [ebp - 0x8f0]
mov dword [ebp - 0x908], edi
mov dword [ebp - 0x8c0], eax
mov dword [ebp - 0x8cc], edx
jne 0xcadbd2
mov esi, dword [ebp - 0x914]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xcadf0f
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xcadf42
cmp edx, dword [0xb2c22c]
jne 0xcadf42
mov ebx, dword [ebp - 0x910]
mov edi, esi
xor eax, eax
mov dword [ebp - 0x8e4], edi
mov esi, eax
jmp 0xcadf56
or dword [ebp - 0x8a8], 0xffffffff
mov ebx, 0xc004d501
mov edi, dword [ebp - 0x8e4]
xor eax, eax
test esi, esi
je 0xcadf69
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xcae132
mov eax, dword [ebp - 0x8a8]
xor ecx, ecx
push 0x40
push ecx
mov ebx, 0xd0ae80
mov esi, edi
push ebx
mov byte [eax + edi], cl
call fcn.00bc259b
add esp, 0xc
cmp byte [edi], 0
je 0xcae0c8
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x8e0]
jne 0xcadfa1
sub ecx, ebx
xor ebx, ebx
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xcae12b
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0x8b4], edx
cmp word [eax], cx
je 0xcadfeb
mov edx, 0xc000007b
mov dword [ebp - 0x8b4], edx
jmp 0xcae033
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xcadfde
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xcadfde
cmp dword [ecx], 0x4550
jne 0xcadfde
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0x8dc]
je 0xcae021
cmp ax, word [ebp - 0x8d4]
je 0xcae021
mov edx, 0xc000000d
jmp 0xcadfe3
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0x8f0], eax
test eax, eax
je 0xcae0bc
mov ecx, esi
mov dword [ebp - 0x8c8], esi
xor eax, eax
mov dword [ebp - 0x950], eax
lea eax, [ecx + 1]
mov dword [ebp - 0x8a4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xcae05c
sub ecx, dword [ebp - 0x8a4]
inc esi
add esi, ecx
test edx, edx
js 0xcae0a6
mov ecx, dword [ebp - 0x8c8]
lea eax, [ebp - 0x950]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0x8b4], edx
test edx, edx
js 0xcae0c8
mov eax, dword [ebp - 0x8ac]
mov ecx, dword [ebp - 0x950]
mov dword [eax*4 + section..data], ecx
jmp 0xcae0ac
mov eax, dword [ebp - 0x8ac]
inc eax
inc ebx
mov dword [ebp - 0x8ac], eax
cmp ebx, dword [ebp - 0x8f0]
jb 0xcae043
add edi, 0x10
cmp byte [esi], 0
jne 0xcadf9a
mov ebx, dword [ebp - 0x8b4]
mov esi, dword [ebp - 0x8e4]
test esi, esi
je 0xcae0e9
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xcae13f
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xcae102
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xcae0f1
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xcae14c
mov ebx, 0xc000007a
jmp 0xcae0ce
mov esi, dword [ebp - 0x8e4]
mov ebx, 0xc000007a
jmp 0xcae0d4
mov eax, dword [0xd0a150]
xor ebx, ebx
inc eax
mov dword [0xd0a150], eax
xor eax, eax
mov edi, 0xd0aed4
xchg dword [edi], eax
push 0x54
lea eax, [ebp - 0x588]
push ebx
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0x91c]
add esp, 0xc
mov esi, dword [0xd0807c]
mov ecx, eax
mov dword [ebp - 0x940], ebx
push 0xf
pop edx
and ecx, edx
mov dword [ebp - 0x8b4], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0xc], cx
mov ecx, eax
shr ecx, 8
push 0x403
and ecx, edx
shr eax, 0xc
push ebx
mov word [ebp - 0xa], cx
and eax, edx
push ebx
mov ecx, esi
mov word [ebp - 8], ax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x8d4], eax
mov dword [ebp - 0x8e4], 0xffffff
test eax, eax
jne 0xcae1f1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcae1e1
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcaf62b
mov ebx, 0x80004005
jmp 0xcaf62b
mov esi, dword [0xd08050]
mov eax, ebx
mov dword [ebp - 0x8bc], eax
mov edi, ebx
lea eax, [ebp - 0x948]
mov dword [ebp - 0x8b8], edi
push eax
push ebx
lea eax, [ebp - 0x924]
mov dword [ebp - 0x92c], ebx
push eax
push 8
mov ecx, esi
mov dword [ebp - 0x8d8], ebx
mov dword [ebp - 0x8a8], ebx
mov dword [ebp - 0x948], ebx
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcae2c7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcae259
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcae430
mov ebx, 0x80004005
mov esi, dword [ebp - 0x8a8]
xor edx, edx
mov eax, dword [ebp - 0x92c]
test eax, eax
je 0xcae288
mov ecx, dword [ebp - 0x8d8]
test ecx, ecx
je 0xcae288
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0xcae280
test esi, esi
je 0xcae29b
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0x92c]
test eax, eax
je 0xcaebad
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0x92c], ecx
jmp 0xcaebaf
mov eax, dword [ebp - 0x948]
add eax, eax
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0x8cc], ebx
test ebx, ebx
jne 0xcae2f4
mov ebx, 0x8007000e
jmp 0xcae264
mov eax, dword [ebp - 0x924]
lea eax, [eax*4 + 4]
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0x8c0], eax
test eax, eax
je 0xcae415
mov esi, eax
lea eax, [ebp - 0x948]
push eax
push ebx
mov ebx, dword [0xd08050]
lea eax, [ebp - 0x924]
push eax
push 8
mov ecx, ebx
call dword [0xd0cffc]
call ebx
test eax, eax
jne 0xcae36c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcae35e
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcae365
mov ebx, 0x80004005
xor ecx, ecx
jmp 0xcae400
mov eax, dword [ebp - 0x8c0]
xor ecx, ecx
mov ebx, eax
mov edi, dword [ebp - 0x8cc]
mov dword [ebp - 0x8b0], ecx
cmp dword [ebp - 0x924], ecx
jbe 0xcae3dd
mov esi, dword [0xd08058]
push ecx
push edi
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, edi
mov dword [ebx], eax
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0xcae3a5
sub ecx, edx
sar ecx, 1
push 4
pop eax
add ebx, eax
mov eax, dword [ebp - 0x8b0]
lea edi, [edi + ecx*2]
add edi, 2
inc eax
push 0
mov dword [ebp - 0x8b0], eax
pop ecx
cmp eax, dword [ebp - 0x924]
jb 0xcae38a
mov eax, dword [ebp - 0x8c0]
mov dword [ebx], 0x409
mov edi, eax
mov ebx, dword [ebp - 0x8bc]
mov esi, ecx
mov dword [ebp - 0x8b8], eax
mov eax, dword [ebp - 0x924]
inc eax
mov dword [ebp - 0x8b0], eax
test esi, esi
je 0xcae41a
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xcae41a
mov ebx, 0x8007000e
push dword [ebp - 0x8cc]
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xcae264
xor eax, eax
mov ebx, eax
mov edx, eax
mov dword [ebp - 0x8ac], ebx
cmp dword [ebp - 0x8b0], eax
jbe 0xcae477
mov ecx, eax
mov eax, dword [edi + edx*4]
cmp eax, dword [ecx*4 + 0xb40a18]
je 0xcae46d
inc ecx
cmp ecx, 0x26
jb 0xcae44e
inc edx
xor eax, eax
cmp edx, dword [ebp - 0x8b0]
jae 0xcae477
jmp 0xcae44c
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x8ac], ebx
mov esi, dword [0xd08054]
mov ecx, esi
push eax
mov dword [ebp - 0x8d0], eax
lea eax, [ebp - 0xc0]
push 0x55
push eax
push dword [ebx*4 + 0xb40a18]
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcae4e0
mov esi, dword [0xd08048]
lea eax, [ebp - 0x410]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xc0]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
test eax, eax
jle 0xcae4e0
mov ebx, dword [ebp - 0x404]
shr ebx, 0x1b
and ebx, 1
mov dword [ebp - 0x8d0], ebx
mov ebx, dword [ebp - 0x8ac]
xor eax, eax
mov edx, 0xb2fcd8
mov esi, eax
mov ecx, edx
mov dword [ebp + esi*4 - 0x128], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x8e0]
jne 0xcae4f5
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0xcae4e9
imul ecx, ebx, 3
movzx eax, byte [ecx + 0xb320b0]
mov eax, dword [ebp + eax*4 - 0x128]
mov dword [ebp - 0x970], eax
movzx eax, byte [ecx + 0xb320b1]
mov eax, dword [ebp + eax*4 - 0x128]
mov dword [ebp - 0x96c], eax
movzx eax, byte [ecx + 0xb320b2]
mov eax, dword [ebp + eax*4 - 0x128]
mov dword [ebp - 0x968], eax
xor ebx, ebx
push 0x1c90
mov eax, ebx
push ebx
mov dword [ebp - 0x8bc], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x8f0], ecx
test ecx, ecx
je 0xcae2ea
or dword [ebp - 0x8c0], 0xffffffff
mov esi, ebx
add ecx, 7
mov dword [ebp - 0x1b8], 0xab69605e
mov edi, 0xb40ac2
mov dword [ebp - 0x1b4], 0x7f1137f
mov al, bl
mov dword [ebp - 0x8b0], ebx
mov dword [ebp - 0x900], esi
mov dword [ebp - 0x90c], ebx
mov dword [ebp - 0x8cc], ecx
mov dword [ebp - 0x8dc], edi
mov dword [ebp - 0x8e8], 0x392
movzx edx, byte [edi - 2]
movzx ecx, byte [edi - 1]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
movzx edi, byte [edi + 2]
shl edx, 8
or edx, ecx
shl edi, 8
mov ecx, dword [ebp - 0x8dc]
xor ebx, edx
mov dword [ebp - 0x8c8], edx
movzx ecx, byte [ecx + 3]
or edi, ecx
mov ecx, dword [ebp - 0x8dc]
shl edi, 8
movzx ecx, byte [ecx + 4]
or edi, ecx
mov ecx, dword [ebp - 0x8dc]
shl edi, 8
add dword [ebp - 0x8dc], 8
movzx ecx, byte [ecx + 5]
or edi, ecx
xor esi, edi
xor esi, ebx
xor esi, 0xac987321
lea ecx, [esi + 0x54969fa2]
rol ecx, 5
imul edx, ecx, 0x137f
mov ecx, esi
rol ecx, 0xa
add edx, ecx
xor ebx, edx
lea ecx, [ebx + 0x7f1137f]
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, ebx
rol ecx, 2
sub edx, ecx
xor esi, edx
imul edx, esi, 0x605e
mov ecx, esi
shr ecx, 0xd
sub edx, ecx
sub edx, 0x756c8a2
xor ebx, edx
mov ecx, ebx
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub ecx, edx
xor ebx, ecx
mov ecx, ebx
mov edx, ebx
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
xor esi, edx
lea ecx, [esi + 0x7f1137f]
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, esi
rol ecx, 2
add edx, ecx
xor ebx, edx
lea ecx, [ebx + 0x54969fa2]
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 8
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0xab69605e
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, esi
ror ecx, 0xa
xor edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, ebx
shr ecx, 0xa
xor edx, ecx
xor esi, edx
mov ecx, esi
mov dword [ebp - 0x8a4], esi
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor ebx, ecx
lea esi, [ebx - 0x7f1]
xor esi, dword [ebp - 0x8a4]
xor esi, 0xab69605e
mov ecx, esi
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, esi
shr ecx, 2
add edx, ecx
xor ebx, edx
lea ecx, [ebx - 0x7f1137f]
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, ebx
rol ecx, 7
add edx, ecx
xor esi, edx
mov ecx, esi
mov edx, esi
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor ebx, edx
mov ecx, ebx
mov dword [ebp - 0x8a4], ebx
xor ecx, 0xab69
rol ecx, 5
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 7
add edx, ecx
xor esi, edx
mov ebx, esi
xor ebx, dword [ebp - 0x8a4]
xor ebx, 0xac987321
mov ecx, ebx
ror ecx, 3
sub ecx, 0xab69
imul ecx, ecx, 0x137f
xor esi, ecx
lea ecx, [esi - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, esi
ror ecx, 6
sub edx, ecx
xor ebx, edx
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 0xe
add edx, ecx
xor esi, edx
lea ecx, [esi - 0x54969fa2]
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, esi
ror ecx, 0xe
sub edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, ebx
shr ecx, 3
xor edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0x7f1137f
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, esi
xor esi, dword [ebp - 0x8c0]
rol ecx, 2
mov dword [ebp - 0x900], esi
mov dword [ebp - 0x8c0], edi
xor edx, ecx
mov edi, dword [ebp - 0x8dc]
xor edx, dword [ebp - 0x8b0]
xor ebx, edx
mov edx, dword [ebp - 0x8cc]
mov dword [ebp - 0x90c], ebx
mov byte [edx - 4], bl
mov cl, byte [ebp - 0x900]
ror dword [ebp - 0x90c], 8
mov byte [edx], cl
mov cl, byte [ebp - 0x90c]
ror dword [ebp - 0x900], 8
mov byte [edx - 5], cl
mov cl, byte [ebp - 0x900]
ror dword [ebp - 0x90c], 8
mov byte [edx - 1], cl
mov cl, byte [ebp - 0x90c]
ror dword [ebp - 0x900], 8
mov byte [edx - 6], cl
mov cl, byte [ebp - 0x900]
ror dword [ebp - 0x90c], 8
mov byte [edx - 2], cl
ror dword [ebp - 0x900], 8
mov cl, byte [ebp - 0x90c]
mov byte [edx - 7], cl
mov cl, byte [ebp - 0x900]
mov byte [edx - 3], cl
add edx, 8
mov ebx, dword [ebp - 0x90c]
mov esi, dword [ebp - 0x900]
mov ecx, dword [ebp - 0x8c8]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0x8e8], 1
mov dword [ebp - 0x90c], ebx
mov dword [ebp - 0x900], esi
mov dword [ebp - 0x8b0], ecx
mov dword [ebp - 0x8cc], edx
jne 0xcae5cf
xor ecx, ecx
mov esi, 0x1c90
mov edx, ecx
mov ecx, dword [ebp - 0x8f0]
xor al, byte [edx + ecx]
inc edx
cmp edx, esi
jb 0xcae932
movzx eax, al
cdq
cmp eax, dword [0xb42750]
jne 0xcae966
cmp edx, dword [0xb42754]
jne 0xcae966
mov ebx, dword [ebp - 0x8bc]
xor edx, edx
mov dword [ebp - 0x92c], ecx
mov ecx, edx
mov dword [ebp - 0x8d8], esi
jmp 0xcae973
mov ebx, 0xc004d501
xor edx, edx
mov dword [ebp - 0x8bc], ebx
test ecx, ecx
je 0xcae986
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xcae264
mov edi, dword [ebp - 0x92c]
xor eax, eax
mov ebx, dword [ebp - 0x8ac]
mov esi, eax
mov edx, eax
cmp ebx, edx
jne 0xcae9ab
mov dword [ebp + esi*4 - 0xd8], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0x8a4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xcae9b6
sub ecx, dword [ebp - 0x8a4]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0xcae9a0
inc esi
push 0
pop eax
cmp esi, 6
jb 0xcae99e
push 0xc
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, dword [ebp - 0x8bc]
mov edx, eax
mov dword [ebp - 0x8b0], edx
test edx, edx
jne 0xcaea05
xor edx, edx
mov ebx, 0x8007000e
mov esi, edx
jmp 0xcae26c
mov edi, edx
xor eax, eax
mov esi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x8ac], eax
movzx edx, word [ebp + ecx*2 - 0xc]
cmp dx, word [eax*2 + 0xb40ab0]
je 0xcaea32
inc eax
cmp eax, 6
jb 0xcaea1d
jmp 0xcaeaf1
mov edx, dword [ebp + eax*4 - 0xd8]
mov ecx, edx
mov dword [ebp - 0x8a4], edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xcaea44
xor eax, eax
sub ecx, edi
mov edi, dword [0xd08060]
push eax
push eax
lea eax, [ecx + 1]
mov ecx, edi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0xd0cffc]
call edi
mov dword [ebp - 0x8c8], eax
test eax, eax
je 0xcaeb29
lea ecx, [eax + eax]
xor eax, eax
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0x8ac]
mov edi, eax
mov eax, dword [ebp - 0x8b0]
mov dword [eax + ecx*4], edi
test edi, edi
je 0xcaeb22
mov edx, dword [ebp - 0x8a4]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x8a4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xcaeab6
push dword [ebp - 0x8c8]
sub ecx, dword [ebp - 0x8a4]
push edi
mov edi, dword [0xd08060]
lea eax, [ecx + 1]
mov ecx, edi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0xd0cffc]
call edi
test eax, eax
je 0xcaeb29
mov ecx, dword [ebp - 0x8ac]
inc ecx
mov dword [ebp - 0x8ac], ecx
push 0
pop eax
cmp ecx, 3
jb 0xcaea18
mov eax, dword [ebp - 0x8b0]
xor edx, edx
mov dword [ebp - 0x8f4], eax
mov esi, edx
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0x588], eax
jmp 0xcaeb49
mov ebx, 0x8007000e
jmp 0xcaeb47
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcaeb40
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcaeb47
mov ebx, 0x80004005
xor edx, edx
test esi, esi
je 0xcae26c
mov edi, edx
mov edx, dword [esi + edi*4]
test edx, edx
je 0xcaeba2
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x8a4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x8e0]
jne 0xcaeb65
sub ecx, dword [ebp - 0x8a4]
xor eax, eax
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xcaeb91
mov byte [edx], al
inc edx
sub ecx, 1
jne 0xcaeb89
push dword [esi + edi*4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
inc edi
cmp edi, 3
jb 0xcaeb53
jmp 0xcae26a
xor ecx, ecx
mov eax, dword [ebp - 0x8b8]
test eax, eax
je 0xcaebc8
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xcaf60d
mov eax, dword [ebp - 0x8f4]
mov esi, dword [0xd080b4]
mov ecx, dword [eax]
mov dword [ebp - 0x580], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x57c], ecx
xor ecx, ecx
mov eax, dword [eax + 8]
mov edi, ecx
push ecx
mov dword [ebp - 0x578], eax
mov ebx, ecx
lea eax, [ebp - 0x9c0]
mov dword [ebp - 0x9bc], ecx
push eax
push ecx
mov dword [ebp - 0x9b8], ecx
mov ecx, esi
push 0x42
mov dword [ebp - 0x9c0], 0xc
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcaec4b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcaec42
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcaec54
mov ebx, 0x80004005
jmp 0xcaec54
mov edi, dword [ebp - 0x9bc]
and edi, 1
mov dword [ebp - 0x584], edi
test ebx, ebx
js 0xcaf60d
mov ebx, dword [ebp - 0x8b4]
mov eax, ebx
push 0xb
pop edx
push 0x2a
pop ecx
mov dword [ebp - 0x8e0], ecx
sub eax, 1
je 0xcaeca4
sub eax, 1
je 0xcaec98
sub eax, 1
jne 0xcaecb0
mov eax, 0xe1
mov dword [ebp - 0x8ec], eax
mov dword [ebp - 0x8c4], eax
jmp 0xcaecb0
mov dword [ebp - 0x8ec], 0xf
jmp 0xcaecaa
mov dword [ebp - 0x8ec], ecx
mov dword [ebp - 0x8c4], edx
push 0x60
pop edi
xor eax, eax
mov dword [ebp - 0x8a8], edi
lea esi, [edi + 0x7c]
push esi
push eax
lea eax, [ebp - 0x530]
push eax
call fcn.00bc259b
add esp, 0xc
mov word [ebp - 0x4ec], si
mov esi, dword [0xd08070]
lea eax, [ebp - 0x530]
mov ecx, esi
push eax
push 0xffffffffffffffff
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
xor edx, edx
test eax, eax
je 0xcaed45
movzx edi, word [ebp - 0x48a]
mov eax, dword [ebp - 0x484]
mov ecx, dword [ebp - 0x480]
mov dword [ebp - 0x8a8], edi
mov dword [ebp - 0x9b0], edx
mov dword [ebp - 0x9b4], edx
mov dword [ebp - 0x8ac], eax
mov dword [ebp - 0x9ac], eax
mov dword [ebp - 0x8b0], ecx
mov dword [ebp - 0x9a8], ecx
cmp edi, 0x60
jae 0xcaed5d
push 0x60
pop edi
mov dword [ebp - 0x8a8], edi
jmp 0xcaed5d
mov eax, dword [ebp - 0x9a8]
mov dword [ebp - 0x8b0], eax
mov eax, dword [ebp - 0x9ac]
mov dword [ebp - 0x8ac], eax
mov eax, dword [ebp - 0x970]
cmp ebx, 1
je 0xcaed6e
mov eax, dword [ebp - 0x968]
push 0x5c
mov dword [ebp - 0x8b8], eax
lea eax, [ebp - 0x390]
push edx
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x8a4], eax
test eax, eax
jne 0xcaedd2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcaedc2
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcaee72
mov ebx, 0x80004005
jmp 0xcaf60d
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push edi
push dword [ebp - 0x8ec]
call dword [0xd0cffc]
call esi
push dword [ebp - 0x8b8]
neg eax
mov dword [ebp - 0x380], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x374]
mov dword [ebp - 0x390], eax
mov byte [ebp - 0x376], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x390]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcaee53
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcaee4a
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcaee59
mov ebx, 0x80004005
jmp 0xcaee59
mov dword [ebp - 0x574], eax
push dword [ebp - 0x8a4]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xcaf60d
cmp dword [ebp - 0x8b4], 1
mov eax, dword [ebp - 0x970]
je 0xcaee8f
mov eax, dword [ebp - 0x968]
mov dword [ebp - 0x8b8], eax
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0x330]
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x8a4], eax
test eax, eax
jne 0xcaef64
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcaeee9
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0xcaedc8
push 0x20
pop edi
test ebx, ebx
js 0xcaf60d
mov ebx, dword [ebp - 0x8b4]
xor ecx, ecx
mov eax, ecx
mov edx, ecx
mov ecx, ebx
sub ecx, 1
je 0xcaef1b
sub ecx, 1
je 0xcaf00b
sub ecx, 1
jne 0xcaef27
mov eax, dword [ebp - 0x8ac]
mov edx, dword [ebp - 0x8b0]
xor ecx, ecx
mov dword [ebp - 0x938], eax
mov dword [ebp - 0x934], edx
xor edx, edx
inc edx
cmp ebx, edx
je 0xcaf046
jbe 0xcaf020
cmp ebx, 3
ja 0xcaf020
xor ebx, ebx
mov edx, ecx
mov dword [ebp - 0x8e0], ebx
mov dword [ebp - 0x8ec], ebx
jmp 0xcaf051
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push edi
push dword [ebp - 0x8c4]
call dword [0xd0cffc]
call esi
push dword [ebp - 0x8b8]
neg eax
mov dword [ebp - 0x320], 0x190
push 0x20
pop edi
mov edx, edi
mov dword [ebp - 0x330], eax
lea ecx, [ebp - 0x314]
mov byte [ebp - 0x316], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x330]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcaefe7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcaefde
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcaefed
mov ebx, 0x80004005
jmp 0xcaefed
mov dword [ebp - 0x570], eax
push dword [ebp - 0x8a4]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xcaeef2
mov eax, dword [ebp - 0x8ac]
push 4
pop ecx
cdq
idiv ecx
xor ecx, ecx
mov edx, ecx
jmp 0xcaef29
mov ecx, dword [ebp - 0x928]
mov edx, dword [ebp - 0x928]
mov dword [ebp - 0x8ec], ecx
mov ecx, dword [ebp - 0x928]
mov dword [ebp - 0x8e0], ecx
mov ecx, dword [ebp - 0x928]
jmp 0xcaf051
mov edx, 0x96
mov dword [ebp - 0x8ec], edi
mov dword [ebp - 0x8e8], edx
mov dword [ebp - 0x8ac], ecx
push dword [ebp - 0x574]
mov esi, dword [0xd0803c]
sub eax, edx
push dword [ebp - 0x8d4]
mov edi, dword [ebp - 0x580]
sub eax, ecx
mov dword [ebp - 0x8c8], eax
mov ecx, esi
mov dword [ebp - 0x54c], eax
mov dword [ebp - 0x55c], eax
xor eax, eax
mov ebx, eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov ecx, esi
mov dword [ebp - 0x8a4], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x564]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0x8d4]
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcaf0d1
mov ebx, 0x80004005
mov eax, dword [ebp - 0x8a4]
test eax, eax
je 0xcaf0ed
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xcaf60d
push dword [ebp - 0x570]
mov esi, dword [0xd0803c]
xor eax, eax
push dword [ebp - 0x8d4]
mov edi, dword [ebp - 0x57c]
mov ecx, esi
mov ebx, eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov ecx, esi
mov dword [ebp - 0x8a4], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x554]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0x8d4]
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcaf153
mov ebx, 0x80004005
mov eax, dword [ebp - 0x8a4]
test eax, eax
je 0xcaf16f
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xcaf60d
mov eax, dword [ebp - 0x8b4]
cmp eax, 2
je 0xcaf187
cmp eax, 3
jne 0xcaf19d
mov edi, dword [ebp - 0x54c]
cmp dword [ebp - 0x55c], edi
jle 0xcaf1a3
mov edi, dword [ebp - 0x55c]
jmp 0xcaf1a3
mov edi, dword [ebp - 0x8c8]
cmp dword [ebp - 0x588], 0
mov esi, dword [0xd080a8]
mov ecx, esi
push dword [ebp - 0x8e0]
je 0xcaf1e4
mov ebx, dword [ebp - 0x8ac]
mov eax, ebx
sub eax, dword [ebp - 0x55c]
add eax, edi
push eax
lea eax, [ebp - 0x564]
push eax
call dword [0xd0cffc]
call esi
sub ebx, dword [ebp - 0x54c]
add ebx, edi
jmp 0xcaf1fa
mov ebx, dword [ebp - 0x8e8]
lea eax, [ebp - 0x564]
push ebx
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x558]
add eax, dword [ebp - 0x8ec]
mov esi, dword [0xd080a8]
mov ecx, esi
push eax
push ebx
lea eax, [ebp - 0x554]
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x8b4]
cmp eax, 2
je 0xcaf4eb
cmp eax, 3
je 0xcaf4eb
xor edx, edx
inc edx
cmp eax, edx
jne 0xcaf50a
xor eax, eax
mov dword [ebp - 0x568], 0xffffff
push 0x5c
push eax
lea eax, [ebp - 0x3f0]
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x8a4], eax
test eax, eax
jne 0xcaf2a7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcaf29c
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcaf348
jmp 0xcaedc8
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0x8a8]
push 0xb
call dword [0xd0cffc]
call esi
push dword [ebp - 0x96c]
neg eax
mov dword [ebp - 0x3e0], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x3d4]
mov dword [ebp - 0x3f0], eax
mov byte [ebp - 0x3d6], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x3f0]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcaf329
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcaf320
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcaf32f
mov ebx, 0x80004005
jmp 0xcaf32f
mov dword [ebp - 0x56c], eax
push dword [ebp - 0x8a4]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xcaf60d
push dword [ebp - 0x56c]
mov esi, dword [0xd0803c]
xor eax, eax
push dword [ebp - 0x8d4]
mov dword [ebp - 0x53c], edi
mov ecx, esi
mov edi, dword [ebp - 0x578]
mov ebx, eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov ecx, esi
mov dword [ebp - 0x8a4], eax
xor eax, eax
push eax
push 0x460
lea eax, [ebp - 0x544]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0x8d4]
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcaf3b4
mov ebx, 0x80004005
mov eax, dword [ebp - 0x8a4]
test eax, eax
je 0xcaf3d0
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xcaf60d
mov eax, dword [ebp - 0x53c]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x53c], eax
cmp eax, ecx
jge 0xcaf3f4
mov dword [ebp - 0x53c], ecx
mov ebx, dword [ebp - 0x8a8]
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x60
pop edi
push edi
push ebx
push dword [ebp - 0x544]
mov dword [ebp - 0x538], 0x20
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x540]
mov dword [ebp - 0x544], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x53c]
mov dword [ebp - 0x540], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x538]
mov dword [ebp - 0x53c], eax
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0x588], 0
mov dword [ebp - 0x538], eax
je 0xcaf4c0
mov ecx, dword [ebp - 0x564]
cmp ecx, dword [ebp - 0x554]
jl 0xcaf49c
mov ecx, dword [ebp - 0x554]
mov eax, dword [ebp - 0x548]
add eax, 0x24
mov esi, dword [0xd080a8]
push eax
push ecx
lea eax, [ebp - 0x544]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
jmp 0xcaf507
mov ecx, dword [ebp - 0x55c]
cmp ecx, dword [ebp - 0x54c]
jg 0xcaf4d4
mov ecx, dword [ebp - 0x54c]
mov eax, dword [ebp - 0x548]
sub ecx, dword [ebp - 0x53c]
add eax, 0x24
add ecx, dword [ebp - 0x544]
jmp 0xcaf4a5
mov eax, dword [ebp - 0x548]
mov dword [ebp - 0x938], edi
mov dword [ebp - 0x934], eax
mov dword [ebp - 0x568], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [ebp - 0x588]
lea edi, [ebp - 0x9d0]
mov ebx, dword [ebp - 0x938]
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp - 0x934]
mov dword [ebp - 0x8b8], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x8b4]
sub eax, 1
je 0xcaf8a6
sub eax, 1
je 0xcaf7d3
sub eax, 1
jne 0xcaf60b
mov esi, dword [0xd080a4]
lea edi, [ebp - 0x1f0]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08084]
lea ecx, [ebp - 0x1f0]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x1f0], 0x28
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcaf60b
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x1dc]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x1d4]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x1d4]
lea esi, [ebp - 0x1dc]
sub eax, ebx
lea edi, [ebp - 0x9d0]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x940], eax
mov eax, dword [ebp - 0x1d0]
sub eax, dword [ebp - 0x8b8]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
mov dword [ebp - 0x93c], eax
xor ebx, ebx
push dword [ebp - 0x8d4]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov edi, 0xd0aed4
xor esi, esi
inc esi
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xcaf62e
mov eax, dword [0xd0a150]
test eax, eax
jle 0xcaf693
sub eax, 1
mov dword [0xd0a150], eax
jne 0xcaf693
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xcaf662
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xcaf651
push 0x40
xor eax, eax
push eax
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0xd0aed4
inc esi
xor eax, eax
xchg dword [edi], eax
mov eax, dword [ebp - 0x8f4]
test eax, eax
je 0xcaf6b2
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xcb14e8
mov edi, dword [ebp - 0x988]
xor eax, eax
mov ebx, dword [ebp - 0x984]
push 0x54
push eax
lea eax, [ebp - 0x5e0]
mov dword [ebp - 0x9a4], edi
push eax
mov dword [ebp - 0x9a0], ebx
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0x8b8], esi
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push dword [ebp - 0x920]
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcaf74d
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x5e0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcaf74d
push 0x20
pop eax
cmp word [ebp - 0x5ce], ax
jne 0xcaf74d
cmp dword [ebp - 0x5cc], 0
je 0xcaf74d
cmp dword [ebp - 0x5dc], 0
jle 0xcaf74d
cmp dword [ebp - 0x5d8], 0
jg 0xcaf762
xor eax, eax
cmp dword [ebp - 0x8b4], 1
mov dword [ebp - 0x8b8], eax
jne 0xcaf8b9
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x564]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x554]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ebx, dword [ebp - 0x8b4]
cmp ebx, 1
jne 0xcaf8bf
mov eax, dword [ebp - 0x584]
mov esi, dword [0xd08014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x944], eax
jmp 0xcaf8bf
mov esi, dword [0xd080a4]
lea edi, [ebp - 0x1b0]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08084]
lea ecx, [ebp - 0x1b0]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x1b0], 0x28
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcaf60b
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x19c]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x194]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0x8a4], 0
lea esi, [ebp - 0x19c]
lea edi, [ebp - 0x9d0]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0xcaf87e
imul eax, dword [ebp - 0x194], 5
cdq
idiv ecx
add eax, dword [ebp - 0x19c]
jmp 0xcaf88c
mov eax, dword [ebp - 0x194]
sub eax, ebx
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x940], eax
mov eax, dword [ebp - 0x190]
sub eax, dword [ebp - 0x8b8]
imul eax, eax, 0x5f
jmp 0xcaf602
xor ebx, ebx
mov dword [ebp - 0x940], ebx
mov dword [ebp - 0x93c], ebx
jmp 0xcaf60d
mov ebx, dword [ebp - 0x8b4]
mov esi, dword [0xd08040]
mov ecx, esi
push 1
push dword [ebp - 0x920]
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0x588], 0
mov dword [ebp - 0x928], eax
mov dword [ebp - 0x8ec], 0x810
je 0xcaf8fa
mov dword [ebp - 0x8ec], 0x20812
cmp dword [ebp - 0x8b8], 0
je 0xcb04d9
mov eax, dword [ebp - 0x584]
mov ebx, dword [ebp - 0x580]
mov dword [ebp - 0x8c8], eax
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x8a4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x638]
mov dword [ebp - 0x8c0], ebx
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x848]
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x8b0], eax
mov dword [ebp - 0x8b8], eax
mov dword [ebp - 0x8e8], eax
push 0x2c
push eax
mov dword [ebp - 0x8a8], eax
lea eax, [ebp - 0x2cc]
push eax
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x138]
mov dword [ebp - 0x8d8], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
jne 0xcaf99f
mov ebx, 0x80070057
jmp 0xcb14cd
mov ebx, dword [ebp - 0x920]
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push ebx
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcaf9de
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcaf9d3
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcafede
jmp 0xcb0559
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x638]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcafa20
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0x8b0], eax
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x8e8], eax
mov eax, dword [ebp - 0x630]
mov dword [ebp - 0x8a8], eax
mov esi, dword [0xd08008]
mov ecx, esi
push ebx
call dword [0xd0cffc]
call esi
mov edi, eax
mov dword [ebp - 0x8e0], edi
test edi, edi
je 0xcaf9bc
xor eax, eax
push 0x2c
mov ebx, eax
mov dword [ebp - 0x998], eax
push eax
lea eax, [ebp - 0x2cc]
mov dword [ebp - 0x8bc], ebx
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0x55c]
add esp, 0xc
sub eax, dword [ebp - 0x564]
xor ecx, ecx
mov esi, dword [0xd0800c]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x560]
sub eax, dword [ebp - 0x558]
mov dword [ebp - 0x2c4], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x2cc], 0x28
mov word [ebp - 0x2c0], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x2be], ax
lea eax, [ebp - 0x998]
push eax
push ecx
lea eax, [ebp - 0x2cc]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x8c4], eax
test eax, eax
jne 0xcafb09
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x8bc], ebx
test ebx, ebx
jle 0xcafaf6
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0x8bc], ebx
test ebx, ebx
mov eax, dword [ebp - 0x8c4]
js 0xcafb09
mov ebx, 0x80004005
mov dword [ebp - 0x8bc], ebx
test ebx, ebx
js 0xcafe96
test eax, eax
je 0xcafb3f
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x848]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcafb3f
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0x8b8], eax
mov eax, dword [ebp - 0x55c]
sub eax, dword [ebp - 0x564]
push dword [ebp - 0x8c4]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x558]
sub eax, dword [ebp - 0x560]
push edi
mov dword [ebp - 0x12c], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
push dword [ebp - 0x8a4]
mov esi, dword [0xd0803c]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0x8d8], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x138]
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0x8ec]
lea eax, [ebp - 0x138]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0x8c0]
push edi
call dword [0xd0cffc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0x8b4], eax
jne 0xcafc3b
cmp dword [ebp - 0x8c8], 0
je 0xcafc2f
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x8dc], eax
jmp 0xcafc45
mov dword [ebp - 0x8dc], 0xffffff
jmp 0xcafc45
mov dword [ebp - 0x8dc], 0xffa8a8a8
mov edi, dword [ebp - 0x564]
xor edx, edx
mov eax, dword [ebp - 0x560]
mov esi, edx
mov dword [ebp - 0x8f4], edi
mov ecx, edx
test edi, edi
jns 0xcafc6b
mov esi, edi
mov dword [ebp - 0x8f4], edx
neg esi
test eax, eax
jns 0xcafc75
mov ecx, eax
mov eax, edx
neg ecx
mov edi, dword [ebp - 0x8e8]
mov edx, dword [ebp - 0x130]
mov dword [ebp - 0x8ac], edi
sub edx, esi
mov edi, dword [ebp - 0x8f4]
sub dword [ebp - 0x8ac], edi
mov edi, dword [ebp - 0x8ac]
mov dword [ebp - 0x8d0], edx
cmp edx, edi
jl 0xcafcad
mov edx, edi
mov dword [ebp - 0x8d0], edi
mov edi, dword [ebp - 0x12c]
sub dword [ebp - 0x8a8], eax
sub edi, ecx
mov dword [ebp - 0x8ac], edi
cmp edi, dword [ebp - 0x8a8]
jl 0xcafcd5
mov edi, dword [ebp - 0x8a8]
mov dword [ebp - 0x8ac], edi
test edx, edx
jle 0xcafe90
test edi, edi
jle 0xcafe90
imul ecx, dword [ebp - 0x130]
mov edx, dword [ebp - 0x8b8]
add ecx, esi
mov esi, dword [ebp - 0x8e8]
imul eax, esi
lea ecx, [edx + ecx*4]
mov edx, dword [ebp - 0x8b0]
mov dword [ebp - 0x8c0], ecx
add eax, dword [ebp - 0x8f4]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0x8d0]
mov dword [ebp - 0x8cc], eax
test edi, edi
jle 0xcafe90
mov ebx, dword [ebp - 0x130]
shl ebx, 2
shl esi, 2
mov dword [ebp - 0x8a4], ebx
mov dword [ebp - 0x8c8], esi
test edx, edx
jle 0xcafe6b
mov esi, eax
mov dword [ebp - 0x8b0], edx
lea ebx, [eax + 3]
sub esi, ecx
mov dword [ebp - 0x8a8], ebx
lea edi, [ecx + 2]
mov dword [ebp - 0x8b8], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xcafe2b
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0x8dc]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x8b8]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x8a8]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x8dc]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x8a8]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x8da]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x8a8]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x8b8]
cdq
idiv ecx
mov edx, dword [ebp - 0x8b0]
add al, bl
mov ebx, dword [ebp - 0x8a8]
mov byte [ebx], al
push 4
pop eax
add ebx, eax
add edi, eax
sub edx, 1
mov dword [ebp - 0x8a8], ebx
mov dword [ebp - 0x8b0], edx
jne 0xcafd65
mov edi, dword [ebp - 0x8ac]
mov edx, dword [ebp - 0x8d0]
mov ecx, dword [ebp - 0x8c0]
mov eax, dword [ebp - 0x8cc]
mov ebx, dword [ebp - 0x8a4]
mov esi, dword [ebp - 0x8c8]
add ecx, ebx
add eax, esi
sub edi, 1
mov dword [ebp - 0x8c0], ecx
mov dword [ebp - 0x8cc], eax
mov dword [ebp - 0x8ac], edi
jne 0xcafd41
mov ebx, dword [ebp - 0x8bc]
mov edi, dword [ebp - 0x8e0]
mov eax, dword [ebp - 0x8c4]
test eax, eax
je 0xcafeb1
mov esi, dword [0xd0801c]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x8d8]
test eax, eax
je 0xcafecd
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xcb14cd
mov eax, dword [ebp - 0x584]
mov ebx, dword [ebp - 0x57c]
mov dword [ebp - 0x8c8], eax
mov eax, dword [ebp - 0x570]
mov dword [ebp - 0x8a4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x740]
mov dword [ebp - 0x8c0], ebx
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x7f0]
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x8b0], eax
mov dword [ebp - 0x8b8], eax
mov dword [ebp - 0x8e8], eax
push 0x2c
push eax
mov dword [ebp - 0x8a8], eax
lea eax, [ebp - 0x2a0]
push eax
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x148]
mov dword [ebp - 0x8dc], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xcaf995
mov ebx, dword [ebp - 0x920]
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push ebx
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcaffb7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcaffac
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcb04c6
jmp 0xcb0559
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x740]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcafff9
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x8b0], eax
mov eax, dword [ebp - 0x73c]
mov dword [ebp - 0x8e8], eax
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0x8a8], eax
mov esi, dword [0xd08008]
mov ecx, esi
push ebx
call dword [0xd0cffc]
call esi
mov edi, eax
mov dword [ebp - 0x8e0], edi
test edi, edi
je 0xcaff95
xor eax, eax
push 0x2c
mov ebx, eax
mov dword [ebp - 0x990], eax
push eax
lea eax, [ebp - 0x2a0]
mov dword [ebp - 0x8bc], ebx
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0x54c]
add esp, 0xc
sub eax, dword [ebp - 0x554]
xor ecx, ecx
mov esi, dword [0xd0800c]
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x550]
sub eax, dword [ebp - 0x548]
mov dword [ebp - 0x298], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x2a0], 0x28
mov word [ebp - 0x294], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x292], ax
lea eax, [ebp - 0x990]
push eax
push ecx
lea eax, [ebp - 0x2a0]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x8c4], eax
test eax, eax
jne 0xcb00e2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x8bc], ebx
test ebx, ebx
jle 0xcb00cf
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0x8bc], ebx
test ebx, ebx
mov eax, dword [ebp - 0x8c4]
js 0xcb00e2
mov ebx, 0x80004005
mov dword [ebp - 0x8bc], ebx
test ebx, ebx
js 0xcb047e
test eax, eax
je 0xcb0118
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x7f0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcb0118
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0x8b8], eax
mov eax, dword [ebp - 0x54c]
sub eax, dword [ebp - 0x554]
push dword [ebp - 0x8c4]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x548]
sub eax, dword [ebp - 0x550]
push edi
mov dword [ebp - 0x13c], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
push dword [ebp - 0x8a4]
mov esi, dword [0xd0803c]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0x8dc], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x148]
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0x8ec]
lea eax, [ebp - 0x148]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0x8c0]
push edi
call dword [0xd0cffc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0x8b4], eax
jne 0xcb021c
cmp dword [ebp - 0x8c8], 0
je 0xcb0210
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov edx, eax
mov dword [ebp - 0x8e4], edx
mov dword [ebp - 0x8d0], edx
jmp 0xcb022d
mov dword [ebp - 0x8d0], 0xffffff
jmp 0xcb022d
mov eax, 0xffa8a8a8
mov dword [ebp - 0x8e4], eax
mov dword [ebp - 0x8d0], eax
mov edi, dword [ebp - 0x554]
xor edx, edx
mov eax, dword [ebp - 0x550]
mov esi, edx
mov dword [ebp - 0x8f4], edi
mov ecx, edx
test edi, edi
jns 0xcb0253
mov esi, edi
mov dword [ebp - 0x8f4], edx
neg esi
test eax, eax
jns 0xcb025d
mov ecx, eax
mov eax, edx
neg ecx
mov edi, dword [ebp - 0x8e8]
mov edx, dword [ebp - 0x140]
mov dword [ebp - 0x8ac], edi
sub edx, esi
mov edi, dword [ebp - 0x8f4]
sub dword [ebp - 0x8ac], edi
mov edi, dword [ebp - 0x8ac]
mov dword [ebp - 0x8d8], edx
cmp edx, edi
jl 0xcb0295
mov edx, edi
mov dword [ebp - 0x8d8], edi
mov edi, dword [ebp - 0x13c]
sub dword [ebp - 0x8a8], eax
sub edi, ecx
mov dword [ebp - 0x8ac], edi
cmp edi, dword [ebp - 0x8a8]
jl 0xcb02bd
mov edi, dword [ebp - 0x8a8]
mov dword [ebp - 0x8ac], edi
test edx, edx
jle 0xcb0478
test edi, edi
jle 0xcb0478
imul ecx, dword [ebp - 0x140]
mov edx, dword [ebp - 0x8b0]
add ecx, esi
mov esi, dword [ebp - 0x8b8]
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0x8e8]
imul eax, esi
mov dword [ebp - 0x8c0], ecx
add eax, dword [ebp - 0x8f4]
lea eax, [edx + eax*4]
mov edx, dword [ebp - 0x8d8]
mov dword [ebp - 0x8cc], eax
test edi, edi
jle 0xcb0478
mov ebx, dword [ebp - 0x140]
shl ebx, 2
shl esi, 2
mov dword [ebp - 0x8a4], ebx
mov dword [ebp - 0x8c8], esi
test edx, edx
jle 0xcb0453
mov esi, eax
mov dword [ebp - 0x8b0], edx
lea ebx, [eax + 3]
sub esi, ecx
mov dword [ebp - 0x8a8], ebx
lea edi, [ecx + 2]
mov dword [ebp - 0x8b8], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xcb0413
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0x8e4]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x8b8]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x8a8]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x8e4]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x8a8]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x8ce]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x8a8]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x8b8]
cdq
idiv ecx
mov edx, dword [ebp - 0x8b0]
add al, bl
mov ebx, dword [ebp - 0x8a8]
mov byte [ebx], al
push 4
pop eax
add ebx, eax
add edi, eax
sub edx, 1
mov dword [ebp - 0x8a8], ebx
mov dword [ebp - 0x8b0], edx
jne 0xcb034d
mov edi, dword [ebp - 0x8ac]
mov edx, dword [ebp - 0x8d8]
mov ecx, dword [ebp - 0x8c0]
mov eax, dword [ebp - 0x8cc]
mov ebx, dword [ebp - 0x8a4]
mov esi, dword [ebp - 0x8c8]
add ecx, ebx
add eax, esi
sub edi, 1
mov dword [ebp - 0x8c0], ecx
mov dword [ebp - 0x8cc], eax
mov dword [ebp - 0x8ac], edi
jne 0xcb0329
mov ebx, dword [ebp - 0x8bc]
mov edi, dword [ebp - 0x8e0]
mov eax, dword [ebp - 0x8c4]
test eax, eax
je 0xcb0499
mov esi, dword [0xd0801c]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x8dc]
test eax, eax
je 0xcb04b5
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xcb14cd
mov edi, dword [ebp - 0x918]
jmp 0xcb1481
xor edx, edx
inc edx
cmp dword [ebp - 0x584], 0
jne 0xcb04ed
cmp ebx, edx
je 0xcb04ed
mov al, 0xc0
jmp 0xcb04ef
or al, 0xff
mov byte [ebp - 0x8aa], al
lea edi, [ebp - 0x964]
xor eax, eax
mov esi, dword [0xd08008]
stosd dword es:[edi], eax
xor ecx, ecx
push dword [ebp - 0x920]
mov word [ebp - 0x8ac], cx
mov ecx, esi
mov byte [ebp - 0x8a9], dl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x980]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x918], eax
test eax, eax
jne 0xcb0563
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcb0553
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcb14cd
mov ebx, 0x80004005
jmp 0xcb14cd
xor eax, eax
inc eax
cmp ebx, eax
jne 0xcb0656
mov ecx, dword [ebp - 0x55c]
mov edx, dword [ebp - 0x54c]
mov edi, dword [ebp - 0x564]
sub ecx, edi
mov eax, dword [ebp - 0x554]
sub edx, eax
cmp edx, ecx
jle 0xcb0598
mov ebx, edx
mov dword [ebp - 0x8dc], ebx
jmp 0xcb05a0
mov ebx, ecx
mov dword [ebp - 0x8dc], ecx
mov esi, dword [ebp - 0x548]
sub esi, dword [ebp - 0x560]
cmp dword [ebp - 0x588], 0
mov dword [ebp - 0x8e0], esi
je 0xcb05d9
sub edi, dword [ebp - 0x55c]
sub eax, dword [ebp - 0x54c]
add edi, ebx
add eax, ebx
mov dword [ebp - 0x964], edi
mov dword [ebp - 0x980], eax
jmp 0xcb05e5
mov edi, dword [ebp - 0x964]
mov eax, dword [ebp - 0x980]
add ecx, edi
mov dword [ebp - 0x8e8], eax
add eax, edx
mov dword [ebp - 0x8d0], edi
mov edi, dword [ebp - 0x558]
sub edi, dword [ebp - 0x560]
mov dword [ebp - 0x8f4], eax
mov dword [ebp - 0x978], eax
mov eax, dword [ebp - 0x550]
sub eax, dword [ebp - 0x560]
mov dword [ebp - 0x8cc], edi
mov dword [ebp - 0x958], edi
mov edi, eax
sub edi, dword [ebp - 0x550]
add edi, dword [ebp - 0x548]
mov dword [ebp - 0x95c], ecx
mov dword [ebp - 0x8a4], eax
mov dword [ebp - 0x97c], eax
mov dword [ebp - 0x8b0], edi
mov dword [ebp - 0x974], edi
jmp 0xcb06e2
mov eax, dword [ebp - 0x938]
lea esi, [ebp - 0x564]
lea edi, [ebp - 0x964]
mov dword [ebp - 0x8dc], eax
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x934]
mov dword [ebp - 0x8e0], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x958]
lea esi, [ebp - 0x554]
mov ecx, dword [ebp - 0x95c]
lea edi, [ebp - 0x980]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x8cc], eax
mov eax, dword [ebp - 0x964]
mov dword [ebp - 0x8d0], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x974]
mov esi, dword [ebp - 0x8e0]
mov dword [ebp - 0x8b0], eax
mov eax, dword [ebp - 0x978]
mov dword [ebp - 0x8f4], eax
mov eax, dword [ebp - 0x97c]
mov dword [ebp - 0x8a4], eax
mov eax, dword [ebp - 0x980]
mov dword [ebp - 0x8e8], eax
xor eax, eax
mov dword [ebp - 0x8c4], ecx
push 0x2c
push eax
mov dword [ebp - 0x98c], eax
mov ebx, eax
lea eax, [ebp - 0x274]
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0x8dc]
add esp, 0xc
mov edi, dword [ebp - 0x918]
xor ecx, ecx
mov dword [ebp - 0x270], eax
neg esi
xor eax, eax
mov dword [ebp - 0x26c], esi
mov esi, dword [0xd0800c]
inc eax
push 0x20
mov word [ebp - 0x268], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x266], ax
lea eax, [ebp - 0x98c]
push eax
push ecx
lea eax, [ebp - 0x274]
mov dword [ebp - 0x274], 0x28
push eax
push edi
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x930], eax
test eax, eax
jne 0xcb078e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcb0781
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
mov eax, dword [ebp - 0x930]
js 0xcb078e
mov ebx, 0x80004005
test ebx, ebx
js 0xcb149d
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0x8b4], eax
jne 0xcb080d
mov ecx, dword [ebp - 0x944]
test ecx, ecx
je 0xcb080d
mov esi, dword [0xd08074]
lea edi, [ebp - 0x174]
xor eax, eax
stosd dword es:[edi], eax
push ecx
mov ecx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x8dc]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp - 0x8e0]
mov dword [ebp - 0x16c], eax
lea eax, [ebp - 0x178]
push eax
mov eax, dword [ebp - 0x918]
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x584]
mov ebx, dword [ebp - 0x580]
mov dword [ebp - 0x914], eax
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x8f0], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x690]
mov dword [ebp - 0x8c0], ebx
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x8a0]
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x910], eax
mov dword [ebp - 0x91c], eax
mov dword [ebp - 0x8d8], eax
push 0x2c
push eax
mov dword [ebp - 0x8a8], eax
lea eax, [ebp - 0x248]
push eax
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x158]
mov dword [ebp - 0x8c8], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x918]
test ebx, ebx
jne 0xcb08ab
mov ebx, 0x80070057
jmp 0xcb149d
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcb08e9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcb08d9
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcb0e04
mov ebx, 0x80004005
jmp 0xcb149d
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x690]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcb092b
mov eax, dword [ebp - 0x67c]
mov dword [ebp - 0x910], eax
mov eax, dword [ebp - 0x68c]
mov dword [ebp - 0x8d8], eax
mov eax, dword [ebp - 0x688]
mov dword [ebp - 0x8a8], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, eax
mov dword [ebp - 0x8d4], esi
test esi, esi
je 0xcb08c2
xor eax, eax
push 0x2c
mov ebx, eax
mov dword [ebp - 0x994], eax
push eax
lea eax, [ebp - 0x248]
mov dword [ebp - 0x8bc], ebx
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0x8c4]
add esp, 0xc
mov edi, dword [ebp - 0x8d0]
xor ecx, ecx
sub eax, edi
mov dword [ebp - 0x248], 0x28
mov dword [ebp - 0x8c4], eax
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x960]
sub eax, dword [ebp - 0x8cc]
mov dword [ebp - 0x240], eax
xor eax, eax
push 0x20
inc eax
mov word [ebp - 0x23c], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x23a], ax
lea eax, [ebp - 0x994]
push eax
push ecx
lea eax, [ebp - 0x248]
push eax
push esi
mov esi, dword [0xd0800c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x8d0], eax
test eax, eax
jne 0xcb0a1c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x8bc], ebx
test ebx, ebx
jle 0xcb0a09
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0x8bc], ebx
test ebx, ebx
mov eax, dword [ebp - 0x8d0]
js 0xcb0a1c
mov ebx, 0x80004005
mov dword [ebp - 0x8bc], ebx
test ebx, ebx
js 0xcb0dac
test eax, eax
je 0xcb0a52
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x8a0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcb0a52
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0x91c], eax
push dword [ebp - 0x8d0]
mov ecx, dword [ebp - 0x8c4]
mov eax, dword [ebp - 0x8cc]
sub eax, dword [ebp - 0x960]
push dword [ebp - 0x8d4]
mov esi, dword [0xd0803c]
mov dword [ebp - 0x150], ecx
mov ecx, esi
mov dword [ebp - 0x14c], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0x8d4]
call dword [0xd0cffc]
call esi
push dword [ebp - 0x8f0]
mov esi, dword [0xd0803c]
mov ecx, esi
push dword [ebp - 0x8d4]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0x8c8], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x158]
push eax
push dword [ebp - 0x8d4]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0x8ec]
lea eax, [ebp - 0x158]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0x8c0]
push dword [ebp - 0x8d4]
call dword [0xd0cffc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0x8b4], eax
jne 0xcb0b61
cmp dword [ebp - 0x914], 0
je 0xcb0b55
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x8c4], eax
jmp 0xcb0b6b
mov dword [ebp - 0x8c4], 0xffffff
jmp 0xcb0b6b
mov dword [ebp - 0x8c4], 0xffa8a8a8
xor eax, eax
mov dword [ebp - 0x8b8], eax
mov edx, eax
mov ecx, eax
test edi, edi
jns 0xcb0b87
mov edx, edi
mov edi, eax
neg edx
mov dword [ebp - 0x8b8], edx
mov eax, dword [ebp - 0x960]
test eax, eax
jns 0xcb0b97
mov ecx, eax
neg ecx
xor eax, eax
mov esi, dword [ebp - 0x150]
sub esi, edx
mov edx, dword [ebp - 0x8d8]
sub edx, edi
mov dword [ebp - 0x8c0], esi
cmp esi, edx
jl 0xcb0bb9
mov esi, edx
mov dword [ebp - 0x8c0], edx
mov edx, dword [ebp - 0x14c]
sub dword [ebp - 0x8a8], eax
sub edx, ecx
mov dword [ebp - 0x8cc], edx
cmp edx, dword [ebp - 0x8a8]
jl 0xcb0be1
mov edx, dword [ebp - 0x8a8]
mov dword [ebp - 0x8cc], edx
test esi, esi
jle 0xcb0dac
test edx, edx
jle 0xcb0dac
imul eax, dword [ebp - 0x8d8]
imul ecx, dword [ebp - 0x150]
mov esi, dword [ebp - 0x91c]
add eax, edi
mov edi, dword [ebp - 0x910]
add ecx, dword [ebp - 0x8b8]
lea eax, [edi + eax*4]
mov dword [ebp - 0x8f0], eax
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0x8c0]
mov dword [ebp - 0x914], ecx
test edx, edx
jle 0xcb0dac
mov ebx, dword [ebp - 0x150]
shl ebx, 2
mov dword [ebp - 0x8b8], ebx
mov ebx, dword [ebp - 0x8d8]
shl ebx, 2
mov dword [ebp - 0x8d8], ebx
mov ebx, dword [ebp - 0x8b8]
mov edi, dword [ebp - 0x8d8]
test esi, esi
jle 0xcb0d87
mov ebx, eax
mov dword [ebp - 0x91c], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0x8a8], edx
lea edi, [ecx + 2]
mov dword [ebp - 0x910], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xcb0d47
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0x8c4]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x910]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x8a8]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x8c4]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x8a8]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x8c2]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x8a8]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x91c]
cdq
idiv ecx
mov edx, dword [ebp - 0x8a8]
add al, bl
mov ebx, dword [ebp - 0x910]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0x8a8], edx
mov dword [ebp - 0x91c], esi
jne 0xcb0c81
mov edx, dword [ebp - 0x8cc]
mov esi, dword [ebp - 0x8c0]
mov ecx, dword [ebp - 0x914]
mov eax, dword [ebp - 0x8f0]
mov ebx, dword [ebp - 0x8b8]
mov edi, dword [ebp - 0x8d8]
add ecx, ebx
add eax, edi
sub edx, 1
mov dword [ebp - 0x914], ecx
mov dword [ebp - 0x8f0], eax
mov dword [ebp - 0x8cc], edx
jne 0xcb0c5d
mov ebx, dword [ebp - 0x8bc]
mov eax, dword [ebp - 0x8d0]
test eax, eax
je 0xcb0dc7
mov esi, dword [0xd0801c]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x8c8]
test eax, eax
je 0xcb0de8
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push dword [ebp - 0x8d4]
call dword [0xd0cffc]
call esi
push dword [ebp - 0x8d4]
mov esi, dword [0xd08018]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov edi, dword [ebp - 0x918]
test ebx, ebx
js 0xcb149d
mov eax, dword [ebp - 0x584]
mov ebx, dword [ebp - 0x57c]
mov dword [ebp - 0x910], eax
mov eax, dword [ebp - 0x570]
mov dword [ebp - 0x914], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x6e8]
mov dword [ebp - 0x8c0], ebx
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x798]
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x8f0], eax
mov dword [ebp - 0x8c8], eax
mov dword [ebp - 0x8d0], eax
push 0x2c
push eax
mov dword [ebp - 0x8c4], eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x168]
mov dword [ebp - 0x8b8], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x918]
test ebx, ebx
je 0xcb08a1
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xcb0edd
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xcb0ed2
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xcb13f7
jmp 0xcb08df
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x6e8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcb0f1f
mov eax, dword [ebp - 0x6d4]
mov dword [ebp - 0x8f0], eax
mov eax, dword [ebp - 0x6e4]
mov dword [ebp - 0x8d0], eax
mov eax, dword [ebp - 0x6e0]
mov dword [ebp - 0x8c4], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, eax
mov dword [ebp - 0x8d4], esi
test esi, esi
je 0xcb0ebb
xor eax, eax
push 0x2c
mov ebx, eax
mov dword [ebp - 0x99c], eax
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x8bc], ebx
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0x8f4]
add esp, 0xc
sub eax, dword [ebp - 0x8e8]
xor ecx, ecx
mov edi, dword [ebp - 0x8a4]
mov dword [ebp - 0x8f4], eax
mov dword [ebp - 0x218], eax
mov eax, edi
sub eax, dword [ebp - 0x8b0]
mov dword [ebp - 0x214], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x21c], 0x28
mov word [ebp - 0x210], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x20e], ax
lea eax, [ebp - 0x99c]
push eax
push ecx
lea eax, [ebp - 0x21c]
push eax
push esi
mov esi, dword [0xd0800c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x8d8], eax
test eax, eax
jne 0xcb1010
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0x8bc], ebx
test ebx, ebx
jle 0xcb0ffd
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0x8bc], ebx
test ebx, ebx
mov eax, dword [ebp - 0x8d8]
js 0xcb1010
mov ebx, 0x80004005
mov dword [ebp - 0x8bc], ebx
test ebx, ebx
js 0xcb139f
test eax, eax
je 0xcb1046
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x798]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xcb1046
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x8c8], eax
mov eax, dword [ebp - 0x8f4]
push dword [ebp - 0x8d8]
mov esi, dword [0xd0803c]
mov ecx, esi
push dword [ebp - 0x8d4]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x8b0]
sub eax, edi
mov dword [ebp - 0x15c], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0x8d4]
call dword [0xd0cffc]
call esi
push dword [ebp - 0x914]
mov esi, dword [0xd0803c]
mov ecx, esi
push dword [ebp - 0x8d4]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0x8b8], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x168]
push eax
push dword [ebp - 0x8d4]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0x8ec]
lea eax, [ebp - 0x168]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0x8c0]
push dword [ebp - 0x8d4]
call dword [0xd0cffc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0x8b4], eax
jne 0xcb114b
cmp dword [ebp - 0x910], 0
je 0xcb113f
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
jmp 0xcb1150
mov dword [ebp - 0x8b0], 0xffffff
jmp 0xcb115c
mov eax, 0xffa8a8a8
mov dword [ebp - 0x8b0], eax
mov dword [ebp - 0x8e4], eax
xor eax, eax
mov edx, eax
mov ecx, eax
mov eax, dword [ebp - 0x8e8]
mov dword [ebp - 0x8a4], edx
test eax, eax
jns 0xcb117e
mov edx, eax
neg edx
xor eax, eax
mov dword [ebp - 0x8a4], edx
test edi, edi
jns 0xcb118a
mov ecx, edi
neg ecx
xor esi, esi
mov edi, esi
mov esi, dword [ebp - 0x160]
sub esi, edx
mov edx, dword [ebp - 0x8d0]
sub edx, eax
mov dword [ebp - 0x8c0], esi
cmp esi, edx
jl 0xcb11ac
mov esi, edx
mov dword [ebp - 0x8c0], edx
mov edx, dword [ebp - 0x15c]
sub dword [ebp - 0x8c4], edi
sub edx, ecx
mov dword [ebp - 0x8cc], edx
cmp edx, dword [ebp - 0x8c4]
jl 0xcb11d4
mov edx, dword [ebp - 0x8c4]
mov dword [ebp - 0x8cc], edx
test esi, esi
jle 0xcb139f
test edx, edx
jle 0xcb139f
imul ecx, dword [ebp - 0x160]
imul edi, dword [ebp - 0x8d0]
mov esi, dword [ebp - 0x8c8]
add ecx, dword [ebp - 0x8a4]
add edi, eax
mov eax, dword [ebp - 0x8f0]
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0x8c0]
mov dword [ebp - 0x910], ecx
lea eax, [eax + edi*4]
mov dword [ebp - 0x91c], eax
test edx, edx
jle 0xcb139f
mov ebx, dword [ebp - 0x160]
shl ebx, 2
mov dword [ebp - 0x8f0], ebx
mov ebx, dword [ebp - 0x8d0]
shl ebx, 2
mov dword [ebp - 0x914], ebx
mov ebx, dword [ebp - 0x8f0]
mov edi, dword [ebp - 0x914]
test esi, esi
jle 0xcb137a
mov ebx, eax
mov dword [ebp - 0x8c8], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0x8ec], edx
lea edi, [ecx + 2]
mov dword [ebp - 0x8a4], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xcb133a
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0x8e4]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x8a4]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0x8ec]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0x8e4]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x8ec]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0x8ae]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0x8ec]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0x8c8]
cdq
idiv ecx
mov edx, dword [ebp - 0x8ec]
add al, bl
mov ebx, dword [ebp - 0x8a4]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0x8ec], edx
mov dword [ebp - 0x8c8], esi
jne 0xcb1274
mov edx, dword [ebp - 0x8cc]
mov esi, dword [ebp - 0x8c0]
mov ecx, dword [ebp - 0x910]
mov eax, dword [ebp - 0x91c]
mov ebx, dword [ebp - 0x8f0]
mov edi, dword [ebp - 0x914]
add ecx, ebx
add eax, edi
sub edx, 1
mov dword [ebp - 0x910], ecx
mov dword [ebp - 0x91c], eax
mov dword [ebp - 0x8cc], edx
jne 0xcb1250
mov ebx, dword [ebp - 0x8bc]
mov eax, dword [ebp - 0x8d8]
test eax, eax
je 0xcb13ba
mov esi, dword [0xd0801c]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x8b8]
test eax, eax
je 0xcb13db
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push dword [ebp - 0x8d4]
call dword [0xd0cffc]
call esi
push dword [ebp - 0x8d4]
mov esi, dword [0xd08018]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov edi, dword [ebp - 0x918]
test ebx, ebx
js 0xcb149d
xor eax, eax
inc eax
cmp dword [ebp - 0x8b4], eax
jne 0xcb1444
mov esi, dword [section..data]
xor eax, eax
push 0xcc0020
push eax
push eax
push edi
push dword [ebp - 0x8e0]
mov ecx, esi
push dword [ebp - 0x8dc]
push dword [ebp - 0x560]
push dword [ebp - 0x564]
push dword [ebp - 0x920]
call dword [0xd0cffc]
call esi
jmp 0xcb1481
push dword [ebp - 0x8ac]
mov ecx, dword [ebp - 0x8e0]
xor edx, edx
mov eax, dword [ebp - 0x8dc]
mov esi, dword [0xd08020]
push ecx
push eax
push edx
push edx
push edi
push ecx
push eax
push dword [ebp - 0x93c]
mov ecx, esi
push dword [ebp - 0x940]
push dword [ebp - 0x920]
call dword [0xd0cffc]
call esi
push dword [ebp - 0x928]
mov esi, dword [0xd08040]
mov ecx, esi
push dword [ebp - 0x920]
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x930]
test eax, eax
je 0xcb14b8
mov esi, dword [0xd0801c]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
test edi, edi
je 0xcb14cd
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x944]
test eax, eax
je 0xcb14e8
mov esi, dword [0xd0801c]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov ecx, dword [ebp - 0x580]
test ecx, ecx
je 0xcb153f
lea edx, [ecx + 2]
xor esi, esi
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0xcb14f7
mov eax, dword [ebp - 0x580]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xcb1521
xor edx, edx
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0xcb1519
push dword [ebp - 0x580]
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebp - 0x580], eax
mov ecx, dword [ebp - 0x57c]
test ecx, ecx
je 0xcb1596
lea edx, [ecx + 2]
xor esi, esi
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0xcb154e
mov eax, dword [ebp - 0x57c]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xcb1578
xor edx, edx
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0xcb1570
push dword [ebp - 0x57c]
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebp - 0x57c], eax
mov edx, dword [ebp - 0x578]
test edx, edx
je 0xcb15ea
mov ecx, edx
xor edi, edi
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0xcb15a7
sub ecx, esi
xor eax, eax
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xcb15d1
mov byte [edx], al
inc edx
sub ecx, 1
jne 0xcb15c3
mov edx, dword [ebp - 0x578]
push edx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0x578], edx
jmp 0xcb15ec
xor edx, edx
cmp dword [ebp - 0x574], 0
je 0xcb1613
push dword [ebp - 0x574]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
xor edx, edx
mov dword [ebp - 0x574], edx
cmp dword [ebp - 0x570], 0
je 0xcb163a
push dword [ebp - 0x570]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
xor edx, edx
mov dword [ebp - 0x570], edx
cmp dword [ebp - 0x56c], 0
je 0xcb1661
push dword [ebp - 0x56c]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
xor edx, edx
mov dword [ebp - 0x56c], edx
xor edx, edx
mov esi, 0xd0aed4
lea ecx, [edx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xcb1668
mov eax, dword [0xd0a150]
push 0
pop edx
test eax, eax
jle 0xcb16c7
sub eax, 1
mov dword [0xd0a150], eax
jne 0xcb16c7
mov edi, edx
mov eax, dword [edi + 0xd0ae80]
test eax, eax
je 0xcb169e
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0xcb168d
push 0x40
xor eax, eax
push eax
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
mov eax, 0xd0aed4
xchg dword [eax], ecx
lea eax, [ebp - 0x450]
push eax
mov eax, dword [ebp - 0x954]
push dword [eax + 0x18]
call dword [sym.imp.ext_ms_win_ntuser_draw_l1_1_0.dll_EndPaint]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret