Function at 0xbb0884
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xebc
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor edx, edx
mov ebx, 0xd0aed4
push esi
push edi
mov dword [ebp - 0xbf8], edx
mov dword [ebp - 0xc9c], edx
mov dword [ebp - 0xd74], edx
mov dword [ebp - 0xc48], edx
mov dword [ebp - 0xac0], edx
lea ecx, [edx + 1]
xor eax, eax
lock cmpxchg dword [ebx], ecx
test eax, eax
jne 0xbb08c1
mov eax, dword [0xd0a150]
or ebx, 0xffffffff
mov dword [ebp - 0xc00], ebx
mov edi, 0xb2bef2
mov dword [ebp - 0xc14], edi
mov dword [ebp - 0xc28], 0x67
mov dword [ebp - 0xbdc], 0x337
mov dword [ebp - 0xbc4], 0x10b
mov dword [ebp - 0xbc0], 0x20b
push 0
pop edx
test eax, eax
jne 0xbb0f32
push 0x338
mov esi, edx
mov dword [ebp - 0xad0], edx
push edx
mov dword [ebp - 0xa9c], edx
mov dword [ebp - 0xab0], esi
mov dword [ebp - 0xb18], edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb90], eax
test eax, eax
je 0xc09366
xor edx, edx
mov dword [ebp - 0x3a8], 0xab69605e
mov esi, edx
mov dword [ebp - 0x3a4], 0x7f1137f
add eax, 7
mov dword [ebp - 0xb00], edx
mov cl, dl
mov dword [ebp - 0xc10], ebx
mov dword [ebp - 0xb68], esi
mov dword [ebp - 0xb78], edx
mov dword [ebp - 0xbe0], eax
mov dword [ebp - 0xb54], edi
mov dword [ebp - 0xb04], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xb54]
xor edx, ebx
mov dword [ebp - 0xab8], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb54]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb54]
shl edi, 8
add dword [ebp - 0xb54], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov dword [ebp - 0xafc], esi
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
mov esi, dword [ebp - 0xab8]
rol eax, 0xa
add edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, esi
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0xafc]
xor eax, edx
imul edx, eax, 0x605e
mov dword [ebp - 0xafc], eax
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0xafc]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xafc], eax
xor edx, 0xab69605e
mov eax, 0x7f1137f
sub eax, edx
xor esi, eax
mov eax, esi
mov edx, esi
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
mov eax, dword [ebp - 0xafc]
xor eax, edx
mov dword [ebp - 0xafc], eax
add eax, 0x7f1137f
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xafc]
rol eax, 2
add edx, eax
xor esi, edx
lea eax, [esi + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 8
sub edx, eax
mov eax, dword [ebp - 0xafc]
xor eax, edx
mov dword [ebp - 0xafc], eax
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xafc]
ror eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, esi
shr eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xafc]
xor eax, edx
mov dword [ebp - 0xafc], eax
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
mov dword [ebp - 0xab8], esi
add esi, 0xfffff80f
xor esi, dword [ebp - 0xafc]
xor esi, 0xab69605e
mov eax, esi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, esi
shr eax, 2
add edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov dword [ebp - 0xab8], eax
add eax, 0xf80eec81
ror eax, 6
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xab8]
rol eax, 7
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov dword [ebp - 0xab8], eax
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xab8]
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xab8]
xor esi, edx
xor eax, esi
xor eax, 0xac987321
mov dword [ebp - 0xab8], eax
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor esi, eax
lea eax, [esi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov dword [ebp - 0xab8], eax
add eax, 0xab69605e
rol eax, 3
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xab8]
rol eax, 0xe
add edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xe
sub edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov dword [ebp - 0xab8], eax
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xab8]
shr eax, 3
xor edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xc10]
rol eax, 2
mov dword [ebp - 0xb68], esi
mov dword [ebp - 0xc10], edi
xor edx, eax
mov edi, dword [ebp - 0xb54]
xor edx, dword [ebp - 0xb00]
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov dword [ebp - 0xb00], ebx
mov edx, dword [ebp - 0xbe0]
mov dword [ebp - 0xb78], eax
add dword [ebp - 0xbe0], 8
mov byte [edx - 4], al
mov al, byte [ebp - 0xb68]
ror dword [ebp - 0xb78], 8
mov byte [edx], al
ror dword [ebp - 0xb68], 8
mov al, byte [ebp - 0xb78]
mov byte [edx - 5], al
mov al, byte [ebp - 0xb68]
ror dword [ebp - 0xb78], 8
mov byte [edx - 1], al
ror dword [ebp - 0xb68], 8
mov al, byte [ebp - 0xb78]
mov byte [edx - 6], al
ror dword [ebp - 0xb78], 8
mov al, byte [ebp - 0xb68]
mov byte [edx - 2], al
ror dword [ebp - 0xb68], 8
mov al, byte [ebp - 0xb78]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb68]
mov byte [edx - 3], al
mov edx, dword [ebp - 0xb78]
mov esi, dword [ebp - 0xb68]
ror edx, 8
ror esi, 8
sub dword [ebp - 0xb04], 1
mov dword [ebp - 0xb78], edx
mov dword [ebp - 0xb68], esi
jne 0xbb09a0
mov esi, dword [ebp - 0xb90]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xbb0d6f
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xc092f7
cmp edx, dword [0xb2c22c]
jne 0xc092f7
mov edi, esi
xor eax, eax
mov dword [ebp - 0xab0], edi
mov esi, eax
mov ebx, 0x337
test esi, esi
jne 0xc09311
cmp dword [ebp - 0xb18], 0
jl 0xc09360
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xd0ae80
push eax
push ebx
call fcn.00bc259b
add esp, 0xc
cmp byte [edi], 0
je 0xbb0f04
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbf8]
jne 0xbb0de6
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc09356
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa9c], edx
cmp word [eax], cx
jne 0xc09325
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xc09325
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xc09325
cmp dword [ecx], 0x4550
jne 0xc09325
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xbc4]
jne 0xc0933c
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xad8], eax
test eax, eax
je 0xbb0ef8
mov ecx, esi
mov dword [ebp - 0xbb4], esi
xor eax, eax
mov dword [ebp - 0xcc4], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xb90], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xbb0e9c
sub ecx, dword [ebp - 0xb90]
inc esi
add esi, ecx
test edx, edx
js 0xc0934b
mov ecx, dword [ebp - 0xbb4]
lea eax, [ebp - 0xcc4]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa9c], edx
test edx, edx
js 0xbb0f04
mov eax, dword [ebp - 0xad0]
mov ecx, dword [ebp - 0xcc4]
mov dword [eax*4 + section..data], ecx
inc eax
inc ebx
mov dword [ebp - 0xad0], eax
cmp ebx, dword [ebp - 0xad8]
jb 0xbb0e83
add edi, 0x10
cmp byte [esi], 0
jne 0xbb0ddf
mov ebx, dword [ebp - 0xa9c]
mov esi, dword [ebp - 0xab0]
test esi, esi
je 0xbb0f25
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc09370
mov eax, dword [0xd0a150]
inc eax
xor ebx, ebx
mov dword [0xd0a150], eax
xor eax, eax
mov ecx, 0xd0aed4
xchg dword [ecx], eax
mov eax, ebx
mov dword [ebp - 0xad0], ebx
mov dword [ebp - 0xa9c], eax
mov edi, ebx
mov eax, dword fs:[0x30]
mov dword [ebp - 0xab0], ebx
cmp dword [eax + 0x1d4], ebx
je 0xc094a8
mov esi, dword [0xd08088]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, eax
mov dword [ebp - 0xb90], ecx
test ecx, ecx
je 0xc093b1
mov eax, ebx
mov esi, ebx
mov dword [ebp - 0xa9c], eax
mov ebx, dword [0xd08098]
lea edx, [ebp - 0xcc0]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xd0cffc]
call ebx
test eax, eax
je 0xbb3bdb
mov ebx, dword [ebp - 0xa9c]
xor eax, eax
mov dword [ebp - 0xad0], esi
mov esi, eax
test esi, esi
jne 0xc093f1
test ebx, ebx
js 0xbb112d
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
mov esi, dword [0xd08094]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov ecx, eax
mov dword [ebp - 0xb90], ecx
test ecx, ecx
je 0xc09405
xor edx, edx
mov eax, edx
mov esi, edx
mov dword [ebp - 0xa9c], eax
mov ebx, dword [0xd08098]
lea edx, [ebp - 0xcbc]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xd0cffc]
call ebx
test eax, eax
je 0xbb3c23
mov ebx, dword [ebp - 0xa9c]
xor eax, eax
mov edi, esi
mov esi, eax
test esi, esi
jne 0xc0946d
test ebx, ebx
js 0xbb1112
mov eax, dword [ebp - 0xad0]
test eax, eax
je 0xc094a8
push 4
mov ecx, 0xb2be5c
pop esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xbb37ff
test dx, dx
je 0xbb108a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xbb37ff
add eax, esi
add ecx, esi
test dx, dx
jne 0xbb1062
xor ebx, ebx
mov eax, ebx
test eax, eax
jne 0xc094a8
test edi, edi
je 0xc094a8
mov ecx, 0xb2be6c
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xbb380b
test dx, dx
je 0xbb10cd
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xbb380b
add eax, esi
add ecx, esi
test dx, dx
jne 0xbb10a5
mov eax, ebx
test eax, eax
jne 0xc094a8
push esi
lea eax, [ebp - 0xcb8]
mov dword [ebp - 0xcb8], ebx
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
je 0xc09481
test byte [ebp - 0xcb8], 0xf
jne 0xc094a8
xor eax, eax
inc eax
mov dword [ebp - 0xac0], eax
mov ebx, dword [ebp - 0xa9c]
test edi, edi
je 0xbb112d
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xad0]
test eax, eax
je 0xbb1148
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc094b3
xor ebx, ebx
push 4
pop eax
push eax
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov dword [ebp - 0xb90], eax
test eax, eax
je 0xc094c0
mov dword [ebp - 0xb00], eax
lea edi, [ebp - 0xc0c]
xor eax, eax
mov dword [ebp - 0xaa0], ebx
stosd dword es:[edi], eax
mov esi, ebx
mov dword [ebp - 0xce4], ebx
mov dword [ebp - 0xce0], ebx
mov dword [ebp - 0xab4], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xacc], ebx
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xbb4], 0x38
mov dword [ebp - 0xad8], ebx
test ebx, ebx
je 0xc094dc
push edi
push 0xd08d58
push ebx
call fcn.00bc13d0
mov esi, ebx
add esp, 0xc
mov dword [ebp - 0xa98], esi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xac8], ecx
test ecx, ecx
je 0xc094dc
mov eax, dword [0xd08d50]
mov edi, ecx
mov dword [ecx], eax
mov eax, dword [0xd08d54]
mov dword [ecx + 4], eax
mov dword [ebp - 0xaa0], edi
rdtsc
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xaa8], edx
xor eax, eax
mov dword [ebp - 0xb10], eax
lea eax, [ebp - 0xd24]
push eax
push 4
pop ecx
mov edx, ecx
call fcn.00b84e9a
mov esi, dword [ebp - 0xd24]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc094f2
lea eax, [ebp - 0xb10]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xc0951f
lea eax, [ebp - 0xd20]
mov edx, 0xa0
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0951f
mov esi, dword [ebp - 0xd20]
mov ecx, dword [ebp - 0xb10]
lea eax, [ebp - 0xb10]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xc0951f
lea eax, [ebp - 0xd1c]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0951f
mov esi, dword [ebp - 0xd1c]
mov ecx, dword [ebp - 0xb10]
lea eax, [ebp - 0xb10]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xc0951f
lea eax, [ebp - 0xcfc]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0951f
mov esi, dword [ebp - 0xcfc]
mov ecx, dword [ebp - 0xb10]
lea eax, [ebp - 0xb10]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xc0951f
lea eax, [ebp - 0xcb4]
mov edx, SysReAllocString
push eax
mov ecx, 0xb2c268
call fcn.00b84ebc
test eax, eax
js 0xc094fa
mov edx, dword [ebp - 0xcb4]
lea eax, [ebp - 0xd34]
push eax
inc edx
push 4
pop eax
mov dword [ebp - 0xcb4], edx
mov ecx, eax
add edx, edx
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0951f
mov esi, dword [ebp - 0xd34]
mov ecx, dword [ebp - 0xb10]
lea eax, [ebp - 0xb10]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xc0951f
lea eax, [ebp - 0xd98]
push eax
push 4
pop ecx
mov edx, ecx
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0951f
mov esi, dword [ebp - 0xd98]
mov ecx, dword [ebp - 0xb10]
lea eax, [ebp - 0xb10]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xc0951f
lea eax, [ebp - 0xd94]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0951f
mov esi, dword [ebp - 0xd94]
mov ecx, dword [ebp - 0xb10]
lea eax, [ebp - 0xb10]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xc0951f
mov esi, dword [ebp - 0xb10]
push esi
push 8
mov dword [ebp - 0xce4], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xadc], edi
test edi, edi
je 0xc09507
mov dword [ebp - 0xce0], edi
xor eax, eax
mov dword [ebp - 0xaac], eax
mov dword [ebp - 0xe44], eax
mov dword [ebp - 0xc18], edi
push 4
pop ecx
lea eax, [ebp - 0xdc8]
mov dword [ebp - 0xdcc], ecx
mov edx, ecx
mov ecx, edi
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09531
lea ecx, [edi + esi]
lea eax, [edi + 8]
cmp eax, ecx
ja 0xc0952a
push 4
pop eax
mov dword [edi], eax
xor ecx, ecx
mov eax, dword [ebp - 0xdc8]
mov dword [eax], ecx
xor eax, eax
inc eax
mov dword [ebp - 0xaac], eax
test ebx, ebx
js 0xc09519
mov esi, edi
mov edi, ecx
mov dword [ebp - 0xc70], esi
test eax, eax
je 0xbb15a1
mov edx, dword [esi]
lea eax, [ebp - 0xd90]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0953e
mov eax, dword [ebp - 0xd90]
mov dword [ebp - 0xd8c], eax
test ebx, ebx
js 0xc09549
lea ecx, [ebp - 0xc70]
mov edx, eax
push ecx
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09549
mov esi, dword [ebp - 0xc70]
inc edi
cmp edi, dword [ebp - 0xaac]
jb 0xbb153b
lea eax, [ebp - 0xdd0]
mov dword [ebp - 0xdd4], 0xa0
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00b84e9a
mov edi, dword [ebp - 0xadc]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0954f
mov ecx, dword [ebp - 0xb10]
lea eax, [esi + 0xa4]
add ecx, edi
cmp eax, ecx
ja 0xc0952a
mov eax, 0xa0
push eax
push dword [ebp - 0xad8]
mov dword [esi], eax
push dword [ebp - 0xdd0]
call fcn.00bc13d0
mov eax, dword [ebp - 0xaac]
add esp, 0xc
inc eax
mov dword [ebp - 0xaac], eax
test ebx, ebx
js 0xc09519
mov esi, edi
xor ecx, ecx
mov dword [ebp - 0xc78], esi
mov edi, ecx
test eax, eax
je 0xbb1691
mov edx, dword [esi]
lea eax, [ebp - 0xd80]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0955a
mov eax, dword [ebp - 0xd80]
mov dword [ebp - 0xd7c], eax
test ebx, ebx
js 0xc09565
lea ecx, [ebp - 0xc78]
mov edx, eax
push ecx
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09565
mov esi, dword [ebp - 0xc78]
inc edi
cmp edi, dword [ebp - 0xaac]
jb 0xbb162b
lea eax, [ebp - 0xdd8]
mov dword [ebp - 0xddc], 8
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00b84e9a
mov edi, dword [ebp - 0xadc]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0956b
mov ecx, dword [ebp - 0xb10]
lea eax, [esi + 0xc]
add ecx, edi
cmp eax, ecx
ja 0xc0952a
mov edx, dword [ebp - 0xac8]
mov ecx, dword [ebp - 0xdd8]
mov dword [esi], 8
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xaac]
inc eax
mov dword [ebp - 0xaac], eax
test ebx, ebx
js 0xc09519
mov ecx, dword [ebp - 0xad4]
mov esi, edi
mov dword [ebp - 0xe58], ecx
mov ecx, dword [ebp - 0xaa8]
mov dword [ebp - 0xe54], ecx
xor ecx, ecx
mov edi, ecx
test eax, eax
je 0xbb1796
mov edx, dword [esi]
lea eax, [ebp - 0xd10]
push eax
push 4
pop eax
mov ecx, eax
mov dword [ebp - 0xad8], esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09576
mov eax, dword [ebp - 0xd10]
mov dword [ebp - 0xd28], eax
test ebx, ebx
js 0xc09519
add eax, esi
mov ecx, esi
cmp eax, esi
jb 0xc09581
mov esi, eax
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, dword [ebp - 0xad8]
jb 0xbb17f8
inc edi
cmp edi, dword [ebp - 0xaac]
jb 0xbb172a
push 8
pop edi
lea eax, [ebp - 0xde0]
mov dword [ebp - 0xde4], edi
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09519
mov ecx, dword [ebp - 0xadc]
lea eax, [esi + 0xc]
add ecx, dword [ebp - 0xb10]
cmp eax, ecx
ja 0xc0952a
mov eax, dword [ebp - 0xde0]
mov ecx, dword [ebp - 0xad4]
inc dword [ebp - 0xaac]
mov dword [esi], edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xaa8]
mov dword [eax + 4], ecx
test ebx, ebx
js 0xc09519
lea eax, [ebp - 0xc4c]
mov edx, SysReAllocString
push eax
mov ecx, 0xb2c268
call fcn.00b84ebc
test eax, eax
js 0xc09589
mov ecx, dword [ebp - 0xc4c]
lea eax, [ebp - 0xc4c]
push eax
xor eax, eax
lea edx, [eax + 1]
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09519
mov eax, dword [ebp - 0xc4c]
lea edi, [eax + eax]
test edi, edi
je 0xc095aa
mov esi, dword [ebp - 0xadc]
xor eax, eax
mov dword [ebp - 0xaec], eax
cmp dword [ebp - 0xaac], eax
jbe 0xbb18e4
mov edx, dword [esi]
lea eax, [ebp - 0xd4c]
push eax
push 4
pop eax
mov ecx, eax
mov dword [ebp - 0xad8], esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09590
mov eax, dword [ebp - 0xd4c]
mov dword [ebp - 0xd48], eax
test ebx, ebx
js 0xc09519
add eax, esi
mov ecx, esi
cmp eax, esi
jb 0xc0959b
mov esi, eax
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, dword [ebp - 0xad8]
jb 0xbb1942
mov eax, dword [ebp - 0xaec]
inc eax
mov dword [ebp - 0xaec], eax
cmp eax, dword [ebp - 0xaac]
jb 0xbb186c
lea eax, [ebp - 0xde8]
mov dword [ebp - 0xdec], edi
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09519
mov ecx, dword [ebp - 0xadc]
lea eax, [edi + 4]
add ecx, dword [ebp - 0xb10]
add eax, esi
cmp eax, ecx
ja 0xc095a3
push edi
push 0xb2c268
push dword [ebp - 0xde8]
mov dword [esi], edi
call fcn.00bc13d0
add esp, 0xc
inc dword [ebp - 0xaac]
test ebx, ebx
js 0xc09519
mov eax, dword [ebp - 0xac0]
mov edi, dword [ebp - 0xaac]
mov esi, dword [ebp - 0xadc]
mov dword [ebp - 0xe4c], eax
xor eax, eax
mov edx, eax
test edi, edi
je 0xbb19da
mov eax, dword [esi]
push 4
add eax, 4
mov dword [ebp - 0xad8], esi
pop ebx
cmp eax, ebx
jb 0xc095ba
mov ecx, eax
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, 4
jb 0xc095c2
mov dword [ebp - 0xd50], ecx
cmp eax, 4
jb 0xc095d5
lea eax, [esi + ecx]
mov ebx, esi
cmp eax, esi
jb 0xc095cd
mov esi, eax
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, dword [ebp - 0xad8]
jb 0xc095d5
inc edx
cmp edx, edi
jb 0xbb196a
push 4
pop ecx
lea eax, [ebp - 0xdf0]
mov dword [ebp - 0xdf4], ecx
mov edx, ecx
mov ecx, esi
push eax
call fcn.00b84e9a
mov edx, dword [ebp - 0xadc]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09519
mov ecx, dword [ebp - 0xb10]
lea eax, [esi + 8]
add ecx, edx
cmp eax, ecx
ja 0xc0952a
mov ecx, dword [ebp - 0xac0]
inc edi
push 4
pop eax
mov dword [esi], eax
mov eax, dword [ebp - 0xdf0]
mov dword [ebp - 0xaac], edi
mov dword [eax], ecx
test ebx, ebx
js 0xc09519
push 4
xor eax, eax
mov esi, edx
mov edx, eax
pop ebx
mov dword [ebp - 0xe50], ebx
test edi, edi
je 0xbb1ac1
mov eax, dword [esi]
add eax, 4
mov dword [ebp - 0xad8], esi
cmp eax, ebx
jb 0xc095e0
mov ecx, eax
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, 4
jb 0xc095e8
mov dword [ebp - 0xd54], ecx
cmp eax, 4
jb 0xc095fb
lea eax, [ecx + esi]
mov ebx, esi
cmp eax, esi
jb 0xc095f3
mov esi, eax
cmp eax, ebx
push 4
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, dword [ebp - 0xad8]
jb 0xc095fd
inc edx
pop ebx
cmp edx, edi
jb 0xbb1a51
lea eax, [ebp - 0xdc0]
mov dword [ebp - 0xdc4], ebx
push eax
mov edx, ebx
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc095fb
mov ecx, dword [ebp - 0xadc]
lea eax, [esi + 8]
add ecx, dword [ebp - 0xb10]
cmp eax, ecx
ja 0xc0952a
mov eax, dword [ebp - 0xdc0]
inc edi
push 4
pop ecx
mov dword [esi], ecx
mov dword [eax], ecx
mov dword [ebp - 0xaac], edi
test ebx, ebx
js 0xc09519
lea eax, [ebp - 0xd58]
mov edx, ecx
push eax
call fcn.00b84e9a
mov esi, dword [ebp - 0xd58]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09603
lea eax, [ebp - 0xd70]
mov edi, esi
push eax
push 8
pop edx
mov dword [ebp - 0xbb0], edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09609
mov esi, dword [ebp - 0xd70]
lea eax, [ebp - 0xbb0]
mov edx, esi
push eax
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09609
lea eax, [ebp - 0xd78]
push eax
push 4
pop edi
mov edx, edi
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09609
mov esi, dword [ebp - 0xd78]
mov ecx, dword [ebp - 0xbb0]
lea eax, [ebp - 0xbb0]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09609
lea eax, [ebp - 0xcf8]
mov edx, edi
push eax
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09609
mov esi, dword [ebp - 0xcf8]
mov ecx, dword [ebp - 0xbb0]
lea eax, [ebp - 0xbb0]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09609
lea eax, [ebp - 0xc60]
mov edx, edi
push eax
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09609
mov esi, dword [ebp - 0xc60]
mov ecx, dword [ebp - 0xbb0]
lea eax, [ebp - 0xbb0]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09609
lea eax, [ebp - 0xc64]
mov edx, edi
push eax
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09609
mov esi, dword [ebp - 0xc64]
mov ecx, dword [ebp - 0xbb0]
lea eax, [ebp - 0xbb0]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09609
mov dword [ebp - 0xabc], eax
test ebx, ebx
js 0xc09519
xor ecx, ecx
rdtsc
mov esi, ecx
mov dword [ebp - 0xb14], ecx
mov dword [ebp - 0xab0], esi
mov dword [ebp - 0xae4], ecx
mov dword [ebp - 0xa9c], ecx
mov dword [ebp - 0xaa4], ecx
mov dword [ebp - 0xb1c], ecx
mov dword [ebp - 0xab8], ecx
mov dword [ebp - 0xaec], ecx
mov dword [ebp - 0xae8], ecx
mov dword [ebp - 0xb50], ecx
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xac8], edx
push 8
pop ecx
mov dword [ebp - 0xc54], ecx
mov edx, dword [ebp - 0xb10]
lea eax, [ebp - 0xc54]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbb1e10
mov eax, dword [ebp - 0xc54]
lea edi, [eax + 7]
and edi, 0xfffffff8
cmp edi, eax
jb 0xc09614
mov dword [ebp - 0xc54], edi
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc0961e
mov eax, dword [ebp - 0xaac]
mov ecx, esi
mov dword [esi], eax
lea eax, [ebp - 0xc44]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xc44], esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc09628
mov ecx, dword [ebp - 0xc44]
mov eax, dword [ebp - 0xb10]
mov dword [ecx], eax
lea eax, [ebp - 0xc44]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc09628
push dword [ebp - 0xb10]
mov eax, dword [ebp - 0xad8]
push dword [ebp - 0xadc]
mov dword [esi + edi - 8], eax
mov eax, dword [ebp - 0xac8]
push dword [ebp - 0xc44]
mov dword [esi + edi - 4], eax
call fcn.00bc13d0
add esp, 0xc
mov dword [ebp - 0xb14], esi
xor eax, eax
mov dword [ebp - 0xab0], edi
mov esi, eax
test esi, esi
jne 0xc0962f
mov esi, dword [ebp - 0xab0]
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xbb33eb
mov ebx, dword [ebp - 0xb14]
xor ecx, ecx
mov edi, ecx
mov dword [ebp - 0xac4], edi
test ebx, ebx
je 0xc09643
test esi, esi
je 0xc09807
lea eax, [esi + 8]
push eax
push ecx
mov dword [ebp - 0xad8], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xae0], eax
test eax, eax
je 0xc09807
xor ecx, ecx
mov dl, cl
test esi, esi
je 0xbb1e78
xor dl, byte [ecx + ebx]
inc ecx
cmp ecx, esi
jb 0xbb1e70
mov dword [ebp - 0xad0], eax
xor eax, eax
mov dword [ebp - 0xb08], ebx
mov ecx, eax
or ebx, 0xffffffff
mov dword [ebp - 0x3b0], 0xb1b54a58
mov dword [ebp - 0x3ac], 0xc81ecb17
mov dword [ebp - 0xb40], ecx
mov dword [ebp - 0xb4c], ebx
mov dword [ebp - 0xb24], eax
mov dword [ebp - 0xb0c], eax
test eax, eax
jne 0xc0964d
mov eax, esi
shr eax, 3
mov dword [ebp - 0xaf0], eax
test eax, eax
je 0xbb22bf
mov eax, dword [ebp - 0xad0]
mov esi, dword [ebp - 0xb08]
add eax, 7
add esi, 2
mov dword [ebp - 0xad0], eax
mov dword [ebp - 0xb08], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xb08]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xb08]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xb08]
shl esi, 8
add dword [ebp - 0xb08], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov dword [ebp - 0xa94], ebx
add ebx, 0xffffb5a8
xor ebx, edi
xor ebx, ecx
mov ecx, 0xc81ecb17
xor ebx, ecx
mov eax, ebx
xor eax, ecx
ror eax, 0xf
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 7
add ecx, eax
mov eax, dword [ebp - 0xa94]
xor eax, ecx
mov dword [ebp - 0xa94], eax
add eax, 0xb1b54a58
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa94]
ror eax, 0xa
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0xcb17
rol eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
rol eax, 5
add ecx, eax
mov eax, dword [ebp - 0xa94]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xa94], eax
xor ecx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, ecx
xor ebx, eax
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 6
sub ecx, eax
sub ecx, 0x339b6838
xor dword [ebp - 0xa94], ecx
mov ecx, dword [ebp - 0xa94]
mov eax, ecx
ror eax, 0xf
xor eax, 0xcb17
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, 0xc81e
imul eax, eax, 0xcb17
xor ecx, eax
lea eax, [ecx + 0x37e0ea91]
mov dword [ebp - 0xa94], ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0xc81e
ror ecx, 0xa
imul eax, eax, 0xb1b5
xor ecx, eax
mov eax, dword [ebp - 0xa94]
xor eax, ecx
mov dword [ebp - 0xa94], eax
xor eax, 0x4a58
rol eax, 6
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa94]
ror eax, 3
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa94]
mov eax, ebx
ror eax, 0xf
sub eax, 0xc81e
imul eax, eax, 0x4a58
xor ecx, eax
mov dword [ebp - 0xa94], ecx
xor ecx, 0xc81e
mov eax, dword [ebp - 0xa94]
shr eax, 1
imul ecx, ecx, 0x4a58
xor ecx, eax
mov eax, dword [ebp - 0xa94]
add eax, 0xffff34e9
xor ebx, ecx
rol eax, 3
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xa94]
shr eax, 0xf
xor ecx, eax
xor ebx, ecx
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 0xd
sub ecx, eax
mov eax, 0xb1b54a58
add ecx, 0x730581bd
xor dword [ebp - 0xa94], ecx
sub eax, dword [ebp - 0xa94]
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa94]
ror eax, 0xb
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa94]
lea eax, [ebx + 0x4e49ed8a]
xor ecx, eax
mov dword [ebp - 0xa94], ecx
mov eax, dword [ebp - 0xa94]
xor eax, 0xb1b5
ror ecx, 7
imul eax, eax, 0x4a58
sub eax, ecx
xor ebx, eax
mov eax, ebx
xor eax, 0xc81e
rol eax, 4
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0x10
sub ecx, eax
mov eax, 0xb1b54a58
xor dword [ebp - 0xa94], ecx
sub eax, dword [ebp - 0xa94]
ror eax, 0xa
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa94]
ror eax, 4
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x4e4ab5a8]
ror eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
ror eax, 9
xor ecx, eax
mov eax, dword [ebp - 0xa94]
xor eax, ecx
mov dword [ebp - 0xa94], eax
xor eax, 0xc81ecb17
rol eax, 8
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xa94]
rol eax, 2
sub ecx, eax
mov eax, 0xc81ecb17
xor ebx, ecx
sub eax, ebx
ror eax, 0xb
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0xc
sub ecx, eax
mov eax, dword [ebp - 0xa94]
xor eax, ecx
mov dword [ebp - 0xa94], eax
xor eax, 0xb1b5
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa94]
shr eax, 8
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xad0]
mov eax, ebx
add dword [ebp - 0xad0], 8
xor eax, dword [ebp - 0xb24]
xor eax, dword [ebp - 0xa94]
xor ebx, dword [ebp - 0xb0c]
xor eax, 0x79ab814f
mov dword [ebp - 0xb4c], eax
mov dword [ebp - 0xb40], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xb4c]
ror dword [ebp - 0xb40], 8
mov byte [ecx], al
ror dword [ebp - 0xb4c], 8
mov al, byte [ebp - 0xb40]
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb4c]
ror dword [ebp - 0xb40], 8
mov byte [ecx - 1], al
ror dword [ebp - 0xb4c], 8
mov al, byte [ebp - 0xb40]
mov byte [ecx - 6], al
ror dword [ebp - 0xb40], 8
mov al, byte [ebp - 0xb4c]
mov byte [ecx - 2], al
ror dword [ebp - 0xb4c], 8
mov al, byte [ebp - 0xb40]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb4c]
mov byte [ecx - 3], al
mov ecx, dword [ebp - 0xb40]
mov ebx, dword [ebp - 0xb4c]
ror ecx, 8
ror ebx, 8
sub dword [ebp - 0xaf0], 1
mov dword [ebp - 0xb24], esi
mov esi, dword [ebp - 0xb08]
mov dword [ebp - 0xb40], ecx
mov dword [ebp - 0xb4c], ebx
mov dword [ebp - 0xb0c], edi
jne 0xbb1ef0
mov edi, dword [ebp - 0xac4]
mov esi, dword [ebp - 0xab0]
mov ecx, dword [ebp - 0xae0]
movzx eax, dl
cdq
mov dword [ecx + esi], eax
mov dword [ecx + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc09716
mov ebx, dword [ebp - 0xad8]
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc09720
mov dword [esi + 4], eax
push ebx
push dword [ebp - 0xae0]
push eax
call fcn.00bc13d0
add esp, 0xc
mov eax, 0xa0
mov dword [esi + 8], eax
push eax
push 8
pop ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc09720
mov dword [esi + 0xc], eax
push 0xa0
push 0xd08ca8
push eax
call fcn.00bc13d0
add esp, 0xc
mov dword [esi + 0x10], ebx
push ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
je 0xc0972c
mov dword [esi + 0x14], ecx
mov edi, esi
mov eax, dword [0xd08d48]
mov ebx, edx
mov dword [ecx], eax
mov esi, edx
mov eax, dword [0xd08d4c]
mov dword [ecx + 4], eax
test esi, esi
jne 0xc09736
xor eax, eax
test ebx, ebx
js 0xbb23a2
mov dword [ebp - 0xae4], edi
mov edi, eax
push dword [ebp - 0xae0]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
jne 0xc0979e
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xbb33eb
mov esi, dword [ebp - 0xae4]
lea eax, [ebp - 0xbac]
push 4
pop edi
push eax
mov edx, dword [esi]
mov ecx, edi
mov dword [ebp - 0xbac], edi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc09811
mov ecx, dword [ebp - 0xbac]
lea eax, [ebp - 0xbac]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc09811
mov edx, dword [esi + 8]
lea eax, [ebp - 0xbac]
mov ecx, dword [ebp - 0xbac]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc09811
mov ecx, dword [ebp - 0xbac]
lea eax, [ebp - 0xbac]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc09811
mov edx, dword [esi + 0x10]
lea eax, [ebp - 0xbac]
mov ecx, dword [ebp - 0xbac]
push eax
call fcn.00b84e9a
mov edi, dword [ebp - 0xbac]
mov ebx, eax
test ebx, ebx
js 0xc09811
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc09824
mov eax, dword [ebp - 0xae4]
mov ecx, esi
mov dword [ebp - 0xaf8], esi
mov eax, dword [eax]
mov dword [esi], eax
lea eax, [ebp - 0xaf8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc0982e
mov ebx, dword [ebp - 0xae4]
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0xaf8]
call fcn.00bc13d0
mov edx, dword [ebx]
lea eax, [ebp - 0xaf8]
mov ecx, dword [ebp - 0xaf8]
add esp, 0xc
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc0982e
mov eax, dword [ebp - 0xae4]
mov ecx, dword [ebp - 0xaf8]
mov eax, dword [eax + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xaf8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc0982e
mov ebx, dword [ebp - 0xae4]
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0xaf8]
call fcn.00bc13d0
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xaf8]
mov ecx, dword [ebp - 0xaf8]
add esp, 0xc
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc0982e
mov eax, dword [ebp - 0xae4]
mov ecx, dword [ebp - 0xaf8]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xaf8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc0982e
mov ebx, dword [ebp - 0xae4]
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0xaf8]
call fcn.00bc13d0
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xaf8]
mov ecx, dword [ebp - 0xaf8]
add esp, 0xc
push eax
call fcn.00b84e9a
mov ebx, eax
xor eax, eax
test ebx, ebx
js 0xbb25cd
mov dword [ebp - 0xa9c], esi
mov esi, eax
mov dword [ebp - 0xaa4], edi
test esi, esi
jne 0xc09835
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xbb33eb
xor eax, eax
mov dword [ebp - 0xcac], 8
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xae0], eax
mov edx, dword [ebp - 0xabc]
lea eax, [ebp - 0xcac]
push eax
push 8
pop ecx
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xc0986a
mov eax, dword [ebp - 0xcac]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jb 0xc09849
mov dword [ebp - 0xca8], ecx
lea eax, [ebp - 0xca8]
push eax
push 8
pop edx
call fcn.00b84e9a
mov ebx, eax
mov eax, dword [ebp - 0xca8]
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09854
mov dword [ebp - 0xad0], eax
test ebx, ebx
js 0xc0986a
mov edi, dword [ebp - 0xaac]
xor eax, eax
inc eax
cmp edi, eax
jbe 0xc0985f
mov ecx, dword [ebp - 0xadc]
xor eax, eax
mov dword [ebp - 0xbd4], ecx
mov esi, eax
mov eax, dword [ecx]
mov dword [ebp - 0xad8], eax
lea eax, [ebp - 0xbd4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0986a
mov edx, dword [ebp - 0xad8]
lea eax, [ebp - 0xbd4]
mov ecx, dword [ebp - 0xbd4]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0986a
mov ecx, dword [ebp - 0xbd4]
xor eax, eax
inc esi
inc eax
cmp esi, eax
jb 0xbb2696
mov esi, dword [ecx]
lea eax, [ebp - 0xbd4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc0986a
mov dword [ebp - 0xac4], esi
neg esi
sbb esi, esi
and dword [ebp - 0xbd4], esi
test ebx, ebx
js 0xc0986a
cmp edi, 2
jbe 0xc0985f
mov ecx, dword [ebp - 0xadc]
xor eax, eax
push 4
mov dword [ebp - 0xbd8], ecx
mov esi, eax
pop edi
lea eax, [ebp - 0xbd8]
mov edx, edi
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09875
mov edx, dword [ecx]
lea eax, [ebp - 0xbd8]
mov ecx, dword [ebp - 0xbd8]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09875
mov ecx, dword [ebp - 0xbd8]
inc esi
cmp esi, 2
jb 0xbb274c
mov esi, dword [ecx]
lea eax, [ebp - 0xbd8]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09875
mov edi, esi
neg esi
sbb esi, esi
and dword [ebp - 0xbd8], esi
test ebx, ebx
js 0xc0986a
mov edx, dword [ebp - 0xad0]
lea eax, [ebp - 0xbb8]
push 4
pop esi
push eax
mov ecx, esi
mov dword [ebp - 0xbb8], esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09880
mov ecx, dword [ebp - 0xbb8]
lea eax, [ebp - 0xbb8]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09880
mov edx, dword [ebp - 0xac4]
lea eax, [ebp - 0xbb8]
mov ecx, dword [ebp - 0xbb8]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09880
mov ecx, dword [ebp - 0xbb8]
lea eax, [ebp - 0xbb8]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09880
mov ecx, dword [ebp - 0xbb8]
lea eax, [ebp - 0xbb8]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov eax, dword [ebp - 0xbb8]
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09880
cmp eax, 0x400000
ja 0xc0988f
mov esi, eax
mov dword [ebp - 0xab8], esi
test ebx, ebx
js 0xbb33eb
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc09899
mov ecx, eax
mov dword [ebp - 0xb1c], eax
mov ebx, 0x10000000
mov edi, dword [ebp - 0xa9c]
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbb33f1
test edi, edi
je 0xc098a9
test ecx, ecx
je 0xc098a9
mov eax, dword [ebp - 0xaa4]
xor ebx, ebx
mov dword [ebp - 0xe00], eax
lea eax, [ebp - 0xd04]
push eax
xor eax, eax
mov dword [ebp - 0xe08], edi
push 0xb2be98
inc eax
mov dword [ebp - 0xe04], ecx
push eax
mov dword [ebp - 0xdfc], esi
mov dword [ebp - 0xdf8], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc098b0
push 0xb2be7c
push dword [ebp - 0xd04]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xc09902
push ebx
push 0x14
lea eax, [ebp - 0xe08]
mov ecx, esi
push eax
push 0x86
call dword [0xd0cffc]
call esi
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xc09916
mov esi, dword [ebp - 0xdfc]
mov dword [ebp - 0xab8], esi
cmp ebx, 0xd0000023
je 0xc09921
test ebx, ebx
js 0xbb33f1
mov eax, dword [ebp - 0xb1c]
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0xb30], ecx
mov edi, ecx
mov dword [ebp - 0xb98], eax
cmp esi, edx
jb 0xc09931
mov esi, dword [eax]
lea ecx, [ebp - 0xb98]
push ecx
mov ecx, eax
mov dword [ebp - 0xad8], esi
call fcn.00b84e9a
mov ebx, eax
xor ecx, ecx
test ebx, ebx
js 0xbb2cd0
lea eax, [ebp - 0xb30]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc09a48
mov eax, dword [ebp - 0xab8]
sub eax, dword [ebp - 0xb30]
cmp eax, esi
jb 0xc0993b
mov eax, dword [ebp - 0xb98]
lea ecx, [ebp - 0xb98]
push ecx
mov edx, esi
mov dword [ebp - 0xaa4], eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc09a48
mov ecx, dword [ebp - 0xb30]
lea eax, [ebp - 0xb30]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc09a48
mov eax, dword [ebp - 0xab8]
sub eax, dword [ebp - 0xb30]
push 4
pop edx
cmp eax, edx
jb 0xc0993b
mov ecx, dword [ebp - 0xb98]
lea eax, [ebp - 0xb98]
push eax
mov esi, dword [ecx]
mov dword [ebp - 0xac8], esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc09a48
mov ecx, dword [ebp - 0xb30]
lea eax, [ebp - 0xb30]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc09a48
mov eax, dword [ebp - 0xab8]
sub eax, dword [ebp - 0xb30]
cmp eax, esi
jb 0xc0993b
mov eax, dword [ebp - 0xb98]
lea ecx, [ebp - 0xb98]
push ecx
mov edx, esi
mov dword [ebp - 0xabc], eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc09a48
mov ecx, dword [ebp - 0xb30]
lea eax, [ebp - 0xb30]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc09a48
mov eax, dword [ebp - 0xab8]
sub eax, dword [ebp - 0xb30]
push 4
pop edx
cmp eax, edx
jb 0xc0993b
mov ecx, dword [ebp - 0xb98]
mov eax, dword [ecx]
mov dword [ebp - 0xae0], eax
lea eax, [ebp - 0xb98]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc09a48
mov ecx, dword [ebp - 0xb30]
lea eax, [ebp - 0xb30]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc09a48
mov eax, dword [ebp - 0xab8]
sub eax, dword [ebp - 0xb30]
mov ecx, dword [ebp - 0xae0]
cmp eax, ecx
jb 0xc0993b
lea eax, [ebp - 0xb30]
mov edx, ecx
mov ecx, dword [ebp - 0xb30]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xc09a48
mov ecx, dword [ebp - 0xab8]
mov eax, ecx
sub eax, dword [ebp - 0xb30]
jne 0xc0993b
mov eax, dword [ebp - 0xae0]
mov ebx, dword [ebp - 0xad8]
add eax, 0xc
add eax, esi
add eax, ebx
cmp eax, ecx
jne 0xc0993b
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc09945
cmp dword [ebp - 0xaa4], edi
je 0xc0995b
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc0994f
mov dword [esi + 4], eax
push ebx
push dword [ebp - 0xaa4]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
cmp dword [ebp - 0xabc], edi
je 0xc09967
mov ebx, dword [ebp - 0xac8]
push ebx
push 8
mov dword [esi + 8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc0994f
mov dword [esi + 0xc], eax
push ebx
push dword [ebp - 0xabc]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
cmp dword [ebp - 0xb98], edi
je 0xc09972
mov ebx, dword [ebp - 0xae0]
push ebx
push 8
mov dword [esi + 0x10], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc0994f
mov dword [esi + 0x14], eax
push ebx
push dword [ebp - 0xb98]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
mov edi, esi
mov ebx, eax
mov esi, eax
test esi, esi
jne 0xc0997d
xor ecx, ecx
test ebx, ebx
js 0xbb2cc8
mov dword [ebp - 0xaec], edi
mov edi, ecx
test edi, edi
jne 0xc099e5
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xbb33eb
mov eax, dword [ebp - 0xaec]
mov esi, ecx
mov dword [ebp - 0xaac], esi
mov dword [ebp - 0xab0], ecx
test eax, eax
je 0xc09a4f
mov ebx, dword [eax + 4]
mov dword [ebp - 0xab8], ebx
test ebx, ebx
je 0xc09a4f
mov edi, dword [eax]
test edi, edi
je 0xc09a4f
add edi, 0xfffffff8
mov dword [ebp - 0xadc], ecx
push edi
push ecx
mov dword [ebp - 0xac4], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xaf0], eax
test eax, eax
je 0xc09b88
xor ecx, ecx
mov dword [ebp - 0x3c0], 0xab69605e
mov dword [ebp - 0x3bc], 0x7f1137f
mov dl, cl
mov ecx, ebx
mov esi, eax
mov dword [ebp - 0xb0c], ecx
mov dword [ebp - 0xae0], esi
and edi, 7
jne 0xc09a5f
xor eax, eax
or dword [ebp - 0xb24], 0xffffffff
mov esi, eax
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xb28], esi
mov ebx, eax
mov dword [ebp - 0xb38], ebx
mov ecx, dword [ebp - 0xac4]
mov eax, ecx
shr eax, 3
mov dword [ebp - 0xabc], eax
test eax, eax
je 0xbb311b
mov eax, dword [ebp - 0xae0]
mov edi, dword [ebp - 0xb0c]
add eax, 7
add edi, 2
mov dword [ebp - 0xaa4], eax
mov dword [ebp - 0xb0c], edi
movzx ecx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ecx, 8
or ecx, eax
shl edi, 8
mov eax, dword [ebp - 0xb0c]
xor ebx, ecx
mov dword [ebp - 0xac8], ecx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb0c]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb0c]
shl edi, 8
add dword [ebp - 0xb0c], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, ebx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul ecx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub ecx, eax
xor esi, ecx
imul ecx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub ecx, eax
sub ecx, 0x756c8a2
xor ebx, ecx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, 0xab69605e
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0x137f
ror ecx, 6
imul eax, eax, 0xab69
xor ecx, eax
xor esi, ecx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul ecx, eax, 0x605e
mov eax, esi
rol eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub ecx, eax
xor esi, ecx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul ecx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x7f1
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov eax, esi
mov dword [ebp - 0xad0], esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea esi, [ebx - 0x7f1]
xor esi, dword [ebp - 0xad0]
xor esi, 0xab69605e
mov eax, esi
xor eax, 0x7f1
rol eax, 2
imul ecx, eax, 0x137f
mov eax, esi
shr eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 7
add ecx, eax
xor esi, ecx
mov eax, esi
mov ecx, esi
xor eax, 0x137f
ror ecx, 9
imul eax, eax, 0x605e
add ecx, eax
xor ebx, ecx
mov eax, ebx
mov dword [ebp - 0xad8], ebx
xor eax, 0xab69
rol eax, 5
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 7
add ecx, eax
xor esi, ecx
mov ebx, esi
xor ebx, dword [ebp - 0xad8]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor esi, eax
lea eax, [esi - 0x7f1137f]
ror eax, 1
imul ecx, eax, 0x605e
mov eax, esi
ror eax, 6
sub ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add ecx, eax
xor esi, ecx
lea eax, [esi - 0x54969fa2]
rol eax, 0xf
imul ecx, eax, 0x137f
mov eax, esi
ror eax, 0xe
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x605e
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor ecx, eax
xor esi, ecx
mov eax, esi
xor eax, 0x7f1137f
rol eax, 4
imul ecx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xb24]
rol eax, 2
mov dword [ebp - 0xb28], esi
mov dword [ebp - 0xb24], edi
xor ecx, eax
mov edi, dword [ebp - 0xb0c]
xor ecx, dword [ebp - 0xb08]
xor ebx, ecx
mov ecx, dword [ebp - 0xaa4]
mov dword [ebp - 0xb38], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xb28]
ror dword [ebp - 0xb38], 8
mov byte [ecx], al
mov al, byte [ebp - 0xb38]
ror dword [ebp - 0xb28], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb28]
ror dword [ebp - 0xb38], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xb38]
ror dword [ebp - 0xb28], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xb28]
ror dword [ebp - 0xb38], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xb28], 8
mov al, byte [ebp - 0xb38]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb28]
mov byte [ecx - 3], al
add ecx, 8
mov ebx, dword [ebp - 0xb38]
mov esi, dword [ebp - 0xb28]
mov eax, dword [ebp - 0xac8]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xabc], 1
mov dword [ebp - 0xb38], ebx
mov dword [ebp - 0xb28], esi
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0xaa4], ecx
jne 0xbb2dcc
mov ecx, dword [ebp - 0xac4]
mov ebx, dword [ebp - 0xaf0]
xor eax, eax
test ecx, ecx
je 0xbb312f
xor dl, byte [eax + ebx]
inc eax
cmp eax, ecx
jb 0xbb3127
mov esi, dword [ebp - 0xab8]
movzx eax, dl
cdq
cmp eax, dword [ecx + esi]
jne 0xc09b62
cmp edx, dword [ecx + esi + 4]
jne 0xc09b62
mov edi, dword [ebp - 0xadc]
xor eax, eax
mov esi, ebx
mov dword [ebp - 0xab0], ecx
mov ebx, eax
test ebx, ebx
jne 0xc09b74
test edi, edi
js 0xc09b88
mov eax, dword [ebp - 0xab0]
xor ecx, ecx
mov dword [ebp - 0xae8], esi
mov ebx, 0x10000000
mov esi, ecx
mov dword [ebp - 0xb50], eax
mov dword [ebp - 0xa94], ebx
test esi, esi
jne 0xc09b94
test ebx, ebx
js 0xbb33eb
mov edi, dword [ebp - 0xb50]
push 4
pop esi
mov dword [ebp - 0xb84], ecx
mov ecx, dword [ebp - 0xae8]
mov dword [ebp - 0xc3c], ecx
cmp edi, esi
jb 0xc09be3
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0xad8], eax
lea eax, [ebp - 0xc3c]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbb33df
lea eax, [ebp - 0xb84]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbb33df
mov eax, edi
sub eax, dword [ebp - 0xb84]
cmp eax, esi
jb 0xc09be3
mov ecx, dword [ebp - 0xc3c]
lea eax, [ebp - 0xc3c]
push eax
push 4
pop eax
mov esi, dword [ecx]
mov edx, eax
mov dword [ebp - 0xaa4], esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbb33df
mov ecx, dword [ebp - 0xb84]
lea eax, [ebp - 0xb84]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbb33df
mov ecx, dword [ebp - 0xb84]
mov eax, edi
sub eax, ecx
cmp eax, esi
jb 0xc09be3
lea eax, [ebp - 0xb84]
mov edx, esi
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbb33df
mov edi, dword [ebp - 0xc3c]
mov edx, dword [ebp - 0xb50]
mov ebx, dword [ebp - 0xae8]
lea ecx, [esi + edi]
lea eax, [edx + ebx]
cmp eax, ecx
jb 0xc09be3
sub edx, esi
sub edx, edi
add edx, ebx
cmp edx, 8
jae 0xc09be3
xor ecx, ecx
mov dword [ebp - 0xae0], ecx
mov eax, ecx
mov dword [ebp - 0xb50], eax
mov ebx, ecx
test edi, edi
je 0xbb337c
mov edx, dword [ebp - 0xaa4]
lea eax, [ebp - 0xbec]
push eax
mov ecx, edi
mov esi, edi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbb33df
mov edx, dword [ebp - 0xbec]
cmp edi, edx
jae 0xbb3368
lea eax, [esi + 4]
cmp eax, esi
jb 0xc09bcf
cmp eax, edx
ja 0xc09bc5
mov eax, dword [esi]
push 4
add eax, 4
pop ebx
cmp eax, ebx
jb 0xc09baa
mov ecx, eax
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, 4
jb 0xc09bb2
mov dword [ebp - 0xd08], ecx
cmp eax, 4
jb 0xbb33c9
add ecx, esi
cmp ecx, esi
jb 0xc09bbd
mov eax, ecx
cmp ecx, esi
sbb ebx, ebx
and ebx, 0xc0000095
cmp ecx, esi
jb 0xbb33c9
cmp eax, edx
ja 0xc09bc5
inc dword [ebp - 0xae0]
mov esi, eax
cmp eax, edx
jb 0xbb32f3
cmp esi, edx
jne 0xc09bc5
mov esi, dword [ebp - 0xaa4]
mov eax, dword [ebp - 0xb50]
test esi, esi
je 0xbb33a2
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb50], eax
test eax, eax
je 0xc09bd9
xor ecx, ecx
mov ebx, ecx
test edi, edi
je 0xbb33b7
push esi
push edi
push eax
call fcn.00bc13d0
mov eax, dword [ebp - 0xb50]
add esp, 0xc
mov dword [ebp - 0xc04], eax
mov eax, dword [ebp - 0xae0]
mov dword [ebp - 0xc0c], eax
test ebx, ebx
js 0xbb33df
mov eax, dword [ebp - 0xad8]
cmp eax, dword [ebp - 0xc0c]
jne 0xc09be3
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
mov edi, dword [ebp - 0xa9c]
mov eax, dword [ebp - 0xb14]
test eax, eax
je 0xbb340c
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xae4]
test esi, esi
je 0xbb347a
xor eax, eax
cmp dword [esi + 4], eax
je 0xbb3433
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xbb344f
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xbb346b
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xbb348f
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb1c]
test eax, eax
je 0xbb34aa
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xaec]
test esi, esi
je 0xbb3518
xor eax, eax
cmp dword [esi + 4], eax
je 0xbb34d1
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xbb34ed
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xbb3509
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xae8]
test eax, eax
je 0xbb3533
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc09519
xor eax, eax
inc eax
cmp dword [ebp - 0xc0c], eax
jb 0xc09bed
cmp dword [ebp - 0xc04], 0
je 0xc09bf7
cmp dword [ebp - 0xc0c], 0
jbe 0xc09bf7
mov ecx, dword [ebp - 0xc04]
lea eax, [ebp - 0xbe4]
push eax
push 4
pop eax
mov esi, dword [ecx]
mov edx, eax
mov dword [ebp - 0xbe4], ecx
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09c10
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbe4]
mov dword [ebp - 0xbe4], eax
test ebx, ebx
js 0xc09c02
push 4
pop edx
cmp esi, edx
jne 0xc0952a
mov eax, dword [eax]
mov dword [ebp - 0xacc], eax
test ebx, ebx
js 0xc09519
cmp eax, 0xd0000023
je 0xc09c21
cmp eax, 0x8007007a
je 0xbb35ea
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test eax, eax
js 0xc09519
cmp dword [ebp - 0xc0c], 6
jne 0xc09bed
cmp dword [ebp - 0xc04], 0
je 0xc09c31
mov ecx, dword [ebp - 0xc04]
xor eax, eax
mov dword [ebp - 0xbd0], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xbd0]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09c61
mov ecx, dword [ebp - 0xbd0]
lea eax, [ebp - 0xbd0]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09c61
mov ecx, dword [ebp - 0xbd0]
xor eax, eax
inc esi
inc eax
cmp esi, eax
jb 0xc09c59
mov esi, dword [ecx]
lea eax, [ebp - 0xbd0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09c61
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbd0]
mov dword [ebp - 0xbd0], eax
test ebx, ebx
js 0xc09c72
cmp esi, 8
jne 0xc0952a
mov ecx, dword [eax]
mov dword [ebp - 0xaec], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xb14], ecx
test ebx, ebx
js 0xc09519
cmp dword [ebp - 0xc04], 0
je 0xc09c8f
mov ecx, dword [ebp - 0xc04]
xor eax, eax
mov dword [ebp - 0xbcc], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xbcc]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09ca8
mov ecx, dword [ebp - 0xbcc]
lea eax, [ebp - 0xbcc]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09ca8
mov ecx, dword [ebp - 0xbcc]
inc esi
cmp esi, 2
jb 0xbb36e4
mov esi, dword [ecx]
lea eax, [ebp - 0xbcc]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09ca8
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbcc]
mov dword [ebp - 0xbcc], eax
test ebx, ebx
js 0xc09c9a
push 4
pop edx
cmp esi, edx
jne 0xc0952a
mov eax, dword [eax]
mov dword [ebp - 0xb50], eax
test ebx, ebx
js 0xc09519
cmp dword [ebp - 0xc04], 0
je 0xc09cb9
mov ecx, dword [ebp - 0xc04]
xor eax, eax
mov dword [ebp - 0xbc8], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xbc8]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09cc3
mov ecx, dword [ebp - 0xbc8]
lea eax, [ebp - 0xbc8]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09cc3
mov ecx, dword [ebp - 0xbc8]
inc esi
cmp esi, 3
jae 0xbb3815
push 4
pop edx
jmp 0xbb37ac
sbb eax, eax
or eax, 1
xor ebx, ebx
jmp 0xbb108e
sbb eax, eax
or eax, 1
jmp 0xbb10cf
mov edi, dword [ecx]
lea eax, [ebp - 0xbc8]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xabc], edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09cc3
mov esi, edi
neg esi
sbb esi, esi
and esi, dword [ebp - 0xbc8]
mov dword [ebp - 0xbc8], esi
test ebx, ebx
js 0xc09519
mov ecx, dword [ebp - 0xc04]
xor eax, eax
push 4
mov dword [ebp - 0xb54], ecx
mov edi, eax
pop edx
mov eax, dword [ecx]
mov dword [ebp - 0xad8], eax
lea eax, [ebp - 0xb54]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09cda
mov edx, dword [ebp - 0xad8]
lea eax, [ebp - 0xb54]
mov ecx, dword [ebp - 0xb54]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09cda
mov ecx, dword [ebp - 0xb54]
inc edi
push 4
pop edx
cmp edi, edx
jb 0xbb386b
mov edi, dword [ecx]
lea eax, [ebp - 0xb54]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09cda
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb54]
mov dword [ebp - 0xb54], eax
test ebx, ebx
js 0xc09ceb
push 4
pop ecx
cmp edi, ecx
jne 0xc0952a
mov eax, dword [eax]
mov dword [ebp - 0xaa4], eax
test ebx, ebx
js 0xc09519
mov ecx, dword [ebp - 0xc04]
xor eax, eax
mov edi, eax
mov eax, dword [ecx]
lea edx, [ecx + 4]
mov dword [ebp - 0xad8], eax
cmp edx, ecx
jb 0xc09cf6
mov eax, edx
cmp edx, ecx
mov dword [ebp - 0xb70], eax
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp edx, ecx
jb 0xc09d06
mov ecx, dword [ebp - 0xad8]
add ecx, eax
mov edx, ecx
mov ebx, ecx
cmp ecx, eax
jb 0xc09cfe
cmp ebx, eax
mov dword [ebp - 0xb70], ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp edx, eax
jb 0xc09d06
inc edi
cmp edi, 5
jb 0xbb3922
mov edi, dword [ecx]
lea eax, [ebp - 0xb70]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xc09d06
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb70]
mov dword [ebp - 0xb70], eax
test ebx, ebx
js 0xc09d17
push 4
pop ecx
cmp edi, ecx
jne 0xc0952a
mov ecx, dword [eax]
test ebx, ebx
js 0xc09519
mov eax, dword [ebp - 0xad4]
cmp eax, dword [ebp - 0xaec]
jne 0xc09bed
mov eax, dword [ebp - 0xaa8]
cmp eax, dword [ebp - 0xb14]
jne 0xc09bed
mov eax, dword [ebp - 0xb50]
push 4
mov dword [ebp - 0xac0], ecx
pop ecx
mov dword [ebp - 0xc48], eax
cmp dword [ebp - 0xaa4], ecx
ja 0xc0950e
mov eax, dword [ebp - 0xabc]
cmp eax, ecx
ja 0xc0950e
push eax
push esi
push dword [ebp - 0xb90]
call fcn.00bc13d0
add esp, 0xc
mov eax, dword [ebp - 0xacc]
mov esi, dword [ebp - 0xa98]
mov edi, dword [ebp - 0xaa0]
test eax, eax
je 0xbb3a60
mov ebx, eax
mov dword [ebp - 0xa94], ebx
mov eax, dword [ebp - 0xce0]
xor edx, edx
mov dword [ebp - 0xce4], edx
mov dword [ebp - 0xce8], edx
test eax, eax
je 0xbb3a8f
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0xce0], edx
mov ecx, dword [ebp - 0xc04]
mov dword [ebp - 0xc08], edx
mov dword [ebp - 0xc0c], edx
test ecx, ecx
je 0xbb3abc
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0xc04], edx
test esi, esi
je 0xbb3acf
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xbb3ae4
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc094cb
mov eax, dword [ebp - 0xac0]
test eax, eax
jne 0xc09d22
mov eax, dword [ebp - 0xb90]
xor edx, edx
mov dword [ebp - 0xb00], edx
mov dword [ebp - 0xc9c], eax
xor edx, edx
mov esi, 0xd0aed4
lea ecx, [edx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xbb3b15
mov eax, dword [0xd0a150]
push 0
pop edx
test eax, eax
jle 0xbb3b74
sub eax, 1
mov dword [0xd0a150], eax
jne 0xbb3b74
mov edi, edx
mov eax, dword [edi + 0xd0ae80]
test eax, eax
je 0xbb3b4b
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0xbb3b3a
push 0x40
xor eax, eax
push eax
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0xd0aed4
xchg dword [ecx], eax
mov eax, dword [ebp - 0xb00]
test eax, eax
jne 0xc106fa
mov eax, dword [ebp - 0xc9c]
test ebx, ebx
js 0xc10706
push 4
pop ecx
cmp dword [ebp - 0xc48], ecx
jne 0xc10749
mov esi, dword [eax]
mov ebx, dword [ebp - 0xd74]
test eax, eax
je 0xbb3bbb
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
test ebx, ebx
js 0xc10759
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xc093d0
xor eax, eax
test esi, esi
jne 0xc093c6
push dword [ebp - 0xcc0]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc093bc
mov eax, dword [ebp - 0xcc0]
mov ecx, dword [ebp - 0xb90]
jmp 0xbb0f95
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xc09446
xor eax, eax
test esi, esi
jne 0xc09436
push dword [ebp - 0xcbc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc0942c
mov eax, dword [ebp - 0xcbc]
mov ecx, dword [ebp - 0xb90]
jmp 0xbb100c
mov edi, dword [ebp - 0xab0]
or ebx, 0xffffffff
mov dword [ebp - 0xb18], 0xc004d501
xor eax, eax
jmp 0xbb0da7
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xbb0daf
mov edx, 0xc000007b
jmp 0xc09331
mov edx, 0xc000000d
mov dword [ebp - 0xa9c], edx
jmp 0xbb0e72
cmp ax, word [ebp - 0xbc0]
je 0xbb0e60
jmp 0xc0932c
mov eax, dword [ebp - 0xad0]
jmp 0xbb0ee8
mov ebx, 0xc000007a
jmp 0xbb0f0a
mov esi, dword [ebp - 0xab0]
mov ebx, 0xc000007a
jmp 0xbb0f10
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc09385
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc09374
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xbb0f3a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc094b5
mov ebx, 0x8007000e
jmp 0xbb1148
mov ebx, 0x80004005
jmp 0xbb0fc9
test eax, eax
jne 0xc093db
mov ebx, 0x80004005
jmp 0xc093ea
jg 0xc093e1
mov ebx, eax
jmp 0xc093ea
movzx ebx, ax
or ebx, 0x80070000
xor eax, eax
jmp 0xbb0fc9
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xbb0fd1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc0941c
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xbb112d
mov ebx, 0x80004005
jmp 0xbb112d
mov ebx, 0x8007000e
jmp 0xbb112d
mov ebx, 0x80004005
mov dword [ebp - 0xa9c], ebx
jmp 0xbb103c
test eax, eax
jne 0xc09451
mov ebx, 0x80004005
jmp 0xc09460
jg 0xc09457
mov ebx, eax
jmp 0xc09460
movzx ebx, ax
or ebx, 0x80070000
mov dword [ebp - 0xa9c], ebx
xor eax, eax
jmp 0xbb103c
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xbb1044
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc09498
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xbb1118
mov ebx, 0x80004005
jmp 0xbb1118
mov eax, dword [ebp - 0xab0]
jmp 0xbb110c
xor ebx, ebx
mov dword [ebp - 0xac0], ebx
jmp 0xbb1152
mov dword [ebp - 0xb00], ebx
mov ebx, 0x8007000e
mov eax, dword [ebp - 0xc5c]
mov dword [ebp - 0xc48], eax
jmp 0xbb3b0e
mov edi, dword [ebp - 0xaa0]
mov ebx, 0xc0000017
mov dword [ebp - 0xa94], ebx
jmp 0xbb3a60
mov esi, dword [ebp - 0xe48]
jmp 0xc0951f
mov ebx, 0xc000003e
mov dword [ebp - 0xa94], ebx
jmp 0xc0951f
mov ebx, 0xc0000017
jmp 0xc09513
mov ebx, 0x8007007a
mov dword [ebp - 0xa94], ebx
mov edi, dword [ebp - 0xaa0]
mov esi, dword [ebp - 0xa98]
jmp 0xbb3a60
mov ebx, 0xc0000023
jmp 0xc09513
mov eax, dword [ebp - 0xaac]
xor ecx, ecx
jmp 0xbb1525
mov eax, dword [ebp - 0xd8c]
jmp 0xbb156a
mov edi, dword [ebp - 0xadc]
mov eax, dword [ebp - 0xaac]
jmp 0xbb1613
mov eax, dword [ebp - 0xd7c]
jmp 0xbb165a
mov edi, dword [ebp - 0xadc]
mov eax, dword [ebp - 0xaac]
jmp 0xbb1700
mov eax, dword [ebp - 0xd28]
jmp 0xbb175f
or esi, 0xffffffff
jmp 0xbb1775
mov ebx, 0xc000003e
jmp 0xc09513
mov eax, dword [ebp - 0xd48]
jmp 0xbb18a1
or esi, 0xffffffff
jmp 0xbb18b7
mov ebx, 0xc0000023
jmp 0xc095af
mov ebx, 0xc000000d
mov dword [ebp - 0xa94], ebx
jmp 0xbb1942
or ecx, 0xffffffff
jmp 0xbb1982
mov ecx, dword [ebp - 0xd50]
jmp 0xbb19a1
or esi, 0xffffffff
jmp 0xbb19b9
mov edx, dword [ebp - 0xadc]
jmp 0xbb1a36
or ecx, 0xffffffff
jmp 0xbb1a66
mov ecx, dword [ebp - 0xd54]
jmp 0xbb1a85
or esi, 0xffffffff
jmp 0xbb1a9d
push 4
pop ecx
jmp 0xbb1b12
mov esi, dword [ebp - 0xe5c]
mov eax, dword [ebp - 0xc18]
jmp 0xbb1cbc
mov ebx, 0xc0000095
jmp 0xbb1e10
mov ebx, 0xc0000017
jmp 0xbb1e0a
xor eax, eax
jmp 0xbb1e02
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xbb1e0a
mov ebx, 0xc000000d
jmp 0xbb23be
xor ebx, ebx
mov dword [ebp - 0xb24], eax
xor esi, esi
mov dword [ebp - 0xb0c], ecx
jbe 0xc096b0
mov edi, dword [ebp - 0xb08]
push 0x38
pop esi
push 4
pop eax
cmp ebx, eax
movzx eax, byte [edi]
jge 0xc09687
lea ecx, [esi - 0x20]
shl eax, cl
mov ecx, dword [ebp - 0xb0c]
or ecx, eax
mov dword [ebp - 0xb0c], ecx
jmp 0xc09697
mov ecx, esi
shl eax, cl
or dword [ebp - 0xb24], eax
mov ecx, dword [ebp - 0xb0c]
inc ebx
sub esi, 8
xor eax, eax
inc edi
cmp ebx, eax
jl 0xc09668
mov dword [ebp - 0xb08], edi
mov edi, eax
mov eax, dword [ebp - 0xb24]
xor ecx, 0xb17a307a
xor eax, 0x42f6b18d
xor ebx, ebx
mov dword [ebp - 0xb40], ecx
mov esi, ebx
jbe 0xc096f2
mov ebx, dword [ebp - 0xad0]
cmp esi, 4
jge 0xc096d9
rol ecx, 8
mov byte [ebx], cl
jmp 0xc096de
rol eax, 8
mov byte [ebx], al
inc ebx
add esi, 1
js 0xc096cd
mov ecx, dword [ebp - 0xb40]
mov dword [ebp - 0xad0], ebx
xor ebx, ebx
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0xb4c], ebx
test eax, eax
jg 0xc0970b
jns 0xc0970b
xor eax, eax
mov ecx, eax
mov dword [ebp - 0xb40], ecx
mov esi, dword [ebp - 0xab0]
jmp 0xbb1ebf
mov ebx, 0xc0000017
jmp 0xbb2394
mov ebx, 0xc0000017
xor edx, edx
jmp 0xbb238c
mov ebx, 0xc0000017
jmp 0xbb238c
cmp dword [esi + 4], 0
je 0xc09752
push dword [esi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 4], edx
cmp dword [esi + 0xc], 0
je 0xc0976e
push dword [esi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0xc], edx
cmp dword [esi + 0x14], 0
je 0xc0978a
push dword [esi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0x14], edx
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xbb2394
xor eax, eax
cmp dword [edi + 4], eax
je 0xc097bb
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc097d7
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc097f3
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xbb23be
mov ebx, 0xc0000001
jmp 0xbb23be
mov edi, dword [ebp - 0xe60]
test ebx, ebx
js 0xbb25d5
jmp 0xbb2479
mov ebx, 0xc0000017
jmp 0xbb25d5
xor eax, eax
jmp 0xbb25cd
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xbb25d5
mov ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
mov eax, dword [ebp - 0xd00]
jmp 0xbb2667
mov ebx, 0xc000000d
mov dword [ebp - 0xa94], ebx
mov esi, dword [ebp - 0xab8]
jmp 0xbb28a8
mov edi, dword [ebp - 0xae0]
jmp 0xbb27c6
mov eax, dword [ebp - 0xe64]
test ebx, ebx
js 0xc0986a
jmp 0xbb2895
mov ebx, 0x8000ffff
jmp 0xbb33e5
mov ecx, dword [ebp - 0xb1c]
mov ebx, 0xd0000017
jmp 0xbb28d5
mov ebx, 0x80070057
jmp 0xc09926
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
jle 0xc098ec
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xa94], ebx
test ebx, ebx
jmp 0xc098ec
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xa94], ebx
test ebx, ebx
mov esi, dword [ebp - 0xab8]
js 0xbb2991
mov ebx, 0x80004005
mov dword [ebp - 0xa94], ebx
jmp 0xbb2991
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
jle 0xc098e6
jmp 0xc098d5
mov esi, dword [ebp - 0xab8]
jmp 0xbb2991
mov ebx, 0x8007007a
mov dword [ebp - 0xa94], ebx
jmp 0xbb33f1
mov ebx, 0xc000003e
jmp 0xbb2cd0
mov ebx, 0xc000003e
jmp 0xc09a48
mov ebx, 0xc0000017
jmp 0xbb2cba
mov ebx, 0xc0000017
xor eax, eax
jmp 0xbb2cb2
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
jmp 0xbb2c28
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
jmp 0xbb2c6a
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
jmp 0xbb2cac
cmp dword [esi + 4], 0
je 0xc09999
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xc099b5
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xc099d1
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xbb2cba
cmp dword [edi + 4], 0
je 0xc09a01
push dword [edi + 4]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 4], ecx
cmp dword [edi + 0xc], 0
je 0xc09a1d
push dword [edi + 0xc]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0xc], ecx
cmp dword [edi + 0x14], 0
je 0xc09a39
push dword [edi + 0x14]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0x14], ecx
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
jmp 0xbb2cd0
mov ebx, 0xd000000d
mov dword [ebp - 0xa94], ebx
jmp 0xbb3197
or dword [ebp - 0xb28], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0xb38], ebx
mov eax, ebx
mov dword [ebp - 0xb24], eax
mov dword [ebp - 0xb08], ebx
test edi, edi
je 0xc09ace
push 0x38
pop esi
push 4
pop eax
cmp ebx, eax
jge 0xc09aa0
mov eax, dword [ebp - 0xb0c]
lea ecx, [esi - 0x20]
movzx eax, byte [eax]
shl eax, cl
or dword [ebp - 0xb08], eax
jmp 0xc09aad
movzx eax, byte [ecx]
mov ecx, esi
shl eax, cl
or dword [ebp - 0xb24], eax
mov ecx, dword [ebp - 0xb0c]
inc ebx
sub esi, 8
inc ecx
mov dword [ebp - 0xb0c], ecx
cmp ebx, edi
jl 0xc09a83
mov esi, dword [ebp - 0xae0]
mov eax, dword [ebp - 0xb24]
mov ebx, dword [ebp - 0xb08]
xor eax, 0x699a899c
xor ebx, 0x92f65a5
mov dword [ebp - 0xb28], eax
xor ecx, ecx
mov dword [ebp - 0xb38], ebx
test edi, edi
je 0xc09b1a
cmp ecx, 4
jge 0xc09afd
rol ebx, 8
mov byte [esi], bl
jmp 0xc09b02
rol eax, 8
mov byte [esi], al
inc ecx
inc esi
cmp ecx, edi
jl 0xc09af1
mov ebx, dword [ebp - 0xb38]
mov eax, dword [ebp - 0xb28]
mov dword [ebp - 0xae0], esi
add edi, 0xfffffffc
test edi, edi
jle 0xc09b40
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xad0], eax
mov esi, eax
mov dword [ebp - 0xb28], eax
jmp 0xbb2d95
xor eax, eax
mov esi, eax
mov dword [ebp - 0xb28], esi
test edi, edi
jns 0xbb2d95
neg edi
shl edi, 3
mov ecx, edi
shr ebx, cl
shl ebx, cl
jmp 0xbb2d8f
mov esi, dword [ebp - 0xaac]
mov edi, 0xc004d501
xor eax, eax
jmp 0xbb315e
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xbb3166
mov ebx, 0xd0000001
xor ecx, ecx
jmp 0xbb3189
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
jmp 0xbb3197
or ecx, 0xffffffff
jmp 0xbb3318
mov ecx, dword [ebp - 0xd08]
jmp 0xbb3331
or eax, 0xffffffff
jmp 0xbb3346
mov ebx, 0xc000000d
jmp 0xbb33df
mov ebx, 0xc0000095
jmp 0xbb33df
mov ebx, 0xc0000017
jmp 0xbb33c9
mov ebx, 0xc000003e
jmp 0xbb33df
mov ebx, 0xc004d501
jmp 0xc09513
mov ebx, 0xc000000d
mov dword [ebp - 0xa94], ebx
mov eax, dword [ebp - 0xacc]
push 4
pop edx
jmp 0xbb35c0
mov esi, dword [ebp - 0xe68]
mov eax, dword [ebp - 0xe6c]
jmp 0xbb35a5
mov eax, 0x8007007a
mov dword [ebp - 0xacc], eax
jmp 0xbb35d3
mov edx, dword [ebp - 0xd9c]
mov ebx, 0xc000000d
mov ecx, dword [ebp - 0xda0]
mov dword [ebp - 0xa94], ebx
mov dword [ebp - 0xb14], edx
mov dword [ebp - 0xaec], ecx
jmp 0xbb36bf
push 4
pop edx
jmp 0xbb3614
mov esi, dword [ebp - 0xe90]
mov eax, dword [ebp - 0xe94]
jmp 0xbb369d
mov eax, dword [ebp - 0xd9c]
mov dword [ebp - 0xb14], eax
mov eax, dword [ebp - 0xda0]
mov dword [ebp - 0xaec], eax
jmp 0xbb36bf
mov ebx, 0xc000000d
mov dword [ebp - 0xa94], ebx
mov eax, dword [ebp - 0xd0c]
push 4
pop edx
jmp 0xbb3781
mov esi, dword [ebp - 0xe98]
mov eax, dword [ebp - 0xe9c]
jmp 0xbb376c
mov ebx, 0xc000000d
jmp 0xc09513
mov eax, dword [ebp - 0xe20]
mov esi, dword [ebp - 0xe24]
mov dword [ebp - 0xabc], eax
jmp 0xbb3850
mov edi, dword [ebp - 0xe28]
mov eax, dword [ebp - 0xe2c]
jmp 0xbb38f5
mov eax, dword [ebp - 0xe30]
jmp 0xbb390a
or eax, 0xffffffff
jmp 0xbb3937
or ecx, 0xffffffff
jmp 0xbb3969
mov edi, dword [ebp - 0xe34]
mov eax, dword [ebp - 0xe38]
jmp 0xbb39c2
mov ecx, dword [ebp - 0xab4]
jmp 0xbb39d7
mov dword [0xd09360], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x2c8]
push eax
push 0xb10000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0xc0e594
cmp eax, esi
jne 0xc09d5a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0xc0e594
mov esi, dword [0xd0807c]
xor ebx, ebx
push 0x403
push ebx
push ebx
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xaac], eax
test eax, eax
jne 0xc09d88
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc0e596
mov esi, dword [0xd0804c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [0xd09358], eax
mov eax, dword [0xd09360]
push 0x54
mov dword [ebp - 0xae0], eax
lea eax, [ebp - 0x778]
push ebx
push eax
mov dword [0xd0935c], edx
call fcn.00bc259b
xor eax, eax
mov dword [ebp - 0xd88], ebx
lea edi, [ebp - 0xc38]
mov dword [ebp - 0xd84], ebx
stosd dword es:[edi], eax
add esp, 0xc
mov dword [ebp - 0xadc], ebx
mov dword [ebp - 0xad8], ebx
stosd dword es:[edi], eax
push 0x2c
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x44c]
push eax
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0xb50], ebx
xor ebx, ebx
mov esi, 0xd0aed4
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xc09e03
mov eax, dword [0xd0a150]
push 0
pop ebx
test eax, eax
jne 0xc0a41d
push 0x338
mov esi, ebx
mov dword [ebp - 0xaa8], ebx
push ebx
mov dword [ebp - 0xa9c], ebx
mov dword [ebp - 0xab0], esi
mov dword [ebp - 0xb00], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb14], eax
test eax, eax
je 0xc0a40f
or dword [ebp - 0xabc], 0xffffffff
mov edi, ebx
add eax, 7
mov dword [ebp - 0x3f0], 0xab69605e
mov cl, bl
mov dword [ebp - 0x3ec], 0x7f1137f
mov dword [ebp - 0xaa4], ebx
mov esi, 0xb2bef2
mov dword [ebp - 0xb58], ebx
mov dword [ebp - 0xb7c], edi
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xaf0], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edx, byte [esi + 2]
shl edx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edx, eax
mov dword [ebp - 0xac8], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl edx, 8
mov ebx, 0xab69605e
or edx, eax
movzx eax, byte [esi + 5]
shl edx, 8
add esi, 8
or edx, eax
mov dword [ebp - 0xaec], esi
mov esi, edx
mov dword [ebp - 0xad4], edx
xor esi, dword [ebp - 0xb58]
xor esi, edi
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor edi, edx
lea eax, [edi + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, edi
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor edi, edx
mov eax, edi
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, ebx
sub eax, edx
xor edi, eax
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor edi, edx
lea eax, [edi + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, ebx
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, edi
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edi, eax
mov dword [ebp - 0xab4], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0xab4]
xor edi, ebx
mov eax, edi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, edi
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov ebx, edi
xor ebx, esi
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor edi, eax
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, edi
ror eax, 6
sub edx, eax
xor ebx, edx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add edx, eax
xor edi, edx
lea eax, [edi - 0x54969fa2]
mov esi, dword [ebp - 0xaec]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, edi
ror eax, 0xe
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, edi
xor edi, dword [ebp - 0xabc]
rol eax, 2
mov dword [ebp - 0xb58], edi
xor edx, eax
xor edx, dword [ebp - 0xaa4]
xor ebx, edx
mov edx, dword [ebp - 0xac4]
mov dword [ebp - 0xb7c], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb58]
ror dword [ebp - 0xb7c], 8
mov byte [edx], al
mov al, byte [ebp - 0xb7c]
ror dword [ebp - 0xb58], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb58]
ror dword [ebp - 0xb7c], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb7c]
ror dword [ebp - 0xb58], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb58]
ror dword [ebp - 0xb7c], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xb7c]
ror dword [ebp - 0xb58], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xb58]
mov byte [edx - 3], al
add edx, 8
mov edi, dword [ebp - 0xb7c]
mov eax, dword [ebp - 0xac8]
ror dword [ebp - 0xb58], 8
ror edi, 8
sub dword [ebp - 0xaf0], 1
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0xad4]
mov dword [ebp - 0xb7c], edi
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xac4], edx
jne 0xc09ea4
mov esi, dword [ebp - 0xb14]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc0a1e1
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xc0a213
cmp edx, dword [0xb2c22c]
jne 0xc0a213
mov ebx, esi
xor eax, eax
mov dword [ebp - 0xab0], ebx
mov esi, eax
mov edi, 0x337
jmp 0xc0a228
mov ebx, dword [ebp - 0xab0]
or edi, 0xffffffff
mov dword [ebp - 0xb00], 0xc004d501
xor eax, eax
test esi, esi
je 0xc0a23b
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb00], 0
jl 0xc0a409
xor eax, eax
mov esi, ebx
push 0x40
push eax
push 0xd0ae80
mov byte [edi + ebx], al
call fcn.00bc259b
add esp, 0xc
cmp byte [ebx], 0
je 0xc0a39f
mov edi, 0xd0ae80
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbf8]
jne 0xc0a274
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc0a402
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa9c], edx
cmp word [eax], cx
jne 0xc0a2ea
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xc0a2ea
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xc0a2ea
cmp dword [ecx], 0x4550
jne 0xc0a2ea
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xbc4]
je 0xc0a2f7
cmp ax, word [ebp - 0xbc0]
je 0xc0a2f7
mov edx, 0xc000000d
jmp 0xc0a2ef
mov edx, 0xc000007b
mov dword [ebp - 0xa9c], edx
jmp 0xc0a309
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xaa4], eax
test eax, eax
je 0xc0a393
mov ecx, esi
mov dword [ebp - 0xac8], esi
xor eax, eax
mov dword [ebp - 0xccc], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xab4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc0a333
sub ecx, dword [ebp - 0xab4]
inc esi
add esi, ecx
test edx, edx
js 0xc0a37d
mov ecx, dword [ebp - 0xac8]
lea eax, [ebp - 0xccc]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa9c], edx
test edx, edx
js 0xc0a39f
mov eax, dword [ebp - 0xaa8]
mov ecx, dword [ebp - 0xccc]
mov dword [eax*4 + section..data], ecx
jmp 0xc0a383
mov eax, dword [ebp - 0xaa8]
inc eax
inc ebx
mov dword [ebp - 0xaa8], eax
cmp ebx, dword [ebp - 0xaa4]
jb 0xc0a31a
add edi, 0x10
cmp byte [esi], 0
jne 0xc0a26d
mov ebx, dword [ebp - 0xa9c]
mov esi, dword [ebp - 0xab0]
test esi, esi
je 0xc0a3c0
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc0a416
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc0a3d9
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc0a3c8
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc0a423
mov ebx, 0xc000007a
jmp 0xc0a3a5
mov esi, dword [ebp - 0xab0]
mov ebx, 0xc000007a
jmp 0xc0a3ab
mov eax, dword [0xd0a150]
xor ebx, ebx
inc eax
mov dword [0xd0a150], eax
xor eax, eax
mov edx, 0xd0aed4
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0xa], ebx
lea edi, [ebp - 0xc84]
mov dword [ebp - 0xae8], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xb1c], ebx
mov dword [ebp - 0xaec], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xdb0]
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xc0a45a
mov eax, dword [0xd0a150]
push 0
pop ebx
test eax, eax
jne 0xc0aa91
push 0x338
mov esi, ebx
mov dword [ebp - 0xaa8], ebx
push ebx
mov dword [ebp - 0xa9c], ebx
mov dword [ebp - 0xab0], esi
mov dword [ebp - 0xb00], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xad4], eax
test eax, eax
je 0xc0aa83
or dword [ebp - 0xabc], 0xffffffff
mov edi, ebx
add eax, 7
mov dword [ebp - 0x3b8], 0xab69605e
mov cl, bl
mov dword [ebp - 0x3b4], 0x7f1137f
mov dword [ebp - 0xaa4], ebx
mov esi, 0xb2bef2
mov dword [ebp - 0xb5c], ebx
mov dword [ebp - 0xb80], edi
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xaf0], 0x67
movzx edx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx ebx, byte [esi + 2]
shl edx, 8
or edx, eax
shl ebx, 8
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
or ebx, eax
mov dword [ebp - 0xab4], edx
movzx eax, byte [esi + 4]
xor edi, edx
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 5]
add esi, 8
shl ebx, 8
or ebx, eax
mov dword [ebp - 0xac8], esi
mov esi, edi
xor esi, ebx
xor esi, dword [ebp - 0xb5c]
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor edi, edx
lea eax, [edi + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, edi
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor edi, edx
mov eax, edi
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor edi, eax
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor edi, edx
lea eax, [edi + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, edi
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edi, eax
mov dword [ebp - 0xae4], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0xae4]
xor edi, 0xab69605e
mov eax, edi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, edi
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xae4], esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
mov eax, esi
xor edi, edx
xor eax, edi
xor eax, 0xac987321
mov dword [ebp - 0xae4], eax
ror eax, 3
sub eax, 0xab69
mov esi, dword [ebp - 0xae4]
imul eax, eax, 0x137f
xor edi, eax
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, edi
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
xor edi, edx
lea eax, [edi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, edi
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xae4], esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, edi
xor edi, dword [ebp - 0xabc]
rol eax, 2
mov dword [ebp - 0xb5c], edi
mov dword [ebp - 0xabc], ebx
xor edx, eax
mov eax, esi
xor edx, dword [ebp - 0xaa4]
xor eax, edx
mov esi, dword [ebp - 0xac8]
mov edx, dword [ebp - 0xac4]
mov dword [ebp - 0xb80], eax
mov byte [edx - 4], al
mov al, byte [ebp - 0xb5c]
ror dword [ebp - 0xb80], 8
mov byte [edx], al
mov al, byte [ebp - 0xb80]
ror dword [ebp - 0xb5c], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb5c]
ror dword [ebp - 0xb80], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb80]
ror dword [ebp - 0xb5c], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb5c]
ror dword [ebp - 0xb80], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xb80]
ror dword [ebp - 0xb5c], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xb5c]
mov byte [edx - 3], al
add edx, 8
mov eax, dword [ebp - 0xb80]
ror dword [ebp - 0xb5c], 8
ror eax, 8
sub dword [ebp - 0xaf0], 1
mov dword [ebp - 0xae4], eax
mov edi, dword [ebp - 0xae4]
mov dword [ebp - 0xb80], eax
mov eax, dword [ebp - 0xab4]
mov dword [ebp - 0xaa4], eax
mov dword [ebp - 0xac4], edx
jne 0xc0a4fb
mov esi, dword [ebp - 0xad4]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc0a855
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xc0a887
cmp edx, dword [0xb2c22c]
jne 0xc0a887
mov ebx, esi
xor eax, eax
mov dword [ebp - 0xab0], ebx
mov esi, eax
mov edi, 0x337
jmp 0xc0a89c
mov ebx, dword [ebp - 0xab0]
or edi, 0xffffffff
mov dword [ebp - 0xb00], 0xc004d501
xor eax, eax
test esi, esi
je 0xc0a8af
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb00], 0
jl 0xc0aa7d
xor eax, eax
mov esi, ebx
push 0x40
push eax
push 0xd0ae80
mov byte [edi + ebx], al
call fcn.00bc259b
add esp, 0xc
cmp byte [ebx], 0
je 0xc0aa13
mov edi, 0xd0ae80
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbf8]
jne 0xc0a8e8
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc0aa76
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa9c], edx
cmp word [eax], cx
jne 0xc0a95e
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xc0a95e
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xc0a95e
cmp dword [ecx], 0x4550
jne 0xc0a95e
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xbc4]
je 0xc0a96b
cmp ax, word [ebp - 0xbc0]
je 0xc0a96b
mov edx, 0xc000000d
jmp 0xc0a963
mov edx, 0xc000007b
mov dword [ebp - 0xa9c], edx
jmp 0xc0a97d
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xaa4], eax
test eax, eax
je 0xc0aa07
mov ecx, esi
mov dword [ebp - 0xac8], esi
xor eax, eax
mov dword [ebp - 0xc1c], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xab4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc0a9a7
sub ecx, dword [ebp - 0xab4]
inc esi
add esi, ecx
test edx, edx
js 0xc0a9f1
mov ecx, dword [ebp - 0xac8]
lea eax, [ebp - 0xc1c]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa9c], edx
test edx, edx
js 0xc0aa13
mov eax, dword [ebp - 0xaa8]
mov ecx, dword [ebp - 0xc1c]
mov dword [eax*4 + section..data], ecx
jmp 0xc0a9f7
mov eax, dword [ebp - 0xaa8]
inc eax
inc ebx
mov dword [ebp - 0xaa8], eax
cmp ebx, dword [ebp - 0xaa4]
jb 0xc0a98e
add edi, 0x10
cmp byte [esi], 0
jne 0xc0a8e1
mov ebx, dword [ebp - 0xa9c]
mov esi, dword [ebp - 0xab0]
test esi, esi
je 0xc0aa34
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc0aa8a
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc0aa4d
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc0aa3c
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc0aa97
mov ebx, 0xc000007a
jmp 0xc0aa19
mov esi, dword [ebp - 0xab0]
mov ebx, 0xc000007a
jmp 0xc0aa1f
mov eax, dword [0xd0a150]
xor ebx, ebx
inc eax
mov dword [0xd0a150], eax
xor eax, eax
mov edi, 0xd0aed4
xchg dword [edi], eax
push 0x54
lea eax, [ebp - 0x778]
push ebx
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0xae0]
add esp, 0xc
mov esi, dword [0xd0807c]
mov ecx, eax
mov dword [ebp - 0xc38], ebx
push 0xf
pop edx
and ecx, edx
mov dword [ebp - 0xab8], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0xc], cx
mov ecx, eax
shr ecx, 8
push 0x403
and ecx, edx
shr eax, 0xc
push ebx
mov word [ebp - 0xa], cx
and eax, edx
push ebx
mov ecx, esi
mov word [ebp - 8], ax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xab0], 0xffffff
test eax, eax
jne 0xc0ab3c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc0ab2c
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc0bf94
mov ebx, 0x80004005
jmp 0xc0bf94
mov esi, dword [0xd08050]
mov eax, ebx
mov dword [ebp - 0xac0], eax
mov edi, ebx
lea eax, [ebp - 0xc50]
mov dword [ebp - 0xb14], edi
push eax
push ebx
lea eax, [ebp - 0xc20]
mov dword [ebp - 0xc24], ebx
push eax
push 8
mov ecx, esi
mov dword [ebp - 0xad4], ebx
mov dword [ebp - 0xacc], ebx
mov dword [ebp - 0xc50], ebx
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc0ac12
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc0aba4
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc0ad7b
mov ebx, 0x80004005
mov esi, dword [ebp - 0xacc]
xor edx, edx
mov eax, dword [ebp - 0xc24]
test eax, eax
je 0xc0abd3
mov ecx, dword [ebp - 0xad4]
test ecx, ecx
je 0xc0abd3
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0xc0abcb
test esi, esi
je 0xc0abe6
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xc24]
test eax, eax
je 0xc0b4df
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0xc24], ecx
jmp 0xc0b4e1
mov eax, dword [ebp - 0xc50]
add eax, eax
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xac4], ebx
test ebx, ebx
je 0xc0acad
mov eax, dword [ebp - 0xc20]
lea eax, [eax*4 + 4]
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xabc], eax
test eax, eax
je 0xc0ad60
mov esi, eax
lea eax, [ebp - 0xc50]
push eax
push ebx
mov ebx, dword [0xd08050]
lea eax, [ebp - 0xc20]
push eax
push 8
mov ecx, ebx
call dword [0xd0cffc]
call ebx
test eax, eax
jne 0xc0acb7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc0ac9f
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc0aca6
mov ebx, 0x80004005
xor ecx, ecx
jmp 0xc0ad4b
mov ebx, 0x8007000e
jmp 0xc0abaf
mov eax, dword [ebp - 0xabc]
xor ecx, ecx
mov ebx, eax
mov edi, dword [ebp - 0xac4]
mov dword [ebp - 0xaa4], ecx
cmp dword [ebp - 0xc20], ecx
jbe 0xc0ad28
mov esi, dword [0xd08058]
push ecx
push edi
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, edi
mov dword [ebx], eax
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0xc0acf0
sub ecx, edx
sar ecx, 1
push 4
pop eax
add ebx, eax
mov eax, dword [ebp - 0xaa4]
lea edi, [edi + ecx*2]
add edi, 2
inc eax
push 0
mov dword [ebp - 0xaa4], eax
pop ecx
cmp eax, dword [ebp - 0xc20]
jb 0xc0acd5
mov eax, dword [ebp - 0xabc]
mov dword [ebx], 0x409
mov edi, eax
mov ebx, dword [ebp - 0xac0]
mov esi, ecx
mov dword [ebp - 0xb14], eax
mov eax, dword [ebp - 0xc20]
inc eax
mov dword [ebp - 0xaa4], eax
test esi, esi
je 0xc0ad65
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc0ad65
mov ebx, 0x8007000e
push dword [ebp - 0xac4]
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc0abaf
xor eax, eax
mov ebx, eax
mov edx, eax
mov dword [ebp - 0xaa8], ebx
cmp dword [ebp - 0xaa4], eax
jbe 0xc0adc2
mov ecx, eax
mov eax, dword [edi + edx*4]
cmp eax, dword [ecx*4 + 0xb40a18]
je 0xc0adb8
inc ecx
cmp ecx, 0x26
jb 0xc0ad99
inc edx
xor eax, eax
cmp edx, dword [ebp - 0xaa4]
jae 0xc0adc2
jmp 0xc0ad97
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0xaa8], ebx
mov esi, dword [0xd08054]
mov ecx, esi
push eax
mov dword [ebp - 0xb00], eax
lea eax, [ebp - 0xc0]
push 0x55
push eax
push dword [ebx*4 + 0xb40a18]
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc0ae2d
mov esi, dword [0xd08048]
lea eax, [ebp - 0x640]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xc0]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
test eax, eax
jle 0xc0ae2d
mov ebx, dword [ebp - 0x634]
xor eax, eax
shr ebx, 0x1b
inc eax
and ebx, eax
mov dword [ebp - 0xb00], ebx
mov ebx, dword [ebp - 0xaa8]
xor eax, eax
mov edx, 0xb2fcd8
mov esi, eax
mov ecx, edx
mov dword [ebp + esi*4 - 0x350], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbf8]
jne 0xc0ae42
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0xc0ae36
imul ecx, ebx, 3
movzx eax, byte [ecx + 0xb320b0]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xc84], eax
movzx eax, byte [ecx + 0xb320b1]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xc80], eax
movzx eax, byte [ecx + 0xb320b2]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xc7c], eax
xor ebx, ebx
push 0x1c90
mov eax, ebx
push ebx
mov dword [ebp - 0xac0], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xb08], ecx
test ecx, ecx
je 0xc0acad
or dword [ebp - 0xabc], 0xffffffff
mov edi, ebx
add ecx, 7
mov dword [ebp - 0x3f8], 0xab69605e
mov al, bl
mov dword [ebp - 0x3f4], 0x7f1137f
mov dword [ebp - 0xaa4], ebx
mov esi, 0xb40ac2
mov dword [ebp - 0xb60], ebx
mov dword [ebp - 0xb88], edi
mov dword [ebp - 0xac4], ecx
mov dword [ebp - 0xaf0], 0x392
movzx ebx, byte [esi - 2]
movzx ecx, byte [esi - 1]
movzx edx, byte [esi + 2]
shl edx, 8
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 3]
or edx, ecx
mov dword [ebp - 0xac8], ebx
movzx ecx, byte [esi + 4]
xor edi, ebx
shl edx, 8
mov ebx, 0xab69605e
or edx, ecx
movzx ecx, byte [esi + 5]
shl edx, 8
add esi, 8
or edx, ecx
mov dword [ebp - 0xad0], esi
mov esi, edx
mov dword [ebp - 0xae0], edx
xor esi, dword [ebp - 0xb60]
xor esi, edi
xor esi, 0xac987321
lea ecx, [esi + 0x54969fa2]
rol ecx, 5
imul edx, ecx, 0x137f
mov ecx, esi
rol ecx, 0xa
add edx, ecx
xor edi, edx
lea ecx, [edi + 0x7f1137f]
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, edi
rol ecx, 2
sub edx, ecx
xor esi, edx
imul edx, esi, 0x605e
mov ecx, esi
shr ecx, 0xd
sub edx, ecx
sub edx, 0x756c8a2
xor edi, edx
mov ecx, edi
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, edi
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, ebx
sub ecx, edx
xor edi, ecx
mov ecx, edi
mov edx, edi
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
xor esi, edx
lea ecx, [esi + 0x7f1137f]
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, esi
rol ecx, 2
add edx, ecx
xor edi, edx
lea ecx, [edi + 0x54969fa2]
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, edi
rol ecx, 8
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, ebx
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, esi
ror ecx, 0xa
xor edx, ecx
xor edi, edx
mov ecx, edi
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, edi
shr ecx, 0xa
xor edx, ecx
xor esi, edx
mov ecx, esi
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor edi, ecx
mov dword [ebp - 0xab4], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0xab4]
xor edi, ebx
mov ecx, edi
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, edi
shr ecx, 2
add edx, ecx
xor esi, edx
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, esi
rol ecx, 7
add edx, ecx
xor edi, edx
mov ecx, edi
mov edx, edi
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0xab69
rol ecx, 5
imul edx, ecx, 0x7f1
mov ecx, esi
rol ecx, 7
add edx, ecx
xor edi, edx
mov ebx, edi
xor ebx, esi
xor ebx, 0xac987321
mov ecx, ebx
ror ecx, 3
sub ecx, 0xab69
imul ecx, ecx, 0x137f
xor edi, ecx
lea ecx, [edi - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, edi
ror ecx, 6
sub edx, ecx
xor ebx, edx
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 0xe
add edx, ecx
xor edi, edx
lea ecx, [edi - 0x54969fa2]
mov esi, dword [ebp - 0xad0]
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, edi
ror ecx, 0xe
sub edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, ebx
shr ecx, 3
xor edx, ecx
xor edi, edx
mov ecx, edi
xor ecx, 0x7f1137f
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, edi
xor edi, dword [ebp - 0xabc]
rol ecx, 2
mov dword [ebp - 0xb60], edi
xor edx, ecx
xor edx, dword [ebp - 0xaa4]
xor ebx, edx
mov edx, dword [ebp - 0xac4]
mov dword [ebp - 0xb88], ebx
mov byte [edx - 4], bl
mov cl, byte [ebp - 0xb60]
ror dword [ebp - 0xb88], 8
mov byte [edx], cl
mov cl, byte [ebp - 0xb88]
ror dword [ebp - 0xb60], 8
mov byte [edx - 5], cl
mov cl, byte [ebp - 0xb60]
ror dword [ebp - 0xb88], 8
mov byte [edx - 1], cl
mov cl, byte [ebp - 0xb88]
ror dword [ebp - 0xb60], 8
mov byte [edx - 6], cl
mov cl, byte [ebp - 0xb60]
ror dword [ebp - 0xb88], 8
mov byte [edx - 2], cl
mov cl, byte [ebp - 0xb88]
ror dword [ebp - 0xb60], 8
mov byte [edx - 7], cl
mov cl, byte [ebp - 0xb60]
mov byte [edx - 3], cl
add edx, 8
mov edi, dword [ebp - 0xb88]
mov ecx, dword [ebp - 0xac8]
ror dword [ebp - 0xb60], 8
ror edi, 8
sub dword [ebp - 0xaf0], 1
mov dword [ebp - 0xaa4], ecx
mov ecx, dword [ebp - 0xae0]
mov dword [ebp - 0xb88], edi
mov dword [ebp - 0xabc], ecx
mov dword [ebp - 0xac4], edx
jne 0xc0af16
xor ecx, ecx
mov esi, 0x1c90
mov edx, ecx
mov ecx, dword [ebp - 0xb08]
xor al, byte [edx + ecx]
inc edx
cmp edx, esi
jb 0xc0b264
movzx eax, al
cdq
cmp eax, dword [0xb42750]
jne 0xc0b298
cmp edx, dword [0xb42754]
jne 0xc0b298
mov ebx, dword [ebp - 0xac0]
xor edx, edx
mov dword [ebp - 0xc24], ecx
mov ecx, edx
mov dword [ebp - 0xad4], esi
jmp 0xc0b2a5
mov ebx, 0xc004d501
xor edx, edx
mov dword [ebp - 0xac0], ebx
test ecx, ecx
je 0xc0b2b8
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc0abaf
mov edi, dword [ebp - 0xc24]
xor eax, eax
mov ebx, dword [ebp - 0xaa8]
mov esi, eax
mov edx, eax
cmp ebx, edx
jne 0xc0b2dd
mov dword [ebp + esi*4 - 0x300], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0xab4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc0b2e8
sub ecx, dword [ebp - 0xab4]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0xc0b2d2
inc esi
push 0
pop eax
cmp esi, 6
jb 0xc0b2d0
push 0xc
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, dword [ebp - 0xac0]
mov edx, eax
mov dword [ebp - 0xaa4], edx
test edx, edx
jne 0xc0b337
xor edx, edx
mov ebx, 0x8007000e
mov esi, edx
jmp 0xc0abb7
mov edi, edx
xor eax, eax
mov esi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov ecx, eax
mov dword [ebp - 0xaa8], eax
movzx edx, word [ebp + ecx*2 - 0xc]
cmp dx, word [eax*2 + 0xb40ab0]
je 0xc0b364
inc eax
cmp eax, 6
jb 0xc0b34f
jmp 0xc0b423
mov edx, dword [ebp + eax*4 - 0x300]
mov ecx, edx
mov dword [ebp - 0xab4], edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc0b376
xor eax, eax
sub ecx, edi
mov edi, dword [0xd08060]
push eax
push eax
lea eax, [ecx + 1]
mov ecx, edi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0xd0cffc]
call edi
mov dword [ebp - 0xac8], eax
test eax, eax
je 0xc0b45b
lea ecx, [eax + eax]
xor eax, eax
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0xaa8]
mov edi, eax
mov eax, dword [ebp - 0xaa4]
mov dword [eax + ecx*4], edi
test edi, edi
je 0xc0b454
mov edx, dword [ebp - 0xab4]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xab4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc0b3e8
push dword [ebp - 0xac8]
sub ecx, dword [ebp - 0xab4]
push edi
mov edi, dword [0xd08060]
lea eax, [ecx + 1]
mov ecx, edi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0xd0cffc]
call edi
test eax, eax
je 0xc0b45b
mov ecx, dword [ebp - 0xaa8]
inc ecx
mov dword [ebp - 0xaa8], ecx
push 0
pop eax
cmp ecx, 3
jb 0xc0b34a
mov eax, dword [ebp - 0xaa4]
xor edx, edx
mov dword [ebp - 0xaec], eax
mov esi, edx
mov eax, dword [ebp - 0xb00]
mov dword [ebp - 0x778], eax
jmp 0xc0b47b
mov ebx, 0x8007000e
jmp 0xc0b479
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc0b472
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc0b479
mov ebx, 0x80004005
xor edx, edx
test esi, esi
je 0xc0abb7
mov edi, edx
mov edx, dword [esi + edi*4]
test edx, edx
je 0xc0b4d4
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0xab4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbf8]
jne 0xc0b497
sub ecx, dword [ebp - 0xab4]
xor eax, eax
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc0b4c3
mov byte [edx], al
inc edx
sub ecx, 1
jne 0xc0b4bb
push dword [esi + edi*4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
inc edi
cmp edi, 3
jb 0xc0b485
jmp 0xc0abb5
xor ecx, ecx
mov eax, dword [ebp - 0xb14]
test eax, eax
je 0xc0b4fa
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc0bf76
mov eax, dword [ebp - 0xaec]
mov esi, dword [0xd080b4]
mov ecx, dword [eax]
mov dword [ebp - 0x770], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x76c], ecx
xor ecx, ecx
mov eax, dword [eax + 8]
mov edi, ecx
push ecx
mov dword [ebp - 0x768], eax
mov ebx, ecx
lea eax, [ebp - 0xdbc]
mov dword [ebp - 0xdb8], ecx
push eax
push ecx
mov dword [ebp - 0xdb4], ecx
mov ecx, esi
push 0x42
mov dword [ebp - 0xdbc], 0xc
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc0b57d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc0b574
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc0b588
mov ebx, 0x80004005
jmp 0xc0b588
mov edi, dword [ebp - 0xdb8]
xor eax, eax
inc eax
and edi, eax
mov dword [ebp - 0x774], edi
test ebx, ebx
js 0xc0bf76
mov edi, dword [ebp - 0xab8]
mov eax, edi
push 0x2a
pop ecx
mov dword [ebp - 0xacc], ecx
sub eax, 1
je 0xc0b5d5
sub eax, 1
je 0xc0b5c9
sub eax, 1
jne 0xc0b5e5
mov ebx, 0xe1
mov dword [ebp - 0xae8], ebx
mov dword [ebp - 0xb1c], ebx
jmp 0xc0b5e5
mov dword [ebp - 0xae8], 0xf
jmp 0xc0b5db
mov dword [ebp - 0xae8], ecx
mov dword [ebp - 0xb1c], 0xb
mov esi, 0xdc
mov dword [ebp - 0xac0], 0x60
push esi
xor ebx, ebx
lea eax, [ebp - 0x720]
push ebx
push eax
call fcn.00bc259b
add esp, 0xc
mov word [ebp - 0x6dc], si
mov esi, dword [0xd08070]
lea eax, [ebp - 0x720]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc0b6ed
movzx ebx, word [ebp - 0x67a]
xor eax, eax
mov ecx, dword [ebp - 0x670]
mov dword [ebp - 0xdac], eax
mov dword [ebp - 0xdb0], eax
mov eax, dword [ebp - 0x674]
push 0x60
mov dword [ebp - 0xaa8], eax
mov dword [ebp - 0xda8], eax
pop eax
mov dword [ebp - 0xac0], ebx
mov dword [ebp - 0xaa4], ecx
mov dword [ebp - 0xda4], ecx
cmp ebx, eax
jae 0xc0b67c
mov dword [ebp - 0xac0], eax
xor ebx, ebx
xor eax, eax
inc eax
cmp edi, eax
mov edi, dword [ebp - 0xc84]
je 0xc0b691
mov edi, dword [ebp - 0xc7c]
push 0x5c
lea eax, [ebp - 0x620]
push ebx
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
xor eax, eax
mov ecx, esi
push 0x403
push eax
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xab4], eax
test eax, eax
jne 0xc0b70a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc0b6dd
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc0b7aa
mov ebx, 0x80004005
jmp 0xc0bf76
mov eax, dword [ebp - 0xda4]
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0xda8]
mov dword [ebp - 0xaa8], eax
jmp 0xc0b67e
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0xac0]
push dword [ebp - 0xae8]
call dword [0xd0cffc]
call esi
push edi
push 0x20
neg eax
mov dword [ebp - 0x610], 0x190
pop edx
lea ecx, [ebp - 0x604]
mov dword [ebp - 0x620], eax
mov byte [ebp - 0x606], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x620]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc0b78b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc0b782
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc0b791
mov ebx, 0x80004005
jmp 0xc0b791
mov dword [ebp - 0x764], eax
push dword [ebp - 0xab4]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xc0bf76
mov edi, dword [ebp - 0xc84]
xor eax, eax
inc eax
cmp dword [ebp - 0xab8], eax
je 0xc0b7c9
mov edi, dword [ebp - 0xc7c]
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0x5c0]
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xab4], eax
test eax, eax
jne 0xc0b827
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc0b819
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0xc0b6e3
push 0x20
pop edi
jmp 0xc0b8c9
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0xac0]
push dword [ebp - 0xb1c]
call dword [0xd0cffc]
call esi
push edi
push 0x20
pop edi
neg eax
mov dword [ebp - 0x5b0], 0x190
mov edx, edi
mov dword [ebp - 0x5c0], eax
lea ecx, [ebp - 0x5a4]
mov byte [ebp - 0x5a6], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x5c0]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc0b8aa
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc0b8a1
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc0b8b0
mov ebx, 0x80004005
jmp 0xc0b8b0
mov dword [ebp - 0x760], eax
push dword [ebp - 0xab4]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xc0bf76
mov ebx, dword [ebp - 0xab8]
xor ecx, ecx
mov eax, ecx
mov edx, ecx
mov ecx, ebx
sub ecx, 1
je 0xc0b8ee
sub ecx, 1
je 0xc0b92e
sub ecx, 1
jne 0xc0b8fa
mov eax, dword [ebp - 0xaa8]
mov edx, dword [ebp - 0xaa4]
mov dword [ebp - 0xc30], eax
mov dword [ebp - 0xc2c], edx
xor ecx, ecx
inc ecx
cmp ebx, ecx
je 0xc0b96e
jbe 0xc0b940
cmp ebx, 3
ja 0xc0b940
xor ebx, ebx
mov edx, ebx
mov dword [ebp - 0xacc], ebx
mov ecx, ebx
mov dword [ebp - 0xaa8], edx
mov dword [ebp - 0xae8], ebx
jmp 0xc0b983
mov eax, dword [ebp - 0xaa8]
push 4
pop ecx
cdq
idiv ecx
xor ecx, ecx
mov edx, ecx
jmp 0xc0b8fa
mov ecx, dword [ebp - 0xc18]
xor ebx, ebx
mov edx, dword [ebp - 0xc18]
mov dword [ebp - 0xae8], ecx
mov ecx, dword [ebp - 0xc18]
mov dword [ebp - 0xacc], ecx
mov ecx, dword [ebp - 0xc18]
mov dword [ebp - 0xaa8], edx
jmp 0xc0b983
xor ebx, ebx
mov dword [ebp - 0xae8], edi
mov ecx, 0x96
mov dword [ebp - 0xaa8], ebx
mov edx, ebx
mov dword [ebp - 0xad4], ecx
push dword [ebp - 0x764]
mov esi, dword [0xd0803c]
sub eax, ecx
push dword [ebp - 0xae4]
mov edi, dword [ebp - 0x770]
sub eax, edx
mov ecx, esi
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0x73c], eax
mov dword [ebp - 0x74c], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov ecx, esi
mov dword [ebp - 0xab4], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x754]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xae4]
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc0b9f9
mov ebx, 0x80004005
mov eax, dword [ebp - 0xab4]
test eax, eax
je 0xc0ba15
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xc0bf76
push dword [ebp - 0x760]
mov esi, dword [0xd0803c]
xor eax, eax
push dword [ebp - 0xae4]
mov edi, dword [ebp - 0x76c]
mov ecx, esi
mov ebx, eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov ecx, esi
mov dword [ebp - 0xab4], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x744]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xae4]
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc0ba7b
mov ebx, 0x80004005
mov eax, dword [ebp - 0xab4]
test eax, eax
je 0xc0ba97
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xc0bf76
mov eax, dword [ebp - 0xab8]
cmp eax, 2
je 0xc0bab7
cmp eax, 3
je 0xc0bab7
mov edi, dword [ebp - 0xac8]
jmp 0xc0bacb
mov edi, dword [ebp - 0x73c]
cmp dword [ebp - 0x74c], edi
jle 0xc0bacb
mov edi, dword [ebp - 0x74c]
cmp dword [ebp - 0x778], 0
mov esi, dword [0xd080a8]
mov ecx, esi
push dword [ebp - 0xacc]
je 0xc0bb1e
mov eax, edi
sub eax, dword [ebp - 0x74c]
add eax, dword [ebp - 0xaa8]
push eax
lea eax, [ebp - 0x754]
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x748]
add eax, dword [ebp - 0xae8]
push eax
mov eax, edi
sub eax, dword [ebp - 0x73c]
add eax, dword [ebp - 0xaa8]
push eax
jmp 0xc0bb42
mov ebx, dword [ebp - 0xad4]
lea eax, [ebp - 0x754]
push ebx
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x748]
add eax, dword [ebp - 0xae8]
push eax
push ebx
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x744]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xab8]
cmp eax, 2
je 0xc0be2b
cmp eax, 3
je 0xc0be2b
xor edx, edx
inc edx
cmp eax, edx
jne 0xc0be4a
xor eax, eax
mov dword [ebp - 0x758], 0xffffff
push 0x5c
push eax
lea eax, [ebp - 0x560]
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xab4], eax
test eax, eax
jne 0xc0bbe1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc0bbd6
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc0bc82
jmp 0xc0b6e3
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0xac0]
push 0xb
call dword [0xd0cffc]
call esi
push dword [ebp - 0xc80]
neg eax
mov dword [ebp - 0x550], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x544]
mov dword [ebp - 0x560], eax
mov byte [ebp - 0x546], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x560]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc0bc63
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xc0bc5a
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xc0bc69
mov ebx, 0x80004005
jmp 0xc0bc69
mov dword [ebp - 0x75c], eax
push dword [ebp - 0xab4]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xc0bf76
push dword [ebp - 0x75c]
mov esi, dword [0xd0803c]
xor eax, eax
push dword [ebp - 0xae4]
mov dword [ebp - 0x72c], edi
mov ecx, esi
mov edi, dword [ebp - 0x768]
mov ebx, eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov ecx, esi
mov dword [ebp - 0xab4], eax
xor eax, eax
push eax
push 0x460
lea eax, [ebp - 0x734]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xae4]
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xc0bcee
mov ebx, 0x80004005
mov eax, dword [ebp - 0xab4]
test eax, eax
je 0xc0bd0a
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xc0bf76
mov eax, dword [ebp - 0x72c]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x72c], eax
cmp eax, ecx
jge 0xc0bd2e
mov dword [ebp - 0x72c], ecx
mov ebx, dword [ebp - 0xac0]
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x60
pop edi
push edi
push ebx
push dword [ebp - 0x734]
mov dword [ebp - 0x728], 0x20
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x730]
mov dword [ebp - 0x734], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x72c]
mov dword [ebp - 0x730], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x728]
mov dword [ebp - 0x72c], eax
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0x778], 0
mov dword [ebp - 0x728], eax
je 0xc0be1b
mov ecx, dword [ebp - 0x754]
cmp ecx, dword [ebp - 0x744]
jl 0xc0bdd6
mov ecx, dword [ebp - 0x744]
mov eax, dword [ebp - 0x738]
add eax, 0x24
push eax
push ecx
jmp 0xc0be02
mov ecx, dword [ebp - 0x73c]
mov eax, dword [ebp - 0x738]
add eax, 0x24
push eax
mov eax, dword [ebp - 0x734]
sub eax, dword [ebp - 0x72c]
add eax, ecx
push eax
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x734]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xc0be47
mov ecx, dword [ebp - 0x74c]
cmp ecx, dword [ebp - 0x73c]
jg 0xc0bde9
jmp 0xc0bde3
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0xc30], edi
mov dword [ebp - 0xc2c], eax
mov dword [ebp - 0x758], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [ebp - 0x778]
lea edi, [ebp - 0xeac]
mov ebx, dword [ebp - 0xc30]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0xc2c]
mov dword [ebp - 0xaa4], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xab8]
sub eax, 1
je 0xc0c18c
sub eax, 1
je 0xc0c0da
sub eax, 1
jne 0xc0bf74
mov esi, dword [0xd080a4]
lea edi, [ebp - 0x420]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08084]
lea ecx, [ebp - 0x420]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x420], 0x28
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc0bf74
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x40c]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x404]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x404]
lea esi, [ebp - 0x40c]
sub eax, ebx
lea edi, [ebp - 0xeac]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc38], eax
mov eax, dword [ebp - 0x400]
sub eax, dword [ebp - 0xaa4]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
jmp 0xc0bf6b
mov eax, dword [ebp - 0x3cc]
sub eax, ebx
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0xc38], eax
mov eax, dword [ebp - 0x3c8]
sub eax, dword [ebp - 0xaa4]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0xc34], eax
xor ebx, ebx
push dword [ebp - 0xae4]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov edi, 0xd0aed4
xor esi, esi
inc esi
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc0bf97
mov eax, dword [0xd0a150]
test eax, eax
jle 0xc0bffc
sub eax, 1
mov dword [0xd0a150], eax
jne 0xc0bffc
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc0bfcb
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc0bfba
push 0x40
xor eax, eax
push eax
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0xd0aed4
inc esi
xor eax, eax
xchg dword [edi], eax
mov eax, dword [ebp - 0xaec]
test eax, eax
je 0xc0c01b
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc0dca4
mov edi, dword [ebp - 0xc38]
xor eax, eax
mov ebx, dword [ebp - 0xc34]
push 0x54
push eax
lea eax, [ebp - 0x7d0]
mov dword [ebp - 0xd88], edi
push eax
mov dword [ebp - 0xd84], ebx
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0xaa4], esi
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push dword [ebp - 0xaac]
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc0c0ba
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x7d0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc0c0ba
push 0x20
pop eax
cmp word [ebp - 0x7be], ax
jne 0xc0c0ba
cmp dword [ebp - 0x7bc], 0
je 0xc0c0ba
cmp dword [ebp - 0x7cc], 0
jle 0xc0c0ba
cmp dword [ebp - 0x7c8], 0
jg 0xc0c19f
xor eax, eax
cmp dword [ebp - 0xab8], 1
mov dword [ebp - 0xaa4], eax
je 0xc0c19f
mov ebx, dword [ebp - 0xab8]
jmp 0xc0c207
mov esi, dword [0xd080a4]
lea edi, [ebp - 0x3e8]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08084]
lea ecx, [ebp - 0x3e8]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x3e8], 0x28
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc0bf74
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x3d4]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x3cc]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xab4], 0
lea esi, [ebp - 0x3d4]
lea edi, [ebp - 0xeac]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0xc0bf48
imul eax, dword [ebp - 0x3cc], 5
cdq
idiv ecx
add eax, dword [ebp - 0x3d4]
jmp 0xc0bf56
xor ebx, ebx
mov dword [ebp - 0xc38], ebx
mov dword [ebp - 0xc34], ebx
jmp 0xc0bf76
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x754]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x744]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ebx, dword [ebp - 0xab8]
cmp ebx, 1
jne 0xc0c207
mov eax, dword [ebp - 0x774]
mov esi, dword [0xd08014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xb50], eax
mov esi, dword [0xd08040]
mov ecx, esi
push 1
push dword [ebp - 0xaac]
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0x778], 0
mov dword [ebp - 0xbf0], eax
mov dword [ebp - 0xb08], 0x810
je 0xc0c242
mov dword [ebp - 0xb08], 0x20812
cmp dword [ebp - 0xaa4], 0
je 0xc0cd62
mov eax, dword [ebp - 0x774]
mov ebx, dword [ebp - 0x770]
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0xab4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x828]
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa38]
push eax
call fcn.00bc259b
add esp, 0xc
lea eax, [ebp - 0x4a4]
xor ecx, ecx
mov dword [ebp - 0xaf0], ecx
mov dword [ebp - 0xabc], ecx
push 0x2c
push ecx
push eax
mov dword [ebp - 0xaa8], ecx
mov dword [ebp - 0xaa4], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x390]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xc0dc84
mov edi, dword [ebp - 0xaac]
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc0c41e
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x828]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc0c338
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0x824]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0xaa4], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov edi, eax
mov dword [ebp - 0xae0], edi
test edi, edi
je 0xc0c41e
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd14], eax
mov dword [ebp - 0xae8], eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0x74c]
add esp, 0xc
sub eax, dword [ebp - 0x754]
xor ecx, ecx
mov esi, dword [0xd0800c]
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp - 0x750]
sub eax, dword [ebp - 0x748]
mov dword [ebp - 0x49c], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x4a4], 0x28
mov word [ebp - 0x498], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x496], ax
lea eax, [ebp - 0xd14]
push eax
push ecx
lea eax, [ebp - 0x4a4]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xb14], eax
test eax, eax
jne 0xc0c429
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xae8], eax
test eax, eax
jle 0xc0c409
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xae8], eax
test eax, eax
js 0xc0c7b3
mov dword [ebp - 0xae8], 0x80004005
jmp 0xc0c7b3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc0dc84
mov esi, dword [0xd08034]
lea ecx, [ebp - 0xa38]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc0c453
mov eax, dword [ebp - 0xa24]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0x74c]
sub eax, dword [ebp - 0x754]
push dword [ebp - 0xb14]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x748]
sub eax, dword [ebp - 0x750]
push edi
mov dword [ebp - 0x384], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
push dword [ebp - 0xab4]
mov esi, dword [0xd0803c]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xad0], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x390]
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xb08]
lea eax, [ebp - 0x390]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push edi
call dword [0xd0cffc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xab8], eax
jne 0xc0c54a
cmp dword [ebp - 0xac8], 0
je 0xc0c53e
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xac0], eax
jmp 0xc0c554
mov dword [ebp - 0xac0], 0xffffff
jmp 0xc0c554
mov dword [ebp - 0xac0], 0xffa8a8a8
mov edi, dword [ebp - 0x754]
xor edx, edx
mov eax, dword [ebp - 0x750]
mov esi, edx
mov dword [ebp - 0xac4], edi
mov ecx, edx
test edi, edi
jns 0xc0c57c
mov esi, edi
mov dword [ebp - 0xac4], edx
neg esi
mov edi, edx
test eax, eax
jns 0xc0c586
mov ecx, eax
mov eax, edx
neg ecx
mov ebx, dword [ebp - 0x388]
mov edx, dword [ebp - 0xaa8]
sub ebx, esi
sub edx, edi
mov dword [ebp - 0xad4], ebx
cmp ebx, edx
jl 0xc0c5a8
mov ebx, edx
mov dword [ebp - 0xad4], edx
mov edi, dword [ebp - 0x384]
mov edx, dword [ebp - 0xaa4]
sub edi, ecx
sub edx, eax
mov dword [ebp - 0xaec], edi
cmp edi, edx
jl 0xc0c5ca
mov edi, edx
mov dword [ebp - 0xaec], edx
test ebx, ebx
jle 0xc0c77b
test edi, edi
jle 0xc0c77b
mov edx, dword [ebp - 0x388]
mov ebx, dword [ebp - 0xaf0]
imul ecx, edx
add ecx, esi
mov esi, dword [ebp - 0xabc]
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0xaa8]
imul eax, esi
mov dword [ebp - 0xb00], ecx
add eax, dword [ebp - 0xac4]
lea eax, [ebx + eax*4]
mov ebx, dword [ebp - 0xad4]
mov dword [ebp - 0xac4], eax
test edi, edi
jle 0xc0c77b
shl edx, 2
shl esi, 2
mov dword [ebp - 0xab4], edx
mov dword [ebp - 0xac8], esi
test ebx, ebx
jle 0xc0c75c
mov esi, eax
mov dword [ebp - 0xabc], ebx
lea edx, [eax + 3]
sub esi, ecx
mov dword [ebp - 0xacc], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xaa4], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc0c71c
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xac0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaa4]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xacc]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xac0]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xabe]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xaa4]
cdq
idiv ecx
mov edx, dword [ebp - 0xacc]
add al, bl
mov ebx, dword [ebp - 0xabc]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xabc], ebx
jne 0xc0c656
mov edi, dword [ebp - 0xaec]
mov ebx, dword [ebp - 0xad4]
mov ecx, dword [ebp - 0xb00]
mov eax, dword [ebp - 0xac4]
mov edx, dword [ebp - 0xab4]
mov esi, dword [ebp - 0xac8]
add ecx, edx
add eax, esi
sub edi, 1
mov dword [ebp - 0xb00], ecx
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xaec], edi
jne 0xc0c632
push dword [ebp - 0xb14]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xad0]
mov edi, dword [ebp - 0xae0]
test eax, eax
je 0xc0c7b3
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xae8], 0
jl 0xc0dc84
mov eax, dword [ebp - 0x774]
mov ebx, dword [ebp - 0x76c]
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0xab4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x880]
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x9e0]
push eax
call fcn.00bc259b
add esp, 0xc
lea eax, [ebp - 0x478]
xor ecx, ecx
mov dword [ebp - 0xaf0], ecx
mov dword [ebp - 0xabc], ecx
push 0x2c
push ecx
push eax
mov dword [ebp - 0xaa8], ecx
mov dword [ebp - 0xaa4], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x380]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xc0dc84
mov edi, dword [ebp - 0xaac]
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc0c41e
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x880]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc0c8ba
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0xaa4], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov edi, eax
mov dword [ebp - 0xad0], edi
test edi, edi
je 0xc0c41e
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd18], eax
mov dword [ebp - 0xae8], eax
lea eax, [ebp - 0x478]
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0x73c]
add esp, 0xc
sub eax, dword [ebp - 0x744]
xor ecx, ecx
mov esi, dword [0xd0800c]
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x740]
sub eax, dword [ebp - 0x738]
mov dword [ebp - 0x470], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x478], 0x28
mov word [ebp - 0x46c], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x46a], ax
lea eax, [ebp - 0xd18]
push eax
push ecx
lea eax, [ebp - 0x478]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xae0], eax
test eax, eax
jne 0xc0c9a0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xae8], eax
test eax, eax
jle 0xc0c98b
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xae8], eax
test eax, eax
js 0xc0cd39
mov dword [ebp - 0xae8], 0x80004005
jmp 0xc0cd39
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x9e0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc0c9ca
mov eax, dword [ebp - 0x9cc]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0x73c]
sub eax, dword [ebp - 0x744]
push dword [ebp - 0xae0]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x738]
sub eax, dword [ebp - 0x740]
push edi
mov dword [ebp - 0x374], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
push dword [ebp - 0xab4]
mov esi, dword [0xd0803c]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xb1c], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x380]
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xb08]
lea eax, [ebp - 0x380]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push edi
call dword [0xd0cffc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xab8], eax
jne 0xc0cac9
cmp dword [ebp - 0xac8], 0
je 0xc0cabd
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov edx, eax
mov dword [ebp - 0xab0], edx
mov dword [ebp - 0xad4], edx
jmp 0xc0cada
mov dword [ebp - 0xad4], 0xffffff
jmp 0xc0cada
mov eax, 0xffa8a8a8
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xad4], eax
mov edi, dword [ebp - 0x744]
xor edx, edx
mov eax, dword [ebp - 0x740]
mov esi, edx
mov dword [ebp - 0xac4], edi
mov ecx, edx
test edi, edi
jns 0xc0cb02
mov esi, edi
mov dword [ebp - 0xac4], edx
neg esi
mov edi, edx
test eax, eax
jns 0xc0cb0c
mov ecx, eax
mov eax, edx
neg ecx
mov ebx, dword [ebp - 0x378]
mov edx, dword [ebp - 0xaa8]
sub ebx, esi
sub edx, edi
mov dword [ebp - 0xaec], ebx
cmp ebx, edx
jl 0xc0cb2e
mov ebx, edx
mov dword [ebp - 0xaec], edx
mov edi, dword [ebp - 0x374]
mov edx, dword [ebp - 0xaa4]
sub edi, ecx
sub edx, eax
mov dword [ebp - 0xb14], edi
cmp edi, edx
jl 0xc0cb50
mov edi, edx
mov dword [ebp - 0xb14], edx
test ebx, ebx
jle 0xc0cd01
test edi, edi
jle 0xc0cd01
mov edx, dword [ebp - 0x378]
mov ebx, dword [ebp - 0xaf0]
imul ecx, edx
add ecx, esi
mov esi, dword [ebp - 0xabc]
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0xaa8]
imul eax, esi
mov dword [ebp - 0xb00], ecx
add eax, dword [ebp - 0xac4]
lea eax, [ebx + eax*4]
mov ebx, dword [ebp - 0xaec]
mov dword [ebp - 0xac4], eax
test edi, edi
jle 0xc0cd01
shl edx, 2
shl esi, 2
mov dword [ebp - 0xab4], edx
mov dword [ebp - 0xac8], esi
test ebx, ebx
jle 0xc0cce2
mov esi, eax
mov dword [ebp - 0xabc], ebx
lea edx, [eax + 3]
sub esi, ecx
mov dword [ebp - 0xac0], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xaa4], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc0cca2
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xab0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaa4]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xac0]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xab0]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac0]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xad2]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac0]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xaa4]
cdq
idiv ecx
mov edx, dword [ebp - 0xac0]
add al, bl
mov ebx, dword [ebp - 0xabc]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xac0], edx
mov dword [ebp - 0xabc], ebx
jne 0xc0cbdc
mov edi, dword [ebp - 0xb14]
mov ebx, dword [ebp - 0xaec]
mov ecx, dword [ebp - 0xb00]
mov eax, dword [ebp - 0xac4]
mov edx, dword [ebp - 0xab4]
mov esi, dword [ebp - 0xac8]
add ecx, edx
add eax, esi
sub edi, 1
mov dword [ebp - 0xb00], ecx
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xb14], edi
jne 0xc0cbb8
push dword [ebp - 0xae0]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xb1c]
mov edi, dword [ebp - 0xad0]
test eax, eax
je 0xc0cd39
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xae8], 0
jl 0xc0dc84
mov edi, dword [ebp - 0xadc]
jmp 0xc0dc30
xor edx, edx
inc edx
cmp dword [ebp - 0x774], 0
jne 0xc0cd76
cmp ebx, edx
je 0xc0cd76
mov al, 0xc0
jmp 0xc0cd78
or al, 0xff
mov byte [ebp - 0xace], al
lea edi, [ebp - 0xc94]
xor eax, eax
mov esi, dword [0xd08008]
stosd dword es:[edi], eax
xor ecx, ecx
push dword [ebp - 0xaac]
mov byte [ebp - 0xad0], cl
mov byte [ebp - 0xacf], cl
mov ecx, esi
stosd dword es:[edi], eax
mov byte [ebp - 0xacd], dl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xcdc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xadc], eax
test eax, eax
jne 0xc0cdd5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc0dc84
xor eax, eax
inc eax
cmp ebx, eax
jne 0xc0ced2
mov eax, dword [ebp - 0x74c]
mov ecx, dword [ebp - 0x73c]
mov ebx, dword [ebp - 0x754]
sub eax, ebx
mov edi, dword [ebp - 0x744]
sub ecx, edi
cmp ecx, eax
jle 0xc0ce0a
mov edx, ecx
mov dword [ebp - 0xb0c], edx
jmp 0xc0ce12
mov edx, eax
mov dword [ebp - 0xb0c], eax
mov esi, dword [ebp - 0x738]
sub esi, dword [ebp - 0x750]
cmp dword [ebp - 0x778], 0
mov dword [ebp - 0xb24], esi
je 0xc0ce4b
sub ebx, dword [ebp - 0x74c]
sub edi, dword [ebp - 0x73c]
add ebx, edx
add edi, edx
mov dword [ebp - 0xc94], ebx
mov dword [ebp - 0xcdc], edi
jmp 0xc0ce57
mov ebx, dword [ebp - 0xc94]
mov edi, dword [ebp - 0xcdc]
add eax, ebx
mov dword [ebp - 0xaa8], ebx
mov ebx, dword [ebp - 0x740]
sub ebx, dword [ebp - 0x750]
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0xc8c], eax
mov eax, dword [ebp - 0x748]
sub eax, dword [ebp - 0x750]
mov dword [ebp - 0xb14], ebx
mov dword [ebp - 0xcd8], ebx
sub ebx, dword [ebp - 0x740]
mov dword [ebp - 0xa98], edi
add edi, ecx
add ebx, dword [ebp - 0x738]
mov dword [ebp - 0xaec], ebx
mov dword [ebp - 0xcd0], ebx
mov ebx, dword [ebp - 0xb0c]
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xc88], eax
mov dword [ebp - 0xaa0], edi
mov dword [ebp - 0xcd4], edi
jmp 0xc0cf64
mov eax, dword [ebp - 0xc2c]
lea esi, [ebp - 0x754]
lea edi, [ebp - 0xc94]
mov ebx, dword [ebp - 0xc30]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xb24], eax
mov dword [ebp - 0xb0c], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xc88]
lea esi, [ebp - 0x744]
lea edi, [ebp - 0xcdc]
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0xc8c]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0xc94]
mov dword [ebp - 0xaa8], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xcd0]
mov esi, dword [ebp - 0xb24]
mov dword [ebp - 0xaec], eax
mov eax, dword [ebp - 0xcd4]
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0xcd8]
mov dword [ebp - 0xb14], eax
mov eax, dword [ebp - 0xcdc]
mov dword [ebp - 0xa98], eax
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd2c], eax
lea eax, [ebp - 0x44c]
push eax
call fcn.00bc259b
mov edi, dword [ebp - 0xadc]
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x44c], 0x28
inc eax
mov dword [ebp - 0x448], ebx
mov word [ebp - 0x440], ax
xor ecx, ecx
push 0x20
pop eax
push ecx
push ecx
mov word [ebp - 0x43e], ax
neg esi
lea eax, [ebp - 0xd2c]
mov dword [ebp - 0x444], esi
mov esi, dword [0xd0800c]
push eax
push ecx
lea eax, [ebp - 0x44c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xad8], eax
test eax, eax
jne 0xc0cfe9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc0dc6f
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xab8], eax
jne 0xc0d05a
mov ecx, dword [ebp - 0xb50]
test ecx, ecx
je 0xc0d05a
mov esi, dword [0xd08074]
lea edi, [ebp - 0x39c]
xor eax, eax
stosd dword es:[edi], eax
push ecx
mov ecx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0x394], eax
lea eax, [ebp - 0x3a0]
push eax
mov eax, dword [ebp - 0xadc]
push eax
mov dword [ebp - 0x398], ebx
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x774]
mov ebx, dword [ebp - 0x770]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0xab4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x930]
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x988]
push eax
call fcn.00bc259b
add esp, 0xc
lea eax, [ebp - 0x4fc]
xor ecx, ecx
mov dword [ebp - 0xaf0], ecx
mov dword [ebp - 0xac4], ecx
push 0x2c
push ecx
push eax
mov dword [ebp - 0xb1c], ecx
mov dword [ebp - 0xaa4], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x360]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xadc]
test ebx, ebx
je 0xc0dc54
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc0d231
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x930]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc0d143
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0x92c]
mov dword [ebp - 0xb1c], eax
mov eax, dword [ebp - 0x928]
mov dword [ebp - 0xaa4], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, eax
mov dword [ebp - 0xae4], esi
test esi, esi
je 0xc0d231
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd30], eax
mov dword [ebp - 0xa9c], eax
lea eax, [ebp - 0x4fc]
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0xae8]
add esp, 0xc
mov edi, dword [ebp - 0xaa8]
xor ecx, ecx
sub eax, edi
mov dword [ebp - 0x4fc], 0x28
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0x4f8], eax
mov eax, dword [ebp - 0xc90]
sub eax, dword [ebp - 0xad4]
mov dword [ebp - 0x4f4], eax
xor eax, eax
push 0x20
inc eax
mov word [ebp - 0x4f0], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x4ee], ax
lea eax, [ebp - 0xd30]
push eax
push ecx
lea eax, [ebp - 0x4fc]
push eax
push esi
mov esi, dword [0xd0800c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xac8], eax
test eax, eax
jne 0xc0d23c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xa9c], eax
test eax, eax
jle 0xc0d21c
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xa9c], eax
test eax, eax
js 0xc0d5e2
mov dword [ebp - 0xa9c], 0x80004005
jmp 0xc0d5e2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xc0dc54
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x988]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc0d266
mov eax, dword [ebp - 0x974]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0xae8]
push dword [ebp - 0xac8]
mov esi, dword [0xd0803c]
mov ecx, esi
push dword [ebp - 0xae4]
mov dword [ebp - 0x358], eax
mov eax, dword [ebp - 0xad4]
sub eax, dword [ebp - 0xc90]
mov dword [ebp - 0x354], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xae4]
call dword [0xd0cffc]
call esi
push dword [ebp - 0xab4]
mov esi, dword [0xd0803c]
mov ecx, esi
push dword [ebp - 0xae4]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xab4], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x360]
push eax
push dword [ebp - 0xae4]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xb08]
lea eax, [ebp - 0x360]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push dword [ebp - 0xae4]
call dword [0xd0cffc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xab8], eax
jne 0xc0d370
cmp dword [ebp - 0xabc], 0
je 0xc0d364
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xac0], eax
jmp 0xc0d37a
mov dword [ebp - 0xac0], 0xffffff
jmp 0xc0d37a
mov dword [ebp - 0xac0], 0xffa8a8a8
xor edx, edx
mov dword [ebp - 0xabc], edx
mov eax, edx
mov esi, edx
test edi, edi
jns 0xc0d396
mov eax, edi
mov edi, edx
neg eax
mov dword [ebp - 0xabc], eax
mov ecx, dword [ebp - 0xc90]
test ecx, ecx
jns 0xc0d3a6
mov esi, ecx
mov ecx, edx
neg esi
mov ebx, dword [ebp - 0x358]
sub ebx, eax
mov eax, dword [ebp - 0xb1c]
sub eax, edi
mov dword [ebp - 0xb00], ebx
cmp ebx, eax
jl 0xc0d3c8
mov ebx, eax
mov dword [ebp - 0xb00], eax
mov eax, dword [ebp - 0xaa4]
mov edx, dword [ebp - 0x354]
sub eax, ecx
sub edx, esi
mov dword [ebp - 0xaa8], edx
cmp edx, eax
jl 0xc0d3ea
mov edx, eax
mov dword [ebp - 0xaa8], eax
test ebx, ebx
jle 0xc0d5ab
test edx, edx
jle 0xc0d5ab
mov eax, dword [ebp - 0x358]
imul ecx, dword [ebp - 0xb1c]
imul eax, esi
mov esi, dword [ebp - 0xac4]
add ecx, edi
add eax, dword [ebp - 0xabc]
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xaf0]
mov dword [ebp - 0xad4], eax
lea ecx, [esi + ecx*4]
mov dword [ebp - 0xae0], ecx
test edx, edx
jle 0xc0d5ab
mov esi, dword [ebp - 0x358]
shl esi, 2
mov dword [ebp - 0xac4], esi
mov esi, dword [ebp - 0xb1c]
shl esi, 2
mov dword [ebp - 0xaf0], esi
mov esi, dword [ebp - 0xac4]
mov edi, dword [ebp - 0xaf0]
test ebx, ebx
jle 0xc0d58c
mov esi, ecx
mov dword [ebp - 0xabc], ebx
lea edx, [ecx + 3]
sub esi, eax
mov dword [ebp - 0xacc], edx
lea edi, [eax + 2]
mov dword [ebp - 0xaa4], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc0d54c
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xac0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaa4]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xacc]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xac0]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xabe]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xaa4]
cdq
idiv ecx
mov edx, dword [ebp - 0xacc]
add al, bl
mov ebx, dword [ebp - 0xabc]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xabc], ebx
jne 0xc0d486
mov edx, dword [ebp - 0xaa8]
mov ebx, dword [ebp - 0xb00]
mov eax, dword [ebp - 0xad4]
mov ecx, dword [ebp - 0xae0]
mov esi, dword [ebp - 0xac4]
mov edi, dword [ebp - 0xaf0]
add eax, esi
add ecx, edi
sub edx, 1
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xae0], ecx
mov dword [ebp - 0xaa8], edx
jne 0xc0d462
push dword [ebp - 0xac8]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xab4]
test eax, eax
je 0xc0d5e2
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push dword [ebp - 0xae4]
call dword [0xd0cffc]
call esi
push dword [ebp - 0xae4]
mov esi, dword [0xd08018]
mov ecx, esi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xa9c], 0
jl 0xc0dc4e
mov eax, dword [ebp - 0x774]
mov ebx, dword [ebp - 0x76c]
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0xab4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x8d8]
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa90]
push eax
call fcn.00bc259b
add esp, 0xc
lea eax, [ebp - 0x4d0]
xor ecx, ecx
mov dword [ebp - 0xac4], ecx
mov dword [ebp - 0xabc], ecx
push 0x2c
push ecx
push eax
mov dword [ebp - 0xae8], ecx
mov dword [ebp - 0xac8], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x370]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xadc]
test ebx, ebx
je 0xc0dc54
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc0d231
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x8d8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc0d6ee
mov eax, dword [ebp - 0x8c4]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0xac8], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, eax
mov dword [ebp - 0xacc], esi
test esi, esi
je 0xc0d231
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd38], eax
mov dword [ebp - 0xb1c], eax
lea eax, [ebp - 0x4d0]
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0xaa0]
add esp, 0xc
sub eax, dword [ebp - 0xa98]
xor ecx, ecx
mov edi, dword [ebp - 0xb14]
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0x4cc], eax
mov eax, edi
sub eax, dword [ebp - 0xaec]
mov dword [ebp - 0x4c8], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x4d0], 0x28
mov word [ebp - 0x4c4], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x4c2], ax
lea eax, [ebp - 0xd38]
push eax
push ecx
lea eax, [ebp - 0x4d0]
push eax
push esi
mov esi, dword [0xd0800c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xae0], eax
test eax, eax
jne 0xc0d7e2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xb1c], eax
test eax, eax
jle 0xc0d7c7
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb1c], eax
test eax, eax
mov edi, dword [ebp - 0xacc]
js 0xc0db89
mov dword [ebp - 0xb1c], 0x80004005
jmp 0xc0db89
mov esi, dword [0xd08034]
lea ecx, [ebp - 0xa90]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xc0d80c
mov eax, dword [ebp - 0xa7c]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0xaa0]
push dword [ebp - 0xae0]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0xaec]
sub eax, edi
mov edi, dword [ebp - 0xacc]
push edi
mov dword [ebp - 0x364], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
push dword [ebp - 0xab4]
mov esi, dword [0xd0803c]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xab4], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x370]
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xb08]
lea eax, [ebp - 0x370]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push edi
call dword [0xd0cffc]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xab8], eax
jne 0xc0d907
cmp dword [ebp - 0xaa4], 0
je 0xc0d8fb
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov ecx, eax
mov dword [ebp - 0xab0], ecx
mov dword [ebp - 0xaa8], ecx
jmp 0xc0d918
mov dword [ebp - 0xaa8], 0xffffff
jmp 0xc0d918
mov eax, 0xffa8a8a8
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xaa8], eax
mov edx, dword [ebp - 0xa98]
xor ebx, ebx
mov dword [ebp - 0xaa4], ebx
mov esi, ebx
mov eax, ebx
test edx, edx
jns 0xc0d93a
mov esi, edx
mov edx, ebx
neg esi
mov dword [ebp - 0xaa4], esi
mov ecx, dword [ebp - 0xb14]
test ecx, ecx
jns 0xc0d94a
mov eax, ecx
mov ecx, ebx
neg eax
mov ebx, dword [ebp - 0x368]
sub ebx, esi
mov esi, dword [ebp - 0xae8]
sub esi, edx
mov dword [ebp - 0xad4], ebx
cmp ebx, esi
jl 0xc0d96c
mov ebx, esi
mov dword [ebp - 0xad4], esi
mov edi, dword [ebp - 0x364]
mov esi, dword [ebp - 0xac8]
sub edi, eax
sub esi, ecx
mov dword [ebp - 0xaec], edi
cmp edi, esi
jl 0xc0d98e
mov edi, esi
mov dword [ebp - 0xaec], esi
test ebx, ebx
jle 0xc0db51
test edi, edi
jle 0xc0db51
imul ecx, dword [ebp - 0xae8]
mov esi, dword [ebp - 0x368]
mov ebx, dword [ebp - 0xabc]
imul eax, esi
add ecx, edx
mov edx, dword [ebp - 0xac4]
add eax, dword [ebp - 0xaa4]
lea ecx, [edx + ecx*4]
mov dword [ebp - 0xb00], ecx
lea eax, [ebx + eax*4]
mov ebx, dword [ebp - 0xad4]
mov dword [ebp - 0xaf0], eax
test edi, edi
jle 0xc0db51
mov edx, esi
shl edx, 2
mov dword [ebp - 0xabc], edx
mov edx, dword [ebp - 0xae8]
shl edx, 2
mov dword [ebp - 0xac4], edx
mov edx, dword [ebp - 0xabc]
mov esi, dword [ebp - 0xac4]
test ebx, ebx
jle 0xc0db32
mov esi, ecx
mov dword [ebp - 0xaa4], ebx
lea edx, [ecx + 3]
sub esi, eax
mov dword [ebp - 0xac0], edx
lea edi, [eax + 2]
mov dword [ebp - 0xac8], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xc0daf2
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xab0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac8]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xac0]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xab0]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac0]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xaa6]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac0]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xac8]
cdq
idiv ecx
mov edx, dword [ebp - 0xac0]
add al, bl
mov ebx, dword [ebp - 0xaa4]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xac0], edx
mov dword [ebp - 0xaa4], ebx
jne 0xc0da2c
mov edi, dword [ebp - 0xaec]
mov ebx, dword [ebp - 0xad4]
mov eax, dword [ebp - 0xaf0]
mov ecx, dword [ebp - 0xb00]
mov edx, dword [ebp - 0xabc]
mov esi, dword [ebp - 0xac4]
add eax, edx
add ecx, esi
sub edi, 1
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0xb00], ecx
mov dword [ebp - 0xaec], edi
jne 0xc0da08
push dword [ebp - 0xae0]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xab4]
mov edi, dword [ebp - 0xacc]
test eax, eax
je 0xc0db89
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xb1c], 0
mov edi, dword [ebp - 0xadc]
jl 0xc0dc54
xor eax, eax
inc eax
cmp dword [ebp - 0xab8], eax
jne 0xc0dbf3
mov esi, dword [section..data]
xor eax, eax
push 0xcc0020
push eax
push eax
mov eax, dword [ebp - 0xb0c]
mov ecx, esi
push edi
push dword [ebp - 0xb24]
push eax
push dword [ebp - 0x750]
push dword [ebp - 0x754]
push dword [ebp - 0xaac]
call dword [0xd0cffc]
call esi
jmp 0xc0dc30
push dword [ebp - 0xad0]
mov ecx, dword [ebp - 0xb24]
xor edx, edx
mov eax, dword [ebp - 0xb0c]
mov esi, dword [0xd08020]
push ecx
push eax
push edx
push edx
push edi
push ecx
push eax
push dword [ebp - 0xc34]
mov ecx, esi
push dword [ebp - 0xc38]
push dword [ebp - 0xaac]
call dword [0xd0cffc]
call esi
push dword [ebp - 0xbf0]
mov esi, dword [0xd08040]
mov ecx, esi
push dword [ebp - 0xaac]
call dword [0xd0cffc]
call esi
jmp 0xc0dc54
mov edi, dword [ebp - 0xadc]
mov eax, dword [ebp - 0xad8]
test eax, eax
je 0xc0dc6f
mov esi, dword [0xd0801c]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
test edi, edi
je 0xc0dc84
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xb50]
test eax, eax
je 0xc0dc9f
mov esi, dword [0xd0801c]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov edi, 0xd0aed4
mov ebx, dword [ebp - 0x770]
xor edx, edx
test ebx, ebx
je 0xc0dcf7
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0xc0dcb3
mov eax, dword [ebp - 0x770]
sub ebx, ecx
sar ebx, 1
lea ebx, [ebx*2 + 2]
test ebx, ebx
je 0xc0dcdb
mov byte [eax], dl
inc eax
sub ebx, 1
jne 0xc0dcd3
push dword [ebp - 0x770]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0x770], edx
mov ebx, dword [ebp - 0x76c]
test ebx, ebx
je 0xc0dd4a
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0xc0dd04
mov eax, dword [ebp - 0x76c]
sub ebx, ecx
sar ebx, 1
lea ebx, [ebx*2 + 2]
test ebx, ebx
je 0xc0dd2c
mov byte [eax], dl
inc eax
sub ebx, 1
jne 0xc0dd24
push dword [ebp - 0x76c]
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x76c], ebx
jmp 0xc0dd4c
xor ebx, ebx
mov edx, dword [ebp - 0x768]
test edx, edx
je 0xc0dd98
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xc0dd5b
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xc0dd83
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0xc0dd75
mov edx, dword [ebp - 0x768]
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x768], ebx
cmp dword [ebp - 0x764], 0
je 0xc0ddbd
push dword [ebp - 0x764]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x764], ebx
cmp dword [ebp - 0x760], 0
je 0xc0dde2
push dword [ebp - 0x760]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x760], ebx
cmp dword [ebp - 0x75c], 0
je 0xc0de07
push dword [ebp - 0x75c]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x75c], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc0de09
mov eax, dword [0xd0a150]
push 0
pop ebx
test eax, eax
jle 0xc0de6b
sub eax, 1
mov dword [0xd0a150], eax
jne 0xc0de6b
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc0de3f
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc0de2e
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xd0aed4
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0xd09360]
mov esi, dword [0xd0804c]
mov ecx, esi
mov dword [ebp - 0xabc], eax
call dword [0xd0cffc]
call esi
sub eax, dword [0xd09358]
lea edi, [ebp - 0x2e8]
push 8
mov dword [ebp - 0xaa4], eax
mov esi, 0xd0aed4
xor eax, eax
xor ebx, ebx
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xc0deaa
mov eax, dword [0xd0a150]
push 0
pop ebx
test eax, eax
jne 0xc0e49e
push 0x338
mov esi, ebx
mov dword [ebp - 0xaa8], ebx
push ebx
mov dword [ebp - 0xa9c], ebx
mov dword [ebp - 0xab0], esi
mov dword [ebp - 0xc60], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xc64], eax
test eax, eax
je 0xc0e492
or dword [ebp - 0xac8], 0xffffffff
mov edi, ebx
add eax, 7
mov dword [ebp - 0xad8], ebx
mov cl, bl
mov dword [ebp - 0xb64], ebx
mov dword [ebp - 0xb8c], edi
mov dword [ebp - 0xc1c], eax
mov esi, dword [ebp - 0xc14]
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edx, byte [esi + 2]
shl edx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edx, eax
mov dword [ebp - 0xab4], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl edx, 8
mov ebx, 0xab69605e
or edx, eax
movzx eax, byte [esi + 5]
shl edx, 8
add esi, 8
or edx, eax
mov dword [ebp - 0xc14], esi
mov esi, edi
mov dword [ebp - 0xbec], edx
xor esi, edx
xor esi, dword [ebp - 0xb64]
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor edi, edx
lea eax, [edi + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, edi
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor edi, edx
mov eax, edi
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, ebx
sub eax, edx
xor edi, eax
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor edi, edx
lea eax, [edi + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, ebx
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, edi
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edi, eax
mov dword [ebp - 0xbf0], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0xbf0]
xor edi, ebx
mov eax, edi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, edi
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov ebx, edi
xor ebx, esi
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor edi, eax
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, edi
ror eax, 6
sub edx, eax
xor ebx, edx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add edx, eax
xor edi, edx
lea eax, [edi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, edi
ror eax, 0xe
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, edi
xor edi, dword [ebp - 0xac8]
rol eax, 2
mov dword [ebp - 0xb64], edi
xor edx, eax
xor edx, dword [ebp - 0xad8]
xor ebx, edx
mov edx, dword [ebp - 0xc1c]
mov dword [ebp - 0xb8c], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb64]
ror dword [ebp - 0xb8c], 8
mov byte [edx], al
mov al, byte [ebp - 0xb8c]
ror dword [ebp - 0xb64], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb64]
ror dword [ebp - 0xb8c], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb8c]
ror dword [ebp - 0xb64], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb64]
ror dword [ebp - 0xb8c], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xb8c]
ror dword [ebp - 0xb64], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xb64]
mov byte [edx - 3], al
add edx, 8
mov edi, dword [ebp - 0xb8c]
mov eax, dword [ebp - 0xab4]
ror dword [ebp - 0xb64], 8
ror edi, 8
sub dword [ebp - 0xc28], 1
mov dword [ebp - 0xad8], eax
mov eax, dword [ebp - 0xbec]
mov dword [ebp - 0xb8c], edi
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xc1c], edx
jne 0xc0df28
mov esi, dword [ebp - 0xc64]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xc0e265
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xc0e298
cmp edx, dword [0xb2c22c]
jne 0xc0e298
mov ebx, dword [ebp - 0xc60]
mov edi, esi
xor eax, eax
mov dword [ebp - 0xab0], edi
mov esi, eax
jmp 0xc0e2ac
or dword [ebp - 0xbdc], 0xffffffff
mov ebx, 0xc004d501
mov edi, dword [ebp - 0xab0]
xor eax, eax
test esi, esi
je 0xc0e2bf
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc0e48c
mov eax, dword [ebp - 0xbdc]
xor ecx, ecx
push 0x40
push ecx
mov ebx, 0xd0ae80
mov esi, edi
push ebx
mov byte [eax + edi], cl
call fcn.00bc259b
add esp, 0xc
cmp byte [edi], 0
je 0xc0e422
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbf8]
jne 0xc0e2f7
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc0e485
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa9c], edx
cmp word [eax], cx
jne 0xc0e36d
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xc0e36d
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xc0e36d
cmp dword [ecx], 0x4550
jne 0xc0e36d
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xbc4]
je 0xc0e37a
cmp ax, word [ebp - 0xbc0]
je 0xc0e37a
mov edx, 0xc000000d
jmp 0xc0e372
mov edx, 0xc000007b
mov dword [ebp - 0xa9c], edx
jmp 0xc0e38c
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xbec], eax
test eax, eax
je 0xc0e416
mov ecx, esi
mov dword [ebp - 0xab4], esi
xor eax, eax
mov dword [ebp - 0xaf4], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xbf0], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xc0e3b6
sub ecx, dword [ebp - 0xbf0]
inc esi
add esi, ecx
test edx, edx
js 0xc0e400
mov ecx, dword [ebp - 0xab4]
lea eax, [ebp - 0xaf4]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa9c], edx
test edx, edx
js 0xc0e422
mov eax, dword [ebp - 0xaa8]
mov ecx, dword [ebp - 0xaf4]
mov dword [eax*4 + section..data], ecx
jmp 0xc0e406
mov eax, dword [ebp - 0xaa8]
inc eax
inc ebx
mov dword [ebp - 0xaa8], eax
cmp ebx, dword [ebp - 0xbec]
jb 0xc0e39d
add edi, 0x10
cmp byte [esi], 0
jne 0xc0e2f0
mov ebx, dword [ebp - 0xa9c]
mov esi, dword [ebp - 0xab0]
test esi, esi
je 0xc0e443
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xc0e499
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc0e45c
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc0e44b
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xc0e4a6
mov ebx, 0xc000007a
jmp 0xc0e428
mov esi, dword [ebp - 0xab0]
mov ebx, 0xc000007a
jmp 0xc0e42e
mov eax, dword [0xd0a150]
inc eax
xor ebx, ebx
mov dword [0xd0a150], eax
xor eax, eax
mov edi, 0xd0aed4
xchg dword [edi], eax
mov eax, dword [ebp - 0xaa4]
xor ecx, ecx
mov esi, dword [0xd08068]
inc ecx
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0x2cc], eax
lea eax, [ebp - 0x2e8]
push eax
push 4
pop eax
push eax
push 0x2021
mov dword [ebp - 0x2e8], ecx
mov dword [ebp - 0x2e0], ecx
mov dword [ebp - 0x2d4], ecx
mov dword [ebp - 0x2d8], ecx
mov dword [ebp - 0x2d0], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x2dc], 0x9966f291
call dword [0xd0cffc]
call esi
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xc0e515
mov eax, dword [0xd0a150]
push 0
pop ebx
test eax, eax
jle 0xc0e577
sub eax, 1
mov dword [0xd0a150], eax
jne 0xc0e577
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xc0e54b
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xc0e53a
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xd0aed4
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xaac]
mov esi, dword [0xd080b0]
mov ecx, esi
push ebx
call dword [0xd0cffc]
call esi
jmp 0xc0e596
xor ebx, ebx
mov eax, ebx
mov dword [ebp - 0xaac], ebx
mov dword [ebp - 0xac8], eax
lea edi, [ebp - 0xcf4]
xor eax, eax
mov dword [ebp - 0xeb4], ebx
stosd dword es:[edi], eax
mov esi, ebx
mov dword [ebp - 0xaa0], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xbf0], ebx
test ebx, ebx
je 0xc10679
push edi
push 0xd08d58
push ebx
call fcn.00bc13d0
add esp, 0xc
mov dword [ebp - 0xaac], ebx
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xc10687
mov ecx, dword [0xd08d50]
mov dword [esi], ecx
mov ecx, dword [0xd08d54]
mov dword [esi + 4], ecx
mov dword [ebp - 0xaa0], esi
rdtsc
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xbec], edx
xor eax, eax
mov dword [ebp - 0xb6c], eax
lea eax, [ebp - 0xd3c]
push eax
push 4
pop edi
mov edx, edi
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xc10687
mov edx, dword [ebp - 0xd3c]
lea eax, [ebp - 0xb6c]
push eax
xor ecx, ecx
call fcn.00b84e9a
or eax, 0x10000000
jl 0xc10687
lea eax, [ebp - 0xd40]
mov edx, 0xa0
push eax
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xc10687
mov edx, dword [ebp - 0xd40]
lea eax, [ebp - 0xb6c]
mov ecx, dword [ebp - 0xb6c]
push eax
call fcn.00b84e9a
or eax, 0x10000000
jl 0xc10687
lea eax, [ebp - 0xd44]
mov ecx, edi
push eax
push 8
pop edx
call fcn.00b84e9a
test eax, eax
js 0xc10687
mov edx, dword [ebp - 0xd44]
lea eax, [ebp - 0xb6c]
mov ecx, dword [ebp - 0xb6c]
push eax
call fcn.00b84e9a
or eax, 0x10000000
jl 0xc10687
lea eax, [ebp - 0xc74]
mov ecx, edi
push eax
push 8
pop edx
call fcn.00b84e9a
test eax, eax
js 0xc10687
mov edx, dword [ebp - 0xc74]
lea eax, [ebp - 0xb6c]
mov ecx, dword [ebp - 0xb6c]
push eax
call fcn.00b84e9a
or eax, 0x10000000
jl 0xc10687
mov edi, dword [ebp - 0xb6c]
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xc14], ebx
test ebx, ebx
je 0xc10681
mov dword [ebp - 0xac8], eax
lea eax, [ebp - 0xe70]
mov ecx, ebx
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc10681
lea ecx, [ebx + edi]
lea eax, [ebx + 8]
cmp eax, ecx
ja 0xc10681
mov eax, dword [ebp - 0xe70]
push 4
pop ecx
mov dword [ebx], ecx
mov dword [eax], ecx
mov edi, ebx
xor eax, eax
mov dword [ebp - 0xbe8], edi
mov dword [ebp - 0xaf4], eax
mov edx, dword [edi]
lea eax, [ebp - 0xc58]
push eax
call fcn.00b84e9a
test eax, eax
js 0xc10681
mov edx, dword [ebp - 0xc58]
lea eax, [ebp - 0xbe8]
push eax
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xc10681
mov eax, dword [ebp - 0xaf4]
xor ecx, ecx
inc eax
inc ecx
mov dword [ebp - 0xaf4], eax
cmp eax, ecx
jae 0xc0e7f2
mov edi, dword [ebp - 0xbe8]
push 4
pop ecx
jmp 0xc0e7a1
mov ecx, dword [ebp - 0xbe8]
lea eax, [ebp - 0xe78]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc10681
mov edx, dword [ebp - 0xb6c]
lea eax, [ecx + 0xa4]
add edx, ebx
cmp eax, edx
ja 0xc10681
mov eax, 0xa0
push eax
push dword [ebp - 0xbf0]
mov dword [ecx], eax
push dword [ebp - 0xe78]
call fcn.00bc13d0
add esp, 0xc
mov edi, ebx
xor eax, eax
mov dword [ebp - 0xb18], edi
mov dword [ebp - 0xaf4], eax
mov edx, dword [edi]
lea eax, [ebp - 0xc68]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
test eax, eax
js 0xc10681
mov edx, dword [ebp - 0xc68]
lea eax, [ebp - 0xb18]
push eax
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xc10681
mov eax, dword [ebp - 0xaf4]
inc eax
mov dword [ebp - 0xaf4], eax
cmp eax, 2
jae 0xc0e8a4
mov edi, dword [ebp - 0xb18]
jmp 0xc0e853
mov ecx, dword [ebp - 0xb18]
lea eax, [ebp - 0xe80]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc10681
mov edi, dword [ebp - 0xb6c]
lea eax, [ecx + 0xc]
add edi, ebx
cmp eax, edi
ja 0xc10681
mov dword [ecx], 8
mov ecx, dword [ebp - 0xe80]
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
xor eax, eax
mov dword [ebp - 0xb04], ebx
mov esi, eax
mov edx, dword [ebx]
lea eax, [ebp - 0xc6c]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
test eax, eax
js 0xc10681
mov edx, dword [ebp - 0xc6c]
lea eax, [ebp - 0xb04]
push eax
mov ecx, ebx
call fcn.00b84e9a
test eax, eax
js 0xc10681
inc esi
cmp esi, 3
jae 0xc0e93b
mov ebx, dword [ebp - 0xb04]
jmp 0xc0e8f6
mov ecx, dword [ebp - 0xb04]
lea eax, [ebp - 0xe88]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc10681
lea eax, [ecx + 0xc]
cmp eax, edi
ja 0xc10681
mov eax, dword [ebp - 0xe88]
push 8
pop ebx
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xab4]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xbec]
mov dword [eax + 4], ecx
lea eax, [ebp - 0xbf4]
push eax
push 4
pop edi
mov edx, edi
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xc10681
mov esi, dword [ebp - 0xbf4]
lea eax, [ebp - 0xb74]
push eax
mov edx, ebx
mov dword [ebp - 0xb9c], esi
call fcn.00b84e9a
test eax, eax
js 0xc10681
mov edx, dword [ebp - 0xb74]
lea eax, [ebp - 0xb9c]
push eax
mov ecx, esi
call fcn.00b84e9a
test eax, eax
js 0xc10681
xor ecx, ecx
rdtsc
mov edi, ecx
mov dword [ebp - 0xad4], ecx
mov ebx, ecx
mov dword [ebp - 0xb70], edi
mov dword [ebp - 0xb84], ebx
mov dword [ebp - 0xa9c], ecx
mov dword [ebp - 0xad8], ecx
mov dword [ebp - 0xbc4], ecx
mov dword [ebp - 0xaf8], ecx
mov dword [ebp - 0xbe4], ecx
mov dword [ebp - 0xad0], ecx
mov dword [ebp - 0xaa8], ecx
mov dword [ebp - 0xb74], eax
mov dword [ebp - 0xbf4], edx
push 8
pop ecx
mov dword [ebp - 0xcc8], ecx
mov edx, dword [ebp - 0xb6c]
lea eax, [ebp - 0xcc8]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0eb3e
mov eax, dword [ebp - 0xcc8]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0xaf4], ecx
cmp ecx, eax
jae 0xc0ea6f
mov esi, 0xc0000095
jmp 0xc0eb3e
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc0ea91
mov esi, 0xc0000017
mov edi, ebx
jmp 0xc0eb3e
push 4
pop ecx
lea eax, [ebp - 0xbbc]
mov dword [edi], ecx
mov edx, ecx
mov dword [ebp - 0xbbc], edi
push eax
mov ecx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0eb23
mov ecx, dword [ebp - 0xbbc]
mov eax, dword [ebp - 0xb6c]
mov dword [ecx], eax
lea eax, [ebp - 0xbbc]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0eb23
mov eax, dword [ebp - 0xaf4]
push dword [ebp - 0xb6c]
mov ecx, dword [ebp - 0xb74]
push dword [ebp - 0xc14]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0xbf4]
push dword [ebp - 0xbbc]
mov dword [edi + eax - 4], ecx
call fcn.00bc13d0
mov eax, dword [ebp - 0xaf4]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xad4], edi
mov edi, ecx
mov dword [ebp - 0xb70], eax
jmp 0xc0eb25
xor ecx, ecx
test edi, edi
je 0xc0eb38
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xb70]
or esi, 0x10000000
jl 0xc10488
mov esi, dword [ebp - 0xad4]
xor ecx, ecx
mov dword [ebp - 0xbe8], ecx
test esi, esi
jne 0xc0eb66
mov esi, 0xc000000d
jmp 0xc0f2b1
test edi, edi
je 0xc0f2ac
lea eax, [edi + 8]
push eax
push ecx
mov dword [ebp - 0xbdc], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xc28], eax
test eax, eax
je 0xc0f2ac
xor ecx, ecx
mov dl, cl
test edi, edi
je 0xc0eba4
xor dl, byte [ecx + esi]
inc ecx
cmp ecx, edi
jb 0xc0eb9c
mov dword [ebp - 0xb04], esi
or ecx, 0xffffffff
mov esi, eax
mov dword [ebp - 0xb48], ecx
xor eax, eax
mov dword [ebp - 0xb94], esi
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xb44], eax
xor eax, eax
mov dword [ebp - 0xacc], eax
mov dword [ebp - 0xac0], eax
je 0xc0ecda
xor esi, esi
mov dword [ebp - 0xac0], eax
mov ecx, eax
mov dword [ebp - 0xaf4], eax
mov dword [ebp - 0xacc], ecx
jbe 0xc0ec5a
mov ebx, dword [ebp - 0xb04]
mov edi, eax
push 0x38
pop esi
push 4
pop ecx
cmp eax, ecx
movzx eax, byte [ebx]
jge 0xc0ec19
lea ecx, [esi - 0x20]
shl eax, cl
mov ecx, dword [ebp - 0xacc]
or edi, eax
jmp 0xc0ec2b
mov ecx, esi
shl eax, cl
mov ecx, dword [ebp - 0xacc]
or ecx, eax
mov dword [ebp - 0xacc], ecx
mov eax, dword [ebp - 0xaf4]
sub esi, 8
inc eax
inc ebx
mov dword [ebp - 0xaf4], eax
test eax, eax
js 0xc0ec00
mov dword [ebp - 0xac0], edi
xor esi, esi
mov edi, dword [ebp - 0xb70]
mov dword [ebp - 0xb04], ebx
mov ebx, dword [ebp - 0xb84]
mov eax, dword [ebp - 0xac0]
xor ecx, 0x42f6b18d
xor eax, 0xb17a307a
cmp dword [ebp - 0xbf8], 0
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xb44], eax
jbe 0xc0ecb5
mov ebx, dword [ebp - 0xb94]
cmp esi, 4
jge 0xc0ec92
rol eax, 8
mov byte [ebx], al
jmp 0xc0ec97
rol ecx, 8
mov byte [ebx], cl
inc ebx
add esi, 1
js 0xc0ec86
mov eax, dword [ebp - 0xb44]
mov dword [ebp - 0xb94], ebx
mov ebx, dword [ebp - 0xb84]
mov dword [ebp - 0xb20], eax
push 0xfffffffffffffffc
xor eax, eax
pop esi
mov ecx, eax
mov dword [ebp - 0xb48], ecx
test esi, esi
jg 0xc0ecd4
jns 0xc0ecd4
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xb44], eax
mov esi, dword [ebp - 0xb94]
mov eax, edi
shr eax, 3
mov dword [ebp - 0xaf4], eax
test eax, eax
je 0xc0f0d0
mov ebx, dword [ebp - 0xb04]
lea eax, [esi + 7]
mov dword [ebp - 0xb18], eax
add ebx, 2
movzx edi, byte [ebx - 2]
movzx eax, byte [ebx - 1]
movzx esi, byte [ebx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [ebx]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 3]
or esi, eax
movzx eax, byte [ebx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [ebx + 5]
add ebx, 8
shl esi, 8
or esi, eax
mov dword [ebp - 0xb74], ebx
xor ecx, esi
mov dword [ebp - 0xa98], ecx
lea ebx, [ecx - 0x4a58]
mov ecx, 0xc81ecb17
xor ebx, edi
xor ebx, dword [ebp - 0xb20]
xor ebx, ecx
mov eax, ebx
xor eax, ecx
ror eax, 0xf
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 7
add ecx, eax
mov eax, dword [ebp - 0xa98]
xor eax, ecx
mov dword [ebp - 0xa98], eax
add eax, 0xb1b54a58
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa98]
ror eax, 0xa
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0xcb17
rol eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
rol eax, 5
add ecx, eax
mov eax, dword [ebp - 0xa98]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xa98], eax
xor ecx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, ecx
xor ebx, eax
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 6
sub ecx, eax
sub ecx, 0x339b6838
xor dword [ebp - 0xa98], ecx
mov ecx, dword [ebp - 0xa98]
mov eax, ecx
ror eax, 0xf
xor eax, 0xcb17
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, 0xc81e
imul eax, eax, 0xcb17
xor ecx, eax
mov dword [ebp - 0xa98], ecx
lea eax, [ecx + 0x37e0ea91]
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0xc81e
ror ecx, 0xa
imul eax, eax, 0xb1b5
xor ecx, eax
mov eax, dword [ebp - 0xa98]
xor eax, ecx
mov dword [ebp - 0xa98], eax
xor eax, 0x4a58
rol eax, 6
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa98]
ror eax, 3
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa98]
mov eax, ebx
ror eax, 0xf
sub eax, 0xc81e
imul eax, eax, 0x4a58
xor ecx, eax
mov dword [ebp - 0xa98], ecx
xor ecx, 0xc81e
mov eax, dword [ebp - 0xa98]
shr eax, 1
imul ecx, ecx, 0x4a58
xor ecx, eax
mov eax, dword [ebp - 0xa98]
add eax, 0xffff34e9
xor ebx, ecx
rol eax, 3
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xa98]
shr eax, 0xf
xor ecx, eax
xor ebx, ecx
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 0xd
sub ecx, eax
mov eax, 0xb1b54a58
add ecx, 0x730581bd
xor dword [ebp - 0xa98], ecx
sub eax, dword [ebp - 0xa98]
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa98]
ror eax, 0xb
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa98]
lea eax, [ebx + 0x4e49ed8a]
xor ecx, eax
mov dword [ebp - 0xa98], ecx
mov eax, dword [ebp - 0xa98]
xor eax, 0xb1b5
ror ecx, 7
imul eax, eax, 0x4a58
sub eax, ecx
xor ebx, eax
mov eax, ebx
xor eax, 0xc81e
rol eax, 4
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0x10
sub ecx, eax
mov eax, 0xb1b54a58
xor dword [ebp - 0xa98], ecx
sub eax, dword [ebp - 0xa98]
ror eax, 0xa
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa98]
ror eax, 4
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x4e4ab5a8]
ror eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
ror eax, 9
xor ecx, eax
mov eax, dword [ebp - 0xa98]
xor eax, ecx
mov dword [ebp - 0xa98], eax
xor eax, 0xc81ecb17
rol eax, 8
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xa98]
rol eax, 2
sub ecx, eax
mov eax, 0xc81ecb17
xor ebx, ecx
sub eax, ebx
ror eax, 0xb
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0xc
sub ecx, eax
mov eax, dword [ebp - 0xa98]
xor eax, ecx
mov dword [ebp - 0xa98], eax
xor eax, 0xb1b5
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa98]
shr eax, 8
xor ecx, eax
xor ebx, ecx
mov eax, ebx
xor ebx, dword [ebp - 0xac0]
xor eax, dword [ebp - 0xacc]
xor eax, dword [ebp - 0xa98]
xor eax, 0x79ab814f
mov dword [ebp - 0xb44], ebx
mov dword [ebp - 0xb48], eax
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0xac0], edi
mov dword [ebp - 0xacc], esi
mov byte [eax - 4], bl
mov al, byte [ebp - 0xb48]
mov ebx, dword [ebp - 0xb18]
ror dword [ebp - 0xb44], 8
mov byte [ebx], al
mov al, byte [ebp - 0xb44]
ror dword [ebp - 0xb48], 8
mov byte [ebx - 5], al
mov al, byte [ebp - 0xb48]
ror dword [ebp - 0xb44], 8
mov byte [ebx - 1], al
mov al, byte [ebp - 0xb44]
ror dword [ebp - 0xb48], 8
mov byte [ebx - 6], al
mov al, byte [ebp - 0xb48]
ror dword [ebp - 0xb44], 8
mov byte [ebx - 2], al
ror dword [ebp - 0xb48], 8
mov al, byte [ebp - 0xb44]
mov byte [ebx - 7], al
mov al, byte [ebp - 0xb48]
mov byte [ebx - 3], al
add ebx, 8
mov eax, dword [ebp - 0xb44]
mov ecx, dword [ebp - 0xb48]
ror eax, 8
ror ecx, 8
sub dword [ebp - 0xaf4], 1
mov dword [ebp - 0xb18], ebx
mov ebx, dword [ebp - 0xb74]
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xb44], eax
mov dword [ebp - 0xb48], ecx
jne 0xc0ecff
mov ebx, dword [ebp - 0xb84]
mov edi, dword [ebp - 0xb70]
mov esi, dword [ebp - 0xc28]
movzx eax, dl
cdq
mov dword [esi + edi], eax
mov dword [esi + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc0f102
mov esi, 0xc0000017
jmp 0xc0f212
mov eax, dword [ebp - 0xbdc]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc0f186
mov dword [edi + 4], eax
push dword [ebp - 0xbdc]
push esi
push eax
call fcn.00bc13d0
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
pop esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc0f186
mov dword [edi + 0xc], eax
push 0xa0
push 0xd08ca8
push eax
call fcn.00bc13d0
add esp, 0xc
mov dword [edi + 0x10], esi
push esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0xc0f18f
mov esi, 0xc0000017
jmp 0xc0f1ab
mov esi, 0xc0000017
xor edx, edx
jmp 0xc0f1ab
mov dword [edi + 0x14], ecx
mov esi, edx
mov eax, dword [0xd08d48]
mov dword [ecx], eax
mov eax, dword [0xd08d4c]
mov dword [ebp - 0xbe8], edi
mov edi, edx
mov dword [ecx + 4], eax
test edi, edi
je 0xc0f212
cmp dword [edi + 4], 0
je 0xc0f1cb
push dword [edi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 4], edx
cmp dword [edi + 0xc], 0
je 0xc0f1e7
push dword [edi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0xc], edx
cmp dword [edi + 0x14], 0
je 0xc0f203
push dword [edi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0x14], edx
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
test esi, esi
js 0xc0f228
mov ebx, dword [ebp - 0xbe8]
mov edi, eax
mov dword [ebp - 0xb84], ebx
jmp 0xc0f22e
mov edi, dword [ebp - 0xbe8]
push dword [ebp - 0xc28]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xc0f2b1
xor eax, eax
cmp dword [edi + 4], eax
je 0xc0f263
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc0f27f
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc0f29b
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc0f2b1
mov esi, 0xc0000001
or esi, 0x10000000
jl 0xc10482
mov edx, dword [ebx]
lea eax, [ebp - 0xba8]
push 4
pop edi
push eax
mov ecx, edi
mov dword [ebp - 0xba8], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0f34c
mov ecx, dword [ebp - 0xba8]
lea eax, [ebp - 0xba8]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0f34c
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xba8]
mov ecx, dword [ebp - 0xba8]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0f34c
mov ecx, dword [ebp - 0xba8]
lea eax, [ebp - 0xba8]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0f34c
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xba8]
mov ecx, dword [ebp - 0xba8]
push eax
call fcn.00b84e9a
mov esi, eax
mov eax, dword [ebp - 0xba8]
test esi, esi
jns 0xc0f352
mov eax, dword [ebp - 0xe3c]
mov dword [ebp - 0xaf4], eax
test esi, esi
js 0xc0f4ab
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc0f380
mov esi, 0xc0000017
jmp 0xc0f4ab
mov eax, dword [ebx]
mov ecx, edi
mov dword [edi], eax
lea eax, [ebp - 0xafc]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xafc], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0f496
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0xafc]
call fcn.00bc13d0
mov edx, dword [ebx]
lea eax, [ebp - 0xafc]
mov ecx, dword [ebp - 0xafc]
add esp, 0xc
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0f496
mov ecx, dword [ebp - 0xafc]
mov eax, dword [ebx + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xafc]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0f496
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0xafc]
call fcn.00bc13d0
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xafc]
mov ecx, dword [ebp - 0xafc]
add esp, 0xc
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0f496
mov ecx, dword [ebp - 0xafc]
mov eax, dword [ebx + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xafc]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0f496
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0xafc]
call fcn.00bc13d0
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xafc]
mov ecx, dword [ebp - 0xafc]
add esp, 0xc
push eax
call fcn.00b84e9a
mov esi, eax
xor ecx, ecx
test esi, esi
js 0xc0f498
mov eax, dword [ebp - 0xaf4]
mov dword [ebp - 0xa9c], edi
mov edi, ecx
mov dword [ebp - 0xad8], eax
jmp 0xc0f498
xor ecx, ecx
test edi, edi
je 0xc0f4ab
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xc10482
xor eax, eax
mov dword [ebp - 0xcb0], 8
mov dword [ebp - 0xaf4], eax
mov dword [ebp - 0xb04], eax
mov edx, dword [ebp - 0xb9c]
lea eax, [ebp - 0xcb0]
push eax
push 8
pop ecx
call fcn.00b84e9a
mov esi, eax
or esi, 0x10000000
jl 0xc0f6fa
mov eax, dword [ebp - 0xcb0]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xc0f509
mov esi, 0xc0000095
jmp 0xc0f52a
mov dword [ebp - 0xca4], ecx
lea eax, [ebp - 0xca4]
push eax
push 8
pop edx
call fcn.00b84e9a
mov esi, eax
mov eax, dword [ebp - 0xca4]
test esi, esi
jns 0xc0f530
mov eax, dword [ebp - 0xd5c]
mov dword [ebp - 0xb18], eax
test esi, esi
js 0xc0f6fa
mov ebx, dword [ebp - 0xc14]
xor eax, eax
mov ecx, ebx
mov edi, eax
mov dword [ebp - 0xbfc], ecx
mov eax, dword [ecx]
mov dword [ebp - 0xb74], eax
lea eax, [ebp - 0xbfc]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0f6fa
mov edx, dword [ebp - 0xb74]
lea eax, [ebp - 0xbfc]
mov ecx, dword [ebp - 0xbfc]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0f6fa
mov ecx, dword [ebp - 0xbfc]
xor eax, eax
inc edi
inc eax
cmp edi, eax
jb 0xc0f550
mov edi, dword [ecx]
lea eax, [ebp - 0xbfc]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0f6fa
mov dword [ebp - 0xaf4], edi
xor eax, eax
mov dword [ebp - 0xb20], ebx
mov edi, eax
lea eax, [ebp - 0xb20]
mov ecx, ebx
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0f632
mov edx, dword [ebx]
lea eax, [ebp - 0xb20]
mov ecx, dword [ebp - 0xb20]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0f632
inc edi
cmp edi, 2
jae 0xc0f611
mov ebx, dword [ebp - 0xb20]
jmp 0xc0f5d0
mov ecx, dword [ebp - 0xb20]
lea eax, [ebp - 0xb20]
push eax
push 4
pop eax
mov edi, dword [ecx]
mov edx, eax
call fcn.00b84e9a
mov esi, eax
mov ebx, edi
test esi, esi
jns 0xc0f640
mov ebx, dword [ebp - 0xb04]
test esi, esi
js 0xc0f6fa
mov edx, dword [ebp - 0xb18]
lea eax, [ebp - 0xba4]
push 4
pop edi
push eax
mov ecx, edi
mov dword [ebp - 0xba4], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0f6d5
mov ecx, dword [ebp - 0xba4]
lea eax, [ebp - 0xba4]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0f6d5
mov edx, dword [ebp - 0xaf4]
lea eax, [ebp - 0xba4]
mov ecx, dword [ebp - 0xba4]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0f6d5
mov ecx, dword [ebp - 0xba4]
lea eax, [ebp - 0xba4]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0f6d5
mov ecx, dword [ebp - 0xba4]
lea eax, [ebp - 0xba4]
push eax
mov edx, ebx
call fcn.00b84e9a
mov esi, eax
mov eax, dword [ebp - 0xba4]
test esi, esi
jns 0xc0f6df
mov eax, dword [ebp - 0xe40]
test esi, esi
js 0xc0f6fa
cmp eax, 0x400000
jbe 0xc0f6f0
mov esi, 0x8000ffff
jmp 0xc10482
mov edi, eax
mov dword [ebp - 0xaf8], edi
jmp 0xc0f700
mov edi, dword [ebp - 0xaf8]
test esi, esi
js 0xc10482
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc0f729
mov ecx, dword [ebp - 0xbc4]
mov esi, 0xd0000017
jmp 0xc0f736
mov ecx, eax
mov dword [ebp - 0xbc4], eax
mov esi, 0x10000000
mov ebx, dword [ebp - 0xa9c]
test esi, esi
js 0xc10488
test ebx, ebx
je 0xc0f7de
test ecx, ecx
je 0xc0f7de
mov eax, dword [ebp - 0xad8]
mov dword [ebp - 0xe14], eax
xor eax, eax
mov dword [ebp - 0xe0c], eax
lea eax, [ebp - 0xd60]
push eax
xor eax, eax
mov dword [ebp - 0xe1c], ebx
push 0xb2be98
inc eax
mov dword [ebp - 0xe18], ecx
push eax
mov dword [ebp - 0xe10], edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc0f7e8
push 0xb2be7c
push dword [ebp - 0xd60]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xc0f7e8
xor eax, eax
mov ecx, esi
push eax
push 0x14
lea eax, [ebp - 0xe1c]
push eax
push 0x86
call dword [0xd0cffc]
call esi
mov esi, eax
or esi, 0x10000000
jl 0xc0f806
mov edi, dword [ebp - 0xe10]
mov dword [ebp - 0xaf8], edi
jmp 0xc0f806
mov esi, 0x80070057
jmp 0xc10488
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc0f7ff
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc0f806
mov esi, 0x80004005
cmp esi, 0xd0000023
jne 0xc0f818
mov esi, 0x8007007a
jmp 0xc10488
test esi, esi
js 0xc10488
mov eax, dword [ebp - 0xbc4]
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0xb34], ecx
mov ebx, ecx
mov dword [ebp - 0xba0], eax
cmp edi, edx
jae 0xc0f847
mov esi, 0xc000003e
jmp 0xc0fc22
mov edi, dword [eax]
lea ecx, [ebp - 0xba0]
push ecx
mov ecx, eax
mov dword [ebp - 0xb74], edi
call fcn.00b84e9a
mov esi, eax
xor ecx, ecx
test esi, esi
js 0xc0fc22
lea eax, [ebp - 0xb34]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0fc20
mov eax, dword [ebp - 0xaf8]
sub eax, dword [ebp - 0xb34]
cmp eax, edi
jb 0xc0fa68
mov eax, dword [ebp - 0xba0]
lea ecx, [ebp - 0xba0]
push ecx
mov edx, edi
mov dword [ebp - 0xb9c], eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0fc20
mov ecx, dword [ebp - 0xb34]
lea eax, [ebp - 0xb34]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0fc20
mov eax, dword [ebp - 0xaf8]
sub eax, dword [ebp - 0xb34]
push 4
pop edx
cmp eax, edx
jb 0xc0fa68
mov ecx, dword [ebp - 0xba0]
lea eax, [ebp - 0xba0]
push eax
mov edi, dword [ecx]
mov dword [ebp - 0xbf4], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0fc20
mov ecx, dword [ebp - 0xb34]
lea eax, [ebp - 0xb34]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0fc20
mov eax, dword [ebp - 0xaf8]
sub eax, dword [ebp - 0xb34]
cmp eax, edi
jb 0xc0fa68
mov eax, dword [ebp - 0xba0]
lea ecx, [ebp - 0xba0]
push ecx
mov edx, edi
mov dword [ebp - 0xaf4], eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0fc20
mov ecx, dword [ebp - 0xb34]
lea eax, [ebp - 0xb34]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0fc20
mov eax, dword [ebp - 0xaf8]
sub eax, dword [ebp - 0xb34]
push 4
pop edx
cmp eax, edx
jb 0xc0fa68
mov ecx, dword [ebp - 0xba0]
mov eax, dword [ecx]
mov dword [ebp - 0xb04], eax
lea eax, [ebp - 0xba0]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0fc20
mov ecx, dword [ebp - 0xb34]
lea eax, [ebp - 0xb34]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0fc20
mov eax, dword [ebp - 0xaf8]
sub eax, dword [ebp - 0xb34]
mov ecx, dword [ebp - 0xb04]
cmp eax, ecx
jb 0xc0fa68
lea eax, [ebp - 0xb34]
mov edx, ecx
mov ecx, dword [ebp - 0xb34]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0fc20
mov ecx, dword [ebp - 0xaf8]
mov eax, ecx
sub eax, dword [ebp - 0xb34]
jne 0xc0fa68
mov eax, dword [ebp - 0xb04]
mov esi, dword [ebp - 0xb74]
add eax, 0xc
add eax, edi
add eax, esi
cmp eax, ecx
jne 0xc0fa68
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc0fa72
mov esi, 0xc0000017
jmp 0xc0fbab
mov esi, 0xc000003e
jmp 0xc0fc20
cmp dword [ebp - 0xb9c], ebx
je 0xc0fab3
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc0faa7
mov dword [edi + 4], eax
push esi
push dword [ebp - 0xb9c]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xc0faba
mov esi, 0xc0000017
xor eax, eax
jmp 0xc0fb44
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
cmp dword [ebp - 0xaf4], ebx
je 0xc0faf6
mov esi, dword [ebp - 0xbf4]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc0faa7
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xaf4]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xc0fafc
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
cmp dword [ebp - 0xba0], ebx
je 0xc0fb38
mov esi, dword [ebp - 0xb04]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc0faa7
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xba0]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xc0fb3e
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov ebx, edi
mov esi, eax
mov edi, eax
test edi, edi
je 0xc0fbab
cmp dword [edi + 4], 0
je 0xc0fb64
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc0fb80
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc0fb9c
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test esi, esi
js 0xc0fbb9
mov dword [ebp - 0xbe4], ebx
mov ebx, ecx
test ebx, ebx
je 0xc0fc22
cmp dword [ebx + 4], 0
je 0xc0fbd9
push dword [ebx + 4]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 4], ecx
cmp dword [ebx + 0xc], 0
je 0xc0fbf5
push dword [ebx + 0xc]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 0xc], ecx
cmp dword [ebx + 0x14], 0
je 0xc0fc11
push dword [ebx + 0x14]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 0x14], ecx
push ebx
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
or esi, 0x10000000
jl 0xc10482
mov eax, dword [ebp - 0xbe4]
mov ebx, ecx
mov dword [ebp - 0xc58], ebx
mov dword [ebp - 0xc74], ecx
test eax, eax
je 0xc0fcf5
mov esi, dword [eax + 4]
mov dword [ebp - 0xc6c], esi
test esi, esi
je 0xc0fcf5
mov edi, dword [eax]
test edi, edi
je 0xc0fcf5
add edi, 0xfffffff8
mov dword [ebp - 0xc68], ecx
push edi
push ecx
mov dword [ebp - 0xbc0], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xbdc], eax
test eax, eax
je 0xc101ea
xor ecx, ecx
mov ebx, esi
mov dl, cl
mov dword [ebp - 0xaf4], ebx
mov esi, edi
mov ecx, eax
mov dword [ebp - 0xb04], ecx
and esi, 7
je 0xc1018c
xor eax, eax
xor edi, edi
mov dword [ebp - 0xb3c], eax
or eax, 0xffffffff
mov dword [ebp - 0xb2c], eax
xor eax, eax
mov dword [ebp - 0xc00], edi
mov dword [ebp - 0xbbc], eax
mov dword [ebp - 0xb9c], eax
test esi, esi
je 0xc0fd34
push 0x38
pop ecx
cmp eax, 4
movzx eax, byte [ebx]
jge 0xc0fcff
add ecx, 0xffffffe0
shl eax, cl
mov ecx, dword [ebp - 0xbb4]
or edi, eax
jmp 0xc0fd07
mov esi, 0xd000000d
jmp 0xc10206
shl eax, cl
or dword [ebp - 0xc00], eax
mov eax, dword [ebp - 0xb9c]
sub ecx, 8
inc eax
mov dword [ebp - 0xbb4], ecx
inc ebx
mov dword [ebp - 0xb9c], eax
cmp eax, esi
jl 0xc0fcde
mov ecx, dword [ebp - 0xb04]
mov dword [ebp - 0xbbc], edi
mov dword [ebp - 0xaf4], ebx
mov eax, dword [ebp - 0xc00]
mov ebx, edi
xor ebx, 0x92f65a5
xor eax, 0x699a899c
xor edi, edi
mov dword [ebp - 0xb3c], ebx
mov dword [ebp - 0xb2c], eax
test esi, esi
je 0xc0fd82
cmp edi, 4
jge 0xc0fd65
rol ebx, 8
mov byte [ecx], bl
jmp 0xc0fd6a
rol eax, 8
mov byte [ecx], al
inc edi
inc ecx
cmp edi, esi
jl 0xc0fd59
mov ebx, dword [ebp - 0xb3c]
mov eax, dword [ebp - 0xb2c]
mov dword [ebp - 0xb04], ecx
lea edi, [esi - 4]
test edi, edi
jle 0xc10164
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xb18], eax
mov esi, eax
mov dword [ebp - 0xb2c], eax
mov edi, dword [ebp - 0xbc0]
mov eax, edi
shr eax, 3
mov dword [ebp - 0xb9c], eax
test eax, eax
je 0xc1012d
mov eax, dword [ebp - 0xb04]
mov edi, dword [ebp - 0xaf4]
add eax, 7
add edi, 2
mov dword [ebp - 0xbb4], eax
mov dword [ebp - 0xb20], edi
movzx ecx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ecx, 8
or ecx, eax
shl edi, 8
mov eax, dword [ebp - 0xb20]
xor ebx, ecx
mov dword [ebp - 0xbf4], ecx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb20]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb20]
shl edi, 8
add dword [ebp - 0xb20], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, ebx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul ecx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub ecx, eax
xor esi, ecx
imul ecx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub ecx, eax
sub ecx, 0x756c8a2
xor ebx, ecx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, 0xab69605e
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0x137f
ror ecx, 6
imul eax, eax, 0xab69
xor ecx, eax
xor esi, ecx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul ecx, eax, 0x605e
mov eax, esi
rol eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub ecx, eax
xor esi, ecx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul ecx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x7f1
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov eax, esi
mov dword [ebp - 0xb18], esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea esi, [ebx - 0x7f1]
xor esi, dword [ebp - 0xb18]
xor esi, 0xab69605e
mov eax, esi
xor eax, 0x7f1
rol eax, 2
imul ecx, eax, 0x137f
mov eax, esi
shr eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 7
add ecx, eax
xor esi, ecx
mov eax, esi
mov ecx, esi
xor eax, 0x137f
ror ecx, 9
imul eax, eax, 0x605e
add ecx, eax
xor ebx, ecx
mov eax, ebx
mov dword [ebp - 0xb74], ebx
xor eax, 0xab69
rol eax, 5
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 7
add ecx, eax
xor esi, ecx
mov ebx, esi
xor ebx, dword [ebp - 0xb74]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor esi, eax
lea eax, [esi - 0x7f1137f]
ror eax, 1
imul ecx, eax, 0x605e
mov eax, esi
ror eax, 6
sub ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add ecx, eax
xor esi, ecx
lea eax, [esi - 0x54969fa2]
rol eax, 0xf
imul ecx, eax, 0x137f
mov eax, esi
ror eax, 0xe
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x605e
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor ecx, eax
xor esi, ecx
mov eax, esi
xor eax, 0x7f1137f
rol eax, 4
imul ecx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xc00]
rol eax, 2
mov dword [ebp - 0xb2c], esi
mov dword [ebp - 0xc00], edi
xor ecx, eax
mov edi, dword [ebp - 0xb20]
xor ecx, dword [ebp - 0xbbc]
xor ebx, ecx
mov ecx, dword [ebp - 0xbb4]
mov dword [ebp - 0xb3c], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xb2c]
ror dword [ebp - 0xb3c], 8
mov byte [ecx], al
mov al, byte [ebp - 0xb3c]
ror dword [ebp - 0xb2c], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb2c]
ror dword [ebp - 0xb3c], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xb3c]
ror dword [ebp - 0xb2c], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xb2c]
ror dword [ebp - 0xb3c], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xb2c], 8
mov al, byte [ebp - 0xb3c]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb2c]
mov byte [ecx - 3], al
add ecx, 8
mov ebx, dword [ebp - 0xb3c]
mov esi, dword [ebp - 0xb2c]
mov eax, dword [ebp - 0xbf4]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xb9c], 1
mov dword [ebp - 0xb3c], ebx
mov dword [ebp - 0xb2c], esi
mov dword [ebp - 0xbbc], eax
mov dword [ebp - 0xbb4], ecx
jne 0xc0fdde
mov edi, dword [ebp - 0xbc0]
mov ecx, dword [ebp - 0xbdc]
xor eax, eax
test edi, edi
je 0xc10141
xor dl, byte [eax + ecx]
inc eax
cmp eax, edi
jb 0xc10139
mov esi, dword [ebp - 0xc6c]
movzx eax, dl
cdq
cmp eax, dword [edi + esi]
jne 0xc101a9
cmp edx, dword [edi + esi + 4]
jne 0xc101a9
mov esi, dword [ebp - 0xc68]
xor eax, eax
mov ebx, ecx
mov ecx, eax
jmp 0xc101bc
xor eax, eax
mov esi, eax
mov dword [ebp - 0xb2c], esi
test edi, edi
jns 0xc0fda7
neg edi
shl edi, 3
mov ecx, edi
shr ebx, cl
shl ebx, cl
mov dword [ebp - 0xb3c], ebx
jmp 0xc0fda7
xor eax, eax
mov esi, eax
mov dword [ebp - 0xbbc], eax
mov ebx, eax
mov dword [ebp - 0xb2c], esi
mov dword [ebp - 0xb3c], ebx
jmp 0xc0fdad
mov ebx, dword [ebp - 0xc58]
mov esi, 0xc004d501
mov edi, dword [ebp - 0xc74]
xor eax, eax
test ecx, ecx
je 0xc101cf
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc101ea
xor ecx, ecx
mov dword [ebp - 0xad0], ebx
mov ebx, ecx
mov dword [ebp - 0xaa8], edi
mov esi, 0x10000000
jmp 0xc101f1
mov esi, 0xd0000001
xor ecx, ecx
test ebx, ebx
je 0xc10206
push ebx
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test esi, esi
js 0xc10482
mov edi, dword [ebp - 0xaa8]
push 4
pop ebx
mov dword [ebp - 0xb94], ecx
mov ecx, dword [ebp - 0xad0]
mov dword [ebp - 0xc40], ecx
cmp edi, ebx
jb 0xc10477
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0xb74], eax
lea eax, [ebp - 0xc40]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc1047c
lea eax, [ebp - 0xb94]
mov edx, ebx
push eax
xor ecx, ecx
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc1047c
mov eax, edi
sub eax, dword [ebp - 0xb94]
cmp eax, ebx
jb 0xc10477
mov ecx, dword [ebp - 0xc40]
lea eax, [ebp - 0xc40]
push eax
push 4
pop eax
mov ebx, dword [ecx]
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc1047c
mov ecx, dword [ebp - 0xb94]
lea eax, [ebp - 0xb94]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc1047c
mov ecx, dword [ebp - 0xb94]
mov eax, edi
sub eax, ecx
cmp eax, ebx
jb 0xc10477
lea eax, [ebp - 0xb94]
mov edx, ebx
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc1047c
mov edi, dword [ebp - 0xc40]
mov edx, dword [ebp - 0xaa8]
mov esi, dword [ebp - 0xad0]
lea ecx, [ebx + edi]
lea eax, [edx + esi]
cmp eax, ecx
jb 0xc10477
sub edx, ebx
sub edx, edi
add edx, esi
cmp edx, 8
jae 0xc10477
xor ecx, ecx
mov dword [ebp - 0xb18], ecx
mov eax, ecx
mov dword [ebp - 0xb04], eax
mov esi, ecx
test edi, edi
je 0xc1040e
lea eax, [ebp - 0xc10]
mov dword [ebp - 0xbb4], edi
push eax
mov edx, ebx
mov ecx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc1047c
mov eax, dword [ebp - 0xc10]
cmp edi, eax
jae 0xc10404
lea eax, [ebp - 0xd64]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc1047c
mov eax, dword [ebp - 0xc10]
cmp dword [ebp - 0xd64], eax
ja 0xc10433
mov edx, dword [ecx]
lea eax, [ebp - 0xd68]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc103b4
mov eax, dword [ebp - 0xd68]
mov dword [ebp - 0xd6c], eax
jmp 0xc103ba
mov eax, dword [ebp - 0xd6c]
test esi, esi
js 0xc1047c
lea ecx, [ebp - 0xc5c]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xbb4]
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc1047c
mov ecx, dword [ebp - 0xc5c]
mov eax, dword [ebp - 0xc10]
mov dword [ebp - 0xbb4], ecx
cmp ecx, eax
ja 0xc10433
inc dword [ebp - 0xb18]
cmp ecx, eax
jb 0xc10360
cmp ecx, eax
jne 0xc10433
mov eax, dword [ebp - 0xb04]
test ebx, ebx
je 0xc1043e
push ebx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb04], eax
test eax, eax
jne 0xc1043a
mov esi, 0xc0000017
jmp 0xc10465
mov esi, 0xc000000d
jmp 0xc1047c
xor ecx, ecx
mov esi, ecx
test edi, edi
je 0xc10453
push ebx
push edi
push eax
call fcn.00bc13d0
mov eax, dword [ebp - 0xb04]
add esp, 0xc
mov dword [ebp - 0xcec], eax
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0xcf4], eax
test esi, esi
js 0xc1047c
mov eax, dword [ebp - 0xb74]
cmp eax, dword [ebp - 0xcf4]
je 0xc1047c
mov esi, 0xc000003e
or esi, 0x10000000
mov ebx, dword [ebp - 0xa9c]
mov eax, dword [ebp - 0xad4]
test eax, eax
je 0xc104a3
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xb84]
test edi, edi
je 0xc10511
xor eax, eax
cmp dword [edi + 4], eax
je 0xc104ca
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc104e6
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc10502
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
je 0xc10528
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc1052a
xor ebx, ebx
mov eax, dword [ebp - 0xbc4]
test eax, eax
je 0xc10543
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ebx, dword [ebp - 0xbe4]
test ebx, ebx
je 0xc105b1
xor eax, eax
cmp dword [ebx + 4], eax
je 0xc1056a
push dword [ebx + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 4], eax
cmp dword [ebx + 0xc], 0
je 0xc10586
push dword [ebx + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0xc], eax
cmp dword [ebx + 0x14], 0
je 0xc105a2
push dword [ebx + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0x14], eax
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xad0]
xor ebx, ebx
test eax, eax
je 0xc105cc
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc10681
mov esi, dword [ebp - 0xcf4]
xor eax, eax
inc eax
cmp esi, eax
jb 0xc10681
mov ecx, dword [ebp - 0xcec]
test ecx, ecx
je 0xc10681
test esi, esi
je 0xc10681
lea eax, [ebp - 0xca0]
mov dword [ebp - 0xca0], ecx
push eax
push 4
pop edi
mov edx, edi
call fcn.00b84e9a
test eax, eax
js 0xc10681
mov eax, dword [ecx]
neg eax
sbb eax, eax
and eax, dword [ebp - 0xca0]
cmp dword [ecx], edi
jne 0xc10681
cmp dword [eax], 0
jl 0xc10681
xor eax, eax
inc eax
cmp esi, eax
jbe 0xc10681
mov dword [ebp - 0xbe0], ecx
mov esi, ebx
mov edi, dword [ecx]
lea eax, [ebp - 0xbe0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc10681
mov ecx, dword [ebp - 0xbe0]
lea eax, [ebp - 0xbe0]
push eax
mov edx, edi
call fcn.00b84e9a
test eax, eax
js 0xc10681
xor eax, eax
inc esi
inc eax
cmp esi, eax
jae 0xc10681
mov ecx, dword [ebp - 0xbe0]
jmp 0xc1063a
mov ebx, dword [ebp - 0xaac]
jmp 0xc1068d
mov ebx, dword [ebp - 0xaac]
mov esi, dword [ebp - 0xaa0]
mov eax, dword [ebp - 0xac8]
test eax, eax
je 0xc106a8
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ecx, dword [ebp - 0xcec]
test ecx, ecx
je 0xc106c3
push ecx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
je 0xc106da
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc106dc
xor ebx, ebx
test esi, esi
je 0xc106ef
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ebx, dword [ebp - 0xa94]
jmp 0xbb3afa
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
jmp 0xbb3b8b
cmp ebx, 0xd0000034
jne 0xc10715
mov ebx, 0xc004f012
jmp 0xc1074e
cmp ebx, 0xd00000e5
je 0xc10734
cmp ebx, 0xc004d501
je 0xc10734
cmp ebx, 0xd000003e
jne 0xc10739
mov ebx, 0xc004f028
jmp 0xc1074e
mov ebx, 0xc004f027
test ebx, ebx
jns 0xbb3b99
cmp ebx, 0x8007007a
jne 0xc1074e
mov ebx, 0xc004f01e
mov esi, dword [ebp - 0xc98]
jmp 0xbb3bb0
xor eax, eax
mov esi, eax
jmp 0xbb3bc3