Function at 0x7ac37460
Capabilities:
Check os version
Enumerate pe sections
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14c
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0
mov eax, dword [eax + 0x2c]
mov esi, dword [ebx + 0x544]
mov dword [ebp - 0x10c], eax
xor eax, eax
test esi, esi
je 0x7ac37ba5
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call fcn.7ac054f0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x544]
test eax, eax
je 0x7ac37b38
lea esi, [esi]
mov edx, eax
mov eax, dword [eax + 4]
test eax, eax
jne 0x7ac374d0
mov dword [ebp - 0xfc], edx
mov ebx, dword [ebp - 0xfc]
lea edi, [ebx - 0x120]
test eax, eax
je 0x7ac37b04
lea esi, [esi]
nop
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax + 8]
test eax, eax
je 0x7ac37e10
lea esi, [esi]
mov edx, eax
mov eax, dword [eax + 4]
test eax, eax
jne 0x7ac37510
mov dword [ebp - 0xfc], edx
mov eax, dword [edi + 0xec]
mov edx, dword [edi + 0xf0]
mov dword [ebp - 0xc8], eax
mov eax, dword [edi + 0xf8]
mov dword [ebp - 0xc4], edx
mov dword [ebp - 0x108], eax
test byte [edi + 0xe8], 1
je 0x7ac379a5
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 0xfc]
lea ebx, [edi - 0xc]
mov dword [edi + 0xf8], 0
sub dword [ecx + 0x3c], eax
mov eax, dword [edi + 0x11c]
mov dword [edi + 0xfc], 0
cmp ebx, eax
je 0x7ac375c6
mov dword [ebp - 0x100], ebx
mov esi, ebx
mov ebx, edi
jmp 0x7ac37597
mov esi, dword [esi + 8]
cmp esi, eax
je 0x7ac375be
cmp dword [esi], 5
jne 0x7ac37590
mov edi, dword [esi + 4]
mov dword [esp], esi
call fcn.7ac0f550
mov dword [esp], esi
mov esi, edi
call fcn.7ac0f690
mov eax, dword [ebx + 0x11c]
mov esi, dword [esi + 8]
cmp esi, eax
jne 0x7ac37597
mov edi, ebx
mov ebx, dword [ebp - 0x100]
mov esi, dword [ebx + 8]
cmp eax, esi
je 0x7ac375f1
lea esi, [esi]
mov edx, dword [esi]
cmp edx, 5
je 0x7ac37d70
mov eax, dword [esi + 8]
cmp edx, 4
je 0x7ac37bb0
mov esi, eax
cmp dword [edi + 0x11c], esi
jne 0x7ac375d0
lea eax, [ebp - 0xcc]
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.7ac14800
mov eax, dword [ebp - 0x9c]
cmp word [eax + 0x4c4], 0
je 0x7ac37fc0
mov eax, dword [edi + 0xe8]
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x100], ecx
and eax, 0xffffffdf
mov dword [edi + 0xe8], eax
lea ebx, [ebp - 0xcc]
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x84], 0
test al, 0x10
je 0x7ac37f10
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x88], 0
mov eax, dword [ebp - 0x9c]
test byte [eax + 4], 1
je 0x7ac376a0
test byte [edi + 7], 0x40
je 0x7ac376a0
test byte [edi + 0xb], 0x40
jne 0x7ac38575
lea esi, [esi]
nop
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x74], 0
mov eax, dword [edi + 4]
test al, 0x40
jne 0x7ac38140
test eax, 0x40000000
je 0x7ac376d0
mov dword [ebp - 0x120], 0
test byte [edi + 0xb], 0x40
jne 0x7ac376e3
mov dword [ebp - 0x120], 0
test ah, 8
jne 0x7ac381d0
mov dword [ebp - 0x118], 0
test ah, 1
je 0x7ac3775c
movzx eax, byte [edi + 0xaa]
cmp al, 4
je 0x7ac3872a
ja 0x7ac37e60
cmp al, 3
jne 0x7ac37738
mov eax, dword [edi + 0xa4]
mov dword [esp + 4], eax
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call fcn.7ac107c0
test eax, eax
cmovs eax, dword [ebp - 0x118]
mov dword [ebp - 0x118], eax
lea esi, [esi]
mov ecx, dword [ebp - 0x9c]
mov eax, dword [ecx + 0x48c]
test eax, eax
je 0x7ac3775c
imul eax, dword [ebp - 0x118]
cdq
idiv dword [ecx + 0x490]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x100]
call fcn.7ac35fe0
mov dword [esp], edi
call fcn.7ac14670
mov esi, eax
mov eax, dword [ebp - 0x64]
test esi, esi
je 0x7ac378ee
mov ebx, dword [sym.imp.ucrtbase.dll__assert]
mov ecx, dword [ebp - 0x78]
mov dword [ebp - 0x104], edi
mov dword [ebp - 0x12c], ebx
test eax, eax
je 0x7ac3788b
lea esi, [esi]
mov dword [esi + 0x20], ecx
mov eax, dword [ebp - 0x74]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x94]
mov dword [esp + 4], esi
mov eax, dword [eax + 0x30]
mov dword [esp], eax
call fcn.7ac2b460
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x7ac37cc8
mov eax, dword [esi + 0x14]
mov edx, dword [ebp - 0x90]
mov ebx, dword [esi + 0xc]
test eax, 0x400000
je 0x7ac37cdf
mov dword [esi + 0x10], 0
mov edi, dword [ebp - 0x70]
test edi, edi
je 0x7ac37c00
test eax, 0x100000
jne 0x7ac378c6
mov edx, eax
and edx, 0x8000
jne 0x7ac378c0
test ah, 0x20
je 0x7ac37856
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov eax, dword [eax + 0xbc]
mov eax, dword [eax]
test ebx, ebx
jle 0x7ac37856
mov edi, dword [ebp - 0x104]
lea ecx, [eax + ecx*2]
jmp 0x7ac3783b
add edx, 1
cmp edx, ebx
je 0x7ac37db0
movzx eax, word [ecx + edx*2]
sub eax, 1
cmp ax, 0x1f
jbe 0x7ac37830
mov dword [ebp - 0x104], edi
test edx, edx
jne 0x7ac38ca3
mov dword [esp], esi
call fcn.7ac2ad70
mov edx, eax
mov eax, dword [ebp - 0x100]
call fcn.7ac36dc0
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x64]
test edx, edx
je 0x7ac37880
cmp esi, eax
je 0x7ac37d98
lea esi, [esi]
mov ecx, dword [ebp - 0x78]
test eax, eax
jne 0x7ac377a0
mov dword [ebp - 0x64], esi
jmp 0x7ac377a0
mov ecx, esi
mov dword [ebp - 0x104], edi
mov esi, dword [ebp - 0x110]
mov eax, dword [ecx + 0x20]
mov edx, dword [ecx + 0x24]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], edx
test byte [esi + 0x15], 0x20
jne 0x7ac37eb0
lea esi, [esi]
nop
mov eax, dword [esi + 0x10]
add dword [ebp - 0x78], eax
mov dword [esp], esi
call fcn.7ac2ad20
mov edx, dword [ebp - 0x64]
mov esi, eax
mov edi, dword [ebp - 0x7c]
mov eax, edx
test edi, edi
je 0x7ac378e4
cmp esi, edx
je 0x7ac37d98
test esi, esi
jne 0x7ac37880
mov edi, dword [ebp - 0x104]
test eax, eax
je 0x7ac37906
mov eax, dword [ebp - 0x68]
mov edx, dword [eax + 0x114]
mov eax, dword [ebp - 0x100]
call fcn.7ac36dc0
mov eax, dword [ebp - 0x94]
mov eax, dword [eax + 0x30]
test byte [eax + 4], 1
je 0x7ac37930
mov eax, dword [ebp - 0x68]
test byte [eax + 7], 0x40
je 0x7ac37930
test byte [eax + 0xb], 0x40
je 0x7ac37930
sub dword [ebp - 0x74], 1
lea esi, [esi]
nop
mov eax, dword [edi + 4]
test eax, 0x40000000
je 0x7ac37940
test byte [edi + 0xb], 0x40
jne 0x7ac37960
test ah, 8
je 0x7ac37960
test byte [edi + 0xba], 8
je 0x7ac37960
mov ecx, dword [ebp - 0x120]
add dword [ebp - 0x74], ecx
lea esi, [esi]
nop
test al, 0x80
jne 0x7ac38120
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp + 8]
and dword [edi + 0xe8], 0xfffffffe
mov dword [edi + 0xf4], eax
mov eax, dword [ebp - 0x7c]
mov ebx, dword [ebp - 0x10c]
mov dword [edi + 0xfc], eax
add dword [ecx + 0x3c], eax
mov eax, dword [edi + 0xf8]
cmp dword [ebp - 0x108], ebx
mov dword [ebp - 0x108], eax
je 0x7ac37c90
mov ebx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x108]
cmp ebx, eax
cmovge eax, ebx
mov ebx, dword [ebp - 0xe0]
mov dword [ebp - 0x10c], eax
test ebx, ebx
je 0x7ac37cb8
lea ecx, [ebp - 0xe0]
lea edx, [ebp - 0xcc]
mov eax, edi
mov dword [ebp - 0xdc], edi
call fcn.7ac36170
mov dword [esp], edi
call fcn.7ac14540
test eax, eax
je 0x7ac37ae0
mov dword [esp], edi
mov ebx, dword [ebp - 0xc8]
call fcn.7ac14540
cmp ebx, dword [eax + 0xec]
je 0x7ac37ab0
mov ebx, dword [ebp - 0xfc]
mov esi, dword [ebp + 8]
jmp 0x7ac37a69
mov dword [esp], edi
mov dword [ebp - 0xdc], eax
call fcn.7ac14540
mov edx, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xc4]
mov dword [eax + 0xec], edx
mov dword [eax + 0xf0], ecx
mov dword [esp], edi
call fcn.7ac14540
lea ecx, [ebp - 0xe0]
lea edx, [ebp - 0xcc]
call fcn.7ac36170
mov dword [esp], edi
call fcn.7ac14540
mov edi, eax
mov dword [esp], edi
call fcn.7ac14540
test eax, eax
je 0x7ac37ae0
lea eax, [edi + 0x120]
cmp ebx, eax
je 0x7ac37aea
mov eax, dword [esi + 8]
mov eax, dword [eax + 4]
add eax, 0xc
cmp edi, eax
je 0x7ac37ae0
mov dword [esp], edi
call fcn.7ac14540
mov edx, dword [ebp - 0xe0]
test edx, edx
jne 0x7ac37a20
mov dword [ebp - 0xe0], eax
jmp 0x7ac37a20
mov dword [esp], edi
mov ebx, dword [ebp - 0xc4]
call fcn.7ac14540
cmp ebx, dword [eax + 0xf0]
jne 0x7ac37a0d
mov dword [esp], edi
call fcn.7ac146f0
test eax, eax
jne 0x7ac37a0d
lea esi, [esi]
mov ecx, dword [ebp - 0xfc]
test ecx, ecx
je 0x7ac37b38
mov ebx, dword [ebp - 0xfc]
mov eax, dword [ebp - 0xfc]
lea edi, [ebx - 0x120]
test eax, eax
jne 0x7ac374f8
mov dword [esp], edi
call fcn.7ac146f0
test eax, eax
je 0x7ac374f8
mov dword [esp], edi
call fcn.7ac2f060
cmp edi, eax
je 0x7ac374f8
mov dword [esp], edi
call fcn.7ac2f060
mov edi, eax
jmp 0x7ac3751f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp - 0x10c]
mov dword [eax + 0x544], 0
mov eax, dword [ebp - 0xb8]
sub eax, dword [ebp - 0xc0]
mov dword [ecx + 0x1c], eax
mov eax, dword [ebp - 0xb4]
sub eax, dword [ebp - 0xbc]
mov dword [ecx + 0x20], eax
mov eax, dword [ecx + 8]
mov eax, dword [eax + 4]
mov eax, dword [eax + 0xfc]
mov dword [ecx + 0x2c], ebx
mov dword [ecx + 0x24], eax
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call fcn.7ac055d0
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xe0]
test ecx, ecx
jne 0x7ac383e8
test eax, eax
setne al
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [eax], 4
jne 0x7ac375e7
lea ebx, [esi + 0xc]
jmp 0x7ac37bde
mov eax, dword [ebp - 0x9c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.7ac2b640
mov eax, dword [esi + 8]
cmp dword [eax], 4
jne 0x7ac375e7
add eax, 0xc
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.7ac2ae40
test eax, eax
jne 0x7ac37bc0
mov esi, dword [esi + 8]
jmp 0x7ac375e9
test eax, 0x200000
jne 0x7ac37e40
mov ecx, dword [ebp - 0x78]
mov edx, dword [ebp - 0x6c]
mov dword [ebp - 0x110], ecx
test edx, edx
je 0x7ac37d40
mov edx, dword [esi + 0x10]
mov edi, edx
mov dword [ebp - 0x124], edx
mov edx, dword [ebp - 0x94]
add edi, ecx
mov dword [ebp - 0x128], edx
mov edx, dword [edx + 4]
mov dword [ebp - 0x11c], edx
mov edx, dword [ebp - 0x80]
sub edi, dword [ebp - 0x11c]
mov dword [ebp - 0x114], edx
cmp edi, dword [ebp - 0x114]
jle 0x7ac37d40
test eax, 0x108000
jne 0x7ac37eb0
test al, 2
je 0x7ac37e90
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x70], 1
cmp eax, esi
jne 0x7ac37791
jmp 0x7ac378c6
cmp eax, ebx
jge 0x7ac379a5
mov dword [esp], ecx
call fcn.7ac14580
mov ebx, dword [ebp - 0xe0]
mov dword [ebp - 0x10c], eax
test ebx, ebx
jne 0x7ac379ca
lea esi, [esi]
mov dword [ebp - 0xe0], edi
jmp 0x7ac379ca
mov eax, dword [esi + 0x14]
mov edx, dword [ebp - 0x88]
mov ebx, dword [esi + 0xc]
test eax, 0x400000
jne 0x7ac377e0
lea eax, [esi + 0x1c]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x18], eax
lea eax, [esi + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x68]
mov dword [esp + 0x10], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x94]
mov dword [esp + 8], esi
mov dword [esp], eax
call fcn.7ac2bf30
mov ebx, dword [esi + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x14]
jmp 0x7ac377e7
mov eax, dword [ebp - 0x70]
test eax, eax
jne 0x7ac38c91
test byte [0x7ac41010], 2
jne 0x7ac38ac3
mov ecx, dword [ebp - 0x78]
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x110], ecx
test ah, 0x30
jne 0x7ac37d4e
test al, 3
je 0x7ac37d51
cmp dword [ebp - 0x64], esi
je 0x7ac37d51
mov dword [ebp - 0x60], esi
mov edx, dword [ebp - 0x110]
add edx, dword [esi + 0x10]
mov dword [esp], esi
mov dword [ebp - 0x78], edx
call fcn.7ac2ad20
mov edx, dword [ebp - 0x64]
mov esi, eax
jmp 0x7ac378d3
mov dword [esp + 8], 0x2cb
mov dword [esp + 4], str..._dlls_riched20_wrap.c
mov dword [esp], str.p__type___diStartRow
call dword [sym.imp.ucrtbase.dll__assert]
mov edx, dword [esi]
jmp 0x7ac375db
mov ebx, dword [ebp - 0x118]
add dword [ebp - 0x74], ebx
jmp 0x7ac378e4
mov dword [ebp - 0x104], edi
mov eax, dword [ebp - 0x100]
mov ecx, ebx
mov edx, esi
mov dword [ebp - 0x70], 0
call fcn.7ac37170
mov ecx, dword [ebp - 0x7c]
mov ebx, eax
test ecx, ecx
je 0x7ac37ec0
mov eax, dword [ebp - 0x90]
test byte [esi + 0x16], 0x40
je 0x7ac37ed0
mov dword [esi + 0x10], 0
mov eax, dword [ebp - 0x100]
mov edx, esi
mov esi, ebx
call fcn.7ac36dc0
mov edx, dword [ebp - 0x64]
jmp 0x7ac378d3
mov eax, dword [ebp - 0xfc]
jmp 0x7ac37e25
cmp edx, dword [eax + 8]
jne 0x7ac37e2d
mov edx, eax
mov eax, dword [eax]
test eax, eax
jne 0x7ac37e20
mov dword [ebp - 0xfc], eax
jmp 0x7ac3751f
mov eax, dword [ebp - 0x100]
mov edx, esi
call fcn.7ac36dc0
mov dword [esp], esi
call fcn.7ac2ad20
mov edx, dword [ebp - 0x64]
mov esi, eax
jmp 0x7ac378d3
cmp al, 5
jne 0x7ac386f0
mov ecx, dword [edi + 0xa4]
mov edx, 0x66666667
mov eax, ecx
sar ecx, 0x1f
imul edx
sar edx, 3
sub edx, ecx
mov dword [ebp - 0x118], edx
jmp 0x7ac37738
mov edx, dword [ebp - 0x114]
cmp dword [ebp - 0x124], edx
jg 0x7ac38168
test al, 1
je 0x7ac38168
lea esi, [esi]
mov dword [ebp - 0x70], 1
jmp 0x7ac3786b
mov eax, dword [ebp - 0x88]
test byte [esi + 0x16], 0x40
jne 0x7ac37de9
lea edx, [esi + 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], edx
lea edx, [esi + 0x18]
mov dword [esp + 0x14], edx
mov eax, dword [esi + 0xc]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x68]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x94]
mov dword [esp], eax
call fcn.7ac2bf30
mov dword [esi + 0x10], eax
jmp 0x7ac37df0
mov ebx, dword [edi + 0xc]
mov dword [esp], edi
call fcn.7ac14710
test eax, eax
je 0x7ac37f2a
mov dword [esp], edi
call fcn.7ac2ef20
add ebx, dword [eax + 0x14]
mov eax, dword [edi + 0x14]
add eax, ebx
mov dword [esp + 4], eax
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call fcn.7ac10760
mov dword [esp + 4], ebx
mov dword [ebp - 0x90], eax
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call fcn.7ac10760
mov dword [ebp - 0x88], eax
cmp word [edi + 8], 0
jne 0x7ac3874d
mov eax, dword [edi + 0x10]
mov dword [esp + 4], eax
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call fcn.7ac10760
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x88]
test eax, eax
jns 0x7ac37f99
mov dword [ebp - 0x88], 0
mov eax, dword [ebp - 0x90]
test eax, eax
jns 0x7ac3767b
mov dword [ebp - 0x90], 0
jmp 0x7ac3767b
mov dword [ebp - 0xe4], 0x400
xor ebx, ebx
mov word [ebp - 0xea], bx
test byte [edi + 6], 1
jne 0x7ac38387
test byte [0x7ac41010], 8
jne 0x7ac383b1
lea eax, [ebp - 0x98]
mov ebx, 0x10
mov dword [ebp - 0x100], eax
mov esi, eax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x104], eax
jmp 0x7ac38042
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x104]
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
mov esi, eax
sub esp, 0x10
test esi, esi
je 0x7ac380e5
lea ecx, [ebp - 0xe8]
mov eax, dword [edi + 0xbc]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ecx
lea ecx, [ebp - 0xea]
mov dword [esp + 0x10], ecx
lea ecx, [ebp - 0xe4]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
mov ecx, dword [eax + 4]
mov dword [esp + 4], ecx
mov eax, dword [eax]
mov dword [esp], eax
call sub.usp10.dll_ScriptItemize
sub esp, 0x1c
cmp eax, 0x8007000e
jne 0x7ac3822d
mov eax, dword [edi + 0xbc]
mov eax, dword [eax + 4]
add eax, 1
cmp ebx, eax
jg 0x7ac388b0
add ebx, ebx
lea eax, [ebx*8]
cmp esi, dword [ebp - 0x100]
jne 0x7ac38010
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov esi, eax
sub esp, 0xc
test esi, esi
jne 0x7ac38042
mov dword [esp + 8], 0
mov eax, dword fs:[0x18]
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov eax, dword [edi + 0xe8]
jmp 0x7ac37632
mov eax, dword [edi + 0xa0]
mov dword [esp + 4], eax
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call fcn.7ac107c0
add eax, dword [ebp - 0x74]
jmp 0x7ac3796b
mov eax, dword [edi + 0x9c]
mov dword [esp + 4], eax
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call fcn.7ac107c0
add dword [ebp - 0x74], eax
mov eax, dword [edi + 4]
jmp 0x7ac376b9
and eax, 0x4000
mov dword [ebp - 0x110], eax
je 0x7ac38414
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
mov eax, dword [eax + 0xbc]
mov eax, dword [eax]
test ebx, ebx
jle 0x7ac381b9
mov edi, dword [ebp - 0x104]
lea edx, [eax + edx*2]
jmp 0x7ac381a5
sub ebx, 1
je 0x7ac381b3
movzx eax, word [edx + ebx*2 - 2]
sub eax, 1
cmp ax, 0x1f
jbe 0x7ac381a0
mov dword [ebp - 0x104], edi
mov eax, dword [ebp - 0x100]
mov ecx, ebx
mov edx, esi
call fcn.7ac37170
jmp 0x7ac3786b
movzx eax, word [edi + 0xba]
mov dword [esp + 4], eax
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call fcn.7ac10820
mov dword [ebp - 0x120], eax
mov ecx, eax
movzx eax, word [edi + 0xba]
test al, 1
je 0x7ac38208
add dword [ebp - 0x88], ecx
add dword [ebp - 0x90], ecx
test al, 2
je 0x7ac38218
mov ecx, dword [ebp - 0x120]
sub dword [ebp - 0x8c], ecx
test al, 4
je 0x7ac38225
mov eax, dword [ebp - 0x120]
add dword [ebp - 0x74], eax
mov eax, dword [edi + 4]
jmp 0x7ac376e3
test eax, eax
js 0x7ac388b0
test byte [0x7ac41010], 8
jne 0x7ac38635
mov dword [esp], edi
call fcn.7ac14670
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x7ac382f6
mov dword [ebp - 0x104], edi
mov edi, eax
jmp 0x7ac38272
mov dword [esp], ebx
call fcn.7ac2ad20
mov ebx, eax
test eax, eax
je 0x7ac382f0
mov ecx, dword [esi + edi*8 + 8]
mov edx, edi
lea eax, [edi + 1]
cmp dword [ebx + 8], ecx
jne 0x7ac38284
mov edi, eax
mov edx, eax
shl edx, 3
lea eax, [esi + edx]
or byte [eax + 5], 0x40
mov eax, dword [eax + 4]
mov dword [ebx + 0x2c], eax
test byte [ebx + 0x16], 0x10
jne 0x7ac382f0
mov eax, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
lea edx, [esi + edx + 8]
add ecx, eax
cmp ecx, dword [edx]
jle 0x7ac38260
mov ecx, dword [ebp - 0x104]
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd8], ecx
mov edx, dword [edx]
sub edx, eax
lea eax, [ebp - 0xd8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xd0], edx
mov dword [esp], eax
call fcn.7ac2b740
mov dword [esp], ebx
call fcn.7ac2ad20
mov ebx, eax
test eax, eax
jne 0x7ac38272
lea esi, [esi]
mov edi, dword [ebp - 0x104]
test byte [0x7ac41010], 8
jne 0x7ac38597
or dword [edi + 0xe8], 0x20
cmp esi, dword [ebp - 0x100]
je 0x7ac38336
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
mov dword [esp], edi
call fcn.7ac14670
mov ebx, eax
test eax, eax
jne 0x7ac38362
jmp 0x7ac3810d
mov dword [esp], ebx
call fcn.7ac2ad20
mov ebx, eax
test eax, eax
je 0x7ac3810d
mov edx, ebx
lea eax, [ebp - 0xcc]
call fcn.7ac36880
test eax, eax
jns 0x7ac38350
mov eax, dword [edi + 0xe8]
and eax, 0xffffffdf
mov dword [edi + 0xe8], eax
jmp 0x7ac37632
test byte [edi + 0xa], 1
je 0x7ac37fdd
movzx eax, byte [ebp - 0xea]
and eax, 0xffffffe0
or eax, 1
mov byte [ebp - 0xea], al
test byte [0x7ac41010], 8
je 0x7ac37fea
movzx eax, byte [ebp - 0xea]
mov dword [esp + 0xc], str.Base_embedding_level__d_n
mov dword [esp + 8], 0x7ac4d45c
and eax, 0x1f
mov dword [esp + 4], 0x7ac41010
mov dword [esp + 0x10], eax
mov dword [esp], 3
call fcn.7ac367b0
jmp 0x7ac37fea
test eax, eax
je 0x7ac38783
mov dword [esp + 4], eax
mov edx, dword [ebp - 0xdc]
mov eax, dword [ebp + 8]
mov dword [esp + 8], edx
mov dword [esp], eax
call fcn.7ac373a0
mov eax, dword [ebp - 0xe0]
jmp 0x7ac37b9d
mov eax, dword [ebp - 0x11c]
add eax, dword [ebp - 0x114]
sub eax, ecx
test ebx, ebx
je 0x7ac38459
test eax, eax
jle 0x7ac38459
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x128]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp], eax
call fcn.7ac2ba00
mov ebx, dword [esi + 0xc]
mov dword [ebp - 0x110], eax
test ebx, ebx
jle 0x7ac3895d
cmp dword [ebp - 0x110], ebx
jge 0x7ac38797
mov ecx, dword [ebp - 0x110]
test ecx, ecx
je 0x7ac3851e
mov eax, dword [esi + 4]
mov edi, dword [esi + 8]
mov eax, dword [eax + 0xbc]
mov dword [ebp - 0x11c], edi
mov eax, dword [eax]
mov dword [ebp - 0x114], eax
jle 0x7ac38c80
lea edx, [eax + edi*2]
mov edi, dword [ebp - 0x104]
jmp 0x7ac384b9
sub ecx, 1
je 0x7ac3897f
movzx eax, word [edx + ecx*2 - 2]
sub eax, 1
cmp ax, 0x1f
ja 0x7ac384b0
mov dword [ebp - 0x104], edi
mov eax, dword [ebp - 0x114]
mov edi, dword [ebp - 0x11c]
lea edx, [eax + edi*2]
mov edi, dword [ebp - 0x104]
jmp 0x7ac384f1
sub ecx, 1
je 0x7ac3898a
movzx eax, word [edx + ecx*2 - 2]
sub eax, 1
cmp ax, 0x1f
jbe 0x7ac384e8
mov eax, dword [ebp - 0x100]
mov edx, esi
mov dword [ebp - 0x104], edi
call fcn.7ac37170
mov ecx, eax
mov eax, dword [esi + 0x10]
add dword [ebp - 0x78], eax
test ecx, ecx
jne 0x7ac38552
test byte [0x7ac41010], 8
jne 0x7ac387d6
mov ecx, dword [ebp - 0x60]
test ecx, ecx
je 0x7ac3886c
mov eax, dword [ecx + 0x14]
test al, 3
jne 0x7ac38546
test ah, 0x10
jne 0x7ac38b81
mov eax, dword [ecx + 0x20]
mov edx, dword [ecx + 0x24]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], edx
mov eax, dword [ebp - 0x64]
mov edx, eax
cmp eax, ecx
je 0x7ac378ad
cmp esi, ecx
je 0x7ac37d1c
mov dword [ebp - 0x70], 1
mov esi, ecx
jmp 0x7ac378e4
mov eax, dword [edi + 0x14]
add eax, eax
mov dword [esp + 4], eax
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call fcn.7ac10760
add dword [ebp - 0x88], eax
jmp 0x7ac376a0
mov dword [esp], 0x7ac41010
call fcn.7ac3cf10
test al, 8
je 0x7ac38303
test byte [0x7ac41010], 8
jne 0x7ac38b58
mov dword [esp], edi
call fcn.7ac14670
mov ebx, eax
test eax, eax
jne 0x7ac385e2
jmp 0x7ac38303
mov dword [esp], ebx
call fcn.7ac2ad20
mov ebx, eax
test eax, eax
je 0x7ac38303
test byte [0x7ac41010], 8
je 0x7ac385d0
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
mov eax, dword [eax + 0xbc]
mov eax, dword [eax]
lea eax, [eax + ecx*2]
call fcn.7ac36500
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 8]
mov dword [esp + 0xc], str._t_d:__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x7ac4d45c
mov dword [esp + 4], 0x7ac41010
mov dword [esp], 3
call fcn.7ac367b0
jmp 0x7ac385d0
mov dword [esp], 0x7ac41010
call fcn.7ac3cf10
test al, 8
je 0x7ac38242
movzx edx, byte [0x7ac41010]
test dl, 8
jne 0x7ac38b15
mov eax, dword [ebp - 0xe8]
test eax, eax
jle 0x7ac388de
xor ecx, ecx
mov dword [ebp - 0x104], esi
mov ebx, esi
mov esi, ecx
jmp 0x7ac3868a
add esi, 1
add ebx, 8
cmp esi, dword [ebp - 0xe8]
jge 0x7ac388d0
mov eax, edx
and eax, 8
je 0x7ac38678
movzx eax, byte [ebx + 6]
and eax, 0x1f
mov dword [esp + 0x1c], eax
movzx eax, byte [ebx + 5]
shr al, 2
and eax, 1
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 8]
sub eax, 1
mov dword [esp + 0x14], eax
mov eax, dword [ebx]
mov dword [esp + 0xc], str._t_d____d_RTL__d_bidi_level__d_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x7ac4d45c
mov dword [esp + 4], 0x7ac41010
mov dword [esp], 3
call fcn.7ac367b0
movzx edx, byte [0x7ac41010]
mov eax, edx
and eax, 8
jmp 0x7ac38678
test byte [0x7ac41010], 1
je 0x7ac37738
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Unsupported_spacing_rule_value__d_n
mov dword [esp + 8], str.ME_GetParaLineSpace
mov dword [esp + 4], 0x7ac41010
mov dword [esp], 0
call fcn.7ac367b0
jmp 0x7ac37738
mov eax, dword [edi + 0xa4]
mov dword [esp + 4], eax
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call fcn.7ac107c0
mov dword [ebp - 0x118], eax
jmp 0x7ac37738
mov dword [ebp - 0x84], eax
movzx eax, word [edi + 0xb4]
mov dword [esp + 4], eax
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call fcn.7ac10760
mov edx, eax
mov eax, dword [edi + 0x108]
cmp edx, eax
jg 0x7ac387bb
add dword [ebp - 0x88], eax
jmp 0x7ac37f6a
mov ebx, dword [ebp + 8]
mov ecx, dword [ebx + 0x28]
cmp dword [ebx + 0x24], ecx
jge 0x7ac37b9d
jmp 0x7ac383f0
mov dword [esp + 8], 0x1de
mov eax, dword [ebp - 0x12c]
mov dword [esp + 4], str..._dlls_riched20_wrap.c
mov dword [esp], str.i___len
call eax
jmp 0x7ac3846d
movzx eax, word [edi + 0xb4]
mov dword [esp + 4], eax
lea eax, [ebp - 0xcc]
mov dword [esp], eax
call fcn.7ac10760
jmp 0x7ac38778
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov eax, dword [eax + 0xbc]
mov eax, dword [eax]
lea eax, [eax + ecx*2]
call fcn.7ac36500
mov dword [esp + 0xc], str.Must_backtrack_to_split_at:__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.ME_SplitByBacktracking
mov dword [esp + 4], 0x7ac41010
mov dword [esp], 3
call fcn.7ac367b0
mov ecx, dword [ebp - 0x60]
test ecx, ecx
jne 0x7ac38536
test byte [0x7ac41010], 8
je 0x7ac3886c
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov eax, dword [eax + 0xbc]
mov eax, dword [eax]
lea eax, [eax + ecx*2]
call fcn.7ac36500
mov dword [esp + 0xc], str.Backtracking_failed__trying_desperate:__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.ME_SplitByBacktracking
mov dword [esp + 4], 0x7ac41010
mov dword [esp], 3
call fcn.7ac367b0
mov edi, dword [ebp - 0x110]
test edi, edi
jne 0x7ac38c66
mov edx, dword [ebp - 0x64]
cmp esi, edx
je 0x7ac38aec
test edx, edx
je 0x7ac38aec
mov ecx, dword [ebp - 0x7c]
mov dword [ebp - 0x70], 1
mov eax, edx
test ecx, ecx
je 0x7ac37880
jmp 0x7ac378dc
cmp esi, dword [ebp - 0x100]
je 0x7ac3810d
mov dword [esp + 8], esi
mov eax, dword fs:[0x18]
jmp 0x7ac380f3
mov esi, dword [ebp - 0x104]
test al, al
jne 0x7ac38a9a
mov dword [esp], edi
call fcn.7ac14670
mov ebx, eax
test eax, eax
jne 0x7ac3890a
jmp 0x7ac38242
mov dword [esp], ebx
call fcn.7ac2ad20
mov ebx, eax
test eax, eax
je 0x7ac38242
test byte [0x7ac41010], 8
je 0x7ac388f8
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
mov eax, dword [eax + 0xbc]
mov eax, dword [eax]
lea eax, [eax + ecx*2]
call fcn.7ac36500
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 8]
mov dword [esp + 0xc], str._t_d:__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x7ac4d45c
mov dword [esp + 4], 0x7ac41010
mov dword [esp], 3
call fcn.7ac367b0
jmp 0x7ac388f8
mov dword [esp + 8], 0x1dd
mov dword [esp + 4], str..._dlls_riched20_wrap.c
mov dword [esp], str.len___0
call dword [sym.imp.ucrtbase.dll__assert]
jmp 0x7ac38461
mov dword [ebp - 0x104], edi
jmp 0x7ac3851e
mov dword [ebp - 0x110], esi
cmp esi, dword [ebp - 0x64]
je 0x7ac37893
mov dword [esp], esi
call fcn.7ac2ad70
mov ebx, eax
mov eax, dword [eax + 0x14]
test ah, 0x80
jne 0x7ac38b0e
mov ecx, esi
mov dword [ebp - 0x104], edi
mov esi, dword [ebp - 0x110]
test ah, 0x40
je 0x7ac38a09
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
mov eax, dword [eax + 0xbc]
mov eax, dword [eax]
test ecx, ecx
jle 0x7ac389f5
lea edx, [eax + edx*2]
jmp 0x7ac389e1
sub ecx, 1
je 0x7ac389ef
movzx eax, word [edx + ecx*2 - 2]
sub eax, 1
cmp ax, 0x1f
jbe 0x7ac389dc
mov dword [ebp - 0x104], edi
mov edx, ebx
mov eax, dword [ebp - 0x100]
call fcn.7ac37170
mov ecx, eax
jmp 0x7ac38546
mov eax, dword [ecx + 0x20]
mov edx, dword [ecx + 0x24]
mov dword [ebp - 0x70], 1
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], edx
test byte [0x7ac41010], 8
je 0x7ac38552
mov eax, dword [ecx + 4]
mov edi, dword [ecx + 8]
mov dword [ebp - 0x110], ecx
mov edx, dword [ecx + 0xc]
mov eax, dword [eax + 0xbc]
mov eax, dword [eax]
lea eax, [eax + edi*2]
call fcn.7ac36500
mov edx, dword [ebx + 0xc]
mov edi, eax
mov eax, dword [ebx + 4]
mov ebx, dword [ebx + 8]
mov eax, dword [eax + 0xbc]
mov eax, dword [eax]
lea eax, [eax + ebx*2]
call fcn.7ac36500
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Split_point_is:__s_s_n
mov dword [esp + 8], str.ME_MaximizeSplit
mov dword [esp + 4], 0x7ac41010
mov dword [esp], 3
call fcn.7ac367b0
mov ecx, dword [ebp - 0x110]
jmp 0x7ac38552
mov dword [esp + 0xc], str.before_splitting_runs_into_ranges_n
mov dword [esp + 8], 0x7ac4d45c
mov dword [esp + 4], 0x7ac41010
mov dword [esp], 3
call fcn.7ac367b0
jmp 0x7ac388de
mov dword [esp + 0xc], str.failure__n
mov dword [esp + 8], str.ME_WrapHandleRun
mov dword [esp + 4], 0x7ac41010
mov dword [esp], 1
call fcn.7ac367b0
jmp 0x7ac37d34
cmp ebx, 1
je 0x7ac38c2f
mov eax, dword [ebp - 0x100]
mov ecx, 1
mov edx, esi
call fcn.7ac37170
mov ecx, eax
jmp 0x7ac38552
mov esi, ebx
jmp 0x7ac38990
mov dword [esp + 0xc], str.got_items:_n
mov dword [esp + 8], 0x7ac4d45c
mov dword [esp + 4], 0x7ac41010
mov dword [esp], 3
call fcn.7ac367b0
movzx edx, byte [0x7ac41010]
mov ecx, dword [ebp - 0xe8]
mov eax, edx
and eax, 8
test ecx, ecx
jg 0x7ac38667
jmp 0x7ac388d6
mov dword [esp + 0xc], str.after_splitting_into_ranges_n
mov dword [esp + 8], 0x7ac4d45c
mov dword [esp + 4], 0x7ac41010
mov dword [esp], 3
call fcn.7ac367b0
jmp 0x7ac385b8
mov eax, dword [ebp - 0x94]
mov dword [esp + 4], esi
mov eax, dword [eax + 0x30]
mov dword [esp], eax
call fcn.7ac2b460
mov edx, dword [ebp - 0x60]
test byte [edx + 0x15], 0x10
je 0x7ac38c41
mov eax, dword [edx + 4]
mov ebx, dword [edx + 0xc]
mov edi, dword [edx + 8]
mov eax, dword [eax + 0xbc]
mov dword [ebp - 0x110], ebx
mov ecx, ebx
mov dword [ebp - 0x11c], edi
mov eax, dword [eax]
mov dword [ebp - 0x114], eax
test ebx, ebx
jle 0x7ac38c98
lea ebx, [eax + edi*2]
mov edi, dword [ebp - 0x104]
jmp 0x7ac38be0
sub ecx, 1
je 0x7ac38c24
movzx eax, word [ebx + ecx*2 - 2]
sub eax, 1
cmp ax, 0x1f
ja 0x7ac38bdb
mov dword [ebp - 0x104], edi
cmp dword [ebp - 0x110], ecx
jne 0x7ac389f7
mov eax, dword [ebp - 0x114]
mov ebx, dword [ebp - 0x11c]
lea ebx, [eax + ebx*2]
jmp 0x7ac38c16
sub ecx, 1
je 0x7ac38c24
movzx eax, word [ebx + ecx*2 - 2]
sub eax, 1
cmp ax, 0x1f
jbe 0x7ac38c11
mov dword [ebp - 0x104], edi
jmp 0x7ac389f7
cmp esi, edx
je 0x7ac378ad
mov eax, dword [ebp - 0x70]
mov ecx, esi
jmp 0x7ac37d1f
mov dword [esp + 8], 0x1f3
mov dword [esp + 4], str..._dlls_riched20_wrap.c
mov dword [esp], str._wc__pLastSplittableRun__nFlags__MERF_SPLITTABLE_
call dword [sym.imp.ucrtbase.dll__assert]
mov edx, dword [ebp - 0x60]
jmp 0x7ac38ba3
mov ecx, dword [ebp - 0x110]
mov eax, dword [ebp - 0x100]
mov edx, esi
call fcn.7ac37170
mov ecx, eax
jmp 0x7ac38552
mov dword [ebp - 0x110], esi
mov edi, dword [ebp - 0x104]
jmp 0x7ac38990
mov esi, ecx
jmp 0x7ac378d3
mov ecx, dword [ebp - 0x110]
jmp 0x7ac389f7
mov ebx, edx
jmp 0x7ac37db6