Function at 0x7de0835b
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get process heap flags
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xffffffe0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x3f8
mov eax, dword [0x7de403ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x24]
xor ecx, ecx
test dword [ebx + 0x14], 0xfffffffe
mov dword [ebp - 0x2dc], eax
push esi
mov esi, dword [ebx + 0x10]
mov eax, 0x38ee
push edi
mov edi, dword [ebx + 0xc]
mov word [ebp - 0x22c], ax
mov eax, 0x11d1
mov dword [ebp - 0x2ac], edi
mov dword [ebp - 0x2b0], esi
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x27c], ecx
mov dword [ebp - 0x270], ecx
mov dword [ebp - 0x274], ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x248], ecx
mov dword [ebp - 0x2a0], ecx
mov dword [ebp - 0x29c], ecx
mov dword [ebp - 0x254], ecx
mov dword [ebp - 0x2b4], ecx
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x250], ecx
mov dword [ebp - 0x284], ecx
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x2a4], ecx
mov dword [ebp - 0x294], ecx
mov dword [ebp - 0x230], 0xf750e6c3
mov word [ebp - 0x22a], ax
mov byte [ebp - 0x228], 0x85
mov byte [ebp - 0x227], 0xe5
mov byte [ebp - 0x226], cl
mov byte [ebp - 0x225], 0xc0
mov byte [ebp - 0x224], 0x4f
mov byte [ebp - 0x223], 0xc2
mov byte [ebp - 0x222], 0x95
mov byte [ebp - 0x221], 0xee
jne 0x7de084ca
movzx eax, byte [ebx + 8]
mov dword [ebp - 0x280], eax
dec eax
je 0x7de087b6
dec eax
je 0x7de08745
dec eax
dec eax
je 0x7de08745
sub eax, 4
je 0x7de084b5
sub eax, 8
jne 0x7de084ca
cmp edi, ecx
jne 0x7de084ca
cmp esi, ecx
je 0x7de084ca
cmp word [esi], cx
je 0x7de084ca
mov dword [ebp - 0x238], 0x7de094a8
jmp 0x7de08827
cmp esi, ecx
jne 0x7de084ca
cmp edi, ecx
je 0x7de08671
cmp word [edi], cx
jne 0x7de08736
mov dword [ebp - 0x234], 0xc000000d
mov dword [ebp - 0x24c], 1
mov eax, dword [ebp - 0x2dc]
test eax, eax
je 0x7de084f0
mov ecx, dword [ebp - 0x24c]
mov dword [eax], ecx
cmp dword [ebp - 0x264], 0
je 0x7de0850c
push dword [ebp - 0x264]
call dword [sym.imp.ntdll.dll_NtClose]
and dword [ebp - 0x264], 0
cmp dword [ebp - 0x248], 0
je 0x7de08528
push dword [ebp - 0x248]
call dword [sym.imp.ntdll.dll_NtClose]
and dword [ebp - 0x248], 0
cmp dword [ebp - 0x23c], 0
mov esi, dword [sym.imp.ntdll.dll_RtlFreeHeap]
je 0x7de0854d
push dword [ebp - 0x23c]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call esi
cmp dword [ebp - 0x254], 0
je 0x7de0856c
push dword [ebp - 0x254]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call esi
mov eax, dword [ebp - 0x260]
mov edi, dword [ebp - 0x284]
test eax, eax
je 0x7de0859b
cmp eax, dword [ebp - 0x2ac]
je 0x7de0859b
cmp edi, eax
jne 0x7de0858a
xor edi, edi
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call esi
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x7de085c4
cmp eax, dword [ebp - 0x2ac]
je 0x7de085c4
cmp edi, eax
jne 0x7de085b3
xor edi, edi
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call esi
mov eax, dword [ebp - 0x27c]
test eax, eax
je 0x7de085ed
cmp eax, dword [ebp - 0x2b0]
je 0x7de085ed
cmp edi, eax
jne 0x7de085dc
xor edi, edi
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call esi
mov eax, dword [ebp - 0x274]
test eax, eax
je 0x7de08616
cmp eax, dword [ebp - 0x2b0]
je 0x7de08616
cmp edi, eax
jne 0x7de08605
xor edi, edi
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call esi
test edi, edi
je 0x7de0862b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call esi
cmp dword [ebp - 0x294], 0
je 0x7de08642
push 0
push dword [ebp - 0x294]
call dword [ebp - 0x2a4]
cmp dword [ebp - 0x26c], 0
je 0x7de08656
push dword [ebp - 0x26c]
call fcn.7dd724bc
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x234]
pop edi
xor ecx, ebp
pop esi
call fcn.7dd71442
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x20
lea eax, [ebp - 0x2b8]
push eax
mov dword [ebp - 0x2b8], ecx
call dword [sym.imp.ntdll.dll_NtQueryInstallUILanguage]
mov dword [ebp - 0x234], eax
test eax, eax
jl 0x7de084d4
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0xac
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x284], eax
test eax, eax
jne 0x7de086c4
mov dword [ebp - 0x234], 0xc0000017
jmp 0x7de084d4
mov dword [ebp - 0x2bc], eax
mov eax, 0xaa
mov word [ebp - 0x2be], ax
xor eax, eax
mov word [ebp - 0x2c0], ax
lea eax, [ebp - 0x2c0]
push eax
movzx eax, word [ebp - 0x2b8]
push eax
call dword [sym.imp.ntdll.dll_RtlLCIDToCultureName]
test al, al
jne 0x7de08707
mov dword [ebp - 0x234], 0xc00000e5
jmp 0x7de084d4
mov eax, dword [ebp - 0x2bc]
lea ecx, [ebp - 0x270]
push ecx
push eax
mov dword [ebp - 0x260], eax
call dword [sym.imp.ntdll.dll_RtlpConvertCultureNamesToLCIDs]
mov dword [ebp - 0x234], eax
test eax, eax
jl 0x7de084d4
or dword [ebx + 8], 0x100
mov dword [ebp - 0x238], 0x7de09490
jmp 0x7de087e2
cmp esi, ecx
jne 0x7de084ca
cmp edi, ecx
je 0x7de084ca
cmp word [edi], cx
je 0x7de084ca
push edi
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
cmp word [ebp - 0x25c], 2
jb 0x7de084ca
movzx eax, word [ebp - 0x25c]
mov ecx, dword [ebp - 0x258]
shr eax, 1
cmp word [ecx + eax*2 + 2], 0
jne 0x7de084ca
cmp dword [ebp - 0x280], 2
jne 0x7de087aa
mov dword [ebp - 0x238], 0x7de09480
jmp 0x7de087e2
mov dword [ebp - 0x238], 0x7de0946c
jmp 0x7de087e2
cmp edi, ecx
je 0x7de084ca
cmp esi, ecx
je 0x7de084ca
cmp word [edi], cx
je 0x7de084ca
cmp word [esi], cx
je 0x7de084ca
mov dword [ebp - 0x238], 0x7de09450
test edi, edi
je 0x7de08827
test dword [ebx + 8], 0x100
je 0x7de08805
lea eax, [ebp - 0x260]
push eax
push edi
mov dword [ebp - 0x270], edi
call dword [sym.imp.ntdll.dll_RtlpConvertLCIDsToCultureNames]
jmp 0x7de08819
lea eax, [ebp - 0x270]
push eax
push edi
mov dword [ebp - 0x260], edi
call dword [sym.imp.ntdll.dll_RtlpConvertCultureNamesToLCIDs]
mov dword [ebp - 0x234], eax
test eax, eax
jl 0x7de084d4
test esi, esi
je 0x7de0886c
test dword [ebx + 8], 0x100
je 0x7de0884a
lea eax, [ebp - 0x27c]
push eax
push esi
mov dword [ebp - 0x274], esi
call dword [sym.imp.ntdll.dll_RtlpConvertLCIDsToCultureNames]
jmp 0x7de0885e
lea eax, [ebp - 0x274]
push eax
push esi
mov dword [ebp - 0x27c], esi
call dword [sym.imp.ntdll.dll_RtlpConvertCultureNamesToLCIDs]
mov dword [ebp - 0x234], eax
test eax, eax
jl 0x7de084d4
mov eax, dword [ebx + 0x18]
or eax, dword [ebx + 0x1c]
mov edi, dword [sym.imp.ntdll.dll_EtwEventWrite]
je 0x7de089ee
mov esi, 0x7de09388
push esi
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x7de089ee
and dword [ebp - 0x28c], 0
and dword [ebp - 0x278], 0
lea eax, [ebp - 0x28c]
push eax
push dword [ebp - 0x2ac]
call fcn.7de08231
test eax, eax
jl 0x7de089a8
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x2b0]
call fcn.7de08231
test eax, eax
jl 0x7de089a8
mov edx, dword [ebp - 0x28c]
lea eax, [ebx + 8]
mov dword [ebp - 0x3e0], eax
mov eax, edx
xor ecx, ecx
lea edi, [eax + 2]
mov dword [ebp - 0x3dc], ecx
mov dword [ebp - 0x3d8], 4
mov dword [ebp - 0x3d4], ecx
mov dword [ebp - 0x298], edi
mov di, word [eax]
inc eax
inc eax
cmp di, cx
jne 0x7de0890c
sub eax, dword [ebp - 0x298]
mov dword [ebp - 0x3d0], edx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x278]
mov dword [ebp - 0x3cc], ecx
mov dword [ebp - 0x3c4], ecx
lea edx, [eax + 2]
mov di, word [eax]
inc eax
inc eax
cmp di, cx
jne 0x7de08943
mov edi, dword [sym.imp.ntdll.dll_EtwEventWrite]
sub eax, edx
mov edx, dword [ebp - 0x278]
sar eax, 1
lea eax, [eax + eax + 2]
push 4
mov dword [ebp - 0x3b8], eax
lea eax, [ebx + 0x14]
mov dword [ebp - 0x3bc], ecx
mov dword [ebp - 0x3b4], ecx
mov dword [ebp - 0x3b0], eax
pop eax
mov dword [ebp - 0x3ac], ecx
mov dword [ebp - 0x3a4], ecx
lea ecx, [ebp - 0x3e0]
push ecx
push eax
push esi
push dword [ebx + 0x1c]
mov dword [ebp - 0x3c0], edx
push dword [ebx + 0x18]
mov dword [ebp - 0x3a8], eax
call edi
cmp dword [ebp - 0x28c], 0
je 0x7de089cb
push dword [ebp - 0x28c]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x278], 0
je 0x7de089ee
push dword [ebp - 0x278]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push 0x7ddb3908
call sym.KERNEL32.dll_LoadLibraryW
mov dword [ebp - 0x26c], eax
test eax, eax
jne 0x7de08a11
mov dword [ebp - 0x234], 0xc00000e5
jmp 0x7de084de
push 0x7ddb38ec
push dword [ebp - 0x26c]
call fcn.7dd7122f
push 0x7ddb38d0
push dword [ebp - 0x26c]
mov esi, eax
call fcn.7dd7122f
mov dword [ebp - 0x2a4], eax
test esi, esi
je 0x7de08a02
test eax, eax
je 0x7de08a02
push 0
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x294]
push eax
call esi
test eax, eax
je 0x7de08a02
push 0x7de093c8
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor eax, eax
mov dword [ebp - 0x2d4], eax
mov dword [ebp - 0x2c8], eax
mov dword [ebp - 0x2c4], eax
lea eax, [ebp - 0x2d8]
push eax
push 0x20019
lea eax, [ebp - 0x264]
lea ecx, [ebp - 0x25c]
push eax
mov dword [ebp - 0x2d8], 0x18
mov dword [ebp - 0x2cc], 0x40
mov dword [ebp - 0x2d0], ecx
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov dword [ebp - 0x234], eax
test eax, eax
jge 0x7de08ad7
cmp eax, 0xc0000034
jne 0x7de084de
and dword [ebp - 0x234], 0
jmp 0x7de084de
mov ecx, dword fs:[0x18]
mov esi, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov eax, 0x216
push eax
mov dword [ebp - 0x288], eax
mov eax, dword [ecx + 0x30]
push 8
push dword [eax + 0x18]
call esi
mov dword [ebp - 0x23c], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x20a
push 8
push dword [eax + 0x18]
call esi
cmp dword [ebp - 0x23c], 0
mov dword [ebp - 0x254], eax
je 0x7de086b5
test eax, eax
je 0x7de086b5
mov dword [ebp - 0x240], eax
xor eax, eax
and dword [ebp - 0x2a8], 0
mov word [ebp - 0x244], ax
mov eax, 0x208
mov word [ebp - 0x242], ax
lea eax, [ebp - 0x2a0]
push eax
push 0x1fe
lea eax, [ebp - 0x220]
push eax
push 0
push dword [ebp - 0x2a8]
push dword [ebp - 0x264]
call dword [sym.imp.ntdll.dll_NtEnumerateKey]
mov dword [ebp - 0x234], eax
test eax, eax
jl 0x7de092df
mov eax, dword [ebp - 0x214]
lea ecx, [eax + 1]
cmp ecx, 0x1e8
jbe 0x7de08ba7
mov dword [ebp - 0x234], 0xc0000017
jmp 0x7de092ea
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x210], cx
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x25c]
push eax
call esi
mov eax, dword [ebp - 0x264]
and dword [ebp - 0x2c8], 0
and dword [ebp - 0x2c4], 0
mov dword [ebp - 0x2d4], eax
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x2d0], eax
lea eax, [ebp - 0x2d8]
push eax
push 0x20019
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 0x2d8], 0x18
mov dword [ebp - 0x2cc], 0x40
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov dword [ebp - 0x234], eax
test eax, eax
jl 0x7de092ea
push 0x7de093b8
lea eax, [ebp - 0x25c]
push eax
call esi
mov esi, dword [ebp - 0x23c]
lea eax, [ebp - 0x2a0]
push eax
push dword [ebp - 0x288]
lea eax, [ebp - 0x25c]
push esi
push 2
push eax
push dword [ebp - 0x248]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov dword [ebp - 0x234], eax
test eax, eax
jl 0x7de092ea
cmp dword [esi + 4], 4
jne 0x7de092ea
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x29c], eax
test dword [ebp - 0x280], eax
je 0x7de092f1
push 0x7de093a8
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x2a0]
push eax
push dword [ebp - 0x288]
lea eax, [ebp - 0x25c]
push esi
push 2
push eax
push dword [ebp - 0x248]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov dword [ebp - 0x234], eax
test eax, eax
jge 0x7de08db3
cmp eax, 0x80000005
jne 0x7de08da6
mov eax, dword [esi + 8]
test eax, eax
jbe 0x7de092ea
push dword [ebp - 0x23c]
lea esi, [eax + 2]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 0x254]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea ecx, [esi + 0xc]
push ecx
push 8
push dword [eax + 0x18]
mov dword [ebp - 0x288], ecx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x23c], eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
cmp dword [ebp - 0x23c], 0
mov dword [ebp - 0x254], eax
je 0x7de08b98
test eax, eax
je 0x7de08b98
lea eax, [ebp - 0x2a0]
push eax
push dword [ebp - 0x288]
lea eax, [ebp - 0x25c]
push dword [ebp - 0x23c]
push 2
push eax
push dword [ebp - 0x248]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov esi, dword [ebp - 0x23c]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
jl 0x7de092ea
cmp dword [esi + 4], 2
jne 0x7de092ea
mov ecx, dword [esi + 8]
lea eax, [esi + 0xc]
shr ecx, 1
xor edx, edx
push eax
mov word [eax + ecx*2], dx
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov esi, dword [sym.imp.ntdll.dll_RtlExpandEnvironmentStrings_U]
lea eax, [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x25c]
push eax
push 0
call esi
mov dword [ebp - 0x234], eax
test eax, eax
jge 0x7de08e70
cmp eax, 0xc0000023
jne 0x7de08e68
push dword [ebp - 0x254]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword fs:[0x18]
push dword [ebp - 0x2b4]
mov eax, dword [eax + 0x30]
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x25c]
push eax
push 0
call esi
mov dword [ebp - 0x234], eax
test eax, eax
jl 0x7de092ea
movzx eax, word [ebp - 0x244]
mov edx, dword [ebp - 0x240]
shr eax, 1
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x240]
call sub.ntdll.dll__wcslwr
pop ecx
push dword [ebp - 0x240]
call dword [sym.imp.ntdll.dll_RtlDoesFileExists_U]
test al, al
jne 0x7de08f07
mov eax, dword [ebx + 0x18]
or eax, dword [ebx + 0x1c]
je 0x7de092ea
mov esi, 0x7de09378
push esi
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x7de092ea
mov eax, dword [ebp - 0x240]
and dword [ebp - 0x30c], 0
mov dword [ebp - 0x310], eax
movzx eax, word [ebp - 0x244]
inc eax
inc eax
and dword [ebp - 0x304], 0
mov dword [ebp - 0x308], eax
lea eax, [ebp - 0x310]
push eax
push 1
push esi
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call edi
jmp 0x7de092ea
push dword [ebx + 0x20]
push dword [ebp - 0x240]
push dword [ebp - 0x294]
push dword [ebp - 0x26c]
call fcn.7de07711
test al, al
jne 0x7de08f98
mov eax, dword [ebx + 0x18]
or dword [ebp - 0x24c], 0x1000
or eax, dword [ebx + 0x1c]
je 0x7de092f1
push 0x7de09368
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x7de092f1
mov eax, dword [ebp - 0x240]
and dword [ebp - 0x2fc], 0
mov dword [ebp - 0x300], eax
movzx eax, word [ebp - 0x244]
inc eax
inc eax
and dword [ebp - 0x2f4], 0
mov dword [ebp - 0x2f8], eax
lea eax, [ebp - 0x300]
push eax
push 1
push 0x7de09368
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call edi
jmp 0x7de092f1
push dword [ebp - 0x240]
call sym.KERNEL32.dll_LoadLibraryW
mov dword [ebp - 0x268], eax
test eax, eax
jne 0x7de09007
mov eax, dword [ebx + 0x18]
or eax, dword [ebx + 0x1c]
je 0x7de092ea
mov esi, 0x7de09348
push esi
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x7de092ea
mov eax, dword [ebp - 0x240]
and dword [ebp - 0x2ec], 0
mov dword [ebp - 0x2f0], eax
movzx eax, word [ebp - 0x244]
inc eax
inc eax
and dword [ebp - 0x2e4], 0
mov dword [ebp - 0x2e8], eax
lea eax, [ebp - 0x2f0]
jmp 0x7de08ef6
push dword [ebp - 0x238]
mov esi, dword [ebp - 0x280]
push dword [ebp - 0x268]
call fcn.7dd7122f
and esi, 1
je 0x7de090e9
mov dword [ebp - 0x298], eax
test eax, eax
jne 0x7de091a3
mov eax, dword [ebx + 0x18]
or eax, dword [ebx + 0x1c]
je 0x7de092ea
push 0x7de09358
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x7de092ea
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x340], eax
movzx eax, word [ebp - 0x244]
xor ecx, ecx
inc eax
inc eax
mov dword [ebp - 0x338], eax
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x33c], ecx
mov dword [ebp - 0x334], ecx
mov dword [ebp - 0x32c], ecx
mov dword [ebp - 0x328], 4
mov dword [ebp - 0x324], ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, cl
jne 0x7de090ae
mov edx, dword [ebp - 0x238]
sub eax, esi
inc eax
mov dword [ebp - 0x318], eax
mov dword [ebp - 0x320], edx
mov dword [ebp - 0x31c], ecx
mov dword [ebp - 0x314], ecx
lea eax, [ebp - 0x340]
push eax
push 3
push 0x7de09358
jmp 0x7de08efa
mov dword [ebp - 0x290], eax
test eax, eax
jne 0x7de091a3
mov eax, dword [ebx + 0x18]
or eax, dword [ebx + 0x1c]
je 0x7de092ea
push 0x7de09358
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x7de092ea
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x370], eax
movzx eax, word [ebp - 0x244]
xor ecx, ecx
inc eax
inc eax
mov dword [ebp - 0x368], eax
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x360], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x36c], ecx
mov dword [ebp - 0x364], ecx
mov dword [ebp - 0x35c], ecx
mov dword [ebp - 0x358], 4
mov dword [ebp - 0x354], ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, cl
jne 0x7de09170
mov edx, dword [ebp - 0x238]
sub eax, esi
inc eax
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x350], edx
mov dword [ebp - 0x34c], ecx
mov dword [ebp - 0x344], ecx
lea eax, [ebp - 0x370]
jmp 0x7de090dc
cmp dword [ebp - 0x234], 0
jl 0x7de092ea
test dword [ebp - 0x29c], 0x100
push dword [ebx + 0x14]
je 0x7de091f0
test esi, esi
je 0x7de091d7
push dword [ebp - 0x274]
push dword [ebp - 0x270]
call dword [ebp - 0x298]
jmp 0x7de0921f
test byte [ebp - 0x280], 0x10
je 0x7de091e8
push dword [ebp - 0x274]
jmp 0x7de09219
push dword [ebp - 0x270]
jmp 0x7de09219
test esi, esi
je 0x7de09202
push dword [ebp - 0x27c]
push dword [ebp - 0x260]
jmp 0x7de091cf
test byte [ebp - 0x280], 0x10
je 0x7de09213
push dword [ebp - 0x27c]
jmp 0x7de09219
push dword [ebp - 0x260]
call dword [ebp - 0x290]
or dword [ebp - 0x24c], eax
mov dword [ebp - 0x250], eax
mov eax, dword [ebx + 0x18]
or eax, dword [ebx + 0x1c]
je 0x7de092f1
push 0x7de09398
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x7de092f1
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x3a0], eax
movzx eax, word [ebp - 0x244]
xor ecx, ecx
inc eax
inc eax
mov dword [ebp - 0x398], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x39c], ecx
mov dword [ebp - 0x394], ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, cl
jne 0x7de09282
mov edx, dword [ebp - 0x238]
sub eax, esi
inc eax
mov dword [ebp - 0x388], eax
lea eax, [ebp - 0x250]
mov dword [ebp - 0x380], eax
lea eax, [ebp - 0x3a0]
push eax
push 3
mov dword [ebp - 0x390], edx
mov dword [ebp - 0x38c], ecx
mov dword [ebp - 0x384], ecx
mov dword [ebp - 0x37c], ecx
mov dword [ebp - 0x378], 4
mov dword [ebp - 0x374], ecx
push 0x7de09398
jmp 0x7de08f8b
cmp eax, 0x8000001a
je 0x7de08acb
or dword [ebp - 0x24c], 1
cmp dword [ebp - 0x248], 0
je 0x7de0930d
push dword [ebp - 0x248]
call dword [sym.imp.ntdll.dll_NtClose]
and dword [ebp - 0x248], 0
cmp dword [ebp - 0x268], 0
je 0x7de09329
push dword [ebp - 0x268]
call dword [sym.imp.ntdll.dll_LdrUnloadDll]
and dword [ebp - 0x268], 0
inc dword [ebp - 0x2a8]
cmp dword [ebp - 0x234], 0x8000001a
jne 0x7de08b52
jmp 0x7de084de