Function at 0x10010990
Capabilities:
Create thread
Encode data using xor
Get graphical window text
Set file attributes
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x104]
sub esp, 0x104
push 0xffffffffffffffff
push 0x10028d7b
mov eax, dword fs:[0]
push eax
sub esp, 0x178
mov eax, dword [0x10040cf8]
xor eax, ebp
mov dword [ebp + 0x100], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.ucrtbased.dll_malloc]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0x1002e784
nop
xor eax, eax
lea ecx, [ecx + ecx*4]
shl ecx, 2
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], ecx
nop
lea eax, [eax + eax*4]
shl eax, 2
push ecx
push eax
call dword [sym.imp.USER32.dll_WindowFromPoint]
push 0xe1
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
call fcn.10026140
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
add esi, 0x14
cmp byte [edi + 0x13], 0
je 0x10010a65
mov eax, dword [edi + 0xf]
inc eax
push eax
call ebx
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10010a59
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10010a40
mov byte [ecx + ebx], 0
mov esi, ebx
mov ebx, dword [sym.imp.ucrtbased.dll_malloc]
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002e7a0
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10010ac5
mov eax, dword [edi + 0xf]
inc eax
push eax
call ebx
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10010abf
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10010aa6
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002e7bc
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10010b2f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10010b29
sub esi, ebx
nop word [eax + eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10010b10
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002e7dc
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10010b93
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10010b8d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10010b74
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002e7fc
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10010bf7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10010bf1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10010bd8
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002e820
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10010c5f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10010c59
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10010c40
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002e840
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10010cc3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10010cbd
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10010ca4
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002e85c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10010d27
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10010d21
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10010d08
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002e878
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10010d8f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10010d89
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10010d70
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002e894
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10010df3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10010ded
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10010dd4
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002e8b0
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10010e57
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10010e51
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10010e38
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002e8cc
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10010ebf
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10010eb9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10010ea0
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002e8e8
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10010f23
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10010f1d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10010f04
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002e904
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10010f87
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10010f81
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10010f68
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002e924
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10010fef
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10010fe9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10010fd0
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002e944
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011053
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001104d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011034
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002e964
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100110b7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100110b1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011098
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002e980
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001111f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011119
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011100
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002e99c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011183
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001117d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011164
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002e9b8
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100111e7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100111e1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100111c8
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002e9d4
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001124f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011249
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011230
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002e9f0
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100112b3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100112ad
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011294
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ea0c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011317
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011311
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100112f8
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ea28
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001137f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011379
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011360
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ea44
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100113e3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100113dd
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100113c4
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ea60
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011447
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011441
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011428
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ea7c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100114af
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100114a9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011490
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ea98
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011513
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001150d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100114f4
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002eab4
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011577
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011571
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011558
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ead0
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100115df
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100115d9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100115c0
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002eaec
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011643
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001163d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011624
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002eb08
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100116a7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100116a1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011688
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002eb24
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001170f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011709
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100116f0
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002eb40
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011773
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001176d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011754
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002eb5c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100117d7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100117d1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100117b8
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002eb7c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001183f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011839
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011820
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002eb9c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100118a3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001189d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011884
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ebbc
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011907
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011901
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100118e8
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ebd8
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001196f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011969
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011950
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ebf4
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100119d3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100119cd
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100119b4
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ec10
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011a37
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011a31
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011a18
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ec2c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011a9f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011a99
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011a80
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ec48
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011b03
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011afd
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011ae4
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ec64
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011b67
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011b61
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011b48
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ec80
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011bcf
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011bc9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011bb0
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ec9c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011c33
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011c2d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011c14
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ecb8
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011c97
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011c91
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011c78
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ecd4
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011cff
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011cf9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011ce0
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ecf0
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011d63
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011d5d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011d44
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ed0c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011dc7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011dc1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011da8
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ed28
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011e2f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011e29
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011e10
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ed44
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011e93
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011e8d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011e74
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ed60
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011ef7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011ef1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011ed8
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ed7c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011f5f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011f59
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011f40
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ed98
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011fc3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011fbd
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011fa4
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002edb4
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012027
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10012021
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012008
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002edd0
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001208f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10012089
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012070
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002edec
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100120f3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100120ed
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100120d4
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ee08
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012157
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10012151
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012138
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ee24
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100121bf
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100121b9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100121a0
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ee40
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012223
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001221d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012204
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ee5c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012287
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10012281
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012268
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ee7c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100122ef
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100122e9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100122d0
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002ee9c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012353
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001234d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012334
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x10014c2c
mov dword [ebp - 0x10], 0x1002eebc
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100123b7
push 0x1002fa88
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [eax + 6], 0xea
jne 0x10014c57
push 1
call edi
cmp dword [0x1004118c], 1
jne 0x10014ce4
push 1
push 0x40
push 8
push 0x1002faa4
lea ecx, [ebp - 0x184]
call fcn.100049c0
lea eax, [ebp - 0x184]
mov dword [ebp - 4], 0
push str._nH_Scan:
push eax
call fcn.10004550
lea eax, [ebp]
push eax
lea eax, [ebp - 0x184]
push eax
call fcn.10004550
add esp, 0x10
lea ecx, [ebp - 0x180]
call fcn.100054a0
test eax, eax
jne 0x10014cd2
push eax
mov eax, dword [ebp - 0x184]
lea ecx, [ebp - 0x184]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x184]
mov dword [ebp - 4], 0xffffffff
call fcn.10004fb0
cmp dword [0x1004119c], 1
jne 0x10014dc6
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xd4]
mov esi, eax
push 1
push 0x40
push 8
push 0x1002fac8
call fcn.100049c0
lea eax, [ebp - 0xd4]
mov dword [ebp - 4], 1
push 0x1002facc
push eax
call fcn.10004550
push esi
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.10004550
lea eax, [ebp - 0xd4]
push str.H_Scan:
push eax
call fcn.10004550
lea eax, [ebp]
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.10004550
lea eax, [ebp - 0xd4]
push 0x1002faec
push eax
call fcn.10004550
add esp, 0x2c
lea ecx, [ebp - 0xd0]
call fcn.100054a0
test eax, eax
jne 0x10014dae
push eax
mov eax, dword [ebp - 0xd4]
lea ecx, [ebp - 0xd4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x1002fb14
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xd4]
call fcn.10004fb0
mov eax, dword [0x10041190]
push 0
cmp eax, 1
jne 0x10014df4
push 0
push 0
push 0x100108e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x10014e1b
push 0
push 0
push 0x10010860
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x10014e2f
push 0
push 0
push 0x10010960
jmp 0x10014ddb
cmp eax, 4
jne 0x10014dee
push 0
push 0
push 0x10026220
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push 0x1002fb18
lea eax, [ebp]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x10014dec