Function at 0x430ea0
Capabilities:
Hash data using sha256
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x80570
call fcn.0058cb30
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [eax]
lea esi, [esp + 0x560]
mov edx, ebx
mov ecx, esi
call fcn.005395f0
mov eax, dword [esp + 0x560]
xor eax, 2
or eax, dword [esp + 0x564]
jne 0x430fa2
movq xmm0, qword [esp + 0x568]
lea eax, [esp + 0x334]
mov dword [esp + 0x560], 0x5a45f4
mov dword [esp + 0x564], 1
mov dword [esp + 0x570], 0
mov dword [esp + 0x100], eax
lea eax, [esp + 0x100]
mov dword [esp + 0x104], fcn.0052dbf0
mov dword [esp + 0x568], eax
mov dword [esp + 0x56c], 1
movq qword [esp + 0x334], xmm0
push esi
call fcn.0044fbf0
add esp, 4
cmp byte [esp + 0x334], 3
jne 0x430f9e
mov esi, dword [esp + 0x338]
mov ebx, dword [esi + 4]
mov edi, dword [esi]
mov eax, dword [ebx]
push edi
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x430f8c
cmp dword [ebx + 8], 9
jb 0x430f7d
mov edi, dword [edi - 4]
mov eax, dword [0x6074a0]
push edi
push 0
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [0x6074a0]
push esi
push 0
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov edi, dword [ebp + 8]
mov al, 9
jmp 0x431006
mov ecx, dword [esp + 0x598]
mov edx, dword [esp + 0x59c]
cmp ecx, 0x1e
mov eax, edx
sbb eax, 0
jae 0x431016
mov dword [esp + 0x560], 0x5a45c4
mov dword [esp + 0x564], 1
mov dword [esp + 0x570], 0
mov dword [esp + 0x568], 0x5a414c
mov dword [esp + 0x56c], 0
lea eax, [esp + 0x560]
push eax
call fcn.0044fbf0
add esp, 4
mov al, 0x17
mov edi, dword [ebp + 8]
mov byte [edi + 1], al
mov byte [edi], 1
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov dword [esp + 0x14], ebx
sub ecx, 0x80000
mov dword [esp + 0x564], 0
mov dword [esp + 0x560], 0
sbb edx, 0
cmovb edx, eax
cmovb ecx, eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], ecx
push 0
lea eax, [esp + 0x564]
push eax
mov dword [esp + 0x18], edx
push edx
mov edi, ecx
push ecx
push ebx
call sub.KERNEL32.dll_SetFilePointerEx
test eax, eax
je 0x4317ba
mov eax, dword [0x6074a0]
mov eax, dword [eax]
test eax, eax
jne 0x431089
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4326e2
mov ecx, dword [0x6074a0]
mov dword [ecx], eax
push 0x8001e
push 8
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x4326e2
mov esi, eax
push 0x8001e
push eax
push dword [ebp + 0x10]
lea eax, [esp + 0x8c]
push eax
call fcn.0053a550
add esp, 0x10
cmp byte [esp + 0x80], 4
jne 0x431899
mov ebx, 0x80000
mov eax, 0x7ffff
nop word cs:[eax + eax]
nop dword [eax + eax]
sub ebx, 1
jb 0x431120
mov ecx, eax
add ecx, 0x1e
jb 0x4326ce
movdqu xmm0, xmmword [esi + eax]
movdqu xmm1, xmmword [esi + eax + 0xe]
dec eax
pcmpeqb xmm0, xmmword [0x5a40f0]
pcmpeqb xmm1, xmmword [str.RTEXT_BLOCK__________END_CIPHERTRSA_PRIVATE_KEY]
pand xmm1, xmm0
pmovmskb ecx, xmm1
cmp ecx, 0xffff
jne 0x4310e0
jmp 0x431151
push esi
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp edi, 0x1e
mov ecx, edi
mov eax, edx
sbb eax, 0
mov eax, 0
jae 0x43101c
jmp 0x430fba
mov dword [esp + 0x560], 0x5a4538
mov dword [esp + 0x564], 1
mov dword [esp + 0x570], 0
mov dword [esp + 0x568], 0x5a414c
mov dword [esp + 0x56c], 0
lea eax, [esp + 0x560]
push eax
call fcn.0044fbf0
add esp, 4
add edi, ebx
mov ebx, dword [esp + 0x10]
adc ebx, 0
push esi
push 0
mov esi, dword [0x6074a0]
push dword [esi]
call sub.KERNEL32.dll_HeapFree
mov eax, edi
mov dword [esp + 0x10], edi
add eax, 0xfffffff8
mov dword [esp + 0x68], eax
mov eax, ebx
adc eax, 0xffffffff
mov dword [esp + 0x64], eax
mov eax, edi
mov edi, ebx
add eax, 0xfffffdf8
mov dword [esp + 0x40], eax
mov eax, ebx
adc eax, 0xffffffff
mov dword [esp + 0xc], eax
mov eax, dword [esi]
test eax, eax
je 0x4311e9
mov esi, dword [esp + 0x14]
jmp 0x431202
call sub.KERNEL32.dll_GetProcessHeap
mov esi, dword [esp + 0x14]
test eax, eax
je 0x4326e9
mov ecx, dword [0x6074a0]
mov dword [ecx], eax
push 0x200
push 8
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x4326e9
lea ebx, [esp + 0x560]
mov edx, esi
mov ecx, ebx
push dword [esp + 0xc]
push dword [esp + 0x44]
push 0
push 1
push 0x200
mov dword [esp + 0x48], eax
push eax
call fcn.0053a800
add esp, 0x18
movzx eax, byte [esp + 0x560]
cmp al, 4
je 0x431269
test al, al
jne 0x43125a
cmp dword [esp + 0x564], 0x26
je 0x431269
mov eax, dword [esp + 0x560]
cmp al, 4
jne 0x431733
mov ecx, dword [ebp + 0xc]
mov al, 0xf
cmp dword [ecx], 2
je 0x431712
mov eax, dword [0x6074b4]
movzx eax, byte [eax]
mov eax, dword [0x6074a0]
mov eax, dword [eax]
test eax, eax
jne 0x43129f
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4326fa
mov ecx, dword [0x6074a0]
mov dword [ecx], eax
push 0x70
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x4326fa
mov esi, eax
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 4], 0xbb67ae85
mov dword [eax], 0x6a09e667
mov dword [eax + 0x24], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x5c], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x60], 0
mov byte [eax + 0x68], 0
mov eax, dword [0x6074b4]
movzx eax, byte [eax]
mov eax, dword [0x6074a0]
mov eax, dword [eax]
test eax, eax
jne 0x431394
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x43270b
mov ecx, dword [0x6074a0]
mov dword [ecx], eax
push 0x70
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x43270b
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 4], 0xbb67ae85
mov dword [eax], 0x6a09e667
mov dword [eax + 0x24], 0
mov dword [eax + 0x20], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x3c], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x54], 0
mov dword [eax + 0x50], 0
mov dword [eax + 0x5c], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x64], 0
mov dword [eax + 0x60], 0
mov byte [eax + 0x68], 0
mov dword [esp + 0x570], esi
mov dword [esp + 0x574], 0x5a4110
mov dword [esp + 0x578], eax
mov dword [esp + 0x57c], 0x5a4110
mov dword [esp + 0x564], 0
mov dword [esp + 0x560], 2
lea eax, [esp + 0x100]
push 0x200
push dword [esp + 0x38]
push ebx
push dword [ebp + 0xc]
push eax
call fcn.004fdb20
add esp, 0x14
cmp dword [esp + 0x100], 0x12
jne 0x431628
mov esi, dword [esp + 0x104]
movzx eax, byte [esp + 0x108]
test esi, esi
je 0x431712
movzx ebx, byte [esp + 0x10b]
movzx edx, word [esp + 0x109]
movzx ecx, al
shl ebx, 0x10
or edx, ebx
cmp dword [esp + 0x10c], 0x41
jne 0x431797
mov ebx, dword [0x6074b4]
mov dword [esp + 0x44], edx
mov dword [esp + 0x18], ecx
movzx eax, byte [ebx]
push 1
push 0x20
call fcn.00401610
add esp, 8
test eax, eax
je 0x43271c
movsd xmm0, qword [esi]
movsd xmm1, qword [esi + 8]
mov dword [esp + 0x3c], eax
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
movsd xmm0, qword [esi + 0x18]
movups xmm2, xmmword [eax]
movsd qword [eax + 0x18], xmm0
movaps xmmword [esp + 0xb0], xmm2
movq xmm0, qword [esi + 0x10]
movq qword [eax + 0x10], xmm0
movdqu xmm1, xmmword [eax + 0x10]
movdqa xmmword [esp + 0xc0], xmm1
movzx eax, byte [ebx]
push 1
push 0x10
call fcn.00401610
add esp, 8
test eax, eax
je 0x43272d
movsd xmm0, qword [esi + 0x20]
movq xmm1, qword [esi + 0x28]
mov dword [esp + 0x38], eax
movq qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov ecx, dword [esi + 0x30]
movzx ebx, byte [esi + 0x40]
movdqu xmm0, xmmword [eax]
mov edx, dword [esi + 0x38]
mov dword [esp + 0x60], ecx
mov ecx, dword [esi + 0x34]
test bl, bl
movdqa xmmword [esp + 0xe0], xmm0
mov dword [esp + 0x58], edx
mov dword [esp + 0x54], ecx
mov ecx, dword [esi + 0x3c]
mov byte [esp + 0x334], bl
mov dword [esp + 0x5c], ecx
je 0x431978
cmp bl, 1
jne 0x43274f
mov dword [esp + 0x560], 0x5a4720
mov dword [esp + 0x564], 1
mov dword [esp + 0x570], 0
mov dword [esp + 0x568], 0x5a414c
mov dword [esp + 0x56c], 0
lea eax, [esp + 0x560]
push eax
call fcn.0044fbf0
add esp, 4
jmp 0x4319bf
movsd xmm2, qword [esp + 0x128]
movsd xmm1, qword [esp + 0x120]
mov eax, dword [esp + 0x138]
movq xmm0, qword [esp + 0x130]
mov dword [esp + 0x80], ebx
mov dword [esp + str._CRITICALDEC__Cannot_decrypt_extracted_container:], 0x5a46b4
mov dword [esp + 0x338], 1
mov dword [esp + 0x84], 0x4fba20
mov dword [esp + 0x344], 0
movsd qword [esp + 0x588], xmm2
movsd qword [esp + 0x580], xmm1
movsd xmm2, qword [esp + 0x118]
movsd xmm1, qword [esp + 0x110]
mov dword [esp + 0x598], eax
lea eax, [esp + 0x80]
movq qword [esp + 0x590], xmm0
mov dword [esp + 0x33c], eax
mov dword [esp + 0x340], 1
movsd qword [esp + 0x578], xmm2
movsd qword [esp + 0x570], xmm1
movsd xmm2, qword [esp + 0x100]
movq xmm1, qword [esp + 0x108]
movq qword [esp + 0x568], xmm1
movsd qword [esp + 0x560], xmm2
lea eax, [esp + 0x334]
push eax
call fcn.0044fbf0
add esp, 4
mov al, 1
mov edi, dword [ebp + 8]
mov byte [edi + 1], al
mov byte [edi], 1
mov eax, dword [esp + 0x34]
push eax
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x43100c
cmp al, 3
jb 0x431778
mov esi, dword [esp + 0x564]
mov ebx, dword [esi + 4]
mov edi, dword [esi]
mov eax, dword [ebx]
push edi
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x431769
cmp dword [ebx + 8], 9
jb 0x43175a
mov edi, dword [edi - 4]
push edi
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
push esi
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
push dword [esp + 0x34]
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov edi, dword [ebp + 8]
mov word [edi], 0x601
jmp 0x43100c
shl edx, 8
or edx, ecx
je 0x4317ad
push esi
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov edi, dword [ebp + 8]
mov word [edi], 0x701
jmp 0x43171b
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0x338], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x560], 0x5a4594
mov dword [esp + 0x564], 2
mov dword [esp + 0x334], 0
mov dword [esp + 0x570], 0
mov dword [esp + 0x100], eax
lea eax, [esp + 0x334]
mov dword [esp + 0x104], fcn.0042bdf0
mov dword [esp + 0x108], eax
lea eax, [esp + 0x100]
mov dword [esp + 0x10c], fcn.0052dbf0
mov dword [esp + 0x568], eax
mov dword [esp + 0x56c], 2
lea eax, [esp + 0x560]
push eax
call fcn.0044fbf0
add esp, 4
cmp byte [esp + 0x334], 3
jne 0x431971
mov esi, dword [esp + 0x338]
mov ebx, dword [esi + 4]
mov edi, dword [esi]
mov eax, dword [ebx]
push edi
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x43188a
cmp dword [ebx + 8], 9
jb 0x43187b
mov edi, dword [edi - 4]
push edi
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
push esi
push 0
mov eax, dword [0x6074a0]
push dword [eax]
jmp 0x43196c
movq xmm0, qword [esp + 0x80]
lea eax, [esp + 0x334]
mov dword [esp + 0x560], 0x5a4560
mov dword [esp + 0x564], 1
mov dword [esp + 0x570], 0
mov dword [esp + 0x100], eax
lea eax, [esp + 0x100]
mov dword [esp + 0x104], fcn.0052dbf0
mov dword [esp + 0x568], eax
mov dword [esp + 0x56c], 1
movq qword [esp + 0x334], xmm0
lea eax, [esp + 0x560]
push eax
call fcn.0044fbf0
add esp, 4
cmp byte [esp + 0x334], 3
mov edi, dword [0x6074a0]
jne 0x431967
mov eax, dword [esp + 0x338]
mov edi, dword [eax + 4]
mov ebx, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [edi]
push ebx
call eax
add esp, 4
cmp dword [edi + 4], 0
je 0x431954
cmp dword [edi + 8], 9
jb 0x431945
mov ebx, dword [ebx - 4]
mov eax, dword [0x6074a0]
push ebx
push 0
push dword [eax]
call sub.KERNEL32.dll_HeapFree
push dword [esp + 0x10]
push 0
mov edi, dword [0x6074a0]
push dword [edi]
call sub.KERNEL32.dll_HeapFree
push esi
push 0
push dword [edi]
call sub.KERNEL32.dll_HeapFree
mov al, 0x16
jmp 0x431003
mov dword [esp + 0x560], 0x5a46ec
mov dword [esp + 0x564], 1
mov dword [esp + 0x570], 0
mov dword [esp + 0x568], 0x5a414c
mov dword [esp + 0x56c], 0
lea eax, [esp + 0x560]
push eax
call fcn.0044fbf0
add esp, 4
test bl, bl
setne byte [esp + 0x50]
push dword [esp + 0x38]
push 0
mov ebx, dword [0x6074a0]
push dword [ebx]
call sub.KERNEL32.dll_HeapFree
push dword [esp + 0x3c]
push 0
push dword [ebx]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 0x44]
shl eax, 8
or eax, dword [esp + 0x18]
je 0x4319fd
push esi
push 0
push dword [ebx]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 0x54]
movaps xmm0, xmmword [esp + 0xb0]
lea ebx, [esp + 0x560]
mov dword [esp + str._DEBUGDEC__File_container_extracted:_key:nonce:st:sk:aes:], 0x5a4478
mov dword [esp + 0x104], 5
mov dword [esp + 0x110], 0
mov dword [esp + 0x108], ebx
mov dword [esp + 0x10c], 5
mov dword [esp + 0x74], eax
mov eax, dword [esp + 0x60]
movups xmmword [esp + 0x80], xmm0
movaps xmm0, xmmword [esp + 0xc0]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x5c]
movups xmmword [esp + 0x90], xmm0
movdqa xmm0, xmmword [esp + 0xe0]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x58]
movdqu xmmword [esp + 0xf0], xmm0
mov dword [esp + 0x78], eax
lea eax, [esp + 0x80]
mov dword [esp + 0x560], eax
lea eax, [esp + 0xf0]
mov dword [esp + 0x564], 0x42e990
mov dword [esp + 0x568], eax
lea eax, [esp + 0x70]
mov dword [esp + 0x56c], 0x42ecd0
mov dword [esp + 0x570], eax
lea eax, [esp + 0x78]
mov dword [esp + 0x574], 0x42e5d0
mov dword [esp + 0x578], eax
lea eax, [esp + 0x1f]
mov dword [esp + 0x57c], 0x42e5d0
mov dword [esp + 0x580], eax
movzx eax, byte [esp + 0x50]
mov dword [esp + 0x584], 0x42dd00
mov byte [esp + 0x1f], al
lea eax, [esp + 0x100]
push eax
call fcn.0044fbf0
add esp, 4
push 1
push 8
call fcn.00401730
add esp, 8
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x68]
test eax, eax
je 0x43273e
push dword [esp + 0x64]
push ecx
push 8
mov dword [esp + 0x24], eax
push eax
push dword [ebp + 0x10]
push ebx
call fcn.0052f640
add esp, 0x18
cmp byte [esp + 0x560], 4
jne 0x431cd8
mov eax, dword [0x6074b4]
mov ecx, ebx
mov ebx, edi
movzx eax, byte [eax]
mov eax, dword [esp + 0x18]
movq xmm0, qword [eax]
lea eax, [esp + 0xa0]
mov dword [esp + 0x560], 0x5a44c8
mov dword [esp + 0x564], 1
mov dword [esp + 0x570], 0
mov dword [esp + 0x100], eax
lea eax, [esp + 0x100]
mov dword [esp + 0x104], fcn.0042bdf0
mov dword [esp + 0x568], eax
mov dword [esp + 0x56c], 1
movq qword [esp + 0xa0], xmm0
push ecx
call fcn.0044fbf0
add esp, 4
mov edi, dword [esp + 0x10]
add edi, 0x1e
adc ebx, 0
mov dword [esp + 0xd8], edi
mov dword [esp + 0xdc], ebx
lea ecx, [esp + 0x560]
mov edx, esi
call fcn.005395f0
mov eax, dword [esp + 0x560]
xor eax, 2
or eax, dword [esp + 0x564]
jne 0x431d42
movq xmm0, qword [esp + 0x568]
lea eax, [esp + 0x334]
mov dword [esp + 0x560], 0x5a45f4
mov dword [esp + 0x564], 1
mov dword [esp + 0x570], 0
mov dword [esp + 0x100], eax
lea eax, [esp + 0x100]
mov dword [esp + 0x104], fcn.0052dbf0
mov dword [esp + 0x568], eax
mov dword [esp + 0x56c], 1
movq qword [esp + 0x334], xmm0
lea eax, [esp + 0x560]
push eax
call fcn.0044fbf0
add esp, 4
cmp byte [esp + 0x334], 3
jne 0x431cce
mov esi, dword [esp + 0x338]
mov ebx, dword [esi + 4]
mov edi, dword [esi]
mov eax, dword [ebx]
push edi
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x431cbf
cmp dword [ebx + 8], 9
jb 0x431cb0
mov edi, dword [edi - 4]
push edi
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
push esi
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov edi, dword [ebp + 8]
mov bl, 9
jmp 0x432133
cmp byte [esp + 0x560], 3
jb 0x431d23
mov esi, dword [esp + 0x564]
mov ebx, dword [esi + 4]
mov edi, dword [esi]
mov eax, dword [ebx]
push edi
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x431d14
cmp dword [ebx + 8], 9
jb 0x431d05
mov edi, dword [edi - 4]
push edi
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
push esi
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
push dword [esp + 0x18]
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov edi, dword [ebp + 8]
mov word [edi], 0x601
jmp 0x43171b
mov esi, dword [esp + 0x598]
mov eax, dword [esp + 0x59c]
mov ecx, 0x200
mov dword [esp + 0x10], ebx
mov dword [esp + 0x4c], 0
sub esi, edi
sbb eax, ebx
cmp esi, 0x200
cmovae esi, ecx
test eax, eax
cmovne esi, ecx
test esi, esi
mov dword [esp + 0x48], esi
je 0x431d9c
push 1
push esi
call fcn.00401730
add esp, 8
mov ebx, eax
test eax, eax
jne 0x431da1
push esi
push 1
call fcn.0041a8c0
add esp, 8
jmp 0x4327ec
mov ebx, 1
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
push dword [esp + 0x10]
push edi
push esi
push ebx
push dword [ebp + 0x10]
lea eax, [esp + 0x574]
push eax
call fcn.0052f640
add esp, 0x18
cmp byte [esp + 0x560], 4
mov edi, dword [ebp + 8]
jne 0x431dfd
test esi, esi
je 0x431e5d
push 1
push esi
call fcn.00401730
add esp, 8
mov edi, eax
test eax, eax
jne 0x431e62
push esi
push 1
call fcn.0041a8c0
add esp, 8
jmp 0x4327ec
cmp byte [esp + 0x560], 3
mov dword [esp + 0x10], ebx
jb 0x431e56
mov eax, dword [esp + 0x564]
mov edi, dword [eax + 4]
mov ebx, dword [eax]
mov dword [esp + 0x14], eax
mov eax, dword [edi]
push ebx
call eax
add esp, 4
cmp dword [edi + 4], 0
je 0x431e41
cmp dword [edi + 8], 9
jb 0x431e32
mov ebx, dword [ebx - 4]
mov eax, dword [0x6074a0]
push ebx
push 0
push dword [eax]
call sub.KERNEL32.dll_HeapFree
push dword [esp + 0x14]
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov edi, dword [ebp + 8]
mov bl, 2
jmp 0x43211d
mov edi, 1
mov dword [esp + 0x334], edi
mov dword [esp + 0x338], esi
mov dword [esp + 0x33c], esi
push 0
push 0
push esi
push edi
push dword [ebp + 0x10]
lea eax, [esp + 0x574]
push eax
call fcn.0052f640
add esp, 0x18
cmp byte [esp + 0x560], 4
jne 0x431fb0
lea eax, [esp + 0xd8]
mov dword [esp + 0x560], 0x5a462c
mov dword [esp + 0x564], 3
mov dword [esp + 0x570], 0
mov dword [esp + 0x100], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x104], fcn.0042bdf0
mov dword [esp + 0x108], eax
lea eax, [esp + 0x100]
mov dword [esp + 0x10c], fcn.0042bdf0
mov dword [esp + 0x568], eax
mov dword [esp + 0x56c], 2
lea eax, [esp + 0x560]
push eax
call fcn.0044fbf0
add esp, 4
push esi
push edi
push ebx
call sub.msvcrt.dll_memcmp
add esp, 0xc
mov edi, eax
test eax, eax
je 0x431ffb
lea eax, [esp + 0x20]
mov dword [esp + 0x560], 0x5a4670
mov dword [esp + 0x564], 2
mov dword [esp + 0x570], 0
mov dword [esp + 0x100], eax
lea eax, [esp + 0x334]
mov dword [esp + 0x104], 0x42f030
mov dword [esp + 0x108], eax
lea eax, [esp + 0x100]
mov dword [esp + 0x10c], 0x42f030
mov dword [esp + 0x568], eax
mov dword [esp + 0x56c], 2
lea eax, [esp + 0x560]
push eax
call fcn.0044fbf0
add esp, 4
mov esi, dword [esp + 0x338]
mov bl, 4
jmp 0x431ffd
cmp byte [esp + 0x560], 3
mov dword [esp + 0x10], ebx
jb 0x432105
mov eax, dword [esp + 0x564]
mov ebx, dword [eax + 4]
mov ecx, dword [eax]
mov dword [esp + 0x14], eax
mov eax, dword [ebx]
mov dword [esp + 0x40], ecx
push ecx
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x4320f3
cmp dword [ebx + 8], 9
jae 0x4320dd
mov eax, dword [esp + 0x40]
jmp 0x4320e4
mov bl, 0x18
test esi, esi
je 0x432016
push dword [esp + 0x334]
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0x24], 0
je 0x43202f
push dword [esp + 0x20]
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
test edi, edi
mov edi, dword [ebp + 8]
jne 0x432133
cmp byte [esp + 0x1f], 0
je 0x432150
movsd xmm1, qword [esp + 0x90]
movq xmm0, qword [esp + 0x98]
movsd xmm2, qword [esp + 0x80]
movsd qword [esp + 0x110], xmm1
movsd xmm1, qword [esp + 0x88]
movq qword [esp + 0x118], xmm0
movsd qword [esp + 0x100], xmm2
movsd qword [esp + 0x108], xmm1
movdqu xmm1, xmmword [esp + 0xf0]
movdqu xmmword [esp + 0x20], xmm1
lea esi, [esp + 0x560]
lea eax, [esp + 0x20]
lea edx, [esp + 0x100]
mov ecx, esi
push eax
call fcn.0042ce70
add esp, 4
lea ebx, [esp + 0x560]
lea eax, [esp + 0x340]
push 0x220
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0x4321f1
mov eax, dword [esp + 0x40]
mov eax, dword [eax - 4]
push eax
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
push dword [esp + 0x14]
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
test esi, esi
je 0x432118
push edi
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov edi, dword [ebp + 8]
mov bl, 3
test esi, esi
je 0x432133
push dword [esp + 0x10]
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov byte [edi + 1], bl
mov byte [edi], 1
push dword [esp + 0x18]
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
jmp 0x43171b
movsd xmm2, qword [esp + 0x98]
movsd xmm1, qword [esp + 0x90]
mov eax, dword [esp + 0xf8]
movq xmm0, qword [esp + 0xf0]
movsd qword [esp + 0x118], xmm2
movsd qword [esp + 0x110], xmm1
movsd xmm2, qword [esp + 0x80]
movq xmm1, qword [esp + 0x88]
mov dword [esp + 0x28], eax
movq qword [esp + 0x20], xmm0
movq qword [esp + 0x108], xmm1
movsd qword [esp + 0x100], xmm2
lea esi, [esp + 0x560]
lea eax, [esp + 0x20]
lea edx, [esp + 0x100]
mov ecx, esi
push eax
call fcn.0042cce0
add esp, 4
lea ebx, [esp + 0x560]
lea eax, [esp + 0x334]
push 0x84
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, 1
mov dword [esp + 0x100], eax
lea ecx, [esp + 0x104]
lea eax, [esp + 0x334]
push 0x22c
push eax
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov esi, dword [esp + 0xa0]
mov edi, dword [esp + 0xa4]
mov edx, dword [esp + 0x70]
mov dword [esp + 0x50], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x38], 0
mov eax, esi
mov ecx, edi
mov dword [esp + 0xe0], edx
add eax, 0xffffffff
adc ecx, 0xffffffff
cmp eax, 0xfffffffe
mov eax, esi
mov esi, edi
mov edi, dword [esp + 0x74]
sbb ecx, 0xffffffff
mov ecx, dword [esp + 0x78]
cmovae esi, dword [esp + 0xc]
cmovae eax, dword [esp + 0x40]
mov dword [esp + 0x58], edi
mov dword [esp + 0xac], ecx
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x54], ecx
cmp edx, eax
mov ecx, eax
cmovb eax, edx
cmp edi, esi
mov dword [esp + 0x60], ecx
cmovb ecx, edx
cmove ecx, eax
mov eax, esi
cmovb eax, edi
mov dword [esp + 0xc0], ecx
mov dword [esp + 0xb0], eax
call fcn.0052b1a0
mov dword [esp + 0x5c], esi
lock dec dword [eax]
jne 0x4322c2
mov ecx, eax
call fcn.0042eeb0
push 0x80000
push 0
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [esp + 0xc0]
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
or eax, dword [esp + 0xb0]
je 0x432437
mov eax, dword [esp + 0xc0]
mov ecx, dword [esp + 0xb0]
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov dword [esp + 0x44], ecx
push edi
push esi
push 0x80000
push ebx
push dword [ebp + 0x10]
lea eax, [esp + 0x34]
push eax
call fcn.0052f640
add esp, 0x18
movzx eax, byte [esp + 0x20]
cmp al, 4
jne 0x4324d7
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0x432437
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x44]
cmp ecx, ebx
sbb eax, 0
cmovb ebx, ecx
cmp ebx, 0x80001
jae 0x4327d9
cmp dword [esp + 0x100], 0
je 0x432388
lea eax, [esp + 0x560]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0x104]
lea edx, [esp + 0x20]
call fcn.0042d550
jmp 0x4323ab
lea eax, [esp + 0x560]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0x110]
lea edx, [esp + 0x20]
call fcn.0042cfe0
test al, al
jne 0x4327b9
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push edi
push esi
push 0
push 1
push ebx
lea eax, [esp + 0x574]
push eax
call fcn.0053a920
add esp, 0x18
movzx eax, byte [esp + 0x20]
cmp al, 4
jne 0x4324d7
mov ebx, dword [esp + 0x24]
add esi, ebx
adc edi, 0
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push dword [esp + 0x64]
push dword [esp + 0x6c]
push edi
push esi
call fcn.00432ab0
add esp, 0x10
movzx eax, byte [esp + 0x20]
cmp al, 4
jne 0x4324d7
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x44]
sub eax, ebx
sbb ecx, 0
test ebx, ebx
je 0x432437
mov dword [esp + 0x10], eax
or eax, ecx
lea ebx, [esp + 0x560]
mov dword [esp + 0x44], ecx
jne 0x43230c
sub esi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x60]
mov eax, dword [esp + 0x58]
mov ebx, dword [esp + 0xc0]
sbb edi, dword [esp + 0x38]
add dword [esp + 0x50], esi
mov esi, dword [esp + 0x5c]
adc dword [esp + 0x6c], edi
cmp dword [esp + 0xe0], ecx
sbb eax, esi
jae 0x4325f9
sub ecx, ebx
mov edi, dword [esp + 0xac]
sbb esi, dword [esp + 0xb0]
mov edx, ecx
mov eax, ecx
cmp edi, ecx
cmovb edx, edi
cmp dword [esp + 0x54], esi
cmovb eax, edi
mov edi, esi
cmovb edi, dword [esp + 0x54]
cmove eax, edx
sub ecx, eax
mov edx, ecx
sbb esi, edi
or edx, esi
je 0x4325f9
mov edx, dword [esp + 0x3c]
add edx, ebx
mov ebx, dword [esp + 0x38]
adc ebx, dword [esp + 0xb0]
add edx, eax
mov eax, ecx
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0xe0]
adc ebx, edi
mov edi, dword [esp + 0x58]
mov dword [esp + 0x38], ebx
lea ebx, [esp + 0x560]
jmp 0x432287
movzx edx, byte [esp + 0x23]
movzx ecx, word [esp + 0x21]
mov edi, dword [ebp + 8]
movzx eax, al
lea ebx, [esp + 0x48]
mov dword [esp + 0x560], 0x5a44f4
mov dword [esp + 0x564], 1
lea esi, [esp + 0x560]
mov dword [esp + 0x570], 0
shl edx, 0x10
or ecx, edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], fcn.0052dbf0
shl ecx, 8
or eax, ecx
mov dword [esp + 0x48], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x568], eax
mov dword [esp + 0x4c], edx
mov dword [esp + 0x56c], 1
push esi
call fcn.0044fbf0
add esp, 4
cmp byte [esp + 0x48], 3
jne 0x43259c
mov esi, dword [esp + 0x4c]
mov ebx, dword [esi + 4]
mov edi, dword [esi]
mov eax, dword [ebx]
push edi
call eax
add esp, 4
cmp dword [ebx + 4], 0
je 0x43258a
cmp dword [ebx + 8], 9
jb 0x43257b
mov edi, dword [edi - 4]
push edi
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
push esi
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
mov edi, dword [ebp + 8]
cmp dword [esp + 0x100], 0
jne 0x4325b4
mov bl, 1
mov eax, dword [0x60749c]
movzx eax, byte [eax]
test bl, bl
je 0x4325be
mov word [edi], 0xa01
jmp 0x432139
push dword [esp + 0xc]
push dword [esp + 0x44]
push dword [ebp + 0x10]
lea eax, [esp + 0x56c]
push eax
call fcn.0052ca70
add esp, 0x10
cmp byte [esp + 0x560], 4
jne 0x432629
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x6c]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
mov byte [eax], 0
jmp 0x432644
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x560]
push dword [esp + 0x64]
push dword [esp + 0x6c]
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.00432ab0
add esp, 0x10
cmp byte [esp + 0x560], 4
jne 0x432664
xor ebx, ebx
jmp 0x4326b8
mov eax, dword [ebp + 8]
mov edx, dword [esp + 0x564]
mov ecx, dword [esp + 0x560]
mov word [eax], 0x1001
call fcn.0042e850
push dword [esp + 0x18]
push 0
mov esi, dword [0x6074a0]
push dword [esi]
call sub.KERNEL32.dll_HeapFree
push dword [esp + 0x34]
push 0
push dword [esi]
jmp 0x431729
cmp byte [esp + 0x560], 3
mov bl, 1
jb 0x4326b8
mov eax, dword [esp + 0x564]
mov esi, dword [eax + 4]
mov edi, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [esi]
push edi
call eax
add esp, 4
cmp dword [esi + 4], 0
je 0x4326a6
cmp dword [esi + 8], 9
jb 0x432697
mov edi, dword [edi - 4]
push edi
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
push dword [esp + 0x10]
push 0
mov eax, dword [0x6074a0]
push dword [eax]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0x100], 0
mov edi, dword [ebp + 8]
jne 0x4325b0
jmp 0x4325a8
push 0x5a450c
push ecx
push eax
call fcn.00428850
add esp, 0xc
jmp 0x4327ec
push 0x8001e
jmp 0x4326ee
push 0x200
push 1
call fcn.0041a8c0
add esp, 8
ud2
push 0x70
push 8
call fcn.0041a8c0
add esp, 8
jmp 0x4327ec
push 0x70
push 8
call fcn.0041a8c0
add esp, 8
jmp 0x4327ec
push 0x20
push 1
call fcn.0041a8c0
add esp, 8
jmp 0x4327ec
push 0x10
push 1
call fcn.0041a8c0
add esp, 8
jmp 0x4327ec
push 8
push 1
call fcn.0041a8c0
add esp, 8
jmp 0x4327ec
lea eax, [esp + 0x334]
mov dword [esp + 0x560], 0x5a4750
mov dword [esp + 0x564], 1
mov dword [esp + 0x570], 0
mov dword [esp + 0x100], eax
lea eax, [esp + 0x100]
mov dword [esp + 0x104], 0x42b930
mov dword [esp + 0x568], eax
mov dword [esp + 0x56c], 1
push 0x5a4758
lea eax, [esp + 0x564]
push eax
call fcn.00425150
add esp, 8
jmp 0x4327ec
push 0x5a425c
push 0x5a4188
lea eax, [esp + 0x28]
push eax
push 0x2b
push 0x5a415c
call fcn.004254f0
add esp, 0x14
jmp 0x4327ec
push 0x5a44fc
push 0x80000
push ebx
call fcn.004287f0
add esp, 0xc
ud2