Function at 0xabcbf6
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xebc
mov eax, dword [0xc940a0]
xor eax, esp
mov dword [esp + 0xeb8], eax
push ebx
xor eax, eax
mov edx, 0xc96238
inc eax
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x1e4], eax
mov dword [esp + 0x1ac], ebx
mov dword [esp + 0x140], ebx
mov dword [esp + 0x138], ebx
mov dword [esp + 0x2c], ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xabcc3f
or dword [esp + 0x130], 0xffffffff
mov esi, 0x9fbcf2
mov eax, dword [0xc95890]
mov dword [esp + 0x11c], esi
mov dword [esp + 0x118], 0x67
mov dword [esp + 0x78], 0x337
mov dword [esp + 0x18c], 0x10b
mov dword [esp + 0x100], 0x20b
push 0
pop ebx
test eax, eax
jne 0xabd23f
mov edi, ebx
mov dword [esp + 0x4c], ebx
mov ecx, 0x338
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], ebx
call fcn.00ad193e
mov dword [esp + 0xa8], eax
test eax, eax
je 0xabd1da
or dword [esp + 0x64], 0xffffffff
mov edx, 0xab69605e
mov dword [esp + 0x900], edx
add eax, 7
mov edx, 0x7f1137f
mov dword [esp + 0x104], ebx
mov dword [esp + 0x904], edx
mov cl, bl
mov dword [esp + 0x194], ebx
mov edx, ebx
mov dword [esp + 0xcc], eax
mov dword [esp + 0x50], esi
mov dword [esp + 0xfc], 0x67
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [esp + 0x50]
xor edx, edi
mov dword [esp + 0x10], edx
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [esp + 0x50]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [esp + 0x50]
shl esi, 8
add dword [esp + 0x50], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
xor ebx, edx
xor ebx, 0xac987321
lea eax, [ebx + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, ebx
rol eax, 0xa
add edx, eax
mov eax, dword [esp + 0x10]
xor eax, edx
mov dword [esp + 0x10], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [esp + 0x10]
rol eax, 2
sub edx, eax
xor ebx, edx
imul edx, ebx, 0x605e
mov eax, ebx
shr eax, 0xd
sub edx, eax
mov eax, dword [esp + 0x10]
sub edx, 0x756c8a2
xor eax, edx
mov dword [esp + 0x10], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [esp + 0x10]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [esp + 0x10]
xor edx, eax
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor ebx, edx
lea eax, [ebx + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, ebx
rol eax, 2
add edx, eax
mov eax, dword [esp + 0x10]
xor eax, edx
mov dword [esp + 0x10], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [esp + 0x10]
rol eax, 8
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, ebx
ror eax, 0xa
xor edx, eax
mov eax, dword [esp + 0x10]
xor eax, edx
mov dword [esp + 0x10], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [esp + 0x10]
shr eax, 0xa
xor edx, eax
xor edx, ebx
mov ebx, dword [esp + 0x10]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
mov dword [esp + 0x10], ebx
add ebx, 0xfffff80f
xor ebx, edx
xor ebx, 0xab69605e
mov eax, ebx
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, ebx
shr eax, 2
add edx, eax
mov eax, dword [esp + 0x10]
xor eax, edx
mov dword [esp + 0x10], eax
add eax, 0xf80eec81
ror eax, 6
imul edx, eax, 0xab69
mov eax, dword [esp + 0x10]
rol eax, 7
add edx, eax
xor ebx, edx
mov eax, ebx
mov edx, ebx
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
mov eax, dword [esp + 0x10]
xor eax, edx
mov dword [esp + 0x10], eax
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, dword [esp + 0x10]
rol eax, 7
add edx, eax
mov eax, dword [esp + 0x10]
xor ebx, edx
xor eax, ebx
xor eax, 0xac987321
mov dword [esp + 0x10], eax
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor ebx, eax
lea eax, [ebx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, ebx
ror eax, 6
sub edx, eax
mov eax, dword [esp + 0x10]
xor eax, edx
mov dword [esp + 0x10], eax
add eax, 0xab69605e
rol eax, 3
imul edx, eax, 0x7f1
mov eax, dword [esp + 0x10]
rol eax, 0xe
add edx, eax
xor ebx, edx
lea eax, [ebx - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, ebx
ror eax, 0xe
sub edx, eax
mov eax, dword [esp + 0x10]
xor eax, edx
mov dword [esp + 0x10], eax
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, dword [esp + 0x10]
shr eax, 3
xor edx, eax
xor ebx, edx
mov edx, 0x7f1137f
mov eax, ebx
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, ebx
xor ebx, dword [esp + 0x64]
rol eax, 2
mov dword [esp + 0x64], esi
mov esi, dword [esp + 0x50]
xor edx, eax
mov eax, dword [esp + 0xcc]
xor edx, dword [esp + 0x104]
xor dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
mov byte [eax - 4], dl
mov byte [eax], bl
ror edx, 8
mov byte [eax - 5], dl
ror ebx, 8
mov byte [eax - 1], bl
ror edx, 8
mov byte [eax - 6], dl
ror ebx, 8
mov byte [eax - 2], bl
ror edx, 8
ror ebx, 8
mov byte [eax - 7], dl
mov byte [eax - 3], bl
add eax, 8
ror edx, 8
ror ebx, 8
sub dword [esp + 0xfc], 1
mov dword [esp + 0x104], edi
mov dword [esp + 0xcc], eax
jne 0xabcd08
mov esi, dword [esp + 0xa8]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xabd030
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xabd064
cmp edx, dword [0x9fc02c]
jne 0xabd064
mov edi, esi
mov dword [esp + 0x28], esi
mov esi, ebx
mov dword [esp + 0x104], 0x337
jmp 0xabd076
or dword [esp + 0x104], 0xffffffff
mov edi, ebx
mov dword [esp + 0x30], 0xc004d501
test esi, esi
je 0xabd081
mov ecx, esi
call fcn.00ad1951
cmp dword [esp + 0x30], ebx
jl 0xabd1d6
mov eax, dword [esp + 0x104]
mov esi, edi
push 0x40
push ebx
push 0xc960a0
mov byte [eax + edi], bl
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], bl
je 0xabd1e1
mov edi, 0xc960a0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [esp + 0xa8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xabd0c2
sub ecx, dword [esp + 0xa8]
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xabd1cf
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [esp + 0x58], ecx
cmp word [eax], dx
je 0xabd10a
mov ecx, 0xc000007b
mov dword [esp + 0x58], ecx
jmp 0xabd154
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xabd0ff
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xabd0ff
cmp dword [edx], 0x4550
jne 0xabd0ff
movzx eax, word [edx + 0x18]
cmp ax, word [esp + 0x18c]
je 0xabd142
cmp ax, word [esp + 0x100]
je 0xabd142
mov ecx, 0xc000000d
jmp 0xabd104
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x30], ebx
test eax, eax
je 0xabd1be
mov edx, esi
mov dword [esp + 0x1c], esi
lea eax, [edx + 1]
mov dword [esp + 0xa8], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xabd177
sub edx, dword [esp + 0xa8]
inc esi
add esi, edx
test ecx, ecx
js 0xabd1ab
push dword [esp + 0x1c]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xabd1c9
mov ecx, dword [esp + 0x4c]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x30]
inc dword [esp + 0x4c]
inc eax
mov dword [esp + 0x30], eax
cmp eax, dword [esp + 0x18]
jb 0xabd167
add edi, 0x10
cmp byte [esi], bl
jne 0xabd0b4
mov esi, dword [esp + 0x58]
jmp 0xabd1e3
mov esi, 0xc000007a
jmp 0xabd1e3
mov edi, dword [esp + 0x28]
mov esi, 0xc000007a
jmp 0xabd1e7
mov esi, ebx
mov edi, dword [esp + 0x28]
test edi, edi
je 0xabd1fa
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push edi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0xabd23a
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xabd211
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xabd200
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xabd245
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
mov eax, dword fs:[0x30]
mov edi, ebx
mov dword [esp + 0x1bc], ebx
mov dword [esp + 0x19c], ebx
cmp dword [eax + 0x1d4], ebx
je 0xabd544
mov esi, dword [0xc93088]
mov ecx, esi
call dword [0xc99200]
call esi
mov edx, eax
mov dword [esp + 0xa8], edx
test edx, edx
jne 0xabd2b7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0xabd2a4
movzx edi, di
or edi, 0x80070000
test edi, edi
push 4
pop esi
js 0xabd54d
mov edi, 0x80004005
jmp 0xabd54d
mov eax, ebx
mov edi, ebx
mov dword [esp + 0x4c], eax
mov ecx, ebx
mov dword [esp + 0x180], eax
mov esi, dword [0xc93098]
lea edx, [esp + 0x1e8]
push edx
mov edx, dword [esp + 0xac]
push ecx
push eax
push 2
push edx
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xabd356
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xabd341
cmp dword [esp + 0x4c], 0
jne 0xabd33a
mov ecx, dword [esp + 0x1e8]
call fcn.00ad193e
push eax
lea ecx, [esp + 0x184]
call fcn.00ad1916
mov eax, dword [esp + 0x180]
mov dword [esp + 0x4c], eax
test eax, eax
je 0xabd333
mov ecx, dword [esp + 0x1e8]
jmp 0xabd2c8
mov edi, 0x8007000e
jmp 0xabd368
mov edi, 0x80004005
jmp 0xabd368
test eax, eax
je 0xabd33a
jg 0xabd34b
mov edi, eax
jmp 0xabd368
movzx edi, ax
or edi, 0x80070000
jmp 0xabd368
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x180], ebx
mov dword [esp + 0x1bc], eax
lea ecx, [esp + 0x180]
call fcn.00ad18c0
test edi, edi
js 0xabd54a
mov esi, dword [0xc93094]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov edx, eax
mov dword [esp + 0xa8], edx
test edx, edx
je 0xabd28d
mov eax, ebx
mov edi, ebx
mov dword [esp + 0x4c], eax
mov ecx, ebx
mov dword [esp + 0x17c], eax
mov esi, dword [0xc93098]
lea edx, [esp + 0x1ec]
push edx
mov edx, dword [esp + 0xac]
push ecx
push eax
push 2
push edx
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xabd443
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xabd42e
cmp dword [esp + 0x4c], 0
jne 0xabd427
mov ecx, dword [esp + 0x1ec]
call fcn.00ad193e
push eax
lea ecx, [esp + 0x180]
call fcn.00ad1916
mov eax, dword [esp + 0x17c]
mov dword [esp + 0x4c], eax
test eax, eax
je 0xabd420
mov ecx, dword [esp + 0x1ec]
jmp 0xabd3b5
mov edi, 0x8007000e
jmp 0xabd455
mov edi, 0x80004005
jmp 0xabd455
test eax, eax
je 0xabd427
jg 0xabd438
mov edi, eax
jmp 0xabd455
movzx edi, ax
or edi, 0x80070000
jmp 0xabd455
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x17c], ebx
mov dword [esp + 0x19c], eax
lea ecx, [esp + 0x17c]
call fcn.00ad18c0
test edi, edi
js 0xabd54a
mov eax, dword [esp + 0x1bc]
test eax, eax
je 0xabd544
push 4
mov ecx, 0x9fb9c0
pop esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xabd4a4
test dx, dx
je 0xabd4a0
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xabd4a4
add eax, esi
add ecx, esi
test dx, dx
jne 0xabd480
mov eax, ebx
jmp 0xabd4a9
sbb eax, eax
or eax, 1
test eax, eax
jne 0xabd544
mov eax, dword [esp + 0x19c]
test eax, eax
je 0xabd544
mov ecx, 0x9f98b0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xabd4e9
test dx, dx
je 0xabd4e5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xabd4e9
add eax, esi
add ecx, esi
test dx, dx
jne 0xabd4c5
mov eax, ebx
jmp 0xabd4ee
sbb eax, eax
or eax, 1
test eax, eax
jne 0xabd544
push esi
lea eax, [esp + 0x1f4]
mov dword [esp + 0x1f4], ebx
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
jne 0xabd535
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0xabd2a7
movzx edi, di
or edi, 0x80070000
test edi, edi
jmp 0xabd2a7
test byte [esp + 0x1f0], 0xf
jne 0xabd544
xor eax, eax
inc eax
jmp 0xabd546
mov eax, ebx
mov dword [esp + 0x2c], eax
push 4
pop esi
lea ecx, [esp + 0x19c]
call fcn.00ad18c0
lea ecx, [esp + 0x1bc]
call fcn.00ad18c0
test edi, edi
jns 0xabd56d
mov dword [esp + 0x2c], ebx
push esi
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
push eax
lea ecx, [esp + 0x13c]
call fcn.00ad18f7
cmp dword [esp + 0x138], 0
jne 0xabd65d
mov dword [esp + 0x14], 0x8007000e
mov eax, dword [esp + 0x1b8]
mov dword [esp + 0x140], eax
xor esi, esi
mov edx, 0xc96238
inc esi
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xabd5af
mov eax, dword [0xc95890]
test eax, eax
jle 0xabd60b
sub eax, 1
mov dword [0xc95890], eax
jne 0xabd60b
mov edi, ebx
mov eax, dword [edi + 0xc960a0]
test eax, eax
je 0xabd5e1
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0xabd5d0
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
inc esi
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
lea ecx, [esp + 0x138]
call fcn.00ad18a9
mov eax, dword [esp + 0x14]
test eax, eax
jns 0xac68fd
cmp eax, 0xd0000034
je 0xac6919
cmp eax, 0xd00000e5
je 0xac68f4
cmp eax, 0xc004d501
je 0xac68f4
cmp eax, 0xd000003e
je 0xac6919
jmp 0xac68f9
mov eax, dword [esp + 0x138]
lea edi, [esp + 0x148]
mov dword [esp + 0x34], eax
mov eax, ebx
mov dword [esp + 0x60], eax
mov dword [esp + 0x2f0], eax
xor eax, eax
stosd dword es:[edi], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [esp + 0x18], eax
mov dword [esp + 0xa8], 0x38
test eax, eax
jne 0xabd6c0
mov esi, 0xc0000017
mov edi, ebx
mov dword [esp + 0x14], esi
jmp 0xac025e
push 0x28
pop ecx
mov esi, 0xc94ea0
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, eax
mov dword [esp + 0x10], edi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [esp + 0x20], ecx
test ecx, ecx
jne 0xabd6fb
mov esi, 0xc0000017
mov dword [esp + 0x14], esi
jmp 0xac025e
mov eax, dword [0xc94e98]
mov dword [ecx], eax
mov eax, dword [0xc94e9c]
mov dword [ecx + 4], eax
mov dword [esp + 0x1c], ecx
rdtsc
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], edx
lea eax, [esp + 0x25c]
mov dword [esp + 0x40], ebx
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov edi, dword [esp + 0x25c]
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
jns 0xabd74d
mov edi, dword [esp + 0x3dc]
jmp 0xac025a
lea eax, [esp + 0x40]
mov edx, edi
push eax
xor ecx, ecx
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
mov dword [esp + 0x14], esi
jl 0xac025a
lea eax, [esp + 0x264]
mov edx, 0xa0
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xac025a
mov edi, dword [esp + 0x264]
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x40]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
mov dword [esp + 0x14], esi
jl 0xac025a
lea eax, [esp + 0x27c]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xac025a
mov edi, dword [esp + 0x27c]
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x40]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
mov dword [esp + 0x14], esi
jl 0xac025a
lea eax, [esp + 0x280]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xac025a
mov edi, dword [esp + 0x280]
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x40]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
mov dword [esp + 0x14], esi
jl 0xac025a
lea eax, [esp + 0x1f4]
mov edx, SysReAllocString
push eax
mov ecx, 0x9fa8e0
call fcn.00a41606
test eax, eax
jns 0xabd878
mov esi, 0xc000003e
jmp 0xac0256
mov edx, dword [esp + 0x1f4]
lea eax, [esp + 0x2a0]
push eax
inc edx
push 4
pop eax
mov dword [esp + 0x1f8], edx
mov ecx, eax
add edx, edx
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xac025a
mov edi, dword [esp + 0x2a0]
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x40]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
mov dword [esp + 0x14], esi
jl 0xac025a
lea eax, [esp + 0x2a4]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xac025a
mov edi, dword [esp + 0x2a4]
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x40]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
mov dword [esp + 0x14], esi
jl 0xac025a
lea eax, [esp + 0x2bc]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xac025a
mov edi, dword [esp + 0x2bc]
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x40]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
mov dword [esp + 0x14], esi
jl 0xac025a
push dword [esp + 0x40]
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [esp + 0xbc], edi
test edi, edi
jne 0xabd992
mov esi, 0xc0000017
jmp 0xac0256
mov eax, edi
mov dword [esp + 0x60], eax
mov dword [esp + 0x2f0], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 0x3d8], ebx
mov dword [esp + 0x174], edi
push 4
pop ecx
lea eax, [esp + 0x31c]
mov dword [esp + 0x318], ecx
mov edx, ecx
mov ecx, edi
push eax
call fcn.00a32533
mov esi, eax
mov ecx, ebx
mov dword [esp + 0x14], esi
test esi, esi
js 0xac025a
mov ecx, dword [esp + 0x40]
lea eax, [edi + 8]
add ecx, edi
cmp eax, ecx
jbe 0xabd9f3
mov esi, 0xc0000023
jmp 0xac0256
push 4
pop eax
mov dword [edi], eax
mov eax, dword [esp + 0x31c]
mov dword [eax], ebx
xor eax, eax
inc eax
mov dword [esp + 0xc], eax
mov ecx, eax
test esi, esi
js 0xac025a
mov dword [esp + 0x54], ebx
mov eax, edi
mov dword [esp + 0x154], eax
test ecx, ecx
je 0xabda9a
mov edx, dword [eax]
lea ecx, [esp + 0x2c4]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabda51
mov eax, dword [esp + 0x2c4]
mov dword [esp + 0x2d8], eax
jmp 0xabda58
mov eax, dword [esp + 0x2d8]
test esi, esi
js 0xabdb0a
lea ecx, [esp + 0x154]
mov edx, eax
push ecx
mov ecx, dword [esp + 0x158]
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabdb0a
mov eax, dword [esp + 0x54]
inc eax
cmp eax, dword [esp + 0xc]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x154]
jb 0xabda23
lea ecx, [esp + 0x324]
mov dword [esp + 0x320], 0xa0
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabdb0a
mov esi, dword [esp + 0x154]
mov ecx, dword [esp + 0x40]
add ecx, edi
lea eax, [esi + 0xa4]
cmp eax, ecx
ja 0xabd9e9
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 0x324]
inc eax
mov dword [esi], 0xa0
mov esi, dword [esp + 0x18]
push 0x28
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0xbc]
mov dword [esp + 0xc], eax
jmp 0xabdb0e
mov eax, dword [esp + 0xc]
test esi, esi
js 0xac025a
mov dword [esp + 0x54], ebx
mov ecx, edi
mov dword [esp + 0x15c], ecx
test eax, eax
je 0xabdb9a
mov edx, dword [ecx]
lea eax, [esp + 0x2dc]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabdb55
mov eax, dword [esp + 0x2dc]
mov dword [esp + 0x2e0], eax
jmp 0xabdb5c
mov eax, dword [esp + 0x2e0]
test esi, esi
js 0xabdbff
lea ecx, [esp + 0x15c]
mov edx, eax
push ecx
mov ecx, dword [esp + 0x160]
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabdbff
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x15c]
inc eax
mov dword [esp + 0x54], eax
cmp eax, dword [esp + 0xc]
jb 0xabdb27
lea eax, [esp + 0x32c]
mov dword [esp + 0x328], 8
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabdbff
mov edx, dword [esp + 0x15c]
mov ecx, dword [esp + 0x40]
add ecx, edi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xabd9e9
mov ecx, dword [esp + 0x32c]
mov dword [edx], 8
mov edx, dword [esp + 0x20]
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
jmp 0xabdc03
mov eax, dword [esp + 0xc]
test esi, esi
js 0xac025a
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x3c8], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x3cc], ecx
mov ecx, edi
mov dword [esp + 0x170], ecx
mov dword [esp + 0x54], ebx
test eax, eax
je 0xabdca9
mov edx, dword [ecx]
lea eax, [esp + 0x2e4]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabdc60
mov eax, dword [esp + 0x2e4]
mov dword [esp + 0x214], eax
jmp 0xabdc67
mov eax, dword [esp + 0x214]
test esi, esi
js 0xac025a
lea ecx, [esp + 0x170]
mov edx, eax
push ecx
mov ecx, dword [esp + 0x174]
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xac025a
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x170]
inc eax
mov dword [esp + 0x54], eax
cmp eax, dword [esp + 0xc]
jb 0xabdc32
lea eax, [esp + 0x334]
mov dword [esp + 0x330], 8
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xac025a
mov edx, dword [esp + 0x170]
mov ecx, dword [esp + 0x40]
add ecx, edi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xabd9e9
mov eax, dword [esp + 0x334]
mov ecx, dword [esp + 0x6c]
inc dword [esp + 0xc]
mov dword [edx], 8
mov dword [eax], ecx
mov ecx, dword [esp + 0x70]
mov dword [eax + 4], ecx
test esi, esi
js 0xac025a
lea eax, [esp + 0x1b0]
mov edx, SysReAllocString
push eax
mov ecx, 0x9fa8e0
call fcn.00a41606
test eax, eax
js 0xabd86e
mov ecx, dword [esp + 0x1b0]
lea eax, [esp + 0x1b0]
push eax
xor eax, eax
lea edx, [eax + 1]
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xac025a
mov eax, dword [esp + 0x1b0]
add eax, eax
mov dword [esp + 0x4c], eax
je 0xabde65
cmp dword [esp + 0xc], 0
mov eax, edi
mov dword [esp + 0x168], eax
mov dword [esp + 0x54], ebx
jbe 0xabddf6
mov edx, dword [eax]
lea ecx, [esp + 0x218]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabddad
mov eax, dword [esp + 0x218]
mov dword [esp + 0x21c], eax
jmp 0xabddb4
mov eax, dword [esp + 0x21c]
test esi, esi
js 0xac025a
lea ecx, [esp + 0x168]
mov edx, eax
push ecx
mov ecx, dword [esp + 0x16c]
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xac025a
mov eax, dword [esp + 0x54]
inc eax
cmp eax, dword [esp + 0xc]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x168]
jb 0xabdd7f
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x338], ecx
lea ecx, [esp + 0x33c]
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xac025a
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x40]
add ecx, 4
mov edx, dword [esp + 0x168]
add eax, edi
add ecx, edx
cmp ecx, eax
jbe 0xabde44
mov esi, 0xc0000023
jmp 0xabde6a
mov eax, dword [esp + 0x4c]
push eax
push 0x9fa8e0
push dword [esp + 0x344]
mov dword [edx], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
inc dword [esp + 0xc]
jmp 0xabde6e
mov esi, 0xc000000d
mov dword [esp + 0x14], esi
test esi, esi
js 0xac025a
cmp dword [esp + 0xc], 0
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x404], eax
mov eax, edi
mov dword [esp + 0x158], eax
mov dword [esp + 0x54], ebx
jbe 0xabdf08
mov edx, dword [eax]
lea ecx, [esp + 0x220]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabdec3
mov eax, dword [esp + 0x220]
mov dword [esp + 0x224], eax
jmp 0xabdeca
mov eax, dword [esp + 0x224]
test esi, esi
js 0xabdf60
lea ecx, [esp + 0x158]
mov edx, eax
push ecx
mov ecx, dword [esp + 0x15c]
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabdf60
mov eax, dword [esp + 0x54]
inc eax
cmp eax, dword [esp + 0xc]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x158]
jb 0xabde95
push 4
pop edx
lea ecx, [esp + 0x304]
mov dword [esp + 0x300], edx
push ecx
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabdf60
mov edx, dword [esp + 0x158]
mov ecx, dword [esp + 0x40]
add ecx, edi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xabd9e9
mov ecx, dword [esp + 0x2c]
push 4
pop eax
mov dword [edx], eax
mov eax, dword [esp + 0x304]
mov dword [eax], ecx
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
jmp 0xabdf64
mov eax, dword [esp + 0xc]
test esi, esi
js 0xac025a
mov dword [esp + 0x54], ebx
mov ecx, edi
mov dword [esp + 0x160], ecx
push 4
pop esi
mov dword [esp + 0x3c4], esi
test eax, eax
je 0xabdffa
mov edx, dword [ecx]
lea eax, [esp + 0x228]
push eax
mov ecx, esi
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabdfb2
mov eax, dword [esp + 0x228]
mov dword [esp + 0x22c], eax
jmp 0xabdfb9
mov eax, dword [esp + 0x22c]
test esi, esi
js 0xabe046
lea ecx, [esp + 0x160]
mov edx, eax
push ecx
mov ecx, dword [esp + 0x164]
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
push 4
test esi, esi
js 0xabe048
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + 0x164]
inc eax
mov dword [esp + 0x58], eax
pop esi
cmp eax, dword [esp + 0xc]
jb 0xabdf87
lea eax, [esp + 0x30c]
mov dword [esp + 0x308], esi
push eax
mov edx, esi
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabe046
mov edx, dword [esp + 0x160]
mov ecx, dword [esp + 0x40]
add ecx, edi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xabd9e9
mov eax, dword [esp + 0x30c]
inc dword [esp + 0xc]
push 4
pop ecx
mov dword [edx], ecx
mov dword [eax], ecx
jmp 0xabe049
push 4
pop ecx
test esi, esi
js 0xac025a
lea eax, [esp + 0x230]
mov edx, ecx
push eax
call fcn.00a32533
mov edi, dword [esp + 0x230]
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
jns 0xabe07d
mov edi, dword [esp + 0x3d4]
jmp 0xabe1fd
lea eax, [esp + 0x234]
mov dword [esp + 0xdc], edi
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabe1fd
mov edi, dword [esp + 0x234]
mov ecx, dword [esp + 0xdc]
lea eax, [esp + 0xdc]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabe1fd
lea eax, [esp + 0x238]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabe1fd
mov edi, dword [esp + 0x238]
mov ecx, dword [esp + 0xdc]
lea eax, [esp + 0xdc]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabe1fd
lea eax, [esp + 0x23c]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabe1fd
mov edi, dword [esp + 0x23c]
mov ecx, dword [esp + 0xdc]
lea eax, [esp + 0xdc]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabe1fd
lea eax, [esp + 0x240]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabe1fd
mov edi, dword [esp + 0x240]
mov ecx, dword [esp + 0xdc]
lea eax, [esp + 0xdc]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabe1fd
lea eax, [esp + 0x244]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabe1fd
mov edi, dword [esp + 0x244]
mov ecx, dword [esp + 0xdc]
lea eax, [esp + 0xdc]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
mov eax, dword [esp + 0xdc]
mov dword [esp + 0x14], esi
test esi, esi
jns 0xabe204
mov eax, dword [esp + 0x174]
mov dword [esp + 0x20], eax
test esi, esi
js 0xac025a
rdtsc
mov edi, ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x80], edi
mov dword [esp + 0x98], ebx
mov dword [esp + 0x124], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0x38], eax
mov dword [esp + 0x48], edx
push 8
pop ecx
mov dword [esp + 0x1a8], ecx
mov edx, dword [esp + 0x40]
lea eax, [esp + 0x1a8]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabe368
mov eax, dword [esp + 0x1a8]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [esp + 0x4c], ecx
cmp ecx, eax
jae 0xabe29a
mov esi, 0xc0000095
jmp 0xabe368
mov dword [esp + 0x1a8], ecx
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xabe2c3
mov esi, 0xc0000017
mov edi, ebx
jmp 0xabe368
mov eax, dword [esp + 0xc]
mov ecx, edi
mov dword [edi], eax
lea eax, [esp + 0x198]
push eax
push 4
pop eax
mov edx, eax
mov dword [esp + 0x19c], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabe34e
mov ecx, dword [esp + 0x198]
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
lea eax, [esp + 0x198]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabe34e
mov eax, dword [esp + 0x4c]
push dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
push dword [esp + 0xc0]
mov dword [edi + eax - 8], ecx
mov ecx, dword [esp + 0x50]
push dword [esp + 0x1a0]
mov dword [edi + eax - 4], ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [esp + 0x58]
add esp, 0xc
mov dword [esp + 0x24], edi
mov edi, ebx
mov dword [esp + 0x80], eax
test edi, edi
je 0xabe361
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [esp + 0x80]
or esi, 0x10000000
mov dword [esp + 0x14], esi
jl 0xabfb8f
cmp dword [esp + 0x24], 0
mov dword [esp + 0x4c], ebx
jne 0xabe38d
mov esi, 0xc000000d
jmp 0xabe924
test edi, edi
je 0xabe91f
lea eax, [edi + 8]
mov ecx, eax
mov dword [esp + 0x38], eax
call fcn.00ad193e
mov esi, eax
mov dword [esp + 0x8c], esi
test esi, esi
je 0xabe91f
mov cl, bl
mov edx, ebx
test edi, edi
je 0xabe3c8
mov eax, dword [esp + 0x24]
xor cl, byte [edx + eax]
inc edx
cmp edx, edi
jb 0xabe3c0
mov eax, 0xb1b54a58
mov dword [esp + 0x7a8], eax
mov eax, 0xc81ecb17
mov dword [esp + 0x7ac], eax
mov eax, edi
shr eax, 3
mov dword [esp + 0x48], eax
test eax, eax
je 0xabe768
movzx edx, word [esp + 0x7aa]
mov eax, 0xc81ecb17
movzx esi, ax
movzx eax, word [esp + 0x7ae]
mov dword [esp + 0x58], eax
mov eax, 0xb1b54a58
movzx eax, ax
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x5c], esi
add eax, 7
mov esi, dword [esp + 0x24]
add esi, 2
mov dword [esp + 0x44], edx
or dword [esp + 0x14], 0xffffffff
mov edx, ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x74], eax
mov dword [esp + 0x9c], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [esp + 0x9c]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [esp + 0x9c]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [esp + 0x9c]
shl esi, 8
add dword [esp + 0x9c], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov eax, ebx
sub eax, dword [esp + 0x3c]
xor eax, edi
xor eax, edx
xor eax, 0xc81ecb17
mov edx, eax
mov dword [esp + 0x14], eax
xor edx, 0xc81ecb17
ror eax, 7
ror edx, 0xf
imul edx, dword [esp + 0x44]
add edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
mov eax, ebx
ror eax, 0xa
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [esp + 0x5c]
sub edx, eax
mov eax, dword [esp + 0x14]
xor eax, edx
mov edx, eax
mov dword [esp + 0x14], eax
xor edx, dword [esp + 0x5c]
rol edx, 4
imul edx, dword [esp + 0x58]
rol eax, 5
add edx, eax
mov eax, 0xc81ecb17
xor ebx, edx
mov edx, 0xb1b54a58
xor edx, ebx
sub eax, edx
mov edx, dword [esp + 0x14]
xor edx, eax
mov dword [esp + 0x14], edx
sub edx, dword [esp + 0x3c]
imul edx, dword [esp + 0x44]
mov eax, dword [esp + 0x14]
shr eax, 6
sub edx, eax
xor ebx, edx
mov edx, dword [esp + 0x14]
mov eax, ebx
ror eax, 0xf
xor eax, dword [esp + 0x5c]
imul eax, dword [esp + 0x3c]
xor edx, eax
mov eax, edx
not eax
ror eax, 3
add eax, dword [esp + 0x58]
imul eax, dword [esp + 0x5c]
xor ebx, eax
mov eax, ebx
sub eax, dword [esp + 0x3c]
sub eax, 0xc81ecb17
xor edx, eax
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
xor eax, dword [esp + 0x58]
imul eax, dword [esp + 0x44]
ror edx, 0xa
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [esp + 0x3c]
rol edx, 6
imul edx, dword [esp + 0x5c]
ror eax, 3
xor edx, eax
mov eax, dword [esp + 0x14]
xor eax, edx
mov dword [esp + 0x14], eax
ror eax, 0xf
sub eax, dword [esp + 0x58]
imul eax, dword [esp + 0x3c]
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [esp + 0x58]
imul edx, dword [esp + 0x3c]
shr eax, 1
xor edx, eax
mov eax, ebx
xor dword [esp + 0x14], edx
mov edx, ebx
sub edx, dword [esp + 0x5c]
rol edx, 3
imul edx, dword [esp + 0x3c]
shr eax, 0xf
xor edx, eax
mov eax, dword [esp + 0x14]
xor eax, edx
mov edx, eax
mov dword [esp + 0x14], eax
sub edx, dword [esp + 0x5c]
imul edx, dword [esp + 0x44]
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 9
imul edx, dword [esp + 0x5c]
ror eax, 0xb
xor edx, eax
mov eax, dword [esp + 0x14]
xor eax, edx
mov dword [esp + 0x14], eax
sub eax, 0xb1b54a58
sub eax, dword [esp + 0x58]
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [esp + 0x44]
imul eax, dword [esp + 0x3c]
ror edx, 7
sub eax, edx
mov edx, dword [esp + 0x14]
xor edx, eax
mov dword [esp + 0x14], edx
xor edx, dword [esp + 0x58]
mov eax, dword [esp + 0x14]
rol edx, 4
imul edx, dword [esp + 0x44]
ror eax, 0x10
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 0xa
imul edx, dword [esp + 0x5c]
ror eax, 4
add edx, eax
mov eax, dword [esp + 0x14]
xor eax, edx
mov edx, eax
mov dword [esp + 0x14], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, dword [esp + 0x58]
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, 0xc81ecb17
rol eax, 2
rol edx, 8
imul edx, dword [esp + 0x3c]
sub edx, eax
mov eax, dword [esp + 0x14]
xor eax, edx
mov edx, 0xc81ecb17
sub edx, eax
mov dword [esp + 0x14], eax
ror edx, 0xb
imul edx, dword [esp + 0x44]
ror eax, 0xc
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [esp + 0x44]
imul edx, dword [esp + 0x5c]
shr eax, 8
xor edx, eax
mov eax, 0xb1b54a58
xor dword [esp + 0x14], edx
xor eax, 0xc81ecb17
mov edx, dword [esp + 0x14]
xor ebx, eax
mov eax, dword [esp + 0x74]
xor ebx, edx
xor edx, dword [esp + 0xbc]
xor ebx, dword [esp + 0xc0]
mov dword [esp + 0xc0], esi
mov esi, dword [esp + 0x9c]
mov byte [eax - 4], dl
mov byte [eax], bl
ror edx, 8
mov byte [eax - 5], dl
ror ebx, 8
mov byte [eax - 1], bl
ror edx, 8
mov byte [eax - 6], dl
ror ebx, 8
mov byte [eax - 2], bl
ror edx, 8
ror ebx, 8
mov byte [eax - 7], dl
mov byte [eax - 3], bl
add eax, 8
ror edx, 8
ror ebx, 8
sub dword [esp + 0x48], 1
mov dword [esp + 0xbc], edi
mov dword [esp + 0x74], eax
jne 0xabe456
mov edi, dword [esp + 0x80]
xor ebx, ebx
mov esi, dword [esp + 0x8c]
movzx eax, cl
cdq
mov dword [esi + edi], eax
mov dword [esi + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [esp + 0x48], edi
test edi, edi
jne 0xabe798
mov esi, 0xc0000017
jmp 0xabe88f
mov eax, dword [esp + 0x38]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xabe7b9
mov esi, 0xc0000017
jmp 0xabe82e
mov dword [edi + 4], eax
push dword [esp + 0x38]
push esi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xabe7b2
mov dword [edi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0xc94df0
push 8
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x4c]
pop eax
push eax
push eax
mov dword [edi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0xabe7b2
mov dword [edi + 0x14], ecx
mov eax, dword [0xc94e90]
mov esi, ebx
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [esp + 0x4c], edi
mov edi, ebx
mov dword [ecx + 4], eax
test edi, edi
je 0xabe88f
cmp dword [edi + 4], 0
je 0xabe84c
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xabe866
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xabe880
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xabe8a2
mov eax, dword [esp + 0x4c]
mov edi, ebx
mov dword [esp + 0x98], eax
jmp 0xabe8a6
mov edi, dword [esp + 0x4c]
mov eax, dword [esp + 0x8c]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xabe924
cmp dword [edi + 4], 0
je 0xabe8da
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xabe8f4
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xabe90e
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xabe924
mov esi, 0xc0000001
or esi, 0x10000000
mov dword [esp + 0x14], esi
jl 0xabfb8f
mov edi, dword [esp + 0x98]
lea eax, [esp + 0x94]
push 4
pop ecx
push eax
mov edx, dword [edi]
mov dword [esp + 0x98], ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabe9d9
mov ecx, dword [esp + 0x94]
lea eax, [esp + 0x94]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabe9d9
mov edx, dword [edi + 8]
lea eax, [esp + 0x94]
mov ecx, dword [esp + 0x94]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabe9d9
mov ecx, dword [esp + 0x94]
lea eax, [esp + 0x94]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabe9d9
mov edx, dword [edi + 0x10]
lea eax, [esp + 0x94]
mov ecx, dword [esp + 0x94]
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [esp + 0x94]
test esi, esi
jns 0xabe9e0
mov eax, dword [esp + 0x3e0]
mov dword [esp + 0x38], eax
test esi, esi
js 0xabeb3a
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xabea0c
mov esi, 0xc0000017
jmp 0xabeb3a
mov eax, dword [esp + 0x98]
mov ecx, edi
mov dword [esp + 0x68], edi
mov eax, dword [eax]
mov dword [edi], eax
lea eax, [esp + 0x68]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabeb27
mov esi, dword [esp + 0x98]
push dword [esi]
push dword [esi + 4]
push dword [esp + 0x70]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [esi]
lea eax, [esp + 0x74]
mov ecx, dword [esp + 0x74]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabeb27
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0x68]
mov eax, dword [eax + 8]
mov dword [ecx], eax
lea eax, [esp + 0x68]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabeb27
mov esi, dword [esp + 0x98]
push dword [esi + 8]
push dword [esi + 0xc]
push dword [esp + 0x70]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [esi + 8]
lea eax, [esp + 0x74]
mov ecx, dword [esp + 0x74]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabeb27
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0x68]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
lea eax, [esp + 0x68]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabeb27
mov esi, dword [esp + 0x98]
push dword [esi + 0x10]
push dword [esi + 0x14]
push dword [esp + 0x70]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [esi + 0x10]
lea eax, [esp + 0x74]
mov ecx, dword [esp + 0x74]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabeb27
mov eax, dword [esp + 0x38]
mov dword [esp + 0x124], edi
mov edi, ebx
mov dword [esp + 0x18], eax
test edi, edi
je 0xabeb3a
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
mov dword [esp + 0x14], esi
jl 0xabfb8f
push 8
pop edi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x1d0], edi
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x1d0]
push eax
mov ecx, edi
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
mov dword [esp + 0x14], esi
jl 0xabebe0
mov eax, dword [esp + 0x1d0]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xabeb99
mov esi, 0xc0000095
mov dword [esp + 0x14], esi
jmp 0xabebc0
mov dword [esp + 0x1d4], ecx
lea eax, [esp + 0x1d4]
mov edx, edi
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [esp + 0x1d4]
mov dword [esp + 0x14], esi
test esi, esi
jns 0xabebc7
mov eax, dword [esp + 0x248]
mov dword [esp + 0x4c], eax
test esi, esi
js 0xabebe0
mov eax, dword [esp + 0x60]
test eax, eax
jne 0xabec0e
mov esi, 0xc000000d
mov dword [esp + 0x14], esi
mov edi, ebx
test esi, esi
js 0xabfb8f
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xabee55
mov esi, 0xd0000017
mov ecx, ebx
jmp 0xabee63
mov edi, dword [esp + 0xc]
cmp edi, 1
jbe 0xabebd7
mov ecx, eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x120], ecx
mov eax, dword [ecx]
mov dword [esp + 0x74], eax
lea eax, [esp + 0x120]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabebe0
mov edx, dword [esp + 0x74]
lea eax, [esp + 0x120]
mov ecx, dword [esp + 0x120]
push eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabebe0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x120]
inc eax
mov dword [esp + 0x20], eax
cmp eax, 1
jb 0xabec24
mov eax, dword [ecx]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x120]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabebe0
mov eax, dword [esp + 0x20]
mov dword [esp + 0x38], eax
neg eax
sbb eax, eax
and dword [esp + 0x120], eax
test esi, esi
js 0xabebe0
cmp edi, 2
mov edi, ebx
ja 0xabecd7
mov esi, 0xc000000d
mov dword [esp + 0x14], esi
jmp 0xabebe2
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x110], ecx
mov eax, dword [ecx]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x110]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabebe0
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x110]
mov ecx, dword [esp + 0x110]
push eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabebe0
mov ecx, dword [esp + 0x110]
inc edi
cmp edi, 2
jb 0xabece2
mov edi, dword [ecx]
lea eax, [esp + 0x110]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabebe0
mov dword [esp + 0x48], edi
neg edi
sbb edi, edi
and dword [esp + 0x110], edi
test esi, esi
js 0xabebe0
mov edx, dword [esp + 0x4c]
lea eax, [esp + 0x90]
push 4
pop edi
push eax
mov ecx, edi
mov dword [esp + 0x94], edi
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabee2a
mov ecx, dword [esp + 0x90]
lea eax, [esp + 0x90]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabee2a
mov edx, dword [esp + 0x38]
lea eax, [esp + 0x90]
mov ecx, dword [esp + 0x90]
push eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabee2a
mov ecx, dword [esp + 0x90]
lea eax, [esp + 0x90]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabee2a
mov edx, dword [esp + 0x48]
lea eax, [esp + 0x90]
mov ecx, dword [esp + 0x90]
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x14], esi
test esi, esi
jns 0xabee39
mov eax, dword [esp + 0x384]
test esi, esi
js 0xabebe0
cmp eax, 0x400000
jbe 0xabee4a
mov esi, 0x8000ffff
jmp 0xabfb8b
mov edi, eax
mov dword [esp + 0x28], edi
jmp 0xabebe2
mov ecx, eax
mov dword [esp + 0xb4], ecx
mov esi, 0x10000000
mov dword [esp + 0x14], esi
test esi, esi
js 0xabfb8f
mov eax, dword [esp + 0x124]
test eax, eax
jne 0xabee84
mov esi, 0x80070057
jmp 0xabfb8b
test ecx, ecx
je 0xabee7a
mov dword [esp + 0x354], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x35c], eax
lea eax, [esp + 0x24c]
push eax
xor eax, eax
mov dword [esp + 0x35c], ecx
push 0x9f29b8
inc eax
mov dword [esp + 0x368], edi
push eax
mov dword [esp + 0x370], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xabeef6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
jle 0xabeee9
movzx esi, si
or esi, 0x80070000
mov dword [esp + 0x14], esi
test esi, esi
js 0xabef41
mov esi, 0x80004005
mov dword [esp + 0x14], esi
jmp 0xabef41
push 0x9fc030
push dword [esp + 0x250]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xabeeca
push ebx
push 0x14
lea eax, [esp + 0x35c]
mov ecx, esi
push eax
push 0x86
call dword [0xc99200]
call esi
mov esi, eax
or esi, 0x10000000
mov dword [esp + 0x14], esi
jl 0xabef41
mov edi, dword [esp + 0x360]
mov dword [esp + 0x28], edi
cmp esi, 0xd0000023
jne 0xabef53
mov esi, 0x8007007a
jmp 0xabfb8b
test esi, esi
js 0xabfb8f
mov eax, dword [esp + 0xb4]
push 4
pop edx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xe0], eax
cmp edi, edx
jae 0xabef88
mov esi, 0xc000003e
jmp 0xabf356
mov edi, dword [eax]
lea ecx, [esp + 0xe0]
push ecx
mov ecx, eax
mov dword [esp + 0x3c], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabf356
lea eax, [esp + 0xac]
xor ecx, ecx
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabf356
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0xac]
cmp eax, edi
jb 0xabef7e
mov eax, dword [esp + 0xe0]
lea ecx, [esp + 0xe0]
push ecx
mov edx, edi
mov dword [esp + 0x1c], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabf356
mov ecx, dword [esp + 0xac]
lea eax, [esp + 0xac]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabf356
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0xac]
push 4
pop edx
cmp eax, edx
jb 0xabef7e
mov ecx, dword [esp + 0xe0]
lea eax, [esp + 0xe0]
push eax
mov edi, dword [ecx]
mov dword [esp + 0x4c], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabf356
mov ecx, dword [esp + 0xac]
lea eax, [esp + 0xac]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabf356
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0xac]
cmp eax, edi
jb 0xabef7e
mov eax, dword [esp + 0xe0]
lea ecx, [esp + 0xe0]
push ecx
mov edx, edi
mov dword [esp + 0x24], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabf356
mov ecx, dword [esp + 0xac]
lea eax, [esp + 0xac]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabf356
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0xac]
push 4
pop edx
cmp eax, edx
jb 0xabef7e
mov ecx, dword [esp + 0xe0]
mov eax, dword [ecx]
mov dword [esp + 0x4c], eax
lea eax, [esp + 0xe0]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabf356
mov ecx, dword [esp + 0xac]
lea eax, [esp + 0xac]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabf356
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0xac]
mov ecx, dword [esp + 0x4c]
cmp eax, ecx
jb 0xabef7e
lea eax, [esp + 0xac]
mov edx, ecx
mov ecx, dword [esp + 0xac]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabf356
mov edx, dword [esp + 0x28]
mov eax, edx
sub eax, dword [esp + 0xac]
jne 0xabef7e
mov esi, dword [esp + 0x38]
mov ecx, dword [esp + 0x4c]
add ecx, 0xc
lea eax, [edi + esi]
add eax, ecx
cmp eax, edx
jne 0xabef7e
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xabf1b0
mov esi, 0xc0000017
jmp 0xabf2db
cmp dword [esp + 0x18], 0
je 0xabf1ea
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xabf1d7
mov esi, 0xc0000017
jmp 0xabf27a
mov dword [edi + 4], eax
push esi
push dword [esp + 0x1c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0xabf1ef
mov dword [edi], ebx
mov dword [edi + 4], ebx
cmp dword [esp + 0x20], 0
je 0xabf224
mov esi, dword [esp + 0x48]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xabf1cd
mov dword [edi + 0xc], eax
push esi
push dword [esp + 0x24]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0xabf22a
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
cmp dword [esp + 0xe0], 0
je 0xabf269
mov esi, dword [esp + 0x4c]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xabf1cd
mov dword [edi + 0x14], eax
push esi
push dword [esp + 0xe4]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0xabf26f
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [esp + 0x8c], edi
mov esi, ebx
mov edi, ebx
test edi, edi
je 0xabf2db
cmp dword [edi + 4], 0
je 0xabf298
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xabf2b2
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xabf2cc
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xabf2ee
mov eax, dword [esp + 0x8c]
mov edi, ebx
mov dword [esp + 0x54], eax
jmp 0xabf2f5
mov edi, dword [esp + 0x8c]
test edi, edi
je 0xabf356
cmp dword [edi + 4], 0
je 0xabf313
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xabf32d
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xabf347
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
mov dword [esp + 0x14], esi
jl 0xabfb8f
mov ecx, dword [esp + 0x54]
mov edi, ebx
mov dword [esp + 0x74], ebx
test ecx, ecx
jne 0xabf37e
mov esi, 0xd000000d
jmp 0xabfb8b
mov eax, dword [ecx + 4]
mov dword [esp + 0x48], eax
test eax, eax
je 0xabf374
mov esi, dword [ecx]
test esi, esi
je 0xabf374
add esi, 0xfffffff8
mov ecx, esi
mov dword [esp + 0x8c], esi
call fcn.00ad193e
mov dword [esp + 0x38], eax
test eax, eax
je 0xabf8d5
mov ecx, 0xab69605e
mov dword [esp + 0xbc], eax
mov dword [esp + 0x7b0], ecx
mov edi, esi
mov ecx, 0x7f1137f
mov dl, bl
mov dword [esp + 0x7b4], ecx
mov eax, ebx
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x14], ecx
and edi, 7
je 0xabf88a
mov dword [esp + 0x3c], ebx
mov ecx, ebx
mov dword [esp + 0x9c], eax
mov dword [esp + 0x18], ecx
test edi, edi
je 0xabf440
mov ebx, dword [esp + 0x14]
push 0x38
pop esi
movzx eax, byte [ebx]
inc ebx
cmp ecx, 4
jge 0xabf415
lea ecx, [esi - 0x20]
shl eax, cl
or dword [esp + 0x9c], eax
jmp 0xabf41d
mov ecx, esi
shl eax, cl
or dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x18]
sub esi, 8
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, edi
jl 0xabf3fe
mov eax, ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x14], eax
xor ebx, ebx
mov eax, dword [esp + 0x9c]
mov esi, dword [esp + 0x3c]
xor eax, 0x92f65a5
xor esi, 0x699a899c
mov dword [esp + 0x80], eax
mov dword [esp + 0xc], esi
mov ecx, ebx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x28], esi
test edi, edi
je 0xabf4b2
mov eax, dword [esp + 0xbc]
push 4
pop esi
lea ebx, [eax + 1]
mov dword [esp + 0x18], ebx
cmp ecx, esi
jge 0xabf488
rol dword [esp + 0x4c], 8
mov ebx, dword [esp + 0x4c]
jmp 0xabf491
rol dword [esp + 0x28], 8
mov ebx, dword [esp + 0x28]
mov byte [eax], bl
inc ecx
mov ebx, dword [esp + 0x18]
mov eax, ebx
cmp ecx, edi
jl 0xabf472
mov eax, dword [esp + 0x80]
mov esi, dword [esp + 0xc]
mov dword [esp + 0xbc], ebx
xor ebx, ebx
push 4
pop ecx
cmp edi, ecx
jbe 0xabf86b
push 8
pop ecx
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [esp + 0xc], esi
mov esi, dword [esp + 0x8c]
mov eax, esi
shr eax, 3
mov dword [esp + 0x20], eax
test eax, eax
je 0xabf83a
movzx esi, word [esp + 0x7b2]
mov ebx, 0x7f1137f
movzx ecx, word [esp + 0x7b6]
mov edi, 0xab69605e
movzx eax, bx
xor ebx, edi
mov dword [esp + 0x44], eax
movzx eax, di
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0xbc]
mov dword [esp + 0x58], esi
add eax, 7
mov esi, dword [esp + 0x14]
add esi, 2
mov dword [esp + 0xc0], ebx
mov ebx, dword [esp + 0x80]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [esp + 0x14]
xor ebx, edi
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [esp + 0x14]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [esp + 0x14]
shl esi, 8
add dword [esp + 0x14], 8
movzx eax, byte [eax + 5]
or esi, eax
mov eax, 0xab69605e
xor ecx, esi
xor eax, 0x7f1137f
xor eax, ecx
xor eax, ebx
mov ecx, eax
mov dword [esp + 0xc], eax
sub ecx, 0xab69605e
rol eax, 0xa
rol ecx, 5
imul ecx, dword [esp + 0x44]
add ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea ecx, [ecx + ebx]
ror ecx, 9
imul ecx, dword [esp + 0x58]
sub ecx, eax
mov eax, dword [esp + 0xc]
xor eax, ecx
mov ecx, eax
mov dword [esp + 0xc], eax
sub ecx, dword [esp + 0x44]
imul ecx, dword [esp + 0x5c]
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [esp + 0x58]
rol ecx, 6
imul ecx, dword [esp + 0x28]
rol eax, 2
sub ecx, eax
mov eax, dword [esp + 0xc]
xor eax, ecx
mov ecx, 0xab69605e
xor ecx, eax
mov dword [esp + 0xc], eax
mov eax, 0x7f1137f
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, dword [esp + 0x44]
imul eax, dword [esp + 0x58]
ror ecx, 6
xor ecx, eax
mov eax, dword [esp + 0xc]
xor eax, ecx
mov ecx, 0x7f1137f
add ecx, eax
mov dword [esp + 0xc], eax
ror ecx, 0xf
imul ecx, dword [esp + 0x5c]
rol eax, 2
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [esp + 0x28]
sub ecx, eax
mov eax, dword [esp + 0xc]
xor eax, ecx
mov ecx, 0xab69605e
xor ecx, eax
mov dword [esp + 0xc], eax
ror ecx, 0xc
imul ecx, dword [esp + 0x44]
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [esp + 0x28]
imul ecx, dword [esp + 0x58]
shr eax, 0xa
xor ecx, eax
xor dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
mov eax, ecx
not eax
ror eax, 5
add eax, dword [esp + 0x5c]
imul eax, dword [esp + 0x28]
xor ebx, eax
mov eax, ebx
sub eax, dword [esp + 0x28]
xor eax, 0xab69605e
xor ecx, eax
mov dword [esp + 0xc], ecx
xor ecx, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
rol ecx, 2
imul ecx, dword [esp + 0x44]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 6
imul ecx, dword [esp + 0x58]
rol eax, 7
add ecx, eax
mov eax, dword [esp + 0xc]
xor eax, ecx
mov dword [esp + 0xc], eax
mov ecx, eax
xor eax, dword [esp + 0x44]
imul eax, dword [esp + 0x5c]
ror ecx, 9
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [esp + 0x58]
rol ecx, 5
imul ecx, dword [esp + 0x28]
rol eax, 7
add ecx, eax
mov eax, dword [esp + 0xc0]
xor dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
xor eax, ecx
xor ebx, eax
mov eax, ebx
ror eax, 3
sub eax, dword [esp + 0x58]
imul eax, dword [esp + 0x44]
xor ecx, eax
mov dword [esp + 0xc], ecx
mov eax, 0x7f1137f
sub ecx, eax
mov eax, dword [esp + 0xc]
ror ecx, 1
imul ecx, dword [esp + 0x5c]
ror eax, 6
sub ecx, eax
xor ebx, ecx
mov ecx, 0xab69605e
mov eax, ebx
rol eax, 0xe
lea ecx, [ecx + ebx]
rol ecx, 3
imul ecx, dword [esp + 0x28]
add ecx, eax
mov eax, dword [esp + 0xc]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [esp + 0xc], eax
rol ecx, 0xf
imul ecx, dword [esp + 0x44]
ror eax, 0xe
sub ecx, eax
xor ebx, ecx
mov ecx, dword [esp + 0x5c]
xor ecx, ebx
mov eax, ebx
imul ecx, dword [esp + 0x58]
shr eax, 3
xor ecx, eax
mov eax, dword [esp + 0xc]
xor eax, ecx
mov ecx, 0x7f1137f
xor ecx, eax
mov dword [esp + 0xc], eax
rol ecx, 4
imul ecx, dword [esp + 0x5c]
rol eax, 2
xor ecx, eax
mov eax, dword [esp + 0x18]
xor ecx, dword [esp + 0x9c]
xor ebx, ecx
mov dword [esp + 0x9c], edi
mov ecx, dword [esp + 0xc]
xor ecx, dword [esp + 0x3c]
mov byte [eax - 4], bl
mov byte [eax], cl
ror ebx, 8
mov byte [eax - 5], bl
ror ecx, 8
mov byte [eax - 1], cl
ror ebx, 8
mov byte [eax - 6], bl
ror ecx, 8
mov byte [eax - 2], cl
ror ebx, 8
ror ecx, 8
mov byte [eax - 7], bl
mov byte [eax - 3], cl
add eax, 8
ror ebx, 8
ror ecx, 8
sub dword [esp + 0x20], 1
mov dword [esp + 0x3c], esi
mov esi, dword [esp + 0x14]
mov dword [esp + 0x18], eax
jne 0xabf542
mov esi, dword [esp + 0x8c]
xor ebx, ebx
mov ecx, dword [esp + 0x38]
mov eax, ebx
test esi, esi
je 0xabf84c
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0xabf844
mov edi, dword [esp + 0x48]
movzx eax, dl
cdq
cmp eax, dword [esi + edi]
jne 0xabf8a6
cmp edx, dword [esi + edi + 4]
jne 0xabf8a6
mov edi, ecx
mov dword [esp + 0x74], esi
mov ecx, ebx
mov esi, ebx
jmp 0xabf8ad
mov dword [esp + 0xc], ebx
jae 0xabf4cd
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [esp + 0x80], eax
jmp 0xabf4cd
or dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x80], eax
jmp 0xabf4d4
mov esi, 0xc004d501
mov edi, ebx
test ecx, ecx
je 0xabf8b6
call fcn.00ad1951
test esi, esi
js 0xabf8d5
mov eax, dword [esp + 0x74]
mov esi, 0x10000000
mov dword [esp + 0xa0], edi
mov edi, ebx
mov dword [esp + 0xa4], eax
jmp 0xabf8da
mov esi, 0xd0000001
mov dword [esp + 0x14], esi
test edi, edi
je 0xabf8f1
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xabfb8f
mov edi, dword [esp + 0xa4]
mov ecx, dword [esp + 0xa0]
push 4
pop edx
mov dword [esp + 0x134], ebx
mov dword [esp + 0x144], ecx
cmp edi, edx
jb 0xabfb80
mov eax, dword [ecx]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x144]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabfb85
lea eax, [esp + 0x134]
xor ecx, ecx
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabfb85
mov eax, edi
sub eax, dword [esp + 0x134]
push 4
pop edx
cmp eax, edx
jb 0xabfb80
mov ecx, dword [esp + 0x144]
lea eax, [esp + 0x144]
push eax
mov edi, dword [ecx]
mov dword [esp + 0x1c], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabfb85
mov ecx, dword [esp + 0x134]
lea eax, [esp + 0x134]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabfb85
mov eax, dword [esp + 0xa4]
mov ecx, dword [esp + 0x134]
sub eax, ecx
cmp eax, edi
jb 0xabfb80
lea eax, [esp + 0x134]
mov edx, edi
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabfb85
mov edx, dword [esp + 0xa4]
mov esi, dword [esp + 0xa0]
mov eax, dword [esp + 0x144]
add eax, edi
lea ecx, [edx + esi]
cmp ecx, eax
jb 0xabfb80
mov eax, dword [esp + 0x144]
sub edx, edi
sub edx, eax
add edx, esi
cmp edx, 8
jae 0xabfb80
mov dword [esp + 0xbc], ebx
mov ecx, ebx
mov dword [esp + 0x20], ecx
mov esi, ebx
test eax, eax
je 0xabfb12
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1a4]
push ecx
mov ecx, eax
mov edi, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabfb85
mov eax, dword [esp + 0x1a4]
jmp 0xabfb00
lea eax, [esp + 0x250]
mov ecx, edi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabfb85
mov eax, dword [esp + 0x1a4]
cmp dword [esp + 0x250], eax
ja 0xabfb37
mov edx, dword [edi]
lea eax, [esp + 0x254]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabfabd
mov eax, dword [esp + 0x254]
mov dword [esp + 0x258], eax
jmp 0xabfac4
mov eax, dword [esp + 0x258]
test esi, esi
js 0xabfb85
lea ecx, [esp + 0x164]
mov edx, eax
push ecx
mov ecx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xabfb85
mov edi, dword [esp + 0x164]
mov eax, dword [esp + 0x1a4]
cmp edi, eax
ja 0xabfb37
inc dword [esp + 0xbc]
cmp edi, eax
jb 0xabfa61
cmp edi, eax
jne 0xabfb37
mov edi, dword [esp + 0x18]
mov ecx, ebx
test edi, edi
je 0xabfb40
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [esp + 0x20], ecx
test ecx, ecx
jne 0xabfb3e
mov esi, 0xc0000017
jmp 0xabfb6f
mov esi, 0xc000000d
jmp 0xabfb85
mov esi, ebx
mov eax, dword [esp + 0x144]
test eax, eax
je 0xabfb5a
push edi
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [esp + 0x2c]
add esp, 0xc
mov eax, dword [esp + 0xbc]
mov dword [esp + 0x150], ecx
mov dword [esp + 0x148], eax
test esi, esi
js 0xabfb85
mov eax, dword [esp + 0x38]
cmp eax, dword [esp + 0x148]
je 0xabfb85
mov esi, 0xc000003e
or esi, 0x10000000
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x24]
test eax, eax
je 0xabfba6
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [esp + 0x98]
test edi, edi
je 0xabfc0e
cmp dword [edi + 4], 0
je 0xabfbcb
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xabfbe5
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xabfbff
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [esp + 0x124]
test eax, eax
je 0xabfc28
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [esp + 0xb4]
test eax, eax
je 0xabfc42
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [esp + 0x54]
test edi, edi
je 0xabfca7
cmp dword [edi + 4], 0
je 0xabfc64
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xabfc7e
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xabfc98
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [esp + 0xa0]
test eax, eax
je 0xabfcc1
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xac025a
xor eax, eax
inc eax
cmp dword [esp + 0x148], eax
jb 0xac0251
cmp dword [esp + 0x150], 0
jne 0xabfd61
mov esi, 0xc000000d
mov dword [esp + 0x14], esi
push 4
mov eax, ebx
pop edx
test esi, esi
js 0xac025a
cmp eax, 0xd0000023
jne 0xabfd09
mov eax, 0x8007007a
mov dword [esp + 0x30], eax
cmp eax, 0x8007007a
je 0xabfd1e
mov esi, eax
mov dword [esp + 0x14], esi
test eax, eax
js 0xac025a
cmp dword [esp + 0x148], 6
jne 0xac0251
cmp dword [esp + 0x150], 0
jne 0xabfddf
mov edx, dword [esp + 0x2cc]
mov esi, 0xc000000d
mov ecx, dword [esp + 0x2c8]
mov dword [esp + 0x14], esi
mov dword [esp + 0xb4], edx
mov dword [esp + 0x54], ecx
jmp 0xabfebc
cmp dword [esp + 0x148], 0
jbe 0xabfce3
mov eax, dword [esp + 0x150]
lea ecx, [esp + 0x128]
push ecx
push 4
pop ecx
mov edi, dword [eax]
mov edx, ecx
mov ecx, eax
mov dword [esp + 0x12c], eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabfdb3
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [esp + 0x128]
mov dword [esp + 0x128], eax
jmp 0xabfdc1
mov edi, dword [esp + 0x388]
mov eax, dword [esp + 0x38c]
test esi, esi
js 0xabfcec
push 4
pop edx
cmp edi, edx
jne 0xabd9e9
mov eax, dword [eax]
mov dword [esp + 0x30], eax
jmp 0xabfcf1
mov ecx, dword [esp + 0x150]
mov edi, ebx
mov dword [esp + 0x114], ecx
mov eax, dword [ecx]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x114]
push eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabfe76
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x114]
mov ecx, dword [esp + 0x114]
push eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabfe76
mov ecx, dword [esp + 0x114]
xor eax, eax
inc edi
inc eax
cmp edi, eax
jae 0xabfe42
push 4
pop edx
jmp 0xabfdef
mov edi, dword [ecx]
lea eax, [esp + 0x114]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabfe76
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [esp + 0x114]
mov dword [esp + 0x114], eax
jmp 0xabfe84
mov edi, dword [esp + 0x390]
mov eax, dword [esp + 0x394]
test esi, esi
js 0xabfea3
cmp edi, 8
jne 0xabd9e9
mov ecx, dword [eax]
mov dword [esp + 0x54], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0xb4], ecx
jmp 0xabfebc
mov eax, dword [esp + 0x2cc]
mov dword [esp + 0xb4], eax
mov eax, dword [esp + 0x2c8]
mov dword [esp + 0x54], eax
test esi, esi
js 0xac025a
cmp dword [esp + 0x150], 0
jne 0xabff05
mov esi, 0xc000000d
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x260]
push 4
pop edx
mov dword [esp + 0x24], eax
test esi, esi
js 0xac025a
cmp dword [esp + 0x150], 0
jne 0xabffc2
mov esi, 0xc000000d
jmp 0xac0256
mov ecx, dword [esp + 0x150]
mov edi, ebx
mov dword [esp + 0xb8], ecx
mov eax, dword [ecx]
mov dword [esp + 0x18], eax
lea eax, [esp + 0xb8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabff9a
mov edx, dword [esp + 0x18]
lea eax, [esp + 0xb8]
mov ecx, dword [esp + 0xb8]
push eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabff9a
mov ecx, dword [esp + 0xb8]
inc edi
cmp edi, 2
jb 0xabff15
mov edi, dword [ecx]
lea eax, [esp + 0xb8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xabff9a
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [esp + 0xb8]
mov dword [esp + 0xb8], eax
jmp 0xabffa8
mov edi, dword [esp + 0x398]
mov eax, dword [esp + 0x39c]
test esi, esi
js 0xabfed7
push 4
pop edx
cmp edi, edx
jne 0xabd9e9
mov eax, dword [eax]
jmp 0xabfee1
mov ecx, dword [esp + 0x150]
mov edi, ebx
mov dword [esp + 0x84], ecx
mov eax, dword [ecx]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x84]
push eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xac0059
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x84]
mov ecx, dword [esp + 0x84]
push eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xac0059
mov ecx, dword [esp + 0x84]
inc edi
cmp edi, 3
jae 0xac0023
push 4
pop edx
jmp 0xabffd2
mov edi, dword [ecx]
lea eax, [esp + 0x84]
push eax
push 4
pop eax
mov edx, eax
mov dword [esp + 0x3c], edi
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xac0059
neg edi
sbb edi, edi
and edi, dword [esp + 0x84]
mov dword [esp + 0x84], edi
jmp 0xac006b
mov eax, dword [esp + 0x3a0]
mov edi, dword [esp + 0x3a4]
mov dword [esp + 0x38], eax
test esi, esi
js 0xac025a
mov ecx, dword [esp + 0x150]
push 4
mov dword [esp + 0x80], ecx
mov dword [esp + 0x1c], ebx
pop edx
mov eax, dword [ecx]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x7c]
push eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xac0100
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x7c]
mov ecx, dword [esp + 0x7c]
push eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xac0100
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x7c]
inc eax
push 4
pop edx
mov dword [esp + 0x18], eax
cmp eax, edx
jb 0xac0088
mov eax, dword [ecx]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x7c]
push eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xac0100
mov ecx, dword [esp + 0x18]
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [esp + 0x7c]
mov dword [esp + 0x7c], eax
jmp 0xac010e
mov ecx, dword [esp + 0x3a8]
mov eax, dword [esp + 0x3ac]
push 4
pop edx
test esi, esi
js 0xac0121
cmp ecx, edx
jne 0xabd9e9
mov eax, dword [eax]
jmp 0xac0128
mov eax, dword [esp + 0x3b0]
mov dword [esp + 0x20], eax
test esi, esi
js 0xac025a
mov ecx, dword [esp + 0x150]
mov dword [esp + 0x50], ecx
mov dword [esp + 0x18], ebx
mov eax, dword [ecx]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x50]
push eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xac01c3
mov edx, dword [esp + 0x48]
lea eax, [esp + 0x50]
mov ecx, dword [esp + 0x50]
push eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xac01c3
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x50]
inc eax
mov dword [esp + 0x18], eax
cmp eax, 5
jae 0xac0190
push 4
pop edx
jmp 0xac0143
mov eax, dword [ecx]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x50]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
js 0xac01c3
mov ecx, dword [esp + 0x18]
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [esp + 0x50]
mov dword [esp + 0x50], eax
jmp 0xac01d1
mov ecx, dword [esp + 0x3b4]
mov eax, dword [esp + 0x3b8]
push 4
pop edx
test esi, esi
js 0xac01e4
cmp ecx, edx
jne 0xabd9e9
mov ecx, dword [eax]
jmp 0xac01e6
mov ecx, ebx
test esi, esi
js 0xac025a
mov eax, dword [esp + 0x6c]
cmp eax, dword [esp + 0x54]
jne 0xac0251
mov eax, dword [esp + 0x70]
cmp eax, dword [esp + 0xb4]
jne 0xac0251
mov dword [esp + 0x2c], ecx
cmp dword [esp + 0x20], edx
jbe 0xac021d
mov ecx, dword [esp + 0x24]
mov esi, 0x8007007a
mov dword [esp + 0x140], ecx
jmp 0xac0256
mov eax, dword [esp + 0x38]
cmp eax, edx
ja 0xac020b
push eax
push edi
push dword [esp + 0x3c]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [esp + 0x30]
add esp, 0xc
mov dword [esp + 0x140], eax
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x10]
test eax, eax
je 0xac025e
mov esi, eax
jmp 0xabd6f2
mov esi, 0xc004d501
mov dword [esp + 0x14], esi
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x2ec], ebx
mov dword [esp + 0x2e8], ebx
test eax, eax
je 0xac028a
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esp + 0x2f0], ebx
mov eax, dword [esp + 0x150]
mov dword [esp + 0x14c], ebx
mov dword [esp + 0x148], ebx
test eax, eax
je 0xac02b9
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esp + 0x150], ebx
test edi, edi
je 0xac02cc
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0xac02e3
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xabd599
mov eax, dword [esp + 0x2c]
test eax, eax
je 0xac68c5
mov dword [0xc95878], eax
mov esi, 0x104
push esi
lea eax, [esp + 0xcbc]
mov dword [esp + 0x1b8], ebx
push eax
push 0x9d0000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0xac481f
cmp eax, esi
jne 0xac0337
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0xac481f
mov esi, dword [0xc9307c]
mov ecx, esi
push 0x403
push ebx
push ebx
call dword [0xc99200]
call esi
mov dword [esp + 0x58], eax
test eax, eax
jne 0xac0361
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xac481f
mov esi, dword [0xc9304c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [0xc95870], eax
lea edi, [esp + 0x78c]
mov eax, dword [0xc95878]
mov dword [esp + 0x6c], eax
xor eax, eax
stosd dword es:[edi], eax
push 0x2c
push ebx
mov dword [0xc95874], edx
stosd dword es:[edi], eax
mov dword [esp + 0x2d8], ebx
mov dword [esp + 0x2dc], ebx
mov dword [esp + 0xa0], ebx
stosd dword es:[edi], eax
lea eax, [esp + 0x85c]
push eax
mov dword [esp + 0xc8], ebx
call fcn.00ab4bf6
add esp, 0xc
mov dword [esp + 0x124], ebx
xor ebx, ebx
mov edx, 0xc96238
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xac03ce
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jne 0xac0950
mov ecx, 0x338
mov dword [esp + 0x30], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
call fcn.00ad193e
mov dword [esp + 0x74], eax
test eax, eax
je 0xac08ec
or dword [esp + 0x18], 0xffffffff
mov edx, 0xab69605e
mov dword [esp + 0x8f8], edx
add eax, 7
mov edx, 0x7f1137f
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x8fc], edx
mov cl, bl
mov dword [esp + 0x10], ebx
mov edx, ebx
mov dword [esp + 0x20], eax
mov esi, 0x9fbcf2
mov dword [esp + 0x38], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [esp + 0xc], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [esp + 0x34], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [esp + 0x10]
xor esi, edx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [esp + 0xc]
xor eax, edx
mov dword [esp + 0xc], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [esp + 0xc]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [esp + 0xc]
sub edx, 0x756c8a2
xor eax, edx
mov dword [esp + 0xc], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [esp + 0xc]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [esp + 0xc]
xor edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [esp + 0xc]
xor eax, edx
mov dword [esp + 0xc], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [esp + 0xc]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [esp + 0xc]
xor eax, edx
mov dword [esp + 0xc], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [esp + 0xc]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [esp + 0xc]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [esp + 0xc], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [esp + 0xc]
xor eax, 0xab69605e
mov dword [esp + 0x10], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [esp + 0x10]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [esp + 0x10]
xor eax, edx
mov dword [esp + 0x10], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [esp + 0x10], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [esp + 0x10]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [esp + 0x10]
xor eax, edx
mov dword [esp + 0x10], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [esp + 0x10]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [esp + 0x10]
xor eax, edx
mov edx, 0x7f1137f
mov dword [esp + 0x10], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [esp + 0x10]
rol eax, 2
xor edx, eax
mov eax, dword [esp + 0x10]
xor edx, dword [esp + 0x1c]
xor eax, dword [esp + 0x18]
xor esi, edx
mov edx, esi
mov dword [esp + 0xc], esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [esp + 0x38], 1
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x34]
mov dword [esp + 0x10], eax
jne 0xac044a
mov esi, dword [esp + 0x74]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xac0765
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xac0791
cmp edx, dword [0x9fc02c]
jne 0xac0791
mov dword [esp + 0x44], esi
mov edi, 0x337
mov esi, ebx
jmp 0xac079c
mov dword [esp + 0x48], 0xc004d501
or edi, 0xffffffff
test esi, esi
je 0xac07a7
mov ecx, esi
call fcn.00ad1951
cmp dword [esp + 0x48], ebx
jl 0xac08ec
mov eax, dword [esp + 0x44]
mov esi, eax
push 0x40
push ebx
push 0xc960a0
mov byte [edi + eax], bl
call fcn.00ab4bf6
mov eax, esi
add esp, 0xc
cmp byte [eax], bl
je 0xac08f3
mov edi, 0xc960a0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [esp + 0x34], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xac07e4
sub ecx, dword [esp + 0x34]
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xac08ec
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [esp + 0x28], ecx
cmp word [eax], dx
je 0xac0829
mov ecx, 0xc000007b
mov dword [esp + 0x28], ecx
jmp 0xac0873
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xac081e
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xac081e
cmp dword [edx], 0x4550
jne 0xac081e
movzx eax, word [edx + 0x18]
cmp ax, word [esp + 0x18c]
je 0xac0861
cmp ax, word [esp + 0x100]
je 0xac0861
mov ecx, 0xc000000d
jmp 0xac0823
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
test eax, eax
je 0xac08d7
mov edx, esi
mov dword [esp + 0x18], esi
lea eax, [edx + 1]
mov dword [esp + 0x34], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xac0893
sub edx, dword [esp + 0x34]
inc esi
add esi, edx
test ecx, ecx
js 0xac08c4
push dword [esp + 0x18]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xac08e2
mov ecx, dword [esp + 0x30]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
inc dword [esp + 0x30]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, dword [esp + 0x20]
jb 0xac0886
add edi, 0x10
cmp byte [esi], bl
jne 0xac07d9
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x44]
jmp 0xac08f5
mov esi, 0xc000007a
jmp 0xac08e6
mov esi, ebx
test eax, eax
je 0xac090b
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push dword [esp + 0x44]
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0xac094b
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xac0922
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xac0911
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xac0956
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov edx, 0xc96238
xchg dword [edx], eax
xor eax, eax
mov dword [esp + 0x60], ebx
lea edi, [esp + 0x374]
mov dword [esp + 0xa0], ebx
stosd dword es:[edi], eax
mov esi, ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0x70], ebx
xor ebx, ebx
stosd dword es:[edi], eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x9c], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xac0998
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jne 0xac0f2c
mov ecx, 0x338
mov dword [esp + 0x30], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
call fcn.00ad193e
mov dword [esp + 0x74], eax
test eax, eax
je 0xac0ec8
or dword [esp + 0x18], 0xffffffff
mov edx, 0xab69605e
mov dword [esp + 0x8f0], edx
add eax, 7
mov edx, 0x7f1137f
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x8f4], edx
mov cl, bl
mov dword [esp + 0x10], ebx
mov edx, ebx
mov dword [esp + 0x20], eax
mov esi, 0x9fbcf2
mov dword [esp + 0x38], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [esp + 0xc], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [esp + 0x34], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [esp + 0x10]
xor esi, edx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [esp + 0xc]
xor eax, edx
mov dword [esp + 0xc], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [esp + 0xc]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [esp + 0xc]
sub edx, 0x756c8a2
xor eax, edx
mov dword [esp + 0xc], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [esp + 0xc]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [esp + 0xc]
xor edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [esp + 0xc]
xor eax, edx
mov dword [esp + 0xc], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [esp + 0xc]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [esp + 0xc]
xor eax, edx
mov dword [esp + 0xc], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [esp + 0xc]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [esp + 0xc]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [esp + 0xc], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [esp + 0xc]
xor eax, 0xab69605e
mov dword [esp + 0x10], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [esp + 0x10]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [esp + 0x10]
xor eax, edx
mov dword [esp + 0x10], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [esp + 0x10], edx
mov edx, dword [esp + 0x10]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [esp + 0x10], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [esp + 0x10]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [esp + 0x10]
xor eax, edx
mov dword [esp + 0x10], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [esp + 0x10]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [esp + 0x10]
xor eax, edx
mov edx, 0x7f1137f
mov dword [esp + 0x10], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [esp + 0x10]
rol eax, 2
xor edx, eax
mov eax, dword [esp + 0x10]
xor edx, dword [esp + 0x1c]
xor eax, dword [esp + 0x18]
xor esi, edx
mov edx, esi
mov dword [esp + 0xc], esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [esp + 0x38], 1
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x34]
mov dword [esp + 0x10], eax
jne 0xac0a14
mov esi, dword [esp + 0x74]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xac0d2f
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xac0d5b
cmp edx, dword [0x9fc02c]
jne 0xac0d5b
mov dword [esp + 0x44], esi
mov edi, 0x337
mov esi, ebx
jmp 0xac0d66
mov dword [esp + 0x48], 0xc004d501
or edi, 0xffffffff
test esi, esi
je 0xac0d71
mov ecx, esi
call fcn.00ad1951
cmp dword [esp + 0x48], ebx
jl 0xac0ec8
mov eax, dword [esp + 0x44]
mov esi, eax
push 0x40
push ebx
push 0xc960a0
mov byte [edi + eax], bl
call fcn.00ab4bf6
mov eax, esi
add esp, 0xc
cmp byte [eax], bl
je 0xac0ecf
mov edi, 0xc960a0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [esp + 0x34], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xac0dae
sub ecx, dword [esp + 0x34]
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xac0ec1
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [esp + 0x28], ecx
cmp word [eax], dx
je 0xac0df3
mov ecx, 0xc000007b
mov dword [esp + 0x28], ecx
jmp 0xac0e3d
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xac0de8
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xac0de8
cmp dword [edx], 0x4550
jne 0xac0de8
movzx eax, word [edx + 0x18]
cmp ax, word [esp + 0x18c]
je 0xac0e2b
cmp ax, word [esp + 0x100]
je 0xac0e2b
mov ecx, 0xc000000d
jmp 0xac0ded
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
test eax, eax
je 0xac0ea1
mov edx, esi
mov dword [esp + 0x18], esi
lea eax, [edx + 1]
mov dword [esp + 0x34], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xac0e5d
sub edx, dword [esp + 0x34]
inc esi
add esi, edx
test ecx, ecx
js 0xac0e8e
push dword [esp + 0x18]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xac0eac
mov ecx, dword [esp + 0x30]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
inc dword [esp + 0x30]
inc eax
mov dword [esp + 0x1c], eax
cmp eax, dword [esp + 0x20]
jb 0xac0e50
add edi, 0x10
cmp byte [esi], bl
jne 0xac0da3
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x44]
jmp 0xac0ed1
mov esi, 0xc000007a
jmp 0xac0eb0
mov esi, 0xc000007a
jmp 0xac0ebb
mov esi, ebx
test eax, eax
je 0xac0ee7
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push dword [esp + 0x44]
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0xac0f27
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xac0efe
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xac0eed
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xac0f32
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
push 0x54
lea eax, [esp + 0x41c]
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
mov esi, dword [0xc9307c]
lea edi, [esp + 0x794]
add esp, 0xc
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
pop edx
push 0x403
push ebx
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
mov eax, dword [esp + 0x78]
mov ecx, eax
and ecx, edx
mov dword [esp + 0x48], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [esp + 0xc0c], cx
mov ecx, eax
shr ecx, 8
and ecx, edx
shr eax, 0xc
mov word [esp + 0xc0e], cx
and eax, edx
mov ecx, esi
mov word [esp + 0xc10], ax
call dword [0xc99200]
call esi
mov dword [esp + 0x5c], eax
mov dword [esp + 0x28], 0xffffff
test eax, eax
jne 0xac0fee
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
jle 0xac0fdb
movzx edi, di
or edi, 0x80070000
mov dword [esp + 0x10], edi
test edi, edi
js 0xac24ca
mov dword [esp + 0x10], 0x80004005
jmp 0xac24ca
mov esi, dword [0xc93050]
lea eax, [esp + 0x1a0]
push eax
push ebx
lea eax, [esp + 0x180]
mov dword [esp + 0x198], ebx
push eax
mov edi, ebx
mov dword [esp + 0x80], ebx
push 8
mov ecx, esi
mov dword [esp + 0xfc], edi
mov dword [esp + 0x194], ebx
mov dword [esp + 0x100], ebx
mov dword [esp + 0x17c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1b0], ebx
call dword [0xc99200]
call esi
test eax, eax
jne 0xac107b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [esp + 0x10], eax
test eax, eax
jle 0xac1068
movzx eax, ax
or eax, 0x80070000
mov dword [esp + 0x10], eax
test eax, eax
js 0xac11c5
mov dword [esp + 0x10], 0x80004005
jmp 0xac11c5
mov eax, dword [esp + 0x1a0]
lea ecx, [eax + eax]
call fcn.00ad193e
push eax
lea ecx, [esp + 0xf4]
call fcn.00ad1916
cmp dword [esp + 0xf0], 0
jne 0xac10ae
mov dword [esp + 0x10], 0x8007000e
jmp 0xac11c5
mov eax, dword [esp + 0x178]
lea ecx, [eax*4 + 4]
call fcn.00ad193e
push eax
lea ecx, [esp + 0x170]
call fcn.00ad1916
mov esi, dword [esp + 0x16c]
test esi, esi
je 0xac10a1
mov ebx, dword [0xc93050]
lea eax, [esp + 0x1a0]
push eax
push dword [esp + 0xf4]
lea eax, [esp + 0x180]
mov ecx, ebx
push eax
push 8
call dword [0xc99200]
call ebx
test eax, eax
jne 0xac1133
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [esp + 0x10], eax
test eax, eax
jle 0xac1122
movzx eax, ax
or eax, 0x80070000
mov dword [esp + 0x10], eax
test eax, eax
js 0xac112c
mov dword [esp + 0x10], 0x80004005
xor ebx, ebx
jmp 0xac11c5
xor ebx, ebx
mov edx, esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x178], ebx
jbe 0xac11a3
mov esi, dword [esp + 0xf0]
mov edi, dword [0xc93058]
mov ecx, edi
push ebx
push esi
call dword [0xc99200]
call edi
mov edx, dword [esp + 0x1c]
mov ecx, esi
mov dword [edx], eax
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xac116c
sub ecx, edi
sar ecx, 1
push 4
pop eax
add edx, eax
mov eax, dword [esp + 0x18]
lea esi, [esi + ecx*2]
mov dword [esp + 0x1c], edx
add esi, 2
inc eax
mov dword [esp + 0x18], eax
cmp eax, dword [esp + 0x178]
jb 0xac114f
mov esi, dword [esp + 0x16c]
mov dword [edx], 0x409
mov edi, esi
mov eax, dword [esp + 0x178]
inc eax
mov dword [esp + 0x16c], ebx
mov dword [esp + 0xec], edi
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x16c]
call fcn.00ad18c0
lea ecx, [esp + 0xf0]
call fcn.00ad18c0
cmp dword [esp + 0x10], 0
jl 0xac18c4
cmp dword [esp + 0x1c], 0
mov eax, ebx
mov dword [esp + 0x30], eax
mov edx, ebx
jbe 0xac1218
mov ecx, ebx
mov eax, dword [edi + edx*4]
cmp eax, dword [ecx*4 + 0xa192e8]
je 0xac1312
inc ecx
cmp ecx, 0x26
jb 0xac11f9
inc edx
cmp edx, dword [esp + 0x1c]
jb 0xac11f7
mov eax, ebx
mov esi, dword [0xc93054]
lea ecx, [esp + 0xc08]
push ebx
push 0x55
push ecx
push dword [eax*4 + 0xa192e8]
mov ecx, esi
mov dword [esp + 0x58], ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xac127d
mov esi, dword [0xc93048]
lea eax, [esp + 0xa78]
push 0x10
push eax
push 0x58
lea eax, [esp + 0xc14]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
test eax, eax
jle 0xac127d
mov edi, dword [esp + 0xa84]
xor eax, eax
shr edi, 0x1b
inc eax
and edi, eax
mov dword [esp + 0x48], edi
mov edx, 0x9fba10
mov esi, ebx
mov ecx, edx
mov dword [esp + esi*4 + 0xbb0], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xac1290
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0xac1284
imul ecx, dword [esp + 0x30], 3
movzx eax, byte [ecx + 0xa00b58]
mov eax, dword [esp + eax*4 + 0xbb0]
mov dword [esp + 0xa4], eax
movzx eax, byte [ecx + 0xa00b59]
mov eax, dword [esp + eax*4 + 0xbb0]
mov dword [esp + 0xc0], eax
movzx eax, byte [ecx + 0xa00b5a]
mov eax, dword [esp + eax*4 + 0xbb0]
mov dword [esp + 0x70], eax
mov ecx, 0x1c90
mov dword [esp + 0x10], ebx
call fcn.00ad193e
mov ecx, eax
mov dword [esp + 0x6c], ecx
test ecx, ecx
jne 0xac131d
mov edi, 0x8007000e
mov dword [esp + 0x10], edi
jmp 0xac18c8
mov eax, ecx
mov dword [esp + 0x30], eax
jmp 0xac1218
or dword [esp + 0x18], 0xffffffff
mov edx, 0xab69605e
mov dword [esp + 0x8e8], edx
add ecx, 7
mov edx, 0x7f1137f
mov dword [esp + 0x1c], ebx
mov esi, 0xa19392
mov dword [esp + 0x8ec], edx
mov al, bl
mov dword [esp + 0x34], ebx
mov edx, ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x38], 0x392
movzx edi, byte [esi - 2]
movzx ecx, byte [esi - 1]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, ecx
shl esi, 8
mov ecx, dword [esp + 0x2c]
xor edx, edi
mov dword [esp + 0xc], edx
movzx ecx, byte [ecx + 3]
or esi, ecx
mov ecx, dword [esp + 0x2c]
shl esi, 8
movzx ecx, byte [ecx + 4]
or esi, ecx
mov ecx, dword [esp + 0x2c]
shl esi, 8
add dword [esp + 0x2c], 8
movzx ecx, byte [ecx + 5]
or esi, ecx
xor ebx, esi
xor ebx, edx
xor ebx, 0xac987321
lea ecx, [ebx + 0x54969fa2]
rol ecx, 5
imul edx, ecx, 0x137f
mov ecx, ebx
rol ecx, 0xa
add edx, ecx
mov ecx, dword [esp + 0xc]
xor ecx, edx
mov dword [esp + 0xc], ecx
add ecx, 0x7f1137f
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, dword [esp + 0xc]
rol ecx, 2
sub edx, ecx
xor ebx, edx
imul edx, ebx, 0x605e
mov ecx, ebx
shr ecx, 0xd
sub edx, ecx
mov ecx, dword [esp + 0xc]
sub edx, 0x756c8a2
xor ecx, edx
mov dword [esp + 0xc], ecx
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, dword [esp + 0xc]
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor ebx, edx
mov edx, ebx
xor edx, 0xab69605e
sub ecx, edx
mov edx, dword [esp + 0xc]
xor edx, ecx
mov dword [esp + 0xc], edx
mov ecx, dword [esp + 0xc]
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
xor ebx, edx
lea ecx, [ebx + 0x7f1137f]
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, ebx
rol ecx, 2
add edx, ecx
mov ecx, dword [esp + 0xc]
xor ecx, edx
mov dword [esp + 0xc], ecx
add ecx, 0x54969fa2
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, dword [esp + 0xc]
rol ecx, 8
sub edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0xab69605e
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, ebx
ror ecx, 0xa
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ecx, edx
mov dword [esp + 0xc], ecx
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, dword [esp + 0xc]
shr ecx, 0xa
xor edx, ecx
xor edx, ebx
mov ebx, dword [esp + 0xc]
mov ecx, edx
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor ebx, ecx
mov dword [esp + 0xc], ebx
add ebx, 0xfffff80f
xor ebx, edx
xor ebx, 0xab69605e
mov ecx, ebx
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, ebx
shr ecx, 2
add edx, ecx
mov ecx, dword [esp + 0xc]
xor ecx, edx
mov dword [esp + 0xc], ecx
add ecx, 0xf80eec81
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, dword [esp + 0xc]
rol ecx, 7
add edx, ecx
xor ebx, edx
mov ecx, ebx
mov edx, ebx
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
mov ecx, dword [esp + 0xc]
xor ecx, edx
mov dword [esp + 0xc], ecx
xor ecx, 0xab69
rol ecx, 5
imul edx, ecx, 0x7f1
mov ecx, dword [esp + 0xc]
rol ecx, 7
add edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, dword [esp + 0xc]
xor ecx, 0xac987321
mov dword [esp + 0xc], ecx
ror ecx, 3
imul ecx, ecx, 0x137f
sub ecx, 0xd0dd417
xor ebx, ecx
lea ecx, [ebx - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, ebx
ror ecx, 6
sub edx, ecx
mov ecx, dword [esp + 0xc]
xor ecx, edx
mov dword [esp + 0xc], ecx
add ecx, 0xab69605e
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, dword [esp + 0xc]
rol ecx, 0xe
add edx, ecx
xor ebx, edx
lea ecx, [ebx - 0x54969fa2]
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, ebx
ror ecx, 0xe
sub edx, ecx
mov ecx, dword [esp + 0xc]
xor ecx, edx
mov dword [esp + 0xc], ecx
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, dword [esp + 0xc]
shr ecx, 3
xor edx, ecx
xor ebx, edx
mov edx, 0x7f1137f
mov ecx, ebx
xor ecx, edx
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, ebx
xor ebx, dword [esp + 0x18]
rol ecx, 2
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x2c]
xor edx, ecx
mov ecx, dword [esp + 0x20]
xor edx, dword [esp + 0x1c]
xor dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
mov byte [ecx - 4], dl
mov byte [ecx], bl
ror edx, 8
mov byte [ecx - 5], dl
ror ebx, 8
mov byte [ecx - 1], bl
ror edx, 8
mov byte [ecx - 6], dl
ror ebx, 8
mov byte [ecx - 2], bl
ror edx, 8
ror ebx, 8
mov byte [ecx - 7], dl
mov byte [ecx - 3], bl
add ecx, 8
ror edx, 8
ror ebx, 8
sub dword [esp + 0x38], 1
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ecx
jne 0xac135e
mov ecx, dword [esp + 0x6c]
xor ebx, ebx
mov edx, ebx
mov esi, 0x1c90
xor al, byte [edx + ecx]
inc edx
cmp edx, esi
jb 0xac1688
movzx eax, al
cdq
cmp eax, dword [0xa1b020]
jne 0xac16b7
cmp edx, dword [0xa1b024]
jne 0xac16b7
mov edi, dword [esp + 0x10]
mov dword [esp + 0x190], ecx
mov ecx, ebx
mov dword [esp + 0x74], esi
jmp 0xac16c0
mov edi, 0xc004d501
mov dword [esp + 0x10], edi
test ecx, ecx
je 0xac16c9
call fcn.00ad1951
test edi, edi
js 0xac18c8
mov edi, dword [esp + 0x190]
mov esi, ebx
mov edx, ebx
mov ebx, dword [esp + 0x30]
cmp ebx, edx
jne 0xac16eb
mov dword [esp + esi*4 + 0xb98], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [esp + 0x34], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xac16f4
sub ecx, dword [esp + 0x34]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0xac16e0
inc esi
push 0
pop ebx
cmp esi, 6
jb 0xac16da
push 0xc
pop ecx
call fcn.00ad193e
push eax
lea ecx, [esp + 0x188]
call fcn.00ad1916
mov esi, dword [esp + 0x184]
test esi, esi
je 0xac1304
mov edi, esi
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, ebx
movzx ecx, word [esp + edi*2 + 0xc00]
mov eax, ebx
cmp cx, word [eax*2 + 0xa19380]
je 0xac175d
inc eax
cmp eax, 6
jb 0xac1748
jmp 0xac1806
mov ecx, dword [0xc93060]
mov edx, dword [esp + eax*4 + 0xb98]
mov dword [esp + 0x1c], ecx
mov ecx, edx
mov dword [esp + 0x18], edx
lea eax, [ecx + 1]
mov dword [esp + 0x34], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xac177b
sub ecx, dword [esp + 0x34]
push ebx
push ebx
lea eax, [ecx + 1]
mov ecx, dword [esp + 0x24]
push eax
push edx
push ebx
push 0xfde9
call dword [0xc99200]
call dword [esp + 0x34]
mov dword [esp + 0x20], eax
test eax, eax
je 0xac183e
lea ecx, [eax + eax]
call fcn.00ad193e
mov dword [esp + 0x38], eax
mov dword [esi + edi*4], eax
test eax, eax
je 0xac1837
mov edx, dword [esp + 0x18]
mov ecx, edx
mov eax, dword [0xc93060]
mov dword [esp + 0x1c], eax
lea eax, [ecx + 1]
mov dword [esp + 0x34], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xac17d6
push dword [esp + 0x20]
sub ecx, dword [esp + 0x38]
push dword [esp + 0x3c]
lea eax, [ecx + 1]
mov ecx, dword [esp + 0x24]
push eax
push edx
push ebx
push 0xfde9
call dword [0xc99200]
call dword [esp + 0x34]
test eax, eax
je 0xac183e
inc edi
cmp edi, 3
jb 0xac173e
mov edi, dword [esp + 0x10]
mov eax, esi
mov dword [esp + 0x24], eax
mov esi, ebx
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x184], esi
mov dword [esp + 0x418], eax
jmp 0xac1868
mov edi, 0x8007000e
jmp 0xac1864
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
jle 0xac185d
movzx edi, di
or edi, 0x80070000
mov dword [esp + 0x10], edi
test edi, edi
js 0xac1868
mov edi, 0x80004005
mov dword [esp + 0x10], edi
test esi, esi
je 0xac18c8
mov eax, ebx
mov dword [esp + 0x30], ebx
mov edx, dword [esi + eax*4]
test edx, edx
je 0xac18b8
mov ecx, edx
lea eax, [ecx + 2]
mov dword [esp + 0x34], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xac1882
sub ecx, dword [esp + 0x34]
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xac18ad
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0xac189e
mov edx, dword [esp + 0x30]
mov edx, dword [esi + edx*4]
mov ecx, edx
call fcn.00ad1951
mov eax, dword [esp + 0x30]
inc eax
mov dword [esp + 0x30], eax
cmp eax, 3
jb 0xac1872
jmp 0xac18c8
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x190]
test eax, eax
je 0xac18e3
mov ecx, dword [esp + 0x74]
test ecx, ecx
je 0xac18e3
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xac18db
lea ecx, [esp + 0x184]
call fcn.00ad18c0
lea ecx, [esp + 0x190]
call fcn.00ad18c0
lea ecx, [esp + 0xec]
call fcn.00ad18c0
test edi, edi
js 0xac24b5
mov eax, dword [esp + 0x24]
mov edi, ebx
mov esi, dword [0xc930b4]
push ebx
mov dword [esp + 0x14], edi
mov ecx, dword [eax]
mov dword [esp + 0x424], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x428], ecx
mov ecx, esi
mov eax, dword [eax + 8]
mov dword [esp + 0x42c], eax
lea eax, [esp + 0x2f8]
push eax
push ebx
push 0x42
mov dword [esp + 0x308], ebx
mov dword [esp + 0x30c], ebx
mov dword [esp + 0x304], 0xc
call dword [0xc99200]
call esi
test eax, eax
jne 0xac199d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
jle 0xac198e
movzx edi, di
or edi, 0x80070000
mov dword [esp + 0x10], edi
test edi, edi
mov eax, ebx
js 0xac19a7
mov edi, 0x80004005
mov dword [esp + 0x10], edi
jmp 0xac19a7
mov eax, dword [esp + 0x2f8]
and eax, 1
mov dword [esp + 0x41c], eax
test edi, edi
js 0xac24b5
mov eax, dword [esp + 0x3c]
push 0x2a
pop ecx
mov dword [esp + 0x8c], ecx
sub eax, 1
je 0xac19ef
sub eax, 1
je 0xac19e5
sub eax, 1
jne 0xac19fe
mov edi, 0xe1
mov dword [esp + 0x60], edi
mov dword [esp + 0xa0], edi
jmp 0xac19fe
mov dword [esp + 0x60], 0xf
jmp 0xac19f3
mov dword [esp + 0x60], ecx
mov dword [esp + 0xa0], 0xb
mov esi, 0xdc
mov dword [esp + 0x2c], 0x60
push esi
lea eax, [esp + 0xa9c]
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov word [esp + 0xadc], si
mov esi, dword [0xc93070]
lea eax, [esp + 0xa98]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xac1a81
mov eax, dword [esp + 0xb44]
movzx edi, word [esp + 0xb3e]
mov ecx, dword [esp + 0xb48]
push 0x60
mov dword [esp + 0x34], eax
mov dword [esp + 0x380], eax
pop eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x380], ecx
cmp edi, eax
jae 0xac1a97
mov dword [esp + 0x2c], eax
jmp 0xac1a97
mov eax, dword [esp + 0x380]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x37c]
mov dword [esp + 0x30], eax
xor eax, eax
inc eax
cmp dword [esp + 0x3c], eax
mov eax, dword [esp + 0xa4]
je 0xac1aab
mov eax, dword [esp + 0x70]
push 0x5c
mov dword [esp + 0x20], eax
lea eax, [esp + 0x95c]
push ebx
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [esp + 0x10], edi
push 0x403
push ebx
push ebx
call dword [0xc99200]
call esi
mov dword [esp + 0x34], eax
test eax, eax
jne 0xac1b19
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
jle 0xac1b06
movzx edi, di
or edi, 0x80070000
mov dword [esp + 0x10], edi
test edi, edi
js 0xac1bc6
mov dword [esp + 0x10], 0x80004005
jmp 0xac24b5
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [esp + 0x30]
push dword [esp + 0x68]
call dword [0xc99200]
call esi
push dword [esp + 0x1c]
neg eax
mov dword [esp + 0x96c], 0x190
push 0x20
pop edx
lea ecx, [esp + 0x978]
mov dword [esp + 0x95c], eax
mov byte [esp + 0x976], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [esp + 0x958]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xac1baa
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
jle 0xac1b9d
movzx edi, di
or edi, 0x80070000
mov dword [esp + 0x10], edi
test edi, edi
js 0xac1bb1
mov edi, 0x80004005
mov dword [esp + 0x10], edi
jmp 0xac1bb1
mov dword [esp + 0x42c], eax
push dword [esp + 0x34]
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
test edi, edi
js 0xac24b5
xor eax, eax
inc eax
cmp dword [esp + 0x3c], eax
je 0xac1be2
mov eax, dword [esp + 0x70]
mov dword [esp + 0xa4], eax
push 0x5c
lea eax, [esp + 0x9bc]
push ebx
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [esp + 0x10], edi
push 0x403
push ebx
push ebx
call dword [0xc99200]
call esi
mov dword [esp + 0x34], eax
test eax, eax
jne 0xac1c44
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
jle 0xac1c39
movzx edi, di
or edi, 0x80070000
mov dword [esp + 0x10], edi
test edi, edi
js 0xac1cf7
jmp 0xac1b0c
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [esp + 0x30]
push dword [esp + 0xa8]
call dword [0xc99200]
call esi
push dword [esp + 0xa4]
neg eax
mov dword [esp + 0x9cc], 0x190
push 0x20
pop edx
lea ecx, [esp + 0x9d8]
mov dword [esp + 0x9bc], eax
mov byte [esp + 0x9d6], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [esp + 0x9b8]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xac1cdb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
jle 0xac1cce
movzx edi, di
or edi, 0x80070000
mov dword [esp + 0x10], edi
test edi, edi
js 0xac1ce2
mov edi, 0x80004005
mov dword [esp + 0x10], edi
jmp 0xac1ce2
mov dword [esp + 0x430], eax
push dword [esp + 0x34]
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
test edi, edi
js 0xac24b5
mov esi, dword [esp + 0x3c]
mov ecx, ebx
mov eax, esi
mov edx, ebx
sub eax, 1
je 0xac1d18
sub eax, 1
je 0xac1d54
sub eax, 1
jne 0xac1d20
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x790], ecx
mov dword [esp + 0x794], edx
xor edx, edx
inc edx
cmp esi, edx
je 0xac1d96
lea eax, [esi - 2]
cmp eax, edx
ja 0xac1d66
mov edx, ebx
mov dword [esp + 0x8c], ebx
mov eax, ebx
mov dword [esp + 0x60], edx
mov dword [esp + 0xa0], ebx
jmp 0xac1dac
mov eax, dword [esp + 0x30]
cdq
and edx, 3
lea ecx, [edx + eax]
mov edx, ebx
sar ecx, 2
jmp 0xac1d20
mov eax, dword [esp + 0x174]
mov edx, dword [esp + 0x174]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x174]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x174]
mov dword [esp + 0x60], edx
jmp 0xac1dac
mov eax, 0x96
mov dword [esp + 0x60], ebx
mov edx, ebx
mov dword [esp + 0xa0], 0x20
mov dword [esp + 0xa4], eax
push dword [esp + 0x42c]
mov esi, dword [0xc9303c]
sub ecx, eax
push dword [esp + 0x60]
mov edi, dword [esp + 0x428]
sub ecx, edx
mov dword [esp + 0x88], ecx
mov dword [esp + 0x45c], ecx
mov dword [esp + 0x44c], ecx
mov ecx, esi
mov dword [esp + 0x18], ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
push ebx
push 0xc50
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x444]
push eax
push 0xffffffffffffffff
push edi
push dword [esp + 0x70]
call dword [0xc99200]
call esi
test eax, eax
jne 0xac1e2a
mov edi, 0x80004005
mov dword [esp + 0x10], edi
jmp 0xac1e2c
mov edi, ebx
mov eax, dword [esp + 0x34]
test eax, eax
je 0xac1e49
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push dword [esp + 0x60]
call dword [0xc99200]
call esi
test edi, edi
js 0xac24b5
push dword [esp + 0x430]
mov esi, dword [0xc9303c]
mov ecx, esi
push dword [esp + 0x60]
mov edi, dword [esp + 0x42c]
mov dword [esp + 0x18], ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
push ebx
push 0xc50
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x454]
push eax
push 0xffffffffffffffff
push edi
push dword [esp + 0x70]
call dword [0xc99200]
call esi
test eax, eax
jne 0xac1eaf
mov edi, 0x80004005
mov dword [esp + 0x10], edi
jmp 0xac1eb1
mov edi, ebx
mov eax, dword [esp + 0x34]
test eax, eax
je 0xac1ece
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push dword [esp + 0x60]
call dword [0xc99200]
call esi
test edi, edi
js 0xac24b5
mov eax, dword [esp + 0x3c]
cmp eax, 2
je 0xac1ee4
cmp eax, 3
jne 0xac1f0b
mov edi, dword [esp + 0x454]
mov dword [esp + 0x80], edi
cmp dword [esp + 0x444], edi
jle 0xac1f12
mov edi, dword [esp + 0x444]
mov dword [esp + 0x80], edi
jmp 0xac1f12
mov edi, dword [esp + 0x80]
cmp dword [esp + 0x418], 0
mov esi, dword [0xc930a8]
mov ecx, esi
push dword [esp + 0x8c]
je 0xac1f68
mov eax, edi
sub eax, dword [esp + 0x448]
add eax, dword [esp + 0x64]
push eax
lea eax, [esp + 0x444]
push eax
call dword [0xc99200]
call esi
mov eax, dword [esp + 0x448]
add eax, dword [esp + 0xa0]
push eax
mov eax, edi
sub eax, dword [esp + 0x458]
add eax, dword [esp + 0x64]
push eax
jmp 0xac1f95
push dword [esp + 0xa8]
lea eax, [esp + 0x444]
push eax
call dword [0xc99200]
call esi
mov eax, dword [esp + 0x448]
add eax, dword [esp + 0xa0]
push eax
push dword [esp + 0xa8]
mov esi, dword [0xc930a8]
lea eax, [esp + 0x454]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [esp + 0x3c]
cmp eax, 2
je 0xac22a4
cmp eax, 3
je 0xac22a4
xor edx, edx
inc edx
cmp eax, edx
jne 0xac22c7
push 0x5c
lea eax, [esp + 0xa1c]
mov dword [esp + 0x43c], 0xffffff
push ebx
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [esp + 0x10], edi
push 0x403
push ebx
push ebx
call dword [0xc99200]
call esi
mov dword [esp + 0x34], eax
test eax, eax
jne 0xac203b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
jle 0xac2030
movzx edi, di
or edi, 0x80070000
mov dword [esp + 0x10], edi
test edi, edi
js 0xac20e9
jmp 0xac1b0c
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [esp + 0x30]
push 0xb
call dword [0xc99200]
call esi
push dword [esp + 0xc0]
neg eax
mov dword [esp + 0xa2c], 0x190
push 0x20
pop edx
lea ecx, [esp + 0xa38]
mov dword [esp + 0xa1c], eax
mov byte [esp + 0xa36], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [esp + 0xa18]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xac20cd
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
jle 0xac20c0
movzx edi, di
or edi, 0x80070000
mov dword [esp + 0x10], edi
test edi, edi
js 0xac20d4
mov edi, 0x80004005
mov dword [esp + 0x10], edi
jmp 0xac20d4
mov dword [esp + 0x434], eax
push dword [esp + 0x34]
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
test edi, edi
js 0xac24b5
push dword [esp + 0x434]
mov eax, dword [esp + 0x84]
mov esi, dword [0xc9303c]
mov ecx, esi
push dword [esp + 0x60]
mov edi, dword [esp + 0x430]
mov dword [esp + 0x46c], eax
mov dword [esp + 0x18], ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
push ebx
push 0x460
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x464]
push eax
push 0xffffffffffffffff
push edi
push dword [esp + 0x70]
call dword [0xc99200]
call esi
test eax, eax
jne 0xac215d
mov edi, 0x80004005
mov dword [esp + 0x10], edi
jmp 0xac215f
mov edi, ebx
mov eax, dword [esp + 0x34]
test eax, eax
je 0xac217c
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push dword [esp + 0x60]
call dword [0xc99200]
call esi
test edi, edi
js 0xac24b5
mov eax, dword [esp + 0x464]
push 0x5a
add eax, 0x18
pop ecx
mov dword [esp + 0x464], eax
cmp eax, ecx
jge 0xac21a3
mov dword [esp + 0x464], ecx
mov edi, dword [esp + 0x2c]
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x60
push edi
push dword [esp + 0x464]
mov dword [esp + 0x474], 0x20
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x60
push edi
push dword [esp + 0x468]
mov dword [esp + 0x468], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x60
push edi
push dword [esp + 0x46c]
mov dword [esp + 0x46c], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x60
push edi
push dword [esp + 0x470]
mov dword [esp + 0x470], eax
call dword [0xc99200]
call esi
mov ecx, dword [esp + 0x458]
mov esi, dword [0xc930a8]
add ecx, 0x24
cmp dword [esp + 0x418], 0
mov dword [esp + 0x468], eax
je 0xac227d
mov eax, dword [esp + 0x43c]
cmp eax, dword [esp + 0x44c]
jl 0xac2267
mov eax, dword [esp + 0x44c]
push ecx
push eax
lea eax, [esp + 0x464]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
jmp 0xac22c4
mov eax, dword [esp + 0x444]
cmp eax, dword [esp + 0x454]
jg 0xac2294
mov eax, dword [esp + 0x454]
sub eax, dword [esp + 0x464]
add eax, dword [esp + 0x45c]
jmp 0xac2267
mov eax, dword [esp + 0x458]
mov dword [esp + 0x790], edi
mov dword [esp + 0x794], eax
mov dword [esp + 0x438], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [esp + 0x418]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x794]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x790]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x3c]
sub eax, 1
je 0xac24a3
sub eax, 1
je 0xac23c3
sub eax, 1
jne 0xac24b1
mov esi, dword [0xc930a4]
lea edi, [esp + 0x930]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [esp + 0x930]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x938], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xac24b1
mov esi, dword [0xc930a0]
lea eax, [esp + 0x944]
push eax
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [esp + 0x94c]
push eax
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [esp + 0x94c]
lea esi, [esp + 0x944]
sub eax, dword [esp + 0x1c]
lea edi, [esp + 0x408]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x788], eax
mov eax, dword [esp + 0x950]
sub eax, dword [esp + 0x18]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
jmp 0xac2497
mov esi, dword [0xc930a4]
lea edi, [esp + 0x908]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [esp + 0x908]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x910], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xac24b1
mov esi, dword [0xc930a0]
lea eax, [esp + 0x91c]
push eax
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [esp + 0x924]
push eax
push ebx
mov ecx, esi
call dword [0xc99200]
call esi
cmp dword [esp + 0x34], 0
lea esi, [esp + 0x91c]
lea edi, [esp + 0x408]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0xac2471
imul eax, dword [esp + 0x924], 5
cdq
idiv ecx
add eax, dword [esp + 0x91c]
jmp 0xac2482
mov eax, dword [esp + 0x924]
sub eax, dword [esp + 0x1c]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [esp + 0x788], eax
mov eax, dword [esp + 0x928]
sub eax, dword [esp + 0x18]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [esp + 0x78c], eax
jmp 0xac24b1
mov dword [esp + 0x788], ebx
mov dword [esp + 0x78c], ebx
mov dword [esp + 0x10], ebx
push dword [esp + 0x5c]
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
xor esi, esi
mov edi, 0xc96238
inc esi
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xac24d2
mov eax, dword [0xc95890]
test eax, eax
jle 0xac2533
sub eax, 1
mov dword [0xc95890], eax
jne 0xac2533
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xac2504
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xac24f3
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0xc96238
inc esi
xor eax, eax
xchg dword [edi], eax
lea ecx, [esp + 0x9c]
call fcn.00ad18c0
cmp dword [esp + 0x10], 0
jl 0xac3faf
mov eax, dword [esp + 0x78c]
mov edi, dword [esp + 0x788]
push 0x54
mov dword [esp + 0x20], eax
mov dword [esp + 0x2d8], eax
lea eax, [esp + 0x474]
push ebx
push eax
mov dword [esp + 0x2dc], edi
call fcn.00ab4bf6
add esp, 0xc
mov dword [esp + 0x18], esi
mov esi, dword [0xc93028]
mov ecx, esi
push 7
push dword [esp + 0x5c]
call dword [0xc99200]
call esi
test eax, eax
je 0xac25e9
mov esi, dword [0xc93034]
lea ecx, [esp + 0x470]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xac25e9
push 0x20
pop eax
cmp word [esp + 0x482], ax
jne 0xac25e9
cmp dword [esp + 0x484], 0
je 0xac25e9
cmp dword [esp + 0x474], 0
jle 0xac25e9
cmp dword [esp + 0x478], 0
jg 0xac25f4
cmp dword [esp + 0x3c], 1
mov dword [esp + 0x18], ebx
jne 0xac2666
push dword [esp + 0x1c]
mov esi, dword [0xc930a8]
lea eax, [esp + 0x440]
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
push dword [esp + 0x1c]
mov esi, dword [0xc930a8]
lea eax, [esp + 0x450]
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov edi, dword [esp + 0x3c]
cmp edi, 1
jne 0xac266a
mov eax, dword [esp + 0x41c]
mov esi, dword [0xc93014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0xc99200]
call esi
mov dword [esp + 0x124], eax
jmp 0xac266a
mov edi, dword [esp + 0x3c]
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push dword [esp + 0x5c]
call dword [0xc99200]
call esi
cmp dword [esp + 0x418], 0
mov dword [esp + 0x108], eax
mov dword [esp + 0xc], 0x810
je 0xac26a1
mov dword [esp + 0xc], 0x20812
cmp dword [esp + 0x18], 0
je 0xac310c
mov eax, dword [esp + 0x41c]
mov esi, dword [esp + 0x420]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x42c]
push 0x54
mov dword [esp + 0x38], eax
lea eax, [esp + 0x524]
push ebx
push eax
mov dword [esp + 0x24], esi
call fcn.00ab4bf6
add esp, 0xc
lea eax, [esp + 0x628]
push 0x54
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [esp + 0x20], ebx
lea eax, [esp + 0x828]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x24], ebx
push 0x2c
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [esp + 0x7cc]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0xac3f8e
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [esp + 0x58]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
je 0xac319b
mov esi, dword [0xc93034]
lea ecx, [esp + 0x520]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xac278a
mov eax, dword [esp + 0x534]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x524]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x528]
mov dword [esp + 0x24], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov edi, eax
mov dword [esp + 0x54], edi
test edi, edi
je 0xac319b
mov eax, dword [esp + 0x444]
sub eax, dword [esp + 0x43c]
mov esi, dword [0xc9300c]
mov ecx, esi
mov dword [esp + 0x82c], eax
mov eax, dword [esp + 0x440]
sub eax, dword [esp + 0x448]
mov dword [esp + 0x830], eax
xor eax, eax
push 0x20
inc eax
mov dword [esp + 0x26c], ebx
mov word [esp + 0x838], ax
pop eax
push ebx
push ebx
mov word [esp + 0x83e], ax
lea eax, [esp + 0x270]
push eax
push ebx
lea eax, [esp + 0x838]
mov dword [esp + 0x70], ebx
push eax
push edi
mov dword [esp + 0x850], ebx
mov dword [esp + 0x854], ebx
mov dword [esp + 0x858], ebx
mov dword [esp + 0x85c], ebx
mov dword [esp + 0x860], ebx
mov dword [esp + 0x864], ebx
mov dword [esp + 0x868], ebx
mov dword [esp + 0x840], 0x28
call dword [0xc99200]
call esi
mov dword [esp + 0x74], eax
test eax, eax
jne 0xac288b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [esp + 0x60], eax
test eax, eax
jle 0xac2878
movzx eax, ax
or eax, 0x80070000
mov dword [esp + 0x60], eax
test eax, eax
js 0xac2bba
mov dword [esp + 0x60], 0x80004005
jmp 0xac2bba
mov esi, dword [0xc93034]
lea ecx, [esp + 0x628]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xac28b5
mov eax, dword [esp + 0x63c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x444]
sub eax, dword [esp + 0x43c]
push dword [esp + 0x74]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [esp + 0x7cc], eax
mov eax, dword [esp + 0x44c]
sub eax, dword [esp + 0x444]
push edi
mov dword [esp + 0x7d4], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
push dword [esp + 0x34]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
push ebx
mov dword [esp + 0xb8], eax
call dword [0xc99200]
call esi
push eax
lea eax, [esp + 0x7c4]
mov ecx, edi
push eax
push dword [esp + 0x5c]
call dword [0xc99200]
call edi
mov edi, dword [esp + 0x54]
lea eax, [esp + 0x7c0]
mov esi, dword [0xc9306c]
mov ecx, esi
push ebx
push dword [esp + 0x10]
push eax
push 0xffffffffffffffff
push dword [esp + 0x28]
push edi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [esp + 0x3c], eax
jne 0xac29ad
cmp dword [esp + 0x38], 0
je 0xac29a3
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [esp + 0x2c], eax
jmp 0xac29b5
mov dword [esp + 0x2c], 0xffffff
jmp 0xac29b5
mov dword [esp + 0x2c], 0xffa8a8a8
mov esi, dword [esp + 0x43c]
mov ecx, ebx
mov eax, dword [esp + 0x440]
mov dword [esp + 0x18], esi
mov dword [esp + 0x30], ebx
test esi, esi
jns 0xac29df
mov edx, esi
mov dword [esp + 0x18], ebx
neg edx
mov esi, ebx
mov dword [esp + 0x30], edx
test eax, eax
jns 0xac29e9
mov ecx, eax
mov eax, ebx
neg ecx
mov edx, dword [esp + 0x70]
sub edx, esi
mov esi, dword [esp + 0x7c8]
sub esi, dword [esp + 0x30]
mov dword [esp + 0x48], esi
cmp esi, edx
jl 0xac2a08
mov esi, edx
mov dword [esp + 0x48], edx
mov edx, dword [esp + 0x7cc]
sub dword [esp + 0x24], eax
sub edx, ecx
mov dword [esp + 0x6c], edx
cmp edx, dword [esp + 0x24]
jl 0xac2a27
mov edx, dword [esp + 0x24]
mov dword [esp + 0x6c], edx
test esi, esi
jle 0xac2b89
test edx, edx
jle 0xac2b89
mov edx, dword [esp + 0x7c8]
imul eax, dword [esp + 0x70]
mov edi, dword [esp + 0x1c]
imul ecx, edx
shl edx, 2
mov dword [esp + 0x34], edx
add eax, dword [esp + 0x18]
mov edx, dword [esp + 0x70]
add ecx, dword [esp + 0x30]
shl edx, 2
mov dword [esp + 0xc0], edx
lea ecx, [edi + ecx*4]
mov edi, dword [esp + 0x20]
mov dword [esp + 0x38], ecx
lea eax, [edi + eax*4]
mov dword [esp + 0x20], eax
mov ebx, eax
mov dword [esp + 0x18], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [esp + 0x24], edx
lea edi, [ecx + 2]
mov dword [esp + 0x1c], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xac2b41
mov bl, byte [ebx + edi]
mov eax, dword [esp + 0x2c]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x1c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [esp + 0x24]
mov bl, byte [eax - 2]
mov eax, dword [esp + 0x2c]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x24]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [esp + 0x2e]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x24]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [esp + 0x18]
cdq
idiv ecx
mov edx, dword [esp + 0x24]
add al, bl
mov ebx, dword [esp + 0x1c]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], esi
jne 0xac2a8f
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x20]
add ecx, dword [esp + 0x34]
add eax, dword [esp + 0xc0]
sub dword [esp + 0x6c], 1
mov esi, dword [esp + 0x48]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x20], eax
jne 0xac2a79
mov edi, dword [esp + 0x54]
xor ebx, ebx
push dword [esp + 0x74]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [esp + 0xb4]
test eax, eax
je 0xac2bba
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [esp + 0x60], 0
jl 0xac3f8e
mov eax, dword [esp + 0x41c]
mov esi, dword [esp + 0x424]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x430]
push 0x54
mov dword [esp + 0x38], eax
lea eax, [esp + 0x57c]
push ebx
push eax
mov dword [esp + 0x28], esi
call fcn.00ab4bf6
add esp, 0xc
lea eax, [esp + 0x680]
push 0x54
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [esp + 0x20], ebx
lea eax, [esp + 0x8ac]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], ebx
push 0x2c
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [esp + 0x7dc]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0xac3f8e
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [esp + 0x58]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
je 0xac319b
mov esi, dword [0xc93034]
lea ecx, [esp + 0x578]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xac2cb4
mov eax, dword [esp + 0x58c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x57c]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x580]
mov dword [esp + 0x24], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov edi, eax
mov dword [esp + 0xb4], edi
test edi, edi
je 0xac319b
mov eax, dword [esp + 0x454]
sub eax, dword [esp + 0x44c]
mov esi, dword [0xc9300c]
mov ecx, esi
mov dword [esp + 0x8b0], eax
mov eax, dword [esp + 0x450]
sub eax, dword [esp + 0x458]
mov dword [esp + 0x8b4], eax
xor eax, eax
push 0x20
inc eax
mov dword [esp + 0x270], ebx
mov word [esp + 0x8bc], ax
pop eax
push ebx
push ebx
mov word [esp + 0x8c2], ax
lea eax, [esp + 0x274]
push eax
push ebx
lea eax, [esp + 0x8bc]
mov dword [esp + 0x70], ebx
push eax
push edi
mov dword [esp + 0x8d4], ebx
mov dword [esp + 0x8d8], ebx
mov dword [esp + 0x8dc], ebx
mov dword [esp + 0x8e0], ebx
mov dword [esp + 0x8e4], ebx
mov dword [esp + 0x8e8], ebx
mov dword [esp + 0x8ec], ebx
mov dword [esp + 0x8c4], 0x28
call dword [0xc99200]
call esi
mov dword [esp + 0x74], eax
test eax, eax
jne 0xac2db8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [esp + 0x60], eax
test eax, eax
jle 0xac2da5
movzx eax, ax
or eax, 0x80070000
mov dword [esp + 0x60], eax
test eax, eax
js 0xac30eb
mov dword [esp + 0x60], 0x80004005
jmp 0xac30eb
mov esi, dword [0xc93034]
lea ecx, [esp + 0x680]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xac2de2
mov eax, dword [esp + 0x694]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x454]
sub eax, dword [esp + 0x44c]
push dword [esp + 0x74]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [esp + 0x7dc], eax
mov eax, dword [esp + 0x45c]
sub eax, dword [esp + 0x454]
push edi
mov dword [esp + 0x7e4], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
push dword [esp + 0x34]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
push ebx
mov dword [esp + 0x50], eax
call dword [0xc99200]
call esi
push eax
lea eax, [esp + 0x7d4]
mov ecx, edi
push eax
push dword [esp + 0xbc]
call dword [0xc99200]
call edi
mov edi, dword [esp + 0xb4]
lea eax, [esp + 0x7d0]
mov esi, dword [0xc9306c]
mov ecx, esi
push ebx
push dword [esp + 0x10]
push eax
push 0xffffffffffffffff
push dword [esp + 0x2c]
push edi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [esp + 0x3c], eax
jne 0xac2ed9
cmp dword [esp + 0x38], 0
je 0xac2ecf
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
jmp 0xac2ede
mov dword [esp + 0x6c], 0xffffff
jmp 0xac2ee6
mov eax, 0xffa8a8a8
mov dword [esp + 0x6c], eax
mov dword [esp + 0x28], eax
mov esi, dword [esp + 0x44c]
mov edx, ebx
mov eax, dword [esp + 0x450]
mov ecx, ebx
mov dword [esp + 0x70], esi
mov dword [esp + 0x1c], ebx
test esi, esi
jns 0xac2f10
mov edx, esi
mov dword [esp + 0x70], ebx
neg edx
mov dword [esp + 0x1c], edx
test eax, eax
jns 0xac2f1a
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [esp + 0x7d8]
sub esi, edx
mov edx, dword [esp + 0x30]
sub edx, dword [esp + 0x70]
mov dword [esp + 0x48], esi
cmp esi, edx
jl 0xac2f39
mov esi, edx
mov dword [esp + 0x48], edx
mov edx, dword [esp + 0x7dc]
sub dword [esp + 0x24], eax
sub edx, ecx
mov dword [esp + 0x54], edx
cmp edx, dword [esp + 0x24]
jl 0xac2f58
mov edx, dword [esp + 0x24]
mov dword [esp + 0x54], edx
test esi, esi
jle 0xac30bd
test edx, edx
jle 0xac30bd
mov edx, dword [esp + 0x7d8]
imul eax, dword [esp + 0x30]
mov edi, dword [esp + 0x18]
imul ecx, edx
shl edx, 2
mov dword [esp + 0x34], edx
add eax, dword [esp + 0x70]
mov edx, dword [esp + 0x30]
add ecx, dword [esp + 0x1c]
shl edx, 2
mov dword [esp + 0xc0], edx
lea ecx, [edi + ecx*4]
mov edi, dword [esp + 0x20]
mov dword [esp + 0x38], ecx
lea eax, [edi + eax*4]
mov dword [esp + 0x20], eax
mov ebx, eax
mov dword [esp + 0x18], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [esp + 0x24], edx
lea edi, [ecx + 2]
mov dword [esp + 0x1c], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xac3072
mov bl, byte [ebx + edi]
mov eax, dword [esp + 0x28]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x1c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [esp + 0x24]
mov bl, byte [eax - 2]
mov eax, dword [esp + 0x28]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x24]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [esp + 0x6e]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x24]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [esp + 0x18]
cdq
idiv ecx
mov edx, dword [esp + 0x24]
add al, bl
mov ebx, dword [esp + 0x1c]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], esi
jne 0xac2fc0
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x20]
add ecx, dword [esp + 0x34]
add eax, dword [esp + 0xc0]
sub dword [esp + 0x54], 1
mov esi, dword [esp + 0x48]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x20], eax
jne 0xac2faa
mov edi, dword [esp + 0xb4]
xor ebx, ebx
push dword [esp + 0x74]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [esp + 0x4c]
test eax, eax
je 0xac30eb
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [esp + 0x60], 0
jl 0xac3f8e
jmp 0xac3f3b
xor ecx, ecx
inc ecx
cmp dword [esp + 0x41c], 0
jne 0xac3121
cmp edi, ecx
je 0xac3121
mov al, 0xc0
jmp 0xac3123
or al, 0xff
mov esi, dword [0xc93008]
push dword [esp + 0x58]
mov byte [esp + 0x52], al
mov eax, ebx
mov byte [esp + 0x53], cl
mov ecx, esi
mov byte [esp + 0x50], bl
mov byte [esp + 0x51], bl
mov dword [esp + 0x64], eax
mov dword [esp + 0x1fc], eax
mov dword [esp + 0xa4], ebx
mov dword [esp + 0x200], eax
mov dword [esp + 0x204], ebx
mov dword [esp + 0x208], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x1c4], eax
mov dword [esp + 0x1c8], ebx
mov dword [esp + 0x1cc], ebx
mov dword [esp + 0x1d0], ebx
call dword [0xc99200]
call esi
mov dword [esp + 0x98], eax
test eax, eax
jne 0xac31a6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xac3f8e
xor eax, eax
inc eax
cmp edi, eax
jne 0xac32bd
mov eax, dword [esp + 0x444]
mov esi, dword [esp + 0x454]
sub esi, dword [esp + 0x44c]
sub eax, dword [esp + 0x43c]
mov dword [esp + 0x80], esi
cmp esi, eax
jg 0xac31e1
mov esi, eax
mov dword [esp + 0x80], eax
mov edx, dword [esp + 0x458]
mov edi, ebx
mov eax, edx
mov ecx, ebx
sub eax, dword [esp + 0x440]
cmp dword [esp + 0x418], 0
mov dword [esp + 0x10], eax
je 0xac323d
mov ecx, dword [esp + 0x43c]
sub ecx, dword [esp + 0x444]
mov eax, dword [esp + 0x44c]
add ecx, esi
sub eax, dword [esp + 0x454]
mov edi, ecx
add eax, esi
mov dword [esp + 0x60], ecx
mov dword [esp + 0x1f8], ecx
mov ecx, eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x1c0], eax
sub edi, dword [esp + 0x43c]
add edi, dword [esp + 0x444]
sub ecx, dword [esp + 0x44c]
mov eax, dword [esp + 0x448]
sub eax, dword [esp + 0x440]
add ecx, dword [esp + 0x454]
sub edx, dword [esp + 0x450]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x200], edi
mov edi, dword [esp + 0x450]
sub edi, dword [esp + 0x440]
add edx, edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x204], eax
mov dword [esp + 0x8c], ecx
mov dword [esp + 0x1c8], ecx
mov dword [esp + 0x54], edi
mov dword [esp + 0x1c4], edi
mov dword [esp + 0x6c], edx
mov dword [esp + 0x1cc], edx
jmp 0xac3358
mov eax, dword [esp + 0x790]
lea esi, [esp + 0x43c]
lea edi, [esp + 0x1f8]
mov dword [esp + 0x80], eax
movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x794]
mov dword [esp + 0x10], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x204]
lea esi, [esp + 0x44c]
lea edi, [esp + 0x1c0]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x200]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1fc]
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0x1f8]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x60], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x1cc]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x1c8]
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x1c4]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x1c0]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x10]
mov esi, dword [0xc9300c]
neg eax
mov edi, dword [esp + 0x80]
mov ecx, esi
mov dword [esp + 0x85c], eax
xor eax, eax
push 0x20
inc eax
mov dword [esp + 0x274], ebx
mov word [esp + 0x864], ax
pop eax
push ebx
push ebx
mov word [esp + 0x86a], ax
lea eax, [esp + 0x278]
push eax
push ebx
lea eax, [esp + 0x864]
mov dword [esp + 0x874], ebx
push eax
push dword [esp + 0xac]
mov dword [esp + 0x880], ebx
mov dword [esp + 0x884], ebx
mov dword [esp + 0x888], ebx
mov dword [esp + 0x88c], ebx
mov dword [esp + 0x890], ebx
mov dword [esp + 0x894], ebx
mov dword [esp + 0x86c], 0x28
mov dword [esp + 0x870], edi
call dword [0xc99200]
call esi
mov dword [esp + 0xbc], eax
test eax, eax
jne 0xac340c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xac3f72
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push dword [esp + 0x9c]
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [esp + 0x3c], eax
jne 0xac3478
mov ecx, dword [esp + 0x124]
test ecx, ecx
je 0xac3478
mov eax, dword [esp + 0x10]
mov esi, dword [0xc93074]
push ecx
mov dword [esp + 0x8e8], eax
mov ecx, esi
lea eax, [esp + 0x8dc]
mov dword [esp + 0x8dc], ebx
push eax
push dword [esp + 0xa0]
mov dword [esp + 0x8e8], ebx
mov dword [esp + 0x8ec], edi
call dword [0xc99200]
call esi
mov eax, dword [esp + 0x41c]
mov esi, dword [esp + 0x420]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x42c]
push 0x54
mov dword [esp + 0x38], eax
lea eax, [esp + 0x5d4]
push ebx
push eax
mov dword [esp + 0x44], esi
call fcn.00ab4bf6
add esp, 0xc
lea eax, [esp + 0x6d8]
push 0x54
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [esp + 0x20], ebx
lea eax, [esp + 0x7fc]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x24], ebx
push 0x2c
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [esp + 0x7ec]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0xac3f56
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [esp + 0x98]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xac3520
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xac3f56
mov esi, dword [0xc93034]
lea ecx, [esp + 0x5d0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xac3560
mov eax, dword [esp + 0x5e4]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x5d4]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x5d8]
mov dword [esp + 0x24], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [esp + 0x2c], ecx
test ecx, ecx
je 0xac3515
mov eax, dword [esp + 0xa0]
sub eax, dword [esp + 0x30]
mov edi, dword [esp + 0x1c]
sub edi, dword [esp + 0x60]
mov esi, dword [0xc9300c]
mov dword [esp + 0x804], eax
xor eax, eax
push 0x20
inc eax
mov dword [esp + 0x278], ebx
mov word [esp + 0x80c], ax
pop eax
push ebx
push ebx
mov word [esp + 0x812], ax
lea eax, [esp + 0x27c]
push eax
push ebx
lea eax, [esp + 0x80c]
mov dword [esp + 0xb4], ebx
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x824], ebx
mov dword [esp + 0x828], ebx
mov dword [esp + 0x82c], ebx
mov dword [esp + 0x830], ebx
mov dword [esp + 0x834], ebx
mov dword [esp + 0x838], ebx
mov dword [esp + 0x83c], ebx
mov dword [esp + 0x814], 0x28
mov dword [esp + 0x818], edi
call dword [0xc99200]
call esi
mov dword [esp + 0x74], eax
test eax, eax
jne 0xac3664
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [esp + 0xa4], eax
test eax, eax
jle 0xac364a
movzx eax, ax
or eax, 0x80070000
mov dword [esp + 0xa4], eax
test eax, eax
mov edi, dword [esp + 0x2c]
js 0xac397b
mov dword [esp + 0xa4], 0x80004005
jmp 0xac397b
mov esi, dword [0xc93034]
lea ecx, [esp + 0x6d8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xac368e
mov eax, dword [esp + 0x6ec]
mov dword [esp + 0x18], eax
push dword [esp + 0x74]
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0xa4]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [esp + 0x7ec], edi
mov edi, dword [esp + 0x30]
push edi
mov dword [esp + 0x7f4], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
push dword [esp + 0x34]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
push ebx
mov dword [esp + 0xb8], eax
call dword [0xc99200]
call esi
mov esi, dword [esp + 0x2c]
mov ecx, edi
push eax
lea eax, [esp + 0x7e4]
push eax
push esi
call dword [0xc99200]
call edi
push ebx
push dword [esp + 0x10]
lea eax, [esp + 0x7e8]
push eax
push 0xffffffffffffffff
push dword [esp + 0x48]
push esi
mov esi, dword [0xc9306c]
mov ecx, esi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [esp + 0x3c], eax
jne 0xac3776
cmp dword [esp + 0x48], 0
je 0xac376c
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [esp + 0x5c], eax
jmp 0xac377e
mov dword [esp + 0x5c], 0xffffff
jmp 0xac377e
mov dword [esp + 0x5c], 0xffa8a8a8
mov edx, dword [esp + 0x60]
mov esi, ebx
mov dword [esp + 0x1c], ebx
mov ecx, ebx
test edx, edx
jns 0xac3798
mov esi, edx
mov edx, ebx
neg esi
mov dword [esp + 0x1c], esi
mov eax, dword [esp + 0xa0]
test eax, eax
jns 0xac37a9
mov ecx, eax
mov eax, ebx
neg ecx
mov edi, dword [esp + 0x7e8]
sub edi, esi
mov esi, dword [esp + 0x70]
sub esi, edx
mov dword [esp + 0x38], edi
cmp edi, esi
jl 0xac37c6
mov edi, esi
mov dword [esp + 0x38], esi
mov esi, dword [esp + 0x7ec]
sub dword [esp + 0x24], eax
sub esi, ecx
mov dword [esp + 0x30], esi
cmp esi, dword [esp + 0x24]
jl 0xac37e5
mov esi, dword [esp + 0x24]
mov dword [esp + 0x30], esi
test edi, edi
jle 0xac3946
test esi, esi
jle 0xac3946
imul eax, dword [esp + 0x70]
imul ecx, dword [esp + 0x7e8]
mov esi, dword [esp + 0x18]
add eax, edx
mov edx, dword [esp + 0x20]
add ecx, dword [esp + 0x1c]
lea eax, [edx + eax*4]
mov edx, dword [esp + 0x7e8]
shl edx, 2
lea ecx, [esi + ecx*4]
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x70]
shl edx, 2
mov dword [esp + 0x48], ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0xc0], edx
mov esi, dword [esp + 0x38]
lea edx, [eax + 3]
mov ebx, eax
mov dword [esp + 0x24], edx
sub ebx, ecx
mov dword [esp + 0x18], esi
lea edi, [ecx + 2]
mov dword [esp + 0x1c], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xac3906
mov bl, byte [ebx + edi]
mov eax, dword [esp + 0x5c]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x1c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [esp + 0x24]
mov bl, byte [eax - 2]
mov eax, dword [esp + 0x5c]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x24]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [esp + 0x5e]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x24]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [esp + 0x18]
cdq
idiv ecx
mov edx, dword [esp + 0x24]
add al, bl
mov ebx, dword [esp + 0x1c]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], esi
jne 0xac3854
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x20]
add ecx, dword [esp + 0x34]
add eax, dword [esp + 0xc0]
sub dword [esp + 0x30], 1
mov dword [esp + 0x48], ecx
mov dword [esp + 0x20], eax
jne 0xac383a
xor ebx, ebx
push dword [esp + 0x74]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [esp + 0xb4]
mov edi, dword [esp + 0x2c]
test eax, eax
je 0xac397b
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [esp + 0xa4], 0
jl 0xac3f56
mov eax, dword [esp + 0x41c]
mov esi, dword [esp + 0x424]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x430]
push 0x54
mov dword [esp + 0x38], eax
lea eax, [esp + 0x4cc]
push ebx
push eax
mov dword [esp + 0x2c], esi
call fcn.00ab4bf6
add esp, 0xc
lea eax, [esp + 0x730]
push 0x54
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov dword [esp + 0x18], ebx
lea eax, [esp + 0x880]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], ebx
push 0x2c
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [esp + 0x7a4]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0xac3f56
mov esi, dword [0xc93028]
mov ecx, esi
mov edi, dword [esp + 0x98]
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
je 0xac3515
mov esi, dword [0xc93034]
lea ecx, [esp + 0x4c8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xac3a7b
mov eax, dword [esp + 0x4dc]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x4cc]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x4d0]
mov dword [esp + 0x24], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [esp + 0x2c], ecx
test ecx, ecx
je 0xac3515
mov eax, dword [esp + 0x8c]
sub eax, dword [esp + 0x44]
mov edi, dword [esp + 0x54]
mov esi, dword [0xc9300c]
mov dword [esp + 0x8c], eax
mov dword [esp + 0x884], eax
mov eax, edi
sub eax, dword [esp + 0x6c]
mov dword [esp + 0x888], eax
xor eax, eax
push 0x20
inc eax
mov dword [esp + 0x27c], ebx
mov word [esp + 0x890], ax
pop eax
push ebx
push ebx
mov word [esp + 0x896], ax
lea eax, [esp + 0x280]
push eax
push ebx
lea eax, [esp + 0x890]
mov dword [esp + 0x70], ebx
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x8a8], ebx
mov dword [esp + 0x8ac], ebx
mov dword [esp + 0x8b0], ebx
mov dword [esp + 0x8b4], ebx
mov dword [esp + 0x8b8], ebx
mov dword [esp + 0x8bc], ebx
mov dword [esp + 0x8c0], ebx
mov dword [esp + 0x898], 0x28
call dword [0xc99200]
call esi
mov dword [esp + 0x74], eax
test eax, eax
jne 0xac3b80
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [esp + 0x60], eax
test eax, eax
jle 0xac3b69
movzx eax, ax
or eax, 0x80070000
mov dword [esp + 0x60], eax
test eax, eax
mov edi, dword [esp + 0x2c]
js 0xac3e98
mov dword [esp + 0x60], 0x80004005
jmp 0xac3e98
mov esi, dword [0xc93034]
lea ecx, [esp + 0x730]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xac3baa
mov eax, dword [esp + 0x744]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x8c]
push dword [esp + 0x74]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [esp + 0x7a4], eax
mov eax, dword [esp + 0x70]
sub eax, edi
mov edi, dword [esp + 0x30]
push edi
mov dword [esp + 0x7ac], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
push dword [esp + 0x34]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
push ebx
mov dword [esp + 0xb8], eax
call dword [0xc99200]
call esi
mov esi, dword [esp + 0x2c]
mov ecx, edi
push eax
lea eax, [esp + 0x79c]
push eax
push esi
call dword [0xc99200]
call edi
push ebx
push dword [esp + 0x10]
lea eax, [esp + 0x7a0]
push eax
push 0xffffffffffffffff
push dword [esp + 0x30]
push esi
mov esi, dword [0xc9306c]
mov ecx, esi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [esp + 0x3c], eax
jne 0xac3c9a
cmp dword [esp + 0x38], 0
je 0xac3c90
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x70], ecx
jmp 0xac3ca7
mov dword [esp + 0x70], 0xffffff
jmp 0xac3ca7
mov eax, 0xffa8a8a8
mov dword [esp + 0x28], eax
mov dword [esp + 0x70], eax
mov edx, dword [esp + 0x44]
mov edi, ebx
mov eax, ebx
test edx, edx
jns 0xac3cbb
mov edi, edx
mov dword [esp + 0x44], ebx
neg edi
mov ecx, dword [esp + 0x54]
test ecx, ecx
jns 0xac3cc9
mov eax, ecx
mov ecx, ebx
neg eax
mov esi, dword [esp + 0x7a0]
mov edx, dword [esp + 0x30]
sub esi, edi
sub edx, dword [esp + 0x44]
mov dword [esp + 0x48], esi
cmp esi, edx
jl 0xac3ce8
mov esi, edx
mov dword [esp + 0x48], edx
mov edx, dword [esp + 0x7a4]
sub dword [esp + 0x24], ecx
sub edx, eax
mov dword [esp + 0x6c], edx
cmp edx, dword [esp + 0x24]
jl 0xac3d07
mov edx, dword [esp + 0x24]
mov dword [esp + 0x6c], edx
test esi, esi
jle 0xac3e63
test edx, edx
jle 0xac3e63
mov edx, dword [esp + 0x7a0]
imul ecx, dword [esp + 0x30]
imul eax, edx
shl edx, 2
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x30]
add ecx, dword [esp + 0x44]
add eax, edi
mov edi, dword [esp + 0x1c]
shl edx, 2
mov dword [esp + 0xc0], edx
lea eax, [edi + eax*4]
mov edi, dword [esp + 0x18]
mov dword [esp + 0x20], eax
lea ecx, [edi + ecx*4]
mov dword [esp + 0x38], ecx
mov ebx, ecx
mov dword [esp + 0x18], esi
lea edx, [ecx + 3]
sub ebx, eax
mov dword [esp + 0x24], edx
lea edi, [eax + 2]
mov dword [esp + 0x1c], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xac3e1f
mov bl, byte [ebx + edi]
mov eax, dword [esp + 0x28]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x1c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [esp + 0x24]
mov bl, byte [eax - 2]
mov eax, dword [esp + 0x28]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x24]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [esp + 0x72]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [esp + 0x24]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [esp + 0x18]
cdq
idiv ecx
mov edx, dword [esp + 0x24]
add al, bl
mov ebx, dword [esp + 0x1c]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], esi
jne 0xac3d6d
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x38]
add eax, dword [esp + 0x34]
add ecx, dword [esp + 0xc0]
sub dword [esp + 0x6c], 1
mov esi, dword [esp + 0x48]
mov dword [esp + 0x20], eax
mov dword [esp + 0x38], ecx
jne 0xac3d57
xor ebx, ebx
push dword [esp + 0x74]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [esp + 0xb4]
mov edi, dword [esp + 0x2c]
test eax, eax
je 0xac3e98
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [esp + 0x60], 0
jl 0xac3f56
xor eax, eax
inc eax
cmp dword [esp + 0x3c], eax
jne 0xac3efa
mov esi, dword [section..data]
mov ecx, esi
push 0xcc0020
push ebx
push ebx
push dword [esp + 0xa4]
push dword [esp + 0x20]
push dword [esp + 0x94]
push dword [esp + 0x458]
push dword [esp + 0x458]
push dword [esp + 0x78]
call dword [0xc99200]
call esi
jmp 0xac3f3b
push dword [esp + 0x4c]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x84]
mov esi, dword [0xc93020]
push ecx
push eax
push ebx
push ebx
push dword [esp + 0xac]
push ecx
push eax
push dword [esp + 0x7ac]
mov ecx, esi
push dword [esp + 0x7ac]
push dword [esp + 0x80]
call dword [0xc99200]
call esi
push dword [esp + 0x108]
mov esi, dword [0xc93040]
mov ecx, esi
push dword [esp + 0x5c]
call dword [0xc99200]
call esi
mov eax, dword [esp + 0xbc]
test eax, eax
je 0xac3f72
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov eax, dword [esp + 0x98]
test eax, eax
je 0xac3f8e
mov esi, dword [0xc93018]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov eax, dword [esp + 0x124]
test eax, eax
je 0xac3faa
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov edi, 0xc96238
mov ecx, dword [esp + 0x420]
test ecx, ecx
je 0xac3ff9
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xac3fbd
mov eax, dword [esp + 0x420]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xac3fe6
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xac3fde
mov ecx, dword [esp + 0x420]
call fcn.00ad1951
mov dword [esp + 0x420], ebx
mov ecx, dword [esp + 0x424]
test ecx, ecx
je 0xac4043
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xac4007
mov eax, dword [esp + 0x424]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xac4030
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xac4028
mov ecx, dword [esp + 0x424]
call fcn.00ad1951
mov dword [esp + 0x424], ebx
mov edx, dword [esp + 0x428]
test edx, edx
je 0xac408a
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xac4053
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xac407c
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0xac406d
mov edx, dword [esp + 0x428]
mov ecx, edx
call fcn.00ad1951
mov dword [esp + 0x428], ebx
cmp dword [esp + 0x42c], 0
je 0xac40b2
push dword [esp + 0x42c]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [esp + 0x42c], ebx
cmp dword [esp + 0x430], 0
je 0xac40da
push dword [esp + 0x430]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [esp + 0x430], ebx
cmp dword [esp + 0x434], 0
je 0xac4102
push dword [esp + 0x434]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [esp + 0x434], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xac4104
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jle 0xac4166
sub eax, 1
mov dword [0xc95890], eax
jne 0xac4166
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xac413a
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xac4129
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0xc95878]
mov esi, dword [0xc9304c]
mov ecx, esi
mov dword [esp + 0x48], eax
call dword [0xc99200]
call esi
sub eax, dword [0xc95870]
lea edi, [esp + 0xb7c]
push 7
mov dword [esp + 0x3c], eax
mov edx, 0xc96238
xor eax, eax
xor ebx, ebx
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xac41a2
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jne 0xac472a
mov edi, ebx
mov dword [esp + 0x30], ebx
mov ecx, 0x338
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], ebx
call fcn.00ad193e
mov dword [esp + 0x108], eax
test eax, eax
je 0xac46c5
or dword [esp + 0x1c], 0xffffffff
mov cl, bl
add eax, 7
mov dword [esp + 0xec], ebx
mov dword [esp + 0xc], ebx
mov edx, ebx
mov dword [esp + 0x18], eax
mov esi, dword [esp + 0x11c]
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [esp + 0x40], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [esp + 0x11c], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [esp + 0xc]
xor esi, edx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [esp + 0x40]
xor eax, edx
mov dword [esp + 0x40], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [esp + 0x40]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [esp + 0x40]
sub edx, 0x756c8a2
xor eax, edx
mov dword [esp + 0x40], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [esp + 0x40]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [esp + 0x40]
xor edx, eax
mov dword [esp + 0x40], edx
mov eax, dword [esp + 0x40]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [esp + 0x40]
xor eax, edx
mov dword [esp + 0x40], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [esp + 0x40]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [esp + 0x40]
xor eax, edx
mov dword [esp + 0x40], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [esp + 0x40]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [esp + 0x40]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
lea eax, [esi - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [esp + 0xc], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [esp + 0xc]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [esp + 0xc]
xor eax, edx
mov dword [esp + 0xc], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [esp + 0xc], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [esp + 0xc]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [esp + 0xc]
xor eax, edx
mov dword [esp + 0xc], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [esp + 0xc]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [esp + 0xc]
xor eax, edx
mov edx, 0x7f1137f
mov dword [esp + 0xc], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [esp + 0xc]
rol eax, 2
xor edx, eax
mov eax, dword [esp + 0xc]
xor edx, dword [esp + 0xec]
xor eax, dword [esp + 0x1c]
xor esi, edx
mov edx, esi
mov dword [esp + 0x40], esi
mov esi, dword [esp + 0x18]
mov dword [esp + 0xec], ebx
mov dword [esp + 0x1c], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [esp + 0x118], 1
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], esi
jne 0xac4201
mov esi, dword [esp + 0x108]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xac4526
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xac454f
cmp edx, dword [0x9fc02c]
jne 0xac454f
mov edi, esi
mov dword [esp + 0x2c], esi
mov esi, ebx
jmp 0xac455e
or dword [esp + 0x78], 0xffffffff
mov edi, ebx
mov dword [esp + 0x20], 0xc004d501
test esi, esi
je 0xac4569
mov ecx, esi
call fcn.00ad1951
cmp dword [esp + 0x20], ebx
jl 0xac46c1
mov eax, dword [esp + 0x78]
mov esi, edi
push 0x40
push ebx
push 0xc960a0
mov byte [eax + edi], bl
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], bl
je 0xac46cc
mov edi, 0xc960a0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [esp + 0x108], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xac45a7
sub ecx, dword [esp + 0x108]
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xac46ba
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [esp + 0x28], ecx
cmp word [eax], dx
je 0xac45ef
mov ecx, 0xc000007b
mov dword [esp + 0x28], ecx
jmp 0xac4639
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xac45e4
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xac45e4
cmp dword [edx], 0x4550
jne 0xac45e4
movzx eax, word [edx + 0x18]
cmp ax, word [esp + 0x18c]
je 0xac4627
cmp ax, word [esp + 0x100]
je 0xac4627
mov ecx, 0xc000000d
jmp 0xac45e9
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [esp + 0x164], eax
mov dword [esp + 0x78], ebx
test eax, eax
je 0xac46a9
mov edx, esi
mov dword [esp + 0x34], esi
lea eax, [edx + 1]
mov dword [esp + 0x108], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xac465f
sub edx, dword [esp + 0x108]
inc esi
add esi, edx
test ecx, ecx
js 0xac4693
push dword [esp + 0x34]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xac46b4
mov ecx, dword [esp + 0x30]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x78]
inc dword [esp + 0x30]
inc eax
mov dword [esp + 0x78], eax
cmp eax, dword [esp + 0x164]
jb 0xac464f
add edi, 0x10
cmp byte [esi], bl
jne 0xac4599
mov esi, dword [esp + 0x28]
jmp 0xac46ce
mov esi, 0xc000007a
jmp 0xac46ce
mov edi, dword [esp + 0x2c]
mov esi, 0xc000007a
jmp 0xac46d2
mov esi, ebx
mov edi, dword [esp + 0x2c]
test edi, edi
je 0xac46e5
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push edi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0xac4725
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xac46fc
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xac46eb
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xac4730
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov edi, 0xc96238
xchg dword [edi], eax
mov eax, dword [esp + 0x38]
xor ecx, ecx
mov esi, dword [0xc93068]
inc ecx
mov dword [esp + 0xb7c], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0xb94], eax
lea eax, [esp + 0xb78]
push eax
push 4
pop eax
push eax
push 0x2021
mov dword [esp + 0xb84], ecx
mov dword [esp + 0xb8c], ecx
mov dword [esp + 0xb98], ecx
mov dword [esp + 0xb94], ecx
mov dword [esp + 0xb9c], ecx
mov ecx, esi
push ebx
mov dword [esp + 0xb94], 0x9966f291
call dword [0xc99200]
call esi
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xac47a4
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jle 0xac4806
sub eax, 1
mov dword [0xc95890], eax
jne 0xac4806
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xac47da
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xac47c9
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
push dword [esp + 0x58]
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
lea ecx, [esp + 0x1b4]
call fcn.00ad18e0
xor eax, eax
mov dword [esp + 0x38], ebx
lea edi, [esp + 0x368]
mov dword [esp + 0x3c], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [esp + 0x208]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [esp + 0x1b4], eax
test eax, eax
je 0xac68e8
push 0x28
pop ecx
mov esi, 0xc94ea0
mov dword [esp + 0x38], eax
mov edi, eax
rep movsd dword es:[edi], dword [esi]
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [esp + 0x108], eax
test eax, eax
je 0xac68e8
mov ecx, dword [0xc94e98]
mov edi, eax
mov dword [eax], ecx
mov ecx, dword [0xc94e9c]
mov dword [eax + 4], ecx
mov dword [esp + 0x3c], edi
rdtsc
mov dword [esp + 0x34], eax
mov dword [esp + 0x164], edx
lea eax, [esp + 0x284]
mov dword [esp + 0xe4], ebx
push eax
push 4
pop esi
mov edx, esi
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xac68df
mov edx, dword [esp + 0x284]
lea eax, [esp + 0xe4]
push eax
xor ecx, ecx
call fcn.00a32533
or eax, 0x10000000
jl 0xac68df
lea eax, [esp + 0x288]
mov edx, 0xa0
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xac68df
mov edx, dword [esp + 0x288]
lea eax, [esp + 0xe4]
mov ecx, dword [esp + 0xe4]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xac68df
lea eax, [esp + 0x28c]
mov ecx, esi
push eax
push 8
pop edx
call fcn.00a32533
test eax, eax
js 0xac68df
mov edx, dword [esp + 0x28c]
lea eax, [esp + 0xe4]
mov ecx, dword [esp + 0xe4]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xac68df
lea eax, [esp + 0x290]
mov ecx, esi
push eax
push 8
pop edx
call fcn.00a32533
test eax, eax
js 0xac68df
mov edx, dword [esp + 0x290]
lea eax, [esp + 0xe4]
mov ecx, dword [esp + 0xe4]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xac68df
mov esi, dword [esp + 0xe4]
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [esp + 0x68], edi
test edi, edi
je 0xac68e8
lea eax, [esp + 0x3e8]
mov ecx, edi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
test eax, eax
js 0xac6866
lea ecx, [edi + esi]
lea eax, [edi + 8]
mov dword [esp + 0x30], ecx
cmp eax, ecx
ja 0xac6866
mov eax, dword [esp + 0x3e8]
push 4
pop ecx
mov dword [edi], ecx
mov dword [eax], ecx
mov esi, edi
mov edi, ebx
mov dword [esp + 0xfc], esi
mov edx, dword [esi]
lea eax, [esp + 0x294]
push eax
call fcn.00a32533
test eax, eax
js 0xac6866
mov edx, dword [esp + 0x294]
lea eax, [esp + 0xfc]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xac6866
mov esi, dword [esp + 0xfc]
xor eax, eax
inc edi
inc eax
cmp edi, eax
jae 0xac4a7d
push 4
pop ecx
jmp 0xac4a34
lea eax, [esp + 0x3f0]
mov ecx, esi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
test eax, eax
js 0xac6866
lea eax, [esi + 0xa4]
cmp eax, dword [esp + 0x30]
ja 0xac6866
mov edi, dword [esp + 0x3f0]
mov dword [esi], 0xa0
mov esi, dword [esp + 0x1b4]
push 0x28
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x68]
mov esi, edi
mov dword [esp + 0xcc], esi
mov dword [esp + 0x78], ebx
mov edx, dword [esi]
lea eax, [esp + 0x298]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
test eax, eax
js 0xac6866
mov edx, dword [esp + 0x298]
lea eax, [esp + 0xcc]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xac6866
mov eax, dword [esp + 0x78]
mov esi, dword [esp + 0xcc]
inc eax
mov dword [esp + 0x78], eax
cmp eax, 2
jb 0xac4ad3
lea eax, [esp + 0x3f8]
mov ecx, esi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
test eax, eax
js 0xac6866
lea eax, [esi + 0xc]
cmp eax, dword [esp + 0x30]
ja 0xac6866
mov edx, dword [esp + 0x108]
mov ecx, dword [esp + 0x3f8]
mov dword [esi], 8
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov esi, edi
mov edi, ebx
mov dword [esp + 0x64], esi
mov edx, dword [esi]
lea eax, [esp + 0x29c]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
test eax, eax
js 0xac6866
mov edx, dword [esp + 0x29c]
lea eax, [esp + 0x64]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xac6866
mov esi, dword [esp + 0x64]
inc edi
cmp edi, 3
jb 0xac4b71
lea eax, [esp + 0x400]
mov ecx, esi
push eax
push 4
pop edi
mov edx, edi
call fcn.00a32533
test eax, eax
js 0xac6866
lea eax, [esi + 0xc]
cmp eax, dword [esp + 0x30]
ja 0xac6866
mov eax, dword [esp + 0x400]
mov ecx, dword [esp + 0x34]
mov dword [esi], 8
mov dword [eax], ecx
mov ecx, dword [esp + 0x164]
mov dword [eax + 4], ecx
lea eax, [esp + 0x10c]
mov edx, edi
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xac6866
mov esi, dword [esp + 0x10c]
lea eax, [esp + 0x88]
push eax
push 8
pop edx
mov ecx, edi
mov dword [esp + 0xd4], esi
call fcn.00a32533
test eax, eax
js 0xac6866
mov edx, dword [esp + 0x88]
lea eax, [esp + 0xd0]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xac6866
rdtsc
mov edi, ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x88], eax
mov dword [esp + 0x10c], edx
push 8
pop ecx
mov dword [esp + 0x1d8], ecx
mov edx, dword [esp + 0xe4]
lea eax, [esp + 0x1d8]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac4dc1
mov eax, dword [esp + 0x1d8]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [esp + 0x78], ecx
cmp ecx, eax
jae 0xac4ce4
mov esi, 0xc0000095
jmp 0xac4dc1
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [esp + 0x100], eax
test eax, eax
jne 0xac4d09
mov esi, 0xc0000017
jmp 0xac4dc1
push 4
pop edx
lea ecx, [esp + 0xc8]
mov dword [esp + 0xc8], eax
push ecx
mov ecx, eax
mov dword [eax], edx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac4da7
mov ecx, dword [esp + 0xc8]
mov eax, dword [esp + 0xe4]
mov dword [ecx], eax
lea eax, [esp + 0xc8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov eax, dword [esp + 0x100]
test esi, esi
js 0xac4dae
mov ecx, dword [esp + 0x78]
push dword [esp + 0xe4]
mov edx, dword [esp + 0x8c]
push dword [esp + 0x6c]
mov dword [eax + ecx - 8], edx
mov edx, dword [esp + 0x114]
push dword [esp + 0xd0]
mov dword [eax + ecx - 4], edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [esp + 0x10c]
add esp, 0xc
mov ecx, dword [esp + 0x78]
mov dword [esp + 0xf0], eax
mov eax, ebx
mov dword [esp + 0x64], ecx
jmp 0xac4dae
mov eax, dword [esp + 0x100]
test eax, eax
je 0xac4dc1
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xac667d
cmp dword [esp + 0xf0], 0
mov dword [esp + 0xb8], ebx
jne 0xac4de8
mov esi, 0xc000000d
jmp 0xac53eb
mov esi, dword [esp + 0x64]
test esi, esi
je 0xac53e6
lea eax, [esi + 8]
mov ecx, eax
mov dword [esp + 0x10c], eax
call fcn.00ad193e
mov dword [esp + 0xc8], eax
test eax, eax
je 0xac53e6
mov edi, dword [esp + 0xf0]
mov cl, bl
mov eax, ebx
test esi, esi
je 0xac4e2b
xor cl, byte [eax + edi]
inc eax
cmp eax, esi
jb 0xac4e23
mov eax, 0xb1b54a58
mov dword [esp + 0x7f0], eax
mov eax, 0xc81ecb17
mov dword [esp + 0x7f4], eax
mov eax, esi
shr eax, 3
mov dword [esp + 0xec], eax
test eax, eax
je 0xac51fb
movzx edx, word [esp + 0x7f2]
mov eax, 0xc81ecb17
movzx esi, ax
movzx eax, word [esp + 0x7f6]
mov dword [esp + 0x50], eax
mov eax, 0xb1b54a58
movzx eax, ax
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0xc8]
mov dword [esp + 0x94], esi
add eax, 7
or dword [esp + 0x88], 0xffffffff
lea esi, [edi + 2]
mov dword [esp + 0x7c], edx
mov edx, ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x118], ebx
mov ebx, dword [esp + 0x88]
mov dword [esp + 0x11c], eax
mov dword [esp + 0x2c], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [esp + 0x2c]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [esp + 0x2c]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [esp + 0x2c]
shl esi, 8
add dword [esp + 0x2c], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov eax, ebx
sub eax, dword [esp + 0x90]
xor eax, 0xc81ecb17
xor eax, edi
xor edx, eax
mov dword [esp + 0xc], edx
mov edx, 0xc81ecb17
mov eax, dword [esp + 0xc]
xor edx, eax
ror edx, 0xf
imul edx, dword [esp + 0x7c]
ror eax, 7
add edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
mov eax, ebx
ror eax, 0xa
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [esp + 0x94]
sub edx, eax
mov eax, dword [esp + 0xc]
xor eax, edx
mov edx, eax
mov dword [esp + 0xc], eax
xor edx, dword [esp + 0x94]
rol edx, 4
imul edx, dword [esp + 0x50]
rol eax, 5
add edx, eax
mov eax, 0xc81ecb17
xor ebx, edx
mov edx, 0xb1b54a58
xor edx, ebx
sub eax, edx
mov edx, dword [esp + 0xc]
xor edx, eax
mov dword [esp + 0xc], edx
sub edx, dword [esp + 0x90]
imul edx, dword [esp + 0x7c]
mov eax, dword [esp + 0xc]
shr eax, 6
sub edx, eax
xor ebx, edx
mov edx, dword [esp + 0xc]
mov eax, ebx
ror eax, 0xf
xor eax, dword [esp + 0x94]
imul eax, dword [esp + 0x90]
xor edx, eax
mov eax, edx
not eax
ror eax, 3
add eax, dword [esp + 0x50]
imul eax, dword [esp + 0x94]
xor ebx, eax
mov eax, ebx
sub eax, dword [esp + 0x90]
sub eax, 0xc81ecb17
xor edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
xor eax, dword [esp + 0x50]
imul eax, dword [esp + 0x7c]
ror edx, 0xa
xor edx, eax
xor ebx, edx
mov edx, dword [esp + 0x90]
xor edx, ebx
mov eax, ebx
rol edx, 6
imul edx, dword [esp + 0x94]
ror eax, 3
xor edx, eax
mov eax, dword [esp + 0xc]
xor eax, edx
mov dword [esp + 0xc], eax
ror eax, 0xf
sub eax, dword [esp + 0x50]
imul eax, dword [esp + 0x90]
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [esp + 0x50]
imul edx, dword [esp + 0x90]
shr eax, 1
xor edx, eax
mov eax, ebx
xor dword [esp + 0xc], edx
mov edx, ebx
sub edx, dword [esp + 0x94]
rol edx, 3
imul edx, dword [esp + 0x90]
shr eax, 0xf
xor edx, eax
mov eax, dword [esp + 0xc]
xor eax, edx
mov edx, eax
mov dword [esp + 0xc], eax
sub edx, dword [esp + 0x94]
imul edx, dword [esp + 0x7c]
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 9
imul edx, dword [esp + 0x94]
ror eax, 0xb
xor edx, eax
mov eax, dword [esp + 0xc]
xor eax, edx
mov dword [esp + 0xc], eax
sub eax, 0xb1b54a58
sub eax, dword [esp + 0x50]
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [esp + 0x7c]
imul eax, dword [esp + 0x90]
ror edx, 7
sub eax, edx
mov edx, dword [esp + 0xc]
xor edx, eax
mov dword [esp + 0xc], edx
xor edx, dword [esp + 0x50]
mov eax, dword [esp + 0xc]
rol edx, 4
imul edx, dword [esp + 0x7c]
ror eax, 0x10
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
ror edx, 0xa
imul edx, dword [esp + 0x94]
mov eax, ebx
ror eax, 4
add edx, eax
mov eax, dword [esp + 0xc]
xor eax, edx
mov edx, eax
mov dword [esp + 0xc], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, dword [esp + 0x50]
xor edx, eax
xor ebx, edx
mov edx, 0xc81ecb17
xor edx, ebx
mov eax, ebx
rol edx, 8
imul edx, dword [esp + 0x90]
rol eax, 2
sub edx, eax
mov eax, dword [esp + 0xc]
xor eax, edx
mov edx, 0xc81ecb17
sub edx, eax
mov dword [esp + 0xc], eax
ror edx, 0xb
imul edx, dword [esp + 0x7c]
ror eax, 0xc
sub edx, eax
xor ebx, edx
mov edx, dword [esp + 0x7c]
xor edx, ebx
mov eax, ebx
imul edx, dword [esp + 0x94]
shr eax, 8
xor edx, eax
mov eax, 0xb1b54a58
xor dword [esp + 0xc], edx
xor eax, 0xc81ecb17
mov edx, dword [esp + 0xc]
xor ebx, eax
mov eax, dword [esp + 0x11c]
xor ebx, edx
xor edx, dword [esp + 0x78]
xor ebx, dword [esp + 0x118]
mov dword [esp + 0x118], esi
mov esi, dword [esp + 0x2c]
mov byte [eax - 4], dl
mov byte [eax], bl
ror edx, 8
mov byte [eax - 5], dl
ror ebx, 8
mov byte [eax - 1], bl
ror edx, 8
mov byte [eax - 6], dl
ror ebx, 8
mov byte [eax - 2], bl
ror edx, 8
ror ebx, 8
mov byte [eax - 7], dl
mov byte [eax - 3], bl
add eax, 8
ror edx, 8
ror ebx, 8
sub dword [esp + 0xec], 1
mov dword [esp + 0x78], edi
mov dword [esp + 0x11c], eax
jne 0xac4ec1
mov esi, dword [esp + 0x64]
xor ebx, ebx
movzx eax, cl
mov ecx, dword [esp + 0xc8]
cdq
mov dword [ecx + esi], eax
mov dword [ecx + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [esp + 0x88], edi
test edi, edi
jne 0xac5235
mov esi, 0xc0000017
jmp 0xac533b
mov esi, dword [esp + 0x10c]
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0xac525b
mov esi, 0xc0000017
jmp 0xac52da
mov dword [edi + 4], ecx
mov eax, dword [esp + 0xc8]
push esi
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xac5254
mov dword [edi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0xc94df0
push 8
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x8c]
pop eax
push eax
push eax
mov dword [edi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0xac5254
mov dword [edi + 0x14], ecx
mov eax, dword [0xc94e90]
mov esi, ebx
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [esp + 0xb8], edi
mov edi, ebx
mov dword [ecx + 4], eax
test edi, edi
je 0xac533b
cmp dword [edi + 4], 0
je 0xac52f8
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xac5312
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xac532c
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xac5353
mov edi, dword [esp + 0xb8]
mov dword [esp + 0x20], edi
mov dword [esp + 0xb8], ebx
jmp 0xac5355
mov edi, ebx
push dword [esp + 0xc8]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [esp + 0xb8]
test eax, eax
je 0xac53eb
mov ecx, dword [eax + 4]
test ecx, ecx
je 0xac5395
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [esp + 0xb8]
mov dword [eax + 4], ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0xac53b5
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [esp + 0xb8]
mov dword [eax + 0xc], ebx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0xac53d5
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [esp + 0xb8]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xac53eb
mov esi, 0xc0000001
or esi, 0x10000000
jl 0xac667d
mov edx, dword [edi]
lea eax, [esp + 0xf4]
push 4
pop ecx
push eax
mov dword [esp + 0xf8], ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5495
mov ecx, dword [esp + 0xf4]
lea eax, [esp + 0xf4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5495
mov edx, dword [edi + 8]
lea eax, [esp + 0xf4]
mov ecx, dword [esp + 0xf4]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5495
mov ecx, dword [esp + 0xf4]
lea eax, [esp + 0xf4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5495
mov edx, dword [edi + 0x10]
lea eax, [esp + 0xf4]
mov ecx, dword [esp + 0xf4]
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [esp + 0xf4]
test esi, esi
jns 0xac549c
mov eax, dword [esp + 0x3bc]
mov dword [esp + 0x78], eax
test esi, esi
js 0xac5602
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [esp + 0x50], ecx
test ecx, ecx
jne 0xac54cc
mov esi, 0xc0000017
jmp 0xac5602
mov eax, dword [edi]
mov dword [ecx], eax
lea eax, [esp + 0xc4]
push eax
push 4
pop eax
mov edx, eax
mov dword [esp + 0xc8], ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac55eb
push dword [edi]
push dword [edi + 4]
push dword [esp + 0xcc]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi]
lea eax, [esp + 0xd0]
mov ecx, dword [esp + 0xd0]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac55eb
mov ecx, dword [esp + 0xc4]
mov eax, dword [edi + 8]
mov dword [ecx], eax
lea eax, [esp + 0xc4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac55eb
push dword [edi + 8]
push dword [edi + 0xc]
push dword [esp + 0xcc]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi + 8]
lea eax, [esp + 0xd0]
mov ecx, dword [esp + 0xd0]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac55eb
mov ecx, dword [esp + 0xc4]
mov eax, dword [edi + 0x10]
mov dword [ecx], eax
lea eax, [esp + 0xc4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac55eb
push dword [edi + 0x10]
push dword [edi + 0x14]
push dword [esp + 0xcc]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi + 0x10]
lea eax, [esp + 0xd0]
mov ecx, dword [esp + 0xd0]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [esp + 0x50]
test esi, esi
js 0xac55ef
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x30], eax
mov eax, ebx
mov dword [esp + 0x1c], ecx
jmp 0xac55ef
mov eax, dword [esp + 0x50]
test eax, eax
je 0xac5602
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xac667d
push 8
pop edi
mov dword [esp + 0x78], ebx
mov dword [esp + 0x1dc], edi
mov edx, dword [esp + 0xd0]
lea eax, [esp + 0x1dc]
push eax
mov ecx, edi
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
jl 0xac5693
mov eax, dword [esp + 0x1dc]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xac5654
mov esi, 0xc0000095
jmp 0xac5677
mov dword [esp + 0x1e0], ecx
lea eax, [esp + 0x1e0]
mov edx, edi
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [esp + 0x1e0]
test esi, esi
jns 0xac567e
mov eax, dword [esp + 0x2a8]
mov dword [esp + 0x64], eax
test esi, esi
js 0xac5693
mov edi, dword [esp + 0x68]
test edi, edi
jne 0xac56c1
mov esi, 0xc000000d
mov edi, ebx
test esi, esi
js 0xac667d
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xac58c5
mov esi, 0xd0000017
mov eax, ebx
jmp 0xac58ce
xor eax, eax
push 4
pop edx
inc eax
cmp edx, eax
jbe 0xac568e
mov ecx, edi
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ecx
mov eax, dword [ecx]
mov dword [esp + 0x88], eax
lea eax, [esp + 0xd4]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5693
mov edx, dword [esp + 0x88]
lea eax, [esp + 0xd4]
mov ecx, dword [esp + 0xd4]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5693
mov eax, dword [esp + 0xd0]
xor ecx, ecx
inc eax
inc ecx
cmp eax, ecx
mov dword [esp + 0xd0], eax
mov ecx, dword [esp + 0xd4]
jae 0xac573e
push 4
pop edx
jmp 0xac56db
mov eax, dword [ecx]
mov dword [esp + 0x88], eax
lea eax, [esp + 0xd4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5693
mov eax, dword [esp + 0x88]
mov dword [esp + 0x78], eax
push 4
pop edx
cmp edx, 2
jbe 0xac568e
mov ecx, edi
mov edi, ebx
mov dword [esp + 0xd8], ecx
mov eax, dword [ecx]
mov dword [esp + 0x88], eax
lea eax, [esp + 0xd8]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac57ee
mov edx, dword [esp + 0x88]
lea eax, [esp + 0xd8]
mov ecx, dword [esp + 0xd8]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac57ee
mov ecx, dword [esp + 0xd8]
inc edi
cmp edi, 2
jae 0xac57d4
push 4
pop edx
jmp 0xac5785
mov edi, dword [ecx]
lea eax, [esp + 0xd8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
jns 0xac57f8
mov edi, ebx
test esi, esi
js 0xac5693
mov edx, dword [esp + 0x64]
lea eax, [esp + 0xf8]
push 4
pop ecx
push eax
mov dword [esp + 0xfc], ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5898
mov ecx, dword [esp + 0xf8]
lea eax, [esp + 0xf8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5898
mov edx, dword [esp + 0x78]
lea eax, [esp + 0xf8]
mov ecx, dword [esp + 0xf8]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5898
mov ecx, dword [esp + 0xf8]
lea eax, [esp + 0xf8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5898
mov ecx, dword [esp + 0xf8]
lea eax, [esp + 0xf8]
push eax
mov edx, edi
call fcn.00a32533
mov edi, dword [esp + 0xf8]
mov esi, eax
test esi, esi
jns 0xac58a7
mov edi, dword [esp + 0x3c0]
test esi, esi
js 0xac5693
cmp edi, 0x400000
jbe 0xac58b9
mov esi, 0x8000ffff
jmp 0xac667d
mov dword [esp + 0x84], edi
jmp 0xac5695
mov dword [esp + 0x70], eax
mov esi, 0x10000000
test esi, esi
js 0xac667d
mov ecx, dword [esp + 0x30]
test ecx, ecx
jne 0xac58e8
mov esi, 0x80070057
jmp 0xac667d
test eax, eax
je 0xac58de
mov dword [esp + 0x344], eax
lea eax, [esp + 0x2ac]
push eax
xor eax, eax
mov dword [esp + 0x344], ecx
mov ecx, dword [esp + 0x20]
inc eax
push 0x9f29b8
push eax
mov dword [esp + 0x354], ecx
mov dword [esp + 0x358], edi
mov dword [esp + 0x35c], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xac594e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xac5945
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xac5998
mov esi, 0x80004005
jmp 0xac5998
push 0x9fc030
push dword [esp + 0x2b0]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xac592e
push ebx
push 0x14
lea eax, [esp + 0x348]
mov ecx, esi
push eax
push 0x86
call dword [0xc99200]
call esi
mov esi, eax
or esi, 0x10000000
jl 0xac5998
mov edi, dword [esp + 0x34c]
mov dword [esp + 0x84], edi
cmp esi, 0xd0000023
jne 0xac59aa
mov esi, 0x8007007a
jmp 0xac667d
test esi, esi
js 0xac667d
mov eax, dword [esp + 0x70]
push 4
pop edx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xe8], eax
cmp edi, edx
jae 0xac59dc
mov esi, 0xc000003e
jmp 0xac5dd0
mov edi, dword [eax]
lea ecx, [esp + 0xe8]
push ecx
mov ecx, eax
mov dword [esp + 0x8c], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5dd0
lea eax, [esp + 0xb0]
xor ecx, ecx
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5dd0
mov eax, dword [esp + 0x84]
sub eax, dword [esp + 0xb0]
cmp eax, edi
jb 0xac59d2
mov eax, dword [esp + 0xe8]
lea ecx, [esp + 0xe8]
push ecx
mov edx, edi
mov dword [esp + 0xd4], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5dd0
mov ecx, dword [esp + 0xb0]
lea eax, [esp + 0xb0]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5dd0
mov eax, dword [esp + 0x84]
sub eax, dword [esp + 0xb0]
push 4
pop edx
cmp eax, edx
jb 0xac59d2
mov ecx, dword [esp + 0xe8]
lea eax, [esp + 0xe8]
push eax
mov edi, dword [ecx]
mov dword [esp + 0x110], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5dd0
mov ecx, dword [esp + 0xb0]
lea eax, [esp + 0xb0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5dd0
mov eax, dword [esp + 0x84]
sub eax, dword [esp + 0xb0]
cmp eax, edi
jb 0xac59d2
mov eax, dword [esp + 0xe8]
lea ecx, [esp + 0xe8]
push ecx
mov edx, edi
mov dword [esp + 0x7c], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5dd0
mov ecx, dword [esp + 0xb0]
lea eax, [esp + 0xb0]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5dd0
mov eax, dword [esp + 0x84]
sub eax, dword [esp + 0xb0]
push 4
pop edx
cmp eax, edx
jb 0xac59d2
mov ecx, dword [esp + 0xe8]
mov eax, dword [ecx]
mov dword [esp + 0x64], eax
lea eax, [esp + 0xe8]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5dd0
mov ecx, dword [esp + 0xb0]
lea eax, [esp + 0xb0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5dd0
mov eax, dword [esp + 0x84]
sub eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0x64]
cmp eax, ecx
jb 0xac59d2
lea eax, [esp + 0xb0]
mov edx, ecx
mov ecx, dword [esp + 0xb0]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac5dd0
mov ecx, dword [esp + 0x84]
mov eax, ecx
sub eax, dword [esp + 0xb0]
jne 0xac59d2
mov eax, dword [esp + 0x64]
mov esi, dword [esp + 0x88]
add eax, 0xc
add eax, esi
add eax, edi
cmp eax, ecx
jne 0xac59d2
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xac5c21
mov esi, 0xc0000017
jmp 0xac5d55
cmp dword [esp + 0xd0], 0
je 0xac5c61
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xac5c4b
mov esi, 0xc0000017
jmp 0xac5cf4
mov dword [edi + 4], eax
push esi
push dword [esp + 0xd4]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0xac5c66
mov dword [edi], ebx
mov dword [edi + 4], ebx
cmp dword [esp + 0x78], 0
je 0xac5c9e
mov esi, dword [esp + 0x10c]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xac5c41
mov dword [edi + 0xc], eax
push esi
push dword [esp + 0x7c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0xac5ca4
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
cmp dword [esp + 0xe8], 0
je 0xac5ce3
mov esi, dword [esp + 0x64]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xac5c41
mov dword [edi + 0x14], eax
push esi
push dword [esp + 0xec]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0xac5ce9
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [esp + 0xcc], edi
mov esi, ebx
mov edi, ebx
test edi, edi
je 0xac5d55
cmp dword [edi + 4], 0
je 0xac5d12
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xac5d2c
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xac5d46
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xac5d68
mov eax, dword [esp + 0xcc]
mov edi, ebx
mov dword [esp + 0x6c], eax
jmp 0xac5d6f
mov edi, dword [esp + 0xcc]
test edi, edi
je 0xac5dd0
cmp dword [edi + 4], 0
je 0xac5d8d
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xac5da7
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xac5dc1
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xac667d
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
test eax, eax
jne 0xac5df6
mov esi, 0xd000000d
jmp 0xac667d
mov esi, dword [eax + 4]
mov dword [esp + 0x10c], esi
test esi, esi
je 0xac5dec
mov edi, dword [eax]
test edi, edi
je 0xac5dec
add edi, 0xfffffff8
mov dword [esp + 0xec], ebx
mov ecx, edi
mov dword [esp + 0x118], edi
call fcn.00ad193e
mov dword [esp + 0x11c], eax
test eax, eax
je 0xac63b8
mov dword [esp + 0xd0], esi
mov ecx, 0xab69605e
mov dword [esp + 0x7b8], ecx
mov ecx, 0x7f1137f
mov dword [esp + 0x7bc], ecx
mov ecx, eax
mov dword [esp + 0xfc], ecx
mov dl, bl
and edi, 7
je 0xac5f88
mov dword [esp + 0x130], ebx
mov eax, ebx
mov dword [esp + 0xd4], eax
mov dword [esp + 0x64], ebx
test edi, edi
je 0xac5ed8
push 0x38
pop ecx
movzx eax, byte [esi]
inc esi
cmp dword [esp + 0x64], 4
jge 0xac5e9a
add ecx, 0xffffffe0
shl eax, cl
mov ecx, dword [esp + 0xa8]
or ebx, eax
jmp 0xac5ea3
shl eax, cl
or dword [esp + 0x130], eax
mov eax, dword [esp + 0x64]
sub ecx, 8
inc eax
mov dword [esp + 0xa8], ecx
mov dword [esp + 0x64], eax
cmp eax, edi
jl 0xac5e7f
mov ecx, dword [esp + 0xfc]
mov dword [esp + 0xd4], ebx
xor ebx, ebx
mov eax, dword [esp + 0xd4]
mov dword [esp + 0xd0], esi
mov esi, eax
mov dword [esp + 0x88], ebx
mov eax, dword [esp + 0x130]
xor esi, 0x92f65a5
xor eax, 0x699a899c
mov dword [esp + 0xc8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x64], esi
mov dword [esp + 0xcc], eax
test edi, edi
je 0xac5f5e
push 4
mov esi, ebx
pop eax
lea ebx, [ecx + 1]
mov dword [esp + 0x88], ebx
cmp esi, eax
jge 0xac5f2b
rol dword [esp + 0x64], 8
mov ebx, dword [esp + 0x64]
jmp 0xac5f3a
rol dword [esp + 0xcc], 8
mov ebx, dword [esp + 0xcc]
mov byte [ecx], bl
inc esi
mov ebx, dword [esp + 0x88]
mov ecx, ebx
cmp esi, edi
jl 0xac5f12
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0xc8]
mov dword [esp + 0xfc], ebx
xor ebx, ebx
push 4
pop ecx
cmp edi, ecx
jbe 0xac5f77
push 8
pop ecx
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [esp + 0xc], eax
jmp 0xac5f9c
mov dword [esp + 0xc], ebx
jae 0xac5f9c
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
jmp 0xac5f95
mov dword [esp + 0xd4], ebx
mov esi, ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0xc8], esi
mov ecx, dword [esp + 0x118]
mov eax, ecx
shr eax, 3
mov dword [esp + 0x78], eax
test eax, eax
je 0xac6342
movzx esi, word [esp + 0x7ba]
mov ebx, 0x7f1137f
movzx ecx, word [esp + 0x7be]
mov edi, 0xab69605e
movzx eax, bx
xor ebx, edi
mov dword [esp + 0x50], eax
movzx eax, di
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0xfc]
mov dword [esp + 0x7c], esi
add eax, 7
mov esi, dword [esp + 0xd0]
add esi, 2
mov dword [esp + 0x88], ebx
mov ebx, dword [esp + 0xc8]
mov dword [esp + 0xd8], ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0xa8], eax
mov dword [esp + 0x2c], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [esp + 0x2c]
xor ebx, edi
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [esp + 0x2c]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [esp + 0x2c]
shl esi, 8
add dword [esp + 0x2c], 8
movzx eax, byte [eax + 5]
or esi, eax
mov eax, 0xab69605e
xor ecx, esi
xor eax, 0x7f1137f
xor eax, ecx
xor eax, ebx
mov ecx, eax
mov dword [esp + 0xc], eax
sub ecx, 0xab69605e
rol eax, 0xa
rol ecx, 5
imul ecx, dword [esp + 0x50]
add ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea ecx, [ebx + ecx]
ror ecx, 9
imul ecx, dword [esp + 0x7c]
sub ecx, eax
mov eax, dword [esp + 0xc]
xor eax, ecx
mov ecx, eax
mov dword [esp + 0xc], eax
sub ecx, dword [esp + 0x50]
imul ecx, dword [esp + 0x84]
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, dword [esp + 0x7c]
xor ecx, ebx
mov eax, ebx
rol ecx, 6
imul ecx, dword [esp + 0xd8]
rol eax, 2
sub ecx, eax
mov eax, dword [esp + 0xc]
xor eax, ecx
mov ecx, 0xab69605e
xor ecx, eax
mov dword [esp + 0xc], eax
mov eax, 0x7f1137f
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, dword [esp + 0x50]
imul eax, dword [esp + 0x7c]
ror ecx, 6
xor ecx, eax
mov eax, dword [esp + 0xc]
xor eax, ecx
mov ecx, 0x7f1137f
add ecx, eax
mov dword [esp + 0xc], eax
ror ecx, 0xf
imul ecx, dword [esp + 0x84]
rol eax, 2
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [esp + 0xd8]
sub ecx, eax
mov eax, dword [esp + 0xc]
xor eax, ecx
mov ecx, 0xab69605e
xor ecx, eax
mov dword [esp + 0xc], eax
ror ecx, 0xc
imul ecx, dword [esp + 0x50]
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov ecx, dword [esp + 0xd8]
xor ecx, ebx
mov eax, ebx
imul ecx, dword [esp + 0x7c]
shr eax, 0xa
xor ecx, eax
mov eax, dword [esp + 0xc]
xor eax, ecx
mov ecx, dword [esp + 0xd8]
mov dword [esp + 0xc], eax
not eax
ror eax, 5
add eax, dword [esp + 0x84]
imul eax, ecx
xor ebx, eax
mov eax, ebx
sub eax, ecx
xor eax, 0xab69605e
xor dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
xor ecx, eax
rol ecx, 2
imul ecx, dword [esp + 0x50]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 6
imul ecx, dword [esp + 0x7c]
rol eax, 7
add ecx, eax
mov eax, dword [esp + 0xc]
xor eax, ecx
mov dword [esp + 0xc], eax
mov ecx, eax
xor eax, dword [esp + 0x50]
imul eax, dword [esp + 0x84]
ror ecx, 9
add ecx, eax
xor ebx, ecx
mov ecx, dword [esp + 0x7c]
xor ecx, ebx
mov eax, ebx
rol ecx, 5
imul ecx, dword [esp + 0xd8]
rol eax, 7
add ecx, eax
xor dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
xor ebx, ecx
xor ebx, dword [esp + 0x88]
mov eax, ebx
ror eax, 3
sub eax, dword [esp + 0x7c]
imul eax, dword [esp + 0x50]
xor ecx, eax
mov dword [esp + 0xc], ecx
mov eax, 0x7f1137f
sub ecx, eax
mov eax, dword [esp + 0xc]
ror ecx, 1
imul ecx, dword [esp + 0x84]
ror eax, 6
sub ecx, eax
xor ebx, ecx
mov ecx, 0xab69605e
mov eax, ebx
rol eax, 0xe
lea ecx, [ecx + ebx]
rol ecx, 3
imul ecx, dword [esp + 0xd8]
add ecx, eax
mov eax, dword [esp + 0xc]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [esp + 0xc], eax
rol ecx, 0xf
imul ecx, dword [esp + 0x50]
ror eax, 0xe
sub ecx, eax
xor ebx, ecx
mov ecx, dword [esp + 0x84]
xor ecx, ebx
mov eax, ebx
imul ecx, dword [esp + 0x7c]
shr eax, 3
xor ecx, eax
mov eax, dword [esp + 0xc]
xor eax, ecx
mov ecx, 0x7f1137f
xor ecx, eax
mov dword [esp + 0xc], eax
rol ecx, 4
imul ecx, dword [esp + 0x84]
rol eax, 2
xor ecx, eax
mov eax, dword [esp + 0xa8]
xor ecx, dword [esp + 0xd4]
xor ebx, ecx
mov dword [esp + 0xd4], edi
mov ecx, dword [esp + 0xc]
xor ecx, dword [esp + 0x130]
mov byte [eax - 4], bl
mov byte [eax], cl
ror ebx, 8
mov byte [eax - 5], bl
ror ecx, 8
mov byte [eax - 1], cl
ror ebx, 8
mov byte [eax - 6], bl
ror ecx, 8
mov byte [eax - 2], cl
ror ebx, 8
ror ecx, 8
mov byte [eax - 7], bl
mov byte [eax - 3], cl
add eax, 8
ror ebx, 8
ror ecx, 8
sub dword [esp + 0x78], 1
mov dword [esp + 0x130], esi
mov esi, dword [esp + 0x2c]
mov dword [esp + 0xa8], eax
jne 0xac601d
mov ecx, dword [esp + 0x118]
xor ebx, ebx
mov esi, dword [esp + 0x11c]
mov eax, ebx
test ecx, ecx
je 0xac6357
xor dl, byte [eax + esi]
inc eax
cmp eax, ecx
jb 0xac634f
mov edi, dword [esp + 0x10c]
movzx eax, dl
cdq
cmp eax, dword [ecx + edi]
jne 0xac637b
cmp edx, dword [ecx + edi + 4]
jne 0xac637b
mov edi, esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edi
mov esi, ebx
jmp 0xac6388
mov dword [esp + 0xec], 0xc004d501
mov edi, ebx
test esi, esi
je 0xac6393
mov ecx, esi
call fcn.00ad1951
cmp dword [esp + 0xec], 0
jl 0xac63b8
mov ecx, dword [esp + 0x1c]
mov eax, ebx
mov dword [esp + 0x128], edi
mov esi, 0x10000000
mov dword [esp + 0x80], ecx
jmp 0xac63c3
mov eax, dword [esp + 0x18]
mov esi, 0xd0000001
mov edi, ebx
test eax, eax
je 0xac63d6
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xac667d
push 4
pop edx
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x13c], edi
cmp dword [esp + 0x80], edx
jb 0xac6672
mov eax, dword [edi]
mov ecx, edi
mov dword [esp + 0x88], eax
lea eax, [esp + 0x13c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac6677
lea eax, [esp + 0x12c]
xor ecx, ecx
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac6677
mov eax, dword [esp + 0x80]
sub eax, dword [esp + 0x12c]
push 4
pop edx
cmp eax, edx
jb 0xac6672
mov ecx, dword [esp + 0x13c]
lea eax, [esp + 0x13c]
push eax
mov edi, dword [ecx]
mov dword [esp + 0xac], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac6677
mov ecx, dword [esp + 0x12c]
lea eax, [esp + 0x12c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac6677
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x12c]
sub eax, ecx
cmp eax, edi
jb 0xac6672
lea eax, [esp + 0x12c]
mov edx, edi
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac6677
mov edx, dword [esp + 0x128]
mov esi, dword [esp + 0x80]
mov ecx, dword [esp + 0x13c]
add ecx, edi
lea eax, [edx + esi]
cmp eax, ecx
jb 0xac6672
mov ecx, dword [esp + 0x13c]
mov eax, edx
sub eax, edi
sub eax, ecx
add eax, esi
cmp eax, 8
jae 0xac6672
mov dword [esp + 0x64], ebx
mov edx, ebx
mov dword [esp + 0xd0], edx
mov esi, ebx
test ecx, ecx
je 0xac65fe
mov edx, dword [esp + 0xa8]
lea eax, [esp + 0x104]
push eax
mov edi, ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac6677
mov eax, dword [esp + 0x104]
jmp 0xac65e9
lea eax, [esp + 0x2b0]
mov ecx, edi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac6677
mov eax, dword [esp + 0x104]
cmp dword [esp + 0x2b0], eax
ja 0xac6626
mov edx, dword [edi]
lea eax, [esp + 0x2b4]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac65a9
mov eax, dword [esp + 0x2b4]
mov dword [esp + 0x2b8], eax
jmp 0xac65b0
mov eax, dword [esp + 0x2b8]
test esi, esi
js 0xac6677
lea ecx, [esp + 0x1b8]
mov edx, eax
push ecx
mov ecx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xac6677
mov edi, dword [esp + 0x1b8]
mov eax, dword [esp + 0x104]
cmp edi, eax
ja 0xac6626
inc dword [esp + 0x64]
cmp edi, eax
jb 0xac654d
cmp edi, eax
jne 0xac6626
mov edi, dword [esp + 0xa8]
mov edx, ebx
test edi, edi
je 0xac662f
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edx, eax
mov dword [esp + 0xd0], edx
test edx, edx
jne 0xac662d
mov esi, 0xc0000017
jmp 0xac665e
mov esi, 0xc000000d
jmp 0xac6677
mov esi, ebx
mov eax, dword [esp + 0x13c]
test eax, eax
je 0xac664c
push edi
push eax
push edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [esp + 0xdc]
add esp, 0xc
mov eax, dword [esp + 0x64]
mov dword [esp + 0x210], edx
mov dword [esp + 0x208], eax
test esi, esi
js 0xac6677
mov eax, dword [esp + 0x88]
cmp eax, dword [esp + 0x208]
je 0xac6677
mov esi, 0xc000003e
or esi, 0x10000000
mov eax, dword [esp + 0xf0]
test eax, eax
je 0xac6697
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [esp + 0x20]
test edi, edi
je 0xac66fc
cmp dword [edi + 4], 0
je 0xac66b9
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xac66d3
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xac66ed
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [esp + 0x30]
test eax, eax
je 0xac6713
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [esp + 0x70]
test eax, eax
je 0xac672a
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [esp + 0x6c]
test edi, edi
je 0xac678f
cmp dword [edi + 4], 0
je 0xac674c
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0xac6766
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0xac6780
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [esp + 0x128]
test eax, eax
je 0xac67a9
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xac6866
mov edi, dword [esp + 0x208]
xor eax, eax
inc eax
cmp edi, eax
jb 0xac6866
mov esi, dword [esp + 0x210]
test esi, esi
je 0xac6866
test edi, edi
je 0xac6866
lea eax, [esp + 0x194]
mov dword [esp + 0x194], esi
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xac6866
mov eax, dword [esi]
neg eax
sbb eax, eax
and eax, dword [esp + 0x194]
push 4
pop ecx
cmp dword [esi], ecx
jne 0xac6866
cmp dword [eax], 0
jl 0xac6866
xor eax, eax
inc eax
cmp edi, eax
jbe 0xac6866
push ecx
mov edi, ebx
mov dword [esp + 0x18c], esi
pop ebx
lea eax, [esp + 0x188]
mov edx, ebx
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xac6864
mov edx, dword [esi]
lea eax, [esp + 0x188]
mov ecx, dword [esp + 0x188]
push eax
call fcn.00a32533
test eax, eax
js 0xac6864
xor eax, eax
inc edi
inc eax
cmp edi, eax
jae 0xac6864
mov esi, dword [esp + 0x188]
jmp 0xac6824
xor ebx, ebx
mov eax, dword [esp + 0x68]
mov edi, dword [esp + 0x3c]
test eax, eax
je 0xac6881
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [esp + 0x210]
test esi, esi
je 0xac689b
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [esp + 0x38]
test eax, eax
je 0xac68b2
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xac68c5
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [esp + 0x138]
mov dword [esp + 0x138], ebx
mov dword [esp + 0x1ac], eax
jmp 0xabd5a7
mov eax, dword [esp + 0x370]
jmp 0xac686e
mov eax, dword [esp + 0x370]
jmp 0xac686a
mov eax, 0xc004f027
test eax, eax
js 0xac6919
push 4
pop eax
cmp dword [esp + 0x140], eax
jne 0xac6919
mov eax, dword [esp + 0x1ac]
mov eax, dword [eax]
mov dword [esp + 0x1e4], eax
lea ecx, [esp + 0x1ac]
call fcn.00ad18a9
cmp dword [esp + 0x1e4], 0
je 0xac699d
push 0x9ff32c
call dword [sym.imp.SHCORE.dll_Ordinal_190]
test eax, eax
je 0xac699d
call fcn.00ab4ee6
test al, al
je 0xac699d
lea eax, [esp + 0x2c0]
mov dword [esp + 0x310], esi
push eax
lea eax, [esp + 0x314]
mov dword [esp + 0x318], 2
push eax
push 0x9fa73c
push 0x9f6508
call dword [sym.imp.ext_ms_win_devmgmt_policy_l1_1_1.dll_PolicyManager_GetPolicy]
mov ecx, dword [esp + 0x2c0]
test eax, eax
js 0xac6992
xor eax, eax
inc eax
cmp dword [ecx + 8], eax
jne 0xac6992
cmp dword [ecx + 0xc], eax
sete bl
test ecx, ecx
je 0xac699d
push ecx
call dword [sym.imp.ext_ms_win_devmgmt_policy_l1_1_1.dll_PolicyManager_FreeGetPolicyData]
mov ecx, dword [esp + 0xec4]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00ab3c50
mov esp, ebp
pop ebp
ret