Function at 0x10010fe0
Capabilities:
Create thread
Encode data using xor
Get graphical window text
Set file attributes
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x104]
sub esp, 0x104
push 0xffffffffffffffff
push 0x1002a45b
mov eax, dword fs:[0]
push eax
sub esp, 0x178
mov eax, dword [0x10041bd0]
xor eax, ebp
mov dword [ebp + 0x100], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.ucrtbased.dll_malloc]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0x1002f8ec
nop
xor eax, eax
lea ecx, [ecx + ecx*4]
shl ecx, 2
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], ecx
nop
lea eax, [eax + eax*4]
shl eax, 2
push ecx
push eax
call dword [sym.imp.USER32.dll_WindowFromPoint]
push 0xe1
lea ecx, [ebp]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
call fcn.100277a0
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
add esi, 0x14
cmp byte [edi + 0x13], 0
je 0x100110b5
mov eax, dword [edi + 0xf]
inc eax
push eax
call ebx
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100110a9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011090
mov byte [ecx + ebx], 0
mov esi, ebx
mov ebx, dword [sym.imp.ucrtbased.dll_malloc]
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002f908
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011115
mov eax, dword [edi + 0xf]
inc eax
push eax
call ebx
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001110f
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100110f6
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002f924
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001117f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011179
sub esi, ebx
nop word [eax + eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011160
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002f944
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100111e3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100111dd
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100111c4
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002f964
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011247
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011241
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011228
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002f988
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100112af
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100112a9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011290
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002f9a8
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011313
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001130d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100112f4
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], str._al_f
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011377
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011371
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011358
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002f9e0
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100113df
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100113d9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100113c0
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002f9fc
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011443
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001143d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011424
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fa18
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100114a7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100114a1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011488
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fa34
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001150f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011509
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100114f0
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fa50
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011573
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001156d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011554
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fa6c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100115d7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100115d1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100115b8
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fa8c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001163f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011639
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011620
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002faac
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100116a3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001169d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011684
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002facc
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011707
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011701
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100116e8
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fae8
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001176f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011769
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011750
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fb04
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100117d3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100117cd
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100117b4
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fb20
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011837
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011831
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011818
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fb3c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001189f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011899
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011880
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fb58
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011903
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100118fd
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100118e4
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fb74
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011967
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011961
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011948
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fb90
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100119cf
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100119c9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100119b0
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fbac
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011a33
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011a2d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011a14
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fbc8
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011a97
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011a91
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011a78
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fbe4
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011aff
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011af9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011ae0
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fc00
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011b63
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011b5d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011b44
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fc1c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011bc7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011bc1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011ba8
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fc38
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011c2f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011c29
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011c10
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fc54
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011c93
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011c8d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011c74
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fc70
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011cf7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011cf1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011cd8
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fc8c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011d5f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011d59
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011d40
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fca8
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011dc3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011dbd
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011da4
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fcc4
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011e27
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011e21
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011e08
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fce4
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011e8f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011e89
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011e70
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fd04
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011ef3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011eed
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011ed4
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fd24
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011f57
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011f51
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011f38
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fd40
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10011fbf
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10011fb9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10011fa0
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fd5c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012023
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001201d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012004
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fd78
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012087
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10012081
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012068
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fd94
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100120ef
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100120e9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100120d0
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fdb0
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012153
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001214d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012134
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fdcc
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100121b7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100121b1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012198
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fde8
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001221f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10012219
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012200
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fe04
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012283
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001227d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012264
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fe20
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100122e7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100122e1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100122c8
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fe3c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001234f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10012349
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012330
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fe58
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100123b3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100123ad
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012394
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fe74
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012417
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10012411
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100123f8
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fe90
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001247f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10012479
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [esi + ecx]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012460
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002feac
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100124e3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100124dd
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100124c4
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fec8
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012547
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10012541
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012528
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002fee4
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100125af
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100125a9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012590
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002ff00
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012613
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001260d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100125f4
mov byte [ecx + ebx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002ff1c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012677
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10012671
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012658
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002ff38
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100126df
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100126d9
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100126c0
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002ff54
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012743
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001273d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012724
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002ff70
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100127a7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100127a1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012788
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002ff8c
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001280f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10012809
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100127f0
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002ffa8
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012873
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001286d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012854
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002ffc4
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100128d7
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x100128d1
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x100128b8
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x1002ffe4
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x1001293f
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x10012939
sub esi, ebx
nop dword [eax]
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012920
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x10030004
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x100129a3
mov eax, dword [edi + 0xf]
inc eax
push eax
call dword [sym.imp.ucrtbased.dll_malloc]
mov ecx, dword [edi + 0xf]
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
je 0x1001299d
sub esi, ebx
mov eax, edx
lea ecx, [edx + ebx]
and eax, 7
inc edx
mov al, byte [eax + edi + 7]
xor al, byte [ecx + esi]
mov byte [ecx], al
mov ecx, dword [edi + 0xf]
cmp edx, ecx
jb 0x10012984
mov byte [ebx + ecx], 0
mov esi, ebx
lea eax, [ebp]
push esi
push eax
call sub.VCRUNTIME140D.dll_strstr
add esp, 8
test eax, eax
jne 0x1001527c
mov dword [ebp - 0x10], 0x10030024
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
add esi, 0x14
cmp byte [edi + 0x13], al
je 0x10012a07
push 0x10030bf0
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [eax + 6], 0xea
jne 0x100152a7
push 1
call edi
cmp dword [0x1004206c], 1
jne 0x10015334
push 1
push 0x40
push 8
push 0x10030c0c
lea ecx, [ebp - 0x184]
call fcn.10004a20
lea eax, [ebp - 0x184]
mov dword [ebp - 4], 0
push str._nH_Scan:
push eax
call fcn.100045b0
lea eax, [ebp]
push eax
lea eax, [ebp - 0x184]
push eax
call fcn.100045b0
add esp, 0x10
lea ecx, [ebp - 0x180]
call fcn.10005500
test eax, eax
jne 0x10015322
push eax
mov eax, dword [ebp - 0x184]
lea ecx, [ebp - 0x184]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
lea ecx, [ebp - 0x184]
mov dword [ebp - 4], 0xffffffff
call fcn.10005010
cmp dword [0x1004207c], 1
jne 0x10015416
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ucrtbased.dll__time64]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ucrtbased.dll__localtime64]
add esp, 8
lea ecx, [ebp - 0xd4]
mov esi, eax
push 1
push 0x40
push 8
push 0x10030c30
call fcn.10004a20
lea eax, [ebp - 0xd4]
mov dword [ebp - 4], 1
push 0x10030c34
push eax
call fcn.100045b0
push esi
call dword [sym.imp.ucrtbased.dll_asctime]
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.100045b0
lea eax, [ebp - 0xd4]
push str.H_Scan:
push eax
call fcn.100045b0
lea eax, [ebp]
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.100045b0
lea eax, [ebp - 0xd4]
push 0x10030c54
push eax
call fcn.100045b0
add esp, 0x2c
lea ecx, [ebp - 0xd0]
call fcn.10005500
test eax, eax
jne 0x100153fe
push eax
mov eax, dword [ebp - 0xd4]
lea ecx, [ebp - 0xd4]
push 2
mov eax, dword [eax + 4]
add ecx, eax
call dword [sym.imp.MSVCP140D.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
push 2
push 0x10030c7c
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0xd4]
call fcn.10005010
mov eax, dword [0x10042070]
push 0
cmp eax, 1
jne 0x10015444
push 0
push 0
push 0x10010f30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xbb8
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1001546b
push 0
push 0
push 0x10010eb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1f4
call edi
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 3
jne 0x1001547f
push 0
push 0
push 0x10010fb0
jmp 0x1001542b
cmp eax, 4
jne 0x1001543e
push 0
push 0
push 0x10027880
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x200010
push 0x10030c80
lea eax, [ebp]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1001543c