Function at 0x412ef7
Capabilities:
Check if file exists
Encode data using xor
Execute anti-debugging instructions
Get keyboard layout
Get number of processors
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xcf4
mov eax, dword [0x4291b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
push 0x40273c
mov dword [ebp - 0xbfc], esi
mov dword [ebp - 0xc00], ecx
mov dword [ebp - 0xbf0], edi
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x429d94], eax
test eax, eax
je 0x4134bc
push 0x402764
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x429d90], eax
test eax, eax
je 0x4134bc
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0xc04], eax
test eax, eax
je 0x4134bc
mov ecx, esi
call fcn.004127c3
test eax, eax
je 0x4134bc
push 0x7f01
push ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f02
push ebx
mov dword [0x429e94], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x402780
push esi
mov dword [0x429e90], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
push 0x402794
push esi
mov dword [0x429e24], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov dword [0x429e20], eax
cmp dword [0x429e90], ebx
je 0x4134bc
test eax, eax
je 0x4134bc
cmp dword [0x429e24], ebx
je 0x4134bc
mov ecx, dword [ebp - 0xc00]
mov edx, esi
call fcn.004207ac
mov eax, dword [ebp - 0xc00]
mov dword [0x429d88], eax
mov dword [0x429e8c], esi
mov dword [0x429d98], 0x54
mov dword [0x429da0], ebx
mov dword [0x429da4], ebx
mov dword [0x429dd4], esi
call fcn.0040cae8
call fcn.0040cb6c
call fcn.004120c7
lea ecx, [ebp - 0xc44]
call fcn.00423418
mov edx, eax
lea ecx, [ebp - 0xc40]
call fcn.00420a6a
mov ecx, dword [eax]
push ecx
mov ecx, 0x42ae64
mov dword [eax], ebx
call fcn.0040fdd6
push ebx
lea ecx, [ebp - 0xc40]
call fcn.0040fdd6
cmp dword [ebp - 0xc44], ebx
je 0x413070
push dword [ebp - 0xc44]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov ecx, dword [0x42ae64]
test ecx, ecx
je 0x413082
mov ecx, dword [ecx + 8]
call fcn.0042358b
push ebx
push esi
push ebx
push ebx
push dword [0x42a8f0]
push dword [0x42a8ec]
push dword [0x42a8e4]
push dword [0x42a8e8]
push 0xcf0000
push 0x402214
push 0x4027a4
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x42a92c], eax
mov dword [0x429d9c], eax
test eax, eax
je 0x4134bc
xor ecx, ecx
call fcn.0040fd23
mov edx, 0x42a960
mov ecx, 0x412cb0
call fcn.00425c8b
test eax, eax
jns 0x4130ec
mov dword [0x42a960], ebx
mov dword [0x42a964], ebx
or dword [ebp - 0xc00], 0xffffffff
mov eax, 0x80000000
cmp dword [0x42a8e4], eax
je 0x4131d1
cmp dword [0x42a8e8], eax
je 0x4131d1
push 0x2c
lea eax, [ebp - 0x56c]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0x56c]
push 0x2c
pop esi
push eax
push dword [0x42a92c]
mov dword [ebp - 0x56c], esi
call dword [sym.imp.USER32.dll_GetWindowPlacement]
test eax, eax
je 0x4131a2
mov eax, dword [0x42a8e8]
mov dword [0x429ec0], eax
sub eax, dword [ebp - 0x550]
add eax, dword [ebp - 0x548]
mov dword [0x429ec8], eax
mov eax, dword [0x42a8e4]
mov dword [0x429ec4], eax
sub eax, dword [ebp - 0x54c]
add eax, dword [ebp - 0x544]
mov dword [0x429ea8], ebx
mov dword [0x429eac], ebx
mov dword [0x429eb0], ebx
mov dword [0x429eb4], ebx
mov dword [0x429eb8], ebx
mov dword [0x429ebc], ebx
mov dword [0x429ea4], esi
mov dword [0x429ecc], eax
mov edi, dword [0x42a92c]
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
push 0x429ea4
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_SetWindowPlacement]
push esi
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
mov edi, dword [ebp - 0xbf0]
mov esi, dword [ebp - 0xbfc]
xor eax, eax
inc eax
push eax
push dword [0x42a92c]
call dword [sym.imp.SHELL32.dll_DragAcceptFiles]
lea eax, [ebp - 0x800]
push eax
push dword [0x42a92c]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [0x42ab94]
push ebx
push esi
push 0xf
push dword [0x42a92c]
neg eax
mov esi, 0x402214
push dword [ebp - 0x7f4]
sbb eax, eax
push dword [ebp - 0x7f8]
and eax, 0xfff00000
push ebx
push ebx
add eax, 0x50300104
push eax
push esi
push 0x402730
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x4134bc
mov ecx, eax
call fcn.00412d1e
xor eax, eax
inc eax
push eax
push eax
push 0xda
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
xor eax, eax
inc eax
push eax
push 0x150e
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x4027b4
push ebx
push 0x1510
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x42aba0]
neg eax
push 0x401
push dword [0x42a92c]
sbb eax, eax
and eax, 0x10000000
push esi
add eax, 0x44800000
push eax
call dword [sym.imp.COMCTL32.dll_CreateStatusWindowW]
mov esi, eax
push 3
mov ecx, 0x42ae78
call fcn.00420920
mov ecx, dword [ebp - 0x7f8]
call fcn.0040bdee
test esi, esi
je 0x4134bc
mov ecx, esi
call fcn.00412dd1
xor eax, eax
lea ecx, [eax + 1]
call fcn.0040f022
lea eax, [ebp - 0x448]
push eax
push dword [0x42adb0]
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [ebp - 0x440]
sub ecx, dword [ebp - 0x448]
call fcn.00412e0b
push ebx
push dword [0x42ab94]
push 0xc8
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [0x42a92c]
call dword [sym.imp.USER32.dll_GetDpiForWindow]
push 0x2d0
push eax
push dword [0x4292c4]
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
neg eax
push 0x429e30
mov dword [0x429e30], eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push eax
push dword [ebp - 0xc04]
mov dword [0x429e2c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, eax
lea eax, [ebp - 0x50]
push eax
push 0x20
pop eax
push eax
push dword [ebp - 0xc04]
call dword [sym.imp.GDI32.dll_GetTextFaceW]
push esi
mov esi, dword [ebp - 0xc04]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x429e4c
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
je 0x4133c5
push 0x429e30
push 0x412c50
push 0x429e4c
push esi
call dword [sym.imp.GDI32.dll_EnumFontsW]
push dword [0x429e2c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0x429e30
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [0x429e2c], eax
jmp 0x4133ca
mov eax, dword [0x429e2c]
push ebx
push eax
push 0x30
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebx
push ebx
push 0xbd
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x429e98], eax
mov eax, dword [0x429e1c]
mov dword [0x429e18], eax
call fcn.0040f3d3
xor eax, eax
lea ecx, [eax + 1]
call fcn.0040f022
push dword [ebp + 0xc]
push dword [0x42a92c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x429e94]
call dword [sym.imp.USER32.dll_SetCursor]
push 9
pop esi
push 0x20
pop ecx
movzx eax, word [edi]
cmp ax, cx
je 0x413441
cmp ax, si
jne 0x413446
add edi, 2
jmp 0x413434
mov edx, edi
mov dword [0x42a8e0], ebx
mov ecx, 0x4027c4
call fcn.00412487
test eax, eax
jne 0x413464
inc eax
mov dword [0x42a8e0], eax
jmp 0x413487
mov edx, edi
mov ecx, 0x4027cc
call fcn.00412487
test eax, eax
jne 0x41347e
push 2
pop eax
mov dword [0x42a8e0], eax
jmp 0x413483
mov eax, dword [0x42a8e0]
test eax, eax
je 0x41349f
push 0x20
add edi, 4
pop ecx
movzx eax, word [edi]
cmp ax, cx
je 0x41349a
cmp ax, si
jne 0x41349f
add edi, 2
jmp 0x41348d
call fcn.00412c6d
test eax, eax
je 0x413501
mov ecx, edi
call fcn.0041288c
test eax, eax
je 0x4134cf
cmp eax, 2
jne 0x413605
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00426d60
leave
ret 8
mov edx, dword [ebp + 0xc]
mov ecx, edi
call fcn.00412a0e
test eax, eax
je 0x4134f2
push ebx
push ebx
push 0x10
push dword [0x42a92c]
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
inc eax
jmp 0x4134be
mov ecx, edi
call fcn.00412bc2
test al, al
jne 0x413605
cmp word [edi], bx
je 0x413605
lea edx, [ebp - 0xc3c]
mov dword [ebp - 0xc3c], ebx
mov ecx, edi
call fcn.004124d3
push ebx
mov esi, 0x80
push esi
push 3
push ebx
push 3
push 0x80000000
push dword [ebp - 0xc3c]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov dword [0x429d8c], eax
cmp eax, 0xffffffff
jne 0x4135d9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
jne 0x4135ab
mov edx, dword [0x42929c]
mov ecx, dword [0x42a92c]
push 0x33
push dword [ebp - 0xc3c]
push dword [0x4292b8]
call fcn.0040f7c1
cmp eax, 2
jne 0x413587
lea ecx, [ebp - 0xc3c]
call fcn.0040ca6d
jmp 0x4134bc
cmp eax, 6
jne 0x4135d0
push ebx
push esi
push 4
push ebx
push 3
push 0xc0000000
push dword [ebp - 0xc3c]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov dword [0x429d8c], eax
jmp 0x4135d0
mov ecx, dword [ebp - 0xc3c]
call fcn.0041170b
mov ecx, dword [0x42a8cc]
test ecx, ecx
je 0x4135c5
call fcn.0040c163
mov dword [0x42a8cc], ebx
call fcn.0040f3d3
cmp dword [0x429d8c], 0xffffffff
je 0x4135fa
mov edx, dword [0x42a8e0]
lea ecx, [ebp - 0xc3c]
push ebx
call fcn.00410da5
test al, al
jne 0x4135fa
mov ecx, dword [ebp - 0xc3c]
call fcn.0041170b
lea ecx, [ebp - 0xc3c]
call fcn.0040ca6d
mov eax, dword [0x42a92c]
mov dword [0x429df0], eax
lea eax, [ebp - 0xc38]
push eax
lea eax, [ebp - 0xc34]
mov dword [0x429df4], ebx
push eax
push 0xb0
push dword [0x42adac]
mov dword [0x429df8], ebx
mov dword [0x429dfc], ebx
mov dword [0x429e00], ebx
mov dword [0x429e04], ebx
mov dword [0x429e08], ebx
mov dword [0x429e0c], ebx
mov dword [0x429e10], ebx
mov dword [0x429dec], 0x28
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0xc38]
push dword [ebp - 0xc34]
push 0xb1
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0xb7
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
and eax, 0x3ff
cmp ax, 0x11
jne 0x4136c0
xor eax, eax
inc eax
push eax
push eax
push 0xd8
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0xc2c], ebx
mov edx, 0x42add0
mov dword [ebp - 0xc04], ebx
mov dword [ebp - 0xc28], ebx
mov dword [ebp - 0xbf0], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x4136df
mov eax, dword [0x42adcc]
mov edi, 0x402ff2
mov dword [ebp - 0xbfc], edi
mov ecx, 0x338
mov dword [ebp - 0xc24], 0x67
mov esi, 0xab69605e
mov dword [ebp - 0xc20], 0x10b
mov dword [ebp - 0x394], 0x20b
push 0
pop ebx
test eax, eax
jne 0x413cd3
push ecx
push ebx
mov dword [ebp - 0xbe0], ebx
mov dword [ebp - 0xbd8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xbdc], eax
test eax, eax
je 0x413d52
or dword [ebp - 0xbe4], 0xffffffff
mov edx, 0x7f1137f
add eax, 7
mov dword [ebp - 0x3a0], esi
mov dword [ebp - 0x39c], edx
mov cl, bl
mov dword [ebp - 0xbec], ebx
mov esi, ebx
mov edx, ebx
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xbe8], edi
mov dword [ebp - 0xbb8], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xbe8]
xor edx, ebx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xbe8]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xbe8]
shl edi, 8
add dword [ebp - 0xbe8], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov eax, esi
mov dword [ebp - 0xbc8], esi
add eax, 0x54969fa2
rol dword [ebp - 0xbc8], 0xa
rol eax, 5
imul eax, eax, 0x137f
add eax, dword [ebp - 0xbc8]
xor edx, eax
mov dword [ebp - 0xbc0], edx
lea eax, [edx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xbc0]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xbc0]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xbc0], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xbc0]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xbc0]
xor edx, eax
mov dword [ebp - 0xbc0], edx
mov eax, dword [ebp - 0xbc0]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xbc0]
xor eax, edx
mov dword [ebp - 0xbc0], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xbc0]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xbc0]
xor eax, edx
mov dword [ebp - 0xbc0], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xbc0]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xbc0]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0xbc0], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0xbc0]
xor eax, 0xab69605e
mov dword [ebp - 0xbc8], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xbc8]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xbc8]
xor eax, edx
mov dword [ebp - 0xbc8], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0xbc8], edx
mov edx, dword [ebp - 0xbc8]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xbc8], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xbc8]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xbc8]
xor eax, edx
mov dword [ebp - 0xbc8], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xbc8]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xbc8]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xbc8], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xbc8]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xbc8]
xor edx, dword [ebp - 0xbec]
xor eax, dword [ebp - 0xbe4]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xbc0], esi
mov esi, dword [ebp - 0xbcc]
mov dword [ebp - 0xbe4], edi
mov edi, dword [ebp - 0xbe8]
mov dword [ebp - 0xbec], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xbb8], 1
mov dword [ebp - 0xbcc], esi
mov esi, eax
mov dword [ebp - 0xbc8], eax
jne 0x413795
mov esi, dword [ebp - 0xbdc]
xor ebx, ebx
mov eax, ebx
mov edi, 0x338
xor cl, byte [eax + esi]
inc eax
cmp eax, edi
jb 0x413b21
movzx eax, cl
cdq
cmp eax, dword [0x403328]
jne 0x413d43
cmp edx, dword [0x40332c]
jne 0x413d43
push 0x40
push ebx
push 0x42a878
mov byte [edi + esi - 1], bl
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov edi, esi
cmp byte [esi], bl
je 0x413cb3
mov edi, 0x42a878
mov dword [ebp - 0xbc0], esi
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xbc8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x413b7b
sub ecx, dword [ebp - 0xbc8]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0x413c9f
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xbd8], edx
cmp word [eax], cx
je 0x413bc3
mov edx, 0xc000007b
mov dword [ebp - 0xbd8], edx
jmp 0x413c17
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0x413bb6
add ecx, dword [edi]
mov dword [ebp - 0xbc8], ecx
cmp ecx, dword [edi]
jb 0x413bb6
cmp dword [ecx], 0x4550
jne 0x413bb6
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xc20]
je 0x413bff
cmp ax, word [ebp - 0x394]
je 0x413bff
mov edx, 0xc000000d
jmp 0x413bbb
mov eax, dword [ecx + 0x78]
mov ecx, dword [ecx + 0x7c]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0xbc8]
mov dword [edi + 0xc], ecx
mov eax, dword [eax + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbb8], ebx
test eax, eax
je 0x413c92
mov ecx, esi
mov dword [ebp - 0xbe8], esi
lea eax, [ecx + 1]
mov dword [ebp - 0xbcc], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x413c3e
sub ecx, dword [ebp - 0xbcc]
inc esi
add esi, ecx
test edx, edx
js 0x413c77
push dword [ebp - 0xbe8]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0x413ca9
mov ecx, dword [ebp - 0xbe0]
mov edx, dword [ebp - 0xbd8]
mov dword [ecx*4 + section..data], eax
mov eax, dword [ebp - 0xbb8]
inc dword [ebp - 0xbe0]
inc eax
mov dword [ebp - 0xbb8], eax
cmp eax, dword [ebp - 0xbc8]
jb 0x413c2d
add edi, 0x10
cmp byte [esi], bl
jne 0x413b6e
jmp 0x413ca9
mov dword [ebp - 0xbd8], 0xc000007a
mov edi, dword [ebp - 0xbc0]
test edi, edi
je 0x413cc2
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push edi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xbd8], ebx
jl 0x413d52
mov eax, dword [0x42adcc]
inc eax
mov dword [0x42adcc], eax
xor eax, eax
mov ecx, 0x42add0
xchg dword [ecx], eax
mov eax, dword fs:[0x30]
mov edi, ebx
mov dword [ebp - 0xc1c], ebx
mov dword [ebp - 0xc18], ebx
cmp dword [eax + 0x1d4], ebx
je 0x41401a
mov esi, dword [0x429088]
mov ecx, esi
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xbc0], eax
test eax, eax
jne 0x413d91
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x413d33
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x414022
mov edi, 0x80004005
jmp 0x414022
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, ebx
mov eax, dword [esi + 0x42a878]
test eax, eax
je 0x413d65
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x413d54
push 0x40
push ebx
push 0x42a878
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x4011f0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x413cd9
mov dword [ebp - 0xc14], ebx
mov edi, ebx
mov ecx, ebx
mov eax, ebx
mov edx, ebx
mov esi, dword [0x429098]
lea ebx, [ebp - 0xc10]
neg eax
push ebx
push ecx
sbb eax, eax
mov ecx, esi
and eax, edx
push eax
push 2
push dword [ebp - 0xbc0]
call dword [0x42b5a4]
call esi
push 0
pop ebx
test eax, eax
jne 0x413e42
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x413e2d
cmp dword [ebp - 0xc14], ebx
jne 0x413e26
push dword [ebp - 0xc10]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
lea ecx, [ebp - 0xc14]
mov dword [ebp - 0xbc8], eax
call fcn.00424e16
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0xc14], eax
test eax, eax
je 0x413e1f
mov ecx, dword [ebp - 0xc10]
mov edx, eax
jmp 0x413d9f
mov edi, 0x8007000e
jmp 0x413e54
mov edi, 0x80004005
jmp 0x413e54
test eax, eax
je 0x413e26
jg 0x413e37
mov edi, eax
jmp 0x413e54
movzx edi, ax
or edi, 0x80070000
jmp 0x413e54
mov eax, dword [ebp - 0xc14]
mov dword [ebp - 0xc14], ebx
mov dword [ebp - 0xc1c], eax
lea ecx, [ebp - 0xc14]
call fcn.00424e16
test edi, edi
js 0x414022
mov esi, dword [0x429094]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xbc0], eax
test eax, eax
je 0x413d1c
mov dword [ebp - 0xc0c], ebx
mov edi, ebx
mov ecx, ebx
mov eax, ebx
mov edx, ebx
mov esi, dword [0x429098]
lea ebx, [ebp - 0xc08]
neg eax
push ebx
push ecx
sbb eax, eax
mov ecx, esi
and eax, edx
push eax
push 2
push dword [ebp - 0xbc0]
call dword [0x42b5a4]
call esi
push 0
pop ebx
test eax, eax
jne 0x413f3d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x413f28
cmp dword [ebp - 0xc0c], ebx
jne 0x413f21
push dword [ebp - 0xc08]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
lea ecx, [ebp - 0xc0c]
mov dword [ebp - 0xbc8], eax
call fcn.00424e16
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0xc0c], eax
test eax, eax
je 0x413f1a
mov ecx, dword [ebp - 0xc08]
mov edx, eax
jmp 0x413e9a
mov edi, 0x8007000e
jmp 0x413f4f
mov edi, 0x80004005
jmp 0x413f4f
test eax, eax
je 0x413f21
jg 0x413f32
mov edi, eax
jmp 0x413f4f
movzx edi, ax
or edi, 0x80070000
jmp 0x413f4f
mov eax, dword [ebp - 0xc0c]
mov dword [ebp - 0xc0c], ebx
mov dword [ebp - 0xc18], eax
lea ecx, [ebp - 0xc0c]
call fcn.00424e16
test edi, edi
js 0x414022
mov eax, dword [ebp - 0xc1c]
test eax, eax
je 0x41401a
mov ecx, 0x402bd8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x413f9e
test dx, dx
je 0x413f97
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x413f9e
add eax, 4
add ecx, 4
test dx, dx
jne 0x413f75
xor esi, esi
mov eax, ebx
inc esi
jmp 0x413fa5
sbb eax, eax
xor esi, esi
inc esi
or eax, esi
test eax, eax
jne 0x41401a
mov eax, dword [ebp - 0xc18]
test eax, eax
je 0x41401a
mov ecx, 0x402be8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x413fde
test dx, dx
je 0x413fda
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x413fde
add eax, 4
add ecx, 4
test dx, dx
jne 0x413fb8
mov eax, ebx
jmp 0x413fe2
sbb eax, eax
or eax, esi
test eax, eax
jne 0x41401a
push 4
lea eax, [ebp - 0xbf4]
mov dword [ebp - 0xbf4], ebx
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
je 0x413d1c
test byte [ebp - 0xbf4], 0xf
jne 0x41401a
xor eax, eax
inc eax
jmp 0x41401c
mov eax, ebx
mov dword [ebp - 0xbf0], eax
lea ecx, [ebp - 0xc18]
call fcn.00424e16
lea ecx, [ebp - 0xc1c]
call fcn.00424e16
test edi, edi
jns 0x414042
mov dword [ebp - 0xbf0], ebx
push 4
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov esi, eax
lea ecx, [ebp - 0xc28]
mov dword [ebp - 0xbc0], esi
call fcn.00424df9
test esi, esi
jne 0x414123
mov dword [ebp - 0xc28], ebx
mov dword [ebp - 0xbc8], 0x8007000e
mov eax, dword [ebp - 0xbf4]
mov dword [ebp - 0xc04], eax
xor ebx, ebx
mov edx, 0x42add0
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x41408a
mov eax, dword [0x42adcc]
push 0
pop ebx
test eax, eax
jle 0x4140e7
sub eax, 1
mov dword [0x42adcc], eax
jne 0x4140e7
mov edi, ebx
mov eax, dword [edi + 0x42a878]
test eax, eax
je 0x4140c0
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0x4140af
push 0x40
push ebx
push 0x42a878
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x4011f0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0x42add0
xchg dword [ecx], eax
lea ecx, [ebp - 0xc28]
call fcn.00424df9
mov eax, dword [ebp - 0xbc8]
mov esi, 0xc004f012
lea edi, [esi + 0x15]
test eax, eax
jns 0x420745
cmp eax, 0xd0000034
jne 0x420719
mov ebx, esi
jmp 0x420753
xor eax, eax
mov dword [ebp - 0xc28], esi
lea edi, [ebp - 0xcc8]
mov dword [ebp - 0xcb4], ebx
stosd dword es:[edi], eax
mov esi, ebx
mov dword [ebp - 0xbb8], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xbe8], 0x38
test eax, eax
je 0x414191
mov edi, eax
mov dword [ebp - 0xbcc], edi
push 0x28
pop ecx
mov esi, 0x429788
rep movsd dword es:[edi], dword [esi]
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, dword [ebp - 0xbcc]
test eax, eax
jne 0x4141a2
mov dword [ebp - 0xbc8], 0xc0000017
mov edi, ebx
jmp 0x415ce9
mov ecx, dword [0x429784]
mov edi, eax
mov eax, dword [0x429780]
mov dword [edi], eax
mov dword [edi + 4], ecx
rdtsc
mov dword [ebp - 0xbe4], eax
mov dword [ebp - 0xbec], edx
push 0xc
pop eax
mov dword [ebp - 0xbcc], eax
lea eax, [ebp - 0xc30]
mov edx, 0x7fffffff
push eax
mov ecx, 0x402b98
call fcn.00424e59
test eax, eax
jns 0x4141f0
mov dword [ebp - 0xc30], ebx
jmp 0x4148b2
mov eax, dword [ebp - 0xc30]
inc eax
mov dword [ebp - 0xbdc], 8
mov dword [ebp - 0xc30], eax
mov dword [ebp - 0xbd8], 0xa0
lea eax, [eax*2 + 4]
cmp eax, 4
jb 0x414223
mov ecx, eax
mov eax, ebx
jmp 0x41423a
mov ecx, dword [ebp - 0xbc0]
mov eax, 0xc0000095
mov dword [ebp - 0xbc0], ecx
mov ecx, dword [ebp - 0xbcc]
mov dword [ebp - 0xbc8], eax
test eax, eax
js 0x415ce9
mov eax, 0xc4
add ecx, eax
cmp ecx, eax
jb 0x414257
mov edx, ecx
jmp 0x41425a
or edx, 0xffffffff
cmp ecx, eax
sbb eax, eax
and eax, 0xc0000095
add eax, 0x10000000
mov dword [ebp - 0xbc8], eax
cmp ecx, 0xc4
jb 0x418878
lea eax, [edx + 8]
mov dword [ebp - 0xbcc], eax
cmp eax, edx
jb 0x41428b
mov ecx, eax
jmp 0x41428e
or ecx, 0xffffffff
cmp eax, edx
sbb eax, eax
and eax, 0xc0000095
add eax, 0x10000000
mov dword [ebp - 0xbc8], eax
cmp dword [ebp - 0xbcc], edx
jb 0x418878
lea edx, [ecx + 8]
cmp edx, ecx
jb 0x4142bd
mov dword [ebp - 0xbcc], edx
jmp 0x4142c6
or eax, 0xffffffff
mov dword [ebp - 0xbcc], eax
cmp edx, ecx
sbb eax, eax
and eax, 0xc0000095
add eax, 0x10000000
mov dword [ebp - 0xbc8], eax
cmp edx, ecx
jb 0x418878
mov eax, dword [ebp - 0xbcc]
push eax
push 8
mov dword [ebp - 0xcb8], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0x414311
mov dword [ebp - 0xbc8], 0xc0000017
jmp 0x415ce9
mov dword [ebp - 0xcb4], eax
mov ecx, edi
mov dword [ebp - 0xbb8], esi
mov edx, ebx
mov dword [ebp - 0xbcc], ecx
mov dword [ebp - 0xcbc], edx
test eax, eax
jne 0x41437e
mov eax, dword [ebp - 0xcb8]
lea ecx, [eax + 8]
mov dword [ebp - 0xbc8], ecx
cmp ecx, eax
jb 0x414434
mov eax, dword [ebp - 0xbdc]
inc edx
mov dword [ebp - 0xcb8], ecx
mov ecx, dword [ebp - 0xbc0]
mov dword [ebp - 0xcbc], edx
mov dword [ebp - 0xbc0], ecx
mov dword [ebp - 0xbb8], esi
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xbe0], edi
jmp 0x4144f5
mov eax, dword [ebp - 0xcb4]
mov edi, ecx
mov esi, dword [ebp - 0xbb8]
mov ecx, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbe0], ebx
test edx, edx
je 0x41444f
mov eax, dword [ebp - 0xbd8]
mov edi, dword [ebp - 0xbdc]
mov esi, dword [ebp - 0xbb8]
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0xbdc], edi
mov edi, dword [ebp - 0xbcc]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0xbc0], eax
cmp eax, 4
jb 0x414434
mov ebx, eax
add ebx, dword [ebp - 0xbc8]
cmp ebx, dword [ebp - 0xbc8]
push 0
mov dword [ebp - 0xbc0], ebx
pop ebx
jb 0x418869
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc8], eax
mov eax, dword [ebp - 0xbe0]
inc eax
mov dword [ebp - 0xbcc], edi
mov dword [ebp - 0xbe0], eax
cmp eax, edx
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xbb8], esi
jb 0x4143ac
mov edx, dword [ebp - 0xbc8]
jmp 0x414451
mov edi, dword [ebp - 0xbcc]
mov esi, dword [ebp - 0xbb8]
mov dword [ebp - 0xbc8], 0xc0000095
jmp 0x415ce9
mov edx, eax
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0xbdc], eax
lea eax, [edx + 4]
mov dword [ebp - 0xbc0], ecx
cmp eax, edx
jb 0x418869
mov ecx, dword [ebp - 0xcb8]
lea eax, [edx + 8]
add ecx, dword [ebp - 0xcb4]
cmp eax, ecx
ja 0x418748
mov dword [edx], 4
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0xcbc]
inc edx
mov dword [ebp - 0xcbc], edx
mov ecx, dword [ebp - 0xbc0]
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0xbc0], ecx
mov dword [ebp - 0xbb8], esi
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xbe0], edi
test esi, esi
jne 0x4144e9
cmp dword [ebp - 0xbd8], esi
jne 0x418427
mov eax, dword [ebp - 0xcb8]
mov dword [ebp - 0xbc8], eax
jmp 0x414502
mov eax, dword [ebp - 0xcb8]
mov dword [ebp - 0xbc8], eax
cmp dword [ebp - 0xbd8], 0
je 0x418427
cmp dword [ebp - 0xcb4], 0
jne 0x41453d
mov eax, dword [ebp - 0xbc8]
mov ecx, 0xa4
add ecx, eax
mov dword [ebp - 0xbc8], ecx
cmp ecx, eax
jb 0x418869
mov edi, dword [ebp - 0xbe0]
mov esi, dword [ebp - 0xbb8]
mov dword [ebp - 0xcb8], ecx
jmp 0x414658
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xbb8], ebx
test edx, edx
je 0x4145ed
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xbe0], edi
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0xbb0], eax
cmp eax, 4
jb 0x418869
mov ebx, eax
add ebx, dword [ebp - 0xbc0]
cmp ebx, dword [ebp - 0xbc0]
push 0
mov dword [ebp - 0xbb0], ebx
pop ebx
jb 0x418869
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xbb8]
inc eax
mov dword [ebp - 0xbb8], eax
cmp eax, edx
mov eax, dword [ebp - 0xbd8]
jb 0x41455d
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xbd8], eax
mov edx, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc0], ecx
mov ecx, dword [ebp - 0xbdc]
mov dword [ebp - 0xbcc], ecx
lea ecx, [edx + 4]
cmp ecx, edx
jb 0x418869
lea ecx, [eax + 4]
mov eax, dword [ebp - 0xcb4]
add eax, dword [ebp - 0xbc8]
add ecx, edx
push 0
pop ebx
cmp ecx, eax
ja 0x418748
mov eax, dword [ebp - 0xbd8]
mov dword [edx], eax
test esi, esi
je 0x414646
push eax
lea eax, [edx + 4]
push esi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0xcb8]
mov edx, dword [ebp - 0xcbc]
mov dword [ebp - 0xbc8], ecx
inc edx
mov dword [ebp - 0xcbc], edx
test edi, edi
jne 0x414670
cmp dword [ebp - 0xbdc], edi
je 0x41467d
jmp 0x418427
cmp dword [ebp - 0xbdc], 0
je 0x418427
cmp dword [ebp - 0xcb4], 0
jne 0x4146a4
push 0xc
pop eax
add eax, ecx
mov dword [ebp - 0xbb0], eax
cmp eax, ecx
jb 0x418869
mov dword [ebp - 0xcb8], eax
jmp 0x4147a0
mov eax, dword [ebp - 0xcb4]
mov ecx, dword [ebp - 0xbc0]
mov dword [ebp - 0xbb0], eax
mov dword [ebp - 0xbb8], ebx
test edx, edx
je 0x414739
mov eax, dword [ebp - 0xbcc]
mov dword [ebp - 0xbcc], eax
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xbc0], esi
mov dword [ebp - 0xbdc], edi
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0xbd8], eax
cmp eax, 4
jb 0x418869
mov eax, dword [ebp - 0xbb0]
mov ebx, dword [ebp - 0xbd8]
add ebx, eax
push 0
mov dword [ebp - 0xbb0], ebx
cmp ebx, eax
pop ebx
jb 0x418869
inc dword [ebp - 0xbb8]
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xbb0], eax
cmp dword [ebp - 0xbb8], edx
jb 0x4146c0
mov edx, dword [ebp - 0xbcc]
mov dword [ebp - 0xbb0], eax
jmp 0x41473f
mov edx, dword [ebp - 0xbdc]
mov dword [ebp - 0xbc0], ecx
lea ecx, [eax + 4]
mov dword [ebp - 0xbb8], ecx
cmp ecx, eax
jb 0x418869
lea ecx, [eax + 4]
mov eax, dword [ebp - 0xcb4]
add eax, dword [ebp - 0xbc8]
add ecx, edx
push 0
pop ebx
cmp ecx, eax
ja 0x418748
mov eax, dword [ebp - 0xbb0]
mov dword [eax], edx
test edi, edi
je 0x41478e
push edx
push edi
push dword [ebp - 0xbb8]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0xcb8]
mov edx, dword [ebp - 0xcbc]
mov dword [ebp - 0xbb0], eax
inc edx
mov dword [ebp - 0xcbc], edx
cmp dword [ebp - 0xcb4], 0
jne 0x4147cd
lea ecx, [eax + 0xc]
cmp ecx, eax
jb 0x418869
inc edx
mov dword [ebp - 0xcb8], ecx
mov dword [ebp - 0xcbc], edx
jmp 0x414892
mov eax, dword [ebp - 0xcb4]
mov ecx, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbb8], ebx
test edx, edx
je 0x414846
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0xbc0], esi
mov dword [ebp - 0xbcc], edi
mov dword [ebp - 0xbdc], eax
cmp eax, 4
jb 0x418869
mov ebx, eax
add ebx, dword [ebp - 0xbc8]
cmp ebx, dword [ebp - 0xbc8]
push 0
mov dword [ebp - 0xbc0], ebx
pop ebx
jb 0x418869
inc dword [ebp - 0xbb8]
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc8], eax
cmp dword [ebp - 0xbb8], edx
jb 0x4147e9
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbc0], ecx
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x418869
mov edx, dword [ebp - 0xbc8]
mov ecx, dword [ebp - 0xbb0]
add ecx, dword [ebp - 0xcb4]
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0x418748
mov eax, dword [ebp - 0xbe4]
mov dword [edx], 8
mov dword [edx + 4], eax
mov eax, dword [ebp - 0xbec]
mov dword [edx + 8], eax
inc dword [ebp - 0xcbc]
lea eax, [ebp - 0xc84]
mov edx, 0x7fffffff
push eax
mov ecx, 0x402b98
call fcn.00424e59
test eax, eax
jns 0x4148c1
mov dword [ebp - 0xc84], ebx
mov dword [ebp - 0xbc8], 0xc000003e
jmp 0x415ce9
mov eax, dword [ebp - 0xc84]
lea ecx, [eax + 1]
mov dword [ebp - 0xbb0], ecx
cmp ecx, eax
jb 0x418862
lea eax, [ecx + ecx]
mov dword [ebp - 0xc84], ecx
test eax, eax
je 0x414aaf
cmp dword [ebp - 0xcb4], 0
jne 0x414949
lea ecx, [eax + 4]
cmp ecx, 4
jb 0x41493f
add ecx, dword [ebp - 0xcb8]
mov edx, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc0], edx
cmp ecx, dword [ebp - 0xcb8]
jb 0x41492e
mov dword [ebp - 0xcb8], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xcbc]
inc ecx
mov dword [ebp - 0xcbc], ecx
jmp 0x414ac6
or dword [ebp - 0xcb8], 0xffffffff
mov eax, 0xc0000095
jmp 0x414ac0
mov eax, 0xc0000095
jmp 0x414ab4
mov ecx, dword [ebp - 0xcbc]
mov eax, dword [ebp - 0xcb4]
mov edx, dword [ebp - 0xbc0]
mov dword [ebp - 0xbb8], eax
mov dword [ebp - 0xbc8], ebx
test ecx, ecx
je 0x414a03
mov dword [ebp - 0xbcc], edi
mov dword [ebp - 0xbdc], esi
mov dword [ebp - 0xbd8], edx
jmp 0x414989
mov edx, dword [ebp - 0xbd8]
mov eax, dword [eax]
mov esi, dword [ebp - 0xbdc]
add eax, 4
mov edi, dword [ebp - 0xbcc]
mov dword [ebp - 0xbc0], edx
mov dword [ebp - 0xbe0], eax
cmp eax, 4
jb 0x414a43
mov eax, dword [ebp - 0xbb8]
mov ecx, dword [ebp - 0xbe0]
add ecx, eax
mov dword [ebp - 0xbb8], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0xcbc]
jb 0x414a55
inc dword [ebp - 0xbc8]
mov eax, dword [ebp - 0xbb8]
mov dword [ebp - 0xbb8], eax
mov dword [ebp - 0xbcc], edi
mov dword [ebp - 0xbdc], esi
mov dword [ebp - 0xbd8], edx
cmp dword [ebp - 0xbc8], ecx
jb 0x414983
mov dword [ebp - 0xbb8], eax
lea ecx, [eax + 4]
mov dword [ebp - 0xbcc], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0xcbc]
jb 0x414aa8
mov edx, dword [ebp - 0xbb0]
add edx, 2
mov dword [ebp - 0xbc8], ebx
lea edx, [eax + edx*2]
mov eax, dword [ebp - 0xcb4]
add eax, dword [ebp - 0xcb8]
cmp edx, eax
jbe 0x414a62
mov eax, 0xc0000023
jmp 0x414ab4
mov edi, dword [ebp - 0xbcc]
mov esi, dword [ebp - 0xbdc]
mov edx, dword [ebp - 0xbd8]
mov eax, 0xc0000095
mov dword [ebp - 0xbc0], edx
jmp 0x414ac6
mov edx, dword [ebp - 0xbb0]
mov eax, dword [ebp - 0xbb8]
lea ecx, [edx + edx]
push ecx
push 0x402b98
push dword [ebp - 0xbcc]
mov dword [eax], ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [ebp - 0xcbc]
add esp, 0xc
mov edx, dword [ebp - 0xbc0]
inc ecx
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0xcbc], ecx
mov dword [ebp - 0xbc0], edx
jmp 0x414acc
mov eax, 0xc0000095
jmp 0x414ac6
mov eax, 0xc000000d
mov edx, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc0], edx
mov ecx, dword [ebp - 0xcbc]
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbb0], esi
mov esi, edi
mov dword [ebp - 0xbb8], esi
mov esi, dword [ebp - 0xbb0]
test eax, eax
js 0x415ce9
cmp dword [ebp - 0xcb4], 0
jne 0x414b1f
mov eax, dword [ebp - 0xcb8]
lea esi, [eax + 8]
mov dword [ebp - 0xbc8], esi
cmp esi, eax
mov esi, dword [ebp - 0xbb0]
jb 0x418869
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0xcb8], eax
jmp 0x414bfc
mov eax, dword [ebp - 0xcb4]
mov esi, dword [ebp - 0xbb0]
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbc0], ebx
test ecx, ecx
je 0x414ba7
mov eax, dword [eax]
mov esi, dword [ebp - 0xbb0]
add eax, 4
mov edi, dword [ebp - 0xbb8]
mov dword [ebp - 0xbcc], eax
cmp eax, 4
jb 0x414c31
mov ecx, eax
add ecx, dword [ebp - 0xbc8]
cmp ecx, dword [ebp - 0xbc8]
mov dword [ebp - 0xbb0], ecx
mov ecx, dword [ebp - 0xcbc]
jb 0x418869
inc dword [ebp - 0xbc0]
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbb8], edi
mov dword [ebp - 0xbb0], esi
cmp dword [ebp - 0xbc0], ecx
jb 0x414b3b
mov dword [ebp - 0xbc8], eax
lea ecx, [eax + 4]
mov dword [ebp - 0xbc0], edx
cmp ecx, eax
jb 0x418869
mov ecx, dword [ebp - 0xcb8]
mov eax, dword [ebp - 0xbc8]
add ecx, dword [ebp - 0xcb4]
add eax, 8
cmp eax, ecx
ja 0x418748
mov eax, dword [ebp - 0xbc8]
mov ecx, dword [ebp - 0xbf0]
mov dword [eax], 4
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0xcb8]
mov ecx, dword [ebp - 0xcbc]
mov dword [ebp - 0xbc8], eax
inc ecx
mov dword [ebp - 0xcbc], ecx
cmp dword [ebp - 0xcb4], 0
jne 0x414c4c
lea edx, [eax + 8]
mov dword [ebp - 0xbb0], edx
cmp edx, eax
jb 0x418869
inc ecx
mov dword [ebp - 0xcb8], edx
mov dword [ebp - 0xcbc], ecx
mov ecx, edx
jmp 0x414d03
mov edi, dword [ebp - 0xbb8]
mov esi, dword [ebp - 0xbb0]
mov dword [ebp - 0xbc8], 0xc0000095
jmp 0x415ce9
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0xbb0], eax
mov dword [ebp - 0xbc0], ebx
test ecx, ecx
je 0x414cc1
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0xbb8], esi
mov dword [ebp - 0xbcc], edi
mov dword [ebp - 0xbdc], eax
cmp eax, 4
jb 0x418869
mov eax, dword [ebp - 0xbb0]
mov ebx, dword [ebp - 0xbdc]
add ebx, eax
push 0
mov dword [ebp - 0xbb0], ebx
cmp ebx, eax
pop ebx
jb 0x418869
inc dword [ebp - 0xbc0]
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xbb0], eax
cmp dword [ebp - 0xbc0], ecx
jb 0x414c62
mov dword [ebp - 0xbb0], eax
lea ecx, [eax + 4]
mov dword [ebp - 0xbc0], edx
cmp ecx, eax
jb 0x418869
mov edx, dword [ebp - 0xbb0]
mov ecx, dword [ebp - 0xbc8]
add ecx, dword [ebp - 0xcb4]
lea eax, [edx + 8]
cmp eax, ecx
ja 0x418748
push 4
pop eax
mov dword [edx], eax
mov dword [edx + 4], eax
inc dword [ebp - 0xcbc]
mov ecx, dword [ebp - 0xcb8]
mov dword [ebp - 0xbb0], esi
mov dword [ebp - 0xbb8], edi
rdtsc
mov dword [ebp - 0xbdc], ebx
mov dword [ebp - 0xbd8], ebx
mov dword [ebp - 0xbe0], ebx
mov dword [ebp - 0xbd4], ebx
mov dword [ebp - 0xbbc], ebx
mov dword [ebp - 0xbc4], ebx
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xbd0], ebx
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xba8], edx
add ecx, 8
cmp ecx, 8
jb 0x418853
lea eax, [ecx + 7]
mov edx, esi
and eax, 0xfffffff8
mov dword [ebp - 0xbb0], eax
cmp eax, ecx
jae 0x414d7a
mov dword [ebp - 0xbc8], 0xd0000095
jmp 0x415ce9
push eax
push 8
mov dword [ebp - 0xbb8], esi
mov dword [ebp - 0xb98], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xb80], ecx
test ecx, ecx
jne 0x414db1
mov dword [ebp - 0xbc8], 0xd0000017
jmp 0x415ce9
mov esi, dword [ebp - 0xbb8]
lea edx, [ecx + 4]
mov edi, dword [ebp - 0xb98]
mov eax, dword [ebp - 0xcbc]
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xba0], edi
mov dword [ecx], eax
cmp edx, ecx
jb 0x414e39
mov eax, dword [ebp - 0xcb8]
mov dword [edx], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x414e45
mov eax, dword [ebp - 0xbb0]
mov edx, dword [ebp - 0xbc8]
mov dword [ecx + eax - 8], edx
mov edx, dword [ebp - 0xba8]
mov dword [ecx + eax - 4], edx
lea eax, [ecx + 8]
push dword [ebp - 0xcb8]
push dword [ebp - 0xcb4]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xb80]
add esp, 0xc
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xbd8], eax
mov dword [ebp - 0xb80], ebx
jmp 0x414ea3
mov edi, dword [ebp - 0xb98]
mov esi, dword [ebp - 0xbb8]
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc0], eax
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xba0], edi
mov dword [ebp - 0xbc8], 0xc0000095
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or dword [ebp - 0xbc8], 0x10000000
jl 0x4181b8
mov eax, ebx
mov dword [ebp - 0xb80], ebx
test eax, eax
jne 0x414ea1
mov dword [ebp - 0xbc8], 0xd000000d
jmp 0x415ce9
mov eax, ebx
test eax, eax
je 0x4181a3
add eax, 8
push eax
push ebx
mov dword [ebp - 0xb98], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xba8], eax
test eax, eax
je 0x4181a3
mov ecx, dword [ebp - 0xbd8]
mov dl, bl
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0xbb0], ebx
test ecx, ecx
je 0x414ef3
xor dl, byte [ebx + eax]
inc ebx
cmp ebx, ecx
jb 0x414ee9
xor ebx, ebx
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0xbc8], eax
or eax, 0xffffffff
and ecx, 7
mov dword [ebp - 0x3a8], 0xb1b54a58
mov dword [ebp - 0x3a4], 0xc81ecb17
mov dword [ebp - 0xbb8], ebx
mov dword [ebp - 0xb7c], eax
mov dword [ebp - 0xb90], ebx
mov dword [ebp - 0xb8c], ebx
mov dword [ebp - 0xb88], ecx
je 0x4150ec
mov dword [ebp - 0xbb8], ebx
mov eax, ebx
mov dword [ebp - 0xb8c], ebx
test ecx, ecx
je 0x4150b1
mov ebx, dword [ebp - 0xbb0]
mov esi, eax
mov dword [ebp - 0xb90], 0x38
mov edi, dword [ebp - 0xb90]
movzx ecx, byte [ebx]
inc ebx
mov dword [ebp - 0xb8c], ecx
cmp esi, 4
jae 0x414f9d
lea ecx, [edi - 0x20]
shl dword [ebp - 0xb8c], cl
mov ecx, dword [ebp - 0xbb8]
or ecx, dword [ebp - 0xb8c]
mov dword [ebp - 0xbb8], ecx
jmp 0x414fb1
mov ecx, edi
shl dword [ebp - 0xb8c], cl
or eax, dword [ebp - 0xb8c]
mov ecx, dword [ebp - 0xbb8]
inc esi
mov dword [ebp - 0xb90], eax
sub edi, 8
mov dword [ebp - 0xb8c], ecx
cmp esi, dword [ebp - 0xb88]
jl 0x414f71
mov edi, dword [ebp - 0xba0]
xor eax, 0x42f6b18d
mov esi, dword [ebp - 0xbcc]
xor ecx, 0xb17a307a
mov dword [ebp - 0xb7c], eax
mov dword [ebp - 0xb94], eax
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xbb0], ebx
xor ebx, ebx
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0xb78], ecx
mov dword [ebp - 0xbb8], ecx
mov ecx, ebx
mov ebx, dword [ebp - 0xb78]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xba0], edi
mov edi, dword [ebp - 0xbc8]
mov dword [ebp - 0xbcc], esi
mov esi, dword [ebp - 0xb88]
mov dword [ebp - 0xbd8], eax
lea eax, [edi + 1]
mov dword [ebp - 0xb78], eax
cmp ecx, 4
jge 0x415059
rol ebx, 8
mov eax, ebx
jmp 0x415068
mov eax, dword [ebp - 0xb94]
rol eax, 8
mov dword [ebp - 0xb94], eax
mov byte [edi], al
inc ecx
mov eax, dword [ebp - 0xb78]
mov edi, eax
cmp ecx, esi
jl 0x415044
mov dword [ebp - 0xbc8], eax
push 0
pop ebx
cmp esi, 4
jbe 0x41509f
mov eax, dword [ebp - 0xb7c]
push 8
pop ecx
sub ecx, esi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xb7c], eax
jmp 0x4150ec
mov eax, ebx
mov dword [ebp - 0xb7c], eax
jae 0x4150ec
mov esi, dword [ebp - 0xbb8]
jmp 0x4150d6
mov eax, dword [ebp - 0xbb0]
mov esi, 0xb17a307a
mov dword [ebp - 0xbb0], eax
mov eax, ebx
mov dword [ebp - 0xb8c], ebx
mov dword [ebp - 0xb90], ebx
mov dword [ebp - 0xb7c], eax
push 4
pop ecx
sub ecx, dword [ebp - 0xb88]
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0xbb8], esi
mov ecx, dword [ebp - 0xbd8]
mov eax, ecx
shr eax, 3
mov dword [ebp - 0xb94], eax
test eax, eax
je 0x4154d2
movzx eax, word [ebp - 0x3a6]
mov edi, 0xb1b54a58
movzx esi, word [ebp - 0x3a2]
mov ecx, 0xc81ecb17
mov dword [ebp - 0xb88], eax
mov eax, 0xc81ecb17
xor eax, edi
movzx ecx, cx
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xbc8]
movzx ebx, di
add eax, 7
mov dword [ebp - 0xb84], ecx
mov ecx, dword [ebp - 0xbb0]
mov dword [ebp - 0xb78], ebx
add ecx, 2
mov ebx, dword [ebp - 0xb7c]
mov dword [ebp - 0xb74], esi
mov dword [ebp - 0xbc8], eax
movzx edi, byte [ecx - 2]
movzx eax, byte [ecx - 1]
movzx esi, byte [ecx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [ecx]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 3]
or esi, eax
movzx eax, byte [ecx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 5]
add ecx, 8
shl esi, 8
or esi, eax
mov dword [ebp - 0xb7c], ecx
xor ebx, esi
mov ecx, 0xc81ecb17
mov eax, ebx
sub eax, dword [ebp - 0xb78]
xor eax, ecx
xor eax, edi
xor dword [ebp - 0xbb8], eax
mov eax, dword [ebp - 0xbb8]
xor ecx, eax
ror ecx, 0xf
imul ecx, dword [ebp - 0xb88]
ror eax, 7
add ecx, eax
xor ebx, ecx
mov ecx, 0xb1b54a58
mov eax, ebx
ror eax, 0xa
lea ecx, [ebx + ecx]
ror ecx, 9
imul ecx, dword [ebp - 0xb84]
sub ecx, eax
mov eax, dword [ebp - 0xbb8]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xbb8], eax
xor ecx, dword [ebp - 0xb84]
rol ecx, 4
imul ecx, dword [ebp - 0xb74]
rol eax, 5
add ecx, eax
mov eax, 0xc81ecb17
xor ebx, ecx
mov ecx, ebx
xor ecx, 0xb1b54a58
sub eax, ecx
mov ecx, dword [ebp - 0xbb8]
xor ecx, eax
mov dword [ebp - 0xbb8], ecx
sub ecx, dword [ebp - 0xb78]
imul ecx, dword [ebp - 0xb88]
mov eax, dword [ebp - 0xbb8]
shr eax, 6
sub ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xbb8]
mov eax, ebx
ror eax, 0xf
xor eax, dword [ebp - 0xb84]
imul eax, dword [ebp - 0xb78]
xor ecx, eax
mov eax, ecx
not eax
ror eax, 3
add eax, dword [ebp - 0xb74]
imul eax, dword [ebp - 0xb84]
xor ebx, eax
mov eax, ebx
sub eax, 0xc81ecb17
sub eax, dword [ebp - 0xb78]
xor ecx, eax
mov dword [ebp - 0xbb8], ecx
mov eax, dword [ebp - 0xbb8]
xor eax, dword [ebp - 0xb74]
imul eax, dword [ebp - 0xb88]
ror ecx, 0xa
xor ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xb78]
rol ecx, 6
imul ecx, dword [ebp - 0xb84]
ror eax, 3
xor ecx, eax
mov eax, dword [ebp - 0xbb8]
xor eax, ecx
mov dword [ebp - 0xbb8], eax
ror eax, 0xf
sub eax, dword [ebp - 0xb74]
imul eax, dword [ebp - 0xb78]
xor ebx, eax
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xb74]
imul ecx, dword [ebp - 0xb78]
shr eax, 1
xor ecx, eax
mov eax, ebx
xor dword [ebp - 0xbb8], ecx
mov ecx, ebx
sub ecx, dword [ebp - 0xb84]
rol ecx, 3
imul ecx, dword [ebp - 0xb78]
shr eax, 0xf
xor ecx, eax
mov eax, dword [ebp - 0xbb8]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xbb8], eax
sub ecx, dword [ebp - 0xb84]
imul ecx, dword [ebp - 0xb88]
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, 0xb1b54a58
sub ecx, ebx
mov eax, ebx
ror ecx, 9
imul ecx, dword [ebp - 0xb84]
ror eax, 0xb
xor ecx, eax
mov eax, dword [ebp - 0xbb8]
xor eax, ecx
mov dword [ebp - 0xbb8], eax
sub eax, 0xb1b54a58
sub eax, dword [ebp - 0xb74]
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, dword [ebp - 0xb88]
imul eax, dword [ebp - 0xb78]
ror ecx, 7
sub eax, ecx
mov ecx, dword [ebp - 0xbb8]
xor ecx, eax
mov dword [ebp - 0xbb8], ecx
xor ecx, dword [ebp - 0xb74]
mov eax, dword [ebp - 0xbb8]
rol ecx, 4
imul ecx, dword [ebp - 0xb88]
ror eax, 0x10
sub ecx, eax
xor ebx, ecx
mov ecx, 0xb1b54a58
sub ecx, ebx
mov eax, ebx
ror ecx, 0xa
imul ecx, dword [ebp - 0xb84]
ror eax, 4
add ecx, eax
mov eax, dword [ebp - 0xbb8]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xbb8], eax
sub ecx, 0xb1b54a58
ror eax, 9
ror ecx, 4
imul ecx, dword [ebp - 0xb74]
xor ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, 0xc81ecb17
rol eax, 2
rol ecx, 8
imul ecx, dword [ebp - 0xb78]
sub ecx, eax
mov eax, dword [ebp - 0xbb8]
xor eax, ecx
mov ecx, 0xc81ecb17
sub ecx, eax
mov dword [ebp - 0xbb8], eax
ror ecx, 0xb
imul ecx, dword [ebp - 0xb88]
ror eax, 0xc
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xb88]
imul ecx, dword [ebp - 0xb84]
xor ebx, dword [ebp - 0xbac]
shr eax, 8
xor ecx, eax
mov eax, dword [ebp - 0xbb8]
xor eax, ecx
mov ecx, dword [ebp - 0xbc8]
xor ebx, eax
xor eax, dword [ebp - 0xb8c]
xor ebx, dword [ebp - 0xb90]
mov dword [ebp - 0xb8c], edi
mov byte [ecx - 4], al
mov byte [ecx], bl
ror eax, 8
mov byte [ecx - 5], al
ror ebx, 8
mov byte [ecx - 1], bl
ror eax, 8
mov byte [ecx - 6], al
ror ebx, 8
mov byte [ecx - 2], bl
ror eax, 8
ror ebx, 8
mov byte [ecx - 7], al
mov byte [ecx - 3], bl
add ecx, 8
ror eax, 8
ror ebx, 8
sub dword [ebp - 0xb94], 1
mov dword [ebp - 0xbc8], ecx
mov ecx, dword [ebp - 0xb7c]
mov dword [ebp - 0xbb8], eax
mov dword [ebp - 0xb90], esi
jne 0x415166
mov ecx, dword [ebp - 0xbd8]
mov eax, dword [ebp - 0xbdc]
mov ebx, dword [ebp - 0xba8]
mov esi, dword [ebp - 0xbcc]
mov edi, dword [ebp - 0xba0]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xb74], eax
movzx eax, dl
cdq
mov dword [ebx + ecx], eax
mov eax, ebx
mov dword [eax + ecx + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb78], eax
push 0
pop ebx
test eax, eax
jne 0x415536
mov dword [ebp - 0xbc8], 0xc0000017
jmp 0x415751
mov ecx, dword [ebp - 0xbac]
mov esi, dword [ebp - 0xbcc]
mov edi, dword [ebp - 0xba0]
mov dword [ebp - 0xbdc], ecx
mov ecx, dword [ebp - 0xb74]
mov dword [ebp - 0xbc0], ecx
mov ecx, dword [ebp - 0xb98]
push ecx
push 8
mov dword [eax], ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x41558f
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xbac]
jmp 0x415684
mov ecx, dword [ebp - 0xb78]
mov dword [ecx + 4], edx
push dword [ebp - 0xb98]
mov dword [ebp - 0xb78], ecx
push dword [ebp - 0xba8]
push edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xbdc]
add esp, 0xc
mov dword [ebp - 0xbac], eax
mov ecx, 0xa0
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0xb78]
push ecx
push 8
mov dword [ebp - 0xb84], esi
mov dword [ebp - 0xb94], edi
mov dword [eax + 8], ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x41568a
mov eax, dword [ebp - 0xb78]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xbac]
mov edi, esi
mov dword [ebp - 0xbdc], ecx
mov esi, 0x4296d8
mov ecx, dword [ebp - 0xb74]
push 0x28
mov dword [ebp - 0xbc0], ecx
mov ecx, dword [ebp - 0xb94]
mov dword [ebp - 0xba0], ecx
pop ecx
mov dword [ebp - 0xbcc], edi
mov edi, dword [eax + 0xc]
rep movsd dword es:[edi], dword [esi]
push 8
mov esi, eax
pop eax
push eax
push eax
mov dword [esi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0x41571d
mov eax, dword [ebp - 0xb74]
mov edi, dword [ebp - 0xb94]
mov dword [ebp - 0xb78], esi
mov esi, dword [ebp - 0xb84]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xbdc], eax
mov dword [ebp - 0xbc8], 0xc0000017
mov eax, dword [ebp - 0xb78]
mov dword [ebp - 0xb80], ebx
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x4156bf
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb78]
mov dword [eax + 4], ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x4156de
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb78]
mov dword [eax + 0xc], ebx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x4156fd
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb78]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xbc8], 0
jl 0x415751
mov eax, dword [ebp - 0xb80]
jmp 0x415745
mov dword [esi + 0x14], eax
mov ecx, dword [0x429778]
mov edx, dword [0x42977c]
mov edi, dword [ebp - 0xba0]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, esi
mov esi, dword [ebp - 0xbcc]
mov dword [ebp - 0xbc8], ebx
mov dword [ebp - 0xbe0], eax
mov dword [ebp - 0xb80], ebx
mov eax, dword [ebp - 0xbdc]
push dword [ebp - 0xba8]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xbe0]
push ebx
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xba0], edi
mov dword [ebp - 0xbe0], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbc0]
mov ecx, dword [ebp - 0xbdc]
mov dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xbac], ecx
mov dword [ebp - 0xb84], esi
mov dword [ebp - 0xb94], edi
test eax, eax
je 0x415847
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x4157e6
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb80]
mov dword [eax + 4], ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x415805
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb80]
mov dword [eax + 0xc], ebx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x415824
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb80]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edx, dword [ebp - 0xbe0]
mov ecx, dword [ebp - 0xbac]
mov dword [ebp - 0xbe0], edx
jmp 0x41584d
mov edx, dword [ebp - 0xbe0]
mov eax, dword [ebp - 0xbc8]
or eax, 0x10000000
mov dword [ebp - 0xb78], edx
mov dword [ebp - 0xbc8], eax
jl 0x415b89
lea eax, [edx + 0x10]
mov dword [ebp - 0xb88], eax
mov eax, dword [eax]
mov dword [ebp - 0xb8c], eax
lea eax, [edx + 8]
mov dword [ebp - 0xb90], eax
mov eax, dword [eax]
mov dword [ebp - 0xb7c], eax
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xb80], eax
cmp eax, 4
jb 0x41817c
mov esi, dword [ebp - 0xb78]
mov edx, dword [ebp - 0xb74]
mov eax, dword [ebp - 0xb84]
mov dword [ebp - 0xbe0], esi
mov esi, dword [ebp - 0xb80]
mov dword [ebp - 0xbdc], ecx
mov ecx, dword [ebp - 0xb94]
mov dword [ebp - 0xbc0], edx
lea edi, [esi + 4]
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xba0], ecx
mov dword [ebp - 0xb80], edi
cmp edi, esi
jb 0x418137
mov esi, edi
add esi, dword [ebp - 0xb7c]
cmp esi, edi
mov dword [ebp - 0xbac], esi
mov esi, dword [ebp - 0xbe0]
mov edi, dword [ebp - 0xbdc]
jb 0x418110
mov esi, dword [ebp - 0xbac]
add esi, 4
cmp esi, dword [ebp - 0xbac]
mov esi, dword [ebp - 0xbe0]
push 0
pop ebx
jb 0x418110
mov esi, dword [ebp - 0xbac]
mov ebx, dword [ebp - 0xb8c]
add esi, 4
add ebx, esi
cmp ebx, esi
mov dword [ebp - 0xbac], ebx
mov esi, dword [ebp - 0xbe0]
push 0
pop ebx
jb 0x418110
push dword [ebp - 0xbac]
mov dword [ebp - 0xb74], edi
push 8
mov dword [ebp - 0xb84], edx
mov dword [ebp - 0xb94], eax
mov dword [ebp - 0xb78], ecx
mov dword [ebp - 0xb8c], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edx, eax
mov dword [ebp - 0xb7c], edx
test edx, edx
je 0x4161a1
mov esi, dword [ebp - 0xb94]
mov eax, edi
mov edi, dword [ebp - 0xb78]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xb84]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xb8c]
mov ecx, eax
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xba0], edi
mov dword [ebp - 0xbe0], ecx
mov eax, dword [eax]
mov dword [edx], eax
lea eax, [edx + 4]
mov dword [ebp - 0xb80], eax
cmp eax, edx
jb 0x415b11
push dword [ecx]
push dword [ecx + 4]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [ebp - 0xbe0]
add esp, 0xc
mov eax, dword [ecx]
add eax, dword [ebp - 0xb80]
mov dword [ebp - 0xb74], eax
cmp eax, dword [ebp - 0xb80]
jb 0x415b09
mov edx, dword [ebp - 0xb74]
mov eax, dword [ebp - 0xb90]
mov eax, dword [eax]
mov dword [edx], eax
lea eax, [edx + 4]
mov dword [ebp - 0xb74], eax
cmp eax, edx
jb 0x415b09
mov edx, dword [ebp - 0xb90]
push dword [edx]
push dword [ecx + 0xc]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xb90]
add esp, 0xc
mov edx, dword [ebp - 0xb74]
mov ecx, dword [eax]
add ecx, edx
mov dword [ebp - 0xb74], ecx
cmp ecx, edx
jb 0x415ae3
mov edx, dword [ebp - 0xb88]
mov eax, dword [edx]
mov dword [ecx], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x415ae3
mov ecx, dword [ebp - 0xbe0]
push dword [edx]
push dword [ecx + 0x14]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xb88]
add esp, 0xc
mov ecx, dword [ebp - 0xb74]
add ecx, 4
mov eax, dword [eax]
add eax, ecx
cmp eax, ecx
jb 0x415abd
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xbd4], eax
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xbbc], eax
jmp 0x415b72
mov eax, dword [ebp - 0xbe0]
mov edx, dword [ebp - 0xb7c]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xbdc]
jmp 0x415b3b
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xbc0]
mov edx, dword [ebp - 0xb7c]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xbdc]
jmp 0x415b3b
mov dword [ebp - 0xbe0], ecx
jmp 0x415aef
mov esi, dword [ebp - 0xb8c]
mov eax, dword [ebp - 0xb84]
mov edi, dword [ebp - 0xb78]
mov dword [ebp - 0xbe0], esi
mov esi, dword [ebp - 0xb94]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xbdc], eax
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xba0], edi
mov dword [ebp - 0xbc8], 0xc0000095
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or dword [ebp - 0xbc8], 0x10000000
jl 0x415b89
cmp dword [ebp - 0xcb4], 0
jne 0x415dee
mov dword [ebp - 0xbc8], 0xc000000d
mov edi, dword [ebp - 0xbdc]
test edi, edi
je 0x415ba2
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xbe0]
test esi, esi
je 0x415c09
cmp dword [esi + 4], 0
je 0x415bc6
push dword [esi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 4], ebx
cmp dword [esi + 0xc], 0
je 0x415be0
push dword [esi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 0xc], ebx
cmp dword [esi + 0x14], 0
je 0x415bfa
push dword [esi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 0x14], ebx
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbd4]
test eax, eax
je 0x415c22
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbc4]
test eax, eax
je 0x415c3b
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xba4]
test esi, esi
je 0x415ca2
cmp dword [esi + 4], 0
je 0x415c5f
push dword [esi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 4], ebx
cmp dword [esi + 0xc], 0
je 0x415c79
push dword [esi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 0xc], ebx
cmp dword [esi + 0x14], 0
je 0x415c93
push dword [esi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 0x14], ebx
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbd0]
test eax, eax
je 0x415cbb
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xbc8], 0
jl 0x415cdd
xor eax, eax
inc eax
cmp dword [ebp - 0xcc8], eax
jae 0x4181bf
mov dword [ebp - 0xbc8], 0xc004d501
mov edi, dword [ebp - 0xba0]
mov esi, dword [ebp - 0xbcc]
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0xcb8], ebx
mov dword [ebp - 0xcbc], ebx
test eax, eax
je 0x415d14
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xcb4], ebx
mov eax, dword [ebp - 0xcc0]
mov dword [ebp - 0xcc4], ebx
mov dword [ebp - 0xcc8], ebx
test eax, eax
je 0x415d3f
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xcc0], ebx
test esi, esi
je 0x415d52
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0x415d65
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xbc8], 0
jl 0x414077
mov eax, dword [ebp - 0xbf0]
test eax, eax
je 0x420702
mov dword [0x42a874], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x308]
mov dword [ebp - 0xc7c], ebx
push eax
push 0x400000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0x41d0b7
cmp eax, esi
jne 0x415dbe
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0x41d0b7
mov esi, dword [0x42907c]
mov ecx, esi
push 0x403
push ebx
push ebx
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xbac], eax
test eax, eax
jne 0x418899
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x41d0b7
xor eax, eax
inc eax
cmp dword [ebp - 0xcbc], eax
jbe 0x415b7f
mov eax, dword [ebp - 0xcb4]
mov edx, dword [ebp - 0xbc0]
mov ecx, dword [ebp - 0xbdc]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xb74], ebx
mov ebx, dword [ebp - 0xbbc]
mov dword [ebp - 0xb90], eax
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xb94], ecx
mov dword [ebp - 0xbdc], ecx
mov dword [ebp - 0xbbc], ebx
mov ecx, dword [eax]
mov ebx, dword [ebp - 0xbd4]
mov dword [ebp - 0xbac], ecx
lea ecx, [eax + 4]
mov dword [ebp - 0xb84], ebx
mov dword [ebp - 0xbd4], ebx
mov dword [ebp - 0xb78], edx
mov dword [ebp - 0xb88], esi
mov dword [ebp - 0xb8c], edi
mov dword [ebp - 0xbc0], edx
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xba0], edi
mov dword [ebp - 0xb7c], ecx
push 0
pop ebx
cmp ecx, eax
jb 0x418101
mov eax, dword [ebp - 0xb84]
mov ecx, dword [ebp - 0xb94]
mov dword [ebp - 0xbd4], eax
mov eax, dword [ebp - 0xb90]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xb7c]
add eax, dword [ebp - 0xbac]
cmp eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xbdc], ecx
jb 0x4180b6
inc dword [ebp - 0xb74]
cmp dword [ebp - 0xb74], 1
jb 0x415e21
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xbc0], edx
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xba0], edi
mov ecx, dword [eax]
add eax, 4
mov dword [ebp - 0xb74], ecx
mov ecx, dword [ebp - 0xbdc]
cmp eax, dword [ebp - 0xbac]
jb 0x41809b
mov eax, dword [ebp - 0xbd4]
mov dword [ebp - 0xbd4], eax
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xbdc], ecx
mov dword [ebp - 0xbe0], eax
cmp dword [ebp - 0xcb4], ebx
je 0x415b7f
cmp dword [ebp - 0xcbc], 2
ja 0x415f93
mov dword [ebp - 0xbc8], 0xc000000d
mov dword [ebp - 0xbe0], eax
mov dword [ebp - 0xba0], edi
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xbc0], edx
mov ecx, dword [ebp - 0xbd4]
mov dword [ebp - 0xbd4], ecx
jmp 0x415b89
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xb88], esi
mov esi, dword [ebp - 0xbd4]
mov dword [ebp - 0xb84], ebx
mov dword [ebp - 0xb94], eax
mov dword [ebp - 0xb78], edi
mov dword [ebp - 0xb8c], edx
mov dword [ebp - 0xb90], ecx
mov dword [ebp - 0xb7c], esi
jmp 0x415fe9
mov edx, dword [ebp - 0xb8c]
mov ecx, dword [ebp - 0xb90]
mov esi, dword [ebp - 0xb7c]
mov ebx, dword [ebp - 0xbbc]
mov edi, ecx
mov ecx, dword [ebp - 0xb88]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xbbc], ebx
mov dword [ebp - 0xbd4], esi
mov esi, edx
mov edx, dword [ebp - 0xb78]
mov ebx, dword [eax]
mov dword [ebp - 0xbac], ebx
lea ebx, [eax + 4]
push 0
mov dword [ebp - 0xb80], ebx
cmp ebx, eax
mov dword [ebp - 0xbc0], esi
mov dword [ebp - 0xbcc], ecx
mov dword [ebp - 0xba0], edx
pop ebx
jb 0x418050
mov eax, dword [ebp - 0xb80]
add eax, dword [ebp - 0xbac]
cmp eax, dword [ebp - 0xb80]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xbe0]
jb 0x41801d
inc dword [ebp - 0xb84]
cmp dword [ebp - 0xb84], 2
mov dword [ebp - 0xb94], eax
mov eax, dword [ebp - 0xbd4]
mov dword [ebp - 0xb7c], eax
mov eax, dword [ebp - 0xb94]
mov dword [ebp - 0xb78], edx
mov dword [ebp - 0xb88], ecx
mov dword [ebp - 0xb8c], esi
mov dword [ebp - 0xb90], edi
jb 0x415fd7
mov eax, dword [ebp - 0xbac]
push 0
mov ebx, dword [eax]
add eax, 4
mov dword [ebp - 0xb84], ebx
pop ebx
cmp eax, dword [ebp - 0xbac]
jb 0x418017
mov eax, dword [ebp - 0xb74]
add eax, 0x50
mov dword [ebp - 0xbac], eax
cmp eax, 0x50
jb 0x418017
add eax, 4
mov dword [ebp - 0xb74], eax
cmp eax, dword [ebp - 0xbac]
jb 0x418017
add eax, dword [ebp - 0xb84]
mov dword [ebp - 0xbac], eax
cmp eax, dword [ebp - 0xb74]
jb 0x418017
cmp eax, 0x400000
jbe 0x416133
mov dword [ebp - 0xbc8], 0x8000ffff
jmp 0x415b8f
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xbd4]
mov dword [ebp - 0xba0], edx
mov dword [ebp - 0xbcc], ecx
mov dword [ebp - 0xbc0], esi
mov dword [ebp - 0xbd4], eax
mov dword [ebp - 0xb94], esi
mov esi, dword [ebp - 0xbac]
push esi
mov dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0xbe0]
push 8
mov dword [ebp - 0xb84], edi
mov dword [ebp - 0xb78], ecx
mov dword [ebp - 0xb88], edx
mov dword [ebp - 0xb8c], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0x4161b0
mov dword [ebp - 0xbc8], 0xd0000017
jmp 0x415b8f
mov edx, eax
mov dword [ebp - 0xbc4], edx
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xb90], edx
test eax, eax
jne 0x416213
mov ecx, dword [ebp - 0xb8c]
mov edi, dword [ebp - 0xb78]
mov dword [ebp - 0xbe0], ecx
mov ecx, dword [ebp - 0xb88]
mov dword [ebp - 0xba0], ecx
mov ecx, dword [ebp - 0xb94]
mov dword [ebp - 0xbcc], edi
mov edi, dword [ebp - 0xb84]
mov dword [ebp - 0xbc8], 0x80070057
mov dword [ebp - 0xbc4], edx
mov dword [ebp - 0xbc0], ecx
jmp 0x4162df
mov dword [ebp - 0xcf0], eax
mov eax, dword [ebp - 0xbbc]
mov dword [ebp - 0xce8], eax
lea eax, [ebp - 0xc80]
push eax
xor eax, eax
mov dword [ebp - 0xcec], edx
push 0x401b14
inc eax
mov dword [ebp - 0xce4], esi
push eax
mov dword [ebp - 0xce0], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0x4162ea
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xbc8], eax
test eax, eax
jle 0x416275
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xbc8], eax
test eax, eax
js 0x416282
mov eax, 0x80004005
mov dword [ebp - 0xbc8], eax
mov ecx, dword [ebp - 0xb8c]
mov edi, dword [ebp - 0xb78]
mov dword [ebp - 0xbe0], ecx
mov ecx, dword [ebp - 0xb88]
mov dword [ebp - 0xba0], ecx
mov ecx, dword [ebp - 0xb94]
mov dword [ebp - 0xbcc], edi
mov edi, dword [ebp - 0xb84]
mov dword [ebp - 0xbc0], ecx
cmp eax, 0xd0000023
jne 0x41637d
mov edx, dword [ebp - 0xbc4]
mov dword [ebp - 0xbc8], 0x8007007a
mov dword [ebp - 0xbc4], edx
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xbd4], eax
jmp 0x415b8f
push 0x404fc8
push dword [ebp - 0xc80]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x416339
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xbc8], eax
test eax, eax
jle 0x416321
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xbc8], eax
test eax, eax
js 0x41632e
mov eax, 0x80004005
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbac], esi
jmp 0x416282
push ebx
push 0x14
lea eax, [ebp - 0xcf0]
mov ecx, edi
push eax
push 0x86
call dword [0x42b5a4]
call edi
or eax, 0x10000000
mov dword [ebp - 0xbac], esi
mov dword [ebp - 0xbc8], eax
jl 0x416282
mov esi, dword [ebp - 0xce4]
mov ecx, dword [ebp - 0xb74]
mov dword [ebp - 0xbac], esi
jmp 0x416391
mov ecx, dword [ebp - 0xb74]
mov dword [ebp - 0xbd4], ecx
test eax, eax
js 0x415b8f
mov edx, dword [ebp - 0xbc4]
mov dword [ebp - 0xb7c], ebx
cmp esi, 4
jae 0x4163ed
mov dword [ebp - 0xbc8], 0xd000003e
mov dword [ebp - 0xbc4], edx
mov edi, dword [ebp - 0xb78]
mov dword [ebp - 0xbcc], edi
mov eax, dword [ebp - 0xb8c]
mov ecx, dword [ebp - 0xb88]
mov edi, dword [ebp - 0xb84]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xb94]
mov dword [ebp - 0xba0], ecx
mov dword [ebp - 0xbc0], eax
jmp 0x4162d9
mov eax, dword [edx]
mov edi, dword [ebp - 0xb78]
mov dword [ebp - 0xb80], eax
lea eax, [edx + 4]
mov dword [ebp - 0xb98], eax
mov dword [ebp - 0xbcc], edi
cmp eax, edx
jb 0x418002
mov eax, dword [ebp - 0xb84]
mov edx, dword [ebp - 0xb94]
mov esi, dword [ebp - 0xb8c]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xb90]
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 0xbac]
add eax, 0xfffffffc
mov dword [ebp - 0xbd4], ecx
mov ecx, dword [ebp - 0xb88]
mov dword [ebp - 0xbc0], edx
mov dword [ebp - 0xba0], ecx
mov dword [ebp - 0xbe0], esi
cmp eax, dword [ebp - 0xb80]
jae 0x416480
mov dword [ebp - 0xbc8], 0xd0000095
mov dword [ebp - 0xbc4], edx
jmp 0x4163be
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xbcc], ecx
mov ecx, dword [ebp - 0xbd4]
mov dword [ebp - 0xbc8], 0xc0000095
mov dword [ebp - 0xbe0], eax
mov dword [ebp - 0xba0], edx
mov dword [ebp - 0xbc0], esi
mov dword [ebp - 0xbd4], ecx
jmp 0x415b8f
mov eax, dword [ebp - 0xb94]
mov edi, dword [ebp - 0xb88]
mov ecx, dword [ebp - 0xb78]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xb8c]
mov dword [ebp - 0xbcc], edi
mov edi, dword [ebp - 0xb90]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xbc8], 0xc0000095
mov dword [ebp - 0xba0], ecx
jmp 0x4162df
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xbc8], 0xc0000095
mov dword [ebp - 0xbe0], eax
jmp 0x415f82
mov eax, dword [ebp - 0xb90]
mov edi, dword [ebp - 0xb88]
mov ecx, dword [ebp - 0xb8c]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xb78]
mov dword [ebp - 0xbcc], edi
mov edi, dword [ebp - 0xb94]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xb84]
mov dword [ebp - 0xbc8], 0xc0000095
mov dword [ebp - 0xba0], ecx
jmp 0x4162df
mov dword [ebp - 0xbc8], 0xc0000095
jmp 0x415b89
mov dword [ebp - 0xbc8], 0xd0000095
mov dword [ebp - 0xbe0], esi
mov dword [ebp - 0xba0], ecx
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xbc0], edx
jmp 0x415b8f
mov eax, dword [ebp - 0xb78]
mov edi, dword [ebp - 0xb84]
mov ecx, dword [ebp - 0xb94]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xbcc], edi
mov edi, dword [ebp - 0xbac]
mov dword [ebp - 0xbc8], 0xd0000095
mov dword [ebp - 0xba0], ecx
mov dword [ebp - 0xbc0], eax
jmp 0x415b8f
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc8], 0xd0000095
mov dword [ebp - 0xba0], edi
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xbc0], eax
jmp 0x415b89
mov edi, dword [ebp - 0xbdc]
mov dword [ebp - 0xbc8], 0xd0000001
jmp 0x415b93
mov edi, ebx
jmp 0x415b8f
cmp dword [ebp - 0xcc0], 0
jne 0x4181d7
mov dword [ebp - 0xbc8], 0xc000000d
jmp 0x415cdd
cmp dword [ebp - 0xcc8], 0
jbe 0x4181c8
mov eax, dword [ebp - 0xcc0]
mov esi, dword [ebp - 0xbcc]
mov edi, dword [ebp - 0xba0]
mov edx, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xbac], edx
cmp ecx, eax
jb 0x418869
neg edx
sbb eax, eax
and eax, ecx
cmp dword [ebp - 0xbac], 4
mov edx, edi
mov dword [ebp - 0xb74], esi
mov dword [ebp - 0xb84], edx
jne 0x418748
mov eax, dword [eax]
mov dword [ebp - 0xbc8], eax
cmp eax, 0xd0000023
jne 0x41823c
mov ecx, 0x8007007a
jmp 0x418255
mov ecx, eax
cmp eax, 0x8007007a
je 0x418255
mov esi, dword [ebp - 0xb74]
mov edi, edx
test eax, eax
js 0x415ce9
cmp dword [ebp - 0xcc8], 6
je 0x418275
mov dword [ebp - 0xbc8], 0xc004d501
mov edi, edx
mov esi, dword [ebp - 0xb74]
jmp 0x415ce9
cmp dword [ebp - 0xcc0], 0
jne 0x41828a
mov dword [ebp - 0xbc8], 0xc000000d
jmp 0x418268
mov edx, dword [ebp - 0xcc0]
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xbac], ebx
mov ebx, dword [edx]
mov esi, dword [ebp - 0xb74]
mov edi, dword [ebp - 0xb84]
mov dword [ebp - 0xb94], ebx
lea ebx, [edx + 4]
push 0
mov dword [ebp - 0xb78], ebx
cmp ebx, edx
pop ebx
jb 0x41883e
mov edx, dword [ebp - 0xb78]
add edx, dword [ebp - 0xb94]
cmp edx, dword [ebp - 0xb78]
jb 0x418869
inc dword [ebp - 0xbac]
cmp dword [ebp - 0xbac], 1
mov dword [ebp - 0xb84], edi
mov dword [ebp - 0xb74], esi
jb 0x41829c
mov ebx, dword [edx]
mov dword [ebp - 0xbac], ebx
lea ebx, [edx + 4]
push 0
mov dword [ebp - 0xb74], ebx
cmp ebx, edx
pop ebx
jb 0x418869
mov edx, dword [ebp - 0xbac]
neg edx
sbb edx, edx
and edx, dword [ebp - 0xb74]
cmp dword [ebp - 0xbac], 8
jne 0x418748
mov ebx, dword [edx]
mov edx, dword [edx + 4]
mov dword [ebp - 0xbac], ebx
mov dword [ebp - 0xb74], edx
cmp dword [ebp - 0xcc0], 0
push 0
pop ebx
je 0x418427
mov edx, dword [ebp - 0xcc0]
mov dword [ebp - 0xb84], ebx
mov dword [ebp - 0xb94], edi
mov dword [ebp - 0xb78], esi
jmp 0x418377
mov edi, dword [ebp - 0xb94]
mov esi, dword [ebp - 0xb78]
mov ebx, dword [ebp - 0xbac]
mov dword [ebp - 0xbac], ebx
mov ebx, dword [ebp - 0xb74]
mov dword [ebp - 0xb74], ebx
mov ebx, dword [edx]
mov dword [ebp - 0xb88], ebx
lea ebx, [edx + 4]
push 0
mov dword [ebp - 0xb8c], ebx
cmp ebx, edx
pop ebx
jb 0x418823
mov edx, dword [ebp - 0xb8c]
add edx, dword [ebp - 0xb88]
cmp edx, dword [ebp - 0xb8c]
jb 0x418869
inc dword [ebp - 0xb84]
cmp dword [ebp - 0xb84], 2
mov dword [ebp - 0xb94], edi
mov dword [ebp - 0xb78], esi
jb 0x41836b
mov ebx, dword [edx]
mov dword [ebp - 0xb84], ebx
lea ebx, [edx + 4]
push 0
mov dword [ebp - 0xb94], ebx
cmp ebx, edx
pop ebx
jb 0x418869
mov edx, dword [ebp - 0xb84]
neg edx
sbb edx, edx
and edx, dword [ebp - 0xb94]
cmp dword [ebp - 0xb84], 4
jne 0x418748
mov edx, dword [edx]
mov dword [ebp - 0xb84], edx
cmp dword [ebp - 0xcc0], ebx
jne 0x418436
mov dword [ebp - 0xbc8], 0xc000000d
jmp 0x415ce9
mov edx, dword [ebp - 0xcc0]
mov dword [ebp - 0xb94], ebx
mov dword [ebp - 0xb78], edi
mov dword [ebp - 0xb88], esi
jmp 0x41845c
mov edi, dword [ebp - 0xb78]
mov esi, dword [ebp - 0xb88]
mov ebx, dword [ebp - 0xbac]
mov dword [ebp - 0xbac], ebx
mov ebx, dword [ebp - 0xb74]
mov dword [ebp - 0xb74], ebx
mov ebx, dword [ebp - 0xb84]
mov dword [ebp - 0xb84], ebx
mov ebx, dword [edx]
mov dword [ebp - 0xb8c], ebx
lea ebx, [edx + 4]
push 0
mov dword [ebp - 0xb90], ebx
cmp ebx, edx
pop ebx
jb 0x418808
mov edx, dword [ebp - 0xb90]
add edx, dword [ebp - 0xb8c]
cmp edx, dword [ebp - 0xb90]
jb 0x418869
inc dword [ebp - 0xb94]
cmp dword [ebp - 0xb94], 3
mov dword [ebp - 0xb78], edi
mov dword [ebp - 0xb88], esi
jb 0x418450
mov ebx, dword [edx]
mov dword [ebp - 0xb94], ebx
lea ebx, [edx + 4]
push 0
mov dword [ebp - 0xb78], ebx
cmp ebx, edx
pop ebx
jb 0x418869
mov edx, dword [ebp - 0xb94]
neg edx
sbb edx, edx
and edx, dword [ebp - 0xb78]
cmp dword [ebp - 0xcc0], ebx
je 0x418427
mov ebx, dword [ebp - 0xcc0]
mov dword [ebp - 0xb78], ebx
xor ebx, ebx
mov dword [ebp - 0xb88], ebx
mov dword [ebp - 0xb8c], edi
mov dword [ebp - 0xb90], esi
jmp 0x418535
mov edi, dword [ebp - 0xb8c]
mov esi, dword [ebp - 0xb90]
mov ebx, dword [ebp - 0xbac]
mov dword [ebp - 0xbac], ebx
mov ebx, dword [ebp - 0xb74]
mov dword [ebp - 0xb74], ebx
mov ebx, dword [ebp - 0xb84]
mov dword [ebp - 0xb84], ebx
mov ebx, dword [ebp - 0xb94]
mov dword [ebp - 0xb94], ebx
mov ebx, dword [ebp - 0xb78]
mov dword [ebp - 0xb7c], edx
push 0
mov edx, dword [ebx]
mov dword [ebp - 0xb78], edx
lea edx, [ebx + 4]
cmp edx, ebx
mov dword [ebp - 0xba0], edx
pop ebx
jb 0x4187ed
mov ebx, edx
add ebx, dword [ebp - 0xb78]
cmp ebx, edx
mov dword [ebp - 0xb78], ebx
mov edx, dword [ebp - 0xb7c]
push 0
pop ebx
jb 0x418869
inc dword [ebp - 0xb88]
cmp dword [ebp - 0xb88], 4
mov dword [ebp - 0xb8c], edi
mov dword [ebp - 0xb90], esi
jb 0x418529
mov ebx, dword [ebp - 0xb78]
push 0
mov edx, dword [ebx]
mov dword [ebp - 0xb78], edx
lea edx, [ebx + 4]
cmp edx, ebx
mov dword [ebp - 0xb88], edx
mov edx, dword [ebp - 0xb7c]
pop ebx
jb 0x418869
mov ebx, dword [ebp - 0xb78]
neg ebx
sbb ebx, ebx
and dword [ebp - 0xb88], ebx
cmp dword [ebp - 0xb78], 4
push 0
pop ebx
jne 0x418748
mov ebx, dword [ebp - 0xb88]
mov ebx, dword [ebx]
mov dword [ebp - 0xb78], ebx
cmp dword [ebp - 0xcc0], 0
push 0
pop ebx
je 0x418427
mov ebx, dword [ebp - 0xcc0]
mov dword [ebp - 0xb88], ebx
xor ebx, ebx
mov dword [ebp - 0xb8c], ebx
mov dword [ebp - 0xb90], edi
mov dword [ebp - 0xba0], esi
jmp 0x41865f
mov edi, dword [ebp - 0xb90]
mov esi, dword [ebp - 0xba0]
mov ebx, dword [ebp - 0xbac]
mov dword [ebp - 0xbac], ebx
mov ebx, dword [ebp - 0xb74]
mov dword [ebp - 0xb74], ebx
mov ebx, dword [ebp - 0xb84]
mov dword [ebp - 0xb84], ebx
mov ebx, dword [ebp - 0xb94]
mov dword [ebp - 0xb94], ebx
mov ebx, dword [ebp - 0xb88]
mov dword [ebp - 0xb7c], edx
mov edx, dword [ebp - 0xb78]
mov dword [ebp - 0xb78], edx
mov edx, dword [ebx]
mov dword [ebp - 0xb88], edx
lea edx, [ebx + 4]
push 0
cmp edx, ebx
mov dword [ebp - 0xbb8], ecx
mov dword [ebp - 0xb80], edx
pop ebx
jb 0x4187d2
mov ebx, edx
add ebx, dword [ebp - 0xb88]
cmp ebx, edx
mov dword [ebp - 0xb88], ebx
mov edx, dword [ebp - 0xb7c]
push 0
pop ebx
jb 0x418869
inc dword [ebp - 0xb8c]
cmp dword [ebp - 0xb8c], 5
mov dword [ebp - 0xb90], edi
mov dword [ebp - 0xba0], esi
jb 0x418653
mov ecx, dword [ebp - 0xb88]
push 0
mov ebx, dword [ecx]
mov dword [ebp - 0xb88], ebx
lea ebx, [ecx + 4]
mov dword [ebp - 0xb8c], ebx
cmp ebx, ecx
pop ebx
jb 0x418869
mov ecx, dword [ebp - 0xb88]
neg ecx
mov dword [ebp - 0xbc8], ebx
sbb ecx, ecx
and ecx, dword [ebp - 0xb8c]
cmp dword [ebp - 0xb88], 4
je 0x418757
mov dword [ebp - 0xbc8], 0xc0000023
jmp 0x415ce9
mov edx, dword [ebp - 0xbe4]
cmp edx, dword [ebp - 0xbac]
mov edx, dword [ebp - 0xb7c]
jne 0x4187c3
mov edi, dword [ebp - 0xb90]
mov esi, dword [ebp - 0xba0]
mov dword [ebp - 0xbc8], 0xc0000095
jmp 0x415ce9
mov edi, dword [ebp - 0xb8c]
mov esi, dword [ebp - 0xb90]
mov dword [ebp - 0xbc8], 0xc0000095
jmp 0x415ce9
mov edi, dword [ebp - 0xb78]
mov esi, dword [ebp - 0xb88]
mov dword [ebp - 0xbc8], 0xc0000095
jmp 0x415ce9
mov edi, dword [ebp - 0xb94]
mov esi, dword [ebp - 0xb78]
mov dword [ebp - 0xbc8], 0xc0000095
jmp 0x415ce9
mov edi, dword [ebp - 0xb84]
mov dword [ebp - 0xbc8], 0xc0000095
jmp 0x41826a
mov dword [ebp - 0xbc8], 0xd0000095
jmp 0x415ce9
or dword [ebp - 0xc84], 0xffffffff
mov dword [ebp - 0xbc8], 0xc0000095
jmp 0x415ce9
test eax, eax
js 0x415ce9
mov eax, dword [ebp - 0xbb8]
test eax, eax
je 0x415ce9
mov dword [ebp - 0xbc8], eax
jmp 0x415ce9
mov esi, dword [0x42904c]
mov ecx, esi
call dword [0x42b5a4]
call esi
mov dword [0x42adc0], eax
lea edi, [ebp - 0x454]
mov eax, dword [0x42a874]
mov dword [ebp - 0xb74], eax
xor eax, eax
stosd dword es:[edi], eax
push 0x2c
push ebx
mov dword [0x42adc4], edx
stosd dword es:[edi], eax
mov dword [ebp - 0xb84], ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x5f0]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0xb94], ebx
xor ebx, ebx
mov edx, 0x42add0
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x4188ef
mov eax, dword [0x42adcc]
push 0
pop ebx
test eax, eax
jne 0x418ebf
mov edi, 0x338
mov dword [ebp - 0xb78], ebx
push edi
push ebx
mov dword [ebp - 0xb88], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb8c], eax
test eax, eax
je 0x4193d0
or dword [ebp - 0xb7c], 0xffffffff
mov edx, 0xab69605e
mov dword [ebp - 0x3b8], edx
add eax, 7
mov edx, 0x7f1137f
mov dword [ebp - 0xb90], ebx
mov edi, 0x402ff2
mov dword [ebp - 0x3b4], edx
mov cl, bl
mov dword [ebp - 0xba0], eax
mov esi, ebx
mov dword [ebp - 0xb80], edi
mov edx, ebx
mov dword [ebp - 0xb98], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xb80]
xor edx, ebx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb80]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb80]
shl edi, 8
add dword [ebp - 0xb80], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov eax, esi
mov dword [ebp - 0xba8], esi
add eax, 0x54969fa2
rol dword [ebp - 0xba8], 0xa
rol eax, 5
imul eax, eax, 0x137f
add eax, dword [ebp - 0xba8]
xor edx, eax
mov dword [ebp - 0xbd0], edx
lea eax, [edx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xbd0]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xbd0]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xbd0], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xbd0]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xbd0]
xor edx, eax
mov dword [ebp - 0xbd0], edx
mov eax, dword [ebp - 0xbd0]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xbd0]
xor eax, edx
mov dword [ebp - 0xbd0], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xbd0]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xbd0]
xor eax, edx
mov dword [ebp - 0xbd0], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xbd0]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xbd0]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0xbd0], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0xbd0]
xor eax, 0xab69605e
mov dword [ebp - 0xba8], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xba8]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xba8]
xor eax, edx
mov dword [ebp - 0xba8], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0xba8], edx
mov edx, dword [ebp - 0xba8]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xba8], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xba8]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xba8]
xor eax, edx
mov dword [ebp - 0xba8], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xba8]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xba8]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xba8], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xba8]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xba8]
xor edx, dword [ebp - 0xb90]
xor eax, dword [ebp - 0xb7c]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xbd0], esi
mov esi, dword [ebp - 0xba0]
mov dword [ebp - 0xb7c], edi
mov edi, dword [ebp - 0xb80]
mov dword [ebp - 0xb90], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xb98], 1
mov dword [ebp - 0xba0], esi
mov esi, eax
mov dword [ebp - 0xba8], eax
jne 0x418981
mov esi, dword [ebp - 0xb8c]
xor ebx, ebx
mov eax, ebx
mov edi, 0x338
xor cl, byte [eax + esi]
inc eax
cmp eax, edi
jb 0x418d0d
movzx eax, cl
cdq
cmp eax, dword [0x403328]
jne 0x4193c1
cmp edx, dword [0x40332c]
jne 0x4193c1
push 0x40
push ebx
push 0x42a878
mov byte [esi + edi - 1], bl
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov edi, esi
cmp byte [esi], bl
je 0x418e9f
mov edi, 0x42a878
mov dword [ebp - 0xb8c], esi
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xb88], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x418d67
sub ecx, dword [ebp - 0xb88]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0x418e8b
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xb88], edx
cmp word [eax], cx
je 0x418daf
mov edx, 0xc000007b
mov dword [ebp - 0xb88], edx
jmp 0x418e03
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0x418da2
add ecx, dword [edi]
mov dword [ebp - 0xb90], ecx
cmp ecx, dword [edi]
jb 0x418da2
cmp dword [ecx], 0x4550
jne 0x418da2
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xc20]
je 0x418deb
cmp ax, word [ebp - 0x394]
je 0x418deb
mov edx, 0xc000000d
jmp 0x418da7
mov eax, dword [ecx + 0x78]
mov ecx, dword [ecx + 0x7c]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0xb90]
mov dword [edi + 0xc], ecx
mov eax, dword [eax + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xb90], eax
mov dword [ebp - 0xb7c], ebx
test eax, eax
je 0x418e7e
mov ecx, esi
mov dword [ebp - 0xba0], esi
lea eax, [ecx + 1]
mov dword [ebp - 0xb80], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418e2a
sub ecx, dword [ebp - 0xb80]
inc esi
add esi, ecx
test edx, edx
js 0x418e63
push dword [ebp - 0xba0]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0x418e95
mov ecx, dword [ebp - 0xb78]
mov edx, dword [ebp - 0xb88]
mov dword [ecx*4 + section..data], eax
mov eax, dword [ebp - 0xb7c]
inc dword [ebp - 0xb78]
inc eax
mov dword [ebp - 0xb7c], eax
cmp eax, dword [ebp - 0xb90]
jb 0x418e19
add edi, 0x10
cmp byte [esi], bl
jne 0x418d5a
jmp 0x418e95
mov dword [ebp - 0xb88], 0xc000007a
mov edi, dword [ebp - 0xb8c]
test edi, edi
je 0x418eae
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push edi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb88], ebx
jl 0x4193d0
mov eax, dword [0x42adcc]
inc eax
mov dword [0x42adcc], eax
xor eax, eax
mov edx, 0x42add0
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0xb78], ebx
lea edi, [ebp - 0x468]
mov dword [ebp - 0xb88], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xc78], ebx
mov dword [ebp - 0xb8c], ebx
mov dword [ebp - 0xb90], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xb7c], ebx
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x418f00
mov eax, dword [0x42adcc]
push 0
pop ebx
test eax, eax
jne 0x41951d
mov edi, 0x338
mov dword [ebp - 0xba0], ebx
push edi
push ebx
mov dword [ebp - 0xb80], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb98], eax
test eax, eax
je 0x4195f2
or dword [ebp - 0xbd0], 0xffffffff
mov edx, 0xab69605e
mov dword [ebp - 0x3c0], edx
add eax, 7
mov edx, 0x7f1137f
mov dword [ebp - 0xba8], ebx
mov edi, 0x402ff2
mov dword [ebp - 0x3bc], edx
mov cl, bl
mov dword [ebp - 0xba4], eax
mov esi, ebx
mov dword [ebp - 0xbc4], edi
mov edx, ebx
mov dword [ebp - 0xbbc], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xbc4]
xor edx, ebx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xbc4]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xbc4]
shl edi, 8
add dword [ebp - 0xbc4], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov eax, esi
mov dword [ebp - 0xbd4], esi
add eax, 0x54969fa2
rol dword [ebp - 0xbd4], 0xa
rol eax, 5
imul eax, eax, 0x137f
add eax, dword [ebp - 0xbd4]
xor edx, eax
mov dword [ebp - 0xbb0], edx
lea eax, [edx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xbb0]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xbb0]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xbb0], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xbb0]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xbb0]
xor edx, eax
mov dword [ebp - 0xbb0], edx
mov eax, dword [ebp - 0xbb0]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xbb0]
xor eax, edx
mov dword [ebp - 0xbb0], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xbb0]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xbb0]
xor eax, edx
mov dword [ebp - 0xbb0], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xbb0]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xbb0]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0xbb0], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0xbb0]
xor eax, 0xab69605e
mov dword [ebp - 0xbd4], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xbd4]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xbd4]
xor eax, edx
mov dword [ebp - 0xbd4], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0xbd4], edx
mov edx, dword [ebp - 0xbd4]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xbd4], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xbd4]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xbd4]
xor eax, edx
mov dword [ebp - 0xbd4], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xbd4]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xbd4]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xbd4], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xbd4]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xbd4]
xor edx, dword [ebp - 0xba8]
xor eax, dword [ebp - 0xbd0]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xbb0], esi
mov esi, dword [ebp - 0xba4]
mov dword [ebp - 0xbd0], edi
mov edi, dword [ebp - 0xbc4]
mov dword [ebp - 0xba8], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xbbc], 1
mov dword [ebp - 0xba4], esi
mov esi, eax
mov dword [ebp - 0xbd4], eax
jne 0x418f92
mov esi, dword [ebp - 0xb98]
xor ebx, ebx
mov eax, ebx
mov edi, 0x338
xor cl, byte [eax + esi]
inc eax
cmp eax, edi
jb 0x41931e
movzx eax, cl
cdq
cmp eax, dword [0x403328]
jne 0x4195e3
cmp edx, dword [0x40332c]
jne 0x4195e3
push 0x40
push ebx
push 0x42a878
mov byte [esi + edi - 1], bl
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov edi, esi
cmp byte [esi], bl
je 0x4194fd
mov edi, 0x42a878
mov dword [ebp - 0xb98], esi
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xb80], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x419378
sub ecx, dword [ebp - 0xb80]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0x4194e9
mov eax, dword [edi]
mov ecx, 0x5a4d
mov dword [ebp - 0xb80], ebx
cmp word [eax], cx
je 0x41940f
mov edx, 0xc000007b
mov dword [ebp - 0xb80], edx
jmp 0x419461
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, ebx
mov eax, dword [esi + 0x42a878]
test eax, eax
je 0x4193e3
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x4193d2
push 0x40
push ebx
push 0x42a878
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x4011f0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x418ec5
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0x4193b1
mov eax, dword [edi]
lea edx, [ecx + eax]
cmp edx, eax
jb 0x4193b1
cmp dword [edx], 0x4550
jne 0x4193b1
movzx eax, word [edx + 0x18]
mov ecx, 0x10b
cmp ax, cx
je 0x41944d
mov ecx, 0x20b
cmp ax, cx
je 0x41944d
mov edx, 0xc000000d
jmp 0x4193b6
mov eax, dword [edx + 0x78]
mov ecx, dword [edx + 0x7c]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
mov eax, dword [edx + 0x50]
mov edx, ebx
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0xbd0], ebx
test eax, eax
je 0x4194dc
mov ecx, esi
mov dword [ebp - 0xba4], esi
lea eax, [ecx + 1]
mov dword [ebp - 0xbc4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x419488
sub ecx, dword [ebp - 0xbc4]
inc esi
add esi, ecx
test edx, edx
js 0x4194c1
push dword [ebp - 0xba4]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0x4194f3
mov ecx, dword [ebp - 0xba0]
mov edx, dword [ebp - 0xb80]
mov dword [ecx*4 + section..data], eax
mov eax, dword [ebp - 0xbd0]
inc dword [ebp - 0xba0]
inc eax
mov dword [ebp - 0xbd0], eax
cmp eax, dword [ebp - 0xba8]
jb 0x419477
add edi, 0x10
cmp byte [esi], bl
jne 0x41936b
jmp 0x4194f3
mov dword [ebp - 0xb80], 0xc000007a
mov edi, dword [ebp - 0xb98]
test edi, edi
je 0x41950c
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push edi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb80], ebx
jl 0x4195f2
mov eax, dword [0x42adcc]
inc eax
mov dword [0x42adcc], eax
xor eax, eax
mov ecx, 0x42add0
xchg dword [ecx], eax
push 0x54
lea eax, [ebp - 0x858]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
mov esi, dword [0x42907c]
lea edi, [ebp - 0x458]
add esp, 0xc
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
pop edx
push 0x403
push ebx
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xb74]
mov ecx, eax
and ecx, edx
mov dword [ebp - 0xb74], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0xc], cx
mov ecx, eax
shr ecx, 8
and ecx, edx
shr eax, 0xc
mov word [ebp - 0xa], cx
and eax, edx
mov ecx, esi
mov word [ebp - 8], ax
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0xb80], 0xffffff
test eax, eax
jne 0x419631
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb98], edi
test edi, edi
jle 0x4195ce
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb98], edi
test edi, edi
js 0x41ac23
mov dword [ebp - 0xb98], 0x80004005
jmp 0x41ac23
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, ebx
mov eax, dword [esi + 0x42a878]
test eax, eax
je 0x419605
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x4195f4
push 0x40
push ebx
push 0x42a878
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x4011f0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x419523
mov esi, dword [0x429050]
lea eax, [ebp - 0xc54]
push eax
push ebx
lea eax, [ebp - 0xbf8]
mov dword [ebp - 0xc74], ebx
push eax
mov edi, ebx
mov dword [ebp - 0xc70], ebx
push 8
mov ecx, esi
mov dword [ebp - 0xba8], ebx
mov dword [ebp - 0xc6c], ebx
mov dword [ebp - 0xc64], ebx
mov dword [ebp - 0xc60], ebx
mov dword [ebp - 0xb98], edi
mov dword [ebp - 0xc54], ebx
call dword [0x42b5a4]
call esi
test eax, eax
jne 0x4196c1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb98], edi
test edi, edi
jle 0x4196ab
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb98], edi
test edi, edi
js 0x41980d
mov edi, 0x80004005
mov dword [ebp - 0xb98], edi
jmp 0x41980d
mov eax, dword [ebp - 0xc54]
add eax, eax
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
lea ecx, [ebp - 0xc64]
mov esi, eax
call fcn.00424e16
test esi, esi
jne 0x4196f6
mov dword [ebp - 0xc64], ebx
mov edi, 0x8007000e
jmp 0x4196b6
mov eax, dword [ebp - 0xbf8]
mov dword [ebp - 0xc64], esi
lea eax, [eax*4 + 4]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
lea ecx, [ebp - 0xc60]
mov esi, eax
call fcn.00424e16
test esi, esi
jne 0x419739
mov edi, 0x8007000e
mov dword [ebp - 0xb98], edi
jmp 0x419807
lea eax, [ebp - 0xc54]
mov dword [ebp - 0xc60], esi
mov esi, dword [0x429050]
mov ecx, esi
push eax
push dword [ebp - 0xc64]
lea eax, [ebp - 0xbf8]
push eax
push 8
call dword [0x42b5a4]
call esi
test eax, eax
je 0x419688
cmp dword [ebp - 0xbf8], 0
mov edx, dword [ebp - 0xc60]
mov eax, dword [ebp - 0xc64]
mov dword [ebp - 0xba4], edx
mov dword [ebp - 0xbc4], ebx
jbe 0x4197e8
mov edi, eax
mov esi, dword [0x429058]
mov ecx, esi
push ebx
push edi
call dword [0x42b5a4]
call esi
mov edx, dword [ebp - 0xba4]
mov ecx, edi
mov dword [edx], eax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4197af
mov eax, dword [ebp - 0xbc4]
sub ecx, esi
sar ecx, 1
add edx, 4
mov dword [ebp - 0xba4], edx
lea edi, [edi + ecx*2]
add edi, 2
inc eax
mov dword [ebp - 0xbc4], eax
cmp eax, dword [ebp - 0xbf8]
jb 0x419790
mov edi, dword [ebp - 0xb98]
mov dword [edx], 0x409
mov eax, dword [ebp - 0xc60]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xbf8]
inc eax
mov dword [ebp - 0xbd0], eax
mov dword [ebp - 0xc60], ebx
lea ecx, [ebp - 0xc60]
call fcn.00424e16
lea ecx, [ebp - 0xc64]
call fcn.00424e16
test edi, edi
js 0x419f9d
cmp dword [ebp - 0xbd0], 0
mov edi, ebx
mov dword [ebp - 0xba4], edi
mov esi, ebx
jbe 0x41986b
mov eax, dword [ebp - 0xc74]
mov edx, ebx
mov ecx, dword [eax + esi*4]
cmp ecx, dword [edx*4 + 0x402bf8]
je 0x419863
inc edx
cmp edx, 0x26
jb 0x419846
inc esi
cmp esi, dword [ebp - 0xbd0]
jb 0x419844
jmp 0x41986b
mov edi, edx
mov dword [ebp - 0xba4], edx
mov esi, dword [0x429054]
lea eax, [ebp - 0x100]
push ebx
push 0x55
push eax
push dword [edi*4 + 0x402bf8]
mov ecx, esi
mov dword [ebp - 0xbd0], ebx
call dword [0x42b5a4]
call esi
test eax, eax
je 0x4198d0
mov esi, dword [0x429048]
lea eax, [ebp - 0x498]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0x100]
mov ecx, esi
push eax
call dword [0x42b5a4]
call esi
test eax, eax
jle 0x4198d0
mov edi, dword [ebp - 0x48c]
xor eax, eax
shr edi, 0x1b
inc eax
and edi, eax
mov dword [ebp - 0xbd0], edi
mov edx, 0x402d10
mov esi, ebx
mov ecx, edx
mov dword [ebp + esi*4 - 0x390], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4198e3
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0x4198d7
imul ecx, dword [ebp - 0xba4], 3
movzx eax, byte [ecx + 0x402c90]
mov eax, dword [ebp + eax*4 - 0x390]
mov dword [ebp - 0xb8c], eax
movzx eax, byte [ecx + 0x402c91]
mov eax, dword [ebp + eax*4 - 0x390]
mov dword [ebp - 0xb90], eax
movzx eax, byte [ecx + 0x402c92]
mov eax, dword [ebp + eax*4 - 0x390]
mov dword [ebp - 0xb7c], eax
push 0x1c90
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xb98], ecx
test ecx, ecx
je 0x419deb
or dword [ebp - 0xbc4], 0xffffffff
mov edx, 0xab69605e
mov dword [ebp - 0x3c8], edx
add ecx, 7
mov edx, 0x7f1137f
mov dword [ebp - 0xba8], ebx
mov edi, 0x403332
mov dword [ebp - 0x3c4], edx
mov al, bl
mov dword [ebp - 0xbbc], ecx
mov esi, ebx
mov dword [ebp - 0xbd4], edi
mov edx, ebx
mov dword [ebp - 0xbb0], 0x392
movzx ebx, byte [edi - 2]
movzx ecx, byte [edi - 1]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [edi]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, ecx
shl edi, 8
mov ecx, dword [ebp - 0xbd4]
xor edx, ebx
mov dword [ebp - 0xbc0], edx
movzx ecx, byte [ecx + 3]
or edi, ecx
mov ecx, dword [ebp - 0xbd4]
shl edi, 8
movzx ecx, byte [ecx + 4]
or edi, ecx
mov ecx, dword [ebp - 0xbd4]
shl edi, 8
add dword [ebp - 0xbd4], 8
movzx ecx, byte [ecx + 5]
or edi, ecx
xor esi, edi
mov dword [ebp - 0xbb8], esi
mov esi, edx
xor esi, dword [ebp - 0xbb8]
xor esi, 0xac987321
lea ecx, [esi + 0x54969fa2]
rol ecx, 5
imul edx, ecx, 0x137f
mov ecx, esi
rol ecx, 0xa
add edx, ecx
mov ecx, dword [ebp - 0xbc0]
xor ecx, edx
mov dword [ebp - 0xbc0], ecx
add ecx, 0x7f1137f
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0xbc0]
rol ecx, 2
sub edx, ecx
xor esi, edx
imul edx, esi, 0x605e
mov ecx, esi
shr ecx, 0xd
sub edx, ecx
mov ecx, dword [ebp - 0xbc0]
sub edx, 0x756c8a2
xor ecx, edx
mov dword [ebp - 0xbc0], ecx
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0xbc0]
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub ecx, edx
mov edx, dword [ebp - 0xbc0]
xor edx, ecx
mov dword [ebp - 0xbc0], edx
mov ecx, dword [ebp - 0xbc0]
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
xor esi, edx
lea ecx, [esi + 0x7f1137f]
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, esi
rol ecx, 2
add edx, ecx
mov ecx, dword [ebp - 0xbc0]
xor ecx, edx
mov dword [ebp - 0xbc0], ecx
add ecx, 0x54969fa2
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0xbc0]
rol ecx, 8
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0xab69605e
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, esi
ror ecx, 0xa
xor edx, ecx
mov ecx, dword [ebp - 0xbc0]
xor ecx, edx
mov dword [ebp - 0xbc0], ecx
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0xbc0]
shr ecx, 0xa
xor edx, ecx
xor edx, esi
mov esi, dword [ebp - 0xbc0]
mov ecx, edx
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor esi, ecx
lea ecx, [esi - 0x7f1]
xor ecx, edx
xor ecx, 0xab69605e
mov dword [ebp - 0xbb8], ecx
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0xbb8]
shr ecx, 2
add edx, ecx
xor esi, edx
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, esi
rol ecx, 7
add edx, ecx
mov ecx, dword [ebp - 0xbb8]
xor ecx, edx
mov dword [ebp - 0xbb8], ecx
mov edx, ecx
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor esi, edx
mov ecx, esi
mov edx, esi
xor ecx, 0xab69
rol esi, 7
rol ecx, 5
imul ecx, ecx, 0x7f1
add ecx, esi
mov esi, dword [ebp - 0xbb8]
xor esi, ecx
mov dword [ebp - 0xbb8], esi
xor esi, edx
mov edx, dword [ebp - 0xbb8]
xor esi, 0xac987321
mov ecx, esi
ror ecx, 3
imul ecx, ecx, 0x137f
sub ecx, 0xd0dd417
xor edx, ecx
mov dword [ebp - 0xbb8], edx
lea ecx, [edx - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0xbb8]
ror ecx, 6
sub edx, ecx
xor esi, edx
lea ecx, [esi - 0x54969fa2]
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, esi
rol ecx, 0xe
add edx, ecx
mov ecx, dword [ebp - 0xbb8]
xor ecx, edx
mov dword [ebp - 0xbb8], ecx
add ecx, 0xab69605e
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0xbb8]
ror ecx, 0xe
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, esi
shr ecx, 3
xor edx, ecx
mov ecx, dword [ebp - 0xbb8]
xor ecx, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xbb8], ecx
xor ecx, edx
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0xbb8]
rol ecx, 2
xor edx, ecx
mov ecx, dword [ebp - 0xbb8]
xor edx, dword [ebp - 0xba8]
xor ecx, dword [ebp - 0xbc4]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xbc0], esi
mov esi, dword [ebp - 0xbbc]
mov dword [ebp - 0xbc4], edi
mov edi, dword [ebp - 0xbd4]
mov dword [ebp - 0xba8], ebx
mov byte [esi - 4], dl
mov byte [esi], cl
ror edx, 8
mov byte [esi - 5], dl
ror ecx, 8
mov byte [esi - 1], cl
ror edx, 8
mov byte [esi - 6], dl
ror ecx, 8
mov byte [esi - 2], cl
ror edx, 8
ror ecx, 8
mov byte [esi - 7], dl
mov byte [esi - 3], cl
add esi, 8
ror ecx, 8
ror edx, 8
sub dword [ebp - 0xbb0], 1
mov dword [ebp - 0xbbc], esi
mov esi, ecx
mov dword [ebp - 0xbb8], ecx
jne 0x4199ab
mov ecx, dword [ebp - 0xb98]
xor ebx, ebx
mov edx, ebx
mov esi, 0x1c90
xor al, byte [edx + ecx]
inc edx
cmp edx, esi
jb 0x419d4b
movzx eax, al
cdq
cmp eax, dword [0x404fc0]
jne 0x419f7d
cmp edx, dword [0x404fc4]
jne 0x419f7d
mov eax, ebx
mov dword [ebp - 0xc70], ecx
mov dword [ebp - 0xba8], esi
mov edi, ebx
mov dword [ebp - 0xb98], eax
mov esi, ebx
mov ebx, dword [ebp - 0xba4]
cmp ebx, esi
jne 0x419d98
mov dword [ebp + edi*4 - 0x320], ecx
mov edx, ecx
lea eax, [edx + 1]
mov dword [ebp - 0xbc4], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x419da3
sub edx, dword [ebp - 0xbc4]
inc ecx
add ecx, edx
inc esi
cmp esi, 0x26
jb 0x419d8d
inc edi
push 0
pop ebx
cmp edi, 6
jb 0x419d85
push 0xc
pop eax
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
lea ecx, [ebp - 0xc6c]
mov edi, eax
call fcn.00424e16
test edi, edi
jne 0x419dfb
mov dword [ebp - 0xc6c], ebx
mov edi, 0x8007000e
mov dword [ebp - 0xb98], edi
jmp 0x419f9d
xor eax, eax
mov dword [ebp - 0xc6c], edi
stosd dword es:[edi], eax
lea ecx, [ebp - 0xc]
mov esi, ebx
mov dword [ebp - 0xba4], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0xba8], eax
movzx edx, word [ecx]
mov eax, ebx
cmp dx, word [eax*2 + 0x402d04]
je 0x419e37
inc eax
cmp eax, 6
jb 0x419e22
jmp 0x419f11
mov edi, dword [ebp + eax*4 - 0x320]
mov ecx, edi
mov edx, dword [0x429060]
mov dword [ebp - 0xbc4], edx
lea eax, [ecx + 1]
mov dword [ebp - 0xbbc], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x419e55
sub ecx, dword [ebp - 0xbbc]
push ebx
push ebx
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
push ebx
push 0xfde9
call dword [0x42b5a4]
call dword [ebp - 0xbc4]
mov dword [ebp - 0xbc4], eax
test eax, eax
je 0x419f4e
lea ecx, [eax + eax]
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0xc6c]
mov dword [ecx + esi], eax
mov eax, dword [ebp - 0xc6c]
cmp dword [eax + esi], ebx
je 0x419deb
mov eax, dword [eax + esi]
mov ecx, edi
mov edx, dword [0x429060]
mov dword [ebp - 0xbd4], eax
mov dword [ebp - 0xbbc], edx
lea eax, [ecx + 1]
mov dword [ebp - 0xbb0], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x419ed5
push dword [ebp - 0xbc4]
sub ecx, dword [ebp - 0xbb0]
push dword [ebp - 0xbd4]
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
push ebx
push 0xfde9
call dword [0x42b5a4]
call dword [ebp - 0xbbc]
test eax, eax
je 0x419f4e
mov ecx, dword [ebp - 0xba4]
push 0xc
add ecx, 2
add esi, 4
pop eax
mov dword [ebp - 0xba4], ecx
cmp esi, eax
jb 0x419e1d
mov eax, dword [ebp - 0xc6c]
mov edi, dword [ebp - 0xb98]
mov dword [ebp - 0xc78], eax
mov eax, dword [ebp - 0xbd0]
mov dword [ebp - 0xc6c], ebx
mov dword [ebp - 0x858], eax
jmp 0x419f9d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb98], edi
test edi, edi
jle 0x419f71
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb98], edi
test edi, edi
js 0x419f9d
mov edi, 0x80004005
jmp 0x419df0
mov edi, 0xc004d501
mov dword [ebp - 0xb98], edi
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xba8], ebx
cmp dword [ebp - 0xc6c], 0
je 0x41a00b
push 0xc
mov esi, ebx
pop edi
mov eax, dword [ebp - 0xc6c]
cmp dword [eax + esi], ebx
je 0x419ffe
mov ecx, dword [eax + esi]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x419fbc
mov eax, dword [ebp - 0xc6c]
sub ecx, edx
sar ecx, 1
mov eax, dword [eax + esi]
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x419fe7
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x419fdf
mov eax, dword [ebp - 0xc6c]
push dword [eax + esi]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
add esi, 4
cmp esi, edi
jb 0x419fab
mov edi, dword [ebp - 0xb98]
mov eax, dword [ebp - 0xc70]
test eax, eax
je 0x41a027
mov ecx, dword [ebp - 0xba8]
test ecx, ecx
je 0x41a027
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x41a01f
lea ecx, [ebp - 0xc6c]
call fcn.00424e16
lea ecx, [ebp - 0xc70]
call fcn.00424e16
lea ecx, [ebp - 0xc74]
call fcn.00424e16
test edi, edi
js 0x41ac0c
mov eax, dword [ebp - 0xc78]
mov esi, dword [0x4290b4]
push 0xc
mov ecx, dword [eax]
mov dword [ebp - 0x850], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x84c], ecx
mov ecx, esi
mov eax, dword [eax + 8]
mov dword [ebp - 0x848], eax
pop eax
push ebx
mov dword [ebp - 0xc98], eax
lea eax, [ebp - 0xc98]
push eax
push ebx
push 0x42
mov dword [ebp - 0xc94], ebx
mov dword [ebp - 0xc90], ebx
call dword [0x42b5a4]
call esi
test eax, eax
jne 0x41a0de
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb98], edi
test edi, edi
jle 0x41a0c7
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb98], edi
test edi, edi
js 0x41a0d3
mov dword [ebp - 0xb98], 0x80004005
mov dword [ebp - 0x854], ebx
jmp 0x41ac0c
mov eax, dword [ebp - 0xc94]
xor ecx, ecx
inc ecx
and eax, ecx
mov dword [ebp - 0x854], eax
mov eax, dword [ebp - 0xb74]
push 0x2a
sub eax, ecx
pop ecx
mov dword [ebp - 0xba8], ecx
je 0x41a12b
sub eax, 1
je 0x41a11f
sub eax, 1
jne 0x41a13b
mov edi, 0xe1
mov dword [ebp - 0xb78], edi
mov dword [ebp - 0xb88], edi
jmp 0x41a13b
mov dword [ebp - 0xb78], 0xf
jmp 0x41a131
mov dword [ebp - 0xb78], ecx
mov dword [ebp - 0xb88], 0xb
mov esi, 0xdc
mov dword [ebp - 0xbd0], 0x60
push esi
lea eax, [ebp - 0x7f0]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov word [ebp - 0x7ac], si
mov esi, dword [0x429070]
lea eax, [ebp - 0x7f0]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41a1cc
mov eax, dword [ebp - 0x744]
movzx edi, word [ebp - 0x74a]
mov ecx, dword [ebp - 0x740]
push 0x60
mov dword [ebp - 0xba4], eax
mov dword [ebp - 0x460], eax
pop eax
mov dword [ebp - 0xbd0], edi
mov dword [ebp - 0x464], ebx
mov dword [ebp - 0x468], ebx
mov dword [ebp - 0xbc4], ecx
mov dword [ebp - 0x45c], ecx
cmp edi, eax
jae 0x41a1e4
mov dword [ebp - 0xbd0], eax
jmp 0x41a1e4
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0xba4], eax
xor eax, eax
inc eax
cmp dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0xb8c]
je 0x41a1fb
mov eax, dword [ebp - 0xb7c]
push 0x5c
mov dword [ebp - 0xbbc], eax
lea eax, [ebp - 0x650]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov esi, dword [0x42907c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xb98], edi
push 0x403
push ebx
push ebx
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xbd4], eax
test eax, eax
jne 0x41a26a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb98], edi
test edi, edi
jle 0x41a25f
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb98], edi
test edi, edi
js 0x41a321
jmp 0x41a797
mov esi, dword [0x42905c]
mov ecx, esi
push 0x48
push dword [ebp - 0xbd0]
push dword [ebp - 0xb78]
call dword [0x42b5a4]
call esi
push dword [ebp - 0xbbc]
neg eax
mov dword [ebp - 0x640], 0x190
push 0x20
mov dword [ebp - 0x650], eax
lea ecx, [ebp - 0x634]
pop eax
mov edx, eax
mov byte [ebp - 0x636], 5
call fcn.0040675d
mov esi, dword [0x429010]
lea eax, [ebp - 0x650]
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
jne 0x41a304
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb98], edi
test edi, edi
jle 0x41a2f5
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb98], edi
test edi, edi
js 0x41a30a
mov edi, 0x80004005
mov dword [ebp - 0xb98], edi
jmp 0x41a30a
mov dword [ebp - 0x844], eax
push dword [ebp - 0xbd4]
mov esi, dword [0x4290b0]
mov ecx, esi
push ebx
call dword [0x42b5a4]
call esi
test edi, edi
js 0x41ac0c
xor eax, eax
inc eax
cmp dword [ebp - 0xb74], eax
je 0x41a340
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xb8c], eax
push 0x5c
lea eax, [ebp - 0x6b0]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov esi, dword [0x42907c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xb98], edi
push 0x403
push ebx
push ebx
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xb78], eax
test eax, eax
jne 0x41a3a9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb98], edi
test edi, edi
jle 0x41a39e
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb98], edi
test edi, edi
js 0x41a460
jmp 0x41a797
mov esi, dword [0x42905c]
mov ecx, esi
push 0x48
push dword [ebp - 0xbd0]
push dword [ebp - 0xb88]
call dword [0x42b5a4]
call esi
push dword [ebp - 0xb8c]
neg eax
mov dword [ebp - 0x6a0], 0x190
push 0x20
mov dword [ebp - 0x6b0], eax
lea ecx, [ebp - 0x694]
pop eax
mov edx, eax
mov byte [ebp - 0x696], 5
call fcn.0040675d
mov esi, dword [0x429010]
lea eax, [ebp - 0x6b0]
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
jne 0x41a443
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb98], edi
test edi, edi
jle 0x41a434
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb98], edi
test edi, edi
js 0x41a449
mov edi, 0x80004005
mov dword [ebp - 0xb98], edi
jmp 0x41a449
mov dword [ebp - 0x840], eax
push dword [ebp - 0xb78]
mov esi, dword [0x4290b0]
mov ecx, esi
push ebx
call dword [0x42b5a4]
call esi
test edi, edi
js 0x41ac0c
mov esi, dword [ebp - 0xb74]
mov eax, ebx
mov ecx, esi
mov edx, ebx
sub ecx, 1
je 0x41a483
sub ecx, 1
je 0x41a4c6
sub ecx, 1
jne 0x41a48f
mov eax, dword [ebp - 0xba4]
mov edx, dword [ebp - 0xbc4]
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x44c], edx
mov ecx, esi
sub ecx, 1
je 0x41a4e9
sub ecx, 1
je 0x41a4d9
sub ecx, 1
je 0x41a4d9
mov ecx, dword [ebp - 0xbf8]
mov edx, dword [ebp - 0xb88]
mov dword [ebp - 0xba8], ecx
mov ecx, dword [ebp - 0xb78]
jmp 0x41a506
mov eax, dword [ebp - 0xba4]
cdq
and edx, 3
add eax, edx
mov edx, ebx
sar eax, 2
jmp 0x41a48f
mov ecx, ebx
mov dword [ebp - 0xba8], ebx
mov dword [ebp - 0xb8c], ebx
jmp 0x41a4f8
mov ecx, 0x96
mov dword [ebp - 0xb8c], 0x20
mov edx, ebx
mov dword [ebp - 0xb78], ecx
mov dword [ebp - 0xb88], edx
push dword [ebp - 0x844]
mov esi, dword [0x42903c]
sub eax, ecx
push dword [ebp - 0xba0]
mov edi, dword [ebp - 0x850]
sub eax, edx
mov ecx, esi
mov dword [ebp - 0xb7c], eax
mov dword [ebp - 0x81c], eax
mov dword [ebp - 0x82c], eax
mov dword [ebp - 0xb98], ebx
call dword [0x42b5a4]
call esi
mov esi, dword [0x42906c]
mov ecx, esi
push ebx
push 0xc50
mov dword [ebp - 0xba4], eax
lea eax, [ebp - 0x834]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xba0]
call dword [0x42b5a4]
call esi
test eax, eax
jne 0x41a581
mov edi, 0x80004005
mov dword [ebp - 0xb98], edi
jmp 0x41a583
mov edi, ebx
mov eax, dword [ebp - 0xba4]
test eax, eax
je 0x41a5a4
mov esi, dword [0x42903c]
mov ecx, esi
push eax
push dword [ebp - 0xba0]
call dword [0x42b5a4]
call esi
test edi, edi
js 0x41ac0c
push dword [ebp - 0x840]
mov esi, dword [0x42903c]
mov ecx, esi
push dword [ebp - 0xba0]
mov edi, dword [ebp - 0x84c]
mov dword [ebp - 0xb98], ebx
call dword [0x42b5a4]
call esi
mov esi, dword [0x42906c]
mov ecx, esi
push ebx
push 0xc50
mov dword [ebp - 0xba4], eax
lea eax, [ebp - 0x824]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xba0]
call dword [0x42b5a4]
call esi
test eax, eax
jne 0x41a611
mov edi, 0x80004005
mov dword [ebp - 0xb98], edi
jmp 0x41a613
mov edi, ebx
mov eax, dword [ebp - 0xba4]
test eax, eax
je 0x41a634
mov esi, dword [0x42903c]
mov ecx, esi
push eax
push dword [ebp - 0xba0]
call dword [0x42b5a4]
call esi
test edi, edi
js 0x41ac0c
mov eax, dword [ebp - 0xb74]
cmp eax, 2
je 0x41a64c
cmp eax, 3
jne 0x41a66e
mov edi, dword [ebp - 0x81c]
mov dword [ebp - 0xb7c], edi
cmp dword [ebp - 0x82c], edi
jle 0x41a674
mov edi, dword [ebp - 0x82c]
mov dword [ebp - 0xb7c], edi
jmp 0x41a674
mov edi, dword [ebp - 0xb7c]
cmp dword [ebp - 0x858], 0
mov esi, dword [0x4290a8]
mov ecx, esi
push dword [ebp - 0xba8]
je 0x41a6c7
mov eax, edi
sub eax, dword [ebp - 0x82c]
add eax, dword [ebp - 0xb88]
push eax
lea eax, [ebp - 0x834]
push eax
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0x828]
add eax, dword [ebp - 0xb8c]
push eax
mov eax, edi
sub eax, dword [ebp - 0x81c]
add eax, dword [ebp - 0xb88]
push eax
jmp 0x41a6ef
push dword [ebp - 0xb78]
lea eax, [ebp - 0x834]
push eax
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0x828]
add eax, dword [ebp - 0xb8c]
push eax
push dword [ebp - 0xb78]
mov esi, dword [0x4290a8]
lea eax, [ebp - 0x824]
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0xb74]
cmp eax, 2
je 0x41aa07
cmp eax, 3
je 0x41aa07
xor edx, edx
inc edx
cmp eax, edx
jne 0x41aa26
push 0x5c
lea eax, [ebp - 0x710]
mov dword [ebp - 0x838], 0xffffff
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov esi, dword [0x42907c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xb98], edi
push 0x403
push ebx
push ebx
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xb78], eax
test eax, eax
jne 0x41a7a6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb98], edi
test edi, edi
jle 0x41a791
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb98], edi
test edi, edi
js 0x41a859
mov dword [ebp - 0xb98], 0x80004005
jmp 0x41ac0c
mov esi, dword [0x42905c]
mov ecx, esi
push 0x48
push dword [ebp - 0xbd0]
push 0xb
call dword [0x42b5a4]
call esi
push dword [ebp - 0xb90]
neg eax
mov dword [ebp - 0x700], 0x190
push 0x20
mov dword [ebp - 0x710], eax
lea ecx, [ebp - 0x6f4]
pop eax
mov edx, eax
mov byte [ebp - 0x6f6], 5
call fcn.0040675d
mov esi, dword [0x429010]
lea eax, [ebp - 0x710]
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
jne 0x41a83c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb98], edi
test edi, edi
jle 0x41a82d
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb98], edi
test edi, edi
js 0x41a842
mov edi, 0x80004005
mov dword [ebp - 0xb98], edi
jmp 0x41a842
mov dword [ebp - 0x83c], eax
push dword [ebp - 0xb78]
mov esi, dword [0x4290b0]
mov ecx, esi
push ebx
call dword [0x42b5a4]
call esi
test edi, edi
js 0x41ac0c
push dword [ebp - 0x83c]
mov eax, dword [ebp - 0xb7c]
mov esi, dword [0x42903c]
mov ecx, esi
push dword [ebp - 0xba0]
mov edi, dword [ebp - 0x848]
mov dword [ebp - 0x80c], eax
mov dword [ebp - 0xb98], ebx
call dword [0x42b5a4]
call esi
mov esi, dword [0x42906c]
mov ecx, esi
push ebx
push 0x460
mov dword [ebp - 0xb78], eax
lea eax, [ebp - 0x814]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xba0]
call dword [0x42b5a4]
call esi
test eax, eax
jne 0x41a8d2
mov edi, 0x80004005
mov dword [ebp - 0xb98], edi
jmp 0x41a8d4
mov edi, ebx
mov eax, dword [ebp - 0xb78]
test eax, eax
je 0x41a8f5
mov esi, dword [0x42903c]
mov ecx, esi
push eax
push dword [ebp - 0xba0]
call dword [0x42b5a4]
call esi
test edi, edi
js 0x41ac0c
mov eax, dword [ebp - 0x80c]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x80c], eax
cmp eax, ecx
jge 0x41a919
mov dword [ebp - 0x80c], ecx
mov edi, dword [ebp - 0xbd0]
mov esi, dword [0x42905c]
mov ecx, esi
push 0x20
pop eax
push 0x60
push edi
push dword [ebp - 0x814]
mov dword [ebp - 0x808], eax
call dword [0x42b5a4]
call esi
mov esi, dword [0x42905c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x810]
mov dword [ebp - 0x814], eax
call dword [0x42b5a4]
call esi
mov esi, dword [0x42905c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x80c]
mov dword [ebp - 0x810], eax
call dword [0x42b5a4]
call esi
mov esi, dword [0x42905c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x808]
mov dword [ebp - 0x80c], eax
call dword [0x42b5a4]
call esi
mov ecx, dword [ebp - 0x818]
mov esi, dword [0x4290a8]
add ecx, 0x24
cmp dword [ebp - 0x858], 0
mov dword [ebp - 0x808], eax
je 0x41a9e5
mov eax, dword [ebp - 0x834]
cmp eax, dword [ebp - 0x824]
jl 0x41a9d0
mov eax, dword [ebp - 0x824]
push ecx
push eax
lea eax, [ebp - 0x814]
mov ecx, esi
push eax
call dword [0x42b5a4]
call esi
jmp 0x41aa23
mov eax, dword [ebp - 0x82c]
cmp eax, dword [ebp - 0x81c]
jg 0x41a9f9
mov eax, dword [ebp - 0x81c]
sub eax, dword [ebp - 0x80c]
add eax, dword [ebp - 0x814]
jmp 0x41a9d0
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x450], edi
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x838], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0xb78], eax
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0xb88], eax
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0xb74]
sub eax, 1
je 0x41abfa
sub eax, 1
je 0x41ab21
sub eax, 1
jne 0x41ac06
mov esi, dword [0x4290a4]
lea edi, [ebp - 0x4e8]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0x42b5a4]
call esi
mov esi, dword [0x429084]
lea ecx, [ebp - 0x4e8]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x4e8], 0x28
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41ac06
mov esi, dword [0x4290a0]
lea eax, [ebp - 0x4d4]
push eax
push ebx
mov ecx, esi
call dword [0x42b5a4]
call esi
mov esi, dword [0x4290a0]
lea eax, [ebp - 0x4cc]
push eax
push ebx
mov ecx, esi
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0x4cc]
lea esi, [ebp - 0x4d4]
sub eax, dword [ebp - 0xb8c]
lea edi, [ebp - 0x418]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x4c8]
sub eax, dword [ebp - 0xb88]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
jmp 0x41abef
mov esi, dword [0x4290a4]
lea edi, [ebp - 0x4c0]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0x42b5a4]
call esi
mov esi, dword [0x429084]
lea ecx, [ebp - 0x4c0]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x4c0], 0x28
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41ac06
mov esi, dword [0x4290a0]
lea eax, [ebp - 0x4ac]
push eax
push ebx
mov ecx, esi
call dword [0x42b5a4]
call esi
mov esi, dword [0x4290a0]
lea eax, [ebp - 0x4a4]
push eax
push ebx
mov ecx, esi
call dword [0x42b5a4]
call esi
cmp dword [ebp - 0xb78], 0
lea esi, [ebp - 0x4ac]
lea edi, [ebp - 0x418]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x41abc8
imul eax, dword [ebp - 0x4a4], 5
cdq
idiv ecx
add eax, dword [ebp - 0x4ac]
jmp 0x41abda
mov eax, dword [ebp - 0x4a4]
sub eax, dword [ebp - 0xb8c]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x4a0]
sub eax, dword [ebp - 0xb88]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x454], eax
jmp 0x41ac06
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0xb98], ebx
push dword [ebp - 0xba0]
mov esi, dword [0x4290b0]
mov ecx, esi
push ebx
call dword [0x42b5a4]
call esi
xor ebx, ebx
mov edi, 0x42add0
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x41ac2a
mov eax, dword [0x42adcc]
push 0
pop ebx
test eax, eax
jle 0x41ac8c
sub eax, 1
mov dword [0x42adcc], eax
jne 0x41ac8c
mov esi, ebx
mov eax, dword [esi + 0x42a878]
test eax, eax
je 0x41ac60
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x41ac4f
push 0x40
push ebx
push 0x42a878
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x4011f0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x42add0
xor eax, eax
xchg dword [edi], eax
lea ecx, [ebp - 0xc78]
call fcn.00424e16
mov eax, dword [ebp - 0xb98]
test eax, eax
js 0x41c829
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0xb78], eax
mov eax, dword [ebp - 0x454]
push 0x54
mov dword [ebp - 0xb88], eax
lea eax, [ebp - 0x8b0]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov esi, dword [0x429028]
add esp, 0xc
xor eax, eax
mov ecx, esi
push 7
push dword [ebp - 0xbac]
lea edi, [eax + 1]
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41ad41
mov esi, dword [0x429034]
lea ecx, [ebp - 0x8b0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41ad41
push 0x20
pop eax
cmp word [ebp - 0x89e], ax
jne 0x41ad39
cmp dword [ebp - 0x89c], 0
je 0x41ad39
cmp dword [ebp - 0x8ac], 0
jle 0x41ad39
cmp dword [ebp - 0x8a8], 0
jg 0x41ad3b
mov edi, ebx
test edi, edi
jne 0x41ad4e
jmp 0x41ad43
mov edi, ebx
xor esi, esi
inc esi
cmp dword [ebp - 0xb74], esi
jne 0x41adca
push dword [ebp - 0xb88]
mov esi, dword [0x4290a8]
lea eax, [ebp - 0x834]
push dword [ebp - 0xb78]
mov ecx, esi
push eax
call dword [0x42b5a4]
call esi
push dword [ebp - 0xb88]
mov esi, dword [0x4290a8]
lea eax, [ebp - 0x824]
push dword [ebp - 0xb78]
mov ecx, esi
push eax
call dword [0x42b5a4]
call esi
xor esi, esi
inc esi
cmp dword [ebp - 0xb74], esi
jne 0x41adca
mov eax, dword [ebp - 0x854]
mov esi, dword [0x429014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xb94], eax
mov esi, dword [0x429040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xbac]
call dword [0x42b5a4]
call esi
cmp dword [ebp - 0x858], 0
mov dword [ebp - 0xb78], eax
mov dword [ebp - 0xb88], 0x810
je 0x41ae07
mov dword [ebp - 0xb88], 0x20812
test edi, edi
je 0x41b8f6
mov eax, dword [ebp - 0x854]
mov esi, dword [ebp - 0x850]
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0x844]
push 0x54
mov dword [ebp - 0xb90], eax
lea eax, [ebp - 0x908]
push ebx
push eax
mov dword [ebp - 0xb7c], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0x960]
push 0x54
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0xba0], ebx
lea eax, [ebp - 0x540]
mov dword [ebp - 0xb98], ebx
mov dword [ebp - 0xba8], ebx
mov dword [ebp - 0xbd0], ebx
push 0x2c
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
lea edi, [ebp - 0x408]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x41c809
mov esi, dword [0x429028]
mov ecx, esi
mov edi, dword [ebp - 0xbac]
push 7
push edi
call dword [0x42b5a4]
call esi
test eax, eax
jne 0x41aebd
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x41c809
mov esi, dword [0x429034]
lea ecx, [ebp - 0x908]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41aeff
mov eax, dword [ebp - 0x8f4]
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0xba8], eax
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0xbd0], eax
mov esi, dword [0x429008]
mov ecx, esi
push edi
call dword [0x42b5a4]
call esi
mov edi, eax
mov dword [ebp - 0xba4], edi
test edi, edi
je 0x41aeb2
mov eax, dword [ebp - 0x82c]
sub eax, dword [ebp - 0x834]
mov esi, dword [0x42900c]
mov ecx, esi
mov dword [ebp - 0x53c], eax
mov eax, dword [ebp - 0x830]
sub eax, dword [ebp - 0x828]
mov dword [ebp - 0x538], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc50], ebx
mov word [ebp - 0x534], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x532], ax
lea eax, [ebp - 0xc50]
push eax
push ebx
lea eax, [ebp - 0x540]
mov dword [ebp - 0x530], ebx
push eax
push edi
mov dword [ebp - 0x52c], ebx
mov dword [ebp - 0x528], ebx
mov dword [ebp - 0x524], ebx
mov dword [ebp - 0x520], ebx
mov dword [ebp - 0x51c], ebx
mov dword [ebp - 0x518], ebx
mov dword [ebp - 0x540], 0x28
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xbc4], eax
test eax, eax
jne 0x41afe1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x41afd1
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x41b362
mov edi, 0x80004005
jmp 0x41b362
mov esi, dword [0x429034]
lea ecx, [ebp - 0x960]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41b00b
mov eax, dword [ebp - 0x94c]
mov dword [ebp - 0xb98], eax
mov eax, dword [ebp - 0x82c]
sub eax, dword [ebp - 0x834]
push dword [ebp - 0xbc4]
mov esi, dword [0x42903c]
mov ecx, esi
mov dword [ebp - 0x400], eax
mov eax, dword [ebp - 0x828]
sub eax, dword [ebp - 0x830]
push edi
mov dword [ebp - 0x3fc], eax
call dword [0x42b5a4]
call esi
mov esi, dword [0x429040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0x42b5a4]
call esi
push dword [ebp - 0xb90]
mov esi, dword [0x42903c]
mov ecx, esi
push edi
call dword [0x42b5a4]
call esi
mov esi, dword [0x429038]
mov ecx, esi
mov edi, dword [0x429074]
push ebx
mov dword [ebp - 0xb90], eax
call dword [0x42b5a4]
call esi
mov esi, dword [ebp - 0xba4]
mov ecx, edi
push eax
lea eax, [ebp - 0x408]
push eax
push esi
call dword [0x42b5a4]
call edi
push ebx
push dword [ebp - 0xb88]
lea eax, [ebp - 0x408]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb7c]
push esi
mov esi, dword [0x42906c]
mov ecx, esi
call dword [0x42b5a4]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xb74], eax
jne 0x41b109
cmp dword [ebp - 0xb8c], 0
je 0x41b0fd
mov esi, dword [0x42908c]
mov ecx, esi
push 8
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xb8c], eax
jmp 0x41b113
mov dword [ebp - 0xb8c], 0xffffff
jmp 0x41b113
mov dword [ebp - 0xb8c], 0xffa8a8a8
mov edi, dword [ebp - 0x834]
mov edx, ebx
mov eax, dword [ebp - 0x830]
mov ecx, ebx
mov dword [ebp - 0xb7c], edi
mov dword [ebp - 0xbbc], ebx
test edi, edi
jns 0x41b145
mov edx, edi
mov dword [ebp - 0xb7c], ebx
neg edx
mov edi, ebx
mov dword [ebp - 0xbbc], edx
test eax, eax
jns 0x41b14f
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [ebp - 0x400]
mov dword [ebp - 0xbd4], esi
sub esi, edx
mov edx, dword [ebp - 0xba8]
sub edx, edi
mov dword [ebp - 0xbb0], esi
cmp esi, edx
jl 0x41b177
mov esi, edx
mov dword [ebp - 0xbb0], edx
mov edx, dword [ebp - 0x3fc]
mov edi, dword [ebp - 0xbd0]
sub edx, ecx
sub edi, eax
mov dword [ebp - 0xbc0], edx
cmp edx, edi
jl 0x41b199
mov edx, edi
mov dword [ebp - 0xbc0], edi
mov edi, ebx
test esi, esi
jle 0x41b32b
test edx, edx
jle 0x41b32b
imul ecx, dword [ebp - 0xbd4]
mov edx, dword [ebp - 0xb98]
imul eax, dword [ebp - 0xba8]
add ecx, dword [ebp - 0xbbc]
add eax, dword [ebp - 0xb7c]
lea ecx, [edx + ecx*4]
mov edx, dword [ebp - 0xba0]
mov dword [ebp - 0xb98], ecx
mov dword [ebp - 0xba0], ebx
lea eax, [edx + eax*4]
mov dword [ebp - 0xb7c], eax
mov ebx, eax
mov dword [ebp - 0xbcc], esi
lea edi, [eax + 3]
sub ebx, ecx
lea edx, [ecx + 2]
mov dword [ebp - 0xbd0], edi
mov dword [ebp - 0xbbc], edx
mov dword [ebp - 0xbb8], ebx
jmp 0x41b213
mov edi, dword [ebp - 0xbd0]
movzx eax, byte [edx - 2]
movzx ecx, byte [edx - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edx]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x41b2c1
mov bl, byte [ebx + edx]
mov eax, dword [ebp - 0xb8c]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbbc]
mov edx, dword [ebp - 0xbb8]
add al, bl
mov ebx, dword [ebp - 0xbb8]
mov byte [edx + ecx], al
movzx ecx, byte [edi - 2]
mov eax, dword [ebp - 0xb8c]
movzx eax, ah
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 2], al
movzx ecx, byte [edi - 3]
movzx eax, byte [ebp - 0xb8a]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 3], al
mov eax, 0xff
movzx ecx, byte [edi]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xbcc]
cdq
idiv ecx
mov edx, dword [ebp - 0xbbc]
add byte [edi], al
add dword [ebp - 0xbd0], 4
add edx, 4
mov edi, dword [ebp - 0xba0]
sub esi, 1
mov dword [ebp - 0xbbc], edx
mov dword [ebp - 0xbcc], esi
jne 0x41b20d
sub dword [ebp - 0xbc0], 1
mov ecx, dword [ebp - 0xb98]
mov eax, dword [ebp - 0xbd4]
mov edx, dword [ebp - 0xba8]
mov esi, dword [ebp - 0xbb0]
mov dword [ebp - 0xba0], edi
lea ecx, [ecx + eax*4]
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xb98], ecx
lea eax, [eax + edx*4]
mov dword [ebp - 0xb7c], eax
jne 0x41b1e9
xor ebx, ebx
push dword [ebp - 0xbc4]
mov esi, dword [0x42901c]
mov ecx, esi
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0xb90]
test eax, eax
je 0x41b362
mov esi, dword [0x42903c]
mov ecx, esi
push eax
push dword [ebp - 0xba4]
call dword [0x42b5a4]
call esi
push dword [ebp - 0xba4]
mov esi, dword [0x429018]
mov ecx, esi
call dword [0x42b5a4]
call esi
test edi, edi
js 0x41c809
mov eax, dword [ebp - 0x854]
mov esi, dword [ebp - 0x84c]
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0x840]
push 0x54
mov dword [ebp - 0xb90], eax
lea eax, [ebp - 0xb70]
push ebx
push eax
mov dword [ebp - 0xb7c], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0x9b8]
push 0x54
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0xba0], ebx
lea eax, [ebp - 0x514]
mov dword [ebp - 0xb98], ebx
mov dword [ebp - 0xba8], ebx
mov dword [ebp - 0xbd0], ebx
push 0x2c
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
lea edi, [ebp - 0x3f8]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x41c809
mov esi, dword [0x429028]
mov ecx, esi
mov edi, dword [ebp - 0xbac]
push 7
push edi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41aeb2
mov esi, dword [0x429034]
lea ecx, [ebp - 0xb70]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41b469
mov eax, dword [ebp - 0xb5c]
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0xb6c]
mov dword [ebp - 0xba8], eax
mov eax, dword [ebp - 0xb68]
mov dword [ebp - 0xbd0], eax
mov esi, dword [0x429008]
mov ecx, esi
push edi
call dword [0x42b5a4]
call esi
mov edi, eax
mov dword [ebp - 0xba4], edi
test edi, edi
je 0x41aeb2
mov eax, dword [ebp - 0x81c]
sub eax, dword [ebp - 0x824]
mov esi, dword [0x42900c]
mov ecx, esi
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x820]
sub eax, dword [ebp - 0x818]
mov dword [ebp - 0x50c], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc68], ebx
mov word [ebp - 0x508], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x506], ax
lea eax, [ebp - 0xc68]
push eax
push ebx
lea eax, [ebp - 0x514]
mov dword [ebp - 0x504], ebx
push eax
push edi
mov dword [ebp - 0x500], ebx
mov dword [ebp - 0x4fc], ebx
mov dword [ebp - 0x4f8], ebx
mov dword [ebp - 0x4f4], ebx
mov dword [ebp - 0x4f0], ebx
mov dword [ebp - 0x4ec], ebx
mov dword [ebp - 0x514], 0x28
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xbc4], eax
test eax, eax
jne 0x41b54f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x41b53f
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x41b8d1
mov edi, 0x80004005
jmp 0x41b8d1
mov esi, dword [0x429034]
lea ecx, [ebp - 0x9b8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41b579
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0xb98], eax
mov eax, dword [ebp - 0x81c]
sub eax, dword [ebp - 0x824]
push dword [ebp - 0xbc4]
mov esi, dword [0x42903c]
mov ecx, esi
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp - 0x818]
sub eax, dword [ebp - 0x820]
push edi
mov dword [ebp - 0x3ec], eax
call dword [0x42b5a4]
call esi
mov esi, dword [0x429040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0x42b5a4]
call esi
push dword [ebp - 0xb90]
mov esi, dword [0x42903c]
mov ecx, esi
push edi
call dword [0x42b5a4]
call esi
mov esi, dword [0x429038]
mov ecx, esi
mov edi, dword [0x429074]
push ebx
mov dword [ebp - 0xb90], eax
call dword [0x42b5a4]
call esi
mov esi, dword [ebp - 0xba4]
mov ecx, edi
push eax
lea eax, [ebp - 0x3f8]
push eax
push esi
call dword [0x42b5a4]
call edi
push ebx
push dword [ebp - 0xb88]
lea eax, [ebp - 0x3f8]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb7c]
push esi
mov esi, dword [0x42906c]
mov ecx, esi
call dword [0x42b5a4]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xb74], eax
jne 0x41b671
cmp dword [ebp - 0xb8c], 0
je 0x41b665
mov esi, dword [0x42908c]
mov ecx, esi
push 8
call dword [0x42b5a4]
call esi
jmp 0x41b676
mov dword [ebp - 0xb74], 0xffffff
jmp 0x41b682
mov eax, 0xffa8a8a8
mov dword [ebp - 0xb74], eax
mov dword [ebp - 0xb80], eax
mov edi, dword [ebp - 0x824]
mov edx, ebx
mov eax, dword [ebp - 0x820]
mov ecx, ebx
mov dword [ebp - 0xb88], edi
mov dword [ebp - 0xb8c], ebx
test edi, edi
jns 0x41b6b4
mov edx, edi
mov dword [ebp - 0xb88], ebx
neg edx
mov edi, ebx
mov dword [ebp - 0xb8c], edx
test eax, eax
jns 0x41b6be
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [ebp - 0x3f0]
mov dword [ebp - 0xb7c], esi
sub esi, edx
mov edx, dword [ebp - 0xba8]
sub edx, edi
mov dword [ebp - 0xbbc], esi
cmp esi, edx
jl 0x41b6e6
mov esi, edx
mov dword [ebp - 0xbbc], edx
mov edx, dword [ebp - 0x3ec]
mov edi, dword [ebp - 0xbd0]
sub edx, ecx
sub edi, eax
mov dword [ebp - 0xbd4], edx
cmp edx, edi
jl 0x41b708
mov edx, edi
mov dword [ebp - 0xbd4], edi
mov edi, ebx
test esi, esi
jle 0x41b89a
test edx, edx
jle 0x41b89a
imul ecx, dword [ebp - 0xb7c]
mov edx, dword [ebp - 0xb98]
imul eax, dword [ebp - 0xba8]
add ecx, dword [ebp - 0xb8c]
add eax, dword [ebp - 0xb88]
lea ecx, [edx + ecx*4]
mov edx, dword [ebp - 0xba0]
mov dword [ebp - 0xb8c], ecx
mov dword [ebp - 0xba0], ebx
lea eax, [edx + eax*4]
mov dword [ebp - 0xb88], eax
mov ebx, eax
mov dword [ebp - 0xbc0], esi
lea edi, [eax + 3]
sub ebx, ecx
lea edx, [ecx + 2]
mov dword [ebp - 0xb98], edi
mov dword [ebp - 0xbd0], edx
mov dword [ebp - 0xbb0], ebx
jmp 0x41b782
mov edi, dword [ebp - 0xb98]
movzx eax, byte [edx - 2]
movzx ecx, byte [edx - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edx]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x41b830
mov bl, byte [ebx + edx]
mov eax, dword [ebp - 0xb80]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbd0]
mov edx, dword [ebp - 0xbb0]
add al, bl
mov ebx, dword [ebp - 0xbb0]
mov byte [edx + ecx], al
movzx ecx, byte [edi - 2]
mov eax, dword [ebp - 0xb80]
movzx eax, ah
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 2], al
movzx ecx, byte [edi - 3]
movzx eax, byte [ebp - 0xb72]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 3], al
mov eax, 0xff
movzx ecx, byte [edi]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xbc0]
cdq
idiv ecx
mov edx, dword [ebp - 0xbd0]
add byte [edi], al
add dword [ebp - 0xb98], 4
add edx, 4
mov edi, dword [ebp - 0xba0]
sub esi, 1
mov dword [ebp - 0xbd0], edx
mov dword [ebp - 0xbc0], esi
jne 0x41b77c
sub dword [ebp - 0xbd4], 1
mov ecx, dword [ebp - 0xb8c]
mov eax, dword [ebp - 0xb7c]
mov edx, dword [ebp - 0xba8]
mov esi, dword [ebp - 0xbbc]
mov dword [ebp - 0xba0], edi
lea ecx, [ecx + eax*4]
mov eax, dword [ebp - 0xb88]
mov dword [ebp - 0xb8c], ecx
lea eax, [eax + edx*4]
mov dword [ebp - 0xb88], eax
jne 0x41b758
xor ebx, ebx
push dword [ebp - 0xbc4]
mov esi, dword [0x42901c]
mov ecx, esi
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0xb90]
test eax, eax
je 0x41b8d1
mov esi, dword [0x42903c]
mov ecx, esi
push eax
push dword [ebp - 0xba4]
call dword [0x42b5a4]
call esi
push dword [ebp - 0xba4]
mov esi, dword [0x429018]
mov ecx, esi
call dword [0x42b5a4]
call esi
test edi, edi
js 0x41c809
mov edi, ebx
jmp 0x41c7a3
mov edi, dword [ebp - 0xb74]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x854], 0
jne 0x41b910
cmp edi, ecx
je 0x41b910
mov al, 0xc0
jmp 0x41b912
or al, 0xff
mov esi, dword [0x429008]
push dword [ebp - 0xbac]
mov byte [ebp - 0xb8a], al
mov eax, ebx
mov byte [ebp - 0xb89], cl
mov ecx, esi
mov byte [ebp - 0xb8c], bl
mov byte [ebp - 0xb8b], bl
mov dword [ebp - 0xb90], eax
mov dword [ebp - 0x3e8], eax
mov dword [ebp - 0xb7c], ebx
mov dword [ebp - 0x3e4], eax
mov dword [ebp - 0x3e0], ebx
mov dword [ebp - 0x3dc], ebx
mov dword [ebp - 0xba0], ebx
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x474], ebx
mov dword [ebp - 0x470], ebx
mov dword [ebp - 0x46c], ebx
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xb98], eax
test eax, eax
jne 0x41b999
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x41c809
xor eax, eax
inc eax
cmp edi, eax
jne 0x41ba9a
mov edi, dword [ebp - 0x82c]
mov eax, edi
mov edx, dword [ebp - 0x81c]
mov ecx, edx
sub ecx, dword [ebp - 0x824]
sub eax, dword [ebp - 0x834]
mov dword [ebp - 0xba8], ecx
cmp ecx, eax
jg 0x41b9d0
mov dword [ebp - 0xba8], eax
mov eax, dword [ebp - 0x818]
mov ecx, ebx
sub eax, dword [ebp - 0x830]
mov esi, ebx
cmp dword [ebp - 0x858], 0
mov dword [ebp - 0xbd0], eax
je 0x41ba25
mov ecx, dword [ebp - 0x834]
mov eax, dword [ebp - 0x824]
sub ecx, edi
add ecx, dword [ebp - 0xba8]
sub eax, edx
add eax, dword [ebp - 0xba8]
mov dword [ebp - 0xb90], ecx
mov esi, eax
mov dword [ebp - 0x3e8], ecx
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0x478], eax
sub edi, dword [ebp - 0x834]
sub edx, dword [ebp - 0x824]
add edi, ecx
mov eax, dword [ebp - 0x828]
add edx, esi
sub eax, dword [ebp - 0x830]
mov dword [ebp - 0xba4], edi
mov dword [ebp - 0x3e0], edi
mov edi, dword [ebp - 0x820]
sub edi, dword [ebp - 0x830]
mov dword [ebp - 0xbd4], edi
mov dword [ebp - 0x474], edi
sub edi, dword [ebp - 0x820]
add edi, dword [ebp - 0x818]
mov dword [ebp - 0xbc4], eax
mov dword [ebp - 0x3dc], eax
mov dword [ebp - 0xbbc], edx
mov dword [ebp - 0x470], edx
mov dword [ebp - 0xbb0], edi
mov dword [ebp - 0x46c], edi
jmp 0x41bb32
mov eax, dword [ebp - 0x450]
lea esi, [ebp - 0x834]
lea edi, [ebp - 0x3e8]
mov dword [ebp - 0xba8], eax
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0xbd0], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x3dc]
lea esi, [ebp - 0x824]
lea edi, [ebp - 0x478]
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 0x3e0]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0xb7c], eax
mov eax, dword [ebp - 0x3e8]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xb90], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0xbbc], eax
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0xbd4], eax
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0xbd0]
mov esi, dword [0x42900c]
neg eax
mov edi, dword [ebp - 0xba8]
mov ecx, esi
mov dword [ebp - 0x5e8], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc48], ebx
mov word [ebp - 0x5e4], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x5e2], ax
lea eax, [ebp - 0xc48]
push eax
push ebx
lea eax, [ebp - 0x5f0]
mov dword [ebp - 0x5e0], ebx
push eax
push dword [ebp - 0xb98]
mov dword [ebp - 0x5dc], ebx
mov dword [ebp - 0x5d8], ebx
mov dword [ebp - 0x5d4], ebx
mov dword [ebp - 0x5d0], ebx
mov dword [ebp - 0x5cc], ebx
mov dword [ebp - 0x5c8], ebx
mov dword [ebp - 0x5f0], 0x28
mov dword [ebp - 0x5ec], edi
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xb84], eax
test eax, eax
jne 0x41bbdc
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, dword [ebp - 0xb98]
jmp 0x41c7f8
mov esi, dword [0x42903c]
mov ecx, esi
push eax
push dword [ebp - 0xb98]
call dword [0x42b5a4]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xb74], eax
jne 0x41bc44
mov ecx, dword [ebp - 0xb94]
test ecx, ecx
je 0x41bc44
mov eax, dword [ebp - 0xbd0]
mov esi, dword [0x429074]
push ecx
mov dword [ebp - 0x42c], eax
mov ecx, esi
lea eax, [ebp - 0x438]
mov dword [ebp - 0x438], ebx
push eax
push dword [ebp - 0xb98]
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x430], edi
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0x854]
mov esi, dword [ebp - 0x850]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0x844]
push 0x54
mov dword [ebp - 0xbb8], eax
lea eax, [ebp - 0xa10]
push ebx
push eax
mov dword [ebp - 0xbcc], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa68]
push 0x54
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0xbe4], ebx
lea eax, [ebp - 0x598]
mov dword [ebp - 0xbec], ebx
mov dword [ebp - 0xbdc], ebx
mov dword [ebp - 0xbd8], ebx
push 0x2c
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
lea edi, [ebp - 0x428]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xb98]
test esi, esi
je 0x41c7dd
mov esi, dword [0x429028]
mov ecx, esi
push 7
push edi
call dword [0x42b5a4]
call esi
test eax, eax
jne 0x41bcf2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x41c7dd
mov esi, dword [0x429034]
lea ecx, [ebp - 0xa10]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41bd34
mov eax, dword [ebp - 0x9fc]
mov dword [ebp - 0xbe4], eax
mov eax, dword [ebp - 0xa0c]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xa08]
mov dword [ebp - 0xbd8], eax
mov esi, dword [0x429008]
mov ecx, esi
push edi
call dword [0x42b5a4]
call esi
mov ecx, eax
mov dword [ebp - 0xbe0], ecx
test ecx, ecx
je 0x41bce7
mov eax, dword [ebp - 0xb7c]
sub eax, dword [ebp - 0xbc4]
mov edi, dword [ebp - 0xba4]
sub edi, dword [ebp - 0xb90]
mov esi, dword [0x42900c]
mov dword [ebp - 0x590], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc4c], ebx
mov word [ebp - 0x58c], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x58a], ax
lea eax, [ebp - 0xc4c]
push eax
push ebx
lea eax, [ebp - 0x598]
mov dword [ebp - 0x588], ebx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x584], ebx
mov dword [ebp - 0x580], ebx
mov dword [ebp - 0x57c], ebx
mov dword [ebp - 0x578], ebx
mov dword [ebp - 0x574], ebx
mov dword [ebp - 0x570], ebx
mov dword [ebp - 0x598], 0x28
mov dword [ebp - 0x594], edi
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xba4], eax
test eax, eax
jne 0x41be16
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x41be06
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x41c186
mov edi, 0x80004005
jmp 0x41c186
mov esi, dword [0x429034]
lea ecx, [ebp - 0xa68]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41be40
mov eax, dword [ebp - 0xa54]
mov dword [ebp - 0xbec], eax
push dword [ebp - 0xba4]
mov eax, dword [ebp - 0xbc4]
sub eax, dword [ebp - 0xb7c]
mov esi, dword [0x42903c]
mov ecx, esi
mov dword [ebp - 0x420], edi
mov edi, dword [ebp - 0xbe0]
push edi
mov dword [ebp - 0x41c], eax
call dword [0x42b5a4]
call esi
mov esi, dword [0x429040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0x42b5a4]
call esi
push dword [ebp - 0xbb8]
mov esi, dword [0x42903c]
mov ecx, esi
push edi
call dword [0x42b5a4]
call esi
mov esi, dword [0x429038]
mov ecx, esi
mov edi, dword [0x429074]
push ebx
mov dword [ebp - 0xbc4], eax
call dword [0x42b5a4]
call esi
mov esi, dword [ebp - 0xbe0]
mov ecx, edi
push eax
lea eax, [ebp - 0x428]
push eax
push esi
call dword [0x42b5a4]
call edi
push ebx
push dword [ebp - 0xb88]
lea eax, [ebp - 0x428]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xbcc]
push esi
mov esi, dword [0x42906c]
mov ecx, esi
call dword [0x42b5a4]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xb74], eax
jne 0x41bf38
cmp dword [ebp - 0xbc0], 0
je 0x41bf2c
mov esi, dword [0x42908c]
mov ecx, esi
push 8
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xbc0], eax
jmp 0x41bf42
mov dword [ebp - 0xbc0], 0xffffff
jmp 0x41bf42
mov dword [ebp - 0xbc0], 0xffa8a8a8
mov edx, dword [ebp - 0xb90]
mov ecx, ebx
mov dword [ebp - 0xbb8], ebx
test edx, edx
jns 0x41bf60
mov esi, edx
mov edx, ebx
neg esi
mov dword [ebp - 0xbb8], esi
mov eax, dword [ebp - 0xb7c]
test eax, eax
jns 0x41bf70
mov ecx, eax
mov eax, ebx
neg ecx
mov edi, dword [ebp - 0x420]
mov esi, dword [ebp - 0xbdc]
mov dword [ebp - 0xb90], edi
sub esi, edx
sub edi, dword [ebp - 0xbb8]
mov dword [ebp - 0xb7c], edi
cmp edi, esi
jl 0x41bf9a
mov dword [ebp - 0xb7c], esi
mov edi, dword [ebp - 0xbd8]
mov esi, dword [ebp - 0x41c]
sub edi, eax
sub esi, ecx
mov dword [ebp - 0xbcc], esi
cmp esi, edi
jl 0x41bfbc
mov esi, edi
mov dword [ebp - 0xbcc], edi
cmp dword [ebp - 0xb7c], 0
mov edi, ebx
jle 0x41c14f
test esi, esi
jle 0x41c14f
imul ecx, dword [ebp - 0xb90]
imul eax, dword [ebp - 0xbdc]
mov esi, dword [ebp - 0xbec]
mov dword [ebp - 0xbec], ebx
add ecx, dword [ebp - 0xbb8]
add eax, edx
mov edx, dword [ebp - 0xbe4]
lea ecx, [esi + ecx*4]
lea esi, [edx + eax*4]
mov dword [ebp - 0xbb8], ecx
mov dword [ebp - 0xbe4], esi
mov ebx, esi
lea edi, [esi + 3]
mov esi, dword [ebp - 0xb7c]
lea edx, [ecx + 2]
sub ebx, ecx
mov dword [ebp - 0xbd8], edi
mov dword [ebp - 0xbf0], edx
mov dword [ebp - 0xbb4], ebx
mov dword [ebp - 0xb9c], esi
jmp 0x41c03d
mov edi, dword [ebp - 0xbd8]
movzx eax, byte [edx - 2]
movzx ecx, byte [edx - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edx]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x41c0eb
mov bl, byte [ebx + edx]
mov eax, dword [ebp - 0xbc0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbf0]
mov edx, dword [ebp - 0xbb4]
add al, bl
mov ebx, dword [ebp - 0xbb4]
mov byte [edx + ecx], al
movzx ecx, byte [edi - 2]
mov eax, dword [ebp - 0xbc0]
movzx eax, ah
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 2], al
movzx ecx, byte [edi - 3]
movzx eax, byte [ebp - 0xbbe]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 3], al
mov eax, 0xff
movzx ecx, byte [edi]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xb9c]
cdq
idiv ecx
mov edx, dword [ebp - 0xbf0]
add byte [edi], al
add dword [ebp - 0xbd8], 4
add edx, 4
mov edi, dword [ebp - 0xbec]
sub esi, 1
mov dword [ebp - 0xbf0], edx
mov dword [ebp - 0xb9c], esi
jne 0x41c037
sub dword [ebp - 0xbcc], 1
mov ecx, dword [ebp - 0xbb8]
mov eax, dword [ebp - 0xb90]
mov esi, dword [ebp - 0xbe4]
mov dword [ebp - 0xbec], edi
lea ecx, [ecx + eax*4]
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0xbb8], ecx
lea esi, [esi + eax*4]
mov dword [ebp - 0xbe4], esi
jne 0x41c00d
xor ebx, ebx
push dword [ebp - 0xba4]
mov esi, dword [0x42901c]
mov ecx, esi
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0xbc4]
test eax, eax
je 0x41c186
mov esi, dword [0x42903c]
mov ecx, esi
push eax
push dword [ebp - 0xbe0]
call dword [0x42b5a4]
call esi
push dword [ebp - 0xbe0]
mov esi, dword [0x429018]
mov ecx, esi
call dword [0x42b5a4]
call esi
test edi, edi
js 0x41c7d7
mov eax, dword [ebp - 0x854]
mov esi, dword [ebp - 0x84c]
mov dword [ebp - 0xb9c], eax
mov eax, dword [ebp - 0x840]
push 0x54
mov dword [ebp - 0xbb4], eax
lea eax, [ebp - 0xac0]
push ebx
push eax
mov dword [ebp - 0xb90], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0xb18]
push 0x54
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0xb7c], ebx
lea eax, [ebp - 0x5c4]
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xbc4], ebx
mov dword [ebp - 0xbc0], ebx
push 0x2c
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
lea edi, [ebp - 0x3d8]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xb98]
test esi, esi
je 0x41c7dd
mov esi, dword [0x429028]
mov ecx, esi
push 7
push edi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41bce7
mov esi, dword [0x429034]
lea ecx, [ebp - 0xac0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41c28d
mov eax, dword [ebp - 0xaac]
mov dword [ebp - 0xb7c], eax
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 0xab8]
mov dword [ebp - 0xbc0], eax
mov esi, dword [0x429008]
mov ecx, esi
push edi
call dword [0x42b5a4]
call esi
mov ecx, eax
mov dword [ebp - 0xbb8], ecx
test ecx, ecx
je 0x41bce7
mov eax, dword [ebp - 0xbbc]
sub eax, dword [ebp - 0xba0]
mov edi, dword [ebp - 0xbd4]
mov esi, dword [0x42900c]
mov dword [ebp - 0xbbc], eax
mov dword [ebp - 0x5c0], eax
mov eax, edi
sub eax, dword [ebp - 0xbb0]
mov dword [ebp - 0x5bc], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc58], ebx
mov word [ebp - 0x5b8], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x5b6], ax
lea eax, [ebp - 0xc58]
push eax
push ebx
lea eax, [ebp - 0x5c4]
mov dword [ebp - 0x5b4], ebx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x5b0], ebx
mov dword [ebp - 0x5ac], ebx
mov dword [ebp - 0x5a8], ebx
mov dword [ebp - 0x5a4], ebx
mov dword [ebp - 0x5a0], ebx
mov dword [ebp - 0x59c], ebx
mov dword [ebp - 0x5c4], 0x28
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xbcc], eax
test eax, eax
jne 0x41c37b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x41c36b
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x41c701
mov edi, 0x80004005
jmp 0x41c701
mov esi, dword [0x429034]
lea ecx, [ebp - 0xb18]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41c3a5
mov eax, dword [ebp - 0xb04]
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0xbbc]
push dword [ebp - 0xbcc]
mov esi, dword [0x42903c]
mov ecx, esi
mov dword [ebp - 0x3d0], eax
mov eax, dword [ebp - 0xbb0]
sub eax, edi
mov edi, dword [ebp - 0xbb8]
push edi
mov dword [ebp - 0x3cc], eax
call dword [0x42b5a4]
call esi
mov esi, dword [0x429040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0x42b5a4]
call esi
push dword [ebp - 0xbb4]
mov esi, dword [0x42903c]
mov ecx, esi
push edi
call dword [0x42b5a4]
call esi
mov esi, dword [0x429038]
mov ecx, esi
mov edi, dword [0x429074]
push ebx
mov dword [ebp - 0xbb4], eax
call dword [0x42b5a4]
call esi
mov esi, dword [ebp - 0xbb8]
mov ecx, edi
push eax
lea eax, [ebp - 0x3d8]
push eax
push esi
call dword [0x42b5a4]
call edi
push ebx
push dword [ebp - 0xb88]
lea eax, [ebp - 0x3d8]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb90]
push esi
mov esi, dword [0x42906c]
mov ecx, esi
call dword [0x42b5a4]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xb74], eax
jne 0x41c4a7
cmp dword [ebp - 0xb9c], 0
je 0x41c49b
mov esi, dword [0x42908c]
mov ecx, esi
push 8
call dword [0x42b5a4]
call esi
mov edx, eax
mov dword [ebp - 0xb80], edx
mov dword [ebp - 0xb9c], edx
jmp 0x41c4b8
mov dword [ebp - 0xb9c], 0xffffff
jmp 0x41c4b8
mov eax, 0xffa8a8a8
mov dword [ebp - 0xb80], eax
mov dword [ebp - 0xb9c], eax
mov edi, dword [ebp - 0xba0]
mov ecx, ebx
mov dword [ebp - 0xb88], ebx
mov eax, ebx
test edi, edi
jns 0x41c4de
mov ecx, edi
mov edi, ebx
neg ecx
mov dword [ebp - 0xba0], edi
mov dword [ebp - 0xb88], ecx
mov edx, dword [ebp - 0xbd4]
test edx, edx
jns 0x41c4ee
mov eax, edx
mov edx, ebx
neg eax
mov esi, dword [ebp - 0x3d0]
mov dword [ebp - 0xb90], esi
sub esi, ecx
mov ecx, dword [ebp - 0xbc4]
sub ecx, edi
mov dword [ebp - 0xbbc], esi
cmp esi, ecx
jl 0x41c516
mov esi, ecx
mov dword [ebp - 0xbbc], ecx
mov ecx, dword [ebp - 0x3cc]
mov edi, dword [ebp - 0xbc0]
sub ecx, eax
sub edi, edx
mov dword [ebp - 0xbd4], ecx
cmp ecx, edi
jl 0x41c538
mov ecx, edi
mov dword [ebp - 0xbd4], edi
mov edi, ebx
test esi, esi
jle 0x41c6ca
test ecx, ecx
jle 0x41c6ca
imul eax, dword [ebp - 0xb90]
mov ecx, dword [ebp - 0xba4]
imul edx, dword [ebp - 0xbc4]
add eax, dword [ebp - 0xb88]
add edx, dword [ebp - 0xba0]
mov dword [ebp - 0xba0], ebx
lea ecx, [ecx + eax*4]
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xb88], ecx
lea eax, [eax + edx*4]
mov dword [ebp - 0xb7c], eax
mov ebx, eax
mov dword [ebp - 0xbe4], esi
lea edi, [eax + 3]
sub ebx, ecx
lea edx, [ecx + 2]
mov dword [ebp - 0xba4], edi
mov dword [ebp - 0xbb0], edx
mov dword [ebp - 0xbc0], ebx
jmp 0x41c5b2
mov edi, dword [ebp - 0xba4]
movzx eax, byte [edx - 2]
movzx ecx, byte [edx - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edx]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x41c660
mov bl, byte [ebx + edx]
mov eax, dword [ebp - 0xb80]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbb0]
mov edx, dword [ebp - 0xbc0]
add al, bl
mov ebx, dword [ebp - 0xbc0]
mov byte [edx + ecx], al
movzx ecx, byte [edi - 2]
mov eax, dword [ebp - 0xb80]
movzx eax, ah
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 2], al
movzx ecx, byte [edi - 3]
movzx eax, byte [ebp - 0xb9a]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 3], al
mov eax, 0xff
movzx ecx, byte [edi]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xbe4]
cdq
idiv ecx
mov edx, dword [ebp - 0xbb0]
add byte [edi], al
add dword [ebp - 0xba4], 4
add edx, 4
mov edi, dword [ebp - 0xba0]
sub esi, 1
mov dword [ebp - 0xbb0], edx
mov dword [ebp - 0xbe4], esi
jne 0x41c5ac
sub dword [ebp - 0xbd4], 1
mov ecx, dword [ebp - 0xb88]
mov eax, dword [ebp - 0xb90]
mov edx, dword [ebp - 0xbc4]
mov esi, dword [ebp - 0xbbc]
mov dword [ebp - 0xba0], edi
lea ecx, [ecx + eax*4]
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xb88], ecx
lea eax, [eax + edx*4]
mov dword [ebp - 0xb7c], eax
jne 0x41c588
xor ebx, ebx
push dword [ebp - 0xbcc]
mov esi, dword [0x42901c]
mov ecx, esi
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0xbb4]
test eax, eax
je 0x41c701
mov esi, dword [0x42903c]
mov ecx, esi
push eax
push dword [ebp - 0xbb8]
call dword [0x42b5a4]
call esi
push dword [ebp - 0xbb8]
mov esi, dword [0x429018]
mov ecx, esi
call dword [0x42b5a4]
call esi
test edi, edi
js 0x41c7d7
mov edi, dword [ebp - 0xb98]
xor eax, eax
inc eax
cmp dword [ebp - 0xb74], eax
jne 0x41c768
mov esi, dword [section..data]
mov ecx, esi
push 0xcc0020
push ebx
push ebx
push edi
push dword [ebp - 0xbd0]
push dword [ebp - 0xba8]
push dword [ebp - 0x830]
push dword [ebp - 0x834]
push dword [ebp - 0xbac]
call dword [0x42b5a4]
call esi
jmp 0x41c7a3
push dword [ebp - 0xb8c]
mov ecx, dword [ebp - 0xbd0]
mov eax, dword [ebp - 0xba8]
mov esi, dword [0x429020]
push ecx
push eax
push ebx
push ebx
push edi
push ecx
push eax
push dword [ebp - 0x454]
mov ecx, esi
push dword [ebp - 0x458]
push dword [ebp - 0xbac]
call dword [0x42b5a4]
call esi
push dword [ebp - 0xb78]
mov eax, dword [ebp - 0xb84]
push dword [ebp - 0xbac]
mov esi, dword [0x429040]
mov ecx, esi
mov dword [ebp - 0xb84], eax
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0xb84]
test eax, eax
je 0x41c7f4
jmp 0x41c7e3
mov edi, dword [ebp - 0xb98]
mov eax, dword [ebp - 0xb84]
mov esi, dword [0x42901c]
mov ecx, esi
push eax
call dword [0x42b5a4]
call esi
test edi, edi
je 0x41c809
mov esi, dword [0x429018]
mov ecx, esi
push edi
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0xb94]
test eax, eax
je 0x41c824
mov esi, dword [0x42901c]
mov ecx, esi
push eax
call dword [0x42b5a4]
call esi
mov edi, 0x42add0
mov ecx, dword [ebp - 0x850]
test ecx, ecx
je 0x41c878
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41c836
mov eax, dword [ebp - 0x850]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x41c85e
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x41c856
push dword [ebp - 0x850]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x850], ebx
mov ecx, dword [ebp - 0x84c]
test ecx, ecx
je 0x41c8c7
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41c885
mov eax, dword [ebp - 0x84c]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x41c8ad
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x41c8a5
push dword [ebp - 0x84c]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x84c], ebx
mov edx, dword [ebp - 0x848]
test edx, edx
je 0x41c913
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41c8d6
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x41c8fe
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0x41c8f0
mov edx, dword [ebp - 0x848]
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x848], ebx
cmp dword [ebp - 0x844], 0
je 0x41c938
push dword [ebp - 0x844]
mov esi, dword [0x42901c]
mov ecx, esi
call dword [0x42b5a4]
call esi
mov dword [ebp - 0x844], ebx
cmp dword [ebp - 0x840], 0
je 0x41c95d
push dword [ebp - 0x840]
mov esi, dword [0x42901c]
mov ecx, esi
call dword [0x42b5a4]
call esi
mov dword [ebp - 0x840], ebx
cmp dword [ebp - 0x83c], 0
je 0x41c982
push dword [ebp - 0x83c]
mov esi, dword [0x42901c]
mov ecx, esi
call dword [0x42b5a4]
call esi
mov dword [ebp - 0x83c], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x41c984
mov eax, dword [0x42adcc]
push 0
pop ebx
test eax, eax
jle 0x41c9e6
sub eax, 1
mov dword [0x42adcc], eax
jne 0x41c9e6
mov esi, ebx
mov eax, dword [esi + 0x42a878]
test eax, eax
je 0x41c9ba
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x41c9a9
push 0x40
push ebx
push 0x42a878
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x4011f0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x42add0
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0x42a874]
mov esi, dword [0x42904c]
mov ecx, esi
mov dword [ebp - 0xb9c], eax
call dword [0x42b5a4]
call esi
sub eax, dword [0x42adc0]
lea edi, [ebp - 0x33c]
push 7
mov dword [ebp - 0xbb4], eax
mov edx, 0x42add0
xor eax, eax
xor ebx, ebx
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x41ca25
mov eax, dword [0x42adcc]
push 0
pop ebx
test eax, eax
jne 0x41cfc7
push 0x338
push ebx
mov dword [ebp - 0xb74], ebx
mov dword [ebp - 0xb84], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb94], eax
test eax, eax
je 0x41d27d
or dword [ebp - 0xb88], 0xffffffff
mov cl, bl
add eax, 7
mov dword [ebp - 0xb78], ebx
mov esi, ebx
mov dword [ebp - 0xb8c], eax
mov edx, ebx
mov edi, dword [ebp - 0xbfc]
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xbfc]
xor edx, ebx
mov dword [ebp - 0xb90], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xbfc]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xbfc]
shl edi, 8
add dword [ebp - 0xbfc], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
mov dword [ebp - 0xb7c], esi
mov esi, edx
xor esi, dword [ebp - 0xb7c]
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0xb90]
xor eax, edx
mov dword [ebp - 0xb90], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xb90]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xb90]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xb90], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xb90]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xb90]
xor edx, eax
mov dword [ebp - 0xb90], edx
mov eax, dword [ebp - 0xb90]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xb90]
xor eax, edx
mov dword [ebp - 0xb90], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xb90]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xb90]
xor eax, edx
mov dword [ebp - 0xb90], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xb90]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [ebp - 0xb90]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
lea eax, [esi - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0xb7c], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb7c]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xb7c]
xor eax, edx
mov dword [ebp - 0xb7c], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0xb7c], edx
mov edx, dword [ebp - 0xb7c]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xb7c], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb7c]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xb7c]
xor eax, edx
mov dword [ebp - 0xb7c], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb7c]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xb7c]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xb7c], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb7c]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xb7c]
xor edx, dword [ebp - 0xb78]
xor eax, dword [ebp - 0xb88]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xb90], esi
mov esi, dword [ebp - 0xb8c]
mov dword [ebp - 0xb78], ebx
mov dword [ebp - 0xb88], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xc24], 1
mov dword [ebp - 0xb8c], esi
mov esi, eax
mov dword [ebp - 0xb7c], eax
jne 0x41ca8b
mov esi, dword [ebp - 0xb94]
xor ebx, ebx
mov eax, ebx
mov edi, 0x338
xor cl, byte [eax + esi]
inc eax
cmp eax, edi
jb 0x41ce15
movzx eax, cl
cdq
cmp eax, dword [0x403328]
jne 0x41d26e
cmp edx, dword [0x40332c]
jne 0x41d26e
push 0x40
push ebx
push 0x42a878
mov byte [esi + edi - 1], bl
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov edi, esi
cmp byte [esi], bl
je 0x41cfa7
mov edi, 0x42a878
mov dword [ebp - 0xb94], esi
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xb84], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41ce6f
sub ecx, dword [ebp - 0xb84]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0x41cf93
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xb84], edx
cmp word [eax], cx
je 0x41ceb7
mov edx, 0xc000007b
mov dword [ebp - 0xb84], edx
jmp 0x41cf0b
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0x41ceaa
add ecx, dword [edi]
mov dword [ebp - 0xb78], ecx
cmp ecx, dword [edi]
jb 0x41ceaa
cmp dword [ecx], 0x4550
jne 0x41ceaa
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xc20]
je 0x41cef3
cmp ax, word [ebp - 0x394]
je 0x41cef3
mov edx, 0xc000000d
jmp 0x41ceaf
mov eax, dword [ecx + 0x78]
mov ecx, dword [ecx + 0x7c]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0xb78]
mov dword [edi + 0xc], ecx
mov eax, dword [eax + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xb78], eax
mov dword [ebp - 0xb88], ebx
test eax, eax
je 0x41cf86
mov ecx, esi
mov dword [ebp - 0xb8c], esi
lea eax, [ecx + 1]
mov dword [ebp - 0xb90], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41cf32
sub ecx, dword [ebp - 0xb90]
inc esi
add esi, ecx
test edx, edx
js 0x41cf6b
push dword [ebp - 0xb8c]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0x41cf9d
mov ecx, dword [ebp - 0xb74]
mov edx, dword [ebp - 0xb84]
mov dword [ecx*4 + section..data], eax
mov eax, dword [ebp - 0xb88]
inc dword [ebp - 0xb74]
inc eax
mov dword [ebp - 0xb88], eax
cmp eax, dword [ebp - 0xb78]
jb 0x41cf21
add edi, 0x10
cmp byte [esi], bl
jne 0x41ce62
jmp 0x41cf9d
mov dword [ebp - 0xb84], 0xc000007a
mov edi, dword [ebp - 0xb94]
test edi, edi
je 0x41cfb6
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push edi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb84], ebx
jl 0x41d27d
mov eax, dword [0x42adcc]
inc eax
mov dword [0x42adcc], eax
xor eax, eax
mov edi, 0x42add0
xchg dword [edi], eax
mov eax, dword [ebp - 0xbb4]
xor ecx, ecx
mov esi, dword [0x429068]
inc ecx
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0xb9c]
mov dword [ebp - 0x324], eax
lea eax, [ebp - 0x340]
push eax
push 4
push 0x2021
mov dword [ebp - 0x340], ecx
mov dword [ebp - 0x338], ecx
mov dword [ebp - 0x32c], ecx
mov dword [ebp - 0x330], ecx
mov dword [ebp - 0x328], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x334], 0x9966f291
call dword [0x42b5a4]
call esi
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x41d03a
mov eax, dword [0x42adcc]
push 0
pop ebx
test eax, eax
jle 0x41d09c
sub eax, 1
mov dword [0x42adcc], eax
jne 0x41d09c
mov esi, ebx
mov eax, dword [esi + 0x42a878]
test eax, eax
je 0x41d070
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x41d05f
push 0x40
push ebx
push 0x42a878
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x4011f0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x42add0
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xbac]
mov esi, dword [0x4290b0]
mov ecx, esi
push ebx
call dword [0x42b5a4]
call esi
lea ecx, [ebp - 0xc7c]
call fcn.00424e3c
xor eax, eax
mov dword [ebp - 0xc9c], ebx
lea edi, [ebp - 0xcb0]
mov esi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0x420696
mov edi, eax
mov dword [ebp - 0xb9c], edi
push 0x28
pop ecx
mov esi, 0x429788
rep movsd dword es:[edi], dword [esi]
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, dword [ebp - 0xb9c]
test eax, eax
je 0x420696
mov edi, eax
mov eax, dword [0x429780]
mov ecx, dword [0x429784]
mov dword [edi], eax
mov dword [edi + 4], ecx
rdtsc
mov dword [ebp - 0xbb4], eax
mov dword [ebp - 0xbac], edx
mov eax, 0xc4
push eax
push 8
mov dword [ebp - 0xca0], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0x420698
mov dword [ebp - 0xc9c], eax
mov edx, esi
mov dword [ebp - 0xb74], edi
mov ecx, ebx
mov dword [ebp - 0xb9c], edx
mov dword [ebp - 0xca4], ecx
mov dword [ebp - 0xb84], eax
mov edx, 0xa0
mov dword [ebp - 0xb94], ebx
mov dword [ebp - 0xb78], 8
test ecx, ecx
je 0x41d206
push 8
pop eax
mov dword [ebp - 0xb78], eax
mov eax, dword [ebp - 0xb84]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0xb9c], eax
cmp eax, 4
jb 0x420698
mov ebx, eax
add ebx, dword [ebp - 0xb84]
cmp ebx, dword [ebp - 0xb84]
push 0
mov dword [ebp - 0xb9c], ebx
pop ebx
jb 0x420698
mov eax, dword [ebp - 0xb9c]
inc dword [ebp - 0xb94]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb78]
cmp dword [ebp - 0xb94], ecx
jb 0x41d1a3
mov eax, dword [ebp - 0xb84]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x420698
mov ecx, dword [ebp - 0xca0]
mov eax, dword [ebp - 0xb84]
add ecx, dword [ebp - 0xc9c]
add eax, 8
cmp eax, ecx
ja 0x420698
mov eax, dword [ebp - 0xb84]
push 4
pop ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0xca4]
inc ecx
mov dword [ebp - 0xca4], ecx
mov eax, dword [ebp - 0xb78]
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xb74], eax
mov dword [ebp - 0xb94], edi
test esi, esi
jne 0x41d2bc
test edx, edx
je 0x41d2c4
jmp 0x420698
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, ebx
mov eax, dword [esi + 0x42a878]
test eax, eax
je 0x41d290
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x41d27f
push 0x40
push ebx
push 0x42a878
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x4011f0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x41cfcd
test edx, edx
je 0x420698
cmp dword [ebp - 0xc9c], 0
mov eax, dword [ebp - 0xca0]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb78]
jne 0x41d313
mov eax, dword [ebp - 0xb84]
mov edx, 0xa4
add edx, eax
mov dword [ebp - 0xb84], edx
cmp edx, eax
jb 0x420698
mov edi, dword [ebp - 0xb94]
mov eax, edx
mov esi, dword [ebp - 0xb9c]
mov dword [ebp - 0xca0], edx
jmp 0x41d3ef
mov ebx, dword [ebp - 0xc9c]
mov dword [ebp - 0xb94], ebx
xor ebx, ebx
mov dword [ebp - 0xb74], ebx
test ecx, ecx
je 0x41d388
mov dword [ebp - 0xb78], eax
mov eax, dword [ebp - 0xb94]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0xb9c], eax
cmp eax, 4
jb 0x420698
mov ebx, eax
add ebx, dword [ebp - 0xb94]
cmp ebx, dword [ebp - 0xb94]
push 0
mov dword [ebp - 0xb9c], ebx
pop ebx
jb 0x420698
mov eax, dword [ebp - 0xb9c]
inc dword [ebp - 0xb74]
mov dword [ebp - 0xb94], eax
mov eax, dword [ebp - 0xb78]
cmp dword [ebp - 0xb74], ecx
jb 0x41d32b
mov dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0xb94]
lea ecx, [eax + 4]
mov dword [ebp - 0xb9c], ecx
cmp ecx, eax
jb 0x420698
lea ecx, [eax + 4]
mov eax, dword [ebp - 0xc9c]
add eax, dword [ebp - 0xb84]
add ecx, edx
push 0
pop ebx
cmp ecx, eax
ja 0x420698
mov eax, dword [ebp - 0xb94]
mov dword [eax], edx
test esi, esi
je 0x41d3dd
push edx
push esi
push dword [ebp - 0xb9c]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0xca0]
mov ecx, dword [ebp - 0xca4]
mov dword [ebp - 0xb84], eax
inc ecx
mov dword [ebp - 0xca4], ecx
mov edx, dword [ebp - 0xb74]
test edi, edi
jne 0x41d409
test edx, edx
je 0x41d411
jmp 0x420698
test edx, edx
je 0x420698
cmp dword [ebp - 0xc9c], 0
jne 0x41d43c
push 0xc
pop edx
add eax, edx
mov dword [ebp - 0xb74], eax
cmp eax, dword [ebp - 0xb84]
jb 0x420698
mov dword [ebp - 0xca0], eax
jmp 0x41d4f8
mov eax, dword [ebp - 0xc9c]
mov dword [ebp - 0xb74], eax
mov dword [ebp - 0xb94], ebx
test ecx, ecx
je 0x41d49d
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0xb9c], eax
cmp eax, 4
jb 0x420698
mov ebx, eax
add ebx, dword [ebp - 0xb74]
cmp ebx, dword [ebp - 0xb74]
push 0
mov dword [ebp - 0xb9c], ebx
pop ebx
jb 0x420698
inc dword [ebp - 0xb94]
mov eax, dword [ebp - 0xb9c]
mov dword [ebp - 0xb74], eax
cmp dword [ebp - 0xb94], ecx
jb 0x41d452
lea ecx, [eax + 4]
mov dword [ebp - 0xb9c], ecx
cmp ecx, eax
jb 0x420698
lea ecx, [eax + 4]
mov eax, dword [ebp - 0xc9c]
add eax, dword [ebp - 0xb84]
add ecx, edx
push 0
pop ebx
cmp ecx, eax
ja 0x420698
mov eax, dword [ebp - 0xb74]
mov dword [eax], edx
test edi, edi
je 0x41d4e6
push edx
push edi
push dword [ebp - 0xb9c]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0xca0]
mov ecx, dword [ebp - 0xca4]
mov dword [ebp - 0xb74], eax
inc ecx
mov dword [ebp - 0xca4], ecx
cmp dword [ebp - 0xc9c], 0
jne 0x41d52d
lea edx, [eax + 0xc]
mov dword [ebp - 0xb9c], edx
cmp edx, eax
jb 0x420698
inc ecx
mov dword [ebp - 0xca0], edx
mov dword [ebp - 0xca4], ecx
mov ecx, edx
jmp 0x41d5ae
mov edx, dword [ebp - 0xc9c]
mov dword [ebp - 0xb84], ebx
test ecx, ecx
je 0x41d568
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x420698
add eax, edx
cmp eax, edx
jb 0x420698
mov edx, eax
mov eax, dword [ebp - 0xb84]
inc eax
mov dword [ebp - 0xb84], eax
cmp eax, ecx
jb 0x41d53d
lea eax, [edx + 4]
cmp eax, edx
jb 0x420698
mov ecx, dword [ebp - 0xb74]
lea eax, [edx + 0xc]
add ecx, dword [ebp - 0xc9c]
cmp eax, ecx
ja 0x420698
mov eax, dword [ebp - 0xbb4]
mov dword [edx], 8
mov dword [edx + 4], eax
mov eax, dword [ebp - 0xbac]
mov dword [edx + 8], eax
inc dword [ebp - 0xca4]
mov ecx, dword [ebp - 0xca0]
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbb4], edi
rdtsc
mov dword [ebp - 0xbac], ebx
mov dword [ebp - 0xb74], ebx
mov dword [ebp - 0xb84], ebx
mov dword [ebp - 0xb94], ebx
mov dword [ebp - 0xb78], ebx
mov dword [ebp - 0xb88], ebx
mov dword [ebp - 0xb8c], ebx
mov dword [ebp - 0xb90], ebx
mov dword [ebp - 0xb7c], eax
mov dword [ebp - 0xba0], edx
add ecx, 8
cmp ecx, 8
jb 0x420698
lea eax, [ecx + 7]
mov edx, esi
and eax, 0xfffffff8
mov dword [ebp - 0xb80], eax
cmp eax, ecx
jae 0x41d61b
jmp 0x420698
push eax
push 8
mov dword [ebp - 0xbb4], esi
mov dword [ebp - 0xb98], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xba8], ecx
test ecx, ecx
je 0x420698
mov eax, dword [ebp - 0xca4]
lea edx, [ecx + 4]
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbd0], edi
mov dword [ecx], eax
cmp edx, ecx
jb 0x41d6c3
mov eax, dword [ebp - 0xca0]
mov dword [edx], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x41d6cf
mov eax, dword [ebp - 0xb80]
mov edx, dword [ebp - 0xb7c]
mov dword [ecx + eax - 8], edx
mov edx, dword [ebp - 0xba0]
mov dword [ecx + eax - 4], edx
lea eax, [ecx + 8]
push dword [ebp - 0xca0]
push dword [ebp - 0xc9c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xba8]
add esp, 0xc
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xb74], eax
mov dword [ebp - 0xbb4], ebx
jmp 0x41d714
mov edi, dword [ebp - 0xb98]
mov esi, dword [ebp - 0xbb4]
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbd0], edi
mov dword [ebp - 0xb7c], 0xc0000095
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or dword [ebp - 0xb7c], 0x10000000
mov eax, ebx
jl 0x41e185
mov dword [ebp - 0xbb4], ebx
test eax, eax
je 0x420698
test eax, eax
je 0x42066d
add eax, 8
push eax
push ebx
mov dword [ebp - 0xb7c], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xba0], eax
test eax, eax
je 0x42066d
mov ecx, dword [ebp - 0xb74]
mov dl, bl
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xb84], ebx
test ecx, ecx
je 0x41d764
xor dl, byte [eax + ebx]
inc ebx
cmp ebx, ecx
jb 0x41d75a
xor ebx, ebx
or dword [ebp - 0xba8], 0xffffffff
mov ecx, 0xb1b54a58
mov dword [ebp - 0x3a0], ecx
mov ecx, 0xc81ecb17
mov dword [ebp - 0x39c], ecx
mov ecx, dword [ebp - 0xba0]
mov dword [ebp - 0xb80], ecx
mov ecx, ebx
mov dword [ebp - 0xb98], ecx
mov ecx, dword [ebp - 0xb74]
and ecx, 7
mov dword [ebp - 0xb84], eax
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xbc4], ebx
mov dword [ebp - 0xbbc], ecx
je 0x41d965
cmp dword [ebp - 0xbbc], 0
mov ecx, ebx
mov dword [ebp - 0xba8], ebx
mov dword [ebp - 0xb98], ecx
mov dword [ebp - 0xba4], ebx
jbe 0x41d92c
mov eax, ebx
mov dword [ebp - 0xbc4], 0x38
mov ebx, dword [ebp - 0xb84]
mov edi, eax
mov esi, dword [ebp - 0xbc4]
movzx ecx, byte [ebx]
inc ebx
mov dword [ebp - 0xb84], ecx
cmp edi, 4
jae 0x41d823
lea ecx, [esi - 0x20]
shl dword [ebp - 0xb84], cl
mov ecx, dword [ebp - 0xb98]
or ecx, dword [ebp - 0xb84]
mov dword [ebp - 0xb98], ecx
jmp 0x41d837
mov ecx, esi
shl dword [ebp - 0xb84], cl
or eax, dword [ebp - 0xb84]
mov ecx, dword [ebp - 0xb98]
inc edi
mov dword [ebp - 0xba4], eax
sub esi, 8
mov dword [ebp - 0xbc4], ecx
cmp edi, dword [ebp - 0xbbc]
jl 0x41d7f7
mov edi, dword [ebp - 0xbd0]
xor eax, 0x42f6b18d
mov esi, dword [ebp - 0xb9c]
xor ecx, 0xb17a307a
mov dword [ebp - 0xbd0], edi
mov edi, dword [ebp - 0xb74]
mov dword [ebp - 0xb84], ebx
xor ebx, ebx
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xb98], ecx
mov dword [ebp - 0xbd4], ecx
mov ecx, ebx
mov dword [ebp - 0xb9c], esi
mov esi, dword [ebp - 0xbbc]
mov dword [ebp - 0xb74], edi
mov edi, dword [ebp - 0xb80]
mov dword [ebp - 0xbac], eax
lea eax, [edi + 1]
mov dword [ebp - 0xb80], eax
cmp ecx, 4
jge 0x41d8d5
rol dword [ebp - 0xbd4], 8
mov eax, dword [ebp - 0xbd4]
jmp 0x41d8e2
rol dword [ebp - 0xbb0], 8
mov eax, dword [ebp - 0xbb0]
mov byte [edi], al
inc ecx
mov eax, dword [ebp - 0xb80]
mov edi, eax
cmp ecx, esi
jl 0x41d8b8
mov dword [ebp - 0xb80], eax
mov eax, dword [ebp - 0xbac]
cmp esi, 4
jbe 0x41d91c
push 8
pop ecx
sub ecx, esi
mov esi, dword [ebp - 0xba8]
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0xba8], esi
jmp 0x41d965
mov dword [ebp - 0xba8], ebx
jae 0x41d965
mov esi, dword [ebp - 0xb98]
jmp 0x41d94f
mov ecx, dword [ebp - 0xb84]
mov esi, 0xb17a307a
mov dword [ebp - 0xb84], ecx
mov dword [ebp - 0xbc4], ebx
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xba8], ebx
push 4
pop ecx
sub ecx, dword [ebp - 0xbbc]
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0xb98], esi
mov ecx, dword [ebp - 0xb74]
shr ecx, 3
mov dword [ebp - 0xbbc], ecx
test ecx, ecx
je 0x41dd5d
movzx eax, word [ebp - 0x39e]
mov ecx, 0xc81ecb17
movzx esi, word [ebp - 0x39a]
mov edi, 0xb1b54a58
movzx ecx, cx
mov dword [ebp - 0xbc0], ecx
mov ecx, 0xc81ecb17
mov dword [ebp - 0xbb0], eax
xor ecx, edi
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xbb8], esi
add eax, 7
mov esi, dword [ebp - 0xb84]
movzx ebx, di
add esi, 2
mov dword [ebp - 0xbd4], ebx
mov ebx, dword [ebp - 0xb98]
mov dword [ebp - 0xbcc], ecx
mov ecx, dword [ebp - 0xba8]
mov dword [ebp - 0xb80], eax
mov dword [ebp - 0xb84], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xb84]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xb84]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xb84]
shl esi, 8
add dword [ebp - 0xb84], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ecx, esi
mov dword [ebp - 0xba8], ecx
sub ecx, dword [ebp - 0xbd4]
xor ecx, edi
xor ecx, ebx
mov ebx, ecx
ror ecx, 0xf
imul ecx, dword [ebp - 0xbb0]
xor ebx, 0xc81ecb17
mov eax, ebx
ror eax, 7
add ecx, eax
mov eax, dword [ebp - 0xba8]
xor eax, ecx
mov ecx, 0xb1b54a58
add ecx, eax
mov dword [ebp - 0xba8], eax
ror ecx, 9
imul ecx, dword [ebp - 0xbc0]
ror eax, 0xa
sub ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xbc0]
xor ecx, ebx
mov eax, ebx
rol eax, 5
rol ecx, 4
imul ecx, dword [ebp - 0xbb8]
add ecx, eax
mov eax, dword [ebp - 0xba8]
xor eax, ecx
mov ecx, 0xb1b54a58
xor ecx, eax
mov dword [ebp - 0xba8], eax
mov eax, 0xc81ecb17
sub eax, ecx
xor ebx, eax
mov ecx, ebx
mov eax, ebx
sub ecx, dword [ebp - 0xbd4]
imul ecx, dword [ebp - 0xbb0]
shr eax, 6
sub ecx, eax
xor dword [ebp - 0xba8], ecx
mov ecx, dword [ebp - 0xba8]
mov eax, ecx
ror eax, 0xf
xor eax, dword [ebp - 0xbc0]
imul eax, dword [ebp - 0xbd4]
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, dword [ebp - 0xbb8]
imul eax, dword [ebp - 0xbc0]
xor ecx, eax
mov dword [ebp - 0xba8], ecx
sub ecx, dword [ebp - 0xbd4]
sub ecx, 0xc81ecb17
mov eax, dword [ebp - 0xbb8]
xor ebx, ecx
xor eax, ebx
mov ecx, ebx
imul eax, dword [ebp - 0xbb0]
ror ecx, 0xa
xor ecx, eax
mov eax, dword [ebp - 0xba8]
xor eax, ecx
mov ecx, dword [ebp - 0xbd4]
xor ecx, eax
mov dword [ebp - 0xba8], eax
rol ecx, 6
imul ecx, dword [ebp - 0xbc0]
ror eax, 3
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xbb8]
mov eax, ebx
ror eax, 0xf
sub eax, ecx
imul eax, dword [ebp - 0xbd4]
xor dword [ebp - 0xba8], eax
mov eax, dword [ebp - 0xba8]
xor ecx, eax
imul ecx, dword [ebp - 0xbd4]
shr eax, 1
xor ecx, eax
mov eax, dword [ebp - 0xba8]
xor ebx, ecx
mov ecx, eax
sub ecx, dword [ebp - 0xbc0]
rol ecx, 3
imul ecx, dword [ebp - 0xbd4]
shr eax, 0xf
xor ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
sub ecx, dword [ebp - 0xbc0]
imul ecx, dword [ebp - 0xbb0]
shr eax, 0xd
sub ecx, eax
mov eax, dword [ebp - 0xba8]
xor eax, ecx
mov ecx, 0xb1b54a58
sub ecx, eax
mov dword [ebp - 0xba8], eax
ror ecx, 9
imul ecx, dword [ebp - 0xbc0]
ror eax, 0xb
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xba8]
mov eax, ebx
sub eax, dword [ebp - 0xbb8]
sub eax, 0xb1b54a58
xor ecx, eax
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xba8], ecx
xor eax, dword [ebp - 0xba8]
imul eax, dword [ebp - 0xbd4]
ror ecx, 7
sub eax, ecx
mov ecx, dword [ebp - 0xbb8]
xor ebx, eax
xor ecx, ebx
mov eax, ebx
rol ecx, 4
imul ecx, dword [ebp - 0xbb0]
ror eax, 0x10
sub ecx, eax
mov eax, dword [ebp - 0xba8]
xor eax, ecx
mov ecx, 0xb1b54a58
sub ecx, eax
mov dword [ebp - 0xba8], eax
ror ecx, 0xa
imul ecx, dword [ebp - 0xbc0]
ror eax, 4
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
sub ecx, 0xb1b54a58
ror eax, 9
ror ecx, 4
imul ecx, dword [ebp - 0xbb8]
xor ecx, eax
mov eax, dword [ebp - 0xba8]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xba8], eax
xor ecx, 0xc81ecb17
rol eax, 2
rol ecx, 8
imul ecx, dword [ebp - 0xbd4]
sub ecx, eax
xor ebx, ecx
mov ecx, 0xc81ecb17
sub ecx, ebx
mov eax, ebx
ror ecx, 0xb
imul ecx, dword [ebp - 0xbb0]
ror eax, 0xc
sub ecx, eax
mov eax, dword [ebp - 0xba8]
xor eax, ecx
mov ecx, dword [ebp - 0xbb0]
xor ecx, eax
mov dword [ebp - 0xba8], eax
imul ecx, dword [ebp - 0xbc0]
shr eax, 8
xor ecx, eax
mov eax, dword [ebp - 0xbcc]
xor ebx, ecx
mov ecx, dword [ebp - 0xba8]
xor eax, ebx
xor ebx, dword [ebp - 0xbc4]
xor ecx, eax
mov dword [ebp - 0xbc4], edi
mov eax, dword [ebp - 0xb80]
xor ecx, dword [ebp - 0xba4]
mov dword [ebp - 0xba4], esi
mov esi, dword [ebp - 0xb84]
mov byte [eax - 4], bl
mov byte [eax], cl
ror ebx, 8
mov byte [eax - 5], bl
ror ecx, 8
mov byte [eax - 1], cl
ror ebx, 8
mov byte [eax - 6], bl
ror ecx, 8
mov byte [eax - 2], cl
ror ebx, 8
ror ecx, 8
mov byte [eax - 7], bl
mov byte [eax - 3], cl
add eax, 8
ror ebx, 8
ror ecx, 8
sub dword [ebp - 0xbbc], 1
mov dword [ebp - 0xb80], eax
jne 0x41d9e9
mov eax, dword [ebp - 0xbac]
mov ecx, dword [ebp - 0xb74]
mov ebx, dword [ebp - 0xba0]
mov esi, dword [ebp - 0xb9c]
mov edi, dword [ebp - 0xbd0]
mov dword [ebp - 0xb84], eax
movzx eax, dl
cdq
mov dword [ecx + ebx], eax
mov eax, ecx
mov ecx, ebx
mov dword [ebp - 0xb9c], esi
mov dword [eax + ecx + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb74], eax
push 0
pop ebx
test eax, eax
jne 0x41de84
mov dword [ebp - 0xb7c], 0xc0000017
mov eax, ebx
push dword [ebp - 0xba0]
mov ecx, dword [ebp - 0xbac]
push ebx
mov dword [ebp - 0xbac], ecx
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbd0], edi
mov dword [ebp - 0xb84], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xb80], edi
mov edi, dword [ebp - 0xbb4]
mov dword [ebp - 0xb74], eax
mov dword [ebp - 0xba0], esi
test edi, edi
je 0x41e060
cmp dword [edi + 4], 0
je 0x41de30
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x41de4a
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x41de64
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edx, dword [ebp - 0xb84]
mov dword [ebp - 0xb84], edx
jmp 0x41e066
mov ecx, dword [ebp - 0xb84]
mov esi, dword [ebp - 0xb9c]
mov edi, dword [ebp - 0xbd0]
mov dword [ebp - 0xbac], ecx
mov ecx, dword [ebp - 0xb7c]
push ecx
push 8
mov dword [eax], ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x41dec5
mov eax, dword [ebp - 0xb84]
jmp 0x41df90
mov ecx, dword [ebp - 0xb74]
mov dword [ecx + 4], edx
push dword [ebp - 0xb7c]
mov dword [ebp - 0xb74], ecx
push dword [ebp - 0xba0]
push edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xbac]
add esp, 0xc
mov dword [ebp - 0xbb4], eax
mov ecx, 0xa0
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xb84], esi
push ecx
push 8
mov dword [ebp - 0xb80], edi
mov dword [eax + 8], ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0x41df96
mov edx, dword [ebp - 0xb74]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xbb4]
mov edi, esi
push 0x28
pop ecx
mov dword [ebp - 0xb9c], edi
mov esi, 0x4296d8
mov edi, dword [edx + 0xc]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xb80]
push 8
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xbd0], eax
mov esi, edx
pop eax
push eax
push eax
mov dword [esi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0x41e02d
mov edi, dword [ebp - 0xb80]
mov eax, dword [ebp - 0xbb4]
mov dword [ebp - 0xb74], esi
mov esi, dword [ebp - 0xb84]
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0xb7c], 0xc0000017
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xbb4], ebx
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41dfcb
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb74]
mov dword [eax + 4], ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x41dfea
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb74]
mov dword [eax + 0xc], ebx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x41e009
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb74]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb7c], 0
jl 0x41ddbc
mov eax, dword [ebp - 0xbb4]
jmp 0x41e055
mov dword [esi + 0x14], eax
mov ecx, dword [0x429778]
mov edx, dword [0x42977c]
mov edi, dword [ebp - 0xbd0]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, esi
mov esi, dword [ebp - 0xb9c]
mov dword [ebp - 0xb7c], ebx
mov dword [ebp - 0xbb4], ebx
jmp 0x41ddbe
mov edx, dword [ebp - 0xb84]
mov ecx, dword [ebp - 0xb7c]
or ecx, 0x10000000
mov dword [ebp - 0xbb4], edx
mov dword [ebp - 0xb7c], ecx
jl 0x41e17f
mov edi, dword [edx]
lea eax, [edx + 0x10]
mov dword [ebp - 0xb7c], eax
add edi, 4
mov eax, dword [eax]
mov dword [ebp - 0xb98], eax
lea eax, [edx + 8]
mov dword [ebp - 0xba8], eax
mov eax, dword [eax]
mov dword [ebp - 0xba4], eax
cmp edi, 4
jb 0x42064c
mov eax, dword [ebp - 0xb74]
mov esi, dword [ebp - 0xba0]
mov ecx, dword [ebp - 0xb80]
mov dword [ebp - 0xbac], eax
lea eax, [edi + 4]
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xb84], edx
mov dword [ebp - 0xbc4], eax
cmp eax, edi
jb 0x420613
mov edi, eax
add edi, dword [ebp - 0xba4]
cmp edi, eax
mov dword [ebp - 0xbb4], edi
mov eax, dword [ebp - 0xbac]
jb 0x4205f2
add edi, 4
cmp edi, dword [ebp - 0xbb4]
jb 0x4205f2
mov edx, dword [ebp - 0xb98]
add edx, edi
mov dword [ebp - 0xbb4], edx
cmp edx, edi
mov edx, dword [ebp - 0xb84]
jb 0x4205f2
push dword [ebp - 0xbb4]
mov edi, eax
mov dword [ebp - 0xba0], esi
push 8
mov dword [ebp - 0xb74], edi
mov dword [ebp - 0xb80], ecx
mov dword [ebp - 0xb98], edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edx, eax
mov dword [ebp - 0xba4], edx
test edx, edx
jne 0x41e372
mov dword [ebp - 0xb7c], 0xd0000017
mov eax, dword [ebp - 0xbac]
mov edi, dword [ebp - 0xb9c]
test eax, eax
je 0x41e19e
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xb84]
test esi, esi
je 0x41e205
cmp dword [esi + 4], 0
je 0x41e1c2
push dword [esi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 4], ebx
cmp dword [esi + 0xc], 0
je 0x41e1dc
push dword [esi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 0xc], ebx
cmp dword [esi + 0x14], 0
je 0x41e1f6
push dword [esi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 0x14], ebx
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb94]
test eax, eax
je 0x41e21e
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb88]
test eax, eax
je 0x41e237
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xb8c]
test esi, esi
je 0x41e29e
cmp dword [esi + 4], 0
je 0x41e25b
push dword [esi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 4], ebx
cmp dword [esi + 0xc], 0
je 0x41e275
push dword [esi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 0xc], ebx
cmp dword [esi + 0x14], 0
je 0x41e28f
push dword [esi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 0x14], ebx
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb90]
test eax, eax
je 0x41e2b7
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb7c], 0
jl 0x420688
mov ecx, dword [ebp - 0xcb0]
xor eax, eax
inc eax
cmp ecx, eax
jb 0x420688
mov eax, dword [ebp - 0xca8]
test eax, eax
je 0x420688
test ecx, ecx
je 0x420688
mov ecx, dword [eax]
lea esi, [eax + 4]
mov dword [ebp - 0xbb4], ecx
cmp esi, eax
jb 0x420688
mov eax, dword [ebp - 0xbb4]
mov ecx, edi
mov edx, dword [ebp - 0xbd0]
neg eax
sbb eax, eax
and eax, esi
cmp dword [ebp - 0xbb4], 4
mov edi, edx
mov esi, ecx
jne 0x420698
cmp dword [eax], 0
jl 0x420698
mov eax, dword [ebp - 0xca8]
test eax, eax
je 0x420698
cmp dword [ebp - 0xcb0], 1
jbe 0x420698
xor edi, edi
mov dword [ebp - 0xb9c], ebx
mov dword [ebp - 0xbd0], edx
inc edi
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x41e36b
lea eax, [edx + ecx]
cmp eax, ecx
jb 0x41e36b
inc ebx
cmp ebx, edi
jb 0x41e356
xor ebx, ebx
jmp 0x42068e
mov eax, dword [ebp - 0xb98]
mov ecx, eax
mov dword [ebp - 0xbac], edi
mov edi, dword [ebp - 0xb80]
mov dword [ebp - 0xb9c], esi
mov eax, dword [eax]
mov dword [edx], eax
lea eax, [edx + 4]
mov dword [ebp - 0xbd0], edi
mov dword [ebp - 0xb84], ecx
mov dword [ebp - 0xbc4], eax
cmp eax, edx
jb 0x41e4d1
push dword [ecx]
push dword [ecx + 4]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [ebp - 0xb84]
add esp, 0xc
mov eax, dword [ecx]
add eax, dword [ebp - 0xbc4]
mov dword [ebp - 0xb74], eax
cmp eax, dword [ebp - 0xbc4]
jb 0x41e4c9
mov edx, dword [ebp - 0xb74]
mov eax, dword [ebp - 0xba8]
mov eax, dword [eax]
mov dword [edx], eax
lea eax, [edx + 4]
mov dword [ebp - 0xb74], eax
cmp eax, edx
jb 0x41e4c9
mov edx, dword [ebp - 0xba8]
push dword [edx]
push dword [ecx + 0xc]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xba8]
add esp, 0xc
mov ecx, dword [ebp - 0xb74]
mov edx, dword [eax]
add edx, ecx
mov dword [ebp - 0xb74], edx
cmp edx, ecx
jb 0x41e4a9
mov eax, dword [ebp - 0xb7c]
lea ecx, [edx + 4]
mov eax, dword [eax]
mov dword [edx], eax
cmp ecx, edx
jb 0x41e4a9
mov eax, dword [ebp - 0xb7c]
push dword [eax]
mov eax, dword [ebp - 0xb84]
push dword [eax + 0x14]
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xb7c]
add esp, 0xc
mov ecx, dword [ebp - 0xb74]
add ecx, 4
mov eax, dword [eax]
add eax, ecx
cmp eax, ecx
jb 0x41e489
mov edi, dword [ebp - 0xba4]
mov eax, dword [ebp - 0xbb4]
mov dword [ebp - 0xb94], edi
mov dword [ebp - 0xb78], eax
jmp 0x41e52a
mov eax, dword [ebp - 0xb84]
mov edx, dword [ebp - 0xba4]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xbd0], edi
jmp 0x41e4f5
mov eax, dword [ebp - 0xb84]
mov dword [ebp - 0xb84], eax
mov edx, dword [ebp - 0xba4]
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xbd0], edi
jmp 0x41e4f5
mov dword [ebp - 0xb84], ecx
jmp 0x41e4b5
mov eax, dword [ebp - 0xb98]
mov esi, dword [ebp - 0xba0]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xb7c], 0xc0000095
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or dword [ebp - 0xb7c], 0x10000000
jl 0x41e17f
cmp dword [ebp - 0xc9c], 0
jne 0x41e542
mov dword [ebp - 0xb7c], 0xc000000d
jmp 0x41e17f
xor eax, eax
inc eax
cmp dword [ebp - 0xca4], eax
jbe 0x41e533
mov eax, dword [ebp - 0xc9c]
mov ecx, dword [ebp - 0xbd0]
mov edx, dword [ebp - 0xb84]
mov dword [ebp - 0xbb4], eax
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xb74], ebx
mov edi, dword [ebp - 0xb78]
mov dword [ebp - 0xba8], ecx
mov dword [ebp - 0xbd0], ecx
mov ecx, dword [ebp - 0xbb4]
mov dword [ebp - 0xba4], edx
mov dword [ebp - 0xb84], edx
mov dword [ebp - 0xb78], edi
mov edx, dword [ecx]
mov edi, dword [ebp - 0xb94]
mov dword [ebp - 0xbb4], edx
lea edx, [ecx + 4]
mov dword [ebp - 0xba0], edi
mov dword [ebp - 0xb80], eax
mov dword [ebp - 0xb98], esi
mov dword [ebp - 0xb94], edi
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xb7c], edx
cmp edx, ecx
jb 0x4205e3
mov ecx, dword [ebp - 0xba8]
mov edx, dword [ebp - 0xba4]
mov dword [ebp - 0xb94], edi
mov edi, dword [ebp - 0xb7c]
add edi, dword [ebp - 0xbb4]
push 0
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0xbb4], edi
pop ebx
cmp edi, dword [ebp - 0xb7c]
jb 0x4205aa
inc dword [ebp - 0xb74]
cmp dword [ebp - 0xb74], 1
jb 0x41e571
mov eax, edi
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xb84], edx
mov edi, dword [eax]
add eax, 4
cmp eax, dword [ebp - 0xbb4]
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xb74], edi
mov edi, dword [ebp - 0xb94]
jb 0x42059b
mov dword [ebp - 0xb94], edi
cmp dword [ebp - 0xc9c], ebx
jne 0x41e678
mov dword [ebp - 0xb7c], 0xc000000d
jmp 0x41e185
cmp dword [ebp - 0xca4], 2
ja 0x41e6ae
mov dword [ebp - 0xb7c], 0xc000000d
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xb84], edx
mov edx, dword [ebp - 0xb94]
mov dword [ebp - 0xb94], edx
jmp 0x41e185
mov edi, dword [ebp - 0xc9c]
mov dword [ebp - 0xbb4], edi
mov edi, dword [ebp - 0xb94]
mov dword [ebp - 0xb7c], ebx
mov dword [ebp - 0xba0], edx
mov dword [ebp - 0xb80], ecx
mov dword [ebp - 0xb98], esi
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0xba4], edi
jmp 0x41e6fe
mov edx, dword [ebp - 0xba0]
mov ecx, dword [ebp - 0xb80]
mov esi, dword [ebp - 0xb98]
mov edi, dword [ebp - 0xba4]
mov ebx, dword [ebp - 0xb78]
mov dword [ebp - 0xb78], ebx
mov ebx, dword [ebp - 0xb74]
mov dword [ebp - 0xb94], edi
mov edi, dword [ebp - 0xbb4]
mov dword [ebp - 0xb74], ebx
push 0
mov dword [ebp - 0xbac], eax
mov ebx, dword [edi]
mov dword [ebp - 0xbb4], ebx
lea ebx, [edi + 4]
mov dword [ebp - 0xbc4], ebx
cmp ebx, edi
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xb84], edx
pop ebx
jb 0x420562
mov edi, dword [ebp - 0xbc4]
add edi, dword [ebp - 0xbb4]
cmp edi, dword [ebp - 0xbc4]
mov dword [ebp - 0xbb4], edi
mov edi, dword [ebp - 0xb94]
jb 0x420553
inc dword [ebp - 0xb7c]
cmp dword [ebp - 0xb7c], 2
mov dword [ebp - 0xba0], edx
mov dword [ebp - 0xb80], ecx
mov dword [ebp - 0xb98], esi
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0xba4], edi
jb 0x41e6e6
mov eax, dword [ebp - 0xbb4]
mov edi, dword [eax]
add eax, 4
mov dword [ebp - 0xb7c], edi
cmp eax, dword [ebp - 0xbb4]
jb 0x420544
mov eax, dword [ebp - 0xb74]
add eax, 0x30
mov dword [ebp - 0xbb4], eax
cmp eax, 0x30
jb 0x420544
add eax, 4
mov dword [ebp - 0xb74], eax
cmp eax, dword [ebp - 0xbb4]
jb 0x420544
add eax, edi
mov edi, dword [ebp - 0xb94]
mov dword [ebp - 0xbb4], eax
cmp eax, dword [ebp - 0xb74]
jb 0x420544
cmp eax, 0x400000
mov eax, dword [ebp - 0xbac]
jbe 0x41e82b
mov dword [ebp - 0xb7c], 0x8000ffff
jmp 0x41e185
mov dword [ebp - 0xb84], edx
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0xb94], edi
mov dword [ebp - 0xb80], esi
mov esi, dword [ebp - 0xbb4]
push esi
push 8
mov dword [ebp - 0xb74], edi
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0xb98], ecx
mov dword [ebp - 0xba8], edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0x41e175
mov edx, eax
mov dword [ebp - 0xb88], edx
mov dword [ebp - 0xba4], edx
test edi, edi
jne 0x41e8d0
mov eax, dword [ebp - 0xba8]
mov edi, dword [ebp - 0xb80]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb98]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xba0]
mov dword [ebp - 0xb7c], 0x80070057
mov dword [ebp - 0xb9c], edi
jmp 0x41e988
mov eax, dword [ebp - 0xb78]
mov dword [ebp - 0xcd4], eax
lea eax, [ebp - 0xc5c]
push eax
xor eax, eax
mov dword [ebp - 0xcdc], edi
push 0x401b14
inc eax
mov dword [ebp - 0xcd8], edx
push eax
mov dword [ebp - 0xcd0], esi
mov dword [ebp - 0xccc], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0x41e99f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
mov dword [ebp - 0xb7c], ecx
test ecx, ecx
jle 0x41e935
movzx ecx, cx
or ecx, 0x80070000
mov dword [ebp - 0xb7c], ecx
test ecx, ecx
js 0x41e942
mov ecx, 0x80004005
mov dword [ebp - 0xb7c], ecx
mov eax, dword [ebp - 0xba8]
mov edi, dword [ebp - 0xb80]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb98]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xba0]
mov dword [ebp - 0xb9c], edi
cmp ecx, 0xd0000023
jne 0x41ea3a
mov edx, dword [ebp - 0xb88]
mov dword [ebp - 0xb7c], 0x8007007a
mov dword [ebp - 0xb88], edx
mov edx, dword [ebp - 0xb74]
mov dword [ebp - 0xb94], edx
jmp 0x41e18b
push 0x404fc8
push dword [ebp - 0xc5c]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [ebp - 0xb9c], eax
test eax, eax
jne 0x41e9f5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
mov dword [ebp - 0xb7c], ecx
test ecx, ecx
jle 0x41e9dd
movzx ecx, cx
or ecx, 0x80070000
mov dword [ebp - 0xb7c], ecx
test ecx, ecx
js 0x41e9ea
mov ecx, 0x80004005
mov dword [ebp - 0xb7c], ecx
mov dword [ebp - 0xbb4], esi
jmp 0x41e942
push ebx
push 0x14
lea ecx, [ebp - 0xcdc]
push ecx
push 0x86
mov ecx, eax
call dword [0x42b5a4]
call dword [ebp - 0xb9c]
mov ecx, eax
mov dword [ebp - 0xbb4], esi
or ecx, 0x10000000
mov dword [ebp - 0xb7c], ecx
jl 0x41e942
mov esi, dword [ebp - 0xcd0]
mov dword [ebp - 0xbb4], esi
jmp 0x41ea50
mov edx, dword [ebp - 0xb74]
mov dword [ebp - 0xb94], edx
test ecx, ecx
js 0x41e18b
mov edi, edx
mov edx, dword [ebp - 0xb88]
mov dword [ebp - 0xb78], ebx
cmp esi, 4
jae 0x41eaa0
mov dword [ebp - 0xb7c], 0xd000003e
mov dword [ebp - 0xb88], edx
mov eax, dword [ebp - 0xba8]
mov edi, dword [ebp - 0xb80]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb98]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xba0]
mov dword [ebp - 0xb9c], edi
jmp 0x41e98e
mov eax, dword [edx]
mov dword [ebp - 0xbc4], eax
lea eax, [edx + 4]
mov dword [ebp - 0xbbc], eax
cmp eax, edx
jb 0x420535
mov eax, dword [ebp - 0xba4]
mov esi, dword [ebp - 0xb80]
mov ecx, dword [ebp - 0xb98]
mov edx, dword [ebp - 0xba8]
mov dword [ebp - 0xb88], eax
mov eax, dword [ebp - 0xbb4]
add eax, 0xfffffffc
mov dword [ebp - 0xb94], edi
mov edi, dword [ebp - 0xba0]
mov dword [ebp - 0xbac], edi
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xb84], edx
cmp eax, dword [ebp - 0xbc4]
jae 0x41eb27
mov dword [ebp - 0xb7c], 0xd000003e
mov eax, dword [ebp - 0xba4]
mov dword [ebp - 0xb88], eax
jmp 0x41ea71
mov ebx, dword [ebp - 0xbbc]
mov eax, dword [ebp - 0xbc4]
push 0
lea edx, [eax + ebx]
cmp edx, ebx
mov dword [ebp - 0xbd4], edx
mov edx, dword [ebp - 0xb84]
pop ebx
jb 0x420526
add eax, 4
mov dword [ebp - 0xb74], eax
cmp eax, 4
jb 0x420515
mov eax, dword [ebp - 0xb94]
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0xbb4]
sub eax, dword [ebp - 0xb74]
mov dword [ebp - 0xb80], edi
mov edi, dword [ebp - 0xb88]
mov dword [ebp - 0xb98], esi
mov dword [ebp - 0xba8], ecx
mov dword [ebp - 0xba4], edx
mov dword [ebp - 0xbb0], edi
cmp eax, 4
jae 0x41ebaf
mov dword [ebp - 0xb7c], 0xd000003e
jmp 0x41e17f
mov eax, dword [ebp - 0xbd4]
mov edi, dword [ebp - 0xb88]
mov eax, dword [eax]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xbd4]
add eax, 4
cmp eax, dword [ebp - 0xbd4]
jb 0x42042b
mov edi, dword [ebp - 0xba0]
mov eax, dword [ebp - 0xb80]
mov esi, dword [ebp - 0xb98]
mov ecx, dword [ebp - 0xba8]
mov edx, dword [ebp - 0xba4]
mov dword [ebp - 0xb94], edi
mov edi, dword [ebp - 0xbb0]
mov dword [ebp - 0xb88], edi
mov edi, dword [ebp - 0xb74]
push 0
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0xb9c], esi
lea ebx, [edi + 4]
mov dword [ebp - 0xbd0], ecx
cmp ebx, edi
mov dword [ebp - 0xb74], ebx
mov edi, dword [ebp - 0xb94]
mov dword [ebp - 0xb84], edx
pop ebx
jb 0x4204d0
mov dword [ebp - 0xb80], eax
mov eax, dword [ebp - 0xbb4]
sub eax, dword [ebp - 0xb74]
mov dword [ebp - 0xba0], edi
mov edi, dword [ebp - 0xb88]
mov dword [ebp - 0xb98], esi
mov dword [ebp - 0xba8], ecx
mov dword [ebp - 0xba4], edx
mov dword [ebp - 0xbb0], edi
cmp eax, dword [ebp - 0xbc0]
jb 0x41eba0
mov eax, dword [ebp - 0xbc0]
mov edi, dword [ebp - 0xbd4]
add eax, 4
add eax, edi
mov dword [ebp - 0xb7c], eax
lea eax, [edi + 4]
mov edi, dword [ebp - 0xb88]
cmp dword [ebp - 0xb7c], eax
jb 0x42042b
mov edi, dword [ebp - 0xba0]
mov ebx, dword [ebp - 0xb74]
add ebx, dword [ebp - 0xbc0]
mov eax, dword [ebp - 0xb80]
cmp ebx, dword [ebp - 0xb74]
mov dword [ebp - 0xb94], edi
mov edi, dword [ebp - 0xbb0]
push 0
mov dword [ebp - 0xb88], edi
mov edi, dword [ebp - 0xb94]
mov dword [ebp - 0xbb8], ebx
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xb84], edx
pop ebx
jb 0x42048b
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0xbb4]
sub eax, dword [ebp - 0xbb8]
mov dword [ebp - 0xb74], edi
mov edi, dword [ebp - 0xb88]
mov dword [ebp - 0xb80], esi
mov dword [ebp - 0xb98], ecx
mov dword [ebp - 0xba8], edx
mov dword [ebp - 0xba4], edi
cmp eax, 4
jb 0x41eba0
mov eax, dword [ebp - 0xb7c]
mov eax, dword [eax]
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp - 0xb7c]
add eax, 4
mov dword [ebp - 0xbcc], eax
cmp eax, dword [ebp - 0xb7c]
jb 0x42042b
mov edi, dword [ebp - 0xb74]
mov eax, dword [ebp - 0xba0]
mov dword [ebp - 0xb94], edi
mov edi, dword [ebp - 0xba4]
mov dword [ebp - 0xb88], edi
mov edi, dword [ebp - 0xbb8]
add edi, 4
mov dword [ebp - 0xbac], eax
cmp edi, dword [ebp - 0xbb8]
mov edi, dword [ebp - 0xb94]
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xb84], edx
jb 0x420446
mov dword [ebp - 0xb74], edi
mov edi, dword [ebp - 0xb88]
mov dword [ebp - 0xba4], edi
mov edi, dword [ebp - 0xbb8]
mov dword [ebp - 0xba0], eax
add edi, 4
mov eax, dword [ebp - 0xbb4]
sub eax, edi
mov dword [ebp - 0xb80], esi
mov dword [ebp - 0xb98], ecx
mov dword [ebp - 0xba8], edx
cmp eax, dword [ebp - 0xbb0]
jb 0x41eba0
mov eax, dword [ebp - 0xbb0]
mov edi, dword [ebp - 0xbb8]
add eax, 4
add eax, edi
mov dword [ebp - 0xb7c], eax
lea eax, [edi + 4]
mov edi, dword [ebp - 0xb88]
cmp dword [ebp - 0xb7c], eax
jb 0x42042b
mov dword [ebp - 0xb9c], edi
mov dword [ebp - 0xb94], ecx
jmp 0x41e18b
mov dword [ebp - 0xb88], edi
mov dword [ebp - 0xb7c], 0xd0000095
mov eax, dword [ebp - 0xbac]
jmp 0x41e68b
mov eax, dword [ebp - 0xba4]
mov edi, dword [ebp - 0xb80]
mov ecx, dword [ebp - 0xb74]
mov dword [ebp - 0xb88], eax
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb98]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xba0]
mov dword [ebp - 0xb7c], 0xd0000095
jmp 0x41ef1d
mov eax, dword [ebp - 0xbb0]
mov edi, dword [ebp - 0xb98]
mov ecx, dword [ebp - 0xba0]
mov dword [ebp - 0xb88], eax
mov eax, dword [ebp - 0xba4]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xb7c], 0xd0000095
jmp 0x41ef1d
mov eax, dword [ebp - 0xbb0]
mov edi, dword [ebp - 0xb98]
mov ecx, dword [ebp - 0xba0]
mov dword [ebp - 0xb88], eax
mov eax, dword [ebp - 0xba4]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xb7c], 0xd0000095
jmp 0x41ef1d
mov eax, dword [ebp - 0xb88]
mov dword [ebp - 0xb88], eax
jmp 0x420431
mov dword [ebp - 0xb7c], 0xd0000095
jmp 0x41eb16
mov dword [ebp - 0xb7c], 0xd0000095
jmp 0x41ea6b
mov dword [ebp - 0xb7c], 0xc0000095
jmp 0x42043b
mov dword [ebp - 0xb7c], 0xc0000095
jmp 0x41e68b
mov eax, dword [ebp - 0xba0]
mov edi, dword [ebp - 0xb98]
mov ecx, dword [ebp - 0xba4]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0xb7c], 0xc0000095
jmp 0x41ef1d
mov dword [ebp - 0xb7c], 0xc0000095
jmp 0x41e69d
mov eax, dword [ebp - 0xba4]
mov edi, dword [ebp - 0xb98]
mov ecx, dword [ebp - 0xba0]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xb7c], 0xc0000095
jmp 0x41ef1d
mov dword [ebp - 0xb7c], 0xc0000095
jmp 0x41e185
mov dword [ebp - 0xb7c], 0xd0000095
mov dword [ebp - 0xb84], edx
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xb9c], esi
jmp 0x41e185
mov eax, dword [ebp - 0xbb4]
mov edi, dword [ebp - 0xba0]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xb7c], 0xd0000095
mov dword [ebp - 0xb9c], edi
jmp 0x41e18b
mov eax, dword [ebp - 0xbd0]
mov dword [ebp - 0xb7c], 0xd0000095
mov dword [ebp - 0xbd0], eax
mov dword [ebp - 0xb9c], esi
jmp 0x41e17f
mov edi, dword [ebp - 0xb9c]
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xb7c], 0xd0000001
jmp 0x41e18f
mov esi, dword [ebp - 0xb9c]
mov edi, dword [ebp - 0xbd0]
jmp 0x420698
mov edi, ebx
mov eax, dword [ebp - 0xc9c]
mov dword [ebp - 0xca0], ebx
mov dword [ebp - 0xca4], ebx
test eax, eax
je 0x4206c3
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xc9c], ebx
mov eax, dword [ebp - 0xca8]
test eax, eax
je 0x4206dc
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
je 0x4206ef
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0x420702
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xc28]
mov dword [ebp - 0xc28], ebx
mov dword [ebp - 0xc2c], eax
jmp 0x414083
cmp eax, 0xd00000e5
je 0x420741
cmp eax, 0xc004d501
je 0x420741
cmp eax, 0xd000003e
jne 0x420735
mov ebx, 0xc004f028
jmp 0x420753
mov ebx, eax
cmp ebx, 0x8007007a
jne 0x420753
jmp 0x42074e
mov ebx, edi
jmp 0x420753
cmp dword [ebp - 0xc04], 4
je 0x420753
mov ebx, 0xc004f01e
lea ecx, [ebp - 0xc2c]
call fcn.00424df9
cmp ebx, edi
je 0x4134ed
cmp ebx, 0xc004d301
je 0x4134ed
cmp ebx, 0xc004d501
je 0x4134ed
cmp ebx, 0xc004d502
je 0x4134ed
test ebx, ebx
jns 0x4134ed
cmp ebx, esi
je 0x4134ed
mov ecx, ebx
call fcn.00424ddb
jmp 0x4134ed