Function at 0x100938f0
Capabilities:
Enumerate pe sections
Enumerate process modules
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100af425
mov eax, dword fs:[0]
push eax
mov eax, 0x185c
call fcn.100a71c0
mov eax, dword [0x100c3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1768], edx
mov eax, dword [0x10214ad0]
mov esi, dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, dword [sym.imp.KERNEL32.dll_Module32Next]
test al, 1
jne 0x100940cf
or eax, 1
mov dword [0x10214ad0], eax
mov dword [ebp - 4], 0
mov ecx, dword [0x10214acc]
test cl, 1
jne 0x100939ca
or ecx, 1
mov dword [0x10214acc], ecx
lea eax, [ebp - 0x1795]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x1776]
mov dword [0x10214ac8], 0
push ecx
lea edx, [ebp - 0x177c]
mov dword [ebp - 0x177c], 0x25ff
xorps xmm0, xmm0
mov word [ebp - 0x1778], 0
push edx
mov ecx, 0x10214ac0
movq qword [0x10214ac0], xmm0
call fcn.100978d0
push 0x100b15b0
call fcn.100a63df
mov byte [ebp - 4], 0
add esp, 4
mov eax, dword [0x10214ad0]
mov ecx, dword [0x10214acc]
test cl, 2
jne 0x10093a58
or ecx, 2
mov dword [0x10214acc], ecx
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1796]
push eax
lea ecx, [ebp - 0x1785]
mov dword [0x10214a9c], 0
push ecx
lea edx, [ebp - 0x1794]
mov dword [ebp - 0x1794], 0xb8
xorps xmm0, xmm0
mov dword [ebp - 0x1790], 0xba00
push edx
mov ecx, 0x10214a94
movq qword [0x10214a94], xmm0
mov dword [ebp - 0x178c], 0xd2ff0000
mov word [ebp - 0x1788], 0xc2
mov byte [ebp - 0x1786], 0
call fcn.100978d0
push 0x100b1550
call fcn.100a63df
mov byte [ebp - 4], 0
add esp, 4
mov eax, dword [0x10214ad0]
mov ecx, dword [0x102148a0]
test ecx, ecx
jne 0x100940c0
mov eax, dword [0x10214ac4]
sub eax, dword [0x10214ac0]
mov dword [ebp - 0x18], eax
mov eax, dword [0x10214ad4]
test eax, eax
jne 0x10093c54
push eax
push 8
mov dword [ebp - 0xcb0], 0x224
call esi
mov esi, eax
lea eax, [ebp - 0xcb0]
push eax
push esi
mov dword [ebp - 0x5b0], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10093b71
lea eax, [ebp - 0xcb0]
push eax
push esi
call edi
test eax, eax
je 0x10093b71
lea eax, [ebp - 0xc90]
push eax
lea ecx, [ebp - 0x94]
call fcn.100258e0
lea eax, [ebp - 0x17c4]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x94]
call fcn.10047030
lea ecx, [ebp - 0x94]
mov edi, dword [eax]
lea eax, [ebp - 0x17c8]
push eax
call fcn.10047010
lea ecx, [ebp - 0x94]
mov esi, dword [eax]
lea eax, [ebp - 0x17cc]
push eax
call fcn.10047030
mov edx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
lea ecx, [ebp - 0x17d4]
push edi
push esi
push dword [eax]
call fcn.100471e0
add esp, 0xc
lea ecx, [ebp - 0x94]
call fcn.10025ab0
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.10093490
cmp eax, 0xa62a3b3b
je 0x10093b8c
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0
call fcn.10025890
mov esi, dword [ebp - 0x5b0]
lea eax, [ebp - 0xcb0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x10093ac0
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x10093bb0
xor eax, eax
jmp 0x10093c43
push dword [ebp - 0x5b0]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
mov edi, dword [ebp - 0xc94]
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0
call fcn.10025890
jmp 0x10093b7b
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x10093bc3
xor eax, eax
jmp 0x10093c43
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0x5b0], ecx
mov dword [ebp - 0x1774], eax
mov dword [ebp - 0x5b4], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x10093c21
nop dword [eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.10093490
mov ecx, dword [ebp - 0x5b0]
cmp eax, 0xca67b978
je 0x10093c1b
mov eax, dword [ebp - 0x1774]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x10093bf0
jmp 0x10093c21
mov dword [ebp - 0x5b4], esi
mov esi, dword [ebp - 0x5b4]
cmp esi, dword [ecx + 0x14]
jbe 0x10093c30
xor eax, eax
jmp 0x10093c43
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov edi, dword [sym.imp.KERNEL32.dll_Module32Next]
mov esi, dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [0x10214ad4], eax
push 0x40
push 0x3000
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0x102148a8
push 0xffffffffffffffff
call eax
mov eax, dword [0x10214ac4]
mov ecx, dword [0x10214ac0]
sub eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [0x10214a88]
test eax, eax
jne 0x10093e6f
mov edx, 0x811c9dc5
mov ecx, str.Wow64Transition
call fcn.10093490
mov edx, 0x811c9dc5
mov dword [ebp - 0x1774], eax
mov ecx, str.win32u.dll
call fcn.10093490
push 0
push 8
mov dword [ebp - 0x5b4], eax
mov dword [ebp - 0x868], 0x224
call esi
mov esi, eax
lea eax, [ebp - 0x868]
push eax
push esi
mov dword [ebp - 0x5b0], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10093d91
lea eax, [ebp - 0x868]
push eax
push esi
call edi
test eax, eax
je 0x10093d91
lea eax, [ebp - 0x848]
push eax
lea ecx, [ebp - 0x7c]
call fcn.100258e0
lea eax, [ebp - 0x17d8]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x7c]
call fcn.10047030
lea ecx, [ebp - 0x7c]
mov edi, dword [eax]
lea eax, [ebp - 0x17dc]
push eax
call fcn.10047010
lea ecx, [ebp - 0x7c]
mov esi, dword [eax]
lea eax, [ebp - 0x17e0]
push eax
call fcn.10047030
mov edx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
lea ecx, [ebp - 0x17e4]
push edi
push esi
push dword [eax]
call fcn.100471e0
add esp, 0xc
lea ecx, [ebp - 0x7c]
call fcn.10025ab0
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.10093490
cmp eax, dword [ebp - 0x5b4]
je 0x10093dab
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0
call fcn.10025890
mov esi, dword [ebp - 0x5b0]
lea eax, [ebp - 0x868]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x10093cf1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x10093dcb
xor eax, eax
jmp 0x10093e64
push dword [ebp - 0x5b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x84c]
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0
call fcn.10025890
jmp 0x10093d9a
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x10093dde
xor eax, eax
jmp 0x10093e64
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0x5b0], ecx
mov dword [ebp - 0x1770], eax
mov dword [ebp - 0x5b4], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x10093e42
nop word [eax + eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.10093490
mov ecx, dword [ebp - 0x5b0]
cmp eax, dword [ebp - 0x1774]
je 0x10093e3c
mov eax, dword [ebp - 0x1770]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x10093e10
jmp 0x10093e42
mov dword [ebp - 0x5b4], esi
mov esi, dword [ebp - 0x5b4]
cmp esi, dword [ecx + 0x14]
jbe 0x10093e51
xor eax, eax
jmp 0x10093e64
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov ecx, dword [0x10214ac0]
mov dword [0x10214a88], eax
mov dword [ecx + 2], eax
push dword [ebp - 0x18]
push dword [0x10214ac0]
push dword [0x102148a8]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [0x10214a98]
add esp, 0xc
sub eax, dword [0x10214a94]
mov dword [ebp - 0x18], eax
mov eax, dword [0x10214ad4]
mov dword [ebp - 0x5b8], 0
test eax, eax
jne 0x10094068
push eax
push 8
mov dword [ebp - 0xa8c], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0xa8c]
push eax
push esi
mov dword [ebp - 0x5b0], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10093f94
lea eax, [ebp - 0xa8c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x10093f94
lea eax, [ebp - 0xa6c]
push eax
lea ecx, [ebp - 0x4c]
call fcn.100258e0
lea eax, [ebp - 0x17c0]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x4c]
call fcn.10047030
lea ecx, [ebp - 0x4c]
mov edi, dword [eax]
lea eax, [ebp - 0x17f4]
push eax
call fcn.10047010
lea ecx, [ebp - 0x4c]
mov esi, dword [eax]
lea eax, [ebp - 0x17f0]
push eax
call fcn.10047030
mov edx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
lea ecx, [ebp - 0x17ec]
push edi
push esi
push dword [eax]
call fcn.100471e0
add esp, 0xc
lea ecx, [ebp - 0x4c]
call fcn.10025ab0
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.10093490
cmp eax, 0xa62a3b3b
je 0x10093fae
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call fcn.10025890
mov esi, dword [ebp - 0x5b0]
lea eax, [ebp - 0xa8c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x10093ef5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x10093fce
xor eax, eax
jmp 0x10094063
push dword [ebp - 0x5b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xa70]
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call fcn.10025890
jmp 0x10093f9d
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x10093fe1
xor eax, eax
jmp 0x10094063
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0x5b0], ecx
mov dword [ebp - 0x1774], eax
mov dword [ebp - 0x5b4], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x10094041
nop word [eax + eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.10093490
mov ecx, dword [ebp - 0x5b0]
cmp eax, 0xca67b978
je 0x1009403b
mov eax, dword [ebp - 0x1774]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x10094010
jmp 0x10094041
mov dword [ebp - 0x5b4], esi
mov esi, dword [ebp - 0x5b4]
cmp esi, dword [ecx + 0x14]
jbe 0x10094050
xor eax, eax
jmp 0x10094063
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov dword [0x10214ad4], eax
push 0x40
push 0x3000
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x5b8]
push ecx
push 0xffffffffffffffff
call eax
mov eax, dword [0x10214a98]
mov ecx, dword [0x10214a94]
sub eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [0x102148a8]
mov dword [ecx + 6], eax
push dword [ebp - 0x18]
push dword [0x10214a94]
push dword [ebp - 0x5b8]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 0x5b8]
add esp, 0xc
mov eax, dword [0x10214ad0]
mov dword [0x102148a0], ecx
mov dword [0x10214adc], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x100940d5
mov ecx, dword [0x10214adc]
mov edi, dword [sym.imp.WINTRUST.dll_WinVerifyTrust]
test al, 2
jne 0x100946a6
or eax, 2
mov dword [0x10214ad0], eax
xorps xmm0, xmm0
mov dword [ebp - 4], 6
push str.C:WindowsSysWOW64_ntdll.dll
lea ecx, [ebp - 0xc8]
movlpd qword [ebp - 0x1784], xmm0
call fcn.100258e0
lea eax, [ebp - 0x17e8]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0xc8]
call fcn.10047010
lea ecx, [ebp - 0xc8]
mov esi, dword [eax]
lea eax, [ebp - 0x17b8]
push eax
call fcn.10047030
lea ecx, [ebp - 0x1797]
push ecx
push esi
push dword [eax]
lea ecx, [ebp - 0xe0]
call fcn.10097bc0
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x5cc], 0x10
call fcn.100786c0
mov dword [ebp - 0x5c8], eax
lea eax, [ebp - 0x5cc]
mov dword [ebp - 0x5e8], eax
lea eax, [ebp - 0x600]
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x5c4], 0
push eax
push 0
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x28], 0xaac56b
mov dword [ebp - 0x24], 0x11d0cd44
mov dword [ebp - 0x20], 0xc000c28c
mov dword [ebp - 0x1c], 0xee95c24f
mov dword [ebp - 0x5d8], 0
mov dword [ebp - 0x5d0], 0
mov dword [ebp - 0x600], 0x34
mov dword [ebp - 0x5fc], 0
mov dword [ebp - 0x5f8], 0
mov dword [ebp - 0x5f4], 2
mov dword [ebp - 0x5f0], 0
mov dword [ebp - 0x5ec], 1
mov dword [ebp - 0x5e4], 1
mov dword [ebp - 0x5e0], 0
mov dword [ebp - 0x5dc], 0
mov dword [ebp - 0x5d4], 0
call edi
mov esi, eax
mov dword [ebp - 0x5e4], 2
lea eax, [ebp - 0x600]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
call edi
lea ecx, [ebp - 0xe0]
call fcn.10046f00
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 6
call fcn.10025890
test esi, esi
jne 0x10094681
push 0xb8
lea eax, [ebp - 0x228]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x228]
push 1
push 0x40
push 0x24
push str.C:WindowsSysWOW64_ntdll.dll
call fcn.1003a8b0
lea eax, [ebp - 0x1850]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x228]
call dword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____thiscall_std::basic_istream_char__struct_std::char_traits_char__::tellg_void_]
push 0
push 0
push 0
mov esi, dword [eax + 8]
add esi, dword [eax]
mov ecx, dword [eax + 0xc]
adc ecx, dword [eax + 4]
mov dword [ebp - 0x17f8], ecx
lea ecx, [ebp - 0x228]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int_]
lea eax, [ebp - 0x1798]
mov dword [ebp - 0x2c], 0
push eax
push dword [ebp - 0x17b8]
xorps xmm0, xmm0
lea ecx, [ebp - 0x34]
movq qword [ebp - 0x34], xmm0
call fcn.10097ce0
push esi
lea ecx, [ebp - 0x34]
call fcn.10097d00
push 0
push esi
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x228]
push dword [ebp - 0x34]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::read_char___long_long___int64__]
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::operator_bool_void_const]
test al, al
je 0x10094654
mov esi, dword [ebp - 0x34]
mov eax, 0x5a4d
mov dword [ebp - 0x1770], esi
cmp word [esi], ax
je 0x1009434c
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0x1780], ax
jmp 0x1009465a
mov edx, dword [esi + 0x3c]
add edx, esi
mov dword [ebp - 0x14], edx
cmp dword [edx], 0x4550
je 0x10094371
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0x1780], ax
jmp 0x1009465a
mov edi, dword [edx + 0x78]
test edi, edi
je 0x100943c5
movzx ecx, word [edx + 0x14]
add edx, 0x18
mov eax, dword [ebp - 0x14]
add ecx, edx
xor edx, edx
movzx eax, word [eax + 6]
mov dword [ebp - 0x5b0], eax
test eax, eax
je 0x100943b8
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x100943aa
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x100943b2
mov eax, dword [ebp - 0x5b0]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x10094394
mov esi, dword [ebp - 0x1770]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov edx, dword [ebp - 0x14]
add eax, edi
jmp 0x100943c7
mov eax, edi
mov edi, dword [eax + esi + 0x20]
add eax, esi
mov dword [ebp - 0x1774], eax
test edi, edi
je 0x10094421
movzx ecx, word [edx + 0x14]
xor esi, esi
movzx eax, word [edx + 6]
add ecx, 0x18
add ecx, edx
mov dword [ebp - 0x5b0], eax
test eax, eax
je 0x10094411
mov edx, dword [ecx + 0xc]
cmp edi, edx
jb 0x10094406
mov eax, dword [ecx + 8]
add eax, edx
cmp edi, eax
jb 0x1009440e
mov eax, dword [ebp - 0x5b0]
inc esi
add ecx, 0x28
cmp esi, eax
jb 0x100943f0
mov edx, dword [ebp - 0x14]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov esi, dword [ebp - 0x1770]
add eax, edi
jmp 0x10094423
mov eax, edi
mov ecx, dword [ebp - 0x1774]
add eax, esi
xor esi, esi
mov dword [ebp - 0x176c], eax
mov dword [ebp - 0x5b4], 0xffffffff
mov dword [ebp - 0x5b0], esi
cmp dword [ecx + 0x14], esi
jbe 0x100944e0
nop dword [eax]
mov edi, dword [eax + esi*4]
test edi, edi
je 0x1009449e
movzx ecx, word [edx + 0x14]
xor esi, esi
movzx eax, word [edx + 6]
add ecx, 0x18
add ecx, edx
mov dword [ebp - 0x179c], eax
test eax, eax
je 0x1009448e
mov edx, dword [ecx + 0xc]
cmp edi, edx
jb 0x10094486
mov eax, dword [ecx + 8]
add eax, edx
cmp edi, eax
jb 0x1009448e
mov eax, dword [ebp - 0x179c]
inc esi
add ecx, 0x28
cmp esi, eax
jb 0x10094470
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov esi, dword [ebp - 0x5b0]
add eax, edi
jmp 0x100944a0
xor eax, eax
mov ecx, dword [ebp - 0x1770]
mov edx, 0x811c9dc5
add ecx, eax
call fcn.10093490
cmp eax, 0xed0594da
je 0x100944da
mov eax, dword [ebp - 0x1774]
inc esi
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x5b0], esi
cmp esi, dword [eax + 0x14]
mov eax, dword [ebp - 0x176c]
jb 0x10094450
jmp 0x100944e0
mov dword [ebp - 0x5b4], esi
mov eax, dword [ebp - 0x1774]
mov ecx, dword [ebp - 0x5b4]
cmp ecx, dword [eax + 0x14]
jbe 0x10094506
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0x1780], ax
jmp 0x1009465a
mov edi, dword [eax + 0x24]
test edi, edi
je 0x10094558
mov esi, dword [ebp - 0x14]
xor edx, edx
movzx eax, word [esi + 0x14]
lea ecx, [esi + 0x18]
add ecx, eax
movzx eax, word [esi + 6]
mov dword [ebp - 0x176c], eax
test eax, eax
je 0x1009454e
nop dword [eax]
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x10094546
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x1009454e
mov eax, dword [ebp - 0x176c]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x10094530
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edi
jmp 0x1009455a
mov eax, edi
mov ecx, dword [ebp - 0x1770]
lea esi, [eax + ecx]
mov eax, dword [ebp - 0x1774]
mov dword [ebp - 0x179c], esi
mov edi, dword [eax + 0x1c]
test edi, edi
je 0x100945c9
mov ecx, dword [ebp - 0x14]
xor edx, edx
movzx eax, word [ecx + 0x14]
add ecx, 0x18
add ecx, eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 6]
mov dword [ebp - 0x176c], eax
test eax, eax
je 0x100945b9
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x100945ab
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x100945b3
mov eax, dword [ebp - 0x176c]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x10094595
mov esi, dword [ebp - 0x179c]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x1770]
add eax, edi
jmp 0x100945cb
mov eax, edi
add ecx, eax
mov eax, dword [ebp - 0x5b4]
movzx eax, word [esi + eax*2]
mov edi, dword [ecx + eax*4]
test edi, edi
je 0x1009463c
mov esi, dword [ebp - 0x14]
xor edx, edx
movzx eax, word [esi + 0x14]
lea ecx, [esi + 0x18]
add ecx, eax
movzx eax, word [esi + 6]
mov dword [ebp - 0x176c], eax
test eax, eax
je 0x1009461e
nop word [eax + eax]
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x10094616
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x1009461e
mov eax, dword [ebp - 0x176c]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x10094600
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edi
add eax, dword [ebp - 0x1770]
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0x1780], ax
jmp 0x1009465a
mov eax, edi
add eax, dword [ebp - 0x1770]
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0x1780], ax
jmp 0x1009465a
mov esi, dword [ebp - 0x1784]
mov edi, dword [ebp - 0x1780]
lea ecx, [ebp - 0x34]
call fcn.10097980
lea ecx, [ebp - 0x1b8]
call fcn.10039510
lea ecx, [ebp - 0x1b8]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
jmp 0x1009468d
mov edi, dword [ebp - 0x1780]
mov esi, dword [ebp - 0x1784]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x10214adc]
mov dword [0x10214ae0], esi
mov dword [0x10214ae4], edi
mov eax, dword [ecx + 6]
mov eax, dword [eax + 2]
mov dword [ebp - 0x1774], eax
mov eax, dword [0x10214a88]
test eax, eax
jne 0x100948af
mov edx, 0x811c9dc5
mov ecx, str.Wow64Transition
call fcn.10093490
mov edx, 0x811c9dc5
mov dword [ebp - 0x179c], eax
mov ecx, str.win32u.dll
call fcn.10093490
push 0
push 8
mov dword [ebp - 0x176c], eax
mov dword [ebp - 0xed4], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0xed4]
push eax
push esi
mov dword [ebp - 0x5b0], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x100947d4
lea eax, [ebp - 0xed4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x100947d4
lea eax, [ebp - 0xeb4]
push eax
lea ecx, [ebp - 0x64]
call fcn.100258e0
lea eax, [ebp - 0x1770]
mov dword [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x64]
call fcn.10047030
lea ecx, [ebp - 0x64]
mov edi, dword [eax]
lea eax, [ebp - 0x14]
push eax
call fcn.10047010
lea ecx, [ebp - 0x64]
mov esi, dword [eax]
lea eax, [ebp - 0x17d0]
push eax
call fcn.10047030
mov edx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
lea ecx, [ebp - 0x17a0]
push edi
push esi
push dword [eax]
call fcn.100471e0
add esp, 0xc
lea ecx, [ebp - 0x64]
call fcn.10025ab0
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.10093490
cmp eax, dword [ebp - 0x176c]
je 0x100947ee
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0xffffffff
call fcn.10025890
mov esi, dword [ebp - 0x5b0]
lea eax, [ebp - 0xed4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x10094731
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x10094811
xor eax, eax
jmp 0x100948a4
push dword [ebp - 0x5b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xeb8]
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0xffffffff
call fcn.10025890
jmp 0x100947dd
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x10094824
xor eax, eax
jmp 0x100948a4
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0x5b0], ecx
mov dword [ebp - 0x176c], eax
mov dword [ebp - 0x5b4], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x10094882
nop dword [eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.10093490
mov ecx, dword [ebp - 0x5b0]
cmp eax, dword [ebp - 0x179c]
je 0x1009487c
mov eax, dword [ebp - 0x176c]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x10094850
jmp 0x10094882
mov dword [ebp - 0x5b4], esi
mov esi, dword [ebp - 0x5b4]
cmp esi, dword [ecx + 0x14]
jbe 0x10094891
xor eax, eax
jmp 0x100948a4
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov ecx, dword [0x10214adc]
mov dword [0x10214a88], eax
cmp dword [ebp - 0x1774], eax
je 0x100948bb
xor ecx, ecx
jmp 0x100948cd
mov eax, dword [0x10214ae0]
mov dword [ecx + 1], eax
movzx eax, word [0x10214ae4]
mov dword [ecx + 0xd], eax
push 0
push 0
push 0
push 0
push 5
push dword [ebp - 0x1768]
lea eax, [ebp - 0x5bc]
push 0
push 0xffffffffffffffff
push 0
push 0x1fffff
push eax
call ecx
mov eax, dword [0x10214ab8]
mov dword [ebp - 0x5ac], 0x10007
test al, 1
jne 0x1009508f
or eax, 1
mov dword [0x10214ab8], eax
mov dword [ebp - 4], 0xb
mov ecx, dword [0x10214acc]
test cl, 1
jne 0x10094996
or ecx, 1
mov dword [0x10214acc], ecx
lea eax, [ebp - 0x1798]
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0x1776]
mov dword [0x10214ac8], 0
push ecx
lea edx, [ebp - 0x177c]
mov dword [ebp - 0x177c], 0x25ff
xorps xmm0, xmm0
mov word [ebp - 0x1778], 0
push edx
mov ecx, 0x10214ac0
movq qword [0x10214ac0], xmm0
call fcn.100978d0
push 0x100b15b0
call fcn.100a63df
mov byte [ebp - 4], 0xb
add esp, 4
mov ecx, dword [0x10214acc]
mov eax, dword [0x10214ab8]
test cl, 2
jne 0x10094a24
or ecx, 2
mov dword [0x10214acc], ecx
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x1797]
push eax
lea ecx, [ebp - 0x1785]
mov dword [0x10214a9c], 0
push ecx
lea edx, [ebp - 0x1794]
mov dword [ebp - 0x1794], 0xb8
xorps xmm0, xmm0
mov dword [ebp - 0x1790], 0xba00
push edx
mov ecx, 0x10214a94
movq qword [0x10214a94], xmm0
mov dword [ebp - 0x178c], 0xd2ff0000
mov word [ebp - 0x1788], 0xc2
mov byte [ebp - 0x1786], 0
call fcn.100978d0
push 0x100b1550
call fcn.100a63df
mov byte [ebp - 4], 0xb
add esp, 4
mov eax, dword [0x10214ab8]
mov ecx, dword [0x102148a0]
test ecx, ecx
jne 0x10095080
mov eax, dword [0x10214ac4]
sub eax, dword [0x10214ac0]
mov dword [ebp - 0x18], eax
mov eax, dword [0x10214ad4]
test eax, eax
jne 0x10094c08
push eax
push 8
mov dword [ebp - 0xed4], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0xed4]
push eax
push esi
mov dword [ebp - 0x5b0], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10094b33
lea eax, [ebp - 0xed4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x10094b33
lea eax, [ebp - 0xeb4]
push eax
lea ecx, [ebp - 0x64]
call fcn.100258e0
lea eax, [ebp - 0x17a0]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x64]
call fcn.10047030
lea ecx, [ebp - 0x64]
mov edi, dword [eax]
lea eax, [ebp - 0x17d0]
push eax
call fcn.10047010
lea ecx, [ebp - 0x64]
mov esi, dword [eax]
lea eax, [ebp - 0x17b8]
push eax
call fcn.10047030
mov edx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
lea ecx, [ebp - 0x17e8]
push edi
push esi
push dword [eax]
call fcn.100471e0
add esp, 0xc
lea ecx, [ebp - 0x64]
call fcn.10025ab0
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.10093490
cmp eax, 0xa62a3b3b
je 0x10094b4d
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0xb
call fcn.10025890
mov esi, dword [ebp - 0x5b0]
lea eax, [ebp - 0xed4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x10094a94
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x10094b6d
xor eax, eax
jmp 0x10094c03
push dword [ebp - 0x5b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xeb8]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0xb
call fcn.10025890
jmp 0x10094b3c
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x10094b80
xor eax, eax
jmp 0x10094c03
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0x5b0], ecx
mov dword [ebp - 0x1768], eax
mov dword [ebp - 0x5b8], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x10094be1
nop dword [eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.10093490
mov ecx, dword [ebp - 0x5b0]
cmp eax, 0xca67b978
je 0x10094bdb
mov eax, dword [ebp - 0x1768]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x10094bb0
jmp 0x10094be1
mov dword [ebp - 0x5b8], esi
mov esi, dword [ebp - 0x5b8]
cmp esi, dword [ecx + 0x14]
jbe 0x10094bf0
xor eax, eax
jmp 0x10094c03
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov dword [0x10214ad4], eax
push 0x40
push 0x3000
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0x102148a8
push 0xffffffffffffffff
call eax
mov eax, dword [0x10214ac4]
mov ecx, dword [0x10214ac0]
sub eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [0x10214a88]
test eax, eax
jne 0x10094e2f
mov edx, 0x811c9dc5
mov ecx, str.Wow64Transition
call fcn.10093490
mov edx, 0x811c9dc5
mov dword [ebp - 0x176c], eax
mov ecx, str.win32u.dll
call fcn.10093490
push 0
push 8
mov dword [ebp - 0x1768], eax
mov dword [ebp - 0xa8c], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0xa8c]
push eax
push esi
mov dword [ebp - 0x5b0], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10094d50
lea eax, [ebp - 0xa8c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x10094d50
nop dword [eax]
lea eax, [ebp - 0xa6c]
push eax
lea ecx, [ebp - 0x4c]
call fcn.100258e0
lea eax, [ebp - 0x17ec]
mov byte [ebp - 4], 0xf
push eax
lea ecx, [ebp - 0x4c]
call fcn.10047030
lea ecx, [ebp - 0x4c]
mov edi, dword [eax]
lea eax, [ebp - 0x17f0]
push eax
call fcn.10047010
lea ecx, [ebp - 0x4c]
mov esi, dword [eax]
lea eax, [ebp - 0x17f4]
push eax
call fcn.10047030
mov edx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
lea ecx, [ebp - 0x17c0]
push edi
push esi
push dword [eax]
call fcn.100471e0
add esp, 0xc
lea ecx, [ebp - 0x4c]
call fcn.10025ab0
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.10093490
cmp eax, dword [ebp - 0x1768]
je 0x10094d6a
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0xb
call fcn.10025890
mov esi, dword [ebp - 0x5b0]
lea eax, [ebp - 0xa8c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x10094cb0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x10094d8a
xor eax, eax
jmp 0x10094e24
push dword [ebp - 0x5b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xa70]
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0xb
call fcn.10025890
jmp 0x10094d59
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x10094d9d
xor eax, eax
jmp 0x10094e24
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0x5b0], ecx
mov dword [ebp - 0x1768], eax
mov dword [ebp - 0x5b8], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x10094e02
nop word [eax + eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.10093490
mov ecx, dword [ebp - 0x5b0]
cmp eax, dword [ebp - 0x176c]
je 0x10094dfc
mov eax, dword [ebp - 0x1768]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x10094dd0
jmp 0x10094e02
mov dword [ebp - 0x5b8], esi
mov esi, dword [ebp - 0x5b8]
cmp esi, dword [ecx + 0x14]
jbe 0x10094e11
xor eax, eax
jmp 0x10094e24
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov ecx, dword [0x10214ac0]
mov dword [0x10214a88], eax
mov dword [ecx + 2], eax
push dword [ebp - 0x18]
push dword [0x10214ac0]
push dword [0x102148a8]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [0x10214a98]
add esp, 0xc
sub eax, dword [0x10214a94]
mov dword [ebp - 0x18], eax
mov eax, dword [0x10214ad4]
mov dword [ebp - 0x5b4], 0
test eax, eax
jne 0x10095028
push eax
push 8
mov dword [ebp - 0x868], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x868]
push eax
push esi
mov dword [ebp - 0x5b0], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10094f54
lea eax, [ebp - 0x868]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x10094f54
lea eax, [ebp - 0x848]
push eax
lea ecx, [ebp - 0x7c]
call fcn.100258e0
lea eax, [ebp - 0x17e4]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0x7c]
call fcn.10047030
lea ecx, [ebp - 0x7c]
mov edi, dword [eax]
lea eax, [ebp - 0x17e0]
push eax
call fcn.10047010
lea ecx, [ebp - 0x7c]
mov esi, dword [eax]
lea eax, [ebp - 0x17dc]
push eax
call fcn.10047030
mov edx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
lea ecx, [ebp - 0x17d8]
push edi
push esi
push dword [eax]
call fcn.100471e0
add esp, 0xc
lea ecx, [ebp - 0x7c]
call fcn.10025ab0
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.10093490
cmp eax, 0xa62a3b3b
je 0x10094f6e
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0xb
call fcn.10025890
mov esi, dword [ebp - 0x5b0]
lea eax, [ebp - 0x868]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x10094eb5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x10094f8e
xor eax, eax
jmp 0x10095023
push dword [ebp - 0x5b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x84c]
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0xb
call fcn.10025890
jmp 0x10094f5d
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x10094fa1
xor eax, eax
jmp 0x10095023
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0x5b0], ecx
mov dword [ebp - 0x1768], eax
mov dword [ebp - 0x5b8], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x10095001
nop word [eax + eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.10093490
mov ecx, dword [ebp - 0x5b0]
cmp eax, 0xca67b978
je 0x10094ffb
mov eax, dword [ebp - 0x1768]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x10094fd0
jmp 0x10095001
mov dword [ebp - 0x5b8], esi
mov esi, dword [ebp - 0x5b8]
cmp esi, dword [ecx + 0x14]
jbe 0x10095010
xor eax, eax
jmp 0x10095023
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov dword [0x10214ad4], eax
push 0x40
push 0x3000
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x5b4]
push ecx
push 0xffffffffffffffff
call eax
mov eax, dword [0x10214a98]
mov ecx, dword [0x10214a94]
sub eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [0x102148a8]
mov dword [ecx + 6], eax
push dword [ebp - 0x18]
push dword [0x10214a94]
push dword [ebp - 0x5b4]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 0x5b4]
add esp, 0xc
mov eax, dword [0x10214ab8]
mov dword [0x102148a0], ecx
mov dword [0x10214ad8], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x10095095
mov ecx, dword [0x10214ad8]
test al, 2
jne 0x1009565c
or eax, 2
mov dword [0x10214ab8], eax
xorps xmm0, xmm0
mov dword [ebp - 4], 0x11
push str.C:WindowsSysWOW64_ntdll.dll
lea ecx, [ebp - 0xc8]
movlpd qword [ebp - 0x1784], xmm0
call fcn.100258e0
lea eax, [ebp - 0x17d4]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0xc8]
call fcn.10047010
lea ecx, [ebp - 0xc8]
mov esi, dword [eax]
lea eax, [ebp - 0x17cc]
push eax
call fcn.10047030
lea ecx, [ebp - 0x1796]
push ecx
push esi
push dword [eax]
lea ecx, [ebp - 0xe0]
call fcn.10097bc0
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x5cc], 0x10
call fcn.100786c0
mov edi, dword [sym.imp.WINTRUST.dll_WinVerifyTrust]
mov dword [ebp - 0x5c8], eax
lea eax, [ebp - 0x5cc]
mov dword [ebp - 0x5e8], eax
lea eax, [ebp - 0x600]
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x5c4], 0
push eax
push 0
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x28], 0xaac56b
mov dword [ebp - 0x24], 0x11d0cd44
mov dword [ebp - 0x20], 0xc000c28c
mov dword [ebp - 0x1c], 0xee95c24f
mov dword [ebp - 0x5d8], 0
mov dword [ebp - 0x5d0], 0
mov dword [ebp - 0x600], 0x34
mov dword [ebp - 0x5fc], 0
mov dword [ebp - 0x5f8], 0
mov dword [ebp - 0x5f4], 2
mov dword [ebp - 0x5f0], 0
mov dword [ebp - 0x5ec], 1
mov dword [ebp - 0x5e4], 1
mov dword [ebp - 0x5e0], 0
mov dword [ebp - 0x5dc], 0
mov dword [ebp - 0x5d4], 0
call edi
mov esi, eax
mov dword [ebp - 0x5e4], 2
lea eax, [ebp - 0x600]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
call edi
lea ecx, [ebp - 0xe0]
call fcn.10046f00
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0x11
call fcn.10025890
test esi, esi
jne 0x10095637
push 0xb8
lea eax, [ebp - 0x228]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x228]
push 1
push 0x40
push 0x24
push str.C:WindowsSysWOW64_ntdll.dll
call fcn.1003a8b0
lea eax, [ebp - 0x1850]
mov byte [ebp - 4], 0x13
push eax
lea ecx, [ebp - 0x228]
call dword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____thiscall_std::basic_istream_char__struct_std::char_traits_char__::tellg_void_]
push 0
push 0
push 0
mov esi, dword [eax + 8]
add esi, dword [eax]
mov ecx, dword [eax + 0xc]
adc ecx, dword [eax + 4]
mov dword [ebp - 0x17f8], ecx
lea ecx, [ebp - 0x228]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int_]
lea eax, [ebp - 0x1795]
mov dword [ebp - 0x2c], 0
push eax
push dword [ebp - 0x17a0]
xorps xmm0, xmm0
lea ecx, [ebp - 0x34]
movq qword [ebp - 0x34], xmm0
call fcn.10097ce0
push esi
lea ecx, [ebp - 0x34]
call fcn.10097d00
push 0
push esi
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x228]
push dword [ebp - 0x34]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::read_char___long_long___int64__]
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::operator_bool_void_const]
test al, al
je 0x1009560a
mov eax, dword [ebp - 0x34]
mov ecx, 0x5a4d
mov dword [ebp - 0x1770], eax
cmp word [eax], cx
je 0x1009530c
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0x1780], ax
jmp 0x10095610
mov edx, dword [eax + 0x3c]
add edx, eax
mov dword [ebp - 0x14], edx
cmp dword [edx], 0x4550
je 0x10095331
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0x1780], ax
jmp 0x10095610
mov edi, dword [edx + 0x78]
test edi, edi
je 0x1009537f
movzx ecx, word [edx + 0x14]
add edx, 0x18
mov esi, dword [ebp - 0x14]
add ecx, edx
xor edx, edx
movzx eax, word [esi + 6]
mov dword [ebp - 0x1768], eax
test eax, eax
je 0x10095372
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x1009536a
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x10095372
mov eax, dword [ebp - 0x1768]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x10095354
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov edx, dword [ebp - 0x14]
add eax, edi
jmp 0x10095381
mov eax, edi
mov ecx, dword [ebp - 0x1770]
add eax, ecx
mov dword [ebp - 0x1774], eax
mov edi, dword [eax + 0x20]
test edi, edi
je 0x100953e1
movzx ecx, word [edx + 0x14]
xor esi, esi
movzx eax, word [edx + 6]
add ecx, 0x18
add ecx, edx
mov dword [ebp - 0x1768], eax
test eax, eax
je 0x100953d1
nop
mov edx, dword [ecx + 0xc]
cmp edi, edx
jb 0x100953c6
mov eax, dword [ecx + 8]
add eax, edx
cmp edi, eax
jb 0x100953ce
mov eax, dword [ebp - 0x1768]
inc esi
add ecx, 0x28
cmp esi, eax
jb 0x100953b0
mov edx, dword [ebp - 0x14]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x1770]
add eax, edi
jmp 0x100953e3
mov eax, edi
add eax, ecx
mov dword [ebp - 0x5b8], 0xffffffff
mov ecx, dword [ebp - 0x1774]
xor esi, esi
mov dword [ebp - 0x176c], eax
mov dword [ebp - 0x5b0], esi
cmp dword [ecx + 0x14], esi
jbe 0x100954a0
nop dword [eax]
mov edi, dword [eax + esi*4]
test edi, edi
je 0x1009545e
movzx ecx, word [edx + 0x14]
xor esi, esi
movzx eax, word [edx + 6]
add ecx, 0x18
add ecx, edx
mov dword [ebp - 0x1768], eax
test eax, eax
je 0x1009544e
mov edx, dword [ecx + 0xc]
cmp edi, edx
jb 0x10095446
mov eax, dword [ecx + 8]
add eax, edx
cmp edi, eax
jb 0x1009544e
mov eax, dword [ebp - 0x1768]
inc esi
add ecx, 0x28
cmp esi, eax
jb 0x10095430
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov esi, dword [ebp - 0x5b0]
add eax, edi
jmp 0x10095460
xor eax, eax
mov ecx, dword [ebp - 0x1770]
mov edx, 0x811c9dc5
add ecx, eax
call fcn.10093490
cmp eax, 0x65ecaf30
je 0x1009549a
mov eax, dword [ebp - 0x1774]
inc esi
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x5b0], esi
cmp esi, dword [eax + 0x14]
mov eax, dword [ebp - 0x176c]
jb 0x10095410
jmp 0x100954a0
mov dword [ebp - 0x5b8], esi
mov eax, dword [ebp - 0x1774]
mov ecx, dword [ebp - 0x5b8]
cmp ecx, dword [eax + 0x14]
jbe 0x100954c6
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0x1780], ax
jmp 0x10095610
mov edi, dword [eax + 0x24]
test edi, edi
je 0x10095518
mov esi, dword [ebp - 0x14]
xor edx, edx
movzx eax, word [esi + 0x14]
lea ecx, [esi + 0x18]
add ecx, eax
movzx eax, word [esi + 6]
mov dword [ebp - 0x1768], eax
test eax, eax
je 0x1009550e
nop dword [eax]
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x10095506
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x1009550e
mov eax, dword [ebp - 0x1768]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x100954f0
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edi
jmp 0x1009551a
mov eax, edi
mov ecx, dword [ebp - 0x1770]
add eax, ecx
mov dword [ebp - 0x176c], eax
mov eax, dword [ebp - 0x1774]
mov edi, dword [eax + 0x1c]
test edi, edi
je 0x1009557f
mov esi, dword [ebp - 0x14]
xor edx, edx
movzx eax, word [esi + 0x14]
lea ecx, [esi + 0x18]
add ecx, eax
movzx eax, word [esi + 6]
mov dword [ebp - 0x1768], eax
test eax, eax
je 0x1009556f
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x10095567
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x1009556f
mov eax, dword [ebp - 0x1768]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x10095551
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x1770]
add eax, edi
jmp 0x10095581
mov eax, edi
mov edx, dword [ebp - 0x5b8]
add ecx, eax
mov eax, dword [ebp - 0x176c]
movzx eax, word [eax + edx*2]
mov edi, dword [ecx + eax*4]
test edi, edi
je 0x100955f2
mov esi, dword [ebp - 0x14]
xor edx, edx
movzx eax, word [esi + 0x14]
lea ecx, [esi + 0x18]
add ecx, eax
movzx eax, word [esi + 6]
mov dword [ebp - 0x1768], eax
test eax, eax
je 0x100955d4
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x100955cc
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x100955d4
mov eax, dword [ebp - 0x1768]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x100955b6
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edi
add eax, dword [ebp - 0x1770]
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0x1780], ax
jmp 0x10095610
mov eax, edi
add eax, dword [ebp - 0x1770]
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0x1780], ax
jmp 0x10095610
mov esi, dword [ebp - 0x1784]
mov edi, dword [ebp - 0x1780]
lea ecx, [ebp - 0x34]
call fcn.10097980
lea ecx, [ebp - 0x1b8]
call fcn.10039510
lea ecx, [ebp - 0x1b8]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
jmp 0x10095643
mov edi, dword [ebp - 0x1780]
mov esi, dword [ebp - 0x1784]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x10214ad8]
mov dword [0x10214ab0], esi
mov dword [0x10214ab4], edi
mov eax, dword [ecx + 6]
mov eax, dword [eax + 2]
mov dword [ebp - 0x179c], eax
mov eax, dword [0x10214a88]
test eax, eax
jne 0x10095883
mov edx, 0x811c9dc5
mov ecx, str.Wow64Transition
call fcn.10093490
mov edx, 0x811c9dc5
mov dword [ebp - 0x176c], eax
mov ecx, str.win32u.dll
call fcn.10093490
push 0
push 8
mov dword [ebp - 0x1768], eax
mov dword [ebp - 0xcb0], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0xcb0]
push eax
push esi
mov dword [ebp - 0x5b0], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x100957a8
lea eax, [ebp - 0xcb0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x100957a8
nop word [eax + eax]
lea eax, [ebp - 0xc90]
push eax
lea ecx, [ebp - 0x94]
call fcn.100258e0
lea eax, [ebp - 0x17c8]
mov dword [ebp - 4], 0x15
push eax
lea ecx, [ebp - 0x94]
call fcn.10047030
lea ecx, [ebp - 0x94]
mov edi, dword [eax]
lea eax, [ebp - 0x17c4]
push eax
call fcn.10047010
lea ecx, [ebp - 0x94]
mov esi, dword [eax]
lea eax, [ebp - 0x1774]
push eax
call fcn.10047030
mov edx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
lea ecx, [ebp - 0x1770]
push edi
push esi
push dword [eax]
call fcn.100471e0
add esp, 0xc
lea ecx, [ebp - 0x94]
call fcn.10025ab0
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.10093490
cmp eax, dword [ebp - 0x1768]
je 0x100957c2
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.10025890
mov esi, dword [ebp - 0x5b0]
lea eax, [ebp - 0xcb0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x100956f0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x100957e8
xor eax, eax
jmp 0x10095878
push dword [ebp - 0x5b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xc94]
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.10025890
jmp 0x100957b1
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x100957fb
xor eax, eax
jmp 0x10095878
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0x5b0], ecx
mov dword [ebp - 0x1768], eax
mov dword [ebp - 0x5b8], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x10095856
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.10093490
mov ecx, dword [ebp - 0x5b0]
cmp eax, dword [ebp - 0x176c]
je 0x10095850
mov eax, dword [ebp - 0x1768]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x10095824
jmp 0x10095856
mov dword [ebp - 0x5b8], esi
mov esi, dword [ebp - 0x5b8]
cmp esi, dword [ecx + 0x14]
jbe 0x10095865
xor eax, eax
jmp 0x10095878
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov ecx, dword [0x10214ad8]
mov dword [0x10214a88], eax
cmp dword [ebp - 0x179c], eax
je 0x1009588f
xor ecx, ecx
jmp 0x100958a1
mov eax, dword [0x10214ab0]
mov dword [ecx + 1], eax
movzx eax, word [0x10214ab4]
mov dword [ecx + 0xd], eax
lea eax, [ebp - 0x5ac]
push eax
push dword [ebp - 0x5bc]
call ecx
mov eax, dword [0x10214ae8]
mov dword [ebp - 0x4fc], 0x10093740
test al, 1
jne 0x1009604f
or eax, 1
mov dword [0x10214ae8], eax
mov dword [ebp - 4], 0x16
mov ecx, dword [0x10214acc]
test cl, 1
jne 0x10095955
or ecx, 1
mov dword [0x10214acc], ecx
lea eax, [ebp - 0x1798]
mov byte [ebp - 4], 0x17
push eax
lea ecx, [ebp - 0x1776]
mov dword [0x10214ac8], 0
push ecx
lea edx, [ebp - 0x177c]
mov dword [ebp - 0x177c], 0x25ff
xorps xmm0, xmm0
mov word [ebp - 0x1778], 0
push edx
mov ecx, 0x10214ac0
movq qword [0x10214ac0], xmm0
call fcn.100978d0
push 0x100b15b0
call fcn.100a63df
mov byte [ebp - 4], 0x16
add esp, 4
mov ecx, dword [0x10214acc]
mov eax, dword [0x10214ae8]
test cl, 2
jne 0x100959e3
or ecx, 2
mov dword [0x10214acc], ecx
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x1797]
push eax
lea ecx, [ebp - 0x1785]
mov dword [0x10214a9c], 0
push ecx
lea edx, [ebp - 0x1794]
mov dword [ebp - 0x1794], 0xb8
xorps xmm0, xmm0
mov dword [ebp - 0x1790], 0xba00
push edx
mov ecx, 0x10214a94
movq qword [0x10214a94], xmm0
mov dword [ebp - 0x178c], 0xd2ff0000
mov word [ebp - 0x1788], 0xc2
mov byte [ebp - 0x1786], 0
call fcn.100978d0
push 0x100b1550
call fcn.100a63df
mov byte [ebp - 4], 0x16
add esp, 4
mov eax, dword [0x10214ae8]
mov ecx, dword [0x102148a0]
test ecx, ecx
jne 0x10096040
mov eax, dword [0x10214ac4]
sub eax, dword [0x10214ac0]
mov dword [ebp - 0x18], eax
mov eax, dword [0x10214ad4]
test eax, eax
jne 0x10095bc8
push eax
push 8
mov dword [ebp - 0xed4], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0xed4]
push eax
push esi
mov dword [ebp - 0x5b0], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10095af2
lea eax, [ebp - 0xed4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x10095af2
lea eax, [ebp - 0xeb4]
push eax
lea ecx, [ebp - 0x64]
call fcn.100258e0
lea eax, [ebp - 0x17a0]
mov byte [ebp - 4], 0x19
push eax
lea ecx, [ebp - 0x64]
call fcn.10047030
lea ecx, [ebp - 0x64]
mov edi, dword [eax]
lea eax, [ebp - 0x17d0]
push eax
call fcn.10047010
lea ecx, [ebp - 0x64]
mov esi, dword [eax]
lea eax, [ebp - 0x17b8]
push eax
call fcn.10047030
mov edx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
lea ecx, [ebp - 0x17e8]
push edi
push esi
push dword [eax]
call fcn.100471e0
add esp, 0xc
lea ecx, [ebp - 0x64]
call fcn.10025ab0
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.10093490
cmp eax, 0xa62a3b3b
je 0x10095b0c
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x16
call fcn.10025890
mov esi, dword [ebp - 0x5b0]
lea eax, [ebp - 0xed4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x10095a53
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x10095b2c
xor eax, eax
jmp 0x10095bc3
push dword [ebp - 0x5b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xeb8]
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x16
call fcn.10025890
jmp 0x10095afb
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x10095b3f
xor eax, eax
jmp 0x10095bc3
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0x5b0], ecx
mov dword [ebp - 0x1768], eax
mov dword [ebp - 0x5b8], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x10095ba1
nop dword [eax + eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [edi + ecx]
call fcn.10093490
mov ecx, dword [ebp - 0x5b0]
cmp eax, 0xca67b978
je 0x10095b9b
mov eax, dword [ebp - 0x1768]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x10095b70
jmp 0x10095ba1
mov dword [ebp - 0x5b8], esi
mov esi, dword [ebp - 0x5b8]
cmp esi, dword [ecx + 0x14]
jbe 0x10095bb0
xor eax, eax
jmp 0x10095bc3
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov dword [0x10214ad4], eax
push 0x40
push 0x3000
lea ecx, [ebp - 0x18]
push ecx
push 0
push 0x102148a8
push 0xffffffffffffffff
call eax
mov eax, dword [0x10214ac4]
mov ecx, dword [0x10214ac0]
sub eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [0x10214a88]
test eax, eax
jne 0x10095def
mov edx, 0x811c9dc5
mov ecx, str.Wow64Transition
call fcn.10093490
mov edx, 0x811c9dc5
mov dword [ebp - 0x176c], eax
mov ecx, str.win32u.dll
call fcn.10093490
push 0
push 8
mov dword [ebp - 0x1768], eax
mov dword [ebp - 0xa8c], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0xa8c]
push eax
push esi
mov dword [ebp - 0x5b0], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10095d10
lea eax, [ebp - 0xa8c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x10095d10
nop dword [eax]
lea eax, [ebp - 0xa6c]
push eax
lea ecx, [ebp - 0x4c]
call fcn.100258e0
lea eax, [ebp - 0x17ec]
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0x4c]
call fcn.10047030
lea ecx, [ebp - 0x4c]
mov edi, dword [eax]
lea eax, [ebp - 0x17f0]
push eax
call fcn.10047010
lea ecx, [ebp - 0x4c]
mov esi, dword [eax]
lea eax, [ebp - 0x17f4]
push eax
call fcn.10047030
mov edx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
lea ecx, [ebp - 0x17c0]
push edi
push esi
push dword [eax]
call fcn.100471e0
add esp, 0xc
lea ecx, [ebp - 0x4c]
call fcn.10025ab0
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.10093490
cmp eax, dword [ebp - 0x1768]
je 0x10095d2a
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x16
call fcn.10025890
mov esi, dword [ebp - 0x5b0]
lea eax, [ebp - 0xa8c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x10095c70
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x10095d4a
xor eax, eax
jmp 0x10095de4
push dword [ebp - 0x5b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xa70]
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x16
call fcn.10025890
jmp 0x10095d19
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x10095d5d
xor eax, eax
jmp 0x10095de4
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0x5b0], ecx
mov dword [ebp - 0x1768], eax
mov dword [ebp - 0x5b8], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x10095dc2
nop word [eax + eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.10093490
mov ecx, dword [ebp - 0x5b0]
cmp eax, dword [ebp - 0x176c]
je 0x10095dbc
mov eax, dword [ebp - 0x1768]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x10095d90
jmp 0x10095dc2
mov dword [ebp - 0x5b8], esi
mov esi, dword [ebp - 0x5b8]
cmp esi, dword [ecx + 0x14]
jbe 0x10095dd1
xor eax, eax
jmp 0x10095de4
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov ecx, dword [0x10214ac0]
mov dword [0x10214a88], eax
mov dword [ecx + 2], eax
push dword [ebp - 0x18]
push dword [0x10214ac0]
push dword [0x102148a8]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [0x10214a98]
add esp, 0xc
sub eax, dword [0x10214a94]
mov dword [ebp - 0x18], eax
mov eax, dword [0x10214ad4]
mov dword [ebp - 0x5b4], 0
test eax, eax
jne 0x10095fe8
push eax
push 8
mov dword [ebp - 0x868], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x868]
push eax
push esi
mov dword [ebp - 0x5b0], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10095f14
lea eax, [ebp - 0x868]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x10095f14
lea eax, [ebp - 0x848]
push eax
lea ecx, [ebp - 0x7c]
call fcn.100258e0
lea eax, [ebp - 0x17e4]
mov byte [ebp - 4], 0x1b
push eax
lea ecx, [ebp - 0x7c]
call fcn.10047030
lea ecx, [ebp - 0x7c]
mov edi, dword [eax]
lea eax, [ebp - 0x17e0]
push eax
call fcn.10047010
lea ecx, [ebp - 0x7c]
mov esi, dword [eax]
lea eax, [ebp - 0x17dc]
push eax
call fcn.10047030
mov edx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
lea ecx, [ebp - 0x17d8]
push edi
push esi
push dword [eax]
call fcn.100471e0
add esp, 0xc
lea ecx, [ebp - 0x7c]
call fcn.10025ab0
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.10093490
cmp eax, 0xa62a3b3b
je 0x10095f2e
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x16
call fcn.10025890
mov esi, dword [ebp - 0x5b0]
lea eax, [ebp - 0x868]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x10095e75
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x10095f4e
xor eax, eax
jmp 0x10095fe3
push dword [ebp - 0x5b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x84c]
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x16
call fcn.10025890
jmp 0x10095f1d
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x10095f61
xor eax, eax
jmp 0x10095fe3
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0x5b0], ecx
mov dword [ebp - 0x1768], eax
mov dword [ebp - 0x5b8], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x10095fc1
nop word [eax + eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.10093490
mov ecx, dword [ebp - 0x5b0]
cmp eax, 0xca67b978
je 0x10095fbb
mov eax, dword [ebp - 0x1768]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x10095f90
jmp 0x10095fc1
mov dword [ebp - 0x5b8], esi
mov esi, dword [ebp - 0x5b8]
cmp esi, dword [ecx + 0x14]
jbe 0x10095fd0
xor eax, eax
jmp 0x10095fe3
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov dword [0x10214ad4], eax
push 0x40
push 0x3000
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x5b4]
push ecx
push 0xffffffffffffffff
call eax
mov eax, dword [0x10214a98]
mov ecx, dword [0x10214a94]
sub eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [0x102148a8]
mov dword [ecx + 6], eax
push dword [ebp - 0x18]
push dword [0x10214a94]
push dword [ebp - 0x5b4]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 0x5b4]
add esp, 0xc
mov eax, dword [0x10214ae8]
mov dword [0x102148a0], ecx
mov dword [0x10214a8c], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x10096055
mov ecx, dword [0x10214a8c]
test al, 2
jne 0x1009661c
or eax, 2
mov dword [0x10214ae8], eax
xorps xmm0, xmm0
mov dword [ebp - 4], 0x1c
push str.C:WindowsSysWOW64_ntdll.dll
lea ecx, [ebp - 0xc8]
movlpd qword [ebp - 0x1784], xmm0
call fcn.100258e0
lea eax, [ebp - 0x17d4]
mov byte [ebp - 4], 0x1d
push eax
lea ecx, [ebp - 0xc8]
call fcn.10047010
lea ecx, [ebp - 0xc8]
mov esi, dword [eax]
lea eax, [ebp - 0x17cc]
push eax
call fcn.10047030
lea ecx, [ebp - 0x1796]
push ecx
push esi
push dword [eax]
lea ecx, [ebp - 0xe0]
call fcn.10097bc0
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x5cc], 0x10
call fcn.100786c0
mov edi, dword [sym.imp.WINTRUST.dll_WinVerifyTrust]
mov dword [ebp - 0x5c8], eax
lea eax, [ebp - 0x5cc]
mov dword [ebp - 0x5e8], eax
lea eax, [ebp - 0x600]
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x5c4], 0
push eax
push 0
mov dword [ebp - 0x5c0], 0
mov dword [ebp - 0x28], 0xaac56b
mov dword [ebp - 0x24], 0x11d0cd44
mov dword [ebp - 0x20], 0xc000c28c
mov dword [ebp - 0x1c], 0xee95c24f
mov dword [ebp - 0x5d8], 0
mov dword [ebp - 0x5d0], 0
mov dword [ebp - 0x600], 0x34
mov dword [ebp - 0x5fc], 0
mov dword [ebp - 0x5f8], 0
mov dword [ebp - 0x5f4], 2
mov dword [ebp - 0x5f0], 0
mov dword [ebp - 0x5ec], 1
mov dword [ebp - 0x5e4], 1
mov dword [ebp - 0x5e0], 0
mov dword [ebp - 0x5dc], 0
mov dword [ebp - 0x5d4], 0
call edi
mov esi, eax
mov dword [ebp - 0x5e4], 2
lea eax, [ebp - 0x600]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
call edi
lea ecx, [ebp - 0xe0]
call fcn.10046f00
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 0x1c
call fcn.10025890
test esi, esi
jne 0x100965f7
push 0xb8
lea eax, [ebp - 0x228]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x228]
push 1
push 0x40
push 0x24
push str.C:WindowsSysWOW64_ntdll.dll
call fcn.1003a8b0
lea eax, [ebp - 0x1850]
mov byte [ebp - 4], 0x1e
push eax
lea ecx, [ebp - 0x228]
call dword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____thiscall_std::basic_istream_char__struct_std::char_traits_char__::tellg_void_]
push 0
push 0
push 0
mov esi, dword [eax + 8]
add esi, dword [eax]
mov ecx, dword [eax + 0xc]
adc ecx, dword [eax + 4]
mov dword [ebp - 0x17f8], ecx
lea ecx, [ebp - 0x228]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int_]
lea eax, [ebp - 0x1795]
mov dword [ebp - 0x2c], 0
push eax
push dword [ebp - 0x17a0]
xorps xmm0, xmm0
lea ecx, [ebp - 0x34]
movq qword [ebp - 0x34], xmm0
call fcn.10097ce0
push esi
lea ecx, [ebp - 0x34]
call fcn.10097d00
push 0
push esi
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x228]
push dword [ebp - 0x34]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::read_char___long_long___int64__]
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::operator_bool_void_const]
test al, al
je 0x100965ca
mov eax, dword [ebp - 0x34]
mov ecx, 0x5a4d
mov dword [ebp - 0x1770], eax
cmp word [eax], cx
je 0x100962cc
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0x1780], ax
jmp 0x100965d0
mov edx, dword [eax + 0x3c]
add edx, eax
mov dword [ebp - 0x14], edx
cmp dword [edx], 0x4550
je 0x100962f1
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0x1780], ax
jmp 0x100965d0
mov edi, dword [edx + 0x78]
test edi, edi
je 0x1009633f
movzx ecx, word [edx + 0x14]
add edx, 0x18
mov esi, dword [ebp - 0x14]
add ecx, edx
xor edx, edx
movzx eax, word [esi + 6]
mov dword [ebp - 0x1768], eax
test eax, eax
je 0x10096332
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x1009632a
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x10096332
mov eax, dword [ebp - 0x1768]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x10096314
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov edx, dword [ebp - 0x14]
add eax, edi
jmp 0x10096341
mov eax, edi
mov ecx, dword [ebp - 0x1770]
add eax, ecx
mov dword [ebp - 0x1774], eax
mov edi, dword [eax + 0x20]
test edi, edi
je 0x100963a1
movzx ecx, word [edx + 0x14]
xor esi, esi
movzx eax, word [edx + 6]
add ecx, 0x18
add ecx, edx
mov dword [ebp - 0x1768], eax
test eax, eax
je 0x10096391
nop
mov edx, dword [ecx + 0xc]
cmp edi, edx
jb 0x10096386
mov eax, dword [ecx + 8]
add eax, edx
cmp edi, eax
jb 0x1009638e
mov eax, dword [ebp - 0x1768]
inc esi
add ecx, 0x28
cmp esi, eax
jb 0x10096370
mov edx, dword [ebp - 0x14]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x1770]
add eax, edi
jmp 0x100963a3
mov eax, edi
add eax, ecx
mov dword [ebp - 0x5b8], 0xffffffff
mov ecx, dword [ebp - 0x1774]
xor esi, esi
mov dword [ebp - 0x176c], eax
mov dword [ebp - 0x5b0], esi
cmp dword [ecx + 0x14], esi
jbe 0x10096460
nop dword [eax]
mov edi, dword [eax + esi*4]
test edi, edi
je 0x1009641e
movzx ecx, word [edx + 0x14]
xor esi, esi
movzx eax, word [edx + 6]
add ecx, 0x18
add ecx, edx
mov dword [ebp - 0x1768], eax
test eax, eax
je 0x1009640e
mov edx, dword [ecx + 0xc]
cmp edi, edx
jb 0x10096406
mov eax, dword [ecx + 8]
add eax, edx
cmp edi, eax
jb 0x1009640e
mov eax, dword [ebp - 0x1768]
inc esi
add ecx, 0x28
cmp esi, eax
jb 0x100963f0
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov esi, dword [ebp - 0x5b0]
add eax, edi
jmp 0x10096420
xor eax, eax
mov ecx, dword [ebp - 0x1770]
mov edx, 0x811c9dc5
add ecx, eax
call fcn.10093490
cmp eax, 0xea61d9e4
je 0x1009645a
mov eax, dword [ebp - 0x1774]
inc esi
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x5b0], esi
cmp esi, dword [eax + 0x14]
mov eax, dword [ebp - 0x176c]
jb 0x100963d0
jmp 0x10096460
mov dword [ebp - 0x5b8], esi
mov eax, dword [ebp - 0x1774]
mov ecx, dword [ebp - 0x5b8]
cmp ecx, dword [eax + 0x14]
jbe 0x10096486
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0x1780], ax
jmp 0x100965d0
mov edi, dword [eax + 0x24]
test edi, edi
je 0x100964d8
mov esi, dword [ebp - 0x14]
xor edx, edx
movzx eax, word [esi + 0x14]
lea ecx, [esi + 0x18]
add ecx, eax
movzx eax, word [esi + 6]
mov dword [ebp - 0x1768], eax
test eax, eax
je 0x100964ce
nop dword [eax]
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x100964c6
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x100964ce
mov eax, dword [ebp - 0x1768]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x100964b0
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edi
jmp 0x100964da
mov eax, edi
mov ecx, dword [ebp - 0x1770]
add eax, ecx
mov dword [ebp - 0x176c], eax
mov eax, dword [ebp - 0x1774]
mov edi, dword [eax + 0x1c]
test edi, edi
je 0x1009653f
mov esi, dword [ebp - 0x14]
xor edx, edx
movzx eax, word [esi + 0x14]
lea ecx, [esi + 0x18]
add ecx, eax
movzx eax, word [esi + 6]
mov dword [ebp - 0x1768], eax
test eax, eax
je 0x1009652f
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x10096527
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x1009652f
mov eax, dword [ebp - 0x1768]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x10096511
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x1770]
add eax, edi
jmp 0x10096541
mov eax, edi
mov edx, dword [ebp - 0x5b8]
add ecx, eax
mov eax, dword [ebp - 0x176c]
movzx eax, word [eax + edx*2]
mov edi, dword [ecx + eax*4]
test edi, edi
je 0x100965b2
mov esi, dword [ebp - 0x14]
xor edx, edx
movzx eax, word [esi + 0x14]
lea ecx, [esi + 0x18]
add ecx, eax
movzx eax, word [esi + 6]
mov dword [ebp - 0x1768], eax
test eax, eax
je 0x10096594
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x1009658c
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x10096594
mov eax, dword [ebp - 0x1768]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x10096576
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edi
add eax, dword [ebp - 0x1770]
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0x1780], ax
jmp 0x100965d0
mov eax, edi
add eax, dword [ebp - 0x1770]
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0x1780], ax
jmp 0x100965d0
mov esi, dword [ebp - 0x1784]
mov edi, dword [ebp - 0x1780]
lea ecx, [ebp - 0x34]
call fcn.10097980
lea ecx, [ebp - 0x1b8]
call fcn.10039510
lea ecx, [ebp - 0x1b8]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
jmp 0x10096603
mov edi, dword [ebp - 0x1780]
mov esi, dword [ebp - 0x1784]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x10214a8c]
mov dword [0x10214aa8], esi
mov dword [0x10214aac], edi
mov eax, dword [ecx + 6]
mov eax, dword [eax + 2]
mov dword [ebp - 0x179c], eax
mov eax, dword [0x10214a88]
test eax, eax
jne 0x10096843
mov edx, 0x811c9dc5
mov ecx, str.Wow64Transition
call fcn.10093490
mov edx, 0x811c9dc5
mov dword [ebp - 0x176c], eax
mov ecx, str.win32u.dll
call fcn.10093490
push 0
push 8
mov dword [ebp - 0x1768], eax
mov dword [ebp - 0xcb0], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0xcb0]
push eax
push esi
mov dword [ebp - 0x5b0], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10096768
lea eax, [ebp - 0xcb0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x10096768
nop word [eax + eax]
lea eax, [ebp - 0xc90]
push eax
lea ecx, [ebp - 0x94]
call fcn.100258e0
lea eax, [ebp - 0x17c8]
mov dword [ebp - 4], 0x20
push eax
lea ecx, [ebp - 0x94]
call fcn.10047030
lea ecx, [ebp - 0x94]
mov edi, dword [eax]
lea eax, [ebp - 0x17c4]
push eax
call fcn.10047010
lea ecx, [ebp - 0x94]
mov esi, dword [eax]
lea eax, [ebp - 0x1774]
push eax
call fcn.10047030
mov edx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
lea ecx, [ebp - 0x1770]
push edi
push esi
push dword [eax]
call fcn.100471e0
add esp, 0xc
lea ecx, [ebp - 0x94]
call fcn.10025ab0
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.10093490
cmp eax, dword [ebp - 0x1768]
je 0x10096782
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.10025890
mov esi, dword [ebp - 0x5b0]
lea eax, [ebp - 0xcb0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x100966b0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x100967a8
xor eax, eax
jmp 0x10096838
push dword [ebp - 0x5b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xc94]
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.10025890
jmp 0x10096771
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x100967bb
xor eax, eax
jmp 0x10096838
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0x5b0], ecx
mov dword [ebp - 0x1768], eax
mov dword [ebp - 0x5b8], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x10096816
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.10093490
mov ecx, dword [ebp - 0x5b0]
cmp eax, dword [ebp - 0x176c]
je 0x10096810
mov eax, dword [ebp - 0x1768]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x100967e4
jmp 0x10096816
mov dword [ebp - 0x5b8], esi
mov esi, dword [ebp - 0x5b8]
cmp esi, dword [ecx + 0x14]
jbe 0x10096825
xor eax, eax
jmp 0x10096838
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov ecx, dword [0x10214a8c]
mov dword [0x10214a88], eax
cmp dword [ebp - 0x179c], eax
je 0x1009684f
xor ecx, ecx
jmp 0x10096861
mov eax, dword [0x10214aa8]
mov dword [ecx + 1], eax
movzx eax, word [0x10214aac]
mov dword [ecx + 0xd], eax
lea eax, [ebp - 0x5ac]
push eax
push dword [ebp - 0x5bc]
call ecx
mov eax, dword [0x10214abc]
test al, 1
jne 0x1009704f
or eax, 1
mov dword [0x10214abc], eax
mov dword [ebp - 4], 0x21
mov ecx, dword [0x10214acc]
test cl, 1
jne 0x10096907
or ecx, 1
mov dword [0x10214acc], ecx
lea eax, [ebp - 0x17bb]
mov byte [ebp - 4], 0x22
push eax
lea edx, [ebp - 0x177e]
mov dword [0x10214ac8], 0
push edx
xorps xmm0, xmm0
mov dword [ebp - 0x1784], 0x25ff
lea esi, [ebp - 0x1784]
movq qword [0x10214ac0], xmm0
push esi
mov ecx, 0x10214ac0
mov word [ebp - 0x1780], 0
call fcn.100978d0
push 0x100b15b0
call fcn.100a63df
mov byte [ebp - 4], 0x21
add esp, 4
mov ecx, dword [0x10214acc]
mov eax, dword [0x10214abc]
test cl, 2
jne 0x10096995
or ecx, 2
mov dword [0x10214acc], ecx
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x17ba]
push eax
lea edx, [ebp - 0x17a1]
mov dword [0x10214a9c], 0
push edx
xorps xmm0, xmm0
mov dword [ebp - 0x17b0], 0xb8
lea esi, [ebp - 0x17b0]
movq qword [0x10214a94], xmm0
push esi
mov ecx, 0x10214a94
mov dword [ebp - 0x17ac], 0xba00
mov dword [ebp - 0x17a8], 0xd2ff0000
mov word [ebp - 0x17a4], 0xc2
mov byte [ebp - 0x17a2], 0
call fcn.100978d0
push 0x100b1550
call fcn.100a63df
mov byte [ebp - 4], 0x21
add esp, 4
mov eax, dword [0x10214abc]
mov ecx, dword [0x102148a0]
test ecx, ecx
jne 0x10097040
mov eax, dword [0x10214ac4]
sub eax, dword [0x10214ac0]
mov dword [ebp - 0x14], eax
mov eax, dword [0x10214ad4]
test eax, eax
jne 0x10096b98
push eax
push 8
mov dword [ebp - 0x10f8], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x10f8]
push eax
push esi
mov dword [ebp - 0x5b4], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10096ac1
lea eax, [ebp - 0x10f8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x10096ac1
nop word [eax + eax]
lea eax, [ebp - 0x10d8]
push eax
lea ecx, [ebp - 0xf8]
call fcn.100258e0
lea eax, [ebp - 0x1820]
mov byte [ebp - 4], 0x24
push eax
lea ecx, [ebp - 0xf8]
call fcn.10047030
lea ecx, [ebp - 0xf8]
mov edi, dword [eax]
lea eax, [ebp - 0x1824]
push eax
call fcn.10047010
lea ecx, [ebp - 0xf8]
mov esi, dword [eax]
lea eax, [ebp - 0x1828]
push eax
call fcn.10047030
mov edx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
lea ecx, [ebp - 0x1804]
push edi
push esi
push dword [eax]
call fcn.100471e0
add esp, 0xc
lea ecx, [ebp - 0xf8]
call fcn.10025ab0
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.10093490
cmp eax, 0xa62a3b3b
je 0x10096adb
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0x21
call fcn.10025890
mov esi, dword [ebp - 0x5b4]
lea eax, [ebp - 0x10f8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x10096a10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x10096afe
xor eax, eax
jmp 0x10096b93
push dword [ebp - 0x5b4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x10dc]
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0x21
call fcn.10025890
jmp 0x10096aca
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x10096b11
xor eax, eax
jmp 0x10096b93
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0x5b4], ecx
mov dword [ebp - 0x1768], eax
mov dword [ebp - 0x5b8], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x10096b71
nop word [eax + eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [edi + ecx]
call fcn.10093490
mov ecx, dword [ebp - 0x5b4]
cmp eax, 0xca67b978
je 0x10096b6b
mov eax, dword [ebp - 0x1768]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x10096b40
jmp 0x10096b71
mov dword [ebp - 0x5b8], esi
mov esi, dword [ebp - 0x5b8]
cmp esi, dword [ecx + 0x14]
jbe 0x10096b80
xor eax, eax
jmp 0x10096b93
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov dword [0x10214ad4], eax
push 0x40
push 0x3000
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0x102148a8
push 0xffffffffffffffff
call eax
mov eax, dword [0x10214ac4]
mov ecx, dword [0x10214ac0]
sub eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [0x10214a88]
test eax, eax
jne 0x10096dcf
mov edx, 0x811c9dc5
mov ecx, str.Wow64Transition
call fcn.10093490
mov edx, 0x811c9dc5
mov dword [ebp - 0x176c], eax
mov ecx, str.win32u.dll
call fcn.10093490
push 0
push 8
mov dword [ebp - 0x1768], eax
mov dword [ebp - 0x131c], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x131c]
push eax
push esi
mov dword [ebp - 0x5b4], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10096cf2
lea eax, [ebp - 0x131c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x10096cf2
nop dword [eax]
lea eax, [ebp - 0x12fc]
push eax
lea ecx, [ebp - 0x110]
call fcn.100258e0
lea eax, [ebp - 0x1808]
mov byte [ebp - 4], 0x25
push eax
lea ecx, [ebp - 0x110]
call fcn.10047030
lea ecx, [ebp - 0x110]
mov edi, dword [eax]
lea eax, [ebp - 0x1810]
push eax
call fcn.10047010
lea ecx, [ebp - 0x110]
mov esi, dword [eax]
lea eax, [ebp - 0x1814]
push eax
call fcn.10047030
mov edx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
lea ecx, [ebp - 0x1818]
push edi
push esi
push dword [eax]
call fcn.100471e0
add esp, 0xc
lea ecx, [ebp - 0x110]
call fcn.10025ab0
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.10093490
cmp eax, dword [ebp - 0x1768]
je 0x10096d0c
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 0x21
call fcn.10025890
mov esi, dword [ebp - 0x5b4]
lea eax, [ebp - 0x131c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x10096c40
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x10096d2f
xor eax, eax
jmp 0x10096dc4
push dword [ebp - 0x5b4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x1300]
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 0x21
call fcn.10025890
jmp 0x10096cfb
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x10096d42
xor eax, eax
jmp 0x10096dc4
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0x5b4], ecx
mov dword [ebp - 0x1768], eax
mov dword [ebp - 0x5b8], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x10096da2
nop dword [eax + eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.10093490
mov ecx, dword [ebp - 0x5b4]
cmp eax, dword [ebp - 0x176c]
je 0x10096d9c
mov eax, dword [ebp - 0x1768]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x10096d70
jmp 0x10096da2
mov dword [ebp - 0x5b8], esi
mov esi, dword [ebp - 0x5b8]
cmp esi, dword [ecx + 0x14]
jbe 0x10096db1
xor eax, eax
jmp 0x10096dc4
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov ecx, dword [0x10214ac0]
mov dword [0x10214a88], eax
mov dword [ecx + 2], eax
push dword [ebp - 0x14]
push dword [0x10214ac0]
push dword [0x102148a8]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [0x10214a98]
add esp, 0xc
sub eax, dword [0x10214a94]
mov dword [ebp - 0x14], eax
mov eax, dword [0x10214ad4]
mov dword [ebp - 0x5b0], 0
test eax, eax
jne 0x10096fe8
push eax
push 8
mov dword [ebp - 0x1540], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x1540]
push eax
push esi
mov dword [ebp - 0x5b4], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10096f11
lea eax, [ebp - 0x1540]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x10096f11
nop word [eax + eax]
lea eax, [ebp - 0x1520]
push eax
lea ecx, [ebp - 0x128]
call fcn.100258e0
lea eax, [ebp - 0x181c]
mov byte [ebp - 4], 0x26
push eax
lea ecx, [ebp - 0x128]
call fcn.10047030
lea ecx, [ebp - 0x128]
mov edi, dword [eax]
lea eax, [ebp - 0x180c]
push eax
call fcn.10047010
lea ecx, [ebp - 0x128]
mov esi, dword [eax]
lea eax, [ebp - 0x182c]
push eax
call fcn.10047030
mov edx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
lea ecx, [ebp - 0x1830]
push edi
push esi
push dword [eax]
call fcn.100471e0
add esp, 0xc
lea ecx, [ebp - 0x128]
call fcn.10025ab0
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.10093490
cmp eax, 0xa62a3b3b
je 0x10096f2b
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 0x21
call fcn.10025890
mov esi, dword [ebp - 0x5b4]
lea eax, [ebp - 0x1540]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x10096e60
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x10096f4e
xor eax, eax
jmp 0x10096fe3
push dword [ebp - 0x5b4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x1524]
lea ecx, [ebp - 0x128]
mov byte [ebp - 4], 0x21
call fcn.10025890
jmp 0x10096f1a
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x10096f61
xor eax, eax
jmp 0x10096fe3
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0x5b4], ecx
mov dword [ebp - 0x1768], eax
mov dword [ebp - 0x5b8], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x10096fc1
nop word [eax + eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.10093490
mov ecx, dword [ebp - 0x5b4]
cmp eax, 0xca67b978
je 0x10096fbb
mov eax, dword [ebp - 0x1768]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x10096f90
jmp 0x10096fc1
mov dword [ebp - 0x5b8], esi
mov esi, dword [ebp - 0x5b8]
cmp esi, dword [ecx + 0x14]
jbe 0x10096fd0
xor eax, eax
jmp 0x10096fe3
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov dword [0x10214ad4], eax
push 0x40
push 0x3000
lea ecx, [ebp - 0x14]
push ecx
push 0
lea ecx, [ebp - 0x5b0]
push ecx
push 0xffffffffffffffff
call eax
mov eax, dword [0x10214a98]
mov ecx, dword [0x10214a94]
sub eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [0x102148a8]
mov dword [ecx + 6], eax
push dword [ebp - 0x14]
push dword [0x10214a94]
push dword [ebp - 0x5b0]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 0x5b0]
add esp, 0xc
mov eax, dword [0x10214abc]
mov dword [0x102148a0], ecx
mov dword [0x10214a90], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x10097055
mov ecx, dword [0x10214a90]
test al, 2
jne 0x10097639
or eax, 2
mov dword [0x10214abc], eax
xorps xmm0, xmm0
mov dword [ebp - 4], 0x27
push str.C:WindowsSysWOW64_ntdll.dll
lea ecx, [ebp - 0x158]
movlpd qword [ebp - 0x177c], xmm0
call fcn.100258e0
lea eax, [ebp - 0x1834]
mov byte [ebp - 4], 0x28
push eax
lea ecx, [ebp - 0x158]
call fcn.10047010
lea ecx, [ebp - 0x158]
mov esi, dword [eax]
lea eax, [ebp - 0x1800]
push eax
call fcn.10047030
lea ecx, [ebp - 0x17b9]
push ecx
push esi
push dword [eax]
lea ecx, [ebp - 0x170]
call fcn.10097bc0
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x610], 0x10
call fcn.100786c0
mov edi, dword [sym.imp.WINTRUST.dll_WinVerifyTrust]
mov dword [ebp - 0x60c], eax
lea eax, [ebp - 0x610]
mov dword [ebp - 0x62c], eax
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0xa4]
mov dword [ebp - 0x608], 0
push eax
push 0
mov dword [ebp - 0x604], 0
mov dword [ebp - 0xa4], 0xaac56b
mov dword [ebp - 0xa0], 0x11d0cd44
mov dword [ebp - 0x9c], 0xc000c28c
mov dword [ebp - 0x98], 0xee95c24f
mov dword [ebp - 0x61c], 0
mov dword [ebp - 0x614], 0
mov dword [ebp - 0x644], 0x34
mov dword [ebp - 0x640], 0
mov dword [ebp - 0x63c], 0
mov dword [ebp - 0x638], 2
mov dword [ebp - 0x634], 0
mov dword [ebp - 0x630], 1
mov dword [ebp - 0x628], 1
mov dword [ebp - 0x624], 0
mov dword [ebp - 0x620], 0
mov dword [ebp - 0x618], 0
call edi
mov esi, eax
mov dword [ebp - 0x628], 2
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0xa4]
push eax
push 0
call edi
lea ecx, [ebp - 0x170]
call fcn.10046f00
lea ecx, [ebp - 0x158]
mov byte [ebp - 4], 0x27
call fcn.10025890
test esi, esi
jne 0x10097614
push 0xb8
lea eax, [ebp - 0x2e0]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x2e0]
push 1
push 0x40
push 0x24
push str.C:WindowsSysWOW64_ntdll.dll
call fcn.1003a8b0
lea eax, [ebp - 0x1868]
mov byte [ebp - 4], 0x29
push eax
lea ecx, [ebp - 0x2e0]
call dword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____thiscall_std::basic_istream_char__struct_std::char_traits_char__::tellg_void_]
push 0
push 0
push 0
mov esi, dword [eax + 8]
add esi, dword [eax]
mov ecx, dword [eax + 0xc]
adc ecx, dword [eax + 4]
mov dword [ebp - 0x17f8], ecx
lea ecx, [ebp - 0x2e0]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int_]
lea eax, [ebp - 0x17b1]
mov dword [ebp - 0xa8], 0
push eax
push dword [ebp - 0x1800]
xorps xmm0, xmm0
lea ecx, [ebp - 0xb0]
movq qword [ebp - 0xb0], xmm0
call fcn.10097ce0
push esi
lea ecx, [ebp - 0xb0]
call fcn.10097d00
push 0
push esi
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x2e0]
push dword [ebp - 0xb0]
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______thiscall_std::basic_istream_char__struct_std::char_traits_char__::read_char___long_long___int64__]
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::operator_bool_void_const]
test al, al
je 0x100975e4
mov eax, dword [ebp - 0xb0]
mov ecx, 0x5a4d
mov dword [ebp - 0x1770], eax
cmp word [eax], cx
je 0x100972f0
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0x1778], ax
jmp 0x100975ea
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [ebp - 0x18], esi
cmp dword [esi], 0x4550
je 0x10097315
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0x1778], ax
jmp 0x100975ea
mov edi, dword [esi + 0x78]
test edi, edi
je 0x10097360
movzx ecx, word [esi + 0x14]
xor edx, edx
movzx eax, word [esi + 6]
add ecx, 0x18
add ecx, esi
mov dword [ebp - 0x1768], eax
test eax, eax
je 0x10097356
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x1009734b
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x10097353
mov eax, dword [ebp - 0x1768]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x10097335
mov esi, dword [ebp - 0x18]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edi
jmp 0x10097362
mov eax, edi
mov ecx, dword [ebp - 0x1770]
add eax, ecx
mov dword [ebp - 0x1774], eax
mov edi, dword [eax + 0x20]
test edi, edi
je 0x100973c1
movzx ecx, word [esi + 0x14]
xor edx, edx
movzx eax, word [esi + 6]
add ecx, 0x18
add ecx, esi
mov dword [ebp - 0x1768], eax
test eax, eax
je 0x100973b1
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x100973a6
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x100973ae
mov eax, dword [ebp - 0x1768]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x10097390
mov esi, dword [ebp - 0x18]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x1770]
add eax, edi
jmp 0x100973c3
mov eax, edi
lea edx, [eax + ecx]
mov dword [ebp - 0x5b8], 0xffffffff
mov ecx, dword [ebp - 0x1774]
xor eax, eax
mov dword [ebp - 0x176c], edx
mov dword [ebp - 0x5b4], eax
cmp dword [ecx + 0x14], eax
jbe 0x10097480
nop dword [eax]
mov edi, dword [edx + eax*4]
test edi, edi
je 0x1009743b
movzx ecx, word [esi + 0x14]
xor edx, edx
movzx eax, word [esi + 6]
add ecx, 0x18
add ecx, esi
mov dword [ebp - 0x1768], eax
test eax, eax
je 0x10097431
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x10097426
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x1009742e
mov eax, dword [ebp - 0x1768]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x10097410
mov esi, dword [ebp - 0x18]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edi
jmp 0x1009743d
xor eax, eax
mov ecx, dword [ebp - 0x1770]
mov edx, 0x811c9dc5
add ecx, eax
call fcn.10093490
cmp eax, 0xe06437fc
mov eax, dword [ebp - 0x5b4]
je 0x1009747a
mov ecx, dword [ebp - 0x1774]
inc eax
mov edx, dword [ebp - 0x176c]
mov dword [ebp - 0x5b4], eax
cmp eax, dword [ecx + 0x14]
jb 0x100973f0
jmp 0x10097480
mov dword [ebp - 0x5b8], eax
mov eax, dword [ebp - 0x1774]
mov ecx, dword [ebp - 0x5b8]
cmp ecx, dword [eax + 0x14]
jbe 0x100974a6
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0x1778], ax
jmp 0x100975ea
mov edi, dword [eax + 0x24]
test edi, edi
je 0x100974f1
movzx ecx, word [esi + 0x14]
xor edx, edx
movzx eax, word [esi + 6]
add ecx, 0x18
add ecx, esi
mov dword [ebp - 0x1768], eax
test eax, eax
je 0x100974e7
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x100974dc
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x100974e4
mov eax, dword [ebp - 0x1768]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x100974c6
mov esi, dword [ebp - 0x18]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edi
jmp 0x100974f3
mov eax, edi
mov ecx, dword [ebp - 0x1770]
add eax, ecx
mov dword [ebp - 0x176c], eax
mov eax, dword [ebp - 0x1774]
mov edi, dword [eax + 0x1c]
test edi, edi
je 0x10097558
movzx ecx, word [esi + 0x14]
xor edx, edx
movzx eax, word [esi + 6]
add ecx, 0x18
add ecx, esi
mov dword [ebp - 0x1768], eax
test eax, eax
je 0x10097548
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x1009753d
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x10097545
mov eax, dword [ebp - 0x1768]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x10097527
mov esi, dword [ebp - 0x18]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x1770]
add eax, edi
jmp 0x1009755a
mov eax, edi
mov edx, dword [ebp - 0x5b8]
add ecx, eax
mov eax, dword [ebp - 0x176c]
movzx eax, word [eax + edx*2]
mov edi, dword [ecx + eax*4]
test edi, edi
je 0x100975cc
movzx ecx, word [esi + 0x14]
xor edx, edx
movzx eax, word [esi + 6]
add ecx, 0x18
add ecx, esi
mov dword [ebp - 0x1768], eax
test eax, eax
je 0x100975ae
nop dword [eax]
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x100975a6
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x100975ae
mov eax, dword [ebp - 0x1768]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x10097590
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edi
add eax, dword [ebp - 0x1770]
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0x1778], ax
jmp 0x100975ea
mov eax, edi
add eax, dword [ebp - 0x1770]
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0x1778], ax
jmp 0x100975ea
mov esi, dword [ebp - 0x177c]
mov edi, dword [ebp - 0x1778]
lea ecx, [ebp - 0xb0]
call fcn.10097980
lea ecx, [ebp - 0x270]
call fcn.10039510
lea ecx, [ebp - 0x270]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
jmp 0x10097620
mov edi, dword [ebp - 0x1778]
mov esi, dword [ebp - 0x177c]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x10214a90]
mov dword [0x10214aa0], esi
mov dword [0x10214aa4], edi
mov eax, dword [ecx + 6]
mov eax, dword [eax + 2]
mov dword [ebp - 0x179c], eax
mov eax, dword [0x10214a88]
test eax, eax
jne 0x10097859
mov edx, 0x811c9dc5
mov ecx, str.Wow64Transition
call fcn.10093490
mov edx, 0x811c9dc5
mov dword [ebp - 0x176c], eax
mov ecx, str.win32u.dll
call fcn.10093490
push 0
push 8
mov dword [ebp - 0x1768], eax
mov dword [ebp - 0x1764], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x1764]
push eax
push esi
mov dword [ebp - 0x5b4], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10097788
lea eax, [ebp - 0x1764]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x10097788
nop dword [eax]
nop dword [eax + eax]
lea eax, [ebp - 0x1744]
push eax
lea ecx, [ebp - 0x140]
call fcn.100258e0
lea eax, [ebp - 0x1774]
mov dword [ebp - 4], 0x2b
push eax
lea ecx, [ebp - 0x140]
call fcn.10047030
lea ecx, [ebp - 0x140]
mov edi, dword [eax]
lea eax, [ebp - 0x1770]
push eax
call fcn.10047010
lea ecx, [ebp - 0x140]
mov esi, dword [eax]
lea eax, [ebp - 0x1838]
push eax
call fcn.10047030
mov edx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
lea ecx, [ebp - 0x17f8]
push edi
push esi
push dword [eax]
call fcn.100471e0
add esp, 0xc
lea ecx, [ebp - 0x140]
call fcn.10025ab0
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.10093490
cmp eax, dword [ebp - 0x1768]
je 0x100977a2
lea ecx, [ebp - 0x140]
mov dword [ebp - 4], 0xffffffff
call fcn.10025890
mov esi, dword [ebp - 0x5b4]
lea eax, [ebp - 0x1764]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x100976d0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x100977c8
xor eax, eax
jmp 0x1009784e
push dword [ebp - 0x5b4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x1748]
lea ecx, [ebp - 0x140]
mov dword [ebp - 4], 0xffffffff
call fcn.10025890
jmp 0x10097791
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x100977db
xor eax, eax
jmp 0x1009784e
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0x5b4], ecx
or edx, 0xffffffff
mov dword [ebp - 0x1768], eax
cmp dword [ecx + 0x14], esi
jbe 0x10097831
nop dword [eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.10093490
mov ecx, dword [ebp - 0x5b4]
cmp eax, dword [ebp - 0x176c]
je 0x1009782f
mov eax, dword [ebp - 0x1768]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x10097800
or edx, 0xffffffff
jmp 0x10097831
mov edx, esi
cmp edx, dword [ecx + 0x14]
jbe 0x1009783a
xor eax, eax
jmp 0x1009784e
mov eax, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add eax, edi
movzx eax, word [eax + edx*2]
lea eax, [ecx + eax*4]
mov eax, dword [eax + edi]
add eax, edi
mov ecx, dword [0x10214a90]
mov dword [0x10214a88], eax
cmp dword [ebp - 0x179c], eax
je 0x10097865
xor ecx, ecx
jmp 0x10097877
mov eax, dword [0x10214aa0]
mov dword [ecx + 1], eax
movzx eax, word [0x10214aa4]
mov dword [ecx + 0xd], eax
push 0
push dword [ebp - 0x5bc]
call ecx
push 0xf
push dword [ebp - 0x5bc]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp - 0x5bc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100a5f76
mov esp, ebp
pop ebp
ret