Function at 0x100032fd
Capabilities:
Check for software breakpoints
Check os version
Compute adler32 checksum
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xa8
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov esi, eax
mov eax, 0xff
mov ebx, esi
and ebx, eax
shr esi, 8
and esi, eax
mov edi, 0x1001418c
mov ebp, str.windvfs_installex
mov ecx, str.src_compat_dvfs_windvfs_v320.h
mov eax, 0x10014140
push edi
push ebp
push 0x67c
push ecx
push eax
call fcn.100013c4
add esp, 0x14
push 0x140
push esi
push ebx
push str.version_NT_d._d_windvfs_d_n
call fcn.100013c4
add esp, 0x10
push edi
push ebp
push 0x680
mov eax, str.src_compat_dvfs_windvfs_v320.h
push eax
mov eax, 0x10014140
push eax
call fcn.100013c4
add esp, 0x14
push 2
push 4
push str.compiler_GNUC_d._d_n
call fcn.100013c4
add esp, 0xc
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1000469c
mov esi, eax
mov ebx, str.NtCreateFile
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push eax
call edi
mov dword [0x10018ba4], eax
mov dword [0x10018b54], 0x100046bd
mov eax, 0x1001418c
push eax
mov eax, str.windvfs_installex
push eax
push 0x68b
mov eax, str.src_compat_dvfs_windvfs_v320.h
push eax
mov eax, 0x10014140
push eax
call fcn.100013c4
add esp, 0x14
mov eax, str.hook_api_s_old_p_new_p_n
push dword [0x10018b54]
push dword [0x10018ba4]
push ebx
push eax
mov ebp, str.hook_api_s_old_p_new_p_n
call fcn.100013c4
add esp, 0x10
mov ebx, str.NtOpenFile
push ebx
push esi
call edi
mov dword [0x10018ba8], eax
mov dword [0x10018b58], 0x1000474d
mov eax, 0x1001418c
push eax
mov eax, str.windvfs_installex
push eax
push 0x68c
mov eax, str.src_compat_dvfs_windvfs_v320.h
push eax
mov eax, 0x10014140
push eax
call fcn.100013c4
add esp, 0x14
push dword [0x10018b58]
push dword [0x10018ba8]
push ebx
push ebp
mov ebp, str.hook_api_s_old_p_new_p_n
call fcn.100013c4
add esp, 0x10
mov ebx, str.NtReadFile
push ebx
push esi
call edi
mov dword [0x10018bac], eax
mov dword [0x10018b5c], 0x100047b5
mov eax, 0x1001418c
push eax
mov eax, str.windvfs_installex
push eax
push 0x68d
mov eax, str.src_compat_dvfs_windvfs_v320.h
push eax
mov eax, 0x10014140
push eax
call fcn.100013c4
add esp, 0x14
push dword [0x10018b5c]
push dword [0x10018bac]
push ebx
push ebp
mov ebp, str.hook_api_s_old_p_new_p_n
call fcn.100013c4
add esp, 0x10
mov ebx, str.NtClose
push ebx
push esi
call edi
mov dword [0x10018bb0], eax
mov dword [0x10018b60], 0x1000483f
mov eax, 0x1001418c
push eax
mov eax, str.windvfs_installex
push eax
push 0x68e
mov eax, str.src_compat_dvfs_windvfs_v320.h
push eax
mov eax, 0x10014140
push eax
call fcn.100013c4
add esp, 0x14
push dword [0x10018b60]
push dword [0x10018bb0]
push ebx
push ebp
mov ebp, str.hook_api_s_old_p_new_p_n
call fcn.100013c4
add esp, 0x10
mov ebx, str.NtSetInformationFile
push ebx
push esi
call edi
mov dword [0x10018bb4], eax
mov dword [0x10018b64], 0x10004866
mov eax, 0x1001418c
push eax
mov eax, str.windvfs_installex
push eax
push 0x68f
mov eax, str.src_compat_dvfs_windvfs_v320.h
push eax
mov eax, 0x10014140
push eax
call fcn.100013c4
add esp, 0x14
push dword [0x10018b64]
push dword [0x10018bb4]
push ebx
push ebp
mov ebp, str.hook_api_s_old_p_new_p_n
call fcn.100013c4
add esp, 0x10
mov ebx, str.NtCreateSection
push ebx
push esi
call edi
mov dword [0x10018bb8], eax
mov dword [0x10018b68], 0x100048ac
mov eax, 0x1001418c
push eax
mov eax, str.windvfs_installex
push eax
push 0x690
mov eax, str.src_compat_dvfs_windvfs_v320.h
push eax
mov eax, 0x10014140
push eax
call fcn.100013c4
add esp, 0x14
push dword [0x10018b68]
push dword [0x10018bb8]
push ebx
push ebp
mov ebp, str.hook_api_s_old_p_new_p_n
call fcn.100013c4
add esp, 0x10
mov ebx, str.NtMapViewOfSection
push ebx
push esi
call edi
mov dword [0x10018bbc], eax
mov dword [0x10018b6c], 0x10004903
mov eax, 0x1001418c
push eax
mov eax, str.windvfs_installex
push eax
push 0x691
mov eax, str.src_compat_dvfs_windvfs_v320.h
push eax
mov eax, 0x10014140
push eax
call fcn.100013c4
add esp, 0x14
push dword [0x10018b6c]
push dword [0x10018bbc]
push ebx
push ebp
mov ebp, str.hook_api_s_old_p_new_p_n
call fcn.100013c4
add esp, 0x10
mov ebx, str.NtUnmapViewOfSection
push ebx
push esi
call edi
mov dword [0x10018bc0], eax
mov dword [0x10018b70], 0x10004975
mov eax, 0x1001418c
push eax
mov eax, str.windvfs_installex
push eax
push 0x692
mov eax, str.src_compat_dvfs_windvfs_v320.h
push eax
mov eax, 0x10014140
push eax
call fcn.100013c4
add esp, 0x14
push dword [0x10018b70]
push dword [0x10018bc0]
push ebx
push ebp
mov ebp, str.hook_api_s_old_p_new_p_n
call fcn.100013c4
add esp, 0x10
mov ebx, str.NtQueryObject
push ebx
push esi
call edi
mov dword [0x10018bc4], eax
mov dword [0x10018b74], 0x100049ab
mov eax, 0x1001418c
push eax
mov eax, str.windvfs_installex
push eax
push 0x693
mov eax, str.src_compat_dvfs_windvfs_v320.h
push eax
mov eax, 0x10014140
push eax
call fcn.100013c4
add esp, 0x14
push dword [0x10018b74]
push dword [0x10018bc4]
push ebx
push ebp
mov ebp, str.hook_api_s_old_p_new_p_n
call fcn.100013c4
add esp, 0x10
mov ebx, str.NtQuerySection
push ebx
push esi
call edi
mov dword [0x10018bc8], eax
mov dword [0x10018b78], 0x100049b1
mov eax, 0x1001418c
push eax
mov eax, str.windvfs_installex
push eax
push 0x694
mov eax, str.src_compat_dvfs_windvfs_v320.h
push eax
mov eax, 0x10014140
push eax
call fcn.100013c4
add esp, 0x14
push dword [0x10018b78]
push dword [0x10018bc8]
push ebx
push ebp
mov ebp, str.hook_api_s_old_p_new_p_n
call fcn.100013c4
add esp, 0x10
mov ebx, str.NtQueryVirtualMemory
push ebx
push esi
call edi
mov dword [0x10018bcc], eax
mov dword [0x10018b7c], 0x10004aa3
mov eax, 0x1001418c
push eax
mov eax, str.windvfs_installex
push eax
push 0x695
mov eax, str.src_compat_dvfs_windvfs_v320.h
push eax
mov eax, 0x10014140
push eax
call fcn.100013c4
add esp, 0x14
push dword [0x10018b7c]
push dword [0x10018bcc]
push ebx
push ebp
mov ebp, str.hook_api_s_old_p_new_p_n
call fcn.100013c4
add esp, 0x10
mov ebx, str.NtQueryInformationFile
push ebx
push esi
call edi
mov dword [0x10018bd0], eax
mov dword [0x10018b80], 0x10004aa9
mov eax, 0x1001418c
push eax
mov eax, str.windvfs_installex
push eax
push 0x696
mov eax, str.src_compat_dvfs_windvfs_v320.h
push eax
mov eax, 0x10014140
push eax
call fcn.100013c4
add esp, 0x14
push dword [0x10018b80]
push dword [0x10018bd0]
push ebx
push ebp
mov ebp, str.hook_api_s_old_p_new_p_n
call fcn.100013c4
add esp, 0x10
mov ebx, str.NtQueryVolumeInformationFile
push ebx
push esi
call edi
mov dword [0x10018bd4], eax
mov dword [0x10018b84], 0x10004bcc
mov eax, 0x1001418c
push eax
mov eax, str.windvfs_installex
push eax
push 0x697
mov eax, str.src_compat_dvfs_windvfs_v320.h
push eax
mov eax, 0x10014140
push eax
call fcn.100013c4
add esp, 0x14
push dword [0x10018b84]
push dword [0x10018bd4]
push ebx
push ebp
mov ebp, str.hook_api_s_old_p_new_p_n
call fcn.100013c4
add esp, 0x10
mov ebx, str.NtQueryAttributesFile
push ebx
push esi
call edi
mov dword [0x10018bd8], eax
mov dword [0x10018b88], 0x10004bd2
mov eax, 0x1001418c
push eax
mov eax, str.windvfs_installex
push eax
push 0x698
mov eax, str.src_compat_dvfs_windvfs_v320.h
push eax
mov eax, 0x10014140
push eax
call fcn.100013c4
add esp, 0x14
push dword [0x10018b88]
push dword [0x10018bd8]
push ebx
push ebp
call fcn.100013c4
add esp, 0x10
mov ebx, str.NtQueryDirectoryFile
push ebx
push esi
call edi
mov dword [0x10018bdc], eax
mov dword [0x10018b8c], 0x10004c83
mov eax, 0x1001418c
push eax
mov eax, str.windvfs_installex
push eax
push 0x699
mov eax, str.src_compat_dvfs_windvfs_v320.h
push eax
mov eax, 0x10014140
push eax
mov ebp, 0x10014140
call fcn.100013c4
add esp, 0x14
push dword [0x10018b8c]
push dword [0x10018bdc]
push ebx
mov eax, str.hook_api_s_old_p_new_p_n
push eax
call fcn.100013c4
add esp, 0x10
mov ebx, str.NtQueryDirectoryFileEx
push ebx
push esi
call edi
mov dword [0x10018be0], eax
mov dword [0x10018b90], 0x10004d19
mov eax, 0x1001418c
push eax
mov eax, str.windvfs_installex
push eax
push 0x69a
mov eax, str.src_compat_dvfs_windvfs_v320.h
push eax
push ebp
call fcn.100013c4
add esp, 0x14
push dword [0x10018b90]
push dword [0x10018be0]
push ebx
mov eax, str.hook_api_s_old_p_new_p_n
push eax
call fcn.100013c4
add esp, 0x10
mov ecx, 0x14
mov edi, 0x10018bf4
mov esi, 0x10018ba4
rep movsd dword es:[edi], dword [esi]
xor esi, esi
xor ebp, ebp
inc ebp
xor eax, eax
lock cmpxchg dword [0x10018b48], ebp
je 0x1000395d
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
cmp esi, 0x20
setae al
push eax
call edi
inc esi
xor eax, eax
lock cmpxchg dword [0x10018b48], ebp
jne 0x10003945
cmp dword [0x10018b38], 0
jne 0x10003976
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x10018b38], eax
xor ebx, ebx
xor eax, eax
xchg dword [0x10018b48], eax
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebx*4 + 0x10018b54]
test ecx, ecx
je 0x100045e9
mov eax, dword [ebx*4 + 0x10018bf4]
mov dword [esp + 0x40], eax
test eax, eax
je 0x100045e9
mov dword [esp], ecx
xor eax, eax
lock cmpxchg dword [0x10018b48], ebp
je 0x100039d1
xor edi, edi
xor eax, eax
cmp edi, 0x20
setae al
push eax
call esi
inc edi
xor eax, eax
lock cmpxchg dword [0x10018b48], ebp
jne 0x100039b9
cmp dword [0x10018b38], 0
lea edi, [esp + 0x60]
mov esi, dword [esp + 0x40]
je 0x10004649
push 0x1c
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp dword [esp + 0x70], 0x1000
jne 0x10004649
mov eax, dword [esp + 0x74]
mov ecx, 0xf0
and eax, ecx
je 0x10004649
push 0x1c
push edi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp dword [esp + 0x70], 0x1000
jne 0x10004649
mov eax, dword [esp + 0x74]
mov ecx, 0xf0
and eax, ecx
je 0x10004649
mov eax, dword [0x10018b44]
test eax, eax
je 0x10003a65
mov ecx, dword [0x10018b3c]
neg eax
xor edx, edx
cmp dword [ecx], esi
je 0x10003a5c
dec edx
add ecx, 0x2c
cmp eax, edx
jne 0x10003a4e
jmp 0x10003a65
cmp edx, 1
jne 0x10004649
mov eax, 0x10018b4c
mov eax, dword [eax]
test eax, eax
je 0x10003a79
mov ebp, dword [eax + 4]
test ebp, ebp
je 0x10003a6a
jmp 0x10003ad0
sub esp, 0x10
movaps xmm0, xmmword [0x10014090]
movups xmmword [esp], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x10004649
mov ebp, eax
add ebp, 0x20
mov dword [eax + 8], 0
xor edx, edx
mov ecx, 0x20
mov edi, ebp
mov dword [ebp], edx
mov dword [eax + 4], ebp
mov edx, ebp
add ebp, 0x20
add ecx, 0x20
cmp ecx, 0xfe1
jb 0x10003aa8
mov ecx, dword [0x10018b4c]
mov dword [eax], ecx
mov dword [0x10018b4c], eax
add ebp, 0xffffffe0
mov dword [esp + 0x3c], ebx
mov ecx, dword [ebp]
mov dword [eax + 4], ecx
inc dword [eax + 8]
mov dword [esp + 0x60], esi
mov eax, dword [esp]
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], ebp
xor eax, eax
mov byte [esp + 0x50], al
mov dword [esp + 0x4c], 0xe8
mov byte [esp + 0x38], al
mov dword [esp + 0x34], 0xe9
mov word [esp + 0x48], 0
mov dword [esp + 0x44], 0x800f
mov dword [esp + 0x6c], eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x70], eax
mov dword [esp + 0x84], ebp
mov dword [esp + 0x20], 0
xor ebx, ebx
xor eax, eax
mov edi, dword [esp + 0x60]
mov dword [esp + 0x5c], eax
movzx eax, al
lea esi, [edi + eax]
mov dword [esp + 0x88], ebx
movzx edx, bl
mov ecx, edx
mov dword [esp + 0x58], edx
add ebp, edx
mov dword [esp + 0x28], ebp
lea ecx, [edi + eax]
add ecx, 0xf
mov dword [esp + 4], ecx
mov dword [esp + 0x54], edi
add eax, edi
add eax, 0x10
mov dword [esp], eax
mov dh, 0xf0
xor ecx, ecx
mov dword [esp + 0x14], esi
mov eax, esi
mov ebx, ecx
mov dl, byte [eax]
movzx ebp, dl
cmp ebp, 0x65
jg 0x10003bb1
lea ecx, [ebp - 0x26]
cmp ecx, 0x18
ja 0x10003b9a
mov esi, 0x1010101
bt esi, ecx
jb 0x10003ba6
lea ecx, [ebp - 0x64]
cmp ecx, 2
jae 0x10003de1
mov cl, 0x40
inc eax
or cl, bl
inc dh
jne 0x10003b7c
jmp 0x10003bf5
cmp ebp, 0xef
jle 0x10003bdb
cmp ebp, 0xf0
je 0x10003bed
mov cl, 4
cmp ebp, 0xf3
je 0x10003ba8
cmp ebp, 0xf2
jne 0x10003de1
mov cl, 2
jmp 0x10003ba8
cmp ebp, 0x66
je 0x10003bf1
cmp ebp, 0x67
jne 0x10003de1
mov cl, 0x10
jmp 0x10003ba8
mov cl, 0x20
jmp 0x10003ba8
mov cl, 8
jmp 0x10003ba8
mov eax, dword [esp + 4]
mov ebx, ecx
movzx esi, bl
cmp bl, 2
mov ecx, 1
cmovb esi, ecx
mov dword [esp + 8], esi
cmp dl, 0xf
jne 0x10003c29
add eax, 2
mov ecx, dword [esp]
mov bl, byte [ecx]
mov ecx, 0x100159c8
mov esi, eax
mov dword [esp + 0x1c], ebx
mov eax, ebx
jmp 0x10003c55
mov eax, edx
and al, 0xfc
mov ecx, 0x1001597e
cmp al, 0xa0
mov esi, dword [esp]
jne 0x10003c4b
mov eax, dword [esp + 8]
test al, 0x10
jne 0x10003c45
and al, 0xe7
jmp 0x10003c47
or al, 8
mov dword [esp + 8], eax
mov dword [esp + 0x1c], 0
mov eax, edx
mov dword [esp], esi
movzx ebx, al
mov esi, ebx
shr esi, 2
movzx eax, byte [ecx + esi]
mov edi, ebx
and edi, 3
add eax, edi
movzx eax, byte [ecx + eax]
cmp eax, 0xff
mov dword [esp + 0x18], ebx
je 0x10003c8a
mov ebx, eax
xor eax, eax
test bl, bl
js 0x10003ca2
mov dword [esp + 0x10], ebx
xor ebx, ebx
jmp 0x10003cb0
mov eax, ebx
and eax, 0xfffffffd
cmp eax, 0x24
sete al
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 0x3000
jmp 0x10003cb0
and ebx, 0x7f
movzx ebx, word [ecx + ebx]
mov dword [esp + 0x10], ebx
shr ebx, 8
cmp byte [esp + 0x1c], 0
je 0x10003cd5
movzx ecx, byte [esi + str.JJJJKRJJJJOLJJJJJJJJUE_JJJEYMFJ_JJJJJJJJJJJJJJacgNJJkmJJEmJJDEJJ]
mov esi, eax
mov eax, dword [esp + 8]
test byte [edi + ecx + str.JJJJKRJJJJOLJJJJJJJJUE_JJJEYMFJ_JJJJJJJJJJJJJJacgNJJkmJJEmJJDEJJ], al
mov ecx, 0x3000
cmovne esi, ecx
mov eax, esi
test byte [esp + 0x10], 1
jne 0x10003cf5
mov ecx, eax
or ecx, 0x9000
test byte [esp + 8], 0x20
cmovne eax, ecx
mov dword [esp + 4], eax
jmp 0x10003f68
or eax, 1
mov dword [esp + 4], eax
mov ecx, dword [esp]
movzx eax, byte [ecx]
mov ecx, eax
shr ecx, 3
and ecx, 7
test ebx, ebx
mov dword [esp + 0x24], ecx
je 0x10003d2a
shl ebx, cl
test bl, bl
mov ecx, 0x3001
mov esi, eax
mov eax, dword [esp + 4]
cmovs eax, ecx
mov dword [esp + 4], eax
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dh, al
shr dh, 6
mov ebx, eax
and bl, 7
mov byte [esp + 0xf], bl
cmp byte [esp + 0x1c], 0
mov edi, dword [esp]
jne 0x10003d91
add cl, 0x27
cmp cl, 6
ja 0x10003d91
cmp dh, 3
movzx ecx, cl
lea esi, [ecx + 0x10015a6f]
movzx edi, byte [esp + 0x24]
lea ebx, [edi + ecx*8 + 0x10015a76]
cmovne ebx, esi
movzx ecx, byte [esp + 0xf]
cmovne ecx, edi
mov bl, byte [ebx]
shl bl, cl
mov esi, eax
mov eax, dword [esp + 4]
mov ecx, eax
or ecx, 0x3000
test bl, bl
mov edi, dword [esp]
cmovs eax, ecx
mov dword [esp + 4], eax
mov eax, esi
movzx ecx, byte [esp + 8]
mov dword [esp + 0x2c], ecx
test cl, 0x20
je 0x10003e05
cmp dh, 3
je 0x10003dfa
mov ecx, dword [esp + 0x18]
mov ebx, ecx
and bl, 0xfe
cmp byte [esp + 0x1c], 0
mov ecx, 0x10015b37
mov esi, 0x10015b1f
cmove ecx, esi
mov esi, 0x10015b49
mov edi, 0x10015b37
cmove esi, edi
movzx ebx, bl
cmovne ebx, dword [esp + 0x18]
cmp byte [ecx], bl
je 0x10003dec
add ecx, 2
cmp ecx, esi
jne 0x10003dd4
jmp 0x10003dfa
lea ecx, [eax + 1]
mov dword [esp], ecx
jmp 0x10003bfb
movzx ebx, byte [ecx + 1]
mov ecx, dword [esp + 0x24]
shl ebx, cl
test bl, bl
jns 0x10003e02
or dword [esp + 4], 0x9000
mov edi, dword [esp]
mov ebx, dword [esp + 0x18]
cmp byte [esp + 0x1c], 0
je 0x10003e35
lea ecx, [ebx - 0x20]
cmp ecx, 3
ja case.default.0x10003e1c
jmp dword [ecx*4 + 0x10015bac]
mov dh, 3
mov ecx, dword [esp + 0x24]
cmp cl, 4
ja 0x10003e75
cmp cl, 1
jne 0x10003e7d
jmp 0x10003e75
cmp ebx, 0x8e
je 0x10003e67
cmp ebx, 0x8c
mov ecx, dword [esp + 0x24]
je 0x10003e70
cmp dh, 3
jne 0x10003e7d
mov ecx, 0x10015b49
mov esi, 0x10015b58
jmp 0x100041fa
and al, 0x30
mov dh, 3
cmp al, 0x20
je 0x10003e75
jmp 0x10003e7d
mov ecx, dword [esp + 0x24]
cmp cl, 1
je 0x10003e75
cmp cl, 5
jbe 0x10003e7d
or dword [esp + 4], 0x11000
mov cl, byte [edi + 1]
cmp byte [esp + 0x24], 1
ja 0x10003eab
cmp ebx, 0xf7
je 0x10003ea0
cmp ebx, 0xf6
jne 0x10003eab
mov ebx, dword [esp + 0x10]
or bl, 2
jmp 0x10003ea7
mov ebx, dword [esp + 0x10]
or bl, 0x10
mov dword [esp + 0x10], ebx
cmp dh, 2
je 0x10003ed4
movzx esi, dh
cmp esi, 1
je 0x10003ed0
test esi, esi
jne 0x10003ee3
test byte [esp + 0x2c], 0x10
jne 0x10003ee7
cmp byte [esp + 0xf], 5
sete bl
shl bl, 2
jmp 0x10003ef1
mov bl, 1
jmp 0x10003ef1
test byte [esp + 0x2c], 0x10
sete bl
add bl, bl
add bl, 2
jmp 0x10003ef1
xor ebx, ebx
jmp 0x10003ef1
cmp byte [esp + 0xf], 6
sete bl
add bl, bl
mov esi, 2
test byte [esp + 0x2c], 0x10
jne 0x10003f28
cmp dh, 3
je 0x10003f28
cmp byte [esp + 0xf], 4
jne 0x10003f28
or dword [esp + 4], 2
and cl, 7
mov esi, 3
cmp cl, 5
jne 0x10003f28
and dh, 1
jne 0x10003f28
mov ecx, dword [esp]
add ecx, 2
jmp 0x10003f4a
mov ecx, dword [esp]
add ecx, esi
dec ecx
cmp bl, 4
je 0x10003f4a
movzx esi, bl
cmp esi, 2
je 0x10003f59
cmp esi, 1
jne 0x10003f63
or dword [esp + 4], 0x20
xor esi, esi
inc esi
jmp 0x10003f63
or dword [esp + 4], 0x80
mov esi, 4
jmp 0x10003f63
or dword [esp + 4], 0x40
mov esi, 2
add esi, ecx
mov dword [esp], esi
movzx ebx, byte [esp + 0x10]
test bl, 0x10
jne 0x10003fb3
xor ecx, ecx
xor eax, eax
mov dword [esp + 0x10], 0
mov ah, cl
mov dword [esp + 8], eax
test bl, 4
je 0x1000403e
test byte [esp + 4], 0x10
jne 0x10004009
test byte [esp + 4], 8
jne 0x10004032
or dword [esp + 4], 8
mov ecx, dword [esp]
movzx eax, word [ecx]
mov dword [esp + 8], eax
jmp 0x1000403a
test bl, 0x40
jne 0x10003fdc
test byte [esp + 8], 8
jne 0x10004010
or dword [esp + 4], 0x10
mov ecx, dword [esp]
mov esi, dword [ecx]
mov dword [esp + 8], esi
shr esi, 0x10
mov dword [esp + 0x10], esi
add ecx, 4
mov dword [esp], ecx
jmp 0x10003f84
test byte [esp + 8], 8
je 0x10004068
or dword [esp + 4], 0x108
mov ecx, dword [esp]
movzx eax, word [ecx]
mov dword [esp + 8], eax
add ecx, 2
mov dword [esp + 0x10], 0
jmp 0x1000409b
or dword [esp + 4], 8
jmp 0x1000403a
or dword [esp + 4], 8
mov ecx, dword [esp]
movzx eax, word [ecx]
mov dword [esp + 8], eax
add ecx, 2
mov dword [esp], ecx
mov dword [esp + 0x10], 0
jmp 0x10003f84
or dword [esp + 4], 0x800
add dword [esp], 2
test bl, 2
je 0x10004059
or dword [esp + 4], 4
mov ecx, dword [esp]
mov eax, dword [esp + 8]
mov al, byte [ecx]
mov dword [esp + 8], eax
inc ecx
mov dword [esp], ecx
test bl, 0x40
jne 0x10004068
test bl, 0x20
jne 0x10004085
mov ecx, dword [esp]
jmp 0x1000409b
mov ecx, dword [esp]
or dword [esp + 4], 0x110
mov esi, dword [ecx]
mov dword [esp + 8], esi
shr esi, 0x10
mov dword [esp + 0x10], esi
add ecx, 4
jmp 0x1000409b
or dword [esp + 4], 0x104
mov ecx, dword [esp]
mov ebx, dword [esp + 8]
mov bl, byte [ecx]
mov dword [esp + 8], ebx
inc ecx
sub ecx, dword [esp + 0x14]
mov ebx, ecx
and ebx, 0xf0
mov eax, dword [esp + 4]
and eax, 0x1000
test ebx, ebx
mov dword [esp], ecx
movzx esi, cl
mov edi, 0xf
cmove edi, esi
or eax, ebx
mov ebx, dword [esp + 0x10]
jne 0x100045f8
cmp byte [esp + 0x5c], 5
jb 0x100040f6
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x28]
add eax, 0xfffffffb
mov dword [esp + 0x35], eax
mov edi, 5
mov al, 1
mov dword [esp + 4], eax
lea eax, [esp + 0x34]
jmp 0x10004321
cmp dl, 0xe8
jne 0x10004138
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x28]
mov ecx, dword [esp + 8]
movzx edx, cl
add eax, edx
movzx ecx, ch
shl ecx, 8
shl ebx, 0x10
add eax, ecx
add eax, ebx
add eax, esi
add eax, 0xfffffffb
mov dword [esp + 0x4d], eax
mov edi, 5
mov dword [esp + 4], 0
lea eax, [esp + 0x4c]
jmp 0x10004321
mov eax, ebp
and eax, 0xfffffffd
cmp eax, 0xe9
jne 0x1000419a
mov ecx, dword [esp + 8]
movzx eax, ch
shl eax, 8
movzx ebx, cl
mov ebp, ecx
or ebx, eax
mov ecx, dword [esp + 0x10]
shl ecx, 0x10
or ecx, ebx
cmp dl, 0xeb
mov eax, ebp
movsx eax, al
cmovne eax, ecx
mov ecx, dword [esp + 0x14]
add ecx, esi
add eax, ecx
mov ecx, dword [esp + 0x54]
cmp eax, ecx
jb 0x1000420e
add ecx, 5
cmp eax, ecx
jae 0x1000420e
mov ecx, dword [esp + 0x20]
cmp ecx, eax
cmovbe ecx, eax
mov dword [esp + 0x20], ecx
jmp 0x1000427c
mov eax, ebp
and eax, 0xfffffff0
cmp eax, 0x70
sete ah
mov ebx, ebp
and ebx, 0xfffffffc
cmp ebx, 0xe0
sete al
or al, ah
jne 0x10004232
mov ecx, dword [esp + 0x1c]
and cl, 0xf0
cmp cl, 0x80
je 0x10004232
and ebp, 0xfffffffe
cmp ebp, 0xc2
sete al
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x20]
setae dl
and dl, al
mov dword [esp + 4], edx
mov eax, ecx
jmp 0x10004321
cmp dh, 3
jne 0x100042b8
mov ecx, 0x10015b58
mov esi, str.install_yuris_patch__v0.2.1__build_240818
cmp byte [ecx], bl
je 0x1000428d
add ecx, 3
cmp ecx, esi
jne 0x100041fa
jmp 0x10003e7d
sub eax, dword [esp + 0x28]
add eax, 0xfffffffb
mov dword [esp + 0x35], eax
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x20]
setae al
mov dword [esp + 4], eax
mov edi, 5
jmp 0x100040ed
mov ecx, dword [esp + 8]
movzx ebx, ch
shl ebx, 8
movzx ebp, cl
or ebp, ebx
mov ecx, dword [esp + 0x10]
shl ecx, 0x10
or ecx, ebp
test al, al
movsx eax, byte [esp + 8]
cmovne ecx, eax
mov eax, dword [esp + 0x14]
add eax, esi
add ecx, eax
mov eax, dword [esp + 0x54]
cmp ecx, eax
jb 0x100042ed
add eax, 5
cmp ecx, eax
jae 0x100042ed
mov eax, dword [esp + 0x20]
cmp eax, ecx
cmovbe eax, ecx
mov dword [esp + 0x20], eax
mov dword [esp + 4], 0
mov eax, dword [esp + 0x14]
jmp 0x10004321
mov eax, dword [esp + 8]
test byte [ecx + 1], al
je 0x10003e7d
movzx ebx, byte [ecx + 2]
mov ecx, dword [esp + 0x24]
shl ebx, cl
test bl, bl
mov ebx, dword [esp + 0x18]
mov edi, dword [esp]
js 0x10003e7d
jmp 0x10003e75
cmp ebx, 0xd5
jle 0x1000439f
cmp ebx, 0xd6
je 0x100043c5
cmp ebx, 0xf7
je 0x100043b5
cmp ebx, 0xd7
je 0x100043b5
jmp 0x10003e7d
and dl, 0xfc
cmp dl, 0xe0
je 0x100045f8
mov eax, dword [esp + 0x18]
and al, 0xf
or al, 0x80
mov byte [esp + 0x45], al
sub ecx, dword [esp + 0x28]
add ecx, 0xfffffffa
mov dword [esp + 0x46], ecx
mov edi, 6
mov dword [esp + 4], 0
lea eax, [esp + 0x44]
cmp edi, esi
je 0x10004333
mov ecx, dword [esp + 0x14]
cmp ecx, dword [esp + 0x20]
jb 0x100045f8
mov ecx, dword [esp + 0x58]
lea ebx, [edi + ecx]
cmp ebx, 0x20
ja 0x100045f8
cmp dword [esp + 0x30], 7
ja 0x100045f8
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x5c]
mov byte [esp + ecx + 0x74], dl
mov esi, edx
mov ecx, dword [esp + 0x70]
mov edx, dword [esp + 0x88]
mov byte [esp + ecx + 0x7c], dl
mov ebp, dword [esp + 0x68]
mov ecx, dword [esp + 0x70]
inc ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x70], ecx
mov ecx, dword [esp + 0x58]
add ecx, ebp
push edi
push eax
push ecx
call sub.msvcrt.dll_memcpy
mov eax, esi
add esp, 0xc
add al, byte [esp]
cmp byte [esp + 4], 0
je 0x10003b38
jmp 0x100043d5
cmp ebx, 0x50
je 0x100043b5
cmp ebx, 0xc5
je 0x10003e75
jmp 0x10003e7d
test byte [esp + 0x2c], 9
jne 0x10003e75
jmp 0x10003e7d
test byte [esp + 0x2c], 6
jne 0x10003e75
jmp 0x10003e7d
mov dword [esp + 0x28], ebp
cmp al, 4
mov ebx, dword [esp + 0x3c]
mov ebp, 1
ja 0x100044dc
mov edi, eax
movzx eax, al
mov esi, dword [esp + 0x60]
movzx ecx, byte [esi + eax]
test ecx, ecx
mov dword [esp], ecx
je 0x1000440e
cmp ecx, 0xcc
je 0x1000440e
cmp ecx, 0x90
jne 0x1000442f
mov edx, eax
mov ecx, edi
cmp cl, 4
mov ecx, dword [esp]
je 0x100044dc
cmp byte [esi + edx + 1], cl
jne 0x1000442f
inc edx
cmp edx, 4
jne 0x1000441e
jmp 0x100044dc
mov ecx, edi
cmp cl, 1
mov ecx, dword [esp]
ja 0x1000446a
test ecx, ecx
je 0x10004451
cmp ecx, 0xcc
je 0x10004451
cmp ecx, 0x90
jne 0x100045f8
mov ecx, edi
test cl, cl
mov ecx, dword [esp]
jne 0x1000446a
cmp byte [esi + eax + 1], cl
jne 0x100045f8
inc eax
cmp eax, 1
jne 0x1000445a
lea edi, [esi - 5]
push 0x1c
lea eax, [esp + 0x90]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp dword [esp + 0x9c], 0x1000
jne 0x100045f8
mov eax, dword [esp + 0xa0]
mov ecx, 0xf0
and eax, ecx
je 0x100045f8
movzx eax, byte [edi]
test eax, eax
je 0x100044bc
cmp eax, 0xcc
je 0x100044bc
cmp eax, 0x90
jne 0x100045f8
mov ecx, 0xfffffffc
cmp byte [esi + ecx], al
jne 0x100045f8
inc ecx
jne 0x100044c1
mov dword [esp + 0x6c], 1
mov ebx, dword [esp + 0x3c]
xor ebp, ebp
inc ebp
mov eax, dword [0x10018b3c]
test eax, eax
je 0x1000451b
mov ecx, dword [0x10018b40]
cmp dword [0x10018b44], ecx
jb 0x10004545
imul ecx, ecx, 0x58
push ecx
push eax
push 0
push dword [0x10018b38]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x100045fc
shl dword [0x10018b40], 1
mov dword [0x10018b3c], eax
jmp 0x10004545
mov dword [0x10018b40], 0x20
push 0x580
push 0
push dword [0x10018b38]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x10018b3c], eax
test eax, eax
je 0x100045fc
mov ecx, dword [0x10018b44]
lea edx, [ecx + 1]
mov dword [0x10018b44], edx
imul ecx, ecx, 0x2c
movsd xmm0, qword [esp + 0x60]
add eax, ecx
add eax, 0xc
movsd qword [eax - 0xc], xmm0
mov ecx, dword [esp + 0x28]
mov dword [eax - 4], ecx
mov ecx, dword [esp + 0x6c]
mov dl, byte [eax + 8]
mov dh, cl
and dh, 1
and dl, 0xf8
or dl, dh
mov byte [eax + 8], dl
mov edx, dword [eax + 0xc]
mov esi, dword [esp + 0x30]
and esi, 0xf
and edx, 0xfffffff0
or edx, esi
mov dword [eax + 0xc], edx
movups xmm0, xmmword [esp + 0x74]
movups xmmword [eax + 0x10], xmm0
test ecx, ecx
je 0x100045b0
mov edx, dword [esp + 0x40]
mov ecx, dword [edx - 5]
mov edx, dword [edx - 2]
mov dword [eax + 3], edx
jmp 0x100045bc
mov edx, dword [esp + 0x40]
mov cl, byte [edx + 4]
mov byte [eax + 4], cl
mov ecx, dword [edx]
mov dword [eax], ecx
mov eax, dword [esp + 0x28]
mov dword [ebx*4 + 0x10018ba4], eax
xor eax, eax
xchg dword [0x10018b48], eax
mov ecx, dword [ebx*4 + 0x10018bf4]
mov edx, ebp
call fcn.1000aec4
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
jne 0x10004651
inc ebx
cmp ebx, 0x14
jne 0x10003986
jmp 0x10004685
mov ebx, dword [esp + 0x3c]
mov edi, dword [esp + 0x84]
mov edx, edi
and edx, 0xfffff000
mov esi, 0x10018b4c
xor eax, eax
mov ecx, eax
mov eax, dword [esi]
test eax, eax
je 0x10004649
mov esi, eax
cmp edx, eax
jne 0x10004612
mov edx, dword [eax + 4]
mov dword [edi], edx
mov dword [eax + 4], edi
dec dword [eax + 8]
jne 0x10004649
test ecx, ecx
mov edx, dword [eax]
mov esi, 0x10018b4c
cmovne esi, ecx
mov dword [esi], edx
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
xchg dword [0x10018b48], eax
cmp ebx, 0x13
ja 0x10004685
push str.E___
push str.windvfs_installex
push 0x6a0
push str.src_compat_dvfs_windvfs_v320.h
push 0x10014140
call fcn.100013c4
add esp, 0x14
push ebx
push str.bind__d_entry_failed_n
call fcn.100013c4
add esp, 8
mov eax, dword [esp + 0xbc]
mov dword [0x10018b50], eax
push eax
call dword [eax + 8]
add esp, 4
mov ebx, eax
jmp 0x100046b0
xor ebx, ebx
push ebx
push str.error
push str.can_not_load_ntdll.dll_
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, ebx
add esp, 0xa8
pop esi
pop edi
pop ebx
pop ebp
ret