Function at 0x413047
Capabilities:
Check if file exists
Encode data using xor
Execute anti-debugging instructions
Get keyboard layout
Get number of processors
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xcf4
mov eax, dword [0x4291b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
push 0x40275c
mov dword [ebp - 0xbfc], esi
mov dword [ebp - 0xc00], ecx
mov dword [ebp - 0xbf0], edi
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x429d94], eax
test eax, eax
je 0x41360c
push 0x402784
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x429d90], eax
test eax, eax
je 0x41360c
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0xc04], eax
test eax, eax
je 0x41360c
mov ecx, esi
call fcn.00412915
test eax, eax
je 0x41360c
push 0x7f01
push ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f02
push ebx
mov dword [0x429e94], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x4027a0
push esi
mov dword [0x429e90], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
push 0x4027b4
push esi
mov dword [0x429e24], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov dword [0x429e20], eax
cmp dword [0x429e90], ebx
je 0x41360c
test eax, eax
je 0x41360c
cmp dword [0x429e24], ebx
je 0x41360c
mov ecx, dword [ebp - 0xc00]
mov edx, esi
call fcn.004208fc
mov eax, dword [ebp - 0xc00]
mov dword [0x429d88], eax
mov dword [0x429e8c], esi
mov dword [0x429d98], 0x54
mov dword [0x429da0], ebx
mov dword [0x429da4], ebx
mov dword [0x429dd4], esi
call fcn.0040cb68
call fcn.0040cbec
call fcn.00412219
lea ecx, [ebp - 0xc44]
call fcn.004235d8
mov edx, eax
lea ecx, [ebp - 0xc40]
call fcn.00420bcf
mov ecx, dword [eax]
push ecx
mov ecx, 0x42ae64
mov dword [eax], ebx
call fcn.0040ff06
push ebx
lea ecx, [ebp - 0xc40]
call fcn.0040ff06
cmp dword [ebp - 0xc44], ebx
je 0x4131c0
push dword [ebp - 0xc44]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov ecx, dword [0x42ae64]
test ecx, ecx
je 0x4131d2
mov ecx, dword [ecx + 8]
call fcn.0042374b
push ebx
push esi
push ebx
push ebx
push dword [0x42a8f0]
push dword [0x42a8ec]
push dword [0x42a8e4]
push dword [0x42a8e8]
push 0xcf0000
push 0x402234
push 0x4027c4
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x42a92c], eax
mov dword [0x429d9c], eax
test eax, eax
je 0x41360c
xor ecx, ecx
call fcn.0040fe53
mov edx, 0x42a960
mov ecx, 0x412e00
call fcn.00425e4b
test eax, eax
jns 0x41323c
mov dword [0x42a960], ebx
mov dword [0x42a964], ebx
or dword [ebp - 0xc00], 0xffffffff
mov eax, 0x80000000
cmp dword [0x42a8e4], eax
je 0x413321
cmp dword [0x42a8e8], eax
je 0x413321
push 0x2c
lea eax, [ebp - 0x56c]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0x56c]
push 0x2c
pop esi
push eax
push dword [0x42a92c]
mov dword [ebp - 0x56c], esi
call dword [sym.imp.USER32.dll_GetWindowPlacement]
test eax, eax
je 0x4132f2
mov eax, dword [0x42a8e8]
mov dword [0x429ec0], eax
sub eax, dword [ebp - 0x550]
add eax, dword [ebp - 0x548]
mov dword [0x429ec8], eax
mov eax, dword [0x42a8e4]
mov dword [0x429ec4], eax
sub eax, dword [ebp - 0x54c]
add eax, dword [ebp - 0x544]
mov dword [0x429ea8], ebx
mov dword [0x429eac], ebx
mov dword [0x429eb0], ebx
mov dword [0x429eb4], ebx
mov dword [0x429eb8], ebx
mov dword [0x429ebc], ebx
mov dword [0x429ea4], esi
mov dword [0x429ecc], eax
mov edi, dword [0x42a92c]
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
push 0x429ea4
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_SetWindowPlacement]
push esi
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
mov edi, dword [ebp - 0xbf0]
mov esi, dword [ebp - 0xbfc]
xor eax, eax
inc eax
push eax
push dword [0x42a92c]
call dword [sym.imp.SHELL32.dll_DragAcceptFiles]
lea eax, [ebp - 0x800]
push eax
push dword [0x42a92c]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [0x42ab94]
push ebx
push esi
push 0xf
push dword [0x42a92c]
neg eax
mov esi, 0x402234
push dword [ebp - 0x7f4]
sbb eax, eax
push dword [ebp - 0x7f8]
and eax, 0xfff00000
push ebx
push ebx
add eax, 0x50300104
push eax
push esi
push 0x402750
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x41360c
mov ecx, eax
call fcn.00412e6e
xor eax, eax
inc eax
push eax
push eax
push 0xda
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
xor eax, eax
inc eax
push eax
push 0x150e
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x4027d4
push ebx
push 0x1510
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x42aba0]
neg eax
push 0x401
push dword [0x42a92c]
sbb eax, eax
and eax, 0x10000000
push esi
add eax, 0x44800000
push eax
call dword [sym.imp.COMCTL32.dll_CreateStatusWindowW]
mov esi, eax
push 3
mov ecx, 0x42ae78
call fcn.00420a70
mov ecx, dword [ebp - 0x7f8]
call fcn.0040be6e
test esi, esi
je 0x41360c
mov ecx, esi
call fcn.00412f21
xor eax, eax
lea ecx, [eax + 1]
call fcn.0040f0f0
lea eax, [ebp - 0x448]
push eax
push dword [0x42adb0]
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [ebp - 0x440]
sub ecx, dword [ebp - 0x448]
call fcn.00412f5b
push ebx
push dword [0x42ab94]
push 0xc8
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [0x42a92c]
call dword [sym.imp.USER32.dll_GetDpiForWindow]
push 0x2d0
push eax
push dword [0x4292c4]
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
neg eax
push 0x429e30
mov dword [0x429e30], eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push eax
push dword [ebp - 0xc04]
mov dword [0x429e2c], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, eax
lea eax, [ebp - 0x50]
push eax
push 0x20
pop eax
push eax
push dword [ebp - 0xc04]
call dword [sym.imp.GDI32.dll_GetTextFaceW]
push esi
mov esi, dword [ebp - 0xc04]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x429e4c
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
je 0x413515
push 0x429e30
push 0x412da0
push 0x429e4c
push esi
call dword [sym.imp.GDI32.dll_EnumFontsW]
push dword [0x429e2c]
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0x429e30
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [0x429e2c], eax
jmp 0x41351a
mov eax, dword [0x429e2c]
push ebx
push eax
push 0x30
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebx
push ebx
push 0xbd
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x429e98], eax
mov eax, dword [0x429e1c]
mov dword [0x429e18], eax
call fcn.0040f4af
xor eax, eax
lea ecx, [eax + 1]
call fcn.0040f0f0
push dword [ebp + 0xc]
push dword [0x42a92c]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x429e94]
call dword [sym.imp.USER32.dll_SetCursor]
push 9
pop esi
push 0x20
pop ecx
movzx eax, word [edi]
cmp ax, cx
je 0x413591
cmp ax, si
jne 0x413596
add edi, 2
jmp 0x413584
mov edx, edi
mov dword [0x42a8e0], ebx
mov ecx, 0x4027e4
call fcn.004125d9
test eax, eax
jne 0x4135b4
inc eax
mov dword [0x42a8e0], eax
jmp 0x4135d7
mov edx, edi
mov ecx, 0x4027ec
call fcn.004125d9
test eax, eax
jne 0x4135ce
push 2
pop eax
mov dword [0x42a8e0], eax
jmp 0x4135d3
mov eax, dword [0x42a8e0]
test eax, eax
je 0x4135ef
push 0x20
add edi, 4
pop ecx
movzx eax, word [edi]
cmp ax, cx
je 0x4135ea
cmp ax, si
jne 0x4135ef
add edi, 2
jmp 0x4135dd
call fcn.00412dbd
test eax, eax
je 0x413651
mov ecx, edi
call fcn.004129de
test eax, eax
je 0x41361f
cmp eax, 2
jne 0x413755
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00426f20
leave
ret 8
mov edx, dword [ebp + 0xc]
mov ecx, edi
call fcn.00412b60
test eax, eax
je 0x413642
push ebx
push ebx
push 0x10
push dword [0x42a92c]
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
inc eax
jmp 0x41360e
mov ecx, edi
call fcn.00412d14
test al, al
jne 0x413755
cmp word [edi], bx
je 0x413755
lea edx, [ebp - 0xc3c]
mov dword [ebp - 0xc3c], ebx
mov ecx, edi
call fcn.00412625
push ebx
mov esi, 0x80
push esi
push 3
push ebx
push 3
push 0x80000000
push dword [ebp - 0xc3c]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov dword [0x429d8c], eax
cmp eax, 0xffffffff
jne 0x413729
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
jne 0x4136fb
mov edx, dword [0x42929c]
mov ecx, dword [0x42a92c]
push 0x33
push dword [ebp - 0xc3c]
push dword [0x4292b8]
call fcn.0040f89d
cmp eax, 2
jne 0x4136d7
lea ecx, [ebp - 0xc3c]
call fcn.0040caed
jmp 0x41360c
cmp eax, 6
jne 0x413720
push ebx
push esi
push 4
push ebx
push 3
push 0xc0000000
push dword [ebp - 0xc3c]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov dword [0x429d8c], eax
jmp 0x413720
mov ecx, dword [ebp - 0xc3c]
call fcn.00411831
mov ecx, dword [0x42a8cc]
test ecx, ecx
je 0x413715
call fcn.0040c1e3
mov dword [0x42a8cc], ebx
call fcn.0040f4af
cmp dword [0x429d8c], 0xffffffff
je 0x41374a
mov edx, dword [0x42a8e0]
lea ecx, [ebp - 0xc3c]
push ebx
call fcn.00410f0c
test al, al
jne 0x41374a
mov ecx, dword [ebp - 0xc3c]
call fcn.00411831
lea ecx, [ebp - 0xc3c]
call fcn.0040caed
mov eax, dword [0x42a92c]
mov dword [0x429df0], eax
lea eax, [ebp - 0xc38]
push eax
lea eax, [ebp - 0xc34]
mov dword [0x429df4], ebx
push eax
push 0xb0
push dword [0x42adac]
mov dword [0x429df8], ebx
mov dword [0x429dfc], ebx
mov dword [0x429e00], ebx
mov dword [0x429e04], ebx
mov dword [0x429e08], ebx
mov dword [0x429e0c], ebx
mov dword [0x429e10], ebx
mov dword [0x429dec], 0x28
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0xc38]
push dword [ebp - 0xc34]
push 0xb1
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0xb7
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
and eax, 0x3ff
cmp ax, 0x11
jne 0x413810
xor eax, eax
inc eax
push eax
push eax
push 0xd8
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0xc2c], ebx
mov edx, 0x42add0
mov dword [ebp - 0xc04], ebx
mov dword [ebp - 0xc28], ebx
mov dword [ebp - 0xbf0], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x41382f
mov eax, dword [0x42adcc]
mov edi, 0x403012
mov dword [ebp - 0xbfc], edi
mov ecx, 0x338
mov dword [ebp - 0xc24], 0x67
mov esi, 0xab69605e
mov dword [ebp - 0xc20], 0x10b
mov dword [ebp - 0x394], 0x20b
push 0
pop ebx
test eax, eax
jne 0x413e23
push ecx
push ebx
mov dword [ebp - 0xbe0], ebx
mov dword [ebp - 0xbd8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xbdc], eax
test eax, eax
je 0x413ea2
or dword [ebp - 0xbe4], 0xffffffff
mov edx, 0x7f1137f
add eax, 7
mov dword [ebp - 0x3a0], esi
mov dword [ebp - 0x39c], edx
mov cl, bl
mov dword [ebp - 0xbec], ebx
mov esi, ebx
mov edx, ebx
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xbe8], edi
mov dword [ebp - 0xbb8], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xbe8]
xor edx, ebx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xbe8]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xbe8]
shl edi, 8
add dword [ebp - 0xbe8], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov eax, esi
mov dword [ebp - 0xbc8], esi
add eax, 0x54969fa2
rol dword [ebp - 0xbc8], 0xa
rol eax, 5
imul eax, eax, 0x137f
add eax, dword [ebp - 0xbc8]
xor edx, eax
mov dword [ebp - 0xbc0], edx
lea eax, [edx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xbc0]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xbc0]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xbc0], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xbc0]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xbc0]
xor edx, eax
mov dword [ebp - 0xbc0], edx
mov eax, dword [ebp - 0xbc0]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xbc0]
xor eax, edx
mov dword [ebp - 0xbc0], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xbc0]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xbc0]
xor eax, edx
mov dword [ebp - 0xbc0], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xbc0]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xbc0]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0xbc0], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0xbc0]
xor eax, 0xab69605e
mov dword [ebp - 0xbc8], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xbc8]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xbc8]
xor eax, edx
mov dword [ebp - 0xbc8], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0xbc8], edx
mov edx, dword [ebp - 0xbc8]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xbc8], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xbc8]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xbc8]
xor eax, edx
mov dword [ebp - 0xbc8], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xbc8]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xbc8]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xbc8], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xbc8]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xbc8]
xor edx, dword [ebp - 0xbec]
xor eax, dword [ebp - 0xbe4]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xbc0], esi
mov esi, dword [ebp - 0xbcc]
mov dword [ebp - 0xbe4], edi
mov edi, dword [ebp - 0xbe8]
mov dword [ebp - 0xbec], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xbb8], 1
mov dword [ebp - 0xbcc], esi
mov esi, eax
mov dword [ebp - 0xbc8], eax
jne 0x4138e5
mov esi, dword [ebp - 0xbdc]
xor ebx, ebx
mov eax, ebx
mov edi, 0x338
xor cl, byte [eax + esi]
inc eax
cmp eax, edi
jb 0x413c71
movzx eax, cl
cdq
cmp eax, dword [0x403348]
jne 0x413e93
cmp edx, dword [0x40334c]
jne 0x413e93
push 0x40
push ebx
push 0x42a878
mov byte [edi + esi - 1], bl
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov edi, esi
cmp byte [esi], bl
je 0x413e03
mov edi, 0x42a878
mov dword [ebp - 0xbc0], esi
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xbc8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x413ccb
sub ecx, dword [ebp - 0xbc8]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0x413def
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xbd8], edx
cmp word [eax], cx
je 0x413d13
mov edx, 0xc000007b
mov dword [ebp - 0xbd8], edx
jmp 0x413d67
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0x413d06
add ecx, dword [edi]
mov dword [ebp - 0xbc8], ecx
cmp ecx, dword [edi]
jb 0x413d06
cmp dword [ecx], 0x4550
jne 0x413d06
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xc20]
je 0x413d4f
cmp ax, word [ebp - 0x394]
je 0x413d4f
mov edx, 0xc000000d
jmp 0x413d0b
mov eax, dword [ecx + 0x78]
mov ecx, dword [ecx + 0x7c]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0xbc8]
mov dword [edi + 0xc], ecx
mov eax, dword [eax + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbb8], ebx
test eax, eax
je 0x413de2
mov ecx, esi
mov dword [ebp - 0xbe8], esi
lea eax, [ecx + 1]
mov dword [ebp - 0xbcc], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x413d8e
sub ecx, dword [ebp - 0xbcc]
inc esi
add esi, ecx
test edx, edx
js 0x413dc7
push dword [ebp - 0xbe8]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0x413df9
mov ecx, dword [ebp - 0xbe0]
mov edx, dword [ebp - 0xbd8]
mov dword [ecx*4 + section..data], eax
mov eax, dword [ebp - 0xbb8]
inc dword [ebp - 0xbe0]
inc eax
mov dword [ebp - 0xbb8], eax
cmp eax, dword [ebp - 0xbc8]
jb 0x413d7d
add edi, 0x10
cmp byte [esi], bl
jne 0x413cbe
jmp 0x413df9
mov dword [ebp - 0xbd8], 0xc000007a
mov edi, dword [ebp - 0xbc0]
test edi, edi
je 0x413e12
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push edi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xbd8], ebx
jl 0x413ea2
mov eax, dword [0x42adcc]
inc eax
mov dword [0x42adcc], eax
xor eax, eax
mov ecx, 0x42add0
xchg dword [ecx], eax
mov eax, dword fs:[0x30]
mov edi, ebx
mov dword [ebp - 0xc1c], ebx
mov dword [ebp - 0xc18], ebx
cmp dword [eax + 0x1d4], ebx
je 0x41416a
mov esi, dword [0x429088]
mov ecx, esi
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xbc0], eax
test eax, eax
jne 0x413ee1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x413e83
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x414172
mov edi, 0x80004005
jmp 0x414172
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, ebx
mov eax, dword [esi + 0x42a878]
test eax, eax
je 0x413eb5
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x413ea4
push 0x40
push ebx
push 0x42a878
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x4011f0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x413e29
mov dword [ebp - 0xc14], ebx
mov edi, ebx
mov ecx, ebx
mov eax, ebx
mov edx, ebx
mov esi, dword [0x429098]
lea ebx, [ebp - 0xc10]
neg eax
push ebx
push ecx
sbb eax, eax
mov ecx, esi
and eax, edx
push eax
push 2
push dword [ebp - 0xbc0]
call dword [0x42b5a4]
call esi
push 0
pop ebx
test eax, eax
jne 0x413f92
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x413f7d
cmp dword [ebp - 0xc14], ebx
jne 0x413f76
push dword [ebp - 0xc10]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
lea ecx, [ebp - 0xc14]
mov dword [ebp - 0xbc8], eax
call fcn.00424fd6
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0xc14], eax
test eax, eax
je 0x413f6f
mov ecx, dword [ebp - 0xc10]
mov edx, eax
jmp 0x413eef
mov edi, 0x8007000e
jmp 0x413fa4
mov edi, 0x80004005
jmp 0x413fa4
test eax, eax
je 0x413f76
jg 0x413f87
mov edi, eax
jmp 0x413fa4
movzx edi, ax
or edi, 0x80070000
jmp 0x413fa4
mov eax, dword [ebp - 0xc14]
mov dword [ebp - 0xc14], ebx
mov dword [ebp - 0xc1c], eax
lea ecx, [ebp - 0xc14]
call fcn.00424fd6
test edi, edi
js 0x414172
mov esi, dword [0x429094]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xbc0], eax
test eax, eax
je 0x413e6c
mov dword [ebp - 0xc0c], ebx
mov edi, ebx
mov ecx, ebx
mov eax, ebx
mov edx, ebx
mov esi, dword [0x429098]
lea ebx, [ebp - 0xc08]
neg eax
push ebx
push ecx
sbb eax, eax
mov ecx, esi
and eax, edx
push eax
push 2
push dword [ebp - 0xbc0]
call dword [0x42b5a4]
call esi
push 0
pop ebx
test eax, eax
jne 0x41408d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x414078
cmp dword [ebp - 0xc0c], ebx
jne 0x414071
push dword [ebp - 0xc08]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
lea ecx, [ebp - 0xc0c]
mov dword [ebp - 0xbc8], eax
call fcn.00424fd6
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0xc0c], eax
test eax, eax
je 0x41406a
mov ecx, dword [ebp - 0xc08]
mov edx, eax
jmp 0x413fea
mov edi, 0x8007000e
jmp 0x41409f
mov edi, 0x80004005
jmp 0x41409f
test eax, eax
je 0x414071
jg 0x414082
mov edi, eax
jmp 0x41409f
movzx edi, ax
or edi, 0x80070000
jmp 0x41409f
mov eax, dword [ebp - 0xc0c]
mov dword [ebp - 0xc0c], ebx
mov dword [ebp - 0xc18], eax
lea ecx, [ebp - 0xc0c]
call fcn.00424fd6
test edi, edi
js 0x414172
mov eax, dword [ebp - 0xc1c]
test eax, eax
je 0x41416a
mov ecx, 0x402bf8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4140ee
test dx, dx
je 0x4140e7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4140ee
add eax, 4
add ecx, 4
test dx, dx
jne 0x4140c5
xor esi, esi
mov eax, ebx
inc esi
jmp 0x4140f5
sbb eax, eax
xor esi, esi
inc esi
or eax, esi
test eax, eax
jne 0x41416a
mov eax, dword [ebp - 0xc18]
test eax, eax
je 0x41416a
mov ecx, 0x402c08
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41412e
test dx, dx
je 0x41412a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41412e
add eax, 4
add ecx, 4
test dx, dx
jne 0x414108
mov eax, ebx
jmp 0x414132
sbb eax, eax
or eax, esi
test eax, eax
jne 0x41416a
push 4
lea eax, [ebp - 0xbf4]
mov dword [ebp - 0xbf4], ebx
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
je 0x413e6c
test byte [ebp - 0xbf4], 0xf
jne 0x41416a
xor eax, eax
inc eax
jmp 0x41416c
mov eax, ebx
mov dword [ebp - 0xbf0], eax
lea ecx, [ebp - 0xc18]
call fcn.00424fd6
lea ecx, [ebp - 0xc1c]
call fcn.00424fd6
test edi, edi
jns 0x414192
mov dword [ebp - 0xbf0], ebx
push 4
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov esi, eax
lea ecx, [ebp - 0xc28]
mov dword [ebp - 0xbc0], esi
call fcn.00424fb9
test esi, esi
jne 0x414273
mov dword [ebp - 0xc28], ebx
mov dword [ebp - 0xbc8], 0x8007000e
mov eax, dword [ebp - 0xbf4]
mov dword [ebp - 0xc04], eax
xor ebx, ebx
mov edx, 0x42add0
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x4141da
mov eax, dword [0x42adcc]
push 0
pop ebx
test eax, eax
jle 0x414237
sub eax, 1
mov dword [0x42adcc], eax
jne 0x414237
mov edi, ebx
mov eax, dword [edi + 0x42a878]
test eax, eax
je 0x414210
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0x4141ff
push 0x40
push ebx
push 0x42a878
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x4011f0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0x42add0
xchg dword [ecx], eax
lea ecx, [ebp - 0xc28]
call fcn.00424fb9
mov eax, dword [ebp - 0xbc8]
mov esi, 0xc004f012
lea edi, [esi + 0x15]
test eax, eax
jns 0x420895
cmp eax, 0xd0000034
jne 0x420869
mov ebx, esi
jmp 0x4208a3
xor eax, eax
mov dword [ebp - 0xc28], esi
lea edi, [ebp - 0xcc8]
mov dword [ebp - 0xcb4], ebx
stosd dword es:[edi], eax
mov esi, ebx
mov dword [ebp - 0xbb8], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xbe8], 0x38
test eax, eax
je 0x4142e1
mov edi, eax
mov dword [ebp - 0xbcc], edi
push 0x28
pop ecx
mov esi, 0x429788
rep movsd dword es:[edi], dword [esi]
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, dword [ebp - 0xbcc]
test eax, eax
jne 0x4142f2
mov dword [ebp - 0xbc8], 0xc0000017
mov edi, ebx
jmp 0x415e39
mov ecx, dword [0x429784]
mov edi, eax
mov eax, dword [0x429780]
mov dword [edi], eax
mov dword [edi + 4], ecx
rdtsc
mov dword [ebp - 0xbe4], eax
mov dword [ebp - 0xbec], edx
push 0xc
pop eax
mov dword [ebp - 0xbcc], eax
lea eax, [ebp - 0xc30]
mov edx, 0x7fffffff
push eax
mov ecx, 0x402bb8
call fcn.00425019
test eax, eax
jns 0x414340
mov dword [ebp - 0xc30], ebx
jmp 0x414a02
mov eax, dword [ebp - 0xc30]
inc eax
mov dword [ebp - 0xbdc], 8
mov dword [ebp - 0xc30], eax
mov dword [ebp - 0xbd8], 0xa0
lea eax, [eax*2 + 4]
cmp eax, 4
jb 0x414373
mov ecx, eax
mov eax, ebx
jmp 0x41438a
mov ecx, dword [ebp - 0xbc0]
mov eax, 0xc0000095
mov dword [ebp - 0xbc0], ecx
mov ecx, dword [ebp - 0xbcc]
mov dword [ebp - 0xbc8], eax
test eax, eax
js 0x415e39
mov eax, 0xc4
add ecx, eax
cmp ecx, eax
jb 0x4143a7
mov edx, ecx
jmp 0x4143aa
or edx, 0xffffffff
cmp ecx, eax
sbb eax, eax
and eax, 0xc0000095
add eax, 0x10000000
mov dword [ebp - 0xbc8], eax
cmp ecx, 0xc4
jb 0x4189c8
lea eax, [edx + 8]
mov dword [ebp - 0xbcc], eax
cmp eax, edx
jb 0x4143db
mov ecx, eax
jmp 0x4143de
or ecx, 0xffffffff
cmp eax, edx
sbb eax, eax
and eax, 0xc0000095
add eax, 0x10000000
mov dword [ebp - 0xbc8], eax
cmp dword [ebp - 0xbcc], edx
jb 0x4189c8
lea edx, [ecx + 8]
cmp edx, ecx
jb 0x41440d
mov dword [ebp - 0xbcc], edx
jmp 0x414416
or eax, 0xffffffff
mov dword [ebp - 0xbcc], eax
cmp edx, ecx
sbb eax, eax
and eax, 0xc0000095
add eax, 0x10000000
mov dword [ebp - 0xbc8], eax
cmp edx, ecx
jb 0x4189c8
mov eax, dword [ebp - 0xbcc]
push eax
push 8
mov dword [ebp - 0xcb8], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0x414461
mov dword [ebp - 0xbc8], 0xc0000017
jmp 0x415e39
mov dword [ebp - 0xcb4], eax
mov ecx, edi
mov dword [ebp - 0xbb8], esi
mov edx, ebx
mov dword [ebp - 0xbcc], ecx
mov dword [ebp - 0xcbc], edx
test eax, eax
jne 0x4144ce
mov eax, dword [ebp - 0xcb8]
lea ecx, [eax + 8]
mov dword [ebp - 0xbc8], ecx
cmp ecx, eax
jb 0x414584
mov eax, dword [ebp - 0xbdc]
inc edx
mov dword [ebp - 0xcb8], ecx
mov ecx, dword [ebp - 0xbc0]
mov dword [ebp - 0xcbc], edx
mov dword [ebp - 0xbc0], ecx
mov dword [ebp - 0xbb8], esi
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xbe0], edi
jmp 0x414645
mov eax, dword [ebp - 0xcb4]
mov edi, ecx
mov esi, dword [ebp - 0xbb8]
mov ecx, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbe0], ebx
test edx, edx
je 0x41459f
mov eax, dword [ebp - 0xbd8]
mov edi, dword [ebp - 0xbdc]
mov esi, dword [ebp - 0xbb8]
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0xbdc], edi
mov edi, dword [ebp - 0xbcc]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0xbc0], eax
cmp eax, 4
jb 0x414584
mov ebx, eax
add ebx, dword [ebp - 0xbc8]
cmp ebx, dword [ebp - 0xbc8]
push 0
mov dword [ebp - 0xbc0], ebx
pop ebx
jb 0x4189b9
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc8], eax
mov eax, dword [ebp - 0xbe0]
inc eax
mov dword [ebp - 0xbcc], edi
mov dword [ebp - 0xbe0], eax
cmp eax, edx
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xbb8], esi
jb 0x4144fc
mov edx, dword [ebp - 0xbc8]
jmp 0x4145a1
mov edi, dword [ebp - 0xbcc]
mov esi, dword [ebp - 0xbb8]
mov dword [ebp - 0xbc8], 0xc0000095
jmp 0x415e39
mov edx, eax
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0xbdc], eax
lea eax, [edx + 4]
mov dword [ebp - 0xbc0], ecx
cmp eax, edx
jb 0x4189b9
mov ecx, dword [ebp - 0xcb8]
lea eax, [edx + 8]
add ecx, dword [ebp - 0xcb4]
cmp eax, ecx
ja 0x418898
mov dword [edx], 4
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0xcbc]
inc edx
mov dword [ebp - 0xcbc], edx
mov ecx, dword [ebp - 0xbc0]
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0xbc0], ecx
mov dword [ebp - 0xbb8], esi
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xbe0], edi
test esi, esi
jne 0x414639
cmp dword [ebp - 0xbd8], esi
jne 0x418577
mov eax, dword [ebp - 0xcb8]
mov dword [ebp - 0xbc8], eax
jmp 0x414652
mov eax, dword [ebp - 0xcb8]
mov dword [ebp - 0xbc8], eax
cmp dword [ebp - 0xbd8], 0
je 0x418577
cmp dword [ebp - 0xcb4], 0
jne 0x41468d
mov eax, dword [ebp - 0xbc8]
mov ecx, 0xa4
add ecx, eax
mov dword [ebp - 0xbc8], ecx
cmp ecx, eax
jb 0x4189b9
mov edi, dword [ebp - 0xbe0]
mov esi, dword [ebp - 0xbb8]
mov dword [ebp - 0xcb8], ecx
jmp 0x4147a8
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xbb8], ebx
test edx, edx
je 0x41473d
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xbe0], edi
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0xbb0], eax
cmp eax, 4
jb 0x4189b9
mov ebx, eax
add ebx, dword [ebp - 0xbc0]
cmp ebx, dword [ebp - 0xbc0]
push 0
mov dword [ebp - 0xbb0], ebx
pop ebx
jb 0x4189b9
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xbb8]
inc eax
mov dword [ebp - 0xbb8], eax
cmp eax, edx
mov eax, dword [ebp - 0xbd8]
jb 0x4146ad
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xbd8], eax
mov edx, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc0], ecx
mov ecx, dword [ebp - 0xbdc]
mov dword [ebp - 0xbcc], ecx
lea ecx, [edx + 4]
cmp ecx, edx
jb 0x4189b9
lea ecx, [eax + 4]
mov eax, dword [ebp - 0xcb4]
add eax, dword [ebp - 0xbc8]
add ecx, edx
push 0
pop ebx
cmp ecx, eax
ja 0x418898
mov eax, dword [ebp - 0xbd8]
mov dword [edx], eax
test esi, esi
je 0x414796
push eax
lea eax, [edx + 4]
push esi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0xcb8]
mov edx, dword [ebp - 0xcbc]
mov dword [ebp - 0xbc8], ecx
inc edx
mov dword [ebp - 0xcbc], edx
test edi, edi
jne 0x4147c0
cmp dword [ebp - 0xbdc], edi
je 0x4147cd
jmp 0x418577
cmp dword [ebp - 0xbdc], 0
je 0x418577
cmp dword [ebp - 0xcb4], 0
jne 0x4147f4
push 0xc
pop eax
add eax, ecx
mov dword [ebp - 0xbb0], eax
cmp eax, ecx
jb 0x4189b9
mov dword [ebp - 0xcb8], eax
jmp 0x4148f0
mov eax, dword [ebp - 0xcb4]
mov ecx, dword [ebp - 0xbc0]
mov dword [ebp - 0xbb0], eax
mov dword [ebp - 0xbb8], ebx
test edx, edx
je 0x414889
mov eax, dword [ebp - 0xbcc]
mov dword [ebp - 0xbcc], eax
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xbc0], esi
mov dword [ebp - 0xbdc], edi
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0xbd8], eax
cmp eax, 4
jb 0x4189b9
mov eax, dword [ebp - 0xbb0]
mov ebx, dword [ebp - 0xbd8]
add ebx, eax
push 0
mov dword [ebp - 0xbb0], ebx
cmp ebx, eax
pop ebx
jb 0x4189b9
inc dword [ebp - 0xbb8]
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xbb0], eax
cmp dword [ebp - 0xbb8], edx
jb 0x414810
mov edx, dword [ebp - 0xbcc]
mov dword [ebp - 0xbb0], eax
jmp 0x41488f
mov edx, dword [ebp - 0xbdc]
mov dword [ebp - 0xbc0], ecx
lea ecx, [eax + 4]
mov dword [ebp - 0xbb8], ecx
cmp ecx, eax
jb 0x4189b9
lea ecx, [eax + 4]
mov eax, dword [ebp - 0xcb4]
add eax, dword [ebp - 0xbc8]
add ecx, edx
push 0
pop ebx
cmp ecx, eax
ja 0x418898
mov eax, dword [ebp - 0xbb0]
mov dword [eax], edx
test edi, edi
je 0x4148de
push edx
push edi
push dword [ebp - 0xbb8]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0xcb8]
mov edx, dword [ebp - 0xcbc]
mov dword [ebp - 0xbb0], eax
inc edx
mov dword [ebp - 0xcbc], edx
cmp dword [ebp - 0xcb4], 0
jne 0x41491d
lea ecx, [eax + 0xc]
cmp ecx, eax
jb 0x4189b9
inc edx
mov dword [ebp - 0xcb8], ecx
mov dword [ebp - 0xcbc], edx
jmp 0x4149e2
mov eax, dword [ebp - 0xcb4]
mov ecx, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbb8], ebx
test edx, edx
je 0x414996
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0xbc0], esi
mov dword [ebp - 0xbcc], edi
mov dword [ebp - 0xbdc], eax
cmp eax, 4
jb 0x4189b9
mov ebx, eax
add ebx, dword [ebp - 0xbc8]
cmp ebx, dword [ebp - 0xbc8]
push 0
mov dword [ebp - 0xbc0], ebx
pop ebx
jb 0x4189b9
inc dword [ebp - 0xbb8]
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc8], eax
cmp dword [ebp - 0xbb8], edx
jb 0x414939
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbc0], ecx
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x4189b9
mov edx, dword [ebp - 0xbc8]
mov ecx, dword [ebp - 0xbb0]
add ecx, dword [ebp - 0xcb4]
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0x418898
mov eax, dword [ebp - 0xbe4]
mov dword [edx], 8
mov dword [edx + 4], eax
mov eax, dword [ebp - 0xbec]
mov dword [edx + 8], eax
inc dword [ebp - 0xcbc]
lea eax, [ebp - 0xc84]
mov edx, 0x7fffffff
push eax
mov ecx, 0x402bb8
call fcn.00425019
test eax, eax
jns 0x414a11
mov dword [ebp - 0xc84], ebx
mov dword [ebp - 0xbc8], 0xc000003e
jmp 0x415e39
mov eax, dword [ebp - 0xc84]
lea ecx, [eax + 1]
mov dword [ebp - 0xbb0], ecx
cmp ecx, eax
jb 0x4189b2
lea eax, [ecx + ecx]
mov dword [ebp - 0xc84], ecx
test eax, eax
je 0x414bff
cmp dword [ebp - 0xcb4], 0
jne 0x414a99
lea ecx, [eax + 4]
cmp ecx, 4
jb 0x414a8f
add ecx, dword [ebp - 0xcb8]
mov edx, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc0], edx
cmp ecx, dword [ebp - 0xcb8]
jb 0x414a7e
mov dword [ebp - 0xcb8], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xcbc]
inc ecx
mov dword [ebp - 0xcbc], ecx
jmp 0x414c16
or dword [ebp - 0xcb8], 0xffffffff
mov eax, 0xc0000095
jmp 0x414c10
mov eax, 0xc0000095
jmp 0x414c04
mov ecx, dword [ebp - 0xcbc]
mov eax, dword [ebp - 0xcb4]
mov edx, dword [ebp - 0xbc0]
mov dword [ebp - 0xbb8], eax
mov dword [ebp - 0xbc8], ebx
test ecx, ecx
je 0x414b53
mov dword [ebp - 0xbcc], edi
mov dword [ebp - 0xbdc], esi
mov dword [ebp - 0xbd8], edx
jmp 0x414ad9
mov edx, dword [ebp - 0xbd8]
mov eax, dword [eax]
mov esi, dword [ebp - 0xbdc]
add eax, 4
mov edi, dword [ebp - 0xbcc]
mov dword [ebp - 0xbc0], edx
mov dword [ebp - 0xbe0], eax
cmp eax, 4
jb 0x414b93
mov eax, dword [ebp - 0xbb8]
mov ecx, dword [ebp - 0xbe0]
add ecx, eax
mov dword [ebp - 0xbb8], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0xcbc]
jb 0x414ba5
inc dword [ebp - 0xbc8]
mov eax, dword [ebp - 0xbb8]
mov dword [ebp - 0xbb8], eax
mov dword [ebp - 0xbcc], edi
mov dword [ebp - 0xbdc], esi
mov dword [ebp - 0xbd8], edx
cmp dword [ebp - 0xbc8], ecx
jb 0x414ad3
mov dword [ebp - 0xbb8], eax
lea ecx, [eax + 4]
mov dword [ebp - 0xbcc], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0xcbc]
jb 0x414bf8
mov edx, dword [ebp - 0xbb0]
add edx, 2
mov dword [ebp - 0xbc8], ebx
lea edx, [eax + edx*2]
mov eax, dword [ebp - 0xcb4]
add eax, dword [ebp - 0xcb8]
cmp edx, eax
jbe 0x414bb2
mov eax, 0xc0000023
jmp 0x414c04
mov edi, dword [ebp - 0xbcc]
mov esi, dword [ebp - 0xbdc]
mov edx, dword [ebp - 0xbd8]
mov eax, 0xc0000095
mov dword [ebp - 0xbc0], edx
jmp 0x414c16
mov edx, dword [ebp - 0xbb0]
mov eax, dword [ebp - 0xbb8]
lea ecx, [edx + edx]
push ecx
push 0x402bb8
push dword [ebp - 0xbcc]
mov dword [eax], ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [ebp - 0xcbc]
add esp, 0xc
mov edx, dword [ebp - 0xbc0]
inc ecx
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0xcbc], ecx
mov dword [ebp - 0xbc0], edx
jmp 0x414c1c
mov eax, 0xc0000095
jmp 0x414c16
mov eax, 0xc000000d
mov edx, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc0], edx
mov ecx, dword [ebp - 0xcbc]
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbb0], esi
mov esi, edi
mov dword [ebp - 0xbb8], esi
mov esi, dword [ebp - 0xbb0]
test eax, eax
js 0x415e39
cmp dword [ebp - 0xcb4], 0
jne 0x414c6f
mov eax, dword [ebp - 0xcb8]
lea esi, [eax + 8]
mov dword [ebp - 0xbc8], esi
cmp esi, eax
mov esi, dword [ebp - 0xbb0]
jb 0x4189b9
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0xcb8], eax
jmp 0x414d4c
mov eax, dword [ebp - 0xcb4]
mov esi, dword [ebp - 0xbb0]
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbc0], ebx
test ecx, ecx
je 0x414cf7
mov eax, dword [eax]
mov esi, dword [ebp - 0xbb0]
add eax, 4
mov edi, dword [ebp - 0xbb8]
mov dword [ebp - 0xbcc], eax
cmp eax, 4
jb 0x414d81
mov ecx, eax
add ecx, dword [ebp - 0xbc8]
cmp ecx, dword [ebp - 0xbc8]
mov dword [ebp - 0xbb0], ecx
mov ecx, dword [ebp - 0xcbc]
jb 0x4189b9
inc dword [ebp - 0xbc0]
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbb8], edi
mov dword [ebp - 0xbb0], esi
cmp dword [ebp - 0xbc0], ecx
jb 0x414c8b
mov dword [ebp - 0xbc8], eax
lea ecx, [eax + 4]
mov dword [ebp - 0xbc0], edx
cmp ecx, eax
jb 0x4189b9
mov ecx, dword [ebp - 0xcb8]
mov eax, dword [ebp - 0xbc8]
add ecx, dword [ebp - 0xcb4]
add eax, 8
cmp eax, ecx
ja 0x418898
mov eax, dword [ebp - 0xbc8]
mov ecx, dword [ebp - 0xbf0]
mov dword [eax], 4
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0xcb8]
mov ecx, dword [ebp - 0xcbc]
mov dword [ebp - 0xbc8], eax
inc ecx
mov dword [ebp - 0xcbc], ecx
cmp dword [ebp - 0xcb4], 0
jne 0x414d9c
lea edx, [eax + 8]
mov dword [ebp - 0xbb0], edx
cmp edx, eax
jb 0x4189b9
inc ecx
mov dword [ebp - 0xcb8], edx
mov dword [ebp - 0xcbc], ecx
mov ecx, edx
jmp 0x414e53
mov edi, dword [ebp - 0xbb8]
mov esi, dword [ebp - 0xbb0]
mov dword [ebp - 0xbc8], 0xc0000095
jmp 0x415e39
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0xbb0], eax
mov dword [ebp - 0xbc0], ebx
test ecx, ecx
je 0x414e11
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0xbb8], esi
mov dword [ebp - 0xbcc], edi
mov dword [ebp - 0xbdc], eax
cmp eax, 4
jb 0x4189b9
mov eax, dword [ebp - 0xbb0]
mov ebx, dword [ebp - 0xbdc]
add ebx, eax
push 0
mov dword [ebp - 0xbb0], ebx
cmp ebx, eax
pop ebx
jb 0x4189b9
inc dword [ebp - 0xbc0]
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xbb0], eax
cmp dword [ebp - 0xbc0], ecx
jb 0x414db2
mov dword [ebp - 0xbb0], eax
lea ecx, [eax + 4]
mov dword [ebp - 0xbc0], edx
cmp ecx, eax
jb 0x4189b9
mov edx, dword [ebp - 0xbb0]
mov ecx, dword [ebp - 0xbc8]
add ecx, dword [ebp - 0xcb4]
lea eax, [edx + 8]
cmp eax, ecx
ja 0x418898
push 4
pop eax
mov dword [edx], eax
mov dword [edx + 4], eax
inc dword [ebp - 0xcbc]
mov ecx, dword [ebp - 0xcb8]
mov dword [ebp - 0xbb0], esi
mov dword [ebp - 0xbb8], edi
rdtsc
mov dword [ebp - 0xbdc], ebx
mov dword [ebp - 0xbd8], ebx
mov dword [ebp - 0xbe0], ebx
mov dword [ebp - 0xbd4], ebx
mov dword [ebp - 0xbbc], ebx
mov dword [ebp - 0xbc4], ebx
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xbd0], ebx
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xba8], edx
add ecx, 8
cmp ecx, 8
jb 0x4189a3
lea eax, [ecx + 7]
mov edx, esi
and eax, 0xfffffff8
mov dword [ebp - 0xbb0], eax
cmp eax, ecx
jae 0x414eca
mov dword [ebp - 0xbc8], 0xd0000095
jmp 0x415e39
push eax
push 8
mov dword [ebp - 0xbb8], esi
mov dword [ebp - 0xb98], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xb80], ecx
test ecx, ecx
jne 0x414f01
mov dword [ebp - 0xbc8], 0xd0000017
jmp 0x415e39
mov esi, dword [ebp - 0xbb8]
lea edx, [ecx + 4]
mov edi, dword [ebp - 0xb98]
mov eax, dword [ebp - 0xcbc]
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xba0], edi
mov dword [ecx], eax
cmp edx, ecx
jb 0x414f89
mov eax, dword [ebp - 0xcb8]
mov dword [edx], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x414f95
mov eax, dword [ebp - 0xbb0]
mov edx, dword [ebp - 0xbc8]
mov dword [ecx + eax - 8], edx
mov edx, dword [ebp - 0xba8]
mov dword [ecx + eax - 4], edx
lea eax, [ecx + 8]
push dword [ebp - 0xcb8]
push dword [ebp - 0xcb4]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xb80]
add esp, 0xc
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xbd8], eax
mov dword [ebp - 0xb80], ebx
jmp 0x414ff3
mov edi, dword [ebp - 0xb98]
mov esi, dword [ebp - 0xbb8]
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc0], eax
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xba0], edi
mov dword [ebp - 0xbc8], 0xc0000095
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or dword [ebp - 0xbc8], 0x10000000
jl 0x418308
mov eax, ebx
mov dword [ebp - 0xb80], ebx
test eax, eax
jne 0x414ff1
mov dword [ebp - 0xbc8], 0xd000000d
jmp 0x415e39
mov eax, ebx
test eax, eax
je 0x4182f3
add eax, 8
push eax
push ebx
mov dword [ebp - 0xb98], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xba8], eax
test eax, eax
je 0x4182f3
mov ecx, dword [ebp - 0xbd8]
mov dl, bl
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0xbb0], ebx
test ecx, ecx
je 0x415043
xor dl, byte [ebx + eax]
inc ebx
cmp ebx, ecx
jb 0x415039
xor ebx, ebx
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0xbc8], eax
or eax, 0xffffffff
and ecx, 7
mov dword [ebp - 0x3a8], 0xb1b54a58
mov dword [ebp - 0x3a4], 0xc81ecb17
mov dword [ebp - 0xbb8], ebx
mov dword [ebp - 0xb7c], eax
mov dword [ebp - 0xb90], ebx
mov dword [ebp - 0xb8c], ebx
mov dword [ebp - 0xb88], ecx
je 0x41523c
mov dword [ebp - 0xbb8], ebx
mov eax, ebx
mov dword [ebp - 0xb8c], ebx
test ecx, ecx
je 0x415201
mov ebx, dword [ebp - 0xbb0]
mov esi, eax
mov dword [ebp - 0xb90], 0x38
mov edi, dword [ebp - 0xb90]
movzx ecx, byte [ebx]
inc ebx
mov dword [ebp - 0xb8c], ecx
cmp esi, 4
jae 0x4150ed
lea ecx, [edi - 0x20]
shl dword [ebp - 0xb8c], cl
mov ecx, dword [ebp - 0xbb8]
or ecx, dword [ebp - 0xb8c]
mov dword [ebp - 0xbb8], ecx
jmp 0x415101
mov ecx, edi
shl dword [ebp - 0xb8c], cl
or eax, dword [ebp - 0xb8c]
mov ecx, dword [ebp - 0xbb8]
inc esi
mov dword [ebp - 0xb90], eax
sub edi, 8
mov dword [ebp - 0xb8c], ecx
cmp esi, dword [ebp - 0xb88]
jl 0x4150c1
mov edi, dword [ebp - 0xba0]
xor eax, 0x42f6b18d
mov esi, dword [ebp - 0xbcc]
xor ecx, 0xb17a307a
mov dword [ebp - 0xb7c], eax
mov dword [ebp - 0xb94], eax
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xbb0], ebx
xor ebx, ebx
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0xb78], ecx
mov dword [ebp - 0xbb8], ecx
mov ecx, ebx
mov ebx, dword [ebp - 0xb78]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xba0], edi
mov edi, dword [ebp - 0xbc8]
mov dword [ebp - 0xbcc], esi
mov esi, dword [ebp - 0xb88]
mov dword [ebp - 0xbd8], eax
lea eax, [edi + 1]
mov dword [ebp - 0xb78], eax
cmp ecx, 4
jge 0x4151a9
rol ebx, 8
mov eax, ebx
jmp 0x4151b8
mov eax, dword [ebp - 0xb94]
rol eax, 8
mov dword [ebp - 0xb94], eax
mov byte [edi], al
inc ecx
mov eax, dword [ebp - 0xb78]
mov edi, eax
cmp ecx, esi
jl 0x415194
mov dword [ebp - 0xbc8], eax
push 0
pop ebx
cmp esi, 4
jbe 0x4151ef
mov eax, dword [ebp - 0xb7c]
push 8
pop ecx
sub ecx, esi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xb7c], eax
jmp 0x41523c
mov eax, ebx
mov dword [ebp - 0xb7c], eax
jae 0x41523c
mov esi, dword [ebp - 0xbb8]
jmp 0x415226
mov eax, dword [ebp - 0xbb0]
mov esi, 0xb17a307a
mov dword [ebp - 0xbb0], eax
mov eax, ebx
mov dword [ebp - 0xb8c], ebx
mov dword [ebp - 0xb90], ebx
mov dword [ebp - 0xb7c], eax
push 4
pop ecx
sub ecx, dword [ebp - 0xb88]
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0xbb8], esi
mov ecx, dword [ebp - 0xbd8]
mov eax, ecx
shr eax, 3
mov dword [ebp - 0xb94], eax
test eax, eax
je 0x415622
movzx eax, word [ebp - 0x3a6]
mov edi, 0xb1b54a58
movzx esi, word [ebp - 0x3a2]
mov ecx, 0xc81ecb17
mov dword [ebp - 0xb88], eax
mov eax, 0xc81ecb17
xor eax, edi
movzx ecx, cx
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xbc8]
movzx ebx, di
add eax, 7
mov dword [ebp - 0xb84], ecx
mov ecx, dword [ebp - 0xbb0]
mov dword [ebp - 0xb78], ebx
add ecx, 2
mov ebx, dword [ebp - 0xb7c]
mov dword [ebp - 0xb74], esi
mov dword [ebp - 0xbc8], eax
movzx edi, byte [ecx - 2]
movzx eax, byte [ecx - 1]
movzx esi, byte [ecx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [ecx]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 3]
or esi, eax
movzx eax, byte [ecx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 5]
add ecx, 8
shl esi, 8
or esi, eax
mov dword [ebp - 0xb7c], ecx
xor ebx, esi
mov ecx, 0xc81ecb17
mov eax, ebx
sub eax, dword [ebp - 0xb78]
xor eax, ecx
xor eax, edi
xor dword [ebp - 0xbb8], eax
mov eax, dword [ebp - 0xbb8]
xor ecx, eax
ror ecx, 0xf
imul ecx, dword [ebp - 0xb88]
ror eax, 7
add ecx, eax
xor ebx, ecx
mov ecx, 0xb1b54a58
mov eax, ebx
ror eax, 0xa
lea ecx, [ebx + ecx]
ror ecx, 9
imul ecx, dword [ebp - 0xb84]
sub ecx, eax
mov eax, dword [ebp - 0xbb8]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xbb8], eax
xor ecx, dword [ebp - 0xb84]
rol ecx, 4
imul ecx, dword [ebp - 0xb74]
rol eax, 5
add ecx, eax
mov eax, 0xc81ecb17
xor ebx, ecx
mov ecx, ebx
xor ecx, 0xb1b54a58
sub eax, ecx
mov ecx, dword [ebp - 0xbb8]
xor ecx, eax
mov dword [ebp - 0xbb8], ecx
sub ecx, dword [ebp - 0xb78]
imul ecx, dword [ebp - 0xb88]
mov eax, dword [ebp - 0xbb8]
shr eax, 6
sub ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xbb8]
mov eax, ebx
ror eax, 0xf
xor eax, dword [ebp - 0xb84]
imul eax, dword [ebp - 0xb78]
xor ecx, eax
mov eax, ecx
not eax
ror eax, 3
add eax, dword [ebp - 0xb74]
imul eax, dword [ebp - 0xb84]
xor ebx, eax
mov eax, ebx
sub eax, 0xc81ecb17
sub eax, dword [ebp - 0xb78]
xor ecx, eax
mov dword [ebp - 0xbb8], ecx
mov eax, dword [ebp - 0xbb8]
xor eax, dword [ebp - 0xb74]
imul eax, dword [ebp - 0xb88]
ror ecx, 0xa
xor ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xb78]
rol ecx, 6
imul ecx, dword [ebp - 0xb84]
ror eax, 3
xor ecx, eax
mov eax, dword [ebp - 0xbb8]
xor eax, ecx
mov dword [ebp - 0xbb8], eax
ror eax, 0xf
sub eax, dword [ebp - 0xb74]
imul eax, dword [ebp - 0xb78]
xor ebx, eax
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xb74]
imul ecx, dword [ebp - 0xb78]
shr eax, 1
xor ecx, eax
mov eax, ebx
xor dword [ebp - 0xbb8], ecx
mov ecx, ebx
sub ecx, dword [ebp - 0xb84]
rol ecx, 3
imul ecx, dword [ebp - 0xb78]
shr eax, 0xf
xor ecx, eax
mov eax, dword [ebp - 0xbb8]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xbb8], eax
sub ecx, dword [ebp - 0xb84]
imul ecx, dword [ebp - 0xb88]
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, 0xb1b54a58
sub ecx, ebx
mov eax, ebx
ror ecx, 9
imul ecx, dword [ebp - 0xb84]
ror eax, 0xb
xor ecx, eax
mov eax, dword [ebp - 0xbb8]
xor eax, ecx
mov dword [ebp - 0xbb8], eax
sub eax, 0xb1b54a58
sub eax, dword [ebp - 0xb74]
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, dword [ebp - 0xb88]
imul eax, dword [ebp - 0xb78]
ror ecx, 7
sub eax, ecx
mov ecx, dword [ebp - 0xbb8]
xor ecx, eax
mov dword [ebp - 0xbb8], ecx
xor ecx, dword [ebp - 0xb74]
mov eax, dword [ebp - 0xbb8]
rol ecx, 4
imul ecx, dword [ebp - 0xb88]
ror eax, 0x10
sub ecx, eax
xor ebx, ecx
mov ecx, 0xb1b54a58
sub ecx, ebx
mov eax, ebx
ror ecx, 0xa
imul ecx, dword [ebp - 0xb84]
ror eax, 4
add ecx, eax
mov eax, dword [ebp - 0xbb8]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xbb8], eax
sub ecx, 0xb1b54a58
ror eax, 9
ror ecx, 4
imul ecx, dword [ebp - 0xb74]
xor ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, 0xc81ecb17
rol eax, 2
rol ecx, 8
imul ecx, dword [ebp - 0xb78]
sub ecx, eax
mov eax, dword [ebp - 0xbb8]
xor eax, ecx
mov ecx, 0xc81ecb17
sub ecx, eax
mov dword [ebp - 0xbb8], eax
ror ecx, 0xb
imul ecx, dword [ebp - 0xb88]
ror eax, 0xc
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xb88]
imul ecx, dword [ebp - 0xb84]
xor ebx, dword [ebp - 0xbac]
shr eax, 8
xor ecx, eax
mov eax, dword [ebp - 0xbb8]
xor eax, ecx
mov ecx, dword [ebp - 0xbc8]
xor ebx, eax
xor eax, dword [ebp - 0xb8c]
xor ebx, dword [ebp - 0xb90]
mov dword [ebp - 0xb8c], edi
mov byte [ecx - 4], al
mov byte [ecx], bl
ror eax, 8
mov byte [ecx - 5], al
ror ebx, 8
mov byte [ecx - 1], bl
ror eax, 8
mov byte [ecx - 6], al
ror ebx, 8
mov byte [ecx - 2], bl
ror eax, 8
ror ebx, 8
mov byte [ecx - 7], al
mov byte [ecx - 3], bl
add ecx, 8
ror eax, 8
ror ebx, 8
sub dword [ebp - 0xb94], 1
mov dword [ebp - 0xbc8], ecx
mov ecx, dword [ebp - 0xb7c]
mov dword [ebp - 0xbb8], eax
mov dword [ebp - 0xb90], esi
jne 0x4152b6
mov ecx, dword [ebp - 0xbd8]
mov eax, dword [ebp - 0xbdc]
mov ebx, dword [ebp - 0xba8]
mov esi, dword [ebp - 0xbcc]
mov edi, dword [ebp - 0xba0]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xb74], eax
movzx eax, dl
cdq
mov dword [ebx + ecx], eax
mov eax, ebx
mov dword [eax + ecx + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb78], eax
push 0
pop ebx
test eax, eax
jne 0x415686
mov dword [ebp - 0xbc8], 0xc0000017
jmp 0x4158a1
mov ecx, dword [ebp - 0xbac]
mov esi, dword [ebp - 0xbcc]
mov edi, dword [ebp - 0xba0]
mov dword [ebp - 0xbdc], ecx
mov ecx, dword [ebp - 0xb74]
mov dword [ebp - 0xbc0], ecx
mov ecx, dword [ebp - 0xb98]
push ecx
push 8
mov dword [eax], ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x4156df
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xbac]
jmp 0x4157d4
mov ecx, dword [ebp - 0xb78]
mov dword [ecx + 4], edx
push dword [ebp - 0xb98]
mov dword [ebp - 0xb78], ecx
push dword [ebp - 0xba8]
push edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xbdc]
add esp, 0xc
mov dword [ebp - 0xbac], eax
mov ecx, 0xa0
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0xb78]
push ecx
push 8
mov dword [ebp - 0xb84], esi
mov dword [ebp - 0xb94], edi
mov dword [eax + 8], ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4157da
mov eax, dword [ebp - 0xb78]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp - 0xbac]
mov edi, esi
mov dword [ebp - 0xbdc], ecx
mov esi, 0x4296d8
mov ecx, dword [ebp - 0xb74]
push 0x28
mov dword [ebp - 0xbc0], ecx
mov ecx, dword [ebp - 0xb94]
mov dword [ebp - 0xba0], ecx
pop ecx
mov dword [ebp - 0xbcc], edi
mov edi, dword [eax + 0xc]
rep movsd dword es:[edi], dword [esi]
push 8
mov esi, eax
pop eax
push eax
push eax
mov dword [esi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0x41586d
mov eax, dword [ebp - 0xb74]
mov edi, dword [ebp - 0xb94]
mov dword [ebp - 0xb78], esi
mov esi, dword [ebp - 0xb84]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xbdc], eax
mov dword [ebp - 0xbc8], 0xc0000017
mov eax, dword [ebp - 0xb78]
mov dword [ebp - 0xb80], ebx
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41580f
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb78]
mov dword [eax + 4], ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x41582e
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb78]
mov dword [eax + 0xc], ebx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x41584d
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb78]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xbc8], 0
jl 0x4158a1
mov eax, dword [ebp - 0xb80]
jmp 0x415895
mov dword [esi + 0x14], eax
mov ecx, dword [0x429778]
mov edx, dword [0x42977c]
mov edi, dword [ebp - 0xba0]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, esi
mov esi, dword [ebp - 0xbcc]
mov dword [ebp - 0xbc8], ebx
mov dword [ebp - 0xbe0], eax
mov dword [ebp - 0xb80], ebx
mov eax, dword [ebp - 0xbdc]
push dword [ebp - 0xba8]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xbe0]
push ebx
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xba0], edi
mov dword [ebp - 0xbe0], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbc0]
mov ecx, dword [ebp - 0xbdc]
mov dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xbac], ecx
mov dword [ebp - 0xb84], esi
mov dword [ebp - 0xb94], edi
test eax, eax
je 0x415997
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x415936
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb80]
mov dword [eax + 4], ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x415955
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb80]
mov dword [eax + 0xc], ebx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x415974
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb80]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edx, dword [ebp - 0xbe0]
mov ecx, dword [ebp - 0xbac]
mov dword [ebp - 0xbe0], edx
jmp 0x41599d
mov edx, dword [ebp - 0xbe0]
mov eax, dword [ebp - 0xbc8]
or eax, 0x10000000
mov dword [ebp - 0xb78], edx
mov dword [ebp - 0xbc8], eax
jl 0x415cd9
lea eax, [edx + 0x10]
mov dword [ebp - 0xb88], eax
mov eax, dword [eax]
mov dword [ebp - 0xb8c], eax
lea eax, [edx + 8]
mov dword [ebp - 0xb90], eax
mov eax, dword [eax]
mov dword [ebp - 0xb7c], eax
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xb80], eax
cmp eax, 4
jb 0x4182cc
mov esi, dword [ebp - 0xb78]
mov edx, dword [ebp - 0xb74]
mov eax, dword [ebp - 0xb84]
mov dword [ebp - 0xbe0], esi
mov esi, dword [ebp - 0xb80]
mov dword [ebp - 0xbdc], ecx
mov ecx, dword [ebp - 0xb94]
mov dword [ebp - 0xbc0], edx
lea edi, [esi + 4]
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xba0], ecx
mov dword [ebp - 0xb80], edi
cmp edi, esi
jb 0x418287
mov esi, edi
add esi, dword [ebp - 0xb7c]
cmp esi, edi
mov dword [ebp - 0xbac], esi
mov esi, dword [ebp - 0xbe0]
mov edi, dword [ebp - 0xbdc]
jb 0x418260
mov esi, dword [ebp - 0xbac]
add esi, 4
cmp esi, dword [ebp - 0xbac]
mov esi, dword [ebp - 0xbe0]
push 0
pop ebx
jb 0x418260
mov esi, dword [ebp - 0xbac]
mov ebx, dword [ebp - 0xb8c]
add esi, 4
add ebx, esi
cmp ebx, esi
mov dword [ebp - 0xbac], ebx
mov esi, dword [ebp - 0xbe0]
push 0
pop ebx
jb 0x418260
push dword [ebp - 0xbac]
mov dword [ebp - 0xb74], edi
push 8
mov dword [ebp - 0xb84], edx
mov dword [ebp - 0xb94], eax
mov dword [ebp - 0xb78], ecx
mov dword [ebp - 0xb8c], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edx, eax
mov dword [ebp - 0xb7c], edx
test edx, edx
je 0x4162f1
mov esi, dword [ebp - 0xb94]
mov eax, edi
mov edi, dword [ebp - 0xb78]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xb84]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xb8c]
mov ecx, eax
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xba0], edi
mov dword [ebp - 0xbe0], ecx
mov eax, dword [eax]
mov dword [edx], eax
lea eax, [edx + 4]
mov dword [ebp - 0xb80], eax
cmp eax, edx
jb 0x415c61
push dword [ecx]
push dword [ecx + 4]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [ebp - 0xbe0]
add esp, 0xc
mov eax, dword [ecx]
add eax, dword [ebp - 0xb80]
mov dword [ebp - 0xb74], eax
cmp eax, dword [ebp - 0xb80]
jb 0x415c59
mov edx, dword [ebp - 0xb74]
mov eax, dword [ebp - 0xb90]
mov eax, dword [eax]
mov dword [edx], eax
lea eax, [edx + 4]
mov dword [ebp - 0xb74], eax
cmp eax, edx
jb 0x415c59
mov edx, dword [ebp - 0xb90]
push dword [edx]
push dword [ecx + 0xc]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xb90]
add esp, 0xc
mov edx, dword [ebp - 0xb74]
mov ecx, dword [eax]
add ecx, edx
mov dword [ebp - 0xb74], ecx
cmp ecx, edx
jb 0x415c33
mov edx, dword [ebp - 0xb88]
mov eax, dword [edx]
mov dword [ecx], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x415c33
mov ecx, dword [ebp - 0xbe0]
push dword [edx]
push dword [ecx + 0x14]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xb88]
add esp, 0xc
mov ecx, dword [ebp - 0xb74]
add ecx, 4
mov eax, dword [eax]
add eax, ecx
cmp eax, ecx
jb 0x415c0d
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xbd4], eax
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xbbc], eax
jmp 0x415cc2
mov eax, dword [ebp - 0xbe0]
mov edx, dword [ebp - 0xb7c]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xbdc]
jmp 0x415c8b
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xbc0]
mov edx, dword [ebp - 0xb7c]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xbdc]
jmp 0x415c8b
mov dword [ebp - 0xbe0], ecx
jmp 0x415c3f
mov esi, dword [ebp - 0xb8c]
mov eax, dword [ebp - 0xb84]
mov edi, dword [ebp - 0xb78]
mov dword [ebp - 0xbe0], esi
mov esi, dword [ebp - 0xb94]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xbdc], eax
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xba0], edi
mov dword [ebp - 0xbc8], 0xc0000095
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or dword [ebp - 0xbc8], 0x10000000
jl 0x415cd9
cmp dword [ebp - 0xcb4], 0
jne 0x415f3e
mov dword [ebp - 0xbc8], 0xc000000d
mov edi, dword [ebp - 0xbdc]
test edi, edi
je 0x415cf2
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xbe0]
test esi, esi
je 0x415d59
cmp dword [esi + 4], 0
je 0x415d16
push dword [esi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 4], ebx
cmp dword [esi + 0xc], 0
je 0x415d30
push dword [esi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 0xc], ebx
cmp dword [esi + 0x14], 0
je 0x415d4a
push dword [esi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 0x14], ebx
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbd4]
test eax, eax
je 0x415d72
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbc4]
test eax, eax
je 0x415d8b
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xba4]
test esi, esi
je 0x415df2
cmp dword [esi + 4], 0
je 0x415daf
push dword [esi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 4], ebx
cmp dword [esi + 0xc], 0
je 0x415dc9
push dword [esi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 0xc], ebx
cmp dword [esi + 0x14], 0
je 0x415de3
push dword [esi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 0x14], ebx
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbd0]
test eax, eax
je 0x415e0b
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xbc8], 0
jl 0x415e2d
xor eax, eax
inc eax
cmp dword [ebp - 0xcc8], eax
jae 0x41830f
mov dword [ebp - 0xbc8], 0xc004d501
mov edi, dword [ebp - 0xba0]
mov esi, dword [ebp - 0xbcc]
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0xcb8], ebx
mov dword [ebp - 0xcbc], ebx
test eax, eax
je 0x415e64
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xcb4], ebx
mov eax, dword [ebp - 0xcc0]
mov dword [ebp - 0xcc4], ebx
mov dword [ebp - 0xcc8], ebx
test eax, eax
je 0x415e8f
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xcc0], ebx
test esi, esi
je 0x415ea2
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0x415eb5
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xbc8], 0
jl 0x4141c7
mov eax, dword [ebp - 0xbf0]
test eax, eax
je 0x420852
mov dword [0x42a874], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x308]
mov dword [ebp - 0xc7c], ebx
push eax
push 0x400000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0x41d207
cmp eax, esi
jne 0x415f0e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0x41d207
mov esi, dword [0x42907c]
mov ecx, esi
push 0x403
push ebx
push ebx
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xbac], eax
test eax, eax
jne 0x4189e9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x41d207
xor eax, eax
inc eax
cmp dword [ebp - 0xcbc], eax
jbe 0x415ccf
mov eax, dword [ebp - 0xcb4]
mov edx, dword [ebp - 0xbc0]
mov ecx, dword [ebp - 0xbdc]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xb74], ebx
mov ebx, dword [ebp - 0xbbc]
mov dword [ebp - 0xb90], eax
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xb94], ecx
mov dword [ebp - 0xbdc], ecx
mov dword [ebp - 0xbbc], ebx
mov ecx, dword [eax]
mov ebx, dword [ebp - 0xbd4]
mov dword [ebp - 0xbac], ecx
lea ecx, [eax + 4]
mov dword [ebp - 0xb84], ebx
mov dword [ebp - 0xbd4], ebx
mov dword [ebp - 0xb78], edx
mov dword [ebp - 0xb88], esi
mov dword [ebp - 0xb8c], edi
mov dword [ebp - 0xbc0], edx
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xba0], edi
mov dword [ebp - 0xb7c], ecx
push 0
pop ebx
cmp ecx, eax
jb 0x418251
mov eax, dword [ebp - 0xb84]
mov ecx, dword [ebp - 0xb94]
mov dword [ebp - 0xbd4], eax
mov eax, dword [ebp - 0xb90]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xb7c]
add eax, dword [ebp - 0xbac]
cmp eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xbdc], ecx
jb 0x418206
inc dword [ebp - 0xb74]
cmp dword [ebp - 0xb74], 1
jb 0x415f71
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xbc0], edx
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xba0], edi
mov ecx, dword [eax]
add eax, 4
mov dword [ebp - 0xb74], ecx
mov ecx, dword [ebp - 0xbdc]
cmp eax, dword [ebp - 0xbac]
jb 0x4181eb
mov eax, dword [ebp - 0xbd4]
mov dword [ebp - 0xbd4], eax
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xbdc], ecx
mov dword [ebp - 0xbe0], eax
cmp dword [ebp - 0xcb4], ebx
je 0x415ccf
cmp dword [ebp - 0xcbc], 2
ja 0x4160e3
mov dword [ebp - 0xbc8], 0xc000000d
mov dword [ebp - 0xbe0], eax
mov dword [ebp - 0xba0], edi
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xbc0], edx
mov ecx, dword [ebp - 0xbd4]
mov dword [ebp - 0xbd4], ecx
jmp 0x415cd9
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xb88], esi
mov esi, dword [ebp - 0xbd4]
mov dword [ebp - 0xb84], ebx
mov dword [ebp - 0xb94], eax
mov dword [ebp - 0xb78], edi
mov dword [ebp - 0xb8c], edx
mov dword [ebp - 0xb90], ecx
mov dword [ebp - 0xb7c], esi
jmp 0x416139
mov edx, dword [ebp - 0xb8c]
mov ecx, dword [ebp - 0xb90]
mov esi, dword [ebp - 0xb7c]
mov ebx, dword [ebp - 0xbbc]
mov edi, ecx
mov ecx, dword [ebp - 0xb88]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xbbc], ebx
mov dword [ebp - 0xbd4], esi
mov esi, edx
mov edx, dword [ebp - 0xb78]
mov ebx, dword [eax]
mov dword [ebp - 0xbac], ebx
lea ebx, [eax + 4]
push 0
mov dword [ebp - 0xb80], ebx
cmp ebx, eax
mov dword [ebp - 0xbc0], esi
mov dword [ebp - 0xbcc], ecx
mov dword [ebp - 0xba0], edx
pop ebx
jb 0x4181a0
mov eax, dword [ebp - 0xb80]
add eax, dword [ebp - 0xbac]
cmp eax, dword [ebp - 0xb80]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xbe0]
jb 0x41816d
inc dword [ebp - 0xb84]
cmp dword [ebp - 0xb84], 2
mov dword [ebp - 0xb94], eax
mov eax, dword [ebp - 0xbd4]
mov dword [ebp - 0xb7c], eax
mov eax, dword [ebp - 0xb94]
mov dword [ebp - 0xb78], edx
mov dword [ebp - 0xb88], ecx
mov dword [ebp - 0xb8c], esi
mov dword [ebp - 0xb90], edi
jb 0x416127
mov eax, dword [ebp - 0xbac]
push 0
mov ebx, dword [eax]
add eax, 4
mov dword [ebp - 0xb84], ebx
pop ebx
cmp eax, dword [ebp - 0xbac]
jb 0x418167
mov eax, dword [ebp - 0xb74]
add eax, 0x50
mov dword [ebp - 0xbac], eax
cmp eax, 0x50
jb 0x418167
add eax, 4
mov dword [ebp - 0xb74], eax
cmp eax, dword [ebp - 0xbac]
jb 0x418167
add eax, dword [ebp - 0xb84]
mov dword [ebp - 0xbac], eax
cmp eax, dword [ebp - 0xb74]
jb 0x418167
cmp eax, 0x400000
jbe 0x416283
mov dword [ebp - 0xbc8], 0x8000ffff
jmp 0x415cdf
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xbd4]
mov dword [ebp - 0xba0], edx
mov dword [ebp - 0xbcc], ecx
mov dword [ebp - 0xbc0], esi
mov dword [ebp - 0xbd4], eax
mov dword [ebp - 0xb94], esi
mov esi, dword [ebp - 0xbac]
push esi
mov dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0xbe0]
push 8
mov dword [ebp - 0xb84], edi
mov dword [ebp - 0xb78], ecx
mov dword [ebp - 0xb88], edx
mov dword [ebp - 0xb8c], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0x416300
mov dword [ebp - 0xbc8], 0xd0000017
jmp 0x415cdf
mov edx, eax
mov dword [ebp - 0xbc4], edx
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xb90], edx
test eax, eax
jne 0x416363
mov ecx, dword [ebp - 0xb8c]
mov edi, dword [ebp - 0xb78]
mov dword [ebp - 0xbe0], ecx
mov ecx, dword [ebp - 0xb88]
mov dword [ebp - 0xba0], ecx
mov ecx, dword [ebp - 0xb94]
mov dword [ebp - 0xbcc], edi
mov edi, dword [ebp - 0xb84]
mov dword [ebp - 0xbc8], 0x80070057
mov dword [ebp - 0xbc4], edx
mov dword [ebp - 0xbc0], ecx
jmp 0x41642f
mov dword [ebp - 0xcf0], eax
mov eax, dword [ebp - 0xbbc]
mov dword [ebp - 0xce8], eax
lea eax, [ebp - 0xc80]
push eax
xor eax, eax
mov dword [ebp - 0xcec], edx
push 0x401b24
inc eax
mov dword [ebp - 0xce4], esi
push eax
mov dword [ebp - 0xce0], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0x41643a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xbc8], eax
test eax, eax
jle 0x4163c5
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xbc8], eax
test eax, eax
js 0x4163d2
mov eax, 0x80004005
mov dword [ebp - 0xbc8], eax
mov ecx, dword [ebp - 0xb8c]
mov edi, dword [ebp - 0xb78]
mov dword [ebp - 0xbe0], ecx
mov ecx, dword [ebp - 0xb88]
mov dword [ebp - 0xba0], ecx
mov ecx, dword [ebp - 0xb94]
mov dword [ebp - 0xbcc], edi
mov edi, dword [ebp - 0xb84]
mov dword [ebp - 0xbc0], ecx
cmp eax, 0xd0000023
jne 0x4164cd
mov edx, dword [ebp - 0xbc4]
mov dword [ebp - 0xbc8], 0x8007007a
mov dword [ebp - 0xbc4], edx
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xbd4], eax
jmp 0x415cdf
push 0x404fe8
push dword [ebp - 0xc80]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x416489
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xbc8], eax
test eax, eax
jle 0x416471
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xbc8], eax
test eax, eax
js 0x41647e
mov eax, 0x80004005
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbac], esi
jmp 0x4163d2
push ebx
push 0x14
lea eax, [ebp - 0xcf0]
mov ecx, edi
push eax
push 0x86
call dword [0x42b5a4]
call edi
or eax, 0x10000000
mov dword [ebp - 0xbac], esi
mov dword [ebp - 0xbc8], eax
jl 0x4163d2
mov esi, dword [ebp - 0xce4]
mov ecx, dword [ebp - 0xb74]
mov dword [ebp - 0xbac], esi
jmp 0x4164e1
mov ecx, dword [ebp - 0xb74]
mov dword [ebp - 0xbd4], ecx
test eax, eax
js 0x415cdf
mov edx, dword [ebp - 0xbc4]
mov dword [ebp - 0xb7c], ebx
cmp esi, 4
jae 0x41653d
mov dword [ebp - 0xbc8], 0xd000003e
mov dword [ebp - 0xbc4], edx
mov edi, dword [ebp - 0xb78]
mov dword [ebp - 0xbcc], edi
mov eax, dword [ebp - 0xb8c]
mov ecx, dword [ebp - 0xb88]
mov edi, dword [ebp - 0xb84]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xb94]
mov dword [ebp - 0xba0], ecx
mov dword [ebp - 0xbc0], eax
jmp 0x416429
mov eax, dword [edx]
mov edi, dword [ebp - 0xb78]
mov dword [ebp - 0xb80], eax
lea eax, [edx + 4]
mov dword [ebp - 0xb98], eax
mov dword [ebp - 0xbcc], edi
cmp eax, edx
jb 0x418152
mov eax, dword [ebp - 0xb84]
mov edx, dword [ebp - 0xb94]
mov esi, dword [ebp - 0xb8c]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xb90]
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 0xbac]
add eax, 0xfffffffc
mov dword [ebp - 0xbd4], ecx
mov ecx, dword [ebp - 0xb88]
mov dword [ebp - 0xbc0], edx
mov dword [ebp - 0xba0], ecx
mov dword [ebp - 0xbe0], esi
cmp eax, dword [ebp - 0xb80]
jae 0x4165d0
mov dword [ebp - 0xbc8], 0xd0000095
mov dword [ebp - 0xbc4], edx
jmp 0x41650e
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xbcc], ecx
mov ecx, dword [ebp - 0xbd4]
mov dword [ebp - 0xbc8], 0xc0000095
mov dword [ebp - 0xbe0], eax
mov dword [ebp - 0xba0], edx
mov dword [ebp - 0xbc0], esi
mov dword [ebp - 0xbd4], ecx
jmp 0x415cdf
mov eax, dword [ebp - 0xb94]
mov edi, dword [ebp - 0xb88]
mov ecx, dword [ebp - 0xb78]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xb8c]
mov dword [ebp - 0xbcc], edi
mov edi, dword [ebp - 0xb90]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xbc8], 0xc0000095
mov dword [ebp - 0xba0], ecx
jmp 0x41642f
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xbc8], 0xc0000095
mov dword [ebp - 0xbe0], eax
jmp 0x4160d2
mov eax, dword [ebp - 0xb90]
mov edi, dword [ebp - 0xb88]
mov ecx, dword [ebp - 0xb8c]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xb78]
mov dword [ebp - 0xbcc], edi
mov edi, dword [ebp - 0xb94]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xb84]
mov dword [ebp - 0xbc8], 0xc0000095
mov dword [ebp - 0xba0], ecx
jmp 0x41642f
mov dword [ebp - 0xbc8], 0xc0000095
jmp 0x415cd9
mov dword [ebp - 0xbc8], 0xd0000095
mov dword [ebp - 0xbe0], esi
mov dword [ebp - 0xba0], ecx
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xbc0], edx
jmp 0x415cdf
mov eax, dword [ebp - 0xb78]
mov edi, dword [ebp - 0xb84]
mov ecx, dword [ebp - 0xb94]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xbcc], edi
mov edi, dword [ebp - 0xbac]
mov dword [ebp - 0xbc8], 0xd0000095
mov dword [ebp - 0xba0], ecx
mov dword [ebp - 0xbc0], eax
jmp 0x415cdf
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xbc8], 0xd0000095
mov dword [ebp - 0xba0], edi
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xbc0], eax
jmp 0x415cd9
mov edi, dword [ebp - 0xbdc]
mov dword [ebp - 0xbc8], 0xd0000001
jmp 0x415ce3
mov edi, ebx
jmp 0x415cdf
cmp dword [ebp - 0xcc0], 0
jne 0x418327
mov dword [ebp - 0xbc8], 0xc000000d
jmp 0x415e2d
cmp dword [ebp - 0xcc8], 0
jbe 0x418318
mov eax, dword [ebp - 0xcc0]
mov esi, dword [ebp - 0xbcc]
mov edi, dword [ebp - 0xba0]
mov edx, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xbac], edx
cmp ecx, eax
jb 0x4189b9
neg edx
sbb eax, eax
and eax, ecx
cmp dword [ebp - 0xbac], 4
mov edx, edi
mov dword [ebp - 0xb74], esi
mov dword [ebp - 0xb84], edx
jne 0x418898
mov eax, dword [eax]
mov dword [ebp - 0xbc8], eax
cmp eax, 0xd0000023
jne 0x41838c
mov ecx, 0x8007007a
jmp 0x4183a5
mov ecx, eax
cmp eax, 0x8007007a
je 0x4183a5
mov esi, dword [ebp - 0xb74]
mov edi, edx
test eax, eax
js 0x415e39
cmp dword [ebp - 0xcc8], 6
je 0x4183c5
mov dword [ebp - 0xbc8], 0xc004d501
mov edi, edx
mov esi, dword [ebp - 0xb74]
jmp 0x415e39
cmp dword [ebp - 0xcc0], 0
jne 0x4183da
mov dword [ebp - 0xbc8], 0xc000000d
jmp 0x4183b8
mov edx, dword [ebp - 0xcc0]
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xbac], ebx
mov ebx, dword [edx]
mov esi, dword [ebp - 0xb74]
mov edi, dword [ebp - 0xb84]
mov dword [ebp - 0xb94], ebx
lea ebx, [edx + 4]
push 0
mov dword [ebp - 0xb78], ebx
cmp ebx, edx
pop ebx
jb 0x41898e
mov edx, dword [ebp - 0xb78]
add edx, dword [ebp - 0xb94]
cmp edx, dword [ebp - 0xb78]
jb 0x4189b9
inc dword [ebp - 0xbac]
cmp dword [ebp - 0xbac], 1
mov dword [ebp - 0xb84], edi
mov dword [ebp - 0xb74], esi
jb 0x4183ec
mov ebx, dword [edx]
mov dword [ebp - 0xbac], ebx
lea ebx, [edx + 4]
push 0
mov dword [ebp - 0xb74], ebx
cmp ebx, edx
pop ebx
jb 0x4189b9
mov edx, dword [ebp - 0xbac]
neg edx
sbb edx, edx
and edx, dword [ebp - 0xb74]
cmp dword [ebp - 0xbac], 8
jne 0x418898
mov ebx, dword [edx]
mov edx, dword [edx + 4]
mov dword [ebp - 0xbac], ebx
mov dword [ebp - 0xb74], edx
cmp dword [ebp - 0xcc0], 0
push 0
pop ebx
je 0x418577
mov edx, dword [ebp - 0xcc0]
mov dword [ebp - 0xb84], ebx
mov dword [ebp - 0xb94], edi
mov dword [ebp - 0xb78], esi
jmp 0x4184c7
mov edi, dword [ebp - 0xb94]
mov esi, dword [ebp - 0xb78]
mov ebx, dword [ebp - 0xbac]
mov dword [ebp - 0xbac], ebx
mov ebx, dword [ebp - 0xb74]
mov dword [ebp - 0xb74], ebx
mov ebx, dword [edx]
mov dword [ebp - 0xb88], ebx
lea ebx, [edx + 4]
push 0
mov dword [ebp - 0xb8c], ebx
cmp ebx, edx
pop ebx
jb 0x418973
mov edx, dword [ebp - 0xb8c]
add edx, dword [ebp - 0xb88]
cmp edx, dword [ebp - 0xb8c]
jb 0x4189b9
inc dword [ebp - 0xb84]
cmp dword [ebp - 0xb84], 2
mov dword [ebp - 0xb94], edi
mov dword [ebp - 0xb78], esi
jb 0x4184bb
mov ebx, dword [edx]
mov dword [ebp - 0xb84], ebx
lea ebx, [edx + 4]
push 0
mov dword [ebp - 0xb94], ebx
cmp ebx, edx
pop ebx
jb 0x4189b9
mov edx, dword [ebp - 0xb84]
neg edx
sbb edx, edx
and edx, dword [ebp - 0xb94]
cmp dword [ebp - 0xb84], 4
jne 0x418898
mov edx, dword [edx]
mov dword [ebp - 0xb84], edx
cmp dword [ebp - 0xcc0], ebx
jne 0x418586
mov dword [ebp - 0xbc8], 0xc000000d
jmp 0x415e39
mov edx, dword [ebp - 0xcc0]
mov dword [ebp - 0xb94], ebx
mov dword [ebp - 0xb78], edi
mov dword [ebp - 0xb88], esi
jmp 0x4185ac
mov edi, dword [ebp - 0xb78]
mov esi, dword [ebp - 0xb88]
mov ebx, dword [ebp - 0xbac]
mov dword [ebp - 0xbac], ebx
mov ebx, dword [ebp - 0xb74]
mov dword [ebp - 0xb74], ebx
mov ebx, dword [ebp - 0xb84]
mov dword [ebp - 0xb84], ebx
mov ebx, dword [edx]
mov dword [ebp - 0xb8c], ebx
lea ebx, [edx + 4]
push 0
mov dword [ebp - 0xb90], ebx
cmp ebx, edx
pop ebx
jb 0x418958
mov edx, dword [ebp - 0xb90]
add edx, dword [ebp - 0xb8c]
cmp edx, dword [ebp - 0xb90]
jb 0x4189b9
inc dword [ebp - 0xb94]
cmp dword [ebp - 0xb94], 3
mov dword [ebp - 0xb78], edi
mov dword [ebp - 0xb88], esi
jb 0x4185a0
mov ebx, dword [edx]
mov dword [ebp - 0xb94], ebx
lea ebx, [edx + 4]
push 0
mov dword [ebp - 0xb78], ebx
cmp ebx, edx
pop ebx
jb 0x4189b9
mov edx, dword [ebp - 0xb94]
neg edx
sbb edx, edx
and edx, dword [ebp - 0xb78]
cmp dword [ebp - 0xcc0], ebx
je 0x418577
mov ebx, dword [ebp - 0xcc0]
mov dword [ebp - 0xb78], ebx
xor ebx, ebx
mov dword [ebp - 0xb88], ebx
mov dword [ebp - 0xb8c], edi
mov dword [ebp - 0xb90], esi
jmp 0x418685
mov edi, dword [ebp - 0xb8c]
mov esi, dword [ebp - 0xb90]
mov ebx, dword [ebp - 0xbac]
mov dword [ebp - 0xbac], ebx
mov ebx, dword [ebp - 0xb74]
mov dword [ebp - 0xb74], ebx
mov ebx, dword [ebp - 0xb84]
mov dword [ebp - 0xb84], ebx
mov ebx, dword [ebp - 0xb94]
mov dword [ebp - 0xb94], ebx
mov ebx, dword [ebp - 0xb78]
mov dword [ebp - 0xb7c], edx
push 0
mov edx, dword [ebx]
mov dword [ebp - 0xb78], edx
lea edx, [ebx + 4]
cmp edx, ebx
mov dword [ebp - 0xba0], edx
pop ebx
jb 0x41893d
mov ebx, edx
add ebx, dword [ebp - 0xb78]
cmp ebx, edx
mov dword [ebp - 0xb78], ebx
mov edx, dword [ebp - 0xb7c]
push 0
pop ebx
jb 0x4189b9
inc dword [ebp - 0xb88]
cmp dword [ebp - 0xb88], 4
mov dword [ebp - 0xb8c], edi
mov dword [ebp - 0xb90], esi
jb 0x418679
mov ebx, dword [ebp - 0xb78]
push 0
mov edx, dword [ebx]
mov dword [ebp - 0xb78], edx
lea edx, [ebx + 4]
cmp edx, ebx
mov dword [ebp - 0xb88], edx
mov edx, dword [ebp - 0xb7c]
pop ebx
jb 0x4189b9
mov ebx, dword [ebp - 0xb78]
neg ebx
sbb ebx, ebx
and dword [ebp - 0xb88], ebx
cmp dword [ebp - 0xb78], 4
push 0
pop ebx
jne 0x418898
mov ebx, dword [ebp - 0xb88]
mov ebx, dword [ebx]
mov dword [ebp - 0xb78], ebx
cmp dword [ebp - 0xcc0], 0
push 0
pop ebx
je 0x418577
mov ebx, dword [ebp - 0xcc0]
mov dword [ebp - 0xb88], ebx
xor ebx, ebx
mov dword [ebp - 0xb8c], ebx
mov dword [ebp - 0xb90], edi
mov dword [ebp - 0xba0], esi
jmp 0x4187af
mov edi, dword [ebp - 0xb90]
mov esi, dword [ebp - 0xba0]
mov ebx, dword [ebp - 0xbac]
mov dword [ebp - 0xbac], ebx
mov ebx, dword [ebp - 0xb74]
mov dword [ebp - 0xb74], ebx
mov ebx, dword [ebp - 0xb84]
mov dword [ebp - 0xb84], ebx
mov ebx, dword [ebp - 0xb94]
mov dword [ebp - 0xb94], ebx
mov ebx, dword [ebp - 0xb88]
mov dword [ebp - 0xb7c], edx
mov edx, dword [ebp - 0xb78]
mov dword [ebp - 0xb78], edx
mov edx, dword [ebx]
mov dword [ebp - 0xb88], edx
lea edx, [ebx + 4]
push 0
cmp edx, ebx
mov dword [ebp - 0xbb8], ecx
mov dword [ebp - 0xb80], edx
pop ebx
jb 0x418922
mov ebx, edx
add ebx, dword [ebp - 0xb88]
cmp ebx, edx
mov dword [ebp - 0xb88], ebx
mov edx, dword [ebp - 0xb7c]
push 0
pop ebx
jb 0x4189b9
inc dword [ebp - 0xb8c]
cmp dword [ebp - 0xb8c], 5
mov dword [ebp - 0xb90], edi
mov dword [ebp - 0xba0], esi
jb 0x4187a3
mov ecx, dword [ebp - 0xb88]
push 0
mov ebx, dword [ecx]
mov dword [ebp - 0xb88], ebx
lea ebx, [ecx + 4]
mov dword [ebp - 0xb8c], ebx
cmp ebx, ecx
pop ebx
jb 0x4189b9
mov ecx, dword [ebp - 0xb88]
neg ecx
mov dword [ebp - 0xbc8], ebx
sbb ecx, ecx
and ecx, dword [ebp - 0xb8c]
cmp dword [ebp - 0xb88], 4
je 0x4188a7
mov dword [ebp - 0xbc8], 0xc0000023
jmp 0x415e39
mov edx, dword [ebp - 0xbe4]
cmp edx, dword [ebp - 0xbac]
mov edx, dword [ebp - 0xb7c]
jne 0x418913
mov edi, dword [ebp - 0xb90]
mov esi, dword [ebp - 0xba0]
mov dword [ebp - 0xbc8], 0xc0000095
jmp 0x415e39
mov edi, dword [ebp - 0xb8c]
mov esi, dword [ebp - 0xb90]
mov dword [ebp - 0xbc8], 0xc0000095
jmp 0x415e39
mov edi, dword [ebp - 0xb78]
mov esi, dword [ebp - 0xb88]
mov dword [ebp - 0xbc8], 0xc0000095
jmp 0x415e39
mov edi, dword [ebp - 0xb94]
mov esi, dword [ebp - 0xb78]
mov dword [ebp - 0xbc8], 0xc0000095
jmp 0x415e39
mov edi, dword [ebp - 0xb84]
mov dword [ebp - 0xbc8], 0xc0000095
jmp 0x4183ba
mov dword [ebp - 0xbc8], 0xd0000095
jmp 0x415e39
or dword [ebp - 0xc84], 0xffffffff
mov dword [ebp - 0xbc8], 0xc0000095
jmp 0x415e39
test eax, eax
js 0x415e39
mov eax, dword [ebp - 0xbb8]
test eax, eax
je 0x415e39
mov dword [ebp - 0xbc8], eax
jmp 0x415e39
mov esi, dword [0x42904c]
mov ecx, esi
call dword [0x42b5a4]
call esi
mov dword [0x42adc0], eax
lea edi, [ebp - 0x454]
mov eax, dword [0x42a874]
mov dword [ebp - 0xb74], eax
xor eax, eax
stosd dword es:[edi], eax
push 0x2c
push ebx
mov dword [0x42adc4], edx
stosd dword es:[edi], eax
mov dword [ebp - 0xb84], ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x5f0]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0xb94], ebx
xor ebx, ebx
mov edx, 0x42add0
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x418a3f
mov eax, dword [0x42adcc]
push 0
pop ebx
test eax, eax
jne 0x41900f
mov edi, 0x338
mov dword [ebp - 0xb78], ebx
push edi
push ebx
mov dword [ebp - 0xb88], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb8c], eax
test eax, eax
je 0x419520
or dword [ebp - 0xb7c], 0xffffffff
mov edx, 0xab69605e
mov dword [ebp - 0x3b8], edx
add eax, 7
mov edx, 0x7f1137f
mov dword [ebp - 0xb90], ebx
mov edi, 0x403012
mov dword [ebp - 0x3b4], edx
mov cl, bl
mov dword [ebp - 0xba0], eax
mov esi, ebx
mov dword [ebp - 0xb80], edi
mov edx, ebx
mov dword [ebp - 0xb98], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xb80]
xor edx, ebx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb80]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb80]
shl edi, 8
add dword [ebp - 0xb80], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov eax, esi
mov dword [ebp - 0xba8], esi
add eax, 0x54969fa2
rol dword [ebp - 0xba8], 0xa
rol eax, 5
imul eax, eax, 0x137f
add eax, dword [ebp - 0xba8]
xor edx, eax
mov dword [ebp - 0xbd0], edx
lea eax, [edx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xbd0]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xbd0]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xbd0], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xbd0]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xbd0]
xor edx, eax
mov dword [ebp - 0xbd0], edx
mov eax, dword [ebp - 0xbd0]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xbd0]
xor eax, edx
mov dword [ebp - 0xbd0], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xbd0]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xbd0]
xor eax, edx
mov dword [ebp - 0xbd0], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xbd0]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xbd0]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0xbd0], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0xbd0]
xor eax, 0xab69605e
mov dword [ebp - 0xba8], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xba8]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xba8]
xor eax, edx
mov dword [ebp - 0xba8], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0xba8], edx
mov edx, dword [ebp - 0xba8]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xba8], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xba8]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xba8]
xor eax, edx
mov dword [ebp - 0xba8], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xba8]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xba8]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xba8], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xba8]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xba8]
xor edx, dword [ebp - 0xb90]
xor eax, dword [ebp - 0xb7c]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xbd0], esi
mov esi, dword [ebp - 0xba0]
mov dword [ebp - 0xb7c], edi
mov edi, dword [ebp - 0xb80]
mov dword [ebp - 0xb90], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xb98], 1
mov dword [ebp - 0xba0], esi
mov esi, eax
mov dword [ebp - 0xba8], eax
jne 0x418ad1
mov esi, dword [ebp - 0xb8c]
xor ebx, ebx
mov eax, ebx
mov edi, 0x338
xor cl, byte [eax + esi]
inc eax
cmp eax, edi
jb 0x418e5d
movzx eax, cl
cdq
cmp eax, dword [0x403348]
jne 0x419511
cmp edx, dword [0x40334c]
jne 0x419511
push 0x40
push ebx
push 0x42a878
mov byte [esi + edi - 1], bl
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov edi, esi
cmp byte [esi], bl
je 0x418fef
mov edi, 0x42a878
mov dword [ebp - 0xb8c], esi
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xb88], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x418eb7
sub ecx, dword [ebp - 0xb88]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0x418fdb
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xb88], edx
cmp word [eax], cx
je 0x418eff
mov edx, 0xc000007b
mov dword [ebp - 0xb88], edx
jmp 0x418f53
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0x418ef2
add ecx, dword [edi]
mov dword [ebp - 0xb90], ecx
cmp ecx, dword [edi]
jb 0x418ef2
cmp dword [ecx], 0x4550
jne 0x418ef2
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xc20]
je 0x418f3b
cmp ax, word [ebp - 0x394]
je 0x418f3b
mov edx, 0xc000000d
jmp 0x418ef7
mov eax, dword [ecx + 0x78]
mov ecx, dword [ecx + 0x7c]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0xb90]
mov dword [edi + 0xc], ecx
mov eax, dword [eax + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xb90], eax
mov dword [ebp - 0xb7c], ebx
test eax, eax
je 0x418fce
mov ecx, esi
mov dword [ebp - 0xba0], esi
lea eax, [ecx + 1]
mov dword [ebp - 0xb80], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418f7a
sub ecx, dword [ebp - 0xb80]
inc esi
add esi, ecx
test edx, edx
js 0x418fb3
push dword [ebp - 0xba0]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0x418fe5
mov ecx, dword [ebp - 0xb78]
mov edx, dword [ebp - 0xb88]
mov dword [ecx*4 + section..data], eax
mov eax, dword [ebp - 0xb7c]
inc dword [ebp - 0xb78]
inc eax
mov dword [ebp - 0xb7c], eax
cmp eax, dword [ebp - 0xb90]
jb 0x418f69
add edi, 0x10
cmp byte [esi], bl
jne 0x418eaa
jmp 0x418fe5
mov dword [ebp - 0xb88], 0xc000007a
mov edi, dword [ebp - 0xb8c]
test edi, edi
je 0x418ffe
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push edi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb88], ebx
jl 0x419520
mov eax, dword [0x42adcc]
inc eax
mov dword [0x42adcc], eax
xor eax, eax
mov edx, 0x42add0
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0xb78], ebx
lea edi, [ebp - 0x468]
mov dword [ebp - 0xb88], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xc78], ebx
mov dword [ebp - 0xb8c], ebx
mov dword [ebp - 0xb90], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xb7c], ebx
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x419050
mov eax, dword [0x42adcc]
push 0
pop ebx
test eax, eax
jne 0x41966d
mov edi, 0x338
mov dword [ebp - 0xba0], ebx
push edi
push ebx
mov dword [ebp - 0xb80], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb98], eax
test eax, eax
je 0x419742
or dword [ebp - 0xbd0], 0xffffffff
mov edx, 0xab69605e
mov dword [ebp - 0x3c0], edx
add eax, 7
mov edx, 0x7f1137f
mov dword [ebp - 0xba8], ebx
mov edi, 0x403012
mov dword [ebp - 0x3bc], edx
mov cl, bl
mov dword [ebp - 0xba4], eax
mov esi, ebx
mov dword [ebp - 0xbc4], edi
mov edx, ebx
mov dword [ebp - 0xbbc], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xbc4]
xor edx, ebx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xbc4]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xbc4]
shl edi, 8
add dword [ebp - 0xbc4], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov eax, esi
mov dword [ebp - 0xbd4], esi
add eax, 0x54969fa2
rol dword [ebp - 0xbd4], 0xa
rol eax, 5
imul eax, eax, 0x137f
add eax, dword [ebp - 0xbd4]
xor edx, eax
mov dword [ebp - 0xbb0], edx
lea eax, [edx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xbb0]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xbb0]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xbb0], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xbb0]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xbb0]
xor edx, eax
mov dword [ebp - 0xbb0], edx
mov eax, dword [ebp - 0xbb0]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xbb0]
xor eax, edx
mov dword [ebp - 0xbb0], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xbb0]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xbb0]
xor eax, edx
mov dword [ebp - 0xbb0], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xbb0]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xbb0]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0xbb0], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0xbb0]
xor eax, 0xab69605e
mov dword [ebp - 0xbd4], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xbd4]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xbd4]
xor eax, edx
mov dword [ebp - 0xbd4], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0xbd4], edx
mov edx, dword [ebp - 0xbd4]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xbd4], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xbd4]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xbd4]
xor eax, edx
mov dword [ebp - 0xbd4], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xbd4]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xbd4]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xbd4], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xbd4]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xbd4]
xor edx, dword [ebp - 0xba8]
xor eax, dword [ebp - 0xbd0]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xbb0], esi
mov esi, dword [ebp - 0xba4]
mov dword [ebp - 0xbd0], edi
mov edi, dword [ebp - 0xbc4]
mov dword [ebp - 0xba8], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xbbc], 1
mov dword [ebp - 0xba4], esi
mov esi, eax
mov dword [ebp - 0xbd4], eax
jne 0x4190e2
mov esi, dword [ebp - 0xb98]
xor ebx, ebx
mov eax, ebx
mov edi, 0x338
xor cl, byte [eax + esi]
inc eax
cmp eax, edi
jb 0x41946e
movzx eax, cl
cdq
cmp eax, dword [0x403348]
jne 0x419733
cmp edx, dword [0x40334c]
jne 0x419733
push 0x40
push ebx
push 0x42a878
mov byte [esi + edi - 1], bl
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov edi, esi
cmp byte [esi], bl
je 0x41964d
mov edi, 0x42a878
mov dword [ebp - 0xb98], esi
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xb80], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4194c8
sub ecx, dword [ebp - 0xb80]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0x419639
mov eax, dword [edi]
mov ecx, 0x5a4d
mov dword [ebp - 0xb80], ebx
cmp word [eax], cx
je 0x41955f
mov edx, 0xc000007b
mov dword [ebp - 0xb80], edx
jmp 0x4195b1
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, ebx
mov eax, dword [esi + 0x42a878]
test eax, eax
je 0x419533
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x419522
push 0x40
push ebx
push 0x42a878
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x4011f0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x419015
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0x419501
mov eax, dword [edi]
lea edx, [ecx + eax]
cmp edx, eax
jb 0x419501
cmp dword [edx], 0x4550
jne 0x419501
movzx eax, word [edx + 0x18]
mov ecx, 0x10b
cmp ax, cx
je 0x41959d
mov ecx, 0x20b
cmp ax, cx
je 0x41959d
mov edx, 0xc000000d
jmp 0x419506
mov eax, dword [edx + 0x78]
mov ecx, dword [edx + 0x7c]
mov dword [edi + 8], eax
mov dword [edi + 0xc], ecx
mov eax, dword [edx + 0x50]
mov edx, ebx
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0xbd0], ebx
test eax, eax
je 0x41962c
mov ecx, esi
mov dword [ebp - 0xba4], esi
lea eax, [ecx + 1]
mov dword [ebp - 0xbc4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4195d8
sub ecx, dword [ebp - 0xbc4]
inc esi
add esi, ecx
test edx, edx
js 0x419611
push dword [ebp - 0xba4]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0x419643
mov ecx, dword [ebp - 0xba0]
mov edx, dword [ebp - 0xb80]
mov dword [ecx*4 + section..data], eax
mov eax, dword [ebp - 0xbd0]
inc dword [ebp - 0xba0]
inc eax
mov dword [ebp - 0xbd0], eax
cmp eax, dword [ebp - 0xba8]
jb 0x4195c7
add edi, 0x10
cmp byte [esi], bl
jne 0x4194bb
jmp 0x419643
mov dword [ebp - 0xb80], 0xc000007a
mov edi, dword [ebp - 0xb98]
test edi, edi
je 0x41965c
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push edi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb80], ebx
jl 0x419742
mov eax, dword [0x42adcc]
inc eax
mov dword [0x42adcc], eax
xor eax, eax
mov ecx, 0x42add0
xchg dword [ecx], eax
push 0x54
lea eax, [ebp - 0x858]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
mov esi, dword [0x42907c]
lea edi, [ebp - 0x458]
add esp, 0xc
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
pop edx
push 0x403
push ebx
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xb74]
mov ecx, eax
and ecx, edx
mov dword [ebp - 0xb74], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0xc], cx
mov ecx, eax
shr ecx, 8
and ecx, edx
shr eax, 0xc
mov word [ebp - 0xa], cx
and eax, edx
mov ecx, esi
mov word [ebp - 8], ax
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0xb80], 0xffffff
test eax, eax
jne 0x419781
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb98], edi
test edi, edi
jle 0x41971e
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb98], edi
test edi, edi
js 0x41ad73
mov dword [ebp - 0xb98], 0x80004005
jmp 0x41ad73
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, ebx
mov eax, dword [esi + 0x42a878]
test eax, eax
je 0x419755
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x419744
push 0x40
push ebx
push 0x42a878
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x4011f0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x419673
mov esi, dword [0x429050]
lea eax, [ebp - 0xc54]
push eax
push ebx
lea eax, [ebp - 0xbf8]
mov dword [ebp - 0xc74], ebx
push eax
mov edi, ebx
mov dword [ebp - 0xc70], ebx
push 8
mov ecx, esi
mov dword [ebp - 0xba8], ebx
mov dword [ebp - 0xc6c], ebx
mov dword [ebp - 0xc64], ebx
mov dword [ebp - 0xc60], ebx
mov dword [ebp - 0xb98], edi
mov dword [ebp - 0xc54], ebx
call dword [0x42b5a4]
call esi
test eax, eax
jne 0x419811
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb98], edi
test edi, edi
jle 0x4197fb
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb98], edi
test edi, edi
js 0x41995d
mov edi, 0x80004005
mov dword [ebp - 0xb98], edi
jmp 0x41995d
mov eax, dword [ebp - 0xc54]
add eax, eax
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
lea ecx, [ebp - 0xc64]
mov esi, eax
call fcn.00424fd6
test esi, esi
jne 0x419846
mov dword [ebp - 0xc64], ebx
mov edi, 0x8007000e
jmp 0x419806
mov eax, dword [ebp - 0xbf8]
mov dword [ebp - 0xc64], esi
lea eax, [eax*4 + 4]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
lea ecx, [ebp - 0xc60]
mov esi, eax
call fcn.00424fd6
test esi, esi
jne 0x419889
mov edi, 0x8007000e
mov dword [ebp - 0xb98], edi
jmp 0x419957
lea eax, [ebp - 0xc54]
mov dword [ebp - 0xc60], esi
mov esi, dword [0x429050]
mov ecx, esi
push eax
push dword [ebp - 0xc64]
lea eax, [ebp - 0xbf8]
push eax
push 8
call dword [0x42b5a4]
call esi
test eax, eax
je 0x4197d8
cmp dword [ebp - 0xbf8], 0
mov edx, dword [ebp - 0xc60]
mov eax, dword [ebp - 0xc64]
mov dword [ebp - 0xba4], edx
mov dword [ebp - 0xbc4], ebx
jbe 0x419938
mov edi, eax
mov esi, dword [0x429058]
mov ecx, esi
push ebx
push edi
call dword [0x42b5a4]
call esi
mov edx, dword [ebp - 0xba4]
mov ecx, edi
mov dword [edx], eax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4198ff
mov eax, dword [ebp - 0xbc4]
sub ecx, esi
sar ecx, 1
add edx, 4
mov dword [ebp - 0xba4], edx
lea edi, [edi + ecx*2]
add edi, 2
inc eax
mov dword [ebp - 0xbc4], eax
cmp eax, dword [ebp - 0xbf8]
jb 0x4198e0
mov edi, dword [ebp - 0xb98]
mov dword [edx], 0x409
mov eax, dword [ebp - 0xc60]
mov dword [ebp - 0xc74], eax
mov eax, dword [ebp - 0xbf8]
inc eax
mov dword [ebp - 0xbd0], eax
mov dword [ebp - 0xc60], ebx
lea ecx, [ebp - 0xc60]
call fcn.00424fd6
lea ecx, [ebp - 0xc64]
call fcn.00424fd6
test edi, edi
js 0x41a0ed
cmp dword [ebp - 0xbd0], 0
mov edi, ebx
mov dword [ebp - 0xba4], edi
mov esi, ebx
jbe 0x4199bb
mov eax, dword [ebp - 0xc74]
mov edx, ebx
mov ecx, dword [eax + esi*4]
cmp ecx, dword [edx*4 + 0x402c18]
je 0x4199b3
inc edx
cmp edx, 0x26
jb 0x419996
inc esi
cmp esi, dword [ebp - 0xbd0]
jb 0x419994
jmp 0x4199bb
mov edi, edx
mov dword [ebp - 0xba4], edx
mov esi, dword [0x429054]
lea eax, [ebp - 0x100]
push ebx
push 0x55
push eax
push dword [edi*4 + 0x402c18]
mov ecx, esi
mov dword [ebp - 0xbd0], ebx
call dword [0x42b5a4]
call esi
test eax, eax
je 0x419a20
mov esi, dword [0x429048]
lea eax, [ebp - 0x498]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0x100]
mov ecx, esi
push eax
call dword [0x42b5a4]
call esi
test eax, eax
jle 0x419a20
mov edi, dword [ebp - 0x48c]
xor eax, eax
shr edi, 0x1b
inc eax
and edi, eax
mov dword [ebp - 0xbd0], edi
mov edx, 0x402d30
mov esi, ebx
mov ecx, edx
mov dword [ebp + esi*4 - 0x390], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x419a33
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0x419a27
imul ecx, dword [ebp - 0xba4], 3
movzx eax, byte [ecx + 0x402cb0]
mov eax, dword [ebp + eax*4 - 0x390]
mov dword [ebp - 0xb8c], eax
movzx eax, byte [ecx + 0x402cb1]
mov eax, dword [ebp + eax*4 - 0x390]
mov dword [ebp - 0xb90], eax
movzx eax, byte [ecx + 0x402cb2]
mov eax, dword [ebp + eax*4 - 0x390]
mov dword [ebp - 0xb7c], eax
push 0x1c90
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xb98], ecx
test ecx, ecx
je 0x419f3b
or dword [ebp - 0xbc4], 0xffffffff
mov edx, 0xab69605e
mov dword [ebp - 0x3c8], edx
add ecx, 7
mov edx, 0x7f1137f
mov dword [ebp - 0xba8], ebx
mov edi, 0x403352
mov dword [ebp - 0x3c4], edx
mov al, bl
mov dword [ebp - 0xbbc], ecx
mov esi, ebx
mov dword [ebp - 0xbd4], edi
mov edx, ebx
mov dword [ebp - 0xbb0], 0x392
movzx ebx, byte [edi - 2]
movzx ecx, byte [edi - 1]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [edi]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, ecx
shl edi, 8
mov ecx, dword [ebp - 0xbd4]
xor edx, ebx
mov dword [ebp - 0xbc0], edx
movzx ecx, byte [ecx + 3]
or edi, ecx
mov ecx, dword [ebp - 0xbd4]
shl edi, 8
movzx ecx, byte [ecx + 4]
or edi, ecx
mov ecx, dword [ebp - 0xbd4]
shl edi, 8
add dword [ebp - 0xbd4], 8
movzx ecx, byte [ecx + 5]
or edi, ecx
xor esi, edi
mov dword [ebp - 0xbb8], esi
mov esi, edx
xor esi, dword [ebp - 0xbb8]
xor esi, 0xac987321
lea ecx, [esi + 0x54969fa2]
rol ecx, 5
imul edx, ecx, 0x137f
mov ecx, esi
rol ecx, 0xa
add edx, ecx
mov ecx, dword [ebp - 0xbc0]
xor ecx, edx
mov dword [ebp - 0xbc0], ecx
add ecx, 0x7f1137f
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0xbc0]
rol ecx, 2
sub edx, ecx
xor esi, edx
imul edx, esi, 0x605e
mov ecx, esi
shr ecx, 0xd
sub edx, ecx
mov ecx, dword [ebp - 0xbc0]
sub edx, 0x756c8a2
xor ecx, edx
mov dword [ebp - 0xbc0], ecx
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0xbc0]
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub ecx, edx
mov edx, dword [ebp - 0xbc0]
xor edx, ecx
mov dword [ebp - 0xbc0], edx
mov ecx, dword [ebp - 0xbc0]
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
xor esi, edx
lea ecx, [esi + 0x7f1137f]
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, esi
rol ecx, 2
add edx, ecx
mov ecx, dword [ebp - 0xbc0]
xor ecx, edx
mov dword [ebp - 0xbc0], ecx
add ecx, 0x54969fa2
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, dword [ebp - 0xbc0]
rol ecx, 8
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0xab69605e
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, esi
ror ecx, 0xa
xor edx, ecx
mov ecx, dword [ebp - 0xbc0]
xor ecx, edx
mov dword [ebp - 0xbc0], ecx
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, dword [ebp - 0xbc0]
shr ecx, 0xa
xor edx, ecx
xor edx, esi
mov esi, dword [ebp - 0xbc0]
mov ecx, edx
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor esi, ecx
lea ecx, [esi - 0x7f1]
xor ecx, edx
xor ecx, 0xab69605e
mov dword [ebp - 0xbb8], ecx
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0xbb8]
shr ecx, 2
add edx, ecx
xor esi, edx
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, esi
rol ecx, 7
add edx, ecx
mov ecx, dword [ebp - 0xbb8]
xor ecx, edx
mov dword [ebp - 0xbb8], ecx
mov edx, ecx
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor esi, edx
mov ecx, esi
mov edx, esi
xor ecx, 0xab69
rol esi, 7
rol ecx, 5
imul ecx, ecx, 0x7f1
add ecx, esi
mov esi, dword [ebp - 0xbb8]
xor esi, ecx
mov dword [ebp - 0xbb8], esi
xor esi, edx
mov edx, dword [ebp - 0xbb8]
xor esi, 0xac987321
mov ecx, esi
ror ecx, 3
imul ecx, ecx, 0x137f
sub ecx, 0xd0dd417
xor edx, ecx
mov dword [ebp - 0xbb8], edx
lea ecx, [edx - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0xbb8]
ror ecx, 6
sub edx, ecx
xor esi, edx
lea ecx, [esi - 0x54969fa2]
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, esi
rol ecx, 0xe
add edx, ecx
mov ecx, dword [ebp - 0xbb8]
xor ecx, edx
mov dword [ebp - 0xbb8], ecx
add ecx, 0xab69605e
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0xbb8]
ror ecx, 0xe
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, esi
shr ecx, 3
xor edx, ecx
mov ecx, dword [ebp - 0xbb8]
xor ecx, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xbb8], ecx
xor ecx, edx
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0xbb8]
rol ecx, 2
xor edx, ecx
mov ecx, dword [ebp - 0xbb8]
xor edx, dword [ebp - 0xba8]
xor ecx, dword [ebp - 0xbc4]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xbc0], esi
mov esi, dword [ebp - 0xbbc]
mov dword [ebp - 0xbc4], edi
mov edi, dword [ebp - 0xbd4]
mov dword [ebp - 0xba8], ebx
mov byte [esi - 4], dl
mov byte [esi], cl
ror edx, 8
mov byte [esi - 5], dl
ror ecx, 8
mov byte [esi - 1], cl
ror edx, 8
mov byte [esi - 6], dl
ror ecx, 8
mov byte [esi - 2], cl
ror edx, 8
ror ecx, 8
mov byte [esi - 7], dl
mov byte [esi - 3], cl
add esi, 8
ror ecx, 8
ror edx, 8
sub dword [ebp - 0xbb0], 1
mov dword [ebp - 0xbbc], esi
mov esi, ecx
mov dword [ebp - 0xbb8], ecx
jne 0x419afb
mov ecx, dword [ebp - 0xb98]
xor ebx, ebx
mov edx, ebx
mov esi, 0x1c90
xor al, byte [edx + ecx]
inc edx
cmp edx, esi
jb 0x419e9b
movzx eax, al
cdq
cmp eax, dword [0x404fe0]
jne 0x41a0cd
cmp edx, dword [0x404fe4]
jne 0x41a0cd
mov eax, ebx
mov dword [ebp - 0xc70], ecx
mov dword [ebp - 0xba8], esi
mov edi, ebx
mov dword [ebp - 0xb98], eax
mov esi, ebx
mov ebx, dword [ebp - 0xba4]
cmp ebx, esi
jne 0x419ee8
mov dword [ebp + edi*4 - 0x320], ecx
mov edx, ecx
lea eax, [edx + 1]
mov dword [ebp - 0xbc4], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x419ef3
sub edx, dword [ebp - 0xbc4]
inc ecx
add ecx, edx
inc esi
cmp esi, 0x26
jb 0x419edd
inc edi
push 0
pop ebx
cmp edi, 6
jb 0x419ed5
push 0xc
pop eax
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
lea ecx, [ebp - 0xc6c]
mov edi, eax
call fcn.00424fd6
test edi, edi
jne 0x419f4b
mov dword [ebp - 0xc6c], ebx
mov edi, 0x8007000e
mov dword [ebp - 0xb98], edi
jmp 0x41a0ed
xor eax, eax
mov dword [ebp - 0xc6c], edi
stosd dword es:[edi], eax
lea ecx, [ebp - 0xc]
mov esi, ebx
mov dword [ebp - 0xba4], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0xba8], eax
movzx edx, word [ecx]
mov eax, ebx
cmp dx, word [eax*2 + 0x402d24]
je 0x419f87
inc eax
cmp eax, 6
jb 0x419f72
jmp 0x41a061
mov edi, dword [ebp + eax*4 - 0x320]
mov ecx, edi
mov edx, dword [0x429060]
mov dword [ebp - 0xbc4], edx
lea eax, [ecx + 1]
mov dword [ebp - 0xbbc], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x419fa5
sub ecx, dword [ebp - 0xbbc]
push ebx
push ebx
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
push ebx
push 0xfde9
call dword [0x42b5a4]
call dword [ebp - 0xbc4]
mov dword [ebp - 0xbc4], eax
test eax, eax
je 0x41a09e
lea ecx, [eax + eax]
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0xc6c]
mov dword [ecx + esi], eax
mov eax, dword [ebp - 0xc6c]
cmp dword [eax + esi], ebx
je 0x419f3b
mov eax, dword [eax + esi]
mov ecx, edi
mov edx, dword [0x429060]
mov dword [ebp - 0xbd4], eax
mov dword [ebp - 0xbbc], edx
lea eax, [ecx + 1]
mov dword [ebp - 0xbb0], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41a025
push dword [ebp - 0xbc4]
sub ecx, dword [ebp - 0xbb0]
push dword [ebp - 0xbd4]
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
push ebx
push 0xfde9
call dword [0x42b5a4]
call dword [ebp - 0xbbc]
test eax, eax
je 0x41a09e
mov ecx, dword [ebp - 0xba4]
push 0xc
add ecx, 2
add esi, 4
pop eax
mov dword [ebp - 0xba4], ecx
cmp esi, eax
jb 0x419f6d
mov eax, dword [ebp - 0xc6c]
mov edi, dword [ebp - 0xb98]
mov dword [ebp - 0xc78], eax
mov eax, dword [ebp - 0xbd0]
mov dword [ebp - 0xc6c], ebx
mov dword [ebp - 0x858], eax
jmp 0x41a0ed
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb98], edi
test edi, edi
jle 0x41a0c1
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb98], edi
test edi, edi
js 0x41a0ed
mov edi, 0x80004005
jmp 0x419f40
mov edi, 0xc004d501
mov dword [ebp - 0xb98], edi
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xba8], ebx
cmp dword [ebp - 0xc6c], 0
je 0x41a15b
push 0xc
mov esi, ebx
pop edi
mov eax, dword [ebp - 0xc6c]
cmp dword [eax + esi], ebx
je 0x41a14e
mov ecx, dword [eax + esi]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41a10c
mov eax, dword [ebp - 0xc6c]
sub ecx, edx
sar ecx, 1
mov eax, dword [eax + esi]
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x41a137
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x41a12f
mov eax, dword [ebp - 0xc6c]
push dword [eax + esi]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
add esi, 4
cmp esi, edi
jb 0x41a0fb
mov edi, dword [ebp - 0xb98]
mov eax, dword [ebp - 0xc70]
test eax, eax
je 0x41a177
mov ecx, dword [ebp - 0xba8]
test ecx, ecx
je 0x41a177
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x41a16f
lea ecx, [ebp - 0xc6c]
call fcn.00424fd6
lea ecx, [ebp - 0xc70]
call fcn.00424fd6
lea ecx, [ebp - 0xc74]
call fcn.00424fd6
test edi, edi
js 0x41ad5c
mov eax, dword [ebp - 0xc78]
mov esi, dword [0x4290b4]
push 0xc
mov ecx, dword [eax]
mov dword [ebp - 0x850], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x84c], ecx
mov ecx, esi
mov eax, dword [eax + 8]
mov dword [ebp - 0x848], eax
pop eax
push ebx
mov dword [ebp - 0xc98], eax
lea eax, [ebp - 0xc98]
push eax
push ebx
push 0x42
mov dword [ebp - 0xc94], ebx
mov dword [ebp - 0xc90], ebx
call dword [0x42b5a4]
call esi
test eax, eax
jne 0x41a22e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb98], edi
test edi, edi
jle 0x41a217
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb98], edi
test edi, edi
js 0x41a223
mov dword [ebp - 0xb98], 0x80004005
mov dword [ebp - 0x854], ebx
jmp 0x41ad5c
mov eax, dword [ebp - 0xc94]
xor ecx, ecx
inc ecx
and eax, ecx
mov dword [ebp - 0x854], eax
mov eax, dword [ebp - 0xb74]
push 0x2a
sub eax, ecx
pop ecx
mov dword [ebp - 0xba8], ecx
je 0x41a27b
sub eax, 1
je 0x41a26f
sub eax, 1
jne 0x41a28b
mov edi, 0xe1
mov dword [ebp - 0xb78], edi
mov dword [ebp - 0xb88], edi
jmp 0x41a28b
mov dword [ebp - 0xb78], 0xf
jmp 0x41a281
mov dword [ebp - 0xb78], ecx
mov dword [ebp - 0xb88], 0xb
mov esi, 0xdc
mov dword [ebp - 0xbd0], 0x60
push esi
lea eax, [ebp - 0x7f0]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov word [ebp - 0x7ac], si
mov esi, dword [0x429070]
lea eax, [ebp - 0x7f0]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41a31c
mov eax, dword [ebp - 0x744]
movzx edi, word [ebp - 0x74a]
mov ecx, dword [ebp - 0x740]
push 0x60
mov dword [ebp - 0xba4], eax
mov dword [ebp - 0x460], eax
pop eax
mov dword [ebp - 0xbd0], edi
mov dword [ebp - 0x464], ebx
mov dword [ebp - 0x468], ebx
mov dword [ebp - 0xbc4], ecx
mov dword [ebp - 0x45c], ecx
cmp edi, eax
jae 0x41a334
mov dword [ebp - 0xbd0], eax
jmp 0x41a334
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0xba4], eax
xor eax, eax
inc eax
cmp dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0xb8c]
je 0x41a34b
mov eax, dword [ebp - 0xb7c]
push 0x5c
mov dword [ebp - 0xbbc], eax
lea eax, [ebp - 0x650]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov esi, dword [0x42907c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xb98], edi
push 0x403
push ebx
push ebx
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xbd4], eax
test eax, eax
jne 0x41a3ba
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb98], edi
test edi, edi
jle 0x41a3af
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb98], edi
test edi, edi
js 0x41a471
jmp 0x41a8e7
mov esi, dword [0x42905c]
mov ecx, esi
push 0x48
push dword [ebp - 0xbd0]
push dword [ebp - 0xb78]
call dword [0x42b5a4]
call esi
push dword [ebp - 0xbbc]
neg eax
mov dword [ebp - 0x640], 0x190
push 0x20
mov dword [ebp - 0x650], eax
lea ecx, [ebp - 0x634]
pop eax
mov edx, eax
mov byte [ebp - 0x636], 5
call fcn.0040675d
mov esi, dword [0x429010]
lea eax, [ebp - 0x650]
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
jne 0x41a454
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb98], edi
test edi, edi
jle 0x41a445
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb98], edi
test edi, edi
js 0x41a45a
mov edi, 0x80004005
mov dword [ebp - 0xb98], edi
jmp 0x41a45a
mov dword [ebp - 0x844], eax
push dword [ebp - 0xbd4]
mov esi, dword [0x4290b0]
mov ecx, esi
push ebx
call dword [0x42b5a4]
call esi
test edi, edi
js 0x41ad5c
xor eax, eax
inc eax
cmp dword [ebp - 0xb74], eax
je 0x41a490
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xb8c], eax
push 0x5c
lea eax, [ebp - 0x6b0]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov esi, dword [0x42907c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xb98], edi
push 0x403
push ebx
push ebx
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xb78], eax
test eax, eax
jne 0x41a4f9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb98], edi
test edi, edi
jle 0x41a4ee
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb98], edi
test edi, edi
js 0x41a5b0
jmp 0x41a8e7
mov esi, dword [0x42905c]
mov ecx, esi
push 0x48
push dword [ebp - 0xbd0]
push dword [ebp - 0xb88]
call dword [0x42b5a4]
call esi
push dword [ebp - 0xb8c]
neg eax
mov dword [ebp - 0x6a0], 0x190
push 0x20
mov dword [ebp - 0x6b0], eax
lea ecx, [ebp - 0x694]
pop eax
mov edx, eax
mov byte [ebp - 0x696], 5
call fcn.0040675d
mov esi, dword [0x429010]
lea eax, [ebp - 0x6b0]
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
jne 0x41a593
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb98], edi
test edi, edi
jle 0x41a584
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb98], edi
test edi, edi
js 0x41a599
mov edi, 0x80004005
mov dword [ebp - 0xb98], edi
jmp 0x41a599
mov dword [ebp - 0x840], eax
push dword [ebp - 0xb78]
mov esi, dword [0x4290b0]
mov ecx, esi
push ebx
call dword [0x42b5a4]
call esi
test edi, edi
js 0x41ad5c
mov esi, dword [ebp - 0xb74]
mov eax, ebx
mov ecx, esi
mov edx, ebx
sub ecx, 1
je 0x41a5d3
sub ecx, 1
je 0x41a616
sub ecx, 1
jne 0x41a5df
mov eax, dword [ebp - 0xba4]
mov edx, dword [ebp - 0xbc4]
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x44c], edx
mov ecx, esi
sub ecx, 1
je 0x41a639
sub ecx, 1
je 0x41a629
sub ecx, 1
je 0x41a629
mov ecx, dword [ebp - 0xbf8]
mov edx, dword [ebp - 0xb88]
mov dword [ebp - 0xba8], ecx
mov ecx, dword [ebp - 0xb78]
jmp 0x41a656
mov eax, dword [ebp - 0xba4]
cdq
and edx, 3
add eax, edx
mov edx, ebx
sar eax, 2
jmp 0x41a5df
mov ecx, ebx
mov dword [ebp - 0xba8], ebx
mov dword [ebp - 0xb8c], ebx
jmp 0x41a648
mov ecx, 0x96
mov dword [ebp - 0xb8c], 0x20
mov edx, ebx
mov dword [ebp - 0xb78], ecx
mov dword [ebp - 0xb88], edx
push dword [ebp - 0x844]
mov esi, dword [0x42903c]
sub eax, ecx
push dword [ebp - 0xba0]
mov edi, dword [ebp - 0x850]
sub eax, edx
mov ecx, esi
mov dword [ebp - 0xb7c], eax
mov dword [ebp - 0x81c], eax
mov dword [ebp - 0x82c], eax
mov dword [ebp - 0xb98], ebx
call dword [0x42b5a4]
call esi
mov esi, dword [0x42906c]
mov ecx, esi
push ebx
push 0xc50
mov dword [ebp - 0xba4], eax
lea eax, [ebp - 0x834]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xba0]
call dword [0x42b5a4]
call esi
test eax, eax
jne 0x41a6d1
mov edi, 0x80004005
mov dword [ebp - 0xb98], edi
jmp 0x41a6d3
mov edi, ebx
mov eax, dword [ebp - 0xba4]
test eax, eax
je 0x41a6f4
mov esi, dword [0x42903c]
mov ecx, esi
push eax
push dword [ebp - 0xba0]
call dword [0x42b5a4]
call esi
test edi, edi
js 0x41ad5c
push dword [ebp - 0x840]
mov esi, dword [0x42903c]
mov ecx, esi
push dword [ebp - 0xba0]
mov edi, dword [ebp - 0x84c]
mov dword [ebp - 0xb98], ebx
call dword [0x42b5a4]
call esi
mov esi, dword [0x42906c]
mov ecx, esi
push ebx
push 0xc50
mov dword [ebp - 0xba4], eax
lea eax, [ebp - 0x824]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xba0]
call dword [0x42b5a4]
call esi
test eax, eax
jne 0x41a761
mov edi, 0x80004005
mov dword [ebp - 0xb98], edi
jmp 0x41a763
mov edi, ebx
mov eax, dword [ebp - 0xba4]
test eax, eax
je 0x41a784
mov esi, dword [0x42903c]
mov ecx, esi
push eax
push dword [ebp - 0xba0]
call dword [0x42b5a4]
call esi
test edi, edi
js 0x41ad5c
mov eax, dword [ebp - 0xb74]
cmp eax, 2
je 0x41a79c
cmp eax, 3
jne 0x41a7be
mov edi, dword [ebp - 0x81c]
mov dword [ebp - 0xb7c], edi
cmp dword [ebp - 0x82c], edi
jle 0x41a7c4
mov edi, dword [ebp - 0x82c]
mov dword [ebp - 0xb7c], edi
jmp 0x41a7c4
mov edi, dword [ebp - 0xb7c]
cmp dword [ebp - 0x858], 0
mov esi, dword [0x4290a8]
mov ecx, esi
push dword [ebp - 0xba8]
je 0x41a817
mov eax, edi
sub eax, dword [ebp - 0x82c]
add eax, dword [ebp - 0xb88]
push eax
lea eax, [ebp - 0x834]
push eax
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0x828]
add eax, dword [ebp - 0xb8c]
push eax
mov eax, edi
sub eax, dword [ebp - 0x81c]
add eax, dword [ebp - 0xb88]
push eax
jmp 0x41a83f
push dword [ebp - 0xb78]
lea eax, [ebp - 0x834]
push eax
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0x828]
add eax, dword [ebp - 0xb8c]
push eax
push dword [ebp - 0xb78]
mov esi, dword [0x4290a8]
lea eax, [ebp - 0x824]
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0xb74]
cmp eax, 2
je 0x41ab57
cmp eax, 3
je 0x41ab57
xor edx, edx
inc edx
cmp eax, edx
jne 0x41ab76
push 0x5c
lea eax, [ebp - 0x710]
mov dword [ebp - 0x838], 0xffffff
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov esi, dword [0x42907c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xb98], edi
push 0x403
push ebx
push ebx
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xb78], eax
test eax, eax
jne 0x41a8f6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb98], edi
test edi, edi
jle 0x41a8e1
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb98], edi
test edi, edi
js 0x41a9a9
mov dword [ebp - 0xb98], 0x80004005
jmp 0x41ad5c
mov esi, dword [0x42905c]
mov ecx, esi
push 0x48
push dword [ebp - 0xbd0]
push 0xb
call dword [0x42b5a4]
call esi
push dword [ebp - 0xb90]
neg eax
mov dword [ebp - 0x700], 0x190
push 0x20
mov dword [ebp - 0x710], eax
lea ecx, [ebp - 0x6f4]
pop eax
mov edx, eax
mov byte [ebp - 0x6f6], 5
call fcn.0040675d
mov esi, dword [0x429010]
lea eax, [ebp - 0x710]
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
jne 0x41a98c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb98], edi
test edi, edi
jle 0x41a97d
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb98], edi
test edi, edi
js 0x41a992
mov edi, 0x80004005
mov dword [ebp - 0xb98], edi
jmp 0x41a992
mov dword [ebp - 0x83c], eax
push dword [ebp - 0xb78]
mov esi, dword [0x4290b0]
mov ecx, esi
push ebx
call dword [0x42b5a4]
call esi
test edi, edi
js 0x41ad5c
push dword [ebp - 0x83c]
mov eax, dword [ebp - 0xb7c]
mov esi, dword [0x42903c]
mov ecx, esi
push dword [ebp - 0xba0]
mov edi, dword [ebp - 0x848]
mov dword [ebp - 0x80c], eax
mov dword [ebp - 0xb98], ebx
call dword [0x42b5a4]
call esi
mov esi, dword [0x42906c]
mov ecx, esi
push ebx
push 0x460
mov dword [ebp - 0xb78], eax
lea eax, [ebp - 0x814]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xba0]
call dword [0x42b5a4]
call esi
test eax, eax
jne 0x41aa22
mov edi, 0x80004005
mov dword [ebp - 0xb98], edi
jmp 0x41aa24
mov edi, ebx
mov eax, dword [ebp - 0xb78]
test eax, eax
je 0x41aa45
mov esi, dword [0x42903c]
mov ecx, esi
push eax
push dword [ebp - 0xba0]
call dword [0x42b5a4]
call esi
test edi, edi
js 0x41ad5c
mov eax, dword [ebp - 0x80c]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x80c], eax
cmp eax, ecx
jge 0x41aa69
mov dword [ebp - 0x80c], ecx
mov edi, dword [ebp - 0xbd0]
mov esi, dword [0x42905c]
mov ecx, esi
push 0x20
pop eax
push 0x60
push edi
push dword [ebp - 0x814]
mov dword [ebp - 0x808], eax
call dword [0x42b5a4]
call esi
mov esi, dword [0x42905c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x810]
mov dword [ebp - 0x814], eax
call dword [0x42b5a4]
call esi
mov esi, dword [0x42905c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x80c]
mov dword [ebp - 0x810], eax
call dword [0x42b5a4]
call esi
mov esi, dword [0x42905c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x808]
mov dword [ebp - 0x80c], eax
call dword [0x42b5a4]
call esi
mov ecx, dword [ebp - 0x818]
mov esi, dword [0x4290a8]
add ecx, 0x24
cmp dword [ebp - 0x858], 0
mov dword [ebp - 0x808], eax
je 0x41ab35
mov eax, dword [ebp - 0x834]
cmp eax, dword [ebp - 0x824]
jl 0x41ab20
mov eax, dword [ebp - 0x824]
push ecx
push eax
lea eax, [ebp - 0x814]
mov ecx, esi
push eax
call dword [0x42b5a4]
call esi
jmp 0x41ab73
mov eax, dword [ebp - 0x82c]
cmp eax, dword [ebp - 0x81c]
jg 0x41ab49
mov eax, dword [ebp - 0x81c]
sub eax, dword [ebp - 0x80c]
add eax, dword [ebp - 0x814]
jmp 0x41ab20
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x450], edi
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x838], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0xb78], eax
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0xb88], eax
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0xb74]
sub eax, 1
je 0x41ad4a
sub eax, 1
je 0x41ac71
sub eax, 1
jne 0x41ad56
mov esi, dword [0x4290a4]
lea edi, [ebp - 0x4e8]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0x42b5a4]
call esi
mov esi, dword [0x429084]
lea ecx, [ebp - 0x4e8]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x4e8], 0x28
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41ad56
mov esi, dword [0x4290a0]
lea eax, [ebp - 0x4d4]
push eax
push ebx
mov ecx, esi
call dword [0x42b5a4]
call esi
mov esi, dword [0x4290a0]
lea eax, [ebp - 0x4cc]
push eax
push ebx
mov ecx, esi
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0x4cc]
lea esi, [ebp - 0x4d4]
sub eax, dword [ebp - 0xb8c]
lea edi, [ebp - 0x418]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x4c8]
sub eax, dword [ebp - 0xb88]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
jmp 0x41ad3f
mov esi, dword [0x4290a4]
lea edi, [ebp - 0x4c0]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0x42b5a4]
call esi
mov esi, dword [0x429084]
lea ecx, [ebp - 0x4c0]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x4c0], 0x28
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41ad56
mov esi, dword [0x4290a0]
lea eax, [ebp - 0x4ac]
push eax
push ebx
mov ecx, esi
call dword [0x42b5a4]
call esi
mov esi, dword [0x4290a0]
lea eax, [ebp - 0x4a4]
push eax
push ebx
mov ecx, esi
call dword [0x42b5a4]
call esi
cmp dword [ebp - 0xb78], 0
lea esi, [ebp - 0x4ac]
lea edi, [ebp - 0x418]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x41ad18
imul eax, dword [ebp - 0x4a4], 5
cdq
idiv ecx
add eax, dword [ebp - 0x4ac]
jmp 0x41ad2a
mov eax, dword [ebp - 0x4a4]
sub eax, dword [ebp - 0xb8c]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x4a0]
sub eax, dword [ebp - 0xb88]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x454], eax
jmp 0x41ad56
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0xb98], ebx
push dword [ebp - 0xba0]
mov esi, dword [0x4290b0]
mov ecx, esi
push ebx
call dword [0x42b5a4]
call esi
xor ebx, ebx
mov edi, 0x42add0
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x41ad7a
mov eax, dword [0x42adcc]
push 0
pop ebx
test eax, eax
jle 0x41addc
sub eax, 1
mov dword [0x42adcc], eax
jne 0x41addc
mov esi, ebx
mov eax, dword [esi + 0x42a878]
test eax, eax
je 0x41adb0
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x41ad9f
push 0x40
push ebx
push 0x42a878
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x4011f0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x42add0
xor eax, eax
xchg dword [edi], eax
lea ecx, [ebp - 0xc78]
call fcn.00424fd6
mov eax, dword [ebp - 0xb98]
test eax, eax
js 0x41c979
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0xb78], eax
mov eax, dword [ebp - 0x454]
push 0x54
mov dword [ebp - 0xb88], eax
lea eax, [ebp - 0x8b0]
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov esi, dword [0x429028]
add esp, 0xc
xor eax, eax
mov ecx, esi
push 7
push dword [ebp - 0xbac]
lea edi, [eax + 1]
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41ae91
mov esi, dword [0x429034]
lea ecx, [ebp - 0x8b0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41ae91
push 0x20
pop eax
cmp word [ebp - 0x89e], ax
jne 0x41ae89
cmp dword [ebp - 0x89c], 0
je 0x41ae89
cmp dword [ebp - 0x8ac], 0
jle 0x41ae89
cmp dword [ebp - 0x8a8], 0
jg 0x41ae8b
mov edi, ebx
test edi, edi
jne 0x41ae9e
jmp 0x41ae93
mov edi, ebx
xor esi, esi
inc esi
cmp dword [ebp - 0xb74], esi
jne 0x41af1a
push dword [ebp - 0xb88]
mov esi, dword [0x4290a8]
lea eax, [ebp - 0x834]
push dword [ebp - 0xb78]
mov ecx, esi
push eax
call dword [0x42b5a4]
call esi
push dword [ebp - 0xb88]
mov esi, dword [0x4290a8]
lea eax, [ebp - 0x824]
push dword [ebp - 0xb78]
mov ecx, esi
push eax
call dword [0x42b5a4]
call esi
xor esi, esi
inc esi
cmp dword [ebp - 0xb74], esi
jne 0x41af1a
mov eax, dword [ebp - 0x854]
mov esi, dword [0x429014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xb94], eax
mov esi, dword [0x429040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xbac]
call dword [0x42b5a4]
call esi
cmp dword [ebp - 0x858], 0
mov dword [ebp - 0xb78], eax
mov dword [ebp - 0xb88], 0x810
je 0x41af57
mov dword [ebp - 0xb88], 0x20812
test edi, edi
je 0x41ba46
mov eax, dword [ebp - 0x854]
mov esi, dword [ebp - 0x850]
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0x844]
push 0x54
mov dword [ebp - 0xb90], eax
lea eax, [ebp - 0x908]
push ebx
push eax
mov dword [ebp - 0xb7c], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0x960]
push 0x54
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0xba0], ebx
lea eax, [ebp - 0x540]
mov dword [ebp - 0xb98], ebx
mov dword [ebp - 0xba8], ebx
mov dword [ebp - 0xbd0], ebx
push 0x2c
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
lea edi, [ebp - 0x408]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x41c959
mov esi, dword [0x429028]
mov ecx, esi
mov edi, dword [ebp - 0xbac]
push 7
push edi
call dword [0x42b5a4]
call esi
test eax, eax
jne 0x41b00d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x41c959
mov esi, dword [0x429034]
lea ecx, [ebp - 0x908]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41b04f
mov eax, dword [ebp - 0x8f4]
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0xba8], eax
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0xbd0], eax
mov esi, dword [0x429008]
mov ecx, esi
push edi
call dword [0x42b5a4]
call esi
mov edi, eax
mov dword [ebp - 0xba4], edi
test edi, edi
je 0x41b002
mov eax, dword [ebp - 0x82c]
sub eax, dword [ebp - 0x834]
mov esi, dword [0x42900c]
mov ecx, esi
mov dword [ebp - 0x53c], eax
mov eax, dword [ebp - 0x830]
sub eax, dword [ebp - 0x828]
mov dword [ebp - 0x538], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc50], ebx
mov word [ebp - 0x534], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x532], ax
lea eax, [ebp - 0xc50]
push eax
push ebx
lea eax, [ebp - 0x540]
mov dword [ebp - 0x530], ebx
push eax
push edi
mov dword [ebp - 0x52c], ebx
mov dword [ebp - 0x528], ebx
mov dword [ebp - 0x524], ebx
mov dword [ebp - 0x520], ebx
mov dword [ebp - 0x51c], ebx
mov dword [ebp - 0x518], ebx
mov dword [ebp - 0x540], 0x28
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xbc4], eax
test eax, eax
jne 0x41b131
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x41b121
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x41b4b2
mov edi, 0x80004005
jmp 0x41b4b2
mov esi, dword [0x429034]
lea ecx, [ebp - 0x960]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41b15b
mov eax, dword [ebp - 0x94c]
mov dword [ebp - 0xb98], eax
mov eax, dword [ebp - 0x82c]
sub eax, dword [ebp - 0x834]
push dword [ebp - 0xbc4]
mov esi, dword [0x42903c]
mov ecx, esi
mov dword [ebp - 0x400], eax
mov eax, dword [ebp - 0x828]
sub eax, dword [ebp - 0x830]
push edi
mov dword [ebp - 0x3fc], eax
call dword [0x42b5a4]
call esi
mov esi, dword [0x429040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0x42b5a4]
call esi
push dword [ebp - 0xb90]
mov esi, dword [0x42903c]
mov ecx, esi
push edi
call dword [0x42b5a4]
call esi
mov esi, dword [0x429038]
mov ecx, esi
mov edi, dword [0x429074]
push ebx
mov dword [ebp - 0xb90], eax
call dword [0x42b5a4]
call esi
mov esi, dword [ebp - 0xba4]
mov ecx, edi
push eax
lea eax, [ebp - 0x408]
push eax
push esi
call dword [0x42b5a4]
call edi
push ebx
push dword [ebp - 0xb88]
lea eax, [ebp - 0x408]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb7c]
push esi
mov esi, dword [0x42906c]
mov ecx, esi
call dword [0x42b5a4]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xb74], eax
jne 0x41b259
cmp dword [ebp - 0xb8c], 0
je 0x41b24d
mov esi, dword [0x42908c]
mov ecx, esi
push 8
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xb8c], eax
jmp 0x41b263
mov dword [ebp - 0xb8c], 0xffffff
jmp 0x41b263
mov dword [ebp - 0xb8c], 0xffa8a8a8
mov edi, dword [ebp - 0x834]
mov edx, ebx
mov eax, dword [ebp - 0x830]
mov ecx, ebx
mov dword [ebp - 0xb7c], edi
mov dword [ebp - 0xbbc], ebx
test edi, edi
jns 0x41b295
mov edx, edi
mov dword [ebp - 0xb7c], ebx
neg edx
mov edi, ebx
mov dword [ebp - 0xbbc], edx
test eax, eax
jns 0x41b29f
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [ebp - 0x400]
mov dword [ebp - 0xbd4], esi
sub esi, edx
mov edx, dword [ebp - 0xba8]
sub edx, edi
mov dword [ebp - 0xbb0], esi
cmp esi, edx
jl 0x41b2c7
mov esi, edx
mov dword [ebp - 0xbb0], edx
mov edx, dword [ebp - 0x3fc]
mov edi, dword [ebp - 0xbd0]
sub edx, ecx
sub edi, eax
mov dword [ebp - 0xbc0], edx
cmp edx, edi
jl 0x41b2e9
mov edx, edi
mov dword [ebp - 0xbc0], edi
mov edi, ebx
test esi, esi
jle 0x41b47b
test edx, edx
jle 0x41b47b
imul ecx, dword [ebp - 0xbd4]
mov edx, dword [ebp - 0xb98]
imul eax, dword [ebp - 0xba8]
add ecx, dword [ebp - 0xbbc]
add eax, dword [ebp - 0xb7c]
lea ecx, [edx + ecx*4]
mov edx, dword [ebp - 0xba0]
mov dword [ebp - 0xb98], ecx
mov dword [ebp - 0xba0], ebx
lea eax, [edx + eax*4]
mov dword [ebp - 0xb7c], eax
mov ebx, eax
mov dword [ebp - 0xbcc], esi
lea edi, [eax + 3]
sub ebx, ecx
lea edx, [ecx + 2]
mov dword [ebp - 0xbd0], edi
mov dword [ebp - 0xbbc], edx
mov dword [ebp - 0xbb8], ebx
jmp 0x41b363
mov edi, dword [ebp - 0xbd0]
movzx eax, byte [edx - 2]
movzx ecx, byte [edx - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edx]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x41b411
mov bl, byte [ebx + edx]
mov eax, dword [ebp - 0xb8c]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbbc]
mov edx, dword [ebp - 0xbb8]
add al, bl
mov ebx, dword [ebp - 0xbb8]
mov byte [edx + ecx], al
movzx ecx, byte [edi - 2]
mov eax, dword [ebp - 0xb8c]
movzx eax, ah
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 2], al
movzx ecx, byte [edi - 3]
movzx eax, byte [ebp - 0xb8a]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 3], al
mov eax, 0xff
movzx ecx, byte [edi]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xbcc]
cdq
idiv ecx
mov edx, dword [ebp - 0xbbc]
add byte [edi], al
add dword [ebp - 0xbd0], 4
add edx, 4
mov edi, dword [ebp - 0xba0]
sub esi, 1
mov dword [ebp - 0xbbc], edx
mov dword [ebp - 0xbcc], esi
jne 0x41b35d
sub dword [ebp - 0xbc0], 1
mov ecx, dword [ebp - 0xb98]
mov eax, dword [ebp - 0xbd4]
mov edx, dword [ebp - 0xba8]
mov esi, dword [ebp - 0xbb0]
mov dword [ebp - 0xba0], edi
lea ecx, [ecx + eax*4]
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xb98], ecx
lea eax, [eax + edx*4]
mov dword [ebp - 0xb7c], eax
jne 0x41b339
xor ebx, ebx
push dword [ebp - 0xbc4]
mov esi, dword [0x42901c]
mov ecx, esi
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0xb90]
test eax, eax
je 0x41b4b2
mov esi, dword [0x42903c]
mov ecx, esi
push eax
push dword [ebp - 0xba4]
call dword [0x42b5a4]
call esi
push dword [ebp - 0xba4]
mov esi, dword [0x429018]
mov ecx, esi
call dword [0x42b5a4]
call esi
test edi, edi
js 0x41c959
mov eax, dword [ebp - 0x854]
mov esi, dword [ebp - 0x84c]
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0x840]
push 0x54
mov dword [ebp - 0xb90], eax
lea eax, [ebp - 0xb70]
push ebx
push eax
mov dword [ebp - 0xb7c], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0x9b8]
push 0x54
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0xba0], ebx
lea eax, [ebp - 0x514]
mov dword [ebp - 0xb98], ebx
mov dword [ebp - 0xba8], ebx
mov dword [ebp - 0xbd0], ebx
push 0x2c
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
lea edi, [ebp - 0x3f8]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x41c959
mov esi, dword [0x429028]
mov ecx, esi
mov edi, dword [ebp - 0xbac]
push 7
push edi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41b002
mov esi, dword [0x429034]
lea ecx, [ebp - 0xb70]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41b5b9
mov eax, dword [ebp - 0xb5c]
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0xb6c]
mov dword [ebp - 0xba8], eax
mov eax, dword [ebp - 0xb68]
mov dword [ebp - 0xbd0], eax
mov esi, dword [0x429008]
mov ecx, esi
push edi
call dword [0x42b5a4]
call esi
mov edi, eax
mov dword [ebp - 0xba4], edi
test edi, edi
je 0x41b002
mov eax, dword [ebp - 0x81c]
sub eax, dword [ebp - 0x824]
mov esi, dword [0x42900c]
mov ecx, esi
mov dword [ebp - 0x510], eax
mov eax, dword [ebp - 0x820]
sub eax, dword [ebp - 0x818]
mov dword [ebp - 0x50c], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc68], ebx
mov word [ebp - 0x508], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x506], ax
lea eax, [ebp - 0xc68]
push eax
push ebx
lea eax, [ebp - 0x514]
mov dword [ebp - 0x504], ebx
push eax
push edi
mov dword [ebp - 0x500], ebx
mov dword [ebp - 0x4fc], ebx
mov dword [ebp - 0x4f8], ebx
mov dword [ebp - 0x4f4], ebx
mov dword [ebp - 0x4f0], ebx
mov dword [ebp - 0x4ec], ebx
mov dword [ebp - 0x514], 0x28
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xbc4], eax
test eax, eax
jne 0x41b69f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x41b68f
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x41ba21
mov edi, 0x80004005
jmp 0x41ba21
mov esi, dword [0x429034]
lea ecx, [ebp - 0x9b8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41b6c9
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0xb98], eax
mov eax, dword [ebp - 0x81c]
sub eax, dword [ebp - 0x824]
push dword [ebp - 0xbc4]
mov esi, dword [0x42903c]
mov ecx, esi
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp - 0x818]
sub eax, dword [ebp - 0x820]
push edi
mov dword [ebp - 0x3ec], eax
call dword [0x42b5a4]
call esi
mov esi, dword [0x429040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0x42b5a4]
call esi
push dword [ebp - 0xb90]
mov esi, dword [0x42903c]
mov ecx, esi
push edi
call dword [0x42b5a4]
call esi
mov esi, dword [0x429038]
mov ecx, esi
mov edi, dword [0x429074]
push ebx
mov dword [ebp - 0xb90], eax
call dword [0x42b5a4]
call esi
mov esi, dword [ebp - 0xba4]
mov ecx, edi
push eax
lea eax, [ebp - 0x3f8]
push eax
push esi
call dword [0x42b5a4]
call edi
push ebx
push dword [ebp - 0xb88]
lea eax, [ebp - 0x3f8]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb7c]
push esi
mov esi, dword [0x42906c]
mov ecx, esi
call dword [0x42b5a4]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xb74], eax
jne 0x41b7c1
cmp dword [ebp - 0xb8c], 0
je 0x41b7b5
mov esi, dword [0x42908c]
mov ecx, esi
push 8
call dword [0x42b5a4]
call esi
jmp 0x41b7c6
mov dword [ebp - 0xb74], 0xffffff
jmp 0x41b7d2
mov eax, 0xffa8a8a8
mov dword [ebp - 0xb74], eax
mov dword [ebp - 0xb80], eax
mov edi, dword [ebp - 0x824]
mov edx, ebx
mov eax, dword [ebp - 0x820]
mov ecx, ebx
mov dword [ebp - 0xb88], edi
mov dword [ebp - 0xb8c], ebx
test edi, edi
jns 0x41b804
mov edx, edi
mov dword [ebp - 0xb88], ebx
neg edx
mov edi, ebx
mov dword [ebp - 0xb8c], edx
test eax, eax
jns 0x41b80e
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [ebp - 0x3f0]
mov dword [ebp - 0xb7c], esi
sub esi, edx
mov edx, dword [ebp - 0xba8]
sub edx, edi
mov dword [ebp - 0xbbc], esi
cmp esi, edx
jl 0x41b836
mov esi, edx
mov dword [ebp - 0xbbc], edx
mov edx, dword [ebp - 0x3ec]
mov edi, dword [ebp - 0xbd0]
sub edx, ecx
sub edi, eax
mov dword [ebp - 0xbd4], edx
cmp edx, edi
jl 0x41b858
mov edx, edi
mov dword [ebp - 0xbd4], edi
mov edi, ebx
test esi, esi
jle 0x41b9ea
test edx, edx
jle 0x41b9ea
imul ecx, dword [ebp - 0xb7c]
mov edx, dword [ebp - 0xb98]
imul eax, dword [ebp - 0xba8]
add ecx, dword [ebp - 0xb8c]
add eax, dword [ebp - 0xb88]
lea ecx, [edx + ecx*4]
mov edx, dword [ebp - 0xba0]
mov dword [ebp - 0xb8c], ecx
mov dword [ebp - 0xba0], ebx
lea eax, [edx + eax*4]
mov dword [ebp - 0xb88], eax
mov ebx, eax
mov dword [ebp - 0xbc0], esi
lea edi, [eax + 3]
sub ebx, ecx
lea edx, [ecx + 2]
mov dword [ebp - 0xb98], edi
mov dword [ebp - 0xbd0], edx
mov dword [ebp - 0xbb0], ebx
jmp 0x41b8d2
mov edi, dword [ebp - 0xb98]
movzx eax, byte [edx - 2]
movzx ecx, byte [edx - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edx]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x41b980
mov bl, byte [ebx + edx]
mov eax, dword [ebp - 0xb80]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbd0]
mov edx, dword [ebp - 0xbb0]
add al, bl
mov ebx, dword [ebp - 0xbb0]
mov byte [edx + ecx], al
movzx ecx, byte [edi - 2]
mov eax, dword [ebp - 0xb80]
movzx eax, ah
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 2], al
movzx ecx, byte [edi - 3]
movzx eax, byte [ebp - 0xb72]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 3], al
mov eax, 0xff
movzx ecx, byte [edi]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xbc0]
cdq
idiv ecx
mov edx, dword [ebp - 0xbd0]
add byte [edi], al
add dword [ebp - 0xb98], 4
add edx, 4
mov edi, dword [ebp - 0xba0]
sub esi, 1
mov dword [ebp - 0xbd0], edx
mov dword [ebp - 0xbc0], esi
jne 0x41b8cc
sub dword [ebp - 0xbd4], 1
mov ecx, dword [ebp - 0xb8c]
mov eax, dword [ebp - 0xb7c]
mov edx, dword [ebp - 0xba8]
mov esi, dword [ebp - 0xbbc]
mov dword [ebp - 0xba0], edi
lea ecx, [ecx + eax*4]
mov eax, dword [ebp - 0xb88]
mov dword [ebp - 0xb8c], ecx
lea eax, [eax + edx*4]
mov dword [ebp - 0xb88], eax
jne 0x41b8a8
xor ebx, ebx
push dword [ebp - 0xbc4]
mov esi, dword [0x42901c]
mov ecx, esi
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0xb90]
test eax, eax
je 0x41ba21
mov esi, dword [0x42903c]
mov ecx, esi
push eax
push dword [ebp - 0xba4]
call dword [0x42b5a4]
call esi
push dword [ebp - 0xba4]
mov esi, dword [0x429018]
mov ecx, esi
call dword [0x42b5a4]
call esi
test edi, edi
js 0x41c959
mov edi, ebx
jmp 0x41c8f3
mov edi, dword [ebp - 0xb74]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x854], 0
jne 0x41ba60
cmp edi, ecx
je 0x41ba60
mov al, 0xc0
jmp 0x41ba62
or al, 0xff
mov esi, dword [0x429008]
push dword [ebp - 0xbac]
mov byte [ebp - 0xb8a], al
mov eax, ebx
mov byte [ebp - 0xb89], cl
mov ecx, esi
mov byte [ebp - 0xb8c], bl
mov byte [ebp - 0xb8b], bl
mov dword [ebp - 0xb90], eax
mov dword [ebp - 0x3e8], eax
mov dword [ebp - 0xb7c], ebx
mov dword [ebp - 0x3e4], eax
mov dword [ebp - 0x3e0], ebx
mov dword [ebp - 0x3dc], ebx
mov dword [ebp - 0xba0], ebx
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x474], ebx
mov dword [ebp - 0x470], ebx
mov dword [ebp - 0x46c], ebx
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xb98], eax
test eax, eax
jne 0x41bae9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x41c959
xor eax, eax
inc eax
cmp edi, eax
jne 0x41bbea
mov edi, dword [ebp - 0x82c]
mov eax, edi
mov edx, dword [ebp - 0x81c]
mov ecx, edx
sub ecx, dword [ebp - 0x824]
sub eax, dword [ebp - 0x834]
mov dword [ebp - 0xba8], ecx
cmp ecx, eax
jg 0x41bb20
mov dword [ebp - 0xba8], eax
mov eax, dword [ebp - 0x818]
mov ecx, ebx
sub eax, dword [ebp - 0x830]
mov esi, ebx
cmp dword [ebp - 0x858], 0
mov dword [ebp - 0xbd0], eax
je 0x41bb75
mov ecx, dword [ebp - 0x834]
mov eax, dword [ebp - 0x824]
sub ecx, edi
add ecx, dword [ebp - 0xba8]
sub eax, edx
add eax, dword [ebp - 0xba8]
mov dword [ebp - 0xb90], ecx
mov esi, eax
mov dword [ebp - 0x3e8], ecx
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0x478], eax
sub edi, dword [ebp - 0x834]
sub edx, dword [ebp - 0x824]
add edi, ecx
mov eax, dword [ebp - 0x828]
add edx, esi
sub eax, dword [ebp - 0x830]
mov dword [ebp - 0xba4], edi
mov dword [ebp - 0x3e0], edi
mov edi, dword [ebp - 0x820]
sub edi, dword [ebp - 0x830]
mov dword [ebp - 0xbd4], edi
mov dword [ebp - 0x474], edi
sub edi, dword [ebp - 0x820]
add edi, dword [ebp - 0x818]
mov dword [ebp - 0xbc4], eax
mov dword [ebp - 0x3dc], eax
mov dword [ebp - 0xbbc], edx
mov dword [ebp - 0x470], edx
mov dword [ebp - 0xbb0], edi
mov dword [ebp - 0x46c], edi
jmp 0x41bc82
mov eax, dword [ebp - 0x450]
lea esi, [ebp - 0x834]
lea edi, [ebp - 0x3e8]
mov dword [ebp - 0xba8], eax
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0xbd0], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x3dc]
lea esi, [ebp - 0x824]
lea edi, [ebp - 0x478]
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 0x3e0]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0x3e4]
mov dword [ebp - 0xb7c], eax
mov eax, dword [ebp - 0x3e8]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xb90], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0xbbc], eax
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0xbd4], eax
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0xbd0]
mov esi, dword [0x42900c]
neg eax
mov edi, dword [ebp - 0xba8]
mov ecx, esi
mov dword [ebp - 0x5e8], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc48], ebx
mov word [ebp - 0x5e4], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x5e2], ax
lea eax, [ebp - 0xc48]
push eax
push ebx
lea eax, [ebp - 0x5f0]
mov dword [ebp - 0x5e0], ebx
push eax
push dword [ebp - 0xb98]
mov dword [ebp - 0x5dc], ebx
mov dword [ebp - 0x5d8], ebx
mov dword [ebp - 0x5d4], ebx
mov dword [ebp - 0x5d0], ebx
mov dword [ebp - 0x5cc], ebx
mov dword [ebp - 0x5c8], ebx
mov dword [ebp - 0x5f0], 0x28
mov dword [ebp - 0x5ec], edi
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xb84], eax
test eax, eax
jne 0x41bd2c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, dword [ebp - 0xb98]
jmp 0x41c948
mov esi, dword [0x42903c]
mov ecx, esi
push eax
push dword [ebp - 0xb98]
call dword [0x42b5a4]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xb74], eax
jne 0x41bd94
mov ecx, dword [ebp - 0xb94]
test ecx, ecx
je 0x41bd94
mov eax, dword [ebp - 0xbd0]
mov esi, dword [0x429074]
push ecx
mov dword [ebp - 0x42c], eax
mov ecx, esi
lea eax, [ebp - 0x438]
mov dword [ebp - 0x438], ebx
push eax
push dword [ebp - 0xb98]
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x430], edi
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0x854]
mov esi, dword [ebp - 0x850]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0x844]
push 0x54
mov dword [ebp - 0xbb8], eax
lea eax, [ebp - 0xa10]
push ebx
push eax
mov dword [ebp - 0xbcc], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa68]
push 0x54
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0xbe4], ebx
lea eax, [ebp - 0x598]
mov dword [ebp - 0xbec], ebx
mov dword [ebp - 0xbdc], ebx
mov dword [ebp - 0xbd8], ebx
push 0x2c
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
lea edi, [ebp - 0x428]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xb98]
test esi, esi
je 0x41c92d
mov esi, dword [0x429028]
mov ecx, esi
push 7
push edi
call dword [0x42b5a4]
call esi
test eax, eax
jne 0x41be42
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x41c92d
mov esi, dword [0x429034]
lea ecx, [ebp - 0xa10]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41be84
mov eax, dword [ebp - 0x9fc]
mov dword [ebp - 0xbe4], eax
mov eax, dword [ebp - 0xa0c]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xa08]
mov dword [ebp - 0xbd8], eax
mov esi, dword [0x429008]
mov ecx, esi
push edi
call dword [0x42b5a4]
call esi
mov ecx, eax
mov dword [ebp - 0xbe0], ecx
test ecx, ecx
je 0x41be37
mov eax, dword [ebp - 0xb7c]
sub eax, dword [ebp - 0xbc4]
mov edi, dword [ebp - 0xba4]
sub edi, dword [ebp - 0xb90]
mov esi, dword [0x42900c]
mov dword [ebp - 0x590], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc4c], ebx
mov word [ebp - 0x58c], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x58a], ax
lea eax, [ebp - 0xc4c]
push eax
push ebx
lea eax, [ebp - 0x598]
mov dword [ebp - 0x588], ebx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x584], ebx
mov dword [ebp - 0x580], ebx
mov dword [ebp - 0x57c], ebx
mov dword [ebp - 0x578], ebx
mov dword [ebp - 0x574], ebx
mov dword [ebp - 0x570], ebx
mov dword [ebp - 0x598], 0x28
mov dword [ebp - 0x594], edi
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xba4], eax
test eax, eax
jne 0x41bf66
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x41bf56
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x41c2d6
mov edi, 0x80004005
jmp 0x41c2d6
mov esi, dword [0x429034]
lea ecx, [ebp - 0xa68]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41bf90
mov eax, dword [ebp - 0xa54]
mov dword [ebp - 0xbec], eax
push dword [ebp - 0xba4]
mov eax, dword [ebp - 0xbc4]
sub eax, dword [ebp - 0xb7c]
mov esi, dword [0x42903c]
mov ecx, esi
mov dword [ebp - 0x420], edi
mov edi, dword [ebp - 0xbe0]
push edi
mov dword [ebp - 0x41c], eax
call dword [0x42b5a4]
call esi
mov esi, dword [0x429040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0x42b5a4]
call esi
push dword [ebp - 0xbb8]
mov esi, dword [0x42903c]
mov ecx, esi
push edi
call dword [0x42b5a4]
call esi
mov esi, dword [0x429038]
mov ecx, esi
mov edi, dword [0x429074]
push ebx
mov dword [ebp - 0xbc4], eax
call dword [0x42b5a4]
call esi
mov esi, dword [ebp - 0xbe0]
mov ecx, edi
push eax
lea eax, [ebp - 0x428]
push eax
push esi
call dword [0x42b5a4]
call edi
push ebx
push dword [ebp - 0xb88]
lea eax, [ebp - 0x428]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xbcc]
push esi
mov esi, dword [0x42906c]
mov ecx, esi
call dword [0x42b5a4]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xb74], eax
jne 0x41c088
cmp dword [ebp - 0xbc0], 0
je 0x41c07c
mov esi, dword [0x42908c]
mov ecx, esi
push 8
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xbc0], eax
jmp 0x41c092
mov dword [ebp - 0xbc0], 0xffffff
jmp 0x41c092
mov dword [ebp - 0xbc0], 0xffa8a8a8
mov edx, dword [ebp - 0xb90]
mov ecx, ebx
mov dword [ebp - 0xbb8], ebx
test edx, edx
jns 0x41c0b0
mov esi, edx
mov edx, ebx
neg esi
mov dword [ebp - 0xbb8], esi
mov eax, dword [ebp - 0xb7c]
test eax, eax
jns 0x41c0c0
mov ecx, eax
mov eax, ebx
neg ecx
mov edi, dword [ebp - 0x420]
mov esi, dword [ebp - 0xbdc]
mov dword [ebp - 0xb90], edi
sub esi, edx
sub edi, dword [ebp - 0xbb8]
mov dword [ebp - 0xb7c], edi
cmp edi, esi
jl 0x41c0ea
mov dword [ebp - 0xb7c], esi
mov edi, dword [ebp - 0xbd8]
mov esi, dword [ebp - 0x41c]
sub edi, eax
sub esi, ecx
mov dword [ebp - 0xbcc], esi
cmp esi, edi
jl 0x41c10c
mov esi, edi
mov dword [ebp - 0xbcc], edi
cmp dword [ebp - 0xb7c], 0
mov edi, ebx
jle 0x41c29f
test esi, esi
jle 0x41c29f
imul ecx, dword [ebp - 0xb90]
imul eax, dword [ebp - 0xbdc]
mov esi, dword [ebp - 0xbec]
mov dword [ebp - 0xbec], ebx
add ecx, dword [ebp - 0xbb8]
add eax, edx
mov edx, dword [ebp - 0xbe4]
lea ecx, [esi + ecx*4]
lea esi, [edx + eax*4]
mov dword [ebp - 0xbb8], ecx
mov dword [ebp - 0xbe4], esi
mov ebx, esi
lea edi, [esi + 3]
mov esi, dword [ebp - 0xb7c]
lea edx, [ecx + 2]
sub ebx, ecx
mov dword [ebp - 0xbd8], edi
mov dword [ebp - 0xbf0], edx
mov dword [ebp - 0xbb4], ebx
mov dword [ebp - 0xb9c], esi
jmp 0x41c18d
mov edi, dword [ebp - 0xbd8]
movzx eax, byte [edx - 2]
movzx ecx, byte [edx - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edx]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x41c23b
mov bl, byte [ebx + edx]
mov eax, dword [ebp - 0xbc0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbf0]
mov edx, dword [ebp - 0xbb4]
add al, bl
mov ebx, dword [ebp - 0xbb4]
mov byte [edx + ecx], al
movzx ecx, byte [edi - 2]
mov eax, dword [ebp - 0xbc0]
movzx eax, ah
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 2], al
movzx ecx, byte [edi - 3]
movzx eax, byte [ebp - 0xbbe]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 3], al
mov eax, 0xff
movzx ecx, byte [edi]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xb9c]
cdq
idiv ecx
mov edx, dword [ebp - 0xbf0]
add byte [edi], al
add dword [ebp - 0xbd8], 4
add edx, 4
mov edi, dword [ebp - 0xbec]
sub esi, 1
mov dword [ebp - 0xbf0], edx
mov dword [ebp - 0xb9c], esi
jne 0x41c187
sub dword [ebp - 0xbcc], 1
mov ecx, dword [ebp - 0xbb8]
mov eax, dword [ebp - 0xb90]
mov esi, dword [ebp - 0xbe4]
mov dword [ebp - 0xbec], edi
lea ecx, [ecx + eax*4]
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0xbb8], ecx
lea esi, [esi + eax*4]
mov dword [ebp - 0xbe4], esi
jne 0x41c15d
xor ebx, ebx
push dword [ebp - 0xba4]
mov esi, dword [0x42901c]
mov ecx, esi
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0xbc4]
test eax, eax
je 0x41c2d6
mov esi, dword [0x42903c]
mov ecx, esi
push eax
push dword [ebp - 0xbe0]
call dword [0x42b5a4]
call esi
push dword [ebp - 0xbe0]
mov esi, dword [0x429018]
mov ecx, esi
call dword [0x42b5a4]
call esi
test edi, edi
js 0x41c927
mov eax, dword [ebp - 0x854]
mov esi, dword [ebp - 0x84c]
mov dword [ebp - 0xb9c], eax
mov eax, dword [ebp - 0x840]
push 0x54
mov dword [ebp - 0xbb4], eax
lea eax, [ebp - 0xac0]
push ebx
push eax
mov dword [ebp - 0xb90], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0xb18]
push 0x54
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 0xb7c], ebx
lea eax, [ebp - 0x5c4]
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xbc4], ebx
mov dword [ebp - 0xbc0], ebx
push 0x2c
push ebx
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
xor eax, eax
lea edi, [ebp - 0x3d8]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xb98]
test esi, esi
je 0x41c92d
mov esi, dword [0x429028]
mov ecx, esi
push 7
push edi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41be37
mov esi, dword [0x429034]
lea ecx, [ebp - 0xac0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41c3dd
mov eax, dword [ebp - 0xaac]
mov dword [ebp - 0xb7c], eax
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 0xab8]
mov dword [ebp - 0xbc0], eax
mov esi, dword [0x429008]
mov ecx, esi
push edi
call dword [0x42b5a4]
call esi
mov ecx, eax
mov dword [ebp - 0xbb8], ecx
test ecx, ecx
je 0x41be37
mov eax, dword [ebp - 0xbbc]
sub eax, dword [ebp - 0xba0]
mov edi, dword [ebp - 0xbd4]
mov esi, dword [0x42900c]
mov dword [ebp - 0xbbc], eax
mov dword [ebp - 0x5c0], eax
mov eax, edi
sub eax, dword [ebp - 0xbb0]
mov dword [ebp - 0x5bc], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc58], ebx
mov word [ebp - 0x5b8], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x5b6], ax
lea eax, [ebp - 0xc58]
push eax
push ebx
lea eax, [ebp - 0x5c4]
mov dword [ebp - 0x5b4], ebx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x5b0], ebx
mov dword [ebp - 0x5ac], ebx
mov dword [ebp - 0x5a8], ebx
mov dword [ebp - 0x5a4], ebx
mov dword [ebp - 0x5a0], ebx
mov dword [ebp - 0x59c], ebx
mov dword [ebp - 0x5c4], 0x28
call dword [0x42b5a4]
call esi
mov dword [ebp - 0xbcc], eax
test eax, eax
jne 0x41c4cb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x41c4bb
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x41c851
mov edi, 0x80004005
jmp 0x41c851
mov esi, dword [0x429034]
lea ecx, [ebp - 0xb18]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x42b5a4]
call esi
test eax, eax
je 0x41c4f5
mov eax, dword [ebp - 0xb04]
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0xbbc]
push dword [ebp - 0xbcc]
mov esi, dword [0x42903c]
mov ecx, esi
mov dword [ebp - 0x3d0], eax
mov eax, dword [ebp - 0xbb0]
sub eax, edi
mov edi, dword [ebp - 0xbb8]
push edi
mov dword [ebp - 0x3cc], eax
call dword [0x42b5a4]
call esi
mov esi, dword [0x429040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0x42b5a4]
call esi
push dword [ebp - 0xbb4]
mov esi, dword [0x42903c]
mov ecx, esi
push edi
call dword [0x42b5a4]
call esi
mov esi, dword [0x429038]
mov ecx, esi
mov edi, dword [0x429074]
push ebx
mov dword [ebp - 0xbb4], eax
call dword [0x42b5a4]
call esi
mov esi, dword [ebp - 0xbb8]
mov ecx, edi
push eax
lea eax, [ebp - 0x3d8]
push eax
push esi
call dword [0x42b5a4]
call edi
push ebx
push dword [ebp - 0xb88]
lea eax, [ebp - 0x3d8]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb90]
push esi
mov esi, dword [0x42906c]
mov ecx, esi
call dword [0x42b5a4]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xb74], eax
jne 0x41c5f7
cmp dword [ebp - 0xb9c], 0
je 0x41c5eb
mov esi, dword [0x42908c]
mov ecx, esi
push 8
call dword [0x42b5a4]
call esi
mov edx, eax
mov dword [ebp - 0xb80], edx
mov dword [ebp - 0xb9c], edx
jmp 0x41c608
mov dword [ebp - 0xb9c], 0xffffff
jmp 0x41c608
mov eax, 0xffa8a8a8
mov dword [ebp - 0xb80], eax
mov dword [ebp - 0xb9c], eax
mov edi, dword [ebp - 0xba0]
mov ecx, ebx
mov dword [ebp - 0xb88], ebx
mov eax, ebx
test edi, edi
jns 0x41c62e
mov ecx, edi
mov edi, ebx
neg ecx
mov dword [ebp - 0xba0], edi
mov dword [ebp - 0xb88], ecx
mov edx, dword [ebp - 0xbd4]
test edx, edx
jns 0x41c63e
mov eax, edx
mov edx, ebx
neg eax
mov esi, dword [ebp - 0x3d0]
mov dword [ebp - 0xb90], esi
sub esi, ecx
mov ecx, dword [ebp - 0xbc4]
sub ecx, edi
mov dword [ebp - 0xbbc], esi
cmp esi, ecx
jl 0x41c666
mov esi, ecx
mov dword [ebp - 0xbbc], ecx
mov ecx, dword [ebp - 0x3cc]
mov edi, dword [ebp - 0xbc0]
sub ecx, eax
sub edi, edx
mov dword [ebp - 0xbd4], ecx
cmp ecx, edi
jl 0x41c688
mov ecx, edi
mov dword [ebp - 0xbd4], edi
mov edi, ebx
test esi, esi
jle 0x41c81a
test ecx, ecx
jle 0x41c81a
imul eax, dword [ebp - 0xb90]
mov ecx, dword [ebp - 0xba4]
imul edx, dword [ebp - 0xbc4]
add eax, dword [ebp - 0xb88]
add edx, dword [ebp - 0xba0]
mov dword [ebp - 0xba0], ebx
lea ecx, [ecx + eax*4]
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xb88], ecx
lea eax, [eax + edx*4]
mov dword [ebp - 0xb7c], eax
mov ebx, eax
mov dword [ebp - 0xbe4], esi
lea edi, [eax + 3]
sub ebx, ecx
lea edx, [ecx + 2]
mov dword [ebp - 0xba4], edi
mov dword [ebp - 0xbb0], edx
mov dword [ebp - 0xbc0], ebx
jmp 0x41c702
mov edi, dword [ebp - 0xba4]
movzx eax, byte [edx - 2]
movzx ecx, byte [edx - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edx]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x41c7b0
mov bl, byte [ebx + edx]
mov eax, dword [ebp - 0xb80]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbb0]
mov edx, dword [ebp - 0xbc0]
add al, bl
mov ebx, dword [ebp - 0xbc0]
mov byte [edx + ecx], al
movzx ecx, byte [edi - 2]
mov eax, dword [ebp - 0xb80]
movzx eax, ah
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 2], al
movzx ecx, byte [edi - 3]
movzx eax, byte [ebp - 0xb9a]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
add byte [edi - 3], al
mov eax, 0xff
movzx ecx, byte [edi]
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xbe4]
cdq
idiv ecx
mov edx, dword [ebp - 0xbb0]
add byte [edi], al
add dword [ebp - 0xba4], 4
add edx, 4
mov edi, dword [ebp - 0xba0]
sub esi, 1
mov dword [ebp - 0xbb0], edx
mov dword [ebp - 0xbe4], esi
jne 0x41c6fc
sub dword [ebp - 0xbd4], 1
mov ecx, dword [ebp - 0xb88]
mov eax, dword [ebp - 0xb90]
mov edx, dword [ebp - 0xbc4]
mov esi, dword [ebp - 0xbbc]
mov dword [ebp - 0xba0], edi
lea ecx, [ecx + eax*4]
mov eax, dword [ebp - 0xb7c]
mov dword [ebp - 0xb88], ecx
lea eax, [eax + edx*4]
mov dword [ebp - 0xb7c], eax
jne 0x41c6d8
xor ebx, ebx
push dword [ebp - 0xbcc]
mov esi, dword [0x42901c]
mov ecx, esi
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0xbb4]
test eax, eax
je 0x41c851
mov esi, dword [0x42903c]
mov ecx, esi
push eax
push dword [ebp - 0xbb8]
call dword [0x42b5a4]
call esi
push dword [ebp - 0xbb8]
mov esi, dword [0x429018]
mov ecx, esi
call dword [0x42b5a4]
call esi
test edi, edi
js 0x41c927
mov edi, dword [ebp - 0xb98]
xor eax, eax
inc eax
cmp dword [ebp - 0xb74], eax
jne 0x41c8b8
mov esi, dword [section..data]
mov ecx, esi
push 0xcc0020
push ebx
push ebx
push edi
push dword [ebp - 0xbd0]
push dword [ebp - 0xba8]
push dword [ebp - 0x830]
push dword [ebp - 0x834]
push dword [ebp - 0xbac]
call dword [0x42b5a4]
call esi
jmp 0x41c8f3
push dword [ebp - 0xb8c]
mov ecx, dword [ebp - 0xbd0]
mov eax, dword [ebp - 0xba8]
mov esi, dword [0x429020]
push ecx
push eax
push ebx
push ebx
push edi
push ecx
push eax
push dword [ebp - 0x454]
mov ecx, esi
push dword [ebp - 0x458]
push dword [ebp - 0xbac]
call dword [0x42b5a4]
call esi
push dword [ebp - 0xb78]
mov eax, dword [ebp - 0xb84]
push dword [ebp - 0xbac]
mov esi, dword [0x429040]
mov ecx, esi
mov dword [ebp - 0xb84], eax
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0xb84]
test eax, eax
je 0x41c944
jmp 0x41c933
mov edi, dword [ebp - 0xb98]
mov eax, dword [ebp - 0xb84]
mov esi, dword [0x42901c]
mov ecx, esi
push eax
call dword [0x42b5a4]
call esi
test edi, edi
je 0x41c959
mov esi, dword [0x429018]
mov ecx, esi
push edi
call dword [0x42b5a4]
call esi
mov eax, dword [ebp - 0xb94]
test eax, eax
je 0x41c974
mov esi, dword [0x42901c]
mov ecx, esi
push eax
call dword [0x42b5a4]
call esi
mov edi, 0x42add0
mov ecx, dword [ebp - 0x850]
test ecx, ecx
je 0x41c9c8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41c986
mov eax, dword [ebp - 0x850]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x41c9ae
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x41c9a6
push dword [ebp - 0x850]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x850], ebx
mov ecx, dword [ebp - 0x84c]
test ecx, ecx
je 0x41ca17
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41c9d5
mov eax, dword [ebp - 0x84c]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x41c9fd
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x41c9f5
push dword [ebp - 0x84c]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x84c], ebx
mov edx, dword [ebp - 0x848]
test edx, edx
je 0x41ca63
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41ca26
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x41ca4e
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0x41ca40
mov edx, dword [ebp - 0x848]
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x848], ebx
cmp dword [ebp - 0x844], 0
je 0x41ca88
push dword [ebp - 0x844]
mov esi, dword [0x42901c]
mov ecx, esi
call dword [0x42b5a4]
call esi
mov dword [ebp - 0x844], ebx
cmp dword [ebp - 0x840], 0
je 0x41caad
push dword [ebp - 0x840]
mov esi, dword [0x42901c]
mov ecx, esi
call dword [0x42b5a4]
call esi
mov dword [ebp - 0x840], ebx
cmp dword [ebp - 0x83c], 0
je 0x41cad2
push dword [ebp - 0x83c]
mov esi, dword [0x42901c]
mov ecx, esi
call dword [0x42b5a4]
call esi
mov dword [ebp - 0x83c], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x41cad4
mov eax, dword [0x42adcc]
push 0
pop ebx
test eax, eax
jle 0x41cb36
sub eax, 1
mov dword [0x42adcc], eax
jne 0x41cb36
mov esi, ebx
mov eax, dword [esi + 0x42a878]
test eax, eax
je 0x41cb0a
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x41caf9
push 0x40
push ebx
push 0x42a878
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x4011f0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x42add0
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0x42a874]
mov esi, dword [0x42904c]
mov ecx, esi
mov dword [ebp - 0xb9c], eax
call dword [0x42b5a4]
call esi
sub eax, dword [0x42adc0]
lea edi, [ebp - 0x33c]
push 7
mov dword [ebp - 0xbb4], eax
mov edx, 0x42add0
xor eax, eax
xor ebx, ebx
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x41cb75
mov eax, dword [0x42adcc]
push 0
pop ebx
test eax, eax
jne 0x41d117
push 0x338
push ebx
mov dword [ebp - 0xb74], ebx
mov dword [ebp - 0xb84], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb94], eax
test eax, eax
je 0x41d3cd
or dword [ebp - 0xb88], 0xffffffff
mov cl, bl
add eax, 7
mov dword [ebp - 0xb78], ebx
mov esi, ebx
mov dword [ebp - 0xb8c], eax
mov edx, ebx
mov edi, dword [ebp - 0xbfc]
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xbfc]
xor edx, ebx
mov dword [ebp - 0xb90], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xbfc]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xbfc]
shl edi, 8
add dword [ebp - 0xbfc], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
mov dword [ebp - 0xb7c], esi
mov esi, edx
xor esi, dword [ebp - 0xb7c]
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0xb90]
xor eax, edx
mov dword [ebp - 0xb90], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xb90]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xb90]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xb90], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xb90]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xb90]
xor edx, eax
mov dword [ebp - 0xb90], edx
mov eax, dword [ebp - 0xb90]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xb90]
xor eax, edx
mov dword [ebp - 0xb90], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xb90]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xb90]
xor eax, edx
mov dword [ebp - 0xb90], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xb90]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [ebp - 0xb90]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
lea eax, [esi - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0xb7c], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb7c]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xb7c]
xor eax, edx
mov dword [ebp - 0xb7c], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0xb7c], edx
mov edx, dword [ebp - 0xb7c]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xb7c], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb7c]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xb7c]
xor eax, edx
mov dword [ebp - 0xb7c], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb7c]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xb7c]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xb7c], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb7c]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xb7c]
xor edx, dword [ebp - 0xb78]
xor eax, dword [ebp - 0xb88]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xb90], esi
mov esi, dword [ebp - 0xb8c]
mov dword [ebp - 0xb78], ebx
mov dword [ebp - 0xb88], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xc24], 1
mov dword [ebp - 0xb8c], esi
mov esi, eax
mov dword [ebp - 0xb7c], eax
jne 0x41cbdb
mov esi, dword [ebp - 0xb94]
xor ebx, ebx
mov eax, ebx
mov edi, 0x338
xor cl, byte [eax + esi]
inc eax
cmp eax, edi
jb 0x41cf65
movzx eax, cl
cdq
cmp eax, dword [0x403348]
jne 0x41d3be
cmp edx, dword [0x40334c]
jne 0x41d3be
push 0x40
push ebx
push 0x42a878
mov byte [esi + edi - 1], bl
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov edi, esi
cmp byte [esi], bl
je 0x41d0f7
mov edi, 0x42a878
mov dword [ebp - 0xb94], esi
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xb84], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41cfbf
sub ecx, dword [ebp - 0xb84]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0x41d0e3
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xb84], edx
cmp word [eax], cx
je 0x41d007
mov edx, 0xc000007b
mov dword [ebp - 0xb84], edx
jmp 0x41d05b
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0x41cffa
add ecx, dword [edi]
mov dword [ebp - 0xb78], ecx
cmp ecx, dword [edi]
jb 0x41cffa
cmp dword [ecx], 0x4550
jne 0x41cffa
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xc20]
je 0x41d043
cmp ax, word [ebp - 0x394]
je 0x41d043
mov edx, 0xc000000d
jmp 0x41cfff
mov eax, dword [ecx + 0x78]
mov ecx, dword [ecx + 0x7c]
mov dword [edi + 8], eax
mov eax, dword [ebp - 0xb78]
mov dword [edi + 0xc], ecx
mov eax, dword [eax + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xb78], eax
mov dword [ebp - 0xb88], ebx
test eax, eax
je 0x41d0d6
mov ecx, esi
mov dword [ebp - 0xb8c], esi
lea eax, [ecx + 1]
mov dword [ebp - 0xb90], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41d082
sub ecx, dword [ebp - 0xb90]
inc esi
add esi, ecx
test edx, edx
js 0x41d0bb
push dword [ebp - 0xb8c]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0x41d0ed
mov ecx, dword [ebp - 0xb74]
mov edx, dword [ebp - 0xb84]
mov dword [ecx*4 + section..data], eax
mov eax, dword [ebp - 0xb88]
inc dword [ebp - 0xb74]
inc eax
mov dword [ebp - 0xb88], eax
cmp eax, dword [ebp - 0xb78]
jb 0x41d071
add edi, 0x10
cmp byte [esi], bl
jne 0x41cfb2
jmp 0x41d0ed
mov dword [ebp - 0xb84], 0xc000007a
mov edi, dword [ebp - 0xb94]
test edi, edi
je 0x41d106
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push edi
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb84], ebx
jl 0x41d3cd
mov eax, dword [0x42adcc]
inc eax
mov dword [0x42adcc], eax
xor eax, eax
mov edi, 0x42add0
xchg dword [edi], eax
mov eax, dword [ebp - 0xbb4]
xor ecx, ecx
mov esi, dword [0x429068]
inc ecx
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0xb9c]
mov dword [ebp - 0x324], eax
lea eax, [ebp - 0x340]
push eax
push 4
push 0x2021
mov dword [ebp - 0x340], ecx
mov dword [ebp - 0x338], ecx
mov dword [ebp - 0x32c], ecx
mov dword [ebp - 0x330], ecx
mov dword [ebp - 0x328], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x334], 0x9966f291
call dword [0x42b5a4]
call esi
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x41d18a
mov eax, dword [0x42adcc]
push 0
pop ebx
test eax, eax
jle 0x41d1ec
sub eax, 1
mov dword [0x42adcc], eax
jne 0x41d1ec
mov esi, ebx
mov eax, dword [esi + 0x42a878]
test eax, eax
je 0x41d1c0
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x41d1af
push 0x40
push ebx
push 0x42a878
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x4011f0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x42add0
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xbac]
mov esi, dword [0x4290b0]
mov ecx, esi
push ebx
call dword [0x42b5a4]
call esi
lea ecx, [ebp - 0xc7c]
call fcn.00424ffc
xor eax, eax
mov dword [ebp - 0xc9c], ebx
lea edi, [ebp - 0xcb0]
mov esi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0x4207e6
mov edi, eax
mov dword [ebp - 0xb9c], edi
push 0x28
pop ecx
mov esi, 0x429788
rep movsd dword es:[edi], dword [esi]
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, dword [ebp - 0xb9c]
test eax, eax
je 0x4207e6
mov edi, eax
mov eax, dword [0x429780]
mov ecx, dword [0x429784]
mov dword [edi], eax
mov dword [edi + 4], ecx
rdtsc
mov dword [ebp - 0xbb4], eax
mov dword [ebp - 0xbac], edx
mov eax, 0xc4
push eax
push 8
mov dword [ebp - 0xca0], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0x4207e8
mov dword [ebp - 0xc9c], eax
mov edx, esi
mov dword [ebp - 0xb74], edi
mov ecx, ebx
mov dword [ebp - 0xb9c], edx
mov dword [ebp - 0xca4], ecx
mov dword [ebp - 0xb84], eax
mov edx, 0xa0
mov dword [ebp - 0xb94], ebx
mov dword [ebp - 0xb78], 8
test ecx, ecx
je 0x41d356
push 8
pop eax
mov dword [ebp - 0xb78], eax
mov eax, dword [ebp - 0xb84]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0xb9c], eax
cmp eax, 4
jb 0x4207e8
mov ebx, eax
add ebx, dword [ebp - 0xb84]
cmp ebx, dword [ebp - 0xb84]
push 0
mov dword [ebp - 0xb9c], ebx
pop ebx
jb 0x4207e8
mov eax, dword [ebp - 0xb9c]
inc dword [ebp - 0xb94]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb78]
cmp dword [ebp - 0xb94], ecx
jb 0x41d2f3
mov eax, dword [ebp - 0xb84]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x4207e8
mov ecx, dword [ebp - 0xca0]
mov eax, dword [ebp - 0xb84]
add ecx, dword [ebp - 0xc9c]
add eax, 8
cmp eax, ecx
ja 0x4207e8
mov eax, dword [ebp - 0xb84]
push 4
pop ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0xca4]
inc ecx
mov dword [ebp - 0xca4], ecx
mov eax, dword [ebp - 0xb78]
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xb74], eax
mov dword [ebp - 0xb94], edi
test esi, esi
jne 0x41d40c
test edx, edx
je 0x41d414
jmp 0x4207e8
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, ebx
mov eax, dword [esi + 0x42a878]
test eax, eax
je 0x41d3e0
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x41d3cf
push 0x40
push ebx
push 0x42a878
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov esi, 0x4011f0
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x41d11d
test edx, edx
je 0x4207e8
cmp dword [ebp - 0xc9c], 0
mov eax, dword [ebp - 0xca0]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb78]
jne 0x41d463
mov eax, dword [ebp - 0xb84]
mov edx, 0xa4
add edx, eax
mov dword [ebp - 0xb84], edx
cmp edx, eax
jb 0x4207e8
mov edi, dword [ebp - 0xb94]
mov eax, edx
mov esi, dword [ebp - 0xb9c]
mov dword [ebp - 0xca0], edx
jmp 0x41d53f
mov ebx, dword [ebp - 0xc9c]
mov dword [ebp - 0xb94], ebx
xor ebx, ebx
mov dword [ebp - 0xb74], ebx
test ecx, ecx
je 0x41d4d8
mov dword [ebp - 0xb78], eax
mov eax, dword [ebp - 0xb94]
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0xb9c], eax
cmp eax, 4
jb 0x4207e8
mov ebx, eax
add ebx, dword [ebp - 0xb94]
cmp ebx, dword [ebp - 0xb94]
push 0
mov dword [ebp - 0xb9c], ebx
pop ebx
jb 0x4207e8
mov eax, dword [ebp - 0xb9c]
inc dword [ebp - 0xb74]
mov dword [ebp - 0xb94], eax
mov eax, dword [ebp - 0xb78]
cmp dword [ebp - 0xb74], ecx
jb 0x41d47b
mov dword [ebp - 0xb74], eax
mov eax, dword [ebp - 0xb94]
lea ecx, [eax + 4]
mov dword [ebp - 0xb9c], ecx
cmp ecx, eax
jb 0x4207e8
lea ecx, [eax + 4]
mov eax, dword [ebp - 0xc9c]
add eax, dword [ebp - 0xb84]
add ecx, edx
push 0
pop ebx
cmp ecx, eax
ja 0x4207e8
mov eax, dword [ebp - 0xb94]
mov dword [eax], edx
test esi, esi
je 0x41d52d
push edx
push esi
push dword [ebp - 0xb9c]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0xca0]
mov ecx, dword [ebp - 0xca4]
mov dword [ebp - 0xb84], eax
inc ecx
mov dword [ebp - 0xca4], ecx
mov edx, dword [ebp - 0xb74]
test edi, edi
jne 0x41d559
test edx, edx
je 0x41d561
jmp 0x4207e8
test edx, edx
je 0x4207e8
cmp dword [ebp - 0xc9c], 0
jne 0x41d58c
push 0xc
pop edx
add eax, edx
mov dword [ebp - 0xb74], eax
cmp eax, dword [ebp - 0xb84]
jb 0x4207e8
mov dword [ebp - 0xca0], eax
jmp 0x41d648
mov eax, dword [ebp - 0xc9c]
mov dword [ebp - 0xb74], eax
mov dword [ebp - 0xb94], ebx
test ecx, ecx
je 0x41d5ed
mov eax, dword [eax]
add eax, 4
mov dword [ebp - 0xb9c], eax
cmp eax, 4
jb 0x4207e8
mov ebx, eax
add ebx, dword [ebp - 0xb74]
cmp ebx, dword [ebp - 0xb74]
push 0
mov dword [ebp - 0xb9c], ebx
pop ebx
jb 0x4207e8
inc dword [ebp - 0xb94]
mov eax, dword [ebp - 0xb9c]
mov dword [ebp - 0xb74], eax
cmp dword [ebp - 0xb94], ecx
jb 0x41d5a2
lea ecx, [eax + 4]
mov dword [ebp - 0xb9c], ecx
cmp ecx, eax
jb 0x4207e8
lea ecx, [eax + 4]
mov eax, dword [ebp - 0xc9c]
add eax, dword [ebp - 0xb84]
add ecx, edx
push 0
pop ebx
cmp ecx, eax
ja 0x4207e8
mov eax, dword [ebp - 0xb74]
mov dword [eax], edx
test edi, edi
je 0x41d636
push edx
push edi
push dword [ebp - 0xb9c]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0xca0]
mov ecx, dword [ebp - 0xca4]
mov dword [ebp - 0xb74], eax
inc ecx
mov dword [ebp - 0xca4], ecx
cmp dword [ebp - 0xc9c], 0
jne 0x41d67d
lea edx, [eax + 0xc]
mov dword [ebp - 0xb9c], edx
cmp edx, eax
jb 0x4207e8
inc ecx
mov dword [ebp - 0xca0], edx
mov dword [ebp - 0xca4], ecx
mov ecx, edx
jmp 0x41d6fe
mov edx, dword [ebp - 0xc9c]
mov dword [ebp - 0xb84], ebx
test ecx, ecx
je 0x41d6b8
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x4207e8
add eax, edx
cmp eax, edx
jb 0x4207e8
mov edx, eax
mov eax, dword [ebp - 0xb84]
inc eax
mov dword [ebp - 0xb84], eax
cmp eax, ecx
jb 0x41d68d
lea eax, [edx + 4]
cmp eax, edx
jb 0x4207e8
mov ecx, dword [ebp - 0xb74]
lea eax, [edx + 0xc]
add ecx, dword [ebp - 0xc9c]
cmp eax, ecx
ja 0x4207e8
mov eax, dword [ebp - 0xbb4]
mov dword [edx], 8
mov dword [edx + 4], eax
mov eax, dword [ebp - 0xbac]
mov dword [edx + 8], eax
inc dword [ebp - 0xca4]
mov ecx, dword [ebp - 0xca0]
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbb4], edi
rdtsc
mov dword [ebp - 0xbac], ebx
mov dword [ebp - 0xb74], ebx
mov dword [ebp - 0xb84], ebx
mov dword [ebp - 0xb94], ebx
mov dword [ebp - 0xb78], ebx
mov dword [ebp - 0xb88], ebx
mov dword [ebp - 0xb8c], ebx
mov dword [ebp - 0xb90], ebx
mov dword [ebp - 0xb7c], eax
mov dword [ebp - 0xba0], edx
add ecx, 8
cmp ecx, 8
jb 0x4207e8
lea eax, [ecx + 7]
mov edx, esi
and eax, 0xfffffff8
mov dword [ebp - 0xb80], eax
cmp eax, ecx
jae 0x41d76b
jmp 0x4207e8
push eax
push 8
mov dword [ebp - 0xbb4], esi
mov dword [ebp - 0xb98], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xba8], ecx
test ecx, ecx
je 0x4207e8
mov eax, dword [ebp - 0xca4]
lea edx, [ecx + 4]
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbd0], edi
mov dword [ecx], eax
cmp edx, ecx
jb 0x41d813
mov eax, dword [ebp - 0xca0]
mov dword [edx], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x41d81f
mov eax, dword [ebp - 0xb80]
mov edx, dword [ebp - 0xb7c]
mov dword [ecx + eax - 8], edx
mov edx, dword [ebp - 0xba0]
mov dword [ecx + eax - 4], edx
lea eax, [ecx + 8]
push dword [ebp - 0xca0]
push dword [ebp - 0xc9c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xba8]
add esp, 0xc
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xb74], eax
mov dword [ebp - 0xbb4], ebx
jmp 0x41d864
mov edi, dword [ebp - 0xb98]
mov esi, dword [ebp - 0xbb4]
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbd0], edi
mov dword [ebp - 0xb7c], 0xc0000095
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or dword [ebp - 0xb7c], 0x10000000
mov eax, ebx
jl 0x41e2d5
mov dword [ebp - 0xbb4], ebx
test eax, eax
je 0x4207e8
test eax, eax
je 0x4207bd
add eax, 8
push eax
push ebx
mov dword [ebp - 0xb7c], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xba0], eax
test eax, eax
je 0x4207bd
mov ecx, dword [ebp - 0xb74]
mov dl, bl
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xb84], ebx
test ecx, ecx
je 0x41d8b4
xor dl, byte [eax + ebx]
inc ebx
cmp ebx, ecx
jb 0x41d8aa
xor ebx, ebx
or dword [ebp - 0xba8], 0xffffffff
mov ecx, 0xb1b54a58
mov dword [ebp - 0x3a0], ecx
mov ecx, 0xc81ecb17
mov dword [ebp - 0x39c], ecx
mov ecx, dword [ebp - 0xba0]
mov dword [ebp - 0xb80], ecx
mov ecx, ebx
mov dword [ebp - 0xb98], ecx
mov ecx, dword [ebp - 0xb74]
and ecx, 7
mov dword [ebp - 0xb84], eax
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xbc4], ebx
mov dword [ebp - 0xbbc], ecx
je 0x41dab5
cmp dword [ebp - 0xbbc], 0
mov ecx, ebx
mov dword [ebp - 0xba8], ebx
mov dword [ebp - 0xb98], ecx
mov dword [ebp - 0xba4], ebx
jbe 0x41da7c
mov eax, ebx
mov dword [ebp - 0xbc4], 0x38
mov ebx, dword [ebp - 0xb84]
mov edi, eax
mov esi, dword [ebp - 0xbc4]
movzx ecx, byte [ebx]
inc ebx
mov dword [ebp - 0xb84], ecx
cmp edi, 4
jae 0x41d973
lea ecx, [esi - 0x20]
shl dword [ebp - 0xb84], cl
mov ecx, dword [ebp - 0xb98]
or ecx, dword [ebp - 0xb84]
mov dword [ebp - 0xb98], ecx
jmp 0x41d987
mov ecx, esi
shl dword [ebp - 0xb84], cl
or eax, dword [ebp - 0xb84]
mov ecx, dword [ebp - 0xb98]
inc edi
mov dword [ebp - 0xba4], eax
sub esi, 8
mov dword [ebp - 0xbc4], ecx
cmp edi, dword [ebp - 0xbbc]
jl 0x41d947
mov edi, dword [ebp - 0xbd0]
xor eax, 0x42f6b18d
mov esi, dword [ebp - 0xb9c]
xor ecx, 0xb17a307a
mov dword [ebp - 0xbd0], edi
mov edi, dword [ebp - 0xb74]
mov dword [ebp - 0xb84], ebx
xor ebx, ebx
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xb98], ecx
mov dword [ebp - 0xbd4], ecx
mov ecx, ebx
mov dword [ebp - 0xb9c], esi
mov esi, dword [ebp - 0xbbc]
mov dword [ebp - 0xb74], edi
mov edi, dword [ebp - 0xb80]
mov dword [ebp - 0xbac], eax
lea eax, [edi + 1]
mov dword [ebp - 0xb80], eax
cmp ecx, 4
jge 0x41da25
rol dword [ebp - 0xbd4], 8
mov eax, dword [ebp - 0xbd4]
jmp 0x41da32
rol dword [ebp - 0xbb0], 8
mov eax, dword [ebp - 0xbb0]
mov byte [edi], al
inc ecx
mov eax, dword [ebp - 0xb80]
mov edi, eax
cmp ecx, esi
jl 0x41da08
mov dword [ebp - 0xb80], eax
mov eax, dword [ebp - 0xbac]
cmp esi, 4
jbe 0x41da6c
push 8
pop ecx
sub ecx, esi
mov esi, dword [ebp - 0xba8]
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0xba8], esi
jmp 0x41dab5
mov dword [ebp - 0xba8], ebx
jae 0x41dab5
mov esi, dword [ebp - 0xb98]
jmp 0x41da9f
mov ecx, dword [ebp - 0xb84]
mov esi, 0xb17a307a
mov dword [ebp - 0xb84], ecx
mov dword [ebp - 0xbc4], ebx
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xba8], ebx
push 4
pop ecx
sub ecx, dword [ebp - 0xbbc]
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0xb98], esi
mov ecx, dword [ebp - 0xb74]
shr ecx, 3
mov dword [ebp - 0xbbc], ecx
test ecx, ecx
je 0x41dead
movzx eax, word [ebp - 0x39e]
mov ecx, 0xc81ecb17
movzx esi, word [ebp - 0x39a]
mov edi, 0xb1b54a58
movzx ecx, cx
mov dword [ebp - 0xbc0], ecx
mov ecx, 0xc81ecb17
mov dword [ebp - 0xbb0], eax
xor ecx, edi
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xbb8], esi
add eax, 7
mov esi, dword [ebp - 0xb84]
movzx ebx, di
add esi, 2
mov dword [ebp - 0xbd4], ebx
mov ebx, dword [ebp - 0xb98]
mov dword [ebp - 0xbcc], ecx
mov ecx, dword [ebp - 0xba8]
mov dword [ebp - 0xb80], eax
mov dword [ebp - 0xb84], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xb84]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xb84]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xb84]
shl esi, 8
add dword [ebp - 0xb84], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ecx, esi
mov dword [ebp - 0xba8], ecx
sub ecx, dword [ebp - 0xbd4]
xor ecx, edi
xor ecx, ebx
mov ebx, ecx
ror ecx, 0xf
imul ecx, dword [ebp - 0xbb0]
xor ebx, 0xc81ecb17
mov eax, ebx
ror eax, 7
add ecx, eax
mov eax, dword [ebp - 0xba8]
xor eax, ecx
mov ecx, 0xb1b54a58
add ecx, eax
mov dword [ebp - 0xba8], eax
ror ecx, 9
imul ecx, dword [ebp - 0xbc0]
ror eax, 0xa
sub ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xbc0]
xor ecx, ebx
mov eax, ebx
rol eax, 5
rol ecx, 4
imul ecx, dword [ebp - 0xbb8]
add ecx, eax
mov eax, dword [ebp - 0xba8]
xor eax, ecx
mov ecx, 0xb1b54a58
xor ecx, eax
mov dword [ebp - 0xba8], eax
mov eax, 0xc81ecb17
sub eax, ecx
xor ebx, eax
mov ecx, ebx
mov eax, ebx
sub ecx, dword [ebp - 0xbd4]
imul ecx, dword [ebp - 0xbb0]
shr eax, 6
sub ecx, eax
xor dword [ebp - 0xba8], ecx
mov ecx, dword [ebp - 0xba8]
mov eax, ecx
ror eax, 0xf
xor eax, dword [ebp - 0xbc0]
imul eax, dword [ebp - 0xbd4]
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, dword [ebp - 0xbb8]
imul eax, dword [ebp - 0xbc0]
xor ecx, eax
mov dword [ebp - 0xba8], ecx
sub ecx, dword [ebp - 0xbd4]
sub ecx, 0xc81ecb17
mov eax, dword [ebp - 0xbb8]
xor ebx, ecx
xor eax, ebx
mov ecx, ebx
imul eax, dword [ebp - 0xbb0]
ror ecx, 0xa
xor ecx, eax
mov eax, dword [ebp - 0xba8]
xor eax, ecx
mov ecx, dword [ebp - 0xbd4]
xor ecx, eax
mov dword [ebp - 0xba8], eax
rol ecx, 6
imul ecx, dword [ebp - 0xbc0]
ror eax, 3
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xbb8]
mov eax, ebx
ror eax, 0xf
sub eax, ecx
imul eax, dword [ebp - 0xbd4]
xor dword [ebp - 0xba8], eax
mov eax, dword [ebp - 0xba8]
xor ecx, eax
imul ecx, dword [ebp - 0xbd4]
shr eax, 1
xor ecx, eax
mov eax, dword [ebp - 0xba8]
xor ebx, ecx
mov ecx, eax
sub ecx, dword [ebp - 0xbc0]
rol ecx, 3
imul ecx, dword [ebp - 0xbd4]
shr eax, 0xf
xor ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
sub ecx, dword [ebp - 0xbc0]
imul ecx, dword [ebp - 0xbb0]
shr eax, 0xd
sub ecx, eax
mov eax, dword [ebp - 0xba8]
xor eax, ecx
mov ecx, 0xb1b54a58
sub ecx, eax
mov dword [ebp - 0xba8], eax
ror ecx, 9
imul ecx, dword [ebp - 0xbc0]
ror eax, 0xb
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xba8]
mov eax, ebx
sub eax, dword [ebp - 0xbb8]
sub eax, 0xb1b54a58
xor ecx, eax
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xba8], ecx
xor eax, dword [ebp - 0xba8]
imul eax, dword [ebp - 0xbd4]
ror ecx, 7
sub eax, ecx
mov ecx, dword [ebp - 0xbb8]
xor ebx, eax
xor ecx, ebx
mov eax, ebx
rol ecx, 4
imul ecx, dword [ebp - 0xbb0]
ror eax, 0x10
sub ecx, eax
mov eax, dword [ebp - 0xba8]
xor eax, ecx
mov ecx, 0xb1b54a58
sub ecx, eax
mov dword [ebp - 0xba8], eax
ror ecx, 0xa
imul ecx, dword [ebp - 0xbc0]
ror eax, 4
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
sub ecx, 0xb1b54a58
ror eax, 9
ror ecx, 4
imul ecx, dword [ebp - 0xbb8]
xor ecx, eax
mov eax, dword [ebp - 0xba8]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xba8], eax
xor ecx, 0xc81ecb17
rol eax, 2
rol ecx, 8
imul ecx, dword [ebp - 0xbd4]
sub ecx, eax
xor ebx, ecx
mov ecx, 0xc81ecb17
sub ecx, ebx
mov eax, ebx
ror ecx, 0xb
imul ecx, dword [ebp - 0xbb0]
ror eax, 0xc
sub ecx, eax
mov eax, dword [ebp - 0xba8]
xor eax, ecx
mov ecx, dword [ebp - 0xbb0]
xor ecx, eax
mov dword [ebp - 0xba8], eax
imul ecx, dword [ebp - 0xbc0]
shr eax, 8
xor ecx, eax
mov eax, dword [ebp - 0xbcc]
xor ebx, ecx
mov ecx, dword [ebp - 0xba8]
xor eax, ebx
xor ebx, dword [ebp - 0xbc4]
xor ecx, eax
mov dword [ebp - 0xbc4], edi
mov eax, dword [ebp - 0xb80]
xor ecx, dword [ebp - 0xba4]
mov dword [ebp - 0xba4], esi
mov esi, dword [ebp - 0xb84]
mov byte [eax - 4], bl
mov byte [eax], cl
ror ebx, 8
mov byte [eax - 5], bl
ror ecx, 8
mov byte [eax - 1], cl
ror ebx, 8
mov byte [eax - 6], bl
ror ecx, 8
mov byte [eax - 2], cl
ror ebx, 8
ror ecx, 8
mov byte [eax - 7], bl
mov byte [eax - 3], cl
add eax, 8
ror ebx, 8
ror ecx, 8
sub dword [ebp - 0xbbc], 1
mov dword [ebp - 0xb80], eax
jne 0x41db39
mov eax, dword [ebp - 0xbac]
mov ecx, dword [ebp - 0xb74]
mov ebx, dword [ebp - 0xba0]
mov esi, dword [ebp - 0xb9c]
mov edi, dword [ebp - 0xbd0]
mov dword [ebp - 0xb84], eax
movzx eax, dl
cdq
mov dword [ecx + ebx], eax
mov eax, ecx
mov ecx, ebx
mov dword [ebp - 0xb9c], esi
mov dword [eax + ecx + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb74], eax
push 0
pop ebx
test eax, eax
jne 0x41dfd4
mov dword [ebp - 0xb7c], 0xc0000017
mov eax, ebx
push dword [ebp - 0xba0]
mov ecx, dword [ebp - 0xbac]
push ebx
mov dword [ebp - 0xbac], ecx
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbd0], edi
mov dword [ebp - 0xb84], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xb80], edi
mov edi, dword [ebp - 0xbb4]
mov dword [ebp - 0xb74], eax
mov dword [ebp - 0xba0], esi
test edi, edi
je 0x41e1b0
cmp dword [edi + 4], 0
je 0x41df80
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x41df9a
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x41dfb4
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edx, dword [ebp - 0xb84]
mov dword [ebp - 0xb84], edx
jmp 0x41e1b6
mov ecx, dword [ebp - 0xb84]
mov esi, dword [ebp - 0xb9c]
mov edi, dword [ebp - 0xbd0]
mov dword [ebp - 0xbac], ecx
mov ecx, dword [ebp - 0xb7c]
push ecx
push 8
mov dword [eax], ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x41e015
mov eax, dword [ebp - 0xb84]
jmp 0x41e0e0
mov ecx, dword [ebp - 0xb74]
mov dword [ecx + 4], edx
push dword [ebp - 0xb7c]
mov dword [ebp - 0xb74], ecx
push dword [ebp - 0xba0]
push edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xbac]
add esp, 0xc
mov dword [ebp - 0xbb4], eax
mov ecx, 0xa0
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xb84], esi
push ecx
push 8
mov dword [ebp - 0xb80], edi
mov dword [eax + 8], ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0x41e0e6
mov edx, dword [ebp - 0xb74]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xbb4]
mov edi, esi
push 0x28
pop ecx
mov dword [ebp - 0xb9c], edi
mov esi, 0x4296d8
mov edi, dword [edx + 0xc]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xb80]
push 8
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xbd0], eax
mov esi, edx
pop eax
push eax
push eax
mov dword [esi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0x41e17d
mov edi, dword [ebp - 0xb80]
mov eax, dword [ebp - 0xbb4]
mov dword [ebp - 0xb74], esi
mov esi, dword [ebp - 0xb84]
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0xb7c], 0xc0000017
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xbb4], ebx
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x41e11b
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb74]
mov dword [eax + 4], ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x41e13a
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb74]
mov dword [eax + 0xc], ebx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x41e159
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb74]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb7c], 0
jl 0x41df0c
mov eax, dword [ebp - 0xbb4]
jmp 0x41e1a5
mov dword [esi + 0x14], eax
mov ecx, dword [0x429778]
mov edx, dword [0x42977c]
mov edi, dword [ebp - 0xbd0]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, esi
mov esi, dword [ebp - 0xb9c]
mov dword [ebp - 0xb7c], ebx
mov dword [ebp - 0xbb4], ebx
jmp 0x41df0e
mov edx, dword [ebp - 0xb84]
mov ecx, dword [ebp - 0xb7c]
or ecx, 0x10000000
mov dword [ebp - 0xbb4], edx
mov dword [ebp - 0xb7c], ecx
jl 0x41e2cf
mov edi, dword [edx]
lea eax, [edx + 0x10]
mov dword [ebp - 0xb7c], eax
add edi, 4
mov eax, dword [eax]
mov dword [ebp - 0xb98], eax
lea eax, [edx + 8]
mov dword [ebp - 0xba8], eax
mov eax, dword [eax]
mov dword [ebp - 0xba4], eax
cmp edi, 4
jb 0x42079c
mov eax, dword [ebp - 0xb74]
mov esi, dword [ebp - 0xba0]
mov ecx, dword [ebp - 0xb80]
mov dword [ebp - 0xbac], eax
lea eax, [edi + 4]
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xb84], edx
mov dword [ebp - 0xbc4], eax
cmp eax, edi
jb 0x420763
mov edi, eax
add edi, dword [ebp - 0xba4]
cmp edi, eax
mov dword [ebp - 0xbb4], edi
mov eax, dword [ebp - 0xbac]
jb 0x420742
add edi, 4
cmp edi, dword [ebp - 0xbb4]
jb 0x420742
mov edx, dword [ebp - 0xb98]
add edx, edi
mov dword [ebp - 0xbb4], edx
cmp edx, edi
mov edx, dword [ebp - 0xb84]
jb 0x420742
push dword [ebp - 0xbb4]
mov edi, eax
mov dword [ebp - 0xba0], esi
push 8
mov dword [ebp - 0xb74], edi
mov dword [ebp - 0xb80], ecx
mov dword [ebp - 0xb98], edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edx, eax
mov dword [ebp - 0xba4], edx
test edx, edx
jne 0x41e4c2
mov dword [ebp - 0xb7c], 0xd0000017
mov eax, dword [ebp - 0xbac]
mov edi, dword [ebp - 0xb9c]
test eax, eax
je 0x41e2ee
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xb84]
test esi, esi
je 0x41e355
cmp dword [esi + 4], 0
je 0x41e312
push dword [esi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 4], ebx
cmp dword [esi + 0xc], 0
je 0x41e32c
push dword [esi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 0xc], ebx
cmp dword [esi + 0x14], 0
je 0x41e346
push dword [esi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 0x14], ebx
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb94]
test eax, eax
je 0x41e36e
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb88]
test eax, eax
je 0x41e387
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xb8c]
test esi, esi
je 0x41e3ee
cmp dword [esi + 4], 0
je 0x41e3ab
push dword [esi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 4], ebx
cmp dword [esi + 0xc], 0
je 0x41e3c5
push dword [esi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 0xc], ebx
cmp dword [esi + 0x14], 0
je 0x41e3df
push dword [esi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [esi + 0x14], ebx
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb90]
test eax, eax
je 0x41e407
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb7c], 0
jl 0x4207d8
mov ecx, dword [ebp - 0xcb0]
xor eax, eax
inc eax
cmp ecx, eax
jb 0x4207d8
mov eax, dword [ebp - 0xca8]
test eax, eax
je 0x4207d8
test ecx, ecx
je 0x4207d8
mov ecx, dword [eax]
lea esi, [eax + 4]
mov dword [ebp - 0xbb4], ecx
cmp esi, eax
jb 0x4207d8
mov eax, dword [ebp - 0xbb4]
mov ecx, edi
mov edx, dword [ebp - 0xbd0]
neg eax
sbb eax, eax
and eax, esi
cmp dword [ebp - 0xbb4], 4
mov edi, edx
mov esi, ecx
jne 0x4207e8
cmp dword [eax], 0
jl 0x4207e8
mov eax, dword [ebp - 0xca8]
test eax, eax
je 0x4207e8
cmp dword [ebp - 0xcb0], 1
jbe 0x4207e8
xor edi, edi
mov dword [ebp - 0xb9c], ebx
mov dword [ebp - 0xbd0], edx
inc edi
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x41e4bb
lea eax, [edx + ecx]
cmp eax, ecx
jb 0x41e4bb
inc ebx
cmp ebx, edi
jb 0x41e4a6
xor ebx, ebx
jmp 0x4207de
mov eax, dword [ebp - 0xb98]
mov ecx, eax
mov dword [ebp - 0xbac], edi
mov edi, dword [ebp - 0xb80]
mov dword [ebp - 0xb9c], esi
mov eax, dword [eax]
mov dword [edx], eax
lea eax, [edx + 4]
mov dword [ebp - 0xbd0], edi
mov dword [ebp - 0xb84], ecx
mov dword [ebp - 0xbc4], eax
cmp eax, edx
jb 0x41e621
push dword [ecx]
push dword [ecx + 4]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [ebp - 0xb84]
add esp, 0xc
mov eax, dword [ecx]
add eax, dword [ebp - 0xbc4]
mov dword [ebp - 0xb74], eax
cmp eax, dword [ebp - 0xbc4]
jb 0x41e619
mov edx, dword [ebp - 0xb74]
mov eax, dword [ebp - 0xba8]
mov eax, dword [eax]
mov dword [edx], eax
lea eax, [edx + 4]
mov dword [ebp - 0xb74], eax
cmp eax, edx
jb 0x41e619
mov edx, dword [ebp - 0xba8]
push dword [edx]
push dword [ecx + 0xc]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xba8]
add esp, 0xc
mov ecx, dword [ebp - 0xb74]
mov edx, dword [eax]
add edx, ecx
mov dword [ebp - 0xb74], edx
cmp edx, ecx
jb 0x41e5f9
mov eax, dword [ebp - 0xb7c]
lea ecx, [edx + 4]
mov eax, dword [eax]
mov dword [edx], eax
cmp ecx, edx
jb 0x41e5f9
mov eax, dword [ebp - 0xb7c]
push dword [eax]
mov eax, dword [ebp - 0xb84]
push dword [eax + 0x14]
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xb7c]
add esp, 0xc
mov ecx, dword [ebp - 0xb74]
add ecx, 4
mov eax, dword [eax]
add eax, ecx
cmp eax, ecx
jb 0x41e5d9
mov edi, dword [ebp - 0xba4]
mov eax, dword [ebp - 0xbb4]
mov dword [ebp - 0xb94], edi
mov dword [ebp - 0xb78], eax
jmp 0x41e67a
mov eax, dword [ebp - 0xb84]
mov edx, dword [ebp - 0xba4]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xbd0], edi
jmp 0x41e645
mov eax, dword [ebp - 0xb84]
mov dword [ebp - 0xb84], eax
mov edx, dword [ebp - 0xba4]
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xbd0], edi
jmp 0x41e645
mov dword [ebp - 0xb84], ecx
jmp 0x41e605
mov eax, dword [ebp - 0xb98]
mov esi, dword [ebp - 0xba0]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xb7c], 0xc0000095
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or dword [ebp - 0xb7c], 0x10000000
jl 0x41e2cf
cmp dword [ebp - 0xc9c], 0
jne 0x41e692
mov dword [ebp - 0xb7c], 0xc000000d
jmp 0x41e2cf
xor eax, eax
inc eax
cmp dword [ebp - 0xca4], eax
jbe 0x41e683
mov eax, dword [ebp - 0xc9c]
mov ecx, dword [ebp - 0xbd0]
mov edx, dword [ebp - 0xb84]
mov dword [ebp - 0xbb4], eax
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xb74], ebx
mov edi, dword [ebp - 0xb78]
mov dword [ebp - 0xba8], ecx
mov dword [ebp - 0xbd0], ecx
mov ecx, dword [ebp - 0xbb4]
mov dword [ebp - 0xba4], edx
mov dword [ebp - 0xb84], edx
mov dword [ebp - 0xb78], edi
mov edx, dword [ecx]
mov edi, dword [ebp - 0xb94]
mov dword [ebp - 0xbb4], edx
lea edx, [ecx + 4]
mov dword [ebp - 0xba0], edi
mov dword [ebp - 0xb80], eax
mov dword [ebp - 0xb98], esi
mov dword [ebp - 0xb94], edi
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xb7c], edx
cmp edx, ecx
jb 0x420733
mov ecx, dword [ebp - 0xba8]
mov edx, dword [ebp - 0xba4]
mov dword [ebp - 0xb94], edi
mov edi, dword [ebp - 0xb7c]
add edi, dword [ebp - 0xbb4]
push 0
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0xbb4], edi
pop ebx
cmp edi, dword [ebp - 0xb7c]
jb 0x4206fa
inc dword [ebp - 0xb74]
cmp dword [ebp - 0xb74], 1
jb 0x41e6c1
mov eax, edi
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xb84], edx
mov edi, dword [eax]
add eax, 4
cmp eax, dword [ebp - 0xbb4]
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xb74], edi
mov edi, dword [ebp - 0xb94]
jb 0x4206eb
mov dword [ebp - 0xb94], edi
cmp dword [ebp - 0xc9c], ebx
jne 0x41e7c8
mov dword [ebp - 0xb7c], 0xc000000d
jmp 0x41e2d5
cmp dword [ebp - 0xca4], 2
ja 0x41e7fe
mov dword [ebp - 0xb7c], 0xc000000d
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xb84], edx
mov edx, dword [ebp - 0xb94]
mov dword [ebp - 0xb94], edx
jmp 0x41e2d5
mov edi, dword [ebp - 0xc9c]
mov dword [ebp - 0xbb4], edi
mov edi, dword [ebp - 0xb94]
mov dword [ebp - 0xb7c], ebx
mov dword [ebp - 0xba0], edx
mov dword [ebp - 0xb80], ecx
mov dword [ebp - 0xb98], esi
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0xba4], edi
jmp 0x41e84e
mov edx, dword [ebp - 0xba0]
mov ecx, dword [ebp - 0xb80]
mov esi, dword [ebp - 0xb98]
mov edi, dword [ebp - 0xba4]
mov ebx, dword [ebp - 0xb78]
mov dword [ebp - 0xb78], ebx
mov ebx, dword [ebp - 0xb74]
mov dword [ebp - 0xb94], edi
mov edi, dword [ebp - 0xbb4]
mov dword [ebp - 0xb74], ebx
push 0
mov dword [ebp - 0xbac], eax
mov ebx, dword [edi]
mov dword [ebp - 0xbb4], ebx
lea ebx, [edi + 4]
mov dword [ebp - 0xbc4], ebx
cmp ebx, edi
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xb84], edx
pop ebx
jb 0x4206b2
mov edi, dword [ebp - 0xbc4]
add edi, dword [ebp - 0xbb4]
cmp edi, dword [ebp - 0xbc4]
mov dword [ebp - 0xbb4], edi
mov edi, dword [ebp - 0xb94]
jb 0x4206a3
inc dword [ebp - 0xb7c]
cmp dword [ebp - 0xb7c], 2
mov dword [ebp - 0xba0], edx
mov dword [ebp - 0xb80], ecx
mov dword [ebp - 0xb98], esi
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0xba4], edi
jb 0x41e836
mov eax, dword [ebp - 0xbb4]
mov edi, dword [eax]
add eax, 4
mov dword [ebp - 0xb7c], edi
cmp eax, dword [ebp - 0xbb4]
jb 0x420694
mov eax, dword [ebp - 0xb74]
add eax, 0x30
mov dword [ebp - 0xbb4], eax
cmp eax, 0x30
jb 0x420694
add eax, 4
mov dword [ebp - 0xb74], eax
cmp eax, dword [ebp - 0xbb4]
jb 0x420694
add eax, edi
mov edi, dword [ebp - 0xb94]
mov dword [ebp - 0xbb4], eax
cmp eax, dword [ebp - 0xb74]
jb 0x420694
cmp eax, 0x400000
mov eax, dword [ebp - 0xbac]
jbe 0x41e97b
mov dword [ebp - 0xb7c], 0x8000ffff
jmp 0x41e2d5
mov dword [ebp - 0xb84], edx
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0xb94], edi
mov dword [ebp - 0xb80], esi
mov esi, dword [ebp - 0xbb4]
push esi
push 8
mov dword [ebp - 0xb74], edi
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0xb98], ecx
mov dword [ebp - 0xba8], edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0x41e2c5
mov edx, eax
mov dword [ebp - 0xb88], edx
mov dword [ebp - 0xba4], edx
test edi, edi
jne 0x41ea20
mov eax, dword [ebp - 0xba8]
mov edi, dword [ebp - 0xb80]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb98]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xba0]
mov dword [ebp - 0xb7c], 0x80070057
mov dword [ebp - 0xb9c], edi
jmp 0x41ead8
mov eax, dword [ebp - 0xb78]
mov dword [ebp - 0xcd4], eax
lea eax, [ebp - 0xc5c]
push eax
xor eax, eax
mov dword [ebp - 0xcdc], edi
push 0x401b24
inc eax
mov dword [ebp - 0xcd8], edx
push eax
mov dword [ebp - 0xcd0], esi
mov dword [ebp - 0xccc], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0x41eaef
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
mov dword [ebp - 0xb7c], ecx
test ecx, ecx
jle 0x41ea85
movzx ecx, cx
or ecx, 0x80070000
mov dword [ebp - 0xb7c], ecx
test ecx, ecx
js 0x41ea92
mov ecx, 0x80004005
mov dword [ebp - 0xb7c], ecx
mov eax, dword [ebp - 0xba8]
mov edi, dword [ebp - 0xb80]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb98]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xba0]
mov dword [ebp - 0xb9c], edi
cmp ecx, 0xd0000023
jne 0x41eb8a
mov edx, dword [ebp - 0xb88]
mov dword [ebp - 0xb7c], 0x8007007a
mov dword [ebp - 0xb88], edx
mov edx, dword [ebp - 0xb74]
mov dword [ebp - 0xb94], edx
jmp 0x41e2db
push 0x404fe8
push dword [ebp - 0xc5c]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov dword [ebp - 0xb9c], eax
test eax, eax
jne 0x41eb45
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
mov dword [ebp - 0xb7c], ecx
test ecx, ecx
jle 0x41eb2d
movzx ecx, cx
or ecx, 0x80070000
mov dword [ebp - 0xb7c], ecx
test ecx, ecx
js 0x41eb3a
mov ecx, 0x80004005
mov dword [ebp - 0xb7c], ecx
mov dword [ebp - 0xbb4], esi
jmp 0x41ea92
push ebx
push 0x14
lea ecx, [ebp - 0xcdc]
push ecx
push 0x86
mov ecx, eax
call dword [0x42b5a4]
call dword [ebp - 0xb9c]
mov ecx, eax
mov dword [ebp - 0xbb4], esi
or ecx, 0x10000000
mov dword [ebp - 0xb7c], ecx
jl 0x41ea92
mov esi, dword [ebp - 0xcd0]
mov dword [ebp - 0xbb4], esi
jmp 0x41eba0
mov edx, dword [ebp - 0xb74]
mov dword [ebp - 0xb94], edx
test ecx, ecx
js 0x41e2db
mov edi, edx
mov edx, dword [ebp - 0xb88]
mov dword [ebp - 0xb78], ebx
cmp esi, 4
jae 0x41ebf0
mov dword [ebp - 0xb7c], 0xd000003e
mov dword [ebp - 0xb88], edx
mov eax, dword [ebp - 0xba8]
mov edi, dword [ebp - 0xb80]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb98]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xba0]
mov dword [ebp - 0xb9c], edi
jmp 0x41eade
mov eax, dword [edx]
mov dword [ebp - 0xbc4], eax
lea eax, [edx + 4]
mov dword [ebp - 0xbbc], eax
cmp eax, edx
jb 0x420685
mov eax, dword [ebp - 0xba4]
mov esi, dword [ebp - 0xb80]
mov ecx, dword [ebp - 0xb98]
mov edx, dword [ebp - 0xba8]
mov dword [ebp - 0xb88], eax
mov eax, dword [ebp - 0xbb4]
add eax, 0xfffffffc
mov dword [ebp - 0xb94], edi
mov edi, dword [ebp - 0xba0]
mov dword [ebp - 0xbac], edi
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xb84], edx
cmp eax, dword [ebp - 0xbc4]
jae 0x41ec77
mov dword [ebp - 0xb7c], 0xd000003e
mov eax, dword [ebp - 0xba4]
mov dword [ebp - 0xb88], eax
jmp 0x41ebc1
mov ebx, dword [ebp - 0xbbc]
mov eax, dword [ebp - 0xbc4]
push 0
lea edx, [eax + ebx]
cmp edx, ebx
mov dword [ebp - 0xbd4], edx
mov edx, dword [ebp - 0xb84]
pop ebx
jb 0x420676
add eax, 4
mov dword [ebp - 0xb74], eax
cmp eax, 4
jb 0x420665
mov eax, dword [ebp - 0xb94]
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0xbb4]
sub eax, dword [ebp - 0xb74]
mov dword [ebp - 0xb80], edi
mov edi, dword [ebp - 0xb88]
mov dword [ebp - 0xb98], esi
mov dword [ebp - 0xba8], ecx
mov dword [ebp - 0xba4], edx
mov dword [ebp - 0xbb0], edi
cmp eax, 4
jae 0x41ecff
mov dword [ebp - 0xb7c], 0xd000003e
jmp 0x41e2cf
mov eax, dword [ebp - 0xbd4]
mov edi, dword [ebp - 0xb88]
mov eax, dword [eax]
mov dword [ebp - 0xbc0], eax
mov eax, dword [ebp - 0xbd4]
add eax, 4
cmp eax, dword [ebp - 0xbd4]
jb 0x42057b
mov edi, dword [ebp - 0xba0]
mov eax, dword [ebp - 0xb80]
mov esi, dword [ebp - 0xb98]
mov ecx, dword [ebp - 0xba8]
mov edx, dword [ebp - 0xba4]
mov dword [ebp - 0xb94], edi
mov edi, dword [ebp - 0xbb0]
mov dword [ebp - 0xb88], edi
mov edi, dword [ebp - 0xb74]
push 0
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0xb9c], esi
lea ebx, [edi + 4]
mov dword [ebp - 0xbd0], ecx
cmp ebx, edi
mov dword [ebp - 0xb74], ebx
mov edi, dword [ebp - 0xb94]
mov dword [ebp - 0xb84], edx
pop ebx
jb 0x420620
mov dword [ebp - 0xb80], eax
mov eax, dword [ebp - 0xbb4]
sub eax, dword [ebp - 0xb74]
mov dword [ebp - 0xba0], edi
mov edi, dword [ebp - 0xb88]
mov dword [ebp - 0xb98], esi
mov dword [ebp - 0xba8], ecx
mov dword [ebp - 0xba4], edx
mov dword [ebp - 0xbb0], edi
cmp eax, dword [ebp - 0xbc0]
jb 0x41ecf0
mov eax, dword [ebp - 0xbc0]
mov edi, dword [ebp - 0xbd4]
add eax, 4
add eax, edi
mov dword [ebp - 0xb7c], eax
lea eax, [edi + 4]
mov edi, dword [ebp - 0xb88]
cmp dword [ebp - 0xb7c], eax
jb 0x42057b
mov edi, dword [ebp - 0xba0]
mov ebx, dword [ebp - 0xb74]
add ebx, dword [ebp - 0xbc0]
mov eax, dword [ebp - 0xb80]
cmp ebx, dword [ebp - 0xb74]
mov dword [ebp - 0xb94], edi
mov edi, dword [ebp - 0xbb0]
push 0
mov dword [ebp - 0xb88], edi
mov edi, dword [ebp - 0xb94]
mov dword [ebp - 0xbb8], ebx
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xb84], edx
pop ebx
jb 0x4205db
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0xbb4]
sub eax, dword [ebp - 0xbb8]
mov dword [ebp - 0xb74], edi
mov edi, dword [ebp - 0xb88]
mov dword [ebp - 0xb80], esi
mov dword [ebp - 0xb98], ecx
mov dword [ebp - 0xba8], edx
mov dword [ebp - 0xba4], edi
cmp eax, 4
jb 0x41ecf0
mov eax, dword [ebp - 0xb7c]
mov eax, dword [eax]
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp - 0xb7c]
add eax, 4
mov dword [ebp - 0xbcc], eax
cmp eax, dword [ebp - 0xb7c]
jb 0x42057b
mov edi, dword [ebp - 0xb74]
mov eax, dword [ebp - 0xba0]
mov dword [ebp - 0xb94], edi
mov edi, dword [ebp - 0xba4]
mov dword [ebp - 0xb88], edi
mov edi, dword [ebp - 0xbb8]
add edi, 4
mov dword [ebp - 0xbac], eax
cmp edi, dword [ebp - 0xbb8]
mov edi, dword [ebp - 0xb94]
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xb84], edx
jb 0x420596
mov dword [ebp - 0xb74], edi
mov edi, dword [ebp - 0xb88]
mov dword [ebp - 0xba4], edi
mov edi, dword [ebp - 0xbb8]
mov dword [ebp - 0xba0], eax
add edi, 4
mov eax, dword [ebp - 0xbb4]
sub eax, edi
mov dword [ebp - 0xb80], esi
mov dword [ebp - 0xb98], ecx
mov dword [ebp - 0xba8], edx
cmp eax, dword [ebp - 0xbb0]
jb 0x41ecf0
mov eax, dword [ebp - 0xbb0]
mov edi, dword [ebp - 0xbb8]
add eax, 4
add eax, edi
mov dword [ebp - 0xb7c], eax
lea eax, [edi + 4]
mov edi, dword [ebp - 0xb88]
cmp dword [ebp - 0xb7c], eax
jb 0x42057b
mov dword [ebp - 0xb9c], edi
mov dword [ebp - 0xb94], ecx
jmp 0x41e2db
mov dword [ebp - 0xb88], edi
mov dword [ebp - 0xb7c], 0xd0000095
mov eax, dword [ebp - 0xbac]
jmp 0x41e7db
mov eax, dword [ebp - 0xba4]
mov edi, dword [ebp - 0xb80]
mov ecx, dword [ebp - 0xb74]
mov dword [ebp - 0xb88], eax
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb98]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xba0]
mov dword [ebp - 0xb7c], 0xd0000095
jmp 0x41f06d
mov eax, dword [ebp - 0xbb0]
mov edi, dword [ebp - 0xb98]
mov ecx, dword [ebp - 0xba0]
mov dword [ebp - 0xb88], eax
mov eax, dword [ebp - 0xba4]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xb7c], 0xd0000095
jmp 0x41f06d
mov eax, dword [ebp - 0xbb0]
mov edi, dword [ebp - 0xb98]
mov ecx, dword [ebp - 0xba0]
mov dword [ebp - 0xb88], eax
mov eax, dword [ebp - 0xba4]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xb7c], 0xd0000095
jmp 0x41f06d
mov eax, dword [ebp - 0xb88]
mov dword [ebp - 0xb88], eax
jmp 0x420581
mov dword [ebp - 0xb7c], 0xd0000095
jmp 0x41ec66
mov dword [ebp - 0xb7c], 0xd0000095
jmp 0x41ebbb
mov dword [ebp - 0xb7c], 0xc0000095
jmp 0x42058b
mov dword [ebp - 0xb7c], 0xc0000095
jmp 0x41e7db
mov eax, dword [ebp - 0xba0]
mov edi, dword [ebp - 0xb98]
mov ecx, dword [ebp - 0xba4]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0xb7c], 0xc0000095
jmp 0x41f06d
mov dword [ebp - 0xb7c], 0xc0000095
jmp 0x41e7ed
mov eax, dword [ebp - 0xba4]
mov edi, dword [ebp - 0xb98]
mov ecx, dword [ebp - 0xba0]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xb7c], 0xc0000095
jmp 0x41f06d
mov dword [ebp - 0xb7c], 0xc0000095
jmp 0x41e2d5
mov dword [ebp - 0xb7c], 0xd0000095
mov dword [ebp - 0xb84], edx
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xb9c], esi
jmp 0x41e2d5
mov eax, dword [ebp - 0xbb4]
mov edi, dword [ebp - 0xba0]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xb7c], 0xd0000095
mov dword [ebp - 0xb9c], edi
jmp 0x41e2db
mov eax, dword [ebp - 0xbd0]
mov dword [ebp - 0xb7c], 0xd0000095
mov dword [ebp - 0xbd0], eax
mov dword [ebp - 0xb9c], esi
jmp 0x41e2cf
mov edi, dword [ebp - 0xb9c]
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xb7c], 0xd0000001
jmp 0x41e2df
mov esi, dword [ebp - 0xb9c]
mov edi, dword [ebp - 0xbd0]
jmp 0x4207e8
mov edi, ebx
mov eax, dword [ebp - 0xc9c]
mov dword [ebp - 0xca0], ebx
mov dword [ebp - 0xca4], ebx
test eax, eax
je 0x420813
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xc9c], ebx
mov eax, dword [ebp - 0xca8]
test eax, eax
je 0x42082c
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
je 0x42083f
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0x420852
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xc28]
mov dword [ebp - 0xc28], ebx
mov dword [ebp - 0xc2c], eax
jmp 0x4141d3
cmp eax, 0xd00000e5
je 0x420891
cmp eax, 0xc004d501
je 0x420891
cmp eax, 0xd000003e
jne 0x420885
mov ebx, 0xc004f028
jmp 0x4208a3
mov ebx, eax
cmp ebx, 0x8007007a
jne 0x4208a3
jmp 0x42089e
mov ebx, edi
jmp 0x4208a3
cmp dword [ebp - 0xc04], 4
je 0x4208a3
mov ebx, 0xc004f01e
lea ecx, [ebp - 0xc2c]
call fcn.00424fb9
cmp ebx, edi
je 0x41363d
cmp ebx, 0xc004d301
je 0x41363d
cmp ebx, 0xc004d501
je 0x41363d
cmp ebx, 0xc004d502
je 0x41363d
test ebx, ebx
jns 0x41363d
cmp ebx, esi
je 0x41363d
mov ecx, ebx
call fcn.00424f9b
jmp 0x41363d