Function at 0x410f69
Capabilities:
Check if file exists
Check os version
Encode data using xor
Execute anti-debugging instructions
Get keyboard layout
Get number of processors
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xdac
mov eax, dword [0x421148]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
push 0x402190
mov dword [ebp - 0xbf4], esi
mov dword [ebp - 0xbc4], ecx
mov dword [ebp - 0xc14], edi
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x421cc8], eax
test eax, eax
je 0x4114c7
push 0x4021b8
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x421cc4], eax
test eax, eax
je 0x4114c7
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0xc18], eax
test eax, eax
je 0x4114c7
mov ecx, esi
call fcn.00410788
test eax, eax
je 0x4114c7
push 0x7f01
push ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f02
push ebx
mov dword [0x421dcc], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x4021d4
push esi
mov dword [0x421dc8], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
push 0x4021e8
push esi
mov dword [0x421d58], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov dword [0x421d54], eax
cmp dword [0x421dc8], ebx
je 0x4114c7
test eax, eax
je 0x4114c7
cmp dword [0x421d58], ebx
je 0x4114c7
mov ecx, dword [ebp - 0xbc4]
mov edx, esi
call fcn.0041ac73
mov eax, dword [ebp - 0xbc4]
mov dword [0x421dc4], eax
mov dword [0x421dc0], esi
mov dword [0x421cd0], 0x54
mov dword [0x421cd8], ebx
mov dword [0x421cdc], ebx
mov dword [0x421d0c], esi
call fcn.00409f88
call fcn.0040a006
call fcn.00410034
push ebx
push esi
push ebx
push ebx
push dword [0x422824]
push dword [0x422820]
push dword [0x422818]
push dword [0x42281c]
push 0xcf0000
push 0x401c14
push 0x4021f8
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x422c94], eax
mov dword [0x421cd4], eax
test eax, eax
je 0x4114c7
xor ecx, ecx
call fcn.0040d4b7
mov edx, 0x422848
mov ecx, 0x410bb0
call fcn.0041e742
test eax, eax
jns 0x411105
mov dword [0x422848], ebx
mov dword [0x42284c], ebx
mov eax, 0x80000000
cmp dword [0x422818], eax
je 0x4111e3
cmp dword [0x42281c], eax
je 0x4111e3
push 0x2c
lea eax, [ebp - 0x5e0]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x5e0]
push 0x2c
pop esi
push eax
push dword [0x422c94]
mov dword [ebp - 0x5e0], esi
call dword [sym.imp.USER32.dll_GetWindowPlacement]
test eax, eax
je 0x4111b4
mov eax, dword [0x42281c]
mov dword [0x421df8], eax
sub eax, dword [ebp - 0x5c4]
add eax, dword [ebp - 0x5bc]
mov dword [0x421e00], eax
mov eax, dword [0x422818]
mov dword [0x421dfc], eax
sub eax, dword [ebp - 0x5c0]
add eax, dword [ebp - 0x5b8]
mov dword [0x421de0], ebx
mov dword [0x421de4], ebx
mov dword [0x421de8], ebx
mov dword [0x421dec], ebx
mov dword [0x421df0], ebx
mov dword [0x421df4], ebx
mov dword [0x421ddc], esi
mov dword [0x421e04], eax
mov edi, dword [0x422c94]
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
push 0x421ddc
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_SetWindowPlacement]
push esi
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
mov edi, dword [ebp - 0xc14]
mov esi, dword [ebp - 0xbf4]
xor eax, eax
inc eax
push eax
push dword [0x422c94]
call dword [sym.imp.SHELL32.dll_DragAcceptFiles]
lea eax, [ebp - 0x868]
push eax
push dword [0x422c94]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [0x422a78]
push ebx
push esi
push 0xf
push dword [0x422c94]
neg eax
mov esi, 0x401c14
push dword [ebp - 0x85c]
sbb eax, eax
push dword [ebp - 0x860]
and eax, 0xfff00000
push ebx
push ebx
add eax, 0x50300104
push eax
push esi
push 0x402184
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x4114c7
mov ecx, eax
call fcn.00410c12
xor eax, eax
inc eax
push eax
push eax
push 0xda
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
xor eax, eax
inc eax
push eax
push 0x150e
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x402208
push ebx
push 0x1510
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x422a84]
neg eax
push 0x401
push dword [0x422c94]
sbb eax, eax
and eax, 0x10000000
push esi
add eax, 0x44800000
push eax
call dword [sym.imp.COMCTL32.dll_CreateStatusWindowW]
test eax, eax
je 0x4114c7
mov ecx, eax
call fcn.00410d6f
xor eax, eax
lea ecx, [eax + 1]
call fcn.0040c567
lea eax, [ebp - 0x5b4]
push eax
push dword [0x422c90]
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [ebp - 0x5ac]
sub ecx, dword [ebp - 0x5b4]
call fcn.00410da3
push ebx
push dword [0x422a78]
push 0xc8
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
mov dl, 3
inc eax
push eax
mov cl, al
call fcn.0040d587
push 0x2d0
push dword [0x422c94]
call dword [sym.imp.USER32.dll_GetDpiForWindow]
push eax
push dword [0x421248]
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
neg eax
push 0x421d60
mov dword [0x421d60], eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push eax
push dword [ebp - 0xc18]
mov dword [0x421dbc], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, eax
lea eax, [ebp - 0x50]
push eax
push 0x20
pop eax
push eax
push dword [ebp - 0xc18]
call dword [sym.imp.GDI32.dll_GetTextFaceW]
push esi
mov esi, dword [ebp - 0xc18]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x421d7c
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
je 0x4113cb
push 0x421d60
push 0x410b60
push 0x421d7c
push esi
call dword [sym.imp.GDI32.dll_EnumFontsW]
push dword [0x421dbc]
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0x421d60
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [0x421dbc], eax
jmp 0x4113d0
mov eax, dword [0x421dbc]
push ebx
push eax
push 0x30
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebx
push ebx
push 0xbd
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x421dd0], eax
mov eax, dword [0x421d50]
mov dword [0x421d4c], eax
xor eax, eax
lea ecx, [eax + 1]
call fcn.0040caa8
xor eax, eax
lea ecx, [eax + 1]
call fcn.0040c567
push dword [ebp + 0xc]
push dword [0x422c94]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x421dcc]
call dword [sym.imp.USER32.dll_SetCursor]
push 9
pop esi
push 0x20
pop ecx
movzx eax, word [edi]
cmp ax, cx
je 0x41144c
cmp ax, si
jne 0x411451
add edi, 2
jmp 0x41143f
mov edx, edi
mov dword [0x422814], ebx
mov ecx, 0x402218
call fcn.0041045e
test eax, eax
jne 0x41146f
inc eax
mov dword [0x422814], eax
jmp 0x411492
mov edx, edi
mov ecx, 0x402220
call fcn.0041045e
test eax, eax
jne 0x411489
push 2
pop eax
mov dword [0x422814], eax
jmp 0x41148e
mov eax, dword [0x422814]
test eax, eax
je 0x4114aa
push 0x20
add edi, 4
pop ecx
movzx eax, word [edi]
cmp ax, cx
je 0x4114a5
cmp ax, si
jne 0x4114aa
add edi, 2
jmp 0x411498
call fcn.00410b77
test eax, eax
je 0x4114fd
mov ecx, edi
call fcn.00410845
test eax, eax
je 0x4114da
cmp eax, 2
jne 0x4115f6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fb30
leave
ret 8
mov edx, dword [ebp + 0xc]
mov ecx, edi
call fcn.004109ac
test eax, eax
je 0x4114fd
push ebx
push ebx
push 0x10
push dword [0x422c94]
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
inc eax
jmp 0x4114c9
cmp word [edi], bx
je 0x4115f6
lea edx, [ebp - 0xc80]
mov dword [ebp - 0xc80], ebx
mov ecx, edi
call fcn.004104a4
push ebx
mov esi, 0x80
push esi
push 3
push ebx
push 3
push 0x80000000
push dword [ebp - 0xc80]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov dword [0x421cc0], eax
cmp eax, 0xffffffff
jne 0x4115da
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
jne 0x4115a7
mov edx, dword [0x421220]
mov ecx, dword [0x422c94]
push 0x33
push dword [ebp - 0xc80]
push dword [0x42123c]
call fcn.0040cf46
cmp eax, 2
jne 0x411583
lea ecx, [ebp - 0xc80]
call fcn.0040e47d
jmp 0x4114c7
cmp eax, 6
jne 0x4115d1
push ebx
push esi
push 4
push ebx
push 3
push 0xc0000000
push dword [ebp - 0xc80]
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov dword [0x421cc0], eax
jmp 0x4115d1
mov ecx, dword [ebp - 0xc80]
call fcn.0040f81b
mov ecx, dword [0x422800]
test ecx, ecx
je 0x4115c1
call fcn.0040d568
xor eax, eax
mov dword [0x422800], ebx
lea ecx, [eax + 1]
call fcn.0040caa8
cmp dword [0x421cc0], 0xffffffff
je 0x4115eb
mov edx, dword [0x422814]
lea ecx, [ebp - 0xc80]
call fcn.0040edca
lea ecx, [ebp - 0xc80]
call fcn.0040e47d
mov eax, dword [0x422c94]
mov dword [0x421d28], eax
lea eax, [ebp - 0xd0c]
push eax
lea eax, [ebp - 0xd10]
mov dword [0x421d2c], ebx
push eax
push 0xb0
push dword [0x422c8c]
mov dword [0x421d30], ebx
mov dword [0x421d34], ebx
mov dword [0x421d38], ebx
mov dword [0x421d3c], ebx
mov dword [0x421d40], ebx
mov dword [0x421d44], ebx
mov dword [0x421d48], ebx
mov dword [0x421d24], 0x28
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0xd0c]
push dword [ebp - 0xd10]
push 0xb1
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0xb7
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
and eax, 0x3ff
cmp ax, 0x11
jne 0x4116b1
xor eax, eax
inc eax
push eax
push eax
push 0xd8
push dword [0x422c8c]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0xce4], ebx
mov edx, 0x422cb8
mov dword [ebp - 0xca0], ebx
mov dword [ebp - 0xca4], ebx
mov dword [ebp - 0xbac], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x4116d0
mov eax, dword [0x422cb4]
mov esi, 0x7f1137f
mov dword [ebp - 0xc78], 0x40274a
mov dword [ebp - 0xc38], 0x67
mov dword [ebp - 0xbf4], 0x337
mov dword [ebp - 0xc7c], 0x10b
mov dword [ebp - 0xc18], 0x20b
push 0
pop ebx
test eax, eax
jne 0x411d6e
push 0x338
mov edi, ebx
mov dword [ebp - 0xbd4], ebx
push ebx
mov dword [ebp - 0xb98], edi
mov dword [ebp - 0xba4], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xbe4], eax
test eax, eax
je 0x411d07
or dword [ebp - 0xbb4], 0xffffffff
mov eax, 0xab69605e
mov dword [ebp - 0x3e0], eax
mov cl, bl
mov eax, 0x7f1137f
mov dword [ebp - 0x3dc], esi
movzx esi, word [ebp - 0x3de]
movzx edx, word [ebp - 0x3da]
movzx eax, ax
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0xbe4]
add eax, 7
mov dword [ebp - 0xbc0], esi
mov dword [ebp - 0xbc4], ebx
mov esi, 0x40274a
mov dword [ebp - 0xc48], ebx
mov dword [ebp - 0xc64], edi
mov dword [ebp - 0xb8c], edx
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xbe8], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edx, byte [esi + 2]
shl edx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edx, eax
mov dword [ebp - 0xc14], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl edx, 8
or edx, eax
mov dword [ebp - 0xbd0], edi
movzx eax, byte [esi + 5]
add esi, 8
mov ebx, dword [ebp - 0xbd0]
shl edx, 8
or edx, eax
mov dword [ebp - 0xb9c], esi
mov edi, edx
mov esi, dword [ebp - 0xbd8]
xor edi, dword [ebp - 0xc48]
mov eax, 0x7f1137f
xor edi, eax
mov dword [ebp - 0xbdc], edx
xor edi, ebx
xor edi, 0xab69605e
mov eax, edi
rol eax, 0xa
lea edx, [edi + 0x54969fa2]
rol edx, 5
imul edx, esi
add edx, eax
xor ebx, edx
mov edx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea edx, [ebx + edx]
ror edx, 9
imul edx, dword [ebp - 0xbc0]
sub edx, eax
xor edi, edx
mov eax, edi
sub eax, esi
imul edx, eax, 0x605e
mov eax, edi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xbc0]
rol edx, 6
imul edx, dword [ebp - 0xb8c]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor edi, edx
mov edx, edi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, esi
xor eax, ebx
mov edx, ebx
imul eax, dword [ebp - 0xbc0]
ror edx, 6
xor edx, eax
mov eax, 0x7f1137f
xor edi, edx
add eax, edi
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, edi
rol eax, 2
add edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 8
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
imul edx, dword [ebp - 0xb8c]
sub edx, eax
xor edi, edx
mov edx, edi
mov eax, edi
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, esi
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb8c]
xor edx, ebx
mov eax, ebx
imul edx, dword [ebp - 0xbc0]
shr eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xb8c]
xor ebx, eax
mov esi, ebx
sub esi, dword [ebp - 0xb8c]
xor esi, edi
xor esi, 0xab69605e
mov edx, esi
mov eax, esi
xor edx, dword [ebp - 0xb8c]
rol edx, 2
imul edx, dword [ebp - 0xbd8]
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, eax
mov eax, ebx
ror edx, 6
imul edx, dword [ebp - 0xbc0]
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xbd8]
xor esi, edx
xor eax, esi
mov edx, esi
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
xor ebx, edx
mov edx, ebx
mov dword [ebp - 0xbd0], ebx
xor edx, dword [ebp - 0xbc0]
mov eax, ebx
rol edx, 5
imul edx, dword [ebp - 0xb8c]
rol eax, 7
add edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov ebx, esi
xor ebx, dword [ebp - 0xbd0]
xor ebx, edx
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xbc0]
imul eax, dword [ebp - 0xbd8]
xor esi, eax
mov eax, esi
sub eax, edx
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [ebp - 0xb8c]
add edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xbd8]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
shr eax, 3
xor edx, 0x605e
imul edx, dword [ebp - 0xbc0]
xor edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov eax, esi
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xbb4]
rol eax, 2
mov dword [ebp - 0xc48], esi
mov esi, dword [ebp - 0xb9c]
xor edx, eax
xor edx, dword [ebp - 0xbc4]
xor ebx, edx
mov edx, dword [ebp - 0xbcc]
mov dword [ebp - 0xc64], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xc48]
ror dword [ebp - 0xc64], 8
mov byte [edx], al
mov al, byte [ebp - 0xc64]
ror dword [ebp - 0xc48], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xc48]
ror dword [ebp - 0xc64], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xc64]
ror dword [ebp - 0xc48], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xc48]
ror dword [ebp - 0xc64], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xc64]
ror dword [ebp - 0xc48], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xc48]
mov byte [edx - 3], al
add edx, 8
mov edi, dword [ebp - 0xc64]
mov eax, dword [ebp - 0xc14]
ror dword [ebp - 0xc48], 8
ror edi, 8
sub dword [ebp - 0xbe8], 1
mov dword [ebp - 0xbc4], eax
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0xc64], edi
mov dword [ebp - 0xbb4], eax
mov dword [ebp - 0xbcc], edx
jne 0x4117cb
mov esi, dword [ebp - 0xbe4]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x411b40
movzx eax, cl
cdq
cmp eax, dword [0x402a80]
jne 0x411b75
cmp edx, dword [0x402a84]
jne 0x411b75
mov edi, esi
mov dword [ebp - 0xb98], esi
mov esi, ebx
mov dword [ebp - 0xbc4], 0x337
jmp 0x411b88
or dword [ebp - 0xbc4], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xba4], 0xc004d501
test esi, esi
je 0x411b9b
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xba4], ebx
jl 0x411d01
mov eax, dword [ebp - 0xbc4]
mov esi, edi
push 0x40
push ebx
push 0x4227c0
mov byte [eax + edi], bl
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], bl
je 0x411d0e
mov edi, 0x4227c0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xc14], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x411bdc
sub ecx, dword [ebp - 0xc14]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0x411cfa
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xbc0], ecx
cmp word [eax], dx
je 0x411c24
mov ecx, 0xc000007b
mov dword [ebp - 0xbc0], ecx
jmp 0x411c6c
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x411c17
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x411c17
cmp dword [edx], 0x4550
jne 0x411c17
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc7c]
je 0x411c5a
cmp ax, word [ebp - 0xc18]
je 0x411c5a
mov ecx, 0xc000000d
jmp 0x411c1c
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xb9c], eax
mov dword [ebp - 0xbc4], ebx
test eax, eax
je 0x411ce7
mov edx, esi
mov dword [ebp - 0xbdc], esi
lea eax, [edx + 1]
mov dword [ebp - 0xc14], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x411c93
sub edx, dword [ebp - 0xc14]
inc esi
add esi, edx
test ecx, ecx
js 0x411ccc
push dword [ebp - 0xbdc]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0x411cf2
mov ecx, dword [ebp - 0xbd4]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xbc0]
mov eax, dword [ebp - 0xbc4]
inc dword [ebp - 0xbd4]
inc eax
mov dword [ebp - 0xbc4], eax
cmp eax, dword [ebp - 0xb9c]
jb 0x411c82
add edi, 0x10
cmp byte [esi], bl
jne 0x411bcf
mov esi, dword [ebp - 0xbc0]
jmp 0x411d10
mov esi, 0xc000007a
jmp 0x411d10
mov edi, dword [ebp - 0xb98]
mov esi, 0xc000007a
jmp 0x411d16
mov esi, ebx
mov edi, dword [ebp - 0xb98]
test edi, edi
je 0x411d29
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0x411d69
mov esi, ebx
mov eax, dword [esi + 0x4227c0]
test eax, eax
je 0x411d40
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x411d2f
push 0x40
push ebx
push 0x4227c0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x401060
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x411d74
mov eax, dword [0x422cb4]
inc eax
mov dword [0x422cb4], eax
xor eax, eax
mov ecx, 0x422cb8
xchg dword [ecx], eax
mov eax, dword fs:[0x30]
mov edi, ebx
mov dword [ebp - 0xccc], ebx
mov dword [ebp - 0xcd0], ebx
cmp dword [eax + 0x1d4], ebx
je 0x412041
mov esi, dword [0x421088]
mov ecx, esi
call dword [0x4234b4]
call esi
mov ecx, eax
mov dword [ebp - 0xc14], ecx
test ecx, ecx
jne 0x411de0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x411dd0
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x412049
mov edi, 0x80004005
jmp 0x412049
mov dword [ebp - 0xc84], ebx
mov edi, ebx
mov eax, ebx
mov esi, ebx
lea edx, [ebp - 0xce0]
push edx
push eax
push esi
mov esi, dword [0x421098]
push 2
push ecx
mov ecx, esi
call dword [0x4234b4]
call esi
test eax, eax
jne 0x411e7c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x411e67
cmp dword [ebp - 0xc84], 0
jne 0x411e60
push dword [ebp - 0xce0]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
lea ecx, [ebp - 0xc84]
mov esi, eax
call fcn.0041d664
test esi, esi
je 0x411e59
mov eax, dword [ebp - 0xce0]
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0xc84], esi
jmp 0x411dec
mov edi, 0x8007000e
jmp 0x411e88
mov edi, 0x80004005
jmp 0x411e8e
test eax, eax
je 0x411e60
jg 0x411e71
mov edi, eax
jmp 0x411e8e
movzx edi, ax
or edi, 0x80070000
jmp 0x411e8e
mov eax, dword [ebp - 0xc84]
mov dword [ebp - 0xccc], eax
mov dword [ebp - 0xc84], ebx
lea ecx, [ebp - 0xc84]
call fcn.0041d664
test edi, edi
js 0x412049
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
mov esi, dword [0x421094]
mov ecx, esi
push eax
call dword [0x4234b4]
call esi
mov ecx, eax
mov dword [ebp - 0xc14], ecx
test ecx, ecx
je 0x411db9
mov dword [ebp - 0xc88], ebx
mov edi, ebx
mov eax, ebx
mov esi, ebx
lea edx, [ebp - 0xcec]
push edx
push eax
push esi
mov esi, dword [0x421098]
push 2
push ecx
mov ecx, esi
call dword [0x4234b4]
call esi
test eax, eax
jne 0x411f64
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0x411f4f
cmp dword [ebp - 0xc88], 0
jne 0x411f48
push dword [ebp - 0xcec]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
lea ecx, [ebp - 0xc88]
mov esi, eax
call fcn.0041d664
test esi, esi
je 0x411f41
mov eax, dword [ebp - 0xcec]
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0xc88], esi
jmp 0x411ed4
mov edi, 0x8007000e
jmp 0x411f70
mov edi, 0x80004005
jmp 0x411f76
test eax, eax
je 0x411f48
jg 0x411f59
mov edi, eax
jmp 0x411f76
movzx edi, ax
or edi, 0x80070000
jmp 0x411f76
mov eax, dword [ebp - 0xc88]
mov dword [ebp - 0xcd0], eax
mov dword [ebp - 0xc88], ebx
lea ecx, [ebp - 0xc88]
call fcn.0041d664
test edi, edi
js 0x412049
mov eax, dword [ebp - 0xccc]
test eax, eax
je 0x412041
mov ecx, 0x402330
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x411fc5
test dx, dx
je 0x411fbe
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x411fc5
add eax, 4
add ecx, 4
test dx, dx
jne 0x411f9c
xor esi, esi
mov eax, ebx
inc esi
jmp 0x411fcc
sbb eax, eax
xor esi, esi
inc esi
or eax, esi
test eax, eax
jne 0x412041
mov eax, dword [ebp - 0xcd0]
test eax, eax
je 0x412041
mov ecx, 0x402340
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x412005
test dx, dx
je 0x412001
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x412005
add eax, 4
add ecx, 4
test dx, dx
jne 0x411fdf
mov eax, ebx
jmp 0x412009
sbb eax, eax
or eax, esi
test eax, eax
jne 0x412041
push 4
lea eax, [ebp - 0xce8]
mov dword [ebp - 0xce8], ebx
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
je 0x411db9
test byte [ebp - 0xce8], 0xf
jne 0x412041
xor eax, eax
inc eax
jmp 0x412043
mov eax, ebx
mov dword [ebp - 0xbac], eax
lea ecx, [ebp - 0xcd0]
call fcn.0041d664
lea ecx, [ebp - 0xccc]
call fcn.0041d664
test edi, edi
jns 0x412069
mov dword [ebp - 0xbac], ebx
push 4
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov esi, eax
lea ecx, [ebp - 0xca4]
mov dword [ebp - 0xba8], esi
call fcn.0041d64d
test esi, esi
jne 0x41214a
mov dword [ebp - 0xca4], ebx
mov dword [ebp - 0xb84], 0x8007000e
mov eax, dword [ebp - 0xc90]
mov dword [ebp - 0xca0], eax
xor ebx, ebx
mov edx, 0x422cb8
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x4120b1
mov eax, dword [0x422cb4]
push 0
pop ebx
test eax, eax
jle 0x41210e
sub eax, 1
mov dword [0x422cb4], eax
jne 0x41210e
mov edi, ebx
mov eax, dword [edi + 0x4227c0]
test eax, eax
je 0x4120e7
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0x4120d6
push 0x40
push ebx
push 0x4227c0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x401060
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0x422cb8
xchg dword [ecx], eax
lea ecx, [ebp - 0xca4]
call fcn.0041d64d
mov eax, dword [ebp - 0xb84]
mov esi, 0xc004f012
lea edi, [esi + 0x15]
test eax, eax
jns 0x41ac16
cmp eax, 0xd0000034
jne 0x41abe9
mov eax, esi
jmp 0x41ac12
xor eax, eax
mov dword [ebp - 0xca4], esi
lea edi, [ebp - 0xc08]
mov dword [ebp - 0xbb0], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xb9c], ebx
mov dword [ebp - 0xbb4], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xc9c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xc14], 0x38
mov dword [ebp - 0xba0], esi
mov edi, 0xc0000095
test esi, esi
jne 0x4121b1
mov esi, 0xc0000017
jmp 0x4144b9
push 0xa0
push 0x421710
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [ebp - 0xbb0], esi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xbb8], ecx
test ecx, ecx
je 0x4121a7
mov eax, dword [0x421708]
mov dword [ecx], eax
mov eax, dword [0x42170c]
mov dword [ecx + 4], eax
mov dword [ebp - 0xb9c], ecx
rdtsc
mov dword [ebp - 0xbd8], eax
mov dword [ebp - 0xbd0], edx
mov dword [ebp - 0xbdc], 0xc
lea eax, [ebp - 0xcc8]
mov edx, 0x7fffffff
push eax
mov ecx, 0x4022f0
call fcn.0041d69b
test eax, eax
jns 0x41223e
mov dword [ebp - 0xcc8], ebx
mov esi, 0xc000003e
jmp 0x4144b9
mov eax, dword [ebp - 0xcc8]
inc eax
mov dword [ebp - 0xcc8], eax
lea eax, [eax*2 + 4]
cmp eax, 4
jb 0x41225b
mov esi, ebx
jmp 0x412263
mov eax, dword [ebp - 0xbdc]
mov esi, edi
mov dword [ebp - 0xb84], esi
test esi, esi
js 0x4144bf
lea ecx, [eax + 0xc4]
mov edx, 0xc4
cmp ecx, edx
jb 0x412284
mov eax, ecx
jmp 0x412287
or eax, 0xffffffff
cmp ecx, edx
sbb esi, esi
and esi, edi
add esi, 0x10000000
mov dword [ebp - 0xb84], esi
cmp ecx, edx
jb 0x4144a9
lea edx, [eax + 8]
cmp edx, eax
jb 0x4122ac
mov ecx, edx
jmp 0x4122af
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, edi
add esi, 0x10000000
mov dword [ebp - 0xb84], esi
cmp edx, eax
jb 0x4144a9
lea eax, [ecx + 8]
cmp eax, ecx
jb 0x4122d4
mov edx, eax
jmp 0x4122d7
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, edi
add esi, 0x10000000
mov dword [ebp - 0xb84], esi
cmp eax, ecx
jb 0x4144a9
push edx
push 8
mov dword [ebp - 0xc04], edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x4121a7
mov dword [ebp - 0xc00], edx
mov dword [ebp - 0xc08], ebx
mov dword [ebp - 0xda4], ebx
lea esi, [edx + 4]
cmp esi, edx
jb 0x412383
mov ecx, dword [ebp - 0xc04]
lea eax, [edx + 8]
add ecx, edx
cmp eax, ecx
jbe 0x412343
mov esi, 0xc0000023
jmp 0x4144b9
mov dword [edx], 4
mov dword [esi], ebx
mov ecx, dword [ebp - 0xc08]
inc ecx
mov dword [ebp - 0xc08], ecx
cmp dword [ebp - 0xc00], 0
jne 0x41238a
mov eax, dword [ebp - 0xc04]
lea edx, [eax + 0xa4]
cmp edx, eax
jb 0x412383
inc ecx
mov dword [ebp - 0xc04], edx
mov dword [ebp - 0xc08], ecx
jmp 0x41240f
mov esi, edi
jmp 0x4144b9
mov edx, dword [ebp - 0xc00]
mov esi, ebx
test ecx, ecx
je 0x4123b1
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x412443
add eax, edx
cmp eax, edx
jb 0x412383
inc esi
mov edx, eax
cmp esi, ecx
jb 0x412396
lea eax, [edx + 4]
cmp eax, edx
jb 0x412383
mov ecx, dword [ebp - 0xc04]
lea eax, [edx + 0xa4]
add ecx, dword [ebp - 0xc00]
mov esi, ebx
mov dword [ebp - 0xb84], esi
cmp eax, ecx
ja 0x412339
mov eax, 0xa0
push eax
push dword [ebp - 0xba0]
mov dword [edx], eax
lea eax, [edx + 4]
push eax
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xc08]
add esp, 0xc
inc ecx
mov dword [ebp - 0xc08], ecx
test esi, esi
js 0x4144bf
mov edx, dword [ebp - 0xc04]
cmp dword [ebp - 0xc00], 0
jne 0x41244d
lea eax, [edx + 0xc]
cmp eax, edx
jb 0x412383
mov edx, eax
inc ecx
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xd30], eax
mov eax, dword [ebp - 0xbd0]
mov dword [ebp - 0xd2c], eax
jmp 0x4124f6
mov esi, edi
mov dword [ebp - 0xb84], esi
jmp 0x412401
mov edi, dword [ebp - 0xc00]
mov esi, ebx
test ecx, ecx
je 0x412478
mov eax, dword [edi]
add eax, 4
cmp eax, 4
jb 0x41251d
add eax, edi
cmp eax, edi
jb 0x412513
inc esi
mov edi, eax
cmp esi, ecx
jb 0x412459
lea eax, [edi + 4]
cmp eax, edi
jb 0x412513
mov ecx, dword [ebp - 0xc00]
lea eax, [edi + 0xc]
add ecx, edx
mov esi, ebx
mov dword [ebp - 0xb84], esi
cmp eax, ecx
ja 0x412339
mov ecx, dword [ebp - 0xbb8]
mov dword [edi], 8
mov eax, dword [ecx]
mov dword [edi + 4], eax
mov eax, dword [ecx + 4]
mov dword [edi + 8], eax
mov edi, 0xc0000095
mov ecx, dword [ebp - 0xc08]
mov edx, dword [ebp - 0xc04]
inc ecx
mov dword [ebp - 0xc08], ecx
test esi, esi
js 0x4144bf
cmp dword [ebp - 0xc00], 0
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xd30], eax
mov eax, dword [ebp - 0xbd0]
mov dword [ebp - 0xd2c], eax
jne 0x41252c
lea eax, [edx + 0xc]
cmp eax, edx
jb 0x412383
inc ecx
mov dword [ebp - 0xc04], eax
mov dword [ebp - 0xc08], ecx
jmp 0x412597
mov esi, 0xc0000095
jmp 0x4144b9
mov edi, 0xc0000095
mov esi, edi
mov dword [ebp - 0xb84], esi
jmp 0x4124cd
mov edi, dword [ebp - 0xc00]
mov esi, ebx
test ecx, ecx
je 0x41254f
mov eax, dword [edi]
add eax, 4
cmp eax, 4
jb 0x4125bc
add eax, edi
cmp eax, edi
jb 0x412513
inc esi
mov edi, eax
cmp esi, ecx
jb 0x412538
lea eax, [edi + 4]
cmp eax, edi
jb 0x412513
mov ecx, dword [ebp - 0xc00]
lea eax, [edi + 0xc]
add ecx, edx
mov esi, ebx
mov dword [ebp - 0xb84], esi
cmp eax, ecx
ja 0x412339
mov eax, dword [ebp - 0xbd8]
mov dword [edi], 8
mov dword [edi + 4], eax
mov eax, dword [ebp - 0xbd0]
mov dword [edi + 8], eax
inc dword [ebp - 0xc08]
test esi, esi
js 0x4144bf
lea eax, [ebp - 0xcc4]
mov edx, 0x7fffffff
push eax
mov ecx, 0x4022f0
call fcn.0041d69b
test eax, eax
jns 0x4125c9
mov dword [ebp - 0xcc4], ebx
jmp 0x412234
mov esi, 0xc0000095
mov dword [ebp - 0xb84], esi
jmp 0x41258f
mov eax, dword [ebp - 0xcc4]
mov ecx, 0xc0000095
lea edx, [eax + 1]
cmp edx, eax
jb 0x4125df
mov esi, ebx
jmp 0x4125e4
mov esi, ecx
or edx, 0xffffffff
mov dword [ebp - 0xb84], esi
mov dword [ebp - 0xcc4], edx
test esi, esi
js 0x4144bf
lea eax, [edx + edx]
mov dword [ebp - 0xbc4], eax
test eax, eax
je 0x4126c8
cmp dword [ebp - 0xc00], 0
jne 0x412649
lea edx, [eax + 4]
cmp edx, 4
jb 0x412642
add edx, dword [ebp - 0xc04]
cmp edx, dword [ebp - 0xc04]
jb 0x41263b
inc dword [ebp - 0xc08]
mov esi, ebx
mov dword [ebp - 0xc04], edx
jmp 0x4126cd
or dword [ebp - 0xc04], 0xffffffff
mov esi, ecx
jmp 0x4126cd
cmp dword [ebp - 0xc08], 0
mov edx, ebx
mov edi, dword [ebp - 0xc00]
jbe 0x41267b
mov eax, dword [edi]
add eax, 4
cmp eax, 4
jb 0x412642
add eax, edi
cmp eax, edi
jb 0x412642
inc edx
mov edi, eax
cmp edx, dword [ebp - 0xc08]
jb 0x41265a
mov eax, dword [ebp - 0xbc4]
lea edx, [edi + 4]
cmp edx, edi
jb 0x412642
lea edx, [eax + 4]
mov esi, ebx
mov eax, dword [ebp - 0xc00]
add edx, edi
add eax, dword [ebp - 0xc04]
mov dword [ebp - 0xb84], esi
cmp edx, eax
jbe 0x4126a6
mov esi, 0xc0000023
jmp 0x4126cd
mov eax, dword [ebp - 0xbc4]
push eax
mov dword [edi], eax
lea eax, [edi + 4]
push 0x4022f0
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
inc dword [ebp - 0xc08]
jmp 0x4126d3
mov esi, 0xc000000d
mov dword [ebp - 0xb84], esi
test esi, esi
js 0x4144bf
cmp dword [ebp - 0xc00], 0
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xd9c], eax
jne 0x41271c
mov eax, dword [ebp - 0xc04]
lea ecx, [eax + 8]
cmp ecx, eax
jb 0x412513
inc dword [ebp - 0xc08]
mov dword [ebp - 0xc04], ecx
mov dword [ebp - 0xd1c], 4
jmp 0x4127ae
cmp dword [ebp - 0xc08], 0
mov ecx, ebx
mov edx, dword [ebp - 0xc00]
jbe 0x412750
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x4127d0
add eax, edx
cmp eax, edx
jb 0x412513
inc ecx
mov edx, eax
cmp ecx, dword [ebp - 0xc08]
jb 0x41272d
lea edi, [edx + 4]
cmp edi, edx
jb 0x412513
mov ecx, dword [ebp - 0xc04]
lea eax, [edx + 8]
add ecx, dword [ebp - 0xc00]
mov esi, ebx
mov dword [ebp - 0xb84], esi
cmp eax, ecx
ja 0x412339
mov eax, dword [ebp - 0xbac]
mov dword [edx], 4
mov dword [edi], eax
mov edi, 0xc0000095
inc dword [ebp - 0xc08]
test esi, esi
js 0x4144bf
cmp dword [ebp - 0xc00], 0
mov dword [ebp - 0xd1c], 4
jne 0x4127df
mov eax, dword [ebp - 0xc04]
lea ecx, [eax + 8]
cmp ecx, eax
jb 0x412513
inc dword [ebp - 0xc08]
mov dword [ebp - 0xc04], ecx
jmp 0x412853
mov edi, 0xc0000095
mov esi, edi
mov dword [ebp - 0xb84], esi
jmp 0x412793
cmp dword [ebp - 0xc08], 0
mov ecx, ebx
mov edx, dword [ebp - 0xc00]
jbe 0x412813
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x4128e7
add eax, edx
cmp eax, edx
jb 0x412383
inc ecx
mov edx, eax
cmp ecx, dword [ebp - 0xc08]
jb 0x4127f0
lea eax, [edx + 4]
cmp eax, edx
jb 0x412383
mov ecx, dword [ebp - 0xc04]
lea eax, [edx + 8]
add ecx, dword [ebp - 0xc00]
mov esi, ebx
mov dword [ebp - 0xb84], esi
cmp eax, ecx
ja 0x412339
push 4
pop eax
mov dword [edx], eax
mov dword [edx + 4], eax
inc dword [ebp - 0xc08]
test esi, esi
js 0x4144bf
rdtsc
mov edi, ebx
mov dword [ebp - 0xbec], ebx
mov dword [ebp - 0xbf0], edi
mov dword [ebp - 0xb8c], ebx
mov dword [ebp - 0xbe8], ebx
mov dword [ebp - 0xba0], ebx
mov dword [ebp - 0xc10], ebx
mov dword [ebp - 0xb90], ebx
mov dword [ebp - 0xbcc], ebx
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xbe4], ebx
mov dword [ebp - 0xbdc], eax
mov dword [ebp - 0xbb8], edx
mov ecx, dword [ebp - 0xc04]
add ecx, 8
cmp ecx, 8
jb 0x412979
lea eax, [ecx + 7]
and eax, 0xfffffff8
mov dword [ebp - 0xbc4], eax
cmp eax, ecx
jb 0x412979
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x4128f4
mov esi, 0xc0000017
mov edi, ebx
jmp 0x41297e
mov esi, edi
mov dword [ebp - 0xb84], esi
jmp 0x41284b
mov eax, dword [ebp - 0xc08]
lea ecx, [edi + 4]
mov dword [edi], eax
cmp ecx, edi
jb 0x412959
mov eax, dword [ebp - 0xc04]
lea edx, [ecx + 4]
mov dword [ecx], eax
cmp edx, ecx
jb 0x412959
mov eax, dword [ebp - 0xbc4]
mov esi, ebx
mov ecx, dword [ebp - 0xbdc]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0xbb8]
mov dword [edi + eax - 4], ecx
push dword [ebp - 0xc04]
push dword [ebp - 0xc00]
push edx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xbc4]
add esp, 0xc
mov dword [ebp - 0xbec], edi
mov edi, ebx
mov dword [ebp - 0xbf0], eax
jmp 0x41295e
mov esi, 0xc0000095
test edi, edi
je 0x412971
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xbf0]
jmp 0x41297e
mov esi, 0xc0000095
or esi, 0x10000000
mov dword [ebp - 0xb84], esi
jl 0x413f19
cmp dword [ebp - 0xbec], 0
mov dword [ebp - 0xbfc], ebx
jne 0x4129a9
mov esi, 0xc000000d
jmp 0x413044
test edi, edi
je 0x41303f
lea eax, [edi + 8]
push eax
push ebx
mov dword [ebp - 0xbb8], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xb98], esi
test esi, esi
je 0x41303f
mov cl, bl
mov edx, ebx
test edi, edi
je 0x4129ef
mov eax, dword [ebp - 0xbec]
xor cl, byte [edx + eax]
inc edx
cmp edx, edi
jb 0x4129e7
mov eax, 0xb1b54a58
mov dword [ebp - 0xc4c], ebx
mov dword [ebp - 0x3d8], eax
mov eax, 0xc81ecb17
mov dword [ebp - 0x3d4], eax
or eax, 0xffffffff
mov dword [ebp - 0xb88], eax
mov dword [ebp - 0xc50], eax
mov eax, edi
shr eax, 3
mov dword [ebp - 0xbe0], eax
test eax, eax
je 0x412e82
movzx edx, word [ebp - 0x3d6]
mov eax, 0xc81ecb17
movzx esi, ax
mov edi, 0xb1b54a58
movzx eax, word [ebp - 0x3d2]
mov dword [ebp - 0xbc0], eax
movzx eax, di
mov dword [ebp - 0xb84], eax
mov eax, edi
xor eax, 0xc81ecb17
mov dword [ebp - 0xbc8], edx
mov edx, dword [ebp - 0xb88]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xb98]
add eax, 7
mov dword [ebp - 0xbbc], esi
mov dword [ebp - 0xbd4], eax
mov eax, dword [ebp - 0xbec]
add eax, 2
mov dword [ebp - 0xb94], ebx
mov dword [ebp - 0xbc4], eax
mov dword [ebp - 0xbf8], ebx
mov ebx, dword [ebp - 0xbc4]
movzx edi, byte [ebx - 2]
movzx eax, byte [ebx - 1]
movzx esi, byte [ebx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [ebx]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 3]
or esi, eax
movzx eax, byte [ebx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [ebx + 5]
add ebx, 8
shl esi, 8
or esi, eax
mov dword [ebp - 0xbc4], ebx
xor edx, esi
mov eax, 0xc81ecb17
mov ebx, edx
mov dword [ebp - 0xb88], edx
sub ebx, dword [ebp - 0xb84]
xor ebx, edi
xor ebx, dword [ebp - 0xc4c]
xor ebx, eax
mov edx, ebx
xor edx, eax
mov eax, ebx
ror edx, 0xf
imul edx, dword [ebp - 0xbc8]
ror eax, 7
add edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, 0xb1b54a58
add edx, eax
mov dword [ebp - 0xb88], eax
ror edx, 9
imul edx, dword [ebp - 0xbbc]
ror eax, 0xa
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xbbc]
rol edx, 4
imul edx, dword [ebp - 0xbc0]
rol eax, 5
add edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb88], eax
xor edx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, edx
xor ebx, eax
mov edx, ebx
mov eax, ebx
sub edx, dword [ebp - 0xb84]
imul edx, dword [ebp - 0xbc8]
shr eax, 6
sub edx, eax
xor dword [ebp - 0xb88], edx
mov edx, dword [ebp - 0xb88]
mov eax, edx
ror eax, 0xf
xor eax, dword [ebp - 0xbbc]
imul eax, dword [ebp - 0xb84]
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, dword [ebp - 0xbc0]
imul eax, dword [ebp - 0xbbc]
xor edx, eax
mov dword [ebp - 0xb88], edx
sub edx, dword [ebp - 0xb84]
sub edx, 0xc81ecb17
xor ebx, edx
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0xbc0]
imul eax, dword [ebp - 0xbc8]
ror edx, 0xa
xor edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, dword [ebp - 0xb84]
xor edx, eax
mov dword [ebp - 0xb88], eax
rol edx, 6
imul edx, dword [ebp - 0xbbc]
ror eax, 3
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb88]
mov eax, ebx
ror eax, 0xf
sub eax, dword [ebp - 0xbc0]
imul eax, dword [ebp - 0xb84]
xor edx, eax
mov dword [ebp - 0xb88], edx
xor edx, dword [ebp - 0xbc0]
imul edx, dword [ebp - 0xb84]
mov eax, dword [ebp - 0xb88]
shr eax, 1
xor edx, eax
mov eax, dword [ebp - 0xb88]
xor ebx, edx
mov edx, eax
sub edx, dword [ebp - 0xbbc]
rol edx, 3
imul edx, dword [ebp - 0xb84]
shr eax, 0xf
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
sub edx, dword [ebp - 0xbbc]
imul edx, dword [ebp - 0xbc8]
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0xb88], eax
ror edx, 9
imul edx, dword [ebp - 0xbbc]
ror eax, 0xb
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb88]
mov eax, ebx
sub eax, 0xb1b54a58
sub eax, dword [ebp - 0xbc0]
xor edx, eax
mov dword [ebp - 0xb88], edx
mov eax, dword [ebp - 0xb88]
xor eax, dword [ebp - 0xbc8]
imul eax, dword [ebp - 0xb84]
ror edx, 7
sub eax, edx
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xbc0]
rol edx, 4
imul edx, dword [ebp - 0xbc8]
ror eax, 0x10
sub edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, 0xb1b54a58
mov dword [ebp - 0xb88], eax
sub edx, eax
ror eax, 4
ror edx, 0xa
imul edx, dword [ebp - 0xbbc]
add edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, dword [ebp - 0xbc0]
xor edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb88], eax
xor edx, 0xc81ecb17
rol eax, 2
rol edx, 8
imul edx, dword [ebp - 0xb84]
sub edx, eax
xor ebx, edx
mov edx, 0xc81ecb17
sub edx, ebx
mov eax, ebx
ror eax, 0xc
ror edx, 0xb
imul edx, dword [ebp - 0xbc8]
sub edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb88], eax
xor edx, dword [ebp - 0xbc8]
imul edx, dword [ebp - 0xbbc]
shr eax, 8
xor edx, eax
mov eax, dword [ebp - 0xb88]
xor ebx, edx
xor eax, ebx
xor ebx, dword [ebp - 0xb94]
xor eax, dword [ebp - 0xbdc]
xor eax, dword [ebp - 0xbf8]
mov dword [ebp - 0xc50], eax
mov eax, dword [ebp - 0xbd4]
mov dword [ebp - 0xc4c], ebx
mov dword [ebp - 0xb94], edi
mov dword [ebp - 0xbf8], esi
mov byte [eax - 4], bl
mov al, byte [ebp - 0xc50]
mov ebx, dword [ebp - 0xbd4]
ror dword [ebp - 0xc4c], 8
mov byte [ebx], al
ror dword [ebp - 0xc50], 8
mov al, byte [ebp - 0xc4c]
mov byte [ebx - 5], al
mov al, byte [ebp - 0xc50]
ror dword [ebp - 0xc4c], 8
mov byte [ebx - 1], al
ror dword [ebp - 0xc50], 8
mov al, byte [ebp - 0xc4c]
mov byte [ebx - 6], al
mov al, byte [ebp - 0xc50]
ror dword [ebp - 0xc4c], 8
mov byte [ebx - 2], al
ror dword [ebp - 0xc50], 8
mov al, byte [ebp - 0xc4c]
mov byte [ebx - 7], al
mov al, byte [ebp - 0xc50]
mov byte [ebx - 3], al
add ebx, 8
mov edx, dword [ebp - 0xc50]
ror dword [ebp - 0xc4c], 8
ror edx, 8
sub dword [ebp - 0xbe0], 1
mov dword [ebp - 0xc50], edx
mov dword [ebp - 0xbd4], ebx
jne 0x412aa0
mov edi, dword [ebp - 0xbf0]
xor ebx, ebx
mov esi, dword [ebp - 0xb98]
movzx eax, cl
cdq
mov dword [esi + edi], eax
mov dword [esi + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x412eae
mov esi, 0xc0000017
jmp 0x412fad
mov eax, dword [ebp - 0xbb8]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0x412ed1
mov esi, 0xc0000017
jmp 0x412f4c
mov dword [edi + 4], eax
push dword [ebp - 0xbb8]
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
pop esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0x412eca
mov dword [edi + 0xc], eax
push 0xa0
push 0x421660
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [edi + 0x10], esi
push esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x412eca
mov dword [edi + 0x14], ecx
mov eax, dword [0x421700]
mov esi, ebx
mov dword [ecx], eax
mov eax, dword [0x421704]
mov dword [ebp - 0xbfc], edi
mov edi, ebx
mov dword [ecx + 4], eax
test edi, edi
je 0x412fad
cmp dword [edi + 4], 0
je 0x412f6a
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x412f84
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x412f9e
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x412fc1
mov eax, dword [ebp - 0xbfc]
mov edi, ebx
mov dword [ebp - 0xb8c], eax
jmp 0x412fc7
mov edi, dword [ebp - 0xbfc]
mov eax, dword [ebp - 0xb98]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0x413044
cmp dword [edi + 4], 0
je 0x412ffa
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x413014
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x41302e
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0x413044
mov esi, 0xc0000001
or esi, 0x10000000
mov dword [ebp - 0xb84], esi
jl 0x413f19
mov edx, dword [ebp - 0xb8c]
mov eax, dword [edx]
mov esi, dword [edx + 0x10]
add eax, 4
mov ecx, dword [edx + 8]
cmp eax, 4
jb 0x413184
lea edx, [eax + 4]
cmp edx, eax
jb 0x413184
add ecx, edx
cmp ecx, edx
jb 0x413184
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x413184
lea ecx, [eax + esi]
mov dword [ebp - 0xbdc], ecx
cmp ecx, eax
jb 0x413184
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x4130c6
mov esi, 0xc0000017
mov edi, 0xc0000095
jmp 0x41318b
mov edx, dword [ebp - 0xb8c]
lea esi, [edi + 4]
mov eax, dword [edx]
mov dword [edi], eax
cmp esi, edi
jb 0x413163
push dword [edx]
push dword [edx + 4]
push esi
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0xb8c]
add esp, 0xc
mov ecx, dword [edx]
add ecx, esi
cmp ecx, esi
jb 0x413163
mov eax, dword [edx + 8]
lea esi, [ecx + 4]
mov dword [ecx], eax
cmp esi, ecx
jb 0x413163
push dword [edx + 8]
push dword [edx + 0xc]
push esi
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0xb8c]
add esp, 0xc
mov ecx, dword [edx + 8]
add ecx, esi
cmp ecx, esi
jb 0x413163
mov eax, dword [edx + 0x10]
lea esi, [ecx + 4]
mov dword [ecx], eax
cmp esi, ecx
jb 0x413163
push dword [edx + 0x10]
push dword [edx + 0x14]
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xb8c]
add esp, 0xc
mov eax, dword [eax + 0x10]
add eax, esi
cmp eax, esi
jb 0x413163
mov eax, dword [ebp - 0xbdc]
mov esi, ebx
mov dword [ebp - 0xbe8], edi
mov edi, ebx
mov dword [ebp - 0xba0], eax
jmp 0x413168
mov esi, 0xc0000095
test edi, edi
je 0x4130bc
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0x4130bc
mov edi, 0xc0000095
mov esi, edi
or esi, 0x10000000
mov dword [ebp - 0xb84], esi
jl 0x413f19
cmp dword [ebp - 0xc00], 0
jne 0x4131b0
mov esi, 0xc000000d
jmp 0x41325f
xor eax, eax
inc eax
cmp dword [ebp - 0xc08], eax
jbe 0x4131a6
mov ecx, dword [ebp - 0xc00]
mov edx, ebx
mov esi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x41325d
lea ecx, [esi + eax]
cmp ecx, eax
jb 0x41325d
xor eax, eax
inc edx
inc eax
cmp edx, eax
jb 0x4131c3
mov eax, dword [ecx]
mov dword [ebp - 0xbdc], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x41325d
cmp dword [ebp - 0xc08], 2
jbe 0x4131a6
mov ecx, dword [ebp - 0xc00]
mov edx, ebx
mov esi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x41325d
lea ecx, [esi + eax]
cmp ecx, eax
jb 0x41325d
inc edx
cmp edx, 2
jb 0x413203
mov edx, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x41325d
mov eax, dword [ebp - 0xbdc]
add eax, 0x50
cmp eax, 0x50
jb 0x41325d
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x41325d
lea eax, [ecx + edx]
cmp eax, ecx
jb 0x41325d
mov dword [ebp - 0xb90], eax
mov esi, ebx
mov dword [ebp - 0xb84], esi
cmp eax, 0x400000
jbe 0x413267
mov esi, 0x8000ffff
jmp 0x413f13
mov esi, edi
mov eax, ebx
mov dword [ebp - 0xb84], esi
test esi, esi
js 0x413f19
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0x41328c
mov esi, 0xd0000017
mov ecx, ebx
jmp 0x413299
mov ecx, eax
mov dword [ebp - 0xc10], ecx
mov esi, 0x10000000
mov dword [ebp - 0xb84], esi
test esi, esi
js 0x413f19
mov eax, dword [ebp - 0xbe8]
test eax, eax
jne 0x4132bb
mov esi, 0x80070057
jmp 0x413f13
test ecx, ecx
je 0x4132b1
mov dword [ebp - 0xd60], eax
mov eax, dword [ebp - 0xba0]
mov dword [ebp - 0xd58], eax
mov eax, dword [ebp - 0xb90]
mov dword [ebp - 0xd54], eax
lea eax, [ebp - 0xd34]
push eax
xor eax, eax
mov dword [ebp - 0xd5c], ecx
push 0x40183c
inc eax
mov dword [ebp - 0xd50], ebx
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0x41333b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0xb84], esi
test esi, esi
jle 0x413326
movzx esi, si
or esi, 0x80070000
mov dword [ebp - 0xb84], esi
test esi, esi
mov eax, dword [ebp - 0xb90]
js 0x41338f
mov esi, 0x80004005
mov dword [ebp - 0xb84], esi
jmp 0x41338f
push 0x404720
push dword [ebp - 0xd34]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x413303
push ebx
push 0x14
lea eax, [ebp - 0xd60]
mov ecx, esi
push eax
push 0x86
call dword [0x4234b4]
call esi
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xb84], esi
jl 0x413389
mov eax, dword [ebp - 0xd54]
mov dword [ebp - 0xb90], eax
jmp 0x41338f
mov eax, dword [ebp - 0xb90]
cmp esi, 0xd0000023
jne 0x4133a1
mov esi, 0x8007007a
jmp 0x413f13
test esi, esi
js 0x413f19
mov dword [ebp - 0xbfc], ebx
cmp eax, 4
jae 0x4133be
mov esi, 0xc000003e
jmp 0x4136f8
mov esi, dword [ebp - 0xc10]
mov ecx, dword [esi]
lea edx, [esi + 4]
mov dword [ebp - 0xbf0], ecx
cmp edx, esi
jb 0x4136f6
add eax, 0xfffffffc
cmp eax, ecx
jb 0x4133b4
lea esi, [ecx + edx]
cmp esi, edx
jb 0x4136f6
lea edx, [ecx + 4]
cmp edx, 4
jb 0x4136f6
mov eax, dword [ebp - 0xb90]
sub eax, edx
cmp eax, 4
jb 0x4133b4
mov eax, dword [ebp - 0xc10]
mov esi, dword [esi]
add eax, 4
add eax, ecx
push 0
pop ebx
lea edx, [eax + 4]
mov dword [ebp - 0xb98], edx
cmp edx, eax
lea edx, [ecx + 4]
jb 0x4136f6
lea eax, [edx + 4]
mov dword [ebp - 0xbdc], eax
cmp eax, edx
jb 0x4136f6
mov eax, dword [ebp - 0xb90]
mov edx, dword [ebp - 0xbdc]
sub eax, edx
cmp eax, esi
jb 0x4133b4
mov eax, dword [ebp - 0xb98]
add eax, esi
cmp eax, dword [ebp - 0xb98]
jb 0x4136f6
lea eax, [edx + esi]
mov dword [ebp - 0xbd4], eax
cmp eax, edx
jb 0x4136f6
mov eax, dword [ebp - 0xb90]
sub eax, dword [ebp - 0xbd4]
cmp eax, 4
jb 0x4133b4
mov eax, dword [ebp - 0xb98]
add eax, esi
mov edx, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xbe0], edx
mov dword [ebp - 0xbb8], ecx
cmp ecx, eax
jb 0x4136f6
mov eax, dword [ebp - 0xbd4]
add eax, 4
mov dword [ebp - 0xba0], eax
cmp eax, dword [ebp - 0xbd4]
jb 0x4136f6
mov eax, dword [ebp - 0xb90]
sub eax, dword [ebp - 0xba0]
cmp eax, edx
jb 0x4133b4
mov eax, dword [ebp - 0xba0]
lea ecx, [eax + edx]
mov dword [ebp - 0xbdc], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0xbf0]
jb 0x4136f6
mov edi, dword [ebp - 0xb90]
mov eax, edi
sub eax, dword [ebp - 0xbdc]
jne 0x4133b4
lea eax, [ecx + 0xc]
add eax, esi
add eax, edx
cmp eax, edi
jne 0x4133b4
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x413538
mov esi, 0xc0000017
jmp 0x413679
mov eax, dword [ebp - 0xc10]
add eax, 4
je 0x413589
mov eax, dword [ebp - 0xbf0]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x41356b
mov esi, 0xc0000017
jmp 0x413618
mov dword [edi + 4], ecx
mov edx, dword [ebp - 0xc10]
push dword [ebp - 0xbf0]
lea eax, [edx + 4]
push eax
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x41358e
mov dword [edi], ebx
mov dword [edi + 4], ebx
cmp dword [ebp - 0xb98], 0
je 0x4135c3
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0x413561
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xb98]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x4135c9
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
cmp dword [ebp - 0xbb8], 0
je 0x413608
mov esi, dword [ebp - 0xbe0]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0x413561
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xbb8]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x41360e
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [ebp - 0xbfc], edi
mov esi, ebx
mov edi, ebx
test edi, edi
je 0x413679
cmp dword [edi + 4], 0
je 0x413636
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x413650
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x41366a
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x41368d
mov eax, dword [ebp - 0xbfc]
mov edi, ebx
mov dword [ebp - 0xbcc], eax
jmp 0x413693
mov edi, dword [ebp - 0xbfc]
test edi, edi
je 0x4136f8
cmp dword [edi + 4], 0
je 0x4136b1
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x4136cb
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x4136e5
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0x4136f8
mov esi, edi
or esi, 0x10000000
mov dword [ebp - 0xb84], esi
jl 0x413f19
mov ecx, dword [ebp - 0xbcc]
mov edi, ebx
mov dword [ebp - 0xbc4], ebx
test ecx, ecx
jne 0x413726
mov esi, 0xd000000d
jmp 0x413f13
mov eax, dword [ecx + 4]
mov dword [ebp - 0xbf8], eax
test eax, eax
je 0x41371c
mov esi, dword [ecx]
test esi, esi
je 0x41371c
add esi, 0xfffffff8
push esi
push ebx
mov dword [ebp - 0xbd4], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xbe0], eax
test eax, eax
je 0x413d9e
mov ecx, 0xab69605e
mov dword [ebp - 0xb90], eax
mov dword [ebp - 0x3d0], ecx
mov edi, esi
mov ecx, 0x7f1137f
mov dl, bl
mov dword [ebp - 0x3cc], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xbf8]
mov dword [ebp - 0xbfc], ecx
mov ecx, ebx
and edi, 7
je 0x413d3b
or dword [ebp - 0xc20], 0xffffffff
mov dword [ebp - 0xc34], ebx
mov dword [ebp - 0xb84], ebx
mov dword [ebp - 0xb88], eax
mov dword [ebp - 0xba0], ecx
test edi, edi
je 0x41380e
mov ebx, dword [ebp - 0xbfc]
push 0x38
pop esi
movzx eax, byte [ebx]
inc ebx
cmp ecx, 4
jge 0x4137da
lea ecx, [esi - 0x20]
shl eax, cl
or dword [ebp - 0xb88], eax
jmp 0x4137e4
mov ecx, esi
shl eax, cl
or dword [ebp - 0xb84], eax
mov ecx, dword [ebp - 0xba0]
sub esi, 8
inc ecx
mov dword [ebp - 0xba0], ecx
cmp ecx, edi
jl 0x4137c4
mov eax, ebx
mov dword [ebp - 0xbfc], ebx
mov dword [ebp - 0xbfc], eax
xor ebx, ebx
mov eax, dword [ebp - 0xb88]
mov esi, dword [ebp - 0xb84]
xor eax, 0x92f65a5
xor esi, 0x699a899c
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xc34], eax
mov ecx, ebx
mov dword [ebp - 0xc20], esi
test edi, edi
je 0x4138a6
mov ebx, dword [ebp - 0xb90]
lea eax, [ebx + 1]
mov ebx, dword [ebp - 0xb90]
mov dword [ebp - 0xbb8], eax
mov eax, dword [ebp - 0xbc8]
cmp ecx, 4
jge 0x413868
rol eax, 8
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xba0], eax
jmp 0x413871
rol esi, 8
mov dword [ebp - 0xba0], esi
mov eax, dword [ebp - 0xba0]
inc ecx
mov byte [ebx], al
mov ebx, dword [ebp - 0xbb8]
mov dword [ebp - 0xb90], ebx
cmp ecx, edi
jl 0x41383d
mov esi, dword [ebp - 0xc20]
mov eax, ebx
mov dword [ebp - 0xb90], eax
xor ebx, ebx
mov eax, dword [ebp - 0xc34]
mov dword [ebp - 0xbc8], eax
cmp edi, 4
jbe 0x413d0a
push 8
pop ecx
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0xbf0], esi
mov dword [ebp - 0xc20], esi
mov esi, dword [ebp - 0xbd4]
mov eax, esi
shr eax, 3
mov dword [ebp - 0xbb8], eax
test eax, eax
je 0x413cd3
movzx ecx, word [ebp - 0x3ca]
mov eax, 0x7f1137f
movzx esi, word [ebp - 0x3ce]
mov edi, dword [ebp - 0xbfc]
mov ebx, dword [ebp - 0xbc8]
movzx eax, ax
mov dword [ebp - 0xbc0], eax
mov dword [ebp - 0xb98], ecx
mov ecx, 0xab69605e
movzx eax, cx
mov dword [ebp - 0xb94], eax
mov eax, dword [ebp - 0xb90]
add eax, 7
mov dword [ebp - 0xbbc], esi
mov esi, dword [ebp - 0xbf0]
add edi, 2
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0xb90], edi
movzx ecx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ecx, 8
or ecx, eax
shl edi, 8
mov eax, dword [ebp - 0xb90]
xor ebx, ecx
mov dword [ebp - 0xbdc], ecx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb90]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb90]
shl edi, 8
add dword [ebp - 0xb90], 8
movzx eax, byte [eax + 5]
or edi, eax
mov eax, 0x7f1137f
xor esi, edi
xor esi, ebx
xor esi, 0xab69605e
xor esi, eax
mov ecx, esi
mov eax, esi
sub ecx, 0xab69605e
rol eax, 0xa
rol ecx, 5
imul ecx, dword [ebp - 0xbc0]
add ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea ecx, [ecx + ebx]
ror ecx, 9
imul ecx, dword [ebp - 0xbbc]
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
sub ecx, dword [ebp - 0xbc0]
imul ecx, dword [ebp - 0xb94]
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xbbc]
xor ecx, ebx
mov eax, ebx
rol ecx, 6
imul ecx, dword [ebp - 0xb98]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, 0xab69605e
xor ecx, esi
sub eax, ecx
xor ebx, eax
mov eax, dword [ebp - 0xbc0]
xor eax, ebx
mov ecx, ebx
imul eax, dword [ebp - 0xbbc]
ror ecx, 6
xor ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov eax, esi
rol eax, 2
lea ecx, [ecx + esi]
ror ecx, 0xf
imul ecx, dword [ebp - 0xb94]
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0xb98]
sub ecx, eax
xor esi, ecx
mov ecx, 0xab69605e
xor ecx, esi
mov eax, esi
ror ecx, 0xc
imul ecx, dword [ebp - 0xbc0]
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xb98]
xor ecx, ebx
mov eax, ebx
imul ecx, dword [ebp - 0xbbc]
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov ecx, dword [ebp - 0xb98]
mov eax, esi
mov dword [ebp - 0xbf0], esi
not eax
ror eax, 5
add eax, dword [ebp - 0xb94]
imul eax, dword [ebp - 0xb98]
xor ebx, eax
mov esi, ebx
sub esi, dword [ebp - 0xb98]
xor esi, dword [ebp - 0xbf0]
xor esi, 0xab69605e
xor ecx, esi
mov eax, esi
rol ecx, 2
imul ecx, dword [ebp - 0xbc0]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 6
imul ecx, dword [ebp - 0xbbc]
rol eax, 7
add ecx, eax
mov eax, dword [ebp - 0xbc0]
xor esi, ecx
xor eax, esi
mov ecx, esi
imul eax, dword [ebp - 0xb94]
ror ecx, 9
add ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xbbc]
xor ecx, ebx
mov dword [ebp - 0xbc8], ebx
rol ecx, 5
mov eax, ebx
imul ecx, dword [ebp - 0xb98]
rol eax, 7
add ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ebx, esi
xor ebx, dword [ebp - 0xbc8]
xor ebx, eax
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xbbc]
imul eax, dword [ebp - 0xbc0]
xor esi, eax
mov eax, 0x7f1137f
mov ecx, esi
sub ecx, eax
ror ecx, 1
mov eax, esi
imul ecx, dword [ebp - 0xb94]
ror eax, 6
sub ecx, eax
xor ebx, ecx
mov ecx, 0xab69605e
mov eax, ebx
rol eax, 0xe
lea ecx, [ebx + ecx]
rol ecx, 3
imul ecx, dword [ebp - 0xb98]
add ecx, eax
xor esi, ecx
mov ecx, 0xab69605e
mov eax, esi
ror eax, 0xe
lea ecx, [esi + ecx]
rol ecx, 0xf
imul ecx, dword [ebp - 0xbc0]
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xb94]
imul ecx, dword [ebp - 0xbbc]
shr eax, 3
xor ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, eax
mov eax, esi
xor esi, dword [ebp - 0xb84]
rol ecx, 4
imul ecx, dword [ebp - 0xb94]
rol eax, 2
mov dword [ebp - 0xc20], esi
mov dword [ebp - 0xb84], edi
mov edi, dword [ebp - 0xb90]
xor ecx, eax
xor ecx, dword [ebp - 0xb88]
xor ebx, ecx
mov ecx, dword [ebp - 0xba0]
mov dword [ebp - 0xc34], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xc20]
ror dword [ebp - 0xc34], 8
mov byte [ecx], al
mov al, byte [ebp - 0xc34]
ror dword [ebp - 0xc20], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xc20]
ror dword [ebp - 0xc34], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xc34]
ror dword [ebp - 0xc20], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xc20]
ror dword [ebp - 0xc34], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xc20], 8
mov al, byte [ebp - 0xc34]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xc20]
mov byte [ecx - 3], al
add ecx, 8
mov ebx, dword [ebp - 0xc34]
mov esi, dword [ebp - 0xc20]
mov eax, dword [ebp - 0xbdc]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xbb8], 1
mov dword [ebp - 0xc34], ebx
mov dword [ebp - 0xc20], esi
mov dword [ebp - 0xb88], eax
mov dword [ebp - 0xba0], ecx
jne 0x413940
mov esi, dword [ebp - 0xbd4]
xor ebx, ebx
mov ecx, dword [ebp - 0xbe0]
mov eax, ebx
test esi, esi
je 0x413ce7
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0x413cdf
mov edi, dword [ebp - 0xbf8]
movzx eax, dl
cdq
cmp eax, dword [esi + edi]
jne 0x413d65
cmp edx, dword [esi + edi + 4]
jne 0x413d65
mov edi, ecx
mov dword [ebp - 0xbc4], esi
mov ecx, ebx
mov esi, ebx
jmp 0x413d6c
mov ecx, ebx
mov dword [ebp - 0xbf0], ecx
mov dword [ebp - 0xc20], ecx
jae 0x4138c7
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xc34], eax
jmp 0x4138c7
or dword [ebp - 0xb84], 0xffffffff
mov dword [ebp - 0xb88], ebx
mov dword [ebp - 0xbf0], ecx
mov dword [ebp - 0xc20], ecx
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xc34], eax
jmp 0x4138cd
mov esi, 0xc004d501
mov edi, ebx
test ecx, ecx
je 0x413d7f
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x413d9e
mov eax, dword [ebp - 0xbc4]
mov esi, 0x10000000
mov dword [ebp - 0xba4], edi
mov edi, ebx
mov dword [ebp - 0xbe4], eax
jmp 0x413da3
mov esi, 0xd0000001
mov dword [ebp - 0xb84], esi
test edi, edi
je 0x413dbc
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x413f19
mov edx, dword [ebp - 0xbe4]
cmp edx, 4
jae 0x413dd9
mov esi, 0xc000003e
jmp 0x413f0d
mov esi, dword [ebp - 0xba4]
mov eax, dword [esi]
lea ecx, [esi + 4]
mov dword [ebp - 0xbdc], eax
cmp ecx, esi
jb 0x413f08
lea eax, [edx - 4]
cmp eax, 4
jb 0x413dcf
mov edi, dword [ecx]
lea esi, [ecx + 4]
cmp esi, ecx
jb 0x413f08
mov ecx, dword [ebp - 0xbe4]
lea eax, [ecx - 8]
cmp eax, edi
jb 0x413dcf
lea eax, [edi + 8]
cmp eax, 8
jb 0x413f08
mov eax, dword [ebp - 0xba4]
lea edx, [esi + edi]
add eax, ecx
cmp eax, edx
jb 0x413dcf
sub ecx, esi
sub ecx, edi
add ecx, dword [ebp - 0xba4]
cmp ecx, 8
jae 0x413dcf
mov dword [ebp - 0xbe4], ebx
mov eax, ebx
mov dword [ebp - 0xba0], eax
test esi, esi
je 0x413e95
mov ecx, esi
cmp edx, esi
jb 0x413f08
jbe 0x413e91
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x413f08
cmp eax, edx
ja 0x413eba
mov eax, dword [ecx]
add eax, 4
cmp eax, 4
jb 0x413ec1
add eax, ecx
cmp eax, ecx
jb 0x413f08
mov ecx, eax
cmp ecx, edx
ja 0x413eba
inc dword [ebp - 0xbe4]
cmp ecx, edx
jb 0x413e5c
mov eax, ebx
cmp ecx, edx
jne 0x413eba
test edi, edi
je 0x413ec8
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xba0], eax
test eax, eax
jne 0x413ec8
mov esi, 0xc0000017
jmp 0x413ef1
mov esi, 0xc000000d
jmp 0x413f0d
mov esi, 0xc0000095
jmp 0x413ef1
test esi, esi
je 0x413edd
push edi
push esi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xba0]
add esp, 0xc
mov dword [ebp - 0xc94], eax
mov eax, dword [ebp - 0xbe4]
mov dword [ebp - 0xc9c], eax
mov esi, ebx
test esi, esi
js 0x413f0d
mov eax, dword [ebp - 0xbdc]
cmp eax, dword [ebp - 0xc9c]
je 0x413f0d
jmp 0x413dcf
mov esi, 0xc0000095
or esi, 0x10000000
mov dword [ebp - 0xb84], esi
mov eax, dword [ebp - 0xbec]
test eax, eax
je 0x413f32
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xb8c]
test edi, edi
je 0x413f99
cmp dword [edi + 4], 0
je 0x413f56
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x413f70
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x413f8a
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbe8]
test eax, eax
je 0x413fb2
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xc10]
test eax, eax
je 0x413fcb
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xbcc]
test edi, edi
je 0x414032
cmp dword [edi + 4], 0
je 0x413fef
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x414009
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x414023
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xba4]
test eax, eax
je 0x41404b
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x4144bf
xor eax, eax
inc eax
cmp dword [ebp - 0xc9c], eax
jae 0x414068
mov esi, 0xc004d501
jmp 0x4144b9
cmp dword [ebp - 0xc94], 0
jne 0x4140d0
mov esi, 0xc000000d
mov dword [ebp - 0xb84], esi
mov eax, ebx
test esi, esi
js 0x4144bf
cmp eax, 0xd0000023
jne 0x414098
mov eax, 0x8007007a
mov dword [ebp - 0xbb4], eax
cmp eax, 0x8007007a
je 0x4140af
mov esi, eax
mov dword [ebp - 0xb84], esi
test eax, eax
js 0x4144bf
cmp dword [ebp - 0xc9c], 6
jne 0x41405e
cmp dword [ebp - 0xc94], 0
jne 0x414132
mov esi, 0xc000000d
mov edi, 0xc0000095
jmp 0x4141d0
cmp dword [ebp - 0xc9c], 0
jbe 0x414071
mov eax, dword [ebp - 0xc94]
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x4140ec
mov esi, ebx
jmp 0x4140f4
or ecx, 0xffffffff
mov esi, 0xc0000095
mov dword [ebp - 0xb84], esi
test esi, esi
js 0x414108
mov eax, edx
neg eax
sbb eax, eax
and eax, ecx
jmp 0x414114
mov edx, dword [ebp - 0xdac]
mov eax, dword [ebp - 0xd98]
test esi, esi
js 0x41407c
cmp edx, 4
jne 0x412339
mov eax, dword [eax]
mov dword [ebp - 0xbb4], eax
jmp 0x41407e
mov eax, dword [ebp - 0xc94]
mov edx, ebx
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x4141c9
lea eax, [esi + ecx]
cmp eax, ecx
jb 0x4141c9
inc edx
cmp edx, 1
jb 0x41413a
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [ebp - 0xbb8], ecx
cmp edx, eax
jb 0x41416b
mov dword [ebp - 0xba0], edx
jmp 0x414172
or dword [ebp - 0xba0], 0xffffffff
cmp edx, eax
mov edi, 0xc0000095
sbb esi, esi
and esi, edi
mov dword [ebp - 0xb84], esi
cmp edx, eax
jb 0x414193
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0xba0]
jmp 0x4141a5
mov ecx, dword [ebp - 0xd8c]
mov dword [ebp - 0xbb8], ecx
mov ecx, dword [ebp - 0xd88]
cmp edx, eax
jb 0x4141d6
cmp dword [ebp - 0xbb8], 8
jne 0x412339
mov eax, dword [ecx]
mov dword [ebp - 0xd28], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0xd24], eax
jmp 0x4141d6
mov edi, 0xc0000095
mov esi, edi
mov dword [ebp - 0xb84], esi
test esi, esi
js 0x4144bf
cmp dword [ebp - 0xc94], 0
jne 0x4141f1
mov esi, 0xc000000d
jmp 0x414272
mov eax, dword [ebp - 0xc94]
mov edx, ebx
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x414270
lea eax, [esi + ecx]
cmp eax, ecx
jb 0x414270
inc edx
cmp edx, 2
jb 0x4141f9
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [ebp - 0xbb8], ecx
cmp edx, eax
jb 0x414226
mov dword [ebp - 0xba0], edx
jmp 0x41422d
or dword [ebp - 0xba0], 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, edi
mov dword [ebp - 0xb84], esi
cmp edx, eax
jb 0x414249
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0xba0]
jmp 0x41425b
mov ecx, dword [ebp - 0xd78]
mov dword [ebp - 0xbb8], ecx
mov ecx, dword [ebp - 0xd94]
cmp edx, eax
jb 0x414278
cmp dword [ebp - 0xbb8], 4
jne 0x412339
mov eax, dword [ecx]
jmp 0x41427e
mov esi, edi
mov dword [ebp - 0xb84], esi
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0xb8c], eax
test esi, esi
js 0x4144bf
cmp dword [ebp - 0xc94], 0
jne 0x41429f
mov esi, 0xc000000d
jmp 0x4144b9
mov eax, dword [ebp - 0xc94]
mov edx, ebx
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x412383
lea eax, [ecx + esi]
cmp eax, ecx
jb 0x412383
inc edx
cmp edx, 3
jb 0x4142a7
mov edx, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xbe0], edx
cmp ecx, eax
jb 0x4142dc
mov dword [ebp - 0xba0], ecx
jmp 0x4142e3
or dword [ebp - 0xba0], 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, edi
mov dword [ebp - 0xb84], esi
cmp ecx, eax
jb 0x4142ff
neg edx
sbb edx, edx
and edx, dword [ebp - 0xba0]
jmp 0x414311
mov edx, dword [ebp - 0xd90]
mov dword [ebp - 0xbe0], edx
mov edx, dword [ebp - 0xd84]
mov dword [ebp - 0xbf8], edx
cmp ecx, eax
jb 0x4144bf
mov eax, dword [ebp - 0xc94]
mov edx, ebx
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x4143a4
lea eax, [esi + ecx]
cmp eax, ecx
jb 0x4143a4
inc edx
cmp edx, 4
jb 0x414327
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [ebp - 0xbb8], ecx
cmp edx, eax
jb 0x414354
mov dword [ebp - 0xba0], edx
jmp 0x41435b
or dword [ebp - 0xba0], 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, edi
mov dword [ebp - 0xb84], esi
cmp edx, eax
jb 0x414377
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0xba0]
jmp 0x414389
mov ecx, dword [ebp - 0xd80]
mov dword [ebp - 0xbb8], ecx
mov ecx, dword [ebp - 0xd7c]
cmp edx, eax
jb 0x4143ac
cmp dword [ebp - 0xbb8], 4
jne 0x412339
mov eax, dword [ecx]
mov dword [ebp - 0xd38], eax
jmp 0x4143ac
mov esi, edi
mov dword [ebp - 0xb84], esi
test esi, esi
js 0x4144bf
mov eax, dword [ebp - 0xc94]
mov edx, ebx
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x414425
lea eax, [esi + ecx]
cmp eax, ecx
jb 0x414425
inc edx
cmp edx, 5
jb 0x4143bc
lea edx, [eax + 4]
cmp edx, eax
jb 0x4143e1
mov dword [ebp - 0xba0], edx
jmp 0x4143e8
or dword [ebp - 0xba0], 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, edi
mov dword [ebp - 0xb84], esi
cmp edx, eax
jb 0x414408
mov ecx, dword [eax]
mov edi, dword [eax]
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0xba0]
jmp 0x414414
mov edi, dword [ebp - 0xda0]
mov ecx, dword [ebp - 0xda8]
cmp edx, eax
jb 0x41442d
cmp edi, 4
jne 0x412339
mov ecx, dword [ecx]
jmp 0x41442f
mov esi, edi
mov dword [ebp - 0xb84], esi
mov ecx, ebx
test esi, esi
js 0x4144bf
mov eax, dword [ebp - 0xbd8]
cmp eax, dword [ebp - 0xd28]
jne 0x41405e
mov eax, dword [ebp - 0xbd0]
cmp eax, dword [ebp - 0xd24]
jne 0x41405e
cmp dword [ebp - 0xd38], 4
mov dword [ebp - 0xbac], ecx
jbe 0x41447d
mov eax, dword [ebp - 0xb8c]
mov esi, 0x8007007a
mov dword [ebp - 0xca0], eax
jmp 0x4144b9
mov eax, dword [ebp - 0xbe0]
cmp eax, 4
ja 0x41446a
push eax
push dword [ebp - 0xbf8]
push dword [ebp - 0xba8]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xb8c]
add esp, 0xc
mov dword [ebp - 0xca0], eax
test esi, esi
js 0x4144bf
mov eax, dword [ebp - 0xbb4]
test eax, eax
je 0x4144bf
mov esi, eax
mov dword [ebp - 0xb84], esi
cmp dword [ebp - 0xc00], 0
mov dword [ebp - 0xc04], ebx
mov dword [ebp - 0xc08], ebx
je 0x4144ee
push dword [ebp - 0xc00]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xc00], ebx
mov eax, dword [ebp - 0xc94]
mov dword [ebp - 0xc98], ebx
mov dword [ebp - 0xc9c], ebx
test eax, eax
je 0x414519
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xc94], ebx
mov eax, dword [ebp - 0xbb0]
test eax, eax
je 0x414532
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb9c]
test eax, eax
je 0x41454b
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x41209e
mov eax, dword [ebp - 0xbac]
test eax, eax
je 0x41abcb
mov dword [0x4227b0], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x308]
mov dword [ebp - 0xd08], ebx
push eax
push 0x400000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0x4190c3
cmp eax, esi
jne 0x41459f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0x4190c3
mov esi, dword [0x42107c]
mov ecx, esi
push 0x403
push ebx
push ebx
call dword [0x4234b4]
call esi
mov dword [ebp - 0xbc0], eax
test eax, eax
jne 0x4145cb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x4190c3
mov esi, dword [0x42104c]
mov ecx, esi
call dword [0x4234b4]
call esi
mov dword [0x422ca8], eax
mov eax, dword [0x4227b0]
push 0x54
mov dword [ebp - 0xbd4], eax
lea eax, [ebp - 0x858]
push ebx
push eax
mov dword [0x422cac], edx
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0xd18], ebx
lea edi, [ebp - 0x3a0]
mov dword [ebp - 0xd14], ebx
stosd dword es:[edi], eax
add esp, 0xc
mov dword [ebp - 0xbc8], ebx
mov dword [ebp - 0xbdc], ebx
stosd dword es:[edi], eax
push 0x2c
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x508]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xbc4], ebx
xor ebx, ebx
mov edx, 0x422cb8
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x414646
mov eax, dword [0x422cb4]
push 0
pop ebx
test eax, eax
jne 0x414d16
push 0x338
push ebx
mov dword [ebp - 0xbcc], ebx
mov dword [ebp - 0xb98], ebx
mov dword [ebp - 0xbb8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xba8], edi
test edi, edi
je 0x414cb5
or dword [ebp - 0xbb0], 0xffffffff
mov eax, 0xab69605e
mov dword [ebp - 0x3c8], eax
add edi, 7
movzx esi, word [ebp - 0x3c6]
mov eax, 0x7f1137f
mov dword [ebp - 0x3c4], eax
mov cl, bl
movzx edx, word [ebp - 0x3c2]
mov eax, ebx
mov dword [ebp - 0xb88], eax
mov dword [ebp - 0xc54], eax
mov dword [ebp - 0xb90], eax
mov dword [ebp - 0xc68], eax
mov eax, 0x7f1137f
mov dword [ebp - 0xbb4], edi
mov edi, 0x40274a
movzx eax, ax
mov dword [ebp - 0xb8c], edx
mov edx, ebx
mov dword [ebp - 0xb94], esi
mov esi, ebx
mov dword [ebp - 0xb9c], ebx
mov dword [ebp - 0xbbc], eax
mov dword [ebp - 0xbac], edi
mov dword [ebp - 0xba0], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xbac]
xor edx, ebx
mov dword [ebp - 0xb90], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xbac]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xbac]
shl edi, 8
add dword [ebp - 0xbac], 8
movzx eax, byte [eax + 5]
or edi, eax
mov eax, 0x7f1137f
xor esi, edi
xor esi, edx
xor esi, eax
xor esi, 0xab69605e
mov eax, esi
mov dword [ebp - 0xb88], esi
rol eax, 0xa
lea edx, [esi + 0x54969fa2]
mov esi, dword [ebp - 0xb90]
rol edx, 5
imul edx, dword [ebp - 0xbbc]
add edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov eax, esi
rol eax, 2
lea edx, [edx + esi]
ror edx, 9
imul edx, dword [ebp - 0xb94]
sub edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov dword [ebp - 0xb88], eax
sub eax, dword [ebp - 0xbbc]
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb88]
shr eax, 0xd
sub edx, eax
xor esi, edx
mov edx, esi
mov eax, esi
xor edx, dword [ebp - 0xb94]
rol edx, 6
imul edx, dword [ebp - 0xb8c]
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb88], eax
xor edx, 0xab69605e
mov eax, 0x7f1137f
sub eax, edx
xor esi, eax
mov eax, dword [ebp - 0xbbc]
xor eax, esi
mov edx, esi
imul eax, dword [ebp - 0xb94]
ror edx, 6
xor edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xb88], eax
add eax, edx
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb88]
rol eax, 2
add edx, eax
xor esi, edx
mov eax, esi
rol eax, 8
lea edx, [esi + 0x54969fa2]
ror edx, 0xe
imul edx, dword [ebp - 0xb8c]
sub edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb88], eax
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, dword [ebp - 0xbbc]
xor edx, eax
xor esi, edx
mov edx, esi
mov eax, esi
xor edx, dword [ebp - 0xb8c]
imul edx, dword [ebp - 0xb94]
shr eax, 0xa
xor edx, eax
xor edx, dword [ebp - 0xb88]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xb8c]
xor esi, eax
mov dword [ebp - 0xb90], esi
sub esi, dword [ebp - 0xb8c]
xor esi, edx
xor esi, 0xab69605e
mov edx, esi
mov eax, esi
xor edx, dword [ebp - 0xb8c]
rol edx, 2
imul edx, dword [ebp - 0xbbc]
shr eax, 2
add edx, eax
mov eax, dword [ebp - 0xb90]
xor eax, edx
mov dword [ebp - 0xb90], eax
lea edx, [eax - 0x7f1137f]
rol eax, 7
ror edx, 6
imul edx, dword [ebp - 0xb94]
add edx, eax
mov eax, dword [ebp - 0xbbc]
xor esi, edx
xor eax, esi
mov edx, esi
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
mov eax, dword [ebp - 0xb90]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb90], eax
xor edx, dword [ebp - 0xb94]
rol edx, 5
imul edx, dword [ebp - 0xb8c]
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xb90]
xor esi, edx
mov edx, 0x7f1137f
xor eax, esi
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0xb90], eax
ror eax, 3
sub eax, dword [ebp - 0xb94]
imul eax, dword [ebp - 0xbbc]
xor esi, eax
mov eax, esi
sub eax, edx
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
mov eax, dword [ebp - 0xb90]
xor eax, edx
mov dword [ebp - 0xb90], eax
lea edx, [eax - 0x54969fa2]
rol eax, 0xe
rol edx, 3
imul edx, dword [ebp - 0xb8c]
add edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xbbc]
sub edx, eax
mov eax, dword [ebp - 0xb90]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb90], eax
shr eax, 3
xor edx, 0x605e
imul edx, dword [ebp - 0xb94]
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
xor eax, esi
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xbb0]
rol eax, 2
mov dword [ebp - 0xc54], esi
mov dword [ebp - 0xbb0], edi
xor edx, eax
mov edi, dword [ebp - 0xbac]
xor edx, dword [ebp - 0xb9c]
mov eax, dword [ebp - 0xb90]
xor eax, edx
mov dword [ebp - 0xb9c], ebx
mov edx, dword [ebp - 0xbb4]
mov dword [ebp - 0xc68], eax
add dword [ebp - 0xbb4], 8
mov byte [edx - 4], al
mov al, byte [ebp - 0xc54]
ror dword [ebp - 0xc68], 8
mov byte [edx], al
ror dword [ebp - 0xc54], 8
mov al, byte [ebp - 0xc68]
mov byte [edx - 5], al
mov al, byte [ebp - 0xc54]
ror dword [ebp - 0xc68], 8
mov byte [edx - 1], al
ror dword [ebp - 0xc54], 8
mov al, byte [ebp - 0xc68]
mov byte [edx - 6], al
ror dword [ebp - 0xc68], 8
mov al, byte [ebp - 0xc54]
mov byte [edx - 2], al
ror dword [ebp - 0xc54], 8
mov al, byte [ebp - 0xc68]
mov byte [edx - 7], al
mov al, byte [ebp - 0xc54]
mov byte [edx - 3], al
mov edx, dword [ebp - 0xc68]
mov esi, dword [ebp - 0xc54]
ror edx, 8
ror esi, 8
sub dword [ebp - 0xba0], 1
mov dword [ebp - 0xc68], edx
mov dword [ebp - 0xc54], esi
jne 0x414721
mov esi, dword [ebp - 0xba8]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x414b00
movzx eax, cl
cdq
cmp eax, dword [0x402a80]
jne 0x414b2e
cmp edx, dword [0x402a84]
jne 0x414b2e
mov dword [ebp - 0xb98], esi
mov edi, 0x337
mov esi, ebx
jmp 0x414b3b
mov dword [ebp - 0xbb8], 0xc004d501
or edi, 0xffffffff
test esi, esi
je 0x414b4e
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xbb8], ebx
jl 0x414cb5
mov eax, dword [ebp - 0xb98]
mov esi, eax
push 0x40
push ebx
push 0x4227c0
mov byte [edi + eax], bl
call sub.msvcrt.dll_memset
mov eax, esi
add esp, 0xc
cmp byte [eax], bl
je 0x414cbc
mov edi, 0x4227c0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xba8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x414b91
sub ecx, dword [ebp - 0xba8]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0x414cb5
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xb94], ecx
cmp word [eax], dx
je 0x414bd9
mov ecx, 0xc000007b
mov dword [ebp - 0xb94], ecx
jmp 0x414c21
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x414bcc
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x414bcc
cmp dword [edx], 0x4550
jne 0x414bcc
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc7c]
je 0x414c0f
cmp ax, word [ebp - 0xc18]
je 0x414c0f
mov ecx, 0xc000000d
jmp 0x414bd1
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0xb9c], ebx
test eax, eax
je 0x414c9c
mov edx, esi
mov dword [ebp - 0xbb0], esi
lea eax, [edx + 1]
mov dword [ebp - 0xba8], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x414c48
sub edx, dword [ebp - 0xba8]
inc esi
add esi, edx
test ecx, ecx
js 0x414c81
push dword [ebp - 0xbb0]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0x414ca7
mov ecx, dword [ebp - 0xbcc]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xb94]
mov eax, dword [ebp - 0xb9c]
inc dword [ebp - 0xbcc]
inc eax
mov dword [ebp - 0xb9c], eax
cmp eax, dword [ebp - 0xba0]
jb 0x414c37
add edi, 0x10
cmp byte [esi], bl
jne 0x414b84
mov esi, dword [ebp - 0xb94]
mov eax, dword [ebp - 0xb98]
jmp 0x414cbe
mov esi, 0xc000007a
jmp 0x414cad
mov esi, ebx
test eax, eax
je 0x414cd1
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0x414d11
mov esi, ebx
mov eax, dword [esi + 0x4227c0]
test eax, eax
je 0x414ce8
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x414cd7
push 0x40
push ebx
push 0x4227c0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x401060
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x414d1c
mov eax, dword [0x422cb4]
inc eax
mov dword [0x422cb4], eax
xor eax, eax
mov edx, 0x422cb8
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0xc], ebx
lea edi, [ebp - 0xcf8]
mov word [ebp - 8], bx
stosd dword es:[edi], eax
mov dword [ebp - 0xbd0], ebx
mov dword [ebp - 0xbd8], ebx
mov dword [ebp - 0xcb8], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x458]
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x414d57
mov eax, dword [0x422cb4]
push 0
pop ebx
test eax, eax
jne 0x4153a1
push 0x338
push ebx
mov dword [ebp - 0xbb4], ebx
mov dword [ebp - 0xb8c], ebx
mov dword [ebp - 0xbf8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xbe4], edi
test edi, edi
je 0x415340
or dword [ebp - 0xba0], 0xffffffff
mov eax, 0xab69605e
mov dword [ebp - 0x3e8], eax
add edi, 7
movzx esi, word [ebp - 0x3e6]
mov eax, 0x7f1137f
mov dword [ebp - 0x3e4], eax
mov cl, bl
movzx edx, word [ebp - 0x3e2]
mov eax, ebx
mov dword [ebp - 0xba4], eax
mov dword [ebp - 0xc6c], eax
mov eax, 0x7f1137f
movzx eax, ax
mov dword [ebp - 0xb94], esi
mov esi, ebx
mov dword [ebp - 0xbb8], edi
mov edi, 0x40274a
mov dword [ebp - 0xbb0], ebx
mov dword [ebp - 0xc44], ebx
mov dword [ebp - 0xb9c], eax
mov dword [ebp - 0xbac], edx
mov dword [ebp - 0xbe0], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
movzx edx, byte [edi + 2]
shl edx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 3]
or edx, eax
mov dword [ebp - 0xba8], ebx
movzx eax, byte [edi + 4]
xor esi, ebx
shl edx, 8
mov ebx, esi
or edx, eax
mov dword [ebp - 0xba4], esi
movzx eax, byte [edi + 5]
add edi, 8
shl edx, 8
or edx, eax
mov esi, dword [ebp - 0xb9c]
mov dword [ebp - 0xbcc], edx
mov eax, 0x7f1137f
mov dword [ebp - 0xbe8], edi
mov edi, edx
xor edi, dword [ebp - 0xc44]
xor edi, ebx
xor edi, eax
xor edi, 0xab69605e
mov eax, edi
rol eax, 0xa
lea edx, [edi + 0x54969fa2]
rol edx, 5
imul edx, esi
add edx, eax
xor ebx, edx
mov edx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [ebp - 0xb94]
sub edx, eax
xor edi, edx
mov eax, edi
sub eax, esi
imul edx, eax, 0x605e
mov eax, edi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb94]
xor edx, ebx
mov eax, ebx
rol edx, 6
imul edx, dword [ebp - 0xbac]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor edi, edx
mov edx, edi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, esi
xor eax, ebx
mov edx, ebx
imul eax, dword [ebp - 0xb94]
ror edx, 6
xor edx, eax
mov eax, 0x7f1137f
xor edi, edx
add eax, edi
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, edi
rol eax, 2
add edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 8
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
imul edx, dword [ebp - 0xbac]
sub edx, eax
xor edi, edx
mov edx, edi
mov eax, edi
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, esi
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xbac]
xor edx, ebx
mov eax, ebx
imul edx, dword [ebp - 0xb94]
shr eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xbac]
xor ebx, eax
mov esi, ebx
sub esi, dword [ebp - 0xbac]
xor esi, edi
mov edi, dword [ebp - 0xb9c]
xor esi, 0xab69605e
mov edx, esi
mov eax, esi
xor edx, dword [ebp - 0xbac]
rol edx, 2
imul edx, edi
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, eax
mov eax, ebx
ror edx, 6
imul edx, dword [ebp - 0xb94]
rol eax, 7
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, edi
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor ebx, edx
mov edx, ebx
mov dword [ebp - 0xba4], ebx
xor edx, dword [ebp - 0xb94]
mov eax, ebx
rol edx, 5
imul edx, dword [ebp - 0xbac]
rol eax, 7
add edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov ebx, esi
xor ebx, dword [ebp - 0xba4]
xor ebx, edx
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xb94]
imul eax, edi
xor esi, eax
mov eax, esi
sub eax, edx
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [ebp - 0xbac]
add edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, edi
mov edi, dword [ebp - 0xbe8]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
shr eax, 3
xor edx, 0x605e
imul edx, dword [ebp - 0xb94]
xor edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov eax, esi
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xba0]
rol eax, 2
mov dword [ebp - 0xc44], esi
xor edx, eax
xor edx, dword [ebp - 0xbb0]
xor ebx, edx
mov edx, dword [ebp - 0xbb8]
mov dword [ebp - 0xc6c], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xc44]
ror dword [ebp - 0xc6c], 8
mov byte [edx], al
mov al, byte [ebp - 0xc6c]
ror dword [ebp - 0xc44], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xc44]
ror dword [ebp - 0xc6c], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xc6c]
ror dword [ebp - 0xc44], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xc44]
ror dword [ebp - 0xc6c], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xc6c]
ror dword [ebp - 0xc44], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xc44]
mov byte [edx - 3], al
add edx, 8
mov esi, dword [ebp - 0xc6c]
mov eax, dword [ebp - 0xba8]
ror dword [ebp - 0xc44], 8
ror esi, 8
sub dword [ebp - 0xbe0], 1
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp - 0xbcc]
mov dword [ebp - 0xc6c], esi
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0xbb8], edx
jne 0x414e24
mov esi, dword [ebp - 0xbe4]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x41518b
movzx eax, cl
cdq
cmp eax, dword [0x402a80]
jne 0x4151b9
cmp edx, dword [0x402a84]
jne 0x4151b9
mov dword [ebp - 0xb8c], esi
mov edi, 0x337
mov esi, ebx
jmp 0x4151c6
mov dword [ebp - 0xbf8], 0xc004d501
or edi, 0xffffffff
test esi, esi
je 0x4151d9
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xbf8], ebx
jl 0x415340
mov eax, dword [ebp - 0xb8c]
mov esi, eax
push 0x40
push ebx
push 0x4227c0
mov byte [edi + eax], bl
call sub.msvcrt.dll_memset
mov eax, esi
add esp, 0xc
cmp byte [eax], bl
je 0x415347
mov edi, 0x4227c0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xba8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41521c
sub ecx, dword [ebp - 0xba8]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0x415340
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xb94], ecx
cmp word [eax], dx
je 0x415264
mov ecx, 0xc000007b
mov dword [ebp - 0xb94], ecx
jmp 0x4152ac
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x415257
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x415257
cmp dword [edx], 0x4550
jne 0x415257
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc7c]
je 0x41529a
cmp ax, word [ebp - 0xc18]
je 0x41529a
mov ecx, 0xc000000d
jmp 0x41525c
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0xb9c], ebx
test eax, eax
je 0x415327
mov edx, esi
mov dword [ebp - 0xbb0], esi
lea eax, [edx + 1]
mov dword [ebp - 0xba8], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x4152d3
sub edx, dword [ebp - 0xba8]
inc esi
add esi, edx
test ecx, ecx
js 0x41530c
push dword [ebp - 0xbb0]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0x415332
mov ecx, dword [ebp - 0xbb4]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xb94]
mov eax, dword [ebp - 0xb9c]
inc dword [ebp - 0xbb4]
inc eax
mov dword [ebp - 0xb9c], eax
cmp eax, dword [ebp - 0xba0]
jb 0x4152c2
add edi, 0x10
cmp byte [esi], bl
jne 0x41520f
mov esi, dword [ebp - 0xb94]
mov eax, dword [ebp - 0xb8c]
jmp 0x415349
mov esi, 0xc000007a
jmp 0x415338
mov esi, ebx
test eax, eax
je 0x41535c
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0x41539c
mov esi, ebx
mov eax, dword [esi + 0x4227c0]
test eax, eax
je 0x415373
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x415362
push 0x40
push ebx
push 0x4227c0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x401060
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x4153a7
mov eax, dword [0x422cb4]
inc eax
mov dword [0x422cb4], eax
xor eax, eax
mov ecx, 0x422cb8
xchg dword [ecx], eax
push 0x54
lea eax, [ebp - 0x858]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xbd4]
add esp, 0xc
mov esi, dword [0x42107c]
mov ecx, eax
mov dword [ebp - 0x3a0], ebx
push 0xf
pop edx
and ecx, edx
mov dword [ebp - 0xb90], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0xc], cx
mov ecx, eax
shr ecx, 8
push 0x403
and ecx, edx
shr eax, 0xc
push ebx
mov word [ebp - 0xa], cx
and eax, edx
push ebx
mov ecx, esi
mov word [ebp - 8], ax
call dword [0x4234b4]
call esi
mov dword [ebp - 0xbbc], eax
mov dword [ebp - 0xb98], 0xffffff
test eax, eax
jne 0x41545d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb88], edi
test edi, edi
jle 0x415448
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb88], edi
test edi, edi
js 0x416a98
mov dword [ebp - 0xb88], 0x80004005
jmp 0x416a98
mov esi, dword [0x421050]
lea eax, [ebp - 0xcc0]
push eax
push ebx
lea eax, [ebp - 0xcac]
mov dword [ebp - 0xcbc], ebx
push eax
mov edi, ebx
mov dword [ebp - 0xcb0], ebx
push 8
mov ecx, esi
mov dword [ebp - 0xbe8], ebx
mov dword [ebp - 0xc58], ebx
mov dword [ebp - 0xca8], ebx
mov dword [ebp - 0xc8c], ebx
mov dword [ebp - 0xb88], edi
mov dword [ebp - 0xcc0], ebx
call dword [0x4234b4]
call esi
test eax, eax
jne 0x4154ed
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb88], edi
test edi, edi
jle 0x4154d7
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb88], edi
test edi, edi
js 0x415639
mov edi, 0x80004005
mov dword [ebp - 0xb88], edi
jmp 0x415639
mov eax, dword [ebp - 0xcc0]
add eax, eax
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
lea ecx, [ebp - 0xca8]
mov esi, eax
call fcn.0041d664
test esi, esi
jne 0x415522
mov dword [ebp - 0xca8], ebx
mov edi, 0x8007000e
jmp 0x4154e2
mov eax, dword [ebp - 0xcac]
mov dword [ebp - 0xca8], esi
lea eax, [eax*4 + 4]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
lea ecx, [ebp - 0xc8c]
mov esi, eax
call fcn.0041d664
test esi, esi
jne 0x415565
mov edi, 0x8007000e
mov dword [ebp - 0xb88], edi
jmp 0x415633
lea eax, [ebp - 0xcc0]
mov dword [ebp - 0xc8c], esi
mov esi, dword [0x421050]
mov ecx, esi
push eax
push dword [ebp - 0xca8]
lea eax, [ebp - 0xcac]
push eax
push 8
call dword [0x4234b4]
call esi
test eax, eax
je 0x4154b4
cmp dword [ebp - 0xcac], 0
mov edx, dword [ebp - 0xc8c]
mov eax, dword [ebp - 0xca8]
mov dword [ebp - 0xb9c], edx
mov dword [ebp - 0xbb0], ebx
jbe 0x415614
mov edi, eax
mov esi, dword [0x421058]
mov ecx, esi
push ebx
push edi
call dword [0x4234b4]
call esi
mov edx, dword [ebp - 0xb9c]
mov ecx, edi
mov dword [edx], eax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4155db
mov eax, dword [ebp - 0xbb0]
sub ecx, esi
sar ecx, 1
add edx, 4
mov dword [ebp - 0xb9c], edx
lea edi, [edi + ecx*2]
add edi, 2
inc eax
mov dword [ebp - 0xbb0], eax
cmp eax, dword [ebp - 0xcac]
jb 0x4155bc
mov edi, dword [ebp - 0xb88]
mov dword [edx], 0x409
mov eax, dword [ebp - 0xc8c]
mov dword [ebp - 0xcbc], eax
mov eax, dword [ebp - 0xcac]
inc eax
mov dword [ebp - 0xb9c], eax
mov dword [ebp - 0xc8c], ebx
lea ecx, [ebp - 0xc8c]
call fcn.0041d664
lea ecx, [ebp - 0xca8]
call fcn.0041d664
test edi, edi
js 0x415db9
cmp dword [ebp - 0xb9c], 0
mov edi, ebx
mov dword [ebp - 0xbb4], edi
mov esi, ebx
jbe 0x415697
mov eax, dword [ebp - 0xcbc]
mov edx, ebx
mov ecx, dword [eax + esi*4]
cmp ecx, dword [edx*4 + 0x402350]
je 0x41568f
inc edx
cmp edx, 0x26
jb 0x415672
inc esi
cmp esi, dword [ebp - 0xb9c]
jb 0x415670
jmp 0x415697
mov edi, edx
mov dword [ebp - 0xbb4], edx
mov esi, dword [0x421054]
lea eax, [ebp - 0x100]
push ebx
push 0x55
push eax
push dword [edi*4 + 0x402350]
mov ecx, esi
mov dword [ebp - 0xbf8], ebx
call dword [0x4234b4]
call esi
test eax, eax
je 0x4156fc
mov esi, dword [0x421048]
lea eax, [ebp - 0x720]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0x100]
mov ecx, esi
push eax
call dword [0x4234b4]
call esi
test eax, eax
jle 0x4156fc
mov edi, dword [ebp - 0x714]
xor eax, eax
shr edi, 0x1b
inc eax
and edi, eax
mov dword [ebp - 0xbf8], edi
mov edx, 0x402468
mov esi, ebx
mov ecx, edx
mov dword [ebp + esi*4 - 0x390], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x41570f
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0x415703
imul ecx, dword [ebp - 0xbb4], 3
movzx eax, byte [ecx + 0x4023e8]
mov esi, dword [ebp + eax*4 - 0x390]
movzx eax, byte [ecx + 0x4023e9]
mov dword [ebp - 0xbd4], esi
mov dword [ebp - 0xcf8], esi
mov eax, dword [ebp + eax*4 - 0x390]
mov dword [ebp - 0xbe4], eax
mov dword [ebp - 0xcf4], eax
movzx eax, byte [ecx + 0x4023ea]
mov esi, dword [ebp + eax*4 - 0x390]
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xcf0], esi
push 0x1c90
mov eax, ebx
push ebx
mov dword [ebp - 0xb88], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xbfc], edi
test edi, edi
je 0x415c56
or dword [ebp - 0xba0], 0xffffffff
mov ecx, 0xab69605e
mov dword [ebp - 0x448], ecx
add edi, 7
movzx esi, word [ebp - 0x446]
mov ecx, 0x7f1137f
mov dword [ebp - 0x444], ecx
mov al, bl
movzx edx, word [ebp - 0x442]
mov ecx, ebx
mov dword [ebp - 0xba4], ecx
mov dword [ebp - 0xc74], ecx
mov ecx, 0x7f1137f
movzx ecx, cx
mov dword [ebp - 0xb94], esi
mov esi, ebx
mov dword [ebp - 0xbb8], edi
mov edi, 0x402a8a
mov dword [ebp - 0xbb0], ebx
mov dword [ebp - 0xc40], ebx
mov dword [ebp - 0xb9c], ecx
mov dword [ebp - 0xbac], edx
mov dword [ebp - 0xbe0], 0x392
movzx ebx, byte [edi - 2]
movzx ecx, byte [edi - 1]
movzx edx, byte [edi + 2]
shl edx, 8
shl ebx, 8
or ebx, ecx
movzx ecx, byte [edi]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [edi + 1]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [edi + 3]
or edx, ecx
mov dword [ebp - 0xba8], ebx
movzx ecx, byte [edi + 4]
xor esi, ebx
shl edx, 8
mov ebx, esi
or edx, ecx
mov dword [ebp - 0xba4], esi
movzx ecx, byte [edi + 5]
add edi, 8
shl edx, 8
or edx, ecx
mov esi, dword [ebp - 0xb9c]
mov dword [ebp - 0xbec], edx
mov ecx, 0x7f1137f
mov dword [ebp - 0xbf0], edi
mov edi, edx
xor edi, dword [ebp - 0xc40]
xor edi, ebx
xor edi, ecx
xor edi, 0xab69605e
mov ecx, edi
rol ecx, 0xa
lea edx, [edi + 0x54969fa2]
rol edx, 5
imul edx, esi
add edx, ecx
xor ebx, edx
mov edx, 0x7f1137f
mov ecx, ebx
rol ecx, 2
lea edx, [ebx + edx]
ror edx, 9
imul edx, dword [ebp - 0xb94]
sub edx, ecx
xor edi, edx
mov ecx, edi
sub ecx, esi
imul edx, ecx, 0x605e
mov ecx, edi
shr ecx, 0xd
sub edx, ecx
xor ebx, edx
mov edx, ebx
mov ecx, ebx
xor edx, dword [ebp - 0xb94]
rol edx, 6
imul edx, dword [ebp - 0xbac]
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor edi, edx
mov edx, edi
xor edx, 0xab69605e
sub ecx, edx
xor ebx, ecx
mov ecx, esi
xor ecx, ebx
mov edx, ebx
imul ecx, dword [ebp - 0xb94]
ror edx, 6
xor edx, ecx
mov ecx, 0x7f1137f
xor edi, edx
add ecx, edi
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, edi
rol ecx, 2
add edx, ecx
xor ebx, edx
mov ecx, ebx
rol ecx, 8
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
imul edx, dword [ebp - 0xbac]
sub edx, ecx
xor edi, edx
mov edx, edi
mov ecx, edi
xor edx, 0xab69605e
ror ecx, 0xa
ror edx, 0xc
imul edx, esi
xor edx, ecx
xor ebx, edx
mov edx, ebx
mov ecx, ebx
xor edx, dword [ebp - 0xbac]
imul edx, dword [ebp - 0xb94]
shr ecx, 0xa
xor edx, ecx
xor edi, edx
mov ecx, edi
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, dword [ebp - 0xbac]
xor ebx, ecx
mov esi, ebx
sub esi, dword [ebp - 0xbac]
xor esi, edi
mov edi, dword [ebp - 0xb9c]
xor esi, 0xab69605e
mov edx, esi
mov ecx, esi
xor edx, dword [ebp - 0xbac]
rol edx, 2
imul edx, edi
shr ecx, 2
add edx, ecx
mov ecx, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, ecx
mov ecx, ebx
ror edx, 6
imul edx, dword [ebp - 0xb94]
rol ecx, 7
add edx, ecx
mov ecx, edi
xor esi, edx
xor ecx, esi
mov edx, esi
imul ecx, ecx, 0x605e
ror edx, 9
add edx, ecx
xor ebx, edx
mov edx, ebx
mov dword [ebp - 0xba4], ebx
xor edx, dword [ebp - 0xb94]
mov ecx, ebx
rol edx, 5
imul edx, dword [ebp - 0xbac]
rol ecx, 7
add edx, ecx
xor esi, edx
mov edx, 0x7f1137f
mov ebx, esi
xor ebx, dword [ebp - 0xba4]
xor ebx, edx
xor ebx, 0xab69605e
mov ecx, ebx
ror ecx, 3
sub ecx, dword [ebp - 0xb94]
imul ecx, edi
xor esi, ecx
mov ecx, esi
sub ecx, edx
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, esi
ror ecx, 6
sub edx, ecx
xor ebx, edx
mov ecx, ebx
rol ecx, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [ebp - 0xbac]
add edx, ecx
xor esi, edx
mov ecx, esi
ror ecx, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, edi
mov edi, dword [ebp - 0xbf0]
sub edx, ecx
xor ebx, edx
mov edx, ebx
mov ecx, ebx
shr ecx, 3
xor edx, 0x605e
imul edx, dword [ebp - 0xb94]
xor edx, ecx
xor esi, edx
mov edx, 0x7f1137f
mov ecx, esi
xor ecx, edx
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, esi
xor esi, dword [ebp - 0xba0]
rol ecx, 2
mov dword [ebp - 0xc40], esi
xor edx, ecx
xor edx, dword [ebp - 0xbb0]
xor ebx, edx
mov edx, dword [ebp - 0xbb8]
mov dword [ebp - 0xc74], ebx
mov byte [edx - 4], bl
mov cl, byte [ebp - 0xc40]
ror dword [ebp - 0xc74], 8
mov byte [edx], cl
mov cl, byte [ebp - 0xc74]
ror dword [ebp - 0xc40], 8
mov byte [edx - 5], cl
mov cl, byte [ebp - 0xc40]
ror dword [ebp - 0xc74], 8
mov byte [edx - 1], cl
mov cl, byte [ebp - 0xc74]
ror dword [ebp - 0xc40], 8
mov byte [edx - 6], cl
mov cl, byte [ebp - 0xc40]
ror dword [ebp - 0xc74], 8
mov byte [edx - 2], cl
mov cl, byte [ebp - 0xc74]
ror dword [ebp - 0xc40], 8
mov byte [edx - 7], cl
mov cl, byte [ebp - 0xc40]
mov byte [edx - 3], cl
add edx, 8
mov esi, dword [ebp - 0xc74]
mov ecx, dword [ebp - 0xba8]
ror dword [ebp - 0xc40], 8
ror esi, 8
sub dword [ebp - 0xbe0], 1
mov dword [ebp - 0xbb0], ecx
mov ecx, dword [ebp - 0xbec]
mov dword [ebp - 0xc74], esi
mov dword [ebp - 0xba0], ecx
mov dword [ebp - 0xbb8], edx
jne 0x415825
mov ecx, dword [ebp - 0xbfc]
xor ebx, ebx
mov edx, ebx
mov esi, 0x1c90
xor al, byte [edx + ecx]
inc edx
cmp edx, esi
jb 0x415b92
movzx eax, al
cdq
cmp eax, dword [0x404718]
jne 0x415bc4
cmp edx, dword [0x40471c]
jne 0x415bc4
mov edi, dword [ebp - 0xb88]
mov dword [ebp - 0xcb0], ecx
mov ecx, ebx
mov dword [ebp - 0xbe8], esi
jmp 0x415bcf
mov edi, 0xc004d501
mov dword [ebp - 0xb88], edi
test ecx, ecx
je 0x415be2
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
js 0x415ddd
mov edi, dword [ebp - 0xcb0]
mov esi, ebx
mov edx, ebx
mov ebx, dword [ebp - 0xbb4]
cmp ebx, edx
jne 0x415c05
mov dword [ebp + esi*4 - 0x340], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0xba8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x415c10
sub ecx, dword [ebp - 0xba8]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0x415bfa
inc esi
push 0
pop ebx
cmp esi, 6
jb 0x415bf2
push 0xc
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
lea ecx, [ebp - 0xc58]
mov edi, eax
call fcn.0041d664
test edi, edi
jne 0x415c66
mov dword [ebp - 0xc58], ebx
mov edi, 0x8007000e
mov dword [ebp - 0xb88], edi
jmp 0x415ddd
mov dword [ebp - 0xc58], edi
lea ecx, [ebp - 0xc]
xor eax, eax
mov dword [ebp - 0xb9c], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, ebx
movzx edx, word [ecx]
mov eax, ebx
cmp dx, word [eax*2 + 0x40245c]
je 0x415c96
inc eax
cmp eax, 6
jb 0x415c81
jmp 0x415d4f
mov edx, dword [ebp + eax*4 - 0x340]
mov ecx, edx
mov dword [ebp - 0xba8], edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x415ca8
sub ecx, esi
mov esi, dword [0x421060]
push ebx
push ebx
lea eax, [ecx + 1]
mov ecx, esi
push eax
push edx
push ebx
push 0xfde9
call dword [0x4234b4]
call esi
mov esi, eax
test esi, esi
je 0x415d8a
lea ecx, [esi + esi]
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0xc58]
mov dword [ecx + edi], eax
mov eax, dword [ebp - 0xc58]
cmp dword [eax + edi], ebx
je 0x415c56
mov edx, dword [ebp - 0xba8]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xba8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x415d13
sub ecx, dword [ebp - 0xba8]
mov eax, dword [ebp - 0xc58]
push esi
mov esi, dword [0x421060]
push dword [eax + edi]
lea eax, [ecx + 1]
mov ecx, esi
push eax
push edx
push ebx
push 0xfde9
call dword [0x4234b4]
call esi
test eax, eax
je 0x415d8a
mov ecx, dword [ebp - 0xb9c]
add ecx, 2
add edi, 4
mov dword [ebp - 0xb9c], ecx
cmp edi, 0xc
jb 0x415c7c
mov eax, dword [ebp - 0xc58]
mov edi, dword [ebp - 0xb88]
mov dword [ebp - 0xcb8], eax
mov eax, dword [ebp - 0xbf8]
mov dword [ebp - 0xc58], ebx
mov dword [ebp - 0x858], eax
jmp 0x415ddd
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb88], edi
test edi, edi
jle 0x415dad
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb88], edi
test edi, edi
js 0x415ddd
mov edi, 0x80004005
jmp 0x415c5b
mov eax, dword [ebp - 0xcf0]
mov dword [ebp - 0xbcc], eax
mov eax, dword [ebp - 0xcf4]
mov dword [ebp - 0xbe4], eax
mov eax, dword [ebp - 0xcf8]
mov dword [ebp - 0xbd4], eax
cmp dword [ebp - 0xc58], 0
je 0x415e43
mov esi, ebx
mov eax, dword [ebp - 0xc58]
cmp dword [eax + esi], ebx
je 0x415e3b
mov ecx, dword [eax + esi]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x415df9
mov eax, dword [ebp - 0xc58]
sub ecx, edx
sar ecx, 1
mov eax, dword [eax + esi]
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x415e24
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x415e1c
mov eax, dword [ebp - 0xc58]
push dword [eax + esi]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
add esi, 4
cmp esi, 0xc
jb 0x415de8
mov eax, dword [ebp - 0xcb0]
test eax, eax
je 0x415e5f
mov ecx, dword [ebp - 0xbe8]
test ecx, ecx
je 0x415e5f
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x415e57
lea ecx, [ebp - 0xc58]
call fcn.0041d664
lea ecx, [ebp - 0xcb0]
call fcn.0041d664
lea ecx, [ebp - 0xcbc]
call fcn.0041d664
test edi, edi
js 0x416a81
mov eax, dword [ebp - 0xcb8]
mov edi, ebx
mov esi, dword [0x4210b4]
push ebx
mov dword [ebp - 0xb88], edi
mov ecx, dword [eax]
mov dword [ebp - 0x850], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x84c], ecx
mov ecx, esi
mov eax, dword [eax + 8]
mov dword [ebp - 0x848], eax
lea eax, [ebp - 0xd4c]
push eax
push ebx
push 0x42
mov dword [ebp - 0xd48], ebx
mov dword [ebp - 0xd44], ebx
mov dword [ebp - 0xd4c], 0xc
call dword [0x4234b4]
call esi
test eax, eax
jne 0x415f19
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb88], edi
test edi, edi
jle 0x415f08
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb88], edi
test edi, edi
mov eax, ebx
js 0x415f22
mov edi, 0x80004005
mov dword [ebp - 0xb88], edi
jmp 0x415f22
mov eax, dword [ebp - 0xd48]
and eax, 1
mov dword [ebp - 0x854], eax
test edi, edi
js 0x416a81
mov eax, dword [ebp - 0xb90]
push 0x2a
pop ecx
mov dword [ebp - 0xba4], ecx
sub eax, 1
je 0x415f6d
sub eax, 1
je 0x415f61
sub eax, 1
jne 0x415f7d
mov edi, 0xe1
mov dword [ebp - 0xbd0], edi
mov dword [ebp - 0xbd8], edi
jmp 0x415f7d
mov dword [ebp - 0xbd0], 0xf
jmp 0x415f73
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xbd8], 0xb
mov esi, 0xdc
mov dword [ebp - 0xbac], 0x60
push esi
lea eax, [ebp - 0x800]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov word [ebp - 0x7bc], si
mov esi, dword [0x421070]
lea eax, [ebp - 0x800]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0x4234b4]
call esi
test eax, eax
je 0x41600e
mov eax, dword [ebp - 0x754]
movzx edi, word [ebp - 0x75a]
mov ecx, dword [ebp - 0x750]
push 0x60
mov dword [ebp - 0xbb4], eax
mov dword [ebp - 0x450], eax
pop eax
mov dword [ebp - 0xbac], edi
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0xbb0], ecx
mov dword [ebp - 0x44c], ecx
cmp edi, eax
jae 0x416026
mov dword [ebp - 0xbac], eax
jmp 0x416026
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0xbb4], eax
xor eax, eax
inc eax
cmp dword [ebp - 0xb90], eax
mov eax, dword [ebp - 0xbd4]
je 0x41603d
mov eax, dword [ebp - 0xbcc]
push 0x5c
mov dword [ebp - 0xb9c], eax
lea eax, [ebp - 0x700]
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x42107c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xb88], edi
push 0x403
push ebx
push ebx
call dword [0x4234b4]
call esi
mov dword [ebp - 0xba8], eax
test eax, eax
jne 0x4160b6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb88], edi
test edi, edi
jle 0x4160a1
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb88], edi
test edi, edi
js 0x41616d
mov dword [ebp - 0xb88], 0x80004005
jmp 0x416a81
mov esi, dword [0x42105c]
mov ecx, esi
push 0x48
push dword [ebp - 0xbac]
push dword [ebp - 0xbd0]
call dword [0x4234b4]
call esi
push dword [ebp - 0xb9c]
neg eax
mov dword [ebp - 0x6f0], 0x190
push 0x20
mov dword [ebp - 0x700], eax
lea ecx, [ebp - 0x6e4]
pop eax
mov edx, eax
mov byte [ebp - 0x6e6], 5
call fcn.0040577c
mov esi, dword [0x421010]
lea eax, [ebp - 0x700]
push eax
mov ecx, esi
call dword [0x4234b4]
call esi
test eax, eax
jne 0x416150
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb88], edi
test edi, edi
jle 0x416141
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb88], edi
test edi, edi
js 0x416156
mov edi, 0x80004005
mov dword [ebp - 0xb88], edi
jmp 0x416156
mov dword [ebp - 0x844], eax
push dword [ebp - 0xba8]
mov esi, dword [0x4210b0]
mov ecx, esi
push ebx
call dword [0x4234b4]
call esi
test edi, edi
js 0x416a81
xor eax, eax
inc eax
cmp dword [ebp - 0xb90], eax
je 0x41618c
mov eax, dword [ebp - 0xbcc]
mov dword [ebp - 0xbd4], eax
push 0x5c
lea eax, [ebp - 0x6a0]
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x42107c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xb88], edi
push 0x403
push ebx
push ebx
call dword [0x4234b4]
call esi
mov dword [ebp - 0xba8], eax
test eax, eax
jne 0x4161f5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb88], edi
test edi, edi
jle 0x4161ea
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb88], edi
test edi, edi
js 0x4162ac
jmp 0x4160a7
mov esi, dword [0x42105c]
mov ecx, esi
push 0x48
push dword [ebp - 0xbac]
push dword [ebp - 0xbd8]
call dword [0x4234b4]
call esi
push dword [ebp - 0xbd4]
neg eax
mov dword [ebp - 0x690], 0x190
push 0x20
mov dword [ebp - 0x6a0], eax
lea ecx, [ebp - 0x684]
pop eax
mov edx, eax
mov byte [ebp - 0x686], 5
call fcn.0040577c
mov esi, dword [0x421010]
lea eax, [ebp - 0x6a0]
push eax
mov ecx, esi
call dword [0x4234b4]
call esi
test eax, eax
jne 0x41628f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb88], edi
test edi, edi
jle 0x416280
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb88], edi
test edi, edi
js 0x416295
mov edi, 0x80004005
mov dword [ebp - 0xb88], edi
jmp 0x416295
mov dword [ebp - 0x840], eax
push dword [ebp - 0xba8]
mov esi, dword [0x4210b0]
mov ecx, esi
push ebx
call dword [0x4234b4]
call esi
test edi, edi
js 0x416a81
mov esi, dword [ebp - 0xb90]
mov ecx, ebx
mov eax, esi
mov edx, ebx
sub eax, 1
je 0x4162cf
sub eax, 1
je 0x41630d
sub eax, 1
jne 0x4162db
mov ecx, dword [ebp - 0xbb4]
mov edx, dword [ebp - 0xbb0]
mov dword [ebp - 0x398], ecx
mov dword [ebp - 0x394], edx
xor edx, edx
inc edx
cmp esi, edx
je 0x41634d
lea eax, [esi - 2]
cmp eax, edx
ja 0x416321
mov eax, ebx
mov dword [ebp - 0xba4], ebx
mov edx, ebx
mov dword [ebp - 0xbd0], eax
mov dword [ebp - 0xbd8], ebx
jmp 0x416364
mov eax, dword [ebp - 0xbb4]
cdq
and edx, 3
lea ecx, [edx + eax]
mov edx, ebx
sar ecx, 2
jmp 0x4162db
mov eax, dword [ebp - 0xc90]
mov edx, dword [ebp - 0xc90]
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0xc90]
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0xc90]
mov dword [ebp - 0xbd0], eax
jmp 0x416364
mov edx, 0x96
mov dword [ebp - 0xbd0], ebx
mov eax, ebx
mov dword [ebp - 0xbd8], 0x20
mov dword [ebp - 0xbd4], edx
push dword [ebp - 0x844]
mov esi, dword [0x42103c]
sub ecx, edx
push dword [ebp - 0xbbc]
mov edi, dword [ebp - 0x850]
sub ecx, eax
mov dword [ebp - 0xbec], ecx
mov eax, ebx
mov dword [ebp - 0x81c], ecx
mov dword [ebp - 0x82c], ecx
mov ecx, esi
mov dword [ebp - 0xb88], eax
call dword [0x4234b4]
call esi
mov esi, dword [0x42106c]
mov ecx, esi
push ebx
push 0xc50
mov dword [ebp - 0xba8], eax
lea eax, [ebp - 0x834]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xbbc]
call dword [0x4234b4]
call esi
test eax, eax
jne 0x4163e7
mov edi, 0x80004005
mov dword [ebp - 0xb88], edi
jmp 0x4163e9
mov edi, ebx
mov eax, dword [ebp - 0xba8]
test eax, eax
je 0x41640a
mov esi, dword [0x42103c]
mov ecx, esi
push eax
push dword [ebp - 0xbbc]
call dword [0x4234b4]
call esi
test edi, edi
js 0x416a81
push dword [ebp - 0x840]
mov esi, dword [0x42103c]
mov eax, ebx
push dword [ebp - 0xbbc]
mov edi, dword [ebp - 0x84c]
mov ecx, esi
mov dword [ebp - 0xb88], eax
call dword [0x4234b4]
call esi
mov esi, dword [0x42106c]
mov ecx, esi
push ebx
push 0xc50
mov dword [ebp - 0xba8], eax
lea eax, [ebp - 0x824]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xbbc]
call dword [0x4234b4]
call esi
test eax, eax
jne 0x416479
mov edi, 0x80004005
mov dword [ebp - 0xb88], edi
jmp 0x41647b
mov edi, ebx
mov eax, dword [ebp - 0xba8]
test eax, eax
je 0x41649c
mov esi, dword [0x42103c]
mov ecx, esi
push eax
push dword [ebp - 0xbbc]
call dword [0x4234b4]
call esi
test edi, edi
js 0x416a81
mov eax, dword [ebp - 0xb90]
cmp eax, 2
je 0x4164b4
cmp eax, 3
jne 0x4164d6
mov edi, dword [ebp - 0x81c]
mov dword [ebp - 0xbec], edi
cmp dword [ebp - 0x82c], edi
jle 0x4164dc
mov edi, dword [ebp - 0x82c]
mov dword [ebp - 0xbec], edi
jmp 0x4164dc
mov edi, dword [ebp - 0xbec]
cmp dword [ebp - 0x858], 0
mov esi, dword [0x4210a8]
mov ecx, esi
push dword [ebp - 0xba4]
je 0x41652f
mov eax, dword [ebp - 0xbd0]
sub eax, dword [ebp - 0x82c]
add eax, edi
push eax
lea eax, [ebp - 0x834]
push eax
call dword [0x4234b4]
call esi
mov eax, dword [ebp - 0x828]
add eax, dword [ebp - 0xbd8]
push eax
mov eax, dword [ebp - 0xbd0]
sub eax, dword [ebp - 0x81c]
add eax, edi
push eax
jmp 0x416557
push dword [ebp - 0xbd4]
lea eax, [ebp - 0x834]
push eax
call dword [0x4234b4]
call esi
mov eax, dword [ebp - 0x828]
add eax, dword [ebp - 0xbd8]
push eax
push dword [ebp - 0xbd4]
mov esi, dword [0x4210a8]
lea eax, [ebp - 0x824]
push eax
mov ecx, esi
call dword [0x4234b4]
call esi
mov eax, dword [ebp - 0xb90]
cmp eax, 2
je 0x416870
cmp eax, 3
je 0x416870
xor edx, edx
inc edx
cmp eax, edx
jne 0x41688f
push 0x5c
lea eax, [ebp - 0x640]
mov dword [ebp - 0x838], 0xffffff
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x42107c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xb88], edi
push 0x403
push ebx
push ebx
call dword [0x4234b4]
call esi
mov dword [ebp - 0xba8], eax
test eax, eax
jne 0x416604
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb88], edi
test edi, edi
jle 0x4165f9
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb88], edi
test edi, edi
js 0x4166b7
jmp 0x4160a7
mov esi, dword [0x42105c]
mov ecx, esi
push 0x48
push dword [ebp - 0xbac]
push 0xb
call dword [0x4234b4]
call esi
push dword [ebp - 0xbe4]
neg eax
mov dword [ebp - 0x630], 0x190
push 0x20
mov dword [ebp - 0x640], eax
lea ecx, [ebp - 0x624]
pop eax
mov edx, eax
mov byte [ebp - 0x626], 5
call fcn.0040577c
mov esi, dword [0x421010]
lea eax, [ebp - 0x640]
push eax
mov ecx, esi
call dword [0x4234b4]
call esi
test eax, eax
jne 0x41669a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb88], edi
test edi, edi
jle 0x41668b
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb88], edi
test edi, edi
js 0x4166a0
mov edi, 0x80004005
mov dword [ebp - 0xb88], edi
jmp 0x4166a0
mov dword [ebp - 0x83c], eax
push dword [ebp - 0xba8]
mov esi, dword [0x4210b0]
mov ecx, esi
push ebx
call dword [0x4234b4]
call esi
test edi, edi
js 0x416a81
push dword [ebp - 0x83c]
mov eax, dword [ebp - 0xbec]
push dword [ebp - 0xbbc]
mov esi, dword [0x42103c]
mov ecx, esi
mov edi, dword [ebp - 0x848]
mov dword [ebp - 0x80c], eax
mov eax, ebx
mov dword [ebp - 0xb88], eax
call dword [0x4234b4]
call esi
mov esi, dword [0x42106c]
mov ecx, esi
push ebx
push 0x460
mov dword [ebp - 0xba8], eax
lea eax, [ebp - 0x814]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xbbc]
call dword [0x4234b4]
call esi
test eax, eax
jne 0x416732
mov edi, 0x80004005
mov dword [ebp - 0xb88], edi
jmp 0x416734
mov edi, ebx
mov eax, dword [ebp - 0xba8]
test eax, eax
je 0x416755
mov esi, dword [0x42103c]
mov ecx, esi
push eax
push dword [ebp - 0xbbc]
call dword [0x4234b4]
call esi
test edi, edi
js 0x416a81
mov eax, dword [ebp - 0x80c]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x80c], eax
cmp eax, ecx
jge 0x416779
mov dword [ebp - 0x80c], ecx
mov edi, dword [ebp - 0xbac]
mov esi, dword [0x42105c]
mov ecx, esi
push 0x20
pop eax
push 0x60
push edi
push dword [ebp - 0x814]
mov dword [ebp - 0x808], eax
call dword [0x4234b4]
call esi
mov esi, dword [0x42105c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x810]
mov dword [ebp - 0x814], eax
call dword [0x4234b4]
call esi
mov esi, dword [0x42105c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x80c]
mov dword [ebp - 0x810], eax
call dword [0x4234b4]
call esi
mov esi, dword [0x42105c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x808]
mov dword [ebp - 0x80c], eax
call dword [0x4234b4]
call esi
cmp dword [ebp - 0x858], 0
mov dword [ebp - 0x808], eax
je 0x416845
mov ecx, dword [ebp - 0x834]
cmp ecx, dword [ebp - 0x824]
jl 0x416821
mov ecx, dword [ebp - 0x824]
mov eax, dword [ebp - 0x818]
add eax, 0x24
mov esi, dword [0x4210a8]
push eax
push ecx
lea eax, [ebp - 0x814]
mov ecx, esi
push eax
call dword [0x4234b4]
call esi
jmp 0x41688c
mov ecx, dword [ebp - 0x82c]
cmp ecx, dword [ebp - 0x81c]
jg 0x416859
mov ecx, dword [ebp - 0x81c]
mov eax, dword [ebp - 0x818]
sub ecx, dword [ebp - 0x80c]
add eax, 0x24
add ecx, dword [ebp - 0x814]
jmp 0x41682a
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x398], edi
mov dword [ebp - 0x394], eax
mov dword [ebp - 0x838], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [ebp - 0x858]
lea edi, [ebp - 0x5a4]
mov dword [ebp - 0xba8], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0xb9c], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xb90]
sub eax, 1
je 0x416a6f
sub eax, 1
je 0x416996
sub eax, 1
jne 0x416a7b
mov esi, dword [0x4210a4]
lea edi, [ebp - 0x594]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0x4234b4]
call esi
mov esi, dword [0x421084]
lea ecx, [ebp - 0x594]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x594], 0x28
call dword [0x4234b4]
call esi
test eax, eax
je 0x416a7b
mov esi, dword [0x4210a0]
lea eax, [ebp - 0x580]
push eax
push ebx
mov ecx, esi
call dword [0x4234b4]
call esi
mov esi, dword [0x4210a0]
lea eax, [ebp - 0x578]
push eax
push ebx
mov ecx, esi
call dword [0x4234b4]
call esi
mov eax, dword [ebp - 0x578]
lea esi, [ebp - 0x580]
sub eax, dword [ebp - 0xb9c]
lea edi, [ebp - 0x5a4]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0x574]
sub eax, dword [ebp - 0xbb0]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
jmp 0x416a64
mov esi, dword [0x4210a4]
lea edi, [ebp - 0x56c]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0x4234b4]
call esi
mov esi, dword [0x421084]
lea ecx, [ebp - 0x56c]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x56c], 0x28
call dword [0x4234b4]
call esi
test eax, eax
je 0x416a7b
mov esi, dword [0x4210a0]
lea eax, [ebp - 0x558]
push eax
push ebx
mov ecx, esi
call dword [0x4234b4]
call esi
mov esi, dword [0x4210a0]
lea eax, [ebp - 0x550]
push eax
push ebx
mov ecx, esi
call dword [0x4234b4]
call esi
cmp dword [ebp - 0xba8], 0
lea esi, [ebp - 0x558]
lea edi, [ebp - 0x5a4]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x416a3d
imul eax, dword [ebp - 0x550], 5
cdq
idiv ecx
add eax, dword [ebp - 0x558]
jmp 0x416a4f
mov eax, dword [ebp - 0x550]
sub eax, dword [ebp - 0xb9c]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0x54c]
sub eax, dword [ebp - 0xbb0]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x39c], eax
jmp 0x416a7b
mov dword [ebp - 0x3a0], ebx
mov dword [ebp - 0x39c], ebx
mov dword [ebp - 0xb88], ebx
push dword [ebp - 0xbbc]
mov esi, dword [0x4210b0]
mov ecx, esi
push ebx
call dword [0x4234b4]
call esi
xor ebx, ebx
mov edi, 0x422cb8
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x416a9f
mov eax, dword [0x422cb4]
push 0
pop ebx
test eax, eax
jle 0x416b01
sub eax, 1
mov dword [0x422cb4], eax
jne 0x416b01
mov esi, ebx
mov eax, dword [esi + 0x4227c0]
test eax, eax
je 0x416ad5
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x416ac4
push 0x40
push ebx
push 0x4227c0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x401060
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x422cb8
xor eax, eax
xchg dword [edi], eax
lea ecx, [ebp - 0xcb8]
call fcn.0041d664
mov eax, dword [ebp - 0xb88]
test eax, eax
js 0x41878b
mov eax, dword [ebp - 0x39c]
mov edi, dword [ebp - 0x3a0]
push 0x54
mov dword [ebp - 0xb9c], eax
mov dword [ebp - 0xd14], eax
lea eax, [ebp - 0x8c0]
push ebx
push eax
mov dword [ebp - 0xd18], edi
call sub.msvcrt.dll_memset
mov esi, dword [0x421028]
add esp, 0xc
xor eax, eax
mov ecx, esi
inc eax
mov dword [ebp - 0xbb0], eax
push 7
push dword [ebp - 0xbc0]
call dword [0x4234b4]
call esi
test eax, eax
je 0x416bb8
mov esi, dword [0x421034]
lea ecx, [ebp - 0x8c0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4234b4]
call esi
test eax, eax
je 0x416bb8
push 0x20
pop eax
cmp word [ebp - 0x8ae], ax
jne 0x416bb8
cmp dword [ebp - 0x8ac], 0
je 0x416bb8
cmp dword [ebp - 0x8bc], 0
jle 0x416bb8
cmp dword [ebp - 0x8b8], 0
jg 0x416bc7
cmp dword [ebp - 0xb90], 1
mov dword [ebp - 0xbb0], ebx
jne 0x416c3b
push dword [ebp - 0xb9c]
mov esi, dword [0x4210a8]
lea eax, [ebp - 0x834]
push edi
push eax
mov ecx, esi
call dword [0x4234b4]
call esi
push dword [ebp - 0xb9c]
mov esi, dword [0x4210a8]
lea eax, [ebp - 0x824]
push edi
push eax
mov ecx, esi
call dword [0x4234b4]
call esi
mov edi, dword [ebp - 0xb90]
cmp edi, 1
jne 0x416c41
mov eax, dword [ebp - 0x854]
mov esi, dword [0x421014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0x4234b4]
call esi
mov dword [ebp - 0xbc4], eax
jmp 0x416c41
mov edi, dword [ebp - 0xb90]
mov esi, dword [0x421040]
mov ecx, esi
push 1
push dword [ebp - 0xbc0]
call dword [0x4234b4]
call esi
cmp dword [ebp - 0x858], 0
mov dword [ebp - 0xc0c], eax
mov dword [ebp - 0xbf0], 0x810
je 0x416c7c
mov dword [ebp - 0xbf0], 0x20812
cmp dword [ebp - 0xbb0], 0
je 0x417809
mov eax, dword [ebp - 0x854]
mov esi, dword [ebp - 0x850]
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp - 0x844]
push 0x54
mov dword [ebp - 0xba8], eax
lea eax, [ebp - 0x9c8]
push ebx
push eax
mov dword [ebp - 0xb9c], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xb28]
push 0x54
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xbb8], ebx
lea eax, [ebp - 0x484]
mov dword [ebp - 0xba0], ebx
mov dword [ebp - 0xbd8], ebx
mov dword [ebp - 0xbd0], ebx
push 0x2c
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x428]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x41876b
mov edi, dword [ebp - 0xbc0]
mov esi, dword [0x421028]
mov ecx, esi
push 7
push edi
call dword [0x4234b4]
call esi
test eax, eax
je 0x41786f
mov esi, dword [0x421034]
lea ecx, [ebp - 0x9c8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4234b4]
call esi
test eax, eax
je 0x416d72
mov eax, dword [ebp - 0x9b4]
mov dword [ebp - 0xbb8], eax
mov eax, dword [ebp - 0x9c4]
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0x9c0]
mov dword [ebp - 0xbd0], eax
mov esi, dword [0x421008]
mov ecx, esi
push edi
call dword [0x4234b4]
call esi
mov ecx, eax
mov dword [ebp - 0xb8c], ecx
test ecx, ecx
je 0x41786f
mov eax, dword [ebp - 0x82c]
mov edi, ebx
sub eax, dword [ebp - 0x834]
mov esi, dword [0x42100c]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x830]
sub eax, dword [ebp - 0x828]
mov dword [ebp - 0x47c], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xd3c], ebx
mov word [ebp - 0x478], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x476], ax
lea eax, [ebp - 0xd3c]
push eax
push ebx
lea eax, [ebp - 0x484]
mov dword [ebp - 0xbe4], edi
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x474], ebx
mov dword [ebp - 0x470], ebx
mov dword [ebp - 0x46c], ebx
mov dword [ebp - 0x468], ebx
mov dword [ebp - 0x464], ebx
mov dword [ebp - 0x460], ebx
mov dword [ebp - 0x45c], ebx
mov dword [ebp - 0x484], 0x28
call dword [0x4234b4]
call esi
mov dword [ebp - 0xbf8], eax
test eax, eax
jne 0x416e60
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x416e50
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x417238
mov edi, 0x80004005
jmp 0x417238
mov esi, dword [0x421034]
lea ecx, [ebp - 0xb28]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4234b4]
call esi
test eax, eax
je 0x416e8a
mov eax, dword [ebp - 0xb14]
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0x82c]
sub eax, dword [ebp - 0x834]
push dword [ebp - 0xbf8]
mov esi, dword [0x42103c]
mov ecx, esi
push dword [ebp - 0xb8c]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x828]
sub eax, dword [ebp - 0x830]
mov dword [ebp - 0x41c], eax
call dword [0x4234b4]
call esi
mov esi, dword [0x421040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xb8c]
call dword [0x4234b4]
call esi
push dword [ebp - 0xba8]
mov esi, dword [0x42103c]
mov ecx, esi
push dword [ebp - 0xb8c]
call dword [0x4234b4]
call esi
mov esi, dword [0x421038]
mov ecx, esi
push ebx
mov dword [ebp - 0xbd4], eax
call dword [0x4234b4]
call esi
mov esi, dword [0x421074]
mov ecx, esi
push eax
lea eax, [ebp - 0x428]
push eax
push dword [ebp - 0xb8c]
call dword [0x4234b4]
call esi
mov esi, dword [0x42106c]
lea eax, [ebp - 0x428]
push ebx
push dword [ebp - 0xbf0]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb9c]
push dword [ebp - 0xb8c]
call dword [0x4234b4]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xb90], eax
jne 0x416f9b
cmp dword [ebp - 0xbb0], 0
je 0x416f8f
mov esi, dword [0x42108c]
mov ecx, esi
push 8
call dword [0x4234b4]
call esi
mov dword [ebp - 0xba4], eax
jmp 0x416fa5
mov dword [ebp - 0xba4], 0xffffff
jmp 0x416fa5
mov dword [ebp - 0xba4], 0xffa8a8a8
mov edx, dword [ebp - 0x834]
mov eax, ebx
mov esi, dword [ebp - 0x830]
mov ecx, ebx
mov dword [ebp - 0xbb4], edx
mov dword [ebp - 0xbb0], ebx
mov dword [ebp - 0xb9c], eax
test edx, edx
jns 0x416fdb
mov ecx, edx
mov dword [ebp - 0xbb4], ebx
neg ecx
mov dword [ebp - 0xbb0], ecx
test esi, esi
jns 0x416feb
mov eax, esi
mov esi, ebx
neg eax
mov dword [ebp - 0xb9c], eax
mov edx, dword [ebp - 0xbd8]
sub edx, dword [ebp - 0xbb4]
mov dword [ebp - 0xba8], edx
mov edx, dword [ebp - 0x420]
sub edx, ecx
mov ecx, dword [ebp - 0xba8]
mov dword [ebp - 0xbe0], edx
cmp edx, ecx
jl 0x41701d
mov edx, ecx
mov dword [ebp - 0xbe0], ecx
mov ecx, dword [ebp - 0x41c]
sub dword [ebp - 0xbd0], esi
sub ecx, eax
mov eax, dword [ebp - 0xbd0]
mov dword [ebp - 0xbe8], ecx
cmp ecx, eax
jl 0x417043
mov ecx, eax
mov dword [ebp - 0xbe8], eax
test edx, edx
jle 0x417201
test ecx, ecx
jle 0x417201
mov ebx, dword [ebp - 0x420]
mov eax, ebx
imul eax, dword [ebp - 0xb9c]
mov edi, dword [ebp - 0xba0]
shl ebx, 2
mov dword [ebp - 0xba8], ebx
add eax, dword [ebp - 0xbb0]
lea edi, [edi + eax*4]
mov eax, dword [ebp - 0xbd8]
imul eax, esi
mov esi, dword [ebp - 0xbb8]
mov dword [ebp - 0xbcc], edi
add eax, dword [ebp - 0xbb4]
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xbd8]
shl esi, 2
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0xbb8], esi
test edx, edx
jle 0x4171da
mov esi, eax
mov dword [ebp - 0xbb0], edx
add edi, 2
lea ebx, [eax + 3]
sub esi, dword [ebp - 0xbcc]
mov dword [ebp - 0xbec], ebx
mov dword [ebp - 0xb9c], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x41719b
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xba4]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb9c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xbec]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xba4]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbec]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xba2]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbec]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xb9c]
cdq
idiv ecx
mov edx, dword [ebp - 0xbb0]
add al, bl
mov ebx, dword [ebp - 0xbec]
mov byte [ebx], al
add ebx, 4
add edi, 4
sub edx, 1
mov dword [ebp - 0xbec], ebx
mov dword [ebp - 0xbb0], edx
jne 0x4170d5
mov ecx, dword [ebp - 0xbe8]
mov edx, dword [ebp - 0xbe0]
mov edi, dword [ebp - 0xbcc]
mov eax, dword [ebp - 0xba0]
mov ebx, dword [ebp - 0xba8]
mov esi, dword [ebp - 0xbb8]
add edi, ebx
add eax, esi
sub ecx, 1
mov dword [ebp - 0xbcc], edi
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0xbe8], ecx
jne 0x4170ad
mov edi, dword [ebp - 0xbe4]
xor ebx, ebx
push dword [ebp - 0xbf8]
mov esi, dword [0x42101c]
mov ecx, esi
call dword [0x4234b4]
call esi
mov eax, dword [ebp - 0xbd4]
test eax, eax
je 0x417238
mov esi, dword [0x42103c]
mov ecx, esi
push eax
push dword [ebp - 0xb8c]
call dword [0x4234b4]
call esi
push dword [ebp - 0xb8c]
mov esi, dword [0x421018]
mov ecx, esi
call dword [0x4234b4]
call esi
test edi, edi
js 0x41876b
mov eax, dword [ebp - 0x854]
mov esi, dword [ebp - 0x84c]
mov dword [ebp - 0xbb8], eax
mov eax, dword [ebp - 0x840]
push 0x54
mov dword [ebp - 0xba8], eax
lea eax, [ebp - 0x918]
push ebx
push eax
mov dword [ebp - 0xb9c], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xb80]
push 0x54
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xba0], ebx
lea eax, [ebp - 0x4b0]
mov dword [ebp - 0xbb0], ebx
mov dword [ebp - 0xbb4], ebx
mov dword [ebp - 0xba4], ebx
push 0x2c
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x418]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x41876b
mov edi, dword [ebp - 0xbc0]
mov esi, dword [0x421028]
mov ecx, esi
push 7
push edi
call dword [0x4234b4]
call esi
test eax, eax
je 0x41786f
mov esi, dword [0x421034]
lea ecx, [ebp - 0x918]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4234b4]
call esi
test eax, eax
je 0x41733f
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0xbb4], eax
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0xba4], eax
mov esi, dword [0x421008]
mov ecx, esi
push edi
call dword [0x4234b4]
call esi
mov ecx, eax
mov dword [ebp - 0xb8c], ecx
test ecx, ecx
je 0x41786f
mov eax, dword [ebp - 0x81c]
mov edi, ebx
sub eax, dword [ebp - 0x824]
mov esi, dword [0x42100c]
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x820]
sub eax, dword [ebp - 0x818]
mov dword [ebp - 0x4a8], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xcfc], ebx
mov word [ebp - 0x4a4], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x4a2], ax
lea eax, [ebp - 0xcfc]
push eax
push ebx
lea eax, [ebp - 0x4b0]
mov dword [ebp - 0xbd8], edi
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x4a0], ebx
mov dword [ebp - 0x49c], ebx
mov dword [ebp - 0x498], ebx
mov dword [ebp - 0x494], ebx
mov dword [ebp - 0x490], ebx
mov dword [ebp - 0x48c], ebx
mov dword [ebp - 0x488], ebx
mov dword [ebp - 0x4b0], 0x28
call dword [0x4234b4]
call esi
mov dword [ebp - 0xbe0], eax
test eax, eax
jne 0x41742d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x41741d
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x4177e6
mov edi, 0x80004005
jmp 0x4177e6
mov esi, dword [0x421034]
lea ecx, [ebp - 0xb80]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4234b4]
call esi
test eax, eax
je 0x417457
mov eax, dword [ebp - 0xb6c]
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp - 0x81c]
sub eax, dword [ebp - 0x824]
push dword [ebp - 0xbe0]
mov esi, dword [0x42103c]
mov ecx, esi
push dword [ebp - 0xb8c]
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x818]
sub eax, dword [ebp - 0x820]
mov dword [ebp - 0x40c], eax
call dword [0x4234b4]
call esi
mov esi, dword [0x421040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xb8c]
call dword [0x4234b4]
call esi
push dword [ebp - 0xba8]
mov esi, dword [0x42103c]
mov ecx, esi
push dword [ebp - 0xb8c]
call dword [0x4234b4]
call esi
mov esi, dword [0x421038]
mov ecx, esi
push ebx
mov dword [ebp - 0xbd4], eax
call dword [0x4234b4]
call esi
mov esi, dword [0x421074]
mov ecx, esi
push eax
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0xb8c]
call dword [0x4234b4]
call esi
mov esi, dword [0x42106c]
lea eax, [ebp - 0x418]
push ebx
push dword [ebp - 0xbf0]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb9c]
push dword [ebp - 0xb8c]
call dword [0x4234b4]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xb90], eax
jne 0x417562
cmp dword [ebp - 0xbb8], 0
je 0x417556
mov esi, dword [0x42108c]
mov ecx, esi
push 8
call dword [0x4234b4]
call esi
jmp 0x417567
mov dword [ebp - 0xbe8], 0xffffff
jmp 0x417573
mov eax, 0xffa8a8a8
mov dword [ebp - 0xbe8], eax
mov dword [ebp - 0xb98], eax
mov esi, dword [ebp - 0x824]
mov edx, ebx
mov eax, dword [ebp - 0x820]
mov ecx, ebx
mov dword [ebp - 0xbcc], esi
mov dword [ebp - 0xb9c], ebx
test esi, esi
jns 0x4175a3
mov edx, esi
mov dword [ebp - 0xbcc], ebx
neg edx
mov dword [ebp - 0xb9c], edx
test eax, eax
jns 0x4175ad
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [ebp - 0x410]
sub esi, edx
mov edx, dword [ebp - 0xbb4]
sub edx, dword [ebp - 0xbcc]
mov dword [ebp - 0xbe4], esi
cmp esi, edx
jl 0x4175d3
mov esi, edx
mov dword [ebp - 0xbe4], edx
mov edx, dword [ebp - 0x40c]
sub dword [ebp - 0xba4], eax
sub edx, ecx
mov dword [ebp - 0xbd0], edx
cmp edx, dword [ebp - 0xba4]
jl 0x4175fb
mov edx, dword [ebp - 0xba4]
mov dword [ebp - 0xbd0], edx
test esi, esi
jle 0x4177af
test edx, edx
jle 0x4177af
mov ebx, dword [ebp - 0x410]
mov edi, dword [ebp - 0xbb4]
mov esi, dword [ebp - 0xbb0]
imul ecx, ebx
imul eax, edi
shl ebx, 2
mov dword [ebp - 0xba8], ebx
add ecx, dword [ebp - 0xb9c]
add eax, dword [ebp - 0xbcc]
shl edi, 2
mov dword [ebp - 0xbf8], edi
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0xba0]
mov dword [ebp - 0xbb8], ecx
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xbe4]
mov dword [ebp - 0xba0], eax
test esi, esi
jle 0x417788
mov ebx, eax
mov dword [ebp - 0xbb0], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0xba4], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xb9c], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x417749
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xb98]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb9c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xba4]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xb98]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xba4]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xbe6]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xba4]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xbb0]
cdq
idiv ecx
mov edx, dword [ebp - 0xba4]
add al, bl
mov ebx, dword [ebp - 0xb9c]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [ebp - 0xba4], edx
mov dword [ebp - 0xbb0], esi
jne 0x417683
mov edx, dword [ebp - 0xbd0]
mov esi, dword [ebp - 0xbe4]
mov ecx, dword [ebp - 0xbb8]
mov eax, dword [ebp - 0xba0]
mov ebx, dword [ebp - 0xba8]
mov edi, dword [ebp - 0xbf8]
add ecx, ebx
add eax, edi
sub edx, 1
mov dword [ebp - 0xbb8], ecx
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0xbd0], edx
jne 0x41765f
mov edi, dword [ebp - 0xbd8]
xor ebx, ebx
push dword [ebp - 0xbe0]
mov esi, dword [0x42101c]
mov ecx, esi
call dword [0x4234b4]
call esi
mov eax, dword [ebp - 0xbd4]
test eax, eax
je 0x4177e6
mov esi, dword [0x42103c]
mov ecx, esi
push eax
push dword [ebp - 0xb8c]
call dword [0x4234b4]
call esi
push dword [ebp - 0xb8c]
mov esi, dword [0x421018]
mov ecx, esi
call dword [0x4234b4]
call esi
test edi, edi
js 0x41876b
jmp 0x418719
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x854], 0
jne 0x41781d
cmp edi, ecx
je 0x41781d
mov al, 0xc0
jmp 0x41781f
or al, 0xff
mov byte [ebp - 0xc0e], al
lea edi, [ebp - 0x3c0]
xor eax, eax
mov esi, dword [0x421008]
stosd dword es:[edi], eax
push dword [ebp - 0xbc0]
mov byte [ebp - 0xc0d], cl
mov ecx, esi
mov byte [ebp - 0xc10], bl
stosd dword es:[edi], eax
mov byte [ebp - 0xc0f], bl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x3b0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [0x4234b4]
call esi
mov dword [ebp - 0xbc8], eax
test eax, eax
jne 0x41787a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x41876b
xor eax, eax
inc eax
cmp dword [ebp - 0xb90], eax
jne 0x4179a3
mov eax, dword [ebp - 0x82c]
mov edx, dword [ebp - 0x81c]
sub edx, dword [ebp - 0x824]
sub eax, dword [ebp - 0x834]
mov dword [ebp - 0xbfc], edx
cmp edx, eax
jg 0x4178b3
mov edx, eax
mov dword [ebp - 0xbfc], eax
mov eax, dword [ebp - 0x818]
mov edi, ebx
sub eax, dword [ebp - 0x830]
mov ecx, ebx
cmp dword [ebp - 0x858], 0
mov dword [ebp - 0xbbc], eax
je 0x41790c
mov edi, dword [ebp - 0x834]
sub edi, dword [ebp - 0x82c]
add edi, edx
mov ecx, edi
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0x3c0], ecx
mov ecx, dword [ebp - 0x824]
sub ecx, dword [ebp - 0x81c]
add ecx, edx
mov esi, ecx
mov dword [ebp - 0xb94], esi
mov dword [ebp - 0x3b0], esi
jmp 0x417924
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0xb94], eax
sub edi, dword [ebp - 0x834]
add edi, dword [ebp - 0x82c]
mov eax, dword [ebp - 0x820]
sub eax, dword [ebp - 0x830]
sub ecx, dword [ebp - 0x824]
add ecx, dword [ebp - 0x81c]
mov dword [ebp - 0xb9c], edi
mov dword [ebp - 0x3b8], edi
mov edi, dword [ebp - 0x828]
sub edi, dword [ebp - 0x830]
mov dword [ebp - 0xbb4], edi
mov dword [ebp - 0x3b4], edi
mov edi, eax
sub edi, dword [ebp - 0x820]
add edi, dword [ebp - 0x818]
mov dword [ebp - 0xbac], ecx
mov dword [ebp - 0x3a8], ecx
mov dword [ebp - 0xb88], eax
mov dword [ebp - 0x3ac], eax
mov dword [ebp - 0xbe8], edi
mov dword [ebp - 0x3a4], edi
jmp 0x417a2f
mov eax, dword [ebp - 0x394]
lea esi, [ebp - 0x834]
lea edi, [ebp - 0x3c0]
mov edx, dword [ebp - 0x398]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xbbc], eax
mov dword [ebp - 0xbfc], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x3b4]
lea esi, [ebp - 0x824]
lea edi, [ebp - 0x3b0]
mov dword [ebp - 0xbb4], eax
mov eax, dword [ebp - 0x3b8]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xb9c], eax
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0xbd0], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0xbe8], eax
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0xb88], eax
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0xb94], eax
mov edi, dword [ebp - 0xbbc]
mov eax, edi
mov esi, dword [0x42100c]
neg eax
mov dword [ebp - 0x500], eax
mov ecx, esi
xor eax, eax
mov dword [ebp - 0xd40], ebx
push 0x20
inc eax
mov dword [ebp - 0x4f8], ebx
mov word [ebp - 0x4fc], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x4fa], ax
lea eax, [ebp - 0xd40]
push eax
push ebx
lea eax, [ebp - 0x508]
mov dword [ebp - 0x4f4], ebx
push eax
push dword [ebp - 0xbc8]
mov dword [ebp - 0x4f0], ebx
mov dword [ebp - 0x4ec], ebx
mov dword [ebp - 0x4e8], ebx
mov dword [ebp - 0x4e4], ebx
mov dword [ebp - 0x4e0], ebx
mov dword [ebp - 0x508], 0x28
mov dword [ebp - 0x504], edx
call dword [0x4234b4]
call esi
mov dword [ebp - 0xbdc], eax
test eax, eax
jne 0x417acf
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x418750
mov esi, dword [0x42103c]
mov ecx, esi
push eax
push dword [ebp - 0xbc8]
call dword [0x4234b4]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xb90], eax
jne 0x417b37
mov ecx, dword [ebp - 0xbc4]
test ecx, ecx
je 0x417b37
mov eax, dword [ebp - 0xbfc]
mov esi, dword [0x421074]
push ecx
mov dword [ebp - 0x53c], eax
mov ecx, esi
lea eax, [ebp - 0x544]
mov dword [ebp - 0x544], ebx
push eax
push dword [ebp - 0xbc8]
mov dword [ebp - 0x540], ebx
mov dword [ebp - 0x538], edi
call dword [0x4234b4]
call esi
mov eax, dword [ebp - 0x854]
mov esi, dword [ebp - 0x850]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0x844]
push 0x54
mov dword [ebp - 0xba8], eax
lea eax, [ebp - 0xa20]
push ebx
push eax
mov dword [ebp - 0xbb8], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa78]
push 0x54
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xba0], ebx
lea eax, [ebp - 0x4dc]
mov dword [ebp - 0xbb0], ebx
mov dword [ebp - 0xbd8], ebx
mov dword [ebp - 0xba4], ebx
push 0x2c
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x408]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x418735
mov edi, dword [ebp - 0xbc8]
mov esi, dword [0x421028]
mov ecx, esi
push 7
push edi
call dword [0x4234b4]
call esi
test eax, eax
jne 0x417be5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0x418735
mov esi, dword [0x421034]
lea ecx, [ebp - 0xa20]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4234b4]
call esi
test eax, eax
je 0x417c27
mov eax, dword [ebp - 0xa0c]
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0xa1c]
mov dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0xa18]
mov dword [ebp - 0xba4], eax
mov esi, dword [0x421008]
mov ecx, esi
push edi
call dword [0x4234b4]
call esi
mov ecx, eax
mov dword [ebp - 0xb8c], ecx
test ecx, ecx
je 0x417bda
mov eax, dword [ebp - 0x3bc]
sub eax, dword [ebp - 0xbb4]
mov edi, dword [ebp - 0xb9c]
sub edi, dword [ebp - 0xbd0]
mov esi, dword [0x42100c]
mov dword [ebp - 0x4d4], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xd00], ebx
mov word [ebp - 0x4d0], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x4ce], ax
lea eax, [ebp - 0xd00]
push eax
push ebx
lea eax, [ebp - 0x4dc]
mov dword [ebp - 0xbd4], ebx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x4cc], ebx
mov dword [ebp - 0x4c8], ebx
mov dword [ebp - 0x4c4], ebx
mov dword [ebp - 0x4c0], ebx
mov dword [ebp - 0x4bc], ebx
mov dword [ebp - 0x4b8], ebx
mov dword [ebp - 0x4b4], ebx
mov dword [ebp - 0x4dc], 0x28
mov dword [ebp - 0x4d8], edi
call dword [0x4234b4]
call esi
mov dword [ebp - 0xbe4], eax
test eax, eax
jne 0x417d1d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xbd4], eax
test eax, eax
jle 0x417d08
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xbd4], eax
test eax, eax
js 0x4180bd
mov dword [ebp - 0xbd4], 0x80004005
jmp 0x4180bd
mov esi, dword [0x421034]
lea ecx, [ebp - 0xa78]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4234b4]
call esi
test eax, eax
je 0x417d47
mov eax, dword [ebp - 0xa64]
mov dword [ebp - 0xbb0], eax
push dword [ebp - 0xbe4]
mov eax, dword [ebp - 0xbb4]
push dword [ebp - 0xb8c]
mov esi, dword [0x42103c]
mov ecx, esi
mov dword [ebp - 0x400], edi
mov edi, dword [ebp - 0x3bc]
sub eax, edi
mov dword [ebp - 0x3fc], eax
call dword [0x4234b4]
call esi
mov esi, dword [0x421040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xb8c]
call dword [0x4234b4]
call esi
push dword [ebp - 0xba8]
mov esi, dword [0x42103c]
mov ecx, esi
push dword [ebp - 0xb8c]
call dword [0x4234b4]
call esi
mov esi, dword [0x421038]
mov ecx, esi
push ebx
mov dword [ebp - 0xba8], eax
call dword [0x4234b4]
call esi
mov esi, dword [0x421074]
mov ecx, esi
push eax
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0xb8c]
call dword [0x4234b4]
call esi
mov esi, dword [0x42106c]
lea eax, [ebp - 0x408]
push ebx
push dword [ebp - 0xbf0]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xbb8]
push dword [ebp - 0xb8c]
call dword [0x4234b4]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xb90], eax
jne 0x417e4e
cmp dword [ebp - 0xbe0], 0
je 0x417e42
mov esi, dword [0x42108c]
mov ecx, esi
push 8
call dword [0x4234b4]
call esi
mov dword [ebp - 0xbec], eax
jmp 0x417e58
mov dword [ebp - 0xbec], 0xffffff
jmp 0x417e58
mov dword [ebp - 0xbec], 0xffa8a8a8
mov ecx, dword [ebp - 0xbd0]
mov edx, ebx
mov dword [ebp - 0xb9c], ebx
mov eax, ebx
test ecx, ecx
jns 0x417e78
mov edx, ecx
mov ecx, ebx
neg edx
mov dword [ebp - 0xb9c], edx
test edi, edi
jns 0x417e82
mov eax, edi
mov edi, ebx
neg eax
mov esi, dword [ebp - 0x400]
sub esi, edx
mov edx, dword [ebp - 0xbd8]
sub edx, ecx
mov dword [ebp - 0xbb4], esi
cmp esi, edx
jl 0x417ea4
mov esi, edx
mov dword [ebp - 0xbb4], edx
mov edx, dword [ebp - 0x3fc]
sub dword [ebp - 0xba4], edi
sub edx, eax
mov dword [ebp - 0xbcc], edx
cmp edx, dword [ebp - 0xba4]
jl 0x417ecc
mov edx, dword [ebp - 0xba4]
mov dword [ebp - 0xbcc], edx
test esi, esi
jle 0x418086
test edx, edx
jle 0x418086
imul edi, dword [ebp - 0xbd8]
mov ebx, dword [ebp - 0x400]
mov esi, dword [ebp - 0xbb0]
imul eax, ebx
shl ebx, 2
add edi, ecx
mov ecx, dword [ebp - 0xba0]
mov dword [ebp - 0xba0], ebx
mov ebx, dword [ebp - 0xbd8]
add eax, dword [ebp - 0xb9c]
shl ebx, 2
lea ecx, [ecx + edi*4]
mov dword [ebp - 0xbb8], ebx
mov ebx, dword [ebp - 0xba0]
mov edi, dword [ebp - 0xbb8]
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xbb4]
mov dword [ebp - 0xbe0], eax
mov dword [ebp - 0xbf8], ecx
test esi, esi
jle 0x418065
mov ebx, ecx
mov dword [ebp - 0xbb0], esi
lea edx, [ecx + 3]
sub ebx, eax
mov dword [ebp - 0xba4], edx
lea edi, [eax + 2]
mov dword [ebp - 0xb9c], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x418026
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xbec]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb9c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xba4]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xbec]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xba4]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xbea]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xba4]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xbb0]
cdq
idiv ecx
mov edx, dword [ebp - 0xba4]
add al, bl
mov ebx, dword [ebp - 0xb9c]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [ebp - 0xba4], edx
mov dword [ebp - 0xbb0], esi
jne 0x417f60
mov edx, dword [ebp - 0xbcc]
mov esi, dword [ebp - 0xbb4]
mov eax, dword [ebp - 0xbe0]
mov ecx, dword [ebp - 0xbf8]
mov ebx, dword [ebp - 0xba0]
mov edi, dword [ebp - 0xbb8]
add eax, ebx
add ecx, edi
sub edx, 1
mov dword [ebp - 0xbe0], eax
mov dword [ebp - 0xbf8], ecx
mov dword [ebp - 0xbcc], edx
jne 0x417f3c
xor ebx, ebx
push dword [ebp - 0xbe4]
mov esi, dword [0x42101c]
mov ecx, esi
call dword [0x4234b4]
call esi
mov eax, dword [ebp - 0xba8]
test eax, eax
je 0x4180bd
mov esi, dword [0x42103c]
mov ecx, esi
push eax
push dword [ebp - 0xb8c]
call dword [0x4234b4]
call esi
push dword [ebp - 0xb8c]
mov esi, dword [0x421018]
mov ecx, esi
call dword [0x4234b4]
call esi
cmp dword [ebp - 0xbd4], 0
jl 0x418735
mov eax, dword [ebp - 0x854]
mov esi, dword [ebp - 0x84c]
mov dword [ebp - 0xbb8], eax
mov eax, dword [ebp - 0x840]
push 0x54
mov dword [ebp - 0xba8], eax
lea eax, [ebp - 0x970]
push ebx
push eax
mov dword [ebp - 0xba0], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xad0]
push 0x54
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xbb0], ebx
lea eax, [ebp - 0x534]
mov dword [ebp - 0xb9c], ebx
mov dword [ebp - 0xbd0], ebx
mov dword [ebp - 0xba4], ebx
push 0x2c
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x3f8]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x418735
mov edi, dword [ebp - 0xbc8]
mov esi, dword [0x421028]
mov ecx, esi
push 7
push edi
call dword [0x4234b4]
call esi
test eax, eax
je 0x417bda
mov esi, dword [0x421034]
lea ecx, [ebp - 0x970]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4234b4]
call esi
test eax, eax
je 0x4181c9
mov eax, dword [ebp - 0x95c]
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp - 0x96c]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0x968]
mov dword [ebp - 0xba4], eax
mov esi, dword [0x421008]
mov ecx, esi
push edi
call dword [0x4234b4]
call esi
mov ecx, eax
mov dword [ebp - 0xb8c], ecx
test ecx, ecx
je 0x417bda
mov eax, dword [ebp - 0xbac]
sub eax, dword [ebp - 0xb94]
mov edi, dword [ebp - 0xb88]
mov esi, dword [0x42100c]
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0x530], eax
mov eax, edi
sub eax, dword [ebp - 0xbe8]
mov dword [ebp - 0x52c], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xd04], ebx
mov word [ebp - 0x528], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x526], ax
lea eax, [ebp - 0xd04]
push eax
push ebx
lea eax, [ebp - 0x534]
mov dword [ebp - 0xbd8], ebx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x524], ebx
mov dword [ebp - 0x520], ebx
mov dword [ebp - 0x51c], ebx
mov dword [ebp - 0x518], ebx
mov dword [ebp - 0x514], ebx
mov dword [ebp - 0x510], ebx
mov dword [ebp - 0x50c], ebx
mov dword [ebp - 0x534], 0x28
call dword [0x4234b4]
call esi
mov dword [ebp - 0xbe4], eax
test eax, eax
jne 0x4182cb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xbd8], eax
test eax, eax
jle 0x4182b6
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xbd8], eax
test eax, eax
js 0x41866e
mov dword [ebp - 0xbd8], 0x80004005
jmp 0x41866e
mov esi, dword [0x421034]
lea ecx, [ebp - 0xad0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x4234b4]
call esi
test eax, eax
je 0x4182f5
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0xb9c], eax
mov eax, dword [ebp - 0xbac]
push dword [ebp - 0xbe4]
mov esi, dword [0x42103c]
mov ecx, esi
push dword [ebp - 0xb8c]
mov dword [ebp - 0x3f0], eax
mov eax, dword [ebp - 0xbe8]
sub eax, edi
mov dword [ebp - 0x3ec], eax
call dword [0x4234b4]
call esi
mov esi, dword [0x421040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xb8c]
call dword [0x4234b4]
call esi
push dword [ebp - 0xba8]
mov esi, dword [0x42103c]
mov ecx, esi
push dword [ebp - 0xb8c]
call dword [0x4234b4]
call esi
mov esi, dword [0x421038]
mov ecx, esi
push ebx
mov dword [ebp - 0xba8], eax
call dword [0x4234b4]
call esi
mov esi, dword [0x421074]
mov ecx, esi
push eax
lea eax, [ebp - 0x3f8]
push eax
push dword [ebp - 0xb8c]
call dword [0x4234b4]
call esi
mov esi, dword [0x42106c]
lea eax, [ebp - 0x3f8]
push ebx
push dword [ebp - 0xbf0]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xba0]
push dword [ebp - 0xb8c]
call dword [0x4234b4]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xb90], eax
jne 0x418404
cmp dword [ebp - 0xbb8], 0
je 0x4183f8
mov esi, dword [0x42108c]
mov ecx, esi
push 8
call dword [0x4234b4]
call esi
mov edx, eax
mov dword [ebp - 0xb98], edx
mov dword [ebp - 0xbb4], edx
jmp 0x418415
mov dword [ebp - 0xbb4], 0xffffff
jmp 0x418415
mov eax, 0xffa8a8a8
mov dword [ebp - 0xb98], eax
mov dword [ebp - 0xbb4], eax
mov ecx, dword [ebp - 0xb94]
mov esi, ebx
mov eax, ebx
test ecx, ecx
jns 0x41842d
mov esi, ecx
mov dword [ebp - 0xb94], ebx
neg esi
test edi, edi
jns 0x418437
mov eax, edi
mov edi, ebx
neg eax
mov edx, dword [ebp - 0x3f0]
mov ecx, dword [ebp - 0xbd0]
sub edx, esi
sub ecx, dword [ebp - 0xb94]
mov dword [ebp - 0xba0], edx
cmp edx, ecx
jl 0x41845d
mov edx, ecx
mov dword [ebp - 0xba0], ecx
mov ecx, dword [ebp - 0x3ec]
sub dword [ebp - 0xba4], edi
sub ecx, eax
mov dword [ebp - 0xbcc], ecx
cmp ecx, dword [ebp - 0xba4]
jl 0x418485
mov ecx, dword [ebp - 0xba4]
mov dword [ebp - 0xbcc], ecx
test edx, edx
jle 0x418637
test ecx, ecx
jle 0x418637
mov ebx, dword [ebp - 0x3f0]
imul edi, dword [ebp - 0xbd0]
imul eax, ebx
shl ebx, 2
mov dword [ebp - 0xbb8], ebx
mov ebx, dword [ebp - 0xbd0]
add edi, dword [ebp - 0xb94]
add eax, esi
mov esi, dword [ebp - 0xb9c]
shl ebx, 2
mov dword [ebp - 0xbe0], ebx
mov ebx, dword [ebp - 0xbb8]
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xbb0]
mov dword [ebp - 0xbf8], eax
lea esi, [esi + edi*4]
mov edi, dword [ebp - 0xbe0]
mov dword [ebp - 0xbe8], esi
test edx, edx
jle 0x418616
lea ebx, [esi + 3]
mov dword [ebp - 0xbb0], edx
sub esi, eax
mov dword [ebp - 0xba4], ebx
lea edi, [eax + 2]
mov dword [ebp - 0xb9c], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x4185d7
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xb98]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb9c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xba4]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xb98]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xba4]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xbb2]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xba4]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xb9c]
cdq
idiv ecx
mov edx, dword [ebp - 0xbb0]
add al, bl
mov ebx, dword [ebp - 0xba4]
mov byte [ebx], al
add ebx, 4
add edi, 4
sub edx, 1
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xbb0], edx
jne 0x418511
mov ecx, dword [ebp - 0xbcc]
mov edx, dword [ebp - 0xba0]
mov eax, dword [ebp - 0xbf8]
mov esi, dword [ebp - 0xbe8]
mov ebx, dword [ebp - 0xbb8]
mov edi, dword [ebp - 0xbe0]
add eax, ebx
add esi, edi
sub ecx, 1
mov dword [ebp - 0xbf8], eax
mov dword [ebp - 0xbe8], esi
mov dword [ebp - 0xbcc], ecx
jne 0x4184ef
xor ebx, ebx
push dword [ebp - 0xbe4]
mov esi, dword [0x42101c]
mov ecx, esi
call dword [0x4234b4]
call esi
mov eax, dword [ebp - 0xba8]
test eax, eax
je 0x41866e
mov esi, dword [0x42103c]
mov ecx, esi
push eax
push dword [ebp - 0xb8c]
call dword [0x4234b4]
call esi
push dword [ebp - 0xb8c]
mov esi, dword [0x421018]
mov ecx, esi
call dword [0x4234b4]
call esi
cmp dword [ebp - 0xbd8], 0
jl 0x418735
xor eax, eax
inc eax
cmp dword [ebp - 0xb90], eax
jne 0x4186d9
mov esi, dword [section..data]
mov ecx, esi
push 0xcc0020
push ebx
push ebx
push dword [ebp - 0xbc8]
push dword [ebp - 0xbbc]
push dword [ebp - 0xbfc]
push dword [ebp - 0x830]
push dword [ebp - 0x834]
push dword [ebp - 0xbc0]
call dword [0x4234b4]
call esi
jmp 0x418719
push dword [ebp - 0xc10]
mov ecx, dword [ebp - 0xbbc]
mov eax, dword [ebp - 0xbfc]
mov esi, dword [0x421020]
push ecx
push eax
push ebx
push ebx
push dword [ebp - 0xbc8]
push ecx
push eax
push dword [ebp - 0x39c]
mov ecx, esi
push dword [ebp - 0x3a0]
push dword [ebp - 0xbc0]
call dword [0x4234b4]
call esi
push dword [ebp - 0xc0c]
mov esi, dword [0x421040]
mov ecx, esi
push dword [ebp - 0xbc0]
call dword [0x4234b4]
call esi
mov eax, dword [ebp - 0xbdc]
test eax, eax
je 0x418750
mov esi, dword [0x42101c]
mov ecx, esi
push eax
call dword [0x4234b4]
call esi
mov eax, dword [ebp - 0xbc8]
test eax, eax
je 0x41876b
mov esi, dword [0x421018]
mov ecx, esi
push eax
call dword [0x4234b4]
call esi
mov eax, dword [ebp - 0xbc4]
test eax, eax
je 0x418786
mov esi, dword [0x42101c]
mov ecx, esi
push eax
call dword [0x4234b4]
call esi
mov edi, 0x422cb8
mov ecx, dword [ebp - 0x850]
test ecx, ecx
je 0x4187da
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x418798
mov eax, dword [ebp - 0x850]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x4187c0
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x4187b8
push dword [ebp - 0x850]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x850], ebx
mov ecx, dword [ebp - 0x84c]
test ecx, ecx
je 0x418829
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4187e7
mov eax, dword [ebp - 0x84c]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x41880f
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x418807
push dword [ebp - 0x84c]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x84c], ebx
mov edx, dword [ebp - 0x848]
test edx, edx
je 0x418875
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x418838
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x418860
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0x418852
mov edx, dword [ebp - 0x848]
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x848], ebx
cmp dword [ebp - 0x844], 0
je 0x41889a
push dword [ebp - 0x844]
mov esi, dword [0x42101c]
mov ecx, esi
call dword [0x4234b4]
call esi
mov dword [ebp - 0x844], ebx
cmp dword [ebp - 0x840], 0
je 0x4188bf
push dword [ebp - 0x840]
mov esi, dword [0x42101c]
mov ecx, esi
call dword [0x4234b4]
call esi
mov dword [ebp - 0x840], ebx
cmp dword [ebp - 0x83c], 0
je 0x4188e4
push dword [ebp - 0x83c]
mov esi, dword [0x42101c]
mov ecx, esi
call dword [0x4234b4]
call esi
mov dword [ebp - 0x83c], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x4188e6
mov eax, dword [0x422cb4]
push 0
pop ebx
test eax, eax
jle 0x418948
sub eax, 1
mov dword [0x422cb4], eax
jne 0x418948
mov esi, ebx
mov eax, dword [esi + 0x4227c0]
test eax, eax
je 0x41891c
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x41890b
push 0x40
push ebx
push 0x4227c0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x401060
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x422cb8
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0x4227b0]
mov esi, dword [0x42104c]
mov ecx, esi
mov dword [ebp - 0xbf8], eax
call dword [0x4234b4]
call esi
sub eax, dword [0x422ca8]
lea edi, [ebp - 0x328]
push 8
mov dword [ebp - 0xbe0], eax
mov edx, 0x422cb8
xor eax, eax
xor ebx, ebx
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x418987
mov eax, dword [0x422cb4]
push 0
pop ebx
test eax, eax
jne 0x418fd3
push 0x338
mov edi, ebx
mov dword [ebp - 0xbcc], ebx
push ebx
mov dword [ebp - 0xc10], edi
mov dword [ebp - 0xbb8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xba0], eax
test eax, eax
je 0x418f6c
or dword [ebp - 0xb9c], 0xffffffff
mov eax, 0xab69605e
mov dword [ebp - 0x440], eax
mov cl, bl
movzx esi, word [ebp - 0x43e]
mov eax, 0x7f1137f
mov dword [ebp - 0x43c], eax
movzx edx, word [ebp - 0x43a]
movzx eax, ax
mov dword [ebp - 0xbb4], eax
mov eax, dword [ebp - 0xba0]
add eax, 7
mov dword [ebp - 0xbdc], ebx
mov dword [ebp - 0xc3c], ebx
mov dword [ebp - 0xc70], edi
mov dword [ebp - 0xbac], edx
mov dword [ebp - 0xb98], esi
mov dword [ebp - 0xbb0], eax
mov esi, dword [ebp - 0xc78]
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edx, byte [esi + 2]
shl edx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edx, eax
mov dword [ebp - 0xc0c], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl edx, 8
or edx, eax
mov dword [ebp - 0xbc4], edi
movzx eax, byte [esi + 5]
mov edi, 0x7f1137f
mov ebx, dword [ebp - 0xbc4]
add esi, 8
shl edx, 8
or edx, eax
mov dword [ebp - 0xc78], esi
xor edi, edx
mov esi, dword [ebp - 0xbb4]
xor edi, dword [ebp - 0xc3c]
mov dword [ebp - 0xba8], edx
xor edi, ebx
xor edi, 0xab69605e
mov eax, edi
rol eax, 0xa
lea edx, [edi + 0x54969fa2]
rol edx, 5
imul edx, esi
add edx, eax
xor ebx, edx
mov edx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea edx, [ebx + edx]
ror edx, 9
imul edx, dword [ebp - 0xb98]
sub edx, eax
xor edi, edx
mov eax, edi
sub eax, esi
imul edx, eax, 0x605e
mov eax, edi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xb98]
rol edx, 6
imul edx, dword [ebp - 0xbac]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor edi, edx
mov edx, edi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, esi
ror edx, 6
imul eax, dword [ebp - 0xb98]
xor edx, eax
mov eax, 0x7f1137f
xor edi, edx
add eax, edi
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, edi
rol eax, 2
add edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 8
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
imul edx, dword [ebp - 0xbac]
sub edx, eax
xor edi, edx
mov edx, edi
mov eax, edi
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, esi
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xbac]
imul edx, dword [ebp - 0xb98]
shr eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xbac]
xor ebx, eax
mov esi, ebx
sub esi, dword [ebp - 0xbac]
xor esi, edi
xor esi, 0xab69605e
mov edx, esi
mov eax, esi
xor edx, dword [ebp - 0xbac]
rol edx, 2
imul edx, dword [ebp - 0xbb4]
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, eax
mov eax, ebx
ror edx, 6
imul edx, dword [ebp - 0xb98]
rol eax, 7
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, dword [ebp - 0xbb4]
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
xor ebx, edx
mov edx, ebx
mov dword [ebp - 0xbc4], ebx
xor edx, dword [ebp - 0xb98]
mov eax, ebx
rol edx, 5
imul edx, dword [ebp - 0xbac]
rol eax, 7
add edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov ebx, edx
xor ebx, esi
xor ebx, dword [ebp - 0xbc4]
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xb98]
imul eax, dword [ebp - 0xbb4]
xor esi, eax
mov eax, esi
sub eax, edx
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [ebp - 0xbac]
add edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xbb4]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
shr eax, 3
xor edx, 0x605e
imul edx, dword [ebp - 0xb98]
xor edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov eax, esi
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xb9c]
rol eax, 2
mov dword [ebp - 0xc3c], esi
xor edx, eax
xor edx, dword [ebp - 0xbdc]
xor ebx, edx
mov edx, dword [ebp - 0xbb0]
mov dword [ebp - 0xc70], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xc3c]
ror dword [ebp - 0xc70], 8
mov byte [edx], al
mov al, byte [ebp - 0xc70]
ror dword [ebp - 0xc3c], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xc3c]
ror dword [ebp - 0xc70], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xc70]
ror dword [ebp - 0xc3c], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xc3c]
ror dword [ebp - 0xc70], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xc70]
ror dword [ebp - 0xc3c], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xc3c]
mov byte [edx - 3], al
add edx, 8
mov edi, dword [ebp - 0xc70]
mov eax, dword [ebp - 0xc0c]
ror dword [ebp - 0xc3c], 8
ror edi, 8
sub dword [ebp - 0xc38], 1
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0xc70], edi
mov dword [ebp - 0xb9c], eax
mov dword [ebp - 0xbb0], edx
jne 0x418a3c
mov esi, dword [ebp - 0xba0]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x418daf
movzx eax, cl
cdq
cmp eax, dword [0x402a80]
jne 0x418dda
cmp edx, dword [0x402a84]
jne 0x418dda
mov edi, esi
mov dword [ebp - 0xc10], esi
mov esi, ebx
jmp 0x418ded
or dword [ebp - 0xbf4], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xbb8], 0xc004d501
test esi, esi
je 0x418e00
push esi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xbb8], ebx
jl 0x418f66
mov eax, dword [ebp - 0xbf4]
mov esi, edi
push 0x40
push ebx
push 0x4227c0
mov byte [eax + edi], bl
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], bl
je 0x418f73
mov edi, 0x4227c0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xc0c], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x418e41
sub ecx, dword [ebp - 0xc0c]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0x418f5f
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xb98], ecx
cmp word [eax], dx
je 0x418e89
mov ecx, 0xc000007b
mov dword [ebp - 0xb98], ecx
jmp 0x418ed1
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x418e7c
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x418e7c
cmp dword [edx], 0x4550
jne 0x418e7c
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc7c]
je 0x418ebf
cmp ax, word [ebp - 0xc18]
je 0x418ebf
mov ecx, 0xc000000d
jmp 0x418e81
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xc38], eax
mov dword [ebp - 0xbf4], ebx
test eax, eax
je 0x418f4c
mov edx, esi
mov dword [ebp - 0xba8], esi
lea eax, [edx + 1]
mov dword [ebp - 0xc0c], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x418ef8
sub edx, dword [ebp - 0xc0c]
inc esi
add esi, edx
test ecx, ecx
js 0x418f31
push dword [ebp - 0xba8]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0x418f57
mov ecx, dword [ebp - 0xbcc]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xb98]
mov eax, dword [ebp - 0xbf4]
inc dword [ebp - 0xbcc]
inc eax
mov dword [ebp - 0xbf4], eax
cmp eax, dword [ebp - 0xc38]
jb 0x418ee7
add edi, 0x10
cmp byte [esi], bl
jne 0x418e34
mov esi, dword [ebp - 0xb98]
jmp 0x418f75
mov esi, 0xc000007a
jmp 0x418f75
mov edi, dword [ebp - 0xc10]
mov esi, 0xc000007a
jmp 0x418f7b
mov esi, ebx
mov edi, dword [ebp - 0xc10]
test edi, edi
je 0x418f8e
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
jns 0x418fce
mov esi, ebx
mov eax, dword [esi + 0x4227c0]
test eax, eax
je 0x418fa5
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x418f94
push 0x40
push ebx
push 0x4227c0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x401060
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x418fd9
mov eax, dword [0x422cb4]
inc eax
mov dword [0x422cb4], eax
xor eax, eax
mov edi, 0x422cb8
xchg dword [edi], eax
mov eax, dword [ebp - 0xbe0]
xor ecx, ecx
mov esi, dword [0x421068]
inc ecx
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0xbf8]
mov dword [ebp - 0x30c], eax
lea eax, [ebp - 0x328]
push eax
push 4
push 0x2021
mov dword [ebp - 0x328], ecx
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x314], ecx
mov dword [ebp - 0x318], ecx
mov dword [ebp - 0x310], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x31c], 0x9966f291
call dword [0x4234b4]
call esi
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x419046
mov eax, dword [0x422cb4]
push 0
pop ebx
test eax, eax
jle 0x4190a8
sub eax, 1
mov dword [0x422cb4], eax
jne 0x4190a8
mov esi, ebx
mov eax, dword [esi + 0x4227c0]
test eax, eax
je 0x41907c
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x41906b
push 0x40
push ebx
push 0x4227c0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x401060
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x422cb8
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xbc0]
mov esi, dword [0x4210b0]
mov ecx, esi
push ebx
call dword [0x4234b4]
call esi
lea ecx, [ebp - 0xd08]
call fcn.0041d684
xor eax, eax
mov dword [ebp - 0xba0], ebx
lea edi, [ebp - 0xc2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xcdc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xc0c], esi
test esi, esi
je 0x41abe2
push edi
push 0x421710
push esi
call sub.msvcrt.dll_memcpy
mov edi, esi
add esp, 0xc
mov dword [ebp - 0xb90], edi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x41ab57
mov ecx, dword [0x421708]
mov dword [esi], ecx
mov ecx, dword [0x42170c]
mov dword [esi + 4], ecx
mov dword [ebp - 0xba0], esi
rdtsc
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0xbf4], edx
mov eax, 0xc4
push eax
push 8
mov dword [ebp - 0xc28], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x41ab57
mov dword [ebp - 0xc24], edx
mov dword [ebp - 0xc2c], ebx
lea edi, [edx + 4]
cmp edi, edx
jb 0x41ab51
mov ecx, dword [ebp - 0xc28]
lea eax, [edx + 8]
add ecx, edx
cmp eax, ecx
ja 0x41ab51
push 4
pop eax
mov dword [edx], eax
mov dword [edi], eax
mov edi, dword [ebp - 0xc2c]
inc edi
mov dword [ebp - 0xc2c], edi
cmp dword [ebp - 0xc24], 0
jne 0x4191f7
mov eax, dword [ebp - 0xc28]
lea ecx, [eax + 0xa4]
cmp ecx, eax
jb 0x41ab51
lea eax, [edi + 1]
mov dword [ebp - 0xc28], ecx
mov dword [ebp - 0xc2c], eax
jmp 0x41926a
mov edx, dword [ebp - 0xc24]
mov ecx, ebx
test edi, edi
je 0x419222
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x41ab51
add eax, edx
cmp eax, edx
jb 0x41ab51
inc ecx
mov edx, eax
cmp ecx, edi
jb 0x419203
lea edi, [edx + 4]
cmp edi, edx
jb 0x41ab51
mov ecx, dword [ebp - 0xc28]
lea eax, [edx + 0xa4]
add ecx, dword [ebp - 0xc24]
cmp eax, ecx
ja 0x41ab51
mov eax, 0xa0
push eax
push dword [ebp - 0xc0c]
mov dword [edx], eax
push edi
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xc28]
add esp, 0xc
inc dword [ebp - 0xc2c]
cmp dword [ebp - 0xc24], 0
jne 0x419286
lea eax, [ecx + 0xc]
cmp eax, ecx
jb 0x41ab51
inc dword [ebp - 0xc2c]
jmp 0x419302
cmp dword [ebp - 0xc2c], 0
mov edi, ebx
mov edx, dword [ebp - 0xc24]
jbe 0x4192ba
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x41ab51
add eax, edx
cmp eax, edx
jb 0x41ab51
inc edi
mov edx, eax
cmp edi, dword [ebp - 0xc2c]
jb 0x419297
lea edi, [edx + 4]
cmp edi, edx
jb 0x41ab51
add ecx, dword [ebp - 0xc24]
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0x41ab51
mov dword [edx], 8
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0xc2c]
inc eax
mov dword [ebp - 0xc2c], eax
cmp dword [ebp - 0xc24], 0
jne 0x419315
mov eax, dword [ebp - 0xc28]
lea ecx, [eax + 0xc]
cmp ecx, eax
jb 0x41ab51
mov dword [ebp - 0xc28], ecx
jmp 0x419383
mov edx, dword [ebp - 0xc24]
mov ecx, ebx
test eax, eax
je 0x419344
mov eax, dword [edx]
add eax, 4
cmp eax, 4
jb 0x41ab51
add eax, edx
cmp eax, edx
jb 0x41ab51
inc ecx
mov edx, eax
cmp ecx, dword [ebp - 0xc2c]
jb 0x419321
lea esi, [edx + 4]
cmp esi, edx
jb 0x41ab51
mov ecx, dword [ebp - 0xc28]
lea eax, [edx + 0xc]
add ecx, dword [ebp - 0xc24]
cmp eax, ecx
ja 0x41ab51
mov eax, dword [ebp - 0xba8]
mov dword [edx], 8
mov dword [esi], eax
mov eax, dword [ebp - 0xbf4]
mov dword [esi + 4], eax
mov ecx, dword [ebp - 0xc28]
inc dword [ebp - 0xc2c]
rdtsc
mov edi, ebx
mov dword [ebp - 0xbec], ebx
mov dword [ebp - 0xbb4], ebx
mov dword [ebp - 0xbb0], edi
mov dword [ebp - 0xbe8], ebx
mov dword [ebp - 0xb9c], ebx
mov dword [ebp - 0xbf0], ebx
mov dword [ebp - 0xbe4], ebx
mov dword [ebp - 0xbfc], ebx
mov dword [ebp - 0xbcc], ebx
mov dword [ebp - 0xc0c], eax
mov dword [ebp - 0xba8], edx
add ecx, 8
cmp ecx, 8
jb 0x41949f
lea eax, [ecx + 7]
and eax, 0xfffffff8
mov dword [ebp - 0xbf4], eax
cmp eax, ecx
jb 0x41949f
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xc38], ecx
test ecx, ecx
jne 0x419415
mov esi, 0xc0000017
jmp 0x4194a4
mov eax, dword [ebp - 0xc2c]
lea edx, [ecx + 4]
mov dword [ecx], eax
cmp edx, ecx
jb 0x419485
mov eax, dword [ebp - 0xc28]
mov dword [edx], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x419485
mov eax, dword [ebp - 0xbf4]
mov esi, ebx
mov edi, dword [ebp - 0xc0c]
mov dword [ecx + eax - 8], edi
mov edi, dword [ebp - 0xba8]
mov dword [ecx + eax - 4], edi
lea eax, [edx + 4]
push dword [ebp - 0xc28]
push dword [ebp - 0xc24]
push eax
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xc38]
add esp, 0xc
mov eax, dword [ebp - 0xbf4]
mov edi, ebx
mov dword [ebp - 0xbec], ecx
mov ecx, ebx
mov dword [ebp - 0xbb4], eax
jmp 0x41948a
mov esi, 0xc0000095
test ecx, ecx
je 0x4194a4
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0x4194a4
mov esi, 0xc0000095
or esi, 0x10000000
jl 0x41a9a5
cmp dword [ebp - 0xbec], 0
mov dword [ebp - 0xb94], ebx
jne 0x4194c9
mov esi, 0xc000000d
jmp 0x419b65
mov esi, dword [ebp - 0xbb4]
test esi, esi
je 0x419b60
lea eax, [esi + 8]
push eax
push ebx
mov dword [ebp - 0xc0c], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xc18], eax
test eax, eax
je 0x419b60
mov edi, dword [ebp - 0xbec]
mov cl, bl
mov eax, ebx
test esi, esi
je 0x419513
xor cl, byte [eax + edi]
inc eax
cmp eax, esi
jb 0x41950b
mov eax, 0xb1b54a58
mov dword [ebp - 0xc5c], ebx
mov dword [ebp - 0x438], eax
mov eax, 0xc81ecb17
mov dword [ebp - 0x434], eax
or eax, 0xffffffff
mov dword [ebp - 0xb88], eax
mov dword [ebp - 0xc60], eax
mov eax, esi
shr eax, 3
mov dword [ebp - 0xbdc], eax
test eax, eax
je 0x419986
movzx edx, word [ebp - 0x436]
mov eax, 0xc81ecb17
movzx esi, ax
movzx eax, word [ebp - 0x432]
mov dword [ebp - 0xb8c], eax
mov eax, 0xb1b54a58
movzx eax, ax
mov dword [ebp - 0xbbc], eax
mov eax, dword [ebp - 0xc18]
add eax, 7
mov dword [ebp - 0xb98], edx
mov edx, dword [ebp - 0xb88]
mov dword [ebp - 0xbc4], eax
lea eax, [edi + 2]
mov dword [ebp - 0xbc8], esi
mov dword [ebp - 0xbf4], eax
mov dword [ebp - 0xc38], ebx
mov dword [ebp - 0xc78], ebx
mov ebx, dword [ebp - 0xbf4]
movzx edi, byte [ebx - 2]
movzx eax, byte [ebx - 1]
movzx esi, byte [ebx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [ebx]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 3]
or esi, eax
movzx eax, byte [ebx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [ebx + 5]
add ebx, 8
shl esi, 8
or esi, eax
mov dword [ebp - 0xbf4], ebx
xor edx, esi
mov eax, 0xc81ecb17
mov ebx, edx
mov dword [ebp - 0xb88], edx
sub ebx, dword [ebp - 0xbbc]
xor ebx, edi
xor ebx, dword [ebp - 0xc5c]
xor ebx, eax
mov edx, ebx
xor edx, eax
mov eax, ebx
ror edx, 0xf
imul edx, dword [ebp - 0xb98]
ror eax, 7
add edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, 0xb1b54a58
add edx, eax
mov dword [ebp - 0xb88], eax
ror edx, 9
imul edx, dword [ebp - 0xbc8]
ror eax, 0xa
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xbc8]
xor edx, ebx
mov eax, ebx
rol edx, 4
imul edx, dword [ebp - 0xb8c]
rol eax, 5
add edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, 0xb1b54a58
xor edx, eax
mov dword [ebp - 0xb88], eax
mov eax, 0xc81ecb17
sub eax, edx
xor ebx, eax
mov edx, ebx
mov eax, ebx
sub edx, dword [ebp - 0xbbc]
imul edx, dword [ebp - 0xb98]
shr eax, 6
sub edx, eax
xor dword [ebp - 0xb88], edx
mov edx, dword [ebp - 0xb88]
mov eax, edx
ror eax, 0xf
xor eax, dword [ebp - 0xbc8]
imul eax, dword [ebp - 0xbbc]
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, dword [ebp - 0xb8c]
imul eax, dword [ebp - 0xbc8]
xor edx, eax
mov eax, dword [ebp - 0xb8c]
mov dword [ebp - 0xb88], edx
sub edx, dword [ebp - 0xbbc]
sub edx, 0xc81ecb17
xor ebx, edx
xor eax, ebx
mov edx, ebx
imul eax, dword [ebp - 0xb98]
ror edx, 0xa
xor edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, dword [ebp - 0xbbc]
xor edx, eax
mov dword [ebp - 0xb88], eax
rol edx, 6
imul edx, dword [ebp - 0xbc8]
ror eax, 3
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb8c]
mov eax, ebx
ror eax, 0xf
sub eax, edx
imul eax, dword [ebp - 0xbbc]
xor dword [ebp - 0xb88], eax
mov eax, dword [ebp - 0xb88]
xor edx, eax
imul edx, dword [ebp - 0xbbc]
shr eax, 1
xor edx, eax
mov eax, dword [ebp - 0xb88]
xor ebx, edx
mov edx, eax
sub edx, dword [ebp - 0xbc8]
rol edx, 3
imul edx, dword [ebp - 0xbbc]
shr eax, 0xf
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
sub edx, dword [ebp - 0xbc8]
imul edx, dword [ebp - 0xb98]
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0xb88], eax
ror edx, 9
imul edx, dword [ebp - 0xbc8]
ror eax, 0xb
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb88]
mov eax, ebx
sub eax, dword [ebp - 0xb8c]
sub eax, 0xb1b54a58
xor edx, eax
mov eax, dword [ebp - 0xb98]
mov dword [ebp - 0xb88], edx
xor eax, dword [ebp - 0xb88]
imul eax, dword [ebp - 0xbbc]
ror edx, 7
sub eax, edx
mov edx, dword [ebp - 0xb8c]
xor ebx, eax
xor edx, ebx
mov eax, ebx
rol edx, 4
imul edx, dword [ebp - 0xb98]
ror eax, 0x10
sub edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, 0xb1b54a58
mov dword [ebp - 0xb88], eax
sub edx, eax
ror edx, 0xa
imul edx, dword [ebp - 0xbc8]
ror eax, 4
add edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, dword [ebp - 0xb8c]
xor edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb88], eax
xor edx, 0xc81ecb17
rol eax, 2
rol edx, 8
imul edx, dword [ebp - 0xbbc]
sub edx, eax
xor ebx, edx
mov edx, 0xc81ecb17
sub edx, ebx
mov eax, ebx
ror eax, 0xc
ror edx, 0xb
imul edx, dword [ebp - 0xb98]
sub edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb88], eax
xor edx, dword [ebp - 0xb98]
imul edx, dword [ebp - 0xbc8]
shr eax, 8
xor edx, eax
mov eax, 0xc81ecb17
xor eax, 0xb1b54a58
xor ebx, edx
xor eax, dword [ebp - 0xb88]
xor eax, ebx
xor ebx, dword [ebp - 0xc38]
xor eax, dword [ebp - 0xc78]
mov dword [ebp - 0xc60], eax
mov eax, dword [ebp - 0xbc4]
mov dword [ebp - 0xc5c], ebx
mov dword [ebp - 0xc38], edi
mov dword [ebp - 0xc78], esi
mov byte [eax - 4], bl
mov al, byte [ebp - 0xc60]
mov ebx, dword [ebp - 0xbc4]
ror dword [ebp - 0xc5c], 8
mov byte [ebx], al
ror dword [ebp - 0xc60], 8
mov al, byte [ebp - 0xc5c]
mov byte [ebx - 5], al
mov al, byte [ebp - 0xc60]
ror dword [ebp - 0xc5c], 8
mov byte [ebx - 1], al
ror dword [ebp - 0xc60], 8
mov al, byte [ebp - 0xc5c]
mov byte [ebx - 6], al
mov al, byte [ebp - 0xc60]
ror dword [ebp - 0xc5c], 8
mov byte [ebx - 2], al
ror dword [ebp - 0xc60], 8
mov al, byte [ebp - 0xc5c]
mov byte [ebx - 7], al
mov al, byte [ebp - 0xc60]
mov byte [ebx - 3], al
add ebx, 8
mov edx, dword [ebp - 0xc60]
ror dword [ebp - 0xc5c], 8
ror edx, 8
sub dword [ebp - 0xbdc], 1
mov dword [ebp - 0xc60], edx
mov dword [ebp - 0xbc4], ebx
jne 0x4195b1
mov esi, dword [ebp - 0xbb4]
xor ebx, ebx
movzx eax, cl
mov ecx, dword [ebp - 0xc18]
cdq
mov dword [ecx + esi], eax
mov dword [ecx + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x4199b8
mov esi, 0xc0000017
jmp 0x419aba
mov esi, dword [ebp - 0xc0c]
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x4199dd
mov esi, 0xc0000017
jmp 0x419a59
mov dword [edi + 4], ecx
mov eax, dword [ebp - 0xc18]
push esi
push eax
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
pop esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0x4199d6
mov dword [edi + 0xc], eax
push 0xa0
push 0x421660
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [edi + 0x10], esi
push esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4199d6
mov dword [edi + 0x14], ecx
mov eax, dword [0x421700]
mov esi, ebx
mov dword [ecx], eax
mov eax, dword [0x421704]
mov dword [ebp - 0xb94], edi
mov edi, ebx
mov dword [ecx + 4], eax
test edi, edi
je 0x419aba
cmp dword [edi + 4], 0
je 0x419a77
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x419a91
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x419aab
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x419ad2
mov edi, dword [ebp - 0xb94]
mov dword [ebp - 0xbb0], edi
mov dword [ebp - 0xb94], ebx
jmp 0x419ad4
mov edi, ebx
push dword [ebp - 0xc18]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb94]
test eax, eax
je 0x419b65
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x419b11
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb94]
mov dword [eax + 4], ebx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0x419b30
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb94]
mov dword [eax + 0xc], ebx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x419b4f
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb94]
mov dword [eax + 0x14], ebx
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0x419b65
mov esi, 0xc0000001
or esi, 0x10000000
jl 0x41a9a5
mov eax, dword [edi]
mov esi, dword [edi + 0x10]
add eax, 4
mov ecx, dword [edi + 8]
cmp eax, 4
jb 0x419c92
lea edx, [eax + 4]
cmp edx, eax
jb 0x419c92
add ecx, edx
cmp ecx, edx
jb 0x419c92
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x419c92
lea ecx, [eax + esi]
mov dword [ebp - 0xc0c], ecx
cmp ecx, eax
jb 0x419c92
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xb8c], esi
test esi, esi
jne 0x419be1
mov esi, 0xc0000017
mov edx, 0xc0000095
jmp 0x419c99
mov eax, dword [edi]
mov dword [esi], eax
lea eax, [esi + 4]
cmp eax, esi
jb 0x419c6b
push dword [edi]
push dword [edi + 4]
push eax
call sub.msvcrt.dll_memcpy
mov edx, dword [edi]
lea ecx, [esi + 4]
add edx, ecx
add esp, 0xc
cmp edx, ecx
jb 0x419c6b
mov eax, dword [edi + 8]
lea esi, [edx + 4]
mov dword [edx], eax
cmp esi, edx
jb 0x419c6b
push dword [edi + 8]
push dword [edi + 0xc]
push esi
call sub.msvcrt.dll_memcpy
mov ecx, dword [edi + 8]
add esp, 0xc
add ecx, esi
cmp ecx, esi
jb 0x419c6b
mov eax, dword [edi + 0x10]
lea esi, [ecx + 4]
mov dword [ecx], eax
cmp esi, ecx
jb 0x419c6b
push dword [edi + 0x10]
push dword [edi + 0x14]
push esi
call sub.msvcrt.dll_memcpy
mov eax, dword [edi + 0x10]
add esp, 0xc
add eax, esi
cmp eax, esi
mov eax, dword [ebp - 0xb8c]
jb 0x419c71
mov ecx, dword [ebp - 0xc0c]
mov esi, ebx
mov dword [ebp - 0xbe8], eax
mov eax, ebx
mov dword [ebp - 0xb9c], ecx
jmp 0x419c76
mov eax, dword [ebp - 0xb8c]
mov esi, 0xc0000095
test eax, eax
je 0x419bd7
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0x419bd7
mov edx, 0xc0000095
mov esi, edx
or esi, 0x10000000
jl 0x41a9a5
cmp dword [ebp - 0xc24], 0
jne 0x419cb8
mov esi, 0xc000000d
jmp 0x419d54
xor eax, eax
inc eax
cmp dword [ebp - 0xc2c], eax
jbe 0x419cae
mov ecx, dword [ebp - 0xc24]
mov esi, ebx
mov edi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x419d52
lea ecx, [edi + eax]
cmp ecx, eax
jb 0x419d52
xor eax, eax
inc esi
inc eax
cmp esi, eax
jb 0x419ccb
mov eax, dword [ecx]
mov dword [ebp - 0xc0c], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x419d52
cmp dword [ebp - 0xc2c], 2
jbe 0x419cae
mov ecx, dword [ebp - 0xc24]
mov esi, ebx
mov edi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x419d52
lea ecx, [edi + eax]
cmp ecx, eax
jb 0x419d52
inc esi
cmp esi, 2
jb 0x419d03
mov esi, dword [ecx]
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x419d52
mov eax, dword [ebp - 0xc0c]
add eax, 0x30
cmp eax, 0x30
jb 0x419d52
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x419d52
lea edi, [ecx + esi]
cmp edi, ecx
jb 0x419d52
mov esi, ebx
cmp edi, 0x400000
jbe 0x419d56
mov esi, 0x8000ffff
jmp 0x41a9a5
mov esi, edx
mov edi, ebx
test esi, esi
js 0x41a9a5
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0x419d7b
mov esi, 0xd0000017
mov eax, ebx
jmp 0x419d86
mov dword [ebp - 0xbf0], eax
mov esi, 0x10000000
test esi, esi
js 0x41a9a5
mov ecx, dword [ebp - 0xbe8]
test ecx, ecx
jne 0x419da2
mov esi, 0x80070057
jmp 0x41a9a5
test eax, eax
je 0x419d98
mov dword [ebp - 0xd70], eax
lea eax, [ebp - 0xc90]
push eax
xor eax, eax
mov dword [ebp - 0xd74], ecx
mov ecx, dword [ebp - 0xb9c]
inc eax
push 0x40183c
push eax
mov dword [ebp - 0xd6c], ecx
mov dword [ebp - 0xd68], edi
mov dword [ebp - 0xd64], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0x419e04
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x419dfb
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x419e44
mov esi, 0x80004005
jmp 0x419e44
push 0x404720
push dword [ebp - 0xc90]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x419de4
push ebx
push 0x14
lea eax, [ebp - 0xd74]
mov ecx, esi
push eax
push 0x86
call dword [0x4234b4]
call esi
mov esi, eax
or esi, 0x10000000
jl 0x419e44
mov edi, dword [ebp - 0xd68]
cmp esi, 0xd0000023
jne 0x419e56
mov esi, 0x8007007a
jmp 0x41a9a5
test esi, esi
js 0x41a9a5
mov dword [ebp - 0xbb4], ebx
cmp edi, 4
jae 0x419e73
mov esi, 0xc000003e
jmp 0x41a194
mov eax, dword [ebp - 0xbf0]
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x41a18f
lea eax, [edi - 4]
cmp eax, esi
jb 0x419e69
lea edx, [ecx + esi]
mov dword [ebp - 0xbc4], edx
cmp edx, ecx
jb 0x41a18f
lea ecx, [esi + 4]
cmp ecx, 4
jb 0x41a18f
mov eax, edi
sub eax, ecx
cmp eax, 4
jb 0x419e69
mov ecx, dword [edx]
add edx, 4
mov dword [ebp - 0xc18], ecx
cmp edx, dword [ebp - 0xbc4]
jb 0x41a18f
lea eax, [esi + 4]
lea ecx, [eax + 4]
mov dword [ebp - 0xbf4], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0xc18]
jb 0x41a18f
mov eax, edi
sub eax, dword [ebp - 0xbf4]
cmp eax, ecx
jb 0x419e69
lea eax, [ecx + edx]
mov dword [ebp - 0xc0c], eax
cmp eax, edx
jb 0x41a18f
mov eax, dword [ebp - 0xbf4]
lea edx, [ecx + eax]
mov dword [ebp - 0xbf4], edx
cmp edx, eax
jb 0x41a18f
mov eax, edi
sub eax, edx
cmp eax, 4
jb 0x419e69
mov eax, dword [ebp - 0xc0c]
mov edx, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xba8], edx
mov dword [ebp - 0xc78], ecx
cmp ecx, eax
jb 0x41a18f
mov eax, dword [ebp - 0xbf4]
add eax, 4
mov dword [ebp - 0xc38], eax
cmp eax, dword [ebp - 0xbf4]
jb 0x41a18f
mov eax, edi
sub eax, dword [ebp - 0xc38]
cmp eax, edx
jb 0x419e69
mov eax, dword [ebp - 0xc38]
lea ecx, [edx + eax]
mov dword [ebp - 0xc0c], ecx
cmp ecx, eax
mov ecx, dword [ebp - 0xc18]
jb 0x41a18f
mov eax, edi
sub eax, dword [ebp - 0xc0c]
jne 0x419e69
lea eax, [ecx + 0xc]
add eax, edx
add eax, esi
cmp eax, edi
jne 0x419e69
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x419fce
mov esi, 0xc0000017
jmp 0x41a112
mov eax, dword [ebp - 0xbf0]
add eax, 4
je 0x41a014
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x419ffb
mov esi, 0xc0000017
jmp 0x41a0b1
mov dword [edi + 4], ecx
mov edx, dword [ebp - 0xbf0]
push esi
lea eax, [edx + 4]
push eax
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x41a019
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov eax, dword [ebp - 0xbc4]
add eax, 4
je 0x41a05c
mov esi, dword [ebp - 0xc18]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x419ff1
mov dword [edi + 0xc], edx
mov eax, dword [ebp - 0xbc4]
push esi
add eax, 4
push eax
push edx
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x41a062
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
cmp dword [ebp - 0xc78], 0
je 0x41a0a1
mov esi, dword [ebp - 0xba8]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0x419ff1
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xc78]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x41a0a7
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [ebp - 0xbb4], edi
mov esi, ebx
mov edi, ebx
test edi, edi
je 0x41a112
cmp dword [edi + 4], 0
je 0x41a0cf
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x41a0e9
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x41a103
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x41a126
mov eax, dword [ebp - 0xbb4]
mov edi, ebx
mov dword [ebp - 0xbe4], eax
jmp 0x41a12c
mov edi, dword [ebp - 0xbb4]
test edi, edi
je 0x41a194
cmp dword [edi + 4], 0
je 0x41a14a
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x41a164
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x41a17e
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0x41a194
mov esi, 0xc0000095
or esi, 0x10000000
jl 0x41a9a5
mov ecx, dword [ebp - 0xbe4]
mov edi, ebx
mov dword [ebp - 0xbdc], ebx
test ecx, ecx
jne 0x41a1bc
mov esi, 0xd000000d
jmp 0x41a9a5
mov eax, dword [ecx + 4]
mov dword [ebp - 0xc78], eax
test eax, eax
je 0x41a1b2
mov esi, dword [ecx]
test esi, esi
je 0x41a1b2
add esi, 0xfffffff8
push esi
push ebx
mov dword [ebp - 0xc7c], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xc38], eax
test eax, eax
je 0x41a836
mov ecx, 0xab69605e
mov edi, esi
mov dword [ebp - 0x430], ecx
mov ecx, 0x7f1137f
mov dword [ebp - 0x42c], ecx
mov dl, bl
mov ecx, dword [ebp - 0xc78]
mov dword [ebp - 0xbb4], ecx
mov ecx, eax
mov dword [ebp - 0xbac], ecx
mov eax, ebx
and edi, 7
je 0x41a7d1
or dword [ebp - 0xc1c], 0xffffffff
mov esi, ebx
mov dword [ebp - 0xc30], ebx
mov dword [ebp - 0xc18], ebx
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xbc4], ebx
test edi, edi
je 0x41a2b4
mov ebx, dword [ebp - 0xbb4]
push 0x38
pop ecx
movzx eax, byte [ebx]
inc ebx
cmp dword [ebp - 0xbc4], 4
jge 0x41a27c
add ecx, 0xffffffe0
shl eax, cl
or dword [ebp - 0xbc8], eax
mov ecx, dword [ebp - 0xc14]
jmp 0x41a280
shl eax, cl
or esi, eax
mov eax, dword [ebp - 0xbc4]
sub ecx, 8
inc eax
mov dword [ebp - 0xc14], ecx
mov dword [ebp - 0xbc4], eax
cmp eax, edi
jl 0x41a25c
mov ecx, dword [ebp - 0xbac]
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0xbb4], ebx
xor ebx, ebx
mov dword [ebp - 0xc18], esi
xor eax, 0x92f65a5
mov dword [ebp - 0xbc4], ebx
xor esi, 0x699a899c
mov dword [ebp - 0xc10], eax
mov dword [ebp - 0xc30], eax
mov dword [ebp - 0xc1c], esi
test edi, edi
je 0x41a348
cmp dword [ebp - 0xbc4], 4
lea ebx, [ecx + 1]
mov ecx, dword [ebp - 0xbac]
mov dword [ebp - 0xbf4], ebx
jge 0x41a2fe
rol eax, 8
mov dword [ebp - 0xc14], eax
jmp 0x41a307
rol esi, 8
mov dword [ebp - 0xc14], esi
mov ebx, dword [ebp - 0xc14]
mov byte [ecx], bl
mov ebx, dword [ebp - 0xbc4]
mov ecx, dword [ebp - 0xbf4]
inc ebx
mov dword [ebp - 0xbc4], ebx
mov dword [ebp - 0xbac], ecx
cmp ebx, edi
jl 0x41a2db
mov esi, dword [ebp - 0xc1c]
mov eax, ecx
mov dword [ebp - 0xbac], eax
xor ebx, ebx
mov eax, dword [ebp - 0xc30]
mov dword [ebp - 0xc10], eax
cmp edi, 4
jbe 0x41a7a0
push 8
pop ecx
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0xba4], esi
mov dword [ebp - 0xc1c], esi
mov esi, dword [ebp - 0xc7c]
mov eax, esi
shr eax, 3
mov dword [ebp - 0xbf4], eax
test eax, eax
je 0x41a769
movzx ecx, word [ebp - 0x42a]
mov eax, 0x7f1137f
movzx esi, word [ebp - 0x42e]
mov edi, dword [ebp - 0xbb4]
mov ebx, dword [ebp - 0xc10]
movzx eax, ax
mov dword [ebp - 0xb98], eax
mov dword [ebp - 0xbc0], ecx
mov ecx, 0xab69605e
movzx eax, cx
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0xbac]
add eax, 7
mov dword [ebp - 0xb94], esi
mov esi, dword [ebp - 0xba4]
add edi, 2
mov dword [ebp - 0xc14], eax
mov dword [ebp - 0xbac], edi
movzx ecx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ecx, 8
or ecx, eax
shl edi, 8
mov eax, dword [ebp - 0xbac]
xor ebx, ecx
mov dword [ebp - 0xc0c], ecx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xbac]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xbac]
shl edi, 8
add dword [ebp - 0xbac], 8
movzx eax, byte [eax + 5]
or edi, eax
mov eax, 0xab69605e
xor esi, edi
mov dword [ebp - 0xba4], esi
mov esi, 0x7f1137f
xor esi, eax
xor esi, dword [ebp - 0xba4]
xor esi, ebx
mov ecx, esi
sub ecx, eax
mov eax, esi
rol ecx, 5
imul ecx, dword [ebp - 0xb98]
rol eax, 0xa
add ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea ecx, [ecx + ebx]
ror ecx, 9
imul ecx, dword [ebp - 0xb94]
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
sub ecx, dword [ebp - 0xb98]
imul ecx, dword [ebp - 0xb8c]
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xb94]
xor ecx, ebx
mov eax, ebx
rol ecx, 6
imul ecx, dword [ebp - 0xbc0]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, 0xab69605e
sub eax, ecx
xor ebx, eax
mov eax, dword [ebp - 0xb98]
xor eax, ebx
mov ecx, ebx
imul eax, dword [ebp - 0xb94]
ror ecx, 6
xor ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov eax, esi
lea ecx, [ecx + esi]
ror ecx, 0xf
imul ecx, dword [ebp - 0xb8c]
rol eax, 2
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0xbc0]
sub ecx, eax
xor esi, ecx
mov ecx, 0xab69605e
xor ecx, esi
mov eax, esi
ror ecx, 0xc
imul ecx, dword [ebp - 0xb98]
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xbc0]
xor ecx, ebx
mov eax, ebx
imul ecx, dword [ebp - 0xb94]
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov ecx, dword [ebp - 0xbc0]
mov eax, esi
not eax
ror eax, 5
add eax, dword [ebp - 0xb8c]
imul eax, ecx
xor ebx, eax
mov eax, ebx
sub eax, ecx
xor eax, 0xab69605e
xor esi, eax
xor ecx, esi
mov eax, esi
rol ecx, 2
imul ecx, dword [ebp - 0xb98]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 6
imul ecx, dword [ebp - 0xb94]
rol eax, 7
add ecx, eax
mov eax, dword [ebp - 0xb98]
xor esi, ecx
xor eax, esi
mov ecx, esi
imul eax, dword [ebp - 0xb8c]
ror ecx, 9
add ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xb94]
xor ecx, ebx
mov dword [ebp - 0xc10], ebx
rol ecx, 5
mov eax, ebx
imul ecx, dword [ebp - 0xbc0]
mov ebx, 0xab69605e
rol eax, 7
add ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
xor ebx, esi
xor ebx, dword [ebp - 0xc10]
xor ebx, eax
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xb94]
imul eax, dword [ebp - 0xb98]
xor esi, eax
mov eax, 0x7f1137f
mov ecx, esi
sub ecx, eax
mov eax, esi
ror ecx, 1
imul ecx, dword [ebp - 0xb8c]
ror eax, 6
sub ecx, eax
xor ebx, ecx
mov ecx, 0xab69605e
mov eax, ebx
rol eax, 0xe
lea ecx, [ecx + ebx]
rol ecx, 3
imul ecx, dword [ebp - 0xbc0]
add ecx, eax
xor esi, ecx
mov ecx, 0xab69605e
mov eax, esi
ror eax, 0xe
lea ecx, [ecx + esi]
rol ecx, 0xf
imul ecx, dword [ebp - 0xb98]
sub ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xb8c]
xor ecx, ebx
mov eax, ebx
imul ecx, dword [ebp - 0xb94]
shr eax, 3
xor ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, eax
mov eax, esi
xor esi, dword [ebp - 0xc18]
rol ecx, 4
imul ecx, dword [ebp - 0xb8c]
rol eax, 2
mov dword [ebp - 0xc1c], esi
mov dword [ebp - 0xc18], edi
mov edi, dword [ebp - 0xbac]
xor ecx, eax
xor ecx, dword [ebp - 0xbc8]
xor ebx, ecx
mov ecx, dword [ebp - 0xc14]
mov dword [ebp - 0xc30], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xc1c]
ror dword [ebp - 0xc30], 8
mov byte [ecx], al
mov al, byte [ebp - 0xc30]
ror dword [ebp - 0xc1c], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xc1c]
ror dword [ebp - 0xc30], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xc30]
ror dword [ebp - 0xc1c], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xc1c]
ror dword [ebp - 0xc30], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xc1c], 8
mov al, byte [ebp - 0xc30]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xc1c]
mov byte [ecx - 3], al
add ecx, 8
mov ebx, dword [ebp - 0xc30]
mov esi, dword [ebp - 0xc1c]
mov eax, dword [ebp - 0xc0c]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xbf4], 1
mov dword [ebp - 0xc30], ebx
mov dword [ebp - 0xc1c], esi
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xc14], ecx
jne 0x41a3e2
mov esi, dword [ebp - 0xc7c]
xor ebx, ebx
mov ecx, dword [ebp - 0xc38]
mov eax, ebx
test esi, esi
je 0x41a77d
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0x41a775
mov edi, dword [ebp - 0xc78]
movzx eax, dl
cdq
cmp eax, dword [esi + edi]
jne 0x41a7fd
cmp edx, dword [esi + edi + 4]
jne 0x41a7fd
mov edi, ecx
mov dword [ebp - 0xbdc], esi
mov ecx, ebx
mov esi, ebx
jmp 0x41a804
mov ecx, ebx
mov dword [ebp - 0xba4], ecx
mov dword [ebp - 0xc1c], ecx
jae 0x41a369
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xc10], eax
mov dword [ebp - 0xc30], eax
jmp 0x41a369
or dword [ebp - 0xc18], 0xffffffff
mov ecx, ebx
mov dword [ebp - 0xbc8], ebx
mov dword [ebp - 0xba4], ecx
mov dword [ebp - 0xc1c], ecx
mov dword [ebp - 0xc10], eax
mov dword [ebp - 0xc30], eax
jmp 0x41a36f
mov esi, 0xc004d501
mov edi, ebx
test ecx, ecx
je 0x41a817
push ecx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x41a836
mov eax, dword [ebp - 0xbdc]
mov esi, 0x10000000
mov dword [ebp - 0xbfc], edi
mov edi, ebx
mov dword [ebp - 0xbcc], eax
jmp 0x41a83b
mov esi, 0xd0000001
test edi, edi
je 0x41a84e
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x41a9a5
mov eax, dword [ebp - 0xbcc]
cmp eax, 4
jae 0x41a86b
mov esi, 0xc000003e
jmp 0x41a99f
mov edx, dword [ebp - 0xbfc]
mov ecx, dword [edx]
mov dword [ebp - 0xc0c], ecx
lea ecx, [edx + 4]
cmp ecx, edx
jb 0x41a99a
add eax, 0xfffffffc
cmp eax, 4
jb 0x41a861
mov edi, dword [ecx]
lea esi, [ecx + 4]
cmp esi, ecx
jb 0x41a99a
mov ecx, dword [ebp - 0xbcc]
lea eax, [ecx - 8]
cmp eax, edi
jb 0x41a861
lea eax, [edi + 8]
cmp eax, 8
jb 0x41a99a
mov eax, dword [ebp - 0xbfc]
lea edx, [esi + edi]
add eax, ecx
cmp eax, edx
jb 0x41a861
sub ecx, esi
sub ecx, edi
add ecx, dword [ebp - 0xbfc]
cmp ecx, 8
jae 0x41a861
mov dword [ebp - 0xbc4], ebx
mov eax, ebx
mov dword [ebp - 0xc14], eax
test esi, esi
je 0x41a927
mov ecx, esi
cmp edx, esi
jb 0x41a99a
jbe 0x41a923
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x41a99a
cmp eax, edx
ja 0x41a94c
mov eax, dword [ecx]
add eax, 4
cmp eax, 4
jb 0x41a953
add eax, ecx
cmp eax, ecx
jb 0x41a99a
mov ecx, eax
cmp ecx, edx
ja 0x41a94c
inc dword [ebp - 0xbc4]
cmp ecx, edx
jb 0x41a8ee
mov eax, ebx
cmp ecx, edx
jne 0x41a94c
test edi, edi
je 0x41a95a
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xc14], eax
test eax, eax
jne 0x41a95a
mov esi, 0xc0000017
jmp 0x41a983
mov esi, 0xc000000d
jmp 0x41a99f
mov esi, 0xc0000095
jmp 0x41a983
test esi, esi
je 0x41a96f
push edi
push esi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xc14]
add esp, 0xc
mov dword [ebp - 0xcd4], eax
mov eax, dword [ebp - 0xbc4]
mov dword [ebp - 0xcdc], eax
mov esi, ebx
test esi, esi
js 0x41a99f
mov eax, dword [ebp - 0xc0c]
cmp eax, dword [ebp - 0xcdc]
je 0x41a99f
jmp 0x41a861
mov esi, 0xc0000095
or esi, 0x10000000
mov eax, dword [ebp - 0xbec]
test eax, eax
je 0x41a9be
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xbb0]
test edi, edi
je 0x41aa25
cmp dword [edi + 4], 0
je 0x41a9e2
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x41a9fc
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x41aa16
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbe8]
test eax, eax
je 0x41aa3e
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbf0]
test eax, eax
je 0x41aa57
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xbe4]
test edi, edi
je 0x41aabe
cmp dword [edi + 4], 0
je 0x41aa7b
push dword [edi + 4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x41aa95
push dword [edi + 0xc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x41aaaf
push dword [edi + 0x14]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbfc]
test eax, eax
je 0x41aad7
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0x41ab51
xor eax, eax
inc eax
cmp dword [ebp - 0xcdc], eax
jb 0x41ab51
mov eax, dword [ebp - 0xcd4]
test eax, eax
je 0x41ab51
cmp dword [ebp - 0xcdc], 0
jbe 0x41ab51
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x41ab06
mov eax, ebx
jmp 0x41ab0e
or ecx, 0xffffffff
mov eax, 0xc0000095
test eax, eax
js 0x41ab51
mov eax, edx
neg eax
sbb eax, eax
and eax, ecx
cmp edx, 4
jne 0x41ab51
cmp dword [eax], 0
jl 0x41ab51
xor eax, eax
inc eax
cmp dword [ebp - 0xcdc], eax
jbe 0x41ab51
mov eax, dword [ebp - 0xcd4]
mov edx, ebx
xor ebx, ebx
inc ebx
mov esi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x41ab4f
lea eax, [esi + ecx]
cmp eax, ecx
jb 0x41ab4f
inc edx
cmp edx, ebx
jb 0x41ab3a
xor ebx, ebx
mov edi, dword [ebp - 0xb90]
cmp dword [ebp - 0xc24], 0
mov dword [ebp - 0xc28], ebx
mov dword [ebp - 0xc2c], ebx
je 0x41ab86
push dword [ebp - 0xc24]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xc24], ebx
mov eax, dword [ebp - 0xcd4]
test eax, eax
je 0x41ab9f
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0x41abb2
push edi
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xba0]
test eax, eax
je 0x41abcb
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xca4]
mov dword [ebp - 0xca4], ebx
mov dword [ebp - 0xce4], eax
jmp 0x4120aa
mov edi, ebx
jmp 0x41ab57
cmp eax, 0xd00000e5
je 0x41ac05
cmp eax, 0xc004d501
je 0x41ac05
cmp eax, 0xd000003e
jne 0x41ac07
mov eax, 0xc004f028
jmp 0x41ac12
mov eax, edi
test eax, eax
jns 0x41ac16
cmp eax, 0x8007007a
je 0x41ac1f
mov ebx, eax
jmp 0x41ac24
cmp dword [ebp - 0xca0], 4
je 0x41ac24
mov ebx, 0xc004f01e
lea ecx, [ebp - 0xce4]
call fcn.0041d64d
cmp ebx, edi
je 0x4114f8
cmp ebx, 0xc004d301
je 0x4114f8
cmp ebx, 0xc004d500
jle 0x41ac57
cmp ebx, 0xc004d502
jle 0x4114f8
test ebx, ebx
jns 0x4114f8
cmp ebx, esi
je 0x4114f8
mov ecx, ebx
call fcn.0041d635
jmp 0x4114f8