Function at 0x1002225c
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd14
mov eax, dword [0x1009e9c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov edx, 0x1009f6e4
push esi
push edi
mov dword [ebp - 0xbe0], ebx
mov dword [ebp - 0xbd8], ebx
mov dword [ebp - 0xbd0], ebx
mov dword [ebp - 0xbcc], ebx
mov dword [ebp - 0xb14], ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10022299
mov eax, dword [0x1009f6e0]
mov dword [ebp - 0xb48], 0x1000e0da
mov dword [ebp - 0xb40], 0x67
mov dword [ebp - 0xafc], 0x337
mov dword [ebp - 0xba8], 0x10b
mov dword [ebp - 0xb4c], 0x20b
push 0
pop ebx
test eax, eax
jne 0x1002290e
push 0x338
push ebx
mov dword [ebp - 0xbac], ebx
mov dword [ebp - 0xb10], ebx
mov dword [ebp - 0xb1c], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xad8], edi
test edi, edi
je 0x100228ad
or dword [ebp - 0xadc], 0xffffffff
mov eax, 0x7f1137f
mov edx, eax
mov dword [ebp - 0x3cc], 0xab69605e
movzx esi, word [ebp - 0x3ca]
mov cl, bl
shr edx, 0x10
add edi, 7
mov dword [ebp - 0x3c8], eax
movzx eax, ax
mov dword [ebp - 0xac0], esi
mov esi, 0x1000e0da
mov dword [ebp - 0xae0], ebx
mov dword [ebp - 0xb6c], ebx
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xac8], edx
mov dword [ebp - 0xb00], edi
mov dword [ebp - 0xb20], 0x67
movzx edx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl edx, 8
or edx, eax
shl edi, 8
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
or edi, eax
mov dword [ebp - 0xb08], edx
movzx eax, byte [esi + 4]
xor ebx, edx
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
add esi, 8
shl edi, 8
or edi, eax
mov dword [ebp - 0xac4], esi
mov esi, ebx
mov eax, 0x7f1137f
xor esi, edi
xor esi, dword [ebp - 0xb6c]
xor esi, eax
xor esi, 0xab69605e
mov eax, esi
rol eax, 0xa
lea edx, [esi + 0x54969fa2]
rol edx, 5
imul edx, dword [ebp - 0xae4]
add edx, eax
xor ebx, edx
mov edx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea edx, [ebx + edx]
ror edx, 9
imul edx, dword [ebp - 0xac0]
sub edx, eax
xor esi, edx
mov eax, esi
sub eax, dword [ebp - 0xae4]
imul edx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xac0]
xor edx, ebx
mov eax, ebx
rol edx, 6
imul edx, dword [ebp - 0xac8]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0xae4]
imul eax, dword [ebp - 0xac0]
ror edx, 6
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
add eax, esi
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor ebx, edx
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
mov eax, ebx
imul edx, dword [ebp - 0xac8]
rol eax, 8
sub edx, eax
xor esi, edx
mov edx, esi
mov eax, esi
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, dword [ebp - 0xae4]
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xac8]
xor edx, ebx
mov eax, ebx
imul edx, dword [ebp - 0xac0]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xac8]
xor ebx, eax
mov esi, ebx
sub esi, dword [ebp - 0xac8]
xor esi, edx
mov edx, dword [ebp - 0xac8]
xor esi, 0xab69605e
xor edx, esi
mov eax, esi
rol edx, 2
imul edx, dword [ebp - 0xae4]
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, eax
mov eax, ebx
ror edx, 6
imul edx, dword [ebp - 0xac0]
rol eax, 7
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, dword [ebp - 0xae4]
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xac0]
xor edx, ebx
mov dword [ebp - 0xaec], ebx
rol edx, 5
mov eax, ebx
imul edx, dword [ebp - 0xac8]
rol eax, 7
add edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov ebx, esi
xor ebx, dword [ebp - 0xaec]
xor ebx, edx
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xac0]
imul eax, dword [ebp - 0xae4]
xor esi, eax
mov eax, esi
sub eax, edx
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [ebp - 0xac8]
add edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xae4]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, 0x605e
shr eax, 3
imul edx, dword [ebp - 0xac0]
xor edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov eax, esi
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xadc]
rol eax, 2
mov dword [ebp - 0xb6c], esi
mov esi, dword [ebp - 0xac4]
xor edx, eax
mov dword [ebp - 0xadc], edi
xor edx, dword [ebp - 0xae0]
xor ebx, edx
mov edx, dword [ebp - 0xb00]
mov dword [ebp - 0xba4], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb6c]
ror dword [ebp - 0xba4], 8
mov byte [edx], al
mov al, byte [ebp - 0xba4]
ror dword [ebp - 0xb6c], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb6c]
ror dword [ebp - 0xba4], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xba4]
ror dword [ebp - 0xb6c], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb6c]
ror dword [ebp - 0xba4], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xba4]
ror dword [ebp - 0xb6c], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xb6c]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [ebp - 0xba4]
ror dword [ebp - 0xb6c], 8
mov eax, dword [ebp - 0xb08]
ror ebx, 8
sub dword [ebp - 0xb20], 1
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xb00], edx
jne 0x10022386
mov esi, dword [ebp - 0xad8]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x100226ed
movzx eax, cl
cdq
cmp eax, dword [0x1000e410]
jne 0x10022722
cmp edx, dword [0x1000e414]
jne 0x10022722
mov edi, esi
mov dword [ebp - 0xae0], 0x337
mov dword [ebp - 0xb10], edi
mov esi, ebx
jmp 0x10022735
or dword [ebp - 0xae0], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xb1c], 0xc004d501
test esi, esi
je 0x10022748
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xb1c], ebx
jl 0x100228ad
mov eax, dword [ebp - 0xae0]
mov esi, edi
push 0x40
push ebx
push 0x1009efb0
mov byte [eax + edi], bl
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], bl
je 0x100228b4
mov edi, 0x1009efb0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xaec], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10022789
sub ecx, dword [ebp - 0xaec]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x100228ad
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xae4], ecx
cmp word [eax], dx
je 0x100227d1
mov ecx, 0xc000007b
mov dword [ebp - 0xae4], ecx
jmp 0x10022819
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x100227c4
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x100227c4
cmp dword [edx], 0x4550
jne 0x100227c4
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xba8]
je 0x10022807
cmp ax, word [ebp - 0xb4c]
je 0x10022807
mov ecx, 0xc000000d
jmp 0x100227c9
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xae0], ebx
test eax, eax
je 0x10022894
mov edx, esi
mov dword [ebp - 0xb08], esi
lea eax, [edx + 1]
mov dword [ebp - 0xaec], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x10022840
sub edx, dword [ebp - 0xaec]
inc esi
add esi, edx
test ecx, ecx
js 0x10022879
push dword [ebp - 0xb08]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002289f
mov ecx, dword [ebp - 0xbac]
mov dword [ecx*4 + 0x1009e5d0], eax
mov ecx, dword [ebp - 0xae4]
mov eax, dword [ebp - 0xae0]
inc dword [ebp - 0xbac]
inc eax
mov dword [ebp - 0xae0], eax
cmp eax, dword [ebp - 0xac4]
jb 0x1002282f
add edi, 0x10
cmp byte [esi], bl
jne 0x1002277c
mov esi, dword [ebp - 0xae4]
mov edi, dword [ebp - 0xb10]
jmp 0x100228b6
mov esi, 0xc000007a
jmp 0x100228a5
mov esi, ebx
test edi, edi
je 0x100228c9
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jns 0x10022909
mov esi, ebx
mov eax, dword [esi + 0x1009efb0]
test eax, eax
je 0x100228e0
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x100228cf
push 0x40
push ebx
push 0x1009efb0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x100036a0
mov edi, 0x1009e5d0
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x10022914
mov eax, dword [0x1009f6e0]
inc eax
mov dword [0x1009f6e0], eax
xor eax, eax
mov ecx, 0x1009f6e4
xchg dword [ecx], eax
mov eax, dword fs:[0x30]
mov edi, ebx
mov dword [ebp - 0xbf4], ebx
mov dword [ebp - 0xbfc], ebx
cmp dword [eax + 0x1d4], ebx
je 0x10022bde
mov esi, dword [0x1009e658]
mov ecx, esi
call dword [0x100a0bc0]
call esi
mov ecx, eax
mov dword [ebp - 0xaec], ecx
test ecx, ecx
jne 0x10022980
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x10022970
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x10022be6
mov edi, 0x80004005
jmp 0x10022be6
mov dword [ebp - 0xbb0], ebx
mov edi, ebx
mov eax, ebx
mov esi, ebx
lea edx, [ebp - 0xc18]
push edx
push eax
push esi
mov esi, dword [0x1009e668]
push 2
push ecx
mov ecx, esi
call dword [0x100a0bc0]
call esi
test eax, eax
jne 0x10022a1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10022a07
cmp dword [ebp - 0xbb0], 0
jne 0x10022a00
push dword [ebp - 0xc18]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xbb0]
mov esi, eax
call fcn.10061a94
test esi, esi
je 0x100229f9
mov eax, dword [ebp - 0xc18]
mov ecx, dword [ebp - 0xaec]
mov dword [ebp - 0xbb0], esi
jmp 0x1002298c
mov edi, 0x8007000e
jmp 0x10022a28
mov edi, 0x80004005
jmp 0x10022a2e
test eax, eax
je 0x10022a00
jg 0x10022a11
mov edi, eax
jmp 0x10022a2e
movzx edi, ax
or edi, 0x80070000
jmp 0x10022a2e
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xbf4], eax
mov dword [ebp - 0xbb0], ebx
lea ecx, [ebp - 0xbb0]
call fcn.10061a94
test edi, edi
js 0x10022be6
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [0x1009e664]
mov ecx, esi
push eax
call dword [0x100a0bc0]
call esi
mov ecx, eax
mov dword [ebp - 0xaec], ecx
test ecx, ecx
je 0x10022959
mov dword [ebp - 0xbb4], ebx
mov edi, ebx
mov eax, ebx
mov esi, ebx
lea edx, [ebp - 0xc10]
push edx
push eax
push esi
mov esi, dword [0x1009e668]
push 2
push ecx
mov ecx, esi
call dword [0x100a0bc0]
call esi
test eax, eax
jne 0x10022b04
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10022aef
cmp dword [ebp - 0xbb4], 0
jne 0x10022ae8
push dword [ebp - 0xc10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xbb4]
mov esi, eax
call fcn.10061a94
test esi, esi
je 0x10022ae1
mov eax, dword [ebp - 0xc10]
mov ecx, dword [ebp - 0xaec]
mov dword [ebp - 0xbb4], esi
jmp 0x10022a74
mov edi, 0x8007000e
jmp 0x10022b10
mov edi, 0x80004005
jmp 0x10022b16
test eax, eax
je 0x10022ae8
jg 0x10022af9
mov edi, eax
jmp 0x10022b16
movzx edi, ax
or edi, 0x80070000
jmp 0x10022b16
mov eax, dword [ebp - 0xbb4]
mov dword [ebp - 0xbfc], eax
mov dword [ebp - 0xbb4], ebx
lea ecx, [ebp - 0xbb4]
call fcn.10061a94
test edi, edi
js 0x10022be6
mov eax, dword [ebp - 0xbf4]
test eax, eax
je 0x10022bde
mov ecx, 0x1000dcb4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10022b65
test dx, dx
je 0x10022b5e
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10022b65
add eax, 4
add ecx, 4
test dx, dx
jne 0x10022b3c
xor esi, esi
mov eax, ebx
inc esi
jmp 0x10022b6c
sbb eax, eax
xor esi, esi
inc esi
or eax, esi
test eax, eax
jne 0x10022bde
mov eax, dword [ebp - 0xbfc]
test eax, eax
je 0x10022bde
mov ecx, 0x1000dcc4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10022ba5
test dx, dx
je 0x10022ba1
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10022ba5
add eax, 4
add ecx, 4
test dx, dx
jne 0x10022b7f
mov eax, ebx
jmp 0x10022ba9
sbb eax, eax
or eax, esi
test eax, eax
jne 0x10022bde
push 4
lea eax, [ebp - 0xc14]
mov dword [ebp - 0xc14], ebx
push eax
push 0xb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
test eax, eax
je 0x10022959
test byte [ebp - 0xc14], 0xf
mov eax, esi
je 0x10022be0
mov eax, ebx
mov dword [ebp - 0xb14], eax
lea ecx, [ebp - 0xbfc]
call fcn.10061a94
lea ecx, [ebp - 0xbf4]
call fcn.10061a94
test edi, edi
jns 0x10022c06
mov dword [ebp - 0xb14], ebx
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea ecx, [ebp - 0xbcc]
mov dword [ebp - 0xad4], esi
call fcn.10061a7d
test esi, esi
jne 0x10022ce6
mov dword [ebp - 0xbcc], ebx
mov dword [ebp - 0xab4], 0x8007000e
mov eax, dword [ebp - 0xbf8]
mov dword [ebp - 0xbd0], eax
xor ebx, ebx
mov edx, 0x1009f6e4
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10022c4e
mov eax, dword [0x1009f6e0]
push 0
pop ebx
test eax, eax
jle 0x10022cab
sub eax, 1
mov dword [0x1009f6e0], eax
jne 0x10022cab
mov edi, ebx
mov eax, dword [edi + 0x1009efb0]
test eax, eax
je 0x10022c84
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0x10022c73
push 0x40
push ebx
push 0x1009efb0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x100036a0
mov edi, 0x1009e5d0
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0x1009f6e4
xchg dword [ecx], eax
lea ecx, [ebp - 0xbcc]
call fcn.10061a7d
mov eax, dword [ebp - 0xab4]
mov edi, 0xc004f012
test eax, eax
jns 0x1002c69d
cmp eax, 0xd0000034
jne 0x1002c663
mov eax, edi
mov esi, eax
jmp 0x1002c6b4
xor eax, eax
mov dword [ebp - 0xbcc], esi
lea edi, [ebp - 0xb2c]
mov dword [ebp - 0xac4], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xadc], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xbc4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xbac], 0x38
mov dword [ebp - 0xb08], esi
test esi, esi
jne 0x10022d4b
mov esi, 0xc0000017
mov edi, ebx
mov dword [ebp - 0xab4], esi
jmp 0x10022de7
push edi
push 0x1009ea98
push esi
call sub.msvcrt.dll_memcpy
mov edi, esi
add esp, 0xc
mov dword [ebp - 0xab8], edi
push 8
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xad8], ecx
test ecx, ecx
jne 0x10022d8c
mov esi, 0xc0000017
mov dword [ebp - 0xab4], esi
jmp 0x10022de7
mov eax, dword [0x1009ea90]
mov dword [ecx], eax
mov eax, dword [0x1009ea94]
mov dword [ecx + 4], eax
mov dword [ebp - 0xac4], ecx
rdtsc
mov dword [ebp - 0xb3c], eax
mov dword [ebp - 0xb38], edx
push 0xc
pop edi
lea eax, [ebp - 0xbf0]
mov edx, SysReAllocString
push eax
mov ecx, 0x1000b330
call fcn.10061ab4
test eax, eax
jns 0x10022ef1
mov dword [ebp - 0xbf0], ebx
mov esi, 0xc000003e
mov dword [ebp - 0xab4], esi
mov edi, dword [ebp - 0xab8]
cmp dword [ebp - 0xb24], 0
mov dword [ebp - 0xb28], ebx
mov dword [ebp - 0xb2c], ebx
je 0x10022e16
push dword [ebp - 0xb24]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xb24], ebx
mov eax, dword [ebp - 0xbbc]
mov dword [ebp - 0xbc0], ebx
mov dword [ebp - 0xbc4], ebx
test eax, eax
je 0x10022e41
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xbbc], ebx
test edi, edi
je 0x10022e54
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xac4]
test eax, eax
je 0x10022e6d
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x10022c3b
mov eax, dword [ebp - 0xb14]
test eax, eax
je 0x1002c64c
mov dword [0x1009efa8], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x2c0]
mov dword [ebp - 0xc30], ebx
push eax
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1002a510
cmp eax, esi
jne 0x10022ec1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1002a510
mov esi, dword [0x1009e64c]
mov ecx, esi
push 0x403
push ebx
push ebx
call dword [0x100a0bc0]
call esi
mov dword [ebp - 0xae4], eax
test eax, eax
jne 0x10025a68
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1002a510
mov eax, dword [ebp - 0xbf0]
inc eax
push 4
mov dword [ebp - 0xbf0], eax
pop edx
lea eax, [eax*2 + 4]
cmp eax, edx
jb 0x10022f10
mov ecx, eax
jmp 0x10022f13
or ecx, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, edx
jb 0x10022de1
mov edi, ecx
lea ecx, [edi + 0xc4]
mov edx, 0xc4
cmp ecx, edx
jb 0x10022f40
mov eax, ecx
jmp 0x10022f43
or eax, 0xffffffff
cmp ecx, edx
sbb esi, esi
and esi, 0xc0000095
add esi, 0x10000000
mov dword [ebp - 0xab4], esi
cmp ecx, edx
jb 0x10025a45
lea edx, [eax + 8]
cmp edx, eax
jb 0x10022f6c
mov ecx, edx
jmp 0x10022f6f
or ecx, 0xffffffff
cmp edx, eax
mov edi, 0xc0000095
sbb esi, esi
and esi, edi
add esi, 0x10000000
mov dword [ebp - 0xab4], esi
cmp edx, eax
jb 0x10025a45
lea eax, [ecx + 8]
cmp eax, ecx
jb 0x10022f99
mov edx, eax
jmp 0x10022f9c
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, edi
add esi, 0x10000000
mov dword [ebp - 0xab4], esi
cmp eax, ecx
jb 0x10025a45
push edx
push 8
mov dword [ebp - 0xb28], edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x10022fdc
mov esi, 0xc0000017
jmp 0x10022ddb
mov dword [ebp - 0xb24], edx
mov ecx, ebx
mov dword [ebp - 0xb2c], ecx
mov dword [ebp - 0xcc4], ebx
lea eax, [edx + 4]
cmp eax, edx
jb 0x10022ffb
mov edi, eax
jmp 0x10022ffe
or edi, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, edx
jb 0x10023040
mov ecx, dword [ebp - 0xb28]
lea eax, [edx + 8]
add ecx, edx
cmp eax, ecx
jbe 0x1002302b
mov esi, 0xc0000023
jmp 0x10022ddb
mov dword [edx], 4
mov dword [edi], ebx
mov ecx, dword [ebp - 0xb2c]
inc ecx
mov dword [ebp - 0xb2c], ecx
test esi, esi
js 0x10022de1
cmp dword [ebp - 0xb24], 0
jne 0x10023092
mov edi, dword [ebp - 0xb28]
lea eax, [edi + 0xa4]
cmp eax, edi
jb 0x10023065
mov edx, eax
jmp 0x10023068
or edx, 0xffffffff
cmp eax, edi
mov dword [ebp - 0xb28], edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, edi
jb 0x1002318e
inc ecx
mov dword [ebp - 0xb2c], ecx
jmp 0x10023196
mov edx, dword [ebp - 0xb24]
mov edi, ebx
test ecx, ecx
je 0x10023128
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xaec], edx
cmp eax, 4
jb 0x100230ba
mov dword [ebp - 0xae0], eax
jmp 0x100230c1
or dword [ebp - 0xae0], 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, 4
jb 0x10023188
mov ebx, dword [ebp - 0xae0]
mov dword [ebp - 0xc50], ebx
xor ebx, ebx
cmp eax, 4
jb 0x10023188
mov eax, dword [ebp - 0xc50]
mov esi, edx
add eax, edx
cmp eax, edx
jb 0x10023104
mov edx, eax
jmp 0x10023107
or edx, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, dword [ebp - 0xaec]
jb 0x10023188
inc edi
cmp edi, ecx
jb 0x100230a2
lea eax, [edx + 4]
cmp eax, edx
jb 0x10023133
mov edi, eax
jmp 0x10023136
or edi, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, edx
jb 0x10023188
mov ecx, dword [ebp - 0xb28]
lea eax, [edx + 0xa4]
add ecx, dword [ebp - 0xb24]
cmp eax, ecx
ja 0x10023021
mov eax, 0xa0
push eax
push dword [ebp - 0xb08]
mov dword [edx], eax
push edi
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xb2c]
add esp, 0xc
inc ecx
mov dword [ebp - 0xb2c], ecx
mov edx, dword [ebp - 0xb28]
test esi, esi
js 0x10022de1
cmp dword [ebp - 0xb24], 0
jne 0x100231ef
mov eax, edx
lea edx, [eax + 0xc]
mov edi, edx
cmp edx, eax
jae 0x100231ad
or edx, 0xffffffff
cmp edi, eax
mov dword [ebp - 0xb28], edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edi, eax
jb 0x10023307
mov edi, dword [ebp - 0xb3c]
inc ecx
mov dword [ebp - 0xc60], edi
mov edi, dword [ebp - 0xb38]
mov dword [ebp - 0xb2c], ecx
mov dword [ebp - 0xc5c], edi
jmp 0x10023330
mov edi, dword [ebp - 0xb24]
mov dword [ebp - 0xb00], ebx
test ecx, ecx
je 0x10023299
mov eax, dword [edi]
add eax, 4
mov dword [ebp - 0xaec], edi
cmp eax, 4
jb 0x1002321b
mov dword [ebp - 0xae0], eax
jmp 0x10023222
or dword [ebp - 0xae0], 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, 4
jb 0x10023307
mov ebx, dword [ebp - 0xae0]
mov dword [ebp - 0xc6c], ebx
xor ebx, ebx
cmp eax, 4
jb 0x10023307
mov eax, dword [ebp - 0xc6c]
mov esi, edi
add eax, edi
cmp eax, edi
jb 0x10023265
mov edi, eax
jmp 0x10023268
or edi, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, dword [ebp - 0xaec]
jb 0x10023307
mov esi, dword [ebp - 0xb00]
inc esi
mov dword [ebp - 0xb00], esi
cmp esi, ecx
jb 0x10023203
lea eax, [edi + 4]
cmp eax, edi
jb 0x100232a8
mov dword [ebp - 0xae0], eax
jmp 0x100232b1
or esi, 0xffffffff
mov dword [ebp - 0xae0], esi
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, edi
jb 0x10023307
mov ecx, dword [ebp - 0xb24]
lea eax, [edi + 0xc]
add ecx, edx
cmp eax, ecx
ja 0x10023021
mov edx, dword [ebp - 0xad8]
mov ecx, dword [ebp - 0xae0]
mov dword [edi], 8
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0xb2c]
mov edx, dword [ebp - 0xb28]
inc ecx
mov dword [ebp - 0xb2c], ecx
test esi, esi
js 0x10022de1
cmp dword [ebp - 0xb24], 0
mov eax, dword [ebp - 0xb3c]
mov dword [ebp - 0xc60], eax
mov eax, dword [ebp - 0xb38]
mov dword [ebp - 0xc5c], eax
jne 0x1002336a
lea eax, [edx + 0xc]
cmp eax, edx
jb 0x1002333f
mov dword [ebp - 0xb28], eax
jmp 0x10023346
or dword [ebp - 0xb28], 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, edx
jb 0x10023470
inc ecx
mov dword [ebp - 0xb2c], ecx
jmp 0x10023478
mov edi, dword [ebp - 0xb24]
mov dword [ebp - 0xb00], ebx
test ecx, ecx
je 0x10023410
mov eax, dword [edi]
add eax, 4
mov dword [ebp - 0xaec], edi
cmp eax, 4
jb 0x10023396
mov dword [ebp - 0xae0], eax
jmp 0x1002339d
or dword [ebp - 0xae0], 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, 4
jb 0x10023470
mov ebx, dword [ebp - 0xae0]
mov dword [ebp - 0xc70], ebx
xor ebx, ebx
cmp eax, 4
jb 0x10023470
mov eax, dword [ebp - 0xc70]
mov esi, edi
add eax, edi
cmp eax, edi
jb 0x100233e0
mov edi, eax
jmp 0x100233e3
or edi, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, dword [ebp - 0xaec]
jb 0x10023470
mov esi, dword [ebp - 0xb00]
inc esi
mov dword [ebp - 0xb00], esi
cmp esi, ecx
jb 0x1002337e
lea eax, [edi + 4]
cmp eax, edi
jb 0x1002341f
mov dword [ebp - 0xae0], eax
jmp 0x10023426
or dword [ebp - 0xae0], 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, edi
jb 0x10023470
mov ecx, dword [ebp - 0xb24]
lea eax, [edi + 0xc]
add ecx, edx
cmp eax, ecx
ja 0x10023021
mov eax, dword [ebp - 0xae0]
mov dword [edi], 8
mov edi, dword [ebp - 0xb3c]
mov dword [eax], edi
mov edi, dword [ebp - 0xb38]
mov dword [eax + 4], edi
inc dword [ebp - 0xb2c]
test esi, esi
js 0x10022de1
lea eax, [ebp - 0xbec]
mov edx, SysReAllocString
push eax
mov ecx, 0x1000b330
call fcn.10061ab4
test eax, eax
jns 0x1002349d
mov dword [ebp - 0xbec], ebx
jmp 0x10022dd6
mov ecx, dword [ebp - 0xbec]
lea eax, [ecx + 1]
cmp eax, ecx
jb 0x100234ae
mov edi, eax
jmp 0x100234b1
or edi, 0xffffffff
cmp eax, ecx
mov dword [ebp - 0xbec], edi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, ecx
jb 0x1002366b
add edi, edi
je 0x10023660
cmp dword [ebp - 0xb24], 0
jne 0x10023551
push 4
lea eax, [edi + 4]
pop ecx
cmp eax, ecx
jb 0x100234ee
mov edx, eax
jmp 0x100234f1
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, ecx
jae 0x10023510
mov edx, dword [ebp - 0xc74]
jmp 0x1002366b
mov ecx, dword [ebp - 0xb28]
lea eax, [ecx + edx]
cmp eax, ecx
jb 0x10023525
mov dword [ebp - 0xb28], eax
jmp 0x1002352c
or dword [ebp - 0xb28], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, ecx
jb 0x1002366b
inc dword [ebp - 0xb2c]
mov esi, ebx
jmp 0x10023665
cmp dword [ebp - 0xb2c], 0
mov ecx, ebx
mov edx, dword [ebp - 0xb24]
jbe 0x100235fc
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xb00], eax
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xaec], edx
cmp eax, 4
jb 0x1002358a
mov dword [ebp - 0xae0], eax
jmp 0x10023591
or dword [ebp - 0xae0], 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, 4
jb 0x1002366b
mov ebx, dword [ebp - 0xae0]
mov dword [ebp - 0xb00], ebx
xor ebx, ebx
cmp eax, 4
jb 0x1002366b
mov eax, dword [ebp - 0xb00]
mov esi, edx
add eax, edx
cmp eax, edx
jb 0x100235d4
mov edx, eax
jmp 0x100235d7
or edx, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, dword [ebp - 0xaec]
jb 0x1002366b
inc ecx
cmp ecx, dword [ebp - 0xb2c]
jb 0x10023572
lea eax, [edx + 4]
cmp eax, edx
jb 0x1002360b
mov dword [ebp - 0xae0], eax
jmp 0x10023612
or dword [ebp - 0xae0], 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, edx
jb 0x1002366b
mov ecx, dword [ebp - 0xb28]
lea eax, [edi + 4]
add ecx, dword [ebp - 0xb24]
add eax, edx
cmp eax, ecx
jbe 0x10023642
mov esi, 0xc0000023
jmp 0x10023665
push edi
push 0x1000b330
push dword [ebp - 0xae0]
mov dword [edx], edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
inc dword [ebp - 0xb2c]
jmp 0x1002366b
mov esi, 0xc000000d
mov dword [ebp - 0xab4], esi
test esi, esi
js 0x10022de1
cmp dword [ebp - 0xb24], 0
mov eax, dword [ebp - 0xb14]
mov dword [ebp - 0xcc8], eax
jne 0x100236d1
mov ecx, dword [ebp - 0xb28]
lea eax, [ecx + 8]
cmp eax, ecx
jb 0x1002369d
mov dword [ebp - 0xb28], eax
jmp 0x100236a4
or dword [ebp - 0xb28], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, ecx
jb 0x100237a0
inc dword [ebp - 0xb2c]
mov dword [ebp - 0xc80], 4
jmp 0x100237bb
cmp dword [ebp - 0xb2c], 0
mov ecx, ebx
mov edx, dword [ebp - 0xb24]
jbe 0x10023753
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xaec], edx
cmp eax, 4
jb 0x100236f6
mov edi, eax
jmp 0x100236f9
or edi, 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, 4
jb 0x10023717
mov dword [ebp - 0xc84], edi
jmp 0x1002371d
mov edi, dword [ebp - 0xc84]
cmp eax, 4
jb 0x100237a0
lea eax, [edx + edi]
mov esi, edx
cmp eax, edx
jb 0x1002372f
mov edx, eax
jmp 0x10023732
or edx, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, dword [ebp - 0xaec]
jb 0x100237a0
inc ecx
cmp ecx, dword [ebp - 0xb2c]
jb 0x100236e2
lea eax, [edx + 4]
cmp eax, edx
jb 0x1002375e
mov edi, eax
jmp 0x10023761
or edi, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, edx
jb 0x100237a0
mov ecx, dword [ebp - 0xb28]
lea eax, [edx + 8]
add ecx, dword [ebp - 0xb24]
cmp eax, ecx
ja 0x10023021
mov eax, dword [ebp - 0xb14]
mov dword [edx], 4
mov dword [edi], eax
inc dword [ebp - 0xb2c]
test esi, esi
js 0x10022de1
cmp dword [ebp - 0xb24], 0
mov dword [ebp - 0xc80], 4
jne 0x100237fa
mov ecx, dword [ebp - 0xb28]
lea eax, [ecx + 8]
cmp eax, ecx
jb 0x100237d0
mov dword [ebp - 0xb28], eax
jmp 0x100237d7
or dword [ebp - 0xb28], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, ecx
jb 0x100238c2
inc dword [ebp - 0xb2c]
jmp 0x100238ca
cmp dword [ebp - 0xb2c], 0
mov ecx, ebx
mov edx, dword [ebp - 0xb24]
jbe 0x1002387c
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xaec], edx
cmp eax, 4
jb 0x1002381f
mov edi, eax
jmp 0x10023822
or edi, 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, 4
jb 0x10023840
mov dword [ebp - 0xc88], edi
jmp 0x10023846
mov edi, dword [ebp - 0xc88]
cmp eax, 4
jb 0x100238c2
lea eax, [edx + edi]
mov esi, edx
cmp eax, edx
jb 0x10023858
mov edx, eax
jmp 0x1002385b
or edx, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, dword [ebp - 0xaec]
jb 0x100238c2
inc ecx
cmp ecx, dword [ebp - 0xb2c]
jb 0x1002380b
lea eax, [edx + 4]
cmp eax, edx
jb 0x10023887
mov edi, eax
jmp 0x1002388a
or edi, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, edx
jb 0x100238c2
mov ecx, dword [ebp - 0xb28]
lea eax, [edx + 8]
add ecx, dword [ebp - 0xb24]
cmp eax, ecx
ja 0x10023021
push 4
pop eax
mov dword [edx], eax
mov dword [edi], eax
inc dword [ebp - 0xb2c]
test esi, esi
js 0x10022de1
rdtsc
mov edi, ebx
mov dword [ebp - 0xb30], ebx
mov dword [ebp - 0xb10], edi
mov dword [ebp - 0xaf4], ebx
mov dword [ebp - 0xb20], ebx
mov dword [ebp - 0xaf0], ebx
mov dword [ebp - 0xad8], ebx
mov dword [ebp - 0xad0], ebx
mov dword [ebp - 0xb00], ebx
mov dword [ebp - 0xacc], ebx
mov dword [ebp - 0xb1c], ebx
mov dword [ebp - 0xaec], eax
mov dword [ebp - 0xb08], edx
mov ecx, dword [ebp - 0xb28]
add ecx, 8
cmp ecx, 8
jb 0x10023928
mov edx, ecx
jmp 0x1002392b
or edx, 0xffffffff
cmp ecx, 8
sbb esi, esi
and esi, 0xc0000095
cmp ecx, 8
jb 0x10023a1f
lea eax, [edx + 7]
and eax, 0xfffffff8
mov dword [ebp - 0xae0], eax
cmp eax, edx
jae 0x10023959
mov esi, 0xc0000095
jmp 0x10023a1f
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x1002397b
mov esi, 0xc0000017
mov edi, ebx
jmp 0x10023a1f
mov eax, dword [ebp - 0xb2c]
mov dword [edi], eax
lea eax, [edi + 4]
cmp eax, edi
jb 0x1002398e
mov ecx, eax
jmp 0x10023991
or ecx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x10023a06
mov eax, dword [ebp - 0xb28]
mov dword [ecx], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x100239b2
mov edx, eax
jmp 0x100239b5
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10023a06
mov eax, dword [ebp - 0xae0]
mov ecx, dword [ebp - 0xaec]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0xb08]
mov dword [edi + eax - 4], ecx
push dword [ebp - 0xb28]
push dword [ebp - 0xb24]
push edx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xae0]
add esp, 0xc
mov dword [ebp - 0xb30], edi
mov edi, ebx
mov dword [ebp - 0xb10], eax
test edi, edi
je 0x10023a19
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xb10]
or esi, 0x10000000
mov dword [ebp - 0xab4], esi
jl 0x10025372
cmp dword [ebp - 0xb30], 0
mov dword [ebp - 0xb34], ebx
jne 0x10023a4a
mov esi, 0xc000000d
jmp 0x100240bd
test edi, edi
je 0x100240b8
lea eax, [edi + 8]
push eax
push ebx
mov dword [ebp - 0xaf8], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xae8], esi
test esi, esi
je 0x100240b8
mov cl, bl
mov edx, ebx
test edi, edi
je 0x10023a90
mov eax, dword [ebp - 0xb30]
xor cl, byte [edx + eax]
inc edx
cmp edx, edi
jb 0x10023a88
mov eax, 0xc81ecb17
mov dword [ebp - 0x404], 0xb1b54a58
mov dword [ebp - 0x400], eax
or eax, 0xffffffff
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xb7c], eax
mov eax, edi
shr eax, 3
mov dword [ebp - 0xb78], ebx
mov dword [ebp - 0xb18], eax
test eax, eax
je 0x10023efb
movzx edx, word [ebp - 0x402]
mov eax, 0xc81ecb17
movzx esi, ax
shr eax, 0x10
mov dword [ebp - 0xae4], eax
mov eax, dword [ebp - 0xae8]
add eax, 7
mov dword [ebp - 0xabc], edx
mov edx, dword [ebp - 0xab4]
mov dword [ebp - 0xb0c], eax
mov eax, dword [ebp - 0xb30]
add eax, 2
mov dword [ebp - 0xac0], esi
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xac8], ebx
mov dword [ebp - 0xb44], ebx
mov ebx, dword [ebp - 0xae0]
movzx edi, byte [ebx - 2]
movzx eax, byte [ebx - 1]
movzx esi, byte [ebx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [ebx]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 3]
or esi, eax
movzx eax, byte [ebx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [ebx + 5]
add ebx, 8
shl esi, 8
or esi, eax
mov dword [ebp - 0xae0], ebx
xor edx, esi
mov eax, 0xc81ecb17
mov dword [ebp - 0xab4], edx
lea ebx, [edx - 0x4a58]
xor ebx, edi
xor ebx, dword [ebp - 0xb78]
xor ebx, eax
mov edx, ebx
xor edx, eax
mov eax, ebx
ror edx, 0xf
imul edx, dword [ebp - 0xabc]
ror eax, 7
add edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov dword [ebp - 0xab4], eax
lea edx, [eax - 0x4e4ab5a8]
ror eax, 0xa
ror edx, 9
imul edx, dword [ebp - 0xac0]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xac0]
rol eax, 5
rol edx, 4
imul edx, dword [ebp - 0xae4]
add edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xab4], eax
xor edx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, edx
xor ebx, eax
mov eax, ebx
shr eax, 6
lea edx, [ebx - 0x4a58]
imul edx, dword [ebp - 0xabc]
sub edx, eax
xor dword [ebp - 0xab4], edx
mov edx, dword [ebp - 0xab4]
mov eax, edx
ror eax, 0xf
xor eax, dword [ebp - 0xac0]
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, dword [ebp - 0xae4]
imul eax, dword [ebp - 0xac0]
xor edx, eax
mov dword [ebp - 0xab4], edx
lea eax, [edx + 0x37e0ea91]
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0xae4]
imul eax, dword [ebp - 0xabc]
ror edx, 0xa
xor edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xab4], eax
xor edx, 0x4a58
ror eax, 3
rol edx, 6
imul edx, dword [ebp - 0xac0]
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xab4]
mov eax, ebx
ror eax, 0xf
sub eax, dword [ebp - 0xae4]
imul eax, eax, 0x4a58
xor edx, eax
mov dword [ebp - 0xab4], edx
xor edx, dword [ebp - 0xae4]
mov eax, dword [ebp - 0xab4]
imul edx, edx, 0x4a58
shr eax, 1
xor edx, eax
mov eax, dword [ebp - 0xab4]
sub eax, dword [ebp - 0xac0]
xor ebx, edx
rol eax, 3
imul edx, eax, 0x4a58
mov eax, dword [ebp - 0xab4]
shr eax, 0xf
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
sub edx, dword [ebp - 0xac0]
imul edx, dword [ebp - 0xabc]
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0xab4], eax
ror edx, 9
imul edx, dword [ebp - 0xac0]
ror eax, 0xb
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xab4]
mov eax, ebx
sub eax, dword [ebp - 0xae4]
add eax, 0x4e4ab5a8
xor edx, eax
mov dword [ebp - 0xab4], edx
mov eax, dword [ebp - 0xab4]
xor eax, dword [ebp - 0xabc]
ror edx, 7
imul eax, eax, 0x4a58
sub eax, edx
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xae4]
rol edx, 4
imul edx, dword [ebp - 0xabc]
ror eax, 0x10
sub edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0xab4], eax
ror edx, 0xa
imul edx, dword [ebp - 0xac0]
ror eax, 4
add edx, eax
xor ebx, edx
mov eax, ebx
ror eax, 9
lea edx, [ebx + 0x4e4ab5a8]
ror edx, 4
imul edx, dword [ebp - 0xae4]
xor edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov dword [ebp - 0xab4], eax
xor eax, 0xc81ecb17
rol eax, 8
imul edx, eax, 0x4a58
mov eax, dword [ebp - 0xab4]
rol eax, 2
sub edx, eax
xor ebx, edx
mov edx, 0xc81ecb17
sub edx, ebx
mov eax, ebx
ror eax, 0xc
ror edx, 0xb
imul edx, dword [ebp - 0xabc]
sub edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov edx, dword [ebp - 0xabc]
xor edx, eax
mov dword [ebp - 0xab4], eax
imul edx, dword [ebp - 0xac0]
shr eax, 8
xor edx, eax
xor ebx, edx
mov eax, ebx
xor ebx, dword [ebp - 0xac8]
xor eax, dword [ebp - 0xb44]
xor eax, dword [ebp - 0xab4]
xor eax, 0xc81ecb17
mov dword [ebp - 0xb78], ebx
xor eax, 0xb1b54a58
mov dword [ebp - 0xac8], edi
mov dword [ebp - 0xb7c], eax
mov eax, dword [ebp - 0xb0c]
mov dword [ebp - 0xb44], esi
mov byte [eax - 4], bl
mov al, byte [ebp - 0xb7c]
mov ebx, dword [ebp - 0xb0c]
ror dword [ebp - 0xb78], 8
mov byte [ebx], al
ror dword [ebp - 0xb7c], 8
mov al, byte [ebp - 0xb78]
mov byte [ebx - 5], al
mov al, byte [ebp - 0xb7c]
ror dword [ebp - 0xb78], 8
mov byte [ebx - 1], al
ror dword [ebp - 0xb7c], 8
mov al, byte [ebp - 0xb78]
mov byte [ebx - 6], al
mov al, byte [ebp - 0xb7c]
ror dword [ebp - 0xb78], 8
mov byte [ebx - 2], al
ror dword [ebp - 0xb7c], 8
mov al, byte [ebp - 0xb78]
mov byte [ebx - 7], al
mov al, byte [ebp - 0xb7c]
mov byte [ebx - 3], al
add ebx, 8
mov edx, dword [ebp - 0xb7c]
ror dword [ebp - 0xb78], 8
ror edx, 8
sub dword [ebp - 0xb18], 1
mov dword [ebp - 0xb7c], edx
mov dword [ebp - 0xb0c], ebx
jne 0x10023b21
mov edi, dword [ebp - 0xb10]
xor ebx, ebx
mov esi, dword [ebp - 0xae8]
movzx eax, cl
cdq
mov dword [esi + edi], eax
mov dword [esi + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x10023f27
mov esi, 0xc0000017
jmp 0x10024026
mov eax, dword [ebp - 0xaf8]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x10023f4a
mov esi, 0xc0000017
jmp 0x10023fc5
mov dword [edi + 4], eax
push dword [ebp - 0xaf8]
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
pop esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x10023f43
mov dword [edi + 0xc], eax
push 0xa0
push 0x1009e9e8
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [edi + 0x10], esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x10023f43
mov dword [edi + 0x14], ecx
mov eax, dword [0x1009ea88]
mov esi, ebx
mov dword [ecx], eax
mov eax, dword [0x1009ea8c]
mov dword [ebp - 0xb34], edi
mov edi, ebx
mov dword [ecx + 4], eax
test edi, edi
je 0x10024026
cmp dword [edi + 4], 0
je 0x10023fe3
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x10023ffd
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x10024017
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x1002403a
mov eax, dword [ebp - 0xb34]
mov edi, ebx
mov dword [ebp - 0xaf4], eax
jmp 0x10024040
mov edi, dword [ebp - 0xb34]
mov eax, dword [ebp - 0xae8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x100240bd
cmp dword [edi + 4], 0
je 0x10024073
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x1002408d
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x100240a7
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100240bd
mov esi, 0xc0000001
or esi, 0x10000000
mov dword [ebp - 0xab4], esi
jl 0x10025372
mov ecx, dword [ebp - 0xaf4]
mov edi, dword [ecx + 8]
mov ecx, dword [ecx]
add ecx, 4
cmp ecx, 4
jb 0x100240e6
mov eax, ecx
jmp 0x100240e9
or eax, 0xffffffff
cmp ecx, 4
sbb esi, esi
and esi, 0xc0000095
cmp ecx, 4
jb 0x10024176
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x10024104
mov edx, ecx
jmp 0x10024107
or edx, 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
cmp ecx, eax
jb 0x10024176
lea eax, [edx + edi]
cmp eax, edx
jb 0x10024120
mov ecx, eax
jmp 0x10024123
or ecx, 0xffffffff
cmp eax, edx
mov edi, 0xc0000095
sbb esi, esi
and esi, edi
cmp eax, edx
jb 0x10024176
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x1002413d
mov eax, edx
jmp 0x10024140
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, edi
cmp edx, ecx
jb 0x10024176
mov edx, dword [ebp - 0xaf4]
mov ecx, dword [edx + 0x10]
add ecx, eax
cmp ecx, eax
jb 0x10024163
mov edx, ecx
mov dword [ebp - 0xb0c], ecx
jmp 0x1002416c
or edx, 0xffffffff
mov dword [ebp - 0xb0c], edx
cmp ecx, eax
sbb esi, esi
and esi, edi
cmp ecx, eax
jae 0x10024182
mov edx, dword [ebp - 0xccc]
mov dword [ebp - 0xb0c], edx
test esi, esi
js 0x10024313
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x100241aa
mov esi, 0xc0000017
jmp 0x10024313
mov edx, dword [ebp - 0xaf4]
lea ecx, [edi + 4]
mov eax, dword [edx]
mov dword [edi], eax
cmp ecx, edi
jb 0x100241c5
mov eax, ecx
mov dword [ebp - 0xaf8], ecx
jmp 0x100241ce
or eax, 0xffffffff
mov dword [ebp - 0xaf8], eax
cmp ecx, edi
sbb esi, esi
and esi, 0xc0000095
cmp ecx, edi
jb 0x10024300
push dword [edx]
push dword [edx + 4]
push eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0xaf4]
add esp, 0xc
mov ecx, dword [ebp - 0xaf8]
mov eax, dword [edx]
add eax, ecx
cmp eax, ecx
jb 0x10024206
mov edx, eax
jmp 0x10024209
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10024300
mov eax, dword [ebp - 0xaf4]
lea ecx, [edx + 4]
mov eax, dword [eax + 8]
mov dword [edx], eax
cmp ecx, edx
jb 0x10024237
mov eax, ecx
mov dword [ebp - 0xaf8], ecx
jmp 0x10024240
or eax, 0xffffffff
mov dword [ebp - 0xaf8], eax
cmp ecx, edx
sbb esi, esi
and esi, 0xc0000095
cmp ecx, edx
jb 0x10024300
mov esi, dword [ebp - 0xaf4]
push dword [esi + 8]
push dword [esi + 0xc]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
mov edx, dword [ebp - 0xaf8]
add eax, edx
cmp eax, edx
jb 0x1002427a
mov ecx, eax
jmp 0x1002427d
or ecx, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x10024300
mov eax, dword [ebp - 0xaf4]
lea edx, [ecx + 4]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
cmp edx, ecx
jb 0x100242a7
mov eax, edx
mov dword [ebp - 0xaf8], edx
jmp 0x100242b0
or eax, 0xffffffff
mov dword [ebp - 0xaf8], eax
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
cmp edx, ecx
jb 0x10024300
mov esi, dword [ebp - 0xaf4]
push dword [esi + 0x10]
push dword [esi + 0x14]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0x10]
add esp, 0xc
mov ecx, dword [ebp - 0xaf8]
add eax, ecx
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10024300
mov eax, dword [ebp - 0xb0c]
mov dword [ebp - 0xb20], edi
mov edi, ebx
mov dword [ebp - 0xaf0], eax
test edi, edi
je 0x10024313
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
or esi, 0x10000000
mov dword [ebp - 0xab4], esi
jl 0x10025372
mov dword [ebp - 0xaf8], ebx
cmp dword [ebp - 0xb24], 0
jne 0x1002436d
mov esi, 0xc000000d
mov dword [ebp - 0xab4], esi
mov eax, ebx
test esi, esi
js 0x10025372
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x10024529
mov esi, 0xd0000017
jmp 0x1002536c
xor eax, eax
inc eax
cmp dword [ebp - 0xb2c], eax
jbe 0x10024334
mov ecx, dword [ebp - 0xb24]
mov edi, ebx
mov eax, dword [ecx]
lea edx, [ecx + 4]
mov dword [ebp - 0xaec], eax
cmp edx, ecx
jb 0x10024393
mov eax, edx
jmp 0x10024396
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, ecx
jb 0x100243f6
mov ecx, dword [ebp - 0xaec]
add ecx, eax
mov edx, ecx
cmp ecx, eax
jae 0x100243bb
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, eax
jb 0x100243f6
xor eax, eax
inc edi
inc eax
cmp edi, eax
jb 0x10024380
lea eax, [ecx + 4]
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, ecx
jb 0x100243f6
mov eax, dword [ecx]
mov dword [ebp - 0xaf8], eax
test esi, esi
js 0x1002433f
cmp dword [ebp - 0xb2c], 2
jbe 0x10024334
mov ecx, dword [ebp - 0xb24]
mov edi, ebx
mov eax, dword [ecx]
lea edx, [ecx + 4]
mov dword [ebp - 0xaec], eax
cmp edx, ecx
jb 0x10024426
mov eax, edx
jmp 0x10024429
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, ecx
jb 0x10024483
mov ecx, dword [ebp - 0xaec]
add ecx, eax
mov edx, ecx
cmp ecx, eax
jae 0x1002444e
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, eax
jb 0x10024483
inc edi
cmp edi, 2
jb 0x10024413
lea eax, [ecx + 4]
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, ecx
jb 0x10024483
mov edi, dword [ecx]
jmp 0x10024485
mov edi, ebx
test esi, esi
js 0x1002433f
mov eax, dword [ebp - 0xaf8]
add eax, 0x50
cmp eax, 0x50
jb 0x1002449f
mov ecx, eax
jmp 0x100244a2
or ecx, 0xffffffff
cmp eax, 0x50
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp eax, 0x50
jb 0x100244fc
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x100244c3
mov eax, edx
jmp 0x100244c6
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, ecx
jb 0x100244fc
lea ecx, [eax + edi]
cmp ecx, eax
jb 0x100244e5
mov edx, ecx
jmp 0x100244e8
or edx, 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp ecx, eax
jae 0x10024502
mov edx, dword [ebp - 0xcd0]
test esi, esi
js 0x1002433f
cmp edx, 0x400000
jbe 0x1002451c
mov esi, 0x8000ffff
jmp 0x1002536c
mov eax, edx
mov dword [ebp - 0xad0], eax
jmp 0x10024341
mov dword [ebp - 0xad8], edi
mov eax, dword [ebp - 0xb20]
test eax, eax
jne 0x10024543
mov esi, 0x80070057
jmp 0x1002536c
mov ecx, dword [ebp - 0xad0]
mov dword [ebp - 0xca0], eax
mov eax, dword [ebp - 0xaf0]
mov dword [ebp - 0xc98], eax
lea eax, [ebp - 0xc7c]
push eax
xor eax, eax
mov dword [ebp - 0xc9c], edi
push 0x1000dca0
inc eax
mov dword [ebp - 0xc94], ecx
push eax
mov dword [ebp - 0xc90], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x100245bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0xab4], esi
test esi, esi
jle 0x100245aa
movzx esi, si
or esi, 0x80070000
mov dword [ebp - 0xab4], esi
test esi, esi
mov eax, dword [ebp - 0xad0]
js 0x10024613
mov esi, 0x80004005
mov dword [ebp - 0xab4], esi
jmp 0x10024613
push 0x100100b0
push dword [ebp - 0xc7c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x10024587
push ebx
push 0x14
lea eax, [ebp - 0xca0]
mov ecx, esi
push eax
push 0x86
call dword [0x100a0bc0]
call esi
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xab4], esi
jl 0x1002460d
mov eax, dword [ebp - 0xc94]
mov dword [ebp - 0xad0], eax
jmp 0x10024613
mov eax, dword [ebp - 0xad0]
cmp esi, 0xd0000023
jne 0x10024625
mov esi, 0x8007007a
jmp 0x1002536c
test esi, esi
js 0x10025372
mov dword [ebp - 0xac8], ebx
cmp eax, 4
jae 0x10024642
mov esi, 0xc000003e
jmp 0x10024a21
mov ecx, dword [edi]
lea eax, [edi + 4]
mov dword [ebp - 0xb0c], ecx
cmp eax, edi
jb 0x1002465b
mov edx, eax
mov dword [ebp - 0xae8], eax
jmp 0x10024664
or edx, 0xffffffff
mov dword [ebp - 0xae8], edx
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x10024a21
mov eax, dword [ebp - 0xad0]
add eax, 0xfffffffc
cmp eax, ecx
jb 0x10024638
lea eax, [ecx + edx]
cmp eax, edx
jb 0x1002468e
mov edx, eax
jmp 0x10024691
or edx, 0xffffffff
cmp eax, dword [ebp - 0xae8]
sbb esi, esi
and esi, 0xc0000095
cmp eax, dword [ebp - 0xae8]
jb 0x10024a21
lea eax, [ecx + 4]
cmp eax, 4
jb 0x100246b7
mov ecx, eax
jmp 0x100246ba
or ecx, 0xffffffff
cmp eax, 4
mov edi, 0xc0000095
sbb esi, esi
and esi, edi
cmp eax, 4
jb 0x10024a21
mov eax, dword [ebp - 0xad0]
sub eax, ecx
cmp eax, 4
jb 0x10024638
mov eax, dword [edx]
mov dword [ebp - 0xaf0], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x100246f7
mov dword [ebp - 0xb10], eax
jmp 0x100246fe
or dword [ebp - 0xb10], 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, edi
cmp eax, edx
jb 0x10024a21
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x10024717
mov edi, eax
jmp 0x1002471a
or edi, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10024a21
mov eax, dword [ebp - 0xad0]
mov edx, dword [ebp - 0xaf0]
sub eax, edi
cmp eax, edx
jb 0x10024638
mov esi, dword [ebp - 0xb10]
lea eax, [edx + esi]
cmp eax, esi
jb 0x10024753
mov ecx, eax
jmp 0x10024756
or ecx, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
cmp eax, dword [ebp - 0xb10]
jb 0x10024a21
lea eax, [edx + edi]
cmp eax, edi
jb 0x10024777
mov edx, eax
jmp 0x1002477a
or edx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x10024a21
mov eax, dword [ebp - 0xad0]
sub eax, edx
cmp eax, 4
jb 0x10024638
mov edi, dword [ecx]
lea eax, [ecx + 4]
mov dword [ebp - 0xaec], edi
cmp eax, ecx
jb 0x100247b4
mov dword [ebp - 0xb34], eax
jmp 0x100247bb
or dword [ebp - 0xb34], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10024a21
lea eax, [edx + 4]
cmp eax, edx
jb 0x100247d8
mov ecx, eax
jmp 0x100247db
or ecx, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x10024a21
mov eax, dword [ebp - 0xad0]
sub eax, ecx
cmp eax, edi
jb 0x10024638
lea eax, [edi + ecx]
cmp eax, ecx
jb 0x10024808
mov edx, eax
jmp 0x1002480b
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10024a21
mov eax, dword [ebp - 0xad0]
sub eax, edx
jne 0x10024638
mov esi, dword [ebp - 0xaf0]
mov ecx, dword [ebp - 0xb0c]
add ecx, 0xc
lea eax, [edi + esi]
add eax, ecx
cmp eax, dword [ebp - 0xad0]
jne 0x10024638
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x1002486c
mov esi, 0xc0000017
jmp 0x100249a6
cmp dword [ebp - 0xae8], 0
je 0x100248b6
mov eax, dword [ebp - 0xb0c]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x1002489b
mov esi, 0xc0000017
jmp 0x10024945
mov dword [edi + 4], eax
mov ecx, dword [ebp - 0xb0c]
push ecx
push dword [ebp - 0xae8]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x100248bb
mov dword [edi], ebx
mov dword [edi + 4], ebx
cmp dword [ebp - 0xb10], 0
je 0x100248f0
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x10024891
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xb10]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x100248f6
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
cmp dword [ebp - 0xb34], 0
je 0x10024935
mov esi, dword [ebp - 0xaec]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x10024891
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xb34]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x1002493b
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [ebp - 0xac8], edi
mov esi, ebx
mov edi, ebx
test edi, edi
je 0x100249a6
cmp dword [edi + 4], 0
je 0x10024963
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x1002497d
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x10024997
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x100249ba
mov eax, dword [ebp - 0xac8]
mov edi, ebx
mov dword [ebp - 0xb00], eax
jmp 0x100249c0
mov edi, dword [ebp - 0xac8]
test edi, edi
je 0x10024a21
cmp dword [edi + 4], 0
je 0x100249de
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x100249f8
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x10024a12
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
or esi, 0x10000000
mov dword [ebp - 0xab4], esi
jl 0x10025372
mov ecx, dword [ebp - 0xb00]
mov edi, ebx
mov dword [ebp - 0xae0], ebx
test ecx, ecx
jne 0x10024a4f
mov esi, 0xd000000d
jmp 0x1002536c
mov eax, dword [ecx + 4]
mov dword [ebp - 0xb44], eax
test eax, eax
je 0x10024a45
mov esi, dword [ecx]
test esi, esi
je 0x10024a45
add esi, 0xfffffff8
push esi
push ebx
mov dword [ebp - 0xb34], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb18], eax
test eax, eax
je 0x1002510c
mov ecx, 0x7f1137f
mov dword [ebp - 0xb0c], eax
mov edi, esi
mov dword [ebp - 0x3f8], ecx
mov ecx, dword [ebp - 0xb44]
and edi, 7
mov dl, bl
mov dword [ebp - 0x3fc], 0xab69605e
mov dword [ebp - 0xb10], ecx
mov eax, ebx
mov dword [ebp - 0xb08], edi
je 0x100250a7
or dword [ebp - 0xb5c], 0xffffffff
mov ecx, ebx
mov dword [ebp - 0xb64], ebx
mov dword [ebp - 0xad0], ebx
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0xaf0], ecx
test edi, edi
je 0x10024b42
mov eax, dword [ebp - 0xb10]
push 0x38
pop esi
lea ebx, [eax + 1]
movzx eax, byte [eax]
mov dword [ebp - 0xaf8], ebx
cmp ecx, 4
jge 0x10024b10
lea ecx, [esi - 0x20]
shl eax, cl
or dword [ebp - 0xae8], eax
jmp 0x10024b1a
mov ecx, esi
shl eax, cl
or dword [ebp - 0xad0], eax
mov ecx, dword [ebp - 0xaf0]
sub esi, 8
mov eax, dword [ebp - 0xaf8]
inc ecx
mov dword [ebp - 0xaf0], ecx
cmp ecx, edi
jl 0x10024af2
mov dword [ebp - 0xb10], eax
xor ebx, ebx
mov eax, dword [ebp - 0xae8]
mov ecx, dword [ebp - 0xad0]
xor eax, 0x92f65a5
xor ecx, 0x699a899c
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xb64], eax
mov dword [ebp - 0xac8], ecx
mov dword [ebp - 0xb5c], ecx
mov dword [ebp - 0xaec], ebx
test edi, edi
je 0x10024bc4
mov esi, dword [ebp - 0xb0c]
lea edi, [esi + 1]
mov dword [ebp - 0xaf0], edi
cmp ebx, 4
jge 0x10024b90
rol eax, 8
mov byte [esi], al
jmp 0x10024b95
rol ecx, 8
mov byte [esi], cl
mov edi, dword [ebp - 0xb08]
inc ebx
mov esi, dword [ebp - 0xaf0]
cmp ebx, edi
jl 0x10024b7b
mov eax, esi
xor ebx, ebx
mov esi, dword [ebp - 0xb5c]
mov dword [ebp - 0xb0c], eax
mov eax, dword [ebp - 0xb64]
mov dword [ebp - 0xab4], eax
jmp 0x10024bca
mov esi, dword [ebp - 0xac8]
add edi, 0xfffffffc
test edi, edi
jle 0x10025075
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0xac8], esi
mov dword [ebp - 0xb5c], esi
mov esi, dword [ebp - 0xb34]
mov eax, esi
shr eax, 3
mov dword [ebp - 0xaf8], eax
test eax, eax
je 0x1002503e
mov edi, dword [ebp - 0xb10]
mov ebx, 0x7f1137f
movzx esi, word [ebp - 0x3fa]
mov ecx, ebx
movzx eax, bx
xor ebx, 0xab69605e
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0xb0c]
shr ecx, 0x10
add eax, 7
add edi, 2
mov dword [ebp - 0xac0], ecx
mov ecx, dword [ebp - 0xab4]
mov dword [ebp - 0xae4], esi
mov esi, dword [ebp - 0xac8]
mov dword [ebp - 0xaf0], ebx
mov dword [ebp - 0xb0c], eax
mov dword [ebp - 0xb10], edi
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xb10]
xor ecx, ebx
mov dword [ebp - 0xab4], ecx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb10]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb10]
shl edi, 8
add dword [ebp - 0xb10], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
mov dword [ebp - 0xac8], esi
mov esi, dword [ebp - 0xaf0]
xor esi, dword [ebp - 0xac8]
xor esi, ecx
mov eax, esi
rol eax, 0xa
lea ecx, [esi + 0x54969fa2]
rol ecx, 5
imul ecx, dword [ebp - 0xabc]
add ecx, eax
mov eax, dword [ebp - 0xab4]
xor eax, ecx
mov ecx, 0x7f1137f
add ecx, eax
mov dword [ebp - 0xab4], eax
ror ecx, 9
imul ecx, dword [ebp - 0xae4]
rol eax, 2
sub ecx, eax
xor esi, ecx
mov eax, esi
sub eax, dword [ebp - 0xabc]
imul ecx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub ecx, eax
mov eax, dword [ebp - 0xab4]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xab4], eax
xor ecx, dword [ebp - 0xae4]
rol ecx, 6
imul ecx, dword [ebp - 0xac0]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, 0xab69605e
sub eax, ecx
mov ecx, dword [ebp - 0xab4]
xor ecx, eax
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0xab4], ecx
xor eax, dword [ebp - 0xab4]
imul eax, dword [ebp - 0xae4]
ror ecx, 6
xor ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
add eax, esi
ror eax, 0xf
imul ecx, eax, 0x605e
mov eax, esi
rol eax, 2
add ecx, eax
mov eax, dword [ebp - 0xab4]
xor eax, ecx
mov dword [ebp - 0xab4], eax
lea ecx, [eax + 0x54969fa2]
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0xac0]
sub ecx, eax
xor esi, ecx
mov ecx, esi
mov eax, esi
xor ecx, 0xab69605e
ror eax, 0xa
ror ecx, 0xc
imul ecx, dword [ebp - 0xabc]
xor ecx, eax
mov eax, dword [ebp - 0xab4]
xor eax, ecx
mov ecx, dword [ebp - 0xac0]
xor ecx, eax
mov dword [ebp - 0xab4], eax
imul ecx, dword [ebp - 0xae4]
shr eax, 0xa
xor ecx, eax
xor ecx, esi
mov esi, dword [ebp - 0xab4]
mov eax, ecx
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xac0]
xor esi, eax
mov dword [ebp - 0xab4], esi
sub esi, dword [ebp - 0xac0]
xor esi, ecx
xor esi, 0xab69605e
mov ecx, esi
mov eax, esi
xor ecx, dword [ebp - 0xac0]
rol ecx, 2
imul ecx, dword [ebp - 0xabc]
shr eax, 2
add ecx, eax
mov eax, dword [ebp - 0xab4]
xor eax, ecx
mov dword [ebp - 0xab4], eax
lea ecx, [eax - 0x7f1137f]
rol eax, 7
ror ecx, 6
imul ecx, dword [ebp - 0xae4]
add ecx, eax
mov eax, dword [ebp - 0xabc]
xor esi, ecx
xor eax, esi
mov ecx, esi
imul eax, eax, 0x605e
ror ecx, 9
add ecx, eax
mov eax, dword [ebp - 0xab4]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xab4], eax
xor ecx, dword [ebp - 0xae4]
rol ecx, 5
imul ecx, dword [ebp - 0xac0]
rol eax, 7
add ecx, eax
mov eax, dword [ebp - 0xaf0]
xor esi, ecx
mov ecx, dword [ebp - 0xab4]
xor eax, esi
xor ecx, eax
mov eax, ecx
mov dword [ebp - 0xab4], ecx
ror eax, 3
sub eax, dword [ebp - 0xae4]
imul eax, dword [ebp - 0xabc]
xor esi, eax
mov eax, esi
mov ecx, 0x7f1137f
sub eax, ecx
ror eax, 1
imul ecx, eax, 0x605e
mov eax, esi
ror eax, 6
sub ecx, eax
mov eax, dword [ebp - 0xab4]
xor eax, ecx
mov dword [ebp - 0xab4], eax
lea ecx, [eax - 0x54969fa2]
rol eax, 0xe
rol ecx, 3
imul ecx, dword [ebp - 0xac0]
add ecx, eax
xor esi, ecx
mov eax, esi
ror eax, 0xe
lea ecx, [esi - 0x54969fa2]
rol ecx, 0xf
imul ecx, dword [ebp - 0xabc]
sub ecx, eax
mov eax, dword [ebp - 0xab4]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xab4], eax
shr eax, 3
xor ecx, 0x605e
imul ecx, dword [ebp - 0xae4]
xor ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
xor eax, esi
rol eax, 4
imul ecx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xad0]
rol eax, 2
mov dword [ebp - 0xb5c], esi
mov dword [ebp - 0xad0], edi
xor ecx, eax
mov edi, dword [ebp - 0xb10]
xor ecx, dword [ebp - 0xae8]
mov eax, dword [ebp - 0xab4]
xor eax, ecx
mov dword [ebp - 0xae8], ebx
mov ecx, dword [ebp - 0xb0c]
mov dword [ebp - 0xb64], eax
add dword [ebp - 0xb0c], 8
mov byte [ecx - 4], al
mov al, byte [ebp - 0xb5c]
ror dword [ebp - 0xb64], 8
mov byte [ecx], al
ror dword [ebp - 0xb5c], 8
mov al, byte [ebp - 0xb64]
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb5c]
ror dword [ebp - 0xb64], 8
mov byte [ecx - 1], al
ror dword [ebp - 0xb5c], 8
mov al, byte [ebp - 0xb64]
mov byte [ecx - 6], al
ror dword [ebp - 0xb64], 8
mov al, byte [ebp - 0xb5c]
mov byte [ecx - 2], al
ror dword [ebp - 0xb5c], 8
mov al, byte [ebp - 0xb64]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb5c]
mov byte [ecx - 3], al
mov ecx, dword [ebp - 0xb64]
mov esi, dword [ebp - 0xb5c]
ror ecx, 8
ror esi, 8
sub dword [ebp - 0xaf8], 1
mov dword [ebp - 0xb64], ecx
mov dword [ebp - 0xb5c], esi
jne 0x10024c62
mov esi, dword [ebp - 0xb34]
xor ebx, ebx
mov ecx, dword [ebp - 0xb18]
mov eax, ebx
test esi, esi
je 0x10025052
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0x1002504a
mov edi, dword [ebp - 0xb44]
movzx eax, dl
cdq
cmp eax, dword [esi + edi]
jne 0x100250d3
cmp edx, dword [esi + edi + 4]
jne 0x100250d3
mov edi, ecx
mov dword [ebp - 0xae0], esi
mov ecx, ebx
mov esi, ebx
jmp 0x100250da
mov ecx, ebx
mov dword [ebp - 0xac8], ecx
mov dword [ebp - 0xb5c], ecx
test edi, edi
jns 0x10024bed
neg edi
shl edi, 3
mov ecx, edi
shr eax, cl
shl eax, cl
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xb64], eax
jmp 0x10024bed
or dword [ebp - 0xad0], 0xffffffff
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xb5c], eax
mov eax, ebx
mov dword [ebp - 0xae8], ebx
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xb64], eax
jmp 0x10024bf3
mov esi, 0xc004d501
mov edi, ebx
test ecx, ecx
je 0x100250ed
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x1002510c
mov eax, dword [ebp - 0xae0]
mov esi, 0x10000000
mov dword [ebp - 0xacc], edi
mov edi, ebx
mov dword [ebp - 0xb1c], eax
jmp 0x10025111
mov esi, 0xd0000001
mov dword [ebp - 0xab4], esi
test edi, edi
je 0x1002512a
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x10025372
mov edx, dword [ebp - 0xb1c]
cmp edx, 4
jb 0x10025361
mov edi, dword [ebp - 0xacc]
mov eax, dword [edi]
mov dword [ebp - 0xaec], eax
lea eax, [edi + 4]
cmp eax, edi
jb 0x1002515a
mov ecx, eax
jmp 0x1002515d
or ecx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x10025366
lea eax, [edx - 4]
cmp eax, 4
jb 0x10025361
mov eax, dword [ecx]
mov dword [ebp - 0xb0c], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x1002518e
mov edi, eax
jmp 0x10025191
or edi, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x10025366
mov ecx, dword [ebp - 0xb0c]
lea eax, [edx - 8]
cmp eax, ecx
jb 0x10025361
lea eax, [ecx + 8]
cmp eax, 8
sbb esi, esi
and esi, 0xc0000095
cmp eax, 8
jb 0x10025366
mov eax, dword [ebp - 0xacc]
lea edx, [edi + ecx]
mov esi, dword [ebp - 0xb1c]
add eax, esi
cmp eax, edx
jb 0x10025361
sub esi, edi
sub esi, ecx
add esi, dword [ebp - 0xacc]
cmp esi, 8
jae 0x10025361
mov dword [ebp - 0xb1c], ebx
mov eax, ebx
mov dword [ebp - 0xb18], eax
mov esi, ebx
test edi, edi
je 0x100252f4
mov ecx, edi
cmp edx, edi
jb 0x1002521f
mov eax, edx
mov dword [ebp - 0xaf8], edx
jmp 0x10025228
or eax, 0xffffffff
mov dword [ebp - 0xaf8], eax
cmp edx, edi
sbb esi, esi
and esi, 0xc0000095
cmp edx, edi
jb 0x1002534f
cmp edi, eax
jae 0x100252e8
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x10025251
mov dword [ebp - 0xaf0], edx
jmp 0x10025258
or dword [ebp - 0xaf0], 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
cmp edx, ecx
jb 0x1002534f
cmp dword [ebp - 0xaf0], eax
ja 0x10025319
mov eax, dword [ecx]
add eax, 4
cmp eax, 4
jb 0x10025284
mov edx, eax
jmp 0x10025287
or edx, 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
cmp eax, 4
jb 0x1002529f
mov dword [ebp - 0xc78], edx
jmp 0x100252a5
mov edx, dword [ebp - 0xc78]
cmp eax, 4
jb 0x1002534f
lea eax, [edx + ecx]
cmp eax, ecx
jb 0x100252b9
mov edx, eax
jmp 0x100252bc
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1002534f
mov eax, dword [ebp - 0xaf8]
cmp edx, eax
ja 0x10025319
inc dword [ebp - 0xb1c]
mov ecx, edx
cmp edx, eax
jb 0x10025242
cmp ecx, eax
jne 0x10025319
mov ecx, dword [ebp - 0xb0c]
mov eax, ebx
test ecx, ecx
je 0x10025328
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb18], eax
test eax, eax
jne 0x10025320
mov esi, 0xc0000017
jmp 0x1002534f
mov esi, 0xc000000d
jmp 0x10025366
mov ecx, dword [ebp - 0xb0c]
mov esi, ebx
test edi, edi
je 0x1002533d
push ecx
push edi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xb18]
add esp, 0xc
mov dword [ebp - 0xbbc], eax
mov eax, dword [ebp - 0xb1c]
mov dword [ebp - 0xbc4], eax
test esi, esi
js 0x10025366
mov eax, dword [ebp - 0xaec]
cmp eax, dword [ebp - 0xbc4]
je 0x10025366
mov esi, 0xc000003e
or esi, 0x10000000
mov dword [ebp - 0xab4], esi
mov eax, dword [ebp - 0xb30]
test eax, eax
je 0x1002538b
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xaf4]
test edi, edi
je 0x100253f2
cmp dword [edi + 4], 0
je 0x100253af
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x100253c9
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x100253e3
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb20]
test eax, eax
je 0x1002540b
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xad8]
test eax, eax
je 0x10025424
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xb00]
test edi, edi
je 0x1002548b
cmp dword [edi + 4], 0
je 0x10025448
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x10025462
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x1002547c
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xacc]
test eax, eax
je 0x100254a4
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x10022de1
xor eax, eax
inc eax
cmp dword [ebp - 0xbc4], eax
jae 0x100254c1
mov esi, 0xc004d501
jmp 0x10022ddb
cmp dword [ebp - 0xbbc], 0
jne 0x10025546
mov esi, 0xc000000d
mov dword [ebp - 0xab4], esi
mov eax, ebx
test esi, esi
js 0x10022de1
cmp eax, 0xd0000023
jne 0x100254f1
mov eax, 0x8007007a
mov dword [ebp - 0xadc], eax
cmp eax, 0x8007007a
je 0x10025508
mov esi, eax
mov dword [ebp - 0xab4], esi
test eax, eax
js 0x10022de1
cmp dword [ebp - 0xbc4], 6
jne 0x100254b7
cmp dword [ebp - 0xbbc], 0
jne 0x100255b9
mov edx, dword [ebp - 0xc48]
mov esi, 0xc000000d
mov ecx, dword [ebp - 0xc4c]
mov dword [ebp - 0xab4], esi
mov dword [ebp - 0xb20], edx
mov dword [ebp - 0xb00], ecx
jmp 0x1002568a
cmp dword [ebp - 0xbc4], 0
jbe 0x100254ca
mov eax, dword [ebp - 0xbbc]
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x10025566
mov edi, ecx
jmp 0x10025569
or edi, 0xffffffff
cmp ecx, dword [ebp - 0xbbc]
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp ecx, dword [ebp - 0xbbc]
jb 0x1002558f
mov eax, edx
neg eax
sbb eax, eax
and eax, edi
jmp 0x1002559b
mov edx, dword [ebp - 0xcd4]
mov eax, dword [ebp - 0xcd8]
test esi, esi
js 0x100254d5
cmp edx, 4
jne 0x10023021
mov eax, dword [eax]
mov dword [ebp - 0xadc], eax
jmp 0x100254d7
mov eax, dword [ebp - 0xbbc]
mov edi, ebx
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [ebp - 0xaec], ecx
cmp edx, eax
jb 0x100255d4
mov ecx, edx
jmp 0x100255d7
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, eax
jb 0x10025646
mov eax, dword [ebp - 0xaec]
add eax, ecx
mov edx, eax
cmp eax, ecx
jae 0x100255fc
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, ecx
jb 0x10025646
xor ecx, ecx
inc edi
inc ecx
cmp edi, ecx
jb 0x100255c1
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x10025625
mov edi, ecx
jmp 0x10025628
or edi, 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp ecx, eax
jb 0x10025646
mov eax, edx
neg eax
sbb eax, eax
and eax, edi
jmp 0x10025652
mov edx, dword [ebp - 0xcdc]
mov eax, dword [ebp - 0xce0]
test esi, esi
js 0x10025672
cmp edx, 8
jne 0x10023021
mov ecx, dword [eax]
mov dword [ebp - 0xb00], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xb20], ecx
jmp 0x1002568a
mov eax, dword [ebp - 0xc48]
mov dword [ebp - 0xb20], eax
mov eax, dword [ebp - 0xc4c]
mov dword [ebp - 0xb00], eax
test esi, esi
js 0x10022de1
cmp dword [ebp - 0xbbc], 0
jne 0x100256d1
mov esi, 0xc000000d
mov dword [ebp - 0xab4], esi
mov eax, dword [ebp - 0xc54]
mov dword [ebp - 0xacc], eax
test esi, esi
js 0x10022de1
cmp dword [ebp - 0xbbc], 0
jne 0x10025780
mov esi, 0xc000000d
jmp 0x10022ddb
mov eax, dword [ebp - 0xbbc]
mov edi, ebx
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [ebp - 0xaec], ecx
cmp edx, eax
jb 0x100256ec
mov ecx, edx
jmp 0x100256ef
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, eax
jb 0x1002575c
mov eax, dword [ebp - 0xaec]
add eax, ecx
mov edx, eax
cmp eax, ecx
jae 0x10025714
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, ecx
jb 0x1002575c
inc edi
cmp edi, 2
jb 0x100256d9
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x1002573b
mov edi, ecx
jmp 0x1002573e
or edi, 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp ecx, eax
jb 0x1002575c
mov eax, edx
neg eax
sbb eax, eax
and eax, edi
jmp 0x10025768
mov edx, dword [ebp - 0xce4]
mov eax, dword [ebp - 0xce8]
test esi, esi
js 0x100256a6
cmp edx, 4
jne 0x10023021
mov eax, dword [eax]
jmp 0x100256ac
mov eax, dword [ebp - 0xbbc]
mov edi, ebx
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [ebp - 0xaec], ecx
cmp edx, eax
jb 0x1002579b
mov ecx, edx
jmp 0x1002579e
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, eax
jb 0x1002580f
mov eax, dword [ebp - 0xaec]
add eax, ecx
mov edx, eax
cmp eax, ecx
jae 0x100257c3
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edx, ecx
jb 0x1002580f
inc edi
cmp edi, 3
jb 0x10025788
mov edx, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xaf8], edx
cmp ecx, eax
jb 0x100257f0
mov edi, ecx
jmp 0x100257f3
or edi, 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp ecx, eax
jb 0x1002580f
neg edx
sbb edx, edx
and edx, edi
jmp 0x10025821
mov eax, dword [ebp - 0xd0c]
mov edx, dword [ebp - 0xd10]
mov dword [ebp - 0xaf8], eax
test esi, esi
js 0x10022de1
mov eax, dword [ebp - 0xbbc]
mov dword [ebp - 0xad8], ebx
mov ecx, dword [eax]
lea edi, [eax + 4]
mov dword [ebp - 0xaec], ecx
cmp edi, eax
jb 0x10025848
mov ecx, edi
jmp 0x1002584b
or ecx, 0xffffffff
cmp edi, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edi, eax
jb 0x100258d0
mov eax, dword [ebp - 0xaec]
add eax, ecx
mov edi, eax
cmp eax, ecx
jae 0x10025870
or eax, 0xffffffff
cmp edi, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edi, ecx
jb 0x100258d0
mov ecx, dword [ebp - 0xad8]
inc ecx
mov dword [ebp - 0xad8], ecx
cmp ecx, 4
jb 0x10025835
mov edi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x100258a7
mov dword [ebp - 0xad8], ecx
jmp 0x100258ae
or dword [ebp - 0xad8], 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp ecx, eax
jb 0x100258d0
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xad8]
jmp 0x100258dc
mov edi, dword [ebp - 0xcf8]
mov eax, dword [ebp - 0xd04]
test esi, esi
js 0x100258ed
cmp edi, 4
jne 0x10023021
mov eax, dword [eax]
jmp 0x100258f3
mov eax, dword [ebp - 0xd14]
mov dword [ebp - 0xaf0], eax
test esi, esi
js 0x10022de1
mov eax, dword [ebp - 0xbbc]
mov dword [ebp - 0xad8], ebx
mov ecx, dword [eax]
lea edi, [eax + 4]
mov dword [ebp - 0xaec], ecx
cmp edi, eax
jb 0x10025920
mov ecx, edi
jmp 0x10025923
or ecx, 0xffffffff
cmp edi, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edi, eax
jb 0x100259a8
mov eax, dword [ebp - 0xaec]
add eax, ecx
mov edi, eax
cmp eax, ecx
jae 0x10025948
or eax, 0xffffffff
cmp edi, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp edi, ecx
jb 0x100259a8
mov ecx, dword [ebp - 0xad8]
inc ecx
mov dword [ebp - 0xad8], ecx
cmp ecx, 5
jb 0x1002590d
mov edi, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x1002597f
mov dword [ebp - 0xad8], ecx
jmp 0x10025986
or dword [ebp - 0xad8], 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xab4], esi
cmp ecx, eax
jb 0x100259a8
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xad8]
jmp 0x100259b4
mov edi, dword [ebp - 0xcf4]
mov eax, dword [ebp - 0xcf0]
test esi, esi
js 0x100259c5
cmp edi, 4
jne 0x10023021
mov ecx, dword [eax]
jmp 0x100259c7
mov ecx, ebx
test esi, esi
js 0x10022de1
mov eax, dword [ebp - 0xb3c]
cmp eax, dword [ebp - 0xb00]
jne 0x100254b7
mov eax, dword [ebp - 0xb38]
cmp eax, dword [ebp - 0xb20]
jne 0x100254b7
cmp dword [ebp - 0xaf0], 4
mov dword [ebp - 0xb14], ecx
jbe 0x10025a1e
mov eax, dword [ebp - 0xacc]
mov esi, 0x8007007a
mov dword [ebp - 0xab4], esi
mov dword [ebp - 0xbd0], eax
jmp 0x10022de1
mov eax, dword [ebp - 0xaf8]
cmp eax, 4
ja 0x10025a02
push eax
push edx
push dword [ebp - 0xad4]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xacc]
add esp, 0xc
mov dword [ebp - 0xbd0], eax
test esi, esi
js 0x10022de1
mov eax, dword [ebp - 0xadc]
mov edi, dword [ebp - 0xab8]
test eax, eax
je 0x10022de7
mov esi, eax
jmp 0x10022d84
mov esi, dword [0x1009e61c]
mov ecx, esi
call dword [0x100a0bc0]
call esi
mov dword [0x1009f6d8], eax
mov eax, dword [0x1009efa8]
push 0x54
mov dword [ebp - 0xb44], eax
lea eax, [ebp - 0x7bc]
push ebx
push eax
mov dword [0x1009f6dc], edx
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0xc68], ebx
lea edi, [ebp - 0x354]
mov dword [ebp - 0xc64], ebx
stosd dword es:[edi], eax
push 0x2c
push ebx
mov dword [ebp - 0xaec], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x500]
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
mov dword [ebp - 0xae0], ebx
xor ebx, ebx
mov edx, 0x1009f6e4
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10025ada
mov eax, dword [0x1009f6e0]
push 0
pop ebx
test eax, eax
jne 0x100261c4
push 0x338
push ebx
mov dword [ebp - 0xb00], ebx
mov dword [ebp - 0xacc], ebx
mov dword [ebp - 0xb18], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xad4], edi
test edi, edi
je 0x10026163
or dword [ebp - 0xaf0], 0xffffffff
mov eax, 0x7f1137f
mov edx, ebx
mov dword [ebp - 0x3f0], eax
mov eax, ebx
mov dword [ebp - 0xad8], ebx
mov cl, bl
mov dword [ebp - 0xad0], edx
mov ebx, 0x7f1137f
mov dword [ebp - 0xb90], edx
mov dword [ebp - 0xac0], eax
mov edx, ebx
mov dword [ebp - 0xb80], eax
shr edx, 0x10
movzx eax, bx
xor ebx, 0xab69605e
add edi, 7
mov dword [ebp - 0x3f4], 0xab69605e
movzx esi, word [ebp - 0x3f2]
mov dword [ebp - 0xadc], edi
mov edi, 0x1000e0da
mov dword [ebp - 0xac8], edx
mov edx, dword [ebp - 0xad0]
mov dword [ebp - 0xaf4], esi
mov esi, dword [ebp - 0xac0]
mov dword [ebp - 0xac4], ebx
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xb14], edi
mov dword [ebp - 0xaf8], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xb14]
xor edx, ebx
mov dword [ebp - 0xad0], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb14]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb14]
shl edi, 8
add dword [ebp - 0xb14], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, dword [ebp - 0xac4]
mov eax, esi
mov dword [ebp - 0xac0], esi
rol eax, 0xa
lea edx, [esi + 0x54969fa2]
mov esi, dword [ebp - 0xad0]
rol edx, 5
imul edx, dword [ebp - 0xabc]
add edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov eax, esi
rol eax, 2
lea edx, [edx + esi]
ror edx, 9
imul edx, dword [ebp - 0xaf4]
sub edx, eax
mov eax, dword [ebp - 0xac0]
xor eax, edx
mov dword [ebp - 0xac0], eax
sub eax, dword [ebp - 0xabc]
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xac0]
shr eax, 0xd
sub edx, eax
xor esi, edx
mov edx, dword [ebp - 0xaf4]
xor edx, esi
mov eax, esi
rol edx, 6
imul edx, dword [ebp - 0xac8]
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0xac0]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xac0], eax
xor edx, 0xab69605e
mov eax, 0x7f1137f
sub eax, edx
xor esi, eax
mov eax, dword [ebp - 0xabc]
xor eax, esi
mov edx, esi
imul eax, dword [ebp - 0xaf4]
ror edx, 6
xor edx, eax
mov eax, dword [ebp - 0xac0]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xac0], eax
add eax, edx
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xac0]
rol eax, 2
add edx, eax
xor esi, edx
mov eax, esi
rol eax, 8
lea edx, [esi + 0x54969fa2]
ror edx, 0xe
imul edx, dword [ebp - 0xac8]
sub edx, eax
mov eax, dword [ebp - 0xac0]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xac0], eax
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, dword [ebp - 0xabc]
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xac8]
xor edx, esi
mov eax, esi
imul edx, dword [ebp - 0xaf4]
shr eax, 0xa
xor edx, eax
xor edx, dword [ebp - 0xac0]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xac8]
xor esi, eax
mov dword [ebp - 0xad0], esi
sub esi, dword [ebp - 0xac8]
xor esi, edx
mov edx, dword [ebp - 0xac8]
xor esi, 0xab69605e
xor edx, esi
mov eax, esi
rol edx, 2
imul edx, dword [ebp - 0xabc]
shr eax, 2
add edx, eax
mov eax, dword [ebp - 0xad0]
xor eax, edx
mov dword [ebp - 0xad0], eax
lea edx, [eax - 0x7f1137f]
rol eax, 7
ror edx, 6
imul edx, dword [ebp - 0xaf4]
add edx, eax
mov eax, dword [ebp - 0xabc]
xor esi, edx
xor eax, esi
mov edx, esi
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
mov eax, dword [ebp - 0xad0]
xor eax, edx
mov edx, dword [ebp - 0xaf4]
xor edx, eax
mov dword [ebp - 0xad0], eax
rol edx, 5
imul edx, dword [ebp - 0xac8]
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xac4]
xor esi, edx
mov edx, dword [ebp - 0xad0]
xor eax, esi
xor edx, eax
mov eax, edx
mov dword [ebp - 0xad0], edx
ror eax, 3
sub eax, dword [ebp - 0xaf4]
imul eax, dword [ebp - 0xabc]
xor esi, eax
mov eax, esi
mov edx, 0x7f1137f
sub eax, edx
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
mov eax, dword [ebp - 0xad0]
xor eax, edx
mov dword [ebp - 0xad0], eax
lea edx, [eax - 0x54969fa2]
rol eax, 0xe
rol edx, 3
imul edx, dword [ebp - 0xac8]
add edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xabc]
sub edx, eax
mov eax, dword [ebp - 0xad0]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xad0], eax
shr eax, 3
xor edx, 0x605e
imul edx, dword [ebp - 0xaf4]
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
xor eax, esi
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xaf0]
rol eax, 2
mov dword [ebp - 0xb80], esi
mov dword [ebp - 0xaf0], edi
xor edx, eax
mov edi, dword [ebp - 0xb14]
xor edx, dword [ebp - 0xad8]
mov eax, dword [ebp - 0xad0]
xor eax, edx
mov dword [ebp - 0xad8], ebx
mov edx, dword [ebp - 0xadc]
mov dword [ebp - 0xb90], eax
add dword [ebp - 0xadc], 8
mov byte [edx - 4], al
mov al, byte [ebp - 0xb80]
ror dword [ebp - 0xb90], 8
mov byte [edx], al
ror dword [ebp - 0xb80], 8
mov al, byte [ebp - 0xb90]
mov byte [edx - 5], al
mov al, byte [ebp - 0xb80]
ror dword [ebp - 0xb90], 8
mov byte [edx - 1], al
ror dword [ebp - 0xb80], 8
mov al, byte [ebp - 0xb90]
mov byte [edx - 6], al
ror dword [ebp - 0xb90], 8
mov al, byte [ebp - 0xb80]
mov byte [edx - 2], al
ror dword [ebp - 0xb80], 8
mov al, byte [ebp - 0xb90]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb80]
mov byte [edx - 3], al
mov edx, dword [ebp - 0xb90]
mov esi, dword [ebp - 0xb80]
ror edx, 8
ror esi, 8
sub dword [ebp - 0xaf8], 1
mov dword [ebp - 0xb90], edx
mov dword [ebp - 0xb80], esi
jne 0x10025bc8
mov esi, dword [ebp - 0xad4]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x10025fa3
movzx eax, cl
cdq
cmp eax, dword [0x1000e410]
jne 0x10025fd8
cmp edx, dword [0x1000e414]
jne 0x10025fd8
mov edi, esi
mov dword [ebp - 0xac4], 0x337
mov dword [ebp - 0xacc], edi
mov esi, ebx
jmp 0x10025feb
or dword [ebp - 0xac4], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xb18], 0xc004d501
test esi, esi
je 0x10025ffe
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xb18], ebx
jl 0x10026163
mov eax, dword [ebp - 0xac4]
mov esi, edi
push 0x40
push ebx
push 0x1009efb0
mov byte [eax + edi], bl
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], bl
je 0x1002616a
mov edi, 0x1009efb0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xad4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1002603f
sub ecx, dword [ebp - 0xad4]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x10026163
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xabc], ecx
cmp word [eax], dx
je 0x10026087
mov ecx, 0xc000007b
mov dword [ebp - 0xabc], ecx
jmp 0x100260cf
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x1002607a
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x1002607a
cmp dword [edx], 0x4550
jne 0x1002607a
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xba8]
je 0x100260bd
cmp ax, word [ebp - 0xb4c]
je 0x100260bd
mov ecx, 0xc000000d
jmp 0x1002607f
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xac4], ebx
test eax, eax
je 0x1002614a
mov edx, esi
mov dword [ebp - 0xb08], esi
lea eax, [edx + 1]
mov dword [ebp - 0xad4], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x100260f6
sub edx, dword [ebp - 0xad4]
inc esi
add esi, edx
test ecx, ecx
js 0x1002612f
push dword [ebp - 0xb08]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10026155
mov ecx, dword [ebp - 0xb00]
mov dword [ecx*4 + 0x1009e5d0], eax
mov ecx, dword [ebp - 0xabc]
mov eax, dword [ebp - 0xac4]
inc dword [ebp - 0xb00]
inc eax
mov dword [ebp - 0xac4], eax
cmp eax, dword [ebp - 0xad8]
jb 0x100260e5
add edi, 0x10
cmp byte [esi], bl
jne 0x10026032
mov esi, dword [ebp - 0xabc]
mov edi, dword [ebp - 0xacc]
jmp 0x1002616c
mov esi, 0xc000007a
jmp 0x1002615b
mov esi, ebx
test edi, edi
je 0x1002617f
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jns 0x100261bf
mov esi, ebx
mov eax, dword [esi + 0x1009efb0]
test eax, eax
je 0x10026196
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x10026185
push 0x40
push ebx
push 0x1009efb0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x100036a0
mov edi, 0x1009e5d0
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x100261ca
mov eax, dword [0x1009f6e0]
inc eax
mov dword [0x1009f6e0], eax
xor eax, eax
mov edx, 0x1009f6e4
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0xc], ebx
lea edi, [ebp - 0xc24]
mov word [ebp - 8], bx
stosd dword es:[edi], eax
mov dword [ebp - 0xb38], ebx
mov dword [ebp - 0xb3c], ebx
mov dword [ebp - 0xbe4], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x3c4]
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10026205
mov eax, dword [0x1009f6e0]
push 0
pop ebx
test eax, eax
jne 0x100268ab
push 0x338
push ebx
mov dword [ebp - 0xadc], ebx
mov dword [ebp - 0xad0], ebx
mov dword [ebp - 0xb18], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xb08], edi
test edi, edi
je 0x1002684a
or dword [ebp - 0xad8], 0xffffffff
mov eax, 0x7f1137f
mov dword [ebp - 0x3e0], eax
mov cl, bl
mov eax, ebx
mov dword [ebp - 0x3e4], 0xab69605e
movzx esi, word [ebp - 0x3e2]
mov dword [ebp - 0xab8], eax
mov dword [ebp - 0xb94], eax
mov eax, 0x7f1137f
mov edx, eax
mov dword [ebp - 0xac0], esi
shr edx, 0x10
mov esi, 0x1000e0da
movzx eax, ax
add edi, 7
mov dword [ebp - 0xac8], edx
mov edx, ebx
mov dword [ebp - 0xac4], ebx
mov dword [ebp - 0xb70], ebx
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xaf0], edi
mov dword [ebp - 0xaf8], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
mov dword [ebp - 0xab8], edx
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
add esi, 8
shl edi, 8
or edi, eax
mov dword [ebp - 0xad4], esi
mov esi, edi
mov eax, 0x7f1137f
xor esi, dword [ebp - 0xb70]
xor esi, edx
xor esi, eax
xor esi, 0xab69605e
mov eax, esi
rol eax, 0xa
lea edx, [esi + 0x54969fa2]
rol edx, 5
imul edx, dword [ebp - 0xabc]
add edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov edx, 0x7f1137f
add edx, eax
mov dword [ebp - 0xab8], eax
ror edx, 9
imul edx, dword [ebp - 0xac0]
rol eax, 2
sub edx, eax
xor esi, edx
mov eax, esi
sub eax, dword [ebp - 0xabc]
imul edx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xab8], eax
xor edx, dword [ebp - 0xac0]
rol edx, 6
imul edx, dword [ebp - 0xac8]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xab8]
xor edx, eax
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0xab8], edx
xor eax, dword [ebp - 0xab8]
imul eax, dword [ebp - 0xac0]
ror edx, 6
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
add eax, esi
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov dword [ebp - 0xab8], eax
lea edx, [eax + 0x54969fa2]
rol eax, 8
ror edx, 0xe
imul edx, dword [ebp - 0xac8]
sub edx, eax
xor esi, edx
mov edx, esi
mov eax, esi
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, dword [ebp - 0xabc]
xor edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xab8], eax
xor edx, dword [ebp - 0xac8]
imul edx, dword [ebp - 0xac0]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [ebp - 0xab8]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xac8]
xor esi, eax
mov dword [ebp - 0xab8], esi
sub esi, dword [ebp - 0xac8]
xor esi, edx
xor esi, 0xab69605e
mov edx, esi
mov eax, esi
xor edx, dword [ebp - 0xac8]
rol edx, 2
imul edx, dword [ebp - 0xabc]
shr eax, 2
add edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov dword [ebp - 0xab8], eax
lea edx, [eax - 0x7f1137f]
rol eax, 7
ror edx, 6
imul edx, dword [ebp - 0xac0]
add edx, eax
mov eax, dword [ebp - 0xabc]
xor esi, edx
xor eax, esi
mov edx, esi
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xab8], eax
xor edx, dword [ebp - 0xac0]
rol edx, 5
imul edx, dword [ebp - 0xac8]
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xab8]
xor esi, edx
mov edx, 0x7f1137f
xor eax, edx
xor eax, esi
xor eax, 0xab69605e
mov dword [ebp - 0xab8], eax
ror eax, 3
sub eax, dword [ebp - 0xac0]
imul eax, dword [ebp - 0xabc]
xor esi, eax
mov eax, esi
sub eax, edx
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov dword [ebp - 0xab8], eax
lea edx, [eax - 0x54969fa2]
rol eax, 0xe
rol edx, 3
imul edx, dword [ebp - 0xac8]
add edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xabc]
sub edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xab8], eax
shr eax, 3
xor edx, 0x605e
imul edx, dword [ebp - 0xac0]
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
xor eax, esi
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xad8]
rol eax, 2
mov dword [ebp - 0xb70], esi
mov esi, dword [ebp - 0xaf0]
xor edx, eax
mov dword [ebp - 0xad8], edi
xor edx, dword [ebp - 0xac4]
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov dword [ebp - 0xac4], ebx
mov dword [ebp - 0xb94], eax
mov byte [esi - 4], al
mov al, byte [ebp - 0xb70]
ror dword [ebp - 0xb94], 8
mov byte [esi], al
ror dword [ebp - 0xb70], 8
mov al, byte [ebp - 0xb94]
mov byte [esi - 5], al
mov al, byte [ebp - 0xb70]
ror dword [ebp - 0xb94], 8
mov byte [esi - 1], al
ror dword [ebp - 0xb70], 8
mov al, byte [ebp - 0xb94]
mov byte [esi - 6], al
ror dword [ebp - 0xb94], 8
mov al, byte [ebp - 0xb70]
mov byte [esi - 2], al
ror dword [ebp - 0xb70], 8
mov al, byte [ebp - 0xb94]
mov byte [esi - 7], al
mov al, byte [ebp - 0xb70]
mov byte [esi - 3], al
add esi, 8
mov edx, dword [ebp - 0xb94]
ror dword [ebp - 0xb70], 8
ror edx, 8
sub dword [ebp - 0xaf8], 1
mov dword [ebp - 0xaf0], esi
mov esi, dword [ebp - 0xad4]
mov dword [ebp - 0xb94], edx
jne 0x100262cf
mov esi, dword [ebp - 0xb08]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x10026695
movzx eax, cl
cdq
cmp eax, dword [0x1000e410]
jne 0x100266c3
cmp edx, dword [0x1000e414]
jne 0x100266c3
mov dword [ebp - 0xad0], esi
mov edi, 0x337
mov esi, ebx
jmp 0x100266d0
mov dword [ebp - 0xb18], 0xc004d501
or edi, 0xffffffff
test esi, esi
je 0x100266e3
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xb18], ebx
jl 0x1002684a
mov eax, dword [ebp - 0xad0]
mov esi, eax
push 0x40
push ebx
push 0x1009efb0
mov byte [edi + eax], bl
call sub.msvcrt.dll_memset
mov eax, esi
add esp, 0xc
cmp byte [eax], bl
je 0x10026851
mov edi, 0x1009efb0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xad4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10026726
sub ecx, dword [ebp - 0xad4]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x1002684a
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xabc], ecx
cmp word [eax], dx
je 0x1002676e
mov ecx, 0xc000007b
mov dword [ebp - 0xabc], ecx
jmp 0x100267b6
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x10026761
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x10026761
cmp dword [edx], 0x4550
jne 0x10026761
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xba8]
je 0x100267a4
cmp ax, word [ebp - 0xb4c]
je 0x100267a4
mov ecx, 0xc000000d
jmp 0x10026766
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xac4], ebx
test eax, eax
je 0x10026831
mov edx, esi
mov dword [ebp - 0xb08], esi
lea eax, [edx + 1]
mov dword [ebp - 0xad4], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x100267dd
sub edx, dword [ebp - 0xad4]
inc esi
add esi, edx
test ecx, ecx
js 0x10026816
push dword [ebp - 0xb08]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002683c
mov ecx, dword [ebp - 0xadc]
mov dword [ecx*4 + 0x1009e5d0], eax
mov ecx, dword [ebp - 0xabc]
mov eax, dword [ebp - 0xac4]
inc dword [ebp - 0xadc]
inc eax
mov dword [ebp - 0xac4], eax
cmp eax, dword [ebp - 0xad8]
jb 0x100267cc
add edi, 0x10
cmp byte [esi], bl
jne 0x10026719
mov esi, dword [ebp - 0xabc]
mov eax, dword [ebp - 0xad0]
jmp 0x10026853
mov esi, 0xc000007a
jmp 0x10026842
mov esi, ebx
test eax, eax
je 0x10026866
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jns 0x100268a6
mov esi, ebx
mov eax, dword [esi + 0x1009efb0]
test eax, eax
je 0x1002687d
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x1002686c
push 0x40
push ebx
push 0x1009efb0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x100036a0
mov edi, 0x1009e5d0
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x100268b1
mov eax, dword [0x1009f6e0]
inc eax
mov dword [0x1009f6e0], eax
xor eax, eax
mov ecx, 0x1009f6e4
xchg dword [ecx], eax
push 0x54
lea eax, [ebp - 0x7bc]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xb44]
add esp, 0xc
mov esi, dword [0x1009e64c]
mov ecx, eax
mov dword [ebp - 0x354], ebx
push 0xf
pop edx
and ecx, edx
mov dword [ebp - 0xaf4], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0xc], cx
mov ecx, eax
shr ecx, 8
push 0x403
and ecx, edx
shr eax, 0xc
push ebx
mov word [ebp - 0xa], cx
and eax, edx
push ebx
mov ecx, esi
mov word [ebp - 8], ax
call dword [0x100a0bc0]
call esi
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xac8], 0xffffff
test eax, eax
jne 0x10026967
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xab8], edi
test edi, edi
jle 0x10026952
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xab8], edi
test edi, edi
js 0x10027f8a
mov dword [ebp - 0xab8], 0x80004005
jmp 0x10027f8a
mov esi, dword [0x1009e620]
lea eax, [ebp - 0xc00]
push eax
push ebx
lea eax, [ebp - 0xbd4]
mov dword [ebp - 0xbe8], ebx
push eax
mov edi, ebx
mov dword [ebp - 0xbdc], ebx
push 8
mov ecx, esi
mov dword [ebp - 0xb44], ebx
mov dword [ebp - 0xb84], ebx
mov dword [ebp - 0xbc8], ebx
mov dword [ebp - 0xbb8], ebx
mov dword [ebp - 0xab8], edi
mov dword [ebp - 0xc00], ebx
call dword [0x100a0bc0]
call esi
test eax, eax
jne 0x100269f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xab8], edi
test edi, edi
jle 0x100269e1
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xab8], edi
test edi, edi
js 0x10026b43
mov edi, 0x80004005
mov dword [ebp - 0xab8], edi
jmp 0x10026b43
mov eax, dword [ebp - 0xc00]
add eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xbc8]
mov esi, eax
call fcn.10061a94
test esi, esi
jne 0x10026a2c
mov dword [ebp - 0xbc8], ebx
mov edi, 0x8007000e
jmp 0x100269ec
mov eax, dword [ebp - 0xbd4]
mov dword [ebp - 0xbc8], esi
lea eax, [eax*4 + 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xbb8]
mov esi, eax
call fcn.10061a94
test esi, esi
jne 0x10026a6f
mov edi, 0x8007000e
mov dword [ebp - 0xab8], edi
jmp 0x10026b3d
lea eax, [ebp - 0xc00]
mov dword [ebp - 0xbb8], esi
mov esi, dword [0x1009e620]
mov ecx, esi
push eax
push dword [ebp - 0xbc8]
lea eax, [ebp - 0xbd4]
push eax
push 8
call dword [0x100a0bc0]
call esi
test eax, eax
je 0x100269be
cmp dword [ebp - 0xbd4], 0
mov edx, dword [ebp - 0xbb8]
mov eax, dword [ebp - 0xbc8]
mov dword [ebp - 0xac4], edx
mov dword [ebp - 0xad8], ebx
jbe 0x10026b1e
mov edi, eax
mov esi, dword [0x1009e628]
mov ecx, esi
push ebx
push edi
call dword [0x100a0bc0]
call esi
mov edx, dword [ebp - 0xac4]
mov ecx, edi
mov dword [edx], eax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10026ae5
mov eax, dword [ebp - 0xad8]
sub ecx, esi
sar ecx, 1
add edx, 4
mov dword [ebp - 0xac4], edx
lea edi, [edi + ecx*2]
add edi, 2
inc eax
mov dword [ebp - 0xad8], eax
cmp eax, dword [ebp - 0xbd4]
jb 0x10026ac6
mov edi, dword [ebp - 0xab8]
mov dword [edx], 0x409
mov eax, dword [ebp - 0xbb8]
mov dword [ebp - 0xbe8], eax
mov eax, dword [ebp - 0xbd4]
inc eax
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xbb8], ebx
lea ecx, [ebp - 0xbb8]
call fcn.10061a94
lea ecx, [ebp - 0xbc8]
call fcn.10061a94
test edi, edi
js 0x100272af
cmp dword [ebp - 0xac4], 0
mov edi, ebx
mov dword [ebp - 0xadc], edi
mov esi, ebx
jbe 0x10026ba1
mov eax, dword [ebp - 0xbe8]
mov edx, ebx
mov ecx, dword [eax + esi*4]
cmp ecx, dword [edx*4 + 0x1000dce0]
je 0x10026b99
inc edx
cmp edx, 0x26
jb 0x10026b7c
inc esi
cmp esi, dword [ebp - 0xac4]
jb 0x10026b7a
jmp 0x10026ba1
mov edi, edx
mov dword [ebp - 0xadc], edx
mov esi, dword [0x1009e624]
lea eax, [ebp - 0xb8]
push ebx
push 0x55
push eax
push dword [edi*4 + 0x1000dce0]
mov ecx, esi
mov dword [ebp - 0xb18], ebx
call dword [0x100a0bc0]
call esi
test eax, eax
je 0x10026c06
mov esi, dword [0x1009e618]
lea eax, [ebp - 0x68c]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xb8]
mov ecx, esi
push eax
call dword [0x100a0bc0]
call esi
test eax, eax
jle 0x10026c06
mov edi, dword [ebp - 0x680]
xor eax, eax
shr edi, 0x1b
inc eax
and edi, eax
mov dword [ebp - 0xb18], edi
mov edx, 0x1000ddf8
mov esi, ebx
mov ecx, edx
mov dword [ebp + esi*4 - 0x344], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10026c19
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0x10026c0d
imul ecx, dword [ebp - 0xadc], 3
movzx eax, byte [ecx + 0x1000dd78]
mov esi, dword [ebp + eax*4 - 0x344]
movzx eax, byte [ecx + 0x1000dd79]
mov dword [ebp - 0xb34], esi
mov dword [ebp - 0xc24], esi
mov eax, dword [ebp + eax*4 - 0x344]
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xc20], eax
movzx eax, byte [ecx + 0x1000dd7a]
mov esi, dword [ebp + eax*4 - 0x344]
mov dword [ebp - 0xb00], esi
mov dword [ebp - 0xc1c], esi
push 0x1c90
mov eax, ebx
push ebx
mov dword [ebp - 0xab8], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xb0c], edi
test edi, edi
je 0x1002714c
or dword [ebp - 0xad8], 0xffffffff
mov ecx, 0x7f1137f
mov edx, ecx
mov dword [ebp - 0x3ec], 0xab69605e
movzx esi, word [ebp - 0x3ea]
mov al, bl
shr edx, 0x10
add edi, 7
mov dword [ebp - 0x3e8], ecx
movzx ecx, cx
mov dword [ebp - 0xad0], esi
mov esi, 0x1000e41a
mov dword [ebp - 0xac4], ebx
mov dword [ebp - 0xb74], ebx
mov dword [ebp - 0xb98], ebx
mov dword [ebp - 0xabc], ecx
mov dword [ebp - 0xae8], edx
mov dword [ebp - 0xaf0], edi
mov dword [ebp - 0xaf8], 0x392
movzx edx, byte [esi - 2]
movzx ecx, byte [esi - 1]
movzx edi, byte [esi + 2]
shl edx, 8
or edx, ecx
shl edi, 8
movzx ecx, byte [esi]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 1]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 3]
or edi, ecx
mov dword [ebp - 0xb08], edx
movzx ecx, byte [esi + 4]
xor ebx, edx
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 5]
add esi, 8
shl edi, 8
or edi, ecx
mov dword [ebp - 0xb1c], esi
mov esi, ebx
mov ecx, 0x7f1137f
xor esi, ecx
xor esi, edi
xor esi, dword [ebp - 0xb74]
xor esi, 0xab69605e
mov ecx, esi
rol ecx, 0xa
lea edx, [esi + 0x54969fa2]
rol edx, 5
imul edx, dword [ebp - 0xabc]
add edx, ecx
xor ebx, edx
mov edx, 0x7f1137f
mov ecx, ebx
rol ecx, 2
lea edx, [ebx + edx]
ror edx, 9
imul edx, dword [ebp - 0xad0]
sub edx, ecx
xor esi, edx
mov ecx, esi
sub ecx, dword [ebp - 0xabc]
imul edx, ecx, 0x605e
mov ecx, esi
shr ecx, 0xd
sub edx, ecx
xor ebx, edx
mov edx, ebx
mov ecx, ebx
xor edx, dword [ebp - 0xad0]
rol edx, 6
imul edx, dword [ebp - 0xae8]
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub ecx, edx
xor ebx, ecx
mov ecx, ebx
mov edx, ebx
xor ecx, dword [ebp - 0xabc]
imul ecx, dword [ebp - 0xad0]
ror edx, 6
xor edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
add ecx, esi
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, esi
rol ecx, 2
add edx, ecx
xor ebx, edx
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
mov ecx, ebx
imul edx, dword [ebp - 0xae8]
rol ecx, 8
sub edx, ecx
xor esi, edx
mov edx, esi
mov ecx, esi
xor edx, 0xab69605e
ror ecx, 0xa
ror edx, 0xc
imul edx, dword [ebp - 0xabc]
xor edx, ecx
xor ebx, edx
mov edx, ebx
mov ecx, ebx
xor edx, dword [ebp - 0xae8]
imul edx, dword [ebp - 0xad0]
shr ecx, 0xa
xor edx, ecx
xor edx, esi
mov ecx, edx
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, dword [ebp - 0xae8]
xor ebx, ecx
mov esi, ebx
sub esi, dword [ebp - 0xae8]
xor esi, edx
mov edx, dword [ebp - 0xae8]
xor esi, 0xab69605e
xor edx, esi
mov ecx, esi
rol edx, 2
imul edx, dword [ebp - 0xabc]
shr ecx, 2
add edx, ecx
mov ecx, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, ecx
mov ecx, ebx
ror edx, 6
imul edx, dword [ebp - 0xad0]
rol ecx, 7
add edx, ecx
mov ecx, dword [ebp - 0xabc]
xor esi, edx
xor ecx, esi
mov edx, esi
imul ecx, ecx, 0x605e
ror edx, 9
add edx, ecx
xor ebx, edx
mov edx, dword [ebp - 0xad0]
xor edx, ebx
mov dword [ebp - 0xad4], ebx
rol edx, 5
mov ecx, ebx
imul edx, dword [ebp - 0xae8]
rol ecx, 7
add edx, ecx
xor esi, edx
mov edx, 0x7f1137f
mov ebx, esi
xor ebx, edx
xor ebx, dword [ebp - 0xad4]
xor ebx, 0xab69605e
mov ecx, ebx
ror ecx, 3
sub ecx, dword [ebp - 0xad0]
imul ecx, dword [ebp - 0xabc]
xor esi, ecx
mov ecx, esi
sub ecx, edx
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, esi
ror ecx, 6
sub edx, ecx
xor ebx, edx
mov ecx, ebx
rol ecx, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [ebp - 0xae8]
add edx, ecx
xor esi, edx
mov ecx, esi
ror ecx, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xabc]
sub edx, ecx
xor ebx, edx
mov edx, ebx
mov ecx, ebx
shr ecx, 3
xor edx, 0x605e
imul edx, dword [ebp - 0xad0]
xor edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
xor ecx, esi
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, esi
xor esi, dword [ebp - 0xad8]
rol ecx, 2
mov dword [ebp - 0xb74], esi
mov esi, dword [ebp - 0xb1c]
xor edx, ecx
mov dword [ebp - 0xad8], edi
xor edx, dword [ebp - 0xac4]
xor ebx, edx
mov edx, dword [ebp - 0xaf0]
mov dword [ebp - 0xb98], ebx
mov byte [edx - 4], bl
mov cl, byte [ebp - 0xb74]
ror dword [ebp - 0xb98], 8
mov byte [edx], cl
mov cl, byte [ebp - 0xb98]
ror dword [ebp - 0xb74], 8
mov byte [edx - 5], cl
mov cl, byte [ebp - 0xb74]
ror dword [ebp - 0xb98], 8
mov byte [edx - 1], cl
mov cl, byte [ebp - 0xb98]
ror dword [ebp - 0xb74], 8
mov byte [edx - 6], cl
mov cl, byte [ebp - 0xb74]
ror dword [ebp - 0xb98], 8
mov byte [edx - 2], cl
mov cl, byte [ebp - 0xb98]
ror dword [ebp - 0xb74], 8
mov byte [edx - 7], cl
mov cl, byte [ebp - 0xb74]
mov byte [edx - 3], cl
add edx, 8
mov ebx, dword [ebp - 0xb98]
ror dword [ebp - 0xb74], 8
mov ecx, dword [ebp - 0xb08]
ror ebx, 8
sub dword [ebp - 0xaf8], 1
mov dword [ebp - 0xb98], ebx
mov dword [ebp - 0xac4], ecx
mov dword [ebp - 0xaf0], edx
jne 0x10026d1d
mov ecx, dword [ebp - 0xb0c]
xor ebx, ebx
mov edx, ebx
mov esi, 0x1c90
xor al, byte [ecx + edx]
inc edx
cmp edx, esi
jb 0x10027088
movzx eax, al
cdq
cmp eax, dword [0x100100a8]
jne 0x100270ba
cmp edx, dword [0x100100ac]
jne 0x100270ba
mov edi, dword [ebp - 0xab8]
mov dword [ebp - 0xbdc], ecx
mov ecx, ebx
mov dword [ebp - 0xb44], esi
jmp 0x100270c5
mov edi, 0xc004d501
mov dword [ebp - 0xab8], edi
test ecx, ecx
je 0x100270d8
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
js 0x100272d3
mov edi, dword [ebp - 0xbdc]
mov esi, ebx
mov edx, ebx
mov ebx, dword [ebp - 0xadc]
cmp ebx, edx
jne 0x100270fb
mov dword [ebp + esi*4 - 0x2f8], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0xad4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10027106
sub ecx, dword [ebp - 0xad4]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0x100270f0
inc esi
push 0
pop ebx
cmp esi, 6
jb 0x100270e8
push 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xb84]
mov edi, eax
call fcn.10061a94
test edi, edi
jne 0x1002715c
mov dword [ebp - 0xb84], ebx
mov edi, 0x8007000e
mov dword [ebp - 0xab8], edi
jmp 0x100272d3
mov dword [ebp - 0xb84], edi
lea ecx, [ebp - 0xc]
xor eax, eax
mov dword [ebp - 0xac4], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, ebx
movzx edx, word [ecx]
mov eax, ebx
cmp dx, word [eax*2 + 0x1000ddec]
je 0x1002718c
inc eax
cmp eax, 6
jb 0x10027177
jmp 0x10027245
mov edx, dword [ebp + eax*4 - 0x2f8]
mov ecx, edx
mov dword [ebp - 0xad4], edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002719e
sub ecx, esi
mov esi, dword [0x1009e630]
push ebx
push ebx
lea eax, [ecx + 1]
mov ecx, esi
push eax
push edx
push ebx
push 0xfde9
call dword [0x100a0bc0]
call esi
mov esi, eax
test esi, esi
je 0x10027280
lea ecx, [esi + esi]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0xb84]
mov dword [ecx + edi], eax
mov eax, dword [ebp - 0xb84]
cmp dword [eax + edi], ebx
je 0x1002714c
mov edx, dword [ebp - 0xad4]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xad4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10027209
sub ecx, dword [ebp - 0xad4]
mov eax, dword [ebp - 0xb84]
push esi
mov esi, dword [0x1009e630]
push dword [eax + edi]
lea eax, [ecx + 1]
mov ecx, esi
push eax
push edx
push ebx
push 0xfde9
call dword [0x100a0bc0]
call esi
test eax, eax
je 0x10027280
mov ecx, dword [ebp - 0xac4]
add ecx, 2
add edi, 4
mov dword [ebp - 0xac4], ecx
cmp edi, 0xc
jb 0x10027172
mov eax, dword [ebp - 0xb84]
mov edi, dword [ebp - 0xab8]
mov dword [ebp - 0xbe4], eax
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0xb84], ebx
mov dword [ebp - 0x7bc], eax
jmp 0x100272d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xab8], edi
test edi, edi
jle 0x100272a3
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xab8], edi
test edi, edi
js 0x100272d3
mov edi, 0x80004005
jmp 0x10027151
mov eax, dword [ebp - 0xc1c]
mov dword [ebp - 0xb00], eax
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0xb20], eax
mov eax, dword [ebp - 0xc24]
mov dword [ebp - 0xb34], eax
cmp dword [ebp - 0xb84], 0
je 0x10027339
mov esi, ebx
mov eax, dword [ebp - 0xb84]
cmp dword [eax + esi], ebx
je 0x10027331
mov ecx, dword [eax + esi]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x100272ef
mov eax, dword [ebp - 0xb84]
sub ecx, edx
sar ecx, 1
mov eax, dword [eax + esi]
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x1002731a
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x10027312
mov eax, dword [ebp - 0xb84]
push dword [eax + esi]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
add esi, 4
cmp esi, 0xc
jb 0x100272de
mov eax, dword [ebp - 0xbdc]
test eax, eax
je 0x10027355
mov ecx, dword [ebp - 0xb44]
test ecx, ecx
je 0x10027355
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x1002734d
lea ecx, [ebp - 0xb84]
call fcn.10061a94
lea ecx, [ebp - 0xbdc]
call fcn.10061a94
lea ecx, [ebp - 0xbe8]
call fcn.10061a94
test edi, edi
js 0x10027f73
mov eax, dword [ebp - 0xbe4]
lea edi, [ebp - 0xcc0]
mov esi, dword [0x1009e684]
push ebx
mov ecx, dword [eax]
mov dword [ebp - 0x7b4], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x7b0], ecx
mov ecx, esi
mov eax, dword [eax + 8]
mov dword [ebp - 0x7ac], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xcc0]
push eax
push ebx
mov edi, ebx
mov dword [ebp - 0xcc0], 0xc
push 0x42
mov dword [ebp - 0xab8], edi
call dword [0x100a0bc0]
call esi
test eax, eax
jne 0x1002740e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xab8], edi
test edi, edi
jle 0x100273fd
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xab8], edi
test edi, edi
mov eax, ebx
js 0x10027419
mov edi, 0x80004005
mov dword [ebp - 0xab8], edi
jmp 0x10027419
mov eax, dword [ebp - 0xcbc]
xor ecx, ecx
inc ecx
and eax, ecx
mov dword [ebp - 0x7b8], eax
test edi, edi
js 0x10027f73
mov eax, dword [ebp - 0xaf4]
push 0x2a
pop ecx
mov dword [ebp - 0xacc], ecx
sub eax, 1
je 0x10027464
sub eax, 1
je 0x10027458
sub eax, 1
jne 0x10027474
mov edi, 0xe1
mov dword [ebp - 0xb38], edi
mov dword [ebp - 0xb3c], edi
jmp 0x10027474
mov dword [ebp - 0xb38], 0xf
jmp 0x1002746a
mov dword [ebp - 0xb38], ecx
mov dword [ebp - 0xb3c], 0xb
mov esi, 0xdc
mov dword [ebp - 0xb14], 0x60
push esi
lea eax, [ebp - 0x768]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov word [ebp - 0x724], si
mov esi, dword [0x1009e640]
lea eax, [ebp - 0x768]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0x100a0bc0]
call esi
test eax, eax
je 0x10027505
mov eax, dword [ebp - 0x6bc]
movzx edi, word [ebp - 0x6c2]
mov ecx, dword [ebp - 0x6b8]
push 0x60
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0x3bc], eax
pop eax
mov dword [ebp - 0xb14], edi
mov dword [ebp - 0x3c0], ebx
mov dword [ebp - 0x3c4], ebx
mov dword [ebp - 0xad8], ecx
mov dword [ebp - 0x3b8], ecx
cmp edi, eax
jae 0x1002751d
mov dword [ebp - 0xb14], eax
jmp 0x1002751d
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0xad8], eax
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0xadc], eax
xor eax, eax
inc eax
cmp dword [ebp - 0xaf4], eax
mov eax, dword [ebp - 0xb34]
je 0x10027534
mov eax, dword [ebp - 0xb00]
push 0x5c
mov dword [ebp - 0xac4], eax
lea eax, [ebp - 0x610]
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x1009e64c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xab8], edi
push 0x403
push ebx
push ebx
call dword [0x100a0bc0]
call esi
mov dword [ebp - 0xad4], eax
test eax, eax
jne 0x100275ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xab8], edi
test edi, edi
jle 0x10027598
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xab8], edi
test edi, edi
js 0x10027662
mov dword [ebp - 0xab8], 0x80004005
jmp 0x10027f73
mov esi, dword [0x1009e62c]
mov ecx, esi
push 0x48
push dword [ebp - 0xb14]
push dword [ebp - 0xb38]
call dword [0x100a0bc0]
call esi
push dword [ebp - 0xac4]
neg eax
mov dword [ebp - 0x600], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x5f4]
mov dword [ebp - 0x610], eax
mov byte [ebp - 0x5f6], 5
call fcn.1001b46e
mov esi, dword [0x1009e5e0]
lea eax, [ebp - 0x610]
push eax
mov ecx, esi
call dword [0x100a0bc0]
call esi
test eax, eax
jne 0x10027645
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xab8], edi
test edi, edi
jle 0x10027636
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xab8], edi
test edi, edi
js 0x1002764b
mov edi, 0x80004005
mov dword [ebp - 0xab8], edi
jmp 0x1002764b
mov dword [ebp - 0x7a8], eax
push dword [ebp - 0xad4]
mov esi, dword [0x1009e680]
mov ecx, esi
push ebx
call dword [0x100a0bc0]
call esi
test edi, edi
js 0x10027f73
xor eax, eax
inc eax
cmp dword [ebp - 0xaf4], eax
je 0x10027681
mov eax, dword [ebp - 0xb00]
mov dword [ebp - 0xb34], eax
push 0x5c
lea eax, [ebp - 0x66c]
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x1009e64c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xab8], edi
push 0x403
push ebx
push ebx
call dword [0x100a0bc0]
call esi
mov dword [ebp - 0xad4], eax
test eax, eax
jne 0x100276ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xab8], edi
test edi, edi
jle 0x100276df
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xab8], edi
test edi, edi
js 0x1002779f
jmp 0x1002759e
mov esi, dword [0x1009e62c]
mov ecx, esi
push 0x48
push dword [ebp - 0xb14]
push dword [ebp - 0xb3c]
call dword [0x100a0bc0]
call esi
push dword [ebp - 0xb34]
neg eax
mov dword [ebp - 0x65c], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x650]
mov dword [ebp - 0x66c], eax
mov byte [ebp - 0x652], 5
call fcn.1001b46e
mov esi, dword [0x1009e5e0]
lea eax, [ebp - 0x66c]
push eax
mov ecx, esi
call dword [0x100a0bc0]
call esi
test eax, eax
jne 0x10027782
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xab8], edi
test edi, edi
jle 0x10027773
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xab8], edi
test edi, edi
js 0x10027788
mov edi, 0x80004005
mov dword [ebp - 0xab8], edi
jmp 0x10027788
mov dword [ebp - 0x7a4], eax
push dword [ebp - 0xad4]
mov esi, dword [0x1009e680]
mov ecx, esi
push ebx
call dword [0x100a0bc0]
call esi
test edi, edi
js 0x10027f73
mov esi, dword [ebp - 0xaf4]
mov ecx, ebx
mov eax, esi
mov edx, ebx
sub eax, 1
je 0x100277c2
sub eax, 1
je 0x10027800
sub eax, 1
jne 0x100277ce
mov ecx, dword [ebp - 0xadc]
mov edx, dword [ebp - 0xad8]
mov dword [ebp - 0x34c], ecx
mov dword [ebp - 0x348], edx
xor edx, edx
inc edx
cmp esi, edx
je 0x10027840
lea eax, [esi - 2]
cmp eax, edx
ja 0x10027814
mov eax, ebx
mov dword [ebp - 0xacc], ebx
mov edx, ebx
mov dword [ebp - 0xb38], eax
mov dword [ebp - 0xb3c], ebx
jmp 0x10027857
mov eax, dword [ebp - 0xadc]
cdq
and edx, 3
lea ecx, [edx + eax]
mov edx, ebx
sar ecx, 2
jmp 0x100277ce
mov eax, dword [ebp - 0xbd8]
mov edx, dword [ebp - 0xbd8]
mov dword [ebp - 0xb3c], eax
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xacc], eax
mov eax, dword [ebp - 0xbd8]
mov dword [ebp - 0xb38], eax
jmp 0x10027857
mov edx, 0x96
mov dword [ebp - 0xb38], ebx
mov eax, ebx
mov dword [ebp - 0xb3c], 0x20
mov dword [ebp - 0xb34], edx
push dword [ebp - 0x7a8]
mov esi, dword [0x1009e60c]
sub ecx, edx
push dword [ebp - 0xac0]
mov edi, dword [ebp - 0x7b4]
sub ecx, eax
mov dword [ebp - 0xb30], ecx
mov eax, ebx
mov dword [ebp - 0x780], ecx
mov dword [ebp - 0x790], ecx
mov ecx, esi
mov dword [ebp - 0xab8], eax
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e63c]
mov ecx, esi
push ebx
push 0xc50
mov dword [ebp - 0xad4], eax
lea eax, [ebp - 0x798]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xac0]
call dword [0x100a0bc0]
call esi
test eax, eax
jne 0x100278da
mov edi, 0x80004005
mov dword [ebp - 0xab8], edi
jmp 0x100278dc
mov edi, ebx
mov eax, dword [ebp - 0xad4]
test eax, eax
je 0x100278fd
mov esi, dword [0x1009e60c]
mov ecx, esi
push eax
push dword [ebp - 0xac0]
call dword [0x100a0bc0]
call esi
test edi, edi
js 0x10027f73
push dword [ebp - 0x7a4]
mov esi, dword [0x1009e60c]
mov eax, ebx
push dword [ebp - 0xac0]
mov edi, dword [ebp - 0x7b0]
mov ecx, esi
mov dword [ebp - 0xab8], eax
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e63c]
mov ecx, esi
push ebx
push 0xc50
mov dword [ebp - 0xad4], eax
lea eax, [ebp - 0x788]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xac0]
call dword [0x100a0bc0]
call esi
test eax, eax
jne 0x1002796c
mov edi, 0x80004005
mov dword [ebp - 0xab8], edi
jmp 0x1002796e
mov edi, ebx
mov eax, dword [ebp - 0xad4]
test eax, eax
je 0x1002798f
mov esi, dword [0x1009e60c]
mov ecx, esi
push eax
push dword [ebp - 0xac0]
call dword [0x100a0bc0]
call esi
test edi, edi
js 0x10027f73
mov eax, dword [ebp - 0xaf4]
cmp eax, 2
je 0x100279a7
cmp eax, 3
jne 0x100279c9
mov edi, dword [ebp - 0x780]
mov dword [ebp - 0xb30], edi
cmp dword [ebp - 0x790], edi
jle 0x100279cf
mov edi, dword [ebp - 0x790]
mov dword [ebp - 0xb30], edi
jmp 0x100279cf
mov edi, dword [ebp - 0xb30]
cmp dword [ebp - 0x7bc], 0
mov esi, dword [0x1009e678]
mov ecx, esi
push dword [ebp - 0xacc]
je 0x10027a22
mov eax, dword [ebp - 0xb38]
sub eax, dword [ebp - 0x790]
add eax, edi
push eax
lea eax, [ebp - 0x798]
push eax
call dword [0x100a0bc0]
call esi
mov eax, dword [ebp - 0x78c]
add eax, dword [ebp - 0xb3c]
push eax
mov eax, dword [ebp - 0xb38]
sub eax, dword [ebp - 0x780]
add eax, edi
push eax
jmp 0x10027a4a
push dword [ebp - 0xb34]
lea eax, [ebp - 0x798]
push eax
call dword [0x100a0bc0]
call esi
mov eax, dword [ebp - 0x78c]
add eax, dword [ebp - 0xb3c]
push eax
push dword [ebp - 0xb34]
mov esi, dword [0x1009e678]
lea eax, [ebp - 0x788]
push eax
mov ecx, esi
call dword [0x100a0bc0]
call esi
mov eax, dword [ebp - 0xaf4]
cmp eax, 2
je 0x10027d62
cmp eax, 3
je 0x10027d62
xor edx, edx
inc edx
cmp eax, edx
jne 0x10027d81
push 0x5c
lea eax, [ebp - 0x5b4]
mov dword [ebp - 0x79c], 0xffffff
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x1009e64c]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xab8], edi
push 0x403
push ebx
push ebx
call dword [0x100a0bc0]
call esi
mov dword [ebp - 0xad4], eax
test eax, eax
jne 0x10027af7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xab8], edi
test edi, edi
jle 0x10027aec
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xab8], edi
test edi, edi
js 0x10027ba8
jmp 0x1002759e
mov esi, dword [0x1009e62c]
mov ecx, esi
push 0x48
push dword [ebp - 0xb14]
push 0xb
call dword [0x100a0bc0]
call esi
push dword [ebp - 0xb20]
neg eax
mov dword [ebp - 0x5a4], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x598]
mov dword [ebp - 0x5b4], eax
mov byte [ebp - 0x59a], 5
call fcn.1001b46e
mov esi, dword [0x1009e5e0]
lea eax, [ebp - 0x5b4]
push eax
mov ecx, esi
call dword [0x100a0bc0]
call esi
test eax, eax
jne 0x10027b8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xab8], edi
test edi, edi
jle 0x10027b7c
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xab8], edi
test edi, edi
js 0x10027b91
mov edi, 0x80004005
mov dword [ebp - 0xab8], edi
jmp 0x10027b91
mov dword [ebp - 0x7a0], eax
push dword [ebp - 0xad4]
mov esi, dword [0x1009e680]
mov ecx, esi
push ebx
call dword [0x100a0bc0]
call esi
test edi, edi
js 0x10027f73
push dword [ebp - 0x7a0]
mov eax, dword [ebp - 0xb30]
push dword [ebp - 0xac0]
mov esi, dword [0x1009e60c]
mov ecx, esi
mov edi, dword [ebp - 0x7ac]
mov dword [ebp - 0x770], eax
mov eax, ebx
mov dword [ebp - 0xab8], eax
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e63c]
mov ecx, esi
push ebx
push 0x460
mov dword [ebp - 0xad4], eax
lea eax, [ebp - 0x778]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xac0]
call dword [0x100a0bc0]
call esi
test eax, eax
jne 0x10027c23
mov edi, 0x80004005
mov dword [ebp - 0xab8], edi
jmp 0x10027c25
mov edi, ebx
mov eax, dword [ebp - 0xad4]
test eax, eax
je 0x10027c46
mov esi, dword [0x1009e60c]
mov ecx, esi
push eax
push dword [ebp - 0xac0]
call dword [0x100a0bc0]
call esi
test edi, edi
js 0x10027f73
mov eax, dword [ebp - 0x770]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x770], eax
cmp eax, ecx
jge 0x10027c6a
mov dword [ebp - 0x770], ecx
mov edi, dword [ebp - 0xb14]
mov esi, dword [0x1009e62c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x778]
mov dword [ebp - 0x76c], 0x20
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e62c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x774]
mov dword [ebp - 0x778], eax
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e62c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x770]
mov dword [ebp - 0x774], eax
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e62c]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x76c]
mov dword [ebp - 0x770], eax
call dword [0x100a0bc0]
call esi
cmp dword [ebp - 0x7bc], 0
mov dword [ebp - 0x76c], eax
je 0x10027d37
mov ecx, dword [ebp - 0x798]
cmp ecx, dword [ebp - 0x788]
jl 0x10027d13
mov ecx, dword [ebp - 0x788]
mov eax, dword [ebp - 0x77c]
add eax, 0x24
mov esi, dword [0x1009e678]
push eax
push ecx
lea eax, [ebp - 0x778]
mov ecx, esi
push eax
call dword [0x100a0bc0]
call esi
jmp 0x10027d7e
mov ecx, dword [ebp - 0x790]
cmp ecx, dword [ebp - 0x780]
jg 0x10027d4b
mov ecx, dword [ebp - 0x780]
mov eax, dword [ebp - 0x77c]
sub ecx, dword [ebp - 0x770]
add eax, 0x24
add ecx, dword [ebp - 0x778]
jmp 0x10027d1c
mov eax, dword [ebp - 0x77c]
mov dword [ebp - 0x34c], edi
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x79c], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [ebp - 0x7bc]
lea edi, [ebp - 0x47c]
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0xad8], eax
mov eax, dword [ebp - 0x34c]
mov dword [ebp - 0xac4], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xaf4]
sub eax, 1
je 0x10027f61
sub eax, 1
je 0x10027e88
sub eax, 1
jne 0x10027f6d
mov esi, dword [0x1009e674]
lea edi, [ebp - 0x46c]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e654]
lea ecx, [ebp - 0x46c]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x46c], 0x28
call dword [0x100a0bc0]
call esi
test eax, eax
je 0x10027f6d
mov esi, dword [0x1009e670]
lea eax, [ebp - 0x458]
push eax
push ebx
mov ecx, esi
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e670]
lea eax, [ebp - 0x450]
push eax
push ebx
mov ecx, esi
call dword [0x100a0bc0]
call esi
mov eax, dword [ebp - 0x450]
lea esi, [ebp - 0x458]
sub eax, dword [ebp - 0xac4]
lea edi, [ebp - 0x47c]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x44c]
sub eax, dword [ebp - 0xad8]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
jmp 0x10027f56
mov esi, dword [0x1009e674]
lea edi, [ebp - 0x42c]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e654]
lea ecx, [ebp - 0x42c]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x42c], 0x28
call dword [0x100a0bc0]
call esi
test eax, eax
je 0x10027f6d
mov esi, dword [0x1009e670]
lea eax, [ebp - 0x418]
push eax
push ebx
mov ecx, esi
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e670]
lea eax, [ebp - 0x410]
push eax
push ebx
mov ecx, esi
call dword [0x100a0bc0]
call esi
cmp dword [ebp - 0xad4], 0
lea esi, [ebp - 0x418]
lea edi, [ebp - 0x47c]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x10027f2f
imul eax, dword [ebp - 0x410], 5
cdq
idiv ecx
add eax, dword [ebp - 0x418]
jmp 0x10027f41
mov eax, dword [ebp - 0x410]
sub eax, dword [ebp - 0xac4]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x354], eax
mov eax, dword [ebp - 0x40c]
sub eax, dword [ebp - 0xad8]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x350], eax
jmp 0x10027f6d
mov dword [ebp - 0x354], ebx
mov dword [ebp - 0x350], ebx
mov dword [ebp - 0xab8], ebx
push dword [ebp - 0xac0]
mov esi, dword [0x1009e680]
mov ecx, esi
push ebx
call dword [0x100a0bc0]
call esi
xor esi, esi
mov edi, 0x1009f6e4
inc esi
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x10027f92
mov eax, dword [0x1009f6e0]
test eax, eax
jle 0x10027ff3
sub eax, 1
mov dword [0x1009f6e0], eax
jne 0x10027ff3
mov esi, ebx
mov eax, dword [esi + 0x1009efb0]
test eax, eax
je 0x10027fc4
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x10027fb3
push 0x40
push ebx
push 0x1009efb0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x100036a0
mov edi, 0x1009e5d0
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0x1009f6e4
inc esi
xor eax, eax
xchg dword [edi], eax
lea ecx, [ebp - 0xbe4]
call fcn.10061a94
mov eax, dword [ebp - 0xab8]
test eax, eax
js 0x10029be2
mov eax, dword [ebp - 0x350]
mov edi, dword [ebp - 0x354]
push 0x54
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xc64], eax
lea eax, [ebp - 0x810]
push ebx
push eax
mov dword [ebp - 0xc68], edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xad8], esi
mov esi, dword [0x1009e5f8]
mov ecx, esi
push 7
push dword [ebp - 0xae4]
call dword [0x100a0bc0]
call esi
test eax, eax
je 0x100280a7
mov esi, dword [0x1009e604]
lea ecx, [ebp - 0x810]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100a0bc0]
call esi
test eax, eax
je 0x100280a7
push 0x20
pop eax
cmp word [ebp - 0x7fe], ax
jne 0x100280a7
cmp dword [ebp - 0x7fc], 0
je 0x100280a7
cmp dword [ebp - 0x80c], 0
jle 0x100280a7
cmp dword [ebp - 0x808], 0
jg 0x100280b6
cmp dword [ebp - 0xaf4], 1
mov dword [ebp - 0xad8], ebx
jne 0x1002812a
push dword [ebp - 0xac4]
mov esi, dword [0x1009e678]
lea eax, [ebp - 0x798]
push edi
push eax
mov ecx, esi
call dword [0x100a0bc0]
call esi
push dword [ebp - 0xac4]
mov esi, dword [0x1009e678]
lea eax, [ebp - 0x788]
push edi
push eax
mov ecx, esi
call dword [0x100a0bc0]
call esi
mov edi, dword [ebp - 0xaf4]
cmp edi, 1
jne 0x10028130
mov eax, dword [ebp - 0x7b8]
mov esi, dword [0x1009e5e4]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0x100a0bc0]
call esi
mov dword [ebp - 0xae0], eax
jmp 0x10028130
mov edi, dword [ebp - 0xaf4]
mov esi, dword [0x1009e610]
mov ecx, esi
push 1
push dword [ebp - 0xae4]
call dword [0x100a0bc0]
call esi
cmp dword [ebp - 0x7bc], 0
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xb14], 0x810
je 0x1002816b
mov dword [ebp - 0xb14], 0x20812
cmp dword [ebp - 0xad8], 0
je 0x10028ca1
mov eax, dword [ebp - 0x7b8]
mov esi, dword [ebp - 0x7b4]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0x7a8]
push 0x54
mov dword [ebp - 0xad4], eax
lea eax, [ebp - 0x8b8]
push ebx
push eax
mov dword [ebp - 0xb08], esi
call sub.msvcrt.dll_memset
push 0x54
lea eax, [ebp - 0xa5c]
push ebx
push eax
call sub.msvcrt.dll_memset
push 0x2c
lea eax, [ebp - 0x4a8]
mov dword [ebp - 0xaf0], ebx
push ebx
push eax
mov dword [ebp - 0xad8], ebx
mov dword [ebp - 0xadc], ebx
mov dword [ebp - 0xacc], ebx
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x384]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x10029bc2
mov edi, dword [ebp - 0xae4]
mov esi, dword [0x1009e5f8]
mov ecx, esi
push 7
push edi
call dword [0x100a0bc0]
call esi
test eax, eax
jne 0x10028220
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10029bc2
mov esi, dword [0x1009e604]
lea ecx, [ebp - 0x8b8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100a0bc0]
call esi
test eax, eax
je 0x10028262
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0x8b4]
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0xacc], eax
mov esi, dword [0x1009e5d8]
mov ecx, esi
push edi
call dword [0x100a0bc0]
call esi
mov esi, eax
mov dword [ebp - 0xae8], esi
test esi, esi
je 0x10028215
push 0x2c
lea eax, [ebp - 0x4a8]
mov dword [ebp - 0xc58], ebx
push ebx
mov edi, ebx
push eax
mov dword [ebp - 0xb44], edi
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x790]
add esp, 0xc
sub eax, dword [ebp - 0x798]
mov dword [ebp - 0x4a4], eax
mov eax, dword [ebp - 0x794]
sub eax, dword [ebp - 0x78c]
mov dword [ebp - 0x4a0], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x4a8], 0x28
mov word [ebp - 0x49c], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x49a], ax
lea eax, [ebp - 0xc58]
push eax
push ebx
lea eax, [ebp - 0x4a8]
push eax
push esi
mov esi, dword [0x1009e5dc]
mov ecx, esi
call dword [0x100a0bc0]
call esi
mov dword [ebp - 0xb18], eax
test eax, eax
jne 0x10028334
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x10028324
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x100286ec
mov edi, 0x80004005
jmp 0x100286ec
mov esi, dword [0x1009e604]
lea ecx, [ebp - 0xa5c]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100a0bc0]
call esi
test eax, eax
je 0x1002835e
mov eax, dword [ebp - 0xa48]
mov dword [ebp - 0xad8], eax
mov eax, dword [ebp - 0x790]
sub eax, dword [ebp - 0x798]
push dword [ebp - 0xb18]
mov esi, dword [0x1009e60c]
mov ecx, esi
push dword [ebp - 0xae8]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x78c]
sub eax, dword [ebp - 0x794]
mov dword [ebp - 0x378], eax
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e610]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xae8]
call dword [0x100a0bc0]
call esi
push dword [ebp - 0xad4]
mov esi, dword [0x1009e60c]
mov ecx, esi
push dword [ebp - 0xae8]
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e608]
mov ecx, esi
push ebx
mov dword [ebp - 0xb0c], eax
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e644]
mov ecx, esi
push eax
lea eax, [ebp - 0x384]
push eax
push dword [ebp - 0xae8]
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e63c]
lea eax, [ebp - 0x384]
push ebx
push dword [ebp - 0xb14]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb08]
push dword [ebp - 0xae8]
call dword [0x100a0bc0]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xaf4], eax
jne 0x1002846f
cmp dword [ebp - 0xac4], 0
je 0x10028463
mov esi, dword [0x1009e65c]
mov ecx, esi
push 8
call dword [0x100a0bc0]
call esi
mov dword [ebp - 0xb30], eax
jmp 0x10028479
mov dword [ebp - 0xb30], 0xffffff
jmp 0x10028479
mov dword [ebp - 0xb30], 0xffa8a8a8
mov esi, dword [ebp - 0x798]
mov edx, ebx
mov eax, dword [ebp - 0x794]
mov ecx, ebx
mov dword [ebp - 0xb00], esi
mov dword [ebp - 0xac4], ebx
test esi, esi
jns 0x100284a9
mov edx, esi
mov dword [ebp - 0xb00], ebx
neg edx
mov dword [ebp - 0xac4], edx
test eax, eax
jns 0x100284b3
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [ebp - 0x37c]
sub esi, edx
mov edx, dword [ebp - 0xadc]
sub edx, dword [ebp - 0xb00]
mov dword [ebp - 0xb20], esi
cmp esi, edx
jl 0x100284d9
mov esi, edx
mov dword [ebp - 0xb20], edx
mov edx, dword [ebp - 0x378]
sub dword [ebp - 0xacc], eax
sub edx, ecx
mov dword [ebp - 0xb1c], edx
cmp edx, dword [ebp - 0xacc]
jl 0x10028501
mov edx, dword [ebp - 0xacc]
mov dword [ebp - 0xb1c], edx
test esi, esi
jle 0x100286b5
test edx, edx
jle 0x100286b5
mov ebx, dword [ebp - 0x37c]
mov edi, dword [ebp - 0xadc]
mov esi, dword [ebp - 0xad8]
imul ecx, ebx
imul eax, edi
shl ebx, 2
mov dword [ebp - 0xad4], ebx
add ecx, dword [ebp - 0xac4]
add eax, dword [ebp - 0xb00]
shl edi, 2
mov dword [ebp - 0xb08], edi
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0xaf0]
mov dword [ebp - 0xaf8], ecx
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xb20]
mov dword [ebp - 0xaf0], eax
test esi, esi
jle 0x1002868e
mov ebx, eax
mov dword [ebp - 0xad8], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0xacc], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xac4], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x1002864f
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xb30]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac4]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xacc]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xb30]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xb2e]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xad8]
cdq
idiv ecx
mov edx, dword [ebp - 0xacc]
add al, bl
mov ebx, dword [ebp - 0xac4]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xad8], esi
jne 0x10028589
mov edx, dword [ebp - 0xb1c]
mov esi, dword [ebp - 0xb20]
mov ecx, dword [ebp - 0xaf8]
mov eax, dword [ebp - 0xaf0]
mov ebx, dword [ebp - 0xad4]
mov edi, dword [ebp - 0xb08]
add ecx, ebx
add eax, edi
sub edx, 1
mov dword [ebp - 0xaf8], ecx
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0xb1c], edx
jne 0x10028565
mov edi, dword [ebp - 0xb44]
xor ebx, ebx
push dword [ebp - 0xb18]
mov esi, dword [0x1009e5ec]
mov ecx, esi
call dword [0x100a0bc0]
call esi
mov eax, dword [ebp - 0xb0c]
test eax, eax
je 0x100286ec
mov esi, dword [0x1009e60c]
mov ecx, esi
push eax
push dword [ebp - 0xae8]
call dword [0x100a0bc0]
call esi
push dword [ebp - 0xae8]
mov esi, dword [0x1009e5e8]
mov ecx, esi
call dword [0x100a0bc0]
call esi
test edi, edi
js 0x10029bc2
mov eax, dword [ebp - 0x7b8]
mov esi, dword [ebp - 0x7b0]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0x7a4]
push 0x54
mov dword [ebp - 0xad4], eax
lea eax, [ebp - 0x864]
push ebx
push eax
mov dword [ebp - 0xb08], esi
call sub.msvcrt.dll_memset
push 0x54
lea eax, [ebp - 0xa08]
push ebx
push eax
call sub.msvcrt.dll_memset
push 0x2c
lea eax, [ebp - 0x558]
mov dword [ebp - 0xaf0], ebx
push ebx
push eax
mov dword [ebp - 0xad8], ebx
mov dword [ebp - 0xadc], ebx
mov dword [ebp - 0xacc], ebx
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x394]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x10029bc2
mov edi, dword [ebp - 0xae4]
mov esi, dword [0x1009e5f8]
mov ecx, esi
push 7
push edi
call dword [0x100a0bc0]
call esi
test eax, eax
je 0x10028215
mov esi, dword [0x1009e604]
lea ecx, [ebp - 0x864]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100a0bc0]
call esi
test eax, eax
je 0x100287ed
mov eax, dword [ebp - 0x850]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0x85c]
mov dword [ebp - 0xacc], eax
mov esi, dword [0x1009e5d8]
mov ecx, esi
push edi
call dword [0x100a0bc0]
call esi
mov esi, eax
mov dword [ebp - 0xae8], esi
test esi, esi
je 0x10028215
push 0x2c
lea eax, [ebp - 0x558]
mov dword [ebp - 0xc44], ebx
push ebx
mov edi, ebx
push eax
mov dword [ebp - 0xb44], edi
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x780]
add esp, 0xc
sub eax, dword [ebp - 0x788]
mov dword [ebp - 0x554], eax
mov eax, dword [ebp - 0x784]
sub eax, dword [ebp - 0x77c]
mov dword [ebp - 0x550], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x558], 0x28
mov word [ebp - 0x54c], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x54a], ax
lea eax, [ebp - 0xc44]
push eax
push ebx
lea eax, [ebp - 0x558]
push eax
push esi
mov esi, dword [0x1009e5dc]
mov ecx, esi
call dword [0x100a0bc0]
call esi
mov dword [ebp - 0xb18], eax
test eax, eax
jne 0x100288c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x100288b3
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x10028c7c
mov edi, 0x80004005
jmp 0x10028c7c
mov esi, dword [0x1009e604]
lea ecx, [ebp - 0xa08]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100a0bc0]
call esi
test eax, eax
je 0x100288ed
mov eax, dword [ebp - 0x9f4]
mov dword [ebp - 0xad8], eax
mov eax, dword [ebp - 0x780]
sub eax, dword [ebp - 0x788]
push dword [ebp - 0xb18]
mov esi, dword [0x1009e60c]
mov ecx, esi
push dword [ebp - 0xae8]
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x77c]
sub eax, dword [ebp - 0x784]
mov dword [ebp - 0x388], eax
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e610]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xae8]
call dword [0x100a0bc0]
call esi
push dword [ebp - 0xad4]
mov esi, dword [0x1009e60c]
mov ecx, esi
push dword [ebp - 0xae8]
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e608]
mov ecx, esi
push ebx
mov dword [ebp - 0xb38], eax
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e644]
mov ecx, esi
push eax
lea eax, [ebp - 0x394]
push eax
push dword [ebp - 0xae8]
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e63c]
lea eax, [ebp - 0x394]
push ebx
push dword [ebp - 0xb14]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb08]
push dword [ebp - 0xae8]
call dword [0x100a0bc0]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xaf4], eax
jne 0x100289f8
cmp dword [ebp - 0xac4], 0
je 0x100289ec
mov esi, dword [0x1009e65c]
mov ecx, esi
push 8
call dword [0x100a0bc0]
call esi
jmp 0x100289fd
mov dword [ebp - 0xb20], 0xffffff
jmp 0x10028a09
mov eax, 0xffa8a8a8
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xac8], eax
mov esi, dword [ebp - 0x788]
mov edx, ebx
mov eax, dword [ebp - 0x784]
mov ecx, ebx
mov dword [ebp - 0xb00], esi
mov dword [ebp - 0xac4], ebx
test esi, esi
jns 0x10028a39
mov edx, esi
mov dword [ebp - 0xb00], ebx
neg edx
mov dword [ebp - 0xac4], edx
test eax, eax
jns 0x10028a43
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [ebp - 0x38c]
sub esi, edx
mov edx, dword [ebp - 0xadc]
sub edx, dword [ebp - 0xb00]
mov dword [ebp - 0xb1c], esi
cmp esi, edx
jl 0x10028a69
mov esi, edx
mov dword [ebp - 0xb1c], edx
mov edx, dword [ebp - 0x388]
sub dword [ebp - 0xacc], eax
sub edx, ecx
mov dword [ebp - 0xb0c], edx
cmp edx, dword [ebp - 0xacc]
jl 0x10028a91
mov edx, dword [ebp - 0xacc]
mov dword [ebp - 0xb0c], edx
test esi, esi
jle 0x10028c45
test edx, edx
jle 0x10028c45
mov ebx, dword [ebp - 0x38c]
mov edi, dword [ebp - 0xad8]
mov esi, dword [ebp - 0xaf0]
imul ecx, ebx
shl ebx, 2
mov dword [ebp - 0xad4], ebx
add ecx, dword [ebp - 0xac4]
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0xadc]
imul eax, edi
mov dword [ebp - 0xaf8], ecx
add eax, dword [ebp - 0xb00]
shl edi, 2
mov dword [ebp - 0xb08], edi
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xb1c]
mov dword [ebp - 0xaf0], eax
test esi, esi
jle 0x10028c1e
mov ebx, eax
mov dword [ebp - 0xad8], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0xacc], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xac4], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x10028bdf
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xac8]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac4]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xacc]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xac8]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xb1e]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xad8]
cdq
idiv ecx
mov edx, dword [ebp - 0xacc]
add al, bl
mov ebx, dword [ebp - 0xac4]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xad8], esi
jne 0x10028b19
mov edx, dword [ebp - 0xb0c]
mov esi, dword [ebp - 0xb1c]
mov ecx, dword [ebp - 0xaf8]
mov eax, dword [ebp - 0xaf0]
mov ebx, dword [ebp - 0xad4]
mov edi, dword [ebp - 0xb08]
add ecx, ebx
add eax, edi
sub edx, 1
mov dword [ebp - 0xaf8], ecx
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0xb0c], edx
jne 0x10028af5
mov edi, dword [ebp - 0xb44]
xor ebx, ebx
push dword [ebp - 0xb18]
mov esi, dword [0x1009e5ec]
mov ecx, esi
call dword [0x100a0bc0]
call esi
mov eax, dword [ebp - 0xb38]
test eax, eax
je 0x10028c7c
mov esi, dword [0x1009e60c]
mov ecx, esi
push eax
push dword [ebp - 0xae8]
call dword [0x100a0bc0]
call esi
push dword [ebp - 0xae8]
mov esi, dword [0x1009e5e8]
mov ecx, esi
call dword [0x100a0bc0]
call esi
test edi, edi
js 0x10029bc2
mov edi, ebx
jmp 0x10029b6e
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x7b8], 0
jne 0x10028cb5
cmp edi, ecx
je 0x10028cb5
mov al, 0xc0
jmp 0x10028cb7
or al, 0xff
mov byte [ebp - 0xb0a], al
lea edi, [ebp - 0x374]
xor eax, eax
mov esi, dword [0x1009e5d8]
stosd dword es:[edi], eax
push dword [ebp - 0xae4]
mov byte [ebp - 0xb09], cl
mov ecx, esi
mov byte [ebp - 0xb0c], bl
stosd dword es:[edi], eax
mov byte [ebp - 0xb0b], bl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x364]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [0x100a0bc0]
call esi
mov dword [ebp - 0xac0], eax
test eax, eax
jne 0x10028d12
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10029bc2
xor eax, eax
inc eax
cmp dword [ebp - 0xaf4], eax
jne 0x10028e3d
mov edi, dword [ebp - 0x790]
mov eax, edi
mov edx, dword [ebp - 0x780]
mov ecx, edx
sub ecx, dword [ebp - 0x788]
sub eax, dword [ebp - 0x798]
mov dword [ebp - 0xad0], ecx
cmp ecx, eax
jg 0x10028d4f
mov ecx, eax
mov dword [ebp - 0xad0], eax
mov esi, dword [ebp - 0x77c]
mov eax, esi
sub eax, dword [ebp - 0x794]
cmp dword [ebp - 0x7bc], 0
mov dword [ebp - 0xb10], eax
mov dword [ebp - 0xac4], ebx
je 0x10028dae
mov eax, dword [ebp - 0x798]
sub eax, edi
add eax, ecx
mov ecx, eax
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0x788]
sub eax, edx
mov dword [ebp - 0xb38], ecx
add eax, dword [ebp - 0xad0]
mov dword [ebp - 0x374], ecx
mov ecx, eax
mov dword [ebp - 0xabc], ecx
mov dword [ebp - 0x364], ecx
jmp 0x10028dc8
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0xb38], eax
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0xabc], eax
mov eax, ebx
sub edi, dword [ebp - 0x798]
add edi, dword [ebp - 0xac4]
sub edx, dword [ebp - 0x788]
sub esi, dword [ebp - 0x784]
add edx, eax
mov eax, dword [ebp - 0x784]
sub eax, dword [ebp - 0x794]
mov dword [ebp - 0xac4], edi
mov dword [ebp - 0x36c], edi
mov edi, dword [ebp - 0x78c]
sub edi, dword [ebp - 0x794]
add esi, eax
mov dword [ebp - 0xadc], edi
mov dword [ebp - 0x368], edi
mov dword [ebp - 0xab8], edx
mov dword [ebp - 0x35c], edx
mov dword [ebp - 0xb08], eax
mov dword [ebp - 0x360], eax
mov dword [ebp - 0xb20], esi
mov dword [ebp - 0x358], esi
jmp 0x10028ec9
mov eax, dword [ebp - 0x34c]
lea esi, [ebp - 0x798]
lea edi, [ebp - 0x374]
mov dword [ebp - 0xad0], eax
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x348]
mov dword [ebp - 0xb10], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x368]
lea esi, [ebp - 0x788]
lea edi, [ebp - 0x364]
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0x36c]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0xb38], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0xb20], eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp - 0x364]
mov dword [ebp - 0xabc], eax
push 0x2c
lea eax, [ebp - 0x500]
mov dword [ebp - 0xc2c], ebx
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xad0]
add esp, 0xc
mov edi, dword [ebp - 0xac0]
mov esi, dword [0x1009e5dc]
mov ecx, esi
mov dword [ebp - 0x4fc], eax
mov eax, dword [ebp - 0xb10]
neg eax
mov dword [ebp - 0x500], 0x28
mov dword [ebp - 0x4f8], eax
xor eax, eax
push 0x20
inc eax
mov word [ebp - 0x4f4], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x4f2], ax
lea eax, [ebp - 0xc2c]
push eax
push ebx
lea eax, [ebp - 0x500]
push eax
push edi
call dword [0x100a0bc0]
call esi
mov dword [ebp - 0xaec], eax
test eax, eax
jne 0x10028f56
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10029bad
mov esi, dword [0x1009e60c]
mov ecx, esi
push eax
push edi
call dword [0x100a0bc0]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xaf4], eax
jne 0x10028fcc
mov ecx, dword [ebp - 0xae0]
test ecx, ecx
je 0x10028fcc
xor eax, eax
mov esi, dword [0x1009e644]
lea edi, [ebp - 0x3dc]
stosd dword es:[edi], eax
push ecx
mov ecx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xad0]
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0xb10]
mov dword [ebp - 0x3d0], eax
lea eax, [ebp - 0x3dc]
push eax
mov eax, dword [ebp - 0xac0]
push eax
mov dword [ebp - 0x3dc], ebx
mov dword [ebp - 0x3d8], ebx
call dword [0x100a0bc0]
call esi
mov eax, dword [ebp - 0x7b8]
mov esi, dword [ebp - 0x7b4]
mov dword [ebp - 0xb18], eax
mov eax, dword [ebp - 0x7a8]
push 0x54
mov dword [ebp - 0xad4], eax
lea eax, [ebp - 0x90c]
push ebx
push eax
mov dword [ebp - 0xaf8], esi
call sub.msvcrt.dll_memset
push 0x54
lea eax, [ebp - 0x9b4]
push ebx
push eax
call sub.msvcrt.dll_memset
push 0x2c
lea eax, [ebp - 0x52c]
mov dword [ebp - 0xaf0], ebx
push ebx
push eax
mov dword [ebp - 0xad8], ebx
mov dword [ebp - 0xb3c], ebx
mov dword [ebp - 0xacc], ebx
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x3a4]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xac0]
test esi, esi
je 0x10029b92
mov esi, dword [0x1009e5f8]
mov ecx, esi
push 7
push edi
call dword [0x100a0bc0]
call esi
test eax, eax
jne 0x10029074
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10029b92
mov esi, dword [0x1009e604]
lea ecx, [ebp - 0x90c]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100a0bc0]
call esi
test eax, eax
je 0x100290b6
mov eax, dword [ebp - 0x8f8]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0x908]
mov dword [ebp - 0xb3c], eax
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0xacc], eax
mov esi, dword [0x1009e5d8]
mov ecx, esi
push edi
call dword [0x100a0bc0]
call esi
mov esi, eax
mov dword [ebp - 0xae8], esi
test esi, esi
je 0x10029069
push 0x2c
lea eax, [ebp - 0x52c]
mov dword [ebp - 0xc8c], ebx
push ebx
push eax
mov dword [ebp - 0xb34], ebx
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x370]
add esp, 0xc
sub eax, dword [ebp - 0xadc]
mov edi, dword [ebp - 0xac4]
sub edi, dword [ebp - 0xb38]
mov dword [ebp - 0x524], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x52c], 0x28
mov word [ebp - 0x520], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x51e], ax
lea eax, [ebp - 0xc8c]
push eax
push ebx
lea eax, [ebp - 0x52c]
mov dword [ebp - 0x528], edi
push eax
push esi
mov esi, dword [0x1009e5dc]
mov ecx, esi
call dword [0x100a0bc0]
call esi
mov dword [ebp - 0xb1c], eax
test eax, eax
jne 0x10029194
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb34], eax
test eax, eax
jle 0x1002917f
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb34], eax
test eax, eax
js 0x10029534
mov dword [ebp - 0xb34], 0x80004005
jmp 0x10029534
mov esi, dword [0x1009e604]
lea ecx, [ebp - 0x9b4]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100a0bc0]
call esi
test eax, eax
je 0x100291be
mov eax, dword [ebp - 0x9a0]
mov dword [ebp - 0xad8], eax
push dword [ebp - 0xb1c]
mov eax, dword [ebp - 0xadc]
push dword [ebp - 0xae8]
mov esi, dword [0x1009e60c]
mov ecx, esi
mov dword [ebp - 0x39c], edi
mov edi, dword [ebp - 0x370]
sub eax, edi
mov dword [ebp - 0x398], eax
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e610]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xae8]
call dword [0x100a0bc0]
call esi
push dword [ebp - 0xad4]
mov esi, dword [0x1009e60c]
mov ecx, esi
push dword [ebp - 0xae8]
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e608]
mov ecx, esi
push ebx
mov dword [ebp - 0xad4], eax
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e644]
mov ecx, esi
push eax
lea eax, [ebp - 0x3a4]
push eax
push dword [ebp - 0xae8]
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e63c]
lea eax, [ebp - 0x3a4]
push ebx
push dword [ebp - 0xb14]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xaf8]
push dword [ebp - 0xae8]
call dword [0x100a0bc0]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xaf4], eax
jne 0x100292c5
cmp dword [ebp - 0xb18], 0
je 0x100292b9
mov esi, dword [0x1009e65c]
mov ecx, esi
push 8
call dword [0x100a0bc0]
call esi
mov dword [ebp - 0xb30], eax
jmp 0x100292cf
mov dword [ebp - 0xb30], 0xffffff
jmp 0x100292cf
mov dword [ebp - 0xb30], 0xffa8a8a8
mov ecx, dword [ebp - 0xb38]
mov edx, ebx
mov dword [ebp - 0xac4], ebx
mov eax, ebx
test ecx, ecx
jns 0x100292ef
mov edx, ecx
mov ecx, ebx
neg edx
mov dword [ebp - 0xac4], edx
test edi, edi
jns 0x100292f9
mov eax, edi
mov edi, ebx
neg eax
mov esi, dword [ebp - 0x39c]
sub esi, edx
mov edx, dword [ebp - 0xb3c]
sub edx, ecx
mov dword [ebp - 0xadc], esi
cmp esi, edx
jl 0x1002931b
mov esi, edx
mov dword [ebp - 0xadc], edx
mov edx, dword [ebp - 0x398]
sub dword [ebp - 0xacc], edi
sub edx, eax
mov dword [ebp - 0xb00], edx
cmp edx, dword [ebp - 0xacc]
jl 0x10029343
mov edx, dword [ebp - 0xacc]
mov dword [ebp - 0xb00], edx
test esi, esi
jle 0x100294fd
test edx, edx
jle 0x100294fd
imul edi, dword [ebp - 0xb3c]
mov ebx, dword [ebp - 0x39c]
mov esi, dword [ebp - 0xad8]
imul eax, ebx
shl ebx, 2
add edi, ecx
mov ecx, dword [ebp - 0xaf0]
mov dword [ebp - 0xaf0], ebx
mov ebx, dword [ebp - 0xb3c]
add eax, dword [ebp - 0xac4]
shl ebx, 2
lea ecx, [ecx + edi*4]
mov dword [ebp - 0xaf8], ebx
mov ebx, dword [ebp - 0xaf0]
mov edi, dword [ebp - 0xaf8]
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xadc]
mov dword [ebp - 0xb18], eax
mov dword [ebp - 0xb44], ecx
test esi, esi
jle 0x100294dc
mov ebx, ecx
mov dword [ebp - 0xad8], esi
lea edx, [ecx + 3]
sub ebx, eax
mov dword [ebp - 0xacc], edx
lea edi, [eax + 2]
mov dword [ebp - 0xac4], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x1002949d
mov bl, byte [edi + ebx]
mov eax, dword [ebp - 0xb30]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac4]
add al, bl
mov byte [edi + ecx], al
mov eax, dword [ebp - 0xacc]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xb30]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xb2e]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xad8]
cdq
idiv ecx
mov edx, dword [ebp - 0xacc]
add al, bl
mov ebx, dword [ebp - 0xac4]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xad8], esi
jne 0x100293d7
mov edx, dword [ebp - 0xb00]
mov esi, dword [ebp - 0xadc]
mov eax, dword [ebp - 0xb18]
mov ecx, dword [ebp - 0xb44]
mov ebx, dword [ebp - 0xaf0]
mov edi, dword [ebp - 0xaf8]
add eax, ebx
add ecx, edi
sub edx, 1
mov dword [ebp - 0xb18], eax
mov dword [ebp - 0xb44], ecx
mov dword [ebp - 0xb00], edx
jne 0x100293b3
xor ebx, ebx
push dword [ebp - 0xb1c]
mov esi, dword [0x1009e5ec]
mov ecx, esi
call dword [0x100a0bc0]
call esi
mov eax, dword [ebp - 0xad4]
test eax, eax
je 0x10029534
mov esi, dword [0x1009e60c]
mov ecx, esi
push eax
push dword [ebp - 0xae8]
call dword [0x100a0bc0]
call esi
push dword [ebp - 0xae8]
mov esi, dword [0x1009e5e8]
mov ecx, esi
call dword [0x100a0bc0]
call esi
cmp dword [ebp - 0xb34], 0
jl 0x10029b8c
mov eax, dword [ebp - 0x7b8]
mov esi, dword [ebp - 0x7b0]
mov dword [ebp - 0xaf8], eax
mov eax, dword [ebp - 0x7a4]
push 0x54
mov dword [ebp - 0xad4], eax
lea eax, [ebp - 0x960]
push ebx
push eax
mov dword [ebp - 0xaf0], esi
call sub.msvcrt.dll_memset
push 0x54
lea eax, [ebp - 0xab0]
push ebx
push eax
call sub.msvcrt.dll_memset
push 0x2c
lea eax, [ebp - 0x4d4]
mov dword [ebp - 0xad8], ebx
push ebx
push eax
mov dword [ebp - 0xac4], ebx
mov dword [ebp - 0xb38], ebx
mov dword [ebp - 0xacc], ebx
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x3b4]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xac0]
test esi, esi
je 0x10029b92
mov esi, dword [0x1009e5f8]
mov ecx, esi
push 7
push edi
call dword [0x100a0bc0]
call esi
test eax, eax
je 0x10029069
mov esi, dword [0x1009e604]
lea ecx, [ebp - 0x960]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100a0bc0]
call esi
test eax, eax
je 0x1002963a
mov eax, dword [ebp - 0x94c]
mov dword [ebp - 0xad8], eax
mov eax, dword [ebp - 0x95c]
mov dword [ebp - 0xb38], eax
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0xacc], eax
mov esi, dword [0x1009e5d8]
mov ecx, esi
push edi
call dword [0x100a0bc0]
call esi
mov esi, eax
mov dword [ebp - 0xae8], esi
test esi, esi
je 0x10029069
push 0x2c
lea eax, [ebp - 0x4d4]
mov dword [ebp - 0xc28], ebx
push ebx
push eax
mov dword [ebp - 0xb3c], ebx
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xab8]
add esp, 0xc
sub eax, dword [ebp - 0xabc]
mov edi, dword [ebp - 0xb08]
mov dword [ebp - 0xab8], eax
mov dword [ebp - 0x4d0], eax
mov eax, edi
sub eax, dword [ebp - 0xb20]
mov dword [ebp - 0x4cc], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x4d4], 0x28
mov word [ebp - 0x4c8], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x4c6], ax
lea eax, [ebp - 0xc28]
push eax
push ebx
lea eax, [ebp - 0x4d4]
push eax
push esi
mov esi, dword [0x1009e5dc]
mov ecx, esi
call dword [0x100a0bc0]
call esi
mov dword [ebp - 0xb1c], eax
test eax, eax
jne 0x10029724
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xb3c], eax
test eax, eax
jle 0x1002970f
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb3c], eax
test eax, eax
js 0x10029ac7
mov dword [ebp - 0xb3c], 0x80004005
jmp 0x10029ac7
mov esi, dword [0x1009e604]
lea ecx, [ebp - 0xab0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x100a0bc0]
call esi
test eax, eax
je 0x1002974e
mov eax, dword [ebp - 0xa9c]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0xab8]
push dword [ebp - 0xb1c]
mov esi, dword [0x1009e60c]
mov ecx, esi
push dword [ebp - 0xae8]
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0xb20]
sub eax, edi
mov dword [ebp - 0x3a8], eax
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e610]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xae8]
call dword [0x100a0bc0]
call esi
push dword [ebp - 0xad4]
mov esi, dword [0x1009e60c]
mov ecx, esi
push dword [ebp - 0xae8]
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e608]
mov ecx, esi
push ebx
mov dword [ebp - 0xad4], eax
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e644]
mov ecx, esi
push eax
lea eax, [ebp - 0x3b4]
push eax
push dword [ebp - 0xae8]
call dword [0x100a0bc0]
call esi
mov esi, dword [0x1009e63c]
lea eax, [ebp - 0x3b4]
push ebx
push dword [ebp - 0xb14]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xaf0]
push dword [ebp - 0xae8]
call dword [0x100a0bc0]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xaf4], eax
jne 0x1002985d
cmp dword [ebp - 0xaf8], 0
je 0x10029851
mov esi, dword [0x1009e65c]
mov ecx, esi
push 8
call dword [0x100a0bc0]
call esi
mov edx, eax
mov dword [ebp - 0xac8], edx
mov dword [ebp - 0xadc], edx
jmp 0x1002986e
mov dword [ebp - 0xadc], 0xffffff
jmp 0x1002986e
mov eax, 0xffa8a8a8
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xadc], eax
mov ecx, dword [ebp - 0xabc]
mov esi, ebx
mov eax, ebx
test ecx, ecx
jns 0x10029886
mov esi, ecx
mov dword [ebp - 0xabc], ebx
neg esi
test edi, edi
jns 0x10029890
mov eax, edi
mov edi, ebx
neg eax
mov edx, dword [ebp - 0x3ac]
mov ecx, dword [ebp - 0xb38]
sub edx, esi
sub ecx, dword [ebp - 0xabc]
mov dword [ebp - 0xaf0], edx
cmp edx, ecx
jl 0x100298b6
mov edx, ecx
mov dword [ebp - 0xaf0], ecx
mov ecx, dword [ebp - 0x3a8]
sub dword [ebp - 0xacc], edi
sub ecx, eax
mov dword [ebp - 0xb00], ecx
cmp ecx, dword [ebp - 0xacc]
jl 0x100298de
mov ecx, dword [ebp - 0xacc]
mov dword [ebp - 0xb00], ecx
test edx, edx
jle 0x10029a90
test ecx, ecx
jle 0x10029a90
mov ebx, dword [ebp - 0x3ac]
imul edi, dword [ebp - 0xb38]
imul eax, ebx
shl ebx, 2
add edi, dword [ebp - 0xabc]
add eax, esi
mov esi, dword [ebp - 0xac4]
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xad8]
mov dword [ebp - 0xad8], ebx
mov ebx, dword [ebp - 0xb38]
shl ebx, 2
lea esi, [esi + edi*4]
mov dword [ebp - 0xaf8], ebx
mov ebx, dword [ebp - 0xad8]
mov edi, dword [ebp - 0xaf8]
mov dword [ebp - 0xb18], eax
mov dword [ebp - 0xb44], esi
test edx, edx
jle 0x10029a6f
lea ebx, [esi + 3]
mov dword [ebp - 0xac4], edx
sub esi, eax
mov dword [ebp - 0xacc], ebx
lea edi, [eax + 2]
mov dword [ebp - 0xb08], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x10029a30
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xac8]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb08]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xacc]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xac8]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xada]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xb08]
cdq
idiv ecx
mov edx, dword [ebp - 0xac4]
add al, bl
mov ebx, dword [ebp - 0xacc]
mov byte [ebx], al
add ebx, 4
add edi, 4
sub edx, 1
mov dword [ebp - 0xacc], ebx
mov dword [ebp - 0xac4], edx
jne 0x1002996a
mov ecx, dword [ebp - 0xb00]
mov edx, dword [ebp - 0xaf0]
mov eax, dword [ebp - 0xb18]
mov esi, dword [ebp - 0xb44]
mov ebx, dword [ebp - 0xad8]
mov edi, dword [ebp - 0xaf8]
add eax, ebx
add esi, edi
sub ecx, 1
mov dword [ebp - 0xb18], eax
mov dword [ebp - 0xb44], esi
mov dword [ebp - 0xb00], ecx
jne 0x10029948
xor ebx, ebx
push dword [ebp - 0xb1c]
mov esi, dword [0x1009e5ec]
mov ecx, esi
call dword [0x100a0bc0]
call esi
mov eax, dword [ebp - 0xad4]
test eax, eax
je 0x10029ac7
mov esi, dword [0x1009e60c]
mov ecx, esi
push eax
push dword [ebp - 0xae8]
call dword [0x100a0bc0]
call esi
push dword [ebp - 0xae8]
mov esi, dword [0x1009e5e8]
mov ecx, esi
call dword [0x100a0bc0]
call esi
cmp dword [ebp - 0xb3c], 0
mov edi, dword [ebp - 0xac0]
jl 0x10029b92
xor eax, eax
inc eax
cmp dword [ebp - 0xaf4], eax
jne 0x10029b33
mov esi, dword [0x1009e5d0]
mov ecx, esi
push 0xcc0020
push ebx
push ebx
push edi
push dword [ebp - 0xb10]
push dword [ebp - 0xad0]
push dword [ebp - 0x794]
push dword [ebp - 0x798]
push dword [ebp - 0xae4]
call dword [0x100a0bc0]
call esi
jmp 0x10029b6e
push dword [ebp - 0xb0c]
mov ecx, dword [ebp - 0xb10]
mov eax, dword [ebp - 0xad0]
mov esi, dword [0x1009e5f0]
push ecx
push eax
push ebx
push ebx
push edi
push ecx
push eax
push dword [ebp - 0x350]
mov ecx, esi
push dword [ebp - 0x354]
push dword [ebp - 0xae4]
call dword [0x100a0bc0]
call esi
push dword [ebp - 0xb04]
mov esi, dword [0x1009e610]
mov ecx, esi
push dword [ebp - 0xae4]
call dword [0x100a0bc0]
call esi
jmp 0x10029b92
mov edi, dword [ebp - 0xac0]
mov eax, dword [ebp - 0xaec]
test eax, eax
je 0x10029bad
mov esi, dword [0x1009e5ec]
mov ecx, esi
push eax
call dword [0x100a0bc0]
call esi
test edi, edi
je 0x10029bc2
mov esi, dword [0x1009e5e8]
mov ecx, esi
push edi
call dword [0x100a0bc0]
call esi
mov eax, dword [ebp - 0xae0]
test eax, eax
je 0x10029bdd
mov esi, dword [0x1009e5ec]
mov ecx, esi
push eax
call dword [0x100a0bc0]
call esi
mov edi, 0x1009f6e4
mov ecx, dword [ebp - 0x7b4]
test ecx, ecx
je 0x10029c31
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10029bef
mov eax, dword [ebp - 0x7b4]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x10029c17
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x10029c0f
push dword [ebp - 0x7b4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x7b4], ebx
mov ecx, dword [ebp - 0x7b0]
test ecx, ecx
je 0x10029c80
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10029c3e
mov eax, dword [ebp - 0x7b0]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x10029c66
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x10029c5e
push dword [ebp - 0x7b0]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x7b0], ebx
mov edx, dword [ebp - 0x7ac]
test edx, edx
je 0x10029ccc
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10029c8f
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x10029cb7
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0x10029ca9
mov edx, dword [ebp - 0x7ac]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x7ac], ebx
cmp dword [ebp - 0x7a8], 0
je 0x10029cf1
push dword [ebp - 0x7a8]
mov esi, dword [0x1009e5ec]
mov ecx, esi
call dword [0x100a0bc0]
call esi
mov dword [ebp - 0x7a8], ebx
cmp dword [ebp - 0x7a4], 0
je 0x10029d16
push dword [ebp - 0x7a4]
mov esi, dword [0x1009e5ec]
mov ecx, esi
call dword [0x100a0bc0]
call esi
mov dword [ebp - 0x7a4], ebx
cmp dword [ebp - 0x7a0], 0
je 0x10029d3b
push dword [ebp - 0x7a0]
mov esi, dword [0x1009e5ec]
mov ecx, esi
call dword [0x100a0bc0]
call esi
mov dword [ebp - 0x7a0], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x10029d3d
mov eax, dword [0x1009f6e0]
push 0
pop ebx
test eax, eax
jle 0x10029d9f
sub eax, 1
mov dword [0x1009f6e0], eax
jne 0x10029d9f
mov esi, ebx
mov eax, dword [esi + 0x1009efb0]
test eax, eax
je 0x10029d73
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x10029d62
push 0x40
push ebx
push 0x1009efb0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x100036a0
mov edi, 0x1009e5d0
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x1009f6e4
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0x1009efa8]
mov esi, dword [0x1009e61c]
mov ecx, esi
mov dword [ebp - 0xb18], eax
call dword [0x100a0bc0]
call esi
sub eax, dword [0x1009f6d8]
lea edi, [ebp - 0x2e0]
push 8
mov dword [ebp - 0xaf8], eax
mov edx, 0x1009f6e4
xor eax, eax
xor ebx, ebx
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10029dde
mov eax, dword [0x1009f6e0]
push 0
pop ebx
test eax, eax
jne 0x1002a420
push 0x338
push ebx
mov dword [ebp - 0xadc], ebx
mov dword [ebp - 0xacc], ebx
mov dword [ebp - 0xad8], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xaf0], edi
test edi, edi
je 0x1002a3bf
or dword [ebp - 0xb08], 0xffffffff
mov eax, ebx
mov dword [ebp - 0xae0], eax
mov cl, bl
mov dword [ebp - 0xb88], eax
mov eax, 0x7f1137f
mov edx, eax
mov dword [ebp - 0x434], 0xab69605e
movzx esi, word [ebp - 0x432]
shr edx, 0x10
add edi, 7
movzx eax, ax
mov dword [ebp - 0xabc], esi
mov esi, ebx
mov dword [ebp - 0xaec], ebx
mov dword [ebp - 0xba0], ebx
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xb14], edx
mov dword [ebp - 0xac4], edi
mov edi, dword [ebp - 0xb48]
movzx edx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl edx, 8
or edx, eax
movzx eax, byte [edi]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl edx, 8
or edx, eax
shl edi, 8
mov eax, dword [ebp - 0xb48]
xor ebx, edx
mov dword [ebp - 0xad4], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb48]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb48]
shl edi, 8
add dword [ebp - 0xb48], 8
movzx eax, byte [eax + 5]
or edi, eax
mov eax, 0x7f1137f
xor esi, edi
xor esi, ebx
xor esi, eax
xor esi, 0xab69605e
mov eax, esi
rol eax, 0xa
lea edx, [esi + 0x54969fa2]
rol edx, 5
imul edx, dword [ebp - 0xac8]
add edx, eax
xor ebx, edx
mov edx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea edx, [ebx + edx]
ror edx, 9
imul edx, dword [ebp - 0xabc]
sub edx, eax
xor esi, edx
mov eax, esi
sub eax, dword [ebp - 0xac8]
imul edx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xabc]
xor edx, ebx
mov eax, ebx
rol edx, 6
imul edx, dword [ebp - 0xb14]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0xac8]
imul eax, dword [ebp - 0xabc]
ror edx, 6
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
add eax, esi
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 8
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
imul edx, dword [ebp - 0xb14]
sub edx, eax
xor esi, edx
mov edx, esi
mov eax, esi
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, dword [ebp - 0xac8]
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb14]
xor edx, ebx
mov eax, ebx
imul edx, dword [ebp - 0xabc]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xb14]
mov eax, esi
mov dword [ebp - 0xae0], esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, edx
xor ebx, eax
mov esi, ebx
sub esi, edx
xor esi, dword [ebp - 0xae0]
xor esi, 0xab69605e
xor edx, esi
mov eax, esi
rol edx, 2
imul edx, dword [ebp - 0xac8]
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, eax
mov eax, ebx
ror edx, 6
imul edx, dword [ebp - 0xabc]
rol eax, 7
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, dword [ebp - 0xac8]
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xabc]
xor edx, ebx
mov dword [ebp - 0xb04], ebx
rol edx, 5
mov eax, ebx
imul edx, dword [ebp - 0xb14]
rol eax, 7
add edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov ebx, esi
xor ebx, dword [ebp - 0xb04]
xor ebx, edx
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xabc]
imul eax, dword [ebp - 0xac8]
xor esi, eax
mov eax, esi
sub eax, edx
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [ebp - 0xb14]
add edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xac8]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, 0x605e
shr eax, 3
imul edx, dword [ebp - 0xabc]
xor edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov eax, esi
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xb08]
rol eax, 2
mov dword [ebp - 0xb88], esi
mov dword [ebp - 0xb08], edi
xor edx, eax
xor edx, dword [ebp - 0xaec]
xor ebx, edx
mov edx, dword [ebp - 0xac4]
mov dword [ebp - 0xba0], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb88]
ror dword [ebp - 0xba0], 8
mov byte [edx], al
mov al, byte [ebp - 0xba0]
ror dword [ebp - 0xb88], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb88]
ror dword [ebp - 0xba0], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xba0]
ror dword [ebp - 0xb88], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb88]
ror dword [ebp - 0xba0], 8
mov byte [edx - 2], al
ror dword [ebp - 0xb88], 8
mov al, byte [ebp - 0xba0]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb88]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [ebp - 0xba0]
mov esi, dword [ebp - 0xb88]
mov eax, dword [ebp - 0xad4]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xb40], 1
mov dword [ebp - 0xba0], ebx
mov dword [ebp - 0xb88], esi
mov dword [ebp - 0xaec], eax
mov dword [ebp - 0xac4], edx
jne 0x10029e8e
mov esi, dword [ebp - 0xaf0]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x1002a209
movzx eax, cl
cdq
cmp eax, dword [0x1000e410]
jne 0x1002a234
cmp edx, dword [0x1000e414]
jne 0x1002a234
mov edi, esi
mov esi, ebx
mov dword [ebp - 0xacc], edi
jmp 0x1002a247
or dword [ebp - 0xafc], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xad8], 0xc004d501
test esi, esi
je 0x1002a25a
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xad8], ebx
jl 0x1002a3bf
mov eax, dword [ebp - 0xafc]
mov esi, edi
push 0x40
push ebx
push 0x1009efb0
mov byte [eax + edi], bl
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], bl
je 0x1002a3c6
mov edi, 0x1009efb0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xb04], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1002a29b
sub ecx, dword [ebp - 0xb04]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x1002a3bf
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xac8], ecx
cmp word [eax], dx
je 0x1002a2e3
mov ecx, 0xc000007b
mov dword [ebp - 0xac8], ecx
jmp 0x1002a32b
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x1002a2d6
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x1002a2d6
cmp dword [edx], 0x4550
jne 0x1002a2d6
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xba8]
je 0x1002a319
cmp ax, word [ebp - 0xb4c]
je 0x1002a319
mov ecx, 0xc000000d
jmp 0x1002a2db
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xb40], eax
mov dword [ebp - 0xafc], ebx
test eax, eax
je 0x1002a3a6
mov edx, esi
mov dword [ebp - 0xad4], esi
lea eax, [edx + 1]
mov dword [ebp - 0xb04], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x1002a352
sub edx, dword [ebp - 0xb04]
inc esi
add esi, edx
test ecx, ecx
js 0x1002a38b
push dword [ebp - 0xad4]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002a3b1
mov ecx, dword [ebp - 0xadc]
mov dword [ecx*4 + 0x1009e5d0], eax
mov ecx, dword [ebp - 0xac8]
mov eax, dword [ebp - 0xafc]
inc dword [ebp - 0xadc]
inc eax
mov dword [ebp - 0xafc], eax
cmp eax, dword [ebp - 0xb40]
jb 0x1002a341
add edi, 0x10
cmp byte [esi], bl
jne 0x1002a28e
mov esi, dword [ebp - 0xac8]
mov edi, dword [ebp - 0xacc]
jmp 0x1002a3c8
mov esi, 0xc000007a
jmp 0x1002a3b7
mov esi, ebx
test edi, edi
je 0x1002a3db
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jns 0x1002a41b
mov esi, ebx
mov eax, dword [esi + 0x1009efb0]
test eax, eax
je 0x1002a3f2
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x1002a3e1
push 0x40
push ebx
push 0x1009efb0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x100036a0
mov edi, 0x1009e5d0
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x1002a426
mov eax, dword [0x1009f6e0]
inc eax
mov dword [0x1009f6e0], eax
xor eax, eax
mov edi, 0x1009f6e4
xchg dword [edi], eax
mov eax, dword [ebp - 0xaf8]
xor ecx, ecx
mov esi, dword [0x1009e638]
inc ecx
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0xb18]
mov dword [ebp - 0x2c4], eax
lea eax, [ebp - 0x2e0]
push eax
push 4
push 0x2021
mov dword [ebp - 0x2e0], ecx
mov dword [ebp - 0x2d8], ecx
mov dword [ebp - 0x2cc], ecx
mov dword [ebp - 0x2d0], ecx
mov dword [ebp - 0x2c8], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x2d4], 0x9966f291
call dword [0x100a0bc0]
call esi
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x1002a493
mov eax, dword [0x1009f6e0]
push 0
pop ebx
test eax, eax
jle 0x1002a4f5
sub eax, 1
mov dword [0x1009f6e0], eax
jne 0x1002a4f5
mov esi, ebx
mov eax, dword [esi + 0x1009efb0]
test eax, eax
je 0x1002a4c9
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x1002a4b8
push 0x40
push ebx
push 0x1009efb0
call fcn.1002f923
add esp, 0xc
mov esi, 0x100036a0
mov edi, 0x1009e5d0
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x1009f6e4
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xae4]
mov esi, dword [0x1009e680]
mov ecx, esi
push ebx
call dword [0x100a0bc0]
call esi
lea ecx, [ebp - 0xc30]
call fcn.100427f2
xor eax, eax
lea edi, [ebp - 0xb58]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xc0c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xafc], esi
test esi, esi
je 0x1002c5da
push edi
push 0x1009ea98
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [ebp - 0xaf4], esi
push 8
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb40], eax
test eax, eax
je 0x1002c5dc
mov ecx, dword [0x1009ea90]
mov edi, eax
mov dword [eax], ecx
mov ecx, dword [0x1009ea94]
mov dword [eax + 4], ecx
mov dword [ebp - 0xad0], edi
rdtsc
mov dword [ebp - 0xaec], eax
mov dword [ebp - 0xb08], edx
mov eax, 0xc4
push eax
push 8
mov dword [ebp - 0xb54], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x1002c5de
mov dword [ebp - 0xb50], edx
mov ecx, ebx
mov dword [ebp - 0xb58], ecx
lea eax, [edx + 4]
cmp eax, edx
jb 0x1002a5ef
mov edi, eax
jmp 0x1002a5f2
or edi, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x1002a627
mov ecx, dword [ebp - 0xb54]
lea eax, [edx + 8]
add ecx, edx
cmp eax, ecx
ja 0x1002c5cc
push 4
pop eax
mov dword [edx], eax
mov dword [edi], eax
mov ecx, dword [ebp - 0xb58]
inc ecx
mov dword [ebp - 0xb58], ecx
test esi, esi
js 0x1002c5cc
cmp dword [ebp - 0xb50], 0
jne 0x1002a673
mov edx, dword [ebp - 0xb54]
lea eax, [edx + 0xa4]
cmp eax, edx
jb 0x1002a64c
mov esi, eax
jmp 0x1002a64f
or esi, 0xffffffff
cmp eax, edx
mov dword [ebp - 0xb54], esi
sbb edi, edi
and edi, 0xc0000095
cmp eax, edx
jb 0x1002a741
inc ecx
mov dword [ebp - 0xb58], ecx
jmp 0x1002a749
mov edx, dword [ebp - 0xb50]
mov esi, ebx
test ecx, ecx
je 0x1002a6e1
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xad4], edx
cmp eax, 4
jb 0x1002a693
mov edi, eax
jmp 0x1002a696
or edi, 0xffffffff
cmp eax, 4
jb 0x1002a6a3
mov dword [ebp - 0xc34], edi
jmp 0x1002a6a9
mov edi, dword [ebp - 0xc34]
cmp eax, 4
jb 0x1002c5cc
lea eax, [edx + edi]
mov dword [ebp - 0xb04], edx
cmp eax, edx
jb 0x1002a6c3
mov edx, eax
jmp 0x1002a6c6
or edx, 0xffffffff
cmp eax, dword [ebp - 0xb04]
sbb edi, edi
and edi, 0xc0000095
cmp eax, dword [ebp - 0xad4]
jb 0x1002a73b
inc esi
cmp esi, ecx
jb 0x1002a67f
lea eax, [edx + 4]
cmp eax, edx
jb 0x1002a6ec
mov esi, eax
jmp 0x1002a6ef
or esi, 0xffffffff
cmp eax, edx
sbb edi, edi
and edi, 0xc0000095
cmp eax, edx
jb 0x1002a73b
mov ecx, dword [ebp - 0xb54]
lea eax, [edx + 0xa4]
add ecx, dword [ebp - 0xb50]
cmp eax, ecx
ja 0x1002c5cc
mov eax, 0xa0
push eax
push dword [ebp - 0xafc]
mov dword [edx], eax
push esi
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xb58]
add esp, 0xc
inc ecx
mov dword [ebp - 0xb58], ecx
mov esi, dword [ebp - 0xb54]
test edi, edi
js 0x1002c5cc
cmp dword [ebp - 0xb50], 0
jne 0x1002a784
mov eax, esi
lea esi, [eax + 0xc]
mov edx, esi
cmp esi, eax
jae 0x1002a760
or esi, 0xffffffff
cmp edx, eax
mov dword [ebp - 0xb54], esi
sbb edi, edi
and edi, 0xc0000095
cmp edx, eax
jb 0x1002a86a
inc ecx
mov dword [ebp - 0xb58], ecx
jmp 0x1002a87b
mov edx, dword [ebp - 0xb50]
mov dword [ebp - 0xafc], ebx
test ecx, ecx
je 0x1002a802
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xad4], edx
cmp eax, 4
jb 0x1002a7a8
mov edi, eax
jmp 0x1002a7ab
or edi, 0xffffffff
cmp eax, 4
jb 0x1002a7b8
mov dword [ebp - 0xc38], edi
jmp 0x1002a7be
mov edi, dword [ebp - 0xc38]
cmp eax, 4
jb 0x1002c5cc
lea eax, [edx + edi]
mov dword [ebp - 0xb04], edx
cmp eax, edx
jb 0x1002a7d8
mov edx, eax
jmp 0x1002a7db
or edx, 0xffffffff
cmp eax, dword [ebp - 0xb04]
sbb edi, edi
and edi, 0xc0000095
cmp eax, dword [ebp - 0xad4]
jb 0x1002a86a
mov edi, dword [ebp - 0xafc]
inc edi
mov dword [ebp - 0xafc], edi
cmp edi, ecx
jb 0x1002a794
lea eax, [edx + 4]
cmp eax, edx
jb 0x1002a811
mov dword [ebp - 0xafc], eax
jmp 0x1002a81a
or edi, 0xffffffff
mov dword [ebp - 0xafc], edi
cmp eax, edx
sbb edi, edi
and edi, 0xc0000095
cmp eax, edx
jb 0x1002a86a
mov ecx, dword [ebp - 0xb50]
lea eax, [edx + 0xc]
add ecx, esi
cmp eax, ecx
ja 0x1002c5cc
mov ecx, dword [ebp - 0xb40]
mov dword [edx], 8
mov edx, dword [ebp - 0xafc]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0xb58]
mov esi, dword [ebp - 0xb54]
inc ecx
mov dword [ebp - 0xb58], ecx
test edi, edi
js 0x1002c5cc
cmp dword [ebp - 0xb50], 0
jne 0x1002a8ad
mov eax, esi
lea esi, [eax + 0xc]
mov edx, esi
cmp esi, eax
jae 0x1002a889
or esi, 0xffffffff
cmp edx, eax
mov dword [ebp - 0xb54], esi
sbb edi, edi
and edi, 0xc0000095
cmp edx, eax
jb 0x1002a994
inc ecx
mov dword [ebp - 0xb58], ecx
jmp 0x1002a99c
mov edx, dword [ebp - 0xb50]
mov dword [ebp - 0xafc], ebx
test ecx, ecx
je 0x1002a92b
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xad4], edx
cmp eax, 4
jb 0x1002a8d1
mov edi, eax
jmp 0x1002a8d4
or edi, 0xffffffff
cmp eax, 4
jb 0x1002a8e1
mov dword [ebp - 0xc3c], edi
jmp 0x1002a8e7
mov edi, dword [ebp - 0xc3c]
cmp eax, 4
jb 0x1002c5cc
lea eax, [edx + edi]
mov dword [ebp - 0xb04], edx
cmp eax, edx
jb 0x1002a901
mov edx, eax
jmp 0x1002a904
or edx, 0xffffffff
cmp eax, dword [ebp - 0xb04]
sbb edi, edi
and edi, 0xc0000095
cmp eax, dword [ebp - 0xad4]
jb 0x1002a994
mov edi, dword [ebp - 0xafc]
inc edi
mov dword [ebp - 0xafc], edi
cmp edi, ecx
jb 0x1002a8bd
lea eax, [edx + 4]
cmp eax, edx
jb 0x1002a93a
mov dword [ebp - 0xafc], eax
jmp 0x1002a943
or edi, 0xffffffff
mov dword [ebp - 0xafc], edi
cmp eax, edx
sbb edi, edi
and edi, 0xc0000095
cmp eax, edx
jb 0x1002a994
mov ecx, dword [ebp - 0xb50]
lea eax, [edx + 0xc]
add ecx, esi
cmp eax, ecx
ja 0x1002c5cc
mov eax, dword [ebp - 0xafc]
mov ecx, dword [ebp - 0xaec]
mov dword [edx], 8
mov dword [eax], ecx
mov ecx, dword [ebp - 0xb08]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0xb58]
mov esi, dword [ebp - 0xb54]
inc ecx
mov dword [ebp - 0xb58], ecx
test edi, edi
js 0x1002c5cc
rdtsc
mov edi, ebx
mov dword [ebp - 0xacc], ebx
mov dword [ebp - 0xb4c], edi
mov dword [ebp - 0xae8], ebx
mov dword [ebp - 0xb20], ebx
mov dword [ebp - 0xac4], ebx
mov dword [ebp - 0xaf0], ebx
mov dword [ebp - 0xac0], ebx
mov dword [ebp - 0xb1c], ebx
mov dword [ebp - 0xb30], ebx
mov dword [ebp - 0xb0c], ebx
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xad4], edx
lea eax, [esi + 8]
cmp eax, 8
jb 0x1002a9f4
mov edx, eax
jmp 0x1002a9f7
or edx, 0xffffffff
cmp eax, 8
sbb esi, esi
and esi, 0xc0000095
cmp eax, 8
jb 0x1002aaf1
lea eax, [edx + 7]
and eax, 0xfffffff8
mov dword [ebp - 0xafc], eax
cmp eax, edx
jae 0x1002aa25
mov esi, 0xc0000095
jmp 0x1002aaf1
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x1002aa47
mov esi, 0xc0000017
mov edi, ebx
jmp 0x1002aaeb
mov eax, dword [ebp - 0xb58]
mov dword [edi], eax
lea eax, [edi + 4]
cmp eax, edi
jb 0x1002aa5a
mov ecx, eax
jmp 0x1002aa5d
or ecx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x1002aad2
mov eax, dword [ebp - 0xb54]
mov dword [ecx], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x1002aa7e
mov edx, eax
jmp 0x1002aa81
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1002aad2
mov eax, dword [ebp - 0xafc]
mov ecx, dword [ebp - 0xb04]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0xad4]
mov dword [edi + eax - 4], ecx
push dword [ebp - 0xb54]
push dword [ebp - 0xb50]
push edx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xafc]
add esp, 0xc
mov dword [ebp - 0xacc], edi
mov edi, ebx
mov dword [ebp - 0xb4c], eax
test edi, edi
je 0x1002aae5
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xb4c]
mov ecx, dword [ebp - 0xb58]
or esi, 0x10000000
jl 0x1002c3df
cmp dword [ebp - 0xacc], 0
mov dword [ebp - 0xadc], ebx
jne 0x1002ab16
mov esi, 0xc000000d
jmp 0x1002b1a2
test edi, edi
je 0x1002b19d
lea eax, [edi + 8]
push eax
push ebx
mov dword [ebp - 0xb08], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xb00], esi
test esi, esi
je 0x1002b197
mov cl, bl
mov eax, ebx
test edi, edi
je 0x1002ab5c
mov edx, dword [ebp - 0xacc]
xor cl, byte [eax + edx]
inc eax
cmp eax, edi
jb 0x1002ab54
mov eax, ebx
mov dword [ebp - 0x43c], 0xb1b54a58
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xb9c], eax
or eax, 0xffffffff
mov dword [ebp - 0xab8], eax
mov dword [ebp - 0xb8c], eax
mov eax, edi
shr eax, 3
mov dword [ebp - 0xaec], eax
test eax, eax
je 0x1002afd4
movzx edx, word [ebp - 0x43a]
mov eax, 0xc81ecb17
movzx esi, ax
shr eax, 0x10
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0xb00]
mov dword [ebp - 0xae4], esi
add eax, 7
mov esi, dword [ebp - 0xacc]
add esi, 2
mov dword [ebp - 0xabc], edx
mov edx, dword [ebp - 0xab8]
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xb48], esi
mov dword [ebp - 0xafc], ebx
mov dword [ebp - 0xb40], ebx
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xb48]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xb48]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xb48]
shl esi, 8
add dword [ebp - 0xb48], 8
movzx eax, byte [eax + 5]
or esi, eax
xor edx, esi
mov dword [ebp - 0xab8], edx
lea eax, [edx - 0x4a58]
mov edx, 0xc81ecb17
xor eax, edx
xor eax, edi
xor ebx, eax
xor edx, ebx
mov eax, ebx
ror edx, 0xf
imul edx, dword [ebp - 0xabc]
ror eax, 7
add edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov dword [ebp - 0xab8], eax
lea edx, [eax - 0x4e4ab5a8]
ror eax, 0xa
ror edx, 9
imul edx, dword [ebp - 0xae4]
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xae4]
xor edx, ebx
mov eax, ebx
rol eax, 5
rol edx, 4
imul edx, dword [ebp - 0xac8]
add edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xab8], eax
xor edx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, edx
xor ebx, eax
mov eax, ebx
shr eax, 6
lea edx, [ebx - 0x4a58]
imul edx, dword [ebp - 0xabc]
sub edx, eax
xor dword [ebp - 0xab8], edx
mov edx, dword [ebp - 0xab8]
mov eax, edx
ror eax, 0xf
xor eax, dword [ebp - 0xae4]
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, dword [ebp - 0xac8]
imul eax, dword [ebp - 0xae4]
xor edx, eax
mov dword [ebp - 0xab8], edx
sub edx, 0xc81ecb17
sub edx, 0x4a58
mov eax, dword [ebp - 0xac8]
xor ebx, edx
xor eax, ebx
mov edx, ebx
imul eax, dword [ebp - 0xabc]
ror edx, 0xa
xor edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xab8], eax
xor edx, 0x4a58
ror eax, 3
rol edx, 6
imul edx, dword [ebp - 0xae4]
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xab8]
mov eax, ebx
ror eax, 0xf
sub eax, dword [ebp - 0xac8]
imul eax, eax, 0x4a58
xor edx, eax
mov eax, dword [ebp - 0xac8]
xor eax, edx
mov dword [ebp - 0xab8], edx
imul edx, eax, 0x4a58
mov eax, dword [ebp - 0xab8]
shr eax, 1
xor edx, eax
mov eax, dword [ebp - 0xab8]
sub eax, dword [ebp - 0xae4]
xor ebx, edx
rol eax, 3
imul edx, eax, 0x4a58
mov eax, dword [ebp - 0xab8]
shr eax, 0xf
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
sub edx, dword [ebp - 0xae4]
imul edx, dword [ebp - 0xabc]
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0xab8], eax
ror edx, 9
imul edx, dword [ebp - 0xae4]
ror eax, 0xb
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xab8]
mov eax, ebx
sub eax, dword [ebp - 0xac8]
add eax, 0x4e4ab5a8
xor edx, eax
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0xab8], edx
xor eax, dword [ebp - 0xab8]
imul eax, eax, 0x4a58
ror edx, 7
sub eax, edx
mov edx, dword [ebp - 0xac8]
xor ebx, eax
xor edx, ebx
mov eax, ebx
rol edx, 4
imul edx, dword [ebp - 0xabc]
ror eax, 0x10
sub edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0xab8], eax
ror edx, 0xa
imul edx, dword [ebp - 0xae4]
ror eax, 4
add edx, eax
xor ebx, edx
mov eax, ebx
ror eax, 9
lea edx, [ebx + 0x4e4ab5a8]
ror edx, 4
imul edx, dword [ebp - 0xac8]
xor edx, eax
mov eax, 0xc81ecb17
xor dword [ebp - 0xab8], edx
xor eax, dword [ebp - 0xab8]
rol eax, 8
imul edx, eax, 0x4a58
mov eax, dword [ebp - 0xab8]
rol eax, 2
sub edx, eax
xor ebx, edx
mov edx, 0xc81ecb17
sub edx, ebx
mov eax, ebx
ror eax, 0xc
ror edx, 0xb
imul edx, dword [ebp - 0xabc]
sub edx, eax
mov eax, dword [ebp - 0xab8]
xor eax, edx
mov edx, dword [ebp - 0xabc]
xor edx, eax
mov dword [ebp - 0xab8], eax
imul edx, dword [ebp - 0xae4]
shr eax, 8
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xae0]
mov eax, ebx
add dword [ebp - 0xae0], 8
xor eax, dword [ebp - 0xab8]
xor ebx, dword [ebp - 0xafc]
xor eax, 0xc81ecb17
xor eax, dword [ebp - 0xb40]
mov dword [ebp - 0xb9c], ebx
xor eax, 0xb1b54a58
mov dword [ebp - 0xb8c], eax
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb8c]
ror dword [ebp - 0xb9c], 8
mov byte [edx], al
ror dword [ebp - 0xb8c], 8
mov al, byte [ebp - 0xb9c]
mov byte [edx - 5], al
mov al, byte [ebp - 0xb8c]
ror dword [ebp - 0xb9c], 8
mov byte [edx - 1], al
ror dword [ebp - 0xb8c], 8
mov al, byte [ebp - 0xb9c]
mov byte [edx - 6], al
ror dword [ebp - 0xb9c], 8
mov al, byte [ebp - 0xb8c]
mov byte [edx - 2], al
ror dword [ebp - 0xb8c], 8
mov al, byte [ebp - 0xb9c]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb8c]
mov byte [edx - 3], al
mov ebx, dword [ebp - 0xb9c]
mov edx, dword [ebp - 0xb8c]
ror ebx, 8
ror edx, 8
sub dword [ebp - 0xaec], 1
mov dword [ebp - 0xb40], esi
mov esi, dword [ebp - 0xb48]
mov dword [ebp - 0xb9c], ebx
mov dword [ebp - 0xb8c], edx
mov dword [ebp - 0xafc], edi
jne 0x1002abea
mov edi, dword [ebp - 0xb4c]
xor ebx, ebx
mov esi, dword [ebp - 0xb00]
movzx eax, cl
cdq
mov dword [esi + edi], eax
mov dword [esi + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x1002b000
mov esi, 0xc0000017
jmp 0x1002b0ff
mov eax, dword [ebp - 0xb08]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x1002b023
mov esi, 0xc0000017
jmp 0x1002b09e
mov dword [edi + 4], eax
push dword [ebp - 0xb08]
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
pop esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x1002b01c
mov dword [edi + 0xc], eax
push 0xa0
push 0x1009e9e8
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [edi + 0x10], esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x1002b01c
mov dword [edi + 0x14], ecx
mov eax, dword [0x1009ea88]
mov esi, ebx
mov dword [ecx], eax
mov eax, dword [0x1009ea8c]
mov dword [ebp - 0xadc], edi
mov edi, ebx
mov dword [ecx + 4], eax
test edi, edi
je 0x1002b0ff
cmp dword [edi + 4], 0
je 0x1002b0bc
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x1002b0d6
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x1002b0f0
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x1002b113
mov eax, dword [ebp - 0xadc]
mov edi, ebx
mov dword [ebp - 0xae8], eax
jmp 0x1002b119
mov edi, dword [ebp - 0xadc]
mov eax, dword [ebp - 0xb00]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x1002b18f
cmp dword [edi + 4], 0
je 0x1002b14c
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x1002b166
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x1002b180
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xb58]
jmp 0x1002b1a2
mov ecx, dword [ebp - 0xb58]
mov esi, 0xc0000001
or esi, 0x10000000
jl 0x1002c3df
mov edx, dword [ebp - 0xae8]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0xad4], eax
mov eax, dword [edx + 8]
mov edx, dword [edx]
add edx, 4
mov dword [ebp - 0xb04], eax
cmp edx, 4
jb 0x1002b1d4
mov eax, edx
jmp 0x1002b1d7
or eax, 0xffffffff
cmp edx, 4
sbb esi, esi
and esi, 0xc0000095
cmp edx, 4
jb 0x1002b271
lea edx, [eax + 4]
cmp edx, eax
jb 0x1002b1f6
mov edi, edx
jmp 0x1002b1f9
or edi, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
cmp edx, eax
jb 0x1002b271
mov eax, dword [ebp - 0xb04]
add eax, edi
cmp eax, edi
jb 0x1002b217
mov edx, eax
jmp 0x1002b21a
or edx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x1002b271
lea edi, [edx + 4]
cmp edi, edx
jb 0x1002b233
mov eax, edi
jmp 0x1002b236
or eax, 0xffffffff
cmp edi, edx
sbb esi, esi
and esi, 0xc0000095
cmp edi, edx
jb 0x1002b271
mov edx, dword [ebp - 0xad4]
add edx, eax
cmp edx, eax
jb 0x1002b25a
mov edi, edx
mov dword [ebp - 0xadc], edx
jmp 0x1002b263
or edi, 0xffffffff
mov dword [ebp - 0xadc], edi
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
cmp edx, eax
jae 0x1002b27d
mov edi, dword [ebp - 0xd00]
mov dword [ebp - 0xadc], edi
test esi, esi
js 0x1002b444
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x1002b2a5
mov esi, 0xc0000017
jmp 0x1002b43e
mov edx, dword [ebp - 0xae8]
lea ecx, [edi + 4]
mov eax, dword [edx]
mov dword [edi], eax
cmp ecx, edi
jb 0x1002b2c0
mov eax, ecx
mov dword [ebp - 0xafc], ecx
jmp 0x1002b2c9
or eax, 0xffffffff
mov dword [ebp - 0xafc], eax
cmp ecx, edi
sbb esi, esi
and esi, 0xc0000095
cmp ecx, edi
jb 0x1002b42b
push dword [edx]
push dword [edx + 4]
push eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0xae8]
add esp, 0xc
mov ecx, dword [ebp - 0xafc]
mov esi, dword [edx]
add esi, ecx
mov dword [ebp - 0xb04], esi
cmp esi, ecx
jb 0x1002b30b
mov dword [ebp - 0xafc], esi
jmp 0x1002b314
or eax, 0xffffffff
mov dword [ebp - 0xafc], eax
cmp esi, ecx
sbb esi, esi
and esi, 0xc0000095
cmp dword [ebp - 0xb04], ecx
jb 0x1002b42b
mov ecx, dword [ebp - 0xafc]
mov eax, dword [edx + 8]
lea esi, [ecx + 4]
mov dword [ecx], eax
mov dword [ebp - 0xb04], esi
cmp esi, ecx
jb 0x1002b34c
mov eax, esi
mov dword [ebp - 0xae0], esi
jmp 0x1002b355
or eax, 0xffffffff
mov dword [ebp - 0xae0], eax
cmp esi, ecx
sbb esi, esi
and esi, 0xc0000095
cmp dword [ebp - 0xb04], ecx
jb 0x1002b42b
push dword [edx + 8]
push dword [edx + 0xc]
push eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0xae8]
add esp, 0xc
mov eax, dword [ebp - 0xae0]
mov esi, dword [edx + 8]
add esi, dword [ebp - 0xae0]
mov dword [ebp - 0xb04], esi
cmp esi, eax
jb 0x1002b39d
mov ecx, esi
jmp 0x1002b3a0
or ecx, 0xffffffff
cmp esi, eax
sbb esi, esi
and esi, 0xc0000095
cmp dword [ebp - 0xb04], eax
jb 0x1002b42b
mov eax, dword [edx + 0x10]
lea esi, [ecx + 4]
mov dword [ecx], eax
mov dword [ebp - 0xb04], esi
cmp esi, ecx
jb 0x1002b3ce
mov eax, esi
mov dword [ebp - 0xafc], esi
jmp 0x1002b3d7
or eax, 0xffffffff
mov dword [ebp - 0xafc], eax
cmp esi, ecx
sbb esi, esi
and esi, 0xc0000095
cmp dword [ebp - 0xb04], ecx
jb 0x1002b42b
push dword [edx + 0x10]
push dword [edx + 0x14]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xae8]
add esp, 0xc
mov ecx, dword [ebp - 0xafc]
mov eax, dword [eax + 0x10]
add eax, ecx
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1002b42b
mov eax, dword [ebp - 0xadc]
mov dword [ebp - 0xb20], edi
mov edi, ebx
mov dword [ebp - 0xac4], eax
test edi, edi
je 0x1002b43e
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xb58]
or esi, 0x10000000
jl 0x1002c3df
mov dword [ebp - 0xb40], ebx
cmp dword [ebp - 0xb50], 0
jne 0x1002b492
mov esi, 0xc000000d
mov eax, ebx
test esi, esi
js 0x1002c3df
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x1002b620
mov esi, 0xd0000017
jmp 0x1002c3df
xor eax, eax
inc eax
cmp ecx, eax
jbe 0x1002b45f
mov edx, dword [ebp - 0xb50]
mov dword [ebp - 0xafc], ebx
mov eax, dword [edx]
lea edi, [edx + 4]
mov dword [ebp - 0xb04], eax
cmp edi, edx
jb 0x1002b4b8
mov eax, edi
jmp 0x1002b4bb
or eax, 0xffffffff
cmp edi, edx
sbb esi, esi
and esi, 0xc0000095
cmp edi, edx
jb 0x1002b515
mov edx, dword [ebp - 0xb04]
add edx, eax
mov edi, edx
cmp edx, eax
jae 0x1002b4da
or edx, 0xffffffff
cmp edi, eax
sbb esi, esi
and esi, 0xc0000095
cmp edi, eax
jb 0x1002b515
mov eax, dword [ebp - 0xafc]
xor esi, esi
inc eax
inc esi
mov dword [ebp - 0xafc], eax
cmp eax, esi
jb 0x1002b4a5
lea eax, [edx + 4]
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x1002b515
mov eax, dword [edx]
mov dword [ebp - 0xb40], eax
test esi, esi
js 0x1002b464
cmp ecx, 2
jbe 0x1002b45f
mov ecx, dword [ebp - 0xb50]
mov edi, ebx
mov eax, dword [ecx]
lea edx, [ecx + 4]
mov dword [ebp - 0xb04], eax
cmp edx, ecx
jb 0x1002b541
mov eax, edx
jmp 0x1002b544
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
cmp edx, ecx
jb 0x1002b58c
mov ecx, dword [ebp - 0xb04]
add ecx, eax
mov edx, ecx
cmp ecx, eax
jae 0x1002b563
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
cmp edx, eax
jb 0x1002b58c
inc edi
cmp edi, 2
jb 0x1002b52e
lea eax, [ecx + 4]
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1002b58c
mov edi, dword [ecx]
jmp 0x1002b58e
mov edi, ebx
test esi, esi
js 0x1002b464
mov eax, dword [ebp - 0xb40]
add eax, 0x30
cmp eax, 0x30
jb 0x1002b5a8
mov ecx, eax
jmp 0x1002b5ab
or ecx, 0xffffffff
cmp eax, 0x30
sbb esi, esi
and esi, 0xc0000095
cmp eax, 0x30
jb 0x1002b5f3
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x1002b5c6
mov eax, edx
jmp 0x1002b5c9
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
cmp edx, ecx
jb 0x1002b5f3
lea edx, [eax + edi]
cmp edx, eax
jb 0x1002b5e2
mov ecx, edx
jmp 0x1002b5e5
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
cmp edx, eax
jae 0x1002b5f9
mov ecx, dword [ebp - 0xcfc]
test esi, esi
js 0x1002b464
cmp ecx, 0x400000
jbe 0x1002b613
mov esi, 0x8000ffff
jmp 0x1002c3df
mov eax, ecx
mov dword [ebp - 0xac0], eax
jmp 0x1002b466
mov dword [ebp - 0xaf0], edi
mov eax, dword [ebp - 0xb20]
test eax, eax
jne 0x1002b63a
mov esi, 0x80070057
jmp 0x1002c3df
mov dword [ebp - 0xcb4], eax
mov eax, dword [ebp - 0xac4]
mov dword [ebp - 0xcac], eax
mov eax, dword [ebp - 0xac0]
mov dword [ebp - 0xca8], eax
lea eax, [ebp - 0xbf8]
push eax
xor eax, eax
mov dword [ebp - 0xcb0], edi
push 0x1000dca0
inc eax
mov dword [ebp - 0xca4], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x1002b6a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1002b695
movzx esi, si
or esi, 0x80070000
test esi, esi
mov eax, dword [ebp - 0xac0]
js 0x1002b6f2
mov esi, 0x80004005
jmp 0x1002b6f2
push 0x100100b0
push dword [ebp - 0xbf8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1002b67e
push ebx
push 0x14
lea eax, [ebp - 0xcb4]
mov ecx, esi
push eax
push 0x86
call dword [0x100a0bc0]
call esi
mov esi, eax
or esi, 0x10000000
jl 0x1002b6ec
mov eax, dword [ebp - 0xca8]
mov dword [ebp - 0xac0], eax
jmp 0x1002b6f2
mov eax, dword [ebp - 0xac0]
cmp esi, 0xd0000023
jne 0x1002b704
mov esi, 0x8007007a
jmp 0x1002c3df
test esi, esi
js 0x1002c3df
mov dword [ebp - 0xb00], ebx
cmp eax, 4
jae 0x1002b721
mov esi, 0xc000003e
jmp 0x1002bb0e
mov ecx, dword [edi]
lea eax, [edi + 4]
mov dword [ebp - 0xae0], ecx
cmp eax, edi
jb 0x1002b73a
mov edx, eax
mov dword [ebp - 0xb4c], eax
jmp 0x1002b743
or edx, 0xffffffff
mov dword [ebp - 0xb4c], edx
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x1002bb0e
mov eax, dword [ebp - 0xac0]
add eax, 0xfffffffc
cmp eax, ecx
jb 0x1002b717
lea edi, [edx + ecx]
cmp edi, edx
jb 0x1002b76d
mov edx, edi
jmp 0x1002b770
or edx, 0xffffffff
cmp edi, dword [ebp - 0xb4c]
sbb esi, esi
and esi, 0xc0000095
cmp edi, dword [ebp - 0xb4c]
jb 0x1002bb0e
lea eax, [ecx + 4]
cmp eax, 4
jb 0x1002b796
mov ecx, eax
jmp 0x1002b799
or ecx, 0xffffffff
cmp eax, 4
mov edi, 0xc0000095
sbb esi, esi
and esi, edi
cmp eax, 4
jb 0x1002bb0e
mov eax, dword [ebp - 0xac0]
sub eax, ecx
cmp eax, 4
jb 0x1002b717
mov eax, dword [edx]
mov dword [ebp - 0xb40], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x1002b7d6
mov dword [ebp - 0xba8], eax
jmp 0x1002b7dd
or dword [ebp - 0xba8], 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, edi
cmp eax, edx
jb 0x1002bb0e
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x1002b7f6
mov edi, eax
jmp 0x1002b7f9
or edi, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1002bb0e
mov eax, dword [ebp - 0xac0]
mov ecx, dword [ebp - 0xb40]
sub eax, edi
cmp eax, ecx
jb 0x1002b717
mov edx, dword [ebp - 0xba8]
lea esi, [edx + ecx]
cmp esi, edx
jb 0x1002b836
mov dword [ebp - 0xafc], esi
jmp 0x1002b83f
or eax, 0xffffffff
mov dword [ebp - 0xafc], eax
cmp esi, edx
lea eax, [edx + ecx]
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x1002bb0e
lea eax, [edi + ecx]
cmp eax, edi
jb 0x1002b85f
mov edx, eax
jmp 0x1002b862
or edx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x1002bb0e
mov eax, dword [ebp - 0xac0]
sub eax, edx
cmp eax, 4
jb 0x1002b717
mov eax, dword [ebp - 0xafc]
mov edi, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xb04], edi
cmp ecx, eax
jb 0x1002b8a2
mov dword [ebp - 0xadc], ecx
jmp 0x1002b8a9
or dword [ebp - 0xadc], 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
cmp ecx, eax
jb 0x1002bb0e
lea eax, [edx + 4]
cmp eax, edx
jb 0x1002b8c6
mov ecx, eax
jmp 0x1002b8c9
or ecx, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x1002bb0e
mov eax, dword [ebp - 0xac0]
sub eax, ecx
cmp eax, edi
jb 0x1002b717
lea eax, [ecx + edi]
cmp eax, ecx
jb 0x1002b8f6
mov edx, eax
jmp 0x1002b8f9
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1002bb0e
mov ecx, dword [ebp - 0xac0]
mov eax, ecx
sub eax, edx
jne 0x1002b717
mov eax, dword [ebp - 0xae0]
mov esi, dword [ebp - 0xb40]
add eax, 0xc
add eax, esi
add eax, edi
cmp eax, ecx
jne 0x1002b717
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x1002b957
mov esi, 0xc0000017
jmp 0x1002ba93
cmp dword [ebp - 0xb4c], 0
je 0x1002b9a3
mov eax, dword [ebp - 0xae0]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x1002b988
mov esi, 0xc0000017
jmp 0x1002ba32
mov dword [edi + 4], ecx
mov eax, dword [ebp - 0xae0]
push eax
push dword [ebp - 0xb4c]
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x1002b9a8
mov dword [edi], ebx
mov dword [edi + 4], ebx
cmp dword [ebp - 0xba8], 0
je 0x1002b9dd
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x1002b97e
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xba8]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x1002b9e3
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
cmp dword [ebp - 0xadc], 0
je 0x1002ba22
mov esi, dword [ebp - 0xb04]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x1002b97e
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xadc]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x1002ba28
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [ebp - 0xb00], edi
mov esi, ebx
mov edi, ebx
test edi, edi
je 0x1002ba93
cmp dword [edi + 4], 0
je 0x1002ba50
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x1002ba6a
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x1002ba84
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x1002baa7
mov eax, dword [ebp - 0xb00]
mov edi, ebx
mov dword [ebp - 0xb1c], eax
jmp 0x1002baad
mov edi, dword [ebp - 0xb00]
test edi, edi
je 0x1002bb0e
cmp dword [edi + 4], 0
je 0x1002bacb
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x1002bae5
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x1002baff
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
or esi, 0x10000000
jl 0x1002c3df
mov ecx, dword [ebp - 0xb1c]
mov edi, ebx
mov dword [ebp - 0xad8], ebx
test ecx, ecx
jne 0x1002bb36
mov esi, 0xd000000d
jmp 0x1002c3df
mov eax, dword [ecx + 4]
mov dword [ebp - 0xac4], eax
test eax, eax
je 0x1002bb2c
mov esi, dword [ecx]
test esi, esi
je 0x1002bb2c
add esi, 0xfffffff8
push esi
push ebx
mov dword [ebp - 0xb4c], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb08], eax
test eax, eax
je 0x1002c160
mov ecx, dword [ebp - 0xac4]
mov edi, esi
and edi, 7
mov dword [ebp - 0xae0], eax
mov dl, bl
mov dword [ebp - 0x444], 0xab69605e
mov dword [ebp - 0xb40], ecx
mov eax, ebx
mov dword [ebp - 0xad4], edi
je 0x1002c101
or dword [ebp - 0xb60], 0xffffffff
mov esi, ebx
mov dword [ebp - 0xb68], ebx
mov dword [ebp - 0xabc], ebx
mov dword [ebp - 0xb10], eax
test edi, edi
je 0x1002bc0f
lea eax, [ecx + 1]
mov dword [ebp - 0xb04], eax
movzx eax, byte [ecx]
mov ecx, dword [ebp - 0xbac]
cmp esi, 4
jge 0x1002bbe3
add ecx, 0xffffffe0
shl eax, cl
or dword [ebp - 0xb10], eax
jmp 0x1002bbe7
shl eax, cl
or ebx, eax
sub dword [ebp - 0xbac], 8
inc esi
mov eax, dword [ebp - 0xb04]
mov ecx, eax
cmp esi, edi
jl 0x1002bbbf
mov dword [ebp - 0xabc], ebx
xor ebx, ebx
mov dword [ebp - 0xb40], eax
mov eax, dword [ebp - 0xb10]
mov ecx, dword [ebp - 0xabc]
xor eax, 0x92f65a5
xor ecx, 0x699a899c
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xb68], eax
mov dword [ebp - 0xb14], ecx
mov dword [ebp - 0xb60], ecx
mov dword [ebp - 0xb04], ebx
test edi, edi
je 0x1002bc91
mov esi, dword [ebp - 0xae0]
lea edi, [esi + 1]
mov dword [ebp - 0xafc], edi
cmp ebx, 4
jge 0x1002bc5d
rol eax, 8
mov byte [esi], al
jmp 0x1002bc62
rol ecx, 8
mov byte [esi], cl
mov edi, dword [ebp - 0xad4]
inc ebx
mov esi, dword [ebp - 0xafc]
cmp ebx, edi
jl 0x1002bc48
mov eax, esi
xor ebx, ebx
mov esi, dword [ebp - 0xb60]
mov dword [ebp - 0xae0], eax
mov eax, dword [ebp - 0xb68]
mov dword [ebp - 0xae4], eax
jmp 0x1002bc97
mov esi, dword [ebp - 0xb14]
add edi, 0xfffffffc
test edi, edi
jle 0x1002c0cf
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0xb14], esi
mov dword [ebp - 0xb60], esi
mov edi, dword [ebp - 0xae4]
mov esi, dword [ebp - 0xb4c]
mov eax, esi
shr eax, 3
mov dword [ebp - 0xaec], eax
test eax, eax
je 0x1002c098
movzx esi, word [ebp - 0x442]
mov eax, 0x7f1137f
mov ecx, eax
mov dword [ebp - 0xac8], esi
mov esi, dword [ebp - 0xb40]
movzx eax, ax
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0xae0]
shr ecx, 0x10
add eax, 7
mov dword [ebp - 0xb48], ecx
add esi, 2
mov dword [ebp - 0xafc], eax
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx ecx, byte [esi + 2]
shl ecx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or ecx, eax
mov dword [ebp - 0xb04], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl ecx, 8
or ecx, eax
mov dword [ebp - 0xae4], edi
movzx eax, byte [esi + 5]
add esi, 8
mov ebx, dword [ebp - 0xae4]
shl ecx, 8
or ecx, eax
mov dword [ebp - 0xb40], esi
mov edi, ecx
mov esi, dword [ebp - 0xadc]
xor edi, dword [ebp - 0xb14]
mov eax, 0x7f1137f
xor edi, eax
mov dword [ebp - 0xad4], ecx
xor edi, ebx
xor edi, 0xab69605e
mov eax, edi
rol eax, 0xa
lea ecx, [edi + 0x54969fa2]
rol ecx, 5
imul ecx, esi
add ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea ecx, [ebx + ecx]
ror ecx, 9
imul ecx, dword [ebp - 0xac8]
sub ecx, eax
xor edi, ecx
mov eax, edi
sub eax, esi
imul ecx, eax, 0x605e
mov eax, edi
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xac8]
rol ecx, 6
imul ecx, dword [ebp - 0xb48]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor edi, ecx
mov ecx, edi
xor ecx, 0xab69605e
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, esi
ror ecx, 6
imul eax, dword [ebp - 0xac8]
xor ecx, eax
mov eax, 0x7f1137f
xor edi, ecx
add eax, edi
ror eax, 0xf
imul ecx, eax, 0x605e
mov eax, edi
rol eax, 2
add ecx, eax
xor ebx, ecx
mov eax, ebx
rol eax, 8
lea ecx, [ebx + 0x54969fa2]
ror ecx, 0xe
imul ecx, dword [ebp - 0xb48]
sub ecx, eax
xor edi, ecx
mov ecx, edi
mov eax, edi
xor ecx, 0xab69605e
ror eax, 0xa
ror ecx, 0xc
imul ecx, esi
xor ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xb48]
imul ecx, dword [ebp - 0xac8]
shr eax, 0xa
xor ecx, eax
xor edi, ecx
mov eax, edi
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xb48]
xor ebx, eax
mov esi, ebx
sub esi, dword [ebp - 0xb48]
xor esi, edi
xor esi, 0xab69605e
mov ecx, esi
mov eax, esi
xor ecx, dword [ebp - 0xb48]
rol ecx, 2
imul ecx, dword [ebp - 0xadc]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 6
imul ecx, dword [ebp - 0xac8]
rol eax, 7
add ecx, eax
xor esi, ecx
mov eax, esi
mov ecx, esi
xor eax, dword [ebp - 0xadc]
imul eax, eax, 0x605e
ror ecx, 9
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov dword [ebp - 0xae4], ebx
xor ecx, dword [ebp - 0xac8]
mov eax, ebx
rol ecx, 5
imul ecx, dword [ebp - 0xb48]
rol eax, 7
add ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov ebx, esi
xor ebx, dword [ebp - 0xae4]
xor ebx, ecx
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xac8]
imul eax, dword [ebp - 0xadc]
xor esi, eax
mov eax, esi
sub eax, ecx
ror eax, 1
imul ecx, eax, 0x605e
mov eax, esi
ror eax, 6
sub ecx, eax
xor ebx, ecx
mov eax, ebx
rol eax, 0xe
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul ecx, dword [ebp - 0xb48]
add ecx, eax
xor esi, ecx
mov eax, esi
ror eax, 0xe
lea ecx, [esi - 0x54969fa2]
rol ecx, 0xf
imul ecx, dword [ebp - 0xadc]
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
shr eax, 3
xor ecx, 0x605e
imul ecx, dword [ebp - 0xac8]
xor ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov eax, esi
xor eax, ecx
rol eax, 4
imul ecx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xabc]
rol eax, 2
mov dword [ebp - 0xb60], esi
mov esi, dword [ebp - 0xb40]
xor ecx, eax
xor ecx, dword [ebp - 0xb10]
xor ebx, ecx
mov ecx, dword [ebp - 0xafc]
mov dword [ebp - 0xb68], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xb60]
ror dword [ebp - 0xb68], 8
mov byte [ecx], al
mov al, byte [ebp - 0xb68]
ror dword [ebp - 0xb60], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb60]
ror dword [ebp - 0xb68], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xb68]
ror dword [ebp - 0xb60], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xb60]
ror dword [ebp - 0xb68], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xb60], 8
mov al, byte [ebp - 0xb68]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb60]
mov byte [ecx - 3], al
add ecx, 8
mov eax, dword [ebp - 0xb60]
mov edi, dword [ebp - 0xb68]
ror eax, 8
mov dword [ebp - 0xb14], eax
mov dword [ebp - 0xb60], eax
mov eax, dword [ebp - 0xb04]
ror edi, 8
sub dword [ebp - 0xaec], 1
mov dword [ebp - 0xb10], eax
mov eax, dword [ebp - 0xad4]
mov dword [ebp - 0xb68], edi
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xafc], ecx
jne 0x1002bd17
mov esi, dword [ebp - 0xb4c]
xor ebx, ebx
mov ecx, dword [ebp - 0xb08]
mov eax, ebx
test esi, esi
je 0x1002c0ac
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0x1002c0a4
mov edi, dword [ebp - 0xac4]
movzx eax, dl
cdq
cmp eax, dword [esi + edi]
jne 0x1002c127
cmp edx, dword [esi + edi + 4]
jne 0x1002c127
mov edi, ecx
mov dword [ebp - 0xad8], esi
mov ecx, ebx
mov esi, ebx
jmp 0x1002c12e
mov ecx, ebx
mov dword [ebp - 0xb14], ecx
mov dword [ebp - 0xb60], ecx
test edi, edi
jns 0x1002bcba
neg edi
shl edi, 3
mov ecx, edi
shr eax, cl
shl eax, cl
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xb68], eax
jmp 0x1002bcba
or dword [ebp - 0xabc], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xb10], ebx
mov dword [ebp - 0xb14], eax
mov dword [ebp - 0xb60], eax
mov dword [ebp - 0xb68], edi
jmp 0x1002bcc6
mov esi, 0xc004d501
mov edi, ebx
test ecx, ecx
je 0x1002c141
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x1002c160
mov eax, dword [ebp - 0xad8]
mov esi, 0x10000000
mov dword [ebp - 0xb30], edi
mov edi, ebx
mov dword [ebp - 0xb0c], eax
jmp 0x1002c165
mov esi, 0xd0000001
test edi, edi
je 0x1002c178
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x1002c3df
mov edx, dword [ebp - 0xb0c]
cmp edx, 4
jb 0x1002c3d4
mov edi, dword [ebp - 0xb30]
mov eax, dword [edi]
mov dword [ebp - 0xad4], eax
lea eax, [edi + 4]
cmp eax, edi
jb 0x1002c1a8
mov ecx, eax
jmp 0x1002c1ab
or ecx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x1002c3d9
lea eax, [edx - 4]
cmp eax, 4
jb 0x1002c3d4
mov edx, dword [ecx]
lea eax, [ecx + 4]
mov dword [ebp - 0xaec], edx
cmp eax, ecx
jb 0x1002c1dc
mov edi, eax
jmp 0x1002c1df
or edi, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1002c3d9
mov eax, dword [ebp - 0xb0c]
add eax, 0xfffffff8
cmp eax, edx
jb 0x1002c3d4
lea eax, [edx + 8]
cmp eax, 8
sbb esi, esi
and esi, 0xc0000095
cmp eax, 8
jb 0x1002c3d9
mov eax, dword [ebp - 0xb30]
lea ecx, [edi + edx]
mov esi, dword [ebp - 0xb0c]
add eax, esi
mov dword [ebp - 0xb04], ecx
cmp eax, ecx
jb 0x1002c3d4
sub esi, edi
sub esi, edx
add esi, dword [ebp - 0xb30]
cmp esi, 8
jae 0x1002c3d4
mov dword [ebp - 0xadc], ebx
mov eax, ebx
mov dword [ebp - 0xb08], eax
mov esi, ebx
test edi, edi
je 0x1002c367
lea esi, [edi + edx]
mov ecx, edi
cmp esi, edi
jb 0x1002c276
mov eax, esi
mov dword [ebp - 0xb40], esi
jmp 0x1002c27f
or eax, 0xffffffff
mov dword [ebp - 0xb40], eax
cmp esi, edi
sbb esi, esi
and esi, 0xc0000095
cmp dword [ebp - 0xb04], edi
jb 0x1002c3c2
cmp edi, eax
jae 0x1002c361
lea esi, [ecx + 4]
mov dword [ebp - 0xb04], esi
cmp esi, ecx
jb 0x1002c2b2
mov dword [ebp - 0xafc], esi
jmp 0x1002c2b9
or dword [ebp - 0xafc], 0xffffffff
cmp esi, ecx
sbb esi, esi
and esi, 0xc0000095
cmp dword [ebp - 0xb04], ecx
jb 0x1002c3c2
cmp dword [ebp - 0xafc], eax
ja 0x1002c38c
mov eax, dword [ecx]
add eax, 4
cmp eax, 4
jb 0x1002c2ed
mov dword [ebp - 0xafc], eax
jmp 0x1002c2f4
or dword [ebp - 0xafc], 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
cmp eax, 4
jb 0x1002c3c2
mov edx, dword [ebp - 0xafc]
mov dword [ebp - 0xc40], edx
mov edx, dword [ebp - 0xaec]
mov eax, dword [ebp - 0xc40]
add eax, ecx
cmp eax, ecx
jb 0x1002c32e
mov dword [ebp - 0xae0], eax
jmp 0x1002c335
or dword [ebp - 0xae0], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x1002c3c2
mov eax, dword [ebp - 0xb40]
mov ecx, dword [ebp - 0xae0]
cmp ecx, eax
ja 0x1002c38c
inc dword [ebp - 0xadc]
cmp ecx, eax
jb 0x1002c29d
cmp ecx, eax
jne 0x1002c38c
mov eax, ebx
test edx, edx
je 0x1002c39b
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb08], eax
test eax, eax
jne 0x1002c393
mov esi, 0xc0000017
jmp 0x1002c3c2
mov esi, 0xc000000d
jmp 0x1002c3d9
mov edx, dword [ebp - 0xaec]
mov esi, ebx
test edi, edi
je 0x1002c3b0
push edx
push edi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xb08]
add esp, 0xc
mov dword [ebp - 0xc04], eax
mov eax, dword [ebp - 0xadc]
mov dword [ebp - 0xc0c], eax
test esi, esi
js 0x1002c3d9
mov eax, dword [ebp - 0xad4]
cmp eax, dword [ebp - 0xc0c]
je 0x1002c3d9
mov esi, 0xc000003e
or esi, 0x10000000
mov eax, dword [ebp - 0xacc]
test eax, eax
je 0x1002c3f8
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xae8]
test edi, edi
je 0x1002c45f
cmp dword [edi + 4], 0
je 0x1002c41c
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x1002c436
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x1002c450
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb20]
test eax, eax
je 0x1002c478
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xaf0]
test eax, eax
je 0x1002c491
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xb1c]
test edi, edi
je 0x1002c4f8
cmp dword [edi + 4], 0
je 0x1002c4b5
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x1002c4cf
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x1002c4e9
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb30]
test eax, eax
je 0x1002c511
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x1002c5cc
xor eax, eax
inc eax
cmp dword [ebp - 0xc0c], eax
jb 0x1002c5cc
mov eax, dword [ebp - 0xc04]
test eax, eax
je 0x1002c5cc
cmp dword [ebp - 0xc0c], 0
jbe 0x1002c5cc
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x1002c550
mov edi, ecx
jmp 0x1002c553
or edi, 0xffffffff
cmp ecx, dword [ebp - 0xc04]
sbb esi, esi
and esi, 0xc0000095
cmp ecx, dword [ebp - 0xc04]
jb 0x1002c573
mov eax, edx
neg eax
sbb eax, eax
and eax, edi
jmp 0x1002c57f
mov edx, dword [ebp - 0xcec]
mov eax, dword [ebp - 0xd08]
test esi, esi
js 0x1002c5cc
cmp edx, 4
jne 0x1002c5cc
cmp dword [eax], 0
jl 0x1002c5cc
xor eax, eax
inc eax
cmp dword [ebp - 0xc0c], eax
jbe 0x1002c5cc
mov eax, dword [ebp - 0xc04]
mov esi, ebx
mov edi, dword [eax]
lea edx, [eax + 4]
cmp edx, eax
jb 0x1002c5ad
mov ecx, edx
jmp 0x1002c5b0
or ecx, 0xffffffff
cmp edx, eax
jb 0x1002c5cc
lea eax, [edi + ecx]
mov edx, eax
cmp eax, ecx
jae 0x1002c5c0
or eax, 0xffffffff
cmp edx, ecx
jb 0x1002c5cc
xor ecx, ecx
inc esi
inc ecx
cmp esi, ecx
jb 0x1002c5a0
mov esi, dword [ebp - 0xaf4]
mov edi, dword [ebp - 0xad0]
jmp 0x1002c5de
mov esi, ebx
mov edi, ebx
cmp dword [ebp - 0xb50], 0
mov dword [ebp - 0xb54], ebx
mov dword [ebp - 0xb58], ebx
je 0x1002c60d
push dword [ebp - 0xb50]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xb50], ebx
mov eax, dword [ebp - 0xc04]
test eax, eax
je 0x1002c626
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x1002c639
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x1002c64c
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xbcc]
mov dword [ebp - 0xbcc], ebx
mov dword [ebp - 0xbe0], eax
jmp 0x10022c47
cmp eax, 0xd00000e5
je 0x1002c682
cmp eax, 0xc004d501
je 0x1002c682
cmp eax, 0xd000003e
jne 0x1002c687
mov eax, 0xc004f028
jmp 0x10022cdf
mov eax, 0xc004f027
test eax, eax
jns 0x1002c69d
cmp eax, 0x8007007a
jne 0x10022cdf
mov esi, 0xc004f01e
jmp 0x1002c6b4
cmp dword [ebp - 0xbd0], 4
jne 0x1002c696
mov eax, dword [ebp - 0xbe0]
mov esi, dword [ebp - 0xbd8]
mov ebx, dword [eax]
lea ecx, [ebp - 0xbe0]
call fcn.10061a7d
test esi, esi
jns 0x1002c6cc
cmp esi, edi
je 0x1002c6cc
xor eax, eax
lea ebx, [eax + 1]
mov ecx, dword [ebp - 4]
test ebx, ebx
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.10084510
mov esp, ebp
pop ebp
ret