Function at 0xa8af2b
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe8c
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0xcac]
xor ebx, ebx
push eax
push 0x9f0eb8
inc ebx
push 0x9f0e90
mov dword [ebp - 0xcac], ebx
call dword [sym.imp.ext_ms_win_devmgmt_policy_l1_1_0.dll_PolicyManager_GetPolicyInt]
test eax, eax
js 0xb2dbd7
cmp dword [ebp - 0xcac], 0
je 0xa8afde
xor edx, edx
mov esi, 0xc96238
mov dword [ebp - 0xcb0], edx
mov dword [ebp - 0xcd8], edx
mov dword [ebp - 0xce0], edx
mov dword [ebp - 0xce4], edx
mov dword [ebp - 0xce8], edx
jmp 0xb2dbef
test ebx, ebx
js 0xb38006
push 4
pop ecx
cmp dword [ebp - 0xce4], ecx
jne 0xb38012
mov ebx, dword [eax]
mov esi, dword [ebp - 0xce0]
jmp 0xb2e668
test esi, esi
js 0xb3801c
test ebx, ebx
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret
xor al, al
jmp 0xa8afcf
mov ecx, dword [ebp + 4]
mov edx, 0x93
push eax
push 0x9f9158
call fcn.00ab606d
jmp 0xa8af6b
mov ecx, ebx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xb2dbef
mov eax, dword [0xc95890]
or edi, 0xffffffff
mov dword [ebp - 0xcec], edi
mov ebx, 0x9fbcf2
mov dword [ebp - 0xcf0], ebx
mov dword [ebp - 0xcfc], 0x67
mov dword [ebp - 0xbd4], 0x337
mov dword [ebp - 0xbd8], 0x10b
mov dword [ebp - 0xbdc], 0x20b
test eax, eax
jne 0xb2e243
push 0x338
mov esi, edx
mov dword [ebp - 0xba8], edx
push edx
mov dword [ebp - 0xbac], edx
mov dword [ebp - 0xb40], esi
mov dword [ebp - 0xb44], edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xbb0], eax
test eax, eax
je 0xb2e237
mov esi, 0xab69605e
mov dword [ebp - 0xb80], edi
xor edx, edx
mov dword [ebp - 0x380], esi
mov esi, 0x7f1137f
mov dword [ebp - 0xb34], edx
add eax, 7
mov dword [ebp - 0x37c], esi
mov cl, dl
mov dword [ebp - 0xb50], edx
mov dword [ebp - 0xb14], eax
mov esi, ebx
mov dword [ebp - 0xb00], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [ebp - 0xaf0], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [ebp - 0xb54], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [ebp - 0xb50]
xor esi, edx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0xaf0]
xor eax, edx
mov dword [ebp - 0xaf0], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xaf0]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xaf0]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xaf0], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xaf0]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xaf0]
xor edx, eax
mov dword [ebp - 0xaf0], edx
mov eax, dword [ebp - 0xaf0]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xaf0]
xor eax, edx
mov dword [ebp - 0xaf0], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xaf0]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xaf0]
xor eax, edx
mov dword [ebp - 0xaf0], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xaf0]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov esi, dword [ebp - 0xaf0]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor esi, eax
lea eax, [esi - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0xb50], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb50]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xb50]
xor eax, edx
mov dword [ebp - 0xb50], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0xb50], edx
mov edx, dword [ebp - 0xb50]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xb50], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb50]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xb50]
xor eax, edx
mov dword [ebp - 0xb50], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb50]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xb50]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xb50], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb50]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xb50]
xor edx, dword [ebp - 0xb34]
xor eax, dword [ebp - 0xb80]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xaf0], esi
mov esi, dword [ebp - 0xb14]
mov dword [ebp - 0xb34], ebx
mov dword [ebp - 0xb80], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xb00], 1
mov dword [ebp - 0xb14], esi
mov esi, dword [ebp - 0xb54]
mov dword [ebp - 0xb50], eax
jne 0xb2dcc0
mov esi, dword [ebp - 0xbb0]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xb2e02b
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xb2e05d
cmp edx, dword [0x9fc02c]
jne 0xb2e05d
mov edi, esi
xor eax, eax
mov dword [ebp - 0xb40], edi
mov esi, eax
mov ebx, 0x337
jmp 0xb2e072
mov edi, dword [ebp - 0xb40]
or ebx, 0xffffffff
mov dword [ebp - 0xb44], 0xc004d501
xor eax, eax
test esi, esi
je 0xb2e085
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb44], 0
jl 0xb2e231
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xc960a0
push eax
push ebx
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xb2e1c7
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xcb0]
jne 0xb2e0bc
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xb2e22a
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xbac], ecx
cmp word [eax], dx
jne 0xb2e132
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xb2e132
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xb2e132
cmp dword [edx], 0x4550
jne 0xb2e132
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xbd8]
je 0xb2e13f
cmp ax, word [ebp - 0xbdc]
je 0xb2e13f
mov ecx, 0xc000000d
jmp 0xb2e137
mov ecx, 0xc000007b
mov dword [ebp - 0xbac], ecx
jmp 0xb2e151
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0xb54], eax
test eax, eax
je 0xb2e1bb
mov edx, esi
mov dword [ebp - 0xaf0], esi
lea eax, [edx + 1]
mov dword [ebp - 0xb00], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xb2e173
sub edx, dword [ebp - 0xb00]
inc esi
add esi, edx
test ecx, ecx
js 0xb2e1ac
push dword [ebp - 0xaf0]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xb2e1c7
mov ecx, dword [ebp - 0xba8]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xbac]
inc dword [ebp - 0xba8]
inc ebx
cmp ebx, dword [ebp - 0xb54]
jb 0xb2e162
add edi, 0x10
cmp byte [esi], 0
jne 0xb2e0b5
mov ebx, dword [ebp - 0xbac]
mov esi, dword [ebp - 0xb40]
test esi, esi
je 0xb2e1e8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xb2e23e
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb2e201
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb2e1f0
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xb2e24b
mov ebx, 0xc000007a
jmp 0xb2e1cd
mov esi, dword [ebp - 0xb40]
mov ebx, 0xc000007a
jmp 0xb2e1d3
mov eax, dword [0xc95890]
inc eax
xor ebx, ebx
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
mov eax, ebx
mov dword [ebp - 0xb54], ebx
mov dword [ebp - 0xb00], eax
mov edi, ebx
mov eax, dword fs:[0x30]
mov dword [ebp - 0xaf0], ebx
cmp dword [eax + 0x1d4], ebx
je 0xb2e542
mov esi, dword [0xc93088]
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0xb14], ecx
test ecx, ecx
jne 0xb2e2a3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb2e58a
mov eax, ebx
mov esi, ebx
mov dword [ebp - 0xb00], eax
mov ebx, dword [0xc93098]
lea edx, [ebp - 0xbe0]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xc99200]
call ebx
test eax, eax
jne 0xb2e332
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xb2e314
xor eax, eax
test esi, esi
jne 0xb2e30d
push dword [ebp - 0xbe0]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xb2e306
mov eax, dword [ebp - 0xbe0]
mov ecx, dword [ebp - 0xb14]
jmp 0xb2e2ad
mov ebx, 0x8007000e
jmp 0xb2e32e
mov ebx, 0x80004005
jmp 0xb2e342
test eax, eax
jne 0xb2e31f
mov ebx, 0x80004005
jmp 0xb2e32e
jg 0xb2e325
mov ebx, eax
jmp 0xb2e32e
movzx ebx, ax
or ebx, 0x80070000
xor eax, eax
jmp 0xb2e342
mov ebx, dword [ebp - 0xb00]
xor eax, eax
mov dword [ebp - 0xb54], esi
mov esi, eax
test esi, esi
je 0xb2e355
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb2e569
mov esi, dword [0xc93094]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0xb14], ecx
test ecx, ecx
jne 0xb2e3a7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb2e397
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb2e569
mov ebx, 0x80004005
jmp 0xb2e569
xor edx, edx
mov eax, edx
mov esi, edx
mov dword [ebp - 0xb00], eax
mov ebx, dword [0xc93098]
lea edx, [ebp - 0xbe4]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xc99200]
call ebx
test eax, eax
jne 0xb2e444
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xb2e420
xor eax, eax
test esi, esi
jne 0xb2e413
push dword [ebp - 0xbe4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xb2e40c
mov eax, dword [ebp - 0xbe4]
mov ecx, dword [ebp - 0xb14]
jmp 0xb2e3b3
mov ebx, 0x8007000e
jmp 0xb2e43a
mov ebx, 0x80004005
mov dword [ebp - 0xb00], ebx
jmp 0xb2e450
test eax, eax
jne 0xb2e42b
mov ebx, 0x80004005
jmp 0xb2e43a
jg 0xb2e431
mov ebx, eax
jmp 0xb2e43a
movzx ebx, ax
or ebx, 0x80070000
mov dword [ebp - 0xb00], ebx
xor eax, eax
jmp 0xb2e450
mov ebx, dword [ebp - 0xb00]
xor eax, eax
mov edi, esi
mov esi, eax
test esi, esi
je 0xb2e463
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb2e54e
mov eax, dword [ebp - 0xb54]
test eax, eax
je 0xb2e542
push 4
mov ecx, 0x9fb9c0
pop esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xb2e4a8
test dx, dx
je 0xb2e4a1
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xb2e4a8
add eax, esi
add ecx, esi
test dx, dx
jne 0xb2e481
xor ebx, ebx
xor eax, eax
inc ebx
jmp 0xb2e4af
sbb eax, eax
xor ebx, ebx
inc ebx
or eax, ebx
test eax, eax
jne 0xb2e542
test edi, edi
je 0xb2e542
mov ecx, 0x9f98b0
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xb2e4ec
test dx, dx
je 0xb2e4e6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xb2e4ec
add eax, esi
add ecx, esi
test dx, dx
jne 0xb2e4c6
xor ecx, ecx
mov eax, ecx
jmp 0xb2e4f2
sbb eax, eax
or eax, ebx
xor ecx, ecx
test eax, eax
jne 0xb2e542
push esi
lea eax, [ebp - 0xb8c]
mov dword [ebp - 0xb8c], ecx
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
jne 0xb2e537
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb2e52e
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb2e554
mov ebx, 0x80004005
jmp 0xb2e554
test byte [ebp - 0xb8c], 0xf
mov eax, ebx
je 0xb2e548
mov eax, dword [ebp - 0xaf0]
mov dword [ebp - 0xce8], eax
mov ebx, dword [ebp - 0xb00]
test edi, edi
je 0xb2e569
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb54]
test eax, eax
je 0xb2e584
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xb2e592
xor ebx, ebx
mov dword [ebp - 0xce8], ebx
jmp 0xb2e594
xor ebx, ebx
push 4
pop eax
push eax
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0xb54], esi
test esi, esi
jne 0xb2e684
mov ebx, 0x8007000e
mov eax, dword [ebp - 0xb8c]
xor edx, edx
mov dword [ebp - 0xce4], eax
mov esi, 0xc96238
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xb2e5c8
mov eax, dword [0xc95890]
mov esi, dword [ebp - 0xb54]
test eax, eax
jle 0xb2e630
sub eax, 1
mov dword [0xc95890], eax
jne 0xb2e630
mov edi, edx
mov eax, dword [edi + 0xc960a0]
test eax, eax
je 0xb2e601
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0xb2e5f0
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xb54]
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
test esi, esi
je 0xb2e644
push esi
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov eax, dword [ebp - 0xcd8]
test ebx, ebx
jns 0xa8afa6
cmp ebx, 0xd0000034
jne 0xb37fd6
mov ebx, 0xc004f012
mov esi, ebx
xor ebx, ebx
inc ebx
test eax, eax
je 0xa8afc2
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
xor eax, eax
mov dword [ebp - 0xcd8], eax
jmp 0xa8afc2
mov eax, ebx
mov dword [ebp - 0xaf0], ebx
mov dword [ebp - 0xb14], eax
lea edi, [ebp - 0xe00]
mov dword [ebp - 0xdec], eax
xor eax, eax
stosd dword es:[edi], eax
mov dword [ebp - 0xb00], ebx
mov dword [ebp - 0xb50], ebx
mov dword [ebp - 0xb80], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb34], eax
mov dword [ebp - 0xbb0], 0x38
test eax, eax
je 0xb2e715
push 0x28
pop ecx
mov esi, 0xc94ea0
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, eax
mov dword [ebp - 0xaf0], edi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xb40], ecx
test ecx, ecx
jne 0xb2e72f
mov ebx, 0xc0000017
jmp 0xb2e724
mov ebx, 0xc0000017
jmp 0xb314b8
mov ebx, 0xc000003e
mov dword [ebp - 0xb44], ebx
jmp 0xb314c4
mov eax, dword [0xc94e98]
mov dword [ecx], eax
mov eax, dword [0xc94e9c]
mov dword [ecx + 4], eax
mov dword [ebp - 0xb00], ecx
rdtsc
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0xba8], edx
lea eax, [ebp - 0xbe8]
mov dword [ebp - 0xca8], ebx
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov esi, dword [ebp - 0xbe8]
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
jns 0xb2e788
mov esi, dword [ebp - 0xbec]
jmp 0xb314c4
lea eax, [ebp - 0xca8]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb44], ebx
jl 0xb314c4
lea eax, [ebp - 0xd0c]
mov edx, 0xa0
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb314c4
mov esi, dword [ebp - 0xd0c]
mov ecx, dword [ebp - 0xca8]
lea eax, [ebp - 0xca8]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb44], ebx
jl 0xb314c4
lea eax, [ebp - 0xbf0]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb314c4
mov esi, dword [ebp - 0xbf0]
mov ecx, dword [ebp - 0xca8]
lea eax, [ebp - 0xca8]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb44], ebx
jl 0xb314c4
lea eax, [ebp - 0xbf4]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb314c4
mov esi, dword [ebp - 0xbf4]
mov ecx, dword [ebp - 0xca8]
lea eax, [ebp - 0xca8]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb44], ebx
jl 0xb314c4
lea eax, [ebp - 0xbf8]
mov edx, SysReAllocString
push eax
mov ecx, 0x9f9120
call fcn.00a41606
test eax, eax
js 0xb2e71f
mov edx, dword [ebp - 0xbf8]
lea eax, [ebp - 0xbfc]
push eax
inc edx
push 4
pop eax
mov dword [ebp - 0xbf8], edx
mov ecx, eax
add edx, edx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb314c4
mov esi, dword [ebp - 0xbfc]
mov ecx, dword [ebp - 0xca8]
lea eax, [ebp - 0xca8]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb44], ebx
jl 0xb314c4
lea eax, [ebp - 0xc00]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb314c4
mov esi, dword [ebp - 0xc00]
mov ecx, dword [ebp - 0xca8]
lea eax, [ebp - 0xca8]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb44], ebx
jl 0xb314c4
lea eax, [ebp - 0xc04]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb314c4
mov esi, dword [ebp - 0xc04]
mov ecx, dword [ebp - 0xca8]
lea eax, [ebp - 0xca8]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb44], ebx
jl 0xb314c4
push dword [ebp - 0xca8]
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xae4], edi
test edi, edi
je 0xb2e715
mov dword [ebp - 0xb14], eax
mov dword [ebp - 0xdec], eax
xor eax, eax
mov esi, eax
mov dword [ebp - 0xae8], esi
mov dword [ebp - 0xc08], eax
mov dword [ebp - 0xc0c], edi
push 4
pop ecx
lea eax, [ebp - 0xdcc]
mov dword [ebp - 0xdd0], ecx
mov edx, ecx
mov ecx, edi
push eax
call fcn.00a32533
mov ebx, eax
xor edx, edx
mov dword [ebp - 0xb44], ebx
mov ecx, edx
test ebx, ebx
js 0xb314be
mov ecx, dword [ebp - 0xca8]
lea eax, [edi + 8]
add ecx, edi
cmp eax, ecx
ja 0xb2eaab
push 4
pop eax
mov dword [edi], eax
mov eax, dword [ebp - 0xdcc]
mov dword [eax], edx
xor eax, eax
lea esi, [eax + 1]
mov dword [ebp - 0xae8], esi
lea ecx, [eax + 1]
test ebx, ebx
js 0xb314be
mov dword [ebp - 0xab4], edx
mov eax, edi
mov dword [ebp - 0xc10], eax
test ecx, ecx
je 0xb2eafe
mov edx, dword [eax]
lea ecx, [ebp - 0xc14]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2eab5
mov eax, dword [ebp - 0xc14]
mov dword [ebp - 0xc18], eax
jmp 0xb2eabb
mov ebx, 0xc0000023
jmp 0xb314b8
mov eax, dword [ebp - 0xc18]
test ebx, ebx
js 0xb314be
lea ecx, [ebp - 0xc10]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xc10]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb314be
mov eax, dword [ebp - 0xab4]
inc eax
mov dword [ebp - 0xab4], eax
cmp eax, esi
mov eax, dword [ebp - 0xc10]
jb 0xb2ea7e
lea ecx, [ebp - 0xda4]
mov dword [ebp - 0xda8], 0xa0
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb314be
mov edx, dword [ebp - 0xc10]
mov ecx, dword [ebp - 0xca8]
add ecx, edi
lea eax, [edx + 0xa4]
cmp eax, ecx
ja 0xb2eaab
mov esi, dword [ebp - 0xb34]
mov edi, dword [ebp - 0xda4]
push 0x28
pop ecx
mov dword [edx], 0xa0
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xae8]
mov edi, dword [ebp - 0xae4]
inc esi
mov dword [ebp - 0xae8], esi
test ebx, ebx
js 0xb314be
xor ecx, ecx
mov eax, edi
mov dword [ebp - 0xc1c], eax
mov dword [ebp - 0xab4], ecx
test esi, esi
je 0xb2ec03
mov edx, dword [eax]
lea ecx, [ebp - 0xc20]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2ebba
mov eax, dword [ebp - 0xc20]
mov dword [ebp - 0xc24], eax
jmp 0xb2ebc0
mov eax, dword [ebp - 0xc24]
test ebx, ebx
js 0xb314be
lea ecx, [ebp - 0xc1c]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xc1c]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb314be
mov eax, dword [ebp - 0xab4]
inc eax
mov dword [ebp - 0xab4], eax
cmp eax, esi
mov eax, dword [ebp - 0xc1c]
jb 0xb2eb8d
lea ecx, [ebp - 0xdac]
mov dword [ebp - 0xdb0], 8
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb314be
mov edx, dword [ebp - 0xc1c]
mov ecx, dword [ebp - 0xca8]
add ecx, edi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xb2eaab
mov ecx, dword [ebp - 0xdac]
inc esi
mov dword [edx], 8
mov edx, dword [ebp - 0xb40]
mov dword [ebp - 0xae8], esi
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
test ebx, ebx
js 0xb314be
mov eax, dword [ebp - 0xbac]
xor ecx, ecx
mov dword [ebp - 0xdc8], eax
mov eax, dword [ebp - 0xba8]
mov dword [ebp - 0xdc4], eax
mov eax, edi
mov dword [ebp - 0xc28], eax
mov dword [ebp - 0xab4], ecx
test esi, esi
je 0xb2ed16
mov edx, dword [eax]
lea ecx, [ebp - 0xc2c]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2eccd
mov eax, dword [ebp - 0xc2c]
mov dword [ebp - 0xc30], eax
jmp 0xb2ecd3
mov eax, dword [ebp - 0xc30]
test ebx, ebx
js 0xb314be
lea ecx, [ebp - 0xc28]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xc28]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb314be
mov eax, dword [ebp - 0xab4]
inc eax
mov dword [ebp - 0xab4], eax
cmp eax, esi
mov eax, dword [ebp - 0xc28]
jb 0xb2eca0
lea ecx, [ebp - 0xde4]
mov dword [ebp - 0xde8], 8
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb314be
mov edx, dword [ebp - 0xc28]
mov ecx, dword [ebp - 0xca8]
add ecx, edi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xb2eaab
mov eax, dword [ebp - 0xde4]
inc esi
mov ecx, dword [ebp - 0xbac]
mov dword [edx], 8
mov dword [ebp - 0xae8], esi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xba8]
mov dword [eax + 4], ecx
test ebx, ebx
js 0xb314be
lea eax, [ebp - 0xc34]
mov edx, SysReAllocString
push eax
mov ecx, 0x9f9120
call fcn.00a41606
test eax, eax
jns 0xb2edac
mov ebx, 0xc000003e
jmp 0xb314b8
mov ecx, dword [ebp - 0xc34]
lea eax, [ebp - 0xc34]
xor edx, edx
push eax
inc edx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb314be
mov eax, dword [ebp - 0xc34]
add eax, eax
mov dword [ebp - 0xab4], eax
je 0xb2eee7
xor ecx, ecx
mov eax, edi
mov dword [ebp - 0xd78], eax
mov dword [ebp - 0xae4], ecx
test esi, esi
je 0xb2ee6f
mov edx, dword [eax]
lea ecx, [ebp - 0xd74]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2ee26
mov eax, dword [ebp - 0xd74]
mov dword [ebp - 0xd70], eax
jmp 0xb2ee2c
mov eax, dword [ebp - 0xd70]
test ebx, ebx
js 0xb314be
lea ecx, [ebp - 0xd78]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xd78]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb314be
mov eax, dword [ebp - 0xae4]
inc eax
mov dword [ebp - 0xae4], eax
cmp eax, esi
mov eax, dword [ebp - 0xd78]
jb 0xb2edf9
mov ecx, dword [ebp - 0xab4]
mov dword [ebp - 0xdd8], ecx
lea ecx, [ebp - 0xdd4]
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb314be
mov eax, dword [ebp - 0xab4]
mov ecx, dword [ebp - 0xca8]
add eax, 4
mov edx, dword [ebp - 0xd78]
add ecx, edi
add eax, edx
cmp eax, ecx
jbe 0xb2eec2
mov ebx, 0xc0000023
jmp 0xb2eeec
mov eax, dword [ebp - 0xab4]
push eax
push 0x9f9120
push dword [ebp - 0xdd4]
mov dword [edx], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
inc esi
mov dword [ebp - 0xae8], esi
jmp 0xb2eef2
mov ebx, 0xc000000d
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb314be
mov eax, dword [ebp - 0xce8]
xor ecx, ecx
mov dword [ebp - 0xd6c], eax
mov eax, edi
mov dword [ebp - 0xd68], eax
mov dword [ebp - 0xab4], ecx
test esi, esi
je 0xb2ef90
mov edx, dword [eax]
lea ecx, [ebp - 0xd64]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2ef47
mov eax, dword [ebp - 0xd64]
mov dword [ebp - 0xd60], eax
jmp 0xb2ef4d
mov eax, dword [ebp - 0xd60]
test ebx, ebx
js 0xb314be
lea ecx, [ebp - 0xd68]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xd68]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb314be
mov eax, dword [ebp - 0xab4]
inc eax
mov dword [ebp - 0xab4], eax
cmp eax, esi
mov eax, dword [ebp - 0xd68]
jb 0xb2ef1a
push 4
pop edx
lea ecx, [ebp - 0xd94]
mov dword [ebp - 0xd98], edx
push ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb314be
mov edx, dword [ebp - 0xd68]
mov ecx, dword [ebp - 0xca8]
add ecx, edi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xb2eaab
mov ecx, dword [ebp - 0xce8]
inc esi
push 4
pop eax
mov dword [edx], eax
mov eax, dword [ebp - 0xd94]
mov dword [ebp - 0xae8], esi
mov dword [eax], ecx
test ebx, ebx
js 0xb314be
push 4
xor ecx, ecx
mov eax, edi
mov dword [ebp - 0xd58], eax
mov dword [ebp - 0xab4], ecx
pop ebx
mov dword [ebp - 0xd5c], ebx
test esi, esi
je 0xb2f081
mov edx, dword [eax]
lea ecx, [ebp - 0xd54]
push ecx
mov ecx, ebx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2f039
mov eax, dword [ebp - 0xd54]
mov dword [ebp - 0xd50], eax
jmp 0xb2f03f
mov eax, dword [ebp - 0xd50]
test ebx, ebx
js 0xb2f0d2
lea ecx, [ebp - 0xd58]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xd58]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
push 4
test ebx, ebx
js 0xb2f0d4
mov eax, dword [ebp - 0xab4]
inc eax
mov dword [ebp - 0xab4], eax
cmp eax, esi
mov eax, dword [ebp - 0xd58]
pop ebx
jb 0xb2f00f
lea ecx, [ebp - 0xd9c]
mov dword [ebp - 0xda0], ebx
push ecx
mov edx, ebx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2f0d2
mov edx, dword [ebp - 0xd58]
mov ecx, dword [ebp - 0xca8]
add ecx, edi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xb2eaab
mov eax, dword [ebp - 0xd9c]
inc esi
push 4
pop ecx
mov dword [edx], ecx
mov dword [eax], ecx
mov dword [ebp - 0xae8], esi
jmp 0xb2f0d5
push 4
pop ecx
test ebx, ebx
js 0xb314be
lea eax, [ebp - 0xd4c]
mov edx, ecx
push eax
call fcn.00a32533
mov esi, dword [ebp - 0xd4c]
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
jns 0xb2f108
mov esi, dword [ebp - 0xd48]
jmp 0xb2f286
lea eax, [ebp - 0xd40]
mov dword [ebp - 0xd44], esi
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2f286
mov esi, dword [ebp - 0xd40]
mov ecx, dword [ebp - 0xd44]
lea eax, [ebp - 0xd44]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2f286
lea eax, [ebp - 0xd3c]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2f286
mov esi, dword [ebp - 0xd3c]
mov ecx, dword [ebp - 0xd44]
lea eax, [ebp - 0xd44]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2f286
lea eax, [ebp - 0xd38]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2f286
mov esi, dword [ebp - 0xd38]
mov ecx, dword [ebp - 0xd44]
lea eax, [ebp - 0xd44]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2f286
lea eax, [ebp - 0xd34]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2f286
mov esi, dword [ebp - 0xd34]
mov ecx, dword [ebp - 0xd44]
lea eax, [ebp - 0xd44]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2f286
lea eax, [ebp - 0xbd0]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2f286
mov esi, dword [ebp - 0xbd0]
mov ecx, dword [ebp - 0xd44]
lea eax, [ebp - 0xd44]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0xd44]
mov dword [ebp - 0xb44], ebx
test ebx, ebx
jns 0xb2f28c
mov eax, dword [ebp - 0xbd0]
mov dword [ebp - 0xab4], eax
test ebx, ebx
js 0xb314be
xor ecx, ecx
rdtsc
mov esi, ecx
mov dword [ebp - 0xae4], ecx
mov dword [ebp - 0xb34], esi
mov dword [ebp - 0xb40], ecx
mov dword [ebp - 0xaec], ecx
mov dword [ebp - 0xad0], ecx
mov dword [ebp - 0xad4], ecx
mov dword [ebp - 0xabc], ecx
mov dword [ebp - 0xacc], ecx
mov dword [ebp - 0xadc], ecx
mov dword [ebp - 0xb3c], ecx
mov dword [ebp - 0xb44], eax
mov dword [ebp - 0xad8], edx
push 8
pop ecx
mov dword [ebp - 0xd2c], ecx
mov edx, dword [ebp - 0xca8]
lea eax, [ebp - 0xd2c]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb2f401
mov eax, dword [ebp - 0xd2c]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0xac4], ecx
cmp ecx, eax
jae 0xb2f32d
mov ebx, 0xc0000095
jmp 0xb2f401
mov dword [ebp - 0xd2c], ecx
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xb2f353
mov ebx, 0xc0000017
jmp 0xb2f3fb
mov eax, dword [ebp - 0xae8]
mov ecx, esi
mov dword [esi], eax
lea eax, [ebp - 0xd28]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xd28], esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb2f3e6
mov ecx, dword [ebp - 0xd28]
mov eax, dword [ebp - 0xca8]
mov dword [ecx], eax
lea eax, [ebp - 0xd28]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb2f3e6
mov eax, dword [ebp - 0xac4]
push dword [ebp - 0xca8]
mov ecx, dword [ebp - 0xb44]
push edi
push dword [ebp - 0xd28]
mov dword [esi + eax - 8], ecx
mov ecx, dword [ebp - 0xad8]
mov dword [esi + eax - 4], ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xac4]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xae4], esi
mov esi, ecx
mov dword [ebp - 0xb34], eax
jmp 0xb2f3e8
xor ecx, ecx
test esi, esi
je 0xb2f3fb
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xb34]
or ebx, 0x10000000
mov dword [ebp - 0xb44], ebx
jl 0xb30dd6
xor eax, eax
mov dword [ebp - 0xac4], eax
cmp dword [ebp - 0xae4], eax
jne 0xb2f42d
mov ebx, 0xc000000d
jmp 0xb2fa64
test esi, esi
je 0xb2fa5f
lea ebx, [esi + 8]
push ebx
push eax
mov dword [ebp - 0xad8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xb44], edi
test edi, edi
je 0xb2fa5f
xor eax, eax
mov cl, al
mov edx, eax
test esi, esi
je 0xb2f475
mov eax, dword [ebp - 0xae4]
xor cl, byte [edx + eax]
inc edx
cmp edx, esi
jb 0xb2f46d
mov eax, 0xb1b54a58
mov dword [ebp - 0x378], eax
mov eax, 0xc81ecb17
mov dword [ebp - 0x374], eax
mov eax, esi
shr eax, 3
mov dword [ebp - 0xac8], eax
test eax, eax
je 0xb2f88c
movzx edx, word [ebp - 0x376]
mov eax, 0xc81ecb17
movzx esi, ax
add edi, 7
movzx eax, word [ebp - 0x372]
mov dword [ebp - 0xac0], eax
mov eax, 0xb1b54a58
movzx eax, ax
mov dword [ebp - 0xab8], esi
mov esi, dword [ebp - 0xae4]
mov dword [ebp - 0xaf4], eax
add esi, 2
xor eax, eax
mov dword [ebp - 0xb04], edx
mov dword [ebp - 0xb10], edi
mov edx, eax
mov dword [ebp - 0xb0c], esi
or ebx, 0xffffffff
mov dword [ebp - 0xafc], eax
mov dword [ebp - 0xae0], eax
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xb0c]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xb0c]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xb0c]
shl esi, 8
add dword [ebp - 0xb0c], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov eax, ebx
sub eax, dword [ebp - 0xaf4]
xor eax, edi
xor eax, edx
xor eax, 0xc81ecb17
mov edx, eax
mov dword [ebp - 0xaf8], eax
xor edx, 0xc81ecb17
ror eax, 7
ror edx, 0xf
imul edx, dword [ebp - 0xb04]
add edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
mov eax, ebx
ror eax, 0xa
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [ebp - 0xab8]
sub edx, eax
mov eax, dword [ebp - 0xaf8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xaf8], eax
xor edx, dword [ebp - 0xab8]
rol edx, 4
imul edx, dword [ebp - 0xac0]
rol eax, 5
add edx, eax
mov eax, 0xc81ecb17
xor ebx, edx
mov edx, 0xb1b54a58
xor edx, ebx
sub eax, edx
mov edx, dword [ebp - 0xaf8]
xor edx, eax
mov dword [ebp - 0xaf8], edx
sub edx, dword [ebp - 0xaf4]
imul edx, dword [ebp - 0xb04]
mov eax, dword [ebp - 0xaf8]
shr eax, 6
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xaf8]
mov eax, ebx
ror eax, 0xf
xor eax, dword [ebp - 0xab8]
imul eax, dword [ebp - 0xaf4]
xor edx, eax
mov eax, edx
not eax
ror eax, 3
add eax, dword [ebp - 0xac0]
imul eax, dword [ebp - 0xab8]
xor ebx, eax
mov eax, ebx
sub eax, 0xc81ecb17
sub eax, dword [ebp - 0xaf4]
xor edx, eax
mov dword [ebp - 0xaf8], edx
mov eax, dword [ebp - 0xaf8]
xor eax, dword [ebp - 0xac0]
imul eax, dword [ebp - 0xb04]
ror edx, 0xa
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xaf4]
rol edx, 6
imul edx, dword [ebp - 0xab8]
ror eax, 3
xor edx, eax
mov eax, dword [ebp - 0xaf8]
xor eax, edx
mov dword [ebp - 0xaf8], eax
ror eax, 0xf
sub eax, dword [ebp - 0xac0]
imul eax, dword [ebp - 0xaf4]
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xac0]
imul edx, dword [ebp - 0xaf4]
shr eax, 1
xor edx, eax
mov eax, ebx
xor dword [ebp - 0xaf8], edx
mov edx, ebx
sub edx, dword [ebp - 0xab8]
rol edx, 3
imul edx, dword [ebp - 0xaf4]
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0xaf8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xaf8], eax
sub edx, dword [ebp - 0xab8]
imul edx, dword [ebp - 0xb04]
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 9
imul edx, dword [ebp - 0xab8]
ror eax, 0xb
xor edx, eax
mov eax, dword [ebp - 0xaf8]
xor eax, edx
mov dword [ebp - 0xaf8], eax
sub eax, 0xb1b54a58
sub eax, dword [ebp - 0xac0]
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0xb04]
imul eax, dword [ebp - 0xaf4]
ror edx, 7
sub eax, edx
mov edx, dword [ebp - 0xaf8]
xor edx, eax
mov dword [ebp - 0xaf8], edx
xor edx, dword [ebp - 0xac0]
mov eax, dword [ebp - 0xaf8]
rol edx, 4
imul edx, dword [ebp - 0xb04]
ror eax, 0x10
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 0xa
imul edx, dword [ebp - 0xab8]
ror eax, 4
add edx, eax
mov eax, dword [ebp - 0xaf8]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xaf8], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, dword [ebp - 0xac0]
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, 0xc81ecb17
rol eax, 2
rol edx, 8
imul edx, dword [ebp - 0xaf4]
sub edx, eax
mov eax, dword [ebp - 0xaf8]
xor eax, edx
mov edx, 0xc81ecb17
sub edx, eax
mov dword [ebp - 0xaf8], eax
ror edx, 0xb
imul edx, dword [ebp - 0xb04]
ror eax, 0xc
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xb04]
imul edx, dword [ebp - 0xab8]
shr eax, 8
xor edx, eax
mov eax, 0xb1b54a58
xor dword [ebp - 0xaf8], edx
xor eax, ebx
mov edx, dword [ebp - 0xaf8]
mov ebx, 0xc81ecb17
xor eax, edx
xor edx, dword [ebp - 0xafc]
xor ebx, eax
mov dword [ebp - 0xafc], edi
mov eax, dword [ebp - 0xb10]
xor ebx, dword [ebp - 0xae0]
mov dword [ebp - 0xae0], esi
mov esi, dword [ebp - 0xb0c]
mov byte [eax - 4], dl
mov byte [eax], bl
ror edx, 8
mov byte [eax - 5], dl
ror ebx, 8
mov byte [eax - 1], bl
ror edx, 8
mov byte [eax - 6], dl
ror ebx, 8
mov byte [eax - 2], bl
ror edx, 8
ror ebx, 8
mov byte [eax - 7], dl
mov byte [eax - 3], bl
add eax, 8
ror edx, 8
ror ebx, 8
sub dword [ebp - 0xac8], 1
mov dword [ebp - 0xb10], eax
jne 0xb2f4ff
mov esi, dword [ebp - 0xb34]
mov edi, dword [ebp - 0xb44]
mov ebx, dword [ebp - 0xad8]
movzx eax, cl
cdq
mov dword [edi + esi], eax
mov dword [edi + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xaf8], esi
test esi, esi
jne 0xb2f8be
mov ebx, 0xc0000017
jmp 0xb2f9c8
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb2f93c
mov dword [esi + 4], eax
push ebx
push edi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [esi + 8], eax
push eax
push 8
pop ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb2f93c
mov dword [esi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0xc94df0
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xaf8]
push ebx
push ebx
mov dword [esi + 0x10], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, dword [ebp - 0xb44]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0xb2f945
mov ebx, 0xc0000017
jmp 0xb2f961
mov ebx, 0xc0000017
xor edx, edx
jmp 0xb2f961
mov dword [esi + 0x14], ecx
mov ebx, edx
mov eax, dword [0xc94e90]
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [ebp - 0xac4], esi
mov esi, edx
mov dword [ecx + 4], eax
test esi, esi
je 0xb2f9c8
cmp dword [esi + 4], 0
je 0xb2f981
push dword [esi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 4], edx
cmp dword [esi + 0xc], 0
je 0xb2f99d
push dword [esi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0xc], edx
cmp dword [esi + 0x14], 0
je 0xb2f9b9
push dword [esi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0x14], edx
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb2f9de
mov eax, dword [ebp - 0xac4]
mov dword [ebp - 0xb40], eax
xor eax, eax
mov esi, eax
jmp 0xb2f9e6
mov esi, dword [ebp - 0xac4]
xor eax, eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
je 0xb2fa64
xor eax, eax
cmp dword [esi + 4], eax
je 0xb2fa16
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xb2fa32
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xb2fa4e
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb2fa64
mov ebx, 0xc0000001
or ebx, 0x10000000
mov dword [ebp - 0xb44], ebx
jl 0xb30dd6
mov esi, dword [ebp - 0xb40]
lea eax, [ebp - 0xc74]
push 4
pop edi
push eax
mov edx, dword [esi]
mov ecx, edi
mov dword [ebp - 0xc74], edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb2fb0b
mov ecx, dword [ebp - 0xc74]
lea eax, [ebp - 0xc74]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb2fb0b
mov edx, dword [esi + 8]
lea eax, [ebp - 0xc74]
mov ecx, dword [ebp - 0xc74]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb2fb0b
mov ecx, dword [ebp - 0xc74]
lea eax, [ebp - 0xc74]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb2fb0b
mov edx, dword [esi + 0x10]
lea eax, [ebp - 0xc74]
mov ecx, dword [ebp - 0xc74]
push eax
call fcn.00a32533
mov edi, dword [ebp - 0xc74]
mov ebx, eax
test ebx, ebx
jns 0xb2fb19
mov edi, dword [ebp - 0xd24]
test ebx, ebx
js 0xb2fc82
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xb2fb39
mov ebx, 0xc0000017
jmp 0xb2fc82
mov eax, dword [ebp - 0xb40]
mov ecx, esi
mov dword [ebp - 0xd20], esi
mov eax, dword [eax]
mov dword [esi], eax
lea eax, [ebp - 0xd20]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb2fc6d
mov ebx, dword [ebp - 0xb40]
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0xd20]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx]
lea eax, [ebp - 0xd20]
mov ecx, dword [ebp - 0xd20]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb2fc6d
mov eax, dword [ebp - 0xb40]
mov ecx, dword [ebp - 0xd20]
mov eax, dword [eax + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xd20]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb2fc6d
mov ebx, dword [ebp - 0xb40]
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0xd20]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xd20]
mov ecx, dword [ebp - 0xd20]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb2fc6d
mov eax, dword [ebp - 0xb40]
mov ecx, dword [ebp - 0xd20]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xd20]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb2fc6d
mov ebx, dword [ebp - 0xb40]
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0xd20]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xd20]
mov ecx, dword [ebp - 0xd20]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
xor eax, eax
test ebx, ebx
js 0xb2fc6f
mov dword [ebp - 0xaec], esi
mov esi, eax
mov dword [ebp - 0xad0], edi
jmp 0xb2fc6f
xor eax, eax
test esi, esi
je 0xb2fc82
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or ebx, 0x10000000
mov dword [ebp - 0xb44], ebx
jl 0xb30dd6
xor eax, eax
mov dword [ebp - 0xd1c], 8
mov dword [ebp - 0xaf8], eax
mov dword [ebp - 0xae0], eax
mov edx, dword [ebp - 0xab4]
lea eax, [ebp - 0xd1c]
push eax
push 8
pop ecx
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb44], ebx
jl 0xb2fe8e
mov eax, dword [ebp - 0xd1c]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xb2fcf2
mov ebx, 0xc0000095
mov dword [ebp - 0xb44], ebx
jmp 0xb2fd19
mov dword [ebp - 0xd14], ecx
lea eax, [ebp - 0xd14]
push eax
push 8
pop edx
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0xd14]
mov dword [ebp - 0xb44], ebx
test ebx, ebx
jns 0xb2fd1f
mov eax, dword [ebp - 0xd18]
mov dword [ebp - 0xafc], eax
test ebx, ebx
js 0xb2fe8e
mov eax, dword [ebp - 0xb14]
test eax, eax
je 0xb2fe83
mov esi, dword [ebp - 0xae8]
cmp esi, 1
jbe 0xb2fe83
mov ecx, eax
xor eax, eax
mov dword [ebp - 0xd10], ecx
mov edi, eax
mov eax, dword [ecx]
mov dword [ebp - 0xb0c], eax
lea eax, [ebp - 0xd10]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2fe8e
mov edx, dword [ebp - 0xb0c]
lea eax, [ebp - 0xd10]
mov ecx, dword [ebp - 0xd10]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2fe8e
mov ecx, dword [ebp - 0xd10]
inc edi
cmp edi, 1
jb 0xb2fd56
mov edi, dword [ecx]
lea eax, [ebp - 0xd10]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2fe8e
mov dword [ebp - 0xaf8], edi
neg edi
sbb edi, edi
and dword [ebp - 0xd10], edi
test ebx, ebx
js 0xb2fe8e
cmp esi, 2
jbe 0xb2fe83
mov ecx, dword [ebp - 0xb14]
xor eax, eax
mov dword [ebp - 0xd08], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xd08]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2fec4
mov ecx, dword [ebp - 0xd08]
lea eax, [ebp - 0xd08]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2fec4
mov ecx, dword [ebp - 0xd08]
inc esi
cmp esi, 2
jb 0xb2fe07
mov esi, dword [ecx]
lea eax, [ebp - 0xd08]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2fec4
mov edi, esi
neg esi
sbb esi, esi
and dword [ebp - 0xd08], esi
jmp 0xb2feca
mov ebx, 0xc000000d
mov dword [ebp - 0xb44], ebx
mov esi, dword [ebp - 0xabc]
test ebx, ebx
js 0xb30dd6
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xb2ffb1
mov ecx, dword [ebp - 0xad4]
mov ebx, 0xd0000017
jmp 0xb2ffbe
mov edi, dword [ebp - 0xae0]
test ebx, ebx
js 0xb2fe8e
mov edx, dword [ebp - 0xafc]
lea eax, [ebp - 0xd04]
push 4
pop esi
push eax
mov ecx, esi
mov dword [ebp - 0xd04], esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2ff85
mov ecx, dword [ebp - 0xd04]
lea eax, [ebp - 0xd04]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2ff85
mov edx, dword [ebp - 0xaf8]
lea eax, [ebp - 0xd04]
mov ecx, dword [ebp - 0xd04]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2ff85
mov ecx, dword [ebp - 0xd04]
lea eax, [ebp - 0xd04]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb2ff85
mov ecx, dword [ebp - 0xd04]
lea eax, [ebp - 0xd04]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0xd04]
mov dword [ebp - 0xb44], ebx
test ebx, ebx
jns 0xb2ff93
mov eax, dword [ebp - 0xd00]
test ebx, ebx
js 0xb2fe8e
cmp eax, 0x400000
jbe 0xb2ffa4
mov ebx, 0x8000ffff
jmp 0xb30dd0
mov esi, eax
mov dword [ebp - 0xabc], esi
jmp 0xb2fe94
mov ecx, eax
mov dword [ebp - 0xad4], eax
mov ebx, 0x10000000
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb30dd6
mov eax, dword [ebp - 0xaec]
test eax, eax
je 0xb3003d
test ecx, ecx
je 0xb3003d
mov dword [ebp - 0xe78], eax
xor ebx, ebx
mov eax, dword [ebp - 0xad0]
mov dword [ebp - 0xe70], eax
lea eax, [ebp - 0xd30]
push eax
push 0x9f29b8
push 1
mov dword [ebp - 0xe74], ecx
mov dword [ebp - 0xe6c], esi
mov dword [ebp - 0xe68], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xb3006d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
jle 0xb3005e
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xb44], ebx
test ebx, ebx
jmp 0xb3005e
mov ebx, 0x80070057
jmp 0xb30dd0
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xb44], ebx
test ebx, ebx
mov esi, dword [ebp - 0xabc]
js 0xb300d5
mov ebx, 0x80004005
mov dword [ebp - 0xb44], ebx
jmp 0xb300d5
push 0x9fc030
push dword [ebp - 0xd30]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0xb30098
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
jle 0xb30058
jmp 0xb30047
push ebx
push 0x14
lea eax, [ebp - 0xe78]
mov ecx, esi
push eax
push 0x86
call dword [0xc99200]
call esi
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb44], ebx
jl 0xb300cf
mov esi, dword [ebp - 0xe6c]
mov dword [ebp - 0xabc], esi
jmp 0xb300d5
mov esi, dword [ebp - 0xabc]
cmp ebx, 0xd0000023
jne 0xb300e7
mov ebx, 0x8007007a
jmp 0xb30dd0
test ebx, ebx
js 0xb30dd6
mov eax, dword [ebp - 0xad4]
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0xcf8], ecx
mov edi, ecx
mov dword [ebp - 0xcf4], eax
cmp esi, edx
jae 0xb30116
mov ebx, 0xc000003e
jmp 0xb304f2
mov esi, dword [eax]
lea ecx, [ebp - 0xcf4]
push ecx
mov ecx, eax
mov dword [ebp - 0xaf8], esi
call fcn.00a32533
mov ebx, eax
xor ecx, ecx
test ebx, ebx
js 0xb304f2
lea eax, [ebp - 0xcf8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb304f0
mov eax, dword [ebp - 0xabc]
sub eax, dword [ebp - 0xcf8]
cmp eax, esi
jb 0xb30338
mov eax, dword [ebp - 0xcf4]
lea ecx, [ebp - 0xcf4]
push ecx
mov edx, esi
mov dword [ebp - 0xae0], eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb304f0
mov ecx, dword [ebp - 0xcf8]
lea eax, [ebp - 0xcf8]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb304f0
mov eax, dword [ebp - 0xabc]
sub eax, dword [ebp - 0xcf8]
push 4
pop edx
cmp eax, edx
jb 0xb30338
mov ecx, dword [ebp - 0xcf4]
lea eax, [ebp - 0xcf4]
push eax
mov esi, dword [ecx]
mov dword [ebp - 0xafc], esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb304f0
mov ecx, dword [ebp - 0xcf8]
lea eax, [ebp - 0xcf8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb304f0
mov eax, dword [ebp - 0xabc]
sub eax, dword [ebp - 0xcf8]
cmp eax, esi
jb 0xb30338
mov eax, dword [ebp - 0xcf4]
lea ecx, [ebp - 0xcf4]
push ecx
mov edx, esi
mov dword [ebp - 0xb0c], eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb304f0
mov ecx, dword [ebp - 0xcf8]
lea eax, [ebp - 0xcf8]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb304f0
mov eax, dword [ebp - 0xabc]
sub eax, dword [ebp - 0xcf8]
push 4
pop edx
cmp eax, edx
jb 0xb30338
mov ecx, dword [ebp - 0xcf4]
mov eax, dword [ecx]
mov dword [ebp - 0xb10], eax
lea eax, [ebp - 0xcf4]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb304f0
mov ecx, dword [ebp - 0xcf8]
lea eax, [ebp - 0xcf8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb304f0
mov eax, dword [ebp - 0xabc]
sub eax, dword [ebp - 0xcf8]
mov ecx, dword [ebp - 0xb10]
cmp eax, ecx
jb 0xb30338
lea eax, [ebp - 0xcf8]
mov edx, ecx
mov ecx, dword [ebp - 0xcf8]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb304f0
mov edx, dword [ebp - 0xabc]
mov eax, edx
sub eax, dword [ebp - 0xcf8]
jne 0xb30338
mov ebx, dword [ebp - 0xaf8]
mov ecx, dword [ebp - 0xb10]
add ecx, 0xc
lea eax, [esi + ebx]
add eax, ecx
cmp eax, edx
jne 0xb30338
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xb30342
mov ebx, 0xc0000017
jmp 0xb3047b
mov ebx, 0xc000003e
jmp 0xb304f0
cmp dword [ebp - 0xae0], edi
je 0xb30383
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb30377
mov dword [esi + 4], eax
push ebx
push dword [ebp - 0xae0]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb3038a
mov ebx, 0xc0000017
xor eax, eax
jmp 0xb30414
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
cmp dword [ebp - 0xb0c], edi
je 0xb303c6
mov ebx, dword [ebp - 0xafc]
push ebx
push 8
mov dword [esi + 8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb30377
mov dword [esi + 0xc], eax
push ebx
push dword [ebp - 0xb0c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb303cc
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
cmp dword [ebp - 0xcf4], edi
je 0xb30408
mov ebx, dword [ebp - 0xb10]
push ebx
push 8
mov dword [esi + 0x10], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb30377
mov dword [esi + 0x14], eax
push ebx
push dword [ebp - 0xcf4]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb3040e
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov edi, esi
mov ebx, eax
mov esi, eax
test esi, esi
je 0xb3047b
cmp dword [esi + 4], 0
je 0xb30434
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xb30450
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xb3046c
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test ebx, ebx
js 0xb30489
mov dword [ebp - 0xacc], edi
mov edi, ecx
test edi, edi
je 0xb304f2
cmp dword [edi + 4], 0
je 0xb304a9
push dword [edi + 4]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 4], ecx
cmp dword [edi + 0xc], 0
je 0xb304c5
push dword [edi + 0xc]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0xc], ecx
cmp dword [edi + 0x14], 0
je 0xb304e1
push dword [edi + 0x14]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0x14], ecx
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov edi, dword [ebp - 0xacc]
or ebx, 0x10000000
mov dword [ebp - 0xb44], ebx
jl 0xb30ddc
mov dword [ebp - 0xae0], ecx
mov esi, ecx
mov dword [ebp - 0xaf8], esi
test edi, edi
je 0xb30539
mov ebx, dword [edi + 4]
mov dword [ebp - 0xafc], ebx
test ebx, ebx
je 0xb30539
mov edi, dword [edi]
test edi, edi
jne 0xb30549
mov ebx, 0xd000000d
jmp 0xb30dd0
mov ebx, 0xd000000d
mov dword [ebp - 0xb44], ebx
jmp 0xb30ddc
add edi, 0xfffffff8
mov dword [ebp - 0xb0c], ecx
push edi
push ecx
mov dword [ebp - 0xb10], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xab8], eax
test eax, eax
je 0xb30b3f
mov esi, 0xab69605e
mov dword [ebp - 0xb04], ebx
mov dword [ebp - 0x360], esi
xor ecx, ecx
mov esi, 0x7f1137f
mov dword [ebp - 0xaf4], eax
mov dword [ebp - 0x35c], esi
mov dl, cl
mov esi, edi
mov dword [ebp - 0xac4], ecx
and esi, 7
je 0xb306ce
mov dword [ebp - 0xac0], ecx
mov eax, ecx
mov dword [ebp - 0xac8], eax
test esi, esi
je 0xb30615
mov edi, dword [ebp - 0xb04]
push 0x38
pop ebx
movzx eax, byte [edi]
inc edi
cmp ecx, 4
jge 0xb305dd
lea ecx, [ebx - 0x20]
shl eax, cl
or dword [ebp - 0xac8], eax
jmp 0xb305e7
mov ecx, ebx
shl eax, cl
or dword [ebp - 0xac0], eax
mov ecx, dword [ebp - 0xac4]
sub ebx, 8
inc ecx
mov dword [ebp - 0xac4], ecx
cmp ecx, esi
jl 0xb305c7
mov eax, edi
mov dword [ebp - 0xb04], edi
mov edi, dword [ebp - 0xb10]
mov dword [ebp - 0xb04], eax
mov eax, dword [ebp - 0xac8]
mov ebx, dword [ebp - 0xac0]
xor eax, 0x92f65a5
xor ebx, 0x699a899c
mov dword [ebp - 0xac4], eax
xor ecx, ecx
mov dword [ebp - 0xad8], ebx
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xad0], ebx
test esi, esi
je 0xb3069d
mov edi, dword [ebp - 0xaf4]
push 4
pop ebx
lea eax, [edi + 1]
mov dword [ebp - 0xaf4], eax
cmp ecx, ebx
jge 0xb30669
rol dword [ebp - 0xabc], 8
mov eax, dword [ebp - 0xabc]
jmp 0xb30676
rol dword [ebp - 0xad0], 8
mov eax, dword [ebp - 0xad0]
mov byte [edi], al
inc ecx
mov eax, dword [ebp - 0xaf4]
mov edi, eax
cmp ecx, esi
jl 0xb3064d
mov ebx, dword [ebp - 0xad8]
mov edi, dword [ebp - 0xb10]
mov dword [ebp - 0xaf4], eax
mov eax, dword [ebp - 0xac4]
push 4
pop ecx
cmp esi, ecx
jbe 0xb306b2
push 8
pop ecx
sub ecx, esi
shl ecx, 3
shr ebx, cl
shl ebx, cl
jmp 0xb306dd
xor ecx, ecx
push 4
mov ebx, ecx
pop ecx
cmp esi, ecx
jae 0xb306dd
sub ecx, esi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xac4], eax
jmp 0xb306dd
or dword [ebp - 0xac0], 0xffffffff
mov ebx, ecx
mov dword [ebp - 0xac8], ecx
mov eax, edi
shr eax, 3
mov dword [ebp - 0xad8], eax
test eax, eax
je 0xb30ac7
movzx ecx, word [ebp - 0x35a]
mov eax, 0x7f1137f
movzx esi, word [ebp - 0x35e]
mov edi, 0xab69605e
movzx eax, ax
xor edi, 0x7f1137f
mov dword [ebp - 0xab4], ecx
mov ecx, 0xab69605e
mov dword [ebp - 0xad0], eax
movzx eax, cx
mov ecx, dword [ebp - 0xb04]
mov dword [ebp - 0xb34], eax
mov eax, dword [ebp - 0xaf4]
add eax, 7
mov dword [ebp - 0xabc], edi
add ecx, 2
mov dword [ebp - 0xae8], esi
mov dword [ebp - 0xaf4], eax
mov dword [ebp - 0xb04], ecx
movzx edi, byte [ecx - 2]
movzx eax, byte [ecx - 1]
movzx esi, byte [ecx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [ecx]
shl edi, 8
or edi, eax
add dword [ebp - 0xb04], 8
movzx eax, byte [ecx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 3]
or esi, eax
movzx eax, byte [ecx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 5]
mov ecx, dword [ebp - 0xac4]
xor ecx, edi
shl esi, 8
mov dword [ebp - 0xac4], ecx
or esi, eax
xor ebx, esi
mov eax, 0x7f1137f
xor ebx, 0xab69605e
xor ebx, ecx
xor ebx, eax
mov ecx, ebx
mov eax, ebx
sub ecx, 0xab69605e
rol eax, 0xa
rol ecx, 5
imul ecx, dword [ebp - 0xad0]
add ecx, eax
mov eax, dword [ebp - 0xac4]
xor eax, ecx
mov ecx, 0x7f1137f
add ecx, eax
mov dword [ebp - 0xac4], eax
ror ecx, 9
imul ecx, dword [ebp - 0xae8]
rol eax, 2
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
sub ecx, dword [ebp - 0xad0]
imul ecx, dword [ebp - 0xb34]
shr eax, 0xd
sub ecx, eax
mov eax, dword [ebp - 0xac4]
xor eax, ecx
mov ecx, dword [ebp - 0xae8]
xor ecx, eax
mov dword [ebp - 0xac4], eax
rol ecx, 6
imul ecx, dword [ebp - 0xab4]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, 0xab69605e
xor ecx, ebx
sub eax, ecx
mov ecx, dword [ebp - 0xac4]
xor ecx, eax
mov eax, dword [ebp - 0xad0]
mov dword [ebp - 0xac4], ecx
xor eax, dword [ebp - 0xac4]
imul eax, dword [ebp - 0xae8]
ror ecx, 6
xor ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
lea ecx, [ecx + ebx]
ror ecx, 0xf
imul ecx, dword [ebp - 0xb34]
rol eax, 2
add ecx, eax
mov eax, dword [ebp - 0xac4]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xac4], eax
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0xab4]
sub ecx, eax
xor ebx, ecx
mov ecx, 0xab69605e
xor ecx, ebx
mov eax, ebx
ror ecx, 0xc
imul ecx, dword [ebp - 0xad0]
ror eax, 0xa
xor ecx, eax
mov eax, dword [ebp - 0xac4]
xor eax, ecx
mov ecx, dword [ebp - 0xab4]
xor ecx, eax
mov dword [ebp - 0xac4], eax
imul ecx, dword [ebp - 0xae8]
shr eax, 0xa
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xac4]
mov eax, ebx
not eax
ror eax, 5
add eax, dword [ebp - 0xb34]
imul eax, dword [ebp - 0xab4]
xor ecx, eax
mov dword [ebp - 0xac4], ecx
mov eax, ecx
mov ecx, dword [ebp - 0xab4]
sub eax, ecx
xor eax, 0xab69605e
xor ebx, eax
xor ecx, ebx
mov eax, ebx
rol ecx, 2
imul ecx, dword [ebp - 0xad0]
shr eax, 2
add ecx, eax
mov eax, dword [ebp - 0xac4]
xor eax, ecx
mov dword [ebp - 0xac4], eax
lea ecx, [eax - 0x7f1137f]
rol eax, 7
ror ecx, 6
imul ecx, dword [ebp - 0xae8]
add ecx, eax
xor ebx, ecx
mov eax, ebx
mov ecx, ebx
xor eax, dword [ebp - 0xad0]
imul eax, dword [ebp - 0xb34]
ror ecx, 9
add ecx, eax
mov eax, dword [ebp - 0xac4]
xor eax, ecx
mov ecx, dword [ebp - 0xae8]
xor ecx, eax
mov dword [ebp - 0xac4], eax
rol ecx, 5
imul ecx, dword [ebp - 0xab4]
rol eax, 7
add ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, dword [ebp - 0xac4]
xor eax, dword [ebp - 0xabc]
mov dword [ebp - 0xac4], eax
ror eax, 3
sub eax, dword [ebp - 0xae8]
imul eax, dword [ebp - 0xad0]
xor ebx, eax
mov eax, 0x7f1137f
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 1
imul ecx, dword [ebp - 0xb34]
ror eax, 6
sub ecx, eax
mov eax, dword [ebp - 0xac4]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0xac4], eax
rol ecx, 3
imul ecx, dword [ebp - 0xab4]
rol eax, 0xe
add ecx, eax
xor ebx, ecx
mov ecx, 0xab69605e
mov eax, ebx
ror eax, 0xe
lea ecx, [ecx + ebx]
rol ecx, 0xf
imul ecx, dword [ebp - 0xad0]
sub ecx, eax
mov eax, dword [ebp - 0xac4]
xor eax, ecx
mov ecx, dword [ebp - 0xb34]
xor ecx, eax
mov dword [ebp - 0xac4], eax
imul ecx, dword [ebp - 0xae8]
shr eax, 3
xor ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
xor ecx, eax
mov eax, ebx
xor ebx, dword [ebp - 0xac0]
rol ecx, 4
imul ecx, dword [ebp - 0xb34]
rol eax, 2
mov dword [ebp - 0xac0], esi
xor ecx, eax
mov eax, dword [ebp - 0xac4]
xor ecx, dword [ebp - 0xac8]
xor eax, ecx
mov dword [ebp - 0xac8], edi
mov ecx, dword [ebp - 0xaf4]
mov byte [ecx - 4], al
mov byte [ecx], bl
ror eax, 8
mov byte [ecx - 5], al
ror ebx, 8
mov byte [ecx - 1], bl
ror eax, 8
mov byte [ecx - 6], al
ror ebx, 8
mov byte [ecx - 2], bl
ror eax, 8
ror ebx, 8
mov byte [ecx - 7], al
mov byte [ecx - 3], bl
add ecx, 8
ror eax, 8
ror ebx, 8
sub dword [ebp - 0xad8], 1
mov dword [ebp - 0xaf4], ecx
mov ecx, dword [ebp - 0xb04]
mov dword [ebp - 0xac4], eax
jne 0xb30755
mov edi, dword [ebp - 0xb10]
mov ecx, dword [ebp - 0xab8]
xor eax, eax
test edi, edi
je 0xb30adb
xor dl, byte [eax + ecx]
inc eax
cmp eax, edi
jb 0xb30ad3
mov esi, dword [ebp - 0xafc]
movzx eax, dl
cdq
cmp eax, dword [edi + esi]
jne 0xb30afe
cmp edx, dword [edi + esi + 4]
jne 0xb30afe
mov ebx, dword [ebp - 0xb0c]
xor eax, eax
mov esi, ecx
mov ecx, eax
jmp 0xb30b11
mov esi, dword [ebp - 0xaf8]
mov ebx, 0xc004d501
mov edi, dword [ebp - 0xae0]
xor eax, eax
test ecx, ecx
je 0xb30b24
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb30b3f
xor eax, eax
mov dword [ebp - 0xadc], esi
mov esi, eax
mov dword [ebp - 0xb3c], edi
mov ebx, 0x10000000
jmp 0xb30b4c
mov edi, dword [ebp - 0xb3c]
mov ebx, 0xd0000001
xor eax, eax
mov dword [ebp - 0xb44], ebx
test esi, esi
je 0xb30b65
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb30dd6
mov ecx, dword [ebp - 0xadc]
xor eax, eax
push 4
pop esi
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xbc8], ecx
cmp edi, esi
jb 0xb30dc5
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0xaf8], eax
lea eax, [ebp - 0xbc8]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb30dca
lea eax, [ebp - 0xbcc]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb30dca
mov eax, edi
sub eax, dword [ebp - 0xbcc]
cmp eax, esi
jb 0xb30dc5
mov ecx, dword [ebp - 0xbc8]
lea eax, [ebp - 0xbc8]
push eax
mov edx, esi
mov edi, dword [ecx]
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb30dca
mov ecx, dword [ebp - 0xbcc]
lea eax, [ebp - 0xbcc]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb30dca
mov eax, dword [ebp - 0xb3c]
mov ecx, dword [ebp - 0xbcc]
sub eax, ecx
cmp eax, edi
jb 0xb30dc5
lea eax, [ebp - 0xbcc]
mov edx, edi
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb30dca
mov esi, dword [ebp - 0xbc8]
mov edx, dword [ebp - 0xb3c]
mov ebx, dword [ebp - 0xadc]
lea ecx, [esi + edi]
lea eax, [edx + ebx]
cmp eax, ecx
jb 0xb30dc5
sub edx, esi
sub edx, edi
add edx, ebx
cmp edx, 8
jae 0xb30dc5
xor ecx, ecx
mov dword [ebp - 0xafc], ecx
mov eax, ecx
mov dword [ebp - 0xae0], eax
mov ebx, ecx
test esi, esi
je 0xb30d5c
lea eax, [ebp - 0xbc4]
mov edx, edi
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb30dca
mov eax, dword [ebp - 0xbc4]
jmp 0xb30d44
lea eax, [ebp - 0xbc0]
mov ecx, esi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb30dca
mov eax, dword [ebp - 0xbc4]
cmp dword [ebp - 0xbc0], eax
ja 0xb30d81
mov edx, dword [esi]
lea eax, [ebp - 0xbbc]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb30d06
mov eax, dword [ebp - 0xbbc]
mov dword [ebp - 0xcdc], eax
jmp 0xb30d0c
mov eax, dword [ebp - 0xcdc]
test ebx, ebx
js 0xb30dca
lea ecx, [ebp - 0xbb8]
mov edx, eax
push ecx
mov ecx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb30dca
mov esi, dword [ebp - 0xbb8]
mov eax, dword [ebp - 0xbc4]
cmp esi, eax
ja 0xb30d81
inc dword [ebp - 0xafc]
cmp esi, eax
jb 0xb30cb0
cmp esi, eax
jne 0xb30d81
mov esi, dword [ebp - 0xbc8]
mov eax, dword [ebp - 0xae0]
test edi, edi
je 0xb30d8c
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xae0], eax
test eax, eax
jne 0xb30d88
mov ebx, 0xc0000017
jmp 0xb30db3
mov ebx, 0xc000000d
jmp 0xb30dca
xor ecx, ecx
mov ebx, ecx
test esi, esi
je 0xb30da1
push edi
push esi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xae0]
add esp, 0xc
mov dword [ebp - 0xdf8], eax
mov eax, dword [ebp - 0xafc]
mov dword [ebp - 0xe00], eax
test ebx, ebx
js 0xb30dca
mov eax, dword [ebp - 0xaf8]
cmp eax, dword [ebp - 0xe00]
je 0xb30dca
mov ebx, 0xc000003e
or ebx, 0x10000000
mov dword [ebp - 0xb44], ebx
mov edi, dword [ebp - 0xacc]
mov eax, dword [ebp - 0xae4]
test eax, eax
je 0xb30df7
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xb40]
test esi, esi
je 0xb30e65
xor eax, eax
cmp dword [esi + 4], eax
je 0xb30e1e
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xb30e3a
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xb30e56
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xaec]
test eax, eax
je 0xb30e80
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xad4]
test eax, eax
je 0xb30e9b
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xb30f03
xor eax, eax
cmp dword [edi + 4], eax
je 0xb30ebc
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xb30ed8
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xb30ef4
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xadc]
test eax, eax
je 0xb30f1e
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb314be
cmp dword [ebp - 0xe00], 1
jb 0xb314b3
cmp dword [ebp - 0xdf8], 0
je 0xb30f8d
cmp dword [ebp - 0xe00], 0
jbe 0xb30f8d
mov eax, dword [ebp - 0xdf8]
lea ecx, [ebp - 0xb48]
push ecx
push 4
pop ecx
mov esi, dword [eax]
mov edx, ecx
mov ecx, eax
mov dword [ebp - 0xb48], eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb31010
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb48]
mov dword [ebp - 0xb48], eax
jmp 0xb3101c
mov ebx, 0xc000000d
mov dword [ebp - 0xb44], ebx
mov eax, dword [ebp - 0xb80]
push 4
pop edx
test ebx, ebx
js 0xb314be
cmp eax, 0xd0000023
jne 0xb30fbb
mov eax, 0x8007007a
mov dword [ebp - 0xb80], eax
cmp eax, 0x8007007a
je 0xb30fd2
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test eax, eax
js 0xb314be
cmp dword [ebp - 0xe00], 6
jne 0xb314b3
cmp dword [ebp - 0xdf8], 0
jne 0xb3103c
mov edx, dword [ebp - 0xdb4]
mov ebx, 0xc000000d
mov ecx, dword [ebp - 0xdb8]
mov dword [ebp - 0xb44], ebx
mov dword [ebp - 0xaf8], edx
mov dword [ebp - 0xae0], ecx
jmp 0xb3110e
mov esi, dword [ebp - 0xcd4]
mov eax, dword [ebp - 0xc80]
test ebx, ebx
js 0xb30f98
push 4
pop edx
cmp esi, edx
jne 0xb2eaab
mov eax, dword [eax]
mov dword [ebp - 0xb80], eax
jmp 0xb30fa1
mov ecx, dword [ebp - 0xdf8]
xor eax, eax
mov dword [ebp - 0xb20], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xb20]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb310ca
mov ecx, dword [ebp - 0xb20]
lea eax, [ebp - 0xb20]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb310ca
mov ecx, dword [ebp - 0xb20]
inc esi
cmp esi, 1
jae 0xb31097
push 4
pop edx
jmp 0xb3104c
mov esi, dword [ecx]
lea eax, [ebp - 0xb20]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb310ca
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb20]
mov dword [ebp - 0xb20], eax
jmp 0xb310d6
mov esi, dword [ebp - 0xc7c]
mov eax, dword [ebp - 0xc70]
test ebx, ebx
js 0xb310f6
cmp esi, 8
jne 0xb2eaab
mov ecx, dword [eax]
mov dword [ebp - 0xae0], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xaf8], ecx
jmp 0xb3110e
mov eax, dword [ebp - 0xdb4]
mov dword [ebp - 0xaf8], eax
mov eax, dword [ebp - 0xdb8]
mov dword [ebp - 0xae0], eax
test ebx, ebx
js 0xb314be
cmp dword [ebp - 0xdf8], 0
jne 0xb31158
mov ebx, 0xc000000d
mov dword [ebp - 0xb44], ebx
mov eax, dword [ebp - 0xc6c]
push 4
pop edx
mov dword [ebp - 0xafc], eax
test ebx, ebx
js 0xb314be
cmp dword [ebp - 0xdf8], 0
jne 0xb3120c
mov ebx, 0xc000000d
jmp 0xb314b8
mov ecx, dword [ebp - 0xdf8]
xor eax, eax
mov dword [ebp - 0xb28], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xb28]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb311e6
mov ecx, dword [ebp - 0xb28]
lea eax, [ebp - 0xb28]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb311e6
mov ecx, dword [ebp - 0xb28]
inc esi
cmp esi, 2
jb 0xb31168
mov esi, dword [ecx]
lea eax, [ebp - 0xb28]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb311e6
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb28]
mov dword [ebp - 0xb28], eax
jmp 0xb311f2
mov esi, dword [ebp - 0xc68]
mov eax, dword [ebp - 0xc4c]
test ebx, ebx
js 0xb3112a
push 4
pop edx
cmp esi, edx
jne 0xb2eaab
mov eax, dword [eax]
jmp 0xb31133
mov ecx, dword [ebp - 0xdf8]
xor eax, eax
mov dword [ebp - 0xb18], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xb18]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb312a0
mov ecx, dword [ebp - 0xb18]
lea eax, [ebp - 0xb18]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb312a0
mov ecx, dword [ebp - 0xb18]
inc esi
cmp esi, 3
jae 0xb31267
push 4
pop edx
jmp 0xb3121c
mov edi, dword [ecx]
lea eax, [ebp - 0xb18]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xb0c], edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb312a0
mov esi, edi
neg esi
sbb esi, esi
and esi, dword [ebp - 0xb18]
mov dword [ebp - 0xb18], esi
jmp 0xb312b2
mov eax, dword [ebp - 0xc64]
mov esi, dword [ebp - 0xc38]
mov dword [ebp - 0xb0c], eax
test ebx, ebx
js 0xb314be
mov ecx, dword [ebp - 0xdf8]
xor eax, eax
push 4
mov dword [ebp - 0xb58], ecx
mov edi, eax
pop edx
mov eax, dword [ecx]
mov dword [ebp - 0xb10], eax
lea eax, [ebp - 0xb58]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb3134d
mov edx, dword [ebp - 0xb10]
lea eax, [ebp - 0xb58]
mov ecx, dword [ebp - 0xb58]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb3134d
mov ecx, dword [ebp - 0xb58]
inc edi
push 4
pop edx
cmp edi, edx
jb 0xb312cd
mov edi, dword [ecx]
lea eax, [ebp - 0xb58]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb3134d
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb58]
mov dword [ebp - 0xb58], eax
jmp 0xb31359
mov edi, dword [ebp - 0xc88]
mov eax, dword [ebp - 0xc98]
push 4
pop edx
test ebx, ebx
js 0xb3136c
cmp edi, edx
jne 0xb2eaab
mov eax, dword [eax]
jmp 0xb31372
mov eax, dword [ebp - 0xc9c]
mov dword [ebp - 0xb10], eax
test ebx, ebx
js 0xb314be
mov ecx, dword [ebp - 0xdf8]
xor eax, eax
mov dword [ebp - 0xb5c], ecx
mov edi, eax
mov eax, dword [ecx]
mov dword [ebp - 0xab8], eax
lea eax, [ebp - 0xb5c]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb31418
mov edx, dword [ebp - 0xab8]
lea eax, [ebp - 0xb5c]
mov ecx, dword [ebp - 0xb5c]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb31418
mov ecx, dword [ebp - 0xb5c]
inc edi
cmp edi, 5
jae 0xb313e5
push 4
pop edx
jmp 0xb31390
mov edi, dword [ecx]
lea eax, [ebp - 0xb5c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb44], ebx
test ebx, ebx
js 0xb31418
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb5c]
mov dword [ebp - 0xb5c], eax
jmp 0xb31424
mov edi, dword [ebp - 0xc3c]
mov eax, dword [ebp - 0xc40]
push 4
pop edx
test ebx, ebx
js 0xb31437
cmp edi, edx
jne 0xb2eaab
mov ecx, dword [eax]
jmp 0xb3143d
mov ecx, dword [ebp - 0xb50]
test ebx, ebx
js 0xb314be
mov eax, dword [ebp - 0xbac]
cmp eax, dword [ebp - 0xae0]
jne 0xb314b3
mov eax, dword [ebp - 0xba8]
cmp eax, dword [ebp - 0xaf8]
jne 0xb314b3
mov dword [ebp - 0xce8], ecx
cmp dword [ebp - 0xb10], edx
ja 0xb314a0
mov eax, dword [ebp - 0xb0c]
cmp eax, edx
ja 0xb314a0
push eax
push esi
mov esi, dword [ebp - 0xb54]
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xafc]
add esp, 0xc
mov dword [ebp - 0xce4], eax
mov eax, dword [ebp - 0xb80]
test eax, eax
je 0xb314be
mov ebx, eax
jmp 0xb314b8
mov ecx, dword [ebp - 0xafc]
mov ebx, 0x8007007a
mov dword [ebp - 0xce4], ecx
jmp 0xb314b8
mov ebx, 0xc004d501
mov dword [ebp - 0xb44], ebx
mov edi, dword [ebp - 0xaf0]
mov eax, dword [ebp - 0xb14]
xor ecx, ecx
mov dword [ebp - 0xdf0], ecx
mov dword [ebp - 0xdf4], ecx
test eax, eax
je 0xb314f3
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0xdec], ecx
mov eax, dword [ebp - 0xdf8]
mov dword [ebp - 0xdfc], ecx
mov dword [ebp - 0xe00], ecx
test eax, eax
je 0xb31520
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0xdf8], ecx
test edi, edi
je 0xb31533
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb00]
test eax, eax
je 0xb3154e
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb2e5b5
mov eax, dword [ebp - 0xce8]
test eax, eax
je 0xb37fa7
mov dword [0xc95878], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x2c8]
push eax
push 0x9d0000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0xb35e29
cmp eax, esi
jne 0xb3159c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0xb35e29
mov esi, dword [0xc9307c]
xor eax, eax
push 0x403
push eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0xaf8], eax
test eax, eax
jne 0xb315ca
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb35e29
mov esi, dword [0xc9304c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [0xc95870], eax
lea edi, [ebp - 0x3ac]
mov eax, dword [0xc95878]
xor ebx, ebx
mov dword [ebp - 0xae0], eax
xor eax, eax
stosd dword es:[edi], eax
push 0x2c
push ebx
mov dword [0xc95874], edx
stosd dword es:[edi], eax
mov dword [ebp - 0xdc0], ebx
mov dword [ebp - 0xdbc], ebx
mov dword [ebp - 0xafc], ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x4b8]
push eax
mov dword [ebp - 0xb0c], ebx
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0xb10], ebx
mov esi, 0xc96238
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xb31632
mov eax, dword [0xc95890]
test eax, eax
jne 0xb31c6b
push 0x338
mov esi, ebx
mov dword [ebp - 0xab8], ebx
push ebx
mov dword [ebp - 0xb04], ebx
mov dword [ebp - 0xaf4], esi
mov dword [ebp - 0xac0], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xac8], eax
test eax, eax
je 0xb31c5d
or dword [ebp - 0xad8], 0xffffffff
mov edx, 0xab69605e
mov dword [ebp - 0x390], edx
add eax, 7
mov edx, 0x7f1137f
mov dword [ebp - 0xac4], ebx
mov edi, 0x9fbcf2
mov dword [ebp - 0x38c], edx
mov cl, bl
mov dword [ebp - 0xb3c], eax
mov edx, ebx
mov dword [ebp - 0xadc], edi
mov dword [ebp - 0xacc], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xadc]
xor edx, ebx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xadc]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xadc]
shl edi, 8
add dword [ebp - 0xadc], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov eax, esi
mov dword [ebp - 0xabc], esi
add eax, 0x54969fa2
rol dword [ebp - 0xabc], 0xa
rol eax, 5
imul eax, eax, 0x137f
add eax, dword [ebp - 0xabc]
xor edx, eax
mov dword [ebp - 0xad4], edx
lea eax, [edx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xad4]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xad4]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xad4], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xad4]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xad4]
xor edx, eax
mov dword [ebp - 0xad4], edx
mov eax, dword [ebp - 0xad4]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xad4]
xor eax, edx
mov dword [ebp - 0xad4], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xad4]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xad4]
xor eax, edx
mov dword [ebp - 0xad4], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xad4]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xad4]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0xad4], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0xad4]
xor eax, 0xab69605e
mov dword [ebp - 0xabc], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xabc]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xabc]
xor eax, edx
mov dword [ebp - 0xabc], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0xabc], edx
mov edx, dword [ebp - 0xabc]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xabc], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xabc]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xabc]
xor eax, edx
mov dword [ebp - 0xabc], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xabc]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xabc]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xabc], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xabc]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xabc]
xor edx, dword [ebp - 0xac4]
xor eax, dword [ebp - 0xad8]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xad4], esi
mov esi, dword [ebp - 0xb3c]
mov dword [ebp - 0xad8], edi
mov edi, dword [ebp - 0xadc]
mov dword [ebp - 0xac4], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xacc], 1
mov dword [ebp - 0xb3c], esi
mov esi, eax
mov dword [ebp - 0xabc], eax
jne 0xb316cc
mov esi, dword [ebp - 0xac8]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xb31a51
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xb31a83
cmp edx, dword [0x9fc02c]
jne 0xb31a83
mov edi, esi
xor eax, eax
mov dword [ebp - 0xaf4], edi
mov esi, eax
mov ebx, 0x337
jmp 0xb31a98
mov edi, dword [ebp - 0xaf4]
or ebx, 0xffffffff
mov dword [ebp - 0xac0], 0xc004d501
xor eax, eax
test esi, esi
je 0xb31aab
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xac0], 0
jl 0xb31c57
xor eax, eax
mov esi, edi
push 0x40
mov byte [edi + ebx], al
mov ebx, 0xc960a0
push eax
push ebx
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xb31bed
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xcb0]
jne 0xb31ae2
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xb31c50
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xb04], ecx
cmp word [eax], dx
jne 0xb31b58
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xb31b58
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xb31b58
cmp dword [edx], 0x4550
jne 0xb31b58
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xbd8]
je 0xb31b65
cmp ax, word [ebp - 0xbdc]
je 0xb31b65
mov ecx, 0xc000000d
jmp 0xb31b5d
mov ecx, 0xc000007b
mov dword [ebp - 0xb04], ecx
jmp 0xb31b77
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0xac0], eax
test eax, eax
je 0xb31be1
mov edx, esi
mov dword [ebp - 0xac8], esi
lea eax, [edx + 1]
mov dword [ebp - 0xac4], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xb31b99
sub edx, dword [ebp - 0xac4]
inc esi
add esi, edx
test ecx, ecx
js 0xb31bd2
push dword [ebp - 0xac8]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xb31bed
mov ecx, dword [ebp - 0xab8]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xb04]
inc dword [ebp - 0xab8]
inc ebx
cmp ebx, dword [ebp - 0xac0]
jb 0xb31b88
add edi, 0x10
cmp byte [esi], 0
jne 0xb31adb
mov ebx, dword [ebp - 0xb04]
mov esi, dword [ebp - 0xaf4]
test esi, esi
je 0xb31c0e
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xb31c64
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb31c27
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb31c16
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xb31c71
mov ebx, 0xc000007a
jmp 0xb31bf3
mov esi, dword [ebp - 0xaf4]
mov ebx, 0xc000007a
jmp 0xb31bf9
mov eax, dword [0xc95890]
xor ebx, ebx
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov edx, 0xc96238
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0xab8], ebx
lea edi, [ebp - 0xe34]
mov dword [ebp - 0xb04], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xaf4], ebx
mov dword [ebp - 0xac0], ebx
mov dword [ebp - 0xac8], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xac4], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xb31caa
mov eax, dword [0xc95890]
test eax, eax
jne 0xb322e5
push 0x338
mov esi, ebx
mov dword [ebp - 0xad8], ebx
push ebx
mov dword [ebp - 0xb3c], ebx
mov dword [ebp - 0xadc], esi
mov dword [ebp - 0xacc], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xabc], eax
test eax, eax
je 0xb322d7
or dword [ebp - 0xad0], 0xffffffff
mov edx, 0xab69605e
mov dword [ebp - 0x388], edx
add eax, 7
mov edx, 0x7f1137f
mov dword [ebp - 0xad4], ebx
mov edi, 0x9fbcf2
mov dword [ebp - 0x384], edx
mov cl, bl
mov dword [ebp - 0xaec], eax
mov edx, ebx
mov dword [ebp - 0xab4], edi
mov dword [ebp - 0xae8], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xab4]
xor edx, ebx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xab4]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xab4]
shl edi, 8
add dword [ebp - 0xab4], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov eax, esi
mov dword [ebp - 0xae4], esi
add eax, 0x54969fa2
rol dword [ebp - 0xae4], 0xa
rol eax, 5
imul eax, eax, 0x137f
add eax, dword [ebp - 0xae4]
xor edx, eax
mov dword [ebp - 0xaf0], edx
lea eax, [edx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xaf0]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xaf0]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xaf0], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xaf0]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xaf0]
xor edx, eax
mov dword [ebp - 0xaf0], edx
mov eax, dword [ebp - 0xaf0]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xaf0]
xor eax, edx
mov dword [ebp - 0xaf0], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xaf0]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xaf0]
xor eax, edx
mov dword [ebp - 0xaf0], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xaf0]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xaf0]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0xaf0], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0xaf0]
xor eax, 0xab69605e
mov dword [ebp - 0xae4], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xae4]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xae4]
xor eax, edx
mov dword [ebp - 0xae4], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0xae4], edx
mov edx, dword [ebp - 0xae4]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xae4], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xae4]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xae4]
xor eax, edx
mov dword [ebp - 0xae4], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xae4]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xae4]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xae4], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xae4]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xae4]
xor edx, dword [ebp - 0xad4]
xor eax, dword [ebp - 0xad0]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xaf0], esi
mov esi, dword [ebp - 0xaec]
mov dword [ebp - 0xad0], edi
mov edi, dword [ebp - 0xab4]
mov dword [ebp - 0xad4], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xae8], 1
mov dword [ebp - 0xaec], esi
mov esi, eax
mov dword [ebp - 0xae4], eax
jne 0xb31d44
mov esi, dword [ebp - 0xabc]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xb320c9
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xb320fb
cmp edx, dword [0x9fc02c]
jne 0xb320fb
mov ebx, esi
xor eax, eax
mov dword [ebp - 0xadc], ebx
mov esi, eax
mov edi, 0x337
jmp 0xb32110
mov ebx, dword [ebp - 0xadc]
or edi, 0xffffffff
mov dword [ebp - 0xacc], 0xc004d501
xor eax, eax
test esi, esi
je 0xb32123
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xacc], 0
jl 0xb322d1
xor eax, eax
mov esi, ebx
push 0x40
push eax
push 0xc960a0
mov byte [edi + ebx], al
call fcn.00ab4bf6
add esp, 0xc
cmp byte [ebx], 0
je 0xb32267
mov edi, 0xc960a0
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xcb0]
jne 0xb3215c
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xb322ca
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xb3c], ecx
cmp word [eax], dx
jne 0xb321d2
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xb321d2
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xb321d2
cmp dword [edx], 0x4550
jne 0xb321d2
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xbd8]
je 0xb321df
cmp ax, word [ebp - 0xbdc]
je 0xb321df
mov ecx, 0xc000000d
jmp 0xb321d7
mov ecx, 0xc000007b
mov dword [ebp - 0xb3c], ecx
jmp 0xb321f1
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0xacc], eax
test eax, eax
je 0xb3225b
mov edx, esi
mov dword [ebp - 0xabc], esi
lea eax, [edx + 1]
mov dword [ebp - 0xad4], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xb32213
sub edx, dword [ebp - 0xad4]
inc esi
add esi, edx
test ecx, ecx
js 0xb3224c
push dword [ebp - 0xabc]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xb32267
mov ecx, dword [ebp - 0xad8]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xb3c]
inc dword [ebp - 0xad8]
inc ebx
cmp ebx, dword [ebp - 0xacc]
jb 0xb32202
add edi, 0x10
cmp byte [esi], 0
jne 0xb32155
mov ebx, dword [ebp - 0xb3c]
mov esi, dword [ebp - 0xadc]
test esi, esi
je 0xb32288
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xb322de
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb322a1
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb32290
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xb322eb
mov ebx, 0xc000007a
jmp 0xb3226d
mov esi, dword [ebp - 0xadc]
mov ebx, 0xc000007a
jmp 0xb32273
mov eax, dword [0xc95890]
xor ebx, ebx
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
push 0x54
lea eax, [ebp - 0xab0]
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
mov esi, dword [0xc9307c]
lea edi, [ebp - 0x3b0]
add esp, 0xc
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
pop edx
push 0x403
push ebx
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xae0]
mov ecx, eax
and ecx, edx
mov dword [ebp - 0xae0], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0xc], cx
mov ecx, eax
shr ecx, 8
and ecx, edx
shr eax, 0xc
mov word [ebp - 0xa], cx
and eax, edx
mov ecx, esi
mov word [ebp - 8], ax
call dword [0xc99200]
call esi
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xb3c], 0xffffff
test eax, eax
jne 0xb32396
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb32386
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb33859
mov ebx, 0x80004005
jmp 0xb33859
mov edi, dword [0xc93050]
lea eax, [ebp - 0xc48]
push eax
push ebx
lea eax, [ebp - 0xb30]
mov dword [ebp - 0xc44], ebx
push eax
mov esi, ebx
mov dword [ebp - 0xacc], ebx
push 8
mov ecx, edi
mov dword [ebp - 0xadc], esi
mov dword [ebp - 0xabc], ebx
mov dword [ebp - 0xad4], ebx
mov dword [ebp - 0xc48], ebx
call dword [0xc99200]
call edi
test eax, eax
jne 0xb324e6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb323fc
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb32662
mov ebx, 0x80004005
mov esi, dword [ebp - 0xabc]
mov edi, dword [ebp - 0xaf4]
xor ecx, ecx
test esi, esi
je 0xb32489
mov eax, ecx
mov dword [ebp - 0xabc], ecx
mov edx, dword [esi + eax*4]
test edx, edx
je 0xb3247d
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0xad4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xcb0]
jne 0xb32433
sub ecx, dword [ebp - 0xad4]
xor eax, eax
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xb32468
mov byte [edx], al
inc edx
sub ecx, 1
jne 0xb32457
mov edx, dword [ebp - 0xabc]
mov edx, dword [esi + edx*4]
push edx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xabc]
inc eax
mov dword [ebp - 0xabc], eax
cmp eax, 3
jb 0xb32421
mov eax, dword [ebp - 0xc44]
xor edx, edx
test eax, eax
je 0xb324a7
mov ecx, dword [ebp - 0xacc]
test ecx, ecx
je 0xb324a7
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0xb3249f
test esi, esi
je 0xb324ba
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xc44]
test eax, eax
je 0xb32deb
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0xc44], ecx
jmp 0xb32ded
mov eax, dword [ebp - 0xc48]
add eax, eax
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xad0], edi
test edi, edi
jne 0xb32513
mov ebx, 0x8007000e
jmp 0xb3264d
mov eax, dword [ebp - 0xb30]
lea eax, [eax*4 + 4]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xaec], esi
test esi, esi
jne 0xb3254e
mov ebx, 0x8007000e
jmp 0xb32547
mov ebx, 0x80004005
xor ecx, ecx
jmp 0xb32634
mov ebx, dword [0xc93050]
lea eax, [ebp - 0xc48]
push eax
push edi
lea eax, [ebp - 0xb30]
mov ecx, ebx
push eax
push 8
call dword [0xc99200]
call ebx
test eax, eax
jne 0xb3258e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb3258a
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb32547
jmp 0xb32542
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0xadc], ecx
cmp dword [ebp - 0xb30], ecx
jbe 0xb32613
mov dword [ebp - 0xab4], edi
mov edi, esi
mov esi, dword [ebp - 0xab4]
mov ebx, dword [0xc93058]
push ecx
push esi
mov ecx, ebx
call dword [0xc99200]
call ebx
mov ecx, esi
mov dword [edi], eax
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xb325c9
sub ecx, edx
sar ecx, 1
push 4
pop eax
add edi, eax
mov eax, dword [ebp - 0xadc]
lea esi, [esi + ecx*2]
add esi, 2
inc eax
push 0
mov dword [ebp - 0xadc], eax
pop ecx
cmp eax, dword [ebp - 0xb30]
jb 0xb325ae
mov esi, dword [ebp - 0xaec]
mov dword [ebp - 0xadc], edi
mov edi, dword [ebp - 0xad0]
mov eax, dword [ebp - 0xadc]
mov ebx, dword [ebp - 0xad4]
mov dword [eax], 0x409
mov eax, dword [ebp - 0xb30]
inc eax
mov dword [ebp - 0xadc], esi
mov esi, ecx
mov dword [ebp - 0xad0], eax
test esi, esi
je 0xb32647
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xadc]
test edi, edi
je 0xb32662
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb32407
xor eax, eax
mov ebx, eax
mov ecx, eax
mov dword [ebp - 0xaec], ebx
cmp dword [ebp - 0xad0], eax
jbe 0xb326a7
mov edx, dword [esi + ecx*4]
cmp edx, dword [eax*4 + 0xa192e8]
je 0xb3269d
inc eax
cmp eax, 0x26
jb 0xb32681
inc ecx
xor eax, eax
cmp ecx, dword [ebp - 0xad0]
jae 0xb326a7
jmp 0xb3267e
mov ebx, eax
xor eax, eax
mov dword [ebp - 0xaec], ebx
mov esi, dword [0xc93054]
mov ecx, esi
push eax
mov dword [ebp - 0xad0], eax
lea eax, [ebp - 0xc0]
push 0x55
push eax
push dword [ebx*4 + 0xa192e8]
call dword [0xc99200]
call esi
test eax, eax
je 0xb32710
mov esi, dword [0xc93048]
lea eax, [ebp - 0x410]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xc0]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
test eax, eax
jle 0xb32710
mov ebx, dword [ebp - 0x404]
shr ebx, 0x1b
and ebx, 1
mov dword [ebp - 0xad0], ebx
mov ebx, dword [ebp - 0xaec]
xor eax, eax
mov edx, 0x9fba10
mov esi, eax
mov ecx, edx
mov dword [ebp + esi*4 - 0x350], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xcb0]
jne 0xb32725
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0xb32719
imul ecx, ebx, 3
movzx eax, byte [ecx + 0xa00b58]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xac0], eax
movzx eax, byte [ecx + 0xa00b59]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xac8], eax
movzx eax, byte [ecx + 0xa00b5a]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xac4], eax
xor eax, eax
push 0x1c90
mov ebx, eax
push eax
mov dword [ebp - 0xad4], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xab4], ecx
test ecx, ecx
jne 0xb327b6
mov ebx, 0x8007000e
jmp 0xb32407
or dword [ebp - 0xae4], 0xffffffff
mov edx, 0xab69605e
xor ebx, ebx
mov dword [ebp - 0x358], edx
mov edx, 0x7f1137f
mov dword [ebp - 0xae8], ebx
add ecx, 7
mov dword [ebp - 0x354], edx
mov esi, 0xa19392
mov dword [ebp - 0xaf0], ecx
mov al, bl
mov dword [ebp - 0xb00], esi
mov edx, ebx
mov dword [ebp - 0xb14], 0x392
movzx edi, byte [esi - 2]
movzx ecx, byte [esi - 1]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, ecx
shl esi, 8
mov ecx, dword [ebp - 0xb00]
xor ebx, edi
movzx ecx, byte [ecx + 3]
or esi, ecx
mov ecx, dword [ebp - 0xb00]
shl esi, 8
movzx ecx, byte [ecx + 4]
or esi, ecx
mov ecx, dword [ebp - 0xb00]
shl esi, 8
add dword [ebp - 0xb00], 8
movzx ecx, byte [ecx + 5]
or esi, ecx
xor edx, esi
xor edx, ebx
xor edx, 0xac987321
mov dword [ebp - 0xb50], edx
lea ecx, [edx + 0x54969fa2]
rol ecx, 5
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0xb50]
rol ecx, 0xa
add edx, ecx
xor ebx, edx
lea ecx, [ebx + 0x7f1137f]
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, ebx
rol ecx, 2
sub edx, ecx
mov ecx, dword [ebp - 0xb50]
xor ecx, edx
mov dword [ebp - 0xb50], ecx
imul edx, dword [ebp - 0xb50], 0x605e
shr ecx, 0xd
sub edx, ecx
sub edx, 0x756c8a2
xor ebx, edx
mov ecx, ebx
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 2
sub edx, ecx
mov ecx, dword [ebp - 0xb50]
xor ecx, edx
mov edx, ecx
mov dword [ebp - 0xb50], ecx
xor edx, 0xab69605e
mov ecx, 0x7f1137f
sub ecx, edx
xor ebx, ecx
mov ecx, ebx
mov edx, ebx
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
mov ecx, dword [ebp - 0xb50]
xor ecx, edx
mov dword [ebp - 0xb50], ecx
add ecx, 0x7f1137f
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0xb50]
rol ecx, 2
add edx, ecx
xor ebx, edx
lea ecx, [ebx + 0x54969fa2]
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 8
sub edx, ecx
mov ecx, dword [ebp - 0xb50]
xor ecx, edx
mov dword [ebp - 0xb50], ecx
xor ecx, 0xab69605e
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0xb50]
ror ecx, 0xa
xor edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, ebx
shr ecx, 0xa
xor edx, ecx
xor edx, dword [ebp - 0xb50]
mov ecx, edx
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor ebx, ecx
lea ecx, [ebx - 0x7f1]
xor ecx, edx
xor ecx, 0xab69605e
mov dword [ebp - 0xb50], ecx
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0xb50]
shr ecx, 2
add edx, ecx
xor ebx, edx
lea ecx, [ebx - 0x7f1137f]
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, ebx
rol ecx, 7
add edx, ecx
mov ecx, dword [ebp - 0xb50]
xor ecx, edx
mov dword [ebp - 0xb50], ecx
mov edx, ecx
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor ebx, edx
mov ecx, ebx
mov edx, ebx
xor ecx, 0xab69
rol ebx, 7
rol ecx, 5
imul ecx, ecx, 0x7f1
add ecx, ebx
mov ebx, dword [ebp - 0xb50]
xor ebx, ecx
mov dword [ebp - 0xb50], ebx
xor ebx, edx
mov edx, dword [ebp - 0xb50]
xor ebx, 0xac987321
mov ecx, ebx
ror ecx, 3
imul ecx, ecx, 0x137f
sub ecx, 0xd0dd417
xor edx, ecx
mov dword [ebp - 0xb50], edx
lea ecx, [edx - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0xb50]
ror ecx, 6
sub edx, ecx
xor ebx, edx
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 0xe
add edx, ecx
mov ecx, dword [ebp - 0xb50]
xor ecx, edx
mov dword [ebp - 0xb50], ecx
add ecx, 0xab69605e
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0xb50]
ror ecx, 0xe
sub edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, ebx
shr ecx, 3
xor edx, ecx
mov ecx, dword [ebp - 0xb50]
xor ecx, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xb50], ecx
xor ecx, edx
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0xb50]
rol ecx, 2
xor edx, ecx
mov ecx, dword [ebp - 0xaf0]
xor edx, dword [ebp - 0xae8]
xor ebx, edx
mov dword [ebp - 0xae8], edi
mov edx, dword [ebp - 0xb50]
xor edx, dword [ebp - 0xae4]
mov byte [ecx - 4], bl
mov byte [ecx], dl
ror ebx, 8
mov byte [ecx - 5], bl
ror edx, 8
mov byte [ecx - 1], dl
ror ebx, 8
mov byte [ecx - 6], bl
ror edx, 8
mov byte [ecx - 2], dl
ror ebx, 8
ror edx, 8
mov byte [ecx - 7], bl
mov byte [ecx - 3], dl
add ecx, 8
ror ebx, 8
ror edx, 8
sub dword [ebp - 0xb14], 1
mov dword [ebp - 0xae4], esi
mov esi, dword [ebp - 0xb00]
mov dword [ebp - 0xaf0], ecx
jne 0xb327fd
mov ebx, dword [ebp - 0xad4]
xor ecx, ecx
mov edx, ecx
mov esi, 0x1c90
mov ecx, dword [ebp - 0xab4]
xor al, byte [edx + ecx]
inc edx
cmp edx, esi
jb 0xb32b77
movzx eax, al
cdq
cmp eax, dword [0xa1b020]
jne 0xb32ba5
cmp edx, dword [0xa1b024]
jne 0xb32ba5
xor edx, edx
mov dword [ebp - 0xc44], ecx
mov ecx, edx
mov dword [ebp - 0xacc], esi
jmp 0xb32bb2
mov ebx, 0xc004d501
xor edx, edx
mov dword [ebp - 0xad4], ebx
test ecx, ecx
je 0xb32bc5
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb32407
mov edi, dword [ebp - 0xc44]
xor eax, eax
mov ebx, dword [ebp - 0xaec]
mov esi, eax
mov edx, eax
cmp ebx, edx
jne 0xb32bea
mov dword [ebp + esi*4 - 0x2e0], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0xabc], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xb32bf5
sub ecx, dword [ebp - 0xabc]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0xb32bdf
inc esi
push 0
pop eax
cmp esi, 6
jb 0xb32bdd
push 0xc
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, dword [ebp - 0xad4]
mov esi, eax
test esi, esi
je 0xb32c6f
xor eax, eax
mov edi, esi
mov edx, esi
mov dword [ebp - 0xad4], edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov ecx, eax
mov eax, esi
sub eax, esi
mov dword [ebp - 0xabc], ecx
mov dword [ebp - 0xaec], eax
movzx edi, word [ebp + ecx*2 - 0xc]
xor eax, eax
cmp di, word [eax*2 + 0xa19380]
je 0xb32c79
inc eax
cmp eax, 6
jb 0xb32c5a
jmp 0xb32d5f
mov ebx, 0x8007000e
jmp 0xb3240d
mov edi, dword [ebp + eax*4 - 0x2e0]
mov ecx, edi
mov edx, dword [0xc93060]
mov dword [ebp - 0xab4], edx
lea eax, [ecx + 1]
mov dword [ebp - 0xae8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xb32c97
sub ecx, dword [ebp - 0xae8]
xor eax, eax
push eax
push eax
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
xor eax, eax
push eax
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0xab4]
mov dword [ebp - 0xab4], eax
test eax, eax
je 0xb32dbe
lea ecx, [eax + eax]
xor eax, eax
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0xad4]
mov edx, dword [ebp - 0xaec]
mov dword [edx + ecx], eax
mov eax, dword [ecx]
mov dword [ebp - 0xae8], eax
test eax, eax
je 0xb32c6f
mov edx, dword [0xc93060]
mov ecx, edi
mov dword [ebp - 0xae4], edx
lea eax, [ecx + 1]
mov dword [ebp - 0xaf0], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xb32d1b
push dword [ebp - 0xab4]
sub ecx, dword [ebp - 0xaf0]
push dword [ebp - 0xae8]
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
xor eax, eax
push eax
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0xae4]
test eax, eax
je 0xb32d97
mov ecx, dword [ebp - 0xabc]
mov edx, dword [ebp - 0xad4]
push 4
inc ecx
pop eax
add edx, eax
mov dword [ebp - 0xabc], ecx
mov dword [ebp - 0xad4], edx
cmp ecx, 3
jb 0xb32c53
mov eax, dword [ebp - 0xad0]
mov edi, esi
xor ecx, ecx
mov dword [ebp - 0xaf4], edi
mov esi, ecx
mov dword [ebp - 0xab0], eax
jmp 0xb32415
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb32dae
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb3240d
mov ebx, 0x80004005
jmp 0xb3240d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb32dd5
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
mov edi, dword [ebp - 0xaf4]
js 0xb32413
mov ebx, 0x80004005
jmp 0xb32413
xor ecx, ecx
mov eax, dword [ebp - 0xadc]
test eax, eax
je 0xb32e06
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb33840
mov eax, dword [edi]
xor ecx, ecx
mov esi, dword [0xc930b4]
mov ebx, ecx
mov dword [ebp - 0xaa8], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0xaa4], eax
mov eax, dword [edi + 8]
mov edi, ecx
push ecx
mov dword [ebp - 0xaa0], eax
lea eax, [ebp - 0xe0c]
push eax
push ecx
mov dword [ebp - 0xe08], ecx
mov dword [ebp - 0xe04], ecx
mov ecx, esi
push 0x42
mov dword [ebp - 0xe0c], 0xc
call dword [0xc99200]
call esi
test eax, eax
jne 0xb32e83
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb32e7a
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb32e8c
mov ebx, 0x80004005
jmp 0xb32e8c
mov edi, dword [ebp - 0xe08]
and edi, 1
mov dword [ebp - 0xaac], edi
test ebx, ebx
js 0xb33840
mov edi, dword [ebp - 0xae0]
mov eax, edi
push 0x2a
pop ecx
mov dword [ebp - 0xadc], ecx
sub eax, 1
je 0xb32ed9
sub eax, 1
je 0xb32ecd
sub eax, 1
jne 0xb32ee9
mov ebx, 0xe1
mov dword [ebp - 0xab8], ebx
mov dword [ebp - 0xb04], ebx
jmp 0xb32ee9
mov dword [ebp - 0xab8], 0xf
jmp 0xb32edf
mov dword [ebp - 0xab8], ecx
mov dword [ebp - 0xb04], 0xb
mov esi, 0xdc
mov dword [ebp - 0xacc], 0x60
push esi
xor ebx, ebx
lea eax, [ebp - 0x740]
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov word [ebp - 0x6fc], si
mov esi, dword [0xc93070]
lea eax, [ebp - 0x740]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xb32fe1
mov eax, dword [ebp - 0x694]
movzx ebx, word [ebp - 0x69a]
mov ecx, dword [ebp - 0x690]
push 0x60
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xe2c], eax
pop eax
mov dword [ebp - 0xacc], ebx
mov dword [ebp - 0xad4], ecx
mov dword [ebp - 0xe28], ecx
cmp ebx, eax
jae 0xb32f72
mov dword [ebp - 0xacc], eax
xor ebx, ebx
cmp edi, 1
mov edi, dword [ebp - 0xac0]
je 0xb32f85
mov edi, dword [ebp - 0xac4]
push 0x5c
lea eax, [ebp - 0x660]
push ebx
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0xad0], eax
test eax, eax
jne 0xb32ffe
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb32fd1
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb3309e
mov ebx, 0x80004005
jmp 0xb33840
mov eax, dword [ebp - 0xe28]
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0xe2c]
mov dword [ebp - 0xabc], eax
jmp 0xb32f74
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0xacc]
push dword [ebp - 0xab8]
call dword [0xc99200]
call esi
push edi
push 0x20
neg eax
mov dword [ebp - 0x650], 0x190
pop edx
lea ecx, [ebp - 0x644]
mov dword [ebp - 0x660], eax
mov byte [ebp - 0x646], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0x660]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb3307f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb33076
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb33085
mov ebx, 0x80004005
jmp 0xb33085
mov dword [ebp - 0xa9c], eax
push dword [ebp - 0xad0]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb33840
cmp dword [ebp - 0xae0], 1
je 0xb330bb
mov eax, dword [ebp - 0xac4]
mov dword [ebp - 0xac0], eax
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0x5a0]
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov edi, eax
test edi, edi
jne 0xb33112
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb33107
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb331b2
jmp 0xb32fd7
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0xacc]
push dword [ebp - 0xb04]
call dword [0xc99200]
call esi
push dword [ebp - 0xac0]
neg eax
mov dword [ebp - 0x590], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x584]
mov dword [ebp - 0x5a0], eax
mov byte [ebp - 0x586], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0x5a0]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb33198
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb3318f
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb3319e
mov ebx, 0x80004005
jmp 0xb3319e
mov dword [ebp - 0xa98], eax
mov esi, dword [0xc930b0]
xor eax, eax
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb33840
mov ebx, dword [ebp - 0xae0]
xor eax, eax
mov ecx, eax
mov edx, eax
mov eax, ebx
sub eax, 1
je 0xb331d7
sub eax, 1
je 0xb33217
sub eax, 1
jne 0xb331e3
mov ecx, dword [ebp - 0xabc]
mov edx, dword [ebp - 0xad4]
mov dword [ebp - 0x3a8], ecx
mov dword [ebp - 0x3a4], edx
xor edx, edx
inc edx
cmp ebx, edx
je 0xb33257
lea eax, [ebx - 2]
xor ebx, ebx
cmp eax, edx
ja 0xb3322b
mov eax, ebx
mov dword [ebp - 0xadc], ebx
mov edx, ebx
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xac0], ebx
jmp 0xb33270
mov eax, dword [ebp - 0xabc]
push 4
cdq
pop ecx
idiv ecx
mov ecx, eax
xor eax, eax
mov edx, eax
jmp 0xb331e3
mov eax, dword [ebp - 0xb30]
mov edx, dword [ebp - 0xb30]
mov dword [ebp - 0xac0], eax
mov eax, dword [ebp - 0xb30]
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0xb30]
mov dword [ebp - 0xb04], eax
jmp 0xb33270
xor ebx, ebx
mov dword [ebp - 0xac0], 0x20
mov edx, 0x96
mov dword [ebp - 0xb04], ebx
mov eax, ebx
mov dword [ebp - 0xab8], edx
push dword [ebp - 0xa9c]
mov esi, dword [0xc9303c]
sub ecx, edx
push dword [ebp - 0xad8]
mov edi, dword [ebp - 0xaa8]
sub ecx, eax
mov dword [ebp - 0xac4], ecx
mov dword [ebp - 0xa74], ecx
mov dword [ebp - 0xa84], ecx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
mov dword [ebp - 0xabc], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0xa8c]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xad8]
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb332e6
mov ebx, 0x80004005
mov eax, dword [ebp - 0xabc]
test eax, eax
je 0xb33302
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb33840
push dword [ebp - 0xa98]
mov esi, dword [0xc9303c]
xor eax, eax
push dword [ebp - 0xad8]
mov edi, dword [ebp - 0xaa4]
mov ecx, esi
mov ebx, eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
mov dword [ebp - 0xabc], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0xa7c]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xad8]
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb33368
mov ebx, 0x80004005
mov eax, dword [ebp - 0xabc]
test eax, eax
je 0xb33384
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb33840
mov eax, dword [ebp - 0xae0]
cmp eax, 2
je 0xb333a4
cmp eax, 3
je 0xb333a4
mov edi, dword [ebp - 0xac4]
jmp 0xb333b8
mov edi, dword [ebp - 0xa74]
cmp dword [ebp - 0xa84], edi
jle 0xb333b8
mov edi, dword [ebp - 0xa84]
cmp dword [ebp - 0xab0], 0
mov esi, dword [0xc930a8]
mov ecx, esi
push dword [ebp - 0xadc]
je 0xb333f9
mov ebx, dword [ebp - 0xb04]
mov eax, ebx
sub eax, dword [ebp - 0xa84]
add eax, edi
push eax
lea eax, [ebp - 0xa8c]
push eax
call dword [0xc99200]
call esi
sub ebx, dword [ebp - 0xa74]
add ebx, edi
jmp 0xb3340f
mov ebx, dword [ebp - 0xab8]
lea eax, [ebp - 0xa8c]
push ebx
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xa80]
add eax, dword [ebp - 0xac0]
mov esi, dword [0xc930a8]
mov ecx, esi
push eax
push ebx
lea eax, [ebp - 0xa7c]
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xae0]
cmp eax, 2
je 0xb33703
cmp eax, 3
je 0xb33703
cmp eax, 1
jne 0xb3371f
xor eax, eax
mov dword [ebp - 0xa90], 0xffffff
push 0x5c
push eax
lea eax, [ebp - 0x600]
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0xab8], eax
test eax, eax
jne 0xb334ba
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb334af
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb3355b
jmp 0xb32fd7
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0xacc]
push 0xb
call dword [0xc99200]
call esi
push dword [ebp - 0xac8]
neg eax
mov dword [ebp - 0x5f0], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x5e4]
mov dword [ebp - 0x600], eax
mov byte [ebp - 0x5e6], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0x600]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb3353c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb33533
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb33542
mov ebx, 0x80004005
jmp 0xb33542
mov dword [ebp - 0xa94], eax
push dword [ebp - 0xab8]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb33840
push dword [ebp - 0xa94]
mov esi, dword [0xc9303c]
xor eax, eax
push dword [ebp - 0xad8]
mov dword [ebp - 0xa64], edi
mov ecx, esi
mov edi, dword [ebp - 0xaa0]
mov ebx, eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
mov dword [ebp - 0xab8], eax
xor eax, eax
push eax
push 0x460
lea eax, [ebp - 0xa6c]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xad8]
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb335c7
mov ebx, 0x80004005
mov eax, dword [ebp - 0xab8]
test eax, eax
je 0xb335e3
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb33840
mov eax, dword [ebp - 0xa64]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0xa64], eax
cmp eax, ecx
jge 0xb33607
mov dword [ebp - 0xa64], ecx
mov ebx, dword [ebp - 0xacc]
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x60
pop edi
push edi
push ebx
push dword [ebp - 0xa6c]
mov dword [ebp - 0xa60], 0x20
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0xa68]
mov dword [ebp - 0xa6c], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0xa64]
mov dword [ebp - 0xa68], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0xa60]
mov dword [ebp - 0xa64], eax
call dword [0xc99200]
call esi
cmp dword [ebp - 0xab0], 0
mov esi, dword [0xc930a8]
mov dword [ebp - 0xa60], eax
je 0xb336ea
mov ecx, dword [ebp - 0xa70]
mov eax, dword [ebp - 0xa8c]
add ecx, 0x24
cmp eax, dword [ebp - 0xa7c]
jl 0xb336be
mov eax, dword [ebp - 0xa7c]
push ecx
jmp 0xb336d6
mov ecx, dword [ebp - 0xa74]
push eax
mov eax, dword [ebp - 0xa6c]
sub eax, dword [ebp - 0xa64]
add eax, ecx
push eax
lea eax, [ebp - 0xa6c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
jmp 0xb3371f
mov eax, dword [ebp - 0xa70]
mov ecx, dword [ebp - 0xa84]
add eax, 0x24
cmp ecx, dword [ebp - 0xa74]
jg 0xb336c7
jmp 0xb336c1
mov eax, dword [ebp - 0xa70]
mov dword [ebp - 0x3a8], edi
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 0xa90], 0xffa8a8a8
mov eax, dword [ebp - 0xab0]
mov ebx, dword [ebp - 0x3a8]
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0xb04], eax
mov eax, dword [ebp - 0xae0]
sub eax, 1
je 0xb33a56
sub eax, 1
je 0xb339a3
sub eax, 1
jne 0xb3383e
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x460]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push 1
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x460]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x460], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xb3383e
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x44c]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x444]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x444]
lea esi, [ebp - 0x44c]
sub eax, ebx
lea edi, [ebp - 0xe44]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x440]
sub eax, dword [ebp - 0xb04]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
jmp 0xb33835
mov eax, dword [ebp - 0x41c]
sub eax, ebx
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x418]
sub eax, dword [ebp - 0xb04]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x3ac], eax
xor ebx, ebx
push dword [ebp - 0xad8]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov edi, 0xc96238
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xb3385e
mov eax, dword [0xc95890]
test eax, eax
jle 0xb338c1
sub eax, 1
mov dword [0xc95890], eax
jne 0xb338c1
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb33893
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb33882
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
mov eax, dword [ebp - 0xaf4]
test eax, eax
je 0xb338e0
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb35032
mov edi, dword [ebp - 0x3b0]
xor eax, eax
mov ebx, dword [ebp - 0x3ac]
push 0x54
push eax
lea eax, [ebp - 0xa00]
mov dword [ebp - 0xdc0], edi
push eax
mov dword [ebp - 0xdbc], ebx
call fcn.00ab4bf6
mov esi, dword [0xc93028]
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0xab8], 1
push 7
push dword [ebp - 0xaf8]
call dword [0xc99200]
call esi
test eax, eax
je 0xb33983
mov esi, dword [0xc93034]
lea ecx, [ebp - 0xa00]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb33983
push 0x20
pop eax
cmp word [ebp - 0x9ee], ax
jne 0xb33983
cmp dword [ebp - 0x9ec], 0
je 0xb33983
cmp dword [ebp - 0x9fc], 0
jle 0xb33983
cmp dword [ebp - 0x9f8], 0
jg 0xb33a69
xor eax, eax
cmp dword [ebp - 0xae0], 1
mov dword [ebp - 0xab8], eax
je 0xb33a69
mov ebx, dword [ebp - 0xae0]
jmp 0xb33ad1
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x438]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push 1
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x438]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x438], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xb3383e
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x424]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x41c]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
cmp dword [ebp - 0xab8], 0
lea esi, [ebp - 0x424]
lea edi, [ebp - 0xe44]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0xb33812
imul eax, dword [ebp - 0x41c], 5
cdq
idiv ecx
add eax, dword [ebp - 0x424]
jmp 0xb33820
xor ebx, ebx
mov dword [ebp - 0x3b0], ebx
mov dword [ebp - 0x3ac], ebx
jmp 0xb33840
mov esi, dword [0xc930a8]
lea eax, [ebp - 0xa8c]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc930a8]
lea eax, [ebp - 0xa7c]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov ebx, dword [ebp - 0xae0]
cmp ebx, 1
jne 0xb33ad1
mov eax, dword [ebp - 0xaac]
mov esi, dword [0xc93014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0xb10], eax
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push dword [ebp - 0xaf8]
call dword [0xc99200]
call esi
cmp dword [ebp - 0xab0], 0
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xaf4], 0x810
je 0xb33b0c
mov dword [ebp - 0xaf4], 0x20812
cmp dword [ebp - 0xab8], 0
je 0xb3461d
mov eax, dword [ebp - 0xaac]
mov ebx, dword [ebp - 0xaa8]
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0xa9c]
mov dword [ebp - 0xac0], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x9a8]
mov dword [ebp - 0xac8], ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x950]
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xadc], eax
push 0x2c
push eax
mov dword [ebp - 0xacc], eax
lea eax, [ebp - 0x48c]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x3c0]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xb35012
mov esi, dword [0xc93028]
mov ecx, esi
mov ebx, dword [ebp - 0xaf8]
push 7
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xb347b1
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x9a8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb33c08
mov eax, dword [ebp - 0x994]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0x9a0]
mov dword [ebp - 0xacc], eax
mov esi, dword [0xc93008]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov ebx, eax
mov dword [ebp - 0xabc], ebx
test ebx, ebx
je 0xb347b1
mov eax, dword [ebp - 0xa84]
xor ecx, ecx
sub eax, dword [ebp - 0xa8c]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x488], eax
mov eax, dword [ebp - 0xa88]
sub eax, dword [ebp - 0xa80]
mov dword [ebp - 0x484], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc50], ecx
mov word [ebp - 0x480], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x47e], ax
lea eax, [ebp - 0xc50]
push eax
push ecx
lea eax, [ebp - 0x48c]
mov dword [ebp - 0xad4], ecx
push eax
mov dword [ebp - 0x47c], ecx
mov dword [ebp - 0x478], ecx
mov dword [ebp - 0x474], ecx
mov dword [ebp - 0x470], ecx
mov dword [ebp - 0x46c], ecx
mov dword [ebp - 0x468], ecx
mov dword [ebp - 0x464], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x48c], 0x28
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0xad0], edi
test edi, edi
jne 0xb33d06
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xad4], eax
test eax, eax
jle 0xb33cf1
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xad4], eax
test eax, eax
js 0xb34074
mov dword [ebp - 0xad4], 0x80004005
jmp 0xb34074
mov esi, dword [0xc93034]
lea eax, [ebp - 0x950]
push eax
push 0x54
push edi
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb33d30
mov eax, dword [ebp - 0x93c]
mov dword [ebp - 0xad8], eax
mov eax, dword [ebp - 0xa84]
sub eax, dword [ebp - 0xa8c]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0xa80]
sub eax, dword [ebp - 0xa88]
push edi
push ebx
mov dword [ebp - 0x3b4], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push ebx
call dword [0xc99200]
call esi
push dword [ebp - 0xac0]
mov esi, dword [0xc9303c]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0xac0], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x3c0]
mov ecx, edi
push eax
push ebx
call dword [0xc99200]
call edi
mov esi, dword [0xc9306c]
xor eax, eax
push eax
push dword [ebp - 0xaf4]
lea eax, [ebp - 0x3c0]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xac8]
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0xae0], 1
jne 0xb33e23
cmp dword [ebp - 0xab8], 0
je 0xb33e17
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [ebp - 0xab8], eax
jmp 0xb33e2d
mov dword [ebp - 0xab8], 0xffffff
jmp 0xb33e2d
mov dword [ebp - 0xab8], 0xffa8a8a8
mov esi, dword [ebp - 0xa8c]
xor edx, edx
mov eax, dword [ebp - 0xa88]
mov edi, edx
mov dword [ebp - 0xac8], esi
mov ecx, edx
test esi, esi
jns 0xb33e55
mov edi, esi
mov dword [ebp - 0xac8], edx
neg edi
mov esi, edx
test eax, eax
jns 0xb33e5f
mov ecx, eax
mov eax, edx
neg ecx
mov edx, dword [ebp - 0xadc]
sub edx, esi
mov esi, dword [ebp - 0x3b8]
sub esi, edi
mov dword [ebp - 0xaec], esi
cmp esi, edx
jl 0xb33e81
mov esi, edx
mov dword [ebp - 0xaec], edx
mov edx, dword [ebp - 0x3b4]
sub dword [ebp - 0xacc], eax
sub edx, ecx
mov dword [ebp - 0xab4], edx
cmp edx, dword [ebp - 0xacc]
jl 0xb33ea9
mov edx, dword [ebp - 0xacc]
mov dword [ebp - 0xab4], edx
test esi, esi
jle 0xb34042
test edx, edx
jle 0xb34042
mov edx, dword [ebp - 0x3b8]
imul eax, dword [ebp - 0xadc]
imul ecx, edx
shl edx, 2
add eax, dword [ebp - 0xac8]
add ecx, edi
mov edi, dword [ebp - 0xad8]
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0xac4]
mov dword [ebp - 0xac4], edx
mov edx, dword [ebp - 0xadc]
shl edx, 2
lea eax, [edi + eax*4]
mov dword [ebp - 0xad8], ecx
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xadc], edx
mov ebx, eax
mov dword [ebp - 0xae4], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0xacc], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xae8], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xb33fe9
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xab8]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xae8]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xacc]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xab8]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xab6]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xae4]
cdq
idiv ecx
mov edx, dword [ebp - 0xacc]
add al, bl
mov ebx, dword [ebp - 0xae8]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xae4], esi
jne 0xb33f23
mov ecx, dword [ebp - 0xad8]
mov eax, dword [ebp - 0xac8]
add ecx, dword [ebp - 0xac4]
add eax, dword [ebp - 0xadc]
sub dword [ebp - 0xab4], 1
mov esi, dword [ebp - 0xaec]
mov dword [ebp - 0xad8], ecx
mov dword [ebp - 0xac8], eax
jne 0xb33f07
mov ebx, dword [ebp - 0xabc]
push dword [ebp - 0xad0]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xac0]
test eax, eax
je 0xb34074
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0xad4], 0
jl 0xb35012
mov eax, dword [ebp - 0xaac]
mov ebx, dword [ebp - 0xaa4]
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0xa98]
mov dword [ebp - 0xac0], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x8f8]
mov dword [ebp - 0xac8], ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x8a0]
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xadc], eax
push 0x2c
push eax
mov dword [ebp - 0xacc], eax
lea eax, [ebp - 0x53c]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x3d0]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xb35012
mov esi, dword [0xc93028]
mov ecx, esi
mov ebx, dword [ebp - 0xaf8]
push 7
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xb347b1
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x8f8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb34181
mov eax, dword [ebp - 0x8e4]
mov dword [ebp - 0xac4], eax
mov eax, dword [ebp - 0x8f4]
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0x8f0]
mov dword [ebp - 0xacc], eax
mov esi, dword [0xc93008]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov ebx, eax
mov dword [ebp - 0xabc], ebx
test ebx, ebx
je 0xb347b1
mov eax, dword [ebp - 0xa74]
xor ecx, ecx
sub eax, dword [ebp - 0xa7c]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x538], eax
mov eax, dword [ebp - 0xa78]
sub eax, dword [ebp - 0xa70]
mov dword [ebp - 0x534], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc54], ecx
mov word [ebp - 0x530], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x52e], ax
lea eax, [ebp - 0xc54]
push eax
push ecx
lea eax, [ebp - 0x53c]
mov dword [ebp - 0xad4], ecx
push eax
mov dword [ebp - 0x52c], ecx
mov dword [ebp - 0x528], ecx
mov dword [ebp - 0x524], ecx
mov dword [ebp - 0x520], ecx
mov dword [ebp - 0x51c], ecx
mov dword [ebp - 0x518], ecx
mov dword [ebp - 0x514], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x53c], 0x28
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0xad0], edi
test edi, edi
jne 0xb3427f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xad4], eax
test eax, eax
jle 0xb3426a
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xad4], eax
test eax, eax
js 0xb345f4
mov dword [ebp - 0xad4], 0x80004005
jmp 0xb345f4
mov esi, dword [0xc93034]
lea eax, [ebp - 0x8a0]
push eax
push 0x54
push edi
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb342a9
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0xad8], eax
mov eax, dword [ebp - 0xa74]
sub eax, dword [ebp - 0xa7c]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0xa70]
sub eax, dword [ebp - 0xa78]
push edi
push ebx
mov dword [ebp - 0x3c4], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push ebx
call dword [0xc99200]
call esi
push dword [ebp - 0xac0]
mov esi, dword [0xc9303c]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0xac0], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x3d0]
mov ecx, edi
push eax
push ebx
call dword [0xc99200]
call edi
mov esi, dword [0xc9306c]
xor eax, eax
push eax
push dword [ebp - 0xaf4]
lea eax, [ebp - 0x3d0]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xac8]
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0xae0], 1
jne 0xb34396
cmp dword [ebp - 0xab8], 0
je 0xb3438a
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
jmp 0xb3439b
mov dword [ebp - 0xae0], 0xffffff
jmp 0xb343a7
mov eax, 0xffa8a8a8
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xb3c], eax
mov edx, dword [ebp - 0xa7c]
xor ecx, ecx
mov eax, dword [ebp - 0xa78]
mov edi, ecx
mov dword [ebp - 0xab8], edx
test edx, edx
jns 0xb343cf
mov edi, edx
neg edi
xor edx, edx
mov dword [ebp - 0xab8], edx
jmp 0xb343d1
xor edx, edx
test eax, eax
jns 0xb343db
mov ecx, eax
mov eax, edx
neg ecx
mov esi, dword [ebp - 0x3c8]
mov edx, dword [ebp - 0xadc]
sub esi, edi
sub edx, dword [ebp - 0xab8]
mov dword [ebp - 0xaf4], esi
cmp esi, edx
jl 0xb34401
mov esi, edx
mov dword [ebp - 0xaf4], edx
mov edx, dword [ebp - 0x3c4]
sub dword [ebp - 0xacc], eax
sub edx, ecx
mov dword [ebp - 0xac8], edx
cmp edx, dword [ebp - 0xacc]
jl 0xb34429
mov edx, dword [ebp - 0xacc]
mov dword [ebp - 0xac8], edx
test esi, esi
jle 0xb345c2
test edx, edx
jle 0xb345c2
mov edx, dword [ebp - 0x3c8]
imul eax, dword [ebp - 0xadc]
imul ecx, edx
shl edx, 2
add eax, dword [ebp - 0xab8]
add ecx, edi
mov edi, dword [ebp - 0xad8]
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0xac4]
mov dword [ebp - 0xac4], edx
mov edx, dword [ebp - 0xadc]
shl edx, 2
lea eax, [edi + eax*4]
mov dword [ebp - 0xad8], ecx
mov dword [ebp - 0xab8], eax
mov dword [ebp - 0xadc], edx
mov ebx, eax
mov dword [ebp - 0xab4], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0xacc], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xaec], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xb34569
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xb3c]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaec]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xacc]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xb3c]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xade]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xab4]
cdq
idiv ecx
mov edx, dword [ebp - 0xacc]
add al, bl
mov ebx, dword [ebp - 0xaec]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xab4], esi
jne 0xb344a3
mov ecx, dword [ebp - 0xad8]
mov eax, dword [ebp - 0xab8]
add ecx, dword [ebp - 0xac4]
add eax, dword [ebp - 0xadc]
sub dword [ebp - 0xac8], 1
mov esi, dword [ebp - 0xaf4]
mov dword [ebp - 0xad8], ecx
mov dword [ebp - 0xab8], eax
jne 0xb34487
mov ebx, dword [ebp - 0xabc]
push dword [ebp - 0xad0]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xac0]
test eax, eax
je 0xb345f4
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0xad4], 0
jl 0xb35012
mov edi, dword [ebp - 0xafc]
jmp 0xb35b2a
cmp dword [ebp - 0xaac], 0
jne 0xb3462f
cmp ebx, 1
je 0xb3462f
mov al, 0xc0
jmp 0xb34631
or al, 0xff
mov esi, dword [0xc93008]
xor ecx, ecx
push dword [ebp - 0xaf8]
mov byte [ebp - 0xab6], al
mov edi, ecx
mov eax, ecx
mov word [ebp - 0xab8], cx
mov dword [ebp - 0xac0], ecx
mov dword [ebp - 0xac8], ecx
mov dword [ebp - 0xe4c], ecx
mov dword [ebp - 0xe48], ecx
mov dword [ebp - 0xac4], ecx
mov dword [ebp - 0xe60], ecx
mov dword [ebp - 0xe5c], ecx
mov dword [ebp - 0xe58], ecx
mov ecx, esi
mov byte [ebp - 0xab5], 1
mov dword [ebp - 0xe54], edi
mov dword [ebp - 0xe50], eax
mov dword [ebp - 0xe64], eax
call dword [0xc99200]
call esi
mov dword [ebp - 0xafc], eax
test eax, eax
je 0xb347b1
cmp ebx, 1
jne 0xb347bc
mov eax, dword [ebp - 0xa84]
mov ecx, dword [ebp - 0xa74]
sub ecx, dword [ebp - 0xa7c]
sub eax, dword [ebp - 0xa8c]
mov dword [ebp - 0xad8], ecx
cmp ecx, eax
jg 0xb346e4
mov ecx, eax
mov dword [ebp - 0xad8], eax
mov edx, dword [ebp - 0xa70]
xor eax, eax
sub edx, dword [ebp - 0xa88]
mov ebx, eax
mov dword [ebp - 0xadc], edx
cmp dword [ebp - 0xab0], eax
je 0xb34738
mov edi, dword [ebp - 0xa8c]
sub edi, dword [ebp - 0xa84]
mov eax, dword [ebp - 0xa7c]
add edi, ecx
sub eax, dword [ebp - 0xa74]
mov ebx, edi
add eax, ecx
mov dword [ebp - 0xac0], edi
mov dword [ebp - 0xe54], edi
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xe64], eax
sub eax, dword [ebp - 0xa7c]
add eax, dword [ebp - 0xa74]
mov edi, dword [ebp - 0xa80]
sub edi, dword [ebp - 0xa88]
sub ebx, dword [ebp - 0xa8c]
add ebx, dword [ebp - 0xa84]
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xe5c], eax
mov eax, dword [ebp - 0xa78]
sub eax, dword [ebp - 0xa88]
mov dword [ebp - 0xacc], edi
mov dword [ebp - 0xe48], edi
mov edi, eax
sub edi, dword [ebp - 0xa78]
add edi, dword [ebp - 0xa70]
mov dword [ebp - 0xe4c], ebx
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xe60], eax
mov dword [ebp - 0xad0], edi
mov dword [ebp - 0xe58], edi
jmp 0xb3484e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb35012
lea esi, [ebp - 0xa8c]
mov ecx, dword [ebp - 0x3a8]
lea edi, [ebp - 0xe54]
mov edx, dword [ebp - 0x3a4]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xad8], ecx
mov dword [ebp - 0xadc], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xe48]
lea esi, [ebp - 0xa7c]
mov ebx, dword [ebp - 0xe4c]
lea edi, [ebp - 0xe64]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xacc], eax
mov eax, dword [ebp - 0xe50]
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0xe54]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xac0], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xe58]
mov dword [ebp - 0xad0], eax
mov eax, dword [ebp - 0xe5c]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0xe60]
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0xe64]
mov dword [ebp - 0xac4], eax
mov esi, dword [0xc9300c]
xor eax, eax
mov edi, dword [ebp - 0xafc]
neg edx
push 0x20
mov dword [ebp - 0xc58], eax
mov dword [ebp - 0x4a8], eax
mov dword [ebp - 0x4a4], eax
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 0x49c], eax
mov dword [ebp - 0x498], eax
mov dword [ebp - 0x494], eax
mov dword [ebp - 0x490], eax
inc eax
mov word [ebp - 0x4ac], ax
pop eax
mov dword [ebp - 0x4b4], ecx
xor ecx, ecx
push ecx
push ecx
mov word [ebp - 0x4aa], ax
lea eax, [ebp - 0xc58]
push eax
push ecx
lea eax, [ebp - 0x4b8]
mov dword [ebp - 0x4b8], 0x28
push eax
push edi
mov ecx, esi
mov dword [ebp - 0x4b0], edx
call dword [0xc99200]
call esi
mov dword [ebp - 0xb0c], eax
test eax, eax
jne 0xb348e9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb34ffd
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0xae0], 1
jne 0xb3494d
mov ecx, dword [ebp - 0xb10]
test ecx, ecx
je 0xb3494d
mov esi, dword [0xc93074]
xor eax, eax
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 0x3dc], eax
mov eax, dword [ebp - 0xad8]
mov dword [ebp - 0x3d8], eax
mov eax, dword [ebp - 0xadc]
push ecx
mov dword [ebp - 0x3d4], eax
mov ecx, esi
lea eax, [ebp - 0x3e0]
push eax
push edi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xaac]
mov esi, dword [ebp - 0xaa8]
mov dword [ebp - 0xaec], eax
mov eax, dword [ebp - 0xa9c]
mov dword [ebp - 0xab4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x848]
mov dword [ebp - 0xae8], esi
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x7f0]
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0xb00], eax
push 0x2c
push eax
mov dword [ebp - 0xb14], eax
lea eax, [ebp - 0x510]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x3a0]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xafc]
test esi, esi
je 0xb34fe2
mov esi, dword [0xc93028]
mov ecx, esi
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
je 0xb34b3a
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x848]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb34a3c
mov eax, dword [ebp - 0x834]
mov dword [ebp - 0xae4], eax
mov eax, dword [ebp - 0x844]
mov dword [ebp - 0xb00], eax
mov eax, dword [ebp - 0x840]
mov dword [ebp - 0xb14], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0xb50], ecx
test ecx, ecx
je 0xb34b3a
mov eax, dword [ebp - 0xac8]
xor edx, edx
mov edi, dword [ebp - 0xacc]
sub eax, edi
sub ebx, dword [ebp - 0xac0]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x508], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc5c], edx
mov word [ebp - 0x504], ax
pop eax
push edx
push edx
mov word [ebp - 0x502], ax
lea eax, [ebp - 0xc5c]
push eax
push edx
lea eax, [ebp - 0x510]
mov dword [ebp - 0xb80], edx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x500], edx
mov dword [ebp - 0x4fc], edx
mov dword [ebp - 0x4f8], edx
mov dword [ebp - 0x4f4], edx
mov dword [ebp - 0x4f0], edx
mov dword [ebp - 0x4ec], edx
mov dword [ebp - 0x4e8], edx
mov dword [ebp - 0x510], 0x28
mov dword [ebp - 0x50c], ebx
call dword [0xc99200]
call esi
mov dword [ebp - 0xacc], eax
test eax, eax
jne 0xb34b45
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xb80], eax
test eax, eax
jle 0xb34b1f
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb80], eax
test eax, eax
mov edi, dword [ebp - 0xb50]
js 0xb34ea8
mov dword [ebp - 0xb80], 0x80004005
jmp 0xb34ea8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb34fe2
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x7f0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb34b6f
mov eax, dword [ebp - 0x7dc]
mov dword [ebp - 0xaf0], eax
push dword [ebp - 0xacc]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x398], ebx
mov ebx, dword [ebp - 0xac8]
sub edi, ebx
mov dword [ebp - 0x394], edi
mov edi, dword [ebp - 0xb50]
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0xab4]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0xac8], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
mov esi, dword [ebp - 0xb50]
mov ecx, edi
push eax
lea eax, [ebp - 0x3a0]
push eax
push esi
call dword [0xc99200]
call edi
xor eax, eax
push eax
push dword [ebp - 0xaf4]
lea eax, [ebp - 0x3a0]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xae8]
push esi
mov esi, dword [0xc9306c]
mov ecx, esi
call dword [0xc99200]
call esi
cmp dword [ebp - 0xae0], 1
jne 0xb34c63
cmp dword [ebp - 0xaec], 0
je 0xb34c57
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [ebp - 0xaec], eax
jmp 0xb34c6d
mov dword [ebp - 0xaec], 0xffffff
jmp 0xb34c6d
mov dword [ebp - 0xaec], 0xffa8a8a8
mov ecx, dword [ebp - 0xac0]
xor edx, edx
mov edi, edx
mov eax, edx
test ecx, ecx
jns 0xb34c83
mov edi, ecx
mov ecx, edx
neg edi
test ebx, ebx
jns 0xb34c8d
mov eax, ebx
mov ebx, edx
neg eax
mov esi, dword [ebp - 0x398]
mov edx, dword [ebp - 0xb00]
sub esi, edi
sub edx, ecx
mov dword [ebp - 0xac0], esi
cmp esi, edx
jl 0xb34caf
mov esi, edx
mov dword [ebp - 0xac0], edx
mov edx, dword [ebp - 0x394]
sub dword [ebp - 0xb14], ebx
sub edx, eax
mov dword [ebp - 0xab4], edx
cmp edx, dword [ebp - 0xb14]
jl 0xb34cd7
mov edx, dword [ebp - 0xb14]
mov dword [ebp - 0xab4], edx
test esi, esi
jle 0xb34e70
test edx, edx
jle 0xb34e70
imul eax, dword [ebp - 0x398]
add eax, edi
mov edi, dword [ebp - 0xaf0]
lea edi, [edi + eax*4]
mov eax, dword [ebp - 0xb00]
imul eax, ebx
mov dword [ebp - 0xae8], edi
add eax, ecx
mov ecx, dword [ebp - 0xae4]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x398]
shl ecx, 2
mov dword [ebp - 0xaf0], ecx
mov ecx, dword [ebp - 0xb00]
shl ecx, 2
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xb00], ecx
mov ebx, eax
mov dword [ebp - 0xb40], esi
add edi, 2
lea edx, [eax + 3]
sub ebx, dword [ebp - 0xae8]
mov dword [ebp - 0xb14], edx
mov dword [ebp - 0xb34], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xb34e1d
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xaec]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb34]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xb14]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xaec]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb14]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xaea]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb14]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xb40]
cdq
idiv ecx
mov edx, dword [ebp - 0xb14]
add al, bl
mov ebx, dword [ebp - 0xb34]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0xb14], edx
mov dword [ebp - 0xb40], esi
jne 0xb34d57
mov edi, dword [ebp - 0xae8]
mov eax, dword [ebp - 0xae4]
add edi, dword [ebp - 0xaf0]
add eax, dword [ebp - 0xb00]
sub dword [ebp - 0xab4], 1
mov esi, dword [ebp - 0xac0]
mov dword [ebp - 0xae8], edi
mov dword [ebp - 0xae4], eax
jne 0xb34d37
push dword [ebp - 0xacc]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xac8]
mov edi, dword [ebp - 0xb50]
test eax, eax
je 0xb34ea8
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0xb80], 0
jl 0xb34fdc
mov eax, dword [ebp - 0xaac]
mov ebx, dword [ebp - 0xaa4]
mov dword [ebp - 0xac0], eax
mov eax, dword [ebp - 0xa98]
mov dword [ebp - 0xac8], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x798]
mov dword [ebp - 0xacc], ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa58]
push eax
call fcn.00ab4bf6
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xaec], eax
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xae8], eax
push 0x2c
push eax
mov dword [ebp - 0xae4], eax
lea eax, [ebp - 0x4e4]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x3f0]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xafc]
test ebx, ebx
je 0xb34fe2
mov esi, dword [0xc93028]
mov ecx, esi
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
je 0xb34b3a
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x798]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb34fb5
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0xaec], eax
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0x790]
mov dword [ebp - 0xae4], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0xaf0], edi
test edi, edi
jne 0xb35634
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, dword [ebp - 0xafc]
mov eax, dword [ebp - 0xb0c]
test eax, eax
je 0xb34ffd
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
test edi, edi
je 0xb35012
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xb10]
test eax, eax
je 0xb3502d
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov edi, 0xc96238
mov ecx, dword [ebp - 0xaa8]
xor ebx, ebx
test ecx, ecx
je 0xb35083
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xb35041
mov eax, dword [ebp - 0xaa8]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xb35069
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xb35061
push dword [ebp - 0xaa8]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xaa8], ebx
mov ecx, dword [ebp - 0xaa4]
test ecx, ecx
je 0xb350d2
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xb35090
mov eax, dword [ebp - 0xaa4]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xb350b8
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xb350b0
push dword [ebp - 0xaa4]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xaa4], ebx
mov edx, dword [ebp - 0xaa0]
test edx, edx
je 0xb3511e
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xb350e1
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xb35109
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0xb350fb
mov edx, dword [ebp - 0xaa0]
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0xaa0], ebx
cmp dword [ebp - 0xa9c], 0
je 0xb35143
push dword [ebp - 0xa9c]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0xa9c], ebx
cmp dword [ebp - 0xa98], 0
je 0xb35168
push dword [ebp - 0xa98]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0xa98], ebx
cmp dword [ebp - 0xa94], 0
je 0xb3518d
push dword [ebp - 0xa94]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0xa94], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xb3518f
mov eax, dword [0xc95890]
test eax, eax
jle 0xb351f2
sub eax, 1
mov dword [0xc95890], eax
jne 0xb351f2
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb351c4
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb351b3
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0xc95878]
mov esi, dword [0xc9304c]
mov ecx, esi
mov dword [ebp - 0xae0], eax
call dword [0xc99200]
call esi
sub eax, dword [0xc95870]
lea edi, [ebp - 0x2fc]
push 7
mov dword [ebp - 0xafc], eax
mov esi, 0xc96238
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xb3522f
mov eax, dword [0xc95890]
test eax, eax
jne 0xb35d31
xor ebx, ebx
push 0x338
mov esi, ebx
mov dword [ebp - 0xb0c], ebx
push ebx
mov dword [ebp - 0xb10], ebx
mov dword [ebp - 0xab8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb58], eax
test eax, eax
je 0xb35d25
or dword [ebp - 0xb28], 0xffffffff
mov cl, bl
add eax, 7
mov dword [ebp - 0xb18], ebx
mov edx, ebx
mov dword [ebp - 0xb20], eax
mov esi, dword [ebp - 0xcf0]
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xcf0]
xor ebx, edi
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xcf0]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xcf0]
shl esi, 8
add dword [ebp - 0xcf0], 8
movzx eax, byte [eax + 5]
or esi, eax
xor edx, esi
xor edx, ebx
xor edx, 0xac987321
mov dword [ebp - 0xb48], edx
lea eax, [edx + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb48]
rol eax, 0xa
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0xb48]
xor eax, edx
mov dword [ebp - 0xb48], eax
imul edx, dword [ebp - 0xb48], 0x605e
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor ebx, edx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0xb48]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb48], eax
xor edx, 0xab69605e
mov eax, 0x7f1137f
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
mov eax, dword [ebp - 0xb48]
xor eax, edx
mov dword [ebp - 0xb48], eax
add eax, 0x7f1137f
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb48]
rol eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub edx, eax
mov eax, dword [ebp - 0xb48]
xor eax, edx
mov dword [ebp - 0xb48], eax
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb48]
ror eax, 0xa
xor edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor edx, eax
xor edx, dword [ebp - 0xb48]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea eax, [ebx - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0xb48], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb48]
shr eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xb48]
xor eax, edx
mov dword [ebp - 0xb48], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor ebx, edx
mov eax, ebx
mov edx, ebx
xor eax, 0xab69
rol ebx, 7
rol eax, 5
imul eax, eax, 0x7f1
add eax, ebx
mov ebx, dword [ebp - 0xb48]
xor ebx, eax
mov dword [ebp - 0xb48], ebx
xor ebx, edx
mov edx, dword [ebp - 0xb48]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xb48], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb48]
ror eax, 6
sub edx, eax
xor ebx, edx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xb48]
xor eax, edx
mov dword [ebp - 0xb48], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb48]
ror eax, 0xe
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xb48]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xb48], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb48]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xb20]
xor edx, dword [ebp - 0xb18]
xor ebx, edx
mov dword [ebp - 0xb18], edi
mov edx, dword [ebp - 0xb48]
xor edx, dword [ebp - 0xb28]
mov byte [eax - 4], bl
mov byte [eax], dl
ror ebx, 8
mov byte [eax - 5], bl
ror edx, 8
mov byte [eax - 1], dl
ror ebx, 8
mov byte [eax - 6], bl
ror edx, 8
mov byte [eax - 2], dl
ror ebx, 8
ror edx, 8
mov byte [eax - 7], bl
mov byte [eax - 3], dl
add eax, 8
ror ebx, 8
ror edx, 8
sub dword [ebp - 0xcfc], 1
mov dword [ebp - 0xb28], esi
mov dword [ebp - 0xb20], eax
jne 0xb3529a
mov esi, dword [ebp - 0xb58]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xb355fa
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xb35b4b
cmp edx, dword [0x9fc02c]
jne 0xb35b4b
mov edi, esi
xor eax, eax
mov dword [ebp - 0xab8], edi
mov esi, eax
mov ebx, eax
jmp 0xb35b5f
mov eax, dword [ebp - 0xabc]
xor ecx, ecx
sub eax, dword [ebp - 0xac4]
mov ebx, dword [ebp - 0xad4]
mov esi, dword [0xc9300c]
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0x4e0], eax
mov eax, ebx
sub eax, dword [ebp - 0xad0]
mov dword [ebp - 0x4dc], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xc60], ecx
mov word [ebp - 0x4d8], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x4d6], ax
lea eax, [ebp - 0xc60]
push eax
push ecx
lea eax, [ebp - 0x4e4]
mov dword [ebp - 0xb00], ecx
push eax
mov dword [ebp - 0x4d4], ecx
mov dword [ebp - 0x4d0], ecx
mov dword [ebp - 0x4cc], ecx
mov dword [ebp - 0x4c8], ecx
mov dword [ebp - 0x4c4], ecx
mov dword [ebp - 0x4c0], ecx
mov dword [ebp - 0x4bc], ecx
mov ecx, esi
push edi
mov dword [ebp - 0x4e4], 0x28
call dword [0xc99200]
call esi
mov dword [ebp - 0xad4], eax
test eax, eax
jne 0xb35717
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xb00], eax
test eax, eax
jle 0xb35702
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb00], eax
test eax, eax
js 0xb35a86
mov dword [ebp - 0xb00], 0x80004005
jmp 0xb35a86
mov esi, dword [0xc93034]
lea ecx, [ebp - 0xa58]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb35741
mov eax, dword [ebp - 0xa44]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0xabc]
push dword [ebp - 0xad4]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp - 0xad0]
sub eax, ebx
push edi
mov dword [ebp - 0x3e4], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0xac8]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0xac8], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x3f0]
mov ecx, edi
push eax
push dword [ebp - 0xaf0]
call dword [0xc99200]
call edi
mov edi, dword [ebp - 0xaf0]
xor eax, eax
mov esi, dword [0xc9306c]
mov ecx, esi
push eax
push dword [ebp - 0xaf4]
lea eax, [ebp - 0x3f0]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xacc]
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0xae0], 1
jne 0xb35834
cmp dword [ebp - 0xac0], 0
je 0xb35828
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
jmp 0xb35839
mov dword [ebp - 0xaf4], 0xffffff
jmp 0xb35845
mov eax, 0xffa8a8a8
mov dword [ebp - 0xaf4], eax
mov dword [ebp - 0xb3c], eax
mov ecx, dword [ebp - 0xac4]
xor eax, eax
mov edx, eax
test ecx, ecx
jns 0xb35861
mov edx, ecx
neg edx
xor ecx, ecx
mov dword [ebp - 0xac4], ecx
jmp 0xb35863
xor ecx, ecx
test ebx, ebx
jns 0xb3586d
mov eax, ebx
mov ebx, ecx
neg eax
mov esi, dword [ebp - 0x3e8]
mov ecx, dword [ebp - 0xae8]
sub esi, edx
sub ecx, dword [ebp - 0xac4]
mov dword [ebp - 0xac0], esi
cmp esi, ecx
jl 0xb35893
mov esi, ecx
mov dword [ebp - 0xac0], ecx
mov ecx, dword [ebp - 0x3e4]
sub dword [ebp - 0xae4], ebx
sub ecx, eax
mov dword [ebp - 0xacc], ecx
cmp ecx, dword [ebp - 0xae4]
jl 0xb358bb
mov ecx, dword [ebp - 0xae4]
mov dword [ebp - 0xacc], ecx
test esi, esi
jle 0xb35a54
test ecx, ecx
jle 0xb35a54
imul eax, dword [ebp - 0x3e8]
mov ecx, dword [ebp - 0xab4]
add eax, edx
mov edx, dword [ebp - 0xae8]
imul ebx, edx
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0xaec]
mov dword [ebp - 0xabc], eax
add ebx, dword [ebp - 0xac4]
lea ecx, [ecx + ebx*4]
mov ebx, dword [ebp - 0x3e8]
shl ebx, 2
shl edx, 2
mov dword [ebp - 0xac4], ecx
mov dword [ebp - 0xad0], ebx
mov dword [ebp - 0xaec], edx
mov ebx, ecx
mov dword [ebp - 0xae4], esi
lea edx, [ecx + 3]
sub ebx, eax
mov dword [ebp - 0xab4], edx
lea edi, [eax + 2]
mov dword [ebp - 0xae8], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xb359fb
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xb3c]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xae8]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xab4]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xb3c]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xab4]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xaf2]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xab4]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xae4]
cdq
idiv ecx
mov edx, dword [ebp - 0xab4]
add al, bl
mov ebx, dword [ebp - 0xae8]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0xab4], edx
mov dword [ebp - 0xae4], esi
jne 0xb35935
mov eax, dword [ebp - 0xabc]
mov ecx, dword [ebp - 0xac4]
add eax, dword [ebp - 0xad0]
add ecx, dword [ebp - 0xaec]
sub dword [ebp - 0xacc], 1
mov esi, dword [ebp - 0xac0]
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xac4], ecx
jne 0xb35919
mov edi, dword [ebp - 0xaf0]
push dword [ebp - 0xad4]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xac8]
test eax, eax
je 0xb35a86
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0xb00], 0
jl 0xb34fdc
cmp dword [ebp - 0xae0], 1
mov edi, dword [ebp - 0xafc]
jne 0xb35aed
mov esi, dword [section..data]
xor eax, eax
push 0xcc0020
push eax
push eax
push edi
push dword [ebp - 0xadc]
mov ecx, esi
push dword [ebp - 0xad8]
push dword [ebp - 0xa88]
push dword [ebp - 0xa8c]
push dword [ebp - 0xaf8]
call dword [0xc99200]
call esi
jmp 0xb35b2a
push dword [ebp - 0xab8]
mov ecx, dword [ebp - 0xadc]
xor edx, edx
mov eax, dword [ebp - 0xad8]
mov esi, dword [0xc93020]
push ecx
push eax
push edx
push edx
push edi
push ecx
push eax
push dword [ebp - 0x3ac]
mov ecx, esi
push dword [ebp - 0x3b0]
push dword [ebp - 0xaf8]
call dword [0xc99200]
call esi
push dword [ebp - 0xb04]
mov esi, dword [0xc93040]
mov ecx, esi
push dword [ebp - 0xaf8]
call dword [0xc99200]
call esi
jmp 0xb34fe2
or dword [ebp - 0xbd4], 0xffffffff
mov ebx, 0xc004d501
mov edi, dword [ebp - 0xab8]
xor eax, eax
test esi, esi
je 0xb35b72
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb35d1f
mov eax, dword [ebp - 0xbd4]
xor ecx, ecx
push 0x40
push ecx
mov ebx, 0xc960a0
mov esi, edi
push ebx
mov byte [edi + eax], cl
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xb35cb5
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xcb0]
jne 0xb35baa
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xb35d18
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xb10], ecx
cmp word [eax], dx
jne 0xb35c20
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xb35c20
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xb35c20
cmp dword [edx], 0x4550
jne 0xb35c20
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xbd8]
je 0xb35c2d
cmp ax, word [ebp - 0xbdc]
je 0xb35c2d
mov ecx, 0xc000000d
jmp 0xb35c25
mov ecx, 0xc000007b
mov dword [ebp - 0xb10], ecx
jmp 0xb35c3f
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0xb5c], eax
test eax, eax
je 0xb35ca9
mov edx, esi
mov dword [ebp - 0xb58], esi
lea eax, [edx + 1]
mov dword [ebp - 0xb18], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xb35c61
sub edx, dword [ebp - 0xb18]
inc esi
add esi, edx
test ecx, ecx
js 0xb35c9a
push dword [ebp - 0xb58]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xb35cb5
mov ecx, dword [ebp - 0xb0c]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xb10]
inc dword [ebp - 0xb0c]
inc ebx
cmp ebx, dword [ebp - 0xb5c]
jb 0xb35c50
add edi, 0x10
cmp byte [esi], 0
jne 0xb35ba3
mov ebx, dword [ebp - 0xb10]
mov esi, dword [ebp - 0xab8]
test esi, esi
je 0xb35cd6
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xb35d2c
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb35cef
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb35cde
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xb35d37
mov ebx, 0xc000007a
jmp 0xb35cbb
mov esi, dword [ebp - 0xab8]
mov ebx, 0xc000007a
jmp 0xb35cc1
mov eax, dword [0xc95890]
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov edi, 0xc96238
xchg dword [edi], eax
mov eax, dword [ebp - 0xafc]
xor ebx, ebx
mov esi, dword [0xc93068]
inc ebx
mov dword [ebp - 0x2fc], eax
mov ecx, esi
mov eax, dword [ebp - 0xae0]
mov dword [ebp - 0x2e4], eax
lea eax, [ebp - 0x300]
push eax
push 4
pop eax
push eax
push 0x2021
xor eax, eax
mov dword [ebp - 0x300], ebx
push eax
mov dword [ebp - 0x2f4], 0x9966f291
mov dword [ebp - 0x2f8], ebx
mov dword [ebp - 0x2ec], ebx
mov dword [ebp - 0x2f0], ebx
mov dword [ebp - 0x2e8], ebx
call dword [0xc99200]
call esi
mov ecx, ebx
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xb35da6
mov eax, dword [0xc95890]
test eax, eax
jle 0xb35e06
sub eax, 1
mov dword [0xc95890], eax
jne 0xb35e06
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb35dda
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb35dc9
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xaf8]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov ebx, dword [ebp - 0xb44]
xor eax, eax
lea edi, [ebp - 0xe18]
mov dword [ebp - 0xb5c], eax
mov dword [ebp - 0xb58], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xe24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb18], eax
test eax, eax
je 0xb37fcb
push 0x28
pop ecx
mov esi, 0xc94ea0
mov dword [ebp - 0xb5c], eax
mov edi, eax
rep movsd dword es:[edi], dword [esi]
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb28], eax
test eax, eax
je 0xb37fcb
mov ecx, dword [0xc94e98]
mov edi, eax
mov dword [eax], ecx
mov ecx, dword [0xc94e9c]
mov dword [eax + 4], ecx
mov dword [ebp - 0xb58], edi
rdtsc
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xb48], edx
xor eax, eax
mov dword [ebp - 0xb60], eax
lea eax, [ebp - 0xb2c]
push eax
push 4
pop esi
mov edx, esi
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb37fc0
mov edx, dword [ebp - 0xb2c]
lea eax, [ebp - 0xb60]
push eax
xor ecx, ecx
call fcn.00a32533
or eax, 0x10000000
jl 0xb37fc0
lea eax, [ebp - 0xb9c]
mov edx, 0xa0
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb37fc0
mov edx, dword [ebp - 0xb9c]
lea eax, [ebp - 0xb60]
mov ecx, dword [ebp - 0xb60]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xb37fc0
lea eax, [ebp - 0xb78]
mov ecx, esi
push eax
push 8
pop edx
call fcn.00a32533
test eax, eax
js 0xb37fc0
mov edx, dword [ebp - 0xb78]
lea eax, [ebp - 0xb60]
mov ecx, dword [ebp - 0xb60]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xb37fc0
lea eax, [ebp - 0xba0]
mov ecx, esi
push eax
push 8
pop edx
call fcn.00a32533
test eax, eax
js 0xb37fc0
mov edx, dword [ebp - 0xba0]
lea eax, [ebp - 0xb60]
mov ecx, dword [ebp - 0xb60]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xb37fc0
mov esi, dword [ebp - 0xb60]
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xba0], edi
test edi, edi
je 0xb37fcb
lea eax, [ebp - 0xddc]
mov ecx, edi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
test eax, eax
js 0xb37f3b
lea ecx, [edi + esi]
lea eax, [edi + 8]
mov dword [ebp - 0xb78], ecx
cmp eax, ecx
ja 0xb37f3b
mov eax, dword [ebp - 0xddc]
push 4
pop ecx
mov dword [edi], ecx
mov dword [eax], ecx
mov esi, edi
xor eax, eax
mov dword [ebp - 0xba4], esi
mov edi, eax
mov edx, dword [esi]
lea eax, [ebp - 0xb38]
push eax
call fcn.00a32533
test eax, eax
js 0xb37f3b
mov edx, dword [ebp - 0xb38]
lea eax, [ebp - 0xba4]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb37f3b
mov esi, dword [ebp - 0xba4]
inc edi
cmp edi, 1
jae 0xb3606e
push 4
pop ecx
jmp 0xb3602b
lea eax, [ebp - 0xd7c]
mov ecx, esi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
test eax, eax
js 0xb37f3b
lea eax, [esi + 0xa4]
cmp eax, dword [ebp - 0xb78]
ja 0xb37f3b
mov edi, dword [ebp - 0xd7c]
mov dword [esi], 0xa0
mov esi, dword [ebp - 0xb18]
push 0x28
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xba0]
xor eax, eax
mov esi, edi
mov dword [ebp - 0xb38], eax
mov dword [ebp - 0xb88], esi
mov edx, dword [esi]
lea eax, [ebp - 0xb70]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
test eax, eax
js 0xb37f3b
mov edx, dword [ebp - 0xb70]
lea eax, [ebp - 0xb88]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb37f3b
mov eax, dword [ebp - 0xb38]
mov esi, dword [ebp - 0xb88]
inc eax
mov dword [ebp - 0xb38], eax
cmp eax, 2
jb 0xb360c8
lea eax, [ebp - 0xd84]
mov ecx, esi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
test eax, eax
js 0xb37f3b
lea eax, [esi + 0xc]
cmp eax, dword [ebp - 0xb78]
ja 0xb37f3b
mov edx, dword [ebp - 0xb28]
mov ecx, dword [ebp - 0xd84]
mov dword [esi], 8
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov esi, edi
xor eax, eax
mov dword [ebp - 0xb90], esi
mov edi, eax
mov edx, dword [esi]
lea eax, [ebp - 0xb94]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
test eax, eax
js 0xb37f3b
mov edx, dword [ebp - 0xb94]
lea eax, [ebp - 0xb90]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb37f3b
mov esi, dword [ebp - 0xb90]
inc edi
cmp edi, 3
jb 0xb36169
lea eax, [ebp - 0xd8c]
mov ecx, esi
push eax
push 4
pop edi
mov edx, edi
call fcn.00a32533
test eax, eax
js 0xb37f3b
lea eax, [esi + 0xc]
cmp eax, dword [ebp - 0xb78]
ja 0xb37f3b
mov eax, dword [ebp - 0xd8c]
mov ecx, dword [ebp - 0xb20]
mov dword [esi], 8
mov dword [eax], ecx
mov ecx, dword [ebp - 0xb48]
mov dword [eax + 4], ecx
lea eax, [ebp - 0xb24]
mov edx, edi
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xb37f3b
mov esi, dword [ebp - 0xb24]
lea eax, [ebp - 0xb98]
push eax
push 8
pop edx
mov ecx, edi
mov dword [ebp - 0xb4c], esi
call fcn.00a32533
test eax, eax
js 0xb37f3b
mov edx, dword [ebp - 0xb98]
lea eax, [ebp - 0xb4c]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb37f3b
xor edx, edx
mov edi, edx
mov dword [ebp - 0xb98], edx
mov dword [ebp - 0xb24], edx
mov dword [ebp - 0xb90], edx
mov dword [ebp - 0xb70], edx
mov dword [ebp - 0xb88], edx
mov dword [ebp - 0xb38], edx
mov dword [ebp - 0xba4], edx
mov dword [ebp - 0xb78], edx
mov dword [ebp - 0xb9c], edx
rdtsc
mov dword [ebp - 0xb94], edi
mov dword [ebp - 0xb2c], eax
mov dword [ebp - 0xb18], edx
push 8
pop ecx
mov dword [ebp - 0xc78], ecx
mov edx, dword [ebp - 0xb60]
lea eax, [ebp - 0xc78]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb363ba
mov eax, dword [ebp - 0xc78]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0xb28], ecx
cmp ecx, eax
jae 0xb362df
mov esi, 0xc0000095
jmp 0xb363ba
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb20], eax
test eax, eax
jne 0xb36303
mov esi, 0xc0000017
jmp 0xb363ba
push 4
pop edx
lea ecx, [ebp - 0xb08]
mov dword [ebp - 0xb08], eax
push ecx
mov ecx, eax
mov dword [eax], edx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb3639f
mov ecx, dword [ebp - 0xb08]
mov eax, dword [ebp - 0xb60]
mov dword [ecx], eax
lea eax, [ebp - 0xb08]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0xb20]
test esi, esi
js 0xb363a5
mov ecx, dword [ebp - 0xb28]
push dword [ebp - 0xb60]
mov edx, dword [ebp - 0xb2c]
push dword [ebp - 0xba0]
mov dword [eax + ecx - 8], edx
mov edx, dword [ebp - 0xb18]
push dword [ebp - 0xb08]
mov dword [eax + ecx - 4], edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xb20]
add esp, 0xc
mov ecx, dword [ebp - 0xb28]
xor edx, edx
mov dword [ebp - 0xb98], eax
mov eax, edx
mov dword [ebp - 0xb24], ecx
jmp 0xb363a7
mov eax, dword [ebp - 0xb20]
xor edx, edx
test eax, eax
je 0xb363ba
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xb37d3f
xor ecx, ecx
mov dword [ebp - 0xb08], ecx
cmp dword [ebp - 0xb98], ecx
jne 0xb363e0
mov esi, 0xc000000d
jmp 0xb36a3b
mov esi, dword [ebp - 0xb24]
test esi, esi
je 0xb36a36
lea eax, [esi + 8]
push eax
push ecx
mov dword [ebp - 0xb2c], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb60], eax
test eax, eax
je 0xb36a36
mov edi, dword [ebp - 0xb98]
xor eax, eax
mov cl, al
test esi, esi
je 0xb3642a
xor cl, byte [eax + edi]
inc eax
cmp eax, esi
jb 0xb36422
mov eax, 0xb1b54a58
mov dword [ebp - 0x368], eax
mov eax, 0xc81ecb17
mov dword [ebp - 0x364], eax
mov eax, esi
shr eax, 3
mov dword [ebp - 0xb18], eax
test eax, eax
je 0xb36835
movzx edx, word [ebp - 0x366]
mov eax, 0xc81ecb17
movzx esi, ax
movzx eax, word [ebp - 0x362]
mov dword [ebp - 0xb28], eax
mov eax, 0xb1b54a58
movzx eax, ax
mov dword [ebp - 0xb20], eax
mov eax, dword [ebp - 0xb60]
add eax, 7
mov dword [ebp - 0xbb8], esi
mov dword [ebp - 0xbbc], eax
lea esi, [edi + 2]
xor eax, eax
mov dword [ebp - 0xb48], edx
mov dword [ebp - 0xbc0], esi
mov edx, eax
or ebx, 0xffffffff
mov dword [ebp - 0xbc4], eax
mov dword [ebp - 0xbc8], eax
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xbc0]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xbc0]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xbc0]
shl esi, 8
add dword [ebp - 0xbc0], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov eax, ebx
sub eax, dword [ebp - 0xb20]
xor eax, 0xc81ecb17
xor eax, edi
xor edx, eax
mov dword [ebp - 0xbcc], edx
mov edx, 0xc81ecb17
mov eax, dword [ebp - 0xbcc]
xor edx, eax
ror edx, 0xf
imul edx, dword [ebp - 0xb48]
ror eax, 7
add edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
mov eax, ebx
ror eax, 0xa
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [ebp - 0xbb8]
sub edx, eax
mov eax, dword [ebp - 0xbcc]
xor eax, edx
mov edx, dword [ebp - 0xbb8]
xor edx, eax
mov dword [ebp - 0xbcc], eax
rol edx, 4
imul edx, dword [ebp - 0xb28]
rol eax, 5
add edx, eax
mov eax, 0xc81ecb17
xor ebx, edx
mov edx, 0xb1b54a58
xor edx, ebx
sub eax, edx
mov edx, dword [ebp - 0xbcc]
xor edx, eax
mov dword [ebp - 0xbcc], edx
sub edx, dword [ebp - 0xb20]
imul edx, dword [ebp - 0xb48]
mov eax, dword [ebp - 0xbcc]
shr eax, 6
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xbcc]
mov eax, ebx
ror eax, 0xf
xor eax, dword [ebp - 0xbb8]
imul eax, dword [ebp - 0xb20]
xor edx, eax
mov eax, edx
not eax
ror eax, 3
add eax, dword [ebp - 0xb28]
imul eax, dword [ebp - 0xbb8]
xor ebx, eax
mov eax, ebx
sub eax, dword [ebp - 0xb20]
sub eax, 0xc81ecb17
xor edx, eax
mov eax, dword [ebp - 0xb28]
mov dword [ebp - 0xbcc], edx
xor eax, dword [ebp - 0xbcc]
imul eax, dword [ebp - 0xb48]
ror edx, 0xa
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb20]
xor edx, ebx
mov eax, ebx
rol edx, 6
imul edx, dword [ebp - 0xbb8]
ror eax, 3
xor edx, eax
mov eax, dword [ebp - 0xbcc]
xor eax, edx
mov edx, dword [ebp - 0xb28]
mov dword [ebp - 0xbcc], eax
ror eax, 0xf
sub eax, edx
imul eax, dword [ebp - 0xb20]
xor ebx, eax
xor edx, ebx
mov eax, ebx
imul edx, dword [ebp - 0xb20]
shr eax, 1
xor edx, eax
mov eax, ebx
xor dword [ebp - 0xbcc], edx
mov edx, ebx
sub edx, dword [ebp - 0xbb8]
rol edx, 3
imul edx, dword [ebp - 0xb20]
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0xbcc]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xbcc], eax
sub edx, dword [ebp - 0xbb8]
imul edx, dword [ebp - 0xb48]
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 9
imul edx, dword [ebp - 0xbb8]
ror eax, 0xb
xor edx, eax
mov eax, dword [ebp - 0xbcc]
xor eax, edx
mov dword [ebp - 0xbcc], eax
sub eax, 0xb1b54a58
sub eax, dword [ebp - 0xb28]
xor ebx, eax
mov eax, dword [ebp - 0xb48]
xor eax, ebx
mov edx, ebx
imul eax, dword [ebp - 0xb20]
ror edx, 7
sub eax, edx
mov edx, dword [ebp - 0xb28]
xor dword [ebp - 0xbcc], eax
mov eax, dword [ebp - 0xbcc]
xor edx, eax
rol edx, 4
imul edx, dword [ebp - 0xb48]
ror eax, 0x10
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 0xa
imul edx, dword [ebp - 0xbb8]
ror eax, 4
add edx, eax
mov eax, dword [ebp - 0xbcc]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xbcc], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, dword [ebp - 0xb28]
xor edx, eax
xor ebx, edx
mov edx, 0xc81ecb17
xor edx, ebx
mov eax, ebx
rol edx, 8
imul edx, dword [ebp - 0xb20]
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0xbcc]
xor eax, edx
mov edx, 0xc81ecb17
sub edx, eax
mov dword [ebp - 0xbcc], eax
ror edx, 0xb
imul edx, dword [ebp - 0xb48]
ror eax, 0xc
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xb48]
imul edx, dword [ebp - 0xbb8]
shr eax, 8
xor edx, eax
mov eax, 0xb1b54a58
xor dword [ebp - 0xbcc], edx
xor eax, ebx
mov edx, dword [ebp - 0xbcc]
mov ebx, 0xc81ecb17
xor eax, edx
xor edx, dword [ebp - 0xbc4]
xor ebx, eax
mov dword [ebp - 0xbc4], edi
mov eax, dword [ebp - 0xbbc]
xor ebx, dword [ebp - 0xbc8]
mov dword [ebp - 0xbc8], esi
mov esi, dword [ebp - 0xbc0]
mov byte [eax - 4], dl
mov byte [eax], bl
ror edx, 8
mov byte [eax - 5], dl
ror ebx, 8
mov byte [eax - 1], bl
ror edx, 8
mov byte [eax - 6], dl
ror ebx, 8
mov byte [eax - 2], bl
ror edx, 8
ror ebx, 8
mov byte [eax - 7], dl
mov byte [eax - 3], bl
add eax, 8
ror edx, 8
ror ebx, 8
sub dword [ebp - 0xb18], 1
mov dword [ebp - 0xbbc], eax
jne 0xb364b4
mov ebx, dword [ebp - 0xb44]
mov esi, dword [ebp - 0xb24]
movzx eax, cl
mov ecx, dword [ebp - 0xb60]
cdq
mov dword [ecx + esi], eax
mov dword [ecx + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xb24], edi
test edi, edi
jne 0xb3686d
mov esi, 0xc0000017
jmp 0xb3697e
mov esi, dword [ebp - 0xb2c]
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb368f2
mov dword [edi + 4], eax
mov edx, dword [ebp - 0xb60]
push esi
push edx
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb368f2
mov dword [edi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0xc94df0
push 8
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xb24]
pop eax
push eax
push eax
mov dword [edi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0xb368fb
mov esi, 0xc0000017
jmp 0xb36917
mov esi, 0xc0000017
xor edx, edx
jmp 0xb36917
mov dword [edi + 0x14], ecx
mov esi, edx
mov eax, dword [0xc94e90]
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [ebp - 0xb08], edi
mov edi, edx
mov dword [ecx + 4], eax
test edi, edi
je 0xb3697e
cmp dword [edi + 4], 0
je 0xb36937
push dword [edi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 4], edx
cmp dword [edi + 0xc], 0
je 0xb36953
push dword [edi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0xc], edx
cmp dword [edi + 0x14], 0
je 0xb3696f
push dword [edi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0x14], edx
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
test esi, esi
js 0xb36998
mov edi, dword [ebp - 0xb08]
mov dword [ebp - 0xb94], edi
mov dword [ebp - 0xb08], eax
jmp 0xb3699e
mov edi, dword [ebp - 0xb94]
push dword [ebp - 0xb60]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb08]
test eax, eax
je 0xb36a3b
mov ecx, dword [eax + 4]
test ecx, ecx
je 0xb369e1
push ecx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb08]
xor edx, edx
mov dword [eax + 4], edx
jmp 0xb369e3
xor edx, edx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0xb36a04
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb08]
xor edx, edx
mov dword [eax + 0xc], edx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0xb36a25
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb08]
xor edx, edx
mov dword [eax + 0x14], edx
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb36a3b
mov esi, 0xc0000001
or esi, 0x10000000
jl 0xb37d3f
mov edx, dword [edi]
lea eax, [ebp - 0xb1c]
push 4
pop ecx
push eax
mov dword [ebp - 0xb1c], ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb36ada
mov ecx, dword [ebp - 0xb1c]
lea eax, [ebp - 0xb1c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb36ada
mov edx, dword [edi + 8]
lea eax, [ebp - 0xb1c]
mov ecx, dword [ebp - 0xb1c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb36ada
mov ecx, dword [ebp - 0xb1c]
lea eax, [ebp - 0xb1c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb36ada
mov edx, dword [edi + 0x10]
lea eax, [ebp - 0xb1c]
mov ecx, dword [ebp - 0xb1c]
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0xb1c]
test esi, esi
jns 0xb36ae0
mov eax, dword [ebp - 0xc84]
mov dword [ebp - 0xb1c], eax
test esi, esi
js 0xb36c49
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xb08], ecx
test ecx, ecx
jne 0xb36b14
mov esi, 0xc0000017
jmp 0xb36c49
mov eax, dword [edi]
mov dword [ecx], eax
lea eax, [ebp - 0xb64]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xb64], ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb36c2e
push dword [edi]
push dword [edi + 4]
push dword [ebp - 0xb64]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi]
lea eax, [ebp - 0xb64]
mov ecx, dword [ebp - 0xb64]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb36c2e
mov ecx, dword [ebp - 0xb64]
mov eax, dword [edi + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xb64]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb36c2e
push dword [edi + 8]
push dword [edi + 0xc]
push dword [ebp - 0xb64]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi + 8]
lea eax, [ebp - 0xb64]
mov ecx, dword [ebp - 0xb64]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb36c2e
mov ecx, dword [ebp - 0xb64]
mov eax, dword [edi + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xb64]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb36c2e
push dword [edi + 0x10]
push dword [edi + 0x14]
push dword [ebp - 0xb64]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi + 0x10]
lea eax, [ebp - 0xb64]
mov ecx, dword [ebp - 0xb64]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
xor edx, edx
mov eax, dword [ebp - 0xb08]
test esi, esi
js 0xb36c36
mov ecx, dword [ebp - 0xb1c]
mov dword [ebp - 0xb90], eax
mov eax, edx
mov dword [ebp - 0xb70], ecx
jmp 0xb36c36
mov eax, dword [ebp - 0xb08]
xor edx, edx
test eax, eax
je 0xb36c49
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xb37d3f
push 8
xor eax, eax
pop edi
mov dword [ebp - 0xb64], eax
mov dword [ebp - 0xb1c], eax
mov dword [ebp - 0xc8c], edi
mov edx, dword [ebp - 0xb4c]
lea eax, [ebp - 0xc8c]
push eax
mov ecx, edi
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
jl 0xb36d51
mov eax, dword [ebp - 0xc8c]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xb36ca5
mov esi, 0xc0000095
jmp 0xb36cc5
mov dword [ebp - 0xc94], ecx
lea eax, [ebp - 0xc94]
mov edx, edi
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0xc94]
test esi, esi
jns 0xb36ccb
mov eax, dword [ebp - 0xc90]
mov dword [ebp - 0xb08], eax
test esi, esi
js 0xb36d51
mov edi, dword [ebp - 0xba0]
test edi, edi
je 0xb36d4c
push 4
pop edx
cmp edx, 1
jbe 0xb36d4c
mov ecx, edi
xor eax, eax
mov dword [ebp - 0xb68], ecx
mov dword [ebp - 0xb4c], eax
mov eax, dword [ecx]
mov dword [ebp - 0xb24], eax
lea eax, [ebp - 0xb68]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb36d51
mov edx, dword [ebp - 0xb24]
lea eax, [ebp - 0xb68]
mov ecx, dword [ebp - 0xb68]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb36d51
mov eax, dword [ebp - 0xb4c]
mov ecx, dword [ebp - 0xb68]
inc eax
mov dword [ebp - 0xb4c], eax
cmp eax, 1
jae 0xb36d87
push 4
pop edx
jmp 0xb36cf7
mov esi, 0xc000000d
mov edi, dword [ebp - 0xb38]
test esi, esi
js 0xb37d3f
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xb36efa
mov eax, dword [ebp - 0xb88]
mov esi, 0xd0000017
jmp 0xb36f05
mov eax, dword [ecx]
mov dword [ebp - 0xb4c], eax
lea eax, [ebp - 0xb68]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb36d51
mov eax, dword [ebp - 0xb4c]
mov dword [ebp - 0xb64], eax
push 4
pop edx
cmp edx, 2
jbe 0xb36d4c
mov ecx, edi
xor eax, eax
mov dword [ebp - 0xb7c], ecx
mov edi, eax
mov eax, dword [ecx]
mov dword [ebp - 0xb68], eax
lea eax, [ebp - 0xb7c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb36e28
mov edx, dword [ebp - 0xb68]
lea eax, [ebp - 0xb7c]
mov ecx, dword [ebp - 0xb7c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb36e28
mov ecx, dword [ebp - 0xb7c]
inc edi
cmp edi, 2
jae 0xb36e0f
push 4
pop edx
jmp 0xb36dc6
mov edi, dword [ecx]
lea eax, [ebp - 0xb7c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
jns 0xb36e36
mov edi, dword [ebp - 0xb1c]
test esi, esi
js 0xb36d51
mov edx, dword [ebp - 0xb08]
lea eax, [ebp - 0xb6c]
push 4
pop ecx
push eax
mov dword [ebp - 0xb6c], ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb36ecf
mov ecx, dword [ebp - 0xb6c]
lea eax, [ebp - 0xb6c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb36ecf
mov edx, dword [ebp - 0xb64]
lea eax, [ebp - 0xb6c]
mov ecx, dword [ebp - 0xb6c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb36ecf
mov ecx, dword [ebp - 0xb6c]
lea eax, [ebp - 0xb6c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb36ecf
mov ecx, dword [ebp - 0xb6c]
lea eax, [ebp - 0xb6c]
push eax
mov edx, edi
call fcn.00a32533
mov edi, dword [ebp - 0xb6c]
mov esi, eax
test esi, esi
jns 0xb36edd
mov edi, dword [ebp - 0xca0]
test esi, esi
js 0xb36d51
cmp edi, 0x400000
jbe 0xb36eef
mov esi, 0x8000ffff
jmp 0xb37d3f
mov dword [ebp - 0xb38], edi
jmp 0xb36d57
mov dword [ebp - 0xb88], eax
mov esi, 0x10000000
test esi, esi
js 0xb37d3f
mov ecx, dword [ebp - 0xb90]
test ecx, ecx
je 0xb36fab
test eax, eax
je 0xb36fab
mov dword [ebp - 0xe88], eax
xor eax, eax
mov dword [ebp - 0xe7c], eax
lea eax, [ebp - 0xca4]
push eax
push 0x9f29b8
mov dword [ebp - 0xe8c], ecx
mov ecx, dword [ebp - 0xb70]
push 1
mov dword [ebp - 0xe84], ecx
mov dword [ebp - 0xe80], edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xb36fb5
push 0x9fc030
push dword [ebp - 0xca4]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xb36fb5
xor eax, eax
mov ecx, esi
push eax
push 0x14
lea eax, [ebp - 0xe8c]
push eax
push 0x86
call dword [0xc99200]
call esi
mov esi, eax
or esi, 0x10000000
jl 0xb36fd3
mov edi, dword [ebp - 0xe80]
mov dword [ebp - 0xb38], edi
jmp 0xb36fd3
mov esi, 0x80070057
jmp 0xb37d3f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xb36fcc
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xb36fd3
mov esi, 0x80004005
cmp esi, 0xd0000023
jne 0xb36fe5
mov esi, 0x8007007a
jmp 0xb37d3f
test esi, esi
js 0xb37d3f
mov eax, dword [ebp - 0xb88]
xor edx, edx
push 4
pop esi
mov dword [ebp - 0xb6c], edx
mov dword [ebp - 0xb74], edx
mov dword [ebp - 0xb84], eax
cmp edi, esi
jae 0xb37018
mov esi, 0xc000003e
jmp 0xb3740b
mov edi, dword [eax]
lea ecx, [ebp - 0xb84]
push ecx
mov edx, esi
mov dword [ebp - 0xb7c], edi
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb37409
lea eax, [ebp - 0xb74]
xor ecx, ecx
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb37409
mov eax, dword [ebp - 0xb38]
sub eax, dword [ebp - 0xb74]
cmp eax, edi
jb 0xb3723c
mov eax, dword [ebp - 0xb84]
lea ecx, [ebp - 0xb84]
push ecx
mov edx, edi
mov dword [ebp - 0xb68], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb37409
mov ecx, dword [ebp - 0xb74]
lea eax, [ebp - 0xb74]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb37409
mov eax, dword [ebp - 0xb38]
sub eax, dword [ebp - 0xb74]
push 4
pop edx
cmp eax, edx
jb 0xb3723c
mov ecx, dword [ebp - 0xb84]
lea eax, [ebp - 0xb84]
push eax
mov edi, dword [ecx]
mov dword [ebp - 0xb64], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb37409
mov ecx, dword [ebp - 0xb74]
lea eax, [ebp - 0xb74]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb37409
mov eax, dword [ebp - 0xb38]
sub eax, dword [ebp - 0xb74]
cmp eax, edi
jb 0xb3723c
mov eax, dword [ebp - 0xb84]
lea ecx, [ebp - 0xb84]
push ecx
mov edx, edi
mov dword [ebp - 0xb1c], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb37409
mov ecx, dword [ebp - 0xb74]
lea eax, [ebp - 0xb74]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb37409
mov eax, dword [ebp - 0xb38]
sub eax, dword [ebp - 0xb74]
push 4
pop edx
cmp eax, edx
jb 0xb3723c
mov ecx, dword [ebp - 0xb84]
mov eax, dword [ecx]
mov dword [ebp - 0xb08], eax
lea eax, [ebp - 0xb84]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb37409
mov ecx, dword [ebp - 0xb74]
lea eax, [ebp - 0xb74]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb37409
mov eax, dword [ebp - 0xb38]
sub eax, dword [ebp - 0xb74]
mov ecx, dword [ebp - 0xb08]
cmp eax, ecx
jb 0xb3723c
lea eax, [ebp - 0xb74]
mov edx, ecx
mov ecx, dword [ebp - 0xb74]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb37409
mov edx, dword [ebp - 0xb38]
mov eax, edx
sub eax, dword [ebp - 0xb74]
jne 0xb3723c
mov esi, dword [ebp - 0xb7c]
mov ecx, dword [ebp - 0xb08]
add ecx, 0xc
lea eax, [edi + esi]
add eax, ecx
cmp eax, edx
jne 0xb3723c
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xb37246
mov esi, 0xc0000017
jmp 0xb37386
mov esi, 0xc000003e
jmp 0xb37409
cmp dword [ebp - 0xb68], 0
je 0xb37288
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb3727c
mov dword [edi + 4], eax
push esi
push dword [ebp - 0xb68]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb3728f
mov esi, 0xc0000017
xor eax, eax
jmp 0xb3731f
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
cmp dword [ebp - 0xb1c], 0
je 0xb372cc
mov esi, dword [ebp - 0xb64]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb3727c
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xb1c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb372d2
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
cmp dword [ebp - 0xb84], 0
je 0xb3730f
mov esi, dword [ebp - 0xb08]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb3727c
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xb84]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb37315
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [ebp - 0xb6c], edi
mov esi, eax
mov edi, eax
test edi, edi
je 0xb37386
cmp dword [edi + 4], 0
je 0xb3733f
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xb3735b
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xb37377
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
test esi, esi
js 0xb3739c
mov eax, dword [ebp - 0xb6c]
mov edi, edx
mov dword [ebp - 0xba4], eax
jmp 0xb373a2
mov edi, dword [ebp - 0xb6c]
test edi, edi
je 0xb3740b
cmp dword [edi + 4], 0
je 0xb373c2
push dword [edi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 4], edx
cmp dword [edi + 0xc], 0
je 0xb373de
push dword [edi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0xc], edx
cmp dword [edi + 0x14], 0
je 0xb373fa
push dword [edi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0x14], edx
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
or esi, 0x10000000
jl 0xb37d3f
mov ecx, dword [ebp - 0xba4]
mov edi, edx
mov dword [ebp - 0xb84], edi
mov dword [ebp - 0xb74], edx
test ecx, ecx
je 0xb374f2
mov eax, dword [ecx + 4]
mov dword [ebp - 0xb6c], eax
test eax, eax
je 0xb374f2
mov esi, dword [ecx]
test esi, esi
je 0xb374f2
add esi, 0xfffffff8
mov dword [ebp - 0xb7c], edx
push esi
push edx
mov dword [ebp - 0xb68], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb64], eax
test eax, eax
je 0xb37a96
xor ecx, ecx
mov edi, esi
mov dl, cl
mov ecx, 0xab69605e
mov dword [ebp - 0x370], ecx
mov ecx, 0x7f1137f
mov dword [ebp - 0x36c], ecx
mov ecx, dword [ebp - 0xb6c]
mov dword [ebp - 0xb1c], ecx
mov ecx, eax
mov dword [ebp - 0xb08], ecx
and edi, 7
je 0xb37a3a
xor eax, eax
xor esi, esi
and dword [ebp - 0xb24], eax
mov dword [ebp - 0xcec], eax
mov dword [ebp - 0xb4c], esi
test edi, edi
je 0xb3753c
mov ebx, dword [ebp - 0xb1c]
push 0x38
pop ecx
movzx eax, byte [ebx]
inc ebx
cmp dword [ebp - 0xb24], 4
jge 0xb374fc
add ecx, 0xffffffe0
shl eax, cl
mov ecx, dword [ebp - 0xbb0]
or esi, eax
jmp 0xb37504
mov esi, 0xd000000d
jmp 0xb37d3f
shl eax, cl
or dword [ebp - 0xcec], eax
mov eax, dword [ebp - 0xb24]
sub ecx, 8
inc eax
mov dword [ebp - 0xbb0], ecx
mov dword [ebp - 0xb24], eax
cmp eax, edi
jl 0xb374d6
mov ecx, dword [ebp - 0xb08]
mov eax, dword [ebp - 0xcec]
mov dword [ebp - 0xb1c], ebx
mov ebx, dword [ebp - 0xb44]
mov dword [ebp - 0xb4c], esi
and dword [ebp - 0xb60], 0
xor esi, 0x92f65a5
xor eax, 0x699a899c
mov dword [ebp - 0xb24], esi
mov dword [ebp - 0xb70], eax
mov dword [ebp - 0xb38], esi
mov dword [ebp - 0xb2c], eax
test edi, edi
je 0xb375c3
mov ebx, dword [ebp - 0xb60]
push 4
pop esi
lea eax, [ecx + 1]
mov dword [ebp - 0xb08], eax
cmp ebx, esi
jge 0xb3758f
rol dword [ebp - 0xb38], 8
mov eax, dword [ebp - 0xb38]
jmp 0xb3759c
rol dword [ebp - 0xb2c], 8
mov eax, dword [ebp - 0xb2c]
mov byte [ecx], al
inc ebx
mov eax, dword [ebp - 0xb08]
mov ecx, eax
cmp ebx, edi
jl 0xb37573
mov ebx, dword [ebp - 0xb44]
mov esi, dword [ebp - 0xb24]
mov dword [ebp - 0xb08], eax
mov eax, dword [ebp - 0xb70]
push 4
pop ecx
cmp edi, ecx
jbe 0xb37a16
push 8
pop ecx
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xb70], eax
mov esi, dword [ebp - 0xb68]
mov eax, esi
shr eax, 3
mov dword [ebp - 0xb38], eax
test eax, eax
je 0xb379d7
movzx ecx, word [ebp - 0x36a]
mov eax, 0x7f1137f
movzx esi, word [ebp - 0x36e]
mov edi, 0xab69605e
movzx eax, ax
mov ebx, edi
mov dword [ebp - 0xb60], eax
xor ebx, 0x7f1137f
movzx eax, di
mov dword [ebp - 0xb20], eax
mov eax, dword [ebp - 0xb08]
mov dword [ebp - 0xb18], ecx
add eax, 7
mov ecx, dword [ebp - 0xb1c]
mov dword [ebp - 0xb2c], ebx
add ecx, 2
mov ebx, dword [ebp - 0xb70]
mov dword [ebp - 0xb28], esi
mov dword [ebp - 0xb08], eax
movzx edi, byte [ecx - 2]
movzx eax, byte [ecx - 1]
movzx esi, byte [ecx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [ecx]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 3]
or esi, eax
movzx eax, byte [ecx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 5]
add ecx, 8
shl esi, 8
mov dword [ebp - 0xb1c], ecx
or esi, eax
mov eax, dword [ebp - 0xb24]
xor ebx, esi
xor eax, edi
xor ebx, eax
mov dword [ebp - 0xb24], eax
xor ebx, dword [ebp - 0xb2c]
mov ecx, ebx
mov eax, ebx
sub ecx, 0xab69605e
rol eax, 0xa
rol ecx, 5
imul ecx, dword [ebp - 0xb60]
add ecx, eax
mov eax, dword [ebp - 0xb24]
xor eax, ecx
mov ecx, 0x7f1137f
add ecx, eax
mov dword [ebp - 0xb24], eax
ror ecx, 9
imul ecx, dword [ebp - 0xb28]
rol eax, 2
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
sub ecx, dword [ebp - 0xb60]
imul ecx, dword [ebp - 0xb20]
shr eax, 0xd
sub ecx, eax
mov eax, dword [ebp - 0xb24]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xb24], eax
xor ecx, dword [ebp - 0xb28]
rol ecx, 6
imul ecx, dword [ebp - 0xb18]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, 0xab69605e
xor ecx, ebx
sub eax, ecx
mov ecx, dword [ebp - 0xb24]
xor ecx, eax
mov dword [ebp - 0xb24], ecx
mov eax, dword [ebp - 0xb24]
xor eax, dword [ebp - 0xb60]
imul eax, dword [ebp - 0xb28]
ror ecx, 6
xor ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea ecx, [ebx + ecx]
ror ecx, 0xf
imul ecx, dword [ebp - 0xb20]
add ecx, eax
mov eax, dword [ebp - 0xb24]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xb24], eax
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0xb18]
sub ecx, eax
xor ebx, ecx
mov ecx, 0xab69605e
xor ecx, ebx
mov eax, ebx
ror ecx, 0xc
imul ecx, dword [ebp - 0xb60]
ror eax, 0xa
xor ecx, eax
mov eax, dword [ebp - 0xb24]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xb24], eax
xor ecx, dword [ebp - 0xb18]
imul ecx, dword [ebp - 0xb28]
shr eax, 0xa
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xb24]
mov eax, ebx
not eax
ror eax, 5
add eax, dword [ebp - 0xb20]
imul eax, dword [ebp - 0xb18]
xor ecx, eax
mov dword [ebp - 0xb24], ecx
sub ecx, dword [ebp - 0xb18]
xor ecx, 0xab69605e
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xb18]
rol ecx, 2
imul ecx, dword [ebp - 0xb60]
shr eax, 2
add ecx, eax
mov eax, dword [ebp - 0xb24]
xor eax, ecx
mov dword [ebp - 0xb24], eax
lea ecx, [eax - 0x7f1137f]
rol eax, 7
ror ecx, 6
imul ecx, dword [ebp - 0xb28]
add ecx, eax
xor ebx, ecx
mov eax, ebx
mov ecx, ebx
xor eax, dword [ebp - 0xb60]
imul eax, dword [ebp - 0xb20]
ror ecx, 9
add ecx, eax
mov eax, dword [ebp - 0xb24]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xb24], eax
xor ecx, dword [ebp - 0xb28]
rol ecx, 5
imul ecx, dword [ebp - 0xb18]
rol eax, 7
add ecx, eax
mov eax, 0xab69605e
xor ebx, ecx
mov ecx, 0x7f1137f
xor eax, ebx
xor eax, dword [ebp - 0xb24]
xor eax, ecx
mov dword [ebp - 0xb24], eax
ror eax, 3
sub eax, dword [ebp - 0xb28]
imul eax, dword [ebp - 0xb60]
xor ebx, eax
mov eax, 0x7f1137f
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 1
imul ecx, dword [ebp - 0xb20]
ror eax, 6
sub ecx, eax
mov eax, dword [ebp - 0xb24]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0xb24], eax
rol ecx, 3
imul ecx, dword [ebp - 0xb18]
rol eax, 0xe
add ecx, eax
xor ebx, ecx
mov ecx, 0xab69605e
mov eax, ebx
ror eax, 0xe
lea ecx, [ecx + ebx]
rol ecx, 0xf
imul ecx, dword [ebp - 0xb60]
sub ecx, eax
mov eax, dword [ebp - 0xb24]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xb24], eax
xor ecx, dword [ebp - 0xb20]
imul ecx, dword [ebp - 0xb28]
shr eax, 3
xor ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
xor ecx, eax
mov eax, ebx
xor ebx, dword [ebp - 0xcec]
rol ecx, 4
imul ecx, dword [ebp - 0xb20]
rol eax, 2
mov dword [ebp - 0xcec], esi
xor ecx, eax
mov eax, dword [ebp - 0xb24]
xor ecx, dword [ebp - 0xb4c]
xor eax, ecx
mov dword [ebp - 0xb4c], edi
mov ecx, dword [ebp - 0xb08]
mov byte [ecx - 4], al
mov byte [ecx], bl
ror eax, 8
mov byte [ecx - 5], al
ror ebx, 8
mov byte [ecx - 1], bl
ror eax, 8
mov byte [ecx - 6], al
ror ebx, 8
mov byte [ecx - 2], bl
ror eax, 8
ror ebx, 8
mov byte [ecx - 7], al
mov byte [ecx - 3], bl
add ecx, 8
ror eax, 8
ror ebx, 8
sub dword [ebp - 0xb38], 1
mov dword [ebp - 0xb08], ecx
mov ecx, dword [ebp - 0xb1c]
mov dword [ebp - 0xb24], eax
jne 0xb3765b
mov ebx, dword [ebp - 0xb44]
mov esi, dword [ebp - 0xb68]
mov ecx, dword [ebp - 0xb64]
xor eax, eax
test esi, esi
je 0xb379eb
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0xb379e3
movzx eax, dl
cdq
mov edi, edx
mov edx, dword [ebp - 0xb6c]
cmp eax, dword [esi + edx]
jne 0xb37a55
cmp edi, dword [esi + edx + 4]
jne 0xb37a55
xor eax, eax
mov dword [ebp - 0xb74], esi
mov esi, dword [ebp - 0xb7c]
mov edi, ecx
mov ecx, eax
jmp 0xb37a62
xor eax, eax
mov dword [ebp - 0xb70], eax
cmp edi, ecx
jae 0xb375e0
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0xb24], esi
jmp 0xb375e0
xor ecx, ecx
mov eax, ecx
mov dword [ebp - 0xb4c], ecx
mov dword [ebp - 0xb70], eax
mov dword [ebp - 0xb24], ecx
jmp 0xb375e6
mov edi, dword [ebp - 0xb84]
mov esi, 0xc004d501
xor eax, eax
test ecx, ecx
je 0xb37a75
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xb37a96
mov eax, dword [ebp - 0xb74]
xor ecx, ecx
mov dword [ebp - 0xb78], edi
mov esi, 0x10000000
mov edi, ecx
mov dword [ebp - 0xb9c], eax
jmp 0xb37a9d
mov esi, 0xd0000001
xor ecx, ecx
test edi, edi
je 0xb37ab0
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xb37d3f
mov edi, dword [ebp - 0xb9c]
xor eax, eax
mov ecx, dword [ebp - 0xb78]
push 4
pop edx
mov dword [ebp - 0xbb4], eax
mov dword [ebp - 0xcb4], ecx
cmp edi, edx
jb 0xb37d34
mov eax, dword [ecx]
mov dword [ebp - 0xb84], eax
lea eax, [ebp - 0xcb4]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb37d39
lea eax, [ebp - 0xbb4]
xor ecx, ecx
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb37d39
mov eax, edi
sub eax, dword [ebp - 0xbb4]
push 4
pop edx
cmp eax, edx
jb 0xb37d34
mov ecx, dword [ebp - 0xcb4]
lea eax, [ebp - 0xcb4]
push eax
mov edi, dword [ecx]
mov dword [ebp - 0xb74], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb37d39
mov ecx, dword [ebp - 0xbb4]
lea eax, [ebp - 0xbb4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb37d39
mov eax, dword [ebp - 0xb9c]
mov ecx, dword [ebp - 0xbb4]
sub eax, ecx
cmp eax, edi
jb 0xb37d34
lea eax, [ebp - 0xbb4]
mov edx, edi
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb37d39
mov edx, dword [ebp - 0xb9c]
mov esi, dword [ebp - 0xb78]
mov eax, dword [ebp - 0xcb4]
add eax, edi
lea ecx, [edx + esi]
cmp ecx, eax
jb 0xb37d34
mov eax, dword [ebp - 0xcb4]
sub edx, edi
sub edx, eax
add edx, esi
cmp edx, 8
jae 0xb37d34
xor edx, edx
mov dword [ebp - 0xb6c], edx
mov ecx, edx
mov dword [ebp - 0xbb4], ecx
mov esi, edx
test eax, eax
je 0xb37cc3
mov edx, dword [ebp - 0xb74]
lea ecx, [ebp - 0xcb8]
push ecx
mov ecx, eax
mov edi, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb37d39
mov eax, dword [ebp - 0xcb8]
jmp 0xb37cab
lea eax, [ebp - 0xcbc]
mov ecx, edi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb37d39
mov eax, dword [ebp - 0xcb8]
cmp dword [ebp - 0xcbc], eax
ja 0xb37cea
mov edx, dword [edi]
lea eax, [ebp - 0xcc0]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb37c6d
mov eax, dword [ebp - 0xcc0]
mov dword [ebp - 0xcc4], eax
jmp 0xb37c73
mov eax, dword [ebp - 0xcc4]
test esi, esi
js 0xb37d39
lea ecx, [ebp - 0xcc8]
mov edx, eax
push ecx
mov ecx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb37d39
mov edi, dword [ebp - 0xcc8]
mov eax, dword [ebp - 0xcb8]
cmp edi, eax
ja 0xb37cea
inc dword [ebp - 0xb6c]
cmp edi, eax
jb 0xb37c17
cmp edi, eax
jne 0xb37cea
mov edi, dword [ebp - 0xb74]
mov ecx, dword [ebp - 0xbb4]
test edi, edi
je 0xb37cf5
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xbb4], ecx
test ecx, ecx
jne 0xb37cf1
mov esi, 0xc0000017
jmp 0xb37d22
mov esi, 0xc000000d
jmp 0xb37d39
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0xcb4]
test eax, eax
je 0xb37d10
push edi
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [ebp - 0xbb4]
add esp, 0xc
mov eax, dword [ebp - 0xb6c]
mov dword [ebp - 0xe1c], ecx
mov dword [ebp - 0xe24], eax
test esi, esi
js 0xb37d39
mov eax, dword [ebp - 0xb84]
cmp eax, dword [ebp - 0xe24]
je 0xb37d39
mov esi, 0xc000003e
or esi, 0x10000000
mov eax, dword [ebp - 0xb98]
test eax, eax
je 0xb37d5a
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xb94]
test edi, edi
je 0xb37dc8
xor eax, eax
cmp dword [edi + 4], eax
je 0xb37d81
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xb37d9d
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xb37db9
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb90]
test eax, eax
je 0xb37de3
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb88]
test eax, eax
je 0xb37dfe
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xba4]
test edi, edi
je 0xb37e6c
xor eax, eax
cmp dword [edi + 4], eax
je 0xb37e25
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xb37e41
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xb37e5d
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb78]
test eax, eax
je 0xb37e87
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xb37f3b
mov edi, dword [ebp - 0xe24]
cmp edi, 1
jb 0xb37f3b
mov esi, dword [ebp - 0xe1c]
test esi, esi
je 0xb37f3b
test edi, edi
je 0xb37f3b
lea eax, [ebp - 0xccc]
mov dword [ebp - 0xccc], esi
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb37f3b
mov eax, dword [esi]
neg eax
sbb eax, eax
and eax, dword [ebp - 0xccc]
push 4
pop ecx
cmp dword [esi], ecx
jne 0xb37f3b
cmp dword [eax], 0
jl 0xb37f3b
cmp edi, 1
jbe 0xb37f3b
xor eax, eax
mov dword [ebp - 0xcd0], esi
mov edi, eax
lea eax, [ebp - 0xcd0]
mov edx, ecx
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb37f35
mov edx, dword [esi]
lea eax, [ebp - 0xcd0]
mov ecx, dword [ebp - 0xcd0]
push eax
call fcn.00a32533
test eax, eax
js 0xb37f35
inc edi
cmp edi, 1
jae 0xb37f35
mov esi, dword [ebp - 0xcd0]
push 4
pop ecx
jmp 0xb37ef8
mov ebx, dword [ebp - 0xb44]
mov eax, dword [ebp - 0xba0]
mov edi, dword [ebp - 0xb58]
test eax, eax
je 0xb37f5c
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xe1c]
test esi, esi
je 0xb37f77
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb5c]
test eax, eax
je 0xb37f92
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xb37fa7
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb54]
xor edx, edx
mov dword [ebp - 0xb54], edx
mov dword [ebp - 0xcd8], eax
jmp 0xb2e5c3
mov eax, dword [ebp - 0xe10]
jmp 0xb37f47
mov eax, dword [ebp - 0xe10]
jmp 0xb37f41
cmp ebx, 0xd00000e5
je 0xb37ffc
cmp ebx, 0xc004d501
je 0xb37ffc
cmp ebx, 0xd000003e
jne 0xa8af9e
mov ebx, 0xc004f028
jmp 0xb2e663
mov ebx, 0xc004f027
jmp 0xa8af9e
cmp ebx, 0x8007007a
jne 0xb2e663
mov esi, 0xc004f01e
jmp 0xb2e665
mov ecx, dword [ebp + 4]
mov edx, 0x9b
push esi
push 0x9f9158
call fcn.00ab606d
jmp 0xa8afca