Function at 0xb69df5
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe44
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
xor edx, edx
push ebx
push esi
mov dword [ebp - 0xbb4], edx
mov ebx, 0xc96238
mov dword [ebp - 0xbc4], edx
mov dword [ebp - 0xbd8], edx
mov dword [ebp - 0xbf0], edx
mov dword [ebp - 0xbf4], edx
lea ecx, [edx + 1]
xor eax, eax
lock cmpxchg dword [ebx], ecx
test eax, eax
jne 0xb69e31
mov eax, dword [0xc95890]
or ebx, 0xffffffff
mov dword [ebp - 0xbf8], ebx
mov dword [ebp - 0xc00], 0x67
mov dword [ebp - 0xc04], 0x337
mov dword [ebp - 0xc08], 0x10b
mov dword [ebp - 0xc0c], 0x20b
push edi
mov edi, 0x9fbcf2
mov dword [ebp - 0xbfc], edi
push 0
pop edx
test eax, eax
jne 0xb6a493
push 0x338
mov esi, edx
mov dword [ebp - 0xb8c], edx
push edx
mov dword [ebp - 0xb38], edx
mov dword [ebp - 0xb0c], esi
mov dword [ebp - 0xb54], edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xaec], eax
test eax, eax
je 0xb6a487
mov esi, 0xab69605e
mov dword [ebp - 0xb40], ebx
mov dword [ebp - 0x384], esi
xor edx, edx
mov esi, 0x7f1137f
mov dword [ebp - 0xb3c], edx
mov dword [ebp - 0x380], esi
add eax, 7
mov esi, edi
mov dword [ebp - 0xadc], eax
mov cl, dl
mov dword [ebp - 0xac4], esi
mov ebx, edx
mov dword [ebp - 0xabc], 0x67
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xac4]
xor edx, edi
mov dword [ebp - 0xb00], edx
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xac4]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xac4]
shl esi, 8
add dword [ebp - 0xac4], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
xor ebx, edx
xor ebx, 0xac987321
lea eax, [ebx + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, ebx
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0xb00]
xor eax, edx
mov dword [ebp - 0xb00], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xb00]
rol eax, 2
sub edx, eax
xor ebx, edx
imul edx, ebx, 0x605e
mov eax, ebx
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xb00]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xb00], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xb00]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xb00]
xor edx, eax
mov dword [ebp - 0xb00], edx
mov eax, dword [ebp - 0xb00]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor ebx, edx
lea eax, [ebx + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, ebx
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xb00]
xor eax, edx
mov dword [ebp - 0xb00], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xb00]
rol eax, 8
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, ebx
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xb00]
xor eax, edx
mov dword [ebp - 0xb00], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xb00]
shr eax, 0xa
xor edx, eax
xor edx, ebx
mov ebx, dword [ebp - 0xb00]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
mov dword [ebp - 0xb00], ebx
add ebx, 0xfffff80f
xor ebx, edx
xor ebx, 0xab69605e
mov eax, ebx
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, ebx
shr eax, 2
add edx, eax
mov eax, dword [ebp - 0xb00]
xor eax, edx
mov dword [ebp - 0xb00], eax
add eax, 0xf80eec81
ror eax, 6
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xb00]
rol eax, 7
add edx, eax
xor ebx, edx
mov eax, ebx
mov edx, ebx
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
mov eax, dword [ebp - 0xb00]
xor eax, edx
mov dword [ebp - 0xb00], eax
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xb00]
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xb00]
xor ebx, edx
xor eax, ebx
xor eax, 0xac987321
mov dword [ebp - 0xb00], eax
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor ebx, eax
lea eax, [ebx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, ebx
ror eax, 6
sub edx, eax
mov eax, dword [ebp - 0xb00]
xor eax, edx
mov dword [ebp - 0xb00], eax
add eax, 0xab69605e
rol eax, 3
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xb00]
rol eax, 0xe
add edx, eax
xor ebx, edx
lea eax, [ebx - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, ebx
ror eax, 0xe
sub edx, eax
mov eax, dword [ebp - 0xb00]
xor eax, edx
mov dword [ebp - 0xb00], eax
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xb00]
shr eax, 3
xor edx, eax
xor ebx, edx
mov edx, 0x7f1137f
mov eax, ebx
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, ebx
xor ebx, dword [ebp - 0xb40]
rol eax, 2
mov dword [ebp - 0xb40], esi
mov esi, dword [ebp - 0xac4]
xor edx, eax
mov eax, dword [ebp - 0xadc]
xor edx, dword [ebp - 0xb3c]
xor dword [ebp - 0xb00], edx
mov edx, dword [ebp - 0xb00]
mov byte [eax - 4], dl
mov byte [eax], bl
ror edx, 8
mov byte [eax - 5], dl
ror ebx, 8
mov byte [eax - 1], bl
ror edx, 8
mov byte [eax - 6], dl
ror ebx, 8
mov byte [eax - 2], bl
ror edx, 8
ror ebx, 8
mov byte [eax - 7], dl
mov byte [eax - 3], bl
add eax, 8
ror edx, 8
ror ebx, 8
sub dword [ebp - 0xabc], 1
mov dword [ebp - 0xb3c], edi
mov dword [ebp - 0xadc], eax
jne 0xb69f09
mov esi, dword [ebp - 0xaec]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xb6a27b
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xb6a2ad
cmp edx, dword [0x9fc02c]
jne 0xb6a2ad
mov edi, esi
xor eax, eax
mov dword [ebp - 0xb0c], edi
mov esi, eax
mov ebx, 0x337
jmp 0xb6a2c2
mov edi, dword [ebp - 0xb0c]
or ebx, 0xffffffff
mov dword [ebp - 0xb54], 0xc004d501
xor eax, eax
test esi, esi
je 0xb6a2d5
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb54], 0
jl 0xb6a481
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xc960a0
push eax
push ebx
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xb6a417
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbb4]
jne 0xb6a30c
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xb6a47a
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xb38], ecx
cmp word [eax], dx
je 0xb6a359
mov ecx, 0xc000007b
mov dword [ebp - 0xb38], ecx
jmp 0xb6a3a1
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xb6a34c
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xb6a34c
cmp dword [edx], 0x4550
jne 0xb6a34c
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc08]
je 0xb6a38f
cmp ax, word [ebp - 0xc0c]
je 0xb6a38f
mov ecx, 0xc000000d
jmp 0xb6a351
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0xb00], eax
test eax, eax
je 0xb6a40b
mov edx, esi
mov dword [ebp - 0xabc], esi
lea eax, [edx + 1]
mov dword [ebp - 0xac4], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xb6a3c3
sub edx, dword [ebp - 0xac4]
inc esi
add esi, edx
test ecx, ecx
js 0xb6a3fc
push dword [ebp - 0xabc]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xb6a417
mov ecx, dword [ebp - 0xb8c]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xb38]
inc dword [ebp - 0xb8c]
inc ebx
cmp ebx, dword [ebp - 0xb00]
jb 0xb6a3b2
add edi, 0x10
cmp byte [esi], 0
jne 0xb6a305
mov ebx, dword [ebp - 0xb38]
mov esi, dword [ebp - 0xb0c]
test esi, esi
je 0xb6a438
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xb6a48e
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb6a451
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb6a440
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xb6a49b
mov ebx, 0xc000007a
jmp 0xb6a41d
mov esi, dword [ebp - 0xb0c]
mov ebx, 0xc000007a
jmp 0xb6a423
mov eax, dword [0xc95890]
inc eax
xor ebx, ebx
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
mov eax, ebx
mov dword [ebp - 0xb00], ebx
mov dword [ebp - 0xac4], eax
mov edi, ebx
mov eax, dword fs:[0x30]
mov dword [ebp - 0xabc], ebx
cmp dword [eax + 0x1d4], ebx
je 0xb6a791
mov esi, dword [0xc93088]
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0xadc], ecx
test ecx, ecx
jne 0xb6a4f3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb6a7d9
mov eax, ebx
mov esi, ebx
mov dword [ebp - 0xac4], eax
mov ebx, dword [0xc93098]
lea edx, [ebp - 0xc10]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xc99200]
call ebx
test eax, eax
jne 0xb6a582
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xb6a564
xor eax, eax
test esi, esi
jne 0xb6a55d
push dword [ebp - 0xc10]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xb6a556
mov eax, dword [ebp - 0xc10]
mov ecx, dword [ebp - 0xadc]
jmp 0xb6a4fd
mov ebx, 0x8007000e
jmp 0xb6a57e
mov ebx, 0x80004005
jmp 0xb6a592
test eax, eax
jne 0xb6a56f
mov ebx, 0x80004005
jmp 0xb6a57e
jg 0xb6a575
mov ebx, eax
jmp 0xb6a57e
movzx ebx, ax
or ebx, 0x80070000
xor eax, eax
jmp 0xb6a592
mov ebx, dword [ebp - 0xac4]
xor eax, eax
mov dword [ebp - 0xb00], esi
mov esi, eax
test esi, esi
je 0xb6a5a5
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb6a7b8
mov esi, dword [0xc93094]
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0xadc], ecx
test ecx, ecx
jne 0xb6a5f7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb6a5e7
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb6a7b8
mov ebx, 0x80004005
jmp 0xb6a7b8
xor edx, edx
mov eax, edx
mov esi, edx
mov dword [ebp - 0xac4], eax
mov ebx, dword [0xc93098]
lea edx, [ebp - 0xc14]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xc99200]
call ebx
test eax, eax
jne 0xb6a694
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xb6a670
xor eax, eax
test esi, esi
jne 0xb6a663
push dword [ebp - 0xc14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xb6a65c
mov eax, dword [ebp - 0xc14]
mov ecx, dword [ebp - 0xadc]
jmp 0xb6a603
mov ebx, 0x8007000e
jmp 0xb6a68a
mov ebx, 0x80004005
mov dword [ebp - 0xac4], ebx
jmp 0xb6a6a0
test eax, eax
jne 0xb6a67b
mov ebx, 0x80004005
jmp 0xb6a68a
jg 0xb6a681
mov ebx, eax
jmp 0xb6a68a
movzx ebx, ax
or ebx, 0x80070000
mov dword [ebp - 0xac4], ebx
xor eax, eax
jmp 0xb6a6a0
mov ebx, dword [ebp - 0xac4]
xor eax, eax
mov edi, esi
mov esi, eax
test esi, esi
je 0xb6a6b3
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb6a79d
mov eax, dword [ebp - 0xb00]
test eax, eax
je 0xb6a791
push 4
mov ecx, 0x9fb9c0
pop esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xb6a6f7
test dx, dx
je 0xb6a6f1
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xb6a6f7
add eax, esi
add ecx, esi
test dx, dx
jne 0xb6a6d1
xor ebx, ebx
mov eax, ebx
jmp 0xb6a6fe
sbb eax, eax
or eax, 1
xor ebx, ebx
test eax, eax
jne 0xb6a791
test edi, edi
je 0xb6a791
mov ecx, 0x9f98b0
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xb6a739
test dx, dx
je 0xb6a735
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xb6a739
add eax, esi
add ecx, esi
test dx, dx
jne 0xb6a715
mov eax, ebx
jmp 0xb6a73e
sbb eax, eax
or eax, 1
test eax, eax
jne 0xb6a791
push esi
lea eax, [ebp - 0xb80]
mov dword [ebp - 0xb80], ebx
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
jne 0xb6a783
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb6a77a
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb6a7a3
mov ebx, 0x80004005
jmp 0xb6a7a3
test byte [ebp - 0xb80], 0xf
jne 0xb6a791
xor eax, eax
inc eax
jmp 0xb6a797
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0xbf4], eax
mov ebx, dword [ebp - 0xac4]
test edi, edi
je 0xb6a7b8
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb00]
test eax, eax
je 0xb6a7d3
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xb6a7e1
xor ebx, ebx
mov dword [ebp - 0xbf4], ebx
jmp 0xb6a7e3
xor ebx, ebx
push 4
pop eax
push eax
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0xb00], esi
test esi, esi
jne 0xb6a8b5
mov ebx, 0x8007000e
mov eax, dword [ebp - 0xb80]
mov dword [ebp - 0xbf0], eax
xor edx, edx
mov edi, 0xc96238
lea ecx, [edx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xb6a817
mov eax, dword [0xc95890]
push 0
pop edx
test eax, eax
jle 0xb6a87c
sub eax, 1
mov dword [0xc95890], eax
jne 0xb6a87c
mov edi, edx
mov eax, dword [edi + 0xc960a0]
test eax, eax
je 0xb6a84d
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0xb6a83c
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xb00]
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
pop edi
test esi, esi
je 0xb6a891
push esi
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov eax, dword [ebp - 0xbc4]
test ebx, ebx
jns 0xb742ad
cmp ebx, 0xd0000034
jne 0xb74270
mov ebx, 0xc004f012
jmp 0xb742a5
mov eax, ebx
mov dword [ebp - 0xabc], ebx
mov dword [ebp - 0xadc], eax
lea edi, [ebp - 0xdb8]
mov dword [ebp - 0xda4], eax
xor eax, eax
stosd dword es:[edi], eax
mov dword [ebp - 0xac4], ebx
mov dword [ebp - 0xb40], ebx
mov dword [ebp - 0xb3c], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xaec], eax
mov dword [ebp - 0xb54], 0x38
test eax, eax
jne 0xb6aa2d
mov ebx, 0xc0000017
mov dword [ebp - 0xb0c], ebx
mov edi, dword [ebp - 0xabc]
mov eax, dword [ebp - 0xadc]
xor ecx, ecx
mov dword [ebp - 0xda8], ecx
mov dword [ebp - 0xdac], ecx
test eax, eax
je 0xb6a952
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0xda4], ecx
mov eax, dword [ebp - 0xdb0]
mov dword [ebp - 0xdb4], ecx
mov dword [ebp - 0xdb8], ecx
test eax, eax
je 0xb6a97f
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0xdb0], ecx
test edi, edi
je 0xb6a992
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xac4]
test eax, eax
je 0xb6a9ad
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb6a804
mov eax, dword [ebp - 0xbf4]
test eax, eax
je 0xb7423f
mov dword [0xc95878], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x2c0]
push eax
push 0x9d0000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0xb720b8
cmp eax, esi
jne 0xb6a9fb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0xb720b8
mov esi, dword [0xc9307c]
xor eax, eax
push 0x403
push eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0xab4], eax
test eax, eax
jne 0xb6d838
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb720b8
push 0x28
pop ecx
mov esi, 0xc94ea0
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, eax
mov dword [ebp - 0xabc], edi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xb38], ecx
test ecx, ecx
jne 0xb6aa74
mov ebx, 0xc0000017
mov dword [ebp - 0xb0c], ebx
mov esi, dword [ebp - 0xb00]
jmp 0xb6a923
mov eax, dword [0xc94e98]
mov dword [ecx], eax
mov eax, dword [0xc94e9c]
mov dword [ecx + 4], eax
mov dword [ebp - 0xac4], ecx
rdtsc
mov dword [ebp - 0xb8c], eax
mov dword [ebp - 0xad0], edx
lea eax, [ebp - 0xc1c]
mov dword [ebp - 0xc18], ebx
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov esi, dword [ebp - 0xc1c]
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
jns 0xb6aaca
mov esi, dword [ebp - 0xc20]
jmp 0xb6aa69
lea eax, [ebp - 0xc18]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb0c], ebx
jl 0xb6aa69
lea eax, [ebp - 0xc2c]
mov edx, 0xa0
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6aa69
mov esi, dword [ebp - 0xc2c]
mov ecx, dword [ebp - 0xc18]
lea eax, [ebp - 0xc18]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb0c], ebx
jl 0xb6aa69
lea eax, [ebp - 0xbac]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6aa69
mov esi, dword [ebp - 0xbac]
mov ecx, dword [ebp - 0xc18]
lea eax, [ebp - 0xc18]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb0c], ebx
jl 0xb6aa69
lea eax, [ebp - 0xc30]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6aa69
mov esi, dword [ebp - 0xc30]
mov ecx, dword [ebp - 0xc18]
lea eax, [ebp - 0xc18]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb0c], ebx
jl 0xb6aa69
lea eax, [ebp - 0xc38]
mov edx, SysReAllocString
push eax
mov ecx, 0xa16fa4
call fcn.00a41606
test eax, eax
jns 0xb6ac0a
mov ebx, 0xc000003e
jmp 0xb6aa63
mov edx, dword [ebp - 0xc38]
lea eax, [ebp - 0xc48]
push eax
inc edx
push 4
pop eax
mov dword [ebp - 0xc38], edx
mov ecx, eax
add edx, edx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6aa69
mov esi, dword [ebp - 0xc48]
mov ecx, dword [ebp - 0xc18]
lea eax, [ebp - 0xc18]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb0c], ebx
jl 0xb6aa69
lea eax, [ebp - 0xc4c]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6aa69
mov esi, dword [ebp - 0xc4c]
mov ecx, dword [ebp - 0xc18]
lea eax, [ebp - 0xc18]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb0c], ebx
jl 0xb6aa69
lea eax, [ebp - 0xc50]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6aa69
mov esi, dword [ebp - 0xc50]
mov ecx, dword [ebp - 0xc18]
lea eax, [ebp - 0xc18]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb0c], ebx
jl 0xb6aa69
push dword [ebp - 0xc18]
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xaa0], edi
test edi, edi
jne 0xb6ad41
mov ebx, 0xc0000017
mov dword [ebp - 0xb0c], ebx
mov esi, dword [ebp - 0xb00]
jmp 0xb6a91d
mov eax, edi
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0xda4], eax
xor eax, eax
mov esi, eax
mov dword [ebp - 0xa9c], esi
mov dword [ebp - 0xc5c], eax
mov dword [ebp - 0xc60], edi
push 4
pop ecx
lea eax, [ebp - 0xd84]
mov dword [ebp - 0xd88], ecx
mov edx, ecx
mov ecx, edi
push eax
call fcn.00a32533
mov ebx, eax
xor edx, edx
mov dword [ebp - 0xb0c], ebx
mov ecx, edx
test ebx, ebx
js 0xb6ad36
mov ecx, dword [ebp - 0xc18]
lea eax, [edi + 8]
add ecx, edi
cmp eax, ecx
jbe 0xb6ada4
mov ebx, 0xc0000023
jmp 0xb6ad30
push 4
pop eax
mov dword [edi], eax
mov eax, dword [ebp - 0xd84]
mov dword [eax], edx
xor eax, eax
lea esi, [eax + 1]
mov dword [ebp - 0xa9c], esi
lea ecx, [eax + 1]
test ebx, ebx
js 0xb6ad36
mov dword [ebp - 0xa6c], edx
mov eax, edi
mov dword [ebp - 0xc64], eax
test ecx, ecx
je 0xb6ae4f
mov edx, dword [eax]
lea ecx, [ebp - 0xc8c]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6ae06
mov eax, dword [ebp - 0xc8c]
mov dword [ebp - 0xc90], eax
jmp 0xb6ae0c
mov eax, dword [ebp - 0xc90]
test ebx, ebx
js 0xb6ad36
lea ecx, [ebp - 0xc64]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xc64]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6ad36
mov eax, dword [ebp - 0xa6c]
inc eax
mov dword [ebp - 0xa6c], eax
cmp eax, esi
mov eax, dword [ebp - 0xc64]
jb 0xb6add9
lea ecx, [ebp - 0xd5c]
mov dword [ebp - 0xd60], 0xa0
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6ad36
mov edx, dword [ebp - 0xc64]
mov ecx, dword [ebp - 0xc18]
add ecx, edi
lea eax, [edx + 0xa4]
cmp eax, ecx
ja 0xb6ad9d
mov esi, dword [ebp - 0xaec]
mov edi, dword [ebp - 0xd5c]
push 0x28
pop ecx
mov dword [edx], 0xa0
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xa9c]
mov edi, dword [ebp - 0xaa0]
inc esi
mov dword [ebp - 0xa9c], esi
test ebx, ebx
js 0xb6ad36
xor ecx, ecx
mov eax, edi
mov dword [ebp - 0xc94], eax
mov dword [ebp - 0xa6c], ecx
test esi, esi
je 0xb6af54
mov edx, dword [eax]
lea ecx, [ebp - 0xc98]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6af0b
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0xc9c], eax
jmp 0xb6af11
mov eax, dword [ebp - 0xc9c]
test ebx, ebx
js 0xb6ad36
lea ecx, [ebp - 0xc94]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xc94]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6ad36
mov eax, dword [ebp - 0xa6c]
inc eax
mov dword [ebp - 0xa6c], eax
cmp eax, esi
mov eax, dword [ebp - 0xc94]
jb 0xb6aede
lea ecx, [ebp - 0xd64]
mov dword [ebp - 0xd68], 8
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6ad36
mov edx, dword [ebp - 0xc94]
mov ecx, dword [ebp - 0xc18]
add ecx, edi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xb6ad9d
mov ecx, dword [ebp - 0xd64]
inc esi
mov dword [edx], 8
mov edx, dword [ebp - 0xb38]
mov dword [ebp - 0xa9c], esi
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
test ebx, ebx
js 0xb6ad36
mov eax, dword [ebp - 0xb8c]
xor ecx, ecx
mov dword [ebp - 0xd80], eax
mov eax, dword [ebp - 0xad0]
mov dword [ebp - 0xd7c], eax
mov eax, edi
mov dword [ebp - 0xca0], eax
mov dword [ebp - 0xa6c], ecx
test esi, esi
je 0xb6b067
mov edx, dword [eax]
lea ecx, [ebp - 0xca4]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6b01e
mov eax, dword [ebp - 0xca4]
mov dword [ebp - 0xca8], eax
jmp 0xb6b024
mov eax, dword [ebp - 0xca8]
test ebx, ebx
js 0xb6ad36
lea ecx, [ebp - 0xca0]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xca0]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6ad36
mov eax, dword [ebp - 0xa6c]
inc eax
mov dword [ebp - 0xa6c], eax
cmp eax, esi
mov eax, dword [ebp - 0xca0]
jb 0xb6aff1
lea ecx, [ebp - 0xd9c]
mov dword [ebp - 0xda0], 8
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6ad36
mov edx, dword [ebp - 0xca0]
mov ecx, dword [ebp - 0xc18]
add ecx, edi
lea eax, [edx + 0xc]
cmp eax, ecx
ja 0xb6ad9d
mov eax, dword [ebp - 0xd9c]
inc esi
mov ecx, dword [ebp - 0xb8c]
mov dword [edx], 8
mov dword [ebp - 0xa9c], esi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xad0]
mov dword [eax + 4], ecx
test ebx, ebx
js 0xb6ad36
lea eax, [ebp - 0xcac]
mov edx, SysReAllocString
push eax
mov ecx, 0xa16fa4
call fcn.00a41606
test eax, eax
jns 0xb6b0fd
mov ebx, 0xc000003e
jmp 0xb6ad30
mov ecx, dword [ebp - 0xcac]
lea eax, [ebp - 0xcac]
push eax
xor eax, eax
lea edx, [eax + 1]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6ad36
mov eax, dword [ebp - 0xcac]
add eax, eax
mov dword [ebp - 0xa6c], eax
je 0xb6b23a
xor ecx, ecx
mov eax, edi
mov dword [ebp - 0xcb0], eax
mov dword [ebp - 0xaa0], ecx
test esi, esi
je 0xb6b1c2
mov edx, dword [eax]
lea ecx, [ebp - 0xcb4]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6b179
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0xcb8], eax
jmp 0xb6b17f
mov eax, dword [ebp - 0xcb8]
test ebx, ebx
js 0xb6ad36
lea ecx, [ebp - 0xcb0]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xcb0]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6ad36
mov eax, dword [ebp - 0xaa0]
inc eax
mov dword [ebp - 0xaa0], eax
cmp eax, esi
mov eax, dword [ebp - 0xcb0]
jb 0xb6b14c
mov ecx, dword [ebp - 0xa6c]
mov dword [ebp - 0xd90], ecx
lea ecx, [ebp - 0xd8c]
push ecx
push 4
pop ecx
mov edx, ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6ad36
mov eax, dword [ebp - 0xa6c]
mov ecx, dword [ebp - 0xc18]
add eax, 4
mov edx, dword [ebp - 0xcb0]
add ecx, edi
add eax, edx
cmp eax, ecx
jbe 0xb6b215
mov ebx, 0xc0000023
jmp 0xb6b23f
mov eax, dword [ebp - 0xa6c]
push eax
push 0xa16fa4
push dword [ebp - 0xd8c]
mov dword [edx], eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
inc esi
mov dword [ebp - 0xa9c], esi
jmp 0xb6b245
mov ebx, 0xc000000d
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6ad36
mov eax, dword [ebp - 0xbf4]
xor ecx, ecx
mov dword [ebp - 0xcbc], eax
mov eax, edi
mov dword [ebp - 0xcc0], eax
mov dword [ebp - 0xa6c], ecx
test esi, esi
je 0xb6b2e3
mov edx, dword [eax]
lea ecx, [ebp - 0xcc8]
push ecx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6b29a
mov eax, dword [ebp - 0xcc8]
mov dword [ebp - 0xccc], eax
jmp 0xb6b2a0
mov eax, dword [ebp - 0xccc]
test ebx, ebx
js 0xb6ad36
lea ecx, [ebp - 0xcc0]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xcc0]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6ad36
mov eax, dword [ebp - 0xa6c]
inc eax
mov dword [ebp - 0xa6c], eax
cmp eax, esi
mov eax, dword [ebp - 0xcc0]
jb 0xb6b26d
push 4
pop edx
lea ecx, [ebp - 0xd4c]
mov dword [ebp - 0xd50], edx
push ecx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6ad36
mov edx, dword [ebp - 0xcc0]
mov ecx, dword [ebp - 0xc18]
add ecx, edi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xb6ad9d
mov ecx, dword [ebp - 0xbf4]
inc esi
push 4
pop eax
mov dword [edx], eax
mov eax, dword [ebp - 0xd4c]
mov dword [ebp - 0xa9c], esi
mov dword [eax], ecx
test ebx, ebx
js 0xb6ad36
push 4
xor ecx, ecx
mov eax, edi
mov dword [ebp - 0xcd4], eax
mov dword [ebp - 0xa6c], ecx
pop ebx
mov dword [ebp - 0xcd0], ebx
test esi, esi
je 0xb6b3d4
mov edx, dword [eax]
lea ecx, [ebp - 0xcd8]
push ecx
mov ecx, ebx
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6b38c
mov eax, dword [ebp - 0xcd8]
mov dword [ebp - 0xcdc], eax
jmp 0xb6b392
mov eax, dword [ebp - 0xcdc]
test ebx, ebx
js 0xb6b425
lea ecx, [ebp - 0xcd4]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xcd4]
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
push 4
test ebx, ebx
js 0xb6b427
mov eax, dword [ebp - 0xa6c]
inc eax
mov dword [ebp - 0xa6c], eax
cmp eax, esi
mov eax, dword [ebp - 0xcd4]
pop ebx
jb 0xb6b362
lea ecx, [ebp - 0xd54]
mov dword [ebp - 0xd58], ebx
push ecx
mov edx, ebx
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6b425
mov edx, dword [ebp - 0xcd4]
mov ecx, dword [ebp - 0xc18]
add ecx, edi
lea eax, [edx + 8]
cmp eax, ecx
ja 0xb6ad9d
mov eax, dword [ebp - 0xd54]
inc esi
push 4
pop ecx
mov dword [edx], ecx
mov dword [eax], ecx
mov dword [ebp - 0xa9c], esi
jmp 0xb6b428
push 4
pop ecx
test ebx, ebx
js 0xb6ad36
lea eax, [ebp - 0xce0]
mov edx, ecx
push eax
call fcn.00a32533
mov esi, dword [ebp - 0xce0]
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
jns 0xb6b45b
mov esi, dword [ebp - 0xce4]
jmp 0xb6b5d9
lea eax, [ebp - 0xcec]
mov dword [ebp - 0xce8], esi
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6b5d9
mov esi, dword [ebp - 0xcec]
mov ecx, dword [ebp - 0xce8]
lea eax, [ebp - 0xce8]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6b5d9
lea eax, [ebp - 0xcf0]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6b5d9
mov esi, dword [ebp - 0xcf0]
mov ecx, dword [ebp - 0xce8]
lea eax, [ebp - 0xce8]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6b5d9
lea eax, [ebp - 0xcf4]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6b5d9
mov esi, dword [ebp - 0xcf4]
mov ecx, dword [ebp - 0xce8]
lea eax, [ebp - 0xce8]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6b5d9
lea eax, [ebp - 0xcf8]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6b5d9
mov esi, dword [ebp - 0xcf8]
mov ecx, dword [ebp - 0xce8]
lea eax, [ebp - 0xce8]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6b5d9
lea eax, [ebp - 0xb58]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6b5d9
mov esi, dword [ebp - 0xb58]
mov ecx, dword [ebp - 0xce8]
lea eax, [ebp - 0xce8]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0xce8]
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
jns 0xb6b5df
mov eax, dword [ebp - 0xb58]
mov dword [ebp - 0xa6c], eax
test ebx, ebx
js 0xb6ad36
xor ecx, ecx
rdtsc
mov esi, ecx
mov dword [ebp - 0xaa0], ecx
mov dword [ebp - 0xaec], esi
mov dword [ebp - 0xb38], ecx
mov dword [ebp - 0xaa4], ecx
mov dword [ebp - 0xa94], ecx
mov dword [ebp - 0xa90], ecx
mov dword [ebp - 0xa74], ecx
mov dword [ebp - 0xa84], ecx
mov dword [ebp - 0xa88], ecx
mov dword [ebp - 0xb04], ecx
mov dword [ebp - 0xb0c], eax
mov dword [ebp - 0xa8c], edx
push 8
pop ecx
mov dword [ebp - 0xcfc], ecx
mov edx, dword [ebp - 0xc18]
lea eax, [ebp - 0xcfc]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6b754
mov eax, dword [ebp - 0xcfc]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0xa80], ecx
cmp ecx, eax
jae 0xb6b680
mov ebx, 0xc0000095
jmp 0xb6b754
mov dword [ebp - 0xcfc], ecx
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xb6b6a6
mov ebx, 0xc0000017
jmp 0xb6b74e
mov eax, dword [ebp - 0xa9c]
mov ecx, esi
mov dword [esi], eax
lea eax, [ebp - 0xd00]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xd00], esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6b739
mov ecx, dword [ebp - 0xd00]
mov eax, dword [ebp - 0xc18]
mov dword [ecx], eax
lea eax, [ebp - 0xd00]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6b739
mov eax, dword [ebp - 0xa80]
push dword [ebp - 0xc18]
mov ecx, dword [ebp - 0xb0c]
push edi
push dword [ebp - 0xd00]
mov dword [esi + eax - 8], ecx
mov ecx, dword [ebp - 0xa8c]
mov dword [esi + eax - 4], ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xa80]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xaa0], esi
mov esi, ecx
mov dword [ebp - 0xaec], eax
jmp 0xb6b73b
xor ecx, ecx
test esi, esi
je 0xb6b74e
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xaec]
or ebx, 0x10000000
mov dword [ebp - 0xb0c], ebx
jl 0xb6d13a
xor eax, eax
mov dword [ebp - 0xa80], eax
cmp dword [ebp - 0xaa0], eax
jne 0xb6b780
mov ebx, 0xc000000d
jmp 0xb6bdba
test esi, esi
je 0xb6bdb5
lea ebx, [esi + 8]
push ebx
push eax
mov dword [ebp - 0xa8c], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xb0c], edi
test edi, edi
je 0xb6bdb5
xor eax, eax
mov cl, al
mov edx, eax
test esi, esi
je 0xb6b7c8
mov eax, dword [ebp - 0xaa0]
xor cl, byte [edx + eax]
inc edx
cmp edx, esi
jb 0xb6b7c0
mov eax, 0xb1b54a58
mov dword [ebp - 0x364], eax
mov eax, 0xc81ecb17
mov dword [ebp - 0x360], eax
mov eax, esi
shr eax, 3
mov dword [ebp - 0xa78], eax
test eax, eax
je 0xb6bbdf
movzx edx, word [ebp - 0x362]
mov eax, 0xc81ecb17
movzx esi, ax
add edi, 7
movzx eax, word [ebp - 0x35e]
mov dword [ebp - 0xa7c], eax
mov eax, 0xb1b54a58
movzx eax, ax
mov dword [ebp - 0xa70], esi
mov esi, dword [ebp - 0xaa0]
mov dword [ebp - 0xaa8], eax
add esi, 2
xor eax, eax
mov dword [ebp - 0xaac], edx
mov dword [ebp - 0xac0], edi
mov edx, eax
mov dword [ebp - 0xac8], esi
or ebx, 0xffffffff
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xa98], eax
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xac8]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xac8]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xac8]
shl esi, 8
add dword [ebp - 0xac8], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov eax, ebx
sub eax, dword [ebp - 0xaa8]
xor eax, edi
xor eax, edx
xor eax, 0xc81ecb17
mov edx, eax
mov dword [ebp - 0xab4], eax
xor edx, 0xc81ecb17
ror eax, 7
ror edx, 0xf
imul edx, dword [ebp - 0xaac]
add edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
mov eax, ebx
ror eax, 0xa
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [ebp - 0xa70]
sub edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xab4], eax
xor edx, dword [ebp - 0xa70]
rol edx, 4
imul edx, dword [ebp - 0xa7c]
rol eax, 5
add edx, eax
mov eax, 0xc81ecb17
xor ebx, edx
mov edx, 0xb1b54a58
xor edx, ebx
sub eax, edx
mov edx, dword [ebp - 0xab4]
xor edx, eax
mov dword [ebp - 0xab4], edx
sub edx, dword [ebp - 0xaa8]
imul edx, dword [ebp - 0xaac]
mov eax, dword [ebp - 0xab4]
shr eax, 6
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xab4]
mov eax, ebx
ror eax, 0xf
xor eax, dword [ebp - 0xa70]
imul eax, dword [ebp - 0xaa8]
xor edx, eax
mov eax, edx
not eax
ror eax, 3
add eax, dword [ebp - 0xa7c]
imul eax, dword [ebp - 0xa70]
xor ebx, eax
mov eax, ebx
sub eax, 0xc81ecb17
sub eax, dword [ebp - 0xaa8]
xor edx, eax
mov dword [ebp - 0xab4], edx
mov eax, dword [ebp - 0xab4]
xor eax, dword [ebp - 0xa7c]
imul eax, dword [ebp - 0xaac]
ror edx, 0xa
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xaa8]
rol edx, 6
imul edx, dword [ebp - 0xa70]
ror eax, 3
xor edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov dword [ebp - 0xab4], eax
ror eax, 0xf
sub eax, dword [ebp - 0xa7c]
imul eax, dword [ebp - 0xaa8]
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xa7c]
imul edx, dword [ebp - 0xaa8]
shr eax, 1
xor edx, eax
mov eax, ebx
xor dword [ebp - 0xab4], edx
mov edx, ebx
sub edx, dword [ebp - 0xa70]
rol edx, 3
imul edx, dword [ebp - 0xaa8]
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xab4], eax
sub edx, dword [ebp - 0xa70]
imul edx, dword [ebp - 0xaac]
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 9
imul edx, dword [ebp - 0xa70]
ror eax, 0xb
xor edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov dword [ebp - 0xab4], eax
sub eax, 0xb1b54a58
sub eax, dword [ebp - 0xa7c]
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0xaac]
imul eax, dword [ebp - 0xaa8]
ror edx, 7
sub eax, edx
mov edx, dword [ebp - 0xab4]
xor edx, eax
mov dword [ebp - 0xab4], edx
xor edx, dword [ebp - 0xa7c]
mov eax, dword [ebp - 0xab4]
rol edx, 4
imul edx, dword [ebp - 0xaac]
ror eax, 0x10
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 0xa
imul edx, dword [ebp - 0xa70]
ror eax, 4
add edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xab4], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, dword [ebp - 0xa7c]
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, 0xc81ecb17
rol eax, 2
rol edx, 8
imul edx, dword [ebp - 0xaa8]
sub edx, eax
mov eax, dword [ebp - 0xab4]
xor eax, edx
mov edx, 0xc81ecb17
sub edx, eax
mov dword [ebp - 0xab4], eax
ror edx, 0xb
imul edx, dword [ebp - 0xaac]
ror eax, 0xc
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xaac]
imul edx, dword [ebp - 0xa70]
shr eax, 8
xor edx, eax
mov eax, 0xb1b54a58
xor dword [ebp - 0xab4], edx
xor eax, ebx
mov edx, dword [ebp - 0xab4]
mov ebx, 0xc81ecb17
xor eax, edx
xor edx, dword [ebp - 0xab0]
xor ebx, eax
mov dword [ebp - 0xab0], edi
mov eax, dword [ebp - 0xac0]
xor ebx, dword [ebp - 0xa98]
mov dword [ebp - 0xa98], esi
mov esi, dword [ebp - 0xac8]
mov byte [eax - 4], dl
mov byte [eax], bl
ror edx, 8
mov byte [eax - 5], dl
ror ebx, 8
mov byte [eax - 1], bl
ror edx, 8
mov byte [eax - 6], dl
ror ebx, 8
mov byte [eax - 2], bl
ror edx, 8
ror ebx, 8
mov byte [eax - 7], dl
mov byte [eax - 3], bl
add eax, 8
ror edx, 8
ror ebx, 8
sub dword [ebp - 0xa78], 1
mov dword [ebp - 0xac0], eax
jne 0xb6b852
mov esi, dword [ebp - 0xaec]
mov edi, dword [ebp - 0xb0c]
mov ebx, dword [ebp - 0xa8c]
movzx eax, cl
cdq
mov dword [edi + esi], eax
mov dword [edi + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xab4], esi
test esi, esi
jne 0xb6bc11
mov ebx, 0xc0000017
jmp 0xb6bd1e
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xb6bc33
mov ebx, 0xc0000017
xor edx, edx
jmp 0xb6bcb7
mov dword [esi + 4], eax
push ebx
push edi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [esi + 8], eax
push eax
push 8
pop ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb6bc27
mov dword [esi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0xc94df0
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0xab4]
push ebx
push ebx
mov dword [esi + 0x10], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, dword [ebp - 0xb0c]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0xb6bc9b
mov ebx, 0xc0000017
jmp 0xb6bcb7
mov dword [esi + 0x14], ecx
mov ebx, edx
mov eax, dword [0xc94e90]
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [ebp - 0xa80], esi
mov esi, edx
mov dword [ecx + 4], eax
test esi, esi
je 0xb6bd1e
cmp dword [esi + 4], 0
je 0xb6bcd7
push dword [esi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 4], edx
cmp dword [esi + 0xc], 0
je 0xb6bcf3
push dword [esi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0xc], edx
cmp dword [esi + 0x14], 0
je 0xb6bd0f
push dword [esi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0x14], edx
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb6bd34
mov eax, dword [ebp - 0xa80]
mov dword [ebp - 0xb38], eax
xor eax, eax
mov esi, eax
jmp 0xb6bd3c
mov esi, dword [ebp - 0xa80]
xor eax, eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
je 0xb6bdba
xor eax, eax
cmp dword [esi + 4], eax
je 0xb6bd6c
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xb6bd88
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xb6bda4
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb6bdba
mov ebx, 0xc0000001
mov esi, 0x10000000
or ebx, esi
mov dword [ebp - 0xb0c], ebx
jl 0xb6d13a
mov esi, dword [ebp - 0xb38]
lea eax, [ebp - 0xd04]
push 4
pop edi
push eax
mov edx, dword [esi]
mov ecx, edi
mov dword [ebp - 0xd04], edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6be62
mov ecx, dword [ebp - 0xd04]
lea eax, [ebp - 0xd04]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6be62
mov edx, dword [esi + 8]
lea eax, [ebp - 0xd04]
mov ecx, dword [ebp - 0xd04]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6be62
mov ecx, dword [ebp - 0xd04]
lea eax, [ebp - 0xd04]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6be62
mov edx, dword [esi + 0x10]
lea eax, [ebp - 0xd04]
mov ecx, dword [ebp - 0xd04]
push eax
call fcn.00a32533
mov edi, dword [ebp - 0xd04]
mov ebx, eax
test ebx, ebx
jns 0xb6be70
mov edi, dword [ebp - 0xcc4]
test ebx, ebx
js 0xb6bfd9
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xb6be90
mov ebx, 0xc0000017
jmp 0xb6bfd9
mov eax, dword [ebp - 0xb38]
mov ecx, esi
mov dword [ebp - 0xd08], esi
mov eax, dword [eax]
mov dword [esi], eax
lea eax, [ebp - 0xd08]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6bfc4
mov ebx, dword [ebp - 0xb38]
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0xd08]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx]
lea eax, [ebp - 0xd08]
mov ecx, dword [ebp - 0xd08]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6bfc4
mov eax, dword [ebp - 0xb38]
mov ecx, dword [ebp - 0xd08]
mov eax, dword [eax + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xd08]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6bfc4
mov ebx, dword [ebp - 0xb38]
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0xd08]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xd08]
mov ecx, dword [ebp - 0xd08]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6bfc4
mov eax, dword [ebp - 0xb38]
mov ecx, dword [ebp - 0xd08]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xd08]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6bfc4
mov ebx, dword [ebp - 0xb38]
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0xd08]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xd08]
mov ecx, dword [ebp - 0xd08]
add esp, 0xc
push eax
call fcn.00a32533
mov ebx, eax
xor eax, eax
test ebx, ebx
js 0xb6bfc6
mov dword [ebp - 0xaa4], esi
mov esi, eax
mov dword [ebp - 0xa94], edi
jmp 0xb6bfc6
xor eax, eax
test esi, esi
je 0xb6bfd9
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, 0x10000000
or ebx, esi
mov dword [ebp - 0xb0c], ebx
jl 0xb6d13a
xor eax, eax
mov dword [ebp - 0xd0c], 8
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xa98], eax
mov edx, dword [ebp - 0xa6c]
lea eax, [ebp - 0xd0c]
push eax
push 8
pop ecx
call fcn.00a32533
mov ebx, eax
or ebx, esi
mov dword [ebp - 0xb0c], ebx
jl 0xb6c14e
mov eax, dword [ebp - 0xd0c]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xb6c046
mov ebx, 0xc0000095
mov dword [ebp - 0xb0c], ebx
jmp 0xb6c06d
mov dword [ebp - 0xd14], ecx
lea eax, [ebp - 0xd14]
push eax
push 8
pop edx
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0xd14]
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
jns 0xb6c073
mov eax, dword [ebp - 0xd10]
mov dword [ebp - 0xab0], eax
test ebx, ebx
js 0xb6c2fd
mov eax, dword [ebp - 0xadc]
xor edi, edi
inc edi
test eax, eax
jne 0xb6c09e
mov ebx, 0xc000000d
mov dword [ebp - 0xb0c], ebx
jmp 0xb6c151
mov esi, dword [ebp - 0xa9c]
cmp esi, edi
jbe 0xb6c08e
mov ecx, eax
xor eax, eax
mov dword [ebp - 0xd18], ecx
mov edi, eax
mov eax, dword [ecx]
mov dword [ebp - 0xac8], eax
lea eax, [ebp - 0xd18]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6c14e
mov edx, dword [ebp - 0xac8]
lea eax, [ebp - 0xd18]
mov ecx, dword [ebp - 0xd18]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6c14e
mov ecx, dword [ebp - 0xd18]
xor eax, eax
inc edi
inc eax
cmp edi, eax
jb 0xb6c0b4
mov edi, dword [ecx]
lea eax, [ebp - 0xd18]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6c14e
mov dword [ebp - 0xab4], edi
neg edi
sbb edi, edi
and dword [ebp - 0xd18], edi
test ebx, ebx
js 0xb6c14e
cmp esi, 2
ja 0xb6c187
mov ebx, 0xc000000d
mov dword [ebp - 0xb0c], ebx
xor edi, edi
inc edi
mov esi, dword [ebp - 0xa74]
test ebx, ebx
js 0xb6d13a
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xb6c30b
mov ecx, dword [ebp - 0xa90]
mov ebx, 0xd0000017
jmp 0xb6c318
mov ecx, dword [ebp - 0xadc]
xor eax, eax
mov dword [ebp - 0xd1c], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xd1c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6c20f
mov ecx, dword [ebp - 0xd1c]
lea eax, [ebp - 0xd1c]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6c20f
mov ecx, dword [ebp - 0xd1c]
inc esi
cmp esi, 2
jb 0xb6c197
mov esi, dword [ecx]
lea eax, [ebp - 0xd1c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6c20f
mov edi, esi
neg esi
sbb esi, esi
and dword [ebp - 0xd1c], esi
jmp 0xb6c215
mov edi, dword [ebp - 0xa98]
test ebx, ebx
js 0xb6c14e
mov edx, dword [ebp - 0xab0]
lea eax, [ebp - 0xd20]
push 4
pop esi
push eax
mov ecx, esi
mov dword [ebp - 0xd20], esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6c2d4
mov ecx, dword [ebp - 0xd20]
lea eax, [ebp - 0xd20]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6c2d4
mov edx, dword [ebp - 0xab4]
lea eax, [ebp - 0xd20]
mov ecx, dword [ebp - 0xd20]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6c2d4
mov ecx, dword [ebp - 0xd20]
lea eax, [ebp - 0xd20]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6c2d4
mov ecx, dword [ebp - 0xd20]
lea eax, [ebp - 0xd20]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov eax, dword [ebp - 0xd20]
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
jns 0xb6c2e2
mov eax, dword [ebp - 0xd24]
test ebx, ebx
js 0xb6c14e
cmp eax, 0x400000
jbe 0xb6c2f3
mov ebx, 0x8000ffff
jmp 0xb6d134
mov esi, eax
mov dword [ebp - 0xa74], esi
jmp 0xb6c303
mov esi, dword [ebp - 0xa74]
xor edi, edi
inc edi
jmp 0xb6c157
mov ecx, eax
mov dword [ebp - 0xa90], eax
mov ebx, 0x10000000
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6d13a
mov eax, dword [ebp - 0xaa4]
test eax, eax
jne 0xb6c33a
mov ebx, 0x80070057
jmp 0xb6d134
test ecx, ecx
je 0xb6c330
mov dword [ebp - 0xe30], eax
xor ebx, ebx
mov eax, dword [ebp - 0xa94]
mov dword [ebp - 0xe28], eax
lea eax, [ebp - 0xd28]
push eax
push 0x9f29b8
push edi
mov dword [ebp - 0xe2c], ecx
mov dword [ebp - 0xe24], esi
mov dword [ebp - 0xe20], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xb6c3b1
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
jle 0xb6c39e
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6c430
mov ebx, 0x80004005
mov dword [ebp - 0xb0c], ebx
jmp 0xb6c430
push 0x9fc030
push dword [ebp - 0xd28]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0xb6c3f3
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
jle 0xb6c3eb
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
mov esi, dword [ebp - 0xa74]
jmp 0xb6c39e
push ebx
push 0x14
lea eax, [ebp - 0xe30]
mov ecx, esi
push eax
push 0x86
call dword [0xc99200]
call esi
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xb0c], ebx
jl 0xb6c42a
mov esi, dword [ebp - 0xe24]
mov dword [ebp - 0xa74], esi
jmp 0xb6c430
mov esi, dword [ebp - 0xa74]
cmp ebx, 0xd0000023
jne 0xb6c442
mov ebx, 0x8007007a
jmp 0xb6d134
test ebx, ebx
js 0xb6d13a
mov eax, dword [ebp - 0xa90]
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0xd2c], ecx
mov edi, ecx
mov dword [ebp - 0xb44], eax
cmp esi, edx
jae 0xb6c471
mov ebx, 0xc000003e
jmp 0xb6c855
mov esi, dword [eax]
lea ecx, [ebp - 0xb44]
push ecx
mov ecx, eax
mov dword [ebp - 0xab4], esi
call fcn.00a32533
mov ebx, eax
xor ecx, ecx
test ebx, ebx
js 0xb6c855
lea eax, [ebp - 0xd2c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6c853
mov eax, dword [ebp - 0xa74]
sub eax, dword [ebp - 0xd2c]
cmp eax, esi
jae 0xb6c4c8
mov ebx, 0xc000003e
jmp 0xb6c853
mov eax, dword [ebp - 0xb44]
lea ecx, [ebp - 0xb44]
push ecx
mov edx, esi
mov dword [ebp - 0xa98], eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6c853
mov ecx, dword [ebp - 0xd2c]
lea eax, [ebp - 0xd2c]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6c853
mov eax, dword [ebp - 0xa74]
sub eax, dword [ebp - 0xd2c]
push 4
pop edx
cmp eax, edx
jb 0xb6c4be
mov ecx, dword [ebp - 0xb44]
lea eax, [ebp - 0xb44]
push eax
mov esi, dword [ecx]
mov dword [ebp - 0xab0], esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6c853
mov ecx, dword [ebp - 0xd2c]
lea eax, [ebp - 0xd2c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6c853
mov eax, dword [ebp - 0xa74]
sub eax, dword [ebp - 0xd2c]
cmp eax, esi
jb 0xb6c4be
mov eax, dword [ebp - 0xb44]
lea ecx, [ebp - 0xb44]
push ecx
mov edx, esi
mov dword [ebp - 0xac8], eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6c853
mov ecx, dword [ebp - 0xd2c]
lea eax, [ebp - 0xd2c]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6c853
mov eax, dword [ebp - 0xa74]
sub eax, dword [ebp - 0xd2c]
push 4
pop edx
cmp eax, edx
jb 0xb6c4be
mov ecx, dword [ebp - 0xb44]
mov eax, dword [ecx]
mov dword [ebp - 0xac0], eax
lea eax, [ebp - 0xb44]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6c853
mov ecx, dword [ebp - 0xd2c]
lea eax, [ebp - 0xd2c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6c853
mov eax, dword [ebp - 0xa74]
sub eax, dword [ebp - 0xd2c]
mov ecx, dword [ebp - 0xac0]
cmp eax, ecx
jb 0xb6c4be
lea eax, [ebp - 0xd2c]
mov edx, ecx
mov ecx, dword [ebp - 0xd2c]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6c853
mov edx, dword [ebp - 0xa74]
mov eax, edx
sub eax, dword [ebp - 0xd2c]
jne 0xb6c4be
mov ebx, dword [ebp - 0xab4]
mov ecx, dword [ebp - 0xac0]
add ecx, 0xc
lea eax, [esi + ebx]
add eax, ecx
cmp eax, edx
jne 0xb6c4be
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0xb6c6a1
mov ebx, 0xc0000017
jmp 0xb6c7de
cmp dword [ebp - 0xa98], edi
je 0xb6c6e2
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xb6c6cb
mov ebx, 0xc0000017
xor eax, eax
jmp 0xb6c777
mov dword [esi + 4], eax
push ebx
push dword [ebp - 0xa98]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb6c6e9
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
cmp dword [ebp - 0xac8], edi
je 0xb6c725
mov ebx, dword [ebp - 0xab0]
push ebx
push 8
mov dword [esi + 8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb6c6bf
mov dword [esi + 0xc], eax
push ebx
push dword [ebp - 0xac8]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb6c72b
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
cmp dword [ebp - 0xb44], edi
je 0xb6c76b
mov ebx, dword [ebp - 0xac0]
push ebx
push 8
mov dword [esi + 0x10], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb6c6bf
mov dword [esi + 0x14], eax
push ebx
push dword [ebp - 0xb44]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb6c771
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov edi, esi
mov ebx, eax
mov esi, eax
test esi, esi
je 0xb6c7de
cmp dword [esi + 4], 0
je 0xb6c797
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xb6c7b3
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xb6c7cf
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test ebx, ebx
js 0xb6c7ec
mov dword [ebp - 0xa84], edi
mov edi, ecx
test edi, edi
je 0xb6c855
cmp dword [edi + 4], 0
je 0xb6c80c
push dword [edi + 4]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 4], ecx
cmp dword [edi + 0xc], 0
je 0xb6c828
push dword [edi + 0xc]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0xc], ecx
cmp dword [edi + 0x14], 0
je 0xb6c844
push dword [edi + 0x14]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0x14], ecx
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov edi, dword [ebp - 0xa84]
or ebx, 0x10000000
mov dword [ebp - 0xb0c], ebx
jl 0xb6d140
mov dword [ebp - 0xa98], ecx
mov esi, ecx
mov dword [ebp - 0xab4], esi
test edi, edi
jne 0xb6c88f
mov ebx, 0xd000000d
mov dword [ebp - 0xb0c], ebx
jmp 0xb6d140
mov ebx, dword [edi + 4]
mov dword [ebp - 0xab0], ebx
test ebx, ebx
je 0xb6c87f
mov edi, dword [edi]
test edi, edi
jne 0xb6c8ac
mov ebx, 0xd000000d
jmp 0xb6d134
add edi, 0xfffffff8
mov dword [ebp - 0xac8], ecx
push edi
push ecx
mov dword [ebp - 0xac0], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xa70], eax
test eax, eax
je 0xb6cea3
mov esi, 0xab69605e
mov dword [ebp - 0xaac], ebx
mov dword [ebp - 0x35c], esi
xor ecx, ecx
mov esi, 0x7f1137f
mov dword [ebp - 0xaa8], eax
mov dword [ebp - 0x358], esi
mov dl, cl
mov esi, edi
mov dword [ebp - 0xa80], ecx
and esi, 7
je 0xb6ca31
mov dword [ebp - 0xa7c], ecx
mov eax, ecx
mov dword [ebp - 0xa78], eax
test esi, esi
je 0xb6c978
mov edi, dword [ebp - 0xaac]
push 0x38
pop ebx
movzx eax, byte [edi]
inc edi
cmp ecx, 4
jge 0xb6c940
lea ecx, [ebx - 0x20]
shl eax, cl
or dword [ebp - 0xa78], eax
jmp 0xb6c94a
mov ecx, ebx
shl eax, cl
or dword [ebp - 0xa7c], eax
mov ecx, dword [ebp - 0xa80]
sub ebx, 8
inc ecx
mov dword [ebp - 0xa80], ecx
cmp ecx, esi
jl 0xb6c92a
mov eax, edi
mov dword [ebp - 0xaac], edi
mov edi, dword [ebp - 0xac0]
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0xa78]
mov ebx, dword [ebp - 0xa7c]
xor eax, 0x92f65a5
xor ebx, 0x699a899c
mov dword [ebp - 0xa80], eax
xor ecx, ecx
mov dword [ebp - 0xa8c], ebx
mov dword [ebp - 0xa74], eax
mov dword [ebp - 0xa94], ebx
test esi, esi
je 0xb6ca00
mov edi, dword [ebp - 0xaa8]
push 4
pop ebx
lea eax, [edi + 1]
mov dword [ebp - 0xaa8], eax
cmp ecx, ebx
jge 0xb6c9cc
rol dword [ebp - 0xa74], 8
mov eax, dword [ebp - 0xa74]
jmp 0xb6c9d9
rol dword [ebp - 0xa94], 8
mov eax, dword [ebp - 0xa94]
mov byte [edi], al
inc ecx
mov eax, dword [ebp - 0xaa8]
mov edi, eax
cmp ecx, esi
jl 0xb6c9b0
mov ebx, dword [ebp - 0xa8c]
mov edi, dword [ebp - 0xac0]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0xa80]
push 4
pop ecx
cmp esi, ecx
jbe 0xb6ca15
push 8
pop ecx
sub ecx, esi
shl ecx, 3
shr ebx, cl
shl ebx, cl
jmp 0xb6ca40
xor ecx, ecx
push 4
mov ebx, ecx
pop ecx
cmp esi, ecx
jae 0xb6ca40
sub ecx, esi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xa80], eax
jmp 0xb6ca40
or dword [ebp - 0xa7c], 0xffffffff
mov ebx, ecx
mov dword [ebp - 0xa78], ecx
mov eax, edi
shr eax, 3
mov dword [ebp - 0xa8c], eax
test eax, eax
je 0xb6ce2b
movzx ecx, word [ebp - 0x356]
mov eax, 0x7f1137f
movzx esi, word [ebp - 0x35a]
mov edi, 0xab69605e
movzx eax, ax
xor edi, 0x7f1137f
mov dword [ebp - 0xa6c], ecx
mov ecx, 0xab69605e
mov dword [ebp - 0xa94], eax
movzx eax, cx
mov ecx, dword [ebp - 0xaac]
mov dword [ebp - 0xaec], eax
mov eax, dword [ebp - 0xaa8]
add eax, 7
mov dword [ebp - 0xa74], edi
add ecx, 2
mov dword [ebp - 0xa9c], esi
mov dword [ebp - 0xaa8], eax
mov dword [ebp - 0xaac], ecx
movzx edi, byte [ecx - 2]
movzx eax, byte [ecx - 1]
movzx esi, byte [ecx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [ecx]
shl edi, 8
or edi, eax
add dword [ebp - 0xaac], 8
movzx eax, byte [ecx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ecx + 3]
or esi, eax
movzx eax, byte [ecx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [ecx + 5]
mov ecx, dword [ebp - 0xa80]
xor ecx, edi
shl esi, 8
mov dword [ebp - 0xa80], ecx
or esi, eax
xor ebx, esi
xor ebx, dword [ebp - 0xa74]
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
sub ecx, 0xab69605e
rol eax, 0xa
rol ecx, 5
imul ecx, dword [ebp - 0xa94]
add ecx, eax
mov eax, dword [ebp - 0xa80]
xor eax, ecx
mov ecx, 0x7f1137f
add ecx, eax
mov dword [ebp - 0xa80], eax
ror ecx, 9
imul ecx, dword [ebp - 0xa9c]
rol eax, 2
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
sub ecx, dword [ebp - 0xa94]
imul ecx, dword [ebp - 0xaec]
shr eax, 0xd
sub ecx, eax
mov eax, dword [ebp - 0xa80]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xa80], eax
xor ecx, dword [ebp - 0xa9c]
rol ecx, 6
imul ecx, dword [ebp - 0xa6c]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
xor ecx, 0xab69605e
sub eax, ecx
mov ecx, dword [ebp - 0xa80]
xor ecx, eax
mov dword [ebp - 0xa80], ecx
mov eax, dword [ebp - 0xa80]
xor eax, dword [ebp - 0xa94]
imul eax, dword [ebp - 0xa9c]
ror ecx, 6
xor ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea ecx, [ebx + ecx]
ror ecx, 0xf
imul ecx, dword [ebp - 0xaec]
add ecx, eax
mov eax, dword [ebp - 0xa80]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xa80], eax
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0xa6c]
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, 0xab69605e
ror eax, 0xa
ror ecx, 0xc
imul ecx, dword [ebp - 0xa94]
xor ecx, eax
mov eax, dword [ebp - 0xa80]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xa80], eax
xor ecx, dword [ebp - 0xa6c]
imul ecx, dword [ebp - 0xa9c]
shr eax, 0xa
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa80]
mov eax, ebx
not eax
ror eax, 5
add eax, dword [ebp - 0xaec]
imul eax, dword [ebp - 0xa6c]
xor ecx, eax
mov dword [ebp - 0xa80], ecx
mov eax, ecx
mov ecx, dword [ebp - 0xa6c]
sub eax, ecx
xor eax, 0xab69605e
xor ebx, eax
xor ecx, ebx
mov eax, ebx
rol ecx, 2
imul ecx, dword [ebp - 0xa94]
shr eax, 2
add ecx, eax
mov eax, dword [ebp - 0xa80]
xor eax, ecx
mov dword [ebp - 0xa80], eax
lea ecx, [eax - 0x7f1137f]
rol eax, 7
ror ecx, 6
imul ecx, dword [ebp - 0xa9c]
add ecx, eax
xor ebx, ecx
mov eax, ebx
mov ecx, ebx
xor eax, dword [ebp - 0xa94]
imul eax, dword [ebp - 0xaec]
ror ecx, 9
add ecx, eax
mov eax, dword [ebp - 0xa80]
xor eax, ecx
mov ecx, dword [ebp - 0xa9c]
xor ecx, eax
mov dword [ebp - 0xa80], eax
rol ecx, 5
imul ecx, dword [ebp - 0xa6c]
rol eax, 7
add ecx, eax
mov eax, 0xab69605e
xor ebx, ecx
mov ecx, 0x7f1137f
xor eax, ebx
xor eax, dword [ebp - 0xa80]
xor eax, ecx
mov dword [ebp - 0xa80], eax
ror eax, 3
sub eax, dword [ebp - 0xa9c]
imul eax, dword [ebp - 0xa94]
xor ebx, eax
mov eax, 0x7f1137f
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 1
imul ecx, dword [ebp - 0xaec]
ror eax, 6
sub ecx, eax
mov eax, dword [ebp - 0xa80]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0xa80], eax
rol ecx, 3
imul ecx, dword [ebp - 0xa6c]
rol eax, 0xe
add ecx, eax
xor ebx, ecx
mov ecx, 0xab69605e
mov eax, ebx
ror eax, 0xe
lea ecx, [ecx + ebx]
rol ecx, 0xf
imul ecx, dword [ebp - 0xa94]
sub ecx, eax
mov eax, dword [ebp - 0xa80]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xa80], eax
xor ecx, dword [ebp - 0xaec]
imul ecx, dword [ebp - 0xa9c]
shr eax, 3
xor ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
xor ecx, eax
mov eax, ebx
xor ebx, dword [ebp - 0xa7c]
rol ecx, 4
imul ecx, dword [ebp - 0xaec]
rol eax, 2
mov dword [ebp - 0xa7c], esi
xor ecx, eax
mov eax, dword [ebp - 0xa80]
xor ecx, dword [ebp - 0xa78]
xor eax, ecx
mov dword [ebp - 0xa78], edi
mov ecx, dword [ebp - 0xaa8]
mov byte [ecx - 4], al
mov byte [ecx], bl
ror eax, 8
mov byte [ecx - 5], al
ror ebx, 8
mov byte [ecx - 1], bl
ror eax, 8
mov byte [ecx - 6], al
ror ebx, 8
mov byte [ecx - 2], bl
ror eax, 8
ror ebx, 8
mov byte [ecx - 7], al
mov byte [ecx - 3], bl
add ecx, 8
ror eax, 8
ror ebx, 8
sub dword [ebp - 0xa8c], 1
mov dword [ebp - 0xaa8], ecx
mov ecx, dword [ebp - 0xaac]
mov dword [ebp - 0xa80], eax
jne 0xb6cab8
mov edi, dword [ebp - 0xac0]
mov ecx, dword [ebp - 0xa70]
xor eax, eax
test edi, edi
je 0xb6ce3f
xor dl, byte [eax + ecx]
inc eax
cmp eax, edi
jb 0xb6ce37
mov esi, dword [ebp - 0xab0]
movzx eax, dl
cdq
cmp eax, dword [edi + esi]
jne 0xb6ce62
cmp edx, dword [edi + esi + 4]
jne 0xb6ce62
mov ebx, dword [ebp - 0xac8]
xor eax, eax
mov esi, ecx
mov ecx, eax
jmp 0xb6ce75
mov esi, dword [ebp - 0xab4]
mov ebx, 0xc004d501
mov edi, dword [ebp - 0xa98]
xor eax, eax
test ecx, ecx
je 0xb6ce88
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb6cea3
xor eax, eax
mov dword [ebp - 0xa88], esi
mov esi, eax
mov dword [ebp - 0xb04], edi
mov ebx, 0x10000000
jmp 0xb6ceb0
mov edi, dword [ebp - 0xb04]
mov ebx, 0xd0000001
xor eax, eax
mov dword [ebp - 0xb0c], ebx
test esi, esi
je 0xb6cec9
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb6d13a
mov ecx, dword [ebp - 0xa88]
xor eax, eax
push 4
pop esi
mov dword [ebp - 0xb84], eax
mov dword [ebp - 0xb70], ecx
cmp edi, esi
jb 0xb6d129
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0xab4], eax
lea eax, [ebp - 0xb70]
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6d12e
lea eax, [ebp - 0xb84]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6d12e
mov eax, edi
sub eax, dword [ebp - 0xb84]
cmp eax, esi
jb 0xb6d129
mov ecx, dword [ebp - 0xb70]
lea eax, [ebp - 0xb70]
push eax
mov edx, esi
mov edi, dword [ecx]
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6d12e
mov ecx, dword [ebp - 0xb84]
lea eax, [ebp - 0xb84]
push eax
mov edx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6d12e
mov eax, dword [ebp - 0xb04]
mov ecx, dword [ebp - 0xb84]
sub eax, ecx
cmp eax, edi
jb 0xb6d129
lea eax, [ebp - 0xb84]
mov edx, edi
push eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6d12e
mov esi, dword [ebp - 0xb70]
mov edx, dword [ebp - 0xb04]
mov ebx, dword [ebp - 0xa88]
lea ecx, [edi + esi]
lea eax, [edx + ebx]
cmp eax, ecx
jb 0xb6d129
sub edx, edi
sub edx, esi
add edx, ebx
cmp edx, 8
jae 0xb6d129
xor ecx, ecx
mov dword [ebp - 0xab0], ecx
mov eax, ecx
mov dword [ebp - 0xa98], eax
mov ebx, ecx
test esi, esi
je 0xb6d0c0
lea eax, [ebp - 0xb68]
mov edx, edi
push eax
mov ecx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6d12e
mov eax, dword [ebp - 0xb68]
jmp 0xb6d0a8
lea eax, [ebp - 0xb64]
mov ecx, esi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6d12e
mov eax, dword [ebp - 0xb68]
cmp dword [ebp - 0xb64], eax
ja 0xb6d0e5
mov edx, dword [esi]
lea eax, [ebp - 0xb60]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6d06a
mov eax, dword [ebp - 0xb60]
mov dword [ebp - 0xd30], eax
jmp 0xb6d070
mov eax, dword [ebp - 0xd30]
test ebx, ebx
js 0xb6d12e
lea ecx, [ebp - 0xb5c]
mov edx, eax
push ecx
mov ecx, esi
call fcn.00a32533
mov ebx, eax
test ebx, ebx
js 0xb6d12e
mov esi, dword [ebp - 0xb5c]
mov eax, dword [ebp - 0xb68]
cmp esi, eax
ja 0xb6d0e5
inc dword [ebp - 0xab0]
cmp esi, eax
jb 0xb6d014
cmp esi, eax
jne 0xb6d0e5
mov esi, dword [ebp - 0xb70]
mov eax, dword [ebp - 0xa98]
test edi, edi
je 0xb6d0f0
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xa98], eax
test eax, eax
jne 0xb6d0ec
mov ebx, 0xc0000017
jmp 0xb6d117
mov ebx, 0xc000000d
jmp 0xb6d12e
xor ecx, ecx
mov ebx, ecx
test esi, esi
je 0xb6d105
push edi
push esi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xa98]
add esp, 0xc
mov dword [ebp - 0xdb0], eax
mov eax, dword [ebp - 0xab0]
mov dword [ebp - 0xdb8], eax
test ebx, ebx
js 0xb6d12e
mov eax, dword [ebp - 0xab4]
cmp eax, dword [ebp - 0xdb8]
je 0xb6d12e
mov ebx, 0xc000003e
or ebx, 0x10000000
mov dword [ebp - 0xb0c], ebx
mov edi, dword [ebp - 0xa84]
mov eax, dword [ebp - 0xaa0]
test eax, eax
je 0xb6d15b
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xb38]
test esi, esi
je 0xb6d1c9
xor eax, eax
cmp dword [esi + 4], eax
je 0xb6d182
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xb6d19e
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xb6d1ba
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xaa4]
test eax, eax
je 0xb6d1e4
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xa90]
test eax, eax
je 0xb6d1ff
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xb6d267
xor eax, eax
cmp dword [edi + 4], eax
je 0xb6d220
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xb6d23c
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xb6d258
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xa88]
test eax, eax
je 0xb6d282
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb6ad36
xor eax, eax
inc eax
cmp dword [ebp - 0xdb8], eax
jae 0xb6d29f
mov ebx, 0xc004d501
jmp 0xb6ad30
cmp dword [ebp - 0xdb0], 0
jne 0xb6d32f
mov ebx, 0xc000000d
mov dword [ebp - 0xb0c], ebx
mov eax, dword [ebp - 0xb3c]
push 4
pop edx
test ebx, ebx
js 0xb6ad36
cmp eax, 0xd0000023
jne 0xb6d2da
mov eax, 0x8007007a
mov dword [ebp - 0xb3c], eax
cmp eax, 0x8007007a
je 0xb6d2f1
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test eax, eax
js 0xb6ad36
cmp dword [ebp - 0xdb8], 6
jne 0xb6d295
cmp dword [ebp - 0xdb0], 0
jne 0xb6d3a9
mov edx, dword [ebp - 0xd6c]
mov ebx, 0xc000000d
mov ecx, dword [ebp - 0xd70]
mov dword [ebp - 0xb0c], ebx
mov dword [ebp - 0xab4], edx
mov dword [ebp - 0xa98], ecx
jmp 0xb6d47d
cmp dword [ebp - 0xdb8], 0
jbe 0xb6d2ac
mov eax, dword [ebp - 0xdb0]
lea ecx, [ebp - 0xb08]
push ecx
push 4
pop ecx
mov esi, dword [eax]
mov edx, ecx
mov ecx, eax
mov dword [ebp - 0xb08], eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6d37d
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb08]
mov dword [ebp - 0xb08], eax
jmp 0xb6d389
mov esi, dword [ebp - 0xb90]
mov eax, dword [ebp - 0xb94]
test ebx, ebx
js 0xb6d2b7
push 4
pop edx
cmp esi, edx
jne 0xb6ad9d
mov eax, dword [eax]
mov dword [ebp - 0xb3c], eax
jmp 0xb6d2c0
mov ecx, dword [ebp - 0xdb0]
xor eax, eax
mov dword [ebp - 0xae8], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xae8]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6d439
mov ecx, dword [ebp - 0xae8]
lea eax, [ebp - 0xae8]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6d439
mov ecx, dword [ebp - 0xae8]
xor eax, eax
inc esi
inc eax
cmp esi, eax
jae 0xb6d406
push 4
pop edx
jmp 0xb6d3b9
mov esi, dword [ecx]
lea eax, [ebp - 0xae8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6d439
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xae8]
mov dword [ebp - 0xae8], eax
jmp 0xb6d445
mov esi, dword [ebp - 0xb98]
mov eax, dword [ebp - 0xb9c]
test ebx, ebx
js 0xb6d465
cmp esi, 8
jne 0xb6ad9d
mov ecx, dword [eax]
mov dword [ebp - 0xa98], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xab4], ecx
jmp 0xb6d47d
mov eax, dword [ebp - 0xd6c]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0xd70]
mov dword [ebp - 0xa98], eax
test ebx, ebx
js 0xb6ad36
cmp dword [ebp - 0xdb0], 0
jne 0xb6d4c7
mov ebx, 0xc000000d
mov dword [ebp - 0xb0c], ebx
mov eax, dword [ebp - 0xba0]
push 4
pop edx
mov dword [ebp - 0xab0], eax
test ebx, ebx
js 0xb6ad36
cmp dword [ebp - 0xdb0], 0
jne 0xb6d57b
mov ebx, 0xc000000d
jmp 0xb6ad30
mov ecx, dword [ebp - 0xdb0]
xor eax, eax
mov dword [ebp - 0xad8], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xad8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6d555
mov ecx, dword [ebp - 0xad8]
lea eax, [ebp - 0xad8]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6d555
mov ecx, dword [ebp - 0xad8]
inc esi
cmp esi, 2
jb 0xb6d4d7
mov esi, dword [ecx]
lea eax, [ebp - 0xad8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6d555
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xad8]
mov dword [ebp - 0xad8], eax
jmp 0xb6d561
mov esi, dword [ebp - 0xba4]
mov eax, dword [ebp - 0xba8]
test ebx, ebx
js 0xb6d499
push 4
pop edx
cmp esi, edx
jne 0xb6ad9d
mov eax, dword [eax]
jmp 0xb6d4a2
mov ecx, dword [ebp - 0xdb0]
xor eax, eax
mov dword [ebp - 0xacc], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xacc]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6d60f
mov ecx, dword [ebp - 0xacc]
lea eax, [ebp - 0xacc]
push eax
mov edx, edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6d60f
mov ecx, dword [ebp - 0xacc]
inc esi
cmp esi, 3
jae 0xb6d5d6
push 4
pop edx
jmp 0xb6d58b
mov edi, dword [ecx]
lea eax, [ebp - 0xacc]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xac8], edi
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6d60f
mov esi, edi
neg esi
sbb esi, esi
and esi, dword [ebp - 0xacc]
mov dword [ebp - 0xacc], esi
jmp 0xb6d621
mov eax, dword [ebp - 0xc24]
mov esi, dword [ebp - 0xbb0]
mov dword [ebp - 0xac8], eax
test ebx, ebx
js 0xb6ad36
mov ecx, dword [ebp - 0xdb0]
xor eax, eax
push 4
mov dword [ebp - 0xb10], ecx
mov edi, eax
pop edx
mov eax, dword [ecx]
mov dword [ebp - 0xac0], eax
lea eax, [ebp - 0xb10]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6d6bc
mov edx, dword [ebp - 0xac0]
lea eax, [ebp - 0xb10]
mov ecx, dword [ebp - 0xb10]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6d6bc
mov ecx, dword [ebp - 0xb10]
inc edi
push 4
pop edx
cmp edi, edx
jb 0xb6d63c
mov edi, dword [ecx]
lea eax, [ebp - 0xb10]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6d6bc
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb10]
mov dword [ebp - 0xb10], eax
jmp 0xb6d6c8
mov edi, dword [ebp - 0xbb8]
mov eax, dword [ebp - 0xbbc]
push 4
pop edx
test ebx, ebx
js 0xb6d6db
cmp edi, edx
jne 0xb6ad9d
mov eax, dword [eax]
jmp 0xb6d6e1
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xac0], eax
test ebx, ebx
js 0xb6ad36
mov ecx, dword [ebp - 0xdb0]
xor eax, eax
mov dword [ebp - 0xb14], ecx
mov edi, eax
mov eax, dword [ecx]
mov dword [ebp - 0xa70], eax
lea eax, [ebp - 0xb14]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6d787
mov edx, dword [ebp - 0xa70]
lea eax, [ebp - 0xb14]
mov ecx, dword [ebp - 0xb14]
push eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6d787
mov ecx, dword [ebp - 0xb14]
inc edi
cmp edi, 5
jae 0xb6d754
push 4
pop edx
jmp 0xb6d6ff
mov edi, dword [ecx]
lea eax, [ebp - 0xb14]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov ebx, eax
mov dword [ebp - 0xb0c], ebx
test ebx, ebx
js 0xb6d787
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb14]
mov dword [ebp - 0xb14], eax
jmp 0xb6d793
mov edi, dword [ebp - 0xbc8]
mov eax, dword [ebp - 0xbcc]
push 4
pop edx
test ebx, ebx
js 0xb6d7a6
cmp edi, edx
jne 0xb6ad9d
mov ecx, dword [eax]
jmp 0xb6d7ac
mov ecx, dword [ebp - 0xb40]
test ebx, ebx
js 0xb6ad36
mov eax, dword [ebp - 0xb8c]
cmp eax, dword [ebp - 0xa98]
jne 0xb6d295
mov eax, dword [ebp - 0xad0]
cmp eax, dword [ebp - 0xab4]
jne 0xb6d295
mov dword [ebp - 0xbf4], ecx
cmp dword [ebp - 0xac0], edx
jbe 0xb6d7fc
mov ecx, dword [ebp - 0xab0]
mov ebx, 0x8007007a
mov dword [ebp - 0xbf0], ecx
jmp 0xb6ad30
mov eax, dword [ebp - 0xac8]
cmp eax, edx
ja 0xb6d7e6
push eax
push esi
mov esi, dword [ebp - 0xb00]
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xab0]
add esp, 0xc
mov dword [ebp - 0xbf0], eax
mov eax, dword [ebp - 0xb3c]
test eax, eax
je 0xb6a91d
mov ebx, eax
jmp 0xb6a917
mov esi, dword [0xc9304c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [0xc95870], eax
lea edi, [ebp - 0x3d0]
mov eax, dword [0xc95878]
xor ebx, ebx
mov dword [ebp - 0xa98], eax
xor eax, eax
stosd dword es:[edi], eax
push 0x2c
push ebx
mov dword [0xc95874], edx
stosd dword es:[edi], eax
mov dword [ebp - 0xd78], ebx
mov dword [ebp - 0xd74], ebx
mov dword [ebp - 0xab0], ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x530]
push eax
mov dword [ebp - 0xac8], ebx
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0xac0], ebx
mov edi, 0xc96238
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xb6d8a0
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jne 0xb6dece
push 0x338
mov esi, ebx
mov dword [ebp - 0xa70], ebx
push ebx
mov dword [ebp - 0xaac], ebx
mov dword [ebp - 0xaa8], esi
mov dword [ebp - 0xa7c], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xa78], eax
test eax, eax
je 0xb6dec0
or dword [ebp - 0xa8c], 0xffffffff
mov edx, 0xab69605e
mov dword [ebp - 0x37c], edx
add eax, 7
mov edx, 0x7f1137f
mov dword [ebp - 0xa80], ebx
mov dword [ebp - 0x378], edx
mov cl, bl
mov dword [ebp - 0xb04], ebx
mov edx, ebx
mov dword [ebp - 0xa88], eax
mov esi, 0x9fbcf2
mov dword [ebp - 0xa84], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
xor edx, ebx
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
mov dword [ebp - 0xa74], edx
movzx eax, byte [esi + 5]
add esi, 8
mov dword [ebp - 0xa90], esi
shl edi, 8
or edi, eax
mov esi, edi
xor esi, dword [ebp - 0xb04]
xor esi, edx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
mov eax, dword [ebp - 0xa74]
xor eax, edx
mov dword [ebp - 0xa74], eax
add eax, 0x7f1137f
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xa74]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xa74]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xa74], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xa74]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xa74]
xor edx, eax
mov dword [ebp - 0xa74], edx
mov eax, dword [ebp - 0xa74]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xa74]
xor eax, edx
mov dword [ebp - 0xa74], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xa74]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xa74]
xor eax, edx
mov dword [ebp - 0xa74], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xa74]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xa74]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0xa74], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0xa74]
xor eax, 0xab69605e
mov dword [ebp - 0xb04], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb04]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xb04]
xor eax, edx
mov dword [ebp - 0xb04], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0xb04], edx
mov edx, dword [ebp - 0xb04]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xb04], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb04]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xb04]
xor eax, edx
mov dword [ebp - 0xb04], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb04]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xb04]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xb04], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb04]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xb04]
xor edx, dword [ebp - 0xa80]
xor eax, dword [ebp - 0xa8c]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xa74], esi
mov esi, dword [ebp - 0xa88]
mov dword [ebp - 0xa80], ebx
mov dword [ebp - 0xa8c], edi
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xa84], 1
mov dword [ebp - 0xa88], esi
mov esi, dword [ebp - 0xa90]
mov dword [ebp - 0xb04], eax
jne 0xb6d93d
mov esi, dword [ebp - 0xa78]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xb6dcb4
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xb6dce6
cmp edx, dword [0x9fc02c]
jne 0xb6dce6
mov edi, esi
xor eax, eax
mov dword [ebp - 0xaa8], edi
mov esi, eax
mov ebx, 0x337
jmp 0xb6dcfb
mov edi, dword [ebp - 0xaa8]
or ebx, 0xffffffff
mov dword [ebp - 0xa7c], 0xc004d501
xor eax, eax
test esi, esi
je 0xb6dd0e
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xa7c], 0
jl 0xb6deba
xor eax, eax
mov esi, edi
push 0x40
mov byte [edi + ebx], al
mov ebx, 0xc960a0
push eax
push ebx
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xb6de50
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbb4]
jne 0xb6dd45
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xb6deb3
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xaac], ecx
cmp word [eax], dx
je 0xb6dd92
mov ecx, 0xc000007b
mov dword [ebp - 0xaac], ecx
jmp 0xb6ddda
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xb6dd85
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xb6dd85
cmp dword [edx], 0x4550
jne 0xb6dd85
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc08]
je 0xb6ddc8
cmp ax, word [ebp - 0xc0c]
je 0xb6ddc8
mov ecx, 0xc000000d
jmp 0xb6dd8a
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0xa7c], eax
test eax, eax
je 0xb6de44
mov edx, esi
mov dword [ebp - 0xa78], esi
lea eax, [edx + 1]
mov dword [ebp - 0xa80], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xb6ddfc
sub edx, dword [ebp - 0xa80]
inc esi
add esi, edx
test ecx, ecx
js 0xb6de35
push dword [ebp - 0xa78]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xb6de50
mov ecx, dword [ebp - 0xa70]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xaac]
inc dword [ebp - 0xa70]
inc ebx
cmp ebx, dword [ebp - 0xa7c]
jb 0xb6ddeb
add edi, 0x10
cmp byte [esi], 0
jne 0xb6dd3e
mov ebx, dword [ebp - 0xaac]
mov esi, dword [ebp - 0xaa8]
test esi, esi
je 0xb6de71
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xb6dec7
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb6de8a
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb6de79
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xb6ded4
mov ebx, 0xc000007a
jmp 0xb6de56
mov esi, dword [ebp - 0xaa8]
mov ebx, 0xc000007a
jmp 0xb6de5c
mov eax, dword [0xc95890]
xor ebx, ebx
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov edx, 0xc96238
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0xa70], ebx
lea edi, [ebp - 0xdec]
mov dword [ebp - 0xaac], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xaa8], ebx
mov dword [ebp - 0xa7c], ebx
mov dword [ebp - 0xa78], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xa80], ebx
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xb6df0f
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jne 0xb6e54d
push 0x338
mov esi, ebx
mov dword [ebp - 0xa8c], ebx
push ebx
mov dword [ebp - 0xb04], ebx
mov dword [ebp - 0xa88], esi
mov dword [ebp - 0xa84], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xa74], eax
test eax, eax
je 0xb6e53f
or dword [ebp - 0xa94], 0xffffffff
mov edx, 0xab69605e
mov dword [ebp - 0x374], edx
add eax, 7
mov edx, 0x7f1137f
mov dword [ebp - 0xa90], ebx
mov edi, 0x9fbcf2
mov dword [ebp - 0x370], edx
mov cl, bl
mov dword [ebp - 0xaa4], eax
mov edx, ebx
mov dword [ebp - 0xa6c], edi
mov dword [ebp - 0xa9c], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
mov eax, dword [ebp - 0xa6c]
xor edx, ebx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xa6c]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xa6c]
shl edi, 8
add dword [ebp - 0xa6c], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, edx
xor esi, 0xac987321
mov eax, esi
mov dword [ebp - 0xaa0], esi
add eax, 0x54969fa2
rol dword [ebp - 0xaa0], 0xa
rol eax, 5
imul eax, eax, 0x137f
add eax, dword [ebp - 0xaa0]
xor edx, eax
mov dword [ebp - 0xad0], edx
lea eax, [edx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xad0]
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xad0]
sub edx, 0x756c8a2
xor eax, edx
mov dword [ebp - 0xad0], eax
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xad0]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
mov edx, dword [ebp - 0xad0]
xor edx, eax
mov dword [ebp - 0xad0], edx
mov eax, dword [ebp - 0xad0]
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
mov eax, dword [ebp - 0xad0]
xor eax, edx
mov dword [ebp - 0xad0], eax
add eax, 0x54969fa2
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, dword [ebp - 0xad0]
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
mov eax, dword [ebp - 0xad0]
xor eax, edx
mov dword [ebp - 0xad0], eax
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, dword [ebp - 0xad0]
shr eax, 0xa
xor edx, eax
xor esi, edx
mov edx, dword [ebp - 0xad0]
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edx, eax
mov dword [ebp - 0xad0], edx
lea eax, [edx - 0x7f1]
xor eax, esi
mov esi, dword [ebp - 0xad0]
xor eax, 0xab69605e
mov dword [ebp - 0xaa0], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xaa0]
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xaa0]
xor eax, edx
mov dword [ebp - 0xaa0], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
xor dword [ebp - 0xaa0], edx
mov edx, dword [ebp - 0xaa0]
xor esi, edx
xor esi, 0xac987321
mov eax, esi
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xaa0], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xaa0]
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xaa0]
xor eax, edx
mov dword [ebp - 0xaa0], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xaa0]
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xaa0]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xaa0], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xaa0]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xaa0]
xor edx, dword [ebp - 0xa90]
xor eax, dword [ebp - 0xa94]
xor esi, edx
mov edx, esi
mov dword [ebp - 0xad0], esi
mov esi, dword [ebp - 0xaa4]
mov dword [ebp - 0xa94], edi
mov edi, dword [ebp - 0xa6c]
mov dword [ebp - 0xa90], ebx
mov byte [esi - 4], dl
mov byte [esi], al
ror edx, 8
mov byte [esi - 5], dl
ror eax, 8
mov byte [esi - 1], al
ror edx, 8
mov byte [esi - 6], dl
ror eax, 8
mov byte [esi - 2], al
ror edx, 8
ror eax, 8
mov byte [esi - 7], dl
mov byte [esi - 3], al
add esi, 8
ror eax, 8
ror edx, 8
sub dword [ebp - 0xa9c], 1
mov dword [ebp - 0xaa4], esi
mov esi, eax
mov dword [ebp - 0xaa0], eax
jne 0xb6dfac
mov esi, dword [ebp - 0xa74]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xb6e331
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xb6e363
cmp edx, dword [0x9fc02c]
jne 0xb6e363
mov ebx, esi
xor eax, eax
mov dword [ebp - 0xa88], ebx
mov esi, eax
mov edi, 0x337
jmp 0xb6e378
mov ebx, dword [ebp - 0xa88]
or edi, 0xffffffff
mov dword [ebp - 0xa84], 0xc004d501
xor eax, eax
test esi, esi
je 0xb6e38b
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xa84], 0
jl 0xb6e539
xor eax, eax
mov esi, ebx
push 0x40
push eax
push 0xc960a0
mov byte [ebx + edi], al
call fcn.00ab4bf6
add esp, 0xc
cmp byte [ebx], 0
je 0xb6e4cf
mov edi, 0xc960a0
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbb4]
jne 0xb6e3c4
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xb6e532
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xb04], ecx
cmp word [eax], dx
je 0xb6e411
mov ecx, 0xc000007b
mov dword [ebp - 0xb04], ecx
jmp 0xb6e459
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xb6e404
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xb6e404
cmp dword [edx], 0x4550
jne 0xb6e404
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc08]
je 0xb6e447
cmp ax, word [ebp - 0xc0c]
je 0xb6e447
mov ecx, 0xc000000d
jmp 0xb6e409
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0xa84], eax
test eax, eax
je 0xb6e4c3
mov edx, esi
mov dword [ebp - 0xa74], esi
lea eax, [edx + 1]
mov dword [ebp - 0xa90], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xb6e47b
sub edx, dword [ebp - 0xa90]
inc esi
add esi, edx
test ecx, ecx
js 0xb6e4b4
push dword [ebp - 0xa74]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xb6e4cf
mov ecx, dword [ebp - 0xa8c]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xb04]
inc dword [ebp - 0xa8c]
inc ebx
cmp ebx, dword [ebp - 0xa84]
jb 0xb6e46a
add edi, 0x10
cmp byte [esi], 0
jne 0xb6e3bd
mov ebx, dword [ebp - 0xb04]
mov esi, dword [ebp - 0xa88]
test esi, esi
je 0xb6e4f0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xb6e546
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb6e509
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb6e4f8
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xb6e553
mov ebx, 0xc000007a
jmp 0xb6e4d5
mov esi, dword [ebp - 0xa88]
mov ebx, 0xc000007a
jmp 0xb6e4db
mov eax, dword [0xc95890]
xor ebx, ebx
inc eax
mov dword [0xc95890], eax
xor eax, eax
mov ecx, 0xc96238
xchg dword [ecx], eax
push 0x54
lea eax, [ebp - 0x7c8]
push ebx
push eax
call fcn.00ab4bf6
xor eax, eax
mov esi, dword [0xc9307c]
lea edi, [ebp - 0x3d4]
add esp, 0xc
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
pop edx
push 0x403
push ebx
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xa98]
mov ecx, eax
and ecx, edx
mov dword [ebp - 0xa98], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0xc], cx
mov ecx, eax
shr ecx, 8
and ecx, edx
shr eax, 0xc
mov word [ebp - 0xa], cx
and eax, edx
mov ecx, esi
mov word [ebp - 8], ax
call dword [0xc99200]
call esi
mov dword [ebp - 0xa8c], eax
mov dword [ebp - 0xb04], 0xffffff
test eax, eax
jne 0xb6e5fe
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb6e5ee
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb6fab2
mov ebx, 0x80004005
jmp 0xb6fab2
mov edi, dword [0xc93050]
lea eax, [ebp - 0xbd4]
push eax
push ebx
lea eax, [ebp - 0xaf0]
mov dword [ebp - 0xbd0], ebx
push eax
mov esi, ebx
mov dword [ebp - 0xa84], ebx
push 8
mov ecx, edi
mov dword [ebp - 0xa88], esi
mov dword [ebp - 0xa74], ebx
mov dword [ebp - 0xa90], ebx
mov dword [ebp - 0xbd4], ebx
call dword [0xc99200]
call edi
test eax, eax
jne 0xb6e74e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb6e664
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb6e8c8
mov ebx, 0x80004005
mov esi, dword [ebp - 0xa74]
mov edi, dword [ebp - 0xaa8]
xor ecx, ecx
test esi, esi
je 0xb6e6f1
mov eax, ecx
mov dword [ebp - 0xa74], ecx
mov edx, dword [esi + eax*4]
test edx, edx
je 0xb6e6e5
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0xa90], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbb4]
jne 0xb6e69b
sub ecx, dword [ebp - 0xa90]
xor eax, eax
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xb6e6d0
mov byte [edx], al
inc edx
sub ecx, 1
jne 0xb6e6bf
mov edx, dword [ebp - 0xa74]
mov edx, dword [esi + edx*4]
push edx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xa74]
inc eax
mov dword [ebp - 0xa74], eax
cmp eax, 3
jb 0xb6e689
mov eax, dword [ebp - 0xbd0]
xor edx, edx
test eax, eax
je 0xb6e70f
mov ecx, dword [ebp - 0xa84]
test ecx, ecx
je 0xb6e70f
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0xb6e707
test esi, esi
je 0xb6e722
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbd0]
test eax, eax
je 0xb6f053
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0xbd0], ecx
jmp 0xb6f055
mov eax, dword [ebp - 0xbd4]
add eax, eax
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xa94], edi
test edi, edi
jne 0xb6e77b
mov ebx, 0x8007000e
jmp 0xb6e8b3
mov eax, dword [ebp - 0xaf0]
lea eax, [eax*4 + 4]
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xaa4], esi
test esi, esi
jne 0xb6e7af
mov ebx, 0x8007000e
xor ecx, ecx
jmp 0xb6e89a
mov ebx, dword [0xc93050]
lea eax, [ebp - 0xbd4]
push eax
push edi
lea eax, [ebp - 0xaf0]
mov ecx, ebx
push eax
push 8
call dword [0xc99200]
call ebx
test eax, eax
jne 0xb6e7f4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb6e7eb
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb6e7a8
mov ebx, 0x80004005
jmp 0xb6e7a8
xor ecx, ecx
mov eax, esi
mov dword [ebp - 0xa88], ecx
cmp dword [ebp - 0xaf0], ecx
jbe 0xb6e879
mov dword [ebp - 0xa6c], edi
mov edi, esi
mov esi, dword [ebp - 0xa6c]
mov ebx, dword [0xc93058]
push ecx
push esi
mov ecx, ebx
call dword [0xc99200]
call ebx
mov ecx, esi
mov dword [edi], eax
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xb6e82f
sub ecx, edx
sar ecx, 1
push 4
pop eax
add edi, eax
mov eax, dword [ebp - 0xa88]
lea esi, [esi + ecx*2]
add esi, 2
inc eax
push 0
mov dword [ebp - 0xa88], eax
pop ecx
cmp eax, dword [ebp - 0xaf0]
jb 0xb6e814
mov esi, dword [ebp - 0xaa4]
mov dword [ebp - 0xa88], edi
mov edi, dword [ebp - 0xa94]
mov eax, dword [ebp - 0xa88]
mov ebx, dword [ebp - 0xa90]
mov dword [eax], 0x409
mov eax, dword [ebp - 0xaf0]
inc eax
mov dword [ebp - 0xa88], esi
mov esi, ecx
mov dword [ebp - 0xa94], eax
test esi, esi
je 0xb6e8ad
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xa88]
test edi, edi
je 0xb6e8c8
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb6e66f
xor eax, eax
mov ebx, eax
mov ecx, eax
mov dword [ebp - 0xaa4], ebx
cmp dword [ebp - 0xa94], eax
jbe 0xb6e90d
mov edx, dword [esi + ecx*4]
cmp edx, dword [eax*4 + 0xa192e8]
je 0xb6e903
inc eax
cmp eax, 0x26
jb 0xb6e8e7
inc ecx
xor eax, eax
cmp ecx, dword [ebp - 0xa94]
jae 0xb6e90d
jmp 0xb6e8e4
mov ebx, eax
xor eax, eax
mov dword [ebp - 0xaa4], ebx
mov esi, dword [0xc93054]
mov ecx, esi
push eax
mov dword [ebp - 0xa94], eax
lea eax, [ebp - 0xb8]
push 0x55
push eax
push dword [ebx*4 + 0xa192e8]
call dword [0xc99200]
call esi
test eax, eax
je 0xb6e978
mov esi, dword [0xc93048]
lea eax, [ebp - 0x404]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xb8]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
test eax, eax
jle 0xb6e978
mov ebx, dword [ebp - 0x3f8]
xor eax, eax
shr ebx, 0x1b
inc eax
and ebx, eax
mov dword [ebp - 0xa94], ebx
mov ebx, dword [ebp - 0xaa4]
xor eax, eax
mov edx, 0x9fba10
mov esi, eax
mov ecx, edx
mov dword [ebp + esi*4 - 0x344], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbb4]
jne 0xb6e98d
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0xb6e981
imul ecx, ebx, 3
movzx eax, byte [ecx + 0xa00b58]
mov eax, dword [ebp + eax*4 - 0x344]
mov dword [ebp - 0xa7c], eax
movzx eax, byte [ecx + 0xa00b59]
mov eax, dword [ebp + eax*4 - 0x344]
mov dword [ebp - 0xa78], eax
movzx eax, byte [ecx + 0xa00b5a]
mov eax, dword [ebp + eax*4 - 0x344]
mov dword [ebp - 0xa80], eax
xor eax, eax
push 0x1c90
mov ebx, eax
push eax
mov dword [ebp - 0xa90], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xa6c], ecx
test ecx, ecx
jne 0xb6ea1e
mov ebx, 0x8007000e
jmp 0xb6e66f
or dword [ebp - 0xaa0], 0xffffffff
mov edx, 0xab69605e
xor ebx, ebx
mov dword [ebp - 0x34c], edx
mov edx, 0x7f1137f
mov dword [ebp - 0xa9c], ebx
add ecx, 7
mov dword [ebp - 0x348], edx
mov esi, 0xa19392
mov dword [ebp - 0xad0], ecx
mov al, bl
mov dword [ebp - 0xabc], esi
mov edx, ebx
mov dword [ebp - 0xac4], 0x392
movzx edi, byte [esi - 2]
movzx ecx, byte [esi - 1]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, ecx
shl esi, 8
mov ecx, dword [ebp - 0xabc]
xor ebx, edi
movzx ecx, byte [ecx + 3]
or esi, ecx
mov ecx, dword [ebp - 0xabc]
shl esi, 8
movzx ecx, byte [ecx + 4]
or esi, ecx
mov ecx, dword [ebp - 0xabc]
shl esi, 8
add dword [ebp - 0xabc], 8
movzx ecx, byte [ecx + 5]
or esi, ecx
xor edx, esi
xor edx, ebx
xor edx, 0xac987321
mov dword [ebp - 0xadc], edx
lea ecx, [edx + 0x54969fa2]
rol ecx, 5
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0xadc]
rol ecx, 0xa
add edx, ecx
xor ebx, edx
lea ecx, [ebx + 0x7f1137f]
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, ebx
rol ecx, 2
sub edx, ecx
mov ecx, dword [ebp - 0xadc]
xor ecx, edx
mov dword [ebp - 0xadc], ecx
imul edx, dword [ebp - 0xadc], 0x605e
shr ecx, 0xd
sub edx, ecx
sub edx, 0x756c8a2
xor ebx, edx
mov ecx, ebx
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 2
sub edx, ecx
mov ecx, dword [ebp - 0xadc]
xor ecx, edx
mov edx, ecx
mov dword [ebp - 0xadc], ecx
xor edx, 0xab69605e
mov ecx, 0x7f1137f
sub ecx, edx
xor ebx, ecx
mov ecx, ebx
mov edx, ebx
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
mov ecx, dword [ebp - 0xadc]
xor ecx, edx
mov dword [ebp - 0xadc], ecx
add ecx, 0x7f1137f
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0xadc]
rol ecx, 2
add edx, ecx
xor ebx, edx
lea ecx, [ebx + 0x54969fa2]
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 8
sub edx, ecx
mov ecx, dword [ebp - 0xadc]
xor ecx, edx
mov dword [ebp - 0xadc], ecx
xor ecx, 0xab69605e
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0xadc]
ror ecx, 0xa
xor edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, ebx
shr ecx, 0xa
xor edx, ecx
xor edx, dword [ebp - 0xadc]
mov ecx, edx
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor ebx, ecx
lea ecx, [ebx - 0x7f1]
xor ecx, edx
xor ecx, 0xab69605e
mov dword [ebp - 0xadc], ecx
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0xadc]
shr ecx, 2
add edx, ecx
xor ebx, edx
lea ecx, [ebx - 0x7f1137f]
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, ebx
rol ecx, 7
add edx, ecx
mov ecx, dword [ebp - 0xadc]
xor ecx, edx
mov dword [ebp - 0xadc], ecx
mov edx, ecx
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor ebx, edx
mov ecx, ebx
mov edx, ebx
xor ecx, 0xab69
rol ebx, 7
rol ecx, 5
imul ecx, ecx, 0x7f1
add ecx, ebx
mov ebx, dword [ebp - 0xadc]
xor ebx, ecx
mov dword [ebp - 0xadc], ebx
xor ebx, edx
mov edx, dword [ebp - 0xadc]
xor ebx, 0xac987321
mov ecx, ebx
ror ecx, 3
imul ecx, ecx, 0x137f
sub ecx, 0xd0dd417
xor edx, ecx
mov dword [ebp - 0xadc], edx
lea ecx, [edx - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0xadc]
ror ecx, 6
sub edx, ecx
xor ebx, edx
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 0xe
add edx, ecx
mov ecx, dword [ebp - 0xadc]
xor ecx, edx
mov dword [ebp - 0xadc], ecx
add ecx, 0xab69605e
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, dword [ebp - 0xadc]
ror ecx, 0xe
sub edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, ebx
shr ecx, 3
xor edx, ecx
mov ecx, dword [ebp - 0xadc]
xor ecx, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xadc], ecx
xor ecx, edx
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, dword [ebp - 0xadc]
rol ecx, 2
xor edx, ecx
mov ecx, dword [ebp - 0xad0]
xor edx, dword [ebp - 0xa9c]
xor ebx, edx
mov dword [ebp - 0xa9c], edi
mov edx, dword [ebp - 0xadc]
xor edx, dword [ebp - 0xaa0]
mov byte [ecx - 4], bl
mov byte [ecx], dl
ror ebx, 8
mov byte [ecx - 5], bl
ror edx, 8
mov byte [ecx - 1], dl
ror ebx, 8
mov byte [ecx - 6], bl
ror edx, 8
mov byte [ecx - 2], dl
ror ebx, 8
ror edx, 8
mov byte [ecx - 7], bl
mov byte [ecx - 3], dl
add ecx, 8
ror ebx, 8
ror edx, 8
sub dword [ebp - 0xac4], 1
mov dword [ebp - 0xaa0], esi
mov esi, dword [ebp - 0xabc]
mov dword [ebp - 0xad0], ecx
jne 0xb6ea65
mov ebx, dword [ebp - 0xa90]
xor ecx, ecx
mov edx, ecx
mov esi, 0x1c90
mov ecx, dword [ebp - 0xa6c]
xor al, byte [edx + ecx]
inc edx
cmp edx, esi
jb 0xb6eddf
movzx eax, al
cdq
cmp eax, dword [0xa1b020]
jne 0xb6ee0d
cmp edx, dword [0xa1b024]
jne 0xb6ee0d
xor edx, edx
mov dword [ebp - 0xbd0], ecx
mov ecx, edx
mov dword [ebp - 0xa84], esi
jmp 0xb6ee1a
mov ebx, 0xc004d501
xor edx, edx
mov dword [ebp - 0xa90], ebx
test ecx, ecx
je 0xb6ee2d
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb6e66f
mov edi, dword [ebp - 0xbd0]
xor eax, eax
mov ebx, dword [ebp - 0xaa4]
mov esi, eax
mov edx, eax
cmp ebx, edx
jne 0xb6ee52
mov dword [ebp + esi*4 - 0x2d8], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0xa74], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xb6ee5d
sub ecx, dword [ebp - 0xa74]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0xb6ee47
inc esi
push 0
pop eax
cmp esi, 6
jb 0xb6ee45
push 0xc
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, dword [ebp - 0xa90]
mov esi, eax
test esi, esi
jne 0xb6eea2
mov ebx, 0x8007000e
jmp 0xb6e675
xor eax, eax
mov edi, esi
mov edx, esi
mov dword [ebp - 0xa90], edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov ecx, eax
mov eax, esi
sub eax, esi
mov dword [ebp - 0xa74], ecx
mov dword [ebp - 0xaa4], eax
movzx edi, word [ebp + ecx*2 - 0xc]
xor eax, eax
cmp di, word [eax*2 + 0xa19380]
je 0xb6eee1
inc eax
cmp eax, 6
jb 0xb6eecc
jmp 0xb6efc7
mov edi, dword [ebp + eax*4 - 0x2d8]
mov ecx, edi
mov edx, dword [0xc93060]
mov dword [ebp - 0xa6c], edx
lea eax, [ecx + 1]
mov dword [ebp - 0xa9c], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xb6eeff
sub ecx, dword [ebp - 0xa9c]
xor eax, eax
push eax
push eax
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
xor eax, eax
push eax
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0xa6c]
mov dword [ebp - 0xa6c], eax
test eax, eax
je 0xb6f026
lea ecx, [eax + eax]
xor eax, eax
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0xa90]
mov edx, dword [ebp - 0xaa4]
mov dword [edx + ecx], eax
mov eax, dword [ecx]
mov dword [ebp - 0xa9c], eax
test eax, eax
je 0xb6ee98
mov edx, dword [0xc93060]
mov ecx, edi
mov dword [ebp - 0xaa0], edx
lea eax, [ecx + 1]
mov dword [ebp - 0xad0], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xb6ef83
push dword [ebp - 0xa6c]
sub ecx, dword [ebp - 0xad0]
push dword [ebp - 0xa9c]
lea eax, [ecx + 1]
mov ecx, edx
push eax
push edi
xor eax, eax
push eax
push 0xfde9
call dword [0xc99200]
call dword [ebp - 0xaa0]
test eax, eax
je 0xb6efff
mov ecx, dword [ebp - 0xa74]
mov edx, dword [ebp - 0xa90]
push 4
inc ecx
pop eax
add edx, eax
mov dword [ebp - 0xa74], ecx
mov dword [ebp - 0xa90], edx
cmp ecx, 3
jb 0xb6eec5
mov eax, dword [ebp - 0xa94]
mov edi, esi
xor ecx, ecx
mov dword [ebp - 0xaa8], edi
mov esi, ecx
mov dword [ebp - 0x7c8], eax
jmp 0xb6e67d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb6f016
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb6e675
mov ebx, 0x80004005
jmp 0xb6e675
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb6f03d
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
mov edi, dword [ebp - 0xaa8]
js 0xb6e67b
mov ebx, 0x80004005
jmp 0xb6e67b
xor ecx, ecx
mov eax, dword [ebp - 0xa88]
test eax, eax
je 0xb6f06e
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb6fa99
mov eax, dword [edi]
xor ecx, ecx
mov esi, dword [0xc930b4]
mov ebx, ecx
mov dword [ebp - 0x7c0], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x7bc], eax
mov eax, dword [edi + 8]
mov edi, ecx
push ecx
mov dword [ebp - 0x7b8], eax
lea eax, [ebp - 0xdc4]
push eax
push ecx
mov dword [ebp - 0xdc0], ecx
mov dword [ebp - 0xdbc], ecx
mov ecx, esi
push 0x42
mov dword [ebp - 0xdc4], 0xc
call dword [0xc99200]
call esi
test eax, eax
jne 0xb6f0eb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb6f0e2
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb6f0f6
mov ebx, 0x80004005
jmp 0xb6f0f6
mov edi, dword [ebp - 0xdc0]
xor eax, eax
inc eax
and edi, eax
mov dword [ebp - 0x7c4], edi
test ebx, ebx
js 0xb6fa99
mov edi, dword [ebp - 0xa98]
mov eax, edi
push 0x2a
pop ecx
mov dword [ebp - 0xa88], ecx
sub eax, 1
je 0xb6f143
sub eax, 1
je 0xb6f137
sub eax, 1
jne 0xb6f153
mov ebx, 0xe1
mov dword [ebp - 0xa70], ebx
mov dword [ebp - 0xaac], ebx
jmp 0xb6f153
mov dword [ebp - 0xa70], 0xf
jmp 0xb6f149
mov dword [ebp - 0xa70], ecx
mov dword [ebp - 0xaac], 0xb
mov esi, 0xdc
mov dword [ebp - 0xa84], 0x60
push esi
xor ebx, ebx
lea eax, [ebp - 0x720]
push ebx
push eax
call fcn.00ab4bf6
add esp, 0xc
mov word [ebp - 0x6dc], si
mov esi, dword [0xc93070]
lea eax, [ebp - 0x720]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xb6f24d
mov eax, dword [ebp - 0x674]
movzx ebx, word [ebp - 0x67a]
mov ecx, dword [ebp - 0x670]
push 0x60
mov dword [ebp - 0xa74], eax
mov dword [ebp - 0xde4], eax
pop eax
mov dword [ebp - 0xa84], ebx
mov dword [ebp - 0xa90], ecx
mov dword [ebp - 0xde0], ecx
cmp ebx, eax
jae 0xb6f1dc
mov dword [ebp - 0xa84], eax
xor ebx, ebx
xor eax, eax
inc eax
cmp edi, eax
mov edi, dword [ebp - 0xa7c]
je 0xb6f1f1
mov edi, dword [ebp - 0xa80]
push 0x5c
lea eax, [ebp - 0x644]
push ebx
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0xa94], eax
test eax, eax
jne 0xb6f26a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb6f23d
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb6f30a
mov ebx, 0x80004005
jmp 0xb6fa99
mov eax, dword [ebp - 0xde0]
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0xde4]
mov dword [ebp - 0xa74], eax
jmp 0xb6f1de
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0xa84]
push dword [ebp - 0xa70]
call dword [0xc99200]
call esi
push edi
push 0x20
neg eax
mov dword [ebp - 0x634], 0x190
pop edx
lea ecx, [ebp - 0x628]
mov dword [ebp - 0x644], eax
mov byte [ebp - 0x62a], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0x644]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb6f2eb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb6f2e2
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb6f2f1
mov ebx, 0x80004005
jmp 0xb6f2f1
mov dword [ebp - 0x7b4], eax
push dword [ebp - 0xa94]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb6fa99
xor eax, eax
inc eax
cmp dword [ebp - 0xa98], eax
je 0xb6f329
mov eax, dword [ebp - 0xa80]
mov dword [ebp - 0xa7c], eax
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0x5e8]
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov edi, eax
test edi, edi
jne 0xb6f380
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb6f375
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb6f420
jmp 0xb6f243
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0xa84]
push dword [ebp - 0xaac]
call dword [0xc99200]
call esi
push dword [ebp - 0xa7c]
neg eax
mov dword [ebp - 0x5d8], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x5cc]
mov dword [ebp - 0x5e8], eax
mov byte [ebp - 0x5ce], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0x5e8]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb6f406
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb6f3fd
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb6f40c
mov ebx, 0x80004005
jmp 0xb6f40c
mov dword [ebp - 0x7b0], eax
mov esi, dword [0xc930b0]
xor eax, eax
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb6fa99
mov ebx, dword [ebp - 0xa98]
xor eax, eax
mov ecx, eax
mov edx, eax
mov eax, ebx
sub eax, 1
je 0xb6f445
sub eax, 1
je 0xb6f485
sub eax, 1
jne 0xb6f451
mov ecx, dword [ebp - 0xa74]
mov edx, dword [ebp - 0xa90]
mov dword [ebp - 0x3cc], ecx
mov dword [ebp - 0x3c8], edx
xor edx, edx
inc edx
cmp ebx, edx
je 0xb6f4c5
lea eax, [ebx - 2]
xor ebx, ebx
cmp eax, edx
ja 0xb6f499
mov edx, ebx
mov dword [ebp - 0xa88], ebx
mov eax, ebx
mov dword [ebp - 0xaac], edx
mov dword [ebp - 0xa7c], ebx
jmp 0xb6f4de
mov eax, dword [ebp - 0xa74]
push 4
cdq
pop ecx
idiv ecx
mov ecx, eax
xor eax, eax
mov edx, eax
jmp 0xb6f451
mov eax, dword [ebp - 0xaf0]
mov edx, dword [ebp - 0xaf0]
mov dword [ebp - 0xa7c], eax
mov eax, dword [ebp - 0xaf0]
mov dword [ebp - 0xa88], eax
mov eax, dword [ebp - 0xaf0]
mov dword [ebp - 0xaac], edx
jmp 0xb6f4de
xor ebx, ebx
mov dword [ebp - 0xa7c], 0x20
mov eax, 0x96
mov dword [ebp - 0xaac], ebx
mov edx, ebx
mov dword [ebp - 0xa70], eax
push dword [ebp - 0x7b4]
mov esi, dword [0xc9303c]
sub ecx, eax
push dword [ebp - 0xa8c]
mov edi, dword [ebp - 0x7c0]
sub ecx, edx
mov dword [ebp - 0xa80], ecx
mov dword [ebp - 0x78c], ecx
mov dword [ebp - 0x79c], ecx
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
mov dword [ebp - 0xa74], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x7a4]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xa8c]
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb6f554
mov ebx, 0x80004005
mov eax, dword [ebp - 0xa74]
test eax, eax
je 0xb6f570
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb6fa99
push dword [ebp - 0x7b0]
mov esi, dword [0xc9303c]
xor eax, eax
push dword [ebp - 0xa8c]
mov edi, dword [ebp - 0x7bc]
mov ecx, esi
mov ebx, eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
mov dword [ebp - 0xa74], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x794]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xa8c]
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb6f5d6
mov ebx, 0x80004005
mov eax, dword [ebp - 0xa74]
test eax, eax
je 0xb6f5f2
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb6fa99
mov eax, dword [ebp - 0xa98]
cmp eax, 2
je 0xb6f60a
cmp eax, 3
jne 0xb6f620
mov edi, dword [ebp - 0x78c]
cmp dword [ebp - 0x79c], edi
jle 0xb6f626
mov edi, dword [ebp - 0x79c]
jmp 0xb6f626
mov edi, dword [ebp - 0xa80]
cmp dword [ebp - 0x7c8], 0
mov esi, dword [0xc930a8]
mov ecx, esi
push dword [ebp - 0xa88]
je 0xb6f679
mov eax, edi
sub eax, dword [ebp - 0x79c]
add eax, dword [ebp - 0xaac]
push eax
lea eax, [ebp - 0x7a4]
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x798]
add eax, dword [ebp - 0xa7c]
push eax
mov eax, edi
sub eax, dword [ebp - 0x78c]
add eax, dword [ebp - 0xaac]
push eax
jmp 0xb6f69d
mov ebx, dword [ebp - 0xa70]
lea eax, [ebp - 0x7a4]
push ebx
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x798]
add eax, dword [ebp - 0xa7c]
push eax
push ebx
mov esi, dword [0xc930a8]
lea eax, [ebp - 0x794]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xa98]
cmp eax, 2
je 0xb6f983
cmp eax, 3
je 0xb6f983
xor edx, edx
inc edx
cmp eax, edx
jne 0xb6f9a2
xor eax, eax
mov dword [ebp - 0x7a8], 0xffffff
push 0x5c
push eax
lea eax, [ebp - 0x58c]
push eax
call fcn.00ab4bf6
mov esi, dword [0xc9307c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0xa70], eax
test eax, eax
jne 0xb6f73c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb6f731
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb6f7dd
jmp 0xb6f243
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x48
push dword [ebp - 0xa84]
push 0xb
call dword [0xc99200]
call esi
push dword [ebp - 0xa78]
neg eax
mov dword [ebp - 0x57c], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x570]
mov dword [ebp - 0x58c], eax
mov byte [ebp - 0x572], 5
call fcn.00a535e0
mov esi, dword [0xc93010]
lea eax, [ebp - 0x58c]
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb6f7be
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xb6f7b5
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb6f7c4
mov ebx, 0x80004005
jmp 0xb6f7c4
mov dword [ebp - 0x7ac], eax
push dword [ebp - 0xa70]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb6fa99
push dword [ebp - 0x7ac]
mov esi, dword [0xc9303c]
xor eax, eax
push dword [ebp - 0xa8c]
mov dword [ebp - 0x77c], edi
mov ecx, esi
mov edi, dword [ebp - 0x7b8]
mov ebx, eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9306c]
mov ecx, esi
mov dword [ebp - 0xa70], eax
xor eax, eax
push eax
push 0x460
lea eax, [ebp - 0x784]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xa8c]
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb6f849
mov ebx, 0x80004005
mov eax, dword [ebp - 0xa70]
test eax, eax
je 0xb6f865
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
test ebx, ebx
js 0xb6fa99
mov eax, dword [ebp - 0x77c]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x77c], eax
cmp eax, ecx
jge 0xb6f889
mov dword [ebp - 0x77c], ecx
mov ebx, dword [ebp - 0xa84]
mov esi, dword [0xc9305c]
mov ecx, esi
push 0x60
pop edi
push edi
push ebx
push dword [ebp - 0x784]
mov dword [ebp - 0x778], 0x20
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x780]
mov dword [ebp - 0x784], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x77c]
mov dword [ebp - 0x780], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc9305c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x778]
mov dword [ebp - 0x77c], eax
call dword [0xc99200]
call esi
cmp dword [ebp - 0x7c8], 0
mov esi, dword [0xc930a8]
mov dword [ebp - 0x778], eax
je 0xb6f955
mov ecx, dword [ebp - 0x788]
mov eax, dword [ebp - 0x7a4]
add ecx, 0x24
cmp eax, dword [ebp - 0x794]
jl 0xb6f940
mov eax, dword [ebp - 0x794]
push ecx
push eax
lea eax, [ebp - 0x784]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
jmp 0xb6f99f
mov eax, dword [ebp - 0x788]
mov ecx, dword [ebp - 0x79c]
add eax, 0x24
cmp ecx, dword [ebp - 0x78c]
jg 0xb6f972
mov ecx, dword [ebp - 0x78c]
push eax
mov eax, dword [ebp - 0x784]
sub eax, dword [ebp - 0x77c]
add eax, ecx
jmp 0xb6f941
mov eax, dword [ebp - 0x788]
mov dword [ebp - 0x3cc], edi
mov dword [ebp - 0x3c8], eax
mov dword [ebp - 0x7a8], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [ebp - 0x7c8]
mov ebx, dword [ebp - 0x3cc]
mov dword [ebp - 0xa70], eax
mov eax, dword [ebp - 0x3c8]
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0xa98]
sub eax, 1
je 0xb6fd32
sub eax, 1
je 0xb6fc5f
sub eax, 1
jne 0xb6fa97
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x454]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x454]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x454], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xb6fa97
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x440]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x438]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x438]
lea esi, [ebp - 0x440]
sub eax, ebx
lea edi, [ebp - 0xdfc]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0x434]
sub eax, dword [ebp - 0xaac]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
mov dword [ebp - 0x3d0], eax
xor ebx, ebx
push dword [ebp - 0xa8c]
mov esi, dword [0xc930b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xc99200]
call esi
xor esi, esi
mov edi, 0xc96238
inc esi
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xb6faba
mov eax, dword [0xc95890]
test eax, eax
jle 0xb6fb1f
sub eax, 1
mov dword [0xc95890], eax
jne 0xb6fb1f
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb6faee
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb6fadd
push 0x40
xor eax, eax
push eax
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0xc96238
inc esi
xor eax, eax
xchg dword [edi], eax
mov eax, dword [ebp - 0xaa8]
test eax, eax
je 0xb6fb3e
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb712ad
mov edi, dword [ebp - 0x3d4]
xor eax, eax
mov ebx, dword [ebp - 0x3d0]
push 0x54
push eax
lea eax, [ebp - 0x870]
mov dword [ebp - 0xd78], edi
push eax
mov dword [ebp - 0xd74], ebx
call fcn.00ab4bf6
add esp, 0xc
mov dword [ebp - 0xa70], esi
mov esi, dword [0xc93028]
mov ecx, esi
push 7
push dword [ebp - 0xab4]
call dword [0xc99200]
call esi
test eax, eax
je 0xb6fbd9
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x870]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb6fbd9
push 0x20
pop eax
cmp word [ebp - 0x85e], ax
jne 0xb6fbd9
cmp dword [ebp - 0x85c], 0
je 0xb6fbd9
cmp dword [ebp - 0x86c], 0
jle 0xb6fbd9
cmp dword [ebp - 0x868], 0
jg 0xb6fbee
xor eax, eax
cmp dword [ebp - 0xa98], 1
mov dword [ebp - 0xa70], eax
jne 0xb6fd45
mov esi, dword [0xc930a8]
lea eax, [ebp - 0x7a4]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc930a8]
lea eax, [ebp - 0x794]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov ebx, dword [ebp - 0xa98]
cmp ebx, 1
jne 0xb6fd4b
mov eax, dword [ebp - 0x7c4]
mov esi, dword [0xc93014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0xc99200]
call esi
mov dword [ebp - 0xac0], eax
jmp 0xb6fd4b
mov esi, dword [0xc930a4]
lea edi, [ebp - 0x42c]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push eax
mov ecx, esi
call dword [0xc99200]
call esi
mov esi, dword [0xc93084]
lea ecx, [ebp - 0x42c]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x42c], 0x28
call dword [0xc99200]
call esi
test eax, eax
je 0xb6fa97
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x418]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov esi, dword [0xc930a0]
lea eax, [ebp - 0x410]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xc99200]
call esi
cmp dword [ebp - 0xa70], 0
lea esi, [ebp - 0x418]
lea edi, [ebp - 0xdfc]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0xb6fd0a
imul eax, dword [ebp - 0x410], 5
cdq
idiv ecx
add eax, dword [ebp - 0x418]
jmp 0xb6fd18
mov eax, dword [ebp - 0x410]
sub eax, ebx
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x3d4], eax
mov eax, dword [ebp - 0x40c]
sub eax, dword [ebp - 0xaac]
imul eax, eax, 0x5f
jmp 0xb6fa8e
xor ebx, ebx
mov dword [ebp - 0x3d4], ebx
mov dword [ebp - 0x3d0], ebx
jmp 0xb6fa99
mov ebx, dword [ebp - 0xa98]
mov esi, dword [0xc93040]
mov ecx, esi
push 1
push dword [ebp - 0xab4]
call dword [0xc99200]
call esi
cmp dword [ebp - 0x7c8], 0
mov dword [ebp - 0xaac], eax
mov dword [ebp - 0xaa8], 0x810
je 0xb6fd86
mov dword [ebp - 0xaa8], 0x20812
cmp dword [ebp - 0xa70], 0
je 0xb708a7
mov eax, dword [ebp - 0x7c4]
mov ebx, dword [ebp - 0x7c0]
mov dword [ebp - 0xa70], eax
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0xa7c], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x8c4]
mov dword [ebp - 0xa78], ebx
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x81c]
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xa80], eax
mov dword [ebp - 0xa8c], eax
mov dword [ebp - 0xa88], eax
mov dword [ebp - 0xa84], eax
lea eax, [ebp - 0x504]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x3c4]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xb7128d
mov esi, dword [0xc93028]
mov ecx, esi
mov ebx, dword [ebp - 0xab4]
push 7
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xb70938
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x8c4]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb6fe7c
mov eax, dword [ebp - 0x8b0]
mov dword [ebp - 0xa80], eax
mov eax, dword [ebp - 0x8c0]
mov dword [ebp - 0xa88], eax
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0xa84], eax
mov esi, dword [0xc93008]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov ebx, eax
mov dword [ebp - 0xa74], ebx
test ebx, ebx
je 0xb70938
mov eax, dword [ebp - 0x79c]
xor ecx, ecx
sub eax, dword [ebp - 0x7a4]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x500], eax
mov eax, dword [ebp - 0x7a0]
sub eax, dword [ebp - 0x798]
mov dword [ebp - 0x4fc], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xbdc], ecx
mov word [ebp - 0x4f8], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x4f6], ax
lea eax, [ebp - 0xbdc]
push eax
push ecx
lea eax, [ebp - 0x504]
mov dword [ebp - 0xa90], ecx
push eax
mov dword [ebp - 0x4f4], ecx
mov dword [ebp - 0x4f0], ecx
mov dword [ebp - 0x4ec], ecx
mov dword [ebp - 0x4e8], ecx
mov dword [ebp - 0x4e4], ecx
mov dword [ebp - 0x4e0], ecx
mov dword [ebp - 0x4dc], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x504], 0x28
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0xa94], edi
test edi, edi
jne 0xb6ff7a
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xa90], eax
test eax, eax
jle 0xb6ff65
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xa90], eax
test eax, eax
js 0xb702f2
mov dword [ebp - 0xa90], 0x80004005
jmp 0xb702f2
mov esi, dword [0xc93034]
lea eax, [ebp - 0x81c]
push eax
push 0x54
push edi
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb6ffa4
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0xa8c], eax
mov eax, dword [ebp - 0x79c]
sub eax, dword [ebp - 0x7a4]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp - 0x798]
sub eax, dword [ebp - 0x7a0]
push edi
push ebx
mov dword [ebp - 0x3b8], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push ebx
call dword [0xc99200]
call esi
push dword [ebp - 0xa7c]
mov esi, dword [0xc9303c]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0xa7c], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x3c4]
mov ecx, edi
push eax
push ebx
call dword [0xc99200]
call edi
mov esi, dword [0xc9306c]
xor eax, eax
push eax
push dword [ebp - 0xaa8]
lea eax, [ebp - 0x3c4]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xa78]
push ebx
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xa98], eax
jne 0xb7009b
cmp dword [ebp - 0xa70], 0
je 0xb7008f
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [ebp - 0xa70], eax
jmp 0xb700a5
mov dword [ebp - 0xa70], 0xffffff
jmp 0xb700a5
mov dword [ebp - 0xa70], 0xffa8a8a8
mov edx, dword [ebp - 0x7a4]
xor ecx, ecx
mov eax, dword [ebp - 0x7a0]
mov edi, ecx
mov dword [ebp - 0xa78], edx
test edx, edx
jns 0xb700cd
mov edi, edx
neg edi
xor edx, edx
mov dword [ebp - 0xa78], edx
jmp 0xb700cf
xor edx, edx
test eax, eax
jns 0xb700d9
mov ecx, eax
mov eax, edx
neg ecx
mov esi, dword [ebp - 0x3bc]
mov edx, dword [ebp - 0xa88]
sub esi, edi
sub edx, dword [ebp - 0xa78]
mov dword [ebp - 0xaa4], esi
cmp esi, edx
jl 0xb700ff
mov esi, edx
mov dword [ebp - 0xaa4], edx
mov edx, dword [ebp - 0x3b8]
sub dword [ebp - 0xa84], eax
sub edx, ecx
mov dword [ebp - 0xa6c], edx
cmp edx, dword [ebp - 0xa84]
jl 0xb70127
mov edx, dword [ebp - 0xa84]
mov dword [ebp - 0xa6c], edx
test esi, esi
jle 0xb702c0
test edx, edx
jle 0xb702c0
mov edx, dword [ebp - 0x3bc]
imul eax, dword [ebp - 0xa88]
imul ecx, edx
shl edx, 2
add eax, dword [ebp - 0xa78]
add ecx, edi
mov edi, dword [ebp - 0xa8c]
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0xa80]
mov dword [ebp - 0xa80], edx
mov edx, dword [ebp - 0xa88]
shl edx, 2
lea eax, [edi + eax*4]
mov dword [ebp - 0xa8c], ecx
mov dword [ebp - 0xa78], eax
mov dword [ebp - 0xa88], edx
mov ebx, eax
mov dword [ebp - 0xaa0], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0xa84], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xa9c], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xb70267
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xa70]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa9c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xa84]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xa70]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa84]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xa6e]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa84]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xaa0]
cdq
idiv ecx
mov edx, dword [ebp - 0xa84]
add al, bl
mov ebx, dword [ebp - 0xa9c]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0xa84], edx
mov dword [ebp - 0xaa0], esi
jne 0xb701a1
mov ecx, dword [ebp - 0xa8c]
mov eax, dword [ebp - 0xa78]
add ecx, dword [ebp - 0xa80]
add eax, dword [ebp - 0xa88]
sub dword [ebp - 0xa6c], 1
mov esi, dword [ebp - 0xaa4]
mov dword [ebp - 0xa8c], ecx
mov dword [ebp - 0xa78], eax
jne 0xb70185
mov ebx, dword [ebp - 0xa74]
push dword [ebp - 0xa94]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xa7c]
test eax, eax
je 0xb702f2
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0xa90], 0
jl 0xb7128d
mov eax, dword [ebp - 0x7c4]
mov ebx, dword [ebp - 0x7bc]
mov dword [ebp - 0xa70], eax
mov eax, dword [ebp - 0x7b0]
mov dword [ebp - 0xa7c], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x918]
mov dword [ebp - 0xa78], ebx
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x96c]
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xa80], eax
mov dword [ebp - 0xa8c], eax
mov dword [ebp - 0xa88], eax
mov dword [ebp - 0xa84], eax
lea eax, [ebp - 0x4d8]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x3b4]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xb7128d
mov esi, dword [0xc93028]
mov ecx, esi
mov ebx, dword [ebp - 0xab4]
push 7
push ebx
call dword [0xc99200]
call esi
test eax, eax
je 0xb70938
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x918]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb703f9
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0xa80], eax
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0xa88], eax
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0xa84], eax
mov esi, dword [0xc93008]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov ebx, eax
mov dword [ebp - 0xa74], ebx
test ebx, ebx
je 0xb70938
mov eax, dword [ebp - 0x78c]
xor ecx, ecx
sub eax, dword [ebp - 0x794]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x4d4], eax
mov eax, dword [ebp - 0x790]
sub eax, dword [ebp - 0x788]
mov dword [ebp - 0x4d0], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xbe0], ecx
mov word [ebp - 0x4cc], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x4ca], ax
lea eax, [ebp - 0xbe0]
push eax
push ecx
lea eax, [ebp - 0x4d8]
mov dword [ebp - 0xa90], ecx
push eax
mov dword [ebp - 0x4c8], ecx
mov dword [ebp - 0x4c4], ecx
mov dword [ebp - 0x4c0], ecx
mov dword [ebp - 0x4bc], ecx
mov dword [ebp - 0x4b8], ecx
mov dword [ebp - 0x4b4], ecx
mov dword [ebp - 0x4b0], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x4d8], 0x28
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0xa94], edi
test edi, edi
jne 0xb704f7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xa90], eax
test eax, eax
jle 0xb704e2
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xa90], eax
test eax, eax
js 0xb7087e
mov dword [ebp - 0xa90], 0x80004005
jmp 0xb7087e
mov esi, dword [0xc93034]
lea eax, [ebp - 0x96c]
push eax
push 0x54
push edi
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb70521
mov eax, dword [ebp - 0x958]
mov dword [ebp - 0xa8c], eax
mov eax, dword [ebp - 0x78c]
sub eax, dword [ebp - 0x794]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x3ac], eax
mov eax, dword [ebp - 0x788]
sub eax, dword [ebp - 0x790]
push edi
push ebx
mov dword [ebp - 0x3a8], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push ebx
call dword [0xc99200]
call esi
push dword [ebp - 0xa7c]
mov esi, dword [0xc9303c]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0xa7c], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x3b4]
mov ecx, edi
push eax
push ebx
call dword [0xc99200]
call edi
mov esi, dword [0xc9306c]
xor eax, eax
push eax
push dword [ebp - 0xaa8]
lea eax, [ebp - 0x3b4]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xa78]
push ebx
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xa98], eax
jne 0xb70612
cmp dword [ebp - 0xa70], 0
je 0xb70606
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
jmp 0xb70617
mov dword [ebp - 0xa98], 0xffffff
jmp 0xb70623
mov eax, 0xffa8a8a8
mov dword [ebp - 0xa98], eax
mov dword [ebp - 0xb04], eax
mov edx, dword [ebp - 0x794]
xor ecx, ecx
mov eax, dword [ebp - 0x790]
mov edi, ecx
mov dword [ebp - 0xa70], edx
test edx, edx
jns 0xb70649
mov edi, edx
neg edi
xor edx, edx
mov dword [ebp - 0xa70], edx
test eax, eax
jns 0xb70653
mov ecx, eax
neg ecx
xor eax, eax
mov ebx, dword [ebp - 0xa88]
mov esi, dword [ebp - 0x3ac]
mov dword [ebp - 0xa78], ebx
sub esi, edi
sub dword [ebp - 0xa78], edx
mov edx, dword [ebp - 0xa78]
mov dword [ebp - 0xaa8], esi
cmp esi, edx
jl 0xb70685
mov esi, edx
mov dword [ebp - 0xaa8], edx
mov edx, dword [ebp - 0x3a8]
sub dword [ebp - 0xa84], eax
sub edx, ecx
mov dword [ebp - 0xa78], edx
cmp edx, dword [ebp - 0xa84]
jl 0xb706ad
mov edx, dword [ebp - 0xa84]
mov dword [ebp - 0xa78], edx
mov ebx, dword [ebp - 0xa74]
test esi, esi
jle 0xb7084c
test edx, edx
jle 0xb7084c
mov edx, dword [ebp - 0x3ac]
imul eax, dword [ebp - 0xa88]
imul ecx, edx
shl edx, 2
add eax, dword [ebp - 0xa70]
add ecx, edi
mov edi, dword [ebp - 0xa8c]
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0xa80]
mov dword [ebp - 0xa80], edx
mov edx, dword [ebp - 0xa88]
shl edx, 2
lea eax, [edi + eax*4]
mov dword [ebp - 0xa8c], ecx
mov dword [ebp - 0xa70], eax
mov dword [ebp - 0xa88], edx
mov ebx, eax
mov dword [ebp - 0xa6c], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0xa84], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xaa4], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xb707f3
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xb04]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaa4]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xa84]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xb04]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa84]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xa96]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa84]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xa6c]
cdq
idiv ecx
mov edx, dword [ebp - 0xa84]
add al, bl
mov ebx, dword [ebp - 0xaa4]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0xa84], edx
mov dword [ebp - 0xa6c], esi
jne 0xb7072d
mov ecx, dword [ebp - 0xa8c]
mov eax, dword [ebp - 0xa70]
add ecx, dword [ebp - 0xa80]
add eax, dword [ebp - 0xa88]
sub dword [ebp - 0xa78], 1
mov esi, dword [ebp - 0xaa8]
mov dword [ebp - 0xa8c], ecx
mov dword [ebp - 0xa70], eax
jne 0xb70711
mov ebx, dword [ebp - 0xa74]
push dword [ebp - 0xa94]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xa7c]
test eax, eax
je 0xb7087e
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push ebx
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
cmp dword [ebp - 0xa90], 0
jl 0xb7128d
mov edi, dword [ebp - 0xab0]
jmp 0xb71db7
xor edx, edx
inc edx
cmp dword [ebp - 0x7c4], 0
jne 0xb708bb
cmp ebx, edx
je 0xb708bb
mov al, 0xc0
jmp 0xb708bd
or al, 0xff
mov esi, dword [0xc93008]
xor ecx, ecx
push dword [ebp - 0xab4]
mov byte [ebp - 0xa6e], al
mov edi, ecx
mov eax, ecx
mov word [ebp - 0xa70], cx
mov dword [ebp - 0xa7c], ecx
mov dword [ebp - 0xa78], ecx
mov dword [ebp - 0xe04], ecx
mov dword [ebp - 0xe00], ecx
mov dword [ebp - 0xa80], ecx
mov dword [ebp - 0xe18], ecx
mov dword [ebp - 0xe14], ecx
mov dword [ebp - 0xe10], ecx
mov ecx, esi
mov byte [ebp - 0xa6d], dl
mov dword [ebp - 0xe0c], edi
mov dword [ebp - 0xe08], eax
mov dword [ebp - 0xe1c], eax
call dword [0xc99200]
call esi
mov dword [ebp - 0xab0], eax
test eax, eax
jne 0xb70943
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb7128d
xor eax, eax
inc eax
cmp ebx, eax
jne 0xb70a45
mov eax, dword [ebp - 0x79c]
mov ecx, dword [ebp - 0x78c]
sub ecx, dword [ebp - 0x794]
sub eax, dword [ebp - 0x7a4]
mov dword [ebp - 0xa8c], ecx
cmp ecx, eax
jg 0xb70978
mov ecx, eax
mov dword [ebp - 0xa8c], eax
mov edx, dword [ebp - 0x788]
xor eax, eax
sub edx, dword [ebp - 0x7a0]
mov ebx, eax
mov dword [ebp - 0xa88], edx
cmp dword [ebp - 0x7c8], eax
je 0xb709cc
mov edi, dword [ebp - 0x7a4]
sub edi, dword [ebp - 0x79c]
mov eax, dword [ebp - 0x794]
add edi, ecx
sub eax, dword [ebp - 0x78c]
mov ebx, edi
add eax, ecx
mov dword [ebp - 0xa7c], edi
mov dword [ebp - 0xe0c], edi
mov dword [ebp - 0xa80], eax
mov dword [ebp - 0xe1c], eax
sub eax, dword [ebp - 0x794]
add eax, dword [ebp - 0x78c]
mov edi, dword [ebp - 0x798]
sub edi, dword [ebp - 0x7a0]
sub ebx, dword [ebp - 0x7a4]
add ebx, dword [ebp - 0x79c]
mov dword [ebp - 0xa74], eax
mov dword [ebp - 0xe14], eax
mov eax, dword [ebp - 0x790]
sub eax, dword [ebp - 0x7a0]
mov dword [ebp - 0xa84], edi
mov dword [ebp - 0xe00], edi
mov edi, eax
sub edi, dword [ebp - 0x790]
add edi, dword [ebp - 0x788]
mov dword [ebp - 0xe04], ebx
mov dword [ebp - 0xa90], eax
mov dword [ebp - 0xe18], eax
mov dword [ebp - 0xa94], edi
mov dword [ebp - 0xe10], edi
jmp 0xb70ad7
lea esi, [ebp - 0x7a4]
mov ecx, dword [ebp - 0x3cc]
lea edi, [ebp - 0xe0c]
mov edx, dword [ebp - 0x3c8]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xa8c], ecx
mov dword [ebp - 0xa88], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xe00]
lea esi, [ebp - 0x794]
mov ebx, dword [ebp - 0xe04]
lea edi, [ebp - 0xe1c]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xa84], eax
mov eax, dword [ebp - 0xe08]
mov dword [ebp - 0xa78], eax
mov eax, dword [ebp - 0xe0c]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xa7c], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xe10]
mov dword [ebp - 0xa94], eax
mov eax, dword [ebp - 0xe14]
mov dword [ebp - 0xa74], eax
mov eax, dword [ebp - 0xe18]
mov dword [ebp - 0xa90], eax
mov eax, dword [ebp - 0xe1c]
mov dword [ebp - 0xa80], eax
mov esi, dword [0xc9300c]
xor eax, eax
mov edi, dword [ebp - 0xab0]
neg edx
push 0x20
mov dword [ebp - 0xbe4], eax
mov dword [ebp - 0x520], eax
mov dword [ebp - 0x51c], eax
mov dword [ebp - 0x518], eax
mov dword [ebp - 0x514], eax
mov dword [ebp - 0x510], eax
mov dword [ebp - 0x50c], eax
mov dword [ebp - 0x508], eax
inc eax
mov word [ebp - 0x524], ax
pop eax
mov dword [ebp - 0x52c], ecx
xor ecx, ecx
push ecx
push ecx
mov word [ebp - 0x522], ax
lea eax, [ebp - 0xbe4]
push eax
push ecx
lea eax, [ebp - 0x530]
mov dword [ebp - 0x530], 0x28
push eax
push edi
mov ecx, esi
mov dword [ebp - 0x528], edx
call dword [0xc99200]
call esi
mov dword [ebp - 0xac8], eax
test eax, eax
jne 0xb70b72
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb71278
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xa98], eax
jne 0xb70bd8
mov ecx, dword [ebp - 0xac0]
test ecx, ecx
je 0xb70bd8
mov esi, dword [0xc93074]
xor eax, eax
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0xa8c]
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0xa88]
push ecx
mov dword [ebp - 0x398], eax
mov ecx, esi
lea eax, [ebp - 0x3a4]
push eax
push edi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0x7c4]
mov esi, dword [ebp - 0x7c0]
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0xa6c], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x9c0]
mov dword [ebp - 0xa9c], esi
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa14]
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0xad0], eax
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xac4], eax
lea eax, [ebp - 0x4ac]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x3e4]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xab0]
test esi, esi
je 0xb7125d
mov esi, dword [0xc93028]
mov ecx, esi
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
jne 0xb70c86
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xb7125d
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x9c0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb70cc8
mov eax, dword [ebp - 0x9ac]
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0x9bc]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0x9b8]
mov dword [ebp - 0xac4], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov ecx, eax
mov dword [ebp - 0xadc], ecx
test ecx, ecx
je 0xb70c7b
mov eax, dword [ebp - 0xa78]
xor edx, edx
mov edi, dword [ebp - 0xa84]
sub eax, edi
sub ebx, dword [ebp - 0xa7c]
mov esi, dword [0xc9300c]
mov dword [ebp - 0x4a4], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xbe8], edx
mov word [ebp - 0x4a0], ax
pop eax
push edx
push edx
mov word [ebp - 0x49e], ax
lea eax, [ebp - 0xbe8]
push eax
push edx
lea eax, [ebp - 0x4ac]
mov dword [ebp - 0xb40], edx
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x49c], edx
mov dword [ebp - 0x498], edx
mov dword [ebp - 0x494], edx
mov dword [ebp - 0x490], edx
mov dword [ebp - 0x48c], edx
mov dword [ebp - 0x488], edx
mov dword [ebp - 0x484], edx
mov dword [ebp - 0x4ac], 0x28
mov dword [ebp - 0x4a8], ebx
call dword [0xc99200]
call esi
mov dword [ebp - 0xa84], eax
test eax, eax
jne 0xb70dc2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xb40], eax
test eax, eax
jle 0xb70da7
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb40], eax
test eax, eax
mov edi, dword [ebp - 0xadc]
js 0xb71129
mov dword [ebp - 0xb40], 0x80004005
jmp 0xb71129
mov esi, dword [0xc93034]
lea ecx, [ebp - 0xa14]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb70dec
mov eax, dword [ebp - 0xa00]
mov dword [ebp - 0xad0], eax
push dword [ebp - 0xa84]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x3dc], ebx
mov ebx, dword [ebp - 0xa78]
sub edi, ebx
mov dword [ebp - 0x3d8], edi
mov edi, dword [ebp - 0xadc]
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0xa6c]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0xa78], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
mov esi, dword [ebp - 0xadc]
mov ecx, edi
push eax
lea eax, [ebp - 0x3e4]
push eax
push esi
call dword [0xc99200]
call edi
xor eax, eax
push eax
push dword [ebp - 0xaa8]
lea eax, [ebp - 0x3e4]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xa9c]
push esi
mov esi, dword [0xc9306c]
mov ecx, esi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xa98], eax
jne 0xb70ee4
cmp dword [ebp - 0xaa4], 0
je 0xb70ed8
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
mov dword [ebp - 0xaa4], eax
jmp 0xb70eee
mov dword [ebp - 0xaa4], 0xffffff
jmp 0xb70eee
mov dword [ebp - 0xaa4], 0xffa8a8a8
mov ecx, dword [ebp - 0xa7c]
xor edx, edx
mov edi, edx
mov eax, edx
test ecx, ecx
jns 0xb70f04
mov edi, ecx
mov ecx, edx
neg edi
test ebx, ebx
jns 0xb70f0e
mov eax, ebx
mov ebx, edx
neg eax
mov esi, dword [ebp - 0x3dc]
mov edx, dword [ebp - 0xabc]
sub esi, edi
sub edx, ecx
mov dword [ebp - 0xa7c], esi
cmp esi, edx
jl 0xb70f30
mov esi, edx
mov dword [ebp - 0xa7c], edx
mov edx, dword [ebp - 0x3d8]
sub dword [ebp - 0xac4], ebx
sub edx, eax
mov dword [ebp - 0xa6c], edx
cmp edx, dword [ebp - 0xac4]
jl 0xb70f58
mov edx, dword [ebp - 0xac4]
mov dword [ebp - 0xa6c], edx
test esi, esi
jle 0xb710f1
test edx, edx
jle 0xb710f1
imul eax, dword [ebp - 0x3dc]
add eax, edi
mov edi, dword [ebp - 0xad0]
lea edi, [edi + eax*4]
mov eax, dword [ebp - 0xabc]
imul eax, ebx
mov dword [ebp - 0xa9c], edi
add eax, ecx
mov ecx, dword [ebp - 0xaa0]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x3dc]
shl ecx, 2
mov dword [ebp - 0xad0], ecx
mov ecx, dword [ebp - 0xabc]
shl ecx, 2
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0xabc], ecx
mov ebx, eax
mov dword [ebp - 0xaec], esi
add edi, 2
lea edx, [eax + 3]
sub ebx, dword [ebp - 0xa9c]
mov dword [ebp - 0xac4], edx
mov dword [ebp - 0xb3c], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xb7109e
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xaa4]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb3c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xac4]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xaa4]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac4]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xaa2]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac4]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xaec]
cdq
idiv ecx
mov edx, dword [ebp - 0xac4]
add al, bl
mov ebx, dword [ebp - 0xb3c]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0xac4], edx
mov dword [ebp - 0xaec], esi
jne 0xb70fd8
mov edi, dword [ebp - 0xa9c]
mov eax, dword [ebp - 0xaa0]
add edi, dword [ebp - 0xad0]
add eax, dword [ebp - 0xabc]
sub dword [ebp - 0xa6c], 1
mov esi, dword [ebp - 0xa7c]
mov dword [ebp - 0xa9c], edi
mov dword [ebp - 0xaa0], eax
jne 0xb70fb8
push dword [ebp - 0xa84]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xa78]
mov edi, dword [ebp - 0xadc]
test eax, eax
je 0xb71129
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0xb40], 0
jl 0xb71257
mov eax, dword [ebp - 0x7c4]
mov ebx, dword [ebp - 0x7bc]
mov dword [ebp - 0xa7c], eax
mov eax, dword [ebp - 0x7b0]
mov dword [ebp - 0xa78], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa68]
mov dword [ebp - 0xa84], ebx
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x774]
push eax
call fcn.00ab4bf6
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xaa4], eax
mov dword [ebp - 0xa6c], eax
mov dword [ebp - 0xa9c], eax
mov dword [ebp - 0xaa0], eax
lea eax, [ebp - 0x480]
push eax
call fcn.00ab4bf6
xor eax, eax
lea edi, [ebp - 0x394]
stosd dword es:[edi], eax
add esp, 0x24
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xab0]
test ebx, ebx
je 0xb7125d
mov esi, dword [0xc93028]
mov ecx, esi
push 7
push edi
call dword [0xc99200]
call esi
test eax, eax
je 0xb70c7b
mov esi, dword [0xc93034]
lea ecx, [ebp - 0xa68]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb71230
mov eax, dword [ebp - 0xa54]
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0xa64]
mov dword [ebp - 0xa9c], eax
mov eax, dword [ebp - 0xa60]
mov dword [ebp - 0xaa0], eax
mov esi, dword [0xc93008]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov edi, eax
mov dword [ebp - 0xad0], edi
test edi, edi
jne 0xb718bb
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, dword [ebp - 0xab0]
mov eax, dword [ebp - 0xac8]
test eax, eax
je 0xb71278
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
test edi, edi
je 0xb7128d
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xac0]
test eax, eax
je 0xb712a8
mov esi, dword [0xc9301c]
mov ecx, esi
push eax
call dword [0xc99200]
call esi
mov edi, 0xc96238
mov ecx, dword [ebp - 0x7c0]
xor ebx, ebx
test ecx, ecx
je 0xb712fe
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xb712bc
mov eax, dword [ebp - 0x7c0]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xb712e4
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xb712dc
push dword [ebp - 0x7c0]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x7c0], ebx
mov ecx, dword [ebp - 0x7bc]
test ecx, ecx
je 0xb7134d
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xb7130b
mov eax, dword [ebp - 0x7bc]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xb71333
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0xb7132b
push dword [ebp - 0x7bc]
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x7bc], ebx
mov edx, dword [ebp - 0x7b8]
test edx, edx
je 0xb71399
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xb7135c
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xb71384
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0xb71376
mov edx, dword [ebp - 0x7b8]
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x7b8], ebx
cmp dword [ebp - 0x7b4], 0
je 0xb713be
push dword [ebp - 0x7b4]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x7b4], ebx
cmp dword [ebp - 0x7b0], 0
je 0xb713e3
push dword [ebp - 0x7b0]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x7b0], ebx
cmp dword [ebp - 0x7ac], 0
je 0xb71408
push dword [ebp - 0x7ac]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov dword [ebp - 0x7ac], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xb7140a
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jle 0xb7146c
sub eax, 1
mov dword [0xc95890], eax
jne 0xb7146c
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb71440
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb7142f
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0xc95878]
mov esi, dword [0xc9304c]
mov ecx, esi
mov dword [ebp - 0xa98], eax
call dword [0xc99200]
call esi
sub eax, dword [0xc95870]
lea edi, [ebp - 0x2f4]
push 7
mov dword [ebp - 0xab0], eax
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
xor ebx, ebx
mov edi, 0xc96238
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xb714ab
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jne 0xb71fbe
push 0x338
mov esi, ebx
mov dword [ebp - 0xac8], ebx
push ebx
mov dword [ebp - 0xac0], ebx
mov dword [ebp - 0xa70], esi
mov dword [ebp - 0xb14], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb10], eax
test eax, eax
je 0xb71fb2
or dword [ebp - 0xad8], 0xffffffff
mov cl, bl
add eax, 7
mov dword [ebp - 0xacc], ebx
mov edx, ebx
mov dword [ebp - 0xae8], eax
mov esi, dword [ebp - 0xbfc]
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xbfc]
xor ebx, edi
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xbfc]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xbfc]
shl esi, 8
add dword [ebp - 0xbfc], 8
movzx eax, byte [eax + 5]
or esi, eax
xor edx, esi
xor edx, ebx
xor edx, 0xac987321
mov dword [ebp - 0xb08], edx
lea eax, [edx + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb08]
rol eax, 0xa
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0xb08]
xor eax, edx
mov dword [ebp - 0xb08], eax
imul edx, dword [ebp - 0xb08], 0x605e
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor ebx, edx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0xb08]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb08], eax
xor edx, 0xab69605e
mov eax, 0x7f1137f
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
mov eax, dword [ebp - 0xb08]
xor eax, edx
mov dword [ebp - 0xb08], eax
add eax, 0x7f1137f
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb08]
rol eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub edx, eax
mov eax, dword [ebp - 0xb08]
xor eax, edx
mov dword [ebp - 0xb08], eax
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb08]
ror eax, 0xa
xor edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor edx, eax
xor edx, dword [ebp - 0xb08]
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea eax, [ebx - 0x7f1]
xor eax, edx
xor eax, 0xab69605e
mov dword [ebp - 0xb08], eax
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb08]
shr eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xb08]
xor eax, edx
mov dword [ebp - 0xb08], eax
mov edx, eax
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor ebx, edx
mov eax, ebx
mov edx, ebx
xor eax, 0xab69
rol ebx, 7
rol eax, 5
imul eax, eax, 0x7f1
add eax, ebx
mov ebx, dword [ebp - 0xb08]
xor ebx, eax
mov dword [ebp - 0xb08], ebx
xor ebx, edx
mov edx, dword [ebp - 0xb08]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
imul eax, eax, 0x137f
sub eax, 0xd0dd417
xor edx, eax
mov dword [ebp - 0xb08], edx
lea eax, [edx - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb08]
ror eax, 6
sub edx, eax
xor ebx, edx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add edx, eax
mov eax, dword [ebp - 0xb08]
xor eax, edx
mov dword [ebp - 0xb08], eax
add eax, 0xab69605e
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, dword [ebp - 0xb08]
ror eax, 0xe
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor edx, eax
mov eax, dword [ebp - 0xb08]
xor eax, edx
mov edx, 0x7f1137f
mov dword [ebp - 0xb08], eax
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, dword [ebp - 0xb08]
rol eax, 2
xor edx, eax
mov eax, dword [ebp - 0xae8]
xor edx, dword [ebp - 0xacc]
xor ebx, edx
mov dword [ebp - 0xacc], edi
mov edx, dword [ebp - 0xb08]
xor edx, dword [ebp - 0xad8]
mov byte [eax - 4], bl
mov byte [eax], dl
ror ebx, 8
mov byte [eax - 5], bl
ror edx, 8
mov byte [eax - 1], dl
ror ebx, 8
mov byte [eax - 6], bl
ror edx, 8
mov byte [eax - 2], dl
ror ebx, 8
ror edx, 8
mov byte [eax - 7], bl
mov byte [eax - 3], dl
add eax, 8
ror ebx, 8
ror edx, 8
sub dword [ebp - 0xc00], 1
mov dword [ebp - 0xad8], esi
mov dword [ebp - 0xae8], eax
jne 0xb7151d
mov esi, dword [ebp - 0xb10]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xb7187d
movzx eax, cl
cdq
cmp eax, dword [0x9fc028]
jne 0xb71dd8
cmp edx, dword [0x9fc02c]
jne 0xb71dd8
mov ebx, dword [ebp - 0xb14]
mov edi, esi
xor eax, eax
mov dword [ebp - 0xa70], edi
mov esi, eax
jmp 0xb71dec
mov eax, dword [ebp - 0xa74]
xor ecx, ecx
sub eax, dword [ebp - 0xa80]
mov ebx, dword [ebp - 0xa90]
mov esi, dword [0xc9300c]
mov dword [ebp - 0xa74], eax
mov dword [ebp - 0x47c], eax
mov eax, ebx
sub eax, dword [ebp - 0xa94]
mov dword [ebp - 0x478], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0xbec], ecx
mov word [ebp - 0x474], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x472], ax
lea eax, [ebp - 0xbec]
push eax
push ecx
lea eax, [ebp - 0x480]
mov dword [ebp - 0xabc], ecx
push eax
mov dword [ebp - 0x470], ecx
mov dword [ebp - 0x46c], ecx
mov dword [ebp - 0x468], ecx
mov dword [ebp - 0x464], ecx
mov dword [ebp - 0x460], ecx
mov dword [ebp - 0x45c], ecx
mov dword [ebp - 0x458], ecx
mov ecx, esi
push edi
mov dword [ebp - 0x480], 0x28
call dword [0xc99200]
call esi
mov dword [ebp - 0xa90], eax
test eax, eax
jne 0xb7199e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xabc], eax
test eax, eax
jle 0xb71989
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xabc], eax
test eax, eax
js 0xb71d11
mov dword [ebp - 0xabc], 0x80004005
jmp 0xb71d11
mov esi, dword [0xc93034]
lea ecx, [ebp - 0x774]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xc99200]
call esi
test eax, eax
je 0xb719c8
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0xa6c], eax
mov eax, dword [ebp - 0xa74]
push dword [ebp - 0xa90]
mov esi, dword [0xc9303c]
mov ecx, esi
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0xa94]
sub eax, ebx
push edi
mov dword [ebp - 0x388], eax
call dword [0xc99200]
call esi
mov esi, dword [0xc93040]
xor eax, eax
inc eax
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
push dword [ebp - 0xa78]
mov esi, dword [0xc9303c]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93038]
mov ecx, esi
mov edi, dword [0xc93074]
mov dword [ebp - 0xa78], eax
xor eax, eax
push eax
call dword [0xc99200]
call esi
push eax
lea eax, [ebp - 0x394]
mov ecx, edi
push eax
push dword [ebp - 0xad0]
call dword [0xc99200]
call edi
mov edi, dword [ebp - 0xad0]
xor eax, eax
mov esi, dword [0xc9306c]
mov ecx, esi
push eax
push dword [ebp - 0xaa8]
lea eax, [ebp - 0x394]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xa84]
push edi
call dword [0xc99200]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xa98], eax
jne 0xb71abf
cmp dword [ebp - 0xa7c], 0
je 0xb71ab3
mov esi, dword [0xc9308c]
mov ecx, esi
push 8
call dword [0xc99200]
call esi
jmp 0xb71ac4
mov dword [ebp - 0xaa8], 0xffffff
jmp 0xb71ad0
mov eax, 0xffa8a8a8
mov dword [ebp - 0xaa8], eax
mov dword [ebp - 0xb04], eax
mov ecx, dword [ebp - 0xa80]
xor eax, eax
mov edx, eax
test ecx, ecx
jns 0xb71aec
mov edx, ecx
neg edx
xor ecx, ecx
mov dword [ebp - 0xa80], ecx
jmp 0xb71aee
xor ecx, ecx
test ebx, ebx
jns 0xb71af8
mov eax, ebx
mov ebx, ecx
neg eax
mov esi, dword [ebp - 0x38c]
mov ecx, dword [ebp - 0xa9c]
sub esi, edx
sub ecx, dword [ebp - 0xa80]
mov dword [ebp - 0xa7c], esi
cmp esi, ecx
jl 0xb71b1e
mov esi, ecx
mov dword [ebp - 0xa7c], ecx
mov ecx, dword [ebp - 0x388]
sub dword [ebp - 0xaa0], ebx
sub ecx, eax
mov dword [ebp - 0xa84], ecx
cmp ecx, dword [ebp - 0xaa0]
jl 0xb71b46
mov ecx, dword [ebp - 0xaa0]
mov dword [ebp - 0xa84], ecx
test esi, esi
jle 0xb71cdf
test ecx, ecx
jle 0xb71cdf
imul eax, dword [ebp - 0x38c]
mov ecx, dword [ebp - 0xa6c]
add eax, edx
mov edx, dword [ebp - 0xa9c]
imul ebx, edx
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0xaa4]
mov dword [ebp - 0xa74], eax
add ebx, dword [ebp - 0xa80]
lea ecx, [ecx + ebx*4]
mov ebx, dword [ebp - 0x38c]
shl ebx, 2
shl edx, 2
mov dword [ebp - 0xa80], ecx
mov dword [ebp - 0xa94], ebx
mov dword [ebp - 0xaa4], edx
mov ebx, ecx
mov dword [ebp - 0xaa0], esi
lea edx, [ecx + 3]
sub ebx, eax
mov dword [ebp - 0xa6c], edx
lea edi, [eax + 2]
mov dword [ebp - 0xa9c], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xb71c86
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xb04]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa9c]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xa6c]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xb04]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa6c]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xaa6]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xa6c]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xaa0]
cdq
idiv ecx
mov edx, dword [ebp - 0xa6c]
add al, bl
mov ebx, dword [ebp - 0xa9c]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub esi, 1
mov dword [ebp - 0xa6c], edx
mov dword [ebp - 0xaa0], esi
jne 0xb71bc0
mov eax, dword [ebp - 0xa74]
mov ecx, dword [ebp - 0xa80]
add eax, dword [ebp - 0xa94]
add ecx, dword [ebp - 0xaa4]
sub dword [ebp - 0xa84], 1
mov esi, dword [ebp - 0xa7c]
mov dword [ebp - 0xa74], eax
mov dword [ebp - 0xa80], ecx
jne 0xb71ba4
mov edi, dword [ebp - 0xad0]
push dword [ebp - 0xa90]
mov esi, dword [0xc9301c]
mov ecx, esi
call dword [0xc99200]
call esi
mov eax, dword [ebp - 0xa78]
test eax, eax
je 0xb71d11
mov esi, dword [0xc9303c]
mov ecx, esi
push eax
push edi
call dword [0xc99200]
call esi
mov esi, dword [0xc93018]
mov ecx, esi
push edi
call dword [0xc99200]
call esi
cmp dword [ebp - 0xabc], 0
jl 0xb71257
mov edi, dword [ebp - 0xab0]
xor eax, eax
inc eax
cmp dword [ebp - 0xa98], eax
jne 0xb71d7a
mov esi, dword [section..data]
xor eax, eax
push 0xcc0020
push eax
push eax
push edi
push dword [ebp - 0xa88]
mov ecx, esi
push dword [ebp - 0xa8c]
push dword [ebp - 0x7a0]
push dword [ebp - 0x7a4]
push dword [ebp - 0xab4]
call dword [0xc99200]
call esi
jmp 0xb71db7
push dword [ebp - 0xa70]
mov ecx, dword [ebp - 0xa88]
xor edx, edx
mov eax, dword [ebp - 0xa8c]
mov esi, dword [0xc93020]
push ecx
push eax
push edx
push edx
push edi
push ecx
push eax
push dword [ebp - 0x3d0]
mov ecx, esi
push dword [ebp - 0x3d4]
push dword [ebp - 0xab4]
call dword [0xc99200]
call esi
push dword [ebp - 0xaac]
mov esi, dword [0xc93040]
mov ecx, esi
push dword [ebp - 0xab4]
call dword [0xc99200]
call esi
jmp 0xb7125d
or dword [ebp - 0xc04], 0xffffffff
mov ebx, 0xc004d501
mov edi, dword [ebp - 0xa70]
xor eax, eax
test esi, esi
je 0xb71dff
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xb71fac
mov eax, dword [ebp - 0xc04]
xor ecx, ecx
push 0x40
push ecx
mov ebx, 0xc960a0
mov esi, edi
push ebx
mov byte [eax + edi], cl
call fcn.00ab4bf6
add esp, 0xc
cmp byte [edi], 0
je 0xb71f42
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbb4]
jne 0xb71e37
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xb71fa5
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xac0], ecx
cmp word [eax], dx
je 0xb71e84
mov ecx, 0xc000007b
mov dword [ebp - 0xac0], ecx
jmp 0xb71ecc
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0xb71e77
add edx, dword [edi]
cmp edx, dword [edi]
jb 0xb71e77
cmp dword [edx], 0x4550
jne 0xb71e77
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc08]
je 0xb71eba
cmp ax, word [ebp - 0xc0c]
je 0xb71eba
mov ecx, 0xc000000d
jmp 0xb71e7c
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop edx
add esi, edx
mov dword [ebp - 0xb14], eax
test eax, eax
je 0xb71f36
mov edx, esi
mov dword [ebp - 0xb10], esi
lea eax, [edx + 1]
mov dword [ebp - 0xacc], eax
mov al, byte [edx]
inc edx
test al, al
jne 0xb71eee
sub edx, dword [ebp - 0xacc]
inc esi
add esi, edx
test ecx, ecx
js 0xb71f27
push dword [ebp - 0xb10]
push dword [edi]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test eax, eax
je 0xb71f42
mov ecx, dword [ebp - 0xac8]
mov dword [ecx*4 + section..data], eax
mov ecx, dword [ebp - 0xac0]
inc dword [ebp - 0xac8]
inc ebx
cmp ebx, dword [ebp - 0xb14]
jb 0xb71edd
add edi, 0x10
cmp byte [esi], 0
jne 0xb71e30
mov ebx, dword [ebp - 0xac0]
mov esi, dword [ebp - 0xa70]
test esi, esi
je 0xb71f63
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push esi
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xb71fb9
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb71f7c
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb71f6b
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xb71fc6
mov ebx, 0xc000007a
jmp 0xb71f48
mov esi, dword [ebp - 0xa70]
mov ebx, 0xc000007a
jmp 0xb71f4e
mov eax, dword [0xc95890]
inc eax
xor ebx, ebx
mov dword [0xc95890], eax
xor eax, eax
mov edi, 0xc96238
xchg dword [edi], eax
mov eax, dword [ebp - 0xab0]
xor ecx, ecx
mov esi, dword [0xc93068]
inc ecx
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0xa98]
mov dword [ebp - 0x2dc], eax
lea eax, [ebp - 0x2f8]
push eax
push 4
pop eax
push eax
push 0x2021
mov dword [ebp - 0x2f8], ecx
mov dword [ebp - 0x2f0], ecx
mov dword [ebp - 0x2e4], ecx
mov dword [ebp - 0x2e8], ecx
mov dword [ebp - 0x2e0], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x2ec], 0x9966f291
call dword [0xc99200]
call esi
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xb72035
mov eax, dword [0xc95890]
push 0
pop ebx
test eax, eax
jle 0xb72097
sub eax, 1
mov dword [0xc95890], eax
jne 0xb72097
mov esi, ebx
mov eax, dword [esi + 0xc960a0]
test eax, eax
je 0xb7206b
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xb7205a
push 0x40
push ebx
push 0xc960a0
call fcn.00ab4bf6
add esp, 0xc
mov esi, 0x9e6748
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xc96238
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xab4]
mov esi, dword [0xc930b0]
mov ecx, esi
push ebx
call dword [0xc99200]
call esi
mov ebx, dword [ebp - 0xb0c]
xor eax, eax
lea edi, [ebp - 0xdd0]
mov dword [ebp - 0xb14], eax
mov dword [ebp - 0xb10], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xddc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa0
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xacc], eax
test eax, eax
je 0xb74265
push 0x28
pop ecx
mov esi, 0xc94ea0
mov dword [ebp - 0xb14], eax
mov edi, eax
rep movsd dword es:[edi], dword [esi]
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xad8], eax
test eax, eax
je 0xb74265
mov ecx, dword [0xc94e98]
mov edi, eax
mov dword [eax], ecx
mov ecx, dword [0xc94e9c]
mov dword [eax + 4], ecx
mov dword [ebp - 0xb10], edi
rdtsc
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0xb08], edx
xor eax, eax
mov dword [ebp - 0xb20], eax
lea eax, [ebp - 0xae4]
push eax
push 4
pop esi
mov edx, esi
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb7425a
mov edx, dword [ebp - 0xae4]
lea eax, [ebp - 0xb20]
push eax
xor ecx, ecx
call fcn.00a32533
or eax, 0x10000000
jl 0xb7425a
lea eax, [ebp - 0xb50]
mov edx, 0xa0
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb7425a
mov edx, dword [ebp - 0xb50]
lea eax, [ebp - 0xb20]
mov ecx, dword [ebp - 0xb20]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xb7425a
lea eax, [ebp - 0xb24]
mov ecx, esi
push eax
push 8
pop edx
call fcn.00a32533
test eax, eax
js 0xb7425a
mov edx, dword [ebp - 0xb24]
lea eax, [ebp - 0xb20]
mov ecx, dword [ebp - 0xb20]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xb7425a
lea eax, [ebp - 0xb78]
mov ecx, esi
push eax
push 8
pop edx
call fcn.00a32533
test eax, eax
js 0xb7425a
mov edx, dword [ebp - 0xb78]
lea eax, [ebp - 0xb20]
mov ecx, dword [ebp - 0xb20]
push eax
call fcn.00a32533
or eax, 0x10000000
jl 0xb7425a
mov esi, dword [ebp - 0xb20]
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xb78], edi
test edi, edi
je 0xb74265
lea eax, [ebp - 0xd94]
mov ecx, edi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
test eax, eax
js 0xb741d3
lea ecx, [edi + esi]
lea eax, [edi + 8]
mov dword [ebp - 0xb24], ecx
cmp eax, ecx
ja 0xb741d3
mov eax, dword [ebp - 0xd94]
push 4
pop ecx
mov dword [edi], ecx
mov dword [eax], ecx
mov esi, edi
xor eax, eax
mov dword [ebp - 0xb74], esi
mov edi, eax
mov edx, dword [esi]
lea eax, [ebp - 0xaf4]
push eax
call fcn.00a32533
test eax, eax
js 0xb741d3
mov edx, dword [ebp - 0xaf4]
lea eax, [ebp - 0xb74]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb741d3
mov esi, dword [ebp - 0xb74]
xor eax, eax
inc edi
inc eax
cmp edi, eax
jae 0xb722ff
push 4
pop ecx
jmp 0xb722ba
lea eax, [ebp - 0xd34]
mov ecx, esi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
test eax, eax
js 0xb741d3
lea eax, [esi + 0xa4]
cmp eax, dword [ebp - 0xb24]
ja 0xb741d3
mov edi, dword [ebp - 0xd34]
mov dword [esi], 0xa0
mov esi, dword [ebp - 0xacc]
push 0x28
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xb78]
xor eax, eax
mov esi, edi
mov dword [ebp - 0xaf4], eax
mov dword [ebp - 0xb6c], esi
mov edx, dword [esi]
lea eax, [ebp - 0xb2c]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
test eax, eax
js 0xb741d3
mov edx, dword [ebp - 0xb2c]
lea eax, [ebp - 0xb6c]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb741d3
mov eax, dword [ebp - 0xaf4]
mov esi, dword [ebp - 0xb6c]
inc eax
mov dword [ebp - 0xaf4], eax
cmp eax, 2
jb 0xb72359
lea eax, [ebp - 0xd3c]
mov ecx, esi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
test eax, eax
js 0xb741d3
lea eax, [esi + 0xc]
cmp eax, dword [ebp - 0xb24]
ja 0xb741d3
mov edx, dword [ebp - 0xad8]
mov ecx, dword [ebp - 0xd3c]
mov dword [esi], 8
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov esi, edi
xor eax, eax
mov dword [ebp - 0xb48], esi
mov edi, eax
mov edx, dword [esi]
lea eax, [ebp - 0xb4c]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
test eax, eax
js 0xb741d3
mov edx, dword [ebp - 0xb4c]
lea eax, [ebp - 0xb48]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb741d3
mov esi, dword [ebp - 0xb48]
inc edi
cmp edi, 3
jb 0xb723fa
lea eax, [ebp - 0xd44]
mov ecx, esi
push eax
push 4
pop edi
mov edx, edi
call fcn.00a32533
test eax, eax
js 0xb741d3
lea eax, [esi + 0xc]
cmp eax, dword [ebp - 0xb24]
ja 0xb741d3
mov eax, dword [ebp - 0xd44]
mov ecx, dword [ebp - 0xae8]
mov dword [esi], 8
mov dword [eax], ecx
mov ecx, dword [ebp - 0xb08]
mov dword [eax + 4], ecx
lea eax, [ebp - 0xae0]
mov edx, edi
push eax
mov ecx, edi
call fcn.00a32533
test eax, eax
js 0xb741d3
mov esi, dword [ebp - 0xae0]
lea eax, [ebp - 0xb88]
push eax
push 8
pop edx
mov ecx, edi
mov dword [ebp - 0xafc], esi
call fcn.00a32533
test eax, eax
js 0xb741d3
mov edx, dword [ebp - 0xb88]
lea eax, [ebp - 0xafc]
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb741d3
xor edx, edx
mov edi, edx
mov dword [ebp - 0xb88], edx
mov dword [ebp - 0xae0], edx
mov dword [ebp - 0xb48], edx
mov dword [ebp - 0xb2c], edx
mov dword [ebp - 0xb6c], edx
mov dword [ebp - 0xaf4], edx
mov dword [ebp - 0xb74], edx
mov dword [ebp - 0xb24], edx
mov dword [ebp - 0xb50], edx
rdtsc
mov dword [ebp - 0xb4c], edi
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xacc], edx
push 8
pop ecx
mov dword [ebp - 0xc28], ecx
mov edx, dword [ebp - 0xb20]
lea eax, [ebp - 0xc28]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb7264b
mov eax, dword [ebp - 0xc28]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0xad8], ecx
cmp ecx, eax
jae 0xb72570
mov esi, 0xc0000095
jmp 0xb7264b
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xae8], eax
test eax, eax
jne 0xb72594
mov esi, 0xc0000017
jmp 0xb7264b
push 4
pop edx
lea ecx, [ebp - 0xab8]
mov dword [ebp - 0xab8], eax
push ecx
mov ecx, eax
mov dword [eax], edx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb72630
mov ecx, dword [ebp - 0xab8]
mov eax, dword [ebp - 0xb20]
mov dword [ecx], eax
lea eax, [ebp - 0xab8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0xae8]
test esi, esi
js 0xb72636
mov ecx, dword [ebp - 0xad8]
push dword [ebp - 0xb20]
mov edx, dword [ebp - 0xae4]
push dword [ebp - 0xb78]
mov dword [eax + ecx - 8], edx
mov edx, dword [ebp - 0xacc]
push dword [ebp - 0xab8]
mov dword [eax + ecx - 4], edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [ebp - 0xae8]
add esp, 0xc
mov ecx, dword [ebp - 0xad8]
xor edx, edx
mov dword [ebp - 0xb88], eax
mov eax, edx
mov dword [ebp - 0xae0], ecx
jmp 0xb72638
mov eax, dword [ebp - 0xae8]
xor edx, edx
test eax, eax
je 0xb7264b
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xb73fd2
xor ecx, ecx
mov dword [ebp - 0xab8], ecx
cmp dword [ebp - 0xb88], ecx
jne 0xb72671
mov esi, 0xc000000d
jmp 0xb72cd5
mov esi, dword [ebp - 0xae0]
test esi, esi
je 0xb72cd0
lea eax, [esi + 8]
push eax
push ecx
mov dword [ebp - 0xae4], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb20], eax
test eax, eax
je 0xb72cd0
mov edi, dword [ebp - 0xb88]
xor eax, eax
mov cl, al
test esi, esi
je 0xb726bb
xor cl, byte [eax + edi]
inc eax
cmp eax, esi
jb 0xb726b3
mov eax, 0xb1b54a58
mov dword [ebp - 0x36c], eax
mov eax, 0xc81ecb17
mov dword [ebp - 0x368], eax
mov eax, esi
shr eax, 3
mov dword [ebp - 0xacc], eax
test eax, eax
je 0xb72aca
movzx edx, word [ebp - 0x36a]
mov eax, 0xc81ecb17
movzx esi, ax
mov ebx, 0xb1b54a58
movzx eax, word [ebp - 0x366]
mov dword [ebp - 0xad8], eax
movzx eax, bx
xor ebx, 0xc81ecb17
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0xb20]
add eax, 7
mov dword [ebp - 0xb5c], esi
mov dword [ebp - 0xb64], eax
lea esi, [edi + 2]
xor eax, eax
mov dword [ebp - 0xb08], edx
mov dword [ebp - 0xb60], ebx
mov edx, eax
mov dword [ebp - 0xb68], esi
or ebx, 0xffffffff
mov dword [ebp - 0xb70], eax
mov dword [ebp - 0xb84], eax
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xb68]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xb68]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xb68]
shl esi, 8
add dword [ebp - 0xb68], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov eax, ebx
sub eax, dword [ebp - 0xae8]
xor eax, 0xc81ecb17
xor eax, edi
xor edx, eax
mov dword [ebp - 0xb44], edx
mov edx, 0xc81ecb17
mov eax, dword [ebp - 0xb44]
xor edx, eax
ror edx, 0xf
imul edx, dword [ebp - 0xb08]
ror eax, 7
add edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
mov eax, ebx
ror eax, 0xa
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [ebp - 0xb5c]
sub edx, eax
mov eax, dword [ebp - 0xb44]
xor eax, edx
mov edx, dword [ebp - 0xb5c]
xor edx, eax
mov dword [ebp - 0xb44], eax
rol edx, 4
imul edx, dword [ebp - 0xad8]
rol eax, 5
add edx, eax
mov eax, 0xc81ecb17
xor ebx, edx
mov edx, 0xb1b54a58
xor edx, ebx
sub eax, edx
mov edx, dword [ebp - 0xb44]
xor edx, eax
mov dword [ebp - 0xb44], edx
sub edx, dword [ebp - 0xae8]
imul edx, dword [ebp - 0xb08]
mov eax, dword [ebp - 0xb44]
shr eax, 6
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb44]
mov eax, ebx
ror eax, 0xf
xor eax, dword [ebp - 0xb5c]
imul eax, dword [ebp - 0xae8]
xor edx, eax
mov eax, edx
not eax
ror eax, 3
add eax, dword [ebp - 0xad8]
imul eax, dword [ebp - 0xb5c]
xor ebx, eax
mov eax, ebx
sub eax, dword [ebp - 0xae8]
sub eax, 0xc81ecb17
xor edx, eax
mov eax, dword [ebp - 0xad8]
mov dword [ebp - 0xb44], edx
xor eax, dword [ebp - 0xb44]
imul eax, dword [ebp - 0xb08]
ror edx, 0xa
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xae8]
xor edx, ebx
mov eax, ebx
rol edx, 6
imul edx, dword [ebp - 0xb5c]
ror eax, 3
xor edx, eax
mov eax, dword [ebp - 0xb44]
xor eax, edx
mov edx, dword [ebp - 0xad8]
mov dword [ebp - 0xb44], eax
ror eax, 0xf
sub eax, edx
imul eax, dword [ebp - 0xae8]
xor ebx, eax
xor edx, ebx
mov eax, ebx
imul edx, dword [ebp - 0xae8]
shr eax, 1
xor edx, eax
mov eax, ebx
xor dword [ebp - 0xb44], edx
mov edx, ebx
sub edx, dword [ebp - 0xb5c]
rol edx, 3
imul edx, dword [ebp - 0xae8]
shr eax, 0xf
xor edx, eax
mov eax, dword [ebp - 0xb44]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb44], eax
sub edx, dword [ebp - 0xb5c]
imul edx, dword [ebp - 0xb08]
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 9
imul edx, dword [ebp - 0xb5c]
ror eax, 0xb
xor edx, eax
mov eax, dword [ebp - 0xb44]
xor eax, edx
mov dword [ebp - 0xb44], eax
sub eax, 0xb1b54a58
sub eax, dword [ebp - 0xad8]
xor ebx, eax
mov eax, dword [ebp - 0xb08]
xor eax, ebx
mov edx, ebx
imul eax, dword [ebp - 0xae8]
ror edx, 7
sub eax, edx
mov edx, dword [ebp - 0xad8]
xor dword [ebp - 0xb44], eax
mov eax, dword [ebp - 0xb44]
xor edx, eax
rol edx, 4
imul edx, dword [ebp - 0xb08]
ror eax, 0x10
sub edx, eax
xor ebx, edx
mov edx, 0xb1b54a58
sub edx, ebx
mov eax, ebx
ror edx, 0xa
imul edx, dword [ebp - 0xb5c]
ror eax, 4
add edx, eax
mov eax, dword [ebp - 0xb44]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb44], eax
sub edx, 0xb1b54a58
ror eax, 9
ror edx, 4
imul edx, dword [ebp - 0xad8]
xor edx, eax
xor ebx, edx
mov edx, 0xc81ecb17
xor edx, ebx
mov eax, ebx
rol edx, 8
imul edx, dword [ebp - 0xae8]
rol eax, 2
sub edx, eax
mov eax, dword [ebp - 0xb44]
xor eax, edx
mov edx, 0xc81ecb17
sub edx, eax
mov dword [ebp - 0xb44], eax
ror edx, 0xb
imul edx, dword [ebp - 0xb08]
ror eax, 0xc
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb08]
xor edx, ebx
mov eax, ebx
imul edx, dword [ebp - 0xb5c]
xor ebx, dword [ebp - 0xb60]
shr eax, 8
xor edx, eax
mov eax, dword [ebp - 0xb64]
xor dword [ebp - 0xb44], edx
mov edx, dword [ebp - 0xb44]
xor ebx, edx
xor edx, dword [ebp - 0xb70]
xor ebx, dword [ebp - 0xb84]
mov byte [eax - 4], dl
mov byte [eax], bl
ror edx, 8
mov byte [eax - 5], dl
ror ebx, 8
mov byte [eax - 1], bl
ror edx, 8
mov byte [eax - 6], dl
ror ebx, 8
mov byte [eax - 2], bl
ror edx, 8
ror ebx, 8
mov byte [eax - 7], dl
mov byte [eax - 3], bl
add eax, 8
ror edx, 8
ror ebx, 8
sub dword [ebp - 0xacc], 1
mov dword [ebp - 0xb84], esi
mov esi, dword [ebp - 0xb68]
mov dword [ebp - 0xb70], edi
mov dword [ebp - 0xb64], eax
jne 0xb72751
mov ebx, dword [ebp - 0xb0c]
mov esi, dword [ebp - 0xae0]
movzx eax, cl
mov ecx, dword [ebp - 0xb20]
cdq
mov dword [ecx + esi], eax
mov dword [ecx + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xae0], edi
test edi, edi
jne 0xb72b02
mov esi, 0xc0000017
jmp 0xb72c18
mov esi, dword [ebp - 0xae4]
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0xb72b2c
mov esi, 0xc0000017
xor edx, edx
jmp 0xb72bb1
mov dword [edi + 4], ecx
mov eax, dword [ebp - 0xb20]
push esi
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb72b20
mov dword [edi + 0xc], eax
push 0x28
pop ecx
mov edi, eax
mov esi, 0xc94df0
push 8
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xae0]
pop eax
push eax
push eax
mov dword [edi + 0x10], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0xb72b95
mov esi, 0xc0000017
jmp 0xb72bb1
mov dword [edi + 0x14], ecx
mov esi, edx
mov eax, dword [0xc94e90]
mov dword [ecx], eax
mov eax, dword [0xc94e94]
mov dword [ebp - 0xab8], edi
mov edi, edx
mov dword [ecx + 4], eax
test edi, edi
je 0xb72c18
cmp dword [edi + 4], 0
je 0xb72bd1
push dword [edi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 4], edx
cmp dword [edi + 0xc], 0
je 0xb72bed
push dword [edi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0xc], edx
cmp dword [edi + 0x14], 0
je 0xb72c09
push dword [edi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0x14], edx
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
test esi, esi
js 0xb72c32
mov edi, dword [ebp - 0xab8]
mov dword [ebp - 0xb4c], edi
mov dword [ebp - 0xab8], eax
jmp 0xb72c38
mov edi, dword [ebp - 0xb4c]
push dword [ebp - 0xb20]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xab8]
test eax, eax
je 0xb72cd5
mov ecx, dword [eax + 4]
test ecx, ecx
je 0xb72c7b
push ecx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xab8]
xor edx, edx
mov dword [eax + 4], edx
jmp 0xb72c7d
xor edx, edx
mov ecx, dword [eax + 0xc]
test ecx, ecx
je 0xb72c9e
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xab8]
xor edx, edx
mov dword [eax + 0xc], edx
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0xb72cbf
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xab8]
xor edx, edx
mov dword [eax + 0x14], edx
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb72cd5
mov esi, 0xc0000001
or esi, 0x10000000
jl 0xb73fd2
mov edx, dword [edi]
lea eax, [ebp - 0xad4]
push 4
pop ecx
push eax
mov dword [ebp - 0xad4], ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb72d74
mov ecx, dword [ebp - 0xad4]
lea eax, [ebp - 0xad4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb72d74
mov edx, dword [edi + 8]
lea eax, [ebp - 0xad4]
mov ecx, dword [ebp - 0xad4]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb72d74
mov ecx, dword [ebp - 0xad4]
lea eax, [ebp - 0xad4]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb72d74
mov edx, dword [edi + 0x10]
lea eax, [ebp - 0xad4]
mov ecx, dword [ebp - 0xad4]
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0xad4]
test esi, esi
jns 0xb72d7a
mov eax, dword [ebp - 0xc34]
mov dword [ebp - 0xad4], eax
test esi, esi
js 0xb72ee3
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xab8], ecx
test ecx, ecx
jne 0xb72dae
mov esi, 0xc0000017
jmp 0xb72ee3
mov eax, dword [edi]
mov dword [ecx], eax
lea eax, [ebp - 0xb18]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xb18], ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb72ec8
push dword [edi]
push dword [edi + 4]
push dword [ebp - 0xb18]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi]
lea eax, [ebp - 0xb18]
mov ecx, dword [ebp - 0xb18]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb72ec8
mov ecx, dword [ebp - 0xb18]
mov eax, dword [edi + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xb18]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb72ec8
push dword [edi + 8]
push dword [edi + 0xc]
push dword [ebp - 0xb18]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi + 8]
lea eax, [ebp - 0xb18]
mov ecx, dword [ebp - 0xb18]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb72ec8
mov ecx, dword [ebp - 0xb18]
mov eax, dword [edi + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xb18]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb72ec8
push dword [edi + 0x10]
push dword [edi + 0x14]
push dword [ebp - 0xb18]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov edx, dword [edi + 0x10]
lea eax, [ebp - 0xb18]
mov ecx, dword [ebp - 0xb18]
add esp, 0xc
push eax
call fcn.00a32533
mov esi, eax
xor edx, edx
mov eax, dword [ebp - 0xab8]
test esi, esi
js 0xb72ed0
mov ecx, dword [ebp - 0xad4]
mov dword [ebp - 0xb48], eax
mov eax, edx
mov dword [ebp - 0xb2c], ecx
jmp 0xb72ed0
mov eax, dword [ebp - 0xab8]
xor edx, edx
test eax, eax
je 0xb72ee3
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xb73fd2
push 8
xor eax, eax
pop edi
mov dword [ebp - 0xb18], eax
mov dword [ebp - 0xad4], eax
mov dword [ebp - 0xc3c], edi
mov edx, dword [ebp - 0xafc]
lea eax, [ebp - 0xc3c]
push eax
mov ecx, edi
call fcn.00a32533
mov esi, eax
or esi, 0x10000000
jl 0xb72f7a
mov eax, dword [ebp - 0xc3c]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xb72f3b
mov esi, 0xc0000095
jmp 0xb72f5b
mov dword [ebp - 0xc44], ecx
lea eax, [ebp - 0xc44]
mov edx, edi
push eax
call fcn.00a32533
mov esi, eax
mov eax, dword [ebp - 0xc44]
test esi, esi
jns 0xb72f61
mov eax, dword [ebp - 0xc40]
mov dword [ebp - 0xab8], eax
test esi, esi
js 0xb72f7a
mov edi, dword [ebp - 0xb78]
test edi, edi
jne 0xb72fb0
mov esi, 0xc000000d
mov edi, dword [ebp - 0xaf4]
test esi, esi
js 0xb73fd2
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xb731a0
mov eax, dword [ebp - 0xb6c]
mov esi, 0xd0000017
jmp 0xb731ab
xor eax, eax
push 4
pop edx
inc eax
cmp edx, eax
jbe 0xb72f75
mov ecx, edi
xor eax, eax
mov dword [ebp - 0xb1c], ecx
mov dword [ebp - 0xafc], eax
mov eax, dword [ecx]
mov dword [ebp - 0xae0], eax
lea eax, [ebp - 0xb1c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb72f7a
mov edx, dword [ebp - 0xae0]
lea eax, [ebp - 0xb1c]
mov ecx, dword [ebp - 0xb1c]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb72f7a
mov eax, dword [ebp - 0xafc]
xor ecx, ecx
inc eax
inc ecx
cmp eax, ecx
mov dword [ebp - 0xafc], eax
mov ecx, dword [ebp - 0xb1c]
jae 0xb73025
push 4
pop edx
jmp 0xb72fca
mov eax, dword [ecx]
mov dword [ebp - 0xafc], eax
lea eax, [ebp - 0xb1c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb72f7a
mov eax, dword [ebp - 0xafc]
mov dword [ebp - 0xb18], eax
push 4
pop edx
cmp edx, 2
jbe 0xb72f75
mov ecx, edi
xor eax, eax
mov dword [ebp - 0xb30], ecx
mov edi, eax
mov eax, dword [ecx]
mov dword [ebp - 0xb1c], eax
lea eax, [ebp - 0xb30]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb730ce
mov edx, dword [ebp - 0xb1c]
lea eax, [ebp - 0xb30]
mov ecx, dword [ebp - 0xb30]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb730ce
mov ecx, dword [ebp - 0xb30]
inc edi
cmp edi, 2
jae 0xb730b5
push 4
pop edx
jmp 0xb7306c
mov edi, dword [ecx]
lea eax, [ebp - 0xb30]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
jns 0xb730dc
mov edi, dword [ebp - 0xad4]
test esi, esi
js 0xb72f7a
mov edx, dword [ebp - 0xab8]
lea eax, [ebp - 0xaf8]
push 4
pop ecx
push eax
mov dword [ebp - 0xaf8], ecx
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb73175
mov ecx, dword [ebp - 0xaf8]
lea eax, [ebp - 0xaf8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb73175
mov edx, dword [ebp - 0xb18]
lea eax, [ebp - 0xaf8]
mov ecx, dword [ebp - 0xaf8]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb73175
mov ecx, dword [ebp - 0xaf8]
lea eax, [ebp - 0xaf8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb73175
mov ecx, dword [ebp - 0xaf8]
lea eax, [ebp - 0xaf8]
push eax
mov edx, edi
call fcn.00a32533
mov edi, dword [ebp - 0xaf8]
mov esi, eax
test esi, esi
jns 0xb73183
mov edi, dword [ebp - 0xc54]
test esi, esi
js 0xb72f7a
cmp edi, 0x400000
jbe 0xb73195
mov esi, 0x8000ffff
jmp 0xb73fd2
mov dword [ebp - 0xaf4], edi
jmp 0xb72f80
mov dword [ebp - 0xb6c], eax
mov esi, 0x10000000
test esi, esi
js 0xb73fd2
mov ecx, dword [ebp - 0xb48]
test ecx, ecx
jne 0xb731c7
mov esi, 0x80070057
jmp 0xb73fd2
test eax, eax
je 0xb731bd
mov dword [ebp - 0xe40], eax
xor eax, eax
mov dword [ebp - 0xe34], eax
lea eax, [ebp - 0xc58]
push eax
xor eax, eax
mov dword [ebp - 0xe44], ecx
mov ecx, dword [ebp - 0xb2c]
inc eax
push 0x9f29b8
push eax
mov dword [ebp - 0xe3c], ecx
mov dword [ebp - 0xe38], edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
jne 0xb7322b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xb73222
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xb73273
mov esi, 0x80004005
jmp 0xb73273
push 0x9fc030
push dword [ebp - 0xc58]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xb7320b
xor eax, eax
mov ecx, esi
push eax
push 0x14
lea eax, [ebp - 0xe44]
push eax
push 0x86
call dword [0xc99200]
call esi
mov esi, eax
or esi, 0x10000000
jl 0xb73273
mov edi, dword [ebp - 0xe38]
mov dword [ebp - 0xaf4], edi
cmp esi, 0xd0000023
jne 0xb73285
mov esi, 0x8007007a
jmp 0xb73fd2
test esi, esi
js 0xb73fd2
mov eax, dword [ebp - 0xb6c]
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0xaf8], ecx
mov dword [ebp - 0xb28], ecx
mov dword [ebp - 0xb34], eax
cmp edi, edx
jae 0xb732b8
mov esi, 0xc000003e
jmp 0xb736b1
mov edi, dword [eax]
lea ecx, [ebp - 0xb34]
push ecx
mov ecx, eax
mov dword [ebp - 0xb30], edi
call fcn.00a32533
mov esi, eax
xor ecx, ecx
test esi, esi
js 0xb736b1
lea eax, [ebp - 0xb28]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb736af
mov eax, dword [ebp - 0xaf4]
sub eax, dword [ebp - 0xb28]
cmp eax, edi
jae 0xb7330f
mov esi, 0xc000003e
jmp 0xb736af
mov eax, dword [ebp - 0xb34]
lea ecx, [ebp - 0xb34]
push ecx
mov edx, edi
mov dword [ebp - 0xb1c], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb736af
mov ecx, dword [ebp - 0xb28]
lea eax, [ebp - 0xb28]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb736af
mov eax, dword [ebp - 0xaf4]
sub eax, dword [ebp - 0xb28]
push 4
pop edx
cmp eax, edx
jb 0xb73305
mov ecx, dword [ebp - 0xb34]
lea eax, [ebp - 0xb34]
push eax
mov edi, dword [ecx]
mov dword [ebp - 0xb18], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb736af
mov ecx, dword [ebp - 0xb28]
lea eax, [ebp - 0xb28]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb736af
mov eax, dword [ebp - 0xaf4]
sub eax, dword [ebp - 0xb28]
cmp eax, edi
jb 0xb73305
mov eax, dword [ebp - 0xb34]
lea ecx, [ebp - 0xb34]
push ecx
mov edx, edi
mov dword [ebp - 0xad4], eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb736af
mov ecx, dword [ebp - 0xb28]
lea eax, [ebp - 0xb28]
push eax
mov edx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb736af
mov eax, dword [ebp - 0xaf4]
sub eax, dword [ebp - 0xb28]
push 4
pop edx
cmp eax, edx
jb 0xb73305
mov ecx, dword [ebp - 0xb34]
mov eax, dword [ecx]
mov dword [ebp - 0xab8], eax
lea eax, [ebp - 0xb34]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb736af
mov ecx, dword [ebp - 0xb28]
lea eax, [ebp - 0xb28]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb736af
mov eax, dword [ebp - 0xaf4]
sub eax, dword [ebp - 0xb28]
mov ecx, dword [ebp - 0xab8]
cmp eax, ecx
jb 0xb73305
lea eax, [ebp - 0xb28]
mov edx, ecx
mov ecx, dword [ebp - 0xb28]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb736af
mov edx, dword [ebp - 0xaf4]
mov eax, edx
sub eax, dword [ebp - 0xb28]
jne 0xb73305
mov esi, dword [ebp - 0xb30]
mov ecx, dword [ebp - 0xab8]
add ecx, 0xc
lea eax, [edi + esi]
add eax, ecx
cmp eax, edx
jne 0xb73305
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xb734e8
mov esi, 0xc0000017
jmp 0xb7362c
cmp dword [ebp - 0xb1c], 0
je 0xb7352a
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xb73513
mov esi, 0xc0000017
xor eax, eax
jmp 0xb735c5
mov dword [edi + 4], eax
push esi
push dword [ebp - 0xb1c]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb73531
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
cmp dword [ebp - 0xad4], 0
je 0xb7356e
mov esi, dword [ebp - 0xb18]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb73507
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xad4]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb73574
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
cmp dword [ebp - 0xb34], 0
je 0xb735b5
mov esi, dword [ebp - 0xab8]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xb73507
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xb34]
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
xor eax, eax
jmp 0xb735bb
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [ebp - 0xaf8], edi
mov esi, eax
mov edi, eax
test edi, edi
je 0xb7362c
cmp dword [edi + 4], 0
je 0xb735e5
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xb73601
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xb7361d
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test esi, esi
js 0xb73642
mov eax, dword [ebp - 0xaf8]
mov edi, ecx
mov dword [ebp - 0xb74], eax
jmp 0xb73648
mov edi, dword [ebp - 0xaf8]
test edi, edi
je 0xb736b1
cmp dword [edi + 4], 0
je 0xb73668
push dword [edi + 4]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 4], ecx
cmp dword [edi + 0xc], 0
je 0xb73684
push dword [edi + 0xc]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0xc], ecx
cmp dword [edi + 0x14], 0
je 0xb736a0
push dword [edi + 0x14]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0x14], ecx
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
or esi, 0x10000000
jl 0xb73fd2
mov eax, dword [ebp - 0xb74]
mov dword [ebp - 0xb34], ecx
mov dword [ebp - 0xb28], ecx
test eax, eax
jne 0xb736dd
mov esi, 0xd000000d
jmp 0xb73fd2
mov esi, dword [eax + 4]
mov dword [ebp - 0xaf8], esi
test esi, esi
je 0xb736d3
mov edi, dword [eax]
test edi, edi
je 0xb736d3
add edi, 0xfffffff8
mov dword [ebp - 0xb30], ecx
push edi
push ecx
mov dword [ebp - 0xb1c], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb18], eax
test eax, eax
je 0xb73d23
xor ecx, ecx
mov dword [ebp - 0xad4], esi
mov dl, cl
mov ecx, 0xab69605e
mov dword [ebp - 0x354], ecx
mov ecx, 0x7f1137f
mov dword [ebp - 0x350], ecx
mov ecx, eax
mov dword [ebp - 0xab8], ecx
and edi, 7
je 0xb73887
xor eax, eax
and dword [ebp - 0xae0], eax
mov dword [ebp - 0xbf8], eax
mov dword [ebp - 0xafc], eax
test edi, edi
je 0xb737c6
push 0x38
mov ebx, eax
pop ecx
movzx eax, byte [esi]
inc esi
cmp dword [ebp - 0xae0], 4
jge 0xb73786
add ecx, 0xffffffe0
shl eax, cl
mov ecx, dword [ebp - 0xb54]
or ebx, eax
jmp 0xb7378e
shl eax, cl
or dword [ebp - 0xbf8], eax
mov eax, dword [ebp - 0xae0]
sub ecx, 8
inc eax
mov dword [ebp - 0xb54], ecx
mov dword [ebp - 0xae0], eax
cmp eax, edi
jl 0xb7376a
mov ecx, dword [ebp - 0xab8]
mov dword [ebp - 0xafc], ebx
mov ebx, dword [ebp - 0xb0c]
mov eax, dword [ebp - 0xafc]
mov dword [ebp - 0xad4], esi
and dword [ebp - 0xb20], 0
mov esi, eax
mov eax, dword [ebp - 0xbf8]
xor esi, 0x92f65a5
xor eax, 0x699a899c
mov dword [ebp - 0xae0], esi
mov dword [ebp - 0xb2c], eax
mov dword [ebp - 0xaf4], esi
mov dword [ebp - 0xae4], eax
test edi, edi
je 0xb73855
mov ebx, dword [ebp - 0xb20]
push 4
pop esi
lea eax, [ecx + 1]
mov dword [ebp - 0xab8], eax
cmp ebx, esi
jge 0xb73821
rol dword [ebp - 0xaf4], 8
mov eax, dword [ebp - 0xaf4]
jmp 0xb7382e
rol dword [ebp - 0xae4], 8
mov eax, dword [ebp - 0xae4]
mov byte [ecx], al
inc ebx
mov eax, dword [ebp - 0xab8]
mov ecx, eax
cmp ebx, edi
jl 0xb73805
mov ebx, dword [ebp - 0xb0c]
mov esi, dword [ebp - 0xae0]
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0xb2c]
push 4
pop ecx
cmp edi, ecx
jbe 0xb7386a
push 8
pop ecx
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
jmp 0xb73899
xor eax, eax
mov dword [ebp - 0xb2c], eax
cmp edi, ecx
jae 0xb7389f
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0xae0], esi
jmp 0xb7389f
xor ecx, ecx
mov esi, ecx
mov dword [ebp - 0xafc], ecx
mov eax, ecx
mov dword [ebp - 0xae0], esi
mov dword [ebp - 0xb2c], eax
mov ecx, dword [ebp - 0xb1c]
mov eax, ecx
shr eax, 3
mov dword [ebp - 0xaf4], eax
test eax, eax
je 0xb73c9b
movzx ecx, word [ebp - 0x34e]
mov eax, 0x7f1137f
movzx esi, word [ebp - 0x352]
mov ebx, dword [ebp - 0xae0]
movzx eax, ax
mov dword [ebp - 0xb20], ecx
mov ecx, 0xab69605e
mov dword [ebp - 0xae4], eax
movzx eax, cx
mov ecx, dword [ebp - 0xb2c]
mov dword [ebp - 0xad8], eax
mov eax, dword [ebp - 0xab8]
mov dword [ebp - 0xacc], esi
add eax, 7
mov esi, dword [ebp - 0xad4]
add esi, 2
mov dword [ebp - 0xab8], eax
mov dword [ebp - 0xad4], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xad4]
xor ebx, edi
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xad4]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xad4]
shl esi, 8
add dword [ebp - 0xad4], 8
movzx eax, byte [eax + 5]
or esi, eax
mov eax, 0xab69605e
xor ecx, esi
xor eax, ecx
mov ecx, 0x7f1137f
xor eax, ebx
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xb2c], eax
sub ecx, 0xab69605e
rol eax, 0xa
rol ecx, 5
imul ecx, dword [ebp - 0xae4]
add ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea ecx, [ebx + ecx]
ror ecx, 9
imul ecx, dword [ebp - 0xacc]
sub ecx, eax
mov eax, dword [ebp - 0xb2c]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xb2c], eax
sub ecx, dword [ebp - 0xae4]
imul ecx, dword [ebp - 0xad8]
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xacc]
rol ecx, 6
imul ecx, dword [ebp - 0xb20]
rol eax, 2
sub ecx, eax
mov eax, dword [ebp - 0xb2c]
xor eax, ecx
mov ecx, 0xab69605e
xor ecx, eax
mov dword [ebp - 0xb2c], eax
mov eax, 0x7f1137f
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, dword [ebp - 0xae4]
imul eax, dword [ebp - 0xacc]
ror ecx, 6
xor ecx, eax
mov eax, dword [ebp - 0xb2c]
xor eax, ecx
mov ecx, 0x7f1137f
mov dword [ebp - 0xb2c], eax
add ecx, eax
ror ecx, 0xf
imul ecx, dword [ebp - 0xad8]
rol eax, 2
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
sub ecx, 0xab69605e
rol eax, 8
ror ecx, 0xe
imul ecx, dword [ebp - 0xb20]
sub ecx, eax
mov eax, dword [ebp - 0xb2c]
xor eax, ecx
mov ecx, 0xab69605e
xor ecx, eax
mov dword [ebp - 0xb2c], eax
ror ecx, 0xc
imul ecx, dword [ebp - 0xae4]
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xb20]
imul ecx, dword [ebp - 0xacc]
shr eax, 0xa
xor ecx, eax
xor dword [ebp - 0xb2c], ecx
mov ecx, dword [ebp - 0xb2c]
mov eax, ecx
not eax
ror eax, 5
add eax, dword [ebp - 0xad8]
imul eax, dword [ebp - 0xb20]
xor ebx, eax
mov eax, ebx
sub eax, dword [ebp - 0xb20]
xor eax, 0xab69605e
xor ecx, eax
mov dword [ebp - 0xb2c], ecx
xor ecx, dword [ebp - 0xb20]
mov eax, dword [ebp - 0xb2c]
rol ecx, 2
imul ecx, dword [ebp - 0xae4]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 6
imul ecx, dword [ebp - 0xacc]
rol eax, 7
add ecx, eax
mov eax, dword [ebp - 0xb2c]
xor eax, ecx
mov dword [ebp - 0xb2c], eax
mov ecx, eax
xor eax, dword [ebp - 0xae4]
imul eax, dword [ebp - 0xad8]
ror ecx, 9
add ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xacc]
rol ecx, 5
imul ecx, dword [ebp - 0xb20]
rol eax, 7
add ecx, eax
mov eax, 0xab69605e
xor dword [ebp - 0xb2c], ecx
mov ecx, dword [ebp - 0xb2c]
xor eax, ecx
xor eax, ebx
mov ebx, 0x7f1137f
xor ebx, eax
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xacc]
imul eax, dword [ebp - 0xae4]
xor ecx, eax
mov eax, 0x7f1137f
mov dword [ebp - 0xb2c], ecx
sub ecx, eax
mov eax, dword [ebp - 0xb2c]
ror ecx, 1
imul ecx, dword [ebp - 0xad8]
ror eax, 6
sub ecx, eax
xor ebx, ecx
mov ecx, 0xab69605e
mov eax, ebx
rol eax, 0xe
lea ecx, [ecx + ebx]
rol ecx, 3
imul ecx, dword [ebp - 0xb20]
add ecx, eax
mov eax, dword [ebp - 0xb2c]
xor eax, ecx
mov ecx, 0xab69605e
add ecx, eax
mov dword [ebp - 0xb2c], eax
rol ecx, 0xf
imul ecx, dword [ebp - 0xae4]
ror eax, 0xe
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
xor ecx, dword [ebp - 0xad8]
imul ecx, dword [ebp - 0xacc]
shr eax, 3
xor ecx, eax
mov eax, dword [ebp - 0xb2c]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xb2c], eax
xor ecx, 0x7f1137f
rol eax, 2
rol ecx, 4
imul ecx, dword [ebp - 0xad8]
xor ecx, eax
mov eax, dword [ebp - 0xab8]
xor ecx, dword [ebp - 0xafc]
xor ebx, ecx
mov dword [ebp - 0xafc], edi
mov ecx, dword [ebp - 0xb2c]
xor ecx, dword [ebp - 0xbf8]
mov byte [eax - 4], bl
mov byte [eax], cl
ror ebx, 8
mov byte [eax - 5], bl
ror ecx, 8
mov byte [eax - 1], cl
ror ebx, 8
mov byte [eax - 6], bl
ror ecx, 8
mov byte [eax - 2], cl
ror ebx, 8
ror ecx, 8
mov byte [eax - 7], bl
mov byte [eax - 3], cl
add eax, 8
ror ebx, 8
ror ecx, 8
sub dword [ebp - 0xaf4], 1
mov dword [ebp - 0xbf8], esi
mov esi, dword [ebp - 0xad4]
mov dword [ebp - 0xab8], eax
jne 0xb73918
mov ebx, dword [ebp - 0xb0c]
mov ecx, dword [ebp - 0xb1c]
mov esi, dword [ebp - 0xb18]
xor eax, eax
test ecx, ecx
je 0xb73caf
xor dl, byte [eax + esi]
inc eax
cmp eax, ecx
jb 0xb73ca7
mov edi, dword [ebp - 0xaf8]
movzx eax, dl
cdq
cmp eax, dword [ecx + edi]
jne 0xb73cd8
cmp edx, dword [ecx + edi + 4]
jne 0xb73cd8
mov edi, esi
mov dword [ebp - 0xb28], ecx
xor eax, eax
mov dword [ebp - 0xb34], edi
mov esi, eax
jmp 0xb73cea
mov edi, dword [ebp - 0xb34]
xor eax, eax
mov dword [ebp - 0xb30], 0xc004d501
test esi, esi
je 0xb73cfd
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xb30], 0
jl 0xb73d23
mov dword [ebp - 0xb24], edi
xor ecx, ecx
mov edi, dword [ebp - 0xb28]
mov eax, ecx
mov dword [ebp - 0xb50], edi
mov esi, 0x10000000
jmp 0xb73d36
mov eax, dword [ebp - 0xb34]
mov esi, 0xd0000001
mov edi, dword [ebp - 0xb50]
xor ecx, ecx
test eax, eax
je 0xb73d49
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xb73fd2
mov ecx, dword [ebp - 0xb24]
xor eax, eax
push 4
pop edx
mov dword [ebp - 0xb7c], eax
mov dword [ebp - 0xc68], ecx
cmp edi, edx
jb 0xb73fc7
mov eax, dword [ecx]
mov dword [ebp - 0xb34], eax
lea eax, [ebp - 0xc68]
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb73fcc
lea eax, [ebp - 0xb7c]
xor ecx, ecx
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb73fcc
mov eax, edi
sub eax, dword [ebp - 0xb7c]
push 4
pop edx
cmp eax, edx
jb 0xb73fc7
mov ecx, dword [ebp - 0xc68]
lea eax, [ebp - 0xc68]
push eax
mov edi, dword [ecx]
mov dword [ebp - 0xb28], edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb73fcc
mov ecx, dword [ebp - 0xb7c]
lea eax, [ebp - 0xb7c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb73fcc
mov eax, dword [ebp - 0xb50]
mov ecx, dword [ebp - 0xb7c]
sub eax, ecx
cmp eax, edi
jb 0xb73fc7
lea eax, [ebp - 0xb7c]
mov edx, edi
push eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb73fcc
mov edx, dword [ebp - 0xb50]
mov esi, dword [ebp - 0xb24]
mov eax, dword [ebp - 0xc68]
add eax, edi
lea ecx, [edx + esi]
cmp ecx, eax
jb 0xb73fc7
mov eax, dword [ebp - 0xc68]
sub edx, edi
sub edx, eax
add edx, esi
cmp edx, 8
jae 0xb73fc7
xor edx, edx
mov dword [ebp - 0xaf8], edx
mov ecx, edx
mov dword [ebp - 0xb7c], ecx
mov esi, edx
test eax, eax
je 0xb73f56
mov edx, dword [ebp - 0xb28]
lea ecx, [ebp - 0xc6c]
push ecx
mov ecx, eax
mov edi, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb73fcc
mov eax, dword [ebp - 0xc6c]
jmp 0xb73f3e
lea eax, [ebp - 0xc70]
mov ecx, edi
push eax
push 4
pop eax
mov edx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb73fcc
mov eax, dword [ebp - 0xc6c]
cmp dword [ebp - 0xc70], eax
ja 0xb73f7d
mov edx, dword [edi]
lea eax, [ebp - 0xc74]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb73f00
mov eax, dword [ebp - 0xc74]
mov dword [ebp - 0xc78], eax
jmp 0xb73f06
mov eax, dword [ebp - 0xc78]
test esi, esi
js 0xb73fcc
lea ecx, [ebp - 0xc7c]
mov edx, eax
push ecx
mov ecx, edi
call fcn.00a32533
mov esi, eax
test esi, esi
js 0xb73fcc
mov edi, dword [ebp - 0xc7c]
mov eax, dword [ebp - 0xc6c]
cmp edi, eax
ja 0xb73f7d
inc dword [ebp - 0xaf8]
cmp edi, eax
jb 0xb73eaa
cmp edi, eax
jne 0xb73f7d
mov edi, dword [ebp - 0xb28]
mov ecx, dword [ebp - 0xb7c]
test edi, edi
je 0xb73f88
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xb7c], ecx
test ecx, ecx
jne 0xb73f84
mov esi, 0xc0000017
jmp 0xb73fb5
mov esi, 0xc000000d
jmp 0xb73fcc
xor eax, eax
mov esi, eax
mov eax, dword [ebp - 0xc68]
test eax, eax
je 0xb73fa3
push edi
push eax
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov ecx, dword [ebp - 0xb7c]
add esp, 0xc
mov eax, dword [ebp - 0xaf8]
mov dword [ebp - 0xdd4], ecx
mov dword [ebp - 0xddc], eax
test esi, esi
js 0xb73fcc
mov eax, dword [ebp - 0xb34]
cmp eax, dword [ebp - 0xddc]
je 0xb73fcc
mov esi, 0xc000003e
or esi, 0x10000000
mov eax, dword [ebp - 0xb88]
test eax, eax
je 0xb73fed
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xb4c]
test edi, edi
je 0xb7405b
xor eax, eax
cmp dword [edi + 4], eax
je 0xb74014
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xb74030
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xb7404c
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb48]
test eax, eax
je 0xb74076
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb6c]
test eax, eax
je 0xb74091
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xb74]
test edi, edi
je 0xb740ff
xor eax, eax
cmp dword [edi + 4], eax
je 0xb740b8
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xb740d4
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xb740f0
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb24]
test eax, eax
je 0xb7411a
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xb741d3
mov edi, dword [ebp - 0xddc]
xor eax, eax
inc eax
cmp edi, eax
jb 0xb741d3
mov esi, dword [ebp - 0xdd4]
test esi, esi
je 0xb741d3
test edi, edi
je 0xb741d3
lea eax, [ebp - 0xc80]
mov dword [ebp - 0xc80], esi
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb741d3
mov eax, dword [esi]
neg eax
sbb eax, eax
and eax, dword [ebp - 0xc80]
push 4
pop ecx
cmp dword [esi], ecx
jne 0xb741d3
cmp dword [eax], 0
jl 0xb741d3
xor eax, eax
inc eax
cmp edi, eax
jbe 0xb741d3
xor eax, eax
mov dword [ebp - 0xc84], esi
push ecx
mov edi, eax
pop ebx
lea eax, [ebp - 0xc84]
mov edx, ebx
push eax
mov ecx, esi
call fcn.00a32533
test eax, eax
js 0xb741cd
mov edx, dword [esi]
lea eax, [ebp - 0xc84]
mov ecx, dword [ebp - 0xc84]
push eax
call fcn.00a32533
test eax, eax
js 0xb741cd
xor eax, eax
inc edi
inc eax
cmp edi, eax
jae 0xb741cd
mov esi, dword [ebp - 0xc84]
jmp 0xb74191
mov ebx, dword [ebp - 0xb0c]
mov eax, dword [ebp - 0xb78]
mov edi, dword [ebp - 0xb10]
test eax, eax
je 0xb741f4
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xdd4]
test esi, esi
je 0xb7420f
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb14]
test eax, eax
je 0xb7422a
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xb7423f
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb00]
xor edx, edx
mov esi, edx
mov dword [ebp - 0xbc4], eax
mov dword [ebp - 0xb00], esi
jmp 0xb6a810
mov eax, dword [ebp - 0xdc8]
jmp 0xb741df
mov eax, dword [ebp - 0xdc8]
jmp 0xb741d9
cmp ebx, 0xd00000e5
je 0xb7428f
cmp ebx, 0xc004d501
je 0xb7428f
cmp ebx, 0xd000003e
jne 0xb74294
mov ebx, 0xc004f028
jmp 0xb742a5
mov ebx, 0xc004f027
test ebx, ebx
jns 0xb742ad
cmp ebx, 0x8007007a
jne 0xb742a5
mov ebx, 0xc004f01e
mov esi, dword [ebp - 0xc88]
jmp 0xb742c0
push 4
pop ecx
cmp dword [ebp - 0xbf0], ecx
jne 0xb742a0
mov esi, dword [eax]
mov ebx, dword [ebp - 0xbd8]
test eax, eax
je 0xb742cb
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
test ebx, ebx
jns 0xb742d3
xor eax, eax
mov esi, eax
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop esi
setne al
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret