Function at 0x40a492
Capabilities:
Check if file exists
Check os version
Encode data using xor
Execute anti-debugging instructions
Get keyboard layout
Get number of processors
Link many functions at runtime
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xdf4
mov eax, dword [0x41c194]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
push 0x401b2c
mov dword [ebp - 0xba4], esi
mov dword [ebp - 0xba0], ecx
mov dword [ebp - 0xbc8], edi
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x41e6d4], eax
test eax, eax
je 0x40a9c6
push 0x401b54
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [0x41e6d8], eax
test eax, eax
je 0x40a9c6
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0xc6c], eax
test eax, eax
je 0x40a9c6
mov ecx, esi
call fcn.00409f9c
test eax, eax
je 0x40a9c6
push 0x7f01
push ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x7f02
push ebx
mov dword [0x41dfcc], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x401b70
push esi
mov dword [0x41dfd0], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov dword [0x41e464], eax
cmp dword [0x41dfd0], ebx
je 0x40a9c6
test eax, eax
je 0x40a9c6
mov ecx, dword [ebp - 0xba0]
mov edx, esi
call fcn.00414f77
mov eax, dword [ebp - 0xba0]
mov dword [0x41dfd4], eax
mov dword [0x41dfd8], esi
mov dword [0x41e680], 0x54
mov dword [0x41e688], ebx
mov dword [0x41e68c], ebx
mov dword [0x41e6bc], esi
call fcn.004053be
call fcn.00409ad6
push ebx
push esi
push ebx
push ebx
push dword [0x41d538]
push dword [0x41d534]
push dword [0x41d52c]
push dword [0x41d530]
push 0xcf0000
push 0x4016f0
push 0x401b80
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x41d1dc], eax
mov dword [0x41e684], eax
test eax, eax
je 0x40a9c6
xor ecx, ecx
call fcn.004080f7
mov edx, 0x41cf98
mov ecx, 0x40a380
call fcn.00419f98
test eax, eax
jns 0x40a60c
mov dword [0x41cf98], ebx
mov dword [0x41cf9c], ebx
mov eax, 0x80000000
cmp dword [0x41d52c], eax
je 0x40a6d4
cmp dword [0x41d530], eax
je 0x40a6d4
push 0x2c
pop esi
push esi
lea eax, [ebp - 0x5e0]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x5e0], esi
lea eax, [ebp - 0x5e0]
push eax
push dword [0x41d1dc]
call dword [sym.imp.USER32.dll_GetWindowPlacement]
test eax, eax
je 0x40a6a5
push esi
push ebx
push 0x41de40
call sub.msvcrt.dll_memset
mov eax, dword [0x41d530]
add esp, 0xc
mov dword [0x41de5c], eax
sub eax, dword [ebp - 0x5c4]
add eax, dword [ebp - 0x5bc]
mov dword [0x41de64], eax
mov eax, dword [0x41d52c]
mov dword [0x41de60], eax
sub eax, dword [ebp - 0x5c0]
add eax, dword [ebp - 0x5b8]
mov dword [0x41de40], esi
mov dword [0x41de68], eax
mov edi, dword [0x41d1dc]
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
push 0x41de40
push edi
mov esi, eax
call dword [sym.imp.USER32.dll_SetWindowPlacement]
push esi
call dword [sym.imp.USER32.dll_SetThreadDpiAwarenessContext]
mov edi, dword [ebp - 0xbc8]
mov esi, dword [ebp - 0xba4]
xor eax, eax
inc eax
push eax
push dword [0x41d1dc]
call dword [sym.imp.SHELL32.dll_DragAcceptFiles]
lea eax, [ebp - 0x868]
push eax
push dword [0x41d1dc]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [0x41d1bc]
push ebx
push esi
push 0xf
push dword [0x41d1dc]
neg eax
mov esi, 0x4016f0
push dword [ebp - 0x85c]
sbb eax, eax
push dword [ebp - 0x860]
and eax, 0xfff00000
push ebx
push ebx
add eax, 0x50300104
push eax
push esi
push 0x401b20
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x40a9c6
mov ecx, eax
call fcn.0040a3de
xor eax, eax
inc eax
push eax
push eax
push 0xda
push dword [0x41d1d4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x41d1cc]
neg eax
push 0x401
push dword [0x41d1dc]
sbb eax, eax
and eax, 0x10000000
push esi
add eax, 0x44800000
push eax
call dword [sym.imp.COMCTL32.dll_CreateStatusWindowW]
mov dword [0x41d1d8], eax
test eax, eax
je 0x40a9c6
xor esi, esi
inc esi
mov ecx, esi
call fcn.004073b8
lea eax, [ebp - 0x4d8]
push eax
push dword [0x41d1d8]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x4d0]
sub eax, dword [ebp - 0x4d8]
or dword [ebp - 0xd68], 0xffffffff
imul eax, eax, 3
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [ebp - 0xd6c], eax
lea eax, [ebp - 0xd6c]
push eax
push 2
push 0x404
push dword [0x41d1d8]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push dword [0x41d1bc]
push 0xc8
push dword [0x41d1d4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [0x41d1bc], ebx
je 0x40a828
push dword [0x41d1dc]
call dword [sym.imp.USER32.dll_GetMenu]
push esi
push 0x1b
push 3
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0x2d0
push dword [0x41d1dc]
call dword [sym.imp.USER32.dll_GetDpiForWindow]
push eax
push dword [0x41c26c]
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
push 0x41dfe0
mov dword [0x41dfe0], eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push eax
push dword [ebp - 0xc6c]
mov dword [0x41dfdc], eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, eax
lea eax, [ebp - 0x50]
push eax
push 0x20
pop eax
push eax
push dword [ebp - 0xc6c]
call dword [sym.imp.GDI32.dll_GetTextFaceW]
push esi
mov esi, dword [ebp - 0xc6c]
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x41dffc
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40a8d5
push 0x41dfe0
push 0x40a330
push 0x41dffc
push esi
call dword [sym.imp.GDI32.dll_EnumFontsW]
push dword [0x41dfdc]
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0x41dfe0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [0x41dfdc], eax
jmp 0x40a8da
mov eax, dword [0x41dfdc]
push ebx
push eax
push 0x30
push dword [0x41d1d4]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
push ebx
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebx
push ebx
push 0xbd
push dword [0x41d1d4]
xor eax, eax
mov word [0x41e260], ax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x41c258]
mov dword [0x41dfc8], eax
call fcn.004074aa
push dword [ebp + 0xc]
push dword [0x41d1dc]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x41dfcc]
call dword [sym.imp.USER32.dll_SetCursor]
push 9
pop esi
push 0x20
pop ecx
movzx eax, word [edi]
cmp ax, cx
je 0x40a94b
cmp ax, si
jne 0x40a950
add edi, 2
jmp 0x40a93e
or dword [0x41d528], 0xffffffff
mov edx, edi
mov ecx, 0x401b90
call fcn.00409de3
test eax, eax
jne 0x40a96f
mov dword [0x41d528], ebx
jmp 0x40a991
mov edx, edi
mov ecx, 0x401b98
call fcn.00409de3
test eax, eax
jne 0x40a987
inc eax
mov dword [0x41d528], eax
jmp 0x40a98c
mov eax, dword [0x41d528]
cmp eax, 0xffffffff
je 0x40a9a9
push 0x20
add edi, 4
pop ecx
movzx eax, word [edi]
cmp ax, cx
je 0x40a9a4
cmp ax, si
jne 0x40a9a9
add edi, 2
jmp 0x40a997
call fcn.0040a347
test eax, eax
je 0x40a9fe
mov ecx, edi
call fcn.0040a05f
test eax, eax
je 0x40a9db
cmp eax, 2
jne 0x40aac3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041b4e0
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
mov ecx, edi
call fcn.0040a1a0
test eax, eax
je 0x40a9fe
push ebx
push ebx
push 0x10
push dword [0x41d1dc]
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
inc eax
jmp 0x40a9c8
cmp word [edi], bx
je 0x40aac3
mov esi, 0x41e040
mov edx, edi
push 0x104
mov ecx, esi
call fcn.00409e29
push ebx
mov edi, 0x80
push edi
push 3
push ebx
push 3
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x41e6dc], eax
cmp eax, 0xffffffff
jne 0x40aab6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x40aa89
mov edx, dword [0x41c244]
mov ecx, dword [0x41d1dc]
push 0x33
push esi
push dword [0x41c260]
call fcn.0040788e
cmp eax, 2
je 0x40a9c6
cmp eax, 6
jne 0x40aaad
push ebx
push edi
push 4
push ebx
push 3
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x41e6dc], eax
jmp 0x40aaad
mov ecx, esi
call fcn.0040947b
mov ecx, dword [0x41c258]
call fcn.004074aa
push dword [0x41c258]
mov edx, 0x104
mov ecx, esi
call fcn.00405313
cmp dword [0x41e6dc], 0xffffffff
je 0x40aac3
mov edx, dword [0x41d528]
mov ecx, esi
call fcn.00408b35
push ebx
push ebx
push dword [0x41c20c]
mov esi, 0x401af4
push ebx
push ebx
push dword [0x41c210]
push esi
push 0x50
push 0x41e4e0
call fcn.00408176
add esp, 0x24
push ebx
push ebx
push dword [0x41c20c]
push ebx
push ebx
push dword [0x41c210]
push esi
push 0x50
push 0x41e580
call fcn.00408176
add esp, 0x24
push 0x58
pop esi
push esi
push ebx
push 0x41e480
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xba4]
add esp, 0xc
mov edx, dword [0x41d1dc]
mov edi, 0x41e640
mov dword [0x41e488], eax
xor eax, eax
mov dword [0x41e480], esi
push 0xa
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xd28]
mov dword [0x41e484], edx
push eax
lea eax, [ebp - 0xd24]
mov dword [0x41e4a0], 0x104
push eax
push 0xb0
push dword [0x41d1d4]
mov dword [0x41e640], 0x28
mov dword [0x41e644], edx
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0xd28]
push dword [ebp - 0xd24]
push 0xb1
push dword [0x41d1d4]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push ebx
push 0xb7
push dword [0x41d1d4]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
and eax, 0x3ff
cmp ax, 0x11
jne 0x40abd4
xor eax, eax
inc eax
push eax
push eax
push 0xd8
push dword [0x41d1d4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0xce8], ebx
mov edx, 0x41d55c
mov dword [ebp - 0xca8], ebx
mov dword [ebp - 0xca4], ebx
mov dword [ebp - 0xbb4], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x40abf3
mov eax, dword [0x41d558]
mov dword [ebp - 0xc60], 0x40227a
mov dword [ebp - 0xc0c], 0x67
mov dword [ebp - 0xbc8], 0x337
mov dword [ebp - 0xc48], 0x10b
mov dword [ebp - 0xc18], 0x20b
push 0
pop ebx
test eax, eax
jne 0x40b285
push 0x338
mov edi, ebx
mov dword [ebp - 0xc10], ebx
push ebx
mov dword [ebp - 0xb90], edi
mov dword [ebp - 0xc08], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xbf4], eax
test eax, eax
je 0x40b21e
or dword [ebp - 0xba4], 0xffffffff
mov eax, 0x7f1137f
mov edx, eax
mov dword [ebp - 0x444], eax
movzx eax, ax
mov cl, bl
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xbf4]
mov dword [ebp - 0x448], 0xab69605e
movzx esi, word [ebp - 0x446]
shr edx, 0x10
add eax, 7
mov dword [ebp - 0xba8], esi
mov esi, 0x40227a
mov dword [ebp - 0xba0], ebx
mov dword [ebp - 0xc44], ebx
mov dword [ebp - 0xc74], edi
mov dword [ebp - 0xbbc], edx
mov dword [ebp - 0xbc0], eax
mov dword [ebp - 0xbec], 0x67
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edx, byte [esi + 2]
shl edx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edx, eax
mov dword [ebp - 0xbb0], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl edx, 8
or edx, eax
mov dword [ebp - 0xc6c], edi
movzx eax, byte [esi + 5]
mov edi, 0x7f1137f
mov ebx, dword [ebp - 0xc6c]
add esi, 8
shl edx, 8
or edx, eax
mov dword [ebp - 0xbe8], esi
xor edi, edx
mov esi, dword [ebp - 0xbdc]
xor edi, dword [ebp - 0xc44]
mov dword [ebp - 0xbe0], edx
xor edi, ebx
xor edi, 0xab69605e
mov eax, edi
rol eax, 0xa
lea edx, [edi + 0x54969fa2]
rol edx, 5
imul edx, esi
add edx, eax
xor ebx, edx
mov edx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea edx, [edx + ebx]
ror edx, 9
imul edx, dword [ebp - 0xba8]
sub edx, eax
xor edi, edx
mov eax, edi
sub eax, esi
imul edx, eax, 0x605e
mov eax, edi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xba8]
rol edx, 6
imul edx, dword [ebp - 0xbbc]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor edi, edx
mov edx, edi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, esi
xor eax, ebx
mov edx, ebx
imul eax, dword [ebp - 0xba8]
ror edx, 6
xor edx, eax
mov eax, 0x7f1137f
xor edi, edx
add eax, edi
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, edi
rol eax, 2
add edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 8
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
imul edx, dword [ebp - 0xbbc]
sub edx, eax
xor edi, edx
mov edx, edi
mov eax, edi
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, esi
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xbbc]
imul edx, dword [ebp - 0xba8]
shr eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xbbc]
xor ebx, eax
mov esi, ebx
sub esi, dword [ebp - 0xbbc]
xor esi, edi
xor esi, 0xab69605e
mov edx, esi
mov eax, esi
xor edx, dword [ebp - 0xbbc]
rol edx, 2
imul edx, dword [ebp - 0xbdc]
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, eax
mov eax, ebx
ror edx, 6
imul edx, dword [ebp - 0xba8]
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xbdc]
xor esi, edx
xor eax, esi
mov edx, esi
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
xor ebx, edx
mov edx, ebx
mov dword [ebp - 0xc6c], ebx
xor edx, dword [ebp - 0xba8]
mov eax, ebx
rol edx, 5
imul edx, dword [ebp - 0xbbc]
rol eax, 7
add edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov ebx, edx
xor ebx, esi
xor ebx, dword [ebp - 0xc6c]
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xba8]
imul eax, dword [ebp - 0xbdc]
xor esi, eax
mov eax, esi
sub eax, edx
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [ebp - 0xbbc]
add edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xbdc]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
shr eax, 3
xor edx, 0x605e
imul edx, dword [ebp - 0xba8]
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
xor eax, esi
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xba4]
rol eax, 2
mov dword [ebp - 0xc44], esi
mov esi, dword [ebp - 0xbe8]
xor edx, eax
xor edx, dword [ebp - 0xba0]
xor ebx, edx
mov edx, dword [ebp - 0xbc0]
mov dword [ebp - 0xc74], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xc44]
ror dword [ebp - 0xc74], 8
mov byte [edx], al
mov al, byte [ebp - 0xc74]
ror dword [ebp - 0xc44], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xc44]
ror dword [ebp - 0xc74], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xc74]
ror dword [ebp - 0xc44], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xc44]
ror dword [ebp - 0xc74], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xc74]
ror dword [ebp - 0xc44], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xc44]
mov byte [edx - 3], al
add edx, 8
mov edi, dword [ebp - 0xc74]
mov eax, dword [ebp - 0xbb0]
ror dword [ebp - 0xc44], 8
ror edi, 8
sub dword [ebp - 0xbec], 1
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xc74], edi
mov dword [ebp - 0xba4], eax
mov dword [ebp - 0xbc0], edx
jne 0x40ace6
mov esi, dword [ebp - 0xbf4]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x40b057
movzx eax, cl
cdq
cmp eax, dword [0x4025b0]
jne 0x40b08c
cmp edx, dword [0x4025b4]
jne 0x40b08c
mov edi, esi
mov dword [ebp - 0xb90], esi
mov esi, ebx
mov dword [ebp - 0xba0], 0x337
jmp 0x40b09f
or dword [ebp - 0xba0], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xc08], 0xc004d501
test esi, esi
je 0x40b0b2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xc08], ebx
jl 0x40b218
mov eax, dword [ebp - 0xba0]
mov esi, edi
push 0x40
push ebx
push 0x41d2d0
mov byte [eax + edi], bl
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], bl
je 0x40b225
mov edi, 0x41d2d0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xbb0], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40b0f3
sub ecx, dword [ebp - 0xbb0]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x40b211
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xba8], ecx
cmp word [eax], dx
je 0x40b13b
mov ecx, 0xc000007b
mov dword [ebp - 0xba8], ecx
jmp 0x40b183
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x40b12e
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x40b12e
cmp dword [edx], 0x4550
jne 0x40b12e
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc48]
je 0x40b171
cmp ax, word [ebp - 0xc18]
je 0x40b171
mov ecx, 0xc000000d
jmp 0x40b133
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xbe8], eax
mov dword [ebp - 0xba0], ebx
test eax, eax
je 0x40b1fe
mov edx, esi
mov dword [ebp - 0xbe0], esi
lea eax, [edx + 1]
mov dword [ebp - 0xbb0], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x40b1aa
sub edx, dword [ebp - 0xbb0]
inc esi
add esi, edx
test ecx, ecx
js 0x40b1e3
push dword [ebp - 0xbe0]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b209
mov ecx, dword [ebp - 0xc10]
mov dword [ecx*4 + 0x41c050], eax
mov ecx, dword [ebp - 0xba8]
mov eax, dword [ebp - 0xba0]
inc dword [ebp - 0xc10]
inc eax
mov dword [ebp - 0xba0], eax
cmp eax, dword [ebp - 0xbe8]
jb 0x40b199
add edi, 0x10
cmp byte [esi], bl
jne 0x40b0e6
mov esi, dword [ebp - 0xba8]
jmp 0x40b227
mov esi, 0xc000007a
jmp 0x40b227
mov edi, dword [ebp - 0xb90]
mov esi, 0xc000007a
jmp 0x40b22d
mov esi, ebx
mov edi, dword [ebp - 0xb90]
test edi, edi
je 0x40b240
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jns 0x40b280
mov esi, ebx
mov eax, dword [esi + 0x41d2d0]
test eax, eax
je 0x40b257
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x40b246
push 0x40
push ebx
push 0x41d2d0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x401010
mov edi, 0x41c050
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x40b28b
mov eax, dword [0x41d558]
inc eax
mov dword [0x41d558], eax
xor eax, eax
mov ecx, 0x41d55c
xchg dword [ecx], eax
mov eax, dword fs:[0x30]
mov edi, ebx
mov dword [ebp - 0xcbc], ebx
mov dword [ebp - 0xcb8], ebx
cmp dword [eax + 0x1d4], ebx
je 0x40b555
mov esi, dword [0x41c0d8]
mov ecx, esi
call dword [0x41f4a8]
call esi
mov ecx, eax
mov dword [ebp - 0xbb0], ecx
test ecx, ecx
jne 0x40b2f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x40b2e7
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x40b55d
mov edi, 0x80004005
jmp 0x40b55d
mov dword [ebp - 0xc8c], ebx
mov edi, ebx
mov eax, ebx
mov esi, ebx
lea edx, [ebp - 0xce4]
push edx
push eax
push esi
mov esi, dword [0x41c0e8]
push 2
push ecx
mov ecx, esi
call dword [0x41f4a8]
call esi
test eax, eax
jne 0x40b393
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40b37e
cmp dword [ebp - 0xc8c], 0
jne 0x40b377
push dword [ebp - 0xce4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xc8c]
mov esi, eax
call fcn.00418d24
test esi, esi
je 0x40b370
mov eax, dword [ebp - 0xce4]
mov ecx, dword [ebp - 0xbb0]
mov dword [ebp - 0xc8c], esi
jmp 0x40b303
mov edi, 0x8007000e
jmp 0x40b39f
mov edi, 0x80004005
jmp 0x40b3a5
test eax, eax
je 0x40b377
jg 0x40b388
mov edi, eax
jmp 0x40b3a5
movzx edi, ax
or edi, 0x80070000
jmp 0x40b3a5
mov eax, dword [ebp - 0xc8c]
mov dword [ebp - 0xcbc], eax
mov dword [ebp - 0xc8c], ebx
lea ecx, [ebp - 0xc8c]
call fcn.00418d24
test edi, edi
js 0x40b55d
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [0x41c0e4]
mov ecx, esi
push eax
call dword [0x41f4a8]
call esi
mov ecx, eax
mov dword [ebp - 0xbb0], ecx
test ecx, ecx
je 0x40b2d0
mov dword [ebp - 0xc88], ebx
mov edi, ebx
mov eax, ebx
mov esi, ebx
lea edx, [ebp - 0xce0]
push edx
push eax
push esi
mov esi, dword [0x41c0e8]
push 2
push ecx
mov ecx, esi
call dword [0x41f4a8]
call esi
test eax, eax
jne 0x40b47b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x40b466
cmp dword [ebp - 0xc88], 0
jne 0x40b45f
push dword [ebp - 0xce0]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xc88]
mov esi, eax
call fcn.00418d24
test esi, esi
je 0x40b458
mov eax, dword [ebp - 0xce0]
mov ecx, dword [ebp - 0xbb0]
mov dword [ebp - 0xc88], esi
jmp 0x40b3eb
mov edi, 0x8007000e
jmp 0x40b487
mov edi, 0x80004005
jmp 0x40b48d
test eax, eax
je 0x40b45f
jg 0x40b470
mov edi, eax
jmp 0x40b48d
movzx edi, ax
or edi, 0x80070000
jmp 0x40b48d
mov eax, dword [ebp - 0xc88]
mov dword [ebp - 0xcb8], eax
mov dword [ebp - 0xc88], ebx
lea ecx, [ebp - 0xc88]
call fcn.00418d24
test edi, edi
js 0x40b55d
mov eax, dword [ebp - 0xcbc]
test eax, eax
je 0x40b555
mov ecx, 0x401e60
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40b4dc
test dx, dx
je 0x40b4d5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40b4dc
add eax, 4
add ecx, 4
test dx, dx
jne 0x40b4b3
xor esi, esi
mov eax, ebx
inc esi
jmp 0x40b4e3
sbb eax, eax
xor esi, esi
inc esi
or eax, esi
test eax, eax
jne 0x40b555
mov eax, dword [ebp - 0xcb8]
test eax, eax
je 0x40b555
mov ecx, 0x401e70
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40b51c
test dx, dx
je 0x40b518
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40b51c
add eax, 4
add ecx, 4
test dx, dx
jne 0x40b4f6
mov eax, ebx
jmp 0x40b520
sbb eax, eax
or eax, esi
test eax, eax
jne 0x40b555
push 4
lea eax, [ebp - 0xcdc]
mov dword [ebp - 0xcdc], ebx
push eax
push 0xb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
je 0x40b2d0
test byte [ebp - 0xcdc], 0xf
mov eax, esi
je 0x40b557
mov eax, ebx
mov dword [ebp - 0xbb4], eax
lea ecx, [ebp - 0xcb8]
call fcn.00418d24
lea ecx, [ebp - 0xcbc]
call fcn.00418d24
test edi, edi
jns 0x40b57d
mov dword [ebp - 0xbb4], ebx
push 4
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea ecx, [ebp - 0xca4]
mov dword [ebp - 0xb94], esi
call fcn.00418d0d
test esi, esi
jne 0x40b65e
mov dword [ebp - 0xca4], ebx
mov dword [ebp - 0xb84], 0x8007000e
mov eax, dword [ebp - 0xc90]
mov dword [ebp - 0xca8], eax
xor ebx, ebx
mov edx, 0x41d55c
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x40b5c5
mov eax, dword [0x41d558]
push 0
pop ebx
test eax, eax
jle 0x40b622
sub eax, 1
mov dword [0x41d558], eax
jne 0x40b622
mov edi, ebx
mov eax, dword [edi + 0x41d2d0]
test eax, eax
je 0x40b5fb
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0x40b5ea
push 0x40
push ebx
push 0x41d2d0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x401010
mov edi, 0x41c050
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0x41d55c
xchg dword [ecx], eax
lea ecx, [ebp - 0xca4]
call fcn.00418d0d
mov eax, dword [ebp - 0xb84]
mov esi, 0xc004f012
lea edi, [esi + 0x15]
test eax, eax
jns 0x414f1a
cmp eax, 0xd0000034
jne 0x414eed
mov eax, esi
jmp 0x414f16
xor eax, eax
mov dword [ebp - 0xca4], esi
lea edi, [ebp - 0xc00]
mov dword [ebp - 0xbac], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xba4], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xc9c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xc6c], 0x38
mov dword [ebp - 0xbe0], esi
test esi, esi
jne 0x40b6c3
mov esi, 0xc0000017
mov edi, ebx
mov dword [ebp - 0xb84], esi
jmp 0x40b75f
push edi
push 0x41c750
push esi
call sub.msvcrt.dll_memcpy
mov edi, esi
add esp, 0xc
mov dword [ebp - 0xb88], edi
push 8
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xbe8], ecx
test ecx, ecx
jne 0x40b704
mov esi, 0xc0000017
mov dword [ebp - 0xb84], esi
jmp 0x40b75f
mov eax, dword [0x41c748]
mov dword [ecx], eax
mov eax, dword [0x41c74c]
mov dword [ecx + 4], eax
mov dword [ebp - 0xbac], ecx
rdtsc
mov dword [ebp - 0xc1c], eax
mov dword [ebp - 0xc04], edx
push 0xc
pop edi
lea eax, [ebp - 0xcc0]
mov edx, 0x7fffffff
push eax
mov ecx, 0x401e20
call fcn.00418d5b
test eax, eax
jns 0x40b869
mov dword [ebp - 0xcc0], ebx
mov esi, 0xc000003e
mov dword [ebp - 0xb84], esi
mov edi, dword [ebp - 0xb88]
cmp dword [ebp - 0xbf8], 0
mov dword [ebp - 0xbfc], ebx
mov dword [ebp - 0xc00], ebx
je 0x40b78e
push dword [ebp - 0xbf8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xbf8], ebx
mov eax, dword [ebp - 0xc94]
mov dword [ebp - 0xc98], ebx
mov dword [ebp - 0xc9c], ebx
test eax, eax
je 0x40b7b9
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xc94], ebx
test edi, edi
je 0x40b7cc
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xbac]
test eax, eax
je 0x40b7e5
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x40b5b2
mov eax, dword [ebp - 0xbb4]
test eax, eax
je 0x414ed6
mov dword [0x41d2c0], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x308]
mov dword [ebp - 0xd4c], ebx
push eax
push 0x400000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0x412da6
cmp eax, esi
jne 0x40b839
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x412da6
mov esi, dword [0x41c0cc]
mov ecx, esi
push 0x403
push ebx
push ebx
call dword [0x41f4a8]
call esi
mov dword [ebp - 0xba8], eax
test eax, eax
jne 0x40e368
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x412da6
mov eax, dword [ebp - 0xcc0]
inc eax
push 4
mov dword [ebp - 0xcc0], eax
pop edx
lea eax, [eax*2 + 4]
cmp eax, edx
jb 0x40b888
mov ecx, eax
jmp 0x40b88b
or ecx, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, edx
jb 0x40b759
mov edi, ecx
lea ecx, [edi + 0xc4]
mov edx, 0xc4
cmp ecx, edx
jb 0x40b8b8
mov eax, ecx
jmp 0x40b8bb
or eax, 0xffffffff
cmp ecx, edx
sbb esi, esi
and esi, 0xc0000095
add esi, 0x10000000
mov dword [ebp - 0xb84], esi
cmp ecx, edx
jb 0x40e345
lea edx, [eax + 8]
cmp edx, eax
jb 0x40b8e4
mov ecx, edx
jmp 0x40b8e7
or ecx, 0xffffffff
cmp edx, eax
mov edi, 0xc0000095
sbb esi, esi
and esi, edi
add esi, 0x10000000
mov dword [ebp - 0xb84], esi
cmp edx, eax
jb 0x40e345
lea eax, [ecx + 8]
cmp eax, ecx
jb 0x40b911
mov edx, eax
jmp 0x40b914
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, edi
add esi, 0x10000000
mov dword [ebp - 0xb84], esi
cmp eax, ecx
jb 0x40e345
push edx
push 8
mov dword [ebp - 0xbfc], edx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
jne 0x40b954
mov esi, 0xc0000017
jmp 0x40b753
mov dword [ebp - 0xbf8], edx
mov ecx, ebx
mov dword [ebp - 0xc00], ecx
mov dword [ebp - 0xdc8], ebx
lea eax, [edx + 4]
cmp eax, edx
jb 0x40b973
mov edi, eax
jmp 0x40b976
or edi, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, edx
jb 0x40b9b8
mov ecx, dword [ebp - 0xbfc]
lea eax, [edx + 8]
add ecx, edx
cmp eax, ecx
jbe 0x40b9a3
mov esi, 0xc0000023
jmp 0x40b753
mov dword [edx], 4
mov dword [edi], ebx
mov ecx, dword [ebp - 0xc00]
inc ecx
mov dword [ebp - 0xc00], ecx
test esi, esi
js 0x40b759
cmp dword [ebp - 0xbf8], 0
jne 0x40ba0a
mov edi, dword [ebp - 0xbfc]
lea eax, [edi + 0xa4]
cmp eax, edi
jb 0x40b9dd
mov edx, eax
jmp 0x40b9e0
or edx, 0xffffffff
cmp eax, edi
mov dword [ebp - 0xbfc], edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, edi
jb 0x40bafd
inc ecx
mov dword [ebp - 0xc00], ecx
jmp 0x40bb05
mov edx, dword [ebp - 0xbf8]
mov dword [ebp - 0xba0], ebx
test ecx, ecx
je 0x40ba97
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xbb0], edx
cmp eax, 4
jb 0x40ba2e
mov edi, eax
jmp 0x40ba31
or edi, 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, 4
jb 0x40ba4f
mov dword [ebp - 0xd20], edi
jmp 0x40ba55
mov edi, dword [ebp - 0xd20]
cmp eax, 4
jb 0x40baf7
lea eax, [edx + edi]
mov esi, edx
cmp eax, edx
jb 0x40ba6b
mov edx, eax
jmp 0x40ba6e
or edx, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, dword [ebp - 0xbb0]
jb 0x40baf7
mov esi, dword [ebp - 0xba0]
inc esi
mov dword [ebp - 0xba0], esi
cmp esi, ecx
jb 0x40ba1a
lea eax, [edx + 4]
cmp eax, edx
jb 0x40baa2
mov edi, eax
jmp 0x40baa5
or edi, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, edx
jb 0x40baf7
mov ecx, dword [ebp - 0xbfc]
lea eax, [edx + 0xa4]
add ecx, dword [ebp - 0xbf8]
cmp eax, ecx
ja 0x40b999
mov eax, 0xa0
push eax
push dword [ebp - 0xbe0]
mov dword [edx], eax
push edi
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xc00]
add esp, 0xc
inc ecx
mov dword [ebp - 0xc00], ecx
mov edx, dword [ebp - 0xbfc]
test esi, esi
js 0x40b759
cmp dword [ebp - 0xbf8], 0
jne 0x40bb5e
mov eax, edx
lea edx, [eax + 0xc]
mov edi, edx
cmp edx, eax
jae 0x40bb1c
or edx, 0xffffffff
cmp edi, eax
mov dword [ebp - 0xbfc], edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp edi, eax
jb 0x40bc76
mov edi, dword [ebp - 0xc1c]
inc ecx
mov dword [ebp - 0xd40], edi
mov edi, dword [ebp - 0xc04]
mov dword [ebp - 0xc00], ecx
mov dword [ebp - 0xd3c], edi
jmp 0x40bc9f
mov edi, dword [ebp - 0xbf8]
mov dword [ebp - 0xbc0], ebx
test ecx, ecx
je 0x40bc08
mov eax, dword [edi]
add eax, 4
mov dword [ebp - 0xbb0], edi
cmp eax, 4
jb 0x40bb8a
mov dword [ebp - 0xba0], eax
jmp 0x40bb91
or dword [ebp - 0xba0], 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, 4
jb 0x40bc76
mov ebx, dword [ebp - 0xba0]
mov dword [ebp - 0xd1c], ebx
xor ebx, ebx
cmp eax, 4
jb 0x40bc76
mov eax, dword [ebp - 0xd1c]
mov esi, edi
add eax, edi
cmp eax, edi
jb 0x40bbd4
mov edi, eax
jmp 0x40bbd7
or edi, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, dword [ebp - 0xbb0]
jb 0x40bc76
mov esi, dword [ebp - 0xbc0]
inc esi
mov dword [ebp - 0xbc0], esi
cmp esi, ecx
jb 0x40bb72
lea eax, [edi + 4]
cmp eax, edi
jb 0x40bc17
mov dword [ebp - 0xba0], eax
jmp 0x40bc20
or esi, 0xffffffff
mov dword [ebp - 0xba0], esi
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, edi
jb 0x40bc76
mov ecx, dword [ebp - 0xbf8]
lea eax, [edi + 0xc]
add ecx, edx
cmp eax, ecx
ja 0x40b999
mov edx, dword [ebp - 0xbe8]
mov ecx, dword [ebp - 0xba0]
mov dword [edi], 8
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 0xc00]
mov edx, dword [ebp - 0xbfc]
inc ecx
mov dword [ebp - 0xc00], ecx
test esi, esi
js 0x40b759
cmp dword [ebp - 0xbf8], 0
mov eax, dword [ebp - 0xc1c]
mov dword [ebp - 0xd40], eax
mov eax, dword [ebp - 0xc04]
mov dword [ebp - 0xd3c], eax
jne 0x40bcd9
lea eax, [edx + 0xc]
cmp eax, edx
jb 0x40bcae
mov dword [ebp - 0xbfc], eax
jmp 0x40bcb5
or dword [ebp - 0xbfc], 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, edx
jb 0x40bddf
inc ecx
mov dword [ebp - 0xc00], ecx
jmp 0x40bde7
mov edi, dword [ebp - 0xbf8]
mov dword [ebp - 0xbc0], ebx
test ecx, ecx
je 0x40bd7f
mov eax, dword [edi]
add eax, 4
mov dword [ebp - 0xbb0], edi
cmp eax, 4
jb 0x40bd05
mov dword [ebp - 0xba0], eax
jmp 0x40bd0c
or dword [ebp - 0xba0], 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, 4
jb 0x40bddf
mov ebx, dword [ebp - 0xba0]
mov dword [ebp - 0xd18], ebx
xor ebx, ebx
cmp eax, 4
jb 0x40bddf
mov eax, dword [ebp - 0xd18]
mov esi, edi
add eax, edi
cmp eax, edi
jb 0x40bd4f
mov edi, eax
jmp 0x40bd52
or edi, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, dword [ebp - 0xbb0]
jb 0x40bddf
mov esi, dword [ebp - 0xbc0]
inc esi
mov dword [ebp - 0xbc0], esi
cmp esi, ecx
jb 0x40bced
lea eax, [edi + 4]
cmp eax, edi
jb 0x40bd8e
mov dword [ebp - 0xba0], eax
jmp 0x40bd95
or dword [ebp - 0xba0], 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, edi
jb 0x40bddf
mov ecx, dword [ebp - 0xbf8]
lea eax, [edi + 0xc]
add ecx, edx
cmp eax, ecx
ja 0x40b999
mov eax, dword [ebp - 0xba0]
mov dword [edi], 8
mov edi, dword [ebp - 0xc1c]
mov dword [eax], edi
mov edi, dword [ebp - 0xc04]
mov dword [eax + 4], edi
inc dword [ebp - 0xc00]
test esi, esi
js 0x40b759
lea eax, [ebp - 0xccc]
mov edx, 0x7fffffff
push eax
mov ecx, 0x401e20
call fcn.00418d5b
test eax, eax
jns 0x40be0c
mov dword [ebp - 0xccc], ebx
jmp 0x40b74e
mov ecx, dword [ebp - 0xccc]
lea eax, [ecx + 1]
cmp eax, ecx
jb 0x40be23
mov edx, eax
mov dword [ebp - 0xbec], eax
jmp 0x40be2c
or edx, 0xffffffff
mov dword [ebp - 0xbec], edx
cmp eax, ecx
mov dword [ebp - 0xccc], edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, ecx
jb 0x40bff5
lea ecx, [edx + edx]
test ecx, ecx
je 0x40bfea
cmp dword [ebp - 0xbf8], 0
jne 0x40becf
lea eax, [ecx + 4]
push 4
pop ecx
cmp eax, ecx
jb 0x40be6c
mov edx, eax
jmp 0x40be6f
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, ecx
jae 0x40be8e
mov edx, dword [ebp - 0xd14]
jmp 0x40bff5
mov ecx, dword [ebp - 0xbfc]
lea eax, [ecx + edx]
cmp eax, ecx
jb 0x40bea3
mov dword [ebp - 0xbfc], eax
jmp 0x40beaa
or dword [ebp - 0xbfc], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, ecx
jb 0x40bff5
inc dword [ebp - 0xc00]
mov esi, ebx
jmp 0x40bfef
cmp dword [ebp - 0xc00], 0
mov edi, dword [ebp - 0xbf8]
mov dword [ebp - 0xbc0], ebx
jbe 0x40bf7d
mov eax, dword [ebp - 0xd14]
mov dword [ebp - 0xba0], eax
mov eax, dword [edi]
add eax, 4
mov dword [ebp - 0xbb0], edi
cmp eax, 4
jb 0x40bf08
mov edx, eax
jmp 0x40bf0b
or edx, 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, 4
jb 0x40bf29
mov dword [ebp - 0xba0], edx
jmp 0x40bf2f
mov edx, dword [ebp - 0xba0]
cmp eax, 4
jb 0x40bff5
lea eax, [edi + edx]
mov esi, edi
cmp eax, edi
jb 0x40bf45
mov edi, eax
jmp 0x40bf48
or edi, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, dword [ebp - 0xbb0]
jb 0x40bff5
mov edx, dword [ebp - 0xbc0]
inc edx
mov dword [ebp - 0xbc0], edx
cmp edx, dword [ebp - 0xc00]
jb 0x40bef4
lea eax, [edi + 4]
cmp eax, edi
jb 0x40bf8c
mov dword [ebp - 0xba0], eax
jmp 0x40bf93
or dword [ebp - 0xba0], 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, edi
jb 0x40bff5
mov eax, dword [ebp - 0xbf8]
lea edx, [ecx + 4]
add eax, dword [ebp - 0xbfc]
add edx, edi
cmp edx, eax
jbe 0x40bfc3
mov esi, 0xc0000023
jmp 0x40bfef
mov ecx, dword [ebp - 0xbec]
lea eax, [ecx + ecx]
push eax
push 0x401e20
push dword [ebp - 0xba0]
mov dword [edi], eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
inc dword [ebp - 0xc00]
jmp 0x40bff5
mov esi, 0xc000000d
mov dword [ebp - 0xb84], esi
test esi, esi
js 0x40b759
cmp dword [ebp - 0xbf8], 0
mov eax, dword [ebp - 0xbb4]
mov dword [ebp - 0xdcc], eax
jne 0x40c05b
mov ecx, dword [ebp - 0xbfc]
lea eax, [ecx + 8]
cmp eax, ecx
jb 0x40c027
mov dword [ebp - 0xbfc], eax
jmp 0x40c02e
or dword [ebp - 0xbfc], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, ecx
jb 0x40c12a
inc dword [ebp - 0xc00]
mov dword [ebp - 0xd0c], 4
jmp 0x40c145
cmp dword [ebp - 0xc00], 0
mov edi, ebx
mov edx, dword [ebp - 0xbf8]
jbe 0x40c0dd
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xbb0], edx
cmp eax, 4
jb 0x40c080
mov ecx, eax
jmp 0x40c083
or ecx, 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, 4
jb 0x40c0a1
mov dword [ebp - 0xd10], ecx
jmp 0x40c0a7
mov ecx, dword [ebp - 0xd10]
cmp eax, 4
jb 0x40c12a
lea eax, [edx + ecx]
mov esi, edx
cmp eax, edx
jb 0x40c0b9
mov edx, eax
jmp 0x40c0bc
or edx, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, dword [ebp - 0xbb0]
jb 0x40c12a
inc edi
cmp edi, dword [ebp - 0xc00]
jb 0x40c06c
lea eax, [edx + 4]
cmp eax, edx
jb 0x40c0e8
mov edi, eax
jmp 0x40c0eb
or edi, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, edx
jb 0x40c12a
mov ecx, dword [ebp - 0xbfc]
lea eax, [edx + 8]
add ecx, dword [ebp - 0xbf8]
cmp eax, ecx
ja 0x40b999
mov eax, dword [ebp - 0xbb4]
mov dword [edx], 4
mov dword [edi], eax
inc dword [ebp - 0xc00]
test esi, esi
js 0x40b759
cmp dword [ebp - 0xbf8], 0
mov dword [ebp - 0xd0c], 4
jne 0x40c184
mov ecx, dword [ebp - 0xbfc]
lea eax, [ecx + 8]
cmp eax, ecx
jb 0x40c15a
mov dword [ebp - 0xbfc], eax
jmp 0x40c161
or dword [ebp - 0xbfc], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, ecx
jb 0x40c24c
inc dword [ebp - 0xc00]
jmp 0x40c254
cmp dword [ebp - 0xc00], 0
mov edi, ebx
mov edx, dword [ebp - 0xbf8]
jbe 0x40c206
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xbb0], edx
cmp eax, 4
jb 0x40c1a9
mov ecx, eax
jmp 0x40c1ac
or ecx, 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, 4
jb 0x40c1ca
mov dword [ebp - 0xd08], ecx
jmp 0x40c1d0
mov ecx, dword [ebp - 0xd08]
cmp eax, 4
jb 0x40c24c
lea eax, [edx + ecx]
mov esi, edx
cmp eax, edx
jb 0x40c1e2
mov edx, eax
jmp 0x40c1e5
or edx, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, dword [ebp - 0xbb0]
jb 0x40c24c
inc edi
cmp edi, dword [ebp - 0xc00]
jb 0x40c195
lea eax, [edx + 4]
cmp eax, edx
jb 0x40c211
mov edi, eax
jmp 0x40c214
or edi, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, edx
jb 0x40c24c
mov ecx, dword [ebp - 0xbfc]
lea eax, [edx + 8]
add ecx, dword [ebp - 0xbf8]
cmp eax, ecx
ja 0x40b999
push 4
pop eax
mov dword [edx], eax
mov dword [edi], eax
inc dword [ebp - 0xc00]
test esi, esi
js 0x40b759
rdtsc
mov edi, ebx
mov dword [ebp - 0xbf0], ebx
mov dword [ebp - 0xbbc], edi
mov dword [ebp - 0xbd8], ebx
mov dword [ebp - 0xbec], ebx
mov dword [ebp - 0xbd0], ebx
mov dword [ebp - 0xbb8], ebx
mov dword [ebp - 0xbc4], ebx
mov dword [ebp - 0xbc0], ebx
mov dword [ebp - 0xb98], ebx
mov dword [ebp - 0xbf4], ebx
mov dword [ebp - 0xbb0], eax
mov dword [ebp - 0xbe0], edx
mov ecx, dword [ebp - 0xbfc]
add ecx, 8
cmp ecx, 8
jb 0x40c2b2
mov edx, ecx
jmp 0x40c2b5
or edx, 0xffffffff
cmp ecx, 8
sbb esi, esi
and esi, 0xc0000095
cmp ecx, 8
jb 0x40c3a9
lea eax, [edx + 7]
and eax, 0xfffffff8
mov dword [ebp - 0xba0], eax
cmp eax, edx
jae 0x40c2e3
mov esi, 0xc0000095
jmp 0x40c3a9
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x40c305
mov esi, 0xc0000017
mov edi, ebx
jmp 0x40c3a9
mov eax, dword [ebp - 0xc00]
mov dword [edi], eax
lea eax, [edi + 4]
cmp eax, edi
jb 0x40c318
mov ecx, eax
jmp 0x40c31b
or ecx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x40c390
mov eax, dword [ebp - 0xbfc]
mov dword [ecx], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x40c33c
mov edx, eax
jmp 0x40c33f
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x40c390
mov eax, dword [ebp - 0xba0]
mov ecx, dword [ebp - 0xbb0]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0xbe0]
mov dword [edi + eax - 4], ecx
push dword [ebp - 0xbfc]
push dword [ebp - 0xbf8]
push edx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xba0]
add esp, 0xc
mov dword [ebp - 0xbf0], edi
mov edi, ebx
mov dword [ebp - 0xbbc], eax
test edi, edi
je 0x40c3a3
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xbbc]
or esi, 0x10000000
mov dword [ebp - 0xb84], esi
jl 0x40dc72
cmp dword [ebp - 0xbf0], 0
mov dword [ebp - 0xc10], ebx
jne 0x40c3d4
mov esi, 0xc000000d
jmp 0x40ca49
test edi, edi
je 0x40ca44
lea esi, [edi + 8]
push esi
push ebx
mov dword [ebp - 0xbb0], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xb90], eax
test eax, eax
je 0x40ca44
mov cl, bl
mov edx, ebx
test edi, edi
je 0x40c418
mov eax, dword [ebp - 0xbf0]
xor cl, byte [edx + eax]
inc edx
cmp edx, edi
jb 0x40c410
mov eax, 0xc81ecb17
mov dword [ebp - 0x440], 0xb1b54a58
mov dword [ebp - 0x43c], eax
or eax, 0xffffffff
mov dword [ebp - 0xb84], eax
mov dword [ebp - 0xc4c], eax
mov eax, edi
shr eax, 3
mov dword [ebp - 0xc64], ebx
mov dword [ebp - 0xbd4], eax
test eax, eax
je 0x40c887
movzx edx, word [ebp - 0x43e]
mov eax, 0xc81ecb17
movzx esi, ax
shr eax, 0x10
mov dword [ebp - 0xba8], eax
mov eax, dword [ebp - 0xb90]
add eax, 7
mov dword [ebp - 0xb8c], edx
mov edx, dword [ebp - 0xb84]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xbf0]
add eax, 2
mov dword [ebp - 0xb9c], esi
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0xc08], ebx
mov dword [ebp - 0xc14], ebx
mov ebx, dword [ebp - 0xba0]
movzx edi, byte [ebx - 2]
movzx eax, byte [ebx - 1]
movzx esi, byte [ebx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [ebx]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 3]
or esi, eax
movzx eax, byte [ebx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [ebx + 5]
add ebx, 8
shl esi, 8
or esi, eax
mov dword [ebp - 0xba0], ebx
xor edx, esi
mov eax, 0xc81ecb17
mov dword [ebp - 0xb84], edx
lea ebx, [edx - 0x4a58]
xor ebx, edi
xor ebx, dword [ebp - 0xc64]
xor ebx, eax
mov edx, ebx
xor edx, eax
mov eax, ebx
ror edx, 0xf
imul edx, dword [ebp - 0xb8c]
ror eax, 7
add edx, eax
mov eax, dword [ebp - 0xb84]
xor eax, edx
mov dword [ebp - 0xb84], eax
lea edx, [eax - 0x4e4ab5a8]
ror eax, 0xa
ror edx, 9
imul edx, dword [ebp - 0xb9c]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xb9c]
rol eax, 5
rol edx, 4
imul edx, dword [ebp - 0xba8]
add edx, eax
mov eax, dword [ebp - 0xb84]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb84], eax
xor edx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, edx
xor ebx, eax
mov eax, ebx
shr eax, 6
lea edx, [ebx - 0x4a58]
imul edx, dword [ebp - 0xb8c]
sub edx, eax
xor dword [ebp - 0xb84], edx
mov edx, dword [ebp - 0xb84]
mov eax, edx
ror eax, 0xf
xor eax, dword [ebp - 0xb9c]
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, dword [ebp - 0xba8]
imul eax, dword [ebp - 0xb9c]
xor edx, eax
mov dword [ebp - 0xb84], edx
lea eax, [edx + 0x37e0ea91]
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0xba8]
imul eax, dword [ebp - 0xb8c]
ror edx, 0xa
xor edx, eax
mov eax, dword [ebp - 0xb84]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb84], eax
xor edx, 0x4a58
ror eax, 3
rol edx, 6
imul edx, dword [ebp - 0xb9c]
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb84]
mov eax, ebx
ror eax, 0xf
sub eax, dword [ebp - 0xba8]
imul eax, eax, 0x4a58
xor edx, eax
mov dword [ebp - 0xb84], edx
xor edx, dword [ebp - 0xba8]
mov eax, dword [ebp - 0xb84]
imul edx, edx, 0x4a58
shr eax, 1
xor edx, eax
mov eax, dword [ebp - 0xb84]
sub eax, dword [ebp - 0xb9c]
xor ebx, edx
rol eax, 3
imul edx, eax, 0x4a58
mov eax, dword [ebp - 0xb84]
shr eax, 0xf
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
sub edx, dword [ebp - 0xb9c]
imul edx, dword [ebp - 0xb8c]
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xb84]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0xb84], eax
ror edx, 9
imul edx, dword [ebp - 0xb9c]
ror eax, 0xb
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb84]
mov eax, ebx
sub eax, dword [ebp - 0xba8]
add eax, 0x4e4ab5a8
xor edx, eax
mov dword [ebp - 0xb84], edx
mov eax, dword [ebp - 0xb84]
xor eax, dword [ebp - 0xb8c]
ror edx, 7
imul eax, eax, 0x4a58
sub eax, edx
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xba8]
rol edx, 4
imul edx, dword [ebp - 0xb8c]
ror eax, 0x10
sub edx, eax
mov eax, dword [ebp - 0xb84]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0xb84], eax
ror edx, 0xa
imul edx, dword [ebp - 0xb9c]
ror eax, 4
add edx, eax
xor ebx, edx
mov eax, ebx
ror eax, 9
lea edx, [ebx + 0x4e4ab5a8]
ror edx, 4
imul edx, dword [ebp - 0xba8]
xor edx, eax
mov eax, dword [ebp - 0xb84]
xor eax, edx
mov dword [ebp - 0xb84], eax
xor eax, 0xc81ecb17
rol eax, 8
imul edx, eax, 0x4a58
mov eax, dword [ebp - 0xb84]
rol eax, 2
sub edx, eax
xor ebx, edx
mov edx, 0xc81ecb17
sub edx, ebx
mov eax, ebx
ror edx, 0xb
imul edx, dword [ebp - 0xb8c]
ror eax, 0xc
sub edx, eax
mov eax, dword [ebp - 0xb84]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb84], eax
xor edx, dword [ebp - 0xb8c]
imul edx, dword [ebp - 0xb9c]
shr eax, 8
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xc14]
xor edx, dword [ebp - 0xb84]
mov eax, ebx
xor ebx, dword [ebp - 0xc08]
xor edx, 0xc81ecb17
xor edx, eax
mov dword [ebp - 0xc64], ebx
mov eax, dword [ebp - 0xbdc]
xor edx, 0xb1b54a58
mov dword [ebp - 0xc4c], edx
mov dword [ebp - 0xc08], edi
mov dword [ebp - 0xc14], esi
mov byte [eax - 4], bl
mov al, byte [ebp - 0xc4c]
mov ebx, dword [ebp - 0xbdc]
ror dword [ebp - 0xc64], 8
mov byte [ebx], al
ror dword [ebp - 0xc4c], 8
mov al, byte [ebp - 0xc64]
mov byte [ebx - 5], al
mov al, byte [ebp - 0xc4c]
ror dword [ebp - 0xc64], 8
mov byte [ebx - 1], al
ror dword [ebp - 0xc4c], 8
mov al, byte [ebp - 0xc64]
mov byte [ebx - 6], al
mov al, byte [ebp - 0xc4c]
ror dword [ebp - 0xc64], 8
mov byte [ebx - 2], al
ror dword [ebp - 0xc4c], 8
mov al, byte [ebp - 0xc64]
mov byte [ebx - 7], al
mov al, byte [ebp - 0xc4c]
mov byte [ebx - 3], al
add ebx, 8
mov edx, dword [ebp - 0xc4c]
ror dword [ebp - 0xc64], 8
ror edx, 8
sub dword [ebp - 0xbd4], 1
mov dword [ebp - 0xc4c], edx
mov dword [ebp - 0xbdc], ebx
jne 0x40c4a9
mov edi, dword [ebp - 0xbbc]
xor ebx, ebx
mov esi, dword [ebp - 0xbb0]
movzx eax, cl
mov ecx, dword [ebp - 0xb90]
cdq
mov dword [ecx + edi], eax
mov dword [ecx + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x40c8b9
mov esi, 0xc0000017
jmp 0x40c9b3
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x40c8d6
mov esi, 0xc0000017
jmp 0x40c952
mov dword [edi + 4], eax
mov edx, dword [ebp - 0xb90]
push esi
push edx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
pop esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40c8cf
mov dword [edi + 0xc], eax
push 0xa0
push 0x41c6a0
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [edi + 0x10], esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x40c8cf
mov dword [edi + 0x14], ecx
mov eax, dword [0x41c740]
mov esi, ebx
mov dword [ecx], eax
mov eax, dword [0x41c744]
mov dword [ebp - 0xc10], edi
mov edi, ebx
mov dword [ecx + 4], eax
test edi, edi
je 0x40c9b3
cmp dword [edi + 4], 0
je 0x40c970
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x40c98a
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x40c9a4
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x40c9c7
mov eax, dword [ebp - 0xc10]
mov edi, ebx
mov dword [ebp - 0xbd8], eax
jmp 0x40c9cd
mov edi, dword [ebp - 0xc10]
push dword [ebp - 0xb90]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x40ca49
cmp dword [edi + 4], 0
je 0x40c9ff
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x40ca19
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x40ca33
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40ca49
mov esi, 0xc0000001
or esi, 0x10000000
mov dword [ebp - 0xb84], esi
jl 0x40dc72
mov ecx, dword [ebp - 0xbd8]
mov edi, dword [ecx + 8]
mov ecx, dword [ecx]
add ecx, 4
cmp ecx, 4
jb 0x40ca72
mov eax, ecx
jmp 0x40ca75
or eax, 0xffffffff
cmp ecx, 4
sbb esi, esi
and esi, 0xc0000095
cmp ecx, 4
jb 0x40cb02
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x40ca90
mov edx, ecx
jmp 0x40ca93
or edx, 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
cmp ecx, eax
jb 0x40cb02
lea eax, [edx + edi]
cmp eax, edx
jb 0x40caac
mov ecx, eax
jmp 0x40caaf
or ecx, 0xffffffff
cmp eax, edx
mov edi, 0xc0000095
sbb esi, esi
and esi, edi
cmp eax, edx
jb 0x40cb02
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x40cac9
mov eax, edx
jmp 0x40cacc
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, edi
cmp edx, ecx
jb 0x40cb02
mov edx, dword [ebp - 0xbd8]
mov ecx, dword [edx + 0x10]
add ecx, eax
cmp ecx, eax
jb 0x40caef
mov edx, ecx
mov dword [ebp - 0xbdc], ecx
jmp 0x40caf8
or edx, 0xffffffff
mov dword [ebp - 0xbdc], edx
cmp ecx, eax
sbb esi, esi
and esi, edi
cmp ecx, eax
jae 0x40cb0e
mov edx, dword [ebp - 0xdf4]
mov dword [ebp - 0xbdc], edx
test esi, esi
js 0x40cc9f
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x40cb36
mov esi, 0xc0000017
jmp 0x40cc9f
mov edx, dword [ebp - 0xbd8]
lea ecx, [edi + 4]
mov eax, dword [edx]
mov dword [edi], eax
cmp ecx, edi
jb 0x40cb51
mov eax, ecx
mov dword [ebp - 0xbd4], ecx
jmp 0x40cb5a
or eax, 0xffffffff
mov dword [ebp - 0xbd4], eax
cmp ecx, edi
sbb esi, esi
and esi, 0xc0000095
cmp ecx, edi
jb 0x40cc8c
push dword [edx]
push dword [edx + 4]
push eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0xbd8]
add esp, 0xc
mov ecx, dword [ebp - 0xbd4]
mov eax, dword [edx]
add eax, ecx
cmp eax, ecx
jb 0x40cb92
mov edx, eax
jmp 0x40cb95
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x40cc8c
mov eax, dword [ebp - 0xbd8]
lea ecx, [edx + 4]
mov eax, dword [eax + 8]
mov dword [edx], eax
cmp ecx, edx
jb 0x40cbc3
mov eax, ecx
mov dword [ebp - 0xbd4], ecx
jmp 0x40cbcc
or eax, 0xffffffff
mov dword [ebp - 0xbd4], eax
cmp ecx, edx
sbb esi, esi
and esi, 0xc0000095
cmp ecx, edx
jb 0x40cc8c
mov esi, dword [ebp - 0xbd8]
push dword [esi + 8]
push dword [esi + 0xc]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 8]
add esp, 0xc
mov edx, dword [ebp - 0xbd4]
add eax, edx
cmp eax, edx
jb 0x40cc06
mov ecx, eax
jmp 0x40cc09
or ecx, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x40cc8c
mov eax, dword [ebp - 0xbd8]
lea edx, [ecx + 4]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
cmp edx, ecx
jb 0x40cc33
mov eax, edx
mov dword [ebp - 0xbd4], edx
jmp 0x40cc3c
or eax, 0xffffffff
mov dword [ebp - 0xbd4], eax
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
cmp edx, ecx
jb 0x40cc8c
mov esi, dword [ebp - 0xbd8]
push dword [esi + 0x10]
push dword [esi + 0x14]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0x10]
add esp, 0xc
mov ecx, dword [ebp - 0xbd4]
add eax, ecx
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x40cc8c
mov eax, dword [ebp - 0xbdc]
mov dword [ebp - 0xbec], edi
mov edi, ebx
mov dword [ebp - 0xbd0], eax
test edi, edi
je 0x40cc9f
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
or esi, 0x10000000
mov dword [ebp - 0xb84], esi
jl 0x40dc72
mov dword [ebp - 0xbd4], ebx
cmp dword [ebp - 0xbf8], 0
jne 0x40ccf9
mov esi, 0xc000000d
mov dword [ebp - 0xb84], esi
mov eax, ebx
test esi, esi
js 0x40dc72
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x40ceb5
mov esi, 0xd0000017
jmp 0x40dc6c
xor eax, eax
inc eax
cmp dword [ebp - 0xc00], eax
jbe 0x40ccc0
mov ecx, dword [ebp - 0xbf8]
mov edi, ebx
mov eax, dword [ecx]
lea edx, [ecx + 4]
mov dword [ebp - 0xbb0], eax
cmp edx, ecx
jb 0x40cd1f
mov eax, edx
jmp 0x40cd22
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp edx, ecx
jb 0x40cd82
mov ecx, dword [ebp - 0xbb0]
add ecx, eax
mov edx, ecx
cmp ecx, eax
jae 0x40cd47
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp edx, eax
jb 0x40cd82
xor eax, eax
inc edi
inc eax
cmp edi, eax
jb 0x40cd0c
lea eax, [ecx + 4]
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, ecx
jb 0x40cd82
mov eax, dword [ecx]
mov dword [ebp - 0xbd4], eax
test esi, esi
js 0x40cccb
cmp dword [ebp - 0xc00], 2
jbe 0x40ccc0
mov ecx, dword [ebp - 0xbf8]
mov edi, ebx
mov eax, dword [ecx]
lea edx, [ecx + 4]
mov dword [ebp - 0xbb0], eax
cmp edx, ecx
jb 0x40cdb2
mov eax, edx
jmp 0x40cdb5
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp edx, ecx
jb 0x40ce0f
mov ecx, dword [ebp - 0xbb0]
add ecx, eax
mov edx, ecx
cmp ecx, eax
jae 0x40cdda
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp edx, eax
jb 0x40ce0f
inc edi
cmp edi, 2
jb 0x40cd9f
lea eax, [ecx + 4]
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, ecx
jb 0x40ce0f
mov edi, dword [ecx]
jmp 0x40ce11
mov edi, ebx
test esi, esi
js 0x40cccb
mov eax, dword [ebp - 0xbd4]
add eax, 0x50
cmp eax, 0x50
jb 0x40ce2b
mov ecx, eax
jmp 0x40ce2e
or ecx, 0xffffffff
cmp eax, 0x50
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp eax, 0x50
jb 0x40ce88
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x40ce4f
mov eax, edx
jmp 0x40ce52
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp edx, ecx
jb 0x40ce88
lea ecx, [eax + edi]
cmp ecx, eax
jb 0x40ce71
mov edx, ecx
jmp 0x40ce74
or edx, 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp ecx, eax
jae 0x40ce8e
mov edx, dword [ebp - 0xdd4]
test esi, esi
js 0x40cccb
cmp edx, 0x400000
jbe 0x40cea8
mov esi, 0x8000ffff
jmp 0x40dc6c
mov eax, edx
mov dword [ebp - 0xbc4], eax
jmp 0x40cccd
mov dword [ebp - 0xbb8], edi
mov eax, dword [ebp - 0xbec]
test eax, eax
jne 0x40cecf
mov esi, 0x80070057
jmp 0x40dc6c
mov ecx, dword [ebp - 0xbc4]
mov dword [ebp - 0xd80], eax
mov eax, dword [ebp - 0xbd0]
mov dword [ebp - 0xd78], eax
lea eax, [ebp - 0xd04]
push eax
xor eax, eax
mov dword [ebp - 0xd7c], edi
push 0x401c04
inc eax
mov dword [ebp - 0xd74], ecx
push eax
mov dword [ebp - 0xd70], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x40cf4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [ebp - 0xb84], esi
test esi, esi
jle 0x40cf36
movzx esi, si
or esi, 0x80070000
mov dword [ebp - 0xb84], esi
test esi, esi
mov eax, dword [ebp - 0xbc4]
js 0x40cf9f
mov esi, 0x80004005
mov dword [ebp - 0xb84], esi
jmp 0x40cf9f
push 0x404250
push dword [ebp - 0xd04]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40cf13
push ebx
push 0x14
lea eax, [ebp - 0xd80]
mov ecx, esi
push eax
push 0x86
call dword [0x41f4a8]
call esi
mov esi, eax
or esi, 0x10000000
mov dword [ebp - 0xb84], esi
jl 0x40cf99
mov eax, dword [ebp - 0xd74]
mov dword [ebp - 0xbc4], eax
jmp 0x40cf9f
mov eax, dword [ebp - 0xbc4]
cmp esi, 0xd0000023
jne 0x40cfb1
mov esi, 0x8007007a
jmp 0x40dc6c
test esi, esi
js 0x40dc72
mov dword [ebp - 0xc08], ebx
cmp eax, 4
jae 0x40cfce
mov esi, 0xc000003e
jmp 0x40d3ac
mov ecx, dword [edi]
lea eax, [edi + 4]
mov dword [ebp - 0xbdc], ecx
cmp eax, edi
jb 0x40cfe7
mov edx, eax
mov dword [ebp - 0xb90], eax
jmp 0x40cff0
or edx, 0xffffffff
mov dword [ebp - 0xb90], edx
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x40d3ac
mov eax, dword [ebp - 0xbc4]
add eax, 0xfffffffc
cmp eax, ecx
jb 0x40cfc4
lea eax, [ecx + edx]
cmp eax, edx
jb 0x40d01a
mov edx, eax
jmp 0x40d01d
or edx, 0xffffffff
cmp eax, dword [ebp - 0xb90]
sbb esi, esi
and esi, 0xc0000095
cmp eax, dword [ebp - 0xb90]
jb 0x40d3ac
lea eax, [ecx + 4]
cmp eax, 4
jb 0x40d043
mov ecx, eax
jmp 0x40d046
or ecx, 0xffffffff
cmp eax, 4
mov edi, 0xc0000095
sbb esi, esi
and esi, edi
cmp eax, 4
jb 0x40d3ac
mov eax, dword [ebp - 0xbc4]
sub eax, ecx
cmp eax, 4
jb 0x40cfc4
mov eax, dword [edx]
mov dword [ebp - 0xbd0], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x40d083
mov dword [ebp - 0xbbc], eax
jmp 0x40d08a
or dword [ebp - 0xbbc], 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, edi
cmp eax, edx
jb 0x40d3ac
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x40d0a3
mov edi, eax
jmp 0x40d0a6
or edi, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x40d3ac
mov eax, dword [ebp - 0xbc4]
mov edx, dword [ebp - 0xbd0]
sub eax, edi
cmp eax, edx
jb 0x40cfc4
mov esi, dword [ebp - 0xbbc]
lea eax, [esi + edx]
cmp eax, esi
jb 0x40d0df
mov ecx, eax
jmp 0x40d0e2
or ecx, 0xffffffff
cmp eax, esi
sbb esi, esi
and esi, 0xc0000095
cmp eax, dword [ebp - 0xbbc]
jb 0x40d3ac
lea eax, [edi + edx]
cmp eax, edi
jb 0x40d103
mov edx, eax
jmp 0x40d106
or edx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x40d3ac
mov eax, dword [ebp - 0xbc4]
sub eax, edx
cmp eax, 4
jb 0x40cfc4
mov edi, dword [ecx]
lea eax, [ecx + 4]
mov dword [ebp - 0xbb0], edi
cmp eax, ecx
jb 0x40d140
mov dword [ebp - 0xc10], eax
jmp 0x40d147
or dword [ebp - 0xc10], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x40d3ac
lea eax, [edx + 4]
cmp eax, edx
jb 0x40d164
mov ecx, eax
jmp 0x40d167
or ecx, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x40d3ac
mov eax, dword [ebp - 0xbc4]
sub eax, ecx
cmp eax, edi
jb 0x40cfc4
lea eax, [ecx + edi]
cmp eax, ecx
jb 0x40d194
mov edx, eax
jmp 0x40d197
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x40d3ac
mov eax, dword [ebp - 0xbc4]
sub eax, edx
jne 0x40cfc4
mov eax, dword [ebp - 0xbdc]
mov esi, dword [ebp - 0xbd0]
add eax, 0xc
add eax, esi
add eax, edi
cmp eax, dword [ebp - 0xbc4]
jne 0x40cfc4
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x40d1f7
mov esi, 0xc0000017
jmp 0x40d331
cmp dword [ebp - 0xb90], 0
je 0x40d241
mov eax, dword [ebp - 0xbdc]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x40d226
mov esi, 0xc0000017
jmp 0x40d2d0
mov dword [edi + 4], eax
mov ecx, dword [ebp - 0xbdc]
push ecx
push dword [ebp - 0xb90]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x40d246
mov dword [edi], ebx
mov dword [edi + 4], ebx
cmp dword [ebp - 0xbbc], 0
je 0x40d27b
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40d21c
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xbbc]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x40d281
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
cmp dword [ebp - 0xc10], 0
je 0x40d2c0
mov esi, dword [ebp - 0xbb0]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40d21c
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xc10]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x40d2c6
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [ebp - 0xc08], edi
mov esi, ebx
mov edi, ebx
test edi, edi
je 0x40d331
cmp dword [edi + 4], 0
je 0x40d2ee
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x40d308
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x40d322
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x40d345
mov eax, dword [ebp - 0xc08]
mov edi, ebx
mov dword [ebp - 0xbc0], eax
jmp 0x40d34b
mov edi, dword [ebp - 0xc08]
test edi, edi
je 0x40d3ac
cmp dword [edi + 4], 0
je 0x40d369
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x40d383
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x40d39d
or esi, 0x10000000
mov dword [ebp - 0xb84], esi
jl 0x40dc72
mov ecx, dword [ebp - 0xbc0]
mov edi, ebx
mov dword [ebp - 0xbe4], ebx
test ecx, ecx
jne 0x40d3da
mov esi, 0xd000000d
jmp 0x40dc6c
mov eax, dword [ecx + 4]
mov dword [ebp - 0xba0], eax
test eax, eax
je 0x40d3d0
mov esi, dword [ecx]
test esi, esi
je 0x40d3d0
add esi, 0xfffffff8
push esi
push ebx
mov dword [ebp - 0xb84], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc14], eax
test eax, eax
je 0x40da0c
mov ecx, 0x7f1137f
mov dword [ebp - 0xbdc], eax
mov edi, esi
mov dword [ebp - 0x42c], ecx
mov ecx, dword [ebp - 0xba0]
and edi, 7
mov dl, bl
mov dword [ebp - 0x430], 0xab69605e
mov dword [ebp - 0xc10], ecx
mov eax, ebx
mov dword [ebp - 0xbb0], edi
je 0x40d9ad
or dword [ebp - 0xc30], 0xffffffff
mov ecx, ebx
mov dword [ebp - 0xc38], ebx
mov dword [ebp - 0xbc4], ebx
mov dword [ebp - 0xb9c], eax
mov dword [ebp - 0xbd0], ecx
test edi, edi
je 0x40d4cd
mov eax, dword [ebp - 0xc10]
push 0x38
pop esi
lea ebx, [eax + 1]
movzx eax, byte [eax]
mov dword [ebp - 0xbd4], ebx
cmp ecx, 4
jge 0x40d49b
lea ecx, [esi - 0x20]
shl eax, cl
or dword [ebp - 0xb9c], eax
jmp 0x40d4a5
mov ecx, esi
shl eax, cl
or dword [ebp - 0xbc4], eax
mov ecx, dword [ebp - 0xbd0]
sub esi, 8
mov eax, dword [ebp - 0xbd4]
inc ecx
mov dword [ebp - 0xbd0], ecx
cmp ecx, edi
jl 0x40d47d
mov dword [ebp - 0xc10], eax
xor ebx, ebx
mov eax, dword [ebp - 0xb9c]
mov ecx, dword [ebp - 0xbc4]
xor eax, 0x92f65a5
xor ecx, 0x699a899c
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0xc38], eax
mov esi, ebx
mov dword [ebp - 0xb90], ecx
mov dword [ebp - 0xc30], ecx
test edi, edi
je 0x40d54b
mov ebx, dword [ebp - 0xbdc]
lea edi, [ebx + 1]
mov dword [ebp - 0xbd0], edi
cmp esi, 4
jge 0x40d517
rol eax, 8
mov byte [ebx], al
jmp 0x40d51c
rol ecx, 8
mov byte [ebx], cl
mov edi, dword [ebp - 0xbb0]
inc esi
mov ebx, dword [ebp - 0xbd0]
cmp esi, edi
jl 0x40d502
mov esi, dword [ebp - 0xc30]
mov eax, ebx
mov dword [ebp - 0xbdc], eax
xor ebx, ebx
mov eax, dword [ebp - 0xc38]
mov dword [ebp - 0xba8], eax
jmp 0x40d551
mov esi, dword [ebp - 0xb90]
add edi, 0xfffffffc
test edi, edi
jle 0x40d97b
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0xb90], esi
mov dword [ebp - 0xc30], esi
mov edi, dword [ebp - 0xba8]
mov esi, dword [ebp - 0xb84]
mov eax, esi
shr eax, 3
mov dword [ebp - 0xbd4], eax
test eax, eax
je 0x40d944
movzx esi, word [ebp - 0x42e]
mov eax, 0x7f1137f
mov ecx, eax
mov dword [ebp - 0xb8c], esi
mov esi, dword [ebp - 0xc10]
movzx eax, ax
mov dword [ebp - 0xc08], eax
mov eax, dword [ebp - 0xbdc]
shr ecx, 0x10
add eax, 7
mov dword [ebp - 0xbbc], ecx
add esi, 2
mov dword [ebp - 0xbd0], eax
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx ecx, byte [esi + 2]
shl ecx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or ecx, eax
mov dword [ebp - 0xbb0], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl ecx, 8
mov ebx, edi
or ecx, eax
mov dword [ebp - 0xba8], edi
movzx eax, byte [esi + 5]
add esi, 8
shl ecx, 8
or ecx, eax
mov dword [ebp - 0xbe8], esi
mov esi, dword [ebp - 0xc08]
mov eax, 0x7f1137f
xor edi, eax
mov dword [ebp - 0xbe0], ecx
xor edi, ecx
xor edi, dword [ebp - 0xb90]
xor edi, 0xab69605e
mov eax, edi
rol eax, 0xa
lea ecx, [edi + 0x54969fa2]
rol ecx, 5
imul ecx, esi
add ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea ecx, [ebx + ecx]
ror ecx, 9
imul ecx, dword [ebp - 0xb8c]
sub ecx, eax
xor edi, ecx
mov eax, edi
sub eax, esi
imul ecx, eax, 0x605e
mov eax, edi
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xb8c]
xor ecx, ebx
mov eax, ebx
rol ecx, 6
imul ecx, dword [ebp - 0xbbc]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor edi, ecx
mov ecx, edi
xor ecx, 0xab69605e
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, esi
ror ecx, 6
imul eax, dword [ebp - 0xb8c]
xor ecx, eax
mov eax, 0x7f1137f
xor edi, ecx
add eax, edi
ror eax, 0xf
imul ecx, eax, 0x605e
mov eax, edi
rol eax, 2
add ecx, eax
xor ebx, ecx
mov eax, ebx
rol eax, 8
lea ecx, [ebx + 0x54969fa2]
ror ecx, 0xe
imul ecx, dword [ebp - 0xbbc]
sub ecx, eax
xor edi, ecx
mov ecx, edi
mov eax, edi
xor ecx, 0xab69605e
ror eax, 0xa
ror ecx, 0xc
imul ecx, esi
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xbbc]
xor ecx, ebx
mov eax, ebx
imul ecx, dword [ebp - 0xb8c]
shr eax, 0xa
xor ecx, eax
xor edi, ecx
mov ecx, dword [ebp - 0xbbc]
mov eax, edi
not eax
ror eax, 5
add eax, 0x605e
imul eax, ecx
xor ebx, eax
mov esi, ebx
sub esi, ecx
xor esi, edi
xor esi, 0xab69605e
xor ecx, esi
mov eax, esi
rol ecx, 2
imul ecx, dword [ebp - 0xc08]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 6
imul ecx, dword [ebp - 0xb8c]
rol eax, 7
add ecx, eax
xor esi, ecx
mov eax, esi
mov ecx, esi
xor eax, dword [ebp - 0xc08]
imul eax, eax, 0x605e
ror ecx, 9
add ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xb8c]
xor ecx, ebx
mov dword [ebp - 0xba8], ebx
rol ecx, 5
mov eax, ebx
imul ecx, dword [ebp - 0xbbc]
rol eax, 7
add ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov ebx, ecx
xor ebx, esi
xor ebx, dword [ebp - 0xba8]
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xb8c]
imul eax, dword [ebp - 0xc08]
xor esi, eax
mov eax, esi
sub eax, ecx
ror eax, 1
imul ecx, eax, 0x605e
mov eax, esi
ror eax, 6
sub ecx, eax
xor ebx, ecx
mov eax, ebx
rol eax, 0xe
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul ecx, dword [ebp - 0xbbc]
add ecx, eax
xor esi, ecx
mov eax, esi
ror eax, 0xe
lea ecx, [esi - 0x54969fa2]
rol ecx, 0xf
imul ecx, dword [ebp - 0xc08]
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
shr eax, 3
xor ecx, 0x605e
imul ecx, dword [ebp - 0xb8c]
xor ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov eax, esi
xor eax, ecx
rol eax, 4
imul ecx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xbc4]
rol eax, 2
mov dword [ebp - 0xc30], esi
mov esi, dword [ebp - 0xbe8]
xor ecx, eax
xor ecx, dword [ebp - 0xb9c]
xor ebx, ecx
mov ecx, dword [ebp - 0xbd0]
mov dword [ebp - 0xc38], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xc30]
ror dword [ebp - 0xc38], 8
mov byte [ecx], al
mov al, byte [ebp - 0xc38]
ror dword [ebp - 0xc30], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xc30]
ror dword [ebp - 0xc38], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xc38]
ror dword [ebp - 0xc30], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xc30]
ror dword [ebp - 0xc38], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xc30], 8
mov al, byte [ebp - 0xc38]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xc30]
mov byte [ecx - 3], al
add ecx, 8
mov eax, dword [ebp - 0xc30]
mov edi, dword [ebp - 0xc38]
ror eax, 8
mov dword [ebp - 0xb90], eax
mov dword [ebp - 0xc30], eax
mov eax, dword [ebp - 0xbb0]
ror edi, 8
sub dword [ebp - 0xbd4], 1
mov dword [ebp - 0xb9c], eax
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xc38], edi
mov dword [ebp - 0xbc4], eax
mov dword [ebp - 0xbd0], ecx
jne 0x40d5d1
mov esi, dword [ebp - 0xb84]
xor ebx, ebx
mov ecx, dword [ebp - 0xc14]
mov eax, ebx
test esi, esi
je 0x40d958
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0x40d950
mov edi, dword [ebp - 0xba0]
movzx eax, dl
cdq
cmp eax, dword [esi + edi]
jne 0x40d9d3
cmp edx, dword [esi + edi + 4]
jne 0x40d9d3
mov edi, ecx
mov dword [ebp - 0xbe4], esi
mov ecx, ebx
mov esi, ebx
jmp 0x40d9da
mov ecx, ebx
mov dword [ebp - 0xb90], ecx
mov dword [ebp - 0xc30], ecx
test edi, edi
jns 0x40d574
neg edi
shl edi, 3
mov ecx, edi
shr eax, cl
shl eax, cl
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0xc38], eax
jmp 0x40d574
or dword [ebp - 0xbc4], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xb9c], ebx
mov dword [ebp - 0xb90], eax
mov dword [ebp - 0xc30], eax
mov dword [ebp - 0xc38], edi
jmp 0x40d580
mov esi, 0xc004d501
mov edi, ebx
test ecx, ecx
je 0x40d9ed
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x40da0c
mov eax, dword [ebp - 0xbe4]
mov esi, 0x10000000
mov dword [ebp - 0xb98], edi
mov edi, ebx
mov dword [ebp - 0xbf4], eax
jmp 0x40da11
mov esi, 0xd0000001
mov dword [ebp - 0xb84], esi
test edi, edi
je 0x40da2a
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x40dc72
mov edx, dword [ebp - 0xbf4]
cmp edx, 4
jb 0x40dc61
mov edi, dword [ebp - 0xb98]
mov eax, dword [edi]
mov dword [ebp - 0xbb0], eax
lea eax, [edi + 4]
cmp eax, edi
jb 0x40da5a
mov ecx, eax
jmp 0x40da5d
or ecx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x40dc66
lea eax, [edx - 4]
cmp eax, 4
jb 0x40dc61
mov eax, dword [ecx]
mov dword [ebp - 0xbdc], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x40da8e
mov edi, eax
jmp 0x40da91
or edi, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x40dc66
mov ecx, dword [ebp - 0xbdc]
lea eax, [edx - 8]
cmp eax, ecx
jb 0x40dc61
lea eax, [ecx + 8]
cmp eax, 8
sbb esi, esi
and esi, 0xc0000095
cmp eax, 8
jb 0x40dc66
mov eax, dword [ebp - 0xb98]
lea edx, [edi + ecx]
mov esi, dword [ebp - 0xbf4]
add eax, esi
cmp eax, edx
jb 0x40dc61
sub esi, edi
sub esi, ecx
add esi, dword [ebp - 0xb98]
cmp esi, 8
jae 0x40dc61
mov dword [ebp - 0xbf4], ebx
mov eax, ebx
mov dword [ebp - 0xbd4], eax
mov esi, ebx
test edi, edi
je 0x40dbf4
mov ecx, edi
cmp edx, edi
jb 0x40db1f
mov eax, edx
mov dword [ebp - 0xbd0], edx
jmp 0x40db28
or eax, 0xffffffff
mov dword [ebp - 0xbd0], eax
cmp edx, edi
sbb esi, esi
and esi, 0xc0000095
cmp edx, edi
jb 0x40dc4f
cmp edi, eax
jae 0x40dbe8
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x40db51
mov dword [ebp - 0xbe4], edx
jmp 0x40db58
or dword [ebp - 0xbe4], 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
cmp edx, ecx
jb 0x40dc4f
cmp dword [ebp - 0xbe4], eax
ja 0x40dc19
mov eax, dword [ecx]
add eax, 4
cmp eax, 4
jb 0x40db84
mov edx, eax
jmp 0x40db87
or edx, 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
cmp eax, 4
jb 0x40db9f
mov dword [ebp - 0xd34], edx
jmp 0x40dba5
mov edx, dword [ebp - 0xd34]
cmp eax, 4
jb 0x40dc4f
lea eax, [edx + ecx]
cmp eax, ecx
jb 0x40dbb9
mov edx, eax
jmp 0x40dbbc
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x40dc4f
mov eax, dword [ebp - 0xbd0]
cmp edx, eax
ja 0x40dc19
inc dword [ebp - 0xbf4]
mov ecx, edx
cmp edx, eax
jb 0x40db42
cmp ecx, eax
jne 0x40dc19
mov ecx, dword [ebp - 0xbdc]
mov eax, ebx
test ecx, ecx
je 0x40dc28
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xbd4], eax
test eax, eax
jne 0x40dc20
mov esi, 0xc0000017
jmp 0x40dc4f
mov esi, 0xc000000d
jmp 0x40dc66
mov ecx, dword [ebp - 0xbdc]
mov esi, ebx
test edi, edi
je 0x40dc3d
push ecx
push edi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xbd4]
add esp, 0xc
mov dword [ebp - 0xc94], eax
mov eax, dword [ebp - 0xbf4]
mov dword [ebp - 0xc9c], eax
test esi, esi
js 0x40dc66
mov eax, dword [ebp - 0xbb0]
cmp eax, dword [ebp - 0xc9c]
je 0x40dc66
mov esi, 0xc000003e
or esi, 0x10000000
mov dword [ebp - 0xb84], esi
mov eax, dword [ebp - 0xbf0]
test eax, eax
je 0x40dc8b
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xbd8]
test edi, edi
je 0x40dcf2
cmp dword [edi + 4], 0
je 0x40dcaf
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x40dcc9
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x40dce3
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xbec]
test eax, eax
je 0x40dd0b
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xbb8]
test eax, eax
je 0x40dd24
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xbc0]
test edi, edi
je 0x40dd8b
cmp dword [edi + 4], 0
je 0x40dd48
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x40dd62
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x40dd7c
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xb98]
test eax, eax
je 0x40dda4
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x40b759
xor eax, eax
inc eax
cmp dword [ebp - 0xc9c], eax
jae 0x40ddc1
mov esi, 0xc004d501
jmp 0x40b753
cmp dword [ebp - 0xc94], 0
jne 0x40de46
mov esi, 0xc000000d
mov dword [ebp - 0xb84], esi
mov eax, ebx
test esi, esi
js 0x40b759
cmp eax, 0xd0000023
jne 0x40ddf1
mov eax, 0x8007007a
mov dword [ebp - 0xba4], eax
cmp eax, 0x8007007a
je 0x40de08
mov esi, eax
mov dword [ebp - 0xb84], esi
test eax, eax
js 0x40b759
cmp dword [ebp - 0xc9c], 6
jne 0x40ddb7
cmp dword [ebp - 0xc94], 0
jne 0x40deb9
mov edx, dword [ebp - 0xd44]
mov esi, 0xc000000d
mov ecx, dword [ebp - 0xd48]
mov dword [ebp - 0xb84], esi
mov dword [ebp - 0xbec], edx
mov dword [ebp - 0xbc0], ecx
jmp 0x40df8a
cmp dword [ebp - 0xc9c], 0
jbe 0x40ddca
mov eax, dword [ebp - 0xc94]
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x40de66
mov edi, ecx
jmp 0x40de69
or edi, 0xffffffff
cmp ecx, dword [ebp - 0xc94]
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp ecx, dword [ebp - 0xc94]
jb 0x40de8f
mov eax, edx
neg eax
sbb eax, eax
and eax, edi
jmp 0x40de9b
mov edx, dword [ebp - 0xdd8]
mov eax, dword [ebp - 0xddc]
test esi, esi
js 0x40ddd5
cmp edx, 4
jne 0x40b999
mov eax, dword [eax]
mov dword [ebp - 0xba4], eax
jmp 0x40ddd7
mov eax, dword [ebp - 0xc94]
mov edi, ebx
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [ebp - 0xbb0], ecx
cmp edx, eax
jb 0x40ded4
mov ecx, edx
jmp 0x40ded7
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp edx, eax
jb 0x40df46
mov eax, dword [ebp - 0xbb0]
add eax, ecx
mov edx, eax
cmp eax, ecx
jae 0x40defc
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp edx, ecx
jb 0x40df46
xor ecx, ecx
inc edi
inc ecx
cmp edi, ecx
jb 0x40dec1
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x40df25
mov edi, ecx
jmp 0x40df28
or edi, 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp ecx, eax
jb 0x40df46
mov eax, edx
neg eax
sbb eax, eax
and eax, edi
jmp 0x40df52
mov edx, dword [ebp - 0xde0]
mov eax, dword [ebp - 0xde4]
test esi, esi
js 0x40df72
cmp edx, 8
jne 0x40b999
mov ecx, dword [eax]
mov dword [ebp - 0xbc0], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xbec], ecx
jmp 0x40df8a
mov eax, dword [ebp - 0xd44]
mov dword [ebp - 0xbec], eax
mov eax, dword [ebp - 0xd48]
mov dword [ebp - 0xbc0], eax
test esi, esi
js 0x40b759
cmp dword [ebp - 0xc94], 0
jne 0x40dfd1
mov esi, 0xc000000d
mov dword [ebp - 0xb84], esi
mov eax, dword [ebp - 0xd00]
mov dword [ebp - 0xb98], eax
test esi, esi
js 0x40b759
cmp dword [ebp - 0xc94], 0
jne 0x40e080
mov esi, 0xc000000d
jmp 0x40b753
mov eax, dword [ebp - 0xc94]
mov edi, ebx
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [ebp - 0xbb0], ecx
cmp edx, eax
jb 0x40dfec
mov ecx, edx
jmp 0x40dfef
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp edx, eax
jb 0x40e05c
mov eax, dword [ebp - 0xbb0]
add eax, ecx
mov edx, eax
cmp eax, ecx
jae 0x40e014
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp edx, ecx
jb 0x40e05c
inc edi
cmp edi, 2
jb 0x40dfd9
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x40e03b
mov edi, ecx
jmp 0x40e03e
or edi, 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp ecx, eax
jb 0x40e05c
mov eax, edx
neg eax
sbb eax, eax
and eax, edi
jmp 0x40e068
mov edx, dword [ebp - 0xde8]
mov eax, dword [ebp - 0xdec]
test esi, esi
js 0x40dfa6
cmp edx, 4
jne 0x40b999
mov eax, dword [eax]
jmp 0x40dfac
mov eax, dword [ebp - 0xc94]
mov edi, ebx
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [ebp - 0xbb0], ecx
cmp edx, eax
jb 0x40e09b
mov ecx, edx
jmp 0x40e09e
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp edx, eax
jb 0x40e10f
mov eax, dword [ebp - 0xbb0]
add eax, ecx
mov edx, eax
cmp eax, ecx
jae 0x40e0c3
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp edx, ecx
jb 0x40e10f
inc edi
cmp edi, 3
jb 0x40e088
mov edi, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xbd0], edi
cmp ecx, eax
jb 0x40e0f0
mov edx, ecx
jmp 0x40e0f3
or edx, 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp ecx, eax
jb 0x40e10f
neg edi
sbb edi, edi
and edi, edx
jmp 0x40e121
mov eax, dword [ebp - 0xdf0]
mov edi, dword [ebp - 0xdd0]
mov dword [ebp - 0xbd0], eax
test esi, esi
js 0x40b759
mov eax, dword [ebp - 0xc94]
mov dword [ebp - 0xbb8], ebx
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [ebp - 0xbb0], ecx
cmp edx, eax
jb 0x40e148
mov ecx, edx
jmp 0x40e14b
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp edx, eax
jb 0x40e1d0
mov eax, dword [ebp - 0xbb0]
add eax, ecx
mov edx, eax
cmp eax, ecx
jae 0x40e170
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp edx, ecx
jb 0x40e1d0
mov ecx, dword [ebp - 0xbb8]
inc ecx
mov dword [ebp - 0xbb8], ecx
cmp ecx, 4
jb 0x40e135
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x40e1a7
mov dword [ebp - 0xbb8], ecx
jmp 0x40e1ae
or dword [ebp - 0xbb8], 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp ecx, eax
jb 0x40e1d0
mov eax, edx
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbb8]
jmp 0x40e1dc
mov edx, dword [ebp - 0xda8]
mov eax, dword [ebp - 0xda4]
test esi, esi
js 0x40e1ed
cmp edx, 4
jne 0x40b999
mov eax, dword [eax]
jmp 0x40e1f3
mov eax, dword [ebp - 0xdc4]
mov dword [ebp - 0xbe4], eax
test esi, esi
js 0x40b759
mov eax, dword [ebp - 0xc94]
mov dword [ebp - 0xbb8], ebx
mov ecx, dword [eax]
lea edx, [eax + 4]
mov dword [ebp - 0xbb0], ecx
cmp edx, eax
jb 0x40e220
mov ecx, edx
jmp 0x40e223
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp edx, eax
jb 0x40e2a8
mov eax, dword [ebp - 0xbb0]
add eax, ecx
mov edx, eax
cmp eax, ecx
jae 0x40e248
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp edx, ecx
jb 0x40e2a8
mov ecx, dword [ebp - 0xbb8]
inc ecx
mov dword [ebp - 0xbb8], ecx
cmp ecx, 5
jb 0x40e20d
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x40e27f
mov dword [ebp - 0xbb8], ecx
jmp 0x40e286
or dword [ebp - 0xbb8], 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
mov dword [ebp - 0xb84], esi
cmp ecx, eax
jb 0x40e2a8
mov eax, edx
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbb8]
jmp 0x40e2b4
mov edx, dword [ebp - 0xdc0]
mov eax, dword [ebp - 0xdbc]
test esi, esi
js 0x40e2c5
cmp edx, 4
jne 0x40b999
mov ecx, dword [eax]
jmp 0x40e2c7
mov ecx, ebx
test esi, esi
js 0x40b759
mov eax, dword [ebp - 0xc1c]
cmp eax, dword [ebp - 0xbc0]
jne 0x40ddb7
mov eax, dword [ebp - 0xc04]
cmp eax, dword [ebp - 0xbec]
jne 0x40ddb7
cmp dword [ebp - 0xbe4], 4
mov dword [ebp - 0xbb4], ecx
jbe 0x40e31e
mov eax, dword [ebp - 0xb98]
mov esi, 0x8007007a
mov dword [ebp - 0xb84], esi
mov dword [ebp - 0xca8], eax
jmp 0x40b759
mov eax, dword [ebp - 0xbd0]
cmp eax, 4
ja 0x40e302
push eax
push edi
push dword [ebp - 0xb94]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xb98]
add esp, 0xc
mov dword [ebp - 0xca8], eax
test esi, esi
js 0x40b759
mov eax, dword [ebp - 0xba4]
mov edi, dword [ebp - 0xb88]
test eax, eax
je 0x40b75f
mov esi, eax
jmp 0x40b6fc
mov esi, dword [0x41c09c]
mov ecx, esi
call dword [0x41f4a8]
call esi
mov dword [0x41d2a8], eax
mov eax, dword [0x41d2c0]
push 0x54
mov dword [ebp - 0xbec], eax
lea eax, [ebp - 0x858]
push ebx
push eax
mov dword [0x41d2ac], edx
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0xd60], ebx
lea edi, [ebp - 0x3a0]
mov dword [ebp - 0xd5c], ebx
stosd dword es:[edi], eax
add esp, 0xc
mov dword [ebp - 0xbb0], ebx
stosd dword es:[edi], eax
push 0x2c
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x530]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xba0], ebx
xor ebx, ebx
mov edx, 0x41d55c
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x40e3dd
mov eax, dword [0x41d558]
push 0
pop ebx
test eax, eax
jne 0x40ea46
push 0x338
push ebx
mov dword [ebp - 0xbc0], ebx
mov dword [ebp - 0xbc4], ebx
mov dword [ebp - 0xbd4], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xbe8], edi
test edi, edi
je 0x40e9e5
or dword [ebp - 0xbb8], 0xffffffff
mov eax, 0x7f1137f
mov dword [ebp - 0x434], eax
mov cl, bl
mov eax, ebx
mov dword [ebp - 0x438], 0xab69605e
movzx esi, word [ebp - 0x436]
mov dword [ebp - 0xba4], eax
mov dword [ebp - 0xc5c], eax
mov eax, 0x7f1137f
mov edx, eax
mov dword [ebp - 0xb9c], esi
shr edx, 0x10
mov esi, ebx
add edi, 7
movzx eax, ax
mov dword [ebp - 0xbe4], edi
mov edi, 0x40227a
mov dword [ebp - 0xbac], ebx
mov dword [ebp - 0xc78], ebx
mov dword [ebp - 0xb8c], eax
mov dword [ebp - 0xb90], edx
mov dword [ebp - 0xbb4], edi
mov dword [ebp - 0xbd0], 0x67
movzx edx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl edx, 8
or edx, eax
movzx eax, byte [edi]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl edx, 8
or edx, eax
shl edi, 8
mov eax, dword [ebp - 0xbb4]
xor ebx, edx
mov dword [ebp - 0xbe0], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xbb4]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xbb4]
shl edi, 8
add dword [ebp - 0xbb4], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
mov dword [ebp - 0xba4], esi
mov esi, 0x7f1137f
xor esi, dword [ebp - 0xba4]
xor esi, ebx
xor esi, 0xab69605e
mov eax, esi
rol eax, 0xa
lea edx, [esi + 0x54969fa2]
rol edx, 5
imul edx, dword [ebp - 0xb8c]
add edx, eax
xor ebx, edx
mov edx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea edx, [ebx + edx]
ror edx, 9
imul edx, dword [ebp - 0xb9c]
sub edx, eax
xor esi, edx
mov eax, esi
sub eax, dword [ebp - 0xb8c]
imul edx, eax, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb9c]
xor edx, ebx
mov eax, ebx
rol edx, 6
imul edx, dword [ebp - 0xb90]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0xb8c]
imul eax, dword [ebp - 0xb9c]
ror edx, 6
xor edx, eax
mov eax, 0x7f1137f
xor esi, edx
add eax, esi
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 8
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
imul edx, dword [ebp - 0xb90]
sub edx, eax
xor esi, edx
mov edx, esi
mov eax, esi
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, dword [ebp - 0xb8c]
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb90]
xor edx, ebx
mov eax, ebx
imul edx, dword [ebp - 0xb9c]
shr eax, 0xa
xor edx, eax
xor edx, esi
mov eax, edx
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xb90]
xor ebx, eax
mov esi, ebx
sub esi, dword [ebp - 0xb90]
xor esi, edx
mov edx, dword [ebp - 0xb90]
xor esi, 0xab69605e
xor edx, esi
mov eax, esi
rol edx, 2
imul edx, dword [ebp - 0xb8c]
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, eax
mov eax, ebx
ror edx, 6
imul edx, dword [ebp - 0xb9c]
rol eax, 7
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, dword [ebp - 0xb8c]
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb9c]
xor edx, ebx
mov dword [ebp - 0xb94], ebx
rol edx, 5
mov eax, ebx
imul edx, dword [ebp - 0xb90]
rol eax, 7
add edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov ebx, esi
xor ebx, dword [ebp - 0xb94]
xor ebx, edx
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xb9c]
imul eax, dword [ebp - 0xb8c]
xor esi, eax
mov eax, esi
sub eax, edx
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [ebp - 0xb90]
add edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xb8c]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, 0x605e
shr eax, 3
imul edx, dword [ebp - 0xb9c]
xor edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov eax, esi
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xbb8]
rol eax, 2
mov dword [ebp - 0xc5c], esi
mov dword [ebp - 0xbb8], edi
xor edx, eax
mov edi, dword [ebp - 0xbb4]
xor edx, dword [ebp - 0xbac]
xor ebx, edx
mov edx, dword [ebp - 0xbe4]
mov dword [ebp - 0xc78], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xc5c]
ror dword [ebp - 0xc78], 8
mov byte [edx], al
mov al, byte [ebp - 0xc78]
ror dword [ebp - 0xc5c], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xc5c]
ror dword [ebp - 0xc78], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xc78]
ror dword [ebp - 0xc5c], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xc5c]
ror dword [ebp - 0xc78], 8
mov byte [edx - 2], al
ror dword [ebp - 0xc5c], 8
mov al, byte [ebp - 0xc78]
mov byte [edx - 7], al
mov al, byte [ebp - 0xc5c]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [ebp - 0xc78]
mov esi, dword [ebp - 0xc5c]
mov eax, dword [ebp - 0xbe0]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xbd0], 1
mov dword [ebp - 0xc78], ebx
mov dword [ebp - 0xc5c], esi
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0xbe4], edx
jne 0x40e4ad
mov esi, dword [ebp - 0xbe8]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x40e830
movzx eax, cl
cdq
cmp eax, dword [0x4025b0]
jne 0x40e85e
cmp edx, dword [0x4025b4]
jne 0x40e85e
mov dword [ebp - 0xbc4], esi
mov edi, 0x337
mov esi, ebx
jmp 0x40e86b
mov dword [ebp - 0xbd4], 0xc004d501
or edi, 0xffffffff
test esi, esi
je 0x40e87e
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xbd4], ebx
jl 0x40e9e5
mov eax, dword [ebp - 0xbc4]
mov esi, eax
push 0x40
push ebx
push 0x41d2d0
mov byte [edi + eax], bl
call sub.msvcrt.dll_memset
mov eax, esi
add esp, 0xc
cmp byte [eax], bl
je 0x40e9ec
mov edi, 0x41d2d0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xb94], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40e8c1
sub ecx, dword [ebp - 0xb94]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x40e9e5
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xb8c], ecx
cmp word [eax], dx
je 0x40e909
mov ecx, 0xc000007b
mov dword [ebp - 0xb8c], ecx
jmp 0x40e951
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x40e8fc
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x40e8fc
cmp dword [edx], 0x4550
jne 0x40e8fc
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc48]
je 0x40e93f
cmp ax, word [ebp - 0xc18]
je 0x40e93f
mov ecx, 0xc000000d
jmp 0x40e901
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xbe8], eax
mov dword [ebp - 0xbac], ebx
test eax, eax
je 0x40e9cc
mov edx, esi
mov dword [ebp - 0xbe0], esi
lea eax, [edx + 1]
mov dword [ebp - 0xb94], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x40e978
sub edx, dword [ebp - 0xb94]
inc esi
add esi, edx
test ecx, ecx
js 0x40e9b1
push dword [ebp - 0xbe0]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40e9d7
mov ecx, dword [ebp - 0xbc0]
mov dword [ecx*4 + 0x41c050], eax
mov ecx, dword [ebp - 0xb8c]
mov eax, dword [ebp - 0xbac]
inc dword [ebp - 0xbc0]
inc eax
mov dword [ebp - 0xbac], eax
cmp eax, dword [ebp - 0xbe8]
jb 0x40e967
add edi, 0x10
cmp byte [esi], bl
jne 0x40e8b4
mov esi, dword [ebp - 0xb8c]
mov eax, dword [ebp - 0xbc4]
jmp 0x40e9ee
mov esi, 0xc000007a
jmp 0x40e9dd
mov esi, ebx
test eax, eax
je 0x40ea01
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jns 0x40ea41
mov esi, ebx
mov eax, dword [esi + 0x41d2d0]
test eax, eax
je 0x40ea18
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x40ea07
push 0x40
push ebx
push 0x41d2d0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x401010
mov edi, 0x41c050
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x40ea4c
mov eax, dword [0x41d558]
inc eax
mov dword [0x41d558], eax
xor eax, eax
mov edx, 0x41d55c
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0xc], ebx
lea edi, [ebp - 0xcf4]
mov word [ebp - 8], bx
stosd dword es:[edi], eax
mov dword [ebp - 0xc04], ebx
mov dword [ebp - 0xc1c], ebx
mov dword [ebp - 0xcc4], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x410]
xor ebx, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x40ea87
mov eax, dword [0x41d558]
push 0
pop ebx
test eax, eax
jne 0x40f0c6
push 0x338
push ebx
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xb90], ebx
mov dword [ebp - 0xc14], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xbc0], edi
test edi, edi
je 0x40f065
or dword [ebp - 0xbe4], 0xffffffff
mov eax, 0x7f1137f
mov dword [ebp - 0x44c], eax
mov cl, bl
mov eax, ebx
mov dword [ebp - 0x450], 0xab69605e
movzx esi, word [ebp - 0x44e]
mov dword [ebp - 0xb98], eax
mov dword [ebp - 0xc7c], eax
mov eax, 0x7f1137f
mov edx, eax
mov dword [ebp - 0xb8c], esi
shr edx, 0x10
mov esi, ebx
add edi, 7
movzx eax, ax
mov dword [ebp - 0xbd0], edi
mov edi, 0x40227a
mov dword [ebp - 0xbb8], ebx
mov dword [ebp - 0xc40], ebx
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0xbb4], edx
mov dword [ebp - 0xbd4], 0x67
movzx ebx, byte [edi - 2]
movzx eax, byte [edi - 1]
movzx edx, byte [edi + 2]
shl edx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [edi]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [edi + 3]
or edx, eax
mov dword [ebp - 0xb94], ebx
movzx eax, byte [edi + 4]
xor esi, ebx
shl edx, 8
mov ebx, esi
or edx, eax
mov dword [ebp - 0xb98], esi
movzx eax, byte [edi + 5]
add edi, 8
shl edx, 8
or edx, eax
mov esi, dword [ebp - 0xbac]
mov dword [ebp - 0xbe0], edx
mov eax, 0x7f1137f
mov dword [ebp - 0xbe8], edi
mov edi, edx
xor edi, dword [ebp - 0xc40]
xor edi, ebx
xor edi, eax
xor edi, 0xab69605e
mov eax, edi
rol eax, 0xa
lea edx, [edi + 0x54969fa2]
rol edx, 5
imul edx, esi
add edx, eax
xor ebx, edx
mov edx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea edx, [ebx + edx]
ror edx, 9
imul edx, dword [ebp - 0xb8c]
sub edx, eax
xor edi, edx
mov eax, edi
sub eax, esi
imul edx, eax, 0x605e
mov eax, edi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xb8c]
rol edx, 6
imul edx, dword [ebp - 0xbb4]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor edi, edx
mov edx, edi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, esi
ror edx, 6
imul eax, dword [ebp - 0xb8c]
xor edx, eax
mov eax, 0x7f1137f
xor edi, edx
add eax, edi
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, edi
rol eax, 2
add edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 8
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
imul edx, dword [ebp - 0xbb4]
sub edx, eax
xor edi, edx
mov edx, edi
mov eax, edi
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, esi
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xbb4]
xor edx, ebx
mov eax, ebx
imul edx, dword [ebp - 0xb8c]
shr eax, 0xa
xor edx, eax
xor edi, edx
mov edx, dword [ebp - 0xbb4]
mov eax, edi
not eax
ror eax, 5
add eax, 0x605e
imul eax, edx
xor ebx, eax
mov esi, ebx
sub esi, edx
xor esi, edi
mov edi, dword [ebp - 0xbac]
xor esi, 0xab69605e
xor edx, esi
mov eax, esi
rol edx, 2
imul edx, edi
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, eax
mov eax, ebx
ror edx, 6
imul edx, dword [ebp - 0xb8c]
rol eax, 7
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, edi
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor ebx, edx
mov edx, ebx
mov dword [ebp - 0xb98], ebx
xor edx, dword [ebp - 0xb8c]
mov eax, ebx
rol edx, 5
imul edx, dword [ebp - 0xbb4]
rol eax, 7
add edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov ebx, esi
xor ebx, dword [ebp - 0xb98]
xor ebx, edx
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xb8c]
imul eax, edi
xor esi, eax
mov eax, esi
sub eax, edx
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [ebp - 0xbb4]
add edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, edi
mov edi, dword [ebp - 0xbe8]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
shr eax, 3
xor edx, 0x605e
imul edx, dword [ebp - 0xb8c]
xor edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov eax, esi
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xbe4]
rol eax, 2
mov dword [ebp - 0xc40], esi
xor edx, eax
xor edx, dword [ebp - 0xbb8]
xor ebx, edx
mov edx, dword [ebp - 0xbd0]
mov dword [ebp - 0xc7c], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xc40]
ror dword [ebp - 0xc7c], 8
mov byte [edx], al
mov al, byte [ebp - 0xc7c]
ror dword [ebp - 0xc40], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xc40]
ror dword [ebp - 0xc7c], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xc7c]
ror dword [ebp - 0xc40], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xc40]
ror dword [ebp - 0xc7c], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xc7c]
ror dword [ebp - 0xc40], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xc40]
mov byte [edx - 3], al
add edx, 8
mov esi, dword [ebp - 0xc7c]
mov eax, dword [ebp - 0xb94]
ror dword [ebp - 0xc40], 8
ror esi, 8
sub dword [ebp - 0xbd4], 1
mov dword [ebp - 0xbb8], eax
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xc7c], esi
mov dword [ebp - 0xbe4], eax
mov dword [ebp - 0xbd0], edx
jne 0x40eb51
mov esi, dword [ebp - 0xbc0]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x40eeb0
movzx eax, cl
cdq
cmp eax, dword [0x4025b0]
jne 0x40eede
cmp edx, dword [0x4025b4]
jne 0x40eede
mov dword [ebp - 0xb90], esi
mov edi, 0x337
mov esi, ebx
jmp 0x40eeeb
mov dword [ebp - 0xc14], 0xc004d501
or edi, 0xffffffff
test esi, esi
je 0x40eefe
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xc14], ebx
jl 0x40f065
mov eax, dword [ebp - 0xb90]
mov esi, eax
push 0x40
push ebx
push 0x41d2d0
mov byte [edi + eax], bl
call sub.msvcrt.dll_memset
mov eax, esi
add esp, 0xc
cmp byte [eax], bl
je 0x40f06c
mov edi, 0x41d2d0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xb94], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40ef41
sub ecx, dword [ebp - 0xb94]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x40f065
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xb8c], ecx
cmp word [eax], dx
je 0x40ef89
mov ecx, 0xc000007b
mov dword [ebp - 0xb8c], ecx
jmp 0x40efd1
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x40ef7c
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x40ef7c
cmp dword [edx], 0x4550
jne 0x40ef7c
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc48]
je 0x40efbf
cmp ax, word [ebp - 0xc18]
je 0x40efbf
mov ecx, 0xc000000d
jmp 0x40ef81
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xbe8], eax
mov dword [ebp - 0xbac], ebx
test eax, eax
je 0x40f04c
mov edx, esi
mov dword [ebp - 0xbe0], esi
lea eax, [edx + 1]
mov dword [ebp - 0xb94], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x40eff8
sub edx, dword [ebp - 0xb94]
inc esi
add esi, edx
test ecx, ecx
js 0x40f031
push dword [ebp - 0xbe0]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40f057
mov ecx, dword [ebp - 0xba4]
mov dword [ecx*4 + 0x41c050], eax
mov ecx, dword [ebp - 0xb8c]
mov eax, dword [ebp - 0xbac]
inc dword [ebp - 0xba4]
inc eax
mov dword [ebp - 0xbac], eax
cmp eax, dword [ebp - 0xbe8]
jb 0x40efe7
add edi, 0x10
cmp byte [esi], bl
jne 0x40ef34
mov esi, dword [ebp - 0xb8c]
mov eax, dword [ebp - 0xb90]
jmp 0x40f06e
mov esi, 0xc000007a
jmp 0x40f05d
mov esi, ebx
test eax, eax
je 0x40f081
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jns 0x40f0c1
mov esi, ebx
mov eax, dword [esi + 0x41d2d0]
test eax, eax
je 0x40f098
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x40f087
push 0x40
push ebx
push 0x41d2d0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x401010
mov edi, 0x41c050
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x40f0cc
mov eax, dword [0x41d558]
inc eax
mov dword [0x41d558], eax
xor eax, eax
mov ecx, 0x41d55c
xchg dword [ecx], eax
push 0x54
lea eax, [ebp - 0x858]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xbec]
add esp, 0xc
mov esi, dword [0x41c0cc]
mov ecx, eax
mov dword [ebp - 0x3a0], ebx
push 0xf
pop edx
and ecx, edx
mov dword [ebp - 0xbd8], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0xc], cx
mov ecx, eax
shr ecx, 8
push 0x403
and ecx, edx
shr eax, 0xc
push ebx
mov word [ebp - 0xa], cx
and eax, edx
push ebx
mov ecx, esi
mov word [ebp - 8], ax
call dword [0x41f4a8]
call esi
mov dword [ebp - 0xb9c], eax
mov dword [ebp - 0xbc4], 0xffffff
test eax, eax
jne 0x40f182
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb88], edi
test edi, edi
jle 0x40f16d
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb88], edi
test edi, edi
js 0x4107e9
mov dword [ebp - 0xb88], 0x80004005
jmp 0x4107e9
mov esi, dword [0x41c0a0]
lea eax, [ebp - 0xcb4]
push eax
push ebx
lea eax, [ebp - 0xcac]
mov dword [ebp - 0xcc8], ebx
push eax
mov edi, ebx
mov dword [ebp - 0xcb0], ebx
push 8
mov ecx, esi
mov dword [ebp - 0xbf4], ebx
mov dword [ebp - 0xc54], ebx
mov dword [ebp - 0xca0], ebx
mov dword [ebp - 0xc84], ebx
mov dword [ebp - 0xb88], edi
mov dword [ebp - 0xcb4], ebx
call dword [0x41f4a8]
call esi
test eax, eax
jne 0x40f212
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb88], edi
test edi, edi
jle 0x40f1fc
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb88], edi
test edi, edi
js 0x40f35e
mov edi, 0x80004005
mov dword [ebp - 0xb88], edi
jmp 0x40f35e
mov eax, dword [ebp - 0xcb4]
add eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xca0]
mov esi, eax
call fcn.00418d24
test esi, esi
jne 0x40f247
mov dword [ebp - 0xca0], ebx
mov edi, 0x8007000e
jmp 0x40f207
mov eax, dword [ebp - 0xcac]
mov dword [ebp - 0xca0], esi
lea eax, [eax*4 + 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xc84]
mov esi, eax
call fcn.00418d24
test esi, esi
jne 0x40f28a
mov edi, 0x8007000e
mov dword [ebp - 0xb88], edi
jmp 0x40f358
lea eax, [ebp - 0xcb4]
mov dword [ebp - 0xc84], esi
mov esi, dword [0x41c0a0]
mov ecx, esi
push eax
push dword [ebp - 0xca0]
lea eax, [ebp - 0xcac]
push eax
push 8
call dword [0x41f4a8]
call esi
test eax, eax
je 0x40f1d9
cmp dword [ebp - 0xcac], 0
mov edx, dword [ebp - 0xc84]
mov eax, dword [ebp - 0xca0]
mov dword [ebp - 0xbac], edx
mov dword [ebp - 0xbb8], ebx
jbe 0x40f339
mov edi, eax
mov esi, dword [0x41c0a8]
mov ecx, esi
push ebx
push edi
call dword [0x41f4a8]
call esi
mov edx, dword [ebp - 0xbac]
mov ecx, edi
mov dword [edx], eax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40f300
mov eax, dword [ebp - 0xbb8]
sub ecx, esi
sar ecx, 1
add edx, 4
mov dword [ebp - 0xbac], edx
lea edi, [edi + ecx*2]
add edi, 2
inc eax
mov dword [ebp - 0xbb8], eax
cmp eax, dword [ebp - 0xcac]
jb 0x40f2e1
mov edi, dword [ebp - 0xb88]
mov dword [edx], 0x409
mov eax, dword [ebp - 0xc84]
mov dword [ebp - 0xcc8], eax
mov eax, dword [ebp - 0xcac]
inc eax
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0xc84], ebx
lea ecx, [ebp - 0xc84]
call fcn.00418d24
lea ecx, [ebp - 0xca0]
call fcn.00418d24
test edi, edi
js 0x40fb05
cmp dword [ebp - 0xbac], 0
mov edi, ebx
mov dword [ebp - 0xbc0], edi
mov esi, ebx
jbe 0x40f3bc
mov eax, dword [ebp - 0xcc8]
mov edx, ebx
mov ecx, dword [eax + esi*4]
cmp ecx, dword [edx*4 + 0x401e80]
je 0x40f3b4
inc edx
cmp edx, 0x26
jb 0x40f397
inc esi
cmp esi, dword [ebp - 0xbac]
jb 0x40f395
jmp 0x40f3bc
mov edi, edx
mov dword [ebp - 0xbc0], edx
mov esi, dword [0x41c0a4]
lea eax, [ebp - 0x100]
push ebx
push 0x55
push eax
push dword [edi*4 + 0x401e80]
mov ecx, esi
mov dword [ebp - 0xc14], ebx
call dword [0x41f4a8]
call esi
test eax, eax
je 0x40f421
mov esi, dword [0x41c098]
lea eax, [ebp - 0x720]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0x100]
mov ecx, esi
push eax
call dword [0x41f4a8]
call esi
test eax, eax
jle 0x40f421
mov edi, dword [ebp - 0x714]
xor eax, eax
shr edi, 0x1b
inc eax
and edi, eax
mov dword [ebp - 0xc14], edi
mov edx, 0x401f98
mov esi, ebx
mov ecx, edx
mov dword [ebp + esi*4 - 0x390], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40f434
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0x40f428
imul ecx, dword [ebp - 0xbc0], 3
movzx eax, byte [ecx + 0x401f18]
mov esi, dword [ebp + eax*4 - 0x390]
movzx eax, byte [ecx + 0x401f19]
mov dword [ebp - 0xbf0], esi
mov dword [ebp - 0xcf4], esi
mov eax, dword [ebp + eax*4 - 0x390]
mov dword [ebp - 0xbdc], eax
mov dword [ebp - 0xcf0], eax
movzx eax, byte [ecx + 0x401f1a]
mov esi, dword [ebp + eax*4 - 0x390]
mov dword [ebp - 0xbec], esi
mov dword [ebp - 0xcec], esi
push 0x1c90
mov eax, ebx
push ebx
mov dword [ebp - 0xb88], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xbe8], edi
test edi, edi
je 0x40f9a2
or dword [ebp - 0xbe4], 0xffffffff
mov ecx, 0x7f1137f
mov dword [ebp - 0x414], ecx
mov al, bl
mov ecx, ebx
mov dword [ebp - 0x418], 0xab69605e
movzx esi, word [ebp - 0x416]
mov dword [ebp - 0xba4], ecx
mov dword [ebp - 0xc58], ecx
mov dword [ebp - 0xb98], ecx
mov dword [ebp - 0xc80], ecx
mov ecx, 0x7f1137f
mov edx, ecx
mov dword [ebp - 0xb8c], esi
shr edx, 0x10
mov esi, ebx
add edi, 7
mov dword [ebp - 0xbb4], edx
movzx ecx, cx
mov edx, 0x4025ba
mov dword [ebp - 0xbd0], edi
mov edi, ebx
mov dword [ebp - 0xbb8], ebx
mov dword [ebp - 0xbac], ecx
mov dword [ebp - 0xbbc], edx
mov dword [ebp - 0xbd4], 0x392
movzx ebx, byte [edx - 2]
movzx ecx, byte [edx - 1]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [edx]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [edx + 1]
movzx edx, byte [edx + 2]
shl edx, 8
shl ebx, 8
or ebx, ecx
mov ecx, dword [ebp - 0xbbc]
xor esi, ebx
mov dword [ebp - 0xb94], ebx
mov ebx, esi
mov dword [ebp - 0xb98], esi
mov esi, dword [ebp - 0xbac]
movzx ecx, byte [ecx + 3]
or edx, ecx
mov ecx, dword [ebp - 0xbbc]
shl edx, 8
movzx ecx, byte [ecx + 4]
or edx, ecx
mov ecx, dword [ebp - 0xbbc]
shl edx, 8
add dword [ebp - 0xbbc], 8
movzx ecx, byte [ecx + 5]
or edx, ecx
xor edi, edx
mov dword [ebp - 0xbe0], edx
mov dword [ebp - 0xba4], edi
mov edi, 0x7f1137f
xor edi, dword [ebp - 0xba4]
xor edi, ebx
xor edi, 0xab69605e
mov ecx, edi
rol ecx, 0xa
lea edx, [edi + 0x54969fa2]
rol edx, 5
imul edx, esi
add edx, ecx
xor ebx, edx
mov edx, 0x7f1137f
mov ecx, ebx
rol ecx, 2
lea edx, [ebx + edx]
ror edx, 9
imul edx, dword [ebp - 0xb8c]
sub edx, ecx
xor edi, edx
mov ecx, edi
sub ecx, esi
imul edx, ecx, 0x605e
mov ecx, edi
shr ecx, 0xd
sub edx, ecx
xor ebx, edx
mov edx, ebx
mov ecx, ebx
xor edx, dword [ebp - 0xb8c]
rol edx, 6
imul edx, dword [ebp - 0xbb4]
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor edi, edx
mov edx, edi
xor edx, 0xab69605e
sub ecx, edx
xor ebx, ecx
mov ecx, ebx
mov edx, ebx
xor ecx, esi
ror edx, 6
imul ecx, dword [ebp - 0xb8c]
xor edx, ecx
mov ecx, 0x7f1137f
xor edi, edx
add ecx, edi
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, edi
rol ecx, 2
add edx, ecx
xor ebx, edx
mov ecx, ebx
rol ecx, 8
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
imul edx, dword [ebp - 0xbb4]
sub edx, ecx
xor edi, edx
mov edx, edi
mov ecx, edi
xor edx, 0xab69605e
ror ecx, 0xa
ror edx, 0xc
imul edx, esi
xor edx, ecx
xor ebx, edx
mov edx, dword [ebp - 0xbb4]
xor edx, ebx
mov ecx, ebx
imul edx, dword [ebp - 0xb8c]
shr ecx, 0xa
xor edx, ecx
xor edi, edx
mov ecx, edi
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, dword [ebp - 0xbb4]
xor ebx, ecx
mov esi, ebx
sub esi, dword [ebp - 0xbb4]
xor esi, edi
mov edi, dword [ebp - 0xbac]
xor esi, 0xab69605e
mov edx, esi
mov ecx, esi
xor edx, dword [ebp - 0xbb4]
rol edx, 2
imul edx, edi
shr ecx, 2
add edx, ecx
mov ecx, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, ecx
mov ecx, ebx
ror edx, 6
imul edx, dword [ebp - 0xb8c]
rol ecx, 7
add edx, ecx
xor esi, edx
mov ecx, esi
mov edx, esi
xor ecx, edi
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor ebx, edx
mov edx, ebx
mov dword [ebp - 0xb98], ebx
xor edx, dword [ebp - 0xb8c]
mov ecx, ebx
rol edx, 5
imul edx, dword [ebp - 0xbb4]
rol ecx, 7
add edx, ecx
xor esi, edx
mov edx, 0x7f1137f
mov ebx, edx
xor ebx, esi
xor ebx, dword [ebp - 0xb98]
xor ebx, 0xab69605e
mov ecx, ebx
ror ecx, 3
sub ecx, dword [ebp - 0xb8c]
imul ecx, edi
xor esi, ecx
mov ecx, esi
sub ecx, edx
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, esi
ror ecx, 6
sub edx, ecx
xor ebx, edx
mov ecx, ebx
rol ecx, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [ebp - 0xbb4]
add edx, ecx
xor esi, edx
mov ecx, esi
ror ecx, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, edi
sub edx, ecx
xor ebx, edx
mov edx, ebx
mov ecx, ebx
xor edx, 0x605e
shr ecx, 3
imul edx, dword [ebp - 0xb8c]
xor edx, ecx
xor esi, edx
mov edx, 0x7f1137f
mov ecx, esi
xor ecx, edx
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, esi
xor esi, dword [ebp - 0xbe4]
rol ecx, 2
mov dword [ebp - 0xc58], esi
xor edx, ecx
xor edx, dword [ebp - 0xbb8]
xor ebx, edx
mov edx, dword [ebp - 0xbd0]
mov dword [ebp - 0xc80], ebx
mov byte [edx - 4], bl
mov cl, byte [ebp - 0xc58]
ror dword [ebp - 0xc80], 8
mov byte [edx], cl
mov cl, byte [ebp - 0xc80]
ror dword [ebp - 0xc58], 8
mov byte [edx - 5], cl
mov cl, byte [ebp - 0xc58]
ror dword [ebp - 0xc80], 8
mov byte [edx - 1], cl
mov cl, byte [ebp - 0xc80]
ror dword [ebp - 0xc58], 8
mov byte [edx - 6], cl
mov cl, byte [ebp - 0xc58]
ror dword [ebp - 0xc80], 8
mov byte [edx - 2], cl
ror dword [ebp - 0xc58], 8
mov cl, byte [ebp - 0xc80]
mov byte [edx - 7], cl
mov cl, byte [ebp - 0xc58]
mov byte [edx - 3], cl
add edx, 8
mov esi, dword [ebp - 0xc80]
mov edi, dword [ebp - 0xc58]
mov ecx, dword [ebp - 0xb94]
ror esi, 8
ror edi, 8
sub dword [ebp - 0xbd4], 1
mov dword [ebp - 0xbb8], ecx
mov ecx, dword [ebp - 0xbe0]
mov dword [ebp - 0xbd0], edx
mov edx, dword [ebp - 0xbbc]
mov dword [ebp - 0xc80], esi
mov dword [ebp - 0xc58], edi
mov dword [ebp - 0xbe4], ecx
jne 0x40f555
mov ecx, dword [ebp - 0xbe8]
xor ebx, ebx
mov edx, ebx
mov esi, 0x1c90
xor al, byte [edx + ecx]
inc edx
cmp edx, esi
jb 0x40f8de
movzx eax, al
cdq
cmp eax, dword [0x404248]
jne 0x40f910
cmp edx, dword [0x40424c]
jne 0x40f910
mov edi, dword [ebp - 0xb88]
mov dword [ebp - 0xcb0], ecx
mov ecx, ebx
mov dword [ebp - 0xbf4], esi
jmp 0x40f91b
mov edi, 0xc004d501
mov dword [ebp - 0xb88], edi
test ecx, ecx
je 0x40f92e
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
js 0x40fb29
mov edi, dword [ebp - 0xcb0]
mov esi, ebx
mov edx, ebx
mov ebx, dword [ebp - 0xbc0]
cmp ebx, edx
jne 0x40f951
mov dword [ebp + esi*4 - 0x340], edi
mov ecx, edi
lea eax, [ecx + 1]
mov dword [ebp - 0xb94], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f95c
sub ecx, dword [ebp - 0xb94]
inc edi
add edi, ecx
inc edx
cmp edx, 0x26
jb 0x40f946
inc esi
push 0
pop ebx
cmp esi, 6
jb 0x40f93e
push 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 0xc54]
mov edi, eax
call fcn.00418d24
test edi, edi
jne 0x40f9b2
mov dword [ebp - 0xc54], ebx
mov edi, 0x8007000e
mov dword [ebp - 0xb88], edi
jmp 0x40fb29
mov dword [ebp - 0xc54], edi
lea ecx, [ebp - 0xc]
xor eax, eax
mov dword [ebp - 0xbac], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, ebx
movzx edx, word [ecx]
mov eax, ebx
cmp dx, word [eax*2 + 0x401f8c]
je 0x40f9e2
inc eax
cmp eax, 6
jb 0x40f9cd
jmp 0x40fa9b
mov edx, dword [ebp + eax*4 - 0x340]
mov ecx, edx
mov dword [ebp - 0xb94], edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40f9f4
sub ecx, esi
mov esi, dword [0x41c0b0]
push ebx
push ebx
lea eax, [ecx + 1]
mov ecx, esi
push eax
push edx
push ebx
push 0xfde9
call dword [0x41f4a8]
call esi
mov esi, eax
test esi, esi
je 0x40fad6
lea ecx, [esi + esi]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0xc54]
mov dword [edi + ecx], eax
mov eax, dword [ebp - 0xc54]
cmp dword [edi + eax], ebx
je 0x40f9a2
mov edx, dword [ebp - 0xb94]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xb94], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40fa5f
sub ecx, dword [ebp - 0xb94]
mov eax, dword [ebp - 0xc54]
push esi
mov esi, dword [0x41c0b0]
push dword [edi + eax]
lea eax, [ecx + 1]
mov ecx, esi
push eax
push edx
push ebx
push 0xfde9
call dword [0x41f4a8]
call esi
test eax, eax
je 0x40fad6
mov ecx, dword [ebp - 0xbac]
add ecx, 2
add edi, 4
mov dword [ebp - 0xbac], ecx
cmp edi, 0xc
jb 0x40f9c8
mov eax, dword [ebp - 0xc54]
mov edi, dword [ebp - 0xb88]
mov dword [ebp - 0xcc4], eax
mov eax, dword [ebp - 0xc14]
mov dword [ebp - 0xc54], ebx
mov dword [ebp - 0x858], eax
jmp 0x40fb29
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb88], edi
test edi, edi
jle 0x40faf9
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb88], edi
test edi, edi
js 0x40fb29
mov edi, 0x80004005
jmp 0x40f9a7
mov eax, dword [ebp - 0xcec]
mov dword [ebp - 0xbec], eax
mov eax, dword [ebp - 0xcf0]
mov dword [ebp - 0xbdc], eax
mov eax, dword [ebp - 0xcf4]
mov dword [ebp - 0xbf0], eax
cmp dword [ebp - 0xc54], 0
je 0x40fb8f
mov esi, ebx
mov eax, dword [ebp - 0xc54]
cmp dword [esi + eax], ebx
je 0x40fb87
mov ecx, dword [esi + eax]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40fb45
mov eax, dword [ebp - 0xc54]
sub ecx, edx
sar ecx, 1
mov eax, dword [esi + eax]
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x40fb70
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x40fb68
mov eax, dword [ebp - 0xc54]
push dword [esi + eax]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
add esi, 4
cmp esi, 0xc
jb 0x40fb34
mov eax, dword [ebp - 0xcb0]
test eax, eax
je 0x40fbab
mov ecx, dword [ebp - 0xbf4]
test ecx, ecx
je 0x40fbab
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x40fba3
lea ecx, [ebp - 0xc54]
call fcn.00418d24
lea ecx, [ebp - 0xcb0]
call fcn.00418d24
lea ecx, [ebp - 0xcc8]
call fcn.00418d24
test edi, edi
js 0x4107d2
mov eax, dword [ebp - 0xcc4]
lea edi, [ebp - 0xda0]
mov esi, dword [0x41c104]
push ebx
mov ecx, dword [eax]
mov dword [ebp - 0x850], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x84c], ecx
mov ecx, esi
mov eax, dword [eax + 8]
mov dword [ebp - 0x848], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xda0]
push eax
push ebx
mov edi, ebx
mov dword [ebp - 0xda0], 0xc
push 0x42
mov dword [ebp - 0xb88], edi
call dword [0x41f4a8]
call esi
test eax, eax
jne 0x40fc64
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb88], edi
test edi, edi
jle 0x40fc53
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb88], edi
test edi, edi
mov eax, ebx
js 0x40fc6f
mov edi, 0x80004005
mov dword [ebp - 0xb88], edi
jmp 0x40fc6f
mov eax, dword [ebp - 0xd9c]
xor ecx, ecx
inc ecx
and eax, ecx
mov dword [ebp - 0x854], eax
test edi, edi
js 0x4107d2
mov eax, dword [ebp - 0xbd8]
push 0x2a
pop ecx
mov dword [ebp - 0xb98], ecx
sub eax, 1
je 0x40fcba
sub eax, 1
je 0x40fcae
sub eax, 1
jne 0x40fcca
mov edi, 0xe1
mov dword [ebp - 0xc04], edi
mov dword [ebp - 0xc1c], edi
jmp 0x40fcca
mov dword [ebp - 0xc04], 0xf
jmp 0x40fcc0
mov dword [ebp - 0xc04], ecx
mov dword [ebp - 0xc1c], 0xb
mov esi, 0xdc
mov dword [ebp - 0xbb4], 0x60
push esi
lea eax, [ebp - 0x800]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov word [ebp - 0x7bc], si
mov esi, dword [0x41c0c0]
lea eax, [ebp - 0x800]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0x41f4a8]
call esi
test eax, eax
je 0x40fd5b
mov eax, dword [ebp - 0x754]
movzx edi, word [ebp - 0x75a]
mov ecx, dword [ebp - 0x750]
push 0x60
mov dword [ebp - 0xba4], eax
mov dword [ebp - 0x408], eax
pop eax
mov dword [ebp - 0xbb4], edi
mov dword [ebp - 0x40c], ebx
mov dword [ebp - 0x410], ebx
mov dword [ebp - 0xbb8], ecx
mov dword [ebp - 0x404], ecx
cmp edi, eax
jae 0x40fd73
mov dword [ebp - 0xbb4], eax
jmp 0x40fd73
mov eax, dword [ebp - 0x404]
mov dword [ebp - 0xbb8], eax
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0xba4], eax
xor eax, eax
inc eax
cmp dword [ebp - 0xbd8], eax
mov eax, dword [ebp - 0xbf0]
je 0x40fd8a
mov eax, dword [ebp - 0xbec]
push 0x5c
mov dword [ebp - 0xbac], eax
lea eax, [ebp - 0x640]
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x41c0cc]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xb88], edi
push 0x403
push ebx
push ebx
call dword [0x41f4a8]
call esi
mov dword [ebp - 0xb94], eax
test eax, eax
jne 0x40fe03
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb88], edi
test edi, edi
jle 0x40fdee
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb88], edi
test edi, edi
js 0x40feba
mov dword [ebp - 0xb88], 0x80004005
jmp 0x4107d2
mov esi, dword [0x41c0ac]
mov ecx, esi
push 0x48
push dword [ebp - 0xbb4]
push dword [ebp - 0xc04]
call dword [0x41f4a8]
call esi
push dword [ebp - 0xbac]
neg eax
mov dword [ebp - 0x630], 0x190
push 0x20
mov dword [ebp - 0x640], eax
lea ecx, [ebp - 0x624]
pop eax
mov edx, eax
mov byte [ebp - 0x626], 5
call fcn.00405313
mov esi, dword [0x41c060]
lea eax, [ebp - 0x640]
push eax
mov ecx, esi
call dword [0x41f4a8]
call esi
test eax, eax
jne 0x40fe9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb88], edi
test edi, edi
jle 0x40fe8e
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb88], edi
test edi, edi
js 0x40fea3
mov edi, 0x80004005
mov dword [ebp - 0xb88], edi
jmp 0x40fea3
mov dword [ebp - 0x844], eax
push dword [ebp - 0xb94]
mov esi, dword [0x41c100]
mov ecx, esi
push ebx
call dword [0x41f4a8]
call esi
test edi, edi
js 0x4107d2
xor eax, eax
inc eax
cmp dword [ebp - 0xbd8], eax
je 0x40fed9
mov eax, dword [ebp - 0xbec]
mov dword [ebp - 0xbf0], eax
push 0x5c
lea eax, [ebp - 0x6a0]
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x41c0cc]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xb88], edi
push 0x403
push ebx
push ebx
call dword [0x41f4a8]
call esi
mov dword [ebp - 0xb94], eax
test eax, eax
jne 0x40ff42
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb88], edi
test edi, edi
jle 0x40ff37
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb88], edi
test edi, edi
js 0x40fff9
jmp 0x40fdf4
mov esi, dword [0x41c0ac]
mov ecx, esi
push 0x48
push dword [ebp - 0xbb4]
push dword [ebp - 0xc1c]
call dword [0x41f4a8]
call esi
push dword [ebp - 0xbf0]
neg eax
mov dword [ebp - 0x690], 0x190
push 0x20
mov dword [ebp - 0x6a0], eax
lea ecx, [ebp - 0x684]
pop eax
mov edx, eax
mov byte [ebp - 0x686], 5
call fcn.00405313
mov esi, dword [0x41c060]
lea eax, [ebp - 0x6a0]
push eax
mov ecx, esi
call dword [0x41f4a8]
call esi
test eax, eax
jne 0x40ffdc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb88], edi
test edi, edi
jle 0x40ffcd
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb88], edi
test edi, edi
js 0x40ffe2
mov edi, 0x80004005
mov dword [ebp - 0xb88], edi
jmp 0x40ffe2
mov dword [ebp - 0x840], eax
push dword [ebp - 0xb94]
mov esi, dword [0x41c100]
mov ecx, esi
push ebx
call dword [0x41f4a8]
call esi
test edi, edi
js 0x4107d2
mov esi, dword [ebp - 0xbd8]
mov ecx, ebx
mov eax, esi
mov edx, ebx
sub eax, 1
je 0x41001c
sub eax, 1
je 0x41005a
sub eax, 1
jne 0x410028
mov ecx, dword [ebp - 0xba4]
mov edx, dword [ebp - 0xbb8]
mov dword [ebp - 0x398], ecx
mov dword [ebp - 0x394], edx
xor edx, edx
inc edx
cmp esi, edx
je 0x41009a
lea eax, [esi - 2]
cmp eax, edx
ja 0x41006e
mov eax, ebx
mov dword [ebp - 0xb98], ebx
mov edx, ebx
mov dword [ebp - 0xc04], eax
mov dword [ebp - 0xc1c], ebx
jmp 0x4100b1
mov eax, dword [ebp - 0xba4]
cdq
and edx, 3
lea ecx, [edx + eax]
mov edx, ebx
sar ecx, 2
jmp 0x410028
mov eax, dword [ebp - 0xc90]
mov edx, dword [ebp - 0xc90]
mov dword [ebp - 0xc1c], eax
mov eax, dword [ebp - 0xc90]
mov dword [ebp - 0xb98], eax
mov eax, dword [ebp - 0xc90]
mov dword [ebp - 0xc04], eax
jmp 0x4100b1
mov edx, 0x96
mov dword [ebp - 0xc04], ebx
mov eax, ebx
mov dword [ebp - 0xc1c], 0x20
mov dword [ebp - 0xbf0], edx
push dword [ebp - 0x844]
mov esi, dword [0x41c08c]
sub ecx, edx
push dword [ebp - 0xb9c]
mov edi, dword [ebp - 0x850]
sub ecx, eax
mov dword [ebp - 0xbbc], ecx
mov eax, ebx
mov dword [ebp - 0x81c], ecx
mov dword [ebp - 0x82c], ecx
mov ecx, esi
mov dword [ebp - 0xb88], eax
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c0bc]
mov ecx, esi
push ebx
push 0xc50
mov dword [ebp - 0xb94], eax
lea eax, [ebp - 0x834]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xb9c]
call dword [0x41f4a8]
call esi
test eax, eax
jne 0x410134
mov edi, 0x80004005
mov dword [ebp - 0xb88], edi
jmp 0x410136
mov edi, ebx
mov eax, dword [ebp - 0xb94]
test eax, eax
je 0x410157
mov esi, dword [0x41c08c]
mov ecx, esi
push eax
push dword [ebp - 0xb9c]
call dword [0x41f4a8]
call esi
test edi, edi
js 0x4107d2
push dword [ebp - 0x840]
mov esi, dword [0x41c08c]
mov eax, ebx
push dword [ebp - 0xb9c]
mov edi, dword [ebp - 0x84c]
mov ecx, esi
mov dword [ebp - 0xb88], eax
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c0bc]
mov ecx, esi
push ebx
push 0xc50
mov dword [ebp - 0xb94], eax
lea eax, [ebp - 0x824]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xb9c]
call dword [0x41f4a8]
call esi
test eax, eax
jne 0x4101c6
mov edi, 0x80004005
mov dword [ebp - 0xb88], edi
jmp 0x4101c8
mov edi, ebx
mov eax, dword [ebp - 0xb94]
test eax, eax
je 0x4101e9
mov esi, dword [0x41c08c]
mov ecx, esi
push eax
push dword [ebp - 0xb9c]
call dword [0x41f4a8]
call esi
test edi, edi
js 0x4107d2
mov eax, dword [ebp - 0xbd8]
cmp eax, 2
je 0x410201
cmp eax, 3
jne 0x410223
mov edi, dword [ebp - 0x81c]
mov dword [ebp - 0xbbc], edi
cmp dword [ebp - 0x82c], edi
jle 0x410229
mov edi, dword [ebp - 0x82c]
mov dword [ebp - 0xbbc], edi
jmp 0x410229
mov edi, dword [ebp - 0xbbc]
cmp dword [ebp - 0x858], 0
mov esi, dword [0x41c0f8]
mov ecx, esi
push dword [ebp - 0xb98]
je 0x41027c
mov eax, dword [ebp - 0xc04]
sub eax, dword [ebp - 0x82c]
add eax, edi
push eax
lea eax, [ebp - 0x834]
push eax
call dword [0x41f4a8]
call esi
mov eax, dword [ebp - 0x828]
add eax, dword [ebp - 0xc1c]
push eax
mov eax, dword [ebp - 0xc04]
sub eax, dword [ebp - 0x81c]
add eax, edi
push eax
jmp 0x4102a4
push dword [ebp - 0xbf0]
lea eax, [ebp - 0x834]
push eax
call dword [0x41f4a8]
call esi
mov eax, dword [ebp - 0x828]
add eax, dword [ebp - 0xc1c]
push eax
push dword [ebp - 0xbf0]
mov esi, dword [0x41c0f8]
lea eax, [ebp - 0x824]
push eax
mov ecx, esi
call dword [0x41f4a8]
call esi
mov eax, dword [ebp - 0xbd8]
cmp eax, 2
je 0x4105c1
cmp eax, 3
je 0x4105c1
xor edx, edx
inc edx
cmp eax, edx
jne 0x4105e0
push 0x5c
lea eax, [ebp - 0x700]
mov dword [ebp - 0x838], 0xffffff
push ebx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [0x41c0cc]
add esp, 0xc
mov edi, ebx
mov ecx, esi
mov dword [ebp - 0xb88], edi
push 0x403
push ebx
push ebx
call dword [0x41f4a8]
call esi
mov dword [ebp - 0xb94], eax
test eax, eax
jne 0x410351
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb88], edi
test edi, edi
jle 0x410346
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb88], edi
test edi, edi
js 0x410404
jmp 0x40fdf4
mov esi, dword [0x41c0ac]
mov ecx, esi
push 0x48
push dword [ebp - 0xbb4]
push 0xb
call dword [0x41f4a8]
call esi
push dword [ebp - 0xbdc]
neg eax
mov dword [ebp - 0x6f0], 0x190
push 0x20
mov dword [ebp - 0x700], eax
lea ecx, [ebp - 0x6e4]
pop eax
mov edx, eax
mov byte [ebp - 0x6e6], 5
call fcn.00405313
mov esi, dword [0x41c060]
lea eax, [ebp - 0x700]
push eax
mov ecx, esi
call dword [0x41f4a8]
call esi
test eax, eax
jne 0x4103e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [ebp - 0xb88], edi
test edi, edi
jle 0x4103d8
movzx edi, di
or edi, 0x80070000
mov dword [ebp - 0xb88], edi
test edi, edi
js 0x4103ed
mov edi, 0x80004005
mov dword [ebp - 0xb88], edi
jmp 0x4103ed
mov dword [ebp - 0x83c], eax
push dword [ebp - 0xb94]
mov esi, dword [0x41c100]
mov ecx, esi
push ebx
call dword [0x41f4a8]
call esi
test edi, edi
js 0x4107d2
push dword [ebp - 0x83c]
mov eax, dword [ebp - 0xbbc]
push dword [ebp - 0xb9c]
mov esi, dword [0x41c08c]
mov ecx, esi
mov edi, dword [ebp - 0x848]
mov dword [ebp - 0x80c], eax
mov eax, ebx
mov dword [ebp - 0xb88], eax
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c0bc]
mov ecx, esi
push ebx
push 0x460
mov dword [ebp - 0xb94], eax
lea eax, [ebp - 0x814]
push eax
push 0xffffffffffffffff
push edi
push dword [ebp - 0xb9c]
call dword [0x41f4a8]
call esi
test eax, eax
jne 0x41047f
mov edi, 0x80004005
mov dword [ebp - 0xb88], edi
jmp 0x410481
mov edi, ebx
mov eax, dword [ebp - 0xb94]
test eax, eax
je 0x4104a2
mov esi, dword [0x41c08c]
mov ecx, esi
push eax
push dword [ebp - 0xb9c]
call dword [0x41f4a8]
call esi
test edi, edi
js 0x4107d2
mov eax, dword [ebp - 0x80c]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x80c], eax
cmp eax, ecx
jge 0x4104c6
mov dword [ebp - 0x80c], ecx
mov edi, dword [ebp - 0xbb4]
mov esi, dword [0x41c0ac]
mov ecx, esi
push 0x20
pop eax
push 0x60
push edi
push dword [ebp - 0x814]
mov dword [ebp - 0x808], eax
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c0ac]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x810]
mov dword [ebp - 0x814], eax
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c0ac]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x80c]
mov dword [ebp - 0x810], eax
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c0ac]
mov ecx, esi
push 0x60
push edi
push dword [ebp - 0x808]
mov dword [ebp - 0x80c], eax
call dword [0x41f4a8]
call esi
cmp dword [ebp - 0x858], 0
mov dword [ebp - 0x808], eax
je 0x410592
mov ecx, dword [ebp - 0x834]
cmp ecx, dword [ebp - 0x824]
jl 0x41056e
mov ecx, dword [ebp - 0x824]
mov eax, dword [ebp - 0x818]
add eax, 0x24
push eax
push ecx
mov esi, dword [0x41c0f8]
lea eax, [ebp - 0x814]
push eax
mov ecx, esi
call dword [0x41f4a8]
call esi
jmp 0x4105dd
mov ecx, dword [ebp - 0x82c]
cmp ecx, dword [ebp - 0x81c]
jg 0x4105a6
mov ecx, dword [ebp - 0x81c]
mov eax, dword [ebp - 0x818]
add eax, 0x24
push eax
mov eax, dword [ebp - 0x814]
sub eax, dword [ebp - 0x80c]
add eax, ecx
push eax
jmp 0x410579
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x398], edi
mov dword [ebp - 0x394], eax
mov dword [ebp - 0x838], 0xffa8a8a8
xor edx, edx
inc edx
mov eax, dword [ebp - 0x858]
lea edi, [ebp - 0x4c8]
mov dword [ebp - 0xb94], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0xbb8], eax
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0xbac], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xbd8]
sub eax, 1
je 0x4107c0
sub eax, 1
je 0x4106e7
sub eax, 1
jne 0x4107cc
mov esi, dword [0x41c0f4]
lea edi, [ebp - 0x4b8]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c0d4]
lea ecx, [ebp - 0x4b8]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x4b8], 0x28
call dword [0x41f4a8]
call esi
test eax, eax
je 0x4107cc
mov esi, dword [0x41c0f0]
lea eax, [ebp - 0x4a4]
push eax
push ebx
mov ecx, esi
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c0f0]
lea eax, [ebp - 0x49c]
push eax
push ebx
mov ecx, esi
call dword [0x41f4a8]
call esi
mov eax, dword [ebp - 0x49c]
lea esi, [ebp - 0x4a4]
sub eax, dword [ebp - 0xbac]
lea edi, [ebp - 0x4c8]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0x498]
sub eax, dword [ebp - 0xbb8]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
jmp 0x4107b5
mov esi, dword [0x41c0f4]
lea edi, [ebp - 0x480]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push edx
push ebx
mov ecx, esi
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c0d4]
lea ecx, [ebp - 0x480]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x480], 0x28
call dword [0x41f4a8]
call esi
test eax, eax
je 0x4107cc
mov esi, dword [0x41c0f0]
lea eax, [ebp - 0x46c]
push eax
push ebx
mov ecx, esi
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c0f0]
lea eax, [ebp - 0x464]
push eax
push ebx
mov ecx, esi
call dword [0x41f4a8]
call esi
cmp dword [ebp - 0xb94], 0
lea esi, [ebp - 0x46c]
lea edi, [ebp - 0x4c8]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x41078e
imul eax, dword [ebp - 0x464], 5
cdq
idiv ecx
add eax, dword [ebp - 0x46c]
jmp 0x4107a0
mov eax, dword [ebp - 0x464]
sub eax, dword [ebp - 0xbac]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp - 0x460]
sub eax, dword [ebp - 0xbb8]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0x39c], eax
jmp 0x4107cc
mov dword [ebp - 0x3a0], ebx
mov dword [ebp - 0x39c], ebx
mov dword [ebp - 0xb88], ebx
push dword [ebp - 0xb9c]
mov esi, dword [0x41c100]
mov ecx, esi
push ebx
call dword [0x41f4a8]
call esi
xor esi, esi
mov edi, 0x41d55c
inc esi
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x4107f1
mov eax, dword [0x41d558]
test eax, eax
jle 0x410852
sub eax, 1
mov dword [0x41d558], eax
jne 0x410852
mov esi, ebx
mov eax, dword [esi + 0x41d2d0]
test eax, eax
je 0x410823
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x410812
push 0x40
push ebx
push 0x41d2d0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x401010
mov edi, 0x41c050
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0x41d55c
inc esi
xor eax, eax
xchg dword [edi], eax
lea ecx, [ebp - 0xcc4]
call fcn.00418d24
mov eax, dword [ebp - 0xb88]
test eax, eax
js 0x412475
mov eax, dword [ebp - 0x39c]
mov edi, dword [ebp - 0x3a0]
push 0x54
mov dword [ebp - 0xbac], eax
mov dword [ebp - 0xd5c], eax
lea eax, [ebp - 0x8c0]
push ebx
push eax
mov dword [ebp - 0xd60], edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xbb8], esi
mov esi, dword [0x41c078]
mov ecx, esi
push 7
push dword [ebp - 0xba8]
call dword [0x41f4a8]
call esi
test eax, eax
je 0x410906
mov esi, dword [0x41c084]
lea ecx, [ebp - 0x8c0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x41f4a8]
call esi
test eax, eax
je 0x410906
push 0x20
pop eax
cmp word [ebp - 0x8ae], ax
jne 0x410906
cmp dword [ebp - 0x8ac], 0
je 0x410906
cmp dword [ebp - 0x8bc], 0
jle 0x410906
cmp dword [ebp - 0x8b8], 0
jg 0x410915
cmp dword [ebp - 0xbd8], 1
mov dword [ebp - 0xbb8], ebx
jne 0x410989
push dword [ebp - 0xbac]
mov esi, dword [0x41c0f8]
lea eax, [ebp - 0x834]
push edi
push eax
mov ecx, esi
call dword [0x41f4a8]
call esi
push dword [ebp - 0xbac]
mov esi, dword [0x41c0f8]
lea eax, [ebp - 0x824]
push edi
push eax
mov ecx, esi
call dword [0x41f4a8]
call esi
mov edi, dword [ebp - 0xbd8]
cmp edi, 1
jne 0x41098f
mov eax, dword [ebp - 0x854]
mov esi, dword [0x41c064]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0x41f4a8]
call esi
mov dword [ebp - 0xba0], eax
jmp 0x41098f
mov edi, dword [ebp - 0xbd8]
mov esi, dword [0x41c090]
mov ecx, esi
push 1
push dword [ebp - 0xba8]
call dword [0x41f4a8]
call esi
cmp dword [ebp - 0x858], 0
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xbbc], 0x810
je 0x4109ca
mov dword [ebp - 0xbbc], 0x20812
cmp dword [ebp - 0xbb8], 0
je 0x411528
mov eax, dword [ebp - 0x854]
mov esi, dword [ebp - 0x850]
mov dword [ebp - 0xbe8], eax
mov eax, dword [ebp - 0x844]
push 0x54
mov dword [ebp - 0xb94], eax
lea eax, [ebp - 0x918]
push ebx
push eax
mov dword [ebp - 0xbe0], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa78]
push 0x54
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xbd0], ebx
lea eax, [ebp - 0x55c]
mov dword [ebp - 0xbe4], ebx
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xc04], ebx
push 0x2c
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x400]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x412455
mov edi, dword [ebp - 0xba8]
mov esi, dword [0x41c078]
mov ecx, esi
push 7
push edi
call dword [0x41f4a8]
call esi
test eax, eax
jne 0x410a85
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x412455
mov esi, dword [0x41c084]
lea ecx, [ebp - 0x918]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x41f4a8]
call esi
test eax, eax
je 0x410ac7
mov eax, dword [ebp - 0x904]
mov dword [ebp - 0xbd0], eax
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0x910]
mov dword [ebp - 0xc04], eax
mov esi, dword [0x41c058]
mov ecx, esi
push edi
call dword [0x41f4a8]
call esi
mov esi, eax
mov dword [ebp - 0xb90], esi
test esi, esi
je 0x410a7a
push 0x2c
lea eax, [ebp - 0x55c]
mov dword [ebp - 0xcfc], ebx
push ebx
mov edi, ebx
push eax
mov dword [ebp - 0xc14], edi
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x82c]
add esp, 0xc
sub eax, dword [ebp - 0x834]
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0x830]
sub eax, dword [ebp - 0x828]
mov dword [ebp - 0x554], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x55c], 0x28
mov word [ebp - 0x550], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x54e], ax
lea eax, [ebp - 0xcfc]
push eax
push ebx
lea eax, [ebp - 0x55c]
push eax
push esi
mov esi, dword [0x41c05c]
mov ecx, esi
call dword [0x41f4a8]
call esi
mov dword [ebp - 0xbd4], eax
test eax, eax
jne 0x410b99
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x410b89
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x410f6d
mov edi, 0x80004005
jmp 0x410f6d
mov esi, dword [0x41c084]
lea ecx, [ebp - 0xa78]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x41f4a8]
call esi
test eax, eax
je 0x410bc3
mov eax, dword [ebp - 0xa64]
mov dword [ebp - 0xbe4], eax
mov eax, dword [ebp - 0x82c]
sub eax, dword [ebp - 0x834]
push dword [ebp - 0xbd4]
mov esi, dword [0x41c08c]
mov ecx, esi
push dword [ebp - 0xb90]
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0x828]
sub eax, dword [ebp - 0x830]
mov dword [ebp - 0x3f4], eax
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c090]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xb90]
call dword [0x41f4a8]
call esi
push dword [ebp - 0xb94]
mov esi, dword [0x41c08c]
mov ecx, esi
push dword [ebp - 0xb90]
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c088]
mov ecx, esi
push ebx
mov dword [ebp - 0xbdc], eax
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c0c4]
mov ecx, esi
push eax
lea eax, [ebp - 0x400]
push eax
push dword [ebp - 0xb90]
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c0bc]
lea eax, [ebp - 0x400]
push ebx
push dword [ebp - 0xbbc]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xbe0]
push dword [ebp - 0xb90]
call dword [0x41f4a8]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xbd8], eax
jne 0x410cd4
cmp dword [ebp - 0xbe8], 0
je 0x410cc8
mov esi, dword [0x41c0dc]
mov ecx, esi
push 8
call dword [0x41f4a8]
call esi
mov dword [ebp - 0xb98], eax
jmp 0x410cde
mov dword [ebp - 0xb98], 0xffffff
jmp 0x410cde
mov dword [ebp - 0xb98], 0xffa8a8a8
mov esi, dword [ebp - 0x834]
mov eax, ebx
mov ecx, dword [ebp - 0x830]
mov edx, ebx
mov dword [ebp - 0xbc0], esi
mov dword [ebp - 0xbb8], ebx
mov dword [ebp - 0xbac], eax
test esi, esi
jns 0x410d14
mov edx, esi
mov dword [ebp - 0xbc0], ebx
neg edx
mov dword [ebp - 0xbb8], edx
test ecx, ecx
jns 0x410d24
mov eax, ecx
mov ecx, ebx
neg eax
mov dword [ebp - 0xbac], eax
mov esi, dword [ebp - 0xba4]
sub esi, dword [ebp - 0xbc0]
mov dword [ebp - 0xb94], esi
mov esi, dword [ebp - 0x3f8]
sub esi, edx
mov edx, dword [ebp - 0xb94]
mov dword [ebp - 0xbec], esi
cmp esi, edx
jl 0x410d56
mov esi, edx
mov dword [ebp - 0xbec], edx
mov edx, dword [ebp - 0x3f4]
sub dword [ebp - 0xc04], ecx
sub edx, eax
mov eax, dword [ebp - 0xc04]
mov dword [ebp - 0xbf4], edx
cmp edx, eax
jl 0x410d7c
mov edx, eax
mov dword [ebp - 0xbf4], eax
test esi, esi
jle 0x410f36
test edx, edx
jle 0x410f36
mov ebx, dword [ebp - 0x3f8]
mov eax, ebx
imul eax, dword [ebp - 0xbac]
mov esi, dword [ebp - 0xbe4]
mov edi, dword [ebp - 0xba4]
imul ecx, edi
shl ebx, 2
add eax, dword [ebp - 0xbb8]
mov dword [ebp - 0xb94], ebx
add ecx, dword [ebp - 0xbc0]
lea eax, [esi + eax*4]
shl edi, 2
mov esi, dword [ebp - 0xbd0]
mov dword [ebp - 0xbe4], eax
mov dword [ebp - 0xbe0], edi
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0xbec]
mov dword [ebp - 0xbd0], ecx
test esi, esi
jle 0x410f0f
mov ebx, ecx
mov dword [ebp - 0xbb8], esi
lea edx, [ecx + 3]
sub ebx, eax
mov dword [ebp - 0xbf0], edx
lea edi, [eax + 2]
mov dword [ebp - 0xbac], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x410ed0
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xb98]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbac]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xbf0]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xb98]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbf0]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xb96]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbf0]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xbb8]
cdq
idiv ecx
mov edx, dword [ebp - 0xbf0]
add al, bl
mov ebx, dword [ebp - 0xbac]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [ebp - 0xbf0], edx
mov dword [ebp - 0xbb8], esi
jne 0x410e0a
mov edx, dword [ebp - 0xbf4]
mov esi, dword [ebp - 0xbec]
mov eax, dword [ebp - 0xbe4]
mov ecx, dword [ebp - 0xbd0]
mov ebx, dword [ebp - 0xb94]
mov edi, dword [ebp - 0xbe0]
add eax, ebx
add ecx, edi
sub edx, 1
mov dword [ebp - 0xbe4], eax
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xbf4], edx
jne 0x410de6
mov edi, dword [ebp - 0xc14]
xor ebx, ebx
push dword [ebp - 0xbd4]
mov esi, dword [0x41c06c]
mov ecx, esi
call dword [0x41f4a8]
call esi
mov eax, dword [ebp - 0xbdc]
test eax, eax
je 0x410f6d
mov esi, dword [0x41c08c]
mov ecx, esi
push eax
push dword [ebp - 0xb90]
call dword [0x41f4a8]
call esi
push dword [ebp - 0xb90]
mov esi, dword [0x41c068]
mov ecx, esi
call dword [0x41f4a8]
call esi
test edi, edi
js 0x412455
mov eax, dword [ebp - 0x854]
mov esi, dword [ebp - 0x84c]
mov dword [ebp - 0xbe8], eax
mov eax, dword [ebp - 0x840]
push 0x54
mov dword [ebp - 0xb94], eax
lea eax, [ebp - 0x970]
push ebx
push eax
mov dword [ebp - 0xbe0], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xad0]
push 0x54
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xbe4], ebx
lea eax, [ebp - 0x588]
mov dword [ebp - 0xbb8], ebx
mov dword [ebp - 0xba4], ebx
mov dword [ebp - 0xb98], ebx
push 0x2c
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x3f0]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test esi, esi
je 0x412455
mov edi, dword [ebp - 0xba8]
mov esi, dword [0x41c078]
mov ecx, esi
push 7
push edi
call dword [0x41f4a8]
call esi
test eax, eax
je 0x410a7a
mov esi, dword [0x41c084]
lea ecx, [ebp - 0x970]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x41f4a8]
call esi
test eax, eax
je 0x411074
mov eax, dword [ebp - 0x95c]
mov dword [ebp - 0xbe4], eax
mov eax, dword [ebp - 0x96c]
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0x968]
mov dword [ebp - 0xb98], eax
mov esi, dword [0x41c058]
mov ecx, esi
push edi
call dword [0x41f4a8]
call esi
mov esi, eax
mov dword [ebp - 0xb90], esi
test esi, esi
je 0x410a7a
push 0x2c
lea eax, [ebp - 0x588]
mov dword [ebp - 0xcf8], ebx
push ebx
mov edi, ebx
push eax
mov dword [ebp - 0xc14], edi
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x81c]
add esp, 0xc
sub eax, dword [ebp - 0x824]
mov dword [ebp - 0x584], eax
mov eax, dword [ebp - 0x820]
sub eax, dword [ebp - 0x818]
mov dword [ebp - 0x580], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x588], 0x28
mov word [ebp - 0x57c], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x57a], ax
lea eax, [ebp - 0xcf8]
push eax
push ebx
lea eax, [ebp - 0x588]
push eax
push esi
mov esi, dword [0x41c05c]
mov ecx, esi
call dword [0x41f4a8]
call esi
mov dword [ebp - 0xbd4], eax
test eax, eax
jne 0x41114a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jle 0x41113a
movzx edi, di
or edi, 0x80070000
test edi, edi
js 0x411503
mov edi, 0x80004005
jmp 0x411503
mov esi, dword [0x41c084]
lea ecx, [ebp - 0xad0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x41f4a8]
call esi
test eax, eax
je 0x411174
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0xbb8], eax
mov eax, dword [ebp - 0x81c]
sub eax, dword [ebp - 0x824]
push dword [ebp - 0xbd4]
mov esi, dword [0x41c08c]
mov ecx, esi
push dword [ebp - 0xb90]
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp - 0x818]
sub eax, dword [ebp - 0x820]
mov dword [ebp - 0x3e4], eax
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c090]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xb90]
call dword [0x41f4a8]
call esi
push dword [ebp - 0xb94]
mov esi, dword [0x41c08c]
mov ecx, esi
push dword [ebp - 0xb90]
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c088]
mov ecx, esi
push ebx
mov dword [ebp - 0xc10], eax
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c0c4]
mov ecx, esi
push eax
lea eax, [ebp - 0x3f0]
push eax
push dword [ebp - 0xb90]
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c0bc]
lea eax, [ebp - 0x3f0]
push ebx
push dword [ebp - 0xbbc]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xbe0]
push dword [ebp - 0xb90]
call dword [0x41f4a8]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xbd8], eax
jne 0x41127f
cmp dword [ebp - 0xbe8], 0
je 0x411273
mov esi, dword [0x41c0dc]
mov ecx, esi
push 8
call dword [0x41f4a8]
call esi
jmp 0x411284
mov dword [ebp - 0xbec], 0xffffff
jmp 0x411290
mov eax, 0xffa8a8a8
mov dword [ebp - 0xbec], eax
mov dword [ebp - 0xbc4], eax
mov esi, dword [ebp - 0x824]
mov edx, ebx
mov eax, dword [ebp - 0x820]
mov ecx, ebx
mov dword [ebp - 0xbc0], esi
mov dword [ebp - 0xbac], ebx
test esi, esi
jns 0x4112c0
mov edx, esi
mov dword [ebp - 0xbc0], ebx
neg edx
mov dword [ebp - 0xbac], edx
test eax, eax
jns 0x4112ca
mov ecx, eax
mov eax, ebx
neg ecx
mov esi, dword [ebp - 0x3e8]
sub esi, edx
mov edx, dword [ebp - 0xba4]
sub edx, dword [ebp - 0xbc0]
mov dword [ebp - 0xbf4], esi
cmp esi, edx
jl 0x4112f0
mov esi, edx
mov dword [ebp - 0xbf4], edx
mov edx, dword [ebp - 0x3e4]
sub dword [ebp - 0xb98], eax
sub edx, ecx
mov dword [ebp - 0xbdc], edx
cmp edx, dword [ebp - 0xb98]
jl 0x411318
mov edx, dword [ebp - 0xb98]
mov dword [ebp - 0xbdc], edx
test esi, esi
jle 0x4114cc
test edx, edx
jle 0x4114cc
mov ebx, dword [ebp - 0x3e8]
mov edi, dword [ebp - 0xbb8]
mov esi, dword [ebp - 0xbe4]
imul ecx, ebx
shl ebx, 2
mov dword [ebp - 0xb94], ebx
add ecx, dword [ebp - 0xbac]
lea ecx, [edi + ecx*4]
mov edi, dword [ebp - 0xba4]
imul eax, edi
mov dword [ebp - 0xbd0], ecx
add eax, dword [ebp - 0xbc0]
shl edi, 2
mov dword [ebp - 0xbe0], edi
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xbf4]
mov dword [ebp - 0xbe4], eax
test esi, esi
jle 0x4114a5
mov ebx, eax
mov dword [ebp - 0xbb8], esi
lea edx, [eax + 3]
sub ebx, ecx
mov dword [ebp - 0xb98], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xbac], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x411466
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xbc4]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbac]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xb98]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xbc4]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb98]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xbea]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb98]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xbb8]
cdq
idiv ecx
mov edx, dword [ebp - 0xb98]
add al, bl
mov ebx, dword [ebp - 0xbac]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [ebp - 0xb98], edx
mov dword [ebp - 0xbb8], esi
jne 0x4113a0
mov edx, dword [ebp - 0xbdc]
mov esi, dword [ebp - 0xbf4]
mov ecx, dword [ebp - 0xbd0]
mov eax, dword [ebp - 0xbe4]
mov ebx, dword [ebp - 0xb94]
mov edi, dword [ebp - 0xbe0]
add ecx, ebx
add eax, edi
sub edx, 1
mov dword [ebp - 0xbd0], ecx
mov dword [ebp - 0xbe4], eax
mov dword [ebp - 0xbdc], edx
jne 0x41137c
mov edi, dword [ebp - 0xc14]
xor ebx, ebx
push dword [ebp - 0xbd4]
mov esi, dword [0x41c06c]
mov ecx, esi
call dword [0x41f4a8]
call esi
mov eax, dword [ebp - 0xc10]
test eax, eax
je 0x411503
mov esi, dword [0x41c08c]
mov ecx, esi
push eax
push dword [ebp - 0xb90]
call dword [0x41f4a8]
call esi
push dword [ebp - 0xb90]
mov esi, dword [0x41c068]
mov ecx, esi
call dword [0x41f4a8]
call esi
test edi, edi
js 0x412455
mov edi, ebx
jmp 0x412401
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x854], 0
jne 0x41153c
cmp edi, ecx
je 0x41153c
mov al, 0xc0
jmp 0x41153e
or al, 0xff
mov byte [ebp - 0xbda], al
lea edi, [ebp - 0x3b0]
xor eax, eax
mov esi, dword [0x41c058]
stosd dword es:[edi], eax
push dword [ebp - 0xba8]
mov byte [ebp - 0xbd9], cl
mov ecx, esi
mov byte [ebp - 0xbdc], bl
stosd dword es:[edi], eax
mov byte [ebp - 0xbdb], bl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x3c0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [0x41f4a8]
call esi
mov dword [ebp - 0xb9c], eax
test eax, eax
jne 0x411599
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x412455
xor eax, eax
inc eax
cmp dword [ebp - 0xbd8], eax
jne 0x4116c2
mov eax, dword [ebp - 0x82c]
mov edx, dword [ebp - 0x81c]
sub edx, dword [ebp - 0x824]
sub eax, dword [ebp - 0x834]
mov dword [ebp - 0xbb4], edx
cmp edx, eax
jg 0x4115d2
mov edx, eax
mov dword [ebp - 0xbb4], eax
mov eax, dword [ebp - 0x818]
mov edi, ebx
sub eax, dword [ebp - 0x830]
mov ecx, ebx
cmp dword [ebp - 0x858], 0
mov dword [ebp - 0xb88], eax
je 0x41162b
mov edi, dword [ebp - 0x834]
sub edi, dword [ebp - 0x82c]
add edi, edx
mov ecx, edi
mov dword [ebp - 0xc04], ecx
mov dword [ebp - 0x3b0], ecx
mov ecx, dword [ebp - 0x824]
sub ecx, dword [ebp - 0x81c]
add ecx, edx
mov edx, ecx
mov dword [ebp - 0xb8c], edx
mov dword [ebp - 0x3c0], edx
jmp 0x411643
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0xc04], eax
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0xb8c], eax
sub edi, dword [ebp - 0x834]
add edi, dword [ebp - 0x82c]
mov eax, dword [ebp - 0x820]
sub eax, dword [ebp - 0x830]
sub ecx, dword [ebp - 0x824]
add ecx, dword [ebp - 0x81c]
mov dword [ebp - 0xbac], edi
mov dword [ebp - 0x3a8], edi
mov edi, dword [ebp - 0x828]
sub edi, dword [ebp - 0x830]
mov dword [ebp - 0xba4], edi
mov dword [ebp - 0x3a4], edi
mov edi, eax
sub edi, dword [ebp - 0x820]
add edi, dword [ebp - 0x818]
mov dword [ebp - 0xc10], ecx
mov dword [ebp - 0x3b8], ecx
mov dword [ebp - 0xbe0], eax
mov dword [ebp - 0x3bc], eax
mov dword [ebp - 0xbf4], edi
mov dword [ebp - 0x3b4], edi
jmp 0x41174e
mov eax, dword [ebp - 0x398]
lea esi, [ebp - 0x834]
lea edi, [ebp - 0x3b0]
mov dword [ebp - 0xbb4], eax
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0xb88], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x3a4]
lea esi, [ebp - 0x824]
lea edi, [ebp - 0x3c0]
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0x3a8]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0xc04], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0xbf4], eax
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0xc10], eax
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0xbe0], eax
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0xb8c], eax
push 0x2c
lea eax, [ebp - 0x530]
mov dword [ebp - 0xd38], ebx
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xbb4]
add esp, 0xc
mov edi, dword [ebp - 0xb9c]
mov esi, dword [0x41c05c]
mov ecx, esi
mov dword [ebp - 0x52c], eax
mov eax, dword [ebp - 0xb88]
neg eax
mov dword [ebp - 0x530], 0x28
mov dword [ebp - 0x528], eax
xor eax, eax
push 0x20
inc eax
mov word [ebp - 0x524], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x522], ax
lea eax, [ebp - 0xd38]
push eax
push ebx
lea eax, [ebp - 0x530]
push eax
push edi
call dword [0x41f4a8]
call esi
mov dword [ebp - 0xbb0], eax
test eax, eax
jne 0x4117db
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x412440
mov esi, dword [0x41c08c]
mov ecx, esi
push eax
push edi
call dword [0x41f4a8]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xbd8], eax
jne 0x411851
mov ecx, dword [ebp - 0xba0]
test ecx, ecx
je 0x411851
xor eax, eax
mov esi, dword [0x41c0c4]
lea edi, [ebp - 0x428]
stosd dword es:[edi], eax
push ecx
mov ecx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xbb4]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0xb88]
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x428]
push eax
mov eax, dword [ebp - 0xb9c]
push eax
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x424], ebx
call dword [0x41f4a8]
call esi
mov eax, dword [ebp - 0x854]
mov esi, dword [ebp - 0x850]
mov dword [ebp - 0xbd4], eax
mov eax, dword [ebp - 0x844]
push 0x54
mov dword [ebp - 0xb94], eax
lea eax, [ebp - 0x9c8]
push ebx
push eax
mov dword [ebp - 0xbd0], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xb80]
push 0x54
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xbe4], ebx
lea eax, [ebp - 0x504]
mov dword [ebp - 0xbb8], ebx
mov dword [ebp - 0xc1c], ebx
mov dword [ebp - 0xb98], ebx
push 0x2c
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x3e0]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xb9c]
test esi, esi
je 0x412425
mov esi, dword [0x41c078]
mov ecx, esi
push 7
push edi
call dword [0x41f4a8]
call esi
test eax, eax
jne 0x4118ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x412425
mov esi, dword [0x41c084]
lea ecx, [ebp - 0x9c8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x41f4a8]
call esi
test eax, eax
je 0x411941
mov eax, dword [ebp - 0x9b4]
mov dword [ebp - 0xbe4], eax
mov eax, dword [ebp - 0x9c4]
mov dword [ebp - 0xc1c], eax
mov eax, dword [ebp - 0x9c0]
mov dword [ebp - 0xb98], eax
mov esi, dword [0x41c058]
mov ecx, esi
push edi
call dword [0x41f4a8]
call esi
mov esi, eax
mov dword [ebp - 0xb90], esi
test esi, esi
je 0x4118f4
push 0x2c
lea eax, [ebp - 0x504]
mov dword [ebp - 0xd2c], ebx
push ebx
push eax
mov dword [ebp - 0xc08], ebx
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x3ac]
add esp, 0xc
sub eax, dword [ebp - 0xba4]
mov edi, dword [ebp - 0xbac]
sub edi, dword [ebp - 0xc04]
mov dword [ebp - 0x4fc], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x504], 0x28
mov word [ebp - 0x4f8], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x4f6], ax
lea eax, [ebp - 0xd2c]
push eax
push ebx
lea eax, [ebp - 0x504]
mov dword [ebp - 0x500], edi
push eax
push esi
mov esi, dword [0x41c05c]
mov ecx, esi
call dword [0x41f4a8]
call esi
mov dword [ebp - 0xbe8], eax
test eax, eax
jne 0x411a1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc08], eax
test eax, eax
jle 0x411a0a
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xc08], eax
test eax, eax
js 0x411dc1
mov dword [ebp - 0xc08], 0x80004005
jmp 0x411dc1
mov esi, dword [0x41c084]
lea ecx, [ebp - 0xb80]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x41f4a8]
call esi
test eax, eax
je 0x411a49
mov eax, dword [ebp - 0xb6c]
mov dword [ebp - 0xbb8], eax
push dword [ebp - 0xbe8]
mov eax, dword [ebp - 0xba4]
push dword [ebp - 0xb90]
mov esi, dword [0x41c08c]
mov ecx, esi
mov dword [ebp - 0x3d8], edi
mov edi, dword [ebp - 0x3ac]
sub eax, edi
mov dword [ebp - 0x3d4], eax
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c090]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xb90]
call dword [0x41f4a8]
call esi
push dword [ebp - 0xb94]
mov esi, dword [0x41c08c]
mov ecx, esi
push dword [ebp - 0xb90]
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c088]
mov ecx, esi
push ebx
mov dword [ebp - 0xb94], eax
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c0c4]
mov ecx, esi
push eax
lea eax, [ebp - 0x3e0]
push eax
push dword [ebp - 0xb90]
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c0bc]
lea eax, [ebp - 0x3e0]
push ebx
push dword [ebp - 0xbbc]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xbd0]
push dword [ebp - 0xb90]
call dword [0x41f4a8]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xbd8], eax
jne 0x411b50
cmp dword [ebp - 0xbd4], 0
je 0x411b44
mov esi, dword [0x41c0dc]
mov ecx, esi
push 8
call dword [0x41f4a8]
call esi
mov dword [ebp - 0xbf0], eax
jmp 0x411b5a
mov dword [ebp - 0xbf0], 0xffffff
jmp 0x411b5a
mov dword [ebp - 0xbf0], 0xffa8a8a8
mov ecx, dword [ebp - 0xc04]
mov eax, ebx
mov dword [ebp - 0xba4], ebx
test ecx, ecx
jns 0x411b78
mov edx, ecx
mov ecx, ebx
neg edx
mov dword [ebp - 0xba4], edx
test edi, edi
jns 0x411b82
mov eax, edi
mov edi, ebx
neg eax
mov edx, dword [ebp - 0xc1c]
mov esi, dword [ebp - 0x3d8]
sub edx, ecx
sub esi, dword [ebp - 0xba4]
mov dword [ebp - 0xbc0], esi
cmp esi, edx
jl 0x411ba8
mov esi, edx
mov dword [ebp - 0xbc0], edx
mov edx, dword [ebp - 0x3d4]
sub dword [ebp - 0xb98], edi
sub edx, eax
mov dword [ebp - 0xbec], edx
cmp edx, dword [ebp - 0xb98]
jl 0x411bd0
mov edx, dword [ebp - 0xb98]
mov dword [ebp - 0xbec], edx
test esi, esi
jle 0x411d8a
test edx, edx
jle 0x411d8a
imul edi, dword [ebp - 0xc1c]
mov ebx, dword [ebp - 0x3d8]
mov esi, dword [ebp - 0xbb8]
imul eax, ebx
shl ebx, 2
add edi, ecx
mov ecx, dword [ebp - 0xbe4]
mov dword [ebp - 0xbe4], ebx
mov ebx, dword [ebp - 0xc1c]
add eax, dword [ebp - 0xba4]
shl ebx, 2
lea ecx, [ecx + edi*4]
mov dword [ebp - 0xbd0], ebx
mov ebx, dword [ebp - 0xbe4]
mov edi, dword [ebp - 0xbd0]
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xbc0]
mov dword [ebp - 0xbd4], eax
mov dword [ebp - 0xc14], ecx
test esi, esi
jle 0x411d69
mov ebx, ecx
mov dword [ebp - 0xbb8], esi
lea edx, [ecx + 3]
sub ebx, eax
mov dword [ebp - 0xb98], edx
lea edi, [eax + 2]
mov dword [ebp - 0xbac], ebx
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x411d2a
mov bl, byte [ebx + edi]
mov eax, dword [ebp - 0xbf0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbac]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xb98]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xbf0]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb98]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xbee]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb98]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xbb8]
cdq
idiv ecx
mov edx, dword [ebp - 0xb98]
add al, bl
mov ebx, dword [ebp - 0xbac]
mov byte [edx], al
add edx, 4
add edi, 4
sub esi, 1
mov dword [ebp - 0xb98], edx
mov dword [ebp - 0xbb8], esi
jne 0x411c64
mov edx, dword [ebp - 0xbec]
mov esi, dword [ebp - 0xbc0]
mov eax, dword [ebp - 0xbd4]
mov ecx, dword [ebp - 0xc14]
mov ebx, dword [ebp - 0xbe4]
mov edi, dword [ebp - 0xbd0]
add eax, ebx
add ecx, edi
sub edx, 1
mov dword [ebp - 0xbd4], eax
mov dword [ebp - 0xc14], ecx
mov dword [ebp - 0xbec], edx
jne 0x411c40
xor ebx, ebx
push dword [ebp - 0xbe8]
mov esi, dword [0x41c06c]
mov ecx, esi
call dword [0x41f4a8]
call esi
mov eax, dword [ebp - 0xb94]
test eax, eax
je 0x411dc1
mov esi, dword [0x41c08c]
mov ecx, esi
push eax
push dword [ebp - 0xb90]
call dword [0x41f4a8]
call esi
push dword [ebp - 0xb90]
mov esi, dword [0x41c068]
mov ecx, esi
call dword [0x41f4a8]
call esi
cmp dword [ebp - 0xc08], 0
jl 0x41241f
mov eax, dword [ebp - 0x854]
mov esi, dword [ebp - 0x84c]
mov dword [ebp - 0xbe4], eax
mov eax, dword [ebp - 0x840]
push 0x54
mov dword [ebp - 0xb94], eax
lea eax, [ebp - 0xa20]
push ebx
push eax
mov dword [ebp - 0xbb8], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xb28]
push 0x54
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xbac], ebx
lea eax, [ebp - 0x5b4]
mov dword [ebp - 0xbe8], ebx
mov dword [ebp - 0xc08], ebx
mov dword [ebp - 0xb98], ebx
push 0x2c
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x3d0]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xb9c]
test esi, esi
je 0x412425
mov esi, dword [0x41c078]
mov ecx, esi
push 7
push edi
call dword [0x41f4a8]
call esi
test eax, eax
je 0x4118f4
mov esi, dword [0x41c084]
lea ecx, [ebp - 0xa20]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x41f4a8]
call esi
test eax, eax
je 0x411ecd
mov eax, dword [ebp - 0xa0c]
mov dword [ebp - 0xbac], eax
mov eax, dword [ebp - 0xa1c]
mov dword [ebp - 0xc08], eax
mov eax, dword [ebp - 0xa18]
mov dword [ebp - 0xb98], eax
mov esi, dword [0x41c058]
mov ecx, esi
push edi
call dword [0x41f4a8]
call esi
mov esi, eax
mov dword [ebp - 0xb90], esi
test esi, esi
je 0x4118f4
push 0x2c
lea eax, [ebp - 0x5b4]
mov dword [ebp - 0xd30], ebx
push ebx
push eax
mov dword [ebp - 0xc04], ebx
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0xc10]
add esp, 0xc
sub eax, dword [ebp - 0xb8c]
mov edi, dword [ebp - 0xbe0]
mov dword [ebp - 0xc10], eax
mov dword [ebp - 0x5b0], eax
mov eax, edi
sub eax, dword [ebp - 0xbf4]
mov dword [ebp - 0x5ac], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x5b4], 0x28
mov word [ebp - 0x5a8], ax
pop eax
push ebx
push ebx
mov word [ebp - 0x5a6], ax
lea eax, [ebp - 0xd30]
push eax
push ebx
lea eax, [ebp - 0x5b4]
push eax
push esi
mov esi, dword [0x41c05c]
mov ecx, esi
call dword [0x41f4a8]
call esi
mov dword [ebp - 0xc14], eax
test eax, eax
jne 0x411fb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc04], eax
test eax, eax
jle 0x411fa2
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xc04], eax
test eax, eax
js 0x41235a
mov dword [ebp - 0xc04], 0x80004005
jmp 0x41235a
mov esi, dword [0x41c084]
lea ecx, [ebp - 0xb28]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0x41f4a8]
call esi
test eax, eax
je 0x411fe1
mov eax, dword [ebp - 0xb14]
mov dword [ebp - 0xbe8], eax
mov eax, dword [ebp - 0xc10]
push dword [ebp - 0xc14]
mov esi, dword [0x41c08c]
mov ecx, esi
push dword [ebp - 0xb90]
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0xbf4]
sub eax, edi
mov dword [ebp - 0x3c4], eax
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c090]
xor eax, eax
inc eax
mov ecx, esi
push eax
push dword [ebp - 0xb90]
call dword [0x41f4a8]
call esi
push dword [ebp - 0xb94]
mov esi, dword [0x41c08c]
mov ecx, esi
push dword [ebp - 0xb90]
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c088]
mov ecx, esi
push ebx
mov dword [ebp - 0xb94], eax
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c0c4]
mov ecx, esi
push eax
lea eax, [ebp - 0x3d0]
push eax
push dword [ebp - 0xb90]
call dword [0x41f4a8]
call esi
mov esi, dword [0x41c0bc]
lea eax, [ebp - 0x3d0]
push ebx
push dword [ebp - 0xbbc]
mov ecx, esi
push eax
push 0xffffffffffffffff
push dword [ebp - 0xbb8]
push dword [ebp - 0xb90]
call dword [0x41f4a8]
call esi
xor eax, eax
inc eax
cmp dword [ebp - 0xbd8], eax
jne 0x4120f0
cmp dword [ebp - 0xbe4], 0
je 0x4120e4
mov esi, dword [0x41c0dc]
mov ecx, esi
push 8
call dword [0x41f4a8]
call esi
mov edx, eax
mov dword [ebp - 0xbc4], edx
mov dword [ebp - 0xba4], edx
jmp 0x412101
mov dword [ebp - 0xba4], 0xffffff
jmp 0x412101
mov eax, 0xffa8a8a8
mov dword [ebp - 0xbc4], eax
mov dword [ebp - 0xba4], eax
mov ecx, dword [ebp - 0xb8c]
mov esi, ebx
mov eax, ebx
test ecx, ecx
jns 0x412119
mov esi, ecx
mov dword [ebp - 0xb8c], ebx
neg esi
test edi, edi
jns 0x412123
mov eax, edi
mov edi, ebx
neg eax
mov edx, dword [ebp - 0x3c8]
mov ecx, dword [ebp - 0xc08]
sub edx, esi
sub ecx, dword [ebp - 0xb8c]
mov dword [ebp - 0xbb8], edx
cmp edx, ecx
jl 0x412149
mov edx, ecx
mov dword [ebp - 0xbb8], ecx
mov ecx, dword [ebp - 0x3c4]
sub dword [ebp - 0xb98], edi
sub ecx, eax
mov dword [ebp - 0xbc0], ecx
cmp ecx, dword [ebp - 0xb98]
jl 0x412171
mov ecx, dword [ebp - 0xb98]
mov dword [ebp - 0xbc0], ecx
test edx, edx
jle 0x412323
test ecx, ecx
jle 0x412323
mov ebx, dword [ebp - 0x3c8]
imul edi, dword [ebp - 0xc08]
imul eax, ebx
shl ebx, 2
add edi, dword [ebp - 0xb8c]
add eax, esi
mov esi, dword [ebp - 0xbe8]
lea eax, [esi + eax*4]
mov esi, dword [ebp - 0xbac]
mov dword [ebp - 0xbac], ebx
mov ebx, dword [ebp - 0xc08]
shl ebx, 2
lea esi, [esi + edi*4]
mov dword [ebp - 0xbe4], ebx
mov ebx, dword [ebp - 0xbac]
mov edi, dword [ebp - 0xbe4]
mov dword [ebp - 0xbd0], eax
mov dword [ebp - 0xbd4], esi
test edx, edx
jle 0x412302
lea ebx, [esi + 3]
mov dword [ebp - 0xbe8], edx
sub esi, eax
mov dword [ebp - 0xb98], ebx
lea edi, [eax + 2]
mov dword [ebp - 0xbe0], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0x4122c3
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xbc4]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xbe0]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xb98]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xbc4]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb98]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xba2]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xb98]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xbe0]
cdq
idiv ecx
mov edx, dword [ebp - 0xbe8]
add al, bl
mov ebx, dword [ebp - 0xb98]
mov byte [ebx], al
add ebx, 4
add edi, 4
sub edx, 1
mov dword [ebp - 0xb98], ebx
mov dword [ebp - 0xbe8], edx
jne 0x4121fd
mov ecx, dword [ebp - 0xbc0]
mov edx, dword [ebp - 0xbb8]
mov eax, dword [ebp - 0xbd0]
mov esi, dword [ebp - 0xbd4]
mov ebx, dword [ebp - 0xbac]
mov edi, dword [ebp - 0xbe4]
add eax, ebx
add esi, edi
sub ecx, 1
mov dword [ebp - 0xbd0], eax
mov dword [ebp - 0xbd4], esi
mov dword [ebp - 0xbc0], ecx
jne 0x4121db
xor ebx, ebx
push dword [ebp - 0xc14]
mov esi, dword [0x41c06c]
mov ecx, esi
call dword [0x41f4a8]
call esi
mov eax, dword [ebp - 0xb94]
test eax, eax
je 0x41235a
mov esi, dword [0x41c08c]
mov ecx, esi
push eax
push dword [ebp - 0xb90]
call dword [0x41f4a8]
call esi
push dword [ebp - 0xb90]
mov esi, dword [0x41c068]
mov ecx, esi
call dword [0x41f4a8]
call esi
cmp dword [ebp - 0xc04], 0
mov edi, dword [ebp - 0xb9c]
jl 0x412425
xor eax, eax
inc eax
cmp dword [ebp - 0xbd8], eax
jne 0x4123c6
mov esi, dword [0x41c050]
mov ecx, esi
push 0xcc0020
push ebx
push ebx
push edi
push dword [ebp - 0xb88]
push dword [ebp - 0xbb4]
push dword [ebp - 0x830]
push dword [ebp - 0x834]
push dword [ebp - 0xba8]
call dword [0x41f4a8]
call esi
jmp 0x412401
push dword [ebp - 0xbdc]
mov ecx, dword [ebp - 0xb88]
mov eax, dword [ebp - 0xbb4]
mov esi, dword [0x41c070]
push ecx
push eax
push ebx
push ebx
push edi
push ecx
push eax
push dword [ebp - 0x39c]
mov ecx, esi
push dword [ebp - 0x3a0]
push dword [ebp - 0xba8]
call dword [0x41f4a8]
call esi
push dword [ebp - 0xbcc]
mov esi, dword [0x41c090]
mov ecx, esi
push dword [ebp - 0xba8]
call dword [0x41f4a8]
call esi
jmp 0x412425
mov edi, dword [ebp - 0xb9c]
mov eax, dword [ebp - 0xbb0]
test eax, eax
je 0x412440
mov esi, dword [0x41c06c]
mov ecx, esi
push eax
call dword [0x41f4a8]
call esi
test edi, edi
je 0x412455
mov esi, dword [0x41c068]
mov ecx, esi
push edi
call dword [0x41f4a8]
call esi
mov eax, dword [ebp - 0xba0]
test eax, eax
je 0x412470
mov esi, dword [0x41c06c]
mov ecx, esi
push eax
call dword [0x41f4a8]
call esi
mov edi, 0x41d55c
mov ecx, dword [ebp - 0x850]
test ecx, ecx
je 0x4124c4
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x412482
mov eax, dword [ebp - 0x850]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x4124aa
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x4124a2
push dword [ebp - 0x850]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x850], ebx
mov ecx, dword [ebp - 0x84c]
test ecx, ecx
je 0x412513
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4124d1
mov eax, dword [ebp - 0x84c]
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x4124f9
mov byte [eax], bl
inc eax
sub ecx, 1
jne 0x4124f1
push dword [ebp - 0x84c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x84c], ebx
mov edx, dword [ebp - 0x848]
test edx, edx
je 0x41255f
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x412522
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0x41254a
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0x41253c
mov edx, dword [ebp - 0x848]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x848], ebx
cmp dword [ebp - 0x844], 0
je 0x412584
push dword [ebp - 0x844]
mov esi, dword [0x41c06c]
mov ecx, esi
call dword [0x41f4a8]
call esi
mov dword [ebp - 0x844], ebx
cmp dword [ebp - 0x840], 0
je 0x4125a9
push dword [ebp - 0x840]
mov esi, dword [0x41c06c]
mov ecx, esi
call dword [0x41f4a8]
call esi
mov dword [ebp - 0x840], ebx
cmp dword [ebp - 0x83c], 0
je 0x4125ce
push dword [ebp - 0x83c]
mov esi, dword [0x41c06c]
mov ecx, esi
call dword [0x41f4a8]
call esi
mov dword [ebp - 0x83c], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x4125d0
mov eax, dword [0x41d558]
push 0
pop ebx
test eax, eax
jle 0x412632
sub eax, 1
mov dword [0x41d558], eax
jne 0x412632
mov esi, ebx
mov eax, dword [esi + 0x41d2d0]
test eax, eax
je 0x412606
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x4125f5
push 0x40
push ebx
push 0x41d2d0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x401010
mov edi, 0x41c050
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x41d55c
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0x41d2c0]
mov esi, dword [0x41c09c]
mov ecx, esi
mov dword [ebp - 0xbd0], eax
call dword [0x41f4a8]
call esi
sub eax, dword [0x41d2a8]
lea edi, [ebp - 0x328]
push 8
mov dword [ebp - 0xbe4], eax
mov edx, 0x41d55c
xor eax, eax
xor ebx, ebx
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x412671
mov eax, dword [0x41d558]
push 0
pop ebx
test eax, eax
jne 0x412cb6
push 0x338
mov edi, ebx
mov dword [ebp - 0xbc0], ebx
push ebx
mov dword [ebp - 0xbbc], edi
mov dword [ebp - 0xbb8], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xbac], eax
test eax, eax
je 0x412c4f
or dword [ebp - 0xbe0], 0xffffffff
mov eax, 0x7f1137f
mov edx, eax
mov dword [ebp - 0x490], 0xab69605e
movzx esi, word [ebp - 0x48e]
mov cl, bl
movzx eax, ax
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0xbac]
shr edx, 0x10
add eax, 7
mov dword [ebp - 0xbb0], ebx
mov dword [ebp - 0xc3c], ebx
mov dword [ebp - 0xc68], edi
mov dword [ebp - 0xbb4], edx
mov dword [ebp - 0xb8c], esi
mov dword [ebp - 0xbe8], eax
mov esi, dword [ebp - 0xc60]
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edx, byte [esi + 2]
shl edx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edx, eax
mov dword [ebp - 0xbcc], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl edx, 8
or edx, eax
mov dword [ebp - 0xba0], edi
movzx eax, byte [esi + 5]
add esi, 8
mov ebx, dword [ebp - 0xba0]
shl edx, 8
or edx, eax
mov dword [ebp - 0xc60], esi
mov edi, edx
mov esi, dword [ebp - 0xba4]
xor edi, dword [ebp - 0xc3c]
mov eax, 0x7f1137f
xor edi, eax
mov dword [ebp - 0xb94], edx
xor edi, ebx
xor edi, 0xab69605e
mov eax, edi
rol eax, 0xa
lea edx, [edi + 0x54969fa2]
rol edx, 5
imul edx, esi
add edx, eax
xor ebx, edx
mov edx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea edx, [ebx + edx]
ror edx, 9
imul edx, dword [ebp - 0xb8c]
sub edx, eax
xor edi, edx
mov eax, edi
sub eax, esi
imul edx, eax, 0x605e
mov eax, edi
shr eax, 0xd
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xb8c]
rol edx, 6
imul edx, dword [ebp - 0xbb4]
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor edi, edx
mov edx, edi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, esi
xor eax, ebx
mov edx, ebx
imul eax, dword [ebp - 0xb8c]
ror edx, 6
xor edx, eax
mov eax, 0x7f1137f
xor edi, edx
add eax, edi
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, edi
rol eax, 2
add edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 8
lea edx, [ebx + 0x54969fa2]
ror edx, 0xe
imul edx, dword [ebp - 0xbb4]
sub edx, eax
xor edi, edx
mov edx, edi
mov eax, edi
xor edx, 0xab69605e
ror eax, 0xa
ror edx, 0xc
imul edx, esi
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xbb4]
imul edx, dword [ebp - 0xb8c]
shr eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
not eax
ror eax, 5
add eax, 0x605e
imul eax, dword [ebp - 0xbb4]
xor ebx, eax
mov esi, ebx
sub esi, dword [ebp - 0xbb4]
xor esi, edi
xor esi, 0xab69605e
mov edx, esi
mov eax, esi
xor edx, dword [ebp - 0xbb4]
rol edx, 2
imul edx, dword [ebp - 0xba4]
shr eax, 2
add edx, eax
mov eax, 0x7f1137f
xor ebx, edx
mov edx, ebx
sub edx, eax
mov eax, ebx
ror edx, 6
imul edx, dword [ebp - 0xb8c]
rol eax, 7
add edx, eax
mov eax, dword [ebp - 0xba4]
xor esi, edx
xor eax, esi
mov edx, esi
imul eax, eax, 0x605e
ror edx, 9
add edx, eax
xor ebx, edx
mov edx, ebx
mov dword [ebp - 0xba0], ebx
xor edx, dword [ebp - 0xb8c]
mov eax, ebx
rol edx, 5
imul edx, dword [ebp - 0xbb4]
rol eax, 7
add edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov ebx, esi
xor ebx, dword [ebp - 0xba0]
xor ebx, edx
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xb8c]
imul eax, dword [ebp - 0xba4]
xor esi, eax
mov eax, esi
sub eax, edx
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
mov eax, ebx
rol eax, 0xe
lea edx, [ebx - 0x54969fa2]
rol edx, 3
imul edx, dword [ebp - 0xbb4]
add edx, eax
xor esi, edx
mov eax, esi
ror eax, 0xe
lea edx, [esi - 0x54969fa2]
rol edx, 0xf
imul edx, dword [ebp - 0xba4]
sub edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
shr eax, 3
xor edx, 0x605e
imul edx, dword [ebp - 0xb8c]
xor edx, eax
xor esi, edx
mov edx, 0x7f1137f
mov eax, esi
xor eax, edx
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xbe0]
rol eax, 2
mov dword [ebp - 0xc3c], esi
xor edx, eax
xor edx, dword [ebp - 0xbb0]
xor ebx, edx
mov edx, dword [ebp - 0xbe8]
mov dword [ebp - 0xc68], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xc3c]
ror dword [ebp - 0xc68], 8
mov byte [edx], al
mov al, byte [ebp - 0xc68]
ror dword [ebp - 0xc3c], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xc3c]
ror dword [ebp - 0xc68], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xc68]
ror dword [ebp - 0xc3c], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xc3c]
ror dword [ebp - 0xc68], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xc68]
ror dword [ebp - 0xc3c], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xc3c]
mov byte [edx - 3], al
add edx, 8
mov edi, dword [ebp - 0xc68]
mov eax, dword [ebp - 0xbcc]
ror dword [ebp - 0xc3c], 8
ror edi, 8
sub dword [ebp - 0xc0c], 1
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp - 0xb94]
mov dword [ebp - 0xc68], edi
mov dword [ebp - 0xbe0], eax
mov dword [ebp - 0xbe8], edx
jne 0x41271d
mov esi, dword [ebp - 0xbac]
xor ebx, ebx
mov eax, ebx
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0x412a92
movzx eax, cl
cdq
cmp eax, dword [0x4025b0]
jne 0x412abd
cmp edx, dword [0x4025b4]
jne 0x412abd
mov edi, esi
mov dword [ebp - 0xbbc], esi
mov esi, ebx
jmp 0x412ad0
or dword [ebp - 0xbc8], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xbb8], 0xc004d501
test esi, esi
je 0x412ae3
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0xbb8], ebx
jl 0x412c49
mov eax, dword [ebp - 0xbc8]
mov esi, edi
push 0x40
push ebx
push 0x41d2d0
mov byte [eax + edi], bl
call sub.msvcrt.dll_memset
add esp, 0xc
cmp byte [edi], bl
je 0x412c56
mov edi, 0x41d2d0
mov ecx, esi
mov edx, esi
lea eax, [ecx + 2]
mov dword [ebp - 0xbcc], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x412b24
sub ecx, dword [ebp - 0xbcc]
push edi
sar ecx, 1
push edx
push ebx
lea esi, [esi + ecx*2]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
je 0x412c42
mov eax, dword [edi]
mov edx, 0x5a4d
mov ecx, ebx
mov dword [ebp - 0xb8c], ecx
cmp word [eax], dx
je 0x412b6c
mov ecx, 0xc000007b
mov dword [ebp - 0xb8c], ecx
jmp 0x412bb4
mov edx, dword [eax + 0x3c]
cmp edx, 0x10000000
jae 0x412b5f
add edx, dword [edi]
cmp edx, dword [edi]
jb 0x412b5f
cmp dword [edx], 0x4550
jne 0x412b5f
movzx eax, word [edx + 0x18]
cmp ax, word [ebp - 0xc48]
je 0x412ba2
cmp ax, word [ebp - 0xc18]
je 0x412ba2
mov ecx, 0xc000000d
jmp 0x412b64
mov eax, dword [edx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [edx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [edx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi + 2]
add esi, 6
mov dword [ebp - 0xc0c], eax
mov dword [ebp - 0xbc8], ebx
test eax, eax
je 0x412c2f
mov edx, esi
mov dword [ebp - 0xb94], esi
lea eax, [edx + 1]
mov dword [ebp - 0xbcc], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x412bdb
sub edx, dword [ebp - 0xbcc]
inc esi
add esi, edx
test ecx, ecx
js 0x412c14
push dword [ebp - 0xb94]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x412c3a
mov ecx, dword [ebp - 0xbc0]
mov dword [ecx*4 + 0x41c050], eax
mov ecx, dword [ebp - 0xb8c]
mov eax, dword [ebp - 0xbc8]
inc dword [ebp - 0xbc0]
inc eax
mov dword [ebp - 0xbc8], eax
cmp eax, dword [ebp - 0xc0c]
jb 0x412bca
add edi, 0x10
cmp byte [esi], bl
jne 0x412b17
mov esi, dword [ebp - 0xb8c]
jmp 0x412c58
mov esi, 0xc000007a
jmp 0x412c58
mov edi, dword [ebp - 0xbbc]
mov esi, 0xc000007a
jmp 0x412c5e
mov esi, ebx
mov edi, dword [ebp - 0xbbc]
test edi, edi
je 0x412c71
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
jns 0x412cb1
mov esi, ebx
mov eax, dword [esi + 0x41d2d0]
test eax, eax
je 0x412c88
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x412c77
push 0x40
push ebx
push 0x41d2d0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x401010
mov edi, 0x41c050
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0x412cbc
mov eax, dword [0x41d558]
inc eax
mov dword [0x41d558], eax
xor eax, eax
mov edi, 0x41d55c
xchg dword [edi], eax
mov eax, dword [ebp - 0xbe4]
xor ecx, ecx
mov esi, dword [0x41c0b8]
inc ecx
mov dword [ebp - 0x324], eax
mov eax, dword [ebp - 0xbd0]
mov dword [ebp - 0x30c], eax
lea eax, [ebp - 0x328]
push eax
push 4
push 0x2021
mov dword [ebp - 0x328], ecx
mov dword [ebp - 0x320], ecx
mov dword [ebp - 0x314], ecx
mov dword [ebp - 0x318], ecx
mov dword [ebp - 0x310], ecx
mov ecx, esi
push ebx
mov dword [ebp - 0x31c], 0x9966f291
call dword [0x41f4a8]
call esi
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0x412d29
mov eax, dword [0x41d558]
push 0
pop ebx
test eax, eax
jle 0x412d8b
sub eax, 1
mov dword [0x41d558], eax
jne 0x412d8b
mov esi, ebx
mov eax, dword [esi + 0x41d2d0]
test eax, eax
je 0x412d5f
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0x412d4e
push 0x40
push ebx
push 0x41d2d0
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x401010
mov edi, 0x41c050
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0x41d55c
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xba8]
mov esi, dword [0x41c100]
mov ecx, esi
push ebx
call dword [0x41f4a8]
call esi
lea ecx, [ebp - 0xd4c]
call fcn.00418d44
xor eax, eax
lea edi, [ebp - 0xc28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xcd8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xbc8], esi
test esi, esi
je 0x414e64
push edi
push 0x41c750
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [ebp - 0xbd8], esi
push 8
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc0c], eax
test eax, eax
je 0x414e66
mov ecx, dword [0x41c748]
mov edi, eax
mov dword [eax], ecx
mov ecx, dword [0x41c74c]
mov dword [eax + 4], ecx
mov dword [ebp - 0xbc4], edi
rdtsc
mov dword [ebp - 0xc60], eax
mov dword [ebp - 0xbb0], edx
mov eax, 0xc4
push eax
push 8
mov dword [ebp - 0xc24], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
test edx, edx
je 0x414e68
mov dword [ebp - 0xc20], edx
mov ecx, ebx
mov dword [ebp - 0xc28], ecx
lea eax, [edx + 4]
cmp eax, edx
jb 0x412e85
mov edi, eax
jmp 0x412e88
or edi, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x412ebd
mov ecx, dword [ebp - 0xc24]
lea eax, [edx + 8]
add ecx, edx
cmp eax, ecx
ja 0x414e56
push 4
pop eax
mov dword [edx], eax
mov dword [edi], eax
mov ecx, dword [ebp - 0xc28]
inc ecx
mov dword [ebp - 0xc28], ecx
test esi, esi
js 0x414e56
cmp dword [ebp - 0xc20], 0
jne 0x412f09
mov edx, dword [ebp - 0xc24]
lea eax, [edx + 0xa4]
cmp eax, edx
jb 0x412ee2
mov esi, eax
jmp 0x412ee5
or esi, 0xffffffff
cmp eax, edx
mov dword [ebp - 0xc24], esi
sbb edi, edi
and edi, 0xc0000095
cmp eax, edx
jb 0x412fd7
inc ecx
mov dword [ebp - 0xc28], ecx
jmp 0x412fdf
mov edx, dword [ebp - 0xc20]
mov esi, ebx
test ecx, ecx
je 0x412f77
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xb94], edx
cmp eax, 4
jb 0x412f29
mov edi, eax
jmp 0x412f2c
or edi, 0xffffffff
cmp eax, 4
jb 0x412f39
mov dword [ebp - 0xd50], edi
jmp 0x412f3f
mov edi, dword [ebp - 0xd50]
cmp eax, 4
jb 0x414e56
lea eax, [edx + edi]
mov dword [ebp - 0xbcc], edx
cmp eax, edx
jb 0x412f59
mov edx, eax
jmp 0x412f5c
or edx, 0xffffffff
cmp eax, dword [ebp - 0xbcc]
sbb edi, edi
and edi, 0xc0000095
cmp eax, dword [ebp - 0xb94]
jb 0x412fd1
inc esi
cmp esi, ecx
jb 0x412f15
lea eax, [edx + 4]
cmp eax, edx
jb 0x412f82
mov esi, eax
jmp 0x412f85
or esi, 0xffffffff
cmp eax, edx
sbb edi, edi
and edi, 0xc0000095
cmp eax, edx
jb 0x412fd1
mov ecx, dword [ebp - 0xc24]
lea eax, [edx + 0xa4]
add ecx, dword [ebp - 0xc20]
cmp eax, ecx
ja 0x414e56
mov eax, 0xa0
push eax
push dword [ebp - 0xbc8]
mov dword [edx], eax
push esi
call sub.msvcrt.dll_memcpy
mov ecx, dword [ebp - 0xc28]
add esp, 0xc
inc ecx
mov dword [ebp - 0xc28], ecx
mov esi, dword [ebp - 0xc24]
test edi, edi
js 0x414e56
cmp dword [ebp - 0xc20], 0
jne 0x41301a
mov eax, esi
lea esi, [eax + 0xc]
mov edx, esi
cmp esi, eax
jae 0x412ff6
or esi, 0xffffffff
cmp edx, eax
mov dword [ebp - 0xc24], esi
sbb edi, edi
and edi, 0xc0000095
cmp edx, eax
jb 0x413100
inc ecx
mov dword [ebp - 0xc28], ecx
jmp 0x413111
mov edx, dword [ebp - 0xc20]
mov dword [ebp - 0xbc8], ebx
test ecx, ecx
je 0x413098
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xb94], edx
cmp eax, 4
jb 0x41303e
mov edi, eax
jmp 0x413041
or edi, 0xffffffff
cmp eax, 4
jb 0x41304e
mov dword [ebp - 0xd54], edi
jmp 0x413054
mov edi, dword [ebp - 0xd54]
cmp eax, 4
jb 0x414e56
lea eax, [edx + edi]
mov dword [ebp - 0xbcc], edx
cmp eax, edx
jb 0x41306e
mov edx, eax
jmp 0x413071
or edx, 0xffffffff
cmp eax, dword [ebp - 0xbcc]
sbb edi, edi
and edi, 0xc0000095
cmp eax, dword [ebp - 0xb94]
jb 0x413100
mov edi, dword [ebp - 0xbc8]
inc edi
mov dword [ebp - 0xbc8], edi
cmp edi, ecx
jb 0x41302a
lea eax, [edx + 4]
cmp eax, edx
jb 0x4130a7
mov dword [ebp - 0xbc8], eax
jmp 0x4130b0
or edi, 0xffffffff
mov dword [ebp - 0xbc8], edi
cmp eax, edx
sbb edi, edi
and edi, 0xc0000095
cmp eax, edx
jb 0x413100
mov ecx, dword [ebp - 0xc20]
lea eax, [edx + 0xc]
add ecx, esi
cmp eax, ecx
ja 0x414e56
mov ecx, dword [ebp - 0xc0c]
mov dword [edx], 8
mov edx, dword [ebp - 0xbc8]
mov eax, dword [ecx]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0xc28]
mov esi, dword [ebp - 0xc24]
inc ecx
mov dword [ebp - 0xc28], ecx
test edi, edi
js 0x414e56
cmp dword [ebp - 0xc20], 0
jne 0x413143
mov eax, esi
lea esi, [eax + 0xc]
mov edx, esi
cmp esi, eax
jae 0x41311f
or esi, 0xffffffff
cmp edx, eax
mov dword [ebp - 0xc24], esi
sbb edi, edi
and edi, 0xc0000095
cmp edx, eax
jb 0x41322a
inc ecx
mov dword [ebp - 0xc28], ecx
jmp 0x413232
mov edx, dword [ebp - 0xc20]
mov dword [ebp - 0xbc8], ebx
test ecx, ecx
je 0x4131c1
mov eax, dword [edx]
add eax, 4
mov dword [ebp - 0xb94], edx
cmp eax, 4
jb 0x413167
mov edi, eax
jmp 0x41316a
or edi, 0xffffffff
cmp eax, 4
jb 0x413177
mov dword [ebp - 0xd58], edi
jmp 0x41317d
mov edi, dword [ebp - 0xd58]
cmp eax, 4
jb 0x414e56
lea eax, [edx + edi]
mov dword [ebp - 0xbcc], edx
cmp eax, edx
jb 0x413197
mov edx, eax
jmp 0x41319a
or edx, 0xffffffff
cmp eax, dword [ebp - 0xbcc]
sbb edi, edi
and edi, 0xc0000095
cmp eax, dword [ebp - 0xb94]
jb 0x41322a
mov edi, dword [ebp - 0xbc8]
inc edi
mov dword [ebp - 0xbc8], edi
cmp edi, ecx
jb 0x413153
lea eax, [edx + 4]
cmp eax, edx
jb 0x4131d0
mov dword [ebp - 0xbc8], eax
jmp 0x4131d9
or edi, 0xffffffff
mov dword [ebp - 0xbc8], edi
cmp eax, edx
sbb edi, edi
and edi, 0xc0000095
cmp eax, edx
jb 0x41322a
mov ecx, dword [ebp - 0xc20]
lea eax, [edx + 0xc]
add ecx, esi
cmp eax, ecx
ja 0x414e56
mov eax, dword [ebp - 0xbc8]
mov ecx, dword [ebp - 0xc60]
mov dword [edx], 8
mov dword [eax], ecx
mov ecx, dword [ebp - 0xbb0]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0xc28]
mov esi, dword [ebp - 0xc24]
inc ecx
mov dword [ebp - 0xc28], ecx
test edi, edi
js 0x414e56
rdtsc
mov edi, ebx
mov dword [ebp - 0xb98], ebx
mov dword [ebp - 0xc18], edi
mov dword [ebp - 0xbbc], ebx
mov dword [ebp - 0xbec], ebx
mov dword [ebp - 0xbe0], ebx
mov dword [ebp - 0xbac], ebx
mov dword [ebp - 0xb9c], ebx
mov dword [ebp - 0xbf4], ebx
mov dword [ebp - 0xbf0], ebx
mov dword [ebp - 0xbdc], ebx
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xb94], edx
lea eax, [esi + 8]
cmp eax, 8
jb 0x41328a
mov edx, eax
jmp 0x41328d
or edx, 0xffffffff
cmp eax, 8
sbb esi, esi
and esi, 0xc0000095
cmp eax, 8
jb 0x413387
lea eax, [edx + 7]
and eax, 0xfffffff8
mov dword [ebp - 0xbc8], eax
cmp eax, edx
jae 0x4132bb
mov esi, 0xc0000095
jmp 0x413387
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x4132dd
mov esi, 0xc0000017
mov edi, ebx
jmp 0x413381
mov eax, dword [ebp - 0xc28]
mov dword [edi], eax
lea eax, [edi + 4]
cmp eax, edi
jb 0x4132f0
mov ecx, eax
jmp 0x4132f3
or ecx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x413368
mov eax, dword [ebp - 0xc24]
mov dword [ecx], eax
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x413314
mov edx, eax
jmp 0x413317
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x413368
mov eax, dword [ebp - 0xbc8]
mov ecx, dword [ebp - 0xbcc]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0xb94]
mov dword [edi + eax - 4], ecx
push dword [ebp - 0xc24]
push dword [ebp - 0xc20]
push edx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xbc8]
add esp, 0xc
mov dword [ebp - 0xb98], edi
mov edi, ebx
mov dword [ebp - 0xc18], eax
test edi, edi
je 0x41337b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xc18]
mov ecx, dword [ebp - 0xc28]
or esi, 0x10000000
jl 0x414c69
cmp dword [ebp - 0xb98], 0
mov dword [ebp - 0xba4], ebx
jne 0x4133ac
mov esi, 0xc000000d
jmp 0x413a36
test edi, edi
je 0x413a31
lea eax, [edi + 8]
push eax
push ebx
mov dword [ebp - 0xbb0], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0xbc0], esi
test esi, esi
je 0x413a2b
mov cl, bl
mov eax, ebx
test edi, edi
je 0x4133f2
mov edx, dword [ebp - 0xb98]
xor cl, byte [eax + edx]
inc eax
cmp eax, edi
jb 0x4133ea
mov eax, ebx
mov dword [ebp - 0x488], 0xb1b54a58
mov dword [ebp - 0xbcc], eax
mov dword [ebp - 0xc70], eax
or eax, 0xffffffff
mov dword [ebp - 0xb88], eax
mov dword [ebp - 0xc50], eax
mov eax, edi
shr eax, 3
mov dword [ebp - 0xc60], eax
test eax, eax
je 0x413868
movzx edx, word [ebp - 0x486]
mov eax, 0xc81ecb17
movzx esi, ax
shr eax, 0x10
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0xbc0]
mov dword [ebp - 0xba8], esi
add eax, 7
mov esi, dword [ebp - 0xb98]
add esi, 2
mov dword [ebp - 0xb90], edx
mov edx, dword [ebp - 0xb88]
mov dword [ebp - 0xba0], eax
mov dword [ebp - 0xbb4], esi
mov dword [ebp - 0xbc8], ebx
mov dword [ebp - 0xc0c], ebx
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xbb4]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xbb4]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xbb4]
shl esi, 8
add dword [ebp - 0xbb4], 8
movzx eax, byte [eax + 5]
or esi, eax
xor edx, esi
mov dword [ebp - 0xb88], edx
lea eax, [edx - 0x4a58]
mov edx, 0xc81ecb17
xor eax, edi
xor eax, edx
xor ebx, eax
xor edx, ebx
mov eax, ebx
ror edx, 0xf
imul edx, dword [ebp - 0xb90]
ror eax, 7
add edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov dword [ebp - 0xb88], eax
lea edx, [eax - 0x4e4ab5a8]
ror eax, 0xa
ror edx, 9
imul edx, dword [ebp - 0xba8]
sub edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xba8]
xor edx, ebx
mov eax, ebx
rol eax, 5
rol edx, 4
imul edx, dword [ebp - 0xb8c]
add edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb88], eax
xor edx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, edx
xor ebx, eax
mov eax, ebx
shr eax, 6
lea edx, [ebx - 0x4a58]
imul edx, dword [ebp - 0xb90]
sub edx, eax
xor dword [ebp - 0xb88], edx
mov edx, dword [ebp - 0xb88]
mov eax, edx
ror eax, 0xf
xor eax, dword [ebp - 0xba8]
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, dword [ebp - 0xb8c]
imul eax, dword [ebp - 0xba8]
xor edx, eax
mov dword [ebp - 0xb88], edx
sub edx, 0xc81ecb17
sub edx, 0x4a58
xor ebx, edx
mov eax, ebx
mov edx, ebx
xor eax, dword [ebp - 0xb8c]
imul eax, dword [ebp - 0xb90]
ror edx, 0xa
xor edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, eax
mov dword [ebp - 0xb88], eax
xor edx, 0x4a58
ror eax, 3
rol edx, 6
imul edx, dword [ebp - 0xba8]
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb88]
mov eax, ebx
ror eax, 0xf
sub eax, dword [ebp - 0xb8c]
imul eax, eax, 0x4a58
xor edx, eax
mov dword [ebp - 0xb88], edx
xor edx, dword [ebp - 0xb8c]
mov eax, dword [ebp - 0xb88]
imul edx, edx, 0x4a58
shr eax, 1
xor edx, eax
mov eax, dword [ebp - 0xb88]
sub eax, dword [ebp - 0xba8]
xor ebx, edx
rol eax, 3
imul edx, eax, 0x4a58
mov eax, dword [ebp - 0xb88]
shr eax, 0xf
xor edx, eax
xor ebx, edx
mov edx, ebx
mov eax, ebx
sub edx, dword [ebp - 0xba8]
imul edx, dword [ebp - 0xb90]
shr eax, 0xd
sub edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0xb88], eax
ror edx, 9
imul edx, dword [ebp - 0xba8]
ror eax, 0xb
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xb88]
mov eax, ebx
sub eax, dword [ebp - 0xb8c]
add eax, 0x4e4ab5a8
xor edx, eax
mov eax, dword [ebp - 0xb90]
mov dword [ebp - 0xb88], edx
xor eax, dword [ebp - 0xb88]
ror edx, 7
imul eax, eax, 0x4a58
sub eax, edx
xor ebx, eax
mov edx, ebx
mov eax, ebx
xor edx, dword [ebp - 0xb8c]
rol edx, 4
imul edx, dword [ebp - 0xb90]
ror eax, 0x10
sub edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, 0xb1b54a58
sub edx, eax
mov dword [ebp - 0xb88], eax
ror edx, 0xa
imul edx, dword [ebp - 0xba8]
ror eax, 4
add edx, eax
xor ebx, edx
mov eax, ebx
ror eax, 9
lea edx, [ebx + 0x4e4ab5a8]
ror edx, 4
imul edx, dword [ebp - 0xb8c]
xor edx, eax
mov eax, 0xc81ecb17
xor dword [ebp - 0xb88], edx
xor eax, dword [ebp - 0xb88]
rol eax, 8
imul edx, eax, 0x4a58
mov eax, dword [ebp - 0xb88]
rol eax, 2
sub edx, eax
xor ebx, edx
mov edx, 0xc81ecb17
sub edx, ebx
mov eax, ebx
ror eax, 0xc
ror edx, 0xb
imul edx, dword [ebp - 0xb90]
sub edx, eax
mov eax, dword [ebp - 0xb88]
xor eax, edx
mov edx, dword [ebp - 0xb90]
xor edx, eax
mov dword [ebp - 0xb88], eax
imul edx, dword [ebp - 0xba8]
shr eax, 8
xor edx, eax
xor ebx, edx
mov edx, dword [ebp - 0xba0]
mov eax, ebx
add dword [ebp - 0xba0], 8
xor ebx, dword [ebp - 0xbc8]
xor eax, 0xc81ecb17
xor eax, dword [ebp - 0xc0c]
xor eax, dword [ebp - 0xb88]
mov dword [ebp - 0xc70], ebx
xor eax, 0xb1b54a58
mov dword [ebp - 0xc50], eax
mov byte [edx - 4], bl
mov al, byte [ebp - 0xc50]
ror dword [ebp - 0xc70], 8
mov byte [edx], al
ror dword [ebp - 0xc50], 8
mov al, byte [ebp - 0xc70]
mov byte [edx - 5], al
mov al, byte [ebp - 0xc50]
ror dword [ebp - 0xc70], 8
mov byte [edx - 1], al
ror dword [ebp - 0xc50], 8
mov al, byte [ebp - 0xc70]
mov byte [edx - 6], al
ror dword [ebp - 0xc70], 8
mov al, byte [ebp - 0xc50]
mov byte [edx - 2], al
ror dword [ebp - 0xc50], 8
mov al, byte [ebp - 0xc70]
mov byte [edx - 7], al
mov al, byte [ebp - 0xc50]
mov byte [edx - 3], al
mov ebx, dword [ebp - 0xc70]
mov edx, dword [ebp - 0xc50]
ror ebx, 8
ror edx, 8
sub dword [ebp - 0xc60], 1
mov dword [ebp - 0xc0c], esi
mov esi, dword [ebp - 0xbb4]
mov dword [ebp - 0xc70], ebx
mov dword [ebp - 0xc50], edx
mov dword [ebp - 0xbc8], edi
jne 0x413480
mov edi, dword [ebp - 0xc18]
xor ebx, ebx
mov esi, dword [ebp - 0xbc0]
movzx eax, cl
cdq
mov dword [esi + edi], eax
mov dword [esi + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x413894
mov esi, 0xc0000017
jmp 0x413993
mov eax, dword [ebp - 0xbb0]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
jne 0x4138b7
mov esi, 0xc0000017
jmp 0x413932
mov dword [edi + 4], eax
push dword [ebp - 0xbb0]
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
pop esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4138b0
mov dword [edi + 0xc], eax
push 0xa0
push 0x41c6a0
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [edi + 0x10], esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
je 0x4138b0
mov dword [edi + 0x14], ecx
mov eax, dword [0x41c740]
mov esi, ebx
mov dword [ecx], eax
mov eax, dword [0x41c744]
mov dword [ebp - 0xba4], edi
mov edi, ebx
mov dword [ecx + 4], eax
test edi, edi
je 0x413993
cmp dword [edi + 4], 0
je 0x413950
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x41396a
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x413984
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x4139a7
mov eax, dword [ebp - 0xba4]
mov edi, ebx
mov dword [ebp - 0xbbc], eax
jmp 0x4139ad
mov edi, dword [ebp - 0xba4]
mov eax, dword [ebp - 0xbc0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x413a23
cmp dword [edi + 4], 0
je 0x4139e0
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x4139fa
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x413a14
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc28]
jmp 0x413a36
mov ecx, dword [ebp - 0xc28]
mov esi, 0xc0000001
or esi, 0x10000000
jl 0x414c69
mov edx, dword [ebp - 0xbbc]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0xb94], eax
mov eax, dword [edx + 8]
mov edx, dword [edx]
add edx, 4
mov dword [ebp - 0xbcc], eax
cmp edx, 4
jb 0x413a68
mov eax, edx
jmp 0x413a6b
or eax, 0xffffffff
cmp edx, 4
sbb esi, esi
and esi, 0xc0000095
cmp edx, 4
jb 0x413b05
lea edx, [eax + 4]
cmp edx, eax
jb 0x413a8a
mov edi, edx
jmp 0x413a8d
or edi, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
cmp edx, eax
jb 0x413b05
mov eax, dword [ebp - 0xbcc]
add eax, edi
cmp eax, edi
jb 0x413aab
mov edx, eax
jmp 0x413aae
or edx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x413b05
lea edi, [edx + 4]
cmp edi, edx
jb 0x413ac7
mov eax, edi
jmp 0x413aca
or eax, 0xffffffff
cmp edi, edx
sbb esi, esi
and esi, 0xc0000095
cmp edi, edx
jb 0x413b05
mov edx, dword [ebp - 0xb94]
add edx, eax
cmp edx, eax
jb 0x413aee
mov edi, edx
mov dword [ebp - 0xba4], edx
jmp 0x413af7
or edi, 0xffffffff
mov dword [ebp - 0xba4], edi
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
cmp edx, eax
jae 0x413b11
mov edi, dword [ebp - 0xdb8]
mov dword [ebp - 0xba4], edi
test esi, esi
js 0x413cd8
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x413b39
mov esi, 0xc0000017
jmp 0x413cd2
mov edx, dword [ebp - 0xbbc]
lea ecx, [edi + 4]
mov eax, dword [edx]
mov dword [edi], eax
cmp ecx, edi
jb 0x413b54
mov eax, ecx
mov dword [ebp - 0xbc8], ecx
jmp 0x413b5d
or eax, 0xffffffff
mov dword [ebp - 0xbc8], eax
cmp ecx, edi
sbb esi, esi
and esi, 0xc0000095
cmp ecx, edi
jb 0x413cbf
push dword [edx]
push dword [edx + 4]
push eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0xbbc]
add esp, 0xc
mov ecx, dword [ebp - 0xbc8]
mov esi, dword [edx]
add esi, ecx
mov dword [ebp - 0xbcc], esi
cmp esi, ecx
jb 0x413b9f
mov dword [ebp - 0xbc8], esi
jmp 0x413ba8
or eax, 0xffffffff
mov dword [ebp - 0xbc8], eax
cmp esi, ecx
sbb esi, esi
and esi, 0xc0000095
cmp dword [ebp - 0xbcc], ecx
jb 0x413cbf
mov ecx, dword [ebp - 0xbc8]
mov eax, dword [edx + 8]
lea esi, [ecx + 4]
mov dword [ecx], eax
mov dword [ebp - 0xbcc], esi
cmp esi, ecx
jb 0x413be0
mov eax, esi
mov dword [ebp - 0xba0], esi
jmp 0x413be9
or eax, 0xffffffff
mov dword [ebp - 0xba0], eax
cmp esi, ecx
sbb esi, esi
and esi, 0xc0000095
cmp dword [ebp - 0xbcc], ecx
jb 0x413cbf
push dword [edx + 8]
push dword [edx + 0xc]
push eax
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0xbbc]
add esp, 0xc
mov esi, dword [ebp - 0xba0]
mov eax, dword [ebp - 0xba0]
add esi, dword [edx + 8]
mov dword [ebp - 0xbcc], esi
cmp esi, eax
jb 0x413c31
mov ecx, esi
jmp 0x413c34
or ecx, 0xffffffff
cmp esi, eax
sbb esi, esi
and esi, 0xc0000095
cmp dword [ebp - 0xbcc], eax
jb 0x413cbf
mov eax, dword [edx + 0x10]
lea esi, [ecx + 4]
mov dword [ecx], eax
mov dword [ebp - 0xbcc], esi
cmp esi, ecx
jb 0x413c62
mov eax, esi
mov dword [ebp - 0xbc8], esi
jmp 0x413c6b
or eax, 0xffffffff
mov dword [ebp - 0xbc8], eax
cmp esi, ecx
sbb esi, esi
and esi, 0xc0000095
cmp dword [ebp - 0xbcc], ecx
jb 0x413cbf
push dword [edx + 0x10]
push dword [edx + 0x14]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xbbc]
add esp, 0xc
mov ecx, dword [ebp - 0xbc8]
mov eax, dword [eax + 0x10]
add eax, ecx
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x413cbf
mov eax, dword [ebp - 0xba4]
mov dword [ebp - 0xbec], edi
mov edi, ebx
mov dword [ebp - 0xbe0], eax
test edi, edi
je 0x413cd2
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc28]
or esi, 0x10000000
jl 0x414c69
mov dword [ebp - 0xc0c], ebx
cmp dword [ebp - 0xc20], 0
jne 0x413d26
mov esi, 0xc000000d
mov eax, ebx
test esi, esi
js 0x414c69
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x413eb4
mov esi, 0xd0000017
jmp 0x414c69
xor eax, eax
inc eax
cmp ecx, eax
jbe 0x413cf3
mov edx, dword [ebp - 0xc20]
mov dword [ebp - 0xbc8], ebx
mov eax, dword [edx]
lea edi, [edx + 4]
mov dword [ebp - 0xbcc], eax
cmp edi, edx
jb 0x413d4c
mov eax, edi
jmp 0x413d4f
or eax, 0xffffffff
cmp edi, edx
sbb esi, esi
and esi, 0xc0000095
cmp edi, edx
jb 0x413da9
mov edx, dword [ebp - 0xbcc]
add edx, eax
mov edi, edx
cmp edx, eax
jae 0x413d6e
or edx, 0xffffffff
cmp edi, eax
sbb esi, esi
and esi, 0xc0000095
cmp edi, eax
jb 0x413da9
mov eax, dword [ebp - 0xbc8]
xor esi, esi
inc eax
inc esi
mov dword [ebp - 0xbc8], eax
cmp eax, esi
jb 0x413d39
lea eax, [edx + 4]
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x413da9
mov eax, dword [edx]
mov dword [ebp - 0xc0c], eax
test esi, esi
js 0x413cf8
cmp ecx, 2
jbe 0x413cf3
mov ecx, dword [ebp - 0xc20]
mov edi, ebx
mov eax, dword [ecx]
lea edx, [ecx + 4]
mov dword [ebp - 0xbcc], eax
cmp edx, ecx
jb 0x413dd5
mov eax, edx
jmp 0x413dd8
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
cmp edx, ecx
jb 0x413e20
mov ecx, dword [ebp - 0xbcc]
add ecx, eax
mov edx, ecx
cmp ecx, eax
jae 0x413df7
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
cmp edx, eax
jb 0x413e20
inc edi
cmp edi, 2
jb 0x413dc2
lea eax, [ecx + 4]
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x413e20
mov edi, dword [ecx]
jmp 0x413e22
mov edi, ebx
test esi, esi
js 0x413cf8
mov eax, dword [ebp - 0xc0c]
add eax, 0x30
cmp eax, 0x30
jb 0x413e3c
mov ecx, eax
jmp 0x413e3f
or ecx, 0xffffffff
cmp eax, 0x30
sbb esi, esi
and esi, 0xc0000095
cmp eax, 0x30
jb 0x413e87
lea edx, [ecx + 4]
cmp edx, ecx
jb 0x413e5a
mov eax, edx
jmp 0x413e5d
or eax, 0xffffffff
cmp edx, ecx
sbb esi, esi
and esi, 0xc0000095
cmp edx, ecx
jb 0x413e87
lea edx, [eax + edi]
cmp edx, eax
jb 0x413e76
mov ecx, edx
jmp 0x413e79
or ecx, 0xffffffff
cmp edx, eax
sbb esi, esi
and esi, 0xc0000095
cmp edx, eax
jae 0x413e8d
mov ecx, dword [ebp - 0xdb4]
test esi, esi
js 0x413cf8
cmp ecx, 0x400000
jbe 0x413ea7
mov esi, 0x8000ffff
jmp 0x414c69
mov eax, ecx
mov dword [ebp - 0xb9c], eax
jmp 0x413cfa
mov dword [ebp - 0xbac], edi
mov eax, dword [ebp - 0xbec]
test eax, eax
jne 0x413ece
mov esi, 0x80070057
jmp 0x414c69
mov dword [ebp - 0xd94], eax
mov eax, dword [ebp - 0xbe0]
mov dword [ebp - 0xd8c], eax
mov eax, dword [ebp - 0xb9c]
mov dword [ebp - 0xd88], eax
lea eax, [ebp - 0xc90]
push eax
xor eax, eax
mov dword [ebp - 0xd90], edi
push 0x401c04
inc eax
mov dword [ebp - 0xd84], ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
test eax, eax
jne 0x413f38
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x413f29
movzx esi, si
or esi, 0x80070000
test esi, esi
mov eax, dword [ebp - 0xb9c]
js 0x413f86
mov esi, 0x80004005
jmp 0x413f86
push 0x404250
push dword [ebp - 0xc90]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x413f12
push ebx
push 0x14
lea eax, [ebp - 0xd94]
mov ecx, esi
push eax
push 0x86
call dword [0x41f4a8]
call esi
mov esi, eax
or esi, 0x10000000
jl 0x413f80
mov eax, dword [ebp - 0xd88]
mov dword [ebp - 0xb9c], eax
jmp 0x413f86
mov eax, dword [ebp - 0xb9c]
cmp esi, 0xd0000023
jne 0x413f98
mov esi, 0x8007007a
jmp 0x414c69
test esi, esi
js 0x414c69
mov dword [ebp - 0xbc0], ebx
cmp eax, 4
jae 0x413fb5
mov esi, 0xc000003e
jmp 0x4143a2
mov ecx, dword [edi]
lea eax, [edi + 4]
mov dword [ebp - 0xba0], ecx
cmp eax, edi
jb 0x413fce
mov edx, eax
mov dword [ebp - 0xc18], eax
jmp 0x413fd7
or edx, 0xffffffff
mov dword [ebp - 0xc18], edx
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x4143a2
mov eax, dword [ebp - 0xb9c]
add eax, 0xfffffffc
cmp eax, ecx
jb 0x413fab
lea edi, [edx + ecx]
cmp edi, edx
jb 0x414001
mov edx, edi
jmp 0x414004
or edx, 0xffffffff
cmp edi, dword [ebp - 0xc18]
sbb esi, esi
and esi, 0xc0000095
cmp edi, dword [ebp - 0xc18]
jb 0x4143a2
lea eax, [ecx + 4]
cmp eax, 4
jb 0x41402a
mov ecx, eax
jmp 0x41402d
or ecx, 0xffffffff
cmp eax, 4
mov edi, 0xc0000095
sbb esi, esi
and esi, edi
cmp eax, 4
jb 0x4143a2
mov eax, dword [ebp - 0xb9c]
sub eax, ecx
cmp eax, 4
jb 0x413fab
mov eax, dword [edx]
mov dword [ebp - 0xc0c], eax
lea eax, [edx + 4]
cmp eax, edx
jb 0x41406a
mov dword [ebp - 0xc48], eax
jmp 0x414071
or dword [ebp - 0xc48], 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, edi
cmp eax, edx
jb 0x4143a2
lea eax, [ecx + 4]
cmp eax, ecx
jb 0x41408a
mov edi, eax
jmp 0x41408d
or edi, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x4143a2
mov eax, dword [ebp - 0xb9c]
mov ecx, dword [ebp - 0xc0c]
sub eax, edi
cmp eax, ecx
jb 0x413fab
mov edx, dword [ebp - 0xc48]
lea esi, [edx + ecx]
cmp esi, edx
jb 0x4140ca
mov dword [ebp - 0xbc8], esi
jmp 0x4140d3
or eax, 0xffffffff
mov dword [ebp - 0xbc8], eax
cmp esi, edx
lea eax, [edx + ecx]
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x4143a2
lea eax, [edi + ecx]
cmp eax, edi
jb 0x4140f3
mov edx, eax
jmp 0x4140f6
or edx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x4143a2
mov eax, dword [ebp - 0xb9c]
sub eax, edx
cmp eax, 4
jb 0x413fab
mov eax, dword [ebp - 0xbc8]
mov edi, dword [eax]
lea ecx, [eax + 4]
mov dword [ebp - 0xbcc], edi
cmp ecx, eax
jb 0x414136
mov dword [ebp - 0xba4], ecx
jmp 0x41413d
or dword [ebp - 0xba4], 0xffffffff
cmp ecx, eax
sbb esi, esi
and esi, 0xc0000095
cmp ecx, eax
jb 0x4143a2
lea eax, [edx + 4]
cmp eax, edx
jb 0x41415a
mov ecx, eax
jmp 0x41415d
or ecx, 0xffffffff
cmp eax, edx
sbb esi, esi
and esi, 0xc0000095
cmp eax, edx
jb 0x4143a2
mov eax, dword [ebp - 0xb9c]
sub eax, ecx
cmp eax, edi
jb 0x413fab
lea eax, [ecx + edi]
cmp eax, ecx
jb 0x41418a
mov edx, eax
jmp 0x41418d
or edx, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x4143a2
mov ecx, dword [ebp - 0xb9c]
mov eax, ecx
sub eax, edx
jne 0x413fab
mov eax, dword [ebp - 0xba0]
mov esi, dword [ebp - 0xc0c]
add eax, 0xc
add eax, esi
add eax, edi
cmp eax, ecx
jne 0x413fab
push 0x18
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x4141eb
mov esi, 0xc0000017
jmp 0x414327
cmp dword [ebp - 0xc18], 0
je 0x414237
mov eax, dword [ebp - 0xba0]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
test ecx, ecx
jne 0x41421c
mov esi, 0xc0000017
jmp 0x4142c6
mov dword [edi + 4], ecx
mov eax, dword [ebp - 0xba0]
push eax
push dword [ebp - 0xc18]
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x41423c
mov dword [edi], ebx
mov dword [edi + 4], ebx
cmp dword [ebp - 0xc48], 0
je 0x414271
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x414212
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xc48]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x414277
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
cmp dword [ebp - 0xba4], 0
je 0x4142b6
mov esi, dword [ebp - 0xbcc]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x414212
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xba4]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x4142bc
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [ebp - 0xbc0], edi
mov esi, ebx
mov edi, ebx
test edi, edi
je 0x414327
cmp dword [edi + 4], 0
je 0x4142e4
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x4142fe
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x414318
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x41433b
mov eax, dword [ebp - 0xbc0]
mov edi, ebx
mov dword [ebp - 0xbf4], eax
jmp 0x414341
mov edi, dword [ebp - 0xbc0]
test edi, edi
je 0x4143a2
cmp dword [edi + 4], 0
je 0x41435f
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x414379
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x414393
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
or esi, 0x10000000
jl 0x414c69
mov ecx, dword [ebp - 0xbf4]
mov edi, ebx
mov dword [ebp - 0xbe8], ebx
test ecx, ecx
jne 0x4143ca
mov esi, 0xd000000d
jmp 0x414c69
mov eax, dword [ecx + 4]
mov dword [ebp - 0xbe0], eax
test eax, eax
je 0x4143c0
mov esi, dword [ecx]
test esi, esi
je 0x4143c0
add esi, 0xfffffff8
push esi
push ebx
mov dword [ebp - 0xc48], esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xbb0], eax
test eax, eax
je 0x4149ea
mov ecx, dword [ebp - 0xbe0]
mov edi, esi
and edi, 7
mov dword [ebp - 0xba0], eax
mov dl, bl
mov dword [ebp - 0x458], 0xab69605e
mov dword [ebp - 0xc0c], ecx
mov eax, ebx
mov dword [ebp - 0xb94], edi
je 0x41498b
or dword [ebp - 0xc2c], 0xffffffff
mov esi, ebx
mov dword [ebp - 0xc34], ebx
mov dword [ebp - 0xc18], ebx
mov dword [ebp - 0xb9c], eax
mov dword [ebp - 0xbcc], ebx
test edi, edi
je 0x4144a9
lea eax, [ecx + 1]
mov dword [ebp - 0xbcc], eax
movzx eax, byte [ecx]
mov ecx, dword [ebp - 0xc6c]
cmp ebx, 4
jge 0x41447d
add ecx, 0xffffffe0
shl eax, cl
or dword [ebp - 0xb9c], eax
jmp 0x414481
shl eax, cl
or esi, eax
sub dword [ebp - 0xc6c], 8
inc ebx
mov eax, dword [ebp - 0xbcc]
mov ecx, eax
cmp ebx, edi
jl 0x414459
mov dword [ebp - 0xc0c], eax
xor ebx, ebx
mov eax, dword [ebp - 0xb9c]
mov dword [ebp - 0xc18], esi
xor eax, 0x92f65a5
mov dword [ebp - 0xbcc], ebx
mov ecx, esi
mov dword [ebp - 0xba8], eax
xor ecx, 0x699a899c
mov dword [ebp - 0xc34], eax
mov dword [ebp - 0xb8c], ecx
mov dword [ebp - 0xc2c], ecx
test edi, edi
je 0x414527
mov esi, dword [ebp - 0xba0]
lea edi, [esi + 1]
mov dword [ebp - 0xbc8], edi
cmp ebx, 4
jge 0x4144f3
rol eax, 8
mov byte [esi], al
jmp 0x4144f8
rol ecx, 8
mov byte [esi], cl
mov edi, dword [ebp - 0xb94]
inc ebx
mov esi, dword [ebp - 0xbc8]
cmp ebx, edi
jl 0x4144de
mov eax, esi
xor ebx, ebx
mov esi, dword [ebp - 0xc2c]
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0xc34]
mov dword [ebp - 0xba8], eax
jmp 0x41452d
mov esi, dword [ebp - 0xb8c]
add edi, 0xfffffffc
test edi, edi
jle 0x414959
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr esi, cl
shl esi, cl
mov dword [ebp - 0xb8c], esi
mov dword [ebp - 0xc2c], esi
mov edi, dword [ebp - 0xba8]
mov esi, dword [ebp - 0xc48]
mov eax, esi
shr eax, 3
mov dword [ebp - 0xc60], eax
test eax, eax
je 0x414922
movzx esi, word [ebp - 0x456]
mov eax, 0x7f1137f
mov ecx, eax
mov dword [ebp - 0xb90], esi
mov esi, dword [ebp - 0xc0c]
movzx eax, ax
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0xba0]
shr ecx, 0x10
add eax, 7
mov dword [ebp - 0xbb4], ecx
add esi, 2
mov dword [ebp - 0xbc8], eax
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx ecx, byte [esi + 2]
shl ecx, 8
shl ebx, 8
or ebx, eax
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or ecx, eax
mov dword [ebp - 0xbcc], ebx
movzx eax, byte [esi + 4]
xor edi, ebx
shl ecx, 8
or ecx, eax
mov dword [ebp - 0xba8], edi
movzx eax, byte [esi + 5]
mov edi, 0x7f1137f
mov ebx, dword [ebp - 0xba8]
add esi, 8
shl ecx, 8
or ecx, eax
mov dword [ebp - 0xc0c], esi
xor edi, ecx
mov esi, dword [ebp - 0xba4]
xor edi, dword [ebp - 0xb8c]
mov dword [ebp - 0xb94], ecx
xor edi, ebx
xor edi, 0xab69605e
mov eax, edi
rol eax, 0xa
lea ecx, [edi + 0x54969fa2]
rol ecx, 5
imul ecx, esi
add ecx, eax
xor ebx, ecx
mov ecx, 0x7f1137f
mov eax, ebx
rol eax, 2
lea ecx, [ecx + ebx]
ror ecx, 9
imul ecx, dword [ebp - 0xb90]
sub ecx, eax
xor edi, ecx
mov eax, edi
sub eax, esi
imul ecx, eax, 0x605e
mov eax, edi
shr eax, 0xd
sub ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xb90]
xor ecx, ebx
mov eax, ebx
rol ecx, 6
imul ecx, dword [ebp - 0xbb4]
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor edi, ecx
mov ecx, edi
xor ecx, 0xab69605e
sub eax, ecx
xor ebx, eax
mov eax, esi
xor eax, ebx
mov ecx, ebx
imul eax, dword [ebp - 0xb90]
ror ecx, 6
xor ecx, eax
mov eax, 0x7f1137f
xor edi, ecx
add eax, edi
ror eax, 0xf
imul ecx, eax, 0x605e
mov eax, edi
rol eax, 2
add ecx, eax
xor ebx, ecx
mov eax, ebx
rol eax, 8
lea ecx, [ebx + 0x54969fa2]
ror ecx, 0xe
imul ecx, dword [ebp - 0xbb4]
sub ecx, eax
xor edi, ecx
mov ecx, edi
mov eax, edi
xor ecx, 0xab69605e
ror eax, 0xa
ror ecx, 0xc
imul ecx, esi
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xbb4]
xor ecx, ebx
mov eax, ebx
imul ecx, dword [ebp - 0xb90]
shr eax, 0xa
xor ecx, eax
xor edi, ecx
mov ecx, dword [ebp - 0xbb4]
mov eax, edi
not eax
ror eax, 5
add eax, 0x605e
imul eax, ecx
xor ebx, eax
mov esi, ebx
sub esi, ecx
xor esi, edi
xor esi, 0xab69605e
xor ecx, esi
mov eax, esi
rol ecx, 2
imul ecx, dword [ebp - 0xba4]
shr eax, 2
add ecx, eax
mov eax, 0x7f1137f
xor ebx, ecx
mov ecx, ebx
sub ecx, eax
mov eax, ebx
ror ecx, 6
imul ecx, dword [ebp - 0xb90]
rol eax, 7
add ecx, eax
mov eax, dword [ebp - 0xba4]
xor esi, ecx
xor eax, esi
mov ecx, esi
imul eax, eax, 0x605e
ror ecx, 9
add ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xb90]
xor ecx, ebx
mov dword [ebp - 0xba8], ebx
rol ecx, 5
mov eax, ebx
imul ecx, dword [ebp - 0xbb4]
rol eax, 7
add ecx, eax
xor esi, ecx
mov ecx, 0x7f1137f
mov ebx, ecx
xor ebx, dword [ebp - 0xba8]
xor ebx, esi
xor ebx, 0xab69605e
mov eax, ebx
ror eax, 3
sub eax, dword [ebp - 0xb90]
imul eax, dword [ebp - 0xba4]
xor esi, eax
mov eax, esi
sub eax, ecx
ror eax, 1
imul ecx, eax, 0x605e
mov eax, esi
ror eax, 6
sub ecx, eax
xor ebx, ecx
mov eax, ebx
rol eax, 0xe
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul ecx, dword [ebp - 0xbb4]
add ecx, eax
xor esi, ecx
mov eax, esi
ror eax, 0xe
lea ecx, [esi - 0x54969fa2]
rol ecx, 0xf
imul ecx, dword [ebp - 0xba4]
sub ecx, eax
xor ebx, ecx
mov ecx, ebx
mov eax, ebx
shr eax, 3
xor ecx, 0x605e
imul ecx, dword [ebp - 0xb90]
xor ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
xor eax, esi
rol eax, 4
imul ecx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xc18]
rol eax, 2
mov dword [ebp - 0xc2c], esi
mov esi, dword [ebp - 0xc0c]
xor ecx, eax
xor ecx, dword [ebp - 0xb9c]
xor ebx, ecx
mov ecx, dword [ebp - 0xbc8]
mov dword [ebp - 0xc34], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xc2c]
ror dword [ebp - 0xc34], 8
mov byte [ecx], al
mov al, byte [ebp - 0xc34]
ror dword [ebp - 0xc2c], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xc2c]
ror dword [ebp - 0xc34], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xc34]
ror dword [ebp - 0xc2c], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xc2c]
ror dword [ebp - 0xc34], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xc2c], 8
mov al, byte [ebp - 0xc34]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xc2c]
mov byte [ecx - 3], al
add ecx, 8
mov eax, dword [ebp - 0xc2c]
mov edi, dword [ebp - 0xc34]
ror eax, 8
mov dword [ebp - 0xb8c], eax
mov dword [ebp - 0xc2c], eax
mov eax, dword [ebp - 0xbcc]
ror edi, 8
sub dword [ebp - 0xc60], 1
mov dword [ebp - 0xb9c], eax
mov eax, dword [ebp - 0xb94]
mov dword [ebp - 0xc34], edi
mov dword [ebp - 0xc18], eax
mov dword [ebp - 0xbc8], ecx
jne 0x4145ad
mov esi, dword [ebp - 0xc48]
xor ebx, ebx
mov ecx, dword [ebp - 0xbb0]
mov eax, ebx
test esi, esi
je 0x414936
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0x41492e
mov edi, dword [ebp - 0xbe0]
movzx eax, dl
cdq
cmp eax, dword [esi + edi]
jne 0x4149b1
cmp edx, dword [esi + edi + 4]
jne 0x4149b1
mov edi, ecx
mov dword [ebp - 0xbe8], esi
mov ecx, ebx
mov esi, ebx
jmp 0x4149b8
mov ecx, ebx
mov dword [ebp - 0xb8c], ecx
mov dword [ebp - 0xc2c], ecx
test edi, edi
jns 0x414550
neg edi
shl edi, 3
mov ecx, edi
shr eax, cl
shl eax, cl
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0xc34], eax
jmp 0x414550
or dword [ebp - 0xc18], 0xffffffff
mov edi, ebx
mov dword [ebp - 0xb9c], ebx
mov dword [ebp - 0xb8c], eax
mov dword [ebp - 0xc2c], eax
mov dword [ebp - 0xc34], edi
jmp 0x41455c
mov esi, 0xc004d501
mov edi, ebx
test ecx, ecx
je 0x4149cb
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x4149ea
mov eax, dword [ebp - 0xbe8]
mov esi, 0x10000000
mov dword [ebp - 0xbf0], edi
mov edi, ebx
mov dword [ebp - 0xbdc], eax
jmp 0x4149ef
mov esi, 0xd0000001
test edi, edi
je 0x414a02
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x414c69
mov edx, dword [ebp - 0xbdc]
cmp edx, 4
jb 0x414c5e
mov edi, dword [ebp - 0xbf0]
mov eax, dword [edi]
mov dword [ebp - 0xb94], eax
lea eax, [edi + 4]
cmp eax, edi
jb 0x414a32
mov ecx, eax
jmp 0x414a35
or ecx, 0xffffffff
cmp eax, edi
sbb esi, esi
and esi, 0xc0000095
cmp eax, edi
jb 0x414c63
lea eax, [edx - 4]
cmp eax, 4
jb 0x414c5e
mov edx, dword [ecx]
lea eax, [ecx + 4]
mov dword [ebp - 0xc60], edx
cmp eax, ecx
jb 0x414a66
mov edi, eax
jmp 0x414a69
or edi, 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x414c63
mov eax, dword [ebp - 0xbdc]
add eax, 0xfffffff8
cmp eax, edx
jb 0x414c5e
lea eax, [edx + 8]
cmp eax, 8
sbb esi, esi
and esi, 0xc0000095
cmp eax, 8
jb 0x414c63
mov eax, dword [ebp - 0xbf0]
lea ecx, [edx + edi]
mov esi, dword [ebp - 0xbdc]
add eax, esi
mov dword [ebp - 0xbcc], ecx
cmp eax, ecx
jb 0x414c5e
sub esi, edx
sub esi, edi
add esi, dword [ebp - 0xbf0]
cmp esi, 8
jae 0x414c5e
mov dword [ebp - 0xba4], ebx
mov eax, ebx
mov dword [ebp - 0xbb0], eax
mov esi, ebx
test edi, edi
je 0x414bf1
lea esi, [edx + edi]
mov ecx, edi
cmp esi, edi
jb 0x414b00
mov eax, esi
mov dword [ebp - 0xc0c], esi
jmp 0x414b09
or eax, 0xffffffff
mov dword [ebp - 0xc0c], eax
cmp esi, edi
sbb esi, esi
and esi, 0xc0000095
cmp dword [ebp - 0xbcc], edi
jb 0x414c4c
cmp edi, eax
jae 0x414beb
lea esi, [ecx + 4]
mov dword [ebp - 0xbcc], esi
cmp esi, ecx
jb 0x414b3c
mov dword [ebp - 0xbc8], esi
jmp 0x414b43
or dword [ebp - 0xbc8], 0xffffffff
cmp esi, ecx
sbb esi, esi
and esi, 0xc0000095
cmp dword [ebp - 0xbcc], ecx
jb 0x414c4c
cmp dword [ebp - 0xbc8], eax
ja 0x414c16
mov eax, dword [ecx]
add eax, 4
cmp eax, 4
jb 0x414b77
mov dword [ebp - 0xbc8], eax
jmp 0x414b7e
or dword [ebp - 0xbc8], 0xffffffff
cmp eax, 4
sbb esi, esi
and esi, 0xc0000095
cmp eax, 4
jb 0x414c4c
mov edx, dword [ebp - 0xbc8]
mov dword [ebp - 0xd64], edx
mov edx, dword [ebp - 0xc60]
mov eax, dword [ebp - 0xd64]
add eax, ecx
cmp eax, ecx
jb 0x414bb8
mov dword [ebp - 0xba0], eax
jmp 0x414bbf
or dword [ebp - 0xba0], 0xffffffff
cmp eax, ecx
sbb esi, esi
and esi, 0xc0000095
cmp eax, ecx
jb 0x414c4c
mov eax, dword [ebp - 0xc0c]
mov ecx, dword [ebp - 0xba0]
cmp ecx, eax
ja 0x414c16
inc dword [ebp - 0xba4]
cmp ecx, eax
jb 0x414b27
cmp ecx, eax
jne 0x414c16
mov eax, ebx
test edx, edx
je 0x414c25
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xbb0], eax
test eax, eax
jne 0x414c1d
mov esi, 0xc0000017
jmp 0x414c4c
mov esi, 0xc000000d
jmp 0x414c63
mov edx, dword [ebp - 0xc60]
mov esi, ebx
test edi, edi
je 0x414c3a
push edx
push edi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xbb0]
add esp, 0xc
mov dword [ebp - 0xcd0], eax
mov eax, dword [ebp - 0xba4]
mov dword [ebp - 0xcd8], eax
test esi, esi
js 0x414c63
mov eax, dword [ebp - 0xb94]
cmp eax, dword [ebp - 0xcd8]
je 0x414c63
mov esi, 0xc000003e
or esi, 0x10000000
mov eax, dword [ebp - 0xb98]
test eax, eax
je 0x414c82
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xbbc]
test edi, edi
je 0x414ce9
cmp dword [edi + 4], 0
je 0x414ca6
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x414cc0
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x414cda
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xbec]
test eax, eax
je 0x414d02
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xbac]
test eax, eax
je 0x414d1b
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0xbf4]
test edi, edi
je 0x414d82
cmp dword [edi + 4], 0
je 0x414d3f
push dword [edi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 4], ebx
cmp dword [edi + 0xc], 0
je 0x414d59
push dword [edi + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0xc], ebx
cmp dword [edi + 0x14], 0
je 0x414d73
push dword [edi + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [edi + 0x14], ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xbf0]
test eax, eax
je 0x414d9b
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
js 0x414e56
xor eax, eax
inc eax
cmp dword [ebp - 0xcd8], eax
jb 0x414e56
mov eax, dword [ebp - 0xcd0]
test eax, eax
je 0x414e56
cmp dword [ebp - 0xcd8], 0
jbe 0x414e56
mov edx, dword [eax]
lea ecx, [eax + 4]
cmp ecx, eax
jb 0x414dda
mov edi, ecx
jmp 0x414ddd
or edi, 0xffffffff
cmp ecx, dword [ebp - 0xcd0]
sbb esi, esi
and esi, 0xc0000095
cmp ecx, dword [ebp - 0xcd0]
jb 0x414dfd
mov eax, edx
neg eax
sbb eax, eax
and eax, edi
jmp 0x414e09
mov edx, dword [ebp - 0xdb0]
mov eax, dword [ebp - 0xdac]
test esi, esi
js 0x414e56
cmp edx, 4
jne 0x414e56
cmp dword [eax], 0
jl 0x414e56
xor eax, eax
inc eax
cmp dword [ebp - 0xcd8], eax
jbe 0x414e56
mov eax, dword [ebp - 0xcd0]
mov esi, ebx
mov edi, dword [eax]
lea edx, [eax + 4]
cmp edx, eax
jb 0x414e37
mov ecx, edx
jmp 0x414e3a
or ecx, 0xffffffff
cmp edx, eax
jb 0x414e56
lea eax, [edi + ecx]
mov edx, eax
cmp eax, ecx
jae 0x414e4a
or eax, 0xffffffff
cmp edx, ecx
jb 0x414e56
xor ecx, ecx
inc esi
inc ecx
cmp esi, ecx
jb 0x414e2a
mov esi, dword [ebp - 0xbd8]
mov edi, dword [ebp - 0xbc4]
jmp 0x414e68
mov esi, ebx
mov edi, ebx
cmp dword [ebp - 0xc20], 0
mov dword [ebp - 0xc24], ebx
mov dword [ebp - 0xc28], ebx
je 0x414e97
push dword [ebp - 0xc20]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0xc20], ebx
mov eax, dword [ebp - 0xcd0]
test eax, eax
je 0x414eb0
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x414ec3
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test edi, edi
je 0x414ed6
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 0xca4]
mov dword [ebp - 0xca4], ebx
mov dword [ebp - 0xce8], eax
jmp 0x40b5be
cmp eax, 0xd00000e5
je 0x414f09
cmp eax, 0xc004d501
je 0x414f09
cmp eax, 0xd000003e
jne 0x414f0b
mov eax, 0xc004f028
jmp 0x414f16
mov eax, edi
test eax, eax
jns 0x414f1a
cmp eax, 0x8007007a
je 0x414f23
mov ebx, eax
jmp 0x414f28
cmp dword [ebp - 0xca8], 4
je 0x414f28
mov ebx, 0xc004f01e
lea ecx, [ebp - 0xce8]
call fcn.00418d0d
cmp ebx, edi
je 0x40a9f9
cmp ebx, 0xc004d301
je 0x40a9f9
cmp ebx, 0xc004d500
jle 0x414f5b
cmp ebx, 0xc004d502
jle 0x40a9f9
test ebx, ebx
jns 0x40a9f9
cmp ebx, esi
je 0x40a9f9
mov ecx, ebx
call fcn.00418cf5
jmp 0x40a9f9