Function at 0xb84f7d
Capabilities:
Check os version
Encode data using xor
Execute anti-debugging instructions
Get number of processors
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xec4
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
xor edx, edx
mov dword [ebp - 0xd80], ecx
push ebx
xor eax, eax
mov dword [ebp - 0xbf0], edx
push esi
inc eax
mov dword [ebp - 0xc78], edx
push edi
mov dword [ebp - 0xd78], edx
mov ebx, 0xd0aed4
mov dword [ebp - 0xc50], edx
mov dword [ebp - 0xab8], edx
mov dword [ebp - 0xc38], eax
mov ecx, eax
xor eax, eax
lock cmpxchg dword [ebx], ecx
push 1
test eax, eax
pop eax
jne 0xb84fc9
mov eax, dword [0xd0a150]
or ebx, 0xffffffff
mov dword [ebp - 0xc08], ebx
mov dword [ebp - 0xb70], 0xb2bef2
mov dword [ebp - 0xbe0], 0x67
mov dword [ebp - 0xbdc], 0x337
mov dword [ebp - 0xbc4], 0x10b
mov dword [ebp - 0xbbc], 0x20b
test eax, eax
jne 0xb855c2
push 0x338
mov esi, edx
mov dword [ebp - 0xad8], edx
push edx
mov dword [ebp - 0xa9c], edx
mov dword [ebp - 0xab0], esi
mov dword [ebp - 0xb64], edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb78], eax
test eax, eax
je 0xbfa8d2
xor edx, edx
mov dword [ebp - 0x3f8], 0xab69605e
mov edi, edx
mov dword [ebp - 0x3f4], 0x7f1137f
add eax, 7
mov dword [ebp - 0xafc], edx
mov cl, dl
mov dword [ebp - 0xc18], ebx
mov dword [ebp - 0xb54], edx
mov esi, 0xb2bef2
mov dword [ebp - 0xb7c], edi
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0xb00], 0x67
movzx edx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx ebx, byte [esi + 2]
shl edx, 8
or edx, eax
shl ebx, 8
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
or ebx, eax
mov dword [ebp - 0xb90], edx
movzx eax, byte [esi + 4]
xor edi, edx
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 5]
add esi, 8
shl ebx, 8
or ebx, eax
mov dword [ebp - 0xc40], esi
mov esi, edi
xor esi, ebx
xor esi, dword [ebp - 0xb54]
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor edi, edx
lea eax, [edi + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, edi
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor edi, edx
mov eax, edi
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor edi, eax
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor edi, edx
lea eax, [edi + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, edi
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edi, eax
mov dword [ebp - 0xb18], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0xb18]
xor edi, 0xab69605e
mov eax, edi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, edi
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xb18], esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
mov eax, esi
xor edi, edx
xor eax, edi
xor eax, 0xac987321
mov dword [ebp - 0xb18], eax
ror eax, 3
sub eax, 0xab69
mov esi, dword [ebp - 0xb18]
imul eax, eax, 0x137f
xor edi, eax
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, edi
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
xor edi, edx
lea eax, [edi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, edi
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xb18], esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, edi
xor edi, dword [ebp - 0xc18]
rol eax, 2
mov dword [ebp - 0xb54], edi
mov dword [ebp - 0xc18], ebx
xor edx, eax
mov eax, esi
xor edx, dword [ebp - 0xafc]
xor eax, edx
mov esi, dword [ebp - 0xc40]
mov edx, dword [ebp - 0xba8]
mov dword [ebp - 0xb7c], eax
mov byte [edx - 4], al
mov al, byte [ebp - 0xb54]
ror dword [ebp - 0xb7c], 8
mov byte [edx], al
mov al, byte [ebp - 0xb7c]
ror dword [ebp - 0xb54], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb54]
ror dword [ebp - 0xb7c], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb7c]
ror dword [ebp - 0xb54], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb54]
ror dword [ebp - 0xb7c], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xb7c]
ror dword [ebp - 0xb54], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xb54]
mov byte [edx - 3], al
add edx, 8
mov eax, dword [ebp - 0xb7c]
ror dword [ebp - 0xb54], 8
ror eax, 8
sub dword [ebp - 0xb00], 1
mov dword [ebp - 0xb18], eax
mov edi, dword [ebp - 0xb18]
mov dword [ebp - 0xb7c], eax
mov eax, dword [ebp - 0xb90]
mov dword [ebp - 0xafc], eax
mov dword [ebp - 0xba8], edx
jne 0xb850a5
mov esi, dword [ebp - 0xb78]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xb853ff
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xbfa863
cmp edx, dword [0xb2c22c]
jne 0xbfa863
mov edi, esi
xor eax, eax
mov dword [ebp - 0xab0], edi
mov esi, eax
mov ebx, 0x337
test esi, esi
jne 0xbfa87d
cmp dword [ebp - 0xb64], 0
jl 0xbfa8cc
xor eax, eax
mov esi, edi
push 0x40
mov byte [ebx + edi], al
mov ebx, 0xd0ae80
push eax
push ebx
call fcn.00bc259b
add esp, 0xc
cmp byte [edi], 0
je 0xb85594
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbf0]
jne 0xb85476
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xbfa8c2
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa9c], edx
cmp word [eax], cx
jne 0xbfa891
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xbfa891
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xbfa891
cmp dword [ecx], 0x4550
jne 0xbfa891
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xbc4]
jne 0xbfa8a8
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xac0], eax
test eax, eax
je 0xb85588
mov ecx, esi
mov dword [ebp - 0xae0], esi
xor eax, eax
mov dword [ebp - 0xcb8], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xb90], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xb8552c
sub ecx, dword [ebp - 0xb90]
inc esi
add esi, ecx
test edx, edx
js 0xbfa8b7
mov ecx, dword [ebp - 0xae0]
lea eax, [ebp - 0xcb8]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa9c], edx
test edx, edx
js 0xb85594
mov eax, dword [ebp - 0xad8]
mov ecx, dword [ebp - 0xcb8]
mov dword [eax*4 + section..data], ecx
inc eax
inc ebx
mov dword [ebp - 0xad8], eax
cmp ebx, dword [ebp - 0xac0]
jb 0xb85513
add edi, 0x10
cmp byte [esi], 0
jne 0xb8546f
mov ebx, dword [ebp - 0xa9c]
mov esi, dword [ebp - 0xab0]
test esi, esi
je 0xb855b5
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xbfa8dc
mov eax, dword [0xd0a150]
inc eax
xor ebx, ebx
mov dword [0xd0a150], eax
xor eax, eax
mov ecx, 0xd0aed4
xchg dword [ecx], eax
mov eax, ebx
mov dword [ebp - 0xad8], ebx
mov dword [ebp - 0xa9c], eax
mov edi, ebx
mov eax, dword fs:[0x30]
mov dword [ebp - 0xab0], ebx
cmp dword [eax + 0x1d4], ebx
je 0xbfaa14
mov esi, dword [0xd08088]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, eax
mov dword [ebp - 0xb90], ecx
test ecx, ecx
je 0xbfa91d
mov eax, ebx
mov esi, ebx
mov dword [ebp - 0xa9c], eax
mov ebx, dword [0xd08098]
lea edx, [ebp - 0xcb4]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xd0cffc]
call ebx
test eax, eax
je 0xb882d2
mov ebx, dword [ebp - 0xa9c]
xor eax, eax
mov dword [ebp - 0xad8], esi
mov esi, eax
test esi, esi
jne 0xbfa95d
test ebx, ebx
js 0xb857bf
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentThreadId]
mov esi, dword [0xd08094]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov ecx, eax
mov dword [ebp - 0xb90], ecx
test ecx, ecx
je 0xbfa971
xor edx, edx
mov eax, edx
mov esi, edx
mov dword [ebp - 0xa9c], eax
mov ebx, dword [0xd08098]
lea edx, [ebp - 0xcb0]
push edx
push eax
push esi
push 2
push ecx
mov ecx, ebx
call dword [0xd0cffc]
call ebx
test eax, eax
je 0xb8831a
mov ebx, dword [ebp - 0xa9c]
xor eax, eax
mov edi, esi
mov esi, eax
test esi, esi
jne 0xbfa9d9
test ebx, ebx
js 0xb857a4
mov eax, dword [ebp - 0xad8]
test eax, eax
je 0xbfaa14
push 4
mov ecx, 0xb2be5c
pop esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xb88362
test dx, dx
je 0xb8571a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xb88362
add eax, esi
add ecx, esi
test dx, dx
jne 0xb856f2
xor ebx, ebx
xor eax, eax
inc ebx
test eax, eax
jne 0xbfaa14
test edi, edi
je 0xbfaa14
mov ecx, 0xb2be6c
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xb8836e
test dx, dx
je 0xb8575e
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xb8836e
add eax, esi
add ecx, esi
test dx, dx
jne 0xb85736
xor ecx, ecx
mov eax, ecx
test eax, eax
jne 0xbfaa14
push esi
lea eax, [ebp - 0xcac]
mov dword [ebp - 0xcac], ecx
push eax
push 0xb
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
push eax
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_GetProcessMitigationPolicy]
test eax, eax
je 0xbfa9ed
test byte [ebp - 0xcac], 0xf
mov eax, ebx
jne 0xbfaa14
mov dword [ebp - 0xab8], eax
mov ebx, dword [ebp - 0xa9c]
test edi, edi
je 0xb857bf
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xad8]
test eax, eax
je 0xb857da
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xbfaa1f
xor ebx, ebx
push 4
pop eax
push eax
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov dword [ebp - 0xb90], eax
test eax, eax
je 0xbfaa2c
mov dword [ebp - 0xafc], eax
lea edi, [ebp - 0xc14]
xor eax, eax
mov dword [ebp - 0xaa0], ebx
stosd dword es:[edi], eax
mov esi, ebx
mov dword [ebp - 0xce0], ebx
mov dword [ebp - 0xcdc], ebx
mov dword [ebp - 0xab4], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xacc], ebx
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xba8], 0x38
mov dword [ebp - 0xae0], ebx
test ebx, ebx
je 0xbfaa50
push edi
push 0xd08d58
push ebx
call fcn.00bc13d0
mov esi, ebx
add esp, 0xc
mov dword [ebp - 0xa98], esi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xac0], ecx
test ecx, ecx
je 0xbfaa50
mov eax, dword [0xd08d50]
mov edi, ecx
mov dword [ecx], eax
mov eax, dword [0xd08d54]
mov dword [ecx + 4], eax
mov dword [ebp - 0xaa0], edi
rdtsc
mov dword [ebp - 0xad0], eax
mov dword [ebp - 0xaa8], edx
xor eax, eax
mov dword [ebp - 0xb0c], eax
lea eax, [ebp - 0xd30]
push eax
push 4
pop ecx
mov edx, ecx
call fcn.00b84e9a
mov esi, dword [ebp - 0xd30]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfaa66
lea eax, [ebp - 0xb0c]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xbfaa93
lea eax, [ebp - 0xd28]
mov edx, 0xa0
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfaa93
mov esi, dword [ebp - 0xd28]
mov ecx, dword [ebp - 0xb0c]
lea eax, [ebp - 0xb0c]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xbfaa93
lea eax, [ebp - 0xd24]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfaa93
mov esi, dword [ebp - 0xd24]
mov ecx, dword [ebp - 0xb0c]
lea eax, [ebp - 0xb0c]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xbfaa93
lea eax, [ebp - 0xd20]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfaa93
mov esi, dword [ebp - 0xd20]
mov ecx, dword [ebp - 0xb0c]
lea eax, [ebp - 0xb0c]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xbfaa93
lea eax, [ebp - 0xca8]
mov edx, SysReAllocString
push eax
mov ecx, 0xb2beb0
call fcn.00b84ebc
test eax, eax
js 0xbfaa6e
mov edx, dword [ebp - 0xca8]
lea eax, [ebp - 0xcfc]
push eax
inc edx
push 4
pop eax
mov dword [ebp - 0xca8], edx
mov ecx, eax
add edx, edx
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfaa93
mov esi, dword [ebp - 0xcfc]
mov ecx, dword [ebp - 0xb0c]
lea eax, [ebp - 0xb0c]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xbfaa93
lea eax, [ebp - 0xcf8]
push eax
push 4
pop ecx
mov edx, ecx
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfaa93
mov esi, dword [ebp - 0xcf8]
mov ecx, dword [ebp - 0xb0c]
lea eax, [ebp - 0xb0c]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xbfaa93
lea eax, [ebp - 0xcf4]
push eax
push 4
pop eax
mov edx, eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfaa93
mov esi, dword [ebp - 0xcf4]
mov ecx, dword [ebp - 0xb0c]
lea eax, [ebp - 0xb0c]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xbfaa93
mov esi, dword [ebp - 0xb0c]
push esi
push 8
mov dword [ebp - 0xce0], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0xadc], edi
test edi, edi
je 0xbfaa7b
mov dword [ebp - 0xcdc], edi
xor eax, eax
mov dword [ebp - 0xaa4], eax
mov dword [ebp - 0xe3c], eax
mov dword [ebp - 0xc24], edi
push 4
pop ecx
lea eax, [ebp - 0xdc8]
mov dword [ebp - 0xdcc], ecx
mov edx, ecx
mov ecx, edi
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfaaa5
lea ecx, [edi + esi]
lea eax, [edi + 8]
cmp eax, ecx
ja 0xbfaa9e
push 4
pop eax
mov dword [edi], eax
xor ecx, ecx
mov eax, dword [ebp - 0xdc8]
mov dword [eax], ecx
xor eax, eax
inc eax
mov dword [ebp - 0xaa4], eax
test ebx, ebx
js 0xbfaa8d
mov esi, edi
mov edi, ecx
mov dword [ebp - 0xc7c], esi
test eax, eax
je 0xb85c33
mov edx, dword [esi]
lea eax, [ebp - 0xda0]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfaab2
mov eax, dword [ebp - 0xda0]
mov dword [ebp - 0xd9c], eax
test ebx, ebx
js 0xbfaabd
lea ecx, [ebp - 0xc7c]
mov edx, eax
push ecx
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfaabd
mov esi, dword [ebp - 0xc7c]
inc edi
cmp edi, dword [ebp - 0xaa4]
jb 0xb85bcd
lea eax, [ebp - 0xdd8]
mov dword [ebp - 0xddc], 0xa0
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00b84e9a
mov edi, dword [ebp - 0xadc]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfaac3
mov ecx, dword [ebp - 0xb0c]
lea eax, [esi + 0xa4]
add ecx, edi
cmp eax, ecx
ja 0xbfaa9e
mov eax, 0xa0
push eax
push dword [ebp - 0xae0]
mov dword [esi], eax
push dword [ebp - 0xdd8]
call fcn.00bc13d0
mov eax, dword [ebp - 0xaa4]
add esp, 0xc
inc eax
mov dword [ebp - 0xaa4], eax
test ebx, ebx
js 0xbfaa8d
mov esi, edi
xor ecx, ecx
mov dword [ebp - 0xc54], esi
mov edi, ecx
test eax, eax
je 0xb85d23
mov edx, dword [esi]
lea eax, [ebp - 0xd98]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfaace
mov eax, dword [ebp - 0xd98]
mov dword [ebp - 0xd8c], eax
test ebx, ebx
js 0xbfaad9
lea ecx, [ebp - 0xc54]
mov edx, eax
push ecx
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfaad9
mov esi, dword [ebp - 0xc54]
inc edi
cmp edi, dword [ebp - 0xaa4]
jb 0xb85cbd
lea eax, [ebp - 0xde0]
mov dword [ebp - 0xde4], 8
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00b84e9a
mov edi, dword [ebp - 0xadc]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfaadf
mov ecx, dword [ebp - 0xb0c]
lea eax, [esi + 0xc]
add ecx, edi
cmp eax, ecx
ja 0xbfaa9e
mov edx, dword [ebp - 0xac0]
mov ecx, dword [ebp - 0xde0]
mov dword [esi], 8
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0xaa4]
inc eax
mov dword [ebp - 0xaa4], eax
test ebx, ebx
js 0xbfaa8d
mov ecx, dword [ebp - 0xad0]
mov esi, edi
mov dword [ebp - 0xe60], ecx
mov ecx, dword [ebp - 0xaa8]
mov dword [ebp - 0xe5c], ecx
xor ecx, ecx
mov edi, ecx
test eax, eax
je 0xb85e28
mov edx, dword [esi]
lea eax, [ebp - 0xd88]
push eax
push 4
pop eax
mov ecx, eax
mov dword [ebp - 0xae0], esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfaaea
mov eax, dword [ebp - 0xd88]
mov dword [ebp - 0xd34], eax
test ebx, ebx
js 0xbfaa8d
add eax, esi
mov ecx, esi
cmp eax, esi
jb 0xbfaaf5
mov esi, eax
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, dword [ebp - 0xae0]
jb 0xb85e8a
inc edi
cmp edi, dword [ebp - 0xaa4]
jb 0xb85dbc
push 8
pop edi
lea eax, [ebp - 0xdc0]
mov dword [ebp - 0xdc4], edi
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfaa8d
mov ecx, dword [ebp - 0xadc]
lea eax, [esi + 0xc]
add ecx, dword [ebp - 0xb0c]
cmp eax, ecx
ja 0xbfaa9e
mov eax, dword [ebp - 0xdc0]
mov ecx, dword [ebp - 0xad0]
inc dword [ebp - 0xaa4]
mov dword [esi], edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xaa8]
mov dword [eax + 4], ecx
test ebx, ebx
js 0xbfaa8d
lea eax, [ebp - 0xc5c]
mov edx, SysReAllocString
push eax
mov ecx, 0xb2beb0
call fcn.00b84ebc
test eax, eax
js 0xbfaafd
mov ecx, dword [ebp - 0xc5c]
lea eax, [ebp - 0xc5c]
xor edx, edx
push eax
inc edx
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfaa8d
mov eax, dword [ebp - 0xc5c]
lea edi, [eax + eax]
test edi, edi
je 0xbfab1e
mov esi, dword [ebp - 0xadc]
xor eax, eax
mov dword [ebp - 0xaec], eax
cmp dword [ebp - 0xaa4], eax
jbe 0xb85f74
mov edx, dword [esi]
lea eax, [ebp - 0xd2c]
push eax
push 4
pop eax
mov ecx, eax
mov dword [ebp - 0xae0], esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfab04
mov eax, dword [ebp - 0xd2c]
mov dword [ebp - 0xd74], eax
test ebx, ebx
js 0xbfaa8d
add eax, esi
mov ecx, esi
cmp eax, esi
jb 0xbfab0f
mov esi, eax
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, dword [ebp - 0xae0]
jb 0xb85fd2
mov eax, dword [ebp - 0xaec]
inc eax
mov dword [ebp - 0xaec], eax
cmp eax, dword [ebp - 0xaa4]
jb 0xb85efc
lea eax, [ebp - 0xde8]
mov dword [ebp - 0xdec], edi
push eax
push 4
pop eax
mov edx, eax
mov ecx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfaa8d
mov ecx, dword [ebp - 0xadc]
lea eax, [edi + 4]
add ecx, dword [ebp - 0xb0c]
add eax, esi
cmp eax, ecx
ja 0xbfab17
push edi
push 0xb2beb0
push dword [ebp - 0xde8]
mov dword [esi], edi
call fcn.00bc13d0
add esp, 0xc
inc dword [ebp - 0xaa4]
test ebx, ebx
js 0xbfaa8d
mov edi, dword [ebp - 0xab8]
xor eax, eax
mov edx, eax
mov esi, dword [ebp - 0xadc]
mov dword [ebp - 0xe44], edi
cmp dword [ebp - 0xaa4], eax
jbe 0xb86072
mov edi, dword [ebp - 0xe58]
mov eax, dword [esi]
push 4
add eax, 4
mov dword [ebp - 0xae0], esi
pop ebx
cmp eax, ebx
jb 0xbfab2e
mov ecx, eax
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, 4
jb 0xb8602d
mov edi, ecx
push 4
pop ecx
cmp eax, ecx
jb 0xbfab52
lea eax, [esi + edi]
mov ecx, esi
cmp eax, esi
jb 0xbfab36
mov esi, eax
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, dword [ebp - 0xae0]
jb 0xbfab3e
inc edx
cmp edx, dword [ebp - 0xaa4]
jb 0xb85ffe
mov edi, dword [ebp - 0xab8]
push 4
pop ecx
lea eax, [ebp - 0xdf0]
mov dword [ebp - 0xdf4], ecx
mov edx, ecx
mov ecx, esi
push eax
call fcn.00b84e9a
mov edx, dword [ebp - 0xadc]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfab44
mov ecx, dword [ebp - 0xb0c]
lea eax, [esi + 8]
add ecx, edx
cmp eax, ecx
ja 0xbfaa9e
mov eax, dword [ebp - 0xdf0]
push 4
pop ecx
mov dword [esi], ecx
mov dword [eax], edi
mov eax, dword [ebp - 0xaa4]
inc eax
mov dword [ebp - 0xaa4], eax
test ebx, ebx
js 0xbfaa8d
mov dword [ebp - 0xe64], ecx
mov esi, edx
xor ecx, ecx
mov edx, ecx
test eax, eax
je 0xb8615a
mov edi, dword [ebp - 0xe68]
mov eax, dword [esi]
push 4
add eax, 4
mov dword [ebp - 0xae0], esi
pop ebx
cmp eax, ebx
jb 0xbfab5a
mov ecx, eax
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, 4
jb 0xb8611b
mov edi, ecx
push 4
pop ecx
cmp eax, ecx
jb 0xb861ad
lea eax, [esi + edi]
mov ecx, esi
cmp eax, esi
jb 0xbfab62
mov esi, eax
cmp eax, ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp eax, dword [ebp - 0xae0]
jb 0xbfab6a
inc edx
cmp edx, dword [ebp - 0xaa4]
jb 0xb860ec
push 4
pop ecx
lea eax, [ebp - 0xdd0]
mov dword [ebp - 0xdd4], ecx
mov edx, ecx
mov ecx, esi
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfab6a
mov ecx, dword [ebp - 0xadc]
lea eax, [esi + 8]
add ecx, dword [ebp - 0xb0c]
cmp eax, ecx
ja 0xbfaa9e
mov eax, dword [ebp - 0xdd0]
inc dword [ebp - 0xaa4]
push 4
pop ecx
mov dword [esi], ecx
mov dword [eax], ecx
test ebx, ebx
js 0xbfaa8d
lea eax, [ebp - 0xd84]
mov edx, ecx
push eax
call fcn.00b84e9a
mov esi, dword [ebp - 0xd84]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfab72
lea eax, [ebp - 0xd00]
mov edi, esi
push eax
push 8
pop edx
mov dword [ebp - 0xbac], edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfab78
mov esi, dword [ebp - 0xd00]
lea eax, [ebp - 0xbac]
mov edx, esi
push eax
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfab78
lea eax, [ebp - 0xd04]
push eax
push 4
pop edi
mov edx, edi
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfab78
mov esi, dword [ebp - 0xd04]
mov ecx, dword [ebp - 0xbac]
lea eax, [ebp - 0xbac]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfab78
lea eax, [ebp - 0xd08]
mov edx, edi
push eax
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfab78
mov esi, dword [ebp - 0xd08]
mov ecx, dword [ebp - 0xbac]
lea eax, [ebp - 0xbac]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfab78
lea eax, [ebp - 0xd0c]
mov edx, edi
push eax
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfab78
mov esi, dword [ebp - 0xd0c]
mov ecx, dword [ebp - 0xbac]
lea eax, [ebp - 0xbac]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfab78
lea eax, [ebp - 0xc64]
mov edx, edi
push eax
mov ecx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfab78
mov esi, dword [ebp - 0xc64]
mov ecx, dword [ebp - 0xbac]
lea eax, [ebp - 0xbac]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov eax, dword [ebp - 0xbac]
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfab78
mov dword [ebp - 0xabc], eax
test ebx, ebx
js 0xbfaa8d
xor ecx, ecx
rdtsc
mov esi, ecx
mov dword [ebp - 0xb10], ecx
mov dword [ebp - 0xab0], esi
mov dword [ebp - 0xac4], ecx
mov dword [ebp - 0xa9c], ecx
mov dword [ebp - 0xaac], ecx
mov dword [ebp - 0xb14], ecx
mov dword [ebp - 0xad4], ecx
mov dword [ebp - 0xaec], ecx
mov dword [ebp - 0xae8], ecx
mov dword [ebp - 0xb50], ecx
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xac0], edx
push 8
pop ecx
mov dword [ebp - 0xc60], ecx
mov edx, dword [ebp - 0xb0c]
lea eax, [ebp - 0xc60]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xb864ab
mov eax, dword [ebp - 0xc60]
lea edi, [eax + 7]
and edi, 0xfffffff8
cmp edi, eax
jb 0xbfab83
mov dword [ebp - 0xc60], edi
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xbfab8d
mov eax, dword [ebp - 0xaa4]
mov ecx, esi
mov dword [esi], eax
lea eax, [ebp - 0xc3c]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xc3c], esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbfab97
mov ecx, dword [ebp - 0xc3c]
mov eax, dword [ebp - 0xb0c]
mov dword [ecx], eax
lea eax, [ebp - 0xc3c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbfab97
push dword [ebp - 0xb0c]
mov eax, dword [ebp - 0xae0]
push dword [ebp - 0xadc]
mov dword [esi + edi - 8], eax
mov eax, dword [ebp - 0xac0]
push dword [ebp - 0xc3c]
mov dword [esi + edi - 4], eax
call fcn.00bc13d0
add esp, 0xc
mov dword [ebp - 0xb10], esi
xor eax, eax
mov dword [ebp - 0xab0], edi
mov esi, eax
test esi, esi
jne 0xbfab9e
mov esi, dword [ebp - 0xab0]
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xb87a7b
mov ebx, dword [ebp - 0xb10]
xor ecx, ecx
mov edi, ecx
mov dword [ebp - 0xac8], edi
test ebx, ebx
je 0xbfabb2
test esi, esi
je 0xbfad76
lea eax, [esi + 8]
push eax
push ecx
mov dword [ebp - 0xae0], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xae4], eax
test eax, eax
je 0xbfad76
xor ecx, ecx
mov dl, cl
test esi, esi
je 0xb86513
xor dl, byte [ecx + ebx]
inc ecx
cmp ecx, esi
jb 0xb8650b
mov dword [ebp - 0xad8], eax
xor eax, eax
mov dword [ebp - 0xb04], ebx
mov ecx, eax
or ebx, 0xffffffff
mov dword [ebp - 0x3a8], 0xb1b54a58
mov dword [ebp - 0x3a4], 0xc81ecb17
mov dword [ebp - 0xb3c], ecx
mov dword [ebp - 0xb40], ebx
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xb08], eax
test eax, eax
jne 0xbfabbc
mov eax, esi
shr eax, 3
mov dword [ebp - 0xaf0], eax
test eax, eax
je 0xb8695a
mov eax, dword [ebp - 0xad8]
mov esi, dword [ebp - 0xb04]
add eax, 7
add esi, 2
mov dword [ebp - 0xad8], eax
mov dword [ebp - 0xb04], esi
movzx edi, byte [esi - 2]
movzx eax, byte [esi - 1]
shl edi, 8
or edi, eax
movzx eax, byte [esi]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 1]
movzx esi, byte [esi + 2]
shl edi, 8
or edi, eax
shl esi, 8
mov eax, dword [ebp - 0xb04]
movzx eax, byte [eax + 3]
or esi, eax
mov eax, dword [ebp - 0xb04]
shl esi, 8
movzx eax, byte [eax + 4]
or esi, eax
mov eax, dword [ebp - 0xb04]
shl esi, 8
add dword [ebp - 0xb04], 8
movzx eax, byte [eax + 5]
or esi, eax
xor ebx, esi
mov dword [ebp - 0xa94], ebx
add ebx, 0xffffb5a8
xor ebx, edi
xor ebx, ecx
mov ecx, 0xc81ecb17
xor ebx, ecx
mov eax, ebx
xor eax, ecx
ror eax, 0xf
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 7
add ecx, eax
mov eax, dword [ebp - 0xa94]
xor eax, ecx
mov dword [ebp - 0xa94], eax
add eax, 0xb1b54a58
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa94]
ror eax, 0xa
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0xcb17
rol eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
rol eax, 5
add ecx, eax
mov eax, dword [ebp - 0xa94]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xa94], eax
xor ecx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, ecx
xor ebx, eax
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 6
sub ecx, eax
sub ecx, 0x339b6838
xor dword [ebp - 0xa94], ecx
mov ecx, dword [ebp - 0xa94]
mov eax, ecx
ror eax, 0xf
xor eax, 0xcb17
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, 0xc81e
imul eax, eax, 0xcb17
xor ecx, eax
lea eax, [ecx + 0x37e0ea91]
mov dword [ebp - 0xa94], ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0xc81e
ror ecx, 0xa
imul eax, eax, 0xb1b5
xor ecx, eax
mov eax, dword [ebp - 0xa94]
xor eax, ecx
mov dword [ebp - 0xa94], eax
xor eax, 0x4a58
rol eax, 6
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa94]
ror eax, 3
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa94]
mov eax, ebx
ror eax, 0xf
sub eax, 0xc81e
imul eax, eax, 0x4a58
xor ecx, eax
mov dword [ebp - 0xa94], ecx
xor ecx, 0xc81e
mov eax, dword [ebp - 0xa94]
shr eax, 1
imul ecx, ecx, 0x4a58
xor ecx, eax
mov eax, dword [ebp - 0xa94]
add eax, 0xffff34e9
xor ebx, ecx
rol eax, 3
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xa94]
shr eax, 0xf
xor ecx, eax
xor ebx, ecx
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 0xd
sub ecx, eax
mov eax, 0xb1b54a58
add ecx, 0x730581bd
xor dword [ebp - 0xa94], ecx
sub eax, dword [ebp - 0xa94]
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa94]
ror eax, 0xb
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xa94]
lea eax, [ebx + 0x4e49ed8a]
xor ecx, eax
mov dword [ebp - 0xa94], ecx
mov eax, dword [ebp - 0xa94]
xor eax, 0xb1b5
ror ecx, 7
imul eax, eax, 0x4a58
sub eax, ecx
xor ebx, eax
mov eax, ebx
xor eax, 0xc81e
rol eax, 4
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0x10
sub ecx, eax
mov eax, 0xb1b54a58
xor dword [ebp - 0xa94], ecx
sub eax, dword [ebp - 0xa94]
ror eax, 0xa
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa94]
ror eax, 4
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x4e4ab5a8]
ror eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
ror eax, 9
xor ecx, eax
mov eax, dword [ebp - 0xa94]
xor eax, ecx
mov dword [ebp - 0xa94], eax
xor eax, 0xc81ecb17
rol eax, 8
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xa94]
rol eax, 2
sub ecx, eax
mov eax, 0xc81ecb17
xor ebx, ecx
sub eax, ebx
ror eax, 0xb
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0xc
sub ecx, eax
mov eax, dword [ebp - 0xa94]
xor eax, ecx
mov dword [ebp - 0xa94], eax
xor eax, 0xb1b5
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xa94]
shr eax, 8
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xad8]
mov eax, ebx
add dword [ebp - 0xad8], 8
xor eax, dword [ebp - 0xb20]
xor eax, dword [ebp - 0xa94]
xor ebx, dword [ebp - 0xb08]
xor eax, 0x79ab814f
mov dword [ebp - 0xb40], eax
mov dword [ebp - 0xb3c], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xb40]
ror dword [ebp - 0xb3c], 8
mov byte [ecx], al
ror dword [ebp - 0xb40], 8
mov al, byte [ebp - 0xb3c]
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb40]
ror dword [ebp - 0xb3c], 8
mov byte [ecx - 1], al
ror dword [ebp - 0xb40], 8
mov al, byte [ebp - 0xb3c]
mov byte [ecx - 6], al
ror dword [ebp - 0xb3c], 8
mov al, byte [ebp - 0xb40]
mov byte [ecx - 2], al
ror dword [ebp - 0xb40], 8
mov al, byte [ebp - 0xb3c]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb40]
mov byte [ecx - 3], al
mov ecx, dword [ebp - 0xb3c]
mov ebx, dword [ebp - 0xb40]
ror ecx, 8
ror ebx, 8
sub dword [ebp - 0xaf0], 1
mov dword [ebp - 0xb20], esi
mov esi, dword [ebp - 0xb04]
mov dword [ebp - 0xb3c], ecx
mov dword [ebp - 0xb40], ebx
mov dword [ebp - 0xb08], edi
jne 0xb8658b
mov edi, dword [ebp - 0xac8]
mov esi, dword [ebp - 0xab0]
mov ecx, dword [ebp - 0xae4]
movzx eax, dl
cdq
mov dword [ecx + esi], eax
mov dword [ecx + esi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xbfac85
mov ebx, dword [ebp - 0xae0]
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xbfac8f
mov dword [esi + 4], eax
push ebx
push dword [ebp - 0xae4]
push eax
call fcn.00bc13d0
add esp, 0xc
mov eax, 0xa0
mov dword [esi + 8], eax
push eax
push 8
pop ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xbfac8f
mov dword [esi + 0xc], eax
push 0xa0
push 0xd08ca8
push eax
call fcn.00bc13d0
add esp, 0xc
mov dword [esi + 0x10], ebx
push ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
je 0xbfac9b
mov dword [esi + 0x14], ecx
mov edi, esi
mov eax, dword [0xd08d48]
mov ebx, edx
mov dword [ecx], eax
mov esi, edx
mov eax, dword [0xd08d4c]
mov dword [ecx + 4], eax
test esi, esi
jne 0xbfaca5
xor eax, eax
test ebx, ebx
js 0xb86a3d
mov dword [ebp - 0xac4], edi
mov edi, eax
push dword [ebp - 0xae4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
jne 0xbfad0d
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xb87a7b
mov esi, dword [ebp - 0xac4]
lea eax, [ebp - 0xbb8]
push 4
pop edi
push eax
mov edx, dword [esi]
mov ecx, edi
mov dword [ebp - 0xbb8], edi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbfad80
mov ecx, dword [ebp - 0xbb8]
lea eax, [ebp - 0xbb8]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbfad80
mov edx, dword [esi + 8]
lea eax, [ebp - 0xbb8]
mov ecx, dword [ebp - 0xbb8]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbfad80
mov ecx, dword [ebp - 0xbb8]
lea eax, [ebp - 0xbb8]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbfad80
mov edx, dword [esi + 0x10]
lea eax, [ebp - 0xbb8]
mov ecx, dword [ebp - 0xbb8]
push eax
call fcn.00b84e9a
mov edi, dword [ebp - 0xbb8]
mov ebx, eax
test ebx, ebx
js 0xbfad80
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xbfad93
mov eax, dword [ebp - 0xac4]
mov ecx, esi
mov dword [ebp - 0xaf8], esi
mov eax, dword [eax]
mov dword [esi], eax
lea eax, [ebp - 0xaf8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbfad9d
mov ebx, dword [ebp - 0xac4]
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0xaf8]
call fcn.00bc13d0
mov edx, dword [ebx]
lea eax, [ebp - 0xaf8]
mov ecx, dword [ebp - 0xaf8]
add esp, 0xc
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbfad9d
mov eax, dword [ebp - 0xac4]
mov ecx, dword [ebp - 0xaf8]
mov eax, dword [eax + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xaf8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbfad9d
mov ebx, dword [ebp - 0xac4]
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0xaf8]
call fcn.00bc13d0
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xaf8]
mov ecx, dword [ebp - 0xaf8]
add esp, 0xc
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbfad9d
mov eax, dword [ebp - 0xac4]
mov ecx, dword [ebp - 0xaf8]
mov eax, dword [eax + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xaf8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbfad9d
mov ebx, dword [ebp - 0xac4]
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0xaf8]
call fcn.00bc13d0
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xaf8]
mov ecx, dword [ebp - 0xaf8]
add esp, 0xc
push eax
call fcn.00b84e9a
mov ebx, eax
xor eax, eax
test ebx, ebx
js 0xb86c68
mov dword [ebp - 0xa9c], esi
mov esi, eax
mov dword [ebp - 0xaac], edi
test esi, esi
jne 0xbfada4
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xb87a7b
xor eax, eax
mov dword [ebp - 0xca4], 8
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xac8], eax
mov edx, dword [ebp - 0xabc]
lea eax, [ebp - 0xca4]
push eax
push 8
pop ecx
call fcn.00b84e9a
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xbfadd9
mov eax, dword [ebp - 0xca4]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jb 0xbfadb8
mov dword [ebp - 0xca0], ecx
lea eax, [ebp - 0xca0]
push eax
push 8
pop edx
call fcn.00b84e9a
mov ebx, eax
mov eax, dword [ebp - 0xca0]
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfadc3
mov dword [ebp - 0xad8], eax
test ebx, ebx
js 0xbfadd9
cmp dword [ebp - 0xaa4], 1
jbe 0xbfadce
mov ecx, dword [ebp - 0xadc]
xor eax, eax
mov dword [ebp - 0xbd8], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xbd8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfade4
mov ecx, dword [ebp - 0xbd8]
lea eax, [ebp - 0xbd8]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfade4
mov ecx, dword [ebp - 0xbd8]
inc esi
cmp esi, 1
jb 0xb86d2d
mov esi, dword [ecx]
lea eax, [ebp - 0xbd8]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfade4
mov edi, esi
neg esi
sbb esi, esi
and dword [ebp - 0xbd8], esi
test ebx, ebx
js 0xbfadd9
cmp dword [ebp - 0xaa4], 2
jbe 0xbfadce
mov ecx, dword [ebp - 0xadc]
xor eax, eax
mov dword [ebp - 0xbcc], ecx
mov esi, eax
lea eax, [ebp - 0xbcc]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfadd9
mov edx, dword [ecx]
lea eax, [ebp - 0xbcc]
mov ecx, dword [ebp - 0xbcc]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfadd9
mov ecx, dword [ebp - 0xbcc]
inc esi
cmp esi, 2
jb 0xb86dd4
mov esi, dword [ecx]
lea eax, [ebp - 0xbcc]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfadd9
mov dword [ebp - 0xac8], esi
neg esi
sbb esi, esi
and dword [ebp - 0xbcc], esi
test ebx, ebx
js 0xbfadd9
mov edx, dword [ebp - 0xad8]
lea eax, [ebp - 0xbb0]
push 4
pop esi
push eax
mov ecx, esi
mov dword [ebp - 0xbb0], esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfadef
mov ecx, dword [ebp - 0xbb0]
lea eax, [ebp - 0xbb0]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfadef
mov ecx, dword [ebp - 0xbb0]
lea eax, [ebp - 0xbb0]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfadef
mov ecx, dword [ebp - 0xbb0]
lea eax, [ebp - 0xbb0]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfadef
mov edx, dword [ebp - 0xac8]
lea eax, [ebp - 0xbb0]
mov ecx, dword [ebp - 0xbb0]
push eax
call fcn.00b84e9a
mov ebx, eax
mov eax, dword [ebp - 0xbb0]
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfadef
cmp eax, 0x400000
ja 0xbfadfe
mov esi, eax
mov dword [ebp - 0xad4], esi
test ebx, ebx
js 0xb87a7b
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xbfae08
mov ecx, eax
mov dword [ebp - 0xb14], eax
mov ebx, 0x10000000
mov edi, dword [ebp - 0xa9c]
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xb87a81
test edi, edi
je 0xbfae18
test ecx, ecx
je 0xbfae18
mov eax, dword [ebp - 0xaac]
xor ebx, ebx
mov dword [ebp - 0xe14], eax
lea eax, [ebp - 0xd14]
push eax
push 0xb2be98
push 1
mov dword [ebp - 0xe1c], edi
mov dword [ebp - 0xe18], ecx
mov dword [ebp - 0xe10], esi
mov dword [ebp - 0xe0c], ebx
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xbfae1f
push 0xb2be7c
push dword [ebp - 0xd14]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xbfae71
push ebx
push 0x14
lea eax, [ebp - 0xe1c]
mov ecx, esi
push eax
push 0x86
call dword [0xd0cffc]
call esi
mov ebx, eax
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xbfae85
mov esi, dword [ebp - 0xe10]
mov dword [ebp - 0xad4], esi
cmp ebx, 0xd0000023
je 0xbfae90
test ebx, ebx
js 0xb87a81
mov eax, dword [ebp - 0xb14]
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0xb2c], ecx
mov edi, ecx
mov dword [ebp - 0xb9c], eax
cmp esi, edx
jb 0xbfaea0
mov esi, dword [eax]
lea ecx, [ebp - 0xb9c]
push ecx
mov ecx, eax
mov dword [ebp - 0xae0], esi
call fcn.00b84e9a
mov ebx, eax
xor ecx, ecx
test ebx, ebx
js 0xb87360
lea eax, [ebp - 0xb2c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbfafb7
mov eax, dword [ebp - 0xad4]
sub eax, dword [ebp - 0xb2c]
cmp eax, esi
jb 0xbfaeaa
mov eax, dword [ebp - 0xb9c]
lea ecx, [ebp - 0xb9c]
push ecx
mov edx, esi
mov dword [ebp - 0xaac], eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbfafb7
mov ecx, dword [ebp - 0xb2c]
lea eax, [ebp - 0xb2c]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbfafb7
mov eax, dword [ebp - 0xad4]
sub eax, dword [ebp - 0xb2c]
push 4
pop edx
cmp eax, edx
jb 0xbfaeaa
mov ecx, dword [ebp - 0xb9c]
lea eax, [ebp - 0xb9c]
push eax
mov esi, dword [ecx]
mov dword [ebp - 0xac0], esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbfafb7
mov ecx, dword [ebp - 0xb2c]
lea eax, [ebp - 0xb2c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbfafb7
mov eax, dword [ebp - 0xad4]
sub eax, dword [ebp - 0xb2c]
cmp eax, esi
jb 0xbfaeaa
mov eax, dword [ebp - 0xb9c]
lea ecx, [ebp - 0xb9c]
push ecx
mov edx, esi
mov dword [ebp - 0xabc], eax
mov ecx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbfafb7
mov ecx, dword [ebp - 0xb2c]
lea eax, [ebp - 0xb2c]
push eax
mov edx, esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbfafb7
mov eax, dword [ebp - 0xad4]
sub eax, dword [ebp - 0xb2c]
push 4
pop edx
cmp eax, edx
jb 0xbfaeaa
mov ecx, dword [ebp - 0xb9c]
mov eax, dword [ecx]
mov dword [ebp - 0xae4], eax
lea eax, [ebp - 0xb9c]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbfafb7
mov ecx, dword [ebp - 0xb2c]
lea eax, [ebp - 0xb2c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbfafb7
mov eax, dword [ebp - 0xad4]
sub eax, dword [ebp - 0xb2c]
mov ecx, dword [ebp - 0xae4]
cmp eax, ecx
jb 0xbfaeaa
lea eax, [ebp - 0xb2c]
mov edx, ecx
mov ecx, dword [ebp - 0xb2c]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xbfafb7
mov ecx, dword [ebp - 0xad4]
mov eax, ecx
sub eax, dword [ebp - 0xb2c]
jne 0xbfaeaa
mov eax, dword [ebp - 0xae4]
mov ebx, dword [ebp - 0xae0]
add eax, 0xc
add eax, esi
add eax, ebx
cmp eax, ecx
jne 0xbfaeaa
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xbfaeb4
cmp dword [ebp - 0xaac], edi
je 0xbfaeca
push ebx
push 8
mov dword [esi], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xbfaebe
mov dword [esi + 4], eax
push ebx
push dword [ebp - 0xaac]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
cmp dword [ebp - 0xabc], edi
je 0xbfaed6
mov ebx, dword [ebp - 0xac0]
push ebx
push 8
mov dword [esi + 8], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xbfaebe
mov dword [esi + 0xc], eax
push ebx
push dword [ebp - 0xabc]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
cmp dword [ebp - 0xb9c], edi
je 0xbfaee1
mov ebx, dword [ebp - 0xae4]
push ebx
push 8
mov dword [esi + 0x10], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xbfaebe
mov dword [esi + 0x14], eax
push ebx
push dword [ebp - 0xb9c]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
mov edi, esi
mov ebx, eax
mov esi, eax
test esi, esi
jne 0xbfaeec
xor ecx, ecx
test ebx, ebx
js 0xb87358
mov dword [ebp - 0xaec], edi
mov edi, ecx
test edi, edi
jne 0xbfaf54
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
jl 0xb87a7b
mov eax, dword [ebp - 0xaec]
mov esi, ecx
mov dword [ebp - 0xaa4], esi
mov dword [ebp - 0xab0], ecx
test eax, eax
je 0xbfafbe
mov ebx, dword [eax + 4]
mov dword [ebp - 0xad4], ebx
test ebx, ebx
je 0xbfafbe
mov edi, dword [eax]
test edi, edi
je 0xbfafbe
add edi, 0xfffffff8
mov dword [ebp - 0xadc], ecx
push edi
push ecx
mov dword [ebp - 0xac8], edi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xaf0], eax
test eax, eax
je 0xbfb0f7
xor ecx, ecx
mov dword [ebp - 0x3b0], 0xab69605e
mov dword [ebp - 0x3ac], 0x7f1137f
mov dl, cl
mov ecx, ebx
mov esi, eax
mov dword [ebp - 0xb08], ecx
mov dword [ebp - 0xae4], esi
and edi, 7
jne 0xbfafce
xor eax, eax
or dword [ebp - 0xb20], 0xffffffff
mov esi, eax
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xb24], esi
mov ebx, eax
mov dword [ebp - 0xb34], ebx
mov ecx, dword [ebp - 0xac8]
mov eax, ecx
shr eax, 3
mov dword [ebp - 0xabc], eax
test eax, eax
je 0xb877ab
mov eax, dword [ebp - 0xae4]
mov edi, dword [ebp - 0xb08]
add eax, 7
add edi, 2
mov dword [ebp - 0xaac], eax
mov dword [ebp - 0xb08], edi
movzx ecx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl ecx, 8
or ecx, eax
shl edi, 8
mov eax, dword [ebp - 0xb08]
xor ebx, ecx
mov dword [ebp - 0xac0], ecx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb08]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb08]
shl edi, 8
add dword [ebp - 0xb08], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, ebx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul ecx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub ecx, eax
xor esi, ecx
imul ecx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub ecx, eax
sub ecx, 0x756c8a2
xor ebx, ecx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, 0xab69605e
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0x137f
ror ecx, 6
imul eax, eax, 0xab69
xor ecx, eax
xor esi, ecx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul ecx, eax, 0x605e
mov eax, esi
rol eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub ecx, eax
xor esi, ecx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul ecx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x7f1
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov eax, esi
mov dword [ebp - 0xad8], esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea esi, [ebx - 0x7f1]
xor esi, dword [ebp - 0xad8]
xor esi, 0xab69605e
mov eax, esi
xor eax, 0x7f1
rol eax, 2
imul ecx, eax, 0x137f
mov eax, esi
shr eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 7
add ecx, eax
xor esi, ecx
mov eax, esi
mov ecx, esi
xor eax, 0x137f
ror ecx, 9
imul eax, eax, 0x605e
add ecx, eax
xor ebx, ecx
mov eax, ebx
mov dword [ebp - 0xae0], ebx
xor eax, 0xab69
rol eax, 5
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 7
add ecx, eax
xor esi, ecx
mov ebx, esi
xor ebx, dword [ebp - 0xae0]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor esi, eax
lea eax, [esi - 0x7f1137f]
ror eax, 1
imul ecx, eax, 0x605e
mov eax, esi
ror eax, 6
sub ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add ecx, eax
xor esi, ecx
lea eax, [esi - 0x54969fa2]
rol eax, 0xf
imul ecx, eax, 0x137f
mov eax, esi
ror eax, 0xe
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x605e
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor ecx, eax
xor esi, ecx
mov eax, esi
xor eax, 0x7f1137f
rol eax, 4
imul ecx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xb20]
rol eax, 2
mov dword [ebp - 0xb24], esi
mov dword [ebp - 0xb20], edi
xor ecx, eax
mov edi, dword [ebp - 0xb08]
xor ecx, dword [ebp - 0xb04]
xor ebx, ecx
mov ecx, dword [ebp - 0xaac]
mov dword [ebp - 0xb34], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xb24]
ror dword [ebp - 0xb34], 8
mov byte [ecx], al
mov al, byte [ebp - 0xb34]
ror dword [ebp - 0xb24], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb24]
ror dword [ebp - 0xb34], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xb34]
ror dword [ebp - 0xb24], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xb24]
ror dword [ebp - 0xb34], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xb24], 8
mov al, byte [ebp - 0xb34]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb24]
mov byte [ecx - 3], al
add ecx, 8
mov ebx, dword [ebp - 0xb34]
mov esi, dword [ebp - 0xb24]
mov eax, dword [ebp - 0xac0]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xabc], 1
mov dword [ebp - 0xb34], ebx
mov dword [ebp - 0xb24], esi
mov dword [ebp - 0xb04], eax
mov dword [ebp - 0xaac], ecx
jne 0xb8745c
mov ecx, dword [ebp - 0xac8]
mov ebx, dword [ebp - 0xaf0]
xor eax, eax
test ecx, ecx
je 0xb877bf
xor dl, byte [eax + ebx]
inc eax
cmp eax, ecx
jb 0xb877b7
mov esi, dword [ebp - 0xad4]
movzx eax, dl
cdq
cmp eax, dword [ecx + esi]
jne 0xbfb0d1
cmp edx, dword [ecx + esi + 4]
jne 0xbfb0d1
mov edi, dword [ebp - 0xadc]
xor eax, eax
mov esi, ebx
mov dword [ebp - 0xab0], ecx
mov ebx, eax
test ebx, ebx
jne 0xbfb0e3
test edi, edi
js 0xbfb0f7
mov eax, dword [ebp - 0xab0]
xor ecx, ecx
mov dword [ebp - 0xae8], esi
mov ebx, 0x10000000
mov esi, ecx
mov dword [ebp - 0xb50], eax
mov dword [ebp - 0xa94], ebx
test esi, esi
jne 0xbfb103
test ebx, ebx
js 0xb87a7b
mov edi, dword [ebp - 0xb50]
push 4
pop esi
mov dword [ebp - 0xc04], ecx
mov ecx, dword [ebp - 0xae8]
mov dword [ebp - 0xc44], ecx
cmp edi, esi
jb 0xbfb152
mov eax, dword [ecx]
mov edx, esi
mov dword [ebp - 0xae0], eax
lea eax, [ebp - 0xc44]
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xb87a6f
lea eax, [ebp - 0xc04]
mov edx, esi
push eax
xor ecx, ecx
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xb87a6f
mov eax, edi
sub eax, dword [ebp - 0xc04]
cmp eax, esi
jb 0xbfb152
mov ecx, dword [ebp - 0xc44]
lea eax, [ebp - 0xc44]
push eax
push 4
pop eax
mov esi, dword [ecx]
mov edx, eax
mov dword [ebp - 0xaac], esi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xb87a6f
mov ecx, dword [ebp - 0xc04]
lea eax, [ebp - 0xc04]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xb87a6f
mov ecx, dword [ebp - 0xc04]
mov eax, edi
sub eax, ecx
cmp eax, esi
jb 0xbfb152
lea eax, [ebp - 0xc04]
mov edx, esi
push eax
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xb87a6f
mov edi, dword [ebp - 0xc44]
mov edx, dword [ebp - 0xb50]
mov ebx, dword [ebp - 0xae8]
lea ecx, [edi + esi]
lea eax, [edx + ebx]
cmp eax, ecx
jb 0xbfb152
sub edx, edi
sub edx, esi
add edx, ebx
cmp edx, 8
jae 0xbfb152
xor ecx, ecx
mov dword [ebp - 0xae4], ecx
mov eax, ecx
mov dword [ebp - 0xb50], eax
mov ebx, ecx
test edi, edi
je 0xb87a0c
mov edx, dword [ebp - 0xaac]
lea eax, [ebp - 0xc00]
push eax
mov ecx, edi
mov esi, edi
call fcn.00b84e9a
mov ebx, eax
test ebx, ebx
js 0xb87a6f
mov edx, dword [ebp - 0xc00]
cmp edi, edx
jae 0xb879f8
lea eax, [esi + 4]
cmp eax, esi
jb 0xbfb13e
cmp eax, edx
ja 0xbfb134
mov eax, dword [esi]
push 4
add eax, 4
pop ebx
cmp eax, ebx
jb 0xbfb119
mov ecx, eax
cmp eax, ebx
sbb ebx, ebx
and ebx, 0xc0000095
cmp eax, 4
jb 0xbfb121
mov dword [ebp - 0xd18], ecx
cmp eax, 4
jb 0xb87a59
add ecx, esi
cmp ecx, esi
jb 0xbfb12c
mov eax, ecx
cmp ecx, esi
sbb ebx, ebx
and ebx, 0xc0000095
cmp ecx, esi
jb 0xb87a59
cmp eax, edx
ja 0xbfb134
inc dword [ebp - 0xae4]
mov esi, eax
cmp eax, edx
jb 0xb87983
cmp esi, edx
jne 0xbfb134
mov esi, dword [ebp - 0xaac]
mov eax, dword [ebp - 0xb50]
test esi, esi
je 0xb87a32
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xb50], eax
test eax, eax
je 0xbfb148
xor ecx, ecx
mov ebx, ecx
test edi, edi
je 0xb87a47
push esi
push edi
push eax
call fcn.00bc13d0
mov eax, dword [ebp - 0xb50]
add esp, 0xc
mov dword [ebp - 0xc0c], eax
mov eax, dword [ebp - 0xae4]
mov dword [ebp - 0xc14], eax
test ebx, ebx
js 0xb87a6f
mov eax, dword [ebp - 0xae0]
cmp eax, dword [ebp - 0xc14]
jne 0xbfb152
or ebx, 0x10000000
mov dword [ebp - 0xa94], ebx
mov edi, dword [ebp - 0xa9c]
mov eax, dword [ebp - 0xb10]
test eax, eax
je 0xb87a9c
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xac4]
test esi, esi
je 0xb87b0a
xor eax, eax
cmp dword [esi + 4], eax
je 0xb87ac3
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xb87adf
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xb87afb
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xb87b1f
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xb14]
test eax, eax
je 0xb87b3a
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov esi, dword [ebp - 0xaec]
test esi, esi
je 0xb87ba8
xor eax, eax
cmp dword [esi + 4], eax
je 0xb87b61
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xb87b7d
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xb87b99
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xae8]
test eax, eax
je 0xb87bc3
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xbfaa8d
cmp dword [ebp - 0xc14], 1
jb 0xbfb15c
cmp dword [ebp - 0xc0c], 0
je 0xbfb166
cmp dword [ebp - 0xc14], 0
jbe 0xbfb166
mov ecx, dword [ebp - 0xc0c]
lea eax, [ebp - 0xbfc]
push eax
push 4
pop eax
mov esi, dword [ecx]
mov edx, eax
mov dword [ebp - 0xbfc], ecx
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfb17f
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbfc]
mov dword [ebp - 0xbfc], eax
test ebx, ebx
js 0xbfb171
push 4
pop edx
cmp esi, edx
jne 0xbfaa9e
mov eax, dword [eax]
mov dword [ebp - 0xacc], eax
test ebx, ebx
js 0xbfaa8d
cmp eax, 0xd0000023
je 0xbfb190
cmp eax, 0x8007007a
je 0xb87c78
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test eax, eax
js 0xbfaa8d
cmp dword [ebp - 0xc14], 6
jne 0xbfb15c
cmp dword [ebp - 0xc0c], 0
je 0xbfb1a0
mov ecx, dword [ebp - 0xc0c]
xor eax, eax
mov dword [ebp - 0xbec], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xbec]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfb1d0
mov ecx, dword [ebp - 0xbec]
lea eax, [ebp - 0xbec]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfb1d0
mov ecx, dword [ebp - 0xbec]
inc esi
cmp esi, 1
jb 0xbfb1c8
mov esi, dword [ecx]
lea eax, [ebp - 0xbec]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfb1d0
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbec]
mov dword [ebp - 0xbec], eax
test ebx, ebx
js 0xbfb1e1
cmp esi, 8
jne 0xbfaa9e
mov ecx, dword [eax]
mov dword [ebp - 0xaec], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xb10], ecx
test ebx, ebx
js 0xbfaa8d
cmp dword [ebp - 0xc0c], 0
je 0xbfb1fe
mov ecx, dword [ebp - 0xc0c]
xor eax, eax
mov dword [ebp - 0xbd0], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xbd0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfb217
mov ecx, dword [ebp - 0xbd0]
lea eax, [ebp - 0xbd0]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfb217
mov ecx, dword [ebp - 0xbd0]
inc esi
cmp esi, 2
jb 0xb87d70
mov esi, dword [ecx]
lea eax, [ebp - 0xbd0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfb217
mov eax, esi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbd0]
mov dword [ebp - 0xbd0], eax
test ebx, ebx
js 0xbfb209
push 4
pop edx
cmp esi, edx
jne 0xbfaa9e
mov eax, dword [eax]
mov dword [ebp - 0xb50], eax
test ebx, ebx
js 0xbfaa8d
cmp dword [ebp - 0xc0c], 0
je 0xbfb228
mov ecx, dword [ebp - 0xc0c]
xor eax, eax
mov dword [ebp - 0xbe8], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xbe8]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfb232
mov ecx, dword [ebp - 0xbe8]
lea eax, [ebp - 0xbe8]
push eax
mov edx, edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfb232
mov ecx, dword [ebp - 0xbe8]
inc esi
cmp esi, 3
jae 0xb87e8b
push 4
pop edx
jmp 0xb87e38
mov edi, dword [ecx]
lea eax, [ebp - 0xbe8]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xabc], edi
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfb232
mov esi, edi
neg esi
sbb esi, esi
and esi, dword [ebp - 0xbe8]
mov dword [ebp - 0xbe8], esi
test ebx, ebx
js 0xbfaa8d
mov ecx, dword [ebp - 0xc0c]
xor eax, eax
push 4
mov dword [ebp - 0xbd4], ecx
mov edi, eax
pop edx
mov eax, dword [ecx]
mov dword [ebp - 0xae0], eax
lea eax, [ebp - 0xbd4]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfb249
mov edx, dword [ebp - 0xae0]
lea eax, [ebp - 0xbd4]
mov ecx, dword [ebp - 0xbd4]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfb249
mov ecx, dword [ebp - 0xbd4]
inc edi
push 4
pop edx
cmp edi, edx
jb 0xb87ee1
mov edi, dword [ecx]
lea eax, [ebp - 0xbd4]
push eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfb249
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xbd4]
mov dword [ebp - 0xbd4], eax
test ebx, ebx
js 0xbfb25a
push 4
pop ecx
cmp edi, ecx
jne 0xbfaa9e
mov eax, dword [eax]
mov dword [ebp - 0xaac], eax
test ebx, ebx
js 0xbfaa8d
mov ecx, dword [ebp - 0xc0c]
xor eax, eax
mov edi, eax
mov eax, dword [ecx]
lea edx, [ecx + 4]
mov dword [ebp - 0xae0], eax
cmp edx, ecx
jb 0xbfb265
mov eax, edx
cmp edx, ecx
mov dword [ebp - 0xb94], eax
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp edx, ecx
jb 0xbfb275
mov ecx, dword [ebp - 0xae0]
add ecx, eax
mov edx, ecx
mov ebx, ecx
cmp ecx, eax
jb 0xbfb26d
cmp ebx, eax
mov dword [ebp - 0xb94], ecx
sbb ebx, ebx
and ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
cmp edx, eax
jb 0xbfb275
inc edi
cmp edi, 5
jb 0xb87f98
mov edi, dword [ecx]
lea eax, [ebp - 0xb94]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
js 0xbfb275
mov eax, edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0xb94]
mov dword [ebp - 0xb94], eax
test ebx, ebx
js 0xbfb286
push 4
pop ecx
cmp edi, ecx
jne 0xbfaa9e
mov ecx, dword [eax]
test ebx, ebx
js 0xbfaa8d
mov eax, dword [ebp - 0xad0]
cmp eax, dword [ebp - 0xaec]
jne 0xbfb15c
mov eax, dword [ebp - 0xaa8]
cmp eax, dword [ebp - 0xb10]
jne 0xbfb15c
mov eax, dword [ebp - 0xb50]
push 4
mov dword [ebp - 0xab8], ecx
pop ecx
mov dword [ebp - 0xc50], eax
cmp dword [ebp - 0xaac], ecx
ja 0xbfaa82
mov eax, dword [ebp - 0xabc]
cmp eax, ecx
ja 0xbfaa82
push eax
push esi
push dword [ebp - 0xb90]
call fcn.00bc13d0
add esp, 0xc
mov eax, dword [ebp - 0xacc]
mov esi, dword [ebp - 0xa98]
mov edi, dword [ebp - 0xaa0]
test eax, eax
je 0xb880d6
mov ebx, eax
mov dword [ebp - 0xa94], ebx
mov eax, dword [ebp - 0xcdc]
xor edx, edx
mov dword [ebp - 0xce0], edx
mov dword [ebp - 0xce4], edx
test eax, eax
je 0xb88105
push eax
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0xcdc], edx
mov ecx, dword [ebp - 0xc0c]
mov dword [ebp - 0xc10], edx
mov dword [ebp - 0xc14], edx
test ecx, ecx
je 0xb88132
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0xc0c], edx
test esi, esi
je 0xb88145
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xb8815a
push edi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xbfaa3d
mov eax, dword [ebp - 0xab8]
test eax, eax
jne 0xbfb291
mov eax, dword [ebp - 0xb90]
xor edx, edx
mov dword [ebp - 0xafc], edx
mov dword [ebp - 0xc78], eax
mov esi, 0xd0aed4
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xb88189
mov eax, dword [0xd0a150]
mov ebx, dword [ebp - 0xa94]
test eax, eax
jle 0xb881eb
sub eax, 1
mov dword [0xd0a150], eax
jne 0xb881eb
mov edi, edx
mov eax, dword [edi + 0xd0ae80]
test eax, eax
je 0xb881c2
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add edi, 0x10
cmp edi, 0x40
jb 0xb881b1
push 0x40
xor eax, eax
push eax
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov ecx, 0xd0aed4
xchg dword [ecx], eax
mov eax, dword [ebp - 0xafc]
test eax, eax
jne 0xc01c40
mov eax, dword [ebp - 0xc78]
mov esi, 0xc004f012
lea edi, [esi + 0x15]
test ebx, ebx
js 0xc01c4c
push 4
pop ecx
cmp dword [ebp - 0xc50], ecx
jne 0xc01c93
mov ecx, dword [eax]
mov ebx, dword [ebp - 0xd78]
mov dword [ebp - 0xd7c], ecx
test eax, eax
je 0xc01c9d
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
xor ecx, ecx
mov dword [ebp - 0xc78], ecx
cmp ebx, edi
je 0xc01cb0
cmp ebx, 0xc004d301
je 0xc01cb0
cmp ebx, 0xc004d502
jle 0xc01ca4
test ebx, ebx
js 0xc01ce6
mov eax, dword [ebp - 0xd7c]
sub eax, 1
jne 0xc01cf9
mov dword [ebp - 0xc38], ecx
mov ebx, ecx
test ebx, ebx
js 0xc01cc4
mov eax, dword [ebp - 0xc38]
test eax, eax
jne 0xc01d11
mov ebx, dword [ebp - 0xd80]
cmp byte [ebx + 0xad], 0
jne 0xc01d1f
cmp byte [ebx + 0xae], 0
jne 0xc01d1f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xbfa93c
xor eax, eax
test esi, esi
jne 0xbfa932
push dword [ebp - 0xcb4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xbfa928
mov eax, dword [ebp - 0xcb4]
mov ecx, dword [ebp - 0xb90]
jmp 0xb85625
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
jne 0xbfa9b2
xor eax, eax
test esi, esi
jne 0xbfa9a2
push dword [ebp - 0xcb0]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0xbfa998
mov eax, dword [ebp - 0xcb0]
mov ecx, dword [ebp - 0xb90]
jmp 0xb8569c
sbb eax, eax
xor ebx, ebx
inc ebx
or eax, ebx
jmp 0xb8571f
sbb eax, eax
or eax, ebx
xor ecx, ecx
jmp 0xb85762
mov edi, dword [ebp - 0xab0]
or ebx, 0xffffffff
mov dword [ebp - 0xb64], 0xc004d501
xor eax, eax
jmp 0xb85437
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb8543f
mov edx, 0xc000007b
jmp 0xbfa89d
mov edx, 0xc000000d
mov dword [ebp - 0xa9c], edx
jmp 0xb85502
cmp ax, word [ebp - 0xbbc]
je 0xb854f0
jmp 0xbfa898
mov eax, dword [ebp - 0xad8]
jmp 0xb85578
mov ebx, 0xc000007a
jmp 0xb8559a
mov esi, dword [ebp - 0xab0]
mov ebx, 0xc000007a
jmp 0xb855a0
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xbfa8f1
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xbfa8e0
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xb855ca
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xbfaa21
mov ebx, 0x8007000e
jmp 0xb857da
mov ebx, 0x80004005
jmp 0xb85659
test eax, eax
jne 0xbfa947
mov ebx, 0x80004005
jmp 0xbfa956
jg 0xbfa94d
mov ebx, eax
jmp 0xbfa956
movzx ebx, ax
or ebx, 0x80070000
xor eax, eax
jmp 0xb85659
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb85661
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xbfa988
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb857bf
mov ebx, 0x80004005
jmp 0xb857bf
mov ebx, 0x8007000e
jmp 0xb857bf
mov ebx, 0x80004005
mov dword [ebp - 0xa9c], ebx
jmp 0xb856cc
test eax, eax
jne 0xbfa9bd
mov ebx, 0x80004005
jmp 0xbfa9cc
jg 0xbfa9c3
mov ebx, eax
jmp 0xbfa9cc
movzx ebx, ax
or ebx, 0x80070000
mov dword [ebp - 0xa9c], ebx
xor eax, eax
jmp 0xb856cc
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb856d4
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xbfaa04
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xb857aa
mov ebx, 0x80004005
jmp 0xb857aa
mov eax, dword [ebp - 0xab0]
jmp 0xb8579e
xor ebx, ebx
mov dword [ebp - 0xab8], ebx
jmp 0xb857e4
mov dword [ebp - 0xafc], ebx
mov ebx, 0x8007000e
mov dword [ebp - 0xa94], ebx
mov eax, dword [ebp - 0xc70]
xor edx, edx
mov dword [ebp - 0xc50], eax
jmp 0xb88184
mov edi, dword [ebp - 0xaa0]
mov ebx, 0xc0000017
mov dword [ebp - 0xa94], ebx
jmp 0xb880d6
mov esi, dword [ebp - 0xe40]
jmp 0xbfaa93
mov ebx, 0xc000003e
mov dword [ebp - 0xa94], ebx
jmp 0xbfaa93
mov ebx, 0xc0000017
jmp 0xbfaa87
mov ebx, 0x8007007a
mov dword [ebp - 0xa94], ebx
mov edi, dword [ebp - 0xaa0]
mov esi, dword [ebp - 0xa98]
jmp 0xb880d6
mov ebx, 0xc0000023
jmp 0xbfaa87
mov eax, dword [ebp - 0xaa4]
xor ecx, ecx
jmp 0xb85bb7
mov eax, dword [ebp - 0xd9c]
jmp 0xb85bfc
mov edi, dword [ebp - 0xadc]
mov eax, dword [ebp - 0xaa4]
jmp 0xb85ca5
mov eax, dword [ebp - 0xd8c]
jmp 0xb85cec
mov edi, dword [ebp - 0xadc]
mov eax, dword [ebp - 0xaa4]
jmp 0xb85d92
mov eax, dword [ebp - 0xd34]
jmp 0xb85df1
or esi, 0xffffffff
jmp 0xb85e07
mov ebx, 0xc000003e
jmp 0xbfaa87
mov eax, dword [ebp - 0xd74]
jmp 0xb85f31
or esi, 0xffffffff
jmp 0xb85f47
mov ebx, 0xc0000023
jmp 0xbfab23
mov ebx, 0xc000000d
mov dword [ebp - 0xa94], ebx
jmp 0xb85fd2
or ecx, 0xffffffff
jmp 0xb86016
or esi, 0xffffffff
jmp 0xb86047
mov edx, dword [ebp - 0xadc]
push 4
pop ecx
mov eax, dword [ebp - 0xaa4]
jmp 0xb860ce
mov edx, dword [ebp - 0xadc]
jmp 0xbfab47
or ecx, 0xffffffff
jmp 0xb86104
or esi, 0xffffffff
jmp 0xb86135
push 4
pop ecx
jmp 0xb861ad
mov esi, dword [ebp - 0xe6c]
mov eax, dword [ebp - 0xc24]
jmp 0xb86357
mov ebx, 0xc0000095
jmp 0xb864ab
mov ebx, 0xc0000017
jmp 0xb864a5
xor eax, eax
jmp 0xb8649d
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb864a5
mov ebx, 0xc000000d
jmp 0xb86a59
xor ebx, ebx
mov dword [ebp - 0xb20], eax
xor esi, esi
mov dword [ebp - 0xb08], ecx
jbe 0xbfac1f
mov edi, dword [ebp - 0xb04]
push 0x38
pop esi
push 4
pop eax
cmp ebx, eax
movzx eax, byte [edi]
jge 0xbfabf6
lea ecx, [esi - 0x20]
shl eax, cl
mov ecx, dword [ebp - 0xb08]
or ecx, eax
mov dword [ebp - 0xb08], ecx
jmp 0xbfac06
mov ecx, esi
shl eax, cl
or dword [ebp - 0xb20], eax
mov ecx, dword [ebp - 0xb08]
inc ebx
sub esi, 8
xor eax, eax
inc edi
cmp ebx, eax
jl 0xbfabd7
mov dword [ebp - 0xb04], edi
mov edi, eax
mov eax, dword [ebp - 0xb20]
xor ecx, 0xb17a307a
xor eax, 0x42f6b18d
xor ebx, ebx
mov dword [ebp - 0xb3c], ecx
mov esi, ebx
jbe 0xbfac61
mov ebx, dword [ebp - 0xad8]
cmp esi, 4
jge 0xbfac48
rol ecx, 8
mov byte [ebx], cl
jmp 0xbfac4d
rol eax, 8
mov byte [ebx], al
inc ebx
add esi, 1
js 0xbfac3c
mov ecx, dword [ebp - 0xb3c]
mov dword [ebp - 0xad8], ebx
xor ebx, ebx
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0xb40], ebx
test eax, eax
jg 0xbfac7a
jns 0xbfac7a
xor eax, eax
mov ecx, eax
mov dword [ebp - 0xb3c], ecx
mov esi, dword [ebp - 0xab0]
jmp 0xb8655a
mov ebx, 0xc0000017
jmp 0xb86a2f
mov ebx, 0xc0000017
xor edx, edx
jmp 0xb86a27
mov ebx, 0xc0000017
jmp 0xb86a27
cmp dword [esi + 4], 0
je 0xbfacc1
push dword [esi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 4], edx
cmp dword [esi + 0xc], 0
je 0xbfacdd
push dword [esi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0xc], edx
cmp dword [esi + 0x14], 0
je 0xbfacf9
push dword [esi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [esi + 0x14], edx
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb86a2f
xor eax, eax
cmp dword [edi + 4], eax
je 0xbfad2a
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xbfad46
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xbfad62
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb86a59
mov ebx, 0xc0000001
jmp 0xb86a59
mov edi, dword [ebp - 0xe70]
test ebx, ebx
js 0xb86c70
jmp 0xb86b14
mov ebx, 0xc0000017
jmp 0xb86c70
xor eax, eax
jmp 0xb86c68
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb86c70
mov ebx, 0xc0000095
mov dword [ebp - 0xa94], ebx
mov eax, dword [ebp - 0xd10]
jmp 0xb86d02
mov ebx, 0xc000000d
mov dword [ebp - 0xa94], ebx
mov esi, dword [ebp - 0xad4]
jmp 0xb86f3a
mov edi, dword [ebp - 0xae4]
jmp 0xb86daf
mov eax, dword [ebp - 0xe74]
test ebx, ebx
js 0xbfadd9
jmp 0xb86f27
mov ebx, 0x8000ffff
jmp 0xb87a75
mov ecx, dword [ebp - 0xb14]
mov ebx, 0xd0000017
jmp 0xb86f67
mov ebx, 0x80070057
jmp 0xbfae95
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
jle 0xbfae5b
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xa94], ebx
test ebx, ebx
jmp 0xbfae5b
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0xa94], ebx
test ebx, ebx
mov esi, dword [ebp - 0xad4]
js 0xb87021
mov ebx, 0x80004005
mov dword [ebp - 0xa94], ebx
jmp 0xb87021
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
mov dword [ebp - 0xa94], ebx
test ebx, ebx
jle 0xbfae55
jmp 0xbfae44
mov esi, dword [ebp - 0xad4]
jmp 0xb87021
mov ebx, 0x8007007a
mov dword [ebp - 0xa94], ebx
jmp 0xb87a81
mov ebx, 0xc000003e
jmp 0xb87360
mov ebx, 0xc000003e
jmp 0xbfafb7
mov ebx, 0xc0000017
jmp 0xb8734a
mov ebx, 0xc0000017
xor eax, eax
jmp 0xb87342
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
jmp 0xb872b8
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
jmp 0xb872fa
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
jmp 0xb8733c
cmp dword [esi + 4], 0
je 0xbfaf08
push dword [esi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 4], eax
cmp dword [esi + 0xc], 0
je 0xbfaf24
push dword [esi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0xc], eax
cmp dword [esi + 0x14], 0
je 0xbfaf40
push dword [esi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [esi + 0x14], eax
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb8734a
cmp dword [edi + 4], 0
je 0xbfaf70
push dword [edi + 4]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 4], ecx
cmp dword [edi + 0xc], 0
je 0xbfaf8c
push dword [edi + 0xc]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0xc], ecx
cmp dword [edi + 0x14], 0
je 0xbfafa8
push dword [edi + 0x14]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [edi + 0x14], ecx
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
jmp 0xb87360
mov ebx, 0xd000000d
mov dword [ebp - 0xa94], ebx
jmp 0xb87827
or dword [ebp - 0xb24], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0xb34], ebx
mov eax, ebx
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xb04], ebx
test edi, edi
je 0xbfb03d
push 0x38
pop esi
push 4
pop eax
cmp ebx, eax
jge 0xbfb00f
mov eax, dword [ebp - 0xb08]
lea ecx, [esi - 0x20]
movzx eax, byte [eax]
shl eax, cl
or dword [ebp - 0xb04], eax
jmp 0xbfb01c
movzx eax, byte [ecx]
mov ecx, esi
shl eax, cl
or dword [ebp - 0xb20], eax
mov ecx, dword [ebp - 0xb08]
inc ebx
sub esi, 8
inc ecx
mov dword [ebp - 0xb08], ecx
cmp ebx, edi
jl 0xbfaff2
mov esi, dword [ebp - 0xae4]
mov eax, dword [ebp - 0xb20]
mov ebx, dword [ebp - 0xb04]
xor eax, 0x699a899c
xor ebx, 0x92f65a5
mov dword [ebp - 0xb24], eax
xor ecx, ecx
mov dword [ebp - 0xb34], ebx
test edi, edi
je 0xbfb089
cmp ecx, 4
jge 0xbfb06c
rol ebx, 8
mov byte [esi], bl
jmp 0xbfb071
rol eax, 8
mov byte [esi], al
inc ecx
inc esi
cmp ecx, edi
jl 0xbfb060
mov ebx, dword [ebp - 0xb34]
mov eax, dword [ebp - 0xb24]
mov dword [ebp - 0xae4], esi
add edi, 0xfffffffc
test edi, edi
jle 0xbfb0af
push 4
pop ecx
sub ecx, edi
shl ecx, 3
shr eax, cl
shl eax, cl
mov dword [ebp - 0xad8], eax
mov esi, eax
mov dword [ebp - 0xb24], eax
jmp 0xb87425
xor eax, eax
mov esi, eax
mov dword [ebp - 0xb24], esi
test edi, edi
jns 0xb87425
neg edi
shl edi, 3
mov ecx, edi
shr ebx, cl
shl ebx, cl
jmp 0xb8741f
mov esi, dword [ebp - 0xaa4]
mov edi, 0xc004d501
xor eax, eax
jmp 0xb877ee
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb877f6
mov ebx, 0xd0000001
xor ecx, ecx
jmp 0xb87819
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
jmp 0xb87827
or ecx, 0xffffffff
jmp 0xb879a8
mov ecx, dword [ebp - 0xd18]
jmp 0xb879c1
or eax, 0xffffffff
jmp 0xb879d6
mov ebx, 0xc000000d
jmp 0xb87a6f
mov ebx, 0xc0000095
jmp 0xb87a6f
mov ebx, 0xc0000017
jmp 0xb87a59
mov ebx, 0xc000003e
jmp 0xb87a6f
mov ebx, 0xc004d501
jmp 0xbfaa87
mov ebx, 0xc000000d
mov dword [ebp - 0xa94], ebx
mov eax, dword [ebp - 0xacc]
push 4
pop edx
jmp 0xb87c4e
mov esi, dword [ebp - 0xe78]
mov eax, dword [ebp - 0xe94]
jmp 0xb87c33
mov eax, 0x8007007a
mov dword [ebp - 0xacc], eax
jmp 0xb87c61
mov edx, dword [ebp - 0xd3c]
mov ebx, 0xc000000d
mov ecx, dword [ebp - 0xd40]
mov dword [ebp - 0xa94], ebx
mov dword [ebp - 0xb10], edx
mov dword [ebp - 0xaec], ecx
jmp 0xb87d4b
push 4
pop edx
jmp 0xb87ca2
mov esi, dword [ebp - 0xe98]
mov eax, dword [ebp - 0xe9c]
jmp 0xb87d29
mov eax, dword [ebp - 0xd3c]
mov dword [ebp - 0xb10], eax
mov eax, dword [ebp - 0xd40]
mov dword [ebp - 0xaec], eax
jmp 0xb87d4b
mov ebx, 0xc000000d
mov dword [ebp - 0xa94], ebx
mov eax, dword [ebp - 0xd1c]
push 4
pop edx
jmp 0xb87e0d
mov esi, dword [ebp - 0xe48]
mov eax, dword [ebp - 0xe4c]
jmp 0xb87df8
mov ebx, 0xc000000d
jmp 0xbfaa87
mov eax, dword [ebp - 0xe50]
mov esi, dword [ebp - 0xe30]
mov dword [ebp - 0xabc], eax
jmp 0xb87ec6
mov edi, dword [ebp - 0xe20]
mov eax, dword [ebp - 0xe24]
jmp 0xb87f6b
mov eax, dword [ebp - 0xe28]
jmp 0xb87f80
or eax, 0xffffffff
jmp 0xb87fad
or ecx, 0xffffffff
jmp 0xb87fdf
mov edi, dword [ebp - 0xe2c]
mov eax, dword [ebp - 0xe34]
jmp 0xb88038
mov ecx, dword [ebp - 0xab4]
jmp 0xb8804d
mov dword [0xd09360], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x2c8]
push eax
push 0xb10000
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
test eax, eax
je 0xbffad1
cmp eax, esi
jne 0xbfb2c9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0x7a
je 0xbffad1
mov esi, dword [0xd0807c]
xor ebx, ebx
push 0x403
push ebx
push ebx
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xaa4], eax
test eax, eax
jne 0xbfb2f7
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xbffad3
mov esi, dword [0xd0804c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [0xd09358], eax
mov eax, dword [0xd09360]
push 0x54
mov dword [ebp - 0xb10], eax
lea eax, [ebp - 0x778]
push ebx
push eax
mov dword [0xd0935c], edx
call fcn.00bc259b
xor eax, eax
mov dword [ebp - 0xd94], ebx
lea edi, [ebp - 0xc34]
mov dword [ebp - 0xd90], ebx
stosd dword es:[edi], eax
add esp, 0xc
mov dword [ebp - 0xadc], ebx
mov dword [ebp - 0xae0], ebx
stosd dword es:[edi], eax
push 0x2c
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.00bc259b
add esp, 0xc
mov dword [ebp - 0xb50], ebx
mov esi, 0xd0aed4
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xbfb370
mov eax, dword [0xd0a150]
test eax, eax
jne 0xbfb99f
push 0x338
mov esi, ebx
mov dword [ebp - 0xaa8], ebx
push ebx
mov dword [ebp - 0xa9c], ebx
mov dword [ebp - 0xab0], esi
mov dword [ebp - 0xafc], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xad0], eax
test eax, eax
je 0xbfb991
or dword [ebp - 0xabc], 0xffffffff
mov edi, 0xb2bef2
add eax, 7
mov dword [ebp - 0x3b8], 0xab69605e
mov cl, bl
mov dword [ebp - 0x3b4], 0x7f1137f
mov dword [ebp - 0xaac], ebx
mov dword [ebp - 0xb68], esi
mov dword [ebp - 0xb80], ebx
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xab8], edi
mov dword [ebp - 0xaf0], 0x67
movzx edx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl edx, 8
or edx, eax
movzx eax, byte [edi]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl edx, 8
or edx, eax
shl edi, 8
mov eax, dword [ebp - 0xab8]
xor ebx, edx
mov dword [ebp - 0xac0], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xab8]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xab8]
shl edi, 8
add dword [ebp - 0xab8], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, ebx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor ebx, edx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xab4], esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea esi, [ebx - 0x7f1]
xor esi, dword [ebp - 0xab4]
xor esi, 0xab69605e
mov eax, esi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, esi
shr eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 7
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor ebx, edx
mov eax, ebx
mov dword [ebp - 0xab4], ebx
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 7
add edx, eax
xor esi, edx
mov ebx, esi
xor ebx, dword [ebp - 0xab4]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor esi, eax
lea eax, [esi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xe
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xabc]
rol eax, 2
mov dword [ebp - 0xb68], esi
mov dword [ebp - 0xabc], edi
xor edx, eax
mov edi, dword [ebp - 0xab8]
xor edx, dword [ebp - 0xaac]
xor ebx, edx
mov edx, dword [ebp - 0xac8]
mov dword [ebp - 0xb80], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb68]
ror dword [ebp - 0xb80], 8
mov byte [edx], al
mov al, byte [ebp - 0xb80]
ror dword [ebp - 0xb68], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb68]
ror dword [ebp - 0xb80], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb80]
ror dword [ebp - 0xb68], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb68]
ror dword [ebp - 0xb80], 8
mov byte [edx - 2], al
ror dword [ebp - 0xb68], 8
mov al, byte [ebp - 0xb80]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb68]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [ebp - 0xb80]
mov esi, dword [ebp - 0xb68]
mov eax, dword [ebp - 0xac0]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xaf0], 1
mov dword [ebp - 0xb80], ebx
mov dword [ebp - 0xb68], esi
mov dword [ebp - 0xaac], eax
mov dword [ebp - 0xac8], edx
jne 0xbfb412
mov esi, dword [ebp - 0xad0]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xbfb763
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xbfb795
cmp edx, dword [0xb2c22c]
jne 0xbfb795
mov ebx, esi
xor eax, eax
mov dword [ebp - 0xab0], ebx
mov esi, eax
mov edi, 0x337
jmp 0xbfb7aa
mov ebx, dword [ebp - 0xab0]
or edi, 0xffffffff
mov dword [ebp - 0xafc], 0xc004d501
xor eax, eax
test esi, esi
je 0xbfb7bd
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xafc], 0
jl 0xbfb98b
xor eax, eax
mov esi, ebx
push 0x40
push eax
push 0xd0ae80
mov byte [edi + ebx], al
call fcn.00bc259b
add esp, 0xc
cmp byte [ebx], 0
je 0xbfb921
mov edi, 0xd0ae80
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbf0]
jne 0xbfb7f6
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xbfb984
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa9c], edx
cmp word [eax], cx
jne 0xbfb86c
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xbfb86c
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xbfb86c
cmp dword [ecx], 0x4550
jne 0xbfb86c
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xbc4]
je 0xbfb879
cmp ax, word [ebp - 0xbbc]
je 0xbfb879
mov edx, 0xc000000d
jmp 0xbfb871
mov edx, 0xc000007b
mov dword [ebp - 0xa9c], edx
jmp 0xbfb88b
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xaac], eax
test eax, eax
je 0xbfb915
mov ecx, esi
mov dword [ebp - 0xac0], esi
xor eax, eax
mov dword [ebp - 0xc9c], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xab4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xbfb8b5
sub ecx, dword [ebp - 0xab4]
inc esi
add esi, ecx
test edx, edx
js 0xbfb8ff
mov ecx, dword [ebp - 0xac0]
lea eax, [ebp - 0xc9c]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa9c], edx
test edx, edx
js 0xbfb921
mov eax, dword [ebp - 0xaa8]
mov ecx, dword [ebp - 0xc9c]
mov dword [eax*4 + section..data], ecx
jmp 0xbfb905
mov eax, dword [ebp - 0xaa8]
inc eax
inc ebx
mov dword [ebp - 0xaa8], eax
cmp ebx, dword [ebp - 0xaac]
jb 0xbfb89c
add edi, 0x10
cmp byte [esi], 0
jne 0xbfb7ef
mov ebx, dword [ebp - 0xa9c]
mov esi, dword [ebp - 0xab0]
test esi, esi
je 0xbfb942
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xbfb998
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xbfb95b
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xbfb94a
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xbfb9a5
mov ebx, 0xc000007a
jmp 0xbfb927
mov esi, dword [ebp - 0xab0]
mov ebx, 0xc000007a
jmp 0xbfb92d
mov eax, dword [0xd0a150]
xor ebx, ebx
inc eax
mov dword [0xd0a150], eax
xor eax, eax
mov edx, 0xd0aed4
xchg dword [edx], eax
xor eax, eax
mov dword [ebp - 0xa], ebx
lea edi, [ebp - 0xcc8]
mov dword [ebp - 0xae8], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0xb14], ebx
mov dword [ebp - 0xaec], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xdb0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0xbfb9da
mov eax, dword [0xd0a150]
test eax, eax
jne 0xbfc00e
push 0x338
mov esi, ebx
mov dword [ebp - 0xaa8], ebx
push ebx
mov dword [ebp - 0xa9c], ebx
mov dword [ebp - 0xab0], esi
mov dword [ebp - 0xafc], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xad0], eax
test eax, eax
je 0xbfc000
or dword [ebp - 0xabc], 0xffffffff
mov edi, ebx
add eax, 7
mov dword [ebp - 0x3c0], 0xab69605e
mov cl, bl
mov dword [ebp - 0x3bc], 0x7f1137f
mov dword [ebp - 0xaac], ebx
mov esi, 0xb2bef2
mov dword [ebp - 0xb58], ebx
mov dword [ebp - 0xb84], edi
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xaf0], 0x67
movzx edx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx ebx, byte [esi + 2]
shl edx, 8
or edx, eax
shl ebx, 8
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 3]
or ebx, eax
mov dword [ebp - 0xab4], edx
movzx eax, byte [esi + 4]
xor edi, edx
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 5]
add esi, 8
shl ebx, 8
or ebx, eax
mov dword [ebp - 0xac0], esi
mov esi, edi
xor esi, ebx
xor esi, dword [ebp - 0xb58]
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor edi, edx
lea eax, [edi + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, edi
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor edi, edx
mov eax, edi
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor edi, eax
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor edi, edx
lea eax, [edi + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, edi
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, edi
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor edi, eax
mov dword [ebp - 0xac4], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0xac4]
xor edi, 0xab69605e
mov eax, edi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, edi
shr eax, 2
add edx, eax
xor esi, edx
lea eax, [esi - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, esi
rol eax, 7
add edx, eax
xor edi, edx
mov eax, edi
mov edx, edi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xac4], esi
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 7
add edx, eax
mov eax, esi
xor edi, edx
xor eax, edi
xor eax, 0xac987321
mov dword [ebp - 0xac4], eax
ror eax, 3
sub eax, 0xab69
mov esi, dword [ebp - 0xac4]
imul eax, eax, 0x137f
xor edi, eax
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, edi
ror eax, 6
sub edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, esi
rol eax, 0xe
add edx, eax
xor edi, edx
lea eax, [edi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, edi
ror eax, 0xe
sub edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xac4], esi
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, esi
shr eax, 3
xor edx, eax
xor edi, edx
mov eax, edi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, edi
xor edi, dword [ebp - 0xabc]
rol eax, 2
mov dword [ebp - 0xb58], edi
mov dword [ebp - 0xabc], ebx
xor edx, eax
mov eax, esi
xor edx, dword [ebp - 0xaac]
xor eax, edx
mov esi, dword [ebp - 0xac0]
mov edx, dword [ebp - 0xac8]
mov dword [ebp - 0xb84], eax
mov byte [edx - 4], al
mov al, byte [ebp - 0xb58]
ror dword [ebp - 0xb84], 8
mov byte [edx], al
mov al, byte [ebp - 0xb84]
ror dword [ebp - 0xb58], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb58]
ror dword [ebp - 0xb84], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb84]
ror dword [ebp - 0xb58], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb58]
ror dword [ebp - 0xb84], 8
mov byte [edx - 2], al
mov al, byte [ebp - 0xb84]
ror dword [ebp - 0xb58], 8
mov byte [edx - 7], al
mov al, byte [ebp - 0xb58]
mov byte [edx - 3], al
add edx, 8
mov eax, dword [ebp - 0xb84]
ror dword [ebp - 0xb58], 8
ror eax, 8
sub dword [ebp - 0xaf0], 1
mov dword [ebp - 0xac4], eax
mov edi, dword [ebp - 0xac4]
mov dword [ebp - 0xb84], eax
mov eax, dword [ebp - 0xab4]
mov dword [ebp - 0xaac], eax
mov dword [ebp - 0xac8], edx
jne 0xbfba78
mov esi, dword [ebp - 0xad0]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xbfbdd2
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xbfbe04
cmp edx, dword [0xb2c22c]
jne 0xbfbe04
mov ebx, esi
xor eax, eax
mov dword [ebp - 0xab0], ebx
mov esi, eax
mov edi, 0x337
jmp 0xbfbe19
mov ebx, dword [ebp - 0xab0]
or edi, 0xffffffff
mov dword [ebp - 0xafc], 0xc004d501
xor eax, eax
test esi, esi
je 0xbfbe2c
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
cmp dword [ebp - 0xafc], 0
jl 0xbfbffa
xor eax, eax
mov esi, ebx
push 0x40
push eax
push 0xd0ae80
mov byte [ebx + edi], al
call fcn.00bc259b
add esp, 0xc
cmp byte [ebx], 0
je 0xbfbf90
mov edi, 0xd0ae80
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbf0]
jne 0xbfbe65
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xbfbff3
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa9c], edx
cmp word [eax], cx
jne 0xbfbedb
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xbfbedb
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xbfbedb
cmp dword [ecx], 0x4550
jne 0xbfbedb
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xbc4]
je 0xbfbee8
cmp ax, word [ebp - 0xbbc]
je 0xbfbee8
mov edx, 0xc000000d
jmp 0xbfbee0
mov edx, 0xc000007b
mov dword [ebp - 0xa9c], edx
jmp 0xbfbefa
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xaac], eax
test eax, eax
je 0xbfbf84
mov ecx, esi
mov dword [ebp - 0xac0], esi
xor eax, eax
mov dword [ebp - 0xbe4], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xab4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xbfbf24
sub ecx, dword [ebp - 0xab4]
inc esi
add esi, ecx
test edx, edx
js 0xbfbf6e
mov ecx, dword [ebp - 0xac0]
lea eax, [ebp - 0xbe4]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa9c], edx
test edx, edx
js 0xbfbf90
mov eax, dword [ebp - 0xaa8]
mov ecx, dword [ebp - 0xbe4]
mov dword [eax*4 + section..data], ecx
jmp 0xbfbf74
mov eax, dword [ebp - 0xaa8]
inc eax
inc ebx
mov dword [ebp - 0xaa8], eax
cmp ebx, dword [ebp - 0xaac]
jb 0xbfbf0b
add edi, 0x10
cmp byte [esi], 0
jne 0xbfbe5e
mov ebx, dword [ebp - 0xa9c]
mov esi, dword [ebp - 0xab0]
test esi, esi
je 0xbfbfb1
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xbfc007
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xbfbfca
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xbfbfb9
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xbfc014
mov ebx, 0xc000007a
jmp 0xbfbf96
mov esi, dword [ebp - 0xab0]
mov ebx, 0xc000007a
jmp 0xbfbf9c
mov eax, dword [0xd0a150]
xor ebx, ebx
inc eax
mov dword [0xd0a150], eax
xor eax, eax
mov edi, 0xd0aed4
xchg dword [edi], eax
push 0x54
lea eax, [ebp - 0x778]
push ebx
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0xb10]
add esp, 0xc
mov esi, dword [0xd0807c]
mov ecx, eax
mov dword [ebp - 0xc34], ebx
push 0xf
pop edx
and ecx, edx
mov dword [ebp - 0xad4], ecx
mov ecx, eax
shr ecx, 4
and ecx, edx
mov word [ebp - 0xc], cx
mov ecx, eax
shr ecx, 8
push 0x403
and ecx, edx
shr eax, 0xc
push ebx
mov word [ebp - 0xa], cx
and eax, edx
push ebx
mov ecx, esi
mov word [ebp - 8], ax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xab0], 0xffffff
test eax, eax
jne 0xbfc0b9
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xbfc0a9
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xbfd4ed
mov ebx, 0x80004005
jmp 0xbfd4ed
mov esi, dword [0xd08050]
mov eax, ebx
mov dword [ebp - 0xab8], eax
mov edi, ebx
lea eax, [ebp - 0xc74]
mov dword [ebp - 0xae4], edi
push eax
push ebx
lea eax, [ebp - 0xc1c]
mov dword [ebp - 0xc20], ebx
push eax
push 8
mov ecx, esi
mov dword [ebp - 0xb10], ebx
mov dword [ebp - 0xacc], ebx
mov dword [ebp - 0xc74], ebx
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xbfc18f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xbfc121
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xbfc2f8
mov ebx, 0x80004005
mov esi, dword [ebp - 0xacc]
xor edx, edx
mov eax, dword [ebp - 0xc20]
test eax, eax
je 0xbfc150
mov ecx, dword [ebp - 0xb10]
test ecx, ecx
je 0xbfc150
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0xbfc148
test esi, esi
je 0xbfc163
push esi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xc20]
test eax, eax
je 0xbfca54
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebp - 0xc20], ecx
jmp 0xbfca56
mov eax, dword [ebp - 0xc74]
add eax, eax
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xac8], ebx
test ebx, ebx
je 0xbfc22a
mov eax, dword [ebp - 0xc1c]
lea eax, [eax*4 + 4]
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xabc], eax
test eax, eax
je 0xbfc2dd
mov esi, eax
lea eax, [ebp - 0xc74]
push eax
push ebx
mov ebx, dword [0xd08050]
lea eax, [ebp - 0xc1c]
push eax
push 8
mov ecx, ebx
call dword [0xd0cffc]
call ebx
test eax, eax
jne 0xbfc234
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xbfc21c
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xbfc223
mov ebx, 0x80004005
xor ecx, ecx
jmp 0xbfc2c8
mov ebx, 0x8007000e
jmp 0xbfc12c
mov eax, dword [ebp - 0xabc]
xor ecx, ecx
mov ebx, eax
mov edi, dword [ebp - 0xac8]
mov dword [ebp - 0xaac], ecx
cmp dword [ebp - 0xc1c], ecx
jbe 0xbfc2a5
mov esi, dword [0xd08058]
push ecx
push edi
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, edi
mov dword [ebx], eax
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0xbfc26d
sub ecx, edx
sar ecx, 1
push 4
pop eax
add ebx, eax
mov eax, dword [ebp - 0xaac]
lea edi, [edi + ecx*2]
add edi, 2
inc eax
push 0
mov dword [ebp - 0xaac], eax
pop ecx
cmp eax, dword [ebp - 0xc1c]
jb 0xbfc252
mov eax, dword [ebp - 0xabc]
mov dword [ebx], 0x409
mov edi, eax
mov ebx, dword [ebp - 0xab8]
mov esi, ecx
mov dword [ebp - 0xae4], eax
mov eax, dword [ebp - 0xc1c]
inc eax
mov dword [ebp - 0xaac], eax
test esi, esi
je 0xbfc2e2
push esi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xbfc2e2
mov ebx, 0x8007000e
push dword [ebp - 0xac8]
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xbfc12c
xor eax, eax
mov ebx, eax
mov edx, eax
mov dword [ebp - 0xafc], ebx
cmp dword [ebp - 0xaac], eax
jbe 0xbfc33f
mov ecx, eax
mov eax, dword [edi + edx*4]
cmp eax, dword [ecx*4 + 0xb40a18]
je 0xbfc335
inc ecx
cmp ecx, 0x26
jb 0xbfc316
inc edx
xor eax, eax
cmp edx, dword [ebp - 0xaac]
jae 0xbfc33f
jmp 0xbfc314
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0xafc], ebx
mov esi, dword [0xd08054]
mov ecx, esi
push eax
mov dword [ebp - 0xad0], eax
lea eax, [ebp - 0xc0]
push 0x55
push eax
push dword [ebx*4 + 0xb40a18]
call dword [0xd0cffc]
call esi
test eax, eax
je 0xbfc3a2
mov esi, dword [0xd08048]
lea eax, [ebp - 0x640]
push 0x10
push eax
push 0x58
lea eax, [ebp - 0xc0]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
test eax, eax
jle 0xbfc3a2
mov edi, dword [ebp - 0x634]
shr edi, 0x1b
and edi, 1
mov dword [ebp - 0xad0], edi
xor eax, eax
mov edx, 0xb2fcd8
mov esi, eax
mov ecx, edx
mov dword [ebp + esi*4 - 0x350], edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbf0]
jne 0xbfc3b7
sub ecx, edi
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
inc esi
cmp esi, 0x13
jb 0xbfc3ab
imul ecx, ebx, 3
movzx eax, byte [ecx + 0xb320b0]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xcc8], eax
movzx eax, byte [ecx + 0xb320b1]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xcc4], eax
movzx eax, byte [ecx + 0xb320b2]
mov eax, dword [ebp + eax*4 - 0x350]
mov dword [ebp - 0xcc0], eax
xor ebx, ebx
push 0x1c90
mov eax, ebx
push ebx
mov dword [ebp - 0xab8], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0xb04], ecx
test ecx, ecx
je 0xbfc22a
or dword [ebp - 0xabc], 0xffffffff
mov edi, ebx
add ecx, 7
mov dword [ebp - 0x3c8], 0xab69605e
mov al, bl
mov dword [ebp - 0x3c4], 0x7f1137f
mov dword [ebp - 0xaac], ebx
mov esi, 0xb40ac2
mov dword [ebp - 0xb5c], ebx
mov dword [ebp - 0xb88], edi
mov dword [ebp - 0xac8], ecx
mov dword [ebp - 0xaf0], 0x392
movzx ebx, byte [esi - 2]
movzx ecx, byte [esi - 1]
movzx edx, byte [esi + 2]
shl edx, 8
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 3]
or edx, ecx
mov dword [ebp - 0xac0], ebx
movzx ecx, byte [esi + 4]
xor edi, ebx
shl edx, 8
mov ebx, 0xab69605e
or edx, ecx
movzx ecx, byte [esi + 5]
shl edx, 8
add esi, 8
or edx, ecx
mov dword [ebp - 0xad8], esi
mov esi, edx
mov dword [ebp - 0xaa8], edx
xor esi, dword [ebp - 0xb5c]
xor esi, edi
xor esi, 0xac987321
lea ecx, [esi + 0x54969fa2]
rol ecx, 5
imul edx, ecx, 0x137f
mov ecx, esi
rol ecx, 0xa
add edx, ecx
xor edi, edx
lea ecx, [edi + 0x7f1137f]
ror ecx, 9
imul edx, ecx, 0xab69
mov ecx, edi
rol ecx, 2
sub edx, ecx
xor esi, edx
imul edx, esi, 0x605e
mov ecx, esi
shr ecx, 0xd
sub edx, ecx
sub edx, 0x756c8a2
xor edi, edx
mov ecx, edi
xor ecx, 0xab69
rol ecx, 6
imul edx, ecx, 0x7f1
mov ecx, edi
rol ecx, 2
sub edx, ecx
mov ecx, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, ebx
sub ecx, edx
xor edi, ecx
mov ecx, edi
mov edx, edi
xor ecx, 0x137f
ror edx, 6
imul ecx, ecx, 0xab69
xor edx, ecx
xor esi, edx
lea ecx, [esi + 0x7f1137f]
ror ecx, 0xf
imul edx, ecx, 0x605e
mov ecx, esi
rol ecx, 2
add edx, ecx
xor edi, edx
lea ecx, [edi + 0x54969fa2]
ror ecx, 0xe
imul edx, ecx, 0x7f1
mov ecx, edi
rol ecx, 8
sub edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, ebx
ror ecx, 0xc
imul edx, ecx, 0x137f
mov ecx, esi
ror ecx, 0xa
xor edx, ecx
xor edi, edx
mov ecx, edi
xor ecx, 0x7f1
imul edx, ecx, 0xab69
mov ecx, edi
shr ecx, 0xa
xor edx, ecx
xor esi, edx
mov ecx, esi
not ecx
ror ecx, 5
add ecx, 0x605e
imul ecx, ecx, 0x7f1
xor edi, ecx
mov dword [ebp - 0xab4], edi
add edi, 0xfffff80f
xor edi, esi
mov esi, dword [ebp - 0xab4]
xor edi, ebx
mov ecx, edi
xor ecx, 0x7f1
rol ecx, 2
imul edx, ecx, 0x137f
mov ecx, edi
shr ecx, 2
add edx, ecx
xor esi, edx
lea ecx, [esi - 0x7f1137f]
ror ecx, 6
imul edx, ecx, 0xab69
mov ecx, esi
rol ecx, 7
add edx, ecx
xor edi, edx
mov ecx, edi
mov edx, edi
xor ecx, 0x137f
ror edx, 9
imul ecx, ecx, 0x605e
add edx, ecx
xor esi, edx
mov ecx, esi
xor ecx, 0xab69
rol ecx, 5
imul edx, ecx, 0x7f1
mov ecx, esi
rol ecx, 7
add edx, ecx
xor edi, edx
mov ebx, edi
xor ebx, esi
xor ebx, 0xac987321
mov ecx, ebx
ror ecx, 3
sub ecx, 0xab69
imul ecx, ecx, 0x137f
xor edi, ecx
lea ecx, [edi - 0x7f1137f]
ror ecx, 1
imul edx, ecx, 0x605e
mov ecx, edi
ror ecx, 6
sub edx, ecx
xor ebx, edx
lea ecx, [ebx - 0x54969fa2]
rol ecx, 3
imul edx, ecx, 0x7f1
mov ecx, ebx
rol ecx, 0xe
add edx, ecx
xor edi, edx
lea ecx, [edi - 0x54969fa2]
mov esi, dword [ebp - 0xad8]
rol ecx, 0xf
imul edx, ecx, 0x137f
mov ecx, edi
ror ecx, 0xe
sub edx, ecx
xor ebx, edx
mov ecx, ebx
xor ecx, 0x605e
imul edx, ecx, 0xab69
mov ecx, ebx
shr ecx, 3
xor edx, ecx
xor edi, edx
mov ecx, edi
xor ecx, 0x7f1137f
rol ecx, 4
imul edx, ecx, 0x605e
mov ecx, edi
xor edi, dword [ebp - 0xabc]
rol ecx, 2
mov dword [ebp - 0xb5c], edi
xor edx, ecx
xor edx, dword [ebp - 0xaac]
xor ebx, edx
mov edx, dword [ebp - 0xac8]
mov dword [ebp - 0xb88], ebx
mov byte [edx - 4], bl
mov cl, byte [ebp - 0xb5c]
ror dword [ebp - 0xb88], 8
mov byte [edx], cl
mov cl, byte [ebp - 0xb88]
ror dword [ebp - 0xb5c], 8
mov byte [edx - 5], cl
mov cl, byte [ebp - 0xb5c]
ror dword [ebp - 0xb88], 8
mov byte [edx - 1], cl
mov cl, byte [ebp - 0xb88]
ror dword [ebp - 0xb5c], 8
mov byte [edx - 6], cl
mov cl, byte [ebp - 0xb5c]
ror dword [ebp - 0xb88], 8
mov byte [edx - 2], cl
mov cl, byte [ebp - 0xb88]
ror dword [ebp - 0xb5c], 8
mov byte [edx - 7], cl
mov cl, byte [ebp - 0xb5c]
mov byte [edx - 3], cl
add edx, 8
mov edi, dword [ebp - 0xb88]
mov ecx, dword [ebp - 0xac0]
ror dword [ebp - 0xb5c], 8
ror edi, 8
sub dword [ebp - 0xaf0], 1
mov dword [ebp - 0xaac], ecx
mov ecx, dword [ebp - 0xaa8]
mov dword [ebp - 0xb88], edi
mov dword [ebp - 0xabc], ecx
mov dword [ebp - 0xac8], edx
jne 0xbfc48b
xor ecx, ecx
mov esi, 0x1c90
mov edx, ecx
mov ecx, dword [ebp - 0xb04]
xor al, byte [edx + ecx]
inc edx
cmp edx, esi
jb 0xbfc7d9
movzx eax, al
cdq
cmp eax, dword [0xb42750]
jne 0xbfc80d
cmp edx, dword [0xb42754]
jne 0xbfc80d
mov ebx, dword [ebp - 0xab8]
xor edx, edx
mov dword [ebp - 0xc20], ecx
mov ecx, edx
mov dword [ebp - 0xb10], esi
jmp 0xbfc81a
mov ebx, 0xc004d501
xor edx, edx
mov dword [ebp - 0xab8], ebx
test ecx, ecx
je 0xbfc82d
push ecx
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xbfc12c
mov esi, dword [ebp - 0xc20]
xor eax, eax
mov ebx, dword [ebp - 0xafc]
mov edi, eax
mov edx, eax
cmp ebx, edx
jne 0xbfc852
mov dword [ebp + edi*4 - 0x300], esi
mov ecx, esi
lea eax, [ecx + 1]
mov dword [ebp - 0xab4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xbfc85d
sub ecx, dword [ebp - 0xab4]
inc esi
add esi, ecx
inc edx
cmp edx, 0x26
jb 0xbfc847
inc edi
push 0
pop eax
cmp edi, 6
jb 0xbfc845
push 0xc
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, dword [ebp - 0xab8]
mov edx, eax
mov dword [ebp - 0xaac], edx
test edx, edx
jne 0xbfc8ac
xor edx, edx
mov ebx, 0x8007000e
mov esi, edx
jmp 0xbfc134
mov edi, edx
xor eax, eax
mov esi, edx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov ecx, eax
mov dword [ebp - 0xaa8], eax
movzx edx, word [ebp + ecx*2 - 0xc]
cmp dx, word [eax*2 + 0xb40ab0]
je 0xbfc8d9
inc eax
cmp eax, 6
jb 0xbfc8c4
jmp 0xbfc998
mov edx, dword [ebp + eax*4 - 0x300]
mov ecx, edx
mov dword [ebp - 0xab4], edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xbfc8eb
xor eax, eax
sub ecx, edi
mov edi, dword [0xd08060]
push eax
push eax
lea eax, [ecx + 1]
mov ecx, edi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0xd0cffc]
call edi
mov dword [ebp - 0xac0], eax
test eax, eax
je 0xbfc9d0
lea ecx, [eax + eax]
xor eax, eax
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, dword [ebp - 0xaa8]
mov edi, eax
mov eax, dword [ebp - 0xaac]
mov dword [eax + ecx*4], edi
test edi, edi
je 0xbfc9c9
mov edx, dword [ebp - 0xab4]
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0xab4], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xbfc95d
push dword [ebp - 0xac0]
sub ecx, dword [ebp - 0xab4]
push edi
mov edi, dword [0xd08060]
lea eax, [ecx + 1]
mov ecx, edi
push eax
push edx
xor eax, eax
push eax
push 0xfde9
call dword [0xd0cffc]
call edi
test eax, eax
je 0xbfc9d0
mov ecx, dword [ebp - 0xaa8]
inc ecx
mov dword [ebp - 0xaa8], ecx
push 0
pop eax
cmp ecx, 3
jb 0xbfc8bf
mov eax, dword [ebp - 0xaac]
xor edx, edx
mov dword [ebp - 0xaec], eax
mov esi, edx
mov eax, dword [ebp - 0xad0]
mov dword [ebp - 0x778], eax
jmp 0xbfc9f0
mov ebx, 0x8007000e
jmp 0xbfc9ee
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xbfc9e7
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xbfc9ee
mov ebx, 0x80004005
xor edx, edx
test esi, esi
je 0xbfc134
mov edi, edx
mov edx, dword [esi + edi*4]
test edx, edx
je 0xbfca49
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0xab4], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbf0]
jne 0xbfca0c
sub ecx, dword [ebp - 0xab4]
xor eax, eax
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xbfca38
mov byte [edx], al
inc edx
sub ecx, 1
jne 0xbfca30
push dword [esi + edi*4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
inc edi
cmp edi, 3
jb 0xbfc9fa
jmp 0xbfc132
xor ecx, ecx
mov eax, dword [ebp - 0xae4]
test eax, eax
je 0xbfca6f
push eax
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xbfd4cf
mov eax, dword [ebp - 0xaec]
mov esi, dword [0xd080b4]
mov ecx, dword [eax]
mov dword [ebp - 0x770], ecx
mov ecx, dword [eax + 4]
mov dword [ebp - 0x76c], ecx
xor ecx, ecx
mov eax, dword [eax + 8]
mov edi, ecx
push ecx
mov dword [ebp - 0x768], eax
mov ebx, ecx
lea eax, [ebp - 0xdbc]
mov dword [ebp - 0xdb8], ecx
push eax
push ecx
mov dword [ebp - 0xdb4], ecx
mov ecx, esi
push 0x42
mov dword [ebp - 0xdbc], 0xc
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xbfcaf2
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xbfcae9
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xbfcafb
mov ebx, 0x80004005
jmp 0xbfcafb
mov edi, dword [ebp - 0xdb8]
and edi, 1
mov dword [ebp - 0x774], edi
test ebx, ebx
js 0xbfd4cf
mov edi, dword [ebp - 0xad4]
mov eax, edi
push 0x2a
pop ecx
mov dword [ebp - 0xacc], ecx
sub eax, 1
je 0xbfcb48
sub eax, 1
je 0xbfcb3c
sub eax, 1
jne 0xbfcb58
mov ebx, 0xe1
mov dword [ebp - 0xae8], ebx
mov dword [ebp - 0xb14], ebx
jmp 0xbfcb58
mov dword [ebp - 0xae8], 0xf
jmp 0xbfcb4e
mov dword [ebp - 0xae8], ecx
mov dword [ebp - 0xb14], 0xb
mov esi, 0xdc
mov dword [ebp - 0xab8], 0x60
push esi
xor ebx, ebx
lea eax, [ebp - 0x720]
push ebx
push eax
call fcn.00bc259b
add esp, 0xc
mov word [ebp - 0x6dc], si
mov esi, dword [0xd08070]
lea eax, [ebp - 0x720]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
call dword [0xd0cffc]
call esi
test eax, eax
je 0xbfcc5e
movzx ebx, word [ebp - 0x67a]
xor eax, eax
mov ecx, dword [ebp - 0x670]
mov dword [ebp - 0xdac], eax
mov dword [ebp - 0xdb0], eax
mov eax, dword [ebp - 0x674]
push 0x60
mov dword [ebp - 0xaa8], eax
mov dword [ebp - 0xda8], eax
pop eax
mov dword [ebp - 0xab8], ebx
mov dword [ebp - 0xaac], ecx
mov dword [ebp - 0xda4], ecx
cmp ebx, eax
jae 0xbfcbef
mov dword [ebp - 0xab8], eax
xor ebx, ebx
cmp edi, 1
mov edi, dword [ebp - 0xcc8]
je 0xbfcc02
mov edi, dword [ebp - 0xcc0]
push 0x5c
lea eax, [ebp - 0x620]
push ebx
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
xor eax, eax
mov ecx, esi
push 0x403
push eax
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xab4], eax
test eax, eax
jne 0xbfcc7b
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xbfcc4e
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xbfcd1b
mov ebx, 0x80004005
jmp 0xbfd4cf
mov eax, dword [ebp - 0xda4]
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0xda8]
mov dword [ebp - 0xaa8], eax
jmp 0xbfcbf1
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0xab8]
push dword [ebp - 0xae8]
call dword [0xd0cffc]
call esi
push edi
push 0x20
neg eax
mov dword [ebp - 0x610], 0x190
pop edx
lea ecx, [ebp - 0x604]
mov dword [ebp - 0x620], eax
mov byte [ebp - 0x606], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x620]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xbfccfc
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xbfccf3
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xbfcd02
mov ebx, 0x80004005
jmp 0xbfcd02
mov dword [ebp - 0x764], eax
push dword [ebp - 0xab4]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xbfd4cf
cmp dword [ebp - 0xad4], 1
mov edi, dword [ebp - 0xcc8]
je 0xbfcd38
mov edi, dword [ebp - 0xcc0]
xor eax, eax
push 0x5c
push eax
lea eax, [ebp - 0x5c0]
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xab4], eax
test eax, eax
jne 0xbfcd96
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xbfcd88
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
jns 0xbfcc54
push 0x20
pop edi
jmp 0xbfce38
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0xab8]
push dword [ebp - 0xb14]
call dword [0xd0cffc]
call esi
push edi
push 0x20
pop edi
neg eax
mov dword [ebp - 0x5b0], 0x190
mov edx, edi
mov dword [ebp - 0x5c0], eax
lea ecx, [ebp - 0x5a4]
mov byte [ebp - 0x5a6], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x5c0]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xbfce19
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xbfce10
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xbfce1f
mov ebx, 0x80004005
jmp 0xbfce1f
mov dword [ebp - 0x760], eax
push dword [ebp - 0xab4]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xbfd4cf
mov ebx, dword [ebp - 0xad4]
xor ecx, ecx
mov eax, ecx
mov edx, ecx
mov ecx, ebx
sub ecx, 1
je 0xbfce5d
sub ecx, 1
je 0xbfce9d
sub ecx, 1
jne 0xbfce69
mov eax, dword [ebp - 0xaa8]
mov edx, dword [ebp - 0xaac]
mov dword [ebp - 0xc2c], eax
mov dword [ebp - 0xc28], edx
xor ecx, ecx
inc ecx
cmp ebx, ecx
je 0xbfcedd
jbe 0xbfceaf
cmp ebx, 3
ja 0xbfceaf
xor ebx, ebx
mov ecx, ebx
mov dword [ebp - 0xacc], ebx
mov edx, ebx
mov dword [ebp - 0xaa8], ecx
mov dword [ebp - 0xae8], ebx
jmp 0xbfcef2
mov eax, dword [ebp - 0xaa8]
push 4
pop ecx
cdq
idiv ecx
xor ecx, ecx
mov edx, ecx
jmp 0xbfce69
mov ecx, dword [ebp - 0xc24]
xor ebx, ebx
mov edx, dword [ebp - 0xc24]
mov dword [ebp - 0xae8], ecx
mov ecx, dword [ebp - 0xc24]
mov dword [ebp - 0xacc], ecx
mov ecx, dword [ebp - 0xc24]
mov dword [ebp - 0xaa8], ecx
jmp 0xbfcef2
xor ebx, ebx
mov dword [ebp - 0xae8], edi
mov edx, 0x96
mov dword [ebp - 0xaa8], ebx
mov ecx, ebx
mov dword [ebp - 0xad0], edx
push dword [ebp - 0x764]
mov esi, dword [0xd0803c]
sub eax, edx
push dword [ebp - 0xac4]
mov edi, dword [ebp - 0x770]
sub eax, ecx
mov ecx, esi
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0x73c], eax
mov dword [ebp - 0x74c], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov ecx, esi
mov dword [ebp - 0xab4], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x754]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xac4]
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xbfcf68
mov ebx, 0x80004005
mov eax, dword [ebp - 0xab4]
test eax, eax
je 0xbfcf84
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xbfd4cf
push dword [ebp - 0x760]
mov esi, dword [0xd0803c]
xor eax, eax
push dword [ebp - 0xac4]
mov edi, dword [ebp - 0x76c]
mov ecx, esi
mov ebx, eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov ecx, esi
mov dword [ebp - 0xab4], eax
xor eax, eax
push eax
push 0xc50
lea eax, [ebp - 0x744]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xac4]
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xbfcfea
mov ebx, 0x80004005
mov eax, dword [ebp - 0xab4]
test eax, eax
je 0xbfd006
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xbfd4cf
mov eax, dword [ebp - 0xad4]
cmp eax, 2
je 0xbfd026
cmp eax, 3
je 0xbfd026
mov edi, dword [ebp - 0xac0]
jmp 0xbfd03a
mov edi, dword [ebp - 0x73c]
cmp dword [ebp - 0x74c], edi
jle 0xbfd03a
mov edi, dword [ebp - 0x74c]
cmp dword [ebp - 0x778], 0
mov esi, dword [0xd080a8]
mov ecx, esi
push dword [ebp - 0xacc]
je 0xbfd07b
mov ebx, dword [ebp - 0xaa8]
mov eax, ebx
sub eax, dword [ebp - 0x74c]
add eax, edi
push eax
lea eax, [ebp - 0x754]
push eax
call dword [0xd0cffc]
call esi
sub ebx, dword [ebp - 0x73c]
add ebx, edi
jmp 0xbfd091
mov ebx, dword [ebp - 0xad0]
lea eax, [ebp - 0x754]
push ebx
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x748]
add eax, dword [ebp - 0xae8]
mov esi, dword [0xd080a8]
mov ecx, esi
push eax
push ebx
lea eax, [ebp - 0x744]
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xad4]
cmp eax, 2
je 0xbfd386
cmp eax, 3
je 0xbfd386
cmp eax, 1
jne 0xbfd3a2
xor eax, eax
mov dword [ebp - 0x758], 0xffffff
push 0x5c
push eax
lea eax, [ebp - 0x560]
push eax
call fcn.00bc259b
mov esi, dword [0xd0807c]
add esp, 0xc
xor eax, eax
mov ecx, esi
mov ebx, eax
push 0x403
push eax
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xab4], eax
test eax, eax
jne 0xbfd13c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xbfd131
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xbfd1dd
jmp 0xbfcc54
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x48
push dword [ebp - 0xab8]
push 0xb
call dword [0xd0cffc]
call esi
push dword [ebp - 0xcc4]
neg eax
mov dword [ebp - 0x550], 0x190
push 0x20
pop edx
lea ecx, [ebp - 0x544]
mov dword [ebp - 0x560], eax
mov byte [ebp - 0x546], 5
call fcn.00b7db60
mov esi, dword [0xd08010]
lea eax, [ebp - 0x560]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xbfd1be
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0xbfd1b5
movzx ebx, bx
or ebx, 0x80070000
test ebx, ebx
js 0xbfd1c4
mov ebx, 0x80004005
jmp 0xbfd1c4
mov dword [ebp - 0x75c], eax
push dword [ebp - 0xab4]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xbfd4cf
push dword [ebp - 0x75c]
mov esi, dword [0xd0803c]
xor eax, eax
push dword [ebp - 0xac4]
mov dword [ebp - 0x72c], edi
mov ecx, esi
mov edi, dword [ebp - 0x768]
mov ebx, eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
mov ecx, esi
mov dword [ebp - 0xab4], eax
xor eax, eax
push eax
push 0x460
lea eax, [ebp - 0x734]
push eax
push 0xffffffffffffffff
push edi
mov edi, dword [ebp - 0xac4]
push edi
call dword [0xd0cffc]
call esi
test eax, eax
jne 0xbfd249
mov ebx, 0x80004005
mov eax, dword [ebp - 0xab4]
test eax, eax
je 0xbfd265
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
test ebx, ebx
js 0xbfd4cf
mov eax, dword [ebp - 0x72c]
push 0x5a
add eax, 0x18
pop ecx
mov dword [ebp - 0x72c], eax
cmp eax, ecx
jge 0xbfd289
mov dword [ebp - 0x72c], ecx
mov ebx, dword [ebp - 0xab8]
mov esi, dword [0xd0805c]
mov ecx, esi
push 0x60
pop edi
push edi
push ebx
push dword [ebp - 0x734]
mov dword [ebp - 0x728], 0x20
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x730]
mov dword [ebp - 0x734], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x72c]
mov dword [ebp - 0x730], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0805c]
mov ecx, esi
push edi
push ebx
push dword [ebp - 0x728]
mov dword [ebp - 0x72c], eax
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0x778], 0
mov dword [ebp - 0x728], eax
je 0xbfd376
mov ecx, dword [ebp - 0x754]
cmp ecx, dword [ebp - 0x744]
jl 0xbfd331
mov ecx, dword [ebp - 0x744]
mov eax, dword [ebp - 0x738]
add eax, 0x24
push eax
push ecx
jmp 0xbfd35d
mov ecx, dword [ebp - 0x73c]
mov eax, dword [ebp - 0x738]
add eax, 0x24
push eax
mov eax, dword [ebp - 0x734]
sub eax, dword [ebp - 0x72c]
add eax, ecx
push eax
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x734]
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xbfd3a2
mov ecx, dword [ebp - 0x74c]
cmp ecx, dword [ebp - 0x73c]
jg 0xbfd344
jmp 0xbfd33e
mov eax, dword [ebp - 0x738]
mov dword [ebp - 0xc2c], edi
mov dword [ebp - 0xc28], eax
mov dword [ebp - 0x758], 0xffa8a8a8
mov eax, dword [ebp - 0x778]
lea edi, [ebp - 0xeb4]
mov ebx, dword [ebp - 0xc2c]
mov dword [ebp - 0xab4], eax
mov eax, dword [ebp - 0xc28]
mov dword [ebp - 0xaac], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0xad4]
sub eax, 1
je 0xbfd6e5
sub eax, 1
je 0xbfd632
sub eax, 1
jne 0xbfd4cd
mov esi, dword [0xd080a4]
lea edi, [ebp - 0x420]
push 0xa
pop ecx
rep stosd dword es:[edi], eax
push 1
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08084]
lea ecx, [ebp - 0x420]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x420], 0x28
call dword [0xd0cffc]
call esi
test eax, eax
je 0xbfd4cd
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x40c]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x404]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x404]
lea esi, [ebp - 0x40c]
sub eax, ebx
lea edi, [ebp - 0xeb4]
imul eax, eax, 0x32
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
cdq
idiv ecx
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc34], eax
mov eax, dword [ebp - 0x400]
sub eax, dword [ebp - 0xaac]
movsd dword es:[edi], dword [esi]
imul eax, eax, 0x32
movsd dword es:[edi], dword [esi]
jmp 0xbfd4c4
mov eax, dword [ebp - 0x3d4]
sub eax, ebx
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0xc34], eax
mov eax, dword [ebp - 0x3d0]
sub eax, dword [ebp - 0xaac]
imul eax, eax, 0x5f
cdq
idiv ecx
mov dword [ebp - 0xc30], eax
xor ebx, ebx
push dword [ebp - 0xac4]
mov esi, dword [0xd080b0]
xor eax, eax
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov edi, 0xd0aed4
xor ecx, ecx
xor eax, eax
inc ecx
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xbfd4ed
mov eax, dword [0xd0a150]
test eax, eax
jle 0xbfd550
sub eax, 1
mov dword [0xd0a150], eax
jne 0xbfd550
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xbfd522
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xbfd511
push 0x40
xor eax, eax
push eax
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xd0aed4
xor eax, eax
xchg dword [edi], eax
mov eax, dword [ebp - 0xaec]
test eax, eax
je 0xbfd56f
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xbff1db
mov edi, dword [ebp - 0xc34]
xor eax, eax
mov ebx, dword [ebp - 0xc30]
push 0x54
push eax
lea eax, [ebp - 0x7d0]
mov dword [ebp - 0xd94], edi
push eax
mov dword [ebp - 0xd90], ebx
call fcn.00bc259b
mov esi, dword [0xd08028]
add esp, 0xc
mov ecx, esi
mov dword [ebp - 0xaac], 1
push 7
push dword [ebp - 0xaa4]
call dword [0xd0cffc]
call esi
test eax, eax
je 0xbfd612
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x7d0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xbfd612
push 0x20
pop eax
cmp word [ebp - 0x7be], ax
jne 0xbfd612
cmp dword [ebp - 0x7bc], 0
je 0xbfd612
cmp dword [ebp - 0x7cc], 0
jle 0xbfd612
cmp dword [ebp - 0x7c8], 0
jg 0xbfd6f8
xor eax, eax
cmp dword [ebp - 0xad4], 1
mov dword [ebp - 0xaac], eax
je 0xbfd6f8
mov ebx, dword [ebp - 0xad4]
jmp 0xbfd760
mov esi, dword [0xd080a4]
lea edi, [ebp - 0x3f0]
push 0xa
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
push 1
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08084]
lea ecx, [ebp - 0x3f0]
push ecx
push eax
mov ecx, esi
mov dword [ebp - 0x3f0], 0x28
call dword [0xd0cffc]
call esi
test eax, eax
je 0xbfd4cd
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x3dc]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a0]
lea eax, [ebp - 0x3d4]
push eax
xor eax, eax
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xab4], 0
lea esi, [ebp - 0x3dc]
lea edi, [ebp - 0xeb4]
movsd dword es:[edi], dword [esi]
push 0x64
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0xbfd4a1
imul eax, dword [ebp - 0x3d4], 5
cdq
idiv ecx
add eax, dword [ebp - 0x3dc]
jmp 0xbfd4af
xor ebx, ebx
mov dword [ebp - 0xc34], ebx
mov dword [ebp - 0xc30], ebx
jmp 0xbfd4cf
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x754]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd080a8]
lea eax, [ebp - 0x744]
push ebx
push edi
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ebx, dword [ebp - 0xad4]
cmp ebx, 1
jne 0xbfd760
mov eax, dword [ebp - 0x774]
mov esi, dword [0xd08014]
neg eax
mov ecx, esi
sbb eax, eax
and eax, 0xff4d98e0
add eax, 0xb26720
push eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xb50], eax
mov esi, dword [0xd08040]
mov ecx, esi
push 1
push dword [ebp - 0xaa4]
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0x778], 0
mov dword [ebp - 0xbc8], eax
mov dword [ebp - 0xb04], 0x810
je 0xbfd79b
mov dword [ebp - 0xb04], 0x20812
cmp dword [ebp - 0xaac], 0
je 0xbfe2b3
mov eax, dword [ebp - 0x774]
mov ebx, dword [ebp - 0x770]
mov dword [ebp - 0xac0], eax
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0xab4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x930]
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x9e0]
push eax
call fcn.00bc259b
add esp, 0xc
lea eax, [ebp - 0x44c]
xor ecx, ecx
mov dword [ebp - 0xaf0], ecx
mov dword [ebp - 0xabc], ecx
push 0x2c
push ecx
push eax
mov dword [ebp - 0xaa8], ecx
mov dword [ebp - 0xaac], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x370]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xbff1bb
mov edi, dword [ebp - 0xaa4]
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xbfd977
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x930]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xbfd891
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0x92c]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0x928]
mov dword [ebp - 0xaac], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov edi, eax
mov dword [ebp - 0xae4], edi
test edi, edi
je 0xbfd977
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd38], eax
mov dword [ebp - 0xae8], eax
lea eax, [ebp - 0x44c]
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0x74c]
add esp, 0xc
sub eax, dword [ebp - 0x754]
xor ecx, ecx
mov esi, dword [0xd0800c]
mov dword [ebp - 0x448], eax
mov eax, dword [ebp - 0x750]
sub eax, dword [ebp - 0x748]
mov dword [ebp - 0x444], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x44c], 0x28
mov word [ebp - 0x440], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x43e], ax
lea eax, [ebp - 0xd38]
push eax
push ecx
lea eax, [ebp - 0x44c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xb10], eax
test eax, eax
jne 0xbfd982
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xae8], eax
test eax, eax
jle 0xbfd962
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xae8], eax
test eax, eax
js 0xbfdd08
mov dword [ebp - 0xae8], 0x80004005
jmp 0xbfdd08
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xbff1bb
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x9e0]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xbfd9ac
mov eax, dword [ebp - 0x9cc]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0x74c]
sub eax, dword [ebp - 0x754]
push dword [ebp - 0xb10]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x748]
sub eax, dword [ebp - 0x750]
push edi
mov dword [ebp - 0x364], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
mov ecx, esi
push 1
push edi
call dword [0xd0cffc]
call esi
push dword [ebp - 0xab4]
mov esi, dword [0xd0803c]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xad8], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x370]
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xb04]
lea eax, [ebp - 0x370]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xad4], 1
jne 0xbfda9f
cmp dword [ebp - 0xac0], 0
je 0xbfda93
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xab8], eax
jmp 0xbfdaa9
mov dword [ebp - 0xab8], 0xffffff
jmp 0xbfdaa9
mov dword [ebp - 0xab8], 0xffa8a8a8
mov edi, dword [ebp - 0x754]
xor edx, edx
mov eax, dword [ebp - 0x750]
mov esi, edx
mov dword [ebp - 0xac8], edi
mov ecx, edx
test edi, edi
jns 0xbfdad1
mov esi, edi
mov dword [ebp - 0xac8], edx
neg esi
mov edi, edx
test eax, eax
jns 0xbfdadb
mov ecx, eax
mov eax, edx
neg ecx
mov ebx, dword [ebp - 0x368]
mov edx, dword [ebp - 0xaa8]
sub ebx, esi
sub edx, edi
mov dword [ebp - 0xad0], ebx
cmp ebx, edx
jl 0xbfdafd
mov ebx, edx
mov dword [ebp - 0xad0], edx
mov edi, dword [ebp - 0x364]
mov edx, dword [ebp - 0xaac]
sub edi, ecx
sub edx, eax
mov dword [ebp - 0xaec], edi
cmp edi, edx
jl 0xbfdb1f
mov edi, edx
mov dword [ebp - 0xaec], edx
test ebx, ebx
jle 0xbfdcd0
test edi, edi
jle 0xbfdcd0
mov edx, dword [ebp - 0x368]
mov ebx, dword [ebp - 0xaf0]
imul ecx, edx
add ecx, esi
mov esi, dword [ebp - 0xabc]
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0xaa8]
imul eax, esi
mov dword [ebp - 0xafc], ecx
add eax, dword [ebp - 0xac8]
lea eax, [ebx + eax*4]
mov ebx, dword [ebp - 0xad0]
mov dword [ebp - 0xac8], eax
test edi, edi
jle 0xbfdcd0
shl edx, 2
shl esi, 2
mov dword [ebp - 0xab4], edx
mov dword [ebp - 0xac0], esi
test ebx, ebx
jle 0xbfdcb1
mov esi, eax
mov dword [ebp - 0xabc], ebx
lea edx, [eax + 3]
sub esi, ecx
mov dword [ebp - 0xacc], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xaac], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xbfdc71
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xab8]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaac]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xacc]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xab8]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xab6]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xaac]
cdq
idiv ecx
mov edx, dword [ebp - 0xacc]
add al, bl
mov ebx, dword [ebp - 0xabc]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xabc], ebx
jne 0xbfdbab
mov edi, dword [ebp - 0xaec]
mov ebx, dword [ebp - 0xad0]
mov ecx, dword [ebp - 0xafc]
mov eax, dword [ebp - 0xac8]
mov edx, dword [ebp - 0xab4]
mov esi, dword [ebp - 0xac0]
add ecx, edx
add eax, esi
sub edi, 1
mov dword [ebp - 0xafc], ecx
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xaec], edi
jne 0xbfdb87
push dword [ebp - 0xb10]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xad8]
mov edi, dword [ebp - 0xae4]
test eax, eax
je 0xbfdd08
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xae8], 0
jl 0xbff1bb
mov eax, dword [ebp - 0x774]
mov ebx, dword [ebp - 0x76c]
mov dword [ebp - 0xac0], eax
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0xab4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x8d8]
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x988]
push eax
call fcn.00bc259b
add esp, 0xc
lea eax, [ebp - 0x478]
xor ecx, ecx
mov dword [ebp - 0xaf0], ecx
mov dword [ebp - 0xabc], ecx
push 0x2c
push ecx
push eax
mov dword [ebp - 0xaa8], ecx
mov dword [ebp - 0xaac], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x380]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ebx, ebx
je 0xbff1bb
mov edi, dword [ebp - 0xaa4]
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xbfd977
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x8d8]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xbfde0f
mov eax, dword [ebp - 0x8c4]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0x8d4]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0x8d0]
mov dword [ebp - 0xaac], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov edi, eax
mov dword [ebp - 0xad8], edi
test edi, edi
je 0xbfd977
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd44], eax
mov dword [ebp - 0xae8], eax
lea eax, [ebp - 0x478]
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0x73c]
add esp, 0xc
sub eax, dword [ebp - 0x744]
xor ecx, ecx
mov esi, dword [0xd0800c]
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x740]
sub eax, dword [ebp - 0x738]
mov dword [ebp - 0x470], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x478], 0x28
mov word [ebp - 0x46c], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x46a], ax
lea eax, [ebp - 0xd44]
push eax
push ecx
lea eax, [ebp - 0x478]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xae4], eax
test eax, eax
jne 0xbfdef5
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xae8], eax
test eax, eax
jle 0xbfdee0
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xae8], eax
test eax, eax
js 0xbfe28a
mov dword [ebp - 0xae8], 0x80004005
jmp 0xbfe28a
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x988]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xbfdf1f
mov eax, dword [ebp - 0x974]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0x73c]
sub eax, dword [ebp - 0x744]
push dword [ebp - 0xae4]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x738]
sub eax, dword [ebp - 0x740]
push edi
mov dword [ebp - 0x374], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
mov ecx, esi
push 1
push edi
call dword [0xd0cffc]
call esi
push dword [ebp - 0xab4]
mov esi, dword [0xd0803c]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xb14], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x380]
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xb04]
lea eax, [ebp - 0x380]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xad4], 1
jne 0xbfe01a
cmp dword [ebp - 0xac0], 0
je 0xbfe00e
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov edx, eax
mov dword [ebp - 0xab0], edx
mov dword [ebp - 0xad0], edx
jmp 0xbfe02b
mov dword [ebp - 0xad0], 0xffffff
jmp 0xbfe02b
mov eax, 0xffa8a8a8
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xad0], eax
mov edi, dword [ebp - 0x744]
xor edx, edx
mov eax, dword [ebp - 0x740]
mov esi, edx
mov dword [ebp - 0xac8], edi
mov ecx, edx
test edi, edi
jns 0xbfe053
mov esi, edi
mov dword [ebp - 0xac8], edx
neg esi
mov edi, edx
test eax, eax
jns 0xbfe05d
mov ecx, eax
mov eax, edx
neg ecx
mov ebx, dword [ebp - 0x378]
mov edx, dword [ebp - 0xaa8]
sub ebx, esi
sub edx, edi
mov dword [ebp - 0xaec], ebx
cmp ebx, edx
jl 0xbfe07f
mov ebx, edx
mov dword [ebp - 0xaec], edx
mov edi, dword [ebp - 0x374]
mov edx, dword [ebp - 0xaac]
sub edi, ecx
sub edx, eax
mov dword [ebp - 0xb10], edi
cmp edi, edx
jl 0xbfe0a1
mov edi, edx
mov dword [ebp - 0xb10], edx
test ebx, ebx
jle 0xbfe252
test edi, edi
jle 0xbfe252
mov edx, dword [ebp - 0x378]
mov ebx, dword [ebp - 0xaf0]
imul ecx, edx
add ecx, esi
mov esi, dword [ebp - 0xabc]
lea ecx, [esi + ecx*4]
mov esi, dword [ebp - 0xaa8]
imul eax, esi
mov dword [ebp - 0xafc], ecx
add eax, dword [ebp - 0xac8]
lea eax, [ebx + eax*4]
mov ebx, dword [ebp - 0xaec]
mov dword [ebp - 0xac8], eax
test edi, edi
jle 0xbfe252
shl edx, 2
shl esi, 2
mov dword [ebp - 0xab4], edx
mov dword [ebp - 0xac0], esi
test ebx, ebx
jle 0xbfe233
mov esi, eax
mov dword [ebp - 0xabc], ebx
lea edx, [eax + 3]
sub esi, ecx
mov dword [ebp - 0xab8], edx
lea edi, [ecx + 2]
mov dword [ebp - 0xaac], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xbfe1f3
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xab0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaac]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xab8]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xab0]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xab8]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xace]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xab8]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xaac]
cdq
idiv ecx
mov edx, dword [ebp - 0xab8]
add al, bl
mov ebx, dword [ebp - 0xabc]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xab8], edx
mov dword [ebp - 0xabc], ebx
jne 0xbfe12d
mov edi, dword [ebp - 0xb10]
mov ebx, dword [ebp - 0xaec]
mov ecx, dword [ebp - 0xafc]
mov eax, dword [ebp - 0xac8]
mov edx, dword [ebp - 0xab4]
mov esi, dword [ebp - 0xac0]
add ecx, edx
add eax, esi
sub edi, 1
mov dword [ebp - 0xafc], ecx
mov dword [ebp - 0xac8], eax
mov dword [ebp - 0xb10], edi
jne 0xbfe109
push dword [ebp - 0xae4]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xb14]
mov edi, dword [ebp - 0xad8]
test eax, eax
je 0xbfe28a
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xae8], 0
jl 0xbff1bb
mov edi, dword [ebp - 0xadc]
jmp 0xbff167
cmp dword [ebp - 0x774], 0
jne 0xbfe2c5
cmp ebx, 1
je 0xbfe2c5
mov al, 0xc0
jmp 0xbfe2c7
or al, 0xff
mov byte [ebp - 0xad6], al
lea edi, [ebp - 0xc90]
xor eax, eax
mov esi, dword [0xd08008]
stosd dword es:[edi], eax
xor ecx, ecx
push dword [ebp - 0xaa4]
mov byte [ebp - 0xad8], cl
mov byte [ebp - 0xad7], cl
mov ecx, esi
stosd dword es:[edi], eax
mov byte [ebp - 0xad5], 1
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0xcd8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xadc], eax
test eax, eax
jne 0xbfe325
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xbff1bb
cmp ebx, 1
jne 0xbfe415
mov ecx, dword [ebp - 0x74c]
mov edx, dword [ebp - 0x73c]
mov ebx, dword [ebp - 0x754]
sub ecx, ebx
mov eax, dword [ebp - 0x744]
sub edx, eax
cmp edx, ecx
jle 0xbfe358
mov esi, edx
mov dword [ebp - 0xb08], esi
jmp 0xbfe360
mov esi, ecx
mov dword [ebp - 0xb08], ecx
mov edi, dword [ebp - 0x738]
sub edi, dword [ebp - 0x750]
cmp dword [ebp - 0x778], 0
mov dword [ebp - 0xb20], edi
je 0xbfe399
sub ebx, dword [ebp - 0x74c]
sub eax, dword [ebp - 0x73c]
add ebx, esi
add eax, esi
mov dword [ebp - 0xc90], ebx
mov dword [ebp - 0xcd8], eax
jmp 0xbfe3a5
mov ebx, dword [ebp - 0xc90]
mov eax, dword [ebp - 0xcd8]
mov edi, dword [ebp - 0x748]
add ecx, ebx
sub edi, dword [ebp - 0x750]
mov dword [ebp - 0xaa8], ebx
mov ebx, dword [ebp - 0x740]
sub ebx, dword [ebp - 0x750]
mov dword [ebp - 0xb10], ebx
mov dword [ebp - 0xcd4], ebx
sub ebx, dword [ebp - 0x740]
add ebx, dword [ebp - 0x738]
mov dword [ebp - 0xad0], edi
mov dword [ebp - 0xc84], edi
lea edi, [eax + edx]
mov dword [ebp - 0xaec], ebx
mov dword [ebp - 0xccc], ebx
mov ebx, dword [ebp - 0xb08]
mov dword [ebp - 0xc88], ecx
mov dword [ebp - 0xaa0], edi
mov dword [ebp - 0xcd0], edi
jmp 0xbfe495
mov eax, dword [ebp - 0xc28]
lea esi, [ebp - 0x754]
lea edi, [ebp - 0xc90]
mov ebx, dword [ebp - 0xc2c]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xb20], eax
mov dword [ebp - 0xb08], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xc84]
lea esi, [ebp - 0x744]
mov ecx, dword [ebp - 0xc88]
lea edi, [ebp - 0xcd8]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xad0], eax
mov eax, dword [ebp - 0xc90]
mov dword [ebp - 0xaa8], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0xccc]
mov dword [ebp - 0xaec], eax
mov eax, dword [ebp - 0xcd0]
mov dword [ebp - 0xaa0], eax
mov eax, dword [ebp - 0xcd4]
mov dword [ebp - 0xb10], eax
mov eax, dword [ebp - 0xcd8]
mov dword [ebp - 0xa98], eax
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd48], eax
lea eax, [ebp - 0x4a4]
push eax
mov dword [ebp - 0xae8], ecx
call fcn.00bc259b
mov eax, dword [ebp - 0xb20]
add esp, 0xc
mov edi, dword [ebp - 0xadc]
neg eax
mov esi, dword [0xd0800c]
xor ecx, ecx
mov dword [ebp - 0x49c], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x4a4], 0x28
mov word [ebp - 0x498], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x496], ax
lea eax, [ebp - 0xd48]
push eax
push ecx
lea eax, [ebp - 0x4a4]
mov dword [ebp - 0x4a0], ebx
push eax
push edi
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xae0], eax
test eax, eax
jne 0xbfe52c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xbff1a6
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xad4], 1
jne 0xbfe59b
mov ecx, dword [ebp - 0xb50]
test ecx, ecx
je 0xbfe59b
mov esi, dword [0xd08074]
lea edi, [ebp - 0x39c]
xor eax, eax
stosd dword es:[edi], eax
push ecx
mov ecx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0xb20]
mov dword [ebp - 0x394], eax
lea eax, [ebp - 0x3a0]
push eax
mov eax, dword [ebp - 0xadc]
push eax
mov dword [ebp - 0x398], ebx
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0x774]
mov ebx, dword [ebp - 0x770]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0x764]
mov dword [ebp - 0xab4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x880]
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa38]
push eax
call fcn.00bc259b
add esp, 0xc
lea eax, [ebp - 0x4d0]
xor ecx, ecx
mov dword [ebp - 0xaf0], ecx
mov dword [ebp - 0xac8], ecx
push 0x2c
push ecx
push eax
mov dword [ebp - 0xb14], ecx
mov dword [ebp - 0xaac], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x360]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xadc]
test ebx, ebx
je 0xbff18b
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xbfe772
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x880]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xbfe684
mov eax, dword [ebp - 0x86c]
mov dword [ebp - 0xaf0], eax
mov eax, dword [ebp - 0x87c]
mov dword [ebp - 0xb14], eax
mov eax, dword [ebp - 0x878]
mov dword [ebp - 0xaac], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, eax
mov dword [ebp - 0xac4], esi
test esi, esi
je 0xbfe772
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd4c], eax
mov dword [ebp - 0xa9c], eax
lea eax, [ebp - 0x4d0]
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0xae8]
add esp, 0xc
mov edi, dword [ebp - 0xaa8]
xor ecx, ecx
sub eax, edi
mov dword [ebp - 0x4d0], 0x28
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0x4cc], eax
mov eax, dword [ebp - 0xc8c]
sub eax, dword [ebp - 0xad0]
mov dword [ebp - 0x4c8], eax
xor eax, eax
push 0x20
inc eax
mov word [ebp - 0x4c4], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x4c2], ax
lea eax, [ebp - 0xd4c]
push eax
push ecx
lea eax, [ebp - 0x4d0]
push eax
push esi
mov esi, dword [0xd0800c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xac0], eax
test eax, eax
jne 0xbfe77d
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xa9c], eax
test eax, eax
jle 0xbfe75d
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xa9c], eax
test eax, eax
js 0xbfeb1f
mov dword [ebp - 0xa9c], 0x80004005
jmp 0xbfeb1f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
jmp 0xbff18b
mov esi, dword [0xd08034]
lea ecx, [ebp - 0xa38]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xbfe7a7
mov eax, dword [ebp - 0xa24]
mov dword [ebp - 0xac8], eax
push dword [ebp - 0xac0]
mov ecx, dword [ebp - 0xae8]
mov eax, dword [ebp - 0xad0]
sub eax, dword [ebp - 0xc8c]
push dword [ebp - 0xac4]
mov esi, dword [0xd0803c]
mov dword [ebp - 0x358], ecx
mov ecx, esi
mov dword [ebp - 0x354], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
mov ecx, esi
push 1
push dword [ebp - 0xac4]
call dword [0xd0cffc]
call esi
push dword [ebp - 0xab4]
mov esi, dword [0xd0803c]
mov ecx, esi
push dword [ebp - 0xac4]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xab4], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x360]
push eax
push dword [ebp - 0xac4]
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xb04]
lea eax, [ebp - 0x360]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push dword [ebp - 0xac4]
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xad4], 1
jne 0xbfe8ad
cmp dword [ebp - 0xabc], 0
je 0xbfe8a1
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xab8], eax
jmp 0xbfe8b7
mov dword [ebp - 0xab8], 0xffffff
jmp 0xbfe8b7
mov dword [ebp - 0xab8], 0xffa8a8a8
xor ecx, ecx
mov dword [ebp - 0xabc], ecx
mov eax, ecx
mov esi, ecx
test edi, edi
jns 0xbfe8d3
mov eax, edi
mov edi, ecx
neg eax
mov dword [ebp - 0xabc], eax
mov edx, dword [ebp - 0xc8c]
test edx, edx
jns 0xbfe8e3
mov esi, edx
mov edx, ecx
neg esi
mov ebx, dword [ebp - 0x358]
sub ebx, eax
mov eax, dword [ebp - 0xb14]
sub eax, edi
mov dword [ebp - 0xafc], ebx
cmp ebx, eax
jl 0xbfe905
mov ebx, eax
mov dword [ebp - 0xafc], eax
mov ecx, dword [ebp - 0x354]
mov eax, dword [ebp - 0xaac]
sub ecx, esi
sub eax, edx
mov dword [ebp - 0xaa8], ecx
cmp ecx, eax
jl 0xbfe927
mov ecx, eax
mov dword [ebp - 0xaa8], eax
test ebx, ebx
jle 0xbfeae8
test ecx, ecx
jle 0xbfeae8
mov eax, dword [ebp - 0x358]
imul eax, esi
mov esi, dword [ebp - 0xac8]
add eax, dword [ebp - 0xabc]
lea esi, [esi + eax*4]
mov eax, dword [ebp - 0xb14]
imul eax, edx
mov edx, dword [ebp - 0xaf0]
mov dword [ebp - 0xad0], esi
add eax, edi
lea eax, [edx + eax*4]
mov dword [ebp - 0xae4], eax
test ecx, ecx
jle 0xbfeae8
mov edx, dword [ebp - 0x358]
shl edx, 2
mov dword [ebp - 0xac8], edx
mov edx, dword [ebp - 0xb14]
shl edx, 2
mov dword [ebp - 0xaf0], edx
mov edx, dword [ebp - 0xac8]
mov edi, dword [ebp - 0xaf0]
test ebx, ebx
jle 0xbfeac9
lea edx, [eax + 3]
mov dword [ebp - 0xabc], ebx
sub eax, esi
mov dword [ebp - 0xacc], edx
lea edi, [esi + 2]
mov dword [ebp - 0xaac], eax
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xbfea89
mov eax, dword [ebp - 0xaac]
movzx esi, cl
mov bl, byte [eax + edi]
mov eax, dword [ebp - 0xab8]
movzx eax, al
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xaac]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xacc]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xab8]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xab6]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xacc]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov edx, dword [ebp - 0xacc]
add al, bl
mov ebx, dword [ebp - 0xabc]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xacc], edx
mov dword [ebp - 0xabc], ebx
jne 0xbfe9c3
mov ecx, dword [ebp - 0xaa8]
mov ebx, dword [ebp - 0xafc]
mov esi, dword [ebp - 0xad0]
mov eax, dword [ebp - 0xae4]
mov edx, dword [ebp - 0xac8]
mov edi, dword [ebp - 0xaf0]
add esi, edx
add eax, edi
sub ecx, 1
mov dword [ebp - 0xad0], esi
mov dword [ebp - 0xae4], eax
mov dword [ebp - 0xaa8], ecx
jne 0xbfe9a1
push dword [ebp - 0xac0]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xab4]
test eax, eax
je 0xbfeb1f
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push dword [ebp - 0xac4]
call dword [0xd0cffc]
call esi
push dword [ebp - 0xac4]
mov esi, dword [0xd08018]
mov ecx, esi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xa9c], 0
jl 0xbff185
mov eax, dword [ebp - 0x774]
mov ebx, dword [ebp - 0x76c]
mov dword [ebp - 0xaac], eax
mov eax, dword [ebp - 0x760]
mov dword [ebp - 0xab4], eax
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0x828]
push eax
call fcn.00bc259b
add esp, 0xc
xor eax, eax
push 0x54
push eax
lea eax, [ebp - 0xa90]
push eax
call fcn.00bc259b
add esp, 0xc
lea eax, [ebp - 0x4fc]
xor ecx, ecx
mov dword [ebp - 0xac8], ecx
mov dword [ebp - 0xabc], ecx
push 0x2c
push ecx
push eax
mov dword [ebp - 0xae8], ecx
mov dword [ebp - 0xac0], ecx
call fcn.00bc259b
xor eax, eax
lea edi, [ebp - 0x390]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0xadc]
test ebx, ebx
je 0xbff18b
mov esi, dword [0xd08028]
mov ecx, esi
push 7
push edi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xbfe772
mov esi, dword [0xd08034]
lea ecx, [ebp - 0x828]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xbfec2b
mov eax, dword [ebp - 0x814]
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0x824]
mov dword [ebp - 0xae8], eax
mov eax, dword [ebp - 0x820]
mov dword [ebp - 0xac0], eax
mov esi, dword [0xd08008]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, eax
mov dword [ebp - 0xacc], esi
test esi, esi
je 0xbfe772
xor eax, eax
push 0x2c
push eax
mov dword [ebp - 0xd50], eax
mov dword [ebp - 0xb14], eax
lea eax, [ebp - 0x4fc]
push eax
call fcn.00bc259b
mov eax, dword [ebp - 0xaa0]
add esp, 0xc
sub eax, dword [ebp - 0xa98]
xor ecx, ecx
mov edi, dword [ebp - 0xb10]
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0x4f8], eax
mov eax, edi
sub eax, dword [ebp - 0xaec]
mov dword [ebp - 0x4f4], eax
xor eax, eax
push 0x20
inc eax
mov dword [ebp - 0x4fc], 0x28
mov word [ebp - 0x4f0], ax
pop eax
push ecx
push ecx
mov word [ebp - 0x4ee], ax
lea eax, [ebp - 0xd50]
push eax
push ecx
lea eax, [ebp - 0x4fc]
push eax
push esi
mov esi, dword [0xd0800c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0xae4], eax
test eax, eax
jne 0xbfed1f
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [ebp - 0xb14], eax
test eax, eax
jle 0xbfed04
movzx eax, ax
or eax, 0x80070000
mov dword [ebp - 0xb14], eax
test eax, eax
mov edi, dword [ebp - 0xacc]
js 0xbff0c2
mov dword [ebp - 0xb14], 0x80004005
jmp 0xbff0c2
mov esi, dword [0xd08034]
lea ecx, [ebp - 0xa90]
push ecx
push 0x54
push eax
mov ecx, esi
call dword [0xd0cffc]
call esi
test eax, eax
je 0xbfed49
mov eax, dword [ebp - 0xa7c]
mov dword [ebp - 0xabc], eax
mov eax, dword [ebp - 0xaa0]
push dword [ebp - 0xae4]
mov esi, dword [0xd0803c]
mov ecx, esi
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0xaec]
sub eax, edi
mov edi, dword [ebp - 0xacc]
push edi
mov dword [ebp - 0x384], eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08040]
mov ecx, esi
push 1
push edi
call dword [0xd0cffc]
call esi
push dword [ebp - 0xab4]
mov esi, dword [0xd0803c]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08038]
mov ecx, esi
mov dword [ebp - 0xab4], eax
xor eax, eax
push eax
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08074]
mov ecx, esi
push eax
lea eax, [ebp - 0x390]
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd0806c]
xor eax, eax
push eax
push dword [ebp - 0xb04]
lea eax, [ebp - 0x390]
mov ecx, esi
push eax
push 0xffffffffffffffff
push ebx
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xad4], 1
jne 0xbfee40
cmp dword [ebp - 0xaac], 0
je 0xbfee34
mov esi, dword [0xd0808c]
mov ecx, esi
push 8
call dword [0xd0cffc]
call esi
mov ecx, eax
mov dword [ebp - 0xab0], ecx
mov dword [ebp - 0xaa8], ecx
jmp 0xbfee51
mov dword [ebp - 0xaa8], 0xffffff
jmp 0xbfee51
mov eax, 0xffa8a8a8
mov dword [ebp - 0xab0], eax
mov dword [ebp - 0xaa8], eax
mov edx, dword [ebp - 0xa98]
xor ebx, ebx
mov dword [ebp - 0xaac], ebx
mov esi, ebx
mov eax, ebx
test edx, edx
jns 0xbfee73
mov esi, edx
mov edx, ebx
neg esi
mov dword [ebp - 0xaac], esi
mov ecx, dword [ebp - 0xb10]
test ecx, ecx
jns 0xbfee83
mov eax, ecx
mov ecx, ebx
neg eax
mov ebx, dword [ebp - 0x388]
sub ebx, esi
mov esi, dword [ebp - 0xae8]
sub esi, edx
mov dword [ebp - 0xad0], ebx
cmp ebx, esi
jl 0xbfeea5
mov ebx, esi
mov dword [ebp - 0xad0], esi
mov edi, dword [ebp - 0x384]
mov esi, dword [ebp - 0xac0]
sub edi, eax
sub esi, ecx
mov dword [ebp - 0xaec], edi
cmp edi, esi
jl 0xbfeec7
mov edi, esi
mov dword [ebp - 0xaec], esi
test ebx, ebx
jle 0xbff08a
test edi, edi
jle 0xbff08a
imul ecx, dword [ebp - 0xae8]
mov esi, dword [ebp - 0x388]
mov ebx, dword [ebp - 0xabc]
imul eax, esi
add ecx, edx
mov edx, dword [ebp - 0xac8]
add eax, dword [ebp - 0xaac]
lea ecx, [edx + ecx*4]
mov dword [ebp - 0xafc], ecx
lea eax, [ebx + eax*4]
mov ebx, dword [ebp - 0xad0]
mov dword [ebp - 0xaf0], eax
test edi, edi
jle 0xbff08a
mov edx, esi
shl edx, 2
mov dword [ebp - 0xabc], edx
mov edx, dword [ebp - 0xae8]
shl edx, 2
mov dword [ebp - 0xac8], edx
mov edx, dword [ebp - 0xabc]
mov esi, dword [ebp - 0xac8]
test ebx, ebx
jle 0xbff06b
mov esi, ecx
mov dword [ebp - 0xaac], ebx
lea edx, [ecx + 3]
sub esi, eax
mov dword [ebp - 0xab8], edx
lea edi, [eax + 2]
mov dword [ebp - 0xac0], esi
movzx eax, byte [edi - 2]
movzx ecx, byte [edi - 1]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi]
add ecx, eax
shr ecx, 2
not cl
test cl, cl
je 0xbff02b
mov bl, byte [esi + edi]
mov eax, dword [ebp - 0xab0]
movzx eax, al
movzx esi, cl
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xac0]
add al, bl
mov byte [ecx + edi], al
mov eax, dword [ebp - 0xab8]
mov bl, byte [eax - 2]
mov eax, dword [ebp - 0xab0]
movzx eax, ah
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xab8]
add al, bl
mov byte [ecx - 2], al
mov bl, byte [ecx - 3]
movzx eax, byte [ebp - 0xaa6]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
cdq
idiv ecx
mov ecx, dword [ebp - 0xab8]
add al, bl
mov byte [ecx - 3], al
mov eax, 0xff
mov bl, byte [ecx]
movzx ecx, bl
sub eax, ecx
mov ecx, 0xff
imul eax, esi
mov esi, dword [ebp - 0xac0]
cdq
idiv ecx
mov edx, dword [ebp - 0xab8]
add al, bl
mov ebx, dword [ebp - 0xaac]
mov byte [edx], al
push 4
pop eax
add edx, eax
add edi, eax
sub ebx, 1
mov dword [ebp - 0xab8], edx
mov dword [ebp - 0xaac], ebx
jne 0xbfef65
mov edi, dword [ebp - 0xaec]
mov ebx, dword [ebp - 0xad0]
mov eax, dword [ebp - 0xaf0]
mov ecx, dword [ebp - 0xafc]
mov edx, dword [ebp - 0xabc]
mov esi, dword [ebp - 0xac8]
add eax, edx
add ecx, esi
sub edi, 1
mov dword [ebp - 0xaf0], eax
mov dword [ebp - 0xafc], ecx
mov dword [ebp - 0xaec], edi
jne 0xbfef41
push dword [ebp - 0xae4]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xab4]
mov edi, dword [ebp - 0xacc]
test eax, eax
je 0xbff0c2
mov esi, dword [0xd0803c]
mov ecx, esi
push eax
push edi
call dword [0xd0cffc]
call esi
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
cmp dword [ebp - 0xb14], 0
mov edi, dword [ebp - 0xadc]
jl 0xbff18b
cmp dword [ebp - 0xad4], 1
jne 0xbff12a
mov esi, dword [section..data]
xor eax, eax
push 0xcc0020
push eax
push eax
mov eax, dword [ebp - 0xb08]
mov ecx, esi
push edi
push dword [ebp - 0xb20]
push eax
push dword [ebp - 0x750]
push dword [ebp - 0x754]
push dword [ebp - 0xaa4]
call dword [0xd0cffc]
call esi
jmp 0xbff167
push dword [ebp - 0xad8]
mov ecx, dword [ebp - 0xb20]
xor edx, edx
mov eax, dword [ebp - 0xb08]
mov esi, dword [0xd08020]
push ecx
push eax
push edx
push edx
push edi
push ecx
push eax
push dword [ebp - 0xc30]
mov ecx, esi
push dword [ebp - 0xc34]
push dword [ebp - 0xaa4]
call dword [0xd0cffc]
call esi
push dword [ebp - 0xbc8]
mov esi, dword [0xd08040]
mov ecx, esi
push dword [ebp - 0xaa4]
call dword [0xd0cffc]
call esi
jmp 0xbff18b
mov edi, dword [ebp - 0xadc]
mov eax, dword [ebp - 0xae0]
test eax, eax
je 0xbff1a6
mov esi, dword [0xd0801c]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
test edi, edi
je 0xbff1bb
mov esi, dword [0xd08018]
mov ecx, esi
push edi
call dword [0xd0cffc]
call esi
mov eax, dword [ebp - 0xb50]
test eax, eax
je 0xbff1d6
mov esi, dword [0xd0801c]
mov ecx, esi
push eax
call dword [0xd0cffc]
call esi
mov edi, 0xd0aed4
mov ebx, dword [ebp - 0x770]
xor edx, edx
test ebx, ebx
je 0xbff22e
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0xbff1ea
mov eax, dword [ebp - 0x770]
sub ebx, ecx
sar ebx, 1
lea ebx, [ebx*2 + 2]
test ebx, ebx
je 0xbff212
mov byte [eax], dl
inc eax
sub ebx, 1
jne 0xbff20a
push dword [ebp - 0x770]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [ebp - 0x770], edx
mov ebx, dword [ebp - 0x76c]
test ebx, ebx
je 0xbff281
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0xbff23b
mov eax, dword [ebp - 0x76c]
sub ebx, ecx
sar ebx, 1
lea ebx, [ebx*2 + 2]
test ebx, ebx
je 0xbff263
mov byte [eax], dl
inc eax
sub ebx, 1
jne 0xbff25b
push dword [ebp - 0x76c]
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x76c], ebx
jmp 0xbff283
xor ebx, ebx
mov edx, dword [ebp - 0x768]
test edx, edx
je 0xbff2cf
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0xbff292
sub ecx, esi
sar ecx, 1
lea ecx, [ecx*2 + 2]
test ecx, ecx
je 0xbff2ba
mov byte [edx], bl
inc edx
sub ecx, 1
jne 0xbff2ac
mov edx, dword [ebp - 0x768]
push edx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov dword [ebp - 0x768], ebx
cmp dword [ebp - 0x764], 0
je 0xbff2f4
push dword [ebp - 0x764]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x764], ebx
cmp dword [ebp - 0x760], 0
je 0xbff319
push dword [ebp - 0x760]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x760], ebx
cmp dword [ebp - 0x75c], 0
je 0xbff33e
push dword [ebp - 0x75c]
mov esi, dword [0xd0801c]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov dword [ebp - 0x75c], ebx
xor ebx, ebx
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xbff340
mov eax, dword [0xd0a150]
test eax, eax
jle 0xbff3a3
sub eax, 1
mov dword [0xd0a150], eax
jne 0xbff3a3
xor eax, eax
mov esi, eax
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xbff375
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xbff364
push 0x40
xor eax, eax
push eax
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xd0aed4
xor eax, eax
xchg dword [edi], eax
mov eax, dword [0xd09360]
mov esi, dword [0xd0804c]
mov ecx, esi
mov dword [ebp - 0xabc], eax
call dword [0xd0cffc]
call esi
sub eax, dword [0xd09358]
lea edi, [ebp - 0x2e8]
push 8
mov dword [ebp - 0xaac], eax
mov esi, 0xd0aed4
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea ecx, [ebx + 1]
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
jne 0xbff3e0
mov eax, dword [0xd0a150]
test eax, eax
jne 0xbff9db
xor ebx, ebx
push 0x338
mov esi, ebx
mov dword [ebp - 0xaa8], ebx
push ebx
mov dword [ebp - 0xa9c], ebx
mov dword [ebp - 0xab0], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xc00], eax
test eax, eax
je 0xbff9cf
or dword [ebp - 0xac0], 0xffffffff
mov cl, bl
add eax, 7
mov dword [ebp - 0xae0], ebx
mov dword [ebp - 0xb6c], esi
mov dword [ebp - 0xb8c], ebx
mov dword [ebp - 0xbe4], eax
mov edi, dword [ebp - 0xb70]
movzx edx, byte [edi - 2]
movzx eax, byte [edi - 1]
shl edx, 8
or edx, eax
movzx eax, byte [edi]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
movzx edi, byte [edi + 2]
shl edx, 8
or edx, eax
shl edi, 8
mov eax, dword [ebp - 0xb70]
xor ebx, edx
mov dword [ebp - 0xab4], edx
movzx eax, byte [eax + 3]
or edi, eax
mov eax, dword [ebp - 0xb70]
shl edi, 8
movzx eax, byte [eax + 4]
or edi, eax
mov eax, dword [ebp - 0xb70]
shl edi, 8
add dword [ebp - 0xb70], 8
movzx eax, byte [eax + 5]
or edi, eax
xor esi, edi
xor esi, ebx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul edx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub edx, eax
xor esi, edx
imul edx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub edx, eax
sub edx, 0x756c8a2
xor ebx, edx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub edx, eax
mov eax, 0x7f1137f
xor esi, edx
mov edx, esi
xor edx, 0xab69605e
sub eax, edx
xor ebx, eax
mov eax, ebx
mov edx, ebx
xor eax, 0x137f
ror edx, 6
imul eax, eax, 0xab69
xor edx, eax
xor esi, edx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul edx, eax, 0x605e
mov eax, esi
rol eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub edx, eax
xor esi, edx
mov eax, esi
xor eax, 0xab69605e
ror eax, 0xc
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x7f1
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor edx, eax
xor esi, edx
mov eax, esi
mov dword [ebp - 0xbc8], esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea esi, [ebx - 0x7f1]
xor esi, dword [ebp - 0xbc8]
xor esi, 0xab69605e
mov eax, esi
xor eax, 0x7f1
rol eax, 2
imul edx, eax, 0x137f
mov eax, esi
shr eax, 2
add edx, eax
xor ebx, edx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul edx, eax, 0xab69
mov eax, ebx
rol eax, 7
add edx, eax
xor esi, edx
mov eax, esi
mov edx, esi
xor eax, 0x137f
ror edx, 9
imul eax, eax, 0x605e
add edx, eax
xor ebx, edx
mov eax, ebx
mov dword [ebp - 0xbc8], ebx
xor eax, 0xab69
rol eax, 5
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 7
add edx, eax
xor esi, edx
mov ebx, esi
xor ebx, dword [ebp - 0xbc8]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor esi, eax
lea eax, [esi - 0x7f1137f]
ror eax, 1
imul edx, eax, 0x605e
mov eax, esi
ror eax, 6
sub edx, eax
xor ebx, edx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul edx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add edx, eax
xor esi, edx
lea eax, [esi - 0x54969fa2]
rol eax, 0xf
imul edx, eax, 0x137f
mov eax, esi
ror eax, 0xe
sub edx, eax
xor ebx, edx
mov eax, ebx
xor eax, 0x605e
imul edx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor edx, eax
xor esi, edx
mov eax, esi
xor eax, 0x7f1137f
rol eax, 4
imul edx, eax, 0x605e
mov eax, esi
xor esi, dword [ebp - 0xac0]
rol eax, 2
mov dword [ebp - 0xb6c], esi
mov dword [ebp - 0xac0], edi
xor edx, eax
xor edx, dword [ebp - 0xae0]
xor ebx, edx
mov edx, dword [ebp - 0xbe4]
mov dword [ebp - 0xb8c], ebx
mov byte [edx - 4], bl
mov al, byte [ebp - 0xb6c]
ror dword [ebp - 0xb8c], 8
mov byte [edx], al
mov al, byte [ebp - 0xb8c]
ror dword [ebp - 0xb6c], 8
mov byte [edx - 5], al
mov al, byte [ebp - 0xb6c]
ror dword [ebp - 0xb8c], 8
mov byte [edx - 1], al
mov al, byte [ebp - 0xb8c]
ror dword [ebp - 0xb6c], 8
mov byte [edx - 6], al
mov al, byte [ebp - 0xb6c]
ror dword [ebp - 0xb8c], 8
mov byte [edx - 2], al
ror dword [ebp - 0xb6c], 8
mov al, byte [ebp - 0xb8c]
mov byte [edx - 7], al
mov al, byte [ebp - 0xb6c]
mov byte [edx - 3], al
add edx, 8
mov ebx, dword [ebp - 0xb8c]
mov esi, dword [ebp - 0xb6c]
mov eax, dword [ebp - 0xab4]
ror ebx, 8
ror esi, 8
sub dword [ebp - 0xbe0], 1
mov dword [ebp - 0xb8c], ebx
mov dword [ebp - 0xb6c], esi
mov dword [ebp - 0xae0], eax
mov dword [ebp - 0xbe4], edx
jne 0xbff455
mov esi, dword [ebp - 0xc00]
xor eax, eax
xor cl, byte [eax + esi]
inc eax
cmp eax, 0x338
jb 0xbff7a6
movzx eax, cl
cdq
cmp eax, dword [0xb2c228]
jne 0xbff7d5
cmp edx, dword [0xb2c22c]
jne 0xbff7d5
mov edi, esi
xor eax, eax
mov dword [ebp - 0xab0], edi
mov esi, eax
mov ebx, eax
jmp 0xbff7e9
or dword [ebp - 0xbdc], 0xffffffff
mov ebx, 0xc004d501
mov edi, dword [ebp - 0xab0]
xor eax, eax
test esi, esi
je 0xbff7fc
push esi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xbff9c9
mov eax, dword [ebp - 0xbdc]
xor ecx, ecx
push 0x40
push ecx
mov ebx, 0xd0ae80
mov esi, edi
push ebx
mov byte [eax + edi], cl
call fcn.00bc259b
add esp, 0xc
cmp byte [edi], 0
je 0xbff95f
mov edi, ebx
mov ecx, esi
mov edx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0xbf0]
jne 0xbff834
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
push edi
push edx
push ebx
lea esi, [esi + ecx*2]
add esi, 2
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xbff9c2
mov eax, dword [edi]
mov ecx, 0x5a4d
mov edx, ebx
mov dword [ebp - 0xa9c], edx
cmp word [eax], cx
jne 0xbff8aa
mov ecx, dword [eax + 0x3c]
cmp ecx, 0x10000000
jae 0xbff8aa
add ecx, dword [edi]
cmp ecx, dword [edi]
jb 0xbff8aa
cmp dword [ecx], 0x4550
jne 0xbff8aa
movzx eax, word [ecx + 0x18]
cmp ax, word [ebp - 0xbc4]
je 0xbff8b7
cmp ax, word [ebp - 0xbbc]
je 0xbff8b7
mov edx, 0xc000000d
jmp 0xbff8af
mov edx, 0xc000007b
mov dword [ebp - 0xa9c], edx
jmp 0xbff8c9
mov eax, dword [ecx + 0x78]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x7c]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x50]
mov dword [edi + 4], eax
mov eax, dword [esi]
push 4
pop ecx
add esi, ecx
mov dword [ebp - 0xc00], eax
test eax, eax
je 0xbff953
mov ecx, esi
mov dword [ebp - 0xab4], esi
xor eax, eax
mov dword [ebp - 0xaf4], eax
lea eax, [ecx + 1]
mov dword [ebp - 0xbc8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0xbff8f3
sub ecx, dword [ebp - 0xbc8]
inc esi
add esi, ecx
test edx, edx
js 0xbff93d
mov ecx, dword [ebp - 0xab4]
lea eax, [ebp - 0xaf4]
push eax
push edi
xor edx, edx
call fcn.00b884d0
mov edx, eax
mov dword [ebp - 0xa9c], edx
test edx, edx
js 0xbff95f
mov eax, dword [ebp - 0xaa8]
mov ecx, dword [ebp - 0xaf4]
mov dword [eax*4 + section..data], ecx
jmp 0xbff943
mov eax, dword [ebp - 0xaa8]
inc eax
inc ebx
mov dword [ebp - 0xaa8], eax
cmp ebx, dword [ebp - 0xc00]
jb 0xbff8da
add edi, 0x10
cmp byte [esi], 0
jne 0xbff82d
mov ebx, dword [ebp - 0xa9c]
mov esi, dword [ebp - 0xab0]
test esi, esi
je 0xbff980
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
jns 0xbff9d6
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xbff999
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xbff988
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
jmp 0xbff9e1
mov ebx, 0xc000007a
jmp 0xbff965
mov esi, dword [ebp - 0xab0]
mov ebx, 0xc000007a
jmp 0xbff96b
mov eax, dword [0xd0a150]
inc eax
mov dword [0xd0a150], eax
xor eax, eax
mov edi, 0xd0aed4
xchg dword [edi], eax
mov eax, dword [ebp - 0xaac]
xor ebx, ebx
mov esi, dword [0xd08068]
inc ebx
mov dword [ebp - 0x2e4], eax
mov ecx, esi
mov eax, dword [ebp - 0xabc]
mov dword [ebp - 0x2cc], eax
lea eax, [ebp - 0x2e8]
push eax
push 4
pop eax
push eax
push 0x2021
xor eax, eax
mov dword [ebp - 0x2e8], ebx
push eax
mov dword [ebp - 0x2dc], 0x9966f291
mov dword [ebp - 0x2e0], ebx
mov dword [ebp - 0x2d4], ebx
mov dword [ebp - 0x2d8], ebx
mov dword [ebp - 0x2d0], ebx
call dword [0xd0cffc]
call esi
mov ecx, ebx
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
jne 0xbffa50
mov eax, dword [0xd0a150]
test eax, eax
jle 0xbffab2
sub eax, 1
mov dword [0xd0a150], eax
jne 0xbffab2
xor ebx, ebx
mov esi, ebx
mov eax, dword [esi + 0xd0ae80]
test eax, eax
je 0xbffa84
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
add esi, 0x10
cmp esi, 0x40
jb 0xbffa73
push 0x40
push ebx
push 0xd0ae80
call fcn.00bc259b
add esp, 0xc
mov esi, 0xb17130
mov edi, section..data
push 0x2e
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, 0xd0aed4
jmp 0xbffab4
xor ebx, ebx
xor eax, eax
xchg dword [edi], eax
push dword [ebp - 0xaa4]
mov esi, dword [0xd080b0]
mov ecx, esi
push ebx
call dword [0xd0cffc]
call esi
jmp 0xbffad3
xor ebx, ebx
mov eax, ebx
mov dword [ebp - 0xaa4], ebx
mov dword [ebp - 0xbe4], eax
lea edi, [ebp - 0xcf0]
xor eax, eax
mov dword [ebp - 0xebc], ebx
stosd dword es:[edi], eax
mov esi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0xa0
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xbc8], ebx
test ebx, ebx
je 0xc01bd1
push edi
push 0xd08d58
push ebx
call fcn.00bc13d0
mov esi, ebx
add esp, 0xc
mov dword [ebp - 0xa98], esi
push 8
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0xc01bd1
mov ecx, dword [0xd08d50]
mov ebx, edi
mov dword [edi], ecx
mov ecx, dword [0xd08d54]
mov dword [edi + 4], ecx
mov dword [ebp - 0xaa4], ebx
rdtsc
mov dword [ebp - 0xab4], eax
mov dword [ebp - 0xc00], edx
xor eax, eax
mov dword [ebp - 0xba0], eax
lea eax, [ebp - 0xd54]
push eax
push 4
pop ecx
mov edx, ecx
call fcn.00b84e9a
test eax, eax
js 0xc01bd7
mov edx, dword [ebp - 0xd54]
lea eax, [ebp - 0xba0]
push eax
xor ecx, ecx
call fcn.00b84e9a
or eax, 0x10000000
jl 0xc01bd7
lea eax, [ebp - 0xd58]
mov edx, 0xa0
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
test eax, eax
js 0xc01bd7
mov edx, dword [ebp - 0xd58]
lea eax, [ebp - 0xba0]
mov ecx, dword [ebp - 0xba0]
push eax
call fcn.00b84e9a
or eax, 0x10000000
jl 0xc01bd7
lea eax, [ebp - 0xd5c]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
test eax, eax
js 0xc01bd7
mov edx, dword [ebp - 0xd5c]
lea eax, [ebp - 0xba0]
mov ecx, dword [ebp - 0xba0]
push eax
call fcn.00b84e9a
or eax, 0x10000000
jl 0xc01bd7
lea eax, [ebp - 0xc68]
push eax
push 8
pop edx
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
test eax, eax
js 0xc01bd7
mov edx, dword [ebp - 0xc68]
lea eax, [ebp - 0xba0]
mov ecx, dword [ebp - 0xba0]
push eax
call fcn.00b84e9a
or eax, 0x10000000
jl 0xc01bd7
mov esi, dword [ebp - 0xba0]
push esi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ebx, eax
mov dword [ebp - 0xae0], ebx
test ebx, ebx
je 0xc01bcb
mov dword [ebp - 0xbe4], eax
lea eax, [ebp - 0xea0]
mov ecx, ebx
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc01bcb
lea ecx, [ebx + esi]
lea eax, [ebx + 8]
mov dword [ebp - 0xaa8], ecx
cmp eax, ecx
ja 0xc01bcb
mov eax, dword [ebp - 0xea0]
push 4
pop ecx
mov dword [ebx], ecx
mov dword [eax], ecx
mov esi, ebx
xor eax, eax
mov dword [ebp - 0xbf8], esi
mov dword [ebp - 0xaf4], eax
mov edx, dword [esi]
lea eax, [ebp - 0xc6c]
push eax
call fcn.00b84e9a
test eax, eax
js 0xc01bcb
mov edx, dword [ebp - 0xc6c]
lea eax, [ebp - 0xbf8]
push eax
mov ecx, esi
call fcn.00b84e9a
test eax, eax
js 0xc01bcb
mov eax, dword [ebp - 0xaf4]
inc eax
mov dword [ebp - 0xaf4], eax
cmp eax, 1
jae 0xbffd38
mov esi, dword [ebp - 0xbf8]
push 4
pop ecx
jmp 0xbffce9
mov ecx, dword [ebp - 0xbf8]
lea eax, [ebp - 0xe7c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc01bcb
lea eax, [ecx + 0xa4]
cmp eax, dword [ebp - 0xaa8]
ja 0xc01bcb
mov eax, 0xa0
push eax
push dword [ebp - 0xbc8]
mov dword [ecx], eax
push dword [ebp - 0xe7c]
call fcn.00bc13d0
add esp, 0xc
mov esi, ebx
xor eax, eax
mov dword [ebp - 0xb64], esi
mov dword [ebp - 0xaf4], eax
mov edx, dword [esi]
lea eax, [ebp - 0xc80]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
test eax, eax
js 0xc01bcb
mov edx, dword [ebp - 0xc80]
lea eax, [ebp - 0xb64]
push eax
mov ecx, esi
call fcn.00b84e9a
test eax, eax
js 0xc01bcb
mov eax, dword [ebp - 0xaf4]
inc eax
mov dword [ebp - 0xaf4], eax
cmp eax, 2
jae 0xbffde6
mov esi, dword [ebp - 0xb64]
jmp 0xbffd95
mov ecx, dword [ebp - 0xb64]
lea eax, [ebp - 0xe84]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc01bcb
lea eax, [ecx + 0xc]
cmp eax, dword [ebp - 0xaa8]
ja 0xc01bcb
mov dword [ecx], 8
mov ecx, dword [ebp - 0xe84]
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
xor eax, eax
mov dword [ebp - 0xb00], ebx
push 4
mov esi, eax
pop edi
mov edx, dword [ebx]
lea eax, [ebp - 0xc58]
push eax
mov ecx, edi
call fcn.00b84e9a
test eax, eax
js 0xc01bcb
mov edx, dword [ebp - 0xc58]
lea eax, [ebp - 0xb00]
push eax
mov ecx, ebx
call fcn.00b84e9a
test eax, eax
js 0xc01bcb
inc esi
cmp esi, 3
jae 0xbffe79
mov ebx, dword [ebp - 0xb00]
jmp 0xbffe37
mov ecx, dword [ebp - 0xb00]
lea eax, [ebp - 0xe8c]
push eax
mov edx, edi
call fcn.00b84e9a
test eax, eax
js 0xc01bcb
lea eax, [ecx + 0xc]
cmp eax, dword [ebp - 0xaa8]
ja 0xc01bcb
mov eax, dword [ebp - 0xe8c]
push 8
pop ebx
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xab4]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc00]
mov dword [eax + 4], ecx
lea eax, [ebp - 0xbf4]
push eax
push 4
pop ecx
mov edx, ecx
call fcn.00b84e9a
test eax, eax
js 0xc01bcb
mov esi, dword [ebp - 0xbf4]
lea eax, [ebp - 0xb4c]
push eax
mov edx, ebx
mov dword [ebp - 0xb78], esi
call fcn.00b84e9a
test eax, eax
js 0xc01bcb
mov edx, dword [ebp - 0xb4c]
lea eax, [ebp - 0xb78]
push eax
mov ecx, esi
call fcn.00b84e9a
test eax, eax
js 0xc01bcb
xor ecx, ecx
rdtsc
mov edi, ecx
mov dword [ebp - 0xad0], ecx
mov ebx, ecx
mov dword [ebp - 0xacc], edi
mov dword [ebp - 0xb94], ebx
mov dword [ebp - 0xa9c], ecx
mov dword [ebp - 0xac0], ecx
mov dword [ebp - 0xbbc], ecx
mov dword [ebp - 0xaf8], ecx
mov dword [ebp - 0xbfc], ecx
mov dword [ebp - 0xbc4], ecx
mov dword [ebp - 0xaa8], ecx
mov dword [ebp - 0xb4c], eax
mov dword [ebp - 0xbf4], edx
push 8
pop ecx
mov dword [ebp - 0xc98], ecx
mov edx, dword [ebp - 0xba0]
lea eax, [ebp - 0xc98]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0007b
mov eax, dword [ebp - 0xc98]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
mov dword [ebp - 0xaf4], ecx
cmp ecx, eax
jae 0xbfffac
mov esi, 0xc0000095
jmp 0xc0007b
push ecx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xbfffce
mov esi, 0xc0000017
mov edi, ebx
jmp 0xc0007b
push 4
pop ecx
lea eax, [ebp - 0xbc0]
mov dword [edi], ecx
mov edx, ecx
mov dword [ebp - 0xbc0], edi
push eax
mov ecx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc00060
mov ecx, dword [ebp - 0xbc0]
mov eax, dword [ebp - 0xba0]
mov dword [ecx], eax
lea eax, [ebp - 0xbc0]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc00060
mov eax, dword [ebp - 0xaf4]
push dword [ebp - 0xba0]
mov ecx, dword [ebp - 0xb4c]
push dword [ebp - 0xae0]
mov dword [edi + eax - 8], ecx
mov ecx, dword [ebp - 0xbf4]
push dword [ebp - 0xbc0]
mov dword [edi + eax - 4], ecx
call fcn.00bc13d0
mov eax, dword [ebp - 0xaf4]
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xad0], edi
mov edi, ecx
mov dword [ebp - 0xacc], eax
jmp 0xc00062
xor ecx, ecx
test edi, edi
je 0xc00075
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xacc]
or esi, 0x10000000
jl 0xc019e6
mov esi, dword [ebp - 0xad0]
xor ecx, ecx
mov dword [ebp - 0xbf8], ecx
test esi, esi
jne 0xc000a3
mov esi, 0xc000000d
jmp 0xc007f0
test edi, edi
je 0xc007eb
lea eax, [edi + 8]
push eax
push ecx
mov dword [ebp - 0xbdc], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xbe0], eax
test eax, eax
je 0xc007eb
xor ecx, ecx
mov dl, cl
test edi, edi
je 0xc000e1
xor dl, byte [ecx + esi]
inc ecx
cmp ecx, edi
jb 0xc000d9
mov dword [ebp - 0xb00], esi
or ecx, 0xffffffff
mov esi, eax
mov dword [ebp - 0xb48], ecx
xor eax, eax
mov dword [ebp - 0xb98], esi
mov dword [ebp - 0xb1c], eax
mov dword [ebp - 0xb44], eax
xor eax, eax
mov dword [ebp - 0xab8], eax
mov dword [ebp - 0xb70], eax
je 0xc00219
xor esi, esi
mov dword [ebp - 0xb70], eax
mov ecx, eax
mov dword [ebp - 0xaf4], eax
mov dword [ebp - 0xab8], ecx
jbe 0xc00199
mov ebx, dword [ebp - 0xb00]
mov edi, eax
push 0x38
pop ecx
mov esi, ecx
push 4
pop ecx
cmp eax, ecx
movzx eax, byte [ebx]
jge 0xc00158
lea ecx, [esi - 0x20]
shl eax, cl
mov ecx, dword [ebp - 0xab8]
or edi, eax
jmp 0xc0016a
mov ecx, esi
shl eax, cl
mov ecx, dword [ebp - 0xab8]
or ecx, eax
mov dword [ebp - 0xab8], ecx
mov eax, dword [ebp - 0xaf4]
sub esi, 8
inc eax
inc ebx
mov dword [ebp - 0xaf4], eax
test eax, eax
js 0xc0013f
mov dword [ebp - 0xb70], edi
xor esi, esi
mov edi, dword [ebp - 0xacc]
mov dword [ebp - 0xb00], ebx
mov ebx, dword [ebp - 0xb94]
mov eax, dword [ebp - 0xb70]
xor ecx, 0x42f6b18d
xor eax, 0xb17a307a
cmp dword [ebp - 0xbf0], 0
mov dword [ebp - 0xb1c], eax
mov dword [ebp - 0xb44], eax
jbe 0xc001f4
mov ebx, dword [ebp - 0xb98]
cmp esi, 4
jge 0xc001d1
rol eax, 8
mov byte [ebx], al
jmp 0xc001d6
rol ecx, 8
mov byte [ebx], cl
inc ebx
add esi, 1
js 0xc001c5
mov eax, dword [ebp - 0xb44]
mov dword [ebp - 0xb98], ebx
mov ebx, dword [ebp - 0xb94]
mov dword [ebp - 0xb1c], eax
push 0xfffffffffffffffc
xor eax, eax
pop esi
mov ecx, eax
mov dword [ebp - 0xb48], ecx
test esi, esi
jg 0xc00213
jns 0xc00213
mov dword [ebp - 0xb1c], eax
mov dword [ebp - 0xb44], eax
mov esi, dword [ebp - 0xb98]
mov eax, edi
shr eax, 3
mov dword [ebp - 0xaf4], eax
test eax, eax
je 0xc0060f
mov ebx, dword [ebp - 0xb00]
lea eax, [esi + 7]
mov dword [ebp - 0xb64], eax
add ebx, 2
movzx edi, byte [ebx - 2]
movzx eax, byte [ebx - 1]
movzx esi, byte [ebx + 2]
shl edi, 8
or edi, eax
shl esi, 8
movzx eax, byte [ebx]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 1]
shl edi, 8
or edi, eax
movzx eax, byte [ebx + 3]
or esi, eax
movzx eax, byte [ebx + 4]
shl esi, 8
or esi, eax
movzx eax, byte [ebx + 5]
add ebx, 8
shl esi, 8
or esi, eax
mov dword [ebp - 0xb4c], ebx
xor ecx, esi
mov dword [ebp - 0xaa0], ecx
lea ebx, [ecx - 0x4a58]
mov ecx, 0xc81ecb17
xor ebx, edi
xor ebx, dword [ebp - 0xb1c]
xor ebx, ecx
mov eax, ebx
xor eax, ecx
ror eax, 0xf
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 7
add ecx, eax
mov eax, dword [ebp - 0xaa0]
xor eax, ecx
mov dword [ebp - 0xaa0], eax
add eax, 0xb1b54a58
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xaa0]
ror eax, 0xa
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0xcb17
rol eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
rol eax, 5
add ecx, eax
mov eax, dword [ebp - 0xaa0]
xor eax, ecx
mov ecx, eax
mov dword [ebp - 0xaa0], eax
xor ecx, 0xb1b54a58
mov eax, 0xc81ecb17
sub eax, ecx
xor ebx, eax
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 6
sub ecx, eax
sub ecx, 0x339b6838
xor dword [ebp - 0xaa0], ecx
mov ecx, dword [ebp - 0xaa0]
mov eax, ecx
ror eax, 0xf
xor eax, 0xcb17
imul eax, eax, 0x4a58
xor ebx, eax
mov eax, ebx
not eax
ror eax, 3
add eax, 0xc81e
imul eax, eax, 0xcb17
xor ecx, eax
mov dword [ebp - 0xaa0], ecx
lea eax, [ecx + 0x37e0ea91]
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0xc81e
ror ecx, 0xa
imul eax, eax, 0xb1b5
xor ecx, eax
mov eax, dword [ebp - 0xaa0]
xor eax, ecx
mov dword [ebp - 0xaa0], eax
xor eax, 0x4a58
rol eax, 6
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xaa0]
ror eax, 3
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xaa0]
mov eax, ebx
ror eax, 0xf
sub eax, 0xc81e
imul eax, eax, 0x4a58
xor ecx, eax
mov dword [ebp - 0xaa0], ecx
xor ecx, 0xc81e
mov eax, dword [ebp - 0xaa0]
shr eax, 1
imul ecx, ecx, 0x4a58
xor ecx, eax
mov eax, dword [ebp - 0xaa0]
add eax, 0xffff34e9
xor ebx, ecx
rol eax, 3
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xaa0]
shr eax, 0xf
xor ecx, eax
xor ebx, ecx
imul ecx, ebx, 0xb1b5
mov eax, ebx
shr eax, 0xd
sub ecx, eax
mov eax, 0xb1b54a58
add ecx, 0x730581bd
xor dword [ebp - 0xaa0], ecx
sub eax, dword [ebp - 0xaa0]
ror eax, 9
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xaa0]
ror eax, 0xb
xor ecx, eax
xor ebx, ecx
mov ecx, dword [ebp - 0xaa0]
lea eax, [ebx + 0x4e49ed8a]
xor ecx, eax
mov dword [ebp - 0xaa0], ecx
mov eax, dword [ebp - 0xaa0]
xor eax, 0xb1b5
ror ecx, 7
imul eax, eax, 0x4a58
sub eax, ecx
xor ebx, eax
mov eax, ebx
xor eax, 0xc81e
rol eax, 4
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0x10
sub ecx, eax
mov eax, 0xb1b54a58
xor dword [ebp - 0xaa0], ecx
sub eax, dword [ebp - 0xaa0]
ror eax, 0xa
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xaa0]
ror eax, 4
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x4e4ab5a8]
ror eax, 4
imul ecx, eax, 0xc81e
mov eax, ebx
ror eax, 9
xor ecx, eax
mov eax, dword [ebp - 0xaa0]
xor eax, ecx
mov dword [ebp - 0xaa0], eax
xor eax, 0xc81ecb17
rol eax, 8
imul ecx, eax, 0x4a58
mov eax, dword [ebp - 0xaa0]
rol eax, 2
sub ecx, eax
mov eax, 0xc81ecb17
xor ebx, ecx
sub eax, ebx
ror eax, 0xb
imul ecx, eax, 0xb1b5
mov eax, ebx
ror eax, 0xc
sub ecx, eax
mov eax, dword [ebp - 0xaa0]
xor eax, ecx
mov dword [ebp - 0xaa0], eax
xor eax, 0xb1b5
imul ecx, eax, 0xcb17
mov eax, dword [ebp - 0xaa0]
shr eax, 8
xor ecx, eax
xor ebx, ecx
mov eax, ebx
xor ebx, dword [ebp - 0xb70]
xor eax, dword [ebp - 0xab8]
xor eax, dword [ebp - 0xaa0]
xor eax, 0x79ab814f
mov dword [ebp - 0xb44], ebx
mov dword [ebp - 0xb48], eax
mov eax, dword [ebp - 0xb64]
mov dword [ebp - 0xb70], edi
mov dword [ebp - 0xab8], esi
mov byte [eax - 4], bl
mov al, byte [ebp - 0xb48]
mov ebx, dword [ebp - 0xb64]
ror dword [ebp - 0xb44], 8
mov byte [ebx], al
mov al, byte [ebp - 0xb44]
ror dword [ebp - 0xb48], 8
mov byte [ebx - 5], al
mov al, byte [ebp - 0xb48]
ror dword [ebp - 0xb44], 8
mov byte [ebx - 1], al
mov al, byte [ebp - 0xb44]
ror dword [ebp - 0xb48], 8
mov byte [ebx - 6], al
mov al, byte [ebp - 0xb48]
ror dword [ebp - 0xb44], 8
mov byte [ebx - 2], al
ror dword [ebp - 0xb48], 8
mov al, byte [ebp - 0xb44]
mov byte [ebx - 7], al
mov al, byte [ebp - 0xb48]
mov byte [ebx - 3], al
add ebx, 8
mov eax, dword [ebp - 0xb44]
mov ecx, dword [ebp - 0xb48]
ror eax, 8
ror ecx, 8
sub dword [ebp - 0xaf4], 1
mov dword [ebp - 0xb64], ebx
mov ebx, dword [ebp - 0xb4c]
mov dword [ebp - 0xb1c], eax
mov dword [ebp - 0xb44], eax
mov dword [ebp - 0xb48], ecx
jne 0xc0023e
mov ebx, dword [ebp - 0xb94]
mov edi, dword [ebp - 0xacc]
mov esi, dword [ebp - 0xbe0]
movzx eax, dl
cdq
mov dword [esi + edi], eax
mov dword [esi + edi + 4], edx
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc00641
mov esi, 0xc0000017
jmp 0xc00751
mov eax, dword [ebp - 0xbdc]
push eax
push 8
mov dword [edi], eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc006c5
mov dword [edi + 4], eax
push dword [ebp - 0xbdc]
push esi
push eax
call fcn.00bc13d0
add esp, 0xc
mov eax, 0xa0
mov dword [edi + 8], eax
push eax
push 8
pop esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc006c5
mov dword [edi + 0xc], eax
push 0xa0
push 0xd08ca8
push eax
call fcn.00bc13d0
add esp, 0xc
mov dword [edi + 0x10], esi
push esi
push esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov ecx, eax
xor edx, edx
test ecx, ecx
jne 0xc006ce
mov esi, 0xc0000017
jmp 0xc006ea
mov esi, 0xc0000017
xor edx, edx
jmp 0xc006ea
mov dword [edi + 0x14], ecx
mov esi, edx
mov eax, dword [0xd08d48]
mov dword [ecx], eax
mov eax, dword [0xd08d4c]
mov dword [ebp - 0xbf8], edi
mov edi, edx
mov dword [ecx + 4], eax
test edi, edi
je 0xc00751
cmp dword [edi + 4], 0
je 0xc0070a
push dword [edi + 4]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 4], edx
cmp dword [edi + 0xc], 0
je 0xc00726
push dword [edi + 0xc]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0xc], edx
cmp dword [edi + 0x14], 0
je 0xc00742
push dword [edi + 0x14]
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor edx, edx
mov dword [edi + 0x14], edx
push edi
push edx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
test esi, esi
js 0xc00767
mov ebx, dword [ebp - 0xbf8]
mov edi, eax
mov dword [ebp - 0xb94], ebx
jmp 0xc0076d
mov edi, dword [ebp - 0xbf8]
push dword [ebp - 0xbe0]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test edi, edi
je 0xc007f0
xor eax, eax
cmp dword [edi + 4], eax
je 0xc007a2
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc007be
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc007da
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc007f0
mov esi, 0xc0000001
or esi, 0x10000000
jl 0xc019e0
mov edx, dword [ebx]
lea eax, [ebp - 0xbb4]
push 4
pop edi
push eax
mov ecx, edi
mov dword [ebp - 0xbb4], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0088b
mov ecx, dword [ebp - 0xbb4]
lea eax, [ebp - 0xbb4]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0088b
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xbb4]
mov ecx, dword [ebp - 0xbb4]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0088b
mov ecx, dword [ebp - 0xbb4]
lea eax, [ebp - 0xbb4]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0088b
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xbb4]
mov ecx, dword [ebp - 0xbb4]
push eax
call fcn.00b84e9a
mov esi, eax
mov eax, dword [ebp - 0xbb4]
test esi, esi
jns 0xc00891
mov eax, dword [ebp - 0xe38]
mov dword [ebp - 0xaf4], eax
test esi, esi
js 0xc009ea
push eax
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc008bf
mov esi, 0xc0000017
jmp 0xc009ea
mov eax, dword [ebx]
mov ecx, edi
mov dword [edi], eax
lea eax, [ebp - 0xb60]
push eax
push 4
pop eax
mov edx, eax
mov dword [ebp - 0xb60], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc009d5
push dword [ebx]
push dword [ebx + 4]
push dword [ebp - 0xb60]
call fcn.00bc13d0
mov edx, dword [ebx]
lea eax, [ebp - 0xb60]
mov ecx, dword [ebp - 0xb60]
add esp, 0xc
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc009d5
mov ecx, dword [ebp - 0xb60]
mov eax, dword [ebx + 8]
mov dword [ecx], eax
lea eax, [ebp - 0xb60]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc009d5
push dword [ebx + 8]
push dword [ebx + 0xc]
push dword [ebp - 0xb60]
call fcn.00bc13d0
mov edx, dword [ebx + 8]
lea eax, [ebp - 0xb60]
mov ecx, dword [ebp - 0xb60]
add esp, 0xc
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc009d5
mov ecx, dword [ebp - 0xb60]
mov eax, dword [ebx + 0x10]
mov dword [ecx], eax
lea eax, [ebp - 0xb60]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc009d5
push dword [ebx + 0x10]
push dword [ebx + 0x14]
push dword [ebp - 0xb60]
call fcn.00bc13d0
mov edx, dword [ebx + 0x10]
lea eax, [ebp - 0xb60]
mov ecx, dword [ebp - 0xb60]
add esp, 0xc
push eax
call fcn.00b84e9a
mov esi, eax
xor ecx, ecx
test esi, esi
js 0xc009d7
mov eax, dword [ebp - 0xaf4]
mov dword [ebp - 0xa9c], edi
mov edi, ecx
mov dword [ebp - 0xac0], eax
jmp 0xc009d7
xor ecx, ecx
test edi, edi
je 0xc009ea
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
or esi, 0x10000000
jl 0xc019e0
xor eax, eax
mov dword [ebp - 0xc94], 8
mov dword [ebp - 0xaf4], eax
mov dword [ebp - 0xb00], eax
mov edx, dword [ebp - 0xb78]
lea eax, [ebp - 0xc94]
push eax
push 8
pop ecx
call fcn.00b84e9a
mov esi, eax
or esi, 0x10000000
jl 0xc00c37
mov eax, dword [ebp - 0xc94]
lea ecx, [eax + 7]
and ecx, 0xfffffff8
cmp ecx, eax
jae 0xc00a48
mov esi, 0xc0000095
jmp 0xc00a69
mov dword [ebp - 0xcbc], ecx
lea eax, [ebp - 0xcbc]
push eax
push 8
pop edx
call fcn.00b84e9a
mov esi, eax
mov eax, dword [ebp - 0xcbc]
test esi, esi
jns 0xc00a6f
mov eax, dword [ebp - 0xd60]
mov dword [ebp - 0xb64], eax
test esi, esi
js 0xc00c37
mov ebx, dword [ebp - 0xae0]
xor eax, eax
mov ecx, ebx
mov edi, eax
mov dword [ebp - 0xb74], ecx
mov eax, dword [ecx]
mov dword [ebp - 0xb4c], eax
lea eax, [ebp - 0xb74]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc00c37
mov edx, dword [ebp - 0xb4c]
lea eax, [ebp - 0xb74]
mov ecx, dword [ebp - 0xb74]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc00c37
mov ecx, dword [ebp - 0xb74]
inc edi
cmp edi, 1
jb 0xc00a8f
mov edi, dword [ecx]
lea eax, [ebp - 0xb74]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc00c37
mov dword [ebp - 0xaf4], edi
xor eax, eax
mov dword [ebp - 0xb1c], ebx
mov edi, eax
lea eax, [ebp - 0xb1c]
mov ecx, ebx
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc00b6f
mov edx, dword [ebx]
lea eax, [ebp - 0xb1c]
mov ecx, dword [ebp - 0xb1c]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc00b6f
inc edi
cmp edi, 2
jae 0xc00b4e
mov ebx, dword [ebp - 0xb1c]
jmp 0xc00b0d
mov ecx, dword [ebp - 0xb1c]
lea eax, [ebp - 0xb1c]
push eax
push 4
pop eax
mov edi, dword [ecx]
mov edx, eax
call fcn.00b84e9a
mov esi, eax
mov ebx, edi
test esi, esi
jns 0xc00b7d
mov ebx, dword [ebp - 0xb00]
test esi, esi
js 0xc00c37
mov edx, dword [ebp - 0xb64]
lea eax, [ebp - 0xb18]
push 4
pop edi
push eax
mov ecx, edi
mov dword [ebp - 0xb18], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc00c12
mov ecx, dword [ebp - 0xb18]
lea eax, [ebp - 0xb18]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc00c12
mov edx, dword [ebp - 0xaf4]
lea eax, [ebp - 0xb18]
mov ecx, dword [ebp - 0xb18]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc00c12
mov ecx, dword [ebp - 0xb18]
lea eax, [ebp - 0xb18]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc00c12
mov ecx, dword [ebp - 0xb18]
lea eax, [ebp - 0xb18]
push eax
mov edx, ebx
call fcn.00b84e9a
mov esi, eax
mov eax, dword [ebp - 0xb18]
test esi, esi
jns 0xc00c1c
mov eax, dword [ebp - 0xe54]
test esi, esi
js 0xc00c37
cmp eax, 0x400000
jbe 0xc00c2d
mov esi, 0x8000ffff
jmp 0xc019e0
mov edi, eax
mov dword [ebp - 0xaf8], edi
jmp 0xc00c3d
mov edi, dword [ebp - 0xaf8]
test esi, esi
js 0xc019e0
push edi
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
jne 0xc00c66
mov ecx, dword [ebp - 0xbbc]
mov esi, 0xd0000017
jmp 0xc00c73
mov ecx, eax
mov dword [ebp - 0xbbc], eax
mov esi, 0x10000000
mov ebx, dword [ebp - 0xa9c]
test esi, esi
js 0xc019e6
test ebx, ebx
je 0xc00d19
test ecx, ecx
je 0xc00d19
mov eax, dword [ebp - 0xac0]
mov dword [ebp - 0xe00], eax
xor eax, eax
mov dword [ebp - 0xdf8], eax
lea eax, [ebp - 0xd64]
push eax
push 0xb2be98
push 1
mov dword [ebp - 0xe08], ebx
mov dword [ebp - 0xe04], ecx
mov dword [ebp - 0xdfc], edi
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleExW]
test eax, eax
je 0xc00d23
push 0xb2be7c
push dword [ebp - 0xd64]
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0xc00d23
xor eax, eax
mov ecx, esi
push eax
push 0x14
lea eax, [ebp - 0xe08]
push eax
push 0x86
call dword [0xd0cffc]
call esi
mov esi, eax
or esi, 0x10000000
jl 0xc00d41
mov edi, dword [ebp - 0xdfc]
mov dword [ebp - 0xaf8], edi
jmp 0xc00d41
mov esi, 0x80070057
jmp 0xc019e6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0xc00d3a
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc00d41
mov esi, 0x80004005
cmp esi, 0xd0000023
jne 0xc00d53
mov esi, 0x8007007a
jmp 0xc019e6
test esi, esi
js 0xc019e6
mov eax, dword [ebp - 0xbbc]
xor ecx, ecx
push 4
pop edx
mov dword [ebp - 0xb30], ecx
mov ebx, ecx
mov dword [ebp - 0xba4], eax
cmp edi, edx
jae 0xc00d82
mov esi, 0xc000003e
jmp 0xc0115d
mov edi, dword [eax]
lea ecx, [ebp - 0xba4]
push ecx
mov ecx, eax
mov dword [ebp - 0xb4c], edi
call fcn.00b84e9a
mov esi, eax
xor ecx, ecx
test esi, esi
js 0xc0115d
lea eax, [ebp - 0xb30]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0115b
mov eax, dword [ebp - 0xaf8]
sub eax, dword [ebp - 0xb30]
cmp eax, edi
jb 0xc00fa3
mov eax, dword [ebp - 0xba4]
lea ecx, [ebp - 0xba4]
push ecx
mov edx, edi
mov dword [ebp - 0xb78], eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0115b
mov ecx, dword [ebp - 0xb30]
lea eax, [ebp - 0xb30]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0115b
mov eax, dword [ebp - 0xaf8]
sub eax, dword [ebp - 0xb30]
push 4
pop edx
cmp eax, edx
jb 0xc00fa3
mov ecx, dword [ebp - 0xba4]
lea eax, [ebp - 0xba4]
push eax
mov edi, dword [ecx]
mov dword [ebp - 0xbf4], edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0115b
mov ecx, dword [ebp - 0xb30]
lea eax, [ebp - 0xb30]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0115b
mov eax, dword [ebp - 0xaf8]
sub eax, dword [ebp - 0xb30]
cmp eax, edi
jb 0xc00fa3
mov eax, dword [ebp - 0xba4]
lea ecx, [ebp - 0xba4]
push ecx
mov edx, edi
mov dword [ebp - 0xaf4], eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0115b
mov ecx, dword [ebp - 0xb30]
lea eax, [ebp - 0xb30]
push eax
mov edx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0115b
mov eax, dword [ebp - 0xaf8]
sub eax, dword [ebp - 0xb30]
push 4
pop edx
cmp eax, edx
jb 0xc00fa3
mov ecx, dword [ebp - 0xba4]
mov eax, dword [ecx]
mov dword [ebp - 0xb00], eax
lea eax, [ebp - 0xba4]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0115b
mov ecx, dword [ebp - 0xb30]
lea eax, [ebp - 0xb30]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0115b
mov eax, dword [ebp - 0xaf8]
sub eax, dword [ebp - 0xb30]
mov ecx, dword [ebp - 0xb00]
cmp eax, ecx
jb 0xc00fa3
lea eax, [ebp - 0xb30]
mov edx, ecx
mov ecx, dword [ebp - 0xb30]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc0115b
mov ecx, dword [ebp - 0xaf8]
mov eax, ecx
sub eax, dword [ebp - 0xb30]
jne 0xc00fa3
mov eax, dword [ebp - 0xb00]
mov esi, dword [ebp - 0xb4c]
add eax, 0xc
add eax, edi
add eax, esi
cmp eax, ecx
jne 0xc00fa3
push 0x18
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0xc00fad
mov esi, 0xc0000017
jmp 0xc010e6
mov esi, 0xc000003e
jmp 0xc0115b
cmp dword [ebp - 0xb78], ebx
je 0xc00fee
push esi
push 8
mov dword [edi], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc00fe2
mov dword [edi + 4], eax
push esi
push dword [ebp - 0xb78]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xc00ff5
mov esi, 0xc0000017
xor eax, eax
jmp 0xc0107f
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
cmp dword [ebp - 0xaf4], ebx
je 0xc01031
mov esi, dword [ebp - 0xbf4]
push esi
push 8
mov dword [edi + 8], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc00fe2
mov dword [edi + 0xc], eax
push esi
push dword [ebp - 0xaf4]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xc01037
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
cmp dword [ebp - 0xba4], ebx
je 0xc01073
mov esi, dword [ebp - 0xb00]
push esi
push 8
mov dword [edi + 0x10], esi
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
test eax, eax
je 0xc00fe2
mov dword [edi + 0x14], eax
push esi
push dword [ebp - 0xba4]
push eax
call fcn.00bc13d0
add esp, 0xc
xor eax, eax
jmp 0xc01079
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov ebx, edi
mov esi, eax
mov edi, eax
test edi, edi
je 0xc010e6
cmp dword [edi + 4], 0
je 0xc0109f
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc010bb
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc010d7
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test esi, esi
js 0xc010f4
mov dword [ebp - 0xbfc], ebx
mov ebx, ecx
test ebx, ebx
je 0xc0115d
cmp dword [ebx + 4], 0
je 0xc01114
push dword [ebx + 4]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 4], ecx
cmp dword [ebx + 0xc], 0
je 0xc01130
push dword [ebx + 0xc]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 0xc], ecx
cmp dword [ebx + 0x14], 0
je 0xc0114c
push dword [ebx + 0x14]
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
mov dword [ebx + 0x14], ecx
push ebx
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
or esi, 0x10000000
jl 0xc019e0
mov eax, dword [ebp - 0xbfc]
mov edi, ecx
mov dword [ebp - 0xc6c], edi
mov dword [ebp - 0xc68], ecx
test eax, eax
je 0xc01228
mov esi, dword [eax + 4]
mov dword [ebp - 0xc58], esi
test esi, esi
je 0xc01228
mov ebx, dword [eax]
test ebx, ebx
je 0xc01228
add ebx, 0xfffffff8
mov dword [ebp - 0xc80], ecx
push ebx
push ecx
mov dword [ebp - 0xbc0], ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xbe0], eax
test eax, eax
je 0xc01748
xor ecx, ecx
mov edi, esi
mov dl, cl
mov dword [ebp - 0xb78], edi
mov esi, ebx
mov ecx, eax
mov dword [ebp - 0xb00], ecx
and esi, 7
je 0xc016ea
xor ebx, ebx
or eax, 0xffffffff
mov dword [ebp - 0xb28], eax
mov eax, ebx
mov dword [ebp - 0xb38], ebx
mov dword [ebp - 0xc08], ebx
mov dword [ebp - 0xb1c], eax
test esi, esi
je 0xc0126a
push 0x38
pop eax
push 4
pop ecx
cmp ebx, ecx
jge 0xc01232
lea ecx, [eax - 0x20]
movzx eax, byte [edi]
shl eax, cl
or dword [ebp - 0xb1c], eax
jmp 0xc01243
mov esi, 0xd000000d
jmp 0xc01764
movzx eax, byte [edi]
mov ecx, dword [ebp - 0xba8]
shl eax, cl
or dword [ebp - 0xc08], eax
mov eax, dword [ebp - 0xba8]
inc ebx
sub eax, 8
inc edi
mov dword [ebp - 0xba8], eax
cmp ebx, esi
jl 0xc01211
mov ecx, dword [ebp - 0xb00]
mov eax, dword [ebp - 0xb1c]
mov dword [ebp - 0xb78], edi
mov ebx, dword [ebp - 0xc08]
xor eax, 0x92f65a5
xor ebx, 0x699a899c
mov dword [ebp - 0xac4], eax
xor edi, edi
mov dword [ebp - 0xb38], eax
mov dword [ebp - 0xb28], ebx
test esi, esi
je 0xc012c2
cmp edi, 4
jge 0xc0129f
rol eax, 8
mov byte [ecx], al
jmp 0xc012a4
rol ebx, 8
mov byte [ecx], bl
inc edi
inc ecx
cmp edi, esi
jl 0xc01293
mov eax, dword [ebp - 0xb38]
mov ebx, dword [ebp - 0xb28]
mov dword [ebp - 0xb00], ecx
mov dword [ebp - 0xac4], eax
add esi, 0xfffffffc
test esi, esi
jle 0xc016bc
push 4
pop eax
mov ecx, eax
sub ecx, esi
shl ecx, 3
shr ebx, cl
shl ebx, cl
mov dword [ebp - 0xb4c], ebx
mov edi, ebx
mov dword [ebp - 0xb28], ebx
mov esi, dword [ebp - 0xac4]
mov ebx, dword [ebp - 0xbc0]
mov eax, ebx
shr eax, 3
mov dword [ebp - 0xbdc], eax
test eax, eax
je 0xc01683
mov eax, dword [ebp - 0xb00]
mov ecx, dword [ebp - 0xb78]
add eax, 7
add ecx, 2
mov dword [ebp - 0xaf4], eax
mov dword [ebp - 0xb74], ecx
movzx ebx, byte [ecx - 2]
movzx eax, byte [ecx - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx]
shl ebx, 8
or ebx, eax
movzx eax, byte [ecx + 1]
movzx ecx, byte [ecx + 2]
shl ecx, 8
shl ebx, 8
or ebx, eax
mov eax, dword [ebp - 0xb74]
xor esi, ebx
mov dword [ebp - 0xb4c], ebx
mov dword [ebp - 0xac4], esi
mov ebx, dword [ebp - 0xac4]
movzx eax, byte [eax + 3]
or ecx, eax
mov eax, dword [ebp - 0xb74]
shl ecx, 8
movzx eax, byte [eax + 4]
or ecx, eax
mov eax, dword [ebp - 0xb74]
shl ecx, 8
add dword [ebp - 0xb74], 8
movzx eax, byte [eax + 5]
or ecx, eax
mov esi, ecx
mov dword [ebp - 0xbf4], ecx
xor esi, edi
mov edi, 0xab69605e
xor esi, ebx
xor esi, 0xac987321
lea eax, [esi + 0x54969fa2]
rol eax, 5
imul ecx, eax, 0x137f
mov eax, esi
rol eax, 0xa
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x7f1137f]
ror eax, 9
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 2
sub ecx, eax
xor esi, ecx
imul ecx, esi, 0x605e
mov eax, esi
shr eax, 0xd
sub ecx, eax
sub ecx, 0x756c8a2
xor ebx, ecx
mov eax, ebx
xor eax, 0xab69
rol eax, 6
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 2
sub ecx, eax
mov eax, 0x7f1137f
xor esi, ecx
mov ecx, esi
xor ecx, edi
sub eax, ecx
xor ebx, eax
mov eax, ebx
mov ecx, ebx
xor eax, 0x137f
ror ecx, 6
imul eax, eax, 0xab69
xor ecx, eax
xor esi, ecx
lea eax, [esi + 0x7f1137f]
ror eax, 0xf
imul ecx, eax, 0x605e
mov eax, esi
rol eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx + 0x54969fa2]
ror eax, 0xe
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 8
sub ecx, eax
xor esi, ecx
mov eax, esi
xor eax, edi
ror eax, 0xc
imul ecx, eax, 0x137f
mov eax, esi
ror eax, 0xa
xor ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x7f1
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 0xa
xor ecx, eax
xor esi, ecx
mov eax, esi
not eax
ror eax, 5
add eax, 0x605e
imul eax, eax, 0x7f1
xor ebx, eax
lea edi, [ebx - 0x7f1]
xor edi, esi
xor edi, 0xab69605e
mov eax, edi
xor eax, 0x7f1
rol eax, 2
imul ecx, eax, 0x137f
mov eax, edi
shr eax, 2
add ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x7f1137f]
ror eax, 6
imul ecx, eax, 0xab69
mov eax, ebx
rol eax, 7
add ecx, eax
xor edi, ecx
mov eax, edi
mov ecx, edi
xor eax, 0x137f
ror ecx, 9
imul eax, eax, 0x605e
add ecx, eax
xor ebx, ecx
mov eax, ebx
mov dword [ebp - 0xac4], ebx
xor eax, 0xab69
rol eax, 5
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 7
add ecx, eax
xor edi, ecx
mov ebx, edi
xor ebx, dword [ebp - 0xac4]
xor ebx, 0xac987321
mov eax, ebx
ror eax, 3
sub eax, 0xab69
imul eax, eax, 0x137f
xor edi, eax
lea eax, [edi - 0x7f1137f]
ror eax, 1
imul ecx, eax, 0x605e
mov eax, edi
ror eax, 6
sub ecx, eax
xor ebx, ecx
lea eax, [ebx - 0x54969fa2]
rol eax, 3
imul ecx, eax, 0x7f1
mov eax, ebx
rol eax, 0xe
add ecx, eax
xor edi, ecx
lea eax, [edi - 0x54969fa2]
rol eax, 0xf
imul ecx, eax, 0x137f
mov eax, edi
ror eax, 0xe
sub ecx, eax
xor ebx, ecx
mov eax, ebx
xor eax, 0x605e
imul ecx, eax, 0xab69
mov eax, ebx
shr eax, 3
xor ecx, eax
xor edi, ecx
mov eax, edi
xor eax, 0x7f1137f
rol eax, 4
imul ecx, eax, 0x605e
mov eax, edi
xor edi, dword [ebp - 0xc08]
rol eax, 2
mov dword [ebp - 0xb28], edi
xor ecx, eax
xor ecx, dword [ebp - 0xb1c]
xor ebx, ecx
mov ecx, dword [ebp - 0xaf4]
mov dword [ebp - 0xb38], ebx
mov byte [ecx - 4], bl
mov al, byte [ebp - 0xb28]
ror dword [ebp - 0xb38], 8
mov byte [ecx], al
mov al, byte [ebp - 0xb38]
ror dword [ebp - 0xb28], 8
mov byte [ecx - 5], al
mov al, byte [ebp - 0xb28]
ror dword [ebp - 0xb38], 8
mov byte [ecx - 1], al
mov al, byte [ebp - 0xb38]
ror dword [ebp - 0xb28], 8
mov byte [ecx - 6], al
mov al, byte [ebp - 0xb28]
ror dword [ebp - 0xb38], 8
mov byte [ecx - 2], al
ror dword [ebp - 0xb28], 8
mov al, byte [ebp - 0xb38]
mov byte [ecx - 7], al
mov al, byte [ebp - 0xb28]
mov byte [ecx - 3], al
add ecx, 8
mov esi, dword [ebp - 0xb38]
mov edi, dword [ebp - 0xb28]
mov eax, dword [ebp - 0xb4c]
ror esi, 8
ror edi, 8
sub dword [ebp - 0xbdc], 1
mov dword [ebp - 0xb1c], eax
mov eax, dword [ebp - 0xbf4]
mov dword [ebp - 0xaf4], ecx
mov ecx, dword [ebp - 0xb74]
mov dword [ebp - 0xb38], esi
mov dword [ebp - 0xb28], edi
mov dword [ebp - 0xc08], eax
jne 0xc01326
mov ebx, dword [ebp - 0xbc0]
mov ecx, dword [ebp - 0xbe0]
xor eax, eax
test ebx, ebx
je 0xc01697
xor dl, byte [eax + ecx]
inc eax
cmp eax, ebx
jb 0xc0168f
mov esi, dword [ebp - 0xc58]
movzx eax, dl
cdq
cmp eax, dword [ebx + esi]
jne 0xc01707
cmp edx, dword [ebx + esi + 4]
jne 0xc01707
xor eax, eax
mov edi, ecx
mov esi, ebx
mov ecx, eax
mov ebx, dword [ebp - 0xc80]
jmp 0xc0171a
xor ecx, ecx
mov edi, ecx
mov dword [ebp - 0xb28], edi
test esi, esi
jns 0xc012e9
neg esi
shl esi, 3
mov ecx, esi
shr eax, cl
shl eax, cl
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xb38], eax
jmp 0xc012e9
xor eax, eax
mov edi, eax
mov dword [ebp - 0xb1c], eax
mov esi, eax
mov dword [ebp - 0xb28], edi
mov dword [ebp - 0xb38], esi
jmp 0xc012f5
mov edi, dword [ebp - 0xc6c]
mov ebx, 0xc004d501
mov esi, dword [ebp - 0xc68]
xor eax, eax
test ecx, ecx
je 0xc0172d
push ecx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
js 0xc01748
xor ecx, ecx
mov dword [ebp - 0xbc4], edi
mov dword [ebp - 0xaa8], esi
mov edi, ecx
mov esi, 0x10000000
jmp 0xc0174f
mov esi, 0xd0000001
xor ecx, ecx
test edi, edi
je 0xc01764
push edi
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor ecx, ecx
test esi, esi
js 0xc019e0
mov edi, dword [ebp - 0xaa8]
push 4
pop ebx
mov dword [ebp - 0xb98], ecx
mov ecx, dword [ebp - 0xbc4]
mov dword [ebp - 0xc48], ecx
cmp edi, ebx
jb 0xc019d5
mov eax, dword [ecx]
mov edx, ebx
mov dword [ebp - 0xb4c], eax
lea eax, [ebp - 0xc48]
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc019da
lea eax, [ebp - 0xb98]
mov edx, ebx
push eax
xor ecx, ecx
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc019da
mov eax, edi
sub eax, dword [ebp - 0xb98]
cmp eax, ebx
jb 0xc019d5
mov ecx, dword [ebp - 0xc48]
lea eax, [ebp - 0xc48]
push eax
push 4
pop eax
mov ebx, dword [ecx]
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc019da
mov ecx, dword [ebp - 0xb98]
lea eax, [ebp - 0xb98]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc019da
mov ecx, dword [ebp - 0xb98]
mov eax, edi
sub eax, ecx
cmp eax, ebx
jb 0xc019d5
lea eax, [ebp - 0xb98]
mov edx, ebx
push eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc019da
mov edi, dword [ebp - 0xc48]
mov edx, dword [ebp - 0xaa8]
mov esi, dword [ebp - 0xbc4]
lea ecx, [edi + ebx]
lea eax, [edx + esi]
cmp eax, ecx
jb 0xc019d5
sub edx, edi
sub edx, ebx
add edx, esi
cmp edx, 8
jae 0xc019d5
xor ecx, ecx
mov dword [ebp - 0xb00], ecx
mov eax, ecx
mov dword [ebp - 0xba8], eax
mov esi, ecx
test edi, edi
je 0xc0196c
lea eax, [ebp - 0xc18]
mov dword [ebp - 0xb78], edi
push eax
mov edx, ebx
mov ecx, edi
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc019da
mov eax, dword [ebp - 0xc18]
cmp edi, eax
jae 0xc01962
lea eax, [ebp - 0xd68]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc019da
mov eax, dword [ebp - 0xc18]
cmp dword [ebp - 0xd68], eax
ja 0xc01991
mov edx, dword [ecx]
lea eax, [ebp - 0xd6c]
push eax
push 4
pop eax
mov ecx, eax
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc01912
mov eax, dword [ebp - 0xd6c]
mov dword [ebp - 0xd70], eax
jmp 0xc01918
mov eax, dword [ebp - 0xd70]
test esi, esi
js 0xc019da
lea ecx, [ebp - 0xc70]
mov edx, eax
push ecx
mov ecx, dword [ebp - 0xb78]
call fcn.00b84e9a
mov esi, eax
test esi, esi
js 0xc019da
mov ecx, dword [ebp - 0xc70]
mov eax, dword [ebp - 0xc18]
mov dword [ebp - 0xb78], ecx
cmp ecx, eax
ja 0xc01991
inc dword [ebp - 0xb00]
cmp ecx, eax
jb 0xc018be
cmp ecx, eax
jne 0xc01991
mov eax, dword [ebp - 0xba8]
test ebx, ebx
je 0xc0199c
push ebx
push 8
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
mov dword [ebp - 0xba8], eax
test eax, eax
jne 0xc01998
mov esi, 0xc0000017
jmp 0xc019c3
mov esi, 0xc000000d
jmp 0xc019da
xor ecx, ecx
mov esi, ecx
test edi, edi
je 0xc019b1
push ebx
push edi
push eax
call fcn.00bc13d0
mov eax, dword [ebp - 0xba8]
add esp, 0xc
mov dword [ebp - 0xce8], eax
mov eax, dword [ebp - 0xb00]
mov dword [ebp - 0xcf0], eax
test esi, esi
js 0xc019da
mov eax, dword [ebp - 0xb4c]
cmp eax, dword [ebp - 0xcf0]
je 0xc019da
mov esi, 0xc000003e
or esi, 0x10000000
mov ebx, dword [ebp - 0xa9c]
mov eax, dword [ebp - 0xad0]
test eax, eax
je 0xc01a01
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov edi, dword [ebp - 0xb94]
test edi, edi
je 0xc01a6f
xor eax, eax
cmp dword [edi + 4], eax
je 0xc01a28
push dword [edi + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0xc01a44
push dword [edi + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0xc], eax
cmp dword [edi + 0x14], 0
je 0xc01a60
push dword [edi + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [edi + 0x14], eax
push edi
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
je 0xc01a86
push ebx
xor ebx, ebx
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xc01a88
xor ebx, ebx
mov eax, dword [ebp - 0xbbc]
test eax, eax
je 0xc01aa1
push eax
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ebx, dword [ebp - 0xbfc]
test ebx, ebx
je 0xc01b0f
xor eax, eax
cmp dword [ebx + 4], eax
je 0xc01ac8
push dword [ebx + 4]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 4], eax
cmp dword [ebx + 0xc], 0
je 0xc01ae4
push dword [ebx + 0xc]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0xc], eax
cmp dword [ebx + 0x14], 0
je 0xc01b00
push dword [ebx + 0x14]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
xor eax, eax
mov dword [ebx + 0x14], eax
push ebx
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov eax, dword [ebp - 0xbc4]
test eax, eax
je 0xc01b2a
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
js 0xc01bcb
mov esi, dword [ebp - 0xcf0]
xor ebx, ebx
inc ebx
cmp esi, ebx
jb 0xc01bcb
mov ecx, dword [ebp - 0xce8]
test ecx, ecx
je 0xc01bcb
test esi, esi
je 0xc01bcb
lea eax, [ebp - 0xc40]
mov dword [ebp - 0xc40], ecx
push eax
push 4
pop edi
mov edx, edi
call fcn.00b84e9a
test eax, eax
js 0xc01bcb
mov eax, dword [ecx]
neg eax
sbb eax, eax
and eax, dword [ebp - 0xc40]
cmp dword [ecx], edi
jne 0xc01bcb
cmp dword [eax], 0
jl 0xc01bcb
cmp esi, ebx
jbe 0xc01bcb
xor eax, eax
mov dword [ebp - 0xc4c], ecx
mov esi, eax
mov edi, dword [ecx]
lea eax, [ebp - 0xc4c]
push eax
push 4
pop eax
mov edx, eax
call fcn.00b84e9a
test eax, eax
js 0xc01bcb
mov ecx, dword [ebp - 0xc4c]
lea eax, [ebp - 0xc4c]
push eax
mov edx, edi
call fcn.00b84e9a
test eax, eax
js 0xc01bcb
inc esi
cmp esi, ebx
jae 0xc01bcb
mov ecx, dword [ebp - 0xc4c]
jmp 0xc01b8f
mov esi, dword [ebp - 0xa98]
mov ebx, dword [ebp - 0xaa4]
mov eax, dword [ebp - 0xbe4]
test eax, eax
je 0xc01bf2
push eax
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
mov ecx, dword [ebp - 0xce8]
test ecx, ecx
je 0xc01c0d
push ecx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test esi, esi
je 0xc01c22
push esi
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
test ebx, ebx
je 0xb88170
push ebx
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb88170
push eax
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
jmp 0xb88202
cmp ebx, 0xd0000034
jne 0xc01c5b
mov ebx, esi
jmp 0xb88235
cmp ebx, 0xd00000e5
je 0xc01c7d
cmp ebx, 0xc004d501
je 0xc01c7d
cmp ebx, 0xd000003e
jne 0xc01c7f
mov ebx, 0xc004f028
jmp 0xb88235
mov ebx, edi
test ebx, ebx
jns 0xb88218
cmp ebx, 0x8007007a
jne 0xb88235
mov ebx, 0xc004f01e
jmp 0xb88235
xor ecx, ecx
jmp 0xb8824c
cmp ebx, 0xc004d500
jle 0xb8826c
mov dword [ebp - 0xc38], 2
mov ebx, ecx
test ebx, ebx
jns 0xb8828b
test byte [0xd0a5c4], 4
je 0xb882c1
push ebx
mov edx, 0xb3dbb0
mov ecx, 0xd08200
call fcn.00b8eed4
jmp 0xb882c1
cmp ebx, esi
je 0xb88289
mov ecx, ebx
call fcn.00c6c3ed
xor ecx, ecx
jmp 0xc01cbc
sub eax, 1
jne 0xb88289
mov dword [ebp - 0xc38], 3
jmp 0xb88289
cmp eax, 3
jne 0xb882c1
jmp 0xb882a1
push 0x90
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebx + 0x18]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SetWindowPos]
push dword [ebx + 0xc0]
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
xor eax, eax
mov ecx, ebx
mov byte [ebx + 0xad], al
call fcn.00cacf52
jmp 0xb882c1